Emulator detection

Spotting a fake phone, such as an app running on a simulated device.

An emulator is software that pretends to be a phone on a computer. Emulator detection recognizes that the app is not running on a real handset.

Identification of virtualized runtimes, rooted devices, and instrumentation frameworks during capture. A virtualized runtime is a simulated phone environment, a rooted device is one whose built-in security restrictions have been removed, and an instrumentation framework is a tool that can alter how an app behaves while it runs.

Emulator detection looks for signs that a device is not what it claims to be:

• Virtual hardware, such as sensors, battery, and camera details that look simulated.
• Altered operating systems, such as rooted or jailbroken devices.
• Hooking tools, which are frameworks that intercept and change what the app sees, such as the camera feed.
• Inconsistent device details, such as a model that does not match its reported capabilities.

A typical check works like this:

1. The app collects signals about the device and runtime.
2. The system compares them with what a genuine device would show.
3. It flags signs of simulation or tampering as risk signals.
4. It blocks the session or asks for a stronger check.

Emulator detection sits next to terms that are easy to mix up:

• Injection attack feeds fake data into the app, and emulators are a common way to do it.
• Device fingerprinting recognizes a device from its attributes, and the same attributes can reveal an emulator.
• Bot attack traffic often runs on emulators because they are cheap to multiply.