TikTok越狱检测之二 ＜调试器检测＞

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

+(pid_t)GetParentPidByProc {

    int name[4];

    name[0] = CTL_KERN;

    name[1] = KERN_PROC;

    name[2] = KERN_PROC_PID;

    name[3] = getpid();

    struct kinfo_proc info;

    size_t info_size = sizeof(info);

    info.kp_proc.p_flag = 0;

    /*查询成功返回0*/

    int error = sysctl(name, sizeof(name) / sizeof(*name), &info, &info_size, NULL, 0);

    if (error == 0) {

        return  info.kp_eproc.e_ppid;

    }

    return 0;

}

1

2

3

4

5

6

7

8

9

10

+(pid_t) GetParentPid{

    bool bRet = false;

    pid_t LAUNCHD_PID = 1;

    pid_t ppid = getppid();

    if (ppid == LAUNCHD_PID) {

        bRet = true;

    }

    return ppid;

}

1

2

3

4

5

6

7

8

9

10

11

12

+(pid_t) GetParentPidBySvc{

    NSInteger ppid = 0;

    __asm__ volatile(

                     "mov x16,#39\t\n"

                     "svc 0x80\t\n"

                     "mov %0,x0\t\n"

                     :"=r"(ppid)

                     :

                     :

                     );

    return (pid_t)ppid;

}