Version 6.5.0 (March 2024)

Supported platform versions

• App Shielding version 6.5.0 was successfully tested with Android 14.

• Android 5.0 (API level 21) – Android 14 (API level 34).

• Shielding Tool:

  • Windows 10: 64-bit Java 17

  • Mac OSX (10.9+)

  • Ubuntu Linux 20.04 LTS or 22.04 LTS

• The App Shielding Gradle plugin version 2.0 and later is supported.

  This plugin supports Android App Bundles and newer Android build versions.

  You can download the plugin and documentation from:

  • Gradle plugin

  • Gradle plugin documentation

Android platform updates

The Android minimum supported version is 5.0 (API level 21). This version of App Shielding supports Android 14.

As of March 1, 2024, App Shielding for Android version 4.3.11.78273 and earlier are no longer supported. For more information, refer to the OneSpan Customer Portal at https://cp.onespan.com/.

Deprecations

Platform minimum supported versions

Android 4.4 (API levels 19 and 20) are no longer supported by App Shielding. The new minimum supported version is Android Lollipop 5.0 (API level 21).

Android Native Development Kit (NDK)

Google has announced that Android Native Development Kit (NDK) (r26) will no longer support KitKat (API levels 19 and 20). The minimum version supported by the NDK for r26 will be Lollipop (API level 21).

App Shielding switches to NDK r26 after its release as LTS version.

Deprecated APIs

The API for the deprecated ForegroundOverrideData feature has been removed and is no longer supported.

Deprecated methods

The CallbackManager.setExtendedObserver(observer) and CallbackManager.removeObserver() methods have been deprecated and will be removed in one of the upcoming versions of App Shielding, Instead of these, use

• CallbackManager.addObserver(observer)

• CallbackManager.removeObserver(observer)

New features and other updates

Automatic detection of FjordPhantom anti-malware

New configuration options

No longer distrust system keyboards on rooted devices

Third-party code: LibreSSL upgraded

Fixes and other updates

Improved Shielding Tool class name obfuscation

Fixed App Shielding runtime file descriptor leak

Documentation fixes: details for callback methods missing

Documentation fixes: incorrect dependencies for configuration options

Documentation fixes: unused error message removed

SHAND-3165: Fixed Shielding Tool warnings about configuration options

SHAND-3426: Improved App Shielding runtime Java debugger detection

SHAND-3666: Improved hiding of App Shielding

SHAND-3720: Fixed Java class name obfuscation

Description: An issue with the Java class name obfuscation was fixed. The Shielding Tool previously failed to obfuscate all classes if you enabled full Java class name obfuscation.

Status: This issue has been fixed. All Java class namees can now be obfuscated via the following line in a rules.cfg file:

~~~
cfg
include "builtin:obfuscate-on.cfg";
 ~~~

SHAND-3730: Fixed unexpected termination with UnsupportedOperationException

SHAND-3766 and SHAND-3895: App Shielding runtime performance

SHAND-3784: Fixed issue with internal error reporting

SHAND-3800: Fixed unexpected termination when starting a shielded app

SHAND-3824: Fixed the handling of mapping files inside an app bundle

Improved detection mechanisms

Description: A number of detection mechanisms has been improved. These improvements are:

• Improved rooting detection. The detection of devices rooted with rooting toolkits like Magisk manager, Magisk Hide, KernelSU, and Zygisk has been improved.

• Improved hooking framework detection. The detection of the following hooking frameworks has been improved:

  • LSPosed

  • MultiApp

  • Riru

  • XPosed

• Improved native code hook detection.

  App Shielding has been improved in detecting hooking frameworks that inject hooks into the application's native libraries. As part of the native code hook detection, App Shielding can be configured to verify the native libraries of your app. For example, your rules.cfg file can use the following line:

  ~~~
  cfg
  verify "lib/arm64-v8a/libmy-native.so";
  ~~~

  The App Shielding native library is always verified. Other native libraries of the application need to be added explicitly. In some situations, App Shielding encountered a race condition when the application loaded several native libraries from different threads. This could have caused a false positive. Now, the race condition is properly handled.

• SHAND-3804 and SHAND-3937: Improved emulator detection. The detection of the mogume cloud emulator and BlueStacks emulator has been improved.

• SHAND-3973: Improved ADB status detection.App Shielding now detects if Android Developer Bridge (ADB) has been enabled with tools like the WADB - Wireless ADB enabler. This tool can enable ADB without changing the Android system settings. For more information, refer to the Play Store page on WADB.

SHAND-3865: Fixed parsing applications that used non-ASCII characters

SHAND-3901 and SHAND-3938: Fixed false positive on emulated input detection

Improved navigation obfuscation

Several navigation obfuscation mechanisms have been improved:

• Obfuscation of navigation actions: If a navigation component uses an action element with an app:argType, and the class name of that app:argType is obfuscated, the Shielding Tool now correctly updates the resource file with the obfuscated class names. Without this fix, the application would crash when trying to use the action.

  ~~~
  xml
  <navigation ...>
    <fragment ....>
      <action
        android:name="exampleData"
        app:argType="com.example.DataType" />
    </fragment>
  </navigation>
  ~~~

  For more information, refer to Use Navigation actions and Fragments in the Android Developer documentation.

• SHAND-3899: Obfuscation of navigation dialogs: If a navigation component uses a dialog element and the class name of that dialog is obfuscated, the Shielding Tool now correctly updates the resource file with the obfuscated class names. Without this fix, the application would crash when trying to load the dialog.

  ~~~
  xml
  <navigation ...>
    ...  
    <dialog....>
      android:id="@+id/myDialog"
      android:name="com.example.MyDialog"
      android:label="MyDialog" />
  </navigation>
  ~~~

  For more information, refer to Dialog destinations in the Android Developer documentation.

SHAND-3922: Support Shielding Tool rules with volatile and transient flags

Shielding Tool rules can now use the flags volatile and transient when selecting methods.

To obfuscate all volatile methods, your rules.cfg file can use the following:

~~~
cfg
match class * { obfuscate volatile *; }
~~~

SHAND-3923: Fixed race condition on excluding activities from screenshot protection

Description: App Shielding can be configured to block all screenshots and given rules that allow screenshots on selected activities. You can block screenshots by enabling the Block Screenshots option on the App Shielding Configuration page in the OneSpan Customer Portal.

In the Shielding Tool rules.cfg file, you can override this setting by allowing screenshots for one or more individual activities.

~~~
cfg
allowScreenshotsForActivity com.example.MyScreenShotEnabledActivity;
~~~

In some cases, when the application switched from an activity for which screenshots were blocked to an activity for which screenshots were explicitly allowed, App Shielding did not unblock the screenshots due to a race condition.

Status: This issue has been fixed.

SHAND-3975 and SHAND-3982: Fixed unexpected terminations of the Shielding Tool

SHAND-3985: Fixed Shielding Tool rules that used annotations

Description: For rules that used annotations the Shielding Tool did not match the annotations correctly.

Status: This issue has been fixed.

If you do not want to obfuscate any members that are annotated with the gson @SerializedName annotation, your rules.cfg file can now use the following without any issues:

~~~
cfg
match class * {
  preserve @com.google.gson.annotations.SerializedName <members>;
}
~~~

SHAND-3993: Extended the ShieldSDK callbacks for untrusted installer apps

Known limitations

The limitations described here have not yet been solved for the current Mobile Application Shielding version. Possible workarounds are described where available.

Magisk and root hider tools on new Android

Root hider tools such as Magisk Hide are designed to hide the fact that the device is compromised (rooted). Android has been increasingly restricted in what can be inspected and observed of the system from inside an app. This means that a rooted system with a root hider tool can be hard to detect due to missing privileges.

On Android 8+, App Shielding may not able to reliably detect a rooted device with Magisk Hide depending on the version of these tools.

New Android version with 16k page size

Google announced that Android is moving from a 4KB page size to a 16KB page size in Android15. 16KB page hardware will be available in the market in the future, as well. The current version of App Shielding does not yet run on the new Android 15 images with a 16KB page size, but OneSpan is working on updating the App Shielding native libraries to no longer assume that the page size is 4K.

Android App Bundles

The OneSpan Customer Portal support for Android App Bundles does not yet include instant-enabled app bundles