Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

android maps检测/内存检测仍然能探测到frida(已跟随魔改frida-tools) #12

Open
seanchan opened this issue Oct 12, 2024 · 4 comments

Comments

@seanchan
Copy link
Contributor

检测效果:
image

魔改日志:
[SUCC] 找到 frida-tools 路径: /Users/xxx/Library/Python/3.9/lib/python/site-packages/frida
是否确认使用此路径?
请输入 (y/n)y
[INFO] 开始给 frida-tools 打补丁...
[INFO] 使用配置的魔改名: mtsvr

[INFO] 创建备份: /Users/xxx/Library/Python/3.9/lib/python/site-packages/frida/_frida.abi3.so.fridare
[INFO] Python 库文件: /Users/xxx/Library/Python/3.9/lib/python/site-packages/frida/_frida.abi3.so
[INFO] Frida 名称: mtsvr

@seanchan
Copy link
Contributor Author

image

内存检查也一致。
单独开server没事,但尝试spawn注入后,内存内还是能被检测到agent 注入

@XUCharles
Copy link

image

内存检查也一致。 单独开server没事,但尝试spawn注入后,内存内还是能被检测到agent 注入

这个frida检测的apk是开源的嘛? 我只试过替换掉libc的字符串比较函数,把所有frida换掉

@seanchan
Copy link
Contributor Author

seanchan commented Nov 7, 2024

Frida_check.apk.zip
忘了这个检测apk的出处了。。。只找到了apk :(
具体检测方案是什么我还真没细研究。。

@XUCharles
Copy link

Frida_check.apk.zip 忘了这个检测apk的出处了。。。只找到了apk :( 具体检测方案是什么我还真没细研究。。

okk 还是感谢

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants