Question

这是一个老问题，许多人都回答了问题，但我又回去了......我想检查设备是否已植根。我不希望我的应用程序安装在root设备上。现在我经历了很多答案并得出结论，没有保证识别root的方法，如果我错了就纠正我。现在我的问题是，我们可以检查设备是否真实而不是检查root或nor？是否有任何应用程序我可以测试我签名的APK代码签名，ssl钉扎，代码曝光和很多东西？

Answer 1

下面是我的Root Checking实用程序类。我使用的字符串常量对我有用。

path6

public static final String[] knownRootAppsPackages = {
            "com.noshufou.android.su",
            "com.noshufou.android.su.elite",
            "eu.chainfire.supersu",
            "com.koushikdutta.superuser",
            "com.thirdparty.superuser",
            "com.yellowes.su",
            "com.zachspong.temprootremovejb",
            "com.ramdroid.appquarantine",
            "eu.chainfire.supersu"

    };

    public static final String[] knownDangerousAppsPackages = {
            "com.koushikdutta.rommanager",
            "com.koushikdutta.rommanager.license",
            "com.dimonvideo.luckypatcher",
            "com.chelpus.lackypatch",
            "com.ramdroid.appquarantine",
            "com.ramdroid.appquarantinepro"
    };

    public static final String[] knownRootCloakingPackages = {
            "com.devadvance.rootcloak",
            "com.devadvance.rootcloakplus",
            "de.robv.android.xposed.installer",
            "com.saurik.substrate",
            "com.zachspong.temprootremovejb",
            "com.amphoras.hidemyroot",
            "com.amphoras.hidemyrootadfree",
            "com.formyhm.hiderootPremium",
            "com.formyhm.hideroot"
    };

    public static final String[] suPaths ={
            "/data/local/",
            "/data/local/bin/",
            "/data/local/xbin/",
            "/sbin/",
            "/su/bin/",
            "/system/bin/",
            "/system/bin/.ext/",
            "/system/bin/failsafe/",
            "/system/sd/xbin/",
            "/system/usr/we-need-root/",
            "/system/xbin/"
    };


    public static final String[] pathsThatShouldNotBeWrtiable = {
            "/system",
            "/system/bin",
            "/system/sbin",
            "/system/xbin",
            "/vendor/bin",
            //"/sys",
            "/sbin",
            "/etc",
            //"/proc",
            //"/dev"
    }

Answer 2

使用 google SafetyNet Attestation API，您可以轻松检查设备是否为正品。

在 build.gradle(:app) 中添加依赖

实现'com.google.android.gms:play-services-safetynet:17.0.0'
获取 Api 密钥并使用 link
启用 Android 设备验证 API
将此方法添加到您的项目中，并从您想要检查设备值真实性的任何地方调用。

public static void sendSafetyNetRequest(Activity context) {

 if(GoogleApiAvailability.getInstance().isGooglePlayServicesAvailable(context,
 13000000) == ConnectionResult.SUCCESS) {

 Log.e(TAG, "The SafetyNet Attestation API is available");

 // TODO(developer): Change the nonce generation to include your own, used once value,
 // ideally from your remote server.

 String nonceData = "Safety Net Sample: " + System.currentTimeMillis();
 ByteArrayOutputStream byteStream = new ByteArrayOutputStream();
 Random mRandom = new SecureRandom();

 byte[] bytes = new byte[24];
 mRandom.nextBytes(bytes);
 try {
     byteStream.write(bytes);
     byteStream.write(nonceData.getBytes());
 } catch (IOException e) {
     e.printStackTrace();
 }

 byte[] nonce = byteStream.toByteArray();

 SafetyNetClient client = SafetyNet.getClient(context);
 Task<SafetyNetApi.AttestationResponse> task = client.attest(nonce, API_KEY_FROM_STEP_2_LINK);

 task.addOnSuccessListener(context, attestationResponse -> {


   /*
          TODO(developer): Forward this result to your server together with
          the nonce for verification.
          You can also parse the JwsResult locally to confirm that the API
          returned a response by checking for an 'error' field first and before
          retrying the request with an exponential backoff.
          NOTE: Do NOT rely on a local, client-side only check for security, you
          must verify the response on a remote server!
         */

     String jwsResult = attestationResponse.getJwsResult();

     Log.e(TAG, "Success! SafetyNet result:\n" + jwsResult + "\n");

     if (jwsResult == null) {
         Log.e(TAG, "jwsResult Null");

     }
     final String[] jwtParts = jwsResult.split("\\.");

     if (jwtParts.length == 3) {
         String decodedPayload = new String(Base64.decode(jwtParts[1], Base64.DEFAULT));
         Log.e(TAG, "decodedPayload :     " + decodedPayload);
     }


 });

 task.addOnFailureListener(context, e -> {
     // An error occurred while communicating with the service.
     String mResult = null;

     if (e instanceof ApiException) {
         // An error with the Google Play Services API contains some additional details.
         ApiException apiException = (ApiException) e;

         Util.showLog(TAG, "Error: " +
                 CommonStatusCodes.getStatusCodeString(apiException.getStatusCode()) + ": " +
                 apiException.getStatusMessage());
     } else {
         // A different, unknown type of error occurred.
        Log.e(TAG, "ERROR! " + e.getMessage());
     }

 });

} else {
  Log.e(TAG, "Prompt user to update Google Play services.";

}
}

如果 ctsProfileMatch 和 basicIntegrity，请检查您的 decodedPayload 日志并检查 table 中的值。证明 API 返回 JWS 响应，如下所示：

{ "nonce": "6pLrr9zWyl6TNzj+kpbR4LZcfPY3U2FmZXR5IE5ldCBTYW1wbGU6IDE2MTQ2NzkwMTIzNjc=", "timestampMs": 9860437986543, "apkPackageName": " your package name will be displayed here", "ctsProfileMatch": true, "apkDigestSha256": [ "base64 encoded, SHA-256 hash of the certificate used to sign requesting app" ], "basicIntegrity": true, "evaluationType": "BASIC" }

[ basicIntegrity & ctsProfileMatch status 2

Answer 3

点击此链接：Determine if running on a rooted device

找到一些方法来检查设备是否为root。它工作正常。

<强> DemoActivity.class

if (isDeviceRooted()) {
            DialogFactory.getInstance().showAlertDialog(this, null, 0, "This application can't run on Rooted android phone", "Exit", new DialogInterface.OnClickListener() {
                @Override
                public void onClick(DialogInterface dialog, int which) {
                    finishAffinity();
                }
            }, false);
        }
        else {
/* Do your code */
}

public static boolean isDeviceRooted() {
        return Utils.checkRootMethod1() || Utils.checkRootMethod2() || Utils.checkRootMethod3();
    }

<强> Utils.class

public static boolean checkRootMethod1() {
        String buildTags = android.os.Build.TAGS;
        return buildTags != null && buildTags.contains("test-keys");
    }

public static boolean checkRootMethod2() {
    String[] paths = {"/system/app/Superuser.apk", "/sbin/su", "/system/bin/su", "/system/xbin/su", "/data/local/xbin/su", "/data/local/bin/su", "/system/sd/xbin/su",
            "/system/bin/failsafe/su", "/data/local/su", "/su/bin/su"};
    for (String path : paths) {
        if (new File(path).exists()) return true;
    }
    return false;
}

public static boolean checkRootMethod3() {
    Process process = null;
    try {
        process = Runtime.getRuntime().exec(new String[]{"/system/xbin/which", "su"});
        BufferedReader in = new BufferedReader(new InputStreamReader(process.getInputStream()));
        return in.readLine() != null;
    } catch (Throwable t) {
        return false;
    } finally {
        if (process != null) process.destroy();
    }
}

Answer 4

可以使用 firebase-crashlytics 检查 root。来自 com.google.firebase.crashlytics.internal.common.CommonUtils.isRooted(Context) 的静态方法检查根但它也是检查 isEmulator

Android设备的根检查

4 个答案: