Modern mobile location-based services (LBS) rely almost exclusively on
high-level operating system APIs (e.g., Location.isMock()). However, this architectural trust model is fundamentally flawed: malicious actors using rooted environments and dynamic instrumentation frameworks (such as LSPosed,Frida, or Magisk) can easily hook the Android runtime and force isMock() to return false. Furthermore, off-the-shelf mock GPS apps can emulate realistic routes and micro-jitter satellite drift, rendering standard geofencing and anti-spoofing checks obsolete.
• The Research/Engineering Gap:
How can an Android endpoint reliably verify physical presence when the
operating system’s software APIs can no longer be trusted?
• How both projects fit:
• MockGPS serves as the Adversarial Benchmark / Attack Harness:
Generates controllable ground-truth attacks (continuous route walking,variable speeds, micro-drift, and background injection).
• IgotU serves as the Zero-Trust Defense Framework: Cross-examines
high-level coordinates against raw GNSS hardware satellite
constellations (active SV count ≥ 3, carrier-to-noise ratio C/N₀) and kinematic inertial sensor fusion (accelerometer variance vs. GPS
velocity).