@zsa233/frida-analykit-agent 2.0.0 → 2.0.2

package/src/process.ts

@@ -1,137 +0,0 @@
-import { help  } from "./helper.js";
-
-
-// frida-gum/index.d.ts
-interface RangeDetails {
-    /**
-     * Base address.
-     */
-    base: NativePointer;
-
-    /**
-     * Size in bytes.
-     */
-    size: number;
-
-    /**
-     * Protection.
-     */
-    protection: PageProtection;
-
-    /**
-     * File mapping details, if available.
-     */
-    file?: FileMapping | undefined;
-
-}
-
-
-export class ProcMapItem {
-    start_page: NativePointer
-    end_page: NativePointer
-    prots: string
-    offset: number
-    main_dev: string
-    slave_dev: string
-    inode: number
-    pathname: string
-
-    constructor(
-        start_page: string,
-        end_page: string,
-        prots: string,
-        offset: string,
-        main_dev: string,
-        slave_dev: string,
-        inode: string,
-        pathname: string,
-    ) {
-        this.start_page = ptr(parseInt(start_page, 16))
-        this.end_page = ptr(parseInt(end_page, 16))
-        this.prots = prots
-        this.offset = parseInt(offset, 16)
-        this.main_dev = main_dev
-        this.slave_dev = slave_dev
-        this.inode = parseInt(inode)
-        this.pathname = pathname.trim()
-    }
-
-    toString(): string {
-        return `${this.start_page.toString(16)}-${this.end_page.toString(16)} ${this.prots} ${this.offset.toString(16)} ${this.main_dev}:${this.slave_dev} ${this.inode} ${this.pathname}`
-    }
-}
-
-const REGEXP_PROC_MAPS_LINE = /^([a-fA-F0-9]+)-([a-fA-F0-9]+)\s+([rwx\-p]+)\s+(\w+)\s+(\w+):(\d+)\s+(\d+)\s+(.*)$/
-
-export class ProcMap {
-    public text: string
-    public items: ProcMapItem[]
-
-    constructor(text: string) {
-        this.text = text
-        this.items = []
-        const lines = text.split('\n')
-        for (const line of lines) {
-            if (!line.trim()) continue
-            const result = ProcMap.parseLine(line)
-            if (!result || result.length !== 8) continue
-            const item = new ProcMapItem(
-                ...result as [string, string, string, string, string, string, string, string]
-            )
-            this.items.push(item)
-        }
-    }
-
-    static parseLine(line: string): string[] | null {
-        const m = REGEXP_PROC_MAPS_LINE.exec(line)
-        if (!m) return null
-        return m.slice(1)
-    }
-
-    find(start_addr: NativePointer, end_addr: NativePointer): ProcMapItem[] {
-        return this.items.filter(item => {
-            return !(item.start_page >= end_addr || item.end_page <= start_addr)
-        })
-    }
-}
-
-
-
-class Proc {
-    private static _mapCache: RangeDetails[] = []
-
-
-    static findMapCache(addr: NativePointer): RangeDetails | null {
-        const result = this._mapCache.find((v, i) => {
-            return addr >= v.base && addr < v.base.add(v.size)
-        })
-        if (result) {
-            return result || null
-        }
-        const range = Process.findRangeByAddress(addr)
-        if(!range) {
-            return null
-        } 
-        let hitIndex = -1
-        const hit = this._mapCache.find((v, i) => {
-            const ok = v.base == range.base
-            if (ok) hitIndex = i
-            return ok
-        })
-        if (hitIndex !== -1) {
-            this._mapCache[hitIndex] = range
-        }else{
-            this._mapCache.push(range)
-        }
-        return range
-    }
-
-
-    static loadProcMap(pid: number | string = 'self'): ProcMap{
-        return new ProcMap(help.readProcMaps(pid))
-    }
-
-}
-
-
-export { Proc as proc }

package/src/rpc.ts

@@ -1,268 +0,0 @@
-import { Java, ObjC, Swift } from "./bridges.js"
-import { JNIEnv } from "./jni/env.js"
-import { RPCMsgType } from "./message.js"
-import { SSLTools } from "./net/ssl.js"
-import { help } from "./helper.js"
-import { Libssl } from "./lib/libssl.js"
-import { proc } from "./process.js"
-import { ElfTools } from "./elf/tools.js"
-
-const _BASE_CONTEXT = {
-    Java,
-    Process,
-    Module,
-    Memory,
-    ObjC,
-    Swift,
-    File,
-    hexdump,
-    ApiResolver,
-    Arm64Relocator,
-    Arm64Writer,
-    Stalker,
-    Thread,
-    Interceptor,
-    ModuleMap,
-    Frida,
-    Script,
-    Backtracer,
-    UInt64,
-    Int64,
-    Worker,
-
-    help,
-    proc,
-    JNIEnv,
-    SSLTools,
-    ElfTools,
-    Libssl,
-
-    Object, Array, String, Number, Boolean, Symbol, BigInt, Function,
-    Math, Date, RegExp, Map, Set, WeakMap, WeakSet,
-    Error, TypeError, SyntaxError,
-    JSON, console,
-    isNaN, isFinite, parseInt, parseFloat,
-    setTimeout, clearTimeout, setInterval, clearInterval,
-    encodeURI, decodeURI, encodeURIComponent, decodeURIComponent,
-    Reflect, Proxy,
-    
-
-    ArrayBuffer,
-    Int8Array,
-    Int16Array,
-    Int32Array,
-    Uint8Array,
-    Uint16Array,
-    Uint32Array,
-    NativePointer,
-    NativeFunction,
-    NativeCallback,
-
-
-}
-
-
-const EVAL_SCOPES: { [key: string]: { [key: string]: any } } = {}
-const SCOPE_GETTER_PREFIX = '__get__$$'
-
-let ID_INCR = 0
-
-function gen_id(): string {
-    ID_INCR++
-    return `${SCOPE_GETTER_PREFIX}${ID_INCR.toString(16)}`
-}
-
-
-function getValueByPath(path: string, bind: boolean = false, root: any = globalThis): any {
-    let obj: any = root
-    let parent = obj
-    for(let key of path.split('/')) {
-        parent = obj
-        obj = obj[key]
-    }
-    if (parent !== root && typeof (obj) === 'function') {
-        obj = bind ? obj.bind(parent) : obj
-    }
-    return obj
-}
-
-function getObj(instIdOrObjChain: string, scopeId: string, bind: boolean = false): any {
-    let value: any
-    if (instIdOrObjChain.startsWith(SCOPE_GETTER_PREFIX)) {
-        const scope = EVAL_SCOPES[scopeId]
-        value = getValueByPath(instIdOrObjChain, bind, scope)
-    } else {
-        value = getValueByPath(instIdOrObjChain, bind)
-    }
-    return value
-}
-
-
-function enumerateObjProps(instIdOrObjChain: string | Array<string>, scopeId: string) {
-    const propsList: Array<{ [key: string]: string }> = []
-    const objList: Array<string> = []
-    if(typeof(instIdOrObjChain) === 'string') {
-        objList.push(instIdOrObjChain)
-    }else{
-        objList.push(...instIdOrObjChain)
-    }
-    for (let v of objList) {
-        const props: { [key: string]: string } = {}
-        let obj
-        try{
-            obj = getObj(v, scopeId)
-        }catch(e){}
-        try {
-            const numKeys: Array<number> = []
-            while (obj && obj !== Object.prototype) {
-                for (const key of Reflect.ownKeys(obj)) {
-                    if (typeof (key) === 'symbol') {
-                        continue
-                    }
-                    if(/^\d+$/.test(key)){
-                        numKeys.push(parseInt(key))
-                        continue
-                    }
-                    let type
-                    const desc = Reflect.getOwnPropertyDescriptor(obj, key)
-                    if (desc?.get) {
-                        type = 'getter'
-                    }else if (desc?.set) {
-                        type = 'setter'
-                    }else{
-                        type = typeof(obj[key])
-                    }
-                    props[String(key)] = type
-                }
-                obj = Object.getPrototypeOf(obj)
-            }
-            if(numKeys.length > 0) {
-                if(numKeys.length <= 50) {
-                    for(let n of numKeys) {
-                        const key = n.toString()
-                        const desc = Reflect.getOwnPropertyDescriptor(obj, key)
-                        let type
-                        if (desc?.get) {
-                            type = 'getter'
-                        } else if (desc?.set) {
-                            type = 'setter'
-                        } else {
-                            type = typeof (obj[key])
-                        }
-                        props[String(key)] = type
-                    }
-                }else{
-                    const minN: number = Math.min(...numKeys)
-                    const maxN: number = Math.max(...numKeys)
-                    props[`[${minN}:${maxN+1}]`] = 'index'
-                }
-            }
-        } catch (e) {
-        }
-
-        propsList.push(props)
-    }
-    return {
-        type: RPCMsgType.ENUMERATE_OBJ_PROPS,
-        data: {
-            props: propsList,
-        },
-    }
-}
-
-
-function iterScopeGet(v: any, scopeId: string, bind: boolean = false): any {
-    switch(typeof(v)) {
-        case 'string':
-            if (v.startsWith(SCOPE_GETTER_PREFIX)) {
-                return getObj(v, scopeId, bind)
-            }
-            break
-        case 'object':
-            const nv: { [key: string]: any } = {}
-            for(const [kk, vv] of Object.entries(v)) {
-                nv[kk] = iterScopeGet(vv, scopeId, bind)
-            }
-            return nv
-    }
-    return v
-}
-
-
-function scopeCall(instIdOrObjChain: string, args: Array<any>, scopeId: string){
-    const obj = getObj(instIdOrObjChain, scopeId, true)
-    const nargs = args.map(v => {
-        return iterScopeGet(v, scopeId, false)
-    })
-    const result = obj(...nargs)
-    const id = gen_id()
-    scopeSave(result, id, scopeId)
-    return {
-        type: RPCMsgType.SCOPE_CALL,
-        data: {
-            id,
-            type: typeof (result),
-            result
-        }
-    }
-}
-
-function scopeSave(obj: any, instId: string, scopeId: string) {
-    let scope = EVAL_SCOPES[scopeId]
-    if (scope === undefined) {
-        scope = {}
-        EVAL_SCOPES[scopeId] = scope
-    }
-    scope[instId] = obj
-}
-
-function scopeGet(instIdOrObjChain: string, scopeId: string, bind: boolean = false): any {
-    const value = getObj(instIdOrObjChain, scopeId, bind)
-    return {
-        type: RPCMsgType.SCOPE_GET,
-        data: {
-            value,
-        }
-    }
-}
-
-function scopeClear(scopeId: string) {
-    delete (EVAL_SCOPES[scopeId])
-}
-
-function scopeDel(instId: string, scopeId: string) {
-    const scope = EVAL_SCOPES[scopeId]
-    if(scope) {
-        delete(scope[instId])
-    }
-}
-
-function evalWithContext(code: string, context: any = {}){
-    const mergeContext = { ..._BASE_CONTEXT, ...context}
-    return Function(...Object.keys(mergeContext), code)(...Object.values(mergeContext))
-}
-
-function scopeEval(source: string, scopeId: string) {
-    const result = evalWithContext(source, EVAL_SCOPES[scopeId] || {})
-    const id = gen_id()
-    scopeSave(result, id, scopeId)
-    return {
-        type: RPCMsgType.SCOPE_EVAL,
-        data: {
-            id,
-            type: typeof (result),
-            result
-        }
-    }
-}
-
-
-rpc.exports = {
-    enumerateObjProps,
-    scopeCall,
-    scopeEval,
-    scopeClear,
-    scopeGet,
-    scopeSave,
-    scopeDel,
-}

package/src/runtime-globals.d.ts

@@ -1,11 +0,0 @@
-export {}
-
-declare global {
-    const console: {
-        log: (...args: unknown[]) => void
-        info: (...args: unknown[]) => void
-        warn: (...args: unknown[]) => void
-        error: (...args: unknown[]) => void
-        debug: (...args: unknown[]) => void
-    }
-}

package/src/utils/array_pointer.ts

@@ -1,102 +0,0 @@
-
-
-
-export class ArrayPointer extends Number {
-    buff: ArrayBuffer | undefined
-    constructor(val: any, buff?: ArrayBuffer) {
-        super(val)
-        this.buff = buff
-    }
-
-    isNull(): boolean {
-        return !this.buff?.byteLength
-    }
-
-    add(val: number | ArrayPointer): ArrayPointer {
-        return new ArrayPointer(this.toNumber() + Number(val), this.buff)
-    }
-
-    sub(val: number | ArrayPointer): ArrayPointer {
-        return new ArrayPointer(this.toNumber() - Number(val), this.buff)
-    }
-
-    toNumber(): number {
-        return Number(this)
-    }
-
-    getViewer(size: number): DataView {
-        const off = this.toNumber()
-        const view = new DataView(this.buff!.slice(off, off + size))
-        return view
-    }
-
-    readS8(): number {
-        const view = this.getViewer(1)
-        return view.getInt8(0)
-    }
-
-    readU8(): number {
-        const view = this.getViewer(1)
-        return view.getUint8(0)
-    }
-
-    readS16(): number {
-        const view = this.getViewer(2)
-        return view.getInt16(0, true)
-    }
-
-    readU16(): number {
-        const view = this.getViewer(2)
-        return view.getUint16(0, true)
-    }
-
-    readS32(): number {
-        const view = this.getViewer(4)
-        return view.getInt32(0, true)
-    }
-
-    readU32(): number {
-        const view = this.getViewer(4)
-        return view.getUint32(0, true)
-    }
-
-    readS64(): BigInt {
-        const view = this.getViewer(8)
-        return view.getBigInt64(0, true)
-    }
-
-    readU64(): BigInt {
-        const view = this.getViewer(8)
-        return view.getBigUint64(0, true)
-    }
-
-    readCString(): string {
-        if(this.isNull()) {
-            return ''
-        }
-        const off = this.toNumber()
-        let str = ''
-        const bview = new DataView(this.buff!)
-        for (let i = off; i < this.buff!.byteLength; i++) {
-            const b = bview.getUint8(i)
-            if (b === 0x00) {
-                break
-            }
-            str += String.fromCharCode(b)
-        }
-        return str
-    }
-
-    readByteArray(length: number): ArrayBuffer {
-        const off = this.toNumber()
-        return this.buff!.slice(off, off + length)
-    }
-
-    readPointer(): NativePointer {
-        return ptr(Number(this.readU64())).readPointer()
-    }
-
-    toString(): string {
-        return this.readU64().toString(16)
-    }
-}

package/src/utils/queue.ts

@@ -1,102 +0,0 @@
-
-
-export class FixedQueue<T> {
-    private _index = -1
-    private $depth = 0
-    private $list: (T | undefined)[]
-    private $length = 0
-    private $overflowCallback?: (elements: T[]) => void
-
-    constructor(length: number) {
-        this.$list = Array.from({ length: length }, () => undefined)
-        this.$length = 0
-        this.$depth = length
-    }
-
-    push(elm: T): T | undefined {
-        let popElm = undefined
-        this._index = (this._index + 1) % this.$depth
-        if (this.$length === this.$depth) {
-            popElm = this.$list[this._index]
-        } else {
-            this.$length++
-        }
-        this.$list[this._index] = elm
-        if(popElm !== undefined) {
-            this.$onOverflow(popElm)
-        }
-        return popElm
-    }
-
-    pop(): T | undefined {
-        if (this.$length === this.$depth) {
-            const head = this.$headIndex
-            const elm = this.$list[head]
-            this.$length--
-            this.$list[head] = undefined
-            return elm
-        } else if (this.$length > 0) {
-            let head = this.$headIndex
-            const elm = this.$list[head]
-            this.$length--
-            if (this.$length < 0) this.$length = 0
-            this.$list[head] = undefined
-            return elm
-        }
-        return undefined
-    }
-
-    clear() {
-        this.$length = 0
-        this._index = 0
-    }
-
-    get $headIndex(): number {
-        let head = this._index + 1 - this.$length
-        if (head < 0) {
-            head += this.$depth
-        }
-        return head
-    }
-
-    get $tailIndex(): number {
-        return this._index
-    }
-
-    get list(): T[] {
-        if (this.$length <= 0) {
-            return []
-        }
-        const head = this.$headIndex
-        const tail = this.$tailIndex + 1
-        if (head >= tail) {
-            return [...this.$list.slice(head), ...this.$list.slice(0, tail)] as T[]
-        }
-        return this.$list.slice(head, tail) as T[]
-    }
-
-    get length() {
-        return this.$length
-    }
-
-    index(offset: number): T | undefined {
-        const idx = (this._index + 1 + offset) % this.$depth
-        return this.$list[idx]
-    }
-
-    flush(): Array<T> {
-        const list = this.list
-        this.clear()
-        return list
-    }
-
-    registerOverflowCallback(callback: (elements: T[]) => void){
-        this.$overflowCallback = callback
-    }
-
-    $onOverflow(element: T) {
-        if(!this.$overflowCallback) return
-        this.$overflowCallback([element, ...this.flush()])
-    }
-
-}

package/src/utils/scan.ts

@@ -1,103 +0,0 @@
-
-
-import { NativePointerObject } from "../helper.js"
-import {
-    binaryPointer,
-    binaryReadPointer,
-    binaryReadU32,
-} from "./utils.js"
-
-
-export const GArray_structOf = {
-    B64: {
-        data: binaryReadPointer(0),
-        len: binaryReadU32(8),
-    },
-    // B32
-    B32: {}
-}
-
-
-
-
-
-class GArrayPtr extends NativePointerObject {
-
-    constructor(handle: NativePointer) {
-        super(handle)
-    }
-
-    static cast(handle: NativePointer): GArrayPtr {
-        return new GArrayPtr(handle)
-    }
-
-    get data(): NativePointer {
-        const obj = this.$handle.readPointer()
-        if (obj.isNull()) return NULL
-        return GArray_structOf.B64.data(obj)
-    }
-
-    get length(): number {
-        const obj = this.$handle.readPointer()
-        if (obj.isNull()) return 0
-        return GArray_structOf.B64.len(obj)
-    }
-
-    [Symbol.iterator]() {
-        let nextPtr = this.data
-        const length = this.length
-        let inc = 0
-        return {
-            next() {
-                const result = {
-                    value: nextPtr,
-                    done: inc >= length,
-                }
-                nextPtr = nextPtr.add(Process.pointerSize)
-                inc++
-                return result
-            }
-        }
-    }
-
-    toArray(): NativePointer[] {
-        const list = []
-        for (let v of this) {
-            list.push(v)
-        }
-        return list
-    }
-}
-
-
-
-
-export const MemoryScanRes_structOf = {
-    B64: {
-        results: binaryPointer(0),
-        user_data: binaryPointer(8),
-        SIZE: 16,
-    },
-    // B32
-    B32: {}
-}
-
-
-export class CMemoryScanRes extends NativePointerObject {
-    readonly data: GArrayPtr
-    readonly user_data: NativePointer
-
-    constructor(userData: NativePointer) {
-        const structOf = MemoryScanRes_structOf.B64
-
-        const handle = Memory.alloc(structOf.SIZE)
-
-        super(handle)
-
-        this.data = new GArrayPtr(structOf.results(handle))
-        structOf.user_data(handle).writePointer(userData)
-        this.user_data = userData
-    }
-
-}
-