From b3a6038dc6baeefc0d1e63d1c0368e8902aa13a1 Mon Sep 17 00:00:00 2001 From: Ch0pin Date: Mon, 6 Jul 2020 18:48:40 +0100 Subject: [PATCH] module bug fixes --- .DS_Store | Bin 6148 -> 0 bytes README.md | 5 +++ libraries/__pycache__/defs.cpython-37.pyc | Bin 14938 -> 15050 bytes libraries/defs.py | 30 ++++++++++++++---- libraries/utils.js | 1 + modules/.DS_Store | Bin 14340 -> 14340 bytes modules/compression/gzip_input_stream.med | 6 ++-- modules/db_queries/.DS_Store | Bin 6148 -> 6148 bytes modules/helpers/dynamic_code_loading.med | 4 +-- modules/helpers/translator.med | 9 +++--- modules/scratchpad.med | 23 ++++++++++++++ .../contentProvider.med | 0 12 files changed, 64 insertions(+), 14 deletions(-) delete mode 100644 .DS_Store rename modules/{db_queries => spyware}/contentProvider.med (100%) diff --git a/.DS_Store b/.DS_Store deleted file mode 100644 index 39e0aec7da3d167ae4649216e18cd890929aaf59..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6148 zcmeHKTWb?R6h6~NJDXUIAhZP^7DV(Rlx#1SJP2t_#iCMaihb~s?sk`Eb+Z$aO+$^5 zAowcyB($$y=#&4U3W9$?|A^1^%q4BoMCpTw=p2~&&d!`~Hv65qWB`EV>aGQl1OSSK zV=Ru<0OS3<^x2SV8AT*wj0h&-5!4m~w%!-58?*vifxk@wzIG|tumK)~(6xS@fH~NQ z8v}WPczIu#`1z+Wz5>GW4JG#oo|a)i=2jgQ736iTd7i0r6d%h}a?{OOJzl^o@- zFcuv6wsY6_8pY(fYb=axKlG}C?7JR@++X!Wmo;*%9=bI#PC<51YEYw?oM<+!sVgbd znn|}(X4A4VQz>&UGu>(#bnK#ab#bk{^`!Z<^=w<{1_XCWVP_O}UI55BVV#vL zov^`CWtPt?Md*k9{m)A`_qdJ&#w#=Tn30vzao)UHsD=RxH}Gxz%SNCK3|y#Vp8IkO zyBN_ui;hHh<@I|fuirX(HR1^)aXMl2X116-ukx|#yHRPy3l{=!(+iiXx9rH1iT@4B z?w&yOLUyfQCq$k>rTH1}wt@%tIb-BTk~&ZtsF4V>m{)#0P^9cGPU7iNW2vRV$zs z_>UFf`-6#vV^(2XqS!jH5?27k7&Z$-pWh`o$5fbA*p`SrXhc#GC6%Zv29b1ZH&t9# zVOyf415uX`qTWo@4TXre8x0f~Nln2pM#x J75JkH`~XbI5t9G_ diff --git a/README.md b/README.md index e61fc7f1..23908288 100644 --- a/README.md +++ b/README.md @@ -92,7 +92,12 @@ ApiClient.checkTrustedRecursive.implementation = function(a1, a2, a3, a4, a5, a6 +CREDITS: +- https://github.com/frida/frida + +- https://github.com/dpnishant/appmon +- https://github.com/brompwnie/uitkyk diff --git a/libraries/__pycache__/defs.cpython-37.pyc b/libraries/__pycache__/defs.cpython-37.pyc index cb6cb9e79f7aa0b9d194f596daa3fd5aacd28227..47f66d323a4adc4821aee85905c89cb4ff651902 100644 GIT binary patch delta 749 zcmYk3OK1~87{}+^>~40qO=@F}tuNBlY9FKzTZjpQ))v8*iZ6%;N@<-)i<;2M7SnW= z64yhKLQ991N_`|}MJVy$wWugwJR1;1M2}v)d8qTnBF-{D{`>zP^Qzb%X8mVS#9M9v7Ay9i8h%Pl-5Q zt`rrjl>kVBP;!Y}Cf7)A*j8DB^-;g8EQcL4cYrH$v4CT7vuMydZtYfl zOZ>Mr+oXG3SxHq+#w|*&koI~p5{|Z<%X>pMn+wf{@_Nf)hNj|ISx8<(UNKFE_mQ6w zo8dO`rCSxR!)L@!xPPI&hV{w_JAnuw3W$EhKEy@Dd5Ma4mrdI#wik_730WFMtxF`e zsZ8cpmPMtm=u@c)nqo=+4Y`Ng)9KXs&CG0?vI)$-hlnF=3E^pO=wq%_VUX|DBLx8! zY9Rnt^-~oK3}{dS;FrE3=OLe}_{;BFo&mTb+d2)S<(B-?gm( delta 605 zcmZ9IO=uHA6vyXn_A6S=ojd7z*VzBiCjZr~ki(;jM3Pu-85C)_NEt#%Z<1U)! zAXsRqFH))2ZmtT7T@f!HdhpVl9=&+*rdO|m^P(s^!~A&jfAjt`Z`N;oa$?7$(Fl{H zZyjp;kG_hX&VY?}=6l?fB4tM8n*PdgVq5tRcVU!GT=qf^b3-j?k9nG__zG9M0BmNb ztI4e8>8|dFxYmVfyO*WC%8f2;WOS}>S6NRt-Oz@fQe~W-W#`yMRzLDP7p9XA;}PE1 zQrebh%xrR%1JXVr?G0b!{jUD2xc;`v{u($skG5nfkGZU7aCV**;&{_4r5Z-Y5w|k8 zGvcmnsG)?zf;wwV;s+~_KdfU|$?lGyD41f8l*L{`0_U?^!NeEY^ht4rlpMh!Z25yU zMY9qX$e$XN0Rt8KApwzpW>Qg=WKi1v9AFl|?3jeZ!T4YpU>>WveNYSLasvPla5>+M zEJzPqnYu1Im@jzRJ-NLaJS)5gSj1Yf0*|m;Or{=7`Tuu3lv*SBSX={G!OpHVc!?K= z-oqQ*JnX@0urxes!aMw2y05pXdI6^nHiudiQU_v=&>_&Bg51P1;VEH-;A6VngcSPa bF<8QH9cumr4x5k< diff --git a/libraries/defs.py b/libraries/defs.py index e051a8b6..7cce930e 100644 --- a/libraries/defs.py +++ b/libraries/defs.py @@ -294,16 +294,34 @@ def parse_module(self,mods): hooks.append(header); hooks.append("\n\nJava.perform(function() {") for file in mods: + codeline_found = False + with open(file) as mod: + content = mod.readlines() hooks.append(' try { ') - for line in mod: - if not line.startswith('#'): - hooks.append('\t\t'+line.strip('\n')) - hooks.append(""" } catch (err) { - console.log('Error loading module %s, Error:'+err); - }"""%file) + for i in range(len(content)): + if content[i].startswith('#Code:'): + codeline_found = True + i += 1 + if codeline_found: + hooks.append('\t\t'+content[i].strip('\n')) + # for line in mod: + # if not line.startswith('#Code'): + # continue + # print(line) + # else: + # After_codeline = True + # print(After_codeline) + # if After_codeline == False: + # print(line.strip('\n')) + # hooks.append('\t\t'+line.strip('\n')) + + hooks.append(""" } catch (err) { + console.log('Error loading module %s, Error:'+err); + }"""%file) + hooks.append('});') with open('agent.js','w') as agent: diff --git a/libraries/utils.js b/libraries/utils.js index 39f26353..4bad7861 100644 --- a/libraries/utils.js +++ b/libraries/utils.js @@ -148,6 +148,7 @@ function getContext() { return Java.use('android.app.ActivityThread').currentApplication().getApplicationContext(); } + //---------------CREDITS TO: https://github.com/brompwnie/uitkyk var objectsToLookFor = ["java.net.Socket", "dalvik.system.DexClassLoader", "java.net.URLConnection", "java.net.URL", "java.security.cert.X509Certificate"]; for (var i in objectsToLookFor) { diff --git a/modules/.DS_Store b/modules/.DS_Store index 3a47ca3640e4eece193a008bd167fff48da5f231..a8eeb1293eb1fb6c1ab0209c8b1728df52840e99 100644 GIT binary patch delta 344 zcmZoEXepTB&uFwUU^hRb+~hz(t<7cvu56y{48;ru43!M!42cXy45^+u`N>H+`AG~6 z3<3-cjAlSQ{XZB0MHm>+R40`e7eG~?nrx`nz%5x_ZD?txqhM%gFnPC{++=e_m3lNi zIq8PM$@#ejVDlgZnu^?f7Z<3h9B+2lxgCf+_FWpaU1(&jkTrAz?k@LdA{ delta 71 zcmV-N0J#5zaD;G>PXQ~jP`eKS7n4yDDzi2aMFz7!7|aK;;KTv53m`!QlZ+LFlMfk5 dvl=9X1hLUJ2a(`3vj;Ht1e0+hVY6Q)rUHbC8FBys diff --git a/modules/compression/gzip_input_stream.med b/modules/compression/gzip_input_stream.med index 09386ed1..4f61d0ec 100644 --- a/modules/compression/gzip_input_stream.med +++ b/modules/compression/gzip_input_stream.med @@ -17,7 +17,8 @@ console.log('----------twiter:@Ch0pin-------------------'); var buffer = Java.array('byte', buff); var result = ""; for(var i = 0; i < buffer.length; ++i){ - result+= (String.fromCharCode(buffer[i])); + if(buffer[i] >= 32 && buffer[i]<127) + result+= (String.fromCharCode(buffer[i])); } console.log('[+] Zipped OUTPUT stream: ' + result); @@ -29,7 +30,8 @@ console.log('----------twiter:@Ch0pin-------------------'); var buffer = Java.array('byte', buff); var result = ""; for(var i = 0; i < buffer.length; ++i){ - result+= (String.fromCharCode(buffer[i])); + if(buffer[i] >= 32 && buffer[i]<127) + result+= (String.fromCharCode(buffer[i])); } console.log('[+] Zipped INPUT stream: ' + result); diff --git a/modules/db_queries/.DS_Store b/modules/db_queries/.DS_Store index 0be0682fe4d5a356e88901b591381e6cc7a2c4b6..485f0829e93a227b425800ea9bcc0742bc5f169e 100644 GIT binary patch delta 116 zcmZoMXfc@JFUrKgz`)4BAi%(o%8=rjlb@WFlb;+d15oRpKF1k?dEh#?w?wf}>`W=2Lf_Q?W_hMU "+ string_to_recv) var castTostring = String.$new(string_to_recv); diff --git a/modules/scratchpad.med b/modules/scratchpad.med index 5c9299ad..dc34d56b 100644 --- a/modules/scratchpad.med +++ b/modules/scratchpad.med @@ -4,5 +4,28 @@ console.log('\n--------SCRATCH PAD LOADING-------------------'); +var avos = Java.use('com.avos.avoscloud.AVQuery'); +avos.$init.overload('java.lang.String').implementation = function(a){ + console.log('inside com.avos.avoscloud.AVQuerycom.avos.avoscloud.AVQuerycom.avos.avoscloud.AVQuerycom.avos.avoscloud.AVQuery:' + a); + return this.$init(a); +} + +avos.$init.overload('java.lang.String', 'java.lang.Class').implementation = function(a,b){ + console.log('inside com.avos.avoscloud.AVQuerycom.avos.avoscloud.AVQuerycom.avos.avoscloud.AVQuerycom.avos.avoscloud.AVQuery:' + a); + return this.$init(a,b); + +} +avos.$init.overload().implementation = function(){ + console.log('com.avos.avoscloud.AVQuery'); + return this.$init(); +} + +var getall = Java.use('com.cp5596.Cputil'); + + +getall.getal.implementation = function(p4){ + console.log('0000000000000'); + return this.getal(p4); +} \ No newline at end of file diff --git a/modules/db_queries/contentProvider.med b/modules/spyware/contentProvider.med similarity index 100% rename from modules/db_queries/contentProvider.med rename to modules/spyware/contentProvider.med