分析 app 的过程中，需要用 frida hook 的话一般就需要对抗 frida
检测，这里以一个经典的 so 来学习一下 frida 检测的绕过
样本是豆瓣，本篇文章使用的 frida 版本: 17.7.3
hook dlopen
hook 它的 dlopen 看一下 so 的加载流程，定位检测的 so
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 function hk_dlopen (void {console .log ("[*] Hook dlopen" );const ignoreLibs = new Set <string >(["libaudioclientimpl.so" ,"libmigui.so" ,"libkoom-monitor.so" ,"libhprof.so" const jniCache : Record <string , NativePointer | null > = {};function shouldIgnore (libName : string boolean {if (!libName) return false ;for (const k of ignoreLibs) {if (libName.indexOf (k) !== -1 ) return true ;return false ;function installHook (symbol : "dlopen" | "android_dlopen_ext" void {let target : NativePointer ;try {Module .getGlobalExportByName (symbol );catch (_e) {console .log (`[-] ${symbol } not found` );return ;Interceptor .attach (target, {onEnter (args : NativePointer []const libName = args[0 ].isNull () ? "" : args[0 ].readUtf8String () || "" ;const flags = args[1 ].toInt32 ();this as any ).libName = libName;this as any ).ignore = shouldIgnore (libName);if (!(this as any ).ignore ) {console .log (`[*] ${symbol } called with: ${libName} (flags: 0x${flags.toString(16 )} )` );onLeave (retval : NativePointer if ((this as any ).ignore ) return ;const libName : string = (this as any ).libName || "" ;if (retval.isNull ()) {console .log (`[-] Failed to load: ${libName} ` );return ;console .log (`[+] Successfully loaded: ${libName} ` );console .log (`[+] ${symbol } hook installed` );installHook ("dlopen" );installHook ("android_dlopen_ext" );hk_dlopen ();
1 2 frida-compile hook_dlopen.ts -o hook_dlopen.js
输出 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Spawning `com.douban .frodo`...[*] Hook dlopen[+] dlopen hook installed[+] android_dlopen_ext hook installed.douban .frodo`. Resuming main thread![*] android_dlopen_ext called with: libframework-connectivity-tiramisu-jni.so (flags: 0 x2)[Pixel 6::com.douban.frodo ] -> [+] Successfully loaded: libframework-connectivity-tiramisu-jni.so [*] android_dlopen_ext called with: /data/app/~~Cf51eG3ZHEZ1OKV2HLZsZg==/com.douban .frodo-ulsR97QYcr8aOckQpu-AYQ==/oat/arm64/base.odex (flags: 0 x2)[+] Successfully loaded: /data/app/~~Cf51eG3ZHEZ1OKV2HLZsZg==/com.douban .frodo-ulsR97QYcr8aOckQpu-AYQ==/oat/arm64/base.odex [*] android_dlopen_ext called with: /data/app/~~Cf51eG3ZHEZ1OKV2HLZsZg==/com.douban .frodo-ulsR97QYcr8aOckQpu-AYQ==/lib/arm64/libmsaoaidsec.so (flags: 0 x2)[*] dlopen called with: libc.so (flags: 0 x2)[+] Successfully loaded: libc.so [*] dlopen called with: libc.so (flags: 0 x2)[+] Successfully loaded: libc.so
hook pthread_create
看到 libmsaoaidsec.so,hook pthread_create
看看它的线程创建流程
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 function hook_pthread_create (void {console .log ("[*] Hooking pthread_create..." );const libc = Process .getModuleByName ("libc.so" );const pthread_create = libc.getExportByName ("pthread_create" );const libcAddr = libc.base ;console .log ("[*] libc base address: " + libcAddr);Interceptor .attach (pthread_create, {onEnter : function (args ) {let func_addr = args[2 ];let secmod = Process .findModuleByName ("libmsaoaidsec.so" );if (!secmod) {return ;let secmodAddr = secmod.base ;let secmodSize = secmod.size ;let secmodEnd = secmodAddr.add (secmodSize);if (func_addr.compare (secmodAddr) >= 0 && func_addr.compare (secmodEnd) < 0 ) {console .log ("-----------------------------------------" );console .log ("[*] Target pthread_create intercepted!" );console .log ("[*] libmsaoaidsec.so base: " + secmodAddr);console .log ("[*] func_addr: " + func_addr);console .log ("[*] func_offset: 0x" + func_addr.sub (secmodAddr).toString (16 ));setImmediate (hook_pthread_create);
输出 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 Spawning `com.douban .frodo`...[*] Hooking pthread_create...[*] libc base address : 0 x7a8a6cc000.douban .frodo`. Resuming main thread![Pixel 6::com.douban.frodo ] -> -----------------------------------------[*] Target pthread_create intercepted![*] libmsaoaidsec.so base: 0 x76b7842000[*] func_addr: 0 x76b785e544[*] func_offset: 0 x1c544[*] Target pthread_create intercepted![*] libmsaoaidsec.so base: 0 x76b7842000[*] func_addr: 0 x76b785d8d4[*] func_offset: 0 x1b8d4[*] Target pthread_create intercepted![*] libmsaoaidsec.so base: 0 x76b7842000[*] func_addr: 0 x76b7868e5c[*] func_offset: 0 x26e5c[Pixel 6::com.douban.frodo ] ->
可以看到它创建了三个线程，分别位于 libmsaoaidsec.so 的
0x1c544, 0x1b8d4, 0x26e5c
这三个偏移地址上
先尝试直接让它们的线程函数返回 0
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 function anti (void {const libc = Process .getModuleByName ("libc.so" );const pthread_create = libc.getExportByName ("pthread_create" );if (!pthread_create){console .log ("[-] pthread_create not found in libc.so" );return ;let pthread_create_native = new NativeFunction (pthread_create, 'int' , ['pointer' , 'pointer' , 'pointer' , 'pointer' ]);Interceptor .replace (pthread_create, new NativeCallback (function (thread : NativePointer , attr : NativePointer , start_routine : NativePointer , arg : NativePointer let module = Process .findModuleByAddress (start_routine);let moduleName = module ? module .name : "unknown" ;let offset = module ? start_routine.sub (module .base ).toString (16 ) : "unknown offset" ;if (moduleName.indexOf ("libmsaoaidsec.so" ) !== -1 ){console .log ("kill thread at offset 0x" + offset + " in " + moduleName);return 0 ;return pthread_create_native (thread, attr, start_routine, arg);'int' , ['pointer' , 'pointer' , 'pointer' , 'pointer' ]));setImmediate (anti);
但是这么做并不能绕过
thread at offset 0x1c544 in libmsaoaidsec.so 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 kill thread at offset 0x1b8d4 in libmsaoaidsec.so
进一步分析
主要可能有两个问题，一是 pthread_create 的第一个参数
pthread_t *thread 没有被赋值，正常的
pthread_create 执行成功后会将新线程的句柄写入这个指针；二是
libmsaoaidsec.so 在初始化时，会扫描内存检查
libc.so 中的 pthread_create
函数头是否被修改，而 Interceptor.replace
会在函数头写入一条跳转指令即
Trampoline，这会被检测到并认为是被篡改了，所以直接崩溃了
所以现在只能换种方式，推测检测逻辑在 libmsaoaidsec.so 的
.init 函数里
so 的加载
so 的加载流程大致是这样的：
graph TD
%% 全局样式
classDef default fill:#f9f9f9,stroke:#333,stroke-width:1px;
classDef highlight fill:#e1f5fe,stroke:#01579b,stroke-width:2px;
classDef core fill:#fff3e0,stroke:#e65100,stroke-width:2px;
%% 第一阶段：Java 层逻辑
subgraph Phase1 [Phase 1: Java Framework]
A1[System.loadLibrary libname] --> A2[Runtime.loadLibrary0]
A2 --> A3{ClassLoader 类型?}
A3 -- PathClassLoader --> A4[DexPathList.findLibrary]
A4 --> A5["搜索 /data/app/.../lib/arm64/"]
A5 --> A6[获取绝对路径: /path/to/libtest.so]
end
%% 第二阶段：ART 运行时与命名空间
subgraph Phase2 [Phase 2: ART Runtime]
A6 --> B1["Runtime.nativeLoad(path, loader)"]
B1 --> B2["JavaVMExt::LoadNativeLibrary (art/runtime)"]
B2 --> B3["NativeLoader (libnativeloader.so)"]
B3 --> B4["Find or Create LinkerNamespace"]
B4 -- "关联 ClassLoader" --> B5["生成 android_dlextinfo (含 namespace)"]
end
%% 第三阶段：Bionic Linker 内核逻辑 (核心)
subgraph Phase3 [Phase 3: Bionic Linker]
B5 --> C1["android_dlopen_ext (linker/linker.cpp)"]
C1 --> C2["find_library (查找 soinfo)"]
C2 --> C3["ElfReader::Load (解析 ELF Header)"]
%% 内存布局
C3 --> C4["mmap PT_LOAD Segments (预留地址空间)"]
C4 --> C5["mmap .text / .data (物理映射)"]
%% 依赖处理
C5 --> C6["BFS: 广度优先解析 DT_NEEDED (依赖库)"]
C6 -- "递归加载" --> C1
%% 符号与重定位
C6 --> C7["Symbol Lookup (遍历符号表 .dynsym)"]
C7 --> C8["Relocation (修正 GOT/PLT 地址)"]
C8 --> C9["protect_relro (内存只读保护)"]
end
%% 第四阶段：初始化与 JNI 握手
subgraph Phase4 [Phase 4: Initialization]
C9 --> D1["call_constructors (linker.cpp)"]
D1 --> D2["DT_INIT (_init 函数)"]
D2 --> D3["DT_INIT_ARRAY (C++ 全局构造函数)"]
D3 -- "返回 handle" --> D4["SharedLibrary::FindSymbol(JNI_OnLoad)"]
D4 --> D5{存在 JNI_OnLoad?}
D5 -- Yes --> D6["执行 JNI_OnLoad (动态注册)"]
D5 -- No --> D7["等待 Java 层调用 (静态匹配)"]
end
%% 关键数据结构标注
class A6,B5,C2,D4 highlight;
class C3,C4,C5 core;
init 函数
因为检测逻辑很有可能在初始化函数阶段，所以选择在
android_dlopen_ext 的 onEnter 阶段 hook
.init 函数
由于 so 没有加载完全，无法 hook 导出函数或者通过基地址＋偏移的方式
hook，所以就通过在 .init 函数里找一个导入函数进行 hook
反编译 libmsaoaidsec.so,找到了它的
.init_proc 函数
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 void init_proc () const char *v0; __pid_t v2; unsigned __int64 StatusReg; unsigned __int64 *v4; int v6; int v7; unsigned __int64 *v8; char *v10; char v12[2000 ]; 3 , 3 , 13 , 0 , 2 ));40 );250 ;if ( *off_47FB8 > 23 )1 ;if ( (sub_25A48() & 1 ) == 0 )memset (v10, 0 , 0x7D0u LL);0LL , 2000LL , "/proc/%d/cmdline" , v2);"r" );if ( v11 )memset (v4, 0 , 0x7D0u LL);const char *)v4;fscanf (v11, "%s" , v4);if ( !strchr (v0, 58 ) )if ( v6 != 1 || (v7 = sub_95C8()) != 0 )sub_123F0 () 2 ]; 1 ] = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3 , 3 , 13 , 0 , 2 )) + 40 );0 ] = 0LL ;"ro.build.version.sdk" , v1);return atoi((const char *)v1);char *sub_12550 () char *result; char haystack[16 ]; int v7; 3 , 3 , 13 , 0 , 2 )) + 40 );0 ;0LL ;0u ;0u ;0u ;0u ;0u ;if ( !(unsigned int )_system_property_get("persist.sys.dalvik.vm.lib" , haystack) || *off_47FB8 >= 21 )"persist.sys.dalvik.vm.lib.2" , haystack);strstr (haystack, "art" );if ( result )0 ] = 1 ;return result;char *sub_12440 () char *result; int *v1; char s[16 ]; int v8; 3 , 3 , 13 , 0 , 2 )) + 40 );0 ;0LL ;0u ;0u ;0u ;0u ;0u ;"ro.build.version.release_or_codename" , s);strchr (s, 83 );if ( result || (result = strstr (s, "12" )) != 0LL )if ( *off_47FB8 <= 32 )31 ;else if ( *off_47FB8 == 32 )0 ;0LL ;0u ;0u ;0u ;0u ;0u ;"ro.build.version.security_patch" , s);strstr (s, "2022-02" );if ( result )31 ;return result;
注意到 __system_property_get
这个导入函数，可以在它被调用并且传入特定参数(比如
“ro.build.version.sdk”)的时候进行 hook，此时就能确定是在
.init_proc 阶段了;然后进行 frida 注入，replace
掉前面三个偏移处的函数
绕过检测代码 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 function nop_64 (addr :NativePointer void {try {Memory .protect (addr, 4 , 'rwx' );let ins = Instruction .parse (addr);console .log (`[*] Original instruction at ${addr} : ${ins.toString()} ` );let w = new Arm64Writer (addr);putRet ();flush ();dispose ();catch (e) {console .log ("[-]Error in nop_64: " + e);function hook_init (void {const libc : Module | null = Process .getModuleByName ("libc.so" );const target : NativePointer | null = libc.findExportByName ("__system_property_get" );if (target === null ) {console .log ("[-] __system_property_get not found" );return ; Interceptor .attach (target, {onEnter : function (this : InvocationContext , args : InvocationArguments void {let arg0 : string | null = args[0 ].readUtf8String ();if (arg0 && arg0.indexOf ("ro.build.version.sdk" ) !== -1 ) {console .log ("[+] system_property_get called" );let mod : Module | null = Process .findModuleByName ("libmsaoaidsec.so" );if (mod) {console .log ("[+] so base: " + mod.base );let offsets : number [] =[0x1c544 , 0x1b8d4 , 0x26e5c ];forEach ((offset : number {let func_addr : NativePointer = mod.base .add (offset);nop_64 (func_addr);console .log ("[+] NOP Offset 0x" + offset.toString (16 ));function hook_dlopen (void {const dlopen_ext = Module .getGlobalExportByName ("android_dlopen_ext" );Interceptor .attach (dlopen_ext,{onEnter :function (args ){let path = args[0 ].readUtf8String ();if (path && path.indexOf ("libmsaoaidsec.so" ) !== -1 ){console .log ("[+] android_dlopen_ext called with: " + path);hook_init ();setImmediate (hook_dlopen);
ps
要是这样绕不过的话可能还要考虑更多其他的检测
比如字符串的检测，像
frida、gum-js、gmain、REJECT等等，这些字符通常来自
Frida agent、本地 Gum 运行时、GLib
事件循环线程名称或相关错误信息，检测可能会扫
proc/self/maps、proc/self/status、线程名、内存、符号表等来进行字符串匹配，对抗的话就需要
hook libc 中的 strstr、strcmp
等字符串比较函数，在这些函数执行时拦截参数，替换掉关键词或者篡改匹配结果，使得包含上述特征字符串的检测始终返回未匹配
安全库可能会扫描
proc/self/maps，查看是否有可疑的内存映射，比如 frida
注入产生的
so、匿名可执行映射或者带有特征路径的映射项，检测流程一般是打开
/proc/self/maps,逐行读取内容，解析权限、路径、匿名段信息，再根据规则判断是否可疑，对抗的话一般是两条思路:一是让检测器拿不到真实的
maps 视图，另一种则是降低 maps 中的可疑特征
另外，如果目标程序没有通过 libc 的
open、fread
等封装函数，而是自实现了相关函数，直接使用 syscall(svc)
进行系统调用，那么在 libc 层的 hook 就不能生效了，这种情况下，可以用
stackplz 或者其他工具在内核态捕获 openat
等并结合调用栈信息定位到用户态发起调用的位置