├── app ├── .gitignore ├── src │ ├── main │ │ ├── res │ │ │ ├── values │ │ │ │ ├── strings.xml │ │ │ │ ├── colors.xml │ │ │ │ └── styles.xml │ │ │ ├── mipmap-hdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_round.png │ │ │ ├── mipmap-mdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_round.png │ │ │ ├── mipmap-xhdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_round.png │ │ │ ├── mipmap-xxhdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_round.png │ │ │ ├── mipmap-xxxhdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_round.png │ │ │ ├── mipmap-anydpi-v26 │ │ │ │ ├── ic_launcher.xml │ │ │ │ └── ic_launcher_round.xml │ │ │ ├── layout │ │ │ │ └── activity_main.xml │ │ │ ├── drawable-v24 │ │ │ │ └── ic_launcher_foreground.xml │ │ │ └── drawable │ │ │ │ └── ic_launcher_background.xml │ │ ├── cpp │ │ │ ├── __set_errno.cpp │ │ │ ├── bionic_asm_arm.h │ │ │ ├── syscall.S │ │ │ ├── CMakeLists.txt │ │ │ ├── bionic_asm.h │ │ │ └── detect.cpp │ │ ├── AndroidManifest.xml │ │ └── java │ │ │ └── com │ │ │ └── qtfreet │ │ │ └── antifrida │ │ │ └── MainActivity.java │ ├── test │ │ └── java │ │ │ └── com │ │ │ └── qtfreet │ │ │ └── antifrida │ │ │ └── ExampleUnitTest.java │ └── androidTest │ │ └── java │ │ └── com │ │ └── qtfreet │ │ └── antifrida │ │ └── ExampleInstrumentedTest.java ├── proguard-rules.pro └── build.gradle ├── settings.gradle ├── gradle └── wrapper │ ├── gradle-wrapper.jar │ └── gradle-wrapper.properties ├── .idea ├── vcs.xml ├── misc.xml ├── runConfigurations.xml ├── gradle.xml └── codeStyles │ └── Project.xml ├── .gitignore ├── README.md ├── gradle.properties ├── gradlew.bat └── gradlew /app/.gitignore: -------------------------------------------------------------------------------- 1 | /build 2 | -------------------------------------------------------------------------------- /settings.gradle: -------------------------------------------------------------------------------- 1 | include ':app' 2 | rootProject.name='AntiFrida' 3 | -------------------------------------------------------------------------------- /app/src/main/res/values/strings.xml: -------------------------------------------------------------------------------- 1 | 2 | AntiFrida 3 | 4 | -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/qtfreet00/AntiFrida/HEAD/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /app/src/main/res/mipmap-hdpi/ic_launcher.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/qtfreet00/AntiFrida/HEAD/app/src/main/res/mipmap-hdpi/ic_launcher.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-mdpi/ic_launcher.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/qtfreet00/AntiFrida/HEAD/app/src/main/res/mipmap-mdpi/ic_launcher.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-xhdpi/ic_launcher.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/qtfreet00/AntiFrida/HEAD/app/src/main/res/mipmap-xhdpi/ic_launcher.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-xxhdpi/ic_launcher.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/qtfreet00/AntiFrida/HEAD/app/src/main/res/mipmap-xxhdpi/ic_launcher.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-xxxhdpi/ic_launcher.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/qtfreet00/AntiFrida/HEAD/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-hdpi/ic_launcher_round.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/qtfreet00/AntiFrida/HEAD/app/src/main/res/mipmap-hdpi/ic_launcher_round.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-mdpi/ic_launcher_round.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/qtfreet00/AntiFrida/HEAD/app/src/main/res/mipmap-mdpi/ic_launcher_round.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-xhdpi/ic_launcher_round.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/qtfreet00/AntiFrida/HEAD/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/qtfreet00/AntiFrida/HEAD/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/qtfreet00/AntiFrida/HEAD/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png -------------------------------------------------------------------------------- /.idea/vcs.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /app/src/main/res/values/colors.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | #008577 4 | #00574B 5 | #D81B60 6 | 7 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *.iml 2 | .gradle 3 | /local.properties 4 | /.idea/caches 5 | /.idea/libraries 6 | /.idea/modules.xml 7 | /.idea/workspace.xml 8 | /.idea/navEditor.xml 9 | /.idea/assetWizardSettings.xml 10 | .DS_Store 11 | /build 12 | /captures 13 | .externalNativeBuild 14 | .cxx 15 | -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | #Tue Sep 17 17:03:30 CST 2019 2 | distributionBase=GRADLE_USER_HOME 3 | distributionPath=wrapper/dists 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | distributionUrl=https\://services.gradle.org/distributions/gradle-5.4.1-all.zip 7 | -------------------------------------------------------------------------------- /app/src/main/cpp/__set_errno.cpp: -------------------------------------------------------------------------------- 1 | // 2 | // Created by qtfreet00 on 2019/6/19. 3 | // 4 | 5 | #include 6 | 7 | #define __LIBC_HIDDEN__ __attribute__((visibility("hidden"))) 8 | 9 | extern "C" __LIBC_HIDDEN__ long __carleen_set_errno(int n) { 10 | errno = n; 11 | return -1; 12 | } 13 | -------------------------------------------------------------------------------- /app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | -------------------------------------------------------------------------------- /app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | #### Frida检测 2 | 3 | 通过Frida内存特征对maps中elf文件进行扫描匹配特征，支持frida-gadget和frida-server 4 | 5 | 不使用frida文件名和端口进行扫描，该方式相对来说篡改比较方便， 6 | 7 | 在`https://github.com/b-mueller/frida-detection-demo`上进行了改进 8 | 9 | 上面项目仅支持frida-inject和端口扫描，frida可通过frida -l 修改远程端口bypass 10 | 11 | 新版实现可用性要高一些，测试Frida 12.7.3通过，原生不检测端口，修改端口无法bypass 12 | 13 | 编译需要在ndk 15及以上 14 | -------------------------------------------------------------------------------- /app/src/main/cpp/bionic_asm_arm.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #define __bionic_asm_align 0 4 | 5 | #undef __bionic_asm_custom_entry 6 | #undef __bionic_asm_custom_end 7 | #define __bionic_asm_custom_entry(f) .fnstart 8 | #define __bionic_asm_custom_end(f) .fnend 9 | 10 | #undef __bionic_asm_function_type 11 | #define __bionic_asm_function_type #function 12 | -------------------------------------------------------------------------------- /app/src/main/res/values/styles.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /app/src/test/java/com/qtfreet/antifrida/ExampleUnitTest.java: -------------------------------------------------------------------------------- 1 | package com.qtfreet.antifrida; 2 | 3 | import org.junit.Test; 4 | 5 | import static org.junit.Assert.*; 6 | 7 | /** 8 | * Example local unit test, which will execute on the development machine (host). 9 | * 10 | * @see Testing documentation 11 | */ 12 | public class ExampleUnitTest { 13 | @Test 14 | public void addition_isCorrect() { 15 | assertEquals(4, 2 + 2); 16 | } 17 | } -------------------------------------------------------------------------------- /.idea/misc.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 14 | -------------------------------------------------------------------------------- /.idea/runConfigurations.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 11 | 12 | -------------------------------------------------------------------------------- /.idea/gradle.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 15 | 16 | -------------------------------------------------------------------------------- /app/src/main/AndroidManifest.xml: -------------------------------------------------------------------------------- 1 | 2 | 4 | 5 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | -------------------------------------------------------------------------------- /app/proguard-rules.pro: -------------------------------------------------------------------------------- 1 | # Add project specific ProGuard rules here. 2 | # You can control the set of applied configuration files using the 3 | # proguardFiles setting in build.gradle. 4 | # 5 | # For more details, see 6 | # http://developer.android.com/guide/developing/tools/proguard.html 7 | 8 | # If your project uses WebView with JS, uncomment the following 9 | # and specify the fully qualified class name to the JavaScript interface 10 | # class: 11 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview { 12 | # public *; 13 | #} 14 | 15 | # Uncomment this to preserve the line number information for 16 | # debugging stack traces. 17 | #-keepattributes SourceFile,LineNumberTable 18 | 19 | # If you keep the line number information, uncomment this to 20 | # hide the original source file name. 21 | #-renamesourcefileattribute SourceFile 22 | -------------------------------------------------------------------------------- /app/src/main/java/com/qtfreet/antifrida/MainActivity.java: -------------------------------------------------------------------------------- 1 | package com.qtfreet.antifrida; 2 | 3 | import androidx.appcompat.app.AppCompatActivity; 4 | 5 | import android.os.Bundle; 6 | import android.widget.TextView; 7 | 8 | public class MainActivity extends AppCompatActivity { 9 | 10 | // Used to load the 'native-lib' library on application startup. 11 | static { 12 | System.loadLibrary("anti-frida"); 13 | } 14 | 15 | @Override 16 | protected void onCreate(Bundle savedInstanceState) { 17 | super.onCreate(savedInstanceState); 18 | setContentView(R.layout.activity_main); 19 | 20 | startCheck(); 21 | } 22 | 23 | /** 24 | * A native method that is implemented by the 'native-lib' native library, 25 | * which is packaged with this application. 26 | */ 27 | public native void startCheck(); 28 | } 29 | -------------------------------------------------------------------------------- /app/src/main/res/layout/activity_main.xml: -------------------------------------------------------------------------------- 1 | 2 | 8 | 9 | 18 | 19 | -------------------------------------------------------------------------------- /app/src/androidTest/java/com/qtfreet/antifrida/ExampleInstrumentedTest.java: -------------------------------------------------------------------------------- 1 | package com.qtfreet.antifrida; 2 | 3 | import android.content.Context; 4 | 5 | import androidx.test.platform.app.InstrumentationRegistry; 6 | import androidx.test.ext.junit.runners.AndroidJUnit4; 7 | 8 | import org.junit.Test; 9 | import org.junit.runner.RunWith; 10 | 11 | import static org.junit.Assert.*; 12 | 13 | /** 14 | * Instrumented test, which will execute on an Android device. 15 | * 16 | * @see Testing documentation 17 | */ 18 | @RunWith(AndroidJUnit4.class) 19 | public class ExampleInstrumentedTest { 20 | @Test 21 | public void useAppContext() { 22 | // Context of the app under test. 23 | Context appContext = InstrumentationRegistry.getInstrumentation().getTargetContext(); 24 | 25 | assertEquals("com.qtfreet.antifrida", appContext.getPackageName()); 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /gradle.properties: -------------------------------------------------------------------------------- 1 | # Project-wide Gradle settings. 2 | # IDE (e.g. Android Studio) users: 3 | # Gradle settings configured through the IDE *will override* 4 | # any settings specified in this file. 5 | # For more details on how to configure your build environment visit 6 | # http://www.gradle.org/docs/current/userguide/build_environment.html 7 | # Specifies the JVM arguments used for the daemon process. 8 | # The setting is particularly useful for tweaking memory settings. 9 | org.gradle.jvmargs=-Xmx1536m 10 | # When configured, Gradle will run in incubating parallel mode. 11 | # This option should only be used with decoupled projects. More details, visit 12 | # http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects 13 | # org.gradle.parallel=true 14 | # AndroidX package structure to make it clearer which packages are bundled with the 15 | # Android operating system, and which are packaged with your app's APK 16 | # https://developer.android.com/topic/libraries/support-library/androidx-rn 17 | android.useAndroidX=true 18 | # Automatically convert third-party libraries to use AndroidX 19 | android.enableJetifier=true 20 | 21 | -------------------------------------------------------------------------------- /app/src/main/cpp/syscall.S: -------------------------------------------------------------------------------- 1 | #include "bionic_asm.h" 2 | 3 | ENTRY_PRIVATE(wrap_openat) 4 | mov ip, r7 5 | .cfi_register r7, ip 6 | ldr r7, =__NR_openat 7 | swi #0 8 | mov r7, ip 9 | .cfi_restore r7 10 | cmn r0, #(CARLEEN_MAX_ERRNO + 1) 11 | bxls lr 12 | neg r0, r0 13 | b __carleen_set_errno 14 | END(wrap_openat) 15 | 16 | ENTRY_PRIVATE(wrap_read) 17 | mov ip, r7 18 | .cfi_register r7, ip 19 | ldr r7, =__NR_read 20 | swi #0 21 | mov r7, ip 22 | .cfi_restore r7 23 | cmn r0, #(CARLEEN_MAX_ERRNO + 1) 24 | bxls lr 25 | neg r0, r0 26 | b __carleen_set_errno 27 | END(wrap_read) 28 | 29 | ENTRY_PRIVATE(wrap_kill) 30 | mov ip, r7 31 | .cfi_register r7, ip 32 | ldr r7, =__NR_kill 33 | swi #0 34 | mov r7, ip 35 | .cfi_restore r7 36 | cmn r0, #(CARLEEN_MAX_ERRNO + 1) 37 | bxls lr 38 | neg r0, r0 39 | b __carleen_set_errno 40 | END(wrap_kill) 41 | 42 | 43 | ENTRY_PRIVATE(wrap_close) 44 | mov ip, r7 45 | .cfi_register r7, ip 46 | ldr r7, =__NR_close 47 | swi #0 48 | mov r7, ip 49 | .cfi_restore r7 50 | cmn r0, #(CARLEEN_MAX_ERRNO + 1) 51 | bxls lr 52 | neg r0, r0 53 | b __carleen_set_errno 54 | END(wrap_close) 55 | -------------------------------------------------------------------------------- /app/build.gradle: -------------------------------------------------------------------------------- 1 | apply plugin: 'com.android.application' 2 | 3 | android { 4 | compileSdkVersion 29 5 | buildToolsVersion "29.0.2" 6 | defaultConfig { 7 | applicationId "com.qtfreet.antifrida" 8 | minSdkVersion 17 9 | targetSdkVersion 29 10 | versionCode 1 11 | versionName "1.0" 12 | testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner" 13 | externalNativeBuild { 14 | cmake { 15 | cppFlags "-std=c++11 " 16 | } 17 | 18 | ndk { 19 | abiFilters "armeabi-v7a" 20 | } 21 | } 22 | } 23 | buildTypes { 24 | release { 25 | minifyEnabled false 26 | proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro' 27 | } 28 | } 29 | externalNativeBuild { 30 | cmake { 31 | path "src/main/cpp/CMakeLists.txt" 32 | version "3.10.2" 33 | } 34 | } 35 | } 36 | 37 | dependencies { 38 | implementation fileTree(dir: 'libs', include: ['*.jar']) 39 | implementation 'androidx.appcompat:appcompat:1.1.0' 40 | implementation 'androidx.constraintlayout:constraintlayout:1.1.3' 41 | testImplementation 'junit:junit:4.12' 42 | androidTestImplementation 'androidx.test:runner:1.2.0' 43 | androidTestImplementation 'androidx.test.espresso:espresso-core:3.2.0' 44 | } 45 | -------------------------------------------------------------------------------- /app/src/main/cpp/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | # For more information about using CMake with Android Studio, read the 2 | # documentation: https://d.android.com/studio/projects/add-native-code.html 3 | 4 | # Sets the minimum version of CMake required to build the native library. 5 | 6 | cmake_minimum_required(VERSION 3.4.1) 7 | 8 | set(can_use_assembler TRUE) 9 | enable_language(ASM) 10 | if (${ANDROID_ABI} STREQUAL "armeabi-v7a") 11 | set(SYSCALL syscall.S) 12 | endif () 13 | # Creates and names a library, sets it as either STATIC 14 | # or SHARED, and provides the relative paths to its source code. 15 | # You can define multiple libraries, and CMake builds them for you. 16 | # Gradle automatically packages shared libraries with your APK. 17 | 18 | add_library( # Sets the name of the library. 19 | anti-frida 20 | # Sets the library as a shared library. 21 | SHARED 22 | ${SYSCALL} 23 | __set_errno.cpp 24 | # Provides a relative path to your source file(s). 25 | detect.cpp) 26 | 27 | # Searches for a specified prebuilt library and stores the path as a 28 | # variable. Because CMake includes system libraries in the search path by 29 | # default, you only need to specify the name of the public NDK library 30 | # you want to add. CMake verifies that the library exists before 31 | # completing its build. 32 | 33 | find_library( # Sets the name of the path variable. 34 | log-lib 35 | 36 | # Specifies the name of the NDK library that 37 | # you want CMake to locate. 38 | log) 39 | 40 | # Specifies libraries CMake should link to your target library. You 41 | # can link multiple libraries, such as libraries you define in this 42 | # build script, prebuilt third-party libraries, or system libraries. 43 | 44 | target_link_libraries( # Specifies the target library. 45 | anti-frida 46 | 47 | # Links the target library to the log library 48 | # included in the NDK. 49 | ${log-lib}) -------------------------------------------------------------------------------- /app/src/main/res/drawable-v24/ic_launcher_foreground.xml: -------------------------------------------------------------------------------- 1 | 7 | 12 | 13 | 19 | 22 | 25 | 26 | 27 | 28 | 34 | 35 | -------------------------------------------------------------------------------- /gradlew.bat: -------------------------------------------------------------------------------- 1 | @if "%DEBUG%" == "" @echo off 2 | @rem ########################################################################## 3 | @rem 4 | @rem Gradle startup script for Windows 5 | @rem 6 | @rem ########################################################################## 7 | 8 | @rem Set local scope for the variables with windows NT shell 9 | if "%OS%"=="Windows_NT" setlocal 10 | 11 | set DIRNAME=%~dp0 12 | if "%DIRNAME%" == "" set DIRNAME=. 13 | set APP_BASE_NAME=%~n0 14 | set APP_HOME=%DIRNAME% 15 | 16 | @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. 17 | set DEFAULT_JVM_OPTS= 18 | 19 | @rem Find java.exe 20 | if defined JAVA_HOME goto findJavaFromJavaHome 21 | 22 | set JAVA_EXE=java.exe 23 | %JAVA_EXE% -version >NUL 2>&1 24 | if "%ERRORLEVEL%" == "0" goto init 25 | 26 | echo. 27 | echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 28 | echo. 29 | echo Please set the JAVA_HOME variable in your environment to match the 30 | echo location of your Java installation. 31 | 32 | goto fail 33 | 34 | :findJavaFromJavaHome 35 | set JAVA_HOME=%JAVA_HOME:"=% 36 | set JAVA_EXE=%JAVA_HOME%/bin/java.exe 37 | 38 | if exist "%JAVA_EXE%" goto init 39 | 40 | echo. 41 | echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 42 | echo. 43 | echo Please set the JAVA_HOME variable in your environment to match the 44 | echo location of your Java installation. 45 | 46 | goto fail 47 | 48 | :init 49 | @rem Get command-line arguments, handling Windows variants 50 | 51 | if not "%OS%" == "Windows_NT" goto win9xME_args 52 | 53 | :win9xME_args 54 | @rem Slurp the command line arguments. 55 | set CMD_LINE_ARGS= 56 | set _SKIP=2 57 | 58 | :win9xME_args_slurp 59 | if "x%~1" == "x" goto execute 60 | 61 | set CMD_LINE_ARGS=%* 62 | 63 | :execute 64 | @rem Setup the command line 65 | 66 | set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar 67 | 68 | @rem Execute Gradle 69 | "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS% 70 | 71 | :end 72 | @rem End local scope for the variables with windows NT shell 73 | if "%ERRORLEVEL%"=="0" goto mainEnd 74 | 75 | :fail 76 | rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of 77 | rem the _cmd.exe /c_ return code! 78 | if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 79 | exit /b 1 80 | 81 | :mainEnd 82 | if "%OS%"=="Windows_NT" endlocal 83 | 84 | :omega 85 | -------------------------------------------------------------------------------- /app/src/main/cpp/bionic_asm.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2013 The Android Open Source Project 3 | * All rights reserved. 4 | * 5 | * Redistribution and use in source and binary forms, with or without 6 | * modification, are permitted provided that the following conditions 7 | * are met: 8 | * * Redistributions of source code must retain the above copyright 9 | * notice, this list of conditions and the following disclaimer. 10 | * * Redistributions in binary form must reproduce the above copyright 11 | * notice, this list of conditions and the following disclaimer in 12 | * the documentation and/or other materials provided with the 13 | * distribution. 14 | * 15 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 | * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 | * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 | * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 | * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 | * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 | * SUCH DAMAGE. 27 | */ 28 | 29 | #ifndef _PRIVATE_BIONIC_ASM_H_ 30 | #define _PRIVATE_BIONIC_ASM_H_ 31 | 32 | #include /* For system call numbers. */ 33 | #define CARLEEN_MAX_ERRNO 4095 /* For recognizing system call error returns. */ 34 | 35 | #define __bionic_asm_custom_entry(f) 36 | #define __bionic_asm_custom_end(f) 37 | #define __bionic_asm_function_type @function 38 | 39 | //#include 40 | #include "bionic_asm_arm.h" 41 | 42 | #define ENTRY_NO_DWARF(f) \ 43 | .text; \ 44 | .globl f; \ 45 | .balign __bionic_asm_align; \ 46 | .type f, __bionic_asm_function_type; \ 47 | f: \ 48 | __bionic_asm_custom_entry(f); \ 49 | 50 | #define ENTRY(f) \ 51 | ENTRY_NO_DWARF(f) \ 52 | .cfi_startproc \ 53 | 54 | #define END_NO_DWARF(f) \ 55 | .size f, .-f; \ 56 | __bionic_asm_custom_end(f) \ 57 | 58 | #define END(f) \ 59 | .cfi_endproc; \ 60 | END_NO_DWARF(f) \ 61 | 62 | /* Like ENTRY, but with hidden visibility. */ 63 | #define ENTRY_PRIVATE(f) \ 64 | ENTRY(f); \ 65 | .hidden f \ 66 | 67 | /* Like ENTRY_NO_DWARF, but with hidden visibility. */ 68 | #define ENTRY_PRIVATE_NO_DWARF(f) \ 69 | ENTRY_NO_DWARF(f); \ 70 | .hidden f \ 71 | 72 | #define ALIAS_SYMBOL(alias, original) \ 73 | .globl alias; \ 74 | .equ alias, original 75 | 76 | 77 | #endif /* _PRIVATE_BIONIC_ASM_H_ */ 78 | 79 | -------------------------------------------------------------------------------- /.idea/codeStyles/Project.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 |
7 | 8 | 9 | 10 | xmlns:android 11 | 12 | ^$ 13 | 14 | 15 | 16 |
17 |
18 | 19 | 20 | 21 | xmlns:.* 22 | 23 | ^$ 24 | 25 | 26 | BY_NAME 27 | 28 |
29 |
30 | 31 | 32 | 33 | .*:id 34 | 35 | http://schemas.android.com/apk/res/android 36 | 37 | 38 | 39 |
40 |
41 | 42 | 43 | 44 | .*:name 45 | 46 | http://schemas.android.com/apk/res/android 47 | 48 | 49 | 50 |
51 |
52 | 53 | 54 | 55 | name 56 | 57 | ^$ 58 | 59 | 60 | 61 |
62 |
63 | 64 | 65 | 66 | style 67 | 68 | ^$ 69 | 70 | 71 | 72 |
73 |
74 | 75 | 76 | 77 | .* 78 | 79 | ^$ 80 | 81 | 82 | BY_NAME 83 | 84 |
85 |
86 | 87 | 88 | 89 | .* 90 | 91 | http://schemas.android.com/apk/res/android 92 | 93 | 94 | ANDROID_ATTRIBUTE_ORDER 95 | 96 |
97 |
98 | 99 | 100 | 101 | .* 102 | 103 | .* 104 | 105 | 106 | BY_NAME 107 | 108 |
109 | 110 | 111 | 112 | 113 | -------------------------------------------------------------------------------- /app/src/main/cpp/detect.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | 14 | extern "C" int wrap_openat(int, const char *, int, ...); 15 | 16 | extern "C" ssize_t wrap_read(int __fd, void *__buf, size_t __count); 17 | 18 | extern "C" int wrap_close(int __fd); 19 | 20 | extern "C" int wrap_kill(pid_t, int); 21 | 22 | #define BUFFER_LEN 512 23 | 24 | #define TAG "carleen" 25 | 26 | #define DEBUG 27 | 28 | #ifdef DEBUG 29 | #define LOGI(...) __android_log_print(ANDROID_LOG_INFO, TAG, __VA_ARGS__) 30 | #define LOGW(...) __android_log_print(ANDROID_LOG_WARN, TAG, __VA_ARGS__) 31 | #else 32 | #define LOGW(...) ((void)0) 33 | #define LOGI(...) ((void)0) 34 | #endif 35 | 36 | int 37 | wrap_memcmp(const unsigned char *s1, const unsigned char *s2, size_t n) { 38 | if (n != 0) { 39 | const unsigned char *p1 = s1; 40 | const unsigned char *p2 = s2; 41 | 42 | do { 43 | if (*p1++ != *p2++) 44 | return (*--p1 - *--p2); 45 | } while (--n != 0); 46 | } 47 | return (0); 48 | } 49 | 50 | 51 | int find_mem_string(long long base, long long end, unsigned char *ptr, unsigned int len) { 52 | 53 | unsigned char *rc = (unsigned char *) base; 54 | 55 | while ((long long) rc < end - len) { 56 | if (*rc == *ptr) { 57 | if (wrap_memcmp(rc, ptr, len) == 0) { 58 | return 1; 59 | } 60 | } 61 | 62 | rc++; 63 | 64 | } 65 | return 0; 66 | } 67 | 68 | int read_line(int fd, char *ptr, unsigned int maxlen) { 69 | int n; 70 | int rc; 71 | char c; 72 | 73 | for (n = 1; n < maxlen; n++) { 74 | if ((rc = wrap_read(fd, &c, 1)) == 1) { 75 | *ptr++ = c; 76 | if (c == '\n') 77 | break; 78 | } else if (rc == 0) { 79 | if (n == 1) 80 | return 0; /* EOF no data read */ 81 | else 82 | break; /* EOF, some data read */ 83 | } else 84 | return (-1); /* error */ 85 | } 86 | *ptr = 0; 87 | return (n); 88 | } 89 | 90 | int elf_check_header(uintptr_t base_addr) { 91 | ElfW(Ehdr) *ehdr = (ElfW(Ehdr) *) base_addr; 92 | if (0 != memcmp(ehdr->e_ident, ELFMAG, SELFMAG)) return 0; 93 | #if defined(__LP64__) 94 | if(ELFCLASS64 != ehdr->e_ident[EI_CLASS]) return 0; 95 | #else 96 | if (ELFCLASS32 != ehdr->e_ident[EI_CLASS]) return 0; 97 | #endif 98 | if (ELFDATA2LSB != ehdr->e_ident[EI_DATA]) return 0; 99 | if (EV_CURRENT != ehdr->e_ident[EI_VERSION]) return 0; 100 | if (ET_EXEC != ehdr->e_type && ET_DYN != ehdr->e_type) return 0; 101 | if (EV_CURRENT != ehdr->e_version) return 0; 102 | return 1; 103 | } 104 | 105 | int wrap_endsWith(const char *str, const char *suffix) { 106 | if (!str || !suffix) 107 | return 0; 108 | size_t lenA = strlen(str); 109 | size_t lenB = strlen(suffix); 110 | if (lenB > lenA) 111 | return 0; 112 | return strncmp(str + lenA - lenB, suffix, lenB) == 0; 113 | } 114 | 115 | 116 | void *check_loop(void *) { 117 | int fd; 118 | char path[256]; 119 | char perm[5]; 120 | unsigned long offset; 121 | unsigned int base; 122 | long end; 123 | char buffer[BUFFER_LEN]; 124 | int loop = 0; 125 | unsigned int length = 11; 126 | //"frida:rpc" 127 | unsigned char frida_rpc[] = 128 | { 129 | 130 | 0xfe, 0xba, 0xfb, 0x4a, 0x9a, 0xca, 0x7f, 0xfb, 131 | 0xdb, 0xea, 0xfe, 0xdc 132 | }; 133 | 134 | for (unsigned char &m : frida_rpc) { 135 | unsigned char c = m; 136 | c = ~c; 137 | c ^= 0xb1; 138 | c = (c >> 0x6) | (c << 0x2); 139 | c ^= 0x4a; 140 | c = (c >> 0x6) | (c << 0x2); 141 | m = c; 142 | } 143 | LOGI("start check frida loop"); 144 | while (loop < 10) { 145 | fd = wrap_openat(AT_FDCWD, "/proc/self/maps", O_RDONLY, 0); 146 | if (fd > 0) { 147 | while ((read_line(fd, buffer, BUFFER_LEN)) > 0) { 148 | 149 | if (sscanf(buffer, "%x-%lx %4s %lx %*s %*s %s", &base, &end, perm, &offset, path) != 150 | 5) { 151 | continue; 152 | } 153 | if (perm[0] != 'r') continue; 154 | if (perm[3] != 'p') continue; //do not touch the shared memory 155 | if (0 != offset) continue; 156 | if (strlen(path) == 0) continue; 157 | if ('[' == path[0]) continue; 158 | if (end - base <= 1000000) continue; 159 | if (wrap_endsWith(path, ".oat")) continue; 160 | if (elf_check_header(base) != 1) continue; 161 | if (find_mem_string(base, end, frida_rpc, length) == 1) { 162 | LOGI("frida found in memory!"); 163 | #ifndef DEBUG 164 | wrap_kill(wrap_getpid(),SIGKILL); 165 | #endif 166 | break; 167 | } 168 | } 169 | } else { 170 | LOGI("open maps error"); 171 | } 172 | wrap_close(fd); 173 | loop++; 174 | sleep(3); 175 | } 176 | return nullptr; 177 | } 178 | 179 | 180 | void anti_frida_loop() { 181 | pthread_t t; 182 | if (pthread_create(&t, nullptr, check_loop, (void *) nullptr) != 0) { 183 | exit(-1); 184 | }; 185 | pthread_detach(t); 186 | } 187 | 188 | 189 | extern "C" 190 | JNIEXPORT void JNICALL 191 | Java_com_qtfreet_antifrida_MainActivity_startCheck(JNIEnv *env, jobject thiz) { 192 | anti_frida_loop(); 193 | } -------------------------------------------------------------------------------- /gradlew: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env sh 2 | 3 | ############################################################################## 4 | ## 5 | ## Gradle start up script for UN*X 6 | ## 7 | ############################################################################## 8 | 9 | # Attempt to set APP_HOME 10 | # Resolve links: $0 may be a link 11 | PRG="$0" 12 | # Need this for relative symlinks. 13 | while [ -h "$PRG" ] ; do 14 | ls=`ls -ld "$PRG"` 15 | link=`expr "$ls" : '.*-> \(.*\)$'` 16 | if expr "$link" : '/.*' > /dev/null; then 17 | PRG="$link" 18 | else 19 | PRG=`dirname "$PRG"`"/$link" 20 | fi 21 | done 22 | SAVED="`pwd`" 23 | cd "`dirname \"$PRG\"`/" >/dev/null 24 | APP_HOME="`pwd -P`" 25 | cd "$SAVED" >/dev/null 26 | 27 | APP_NAME="Gradle" 28 | APP_BASE_NAME=`basename "$0"` 29 | 30 | # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. 31 | DEFAULT_JVM_OPTS="" 32 | 33 | # Use the maximum available, or set MAX_FD != -1 to use that value. 34 | MAX_FD="maximum" 35 | 36 | warn () { 37 | echo "$*" 38 | } 39 | 40 | die () { 41 | echo 42 | echo "$*" 43 | echo 44 | exit 1 45 | } 46 | 47 | # OS specific support (must be 'true' or 'false'). 48 | cygwin=false 49 | msys=false 50 | darwin=false 51 | nonstop=false 52 | case "`uname`" in 53 | CYGWIN* ) 54 | cygwin=true 55 | ;; 56 | Darwin* ) 57 | darwin=true 58 | ;; 59 | MINGW* ) 60 | msys=true 61 | ;; 62 | NONSTOP* ) 63 | nonstop=true 64 | ;; 65 | esac 66 | 67 | CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar 68 | 69 | # Determine the Java command to use to start the JVM. 70 | if [ -n "$JAVA_HOME" ] ; then 71 | if [ -x "$JAVA_HOME/jre/sh/java" ] ; then 72 | # IBM's JDK on AIX uses strange locations for the executables 73 | JAVACMD="$JAVA_HOME/jre/sh/java" 74 | else 75 | JAVACMD="$JAVA_HOME/bin/java" 76 | fi 77 | if [ ! -x "$JAVACMD" ] ; then 78 | die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME 79 | 80 | Please set the JAVA_HOME variable in your environment to match the 81 | location of your Java installation." 82 | fi 83 | else 84 | JAVACMD="java" 85 | which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 86 | 87 | Please set the JAVA_HOME variable in your environment to match the 88 | location of your Java installation." 89 | fi 90 | 91 | # Increase the maximum file descriptors if we can. 92 | if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then 93 | MAX_FD_LIMIT=`ulimit -H -n` 94 | if [ $? -eq 0 ] ; then 95 | if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then 96 | MAX_FD="$MAX_FD_LIMIT" 97 | fi 98 | ulimit -n $MAX_FD 99 | if [ $? -ne 0 ] ; then 100 | warn "Could not set maximum file descriptor limit: $MAX_FD" 101 | fi 102 | else 103 | warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT" 104 | fi 105 | fi 106 | 107 | # For Darwin, add options to specify how the application appears in the dock 108 | if $darwin; then 109 | GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\"" 110 | fi 111 | 112 | # For Cygwin, switch paths to Windows format before running java 113 | if $cygwin ; then 114 | APP_HOME=`cygpath --path --mixed "$APP_HOME"` 115 | CLASSPATH=`cygpath --path --mixed "$CLASSPATH"` 116 | JAVACMD=`cygpath --unix "$JAVACMD"` 117 | 118 | # We build the pattern for arguments to be converted via cygpath 119 | ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null` 120 | SEP="" 121 | for dir in $ROOTDIRSRAW ; do 122 | ROOTDIRS="$ROOTDIRS$SEP$dir" 123 | SEP="|" 124 | done 125 | OURCYGPATTERN="(^($ROOTDIRS))" 126 | # Add a user-defined pattern to the cygpath arguments 127 | if [ "$GRADLE_CYGPATTERN" != "" ] ; then 128 | OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)" 129 | fi 130 | # Now convert the arguments - kludge to limit ourselves to /bin/sh 131 | i=0 132 | for arg in "$@" ; do 133 | CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -` 134 | CHECK2=`echo "$arg"|egrep -c "^-"` ### Determine if an option 135 | 136 | if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then ### Added a condition 137 | eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"` 138 | else 139 | eval `echo args$i`="\"$arg\"" 140 | fi 141 | i=$((i+1)) 142 | done 143 | case $i in 144 | (0) set -- ;; 145 | (1) set -- "$args0" ;; 146 | (2) set -- "$args0" "$args1" ;; 147 | (3) set -- "$args0" "$args1" "$args2" ;; 148 | (4) set -- "$args0" "$args1" "$args2" "$args3" ;; 149 | (5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;; 150 | (6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;; 151 | (7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;; 152 | (8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;; 153 | (9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;; 154 | esac 155 | fi 156 | 157 | # Escape application args 158 | save () { 159 | for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done 160 | echo " " 161 | } 162 | APP_ARGS=$(save "$@") 163 | 164 | # Collect all arguments for the java command, following the shell quoting and substitution rules 165 | eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS" 166 | 167 | # by default we should be in the correct project dir, but when run from Finder on Mac, the cwd is wrong 168 | if [ "$(uname)" = "Darwin" ] && [ "$HOME" = "$PWD" ]; then 169 | cd "$(dirname "$0")" 170 | fi 171 | 172 | exec "$JAVACMD" "$@" 173 | -------------------------------------------------------------------------------- /app/src/main/res/drawable/ic_launcher_background.xml: -------------------------------------------------------------------------------- 1 | 2 | 7 | 10 | 15 | 20 | 25 | 30 | 35 | 40 | 45 | 50 | 55 | 60 | 65 | 70 | 75 | 80 | 85 | 90 | 95 | 100 | 105 | 110 | 115 | 120 | 125 | 130 | 135 | 140 | 145 | 150 | 155 | 160 | 165 | 170 | 171 | --------------------------------------------------------------------------------