socker协议分析

最新推荐文章于 2021-05-27 16:18:12 发布
最新推荐文章于 2021-05-27 16:18:12 发布
阅读量495 收藏 2
点赞数 2
分类专栏： android安全
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/u014679440/article/details/114260353
版权

分析思路：
1、堆栈回溯
2、控制流分析与数据流分析
3、关键字符串、关键API定位

java层Socket抓包溯源

tcp
java.net.SocketInputStream
		|
		.......
		|
		java层
				|
				socketRead0 （jni）
							|
							native层
java.net.SocketOutputStream
		|
		.......
		|
		java层
				|
				socketWrite0 （jni）
							|
							native层

function LogPrint(log) {
    var theDate = new Date();
    var hour = theDate.getHours();
    var minute = theDate.getMinutes();
    var second = theDate.getSeconds();
    var mSecond = theDate.getMilliseconds();

    hour < 10 ? hour = "0" + hour : hour;
    minute < 10 ? minute = "0" + minute : minute;
    second < 10 ? second = "0" + second : second;
    mSecond < 10 ? mSecond = "00" + mSecond : mSecond < 100 ? mSecond = "0" + mSecond : mSecond;
    var time = hour + ":" + minute + ":" + second + ":" + mSecond;
    var threadid = Process.getCurrentThreadId();
    console.log("[" + time + "]" + "->threadid:" + threadid + "--" + log);

}

function printJavaStack(name) {
    Java.perform(function () {
        var Exception = Java.use("java.lang.Exception");
        var ins = Exception.$new("Exception");
        var straces = ins.getStackTrace();
        if (straces != undefined && straces != null) {
            var strace = straces.toString();
            var replaceStr = strace.replace(/,/g, " \n ");
            LogPrint("=============================" + name + " Stack strat=======================");
            LogPrint(replaceStr);
            LogPrint("=============================" + name + " Stack end======================= \n ");
            Exception.$dispose();
        }
    });
}

function isprintable(value) {
    if (value >= 32 && value <= 126) {
        return true;
    }
    return false;
}

function hooktcp() {
    Java.perform(function () {
        var SocketClass = Java.use('java.net.Socket');
        SocketClass.$init.overload('java.lang.String', 'int').implementation = function (arg0, arg1) {
            console.log("[" + Process.getCurrentThreadId() + "]new Socket connection:" + arg0 + ",port:" + arg1);
            printJavaStack('tcp connect...')
            return this.$init(arg0, arg1);
        }
        var SocketInputStreamClass = Java.use('java.net.SocketInputStream');
        //socketRead0
        SocketInputStreamClass.socketRead0.implementation = function (arg0, arg1, arg2, arg3, arg4) {
            var size = this.socketRead0(arg0, arg1, arg2, arg3, arg4);
            //console.log("[" + Process.getCurrentThreadId() + "]socketRead0:size:" + size + ",content:" + JSON.stringify(arg1));
            var bytearray = Java.array('byte', arg1);
            var content = '';
            for (var i = 0; i < size; i++) {
                if (isprintable(bytearray[i])) {
                    content = content + String.fromCharCode(bytearray[i]);
                }
            }
            var socketimpl = this.impl.value;
            var address = socketimpl.address.value;
            var port = socketimpl.port.value;

            console.log("\naddress:" + address + ",port" + port + "\n" + JSON.stringify(this.socket.value) + "\n[" + Process.getCurrentThreadId() + "]receive:" + content);
            printJavaStack('socketRead0')
            return size;
        }
        var SocketOutPutStreamClass = Java.use('java.net.SocketOutputStream');
        SocketOutPutStreamClass.socketWrite0.implementation = function (arg0, arg1, arg2, arg3) {
            var result = this.socketWrite0(arg0, arg1, arg2, arg3);
            //console.log("[" + Process.getCurrentThreadId() + "]socketWrite0:len:" + arg3 + "--content:" + JSON.stringify(arg1));
            var bytearray = Java.array('byte', arg1);
            var content = '';
            for (var i = 0; i < arg3; i++) {

                if (isprintable(bytearray[i])) {
                    content = content + String.fromCharCode(bytearray[i]);
                }
            }
            var socketimpl = this.impl.value;
            var address = socketimpl.address.value;
            var port = socketimpl.port.value;
            console.log("send address:" + address + ",port" + port + "[" + Process.getCurrentThreadId() + "]send:" + content);
            console.log("\n" + JSON.stringify(this.socket.value) + "\n[" + Process.getCurrentThreadId() + "]send:" + content);
            printJavaStack('socketWrite0')
            return result;
        }
    })
}

function main() {
    hooktcp();
}

setImmediate(main)

udp 
java.net.DatagramSocket.send
	|
	PlainDatagramSockerImpl.send
		|
		IoBridge.sendto
				|
				java层
					|
					libcore.io.Linux.sendtoBytes (jni)
						|
						native层
						
java.net.DatagramSocket.receive
	|
	....
			|
				java层
					|
					libcore.io.Linux.recvfromBytes (jni)
						|
						native层

java.net.DatagramSocket.send

function LogPrint(log) {
    var theDate = new Date();
    var hour = theDate.getHours();
    var minute = theDate.getMinutes();
    var second = theDate.getSeconds();
    var mSecond = theDate.getMilliseconds();

    hour < 10 ? hour = "0" + hour : hour;
    minute < 10 ? minute = "0" + minute : minute;
    second < 10 ? second = "0" + second : second;
    mSecond < 10 ? mSecond = "00" + mSecond : mSecond < 100 ? mSecond = "0" + mSecond : mSecond;
    var time = hour + ":" + minute + ":" + second + ":" + mSecond;
    var threadid = Process.getCurrentThreadId();
    console.log("[" + time + "]" + "->threadid:" + threadid + "--" + log);

}

function printJavaStack(name) {
    Java.perform(function () {
        var Exception = Java.use("java.lang.Exception");
        var ins = Exception.$new("Exception");
        var straces = ins.getStackTrace();
        if (straces != undefined && straces != null) {
            var strace = straces.toString();
            var replaceStr = strace.replace(/,/g, " \n ");
            LogPrint("=============================" + name + " Stack strat=======================");
            LogPrint(replaceStr);
            LogPrint("=============================" + name + " Stack end======================= \n ");
            Exception.$dispose();
        }
    });
}

function isprintable(value) {
    if (value >= 32 && value <= 126) {
        return true;
    }
    return false;
}

function hookudp() {
    Java.perform(function () {
        var LinuxClass = Java.use('libcore.io.Linux');
        //private native int recvfromBytes(FileDescriptor fd, Object buffer, int byteOffset, int byteCount, int flags, InetSocketAddress srcAddress) throws ErrnoException, SocketException;
        LinuxClass.recvfromBytes.implementation = function (arg0, arg1, arg2, arg3, arg4, arg5) {
            var size = this.recvfromBytes(arg0, arg1, arg2, arg3, arg4, arg5);
            var bytearray = Java.array('byte', arg1);
            var content = "";
            for (var i = 0; i < size; i++) {

                if (isprintable(bytearray[i])) {
                    content = content + String.fromCharCode(bytearray[i]);
                }

            }
            console.log("address:" + arg5 + " [" + Process.getCurrentThreadId() + "]recvfromBytes:size:" + size + ",content:" + JSON.stringify(arg1) + "---content," + content);
            printJavaStack('recvfromBytes');
            return size;
        }
        //private native int sendtoBytes(FileDescriptor fd, Object buffer, int byteOffset, int byteCount, int flags, InetAddress inetAddress, int port) throws ErrnoException, SocketException;
        // private native int sendtoBytes(FileDescriptor fd, Object buffer, int byteOffset, int byteCount, int flags, SocketAddress address) throws ErrnoException, SocketException;
        LinuxClass.sendtoBytes.overload('java.io.FileDescriptor', 'java.lang.Object', 'int', 'int', 'int', 'java.net.InetAddress', 'int').implementation = function (arg0, arg1, arg2, arg3, arg4, arg5, arg6) {
            var size = this.sendtoBytes(arg0, arg1, arg2, arg3, arg4, arg5, arg6);
            var bytearray = Java.array('byte', arg1);
            var content = "";
            for (var i = 0; i < size; i++) {
                if (isprintable(bytearray[i])) {
                    content = content + String.fromCharCode(bytearray[i]);
                }

            }
            console.log("address:" + arg5 + ",port" + arg6 + " [" + Process.getCurrentThreadId() + "]LinuxClass11.sendtoBytes:len:" + size + "--content:" + JSON.stringify(arg1) + "--content:" + content);
            printJavaStack('LinuxClass11.sendtoBytes')
            return size;
        }
        LinuxClass.sendtoBytes.overload('java.io.FileDescriptor', 'java.lang.Object', 'int', 'int', 'int', 'java.net.SocketAddress').implementation = function (arg0, arg1, arg2, arg3, arg4, arg5) {
            var size = this.sendtoBytes(arg0, arg1, arg2, arg3, arg4, arg5);
            var bytearray = Java.array('byte', arg1);
            var content = "";
            for (var i = 0; i < size; i++) {
                if (isprintable(bytearray[i])) {
                    content = content + String.fromCharCode(bytearray[i]);
                }
            }
            console.log("address:" + arg5 + " [" + Process.getCurrentThreadId() + "]LinuxClass22.sendtoBytes:len:" + size + "--content:" + JSON.stringify(arg1) + ",content:" + content);
            printJavaStack('LinuxClass22.sendtoBytes')
            return size;
        }


    })

}

function main() {
    hookudp();
}

setImmediate(main)

java层SSL抓包溯源

aosp默认使用okhttp

sslSocker->com.android.org.conscrypt.OpenSSLSocketImplWrapper

发送数据
com.android.org.conscrypt.OpenSSLSocketImpl$SSLSocketOutStream
	|
	write
		|
		com.android.org.conscrypt.NativeCrypto.SSL_write （jni，此时证书加密前的数据）
			|
			native层
		

接收数据
com.android.org.conscrypt.OpenSSLSocketImpl$SSLSocketInputStream
	|
	read
		|
		com.android.org.conscrypt.NativeCrypto.SSL_read （jni，此时证书解密后的数据）
			|
			native层

function LogPrint(log) {
    var theDate = new Date();
    var hour = theDate.getHours();
    var minute = theDate.getMinutes();
    var second = theDate.getSeconds();
    var mSecond = theDate.getMilliseconds();

    hour < 10 ? hour = "0" + hour : hour;
    minute < 10 ? minute = "0" + minute : minute;
    second < 10 ? second = "0" + second : second;
    mSecond < 10 ? mSecond = "00" + mSecond : mSecond < 100 ? mSecond = "0" + mSecond : mSecond;
    var time = hour + ":" + minute + ":" + second + ":" + mSecond;
    var threadid = Process.getCurrentThreadId();
    console.log("[" + time + "]" + "->threadid:" + threadid + "--" + log);

}

function printJavaStack(name) {
    Java.perform(function () {
        var Exception = Java.use("java.lang.Exception");
        var ins = Exception.$new("Exception");
        var straces = ins.getStackTrace();
        if (straces != undefined && straces != null) {
            var strace = straces.toString();
            var replaceStr = strace.replace(/,/g, " \n ");
            LogPrint("=============================" + name + " Stack strat=======================");
            LogPrint(replaceStr);
            LogPrint("=============================" + name + " Stack end======================= \n ");
            Exception.$dispose();
        }
    });
}
function getsocketdetail(fd) {
    var result = "";
    var type = Socket.type(fd);
    if (type != null) {
        result = result + "type:" + type;
        var peer = Socket.peerAddress(fd);
        var local = Socket.localAddress(fd);
        result = result + ",address:" + JSON.stringify(peer) + ",local:" + JSON.stringify(local);
    } else {
        result = "unknown";
    }
    return result;

}

function printNativeStack(context, name) {
    //Debug.
    var array = Thread.backtrace(context, Backtracer.ACCURATE);
    var first = DebugSymbol.fromAddress(array[0]);
    if (first.toString().indexOf('libopenjdk.so!NET_Send') < 0) {
        var trace = Thread.backtrace(context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join("\n");
        LogPrint("-----------start:" + name + "--------------");
        LogPrint(trace);
        LogPrint("-----------end:" + name + "--------------");
    }

}
function isprintable(value) {
    if (value >= 32 && value <= 126) {
        return true;
    }
    return false;
}
function hookssl() {
    Java.perform(function () {
        var NativeCryptoClass = Java.use('com.android.org.conscrypt.NativeCrypto');
        NativeCryptoClass.SSL_read.implementation = function (arg0, arg1, arg2, arg3, arg4, arg5, arg6) {
            var size = this.SSL_read(arg0, arg1, arg2, arg3, arg4, arg5, arg6);
            var bytearray = Java.array('byte', arg3);
            var content = '';
            for (var i = 0; i < size; i++) {
                if (isprintable(bytearray[i])) {
                    content = content + String.fromCharCode(bytearray[i]);
                }
            }
            console.log("\n[" + Process.getCurrentThreadId() + "]ssl receive:" + content);
            printJavaStack('NativeCryptoClass.read')
            return size;
        }
        NativeCryptoClass.SSL_write.implementation = function (arg0, arg1, arg2, arg3, arg4, arg5, arg6) {
            var result = this.SSL_write(arg0, arg1, arg2, arg3, arg4, arg5, arg6);
            var bytearray = Java.array('byte', arg3);
            var content = '';
            for (var i = 0; i < arg5; i++) {
                if (isprintable(bytearray[i])) {
                    content = content + String.fromCharCode(bytearray[i]);
                }
            }
            console.log("\n[" + Process.getCurrentThreadId() + "]ssl send:" + content);
            printJavaStack('NativeCryptoClass.SSL_write')
            return result;
        }
    })
}
function enumerate() {
    Java.perform(function () {
        Java.enumerateLoadedClassesSync().forEach(function (classname) {
            if (classname.indexOf("NativeCrypto") >= 0) {
                console.log(classname);
            }
        })
    })
}

function main() {
    //enumerate();
    hookssl();
}

setImmediate(main)

com.android.org.conscrypt.NativeCrypto.SSL_read 太深了，到上一层
com.android.org.conscrypt.OpenSSLSocketImpl$SSLSocketInputStream拿ip和端口的信息

function LogPrint(log) {
    var theDate = new Date();
    var hour = theDate.getHours();
    var minute = theDate.getMinutes();
    var second = theDate.getSeconds();
    var mSecond = theDate.getMilliseconds();

    hour < 10 ? hour = "0" + hour : hour;
    minute < 10 ? minute = "0" + minute : minute;
    second < 10 ? second = "0" + second : second;
    mSecond < 10 ? mSecond = "00" + mSecond : mSecond < 100 ? mSecond = "0" + mSecond : mSecond;
    var time = hour + ":" + minute + ":" + second + ":" + mSecond;
    var threadid = Process.getCurrentThreadId();
    console.log("[" + time + "]" + "->threadid:" + threadid + "--" + log);

}

function printJavaStack(name) {
    Java.perform(function () {
        var Exception = Java.use("java.lang.Exception");
        var ins = Exception.$new("Exception");
        var straces = ins.getStackTrace();
        if (straces != undefined && straces != null) {
            var strace = straces.toString();
            var replaceStr = strace.replace(/,/g, " \n ");
            LogPrint("=============================" + name + " Stack strat=======================");
            LogPrint(replaceStr);
            LogPrint("=============================" + name + " Stack end======================= \n ");
            Exception.$dispose();
        }
    });
}

function isprintable(value) {
    if (value >= 32 && value <= 126) {
        return true;
    }
    return false;
}

function hooksslsocket() {
    Java.perform(function () {
        var SSLInputStreamClass = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl$SSLInputStream');
        //public int read(byte[] buf, int offset, int byteCount)
        SSLInputStreamClass.read.overload().implementation = function () {
            var value = this.read();
            var sslsocketimplwrapper = this.this$0.value;
            console.log("SSLInputStreamClass.read 1obj->" + sslsocketimplwrapper);
            var socket = sslsocketimplwrapper.socket.value;
            console.log("SSLInputStreamClass.read 1socket->" + socket);
            //console.log("[" + Process.getCurrentThreadId() + "]SSLInputStreamClass.read:len:" + 4 + "--content:" + JSON.stringify(value));
            console.log("[" + Process.getCurrentThreadId() + "]sslsocket read a int:" + value);
            printJavaStack('sslInputStream.read()')
            return value;
        }

        SSLInputStreamClass.read.overload('[B', 'int', 'int').implementation = function (arg0, arg1, arg2) {
            var size = this.read(arg0, arg1, arg2);
            //内部类对象直接得到外部类对象的方法
            var sslsocketimplwrapper = this.this$0.value;
            console.log("SSLInputStreamClass.read 2obj->" + sslsocketimplwrapper);
            var socket = sslsocketimplwrapper.socket.value;
            console.log("SSLInputStreamClass.read 2socket->" + socket);
            //console.log("[" + Process.getCurrentThreadId() + "]SSLInputStreamClass.read:len:" + size + "--content:" + JSON.stringify(arg0));
            var bytearray = Java.array('byte', arg0);
            var content = '';
            for (var i = 0; i < size; i++) {
                if (isprintable(bytearray[i])) {
                    content = content + String.fromCharCode(bytearray[i]);
                }
            }
            /*            var socketimpl = this.impl.value;
                        var address = socketimpl.address.value;
                        var port = socketimpl.port.value;*/
            console.log("[" + Process.getCurrentThreadId() + "]sslsocket read:" + content);
            //console.log("\n" + JSON.stringify(this.socket.value) + "\n[" + Process.getCurrentThreadId() + "]send:" + content);
            printJavaStack('sslInputStream.read')
            return size;
        }

        var SSLOutputStreamClass = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl$SSLOutputStream');
        SSLOutputStreamClass.write.overload('int').implementation = function (arg0) {
            var result = this.write(arg0);
            //通过内部类对象得到外部类对象
            var sslsocketimplwrapper = this.this$0.value;
            console.log("SSLOutputStream 1obj->" + sslsocketimplwrapper);
            var socket = sslsocketimplwrapper.socket.value;
            console.log("SSLOutputStream 1socket->" + socket);
            /*SSLOutputStream 2obj->SSL socket over Socket[address=portal.meirishanglai.com/240.0.0.21,port=443,localPort=37563]
              SSLOutputStream 2socket->Socket[address=portal.meirishanglai.com/240.0.0.21,port=443,localPort=37563]
            */
            console.log("[" + Process.getCurrentThreadId() + "]write(int):len:" + 4 + "--content:" + arg0);
            printJavaStack('sslOutputStream.write(int)')
            return result;
        }

        //public void write(byte[] buf, int offset, int byteCount)
        SSLOutputStreamClass.write.overload('[B', 'int', 'int').implementation = function (arg0, arg1, arg2) {
            var result = this.write(arg0, arg1, arg2);
            var sslsocketimplwrapper = this.this$0.value;
            console.log("SSLOutputStream 2obj->" + sslsocketimplwrapper);
            var socket = sslsocketimplwrapper.socket.value;
            console.log("SSLOutputStream 2socket->" + socket);
            //console.log("[" + Process.getCurrentThreadId() + "]socketWrite0:len:" + arg2 + "--content:" + JSON.stringify(arg0));
            var bytearray = Java.array('byte', arg0);
            var content = '';
            for (var i = 0; i < arg2; i++) {
                if (isprintable(bytearray[i])) {
                    content = content + String.fromCharCode(bytearray[i]);
                }

            }
            /*            var socketimpl = this.impl.value;
                        var address = socketimpl.address.value;
                        var port = socketimpl.port.value;*/
            console.log("[" + Process.getCurrentThreadId() + "]sslsocket send:" + content);
            //console.log("\n" + JSON.stringify(this.socket.value) + "\n[" + Process.getCurrentThreadId() + "]send:" + content);
            printJavaStack('sslOutputStream.write')
            return result;
        }
    })
}

function main() {
    hooksslsocket();
}

setImmediate(main)

jni层Socker抓包溯源

tcp native层
libopenjdk.so - socketRead0
	|
	NET_Read
			|
			libc.so - recvfrom
				|
				系统调用(可以在自己的so中实现recvfrom，然后调用系统调用号)
					|
					内核

libopenjdk.so - socketWrite0
	|
	NET_Send
			|
			libc.so - sendto
				|
				系统调用
					|
					内核

function LogPrint(log) {
    var theDate = new Date();
    var hour = theDate.getHours();
    var minute = theDate.getMinutes();
    var second = theDate.getSeconds();
    var mSecond = theDate.getMilliseconds();

    hour < 10 ? hour = "0" + hour : hour;
    minute < 10 ? minute = "0" + minute : minute;
    second < 10 ? second = "0" + second : second;
    mSecond < 10 ? mSecond = "00" + mSecond : mSecond < 100 ? mSecond = "0" + mSecond : mSecond;
    var time = hour + ":" + minute + ":" + second + ":" + mSecond;
    var threadid = Process.getCurrentThreadId();
    console.log("[" + time + "]" + "->threadid:" + threadid + "--" + log);

}

function printNativeStack(context, name) {
    //Debug.
    var array = Thread.backtrace(context, Backtracer.ACCURATE);
    var first = DebugSymbol.fromAddress(array[0]);
    if (first.toString().indexOf('libopenjdk.so!NET_Send') < 0) {
        var trace = Thread.backtrace(context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join("\n");
        LogPrint("-----------start:" + name + "--------------");
        LogPrint(trace);
        LogPrint("-----------end:" + name + "--------------");
    }

}

function printJavaStack(name) {
    Java.perform(function () {
        var Exception = Java.use("java.lang.Exception");
        var ins = Exception.$new("Exception");
        var straces = ins.getStackTrace();
        if (straces != undefined && straces != null) {
            var strace = straces.toString();
            var replaceStr = strace.replace(/,/g, " \n ");
            LogPrint("=============================" + name + " Stack strat=======================");
            LogPrint(replaceStr);
            LogPrint("=============================" + name + " Stack end======================= \n ");
            Exception.$dispose();
        }
    });
}

function isprintable(value) {
    if (value >= 32 && value <= 126) {
        return true;
    }
    return false;
}

function getsocketdetail(fd) {
    var result = "";
    var type = Socket.type(fd);
    if (type != null) {
        result = result + "type:" + type;
        var peer = Socket.peerAddress(fd);
        var local = Socket.localAddress(fd);
        result = result + ",address:" + JSON.stringify(peer) + ",local:" + JSON.stringify(local);
    } else {
        result = "unknown";
    }
    return result;

}

function hooklibc() {
    var libcmodule = Process.getModuleByName("libc.so");
    var recvfrom_addr = libcmodule.getExportByName("recvfrom");
    var sendto_addr = libcmodule.getExportByName("sendto");
    console.log(recvfrom_addr + "---" + sendto_addr);
    //ssize_t recvfrom(int fd, void *buf, size_t n, int flags, struct sockaddr *addr, socklen_t *addr_len)
    Interceptor.attach(recvfrom_addr, {
        onEnter: function (args) {
            this.arg0 = args[0];
            this.arg1 = args[1];
            this.arg2 = args[2];

            LogPrint("go into libc.so->recvfom");

            printNativeStack(this.context, "recvfom");
        }, onLeave(retval) {
            var size = retval.toInt32();
            if (size > 0) {
                var result = getsocketdetail(this.arg0.toInt32());
                console.log(result + "---libc.so->recvfrom:" + hexdump(this.arg1, {
                    length: size
                }));
            }

            LogPrint("leave libc.so->recvfom");
        }
    });
    //ssize_t sendto(int fd, const void *buf, size_t n, int flags, const struct sockaddr *addr, socklen_t addr_len)
    Interceptor.attach(sendto_addr, {
        onEnter: function (args) {
            this.arg0 = args[0];
            this.arg1 = args[1];
            this.arg2 = args[2];
            LogPrint("go into libc.so->sendto");
            printNativeStack(this.context, "sendto");
        }, onLeave(retval) {
            var size = ptr(this.arg2).toInt32();
            if (size > 0) {
                var result = getsocketdetail(this.arg0.toInt32());
                console.log(result + "---libc.so->sendto:" + hexdump(this.arg1, {
                    length: size
                }));
            }

            LogPrint("leave libc.so->sendto");
        }
    });
}

function main() {
    hooklibc();
}

setImmediate(main);

udp
libcore.io.Linux.sendtoBytes (jni)
	|
	libc.so - sendto

libcore.io.Linux.recvfromBytes (jni)
	|
	libc.so - recvfrom

function LogPrint(log) {
    var theDate = new Date();
    var hour = theDate.getHours();
    var minute = theDate.getMinutes();
    var second = theDate.getSeconds();
    var mSecond = theDate.getMilliseconds();

    hour < 10 ? hour = "0" + hour : hour;
    minute < 10 ? minute = "0" + minute : minute;
    second < 10 ? second = "0" + second : second;
    mSecond < 10 ? mSecond = "00" + mSecond : mSecond < 100 ? mSecond = "0" + mSecond : mSecond;
    var time = hour + ":" + minute + ":" + second + ":" + mSecond;
    var threadid = Process.getCurrentThreadId();
    console.log("[" + time + "]" + "->threadid:" + threadid + "--" + log);

}

function printNativeStack(context, name) {
    //Debug.
    var array = Thread.backtrace(context, Backtracer.ACCURATE);
    var first = DebugSymbol.fromAddress(array[0]);
    if (first.toString().indexOf('libopenjdk.so!NET_Send') < 0) {
        var trace = Thread.backtrace(context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join("\n");
        LogPrint("-----------start:" + name + "--------------");
        LogPrint(trace);
        LogPrint("-----------end:" + name + "--------------");
    }

}

function printJavaStack(name) {
    Java.perform(function () {
        var Exception = Java.use("java.lang.Exception");
        var ins = Exception.$new("Exception");
        var straces = ins.getStackTrace();
        if (straces != undefined && straces != null) {
            var strace = straces.toString();
            var replaceStr = strace.replace(/,/g, " \n ");
            LogPrint("=============================" + name + " Stack strat=======================");
            LogPrint(replaceStr);
            LogPrint("=============================" + name + " Stack end======================= \n ");
            Exception.$dispose();
        }
    });
}

function isprintable(value) {
    if (value >= 32 && value <= 126) {
        return true;
    }
    return false;
}

function getsocketdetail(fd) {
    var result = "";
    var type = Socket.type(fd);
    if (type != null) {
        result = result + "type:" + type;
        var peer = Socket.peerAddress(fd);
        var local = Socket.localAddress(fd);
        result = result + ",address:" + JSON.stringify(peer) + ",local:" + JSON.stringify(local);
    } else {
        result = "unknown";
    }
    return result;

}

function getip(ip_ptr) {
    var result = ptr(ip_ptr).readU8() + "." + ptr(ip_ptr.add(1)).readU8() + "." + ptr(ip_ptr.add(2)).readU8() + "." + ptr(ip_ptr.add(3)).readU8()
    return result;
}

function getudpaddr(addrptr) {
    var port_ptr = addrptr.add(2);
    var port = ptr(port_ptr).readU8() * 256 + ptr(port_ptr.add(1)).readU8();
    var ip_ptr = addrptr.add(4);
    var ip_addr = getip(ip_ptr);
    return "peer:"+ip_addr+"--port:"+port;
}

function hooklibc() {
    var libcmodule = Process.getModuleByName("libc.so");
    var recvfrom_addr = libcmodule.getExportByName("recvfrom");
    var sendto_addr = libcmodule.getExportByName("sendto");
    console.log(recvfrom_addr + "---" + sendto_addr);
    //ssize_t recvfrom(int fd, void *buf, size_t n, int flags, struct sockaddr *addr, socklen_t *addr_len)
    Interceptor.attach(recvfrom_addr, {
        onEnter: function (args) {
            this.arg0 = args[0];
            this.arg1 = args[1];
            this.arg2 = args[2];
            this.arg3 = args[3];
            this.arg4 = args[4];
            this.arg5 = args[5];
            LogPrint("go into libc.so->recvfom");

            printNativeStack(this.context, "recvfom");
        }, onLeave(retval) {
            var size = retval.toInt32();
            if (size > 0) {
                var result = getsocketdetail(this.arg0.toInt32());
                if (result.indexOf('udp') >= 0) {
                    /*75struct sockaddr_in {
                    76	short	sin_family;
                    77	u_short	sin_port;
                    78	struct in_addr	sin_addr;
                    79	char	sin_zero[8];
                    80};*/
                    var sockaddr_in_ptr = this.arg4;
                    var sizeofsockaddr_in = this.arg5;

                    //02 00 22 b8 c0 a8 05 96 00 00 00 00 00 00 00 00
                    console.log("this is a recvfrom udp!->" + getudpaddr(sockaddr_in_ptr) + "---" + sizeofsockaddr_in);
                }
                console.log(Process.getCurrentThreadId()+result + "---libc.so->recvfrom:" + hexdump(this.arg1, {
                    length: size
                }));
            }

            LogPrint("leave libc.so->recvfom");
        }
    });
    //ssize_t sendto(int fd, const void *buf, size_t n, int flags, const struct sockaddr *addr, socklen_t addr_len)
    Interceptor.attach(sendto_addr, {
        onEnter: function (args) {
            this.arg0 = args[0];
            this.arg1 = args[1];
            this.arg2 = args[2];
            this.arg3 = args[3];
            this.arg4 = args[4];
            this.arg5 = args[5];
            LogPrint("go into libc.so->sendto");
            printNativeStack(this.context, "sendto");
        }, onLeave(retval) {
            var size = ptr(this.arg2).toInt32();
            if (size > 0) {
                var result = getsocketdetail(this.arg0.toInt32());
                if (result.indexOf('udp') >= 0) {
                    /*75struct sockaddr_in {
                    76	short	sin_family;
                    77	u_short	sin_port;
                    78	struct in_addr	sin_addr;
                    79	char	sin_zero[8];
                    80};*/
                    var sockaddr_in_ptr = this.arg4;
                    var sizeofsockaddr_in = this.arg5;

                    //02 00 22 b8 c0 a8 05 96 00 00 00 00 00 00 00 00
                    console.log("this is a sendto udp!->" + getudpaddr(sockaddr_in_ptr) + "---" + sizeofsockaddr_in);
                }
                console.log(Process.getCurrentThreadId()+"---"+result + "---libc.so->sendto:" + hexdump(this.arg1, {
                    length: size
                }));
            }

            LogPrint("leave libc.so->sendto");
        }
    });
}

function main() {
    hooklibc();
}

setImmediate(main);

jni层SSL抓包溯源

com.android.org.conscrypt.NativeCrypto.SSL_write （jni)
	|
	sslWrite
		|
		boringssl -> ssl_lib.c -> SSL_write
			|
			ssl3_write_app_data
				|
				do_ssl3_write （此时还是明文，之后被加密了）
					|
					ssl_write_pending
						|
						ssl_write_buffer_flush
							|
							dtls_write_buffer_flush/tls_write_buffer_flush
								|
								BIO_write
									|
									bio_io
										|
										libc.so - write

com.android.org.conscrypt.NativeCrypto.SSL_read   (jni)
	|
	libc.so - read


function hooklibc() {
    var libcmodule = Process.getModuleByName("libc.so");
    var read_addr = libcmodule.getExportByName("read");
    var write_addr = libcmodule.getExportByName("write");
    console.log(read_addr + "---" + write_addr);
    Interceptor.attach(read_addr, {
        onEnter: function (args) {
            this.arg0 = args[0];
            this.arg1 = args[1];
            this.arg2 = args[2];

            this.socketinfo = getsocketdetail(this.arg0.toInt32());
            LogPrint("go into libc.so->read_addr" + "---" + this.socketinfo);
            this.flag = false;
            if (this.socketinfo.indexOf("tcp") >= 0) {
                this.flag = true;
            }
            if (this.flag) {
                printNativeStack(this.context, Process.getCurrentThreadId() + "read");
            }


        }, onLeave(retval) {

            if (this.flag) {
                var size = retval.toInt32();
                if (size > 0) {
                    console.log(Process.getCurrentThreadId() + "---libc.so->read:" + hexdump(this.arg1, {
                        length: size
                    }));
                }
            }


            LogPrint("leave libc.so->read");
        }
    });
    Interceptor.attach(write_addr, {
        onEnter: function (args) {
            this.arg0 = args[0];
            this.arg1 = args[1];
            this.arg2 = args[2];

            this.socketinfo = getsocketdetail(this.arg0.toInt32());
            LogPrint("go into libc.so->write" + "---" + this.socketinfo);
            this.flag = false;
            if (this.socketinfo.indexOf("tcp") >= 0) {
                this.flag = true;
            }
            if (this.flag) {
                printNativeStack(this.context, Process.getCurrentThreadId() + "write");
            }


        }, onLeave(retval) {
            if (this.flag) {
                var size = ptr(this.arg2).toInt32();
                if (size > 0) {
                    console.log(Process.getCurrentThreadId() + "---libc.so->write:" + hexdump(this.arg1, {
                        length: size
                    }));
                }
            }

            LogPrint("leave libc.so->write");
        }
    });
}

自编译openssl库抓包溯源

hook 自编译 ssl so中的所有导出函数（有符号）

function hookallssl() {
    var libsslmodule = Process.getModuleByName("libssl.so");
    var SSL_get_rfd_ptr = libsslmodule.getExportByName('SSL_get_rfd');
    var SSL_get_rfd = new NativeFunction(SSL_get_rfd_ptr, 'int', ['pointer']);
    Process.enumerateModules().forEach(function (module) {
        module.enumerateExports().forEach(function (symbol) {
            var name = symbol.name;
            if (name == 'SSL_read') {
                LogPrint(JSON.stringify(module) + JSON.stringify(symbol));
            }
            if (name == 'SSL_write') {
                LogPrint(JSON.stringify(module) + JSON.stringify(symbol));
                Interceptor.attach(symbol.address, {
                    onEnter: function (args) {
                        this.arg0 = args[0];
                        this.arg1 = args[1];
                        this.arg2 = args[2];
                        LogPrint("go into " + Process.getCurrentThreadId() + "---" + JSON.stringify(module) + "---" + JSON.stringify(symbol));
                        printNativeStack(this.context, Process.getCurrentThreadId() + "---" + JSON.stringify(module) + "---" + JSON.stringify(symbol));
                        var size = ptr(this.arg2).toInt32();
                        if (size > 0) {
                            var sockfd = SSL_get_rfd(this.arg0);
                            var socketdetail = getsocketdetail(sockfd);
                            console.log(socketdetail + "---" + Process.getCurrentThreadId() + "---" + JSON.stringify(module) + "---" + JSON.stringify(symbol) + hexdump(this.arg1, {
                                length: size
                            }));
                        }
                    }, onLeave(retval) {
                        LogPrint("leave " + Process.getCurrentThreadId() + "---" + JSON.stringify(module) + "---" + JSON.stringify(symbol));

                    }
                });
            }


        })
    })
}

so中的符号被抹掉时：
通过hook libc.so中的write，read进行堆栈回溯

showme#
关注
  • 2
    点赞
  • 踩
  • 2
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
记录Android的一个bug
Android_data的博客
05-07 928
我有一个地图类的app，在滑动地图的时候造成了程序员崩溃，关键是很诡异，没有指出哪一行出错，但就是崩溃了，崩溃日志如下 W/System.err: java.io.FileNotFoundException: /data/user/0/com.ex.shuwu/cache/optlist.ser: open failed: ENOENT (No such file or directory) W/System.err: at libcore.io.IoBridge.open(IoBridge.j
使用Sniffer截获流经本机网卡的IP数据包
raphyer的专栏
10-07 3576
Win2K下的Sniffer工具源代码 详细信息   Win2K下的Sniffer源代码。[代码性质] VC完整应用程序代码[代码作者] zw[文件大小] 130K [更新日期] 2002-11-26 19:47:00 [下载次数] 6015  http://www.vckbase.com/code/downcode.asp?id=1692IP包监听程序(For 9x)源代码 详细信息
java读取1g文件报错,java读文件报错，没招了，快过来看看，就是普通的用FileInputStream读的时候就报这个...
weixin_29003437的博客
03-10 608
android.system.ErrnoException: read failed: EINVAL (Invalid argument)libcore.io.Linux.readBytes(Native Method)libcore.io.Linux.read(Linux.java:182)libcore.io.BlockGuardOs.read(BlockGuardOs.java:251)li...
linux环境下ssl多线程编程实例（整理）
guozhiyingguo的博客
10-18 3316
服务端： #include #include #include #include #ifndef    _WIN32 #include #include #include #include #include #include #else #include #include #endif #include "pthread.h" #inclu
android webview加载黑屏,华为10手机打开Webview ANR 黑屏问题
weixin_36047753的博客
05-26 1007
本帖最后由 huafen346619996 于 2020-6-22 15:41 编辑@华为的各位开发老师，有app 使用webview打开网页的时候的时候概率性出现黑屏的问题，通过对比市场上其他类型的手机，发现只有华为10的系统会出现下面ANR的信息。能麻烦开发老师们能定位下这是什么原因吗，非常感谢1 at libcore.io.Linux.android_getaddrinfo(N...
HTTP.rar_HTTP_HTTP协议分析_http socket
09-23
HTTP协议分析涉及到请求方法、状态码、头部字段、URL结构以及实体主体等内容。在这个“HTTP.rar”压缩包中，可能包含了关于这些主题的详细资料，以及如何通过编程实现HTTP协议的实例。 首先，我们来深入理解HTTP...
Socket通信编程传输协议分析的python代码及wireshark抓取文件包
01-23
在本主题中，我们将深入探讨Python中的Socket通信，TCP协议的工作原理，以及如何使用Wireshark工具来捕获和分析网络包。 首先，让我们从Python的Socket编程开始。Python的`socket`模块提供了一个低级别的接口，可以...
LR socket协议脚本开发
07-17
使用LoadRunner进行Windows Socket协议的性能测试，相比于传统手动编写测试脚本的方法，大大减少了开发工作量，并且易于复用和分析数据。 在使用LoadRunner进行Socket脚本开发时，需要注意以下几个方面： 1. 参数...
Socket协议 一、实验环境： Windows10系统、pycharm软件
最新发布
05-08
### Socket协议实验解析 #### 实验背景与目的 本次实验由青岛科技大学物联网工程专业191班的学生焦海洋完成，学号为1908070108。实验的主要目的是通过Python语言中的`socket`模块来实现图片在不同计算机间的传输。...
计算机网络实验二- Socket通信编程与传输协议分析
11-14
计算机网络实验中的Socket通信编程与传输协议分析是一个深入理解TCP/IP协议栈中传输层工作原理的重要实践环节。在这个实验中，学生们将通过编程实践来掌握Socket接口的使用，理解TCP的连接建立、数据传输和连接关闭...
签名文件索引
03-04
关于搜索引擎的另一种数据结构，Bing必应重新定义的签名文件。
Android硬解码 media_jni.so 源码
01-09
这是android硬解mediacodec里libmedia_jni.so库的源码
【原创】我的毕业设计论文——利用HOOK技术实现应用层网络抓包
程序的江湖？！ 勿在浮砂筑高台！
06-06 1万+
 成都东软信息技术职业学院04级毕业论文 利用HOOK技术实现应用层网络抓包  班级： 可视化程序设计2班 导师： 李        丹 学号： 04311110210 姓名： 刘   海   平  摘  要    数据包抓取（拦截）技术，主要应用在信息安全相关领域，特别是防火墙技术。随着网络游戏产业日益兴旺，后来出现很多针对不同游戏的外挂，这些外挂也使用到抓包技术，但是与其他
android系统定制添加分辨率，density设置
wang 恒 的博客
02-20 9843
本文基于qcom msm8909 android5.1平台，因为客户需求以及实际使用，主板接入的显示屏有各种尺寸，这样对屏幕的显示造成了极大的影响，因此着手开发了一个设置功能，主要针对屏幕分辨率和density等参数的设置。 首先想到的是调试过程中，在android4.3之后，官方引入了一个wm的命令工具（wm工具简介及使用），但在开发过程中，遇到个很蛋痛的问题，问题现象如下： 笔者采用jni...
android system w,【已解决】android中代码操作外部SD卡出错：W/System.err(1595): Caused by: libcore.io.ErrnoException: ...
weixin_39614561的博客
05-27 303
【背景】android程序中，相关代码：writeFileSdcard("/mnt/sdcard/preprocessedfile",sBuilder.toString());public void writeFileSdcard(String fileName,String message){try{//FileOutputStream fout = openFileOutput(fileNam...
高级编程之 socker编程
weixin_45550881的博客
01-09 1735
1. 网络基础 1-1. IP地址 1-1-1. 目的： 用来标记网络上的一台电脑 1-1-2. 如何查看IP window: ifconfig Linux: ipconfig 1-1-3. IP地址分类 1-1-3-1. IPV4（被广泛使用的） IP协议的版本号是4 当前再用，目前被广泛应用 IPv4的地址位数为32位（4位字节） 地址有限，几乎全部耗尽 1-1-3-2. IPV6 ...
SSL编程- 简单函数介绍
热门推荐
裸奔的蜗牛
12-10 6万+
SSL编程 OpenSSL是一个开放源代码的SSL协议的产品实现，它采用C语言作为开发语言，具备了跨系统的性能。调用OpenSSL的函数就可以实现一个SSL加密的安全数据传输通道，从而保护客户端和服务器之间数据的安全。 头文件： #include #include 基于OpenSSL的程序都要遵循以下几个步骤： (1 ) OpenSSL初始化 在使用Ope
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值