heibai2006/frida-snippets
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

socket activity

Browse Source
This commit is contained in:
iddoeldor 2019-04-17 14:55:55 +03:00 committed by GitHub
parent f0c0a8c898
commit 11fce7c847
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 78 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
README.md
View File

@ -5,6 +5,7 @@
<details>
<summary>Native</summary>
* [`Socket activity`](#socket-activity)
* [`Intercept open`](#intercept-open)
* [`Execute shell command`](#execute-shell-command)
* [`List modules`](#list-modules)
@ -62,6 +63,83 @@
<hr />
#### Socket activity
```js
var socketFunctionPrefixes = ['connect', 'recv', 'send', 'read', 'write'];
function isSocketFunction(name) {
return socketFunctionPrefixes.some(function (prefix) {
return name.indexOf(prefix) === 0;
});
}
var libcPath = Process.enumerateModulesSync().filter(function(m){return m.name.indexOf('libc.so')!=-1})[0].path; // on iOS (darwin) instead of libc search for libSystem.B.dylib
Module.enumerateExportsSync(libcPath).forEach(function(ex){
if (ex.type === 'function' && isSocketFunction(ex.name)) {
Interceptor.attach(ex.address, {
onEnter: function (args) {
this.fd = args[0].toInt32();
},
onLeave: function (retval) {
var fd = this.fd;
if (Socket.type(fd) !== 'tcp')
return;
var address = Socket.peerAddress(fd);
if (address === null)
return;
console.log(fd, ex.name, address.ip + ':' + address.port);
}
});
}
});
```
<details>
<summary>Output example</summary>
Android example
```
Java.perform(function(){
var socketFunctionPrefixes = ['connect', 'recv', 'send', 'read', 'write'];
function isSocketFunction(name) {
return socketFunctionPrefixes.some(function (prefix) {
return name.indexOf(prefix) === 0;
});
}
var libcPath = Process.enumerateModulesSync().filter(function(m){return m.name.indexOf('libc.so')!=-1})[0].path;
Module.enumerateExportsSync(libcPath).forEach(function(ex){
if (ex.type === 'function' && isSocketFunction(ex.name)) {
Interceptor.attach(ex.address, {
onEnter: function (args) {
this.fd = args[0].toInt32();
},
onLeave: function (retval) {
var fd = this.fd;
if (Socket.type(fd) !== 'tcp')
return;
var address = Socket.peerAddress(fd);
if (address === null)
return;
console.log(fd, ex.name, address.ip + ':' + address.port);
}
});
}
});
});
```
```sh
$ frida -Uf com.example.app -l script.js --no-pause
[Android Model-X::com.example.app]-> 117 write 5.0.2.1:5242
117 read 5.0.2.1:5242
135 write 5.0.2.1:4244
135 read 5.0.2.1:4244
135 read 5.0.2.1:4244
```
</details>
<br>[⬆ Back to top](#table-of-contents)
#### Intercept Open
An example for intercepting `libc#open` & logging backtrace if specific file was opened.