heibai2006/frida-snippets
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

socket activity #refactoring

Browse Source
This commit is contained in:
iddoeldor 2019-04-17 15:14:14 +03:00 committed by GitHub
parent 11fce7c847
commit 2b87e7e6bc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 56 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

104
README.md
View File

@ -67,31 +67,35 @@
#### Socket activity #### Socket activity
```js ```js
var socketFunctionPrefixes = ['connect', 'recv', 'send', 'read', 'write']; Module.enumerateExportsSync(
function isSocketFunction(name) { // finding socket module path
return socketFunctionPrefixes.some(function (prefix) { Process.enumerateModulesSync().filter(function(m){·
return name.indexOf(prefix) === 0; return m.name === { linux: 'libc.so', darnwin: 'libSystem.B.dylib', windows: 'ws2_32.dll' }[Process.platform]
}); })[0].path
} ).forEach(function(ex){
var libcPath = Process.enumerateModulesSync().filter(function(m){return m.name.indexOf('libc.so')!=-1})[0].path; // on iOS (darwin) instead of libc search for libSystem.B.dylib if (
Module.enumerateExportsSync(libcPath).forEach(function(ex){ ex.type === 'function' &&·
if (ex.type === 'function' && isSocketFunction(ex.name)) { // if function contains the prefix of one of the socket related functions
Interceptor.attach(ex.address, { ['connect', 'recv', 'send', 'read', 'write'].some(function(prefix) {
onEnter: function (args) { return ex.name.indexOf(prefix) === 0
this.fd = args[0].toInt32(); })
}, ) {
onLeave: function (retval) { Interceptor.attach(ex.address, {
var fd = this.fd; onEnter: function (args) {
if (Socket.type(fd) !== 'tcp') this.fd = args[0].toInt32();
return; },
var address = Socket.peerAddress(fd); onLeave: function (retval) {
if (address === null) var fd = this.fd;
if (Socket.type(fd) !== 'tcp')
return; return;
console.log(fd, ex.name, address.ip + ':' + address.port); var address = Socket.peerAddress(fd);
} if (address === null)
}); return;
} console.log(fd, ex.name, address.ip + ':' + address.port);
}); }
});
}
});
``` ```
<details> <details>
@ -100,31 +104,35 @@
Android example Android example
``` ```
Java.perform(function(){ Java.perform(function(){
var socketFunctionPrefixes = ['connect', 'recv', 'send', 'read', 'write']; Module.enumerateExportsSync(
function isSocketFunction(name) { // finding socket module path
return socketFunctionPrefixes.some(function (prefix) { Process.enumerateModulesSync().filter(function(m){·
return name.indexOf(prefix) === 0; return m.name === { linux: 'libc.so', darnwin: 'libSystem.B.dylib', windows: 'ws2_32.dll' }[Process.platform]
}); })[0].path
} ).forEach(function(ex){
var libcPath = Process.enumerateModulesSync().filter(function(m){return m.name.indexOf('libc.so')!=-1})[0].path; if (
Module.enumerateExportsSync(libcPath).forEach(function(ex){ ex.type === 'function' &&·
if (ex.type === 'function' && isSocketFunction(ex.name)) { // if function contains the prefix of one of the socket related functions
Interceptor.attach(ex.address, { ['connect', 'recv', 'send', 'read', 'write'].some(function(prefix) {
onEnter: function (args) { return ex.name.indexOf(prefix) === 0
this.fd = args[0].toInt32(); })
}, ) {
onLeave: function (retval) { Interceptor.attach(ex.address, {
var fd = this.fd; onEnter: function (args) {
if (Socket.type(fd) !== 'tcp') this.fd = args[0].toInt32();
return; },
var address = Socket.peerAddress(fd); onLeave: function (retval) {
if (address === null) var fd = this.fd;
if (Socket.type(fd) !== 'tcp')
return; return;
console.log(fd, ex.name, address.ip + ':' + address.port); var address = Socket.peerAddress(fd);
} if (address === null)
}); return;
} console.log(fd, ex.name, address.ip + ':' + address.port);
}); }
});
}
});
}); });
``` ```
```sh ```sh