内容纲要

恶意样本

反模拟器机制

该程序经分析,发现对设备硬件进行了读取,如果存在模拟器的特征,则退出程序

ro.hardware

ro.hardware值设置是在/system/core/init.c中实现的,其通过hardware来赋值,hardware首先被/proc/cpuinfo赋值,然后会检测comandline。

image-20211007012031659

ro.build.flavor

image-20211007012059857

ro.product.model

image-20211007012123822

ro.product.model

image-20211007012142669

ro.product.manufacturer

image-20211007012204646

ro.product.board

image-20211007012221209

ro.board.platform

image-20211007012246805

gsm.version.baseband

image-20211007012307305

others

image-20211007012339137

image-20211007012346919

getProperty

反射,可以通过此获取系统属性

sensorManager

获取传感器的一些信息,可以通过此来判断一些低级的模拟器

https://vimsky.com/zh-tw/examples/detail/java-method-android.hardware.SensorManager.getSensorList.html

官方文档

基于恶意样本写的模拟器识别

//模拟器检测,大多数的沙箱和模拟器可以检测出
package com.example.emulatordetection;

import androidx.appcompat.app.AppCompatActivity;

import android.content.Context;
import android.hardware.SensorManager;
import android.os.Bundle;
import android.text.TextUtils;
import android.util.Log;
import android.widget.Toast;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.lang.reflect.Method;
import java.util.List;
import java.util.concurrent.ConcurrentHashMap;

public class MainActivity extends AppCompatActivity implements EmulatorCheckCallback {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        checkEmulator(MainActivity.this,MainActivity.this);
    }
    private boolean checkEmulator(Context acvtivity_context,EmulatorCheckCallback activity_callback){
        if(acvtivity_context!=null&&activity_callback!=null){
            checkFeaturesByHardware();
            checkFeaturesByFlavor();
            checkFeaturesByModel();
            checkFeaturesByManufacturer();
            checkFeaturesByBoard();
            checkFeaturesByPlatform();
            checkFeaturesByBaseBand();
            checkSensorNumber(acvtivity_context);
            checkCameraFlash(acvtivity_context);
            checkCamera(acvtivity_context);
            checkBluetooth(acvtivity_context);
            checkLightSensor(acvtivity_context);
            checkFeaturesByCgroup();
            checkAppNumber();
        }
        return false;
    }

    private void checkFeaturesByHardware(){
        CheckResult hardware;
        String type = this.getProperty("ro.hardware");
        int flag = 0;
        if(type == null) {
            hardware=new CheckResult(0, null);  // result,value
        }
        String type_low = type.toLowerCase();
        int result_return = 1;
        switch(type_low.hashCode()) {
            case 937844646: {
                if(type_low.equals("android_x86")) {
                    flag = 6;
                    break;
                }
                flag=-1;
                break;
            }
            case -1367724016: {
                if(!type_low.equals("cancro")) {
                    flag=-1;
                    break;
                }
                flag = 2;
                break;
            }
            case -822798509: {
                if(!type_low.equals("vbox86")) {
                    flag=-1;
                    break;
                }
                flag = 5;
                break;
            }
            case 109271: {
                if(!type_low.equals("nox")) {
                    flag=-1;
                    break;
                }
                flag = 1;
                break;
            }
            case 3570999: {
                if(!type_low.equals("ttvm")) {
                    flag=-1;
                    break;
                }
                break;
            }
            case 3613077: {
                if(!type_low.equals("vbox")) {
                    flag=-1;
                    break;
                }
                flag = 4;
                break;
            }
            case 100361430: {
                if(!type_low.equals("intel")) {
                    flag=-1;
                    break;
                }
                flag = 3;
                break;
            }
            default: {
                flag=-1;
                break;
            }
        }
        switch(flag) {
            case 0:
            case 1:
            case 2:
            case 3:
            case 4:
            case 5:
            case 6: {
                break;
            }
            default: {
                result_return = 2;
                break;
            }
        }
        hardware=new CheckResult(result_return, type);  // result,value
        int hardware_result=hardware.result;
        if(hardware_result==0){
            hardware_result=1;
        }else if(hardware_result!=1){
            hardware_result=0;
        }else{
                Toast.makeText(this, "Hardware not found.\r\n", Toast.LENGTH_SHORT).show();
        }
    }
    private void checkFeaturesByFlavor(){
        String value=this.getProperty("ro.build.flavor");
        CheckResult flavor;
        if(value==null) flavor=new CheckResult(0,null);
        String value_low=value.toLowerCase();
        int result=1;
        if(value_low.contains("vbox"))  ;
        else if(value_low.contains("sdk_gphone"))   ;
        else    result=2;
        flavor=new CheckResult(result,value);
        if(flavor.result==1){
            Toast.makeText(this, "Flavor not found.\r\n", Toast.LENGTH_SHORT).show();
        }
    }
    private void checkFeaturesByModel(){
        String value=this.getProperty("ro.product.model");
        CheckResult model;
        if(value==null) model=new CheckResult(0,null);
        String value_low = value.toLowerCase();
        int result=1;
        if(value_low.contains("google_sdk"))   ;
        else if(value_low.contains("emulator")) ;
        else if(value_low.contains("android sdk built for x86")) ;
        else {
            result=2;
        }
        model=new CheckResult(result,value);
        if(model.result==1){
            Toast.makeText(this, "Model not found.\r\n", Toast.LENGTH_SHORT).show();
        }
    }
    private void checkFeaturesByManufacturer(){
        String value=this.getProperty("ro.product.manufacturer");
        CheckResult manufacturer;
        if(value==null) manufacturer=new CheckResult(0,null);
        String value_low = value.toLowerCase();
        int result=1;
        if(value_low.contains("genymotion"))    ;
        else if(value_low.contains("netease"))  ;
        else    result=2;
        manufacturer=new CheckResult(result,value);
        if(manufacturer.result==1){
            Toast.makeText(this, "Manufacturer not found.\r\n", Toast.LENGTH_SHORT).show();
        }
    }
    private void checkFeaturesByBoard(){
        String value=this.getProperty("ro.product.board");
        CheckResult board;
        if(value==null) board=new CheckResult(0,null);
        String value_low = value.toLowerCase();
        int result=1;
        if(value_low.contains("android"))    ;
        else if(value_low.contains("goldfish"))  ;
        else    result=2;
        board=new CheckResult(result,value);
        if(board.result==1){
            Toast.makeText(this, "Board not found.\r\n", Toast.LENGTH_SHORT).show();
        }
    }
    private void checkFeaturesByPlatform(){
        String value=this.getProperty("ro.board.platform");
        CheckResult platform;
        if(value==null) platform=new CheckResult(0,null);
        int result=value.toLowerCase().contains("android")?1:2;
        platform=new CheckResult(result,value);
        if(platform.result==1)  Toast.makeText(this, "Platform not found.\r\n", Toast.LENGTH_SHORT).show();
    }
    private void checkFeaturesByBaseBand(){
        String value=this.getProperty("gsm.version.baseband");
        CheckResult baseband;
        if(value==null) baseband=new CheckResult(0,null);
        int result=value.contains("1.0.0.0")? 1 : 2;
        baseband=new CheckResult(result,value);
        if(baseband.result==1) Toast.makeText(this, "Base band not found.\r\n", Toast.LENGTH_SHORT).show();
    }
    private void checkSensorNumber(Context activity_context){
        SensorManager sensorManager=(SensorManager)activity_context.getSystemService(SENSOR_SERVICE);
        List sensorList=sensorManager.getSensorList(-1);
        int number=sensorList.size();
        if(number<=7) Toast.makeText(this, "Sensor number<=7. Number is: "+number+"\r\n", Toast.LENGTH_SHORT).show();
    }
    private void checkCameraFlash(Context activity_context){
        if(!activity_context.getPackageManager().hasSystemFeature("android.hardware.camera.flash"))
            Toast.makeText(this, "Camera flash not supported.", Toast.LENGTH_SHORT).show();
    }
    private void checkCamera(Context activity_context){
        if(!activity_context.getPackageManager().hasSystemFeature("android.hardware.camera"))
            Toast.makeText(this, "Camera not supported.", Toast.LENGTH_SHORT).show();
    }
    private void checkBluetooth(Context activity_context){
        if(!activity_context.getPackageManager().hasSystemFeature("android.hardware.bluetooth"))
            Toast.makeText(this, "Bluetooth not supported.", Toast.LENGTH_SHORT).show();
    }
    private void checkLightSensor(Context activity_context){
        SensorManager sensorManager = (SensorManager) activity_context.getSystemService(SENSOR_SERVICE);
        if(sensorManager.getDefaultSensor(5) == null)
            Toast.makeText(this, "Light sensor not supported.", Toast.LENGTH_SHORT).show();
    }
    private void checkFeaturesByCgroup(){
        String value=do_exec("cat /proc/self/cgroup");
        CheckResult Cgroup;
        if(value==null) Cgroup=new CheckResult(0,null);
        else    Cgroup=new CheckResult(2,value);
        if(Cgroup.result==0) Toast.makeText(this, "Cgourp is null.", Toast.LENGTH_SHORT).show();
    }
    private void checkAppNumber(){
        String value=do_exec("pm list package -3");//third-part packages
        if(value==null) Toast.makeText(this, "exec no return.", Toast.LENGTH_SHORT).show();
        else{
        int number=0;
        number=value.split("package:").length;
        Toast.makeText(this, "App number is: "+number, Toast.LENGTH_LONG).show();
        }
    }

    public void findEmulator(String arg2) {
        Log.d("TEST", arg2);
    }
    private String getProperty(String arg2) {
        Object v0=null;
        String value=null;
        try {
            Class<?> c = Class.forName("android.os.SystemProperties");
            Method get = c.getMethod("get", String.class, String.class);
            value = (String)(get.invoke(c, arg2, "unknown" ));
            if(TextUtils.isEmpty(((CharSequence)value))) {
                value = null;
            }
        } catch (Exception e) {
            e.printStackTrace();
        }finally {
            return value;
        }
    }
    private  String do_exec(String cmd) {
        String s = "/n";
        try {
            Process p = Runtime.getRuntime().exec(cmd);
            BufferedReader in = new BufferedReader(new InputStreamReader(p.getInputStream()));
            String line = null;
            while ((line = in.readLine()) != null) {
                s += line + "/n";
            }
        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        return s;
    }

}

class CheckResult {
    public static final int RESULT_EMULATOR = 1;
    public static final int RESULT_MAYBE_EMULATOR = 0;
    public static final int RESULT_UNKNOWN = 2;
    public int result;
    public String value;

    public CheckResult(int arg1, String arg2) {
        super();
        this.result = arg1;
        this.value = arg2;
    }
}
interface EmulatorCheckCallback {
    void findEmulator(String arg1);
}

梆梆加固恶意样本

未完成