1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

┌─────────────────────────────────────────────────────────────────┐
│                      反分析技术体系                              │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐          │
│  │   反调试     │  │   反 Hook    │  │  反模拟器    │          │
│  │ Anti-Debug   │  │ Anti-Hook    │  │ Anti-Emulator│          │
│  ├──────────────┤  ├──────────────┤  ├──────────────┤          │
│  │ TracerPid    │  │ Frida 端口   │  │ 系统属性     │          │
│  │ ptrace       │  │ 内存特征     │  │ 特有文件     │          │
│  │ 时间检测     │  │ Inline Hook  │  │ CPU 信息     │          │
│  │ 断点检测     │  │ Xposed 检测  │  │ 传感器数据   │          │
│  └──────────────┘  └──────────────┘  └──────────────┘          │
│                                                                 │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐          │
│  │   Root 检测  │  │  完整性校验  │  │  SSL Pinning │          │
│  │ Root Detect  │  │  Integrity   │  │  证书绑定    │          │
│  ├──────────────┤  ├──────────────┤  ├──────────────┤          │
│  │ su 文件      │  │ 签名校验     │  │ 证书指纹     │          │
│  │ Magisk 检测  │  │ DEX 校验     │  │ 公钥绑定     │          │
│  │ SELinux      │  │ SO 校验      │  │ 证书链验证   │          │
│  └──────────────┘  └──────────────┘  └──────────────┘          │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

// Native (C/C++) 实现 - TracerPid 检测
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <pthread.h>

int check_tracer_pid() {
    FILE *fp = fopen("/proc/self/status", "r");
    if (fp == NULL) {
        return 0;
    }

    char line[128];
    int tracer_pid = 0;

    while (fgets(line, sizeof(line), fp)) {
        if (strncmp(line, "TracerPid:", 10) == 0) {
            sscanf(line, "TracerPid:\t%d", &tracer_pid);
            break;
        }
    }

    fclose(fp);
    return tracer_pid;
}

// 后台线程持续检测
void* anti_debug_thread(void* arg) {
    while (1) {
        if (check_tracer_pid() != 0) {
            // 检测到调试器，执行保护逻辑
            kill(getpid(), SIGKILL);
        }
        usleep(100000);  // 100ms 间隔
    }
    return NULL;
}

// 在 JNI_OnLoad 或初始化函数中启动检测线程
void start_anti_debug() {
    pthread_t thread;
    pthread_create(&thread, NULL, anti_debug_thread, NULL);
    pthread_detach(thread);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

// Frida 脚本 - 绕过 TracerPid 检测
Interceptor.attach(Module.findExportByName("libc.so", "fopen"), {
    onEnter: function(args) {
        this.path = args[0].readCString();
    },
    onLeave: function(retval) {
        if (this.path && this.path.indexOf("/proc/") !== -1 &&
            this.path.indexOf("/status") !== -1) {
            this.statusFile = retval;
        }
    }
});

Interceptor.attach(Module.findExportByName("libc.so", "fgets"), {
    onLeave: function(retval) {
        if (retval.isNull()) return;

        var line = retval.readCString();
        if (line && line.indexOf("TracerPid:") !== -1) {
            // 将 TracerPid 改为 0
            var newLine = "TracerPid:\t0\n";
            retval.writeUtf8String(newLine);
            console.log("[*] TracerPid spoofed to 0");
        }
    }
});

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

// Native (C/C++) 实现 - ptrace 自附加
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <unistd.h>
#include <stdlib.h>

void anti_debug_ptrace() {
    // 方法1: 直接 ptrace 自己
    if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) == -1) {
        // 如果失败，说明已经被调试
        exit(0);
    }
}

void anti_debug_ptrace_fork() {
    // 方法2: fork 子进程来 ptrace 父进程
    pid_t child = fork();

    if (child == 0) {
        // 子进程
        pid_t parent = getppid();

        // 附加到父进程
        if (ptrace(PTRACE_ATTACH, parent, NULL, NULL) == -1) {
            // 父进程已被调试
            kill(parent, SIGKILL);
            exit(0);
        }

        // 等待父进程停止
        waitpid(parent, NULL, 0);

        // 继续父进程执行
        ptrace(PTRACE_CONT, parent, NULL, NULL);

        // 持续监控
        while (1) {
            int status;
            waitpid(parent, &status, 0);

            if (WIFEXITED(status) || WIFSIGNALED(status)) {
                exit(0);
            }

            ptrace(PTRACE_CONT, parent, NULL, NULL);
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

// Frida 脚本 - 绕过 ptrace 检测
var ptrace = Module.findExportByName(null, "ptrace");

Interceptor.attach(ptrace, {
    onEnter: function(args) {
        this.request = args[0].toInt32();
        console.log("[*] ptrace called with request: " + this.request);
    },
    onLeave: function(retval) {
        // PTRACE_TRACEME = 0
        if (this.request === 0) {
            retval.replace(0);  // 返回成功
            console.log("[*] ptrace(PTRACE_TRACEME) bypassed");
        }
    }
});

// 同时 Hook fork 防止子进程检测
Interceptor.attach(Module.findExportByName("libc.so", "fork"), {
    onLeave: function(retval) {
        var pid = retval.toInt32();
        if (pid === 0) {
            // 在子进程中，可以直接退出
            console.log("[*] fork() in child process, may be anti-debug");
        }
    }
});

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

// Native (C/C++) 实现 - 时间检测
#include <time.h>
#include <stdlib.h>

#define THRESHOLD_NS 100000000  // 100ms 阈值

void timing_check() {
    struct timespec start, end;

    clock_gettime(CLOCK_MONOTONIC, &start);

    // 执行一些简单操作
    volatile int sum = 0;
    for (int i = 0; i < 1000; i++) {
        sum += i;
    }

    clock_gettime(CLOCK_MONOTONIC, &end);

    long elapsed = (end.tv_sec - start.tv_sec) * 1000000000L +
                   (end.tv_nsec - start.tv_nsec);

    if (elapsed > THRESHOLD_NS) {
        // 执行时间异常，可能被调试
        exit(0);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

// Java 实现 - 时间检测
public class TimingCheck {
    private static final long THRESHOLD_MS = 100;

    public static boolean isBeingDebugged() {
        long startTime = System.nanoTime();

        // 执行一些简单计算
        int sum = 0;
        for (int i = 0; i < 10000; i++) {
            sum += i;
        }

        long endTime = System.nanoTime();
        long elapsed = (endTime - startTime) / 1000000;  // 转换为毫秒

        return elapsed > THRESHOLD_MS;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

// Frida 脚本 - 绕过时间检测
var clock_gettime = Module.findExportByName("libc.so", "clock_gettime");
var baseTime = null;
var fakeElapsed = 1000000;  // 1ms

Interceptor.attach(clock_gettime, {
    onEnter: function(args) {
        this.timespec = args[1];
    },
    onLeave: function(retval) {
        if (baseTime === null) {
            baseTime = {
                tv_sec: this.timespec.readU32(),
                tv_nsec: this.timespec.add(4).readU32()
            };
        } else {
            // 返回假的时间差
            this.timespec.writeU32(baseTime.tv_sec);
            this.timespec.add(4).writeU32(baseTime.tv_nsec + fakeElapsed);
            fakeElapsed += 1000000;  // 每次增加 1ms
        }
    }
});

// Hook Java 层时间函数
Java.perform(function() {
    var System = Java.use("java.lang.System");

    var startNanoTime = null;

    System.nanoTime.implementation = function() {
        if (startNanoTime === null) {
            startNanoTime = this.nanoTime();
        }
        // 返回递增的假时间
        startNanoTime += 1000000;  // 1ms
        return startNanoTime;
    };
});

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

// Native (C/C++) 实现 - 断点检测
#include <stdint.h>
#include <string.h>

// x86/x64 断点指令
#define BREAKPOINT_X86 0xCC

// ARM 断点指令
#define BREAKPOINT_ARM 0xE7F001F0
#define BREAKPOINT_THUMB 0xDE01

int check_breakpoints(void* func_addr, size_t func_size) {
    uint8_t* code = (uint8_t*)func_addr;

    for (size_t i = 0; i < func_size; i++) {
        // 检测 x86 软件断点
        if (code[i] == BREAKPOINT_X86) {
            return 1;  // 发现断点
        }

#ifdef __arm__
        // 检测 ARM/Thumb 断点
        if (i + 1 < func_size) {
            uint16_t thumb_inst = *(uint16_t*)(code + i);
            if (thumb_inst == BREAKPOINT_THUMB) {
                return 1;
            }
        }
#endif
    }

    return 0;
}

// 计算函数校验和，检测是否被修改
uint32_t calculate_checksum(void* start, size_t size) {
    uint32_t checksum = 0;
    uint8_t* data = (uint8_t*)start;

    for (size_t i = 0; i < size; i++) {
        checksum += data[i];
        checksum = (checksum << 1) | (checksum >> 31);  // 循环左移
    }

    return checksum;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

// Frida 脚本 - 使用 Memory.protect 修改权限
// 在检测之前临时恢复原始代码

var targetFunction = Module.findExportByName("libtarget.so", "sensitive_function");

// 保存原始字节
var originalBytes = Memory.readByteArray(targetFunction, 16);

// 当检测函数被调用时，临时恢复
Interceptor.attach(Module.findExportByName("libtarget.so", "check_breakpoints"), {
    onEnter: function(args) {
        // 恢复原始代码
        Memory.writeByteArray(targetFunction, originalBytes);
    },
    onLeave: function(retval) {
        // 重新设置 Hook
        // ... 重新安装 Interceptor
    }
});

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

// Native (C/C++) 实现 - Frida 端口检测
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <errno.h>

// Frida 默认端口
#define FRIDA_DEFAULT_PORT 27042

int check_frida_port() {
    int sock = socket(AF_INET, SOCK_STREAM, 0);
    if (sock < 0) {
        return 0;
    }

    struct sockaddr_in addr;
    memset(&addr, 0, sizeof(addr));
    addr.sin_family = AF_INET;
    addr.sin_port = htons(FRIDA_DEFAULT_PORT);
    addr.sin_addr.s_addr = inet_addr("127.0.0.1");

    // 设置非阻塞连接超时
    struct timeval timeout;
    timeout.tv_sec = 1;
    timeout.tv_usec = 0;
    setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout));

    int result = connect(sock, (struct sockaddr*)&addr, sizeof(addr));
    close(sock);

    if (result == 0) {
        return 1;  // Frida 端口开放
    }

    return 0;
}

// 扫描多个可疑端口
int check_suspicious_ports() {
    int suspicious_ports[] = {27042, 27043, 27044, 27045, 4444};
    int num_ports = sizeof(suspicious_ports) / sizeof(suspicious_ports[0]);

    for (int i = 0; i < num_ports; i++) {
        int sock = socket(AF_INET, SOCK_STREAM, 0);
        if (sock < 0) continue;

        struct sockaddr_in addr;
        memset(&addr, 0, sizeof(addr));
        addr.sin_family = AF_INET;
        addr.sin_port = htons(suspicious_ports[i]);
        addr.sin_addr.s_addr = inet_addr("127.0.0.1");

        struct timeval timeout = {0, 100000};  // 100ms
        setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout));

        if (connect(sock, (struct sockaddr*)&addr, sizeof(addr)) == 0) {
            close(sock);
            return 1;  // 发现可疑端口
        }
        close(sock);
    }

    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

// Java 实现 - Frida 端口检测
import java.net.Socket;
import java.net.InetSocketAddress;

public class FridaPortDetector {
    private static final int[] SUSPICIOUS_PORTS = {27042, 27043, 27044, 27045};

    public static boolean detectFridaPort() {
        for (int port : SUSPICIOUS_PORTS) {
            try {
                Socket socket = new Socket();
                socket.connect(new InetSocketAddress("127.0.0.1", port), 100);
                socket.close();
                return true;  // 端口开放，可能是 Frida
            } catch (Exception e) {
                // 连接失败，继续检测下一个端口
            }
        }
        return false;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

// Frida 脚本 - 绕过端口检测
// 方法1: Hook connect 函数
Interceptor.attach(Module.findExportByName("libc.so", "connect"), {
    onEnter: function(args) {
        var sockaddr = args[1];
        var family = sockaddr.readU16();

        if (family === 2) {  // AF_INET
            var port = (sockaddr.add(2).readU8() << 8) | sockaddr.add(3).readU8();

            // 检测 Frida 端口
            if (port === 27042 || port === 27043 || port === 27044) {
                console.log("[*] Blocking connect to Frida port: " + port);
                // 修改端口为不存在的端口
                sockaddr.add(2).writeU8(0xFF);
                sockaddr.add(3).writeU8(0xFF);
            }
        }
    }
});

// 方法2: 使用自定义端口启动 Frida
// frida-server -l 0.0.0.0:31337

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

// Native (C/C++) 实现 - 内存映射检测
#include <stdio.h>
#include <string.h>
#include <stdlib.h>

typedef struct {
    const char* pattern;
    int is_regex;
} DetectionPattern;

static DetectionPattern frida_patterns[] = {
    {"frida", 0},
    {"gadget", 0},
    {"gum-js-loop", 0},
    {"gmain", 0},
    {"linjector", 0},
    {"/data/local/tmp", 0},
    {"re.frida.server", 0},
    {"pool-frida", 0},
};

int check_frida_in_maps() {
    FILE *fp = fopen("/proc/self/maps", "r");
    if (fp == NULL) {
        return 0;
    }

    char line[512];
    int num_patterns = sizeof(frida_patterns) / sizeof(frida_patterns[0]);

    while (fgets(line, sizeof(line), fp)) {
        // 转换为小写进行匹配
        char lower_line[512];
        for (int i = 0; line[i]; i++) {
            lower_line[i] = tolower(line[i]);
        }
        lower_line[strlen(line)] = '\0';

        for (int i = 0; i < num_patterns; i++) {
            if (strstr(lower_line, frida_patterns[i].pattern)) {
                fclose(fp);
                return 1;  // 检测到 Frida
            }
        }
    }

    fclose(fp);
    return 0;
}

// 检测内存中的 Frida 特征字符串
int check_frida_strings_in_memory() {
    FILE *fp = fopen("/proc/self/maps", "r");
    if (fp == NULL) return 0;

    char line[512];
    while (fgets(line, sizeof(line), fp)) {
        // 解析内存区域
        unsigned long start, end;
        char perms[5];

        if (sscanf(line, "%lx-%lx %4s", &start, &end, perms) != 3) {
            continue;
        }

        // 只检查可读区域
        if (perms[0] != 'r') continue;

        // 搜索 Frida 特征
        char* region = (char*)start;
        size_t region_size = end - start;

        // 注意: 这种方法可能会崩溃，需要小心处理
        // 实际实现需要使用 process_vm_readv 或其他安全方式
    }

    fclose(fp);
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

// Frida 脚本 - 绕过 maps 检测
var keywords = ["frida", "gadget", "gum-js-loop", "gmain", "linjector"];

Interceptor.attach(Module.findExportByName("libc.so", "fopen"), {
    onEnter: function(args) {
        this.path = args[0].readCString();
    },
    onLeave: function(retval) {
        if (this.path && this.path.indexOf("maps") !== -1) {
            this.isMaps = true;
            this.fd = retval;
        }
    }
});

Interceptor.attach(Module.findExportByName("libc.so", "fgets"), {
    onLeave: function(retval) {
        if (!retval.isNull()) {
            var line = retval.readCString();
            if (line) {
                var shouldFilter = false;
                for (var i = 0; i < keywords.length; i++) {
                    if (line.toLowerCase().indexOf(keywords[i]) !== -1) {
                        shouldFilter = true;
                        break;
                    }
                }

                if (shouldFilter) {
                    // 用空行替换
                    retval.writeUtf8String("\n");
                    console.log("[*] Filtered maps line containing Frida");
                }
            }
        }
    }
});

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

// Native (C/C++) 实现 - Inline Hook 检测
#include <dlfcn.h>
#include <string.h>
#include <stdint.h>

// ARM64 跳转指令特征
#define ARM64_BR_OPCODE    0xD61F0000
#define ARM64_BLR_OPCODE   0xD63F0000
#define ARM64_B_OPCODE     0x14000000
#define ARM64_B_MASK       0xFC000000

// x86_64 跳转指令特征
#define X86_JMP_REL32      0xE9
#define X86_JMP_ABS        0xFF

int check_function_hook(void* func_ptr) {
    uint8_t* code = (uint8_t*)func_ptr;

#if defined(__aarch64__)
    // ARM64 检测
    uint32_t instruction = *(uint32_t*)code;

    // 检测 BR/BLR 指令
    if ((instruction & 0xFFFFFC1F) == ARM64_BR_OPCODE ||
        (instruction & 0xFFFFFC1F) == ARM64_BLR_OPCODE) {
        return 1;  // 可能被 Hook
    }

    // 检测 B 指令
    if ((instruction & ARM64_B_MASK) == ARM64_B_OPCODE) {
        return 1;
    }

    // 检测 LDR + BR 组合 (常见 Hook 方式)
    // LDR X16, #offset; BR X16
    if ((instruction & 0xFF000000) == 0x58000000) {
        uint32_t next_inst = *(uint32_t*)(code + 4);
        if ((next_inst & 0xFFFFFFFF) == 0xD61F0200) {
            return 1;
        }
    }

#elif defined(__x86_64__) || defined(__i386__)
    // x86/x64 检测
    if (code[0] == X86_JMP_REL32) {  // E9 xx xx xx xx
        return 1;
    }

    if (code[0] == X86_JMP_ABS && code[1] == 0x25) {  // FF 25 xx xx xx xx
        return 1;
    }

    // 检测 push + ret (另一种 Hook 方式)
    if (code[0] == 0x68) {  // push imm32
        // 检查后面是否有 ret
        for (int i = 5; i < 10; i++) {
            if (code[i] == 0xC3) {  // ret
                return 1;
            }
        }
    }
#endif

    return 0;
}

// 检测常见被 Hook 的函数
void check_common_hooks() {
    const char* targets[] = {
        "open", "read", "write", "connect", "send", "recv",
        "ptrace", "kill", "exit", "fork", "execve"
    };

    void* libc = dlopen("libc.so", RTLD_NOW);
    if (!libc) return;

    for (int i = 0; i < sizeof(targets) / sizeof(targets[0]); i++) {
        void* func = dlsym(libc, targets[i]);
        if (func && check_function_hook(func)) {
            // 检测到 Hook
            exit(0);
        }
    }

    dlclose(libc);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

// Frida 脚本 - 使用 Stalker 避免 Inline Hook 检测
// Stalker 使用代码追踪而非修改原始指令

var targetModule = Process.findModuleByName("libtarget.so");

Stalker.follow(Process.getCurrentThreadId(), {
    transform: function(iterator) {
        var instruction = iterator.next();

        do {
            if (instruction.address.compare(targetModule.base) >= 0 &&
                instruction.address.compare(targetModule.base.add(targetModule.size)) < 0) {
                // 在目标模块内，可以插入自定义代码
                iterator.putCallout(function(context) {
                    // 自定义逻辑
                });
            }
            iterator.keep();
        } while ((instruction = iterator.next()) !== null);
    }
});

// 或者使用 replace 替代 attach，更难被检测
var original = Module.findExportByName("libc.so", "open");
var originalFunc = new NativeFunction(original, 'int', ['pointer', 'int']);

Interceptor.replace(original, new NativeCallback(function(path, flags) {
    var pathStr = path.readCString();
    console.log("[*] open: " + pathStr);
    return originalFunc(path, flags);
}, 'int', ['pointer', 'int']));

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91

// Java 实现 - Xposed 检测
import java.io.File;
import java.lang.reflect.Method;
import java.util.HashSet;
import java.util.Set;

public class XposedDetector {

    // 检测 Xposed 相关文件
    public static boolean checkXposedFiles() {
        String[] paths = {
            "/system/framework/XposedBridge.jar",
            "/system/lib/libxposed_art.so",
            "/system/lib64/libxposed_art.so",
            "/system/xposed.prop",
            "/data/data/de.robv.android.xposed.installer",
            "/data/data/org.lsposed.manager",
            "/data/adb/lspd"
        };

        for (String path : paths) {
            if (new File(path).exists()) {
                return true;
            }
        }
        return false;
    }

    // 检测 Xposed 类加载
    public static boolean checkXposedClass() {
        try {
            Class.forName("de.robv.android.xposed.XposedBridge");
            return true;
        } catch (ClassNotFoundException e) {
            // Xposed 未加载
        }

        try {
            Class.forName("de.robv.android.xposed.XposedHelpers");
            return true;
        } catch (ClassNotFoundException e) {
            // Xposed 未加载
        }

        return false;
    }

    // 通过堆栈检测 Xposed Hook
    public static boolean checkXposedInStack() {
        StackTraceElement[] stackTrace = Thread.currentThread().getStackTrace();

        for (StackTraceElement element : stackTrace) {
            String className = element.getClassName();
            if (className.contains("xposed") ||
                className.contains("lsposed") ||
                className.contains("EdXposed")) {
                return true;
            }
        }
        return false;
    }

    // 检测方法是否被 Hook (通过 Modifier)
    public static boolean isMethodHooked(Method method) {
        // Xposed Hook 后方法会变成 native
        if (method.getModifiers() != method.getModifiers()) {
            return true;
        }

        // 检查方法是否可访问性被修改
        try {
            // 某些 Hook 框架会修改这个值
        } catch (Exception e) {
            return true;
        }

        return false;
    }

    // 检测全局变量
    public static boolean checkXposedGlobals() {
        try {
            Class<?> xposedBridge = Class.forName("de.robv.android.xposed.XposedBridge");
            java.lang.reflect.Field disableHooks = xposedBridge.getDeclaredField("disableHooks");
            disableHooks.setAccessible(true);
            return true;
        } catch (Exception e) {
            return false;
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

// Native (C/C++) 实现 - Xposed 检测
#include <dlfcn.h>
#include <link.h>

int check_xposed_in_loaded_libs() {
    // 遍历已加载的共享库
    FILE *fp = fopen("/proc/self/maps", "r");
    if (fp == NULL) return 0;

    char line[512];
    while (fgets(line, sizeof(line), fp)) {
        if (strstr(line, "XposedBridge") ||
            strstr(line, "libxposed") ||
            strstr(line, "lspd") ||
            strstr(line, "riru") ||
            strstr(line, "zygisk")) {
            fclose(fp);
            return 1;
        }
    }

    fclose(fp);
    return 0;
}

// 检测 ART 方法结构是否被修改
int check_art_method_hook(void* art_method) {
    // ART 方法被 Xposed Hook 后，entry_point 会被修改
    // 这需要了解 ART 内部结构，不同 Android 版本有差异

    // 简化示例: 检查 entry_point 是否指向已知区域
    // 实际实现需要根据具体 Android 版本调整

    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

// Frida 脚本 - 绕过 Xposed 检测
Java.perform(function() {
    // Hook File.exists
    var File = Java.use("java.io.File");
    var xposedPaths = [
        "/system/framework/XposedBridge.jar",
        "/system/lib/libxposed_art.so",
        "/data/data/de.robv.android.xposed.installer",
        "/data/data/org.lsposed.manager"
    ];

    File.exists.implementation = function() {
        var path = this.getAbsolutePath();
        for (var i = 0; i < xposedPaths.length; i++) {
            if (path.indexOf(xposedPaths[i]) !== -1) {
                console.log("[*] Hiding Xposed file: " + path);
                return false;
            }
        }
        return this.exists();
    };

    // Hook Class.forName
    var JavaClass = Java.use("java.lang.Class");
    JavaClass.forName.overload("java.lang.String").implementation = function(name) {
        if (name.indexOf("xposed") !== -1 || name.indexOf("lsposed") !== -1) {
            console.log("[*] Blocking class load: " + name);
            throw Java.use("java.lang.ClassNotFoundException").$new(name);
        }
        return this.forName(name);
    };

    // Hook getStackTrace
    var Thread = Java.use("java.lang.Thread");
    Thread.getStackTrace.implementation = function() {
        var stack = this.getStackTrace();
        var filteredStack = [];

        for (var i = 0; i < stack.length; i++) {
            var className = stack[i].getClassName();
            if (className.indexOf("xposed") === -1 &&
                className.indexOf("lsposed") === -1) {
                filteredStack.push(stack[i]);
            }
        }

        return Java.array("java.lang.StackTraceElement", filteredStack);
    };
});

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

// Java 实现 - Magisk 检测
import java.io.File;
import java.io.BufferedReader;
import java.io.InputStreamReader;

public class MagiskDetector {

    // 检测 Magisk 相关文件
    public static boolean checkMagiskFiles() {
        String[] paths = {
            "/sbin/.magisk",
            "/sbin/magisk",
            "/data/adb/magisk",
            "/data/adb/magisk.img",
            "/data/adb/magisk.db",
            "/data/data/com.topjohnwu.magisk",
            "/data/user_de/0/com.topjohnwu.magisk"
        };

        for (String path : paths) {
            if (new File(path).exists()) {
                return true;
            }
        }
        return false;
    }

    // 检测 MagiskHide/DenyList
    public static boolean checkMagiskHide() {
        try {
            // 执行 magisk 命令
            Process process = Runtime.getRuntime().exec("magisk --hide status");
            BufferedReader reader = new BufferedReader(
                new InputStreamReader(process.getInputStream())
            );
            String line = reader.readLine();
            process.waitFor();
            return line != null;
        } catch (Exception e) {
            return false;
        }
    }

    // 通过挂载点检测
    public static boolean checkMagiskMount() {
        try {
            BufferedReader reader = new BufferedReader(
                new java.io.FileReader("/proc/self/mounts")
            );
            String line;
            while ((line = reader.readLine()) != null) {
                if (line.contains("magisk") || line.contains("/sbin/.")) {
                    reader.close();
                    return true;
                }
            }
            reader.close();
        } catch (Exception e) {
            // 忽略
        }
        return false;
    }

    // 检测 Zygisk
    public static boolean checkZygisk() {
        // Zygisk 会注入到 zygote 进程
        String[] zygiskIndicators = {
            "/data/adb/modules/zygisk",
            "/dev/zygisk"
        };

        for (String path : zygiskIndicators) {
            if (new File(path).exists()) {
                return true;
            }
        }
        return false;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

// Frida 脚本 - 绕过 Magisk 检测
Java.perform(function() {
    // 隐藏 Magisk 文件
    var magiskPaths = [
        "/sbin/.magisk", "/sbin/magisk", "/data/adb/magisk",
        "/data/data/com.topjohnwu.magisk"
    ];

    var File = Java.use("java.io.File");

    File.exists.implementation = function() {
        var path = this.getAbsolutePath();
        for (var i = 0; i < magiskPaths.length; i++) {
            if (path.indexOf(magiskPaths[i]) !== -1 ||
                path.indexOf("magisk") !== -1) {
                return false;
            }
        }
        return this.exists();
    };

    // Hook Runtime.exec 阻止 magisk 命令执行
    var Runtime = Java.use("java.lang.Runtime");

    Runtime.exec.overload("java.lang.String").implementation = function(cmd) {
        if (cmd.indexOf("magisk") !== -1 || cmd.indexOf("su") !== -1) {
            console.log("[*] Blocking command: " + cmd);
            throw Java.use("java.io.IOException").$new("Command not found");
        }
        return this.exec(cmd);
    };
});

// Native 层 Hook
Interceptor.attach(Module.findExportByName("libc.so", "fopen"), {
    onEnter: function(args) {
        var path = args[0].readCString();
        if (path && (path.indexOf("magisk") !== -1 ||
                     path.indexOf("/sbin/.") !== -1)) {
            console.log("[*] Blocking fopen: " + path);
            args[0].writeUtf8String("/nonexistent");
        }
    }
});