2023Anti-Frida加固样本分析.docx
分析某加固的AntRFrida保护分析过程找到检测所在的S。我们可以通过frida-trace快速进行系统函数的hook,首先我们需要知道loads。的函数一般为dlopen和android_dlopen_ext,所以先执行trida-trace-U-tcom.wuje.Chengxin-1dIopen可以观察到以下输出：PSE:antiantifridachenxin>frida-tracecom.wujie.ChengxindlopenInStrUmenting.dlopen:1.oadedhandlerat11EWantiantifridaWchenxinWhandlerslibdl.sodlopen.is"Startedtracingifunction.PressCtrl+Ctostop.-TID0x3a6f/240msdlopen()24msdlopen()246msdlopen()卜Iin；PSE:样本antiantifridachenxin>_可以看到这里只显示了调用dlopen,但是参数没有输出，祖叩en的第一个参数即为所需Ioad的s。的名字(args0.readcstring()我们可以去提示的路径下修改dlopen.js脚本修改前：IHChengxinJsBdlopeajs3*ForfullAPIreference,see:https:fZda.redocsjavascript-apedsynchronous1.ywhenabouttoca1.1.d1.open.bouttoreturnfromd1.open.SeeonEdetai1.paramfunction1.og1.thisfunctionwithastringtoparamNativePointer)retva1.onEnter/on1.eave,butinsteadinvocation.inonEnter.bepresentedtotheuser,aNativePointerobject.'thisobjectObjecta1.1.owingyoutoaccessstatestoredHowever,dousethistostorefunctionargumentsacrossparamobjectstateVOn1.eaVe(Iog,retval,state)*use"this"whichisanobjectforkeepingstate1.oca1.toan*/onEnter(log,args,state)log(dlopen();),chen×in>_handlers_>libdl.soBdIopenjs5678910111213141516171819202122232425262728293031323334353637修改后：,thisobject-Objecta1.1.owingyoutostorestateforuseinon1.eave.'paramfunction1.og-Ca1.lthisfunctionithastringtobepresentedtotheuser.,paramarrayargsFunctionargumentsrepresentedasanarrayofNativePointerobjects.*Fore×amp1.euseargs0.readUtf8String()ifthefirstargumentisapointertoaCstringeItisalsopossib1.etomodifyargumentsbyassigningaNativePointerobjecttoane1.ementcparamobjectstate.OnlyoneJavaScriptfunctionexecuteatatimejsodonotWOrrtVaboutrace-conditions.ISChengxinjsIHdlopen.js3×chenxin>_handlers_>libdl.so>ISdIopenJs4567891011121314IS1617181920212223242526272829303132333435363738ForfullAPIreference,/Ca1.1.eds.thisobject)paramfunction1.ogparamarrayargsFore×amp1.euseCIrgSftItisa1.sopossib1.et<paramobjectstateOn1.yoneJavaScriptfHoweverjdonotusetisee:https:frida.redocsjavascript-apt/:oca1.1.dtopen.foruseinon1.eavtresentedasanarrayofNativePointerobjectreadlftf8String()ifthefirstargumentisapointertoaCstringjdifyargumentsbyassigningaNativePointerobjecttoane1.ementObjecta1.1.owingyoutokeepstateacrossfunctioncal1.s.ionwi1.1.executeatatime,sodonotworryaboutonnter(log,args,state)log(,dlopen():'*argsf.readCString();,*Ca1.1.edsynchronous1.yuhenabouttoreturnfromd1.open.thisobject-Objec'paramfunction1.og§Parem(NativePointer)retva1.paramobjectstateon1.eave(log,retval,state),ossonEnter/on1.eav1.race-condtionse,butinstead.sfunctionwxtReturnva1.uer'tcstoredino11Etct'.，stringtobepresentedto'esentedosoNotivcPointct*outokeepstateacrossfunctionca1.ls.再次输出一下：PSE:样本antiantifridachenxin>frida-tracecom.wujie.ChengxindlopenInstrumenting.dlopen:1.oadedhandlerat"E：样本Wantiantifridachenxin_handlers_Wlibdl.sodlopen.Js"Startedtracing1function.PressCtrlKtostop./TIDx3e92/241 msdIopen():libc.so242 msdlopen():libc.so247 msdlopen():Iibdatajar.soProcesstermir<dtedIPSE:antiantifridachenxin>现在dlopen的参数就显示出来了，但是这里load的三个SO显然是系统的s。而非app的SO,所以我们再hookandroid_dlopen_ext看看：PSE:样本antiantifri,dachenxin>frida-tracec<xn.wujIe.Chengxinandroid_dlopen_extInstrumenting.android-dlopen-e×t:1.oadedhandlerat"E:样本Wantiantifridachenxin_handlers_libdl.soandroid_dlopen_ext.js"Startedtracing1function.PressCtrltCtostop./TID0x406c/211msandroid.dlopen,e×t():systemframeworkoatarmorg.apache.http.legacy.odex216msandroiddlopene×t():dataappcom.wujie.che11gxin-WZCaCd7ATEUlEIc9F17Xdg=oata11nbase.o<ie×222msandroid-dloen-e×t():dataappcom.wujie.chengxin-WZCaCd7ATEUlEIc9F17Xdg=llbarwlibDexHelper.sopsE:样本antiantifridachenxin>_可以看到当IOad到IibDeXHelPer.so的时候，frida被杀掉了，所以我们初步可以判定做检测的位置在IibDexHelper.so首先我们可以通过hook字符串比较函数（比如StrStrWStrCmP等函数）来观察是否传入了frida相关的字符串进行比较Interceptor.attach(Module.findE×portByName(null,"strstr"),onEnter:function(args)if(args0.readCString().indexOf("frida")!：1args1.readCString().indexf("frida")!=-1|args0.readCString().indexOf("gum-js-loop")!=-largsl.readCString().indexf("gum-js-loop")!=-l|args0.readCString().indexOf("gmain")!=-1argsl.readCString().indexOf("g三ain")I=-1|args.readCString().i11dexf("Iinjector")!=-1argsl.readCString().indexf("Iinjector")!=-1console.log('nstrstr('+'sl="t+args0.readCString()+',s2=w,+args1.readCString()+""+11,)i),on1.eave:function(retval)!)；PSE:ffantiatifridachen×in>frida-traceCM.wjie.CbengxinstrstrInstrumenting.strstr:1.oadedhandlerat"E:样本antiantifridachenxin_handlers_1ibc.sostrstr.js"Startedtracing1fu
