wrapbluestacks

OneStepBeforeGameHackers--InstrumentingAndroidEmulatorsnevermoeDeNACo.
,Ltd.
SelfIntroductionnevermoe(@n3v3rm03,i[at]nevermoe.
com)Loveplaying/hackinggamesDeNACo.
,Ltd.
AgendaBackgroundEmulatorInternalHookingDemoConclusionDeNACo.
,Ltd.
Background:GameCheatingThreatModelUsersCheatersVendorsPCYESYESYESMobile(Normally)NoYESNoFullControlDeNACo.
,Ltd.
Background:MobileGameCheatingBusinessModelIsthereaneasywaytodistributecheatingtoolsAndroidemulators!
UniedenvironmentAlreadyoreasilyrootedDeNACo.
,Ltd.
CheatingonemulatorsPopular:Touchsimulation(e.
g.
MobileAnjian)WhyaretherenohookingtoolsGamecodesareusuallynativeCommercialemulatorsuseIntelHoudiniforarm-x86translationinnativecodeBackground:MobileGameCheatingBusinessModelDiculttohookDeNACo.
,Ltd.
Background:PurposeEnablehookingoncommercialAndroidemulators!
DeNACo.
,Ltd.
EmulatorInternal:TargetsClientVer.
AndroidVer.
HoudiniVer.
BlueStacks3.
56.
73.
18174.
4.
24.
0.
8.
45720NOX6.
0.
5.
24.
4.
24.
0.
8.
45720NOX6.
0.
5.
25.
5.
15.
0.
7b_x.
48396LeiDian2.
0.
545.
5.
15.
0.
7b_x.
48396DeNACo.
,Ltd.
EmulatorInternal:CommandLineBinary//le:enable_nativebridge.
shcd$binfmt_misc_dirif[-eregister];thenecho':arm_exe:M::\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x28::'"/system/lib/arm/houdini:P">registerecho':arm_dyn:M::\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x28::'"/system/lib/arm/houdini:P">registerHookitLD_PRELOAD=libinject_arm.
so.
/target_exe_armptrace(x86)target_pidptrace(arm)target_pidDeNACo.
,Ltd.
EmulatorInternal:JavaApplicationIsLD_PRELOADusefulinJavaapplicationhookingDeNACo.
,Ltd.
NormalstartupEmulatorInternal:JavaApplicationZygoteforkApplicationloopstartuprequestfromActivityManagerinithoudiniDeNACo.
,Ltd.
Startwith"wrap"systempropertysetpropwrap.
com.
nevermoe.
exampleLD_PRELOAD=libinject.
soEmulatorInternal:JavaApplicationZygoteforkShellloopstartuprequestfromActivityManagerexecshellforkexecv(app_process)ApplicationinithoudiniDeNACo.
,Ltd.
Startwith"wrap"systempropertyEmulatorInternal:JavaApplicationrunOnce()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaforkAndSpecialize()—frameworks/base/core/java/com/android/internal/os/Zygote.
javaForkAndSpecializeCommon()—frameworks/base/core/jni/com_android_internal_os_Zygote.
cpprunSelectLoop()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javahandleChildProc()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaexecApplication()—frameworks/base/core/java/com/android/internal/os/WrapperInit.
javapublicstaticvoidexecApplication(StringinvokeWith,StringniceName,inttargetSdkVersion,FileDescriptorpipeFd,String[]args){StringBuildercommand=newStringBuilder(invokeWith);command.
append("/system/bin/app_process/system/bin--application");if(niceName!
=null){command.
append("'--nice-name=").
append(niceName).
append("'");}command.
append("com.
android.
internal.
os.
WrapperInit");command.
append(pipeFd!
=nullpipeFd.
getInt$():0);command.
append('');command.
append(targetSdkVersion);Zygote.
appendQuotedShellArgs(command,args);Zygote.
execShell(command.
toString());}DeNACo.
,Ltd.
EmulatorInternal:JavaApplicationStartwith"wrap"property/system/bin/sh-cLD_PRELOAD=libinject_arm.
so\/system/bin/app_process/system/bin--application\'--nice-name=com.
nevermoe.
myapp'\com.
android.
internal.
os.
WrapperInit4821\'android.
app.
ActivityThread'Won'tdothetrickx86armDeNACo.
,Ltd.
EmulatorInternal:InitHoudinimain()—frameworks/base/cmds/app_process/app_main.
cppAndroidRuntime::start()—frameworks/base/core/jni/AndroidRuntime.
cppZygoteInit::main()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javaJNI_CreateJavaVM()—art/runtime/jni_internal.
ccRuntime::Start()—art/runtime/runtime.
ccAndroidRuntime::startVm()—frameworks/base/core/jni/AndroidRuntime.
cpp(Android5.
1.
1/4.
4.
2)app_process--StartasZygoteDeNACo.
,Ltd.
(Android5.
1.
1)ZygoteforkprocessEmulatorInternal:InitHoudinirunOnce()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaforkAndSpecialize()—frameworks/base/core/java/com/android/internal/os/Zygote.
javacallPostForkChildHooks()—frameworks/base/core/java/com/android/internal/os/Zygote.
javapostForkChild()—libcore/dalvik/src/main/java/dalvik/system/ZygoteHooks.
javaZygoteHooks_nativePostForkChild()—art/runtime/native/dalvik_system_ZygoteHooks.
ccForkAndSpecializeCommon()—frameworks/base/core/jni/com_android_internal_os_Zygote.
cppRuntime::DidForkFromZygote—art/runtime/runtime.
ccInitializeNativeBridge—system/core/libnativebridge/native_bridge.
ccInitializeNativeBridge—art/runtime/native_bridge_art_interface.
ccrunSelectLoop()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javahandleChildProc()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javazygoteInit()—frameworks/base/core/java/com/android/internal/os/RuntimeInit.
javaDeNACo.
,Ltd.
Android5.
1.
1EmulatorInternal:InitHoudini//Nativebridgeinterfacestoruntime.
structNativeBridgeCallbacks{uint32_tversion;bool(*initialize)(constNativeBridgeRuntimeCallbacks*runtime_cbs,constchar*private_dir,void*(*loadLibrary)(constchar*libpath,intag);void*(*getTrampoline)(void*handle,constchar*name,constchar*shorty,uint32_tlen);bool(*isSupported)(constchar*libpath);conststructNativeBridgeRuntimeValues*(*getAppEnv)(constchar*instruction_set);bool(*isCompatibleWith)(uint32_tbridge_version);NativeBridgeSignalHandlerFn(*getSignalHandler)(intsignal);};//libhoudini.
so.
data:00379198NativeBridgeItfdd2.
data:0037919Cddoffsetsub_1BD070.
data:003791A0ddoffsetsub_1BCC80.
data:003791A4ddoffsetsub_1BCD60.
data:003791A8ddoffsetsub_1BCEC0.
data:003791ACddoffsetsub_1BCF40.
data:003791B0ddoffsetsub_1BCF90.
data:003791B4ddoffsetsub_1BCFE0DeNACo.
,Ltd.
Android4.
4.
2EmulatorInternal:InitHoudinidvmLoadNativeCode()houdini::hookDlopen()houdini::hookJniOnload()houdiniHookInit()//le:platform/dalvik/vm/Native.
cpphookDlopen(){v3=dlopen((constchar*)this,(int)a2);if(v3)returnv3;elsehoudiniHookInit();}houdiniHookInit(){v15=dword_4F2F84;*(_DWORD*)(v15+8)=dlsym(handle,"dvm2hdDlopen");v16=dword_4F2F84;*(_DWORD*)(v16+12)=dlsym(handle,"dvm2hdDlsym");v17=dword_4F2F84;*(_DWORD*)(v17+20)=dlsym(handle,"dvm2hdNeeded");v18=dword_4F2F84;*(_DWORD*)(v18+16)=dlsym(handle,"dvm2hdNativeMethodHelper");v19=dword_4F2F84;*(_DWORD*)(v19+24)=dlsym(handle,"androidrt2hdCreateActivity");}DeNACo.
,Ltd.
GenymotionNohoudiniprovidedBluestackslib3btrans.
so==libhoudini.
soNOXpackedlibdvm.
soEmulatorInternal:HoudiniLicenseDeNACo.
,Ltd.
GenymotionNohoudiniprovidedBluestackslib3btrans.
so==libhoudini.
soNOXpackedlibdvm.
soEmulatorInternal:HoudiniLicenseDeNACo.
,Ltd.
Hooking:ExistingHookingFrameworkXposedOnlyJavaLayer(Discussthislater)Substituteapp_processtoloaditsownjarleFridaOmnipotent"I'mafraidNOXisunsupported.
Pleaseuseastockemulatororrealdevice,orhelpusxthis.
It'snotapriorityformepersonallysounlesssomebodyhelpsout,NOXsupportwillnothappen.
:-/"Substrate(onAndroid)Fakeliblog.
soOutdatedDeNACo.
,Ltd.
Hooking:NormalApproachptraceattachptracecalldlopenhookfunctiontracertraceelibA.
solibB.
solibinject.
so.
.
.
hookfunctionDeNACo.
,Ltd.
HookingonEmulator:(A)UtilizeHoudiniptraceattachptracecalldlopenopenarmlibbyhoudinitracertraceelib_x86.
solib_arm.
solibinject_x86.
so.
.
.
hookfunctionhookfunctionlibinject_arm.
soopenarmlibbyhoudiniDeNACo.
,Ltd.
HookingonEmulator:(B)UtilizeXposedpublicclassNativeHook{static{System.
loadLibrary("inject_arm");}publicnativestaticvoidinitNativeHook();}findAndHookMethod("android.
app.
Application",lpparam.
classLoader,"onCreate",newXC_MethodHook(){@OverrideprotectedvoidbeforeHookedMethod(MethodHookParamparam)throwsThrowable{NativeHook.
initNativeHook();}@OverrideprotectedvoidafterHookedMethod(MethodHookParamparam)throwsThrowable{}});DeNACo.
,Ltd.
DemoMethodA:github.
com/nevermoe/EHookvoidreal_init_func(){hook_by_addr(&h1,"nb/libc.
so",target_addr,hook_target);hook_by_name(&h2,"nb/libc.
so","recvfrom",hook_recvfrom);}DeNACo.
,Ltd.
ConclusionMobilegameisgettingmorepopularaswellascheatingCheatingpatternschangeasthetechniquedevelopsWeneedemulatordetectionmorethanwethoughtGamesecurityisfun!
DeNACo.
,Ltd.
ThankYou!
DeNACo.
,Ltd.
(Android5.
1.
1)app_processstartasapplicationEmulatorInternal:InitHoudinimain()—frameworks/base/cmds/app_process/app_main.
cppAndroidRuntime::start()—frameworks/base/core/jni/AndroidRuntime.
cppRuntimeInit::main()—frameworks/base/core/java/com/android/internal/os/RuntimeInit.
javaJNI_CreateJavaVM()—art/runtime/jni_internal.
ccRuntime::Start()—art/runtime/runtime.
ccRuntime::DidForkFromZygote—art/runtime/runtime.
ccInitializeNativeBridge—system/core/libnativebridge/native_bridge.
ccAndroidRuntime::startVm()—frameworks/base/core/jni/AndroidRuntime.
cppInitializeNativeBridge—art/runtime/native_bridge_art_interface.
cc