Android 记录一次因隐私合规引发的权限hook

布景

一天，本该高兴编码flutter的我，突然被集团法务钉了，说在合规扫描排查中发现某xxxApp存在在App静默状态下调用某灵敏权限获取用户信息，不合规。经过调用栈排查发现是某第三方推送sdk在静默状态下心跳调用的，本着能动口不动脑的准则，我联系了上了第三方的技术，询问是否有静默方面的api，成果一番舌战后，对方告诉我他们隐私政策里有增加说明，之后也没有想要改动的打算，但是集团那边说在隐私里说明也不行。

综上，那只能自己着手。

解决的办法：是经过hook系统权限，增加某个业务逻辑点阻拦并处理。

涉及到的知识点：java反射、动态署理、一点点耐性。

本文涉及到的灵敏权限：

//wifi
android.net.wifi.WifiManager.getScanResults()
android.net.wifi.WifiManager.getConnectionInfo()
//蓝牙
android.bluetooth.le.BluetoothLeScanner.startScan()
//定位
android.location.LocationManager.getLastKnownLocation()

开端

wifi篇

1.首要寻找切入点，以办法WifiManager.getScanResults()为例检查源码

public List<ScanResult> getScanResults() {
   try {
        return mService.getScanResults(mContext.getOpPackageName(),
               mContext.getAttributionTag());
   } catch (RemoteException e) {
       throw e.rethrowFromSystemServer();
   }
}

发现目标办法是由mService目标调用，它的定义

@UnsupportedAppUsage
IWifiManager mService;

检查IWifiManager

interface IWifiManager{
 ...
List<ScanResult> getScanResults(String callingPackage, String callingFeatureId);
WifiInfo getConnectionInfo(String callingPackage, String callingFeatureId);
 ...
}

能够看到IWifiManager是一个接口类，包括所需办法，能够当成一个切入点。

若以IWifiManager为切入点，进行hook

办法一

private static void hookWifi(Context context) {
    try {
        //反射获取相关类、字段目标
        Class<?> iWifiManagerClass = HookUtil.getClass("android.net.wifi.IWifiManager");
        Field serviceField = HookUtil.getField("android.net.wifi.WifiManager", "mService");
        WifiManager wifiManager = (WifiManager) context.getSystemService(Context.WIFI_SERVICE);
        //获取原始mService目标
        Object realIwm = serviceField.get(wifiManager);
        //创立IWifiManager署理
        Object proxy = Proxy.newProxyInstance(iWifiManagerClass.getClassLoader(),
                new Class[]{iWifiManagerClass}, new WifiManagerProxy(realIwm));
        //设置新署理
        serviceField.set(wifiManager, proxy);
    } catch (Exception e) {
        e.printStackTrace();
    }
}

其中新署理类完成InvocationHandler

public class WifiManagerProxy implements InvocationHandler {
    private final Object mOriginalTarget;
    public WifiManagerProxy(Object mOriginalTarget) {
        this.mOriginalTarget = mOriginalTarget;
    }
    @Override
    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
        String methodName = method.getName();
        if (("getScanResults".equals(methodName) || "getConnectionInfo".equals(methodName))){
            //todo something
            return null;
        }
        return method.invoke(mOriginalTarget,args);
    }
}

2.考虑context问题：

获取原始wifiManager需求用到context上下文，不同context获取到的wifiManager不同。若一致运用application上下文能够基本覆盖所需，但是可能会呈现遗漏（比如某处运用的是activity#context）。为了保证hook开关唯一，测验再往上查找新的切入点。

检查获取wifiManager办法，由context调用.getSystemService(）

WifiManager wifiManager = (WifiManager) context.getSystemService(Context.WIFI_SERVICE);

持续检查context的完成contextImpl中

@Override
public Object getSystemService(String name) {
    ...
    return SystemServiceRegistry.getSystemService(this, name);
}

检查SystemServiceRegistry.getSystemService静态办法

public static Object getSystemService(ContextImpl ctx, String name) {
    if (name == null) {
        return null;
    }
    final ServiceFetcher<?> fetcher = SYSTEM_SERVICE_FETCHERS.get(name);
    if (fetcher == null) {
        ...
        return null;
    }
    final Object ret = fetcher.getService(ctx);
    if (sEnableServiceNotFoundWtf && ret == null) {
        ...
        return null;
    }
    return ret;
}

服务由SYSTEM_SERVICE_FETCHERS获取，它是一个静态的HashMap，它的put办法在registerService中

private static <T> void registerService(@NonNull String serviceName,
        @NonNull Class<T> serviceClass, @NonNull ServiceFetcher<T> serviceFetcher) {
   ...
   SYSTEM_SERVICE_FETCHERS.put(serviceName, serviceFetcher);
   ...
}
static{
...
//Android 11及以上
WifiFrameworkInitializer.registerServiceWrappers()
...
}
...
@SystemApi
public static <TServiceClass> void registerContextAwareService(
        @NonNull String serviceName, @NonNull Class<TServiceClass> serviceWrapperClass,
        @NonNull ContextAwareServiceProducerWithoutBinder<TServiceClass> serviceProducer) {
    ...
    registerService(serviceName, serviceWrapperClass,
        new CachedServiceFetcher<TServiceClass>() {
            @Override
            public TServiceClass createService(ContextImpl ctx)
                    throws ServiceNotFoundException {
                return serviceProducer.createService(
                        ctx.getOuterContext(),
                        ServiceManager.getServiceOrThrow(serviceName));
            }});
}

public static void registerServiceWrappers() {
...
SystemServiceRegistry.registerContextAwareService(
                 Context.WIFI_SERVICE,
                 WifiManager.class,
                 (context, serviceBinder) -> {
                     IWifiManager service = IWifiManager.Stub.asInterface(serviceBinder);
                     return new WifiManager(context, service, getInstanceLooper());
                 }
         );
}

SYSTEM_SERVICE_FETCHERS静态代码块中经过.registerServiceWrappers()注册WIFI_SERVICE服务。

在registerService中new了一个CachedServiceFetcher，它返回一个serviceProducer.createService(...)

TServiceClass createService(@NonNull Context context, @NonNull IBinder serviceBinder);

其中第二个参数是一个IBinder目标，它的创立

ServiceManager.getServiceOrThrow(serviceName)

持续

public static IBinder getServiceOrThrow(String name) throws ServiceNotFoundException {
         final IBinder binder = getService(name);
         if (binder != null) {
             return binder;
         } else {
             throw new ServiceNotFoundException(name);
         }
     }
...
@UnsupportedAppUsage
public static IBinder getService(String name) {
         try {
             IBinder service = sCache.get(name);
             if (service != null) {
                 return service;
             } else {
                 return Binder.allowBlocking(rawGetService(name));
             }
         } catch (RemoteException e) {
             Log.e(TAG, "error in getService", e);
         }
         return null;
     }

终究在getService中IBinder缓存在sCache中，它是一个静态变量

@UnsupportedAppUsage
private static Map<String, IBinder> sCache = new ArrayMap<String, IBinder>();

综上，如果能够创立新的IBinder，再替换掉sCache中的原始值就能够完成所需。

若以sCache为一个切入点

办法二

private static void hookWifi2() {
    try {
        Method getServiceMethod = HookUtil.getMethod("android.os.ServiceManager", "getService", String.class);
        Object iBinderObject = getServiceMethod.invoke(null, Context.WIFI_SERVICE);
        Field sCacheFiled = HookUtil.getField("android.os.ServiceManager", "sCache");
        Object sCacheValue = sCacheFiled.get(null);
        //生成署理IBinder，并替换原始值
        if (iBinderObject != null && sCacheValue != null) {
            IBinder iBinder = (IBinder) iBinderObject;
            Map<String, IBinder> sCacheMap = (Map<String, IBinder>) sCacheValue;
            Object proxy = Proxy.newProxyInstance(iBinder.getClass().getClassLoader(), new Class[]{IBinder.class}, new WifiBinderProxy(iBinder));
            sCacheMap.put(Context.WIFI_SERVICE, (IBinder) proxy);
        }
    } catch (Exception e) {
        e.printStackTrace();
    }
}

public class WifiBinderProxy implements InvocationHandler {
    private final IBinder originalTarget;
    public WifiBinderProxy(IBinder originalTarget) {
        this.originalTarget = originalTarget;
    }
    @Override
    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
        if ("queryLocalInterface".equals(method.getName())) {
            Object hook = hookQueryLocalInterface();
            if (hook != null){
                return hook;
            }
        }
        return method.invoke(originalTarget, args);
    }
    private Object hookQueryLocalInterface(){
        try {
            //获取原始IWifiManager目标
            Method asInterfaceMethod = HookUtil.getMethod("android.net.wifi.IWifiManager$Stub", "asInterface", IBinder.class);
            Object iwifiManagerObject = asInterfaceMethod.invoke(null, originalTarget);
            //生成新IWifiManager署理
            Class<?> iwifiManagerClass = HookUtil.getClass("android.net.wifi.IWifiManager");
            return Proxy.newProxyInstance(originalTarget.getClass().getClassLoader(),
                    new Class[]{IBinder.class, IInterface.class, iwifiManagerClass},
                    new WifiManagerProxy(iLocationManagerObject));
        }catch (Exception e){
            e.printStackTrace();
        }
        return null;
    }
}

至此完成无需上下文的大局阻拦。

蓝牙篇

以BluetoothLeScanner.startScan()为例查找切入点，以下省略非必需源码张贴

private int startScan(List<ScanFilter> filters, ScanSettings settings,
        final WorkSource workSource, final ScanCallback callback,
        final PendingIntent callbackIntent,
        List<List<ResultStorageDescriptor>> resultStorages) {
        ...
        IBluetoothGatt gatt;
        try {
            gatt = mBluetoothManager.getBluetoothGatt();
        } catch (RemoteException e) {
            gatt = null;
        }
...
private final IBluetoothManager mBluetoothManager;
...
public BluetoothLeScanner(BluetoothAdapter bluetoothAdapter) {
    mBluetoothAdapter = Objects.requireNonNull(bluetoothAdapter);
    mBluetoothManager = mBluetoothAdapter.getBluetoothManager();
    ...
}

向上查找IBluetoothManager,它在BluetoothAdapter中；向下署理getBluetoothGatt办法处理IBluetoothGatt

检查BluetoothAdapter的创立

public static BluetoothAdapter createAdapter(AttributionSource attributionSource) {
    IBinder binder = ServiceManager.getService(BLUETOOTH_MANAGER_SERVICE);
    if (binder != null) {
        return new BluetoothAdapter(IBluetoothManager.Stub.asInterface(binder),
                attributionSource);
    } else {
        Log.e(TAG, "Bluetooth binder is null");
        return null;
    }
}

ok，他也包括由ServiceManager中获取得到IBinder，然后进行后续操作。

若以IBluetoothManager为切入点

private static void hookBluetooth() {
    try {
        //反射ServiceManager中的getService(BLUETOOTH_MANAGER_SERVICE = 'bluetooth_manager')办法，获取原始IBinder
        Method getServiceMethod = HookUtil.getMethod("android.os.ServiceManager", "getService", String.class);
        Object iBinderObject = getServiceMethod.invoke(null, "bluetooth_manager");
        //获取ServiceManager目标sCache
        Field sCacheFiled = HookUtil.getField("android.os.ServiceManager", "sCache");
        Object sCacheValue = sCacheFiled.get(null);
        //动态署理生成署理iBinder刺进sCache
        if (iBinderObject != null && sCacheValue != null) {
            IBinder iBinder = (IBinder) iBinderObject;
            Map<String, IBinder> sCacheMap = (Map<String, IBinder>) sCacheValue;
            Object proxy = Proxy.newProxyInstance(iBinder.getClass().getClassLoader(), new Class[]{IBinder.class}, new BluetoothBinderProxy(iBinder));
            sCacheMap.put("bluetooth_manager", (IBinder) proxy);
        }
    } catch (Exception e) {
        e.printStackTrace();
    }
}

署理IBluetoothManager

public class BluetoothBinderProxy implements InvocationHandler {
    private final IBinder mOriginalTarget;
    public BluetoothBinderProxy(IBinder originalTarget) {
        this.mOriginalTarget = originalTarget;
    }
    @Override
    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
        if ("queryLocalInterface".equals(method.getName())) {
            //阻拦
            Object hook = hookQueryLocalInterface();
            if (hook != null){
                return hook;
            }
        }
        //不阻拦
        return method.invoke(mOriginalTarget, args);
    }
    private Object hookQueryLocalInterface(){
        try {
            //获取原始IBluetoothManager目标
            Method asInterfaceMethod = HookUtil.getMethod("android.bluetooth.IBluetoothManager$Stub", "asInterface", IBinder.class);
            Object iBluetoothManagerObject = asInterfaceMethod.invoke(null, mOriginalTarget);
            //生成署理IBluetoothManager
            Class<?> iBluetoothManagerClass = HookUtil.getClass("android.bluetooth.IBluetoothManager");
            return Proxy.newProxyInstance(mOriginalTarget.getClass().getClassLoader(),
                    new Class[]{IBinder.class, IInterface.class, iBluetoothManagerClass},
                    new BluetoothManagerProxy(iBluetoothManagerObject));
        }catch (Exception e){
            e.printStackTrace();
        }
        return null;
    }
}

署理IBluetoothGatt

public class BluetoothManagerProxy implements InvocationHandler {
    private final Object mOriginalTarget;
    public BluetoothManagerProxy(Object mOriginalTarget) {
        this.mOriginalTarget = mOriginalTarget;
    }
    @Override
    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
        if ("getBluetoothGatt".equals(method.getName())) {
            Object object = method.invoke(mOriginalTarget,args);
            Object hook = hookGetBluetoothGatt(object);
            if (hook != null){
                return hook;
            }
        }
        return method.invoke(mOriginalTarget, args);
    }
    private Object hookGetBluetoothGatt(Object object) {
        try {
            Class<?> iBluetoothGattClass = HookUtil.getClass("android.bluetooth.IBluetoothGatt");
            return Proxy.newProxyInstance(mOriginalTarget.getClass().getClassLoader(),
                    new Class[]{IBinder.class, IInterface.class, iBluetoothGattClass},
                    new BluetoothGattProxy(object));
        } catch (Exception e) {
            e.printStackTrace();
        }
        return null;
    }
}

处理业务逻辑

public class BluetoothGattProxy implements InvocationHandler {
    private final Object mOriginalTarget;
    public BluetoothGattProxy(Object mOriginalTarget) {
        this.mOriginalTarget = mOriginalTarget;
    }
    @Override
    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
        if ("startScan".equals(method.getName())){
            //todo something
            return null;
        }
        return method.invoke(mOriginalTarget,args);
    }
}

定位篇

以LocationManager.getLastKnownLocation()为例查找切入点，此处不张贴源码，直接展现

private static void hookLocation() {
    try {
        Method getServiceMethod = HookUtil.getMethod("android.os.ServiceManager", "getService", String.class);
        Object iBinderObject = getServiceMethod.invoke(null, Context.LOCATION_SERVICE);
        Field sCacheFiled = HookUtil.getField("android.os.ServiceManager", "sCache");
        Object sCacheValue = sCacheFiled.get(null);
        //动态署理生成署理iBinder刺进sCache
        if (iBinderObject != null && sCacheValue != null) {
            IBinder iBinder = (IBinder) iBinderObject;
            Map<String, IBinder> sCacheMap = (Map<String, IBinder>) sCacheValue;
            Object proxy = Proxy.newProxyInstance(iBinder.getClass().getClassLoader(), new Class[]{IBinder.class}, new LocationBinderProxy(iBinder));
            sCacheMap.put(Context.LOCATION_SERVICE, (IBinder) proxy);
        }
    } catch (Exception e) {
        e.printStackTrace();
    }
}

public class LocationBinderProxy implements InvocationHandler {
    private final IBinder originalTarget;
    public LocationBinderProxy(IBinder originalTarget) {
        this.originalTarget = originalTarget;
    }
    @Override
    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
        if ("queryLocalInterface".equals(method.getName())) {
            Object hook = hookQueryLocalInterface();
            if (hook != null){
                return hook;
            }
        }
        return method.invoke(originalTarget, args);
    }
    private Object hookQueryLocalInterface(){
        try {
            //获取原始ILocationManager目标
            Method asInterfaceMethod = HookUtil.getMethod("android.location.ILocationManager$Stub", "asInterface", IBinder.class);
            Object iLocationManagerObject = asInterfaceMethod.invoke(null, originalTarget);
            //生成署理ILocationManager
            Class<?> iLocationManagerClass = HookUtil.getClass("android.location.ILocationManager");
            return Proxy.newProxyInstance(originalTarget.getClass().getClassLoader(),
                    new Class[]{IBinder.class, IInterface.class, iLocationManagerClass},
                    new LocationManagerProxy(iLocationManagerObject));
        }catch (Exception e){
            e.printStackTrace();
        }
        return null;
    }
}

总结

作为Android进程间通讯机制Binder的守护进程，本次所hook的权限都可追溯到ServiceManager，ServiceManager中的sCache缓存了权限相关的IBinder，以此为切入点能够进行一致处理，不需求引进context。

在此记载一下因隐私合规引发的hook处理流程，一起也想吐槽一下国内应用商场App上架审阅是真滴难，每个商场的合规扫描标准都不相同。

附录

源码检查网站 aospxref.com/

路径：/frameworks/base/core/java/android/os/ServiceManager.java