Events

A protected app runs its checks when it starts, then every minute while it is open, and reports what each check observed. Each report is an event. The "Events" tab of "Mobile ADR" lists the events of all your protected apps, newest first.

An app protected with some checks turned off never reports the events of those checks. See Protect an app to choose the checks.

See the events

• In "Mobile ADR", click "Events".

  

• Each row is one event:

  • "Check": the name of the event, such as hook.maps_hits, and under it the source the app read it from, such as the process's memory map.
  • "Status": whether the check could run. See Statuses.
  • "Value": what the check observed, such as true, a number, or a list of names. An empty list, [], means the check found nothing.
  • "Application": the protected app that reported it.
  • "Build": the build ID of the protected copy, the same as in the "Builds" tab.
  • "Received": when Mobile ADR received the event. Hover over it to see the exact date and time.

  

• Read the value to see what was found. Here, the hooking check of an Android app found the Frida agent loaded in the app: hook.maps_hits lists frida-agent-64.so.

  

• The newest events show first. Click "Load older events" at the bottom of the list to see older ones.

See the events of one app

• In the "Applications" tab, click the "View events" icon on the app's row.

  

• The "Events" tab opens with only that app's events, and shows "Events of" and the app's name. Click the x on it to see the events of all your apps again.

  

Statuses

The status tells whether the check could run, not whether it found a threat: read the value for that.

Status	Meaning
OK	The check ran. The value is what it observed.
Unsupported	The check can't run on this device or system version, for example a jailbreak check on the iOS Simulator. It has no value.
Error	The check ran but failed, for example because the system refused a request. It has no value.
Timeout	The check did not finish in time. It has no value.

The events of each check

Each event name starts with its check: root. for Root, hook. for Hooking and instrumentation, and so on.

Check	Android events	iOS events	What a finding looks like
Root	root.fs_paths, root.build_props, root.mounts, root.rw_mounts, root.selinux_enforcing		Root files such as /system/xbin/su or /sbin/magisk, a system partition mounted writable, SELinux not enforcing.
Jailbreak		jb.fs_paths, jb.sandbox_escape, jb.fork_ok	Jailbreak files such as /Applications/Cydia.app, or the app can write outside its sandbox or start a process.
Debugger	dbg.tracer_pid	dbg.traced, dbg.parent	A debugger attached to the app, or an app not launched by iOS.
Hooking and instrumentation	hook.maps_hits, hook.rwx_regions	hook.maps_hits, hook.dyld_env, hook.frida_port, hook.rwx_regions	Frida, Substrate or Xposed loaded in the app, the Frida port open, injected libraries, memory both writable and executable.
Code integrity	integ.text_sha256		The protection's code in memory differs from the installed file, for example patched by a hook.
Network interception	mitm.tunnels, mitm.user_cas	mitm.tunnels, mitm.proxies, mitm.user_cas	A VPN tunnel up, or on iOS a proxy configured. mitm.user_cas lists the user-installed certificates on Android devices that let the app read them, and is reported as Unsupported elsewhere, always on iOS.
App identity	id.package, id.uid, id.code_path	id.bundle_id, id.team_id, id.cdhash	A package name, bundle ID or signing team that is not your app's, or the app running from another app's folder.
Emulator	emu.props	emu.simulator	Emulator build properties on Android, or true on the iOS Simulator.
Virtualization and app cloning		virt.exec_path, virt.foreign_images	The app runs inside another app's container.