如何破解运动世界校园模拟器检测

大家好，又见面了，我是你们的朋友全栈君。

本文已过时 最新版不可用

最早用安卓上的Packet Capture 抓到http包 只要删除对应模拟器文件就可以
后来变成了https 又对emulatorUrls进行了加密 再追加了几个文件就难倒了一批菜鸡
软件使用360加固 直接逆向难度不小 选择曲线救国
第一次用Flidder的auto responder 直接把emulatorUrls的值清零返回.成功
过段时间压抑不住自己的好奇心 就是想知道它检测了那些文件 遂开始学习用xposed来hook API倒是一猜就中 是java.io.File.exists
根据http://www.52pojie.cn/thread-534126-1-1.html 的教程 先hook360的ClassLoader 就能hook我想要的java.io.File.exists了
函数声明 public boolean exists()
只要hook时param.thisObject.toString().contains(“模拟器文件关键字”) 修改返回值为false

运行效果

全部源码

package com.bc.hook;

import android.content.Context;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;


public class Main implements IXposedHookLoadPackage {
    private String TAG = "BC";

    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
        if (!loadPackageParam.packageName.equals("com.zjwh.android_wh_physicalfitness"))
            return;
        XposedBridge.log("Loaded app: " + loadPackageParam.packageName);
        //hook加固后的包，首先hook getNewAppInstance这个方法来获取context对象
        XposedHelpers.findAndHookMethod("com.qihoo.util.StubApp1211622898", loadPackageParam.classLoader,
                "getNewAppInstance", Context.class, new XC_MethodHook() {
                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                        super.afterHookedMethod(param);
                        //获取到360的Context对象，通过这个对象来获取classloader
                        Context context = (Context) param.args[0];
                        //获取360的classloader，之后hook加固后的就使用这个classloader
                        ClassLoader classLoader = context.getClassLoader();
                        //下面就是强classloader修改成360的classloader就可以成功的hook了
                        XposedHelpers.findAndHookMethod("java.io.File", classLoader, "exists", new XC_MethodHook() {
                            @Override
                            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                                super.beforeHookedMethod(param);
                                XposedBridge.log("被检文件:" + param.thisObject);
                            }

                            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                                super.afterHookedMethod(param);
                                if (param.thisObject.toString().contains("Nox") || param.thisObject.toString().contains("nox") || param.thisObject.toString().contains("stacks") || param.thisObject.toString().contains("Tian") || param.thisObject.toString().contains("tian")) {
                                    param.setResult(false);
                                    XposedBridge.log(TAG + "返回值设为false");
                                }
                                XposedBridge.log(TAG + "返回值: " + param.getResult());
                            }
                        });

                    }
                });
    }
}