There are already many application scenarios based on location-based services on the market, such as sports category applications that generate motion trajectories based on geographic location, enterprise office applications that check in based on location information, game category applications that develop regional rankings based on location information, and e-commerce applications that distribute regions based on location sex coupons and more. After Heihuichan sniffed out the commercial interests behind it, he achieved his goal by forging location information. In order to further reduce the technical threshold and the difficulty of confrontation, virtual positioning tools came into being.
In the past, the iOS system needed to be jailbroken or modified by tampering technology CoreLocation to achieve virtual positioning, which not only increased the complexity and equipment cost of Heihui itself, but also brought more detection features to the detection. In order to solve this pain point, more and more black and gray products have begun to use tools such as AnyGo, iAnyGo, and Aisi Assistant to forge locations.
The staff of a sports product found Gee Experience, saying that they found that more and more brushes were using AnyGo for location forgery, and they asked us for a solution. Before helping customers solve problems, let's first understand what kind of virtual positioning software AnyGo is.
Introduction to AnyGo
AnyGo utilizes Xcode to provide positioning simulation services through GPX files without installing the App on iOS or requiring the iPhone system to be jailbroken. Below is a screenshot of the AnyGo interface:
AnyGo simulation positioning
Through the GPX file, AnyGo can not only simulate positioning to a certain position, but also simulate the motion trajectory according to the scene, and it is valid for the global system:
simulated running
driving simulator
Use Xcode to realize iOS virtual positioning
Now that AnyGo is using an Apple-developed testing service, let's get our hands dirty with Xocde.
First, open Debug in Xcode Simulate Location, select the location or modify the positioning information through the GPX file, and then the main operation of virtual positioning can be completed.
Simulate Location The virtual positioning is described through the GPX file. Among them, GPX is a general GPS XML format data designed for application software, which can be used to describe points, paths and trajectories.
How AnyGo works
com.apple.dt.simulatelocation In order to understand the principle of virtual positioning tools of the same type as AnyGo, we need to understand services and libimobiledeviceopen source libraries next .
AnyGo connects to the iOS device through the Wi-Fi or USB communication capability provided by the cross-platform open source library libimobiledevice , and sends the start service command to the lockdown process on the device com.apple.dt.simulatelocation . This service will use the specified GPX file for system-wide virtual positioning, so that all applications on the system will use false positioning information. The following is part of libimobiledevice the source code:
#define DT_SIMULATELOCATION_SERVICE "com.apple.dt.simulatelocation"
if (lockdownd_start_service(lockdown, DT_SIMULATELOCATION_SERVICE, &svc) != LOCKDOWN_E_SUCCESS) {
lockdownd_client_free(lockdown);
idevice_free(device);
printf("ERROR: Could not start the simulatelocation service. Make sure a developer disk image is mounted!\n");
return -1;
}lockdown
Lockdown is a startup daemon process on iOS devices, which is used for communication between iPhone process and system services. It runs with root privileges, and its configuration file statement is located in the path /System/Library/LaunchDaemons/com.apple.mobile.lockdown.plist. We will share more relevant content in the future.
How to detect AnyGo
How to identify such virtual positioning? In fact, preliminary detection can be performed through the API provided by the iOS system.
CLLocationIn iOS 15+, the system provides isProducedByAccessoryand properties in the library isSimulatedBySoftware to identify virtual positioning via GPX.
The result returned by obtaining location information without tampering:
After using GPX to modify the positioning, return the result:
It can be seen that the virtual positioning has been realized and isSimulatedBySoftware has been hit. In addition, we can also use the principle of AnyGo for identification.
In the end, the sports category customer solved their imminent problems through our products.
Of course, in addition to the identification of virtual positioning, it is also essential to do a good job in subsequent code confrontation. Geetest Device Test is a risk control product recently launched by Geetest. It generates unique device identifiers through three-dimensional composite and weak feature attribution algorithms. It can detect not limited to virtual location, simulator, tampering, proxy, multi-opening, Various risks such as jailbreak escort the safe development of enterprises.
Add Eva WeChat: Geetest_1024, join the Geetest reader exchange group