• [原创] Bypass 某 x 书 frida 检测

0x01、环境

app 版本：8.46.0 酷安下载
设备：Pixel 2XL Android 8.1
hook：frida 12.8.0、frida-tools 5.3.0

0x02、Bypass_frida

hook libc.so 模块中 strstr 与 strcmp，一把绕过。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
function Bypass_frida() {
    var pt_strstr = Module.findExportByName("libc.so", 'strstr');
    Interceptor.attach(pt_strstr, {
        onEnter: function (args) {
            var args1 = args[0].readCString();
            var args2 = args[1].readCString();
            if (
                args2.indexOf("gum-js-loop") !== -1 ||
                args2.indexOf("pool-frida") !== -1||
                args2.indexOf("linjector") !== -1 ||
                args2.indexOf("REJECT") !== -1 ||
                args2.indexOf("frida") !== -1 ||
                args2.indexOf("gmain") !== -1 ||
                args2.indexOf("gdbus") !== -1 ||
                args2.indexOf("tmp") !== -1
            ) {
                console.log("strstr-->", args1, args2);
                this.hook_str = true;
            }
        }, onLeave: function (retval) {
            if (this.hook_str) {
                retval.replace(0);
            }
        }
    });
 
    var pt_strcmp = Module.findExportByName("libc.so", 'strcmp');
    Interceptor.attach(pt_strcmp, {
        onEnter: function (args) {
            var args1 = args[0].readCString();
            var args2 = args[1].readCString();
            if (
                args2.indexOf("gum-js-loop") !== -1 ||
                args2.indexOf("pool-frida") !== -1||
                args2.indexOf("linjector") !== -1 ||
                args2.indexOf("REJECT") !== -1 ||
                args2.indexOf("frida") !== -1 ||
                args2.indexOf("gmain") !== -1 ||
                args2.indexOf("gdbus") !== -1 ||
                args2.indexOf("tmp") !== -1
            ) {
                console.log("strcmp-->", args1, args2);
                this.hook_cmp = true;
            }
        }, onLeave: function (retval) {
            if (this.hook_cmp) {
                retval.replace(0);
            }
        }
    })
}
Bypass_frida();

0x03、效果

图片描述

最新回复：
你瞒我瞒 2024-07-26 09:36:28
x是什么，小白猜不到。
行简 2024-07-26 10:03:58
你瞒我瞒 x是什么，小白猜不到。
是 x 啊
hacker521 2024-07-28 00:16:14
你瞒我瞒 x是什么，小白猜不到。
小红薯
你瞒我瞒 2024-07-29 09:38:50
行简 是 x 啊[em_76]
之前的蓝尿?
mb_rugymctl 2024-07-29 19:20:01
大佬，能帮忙app去壳吗？https://f.ws28.cn/f/epnkmz8iilm
行简 2024-07-30 10:46:00
mb_rugymctl 大佬，能帮忙app去壳吗？https://f.ws28.cn/f/epnkmz8iilm
可 私我
mb_rugymctl 2024-07-30 17:37:07
行简 可 私我
呃。。。账号没权限私信
mb_jeslfge 2024-11-09 10:58:02
看样子像脸书