1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

public class Property {

    public String name;

    public String seek_value;

    public Property(String name, String seek_value) {

        this.name = name;

        this.seek_value = seek_value;

    }

}

/**

 * 已知屬性, 格式為 [屬性名, 屬性值], 用於判定當前是否為QEMU環境

 */

private static Property[] known_props = {new Property("init.svc.qemud", null),

        new Property("init.svc.qemu-props", null), new Property("qemu.hw.mainkeys", null),

        new Property("qemu.sf.fake_camera", null), new Property("qemu.sf.lcd_density", null),

        new Property("ro.bootloader", "unknown"), new Property("ro.bootmode", "unknown"),

        new Property("ro.hardware", "goldfish"), new Property("ro.kernel.android.qemud", null),

        new Property("ro.kernel.qemu.gles", null), new Property("ro.kernel.qemu", "1"),

        new Property("ro.product.device", "generic"), new Property("ro.product.model", "sdk"),

        new Property("ro.product.name", "sdk"),

        new Property("ro.serialno", null)};

/**

 * 一個閾值, 因為所謂"已知"的模擬器屬性並不完全準確, 有可能出現假陽性結果, 因此保持一定的閾值能讓檢測效果更好

 */

private static int MIN_PROPERTIES_THRESHOLD = 0x5;

/**

 * 嘗試通過查詢指定的系統屬性來檢測QEMU環境, 最後跟閾值比較得出檢測結果.

 *

 * @param context A {link Context} object for the Android application.

 * @return {@code true} if enough properties where found to exist or {@code false} if not.

 */

public boolean hasQEmuProps(Context context) {

    int found_props = 0;

    for (Property property : known_props) {

        String property_value = Utilities.getProp(context, property.name);

        // See if we expected just a non-null

        if ((property.seek_value == null) && (property_value != null)) {

            found_props++;

        }

        // See if we expected a value to seek

        if ((property.seek_value != null) && (property_value.indexOf(property.seek_value) != -1)) {

            found_props++;

        }

    }

    if (found_props >= MIN_PROPERTIES_THRESHOLD) {

        return true;

    }

    return false;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

private static String[] known_device_ids = {"000000000000000", // Default emulator id

        "e21833235b6eef10", // VirusTotal id

        "012345678912345"};

public static boolean hasKnownDeviceId(Context context) {

    TelephonyManager telephonyManager = (TelephonyManager) context.getSystemService(Context.TELEPHONY_SERVICE);

    String deviceId = telephonyManager.getDeviceId();

    for (String known_deviceId : known_device_ids) {

        if (known_deviceId.equalsIgnoreCase(deviceId)) {

            return true;

        }

    }

    return false;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

private static String[] known_numbers = {

        "15555215554", // 模擬器預設電話號碼 + VirusTotal

        "15555215556", "15555215558", "15555215560", "15555215562", "15555215564", "15555215566",

        "15555215568", "15555215570", "15555215572", "15555215574", "15555215576", "15555215578",

        "15555215580", "15555215582", "15555215584",};

public static boolean hasKnownPhoneNumber(Context context) {

    TelephonyManager telephonyManager = (TelephonyManager) context.getSystemService(Context.TELEPHONY_SERVICE);

    String phoneNumber = telephonyManager.getLine1Number();

    for (String number : known_numbers) {

        if (number.equalsIgnoreCase(phoneNumber)) {

            return true;

        }

    }

    return false;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

private static String[] known_imsi_ids = {"310260000000000" // 預設IMSI編號

};

public static boolean hasKnownImsi(Context context) {

    TelephonyManager telephonyManager = (TelephonyManager) context.getSystemService(Context.TELEPHONY_SERVICE);

    String imsi = telephonyManager.getSubscriberId();

    for (String known_imsi : known_imsi_ids) {

        if (known_imsi.equalsIgnoreCase(imsi)) {

            return true;

        }

    }

    return false;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

public static boolean hasEmulatorBuild(Context context) {

    String BOARD = android.os.Build.BOARD; // The name of the underlying board, like "unknown".

    // This appears to occur often on real hardware... that's sad

    // String BOOTLOADER = android.os.Build.BOOTLOADER; // The system bootloader version number.

    String BRAND = android.os.Build.BRAND; // The brand (e.g., carrier) the software is customized for, if any.

    // "generic"

    String DEVICE = android.os.Build.DEVICE; // The name of the industrial design. "generic"

    String HARDWARE = android.os.Build.HARDWARE; // The name of the hardware (from the kernel command line or

    // /proc). "goldfish"

    String MODEL = android.os.Build.MODEL; // The end-user-visible name for the end product. "sdk"

    String PRODUCT = android.os.Build.PRODUCT; // The name of the overall product.

    if ((BOARD.compareTo("unknown") == 0) /* || (BOOTLOADER.compareTo("unknown") == 0) */

            || (BRAND.compareTo("generic") == 0) || (DEVICE.compareTo("generic") == 0)

            || (MODEL.compareTo("sdk") == 0) || (PRODUCT.compareTo("sdk") == 0)

            || (HARDWARE.compareTo("goldfish") == 0)) {

        return true;

    }

    return false;

}

1

2

3

4

5

public static boolean isOperatorNameAndroid(Context paramContext) {

    String szOperatorName = ((TelephonyManager) paramContext.getSystemService(Context.TELEPHONY_SERVICE)).getNetworkOperatorName();

    boolean isAndroid = szOperatorName.equalsIgnoreCase("android");

    return isAndroid;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

private static String[] known_qemu_drivers = {"goldfish"};

/**

 * 讀取驅動檔案, 檢查是否包含已知的qemu驅動

 *

 * @return {@code true} if any known drivers where found to exist or {@code false} if not.

 */

public static boolean hasQEmuDrivers() {

    for (File drivers_file : new File[]{new File("/proc/tty/drivers"), new File("/proc/cpuinfo")}) {

        if (drivers_file.exists() && drivers_file.canRead()) {

            // We don't care to read much past things since info we care about should be inside here

            byte[] data = new byte[1024];

            try {

                InputStream is = new FileInputStream(drivers_file);

                is.read(data);

                is.close();

            } catch (Exception exception) {

                exception.printStackTrace();

            }

            String driver_data = new String(data);

            for (String known_qemu_driver : FindEmulator.known_qemu_drivers) {

                if (driver_data.indexOf(known_qemu_driver) != -1) {

                    return true;

                }

            }

        }

    }

    return false;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

private static String[] known_files = {"/system/lib/libc_malloc_debug_qemu.so", "/sys/qemu_trace",

        "/system/bin/qemu-props"};

/**

 * 檢查是否存在已知的QEMU環境檔案

 *

 * @return {@code true} if any files where found to exist or {@code false} if not.

 */

public static boolean hasQEmuFiles() {

    for (String pipe : known_files) {

        File qemu_file = new File(pipe);

        if (qemu_file.exists()) {

            return true;

        }

    }

    return false;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

private static String[] known_geny_files = {"/dev/socket/genyd", "/dev/socket/baseband_genyd"};

/**

 * 檢查是否存在已知的Genemytion環境檔案

 *

 * @return {@code true} if any files where found to exist or {@code false} if not.

 */

public static boolean hasGenyFiles() {

    for (String file : known_geny_files) {

        File geny_file = new File(file);

        if (geny_file.exists()) {

            return true;

        }

    }

    return false;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

private static String[] known_pipes = {"/dev/socket/qemud", "/dev/qemu_pipe"};

/**

 * 檢查是否存在已知的QEMU使用的管道

 *

 * @return {@code true} if any pipes where found to exist or {@code false} if not.

 */

public static boolean hasPipes() {

    for (String pipe : known_pipes) {

        File qemu_socket = new File(pipe);

        if (qemu_socket.exists()) {

            return true;

        }

    }

    return false;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

static {

    // This is only valid for arm

    System.loadLibrary("anti");

}

public native static int qemuBkpt();

public static boolean checkQemuBreakpoint() {

    boolean hit_breakpoint = false;

    // Potentially you may want to see if this is a specific value

    int result = qemuBkpt();

    if (result > 0) {

        hit_breakpoint = true;

    }

    return hit_breakpoint;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

void handler_sigtrap(int signo) {

  exit(-1);

}

void handler_sigbus(int signo) {

  exit(-1);

}

int setupSigTrap() {

  // BKPT throws SIGTRAP on nexus 5 / oneplus one (and most devices)

  signal(SIGTRAP, handler_sigtrap);

  // BKPT throws SIGBUS on nexus 4

  signal(SIGBUS, handler_sigbus);

}

// This will cause a SIGSEGV on some QEMU or be properly respected

int tryBKPT() {

  __asm__ __volatile__ ("bkpt 255");

}

jint Java_diff_strazzere_anti_emulator_FindEmulator_qemuBkpt(JNIEnv* env, jobject jObject) {

  pid_t child = fork();

  int child_status, status = 0;

  if(child == 0) {

    setupSigTrap();

    tryBKPT();

  } else if(child == -1) {

    status = -1;

  } else {

    int timeout = 0;

    int i = 0;

    while ( waitpid(child, &child_status, WNOHANG) == 0 ) {

      sleep(1);

      // Time could be adjusted here, though in my experience if the child has not returned instantly

      // then something has gone wrong and it is an emulated device

      if(i++ == 1) {

        timeout = 1;

        break;

      }

    }

    if(timeout == 1) {

      // Process timed out - likely an emulated device and child is frozen

      status = 1;

    }

    if ( WIFEXITED(child_status) ) {

      // 子程序正常退出

      status = 0;

    } else {

      // Didn't exit properly - very likely an emulator

      status = 2;

    }

    // Ensure child is dead

    kill(child, SIGKILL);

  }

  return status;

}

1

2

3

4

5

6

7

8

public static boolean hasEmulatorAdb() {

    try {

        return FindDebugger.hasAdbInEmulator();

    } catch (Exception exception) {

        exception.printStackTrace();

        return false;

    }

}

1

2

3

public static boolean isUserAMonkey() {

    return ActivityManager.isUserAMonkey();

}

1

2

3

4

5

6

/**

 * 你信或不信, 還真有許多加固程式使用這個方法...

 */

public static boolean isBeingDebugged() {

    return Debug.isDebuggerConnected();

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

private static String tracerpid = "TracerPid";

/**

 * 阿里巴巴用於檢測是否在跟蹤應用程序

 *

 * 容易規避, 用法是建立一個執行緒每3秒檢測一次, 如果檢測到則程式崩潰

 *

 * @return

 * @throws IOException

 */

public static boolean hasTracerPid() throws IOException {

    BufferedReader reader = null;

    try {

        reader = new BufferedReader(new InputStreamReader(new FileInputStream("/proc/self/status")), 1000);

        String line;

        while ((line = reader.readLine()) != null) {

            if (line.length() > tracerpid.length()) {

                if (line.substring(0, tracerpid.length()).equalsIgnoreCase(tracerpid)) {

                    if (Integer.decode(line.substring(tracerpid.length() + 1).trim()) > 0) {

                        return true;

                    }

                    break;

                }

            }

        }

    } catch (Exception exception) {

        exception.printStackTrace();

    } finally {

        reader.close();

    }

    return false;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

public static boolean hasAdbInEmulator() throws IOException {

    boolean adbInEmulator = false;

    BufferedReader reader = null;

    try {

        reader = new BufferedReader(new InputStreamReader(new FileInputStream("/proc/net/tcp")), 1000);

        String line;

        // Skip column names

        reader.readLine();

        ArrayList<tcp> tcpList = new ArrayList<tcp>();

        while ((line = reader.readLine()) != null) {

            tcpList.add(tcp.create(line.split("\\W+")));

        }

        reader.close();

        // Adb is always bounce to 0.0.0.0 - though the port can change

        // real devices should be != 127.0.0.1

        int adbPort = -1;

        for (tcp tcpItem : tcpList) {

            if (tcpItem.localIp == 0) {

                adbPort = tcpItem.localPort;

                break;

            }

        }

        if (adbPort != -1) {

            for (tcp tcpItem : tcpList) {

                if ((tcpItem.localIp != 0) && (tcpItem.localPort == adbPort)) {

                    adbInEmulator = true;

                }

            }

        }

    } catch (Exception exception) {

        exception.printStackTrace();

    } finally {

        reader.close();

    }

    return adbInEmulator;

}

public static class tcp {

    public int id;

    public long localIp;

    public int localPort;

    public int remoteIp;

    public int remotePort;

    static tcp create(String[] params) {

        return new tcp(params[1], params[2], params[3], params[4], params[5], params[6], params[7], params[8],

                        params[9], params[10], params[11], params[12], params[13], params[14]);

    }

    public tcp(String id, String localIp, String localPort, String remoteIp, String remotePort, String state,

                    String tx_queue, String rx_queue, String tr, String tm_when, String retrnsmt, String uid,

                    String timeout, String inode) {

        this.id = Integer.parseInt(id, 16);

        this.localIp = Long.parseLong(localIp, 16);

        this.localPort = Integer.parseInt(localPort, 16);

    }

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

public static boolean hasPackageNameInstalled(Context context, String packageName) {

    PackageManager packageManager = context.getPackageManager();

    // In theory, if the package installer does not throw an exception, package exists

    try {

        packageManager.getInstallerPackageName(packageName);

        return true;

    } catch (IllegalArgumentException exception) {

        return false;

    }

}

public static boolean hasAppAnalysisPackage(Context context) {

    return Utilities.hasPackageNameInstalled(context, "org.appanalysis");

}

public static boolean hasTaintClass() {

    try {

        Class.forName("dalvik.system.Taint");

        return true;

    }

    catch (ClassNotFoundException exception) {

        return false;

    }

}

1

2

3

4

5

6

7

8

9

10

11

private static boolean hasEth0Interface() {

    try {

        for (Enumeration<NetworkInterface> en = NetworkInterface.getNetworkInterfaces(); en.hasMoreElements(); ) {

            NetworkInterface intf = en.nextElement();

            if (intf.getName().equals("eth0"))

                return true;

        }

    } catch (SocketException ex) {

    }

    return false;

}