Android Java层的hook检测(Cydia Substrate或者Xposed框架)
来源:互联网 发布:js定义map集合 编辑:程序博客网 时间:2024/06/05 22:45
参考原文 http://d3adend.org/blog/?p=589
参考翻译 http://drops.wooyun.org/tips/16356
注意:原文中第3个方法“检测并不应该native的native方法”没有实现。
检测代码如下:
import java.io.BufferedReader;import java.io.FileReader;import java.util.HashSet;import java.util.List;import java.util.Set;import android.content.Context;import android.content.pm.ApplicationInfo;import android.content.pm.PackageManager;import android.util.Log;/** * 检测native hook框架:Cydia Substrate、Xposed * * @author admin * */public class FindHook {private static boolean findHookAppName(Context context) {PackageManager packageManager = context.getPackageManager();List<ApplicationInfo> applicationInfoList = packageManager.getInstalledApplications(PackageManager.GET_META_DATA);for (ApplicationInfo applicationInfo : applicationInfoList) {if (applicationInfo.packageName.equals("de.robv.android.xposed.installer")) {Log.wtf("HookDetection", "Xposed found on the system.");return true;}if (applicationInfo.packageName.equals("com.saurik.substrate")) {Log.wtf("HookDetection", "Substrate found on the system.");return true;}}return false;}private static boolean findHookAppFile() {try {Set<String> libraries = new HashSet<String>();String mapsFilename = "/proc/" + android.os.Process.myPid() + "/maps";BufferedReader reader = new BufferedReader(new FileReader(mapsFilename));String line;while ((line = reader.readLine()) != null) {if (line.endsWith(".so") || line.endsWith(".jar")) {int n = line.lastIndexOf(" ");libraries.add(line.substring(n + 1));}}reader.close();for (String library : libraries) {if (library.contains("com.saurik.substrate")) {Log.wtf("HookDetection", "Substrate shared object found: " + library);return true;}if (library.contains("XposedBridge.jar")) {Log.wtf("HookDetection", "Xposed JAR found: " + library);return true;}}} catch (Exception e) {Log.wtf("HookDetection", e.toString());}return false;}// 1. 如果存在Xposed框架hook// (1)在dalvik.system.NativeStart.main方法后出现de.robv.android.xposed.XposedBridge.main调用// (2)如果Xposed hook了调用栈里的一个方法,// 还会有de.robv.android.xposed.XposedBridge.handleHookedMethod// 和de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative调用// 2. 如果存在Substrate框架hook// (1)dalvik.system.NativeStart.main调用后会出现2次com.android.internal.os.ZygoteInit.main,而不是一次。// (2)如果Substrate hook了调用栈里的一个方法,// 还会出现com.saurik.substrate.MS$2.invoked,com.saurik.substrate.MS$MethodPointer.invoke还有跟Substrate扩展相关的方法private static boolean findHookStack() {try {throw new Exception("findhook");} catch (Exception e) {// 读取栈信息// for(StackTraceElement stackTraceElement : e.getStackTrace()) {// Log.wtf("HookDetection", stackTraceElement.getClassName() + "->"+// stackTraceElement.getMethodName());// }int zygoteInitCallCount = 0;for (StackTraceElement stackTraceElement : e.getStackTrace()) {if (stackTraceElement.getClassName().equals("com.android.internal.os.ZygoteInit")) {zygoteInitCallCount++;if (zygoteInitCallCount == 2) {Log.wtf("HookDetection", "Substrate is active on the device.");return true;}}if (stackTraceElement.getClassName().equals("com.saurik.substrate.MS$2")&& stackTraceElement.getMethodName().equals("invoked")) {Log.wtf("HookDetection", "A method on the stack trace has been hooked using Substrate.");return true;}if (stackTraceElement.getClassName().equals("de.robv.android.xposed.XposedBridge")&& stackTraceElement.getMethodName().equals("main")) {Log.wtf("HookDetection", "Xposed is active on the device.");return true;}if (stackTraceElement.getClassName().equals("de.robv.android.xposed.XposedBridge")&& stackTraceElement.getMethodName().equals("handleHookedMethod")) {Log.wtf("HookDetection", "A method on the stack trace has been hooked using Xposed.");return true;}}}return false;}public static boolean isHook(Context context) {if (findHookAppName(context) || findHookAppFile() || findHookStack()) {return true;}return false;}}
检测绕过的方法
对应如下:
hook PackageManager的getInstalledApplications,把Xposed或者Substrate的包名去掉
hook Exception的getStackTrace,把自己的方法去掉
hook 打开的文件的操作,返回/dev/null或者修改的map文件
2 0
- Android Java层的hook检测(Cydia Substrate或者Xposed框架)
- Cydia Substrate框架Android so hook分析
- 利用Cydia Substrate进行Android JAVA HOOK
- Cydia Substrate Android SO Hook
- Android逆向之旅---Native层的Hook神器Cydia Substrate使用详解
- Android逆向之旅---Native层的Hook神器Cydia Substrate使用详解
- 改造 Cydia Substrate 框架用于函数内代码的HOOK
- 利用Cydia Substrate进行Android HOOK (1)
- 利用Cydia Substrate进行Android HOOK(2)
- Android上玩玩Hook(1):Cydia Substrate初识
- Android HOOK工具Cydia Substrate使用详解
- Android HOOK工具Cydia Substrate使用详解
- Android上玩玩Hook:Cydia Substrate实战
- Android上玩玩Hook:Cydia Substrate实战
- Android上玩玩Hook:Cydia Substrate实战
- Android上玩玩Hook:Cydia Substrate实战
- 利用Cydia Substrate进行Android HOOK
- Android上玩玩Hook:Cydia Substrate实战
- Git版本控制策略
- UIBezierPath 使用
- ADT下载地址(含各版本),最新ADT-23.0.6
- Unity3D在windows10下小问题解决
- Executing spatial queries
- Android Java层的hook检测(Cydia Substrate或者Xposed框架)
- Android只GLSurfaceView画立方体测试代码
- 分享pdf表格转换成excel的转换方法
- 使用Jsoup解析html网页
- 如何查看表和索引的统计信息
- Spring的quartz定时器
- 字符串结尾‘0’和‘\0’的区别
- 配置JAVA环境变量
- iOS 探讨之 动态二维码