forked from Trietptm-on-Security/WooYun-2
-
Notifications
You must be signed in to change notification settings - Fork 7
/
Android Java层的anti-hooking技巧.html
353 lines (286 loc) · 124 KB
/
Android Java层的anti-hooking技巧.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
<html>
<head>
<title>Android Java层的anti-hooking技巧 - 路人甲</title>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<h1>原文地址:<a href="http://drops.wooyun.org/tips/16356">http://drops.wooyun.org/tips/16356</a></h1>
<p>
<p><strong>原文：</strong><a href="http://d3adend.org/blog/?p=589">http://d3adend.org/blog/?p=589</a></p>
<h1>0x00 前言</h1>
<hr />
<p>一个最近关于检测native hook框架的方法让我开始思考一个Android应用如何在Java层检测Cydia Substrate或者Xposed框架。</p>
<p><strong>声明:</strong></p>
<p>下文所有的anti-hooking技巧很容易就可以被有经验的逆向人员绕过，这里只是展示几个检测的方法。在最近DexGuard和GuardIT等工具中还没有这类anti-hooking检测功能，不过我相信不久就会增加这个功能。</p>
<!--more-->
<h1>0x01 检测安装的应用</h1>
<hr />
<p>一个最直接的想法就是检测设备上有没有安装Substrate或者Xposed框架，可以直接调用PackageManager显示所有安装的应用，然后看是否安装了Substrate或者Xposed。</p>
<pre><code>#!java
PackageManager packageManager = context.getPackageManager();
List applicationInfoList = packageManager.getInstalledApplications(PackageManager.GET_META_DATA);
for(ApplicationInfo applicationInfo : applicationInfoList) {
if(applicationInfo.packageName.equals("de.robv.android.xposed.installer")) {
Log.wtf("HookDetection", "Xposed found on the system.");
}
if(applicationInfo.packageName.equals("com.saurik.substrate")) {
Log.wtf("HookDetection", "Substrate found on the system.");
}
}
</code></pre>
<h1>0x02 检查调用栈里的可疑方法</h1>
<hr />
<p>另一个想到的方法是检查Java调用栈里的可疑方法，主动抛出一个异常，然后打印方法的调用栈。代码如下：</p>
<pre><code>#!java
public class DoStuff {
public static String getSecret() {
try {
throw new Exception("blah");
}
catch(Exception e) {
for(StackTraceElement stackTraceElement : e.getStackTrace()) {
Log.wtf("HookDetection", stackTraceElement.getClassName() + "->" + stackTraceElement.getMethodName());
}
}
return "ChangeMePls!!!";
}
}
</code></pre>
<p>当应用没有被hook的时候，正常的调用栈是这样的：</p>
<pre><code>#!bash
com.example.hookdetection.DoStuff->getSecret
com.example.hookdetection.MainActivity->onCreate
android.app.Activity->performCreate
android.app.Instrumentation->callActivityOnCreate
android.app.ActivityThread->performLaunchActivity
android.app.ActivityThread->handleLaunchActivity
android.app.ActivityThread->access$800
android.app.ActivityThread$H->handleMessage
android.os.Handler->dispatchMessage
android.os.Looper->loop
android.app.ActivityThread->main
java.lang.reflect.Method->invokeNative
java.lang.reflect.Method->invoke
com.android.internal.os.ZygoteInit$MethodAndArgsCaller->run
com.android.internal.os.ZygoteInit->main
dalvik.system.NativeStart->main
</code></pre>
<p>但是假如有Xposed框架hook了com.example.hookdetection.DoStuff.getSecret方法，那么调用栈会有2个变化：</p>
<ul>
<li>在dalvik.system.NativeStart.main方法后出现de.robv.android.xposed.XposedBridge.main调用</li>
<li>如果Xposed hook了调用栈里的一个方法，还会有de.robv.android.xposed.XposedBridge.handleHookedMethod 和de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative调用</li>
</ul>
<p>所以如果hook了getSecret方法，调用栈就会如下：</p>
<pre><code>#!bash
com.example.hookdetection.DoStuff->getSecret
de.robv.android.xposed.XposedBridge->invokeOriginalMethodNative
de.robv.android.xposed.XposedBridge->handleHookedMethod
com.example.hookdetection.DoStuff->getSecret
com.example.hookdetection.MainActivity->onCreate
android.app.Activity->performCreate
android.app.Instrumentation->callActivityOnCreate
android.app.ActivityThread->performLaunchActivity
android.app.ActivityThread->handleLaunchActivity
android.app.ActivityThread->access$800
android.app.ActivityThread$H->handleMessage
android.os.Handler->dispatchMessage
android.os.Looper->loop
android.app.ActivityThread->main
java.lang.reflect.Method->invokeNative
java.lang.reflect.Method->invoke
com.android.internal.os.ZygoteInit$MethodAndArgsCaller->run
com.android.internal.os.ZygoteInit->main
de.robv.android.xposed.XposedBridge->main
dalvik.system.NativeStart->main
</code></pre>
<p>下面看下Substrate hook com.example.hookdetection.DoStuff.getSecret方法后，调用栈会有什么变化：</p>
<ul>
<li>dalvik.system.NativeStart.main调用后会出现2次com.android.internal.os.ZygoteInit.main，而不是一次。</li>
<li>如果Substrate hook了调用栈里的一个方法，还会出现com.saurik.substrate.MS$2.invoked，com.saurik.substrate.MS$MethodPointer.invoke还有跟Substrate扩展相关的方法（这里是com.cigital.freak.Freak$1$1.invoked）。</li>
</ul>
<p>所以如果hook了getSecret方法，调用栈就会如下：</p>
<pre><code>#!bash
com.example.hookdetection.DoStuff->getSecret
com.saurik.substrate._MS$MethodPointer->invoke
com.saurik.substrate.MS$MethodPointer->invoke
com.cigital.freak.Freak$1$1->invoked
com.saurik.substrate.MS$2->invoked
com.example.hookdetection.DoStuff->getSecret
com.example.hookdetection.MainActivity->onCreate
android.app.Activity->performCreate
android.app.Instrumentation->callActivityOnCreate
android.app.ActivityThread->performLaunchActivity
android.app.ActivityThread->handleLaunchActivity
android.app.ActivityThread->access$800
android.app.ActivityThread$H->handleMessage
android.os.Handler->dispatchMessage
android.os.Looper->loop
android.app.ActivityThread->main
java.lang.reflect.Method->invokeNative
java.lang.reflect.Method->invoke
com.android.internal.os.ZygoteInit$MethodAndArgsCaller->run
com.android.internal.os.ZygoteInit->main
com.android.internal.os.ZygoteInit->main
dalvik.system.NativeStart->main
</code></pre>
<p>在知道了调用栈的变化之后，就可以在Java层写代码进行检测：</p>
<pre><code>#!java
try {
throw new Exception("blah");
}
catch(Exception e) {
int zygoteInitCallCount = 0;
for(StackTraceElement stackTraceElement : e.getStackTrace()) {
if(stackTraceElement.getClassName().equals("com.android.internal.os.ZygoteInit")) {
zygoteInitCallCount++;
if(zygoteInitCallCount == 2) {
Log.wtf("HookDetection", "Substrate is active on the device.");
}
}
if(stackTraceElement.getClassName().equals("com.saurik.substrate.MS$2") &&
stackTraceElement.getMethodName().equals("invoked")) {
Log.wtf("HookDetection", "A method on the stack trace has been hooked using Substrate.");
}
if(stackTraceElement.getClassName().equals("de.robv.android.xposed.XposedBridge") &&
stackTraceElement.getMethodName().equals("main")) {
Log.wtf("HookDetection", "Xposed is active on the device.");
}
if(stackTraceElement.getClassName().equals("de.robv.android.xposed.XposedBridge") &&
stackTraceElement.getMethodName().equals("handleHookedMethod")) {
Log.wtf("HookDetection", "A method on the stack trace has been hooked using Xposed.");
}
}
}
</code></pre>
<h1>0x03 检测并不应该native的native方法</h1>
<hr />
<p>Xposed框架会把hook的Java方法类型改为"native"，然后把原来的方法替换成自己的代码（调用hookedMethodCallback）。可以查看<a href="https://github.com/rovo89/Xposed/blob/6a8c2db5523377742a2c40fbd317b559e46b386f/libxposed_dalvik.cpp">XposedBridge_hookMethodNative</a>的实现，是修改后app_process里的方法。</p>
<p>利用Xposed改变hook方法的这个特性（Substrate也使用类似的原理），就可以用来检测是否被hook了。注意这不能用来检测ART运行时的Xposed，因为没必要把方法的类型改为native。</p>
<p>假设有下面这个方法：</p>
<pre><code>#!java
public class DoStuff {
public static String getSecret() {
return "ChangeMePls!!!";
}
}
</code></pre>
<p>如果getSecret方法被hook了，在运行的时候就会像下面的定义：</p>
<pre><code>#!java
public class DoStuff {
// calls hookedMethodCallback if hooked using Xposed
public native static String getSecret();
}
</code></pre>
<p>基于上面的原理，检测的步骤如下：</p>
<ul>
<li>定位到应用的DEX文件</li>
<li>枚举所有的class</li>
<li>通过反射机制判断运行时不应该是native的方法</li>
</ul>
<p>下面的Java展示了这个技巧。这里假设了应用本身没有通过JNI调用本地代码，大多数应用都不需要调用本地方法。不过如果有JNI调用的话，只需要把这些native方法添加到一个白名单中即可。理论上这个方法也可以用于检测Java库或者第三方库，不过需要把第三方库的native方法添加到一个白名单。检测代码如下：</p>
<pre><code>#!java
for (ApplicationInfo applicationInfo : applicationInfoList) {
if (applicationInfo.processName.equals("com.example.hookdetection")) {
Set classes = new HashSet();
DexFile dex;
try {
dex = new DexFile(applicationInfo.sourceDir);
Enumeration entries = dex.entries();
while(entries.hasMoreElements()) {
String entry = entries.nextElement();
classes.add(entry);
}
dex.close();
}
catch (IOException e) {
Log.e("HookDetection", e.toString());
}
for(String className : classes) {
if(className.startsWith("com.example.hookdetection")) {
try {
Class clazz = HookDetection.class.forName(className);
for(Method method : clazz.getDeclaredMethods()) {
if(Modifier.isNative(method.getModifiers())){
Log.wtf("HookDetection", "Native function found (could be hooked by Substrate or Xposed): " + clazz.getCanonicalName() + "->" + method.getName());
}
}
}
catch(ClassNotFoundException e) {
Log.wtf("HookDetection", e.toString());
}
}
}
}
}
</code></pre>
<h1>0x04 通过/proc/[pid]/maps检测可疑的共享对象或者JAR</h1>
<hr />
<p>/proc/[pid]/maps记录了内存映射的区域和访问权限，首先查看Android应用的映像，第一列是起始地址和结束地址，第六列是映射文件的路径。</p>
<pre><code>#!bash
#cat /proc/5584/maps
40027000-4002c000 r-xp 00000000 103:06 2114 /system/bin/app_process
4002c000-4002d000 r--p 00004000 103:06 2114 /system/bin/app_process
4002d000-4002e000 rw-p 00005000 103:06 2114 /system/bin/app_process
4002e000-4003d000 r-xp 00000000 103:06 246 /system/bin/linker
4003d000-4003e000 r--p 0000e000 103:06 246 /system/bin/linker
4003e000-4003f000 rw-p 0000f000 103:06 246 /system/bin/linker
4003f000-40042000 rw-p 00000000 00:00 0
40042000-40043000 r--p 00000000 00:00 0
40043000-40044000 rw-p 00000000 00:00 0
40044000-40047000 r-xp 00000000 103:06 1176 /system/lib/libNimsWrap.so
40047000-40048000 r--p 00002000 103:06 1176 /system/lib/libNimsWrap.so
40048000-40049000 rw-p 00003000 103:06 1176 /system/lib/libNimsWrap.so
40049000-40091000 r-xp 00000000 103:06 1237 /system/lib/libc.so
... Lots of other memory regions here ...
</code></pre>
<p>因此可以写代码检测加载到当前内存区域中的可疑文件：</p>
<pre><code>#!java
try {
Set libraries = new HashSet();
String mapsFilename = "/proc/" + android.os.Process.myPid() + "/maps";
BufferedReader reader = new BufferedReader(new FileReader(mapsFilename));
String line;
while((line = reader.readLine()) != null) {
if (line.endsWith(".so") || line.endsWith(".jar")) {
int n = line.lastIndexOf(" ");
libraries.add(line.substring(n + 1));
}
}
for (String library : libraries) {
if(library.contains("com.saurik.substrate")) {
Log.wtf("HookDetection", "Substrate shared object found: " + library);
}
if(library.contains("XposedBridge.jar")) {
Log.wtf("HookDetection", "Xposed JAR found: " + library);
}
}
reader.close();
}
catch (Exception e) {
Log.wtf("HookDetection", e.toString());
}
</code></pre>
<p>Substrate会用到几个so：</p>
<pre><code>#!bash
Substrate shared object found: /data/app-lib/com.saurik.substrate-1/libAndroidBootstrap0.so
Substrate shared object found: /data/app-lib/com.saurik.substrate-1/libAndroidCydia.cy.so
Substrate shared object found: /data/app-lib/com.saurik.substrate-1/libDalvikLoader.cy.so
Substrate shared object found: /data/app-lib/com.saurik.substrate-1/libsubstrate.so
Substrate shared object found: /data/app-lib/com.saurik.substrate-1/libsubstrate-dvm.so
Substrate shared object found: /data/app-lib/com.saurik.substrate-1/libAndroidLoader.so
</code></pre>
<p>Xposed会用到一个Jar：</p>
<pre><code>#!bash
Xposed JAR found: /data/data/de.robv.android.xposed.installer/bin/XposedBridge.jar
</code></pre>
<h1>0x05 绕过检测的方法</h1>
<hr />
<p>上面讨论了几个anti-hooking的方法，不过相信也会有人提出绕过的方法，这里对应每个检测方法如下：</p>
<ul>
<li>hook PackageManager的getInstalledApplications，把Xposed或者Substrate的包名去掉</li>
<li>hook Exception的getStackTrace，把自己的方法去掉</li>
<li>hook getModifiers，把flag改成看起来不是native</li>
<li>hook 打开的文件的操作，返回/dev/null或者修改的map文件</li>
</ul> </p>
</body>
</html>