Whatsapp 相关(七) -网络请求

本篇主要用来完善上篇文章 frida 监测网络请求的.

whatsapp相关(五)- frida监测网络请求

1: 脚本

本次的脚本与上次的区别是,之前只能输出请求的地址,本次优化后,可输出请求参数,结果等.

代码如下:

Java.perform(function () {var HttpURLConnection = Java.use('java.net.HttpURLConnection');var URL = Java.use('java.net.URL');var Proxy = Java.use('java.net.Proxy');var originalOpenConnection = URL.openConnection;URL.openConnection.overload().implementation = function () {var connection = originalOpenConnection.call(this);console.log('URL.openConnection called: ' + this.toString());return connection;};var HttpURLConnectionImpl = Java.use('com.android.okhttp.internal.huc.HttpURLConnectionImpl');HttpURLConnectionImpl.connect.overload().implementation = function () {console.log('connect()');HttpURLConnectionImpl.connect.call(this);};HttpURLConnectionImpl.setRequestProperty.implementation = function(name,value){console.log("setRequestProperty => ",name,": ",value);return this.setRequestProperty(name,value);};HttpURLConnectionImpl.setRequestMethod.implementation = function(type){console.log("setRequestMethod : ",type);return this.setRequestMethod(type);};HttpURLConnectionImpl.responseSourceHeader.implementation = function(response){var result = this.responseSourceHeader(response);console.log("responseSourceHeader : " + result);return result;};HttpURLConnectionImpl.getResponseCode.overload().implementation = function(){var code =    this.getResponseCode();console.log("getResponseCode : " + code);return code;};HttpURLConnectionImpl.setConnectTimeout.overload("int").implementation = function(time){console.log("setConnectTimeout : " + time);return this.setConnectTimeout(time);};var testInput;HttpURLConnectionImpl.getInputStream.overload().implementation = function () {var returnStream = HttpURLConnectionImpl.getInputStream.call(this);testInput = returnStream;var inputStr = readInputStream(testInput);console.log("getInputStream(): " + inputStr);return returnStream;};#打印inputStreamfunction readInputStream(inputStream){var str = '';if(inputStream == null){console.log("inputStream is null");return str;}try{var inputStreamReader = Java.use('java.io.InputStreamReader').$new(inputStream ,"UTF-8");var bufferedReader = Java.use('java.io.BufferedReader').$new(inputStreamReader);var response = Java.use('java.lang.StringBuffer').$new();var line = null;while((line = bufferedReader.readLine()) != null){response.append(line);}bufferedReader.close();str = response;}catch(error){console.error( "inputstream error: " + error);return null;}return str;}
});

由于HttpURLConnection 是抽象类,所以直接打印的HttpURLConnection方法无法输出数据.

我们找到HttpURLConnection的子类HttpURLConnectionImpl .从而获取相关的数据输出.

2: 测试

执行脚本:

frida -U -f com.whatsapp -l /home/zh/workSpace/test/Xpose/app/src/main/java/com/zh/xpose/js/url.js ____/ _  |   Frida 16.0.2 - A world-class dynamic instrumentation toolkit| (_| |> _  |   Commands:/_/ |_|       help      -> Displays the help system. . . .       object?   -> Display information about 'object'. . . .       exit/quit -> Exit. . . .. . . .   More info at https://frida.re/docs/home/. . . .. . . .   Connected to xxx (id=6b4a96b2)
Spawned `com.whatsapp`. Resuming main thread!

启动whatsapp后:


[xxx::com.whatsapp ]-> URL.openConnection called: https://graph.whatsapp.com/graphql
setConnectTimeout : 15000
setRequestProperty =>  User-Agent :  WhatsApp/xxx Android/10 Device/LeEco-xxx [FBAN/WhatsAppAndroid;FBAV/xxx;FBLC/zh_CN;FBSV/10;FBBR/msm8996;FBBD/LeEco;FBBV/240175000;FBCA/arm64-v8a:;FBPN/com.whatsapp;FBDM/DisplayMetrics{density=3.5, width=1440, height=2560, scaledDensity=3.5, xdpi=537.882, ydpi=537.388};]
setRequestMethod :  POST
setRequestProperty =>  Content-Type :  application/json
setRequestProperty =>  Content-Encoding :  gzip
connect()
responseSourceHeader : NETWORK 200
getInputStream(): {"data":{"avatar_static_config":{"id":"711543810765370"}},"extensions":{"is_final":true}}URL.openConnection called: http://clients3.google.com/generate_204
setConnectTimeout : 10000
URL.openConnection called: https://www.whatsapp.com/android/3/WhatsApp.version
setConnectTimeout : 15000
setRequestProperty =>  User-Agent :  WhatsApp/xxx Android/10 Device/LeEco-xxx
setRequestProperty =>  Accept-Charset :  UTF-8
getInputStream(): 
getResponseCode : 204
getResponseCode : 200
getInputStream(): <pre style="word-wrap: break-word; white-space: pre-wrap;">2.24.2.77</pre>