Android hook檢測(安全方向)
阿新 • • 發佈:2018-12-10
什麼是hook
所謂hook技術,就是通過一段程式碼(反射、代理)侵入到App啟動過程中,在原本執行的程式碼前插入其它的功能。比如:通過hook技術,上傳登陸頁面的賬號密碼等。
乾貨
對於主流hook框架(Xposed、Cydia Substrate),通常有以下三種方式來檢測一個App是否被hook:
- 安裝目錄中是否存在hook工具
- 儲存中是否存在hook安裝檔案
- 執行棧中是否存在hook相關類
1.查詢裝置安裝目錄中是否存在hook工具
private static boolean findHookAppName(Context context) { PackageManager packageManager = context.getPackageManager(); List<ApplicationInfo> applicationInfoList = packageManager .getInstalledApplications(PackageManager.GET_META_DATA); for (ApplicationInfo applicationInfo : applicationInfoList) { if (applicationInfo.packageName.equals("de.robv.android.xposed.installer")) { Log.wtf("HookDetection", "Xposed found on the system."); return true; } if (applicationInfo.packageName.equals("com.saurik.substrate")) { Log.wtf("HookDetection", "Substrate found on the system."); return true; } } return false; }
2.查詢裝置儲存中是否存在hook安裝檔案
private static boolean findHookAppFile() { try { Set<String> libraries = new HashSet<String>(); String mapsFilename = "/proc/" + android.os.Process.myPid() + "/maps"; BufferedReader reader = new BufferedReader(new FileReader(mapsFilename)); String line; while ((line = reader.readLine()) != null) { if (line.endsWith(".so") || line.endsWith(".jar")) { int n = line.lastIndexOf(" "); libraries.add(line.substring(n + 1)); } } reader.close(); for (String library : libraries) { if (library.contains("com.saurik.substrate")) { Log.wtf("HookDetection", "Substrate shared object found: " + library); return true; } if (library.contains("XposedBridge.jar")) { Log.wtf("HookDetection", "Xposed JAR found: " + library); return true; } } } catch (Exception e) { Log.wtf("HookDetection", e.toString()); } return false; }
3.查詢程式執行的棧中是否存在hook相關類
private static boolean findHookStack() { try { throw new Exception("findhook"); } catch (Exception e) { // 讀取棧資訊 // for(StackTraceElement stackTraceElement : e.getStackTrace()) { // Log.wtf("HookDetection", stackTraceElement.getClassName() + "->"+ // stackTraceElement.getMethodName()); // } int zygoteInitCallCount = 0; for (StackTraceElement stackTraceElement : e.getStackTrace()) { if (stackTraceElement.getClassName().equals("com.android.internal.os.ZygoteInit")) { zygoteInitCallCount++; if (zygoteInitCallCount == 2) { Log.wtf("HookDetection", "Substrate is active on the device."); return true; } } if (stackTraceElement.getClassName().equals("com.saurik.substrate.MS$2") && stackTraceElement.getMethodName().equals("invoked")) { Log.wtf("HookDetection", "A method on the stack trace has been hooked using Substrate."); return true; } if (stackTraceElement.getClassName().equals("de.robv.android.xposed.XposedBridge") && stackTraceElement.getMethodName().equals("main")) { Log.wtf("HookDetection", "Xposed is active on the device."); return true; } if (stackTraceElement.getClassName().equals("de.robv.android.xposed.XposedBridge") && stackTraceElement.getMethodName().equals("handleHookedMethod")) { Log.wtf("HookDetection", "A method on the stack trace has been hooked using Xposed."); return true; } } } return false; }
4.綜合判斷 (true為hook)
public static boolean isHook(Context context) {
if (findHookAppName(context) || findHookAppFile() || findHookStack()) {
return true;
}
return false;
}