Skip to content

Commit

Permalink
Add explanation for false positives
Browse files Browse the repository at this point in the history
A filter should be built from feedbacks.
  • Loading branch information
JingMatrix committed Dec 16, 2024
1 parent 4469503 commit 3de7f15
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 1 deletion.
2 changes: 2 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ See blog [Android 用户态注入隐藏已死](https://nullptr.icu/index.php/arc

A call to `dlclose` will increase the counter [g_module_unload_counter](https://cs.android.com/android/platform/superproject/main/+/main:bionic/linker/linker.cpp;l=1956).

This detection highly depends on Android OS and vendor customization, which is shown to be false positive on Samsung and OnePlus.

## State of bypassing current test

- [ ] [Zygisk of Magisk](https://github.com/topjohnwu/Magisk)
Expand Down
2 changes: 1 addition & 1 deletion app/src/main/cpp/native-lib.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ Java_org_matrix_demo_MainActivity_stringFromJNI(JNIEnv *env,

if (module_injected > 0) {
counter_detection =
std::format("Module counter: {} shared libraries injected", module_injected);
std::format("Module counter: {} shared libraries unloaded", module_injected);
}

return env->NewStringUTF(
Expand Down

0 comments on commit 3de7f15

Please sign in to comment.