Should this handle packaged Chromium too? #17
Comments
|
Hi @yoshimo first of all thx for reporting this issue. I'm not sure if we tested friTap against Chrome explicitly and it might that friTap is currently not supporting LIBCEF based applications. |
|
Windows 10 Pro, https://download.battle.net/en-us/?product=bnetdesk |
same here, when attaching to a running chromium process also, friTap fails to spawn chromium friTap --debugoutputnote: the running chromium in gdbstart chromium get the pid of the main process (other processes are renderer processes) attach add breakpoints ... or navigate to some https website watch out for the ssl functions in chromiumboringssl functions in chromium/src/third_party/boringssl/src/ssl/ssl_buffer.cc
boringssl functions in chromium/src/third_party/boringssl/src/ssl/s3_pkt.cc
boringssl functions in chromium/src/third_party/boringssl/src/crypto/bio/bio.c
chromium functions in chromium/src/net/socket/ssl_client_socket_impl.cc
CDP Network.dataReceived event in chromiumthe Network.dataReceived event should be sent Network.streamResourceContent must be called
// ------------- Frontend notifications.
void Frontend::dataReceived(const String& requestId, double timestamp, int dataLength, int encodedDataLength, Maybe<Binary> data)
{
if (!frontend_channel_)
return;
crdtp::ObjectSerializer serializer;
serializer.AddField(crdtp::MakeSpan("requestId"), requestId);
serializer.AddField(crdtp::MakeSpan("timestamp"), timestamp);
serializer.AddField(crdtp::MakeSpan("dataLength"), dataLength);
serializer.AddField(crdtp::MakeSpan("encodedDataLength"), encodedDataLength);
serializer.AddField(crdtp::MakeSpan("data"), data);
frontend_channel_->SendProtocolNotification(crdtp::CreateNotification("Network.dataReceived", serializer.Finish()));
}void InspectorNetworkAgent::DidReceiveData(uint64_t identifier,
DocumentLoader* loader,
const char* data,
uint64_t data_length) {
String request_id = RequestId(loader, identifier);
Maybe<protocol::Binary> binary_data;
if (data) {
NetworkResourcesData::ResourceData const* resource_data =
resources_data_->Data(request_id);
if (resource_data && !resource_data->HasContent() &&
(!resource_data->CachedResource() ||
resource_data->CachedResource()->GetDataBufferingPolicy() ==
kDoNotBufferData ||
IsErrorStatusCode(resource_data->HttpStatusCode())))
resources_data_->MaybeAddResourceData(request_id, data, data_length);
if (streaming_request_ids_.Contains(request_id)) {
binary_data =
protocol::Binary::fromSpan(reinterpret_cast<const uint8_t*>(data),
base::checked_cast<size_t>(data_length));
}
}
GetFrontend()->dataReceived(
request_id, base::TimeTicks::Now().since_origin().InSecondsF(),
static_cast<int>(data_length),
static_cast<int>(
resources_data_->GetAndClearPendingEncodedDataLength(request_id)),
std::move(binary_data));
}i need this for my aiohttp_chromium to support capturing HTTP streams one problem/challenge is that chromium has no dynamic linking to libssl.so or libboringssl.so the naive attempt to hook BIO_read fails Interceptor.attach(Module.getExportByName(null, 'BIO_read'), {
onEnter(args) {
// ...
},
onLeave(retval) {
// ...
},
});fix: use
... but this (hooking functions in the main executable) see also E9Patch Web Browser Guide
considering that chromium is open source, this is ridiculous... see also frida/frida-tools#42 |
|
Hi, thx for providing such detailed information. Currently, friTap can only identify SSL libraries when they are dynamically linked. However, if you know the offsets, you can try to specify them as explained in [1]. For this, use the To identify newly spawned processes with friTap, you can leverage the spawn gating feature of Frida. Simply use the Regarding Chromium support, at present, other issues are prioritized due to the focus being broader than just a single application. However, we're always open to contributions. So, if you have a solution for this issue, please don't hesitate to share it with us :-) [1] https://github.com/fkie-cad/friTap/blob/main/USAGE.md#providing-custom-offsetsaddresses |
|
for the record, i dont need this for now, so im not working on this one problem is that frida is slow, compared to gdb or lldb |
|
Hi, this should be solved in the latest version of friTap (version 1.2.1.0). In order to hook BoringSSL which is statically linked (without symbols) into Cronet we are able to extract the keys by hooking utilizing byte patterns. Right now we developed that mainly for Android but soon we will extend the patterns for other platforms as well. All the best Daniel |
Some applications run LIBCEF, aka Chromium Embedded Framework which in turn is using tls somewhere. Probably boringtls
I tried to attach fritrap on every spawned sub-process (It would be nice if fritap would automatically cover processes that are spawned from the main process as well), including those that seem to connect to the outside world.
The pcap stays empty. So i was wondering if this supposed to work or i am not doing anything wrong?
The text was updated successfully, but these errors were encountered: