过某b app的frida检测

16岁的年轻人

function hook_dlopen(soName = '') {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    // console.log(path)
                    if (path.indexOf(soName) >= 0) {
                        locate_init()
                    }
                }
            }
        }
    );
}

function locate_init() {
    let secmodule = null
    Interceptor.attach(Module.findExportByName(null, "__system_property_get"),
        {
            // _system_property_get("ro.build.version.sdk", v1);
            onEnter: function (args) {
                secmodule = Process.findModuleByName("libmsaoaidsec.so")
                var name = args[0];
                if (name !== undefined && name != null) {
                    name = ptr(name).readCString();
                    if (name.indexOf("ro.build.version.sdk") >= 0) {
                        // 这是.init_proc刚开始执行的地方，是一个比较早的时机点
                        // do something
                        hook_pthread_create()
                    }
                }
            }
        }
    );
}

let i = 0;
function hook_pthread_create() {

    //只有三条检测线程被干掉之后开始hook
    if (i >= 3) {
        hook()
    }

    let baseAddress = Process.findModuleByName("libmsaoaidsec.so").base;
    console.log("libmsaoaidsec.so --- " + baseAddress);

    Interceptor.replace(Module.findExportByName("libc.so", "pthread_create"), new NativeCallback(function (attr, start_routine, arg1, arg2) {
        // console.log("The thread function address is ", arg1)
        let func_addr = arg1.sub(baseAddress); // 计算相对地址

        // 判断 func_addr 的值是否为指定的偏移
        if (func_addr.equals(ptr(0x1B8D4)) || func_addr.equals(ptr(0x26E5C)) || func_addr.equals(ptr(0x1c544))) {
            i++
            console.log(func_addr, i)

            //假装成功创建线程
            return 0
        }


        // 获取系统库中的 pthread_create 函数并调用
        let pthread_create = new NativeFunction(Module.findExportByName("libc.so", "pthread_create"), 'int', ['pointer', 'pointer', 'pointer', 'pointer']);
        return pthread_create(attr, start_routine, arg1, arg2);
    }, 'int', ['pointer', 'pointer', 'pointer', 'pointer']));
}

setImmediate(hook_dlopen, "libmsaoaidsec.so")

function hook() {
//......
}

16岁的年轻人

libmsaoaidsec

[Pixel 4::tv.danmaku.bili ]-> libmsaoaidsec.so --- 0x7749a83000
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x7749a9f544
The thread function address is 0x7749a9e8d4
The thread function address is 0x7749aa9e5c
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
The thread function address is 0x782b5394ec
Process terminated