> For the complete documentation index, see [llms.txt](https://docs.talsec.app/appsec-articles/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.talsec.app/appsec-articles/articles/whats-new-in-freerasp-bootloader-detection.md).

# What's New in freeRASP: Bootloader Detection

## What's New in freeRASP: Bootloader Detection

freeRASP shipped across all seven distributions. The headline is a new threat signal: bootloader detection. If the device your app runs on has an unlocked bootloader, you now get told about it.

<figure><img src="/files/aIusLUnBeijIHvGI7743" alt=""><figcaption></figcaption></figure>

<table data-search="false"><thead><tr><th>Platform</th><th>Version</th></tr></thead><tbody><tr><td>Android</td><td>19.2.1</td></tr><tr><td>iOS</td><td>7.1.2</td></tr><tr><td>Flutter</td><td>8.2.1</td></tr><tr><td>React Native</td><td>5.2.0</td></tr><tr><td>Kotlin Multiplatform</td><td>2.1.0</td></tr><tr><td>Capacitor</td><td>3.2.0</td></tr><tr><td>Cordova</td><td>9.1.0</td></tr></tbody></table>

### Bootloader detection

* The bootloader is the first code that runs at power-on, and the anchor for Verified Boot. Locked bootloader, intact boot chain. Unlocked, no chain.
* Unlocking is rarely the goal. It is the prerequisite for flashing a custom ROM, installing persistent root, or building a device that looks normal while fully instrumented.
* By the time you catch Frida or Magisk, you are catching step two. Bootloader state is step one.
* The check uses hardware-backed Key Attestation, not system properties like `ro.boot.verifiedbootstate`, which a rooted device can trivially spoof.
* Android only. iOS has no unlock path.

### Handling the new threat

Arrives through the listener you already registered. Names differ per platform:

| Platform             | Callback                   |
| -------------------- | -------------------------- |
| Android              | `onBootloader()`           |
| Flutter              | `onBootloader`             |
| React Native         | `bootloader`               |
| Kotlin Multiplatform | `FreeRaspEvent.Bootloader` |
| Capacitor            | `bootloader`               |
| Cordova              | `bootloader`               |

Note that Android's `ThreatDetected` is an abstract class, so nothing forces you to implement the new method. Add it deliberately or the events go nowhere.

### Improved root, hook, and Frida detection

* **KernelSU.** Roots via kernel module rather than patching the system partition, so the classic indicators (`su` in `/system/bin`, a Magisk directory, a modified `boot.img`) are not there to find. Detection watches kernel-level behaviour instead. Covered since 18.0.4, tightened here.
* **Hook and Frida.** Modern Frida usage leans on gadget injection and in-memory instrumentation that never touches disk, so detection keeps moving toward runtime memory inspection.
* General root detection improvements.

### Improvements on iOS

* Improved jailbreak detection in 7.1.2.
* Coming from an older version, you also pick up 7.1.1: postponed checks, where slower subchecks defer until after the initial startup pass instead of blocking launch, plus improved hook detection.
* Cordova and KMP get both this release. Flutter, React Native and Capacitor already had them.

### Bugfixes

* Native crash from a `std::terminate()` race condition
* Root detection crashing in obfuscated release builds, which is the configuration you ship
* Hardware-backed keystore detection failing with `NoSuchMethodError` on some Android 12+ devices
* Periodic hook and root checks overwriting each other
* Crash inside `AppZygotePreload` during root detection (Flutter and React Native)

### Breaking change

Native Android integrators only, since the wrappers absorb it: the package namespace moved from `com.aheaditec.talsec_security` to `app.talsec.rasp`, and the callback methods on `ThreatListener.ThreatDetected` and `ThreatListener.DeviceState` were renamed. Check the Android integration docs for the new signatures.

### How to upgrade

Bump the version, add a handler for the bootloader callback, and if you are on native Android, budget time for the namespace migration.

Full per-platform changelog at [docs.talsec.app](https://docs.talsec.app/freerasp/freerasp/whats-new-and-changelog). Bootloader detection has [its own page](https://docs.talsec.app/freerasp/freerasp/wiki/threat-detection/bootloader-detection-android-only). Found something odd? Open an issue on the relevant repository. A good chunk of this release's fix list started there.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.talsec.app/appsec-articles/articles/whats-new-in-freerasp-bootloader-detection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.