From fa10ac6f9bf53e7d810a3d3b20ef7381dfcd0d59 Mon Sep 17 00:00:00 2001 From: Riyad Mondol Date: Sat, 14 Jun 2025 05:08:12 +0600 Subject: [PATCH] Delete root_detection_bypass.js --- root_detection_bypass.js | 336 --------------------------------------- 1 file changed, 336 deletions(-) delete mode 100644 root_detection_bypass.js diff --git a/root_detection_bypass.js b/root_detection_bypass.js deleted file mode 100644 index b0dd8b2..0000000 --- a/root_detection_bypass.js +++ /dev/null @@ -1,336 +0,0 @@ -(() => { - 'use strict'; - - const CONFIG = { - fingerprint: "google/crosshatch/crosshatch:10/QQ3A.200805.001/6578210:user/release-keys", - secureProps: { - "ro.secure": "1", - "ro.debuggable": "0", - "ro.build.type": "user", - "ro.build.tags": "release-keys" - } - }; - - const ROOT_INDICATORS = { - paths: new Set([ - "/data/local/bin/su", - "/data/local/su", - "/data/local/xbin/su", - "/dev/com.koushikdutta.superuser.daemon/", - "/sbin/su", - "/su/bin/su", - "/system/bin/su", - "/system/xbin/su", - "/system/sbin/su", - "/vendor/bin/su", - "/data/adb/su/bin/su", - "/system/bin/failsafe/su", - "/system/bin/.ext/.su", - "/system/bin/.ext/su", - "/system/bin/failsafe/su", - "/system/sd/xbin/su", - "/system/usr/we-need-root/su", - "/cache/su", - "/data/su", - "/dev/su", - "/data/adb/magisk", - "/sbin/.magisk", - "/cache/.disable_magisk", - "/dev/.magisk.unblock", - "/cache/magisk.log", - "/data/adb/magisk.img", - "/data/adb/magisk.db", - "/data/adb/magisk_simple", - "/init.magisk.rc", - "/system/app/Superuser.apk", - "/system/etc/init.d/99SuperSUDaemon", - "/system/xbin/daemonsu", - "/system/xbin/ku.sud", - "/data/adb/ksu", - "/data/adb/ksud", - "/system/xbin/busybox", - "/system/app/Kinguser.apk" - ]), - - packages: new Set([ - "com.noshufou.android.su", - "com.noshufou.android.su.elite", - "eu.chainfire.supersu", - "com.koushikdutta.superuser", - "com.thirdparty.superuser", - "com.yellowes.su", - "com.koushikdutta.rommanager", - "com.koushikdutta.rommanager.license", - "com.dimonvideo.luckypatcher", - "com.chelpus.lackypatch", - "com.ramdroid.appquarantine", - "com.ramdroid.appquarantinepro", - "com.topjohnwu.magisk", - "me.weishu.kernelsu" - ]), - - commands: new Set([ - "su", - "which su", - "whereis su", - "locate su", - "find / -name su", - "mount", - "magisk", - "/system/bin/su", - "/system/xbin/su", - "/sbin/su", - "/su/bin/su" - ]), - - binaries: new Set([ - "su", - "busybox", - "magisk", - "supersu", - "ksud", - "daemonsu" - ]) - }; - - const Logger = { - prefix: "RootBypass: ", - info(message) { - console.log(`${this.prefix}${message}`); - }, - error(message, error) { - console.error(`${this.prefix}ERROR: ${message}`, error || ""); - } - }; - - function bypassNativeFileCheck() { - const fopen = Module.findExportByName("libc.so", "fopen"); - if (fopen) { - Interceptor.attach(fopen, { - onEnter(args) { - this.path = args[0].readUtf8String(); - }, - onLeave(retval) { - if (retval.toInt32() !== 0) { - const path = this.path.toLowerCase(); - if (ROOT_INDICATORS.paths.has(this.path) || path.includes("magisk") || path.includes("/su") || path.endsWith("/su")) { - Logger.info(`Blocked fopen: ${this.path}`); - retval.replace(ptr(0x0)); - } - } - } - }); - } - - const access = Module.findExportByName("libc.so", "access"); - if (access) { - Interceptor.attach(access, { - onEnter(args) { - this.path = args[0].readUtf8String(); - }, - onLeave(retval) { - if (retval.toInt32() === 0) { - const path = this.path.toLowerCase(); - if (ROOT_INDICATORS.paths.has(this.path) || path.includes("magisk") || path.includes("/su") || path.endsWith("/su")) { - Logger.info(`Blocked access: ${this.path}`); - retval.replace(ptr(-1)); - } - } - } - }); - } - - const stat = Module.findExportByName("libc.so", "stat"); - if (stat) { - Interceptor.attach(stat, { - onEnter(args) { - this.path = args[0].readUtf8String(); - }, - onLeave(retval) { - const path = this.path.toLowerCase(); - if (ROOT_INDICATORS.paths.has(this.path) || path.includes("magisk") || path.includes("/su") || path.endsWith("/su")) { - Logger.info(`Blocked stat: ${this.path}`); - retval.replace(ptr(-1)); - } - } - }); - } - - const lstat = Module.findExportByName("libc.so", "lstat"); - if (lstat) { - Interceptor.attach(lstat, { - onEnter(args) { - this.path = args[0].readUtf8String(); - }, - onLeave(retval) { - const path = this.path.toLowerCase(); - if (ROOT_INDICATORS.paths.has(this.path) || path.includes("magisk") || path.includes("/su") || path.endsWith("/su")) { - Logger.info(`Blocked lstat: ${this.path}`); - retval.replace(ptr(-1)); - } - } - }); - } - } - - function bypassJavaFileCheck() { - const UnixFileSystem = Java.use("java.io.UnixFileSystem"); - UnixFileSystem.checkAccess.implementation = function(file, access) { - const filename = file.getAbsolutePath(); - if (ROOT_INDICATORS.paths.has(filename) || filename.includes("magisk") || filename.includes("su")) { - Logger.info(`Blocked file access check: ${filename}`); - return false; - } - return this.checkAccess(file, access); - }; - - const File = Java.use("java.io.File"); - File.exists.implementation = function() { - const filename = this.getAbsolutePath(); - if (ROOT_INDICATORS.paths.has(filename) || filename.includes("magisk") || filename.includes("su")) { - Logger.info(`Blocked file exists check: ${filename}`); - return false; - } - return this.exists(); - }; - - File.length.implementation = function() { - const filename = this.getAbsolutePath(); - if (ROOT_INDICATORS.paths.has(filename) || filename.includes("magisk") || filename.includes("su")) { - Logger.info(`Blocked file length check: ${filename}`); - return 0; - } - return this.length(); - }; - - const FileInputStream = Java.use("java.io.FileInputStream"); - FileInputStream.$init.overload('java.io.File').implementation = function(file) { - const filename = file.getAbsolutePath(); - if (ROOT_INDICATORS.paths.has(filename) || filename.includes("magisk") || filename.includes("su")) { - Logger.info(`Blocked FileInputStream creation: ${filename}`); - throw new Java.use("java.io.FileNotFoundException").$new(filename); - } - return this.$init(file); - }; - } - - function setProp() { - try { - const Build = Java.use("android.os.Build"); - const fields = { - "TAGS": "release-keys", - "TYPE": "user", - "FINGERPRINT": CONFIG.fingerprint - }; - - Object.entries(fields).forEach(([field, value]) => { - const fieldObj = Build.class.getDeclaredField(field); - fieldObj.setAccessible(true); - fieldObj.set(null, value); - }); - - const system_property_get = Module.findExportByName("libc.so", "__system_property_get"); - if (system_property_get) { - Interceptor.attach(system_property_get, { - onEnter(args) { - this.key = args[0].readCString(); - this.ret = args[1]; - }, - onLeave(retval) { - const secureValue = CONFIG.secureProps[this.key]; - if (secureValue !== undefined) { - const valuePtr = Memory.allocUtf8String(secureValue); - Memory.copy(this.ret, valuePtr, secureValue.length + 1); - } - } - }); - } - - const Runtime = Java.use('java.lang.Runtime'); - Runtime.exec.overload('java.lang.String').implementation = function(cmd) { - if (cmd.startsWith("getprop ")) { - const prop = cmd.split(" ")[1]; - if (CONFIG.secureProps[prop]) { - Logger.info(`Blocked getprop command: ${cmd}`); - return null; - } - } - return this.exec(cmd); - }; - } catch (error) { - Logger.error("Error setting up build properties bypass", error); - } - } - - function bypassRootPackageCheck() { - const ApplicationPackageManager = Java.use("android.app.ApplicationPackageManager"); - - ApplicationPackageManager.getPackageInfo.overload('java.lang.String', 'int').implementation = function(str, i) { - if (ROOT_INDICATORS.packages.has(str)) { - Logger.info(`Blocked package check: ${str}`); - str = "com.nonexistent.package"; - } - return this.getPackageInfo(str, i); - }; - - ApplicationPackageManager.getInstalledPackages.overload('int').implementation = function(flags) { - const packages = this.getInstalledPackages(flags); - const packageList = packages.toArray(); - const filteredPackages = packageList.filter(pkg => !ROOT_INDICATORS.packages.has(pkg.packageName.value)); - return Java.use("java.util.ArrayList").$new(filteredPackages); - }; - } - - function bypassShellCommands() { - try { - const ProcessBuilder = Java.use('java.lang.ProcessBuilder'); - ProcessBuilder.command.overload('java.util.List').implementation = function(commands) { - const cmdList = commands.toArray(); - if (cmdList.length > 0) { - const cmd = cmdList[0].toString(); - if (ROOT_INDICATORS.commands.has(cmd) || (cmdList.length > 1 && ROOT_INDICATORS.binaries.has(cmdList[1].toString()))) { - Logger.info(`Blocked ProcessBuilder command: ${cmdList.join(' ')}`); - return this.command(Java.use("java.util.Arrays").asList([""])); - } - } - return this.command(commands); - }; - - const Runtime = Java.use('java.lang.Runtime'); - Runtime.exec.overload('[Ljava.lang.String;').implementation = function(cmdArray) { - if (cmdArray.length > 0) { - const cmd = cmdArray[0]; - if (ROOT_INDICATORS.commands.has(cmd) || (cmdArray.length > 1 && ROOT_INDICATORS.binaries.has(cmdArray[1]))) { - Logger.info(`Blocked Runtime.exec command array: ${cmdArray.join(' ')}`); - return this.exec([""]); - } - } - return this.exec(cmdArray); - }; - - const ProcessImpl = Java.use("java.lang.ProcessImpl"); - ProcessImpl.start.implementation = function(cmdArray, env, dir, redirects, redirectErrorStream) { - if (cmdArray.length > 0) { - const cmd = cmdArray[0].toString(); - const arg = cmdArray.length > 1 ? cmdArray[1].toString() : ""; - - if (ROOT_INDICATORS.commands.has(cmd) || ROOT_INDICATORS.binaries.has(arg)) { - Logger.info(`Blocked ProcessImpl command: ${cmdArray.join(' ')}`); - return ProcessImpl.start.call(this, [Java.use("java.lang.String").$new("")], env, dir, redirects, redirectErrorStream); - } - } - return ProcessImpl.start.call(this, cmdArray, env, dir, redirects, redirectErrorStream); - }; - } catch (error) { - Logger.error("Error setting up shell command bypass", error); - } - } - - Logger.info("Initializing root detection bypass..."); - bypassNativeFileCheck(); - bypassJavaFileCheck(); - setProp(); - bypassRootPackageCheck(); - bypassShellCommands(); - Logger.info("Root detection bypass initialized successfully"); -})();