__int64 antiFartYoupkAndAntiFrida()
{
Jni_Data
*
*
v0;
/
/
x21
jclass v1;
/
/
x19
unsigned
int
v2;
/
/
w19
__int64 v4;
/
/
x19
Jni_Data
*
v5;
/
/
x8
__int64 v6;
/
/
x19
void
*
v7;
/
/
x0
Jni_Data
*
v8;
/
/
x8
__int64 v9;
/
/
[xsp
+
8h
] [xbp
-
B8h] BYREF
_BYTE v10[
8
];
/
/
[xsp
+
10h
] [xbp
-
B0h] BYREF
char v11[
128
];
/
/
[xsp
+
18h
] [xbp
-
A8h] BYREF
__int64 v12;
/
/
[xsp
+
98h
] [xbp
-
28h
]
v12
=
*
(_QWORD
*
)(_ReadStatusReg(ARM64_SYSREG(
3
,
3
,
13
,
0
,
2
))
+
40
);
if
( (unsigned
int
)faccessat(
"/data/dexname"
) !
=
-
1
)
{
return
1
;
}
v0
=
ppjni_data;
v1
=
(
*
(
*
ppjni_data)
-
>Env)
-
>FindClass((
*
ppjni_data)
-
>Env,
"cn/youlor/Unpacker"
);
(
*
v0)
-
>jni_func_D5D58
-
>checkException((
*
v0)
-
>Env);
if
( v1 )
{
return
1
;
}
if
( (
*
v0)
-
>androidVersion <
24
|| (v2
=
1
,
!((__int64 (__fastcall
*
)(const char
*
, const char
*
, __int64))(
*
v0)
-
>hookfunc_D59F8
-
>dlsym)(
"libart.so"
,
"_ZN3art8Unpacker12dumpAllDexesEv"
,
1LL
))
&& (v2
=
1
,
!((__int64 (__fastcall
*
)(const char
*
, const char
*
, __int64))(
*
v0)
-
>hookfunc_D59F8
-
>dlsym)(
"libart.so"
,
"_ZN3art4Aupk13aupkArtMethodE"
,
1LL
)) )
{
if
( (unsigned
int
)faccessat(
"/data/local/tmp/unpacker.config"
) !
=
-
1
)
{
return
1
;
}
if
( (unsigned
int
)faccessat(
"/data/local/tmp/aupk.config"
) !
=
-
1
)
{
return
1
;
}
if
( (unsigned
int
)faccessat(
"/data/fart"
) !
=
-
1
)
{
return
1
;
}
v4
=
(__int64)(
*
(
*
v0)
-
>Env)
-
>FindClass((
*
v0)
-
>Env,
"cn/mik/Fartext"
);
(
*
v0)
-
>jni_func_D5D58
-
>checkException((
*
v0)
-
>Env);
if
( v4 )
{
return
1
;
}
if
( (unsigned
int
)faccessat(
"/data/system/mik.conf"
) !
=
-
1
)
{
return
1
;
}
v5
=
*
v0;
v9
=
0LL
;
v6
=
(__int64)(
*
v5
-
>Env)
-
>NewStringUTF(v5
-
>Env,
"mikrom"
);
(
*
v0)
-
>jni_func_D5D58
-
>CallStaticObjectMethodV(
(
*
v0)
-
>Env,
&v9,
"android/os/ServiceManager"
,
aLjava,
"getService"
,
v6);
(
*
(
*
v0)
-
>Env)
-
>DeleteLocalRef((
*
v0)
-
>Env, (jobject)v6);
if
( v9 || !strstr(aData,
"re.frida.server"
) )
{
return
1
;
}
if
( (
*
v0)
-
>androidVersion <
24
)
{
v7
=
dlopen(
"libart.so"
,
0
);
if
( v7 && dlsym(v7,
"myfartInvoke"
) )
{
return
1
;
}
}
else
if
( ((__int64 (__fastcall
*
)(const char
*
, const char
*
, _QWORD))(
*
v0)
-
>hookfunc_D59F8
-
>dlsym)(
"libart.so"
,
"myfartInvoke"
,
0LL
) )
{
return
1
;
}
v8
=
*
v0;
if
( !(
*
v0)
-
>isPakeName )
{
LABEL_25:
(
*
(void (__fastcall
*
*
)(_BYTE
*
, _QWORD, _DWORD
*
(
*
)(), _QWORD))v8
-
>pthread_create)(v10,
0LL
, sub_43D80,
0LL
);
return
0
;
}
memset(v11,
0
, sizeof(v11));
if
( (
int
)_system_property_get_1((__int64)
"ro.dalvik.vm.native.bridge"
, (__int64)v11) <
1
|| !strcmp_1(v11,
"libriruloader.so"
) && (unsigned
int
)faccessat(
"/system/lib/libriruloader.so"
)
=
=
-
1
)
{
(
*
(void (__fastcall
*
*
)(_BYTE
*
, _QWORD, void (__fastcall __noreturn
*
)(__int64), _QWORD))(
*
v0)
-
>pthread_create)(
v10,
0LL
,
antiFrida,
0LL
);
v8
=
*
v0;
goto LABEL_25;
}
return
1
;
}
return
v2;
}