1、Root检测原理及判断#

原理：当APP运行之后，APP的检测root的代码就会运行，然后去特定的路径下检查是否存在su命令，如果存在su命令，则说明此APP已经被root了，反正则无
为什么：为什么可以通过这种方式判断设备是否已经被root？因为被root的设备有很多的特征，特征之一就是会在特定的路径下面生成su命令，使用不同的root软件root设备之后，su命令存在位置不同，以下是一些常见的：

1
system/bin/su   # 通过面具root设备之后su命令的存在位置
2
data/local/bin/su
3
sbin/su
4
...

判断设备是否已被root：通过adb连接设备，尝试在特定的路径下找到su命令，找到则被root，反正则无，比如我的设备：可以看到我的设备在system/bin路径下存在su命令，说明已被root

2、绕过root检测#

方案一：#

原理：
- 通过HOOK使APP在检查对应文件的时候，检测不到su命令
案例：
运行之后直接提示此设备已被root，不能正常使用此APP 查看此APP包名：
运行HOOK脚本：

脚本地址

1
const commonPaths = [
2
    "/data/local/bin/su",
3
    "/data/local/su",
4
    "/data/local/xbin/su",
5
    "/dev/com.koushikdutta.superuser.daemon/",
6
    "/sbin/su",
7
    "/system/app/Superuser.apk",
8
    "/system/bin/failsafe/su",
9
    "/system/bin/su",
10
    "/su/bin/su",
11
    "/system/etc/init.d/99SuperSUDaemon",
12
    "/system/sd/xbin/su",
13
    "/system/xbin/busybox",
14
    "/system/xbin/daemonsu",
15
    "/system/xbin/su",
16
    "/system/sbin/su",
17
    "/vendor/bin/su",
18
    "/cache/su",
19
    "/data/su",
20
    "/dev/su",
21
    "/system/bin/.ext/su",
22
    "/system/usr/we-need-root/su",
23
    "/system/app/Kinguser.apk",
24
    "/data/adb/magisk",
25
    "/sbin/.magisk",
26
    "/cache/.disable_magisk",
27
    "/dev/.magisk.unblock",
28
    "/cache/magisk.log",
29
    "/data/adb/magisk.img",
30
    "/data/adb/magisk.db",
31
    "/data/adb/magisk_simple",
32
    "/init.magisk.rc",
33
    "/system/xbin/ku.sud",
34
    "/data/adb/ksu",
35
    "/data/adb/ksud"
36
];
37

38
const ROOTmanagementApp = [
39
    "com.noshufou.android.su",
40
    "com.noshufou.android.su.elite",
41
    "eu.chainfire.supersu",
42
    "com.koushikdutta.superuser",
43
    "com.thirdparty.superuser",
44
    "com.yellowes.su",
45
    "com.koushikdutta.rommanager",
46
    "com.koushikdutta.rommanager.license",
47
    "com.dimonvideo.luckypatcher",
48
    "com.chelpus.lackypatch",
49
    "com.ramdroid.appquarantine",
50
    "com.ramdroid.appquarantinepro",
51
    "com.topjohnwu.magisk",
52
    "me.weishu.kernelsu"
53
];
54

55

56

57
function stackTraceHere(isLog){
58
    var Exception = Java.use('java.lang.Exception');
59
    var Log = Java.use('android.util.Log');
60
    var stackinfo = Log.getStackTraceString(Exception.$new())
61
    if(isLog){
62
        console.log(stackinfo)
63
    }else{
64
        return stackinfo
65
    }
66
}
67

68
function stackTraceNativeHere(isLog){
69
    var backtrace = Thread.backtrace(this.context, Backtracer.ACCURATE)
70
    .map(DebugSymbol.fromAddress)
71
    .join("\n\t");
72
    console.log(backtrace)
73
}
74

75

76
function bypassJavaFileCheck(){
77
    var UnixFileSystem = Java.use("java.io.UnixFileSystem")
78
    UnixFileSystem.checkAccess.implementation = function(file,access){
79

80
        var stack = stackTraceHere(false)
81

82
        const filename = file.getAbsolutePath();
83

84
        if (filename.indexOf("magisk") >= 0) {
85
            console.log("Anti Root Detect - check file: " + filename)
86
            return false;
87
        }
88

89
        if (commonPaths.indexOf(filename) >= 0) {
90
            console.log("Anti Root Detect - check file: " + filename)
91
            return false;
92
        }
93

94
        return this.checkAccess(file,access)
95
    }
96
}
97

98
function bypassNativeFileCheck(){
99
    var fopen = Module.findExportByName("libc.so","fopen")
100
    Interceptor.attach(fopen,{
101
        onEnter:function(args){
102
            this.inputPath = args[0].readUtf8String()
103
        },
104
        onLeave:function(retval){
105
            if(retval.toInt32() != 0){
106
                if (commonPaths.indexOf(this.inputPath) >= 0) {
107
                    console.log("Anti Root Detect - fopen : " + this.inputPath)
108
                    retval.replace(ptr(0x0))
109
                }
110
            }
111
        }
112
    })
113

114
    var access = Module.findExportByName("libc.so","access")
115
    Interceptor.attach(access,{
116
        onEnter:function(args){
117
            this.inputPath = args[0].readUtf8String()
118
        },
119
        onLeave:function(retval){
120
            if(retval.toInt32()==0){
121
                if(commonPaths.indexOf(this.inputPath) >= 0){
122
                    console.log("Anti Root Detect - access : " + this.inputPath)
123
                    retval.replace(ptr(-1))
124
                }
125
            }
126
        }
127
    })
128
}
129

130
function setProp(){
131
    var Build = Java.use("android.os.Build")
132
    var TAGS = Build.class.getDeclaredField("TAGS")
133
    TAGS.setAccessible(true)
134
    TAGS.set(null,"release-keys")
135

136
    var FINGERPRINT = Build.class.getDeclaredField("FINGERPRINT")
137
    FINGERPRINT.setAccessible(true)
138
    FINGERPRINT.set(null,"google/crosshatch/crosshatch:10/QQ3A.200805.001/6578210:user/release-keys")
139

140
    // Build.deriveFingerprint.inplementation = function(){
141
    //     var ret = this.deriveFingerprint() //该函数无法通过反射调用
142
    //     console.log(ret)
143
    //     return ret
144
    // }
145

146
    var system_property_get = Module.findExportByName("libc.so", "__system_property_get")
147
    Interceptor.attach(system_property_get,{
148
        onEnter(args){
149
            this.key = args[0].readCString()
150
            this.ret = args[1]
151
        },
152
        onLeave(ret){
153
            if(this.key == "ro.build.fingerprint"){
154
                var tmp = "google/crosshatch/crosshatch:10/QQ3A.200805.001/6578210:user/release-keys"
155
                var p = Memory.allocUtf8String(tmp)
156
                Memory.copy(this.ret,p,tmp.length+1)
157
            }
158
        }
159
    })
160

161
}
162

163
//android.app.PackageManager
164
function bypassRootAppCheck(){
165
    var ApplicationPackageManager = Java.use("android.app.ApplicationPackageManager")
166
    ApplicationPackageManager.getPackageInfo.overload('java.lang.String', 'int').implementation = function(str,i){
167
        // console.log(str)
168
        if (ROOTmanagementApp.indexOf(str) >= 0) {
169
            console.log("Anti Root Detect - check package : " + str)
170
            str = "ashen.one.ye.not.found"
171
        }
172
        return this.getPackageInfo(str,i)
173
    }
174

175
    //shell pm check
176
}
177

178
function bypassShellCheck(){
179
    var String = Java.use('java.lang.String')
180

181
    var ProcessImpl = Java.use("java.lang.ProcessImpl")
182
    ProcessImpl.start.implementation = function(cmdarray,env,dir,redirects,redirectErrorStream){
183

184
        if(cmdarray[0] == "mount"){
185
            console.log("Anti Root Detect - Shell : " + cmdarray.toString())
186
            arguments[0] = Java.array('java.lang.String',[String.$new("")])
187
            return ProcessImpl.start.apply(this,arguments)
188
        }
189

190
        if(cmdarray[0] == "getprop"){
191
            console.log("Anti Root Detect - Shell : " + cmdarray.toString())
192
            const prop = [
193
                "ro.secure",
194
                "ro.debuggable"
195
            ];
196
            if(prop.indexOf(cmdarray[1]) >= 0){
197
                arguments[0] = Java.array('java.lang.String',[String.$new("")])
198
                return ProcessImpl.start.apply(this,arguments)
199
            }
200
        }
201

202
        if(cmdarray[0].indexOf("which") >= 0){
203
            const prop = [
204
                "su"
205
            ];
206
            if(prop.indexOf(cmdarray[1]) >= 0){
207
                console.log("Anti Root Detect - Shell : " + cmdarray.toString())
208
                arguments[0] = Java.array('java.lang.String',[String.$new("")])
209
                return ProcessImpl.start.apply(this,arguments)
210
            }
211
        }
212

213
        return ProcessImpl.start.apply(this,arguments)
214
    }
215
}
216

217
console.log("Attach")
218
bypassNativeFileCheck()
219
bypassJavaFileCheck()
220
setProp()
221
bypassRootAppCheck()
222
bypassShellCheck()

alt text root检测已被HOOK，导致APP无法检测到su命令，成功绕过root检测

方案二：#

原理：
- magisk+Shamiko模块做Root隐藏，使用面具的Zygisk来隐藏指定APP的Root隐藏
打开magisk并下载Shamiko模块：
首页设置-Zygisk：
在排除列表中添加目标APP之后再次打开APP：成功绕过root检测

方案三：#

原理：
- 反编译APP，编写HOOK脚本绕过root检测
jadx反编译APP代码，定位到对应代码位置：此处通过isSimulator、isRooted来判断是否为虚拟机环境或者该设备是否已被root，如果二者满足其一则弹窗阻止用户使用此APP，经过对isSimulator、isRooted的分析编写HOOK绕过root检测脚本
HOOK脚本：

1
// Bypass_Root_HOOK
2
Java.perform(function () {
3
   var MiscUtil = Java.use("com.yoloho.libcore.util.MiscUtil");
4

5
   MiscUtil.isRooted.implementation = function () {
6
       console.log("==========1. START HOOK!!!==========");
7
       console.log("==========1. FINISHED!!==========");
8
       return false;
9
   }
10

11
   MiscUtil.isSimulator.implementation = function () {
12
       console.log("==========2. START HOOK!!!==========");
13
       console.log("==========2. FINISHED!!==========");
14
       return false;
15
   }
16
});