├── .gitignore ├── README.md ├── app ├── .gitignore ├── build.gradle ├── proguard-rules.pro └── src │ ├── androidTest │ └── java │ │ └── com │ │ └── xxr0ss │ │ └── antifrida │ │ └── ExampleInstrumentedTest.kt │ ├── main │ ├── AndroidManifest.xml │ ├── cpp │ │ ├── CMakeLists.txt │ │ ├── antifrida.cpp │ │ ├── my_bionic_asm.h │ │ └── syscall.S │ ├── ic_launcher-playstore.png │ ├── java │ │ └── com │ │ │ └── xxr0ss │ │ │ └── antifrida │ │ │ ├── MainActivity.kt │ │ │ └── utils │ │ │ ├── AntiFridaUtil.kt │ │ │ └── SuperUser.kt │ └── res │ │ ├── drawable │ │ └── ic_launcher_foreground.xml │ │ ├── layout │ │ └── activity_main.xml │ │ ├── mipmap-anydpi-v26 │ │ ├── ic_launcher.xml │ │ └── ic_launcher_round.xml │ │ ├── values-night │ │ └── themes.xml │ │ └── values │ │ ├── arrays.xml │ │ ├── colors.xml │ │ ├── ic_launcher_background.xml │ │ ├── strings.xml │ │ └── themes.xml │ └── test │ └── java │ └── com │ └── xxr0ss │ └── antifrida │ └── ExampleUnitTest.kt ├── build.gradle ├── gradle.properties ├── gradle └── wrapper │ ├── gradle-wrapper.jar │ └── gradle-wrapper.properties ├── gradlew ├── gradlew.bat └── settings.gradle /.gitignore: -------------------------------------------------------------------------------- 1 | *.iml 2 | .gradle 3 | .idea 4 | /local.properties 5 | /.idea/caches 6 | /.idea/libraries 7 | /.idea/modules.xml 8 | /.idea/workspace.xml 9 | /.idea/navEditor.xml 10 | /.idea/assetWizardSettings.xml 11 | .DS_Store 12 | /build 13 | /captures 14 | .externalNativeBuild 15 | .cxx 16 | local.properties 17 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # AntiFrida 2 | 3 | ## 检查项 4 | 5 | * 默认端口 6 | * 进程列表 7 | * 进程内存模块列表 8 | * 进程内存模块存在Frida特征字符串 9 | * 进程处于被调试状态 -------------------------------------------------------------------------------- /app/.gitignore: -------------------------------------------------------------------------------- 1 | /build -------------------------------------------------------------------------------- /app/build.gradle: -------------------------------------------------------------------------------- 1 | plugins { 2 | id 'com.android.application' 3 | id 'org.jetbrains.kotlin.android' 4 | } 5 | 6 | android { 7 | compileSdk 33 8 | 9 | defaultConfig { 10 | applicationId "com.xxr0ss.antifrida" 11 | minSdk 29 12 | targetSdk 33 13 | versionCode 1 14 | versionName "1.0" 15 | 16 | testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner" 17 | externalNativeBuild { 18 | cmake { 19 | cppFlags '' 20 | } 21 | 22 | ndk { 23 | abiFilters 'arm64-v8a', 'armeabi-v7a', 'x86_64' 24 | } 25 | } 26 | } 27 | 28 | buildTypes { 29 | release { 30 | minifyEnabled false 31 | proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro' 32 | } 33 | } 34 | buildFeatures { 35 | viewBinding true 36 | } 37 | compileOptions { 38 | sourceCompatibility JavaVersion.VERSION_1_8 39 | targetCompatibility JavaVersion.VERSION_1_8 40 | } 41 | kotlinOptions { 42 | jvmTarget = '1.8' 43 | } 44 | externalNativeBuild { 45 | cmake { 46 | path file('src/main/cpp/CMakeLists.txt') 47 | } 48 | } 49 | namespace 'com.xxr0ss.antifrida' 50 | } 51 | 52 | dependencies { 53 | 54 | implementation 'androidx.core:core-ktx:1.10.0' 55 | implementation 'androidx.appcompat:appcompat:1.6.1' 56 | implementation 'com.google.android.material:material:1.8.0' 57 | implementation 'androidx.constraintlayout:constraintlayout:2.1.4' 58 | testImplementation 'junit:junit:4.13.2' 59 | androidTestImplementation 'androidx.test.ext:junit:1.1.5' 60 | androidTestImplementation 'androidx.test.espresso:espresso-core:3.5.1' 61 | } -------------------------------------------------------------------------------- /app/proguard-rules.pro: -------------------------------------------------------------------------------- 1 | # Add project specific ProGuard rules here. 2 | # You can control the set of applied configuration files using the 3 | # proguardFiles setting in build.gradle. 4 | # 5 | # For more details, see 6 | # http://developer.android.com/guide/developing/tools/proguard.html 7 | 8 | # If your project uses WebView with JS, uncomment the following 9 | # and specify the fully qualified class name to the JavaScript interface 10 | # class: 11 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview { 12 | # public *; 13 | #} 14 | 15 | # Uncomment this to preserve the line number information for 16 | # debugging stack traces. 17 | #-keepattributes SourceFile,LineNumberTable 18 | 19 | # If you keep the line number information, uncomment this to 20 | # hide the original source file name. 21 | #-renamesourcefileattribute SourceFile -------------------------------------------------------------------------------- /app/src/androidTest/java/com/xxr0ss/antifrida/ExampleInstrumentedTest.kt: -------------------------------------------------------------------------------- 1 | package com.xxr0ss.antifrida 2 | 3 | import androidx.test.platform.app.InstrumentationRegistry 4 | import androidx.test.ext.junit.runners.AndroidJUnit4 5 | 6 | import org.junit.Test 7 | import org.junit.runner.RunWith 8 | 9 | import org.junit.Assert.* 10 | 11 | /** 12 | * Instrumented test, which will execute on an Android device. 13 | * 14 | * See [testing documentation](http://d.android.com/tools/testing). 15 | */ 16 | @RunWith(AndroidJUnit4::class) 17 | class ExampleInstrumentedTest { 18 | @Test 19 | fun useAppContext() { 20 | // Context of the app under test. 21 | val appContext = InstrumentationRegistry.getInstrumentation().targetContext 22 | assertEquals("com.xxr0ss.antifrida", appContext.packageName) 23 | } 24 | } -------------------------------------------------------------------------------- /app/src/main/AndroidManifest.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 14 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | -------------------------------------------------------------------------------- /app/src/main/cpp/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | cmake_minimum_required(VERSION 3.18.1) 2 | 3 | project("antifrida") 4 | 5 | set(can_use_assembler TRUE) 6 | enable_language(ASM) 7 | 8 | add_library(antifrida SHARED syscall.S antifrida.cpp) 9 | 10 | find_library(log-lib log) 11 | 12 | target_link_libraries(antifrida ${log-lib}) 13 | -------------------------------------------------------------------------------- /app/src/main/cpp/antifrida.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | 17 | 18 | #define unused_param(x) (x) 19 | 20 | const char MAPS_FILE[] = "/proc/self/maps"; 21 | const char TAG[] = "JNI"; 22 | 23 | // customized syscalls 24 | extern "C" int my_read(int, void *, size_t); 25 | extern "C" int 26 | my_openat(int dirfd, const char *const __pass_object_size pathname, int flags, mode_t modes); 27 | extern "C" long my_ptrace(int __request, ...); 28 | 29 | // Our customized __set_errno_internal for syscall.S to use. 30 | // we do not use the one from libc due to issue https://github.com/android/ndk/issues/1422 31 | extern "C" long __set_errno_internal(int n) { 32 | errno = n; 33 | return -1; 34 | } 35 | 36 | extern "C" 37 | JNIEXPORT jboolean JNICALL 38 | Java_com_xxr0ss_antifrida_utils_AntiFridaUtil_checkFridaByPort(JNIEnv *env, jobject thiz, 39 | jint port) { 40 | unused_param(thiz); 41 | struct sockaddr_in sa{}; 42 | sa.sin_family = AF_INET; 43 | sa.sin_port = htons(port); 44 | inet_aton("127.0.0.1", &sa.sin_addr); 45 | int sock = socket(AF_INET, SOCK_STREAM, 0); 46 | 47 | if (connect(sock, (struct sockaddr *) &sa, sizeof(sa)) == 0) { 48 | // we can connect to frida-server when it's running 49 | close(sock); 50 | return JNI_TRUE; 51 | } 52 | 53 | return JNI_FALSE; 54 | } 55 | 56 | /* Read pseudo files in paths like /proc /sys 57 | * *buf_ptr can be existing dynamic memory or nullptr (if so, this function 58 | * will alloc memory automatically). 59 | * remember to free the *buf_ptr because in no cases will *buf_ptr be 60 | * freed inside this function 61 | * return -1 on error, or non-negative value on success 62 | * */ 63 | int read_pseudo_file_at(const char *path, char **buf_ptr, size_t *buf_size_ptr, 64 | bool use_customized_syscalls) { 65 | if (!path || !*path || !buf_ptr || !buf_size_ptr) { 66 | errno = EINVAL; 67 | return -1; 68 | } 69 | 70 | char *buf; 71 | size_t buf_size, total_read_size = 0; 72 | 73 | /* Existing dynamic buffer, or a new buffer? */ 74 | buf_size = *buf_size_ptr; 75 | if (!buf_size) 76 | *buf_ptr = nullptr; 77 | buf = *buf_ptr; 78 | 79 | /* Open pseudo file */ 80 | int fd = use_customized_syscalls 81 | ? my_openat(AT_FDCWD, path, O_RDONLY | O_CLOEXEC, 0) 82 | : openat(AT_FDCWD, path, O_RDONLY | O_CLOEXEC, 0); 83 | 84 | if (fd == -1) { 85 | __android_log_print(ANDROID_LOG_INFO, TAG, "openat error %s : %d", strerror(errno), errno); 86 | return -1; 87 | } 88 | 89 | while (true) { 90 | if (total_read_size >= buf_size) { 91 | /* linear size growth 92 | * buf_size grow ~4k bytes each time, 32 bytes for zero padding 93 | * */ 94 | buf_size = (total_read_size | 4095) + 4097 - 32; 95 | buf = (char *) realloc(buf, buf_size); 96 | if (!buf) { 97 | close(fd); 98 | errno = ENOMEM; 99 | return -1; 100 | } 101 | *buf_ptr = buf; 102 | *buf_size_ptr = buf_size; 103 | } 104 | 105 | ssize_t n = use_customized_syscalls 106 | ? my_read(fd, buf + total_read_size, buf_size - total_read_size) 107 | : read(fd, buf + total_read_size, buf_size - total_read_size); 108 | if (n > 0) { 109 | total_read_size += n; 110 | } else if (n == 0) { 111 | break; 112 | } else if (n == -1) { 113 | const int saved_errno = errno; 114 | close(fd); 115 | errno = saved_errno; 116 | return -1; 117 | } 118 | } 119 | 120 | if (close(fd) == -1) { 121 | /* errno set by close(). */ 122 | return -1; 123 | } 124 | 125 | if (total_read_size + 32 > buf_size) 126 | memset(buf + total_read_size, 0, 32); 127 | else 128 | memset(buf + total_read_size, 0, buf_size - total_read_size); 129 | 130 | errno = 0; 131 | return (int)total_read_size; 132 | } 133 | 134 | extern "C" 135 | JNIEXPORT jstring JNICALL 136 | Java_com_xxr0ss_antifrida_utils_AntiFridaUtil_nativeReadProcMaps(JNIEnv *env, jobject thiz, 137 | jboolean useCustomizedSyscall) { 138 | char *data = nullptr; 139 | size_t data_size = 0; 140 | 141 | int res = read_pseudo_file_at(MAPS_FILE, &data, &data_size, useCustomizedSyscall); 142 | if (res == -1) { 143 | __android_log_print(ANDROID_LOG_ERROR, TAG, 144 | "read_pseudo_file %s failed, errno %s: %d", 145 | MAPS_FILE, strerror(errno), errno); 146 | if (data) { 147 | free(data); 148 | } 149 | return nullptr; 150 | } else if (res == 0) { 151 | __android_log_print(ANDROID_LOG_INFO, TAG, "read_pseudo_file had read 0 bytes"); 152 | if (data) { 153 | free(data); 154 | } 155 | return nullptr; 156 | } 157 | jstring str = env->NewStringUTF(data); 158 | free(data); 159 | return str; 160 | } 161 | 162 | int read_line(int fd, char *ptr, unsigned int maxlen, jboolean use_customized_syscall) { 163 | int n; 164 | long rc; 165 | char c; 166 | 167 | for (n = 1; n < maxlen; n++) { 168 | rc = use_customized_syscall ? my_read(fd, &c, 1) : read(fd, &c, 1); 169 | if (rc == 1) { 170 | *ptr++ = c; 171 | if (c == '\n') 172 | break; 173 | } else if (rc == 0) { 174 | if (n == 1) 175 | return 0; /* EOF no data read */ 176 | else 177 | break; /* EOF, some data read */ 178 | } else 179 | return (-1); /* error */ 180 | } 181 | *ptr = 0; 182 | return (n); 183 | } 184 | 185 | int wrap_endsWith(const char *str, const char *suffix) { 186 | if (!str || !suffix) 187 | return 0; 188 | size_t lenA = strlen(str); 189 | size_t lenB = strlen(suffix); 190 | if (lenB > lenA) 191 | return 0; 192 | return strncmp(str + lenA - lenB, suffix, lenB) == 0; 193 | } 194 | 195 | int elf_check_header(uintptr_t base_addr) { 196 | auto *ehdr = (ElfW(Ehdr) *) base_addr; 197 | if (0 != memcmp(ehdr->e_ident, ELFMAG, SELFMAG)) return 0; 198 | #if defined(__LP64__) 199 | if (ELFCLASS64 != ehdr->e_ident[EI_CLASS]) return 0; 200 | #else 201 | if (ELFCLASS32 != ehdr->e_ident[EI_CLASS]) return 0; 202 | #endif 203 | if (ELFDATA2LSB != ehdr->e_ident[EI_DATA]) return 0; 204 | if (EV_CURRENT != ehdr->e_ident[EI_VERSION]) return 0; 205 | if (ET_EXEC != ehdr->e_type && ET_DYN != ehdr->e_type) return 0; 206 | if (EV_CURRENT != ehdr->e_version) return 0; 207 | return 1; 208 | } 209 | 210 | int find_mem_string(uint64_t base, uint64_t end, unsigned char *ptr, unsigned int len) { 211 | auto *rc = (unsigned char *) base; 212 | 213 | while ((uint64_t) rc < end - len) { 214 | if (*rc == *ptr) { 215 | if (memcmp(rc, ptr, len) == 0) { 216 | return 1; 217 | } 218 | } 219 | rc++; 220 | } 221 | return 0; 222 | } 223 | 224 | 225 | extern "C" 226 | JNIEXPORT jboolean JNICALL 227 | Java_com_xxr0ss_antifrida_utils_AntiFridaUtil_scanModulesForSignature(JNIEnv *env, jobject thiz, 228 | jstring signature, 229 | jboolean use_customized_syscalls) { 230 | int fd = use_customized_syscalls ? my_openat(AT_FDCWD, MAPS_FILE, O_RDONLY | O_CLOEXEC, 0) 231 | : openat(AT_FDCWD, MAPS_FILE, O_RDONLY | O_CLOEXEC, 0); 232 | if (fd == -1) { 233 | __android_log_print(ANDROID_LOG_INFO, TAG, "openat error %s : %d", strerror(errno), errno); 234 | return -1; 235 | } 236 | 237 | const int buf_size = 512; 238 | char buf[buf_size]; 239 | char path[256]; 240 | char perm[5]; 241 | const char *sig = env->GetStringUTFChars(signature, nullptr); 242 | size_t sig_len = strlen(sig); 243 | 244 | uint64_t base, end, offset; 245 | jboolean result = JNI_FALSE; 246 | 247 | while ((read_line(fd, buf, buf_size, use_customized_syscalls)) > 0) { 248 | if (sscanf(buf, "%lx-%lx %4s %lx %*s %*s %s", &base, &end, perm, &offset, path) != 5) { 249 | continue; 250 | } 251 | 252 | if (perm[0] != 'r') continue; 253 | if (perm[3] != 'p') continue; //do not touch the shared memory 254 | if (0 != offset) continue; 255 | if (strlen(path) == 0) continue; 256 | if ('[' == path[0]) continue; 257 | if (end - base <= 1000000) continue; 258 | if (wrap_endsWith(path, ".oat")) continue; 259 | if (elf_check_header(base) != 1) continue; 260 | 261 | if (find_mem_string(base, end, (unsigned char *) sig, sig_len) == 1) { 262 | __android_log_print(ANDROID_LOG_INFO, TAG, 263 | "frida signature \"%s\" found in %lx - %lx", sig, base, end); 264 | result = JNI_TRUE; 265 | break; 266 | } 267 | } 268 | 269 | return result; 270 | } 271 | 272 | extern "C" 273 | JNIEXPORT jboolean JNICALL 274 | Java_com_xxr0ss_antifrida_utils_AntiFridaUtil_checkBeingDebugged(JNIEnv *env, jobject thiz, 275 | jboolean use_customized_syscall) { 276 | 277 | long res = use_customized_syscall 278 | ? my_ptrace(PTRACE_TRACEME, 0) 279 | : ptrace(PTRACE_TRACEME, 0); 280 | return res < 0 ? JNI_TRUE : JNI_FALSE; 281 | } -------------------------------------------------------------------------------- /app/src/main/cpp/my_bionic_asm.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2013 The Android Open Source Project 3 | * All rights reserved. 4 | * 5 | * Redistribution and use in source and binary forms, with or without 6 | * modification, are permitted provided that the following conditions 7 | * are met: 8 | * * Redistributions of source code must retain the above copyright 9 | * notice, this list of conditions and the following disclaimer. 10 | * * Redistributions in binary form must reproduce the above copyright 11 | * notice, this list of conditions and the following disclaimer in 12 | * the documentation and/or other materials provided with the 13 | * distribution. 14 | * 15 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 | * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 | * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 | * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 | * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 | * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 | * SUCH DAMAGE. 27 | */ 28 | 29 | #pragma once 30 | 31 | // /* https://github.com/android/ndk/issues/1422 */ 32 | // #include 33 | 34 | #include /* For system call numbers. */ 35 | 36 | #define MAX_ERRNO 4095 /* For recognizing system call error returns. */ 37 | 38 | #define __bionic_asm_custom_entry(f) 39 | #define __bionic_asm_custom_end(f) 40 | #define __bionic_asm_function_type @function 41 | #define __bionic_asm_custom_note_gnu_section() 42 | 43 | /* Instead of including ""s, which are private in 44 | * AOSP and not available in Android NDK, we copy what we need in them and paste 45 | * them into the following architecture-specific defines. This makes our 46 | * "bionic_asm.h" a standalone header file. 47 | */ 48 | #if defined(__aarch64__) 49 | 50 | // #include 51 | // == NOTE: code here is copied from "bionic_asm_arm64.h" == 52 | #define __bionic_asm_align 16 53 | #undef __bionic_asm_function_type 54 | #define __bionic_asm_function_type %function 55 | // ========================================================= 56 | 57 | #elif defined(__arm__) 58 | 59 | // #include 60 | #define __bionic_asm_align 0 61 | #undef __bionic_asm_custom_entry 62 | #undef __bionic_asm_custom_end 63 | #define __bionic_asm_custom_entry(f) .fnstart 64 | #define __bionic_asm_custom_end(f) .fnend 65 | #undef __bionic_asm_function_type 66 | #define __bionic_asm_function_type #function 67 | 68 | #elif defined(__x86_64__) 69 | 70 | // #include 71 | #define __bionic_asm_align 16 72 | 73 | #endif 74 | 75 | 76 | #define ENTRY_NO_DWARF(f) \ 77 | .text; \ 78 | .globl f; \ 79 | .balign __bionic_asm_align; \ 80 | .type f, __bionic_asm_function_type; \ 81 | f: \ 82 | __bionic_asm_custom_entry(f); \ 83 | 84 | #define ENTRY(f) \ 85 | ENTRY_NO_DWARF(f) \ 86 | .cfi_startproc \ 87 | 88 | #define END_NO_DWARF(f) \ 89 | .size f, .-f; \ 90 | __bionic_asm_custom_end(f) \ 91 | 92 | #define END(f) \ 93 | .cfi_endproc; \ 94 | END_NO_DWARF(f) \ 95 | 96 | /* Like ENTRY, but with hidden visibility. */ 97 | #define ENTRY_PRIVATE(f) \ 98 | ENTRY(f); \ 99 | .hidden f \ 100 | 101 | /* Like ENTRY_NO_DWARF, but with hidden visibility. */ 102 | #define ENTRY_PRIVATE_NO_DWARF(f) \ 103 | ENTRY_NO_DWARF(f); \ 104 | .hidden f \ 105 | 106 | #define __BIONIC_WEAK_ASM_FOR_NATIVE_BRIDGE(f) \ 107 | .weak f; \ 108 | 109 | #define ALIAS_SYMBOL(alias, original) \ 110 | .globl alias; \ 111 | .equ alias, original 112 | 113 | #define NOTE_GNU_PROPERTY() \ 114 | __bionic_asm_custom_note_gnu_section() 115 | -------------------------------------------------------------------------------- /app/src/main/cpp/syscall.S: -------------------------------------------------------------------------------- 1 | #include "my_bionic_asm.h" 2 | 3 | #if defined(__aarch64__) 4 | 5 | ENTRY(my_read) 6 | mov x8, __NR_read 7 | svc #0 8 | cmn x0, #(MAX_ERRNO + 1) 9 | cneg x0, x0, hi 10 | b.hi __set_errno_internal 11 | ret 12 | END(my_read) 13 | 14 | ENTRY(my_openat) 15 | mov x8, __NR_openat 16 | svc #0 17 | cmn x0, #(MAX_ERRNO + 1) 18 | cneg x0, x0, hi 19 | b.hi __set_errno_internal 20 | ret 21 | END(my_openat) 22 | 23 | ENTRY(my_ptrace) 24 | mov x8, __NR_ptrace 25 | svc #0 26 | cmn x0, #(MAX_ERRNO + 1) 27 | cneg x0, x0, hi 28 | b.hi __set_errno_internal 29 | ret 30 | END(my_ptrace) 31 | # endif 32 | 33 | #if defined(__arm__) 34 | ENTRY(my_read) 35 | mov ip, sp 36 | stmfd sp!, {r4, r5, r6, r7} 37 | .cfi_def_cfa_offset 16 38 | .cfi_rel_offset r4, 0 39 | .cfi_rel_offset r5, 4 40 | .cfi_rel_offset r6, 8 41 | .cfi_rel_offset r7, 12 42 | ldmfd ip, {r4, r5, r6} 43 | ldr r7, =__NR_read 44 | swi #0 45 | ldmfd sp!, {r4, r5, r6, r7} 46 | .cfi_def_cfa_offset 0 47 | cmn r0, #(MAX_ERRNO + 1) 48 | bxls lr 49 | neg r0, r0 50 | b __set_errno_internal 51 | END(my_read) 52 | 53 | ENTRY(my_openat) 54 | mov ip, sp 55 | stmfd sp!, {r4, r5, r6, r7} 56 | .cfi_def_cfa_offset 16 57 | .cfi_rel_offset r4, 0 58 | .cfi_rel_offset r5, 4 59 | .cfi_rel_offset r6, 8 60 | .cfi_rel_offset r7, 12 61 | ldmfd ip, {r4, r5, r6} 62 | ldr r7, =__NR_openat 63 | swi #0 64 | ldmfd sp!, {r4, r5, r6, r7} 65 | .cfi_def_cfa_offset 0 66 | cmn r0, #(MAX_ERRNO + 1) 67 | bxls lr 68 | neg r0, r0 69 | b __set_errno_internal 70 | END(my_openat) 71 | 72 | ENTRY(my_ptrace) 73 | mov ip, r7 74 | mov ip, sp 75 | stmfd sp!, {r4, r5, r6, r7} 76 | .cfi_def_cfa_offset 16 77 | .cfi_rel_offset r4, 0 78 | .cfi_rel_offset r5, 4 79 | .cfi_rel_offset r6, 8 80 | .cfi_rel_offset r7, 12 81 | ldmfd ip, {r4, r5, r6} 82 | ldr r7, =__NR_ptrace 83 | swi #0 84 | ldmfd sp!, {r4, r5, r6, r7} 85 | .cfi_def_cfa_offset 0 86 | cmn r0, #(MAX_ERRNO + 1) 87 | bxls lr 88 | neg r0, r0 89 | b __set_errno_internal 90 | END(my_ptrace) 91 | #endif 92 | 93 | #if defined(__x86_64__) 94 | ENTRY(my_read) 95 | movl $__NR_read, %eax 96 | syscall 97 | cmpq $-MAX_ERRNO, %rax 98 | jb my_read_return 99 | negl %eax 100 | movl %eax, %edi 101 | call __set_errno_internal 102 | my_read_return: 103 | ret 104 | END(my_read) 105 | 106 | ENTRY(my_openat) 107 | movl $__NR_openat, %eax 108 | syscall 109 | cmpq $-MAX_ERRNO, %rax 110 | jb my_openat_return 111 | negl %eax 112 | movl %eax, %edi 113 | call __set_errno_internal 114 | my_openat_return: 115 | ret 116 | END(my_openat) 117 | 118 | ENTRY(my_ptrace) 119 | movl $__NR_ptrace, %eax 120 | syscall 121 | cmpq $-MAX_ERRNO, %rax 122 | jb my_ptrace_return 123 | negl %eax 124 | movl %eax, %edi 125 | call __set_errno_internal 126 | my_ptrace_return: 127 | ret 128 | END(my_ptrace) 129 | 130 | #endif -------------------------------------------------------------------------------- /app/src/main/ic_launcher-playstore.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xxr0ss/AntiFrida/375bf300850ce09eb3e4e80f80cbb7b9fe4cf4fa/app/src/main/ic_launcher-playstore.png -------------------------------------------------------------------------------- /app/src/main/java/com/xxr0ss/antifrida/MainActivity.kt: -------------------------------------------------------------------------------- 1 | package com.xxr0ss.antifrida 2 | 3 | import android.os.Bundle 4 | import android.util.Log 5 | import android.view.View 6 | import android.widget.AdapterView 7 | import android.widget.Toast 8 | import androidx.appcompat.app.AppCompatActivity 9 | import com.xxr0ss.antifrida.databinding.ActivityMainBinding 10 | import com.xxr0ss.antifrida.utils.AntiFridaUtil 11 | import com.xxr0ss.antifrida.utils.ReadVia 12 | import com.xxr0ss.antifrida.utils.SuperUser 13 | 14 | 15 | class MainActivity : AppCompatActivity() { 16 | private lateinit var binding: ActivityMainBinding 17 | 18 | private val TAG = "MainActivity" 19 | 20 | private var posReadVia: Int = 0 21 | 22 | // put possible frida module names here 23 | private val frida_module_blocklist = listOf("frida-agent", "frida-gadget") 24 | 25 | override fun onCreate(savedInstanceState: Bundle?) { 26 | super.onCreate(savedInstanceState) 27 | binding = ActivityMainBinding.inflate(layoutInflater) 28 | setContentView(binding.root) 29 | 30 | SuperUser.tryRoot(packageCodePath) 31 | binding.rootStatus.text = "rooted: ${SuperUser.rooted.toString()}" 32 | 33 | binding.spinnerVia.onItemSelectedListener = object : AdapterView.OnItemSelectedListener { 34 | override fun onItemSelected(parent: AdapterView<*>?, view: View?, pos: Int, id: Long) { 35 | posReadVia = pos 36 | Log.d(TAG, "onItemSelected: $pos $id") 37 | } 38 | 39 | override fun onNothingSelected(parent: AdapterView<*>?) { 40 | Log.d(TAG, "onNothingSelected: null") 41 | } 42 | } 43 | 44 | binding.btnCheckMaps.setOnClickListener { 45 | Toast.makeText( 46 | this, 47 | (if (AntiFridaUtil.checkFridaByProcMaps( 48 | frida_module_blocklist, 49 | ReadVia.fromInt(posReadVia) 50 | ) 51 | ) 52 | "frida module detected" else "No frida module detected") 53 | + " via ${ReadVia.fromInt(posReadVia).name}", 54 | Toast.LENGTH_SHORT 55 | ).show() 56 | binding.textStatus.editableText.clear() 57 | binding.textStatus.editableText.append( 58 | when (AntiFridaUtil.maps_file_content) { 59 | null -> "no maps file data" 60 | else -> "maps file:\n ${AntiFridaUtil.maps_file_content}" 61 | } 62 | ) 63 | } 64 | 65 | binding.btnCheckPort.setOnClickListener { 66 | Toast.makeText( 67 | this, if (AntiFridaUtil.checkFridaByPort(27042)) 68 | "frida default port 27042 detected" else "no frida default port detected", 69 | Toast.LENGTH_SHORT 70 | ).show() 71 | } 72 | 73 | binding.btnCheckProcesses.setOnClickListener { 74 | if (!SuperUser.rooted) { 75 | SuperUser.tryRoot(packageCodePath) 76 | if (!SuperUser.rooted) 77 | return@setOnClickListener 78 | } 79 | val result = SuperUser.execRootCmd("ps -ef") 80 | Log.i(TAG, "Root cmd result (size ${result.length}): $result ") 81 | binding.textStatus.text.clear() 82 | binding.textStatus.text.append(result) 83 | 84 | Toast.makeText( 85 | this, if (result.contains("frida-server")) 86 | "frida-server process detected" else "no frida-server process found", 87 | Toast.LENGTH_SHORT 88 | ).show() 89 | } 90 | 91 | binding.btnScanModules.setOnClickListener { 92 | val useMySyscalls = binding.switchUseMySyscalls.isChecked 93 | // not all signatures here exist in the latest frida modules 94 | // if you find any signature that works, just put it here 95 | val blockList = listOf("frida:rpc", "LIBFRIDA") 96 | var detected = false; 97 | blockList.forEach { 98 | detected = AntiFridaUtil.scanModulesForSignature(it, useMySyscalls) 99 | } 100 | 101 | Toast.makeText( 102 | this, if (detected) 103 | "frida signature found" else "no frida signature found", Toast.LENGTH_SHORT 104 | ).show() 105 | } 106 | 107 | binding.btnCheckBeingDebugged.setOnClickListener { 108 | val useMySyscalls = binding.switchUseMySyscalls.isChecked 109 | Toast.makeText( 110 | this, if (AntiFridaUtil.checkBeingDebugged(useMySyscalls)) 111 | "Being debugged" else "Not being debugged", Toast.LENGTH_SHORT 112 | ).show() 113 | } 114 | 115 | binding.btnCheckPmap.setOnClickListener { 116 | if (!SuperUser.rooted) { 117 | SuperUser.tryRoot(packageCodePath) 118 | if (!SuperUser.rooted) 119 | return@setOnClickListener 120 | } 121 | 122 | val result = SuperUser.execRootCmd("pmap ${android.os.Process.myPid()}") 123 | Log.i(TAG, "Root cmd result (size ${result.length}): $result ") 124 | binding.textStatus.text.clear() 125 | binding.textStatus.text.append(result) 126 | var moduleExists = false 127 | for (module in frida_module_blocklist) { 128 | if (result.contains(module)) { 129 | moduleExists = true 130 | } 131 | } 132 | 133 | Toast.makeText( 134 | this, if (moduleExists) 135 | "frida module detected" else "no frida module found", 136 | Toast.LENGTH_SHORT 137 | ).show() 138 | } 139 | } 140 | } -------------------------------------------------------------------------------- /app/src/main/java/com/xxr0ss/antifrida/utils/AntiFridaUtil.kt: -------------------------------------------------------------------------------- 1 | package com.xxr0ss.antifrida.utils 2 | 3 | import java.io.File 4 | import java.lang.Exception 5 | import android.util.Log 6 | 7 | 8 | object AntiFridaUtil { 9 | private var TAG: String = "AntiFridaUtil" 10 | 11 | var maps_file_content: String? = null 12 | 13 | fun checkFridaByProcMaps(targets: List, via: ReadVia): Boolean { 14 | maps_file_content = when (via) { 15 | ReadVia.JVM -> readProcMaps() 16 | ReadVia.ORIG_SYSCALL -> nativeReadProcMaps() 17 | ReadVia.CUSTOMIZED_SYSCALL -> nativeReadProcMaps(true) 18 | } 19 | 20 | if (maps_file_content == null) { 21 | Log.d(TAG, "maps got null") 22 | return false 23 | } 24 | 25 | Log.d(TAG, maps_file_content!!) 26 | for (target in targets) { 27 | if (target in maps_file_content!!) 28 | return true 29 | } 30 | return false 31 | } 32 | 33 | 34 | private fun readProcMaps(): String? { 35 | try { 36 | val mapsFile = File("/proc/self/maps") 37 | return mapsFile.readText() 38 | } catch (e: Exception) { 39 | Log.e(TAG, e.stackTraceToString()) 40 | } 41 | return null 42 | } 43 | 44 | private external fun nativeReadProcMaps(useCustomizedSyscall: Boolean = false): String? 45 | 46 | external fun checkFridaByPort(port: Int): Boolean 47 | 48 | external fun scanModulesForSignature( 49 | signature: String, 50 | useCustomizedSyscalls: Boolean = false 51 | ): Boolean 52 | 53 | external fun checkBeingDebugged(useCustomizedSyscall: Boolean=false): Boolean 54 | 55 | init { 56 | System.loadLibrary("antifrida") 57 | } 58 | } 59 | 60 | enum class ReadVia(val value: Int) { 61 | JVM(0), 62 | ORIG_SYSCALL(1), 63 | CUSTOMIZED_SYSCALL(2); 64 | 65 | companion object { 66 | fun fromInt(value: Int) = values().first { it.value == value } 67 | } 68 | } -------------------------------------------------------------------------------- /app/src/main/java/com/xxr0ss/antifrida/utils/SuperUser.kt: -------------------------------------------------------------------------------- 1 | package com.xxr0ss.antifrida.utils 2 | 3 | import android.util.Log 4 | import java.io.* 5 | 6 | object SuperUser { 7 | private val TAG: String = "SuperUser" 8 | var rooted = false 9 | 10 | fun tryRoot(pkgCodePath: String) { 11 | // try exec su and refresh `rooted` 12 | var process: Process? = null 13 | var dos: DataOutputStream? = null 14 | try { 15 | process = Runtime.getRuntime().exec("su") 16 | dos = DataOutputStream(process.outputStream) 17 | dos.writeBytes("chmod 777 ${pkgCodePath}\n") 18 | dos.writeBytes("exit\n") 19 | dos.flush() 20 | rooted = process.waitFor() == 0 21 | } catch (e: Exception) { 22 | rooted = false 23 | } finally { 24 | dos?.close() 25 | process?.destroy() 26 | } 27 | } 28 | 29 | fun execRootCmd(cmd: String): String { 30 | if (!rooted) return "" 31 | var out = "" 32 | try { 33 | val process = Runtime.getRuntime().exec("su") 34 | val stdin = DataOutputStream(process.outputStream) 35 | val stdout = process.inputStream 36 | val stderr = process.errorStream 37 | 38 | Log.i(TAG, "execRootCmd: $cmd") 39 | stdin.writeBytes(cmd + "\n") 40 | stdin.flush() 41 | stdin.writeBytes("exit\n") 42 | stdin.flush() 43 | stdin.close() 44 | 45 | var br = BufferedReader(InputStreamReader(stdout)) 46 | var line: String? 47 | 48 | while ((br.readLine().also { line = it }) != null) { 49 | out += line 50 | } 51 | br.close() 52 | br = BufferedReader(InputStreamReader(stderr)) 53 | while ((br.readLine().also { line = it }) != null) { 54 | out += line 55 | } 56 | br.close() 57 | }catch (e: Exception) { 58 | Log.e(TAG, e.stackTraceToString()) 59 | } 60 | return out 61 | } 62 | } -------------------------------------------------------------------------------- /app/src/main/res/drawable/ic_launcher_foreground.xml: -------------------------------------------------------------------------------- 1 | 6 | 10 | 13 | 14 | 15 | -------------------------------------------------------------------------------- /app/src/main/res/layout/activity_main.xml: -------------------------------------------------------------------------------- 1 | 2 | 8 | 9 | 10 | 16 | 17 | 22 | 23 | 31 | 32 | 36 | 37 | 40 | 41 |