-
-
[原创] 关于hunter检测的隐藏
-
发表于: 2025-4-29 23:08
-
检测点
Find Xposed Api
这种最好过的了, 直接自编译一下lsposed, 改改包名类名就行了.
Hunter可能已经被注入
这种就是有可执行的匿名内存, 参考: e94K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6J5k6i4k6W2L8Y4W2Q4x3V1k6m8L8X3c8J5L8$3W2V1i4K6u0V1e0r3W2T1M7X3q4J5P5g2)9J5k6q4u0W2L8h3q4H3i4K6u0V1d9r3W2V1k6b7`.`.
我的方法是open一个/system/lib下的正常so文件(要求文件大小比内存块大), mmap后, move内存后mremap回去, 但有些应用会崩溃,原因没查出来, 所以看看就好, 生产环境不能用, 过hunter momo nativeTest是没有问题的
底下那一堆Find JVM Method Is Hooked也是在匿名内存搞定后就没了
inMemoryDexClassLoader
这个就更好过了
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | jmethodID initMid;if (sdk_int < __ANDROID_API_Q__) { // c1fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0M7#2)9J5k6h3q4F1k6s2u0G2K9h3c8Q4x3X3g2U0L8$3#2Q4x3V1k6S2L8X3c8J5L8$3W2V1i4K6u0r3M7r3I4S2N6r3k6G2M7X3#2Q4x3V1k6K6N6i4m8W2M7Y4m8J5L8$3A6W2j5%4c8Q4x3V1k6Q4x3V1u0Q4x3V1k6S2L8X3c8J5L8$3W2V1i4K6u0V1z5g2)9J5k6e0m8Q4x3X3f1H3i4K6g2X3M7U0q4Q4x3@1q4D9K9h3u0U0L8%4u0W2i4K6u0r3k6r3q4D9N6X3W2C8i4K6u0r3M7%4u0U0i4K6u0r3L8h3q4A6L8W2)9J5c8X3A6S2N6X3q4Q4x3V1k6V1j5h3I4$3K9h3E0Q4x3V1k6K6P5i4y4@1k6h3#2Q4x3V1k6n7j5i4y4W2c8r3g2^5b7$3I4S2M7%4y4x3L8$3q4V1k6i4u0Q4x3X3g2B7j5i4k6S2i4K6y4n7L8q4)9K6c8o6p5J5x3H3`.`. initMid = JNI_GetMethodID(env, in_memory_classloader, "<init>", "([Ljava/nio/ByteBuffer;Ljava/lang/ClassLoader;)V");} else { // 7b1K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0M7#2)9J5k6h3q4F1k6s2u0G2K9h3c8Q4x3X3g2U0L8$3#2Q4x3V1k6S2L8X3c8J5L8$3W2V1i4K6u0r3M7r3I4S2N6r3k6G2M7X3#2Q4x3V1k6K6N6i4m8W2M7Y4m8J5L8$3A6W2j5%4c8Q4x3V1k6Q4x3V1u0Q4x3V1k6S2L8X3c8J5L8$3W2V1i4K6u0V1x3e0m8Q4x3X3f1H3i4K6u0W2x3q4)9#2k6Y4t1I4i4K6y4m8L8r3W2T1j5$3!0J5k6g2)9J5c8X3c8S2L8s2k6A6K9#2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3k6r3q4D9N6X3W2C8i4K6u0r3M7%4W2K6N6r3g2E0i4K6u0r3b7X3q4K6k6f1c8W2P5p5y4D9j5i4y4K6e0r3!0S2k6r3g2J5i4K6u0W2K9X3q4$3j5g2)9K6b7X3I4Q4x3@1b7I4y4K6x3`. initMid = JNI_GetMethodID(env, in_memory_classloader, "<init>", "([Ljava/nio/ByteBuffer;Ljava/lang/String;Ljava/lang/ClassLoader;)V");}auto byte_buffer_class = JNI_FindClass(env, "java/nio/ByteBuffer");auto dex_buffer = env->NewDirectByteBuffer(dex_data, dex_size);auto dex_buffer_array = JNI_NewObjectArray(env, 1, byte_buffer_class, dex_buffer);if (sdk_int < __ANDROID_API_Q__) { if (auto my_cl = JNI_NewObject(env, in_memory_classloader, initMid, dex_buffer_array, sys_classloader)) { inject_class_loader_ = JNI_NewGlobalRef(env, my_cl); }} else { jstring librarySearchPath = nullptr; if (auto my_cl = JNI_NewObject(env, in_memory_classloader, initMid, dex_buffer_array, librarySearchPath, sys_classloader)) { inject_class_loader_ = JNI_NewGlobalRef(env, my_cl); }} |
直接调它的父类
CRC校验
这个也简单, 可以参考: https://bbs.kanxue.com/thread-285790.htm
hunter的检测相对NativeTest简单点
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
最后于 2025-4-30 14:11
被无味编辑
，原因： 格式
|
|
|---|---|
|
|
|
|
|
|
|
|
直接用delta magisk |
|
|
|
|
|
我无法复现这个检测点, 所以也没办法了 
|
|
|
开启zygisk_next暴露信息 ``` APatch /debug_ramdisk tmpfs rw,seclabel,relatime,size=3675100k,nr_inodes=918775 0 0 APatch /debug_ramdisk/pts devpts rw,seclabel,relatime,mode=600,ptmxmode=000 0 0 ``` 直接用模块过滤掉了
最后于 2025-4-30 17:26
被小黄鸭爱学习编辑
，原因：
|
|
|
|
|
|
我改了肯定只是给我自己用  , 别人的模块肯定是要自己改了重编译的
|
|
|
|
|
|
github有下载地址。21dK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6%4x3U0V1$3y4o6R3^5x3K6t1H3i4K6u0r3d9s2g2F1N6r3g2J5g2i4m8V1j5i4c8W2 |
|
|
都自己编译了，还用什么第三方模块啊 |
|
|
具体是哪个模块啊？ |
|
|
大佬能帮忙写个检测的demo嘛，有偿
|
|
|
|
|
|
|
|
|
|
|
|
为啥不来看看我的课呢？Hunter全部源码都讲了  毕竟是我写的。
|
|
|
写的不错，点个赞 
|
|
|
|
|
|
|
|
|
|
