1
| 目标 | 在动态流量篡改工具中拦截 FactsDroid 的 API 流量；操控显示给用户的 fact，可注入自定义内容或抑制真实 fact |
2
| 约束 ① | 不静态修改原始 APK |
3
| 约束 ② | 不能修改发往后端的请求 |
4
| 约束 ③ | 后端 (`uselessfacts.jsph.pl`) 不在挑战范围内，不能利用 |
5
| 约束 ④ | 响应操控可用 |

1
strings lib/x86_64/libapp.so | grep -E 'uselessfacts|pinning|root|fetch|certs'
2
aapt dump badging FactsDroid.apk

1
| 包名 | `com.eightksec.factsdroid` |
2
| 框架 | Flutter（含 `lib/x86_64/libapp.so` 与 `libflutter.so`） |
3
| API | `https://uselessfacts.jsph.pl/api/v2/facts/random` |
4
| 钉死的证书 | `assets/flutter_assets/assets/certs/uselessfacts_jsph_pl.crt`（Let's Encrypt 颁发给 `uselessfacts.jsph.pl` 的叶证书） |
5
| 二进制内符号 | `SecurityContext_SetTrustedCertificatesBytes`、`SecureSocket_RegisterBadCertificateCallback`、`Pinning validation likely failed`、`_fetchRandomFact`、`_checkRoot`、`Security Warning: Device appears to be rooted` |
6
| MainActivity (Java) | 仅声明 channel 名 `com.eightksec.factsdroid/root_check`，****未注册 handler**** |

1
/*
2
 * antiroot-channel.js — Java/Flutter side patch for FactsDroid root_check.
3
 *
4
 * The MainActivity does not register a handler for the
5
 * `com.eightksec.factsdroid/root_check` MethodChannel.  The Flutter
6
 * engine therefore replies "no handler", the Dart future yields null,
7
 * and the catch-all path concludes the device is rooted.
8
 *
9
 * Hook FlutterJNI.handlePlatformMessage.  For that channel send back a
10
 * synthetic StandardMethodCodec success-envelope holding `false`.
11
 *
12
 * Wire format of `StandardMethodCodec.encodeSuccessEnvelope(Boolean.FALSE)`:
13
 *   byte 0: 0x00    (success tag)
14
 *   byte 1: 0x02    (StandardMessageCodec value type for `false`)
15
 *
16
 * We build that 2-byte envelope ourselves because the Flutter codec
17
 * helper class is stripped by ProGuard in release builds of this app.
18
 */
19

20
console.log('[chan] antiroot-channel loading');
21

22
function patch() {
23
  Java.perform(function () {
24
    var FlutterJNI;
25
    try {
26
      FlutterJNI = Java.use('io.flutter.embedding.engine.FlutterJNI');
27
    } catch (e) {
28
      console.log('[chan] FlutterJNI not yet loaded');
29
      return false;
30
    }
31
    var ByteBuffer = Java.use('java.nio.ByteBuffer');
32

33
    FlutterJNI.handlePlatformMessage.overload(
34
      'java.lang.String', 'java.nio.ByteBuffer', 'int', 'long'
35
    ).implementation = function (channel, message, replyId, messageData) {
36
      if (channel === 'com.eightksec.factsdroid/root_check') {
37
        console.log('[chan] root_check inbound (replyId=' + replyId + ')');
38
        try {
39
          // success(false): tag byte 0x00, then StandardMessageCodec false = 0x02
40
          var buf = ByteBuffer.allocateDirect(2);
41
          buf.put(0x00);
42
          buf.put(0x02);
43
          this.invokePlatformMessageResponseCallback(replyId, buf, buf.position());
44
          console.log('[chan] replied isRooted=false');
45
          return;
46
        } catch (e) {
47
          console.log('[chan] reply error: ' + e);
48
        }
49
      }
50
      return this.handlePlatformMessage(channel, message, replyId, messageData);
51
    };
52
    console.log('[chan] FlutterJNI.handlePlatformMessage hooked');
53
    return true;
54
  });
55
}
56

57
let chanTries = 0;
58
const chanTimer = setInterval(function () {
59
  if (chanTries++ > 80) { clearInterval(chanTimer); console.log('[chan] giving up'); return; }
60
  let loaded = false;
61
  Java.perform(function () {
62
    try { Java.use('io.flutter.embedding.engine.FlutterJNI'); loaded = true; }
63
    catch (e) {}
64
  });
65
  if (loaded) { clearInterval(chanTimer); patch(); }
66
}, 100);

1
/**
2

3
A Frida script that disables Flutter's TLS verification
4

5
This script works on Android x86, Android x64 and iOS x64. It uses pattern matching to find [ssl_verify_peer_cert in handshake.cc](https://github.com/google/boringssl/blob/master/ssl/handshake.cc#L323)
6

7
If the script doesn't work, take a look at https://github.com/NVISOsecurity/disable-flutter-tls-verification#warning-what-if-this-script-doesnt-work
8

9
*/
10

11
// Configuration object containing patterns to locate the ssl_verify_peer_cert function for different platforms and architectures.
12
var config = {
13
    "ios":{
14
        "modulename": "Flutter",
15
        "patterns":{
16
            "arm64": [
17
                // First pattern is actually for macos
18
                "FF 83 01 D1 FA 67 01 A9 F8 5F 02 A9 F6 57 03 A9 F4 4F 04 A9 FD 7B 05 A9 FD 43 01 91 F4 03 00 AA 68 31 00 F0 08 01 40 F9 08 01 40 F9 E8 07 00 F9",
19
                "FF 83 01 D1 FA 67 01 A9 F8 5F 02 A9 F6 57 03 A9 F4 4F 04 A9 FD 7B 05 A9 FD 43 01 91 F? 03 00 AA ?? 0? 40 F? ?8 ?? 40 F9 ?? ?? 4? F9 ?? 00 00",
20
                "FF 43 01 D1 F8 5F 01 A9 F6 57 02 A9 F4 4F 03 A9 FD 7B 04 A9 FD 03 01 91 F3 03 00 AA 14 00 40 F9 88 1A 40 F9 15 E9 40 F9 B5 00 00 B4 B6 46 40 F9"
21

22
            ],
23
        },
24
    },
25
    "android":{
26
        "modulename": "libflutter.so",
27
        "patterns":{
28
            "arm64": [
29
                "F? 0F 1C F8 F? 5? 01 A9 F? 5? 02 A9 F? ?? 03 A9 ?? ?? ?? ?? 68 1A 40 F9",
30
                "F? 43 01 D1 FE 67 01 A9 F8 5F 02 A9 F6 57 03 A9 F4 4F 04 A9 13 00 40 F9 F4 03 00 AA 68 1A 40 F9",
31
                "FF 43 01 D1 FE 67 01 A9 ?? ?? 06 94 ?? 7? 06 94 68 1A 40 F9 15 15 41 F9 B5 00 00 B4 B6 4A 40 F9",
32
                "FF ?3 01 D1 F? ?? 01 A9 ?? ?? ?? 94 ?? ?? ?? 52 48 00 00 39 1A 50 40 F9 DA 02 00 B4 48 03 40 F9",
33
            ],
34
            "arm": [
35
                "2D E9 F? 4? D0 F8 00 80 81 46 D8 F8 18 00 D0 F8",
36
            ],
37
            "x64": [
38
                "55 41 57 41 56 41 55 41 54 53 50 49 89 F? 4? 8B ?? 4? 8B 4? 30 4C 8B ?? ?? 0? 00 00 4D 85 ?? 74 1? 4D 8B",
39
                "55 41 57 41 56 41 55 41 54 53 48 83 EC 18 49 89 FF 48 8B 1F 48 8B 43 30 4C 8B A0 28 02 00 00 4D 85 E4 74",
40
                "55 41 57 41 56 41 55 41 54 53 48 83 EC 18 49 89 FE 4C 8B 27 49 8B 44 24 30 48 8B 98 D0 01 00 00 48 85 DB"
41
            ],
42
            "x86":[
43
                "55 89 E5 53 57 56 83 E4 F0 83 EC 20 E8 00 00 00 00 5B 81 C3 2B 79 66 00 8B 7D 08 8B 17 8B 42 18 8B 80 88 01"
44
            ]
45

46
        }
47
    },
48
    "windows": {
49
        "modulename": "flutter_windows.dll",
50
        "patterns":{
51
            "x64":[
52
                "41 57 41 56 41 55 41 54 56 57 53 48 83 EC 40 4? 89 CF 48 8B 05 ?? ?? ?? 00 48 31 E0 48 89 44 24 38 4? 8B 31 4? 8B",
53
                "41 57 41 56 41 55 41 54 56 57 55 53 48 83 EC 38 48 89 CF 48 8B 05 20 45 C6 00 48 31 E0 48 89 44 24 30 48 8B 31 48",
54
            ]
55
        }
56
    },
57
    "linux":{
58
        "modulename": "libflutter_linux_gtk.so",
59
        "patterns":{
60
            "x64":[
61
                // This one actually matches android x64 too
62
                "55 41 57 41 56 41 55 41 54 53 48 83 EC 18 49 89 FE 4C 8B 27 49 8B 44 24 30 48 8B 98 D0 01 00 00 48 85 DB"
63
            ]
64
        }
65
    }
66
};
67

68
console.log("[+] Pattern version: Jan 26 2026")
69
console.log("[+] Arch:", Process.arch)
70
console.log("[+] Platform: ", Process.platform)
71
// Flag to check if TLS validation has already been disabled
72
var TLSValidationDisabled = false;
73
var flutterLibraryFound = false;
74
var tries = 0;
75
var maxTries = 5;
76
var timeout = 1000;
77
var androidBypass = false;
78
disableTLSValidation();
79

80
// Main function to disable TLS validation for Flutter
81
function disableTLSValidation() {
82

83
    // Stop if ready
84
    if (TLSValidationDisabled) return;
85

86
    tries ++;
87
    if(tries > maxTries && !androidBypass){
88
        console.warn(`\n`)
89
        console.warn('[!] Flutter library not found. Possible reasons:');
90
        console.warn('[!] - The application does not use Flutter');
91
        console.warn('[!] - The application has not loaded the Flutter library yet');
92
        console.warn('[!] - You are using an emulator + gadget (https://github.com/NVISOsecurity/disable-flutter-tls-verification/issues/43)');
93
        console.warn('[!] The script will continue, but is likely to fail');
94
        console.warn(`\n`)
95
        androidBypass = true;
96
    }else{
97
        // No module found yet
98
        if(m == null){
99
            if(androidBypass){
100
                // But we are in bypass mode and are looking for the ssl_verify_peer_certy anyway
101
                console.log(`[ ] Locating ssl_verify_peer_cert (${tries}/${maxTries})`)
102
            }
103
            else{
104
                // Still looking for flutter lib
105
                console.log(`[ ] Locating Flutter library ${tries}/${maxTries}`);
106
            }
107
        }
108
        else
109
        {
110
            // Module has been located
111
            console.log(`[ ] Locating ssl_verify_peer_cert (${tries}/${maxTries})`)
112
        }
113
    }
114

115

116
    // Figure out which patterns to use
117
    var platformConfig = {}
118
    if(Java.available){
119
        platformConfig = config["android"]
120
    }
121
    else if(Process.platform === 'darwin'){
122
        platformConfig = config["ios"]
123
    }
124
    else if(Process.platform in config){
125
        platformConfig = config[Process.platform]
126
    }
127
    else{
128
        console.log(`[!] Platform not supported: ${Process.platform}`)
129
    }
130

131
    var m = Process.findModuleByName(platformConfig["modulename"]);
132

133
    if (m === null && !androidBypass) {
134
        setTimeout(disableTLSValidation, timeout);
135
        return;
136
    }
137
    else{
138
        if(!androidBypass){
139
            console.log(`[+] Flutter library located`)
140
        }
141
        // reset counter so that searching for ssl_verify_peer_cert also gets x attempts
142
        if(flutterLibraryFound == false){
143
            flutterLibraryFound = true;
144
            tries = 0;
145
        }
146
    }
147

148
    if (Process.arch in platformConfig["patterns"])
149
    {
150
        var ranges;
151
        if(Java.available){
152
            // On Android, getting ranges from the loaded module is buggy, so we revert to Process.enumerateRanges
153
            ranges = Process.enumerateRanges({protection: 'r-x'}).filter(isFlutterRange)
154
        }else{
155
            // On iOS, there's no issue
156
            ranges = m.enumerateRanges('r-x')
157
        }
158

159
        findAndPatch(ranges, platformConfig["patterns"][Process.arch], Java.available && Process.arch == "arm" ? 1 : 0);
160
    }
161
    else
162
    {
163
        console.log('[!] Processor architecture not supported: ', Process.arch);
164
    }
165

166
    if (!TLSValidationDisabled)
167
    {
168
        if (tries == maxTries)
169
        {
170
            if(androidBypass){
171
                console.warn(`\n`)
172
                console.warn(`[!] No function matching ssl_verify_peer_cert could be found.`)
173
                console.warn(`[!] If you are sure that the application is using Flutter, please open an issue:`)
174
                console.warn(`[!] https://github.com/NVISOsecurity/disable-flutter-tls-verification/issues`)
175
                console.warn(`\n`)
176
            }else{
177
                console.warn(`\n`)
178
                console.error(`[!] libFlutter was found, but ssl_verify_peer_cert could not be located`)
179
                console.error(`Please open an issue at https://github.com/NVISOsecurity/disable-flutter-tls-verification/issues`);
180
                console.warn(`\n`)
181
            }
182
            // Not really, but we give up
183
            TLSValidationDisabled = true
184
        }
185
    }
186
}
187

188
// Find and patch the method in memory to disable TLS validation
189
function findAndPatch(ranges, patterns, thumb) {
190

191
    ranges.forEach(range => {
192
        patterns.forEach(pattern => {
193
            var matches = Memory.scanSync(range.base, range.size, pattern);
194
            matches.forEach(match => {
195
                var info = DebugSymbol.fromAddress(match.address)
196
                if(info.name){
197
                    console.log(`[+] ssl_verify_peer_cert found at offset: ${info.name || match.address}`);
198
                }else{
199

200
                    console.log(`[+] ssl_verify_peer_cert found at location: ${match.address}`);
201
                }
202
                TLSValidationDisabled = true;
203
                hook_ssl_verify_peer_cert(match.address.add(thumb));
204
                console.log('[+] ssl_verify_peer_cert has been patched')
205

206
            });
207
            if(matches.length > 1){
208
                console.log('[!] Multiple matches detected. This can have a negative impact and may crash the app. Please open a ticket')
209
            }
210
        });
211

212
    });
213

214
    // Try again. disableTLSValidation will not do anything if TLSValidationDisabled = true
215
    setTimeout(disableTLSValidation, timeout);
216
}
217

218
function isFlutterRange(range){
219
    if(androidBypass) return true;
220

221
    var address = range.base
222
    var info = DebugSymbol.fromAddress(address)
223
    if(info.moduleName != null){
224
        if(info.moduleName.toLowerCase().includes("flutter")){
225
            return true;
226
        }
227
    }
228
    return false;
229
}
230

231
// Replace the target function's implementation to effectively disable the TLS check
232
function hook_ssl_verify_peer_cert(address) {
233
    Interceptor.replace(address, new NativeCallback((pathPtr, flags) => {
234
        return 0;
235
    }, 'int', ['pointer', 'int']));
236
}

1
/*
2
 * mitm-redirect.js — Selective MITM redirect for FactsDroid (Flutter app).
3
 *
4
 * Goal: route only `uselessfacts.jsph.pl` traffic through the local
5
 * mitmproxy reverse listener, leaving everything else (Google Fonts,
6
 * etc.) alone — and defeat Flutter's BoringSSL cert pinning.
7
 *
8
 * Mechanism:
9
 *   1. Hook getaddrinfo() and resolve `uselessfacts.jsph.pl` to MITM_HOST.
10
 *   2. Hook connect(); if the target == MITM_HOST and port == 443,
11
 *      rewrite the port to MITM_PORT.
12
 *   3. Load companion script disable-flutter-tls.js to neutralise the
13
 *      Flutter cert-pinning check.
14
 *
15
 * Constraint compliance:
16
 *   - We do not change any bytes the app *sends*. SNI, Host header, and
17
 *     request body are exactly what the app would have transmitted to
18
 *     the real backend; only the destination IP/port are rewritten so
19
 *     mitmproxy in reverse-mode can interpose.
20
 */
21

22
const TARGET_HOST = "uselessfacts.jsph.pl";
23
const MITM_HOST   = "192.168.124.18"; // host where mitmdump listens
24
const MITM_PORT   = 443;              // mitmproxy reverse-mode port
25

26
function ipToBytes(ip) {
27
  return ip.split('.').map(b => parseInt(b, 10) & 0xff);
28
}
29
const MITM_BYTES = ipToBytes(MITM_HOST);
30

31
function readSockaddrFamily(p) {
32
  try {
33
    if (!p || p.isNull()) return 0;
34
    const family = p.readU16();
35
    return (family === 2 || family === 10) ? family : 0;
36
  } catch (e) {
37
    return 0;
38
  }
39
}
40

41
function findAiAddr(ai) {
42
  // Android/Bionic and glibc place ai_addr/ai_canonname differently on
43
  // 64-bit builds. Pick the pointer that actually references a sockaddr.
44
  const candidates = Process.pointerSize === 8 ? [24, 32] : [20, 24];
45
  for (const off of candidates) {
46
    try {
47
      const p = ai.add(off).readPointer();
48
      const family = readSockaddrFamily(p);
49
      if (family !== 0) return { ptr: p, off: off, family: family };
50
    } catch (e) {}
51
  }
52
  return null;
53
}
54

55
function findExport(modName, sym) {
56
  // Frida 17 deprecates Module.findExportByName(null, sym).
57
  if (typeof Module.getGlobalExportByName === 'function') {
58
    try { return Module.getGlobalExportByName(sym); } catch (e) {}
59
  }
60
  if (modName) {
61
    try { return Module.getExportByName(modName, sym); } catch (e) {}
62
  }
63
  for (const m of Process.enumerateModules()) {
64
    try {
65
      const p = Module.getExportByName(m.name, sym);
66
      if (p && !p.isNull()) return p;
67
    } catch (e) {}
68
  }
69
  return null;
70
}
71

72
// ----- 1. hook getaddrinfo to coerce DNS for the target host -----
73
function hookGetaddrinfo() {
74
  const gai = findExport(null, 'getaddrinfo');
75
  if (!gai) { console.log('[mitm] getaddrinfo not found'); return; }
76

77
  Interceptor.attach(gai, {
78
    onEnter: function (args) {
79
      this.host = args[0].isNull() ? null : args[0].readUtf8String();
80
      this.res  = args[3];
81
    },
82
    onLeave: function (retval) {
83
      if (retval.toInt32() !== 0) return;
84
      if (!this.host || this.host !== TARGET_HOST) return;
85
      // Walk the addrinfo* linked list at *res, replace each sockaddr.
86
      let p = this.res.readPointer();
87
      while (!p.isNull()) {
88
        // struct addrinfo: int flags; int family; int socktype;
89
        //                  int protocol; socklen_t addrlen;
90
        //                  struct sockaddr *addr;
91
        //                  char *canonname;
92
        //                  struct addrinfo *next;
93
        const aiAddr = findAiAddr(p);
94
        const addrPtr = aiAddr ? aiAddr.ptr : ptr(0);
95
        const family = aiAddr ? aiAddr.family : p.add(4).readInt();
96
        // sockaddr_in: family(2) port(2) addr(4)
97
        if (family === 2 && !addrPtr.isNull()) {
98
          // keep port; rewrite v4 address
99
          p.add(4).writeInt(2);
100
          for (let i = 0; i < 4; i++) addrPtr.add(4 + i).writeU8(MITM_BYTES[i]);
101
        } else if (family === 10 && !addrPtr.isNull()) {
102
          // Convert IPv6 results into IPv4 sockaddr_in results. Keeping an
103
          // AF_INET6 family with an IPv4-mapped address can bypass the simple
104
          // IPv4 connect() rewrite and may not hit a Windows IPv4 listener.
105
          p.add(4).writeInt(2);      // ai_family = AF_INET
106
          p.add(16).writeU32(16);    // ai_addrlen = sizeof(sockaddr_in)
107
          addrPtr.writeU16(2);       // sockaddr.sa_family = AF_INET
108
          for (let i = 0; i < 4; i++) addrPtr.add(4 + i).writeU8(MITM_BYTES[i]);
109
        }
110
        p = p.add(Process.pointerSize === 8 ? 40 : 32).readPointer(); // ai_next offset
111
      }
112
      console.log(`[mitm] getaddrinfo("${this.host}") -> ${MITM_HOST}`);
113
    }
114
  });
115
  console.log('[mitm] getaddrinfo hook installed');
116
}
117

118
// ----- 2. hook connect to remap port 443 -> MITM_PORT for MITM_HOST -----
119
function hookConnectSymbol(sym) {
120
  const connectPtr = findExport('libc.so', sym);
121
  if (!connectPtr) return false;
122
  Interceptor.attach(connectPtr, {
123
    onEnter: function (args) {
124
      const sa = args[1];
125
      if (sa.isNull()) return;
126
      const family = sa.readU16();
127
      if (family === 2) {
128
        const port = ((sa.add(2).readU8() << 8) | sa.add(3).readU8()) & 0xffff;
129
        const ip = `${sa.add(4).readU8()}.${sa.add(5).readU8()}.${sa.add(6).readU8()}.${sa.add(7).readU8()}`;
130
        if (port === 443) console.log(`[mitm] ${sym}() IPv4 ${ip}:${port}`);
131
        if (ip === MITM_HOST && port === 443) {
132
          sa.add(2).writeU8((MITM_PORT >> 8) & 0xff);
133
          sa.add(3).writeU8(MITM_PORT & 0xff);
134
          console.log(`[mitm] ${sym}() ${ip}:443 -> ${MITM_HOST}:${MITM_PORT}`);
135
        }
136
      } else if (family === 10) {
137
        const port = ((sa.add(2).readU8() << 8) | sa.add(3).readU8()) & 0xffff;
138
        if (port === 443) {
139
          const mapped =
140
            sa.add(8).readU8() === 0 && sa.add(9).readU8() === 0 &&
141
            sa.add(10).readU8() === 0 && sa.add(11).readU8() === 0 &&
142
            sa.add(12).readU8() === 0 && sa.add(13).readU8() === 0 &&
143
            sa.add(14).readU8() === 0 && sa.add(15).readU8() === 0 &&
144
            sa.add(16).readU8() === 0 && sa.add(17).readU8() === 0 &&
145
            sa.add(18).readU8() === 0xff && sa.add(19).readU8() === 0xff;
146
          if (mapped) {
147
            const ip = `${sa.add(20).readU8()}.${sa.add(21).readU8()}.${sa.add(22).readU8()}.${sa.add(23).readU8()}`;
148
            console.log(`[mitm] ${sym}() IPv6-mapped ${ip}:${port}`);
149
          } else {
150
            console.log(`[mitm] ${sym}() IPv6 port ${port}`);
151
          }
152
        }
153
      }
154
    }
155
  });
156
  console.log(`[mitm] ${sym} hook installed`);
157
  return true;
158
}
159

160
function hookConnect() {
161
  let hooked = false;
162
  ['connect', '__connect'].forEach(sym => {
163
    try { hooked = hookConnectSymbol(sym) || hooked; } catch (e) {}
164
  });
165
  if (!hooked) console.log('[mitm] connect not found');
166
}
167

168
setImmediate(() => {
169
  try { hookGetaddrinfo(); } catch (e) { console.log('[mitm] gai hook err: ' + e); }
170
  try { hookConnect(); }     catch (e) { console.log('[mitm] conn hook err: ' + e); }
171
  try { hookRootDetection(); } catch (e) { console.log('[mitm] rd hook err: ' + e); }
172
  console.log('[mitm] redirect ready (target=' + TARGET_HOST + ' -> ' + MITM_HOST + ':' + MITM_PORT + ')');
173
});
174

175
// ----- 3. defeat root detection by hiding su / magisk artifacts -----
176
function hookRootDetection() {
177
  const SU_PATHS = [
178
    '/system/bin/su', '/system/xbin/su', '/sbin/su', '/su/bin/su',
179
    '/system/app/Superuser.apk', '/system/etc/init.d/99SuperSUDaemon',
180
    '/system/xbin/busybox', '/system/bin/busybox',
181
    '/sbin/.magisk', '/sbin/magisk', '/data/adb/magisk',
182
    '/dev/.magisk.unblock', '/dev/com.koushikdutta.superuser.daemon',
183
  ];
184
  const isSuPath = (p) => p && SU_PATHS.includes(p);
185

186
  function wrap(name, idx) {
187
    const fn = findExport(null, name);
188
    if (!fn) return;
189
    Interceptor.attach(fn, {
190
      onEnter: function (args) {
191
        try {
192
          const p = args[idx].readUtf8String();
193
          this.faked = isSuPath(p);
194
          if (this.faked) console.log(`[antiroot] ${name}("${p}") -> ENOENT`);
195
        } catch (e) {}
196
      },
197
      onLeave: function (retval) {
198
        if (this.faked) {
199
          retval.replace(ptr(-1));
200
        }
201
      }
202
    });
203
  }
204
  ['access', 'stat', 'lstat', 'fstatat', 'open', 'openat', 'faccessat'].forEach(n => {
205
    try { wrap(n, n.includes('at') && n !== 'fstatat' ? 1 : 0); } catch (e) {}
206
  });
207

208
  // also fake `which su` / shell-based checks: make Process_Start return failure
209
  // for command lines containing "su" — only if we observe them.
210
  const cmdHook = findExport(null, 'system');
211
  if (cmdHook) {
212
    Interceptor.attach(cmdHook, {
213
      onEnter: function (args) {
214
        try {
215
          const cmd = args[0].readUtf8String();
216
          if (cmd && /\bsu\b|magisk|busybox/.test(cmd)) {
217
            this.faked = true;
218
            console.log(`[antiroot] system("${cmd}") -> 1`);
219
          }
220
        } catch (e) {}
221
      },
222
      onLeave: function (retval) {
223
        if (this.faked) retval.replace(ptr(1));
224
      }
225
    });
226
  }
227
  console.log('[antiroot] file/exec hooks installed');
228
}