root 检测

1. root管理apk检测

/system/etc/init.d/99SuperSUDaemon
/data/data/com.topjohnwu.magisk
/sdcard/MagiskManager

2. shell 执行su命令 Runtime.getRuntime().exec("su");

3. grep:

build.fingerprint   test-keys
Build.TAGS  test-keys
ro.debuggable 1
ro.secure    0
ro.adb.secure 0

4. new File(snext).exists() 文件是否存在 ls -l 判断是否有 sx权限

"/sbin/su",
"/system/bin/su",
"/system/sbin/su",
"/system/xbin/su",
"/data/local/xbin/su",
"/data/local/bin/su",
"/system/sd/xbin/su",
"/system/bin/failsafe/su",
"/data/local/su",
"/su/bin/su",
"/vendor/bin/su"

5. busybox是否存在

String str = "/system/xbin/busybox";
String str1 = "/system/sbin/busybox";
if (new File("/system/bin/busybox").exists()) {    
    return true;
}    

6. /root 路径是否有文件

模拟器检测

1. pipe检测
   /dev/socket/qemud /dev/qemu_pipe是否存在

2. QEmuDriverFile驱动文件检测
   /proc/tty/drivers 是否含有 goldfish字段

3. cpu信息检测
   /system/bin/cat /proc/cpuinfo cat 查看是否含有intel 且不包含 atom

4. 判断deviceid imei
   context.getSystemService("phone").getDeviceId() 000000000000000
   context.getSystemService("phone").getSubscriberId() 310260000000000
   大概率为模拟器

5. 手机号判断

6. 可否发送短信、拨打电话

Intent intent = new Intent();
intent.setData(Uri.parse("tel:10086"));//smsto:10086
intent.setAction("android.intent.action.DIAL");//intent.setAction("android.intent.action.VIEW");
int vi = (intent.resolveActivity(p0.getPackageManager()) != null)? 1: 0;    

7. 模拟器app判断

"com.microvirt.launcher2",
"com.microvirt.launcher.Launcher"

8. 传感器是否存在判断

hook框架检测

1. 查看自身进程的虚拟内存 /proc/{pid}/maps 是否加载了frame特征文件

com.saurik.substrate
XposedBridge.jar
me.weishu.exp  （Taichi）

2. xposed
   反射获取de.robv.android.xposed.XposedHelpers中methodCache，查看已加载的hook的类是否有自己的关键类。
   从PackageInfo中获取是否存在包名为de.robv.android.xposed.installer

3.检测常见路径/data/local/tmp

frida-server ---frida
hijack    ---ADBI
libstrmon     ---DDI

4. 打印堆栈

Substrate    com.android.internal.os.ZygoteInit
Substrate    com.saurik.substrate.MS$2        方法： invoked
Xposed    de.robv.android.xposed.XposedBridge    方法：main handleHookedMethod
EdXposed EdHooker_               方法： hook
TaiChi    me.weishu.epic

原文链接：https://blog.csdn.net/weixin_43922321/article/details/120001888