radito/SecurityRiskAndroid

# SecurityRiskAndroid

Android 示例应用，用于检测可疑的 runtime 条件，例如 root 痕迹、hooking 框架、Frida 痕迹、debugger 附加、可疑的 memory 映射、ART/Zygote 副作用、package 可见性操纵、mock-location 信号、可疑的 disk/process/port 痕迹、root 辅助诊断信号以及 native 代码篡改。 该项目使用 JNI native 库，并将结果暴露给简单的 Java UI。native 检查器被设计为分层 runtime 风险检测器，而不是单一的 root 检查。root 辅助检查被视为可选的诊断证据，而不是常规的 app-process 视图。 ## 文件结构 ``` app/src/main/cpp/security_checks.c app/src/main/java/com/example/securitysample/SecurityChecker.java app/src/main/java/com/example/securitysample/MainActivity.java app/src/main/AndroidManifest.xml ``` ## 当前 Runtime 模型 检查器使用三个 runtime 路径： ``` FAST_SYNC - Runs immediately when runAllChecks() is called. - Intended to return quickly without blocking the UI for heavy scans. - Produces an immediate score/verdict using cheap or medium-cost checks. DEEP_ASYNC - Runs in one native background worker thread. - Performs heavier ART, package, location, PHDR, disk, process, port, and disk-vs-memory checks. - Result fields are returned as PENDING until the deep worker finishes. - Finished deep results are cached and reused by later runAllChecks() calls. ROOT_ASSISTED_ASYNC - Runs as part of the async diagnostic path when su is available/granted. - Uses a root helper view to inspect /data/adb, module files, process lists, port/socket state, and mounts. - Keeps root-assisted results separate from normal app-process results. - Useful for comparing APP_VIEW versus ROOT_VIEW and detecting hiding/delta behavior. ``` 生命周期示例： ``` First call: SCORE:1|VERDICT:CLEAN|DEEP_SCAN:PENDING|PACKAGE_RISK:PENDING|LOCATION_ENVIRONMENT:PENDING|ROOT_ASSISTED_ASYNC:PENDING|... After deep scan completes: SCORE:8|VERDICT:BLOCK|DEEP_SCAN:CACHED|DEEP_AGE_MS:1234|PACKAGE_RISK:DETECTED|LOCATION_ENVIRONMENT:CLEAN|ROOT_ASSISTED_ASYNC:DENIED|... After root-assisted scan is granted: SCORE:14|VERDICT:BLOCK|DEEP_SCAN:CACHED|ROOT_ASSISTED_ASYNC:GRANTED|ROOT_ASSISTED_MODULES:DETECTED|ROOT_VIEW_DELTA:DETECTED|... ``` Java UI 不需要进行修改即可让 native 检查器返回 `PENDING` 或缓存的值，因为结果仍然以相同的管道分隔字符串形式暴露。 ## 功能 native 检查器目前执行以下检查： ``` Root path visibility detection Root mount visibility detection Xposed / LSPosed / Zygisk / Magisk artifact scan Frida artifact scan Raw syscall /proc/self/maps scan Maps filtering mismatch check Debugger detection via TracerPid Emulator file detection Suspicious executable memory mapping detection RWX memory detection Executable deleted mapping detection Suspicious memfd / ashmem executable mapping detection Normal ART/JIT memfd allowlist Thread name scan File descriptor scan Native symbol owner check Inline hook heuristic check JNI function table owner check JavaVM function table owner check PHDR loaded-module scan Self-entry breakpoint / patch probe Native .text live memory integrity check Disk-vs-memory native library hash check Kernel identity consistency check USB debugging signal check Bootloader / verified boot property check Build/security property check ART bridge class scan ART stack trace scan ART ClassLoader / DexPathList scan ART dex/apk/jar/vdex/oat maps scan Package visibility / HMA-style inconsistency probe Risky package visibility probe Location / mock-location environment probe System framework runtime / service-object sanity check Public storage artifact scan Root-only disk artifact scan Magisk / KernelSU / APatch ZIP module structure scan Risky APK artifact scan Suspicious process scan Suspicious listening port / unix socket scan Root-assisted async diagnostic scan Root view versus app view delta detection Async deep scan worker Deep scan cached result state Native log buffer exposed to Java Java callback support for background detections ``` ## 重要术语 某些检查使用 `CLEAN` 一词，但应谨慎解读。 ``` ROOT_PATHS:CLEAN ROOT_MOUNTS:CLEAN ``` 表示： ``` No root artifact was visible from this app process. ``` 它**并不**证明设备真正未经 root。诸如 Shamiko 之类的工具可能会向目标 app process 隐藏 root 痕迹。 因此，runtime 篡改检查与 root 可见性检查是分开的： ``` ROOT_PATHS / ROOT_MOUNTS - Root visibility signals from this process. ART_BRIDGE_CLASSES / ART_STACK / ART_CLASSLOADER / ART_DEX_MAPS - ART/Zygote/runtime side-effect signals. PACKAGE_RISK / PACKAGE_INCONSISTENCY - Package visibility and hiding-tool behavior signals. LOCATION_ENVIRONMENT - Mock location and location-provider environment signals. FRAMEWORK_RUNTIME - System framework mapping, framework classloader, and framework service-object sanity signals. DISK_PUBLIC_ARTIFACTS / DISK_ROOT_ARTIFACTS / DISK_ZIP_MODULES / DISK_APK_RISK - Disk artifact signals from public storage, root-only paths, Magisk-style ZIP modules, and risky APK names. SUSPICIOUS_PROCESS / SUSPICIOUS_PORTS - Process, TCP listener, and unix socket signals such as Frida, debug servers, sshd/dropbear, Termux SSH, or root daemons. ROOT_ASSISTED_ASYNC / ROOT_VIEW_DELTA - Optional root-assisted diagnostic signals. `ROOT_VIEW_DELTA:DETECTED` means the normal app view looked clean, but the root helper view found evidence. MEMORY_LIVE / MEMORY_DISK - Native library integrity signals. ``` ## 环境要求 推荐环境： ``` Android Studio / Gradle project Android Gradle Plugin 8.x Gradle 8.x NDK 25.x or newer CMake 3.22.1 or newer minSdk 26 or compatible ``` ## CMake 设置 确保 native 库链接了 `log` 和 `dl`。 `CMakeLists.txt` 示例： ``` cmake_minimum_required(VERSION 3.22.1) project(securitysample) add_library( securitysample SHARED security_checks.c ) find_library(log-lib log) target_link_libraries( securitysample ${log-lib} dl ) ``` ## Java Native API `SecurityChecker.java` 加载 native 库并暴露以下方法： ``` public native String runAllChecks(); public native void setCallback(ThreatCallback callback); public native String getNativeLog(); public native void clearNativeLog(); ``` 高级辅助方法： ``` Map getParsedResults(); boolean isCompromised(); ``` ## 用法 在 `MainActivity.java` 中： ``` checker = new SecurityChecker(); checker.setThreatCallback(reason -> { mainHandler.post(() -> updateBgStatus("⚠ BG THREAD: " + reason)); }); Map results = checker.getParsedResults(); String nativeLog = checker.getNativeLog(); ``` App UI 显示： ``` Security check result rows Compromised / clean summary Background threat status Full native log buffer ``` ## 结果字段 常见结果字段： ``` SCORE VERDICT DEEP_SCAN DEEP_AGE_MS ROOT_PATHS ROOT_MOUNTS MAPS_ARTIFACTS MAPS_FILTERED SUSPICIOUS_MAPS DEBUGGER THREADS FDS LINKER_INLINE USB_DEBUGGING BOOTLOADER_UNLOCKED BUILD_PROPS KERNEL_IDENTITY JNI_TABLE JVM_TABLE MODULES SELF_BREAKPOINTS ART_BRIDGE_CLASSES ART_STACK ART_CLASSLOADER ART_DEX_MAPS PACKAGE_RISK PACKAGE_INCONSISTENCY LOCATION_ENVIRONMENT FRAMEWORK_RUNTIME DISK_PUBLIC_ARTIFACTS DISK_ROOT_ARTIFACTS DISK_ZIP_MODULES DISK_APK_RISK SUSPICIOUS_PROCESS SUSPICIOUS_PORTS ROOT_ASSISTED_ASYNC ROOT_ASSISTED_ROOT_VIEW ROOT_ASSISTED_MODULES ROOT_ASSISTED_PROCESS ROOT_ASSISTED_PORTS ROOT_VIEW_DELTA EMULATOR MEMORY_LIVE MEMORY_DISK ``` 可能的状态值包括： ``` CLEAN DETECTED HOOKED TAMPERED MISMATCH PENDING CACHED RUNNING_CACHED GRANTED DENIED TIMEOUT UNAVAILABLE NOT_RUN SKIPPED ERROR ``` ## 输出示例 深度扫描仍在运行时的初始快速结果： ``` SCORE:1|VERDICT:CLEAN|DEEP_SCAN:PENDING|ROOT_PATHS:CLEAN|ROOT_MOUNTS:CLEAN|MAPS_ARTIFACTS:CLEAN|SUSPICIOUS_MAPS:CLEAN|DEBUGGER:CLEAN|USB_DEBUGGING:DETECTED|JNI_TABLE:CLEAN|JVM_TABLE:CLEAN|ART_CLASSLOADER:PENDING|PACKAGE_RISK:PENDING|LOCATION_ENVIRONMENT:PENDING|DISK_ROOT_ARTIFACTS:PENDING|SUSPICIOUS_PROCESS:PENDING|SUSPICIOUS_PORTS:PENDING|ROOT_ASSISTED_ASYNC:PENDING|MEMORY_DISK:PENDING| ``` 后续缓存的深度结果： ``` SCORE:14|VERDICT:BLOCK|DEEP_SCAN:CACHED|DEEP_AGE_MS:1420|ROOT_PATHS:CLEAN|ROOT_MOUNTS:CLEAN|MAPS_ARTIFACTS:CLEAN|MAPS_FILTERED:CLEAN|SUSPICIOUS_MAPS:CLEAN|DEBUGGER:CLEAN|JNI_TABLE:CLEAN|JVM_TABLE:CLEAN|ART_BRIDGE_CLASSES:CLEAN|ART_STACK:CLEAN|ART_CLASSLOADER:DETECTED|ART_DEX_MAPS:DETECTED|PACKAGE_RISK:DETECTED|PACKAGE_INCONSISTENCY:DETECTED|LOCATION_ENVIRONMENT:CLEAN|DISK_ROOT_ARTIFACTS:DETECTED|SUSPICIOUS_PROCESS:DETECTED|SUSPICIOUS_PORTS:CLEAN|ROOT_ASSISTED_ASYNC:GRANTED|ROOT_ASSISTED_MODULES:DETECTED|ROOT_VIEW_DELTA:DETECTED|MEMORY_LIVE:CLEAN|MEMORY_DISK:CLEAN| ``` Native 日志输出： ``` 1718520000000 [I] pid=12345 tid=12345 Security JNI loaded: VERBOSE=1 log_buffer=262144 bytes 1718520000012 [I] pid=12345 tid=12345 runAllChecks fast path begin 1718520000028 [I] pid=12345 tid=12345 deep scan worker started 1718520000030 [I] pid=12345 tid=12345 [manual] SCORE=1 VERDICT=CLEAN DEEP_SCAN=PENDING 1718520001460 [I] pid=12345 tid=12346 ART ClassLoader chain: depth=0 class=dalvik.system.PathClassLoader 1718520001580 [I] pid=12345 tid=12346 Suspicious listening port signal: port=27042 risk=strong 1718520001600 [I] pid=12345 tid=12346 Root-assisted su granted: output_bytes=32768 1718520001610 [I] pid=12345 tid=12346 Root-assisted module/root artifact signal visible 1718520001620 [I] pid=12345 tid=12346 deep scan worker completed: score=14 verdict=BLOCK ``` ## Runtime 开销 预期的 runtime 取决于设备速度、已加载库的数量、已安装 package 的数量、框架映射的数量、文件描述符的数量、公共存储大小、process 可见性、port/socket 可见性，以及 hooking/hiding 框架是否正在过滤 API 结果。root 辅助扫描也可能等待 superuser 提示、拒绝或超时。 预计耗时： ``` JNI_OnLoad baseline: 1–20 ms FAST_SYNC runAllChecks(): Target under 100–200 ms on typical devices May be higher on old or heavily hooked devices DEEP_ASYNC worker: Usually hundreds of ms to a few seconds Can be slower when PackageManager, LocationManager, ART reflection, disk scans, process scans, port scans, or /proc scans are hooked or heavily filtered ROOT_ASSISTED_ASYNC: May return quickly if su is unavailable or denied May take several seconds if a root manager prompt is shown or the request times out ``` 推荐的生产环境模式： ``` Startup: - initialize JNI - run fast checks only - return PENDING for heavy fields After UI is visible: - allow deep async worker to finish - update UI, log, or internal risk state Before sensitive action: - reuse cached deep result if fresh - rerun selected deep checks if stale - treat root-assisted data as diagnostic evidence, especially when APP_VIEW and ROOT_VIEW disagree Background: - periodically or randomly run selected checks - avoid full heavy scans on every frame or click ``` 避免在第一个渲染帧上执行繁重的全量扫描。 ## 风险评分 检查器采用基于评分的方法，而不是依赖于单一信号。 示例： ``` score >= 8 → BLOCK score >= 4 → WARNING score < 4 → CLEAN ``` 与立即基于单一可疑痕迹进行拦截相比，这减少了误报。 该项目处理不同权重的信号： ``` Strong signals: - Memory hash mismatch - JNI / JavaVM table pointer outside libart - Frida/Gum thread or fd artifact - Suspicious foreign executable memfd - Foreign module dex/apk loaded into app runtime - Package visibility inconsistency - Root-assisted module/root artifact visibility - Root view delta between app process view and root helper view - Frida/debug/root daemon process or port signal Medium signals: - Suspicious maps artifact - PHDR/maps mismatch - ART stack or classloader anomaly - Location/mock environment anomaly - SSH/dropbear/Termux SSH process or listener - Magisk-style ZIP module or risky APK artifact Weak signals: - USB debugging enabled - Developer options indicator - Emulator-like file presence - Some build property anomalies - Termux process without sshd/dropbear or other stronger companion signals ``` ## 重要安全说明 本项目可用作概念验证以及分层防御策略的一部分。 不应将其视为无法绕过。 高级攻击者仍可能通过以下方式绕过检测： ``` Renaming artifacts Filtering /proc output Hooking native functions Patching JNI return values Patching the app binary Running the app inside a controlled environment Disabling background threads Modifying the checker logic Hooking PackageManager / LocationManager / Settings APIs Returning fake clean values from Java/ART calls Patching the risk score or verdict generation Denying, delaying, or faking root-assisted diagnostic output ``` 为了获得更强的保护，请将其与以下内容结合使用： ``` Server-side validation Play Integrity API Hardware-backed attestation when available Certificate pinning Native-side sensitive logic Obfuscation Anti-tamper checks Runtime challenge-response Short-lived server nonce Multiple independent detection paths Delayed or randomized enforcement ``` 不要仅依赖 `runAllChecks()` 的 Java 返回值，因为 Java 方法可能会被 hook。同时，也不要将 `SU_DENIED` 视为设备干净的证明；它仅表示未授予 root 辅助诊断路径的权限。 对于强化构建： ``` Set VERBOSE=0 Strip native symbols Hide symbol visibility Avoid exposing exact detection reasons Avoid storing sensitive secrets in JNI Avoid making one final return string the only enforcement point Use server-side challenge-response for important decisions Keep root-assisted checks opt-in or diagnostic in research builds ``` ## 免责声明 本项目用于防御性测试、学习和应用强化。 它不是一个完整的反篡改或反 hooking 解决方案。请将其作为更广泛的安全设计中的一层来使用。

标签：AMSI绕过, Android安全, Bash脚本, C/C++, JS文件枚举, UML, URL发现, 事务性I/O, 后台面板检测, 威胁检测, 安全检测, 客户端加密, 目录枚举, 移动安全, 运行环境安全, 逆向分析