Skip to content

feat(hook): add missing anti-debug and anti-Frida detection methods#5

Open
ZnDong wants to merge 1 commit into1193776794:mainfrom
ZnDong:add-new-debugger-detection-2
Open

feat(hook): add missing anti-debug and anti-Frida detection methods#5
ZnDong wants to merge 1 commit into1193776794:mainfrom
ZnDong:add-new-debugger-detection-2

Conversation

@ZnDong
Copy link

@ZnDong ZnDong commented Feb 19, 2026

Detection method derived from a real-world Chinese banking app, which kills the process immediately upon detection.

  • Add /proc/net/tcp hex port scanning for IDA (0x5D8A=23946) and Frida (0x69A2=27042)
  • Add linjector thread name detection in checkFridaThreads() via both comm and syscall status
  • Add frida-agent-32/frida-agent-64 signatures to memory maps scanning
  • Add /proc/self/fd linjector pipe scanning via syscall(readlinkat)
  • Add linjector to suspicious FD keywords in native-lib.cpp
  • Integrate new detections into detectFrida() combined result and JNI layer
  • Add checkIdaPortTcp/checkFridaPortTcp/checkFridaFdLinjector native methods
  • Update Java-side collectFridaDetails() with TCP port and FD linjector details

- Add /proc/net/tcp hex port scanning for IDA (0x5D8A=23946) and Frida (0x69A2=27042)
- Add linjector thread name detection in checkFridaThreads() via both comm and syscall status
- Add frida-agent-32/frida-agent-64 signatures to memory maps scanning
- Add /proc/self/fd linjector pipe scanning via syscall(readlinkat)
- Add linjector to suspicious FD keywords in native-lib.cpp
- Integrate new detections into detectFrida() combined result and JNI layer
- Add checkIdaPortTcp/checkFridaPortTcp/checkFridaFdLinjector native methods
- Update Java-side collectFridaDetails() with TCP port and FD linjector details
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant