[jacobocasado]

Relates to #4005. Supersedes #4006.

Description

Draft / WIP: This branch is not ready for review. It still needs to address @cpholguera's feedback on collecting outputs from logs and on making observations reproducible when detection is not visible on screen or in logs. These are two related themes across three inline comments on #4006.

Adds three Android behavioral detection tests for root, emulator, and hooking, with accompanying demos for root and emulator. Also adds the static emulator detection test from @sgIOlas's work and a separate native hooking demo for the existing instrumentation-based test. The behavioral hooking test does not yet have a demo.

The behavioral tests run the app under the selected condition and evaluate its response according to its risk profile. Root and emulator observation does not require Frida. In the hooking test, Frida supplies the test stimulus rather than tracing the app's detection logic.

Implemented changes

• Add behavioral tests MASTG-TEST-0x01 (root), MASTG-TEST-0x02 (emulator), and MASTG-TEST-0x04 (hooking).
• Add behavioral demos MASTG-DEMO-0x01 (root) and MASTG-DEMO-0x02 (emulator).
• Add the static emulator test MASTG-TEST-0x03.
• Add a native hooking/bypass demo MASTG-DEMO-0x03 associated with the existing dynamic MASTG-TEST-0341; keep MASTG-DEMO-0108 unchanged from upstream.
• Reuse existing sample code and manifests through relative symlinks so the demo build includes the shared inputs.
• Align the shared emulator sample, documentation, and trace after removing the Build.SERIAL and Build.USER checks.
• Include the KernelSU tool reference used by the root test's false-negative discussion.

Related: #3987.

Coverage after this PR

This matrix covers Android root, emulator, hook, and debugger detection in MASTG. It distinguishes static analysis, instrumentation-based dynamic analysis, and behavioral testing.

New marks additions in this PR. A dash means no dedicated test or directly associated demo was identified. Temporary 0x IDs will be replaced during review.

Test approach	Root detection	Emulator detection	Hook detection	Debugger detection
Static	Test: MASTG-TEST-0324 Demo: MASTG-DEMO-0087	New test: MASTG-TEST-0x03 Demo: —	Test: — Demo: —	Test: MASTG-TEST-0352 Demos: MASTG-DEMO-0115, MASTG-DEMO-0116
Dynamic (instrumentation-based)	Test: MASTG-TEST-0325 Demo: MASTG-DEMO-0088	Test: MASTG-TEST-0351 Demo: MASTG-DEMO-0114	Test: MASTG-TEST-0341 Demos: MASTG-DEMO-0106, MASTG-DEMO-0107, MASTG-DEMO-0108, new MASTG-DEMO-0x03	Test: MASTG-TEST-0353 Demo: —
Behavioral	New test: MASTG-TEST-0x01 New demo: MASTG-DEMO-0x01	New test: MASTG-TEST-0x02 New demo: MASTG-DEMO-0x02	New test: MASTG-TEST-0x04 Demo: —	Test: — Demo: —

Remaining gaps

• A demo for the new static emulator detection test.
• A behavioral hooking demo for MASTG-TEST-0x04.
• A static hook detection test and accompanying demo.
• A demo for the existing dynamic debugger detection test.
• A behavioral debugger detection test and accompanying demo.

Completing the remaining coverage is outside this PR's scope and is left for later.

Validation

• Scoped Markdown lint: all 11 changed/new Markdown files pass with the repository lint configuration.
• git diff --check, shell syntax, and JavaScript syntax checks pass for this branch.
• Changed-file relative symlinks resolve.
• Earlier local Android emulator checks confirmed the shared emulator sample's permission/grant/rerun flow. These checks did not validate the native hooking demo.

A full website build, the native demo's runtime behavior, and the full device/environment matrix were not validated locally for this branch. Further review and validation remain WIP.

---

AI Tool Disclosure

• This contribution does not include AI-generated content.

• This contribution includes AI-generated content.

• AI tools used: Pi coding agent with the OpenAI Codex provider.

• Models and versions: openai-codex/gpt-6.1-sol (runtime model identifier).

• Prompt summary: Review MASTG conventions, align behavioral test evaluation with risk-appropriate responses, reuse demo inputs, validate local sample behavior, and prepare the issue, PR, and coverage matrix. Reconcile this draft with the revised branch and @cpholguera's review feedback. The contributor reviewed and corrected the proposed wording and scope throughout the process.

• Your mobile security expertise level: high.

Contributor Checklist

• I have read and understood the contributing guidelines.
• I followed the project style guide.
• I validated the technical correctness of my changes and understand the topic. (Pending WIP review and native demo validation.)
• This PR adds clear value and is not spam or low-effort content.