friTap 2.2.1__tar.gz → 2.2.2__tar.gz

{fritap-2.2.1/friTap.egg-info → fritap-2.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: friTap
-Version: 2.2.1
+Version: 2.2.2
 Summary: Simplifies (SSL/TLS) traffic analysis and key extraction using Frida across major platforms.
 Home-page: https://github.com/fkie-cad/friTap
 Author: Daniel Baier, Julian Lengersdorff, Francois Egner, Max Ufer
@@ -66,7 +66,7 @@ Dynamic: summary
 </div>
 
 # friTap
-![version](https://img.shields.io/badge/version-2.2.1-blue) [![PyPI version](https://d25lcipzij17d.cloudfront.net/badge.svg?id=py&r=r&ts=1683906897&type=6e&v=2.2.1&x2=0)](https://badge.fury.io/py/friTap) [![CI](https://github.com/fkie-cad/friTap/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/fkie-cad/friTap/actions/workflows/ci.yml)
+![version](https://img.shields.io/badge/version-2.2.2-blue) [![PyPI version](https://d25lcipzij17d.cloudfront.net/badge.svg?id=py&r=r&ts=1683906897&type=6e&v=2.2.2&x2=0)](https://badge.fury.io/py/friTap) [![CI](https://github.com/fkie-cad/friTap/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/fkie-cad/friTap/actions/workflows/ci.yml)
 [![Ruff](https://github.com/fkie-cad/friTap/actions/workflows/lint.yml/badge.svg?branch=main)](https://github.com/fkie-cad/friTap/actions/workflows/lint.yml)
 [![Publish status](https://github.com/fkie-cad/friTap/actions/workflows/publish.yml/badge.svg?branch=main)](https://github.com/fkie-cad/friTap/actions/workflows/publish.yml)
 

{fritap-2.2.1 → fritap-2.2.2}/README.md

@@ -4,7 +4,7 @@
 </div>
 
 # friTap
-![version](https://img.shields.io/badge/version-2.2.1-blue) [![PyPI version](https://d25lcipzij17d.cloudfront.net/badge.svg?id=py&r=r&ts=1683906897&type=6e&v=2.2.1&x2=0)](https://badge.fury.io/py/friTap) [![CI](https://github.com/fkie-cad/friTap/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/fkie-cad/friTap/actions/workflows/ci.yml)
+![version](https://img.shields.io/badge/version-2.2.2-blue) [![PyPI version](https://d25lcipzij17d.cloudfront.net/badge.svg?id=py&r=r&ts=1683906897&type=6e&v=2.2.2&x2=0)](https://badge.fury.io/py/friTap) [![CI](https://github.com/fkie-cad/friTap/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/fkie-cad/friTap/actions/workflows/ci.yml)
 [![Ruff](https://github.com/fkie-cad/friTap/actions/workflows/lint.yml/badge.svg?branch=main)](https://github.com/fkie-cad/friTap/actions/workflows/lint.yml)
 [![Publish status](https://github.com/fkie-cad/friTap/actions/workflows/publish.yml/badge.svg?branch=main)](https://github.com/fkie-cad/friTap/actions/workflows/publish.yml)
 

{fritap-2.2.1 → fritap-2.2.2}/friTap/about.py

@@ -2,5 +2,5 @@
 # -*- coding: utf-8 -*-
 
 __author__ = "Daniel Baier, Julian Lengersdorff, Francois Egner, Max Ufer"
-__version__ = "2.2.1"
+__version__ = "2.2.2"
 debug = False # are we running in debug mode?

{fritap-2.2.1 → fritap-2.2.2}/friTap/config.py

@@ -87,6 +87,28 @@ class HookingConfig:
     # passes, no Java VM safepoint sync), which also helps fritap attach to a
     # target that is already in the middle of active QUIC traffic.
     quic_only: bool = False
+    # When True, the agent skips the inline android_dlopen_ext loader hook. This
+    # is the hook PairIP / anti-tamper runtimes detect and SIGSEGV on during a
+    # spawn-time integrity scan (fkie-cad/friTap#64). Only already-loaded /
+    # explicitly-selected TLS libraries are then hooked. The agent also auto-
+    # skips it in spawn mode when an anti-tamper library is detected.
+    no_loader_hook: bool = False
+    # EXPERIMENTAL (Android). Watch android_dlopen_ext via a hardware breakpoint
+    # (ARM64 debug registers, no linker code patch) instead of the inline
+    # trampoline, so late-loaded TLS libs can be hooked on PairIP-protected apps
+    # without tripping the anti-tamper scan. Unvalidated on-device; default OFF.
+    stealth_loader: bool = False
+    # --pairip-safe (Android; attach and spawn). Minimal, scan-free capture mode
+    # for PairIP-protected apps: hook only a curated TLS-library allowlist
+    # (libssl.so, libhttpengine.so, libjavacrypto.so, libconscrypt*,
+    # libcommerce_http_client.so, offset-based libwebviewchromium.so; libunity.so
+    # is opt-in via --offsets), resolved WITHOUT any Memory.scan (exports ->
+    # symbols -> offsets). Skips the loader hook, WebView/Cronet pattern scan,
+    # Java hooks, OHTTP and the library-scan pass — the broad footprint that trips
+    # PairIP's periodic integrity check (an in-process SIGSEGV). Keys persist via
+    # "blink" (hooks toggled so .text stays pristine between scans).
+    # (fkie-cad/friTap#64). Default OFF.
+    pairip_safe: bool = False
     # Override which layer of the HTTP/3 egress-headers fallback chain the
     # agent actually attaches to. "auto" (default) keeps the winner-takes-all
     # logic: quiche-internal QuicSpdyStream::WriteHeaders preferred, then
@@ -221,6 +243,9 @@ class FriTapConfig:
         force_scan_modules: Optional[List[str]] = None,
         quic_capture_mode: str = "stream",
         quic_only: bool = False,
+        no_loader_hook: bool = False,
+        stealth_loader: bool = False,
+        pairip_safe: bool = False,
         quic_egress_headers_layer: str = "auto",
         scan_keys_region: Optional[str] = None,
         scan: Optional[str] = None,
@@ -280,6 +305,9 @@ class FriTapConfig:
                 force_scan_modules=list(force_scan_modules or []),
                 quic_capture_mode=quic_capture_mode,
                 quic_only=quic_only,
+                no_loader_hook=no_loader_hook,
+                stealth_loader=stealth_loader,
+                pairip_safe=pairip_safe,
                 quic_egress_headers_layer=quic_egress_headers_layer,
                 scan_keys_region=scan_keys_region,
             ),

{fritap-2.2.1 → fritap-2.2.2}/friTap/constants.py

@@ -87,6 +87,7 @@ class ContentType:
     CONSOLE_WARN = "console_warn"
     CONSOLE_ERROR = "console_error"
     LIBRARY_DETECTED = "library_detected"
+    ANTI_TAMPER_DETECTED = "anti_tamper_detected"
     SOCKET_TRACE = "socket_trace"
     SSH_KEY = "ssh_key"
     SSH_KEYLOG = "ssh_keylog"

{fritap-2.2.1 → fritap-2.2.2}/friTap/events.py

@@ -97,6 +97,19 @@ class LibraryDetectedEvent(FriTapEvent):
     path: str = ""
 
 
+@dataclass
+class AntiTamperDetectedEvent(FriTapEvent):
+    """Emitted when a known anti-tamper / integrity-protection runtime (e.g.
+    Google PairIP, libpairipcore.so) is detected in the target process.
+
+    ``skipped_loader_hook`` is True when friTap responded by skipping the inline
+    android_dlopen_ext loader hook to avoid a SIGSEGV (fkie-cad/friTap#64).
+    """
+    library: str = ""
+    name: str = ""
+    skipped_loader_hook: bool = False
+
+
 # Session lifecycle event type constants
 SESSION_STARTED = "started"
 SESSION_RESUMED = "resumed"

{fritap-2.2.1 → fritap-2.2.2}/friTap/friTap.py

@@ -421,6 +421,37 @@ Offline (read / analyze .tap):
                            "Filter scope: Android = Google QUICHE (Cronet) only; "
                            "Linux = Cloudflare quiche, Google QUICHE (Cronet), Mozilla "
                            "Neqo (Firefox).")
+    args.add_argument("--no-loader-hook", "-nlh", required=False, action="store_const",
+                      const=True, default=False, dest="no_loader_hook",
+                      help="Android: do not install the android_dlopen_ext loader hook. "
+                           "Avoids PairIP / anti-tamper SIGSEGV crashes (fkie-cad/friTap#64); "
+                           "only already-loaded / explicitly-selected (--offsets) TLS libraries "
+                           "are hooked. Recommended together with attach mode (no -s). friTap "
+                           "also auto-skips this hook in spawn mode when it detects a known "
+                           "anti-tamper library such as Google PairIP (libpairipcore.so).")
+    args.add_argument("--experimental-stealth-loader", required=False, action="store_const",
+                      const=True, default=False, dest="stealth_loader",
+                      help="EXPERIMENTAL (Android, arm64). Watch android_dlopen_ext via a "
+                           "hardware breakpoint (CPU debug registers — no linker code patch) "
+                           "instead of the inline trampoline, so late-loaded TLS libraries can "
+                           "be hooked on PairIP-protected apps without tripping the anti-tamper "
+                           "scan (fkie-cad/friTap#64). UNVALIDATED on-device; needs root "
+                           "frida-server and may not catch loads on threads created after attach.")
+    args.add_argument("--pairip-safe", required=False, action="store_const",
+                      const=True, default=False, dest="pairip_safe",
+                      help="Android: minimal capture mode for Google PairIP-protected apps "
+                           "(fkie-cad/friTap#64). Hooks ONLY a curated, scan-free TLS-library "
+                           "allowlist (libssl.so, libhttpengine.so, libcommerce_http_client.so, "
+                           "libjavacrypto.so, libconscrypt*, and offset-based libwebviewchromium.so; "
+                           "libunity.so is opt-in via --offsets), resolved without any Memory.scan "
+                           "(exports -> symbols -> offsets); skips the loader hook, the WebView/Cronet "
+                           "pattern scan, Java hooks, OHTTP and library-scan — the broad footprint "
+                           "that trips PairIP's periodic integrity check and SIGSEGVs the app. Keys "
+                           "persist via 'blink' (hooks toggled so .text stays pristine between scans). "
+                           "Works with BOTH attach and spawn (-s); spawn is best-effort (hooks are "
+                           "deferred past PairIP's startup window, so the earliest handshakes may be "
+                           "missed — attach is the proven path). Trigger fresh TLS handshakes after "
+                           "attach (e.g. toggle wifi). See docs/advanced/pairip-safe.md.")
     args.add_argument("--library-scan", "-ls", required=False, action="store_const",
                       const=True, default=False,
                       help="Pre-scan for TLS libraries using tlsLibHunter before hooking. "
@@ -712,6 +743,9 @@ Offline (read / analyze .tap):
             force_scan_modules=getattr(parsed, 'force_scan_modules', None),
             quic_capture_mode=getattr(parsed, 'quic_capture_mode', 'stream'),
             quic_only=getattr(parsed, 'quic_only', False),
+            no_loader_hook=getattr(parsed, 'no_loader_hook', False),
+            stealth_loader=getattr(parsed, 'stealth_loader', False),
+            pairip_safe=getattr(parsed, 'pairip_safe', False),
             quic_egress_headers_layer=getattr(parsed, 'quic_egress_headers_layer', 'auto'),
             scan_keys_region=getattr(parsed, 'scan_keys_region', None),
             scan=getattr(parsed, 'scan', None),