@zsa233/frida-analykit-agent 2.0.0 → 2.0.2

package/dist/message.d.ts

@@ -0,0 +1,18 @@
+export declare enum RPCMsgType {
+    BATCH = "BATCH",
+    SCOPE_CALL = "SCOPE_CALL",
+    SCOPE_EVAL = "SCOPE_EVAL",
+    SCOPE_GET = "SCOPE_GET",
+    ENUMERATE_OBJ_PROPS = "ENUMERATE_OBJ_PROPS",
+    INIT_CONFIG = "INIT_CONFIG",
+    SAVE_FILE = "SAVE_FILE",
+    SSL_SECRET = "SSL_SECRET",
+    PROGRESSING = "PROGRESSING"
+}
+export declare enum batchSendSource {
+}
+export declare enum saveFileSource {
+    procMaps = "procMaps",
+    textFile = "textFile",
+    elfModule = "elfModule"
+}

package/dist/message.js

@@ -0,0 +1,21 @@
+export var RPCMsgType;
+(function (RPCMsgType) {
+    RPCMsgType["BATCH"] = "BATCH";
+    RPCMsgType["SCOPE_CALL"] = "SCOPE_CALL";
+    RPCMsgType["SCOPE_EVAL"] = "SCOPE_EVAL";
+    RPCMsgType["SCOPE_GET"] = "SCOPE_GET";
+    RPCMsgType["ENUMERATE_OBJ_PROPS"] = "ENUMERATE_OBJ_PROPS";
+    RPCMsgType["INIT_CONFIG"] = "INIT_CONFIG";
+    RPCMsgType["SAVE_FILE"] = "SAVE_FILE";
+    RPCMsgType["SSL_SECRET"] = "SSL_SECRET";
+    RPCMsgType["PROGRESSING"] = "PROGRESSING";
+})(RPCMsgType || (RPCMsgType = {}));
+export var batchSendSource;
+(function (batchSendSource) {
+})(batchSendSource || (batchSendSource = {}));
+export var saveFileSource;
+(function (saveFileSource) {
+    saveFileSource["procMaps"] = "procMaps";
+    saveFileSource["textFile"] = "textFile";
+    saveFileSource["elfModule"] = "elfModule";
+})(saveFileSource || (saveFileSource = {}));

package/dist/net/ssl.d.ts

@@ -0,0 +1,29 @@
+import { NativePointerObject } from "../helper.js";
+import { ElfModuleX } from "../elf/module.js";
+export type SSLSecretLog = {
+    label: string;
+    client_random: string;
+    secret: string;
+};
+export declare class BoringSSL {
+    private mod;
+    constructor(mod: ElfModuleX | Module);
+    static loadFromModule(mod: ElfModuleX | Module): BoringSSL;
+    scanKeylogFunc(fullScan?: boolean, verifier?: (p: NativePointer) => NativePointer | null): NativePointer[];
+    verifyKeylogFunc(p: NativePointer): NativePointer | null;
+}
+declare class SSLTools extends NativePointerObject {
+    private static _libssl_hook;
+    static newConsumer(tag?: string): SSLSecretCallbackConsumer;
+    static attachLibsslKeylogFunc(tag?: string): boolean;
+    static attachBoringsslKeylogFunc(options: {
+        mod?: ElfModuleX | Module;
+        libname?: string;
+    }): void;
+}
+export declare class SSLSecretCallbackConsumer {
+    private tag;
+    constructor(tag: string);
+    Handler(): ScriptInvocationListenerCallbacks;
+}
+export { SSLTools };

package/dist/net/ssl.js

@@ -0,0 +1,249 @@
+import { Config, setGlobalProperties } from "../config.js";
+import { RPCMsgType } from "../message.js";
+import { arrayBuffer2Hex, unwrapArgs } from "../utils/utils.js";
+import { ssl_st_structOf, SSL3_RANDOM_SIZE } from "./struct.js";
+import { help, NativePointerObject, ProgressNotify } from "../helper.js";
+import { Libssl } from "../lib/libssl.js";
+import { FuncHelper } from "../func.js";
+import { ElfModuleX } from "../elf/module.js";
+import { AdrlXref } from "../elf/xref.js";
+import { TextEncoder } from "../utils/text_endec.js";
+import { Subroutine } from "../elf/verifier.js";
+const HEX_TABLE = '0123456789abcdef';
+class SSL extends NativePointerObject {
+    constructor(handle) {
+        super(handle);
+        for (let [field, offseter] of Object.entries(Process.pointerSize === 8 ? ssl_st_structOf.B64 : {})) {
+            Object.defineProperty(this, field, {
+                value: offseter(this.$handle),
+                writable: false,
+                enumerable: true,
+            });
+        }
+    }
+    static cbb_hex(bytes, in_len) {
+        const bs = new Uint8Array(bytes);
+        const hex_list = [];
+        for (let i = 0; i < in_len; i++) {
+            hex_list.push(HEX_TABLE[bs[i] >> 4] + HEX_TABLE[bs[i] & 0xf]);
+        }
+        return hex_list.join('');
+    }
+    secretlog(label, secret, secret_len) {
+        return {
+            label,
+            client_random: SSL.cbb_hex(this.s3.client_random, SSL3_RANDOM_SIZE),
+            secret: SSL.cbb_hex(secret, secret_len),
+        };
+    }
+}
+function sendSSLSecret(tag, data) {
+    if (Config.OnRPC) {
+        help.$send({
+            type: RPCMsgType.SSL_SECRET,
+            data: {
+                tag: tag,
+                ...data
+            }
+        });
+    }
+    else {
+        const file = help.getLogfile(tag, 'a');
+        file.writeLine(`${data.label} ${data.client_random} ${data.secret}`);
+        file.flush();
+    }
+}
+export class BoringSSL {
+    constructor(mod) {
+        this.mod = mod;
+    }
+    static loadFromModule(mod) {
+        return new BoringSSL(mod);
+    }
+    scanKeylogFunc(fullScan = false, verifier = this.verifyKeylogFunc) {
+        const prog = new ProgressNotify('BoringSSL::scanKeylogFunc');
+        const mod = this.mod;
+        const tryGetSegment = (name) => {
+            if (mod instanceof ElfModuleX) {
+                return mod.getSegment(name);
+            }
+            return null;
+        };
+        const targetString = 'CLIENT_RANDOM';
+        const enc = new TextEncoder();
+        const strBuff = enc.encode(targetString).buffer;
+        const scanPattern = arrayBuffer2Hex(strBuff) + " 00";
+        const targetScanRange = fullScan ? mod : (tryGetSegment('.rodata') || mod);
+        prog.notify({
+            intro: `开始扫描特征[${targetString}]`,
+            modx_name: mod.name,
+            modx_base: mod.base,
+            modx_size: mod.size,
+            scan_base: (targetScanRange ? targetScanRange : mod).base,
+            scan_size: (targetScanRange ? targetScanRange : mod).size,
+            scan_string: targetString,
+            scan_pattern: scanPattern,
+            next: 'help.scanMemory'
+        });
+        // 特征string 扫描
+        const stringTargets = help.scanMemory(targetScanRange ? targetScanRange : mod, scanPattern, { limit: 0x10000 });
+        prog.notify({
+            intro: `捕获目标数[${stringTargets.length}]`,
+            targets: stringTargets.map(v => v.address),
+        });
+        if (!stringTargets.length) {
+            return [];
+        }
+        prog.notify({
+            targets: stringTargets.map(v => v.address),
+        });
+        const guessBLs = [];
+        for (const target of stringTargets) {
+            const adrlScanRange = fullScan ? mod : (tryGetSegment('.text') || mod);
+            prog.notify({
+                target: target.address,
+                scan_base: adrlScanRange.base,
+                scan_size: adrlScanRange.size,
+                next: 'AdrlXref::scanAdrl'
+            });
+            // adrl 目标引用扫描
+            const xref = new AdrlXref(target.address);
+            const adrlResults = xref.scanAdrl(adrlScanRange);
+            prog.notify({
+                intro: `特征[${target.address.sub(mod.base)}]引用关联数[${adrlResults.length}]`,
+                results: adrlResults,
+            });
+            for (const adrl of adrlResults) {
+                const bls = [];
+                // bl 函数调用（只考虑第一次bl
+                const bl = adrl.scanBL();
+                if (bl) {
+                    guessBLs.push(bl);
+                    bls.push(bl);
+                }
+                prog.notify({
+                    adrl: adrl,
+                    bls: bls,
+                });
+            }
+        }
+        const guessFuncs = [];
+        for (const target of guessBLs) {
+            const funcPtr = ptr(target.insn.operands[0].value.toString());
+            guessFuncs.push(funcPtr);
+            prog.notify({
+                intro: `从[${target.src.$handle.sub(mod.base)}]猜测目标函数[${funcPtr.sub(mod.base)}]`,
+                bl: target,
+                func_ptr: funcPtr,
+            });
+        }
+        // 进一步验证目标函数
+        return guessFuncs.reduce((acc, v) => {
+            const p = verifier(v);
+            if (p) {
+                acc.push(p);
+            }
+            return acc;
+        }, []);
+    }
+    verifyKeylogFunc(p) {
+        const subroutine = Subroutine.loadFromPointer(p);
+        // thunk/tail call
+        const verifyResult = subroutine.scoreThunk();
+        if (verifyResult.score > 50 && verifyResult.eoi) {
+            const bInstr = verifyResult.eoi;
+            switch (bInstr.mnemonic) {
+                case 'b':
+                    const target = bInstr.operands[0];
+                    return ptr(target.value.toString());
+                case 'br':
+                    // TODO:
+                    break;
+            }
+        }
+        return p;
+    }
+}
+class SSLTools extends NativePointerObject {
+    static newConsumer(tag = 'sslkey.log') {
+        return new SSLSecretCallbackConsumer(tag);
+    }
+    static attachLibsslKeylogFunc(tag = 'sslkey.log') {
+        if (this._libssl_hook) {
+            return true;
+        }
+        const handle = Libssl.SSL_new.$handle;
+        if (!handle || handle.isNull()) {
+            return false;
+        }
+        this._libssl_hook = true;
+        Interceptor.attach(handle, {
+            onEnter(args) {
+                const [ctx] = unwrapArgs(args, 1);
+                this.ssl_ctx = ctx;
+            },
+            onLeave(retval) {
+                const ctx = this.ssl_ctx;
+                Libssl.SSL_CTX_set_keylog_callback(ctx, FuncHelper.SSL_CTX_keylog_callback(Libssl.SSL_CTX_get_keylog_callback(ctx), (impl, ssl, line) => {
+                    const str = line.readCString();
+                    if (str !== null) {
+                        const sep_list = str.split(' ');
+                        if (sep_list.length !== 3) {
+                            printErr(`[attachLogSecret] error to parse secret_log[${str}]`);
+                        }
+                        else {
+                            const [label, client_random, secret] = sep_list;
+                            sendSSLSecret(tag, { label, client_random, secret });
+                        }
+                    }
+                    if (!impl.isNull()) {
+                        impl(ssl, line);
+                    }
+                }));
+            }
+        });
+        return true;
+    }
+    static attachBoringsslKeylogFunc(options) {
+        let { mod, libname } = options;
+        if (!mod && !libname) {
+            throw new Error(`[attachBoringssl] mod和libname必须要指定一个`);
+        }
+        const prog = new ProgressNotify('SSLTools::attachBoringsslKeylogFunc');
+        if (!mod) {
+            mod = Process.getModuleByName(libname);
+        }
+        const bor = new BoringSSL(mod);
+        const guessList = bor.scanKeylogFunc();
+        if (guessList.length != 1) {
+            throw new Error(`[attachBoringssl] 扫到的目标不存在或多个[${guessList.length}], 不执行attach。`);
+        }
+        Interceptor.attach(guessList[0], SSLTools.newConsumer('sslkey.log').Handler());
+        prog.log(mod.name, `ssl_log_secret: ${guessList[0].sub(mod.base)}`);
+    }
+}
+SSLTools._libssl_hook = false;
+export class SSLSecretCallbackConsumer {
+    constructor(tag) {
+        this.tag = tag;
+    }
+    Handler() {
+        const that = this;
+        return {
+            onEnter(args) {
+                const [ssl, label, secret, secret_len] = unwrapArgs(args, 4);
+                const handle = new SSL(ssl);
+                const len = secret_len.toUInt32();
+                const data = handle.secretlog(label.readCString(), secret.readByteArray(len), len);
+                sendSSLSecret(that.tag, data);
+            },
+            onLeave(retval) {
+            }
+        };
+    }
+}
+export { SSLTools };
+setGlobalProperties({
+    'SSLTools': SSLTools,
+    'BoringSSL': BoringSSL,
+});

package/dist/net/struct.d.ts

@@ -0,0 +1,34 @@
+export declare const SSL3_RANDOM_SIZE = 32;
+export declare const bssl_SSL3_STATE_structOf: {
+    B64: {
+        read_sequence: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => ArrayBuffer;
+        cwrite_sequence: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => ArrayBuffer;
+        server_random: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => ArrayBuffer;
+        client_random: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => ArrayBuffer;
+    };
+    B32: {};
+};
+export declare const ssl_st_structOf: {
+    B64: {
+        method: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => NativePointer;
+        config: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => NativePointer;
+        version: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => number;
+        max_send_fragment: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => number;
+        rbio: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => NativePointer;
+        wbio: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => NativePointer;
+        do_handshake: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => NativePointer;
+        s3: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => {
+            [key: string]: any;
+        };
+        d1: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => NativePointer;
+        msg_callback: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => NativePointer;
+        msg_callback_arg: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => NativePointer;
+        initial_timeout_duration_ms: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => number;
+        session: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => NativePointer;
+        info_callback: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => NativePointer;
+        ctx: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => NativePointer;
+        session_ctx: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => NativePointer;
+        ex_data: (base: NativePointer | import("../utils/array_pointer.js").ArrayPointer) => NativePointer;
+    };
+    B32: {};
+};

package/{src/net/struct.ts → dist/net/struct.js}

@@ -1,15 +1,5 @@
-
-
-import {
-    readByteArray, binaryReadPointer,
-    binaryPointer, binaryReadPointerStruct,
-    binaryReadU8, binaryReadU16,
-    binaryReadU32, binaryReadS32,
-    binaryReadU64, binaryReadS64,
-} from "../utils/utils.js"
-
-export const SSL3_RANDOM_SIZE = 32
-
+import { readByteArray, binaryReadPointer, binaryReadPointerStruct, binaryReadU16, binaryReadU32, } from "../utils/utils.js";
+export const SSL3_RANDOM_SIZE = 32;
 export const bssl_SSL3_STATE_structOf = {
     B64: {
         read_sequence: readByteArray(0, 8),
@@ -20,9 +10,7 @@ export const bssl_SSL3_STATE_structOf = {
     },
     // B32
     B32: {}
-}
-
-
+};
 export const ssl_st_structOf = {
     B64: {
         method: binaryReadPointer(0),
@@ -46,6 +34,4 @@ export const ssl_st_structOf = {
     },
     // B32
     B32: {}
-}
-
-
+};

package/dist/net/tools.js

@@ -0,0 +1 @@
+"use strict";

package/dist/process.d.ts

@@ -0,0 +1,43 @@
+interface RangeDetails {
+    /**
+     * Base address.
+     */
+    base: NativePointer;
+    /**
+     * Size in bytes.
+     */
+    size: number;
+    /**
+     * Protection.
+     */
+    protection: PageProtection;
+    /**
+     * File mapping details, if available.
+     */
+    file?: FileMapping | undefined;
+}
+export declare class ProcMapItem {
+    start_page: NativePointer;
+    end_page: NativePointer;
+    prots: string;
+    offset: number;
+    main_dev: string;
+    slave_dev: string;
+    inode: number;
+    pathname: string;
+    constructor(start_page: string, end_page: string, prots: string, offset: string, main_dev: string, slave_dev: string, inode: string, pathname: string);
+    toString(): string;
+}
+export declare class ProcMap {
+    text: string;
+    items: ProcMapItem[];
+    constructor(text: string);
+    static parseLine(line: string): string[] | null;
+    find(start_addr: NativePointer, end_addr: NativePointer): ProcMapItem[];
+}
+declare class Proc {
+    private static _mapCache;
+    static findMapCache(addr: NativePointer): RangeDetails | null;
+    static loadProcMap(pid?: number | string): ProcMap;
+}
+export { Proc as proc };

package/dist/process.js

@@ -0,0 +1,77 @@
+import { help } from "./helper.js";
+export class ProcMapItem {
+    constructor(start_page, end_page, prots, offset, main_dev, slave_dev, inode, pathname) {
+        this.start_page = ptr(parseInt(start_page, 16));
+        this.end_page = ptr(parseInt(end_page, 16));
+        this.prots = prots;
+        this.offset = parseInt(offset, 16);
+        this.main_dev = main_dev;
+        this.slave_dev = slave_dev;
+        this.inode = parseInt(inode);
+        this.pathname = pathname.trim();
+    }
+    toString() {
+        return `${this.start_page.toString(16)}-${this.end_page.toString(16)} ${this.prots} ${this.offset.toString(16)} ${this.main_dev}:${this.slave_dev} ${this.inode} ${this.pathname}`;
+    }
+}
+const REGEXP_PROC_MAPS_LINE = /^([a-fA-F0-9]+)-([a-fA-F0-9]+)\s+([rwx\-p]+)\s+(\w+)\s+(\w+):(\d+)\s+(\d+)\s+(.*)$/;
+export class ProcMap {
+    constructor(text) {
+        this.text = text;
+        this.items = [];
+        const lines = text.split('\n');
+        for (const line of lines) {
+            if (!line.trim())
+                continue;
+            const result = ProcMap.parseLine(line);
+            if (!result || result.length !== 8)
+                continue;
+            const item = new ProcMapItem(...result);
+            this.items.push(item);
+        }
+    }
+    static parseLine(line) {
+        const m = REGEXP_PROC_MAPS_LINE.exec(line);
+        if (!m)
+            return null;
+        return m.slice(1);
+    }
+    find(start_addr, end_addr) {
+        return this.items.filter(item => {
+            return !(item.start_page >= end_addr || item.end_page <= start_addr);
+        });
+    }
+}
+class Proc {
+    static findMapCache(addr) {
+        const result = this._mapCache.find((v, i) => {
+            return addr >= v.base && addr < v.base.add(v.size);
+        });
+        if (result) {
+            return result || null;
+        }
+        const range = Process.findRangeByAddress(addr);
+        if (!range) {
+            return null;
+        }
+        let hitIndex = -1;
+        const hit = this._mapCache.find((v, i) => {
+            const ok = v.base == range.base;
+            if (ok)
+                hitIndex = i;
+            return ok;
+        });
+        if (hitIndex !== -1) {
+            this._mapCache[hitIndex] = range;
+        }
+        else {
+            this._mapCache.push(range);
+        }
+        return range;
+    }
+    static loadProcMap(pid = 'self') {
+        return new ProcMap(help.readProcMaps(pid));
+    }
+}
+Proc._mapCache = [];
+export { Proc as proc };

package/dist/rpc.d.ts

@@ -0,0 +1 @@
+export {};