[IMPROVEMENT] Remove hooking requirement on TEST-0325 and MASTG-DEMO-0088

Overview

MASTG-TEST-0325 "verifies whether an app implements runtime root detection by attempting to hook into common root detection mechanisms.". Following this same test design, MASTG-DEMO-0088 uses Frooky to hook and monitor the attempts made by the demo app to access all the root-related files in the filesystem.

This may be suitable for a demo but not for a real app target. In the real world you want to isolate the test case and potential IoCs as much as possible. Once you start using hooking to verify a seemingly different detection such as root, you are put into a tricky scenario where you cannot directly tell whether the app's RASP is reacting to your device being rooted or the hooks you are applying.

Proposal

Use a runtime behavior check instead. Open the app on a rooted device without any hiding mechanisms enabled and exercise the different protected user flows. If the app behaves different than expected, bails out, or restricts access to functionality the test passes.