f7bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6T1N6h3&6F1P5h3u0D9N6h3g2Q4x3V1k6b7e0g2y4b7M7X3!0@1k6h3y4@1
对于Hook IBinder其实检测也不难,如果proxy过的话一般就是被注入了,
[培训]科锐逆向工程师培训第53期2025年7月8日开班!
//看不明白你的代码
PMSProtector { (Context context) { Class<?> activityThreadClass = { activityThreadClass = Class.(); Method currentActivityThreadMethod = activityThreadClass.getDeclaredMethod(); Object currentActivityThread = currentActivityThreadMethod.invoke(); Field sPackageManagerField = activityThreadClass.getDeclaredField(); sPackageManagerField.setAccessible(); Object sPackageManager = sPackageManagerField.get(currentActivityThread); (sPackageManager Proxy) { //这个是什么情况 System..println(); } PackageManager pm = context.getPackageManager()(pm.getClass().getClassLoader().getClass().getName().equals()) { } } (ClassNotFoundException e) { e.printStackTrace()} (NoSuchMethodException e) { e.printStackTrace()} (IllegalAccessException e) { e.printStackTrace()} (InvocationTargetException e) { e.printStackTrace()} (NoSuchFieldException e) { e.printStackTrace()} } }
无边 //看不明白你的代码PMSProtector { (Context&n ...
已经更新,原理很简单,ibinder被hook了会会变样的,虽然逻辑好像没变,仔细分析已经变了。