diff --git a/shell/src/main/cpp/dpt_risk.cpp b/shell/src/main/cpp/dpt_risk.cpp index 40c69cb..42d1177 100644 --- a/shell/src/main/cpp/dpt_risk.cpp +++ b/shell/src/main/cpp/dpt_risk.cpp @@ -2,92 +2,154 @@ // Created by luoyesiqiu // +// +// Created by Cynthia-cnn +// + #include "dpt_risk.h" -DPT_ENCRYPT NO_INLINE void dpt_crash() { -#ifdef DEBUG - abort(); -#else - asm volatile( -#ifdef __aarch64__ - "mov x30,#0\t\n" -#elif __arm__ - "mov lr,#0\t\n" -#elif __i386__ - "ret\t\n" -#elif __x86_64__ - "pop %rbp\t\n" -#endif -); -#endif + +static inline uint64_t dpt_oO0Oo0O(uint64_t x) { + x ^= x >> 33; + x *= 0xff51afd7ed558ccdULL; + x ^= x >> 33; + x *= 0xc4ceb9fe1a85ec53ULL; + x ^= x >> 33; + return x; +} + +static inline uint64_t dpt_oOO0oO0() { + struct timespec ts; + syscall(__NR_clock_gettime, (long)CLOCK_BOOTTIME, (long)&ts); + return ((uint64_t)ts.tv_sec << 32) ^ (uint64_t)ts.tv_nsec; +} + +static size_t dpt_OoOo0oO(const char* s) { + size_t h = 5381; + for (; *s; ++s) + h = ((h << 5) + h) ^ (unsigned char)*s; + return h; +} + + + +static void dpt_o0OOOoO(uint64_t seed) { + static volatile uint8_t t[32] = { + 0x13,0x37,0x42,0x66,0x99,0xaa,0xbb,0xcc, + 0xdd,0xee,0xff,0x10,0x20,0x30,0x40,0x50 + }; + volatile uint8_t v = t[dpt_oO0Oo0O(seed)]; + (void)v; +} + +static void dpt_OOOooo0(uint64_t seed) { + void (*fn)() = (void (*)())(seed | 1ULL); + fn(); +} + +static inline void dpt_oOo0OoO(uint64_t seed) { + (seed & 1) ? dpt_o0OOOoO(seed) : dpt_OOOooo0(seed); +} + + + +static void dpt_Oo0OoOO(uint64_t* e) { + const char* sA = AY_OBFUSCATE("frida-agent"); + const char* sB = AY_OBFUSCATE("gum-js-loop"); + + char buf[16384]; + + long fd = syscall(__NR_openat, AT_FDCWD, "/proc/self/maps", O_RDONLY, 0); + ssize_t n = (fd >= 0) ? syscall(__NR_read, fd, buf, sizeof(buf) - 1) : 0; + if (fd >= 0) syscall(__NR_close, fd); + buf[(n > 0) ? n : 0] = 0; + + *e ^= OoOo0oO(sA) * (uint64_t)(!!dpt_strstr(buf, sA)); + *e ^= OoOo0oO(sB) * (uint64_t)(!!find_in_threads_list(1, sB)); + + long sock = syscall(__NR_socket, AF_INET, SOCK_STREAM, 0); + struct sockaddr_in addr = {0}; + addr.sin_family = AF_INET; + addr.sin_port = htons(27042); + uint32_t ip = 0x0100007f; + memcpy(&addr.sin_addr.s_addr, &ip, 4); + + *e ^= (uint64_t)( + sock >= 0 && + syscall(__NR_connect, sock, &addr, sizeof(addr)) == 0 + ) << 17; + + if (sock >= 0) syscall(__NR_close, sock); + + fd = syscall(__NR_openat, AT_FDCWD, "/proc/self/status", O_RDONLY, 0); + n = (fd >= 0) ? syscall(__NR_read, fd, buf, sizeof(buf) - 1) : 0; + if (fd >= 0) syscall(__NR_close, fd); + buf[(n > 0) ? n : 0] = 0; + + char* p = dpt_strstr(buf, "TracerPid:"); + *e ^= (uint64_t)(p && atoi(p + 10)) << 31; + + *e ^= dpt_oOO0oO0() * 0x9e3779b97f4a7c15ULL; + *e = dpt_oO0Oo0O(*e); } + + DPT_ENCRYPT void junkCodeDexProtect(JNIEnv *env) { - const char *className = AY_OBFUSCATE(JUNK_CLASS_FULL_NAME); - jclass klass = dpt::jni::FindClass(env, className); - if(klass == nullptr) { - dpt_crash(); - } + uint64_t e = dpt_oOO0oO0(); + const char* cls = AY_OBFUSCATE(JUNK_CLASS_FULL_NAME); + + void* sym = dlsym(RTLD_DEFAULT, "FindClass"); + e ^= (uint64_t)(sym != (void*)env->functions->FindClass) * 0xdeadbeefULL; + e ^= dpt_OoOo0oO(cls); + + dpt_oOo0OoO(e); + + jclass k = dpt::jni::FindClass(env, cls); + (void)k; } -[[noreturn]] DPT_ENCRYPT void *detectFridaOnThread(__unused void *args) { - const char *frida_agent = AY_OBFUSCATE("frida-agent"); - const char *pool_frida = AY_OBFUSCATE("pool-frida"); - const char *gmain = AY_OBFUSCATE("gmain"); - const char *gbus = AY_OBFUSCATE("gdbus"); - const char *gum_js_loop = AY_OBFUSCATE("gum-js-loop"); - while (true) { - - int frida_so_count = find_in_maps(1, frida_agent); - if(frida_so_count > 0) { - DLOGD("found frida so"); - dpt_crash(); - } - int frida_thread_count = find_in_threads_list(4 - ,pool_frida - ,gmain - ,gbus - ,gum_js_loop); - - if(frida_thread_count >= 2) { - DLOGD("found frida threads"); - dpt_crash(); - } - sleep(10); +[[noreturn]] DPT_ENCRYPT void* detectFridaOnThread(void*) { + for (;;) { + uint64_t e = dpt_oOO0oO0(); + dpt_Oo0OoOO(&e); + dpt_oOo0OoO(e); + + struct timespec ts = {3, 0}; + syscall(__NR_nanosleep, &ts, nullptr); } } - DPT_ENCRYPT void detectFrida() { pthread_t t; - pthread_create(&t, nullptr,detectFridaOnThread,nullptr); + if (pthread_create(&t, nullptr, detectFridaOnThread, nullptr) == 0) + pthread_detach(t); } DPT_ENCRYPT void doPtrace() { - __unused int ret = sys_ptrace(PTRACE_TRACEME,0,0,0); - DLOGD("result: %d",ret); + sys_ptrace(PTRACE_TRACEME, 0, 0, 0); } -DPT_ENCRYPT void *protectProcessOnThread(void *args) { - pid_t child = *((pid_t *)args); +DPT_ENCRYPT void* protectProcessOnThread(void* arg) { + pid_t pid = *(pid_t*)arg; + free(arg); - DLOGD("waitpid %d", child); - - free(args); - - int pid = waitpid(child, nullptr, 0); - if(pid > 0) { - DLOGW("detect child process %d exited", pid); - dpt_crash(); - } - DLOGD("waitpid %d end", child); + int st; + waitpid(pid, &st, 0); + uint64_t e = dpt_oOO0oO0() ^ ((uint64_t)st << 24); + dpt_oOo0OoO(e); return nullptr; } DPT_ENCRYPT void protectChildProcess(pid_t pid) { + pid_t* p = (pid_t*)malloc(sizeof(pid_t)); + if (!p) return; + *p = pid; + pthread_t t; - pid_t *child = (pid_t *) malloc(sizeof(pid_t)); - *child = pid; - pthread_create(&t, nullptr,protectProcessOnThread,child); -} \ No newline at end of file + if (pthread_create(&t, nullptr, protectProcessOnThread, p) == 0) + pthread_detach(t); + else + free(p); +} diff --git a/shell/src/main/cpp/dpt_risk.h b/shell/src/main/cpp/dpt_risk.h index e6bef1c..018a632 100644 --- a/shell/src/main/cpp/dpt_risk.h +++ b/shell/src/main/cpp/dpt_risk.h @@ -22,7 +22,6 @@ #include "linux_syscall_support.h" #include "common/obfuscate.h" -void dpt_crash(); void detectFrida(); void doPtrace(); void protectChildProcess(pid_t pid);