OneStepBeforeGameHackers--InstrumentingAndroidEmulatorsnevermoeDeNACo.
,Ltd.
SelfIntroductionnevermoe(@n3v3rm03,i[at]nevermoe.
com)Loveplaying/hackinggamesDeNACo.
,Ltd.
AgendaBackgroundEmulatorInternalHookingDemoConclusionDeNACo.
,Ltd.
Background:GameCheatingThreatModelUsersCheatersVendorsPCYESYESYESMobile(Normally)NoYESNoFullControlDeNACo.
,Ltd.
Background:MobileGameCheatingBusinessModelIsthereaneasywaytodistributecheatingtoolsAndroidemulators!
UniedenvironmentAlreadyoreasilyrootedDeNACo.
,Ltd.
CheatingonemulatorsPopular:Touchsimulation(e.
g.
MobileAnjian)WhyaretherenohookingtoolsGamecodesareusuallynativeCommercialemulatorsuseIntelHoudiniforarm-x86translationinnativecodeBackground:MobileGameCheatingBusinessModelDiculttohookDeNACo.
,Ltd.
Background:PurposeEnablehookingoncommercialAndroidemulators!
DeNACo.
,Ltd.
EmulatorInternal:TargetsClientVer.
AndroidVer.
HoudiniVer.
BlueStacks3.
56.
73.
18174.
4.
24.
0.
8.
45720NOX6.
0.
5.
24.
4.
24.
0.
8.
45720NOX6.
0.
5.
25.
5.
15.
0.
7b_x.
48396LeiDian2.
0.
545.
5.
15.
0.
7b_x.
48396DeNACo.
,Ltd.
EmulatorInternal:CommandLineBinary//le:enable_nativebridge.
shcd$binfmt_misc_dirif[-eregister];thenecho':arm_exe:M::\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x28::'"/system/lib/arm/houdini:P">registerecho':arm_dyn:M::\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x28::'"/system/lib/arm/houdini:P">registerHookitLD_PRELOAD=libinject_arm.
so.
/target_exe_armptrace(x86)target_pidptrace(arm)target_pidDeNACo.
,Ltd.
EmulatorInternal:JavaApplicationIsLD_PRELOADusefulinJavaapplicationhookingDeNACo.
,Ltd.
NormalstartupEmulatorInternal:JavaApplicationZygoteforkApplicationloopstartuprequestfromActivityManagerinithoudiniDeNACo.
,Ltd.
Startwith"wrap"systempropertysetpropwrap.
com.
nevermoe.
exampleLD_PRELOAD=libinject.
soEmulatorInternal:JavaApplicationZygoteforkShellloopstartuprequestfromActivityManagerexecshellforkexecv(app_process)ApplicationinithoudiniDeNACo.
,Ltd.
Startwith"wrap"systempropertyEmulatorInternal:JavaApplicationrunOnce()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaforkAndSpecialize()—frameworks/base/core/java/com/android/internal/os/Zygote.
javaForkAndSpecializeCommon()—frameworks/base/core/jni/com_android_internal_os_Zygote.
cpprunSelectLoop()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javahandleChildProc()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaexecApplication()—frameworks/base/core/java/com/android/internal/os/WrapperInit.
javapublicstaticvoidexecApplication(StringinvokeWith,StringniceName,inttargetSdkVersion,FileDescriptorpipeFd,String[]args){StringBuildercommand=newStringBuilder(invokeWith);command.
append("/system/bin/app_process/system/bin--application");if(niceName!
=null){command.
append("'--nice-name=").
append(niceName).
append("'");}command.
append("com.
android.
internal.
os.
WrapperInit");command.
append(pipeFd!
=nullpipeFd.
getInt$():0);command.
append('');command.
append(targetSdkVersion);Zygote.
appendQuotedShellArgs(command,args);Zygote.
execShell(command.
toString());}DeNACo.
,Ltd.
EmulatorInternal:JavaApplicationStartwith"wrap"property/system/bin/sh-cLD_PRELOAD=libinject_arm.
so\/system/bin/app_process/system/bin--application\'--nice-name=com.
nevermoe.
myapp'\com.
android.
internal.
os.
WrapperInit4821\'android.
app.
ActivityThread'Won'tdothetrickx86armDeNACo.
,Ltd.
EmulatorInternal:InitHoudinimain()—frameworks/base/cmds/app_process/app_main.
cppAndroidRuntime::start()—frameworks/base/core/jni/AndroidRuntime.
cppZygoteInit::main()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javaJNI_CreateJavaVM()—art/runtime/jni_internal.
ccRuntime::Start()—art/runtime/runtime.
ccAndroidRuntime::startVm()—frameworks/base/core/jni/AndroidRuntime.
cpp(Android5.
1.
1/4.
4.
2)app_process--StartasZygoteDeNACo.
,Ltd.
(Android5.
1.
1)ZygoteforkprocessEmulatorInternal:InitHoudinirunOnce()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javaforkAndSpecialize()—frameworks/base/core/java/com/android/internal/os/Zygote.
javacallPostForkChildHooks()—frameworks/base/core/java/com/android/internal/os/Zygote.
javapostForkChild()—libcore/dalvik/src/main/java/dalvik/system/ZygoteHooks.
javaZygoteHooks_nativePostForkChild()—art/runtime/native/dalvik_system_ZygoteHooks.
ccForkAndSpecializeCommon()—frameworks/base/core/jni/com_android_internal_os_Zygote.
cppRuntime::DidForkFromZygote—art/runtime/runtime.
ccInitializeNativeBridge—system/core/libnativebridge/native_bridge.
ccInitializeNativeBridge—art/runtime/native_bridge_art_interface.
ccrunSelectLoop()—frameworks/base/core/java/com/android/internal/os/ZygoteInit.
javahandleChildProc()—frameworks/base/core/java/com/android/internal/os/ZygoteConnection.
javazygoteInit()—frameworks/base/core/java/com/android/internal/os/RuntimeInit.
javaDeNACo.
,Ltd.
Android5.
1.
1EmulatorInternal:InitHoudini//Nativebridgeinterfacestoruntime.
structNativeBridgeCallbacks{uint32_tversion;bool(*initialize)(constNativeBridgeRuntimeCallbacks*runtime_cbs,constchar*private_dir,void*(*loadLibrary)(constchar*libpath,intag);void*(*getTrampoline)(void*handle,constchar*name,constchar*shorty,uint32_tlen);bool(*isSupported)(constchar*libpath);conststructNativeBridgeRuntimeValues*(*getAppEnv)(constchar*instruction_set);bool(*isCompatibleWith)(uint32_tbridge_version);NativeBridgeSignalHandlerFn(*getSignalHandler)(intsignal);};//libhoudini.
so.
data:00379198NativeBridgeItfdd2.
data:0037919Cddoffsetsub_1BD070.
data:003791A0ddoffsetsub_1BCC80.
data:003791A4ddoffsetsub_1BCD60.
data:003791A8ddoffsetsub_1BCEC0.
data:003791ACddoffsetsub_1BCF40.
data:003791B0ddoffsetsub_1BCF90.
data:003791B4ddoffsetsub_1BCFE0DeNACo.
,Ltd.
Android4.
4.
2EmulatorInternal:InitHoudinidvmLoadNativeCode()houdini::hookDlopen()houdini::hookJniOnload()houdiniHookInit()//le:platform/dalvik/vm/Native.
cpphookDlopen(){v3=dlopen((constchar*)this,(int)a2);if(v3)returnv3;elsehoudiniHookInit();}houdiniHookInit(){v15=dword_4F2F84;*(_DWORD*)(v15+8)=dlsym(handle,"dvm2hdDlopen");v16=dword_4F2F84;*(_DWORD*)(v16+12)=dlsym(handle,"dvm2hdDlsym");v17=dword_4F2F84;*(_DWORD*)(v17+20)=dlsym(handle,"dvm2hdNeeded");v18=dword_4F2F84;*(_DWORD*)(v18+16)=dlsym(handle,"dvm2hdNativeMethodHelper");v19=dword_4F2F84;*(_DWORD*)(v19+24)=dlsym(handle,"androidrt2hdCreateActivity");}DeNACo.
,Ltd.
GenymotionNohoudiniprovidedBluestackslib3btrans.
so==libhoudini.
soNOXpackedlibdvm.
soEmulatorInternal:HoudiniLicenseDeNACo.
,Ltd.
GenymotionNohoudiniprovidedBluestackslib3btrans.
so==libhoudini.
soNOXpackedlibdvm.
soEmulatorInternal:HoudiniLicenseDeNACo.
,Ltd.
Hooking:ExistingHookingFrameworkXposedOnlyJavaLayer(Discussthislater)Substituteapp_processtoloaditsownjarleFridaOmnipotent"I'mafraidNOXisunsupported.
Pleaseuseastockemulatororrealdevice,orhelpusxthis.
It'snotapriorityformepersonallysounlesssomebodyhelpsout,NOXsupportwillnothappen.
:-/"Substrate(onAndroid)Fakeliblog.
soOutdatedDeNACo.
,Ltd.
Hooking:NormalApproachptraceattachptracecalldlopenhookfunctiontracertraceelibA.
solibB.
solibinject.
so.
.
.
hookfunctionDeNACo.
,Ltd.
HookingonEmulator:(A)UtilizeHoudiniptraceattachptracecalldlopenopenarmlibbyhoudinitracertraceelib_x86.
solib_arm.
solibinject_x86.
so.
.
.
hookfunctionhookfunctionlibinject_arm.
soopenarmlibbyhoudiniDeNACo.
,Ltd.
HookingonEmulator:(B)UtilizeXposedpublicclassNativeHook{static{System.
loadLibrary("inject_arm");}publicnativestaticvoidinitNativeHook();}findAndHookMethod("android.
app.
Application",lpparam.
classLoader,"onCreate",newXC_MethodHook(){@OverrideprotectedvoidbeforeHookedMethod(MethodHookParamparam)throwsThrowable{NativeHook.
initNativeHook();}@OverrideprotectedvoidafterHookedMethod(MethodHookParamparam)throwsThrowable{}});DeNACo.
,Ltd.
DemoMethodA:github.
com/nevermoe/EHookvoidreal_init_func(){hook_by_addr(&h1,"nb/libc.
so",target_addr,hook_target);hook_by_name(&h2,"nb/libc.
so","recvfrom",hook_recvfrom);}DeNACo.
,Ltd.
ConclusionMobilegameisgettingmorepopularaswellascheatingCheatingpatternschangeasthetechniquedevelopsWeneedemulatordetectionmorethanwethoughtGamesecurityisfun!
DeNACo.
,Ltd.
ThankYou!
DeNACo.
,Ltd.
(Android5.
1.
1)app_processstartasapplicationEmulatorInternal:InitHoudinimain()—frameworks/base/cmds/app_process/app_main.
cppAndroidRuntime::start()—frameworks/base/core/jni/AndroidRuntime.
cppRuntimeInit::main()—frameworks/base/core/java/com/android/internal/os/RuntimeInit.
javaJNI_CreateJavaVM()—art/runtime/jni_internal.
ccRuntime::Start()—art/runtime/runtime.
ccRuntime::DidForkFromZygote—art/runtime/runtime.
ccInitializeNativeBridge—system/core/libnativebridge/native_bridge.
ccAndroidRuntime::startVm()—frameworks/base/core/jni/AndroidRuntime.
cppInitializeNativeBridge—art/runtime/native_bridge_art_interface.
cc
racknerd怎么样?racknerd商家最近促销三款美国便宜vps,最低只需要9.49美元,可以选择美国圣何塞、西雅图、纽约和芝加哥机房。RackNerd是一家成立于2019年的美国高性价比服务器商家,主要从事美国和荷兰数据中心的便宜vps、独立服务器销售!支持中文工单、支持支付宝和微信以及PayPal付款购买!点击直达:racknerd官方网站INTEL系列可选机房:加利福尼亚州圣何塞、芝加...
日本vps云服务器怎么选择?很多人都会遇到日本vps和日本云服务器怎么选择的问题,日本云服务器具有免备案的特点。小编今天就分析一下日本云服务器价格多少钱,以方便大家选购的时候有个更加合适的取舍。日本云服务器租用前比较选择,高性能、安全、高效、免备案日本云服务器是很关键的因素。那么,日本云服务器该怎么选择呢?日本作为我们的邻国,与其贸易、文化往来是比较多的。日本云服务器价格多少钱一年?一、日本·CN...
ATCLOUD.NET怎么样?ATCLOUD.NET主要提供KVM架构的VPS产品、LXC容器化产品、权威DNS智能解析、域名注册、SSL证书等海外网站建设服务。 其大部分数据中心是由OVH机房提供,其节点包括美国(俄勒冈、弗吉尼亚)、加拿大、英国、法国、德国以及新加坡。 提供超过480Gbps的DDoS高防保护,杜绝DDoS攻击骚扰,比较适合海外建站等业务。官方网站:点击访问ATCLOUD官网活...
bluestacks为你推荐
推广方法产品如何做推广暴风影音怎么截图暴风影音怎么截屏啊?51自学网站谁能给我免费学习的网站吧 谢谢了二层交换机什么是三层交换机?什么是二层叫交换机?有什么区别?云挂机快手极速版后台云挂机辅?助各位用了吗?在哪找的?分词技术怎样做好百度分词技术和长尾词优化分词技术怎么在SEO中学会运用关键词分词技术服务器连接异常服务器连接异常是怎么回事啊,怎么解决服务器连接异常服务器连接异常,即将退出,请重新进入游戏.怎么回事微信怎么看聊天记录微信如何查找聊天记录
美国服务器托管 net主机 亚洲大于500m kvmla vmsnap3 服务器架设 长沙服务器 panel1 网站挂马检测工具 52测评网 100x100头像 阿里云浏览器 股票老左 彩虹云 我的世界服务器ip 阿里云邮箱登陆地址 supercache 广州服务器托管 闪讯网 建站技术 更多