为了保护关键代码被逆向分析，一般放在应用程序初始化过程中，如init_array，或jni_onload函数里进行检查代码执行。

1.调试检测

对调试器的检测（ida，gdb,strace, ltrace等调试工具）

a.父进程检测

b.当前运行进程检测

例如对android_server进程检测。针对这种检测只需将android_server改名就可绕过

[objc] view plain copy

pid_t GetPidByName(const charchar *as_name) {

DIR *pdir = NULL;

struct dirent *pde = NULL;

FILEFILE *pf = NULL;

char buff[128];

pid_t pid;

char szName[128];

// 遍历/proc目录下所有pid目录

pdir = opendir("/proc");

if (!pdir) {

perror("open /proc fail.\n");

return -1;

}

while ((pde = readdir(pdir))) {

if ((pde->d_name[0] < '0') || (pde->d_name[0] > '9')) {

continue;

}

sprintf(buff, "/proc/%s/status", pde->d_name);

pf = fopen(buff, "r");

if (pf) {

fgets(buff, sizeof(buff), pf);

fclose(pf);

sscanf(buff, "%*s %s", szName);

pid = atoi(pde->d_name);

if (strcmp(szName, as_name) == 0) {

closedir(pdir);

return pid;

}

}

}

closedir(pdir);

return 0;

}

c.读取进程状态(/proc/pid/status)

State属性值T 表示调试状态，TracerPid 属性值正在调试此进程的pid,在非调试情况下State为S或R, TracerPid等于0

d.读取 /proc/%d/wchan

下图中第一个红色框值为非调试状态值，第二个红色框值为调试状态：

[objc] view plain copy

static void get_process_status(pid_t pid,const char* info,charchar *outline)

{

FILEFILE *fp;

char filename;

char line = {0};

snprintf( filename, sizeof(filename), "/proc/%d/status", pid );

fp = fopen( filename, "r" );

if ( fp != NULL )

{

while ( fgets( line, sizeof(line), fp ) )

{

if ( strstr( line, info ) )

strcpy(outline,line);

}

fclose( fp ) ;

}

return ;

}

static int getProcessStatus(int pid)

{

char readline = {0};

int result = STATUS_ELSE;

get_process_status(pid,"State",readline);

if(strstr(readline,"R"))

result = STATUS_RUNNING;

else if(strstr(readline,"S"))

result = STATUS_SLEEPING;

else if(strstr(readline,"T"))

result = STATUS_TRACING;

return result;

}

static int getTracerPid(int pid)

{

char readline = {0};

int result = INVALID_PID;

get_process_status(pid,"TracerPid",readline);

charchar *pidnum = strstr(readline,":");

result = atoi(pidnum + 1);

return result;

}

static int getWchanStatus(int pid)

{

FILEFILE *fp= NULL;

char filename;

char wchaninfo = {0};

int result = WCHAN_ELSE;

char cmd = {0};

sprintf(cmd,"cat /proc/%d/wchan",pid);

LOGANTI("cmd= %s",cmd);

FILEFILE *ptr; if((ptr=popen(cmd, "r")) != NULL)

{

if(fgets(wchaninfo, 128, ptr) != NULL)

{

LOGANTI("wchaninfo= %s",wchaninfo);

}

}

if(strncasecmp(wchaninfo,"sys_epoll\0",strlen("sys_epoll\0")) == 0)

result = WCHAN_RUNNING;

else if(strncasecmp(wchaninfo,"ptrace_stop\0",strlen("ptrace_stop\0")) == 0)

result = WCHAN_TRACING;

return result;

}

e. ptrace 自身或者fork子进程相互ptrace

[objc] view plain copy

ptrace me

if (ptrace(PTRACE_TRACEME, 0, 1, 0) < 0) {

printf("DEBUGGING... Bye\n");

return 1;

}

void anti_ptrace(void)

{

pid_t child;

child = fork();

if (child)

wait(NULL);

else {

pid_t parent = getppid();

if (ptrace(PTRACE_ATTACH, parent, 0, 0) < 0)

while(1);

sleep(1);

ptrace(PTRACE_DETACH, parent, 0, 0);

exit(0);

}

}

f. 防止dump

利用Inotify机制，对/proc/pid/mem和/proc/pid/pagemap文件进行监视。inotify API提供了监视文件系统的事件机制，可用于监视个体文件，或者监控目录。具体原理可参考：

pages/man7/inotify.7.html

伪代码：

[objc] view plain copy

void __fastcall anitInotify(int flag)

{

MemorPagemap = flag;

charchar *pagemap = "/proc/%d/pagemap";

charchar *mem = "/proc/%d/mem";

pagemap_addr = (charchar *)malloc(0x100u);

mem_addr = (charchar *)malloc(0x100u);

ret = sprintf(pagemap_addr, &pagemap, pid_);

ret = sprintf(mem_addr, &mem, pid_);

if ( !MemorPagemap )

{

ret = pthread_create(&th, 0, (voidvoid *(*)(voidvoid *)) inotity_func, mem_addr);

if ( ret >= 0 )

ret = pthread_detach(th);

}

if ( MemorPagemap == 1 )

{

ret = pthread_create(&newthread, 0, (voidvoid *(*)(voidvoid *)) inotity_func, pagemap_addr);

if(ret > 0)

ret = pthread_detach(th);

}

}

void __fastcall __noreturn inotity_func(const charchar *inotity_file)

{

const charchar *name; // r4@1

signed int fd; // r8@1

bool flag; // zf@3

bool ret; // nf@3

ssize_t length; // r10@3

ssize_t i; // r9@7

fd_set readfds; // @2

char event; // @1

name = inotity_file;

memset(buffer, 0, 0x400u);

fd = inotify_init();

inotify_add_watch(fd, name, 0xFFFu);

while ( 1 )

{

do

{

memset(&readfds, 0, 0x80u);

}

while ( select(fd + 1, &readfds, 0, 0, 0) <= 0 );

length = read(fd, event, 0x400u);

flag = length == 0;

ret = length < 0;

if ( length >= 0 )

{

if ( !ret && !flag )

{

i = 0;

do

{

inotity_kill((int)&event);

i += *(_DWORD *)&event + 16;

}

while ( length > i );

}

}

else

{

while ( *(_DWORD *)_errno() == 4 )

{

length = read(fd, buffer, 0x400u);

flag = length == 0;

ret = length < 0;

if ( length >= 0 )

}

}

}

}

g. 对read做hook

因为一般的内存dump都会调用到read函数，所以对read做内存hook，检测read数据是否在自己需要保护的空间来阻止dump

h. 设置单步调试陷阱

[objc] view plain copy

int handler()

{

return bsd_signal(5, 0);

}

int set_SIGTRAP()

{

int result;

bsd_signal(5, (int)handler);

result = raise(5);

return result;

}