Android - App Libraries - Monitor (Pro)

The built code for your game is stored inside the Android library files. These are a common target for cheaters who manipulate the code to gain advantages. However, it is often far too difficult or costly to change the actual code, so cheaters inject their own libraries instead of modifying the existing ones.

You can detect this injection by validating the libraries found within your application.

Monitor

The 'AndroidPackageLibraryMonitor' (class AndroidPackageLibraryMonitor, namespace GUPS.AntiCheat.Monitor.Android) reads all files located in the app's library directory, for example {APK}\lib\armeabi-v7a\. When the libraries have been read, it emits an AndroidLibraryStatus to its observers.

Status

The monitor emits an AndroidLibraryStatus, which implements IAndroidStatus (and therefore IWatchedSubject):

public struct AndroidLibraryStatus : IAndroidStatus
{
    // True if the libraries could not be retrieved (e.g. a JNI failure).
    public bool FailedToRetrieveData { get; }

    // The names of the native libraries bundled in the running app (APK/AAB).
    public List<string> Libraries { get; }
}

• FailedToRetrieveData: True when the libraries could not be retrieved or an exception occurred; the list is then not valid.
• Libraries: The names of the native libraries bundled in the app.

Lifecycle and timing

The monitor reads the libraries once, in its OnStart callback, and then notifies observers a single time with the resulting AndroidLibraryStatus. If the libraries could not be read, it still notifies with FailedToRetrieveData set to true.

Configuration

There are no inspector fields on this monitor. The whitelisted and blacklisted libraries are configured in the AntiCheat project settings and validated by the detector (see 'Detect Disallowed Libraries'). Go to 'Project Settings -> GuardingPearSoftware -> AntiCheat' and open the 'Android - App Library - Settings' section.

In the AntiCheat Project Settings, apply the library whitelist and blacklist settings.

To find the libraries of your app, open the built app with a zip file manager, go to the library directory (for example lib\armeabi-v7a\), and enter the full library names, including the extension.

Example: Libraries found in a built Android app.

Development builds

The paired detector honors the global 'Verify development builds' switch. By default it validates the app only in release builds, so the check is skipped in development builds and inside the Unity editor. Enable this option in 'Project Settings -> GuardingPearSoftware -> AntiCheat' while testing.

Enable 'Verify development builds' to also validate the app in development builds and the editor.

Supported Platforms

The monitor is only available on Android platforms.

Requirements

Requires an Android build with at least Android 4.4 (API level 19) (December 2013).

How To Use

Attach the 'AndroidPackageLibraryMonitor' to a child GameObject of the 'AntiCheat-Monitor' and pair it with the 'AndroidPackageTamperingDetector'.

Add Monitor Component

Add the 'AndroidPackageLibraryMonitor' MonoBehavior from the 'GUPS.AntiCheat.Monitor.Android' namespace to your 'AntiCheat-Monitor' GameObject, or better, to a child GameObject.

Add the 'AndroidPackageLibraryMonitor' as a Component.

Consume the status in code

Besides pairing the monitor with a detector, you can subscribe your own observer to receive the AndroidLibraryStatus directly. Every monitor derives from AMonitor and exposes Subscribe(IObserver<IWatchedSubject>), which returns an IDisposable you can dispose to unsubscribe.

using System;
using GUPS.AntiCheat.Core.Watch;
using GUPS.AntiCheat.Monitor.Android;
using UnityEngine;

public class AndroidLibraryStatusLogger : MonoBehaviour, IObserver<IWatchedSubject>
{
    private void Start()
    {
        var monitor = GetComponentInChildren<AndroidPackageLibraryMonitor>();
        monitor.Subscribe(this);
    }

    public void OnNext(IWatchedSubject subject)
    {
        if (subject is AndroidLibraryStatus status)
        {
            if (status.FailedToRetrieveData)
            {
                Debug.LogWarning("Could not read the app libraries.");
                return;
            }

            Debug.Log($"Found {status.Libraries.Count} libraries.");
        }
    }

    public void OnError(Exception error) { }
    public void OnCompleted() { }
}

Detect Disallowed Libraries

To react to the sent status and thus validate the found libraries, you need a detector. To do this, use the 'AndroidPackageTamperingDetector', an aggregated detector that can react to various attempts to tamper with the Android app itself.