如何破解运动世界校园模拟器检测

来源：互联网发布：监管网络的部门编辑：程序博客网时间：2024/04/25 02:47

最早用安卓上的Packet Capture 抓到http包只要删除对应模拟器文件就可以
后来变成了https 又对emulatorUrls进行了加密再追加了几个文件就难倒了一批菜鸡
软件使用360加固直接逆向难度不小选择曲线救国
第一次用Flidder的auto responder 直接把emulatorUrls的值清零返回.成功
过段时间压抑不住自己的好奇心就是想知道它检测了那些文件遂开始学习用xposed来hook API倒是一猜就中是java.io.File.exists
根据http://www.52pojie.cn/thread-534126-1-1.html 的教程先hook360的ClassLoader 就能hook我想要的java.io.File.exists了
函数声明 public boolean exists()
只要hook时param.thisObject.toString().contains(“模拟器文件关键字”) 修改返回值为false

运行效果

全部源码

package com.bc.hook;import android.content.Context;import de.robv.android.xposed.IXposedHookLoadPackage;import de.robv.android.xposed.XC_MethodHook;import de.robv.android.xposed.XposedBridge;import de.robv.android.xposed.XposedHelpers;import de.robv.android.xposed.callbacks.XC_LoadPackage;public class Main implements IXposedHookLoadPackage {    private String TAG = "BC";    @Override    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {        if (!loadPackageParam.packageName.equals("com.zjwh.android_wh_physicalfitness"))            return;        XposedBridge.log("Loaded app: " + loadPackageParam.packageName);        //hook加固后的包，首先hook getNewAppInstance这个方法来获取context对象        XposedHelpers.findAndHookMethod("com.qihoo.util.StubApp1211622898", loadPackageParam.classLoader,                "getNewAppInstance", Context.class, new XC_MethodHook() {                    @Override                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {                        super.afterHookedMethod(param);                        //获取到360的Context对象，通过这个对象来获取classloader                        Context context = (Context) param.args[0];                        //获取360的classloader，之后hook加固后的就使用这个classloader                        ClassLoader classLoader = context.getClassLoader();                        //下面就是强classloader修改成360的classloader就可以成功的hook了                        XposedHelpers.findAndHookMethod("java.io.File", classLoader, "exists", new XC_MethodHook() {                            @Override                            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {                                super.beforeHookedMethod(param);                                XposedBridge.log("被检文件:" + param.thisObject);                            }                            protected void afterHookedMethod(MethodHookParam param) throws Throwable {                                super.afterHookedMethod(param);                                if (param.thisObject.toString().contains("Nox") || param.thisObject.toString().contains("nox") || param.thisObject.toString().contains("stacks") || param.thisObject.toString().contains("Tian") || param.thisObject.toString().contains("tian")) {                                    param.setResult(false);                                    XposedBridge.log(TAG + "返回值设为false");                                }                                XposedBridge.log(TAG + "返回值: " + param.getResult());                            }                        });                    }                });    }}

阅读全文

0 0