OneStepBeforeGameHackers--InstrumentingAndroidEmulatorsnevermoeDeNACo.
,Ltd.
SelfIntroductionnevermoe(@n3v3rm03,i[at]nevermoe.
com)Loveplaying/hackinggamesDeNACo.
,Ltd.
AgendaBackgroundEmulatorInternalHookingDemoConclusionDeNACo.
,Ltd.
Background:GameCheatingThreatModelUsersCheatersVendorsPCYESYESYESMobile(Normally)NoYESNoFullControlDeNACo.
,Ltd.
Background:MobileGameCheatingBusinessModelIsthereaneasywaytodistributecheatingtoolsAndroidemulators!
UniedenvironmentAlreadyoreasilyrootedDeNACo.
,Ltd.
CheatingonemulatorsPopular:Touchsimulation(e.
g.
MobileAnjian)WhyaretherenohookingtoolsGamecodesareusuallynativeCommercialemulatorsuseIntelHoudiniforarm-x86translationinnativecodeBackground:MobileGameCheatingBusinessModelDiculttohookDeNACo.
,Ltd.
Background:PurposeEnablehookingoncommercialAndroidemulators!
DeNACo.
,Ltd.
EmulatorInternal:TargetsClientVer.
AndroidVer.
HoudiniVer.
BlueStacks3.
56.
73.
18174.
4.
24.
0.
8.
45720NOX6.
0.
5.
24.
4.
24.
0.
8.
45720NOX6.
0.
5.
25.
5.
15.
0.
7b_x.
48396LeiDian2.
0.
545.
5.
15.
0.
7b_x.
48396DeNACo.
,Ltd.
EmulatorInternal:CommandLineBinary//le:enable_nativebridge.
shcd$binfmt_misc_dirif[-eregister];thenecho':arm_exe:M::\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x28::'"/system/lib/arm/houdini:P">registerecho':arm_dyn:M::\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x28::'"/system/lib/arm/houdini:P">registerHookitLD_PRELOAD=libinject_arm.
so.
/target_exe_armptrace(x86)target_pidptrace(arm)target_pidDeNACo.
,Ltd.
EmulatorInternal:JavaApplicationIsLD_PRELOADusefulinJavaapplicationhookingDeNACo.
,Ltd.
NormalstartupEmulatorInternal:JavaApplicationZygoteforkApplicationloopstartuprequestfromActivityManagerinithoudiniDeNACo.
,Ltd.
Startwith"wrap"systempropertysetpropwrap.
com.
nevermoe.
exampleLD_PRELOAD=libinject.
soEmulatorInternal:JavaApplicationZygoteforkShellloopstartuprequestfromActivityManagerexecshellforkexecv(app_process)ApplicationinithoudiniDeNACo.
,Ltd.
Startwith"wrap"systempropertyEmulatorInternal:JavaApplicationrunOnce()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaforkAndSpecialize()—frameworks/base/core/java/com/android/internal/os/Zygote.
javaForkAndSpecializeCommon()—frameworks/base/core/jni/com_android_internal_os_Zygote.
cpprunSelectLoop()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javahandleChildProc()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaexecApplication()—frameworks/base/core/java/com/android/internal/os/WrapperInit.
javapublicstaticvoidexecApplication(StringinvokeWith,StringniceName,inttargetSdkVersion,FileDescriptorpipeFd,String[]args){StringBuildercommand=newStringBuilder(invokeWith);command.
append("/system/bin/app_process/system/bin--application");if(niceName!
=null){command.
append("'--nice-name=").
append(niceName).
append("'");}command.
append("com.
android.
internal.
os.
WrapperInit");command.
append(pipeFd!
=nullpipeFd.
getInt$():0);command.
append('');command.
append(targetSdkVersion);Zygote.
appendQuotedShellArgs(command,args);Zygote.
execShell(command.
toString());}DeNACo.
,Ltd.
EmulatorInternal:JavaApplicationStartwith"wrap"property/system/bin/sh-cLD_PRELOAD=libinject_arm.
so\/system/bin/app_process/system/bin--application\'--nice-name=com.
nevermoe.
myapp'\com.
android.
internal.
os.
WrapperInit4821\'android.
app.
ActivityThread'Won'tdothetrickx86armDeNACo.
,Ltd.
EmulatorInternal:InitHoudinimain()—frameworks/base/cmds/app_process/app_main.
cppAndroidRuntime::start()—frameworks/base/core/jni/AndroidRuntime.
cppZygoteInit::main()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javaJNI_CreateJavaVM()—art/runtime/jni_internal.
ccRuntime::Start()—art/runtime/runtime.
ccAndroidRuntime::startVm()—frameworks/base/core/jni/AndroidRuntime.
cpp(Android5.
1.
1/4.
4.
2)app_process--StartasZygoteDeNACo.
,Ltd.
(Android5.
1.
1)ZygoteforkprocessEmulatorInternal:InitHoudinirunOnce()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaforkAndSpecialize()—frameworks/base/core/java/com/android/internal/os/Zygote.
javacallPostForkChildHooks()—frameworks/base/core/java/com/android/internal/os/Zygote.
javapostForkChild()—libcore/dalvik/src/main/java/dalvik/system/ZygoteHooks.
javaZygoteHooks_nativePostForkChild()—art/runtime/native/dalvik_system_ZygoteHooks.
ccForkAndSpecializeCommon()—frameworks/base/core/jni/com_android_internal_os_Zygote.
cppRuntime::DidForkFromZygote—art/runtime/runtime.
ccInitializeNativeBridge—system/core/libnativebridge/native_bridge.
ccInitializeNativeBridge—art/runtime/native_bridge_art_interface.
ccrunSelectLoop()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javahandleChildProc()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javazygoteInit()—frameworks/base/core/java/com/android/internal/os/RuntimeInit.
javaDeNACo.
,Ltd.
Android5.
1.
1EmulatorInternal:InitHoudini//Nativebridgeinterfacestoruntime.
structNativeBridgeCallbacks{uint32_tversion;bool(*initialize)(constNativeBridgeRuntimeCallbacks*runtime_cbs,constchar*private_dir,void*(*loadLibrary)(constchar*libpath,intag);void*(*getTrampoline)(void*handle,constchar*name,constchar*shorty,uint32_tlen);bool(*isSupported)(constchar*libpath);conststructNativeBridgeRuntimeValues*(*getAppEnv)(constchar*instruction_set);bool(*isCompatibleWith)(uint32_tbridge_version);NativeBridgeSignalHandlerFn(*getSignalHandler)(intsignal);};//libhoudini.
so.
data:00379198NativeBridgeItfdd2.
data:0037919Cddoffsetsub_1BD070.
data:003791A0ddoffsetsub_1BCC80.
data:003791A4ddoffsetsub_1BCD60.
data:003791A8ddoffsetsub_1BCEC0.
data:003791ACddoffsetsub_1BCF40.
data:003791B0ddoffsetsub_1BCF90.
data:003791B4ddoffsetsub_1BCFE0DeNACo.
,Ltd.
Android4.
4.
2EmulatorInternal:InitHoudinidvmLoadNativeCode()houdini::hookDlopen()houdini::hookJniOnload()houdiniHookInit()//le:platform/dalvik/vm/Native.
cpphookDlopen(){v3=dlopen((constchar*)this,(int)a2);if(v3)returnv3;elsehoudiniHookInit();}houdiniHookInit(){v15=dword_4F2F84;*(_DWORD*)(v15+8)=dlsym(handle,"dvm2hdDlopen");v16=dword_4F2F84;*(_DWORD*)(v16+12)=dlsym(handle,"dvm2hdDlsym");v17=dword_4F2F84;*(_DWORD*)(v17+20)=dlsym(handle,"dvm2hdNeeded");v18=dword_4F2F84;*(_DWORD*)(v18+16)=dlsym(handle,"dvm2hdNativeMethodHelper");v19=dword_4F2F84;*(_DWORD*)(v19+24)=dlsym(handle,"androidrt2hdCreateActivity");}DeNACo.
,Ltd.
GenymotionNohoudiniprovidedBluestackslib3btrans.
so==libhoudini.
soNOXpackedlibdvm.
soEmulatorInternal:HoudiniLicenseDeNACo.
,Ltd.
GenymotionNohoudiniprovidedBluestackslib3btrans.
so==libhoudini.
soNOXpackedlibdvm.
soEmulatorInternal:HoudiniLicenseDeNACo.
,Ltd.
Hooking:ExistingHookingFrameworkXposedOnlyJavaLayer(Discussthislater)Substituteapp_processtoloaditsownjarleFridaOmnipotent"I'mafraidNOXisunsupported.
Pleaseuseastockemulatororrealdevice,orhelpusxthis.
It'snotapriorityformepersonallysounlesssomebodyhelpsout,NOXsupportwillnothappen.
:-/"Substrate(onAndroid)Fakeliblog.
soOutdatedDeNACo.
,Ltd.
Hooking:NormalApproachptraceattachptracecalldlopenhookfunctiontracertraceelibA.
solibB.
solibinject.
so.
.
.
hookfunctionDeNACo.
,Ltd.
HookingonEmulator:(A)UtilizeHoudiniptraceattachptracecalldlopenopenarmlibbyhoudinitracertraceelib_x86.
solib_arm.
solibinject_x86.
so.
.
.
hookfunctionhookfunctionlibinject_arm.
soopenarmlibbyhoudiniDeNACo.
,Ltd.
HookingonEmulator:(B)UtilizeXposedpublicclassNativeHook{static{System.
loadLibrary("inject_arm");}publicnativestaticvoidinitNativeHook();}findAndHookMethod("android.
app.
Application",lpparam.
classLoader,"onCreate",newXC_MethodHook(){@OverrideprotectedvoidbeforeHookedMethod(MethodHookParamparam)throwsThrowable{NativeHook.
initNativeHook();}@OverrideprotectedvoidafterHookedMethod(MethodHookParamparam)throwsThrowable{}});DeNACo.
,Ltd.
DemoMethodA:github.
com/nevermoe/EHookvoidreal_init_func(){hook_by_addr(&h1,"nb/libc.
so",target_addr,hook_target);hook_by_name(&h2,"nb/libc.
so","recvfrom",hook_recvfrom);}DeNACo.
,Ltd.
ConclusionMobilegameisgettingmorepopularaswellascheatingCheatingpatternschangeasthetechniquedevelopsWeneedemulatordetectionmorethanwethoughtGamesecurityisfun!
DeNACo.
,Ltd.
ThankYou!
DeNACo.
,Ltd.
(Android5.
1.
1)app_processstartasapplicationEmulatorInternal:InitHoudinimain()—frameworks/base/cmds/app_process/app_main.
cppAndroidRuntime::start()—frameworks/base/core/jni/AndroidRuntime.
cppRuntimeInit::main()—frameworks/base/core/java/com/android/internal/os/RuntimeInit.
javaJNI_CreateJavaVM()—art/runtime/jni_internal.
ccRuntime::Start()—art/runtime/runtime.
ccRuntime::DidForkFromZygote—art/runtime/runtime.
ccInitializeNativeBridge—system/core/libnativebridge/native_bridge.
ccAndroidRuntime::startVm()—frameworks/base/core/jni/AndroidRuntime.
cppInitializeNativeBridge—art/runtime/native_bridge_art_interface.
cc
国庆钜惠 最低5折起 限量促销CYUN专注海外精品服务器资源,主营香港CN2 GIA、美国CERA、美国高防服务器资源,实体公司,ISP/IDC资质齐全,客服配备齐全。本次针对国庆推出非常给力的促销活动,旗下所有平台同享,新老客户同享,限时限量,售完截止。活动截止时间:2021年10月9日官网地址:www.cyun.net参与机型:香港CN2 GIA云服务器、香港双程CN2云服...
收到10gbiz发来的7月份优惠方案,中国香港、美国洛杉矶机房VPS主机4折优惠码,优惠后洛杉矶VPS月付2.36美元起,香港VPS月付2.75美元起。这是一家2020年成立的主机商,提供的产品包括独立服务器租用和VPS主机等,数据中心在美国洛杉矶、圣何塞和中国香港。商家VPS主机基于KVM架构,支持使用PayPal或者支付宝付款。洛杉矶VPS架构CPU内存硬盘带宽系统价格单核512MB10GB1...
我们在去年12月分享过Hosteons新上AMD Ryzen9 3900X CPU及DDR4内存、NVMe硬盘的高性能VPS产品的消息,目前商家再次发布了产品更新信息,暂停新开100M带宽KVM套餐,新订单转而升级为新的Budget KVM VPS(SSD)系列,带宽为1Gbps端口,且配置大幅升级,目前100M带宽仅保留OpenVZ架构产品可新订购,所有原有主机不变,用户一直续费一直可用。Bud...
bluestacks为你推荐
google竞价排名谷歌竞价排名现在是显示在什么位置?vista系统重装Vista系统的重装的步骤,有系统恢复盘vista系统重装怎样重装vista系统无线路由器限速设置无线路由器速度如何设置?免费开通黄钻怎样能免费开通黄钻会员免费开通黄钻能免费开通黄钻吗??arm开发板开发板是什么?如ARM开发板,DSP开发板等。。它和最终目标板有何区别?ps抠图技巧ps抠图多种技巧,越详细越好,急~~~~~~~如何建立一个网站如何建立一个网站神雕侠侣礼包大全神雕侠侣手游版四重大礼包怎么得到啊?
武汉域名注册 韩国vps俄罗斯美女 联通vps 希网动态域名 yardvps ion 香港cdn 湖南服务器托管 圣诞促销 ntfs格式分区 速度云 空间登入 架设邮件服务器 备案空间 web应用服务器 114dns 97rb 阿里云邮箱个人版 云销售系统 windowsserver2008 更多