Android修改内核源码绕过防调试检测
2023-3-6 08:16:2 Author: 哆啦安全(查看原文) 阅读量:17 收藏

安卓逆向工具

链接:https://pan.baidu.com/s/16ycrpZcl-pBhz5oGJ3MC1Q 提取码:i8tx


1./fs/proc/base.c

/* * Provides a wchan file via kallsyms in a proper one-value-per-file format. * Returns the resolved symbol.  If that fails, simply return the address. */static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns,              struct pid *pid, struct task_struct *task){    unsigned long wchan;    char symname[KSYM_NAME_LEN];
wchan = get_wchan(task);
if (wchan && ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS) && !lookup_symbol_name(wchan, symname)) { //seq_printf(m, "%s", symname); if (strstr(symname, "trace")) { seq_printf(m, "%s", "sys_epoll_wait"); } } else seq_putc(m, '0');
return 0;}

2./fs/proc/array.c

/* * The task state array is a strange "bitmap" of * reasons to sleep. Thus "running" is zero, and * you can test for combinations of others with * simple bit tests. */static const char * const task_state_array[] = {    "R (running)",        /*   0 */    "S (sleeping)",        /*   1 */    "D (disk sleep)",    /*   2 */    "T (stopped)",        /*   4 */    "S (sleeping)",//"t (tracing stop)",    /*   8 */    "X (dead)",        /*  16 */    "Z (zombie)",        /*  32 */};

tpid = 0;seq_printf(m,  "State:\t%s\n"  "Tgid:\t%d\n"  "Pid:\t%d\n"  "PPid:\t%d\n"  "TracerPid:\t%d\n"  "Uid:\t%d\t%d\t%d\t%d\n"  "Gid:\t%d\t%d\t%d\t%d\n"  "Ngid:\t%d\n"  "FDSize:\t%d\nGroups:\t",  get_task_state(p),  tgid, pid_nr_ns(pid, ns), ppid, tpid,  from_kuid_munged(user_ns, cred->uid),  from_kuid_munged(user_ns, cred->euid),  from_kuid_munged(user_ns, cred->suid),  from_kuid_munged(user_ns, cred->fsuid),  from_kgid_munged(user_ns, cred->gid),  from_kgid_munged(user_ns, cred->egid),  from_kgid_munged(user_ns, cred->sgid),  from_kgid_munged(user_ns, cred->fsgid),  ngid, max_fds);

Android系统源码结构

链接:https://pan.baidu.com/s/1ocvfmLXnkw2ufbg96dfzfQ 提取码:9hr4

商务合作

安全产品

安全服务

2023年招聘

安全培训服务

软件定制服务

Android系统定制服务

安全/软件开发的课程列表

定制版安全分析辅助测试手机

Android系统定制需求,联系作者

推荐阅读

修改ptrace绕过反调试(Android10)

修改内核源码绕过反调试检测(Android10)

商务合作

更多业务合作,点击下方"阅读原文"


文章来源: http://mp.weixin.qq.com/s?__biz=Mzg2NzUzNzk1Mw==&mid=2247495300&idx=1&sn=ea4d54c6e81cae66dcb04197d85daf19&chksm=ceb8abcaf9cf22dc0d23b400fdb68a874d6cda7f419a2b036d5ccfeef7a31b8e8f4280ef55e5#rd
如有侵权请联系:admin#unsafe.sh