网络通讯协议分析

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

import socket
import threading

IP = '0.0.0.0'
PORT = 9999

def main():
    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    server.bind((IP, PORT))
    server.listen(5)
    print(f'[*] Listening on {IP}:{PORT}')

    while True:
        client, address = server.accept()
        print(f'[*] Accepted connection from {address[0]}:{address[1]}')
        client_handler = threading.Thread(target=handle_client, args=(client,))
        client_handler.start()

def handle_client(client_socket):
    with client_socket as sock:
        request = sock.recv(1024)
        print(f'[*] Received: {request.decode("utf-8")}')
        sock.send(b'ACKKK')

if __name__ == '__main__':
    main()

1

<uses-permission android:name="android.permission.INTERNET"/>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

package com.example.luotcp;

import androidx.appcompat.app.AppCompatActivity;

import android.os.Bundle;
import android.util.Log;
import android.widget.TextView;

import com.example.luotcp.databinding.ActivityMainBinding;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.net.Socket;

public class MainActivity extends AppCompatActivity {
    static final String TAG = "XiaLuoHun";

    // Used to load the 'luotcp' library on application startup.
    static {
        System.loadLibrary("luotcp");
    }

    private ActivityMainBinding binding;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        binding = ActivityMainBinding.inflate(getLayoutInflater());
        setContentView(binding.getRoot());

        // Example of a call to a native method
        TextView tv = binding.sampleText;
        tv.setText(stringFromJNI());

        new Thread(new Runnable() {
            @Override
            public void run() {
                try{
                    while (true){
                        DoTcp("10.67.16.180", 9999);
                        Thread.sleep(3000);
                    }
                }
                catch(IOException | InterruptedException e){
                    e.printStackTrace();
                }
            }
        }).start();
    }

    public static void DoTcp(String strIP, int nPort) throws IOException, InterruptedException {
        Socket socket = new Socket(strIP, nPort);
        socket.setSoTimeout(10000);
        //发送数据给服务端
        OutputStream outputStream = socket.getOutputStream();
        outputStream.write("hello,server".getBytes("UTF-8"));
        Thread.sleep(2000);
        socket.shutdownOutput();
        //读取数据
        InputStream in = socket.getInputStream();
        BufferedReader br = new BufferedReader(new InputStreamReader(in));
        String line = br.readLine();
        //打印读取到的数据
        Log.d(TAG, "tcp server recv:" + line);
        br.close();
        socket.close();
    }

    /**
     * A native method that is implemented by the 'luotcp' native library,
     * which is packaged with this application.
     */
    public native String stringFromJNI();
}

1
2
3
4
5
6
7

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/java/java/net/Socket.java
public Socket(String host, int port)
->private Socket(InetAddress[] addresses, int port, SocketAddress localAddr,boolean stream) 

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/java/java/net/InetSocketAddress.java
->public InetSocketAddress(InetAddress addr, int port)
->private InetSocketAddressHolder(String hostname, InetAddress addr, int port)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

function hookSocketInit() {
    var Socket = Java.use('java.net.Socket')
    // Socket.$init.overload('java.lang.String', 'int').implementation = function (host, port) {
    //     console.log('Host:', host, 'Port:', port)
    //     return this.$init(host, port)
    // }

    // Socket.$init.overload('[Ljava.net.InetAddress;', 'int', 'java.net.SocketAddress', 'boolean').implementation = function (addresses, port, localAddr, stream) {
    //     console.log('IP:', addresses[0].toString(), 'Port:', port)
    //     return this.$init(addresses, port, localAddr, stream)
    // }

    var InetSocketAddressHolder = Java.use('java.net.InetSocketAddress$InetSocketAddressHolder')
    InetSocketAddressHolder.$init.overload('java.lang.String', 'java.net.InetAddress', 'int').implementation = function (hostname, addr, port) {
        console.log('IP:', addr.toString(), 'Port:', port)
        //console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
        return this.$init(hostname, addr, port)
    }
}

function hookTcpJava() {
    Java.perform(function () {
        hookSocketInit()
    })
}

setImmediate(hookTcpJava())

1
2

objection.exe -g com.example.luotcp explore
android hooking watch class_method java.net.Socket.getOutputStream --dump-args --dump-return --dump-backtrace

1
2
3
4

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/java/java/net/SocketOutputStream.java
public void write(byte b[])
->private void socketWrite(byte b[], int off, int len)
->private native void socketWrite0(FileDescriptor fd, byte[] b, int off,int len)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

function getAddrInfo(socket, isRead) {
    var src_addr = ''
    var src_port = ''
    var dst_addr = ''
    var dst_port = ''

    if (isRead) {
        src_addr = socket.getRemoteSocketAddress().toString().split(":")[0].split("/").pop()
        src_port = socket.getRemoteSocketAddress().toString().split(":").pop()
        dst_addr = socket.getLocalAddress().toString().split(":")[0].split("/").pop()
        dst_port = socket.getLocalPort().toString()
    } else {
        src_addr = socket.getLocalAddress().toString().split(":")[0].split("/").pop()
        src_port = socket.getLocalPort().toString()
        dst_addr = socket.getRemoteSocketAddress().toString().split(":")[0].split("/").pop()
        dst_port = socket.getRemoteSocketAddress().toString().split(":").pop()
    }

    return src_addr + ':' + src_port + ' --> ' + dst_addr + ':' + dst_port
}

function hookWrite() {
    var SocketOutputStream = Java.use('java.net.SocketOutputStream')
    SocketOutputStream.socketWrite0.implementation = function (fd, b, off, len) {
        //打印数据包的源和目标地址
        var socket = this.socket.value
        var msg = getAddrInfo(socket, false)
        console.log('socketWrite0', msg)

        //打印发包内容
        var bufLen = len
        var ptr = Memory.alloc(bufLen);
        for (var i = 0; i < bufLen; ++i)
            Memory.writeS8(ptr.add(i), b[off + i]);
        console.log(hexdump(ptr, {
            offset: 0,
            length: bufLen,
            header: false,
            ansi: false
        }));

        //打印调用栈
        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

        return this.socketWrite0(fd, b, off, len)
    }
}

function hookTcpJava() {
    Java.perform(function () {
        hookWrite()
    })
}

setImmediate(hookTcpJava())

1
2
3
4
5
6
7
8

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/java/java/io/BufferedReader.java
public String readLine()
->String readLine(boolean ignoreLF)
->private void fill(){
    //---
    in.read(cb, dst, cb.length - dst);
    //---
}

1
2
3
4
5
6

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/java/java/net/SocketInputStream.java
public int read(byte b[])
->public int read(byte b[], int off, int length) 
->int read(byte b[], int off, int length, int timeout)
->private int socketRead(FileDescriptor fd,byte b[], int off, int len,int timeout)
->private native int socketRead0(FileDescriptor fd,byte b[], int off, int len,int timeout)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

function getAddrInfo(socket, isRead) {
    var src_addr = ''
    var src_port = ''
    var dst_addr = ''
    var dst_port = ''

    if (isRead) {
        src_addr = socket.getRemoteSocketAddress().toString().split(":")[0].split("/").pop()
        src_port = socket.getRemoteSocketAddress().toString().split(":").pop()
        dst_addr = socket.getLocalAddress().toString().split(":")[0].split("/").pop()
        dst_port = socket.getLocalPort().toString()
    } else {
        src_addr = socket.getLocalAddress().toString().split(":")[0].split("/").pop()
        src_port = socket.getLocalPort().toString()
        dst_addr = socket.getRemoteSocketAddress().toString().split(":")[0].split("/").pop()
        dst_port = socket.getRemoteSocketAddress().toString().split(":").pop()
    }

    return src_addr + ':' + src_port + ' --> ' + dst_addr + ':' + dst_port
}

function hookRead() {
    var SocketInputStream = Java.use('java.net.SocketInputStream')
    SocketInputStream.socketRead0.implementation = function (fd, b, off, len, timeout) {
        var result = this.socketRead0(fd, b, off, len, timeout);
        if (result > 0) {
            //打印数据包的源和目标地址
            var socket = this.socket.value
            var msg = getAddrInfo(socket, true)
            console.log('socketRead0', msg)

            //打印收包内容
            var ptr = Memory.alloc(result);
            for (var i = 0; i < result; ++i)
                Memory.writeS8(ptr.add(i), b[off + i]);
            console.log(hexdump(ptr, {
                offset: 0,
                length: result,
                header: false,
                ansi: false
            }));

            //打印调用栈
            console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
        }
        return result
    }
}

function hookTcpJava() {
    Java.perform(function () {
        hookRead()
    })
}

setImmediate(hookTcpJava())

1
2
3
4
5
6
7
8

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/java/java/net/SocketOutputStream.java
private native void socketWrite0(FileDescriptor fd, byte[] b, int off,int len)

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/native/SocketOutputStream.c
SocketOutputStream_socketWrite0(JNIEnv *env, jobject this,jobject fdObj,jbyteArray data,jint off, jint len)

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/native/linux_close.cpp
->int NET_Send(int s, void *msg, int len, unsigned int flags)

1
2
3

adb shell
su
grep -ril NET_Send /system/lib64/*

1

adb pull /system/lib64/libopenjdk.so

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

function getAddrInfo(sockfd, isRecv) {
    var message = {}
    var src_dst = ["src", "dst"]
    for (var i = 0; i < src_dst.length; i++) {
        if ((src_dst[i] == "src") ^ isRecv) {
            var sockAddr = Socket.localAddress(sockfd)
        } else {
            var sockAddr = Socket.peerAddress(sockfd)
        }
        if (sockAddr == null) {
            // 网络超时or其他原因可能导致socket被关闭
            message[src_dst[i] + "_port"] = 0
            message[src_dst[i] + "_addr"] = 0
        } else {
            message[src_dst[i] + "_port"] = (sockAddr.port & 0xFFFF)
            message[src_dst[i] + "_addr"] = sockAddr.ip.split(":").pop()
        }
    }
    return message['src_addr'] + ':' + message['src_port'] + ' --> ' + message['dst_addr'] + ':' + message['dst_port']
}

function hookJniSend() {
    var sendto = Module.getExportByName("libc.so", "sendto");
    Interceptor.attach(sendto, {
        onEnter: function (args) {
            //打印数据包的源和目标地址
            var sockfd = args[0].toInt32()
            var msg = getAddrInfo(sockfd, false)
            console.log('sendto', msg)

            //打印发包内容
            var buf = ptr(args[1]).readCString();
            var len = args[2].toInt32();
            console.log(hexdump(args[1], {
                length: len
            }))

            //打印调用栈
            console.log('sendto called from:\n' +
                Thread.backtrace(this.context, Backtracer.FUZZY)
                .map(DebugSymbol.fromAddress).join('\n') + '\n')
        },
        onLeave: function (retval) {}
    })
}

function hookTcpJni() {
    /hookJniSend()
}

setImmediate(hookTcpJni())

1
2
3
4
5
6
7
8

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/java/java/net/SocketInputStream.java
private native int socketRead0(FileDescriptor fd,byte b[], int off, int len,int timeout)

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/native/SocketInputStream.c
SocketInputStream_socketRead0(JNIEnv *env, jobject this,jobject fdObj, jbyteArray data,jint off, jint len, jint timeout)
 
//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/native/linux_close.cpp
->int NET_Read(int s, void* buf, size_t len)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

function getAddrInfo(sockfd, isRecv) {
    var message = {}
    var src_dst = ["src", "dst"]
    for (var i = 0; i < src_dst.length; i++) {
        if ((src_dst[i] == "src") ^ isRecv) {
            var sockAddr = Socket.localAddress(sockfd)
        } else {
            var sockAddr = Socket.peerAddress(sockfd)
        }
        if (sockAddr == null) {
            // 网络超时or其他原因可能导致socket被关闭
            message[src_dst[i] + "_port"] = 0
            message[src_dst[i] + "_addr"] = 0
        } else {
            message[src_dst[i] + "_port"] = (sockAddr.port & 0xFFFF)
            message[src_dst[i] + "_addr"] = sockAddr.ip.split(":").pop()
        }
    }
    return message['src_addr'] + ':' + message['src_port'] + ' --> ' + message['dst_addr'] + ':' + message['dst_port']
}

function hookJniRecv() {
    var recvfrom = Module.getExportByName("libc.so", "recvfrom");
    Interceptor.attach(recvfrom, {
        onEnter: function (args) {
            this.fd = args[0];
            this.buff = args[1];
            this.size = args[2];
        },
        onLeave: function (retval) {
            var type = Socket.type(this.fd.toInt32());
            if (retval > 0 && type != null && type != 'unix:stream') {
                //打印数据包的源和目标地址
                var sockfd = this.fd.toInt32()
                var msg = getAddrInfo(sockfd, true)
                console.log('recvfrom', msg)

                //打印收包内容
                console.log(hexdump(this.buff, {
                    length: retval.toInt32()
                }))

                //打印调用栈
                console.log('recvfrom called from:\n' +
                    Thread.backtrace(this.context, Backtracer.FUZZY)
                    .map(DebugSymbol.fromAddress).join('\n') + '\n')
            }
        }
    })
}

function hookTcpJni() {
    hookJniRecv()
}

setImmediate(hookTcpJni())

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

import socket
import threading

IP = '0.0.0.0'
PORT = 9997

def main():
    server = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    server.bind((IP, PORT))
    print(f'[*] bind on {IP}:{PORT}')

    while True:
        data, address = server.recvfrom(1024)
        print(f'[*] recvfrom connection from {address[0]}:{address[1]}')
        print(f'[*] Received: {data.decode("utf-8")}')
        server.sendto(b'ACKKK', address)

if __name__ == '__main__':
    main()

1

<uses-permission android:name="android.permission.INTERNET"/>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74

package com.example.luoudp;

import androidx.appcompat.app.AppCompatActivity;

import android.os.Bundle;
import android.util.Log;
import android.widget.TextView;

import com.example.luoudp.databinding.ActivityMainBinding;

import java.io.IOException;
import java.net.DatagramPacket;
import java.net.DatagramSocket;
import java.net.InetAddress;
import java.nio.charset.StandardCharsets;

public class MainActivity extends AppCompatActivity {
    static final String TAG = "XiaLuoHun";

    // Used to load the 'luoudp' library on application startup.
    static {
        System.loadLibrary("luoudp");
    }

    private ActivityMainBinding binding;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        binding = ActivityMainBinding.inflate(getLayoutInflater());
        setContentView(binding.getRoot());

        // Example of a call to a native method
        TextView tv = binding.sampleText;
        tv.setText(stringFromJNI());

        new Thread(new Runnable() {
            @Override
            public void run() {
                try{
                    while (true){
                        DoUdp("10.67.16.180", 9997);
                        Thread.sleep(3000);
                    }
                }
                catch(IOException | InterruptedException e){
                    e.printStackTrace();
                }
            }
        }).start();
    }

    public static void DoUdp(String strIP, int nPort) throws IOException {
        DatagramSocket socket = new DatagramSocket();
        //发送数据
        DatagramPacket outPacket = new DatagramPacket(new byte[0], 0, InetAddress.getByName(strIP), nPort);
        outPacket.setData("hello,server".getBytes(StandardCharsets.UTF_8));
        socket.send(outPacket);

        //接收数据
        byte[] inBuff = new byte[4096];
        DatagramPacket inPacket = new DatagramPacket(inBuff, inBuff.length);
        socket.receive(inPacket);
        //打印读取到的数据
        Log.d(TAG, new String(inBuff, 0, inPacket.getLength()));
    }

    /**
     * A native method that is implemented by the 'luoudp' native library,
     * which is packaged with this application.
     */
    public native String stringFromJNI();
}

1
2
3
4
5

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/java/java/net/DatagramPacket.java
public DatagramPacket(byte buf[], int offset, int length,InetAddress address, int port)
->public synchronized void setAddress(InetAddress iaddr)
public synchronized void setPort(int iport)
//发现IP和Port最终在DatagramPacket的address和Port变量中存储

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

function hookDatagramPacketInit() {
    var DatagramPacket = Java.use('java.net.DatagramPacket')
    DatagramPacket.$init.overload('[B', 'int', 'java.net.InetAddress', 'int').implementation = function (buf, length, address, port) {
        console.log('IP:', address.toString(), 'Port:', port)
        var result = this.$init(buf, length, address, port)
        //console.log('IP:', this.address.value.toString(), 'Port:', this.port.value)
        return result
    }
}

function hookUdpJava() {
    Java.perform(function () {
        hookDatagramPacketInit()
    })
}

setImmediate(hookUdpJava())

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/java/java/net/DatagramSocket.java
public void send(DatagramPacket p){
    //---
    //这里发现调用了一个抽象类的send方法,通过动态调试看堆栈调用,可以确定其具体实现类为PlainDatagramSocketImpl
    getImpl().send(p);
    //---
}

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/java/java/net/PlainDatagramSocketImpl.java
->protected void send(DatagramPacket p)

//http://androidxref.com/8.1.0_r33/xref/libcore/luni/src/main/java/libcore/io/IoBridge.java
->public static int sendto(FileDescriptor fd, byte[] bytes, int byteOffset, int byteCount, int flags, InetAddress inetAddress, int port)

//http://androidxref.com/8.1.0_r33/xref/libcore/luni/src/main/java/libcore/io/Linux.java
->public int sendto(FileDescriptor fd, byte[] bytes, int byteOffset, int byteCount, int flags, InetAddress inetAddress, int port)

->private native int sendtoBytes(FileDescriptor fd, Object buffer, int byteOffset, int byteCount, int flags, InetAddress inetAddress, int port)
private native int sendtoBytes(FileDescriptor fd, Object buffer, int byteOffset, int byteCount, int flags, SocketAddress address)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

function hookUdpSend() {
    var linux = Java.use("libcore.io.Linux")
    linux.sendtoBytes.overload('java.io.FileDescriptor', 'java.lang.Object', 'int', 'int', 'int', 'java.net.InetAddress', 'int').implementation = function (fd, byteAry, byteOffset, byteCount, flags, inetAddress, port) {
        //打印数据包的源和目标地址
        var sockname = this.getsockname(fd)
        //console.log('sockname', JSON.stringify(sockname))
        var InetSocketAddressObj = Java.cast(sockname, Java.use("java.net.InetSocketAddress"))
        var src_addr = InetSocketAddressObj.holder.value.addr.value.toString()
        var src_port = InetSocketAddressObj.holder.value.port.value
        var dst_addr = inetAddress.toString()
        var dst_port = port
        var msg = src_addr + ':' + src_port + ' --> ' + dst_addr + ':' + dst_port
        console.log('sendtoBytes', msg)

        //打印发包内容
        var b = Java.array("byte", byteAry);
        var bufLen = byteCount
        var ptr = Memory.alloc(bufLen);
        for (var i = 0; i < bufLen; ++i)
            Memory.writeS8(ptr.add(i), b[byteOffset + i]);
        console.log(hexdump(ptr, {
            offset: 0,
            length: bufLen,
            header: false,
            ansi: false
        }));

        //打印调用栈
        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()))
        return this.sendtoBytes(fd, byteAry, byteOffset, byteCount, flags, inetAddress, port)
    }

    linux.sendtoBytes.overload('java.io.FileDescriptor', 'java.lang.Object', 'int', 'int', 'int', 'java.net.SocketAddress').implementation = function (fd, byteAry, byteOffset, byteCount, flags, address) {
        return this.sendtoBytes(fd, byteAry, byteOffset, byteCount, flags, address);
    }
}

function hookUdpJava() {
    Java.perform(function () {
        //hookDatagramPacketInit()
        hookUdpSend()
    })
}

setImmediate(hookUdpJava())

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/java/java/net/DatagramSocket.java
public synchronized void receive(DatagramPacket p){
    //---
    //这里发现调用了一个抽象类的receive方法,通过动态调试看堆栈调用,可以确定其具体实现类为PlainDatagramSocketImpl
     getImpl().receive(p);
    //---
}
//http://androidxref.com/8.1.0_r33/xref/libcore/ojluni/src/main/java/java/net/PlainDatagramSocketImpl.java
protected synchronized void receive0(DatagramPacket p)
->private void doRecv(DatagramPacket p, int flags)

//http://androidxref.com/8.1.0_r33/xref/libcore/luni/src/main/java/libcore/io/IoBridge.java
->public static int recvfrom(boolean isRead, FileDescriptor fd, byte[] bytes, int byteOffset, int byteCount, int flags, DatagramPacket packet, boolean isConnected)
 
//http://androidxref.com/8.1.0_r33/xref/libcore/luni/src/main/java/libcore/io/Linux.java    
->public int recvfrom(FileDescriptor fd, byte[] bytes, int byteOffset, int byteCount, int flags, InetSocketAddress srcAddress)

->private native int recvfromBytes(FileDescriptor fd, Object buffer, int byteOffset, int byteCount, int flags, InetSocketAddress srcAddress)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

function hookUdpRecv() {
    var linux = Java.use("libcore.io.Linux")
    linux.recvfromBytes.implementation = function (fd, buffer, byteOffset, byteCount, flags, srcAddress) {
        var result = this.recvfromBytes(fd, buffer, byteOffset, byteCount, flags, srcAddress)
        //打印数据包的源和目标地址
        var src_addr = srcAddress.holder.value.addr.value.toString()
        var src_port = srcAddress.holder.value.port.value
        var sockname = this.getsockname(fd)
        //console.log('sockname', JSON.stringify(sockname))
        var InetSocketAddressObj = Java.cast(sockname, Java.use("java.net.InetSocketAddress"))
        var dst_addr = InetSocketAddressObj.holder.value.addr.value.toString()
        var dst_port = InetSocketAddressObj.holder.value.port.value
        var msg = src_addr + ':' + src_port + ' --> ' + dst_addr + ':' + dst_port
        console.log('recvfromBytes', msg)

        //打印收包内容
        var b = Java.array("byte", buffer);
        var ptr = Memory.alloc(result);
        for (var i = 0; i < result; ++i)
            Memory.writeS8(ptr.add(i), b[byteOffset + i]);
        console.log(hexdump(ptr, {
            offset: 0,
            length: result,
            header: false,
            ansi: false
        }));

        //打印调用栈
        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()))
        return result
    }
}

function hookUdpJava() {
    Java.perform(function () {
        hookUdpRecv()
    })
}

setImmediate(hookUdpJava())

1
2

//http://androidxref.com/8.1.0_r33/xref/libcore/luni/src/main/native/libcore_io_Linux.cpp
static jint Linux_sendtoBytes(JNIEnv* env, jobject, jobject javaFd, jobject javaBytes, jint byteOffset, jint byteCount, jint flags, jobject javaInetAddress, jint port)

1
2
3

adb shell
su
grep -ril Linux_sendtoBytes /system/lib64/*

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

//http://androidxref.com/8.1.0_r33/xref/libcore/luni/src/main/native/libcore_io_Linux.cpp
extern "C" JNIEXPORT jint Linux_sendtoBytes1(JNIEnv* env, jobject, jobject javaFd, jobject javaBytes, jint byteOffset, jint byteCount, jint flags, jobject javaInetAddress, jint port) {
    ScopedBytesRO bytes(env, javaBytes);
    if (bytes.get() == NULL) {
        return -1;
    }

    return NET_IPV4_FALLBACK(env, ssize_t, sendto, javaFd, javaInetAddress, port,
                             NULL_ADDR_OK, bytes.get() + byteOffset, byteCount, flags);
}

1
2
3
4
5

//http://androidxref.com/8.1.0_r33/xref/libcore/luni/src/main/native/NetworkUtilities.cpp
bool inetAddressToSockaddr(JNIEnv* env, jobject inetAddress, int port, sockaddr_storage& ss, socklen_t& sa_len) {
    return inetAddressToSockaddr(env, inetAddress, port, ss, sa_len, true);
}
->static bool inetAddressToSockaddr(JNIEnv* env, jobject inetAddress, int port, sockaddr_storage& ss, socklen_t& sa_len, bool map)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

//大小为16
struct sockaddr_in
{
 uint16 sin_family;          /* Address family AF_INET */ 
 uint16 sin_port;            /* Port number.  */
 uint32 sin_addr.s_addr;     /* Internet address.  */
 unsigned char sin_zero[8];  /* Pad to size of `struct sockaddr'.  */
};

//大小为28
struct sockaddr_in6
{
 uint16 sin6_family;         /* Address family AF_INET6 */
 uint16 sin6_port;           /* Transport layer port # */
 uint32 sin6_flowinfo;       /* IPv6 flow information */
 uint8  sin6_addr[16];       /* IPv6 address */
 uint32 sin6_scope_id;       /* IPv6 scope-id */
};

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

function hookJniSend() {
    var sendto = Module.getExportByName("libc.so", "sendto");
    Interceptor.attach(sendto, {
        onEnter: function (args) {
            var fd = args[0].toInt32()
            var buf = args[1]
            var n = args[2]
            var flags = args[3]
            var addr = args[4]
            var addr_len = args[5].toInt32()

            //打印Udp sendto的后两个参数
            // console.log(hexdump(addr, {
            //     length: addr_len
            // }))
            // console.log('len', addr_len)

            //打印数据包的源和目标地址
            var sockfd = fd
            var sockAddr = Socket.localAddress(sockfd)
            var src_addr = sockAddr.ip.split(":").pop()
            var src_port = (sockAddr.port & 0xFFFF)

            //解析sockaddr_in6结构
            var ipbase = ptr(addr).add(0x14);
            var dst_addr = ipbase.readU8() + "." + ipbase.add(1).readU8() + "." + ipbase.add(2).readU8() + "." + ipbase.add(3).readU8()
            var port_high = ptr(addr).add(2).readU8();
            var port_low = ptr(addr).add(3).readU8();
            var dst_port = port_high * 0x100 + port_low;

            var msg = src_addr + ':' + src_port + ' --> ' + dst_addr + ':' + dst_port
            console.log('sendto', msg)

            //打印发包内容
            var len = args[2].toInt32();
            console.log(hexdump(buf, {
                length: len
            }))

            //打印调用栈
            console.log('sendto called from:\n' +
                Thread.backtrace(this.context, Backtracer.FUZZY)
                .map(DebugSymbol.fromAddress).join('\n') + '\n')
        },
        onLeave: function (retval) {}
    })
}

function hookUdpJni() {
    hookJniSend()
}

setImmediate(hookUdpJni())

1
2

//http://androidxref.com/8.1.0_r33/xref/libcore/luni/src/main/native/libcore_io_Linux.cpp
static jint Linux_recvfromBytes(JNIEnv* env, jobject, jobject javaFd, jobject javaBytes, jint byteOffset, jint byteCount, jint flags, jobject javaInetSocketAddress)