iOS越狱检测及设备检测分析(一)

iOS越狱检测及设备检测分析(一)——世纪佳缘

越狱检测

fopen检测
 /bin/bash   
 /Applications/Cydia.app
 /Library/MobileSubstrate/MobileSubstrate.dylib
 /usr/sbin/sshd
 /etc/apt

environ检测
MobileSubstrate 
mobilesubstrate

getenv检测
DYLD_INSERT_LIBRARIES

_dyld_get_image_name检测
MobileSubstrate

-[NSFileManager fileExistsAtPath:]检测
/private/var/lib/cydia
/Applications/Cydia.app
/private/var/stash
/private/var/lib/apt/
/user/Applications
/User/Applications
/user/Containers/Bundle/Application
/etc/apt
/usr/sbin/sshd
/bin/bash
/Library/MobileSubstrate/MobileSubstrate.dylib

[NSString writeToFile:atomically:encoding:error:]检测
/private/filename

-[UIApplication URLWithString:]检测
cydia://

设备检测

uname检测

sysctl检测
KERN_BOOTTIME
hw.model
hw.machine
hw.ncpu
kern.boottime
kern.osversion
kern.hostname

NSLocale检测
NSLocaleCountryCode 
preferredLanguages

UIDevice检测
name
systemVersion
systemName

手机运营商检测
carrierName
mobileCountryCode
mobileNetworkCode
isoCountryCode
carrierName
currentRadioAccessTechnology

系统时间检测
NSFileCreationDate
NSFileModificationDate
NSProcessInfo.systemUptime 

硬盘检测
NSFileSystemSize
NSFileSystemFreeSize

内存/CPU使用检测
task_info TASK_BASIC_INFO  CPU/MEM
task_thread thread_info
host_statistics  CPU
host_page_size MEM

耳机检测
AVAudioSession.currentRoute.outputs.portType

网络检测
SCNetworkReachabilityGetFlags
FHostGetAddressing
CFNetworkCopySystemProxySettings  VPN检测
getifaddrs
sysctl获取ipv4网关
sysctl获取mac地址
CNCopySupportedInterfaces获取wifi
CFHostGetAddressing DNS检测
CFNetworkCopyProxiesForURL 代理检测

摄像头检测
UIImagePickerController.isSourceTypeAvailable

NSUserDefaults检测
AppleICUForce24HourTime
AppleLocale
AppleLanguages
AppleKeyboards

屏幕检测
bounds
nativeBounds
scale
brightness 亮度
orientation 朝向

时区检测
systemTimeZone

iTunes检测
purchaseDate  app购买时间
acountInfo AppleID账号

app安装时间
fileCreationDate

IDFV/IDFA

电池检测
batteryLevel
batteryState

位置检测
altitude
verticalAccuracy
horizontalAccuracy
coordinate
timestamp

检测app是否被破解
SignerIdentity
ResourceRules.plist
_CodeSignature
  • 3
    点赞
  • 8
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
iOS越狱开发中,常用的Hook检测包括以下几种: 1. 检测当前进程是否被其他进程注入 ``` void anti_injection() { char path[1024]; int ret = proc_pidpath(getpid(), path, sizeof(path)); if (ret <= 0) { NSLog(@"anti_injection: proc_pidpath failed"); exit(1); } if (strstr(path, "/Library/MobileSubstrate") != NULL) { NSLog(@"anti_injection: MobileSubstrate detected"); exit(1); } if (strstr(path, "/Library/Frameworks/CydiaSubstrate.framework") != NULL) { NSLog(@"anti_injection: CydiaSubstrate detected"); exit(1); } } ``` 2. 检测是否被调试 ``` void anti_debugging() { int name[4]; struct kinfo_proc info; size_t info_size = sizeof(info); name[0] = CTL_KERN; name[1] = KERN_PROC; name[2] = KERN_PROC_PID; name[3] = getpid(); if (sysctl(name, 4, &info, &info_size, NULL, 0) == -1) { NSLog(@"anti_debugging: sysctl failed"); exit(1); } if (info.kp_proc.p_flag & P_TRACED) { NSLog(@"anti_debugging: traced"); exit(1); } } ``` 3. 检测是否被hook ``` void anti_hooking() { const char *functionName = "ptrace"; void *handle = dlopen("/usr/lib/libc.dylib", RTLD_GLOBAL | RTLD_NOW); if (handle == NULL) { NSLog(@"anti_hooking: dlopen failed"); exit(1); } void *ptrace_func = dlsym(handle, functionName); if (ptrace_func == NULL) { NSLog(@"anti_hooking: dlsym failed"); exit(1); } if (ptrace_func != (void *)&ptrace) { NSLog(@"anti_hooking: hook detected"); exit(1); } } ``` 4. 检测是否被注入Cycript等调试工具 ``` void anti_cycript() { char *cycript = strstr(getenv("DYLD_INSERT_LIBRARIES"), "cycript"); if (cycript != NULL) { NSLog(@"anti_cycript: cycript detected"); exit(1); } } ``` 此外,还可以在代码中添加闪退检测断点,当程序发生闪退时就可以打断点进行调试,例如: ``` void crash_handler(int signal) { signal(SIGTRAP, NULL); NSLog(@"crash_handler: signal=%d", signal); exit(1); } void set_crash_handler() { signal(SIGTRAP, crash_handler); } ```
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值