首页
论坛
专栏
课程

[原创]Frida实现okhttp3.Interceptor

2019-6-21 23:25 3111

[原创]Frida实现okhttp3.Interceptor

2019-6-21 23:25
3111

https://bbs.pediy.com/thread-252100.htm
珍惜Any用xposed实现了okhttp3的Interceptor,我这里发一个frida实现okhttp3的Interceptor

function hook_okhttp3() {
    Java.perform(function () {
        var ByteString = Java.use("com.android.okhttp.okio.ByteString");
        var Buffer = Java.use("com.android.okhttp.okio.Buffer");
        var Interceptor = Java.use("okhttp3.Interceptor");
        var MyInterceptor = Java.registerClass({
            name: "okhttp3.MyInterceptor",
            implements: [Interceptor],
            methods: {
                intercept: function (chain) {
                    var request = chain.request();
                    try {
                        console.log("MyInterceptor.intercept onEnter:", request, "\nrequest headers:\n", request.headers());
                        var requestBody = request.body();
                        var contentLength = requestBody ? requestBody.contentLength() : 0;
                        if (contentLength > 0) {
                            var BufferObj = Buffer.$new();
                            requestBody.writeTo(BufferObj);
                            try {
                                console.log("\nrequest body String:\n", BufferObj.readString(), "\n");
                            } catch (error) {
                                try {
                                    console.log("\nrequest body ByteString:\n", ByteString.of(BufferObj.readByteArray()).hex(), "\n");
                                } catch (error) {
                                    console.log("error 1:", error);
                                }
                            }
                        }
                    } catch (error) {
                        console.log("error 2:", error);
                    }
                    var response = chain.proceed(request);
                    try {
                        console.log("MyInterceptor.intercept onLeave:", response, "\nresponse headers:\n", response.headers());
                        var responseBody = response.body();
                        var contentLength = responseBody ? responseBody.contentLength() : 0;
                        if (contentLength > 0) {
                            console.log("\nresponsecontentLength:", contentLength, "responseBody:", responseBody, "\n");

                            var ContentType = response.headers().get("Content-Type");
                            console.log("ContentType:", ContentType);
                            if (ContentType.indexOf("video") == -1) {
                                if (ContentType.indexOf("application") == 0) {
                                    var source = responseBody.source();
                                    if (ContentType.indexOf("application/zip") != 0) {
                                        try {
                                            console.log("\nresponse.body StringClass\n", source.readUtf8(), "\n");
                                        } catch (error) {
                                            try {
                                                console.log("\nresponse.body ByteString\n", source.readByteString().hex(), "\n");
                                            } catch (error) {
                                                console.log("error 4:", error);
                                            }
                                        }
                                    }
                                }

                            }

                        }

                    } catch (error) {
                        console.log("error 3:", error);
                    }
                    return response;
                }
            }
        });
        var ArrayList = Java.use("java.util.ArrayList");
        var OkHttpClient = Java.use("okhttp3.OkHttpClient");
        console.log(OkHttpClient);
        OkHttpClient.$init.overload('okhttp3.OkHttpClient$Builder').implementation = function (Builder) {
            console.log("OkHttpClient.$init:", this, Java.cast(Builder.interceptors(), ArrayList));
            this.$init(Builder);
        };

        var MyInterceptorObj = MyInterceptor.$new();
        var Builder = Java.use("okhttp3.OkHttpClient$Builder");
        console.log(Builder);
        Builder.build.implementation = function () {
            this.interceptors().clear();
            //var MyInterceptorObj = MyInterceptor.$new();
            this.interceptors().add(MyInterceptorObj);
            var result = this.build();
            return result;
        };

        Builder.addInterceptor.implementation = function (interceptor) {
            this.interceptors().clear();
            //var MyInterceptorObj = MyInterceptor.$new();
            this.interceptors().add(MyInterceptorObj);
            return this;
            //return this.addInterceptor(interceptor);
        };

        console.log("hook_okhttp3...");
    });
}

用spawn方式启动app
frida -U --no-pause -f xxx -l hook.js

 

看看效果



[公告]安全服务和外包项目请将项目需求发到看雪企服平台:https://qifu.kanxue.com

最后于 2019-7-4 23:12 被Imyang编辑 ,原因:
最新回复 (9)
Ddddz 2019-6-24 14:21
2
0
beimingyouyu 2019-7-1 18:22
3
0
java.lang.ClassNotFoundException: Didn\'t find class "okhttp3.MyInterceptor"
Imyang 1 2019-7-2 11:11
4
0
beimingyouyu java.lang.ClassNotFoundException: Didn\'t find class "okhttp3.MyInterceptor"
你用的frida是哪个版本,okhttp3.MyInterceptor是通过Java.registerClass注册的类,不是apk里面的
小黄鸭爱学习 2019-7-3 09:54
5
0
测试没有效果 frida 最新的 12.6.9 版本
beimingyouyu 2019-7-4 15:42
6
0
发现是Android版本低的手机里frida会不能使用registerClass,不过换版本高点的手机试了之后同没效果
Imyang 1 2019-7-4 23:11
7
0
beimingyouyu 发现是Android版本低的手机里frida会不能使用registerClass,不过换版本高点的手机试了之后同没效果
我的手机系统是Android 8.1.0, 自己编译的AOSP。
用spawn方式启动app
frida -U --no-pause -f xxx -l hook.js
mb_gygeohyt 2019-7-27 15:57
8
0
大佬我想问一下为什么我用Java.cast进行数据类型转换都会报错,我本来是想把java.lang.Object转为[B但是失败了,然后我尝试string转为stirng也会报错,大佬这是什么情况啊
Imyang 1 2019-7-29 09:32
9
0
mb_gygeohyt 大佬我想问一下为什么我用Java.cast进行数据类型转换都会报错,我本来是想把java.lang.Object转为[B但是失败了,然后我尝试string转为stirng也会报错,大佬这是什么情况啊 ...
```
var ByteString = Java.use("com.android.okhttp.okio.ByteString");
ByteString.of(BufferObj.readByteArray()).hex()
```
如果你想打印byte[],可以使用ByteString转成hex的字符串
很快就胖了 2019-7-31 10:11
10
0
大佬,为什么我执行注入hookjs成功了,但是没有回调消息的
游客
登录 | 注册 方可回帖
返回