Frida, hook OKHttp Library does not work with examples - frida

I'm trying to hook functions of the OKHttp library by using then following Frida script:
setTimeout(function(){
Java.perform(function (){
console.log("-- Hook OKHttp library --");
try {
var Builder = Java.use('okhttp3.CertificatePinner$Builder');
var Pin = Java.use('okhttp3.CertificatePinner$Pin');
var OkHttpClient = Java.use('okhttp3.OkHttpClient$Builder');
console.log("OkHTTP classes found");
Builder.add.overload.implementation = function(a, b) {
console.log("TEST ADD");
}
Pin.matches.overload.implementation = function (a) {
console.log("TEST matches")
return true;
}
OkHttpClient.certificatePinner.overload.implementation = function (a) {
console.log("TEST certificatePinner");
}
console.log("OkHTTP functions found");
} catch (err) {
// If we dont have a ClassNotFoundException exception, raise the
// problem encountered.
console.log("OkHTTP 3.x classes/functions not Found");
}
});
},0);
And I am executing the following code in my Android application:
CertificatePinner certificatePinner = new CertificatePinner.Builder()
.add(certificateDNWildcard, certificateHash)
.build();
//Create http client with pinned certificate
OkHttpClient okHttpClient = new OkHttpClient.Builder()
.certificatePinner(certificatePinner)
.build();
As you can see I am calling the function .add(certificateDNWildcard, certificateHash) which I am trying to hook. However, nothing is printed in the terminal when I execute this function. Furthermore, the output of my terminal is:
-- Hook OKHttp library --
OkHTTP classes found
OkHTTP functions found
Hence, it does find the classes and functions; however, the hook itself does not work effectively. Could someone help me?
I am using:
* Frida 12.8.11
* Android 10
* ARM64

You should either:
// works if add method has a single implementation
Builder.add.implementation = function(a, b) {
console.log("TEST ADD");
}
or
// always works
Builder.add.overload('java.lang.String', 'java.lang.String').implementation = function(a, b) {
console.log("TEST ADD");
}

Related

Hyperledger Composer with javascript

I am a beginner with hyperledger composer. I want to retrieve data from server such as AJAX that use it in javascript file of hyperledger composer.
How can I achieve it?
below, it is example from w3school that I use in script file of hyperledger composer.
/**
* Sample transaction processor function.
* #param {org.acme.sample.SampleTransaction} tx The sample transaction instance.
* #transaction
*/
function sampleTransaction(tx) {
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
document.getElementById("demo").innerHTML = this.responseText;
}
};
xhttp.open("GET", "ajax_info.txt", true);
xhttp.send();
}
you can use call-outs in Composer transaction functions. But remember with smart contract transactions, all peers executing the transaction logic must return a deterministic result - else your transaction will fail to be endorsed (you probably knew that, just saying)
See more details and examples here -> https://hyperledger.github.io/composer/latest/integrating/call-out
function handlePost(postTransaction) {
var url = 'https://composer-node-red.mybluemix.net/compute';
// call-out
return post( url, postTransaction)
.then(function (result) {
// alert(JSON.stringify(result));
postTransaction.asset.value = 'Count is ' + result.body.sum;
// now update an Asset Registry (Composer)
return getAssetRegistry('org.example.sample.SampleAsset')
.then(function (assetRegistry) {
return assetRegistry.update(postTransaction.asset);
});
});
}

Error with breeze 1.4.11 and IE8

Trying to download data with breeze 1.4.11 and IE8 throws the following exception:
Unable to either parse or import metadata: getters & setters can not be defined on this javascript engine
The error is caused by line 173 of b00_breeze.modelLibrary.backingStore.js
Created a GitHub repo to reproduce the bug.
Breeze uses the ViewModel of the hosting MVVM framework. That’s generally a good decision. Additionally, change tracking on entities is a fundamental concept of breeze.js (same for Entity Framework). It’s an easy task to track changes if the MVVM framework uses Observables with real getter and setters (e.g. Knockout). AngularJS on the other hands works with plain JavaScript objects. This makes change tracking difficulty. The only two reliable ways are ES5-properties (simple, but not supported by IE8) or a very deep integration in the $digest cycle. The breeze-team took the first-choice - what a pity for projects that have to support IE8!
Ok, let's analyze the root cause of the problem: change tracking
Do you really need that feature? At least in our project we decided for breeze.js/OData for reading and for a more "restful" approach when it comes to writing. If you don’t need those advanced features, than the following script should solve the issue:
/********************************************************
* A replacement for the "backingStore" modelLibrary
*
* This is a bare version of the original backingStore,
* without ANY change tracking - that's why it will work in IE8!
* (Object.defineProperty not required any more)
*
* This adapter is a "drop in" replacement for the "backingStore" adapter in Breeze core.
* It has the same adapter name so it will silently replace the original "backingStore" adapter
* when you load this script AFTER the breeze library.
* WARNING: For obvious reasons a lot of breeze magic will be lost!
*
* Author: Johannes Hoppe / haushoppe-its.de
*
* Copyright 2014 IdeaBlade, Inc. All Rights Reserved.
* Use, reproduction, distribution, and modification of this code is subject to the terms and
* conditions of the IdeaBlade Breeze license, available at http://www.breezejs.com/license
******************************************************/
(function (definition, window) {
if (window.breeze) {
definition(window.breeze);
} else if (typeof require === "function" && typeof exports === "object" && typeof module === "object") {
// CommonJS or Node
var b = require('breeze');
definition(b);
} else if (typeof define === "function" && define["amd"] && !window.breeze) {
// Requirejs / AMD
define(['breeze'], definition);
} else {
throw new Error("Can't find breeze");
}
}(function (breeze) {
"use strict";
var core = breeze.core;
var ctor = function () {
this.name = "backingStore";
this.A_BIG_FAT_WARNING = "This is a bare version of the backingStore! Change tracking won't work!";
};
var protoFn = ctor.prototype;
protoFn.initialize = function() {
};
protoFn.getTrackablePropertyNames = function (entity) {
var names = [];
for (var p in entity) {
if (p === "entityType") continue;
if (p === "_$typeName") continue;
var val = entity[p];
if (!core.isFunction(val)) {
names.push(p);
}
}
return names;
};
protoFn.initializeEntityPrototype = function (proto) {
proto.getProperty = function (propertyName) {
return this[propertyName];
};
proto.setProperty = function (propertyName, value) {
this[propertyName] = value;
return this;
};
};
// This method is called when an EntityAspect is first created - this will occur as part of the entityType.createEntity call.
// which can be called either directly or via standard query materialization
// entity is either an entity or a complexObject
protoFn.startTracking = function (entity, proto) {
// assign default values to the entity
var stype = entity.entityType || entity.complexType;
stype.getProperties().forEach(function (prop) {
var propName = prop.name;
var val = entity[propName];
if (prop.isDataProperty) {
if (prop.isComplexProperty) {
if (prop.isScalar) {
val = prop.dataType._createInstanceCore(entity, prop);
} else {
val = breeze.makeComplexArray([], entity, prop);
}
} else if (!prop.isScalar) {
val = breeze.makePrimitiveArray([], entity, prop);
} else if (val === undefined) {
val = prop.defaultValue;
}
} else if (prop.isNavigationProperty) {
if (val !== undefined) {
throw new Error("Cannot assign a navigation property in an entity ctor.: " + prop.Name);
}
if (prop.isScalar) {
// TODO: change this to nullstob later.
val = null;
} else {
val = breeze.makeRelationArray([], entity, prop);
}
} else {
throw new Error("unknown property: " + propName);
}
entity[propName] = val;
});
};
breeze.config.registerAdapter("modelLibrary", ctor);
}, this));
Download at: https://gist.github.com/JohannesHoppe/72d7916aeb08897bd256
This is a bare version of the original backingStore, without ANY change tracking - that's why it will work in IE8! (Object.defineProperty not required any more) This adapter is a "drop in" replacement for the "backingStore" adapter in Breeze core. It has the same adapter name so it will silently replace the original "backingStore" adapter when you load the script AFTER the breeze library.
Here is a demo to proof the functionality:
http://jsfiddle.net/Johannes_Hoppe/bcav9hzL/5/
JsFiddle does not support IE8, please use this direct link:
http://jsfiddle.net/Johannes_Hoppe/bcav9hzL/5/embedded/result/
Cheers!
The Breeze 'backingStore' model library is explicitly not supported in IE8. This is because the 'backingStore' implementation requires the full javascript 'Object.defineProperty' capability which is not available in IE8 and cannot be provided by any shim.
That said, the breeze 'knockout' and 'backbone' model library adapters should both work with IE8.
Also see: http://www.breezejs.com/documentation/prerequisites

Common way to execute a stored proc from both ColdFusion and Railo

I think I've gotten the most simplest scenario built. I just want to pass it by everyone for a sanity check. Here's the idea:
GetErrorCodes.cfm does the following:
<cfscript>
response = new ErrorCodes().WhereXXX(); // ACF or Railo, doesn't matter
</cfscript>
ErrorCodes.cfc:
function WhereXXX() {
return new sproc().exec('app.GetErrorCodes'); // All my functions will do this instead of executing the sproc themselves.
}
sproc.cfc:
component {
function exec(procedure) {
local.result = {};
if (server.ColdFusion.productname == 'Railo') {
return new Railo().exec(arguments.procedure); // Has to be outside of sproc.cfc because ColdFusion throws a syntax error otherwise.
}
local.svc = new storedProc();
local.svc.setProcedure(arguments.procedure);
local.svc.addProcResult(name='qry');
try {
local.obj = local.svc.execute();
local.result.Prefix = local.obj.getPrefix();
local.result.qry = local.obj.getProcResultSets().qry;
} catch(any Exception) {
request.msg = Exception.Detail;
}
return local.result;
}
Railo.cfc:
component {
function exec(procedure) {
local.result = {};
try {
storedproc procedure=arguments.procedure result="local.result.Prefix" returncode="yes" {
procresult name="local.result.qry";
}
} catch(any Exception) {
request.msg = Exception.Message;
}
return local.result;
}
}
So I've been working on this all day, but tell me, is this a sane way to keep the source code the same if it's to be run on either a ColdFusion server or a Railo server?
Um... just use <cfstoredproc> instead of trying to use two different CFScript approaches that are mutually exclusive to each other of the CFML platforms.

Firefox lightweight-theme-list-change event not sent?

I have a FF extension that I want notified when the lightweight theme list is changed. Here's the code:
var PesonaSwitcherObserver = {
register: function() {
PersonaSwitcher.log ("in register");
var observerService =
Components.classes["#mozilla.org/observer-service;1"]
.getService(Components.interfaces.nsIObserverService);
observerService.addObserver(PesonaSwitcherObserver,
"lightweight-theme-list-change", false);
},
observe: function (subject, topic, data) {
PersonaSwitcher.log ("in observe");
switch (topic) {
case 'lightweight-theme-list-change':
PersonaSwitcher.subMenu();
break;
}
},
unregister: function() {
PersonaSwitcher.log ("in unregister");
var observerService =
Components.classes["#mozilla.org/observer-service;1"]
.getService(Components.interfaces.nsIObserverService);
observerService.removeObserver(PesonaSwitcherObserver,
"lightweight-theme-list-change");
}
}
window.addEventListener("load", PesonaSwitcherObserver.register, false);
window.addEventListener("unload", PesonaSwitcherObserver.unregister, false);
The log receives the "in register", but no "in observes" when I add or remove personas. I've even looked at LightweightThemeManager.jsm and
function _updateUsedThemes(aList) {
calls
Services.obs.notifyObservers(null, "lightweight-theme-list-changed", null);
Anyone know why or have a hint?
I guess that the call to observerService.addObserver() fails - please check the Error Console (press Ctrl-Shift-J to open it). Your observer doesn't implement QueryInterface function and the observer service will explicitly check whether nsIObserver is implemented. This function is easiest to implement using XPCOMUtils.jsm. If you don't want to import it into the global scope (you probably don't since your code seems to run from an overlay) you can do it like this:
var PesonaSwitcherObserver = {
QueryInterface: Components.utils.import("resource://gre/modules/XPCOMUtils.jsm", null)
.XPCOMUtils
.generateQI([Components.interfaces.nsIObserver]),
...

Firefox extension observing response

I am trying using code
// This is an active module of the goelvivek (8) Add-on
exports.main = function() {
var httpRequestObserver =
{
observe: function(subject, topic, data)
{
if (topic == "http-on-examine-response") {
if(console)
console.log(data);
}
}
};
var {Cc, Ci, Cr} = require("chrome");
var observer = require("observer-service");
observerService = Components.classes["#mozilla.org/observer-service;1"].
getService(Components.interfaces.nsIObserverService);
observerService.addObserver(httpRequestObserver, "http-on-examine-response", false);
};
but line console.log(data); is not printing any thing in console log. why ?
In addition to the issue noted by Nickolay, an observer needs to implement a QueryInterface() function (typically by means of XPCOMUtils.generateQI()). Here is how one would do it with the Add-on SDK:
var {Cc, Ci, Cr, Cu} = require("chrome");
var {XPCOMUtils} = Cu.import("resource://gre/modules/XPCOMUtils.jsm");
var httpRequestObserver =
{
QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver, Ci.nsISupportsWeakReference]),
...
};
However, since you already require observer-service package, it would be easier to use it:
var observer = require("observer-service");
observer.add("http-on-examine-response", onHttpRequest);
function onHttpRequest(subject, data)
{
...
}
The downside of this approach is that observer-service is an internal package and its API might change in future Add-on SDK versions.
Is it the real snippet? You should see an error about Components being undefined in the Error Console. Either get it from require('chrome') or use the object from require("observer-service").

Resources