flutter_bshield_callback 4.1.0

Flutter callback BShield.

BShield Flutter Plugin

Flutter plugin for BShield SDK — OS protection callbacks and API protection.

Installation

dependencies:
  flutter_bshield_callback: ^4.1.0

Android — Proguard/R8

-keep class io.bshield.** { *; }
-keep class okio.** { *; }

---

OS Protection

Read protection data

Returns the encrypted device report. Use this when you need to send the report to the BShield dashboard on a custom schedule or interval instead of relying on Shield's automatic reporting.

import 'package:flutter_bshield_callback/flutter_bshield_callback.dart';

Uint8List shieldData = await FlutterBShieldCallback.readData();

Attach custom parameters to reports

await FlutterBShieldCallback.insertParameter("user_id", "123456");

Trigger remote config update

await FlutterBShieldCallback.updateConfig();

Re-check device

await FlutterBShieldCallback.retry();

Read encrypted assets

Uint8List data = await FlutterBShieldCallback.readAssets("test.txt");

---

Real-time protection status

Subscribe to receive callbacks whenever Shield re-checks the device and detects a change in protection status.

final subscription = FlutterBShieldCallback.osProtectionStatusStream.listen(
  (List<int> flags) {
    // flags contains the active detection flag codes (see table below)
    if (flags.contains(5)) {
      // device is rooted
    }
  },
);

// Cancel when done
subscription.cancel();

Detection flag codes:

Flag	Description
5	Root
6	Unlock bootloader
10	ADB enabled
11	Developer options enabled
12	Custom ROM
14	Unknown sources enabled
15	Blacklisted app detected
16	Untrusted keyboard
17	Work profile
19	System proxy
21	Possible root
22	Possible hook
23	VPN

Get current detection flags

One-shot read of the current flags without subscribing to the stream.

List<int> flags = await FlutterBShieldCallback.getDetectFlags();

---

Accessibility service detection (Android only)

Use these when the block_accessibility config is disabled and you want to build a custom UI explaining why certain apps are blocked.

// Check if any accessibility service is currently blocked
bool blocked = await FlutterBShieldCallback.isAccessibilityBlocked();

// List of blocked accessibility service package names
List<String> packages = await FlutterBShieldCallback.getBlockedAccessibilityPackageList();

// Same list with app name included (for display in UI)
List<BShieldAccessibilityPackageInfo> infos =
    await FlutterBShieldCallback.getBlockedAccessibilityPackageInfoList();
for (final info in infos) {
  print('${info.appName} — ${info.packageName}');
}

When building a custom UI for accessibility blocking, set accessibility: false in the BShield config so Shield does not show its default dialog.

---

Blocked packages (Android only)

Returns the list of packages currently blocked by Shield (used for custom UI when block_blacklist_package is false).

List<String> blocked = await FlutterBShieldCallback.getBlockedPackages();

---

Active keyboard info (Android only)

Use this to collect keyboard information before deciding whether to add a keyboard to the whitelist_keyboard_list config.

BShieldKeyboardInfo? keyboard = await FlutterBShieldCallback.getActiveKeyboardInfo();
if (keyboard != null) {
  print(keyboard.packageName);       // package name of the active keyboard
  print(keyboard.isSystemKeyboard);  // true if it is the system default keyboard
}

---

API Protection

BShield API Protection protects your server APIs against:

• API attacks — requests injected from outside the app or from unshielded apps are blocked before reaching your server
• Mass data scraping — bot scripts and mobile farms exploiting search/lookup APIs to harvest and sell user data
• API abuse — fake account creation, identity fraud, promotion abuse, and illegal transactions via automated scripts
• Password and OTP brute-force — automated scripts attempting to crack credentials or OTP codes

Two modes are available, configured via api_shield in the BShield config:

• Mode 1 (Signing) — Shield signs the request URL and body, attaching the signature as headers Xqcode and Xqsig. The server verifies the signature.
• Mode 2 (Encryption) — Shield encrypts the full request URL and body. The server decrypts them.

Mode 1 — Manual signing (Callback SDK)

Use generateSignature when you need to attach the signature manually (e.g. custom HTTP client, non-OkHttp clients).

import 'dart:convert';
import 'package:http/http.dart' as http;

final urlString = 'https://api.example.com/v1/endpoint';
final body = jsonEncode({'key': 'value'});
final bodyBytes = Uint8List.fromList(utf8.encode(body));

final shieldCode = await FlutterBShieldCallback.getShieldCode();
final signature  = await FlutterBShieldCallback.generateSignature(urlString, bodyBytes, 'POST');

final response = await http.post(
  Uri.parse(urlString),
  headers: {
    'Content-Type': 'application/json',
    'xqcode': shieldCode.toString(),
    'xqsig': base64Encode(signature),
  },
  body: body,
);

Mode 2 — Manual encryption (Callback SDK)

Use encryptRequest when you need to encrypt the request manually.

final urlString = 'https://api.example.com/v1/endpoint';
final bodyBytes = Uint8List.fromList(utf8.encode(jsonEncode({'key': 'value'})));

final shieldCode     = await FlutterBShieldCallback.getShieldCode();
final encryptedBody  = await FlutterBShieldCallback.encryptRequest(urlString, bodyBytes, 'POST');

final response = await http.post(
  Uri.parse(urlString),
  headers: {
    'Content-Type': 'application/json',
    'xqcode': shieldCode.toString(),
  },
  body: encryptedBody,
);

On Android, BShield supports zero-code integration for OkHttp — Shield automatically injects headers or encrypts requests without any Callback SDK. On iOS, this is supported automatically for NSURLSession/NSURLConnection (including Alamofire). The Callback SDK is for custom clients or advanced use cases.