taobao设备指纹信息研究 libsgmain.so 分析

1

libsgmain.so 分析

libsgmiddletier.so, 拉出来 jadx ⼀下

libsgmainso.so doCommand 这是⼀个⼊⼝点

libsgsecuritybody.so

DeviceInfoCapture 这个类⾥⾯读取了⼤量的设备信息，⽤于设备指纹

libsgmisc.so

检查包的完整性， dex hash 检测

JNICLibrary.doCommandNative 这个是核⼼的设备指纹收集⽅法⼊⼝

在 libsgmain.so ⽂件中包含⼀个原⽣库（ libsgmain.so 实际上是⼀个 .JAR ⽂件，其中实

现了与加密有关的接⼝）： libsgmainso-6.xx.x

DeviceInfoCapturer 类分析：

DeviceInfoCapturer.doCommandForString ==> 0 null // 固定 null

DeviceInfoCapturer.doCommandForString ==> 1 null // 固定 null

DeviceInfoCapturer.doCommandForString ==> 2 null // 固定 null

DeviceInfoCapturer.a boolean ==> false 720*1449

DeviceInfoCapturer.doCommandForString ==> 3 720*1449 //

屏幕尺⼨ / 分辨率相关 libsgmain.so 分析

2

DeviceInfoCapturer.a boolean ==> true 720*1600

DeviceInfoCapturer.doCommandForString ==> 4 720*1600 //

屏幕分辨率

DeviceInfoCapturer.doCommandForString ==> 5 // android.os.S

ystemProperties "gsm.version.baseband

DeviceInfoCapturer.doCommandForString ==> 6 8 // new java.i

o.File("/sys/devices/system/cpu/").listFiles(new com.alibaba.

one.sdk.c()); CPU 核⼼数

DeviceInfoCapturer.doCommandForString ==> 7 2001000 // /sy

s/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq CPU0 （第⼀

个 CPU 核⼼）在没有任何限制的情况下可以达到的最⼤运⾏频率

DeviceInfoCapturer.doCommandForString ==> 8 55618547712 // a

ndroid.os.StatFs r1 = new android.os.StatFs(android.os.Enviro

nment.getDataDirectory().getPath());

// r4 = r1.getBlockCount() * r1.getBlockSize();

DeviceInfoCapturer.doCommandForString ==> 9 3900196 // jav

a.io.FileReader r4 = new java.io.FileReader("/proc/meminfo")

// cat /proc/meminfo | head -n 1

// MemTotal: 3900196 kB

DeviceInfoCapturer.doCommandForString ==> 10 55618547712

// android.os.StatFs r1 = new android.os.StatFs(android.os.En

vironment.getExternalStorageDirectory().getPath());

// r4 = r1.getBlockSize() * r1.getBlockCount();

DeviceInfoCapturer.doCommandForString ==> 11 // ⽹卡相关

DeviceInfoCapturer.doCommandForString ==> 12 null

// android.telephony.TelephonyManager.getNetworkOperatorName

() libsgmain.so 分析

3

DeviceInfoCapturer.doCommandForString ==> 13 0

DeviceInfoCapturer.doCommandForString ==> 14 null

DeviceInfoCapturer.doCommandForString ==> 15

DeviceInfoCapturer.doCommandForString ==> 16 null

DeviceInfoCapturer.doCommandForString ==> 17 dbcaf6449981d14

c63b65b1e8d501ad50ccbe31e // com.alibaba.one.sdk.i.a(); 硬件

信息 sha-1 出来的

// hash.a string ==> ACCELEROMETER1sc7a20ORIENTATION1MTKLIGH

T1MTKPROXIMITY1MTKSIGNIFICANT_MOTION1MTKSTEP_DETECTOR1MTKSTEP

_COUNTER1MTKTILT_DETECTOR1MTKGLANCE_GESTURE1MTKpickup Wakeup

1xiaomiDEVICE_ORIENTATION1MTKSTATIONARY_DETECT1MTKMOTION_DETE

CT1MTKSTEP_DETECTOR_WAKEUP1MTK --- dbcaf6449981d14c63b65b1e8d

501ad50ccbe31e

DeviceInfoCapturer.doCommandForString ==> 18 67339174b6aa334

f // android_id

DeviceInfoCapturer.doCommandForString ==> 19 1706706519660

// java.lang.String.valueOf(java.lang.System.currentTimeMilli

s() - android.os.SystemClock.elapsedRealtime()); 开机时间

DeviceInfoCapturer.doCommandForString ==> 20 // 包名

DeviceInfoCapturer.doCommandForString ==> 21 8.7.1 // app 版本

DeviceInfoCapturer.doCommandForString ==> 22 7d77c8250a6c12e

3b0d816ce638000ff79c65979 // 包签名的 hash 值 g.a(packageInfo.si

gnatures[0].toCharsString()) SHA-1 算法

DeviceInfoCapturer.doCommandForString ==> 23 ZbpKjmOR7D4DAM3

smJxJGyra // utdid

// java.lang.Class.forName("com.ut.device.UTDevice").getMetho libsgmain.so 分析

4

d("getUtdid"

DeviceInfoCapturer.doCommandForString ==> 24

// r0 = com.alibaba.one.sdk.k.a(com.alibaba.one.android.inne

r.DeviceInfoCapturer.f4a); 置空即可

DeviceInfoCapturer.doCommandForString ==> 25 null

// java.lang.Class.forName("com.android.id.IdentifierManage

r").getOAID

DeviceInfoCapturer.doCommandForString ==> 26 099277f64455964

5 // com.android.id.IdentifierManager.getOAID

DeviceInfoCapturer.doCommandForString ==> 27 null // conten

t://com.vivo.vms.IdProvider/IdentifierId/OAID

DeviceInfoCapturer.doCommandForString ==> 28 null

// com.alibaba.one.android.inner.DeviceInfoCapturer.c

DeviceInfoCapturer.doCommandForString ==> 29 6.6.230507 //

ligsgmain.so 版本

// com.alibaba.wireless.security.open.SecurityGuardManager".g

etInstance.getSDKVersion

DeviceInfoCapturer.doCommandForString ==> 30 null

// java.lang.Class.forName("com.yunos.tvtaobao.uuid.CloudUUI

D").getCloudUUID

DeviceInfoCapturer.doCommandForString ==> 31 2024-01-27 01:1

0:29.340 // app 安装的时间 packageInfo.firstInstallTime

更丰富的设备资料 - 联⽹后才读取 libsgmain.so 分析

5

DeviceInfoCapturerFull.doCommandForString ==> 0 2.68*5.94*6

0.0

// com.alibaba.one.sdk.f.d() width/xdpi,height/xdpi,refreshRa

te

DeviceInfoCapturerFull.doCommandForString ==> 1 320

// densityDpi

DeviceInfoCapturerFull.doCommandForString ==> 2 720*1449

// 分辨率

DeviceInfoCapturerFull.doCommandForString ==> 3 Phone

// Tablet 、 Phone 、 TV

DeviceInfoCapturerFull.doCommandForString ==> 4 {"ram":

{"t":"3900196","f":"253176","a":"2124644"},"rom":{"t":"556185

47712","f":"41185140736","a":"41076584448"},"sdcard":{"t":"55

618547712","f":"41185140736","a":"41076584448"}}

// 各种⽂件⼤⼩ sdk.f.c

DeviceInfoCapturerFull.doCommandForString ==> 5 中国联通

// android.telephony.TelephonyManager r8 = com.alibaba.one.sd

k.j.f16a

// java.lang.String r8 = r8.getSimOperatorName()

DeviceInfoCapturerFull.doCommandForString ==> 6 0

// java.lang.System.getProperty(r8).length

DeviceInfoCapturerFull.doCommandForString ==> 7 null

// 固定 null

DeviceInfoCapturerFull.doCommandForString ==> 8 {"level":10

0,"voltage":4382,"temperature":256,"status":5,"health":2,"pre

sent":-1,"plugged":2}

// com.alibaba.one.sdk.f.a() libsgmain.so 分析

6

// "android.intent.action.BATTERY_CHANGED" 监听电量信息回调， plu

gged ： USB ： 2 ， AC ： 1

DeviceInfoCapturerFull.doCommandForString ==> 9 null

// 固定 null

DeviceInfoCapturerFull.doCommandForString ==> 10 Asia/Shangh

ai GMT+08:00

// java.util.TimeZone.getDefault().getDisplayName()

DeviceInfoCapturerFull.doCommandForString ==> 11 12.0

// getTextSize() 字体⼤⼩

DeviceInfoCapturerFull.doCommandForString ==> 12 null

// "com.taobao.login4android.Login.getNick" 昵称

DeviceInfoCapturerFull.doCommandForString ==> 13

// context.getApplication().getApplicationLabel()

DeviceInfoCapturerFull.doCommandForString ==> 14 433150583

// java.lang.System.currentTimeMillis() - r8.firstInstallTime

DeviceInfoCapturerFull.doCommandForString ==> 15 17062890293

40

// getPackageInfo.getLastUpdateTime

DeviceInfoCapturerFull.doCommandForString ==> 16 0

// packageInfo.applicationInfo.flags & 128) == 0

// 这个标志表⽰应⽤的数据是否可以通过 adb 等⽅式进⾏备份，也就是检查 adb 是

否开启

// 根据 Android 的⽂档， 128 对应的标志是 ApplicationInfo.FLAG_EXTERNA

L_STORAGE

DeviceInfoCapturerFull.doCommandForString ==> 17 1

// 检查当前运⾏的 app pid 是否就是⾃⾝，可以写固定 1 libsgmain.so 分析

7

DeviceInfoCapturerFull.doCommandForString ==> 18 23781390

// appKey 固定值

DeviceInfoCapturerFull.doCommandForString ==> 19 ACCESS_WIFI

_STATE,VIBRATE,INTERNET,ACCESS_NETWORK_STATE,WAKE_LOCK,CHANGE

_WIFI_STATE,NFC,MODIFY_AUDIO_SETTINGS,FLASHLIGHT,BROADCAST_ST

ICKY,DOWNLOAD_WITHOUT_NOTIFICATION,DISABLE_KEYGUARD,EXPAND_ST

ATUS_BAR,ACCESS_LOCATION_EXTRA_COMMANDS,CHANGE_NETWORK_STATE,

BLUETOOTH,USE_FINGERPRINT,FOREGROUND_SERVICE,cn.damai.permiss

ion.MIPUSH_RECEIVE,cn.damai.push.permission.MESSAGE,cn.damai.

permission.C2D_MESSAGE,cn.damai.permission.PROCESS_PUSH_MSG,c

n.damai.permission.PUSH_PROVIDER,

// requestedPermissions

DeviceInfoCapturerFull.doCommandForString ==> 20 {"flag":953

695812,"dlp":" 淘宝 ","fi":1706289029340,"lu":1706289029340}

// flag applicationInfo.flags

// dlp packageManager.getApplicationLabel(applicationInfo).to

String()

// fi packageInfo.firstInstallTime

// lu packageInfo.lastUpdateTime

DeviceInfoCapturerFull.doCommandForString ==> 21 c38dde1913e

fa2e8c35f1cfef6f7e1082942a628

// sha-1 包签名

DeviceInfoCapturerFull.doCommandForString ==> 22 null

// "com.alibaba.wireless.security.open.SecurityGuardManage

r"."getGlobalUserData"

DeviceInfoCapturerFull.doCommandForString ==> 24 H.sensor.pr

oximity,S.adoptable_storage,H.sensor.accelerometer,H.faketouc

h,H.usb.accessory,H.telephony.cdma,S.backup,H.touchscreen,H.t libsgmain.so 分析

8

ouchscreen.multitouch,S.print,H.ethernet,S.activities_on_seco

ndary_displays,S.voice_recognizers,S.picture_in_picture,H.aud

io.low_latency,S.cant_save_state,H.opengles.aep,H.bluetooth,

H.camera.autofocus,H.telephony.gsm,H.telephony.ims,H.usb.hos

t,H.audio.output,S.verified_boot,H.camera.flash,H.camera.fron

t,H.screen.portrait,H.sensor.stepdetector,S.home_screen,H.mic

rophone,S.autofill,S.securely_removes_users,H.bluetooth_le,H.

touchscreen.multitouch.jazzhand,S.app_widgets,S.input_method

s,H.sensor.light,H.vulkan.version,S.companion_device_setup,S.

device_admin,H.wifi.passpoint,H.camera,H.screen.landscape,H.r

am.normal,S.managed_users,S.webview,H.sensor.stepcounter,H.ca

mera.capability.manual_post_processing,H.camera.any,H.camera.

capability.raw,H.vulkan.compute,S.connectionservice,H.touchsc

reen.multitouch.distinct,H.location.network,S.cts,H.camera.ca

pability.manual_sensor,H.camera.level.full,H.wifi.direct,S.li

ve_wallpaper,S.ipsec_tunnels,H.location.gps,S.midi,H.wifi,H.l

ocation,H.vulkan.level,S.secure_lock_screen,H.telephony,S.fil

e_based_encryption,

// for (FeatureInfo featureInfo : c.getPackageManager().getSy

stemAvailableFeatures() ⽤于获取系统上所有可⽤的硬件和软件特性

DeviceInfoCapturerFull.doCommandForString ==> 25 null 或者 Pr

ew+KQ4NfW9/Rm+n+81NL9WM1fauXboIegsudtvlwoRDG9zjQEAAA==

// ava.lang.String r0 = "sgPrefs"

// android.content.SharedPreferences r8 = r8.getSharedPrefere

nces(r0, r4)

// java.lang.String r0 = "2144d8c39b6aea0"

DeviceInfoCapturerFull.doCommandForString ==> 23 6DJdJCgPtpu

mg9fKx8mf2a2QMI8FEr7+IKEydqvib1g=

// android.media.MediaDrm r0 = new android.media.MediaDrm."de

viceUniqueId" ==> base64

DeviceInfoCapturerFull.doCommandForString ==> 26 0|BIH0MIHxA libsgmain.so 分析

9

gEDCgEBAgEECgEBBAgXBAWYu9yAXAQAMEu/hT0IAgYBjWCRt7i/hUU7BDkwNz

ERMA8ECGNuLmRhbWFpAgNbjjIxIgQgSs2aIIrzESNgjPE1WsY9U+J1Rzh+TiV

LzSMucu/i48kwgYmhCDEGAgECAgEDogMCAQOjBAICAQCqAwIBAb+DdwIFAL+F

PgMCAQC/hUBMMEoEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

QEACgECBCBgAWt8BX1Nq0snm7KFnKcmNjjap/WXxa4lRFzagR9Wqb+FQQUCAw

GGoL+FQgUCAwMVHA==

// c() 读了 keystore 、公钥证书、系统证书链

DeviceInfoCapturerFull.doCommandForString ==> 27 null

// 固定 null

DeviceInfoCapturerFull.doCommandForString ==> 28

{"s":4,"v":true,"c0t":"MIICpjCCAkugAwIBAgIBATAKBggqhkjOPQQDAj

A5MQwwCgYDVQQMDANURUUxKTAnBgNVBAUTIDZiMDJiNWY5MzIxMjkzZmQwMDE

0YzcxMjJjN2ZmYWM1MB4XDTcwMDEwMTAwMDAwMFoXDTM3MTIxNTAwMDAwMFow

HzEdMBsGA1UEAwwUQW5kcm9pZCBLZXlzdG9yZSBLZXkwWTATBgcqhkjOPQIBB

ggqhkjOPQMBBwNCAAS1mhflIRSJiBWGNe++3m50GuRZ5Z79w1MoCtlpnnBLVs

81BKwPxLnd3dC3eVRWLAGBDkXGwMHfFQP+jO30HJgLo4IBXDCCAVgwCwYDVR0

PBAQDAgeAMIIBJgYKKwYBBAHWeQIBEQSCARYwggESAgEDCgEBAgEECgEBBCkx

NzA2NzIyMTgwMzk0LDE3MDYyODkwMjkzNDAsMTcwNjI4OTAyOTM0MAQAMEu\/

hT0IAgYBjWCRu6C\/hUU7BDkwNzERMA8ECGNuLmRhbWFpAgNbjjIxIgQgSs2a

IIrzESNgjPE1WsY9U+J1Rzh+TiVLzSMucu\/i48kwgYmhCDEGAgECAgEDogMC

AQOjBAICAQCqAwIBAb+DdwIFAL+FPgMCAQC\/hUBMMEoEIAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAQEACgECBCBgAWt8BX1Nq0snm7KFnKcmN

jjap\/WXxa4lRFzagR9Wqb+FQQUCAwGGoL+FQgUCAwMVHDAfBgNVHSMEGDAWg

BSQTtbki71R9aL84xtk0+jhlHD\/5jAKBggqhkjOPQQDAgNJADBGAiEAmR7co

7VFcI0+oIeQqmFheOCTZFzajS0hGiay83DZBa0CIQDePOFKdnCgf\/cIhU9VY

ERjAMfUhvduekv6ihDpCbwZVA==","c1pk":"MFkwEwYHKoZIzj0CAQYIKoZI

zj0DAQcDQgAErkDpvgP5qTG7kw1CoOqTpVqSLJeh7b7JiRF0RQejgHYWFdAG2

0dg0ivp3z+BLQS7qSOtSJpHhzOJpWugnrW3Xw==","ret":true,"t":"0"}

// d()

// s => getCertificateChain.length

// v => 固定 true

// c0t => base64 ，遍历 java.security.cert.X509Certificate.getP

ublicKey() 计算得到⼀个值

// c1pk => base64 r0.getPublicKey().decode libsgmain.so 分析

10

// ret => 固定 true

// t => 固定 0

设备指纹修改策略：

硬件：每⼀个硬件都要有细微的差别 - 权重⽐较⾼

软件：系统层⾯要有差别 - 权重⾼

环境：包信息要有差异