├── LICENSE
├── README.md
├── myhexdump.py
├── pic
├── Sample.PNG
├── bypass.png
├── clientcer.png
├── difport.png
├── locator.png
├── sslunpinningcer.png
├── summary1.jpg
└── summary2.jpg
├── r0capture.py
└── script.js
/LICENSE:
--------------------------------------------------------------------------------
1 | Apache License
2 | Version 2.0, January 2004
3 | http://www.apache.org/licenses/
4 |
5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6 |
7 | 1. Definitions.
8 |
9 | "License" shall mean the terms and conditions for use, reproduction,
10 | and distribution as defined by Sections 1 through 9 of this document.
11 |
12 | "Licensor" shall mean the copyright owner or entity authorized by
13 | the copyright owner that is granting the License.
14 |
15 | "Legal Entity" shall mean the union of the acting entity and all
16 | other entities that control, are controlled by, or are under common
17 | control with that entity. For the purposes of this definition,
18 | "control" means (i) the power, direct or indirect, to cause the
19 | direction or management of such entity, whether by contract or
20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the
21 | outstanding shares, or (iii) beneficial ownership of such entity.
22 |
23 | "You" (or "Your") shall mean an individual or Legal Entity
24 | exercising permissions granted by this License.
25 |
26 | "Source" form shall mean the preferred form for making modifications,
27 | including but not limited to software source code, documentation
28 | source, and configuration files.
29 |
30 | "Object" form shall mean any form resulting from mechanical
31 | transformation or translation of a Source form, including but
32 | not limited to compiled object code, generated documentation,
33 | and conversions to other media types.
34 |
35 | "Work" shall mean the work of authorship, whether in Source or
36 | Object form, made available under the License, as indicated by a
37 | copyright notice that is included in or attached to the work
38 | (an example is provided in the Appendix below).
39 |
40 | "Derivative Works" shall mean any work, whether in Source or Object
41 | form, that is based on (or derived from) the Work and for which the
42 | editorial revisions, annotations, elaborations, or other modifications
43 | represent, as a whole, an original work of authorship. For the purposes
44 | of this License, Derivative Works shall not include works that remain
45 | separable from, or merely link (or bind by name) to the interfaces of,
46 | the Work and Derivative Works thereof.
47 |
48 | "Contribution" shall mean any work of authorship, including
49 | the original version of the Work and any modifications or additions
50 | to that Work or Derivative Works thereof, that is intentionally
51 | submitted to Licensor for inclusion in the Work by the copyright owner
52 | or by an individual or Legal Entity authorized to submit on behalf of
53 | the copyright owner. For the purposes of this definition, "submitted"
54 | means any form of electronic, verbal, or written communication sent
55 | to the Licensor or its representatives, including but not limited to
56 | communication on electronic mailing lists, source code control systems,
57 | and issue tracking systems that are managed by, or on behalf of, the
58 | Licensor for the purpose of discussing and improving the Work, but
59 | excluding communication that is conspicuously marked or otherwise
60 | designated in writing by the copyright owner as "Not a Contribution."
61 |
62 | "Contributor" shall mean Licensor and any individual or Legal Entity
63 | on behalf of whom a Contribution has been received by Licensor and
64 | subsequently incorporated within the Work.
65 |
66 | 2. Grant of Copyright License. Subject to the terms and conditions of
67 | this License, each Contributor hereby grants to You a perpetual,
68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable
69 | copyright license to reproduce, prepare Derivative Works of,
70 | publicly display, publicly perform, sublicense, and distribute the
71 | Work and such Derivative Works in Source or Object form.
72 |
73 | 3. Grant of Patent License. Subject to the terms and conditions of
74 | this License, each Contributor hereby grants to You a perpetual,
75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable
76 | (except as stated in this section) patent license to make, have made,
77 | use, offer to sell, sell, import, and otherwise transfer the Work,
78 | where such license applies only to those patent claims licensable
79 | by such Contributor that are necessarily infringed by their
80 | Contribution(s) alone or by combination of their Contribution(s)
81 | with the Work to which such Contribution(s) was submitted. If You
82 | institute patent litigation against any entity (including a
83 | cross-claim or counterclaim in a lawsuit) alleging that the Work
84 | or a Contribution incorporated within the Work constitutes direct
85 | or contributory patent infringement, then any patent licenses
86 | granted to You under this License for that Work shall terminate
87 | as of the date such litigation is filed.
88 |
89 | 4. Redistribution. You may reproduce and distribute copies of the
90 | Work or Derivative Works thereof in any medium, with or without
91 | modifications, and in Source or Object form, provided that You
92 | meet the following conditions:
93 |
94 | (a) You must give any other recipients of the Work or
95 | Derivative Works a copy of this License; and
96 |
97 | (b) You must cause any modified files to carry prominent notices
98 | stating that You changed the files; and
99 |
100 | (c) You must retain, in the Source form of any Derivative Works
101 | that You distribute, all copyright, patent, trademark, and
102 | attribution notices from the Source form of the Work,
103 | excluding those notices that do not pertain to any part of
104 | the Derivative Works; and
105 |
106 | (d) If the Work includes a "NOTICE" text file as part of its
107 | distribution, then any Derivative Works that You distribute must
108 | include a readable copy of the attribution notices contained
109 | within such NOTICE file, excluding those notices that do not
110 | pertain to any part of the Derivative Works, in at least one
111 | of the following places: within a NOTICE text file distributed
112 | as part of the Derivative Works; within the Source form or
113 | documentation, if provided along with the Derivative Works; or,
114 | within a display generated by the Derivative Works, if and
115 | wherever such third-party notices normally appear. The contents
116 | of the NOTICE file are for informational purposes only and
117 | do not modify the License. You may add Your own attribution
118 | notices within Derivative Works that You distribute, alongside
119 | or as an addendum to the NOTICE text from the Work, provided
120 | that such additional attribution notices cannot be construed
121 | as modifying the License.
122 |
123 | You may add Your own copyright statement to Your modifications and
124 | may provide additional or different license terms and conditions
125 | for use, reproduction, or distribution of Your modifications, or
126 | for any such Derivative Works as a whole, provided Your use,
127 | reproduction, and distribution of the Work otherwise complies with
128 | the conditions stated in this License.
129 |
130 | 5. Submission of Contributions. Unless You explicitly state otherwise,
131 | any Contribution intentionally submitted for inclusion in the Work
132 | by You to the Licensor shall be under the terms and conditions of
133 | this License, without any additional terms or conditions.
134 | Notwithstanding the above, nothing herein shall supersede or modify
135 | the terms of any separate license agreement you may have executed
136 | with Licensor regarding such Contributions.
137 |
138 | 6. Trademarks. This License does not grant permission to use the trade
139 | names, trademarks, service marks, or product names of the Licensor,
140 | except as required for reasonable and customary use in describing the
141 | origin of the Work and reproducing the content of the NOTICE file.
142 |
143 | 7. Disclaimer of Warranty. Unless required by applicable law or
144 | agreed to in writing, Licensor provides the Work (and each
145 | Contributor provides its Contributions) on an "AS IS" BASIS,
146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147 | implied, including, without limitation, any warranties or conditions
148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149 | PARTICULAR PURPOSE. You are solely responsible for determining the
150 | appropriateness of using or redistributing the Work and assume any
151 | risks associated with Your exercise of permissions under this License.
152 |
153 | 8. Limitation of Liability. In no event and under no legal theory,
154 | whether in tort (including negligence), contract, or otherwise,
155 | unless required by applicable law (such as deliberate and grossly
156 | negligent acts) or agreed to in writing, shall any Contributor be
157 | liable to You for damages, including any direct, indirect, special,
158 | incidental, or consequential damages of any character arising as a
159 | result of this License or out of the use or inability to use the
160 | Work (including but not limited to damages for loss of goodwill,
161 | work stoppage, computer failure or malfunction, or any and all
162 | other commercial damages or losses), even if such Contributor
163 | has been advised of the possibility of such damages.
164 |
165 | 9. Accepting Warranty or Additional Liability. While redistributing
166 | the Work or Derivative Works thereof, You may choose to offer,
167 | and charge a fee for, acceptance of support, warranty, indemnity,
168 | or other liability obligations and/or rights consistent with this
169 | License. However, in accepting such obligations, You may act only
170 | on Your own behalf and on Your sole responsibility, not on behalf
171 | of any other Contributor, and only if You agree to indemnify,
172 | defend, and hold each Contributor harmless for any liability
173 | incurred by, or claims asserted against, such Contributor by reason
174 | of your accepting any such warranty or additional liability.
175 |
176 | END OF TERMS AND CONDITIONS
177 |
178 | APPENDIX: How to apply the Apache License to your work.
179 |
180 | To apply the Apache License to your work, attach the following
181 | boilerplate notice, with the fields enclosed by brackets "[]"
182 | replaced with your own identifying information. (Don't include
183 | the brackets!) The text should be enclosed in the appropriate
184 | comment syntax for the file format. We also recommend that a
185 | file or class name and description of purpose be included on the
186 | same "printed page" as the copyright notice for easier
187 | identification within third-party archives.
188 |
189 | Copyright [yyyy] [name of copyright owner]
190 |
191 | Licensed under the Apache License, Version 2.0 (the "License");
192 | you may not use this file except in compliance with the License.
193 | You may obtain a copy of the License at
194 |
195 | http://www.apache.org/licenses/LICENSE-2.0
196 |
197 | Unless required by applicable law or agreed to in writing, software
198 | distributed under the License is distributed on an "AS IS" BASIS,
199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200 | See the License for the specific language governing permissions and
201 | limitations under the License.
202 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # r0capture
2 |
3 | 安卓应用层抓包通杀脚本
4 |
5 | ## 简介
6 |
7 | - 仅限安卓平台，测试安卓7、8、9、10、11、12、13、14 可用 ；
8 | - 无视所有证书校验或绑定，不用考虑任何证书的事情；
9 | - 通杀TCP/IP四层模型中的应用层中的全部协议；
10 | - 通杀协议包括：Http,WebSocket,Ftp,Xmpp,Imap,Smtp,Protobuf等等、以及它们的SSL版本；
11 | - 通杀所有应用层框架，包括HttpUrlConnection、Okhttp1/3/4、Retrofit/Volley等等；
12 | - 无视加固，不管是整体壳还是二代壳或VMP，不用考虑加固的事情；
13 | - 如果有抓不到的情况欢迎提issue，或者直接加vx：r0ysue，进行反馈~
14 |
15 | ### June.18th 2023 update：测试Pixel4/安卓13/KernelSU/Frida16 功能工作正常 正常抓包 导出证书
16 |
17 | ### January.14th 2021 update：增加几个辅助功能
18 |
19 | - 增加App收发包函数定位功能
20 | - 增加App客户端证书导出功能
21 | - 新增host连接方式“-H”，用于Frida-server监听在非标准端口时的连接
22 |
23 | ## 用法
24 |
25 | - 推荐环境：[https://github.com/r0ysue/AndroidSecurityStudy/blob/master/FRIDA/A01/README.md](https://github.com/r0ysue/AndroidSecurityStudy/blob/master/FRIDA/A01/README.md)
26 |
27 | 切记仅限安卓平台7、8、9、10、11 可用 ，禁止使用模拟器。
28 |
29 | - Spawn 模式：
30 |
31 | `$ python3 r0capture.py -U -f com.coolapk.market -v`
32 |
33 | - Attach 模式，抓包内容保存成pcap文件供后续分析：
34 |
35 | `$ python3 r0capture.py -U 酷安 -v -p iqiyi.pcap`
36 |
37 | 建议使用`Attach`模式，从感兴趣的地方开始抓包，并且保存成`pcap`文件，供后续使用Wireshark进行分析。
38 | > 老版本Frida使用包名，新版本Frida使用APP名。APP名必须是点开app后，frida-ps -U显示的那个app名字。
39 |
40 | 
41 |
42 | - 收发包函数定位：`Spawn`和`attach`模式均默认开启；
43 |
44 | > 可以使用`python r0capture.py -U -f cn.soulapp.android -v >> soul3.txt`这样的命令将输出重定向至txt文件中稍后过滤内容
45 |
46 | 
47 |
48 | - 客户端证书导出功能：默认开启；必须以Spawm模式运行；
49 |
50 | > 运行脚本之前必须手动给App加上存储卡读写权限；
51 |
52 | > 并不是所有App都部署了服务器验证客户端的机制，只有配置了的才会在Apk中包含客户端证书
53 |
54 | > 导出后的证书位于/sdcard/Download/包名xxx.p12路径，导出多次，每一份均可用，密码默认为：r0ysue，推荐使用[keystore-explorer](http://keystore-explorer.org/)打开查看证书。
55 |
56 | 
57 |
58 | - 新增host连接方式“-H”，用于Frida-server监听在非标准端口时的连接。有些App会检测Frida标准端口，因此frida-server开在非标准端口可以绕过检测。
59 |
60 | 
61 |
62 | ## 感谢[爱吃菠菜](https://bbs.pediy.com/user-760871.htm)巨巨总结的本项目知识点
63 |
64 | 
65 | 
66 |
67 |
68 | PS：
69 |
70 | > 这个项目基于[frida_ssl_logger](https://github.com/BigFaceCat2017/frida_ssl_logger)，之所以换个名字，只是侧重点不同。 原项目的侧重点在于抓ssl和跨平台，本项目的侧重点是抓到所有的包。
71 |
72 | > 局限：部分开发实力过强的大厂或框架，采用的是自身的SSL框架，比如WebView、小程序或Flutter，这部分目前暂未支持。部分融合App本质上已经不属于安卓App，没有使用安卓系统的框架，无法支持。当然这部分App也是少数。暂不支持HTTP/2、或HTTP/3，该部分API在安卓系统上暂未普及或布署，为App自带，无法进行通用hook。各种模拟器架构、实现、环境较为复杂，建议珍爱生命、使用真机。暂未添加多进程支持，比如:service或:push等子进程，可以使用Frida的Child-gating来支持一下。支持多进程之后要考虑pcap文件的写入锁问题，可以用frida-tool的Reactor线程锁来支持一下。
73 |
74 | ## 以下是原项目的简介：
75 |
76 | [https://github.com/BigFaceCat2017/frida_ssl_logger](https://github.com/BigFaceCat2017/frida_ssl_logger)
77 |
78 | ### frida_ssl_logger
79 | ssl_logger based on frida
80 | for from https://github.com/google/ssl_logger
81 |
82 | ### 修改内容
83 | 1. 优化了frida的JS脚本，修复了在新版frida上的语法错误；
84 | 2. 调整JS脚本，使其适配iOS和macOS，同时也兼容了Android；
85 | 3. 增加了更多的选项，使其能在多种情况下使用；
86 |
87 | ### 安装依赖
88 | ```
89 | Python版本>=3.6
90 | pip install loguru
91 | pip install click
92 | ```
93 | ### Usage
94 | ```shell
95 | python3 ./ssl_logger.py -U -f com.bfc.mm
96 | python3 ./ssl_logger.py -v -p test.pcap 6666
97 | ````
98 |
99 |
--------------------------------------------------------------------------------
/myhexdump.py:
--------------------------------------------------------------------------------
1 | # -*- coding: utf-8 -*-
2 | # !/usr/bin/env python
3 | # -*- coding: latin-1 -*-
4 |
5 | # <-- removing this magic comment breaks Python 3.4 on Windows
6 | """
7 | 1. Dump binary data to the following text format:
8 |
9 | 00000000: 00 00 00 5B 68 65 78 64 75 6D 70 5D 00 00 00 00 ...[hexdump]....
10 | 00000010: 00 11 22 33 44 55 66 77 88 99 AA BB CC DD EE FF .."3DUfw........
11 |
12 | It is similar to the one used by:
13 | Scapy
14 | 00 00 00 5B 68 65 78 64 75 6D 70 5D 00 00 00 00 ...[hexdump]....
15 | 00 11 22 33 44 55 66 77 88 99 AA BB CC DD EE FF .."3DUfw........
16 |
17 | Far Manager
18 | 000000000: 00 00 00 5B 68 65 78 64 ¦ 75 6D 70 5D 00 00 00 00 [hexdump]
19 | 000000010: 00 11 22 33 44 55 66 77 ¦ 88 99 AA BB CC DD EE FF ?"3DUfwª»ÌÝîÿ
20 |
21 |
22 | 2. Restore binary data from the formats above as well
23 | as from less exotic strings of raw hex
24 |
25 | """
26 |
27 | __version__ = '3.3'
28 | __author__ = 'anatoly techtonik <techtonik@gmail.com>'
29 | __license__ = 'Public Domain'
30 |
31 | __history__ = \
32 | """
33 | 3.3 (2015-01-22)
34 | * accept input from sys.stdin if "-" is specified
35 | for both dump and restore (issue #1)
36 | * new normalize_py() helper to set sys.stdout to
37 | binary mode on Windows
38 |
39 | 3.2 (2015-07-02)
40 | * hexdump is now packaged as .zip on all platforms
41 | (on Linux created archive was tar.gz)
42 | * .zip is executable! try `python hexdump-3.2.zip`
43 | * dump() now accepts configurable separator, patch
44 | by Ian Land (PR #3)
45 |
46 | 3.1 (2014-10-20)
47 | * implemented workaround against mysterious coding
48 | issue with Python 3 (see revision 51302cf)
49 | * fix Python 3 installs for systems where UTF-8 is
50 | not default (Windows), thanks to George Schizas
51 | (the problem was caused by reading of README.txt)
52 |
53 | 3.0 (2014-09-07)
54 | * remove unused int2byte() helper
55 | * add dehex(text) helper to convert hex string
56 | to binary data
57 | * add 'size' argument to dump() helper to specify
58 | length of chunks
59 |
60 | 2.0 (2014-02-02)
61 | * add --restore option to command line mode to get
62 | binary data back from hex dump
63 | * support saving test output with `--test logfile`
64 | * restore() from hex strings without spaces
65 | * restore() now raises TypeError if input data is
66 | not string
67 | * hexdump() and dumpgen() now don't return unicode
68 | strings in Python 2.x when generator is requested
69 |
70 | 1.0 (2013-12-30)
71 | * length of address is reduced from 10 to 8
72 | * hexdump() got new 'result' keyword argument, it
73 | can be either 'print', 'generator' or 'return'
74 | * actual dumping logic is now in new dumpgen()
75 | generator function
76 | * new dump(binary) function that takes binary data
77 | and returns string like "66 6F 72 6D 61 74"
78 | * new genchunks(mixed, size) function that chunks
79 | both sequences and file like objects
80 |
81 | 0.5 (2013-06-10)
82 | * hexdump is now also a command line utility (no
83 | restore yet)
84 |
85 | 0.4 (2013-06-09)
86 | * fix installation with Python 3 for non English
87 | versions of Windows, thanks to George Schizas
88 |
89 | 0.3 (2013-04-29)
90 | * fully Python 3 compatible
91 |
92 | 0.2 (2013-04-28)
93 | * restore() to recover binary data from a hex dump in
94 | native, Far Manager and Scapy text formats (others
95 | might work as well)
96 | * restore() is Python 3 compatible
97 |
98 | 0.1 (2013-04-28)
99 | * working hexdump() function for Python 2
100 | """
101 |
102 | import binascii # binascii is required for Python 3
103 | import sys
104 |
105 | # --- constants
106 | PY3K = sys.version_info >= (3, 0)
107 |
108 |
109 | # --- workaround against Python consistency issues
110 | def normalize_py():
111 | ''' Problem 001 - sys.stdout in Python is by default opened in
112 | text mode, and writes to this stdout produce corrupted binary
113 | data on Windows
114 |
115 | python -c "import sys; sys.stdout.write('_\n_')" > file
116 | python -c "print(repr(open('file', 'rb').read()))"
117 | '''
118 | if sys.platform == "win32":
119 | # set sys.stdout to binary mode on Windows
120 | import os, msvcrt
121 | msvcrt.setmode(sys.stdout.fileno(), os.O_BINARY)
122 |
123 |
124 | # --- - chunking helpers
125 | def chunks(seq, size):
126 | '''Generator that cuts sequence (bytes, memoryview, etc.)
127 | into chunks of given size. If `seq` length is not multiply
128 | of `size`, the lengh of the last chunk returned will be
129 | less than requested.
130 |
131 | >>> list( chunks([1,2,3,4,5,6,7], 3) )
132 | [[1, 2, 3], [4, 5, 6], [7]]
133 | '''
134 | d, m = divmod(len(seq), size)
135 | for i in range(d):
136 | yield seq[i * size:(i + 1) * size]
137 | if m:
138 | yield seq[d * size:]
139 |
140 |
141 | def chunkread(f, size):
142 | '''Generator that reads from file like object. May return less
143 | data than requested on the last read.'''
144 | c = f.read(size)
145 | while len(c):
146 | yield c
147 | c = f.read(size)
148 |
149 |
150 | def genchunks(mixed, size):
151 | '''Generator to chunk binary sequences or file like objects.
152 | The size of the last chunk returned may be less than
153 | requested.'''
154 | if hasattr(mixed, 'read'):
155 | return chunkread(mixed, size)
156 | else:
157 | return chunks(mixed, size)
158 |
159 |
160 | # --- - /chunking helpers
161 |
162 |
163 | def dehex(hextext):
164 | """
165 | Convert from hex string to binary data stripping
166 | whitespaces from `hextext` if necessary.
167 | """
168 | if PY3K:
169 | return bytes.fromhex(hextext)
170 | else:
171 | hextext = "".join(hextext.split())
172 | return hextext.decode('hex')
173 |
174 |
175 | def dump(binary, size=2, sep=' '):
176 | '''
177 | Convert binary data (bytes in Python 3 and str in
178 | Python 2) to hex string like '00 DE AD BE EF'.
179 | `size` argument specifies length of text chunks
180 | and `sep` sets chunk separator.
181 | '''
182 | hexstr = binascii.hexlify(binary)
183 | if PY3K:
184 | hexstr = hexstr.decode('ascii')
185 | return sep.join(chunks(hexstr.upper(), size))
186 |
187 |
188 | def dumpgen(data, only_str):
189 | '''
190 | Generator that produces strings:
191 |
192 | '00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................'
193 | '''
194 | generator = genchunks(data, 16)
195 | for addr, d in enumerate(generator):
196 | line = ""
197 | if not only_str:
198 | # 00000000:
199 | line = '%08X: ' % (addr * 16)
200 | # 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
201 | dumpstr = dump(d)
202 | line += dumpstr[:8 * 3]
203 | if len(d) > 8: # insert separator if needed
204 | line += ' ' + dumpstr[8 * 3:]
205 | # ................
206 | # calculate indentation, which may be different for the last line
207 | pad = 2
208 | if len(d) < 16:
209 | pad += 3 * (16 - len(d))
210 | if len(d) <= 8:
211 | pad += 1
212 | line += ' ' * pad
213 |
214 | for byte in d:
215 | # printable ASCII range 0x20 to 0x7E
216 | if not PY3K:
217 | byte = ord(byte)
218 | if 0x20 <= byte <= 0x7E:
219 | line += chr(byte)
220 | else:
221 | line += '.'
222 | yield line
223 |
224 |
225 | def hexdump(data, result='print', only_str=False):
226 | '''
227 | Transform binary data to the hex dump text format:
228 |
229 | 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
230 |
231 | [x] data argument as a binary string
232 | [x] data argument as a file like object
233 |
234 | Returns result depending on the `result` argument:
235 | 'print' - prints line by line
236 | 'return' - returns single string
237 | 'generator' - returns generator that produces lines
238 | '''
239 | if PY3K and type(data) == str:
240 | raise TypeError('Abstract unicode data (expected bytes sequence)')
241 |
242 | gen = dumpgen(data, only_str=only_str)
243 | if result == 'generator':
244 | return gen
245 | elif result == 'return':
246 | return '\n'.join(gen)
247 | elif result == 'print':
248 | for line in gen:
249 | print(line)
250 | else:
251 | raise ValueError('Unknown value of `result` argument')
252 |
253 |
254 | def restore(dump):
255 | '''
256 | Restore binary data from a hex dump.
257 | [x] dump argument as a string
258 | [ ] dump argument as a line iterator
259 |
260 | Supported formats:
261 | [x] hexdump.hexdump
262 | [x] Scapy
263 | [x] Far Manager
264 | '''
265 | minhexwidth = 2 * 16 # minimal width of the hex part - 00000... style
266 | bytehexwidth = 3 * 16 - 1 # min width for a bytewise dump - 00 00 ... style
267 |
268 | result = bytes() if PY3K else ''
269 | if type(dump) != str:
270 | raise TypeError('Invalid data for restore')
271 |
272 | text = dump.strip() # ignore surrounding empty lines
273 | for line in text.split('\n'):
274 | # strip address part
275 | addrend = line.find(':')
276 | if 0 < addrend < minhexwidth: # : is not in ascii part
277 | line = line[addrend + 1:]
278 | line = line.lstrip()
279 | # check dump type
280 | if line[2] == ' ': # 00 00 00 ... type of dump
281 | # check separator
282 | sepstart = (2 + 1) * 7 + 2 # ('00'+' ')*7+'00'
283 | sep = line[sepstart:sepstart + 3]
284 | if sep[:2] == ' ' and sep[2:] != ' ': # ...00 00 00 00...
285 | hexdata = line[:bytehexwidth + 1]
286 | elif sep[2:] == ' ': # ...00 00 | 00 00... - Far Manager
287 | hexdata = line[:sepstart] + line[sepstart + 3:bytehexwidth + 2]
288 | else: # ...00 00 00 00... - Scapy, no separator
289 | hexdata = line[:bytehexwidth]
290 | line = hexdata
291 | result += dehex(line)
292 | return result
293 |
294 |
295 | def runtest(logfile=None):
296 | '''Run hexdump tests. Requires hexfile.bin to be in the same
297 | directory as hexdump.py itself'''
298 |
299 | class TeeOutput(object):
300 | def __init__(self, stream1, stream2):
301 | self.outputs = [stream1, stream2]
302 |
303 | # -- methods from sys.stdout / sys.stderr
304 | def write(self, data):
305 | for stream in self.outputs:
306 | if PY3K:
307 | if 'b' in stream.mode:
308 | data = data.encode('utf-8')
309 | stream.write(data)
310 | stream.flush()
311 |
312 | def tell(self):
313 | raise IOError
314 |
315 | def flush(self):
316 | for stream in self.outputs:
317 | stream.flush()
318 | # --/ sys.stdout
319 |
320 | if logfile:
321 | openlog = open(logfile, 'wb')
322 | # copy stdout and stderr streams to log file
323 | savedstd = sys.stderr, sys.stdout
324 | sys.stderr = TeeOutput(sys.stderr, openlog)
325 | sys.stdout = TeeOutput(sys.stdout, openlog)
326 |
327 | def echo(msg, linefeed=True):
328 | sys.stdout.write(msg)
329 | if linefeed:
330 | sys.stdout.write('\n')
331 |
332 | expected = '''\
333 | 00000000: 00 00 00 5B 68 65 78 64 75 6D 70 5D 00 00 00 00 ...[hexdump]....
334 | 00000010: 00 11 22 33 44 55 66 77 88 99 0A BB CC DD EE FF .."3DUfw........\
335 | '''
336 |
337 | # get path to hexfile.bin
338 | # this doesn't work from .zip
339 | # import os.path as osp
340 | # hexfile = osp.dirname(osp.abspath(__file__)) + '/hexfile.bin'
341 | # this doesn't work either
342 | # hexfile = osp.dirname(sys.modules[__name__].__file__) + '/hexfile.bin'
343 | # this works
344 | import pkgutil
345 | bin = pkgutil.get_data('hexdump', 'data/hexfile.bin')
346 |
347 | # varios length of input data
348 | hexdump(b'zzzz' * 12)
349 | hexdump(b'o' * 17)
350 | hexdump(b'p' * 24)
351 | hexdump(b'q' * 26)
352 | # allowable character set filter
353 | hexdump(b'line\nfeed\r\ntest')
354 | hexdump(b'\x00\x00\x00\x5B\x68\x65\x78\x64\x75\x6D\x70\x5D\x00\x00\x00\x00'
355 | b'\x00\x11\x22\x33\x44\x55\x66\x77\x88\x99\x0A\xBB\xCC\xDD\xEE\xFF')
356 | print('---')
357 | # dumping file-like binary object to screen (default behavior)
358 | hexdump(bin)
359 | print('return output')
360 | hexout = hexdump(bin, result='return')
361 | assert hexout == expected, 'returned hex didn\'t match'
362 | print('return generator')
363 | hexgen = hexdump(bin, result='generator')
364 | assert next(hexgen) == expected.split('\n')[0], 'hex generator 1 didn\'t match'
365 | assert next(hexgen) == expected.split('\n')[1], 'hex generator 2 didn\'t match'
366 |
367 | # binary restore test
368 | bindata = restore(
369 | '''
370 | 00000000: 00 00 00 5B 68 65 78 64 75 6D 70 5D 00 00 00 00 ...[hexdump]....
371 | 00000010: 00 11 22 33 44 55 66 77 88 99 0A BB CC DD EE FF .."3DUfw........
372 | ''')
373 | echo('restore check ', linefeed=False)
374 | assert bin == bindata, 'restore check failed'
375 | echo('passed')
376 |
377 | far = \
378 | '''
379 | 000000000: 00 00 00 5B 68 65 78 64 ¦ 75 6D 70 5D 00 00 00 00 [hexdump]
380 | 000000010: 00 11 22 33 44 55 66 77 ¦ 88 99 0A BB CC DD EE FF ?"3DUfwª»ÌÝîÿ
381 | '''
382 | echo('restore far format ', linefeed=False)
383 | assert bin == restore(far), 'far format check failed'
384 | echo('passed')
385 |
386 | scapy = '''\
387 | 00 00 00 5B 68 65 78 64 75 6D 70 5D 00 00 00 00 ...[hexdump]....
388 | 00 11 22 33 44 55 66 77 88 99 0A BB CC DD EE FF .."3DUfw........
389 | '''
390 | echo('restore scapy format ', linefeed=False)
391 | assert bin == restore(scapy), 'scapy format check failed'
392 | echo('passed')
393 |
394 | if not PY3K:
395 | assert restore('5B68657864756D705D') == '[hexdump]', 'no space check failed'
396 | assert dump('\\\xa1\xab\x1e', sep='').lower() == '5ca1ab1e'
397 | else:
398 | assert restore('5B68657864756D705D') == b'[hexdump]', 'no space check failed'
399 | assert dump(b'\\\xa1\xab\x1e', sep='').lower() == '5ca1ab1e'
400 |
401 | print('---[test file hexdumping]---')
402 |
403 | import os
404 | import tempfile
405 | hexfile = tempfile.NamedTemporaryFile(delete=False)
406 | try:
407 | hexfile.write(bin)
408 | hexfile.close()
409 | hexdump(open(hexfile.name, 'rb'))
410 | finally:
411 | os.remove(hexfile.name)
412 | if logfile:
413 | sys.stderr, sys.stdout = savedstd
414 | openlog.close()
415 |
416 |
417 | def main():
418 | from optparse import OptionParser
419 | parser = OptionParser(usage='''
420 | %prog [binfile|-]
421 | %prog -r hexfile
422 | %prog --test [logfile]''', version=__version__)
423 | parser.add_option('-r', '--restore', action='store_true',
424 | help='restore binary from hex dump')
425 | parser.add_option('--test', action='store_true', help='run hexdump sanity checks')
426 |
427 | options, args = parser.parse_args()
428 |
429 | if options.test:
430 | if args:
431 | runtest(logfile=args[0])
432 | else:
433 | runtest()
434 | elif not args or len(args) > 1:
435 | parser.print_help()
436 | sys.exit(-1)
437 | else:
438 | ## dump file
439 | if not options.restore:
440 | # [x] memory effective dump
441 | if args[0] == '-':
442 | if not PY3K:
443 | hexdump(sys.stdin)
444 | else:
445 | hexdump(sys.stdin.buffer)
446 | else:
447 | hexdump(open(args[0], 'rb'))
448 |
449 | ## restore file
450 | else:
451 | # prepare input stream
452 | if args[0] == '-':
453 | instream = sys.stdin
454 | else:
455 | if PY3K:
456 | instream = open(args[0])
457 | else:
458 | instream = open(args[0], 'rb')
459 |
460 | # output stream
461 | # [ ] memory efficient restore
462 | if PY3K:
463 | sys.stdout.buffer.write(restore(instream.read()))
464 | else:
465 | # Windows - binary mode for sys.stdout to prevent data corruption
466 | normalize_py()
467 | sys.stdout.write(restore(instream.read()))
468 |
469 |
470 | if __name__ == '__main__':
471 | main()
472 |
473 | # [x] file restore from command line utility
474 | # [ ] write dump with LF on Windows for consistency
475 | # [ ] encoding param for hexdump()ing Python 3 str if anybody requests that
476 |
477 | # [ ] document chunking API
478 | # [ ] document hexdump API
479 | # [ ] blog about sys.stdout text mode problem on Windows
480 |
--------------------------------------------------------------------------------
/pic/Sample.PNG:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/r0ysue/r0capture/f8f06133c505a08fca6dff147c1e4d93953ca43c/pic/Sample.PNG
--------------------------------------------------------------------------------
/pic/bypass.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/r0ysue/r0capture/f8f06133c505a08fca6dff147c1e4d93953ca43c/pic/bypass.png
--------------------------------------------------------------------------------
/pic/clientcer.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/r0ysue/r0capture/f8f06133c505a08fca6dff147c1e4d93953ca43c/pic/clientcer.png
--------------------------------------------------------------------------------
/pic/difport.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/r0ysue/r0capture/f8f06133c505a08fca6dff147c1e4d93953ca43c/pic/difport.png
--------------------------------------------------------------------------------
/pic/locator.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/r0ysue/r0capture/f8f06133c505a08fca6dff147c1e4d93953ca43c/pic/locator.png
--------------------------------------------------------------------------------
/pic/sslunpinningcer.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/r0ysue/r0capture/f8f06133c505a08fca6dff147c1e4d93953ca43c/pic/sslunpinningcer.png
--------------------------------------------------------------------------------
/pic/summary1.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/r0ysue/r0capture/f8f06133c505a08fca6dff147c1e4d93953ca43c/pic/summary1.jpg
--------------------------------------------------------------------------------
/pic/summary2.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/r0ysue/r0capture/f8f06133c505a08fca6dff147c1e4d93953ca43c/pic/summary2.jpg
--------------------------------------------------------------------------------
/r0capture.py:
--------------------------------------------------------------------------------
1 | # Copyright 2017 Google Inc. All Rights Reserved.
2 |
3 | # Licensed under the Apache License, Version 2.0 (the "License");
4 | # you may not use this file except in compliance with the License.
5 | # You may obtain a copy of the License at
6 | #
7 | # http://www.apache.org/licenses/LICENSE-2.0
8 | #
9 | # Unless required by applicable law or agreed to in writing, software
10 | # distributed under the License is distributed on an "AS IS" BASIS,
11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | # See the License for the specific language governing permissions and
13 | # limitations under the License.
14 |
15 | """Decrypts and logs a process's SSL traffic.
16 | Hooks the functions SSL_read() and SSL_write() in a given process and logs the
17 | decrypted data to the console and/or to a pcap file.
18 | Typical usage example:
19 | ssl_log("wget", "log.pcap", True)
20 | Dependencies:
21 | frida (https://www.frida.re/):
22 | sudo pip install frida
23 | hexdump (https://bitbucket.org/techtonik/hexdump/) if using verbose output:
24 | sudo pip install hexdump
25 | """
26 |
27 | __author__ = "geffner@google.com (Jason Geffner)"
28 | __version__ = "2.0"
29 |
30 | """
31 | # r0capture
32 |
33 | ID: r0ysue
34 |
35 | 安卓应用层抓包通杀脚本
36 |
37 | https://github.com/r0ysue/r0capture
38 |
39 | ## 简介
40 |
41 | - 仅限安卓平台，测试安卓7、8、9、10 可用 ；
42 | - 无视所有证书校验或绑定，无视任何证书；
43 | - 通杀TCP/IP四层模型中的应用层中的全部协议；
44 | - 通杀协议包括：Http,WebSocket,Ftp,Xmpp,Imap,Smtp,Protobuf等等、以及它们的SSL版本；
45 | - 通杀所有应用层框架，包括HttpUrlConnection、Okhttp1/3/4、Retrofit/Volley等等；
46 | """
47 |
48 | # Windows版本需要安装库：
49 | # pip install 'win_inet_pton'
50 | # pip install hexdump
51 | import argparse
52 | import os
53 | import pprint
54 | import random
55 | import signal
56 | import socket
57 | import struct
58 | import sys
59 | import time
60 | from pathlib import Path
61 |
62 | import frida
63 | from loguru import logger
64 |
65 | try:
66 | if os.name == 'nt':
67 | import win_inet_pton
68 | except ImportError:
69 | # win_inet_pton import error
70 | pass
71 |
72 | try:
73 | import myhexdump as hexdump # pylint: disable=g-import-not-at-top
74 | except ImportError:
75 | pass
76 | try:
77 | from shutil import get_terminal_size as get_terminal_size
78 | except:
79 | try:
80 | from backports.shutil_get_terminal_size import get_terminal_size as get_terminal_size
81 | except:
82 | pass
83 |
84 | try:
85 | import click
86 | except:
87 | class click:
88 | @staticmethod
89 | def secho(message=None, **kwargs):
90 | print(message)
91 |
92 | @staticmethod
93 | def style(**kwargs):
94 | raise Exception("unsupported style")
95 | banner = """
96 | --------------------------------------------------------------------------------------------
97 | .oooo. .
98 | d8P'`Y8b .o8
99 | oooo d8b 888 888 .ooooo. .oooo. oo.ooooo. .o888oo oooo oooo oooo d8b .ooooo.
100 | `888""8P 888 888 d88' `"Y8 `P )88b 888' `88b 888 `888 `888 `888""8P d88' `88b
101 | 888 888 888 888 .oP"888 888 888 888 888 888 888 888ooo888
102 | 888 `88b d88' 888 .o8 d8( 888 888 888 888 . 888 888 888 888 .o
103 | d888b `Y8bd8P' `Y8bod8P' `Y888""8o 888bod8P' "888" `V88V"V8P' d888b `Y8bod8P'
104 | 888
105 | o888o
106 | https://github.com/r0ysue/r0capture
107 | --------------------------------------------------------------------------------------------\n
108 | """
109 |
110 |
111 | def show_banner():
112 | colors = ['bright_red', 'bright_green', 'bright_blue', 'cyan', 'magenta']
113 | try:
114 | click.style('color test', fg='bright_red')
115 | except:
116 | colors = ['red', 'green', 'blue', 'cyan', 'magenta']
117 | try:
118 | columns = get_terminal_size().columns
119 | if columns >= len(banner.splitlines()[1]):
120 | for line in banner.splitlines():
121 | click.secho(line, fg=random.choice(colors))
122 | except:
123 | pass
124 |
125 |
126 | # ssl_session[<SSL_SESSION id>] = (<bytes sent by client>,
127 | # <bytes sent by server>)
128 | ssl_sessions = {}
129 |
130 |
131 | def ssl_log(process, pcap=None, host=False, verbose=False, isUsb=False, ssllib="", isSpawn=True, wait=0):
132 | """Decrypts and logs a process's SSL traffic.
133 | Hooks the functions SSL_read() and SSL_write() in a given process and logs
134 | the decrypted data to the console and/or to a pcap file.
135 | Args:
136 | process: The target process's name (as a string) or process ID (as an int).
137 | pcap: The file path to which the pcap file should be written.
138 | verbose: If True, log the decrypted traffic to the console.
139 | Raises:
140 | NotImplementedError: Not running on a Linux or macOS system.
141 | """
142 |
143 | # if platform.system() not in ("Darwin", "Linux"):
144 | # raise NotImplementedError("This function is only implemented for Linux and "
145 | # "macOS systems.")
146 |
147 | def log_pcap(pcap_file, ssl_session_id, function, src_addr, src_port,
148 | dst_addr, dst_port, data):
149 | """Writes the captured data to a pcap file.
150 | Args:
151 | pcap_file: The opened pcap file.
152 | ssl_session_id: The SSL session ID for the communication.
153 | function: The function that was intercepted ("SSL_read" or "SSL_write").
154 | src_addr: The source address of the logged packet.
155 | src_port: The source port of the logged packet.
156 | dst_addr: The destination address of the logged packet.
157 | dst_port: The destination port of the logged packet.
158 | data: The decrypted packet data.
159 | """
160 | t = time.time()
161 |
162 | if ssl_session_id not in ssl_sessions:
163 | ssl_sessions[ssl_session_id] = (random.randint(0, 0xFFFFFFFF),
164 | random.randint(0, 0xFFFFFFFF))
165 | client_sent, server_sent = ssl_sessions[ssl_session_id]
166 |
167 | if function == "SSL_read":
168 | seq, ack = (server_sent, client_sent)
169 | else:
170 | seq, ack = (client_sent, server_sent)
171 |
172 | for writes in (
173 | # PCAP record (packet) header
174 | ("=I", int(t)), # Timestamp seconds
175 | ("=I", int((t * 1000000) % 1000000)), # Timestamp microseconds
176 | ("=I", 40 + len(data)), # Number of octets saved
177 | ("=i", 40 + len(data)), # Actual length of packet
178 | # IPv4 header
179 | (">B", 0x45), # Version and Header Length
180 | (">B", 0), # Type of Service
181 | (">H", 40 + len(data)), # Total Length
182 | (">H", 0), # Identification
183 | (">H", 0x4000), # Flags and Fragment Offset
184 | (">B", 0xFF), # Time to Live
185 | (">B", 6), # Protocol
186 | (">H", 0), # Header Checksum
187 | (">I", src_addr), # Source Address
188 | (">I", dst_addr), # Destination Address
189 | # TCP header
190 | (">H", src_port), # Source Port
191 | (">H", dst_port), # Destination Port
192 | (">I", seq), # Sequence Number
193 | (">I", ack), # Acknowledgment Number
194 | (">H", 0x5018), # Header Length and Flags
195 | (">H", 0xFFFF), # Window Size
196 | (">H", 0), # Checksum
197 | (">H", 0)): # Urgent Pointer
198 | pcap_file.write(struct.pack(writes[0], writes[1]))
199 | pcap_file.write(data)
200 |
201 | if function == "SSL_read":
202 | server_sent += len(data)
203 | else:
204 | client_sent += len(data)
205 | ssl_sessions[ssl_session_id] = (client_sent, server_sent)
206 |
207 | def on_message(message, data):
208 | """Callback for errors and messages sent from Frida-injected JavaScript.
209 | Logs captured packet data received from JavaScript to the console and/or a
210 | pcap file. See https://www.frida.re/docs/messages/ for more detail on
211 | Frida's messages.
212 | Args:
213 | message: A dictionary containing the message "type" and other fields
214 | dependent on message type.
215 | data: The string of captured decrypted data.
216 | """
217 | if message["type"] == "error":
218 | logger.info(f"{message}")
219 | os.kill(os.getpid(), signal.SIGTERM)
220 | return
221 | if len(data) == 1:
222 | logger.info(f'{message["payload"]["function"]}')
223 | logger.info(f'{message["payload"]["stack"]}')
224 | return
225 | p = message["payload"]
226 | if verbose:
227 | src_addr = socket.inet_ntop(socket.AF_INET,
228 | struct.pack(">I", p["src_addr"]))
229 | dst_addr = socket.inet_ntop(socket.AF_INET,
230 | struct.pack(">I", p["dst_addr"]))
231 | session_id = p['ssl_session_id']
232 | logger.info(f"SSL Session: {session_id}")
233 | logger.info("[%s] %s:%d --> %s:%d" % (
234 | p["function"],
235 | src_addr,
236 | p["src_port"],
237 | dst_addr,
238 | p["dst_port"]))
239 | gen = hexdump.hexdump(data, result="generator",only_str=True)
240 | str_gen = ''.join(gen)
241 | logger.info(f"{str_gen}")
242 | logger.info(f"{p['stack']}")
243 | if pcap:
244 | log_pcap(pcap_file, p["ssl_session_id"], p["function"], p["src_addr"],
245 | p["src_port"], p["dst_addr"], p["dst_port"], data)
246 |
247 | if isUsb:
248 | try:
249 | device = frida.get_usb_device()
250 | except:
251 | device = frida.get_remote_device()
252 | else:
253 | if host:
254 | manager = frida.get_device_manager()
255 | device = manager.add_remote_device(host)
256 | else:
257 | device = frida.get_local_device()
258 |
259 | if isSpawn:
260 | pid = device.spawn([process])
261 | time.sleep(1)
262 | session = device.attach(pid)
263 | time.sleep(1)
264 | device.resume(pid)
265 | else:
266 | print("attach")
267 | session = device.attach(process)
268 | if wait > 0:
269 | print(f"wait for {wait} seconds")
270 | time.sleep(wait)
271 |
272 | # session = frida.attach(process)
273 |
274 | # pid = device.spawn([process])
275 | # pid = process
276 | # session = device.attach(pid)
277 | # device.resume(pid)
278 | if pcap:
279 | pcap_file = open(pcap, "wb", 0)
280 | for writes in (
281 | ("=I", 0xa1b2c3d4), # Magic number
282 | ("=H", 2), # Major version number
283 | ("=H", 4), # Minor version number
284 | ("=i", time.timezone), # GMT to local correction
285 | ("=I", 0), # Accuracy of timestamps
286 | ("=I", 65535), # Max length of captured packets
287 | ("=I", 228)): # Data link type (LINKTYPE_IPV4)
288 | pcap_file.write(struct.pack(writes[0], writes[1]))
289 |
290 | with open(Path(__file__).resolve().parent.joinpath("./script.js"), encoding="utf-8") as f:
291 | _FRIDA_SCRIPT = f.read()
292 | # _FRIDA_SCRIPT = session.create_script(content)
293 | # print(_FRIDA_SCRIPT)
294 | script = session.create_script(_FRIDA_SCRIPT)
295 | script.on("message", on_message)
296 | script.load()
297 |
298 | if ssllib != "":
299 | script.exports.setssllib(ssllib)
300 |
301 | print("Press Ctrl+C to stop logging.")
302 |
303 | def stoplog(signum, frame):
304 | print('You have stoped logging.')
305 | session.detach()
306 | if pcap:
307 | pcap_file.flush()
308 | pcap_file.close()
309 | exit()
310 |
311 | signal.signal(signal.SIGINT, stoplog)
312 | signal.signal(signal.SIGTERM, stoplog)
313 | sys.stdin.read()
314 |
315 |
316 | if __name__ == "__main__":
317 | show_banner()
318 |
319 |
320 | class ArgParser(argparse.ArgumentParser):
321 |
322 | def error(self, message):
323 | print("ssl_logger v" + __version__)
324 | print("by " + __author__)
325 | print("Modified by BigFaceCat")
326 | print("Error: " + message)
327 | print()
328 | print(self.format_help().replace("usage:", "Usage:"))
329 | self.exit(0)
330 |
331 |
332 | parser = ArgParser(
333 | add_help=False,
334 | description="Decrypts and logs a process's SSL traffic.",
335 | formatter_class=argparse.RawDescriptionHelpFormatter,
336 | epilog=r"""
337 | Examples:
338 | %(prog)s -pcap ssl.pcap openssl
339 | %(prog)s -verbose 31337
340 | %(prog)s -pcap log.pcap -verbose wget
341 | %(prog)s -pcap log.pcap -ssl "*libssl.so*" com.bigfacecat.testdemo
342 | """)
343 |
344 | args = parser.add_argument_group("Arguments")
345 | args.add_argument("-pcap", '-p', metavar="<path>", required=False,
346 | help="Name of PCAP file to write")
347 | args.add_argument("-host", '-H', metavar="<192.168.1.1:27042>", required=False,
348 | help="connect to remote frida-server on HOST")
349 | args.add_argument("-verbose", "-v", required=False, action="store_const", default=True,
350 | const=True, help="Show verbose output")
351 | args.add_argument("process", metavar="<process name | process id>",
352 | help="Process whose SSL calls to log")
353 | args.add_argument("-ssl", default="", metavar="<lib>",
354 | help="SSL library to hook")
355 | args.add_argument("--isUsb", "-U", default=False, action="store_true",
356 | help="connect to USB device")
357 | args.add_argument("--isSpawn", "-f", default=False, action="store_true",
358 | help="if spawned app")
359 | args.add_argument("-wait", "-w", type=int, metavar="<seconds>", default=0,
360 | help="Time to wait for the process")
361 |
362 | parsed = parser.parse_args()
363 | logger.add(f"{parsed.process.replace('.','_')}-{int(time.time())}.log", rotation="500MB", encoding="utf-8", enqueue=True, retention="10 days")
364 |
365 | ssl_log(
366 | int(parsed.process) if parsed.process.isdigit() else parsed.process,
367 | parsed.pcap,
368 | parsed.host,
369 | parsed.verbose,
370 | isUsb=parsed.isUsb,
371 | isSpawn=parsed.isSpawn,
372 | ssllib=parsed.ssl,
373 | wait=parsed.wait
374 | )
375 |
--------------------------------------------------------------------------------
/script.js:
--------------------------------------------------------------------------------
1 | /**
2 | * Initializes 'addresses' dictionary and NativeFunctions.
3 | */
4 | "use strict";
5 | rpc.exports = {
6 | setssllib: function (name) {
7 | console.log("setSSLLib => " + name);
8 | libname = name;
9 | initializeGlobals();
10 | return;
11 | }
12 | };
13 |
14 | var addresses = {};
15 | var SSL_get_fd = null;
16 | var SSL_get_session = null;
17 | var SSL_SESSION_get_id = null;
18 | var getpeername = null;
19 | var getsockname = null;
20 | var ntohs = null;
21 | var ntohl = null;
22 | var SSLstackwrite = null;
23 | var SSLstackread = null;
24 |
25 | var libname = "*libssl*";
26 |
27 | function uuid(len, radix) {
28 | var chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'.split('');
29 | var uuid = [], i;
30 | radix = radix || chars.length;
31 |
32 | if (len) {
33 | // Compact form
34 | for (i = 0; i < len; i++) uuid[i] = chars[0 | Math.random() * radix];
35 | } else {
36 | // rfc4122, version 4 form
37 | var r;
38 |
39 | // rfc4122 requires these characters
40 | uuid[8] = uuid[13] = uuid[18] = uuid[23] = '-';
41 | uuid[14] = '4';
42 |
43 | // Fill in random data. At i==19 set the high bits of clock sequence as
44 | // per rfc4122, sec. 4.1.5
45 | for (i = 0; i < 36; i++) {
46 | if (!uuid[i]) {
47 | r = 0 | Math.random() * 16;
48 | uuid[i] = chars[(i == 19) ? (r & 0x3) | 0x8 : r];
49 | }
50 | }
51 | }
52 |
53 | return uuid.join('');
54 | }
55 | function return_zero(args) {
56 | return 0;
57 | }
58 | function initializeGlobals() {
59 | var resolver = new ApiResolver("module");
60 | var exps = [
61 | [Process.platform == "darwin" ? "*libboringssl*" : "*libssl*", ["SSL_read", "SSL_write", "SSL_get_fd", "SSL_get_session", "SSL_SESSION_get_id"]], // for ios and Android
62 | [Process.platform == "darwin" ? "*libsystem*" : "*libc*", ["getpeername", "getsockname", "ntohs", "ntohl"]]
63 | ];
64 | // console.log(exps)
65 | for (var i = 0; i < exps.length; i++) {
66 | var lib = exps[i][0];
67 | var names = exps[i][1];
68 | for (var j = 0; j < names.length; j++) {
69 | var name = names[j];
70 | // console.log("exports:" + lib + "!" + name)
71 | var matches = resolver.enumerateMatchesSync("exports:" + lib + "!" + name);
72 | if (matches.length == 0) {
73 | if (name == "SSL_get_fd") {
74 | addresses["SSL_get_fd"] = 0;
75 | continue;
76 | }
77 | throw "Could not find " + lib + "!" + name;
78 | }
79 | else if (matches.length != 1) {
80 | // Sometimes Frida returns duplicates.
81 | var address = 0;
82 | var s = "";
83 | var duplicates_only = true;
84 | for (var k = 0; k < matches.length; k++) {
85 | if (s.length != 0) {
86 | s += ", ";
87 | }
88 | s += matches[k].name + "@" + matches[k].address;
89 | if (address == 0) {
90 | address = matches[k].address;
91 | }
92 | else if (!address.equals(matches[k].address)) {
93 | duplicates_only = false;
94 | }
95 | }
96 | if (!duplicates_only) {
97 | throw "More than one match found for " + lib + "!" + name + ": " + s;
98 | }
99 | }
100 | addresses[name] = matches[0].address;
101 | }
102 | }
103 | if (addresses["SSL_get_fd"] == 0) {
104 | SSL_get_fd = return_zero;
105 | } else {
106 | SSL_get_fd = new NativeFunction(addresses["SSL_get_fd"], "int", ["pointer"]);
107 | }
108 | SSL_get_session = new NativeFunction(addresses["SSL_get_session"], "pointer", ["pointer"]);
109 | SSL_SESSION_get_id = new NativeFunction(addresses["SSL_SESSION_get_id"], "pointer", ["pointer", "pointer"]);
110 | getpeername = new NativeFunction(addresses["getpeername"], "int", ["int", "pointer", "pointer"]);
111 | getsockname = new NativeFunction(addresses["getsockname"], "int", ["int", "pointer", "pointer"]);
112 | ntohs = new NativeFunction(addresses["ntohs"], "uint16", ["uint16"]);
113 | ntohl = new NativeFunction(addresses["ntohl"], "uint32", ["uint32"]);
114 | }
115 | initializeGlobals();
116 |
117 | function ipToNumber(ip) {
118 | var num = 0;
119 | if (ip == "") {
120 | return num;
121 | }
122 | var aNum = ip.split(".");
123 | if (aNum.length != 4) {
124 | return num;
125 | }
126 | num += parseInt(aNum[0]) << 0;
127 | num += parseInt(aNum[1]) << 8;
128 | num += parseInt(aNum[2]) << 16;
129 | num += parseInt(aNum[3]) << 24;
130 | num = num >>> 0;//这个很关键，不然可能会出现负数的情况
131 | return num;
132 | }
133 |
134 | /**
135 | * Returns a dictionary of a sockfd's "src_addr", "src_port", "dst_addr", and
136 | * "dst_port".
137 | * @param {int} sockfd The file descriptor of the socket to inspect.
138 | * @param {boolean} isRead If true, the context is an SSL_read call. If
139 | * false, the context is an SSL_write call.
140 | * @return {dict} Dictionary of sockfd's "src_addr", "src_port", "dst_addr",
141 | * and "dst_port".
142 | */
143 | function getPortsAndAddresses(sockfd, isRead) {
144 | var message = {};
145 | var src_dst = ["src", "dst"];
146 | for (var i = 0; i < src_dst.length; i++) {
147 | if ((src_dst[i] == "src") ^ isRead) {
148 | var sockAddr = Socket.localAddress(sockfd)
149 | }
150 | else {
151 | var sockAddr = Socket.peerAddress(sockfd)
152 | }
153 | if (sockAddr == null) {
154 | // 网络超时or其他原因可能导致socket被关闭
155 | message[src_dst[i] + "_port"] = 0
156 | message[src_dst[i] + "_addr"] = 0
157 | } else {
158 | message[src_dst[i] + "_port"] = (sockAddr.port & 0xFFFF)
159 | message[src_dst[i] + "_addr"] = ntohl(ipToNumber(sockAddr.ip.split(":").pop()))
160 | }
161 | }
162 | return message;
163 | }
164 | /**
165 | * Get the session_id of SSL object and return it as a hex string.
166 | * @param {!NativePointer} ssl A pointer to an SSL object.
167 | * @return {dict} A string representing the session_id of the SSL object's
168 | * SSL_SESSION. For example,
169 | * "59FD71B7B90202F359D89E66AE4E61247954E28431F6C6AC46625D472FF76336".
170 | */
171 | function getSslSessionId(ssl) {
172 | var session = SSL_get_session(ssl);
173 | if (session == 0) {
174 | return 0;
175 | }
176 | var len = Memory.alloc(4);
177 | var p = SSL_SESSION_get_id(session, len);
178 | len = Memory.readU32(len);
179 | var session_id = "";
180 | for (var i = 0; i < len; i++) {
181 | // Read a byte, convert it to a hex string (0xAB ==> "AB"), and append
182 | // it to session_id.
183 | session_id +=
184 | ("0" + Memory.readU8(p.add(i)).toString(16).toUpperCase()).substr(-2);
185 | }
186 | return session_id;
187 | }
188 |
189 | Interceptor.attach(addresses["SSL_read"],
190 | {
191 | onEnter: function (args) {
192 | var message = getPortsAndAddresses(SSL_get_fd(args[0]), true);
193 | message["ssl_session_id"] = getSslSessionId(args[0]);
194 | message["function"] = "SSL_read";
195 | message["stack"] = SSLstackread;
196 | this.message = message;
197 | this.buf = args[1];
198 | },
199 | onLeave: function (retval) {
200 | retval |= 0; // Cast retval to 32-bit integer.
201 | if (retval <= 0) {
202 | return;
203 | }
204 | send(this.message, Memory.readByteArray(this.buf, retval));
205 | }
206 | });
207 |
208 | Interceptor.attach(addresses["SSL_write"],
209 | {
210 | onEnter: function (args) {
211 | var message = getPortsAndAddresses(SSL_get_fd(args[0]), false);
212 | message["ssl_session_id"] = getSslSessionId(args[0]);
213 | message["function"] = "SSL_write";
214 | message["stack"] = SSLstackwrite;
215 | send(message, Memory.readByteArray(args[1], parseInt(args[2])));
216 | },
217 | onLeave: function (retval) {
218 | }
219 | });
220 |
221 | if (Java.available) {
222 | Java.perform(function () {
223 | function storeP12(pri, p7, p12Path, p12Password) {
224 | var X509Certificate = Java.use("java.security.cert.X509Certificate")
225 | var p7X509 = Java.cast(p7, X509Certificate);
226 | var chain = Java.array("java.security.cert.X509Certificate", [p7X509])
227 | var ks = Java.use("java.security.KeyStore").getInstance("PKCS12", "BC");
228 | ks.load(null, null);
229 | ks.setKeyEntry("client", pri, Java.use('java.lang.String').$new(p12Password).toCharArray(), chain);
230 | try {
231 | var out = Java.use("java.io.FileOutputStream").$new(p12Path);
232 | ks.store(out, Java.use('java.lang.String').$new(p12Password).toCharArray())
233 | } catch (exp) {
234 | console.log(exp)
235 | }
236 | }
237 | //在服务器校验客户端的情形下，帮助dump客户端证书，并保存为p12的格式，证书密码为r0ysue
238 | Java.use("java.security.KeyStore$PrivateKeyEntry").getPrivateKey.implementation = function () {
239 | var result = this.getPrivateKey()
240 | var packageName = Java.use("android.app.ActivityThread").currentApplication().getApplicationContext().getPackageName();
241 | storeP12(this.getPrivateKey(), this.getCertificate(), '/sdcard/Download/' + packageName + uuid(10, 16) + '.p12', 'r0ysue');
242 | var message = {};
243 | message["function"] = "dumpClinetCertificate=>" + '/sdcard/Download/' + packageName + uuid(10, 16) + '.p12' + ' pwd: r0ysue';
244 | message["stack"] = Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new());
245 | var data = Memory.alloc(1);
246 | send(message, Memory.readByteArray(data, 1))
247 | return result;
248 | }
249 | Java.use("java.security.KeyStore$PrivateKeyEntry").getCertificateChain.implementation = function () {
250 | var result = this.getCertificateChain()
251 | var packageName = Java.use("android.app.ActivityThread").currentApplication().getApplicationContext().getPackageName();
252 | storeP12(this.getPrivateKey(), this.getCertificate(), '/sdcard/Download/' + packageName + uuid(10, 16) + '.p12', 'r0ysue');
253 | var message = {};
254 | message["function"] = "dumpClinetCertificate=>" + '/sdcard/Download/' + packageName + uuid(10, 16) + '.p12' + ' pwd: r0ysue';
255 | message["stack"] = Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new());
256 | var data = Memory.alloc(1);
257 | send(message, Memory.readByteArray(data, 1))
258 | return result;
259 | }
260 |
261 | //SSLpinning helper 帮助定位证书绑定的关键代码a
262 | Java.use("java.io.File").$init.overload('java.io.File', 'java.lang.String').implementation = function (file, cert) {
263 | var result = this.$init(file, cert)
264 | var stack = Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new());
265 | if (file.getPath().indexOf("cacert") >= 0 && stack.indexOf("X509TrustManagerExtensions.checkServerTrusted") >= 0) {
266 | var message = {};
267 | message["function"] = "SSLpinning position locator => " + file.getPath() + " " + cert;
268 | message["stack"] = stack;
269 | var data = Memory.alloc(1);
270 | send(message, Memory.readByteArray(data, 1))
271 | }
272 | return result;
273 | }
274 |
275 |
276 | Java.use("java.net.SocketOutputStream").socketWrite0.overload('java.io.FileDescriptor', '[B', 'int', 'int').implementation = function (fd, bytearry, offset, byteCount) {
277 | var result = this.socketWrite0(fd, bytearry, offset, byteCount);
278 | var message = {};
279 | message["function"] = "HTTP_send";
280 | message["ssl_session_id"] = "";
281 | message["src_addr"] = ntohl(ipToNumber((this.socket.value.getLocalAddress().toString().split(":")[0]).split("/").pop()));
282 | message["src_port"] = parseInt(this.socket.value.getLocalPort().toString());
283 | message["dst_addr"] = ntohl(ipToNumber((this.socket.value.getRemoteSocketAddress().toString().split(":")[0]).split("/").pop()));
284 | message["dst_port"] = parseInt(this.socket.value.getRemoteSocketAddress().toString().split(":").pop());
285 | message["stack"] = Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()).toString();
286 | var ptr = Memory.alloc(byteCount);
287 | for (var i = 0; i < byteCount; ++i)
288 | Memory.writeS8(ptr.add(i), bytearry[offset + i]);
289 | send(message, Memory.readByteArray(ptr, byteCount))
290 | return result;
291 | }
292 | Java.use("java.net.SocketInputStream").socketRead0.overload('java.io.FileDescriptor', '[B', 'int', 'int', 'int').implementation = function (fd, bytearry, offset, byteCount, timeout) {
293 | var result = this.socketRead0(fd, bytearry, offset, byteCount, timeout);
294 | var message = {};
295 | message["function"] = "HTTP_recv";
296 | message["ssl_session_id"] = "";
297 | message["src_addr"] = ntohl(ipToNumber((this.socket.value.getRemoteSocketAddress().toString().split(":")[0]).split("/").pop()));
298 | message["src_port"] = parseInt(this.socket.value.getRemoteSocketAddress().toString().split(":").pop());
299 | message["dst_addr"] = ntohl(ipToNumber((this.socket.value.getLocalAddress().toString().split(":")[0]).split("/").pop()));
300 | message["dst_port"] = parseInt(this.socket.value.getLocalPort());
301 | message["stack"] = Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()).toString();
302 | if (result > 0) {
303 | var ptr = Memory.alloc(result);
304 | for (var i = 0; i < result; ++i)
305 | Memory.writeS8(ptr.add(i), bytearry[offset + i]);
306 | send(message, Memory.readByteArray(ptr, result))
307 | }
308 | return result;
309 | }
310 |
311 | if (parseFloat(Java.androidVersion) > 8) {
312 | Java.use("com.android.org.conscrypt.ConscryptFileDescriptorSocket$SSLOutputStream").write.overload('[B', 'int', 'int').implementation = function (bytearry, int1, int2) {
313 | var result = this.write(bytearry, int1, int2);
314 | SSLstackwrite = Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()).toString();
315 | return result;
316 | }
317 | Java.use("com.android.org.conscrypt.ConscryptFileDescriptorSocket$SSLInputStream").read.overload('[B', 'int', 'int').implementation = function (bytearry, int1, int2) {
318 | var result = this.read(bytearry, int1, int2);
319 | SSLstackread = Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()).toString();
320 | return result;
321 | }
322 | }
323 | else {
324 | Java.use("com.android.org.conscrypt.OpenSSLSocketImpl$SSLOutputStream").write.overload('[B', 'int', 'int').implementation = function (bytearry, int1, int2) {
325 | var result = this.write(bytearry, int1, int2);
326 | SSLstackwrite = Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()).toString();
327 | return result;
328 | }
329 | Java.use("com.android.org.conscrypt.OpenSSLSocketImpl$SSLInputStream").read.overload('[B', 'int', 'int').implementation = function (bytearry, int1, int2) {
330 | var result = this.read(bytearry, int1, int2);
331 | SSLstackread = Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()).toString();
332 | return result;
333 | }
334 |
335 | }
336 | }
337 |
338 | )
339 | }
340 |
--------------------------------------------------------------------------------