农业银行Root检测绕过

农业银行Root检测绕过

农银掌上银行有Root检测，在Root的设备上会闪退。
App使用了爱加密进行加固。

image-20210319170520495

通过日志信息猜测调用了killProcess，Hook killProcess查看堆栈信息。

1
2
3
4
5
var Process = Java.use("android.os.Process");
Process.killProcess.implementation = function(arg0){
    console.log('killProcess...');
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
};
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
java.lang.Exception
        at android.os.Process.killProcess(Native Method)
        at com.ijm.detect.drisk.unexp.d.a(Unknown Source:152)
        at com.ijm.detect.drisk.unexp.NativeToolH.doAttackStrategy(Unknown Source:0)
        at com.ijm.detect.drisk.unexp.NativeToolH.ncha(Native Method)
        at com.ijm.detect.drisk.DRiskNativeTool.checkHookAttack(Unknown Source:45)
        at com.android.bankabc.homepage.fragment.HomepageFragment.checkRisk(Unknown Source:6)
        at com.android.bankabc.homepage.fragment.HomepageFragment.access$400(Unknown Source:0)
        at com.android.bankabc.homepage.fragment.HomepageFragment$2.run(Unknown Source:2)
        at com.alipay.mobile.framework.pipeline.analysis.AnalysedRunnable.run(AnalysedRunnable.java:86)
        at com.alipay.mobile.framework.pipeline.DelayedRunnable.run(DelayedRunnable.java:65)
        at com.alipay.mobile.common.task.pipeline.NamedRunnable.run(NamedRunnable.java:152)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
        at java.lang.Thread.run(Thread.java:919)

com.ijm.detect.drisk.unexp.NativeToolH.doAttackStrategy被调用多次，替换这个函数就行，函数的原型：public static void com.ijm.detect.drisk.unexp.NativeToolH.doAttackStrategy(android.content.Context,int,int)。

1
2
3
4
5
6
7
findAndHookMethod("com.ijm.detect.drisk.unexp.NativeToolH", classLoader, "doAttackStrategy", Context.class, int.class, int.class, new XC_MethodReplacement() {
    @Override
    protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
        XposedBridge.log(lpparam.packageName + "\tdoAttackStrategy() callled!");
        return null;
        }
});