Android安全- 关于hunter检测的隐藏_游戏逆向|游戏安全|yxfzedu.com

检测点

图片描述

Find Xposed Api

这种最好过的了, 直接自编译一下lsposed, 改改包名类名就行了.

Hunter可能已经被注入

这种就是有可执行的匿名内存, 参考: c8eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6J5k6i4k6W2L8Y4W2Q4x3V1k6m8L8X3c8J5L8$3W2V1i4K6u0V1e0r3W2T1M7X3q4J5P5g2)9J5k6q4u0W2L8h3q4H3i4K6u0V1d9r3W2V1k6b7`.`.
我的方法是open一个/system/lib下的正常so文件(要求文件大小比内存块大), mmap后, move内存后mremap回去, 但有些应用会崩溃,原因没查出来, 所以看看就好, 生产环境不能用, 过hunter momo nativeTest是没有问题的

底下那一堆Find JVM Method Is Hooked也是在匿名内存搞定后就没了

inMemoryDexClassLoader

这个就更好过了

jmethodID initMid;
if (sdk_int < __ANDROID_API_Q__) {
    // f45K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0M7#2)9J5k6h3q4F1k6s2u0G2K9h3c8Q4x3X3g2U0L8$3#2Q4x3V1k6S2L8X3c8J5L8$3W2V1i4K6u0r3M7r3I4S2N6r3k6G2M7X3#2Q4x3V1k6K6N6i4m8W2M7Y4m8J5L8$3A6W2j5%4c8Q4x3V1k6Q4x3V1u0Q4x3V1k6S2L8X3c8J5L8$3W2V1i4K6u0V1z5g2)9J5k6e0m8Q4x3X3f1H3i4K6g2X3M7U0q4Q4x3@1q4D9K9h3u0U0L8%4u0W2i4K6u0r3k6r3q4D9N6X3W2C8i4K6u0r3M7%4u0U0i4K6u0r3L8h3q4A6L8W2)9J5c8X3A6S2N6X3q4Q4x3V1k6V1j5h3I4$3K9h3E0Q4x3V1k6K6P5i4y4@1k6h3#2Q4x3V1k6n7j5i4y4W2c8r3g2^5b7$3I4S2M7%4y4x3L8$3q4V1k6i4u0Q4x3X3g2B7j5i4k6S2i4K6y4n7L8q4)9K6c8o6p5J5x3H3`.`.
    initMid = JNI_GetMethodID(env, in_memory_classloader, "<init>",
                              "([Ljava/nio/ByteBuffer;Ljava/lang/ClassLoader;)V");
} else {
    // 265K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0M7#2)9J5k6h3q4F1k6s2u0G2K9h3c8Q4x3X3g2U0L8$3#2Q4x3V1k6S2L8X3c8J5L8$3W2V1i4K6u0r3M7r3I4S2N6r3k6G2M7X3#2Q4x3V1k6K6N6i4m8W2M7Y4m8J5L8$3A6W2j5%4c8Q4x3V1k6Q4x3V1u0Q4x3V1k6S2L8X3c8J5L8$3W2V1i4K6u0V1x3e0m8Q4x3X3f1H3i4K6u0W2x3q4)9#2k6Y4t1I4i4K6y4m8L8r3W2T1j5$3!0J5k6g2)9J5c8X3c8S2L8s2k6A6K9#2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3k6r3q4D9N6X3W2C8i4K6u0r3M7%4W2K6N6r3g2E0i4K6u0r3b7X3q4K6k6f1c8W2P5p5y4D9j5i4y4K6e0r3!0S2k6r3g2J5i4K6u0W2K9X3q4$3j5g2)9K6b7X3I4Q4x3@1b7I4y4K6x3`.
    initMid = JNI_GetMethodID(env, in_memory_classloader, "<init>",
                              "([Ljava/nio/ByteBuffer;Ljava/lang/String;Ljava/lang/ClassLoader;)V");
}
auto byte_buffer_class = JNI_FindClass(env, "java/nio/ByteBuffer");
auto dex_buffer = env->NewDirectByteBuffer(dex_data, dex_size);
auto dex_buffer_array = JNI_NewObjectArray(env, 1, byte_buffer_class, dex_buffer);
 
if (sdk_int < __ANDROID_API_Q__) {
    if (auto my_cl = JNI_NewObject(env, in_memory_classloader, initMid,
                                   dex_buffer_array, sys_classloader)) {
        inject_class_loader_ = JNI_NewGlobalRef(env, my_cl);
    }
} else {
    jstring librarySearchPath = nullptr;
    if (auto my_cl = JNI_NewObject(env, in_memory_classloader, initMid,
                                   dex_buffer_array, librarySearchPath, sys_classloader)) {
        inject_class_loader_ = JNI_NewGlobalRef(env, my_cl);
    }
}

直接调它的父类

CRC校验

这个也简单, 可以参考: https://bbs.kanxue.com/thread-285790.htm

hunter的检测相对NativeTest简单点

图片描述

最后于 23小时前被无味编辑，原因：格式

更多【Android安全- 关于hunter检测的隐藏】相关视频教程：www.yxfzedu.com

Android安全- 关于hunter检测的隐藏

检测点

Find Xposed Api

Hunter可能已经被注入

底下那一堆Find JVM Method Is Hooked也是在匿名内存搞定后就没了

inMemoryDexClassLoader

CRC校验

hunter的检测相对NativeTest简单点

相关文章推荐

Markdown Editor

友情链接

课程目录

技术交流QQ群