应用兼容性-娜迦加固应用启动卡在首屏

1,应用名和现象

运行环境: 模拟器

现象: 启动后卡在首屏上

2,加固特征

通过MT文件管理器可以直接看到加固类型

按照网上提到的加固特征,

  • 娜迦: libchaosvmp.so , libddog.solibfdog.so
  • 爱加密:libexec.so, libexecmain.so
  • 梆梆: libsecexe.so, libsecmain.so , libDexHelper.so
  • 360:libprotectClass.so, libjiagu.so
  • 通付盾:libegis.so
  • 网秦:libnqshield.so
  • 百度:libbaiduprotect.so

在/data/app/和/data/data目录下并没有找到对应的文件名: 

3,分析

通过查看日志: 

4.585  2219  2235 I ActivityManager: Start proc 27774:com.tdx.AndroidNew/u0a63 for activity com.tdx.AndroidNew/com.tdx.Android.TdxActivity
08-15 05:06:04.632 27774 27774 I .tdx.AndroidNe: The ClassLoaderContext is a special shared library.
08-15 05:06:04.634 27774 27774 E LoadedApk: Unable to instantiate appComponentFactory
08-15 05:06:04.634 27774 27774 E LoadedApk: java.lang.ClassNotFoundException: Didn't find class "androidx.core.app.CoreComponentFactory" on path: DexPathList[[zip file "/system/framework/org.apache.http.legacy.boot.jar", zip file "/data/app/com.tdx.AndroidNew-X6oSS0WfcSHPhFq-lPKHIg==/base.apk"],nativeLibraryDirectories=[/data/app/com.tdx.AndroidNew-X6oSS0WfcSHPhFq-lPKHIg==/lib/arm, /data/app/com.tdx.AndroidNew-X6oSS0WfcSHPhFq-lPKHIg==/base.apk!/lib/armeabi-v7a, /system/lib]]
08-15 05:06:04.634 27774 27774 E LoadedApk:     at dalvik.system.BaseDexClassLoader.findClass(BaseDexClassLoader.java:134)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at java.lang.ClassLoader.loadClass(ClassLoader.java:379)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at java.lang.ClassLoader.loadClass(ClassLoader.java:312)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at android.app.LoadedApk.createAppFactory(LoadedApk.java:226)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at android.app.LoadedApk.createOrUpdateClassLoaderLocked(LoadedApk.java:731)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at android.app.LoadedApk.getClassLoader(LoadedApk.java:810)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at android.app.LoadedApk.getResources(LoadedApk.java:1032)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at android.app.ContextImpl.createAppContext(ContextImpl.java:2347)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at android.app.ActivityThread.handleBindApplication(ActivityThread.java:5796)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at android.app.ActivityThread.access$1100(ActivityThread.java:200)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1651)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at android.os.Handler.dispatchMessage(Handler.java:106)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at android.os.Looper.loop(Looper.java:193)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at android.app.ActivityThread.main(ActivityThread.java:6716)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at java.lang.reflect.Method.invoke(Native Method)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:493)
08-15 05:06:04.634 27774 27774 E LoadedApk:     at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:858)
08-15 05:06:04.708 27774 27774 I NagaLinker: v8.84.3
08-15 05:06:04.710 27774 27774 V XLoader :      version = v1.5.2.12-v1.5.4.10
08-15 05:06:04.723 27774 27794 W .tdx.AndroidNe: Opening an oat file without a class loader. Are you using the deprecated DexFile APIs?
08-15 05:06:04.724 27774 27794 E System  : Unable to load dex file: /data/user/0/com.tdx.AndroidNew/.cache/fake_classes2.dex
08-15 05:06:04.724 27774 27795 W .tdx.AndroidNe: Opening an oat file without a class loader. Are you using the deprecated DexFile APIs?
08-15 05:06:04.724 27774 27795 E System  : Unable to load dex file: /data/user/0/com.tdx.AndroidNew/.cache/fake_classes3.dex
08-15 05:06:04.724 27774 27795 E System  : java.io.IOException: No original dex files found for dex location /data/user/0/com.tdx.AndroidNew/.cache/fake_classes3.dex
08-15 05:06:04.724 27774 27795 E System  :      at dalvik.system.DexFile.openDexFileNative(Native Method)
08-15 05:06:04.724 27774 27795 E System  :      at dalvik.system.DexFile.openDexFile(DexFile.java:354)
08-15 05:06:04.724 27774 27795 E System  :      at dalvik.system.DexFile.<init>(DexFile.java:143)
08-15 05:06:04.724 27774 27795 E System  :      at dalvik.system.DexFile.loadDex(DexFile.java:202)
08-15 05:06:04.724 27774 27795 E System  :      at dalvik.system.DexPathList.loadDexFile(DexPathList.java:397)
08-15 05:06:04.724 27774 27795 E System  :      at dalvik.system.DexPathList.makeDexElements(DexPathList.java:344)
08-15 05:06:04.724 27774 27795 E System  :      at dalvik.system.DexPathList.makeDexElements(DexPathList.java:321)
08-15 05:06:04.724 27774 27795 E System  :      at dalvik.system.DexPathList.makePathElements(DexPathList.java:443)
08-15 05:06:04.724 27774 27795 E System  :      at java.lang.reflect.Method.invoke(Native Method)
08-15 05:06:04.724 27774 27795 E System  :      at com.appsec.e.a(Unknown Source:24)
08-15 05:06:04.724 27774 27795 E System  :      at com.appsec.c$a.a(Unknown Source:142)
08-15 05:06:04.724 27774 27795 E System  :      at com.appsec.c$a.call(Unknown Source:125)
08-15 05:06:04.724 27774 27795 E System  :      at java.util.concurrent.FutureTask.run(FutureTask.java:266)
08-15 05:06:04.724 27774 27795 E System  :      at java.lang.Thread.run(Thread.java:764)
08-15 05:06:04.724 27774 27794 E System  : java.io.IOException: No original dex files found for dex location /data/user/0/com.tdx.AndroidNew/.cache/fake_classes2.dex
08-15 05:06:04.724 27774 27794 E System  :      at dalvik.system.DexFile.openDexFileNative(Native Method)
08-15 05:06:04.724 27774 27794 E System  :      at dalvik.system.DexFile.openDexFile(DexFile.java:354)
08-15 05:06:04.724 27774 27794 E System  :      at dalvik.system.DexFile.<init>(DexFile.java:143)
08-15 05:06:04.724 27774 27794 E System  :      at dalvik.system.DexFile.loadDex(DexFile.java:202)
08-15 05:06:04.724 27774 27794 E System  :      at dalvik.system.DexPathList.loadDexFile(DexPathList.java:397)
08-15 05:06:04.724 27774 27794 E System  :      at dalvik.system.DexPathList.makeDexElements(DexPathList.java:344)
08-15 05:06:04.724 27774 27794 E System  :      at dalvik.system.DexPathList.makeDexElements(DexPathList.java:321)
08-15 05:06:04.724 27774 27794 E System  :      at dalvik.system.DexPathList.makePathElements(DexPathList.java:443)
08-15 05:06:04.724 27774 27794 E System  :      at java.lang.reflect.Method.invoke(Native Method)
08-15 05:06:04.724 27774 27794 E System  :      at com.appsec.e.a(Unknown Source:24)
08-15 05:06:04.724 27774 27794 E System  :      at com.appsec.c$a.a(Unknown Source:142)
08-15 05:06:04.724 27774 27794 E System  :      at com.appsec.c$a.call(Unknown Source:125)
08-15 05:06:04.724 27774 27794 E System  :      at java.util.concurrent.FutureTask.run(FutureTask.java:266)
08-15 05:06:04.724 27774 27794 E System  :      at java.lang.Thread.run(Thread.java:764)
08-15 05:06:04.724 27774 27796 W .tdx.AndroidNe: Opening an oat file without a class loader. Are you using the deprecated DexFile APIs?
08-15 05:06:04.725 27774 27796 E System  : Unable to load dex file: /data/user/0/com.tdx.AndroidNew/.cache/fake_classes4.dex

27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542] JNI DETECTED ERROR IN APPLICATION: JNI GetStaticMethodID called with pending exception java.lang.ClassNotFoundException: Didn't find class "com.sdog.SysUtils" on path: DexPathList[[zip file "/system/framework/org.apache.http.legacy.boot.jar", zip file "/data/app/com.tdx.AndroidNew-X6oSS0WfcSHPhFq-lPKHIg==/base.apk"],nativeLibraryDirectories=[/data/app/com.tdx.AndroidNew-X6oSS0WfcSHPhFq-lPKHIg==/lib/arm, /data/app/com.tdx.AndroidNew-X6oSS0WfcSHPhFq-lPKHIg==/base.apk!/lib/armeabi-v7a, /system/lib]]
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at java.lang.Class dalvik.system.BaseDexClassLoader.findClass(java.lang.String) (BaseDexClassLoader.java:134)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at java.lang.Class java.lang.ClassLoader.loadClass(java.lang.String, boolean) (ClassLoader.java:379)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at java.lang.Class java.lang.ClassLoader.loadClass(java.lang.String) (ClassLoader.java:312)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at java.lang.String java.lang.Runtime.nativeLoad(java.lang.String, java.lang.ClassLoader) (Runtime.java:-2)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at void java.lang.Runtime.loadLibrary0(java.lang.ClassLoader, java.lang.String) (Runtime.java:1014)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at void java.lang.System.loadLibrary(java.lang.String) (System.java:1669)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at void com.Proxy.Helper.a(android.content.Context) ((null):70)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at void com.Proxy.ShellApplication.attachBaseContext(android.content.Context) ((null):20)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at void android.app.Application.attach(android.content.Context) (Application.java:212)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at android.app.Application android.app.Instrumentation.newApplication(java.lang.ClassLoader, java.lang.String, android.content.Context) (Instrumentation.java:1121)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at android.app.Application android.app.LoadedApk.makeApplication(boolean, android.app.Instrumentation) (LoadedApk.java:1061)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at void android.app.ActivityThread.handleBindApplication(android.app.ActivityThread$AppBindData) (ActivityThread.java:5889)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at void android.app.ActivityThread.access$1100(android.app.ActivityThread, android.app.ActivityThread$AppBindData) (ActivityThread.java:200)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at void android.app.ActivityThread$H.handleMessage(android.os.Message) (ActivityThread.java:1651)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at void android.os.Handler.dispatchMessage(android.os.Message) (Handler.java:106)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at void android.os.Looper.loop() (Looper.java:193)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at void android.app.ActivityThread.main(java.lang.String[]) (ActivityThread.java:6716)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at java.lang.Object java.lang.reflect.Method.invoke(java.lang.Object, java.lang.Object[]) (Method.java:-2)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at void com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run() (RuntimeInit.java:493)
08-15 05:06:04.739 27774 27774 F .tdx.AndroidNe: java_vm_ext.cc:542]   at void com.android.internal.os.ZygoteInit.main(java.lang.String[]) (ZygoteInit.java:858)

Unable to instantiate appComponentFactory是典型的娜迦加固异常日志,另外也出现了NagaLinker: v8.84.3,说明娜迦重新使用了新的连接器。

4,初步结论

娜迦加固对X86架构的运行环境有检测,只要检测到X86环境,加固代码就会有异常,如果要解决的话,就需要逆向加固代码,这个难度还是比较大。

  • 17
    点赞
  • 26
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

旗浩QH

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付:¥1
获取中
扫码支付

您的余额不足,请更换扫码支付或充值

打赏作者

实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值