1、检测文件名（改名）、端口名27042（改端口）、双进程保护（spawn启动）
2、检测D-Bus
D-Bus是一种进程间通信(IPC)和远程过程调用(RPC)机制,最初是为Linux开发的,目的是用一个统一的协议替代现有的和竞争的IPC解决方案。
遍历连接手机所有端口发送D-bus消息，如果返回"REJECT"这个特征则认为存在frida-server。
内存中存在frida rpc字符串，认为有frida-server
/*
/
for(i = 0 ; i )&sa , sizeof sa) != -1) {
__android_log_print(ANDROID_LOG_VERBOSE, APPNAME, "FRIDA DETECTION [1]: Open Port: %d", i);
memset(res, 0 , 7);
// send a D-Bus AUTH message. Expected answer is “REJECT"
send(sock, "\x00", 1, NULL);
send(sock, "AUTH\r\n", 6, NULL);
usleep(100);
if (ret = recv(sock, res, 6, MSG_DONTWAIT) != -1) {
if (strcmp(res, "REJECT") == 0) {
/ Frida server detected. Do something… /
}
}
}
close(sock);
}
3、检测/proc/pid/maps映射文件
4、检测/proc/pid/tast/tid/stat/或者/proc/pid/task/tip/status
5、直接调用openat的syscall的检测在text节表中搜索frida-gadget.so / frida-agent.so字符串，避免了hook libc来anti-anti的方法
6、从inlinehook角度检测frida
https://zhuanlan.zhihu.com/p/557713016
hook_open函数可以查看是哪里检测了so文件
function hook_open(){
var pth = Module.findExportByName(null,"open");
Interceptor.attach(ptr(pth),{
onEnter:function(args){
this.filename = args[0];
console.log("",this.filename.readCString())
if (this.filename.readCString().indexOf(".so") != -1){
args[0] = ptr(0)
}
},onLeave:function(retval){
return retval;
}
})
}
setImmediate(hook_open)
替换一个正常的
function main() {
const openPtr = Module.getExportByName('libc.so', 'open');
const open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);
var readPtr = Module.findExportByName("libc.so", "read");
var read = new NativeFunction(readPtr, 'int', ['int', 'pointer', "int"]);
var fakePath = "/data/data/com.app/maps";
var file = new File(fakePath, "w");
var buffer = Memory.alloc(512);
Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {
var pathname = Memory.readUtf8String(pathnameptr);
var realFd = open(pathnameptr, flag);
if (pathname.indexOf("maps") >= 0) {
while (parseInt(read(realFd, buffer, 512)) !== 0) {
var oneLine = Memory.readCString(buffer);
if (oneLine.indexOf("tmp") === -1) {
file.write(oneLine);
}
}
var filename = Memory.allocUtf8String(fakePath);
return open(filename, flag);
}
var fd = open(pathnameptr, flag);
return fd;
}, 'int', ['pointer', 'int']));
}
setImmediate(main)
检测点是maps、status
新版jadx修改checknum
[/md]
