IOS - 抓包通杀篇

news/2024/7/20 8:13:19 标签: ios, javascript, 开发语言

IOS中大多数情况，开发者都会使用OC提供的api函数，CFNetworkCopySystemProxySettings来进行代理检测；

CFNetworkCopySystemProxySettings

在这里插入图片描述

在这里插入图片描述

检测函数直接会检测这些ip和端口等：
在这里插入图片描述

采用直接附加页面进程：

frida -UF -l 通杀代理抓包.js

上通杀脚本：

javascript">var _imports = Process.findModuleByName("XXX").enumerateImports();
var _CFNetworkCopySystemProxySettings = null;
for (var i = 0; i < _imports.length; i++) {
    //查找CFNetworkCopySystemProxySettings系统代理函数
    if (_imports[i].name.indexOf("CFNetworkCopySystemProxySettings") !== -1) {
        console.log(_imports[i].name, _imports[i].address);
        _CFNetworkCopySystemProxySettings = _imports[i].address;
    }
}


if (_CFNetworkCopySystemProxySettings) {
    Interceptor.attach(_CFNetworkCopySystemProxySettings, {
        onEnter: function (agrgs) {

        }, onLeave: function (retval) {
            console.log("retval: ", ObjC.Object(retval));
            //将返回值全部nop
            retval.replace(0);
        }
    })
}

NSURL URLWithString:

> frida-trace -U -f 包名 -m "+[NSURL URIWithString:]"

更改url得传入得参数，及堆栈打印，也叫url定位

/*
 * Auto-generated by Frida. Please modify to match the signature of +[NSURL URLWithString:].
 * This stub is currently auto-generated from manpages when available.
 *
 * For full API reference, see: https://frida.re/docs/javascript-api/
 */

{
  /**
   * Called synchronously when about to call +[NSURL URLWithString:].
   *
   * @this {object} - Object allowing you to store state for use in onLeave.
   * @param {function} log - Call this function with a string to be presented to the user.
   * @param {array} args - Function arguments represented as an array of NativePointer objects.
   * For example use args[0].readUtf8String() if the first argument is a pointer to a C string encoded as UTF-8.
   * It is also possible to modify arguments by assigning a NativePointer object to an element of this array.
   * @param {object} state - Object allowing you to keep state across function calls.
   * Only one JavaScript function will execute at a time, so do not worry about race-conditions.
   * However, do not use this to store function arguments across onEnter/onLeave, but instead
   * use "this" which is an object for keeping state local to an invocation.
   */
  onEnter(log, args, state) {
	console.log('CCCryptorCreate called from:\n' +
        Thread.backtrace(this.context, Backtracer.ACCURATE)
        .map(DebugSymbol.fromAddress).join('\n') + '\n');
	log(`+[NSURL URLWithString:]` + ObjC.Object(args[2]));
  },

  /**
   * Called synchronously when about to return from +[NSURL URLWithString:].
   *
   * See onEnter for details.
   *
   * @this {object} - Object allowing you to access state stored in onEnter.
   * @param {function} log - Call this function with a string to be presented to the user.
   * @param {NativePointer} retval - Return value represented as a NativePointer object.
   * @param {object} state - Object allowing you to keep state across function calls.
   */
  onLeave(log, retval, state) {
  }
}

双向证书：

资源路径操作，可以入手关键函数；

> frida-trace  -UF  -m "-[NSBundle pathForResource*]"

javascript">/*
 * Auto-generated by Frida. Please modify to match the signature of -[NSBundle pathForResource:ofType:].
 * This stub is currently auto-generated from manpages when available.
 *
 * For full API reference, see: https://frida.re/docs/javascript-api/
 */

{
  /**
   * Called synchronously when about to call -[NSBundle pathForResource:ofType:].
   *
   * @this {object} - Object allowing you to store state for use in onLeave.
   * @param {function} log - Call this function with a string to be presented to the user.
   * @param {array} args - Function arguments represented as an array of NativePointer objects.
   * For example use args[0].readUtf8String() if the first argument is a pointer to a C string encoded as UTF-8.
   * It is also possible to modify arguments by assigning a NativePointer object to an element of this array.
   * @param {object} state - Object allowing you to keep state across function calls.
   * Only one JavaScript function will execute at a time, so do not worry about race-conditions.
   * However, do not use this to store function arguments across onEnter/onLeave, but instead
   * use "this" which is an object for keeping state local to an invocation.
   */
  onEnter(log, args, state) {
	console.log('NSBundle pathForResource called from:\n' +
        Thread.backtrace(this.context, Backtracer.ACCURATE)
        .map(DebugSymbol.fromAddress).join('\n') + '\n');
    log(`-[NSBundle pathForResource:${ObjC.Object(args[2])} ofType:${ObjC.Object(args[3])}]`);
  },

  /**
   * Called synchronously when about to return from -[NSBundle pathForResource:ofType:].
   *
   * See onEnter for details.
   *
   * @this {object} - Object allowing you to access state stored in onEnter.
   * @param {function} log - Call this function with a string to be presented to the user.
   * @param {NativePointer} retval - Return value represented as a NativePointer object.
   * @param {object} state - Object allowing you to keep state across function calls.
   */
  onLeave(log, retval, state) {
  }
}

HOOK抓包

基于底层ssl库来实现：

javascript">//请求
var ssl_write = Module.findExportByName("libboringssl.dylib", "SSL_write");
console.log("ssl_write", ssl_write);   //ssl input len
Interceptor.attach(ssl_write, {
    onEnter: function (args) {
        console.log("=================================================");
        console.log("CurrentThreadId: ", Process.getCurrentThreadId(), ", ssl_write onEnter args[1]: ", hexdump(args[1], {length: args[2].toInt32()}));
    }, onLeave: function (retval) {

    }
});

//返回响应
var ssl_read = Module.findExportByName("libboringssl.dylib", "SSL_read");
console.log("ssl_read", ssl_read);  //ssl output len
Interceptor.attach(ssl_read, {
    onEnter: function (args) {
        this.args1 = args[1];
        this.args2 = args[2];
    }, onLeave: function (retval) {
        console.log("=================================================");
        console.log("CurrentThreadId: ", Process.getCurrentThreadId(), ", ssl_read onLeave args[1]: ",
            this.args1.readByteArray(this.args2.toInt32())
        );
    }
});

r0Capture 肉师傅的安卓应用层抓包通杀脚本

这个在之前安卓也说过，ios和安卓都通用的；
详见：https://codeooo.blog.csdn.net/article/details/127123371

javascript">function initializeGlobals() {
  var resolver = new ApiResolver("module");
  var exps = [
    [Process.platform == "darwin" ? "*libboringssl*" : "*libssl*", ["SSL_read", "SSL_write", "SSL_get_fd", "SSL_get_session", "SSL_SESSION_get_id"]], // for ios and Android
    [Process.platform == "darwin" ? "*libsystem*" : "*libc*", ["getpeername", "getsockname", "ntohs", "ntohl"]]
  ];

源码里三目运算符，也说明了，ios用 libboringssl 动态库 ， 安卓 libssl库；

同时还hook了，”SSL_read", “SSL_write” ,等等~

javascript">Interceptor.attach(addresses["SSL_read"],
  {
    onEnter: function (args) {
      var message = getPortsAndAddresses(SSL_get_fd(args[0]), true);
      message["ssl_session_id"] = getSslSessionId(args[0]);
      message["function"] = "SSL_read";
      message["stack"] = SSLstackread;
      this.message = message;
      this.buf = args[1];
    },
    onLeave: function (retval) {
      retval |= 0; // Cast retval to 32-bit integer.
      if (retval <= 0) {
        return;
      }
      send(this.message, Memory.readByteArray(this.buf, retval));
    }
  });

Interceptor.attach(addresses["SSL_write"],
  {
    onEnter: function (args) {
      var message = getPortsAndAddresses(SSL_get_fd(args[0]), false);
      message["ssl_session_id"] = getSslSessionId(args[0]);
      message["function"] = "SSL_write";
      message["stack"] = SSLstackwrite;
      send(message, Memory.readByteArray(args[1], parseInt(args[2])));
    },
    onLeave: function (retval) {
    }
  });

http://www.niftyadmin.cn/n/128422.html

相关文章

一种新的 Mini Micro 编程方式

一种新的 Mini Micro 编程方式

我很高兴正式宣布MiniBASIC的发布&#xff0c;它是 1980 年代经典 BASIC 编程语言的干净、强大的新实现。MiniBASIC 可在 itch.io 上在线使用&#xff0c;或下载用于 Windows、Mac 或 Linux。它也是完全开源的&#xff08;托管在GitHub上&#xff09;。一种新的 Mini Micro 编程…
阅读更多...
关于递归处理，应该怎么处理，思路是什么？

关于递归处理，应该怎么处理，思路是什么？

其实问题很简单&#xff0c;就是想要循环遍历整个data对象&#xff0c;来实现所有name转成label&#xff0c;但是想到里面还有children属性&#xff0c;整个children里面可能还会嵌套很多很多的name&#xff0c;如此循环&#xff0c;很难搞&#xff0c;知道使用递归&#xff0c…
阅读更多...
作为一个新人，怎样学习嵌入式Linux？

作为一个新人，怎样学习嵌入式Linux？

作为一个新人&#xff0c;怎样学习嵌入式Linux&#xff1f;被问过太多次&#xff0c;特写这篇文章来回答一下。 在学习嵌入式Linux之前&#xff0c;肯定要有C语言基础。汇编基础有没有无所谓(就那么几条汇编指令&#xff0c;用到了一看就会)。 C语言要学到什么程度呢&#x…
阅读更多...
盒子模型的简介

盒子模型的简介

盒子的组成 一个盒子由外到内可以分成四个部分&#xff1a;margin&#xff08;外边距&#xff09;、border&#xff08;边框&#xff09;、padding&#xff08;内边距&#xff09;、content&#xff08;内容&#xff09;。会发现margin、border、padding是css属性&#xff0c;因…
阅读更多...
如何成为程序员中的牛人/高手？

如何成为程序员中的牛人/高手？

目录 一、牛人是怎么成为牛人的&#xff1f; 二、关于牛人的一点看法 三、让程序员与业务接壤&#xff0c;在开发团队中“升级” 四、使用低代码平台 目标效果 五、最后 祝伟大的程序员们梦想成真、码到成功&#xff01; 一、牛人是怎么成为牛人的&#xff1f; 最近在某…
阅读更多...
LeetCode 1599. Maximum Profit of Operating a Centennial Wheel【数组,模拟】中等

LeetCode 1599. Maximum Profit of Operating a Centennial Wheel【数组,模拟】中等

本文属于「征服LeetCode」系列文章之一&#xff0c;这一系列正式开始于2021/08/12。由于LeetCode上部分题目有锁&#xff0c;本系列将至少持续到刷完所有无锁题之日为止&#xff1b;由于LeetCode还在不断地创建新题&#xff0c;本系列的终止日期可能是永远。在这一系列刷题文章…
阅读更多...
网上鲜花交易平台，可运行

网上鲜花交易平台，可运行

文章目录项目介绍一、项目功能介绍1、用户模块主要功能包括&#xff1a;2、商家模块主要功能包括&#xff1a;3、管理员模块主要功能包括&#xff1a;二、部分页面展示1、用户模块部分功能页面展示2、商家模块部分功能页面展示3、管理员模块部分功能页面展示三、部分源码四、底…
阅读更多...
【代码实践】DeepBDC for few-shot learning代码运行

【代码实践】DeepBDC for few-shot learning代码运行

DeepBDC是Jiangtao Xie等人在CVPR2022上提出的few-shot classification方法&#xff0c;论文全名为“Joint Distribution Matters: Deep Brownian Distance Covariance for Few-Shot Classification”。本文旨在记录在Window系统下运行该官方代码&#xff08;https://github.co…
阅读更多...
最新文章

Copyright @ 2022~2023