新版梆梆检测绕过#

1
var so_name = "libDexHelper.so";
2
var inner_base = null;
3
var trace_started = false;
4
var found = false;
5
var mmap_listener = null;
6

7
/*
8
    @param print_stack: Whether printing stack info, default is false.
9
*/
10
var print_stack = false;
11

12
/*
13
    @param print_stack_mode
14
    - FUZZY: print as much stack info as possible
15
    - ACCURATE: print stack info as accurately as possible
16
    - MANUAL: if printing the stack info in an error and causes exit, use this option to manually print the address
17
*/
18
var print_stack_mode = "FUZZY";
19

20
function addr_in_so(addr){
21
    var process_Obj_Module_Arr = Process.enumerateModules();
22
    for(var i = 0; i < process_Obj_Module_Arr.length; i++) {
23
        if(addr>process_Obj_Module_Arr[i].base && addr<process_Obj_Module_Arr[i].base.add(process_Obj_Module_Arr[i].size)){
24
            console.log(addr.toString(16),"is in",process_Obj_Module_Arr[i].name,"offset: 0x"+(addr-process_Obj_Module_Arr[i].base).toString(16));
25
        }
26
    }
27
}
28

29
function hook_dlopen() {
30
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
31
        {
32
            onEnter: function (args) {
33
                var pathptr = args[0];
34
                if (pathptr !== undefined && pathptr != null) {
35
                    var path = ptr(pathptr).readCString();
36
                    //console.log(path);
37
                    if (path.indexOf(so_name) >= 0) {
38
                        this.is_can_hook = true;
39
                    }
40
                }
41
            },
42
            onLeave: function (retval) {
43
                if (this.is_can_hook && !trace_started) {
44
                    console.log("[+] mmap base   = " + inner_base);
45
                    console.log("[+] use mmap base = " + inner_base);
46

47
                    // note: you can do any thing before or after stalker trace so.
48
                    if (inner_base != null) {
49
                        if (mmap_listener != null) {
50
                            mmap_listener.detach();
51
                            mmap_listener = null;
52
                            console.log("[+] mmap hook detached");
53
                        }
54
                        trace_so();
55
                    }
56
                }
57
            }
58
        }
59
    );
60
}
61

62
function hook_mmap() {
63
    mmap_listener = Interceptor.attach(Module.findExportByName("libc.so", "mmap"), {
64
        onEnter: function (args) {
65
            this.len = args[1].toUInt32();
66
        },
67
        onLeave: function (retval) {
68
            if (found || retval.isNull()) return;
69

70
            if (this.len === 0x134000) {
71
                found = true;
72
                inner_base = ptr(retval.toString());
73
                console.log("[+] inner base = " + inner_base);
74
            }
75
        }
76
    });
77
}
78

79
function trace_so(){
80
    if (inner_base == null || trace_started) return;
81

82
    trace_started = true;
83
    var times = 1;
84
    var module_base = inner_base;
85
    var pid = Process.getCurrentThreadId();
86
    console.log("start Stalker!");
87
    Stalker.exclude({
88
        "base": Process.getModuleByName("libc.so").base,
89
        "size": Process.getModuleByName("libc.so").size
90
    })
91
    Stalker.follow(pid,{
92
        events:{
93
            call:false,
94
            ret:false,
95
            exec:false,
96
            block:false,
97
            compile:false
98
        },
99
        onReceive:function(events){
100
        },
101
        transform: function (iterator) {
102
            var instruction = iterator.next();
103
            do{
104
                var offset = instruction.address.sub(module_base).toUInt32();
105
                var index = func_addr.indexOf(offset);
106
                if (index !== -1) {
107
                    console.log("call" + times + ":" + func_name[index])
108
                    times = times + 1
109
                    if (print_stack) {
110
                        if (print_stack_mode === "FUZZY") {
111
                            iterator.putCallout((context) => {
112
                                console.log("backtrace:\n"+Thread.backtrace(context, Backtracer.FUZZY).map(DebugSymbol.fromAddress).join('\n'));
113
                                console.log('---------------------')
114
                            });
115
                        }
116
                        else if (print_stack_mode === "ACCURATE") {
117
                            iterator.putCallout((context) => {
118
                                console.log("backtrace:\n"+Thread.backtrace(context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n'));
119
                                console.log('---------------------')
120
                            })
121
                        }
122

123
                        else if (print_stack_mode === "MANUAL") {
124
                            iterator.putCallout((context) => {
125
                                console.log("backtrace:")
126
                                Thread.backtrace(context, Backtracer.FUZZY).map(addr_in_so);
127
                                console.log('---------------------')
128
                            })
129
                        }
130
                    }
131
                }
132
                iterator.keep();
133
            } while ((instruction = iterator.next()) !== null);
134
        },
135

136
        onCallSummary:function(summary){
137

138
        }
139
    });
140
    console.log("Stalker end!");
141
}
142

143
hook_mmap();
144
setImmediate(hook_dlopen,0);

1
function rep_sub1304C() {
2
    if (inner_base == null || sub1304c_replaced) return;
3

4
    var target = inner_base.add(0x1304c);
5
    console.log("[+] replacing sub_1304C @ " + target);
6

7
    Interceptor.replace(target, new NativeCallback(function (a0, a1, a2) {
8
        console.log(
9
            "[+] skip sub_1304C(flag=" + a0.toString() +
10
            ", code=0x" + a1.toString(16) +
11
            ", mask=0x" + a2.toString(16) + ")"
12
        );
13
        return 0;
14
    }, 'int64', ['int64', 'uint32', 'int']));
15

16
    sub1304c_replaced = true;
17
}

1
call188:sub_24F18
2
call189:.strcasecmp
3
call190:sub_105B8
4
call191:sub_FE78
5
call192:sub_40B04
6
call193:sub_3DBB4
7
call194:sub_3DF50
8
call195:sub_406E8
9
call196:sub_41838
10
call197:sub_408C4
11
Process terminated
12
[Pixel 6::com.moutai.mall ]->

1
var target_so = "libDexHelper.so";
2
var inner_base = null;
3
var found = false;
4
var patched = false;
5
var callbacks = [];
6
var mmap_listener = null;
7
var dlopen_listener = null;
8

9
function patchArm64MovX0Zero(addr, tag) {
10
    Memory.patchCode(addr, 4, function (code) {
11
        var writer = new Arm64Writer(code, { pc: addr });
12
        writer.putMovRegReg("x0", "xzr");
13
        writer.flush();
14
    });
15
    console.log("[+] patched " + tag + " @ " + addr + " (mov x0, xzr)");
16
}
17

18
function applyPatches() {
19
    if (patched || inner_base == null) return;
20

21
    var sub1304c = inner_base.add(0x1304c);
22
    var cb = new NativeCallback(function () {
23
        return 0;
24
    }, "int", []);
25

26
    callbacks.push(cb);
27
    Interceptor.replace(sub1304c, cb);
28
    console.log("[+] patched sub_1304C @ " + sub1304c);
29

30
    patchArm64MovX0Zero(inner_base.add(0x190a0), "kill syscall #1");
31
    patchArm64MovX0Zero(inner_base.add(0x19420), "kill syscall #2");
32

33
    patched = true;
34
}
35

36
mmap_listener = Interceptor.attach(Module.findExportByName("libc.so", "mmap"), {
37
    onEnter: function (args) {
38
        this.len = args[1].toUInt32();
39
    },
40
    onLeave: function (retval) {
41
        if (found || retval.isNull()) return;
42

43
        if (this.len === 0x134000) {
44
            found = true;
45
            inner_base = ptr(retval.toString());
46
            console.log("[+] inner base = " + inner_base);
47
            if (mmap_listener) {
48
                mmap_listener.detach();
49
                mmap_listener = null;
50
                console.log("[+] mmap hook detached");
51
            }
52
        }
53
    }
54
});
55

56
dlopen_listener = Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"), {
57
    onEnter: function (args) {
58
        this.fileName = args[0].isNull() ? "" : args[0].readCString();
59
    },
60
    onLeave: function (retval) {
61
        if (patched) return;
62

63
        if (this.fileName && this.fileName.indexOf(target_so) >= 0 && inner_base != null) {
64
            applyPatches();
65
            if (dlopen_listener) {
66
                dlopen_listener.detach();
67
                dlopen_listener = null;
68
                console.log("[+] dlopen hook detached");
69
            }
70
        }
71
    }
72
});

1
import os
2
import re
3

4
import idautils
5
import ida_bytes
6
import ida_funcs
7
import ida_kernwin
8
import ida_segment
9
import idc
10

11

12
TARGET_SYSCALLS = {
13
    93: "exit",
14
    94: "exit_group",
15
    129: "kill",
16
    130: "tkill",
17
    131: "tgkill",
18
}
19
BACKTRACK_LIMIT = 20
20
PATCH_FILE_NAME = "termination_patch_snippet.txt"
21

22

23
def log(msg=""):
24
    print(msg)
25

26

27
def is_exec_seg(seg):
28
    if seg is None:
29
        return False
30
    return bool(seg.perm & ida_segment.SEGPERM_EXEC)
31

32

33
def iter_exec_heads():
34
    for seg_ea in idautils.Segments():
35
        seg = ida_segment.getseg(seg_ea)
36
        if not is_exec_seg(seg):
37
            continue
38
        ea = seg.start_ea
39
        while ea < seg.end_ea:
40
            flags = ida_bytes.get_flags(ea)
41
            if ida_bytes.is_code(flags):
42
                yield ea
43
            ea = idc.next_head(ea, seg.end_ea)
44

45

46
def op_text(ea, n):
47
    text = idc.print_operand(ea, n)
48
    return text.strip() if text else ""
49

50

51
def mnem(ea):
52
    return idc.print_insn_mnem(ea).lower()
53

54

55
def normalize_reg(text):
56
    return text.lower().strip()
57

58

59
def is_x8_reg(text):
60
    reg = normalize_reg(text)
61
    return reg in ("x8", "w8")
62

63

64
def parse_imm_and_shift(text):
65
    """
66
    Parse operand text forms like:
67
      #0x81
68
      #0xb6a2,LSL#16
69
      #123
70
    Returns (imm, shift_bits).
71
    """
72
    t = text.lower().replace(" ", "")
73
    m = re.match(r"#(?P<imm>-?(?:0x[0-9a-f]+|\d+))(?:,lsl#(?P<shift>\d+))?$", t)
74
    if not m:
75
        return None
76
    imm = int(m.group("imm"), 0)
77
    shift = int(m.group("shift") or 0)
78
    return imm, shift
79

80

81
def writes_x8(ea):
82
    return is_x8_reg(op_text(ea, 0))
83

84

85
def decode_syscall_from_backtrack(svc_ea, limit=BACKTRACK_LIMIT):
86
    """
87
    Heuristically reconstruct x8 value by scanning backwards.
88

89
    Supports common forms:
90
      MOV   X8, #imm
91
      MOVZ  X8, #imm[, LSL#n]
92
      MOVK  X8, #imm[, LSL#n]
93
      ORR   X8, XZR, #imm
94

95
    Returns:
96
      {
97
        "sysno": int or None,
98
        "writer_eas": [ea...],  # instructions contributing to x8
99
      }
100
    """
101
    func = ida_funcs.get_func(svc_ea)
102
    if not func:
103
        return {"sysno": None, "writer_eas": []}
104

105
    cur = idc.prev_head(svc_ea, func.start_ea)
106
    seen = 0
107
    pieces = []
108
    writer_eas = []
109

110
    while cur != idc.BADADDR and cur >= func.start_ea and seen < limit:
111
        seen += 1
112
        insn_mnem = mnem(cur)
113

114
        if writes_x8(cur):
115
            writer_eas.append(cur)
116

117
            if insn_mnem in ("mov", "movz"):
118
                parsed = parse_imm_and_shift(op_text(cur, 1))
119
                if parsed is None:
120
                    return {"sysno": None, "writer_eas": writer_eas}
121
                imm, shift = parsed
122
                value = imm << shift
123
                for part_shift, part_imm in pieces:
124
                    mask = 0xFFFF << part_shift
125
                    value = (value & ~mask) | ((part_imm & 0xFFFF) << part_shift)
126
                return {"sysno": value, "writer_eas": writer_eas}
127

128
            if insn_mnem == "movk":
129
                parsed = parse_imm_and_shift(op_text(cur, 1))
130
                if parsed is None:
131
                    return {"sysno": None, "writer_eas": writer_eas}
132
                imm, shift = parsed
133
                pieces.append((shift, imm))
134
                cur = idc.prev_head(cur, func.start_ea)
135
                continue
136

137
            if insn_mnem == "orr":
138
                src1 = normalize_reg(op_text(cur, 1))
139
                parsed = parse_imm_and_shift(op_text(cur, 2))
140
                if src1 == "xzr" and parsed is not None:
141
                    imm, shift = parsed
142
                    value = imm << shift
143
                    return {"sysno": value, "writer_eas": writer_eas}
144
                return {"sysno": None, "writer_eas": writer_eas}
145

146
            return {"sysno": None, "writer_eas": writer_eas}
147

148
        cur = idc.prev_head(cur, func.start_ea)
149

150
    return {"sysno": None, "writer_eas": writer_eas}
151

152

153
def nearby_insns(ea, before=10, after=2):
154
    items = []
155
    cur = ea
156
    for _ in range(before):
157
        cur = idc.prev_head(cur, idc.get_segm_start(cur))
158
        if cur == idc.BADADDR:
159
            break
160
    count = before + after + 1
161
    while cur != idc.BADADDR and count > 0:
162
        items.append((cur, idc.GetDisasm(cur)))
163
        nxt = idc.next_head(cur, idc.get_segm_end(cur))
164
        if nxt == idc.BADADDR or nxt == cur:
165
            break
166
        cur = nxt
167
        count -= 1
168
    return items
169

170

171
def make_patch_lines(matches):
172
    lines = []
173
    lines.append("// auto-generated by search_kill.py")
174
    lines.append("function patchArm64MovX0Zero(addr, tag) {")
175
    lines.append("    Memory.patchCode(addr, 4, function (code) {")
176
    lines.append("        var writer = new Arm64Writer(code, { pc: addr });")
177
    lines.append('        writer.putMovRegReg("x0", "xzr");')
178
    lines.append("        writer.flush();")
179
    lines.append("    });")
180
    lines.append('    console.log("[+] patched " + tag + " @ " + addr + " (mov x0, xzr)");')
181
    lines.append("}")
182
    lines.append("")
183
    for idx, item in enumerate(matches, 1):
184
        tag = "%s syscall(%d) #%d @ 0x%x" % (
185
            item["sys_name"],
186
            item["sysno"],
187
            idx,
188
            item["svc_ea"],
189
        )
190
        lines.append("// %s (%d)" % (item["sys_name"], item["sysno"]))
191
        lines.append('patchArm64MovX0Zero(inner_base.add(0x%x), "%s");' % (item["svc_ea"], tag))
192
    return "\n".join(lines)
193

194

195
def write_snippet_file(text):
196
    out_dir = os.path.dirname(idc.get_idb_path()) or os.getcwd()
197
    out_path = os.path.join(out_dir, PATCH_FILE_NAME)
198
    try:
199
        with open(out_path, "w", encoding="utf-8") as fp:
200
            fp.write(text)
201
        return out_path
202
    except Exception as exc:
203
        log("[!] failed to write snippet file: %s" % exc)
204
        return None
205

206

207
def main():
208
    matches = []
209

210
    for ea in iter_exec_heads():
211
        if mnem(ea) != "svc":
212
            continue
213

214
        info = decode_syscall_from_backtrack(ea)
215
        if info["sysno"] not in TARGET_SYSCALLS:
216
            continue
217

218
        func = ida_funcs.get_func(ea)
219
        func_name = idc.get_func_name(ea) if func else "<no_func>"
220

221
        matches.append({
222
            "svc_ea": ea,
223
            "func_start": func.start_ea if func else idc.BADADDR,
224
            "func_name": func_name,
225
            "writer_eas": list(reversed(info["writer_eas"])),
226
            "sysno": info["sysno"],
227
            "sys_name": TARGET_SYSCALLS[info["sysno"]],
228
            "nearby": nearby_insns(ea),
229
        })
230

231
    if not matches:
232
        msg = "[*] no target termination syscall svc sites found"
233
        log(msg)
234
        ida_kernwin.info(msg)
235
        return
236

237
    matches.sort(key=lambda x: (x["sysno"], x["svc_ea"]))
238

239
    log("[*] found %d target termination syscall site(s)" % len(matches))
240
    log("")
241

242
    for idx, item in enumerate(matches, 1):
243
        log("=" * 72)
244
        log("[%d] svc @ 0x%x  func=%s @ 0x%x  %s (sysno=%d / 0x%x)" % (
245
            idx,
246
            item["svc_ea"],
247
            item["func_name"],
248
            item["func_start"],
249
            item["sys_name"],
250
            item["sysno"],
251
            item["sysno"],
252
        ))
253
        if item["writer_eas"]:
254
            log("    x8 writers:")
255
            for w in item["writer_eas"]:
256
                log("      0x%x  %s" % (w, idc.GetDisasm(w)))
257
        else:
258
            log("    x8 writers: <unresolved>")
259
        log("    nearby:")
260
        for ea, text in item["nearby"]:
261
            mark = ">>" if ea == item["svc_ea"] else "  "
262
            log("    %s 0x%x  %s" % (mark, ea, text))
263
        log("")
264

265
    snippet = make_patch_lines(matches)
266
    out_path = write_snippet_file(snippet)
267

268
    log("=" * 72)
269
    log("[*] bypass.js snippet:")
270
    log(snippet)
271
    log("")
272
    if out_path:
273
        log("[*] snippet saved to: %s" % out_path)
274

275
    ida_kernwin.info("search_kill.py finished, found %d target termination svc site(s)" % len(matches))
276

277

278
if __name__ == "__main__":
279
    main()