OneStepBeforeGameHackers--InstrumentingAndroidEmulatorsnevermoeDeNACo.
,Ltd.
SelfIntroductionnevermoe(@n3v3rm03,i[at]nevermoe.
com)Loveplaying/hackinggamesDeNACo.
,Ltd.
AgendaBackgroundEmulatorInternalHookingDemoConclusionDeNACo.
,Ltd.
Background:GameCheatingThreatModelUsersCheatersVendorsPCYESYESYESMobile(Normally)NoYESNoFullControlDeNACo.
,Ltd.
Background:MobileGameCheatingBusinessModelIsthereaneasywaytodistributecheatingtoolsAndroidemulators!
UniedenvironmentAlreadyoreasilyrootedDeNACo.
,Ltd.
CheatingonemulatorsPopular:Touchsimulation(e.
g.
MobileAnjian)WhyaretherenohookingtoolsGamecodesareusuallynativeCommercialemulatorsuseIntelHoudiniforarm-x86translationinnativecodeBackground:MobileGameCheatingBusinessModelDiculttohookDeNACo.
,Ltd.
Background:PurposeEnablehookingoncommercialAndroidemulators!
DeNACo.
,Ltd.
EmulatorInternal:TargetsClientVer.
AndroidVer.
HoudiniVer.
BlueStacks3.
56.
73.
18174.
4.
24.
0.
8.
45720NOX6.
0.
5.
24.
4.
24.
0.
8.
45720NOX6.
0.
5.
25.
5.
15.
0.
7b_x.
48396LeiDian2.
0.
545.
5.
15.
0.
7b_x.
48396DeNACo.
,Ltd.
EmulatorInternal:CommandLineBinary//le:enable_nativebridge.
shcd$binfmt_misc_dirif[-eregister];thenecho':arm_exe:M::\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x28::'"/system/lib/arm/houdini:P">registerecho':arm_dyn:M::\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x28::'"/system/lib/arm/houdini:P">registerHookitLD_PRELOAD=libinject_arm.
so.
/target_exe_armptrace(x86)target_pidptrace(arm)target_pidDeNACo.
,Ltd.
EmulatorInternal:JavaApplicationIsLD_PRELOADusefulinJavaapplicationhookingDeNACo.
,Ltd.
NormalstartupEmulatorInternal:JavaApplicationZygoteforkApplicationloopstartuprequestfromActivityManagerinithoudiniDeNACo.
,Ltd.
Startwith"wrap"systempropertysetpropwrap.
com.
nevermoe.
exampleLD_PRELOAD=libinject.
soEmulatorInternal:JavaApplicationZygoteforkShellloopstartuprequestfromActivityManagerexecshellforkexecv(app_process)ApplicationinithoudiniDeNACo.
,Ltd.
Startwith"wrap"systempropertyEmulatorInternal:JavaApplicationrunOnce()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaforkAndSpecialize()—frameworks/base/core/java/com/android/internal/os/Zygote.
javaForkAndSpecializeCommon()—frameworks/base/core/jni/com_android_internal_os_Zygote.
cpprunSelectLoop()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javahandleChildProc()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaexecApplication()—frameworks/base/core/java/com/android/internal/os/WrapperInit.
javapublicstaticvoidexecApplication(StringinvokeWith,StringniceName,inttargetSdkVersion,FileDescriptorpipeFd,String[]args){StringBuildercommand=newStringBuilder(invokeWith);command.
append("/system/bin/app_process/system/bin--application");if(niceName!
=null){command.
append("'--nice-name=").
append(niceName).
append("'");}command.
append("com.
android.
internal.
os.
WrapperInit");command.
append(pipeFd!
=nullpipeFd.
getInt$():0);command.
append('');command.
append(targetSdkVersion);Zygote.
appendQuotedShellArgs(command,args);Zygote.
execShell(command.
toString());}DeNACo.
,Ltd.
EmulatorInternal:JavaApplicationStartwith"wrap"property/system/bin/sh-cLD_PRELOAD=libinject_arm.
so\/system/bin/app_process/system/bin--application\'--nice-name=com.
nevermoe.
myapp'\com.
android.
internal.
os.
WrapperInit4821\'android.
app.
ActivityThread'Won'tdothetrickx86armDeNACo.
,Ltd.
EmulatorInternal:InitHoudinimain()—frameworks/base/cmds/app_process/app_main.
cppAndroidRuntime::start()—frameworks/base/core/jni/AndroidRuntime.
cppZygoteInit::main()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javaJNI_CreateJavaVM()—art/runtime/jni_internal.
ccRuntime::Start()—art/runtime/runtime.
ccAndroidRuntime::startVm()—frameworks/base/core/jni/AndroidRuntime.
cpp(Android5.
1.
1/4.
4.
2)app_process--StartasZygoteDeNACo.
,Ltd.
(Android5.
1.
1)ZygoteforkprocessEmulatorInternal:InitHoudinirunOnce()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaforkAndSpecialize()—frameworks/base/core/java/com/android/internal/os/Zygote.
javacallPostForkChildHooks()—frameworks/base/core/java/com/android/internal/os/Zygote.
javapostForkChild()—libcore/dalvik/src/main/java/dalvik/system/ZygoteHooks.
javaZygoteHooks_nativePostForkChild()—art/runtime/native/dalvik_system_ZygoteHooks.
ccForkAndSpecializeCommon()—frameworks/base/core/jni/com_android_internal_os_Zygote.
cppRuntime::DidForkFromZygote—art/runtime/runtime.
ccInitializeNativeBridge—system/core/libnativebridge/native_bridge.
ccInitializeNativeBridge—art/runtime/native_bridge_art_interface.
ccrunSelectLoop()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javahandleChildProc()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javazygoteInit()—frameworks/base/core/java/com/android/internal/os/RuntimeInit.
javaDeNACo.
,Ltd.
Android5.
1.
1EmulatorInternal:InitHoudini//Nativebridgeinterfacestoruntime.
structNativeBridgeCallbacks{uint32_tversion;bool(*initialize)(constNativeBridgeRuntimeCallbacks*runtime_cbs,constchar*private_dir,void*(*loadLibrary)(constchar*libpath,intag);void*(*getTrampoline)(void*handle,constchar*name,constchar*shorty,uint32_tlen);bool(*isSupported)(constchar*libpath);conststructNativeBridgeRuntimeValues*(*getAppEnv)(constchar*instruction_set);bool(*isCompatibleWith)(uint32_tbridge_version);NativeBridgeSignalHandlerFn(*getSignalHandler)(intsignal);};//libhoudini.
so.
data:00379198NativeBridgeItfdd2.
data:0037919Cddoffsetsub_1BD070.
data:003791A0ddoffsetsub_1BCC80.
data:003791A4ddoffsetsub_1BCD60.
data:003791A8ddoffsetsub_1BCEC0.
data:003791ACddoffsetsub_1BCF40.
data:003791B0ddoffsetsub_1BCF90.
data:003791B4ddoffsetsub_1BCFE0DeNACo.
,Ltd.
Android4.
4.
2EmulatorInternal:InitHoudinidvmLoadNativeCode()houdini::hookDlopen()houdini::hookJniOnload()houdiniHookInit()//le:platform/dalvik/vm/Native.
cpphookDlopen(){v3=dlopen((constchar*)this,(int)a2);if(v3)returnv3;elsehoudiniHookInit();}houdiniHookInit(){v15=dword_4F2F84;*(_DWORD*)(v15+8)=dlsym(handle,"dvm2hdDlopen");v16=dword_4F2F84;*(_DWORD*)(v16+12)=dlsym(handle,"dvm2hdDlsym");v17=dword_4F2F84;*(_DWORD*)(v17+20)=dlsym(handle,"dvm2hdNeeded");v18=dword_4F2F84;*(_DWORD*)(v18+16)=dlsym(handle,"dvm2hdNativeMethodHelper");v19=dword_4F2F84;*(_DWORD*)(v19+24)=dlsym(handle,"androidrt2hdCreateActivity");}DeNACo.
,Ltd.
GenymotionNohoudiniprovidedBluestackslib3btrans.
so==libhoudini.
soNOXpackedlibdvm.
soEmulatorInternal:HoudiniLicenseDeNACo.
,Ltd.
GenymotionNohoudiniprovidedBluestackslib3btrans.
so==libhoudini.
soNOXpackedlibdvm.
soEmulatorInternal:HoudiniLicenseDeNACo.
,Ltd.
Hooking:ExistingHookingFrameworkXposedOnlyJavaLayer(Discussthislater)Substituteapp_processtoloaditsownjarleFridaOmnipotent"I'mafraidNOXisunsupported.
Pleaseuseastockemulatororrealdevice,orhelpusxthis.
It'snotapriorityformepersonallysounlesssomebodyhelpsout,NOXsupportwillnothappen.
:-/"Substrate(onAndroid)Fakeliblog.
soOutdatedDeNACo.
,Ltd.
Hooking:NormalApproachptraceattachptracecalldlopenhookfunctiontracertraceelibA.
solibB.
solibinject.
so.
.
.
hookfunctionDeNACo.
,Ltd.
HookingonEmulator:(A)UtilizeHoudiniptraceattachptracecalldlopenopenarmlibbyhoudinitracertraceelib_x86.
solib_arm.
solibinject_x86.
so.
.
.
hookfunctionhookfunctionlibinject_arm.
soopenarmlibbyhoudiniDeNACo.
,Ltd.
HookingonEmulator:(B)UtilizeXposedpublicclassNativeHook{static{System.
loadLibrary("inject_arm");}publicnativestaticvoidinitNativeHook();}findAndHookMethod("android.
app.
Application",lpparam.
classLoader,"onCreate",newXC_MethodHook(){@OverrideprotectedvoidbeforeHookedMethod(MethodHookParamparam)throwsThrowable{NativeHook.
initNativeHook();}@OverrideprotectedvoidafterHookedMethod(MethodHookParamparam)throwsThrowable{}});DeNACo.
,Ltd.
DemoMethodA:github.
com/nevermoe/EHookvoidreal_init_func(){hook_by_addr(&h1,"nb/libc.
so",target_addr,hook_target);hook_by_name(&h2,"nb/libc.
so","recvfrom",hook_recvfrom);}DeNACo.
,Ltd.
ConclusionMobilegameisgettingmorepopularaswellascheatingCheatingpatternschangeasthetechniquedevelopsWeneedemulatordetectionmorethanwethoughtGamesecurityisfun!
DeNACo.
,Ltd.
ThankYou!
DeNACo.
,Ltd.
(Android5.
1.
1)app_processstartasapplicationEmulatorInternal:InitHoudinimain()—frameworks/base/cmds/app_process/app_main.
cppAndroidRuntime::start()—frameworks/base/core/jni/AndroidRuntime.
cppRuntimeInit::main()—frameworks/base/core/java/com/android/internal/os/RuntimeInit.
javaJNI_CreateJavaVM()—art/runtime/jni_internal.
ccRuntime::Start()—art/runtime/runtime.
ccRuntime::DidForkFromZygote—art/runtime/runtime.
ccInitializeNativeBridge—system/core/libnativebridge/native_bridge.
ccAndroidRuntime::startVm()—frameworks/base/core/jni/AndroidRuntime.
cppInitializeNativeBridge—art/runtime/native_bridge_art_interface.
cc
有在六月份的时候也有分享过新网域名注册商发布的域名促销活动(这里)。这不在九月份发布秋季域名促销活动,有提供年付16元的.COM域名,同时还有5个+的特殊后缀的域名是免费的。对于新网服务商是曾经非常老牌的域名注册商,早年也是有在他们家注册域名的。我们可以看到,如果有针对新用户的可以领到16元的.COM域名。包括还有首年免费的.XYZ、.SHOP、Space等等后缀的域名。除了.COM域名之外的其他...
photonvps怎么样?photonvps现在针对旗下美国vps推出半价促销优惠活动,2.5美元/月起,免费10Gbps DDoS防御,Linux系统,机房可选美国洛杉矶、达拉斯、芝加哥、阿什本。以前觉得老牌商家PhotonVPS贵的朋友可以先入手一个月PhotonVPS美国Linux VPS试试了。PhotonVPS允许合法大人内容,支持支付宝、paypal和信用卡,30天退款保证。Photo...
GreencloudVPS此次在四个机房都上线10Gbps大带宽VPS,并且全部采用AMD处理器,其中美国芝加哥机房采用Ryzen 3950x处理器,新加坡、荷兰阿姆斯特丹、美国杰克逊维尔机房采用Ryzen 3960x处理器,全部都是RAID-1 NVMe硬盘、DDR4 2666Mhz内存,GreenCloudVPS本次促销的便宜VPS最低仅需20美元/年,支持支付宝、银联和paypal。Gree...
bluestacks为你推荐
google地球打不开为什么google earth打不开不兼容vivo手机和软件不兼容怎么办?网易公开课怎么下载网易公开课的视频该如何下载?迅雷云点播账号求个迅雷VIP 是VIP就可以 只用来看云点播 改密码是孙子。 谢了 ! 362135668@qq.com2012年正月十五山西省太原市2012年正月十五活动的相关情况ios系统iOS系统为什么那么好cr2格式如何打开CR2格式的照片呢系统分析员考系统分析员有什么好处?宽带接入服务器目前常见宽带接入的方式有哪几种服务器连接异常主服务器连接异常
3322动态域名 搬瓦工官网 Hello图床 丹弗 777te 阿里云浏览器 微软服务器操作系统 爱奇艺会员免费试用 华为云服务登录 数据库空间 中国linux 稳定空间 美国vpn服务器 以下 遨游论坛 电脑主机配置 大容量存储控制器驱动 文件服务器硬件配置 web服务器下载 电脑主机报价 更多