1,应用名和现象
运行环境: 模拟器
现象: 启动后卡在首屏上
2,加固特征
通过MT文件管理器可以直接看到加固类型
按照网上提到的加固特征,
- 娜迦: libchaosvmp.so , libddog.solibfdog.so
- 爱加密:libexec.so, libexecmain.so
- 梆梆: libsecexe.so, libsecmain.so , libDexHelper.so
- 360:libprotectClass.so, libjiagu.so
- 通付盾:libegis.so
- 网秦:libnqshield.so
- 百度:libbaiduprotect.so
在/data/app/和/data/data目录下并没有找到对应的文件名:
3,分析
通过查看日志:
4.585 2219 2235 I ActivityManager: Start proc 27774:com.tdx.AndroidNew/u0a63 for activity com.tdx.AndroidNew/com.tdx.Android.TdxActivity
08-15 05:06:04.632 27774 27774 I .tdx.AndroidNe: The ClassLoaderContext is a special shared library.
08-15 05:06:04.634 27774 27774 E LoadedApk: Unable to instantiate appComponentFactory
08-15 05:06:04.634 27774 27774 E LoadedApk: java.lang.ClassNotFoundException: Didn't find class "androidx.core.app.CoreComponentFactory" on path: DexPathList[[zip file "/system/framework/org.apache.http.legacy.boot.jar", zip file "/data/app/com.tdx.AndroidNew-X6oSS0WfcSHPhFq-lPKHIg==/base.apk"],nativeLibraryDirectories=[/data/app/com.tdx.AndroidNew-X6oSS0WfcSHPhFq-lPKHIg==/lib/arm, /data/app/com.tdx.AndroidNew-X6oSS0WfcSHPhFq-lPKHIg==/base.apk!/lib/armeabi-v7a, /system/lib]]
08-15 05:06:04.634 27774 27774 E LoadedApk: at dalvik.system.BaseDexClassLoader.findClass(BaseDexClassLoader.java:134)
08-15 05:06:04.634 27774 27774 E LoadedApk: at java.lang.ClassLoader.loadClass(ClassLoader.java:379)
08-15 05:06:04.634 27774 27774 E LoadedApk: at java.lang.ClassLoader.loadClass(ClassLoader.java:312)
08-15 05:06:04.634 27774 27774 E LoadedApk: at android.app.LoadedApk.createAppFactory(LoadedApk.java:226)
08-15 05:06:04.634 27774 27774 E LoadedApk: at android.app.LoadedApk.createOrUpdateClassLoaderLocked(LoadedApk.java:731)
08-15 05:06:04.634 27774 27774 E LoadedApk: at android.app.LoadedApk.getClassLoader(LoadedApk.java:810)
08-15 05:06:04.634 27774 27774 E LoadedApk: at android.app.LoadedApk.getResources(LoadedApk.java:1032)
08-15 05:06:04.634 27774 27774 E LoadedApk: at android.app.ContextImpl.createAppContext(ContextImpl.java:2347)
08-15 05:06:04.634 27774 27774 E LoadedApk: at android.app.ActivityThread.handleBindApplication(ActivityThread.java:5796)
08-15 05:06:04.634 27774 27774 E LoadedApk: at android.app.ActivityThread.access$1100(ActivityThread.java:200)
08-15 05:06:04.634 27774 27774 E LoadedApk: at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1651)
08-15 05:06:04.634 27774 27774 E LoadedApk: at android.os.Handler.dispatchMessage(Handler.java:106)
08-15 05:06:04.634 27774 27774 E LoadedApk: at android.os.Looper.loop(Looper.java:193)
08-15 05:06:04.634 27774 27774 E LoadedApk: at android.app.ActivityThread.main(ActivityThread.java:6716)
08-15 05:06:04.634 27774 27774 E LoadedApk: at java.lang.reflect.Method.invoke(Native Method)
08-15 05:06:04.634 27774 27774 E LoadedApk: at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:493)
08-15 05:06:04.634 27774 27774 E LoadedApk: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:858)
08-15 05:06:04.708 27774 27774 I NagaLinker: v8.84.3
08-15 05:06:04.710 27774 27774 V XLoader : version = v1.5.2.12-v1.5.4.10
08-15 05:06:04.723 27774 27794 W .tdx.AndroidNe: Opening an oat file without a class loader. Are you using the deprecated DexFile APIs?
08-15 05:06:04.724 27774 27794 E System : Unable to load dex file: /data/user/0/com.tdx.AndroidNew/.cache/fake_classes2.dex
08-15 05:06:04.724 27774 27795 W .tdx.AndroidNe: Opening an oat file without a class loader. Are you using the deprecated DexFile APIs?
08-15 05:06:04.724 27774 27795 E System : Unable to load dex file: /data/user/0/com.tdx.AndroidNew/.cache/fake_classes3.dex
08-15 05:06:04.724 27774 27795 E System : java.io.IOException: No original dex files found for dex location /data/user/0/com.tdx.AndroidNew/.cache/fake_classes3.dex
08-15 05:06:04.724 27774 27795 E System : at dalvik.system.DexFile.openDexFileNative(Native Method)
08-15 05:06:04.724 27774 27795 E System : at dalvik.system.DexFile.openDexFile(DexFile.java:354)
08-15 05:06:04.724 27774 27795 E System : at dalvik.system.DexFile.<init>(DexFile.java:143)
08-15 05:06:04.724 27774 27795 E System : at dalvik.system.DexFile.loadDex(DexFile.java:202)
08-15 05:06:04.724 27774 27795 E System : at dalvik.system.DexPathList.loadDexFile(DexPathList.java:397)
08-15 05:06:04.724 27774 27795 E System : at dalvik.system.DexPathList.makeDexElements(DexPathList.java:344)
08-15 05:06:04.724 27774 27795 E System : at dalvik.system.DexPathList.makeDexElements(DexPathList.java:321)
08-15 05:06:04.724 27774 27795 E System : at dalvik.system.DexPathList.makePathElements(DexPathList.java:443)
08-15 05:06:04.724 27774 27795 E System : at java.lang.reflect.Method.invoke(Native Method)
08-15 05:06:04.724 27774 27795 E System : at com.appsec.e.a(Unknown Source:24)
08-15 05:06:04.724 27774 27795 E System : at com.appsec.c$a.a(Unknown Source:142)
08-15 05:06:04.724 27774 27795 E System : at com.appsec.c$a.call(Unknown Source:125)
08-15 05:06:04.724 27774 27795 E System : at java.util.concurrent.FutureTask.run(FutureTask.java:266)
08-15 05:06:04.724 27774 27795 E System : at java.lang.Thread.run(Thread.java:764)
08-15 05:06:04.724 27774 27794 E System : java.io.IOException: No original dex files found for dex location /data/user/0/com.tdx.AndroidNew/.cache/fake_classes2.dex
08-15 05:06:04.724 27774 27794 E System : at dalvik.system.DexFile.openDexFileNative(Native Method)
08-15 05:06:04.724 27774 27794 E System : at dalvik.system.DexFile.openDexFile(DexFile.java:354)
08-15 05:06:04.724 27774 27794 E System : at dalvik.system.DexFile.<init>(DexFile.java:143)
08-15 05:06:04.724 27774 27794 E System : at dalvik.system.DexFile.loadDex(DexFile.java:202)
08-15 05:06:04.724 27774 27794 E System : at dalvik.system.DexPathList.loadDexFile(DexPathList.java:397)
08-15 05:06:04.724 27774 27794 E System : at dalvik.system.DexPathList.makeDexElements(DexPathList.java:344)
08-15 05:06:04.724 27774 27794 E System : at dalvik.system.DexPathList.makeDexElements(DexPathList.java:321)
08-15 05:06:04.724 27774 27794 E System : at dalvik.system.DexPathList.makePathElements(DexPathList.java:443)
08-15 05:06:04.724 27774 27794 E System : at java.lang.reflect.Method.invoke(Native Method)
08-15 05:06:04.724 27774 27794 E System : at com.appsec.e.a(Unknown Source:24)
08-15 05:06:04.724 27774 27794 E System : at com.appsec.c$a.a(Unknown Source:142)
08-15 05:06:04.724 27774 27794 E System : at com.appsec.c$a.call(Unknown Source:125)
08-15 05:06:04.724 27774 27794 E System : at java.util.concurrent.FutureTask.run(FutureTask.java:266)
08-15 05:06:04.724 27774 27794 E System : at java.lang.Thread.run(Thread.java:764)
08-15 05:06:04.724 27774 27796 W .tdx.AndroidNe: Opening an oat file without a class loader. Are you using the deprecated DexFile APIs?
08-15 05:06:04.725 27774 27796 E System : Unable to load dex file: /data/user/0/com.tdx.AndroidNew/.cache/fake_classes4.dex27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] JNI DETECTED ERROR IN APPLICATION: JNI GetStaticMethodID called with pending exception java.lang.ClassNotFoundException: Didn't find class "com.sdog.SysUtils" on path: DexPathList[[zip file "/system/framework/org.apache.http.legacy.boot.jar", zip file "/data/app/com.tdx.AndroidNew-X6oSS0WfcSHPhFq-lPKHIg==/base.apk"],nativeLibraryDirectories=[/data/app/com.tdx.AndroidNew-X6oSS0WfcSHPhFq-lPKHIg==/lib/arm, /data/app/com.tdx.AndroidNew-X6oSS0WfcSHPhFq-lPKHIg==/base.apk!/lib/armeabi-v7a, /system/lib]]
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at java.lang.Class dalvik.system.BaseDexClassLoader.findClass(java.lang.String) (BaseDexClassLoader.java:134)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at java.lang.Class java.lang.ClassLoader.loadClass(java.lang.String, boolean) (ClassLoader.java:379)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at java.lang.Class java.lang.ClassLoader.loadClass(java.lang.String) (ClassLoader.java:312)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at java.lang.String java.lang.Runtime.nativeLoad(java.lang.String, java.lang.ClassLoader) (Runtime.java:-2)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at void java.lang.Runtime.loadLibrary0(java.lang.ClassLoader, java.lang.String) (Runtime.java:1014)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at void java.lang.System.loadLibrary(java.lang.String) (System.java:1669)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at void com.Proxy.Helper.a(android.content.Context) ((null):70)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at void com.Proxy.ShellApplication.attachBaseContext(android.content.Context) ((null):20)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at void android.app.Application.attach(android.content.Context) (Application.java:212)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at android.app.Application android.app.Instrumentation.newApplication(java.lang.ClassLoader, java.lang.String, android.content.Context) (Instrumentation.java:1121)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at android.app.Application android.app.LoadedApk.makeApplication(boolean, android.app.Instrumentation) (LoadedApk.java:1061)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at void android.app.ActivityThread.handleBindApplication(android.app.ActivityThread$AppBindData) (ActivityThread.java:5889)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at void android.app.ActivityThread.access$1100(android.app.ActivityThread, android.app.ActivityThread$AppBindData) (ActivityThread.java:200)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at void android.app.ActivityThread$H.handleMessage(android.os.Message) (ActivityThread.java:1651)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at void android.os.Handler.dispatchMessage(android.os.Message) (Handler.java:106)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at void android.os.Looper.loop() (Looper.java:193)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at void android.app.ActivityThread.main(java.lang.String[]) (ActivityThread.java:6716)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at java.lang.Object java.lang.reflect.Method.invoke(java.lang.Object, java.lang.Object[]) (Method.java:-2)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at void com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run() (RuntimeInit.java:493)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] at void com.android.internal.os.ZygoteInit.main(java.lang.String[]) (ZygoteInit.java:858)
Unable to instantiate appComponentFactory是典型的娜迦加固异常日志,另外也出现了NagaLinker: v8.84.3,说明娜迦重新使用了新的连接器。
4,初步结论
娜迦加固对X86架构的运行环境有检测,只要检测到X86环境,加固代码就会有异常,如果要解决的话,就需要逆向加固代码,这个难度还是比较大。