Android逆向之旅—Root检测与反检测.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "253caa21",
   "metadata": {},
   "source": [
    "# Root检测与反检测\n",
    "\n",
    "\n",
    "## 一、Android 安全之Root检测\n",
    "　　java层常见root检测大多是通过检测系统文件：一些路径下的su文件，或一些root的app相关文件。 \n",
    "```txt\n",
    "\"/data/local/bin/su\",\n",
    "\"/data/local/su\",\n",
    "\"/data/local/xbin/su\",\n",
    "\"/dev/com.koushikdutta.superuser.daemon/\",\n",
    "\"/sbin/su\",\n",
    "\"/system/app/Superuser.apk\",\n",
    "\"/system/bin/failsafe/su\",\n",
    "\"/system/bin/su\",\n",
    "\"/su/bin/su\",\n",
    "\"/system/etc/init.d/99SuperSUDaemon\",\n",
    "\"/system/sd/xbin/su\",\n",
    "\"/system/xbin/busybox\",\n",
    "\"/system/xbin/daemonsu\",\n",
    "\"/system/xbin/su\",\n",
    "\"/system/sbin/su\",\n",
    "\"/vendor/bin/su\",\n",
    "\"/cache/su\",\n",
    "\"/data/su\",\n",
    "\"/dev/su\",\n",
    "\"/system/bin/.ext/su\",\n",
    "\"/system/usr/we-need-root/su\",\n",
    "\"/system/app/Kinguser.apk\",\n",
    "\"/data/adb/magisk\",\n",
    "\"/sbin/.magisk\",\n",
    "\"/cache/.disable_magisk\",\n",
    "\"/dev/.magisk.unblock\",\n",
    "\"/cache/magisk.log\",\n",
    "\"/data/adb/magisk.img\",\n",
    "\"/data/adb/magisk.db\",\n",
    "\"/data/adb/magisk_simple\",\n",
    "\"/init.magisk.rc\",\n",
    "\"/system/xbin/ku.sud\"\n",
    "```\n",
    "\n",
    "　　检测一些root的app如magisk等。   \n",
    "```txt\n",
    "\"com.noshufou.android.su\",\n",
    "\"com.noshufou.android.su.elite\",\n",
    "\"eu.chainfire.supersu\",\n",
    "\"com.koushikdutta.superuser\",\n",
    "\"com.thirdparty.superuser\",\n",
    "\"com.yellowes.su\",\n",
    "\"com.koushikdutta.rommanager\",\n",
    "\"com.koushikdutta.rommanager.license\",\n",
    "\"com.dimonvideo.luckypatcher\",\n",
    "\"com.chelpus.lackypatch\",\n",
    "\"com.ramdroid.appquarantine\",\n",
    "\"com.ramdroid.appquarantinepro\",\n",
    "\"com.topjohnwu.magisk\",\n",
    "\"com.kingroot.kinguser\",\n",
    "\"com.kingo.root\",\n",
    "\"com.smedialink.oneclickroot\",\n",
    "\"com.zhiqupk.root.global\",\n",
    "\"com.alephzain.framaroot\",\n",
    "\"com.android.vending.billing.InAppBillingService.COIN\",\n",
    "\"com.android.vending.billing.InAppBillingService.LUCK\",\n",
    "\"com.chelpus.luckypatcher\",\n",
    "\"com.blackmartalpha\",\n",
    "\"org.blackmart.market\",\n",
    "\"com.allinone.free\",\n",
    "\"com.repodroid.app\",\n",
    "\"org.creeplays.hack\",\n",
    "\"com.baseappfull.fwd\",\n",
    "\"com.zmapp\",\n",
    "\"com.dv.marketmod.installer\",\n",
    "\"org.mobilism.android\",\n",
    "\"com.android.wp.net.log\",\n",
    "\"com.android.camera.update\",\n",
    "\"cc.madkite.freedom\",\n",
    "\"com.solohsu.android.edxp.manager\",\n",
    "\"org.meowcat.edxposed.manager\",\n",
    "\"com.xmodgame\",\n",
    "\"com.cih.game_cih\",\n",
    "\"com.charles.lpoqasert\",\n",
    "\"catch_.me_.if_.you_.can_\"\n",
    "```\n",
    "\n",
    "\n",
    "## 二、Android 逆向之反Root检测\n",
    "　　Zygisk版本面具Magisk虽然移除了MagiskHide但也可以实现隐藏Root。\n",
    "[新版Magisk(面具)隐藏root方法](https://zhuanlan.zhihu.com/p/506203078)   \n",
    "[隐藏Root - Zygisk版面具Magisk过银行App等Root检测](https://www.bilibili.com/read/cv15350941/)   \n",
    "\n",
    "### 2.1、方法一\n",
    "\n",
    "1、打开magisk，点击右上角设置，找到Zygisk选项并且打开，打开后重启手机。\n",
    "2、重启手机后刷入Shamiko模块并开启，重启手机，打开面具右上角设置，打开‘遵循排除列表’选项，再点击‘配置排除列表’，勾选你要隐藏root的应用（注意应用下的所有选项都要勾选），然后关闭‘遵守排除列表’选项，重启手机。（如果没有关闭‘遵循排除列表’，此时，虽然可以绕过root检测，但是在排除列表中的应用是无法使用虚拟框架和模块的）     \n",
    "　　（去浏览器中下载Shamiko模块并保存到方便的位置，在面具Magisk的模块功能中使用本地安装刷入该模块）   \n",
    "3、一般来说，完成上面的操作步骤就可以了，如果发现有app还是会提示设备已root，那么就要随机Magisk包名以达到隐藏Magisk的效果，以防止被某些软件检测到Magisk判别root。\n",
    "4、隐藏Magisk后，此时大部分的软件都已经检测不到root，但是还有一部分顽强的软件还是可以检测到root十分顽强，那么我们该怎么办呢？我们下载Zygisk版本的LSPosed，用面具刷入，重启手机。下载隐藏应用列表，然后打开隐藏应用列表，点击检测测试下载测试软件，后面需要用到和点击安装magisk插件，选择Zygisk，安装成功后，重启手机。 然后点击模板管理，创建黑名单模板，填写以下可能被检测到的maps规则\n",
    "\n",
    "如下图将规则复制粘贴：\n",
    "```txt\n",
    "magisk\n",
    "root\n",
    "lsposed\n",
    "edxposed\n",
    "xposed\n",
    "qn_dyn_lib\n",
    "qn_mmkv\n",
    "org.meowcatedxposedmanager\n",
    "org.lsposed.manage\n",
    "manager\n",
    "com.topjohnwumagisk\n",
    "magisk manager\n",
    "```\n",
    "　　然后然后点击隐藏应用，勾选带有root权限的所有软件。保存刚才设置好的规则,选择你要隐藏root的软件，按照下面的图片并且保存选择刚才设置好的规则模板，保存即可。\n",
    "　　还要注意的是，那个工作模式不要盲目选择所有隐藏方式，容易让某些软件直接崩溃 下面打开测试软件，我们会发现，没有被检测到root，这样说明很多软件都不会被检测了，可以正常使用。\n",
    "　　magisk的延伸版本 Canary（金丝雀版本）和alpha（阿尔法版本）隐藏方法同理，还要注意一点Zygisk不能和riru系列的模块共存，安装riru，Shamiko模块就会不工作，如果你想用riru系列模块又想隐藏root建议会退magisk23.0即可。  \n",
    "### 2.2、方法二\n",
    "　　通过一些公开的脚本去绕过，直接可以绕过。 \n",
    "```shell\n",
    "frida -U -f com.xxxx.xxxx -l anti_root.js --no-pause\n",
    "```  \n",
    "  \n",
    "  \n"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.12"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}