search

aimardcr / AndroidNativeGuard

All-in-one android application protection
146 stars 35 forks source link

BlACKLIST not working #2

Closed TheMercen133 closed 1 year ago

TheMercen133 commented 1 year ago

BLACKLIST doesn't work and still detects all running lib.so as a result lib.so that is not related to apk still detects checksums that are not the same.

aimardcr commented 1 year ago

Have you added the lib name in the the code? If yes, can you show me the code?

aimardcr commented 1 year ago

Also about that pthread_create bypass, this project is just a proof of concepts on how to protect an android app, you can implement such as heartbeat so that if the services aren't running, then the app won't work.

TheMercen133 commented 1 year ago

Have you added the lib name in the the code? If yes, can you show me the code?

static std::vector BLACKLISTS { "libdolbyottcontrol.so" // Add your library here incase you don't want a certain library to be detected when it's tampered };

aimardcr commented 1 year ago

Okay, my bad. I forgot to make sure that the blacklist checks only for file name, not the whole path. Fixed in 3946859c0f6fc05f83655165b637cb498119b48f.

TheMercen133 commented 1 year ago

Okay, my bad. I forgot to make sure that the blacklist checks only for file name, not the whole path. Fixed in ddb0b00

Result : AntiLibPatch::execute info.dlpi_name: /system/lib64/libdolbyottcontrol.so AntiLibPatch::execute /system/lib64/libdolbyottcontrol.so[.text] checksum: 0x00000000 -> 0x6888E37C AntiLibPatch::execute /system/lib64/libdolbyottcontrol.so[.text] checksum mismatch

aimardcr commented 1 year ago

Okay, my bad. I forgot to make sure that the blacklist checks only for file name, not the whole path. Fixed in ddb0b00

Result : AntiLibPatch::execute info.dlpi_name: /system/lib64/libdolbyottcontrol.so AntiLibPatch::execute /system/lib64/libdolbyottcontrol.so[.text] checksum: 0x00000000 -> 0x6888E37C AntiLibPatch::execute /system/lib64/libdolbyottcontrol.so[.text] checksum mismatch

Please use the latest code and let me know of the result.

TheMercen133 commented 1 year ago

Okay, my bad. I forgot to make sure that the blacklist checks only for file name, not the whole path. Fixed in ddb0b00

Result : AntiLibPatch::execute info.dlpi_name: /system/lib64/libdolbyottcontrol.so AntiLibPatch::execute /system/lib64/libdolbyottcontrol.so[.text] checksum: 0x00000000 -> 0x6888E37C AntiLibPatch::execute /system/lib64/libdolbyottcontrol.so[.text] checksum mismatch

Please use the latest code and let me know of the result.

still same, not solve yet

aimardcr commented 1 year ago

Try again, take a look at 1d110c3b2e2ce90e7f3db949d958d753f7c11744 changes

TheMercen133 commented 1 year ago

Try again, take a look at 1d110c3 changes

its working now, thanks