[DETECTION] Add libmsaoaidsec.so (no idea about name)

[enovella]

Blog

• https://blog.csdn.net/weixin_56039202/article/details/130441119
• https://blog.seeflower.dev/archives/178/

Further info

> ls -la tv*
-rw-r--r--@ 1 enovella  enovella   99703321 Aug 19 01:47 tv.danmaku.bili-6.89.0.apk
-rw-r--r--@ 1 enovella  enovella  111331669 Aug 19 02:03 tv.danmaku.bili_7.31.0.apk
-rw-r--r--@ 1 enovella  enovella  107958314 Aug 19 02:15 tv.danmaku.bili_v7.16.0.apk
> apkid tv.danmaku.bili_v7.16.0.apk
[+] APKiD 2.1.5 :: from RedNaga :: rednaga.io
[*] tv.danmaku.bili_v7.16.0.apk!classes.dex
 |-> anti_vm : Build.BOARD check, Build.FINGERPRINT check, Build.HARDWARE check, Build.MANUFACTURER check, Build.MODEL check, Build.PRODUCT check, Build.TAGS check, SIM operator check, device ID check, emulator file check, network operator name check, possible Build.SERIAL check, ro.kernel.qemu check, ro.product.device check, subscriber ID check
 |-> compiler : r8
[*] tv.danmaku.bili_v7.16.0.apk!classes10.dex
 |-> anti_vm : Build.BOARD check, Build.FINGERPRINT check, Build.HARDWARE check, Build.MANUFACTURER check, SIM operator check, possible Build.SERIAL check
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes11.dex
 |-> anti_vm : Build.MANUFACTURER check, Build.MODEL check, Build.PRODUCT check
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes12.dex
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes13.dex
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes14.dex
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes15.dex
 |-> anti_vm : Build.MANUFACTURER check
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes16.dex
 |-> anti_vm : Build.MANUFACTURER check
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes17.dex
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes18.dex
 |-> anti_vm : Build.BOARD check, Build.FINGERPRINT check, Build.HARDWARE check, Build.MANUFACTURER check
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes19.dex
 |-> anti_vm : Build.MANUFACTURER check
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes2.dex
 |-> anti_vm : Build.MANUFACTURER check
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes3.dex
 |-> anti_vm : Build.FINGERPRINT check, Build.MANUFACTURER check, Build.MODEL check, Build.PRODUCT check, SIM operator check, device ID check, possible Build.SERIAL check, subscriber ID check
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes4.dex
 |-> anti_vm : Build.FINGERPRINT check, Build.MANUFACTURER check, Build.MODEL check, possible Build.SERIAL check
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes5.dex
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes6.dex
 |-> anti_vm : Build.MANUFACTURER check, Build.MODEL check, Build.PRODUCT check
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes7.dex
 |-> anti_vm : Build.BOARD check, Build.FINGERPRINT check, Build.MANUFACTURER check, SIM operator check, subscriber ID check
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes8.dex
 |-> anti_vm : Build.BOARD check, Build.FINGERPRINT check, Build.MANUFACTURER check, possible ro.secure check
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!classes9.dex
 |-> anti_vm : Build.BOARD check, Build.FINGERPRINT check, Build.MANUFACTURER check, Build.MODEL check, Build.PRODUCT check, Build.TAGS check, emulator file check, possible Build.SERIAL check, possible VM check, subscriber ID check
 |-> compiler : r8 without marker (suspicious)
[*] tv.danmaku.bili_v7.16.0.apk!lib/arm64-v8a/libbili.so
 |-> obfuscator : Obfuscator-LLVM version 5.0 (string encryption)

Package names

• tv.danmaku.bili
• com.wodi.who

[Yehh22]

See LibChecker's rules: https://github.com/LibChecker/LibChecker-Rules/blob/master/native-libs/libmsaoaidsec.so.json