Kubian combines hardware-backed integrity with a continuous native protection runtime and a verification backend. Three layers, one trust decision. Studio-controlled enforcement — without building an internal anti-cheat team.
At session start, libKubianIntegrity.so runs a two-step exchange gated on the core library's hardware token: fetch a single-use challenge, mint a fresh Android KeyStore EC key bound to that nonce (StrongBox-first, TEE fallback), then trade the attestation chain — Build fingerprint, Android ID, Widevine ID and security level — for an integrity token. libKubianIntegrityCertificate.so provisions the one-time device certificate the same way, wiping key material from memory after use. The verification backend validates the certificate chain and signature cryptographically — X.509 and ECDSA verification run in native C via pyca/cryptography on OpenSSL 3.x, with KeyMint attestation structures DER-decoded via pyasn1 (cached per certificate).
A native protection loop (libKubianIntegrityCore.so) sweeps the running process and system every 2s — TracerPid debugger attach, Frida maps/ports/anon-exec, Zygisk / Riru / LSPosed / Magisk / KernelSU hooks, su paths, test-keys and debuggable properties, SELinux enforce state, memfd leaks, and a self .text hash against tampering, with ptrace TRACEME anti-debug. Detections are reported to the backend in realtime, bans are re-polled every 10s, device certificates auto-refresh, and enforcing checks terminate the process on Kick/Ban.
Every realtime detection carries its own policy. For each check — Frida, injection, root, debugger, anti-debug — teams independently enable Alert, Kick, or Ban, or any combination. Bans are permanent, executed server-side on the device, and enforced network-wide across all protected apps.
Every challenge is unique and single-use, so integrity responses cannot be replayed.
These are selected public capabilities, not a complete inventory. Additional safeguards remain intentionally undisclosed to keep the suite effective.
Every realtime check maps to its own policy. Actions are independent, so a check can Alert only, Ban + Alert, Kick + Alert, or any other combination — per detection.
Log the detection to the offenders audit with full context for your team's review. No kick, no ban.
Remove the player from the active session. No server ban is issued, so a repeat offense can be escalated later.
Remove the player from the session and execute a permanent server ban on the device. Bans are enforced network-wide across all protected apps.
| Realtime check | What it detects | Default actions |
|---|---|---|
| Frida Detection | Frida server presence and connection attempts | Alert |
| Injection Detection | Xposed, Zygisk, LSPosed, Substrate and runtime hooking frameworks | Alert |
| Root (Hard) | su binaries, uid 0, Magisk / KernelSU mounts and hidden root | Ban Alert |
| Root (Soft) | SELinux permissive, test-keys builds, insecure / debuggable properties | Kick Alert |
| Debugger Detection | Attached debuggers via TracerPid | Kick Alert |
| Anti-Debug Trap | ptrace / seccomp trap that blocks debugger attachment | Alert |
The realtime policy is cryptographically signed by Kubian and recalculated every 30s asynchronously — a tampered response is rejected and the library falls back to full protection. When a ban is issued mid-session, the client detects it through a ban-state poll and enforces it immediately, even across restarts.
Kubian ships with an operational dashboard your team uses to watch, review, and enforce what happens on protected devices. Here is what each section is for.
Live counts of players validated, offenders flagged, pending reviews, and active bans, plus a 24-hour API request chart and the recent offender feed. This is where your team starts each day.
The integrity policy. Every realtime check — Frida, injection, root (hard), root (soft), debugger, anti-debug — is switched on or off and assigned Alert, Kick, or Ban actions. Device, hardware, and application checks are configured here too.
Every registered player on the project, searchable by UID, with registration date and verification history.
The audit log. Every detection records the check that fired, the timestamp, the device, and the action that was taken — so your team can review and escalate.
Team access with Owner, Admin, and Member roles — who can view, review, and manage the project.
Project name, ownership, and the App ID and App Secret your SDK uses to authenticate requests to the verification backend. Secrets can be regenerated if compromised.
The release APK is pinned to the project once, locking the Application SHA-256 and package name that integrity must match. This can only be done a single time.
The destructive action. Permanently purges the project, its keys, bans, players, logs, and members. There is no recovery.
Dashboard settings are recalculated every 30s asynchronously to avoid double-request edge cases, and the realtime policy they control is cryptographically signed by Kubian — a tampered response is rejected and the library falls back to full protection. Saved settings are still served out extremely fast.
Low, scaling prices. Kubian Mini at $60/month and Kubian Max at $80/month, per application. Direct integration support on every plan.