-
-
[原创] Bypass 某 x 书 frida 检测
-
发表于: 2024-7-25 16:43
-
app 版本：8.46.0 酷安下载
设备：Pixel 2XL Android 8.1
hook：frida 12.8.0、frida-tools 5.3.0
hook libc.so 模块中 strstr 与 strcmp，一把绕过。
function Bypass_frida() { var pt_strstr = Module.findExportByName("libc.so", 'strstr');
Interceptor.attach(pt_strstr, {
onEnter: function (args) {
var args1 = args[0].readCString();
var args2 = args[1].readCString();
if (
args2.indexOf("gum-js-loop") !== -1 ||
args2.indexOf("pool-frida") !== -1||
args2.indexOf("linjector") !== -1 ||
args2.indexOf("REJECT") !== -1 ||
args2.indexOf("frida") !== -1 ||
args2.indexOf("gmain") !== -1 ||
args2.indexOf("gdbus") !== -1 ||
args2.indexOf("tmp") !== -1
) {
console.log("strstr-->", args1, args2);
this.hook_str = true;
}
}, onLeave: function (retval) {
if (this.hook_str) {
retval.replace(0);
}
}
});
var pt_strcmp = Module.findExportByName("libc.so", 'strcmp');
Interceptor.attach(pt_strcmp, {
onEnter: function (args) {
var args1 = args[0].readCString();
var args2 = args[1].readCString();
if (
args2.indexOf("gum-js-loop") !== -1 ||
args2.indexOf("pool-frida") !== -1||
args2.indexOf("linjector") !== -1 ||
args2.indexOf("REJECT") !== -1 ||
args2.indexOf("frida") !== -1 ||
args2.indexOf("gmain") !== -1 ||
args2.indexOf("gdbus") !== -1 ||
args2.indexOf("tmp") !== -1
) {
console.log("strcmp-->", args1, args2);
this.hook_cmp = true;
}
}, onLeave: function (retval) {
if (this.hook_cmp) {
retval.replace(0);
}
}
})
}Bypass_frida();function Bypass_frida() { var pt_strstr = Module.findExportByName("libc.so", 'strstr');
Interceptor.attach(pt_strstr, {
onEnter: function (args) {
var args1 = args[0].readCString();
var args2 = args[1].readCString();
if (
args2.indexOf("gum-js-loop") !== -1 ||
args2.indexOf("pool-frida") !== -1||
args2.indexOf("linjector") !== -1 ||
args2.indexOf("REJECT") !== -1 ||
args2.indexOf("frida") !== -1 ||
args2.indexOf("gmain") !== -1 ||
args2.indexOf("gdbus") !== -1 ||
args2.indexOf("tmp") !== -1
) {
console.log("strstr-->", args1, args2);
this.hook_str = true;
}
}, onLeave: function (retval) {
if (this.hook_str) {
retval.replace(0);
}
}
});
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
最后于 2024-7-25 16:54
被行简编辑
，原因： Done
|
|
|---|---|
|
|
|
|
|
是 x 啊 
|
|
|
小红薯 |
|
|
之前的蓝尿? |
|
|
|
|
|
可 私我 |
|
|
呃。。。账号没权限私信 
|
|
|
|
