What's New in freeRASP: Bootloader Detection

What's New in freeRASP: Bootloader Detection

freeRASP shipped across all seven distributions. The headline is a new threat signal: bootloader detection. If the device your app runs on has an unlocked bootloader, you now get told about it.

Platform	Version
Android	19.2.1
iOS	7.1.2
Flutter	8.2.1
React Native	5.2.0
Kotlin Multiplatform	2.1.0
Capacitor	3.2.0
Cordova	9.1.0

Bootloader detection

• The bootloader is the first code that runs at power-on, and the anchor for Verified Boot. Locked bootloader, intact boot chain. Unlocked, no chain.

• Unlocking is rarely the goal. It is the prerequisite for flashing a custom ROM, installing persistent root, or building a device that looks normal while fully instrumented.

• By the time you catch Frida or Magisk, you are catching step two. Bootloader state is step one.

• The check uses hardware-backed Key Attestation, not system properties like ro.boot.verifiedbootstate, which a rooted device can trivially spoof.

• Android only. iOS has no unlock path.

Handling the new threat

Arrives through the listener you already registered. Names differ per platform:

Platform	Callback
Android	onBootloader()
Flutter	onBootloader
React Native	bootloader
Kotlin Multiplatform	FreeRaspEvent.Bootloader
Capacitor	bootloader
Cordova	bootloader

Note that Android's ThreatDetected is an abstract class, so nothing forces you to implement the new method. Add it deliberately or the events go nowhere.

Improved root, hook, and Frida detection

• KernelSU. Roots via kernel module rather than patching the system partition, so the classic indicators (su in /system/bin, a Magisk directory, a modified boot.img) are not there to find. Detection watches kernel-level behaviour instead. Covered since 18.0.4, tightened here.

• Hook and Frida. Modern Frida usage leans on gadget injection and in-memory instrumentation that never touches disk, so detection keeps moving toward runtime memory inspection.

• General root detection improvements.

Improvements on iOS

• Improved jailbreak detection in 7.1.2.

• Coming from an older version, you also pick up 7.1.1: postponed checks, where slower subchecks defer until after the initial startup pass instead of blocking launch, plus improved hook detection.

• Cordova and KMP get both this release. Flutter, React Native and Capacitor already had them.

Bugfixes

• Native crash from a std::terminate() race condition

• Root detection crashing in obfuscated release builds, which is the configuration you ship

• Hardware-backed keystore detection failing with NoSuchMethodError on some Android 12+ devices

• Periodic hook and root checks overwriting each other

• Crash inside AppZygotePreload during root detection (Flutter and React Native)

Breaking change

Native Android integrators only, since the wrappers absorb it: the package namespace moved from com.aheaditec.talsec_security to app.talsec.rasp, and the callback methods on ThreatListener.ThreatDetected and ThreatListener.DeviceState were renamed. Check the Android integration docs for the new signatures.

How to upgrade

Bump the version, add a handler for the bootloader callback, and if you are on native Android, budget time for the namespace migration.

Full per-platform changelog at docs.talsec.app. Bootloader detection has its own page. Found something odd? Open an issue on the relevant repository. A good chunk of this release's fix list started there.