Frida-server端口扫描检测及Frida脚本适配相关技术问询

安装并启动Frida-server后，某银行应用出现异常行为。调研发现部分应用会通过NDK层对设备进行端口扫描检测Frida-server，就算修改Frida-server默认端口也无法规避。

参考mullerberndt的方案，编写了一款同时检测Frida默认端口（27047）和全端口范围，并通过D-Bus协议探测的C脚本：

#include <stdio.h>
#include <stdbool.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/ip.h>

struct sockaddr_in sa;

int detect_frida_server(void);
bool check_protocol(int);
bool check_all_ports(int);

int main() {
    int res = detect_frida_server();
    printf("Detection result return value: %d\n", res);
    return 0;
}

int detect_frida_server() {
    const int fs_port = 27047;
    memset(&sa, 0 , sizeof(sa));
    sa.sin_family = AF_INET;
    sa.sin_port = htons(fs_port);
    inet_aton("127.0.0.1", &(sa.sin_addr));

    int sock = socket(AF_INET, SOCK_STREAM, 0);

    if(connect(sock, (struct sockaddr *) &sa, sizeof sa) != -1) {
        printf("FRIDA DETECTION[1]: Open port: %d\n", fs_port);
        if(check_protocol(sock)) {
            printf("Frida server detected!");
            return 1;
        }
        printf("Suspicious.\n");
        return 2;
    }
    else if(check_all_ports(fs_port)) {
        printf("Frida server detected!");
        return 1;
    }

    if(check_all_ports(fs_port)) {
        printf("Frida server detected!");
        return 1;
    }
    return 0;
}

bool check_all_ports(int port) {
    int i, sock;
    for (i = 0; i <=65535; i++) {
        if(i == port) continue;

        sock = socket(AF_INET, SOCK_STREAM, 0);
        sa.sin_port = htons(i);

        if(connect(sock, (struct sockaddr *) &sa, sizeof sa) != -1)
        {
            printf("FRIDA DETECTION[1]: Open port: %d\n", i);
            if(check_protocol(sock)) return true;
        }
    }

    return false;
}

bool check_protocol(int s) {
    char res[7];
    bool rres = false;

    memset((void*) res, 0, sizeof(res));

    send(s, "\x00", 1, NULL);
    send(s, "AUTH\r\n", 6, NULL);

    usleep(100);

    if(recv(s, res, sizeof(res) - 1, MSG_DONTWAIT) != -1)
        if(strcmp(res, "REJECT") == 0)
            rres = true;

    return rres;
}

编译与推送命令 #

编译命令：

\Android\Sdk\ndk\21.4.7075529\toolchains\llvm\prebuilt\windows-x86_64\bin\aarch64-linux-android21-clang detect-fs.c -o detect_frida

推送命令：

adb push detect_frida /data/local/tmp/detect-fs-v2

运行该代码时可检测到开放端口并成功connect，但D-Bus协议探测未生效。随后简化代码为仅检测端口连通性：

#include <stdio.h>
#include <string.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/ip.h>

int port_scan(void);

int main() {
    int open = port_scan();
    if(open) printf("Port is open at: %d\n", open);
    else printf("No ports were found to be open. System secure.\n");
    return 0;
}

int port_scan() {
    struct sockaddr_in sa;
    memset(&sa, 0 , sizeof(sa));
    sa.sin_family = AF_INET;
    
    for(int i = 0; i < 65535; i++) {
        int sock = socket(AF_INET, SOCK_STREAM, 0);
        sa.sin_port = htons(i);
        
        if(connect(sock, (struct sockaddr *) &sa, sizeof sa) != -1) {
            close(sock);
            return i;
        }
    }
    
    return 0;
}

推测目标银行应用可能采用此端口连通性检测方式。已为二进制文件赋予root权限并设置chmod 775，但疑惑非root环境下的Play商店应用能否通过NDK层实现该检测。

同时有以下疑问：

• 非root Android环境下是否禁止localhost监听端口（包括80端口的Web服务器）？
• 如何编写Frida脚本hook connect方法，使其对非合法连接返回false（即伪装所有端口关闭）且不影响应用与后端的合法通信？
• 全端口扫描在Android设备上的耗时是否适合作为隐蔽的root/篡改检测手段？

内容的提问来源于stack exchange，提问作者dazzleworth