allenymt / PrivacySentry

Android隐私合规整改检测工具,注解+Asm修改字节码的检测方案
MIT License
2.05k stars 262 forks source link

应用宝隐私合规检测还是报调用过于频繁 #52

Closed lijuncai closed 2 years ago

lijuncai commented 2 years ago

安装最新的版本,使用默认拦截的方案,还是会被检测出使用过于频繁,主要为友盟和穿山甲调 1658841347301 1658842216346

allenymt commented 2 years ago

这个自己配置下? app信息 内部没有做缓存处理的

具体的函数配置可以参考demo

allenymt commented 2 years ago

最好的方式还是升级SDK,反馈给SDK的开发

lijuncai commented 2 years ago

最好的方式还是升级SDK,反馈给SDK的开发

您好,我想咨询下,是不是因为检测方用的也是hook,比这个先拦截了,所以导致我们的拦截方法没生效

allenymt commented 2 years ago

不会的,PrivacySentry是编译期修改代码拦截的,有具体的堆栈吗

lijuncai commented 2 years ago
image

这个是不是默认配置的,需要额外操作嘛

lijuncai commented 2 years ago

不会的,PrivacySentry是编译期修改代码拦截的,有具体的堆栈吗

android.app.ApplicationPackageManager.getPackageInfoAsUser(java.lang.String,int,int) android.app.ApplicationPackageManager.getPackageInfo(ApplicationPackageManager.java:152) com.ss.android.socialbase.appdownloader.f.e.f(SourceFile:23) com.ss.android.socialbase.appdownloader.f.e.e(SourceFile:12) com.ss.android.socialbase.appdownloader.f.e.a(SourceFile:4) com.ss.android.downloadlib.e$3.run(SourceFile:5)

lijuncai commented 2 years ago

不会的,PrivacySentry是编译期修改代码拦截的,有具体的堆栈吗

android.app.ApplicationPackageManager.getPackageInfoAsUser(java.lang.String,int,int) android.app.ApplicationPackageManager.getPackageInfo(ApplicationPackageManager.java:152) com.ss.android.socialbase.appdownloader.f.e.f(SourceFile:23) com.ss.android.socialbase.appdownloader.f.e.e(SourceFile:12) com.ss.android.socialbase.appdownloader.f.e.a(SourceFile:4) com.ss.android.downloadlib.e$3.run(SourceFile:5)

android.app.ActivityManager.getRunningAppProcesses() com.yl.lib.privacy_proxy.PrivacyProxyCall$Proxy.getRunningAppProcesses(SourceFile:5) bykvm_19do.bykvm_19do.bykvm_int108.bykvm_19do.bykvm_case1.a.b(SourceFile:5) bykvm_19do.bykvm_19do.bykvm_int108.bykvm_19do.bykvm_new1.a.e(SourceFile:1) bykvm_19do.bykvm_19do.bykvm_int108.bykvm_19do.bykvm_byte12b.d.a(SourceFile:1) bykvm_19do.bykvm_19do.bykvm_int108.bykvm_19do.bykvm_byte12b.d.a(SourceFile:3) bykvm_19do.bykvm_19do.bykvm_int108.bykvm_19do.h$a.run(SourceFile:2) android.os.Handler.handleCallback(Handler.java:873) android.os.HandlerThread.run(HandlerThread.java:65)

lijuncai commented 2 years ago

android.app.ActivityManager.getRunningAppProcesses() com.yl.lib.privacy_proxy.PrivacyProxyCall$Proxy.getRunningAppProcesses(SourceFile:5) bykvm_19do.bykvm_19do.bykvm_int108.bykvm_19do.bykvm_case1.a.b(SourceFile:5) bykvm_19do.bykvm_19do.bykvm_int108.bykvm_19do.bykvm_new1.a.e(SourceFile:1) bykvm_19do.bykvm_19do.bykvm_int108.bykvm_19do.bykvm_byte12b.d.a(SourceFile:1) bykvm_19do.bykvm_19do.bykvm_int108.bykvm_19do.bykvm_byte12b.d.a(SourceFile:3) bykvm_19do.bykvm_19do.bykvm_int108.bykvm_19do.h$a.run(SourceFile:2) android.os.Handler.handleCallback(Handler.java:873) android.os.HandlerThread.run(HandlerThread.java:65)

android.app.ActivityManager.getRunningAppProcesses() com.yl.lib.privacy_proxy.PrivacyProxyCall$Proxy.getRunningAppProcesses(SourceFile:5) bykvm_19do.bykvm_19do.bykvm_19do.m0.a(SourceFile:8) bykvm_19do.bykvm_19do.bykvm_19do.j2.J(SourceFile:2) bykvm_19do.bykvm_19do.bykvm_19do.a.a(SourceFile:13) bykvm_19do.bykvm_19do.bykvm_if122.bykvm_new1.p.b(SourceFile:9) bykvm_19do.bykvm_19do.bykvm_if122.bykvm_new1.p.a(SourceFile:4) bykvm_19do.bykvm_19do.bykvm_if122.bykvm_int108.d$a.run(SourceFile:1)

这两个调用是在同一秒调用的,我看都走到咱们拦截的方法了,咱们拦截的方法是有时间间隔的吧

allenymt commented 2 years ago

getRunningAppProcesses 没做时间间隔控制,可以把拦截方法的配置拷贝出去,SDK默认会用业务方配置的方法去拦截,具体控制逻辑业务方自己实现即可

lijuncai commented 2 years ago

getRunningAppProcesses 没做时间间隔控制,可以把拦截方法的配置拷贝出去,SDK默认会用业务方配置的方法去拦截,具体控制逻辑业务方自己实现即可

哦哦,好的,咱们哪个方法有做时间间隔控制嘛,我参考一下

allenymt commented 2 years ago
  1. 具体配置可以参考这个类 https://github.com/allenymt/PrivacySentry/blob/main/privacy-test/src/main/java/com/yl/lib/privacy_test/PrivacyProxySelfTest2.java

  2. 没有做时间间隔控制的方法哈,这个SDK内部实现 不合适

lijuncai commented 2 years ago
  1. https://github.com/allenymt/PrivacySentry/blob/main/privacy-test/src/main/java/com/yl/lib/privacy_test/PrivacyProxySelfTest2.java

好的,明白,我看这句话“默认拦截隐私方法时间为1分钟,支持自定义设置时间。” 以为已经默认实现了,那我按例子改改

allenymt commented 2 years ago

是我描述的问题,已修改

lijuncai commented 2 years ago

android.provider.Settings$Secure.getString(android.content.ContentResolver,java.lang.String) com.bytedance.sdk.openadsdk.core.u.m(Unknown Source:356) com.bytedance.sdk.openadsdk.core.u.k(Unknown Source:273) com.bytedance.sdk.openadsdk.core.u.c(Unknown Source:101) com.bytedance.sdk.openadsdk.core.q.a.c.q(Unknown Source:130) com.bytedance.sdk.openadsdk.core.q.a.c.a(Unknown Source:116) com.bytedance.sdk.openadsdk.core.q.c.c$2.run(Unknown Source:81) com.bytedance.sdk.component.g.b.run(Unknown Source:35)

android.provider.Settings$Secure.getString(android.content.ContentResolver,java.lang.String) com.bytedance.embedapplog.af.a(Unknown Source:34) com.bytedance.embedapplog.y.d(Unknown Source:189) com.bytedance.embedapplog.m.handleMessage(Unknown Source:168) android.os.HandlerThread.run(HandlerThread.java:65)

我在咨询下,我看大部分AndroidID获取的都拦截了,但是这两个没拦截到,是因为它的代码是动态加载的嘛

allenymt commented 2 years ago

应该是的

lijuncai commented 2 years ago

应该是的

多谢解答,抱拳

allenymt commented 1 year ago

1.2.2 支持多种缓存配置了