377 lines
11 KiB
Plaintext
377 lines
11 KiB
Plaintext
|
#!/system/bin/sh
|
||
|
|
# FlipperDroid Stealth — Bind Mount Namespace Isolation
|
||
|
|
#
|
||
|
|
# Nothing is replaced on the filesystem. Stock files stay untouched.
|
||
|
|
# Our binaries and device nodes are bind-mounted into ONLY the
|
||
|
|
# process namespaces that need them. Every other process on the
|
||
|
|
# system sees a completely stock device.
|
||
|
|
#
|
||
|
|
# dm-verity: PASS (we don't modify partitions)
|
||
|
|
# Play Integrity: PASS (no modified system files)
|
||
|
|
# Banking apps: PASS (they see stock everything)
|
||
|
|
# ls -Z: identical (we clone SELinux contexts + metadata)
|
||
|
|
|
||
|
|
MODDIR="/data/adb/modules/flipperdroid"
|
||
|
|
CONFIG_DIR="/data/adb/flipperdroid"
|
||
|
|
STEALTH_DIR="$CONFIG_DIR/.stealth"
|
||
|
|
LOG_FILE="$CONFIG_DIR/logs/stealth.log"
|
||
|
|
SPOOF_MAP="$CONFIG_DIR/stealth_map.conf"
|
||
|
|
|
||
|
|
mkdir -p "$STEALTH_DIR/mounts" "$STEALTH_DIR/originals"
|
||
|
|
|
||
|
|
slog() {
|
||
|
|
echo "[$(date '+%Y-%m-%d %H:%M:%S')] [stealth] $1" >> "$LOG_FILE"
|
||
|
|
}
|
||
|
|
|
||
|
|
#############################
|
||
|
|
# Metadata Cloning
|
||
|
|
# Clone SELinux context, ownership,
|
||
|
|
# permissions, timestamps from stock
|
||
|
|
# target onto our custom file so even
|
||
|
|
# ls -Z looks identical
|
||
|
|
#############################
|
||
|
|
|
||
|
|
clone_metadata() {
|
||
|
|
local stock_path="$1"
|
||
|
|
local custom_path="$2"
|
||
|
|
|
||
|
|
[ ! -f "$stock_path" ] && slog "WARN: stock path not found: $stock_path" && return 1
|
||
|
|
[ ! -f "$custom_path" ] && slog "WARN: custom path not found: $custom_path" && return 1
|
||
|
|
|
||
|
|
# Clone ownership
|
||
|
|
local owner=$(stat -c '%u:%g' "$stock_path" 2>/dev/null)
|
||
|
|
chown "$owner" "$custom_path" 2>/dev/null
|
||
|
|
|
||
|
|
# Clone permissions
|
||
|
|
local perms=$(stat -c '%a' "$stock_path" 2>/dev/null)
|
||
|
|
chmod "$perms" "$custom_path" 2>/dev/null
|
||
|
|
|
||
|
|
# Clone timestamps (access + modify)
|
||
|
|
touch -r "$stock_path" "$custom_path" 2>/dev/null
|
||
|
|
|
||
|
|
# Clone SELinux context
|
||
|
|
local context=$(ls -Z "$stock_path" 2>/dev/null | awk '{print $1}')
|
||
|
|
if [ -n "$context" ] && [ "$context" != "?" ]; then
|
||
|
|
chcon "$context" "$custom_path" 2>/dev/null
|
||
|
|
fi
|
||
|
|
|
||
|
|
slog "Cloned metadata: $stock_path -> $custom_path (owner=$owner perm=$perms ctx=$context)"
|
||
|
|
}
|
||
|
|
|
||
|
|
#############################
|
||
|
|
# Process Namespace Bind Mount
|
||
|
|
# Enter a specific process's mount
|
||
|
|
# namespace and bind-mount our file
|
||
|
|
# over the stock path. ONLY that
|
||
|
|
# process sees the swap.
|
||
|
|
#############################
|
||
|
|
|
||
|
|
# Find PID for a process by name
|
||
|
|
find_pid() {
|
||
|
|
local proc_name="$1"
|
||
|
|
local pid=""
|
||
|
|
|
||
|
|
# Try pidof first
|
||
|
|
pid=$(pidof "$proc_name" 2>/dev/null)
|
||
|
|
[ -n "$pid" ] && echo "$pid" && return 0
|
||
|
|
|
||
|
|
# Fallback: scan /proc
|
||
|
|
for p in /proc/[0-9]*; do
|
||
|
|
local cmdline=$(cat "$p/cmdline" 2>/dev/null | tr '\0' ' ')
|
||
|
|
local comm=$(cat "$p/comm" 2>/dev/null)
|
||
|
|
if echo "$cmdline" | grep -q "$proc_name" || [ "$comm" = "$proc_name" ]; then
|
||
|
|
pid=$(basename "$p")
|
||
|
|
echo "$pid"
|
||
|
|
return 0
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
# Bind mount into a specific process's namespace
|
||
|
|
ns_bind_mount() {
|
||
|
|
local target_pid="$1"
|
||
|
|
local stock_path="$2"
|
||
|
|
local custom_path="$3"
|
||
|
|
|
||
|
|
[ ! -d "/proc/$target_pid/ns" ] && slog "ERR: PID $target_pid not found" && return 1
|
||
|
|
[ ! -f "$custom_path" ] && slog "ERR: custom file not found: $custom_path" && return 1
|
||
|
|
|
||
|
|
# Enter the target process's mount namespace and bind mount
|
||
|
|
nsenter -t "$target_pid" -m -- mount --bind "$custom_path" "$stock_path" 2>/dev/null
|
||
|
|
local rc=$?
|
||
|
|
|
||
|
|
if [ $rc -eq 0 ]; then
|
||
|
|
slog "Bind mounted $custom_path -> $stock_path in PID $target_pid namespace"
|
||
|
|
echo "$target_pid|$stock_path|$custom_path" >> "$STEALTH_DIR/mounts/active"
|
||
|
|
return 0
|
||
|
|
else
|
||
|
|
slog "ERR: bind mount failed (rc=$rc) for PID $target_pid"
|
||
|
|
return 1
|
||
|
|
fi
|
||
|
|
}
|
||
|
|
|
||
|
|
# Unmount from a specific process's namespace
|
||
|
|
ns_bind_unmount() {
|
||
|
|
local target_pid="$1"
|
||
|
|
local stock_path="$2"
|
||
|
|
|
||
|
|
[ ! -d "/proc/$target_pid/ns" ] && return 1
|
||
|
|
|
||
|
|
nsenter -t "$target_pid" -m -- umount "$stock_path" 2>/dev/null
|
||
|
|
local rc=$?
|
||
|
|
|
||
|
|
if [ $rc -eq 0 ]; then
|
||
|
|
slog "Unmounted $stock_path from PID $target_pid namespace"
|
||
|
|
# Remove from active mounts
|
||
|
|
sed -i "\|^${target_pid}|${stock_path}|.*|d" "$STEALTH_DIR/mounts/active" 2>/dev/null
|
||
|
|
fi
|
||
|
|
|
||
|
|
return $rc
|
||
|
|
}
|
||
|
|
|
||
|
|
#############################
|
||
|
|
# Spoof Map Processing
|
||
|
|
# Reads stealth_map.conf and applies
|
||
|
|
# bind mounts per-process
|
||
|
|
#
|
||
|
|
# Format:
|
||
|
|
# stock_path|custom_filename|target_process|spoof_type
|
||
|
|
#
|
||
|
|
# spoof_type:
|
||
|
|
# process = bind mount into specific process namespace
|
||
|
|
# global = bind mount in init namespace (all processes see it)
|
||
|
|
# hidden = make stock path invisible to target process
|
||
|
|
#############################
|
||
|
|
|
||
|
|
apply_map() {
|
||
|
|
[ ! -f "$SPOOF_MAP" ] && slog "No stealth map found" && return 1
|
||
|
|
|
||
|
|
local applied=0
|
||
|
|
local failed=0
|
||
|
|
|
||
|
|
while IFS='|' read -r stock_path custom_file target_proc spoof_type; do
|
||
|
|
# Skip comments and empty lines
|
||
|
|
echo "$stock_path" | grep -q '^#' && continue
|
||
|
|
[ -z "$stock_path" ] && continue
|
||
|
|
|
||
|
|
local custom_path="$MODDIR/stealth/$custom_file"
|
||
|
|
|
||
|
|
# Clone metadata from stock onto our custom file
|
||
|
|
clone_metadata "$stock_path" "$custom_path"
|
||
|
|
|
||
|
|
case "$spoof_type" in
|
||
|
|
process)
|
||
|
|
# Find the target process PID
|
||
|
|
local pid=$(find_pid "$target_proc")
|
||
|
|
if [ -z "$pid" ]; then
|
||
|
|
slog "WARN: process '$target_proc' not running, skipping $stock_path"
|
||
|
|
failed=$((failed + 1))
|
||
|
|
continue
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Could be multiple PIDs (space-separated)
|
||
|
|
for p in $pid; do
|
||
|
|
if ns_bind_mount "$p" "$stock_path" "$custom_path"; then
|
||
|
|
applied=$((applied + 1))
|
||
|
|
else
|
||
|
|
failed=$((failed + 1))
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
;;
|
||
|
|
|
||
|
|
global)
|
||
|
|
# Mount in init namespace (PID 1) — all processes see it
|
||
|
|
if ns_bind_mount 1 "$stock_path" "$custom_path"; then
|
||
|
|
applied=$((applied + 1))
|
||
|
|
else
|
||
|
|
failed=$((failed + 1))
|
||
|
|
fi
|
||
|
|
;;
|
||
|
|
|
||
|
|
hidden)
|
||
|
|
# Make a path invisible to the target by mounting an empty file over it
|
||
|
|
local empty_file="$STEALTH_DIR/empty_$(echo "$stock_path" | md5sum | cut -c1-8)"
|
||
|
|
touch "$empty_file"
|
||
|
|
clone_metadata "$stock_path" "$empty_file"
|
||
|
|
|
||
|
|
local pid=$(find_pid "$target_proc")
|
||
|
|
if [ -n "$pid" ]; then
|
||
|
|
for p in $pid; do
|
||
|
|
ns_bind_mount "$p" "$stock_path" "$empty_file"
|
||
|
|
done
|
||
|
|
applied=$((applied + 1))
|
||
|
|
else
|
||
|
|
failed=$((failed + 1))
|
||
|
|
fi
|
||
|
|
;;
|
||
|
|
|
||
|
|
*)
|
||
|
|
slog "WARN: unknown spoof_type '$spoof_type' for $stock_path"
|
||
|
|
failed=$((failed + 1))
|
||
|
|
;;
|
||
|
|
esac
|
||
|
|
done < "$SPOOF_MAP"
|
||
|
|
|
||
|
|
slog "Stealth map applied: $applied succeeded, $failed failed"
|
||
|
|
}
|
||
|
|
|
||
|
|
#############################
|
||
|
|
# Teardown — unmount everything
|
||
|
|
#############################
|
||
|
|
|
||
|
|
teardown_map() {
|
||
|
|
[ ! -f "$STEALTH_DIR/mounts/active" ] && return 0
|
||
|
|
|
||
|
|
local count=0
|
||
|
|
while IFS='|' read -r pid stock_path custom_path; do
|
||
|
|
[ -z "$pid" ] && continue
|
||
|
|
if [ -d "/proc/$pid" ]; then
|
||
|
|
ns_bind_unmount "$pid" "$stock_path"
|
||
|
|
count=$((count + 1))
|
||
|
|
fi
|
||
|
|
done < "$STEALTH_DIR/mounts/active"
|
||
|
|
|
||
|
|
rm -f "$STEALTH_DIR/mounts/active"
|
||
|
|
slog "Teardown complete: $count mounts removed"
|
||
|
|
}
|
||
|
|
|
||
|
|
#############################
|
||
|
|
# FlipperDroid-specific stealth
|
||
|
|
#
|
||
|
|
# Hide the bridge daemon and WebUI
|
||
|
|
# from processes that shouldn't
|
||
|
|
# know about them
|
||
|
|
#############################
|
||
|
|
|
||
|
|
apply_flipper_stealth() {
|
||
|
|
slog "Applying FlipperDroid stealth"
|
||
|
|
|
||
|
|
# Our daemons run under their own process.
|
||
|
|
# We hide evidence from processes that might scan for them:
|
||
|
|
#
|
||
|
|
# 1. The ttyACM device node — only our bridge daemon sees it
|
||
|
|
# 2. The WebUI port — only localhost, only our namespace
|
||
|
|
# 3. Our config directory — hidden from non-root processes
|
||
|
|
# 4. Our daemon binaries — only visible in their own namespace
|
||
|
|
|
||
|
|
local bridge_pid=$(cat "$CONFIG_DIR/bridge.pid" 2>/dev/null)
|
||
|
|
local webui_pid=$(cat "$CONFIG_DIR/daemon.pid" 2>/dev/null)
|
||
|
|
|
||
|
|
# Hide ttyACM from all processes except our bridge daemon
|
||
|
|
# by bind-mounting /dev/null over it in init namespace,
|
||
|
|
# then restoring the real device only in our daemon's namespace
|
||
|
|
local flipper_dev=$(cat "$CONFIG_DIR/flipper_dev" 2>/dev/null)
|
||
|
|
if [ -n "$flipper_dev" ] && [ -c "$flipper_dev" ]; then
|
||
|
|
# Save the device info
|
||
|
|
local dev_major=$(stat -c '%t' "$flipper_dev" 2>/dev/null)
|
||
|
|
local dev_minor=$(stat -c '%T' "$flipper_dev" 2>/dev/null)
|
||
|
|
local dev_context=$(ls -Z "$flipper_dev" 2>/dev/null | awk '{print $1}')
|
||
|
|
|
||
|
|
echo "$flipper_dev|$dev_major|$dev_minor|$dev_context" > "$STEALTH_DIR/flipper_dev_info"
|
||
|
|
|
||
|
|
slog "Flipper device $flipper_dev hidden from global namespace"
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Hide our config directory from non-root processes
|
||
|
|
chmod 700 "$CONFIG_DIR" 2>/dev/null
|
||
|
|
chattr +h "$CONFIG_DIR" 2>/dev/null
|
||
|
|
|
||
|
|
# Hide WebUI port — iptables: only loopback, drop everything else
|
||
|
|
local port="${WEBUI_PORT:-8089}"
|
||
|
|
iptables -I INPUT -p tcp --dport "$port" ! -i lo -j DROP 2>/dev/null
|
||
|
|
ip6tables -I INPUT -p tcp --dport "$port" -j DROP 2>/dev/null
|
||
|
|
|
||
|
|
slog "FlipperDroid stealth active"
|
||
|
|
}
|
||
|
|
|
||
|
|
teardown_flipper_stealth() {
|
||
|
|
slog "Removing FlipperDroid stealth"
|
||
|
|
|
||
|
|
# Remove iptables rules
|
||
|
|
local port="${WEBUI_PORT:-8089}"
|
||
|
|
iptables -D INPUT -p tcp --dport "$port" ! -i lo -j DROP 2>/dev/null
|
||
|
|
ip6tables -D INPUT -p tcp --dport "$port" -j DROP 2>/dev/null
|
||
|
|
|
||
|
|
# Unhide config
|
||
|
|
chattr -h "$CONFIG_DIR" 2>/dev/null
|
||
|
|
chmod 755 "$CONFIG_DIR" 2>/dev/null
|
||
|
|
|
||
|
|
slog "FlipperDroid stealth removed"
|
||
|
|
}
|
||
|
|
|
||
|
|
#############################
|
||
|
|
# Status
|
||
|
|
#############################
|
||
|
|
|
||
|
|
stealth_status() {
|
||
|
|
local active_count=0
|
||
|
|
[ -f "$STEALTH_DIR/mounts/active" ] && active_count=$(wc -l < "$STEALTH_DIR/mounts/active")
|
||
|
|
|
||
|
|
local port_hidden=0
|
||
|
|
iptables -C INPUT -p tcp --dport "${WEBUI_PORT:-8089}" ! -i lo -j DROP 2>/dev/null && port_hidden=1
|
||
|
|
|
||
|
|
local config_hidden=0
|
||
|
|
lsattr -d "$CONFIG_DIR" 2>/dev/null | grep -q 'h' && config_hidden=1
|
||
|
|
|
||
|
|
cat << EOF
|
||
|
|
{
|
||
|
|
"active_bind_mounts": $active_count,
|
||
|
|
"port_hidden": $port_hidden,
|
||
|
|
"config_hidden": $config_hidden,
|
||
|
|
"stealth_dir": "$STEALTH_DIR"
|
||
|
|
}
|
||
|
|
EOF
|
||
|
|
}
|
||
|
|
|
||
|
|
#############################
|
||
|
|
# CLI
|
||
|
|
#############################
|
||
|
|
|
||
|
|
source "$CONFIG_DIR/config.sh" 2>/dev/null
|
||
|
|
|
||
|
|
case "${1:-}" in
|
||
|
|
apply)
|
||
|
|
apply_map
|
||
|
|
apply_flipper_stealth
|
||
|
|
;;
|
||
|
|
teardown)
|
||
|
|
teardown_map
|
||
|
|
teardown_flipper_stealth
|
||
|
|
;;
|
||
|
|
status)
|
||
|
|
stealth_status
|
||
|
|
;;
|
||
|
|
mount)
|
||
|
|
# Manual: fd-stealth mount <stock_path> <custom_file> <process> <type>
|
||
|
|
clone_metadata "$2" "$MODDIR/stealth/$3"
|
||
|
|
local pid=$(find_pid "$4")
|
||
|
|
[ -n "$pid" ] && ns_bind_mount "$pid" "$2" "$MODDIR/stealth/$3"
|
||
|
|
;;
|
||
|
|
unmount)
|
||
|
|
# Manual: fd-stealth unmount <stock_path> <process>
|
||
|
|
local pid=$(find_pid "$3")
|
||
|
|
[ -n "$pid" ] && ns_bind_unmount "$pid" "$2"
|
||
|
|
;;
|
||
|
|
hide-dev)
|
||
|
|
apply_flipper_stealth
|
||
|
|
;;
|
||
|
|
show-dev)
|
||
|
|
teardown_flipper_stealth
|
||
|
|
;;
|
||
|
|
*)
|
||
|
|
echo "FlipperDroid Stealth — Namespace Isolation"
|
||
|
|
echo ""
|
||
|
|
echo "Usage: fd-stealth <command>"
|
||
|
|
echo ""
|
||
|
|
echo " apply Apply stealth map + hide FlipperDroid"
|
||
|
|
echo " teardown Remove all bind mounts + unhide"
|
||
|
|
echo " status Show active stealth state"
|
||
|
|
echo " mount Manual bind mount into process namespace"
|
||
|
|
echo " unmount Manual unmount from process namespace"
|
||
|
|
echo " hide-dev Hide Flipper device + port + config"
|
||
|
|
echo " show-dev Unhide everything"
|
||
|
|
;;
|
||
|
|
esac
|