From 16719239ac0fb477aaaac5f9ba629d21fd22b61a Mon Sep 17 00:00:00 2001 From: hyugogirubato <65763543+hyugogirubato@users.noreply.github.com> Date: Mon, 18 Sep 2023 12:44:32 +0200 Subject: [PATCH] Release v1.1.5 --- CHANGELOG.md | 17 +++++++++++ README.md | 3 -- scripts/android-crypto/crypto.js | 11 ++----- scripts/android-native/native.js | 50 ++++++++++++++++++++------------ 4 files changed, 51 insertions(+), 30 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e00f0f9..0778654 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,22 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.1.5] - 2023-09-18 + +### Added + +- **Native**: Support for the `Integer` type for return codes. + +### Fixed + +- **Native**: Problems displaying recursive mode (argument number colliding with other calls). +- **Native**: Fixed automatic detection of the number of arguments per function (experimental). + +### Changed + +- **Native**: Removed detection of `UUID` form in `hex` format. +- **Crypto**: Removed detection of `UUID` form in `hex` format. + ## [1.1.4] - 2023-08-15 ### Added @@ -68,6 +84,7 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). - Initial Release. +[1.1.5]: https://github.com/hyugogirubato/Frida-CodeShare/releases/tag/v1.1.5 [1.1.4]: https://github.com/hyugogirubato/Frida-CodeShare/releases/tag/v1.1.4 [1.1.3]: https://github.com/hyugogirubato/Frida-CodeShare/releases/tag/v1.1.3 [1.1.2]: https://github.com/hyugogirubato/Frida-CodeShare/releases/tag/v1.1.2 diff --git a/README.md b/README.md index 044f9e4..fc695b8 100644 --- a/README.md +++ b/README.md @@ -9,9 +9,6 @@ -> **Warning** -> -> An error has been observed with the native script concerning the automatic detection of the number of arguments of a function. This feature will be fixed soon. This repository contains a collection of Frida scripts for intercepting and modifying the behavior of Android apps at runtime. These scripts leverage the power of Frida, a dynamic instrumentation tool, to hook into the target app's Java diff --git a/scripts/android-crypto/crypto.js b/scripts/android-crypto/crypto.js index 2c1dc68..df7e5aa 100644 --- a/scripts/android-crypto/crypto.js +++ b/scripts/android-crypto/crypto.js @@ -1,10 +1,10 @@ /**@@@+++@@@@****************************************************************** ** - ** Android Crypto Interceptor frida script v1.3 hyugogirubato + ** Android Crypto Interceptor frida script v1.4 hyugogirubato ** ** frida -D "DEVICE" -l "crypto.js" -f "PACKAGE" ** - ** Update: Added Hex output when the size matches a classic standard. + ** Update: Removed detection of UUID form in hex format. ** ***@@@---@@@@****************************************************************** */ @@ -59,11 +59,6 @@ const bytesToBase64 = (bytes) => { return null; } -const isUUID = (hex) => { - const uuidPattern = /^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/; - return uuidPattern.test(hex); -} - const Base64ToHex = (base64) => { const bytes = BASE64.getDecoder().decode(base64); let hexData = ""; @@ -86,7 +81,7 @@ const showVariable = (module, items, colorKey, hexValue = false) => { if (items[i].key.includes("Base64") && items[i].value !== null) { const key = items[i].key.replace("Base64", "HEX"); const value = Base64ToHex(items[i].value); - if ((!value.includes("-") && [32, 40, 48, 64].includes(value.length)) || isUUID(value) || hexValue) { + if ((!value.includes("-") && [32, 40, 48, 64].includes(value.length)) || hexValue) { console.log(`${colorKey} --> [${i}] ${key}: ${value}${COLORS.reset}`); } } diff --git a/scripts/android-native/native.js b/scripts/android-native/native.js index 71b7fb0..0077db8 100644 --- a/scripts/android-native/native.js +++ b/scripts/android-native/native.js @@ -1,10 +1,10 @@ /**@@@+++@@@@****************************************************************** ** - ** Android Native Interceptor frida script v1.8 hyugogirubato + ** Android Native Interceptor frida script v1.9 hyugogirubato ** ** frida -D "DEVICE" -l "native.js" -f "PACKAGE" ** - ** Update: Added debug information option for library/module/variable + ** Update: Support for the Integer type for return codes. ** ***@@@---@@@@****************************************************************** */ @@ -38,11 +38,6 @@ const randomColor = () => { return COLORS[colorKeys[index]]; } -const isUUID = (hex) => { - const uuidPattern = /^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/; - return uuidPattern.test(hex); -} - const searchLibraries = () => { let libraries = Process.enumerateModules().filter(lib => PACKAGE ? lib["path"].toLowerCase().includes(PACKAGE.toLowerCase()) : true); if (LIBRARIES.length > 0) { @@ -136,7 +131,7 @@ const showVariable = (address, colorKey, argIndex = 0, hexValue = false) => { console.log(`${colorKey} --> [${argIndex}] Pointer: 0x${hexData}${COLORS.reset}`); } else { // Hex - if ((!hexData.includes("-") && [32, 40, 48, 64].includes(hexData.length)) || isUUID(hexData) || hexValue) { + if ((!hexData.includes("-") && [32, 40, 48, 64].includes(hexData.length)) || hexValue) { console.log(`${colorKey} --> [${argIndex}] Hex: ${hexData}${COLORS.reset}`); } @@ -147,34 +142,51 @@ const showVariable = (address, colorKey, argIndex = 0, hexValue = false) => { console.log(`${colorKey} --> [${argIndex}] Base64: ${base64Data}${COLORS.reset}`); }); } + } else { + console.log(`${colorKey} --> [${argIndex}] Integer: ${parseInt(address, 16)}${COLORS.reset}`); } } +const argsCount = (args) => { + let count = 0; + while (true) { + try { + const tmp = new NativePointer(args[count]); + tmp.readPointer(); + count += 1; + } catch (e) { + break + } + } + return count; +} + const attachFunction = (module) => { console.log(`[*] Module attached: ${module["name"]}`); const colorKey = randomColor(); - const params = []; - Interceptor.attach(module["address"], { + const params = {}; + const address = module["address"]; + Interceptor.attach(address, { onEnter: function (args) { console.log(`${colorKey}[+] onEnter: ${module["name"]}${COLORS.reset}`); - // RangeError Patch - for (let i = 0; i < 10; i++) { - if (args[i].toString().length !== 12) { - break; - } + // RangeError Patch + args counter + params[address] = []; + for (let i = 0; i < argsCount(args); i++) { showVariable(args[i], colorKey, i, false); - params.push(args[i]); + params[address].push(args[i]); } }, onLeave: function (retval) { console.log(`${colorKey}[-] onLeave: ${module["name"]}${COLORS.reset}`); if (RECURSIVE) { - for (let i = 0; i < params.length; i++) { - showVariable(params[i], colorKey, i, false); + for (let i = 0; i < params[address].length; i++) { + showVariable(params[address][i], colorKey, i, false); } } - showVariable(retval, colorKey, RECURSIVE ? params.length : 0, false); + + showVariable(retval, colorKey, RECURSIVE ? params[address].length : 0, false); + delete params[address]; } }); }