服务粉丝

我们一直在努力
当前位置:首页 > 财经 >

Xposed检测绕过

日期: 来源:看雪学苑收集编辑:那年没下雪


本文为看雪论坛优秀文章

看雪论坛作者ID:那年没下雪


分享一些Xposed检测绕过的总结,很多加壳软件检测到xposed就会杀死当前软件进程。


1、绕过jar Class检测

// 过防止调用loadClass加载 de.robv.android.xposed.        XposedHelpers.findAndHookMethod(ClassLoader.class, "loadClass", String.class, new XC_MethodHook() {            @Override            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {                if(param.args != null && param.args[0] != null && param.args[0].toString().startsWith("de.robv.android.xposed.")){                     // 改成一个不存在的类                    param.args[0] = "de.robv.android.xposed.ThTest";                }                 super.beforeHookedMethod(param);            }        });

2、绕过堆栈检测

XposedHelpers.findAndHookMethod(StackTraceElement.class, "getClassName", new XC_MethodHook() {            @Override            protected void afterHookedMethod(MethodHookParam param) throws Throwable {                String result = (String) param.getResult();                if (result != null){                    if (result.contains("de.robv.android.xposed.")) {                        param.setResult("");                        // Log.i(tag, "替换了,字符串名称 " + result);                    }else if(result.contains("com.android.internal.os.ZygoteInit")){                        param.setResult("");                    }                }                 super.afterHookedMethod(param);            }        });


3、绕过包名检测

findAndHookMethod("android.app.ApplicationPackageManager", lpparam.classLoader, "getInstalledApplications", int.class, new XC_MethodHook() {            @SuppressWarnings("unchecked")            @Override            protected void afterHookedMethod(MethodHookParam param) throws Throwable { // Hook after getIntalledApplications is called                if (debugPref) {                    XposedBridge.log("Hooked getInstalledApplications");                }                 List<ApplicationInfo> packages = (List<ApplicationInfo>) param.getResult(); // Get the results from the method call                Iterator<ApplicationInfo> iter = packages.iterator();                ApplicationInfo tempAppInfo;                String tempPackageName;                  // Iterate through the list of ApplicationInfo and remove any mentions that match a keyword in the keywordSet                while (iter.hasNext()) {                    tempAppInfo = iter.next();                    tempPackageName = tempAppInfo.packageName;                    if (tempPackageName != null && tempPackageName.equals("de.robv.android.xposed.installer")) {                        iter.remove();                        if (debugPref) {                            XposedBridge.log("Found and hid package: " + tempPackageName);                        }                    }                }                 param.setResult(packages); // Set the return value to the clean list            }        });

4、绕过jar文件检测:

Constructor<?> constructLayoutParams = findConstructorExact(java.io.File.class, String.class);        XposedBridge.hookMethod(constructLayoutParams, new XC_MethodHook(XCallback.PRIORITY_HIGHEST) {            @Override            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {                if (param.args[0] != null) {                    if (debugPref) {                        XposedBridge.log("File: Found a File constructor: " + ((String) param.args[0]));                    }                }                 if (isRootCloakLoadingPref) {                    // RootCloak is trying to load it's preferences, we shouldn't block this.                    return;                }                if (((String) param.args[0]).contains("XposedBridge")) {                    if (debugPref) {                        XposedBridge.log("File: Found a File constructor with word super, noshufou, or chainfire");                    }                    param.args[0] = "/system/app/" + FAKE_FILE;                }            }        });


5、绕过maps检测

XposedHelpers.findAndHookConstructor("java.io.FileReader",lpparam.classLoader ,String.class , new XC_MethodHook() {          @Override          protected void beforeHookedMethod(MethodHookParam param) throws Throwable {              String arg0 = (String) param.args[0];              if(arg0.toLowerCase().contains("/proc/")){                  param.setResult(null);              }          }      });

6、绕过vxp检测

XposedHelpers.findAndHookMethod("java.lang.System", lpparam.classLoader, "getProperty", String.class, new XC_MethodHook() {           @Override           protected void beforeHookedMethod(MethodHookParam param) throws Throwable {               String arg0 = (String)param.args[0];               if(arg0.equals("vxp")){                   param.setResult(null);               }           }       });


7、绕过SO检测

findAndHookMethod("java.lang.Runtime", lpparam.classLoader, "exec", String[].class, String[].class, File.class, new XC_MethodHook() {           @Override           protected void beforeHookedMethod(MethodHookParam param) throws Throwable {               if (debugPref) {                   XposedBridge.log("Hooked Runtime.exec");               }                String[] execArray = (String[]) param.args[0]; // Grab the tokenized array of commands               if ((execArray != null) && (execArray.length >= 1)) { // Do some checking so we don't break anything                   String firstParam = execArray[0]; // firstParam is going to be the main command/program being run                   if (debugPref) { // If debugging is on, print out what is being called                       String tempString = "Exec Command:";                       for (String temp : execArray) {                           tempString = tempString + " " + temp;                       }                       XposedBridge.log(tempString);                   }                    if (stringEndsWithFromSet(firstParam, commandSet)) { // Check if the firstParam is one of the keywords we want to filter                       if (debugPref) {                           XposedBridge.log("Found blacklisted command at the end of the string: " + firstParam);                       }                        // A bunch of logic follows since the solution depends on which command is being called                       // TODO: ***Clean up this logic***                       if (commandSet.contains("ls") && execArray.length >= 3 && execArray[1].contains("lib")) {                           param.setThrowable(new IOException());                       } else {                           param.setThrowable(new IOException());                       }                        if (debugPref && param.getThrowable() == null) { // Print out the new command if debugging is on                           String tempString = "New Exec Command:";                           for (String temp : (String[]) param.args[0]) {                               tempString = tempString + " " + temp;                           }                           XposedBridge.log(tempString);                       }                   }               } else {                   if (debugPref) {                       XposedBridge.log("Null or empty array on exec");                   }               }           }       });

8、绕过ClassPath检测

XposedHelpers.findAndHookMethod("java.lang.System", lpparam.classLoader, "getenv", String.class, new XC_MethodHook() {           @Override           protected void beforeHookedMethod(MethodHookParam param) throws Throwable {               String arg0 = (String)param.args[0];               if(arg0.equals("CLASSPATH")){                   param.setResult("FAKE.CLASSPATH");               }           }       });


9、检测缓存

// 定义全局变量 modifyXposedHelpers.findAndHookMethod(Method.class, "getModifiers", new XC_MethodHook() {            @Override            protected void afterHookedMethod(MethodHookParam param) throws Throwable {                Method method = (Method)param.thisObject;                String[] array = new String[] { "getDeviceId" };                String method_name = method.getName();                if(Arrays.asList(array).contains(method_name)){                    modify = 0;                }else{                    modify = (int)param.getResult();                }                 super.afterHookedMethod(param);            }        });         XposedHelpers.findAndHookMethod(Modifier.class, "isNative", int.class, new XC_MethodHook() {            @Override            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {                param.args[0] = modify;                 super.beforeHookedMethod(param);            }        });




看雪ID:那年没下雪

https://bbs.kanxue.com/user-home-884888.htm

*本文由看雪论坛 那年没下雪 原创,转载请注明来自看雪社区


# 往期推荐

1、源代码静态分析方法——代码属性图Code Property Graphs

2、详解典型CVE内核漏洞

3、php(phar)反序列化漏洞及各种绕过姿势

4、Windows 2000系统的一个0day漏洞发现过程

5、wibu证书 - asn1码流

6、COM 进程注入技术-编程技术



球分享

球点赞

球在看


点击“阅读原文”,了解更多!

相关阅读

  • CVE-2023-0050:GitLab跨站脚本漏洞通告

  • 赶紧点击上方话题进行订阅吧!报告编号:B6-2023-030301报告来源:360CERT报告作者:360CERT更新日期:2023-03-031 漏洞简述2023年03月03日,360CERT监测发现GitLab官方发布了GitLab跨
  • 供应链安全这件事,早就被朱元璋玩明白了

  • 第 22 叨如果城墙裂开一道缝,怎么才能知道是谁烧制的城砖有质量问题呢?公元1356年,朱元璋所率领的义军在打败元朝水军后,顺利攻占了集庆,也就是后来的明朝应天府(今江苏南京),从此有
  • 一键shiro反序列化漏洞利用工具

  • 项目地址https://github.com/j1anFen/shiro_attack免责声明该项目仅供合法的渗透测试以及爱好者参考学习,请各位遵守《中华人民共和国网络安全法》以及相应地方的法律,禁止使
  • N!Ligolo内网渗透反向隧道工具

  • 声明:该公众号分享的安全工具和项目均来源于网络,仅供安全研究与学习之用,如用于其他用途,由使用者承担全部法律及连带责任,与工具作者和本公众号无关。工具简介简单轻量级的反向
  • 绕过防病毒和EDR基础技术脑图

  • 声明:该公众号分享的安全工具和项目均来源于网络,仅供安全研究与学习之用,如用于其他用途,由使用者承担全部法律及连带责任,与工具作者和本公众号无关。这个脑图列出了绕过反病毒
  • 收藏!攻击者溯源反制脑图合集

  • 声明:该公众号分享的安全工具和项目均来源于网络,仅供安全研究与学习之用,如用于其他用途,由使用者承担全部法律及连带责任,与工具作者和本公众号无关。之前收集整理的一些有关溯
  • Kali Linux安装AWVS15.4

  • AWVS是英文Acunetix Web Vulnerability Scanner的简称。它是一款红队常用的web漏洞扫描工具。通过扫描可以发现站点存在的SQL注入、XSS等漏洞。以便开发者加强系统安全。安

热门文章

  • “复活”半年后 京东拍拍二手杀入公益事业

  • 京东拍拍二手“复活”半年后,杀入公益事业,试图让企业捐的赠品、家庭闲置品变成实实在在的“爱心”。 把“闲置品”变爱心 6月12日,“益心一益·守护梦想每一步”2018年四

最新文章

  • Xposed检测绕过

  • 本文为看雪论坛优秀文章看雪论坛作者ID:那年没下雪分享一些Xposed检测绕过的总结,很多加壳软件检测到xposed就会杀死当前软件进程。1、绕过jar Class检测// 过防止调用loadCla
  • 绒绒说安全:黑客的隐藏术之跳板攻击

  • 新一期的绒绒说安全又和大家见面了,今天我们为大家介绍下什么是跳板攻击。跳板攻击是黑客入侵目标网络的一种常用手段。黑客在实施攻击时,通常不会直接从自己的系统向目标发动