strazzere / anti-emulator Goto Github PK

View Code? Open in Web Editor NEW

770.0 770.0 220.0 2.17 MB

Android Anti-Emulator

License: Apache License 2.0

Makefile 1.06% C 6.33% Java 92.60%

android anti-emulation emulator java malware reverse-engineering

anti-emulator's People

Contributors

Stargazers

Watchers

Forkers

0bj3ct jacobsoo yike8 coc360 9hao ali-zohrevand bincker tempbottle jevey gyreg sandiegoxu ocean-feng bootuikey jokerni ytnbfirewings liubaishui projectdev100 halfkiss liyun1030 vaginessa android-sec illahaha anymarvel tdqtdq heart2009 goodhacker k5h4tr1y4 fancyfon secpersu burningcodes ilocker16 pkm1118 futurelighthouse agile6v jmdebugger thoinv pingia benbon home201448 kerasking weiyirong lixiang21 wyyl1 gcoldcoffee zekn junky228 ajrulez richardy2012 shuixi2013 micxu chanderwoo taituo87 martinzheng00 leeflora loriyzmdog nightoftwelve yeshengwu quantmod hl46000 guanleustc meluo s3curity-er1c thomasking2014 tangsilian doduytrung kyuhlee voraka jeperez yzygitzh oasis2008 oscommonjs funagi kkwhy hutianqi kidundead combat1964 f0r34chb3t4 adpushpop crackercat android-sec01 jack51706 bbsyaya primekun andyhao567 badforlabor secice debugpro jwc0310 motazalnuweiri binaryninja midoxnet madclient robertchow exiahan drbridge sofsirwj ld2006203 lingkeyang hobbit19 octacode

anti-emulator's Issues

HasQEmuFiles returning true on Real Device

Hi, I have problem on real device. Method HasQEmuFiles in FindEmulator.java return true on real device.
devices: Samsung s8(android 7.), Galaxy S7 edge(android 8), Galaxy S7 edge(android 8). Devices was reset to factory but still return true.

Crash in arm64-v8a devices

As the title says, the app crashes immediately in this line (I think).

Perhaps it is related to #12? Any ideas? :)

Reproduction steps are simple: Just try to run the app in any arm64-v8a powered device.

E/ion: ioctl c0044901 failed with code -1: Invalid argument
E/AndroidRuntime: FATAL EXCEPTION: Thread-2
    Process: diff.strazzere.anti, PID: 29146
    java.lang.UnsatisfiedLinkError: dalvik.system.PathClassLoader[DexPathList[[zip file "/data/app/diff.strazzere.anti-73jbD1oseRECGqZbKcNMfg==/base.apk"],nativeLibraryDirectories=[/data/app/diff.strazzere.anti-73jbD1oseRECGqZbKcNMfg==/lib/arm64, /system/lib64]]] couldn't find "libanti.so"
        at java.lang.Runtime.loadLibrary0(Runtime.java:1012)
        at java.lang.System.loadLibrary(System.java:1669)
        at diff.strazzere.anti.emulator.FindEmulator.<clinit>(FindEmulator.java:67)
        at diff.strazzere.anti.emulator.FindEmulator.hasKnownDeviceId(FindEmulator.java:170)
        at diff.strazzere.anti.MainActivity.isQEmuEnvDetected(MainActivity.java:45)
        at diff.strazzere.anti.MainActivity$1.run(MainActivity.java:30)

Unknown error/crash on pixel4

06-17 13:30:18.482 16626 16626 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
06-17 13:30:18.483 16626 16626 F DEBUG   : Build fingerprint: 'google/flame/flame:10/QQ3A.200605.001/6392402:user/release-keys'
06-17 13:30:18.483 16626 16626 F DEBUG   : Revision: 'MP1.0'
06-17 13:30:18.483 16626 16626 F DEBUG   : ABI: 'arm64'
06-17 13:30:18.483 16626 16626 F DEBUG   : Timestamp: 2020-06-17 13:30:18-0700
06-17 13:30:18.483 16626 16626 F DEBUG   : pid: 16620, tid: 16620, name: Thread-2  >>> diff.strazzere.anti <<<
06-17 13:30:18.483 16626 16626 F DEBUG   : uid: 10313
06-17 13:30:18.483 16626 16626 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x753c30f108
06-17 13:30:18.483 16626 16626 F DEBUG   :     x0  0000000000000000  x1  000000753c30f0f0  x2  0000000000000018  x3  000000753c30f108
06-17 13:30:18.483 16626 16626 F DEBUG   :     x4  0000000000000001  x5  0000000000000000  x6  0000007536f3a200  x7  0000000000000000
06-17 13:30:18.483 16626 16626 F DEBUG   :     x8  0000000000000000  x9  169b0e20c9ac40e0  x10 0000000000000018  x11 0000000000000008
06-17 13:30:18.483 16626 16626 F DEBUG   :     x12 000000753c30f0f0  x13 000000753c30f108  x14 00000075471402cc  x15 0000000000000000
06-17 13:30:18.483 16626 16626 F DEBUG   :     x16 00000075cb2ad120  x17 00000075cb273f10  x18 00000074de6f6000  x19 00000075cc428f00
06-17 13:30:18.483 16626 16626 F DEBUG   :     x20 0000000000000001  x21 000000753c30f108  x22 000000753c30f0f0  x23 0000007536f3a200
06-17 13:30:18.483 16626 16626 F DEBUG   :     x24 00000075cb26c97c  x25 0000000000000018  x26 0000000000007204  x27 0000000080047204
06-17 13:30:18.483 16626 16626 F DEBUG   :     x28 0000000000000001  x29 0000007536efa230
06-17 13:30:18.483 16626 16626 F DEBUG   :     sp  0000007536efa1f0  lr  00000075cb27c33c  pc  00000075cb27c364
06-17 13:30:18.712  3108  3108 D ImageWallpaper: wallpaper visibility changes to: false
06-17 13:30:18.715   615   615 E Layer   : [Surface(name=AppWindowToken{a824dad token=Token{7331ac4 ActivityRecord{cd721d7 u0 diff.strazzere.anti/.MainActivity t13156}}})/@0x90fc806 - animation-leash#0] No local sync point found
06-17 13:30:18.715   615   615 E Layer   : [Surface(name=AppWindowToken{a824dad token=Token{7331ac4 ActivityRecord{cd721d7 u0 diff.strazzere.anti/.MainActivity t13156}}})/@0x90fc806 - animation-leash#0] No local sync point found
06-17 13:30:18.715   615   615 E Layer   : [Surface(name=AppWindowToken{a5cc453 token=Token{5444c42 ActivityRecord{a1c528d u0 com.google.android.apps.nexuslauncher/.NexusLauncherActivity t12774}}})/@0x1174a0c - animation-leash#0] No local sync point found
06-17 13:30:18.739 16626 16626 F DEBUG   : 
06-17 13:30:18.739 16626 16626 F DEBUG   : backtrace:
06-17 13:30:18.740 16626 16626 F DEBUG   :       #00 pc 0000000000069364  /system/lib64/libbinder.so (android::Parcel::ipcSetDataReference(unsigned char const*, unsigned long, unsigned long long const*, unsigned long, void (*)(android::Parcel*, unsigned char const*, unsigned long, unsigned long long const*, unsigned long, void*), void*)+96) (BuildId: 3b3157019df8c6095f4884ba25e5c04f)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #01 pc 0000000000059334  /system/lib64/libbinder.so (android::IPCThreadState::waitForResponse(android::Parcel*, int*)+528) (BuildId: 3b3157019df8c6095f4884ba25e5c04f)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #02 pc 0000000000058efc  /system/lib64/libbinder.so (android::IPCThreadState::transact(int, unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+180) (BuildId: 3b3157019df8c6095f4884ba25e5c04f)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #03 pc 000000000004df38  /system/lib64/libbinder.so (android::BpBinder::transact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+72) (BuildId: 3b3157019df8c6095f4884ba25e5c04f)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #04 pc 00000000001484ec  /system/lib64/libandroid_runtime.so (android_os_BinderProxy_transact(_JNIEnv*, _jobject*, int, _jobject*, _jobject*, int)+152) (BuildId: a4deef8d84f80b74d5707e20f76e8091)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #05 pc 00000000002c2434  /system/framework/arm64/boot-framework.oat (art_jni_trampoline+196) (BuildId: 8dd360e7ac2513f6c21e6f05c4163646b3e394be)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #06 pc 0000000000136334  /apex/com.android.runtime/lib64/libart.so (art_quick_invoke_stub+548) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #07 pc 000000000014506c  /apex/com.android.runtime/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+244) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #08 pc 00000000002df0d4  /apex/com.android.runtime/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+384) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #09 pc 00000000002da3b4  /apex/com.android.runtime/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+912) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #10 pc 0000000000597844  /apex/com.android.runtime/lib64/libart.so (MterpInvokeVirtual+648) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #11 pc 0000000000130814  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #12 pc 00000000002eaa8c  /system/framework/framework.jar (android.os.BinderProxy.transact+216)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #13 pc 0000000000599348  /apex/com.android.runtime/lib64/libart.so (MterpInvokeInterface+1740) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #14 pc 0000000000130a14  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_interface+20) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #15 pc 000000000032a978  /system/framework/framework.jar (android.os.ServiceManagerProxy.getService+40)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #16 pc 0000000000599348  /apex/com.android.runtime/lib64/libart.so (MterpInvokeInterface+1740) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #17 pc 0000000000130a14  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_interface+20) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #18 pc 000000000032ac1c  /system/framework/framework.jar (android.os.ServiceManager.rawGetService+24)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #19 pc 000000000059a6f0  /apex/com.android.runtime/lib64/libart.so (MterpInvokeStatic+1136) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #20 pc 0000000000130994  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #21 pc 000000000032ab92  /system/framework/framework.jar (android.os.ServiceManager.getService+22)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #22 pc 000000000059a6f0  /apex/com.android.runtime/lib64/libart.so (MterpInvokeStatic+1136) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #23 pc 0000000000130994  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #24 pc 00000000004660f6  /system/framework/framework.jar (android.telephony.TelephonyManager.getITelephony+6)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #25 pc 0000000000599ee4  /apex/com.android.runtime/lib64/libart.so (MterpInvokeDirect+1168) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #26 pc 0000000000130914  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_direct+20) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #27 pc 00000000004678fa  /system/framework/framework.jar (android.telephony.TelephonyManager.getDeviceId+2)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #28 pc 0000000000597b54  /apex/com.android.runtime/lib64/libart.so (MterpInvokeVirtual+1432) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #29 pc 0000000000130814  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #30 pc 0000000000001d92  [anon:dalvik-classes2.dex extracted in memory from /data/app/diff.strazzere.anti-A7BVdpvAnCWut3H_s81xAA==/base.apk!classes2.dex] (diff.strazzere.anti.emulator.FindEmulator.hasKnownDeviceId+18)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #31 pc 000000000059a6f0  /apex/com.android.runtime/lib64/libart.so (MterpInvokeStatic+1136) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #32 pc 0000000000130994  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #33 pc 0000000000001532  [anon:dalvik-classes2.dex extracted in memory from /data/app/diff.strazzere.anti-A7BVdpvAnCWut3H_s81xAA==/base.apk!classes2.dex] (diff.strazzere.anti.MainActivity.isQEmuEnvDetected+626)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #34 pc 0000000000597b54  /apex/com.android.runtime/lib64/libart.so (MterpInvokeVirtual+1432) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #35 pc 0000000000130814  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #36 pc 00000000000011c8  [anon:dalvik-classes2.dex extracted in memory from /data/app/diff.strazzere.anti-A7BVdpvAnCWut3H_s81xAA==/base.apk!classes2.dex] (diff.strazzere.anti.MainActivity$1.run+40)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #37 pc 00000000002afd20  /apex/com.android.runtime/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEbb.llvm.1271440803783865717+240) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #38 pc 0000000000588e8c  /apex/com.android.runtime/lib64/libart.so (artQuickToInterpreterBridge+1012) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #39 pc 000000000013f468  /apex/com.android.runtime/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #40 pc 0000000000136334  /apex/com.android.runtime/lib64/libart.so (art_quick_invoke_stub+548) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #41 pc 000000000014506c  /apex/com.android.runtime/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+244) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #42 pc 00000000004a9110  /apex/com.android.runtime/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #43 pc 00000000004aa1a4  /apex/com.android.runtime/lib64/libart.so (art::InvokeVirtualOrInterfaceWithJValues(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue const*)+416) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #44 pc 00000000004e9f3c  /apex/com.android.runtime/lib64/libart.so (art::Thread::CreateCallback(void*)+1176) (BuildId: f9ff276075287a1d376fcd141f6042aa)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #45 pc 00000000000e10a0  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+36) (BuildId: 8de865099c99977483c8947f9b7937e9)
06-17 13:30:18.740 16626 16626 F DEBUG   :       #46 pc 0000000000083ab0  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 8de865099c99977483c8947f9b7937e9)

Samsung note4 special file

"/system/bin/qemu-props" this file is exist in Samsung note 4.

FATAL EXCEPTION on System.loadLibrary("anti");

The app crashes on
System.loadLibrary("anti");
in FindEmulator.java

Handle file unacceptable in new version of android

06-17 13:30:18.405 16594 16618 W System.err: java.io.FileNotFoundException: /proc/net/tcp: open failed: EACCES (Permission denied)
06-17 13:30:18.405 16594 16618 W System.err:    at libcore.io.IoBridge.open(IoBridge.java:496)
06-17 13:30:18.405 16594 16618 W System.err:    at java.io.FileInputStream.<init>(FileInputStream.java:159)
06-17 13:30:18.405 16594 16618 W System.err:    at java.io.FileInputStream.<init>(FileInputStream.java:115)
06-17 13:30:18.405 16594 16618 W System.err:    at diff.strazzere.anti.debugger.FindDebugger.hasAdbInEmulator(FindDebugger.java:70)
06-17 13:30:18.405 16594 16618 W System.err:    at diff.strazzere.anti.emulator.FindEmulator.hasEmulatorAdb(FindEmulator.java:247)
06-17 13:30:18.405 16594 16618 W System.err:    at diff.strazzere.anti.MainActivity.isQEmuEnvDetected(MainActivity.java:54)
06-17 13:30:18.405 16594 16618 W System.err:    at diff.strazzere.anti.MainActivity$1.run(MainActivity.java:30)
06-17 13:30:18.405 16594 16618 W System.err: Caused by: android.system.ErrnoException: open failed: EACCES (Permission denied)
06-17 13:30:18.405 16594 16618 W System.err:    at libcore.io.Linux.open(Native Method)
06-17 13:30:18.405 16594 16618 W System.err:    at libcore.io.ForwardingOs.open(ForwardingOs.java:167)
06-17 13:30:18.405 16594 16618 W System.err:    at libcore.io.BlockGuardOs.open(BlockGuardOs.java:252)
06-17 13:30:18.405 16594 16618 W System.err:    at libcore.io.ForwardingOs.open(ForwardingOs.java:167)
06-17 13:30:18.405 16594 16618 W System.err:    at android.app.ActivityThread$AndroidOs.open(ActivityThread.java:7255)
06-17 13:30:18.405 16594 16618 W System.err:    at libcore.io.IoBridge.open(IoBridge.java:482)
06-17 13:30:18.399 16594 16594 W Thread-2: type=1400 audit(0.0:393745): avc: denied { read } for name="drivers" dev="proc" ino=4026531853 scontext=u:r:untrusted_app:s0:c57,c257,c512,c768 tcontext=u:object_r:proc_tty_drivers:s0 tclass=file permissive=0
06-17 13:30:18.405 16594 16618 W System.err:    ... 6 more
06-17 13:30:18.405 16594 16618 W System.err: java.lang.NullPointerException: Attempt to invoke virtual method 'void java.io.BufferedReader.close()' on a null object reference
06-17 13:30:18.405 16594 16618 W System.err:    at diff.strazzere.anti.debugger.FindDebugger.hasAdbInEmulator(FindDebugger.java:103)
06-17 13:30:18.405 16594 16618 W System.err:    at diff.strazzere.anti.emulator.FindEmulator.hasEmulatorAdb(FindEmulator.java:247)
06-17 13:30:18.405 16594 16618 W System.err:    at diff.strazzere.anti.MainActivity.isQEmuEnvDetected(MainActivity.java:54)
06-17 13:30:18.405 16594 16618 W System.err:    at diff.strazzere.anti.MainActivity$1.run(MainActivity.java:30)

From a pixel 4

EmulatorDetection

I'm interested in what you're doing here.. Sorry for opening an issue, wasn't sure of a better way to contact you for something like this: I did some emulator detection stuff awhile back you may be interested in: https://github.com/Fuzion24/AndroidEmulatorDetection

detect emulator using the specific files

Hi, @strazzere

I found the following files and directories can detect emulator，they can be added to the code?

"/data/youwave_id"
"/dev/vboxguest"
"/dev/vboxuser"
"/fstab.vbox86"
"/init.vbox86.rc"
"/system/lib/vboxguest.ko"
"/system/lib/vboxsf.ko"
"/system/lib/vboxvideo.ko"
"/system/usr/idc/androVM_Virtual_Input.idc"
"/system/usr/keylayout/androVM_Virtual_Input.kl"
"/system/xbin/mount.vboxsf"
"/ueventd.vbox86.rc"
"/system/lib/hw/audio.primary.vbox86.so"
"/system/lib/hw/camera.vbox86.so"
"/system/lib/hw/gps.vbox86.so"
"/system/lib/hw/gralloc.vbox86.so"
"/system/lib/hw/sensors.vbox86.so"
"/data/app/com.bluestacks.appmart-1.apk"
"/data/app/com.bluestacks.BstCommandProcessor-1.apk"
"/data/app/com.bluestacks.help-1.apk"
"/data/app/com.bluestacks.home-1.apk"
"/data/app/com.bluestacks.s2p-1.apk"
"/data/app/com.bluestacks.searchapp-1.apk"
"/data/bluestacks.prop"
"/data/data/com.androVM.vmconfig"
"/data/data/com.bluestacks.accelerometerui"
"/data/data/com.bluestacks.appfinder"
"/data/data/com.bluestacks.appmart"
"/data/data/com.bluestacks.appsettings"
"/data/data/com.bluestacks.BstCommandProcessor"
"/data/data/com.bluestacks.bstfolder"
"/data/data/com.bluestacks.help"
"/data/data/com.bluestacks.home"
"/data/data/com.bluestacks.s2p"
"/data/data/com.bluestacks.searchapp"
"/data/data/com.bluestacks.settings"
"/data/data/com.bluestacks.setup"
"/data/data/com.bluestacks.spotlight"
"/mnt/prebundledapps/bluestacks.prop.orig"
"/mnt/prebundledapps/propfiles/ics.bluestacks.prop.note"
"/mnt/prebundledapps/propfiles/ics.bluestacks.prop.s2"
"/mnt/prebundledapps/propfiles/ics.bluestacks.prop.s3"
"/mnt/sdcard/bstfolder/InputMapper/com.bluestacks.appmart.cfg"
"/mnt/sdcard/buildroid-gapps-ics-20120317-signed.tgz"
"/mnt/sdcard/windows/InputMapper/com.bluestacks.appmart.cfg"
"/proc/irq/9/vboxguest"
"/sys/bus/pci/drivers/vboxguest"
"/sys/bus/pci/drivers/vboxguest/0000:00:04.0"
"/sys/bus/pci/drivers/vboxguest/bind"
"/sys/bus/pci/drivers/vboxguest/module"
"/sys/bus/pci/drivers/vboxguest/new_id"
"/sys/bus/pci/drivers/vboxguest/remove_id"
"/sys/bus/pci/drivers/vboxguest/uevent"
"/sys/bus/pci/drivers/vboxguest/unbind"
"/sys/bus/platform/drivers/qemu_pipe"
"/sys/bus/platform/drivers/qemu_trace"
"/sys/class/bdi/vboxsf-c"
"/sys/class/misc/vboxguest"
"/sys/class/misc/vboxuser"
"/sys/devices/virtual/bdi/vboxsf-c"
"/sys/devices/virtual/misc/vboxguest"
"/sys/devices/virtual/misc/vboxguest/dev"
"/sys/devices/virtual/misc/vboxguest/power"
"/sys/devices/virtual/misc/vboxguest/subsystem"
"/sys/devices/virtual/misc/vboxguest/uevent"
"/sys/devices/virtual/misc/vboxuser"
"/sys/devices/virtual/misc/vboxuser/dev"
"/sys/devices/virtual/misc/vboxuser/power"
"/sys/devices/virtual/misc/vboxuser/subsystem"
"/sys/devices/virtual/misc/vboxuser/uevent"
"/sys/module/vboxguest/"
"/sys/module/vboxsf/"
"/sys/module/vboxvideo/"
"/system/app/bluestacksHome.apk"
"/system/bin/androVM-prop"
"/system/bin/androVM-vbox-sf"
"/system/bin/androVM_setprop"
"/system/bin/get_androVM_host"
"/system/bin/mount.vboxsf"
"/system/etc/init.androVM.sh"
"/system/etc/init.buildroid.sh"
"/system/lib/modules/3.0.8-android-x86+/extra/vboxguest"
"/system/lib/modules/3.0.8-android-x86+/extra/vboxguest/vboxguest.ko"
"/system/lib/modules/3.0.8-android-x86+/extra/vboxsf"
"/system/lib/modules/3.0.8-android-x86+/extra/vboxsf/vboxsf.ko"
"/ueventd.android_x86.rc"

found debug .so in real device

I am here again..
found "libc_malloc_debug_qemu.so" in /system/lib in some ROMs like CyanogenMod...
I just simply remove this file in the "knowns file array" to let the detection work

hasAdbInEmulator misfires (or logic is wrong?) for tcpip adb connections

V/AntiEmulator(15537): Checking for QEmu env...
V/AntiEmulator(15537): hasKnownDeviceId : false
V/AntiEmulator(15537): hasKnownPhoneNumber : false
V/AntiEmulator(15537): isOperatorNameAndroid : false
V/AntiEmulator(15537): hasKnownImsi : false
V/AntiEmulator(15537): hasEmulatorBuild : false
V/AntiEmulator(15537): hasPipes : false
V/AntiEmulator(15537): hasQEmuDriver : false
V/AntiEmulator(15537): hasQEmuFiles : false
V/AntiEmulator(15537): hasGenyFiles : false
V/AntiEmulator(15537): hasEmulatorAdb :true
V/AntiEmulator(15537): hitsQemuBreakpoint : false
V/AntiEmulator(15537): QEmu environment detected.

shell@hammerhead:/ $ cat /proc/net/tcp
  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode                                                     
   0: 00000000:15B3 00000000:0000 0A 00000000:00000000 00:00000000 00000000  2000        0 106221 1 00000000 100 0 0 10 -1                           
   1: 2901A8C0:A572 33DB1CB8:01BB 01 00000000:00000000 00:00000000 00000000 10095        0 106752 1 00000000 22 4 32 10 -1                           
   2: 2901A8C0:15B3 5E01A8C0:889E 01 00000018:00000000 01:00000014 00000000  2000        0 109277 3 00000000 21 4 29 10 -1                           
   3: 2901A8C0:DAE7 2D00D9AC:01BB 08 00000000:0000026D 00:00000000 00000000 10022        0 24576 1 00000000 21 4 30 10 -1                            
   4: 2901A8C0:C6F4 D088592F:01BB 09 00000001:00000000 01:000007E2 00000007     0        0 0 2 00000000 3584 4 14 2 7                                
   5: 2901A8C0:9A34 3BDB1CB8:01BB 01 00000000:00000000 00:00000000 00000000 10095        0 109637 1 00000000 21 4 33 10 -1

Two licenses

One is GPL, the other Apache 2.0
https://github.com/strazzere/anti-emulator/blob/master/LICENSE.txt
https://github.com/strazzere/anti-emulator/blob/master/LICENSE

why using "==" to compare String in class /FindEmulator.java?

public static boolean hasEmulatorBuild(Context context) {
//...
if ((BOARD == "unknown") || (BOOTLOADER == "unknown") || (BRAND == "generic") || (DEVICE == "generic")
|| (MODEL == "sdk") || (PRODUCT == "sdk") || (HARDWARE == "goldfish"))
/...
}

why using "==" here? Looks like it will always return false...
And I found BOOTLOADER is 'unknown' in some deivces with "other" ROM...

[Q] Manifest - MaxSdkVersion

HI, i have a question.

Is there any reason for this attribute in manifest?

anti-emulator/AntiEmulator/AndroidManifest.xml

Line 8 in 81973a6

android:maxSdkVersion="29" />

Thanks

Distribute library

Hi, thanks for all your hard work! I was wondering if you have any plans / if it's possible to distribute this library through Maven or any other dependency system.

I would like to make your code available for Xamarin apps through a Binding Library and having the package available like that would speed up the process :)

QEMU specific code should only ever run on a armeabi-v7a system

Due to the bug it's targeting, this will only ever work on or against a system which is believed to be of armeabi-v7a type. We need to gate this logic otherwise it can induce traces, etc.