devbox
很楠不爱3
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

安卓逆向环境检测--模拟器_模拟器检测

作者：很楠不爱3 | 2024-03-18 08:47:56

赞

踩

模拟器检测

一、通过 android/os/Build 类检测虚拟机

  1.  
  2. UNEXPORT bool AntiEmulator::check_Build(JNIEnv *env) {
  3.     char* sig = "Ljava/lang/String;";
  4.     Field* field = new Field("android/os/Build", env);
  5.     bool ret = false;
  6.  
  7.     // HARDWARE
  8.     jstring HARDWARE = field->get_static_jstring_field("HARDWARE", sig);
  9.     char *cHARDWARE = const_cast<char *>(env->GetStringUTFChars(HARDWARE, NULL));
  10.     if (Str::strstr(cHARDWARE, "vbox86") != nullptr ||
  11.         Str::strstr(cHARDWARE, "nox") != nullptr ||
  12.         Str::strstr(cHARDWARE, "ttVM_x86") != nullptr ) {//是模拟器 不通过
  13.         LOGI("check_Build => check FINGERPRINT find emulator => FINGERPRINT:%s", cHARDWARE);
  14.         ret =  true;
  15.     }
  16.     LOGI("HARDWARE:%s", cHARDWARE);
  17.  
  18.     // FINGERPRINT
  19.     jstring FINGERPRINT = field->get_static_jstring_field("FINGERPRINT", sig);
  20.     char *cFINGERPRINT = const_cast<char *>(env->GetStringUTFChars(FINGERPRINT, NULL));
  21.     if (Str::strstr(cFINGERPRINT, "Android") != nullptr || Str::strstr(cFINGERPRINT, "unknown") != nullptr ||
  22.             Str::strstr(cFINGERPRINT, "generic/sdk/generic") != nullptr ||
  23.             Str::strstr(cFINGERPRINT, "generic_x86/sdk_x86/generic_x86") != nullptr ||
  24.             Str::strstr(cFINGERPRINT, "Andy") != nullptr ||
  25.             Str::strstr(cFINGERPRINT, "ttVM_Hdragon") != nullptr ||
  26.             Str::strstr(cFINGERPRINT, "generic/google_sdk/generic") != nullptr ||
  27.             Str::strstr(cFINGERPRINT, "vbox86p") != nullptr ||
  28.             Str::strstr(cFINGERPRINT, "generic/vbox86p/vbox86p") != nullptr) {//是模拟器 不通过
  29.         LOGI("check_Build => check FINGERPRINT find emulator => FINGERPRINT:%s", cFINGERPRINT);
  30.         ret =  true;
  31.     }
  32.     LOGI("FINGERPRINT:%s", cFINGERPRINT);
  33.  
  34.     // MODEL
  35.     jstring MODEL = field->get_static_jstring_field("MODEL", sig);
  36.     char *cMODEL = const_cast<char *>(env->GetStringUTFChars(MODEL, NULL));
  37.     if (Str::strstr(cMODEL, "google_sdk") != nullptr || Str::strstr(cMODEL, "Emulator") != nullptr ||
  38.                 Str::strstr(cMODEL, "Droid4X") != nullptr ||
  39.                 Str::strstr(cMODEL, "TiantianVM") != nullptr ||
  40.                 Str::strstr(cMODEL, "Andy") != nullptr ||
  41.                 Str::strstr(cMODEL, "Android SDK built for x86_64") != nullptr ||
  42.                 Str::strstr(cMODEL, "Android SDK built for x86") != nullptr) {//是模拟器 不通过
  43.         LOGI("check_Build => check MODEL find emulator => MODEL:%s", cMODEL);
  44.         ret = true;
  45.     }
  46.     LOGI("MODEL:%s", cMODEL);
  47.  
  48.     // MANUFACTURER
  49.     jstring MANUFACTURER = field->get_static_jstring_field("MANUFACTURER", sig);
  50.     char *cMANUFACTURER = const_cast<char *>(env->GetStringUTFChars(MANUFACTURER, NULL));
  51.     if (Str::strstr(cMANUFACTURER, "Genymotion") != nullptr ||
  52.             Str::strstr(cMANUFACTURER, "Andy") != nullptr ||
  53.             Str::strstr(cMANUFACTURER, "nox") != nullptr ||
  54.             Str::strstr(cMANUFACTURER, "TiantianVM") != nullptr) {//是模拟器 不通过
  55.         LOGI("check_Build => check MANUFACTURER find emulator => MANUFACTURER:%s", cMANUFACTURER);
  56.         ret = true;
  57.     }
  58.     LOGI("MANUFACTURER:%s", cMANUFACTURER);
  59.  
  60.     // PRODUCT
  61.     jstring PRODUCT = field->get_static_jstring_field("PRODUCT", sig);
  62.     char *cPRODUCT = const_cast<char *>(env->GetStringUTFChars(PRODUCT, NULL));
  63.     if (Str::strstr(cPRODUCT, "sdk") != nullptr ||
  64.             Str::strstr(cPRODUCT, "Andy") != nullptr ||
  65.             Str::strstr(cPRODUCT, "Droid4X") != nullptr ||
  66.             Str::strstr(cPRODUCT, "nox") != nullptr ||
  67.             Str::strstr(cPRODUCT, "vbox86p") != nullptr ) {//是模拟器 不通过
  68.         LOGI("check_Build => check PRODUCT find emulator => PRODUCT:%s", cPRODUCT);
  69.         ret = true;
  70.     }
  71.     LOGI("PRODUCT:%s", cPRODUCT);
  72.  
  73.     // BRAND   DEVICE
  74.     jstring BRAND = field->get_static_jstring_field("BRAND", sig);
  75.     char *cBRAND = const_cast<char *>(env->GetStringUTFChars(BRAND, NULL));
  76.     jstring DEVICE = field->get_static_jstring_field("DEVICE", sig);
  77.     char *cDEVICE = const_cast<char *>(env->GetStringUTFChars(DEVICE, NULL));
  78.     if ((Str::strstr(cBRAND, "generic") != nullptr && Str::strstr(cDEVICE, "generic") == cDEVICE) ||
  79.             Str::strstr(cBRAND, "Andy") != nullptr ||
  80.             Str::strstr(cBRAND, "Droid4X") != nullptr ||
  81.             Str::strstr(cBRAND, "nox") != nullptr ||
  82.             Str::strstr(cBRAND, "vbox86p") != nullptr ) {//是模拟器 不通过
  83.         LOGI("check_Build => check BRAND find emulator => BRAND:%s", cBRAND);
  84.         LOGI("check_Build => check DEVICE find emulator => DEVICE:%s", cDEVICE);
  85.         ret = true;
  86.     }
  87.     LOGI("BRAND:%s", cBRAND);
  88.     LOGI("DEVICE:%s", cDEVICE);
  89.     env->ReleaseStringUTFChars(HARDWARE, cHARDWARE);
  90.     env->ReleaseStringUTFChars(FINGERPRINT, cFINGERPRINT);
  91.     env->ReleaseStringUTFChars(MODEL, cMODEL);
  92.     env->ReleaseStringUTFChars(MANUFACTURER, cMANUFACTURER);
  93.     env->ReleaseStringUTFChars(PRODUCT, cPRODUCT);
  94.     env->ReleaseStringUTFChars(BRAND, cBRAND);
  95.     env->ReleaseStringUTFChars(DEVICE, cDEVICE);
  96.     return ret;
  97. }

二、通过检查prop.build文件中的字段来判断是否为模拟器

  1.  
  2. UNEXPORT bool AntiEmulator::check_prop() {
  3.     char tmp[1024] = {0};
  4.  
  5.     // ro.kernel.qemu
  6.     File::read_property("ro.kernel.qemu", reinterpret_cast<char *>(&tmp));
  7.     if (Str::strcmp(tmp, "1") == 0){
  8.         return true;
  9.     }
  10.     LOGI("check_prop ro.kernel.qemu -> %s", tmp);
  11.  
  12.     // ro.product.model
  13.     File::read_property("ro.product.model", reinterpret_cast<char *>(&tmp));
  14.     if (Str::strstr(tmp, "sdk") != nullptr || Str::strstr(tmp, "Android SDK") != nullptr){
  15.         return true;
  16.     }
  17.     LOGI("check_prop ro.product.model -> %s", tmp);
  18.  
  19.     // ro.product.cpu.abi
  20.     File::read_property("ro.product.cpu.abi", reinterpret_cast<char *>(&tmp));
  21.     if (Str::strcmp(tmp, "x86") == 0){
  22.         return true;
  23.     }
  24.     LOGI("check_prop ro.product.cpu.abi -> %s", tmp);
  25.     return false;
  26. }

三、检查是否存在一些模拟器框架文件

  1.  
  2. UNEXPORT void AntiEmulator::check_file() {
  3.     char *(path[]) = {
  4.             "/system/bin/androVM-prop",   //检测androidVM
  5.             "/system/bin/microvirt-prop", //检测逍遥模拟器--新版本找不到特征
  6.             "/system/lib/libdroid4x.so",  //检测海马模拟器
  7.             "/system/bin/windroyed",      //检测文卓爷模拟器
  8.             "/system/bin/nox-prop",       //检测夜神模拟器--某些版本找不到特征
  9.             "/system/lib/libnoxspeedup.so",//检测夜神模拟器
  10.             "/system/bin/ttVM-prop",      //检测天天模拟器
  11.             "/data/.bluestacks.prop",     //检测bluestacks模拟器  51模拟器
  12.             "/system/bin/duosconfig",     //检测AMIDuOS模拟器
  13.             "/system/etc/xxzs_prop.sh",   //检测星星模拟器
  14.             "/system/etc/mumu-configs/device-prop-configs/mumu.config", //网易MuMu模拟器
  15.             "/system/priv-app/ldAppStore",   //雷电模拟器
  16.             "/system/bin/ldinit",             //雷电模拟器
  17.             "/system/bin/ldmountsf",          //雷电模拟器
  18.             "/system/app/AntStore",          //小蚁模拟器
  19.             "/system/app/AntLauncher",       //小蚁模拟器
  20.             "vmos.prop",                     //vmos虚拟机
  21.             "fstab.titan",                   //光速虚拟机
  22.             "init.titan.rc",                 //光速虚拟机
  23.             "x8.prop",                       //x8沙箱和51虚拟机
  24.             "/system/lib/libc_malloc_debug_qemu.so", //AVD QEMU
  25.             "/system/bin/microvirtd",
  26.             "/dev/socket/qemud",
  27.             "/dev/qemu_pipe"};
  28.     for (int i = 0; i < sizeof(path) / sizeof(char*); i++){
  29.         if (Syscall::check_file_or_dir_exists(path[i])){
  30.             LOGI("check_file  %s file existing", path[i]);
  31.             // TODO 风险
  32.  
  33.         }
  34.     }
  35. }

四、检测cpu温度，一般模拟器没有此文件:/sys/class/thermal/thermal_zone...

  1.  
  2. UNEXPORT void AntiEmulator::check_cpu_temp() {
  3.     DIR *dirptr = NULL; //当前手机的温度检测，手机下均有thermal_zone文件
  4.     int count = 0;
  5.     struct dirent *entry;
  6.     if ((dirptr = opendir("/sys/class/thermal/")) != NULL) {
  7.         while (entry = readdir(dirptr)) {
  8.             if (!strcmp(entry->d_name, ".") || !strcmp(entry->d_name, "..")) {
  9.                 continue;
  10.             }
  11.             char *tmp = entry->d_name;
  12.             if (Str::strstr(tmp, "thermal_zone") != NULL) {
  13.                 count++;
  14.             }
  15.         }
  16.         closedir(dirptr);
  17.     } else {
  18.         LOGE("AntiEmulator::check_cpu_temp open thermal fail");
  19.     }
  20.     if (count == 0){
  21.         // TODO 此时为模拟器
  22.     }
  23.     LOGI("AntiEmulator::check_cpu_temp count=%d", count);
  24. }

五、读取 /proc/cpuinfo，真机一般会获取到hardware

  1. UNEXPORT void AntiEmulator::check_cpu() {
  2.     string str = Syscall::readFile((char*)"/proc/cpuinfo");
  3.     char* split = (char*)"\n";
  4.     string strs = str + split; // 在字符串末尾也加入分隔符，方便截取最后一段
  5.     size_t pos = strs.find(split);
  6.     while (pos != strs.npos)
  7.     {
  8.         string temp = strs.substr(0, pos);
  9.         if (Str::strstr(const_cast<char *>(temp.c_str()), "Hardware") != NULL){
  10.             LOGI("AntiEmulator::check_cpu find %s", temp.c_str());
  11.             return;
  12.         }
  13.         //去掉已分割的字符串,在剩下的字符串中进行分割
  14.         strs = strs.substr(pos + 1, strs.size());
  15.         pos = strs.find(split);
  16.     }
  17.     // TODO 没找到 Hardware，说明为模拟器
  18.  
  19. }

六、读取 /proc/version，模拟器一般有qemu，tencent

  1. UNEXPORT void AntiEmulator::check_version() {
  2.     string str = Syscall::readFile((char*)"/proc/version");
  3.     char* split = (char*)"\n";
  4.     string strs = str + split; // 在字符串末尾也加入分隔符，方便截取最后一段
  5.     size_t pos = strs.find(split);
  6.     while (pos != strs.npos)
  7.     {
  8.         string temp = strs.substr(0, pos);
  9.         if (Str::strstr(const_cast<char *>(temp.c_str()), "qemu") != NULL ||
  10.             Str::strstr(const_cast<char *>(temp.c_str()), "qemu") != NULL){
  11.             // TODO 发现模拟器
  12.             LOGI("AntiEmulator::check_version find %s", temp.c_str());
  13.             return;
  14.         }
  15.         //去掉已分割的字符串,在剩下的字符串中进行分割
  16.         strs = strs.substr(pos + 1, strs.size());
  17.         pos = strs.find(split);
  18.     }
  19. }

七、检查传感器个数，少于20个认为是模拟器

  1. UNEXPORT void AntiEmulator::check_sensor(JNIEnv *env) {
  2.     jobject context = AntiEmulator::getApplicationContext(env);
  3.     LOGI("check_sensor context %p", context);
  4.     jstring sensor = env->NewStringUTF("sensor");
  5.     jobject objService = Method::callMethodObject(env, context,
  6.                                                   "android/content/Context",
  7.                                                   "getSystemService",
  8.                                                   "(Ljava/lang/String;)Ljava/lang/Object;",
  9.                                                   sensor);
  10.     env->DeleteLocalRef(sensor);
  11.     LOGI("check_sensor objService %p", objService);
  12.     jobject sensorlist = Method::callMethodObject(env, objService,
  13.                                                                  "android/hardware/SensorManager",
  14.                                                                  "getSensorList",
  15.                                                                  "(I)Ljava/util/List;",
  16.                                                                  -1);
  17.     LOGI("check_sensor sensorlist %p", sensorlist);
  18.     jint len = Method::callMethodInt(env, sensorlist, "java/util/List", "size", "()I");
  19.     LOGI("check_sensor sensorlist len=%d", len);
  20.     if (len < 20){
  21.         // todo 传感器少于20 认为当前环境为非真机环境
  22.     }
  23.  
  24. }

八、检查摄像头个数

  1. UNEXPORT void AntiEmulator::check_camera(JNIEnv *env) {
  2.     jobject context = AntiEmulator::getApplicationContext(env);
  3.     LOGI("check_camera context %p", context);
  4.     jstring camera = env->NewStringUTF("camera");
  5.     jobject objService = Method::callMethodObject(env, context,
  6.                                                                  "android/content/Context",
  7.                                                                  "getSystemService",
  8.                                                                  "(Ljava/lang/String;)Ljava/lang/Object;",
  9.                                                                     camera);
  10.     env->DeleteLocalRef(camera);
  11.     LOGI("check_camera objService %p", objService);
  12.     jobjectArray cameralist = static_cast<jobjectArray>(Method::callMethodObject(env, objService,
  13.                                                                                  "android/hardware/camera2/CameraManager",
  14.                                                                                  "getCameraIdList",
  15.                                                                                  "()[Ljava/lang/String;"));
  16.     LOGI("check_camera cameralist %p", cameralist);
  17.     int len = env->GetArrayLength(cameralist);
  18.     LOGI("check_camera cameralist len %d", len);
  19.     if (len < 2){
  20.         // todo 摄像头少于2 认为当前环境为非真机环境
  21.  
  22.     }
  23. //    for (int i = 0; i < len + 1; i++){
  24. //        jobject ca = env->GetObjectArrayElement(cameralist, i);
  25. //        LOGI("check_camera camera -> %d : %p", i, ca);
  26. //    }
  27.  
  28. }

九、检查mounts文件，检测里面是否包含docker关键字 ，防止一些云手机搞虚拟化，通过使用docker进行挂载

  1. UNEXPORT void AntiEmulator::check_mounts() {
  2.     char *(path[]) = {"/proc/mounts", "/proc/self/mountstats", "/proc/self/mountinfo"};
  3.     for (int i = 0; i < sizeof(path) / sizeof(char*); i++){
  4.         string status = Syscall::readFile(path[i]);
  5.         if (status == "null"){
  6.             break;
  7.         }
  8.         size_t pos = status.find("\n");
  9.         while (pos != status.npos)
  10.         {
  11.             string temp = status.substr(0, pos);
  12.             if (Str::strstr(const_cast<char *>(temp.c_str()), (char*)"docker") != nullptr){
  13.                 //TODO 发现docker, 可能存在云手机挂载docker
  14.  
  15.             }
  16.             //去掉已分割的字符串,在剩下的字符串中进行分割
  17.             status = status.substr(pos + 1, status.size());
  18.             pos = status.find("\n");
  19.         }
  20.     }
  21. }

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/很楠不爱3/article/detail/261806
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号