【Android 逆向】frida 检测绕过
1. aaa.apk 安装到手机，是一个叫玩吧的应用
./hooker
......
23248 浏 览 器 com.browser2345_oem
32541 玩吧 com.wodi.who
2447 电话和短信存储 com.android.providers.telephony
2447 电话服务 com.android.phone
3264 电量和性能 com.miui.powerkeeper
......
2. 启动hluda版frida server hluda-server-14.2.13-android-arm64 绕过一些对frida特征的检查
执行 frida -Uf com.wodi.who --no-pause,直接崩溃退出
Spawned `com.wodi.who`. Resuming main thread!
[MI 5X::com.wodi.who]-> Process terminated
[MI 5X::com.wodi.who]->
说明有对frida 附着到进程存在检测
3. 常用检测有 对 TracerPid 的检测，参考r0trace 的方案进行绕过
var ByPassTracerPid = function () {
var fgetsPtr = Module.findExportByName("libc.so", "fgets");
var fgets = new NativeFunction(fgetsPtr, 'pointer', ['pointer', 'int', 'pointer']);
Interceptor.replace(fgetsPtr, new NativeCallback(function (buffer, size, fp) {
var retval = fgets(buffer, size, fp);
var bufstr = Memory.readUtf8String(buffer);
if (bufstr.indexOf("TracerPid:") > -1) {
Memory.writeUtf8String(buffer, "TracerPid:\t0");
console.log("tracerpid replaced: " + Memory.readUtf8String(buffer));
}
return retval;
}, 'pointer', ['pointer', 'int', 'pointer']));
};
日志
Spawned `com.wodi.who`. Resuming main thread!
[MI 5X::com.wodi.who]-> tracerpid replaced: TracerPid: 0
Process terminated
[MI 5X::com.wodi.who]->
还是不行，看来还有别的地方检测
4.尝试hook pthread_create 来看一下哪里调用到了它
function hook_func() {
var pthread_creat_addr = Module.findExportByName("libc.so", "pthread_create")
Interceptor.attach(pthread_creat_addr,{
onEnter(args){
console.log("call pthread_create...")
let func_addr = args[2]
console.log("The thread function address is " + func_addr)
console.log('pthread_create called from:\n'
+ Thread.backtrace(this.context, Backtracer.ACCURATE)
.map(DebugSymbol.fromAddress)
.join('\n')
+ '\n');
}
})
}
执行日志：
call pthread_create...
The thread function address is 0xc0512129
The libmsaoaidsec.so base 0xc0501000
pthread_create called from:
0xc05123fd libmsaoaidsec.so!0x113fd
0xc0511ab7 libmsaoaidsec.so!0x10ab7
0xc0511bc1 libmsaoaidsec.so!0x10bc1
0xc050d5b9 libmsaoaidsec.so!_init+0x1ac
0xec63662b
......
tracerpid replaced: TracerPid: 0
Process terminated
可以看到 libmsaoaidsec.so 执行了0x113fd 后好像就出问题了，而且这个是在_init+0x1ac，很值得怀疑,看一下反汇编的代码
0xc0512129 - 0xc0501000 = 0x11129
可以看到这里看起来一个线程搞事情
int sub_113E0()
{
_DWORD *v0; // r4
pthread_t v2; // [sp+0h] [bp-10h] BYREF
int v3; // [sp+4h] [bp-Ch]
v0 = off_1FC04;
v3 = *(_DWORD *)off_1FC04;
pthread_create(&v2, 0, (void *(*)(void *))sub_11128, 0);
return *v0 - v3;
}
那么hook 掉这个 sub_11128 ，让他啥也不干,对应偏移地址 0x000113E0
Interceptor.replace(module.base.add(0x00011128+1), new NativeCallback(function() {
console.log("0x00011129 replace success!!!")
}, 'void', []))
执行日志
***
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'xiaomi/tiffany/tiffany:8.1.0/OPM1.171019.019/V11.0.3.0.ODBCNXM:user/release-keys'
Revision: '0'
ABI: 'arm'
pid: 12322, tid: 12322, name: com.wodi.who >>> com.wodi.who <<<
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x32b1
r0 0000c6dd r1 0000008c r2 8ea8c4cb r3 0000023d
r4 00000000 r5 0008d5f4 r6 00003225 r7 000001aa
r8 dd932900 r9 ffd70784 sl 00000000 fp ffd70878
ip ea1a962c sp ffd6e638 lr c052bc95 pc c052bc96 cpsr 200f0030
backtrace:
#00 pc 00001c96 /data/app/com.wodi.who-Gf4PUi4Emat5i9N3B4wFBA==/lib/arm/libmsaoaidsec.so (offset 0x12000)
#01 pc 00001c91 /data/app/com.wodi.who-Gf4PUi4Emat5i9N3B4wFBA==/lib/arm/libmsaoaidsec.so (offset 0x12000)
***
还是崩了，说明还有地方在检测，比如这个00001c96+0x12000处，
可以看到这里在检测linker的情况，查询了符号表和字符串表，估计实在检查一些函数是否被hook，那先hooker当前这个函数
Interceptor.replace(module.base.add(0x00013AB0+1), new NativeCallback(function() {
console.log("0x00013AB1 replace success!!!")
}, 'void', []))
注意： Thumb指令的地址 ，hook的时候要加1，然后就ok了，进程不再崩溃，执行frida命令ok
日志
Process
tracerpid replaced: TracerPid: 0
tracerpid replaced: TracerPid: 0
[MI 5X::com.wodi.who]-> Process
{
"arch": "arm",
"codeSigningPolicy": "optional",
"id": 12563,
"pageSize": 4096,
"platform": "linux",
"pointerSize": 4
}
[MI 5X::com.wodi.who]-> tracerpid replaced: TracerPid: 0
全部代码
var ByPassTracerPid = function () {
var fgetsPtr = Module.findExportByName("libc.so", "fgets");
var fgets = new NativeFunction(fgetsPtr, 'pointer', ['pointer', 'int', 'pointer']);
Interceptor.replace(fgetsPtr, new NativeCallback(function (buffer, size, fp) {
var retval = fgets(buffer, size, fp);
var bufstr = Memory.readUtf8String(buffer);
if (bufstr.indexOf("TracerPid:") > -1) {
Memory.writeUtf8String(buffer, "TracerPid:\t0");
console.log("tracerpid replaced: " + Memory.readUtf8String(buffer));
}
return retval;
}, 'pointer', ['pointer', 'int', 'pointer']));
};
//setImmediate(ByPassTracerPid);
function hook_dlopen(soName) {
Interceptor.attach(Module.findExportByName(null, "dlopen"),
{
onEnter: function (args) {
var pathptr = args[0];
if (pathptr !== undefined && pathptr != null) {
var path = ptr(pathptr).readCString();
if (path.indexOf(soName) >= 0) {
this.is_can_hook = true;
}
}
},
onLeave: function (retval) {
if (this.is_can_hook) {
console.log("hook start...");
hook_func()
}
}
}
);
Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
{
onEnter: function (args) {
var pathptr = args[0];
if (pathptr !== undefined && pathptr != null) {
var path = ptr(pathptr).readCString();
if (path.indexOf(soName) >= 0) {
this.is_can_hook = true;
}
}
},
onLeave: function (retval) {
if (this.is_can_hook) {
console.log("hook start...");
hook_func()
}
}
}
);
}
function hook_func() {
var pthread_creat_addr = Module.findExportByName("libc.so", "pthread_create")
Interceptor.attach(pthread_creat_addr,{
onEnter(args){
console.log("call pthread_create...")
let func_addr = args[2]
console.log("The thread function address is " + func_addr)
let libmsaoaidsec = Process.findModuleByName("libmsaoaidsec.so")
if (libmsaoaidsec != null){
console.log("The libmsaoaidsec.so base " + libmsaoaidsec.base)
bypass_thread(libmsaoaidsec)
}
console.log('pthread_create called from:\n'
+ Thread.backtrace(this.context, Backtracer.ACCURATE)
.map(DebugSymbol.fromAddress)
.join('\n')
+ '\n');
}
})
}
function bypass_thread(module) {
// Interceptor.replace(module.base.add(0x0000FA98+1), new NativeCallback(function() {
// console.log("0x0000FA99 replace success!!!")
// }, 'void', []))
Interceptor.replace(module.base.add(0x00011128+1), new NativeCallback(function() {
console.log("0x00011129 replace success!!!")
}, 'void', []))
P
}
function main() {
ByPassTracerPid()
hook_dlopen("libc.so")
}
setImmediate(main)
