[DETECTION] Improve Ijiami packer ELF rule

[enovella]

$ apkid ../com.green*
[+] APKiD 2.1.5 :: from RedNaga :: rednaga.io
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk
 |-> packer : Ijiami
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!lib/arm64-v8a/libagora-core.so
 |-> anti_hook : syscalls
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!lib/arm64-v8a/libijiami_sdk1.so
 |-> anti_hook : syscalls
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!lib/arm64-v8a/libsgmain.so!classes.dex
 |-> compiler : unknown (please file detection issue!)
 |-> obfuscator : unreadable field names, unreadable method names
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!lib/arm64-v8a/libsgmiddletier.so!classes.dex
 |-> compiler : unknown (please file detection issue!)
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!lib/arm64-v8a/libsgmisc.so!classes.dex
 |-> compiler : unknown (please file detection issue!)
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!lib/arm64-v8a/libsgnocaptcha.so!classes.dex
 |-> compiler : unknown (please file detection issue!)
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!lib/arm64-v8a/libsgsecuritybody.so!classes.dex
 |-> compiler : unknown (please file detection issue!)
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!lib/arm64-v8a/libijm-emulator.so
 |-> anti_hook : syscalls
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!lib/arm64-v8a/libhtsfx.so
 |-> anti_hook : syscalls
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!lib/arm64-v8a/libexecmain.so
 |-> anti_hook : syscalls
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!lib/arm64-v8a/libexec.so
 |-> anti_hook : syscalls
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/1763780556!lib/arm64-v8a/libPglmetasec_ml.so
 |-> anti_hook : syscalls
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/1763780556!classes.dex
 |-> anti_vm : Build.BOARD check, Build.FINGERPRINT check, Build.MANUFACTURER check, SIM operator check, network interface name check, network operator name check, possible Build.SERIAL check, subscriber ID check
 |-> compiler : dexlib 2.x
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/1763780556!assets/mapnaveinfoox111.dex
 |-> compiler : dexlib 2.x
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/gdt_plugin/gdtadv2.jar!assets/yaq3_0.sec
 |-> anti_vm : Build.MODEL check
 |-> compiler : dexlib 2.x
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/gdt_plugin/gdtadv2.jar!classes.dex
 |-> anti_vm : Build.FINGERPRINT check, Build.MANUFACTURER check, Build.MODEL check, Build.PRODUCT check
 |-> compiler : dexlib 2.x
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/gdt_plugin/gdtadv2.jar!lib/arm64-v8a/libturingau.so
 |-> obfuscator : Obfuscator-LLVM version 9.x
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/gdt_plugin/gdtadv2.jar!lib/armeabi/libturingau.so
 |-> obfuscator : Obfuscator-LLVM version 9.x
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/OTS_Browse.apk!classes.dex
 |-> compiler : dx
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/OTS_DnsPlug.jar!classes.dex
 |-> compiler : dx
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/OTS_Http.apk!classes.dex
 |-> compiler : dx
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/OTS_Ping.jar!classes.dex
 |-> compiler : dx
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/OTS_TraceRoute.jar!classes.dex
 |-> compiler : dx
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/OTS_VideoTest.apk!classes.dex
 |-> compiler : dx (possible dexmerge)
 |-> manipulator : dexmerge
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/libijmDataEncryption.so
 |-> packer : UPX (unknown, modified)
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/libijmDataEncryption_arm64.so
 |-> anti_hook : syscalls
[*] ../com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!classes.dex
 |-> compiler : dexlib 2.x

Sample

• https://m.apkpure.com/zhong-guo-yi-dong/com.greenpoint.android.mc10086.activity/download

Check

• com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/libijmDataEncryption_arm64.so
• com.greenpoint.android.mc10086.activity_9.1.0_Apkpure.apk!assets/libijmDataEncryption.so