基于java实现的在 Android 上的模拟器检测，多开检测，Hook检测

# anti-counterfeit-android 模拟器检测，多开检测，Hook检测，Root检测。 4个Java类，直接拷贝使用即可。 ## 模拟器检测 boolean isEmulator = EmulatorDetector.isEmulator(); ## 多开检测 boolean isVirtual = CheckVirtual.isRunInVirtual(context); ## Hook检测 boolean isHook = CheckHook.isHook(context); ## Root检测 boolean isRoot = CheckRoot.isDeviceRooted(); # # Anti 模拟器 这个很容易理解，模拟出来的机器，每次模拟的时候生成的设备ID，只存在模拟器使用的生命周期里。可能下一次模拟时又不一样了。 应对方法：主要是检测运行模拟器的一些特征，比如驱动文件，Build类内的硬件讯息等。 比如Build类内有模拟器的字串，明显就是模拟器： ```java public static boolean isEmulatorAbsoluly() { if (Build.PRODUCT.contains("sdk") || Build.PRODUCT.contains("sdk_x86") || Build.PRODUCT.contains("sdk_google") || Build.PRODUCT.contains("Andy") || Build.PRODUCT.contains("Droid4X") || Build.PRODUCT.contains("nox") || Build.PRODUCT.contains("vbox86p")) { return true; } if (Build.MANUFACTURER.equals("Genymotion") || Build.MANUFACTURER.contains("Andy") || Build.MANUFACTURER.contains("nox") || Build.MANUFACTURER.contains("TiantianVM")) { return true; } if (Build.BRAND.contains("Andy")) { return true; } if (Build.DEVICE.contains("Andy") || Build.DEVICE.contains("Droid4X") || Build.DEVICE.contains("nox") || Build.DEVICE.contains("vbox86p")) { return true; } if (Build.MODEL.contains("Emulator") || Build.MODEL.equals("google_sdk") || Build.MODEL.contains("Droid4X") || Build.MODEL.contains("TiantianVM") || Build.MODEL.contains("Andy") || Build.MODEL.equals("Android SDK built for x86_64") || Build.MODEL.equals("Android SDK built for x86")) { return true; } if (Build.HARDWARE.equals("vbox86") || Build.HARDWARE.contains("nox") || Build.HARDWARE.contains("ttVM_x86")) { return true; } if (Build.FINGERPRINT.contains("generic/sdk/generic") || Build.FINGERPRINT.contains("generic_x86/sdk_x86/generic_x86") || Build.FINGERPRINT.contains("Andy") || Build.FINGERPRINT.contains("ttVM_Hdragon") || Build.FINGERPRINT.contains("generic/google_sdk/generic") || Build.FINGERPRINT.contains("vbox86p") || Build.FINGERPRINT.contains("generic/vbox86p/vbox86p")) { return true; } return false; } ``` 还有的特征只是疑似，但不确定，对于这些特征，可以集合起来做一个疑似度评分，评分达到一定程度就标记为模拟器： ```java int newRating = 0; if (rating < 0) { if (Build.PRODUCT.contains("sdk") || Build.PRODUCT.contains("Andy") || Build.PRODUCT.contains("ttVM_Hdragon") || Build.PRODUCT.contains("google_sdk") || Build.PRODUCT.contains("Droid4X") || Build.PRODUCT.contains("nox") || Build.PRODUCT.contains("sdk_x86") || Build.PRODUCT.contains("sdk_google") || Build.PRODUCT.contains("vbox86p")) { newRating++; } if (Build.MANUFACTURER.equals("unknown") || Build.MANUFACTURER.equals("Genymotion") || Build.MANUFACTURER.contains("Andy") || Build.MANUFACTURER.contains("MIT") || Build.MANUFACTURER.contains("nox") || Build.MANUFACTURER.contains("TiantianVM")) { newRating++; } if (Build.BRAND.equals("generic") || Build.BRAND.equals("generic_x86") || Build.BRAND.equals("TTVM") || Build.BRAND.contains("Andy")) { newRating++; } if (Build.DEVICE.contains("generic") || Build.DEVICE.contains("generic_x86") || Build.DEVICE.contains("Andy") || Build.DEVICE.contains("ttVM_Hdragon") || Build.DEVICE.contains("Droid4X") || Build.DEVICE.contains("nox") || Build.DEVICE.contains("generic_x86_64") || Build.DEVICE.contains("vbox86p")) { newRating++; } if (Build.MODEL.equals("sdk") || Build.MODEL.contains("Emulator") || Build.MODEL.equals("google_sdk") || Build.MODEL.contains("Droid4X") || Build.MODEL.contains("TiantianVM") || Build.MODEL.contains("Andy") || Build.MODEL.equals("Android SDK built for x86_64") || Build.MODEL.equals("Android SDK built for x86")) { newRating++; } if (Build.HARDWARE.equals("goldfish") || Build.HARDWARE.equals("vbox86") || Build.HARDWARE.contains("nox") || Build.HARDWARE.contains("ttVM_x86")) { newRating++; } if (Build.FINGERPRINT.contains("generic/sdk/generic") || Build.FINGERPRINT.contains("generic_x86/sdk_x86/generic_x86") || Build.FINGERPRINT.contains("Andy") || Build.FINGERPRINT.contains("ttVM_Hdragon") || Build.FINGERPRINT.contains("generic_x86_64") || Build.FINGERPRINT.contains("generic/google_sdk/generic") || Build.FINGERPRINT.contains("vbox86p") || Build.FINGERPRINT.contains("generic/vbox86p/vbox86p")) { newRating++; } try { String opengl = android.opengl.GLES20.glGetString(android.opengl.GLES20.GL_RENDERER); if (opengl != null) { if (opengl.contains("Bluestacks") || opengl.contains("Translator") ) newRating += 10; } } catch (Exception e) { e.printStackTrace(); } try { File sharedFolder = new File(Environment .getExternalStorageDirectory().toString() + File.separatorChar + "windows" + File.separatorChar + "BstSharedFolder"); if (sharedFolder.exists()) { newRating += 10; } } catch (Exception e) { e.printStackTrace(); } rating = newRating; } return rating > 3;//不能再少了，否则有可能误判，若增减了新的嫌疑度判定属性，要重新评估该值 ``` # Anti 多开 多开麻烦在于真机多开，具备真机特征，模拟器的检测就失效了，因为它就是真机。 应对方法：普通的软多开，一般绕不过uid，还是用宿主的。因此，如果满足同一uid下的两个进程对应的包名，在"/data/data"下有两个私有目录，则违背了系统 "只为一个应用创建唯一一个私有目录"的设定，则该应用被多开了。 ```java public static boolean isRunInVirtual() { String filter = getUidStrFormat(); String result = exec("ps"); if (result == null || result.isEmpty()) { return false;