> For the complete documentation index, see [llms.txt](https://docs.talsec.app/premium-products/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.talsec.app/premium-products/product/rasp.md).
# RASP+
RASP+ is Talsec’s premium in‑app protection SDK for In-App Protection and Shielding
**RASP+ SDK** (Runtime App Self Protection and Monitoring) provides in-app protection and shielding. It combats reverse engineering, device/OS integrity compromise (like **rooting**, running in an **emulator**, using a **debugger** or dynamic **hooking**), and **Malware** attacks such as **Accessibility services misuse**, **screen readers**, and **Overlay attacks**. RASP SDK subscription includes SDK integration with the Audit portal based on the Elastic Cloud managed service controlled by the Customer.
Due to **hundreds of different security controls**, a RASP-protected App becomes "aware" of risk factors coming from compromises of the OS and/or app execution environment. Threat signals are also sent to the monitoring and auditing backend for security analysis and alarming by automatic watchers.
That breadth is deliberate: RASP+ targets the compromised environment rather than one tool at a time. On Android that means privileged access and the layers built to conceal it — **su**, **Magisk** and **Magisk Delta**, **Zygisk**, **KernelSU**, **APatch**, **Shamiko**, **HideMyApplist**, **Vector**, alongside the tools like **SuperSU** and **KingRoot**. RASP+ does not claim a dedicated signature for each module in these ecosystems; the layered privileged-access and integrity checks mean environments assembled from such tools are commonly identified even where no tool-specific check applies.
On iOS the same logic covers the jailbreak toolchain and its hiding layer — **unc0ver**, **checkra1n**, **palera1n**, **Taurine**, **Dopamine** and **Serotonin**, together with concealment tweaks such as **Shadow** and package managers including **Cydia**, **Sileo** and **Zebra**.
The same applies to instrumentation and tampering. RASP+ looks for the traces left by hooking frameworks — **Frida**, **objection**, **Xposed**, **LSPosed**, **EdXposed** on Android, **Cydia Substrate** and **libhooker** on iOS — and for the marks of repackaging and cloning left by **apktool**, **JADX**, **Lucky Patcher**, **LSPatch**, **Parallel Space**, and **App Cloner**.
{% hint style="info" %}
Premium Users: View [premium documentation here](https://docs.talsec.app/premium-integration-documentations/).
{% endhint %}
***RASP+** is the more advanced premium commercial edition, with* [***freeRASP***](https://docs.talsec.app/freerasp/freerasp/introduction) *provided as a free community alternative. Unlike freeRASP, which ships as one universal binary for all customers, RASP+ builds are hardened and individualized per app — bound to your signing certificate, package name and individual secrets key material. Reactions to detected threats also execute at the native, obfuscated layer rather than in application code.*
For pricing information, differences between freeRASP and RASP+, or to request a demo, visit [Talsec](https://talsec.app/).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.talsec.app/premium-products/product/rasp.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
