Android逆向之旅—Frida检测与反检测.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "82d59677",
   "metadata": {},
   "source": [
    "# Frida检测与反检测\n",
    "\n",
    "\n",
    "## 一、Frida检测\n",
    "　　常见的Frida检测\n",
    "1. 检测frida-server文件名  \n",
    "2. 检测27042默认端口  \n",
    "3. 检测D-Bus  \n",
    "4. 检测/proc/pid/maps映射文件  \n",
    "5. 检测/proc/pid/tast/tid/stat或/proc/pid/tast/tid/status    \n",
    "6. 双进程保护  \n",
    "\n",
    "　　前两种可以通过修改frida-server文件名，修改默认端口绕过。双进程可以通过-f spawn模式启动绕过。其他的需要去hook修改。 \n",
    "　　\n",
    "\n",
    "## 二、Frida反检测\n",
    "\n",
    "### 2.1、检测点定位\n",
    "　　1、修改了frida-server文件名，以及服务端口，或尝试spawn启动，判定是否可以绕过检测。\n",
    "　　2、so文件查看：看看载入了那些so文件？\n",
    "```js\n",
    "function fridaProcess(){\n",
    "  Java.perform(function () {\n",
    "    var enumMoudle = Process.enumerateModules();\n",
    "    for (var i = 0; i < enumMoudle.length; i++){\n",
    "      console.log(\"\", enumMoudle[i].name)\n",
    "    }\n",
    "  });\n",
    "}\n",
    "\n",
    "setImmediate(fridaProcess,0)\n",
    "```\n",
    "　　3、so载入的时候，底层最后是open去打开的。所以再用frida去hook应用中的open函数，看看读取了哪些so或者文件，可以看到最后断在了/proc/self/maps（安全检测了/proc/pid/maps映射文件 ）。  \n",
    "```js\n",
    "\n",
    "var pth = Module.findExportByName(null,\"open\");\n",
    "    Interceptor.attach(ptr(pth),{\n",
    "        onEnter:function(args){\n",
    "            this.filename = args[0];\n",
    "            console.log(\"\",this.filename.readCString())\n",
    "            if (this.filename.readCString().indexOf(\".so\") != -1){\n",
    "                args[0] = ptr(0)\n",
    "\n",
    "            }\n",
    "\n",
    "        },onLeave:function(retval){\n",
    "            return retval;\n",
    "        }\n",
    "    })\n",
    "```\n",
    "### 2.2、/proc/pid/maps检测的原理分析与绕过\n",
    "#### 2.2.1、原理\n",
    "　　当挂上frida后，对应的maps文件中会出现re.frida.server之类的特征，这是在使用frida server的时候自动创建的，其中存放着frida的功能模块，可以在载入so的hook脚本输出中能看到最后也是断在frida-agent.so。  \n",
    "#### 2.2.2、绕过\n",
    "　　要绕过这个检测，可以通过备份一个正常启动时的maps文件（前提是：app不使用frida是能正常启动不闪退的）。 \n",
    "```js\n",
    "function main() {\n",
    "  const openPtr = Module.getExportByName('libc.so', 'open');\n",
    "  const open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);\n",
    "  var readPtr = Module.findExportByName(\"libc.so\", \"read\");\n",
    "  var read = new NativeFunction(readPtr, 'int', ['int', 'pointer', \"int\"]);\n",
    "  var fakePath = \"/data/data/com.app/maps\";\n",
    "  var file = new File(fakePath, \"w\");\n",
    "  var buffer = Memory.alloc(512);\n",
    "  Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {\n",
    "      var pathname = Memory.readUtf8String(pathnameptr);\n",
    "      var realFd = open(pathnameptr, flag);\n",
    "      if (pathname.indexOf(\"maps\") >= 0) {\n",
    "          while (parseInt(read(realFd, buffer, 512)) !== 0) {\n",
    "              var oneLine = Memory.readCString(buffer);\n",
    "              if (oneLine.indexOf(\"tmp\") === -1) {\n",
    "                  file.write(oneLine);\n",
    "              }\n",
    "          }\n",
    "          var filename = Memory.allocUtf8String(fakePath);\n",
    "          return open(filename, flag);\n",
    "      }\n",
    "      var fd = open(pathnameptr, flag);\n",
    "      return fd;\n",
    "  }, 'int', ['pointer', 'int']));\n",
    "}\n",
    "setImmediate(main)\n",
    "```"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.12"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}