本篇主要用来完善上篇文章 frida 监测网络请求的.

whatsapp相关(五)- frida监测网络请求

1: 脚本

本次的脚本与上次的区别是,之前只能输出请求的地址,本次优化后,可输出请求参数,结果等.

代码如下:

Java.perform(function () {
    var HttpURLConnection = Java.use('java.net.HttpURLConnection');
    var URL = Java.use('java.net.URL');
    var Proxy = Java.use('java.net.Proxy');

    var originalOpenConnection = URL.openConnection;
    URL.openConnection.overload().implementation = function () {
        var connection = originalOpenConnection.call(this);
        console.log('URL.openConnection called: ' + this.toString());
        return connection;
    };


    var HttpURLConnectionImpl = Java.use('com.android.okhttp.internal.huc.HttpURLConnectionImpl');
     HttpURLConnectionImpl.connect.overload().implementation = function () {
        console.log('connect()');
        HttpURLConnectionImpl.connect.call(this);
    };
    
    HttpURLConnectionImpl.setRequestProperty.implementation = function(name,value){
                console.log("setRequestProperty => ",name,": ",value);
                return this.setRequestProperty(name,value);
     };
            
    HttpURLConnectionImpl.setRequestMethod.implementation = function(type){
                console.log("setRequestMethod : ",type);
                return this.setRequestMethod(type);
      };
            
    HttpURLConnectionImpl.responseSourceHeader.implementation = function(response){
    			var result = this.responseSourceHeader(response);
    			console.log("responseSourceHeader : " + result);
    			return result;
   };
   
    HttpURLConnectionImpl.getResponseCode.overload().implementation = function(){
                 var code =    this.getResponseCode();
                console.log("getResponseCode : " + code);
                return code;
    };

    HttpURLConnectionImpl.setConnectTimeout.overload("int").implementation = function(time){
        		console.log("setConnectTimeout : " + time);
        		return this.setConnectTimeout(time);
    		};
    		
    var testInput;
    HttpURLConnectionImpl.getInputStream.overload().implementation = function () {
        var returnStream = HttpURLConnectionImpl.getInputStream.call(this);
        testInput = returnStream;
        var inputStr = readInputStream(testInput);
        console.log("getInputStream(): " + inputStr);
        return returnStream;
    };

	#打印inputStream
    function readInputStream(inputStream){
        var str = '';
        if(inputStream == null){
            console.log("inputStream is null");
            return str;
        }
        try{
            var inputStreamReader = Java.use('java.io.InputStreamReader').$new(inputStream ,"UTF-8");
            var bufferedReader = Java.use('java.io.BufferedReader').$new(inputStreamReader);
            var response = Java.use('java.lang.StringBuffer').$new();
            var line = null;
            while((line = bufferedReader.readLine()) != null){
                response.append(line);
            }
            bufferedReader.close();
            str = response;
        }catch(error){
            console.error( "inputstream error: " + error);
            return null;
        }
        return str;
    }
});

由于HttpURLConnection 是抽象类,所以直接打印的HttpURLConnection方法无法输出数据.

我们找到HttpURLConnection的子类HttpURLConnectionImpl .从而获取相关的数据输出.

2: 测试

执行脚本:

frida -U -f com.whatsapp -l /home/zh/workSpace/test/Xpose/app/src/main/java/com/zh/xpose/js/url.js 


     ____
    / _  |   Frida 16.0.2 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to xxx (id=6b4a96b2)
Spawned `com.whatsapp`. Resuming main thread!                           

启动whatsapp后:

[xxx::com.whatsapp ]-> URL.openConnection called: https://graph.whatsapp.com/graphql
setConnectTimeout : 15000
setRequestProperty =>  User-Agent :  WhatsApp/xxx Android/10 Device/LeEco-xxx [FBAN/WhatsAppAndroid;FBAV/xxx;FBLC/zh_CN;FBSV/10;FBBR/msm8996;FBBD/LeEco;FBBV/240175000;FBCA/arm64-v8a:;FBPN/com.whatsapp;FBDM/DisplayMetrics{density=3.5, width=1440, height=2560, scaledDensity=3.5, xdpi=537.882, ydpi=537.388};]
setRequestMethod :  POST
setRequestProperty =>  Content-Type :  application/json
setRequestProperty =>  Content-Encoding :  gzip
connect()
responseSourceHeader : NETWORK 200
getInputStream(): {"data":{"avatar_static_config":{"id":"711543810765370"}},"extensions":{"is_final":true}}


URL.openConnection called: http://clients3.google.com/generate_204
setConnectTimeout : 10000
URL.openConnection called: https://www.whatsapp.com/android/3/WhatsApp.version
setConnectTimeout : 15000
setRequestProperty =>  User-Agent :  WhatsApp/xxx Android/10 Device/LeEco-xxx
setRequestProperty =>  Accept-Charset :  UTF-8
getInputStream(): 
getResponseCode : 204
getResponseCode : 200
getInputStream(): <pre style="word-wrap: break-word; white-space: pre-wrap;">2.24.2.77</pre>

有兴趣加下订阅号,新文章推送: