/

Emulator Detection

Protection Module: EmulatorDetection

Detects if your application is running in an emulator or compatibility layer instead of native hardware.

Available for:

  • Desktop Applications (Windows, Linux, macOS)
  • Mobile Applications (iOS Simulator, Android Emulators)
  • Cross-platform Applications

How It Works

Emulator Detection identifies when applications run in emulated or compatibility layer environments rather than on native hardware/OS.

Detection Methods:

Desktop Emulators

  • Wine Detection - Identifies Wine compatibility layer on Linux/macOS
  • System DLL Analysis - Checks for Wine-specific libraries
  • Registry Patterns - Wine-specific registry entries
  • Process Names - Wine processes (wine-preloader, wineserver)

Mobile Emulators

  • Android Emulator Detection:

    • QEMU-specific properties (ro.kernel.qemu)
    • Emulator build fingerprints
    • Generic device names ("generic", "sdk", "google_sdk")
    • Sensor availability checks
    • Telephony features
    • Battery characteristics

  • iOS Simulator Detection:

    • Simulator build configuration
    • Hardware model strings
    • File system characteristics
    • System framework differences

Common Emulators Detected:

  • Wine / CrossOver / Proton
  • Android Studio Emulator
  • Genymotion
  • BlueStacks
  • MEmu
  • NoxPlayer
  • LDPlayer
  • iOS Simulator (Xcode)

Configuration

JSON Configuration

JSON
{
  "protections": {
    "EmulatorDetection": {
      "enabled": true,
      "action": "log"
    }
  }
}

Code-Based Configuration

C#
await Payload.ConfigureAsync(config =>
{
    config.AddProtection(ProtectionModuleType.EmulatorDetection, ActionType.Log);
});

Advanced Configuration

JSON
{
  "protections": {
    "EmulatorDetection": {
      "enabled": true,
      "action": "close",
      "intervalMs": 120000,
      "config": {
        "detectWine": true,
        "detectAndroidEmulators": true,
        "detectIOSSimulator": true,
        "allowDevelopmentEmulators": false
      }
    }
  }
}

Available Actions

ActionBehaviorRecommended For
CloseTerminate applicationGaming apps, DRM-protected content
LogRecord detection and continueAnalytics, development
CustomExecute custom handlerConditional features, warnings
NoneDetect onlyTesting configurations

Configuration Parameters

JSON
{
  "config": {
    "detectWine": true,
    "detectAndroidEmulators": true,
    "detectIOSSimulator": true,
    "allowDevelopmentEmulators": false
  }
}
ParameterDescriptionDefault
detectWineDetect Wine compatibility layertrue
detectAndroidEmulatorsDetect Android emulatorstrue
detectIOSSimulatorDetect iOS Simulatortrue
allowDevelopmentEmulatorsAllow official dev emulators (Xcode, Android Studio)false

When to Use

Recommended for:

  • Gaming Applications - Prevent cheating via emulator tools
  • DRM Content - Protect video/audio from emulator recording
  • Security-Critical Apps - Banking, payment apps (combined with Jailbreak Detection)
  • In-App Purchases - Prevent emulator-based purchase fraud
  • Geolocation Apps - Prevent fake GPS in emulators

Not recommended for:

  • Applications designed to run on Wine (Linux compatibility)
  • Developer tools that target emulators
  • Applications with legitimate emulator use cases

Code Examples

Development vs Production

C#
await Payload.ConfigureAsync(config =>
{
#if DEBUG
    // Allow emulators during development
    config.AddProtection(ProtectionModuleType.EmulatorDetection, ActionType.None);
#else
    // Block in production
    config.AddProtection(ProtectionModuleType.EmulatorDetection, ActionType.Close);
#endif
});

Mobile-Specific Detection

C#
config.RegisterCustomAction("mobile-emulator-alert", async (threat) =>
{
    var emulatorType = threat.Metadata["emulatorType"]?.ToString();

#if ANDROID || IOS
    // Show warning for mobile emulators
    var continueApp = await Application.Current.MainPage.DisplayAlert(
        "Emulator Detected",
        $"This app appears to be running in an emulator ({emulatorType}). " +
        "Some features may not work correctly.",
        "Continue Anyway",
        "Exit"
    );

    if (!continueApp)
    {
        Environment.Exit(0);
    }
#endif
});

Wine Detection with Graceful Fallback

C#
config.RegisterCustomAction("wine-handler", async (threat) =>
{
    if (OperatingSystem.IsLinux() || OperatingSystem.IsMacOS())
    {
        var isWine = threat.Metadata.ContainsKey("wine");

        if (isWine)
        {
            // Log Wine usage
            await AnalyticsService.TrackEvent("wine_detected", new
            {
                WineVersion = threat.Metadata["wineVersion"],
                Platform = Environment.OSVersion
            });

            // Optionally show compatibility notice
            Console.WriteLine("Running via Wine. Some features may have limited support.");
        }
    }
});

config.AddProtection(ProtectionModuleType.EmulatorDetection, "wine-handler");

Gaming Anti-Cheat

C#
config.RegisterCustomAction("gaming-emulator-check", async (threat) =>
{
    var emulatorType = threat.Metadata["emulatorType"]?.ToString();

    // Log to anti-cheat system
    await AntiCheatService.ReportViolation(new
    {
        Type = "EmulatorDetected",
        Emulator = emulatorType,
        PlayerId = CurrentPlayer.Id,
        Timestamp = DateTime.UtcNow
    });

    // Show ban message
    await ShowMessageAsync(
        "Emulator Detected",
        "This game cannot be played on emulators. Your account may be flagged for review."
    );

    await Task.Delay(5000);
    Environment.Exit(-1);
});

Platform-Specific Behavior

Windows (Wine Detection)

C#
// Wine creates specific registry keys
// HKEY_CURRENT_USER\Software\Wine
// Checks for wine.dll, ntdll.dll signatures

Android

C#
// Build fingerprint contains "generic" or "sdk"
// android.os.Build.FINGERPRINT
// android.os.Build.MODEL
// android.os.Build.MANUFACTURER

iOS

C#
// Simulator has different processor architecture
// TARGET_OS_SIMULATOR preprocessor flag
// Different system framework behavior

Performance Impact

Detection Time:

  • Desktop: 30-100ms
  • Mobile: 50-150ms

CPU Usage: Minimal Memory: <500 KB

Recommended Interval: 120000ms (2 minutes)

Platform Compatibility

PlatformSupportEmulators Detected
Windows✔Wine (on Linux/macOS via compatibility)
Linux✔Wine, Android emulators
macOS✔Wine, iOS Simulator, Android emulators
Android✔Android Studio, Genymotion, BlueStacks, etc.
iOS✔iOS Simulator
.NET MAUI✔Full support
Xamarin✔Full support

Threat Detection Details

JSON
{
  "threatId": "EMU-2025-12-28-7890",
  "description": "Emulator environment detected",
  "moduleType": "EmulatorDetection",
  "detectedAt": "2025-12-28T15:30:45Z",
  "confidence": 0.92,
  "metadata": {
    "emulatorType": "android-emulator",
    "detectionMethod": "build-fingerprint",
    "buildFingerprint": "google/sdk_gphone_x86/generic_x86:11/RSR1.201013.001/6903271:userdebug/test-keys",
    "deviceModel": "sdk_gphone_x86",
    "manufacturer": "Google",
    "isQemu": true
  }
}

Next Steps

Virtual Machine Detection

Detect VMs

Actions

Configure responses

Mobile Installation

MAUI/Xamarin setup

Previous
Virtual Machine Detection
Next
Jailbreak Detection