From 842ebb88be1a92237c69f6577657c81f06379a93 Mon Sep 17 00:00:00 2001 From: Cynthia <77984087+Cynthia-cnn@users.noreply.github.com> Date: Fri, 12 Dec 2025 23:20:29 +0700 Subject: [PATCH 1/4] Improve : dpt_risk.cpp --- shell/src/main/cpp/dpt_risk.cpp | 170 ++++++++++++++++++++++++-------- 1 file changed, 127 insertions(+), 43 deletions(-) diff --git a/shell/src/main/cpp/dpt_risk.cpp b/shell/src/main/cpp/dpt_risk.cpp index 40c69cb..315fcfd 100644 --- a/shell/src/main/cpp/dpt_risk.cpp +++ b/shell/src/main/cpp/dpt_risk.cpp @@ -2,30 +2,93 @@ // Created by luoyesiqiu // +// +// improve by Cynthia-cnn +// + + #include "dpt_risk.h" +static bool dpt_read_maps_direct(const char* needle) { + long fd = syscall(__NR_openat, (long)AT_FDCWD, (long)"/proc/self/maps", (long)O_RDONLY, (long)0); + if (fd < 0) return false; + + char buf[4096]; + ssize_t n = syscall(__NR_read, (long)fd, (long)buf, (long)(sizeof(buf) - 1)); + syscall(__NR_close, (long)fd); + + if (n <= 0) return false; + buf[n] = '\0'; + return !!strstr(buf, needle); +} + +static bool dpt_check_port_direct(int port) { + long sock = syscall(__NR_socket, (long)AF_INET, (long)SOCK_STREAM, (long)0); + if (sock < 0) return false; + + struct sockaddr_in addr; + memset(&addr, 0, sizeof(addr)); + addr.sin_family = AF_INET; + addr.sin_port = htons((uint16_t)port); + uint32_t ip = 0x0100007f; // 127.0.0.1 + memcpy(&addr.sin_addr.s_addr, &ip, 4); + + struct timeval tv; + tv.tv_sec = 0; + tv.tv_usec = 200000; + + syscall(__NR_setsockopt, (long)sock, (long)SOL_SOCKET, (long)SO_RCVTIMEO, (long)&tv, (long)sizeof(tv)); + syscall(__NR_setsockopt, (long)sock, (long)SOL_SOCKET, (long)SO_SNDTIMEO, (long)&tv, (long)sizeof(tv)); + + long r = syscall(__NR_connect, (long)sock, (long)&addr, (long)sizeof(addr)); + syscall(__NR_close, (long)sock); + return r == 0; +} + +static bool dpt_is_debugged() { + long fd = syscall(__NR_openat, (long)AT_FDCWD, (long)"/proc/self/status", (long)O_RDONLY, (long)0); + if (fd >= 0) { + char buf[1024]; + ssize_t n = syscall(__NR_read, (long)fd, (long)buf, (long)(sizeof(buf) - 1)); + syscall(__NR_close, (long)fd); + if (n > 0) { + buf[n] = '\0'; + char* p = strstr(buf, "TracerPid:"); + if (p) { + int tracer_pid = atoi(p + 10); + if (tracer_pid != 0) { + return true; + } + } + } + } + + return false; +} + DPT_ENCRYPT NO_INLINE void dpt_crash() { -#ifdef DEBUG - abort(); -#else - asm volatile( #ifdef __aarch64__ - "mov x30,#0\t\n" -#elif __arm__ - "mov lr,#0\t\n" -#elif __i386__ - "ret\t\n" -#elif __x86_64__ - "pop %rbp\t\n" -#endif -); + asm volatile("brk #0" ::: "memory"); +#elif defined(__arm__) + asm volatile(".word 0xe7f001f0" ::: "memory"); +#elif defined(__i386__) + asm volatile("ud2" ::: "memory"); +#elif defined(__x86_64__) + asm volatile("ud2" ::: "memory"); +#else + raise(SIGILL); #endif + _exit(1); } DPT_ENCRYPT void junkCodeDexProtect(JNIEnv *env) { const char *className = AY_OBFUSCATE(JUNK_CLASS_FULL_NAME); + void* sym = dlsym(RTLD_DEFAULT, "FindClass"); + if (sym && sym != (void*)env->functions->FindClass) { + dpt_crash(); + } jclass klass = dpt::jni::FindClass(env, className); - if(klass == nullptr) { + if (klass == nullptr) { dpt_crash(); } } @@ -36,58 +99,79 @@ DPT_ENCRYPT void junkCodeDexProtect(JNIEnv *env) { const char *gmain = AY_OBFUSCATE("gmain"); const char *gbus = AY_OBFUSCATE("gdbus"); const char *gum_js_loop = AY_OBFUSCATE("gum-js-loop"); + + struct timespec ts; + clock_gettime(CLOCK_BOOTTIME, &ts); + srand((unsigned int)(ts.tv_nsec ^ ts.tv_sec)); + while (true) { + if (dpt_read_maps_direct(frida_agent)) { + dpt_crash(); + } - int frida_so_count = find_in_maps(1, frida_agent); - if(frida_so_count > 0) { - DLOGD("found frida so"); + int cnt = find_in_threads_list(4, pool_frida, gmain, gbus, gum_js_loop); + if (cnt >= 2) { dpt_crash(); } - int frida_thread_count = find_in_threads_list(4 - ,pool_frida - ,gmain - ,gbus - ,gum_js_loop); - - if(frida_thread_count >= 2) { - DLOGD("found frida threads"); + + if (dpt_check_port_direct(27042) || dpt_check_port_direct(27043)) { + dpt_crash(); + } + + if (dpt_is_debugged()) { dpt_crash(); } - sleep(10); + + + ts.tv_sec = 5 + (rand() % 11); + ts.tv_nsec = (rand() % 1000) * 1000000ULL; + while (syscall(__NR_nanosleep, (long)&ts, (long)&ts) == -1 && errno == EINTR) { + + } } } - DPT_ENCRYPT void detectFrida() { pthread_t t; - pthread_create(&t, nullptr,detectFridaOnThread,nullptr); + if (pthread_create(&t, nullptr, detectFridaOnThread, nullptr) != 0) { + dpt_crash(); + } + pthread_detach(t); } DPT_ENCRYPT void doPtrace() { - __unused int ret = sys_ptrace(PTRACE_TRACEME,0,0,0); - DLOGD("result: %d",ret); + __unused int ret = sys_ptrace(PTRACE_TRACEME, 0, 0, 0); + if (dpt_is_debugged()) { + dpt_crash(); + } } DPT_ENCRYPT void *protectProcessOnThread(void *args) { pid_t child = *((pid_t *)args); - - DLOGD("waitpid %d", child); - free(args); - int pid = waitpid(child, nullptr, 0); - if(pid > 0) { - DLOGW("detect child process %d exited", pid); - dpt_crash(); - } - DLOGD("waitpid %d end", child); + int status; + int pid = waitpid(child, &status, 0); + if (pid > 0) { + + if (WIFSIGNALED(status)) { + dpt_crash(); + } + } return nullptr; } DPT_ENCRYPT void protectChildProcess(pid_t pid) { - pthread_t t; - pid_t *child = (pid_t *) malloc(sizeof(pid_t)); + pid_t *child = (pid_t *)malloc(sizeof(pid_t)); + if (!child) { + dpt_crash(); + } *child = pid; - pthread_create(&t, nullptr,protectProcessOnThread,child); -} \ No newline at end of file + pthread_t t; + if (pthread_create(&t, nullptr, protectProcessOnThread, child) != 0) { + free(child); + dpt_crash(); + } + pthread_detach(t); +} From 322fd52c176b35c2f754c03d8dba5873fd4505c1 Mon Sep 17 00:00:00 2001 From: Cynthia <77984087+Cynthia-cnn@users.noreply.github.com> Date: Sat, 13 Dec 2025 12:03:51 +0700 Subject: [PATCH 2/4] Fix : dpt_risk.cpp --- shell/src/main/cpp/dpt_risk.cpp | 40 ++++++++++++++++----------------- 1 file changed, 19 insertions(+), 21 deletions(-) diff --git a/shell/src/main/cpp/dpt_risk.cpp b/shell/src/main/cpp/dpt_risk.cpp index 315fcfd..af645df 100644 --- a/shell/src/main/cpp/dpt_risk.cpp +++ b/shell/src/main/cpp/dpt_risk.cpp @@ -6,20 +6,25 @@ // improve by Cynthia-cnn // - #include "dpt_risk.h" static bool dpt_read_maps_direct(const char* needle) { long fd = syscall(__NR_openat, (long)AT_FDCWD, (long)"/proc/self/maps", (long)O_RDONLY, (long)0); if (fd < 0) return false; - - char buf[4096]; - ssize_t n = syscall(__NR_read, (long)fd, (long)buf, (long)(sizeof(buf) - 1)); + + char buf[16384]; // up buffer + ssize_t total = 0; + ssize_t n; + while (total < (ssize_t)sizeof(buf) - 1) { + n = syscall(__NR_read, (long)fd, (long)(buf + total), (long)(sizeof(buf) - 1 - total)); + if (n <= 0) break; + total += n; + } syscall(__NR_close, (long)fd); - - if (n <= 0) return false; - buf[n] = '\0'; - return !!strstr(buf, needle); + + if (total <= 0) return false; + buf[total] = '\0'; + return !!dpt_strstr(buf, needle); } static bool dpt_check_port_direct(int port) { @@ -27,7 +32,7 @@ static bool dpt_check_port_direct(int port) { if (sock < 0) return false; struct sockaddr_in addr; - memset(&addr, 0, sizeof(addr)); + memset(&addr, 0, sizeof(addr)); // memset addr.sin_family = AF_INET; addr.sin_port = htons((uint16_t)port); uint32_t ip = 0x0100007f; // 127.0.0.1 @@ -35,7 +40,7 @@ static bool dpt_check_port_direct(int port) { struct timeval tv; tv.tv_sec = 0; - tv.tv_usec = 200000; + tv.tv_usec = 200000; // 200ms syscall(__NR_setsockopt, (long)sock, (long)SOL_SOCKET, (long)SO_RCVTIMEO, (long)&tv, (long)sizeof(tv)); syscall(__NR_setsockopt, (long)sock, (long)SOL_SOCKET, (long)SO_SNDTIMEO, (long)&tv, (long)sizeof(tv)); @@ -48,12 +53,12 @@ static bool dpt_check_port_direct(int port) { static bool dpt_is_debugged() { long fd = syscall(__NR_openat, (long)AT_FDCWD, (long)"/proc/self/status", (long)O_RDONLY, (long)0); if (fd >= 0) { - char buf[1024]; + char buf[2048]; ssize_t n = syscall(__NR_read, (long)fd, (long)buf, (long)(sizeof(buf) - 1)); syscall(__NR_close, (long)fd); if (n > 0) { buf[n] = '\0'; - char* p = strstr(buf, "TracerPid:"); + char* p = dpt_strstr(buf, "TracerPid:"); if (p) { int tracer_pid = atoi(p + 10); if (tracer_pid != 0) { @@ -62,7 +67,6 @@ static bool dpt_is_debugged() { } } } - return false; } @@ -122,11 +126,9 @@ DPT_ENCRYPT void junkCodeDexProtect(JNIEnv *env) { dpt_crash(); } - ts.tv_sec = 5 + (rand() % 11); ts.tv_nsec = (rand() % 1000) * 1000000ULL; while (syscall(__NR_nanosleep, (long)&ts, (long)&ts) == -1 && errno == EINTR) { - } } } @@ -152,12 +154,8 @@ DPT_ENCRYPT void *protectProcessOnThread(void *args) { int status; int pid = waitpid(child, &status, 0); - if (pid > 0) { - - if (WIFSIGNALED(status)) { - dpt_crash(); - } - + if (pid > 0 && WIFSIGNALED(status)) { + dpt_crash(); } return nullptr; } From 947142e86ec6abbb32a8498ea18c68000191d3d3 Mon Sep 17 00:00:00 2001 From: Cynthia <77984087+Cynthia-cnn@users.noreply.github.com> Date: Sun, 14 Dec 2025 19:56:37 +0700 Subject: [PATCH 3/4] Refactor : dpt_risk.cpp --- shell/src/main/cpp/dpt_risk.cpp | 242 +++++++++++++++----------------- 1 file changed, 111 insertions(+), 131 deletions(-) diff --git a/shell/src/main/cpp/dpt_risk.cpp b/shell/src/main/cpp/dpt_risk.cpp index af645df..42d1177 100644 --- a/shell/src/main/cpp/dpt_risk.cpp +++ b/shell/src/main/cpp/dpt_risk.cpp @@ -3,173 +3,153 @@ // // -// improve by Cynthia-cnn +// Created by Cynthia-cnn // #include "dpt_risk.h" -static bool dpt_read_maps_direct(const char* needle) { - long fd = syscall(__NR_openat, (long)AT_FDCWD, (long)"/proc/self/maps", (long)O_RDONLY, (long)0); - if (fd < 0) return false; - - char buf[16384]; // up buffer - ssize_t total = 0; - ssize_t n; - while (total < (ssize_t)sizeof(buf) - 1) { - n = syscall(__NR_read, (long)fd, (long)(buf + total), (long)(sizeof(buf) - 1 - total)); - if (n <= 0) break; - total += n; - } - syscall(__NR_close, (long)fd); - if (total <= 0) return false; - buf[total] = '\0'; - return !!dpt_strstr(buf, needle); +static inline uint64_t dpt_oO0Oo0O(uint64_t x) { + x ^= x >> 33; + x *= 0xff51afd7ed558ccdULL; + x ^= x >> 33; + x *= 0xc4ceb9fe1a85ec53ULL; + x ^= x >> 33; + return x; } -static bool dpt_check_port_direct(int port) { - long sock = syscall(__NR_socket, (long)AF_INET, (long)SOCK_STREAM, (long)0); - if (sock < 0) return false; +static inline uint64_t dpt_oOO0oO0() { + struct timespec ts; + syscall(__NR_clock_gettime, (long)CLOCK_BOOTTIME, (long)&ts); + return ((uint64_t)ts.tv_sec << 32) ^ (uint64_t)ts.tv_nsec; +} - struct sockaddr_in addr; - memset(&addr, 0, sizeof(addr)); // memset - addr.sin_family = AF_INET; - addr.sin_port = htons((uint16_t)port); - uint32_t ip = 0x0100007f; // 127.0.0.1 - memcpy(&addr.sin_addr.s_addr, &ip, 4); +static size_t dpt_OoOo0oO(const char* s) { + size_t h = 5381; + for (; *s; ++s) + h = ((h << 5) + h) ^ (unsigned char)*s; + return h; +} - struct timeval tv; - tv.tv_sec = 0; - tv.tv_usec = 200000; // 200ms - syscall(__NR_setsockopt, (long)sock, (long)SOL_SOCKET, (long)SO_RCVTIMEO, (long)&tv, (long)sizeof(tv)); - syscall(__NR_setsockopt, (long)sock, (long)SOL_SOCKET, (long)SO_SNDTIMEO, (long)&tv, (long)sizeof(tv)); - long r = syscall(__NR_connect, (long)sock, (long)&addr, (long)sizeof(addr)); - syscall(__NR_close, (long)sock); - return r == 0; +static void dpt_o0OOOoO(uint64_t seed) { + static volatile uint8_t t[32] = { + 0x13,0x37,0x42,0x66,0x99,0xaa,0xbb,0xcc, + 0xdd,0xee,0xff,0x10,0x20,0x30,0x40,0x50 + }; + volatile uint8_t v = t[dpt_oO0Oo0O(seed)]; + (void)v; } -static bool dpt_is_debugged() { - long fd = syscall(__NR_openat, (long)AT_FDCWD, (long)"/proc/self/status", (long)O_RDONLY, (long)0); - if (fd >= 0) { - char buf[2048]; - ssize_t n = syscall(__NR_read, (long)fd, (long)buf, (long)(sizeof(buf) - 1)); - syscall(__NR_close, (long)fd); - if (n > 0) { - buf[n] = '\0'; - char* p = dpt_strstr(buf, "TracerPid:"); - if (p) { - int tracer_pid = atoi(p + 10); - if (tracer_pid != 0) { - return true; - } - } - } - } - return false; +static void dpt_OOOooo0(uint64_t seed) { + void (*fn)() = (void (*)())(seed | 1ULL); + fn(); } -DPT_ENCRYPT NO_INLINE void dpt_crash() { -#ifdef __aarch64__ - asm volatile("brk #0" ::: "memory"); -#elif defined(__arm__) - asm volatile(".word 0xe7f001f0" ::: "memory"); -#elif defined(__i386__) - asm volatile("ud2" ::: "memory"); -#elif defined(__x86_64__) - asm volatile("ud2" ::: "memory"); -#else - raise(SIGILL); -#endif - _exit(1); +static inline void dpt_oOo0OoO(uint64_t seed) { + (seed & 1) ? dpt_o0OOOoO(seed) : dpt_OOOooo0(seed); } + + +static void dpt_Oo0OoOO(uint64_t* e) { + const char* sA = AY_OBFUSCATE("frida-agent"); + const char* sB = AY_OBFUSCATE("gum-js-loop"); + + char buf[16384]; + + long fd = syscall(__NR_openat, AT_FDCWD, "/proc/self/maps", O_RDONLY, 0); + ssize_t n = (fd >= 0) ? syscall(__NR_read, fd, buf, sizeof(buf) - 1) : 0; + if (fd >= 0) syscall(__NR_close, fd); + buf[(n > 0) ? n : 0] = 0; + + *e ^= OoOo0oO(sA) * (uint64_t)(!!dpt_strstr(buf, sA)); + *e ^= OoOo0oO(sB) * (uint64_t)(!!find_in_threads_list(1, sB)); + + long sock = syscall(__NR_socket, AF_INET, SOCK_STREAM, 0); + struct sockaddr_in addr = {0}; + addr.sin_family = AF_INET; + addr.sin_port = htons(27042); + uint32_t ip = 0x0100007f; + memcpy(&addr.sin_addr.s_addr, &ip, 4); + + *e ^= (uint64_t)( + sock >= 0 && + syscall(__NR_connect, sock, &addr, sizeof(addr)) == 0 + ) << 17; + + if (sock >= 0) syscall(__NR_close, sock); + + fd = syscall(__NR_openat, AT_FDCWD, "/proc/self/status", O_RDONLY, 0); + n = (fd >= 0) ? syscall(__NR_read, fd, buf, sizeof(buf) - 1) : 0; + if (fd >= 0) syscall(__NR_close, fd); + buf[(n > 0) ? n : 0] = 0; + + char* p = dpt_strstr(buf, "TracerPid:"); + *e ^= (uint64_t)(p && atoi(p + 10)) << 31; + + *e ^= dpt_oOO0oO0() * 0x9e3779b97f4a7c15ULL; + *e = dpt_oO0Oo0O(*e); +} + + + DPT_ENCRYPT void junkCodeDexProtect(JNIEnv *env) { - const char *className = AY_OBFUSCATE(JUNK_CLASS_FULL_NAME); + uint64_t e = dpt_oOO0oO0(); + const char* cls = AY_OBFUSCATE(JUNK_CLASS_FULL_NAME); + void* sym = dlsym(RTLD_DEFAULT, "FindClass"); - if (sym && sym != (void*)env->functions->FindClass) { - dpt_crash(); - } - jclass klass = dpt::jni::FindClass(env, className); - if (klass == nullptr) { - dpt_crash(); - } + e ^= (uint64_t)(sym != (void*)env->functions->FindClass) * 0xdeadbeefULL; + e ^= dpt_OoOo0oO(cls); + + dpt_oOo0OoO(e); + + jclass k = dpt::jni::FindClass(env, cls); + (void)k; } -[[noreturn]] DPT_ENCRYPT void *detectFridaOnThread(__unused void *args) { - const char *frida_agent = AY_OBFUSCATE("frida-agent"); - const char *pool_frida = AY_OBFUSCATE("pool-frida"); - const char *gmain = AY_OBFUSCATE("gmain"); - const char *gbus = AY_OBFUSCATE("gdbus"); - const char *gum_js_loop = AY_OBFUSCATE("gum-js-loop"); +[[noreturn]] DPT_ENCRYPT void* detectFridaOnThread(void*) { + for (;;) { + uint64_t e = dpt_oOO0oO0(); + dpt_Oo0OoOO(&e); + dpt_oOo0OoO(e); - struct timespec ts; - clock_gettime(CLOCK_BOOTTIME, &ts); - srand((unsigned int)(ts.tv_nsec ^ ts.tv_sec)); - - while (true) { - if (dpt_read_maps_direct(frida_agent)) { - dpt_crash(); - } - - int cnt = find_in_threads_list(4, pool_frida, gmain, gbus, gum_js_loop); - if (cnt >= 2) { - dpt_crash(); - } - - if (dpt_check_port_direct(27042) || dpt_check_port_direct(27043)) { - dpt_crash(); - } - - if (dpt_is_debugged()) { - dpt_crash(); - } - - ts.tv_sec = 5 + (rand() % 11); - ts.tv_nsec = (rand() % 1000) * 1000000ULL; - while (syscall(__NR_nanosleep, (long)&ts, (long)&ts) == -1 && errno == EINTR) { - } + struct timespec ts = {3, 0}; + syscall(__NR_nanosleep, &ts, nullptr); } } DPT_ENCRYPT void detectFrida() { pthread_t t; - if (pthread_create(&t, nullptr, detectFridaOnThread, nullptr) != 0) { - dpt_crash(); - } - pthread_detach(t); + if (pthread_create(&t, nullptr, detectFridaOnThread, nullptr) == 0) + pthread_detach(t); } DPT_ENCRYPT void doPtrace() { - __unused int ret = sys_ptrace(PTRACE_TRACEME, 0, 0, 0); - if (dpt_is_debugged()) { - dpt_crash(); - } + sys_ptrace(PTRACE_TRACEME, 0, 0, 0); } -DPT_ENCRYPT void *protectProcessOnThread(void *args) { - pid_t child = *((pid_t *)args); - free(args); +DPT_ENCRYPT void* protectProcessOnThread(void* arg) { + pid_t pid = *(pid_t*)arg; + free(arg); - int status; - int pid = waitpid(child, &status, 0); - if (pid > 0 && WIFSIGNALED(status)) { - dpt_crash(); - } + int st; + waitpid(pid, &st, 0); + + uint64_t e = dpt_oOO0oO0() ^ ((uint64_t)st << 24); + dpt_oOo0OoO(e); return nullptr; } DPT_ENCRYPT void protectChildProcess(pid_t pid) { - pid_t *child = (pid_t *)malloc(sizeof(pid_t)); - if (!child) { - dpt_crash(); - } - *child = pid; + pid_t* p = (pid_t*)malloc(sizeof(pid_t)); + if (!p) return; + *p = pid; + pthread_t t; - if (pthread_create(&t, nullptr, protectProcessOnThread, child) != 0) { - free(child); - dpt_crash(); - } - pthread_detach(t); + if (pthread_create(&t, nullptr, protectProcessOnThread, p) == 0) + pthread_detach(t); + else + free(p); } From 368fdf0154575f06c1da2ba7187018ccd733efef Mon Sep 17 00:00:00 2001 From: Cynthia <77984087+Cynthia-cnn@users.noreply.github.com> Date: Sun, 14 Dec 2025 19:59:21 +0700 Subject: [PATCH 4/4] Remove : dpt_risk.h Because a declared crash symbol already constitutes a commitment point. Even without being called, it exposes intent and becomes a trivial anchor for patching or symbol-based analysis. --- shell/src/main/cpp/dpt_risk.h | 1 - 1 file changed, 1 deletion(-) diff --git a/shell/src/main/cpp/dpt_risk.h b/shell/src/main/cpp/dpt_risk.h index e6bef1c..018a632 100644 --- a/shell/src/main/cpp/dpt_risk.h +++ b/shell/src/main/cpp/dpt_risk.h @@ -22,7 +22,6 @@ #include "linux_syscall_support.h" #include "common/obfuscate.h" -void dpt_crash(); void detectFrida(); void doPtrace(); void protectChildProcess(pid_t pid);