[移动开发]Android常见风控检测位置

root 检测?

1. root管理apk检测
????????/system/etc/init.d/99SuperSUDaemon

????????/data/data/com.topjohnwu.magisk

????????/sdcard/MagiskManager
?
2. shell 执行su命令 Runtime.getRuntime().exec("su");

3. grep:
????????build.fingerprint ? test-keys
????????Build.TAGS ?test-keys
????????ro.debuggable 1
????????ro.secure?? ?0
????????ro.adb.secure 0

4. new File(snext).exists() 文件是否存在 ?ls -l 判断是否有 s x权限

"/sbin/su","/system/bin/su","/system/sbin/su","/system/xbin/su","/data/local/xbin/su","/data/local/bin/su","/system/sd/xbin/su","/system/bin/failsafe/su","/data/local/su","/su/bin/su","/vendor/bin/su"

5. /*busybox是否存在*/?? ?
?? ? ? String str = "/system/xbin/busybox";
? ? ? ?String str1 = "/system/sbin/busybox";
? ? ? ?if (new File("/system/bin/busybox").exists()) {?? ?
? ? ? ? ? return true;
? ? ? ?}?? ?

6. /*root 路径是否有文件*/

模拟器检测
1. pipe检测
? ? ? ?/dev/socket/qemud ? /dev/qemu_pipe ?new File 是否存在

2. QEmuDriverFile驱动文件检测
?? ?/proc/tty/drivers ?是否含有 goldfish字段?

3. cpu信息检测
?? ? ? ? ?/system/bin/cat /proc/cpuinfo ?//cat 查看
?? ??? ? ?是否含有intel 且不包含 atom

4. 判断deviceid imei?
?? ?context.getSystemService("phone").getDeviceId()?? ?000000000000000?
?? ?context.getSystemService("phone").getSubscriberId() 310260000000000
?? ??? ? ?大概率为模拟器

5. 手机号判断

6. 可否发送短信、拨打电话
? ? ? ?Intent intent = new Intent();
? ? ? ?intent.setData(Uri.parse("tel:10086"));//smsto:10086
? ? ? ?intent.setAction("android.intent.action.DIAL");//intent.setAction("android.intent.action.VIEW");
? ? ? ?int vi = (intent.resolveActivity(p0.getPackageManager()) != null)? 1: 0;?? ?

7. 模拟器app判断
?? ?eg:"com.microvirt.launcher2", "com.microvirt.launcher.Launcher"
?? ?
8. 传感器是否存在判断

hook框架检测
1. 查看自身进程的虚拟内存 /proc/{pid}/maps 是否加载了frame特征文件
?? ?com.saurik.substrate
?? ?XposedBridge.jar
?? ?me.weishu.exp ?（Taichi）

2. xposed?
?? ?反射获取de.robv.android.xposed.XposedHelpers中methodCache，查看已加载的hook的类是否有自己的关键类。
?? ?从PackageInfo中获取是否存在包名为de.robv.android.xposed.installer

3.检测常见路径/data/local/tmp
?? ?frida-server ---frida
?? ?hijack?? ?---ADBI
?? ?libstrmon ?? ?---DDI

4. 打印堆栈
Substrate?? ?com.android.internal.os.ZygoteInit
Substrate?? ?com.saurik.substrate.MS$2?? ??? ?方法： invoked
Xposed?? ?de.robv.android.xposed.XposedBridge ? ?方法：main handleHookedMethod
EdXposed EdHooker_ ? ?? ??? ??? ?方法： hook
TaiChi?? ?me.weishu.epic

?