wrapbluestacks

bluestacks  时间:2021-02-19  阅读:()
OneStepBeforeGameHackers--InstrumentingAndroidEmulatorsnevermoeDeNACo.
,Ltd.
SelfIntroductionnevermoe(@n3v3rm03,i[at]nevermoe.
com)Loveplaying/hackinggamesDeNACo.
,Ltd.
AgendaBackgroundEmulatorInternalHookingDemoConclusionDeNACo.
,Ltd.
Background:GameCheatingThreatModelUsersCheatersVendorsPCYESYESYESMobile(Normally)NoYESNoFullControlDeNACo.
,Ltd.
Background:MobileGameCheatingBusinessModelIsthereaneasywaytodistributecheatingtoolsAndroidemulators!
UniedenvironmentAlreadyoreasilyrootedDeNACo.
,Ltd.
CheatingonemulatorsPopular:Touchsimulation(e.
g.
MobileAnjian)WhyaretherenohookingtoolsGamecodesareusuallynativeCommercialemulatorsuseIntelHoudiniforarm-x86translationinnativecodeBackground:MobileGameCheatingBusinessModelDiculttohookDeNACo.
,Ltd.
Background:PurposeEnablehookingoncommercialAndroidemulators!
DeNACo.
,Ltd.
EmulatorInternal:TargetsClientVer.
AndroidVer.
HoudiniVer.
BlueStacks3.
56.
73.
18174.
4.
24.
0.
8.
45720NOX6.
0.
5.
24.
4.
24.
0.
8.
45720NOX6.
0.
5.
25.
5.
15.
0.
7b_x.
48396LeiDian2.
0.
545.
5.
15.
0.
7b_x.
48396DeNACo.
,Ltd.
EmulatorInternal:CommandLineBinary//le:enable_nativebridge.
shcd$binfmt_misc_dirif[-eregister];thenecho':arm_exe:M::\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x28::'"/system/lib/arm/houdini:P">registerecho':arm_dyn:M::\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x28::'"/system/lib/arm/houdini:P">registerHookitLD_PRELOAD=libinject_arm.
so.
/target_exe_armptrace(x86)target_pidptrace(arm)target_pidDeNACo.
,Ltd.
EmulatorInternal:JavaApplicationIsLD_PRELOADusefulinJavaapplicationhookingDeNACo.
,Ltd.
NormalstartupEmulatorInternal:JavaApplicationZygoteforkApplicationloopstartuprequestfromActivityManagerinithoudiniDeNACo.
,Ltd.
Startwith"wrap"systempropertysetpropwrap.
com.
nevermoe.
exampleLD_PRELOAD=libinject.
soEmulatorInternal:JavaApplicationZygoteforkShellloopstartuprequestfromActivityManagerexecshellforkexecv(app_process)ApplicationinithoudiniDeNACo.
,Ltd.
Startwith"wrap"systempropertyEmulatorInternal:JavaApplicationrunOnce()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaforkAndSpecialize()—frameworks/base/core/java/com/android/internal/os/Zygote.
javaForkAndSpecializeCommon()—frameworks/base/core/jni/com_android_internal_os_Zygote.
cpprunSelectLoop()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javahandleChildProc()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaexecApplication()—frameworks/base/core/java/com/android/internal/os/WrapperInit.
javapublicstaticvoidexecApplication(StringinvokeWith,StringniceName,inttargetSdkVersion,FileDescriptorpipeFd,String[]args){StringBuildercommand=newStringBuilder(invokeWith);command.
append("/system/bin/app_process/system/bin--application");if(niceName!
=null){command.
append("'--nice-name=").
append(niceName).
append("'");}command.
append("com.
android.
internal.
os.
WrapperInit");command.
append(pipeFd!
=nullpipeFd.
getInt$():0);command.
append('');command.
append(targetSdkVersion);Zygote.
appendQuotedShellArgs(command,args);Zygote.
execShell(command.
toString());}DeNACo.
,Ltd.
EmulatorInternal:JavaApplicationStartwith"wrap"property/system/bin/sh-cLD_PRELOAD=libinject_arm.
so\/system/bin/app_process/system/bin--application\'--nice-name=com.
nevermoe.
myapp'\com.
android.
internal.
os.
WrapperInit4821\'android.
app.
ActivityThread'Won'tdothetrickx86armDeNACo.
,Ltd.
EmulatorInternal:InitHoudinimain()—frameworks/base/cmds/app_process/app_main.
cppAndroidRuntime::start()—frameworks/base/core/jni/AndroidRuntime.
cppZygoteInit::main()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javaJNI_CreateJavaVM()—art/runtime/jni_internal.
ccRuntime::Start()—art/runtime/runtime.
ccAndroidRuntime::startVm()—frameworks/base/core/jni/AndroidRuntime.
cpp(Android5.
1.
1/4.
4.
2)app_process--StartasZygoteDeNACo.
,Ltd.
(Android5.
1.
1)ZygoteforkprocessEmulatorInternal:InitHoudinirunOnce()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaforkAndSpecialize()—frameworks/base/core/java/com/android/internal/os/Zygote.
javacallPostForkChildHooks()—frameworks/base/core/java/com/android/internal/os/Zygote.
javapostForkChild()—libcore/dalvik/src/main/java/dalvik/system/ZygoteHooks.
javaZygoteHooks_nativePostForkChild()—art/runtime/native/dalvik_system_ZygoteHooks.
ccForkAndSpecializeCommon()—frameworks/base/core/jni/com_android_internal_os_Zygote.
cppRuntime::DidForkFromZygote—art/runtime/runtime.
ccInitializeNativeBridge—system/core/libnativebridge/native_bridge.
ccInitializeNativeBridge—art/runtime/native_bridge_art_interface.
ccrunSelectLoop()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javahandleChildProc()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javazygoteInit()—frameworks/base/core/java/com/android/internal/os/RuntimeInit.
javaDeNACo.
,Ltd.
Android5.
1.
1EmulatorInternal:InitHoudini//Nativebridgeinterfacestoruntime.
structNativeBridgeCallbacks{uint32_tversion;bool(*initialize)(constNativeBridgeRuntimeCallbacks*runtime_cbs,constchar*private_dir,void*(*loadLibrary)(constchar*libpath,intag);void*(*getTrampoline)(void*handle,constchar*name,constchar*shorty,uint32_tlen);bool(*isSupported)(constchar*libpath);conststructNativeBridgeRuntimeValues*(*getAppEnv)(constchar*instruction_set);bool(*isCompatibleWith)(uint32_tbridge_version);NativeBridgeSignalHandlerFn(*getSignalHandler)(intsignal);};//libhoudini.
so.
data:00379198NativeBridgeItfdd2.
data:0037919Cddoffsetsub_1BD070.
data:003791A0ddoffsetsub_1BCC80.
data:003791A4ddoffsetsub_1BCD60.
data:003791A8ddoffsetsub_1BCEC0.
data:003791ACddoffsetsub_1BCF40.
data:003791B0ddoffsetsub_1BCF90.
data:003791B4ddoffsetsub_1BCFE0DeNACo.
,Ltd.
Android4.
4.
2EmulatorInternal:InitHoudinidvmLoadNativeCode()houdini::hookDlopen()houdini::hookJniOnload()houdiniHookInit()//le:platform/dalvik/vm/Native.
cpphookDlopen(){v3=dlopen((constchar*)this,(int)a2);if(v3)returnv3;elsehoudiniHookInit();}houdiniHookInit(){v15=dword_4F2F84;*(_DWORD*)(v15+8)=dlsym(handle,"dvm2hdDlopen");v16=dword_4F2F84;*(_DWORD*)(v16+12)=dlsym(handle,"dvm2hdDlsym");v17=dword_4F2F84;*(_DWORD*)(v17+20)=dlsym(handle,"dvm2hdNeeded");v18=dword_4F2F84;*(_DWORD*)(v18+16)=dlsym(handle,"dvm2hdNativeMethodHelper");v19=dword_4F2F84;*(_DWORD*)(v19+24)=dlsym(handle,"androidrt2hdCreateActivity");}DeNACo.
,Ltd.
GenymotionNohoudiniprovidedBluestackslib3btrans.
so==libhoudini.
soNOXpackedlibdvm.
soEmulatorInternal:HoudiniLicenseDeNACo.
,Ltd.
GenymotionNohoudiniprovidedBluestackslib3btrans.
so==libhoudini.
soNOXpackedlibdvm.
soEmulatorInternal:HoudiniLicenseDeNACo.
,Ltd.
Hooking:ExistingHookingFrameworkXposedOnlyJavaLayer(Discussthislater)Substituteapp_processtoloaditsownjarleFridaOmnipotent"I'mafraidNOXisunsupported.
Pleaseuseastockemulatororrealdevice,orhelpusxthis.
It'snotapriorityformepersonallysounlesssomebodyhelpsout,NOXsupportwillnothappen.
:-/"Substrate(onAndroid)Fakeliblog.
soOutdatedDeNACo.
,Ltd.
Hooking:NormalApproachptraceattachptracecalldlopenhookfunctiontracertraceelibA.
solibB.
solibinject.
so.
.
.
hookfunctionDeNACo.
,Ltd.
HookingonEmulator:(A)UtilizeHoudiniptraceattachptracecalldlopenopenarmlibbyhoudinitracertraceelib_x86.
solib_arm.
solibinject_x86.
so.
.
.
hookfunctionhookfunctionlibinject_arm.
soopenarmlibbyhoudiniDeNACo.
,Ltd.
HookingonEmulator:(B)UtilizeXposedpublicclassNativeHook{static{System.
loadLibrary("inject_arm");}publicnativestaticvoidinitNativeHook();}findAndHookMethod("android.
app.
Application",lpparam.
classLoader,"onCreate",newXC_MethodHook(){@OverrideprotectedvoidbeforeHookedMethod(MethodHookParamparam)throwsThrowable{NativeHook.
initNativeHook();}@OverrideprotectedvoidafterHookedMethod(MethodHookParamparam)throwsThrowable{}});DeNACo.
,Ltd.
DemoMethodA:github.
com/nevermoe/EHookvoidreal_init_func(){hook_by_addr(&h1,"nb/libc.
so",target_addr,hook_target);hook_by_name(&h2,"nb/libc.
so","recvfrom",hook_recvfrom);}DeNACo.
,Ltd.
ConclusionMobilegameisgettingmorepopularaswellascheatingCheatingpatternschangeasthetechniquedevelopsWeneedemulatordetectionmorethanwethoughtGamesecurityisfun!
DeNACo.
,Ltd.
ThankYou!
DeNACo.
,Ltd.
(Android5.
1.
1)app_processstartasapplicationEmulatorInternal:InitHoudinimain()—frameworks/base/cmds/app_process/app_main.
cppAndroidRuntime::start()—frameworks/base/core/jni/AndroidRuntime.
cppRuntimeInit::main()—frameworks/base/core/java/com/android/internal/os/RuntimeInit.
javaJNI_CreateJavaVM()—art/runtime/jni_internal.
ccRuntime::Start()—art/runtime/runtime.
ccRuntime::DidForkFromZygote—art/runtime/runtime.
ccInitializeNativeBridge—system/core/libnativebridge/native_bridge.
ccAndroidRuntime::startVm()—frameworks/base/core/jni/AndroidRuntime.
cppInitializeNativeBridge—art/runtime/native_bridge_art_interface.
cc

美国VPS 美国高防VPS 香港VPS 日本VPS 首月9元 百纵科技

百纵科技湖南百纵科技有限公司是一家具有ISP ICP 电信增值许可证的正规公司,多年不断转型探索现已颇具规模,公司成立于2009年 通过多年经营积累目前已独具一格,公司主要经营香港服务器,香港站群服务器,美国高防服务器,美国站群服务器,云服务器,母机租用托管!美国CN2云服务器,美国VPS,美国高防云主机,美国独立服务器,美国站群服务器,美国母机。美国原生IP支持大批量订货 合作 适用电商 亚马逊...

德阳电信高防物理机 16核16G 50M 260元/月 达州创梦网络

达州创梦网络怎么样,达州创梦网络公司位于四川省达州市,属于四川本地企业,资质齐全,IDC/ISP均有,从创梦网络这边租的服务器均可以备案,属于一手资源,高防机柜、大带宽、高防IP业务,一手整C IP段,四川电信,一手四川托管服务商,成都优化线路,机柜租用、服务器云服务器租用,适合建站做游戏,不须要在套CDN,全国访问快,直连省骨干,大网封UDP,无视UDP攻击,机房集群高达1.2TB,单机可提供1...

raksmart:香港机房服务器实测评数据分享,告诉你raksmart服务器怎么样

raksmart作为一家老牌美国机房总是被很多人问到raksmart香港服务器怎么样、raksmart好不好?其实,这也好理解。香港服务器离大陆最近、理论上是不需要备案的服务器里面速度最快的,被过多关注也就在情理之中了。本着为大家趟雷就是本站的光荣这一理念,拿了一台raksmart的香港独立服务器,简单做个测评,分享下实测的数据,仅供参考!官方网站:https://www.raksmart.com...

bluestacks为你推荐
office2016激活密钥office2016怎么激活啊?求秘钥google地球打不开google earth打不开怎么办?伪装微信地理位置微信地理位置伪装软件怎么定位到微信flash导航条谁来帮我看看这样的flash导航条 下面的页面该怎么设计http与https的区别http和https到底有什么区别啊???xp系统停止服务XP停止服务后该怎么办?xp系统停止服务XP系统为什么要停止服务?奇虎论坛奇虎论坛最新推荐歌曲列表·人人逛街人人逛街评论怎么不显示链接了?好像4月28日就不能显示了。是什么原因呢?bt封杀为什么现在网上许多BT下载都被封了?
vps代购 a5域名交易 泛域名绑定 budgetvm google镜像 香港vps99idc uk2 win8.1企业版升级win10 tk域名 java虚拟主机 ibox官网 坐公交投2700元 毫秒英文 789电视 699美元 泉州移动 江苏双线服务器 google台湾 国内域名 ledlamp 更多