ReferenceError: addNativeHook is not defined

[visualsayed]

I know that I need Dwarf 2 to run this script but how can I get the required version?

[iGio90]

You dont need any dwarf!
just replace the addNativeHook with a standard frida interceptor on the same addresses
this one is quite outdate in terms of api but hooks are still right

[PinkiePieStyle]

before 2.x changes
https://github.com/iGio90/NetworkRequests/tree/fdefdf3d7ca3896fe02aece474f4535350f20efc

[visualsayed]

Hi Giovani, hi PinkiePieStyle,

Thanks a lot for your help, it is highly appreciated I did try the script before 2.x changes but I got the following error:

01:15:24.770946 ReferenceError: api is not defined

I also manage to replace addNativeHook with a standard frida but with no luck.

Any recommendation?

Thanks a gain,
Sayed

[visualsayed]

Hi again,

What I'm trying to do is logging both "login" and "register" accounts requests of a moded APK that belongs to a game.

I tried all possible frida, objection, dwarf scripts but not luck.

Any thoughts?

Thanks a lot,
Sayed

[PinkiePieStyle]

Think @iGio90 changed api.hookNative to putBreakpoint and some other stuff in Dwarf

https://github.com/iGio90/NetworkRequests/tree/fdefdf3d7ca3896fe02aece474f4535350f20efc

replace 'api.' with ''
replace 'hookNative' and 'hookJava' with 'putBreakpoint'

[visualsayed]

Hi PinkiePieStyle,

Thanks for your help, Now i didn't get any error in dwarf UI javascript console panel but I got the following error in the cmd prompt:

payload: {'type': 'error', 'description': "TypeError: Cannot read property '1' of undefined", 'stack': "TypeError: Cannot read property '1' of undefined\n at ThreadContext.eval (eval at evaluateFunction (/script1.js:1735:18), :14:41)\n at Function.breakpoint (/script1.js:3092:24)\n at InvocationContext. (/script1.js:3243:25)\n at InvocationContext.replacement (/script1.js:2993:40)", 'lineNumber': 14, 'columnNumber': 41}
payload: {'type': 'error', 'description': "TypeError: Cannot read property '1' of undefined", 'stack': "TypeError: Cannot read property '1' of undefined\n at ThreadContext.eval (eval at evaluateFunction (/script1.js:1735:18), :14:41)\n at Function.breakpoint (/script1.js:3092:24)\n at InvocationContext. (/script1.js:3243:25)\n at InvocationContext.replacement (/script1.js:2993:40)", 'lineNumber': 14, 'columnNumber': 41}
payload: {'type': 'error', 'description': 'TypeError: condition.call is not a function', 'stack': 'TypeError: condition.call is not a function\n at Function.breakpoint (/script1.js:3092:24)\n at InvocationContext. (/script1.js:3243:25)\n at InvocationContext.replacement (/script1.js:2993:40)', 'fileName': '/script1.js', 'lineNumber': 3092, 'columnNumber': 24}
QWindowsWindow::setGeometry: Unable to set geometry 2048x1188+0+34 (frame: 2070x1244-11-11) on QWidgetWindow/"AppWindowClassWindow" on "\.\DISPLAY1". Resulting geometry: 2048x1058+0+34 (frame: 2070x1114-11-11) margins: 11, 45, 11, 11 minimum size: 516x594 MINMAXINFO maxSize=0,0 maxpos=0,0 mintrack=1054,1244 maxtrack=0,0)

Any Ideas?

Thanks,
Sayed

[PinkiePieStyle]

// api.hookNative is a shortcut of Interceptor attach
// api.findExport is a shortcut of Module.findExportByName
putBreakpoint(findExport('send'), function(args) {
    var what = Memory.readByteArray(args[1], parseInt(args[2]));
    // send data to ui (data panel)
    setData(Date.now() + ' send', what);
    // return -1 to prevent thread break
    //return -1;
});

putBreakpoint(findExport('SSL_write', 'libssl.so'), function(args) {
    var what = Memory.readByteArray(args[1], parseInt(args[2]));
    // send data to ui (data panel)
    setData(Date.now() + ' SSL_write', what);
    // return -1 to prevent thread break
    //return -1;
});

putBreakpoint(findExport('recv'), {
    onEnter: function (args) {
        this.buf = args[1];
        // return -1 to prevent thread break
       //return -1;
    },
    onLeave: function (ret) {
        var what = Memory.readByteArray(this.buf, parseInt(ret));
        // send data to ui (data panel)
        setData(Date.now() + ' recv', what);
    }

});

putBreakpoint(findExport('SSL_read', 'libssl.so'), {
    onEnter: function (args) {
        this.buf = args[1];
        //return -1;
    },
    onLeave: function (ret) {
        var what = Memory.readByteArray(this.buf, parseInt(ret));
        // send data to ui (data panel)
        setData(Date.now() + ' SSL_read', what);
    }
});

// api.hookJava is a global shortcut to hook both java methods and class constructor
if (Java.available) {
    Java.perform(function () {
        var String = Java.use('java.lang.String');

        var mediaType;
        var bodyContent;
        hookJavaMethod('okhttp3.RequestBody.create', function (args) {
            mediaType = args[0];
            bodyContent = args[1];
        });

        hookJavaMethod('okhttp3.Request$Builder.build', function () {
            var a = this.build();
            var s = a + '\n\n' +
                '-=url=-\n' + a.url() + '\n\n' +
                '-=headers=-\n' + a.headers();
            if (a.body() !== null) {
                s += '\n\n' + '-=body=-\n' + mediaType + '\n' + String.$new(bodyContent)
            }
            setData(Date.now() + ' okhttp3.Request', s);
            return a;
        });

        hookJavaMethod('okhttp3.Response$Builder.build', function () {
            var a = this.build();
            var u;
            try {
                var source = a.peekBody(a.body().contentLength());
                var buffer = Java.array('byte', source.bytes());
                u = new Uint8Array(buffer);
            } catch (e) {
                return a;
            }

            var s = a + '\n\n' +
                '-=headers=-\n' + a.headers() + '\n\n' +
                '-=buffer=-\n' + hexdump(u.buffer);
            setData(Date.now() + ' okhttp3.Response', s);
            return a;
        });
    });
}

[iGio90]

why putBreakpoint and -1? just Interceptor.attach(ptr, cb)

[visualsayed]

Hi PinkiePieStyle , Hi iGio90,

I already tried "putBreakpoint" and it works with out error in dwarf UI but it doesn't dump tcp.

Dwarf was a great help in logging called java classes and it turns out that the games use java sockets to send login and register requests to the server so I used the following JS snippet to log IP and Port:

Java.perform(function(){
var target = Java.use("java.net.Socket");

target.$init.overload().implementation = function(){
return this.$init();
};

target.connect.overload('java.net.SocketAddress', 'int').implementation = function(socketAddr, timeout) {
this.connect(socketAddr, timeout);
console.log(socketAddr.toString());
};
});

Using frida it works fine and logged IP/Port while register a new account but How can I log message data such email, password, birthdate so I can creates account programmatcially?

Thanks,
Sayed

[iGio90]

hook OutputStream.write and InputStream.read ?

[visualsayed]

Hi iGio90,

Thanks a lot for your help and effort it is greatly appreciated.

I did hook OutputStream.write and InputStream.read methods using Frida "Objection" but it seems that there is a kind of SSL pinning which could be bypassed using objection "android sslpinning disable" .

Here you are the log after clicking "create account" button on "Account Registration" dialog:

https://pastebin.com/RgspnFDx

Does this ensures that registration process used Java sockets?

Thanks a lot,
Sayed