frida反调试

frida反调试

常见frida检测

1、检测文件名（改名）、端口名27042（改端口）、双进程保护（spawn启动）

2、检测D-Bus

D-Bus是一种进程间通信(IPC)和远程过程调用(RPC)机制,最初是为Linux开发的,目的是用一个统一的协议替代现有的和竞争的IPC解决方案。

function main() {
const openPtr = Module.getExportByName(‘libc.so’, ‘open’);
const open = new NativeFunction(openPtr, ‘int’, [‘pointer’, ‘int’]);
var readPtr = Module.findExportByName(“libc.so”, “read”);
var read = new NativeFunction(readPtr, ‘int’, [‘int’, ‘pointer’, “int”]);
var fakePath = “/data/data/com.app/maps”;
var file = new File(fakePath, “w”);
var buffer = Memory.alloc(512);
Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {
var pathname = Memory.readUtf8String(pathnameptr);
var realFd = open(pathnameptr, flag);
if (pathname.indexOf(“maps”) >= 0) {
w