Bypass 某 x 书 frida 检测

0x01、环境

app 版本：8.46.0 酷安下载
设备：Pixel 2XL Android 8.1
hook：frida 12.8.0、frida-tools 5.3.0

0x02、Bypass_frida

hook libc.so 模块中 strstr 与 strcmp，一把绕过。

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52

function Bypass_frida() {     var pt_strstr = Module.findExportByName("libc.so", 'strstr');     Interceptor.attach(pt_strstr, {         onEnter: function (args) {             var args1 = args[0].readCString();             var args2 = args[1].readCString();             if (                 args2.indexOf("gum-js-loop") !== -1 ||                 args2.indexOf("pool-frida") !== -1||                 args2.indexOf("linjector") !== -1 ||                 args2.indexOf("REJECT") !== -1 ||                 args2.indexOf("frida") !== -1 ||                 args2.indexOf("gmain") !== -1 ||                 args2.indexOf("gdbus") !== -1 ||                 args2.indexOf("tmp") !== -1             ) {                 console.log("strstr-->", args1, args2);                 this.hook_str = true;             }         }, onLeave: function (retval) {             if (this.hook_str) {                 retval.replace(0);             }         }     });     var pt_strcmp = Module.findExportByName("libc.so", 'strcmp');     Interceptor.attach(pt_strcmp, {         onEnter: function (args) {             var args1 = args[0].readCString();             var args2 = args[1].readCString();             if (                 args2.indexOf("gum-js-loop") !== -1 ||                 args2.indexOf("pool-frida") !== -1||                 args2.indexOf("linjector") !== -1 ||                 args2.indexOf("REJECT") !== -1 ||                 args2.indexOf("frida") !== -1 ||                 args2.indexOf("gmain") !== -1 ||                 args2.indexOf("gdbus") !== -1 ||                 args2.indexOf("tmp") !== -1             ) {                 console.log("strcmp-->", args1, args2);                 this.hook_cmp = true;             }         }, onLeave: function (retval) {             if (this.hook_cmp) {                 retval.replace(0);             }         }     }) } Bypass_frida();

0x03、效果