安卓 App 逆向课程之四 frida 注入 Okhttp 抓包中篇

// 构造request
Request request = new Request.Builder()
    .url(url) // Hook url()方法，此处只能得到单纯url，不妥
    .header(key, value) // Hook header()方法，一个request会多次调用此方法，会造成干扰，不妥。
    .header(key, value)
    ...
    .build();// Hook build()方法，一个request只可能调用一次，且它是构造完成时调用，不会遗漏信息。

  @Override public Call newCall(Request request) {
    return RealCall.newRealCall(this, request, false /* for web socket */);
  }

Java.perform(function () {
    var OkHttpClient = Java.use("okhttp3.OkHttpClient");

    OkHttpClient.newCall.implementation = function (request) {
        var result = this.newCall(request);
        console.log(request.toString());
        return result；
    };

});

C:UsersLenovo>adb shell
root@OXF-AN10:/ # cd /data/local/tmp
root@OXF-AN10:/data/local/tmp # ./frida-server

C:UsersLenovo>frida -U com.r0ysue.learnokhttp explore -l C:UsersLenovoDesktop抓包teach1.js
     ____
    / _  |   Frida 12.8.14 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://www.frida.re/docs/home/

[OXF AN10::com.r0ysue.learnokhttp]-> 
Request{method=GET, url=http://www.kuaidi100.com/query?type=yuantong&postid=11111111111, tags={}}
Request{method=GET, url=http://www.kuaidi100.com/query?type=yuantong&postid=11111111111, tags={}}
Request{method=GET, url=http://www.kuaidi100.com/query?type=yuantong&postid=11111111111, tags={}}
Request{method=GET, url=http://www.kuaidi100.com/query?type=yuantong&postid=11111111111, tags={}}
Request{method=GET, url=http://www.kuaidi100.com/query?type=yuantong&postid=11111111111, tags={}}

static RealCall newRealCall(OkHttpClient client, Request originalRequest, boolean forWebSocket) {
// Safely publish the Call instance to the EventListener.
RealCall call = new RealCall(client, originalRequest, forWebSocket);
call.eventListener = client.eventListenerFactory().create(call);
return call;
}

Response getResponseWithInterceptorChain() throws IOException {
    // 空的拦截器容器
    List<Interceptor> interceptors = new ArrayList<>();
    // 添加用户自定义的应用拦截器集合(可能0，1或多个)
    interceptors.addAll(client.interceptors());
    // 添加retryAndFollowUpInterceptor拦截器，该拦截器用于取消、失败重试、重定向
    interceptors.add(retryAndFollowUpInterceptor);
    // 添加BridgeInterceptor拦截器，对于Request而言，该拦截器把用户请求转换为 HTTP 请求；对于Resposne，把 HTTP 响应转换为用户友好的响应
    interceptors.add(new BridgeInterceptor(client.cookieJar()));
    // 添加CacheInterceptor拦截器，该拦截器读写缓存、根据策略决定是否使用
    interceptors.add(new CacheInterceptor(client.internalCache()));
    //该拦截器实现和服务器建立连接
    interceptors.add(new ConnectInterceptor(client));
    //如果不是WebSocket请求，添加用户自定义的网络拦截器集合(可能0，1或多个)
    if (!forWebSocket) {
      interceptors.addAll(client.networkInterceptors());
    }
    // 添加真正发起网络请求的Interceptor
    interceptors.add(new CallServerInterceptor(forWebSocket));

    Interceptor.Chain chain = new RealInterceptorChain(interceptors, null, null, null, 0,
        originalRequest, this, eventListener, client.connectTimeoutMillis(),
        client.readTimeoutMillis(), client.writeTimeoutMillis());

    return chain.proceed(originalRequest);
  }
}

package com.r0ysue.learnokhttp;

import android.util.Log;
import java.io.IOException;
import okhttp3.Interceptor;
import okhttp3.Request;
import okhttp3.Response;

class LoggingInterceptor implements Interceptor {

    // TAG即为日志打印时的标签
    private static String TAG = "learnokhttp";

    @Override public Response intercept(Interceptor.Chain chain) throws IOException {

        Request request = chain.request();
        Log.i(TAG, "请求URL："+String.valueOf(request.url())+"n");
        Log.i(TAG, "请求headers："+"n"+String.valueOf(request.headers())+"n");

        Response response = chain.proceed(request);

        return response;
    }

}

// 新建一个Okhttp客户端
// OkHttpClient client = new OkHttpClient();

// 新建一个拦截器
OkHttpClient client = new OkHttpClient.Builder()
        .addNetworkInterceptor(new LoggingInterceptor())
        .build();

OkHttpClient client = new OkHttpClient();

public OkHttpClient() {
   this(new Builder());
 }

public Builder() {
      dispatcher = new Dispatcher();
      protocols = DEFAULT_PROTOCOLS;
      connectionSpecs = DEFAULT_CONNECTION_SPECS;
      eventListenerFactory = EventListener.factory(EventListener.NONE);
      proxySelector = ProxySelector.getDefault();
      cookieJar = CookieJar.NO_COOKIES;
      //...
      //...
      //...
    }
#此即Okhttp默认配置
OkHttpClient(Builder builder) {
    this.dispatcher = builder.dispatcher;
    this.proxy = builder.proxy;
    this.protocols = builder.protocols;
    this.connectionSpecs = builder.connectionSpecs;
    this.interceptors = Util.immutableList(builder.interceptors);
    this.networkInterceptors = Util.immutableList(builder.networkInterceptors);
    this.eventListenerFactory = builder.eventListenerFactory;
    this.proxySelector = builder.proxySelector;
    //...
    //...
    //...
  }

OkHttpClient client = new OkHttpClient.Builder()
    .addNetworkInterceptor(new LoggingInterceptor())
    .build();

// 此为原先的client
OkHttpClient client = new OkHttpClient();

// 基于原先的client创建新的client
OkHttpClient newClient = client.newBuilder()
    .addNetworkInterceptor(new LoggingInterceptor())
    .build();

C:UsersLenovo>objection -g com.r0ysue.learnokhttp explore

C:UsersLenovo>objection -g com.r0ysue.learnokhttp explore


A newer version of objection is available!
You have v1.8.4 and v1.9.2 is ready for download.

Upgrade with: pip3 install objection --upgrade
For more information, please see: https://github.com/sensepost/objection/wiki/Updating

Using USB device `OXF AN10`
Agent injected and responds ok!

     _   _         _   _
 ___| |_|_|___ ___| |_|_|___ ___
| . | . | | -_|  _|  _| | . |   |
|___|___| |___|___|_| |_|___|_|_|
      |___|(object)inject(ion) v1.8.4

     Runtime Mobile Exploration
        by: @leonjza from @sensepost

[tab] for command suggestions
com.r0ysue.learnokhttp on (HUAWEI: 5.1.1) [usb] #

android heap search instances okhttp3.OkHttpClient

com.r0ysue.learnokhttp on (HUAWEI: 5.1.1) [usb] # android heap search instances okhttp3.OkHttpClient
Class instance enumeration complete for [32mokhttp3.OkHttpClient[39m

    if (userRequest.header("Host") == null) {
      requestBuilder.header("Host", hostHeader(userRequest.url(), false));
    }

    if (userRequest.header("Connection") == null) {
      requestBuilder.header("Connection", "Keep-Alive");
    }

    // If we add an "Accept-Encoding: gzip" header field we're responsible for also decompressing
    // the transfer stream.
    boolean transparentGzip = false;
    if (userRequest.header("Accept-Encoding") == null && userRequest.header("Range") == null) {
      transparentGzip = true;
      requestBuilder.header("Accept-Encoding", "gzip");
    }

    List<Cookie> cookies = cookieJar.loadForRequest(userRequest.url());
    if (!cookies.isEmpty()) {
      requestBuilder.header("Cookie", cookieHeader(cookies));
    }

    if (userRequest.header("User-Agent") == null) {
      requestBuilder.header("User-Agent", Version.userAgent());
    }