-
Notifications
You must be signed in to change notification settings - Fork 32
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
improving hooks in BoringSSL (ssl_log_secrets()); improved the way we…
… can use byte patterns for hooking; symbols now used as an backup solution when we don't identify the target functions using the exports
- Loading branch information
1 parent
ced43c9
commit f37f477
Showing
10 changed files
with
442 additions
and
34 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,93 @@ | ||
|
|
||
| import {Cronet } from "../ssl_lib/cronet.js"; | ||
| import { socket_library } from "./android_agent.js"; | ||
| import {PatternBasedHooking } from "../shared/pattern_based_hooking.js"; | ||
| import { patterns, isPatternReplaced } from "../ssl_log.js" | ||
| import { devlog } from "../util/log.js"; | ||
|
|
||
|
|
||
| export class Pattern_Android extends Cronet { | ||
|
|
||
| constructor(public moduleName:string, public socket_library:String, is_base_hook: boolean){ | ||
| super(moduleName,socket_library,is_base_hook); | ||
| } | ||
|
|
||
| install_key_extraction_hook(){ | ||
| if(isPatternReplaced){ | ||
| const patternModuleName = Process.findModuleByName(this.module_name); | ||
| const hooker = new PatternBasedHooking(patternModuleName); | ||
|
|
||
| hooker.hook_DumpKeys(this.module_name,this.module_name,patterns,(args: any[]) => { | ||
| devlog(`Installed ssl_log_secret() hooks using byte patterns for module ${this.module_name}`); | ||
| this.dumpKeys(args[1], args[0], args[2]); // Unpack args into dumpKeys | ||
| }); | ||
|
|
||
| return hooker; | ||
| }else{ | ||
| return null; | ||
| } | ||
|
|
||
| } | ||
|
|
||
| // instead of relying on pattern we check if the target module has a symbol of ssl_log_secret() | ||
| execute_symbol_based_hooking(hooker){ | ||
| // Capture the dumpKeys function with the correct 'this' | ||
| let dumpKeysFunc = this.dumpKeys.bind(this); | ||
|
|
||
| if(hooker.no_hooking_success){ | ||
| let symbols = Process.getModuleByName(this.module_name).enumerateSymbols().filter(exports => exports.name.toLowerCase().includes("ssl_log")); | ||
| if(symbols.length > 0){ | ||
| devlog("Installed ssl_log_secret() hooks using sybmols."); | ||
| try{ | ||
| Interceptor.attach(symbols[0].address, { | ||
| onEnter: function(args) { | ||
| dumpKeysFunc(args[1], args[0], args[2]); | ||
| } | ||
| }); | ||
|
|
||
| }catch(e){ | ||
| // right now we ingore error's here | ||
| } | ||
| } | ||
|
|
||
|
|
||
| } | ||
|
|
||
| } | ||
|
|
||
| execute_boring_ssl_log_secret_hooks(){ | ||
| // hooking ssl_log_secret() from BoringSSL | ||
| let hooker_instance = this.install_key_extraction_hook(); | ||
| return hooker_instance; | ||
| } | ||
|
|
||
| } | ||
|
|
||
|
|
||
| export function pattern_execute(moduleName:string, is_base_hook: boolean){ | ||
| let pattern_BoringSSL = new Pattern_Android(moduleName,socket_library,is_base_hook); | ||
| try { | ||
| let hooker = pattern_BoringSSL.execute_boring_ssl_log_secret_hooks(); | ||
| if(hooker != null){ | ||
| // wait 1 sec before we continue | ||
| setTimeout(function() { | ||
| pattern_BoringSSL.execute_symbol_based_hooking(hooker); | ||
| }, 1000); | ||
| } | ||
| }catch(error_msg){ | ||
| devlog(`pattern_execute error: ${error_msg}`) | ||
| } | ||
|
|
||
| if (is_base_hook) { | ||
| try { | ||
| const init_addresses = pattern_BoringSSL.addresses[moduleName]; | ||
| // ensure that we only add it to global when we are not | ||
| if (Object.keys(init_addresses).length > 0) { | ||
| (global as any).init_addresses[moduleName] = init_addresses; | ||
| } | ||
| }catch(error_msg){ | ||
| devlog(`pattern_execute base-hook error: ${error_msg}`) | ||
| } | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.