dasemu/adif-api-reverse-engineering
0
0
Fork 0
Code Issues Pull Requests Activity

Agregados varios //TODO para revisar

Browse Source
This commit is contained in:
Darío Sevilla
2025-12-04 21:22:05 +01:00
parent e0133d2ca2
commit ec57ac366d
9 changed files with 837 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files

154
frida_scripts/frida_capture_request_body.js
View File

@@ -1,36 +1,77 @@
/**
* Capture REQUEST BODY using writeTo() method
* Capture REQUEST BODY by hooking MoshiRequestBodyConverter
*/
console.log("\n[*] Capturing REQUEST Bodies\n");
console.log("\n[*] Capturing REQUEST Bodies via MoshiRequestBodyConverter\n");
Java.perform(function() {
// Hook MoshiRequestBodyConverter.convert() directly
try {
var MoshiRequestBodyConverter = Java.use("retrofit2.converter.moshi.MoshiRequestBodyConverter");
console.log("[+] Found MoshiRequestBodyConverter");
var convertOriginal = MoshiRequestBodyConverter.convert.overload('java.lang.Object');
convertOriginal.implementation = function(obj) {
// BEFORE calling original, serialize the object ourselves to capture it
try {
// Get the adapter field to serialize the object
var adapterField = this.getClass().getDeclaredField("adapter");
adapterField.setAccessible(true);
var adapter = adapterField.get(this);
// Create our own buffer and writer to capture the JSON
var Buffer = Java.use("r3.f");
var tempBuffer = Buffer.$new();
// Create JsonWriter with buffer
var JsonWriter = Java.use("Z2.t");
var JsonWriterConstructor = JsonWriter.class.getDeclaredConstructor([Java.use("r3.i").class]);
JsonWriterConstructor.setAccessible(true);
var tempWriter = JsonWriterConstructor.newInstance([tempBuffer]);
// Serialize to our buffer
adapter.toJson(tempWriter, obj);
tempWriter.close();
// Read the JSON
var jsonContent = tempBuffer.B0(); // readUtf8()
console.log("\n" + "=".repeat(80));
console.log("[CAPTURED REQUEST BODY]");
if (jsonContent && jsonContent.length > 0) {
if (jsonContent.length > 3000) {
console.log(jsonContent.substring(0, 3000));
console.log("\n... (truncated, total: " + jsonContent.length + " chars)");
} else {
console.log(jsonContent);
}
} else {
console.log("(empty)");
}
console.log("=".repeat(80) + "\n");
} catch (e) {
console.log("[CAPTURE ERROR] " + e);
}
// Call original to return the actual RequestBody
return convertOriginal.call(this, obj);
};
console.log("[*] MoshiRequestBodyConverter hook installed!\n");
} catch (e) {
console.log("[-] Failed to hook MoshiRequestBodyConverter: " + e);
}
// Also hook the Auth interceptor to show URLs
try {
var AuthHeaderInterceptor = Java.use("com.adif.elcanomovil.serviceNetworking.interceptors.AuthHeaderInterceptor");
console.log("[+] Found AuthHeaderInterceptor");
// Try to find Buffer class
var Buffer = null;
var bufferNames = ["r.f", "r3.f", "okio.Buffer", "r3.Buffer"];
for (var i = 0; i < bufferNames.length; i++) {
try {
Buffer = Java.use(bufferNames[i]);
console.log("[+] Found Buffer class: " + bufferNames[i]);
break;
} catch (e) {
// Try next
}
}
if (!Buffer) {
console.log("[-] Could not find Buffer class, trying without pre-loading");
}
AuthHeaderInterceptor.intercept.implementation = function(chain) {
console.log("\n" + "=".repeat(80));
console.log("[HTTP REQUEST]");
try {
// Cast chain
var ChainClass = Java.use("j3.g");
@@ -46,87 +87,26 @@ Java.perform(function() {
var urlField = request.getClass().getDeclaredField("a");
urlField.setAccessible(true);
var urlObj = urlField.get(request);
console.log("[URL] " + urlObj.toString());
// Get method
var methodField = request.getClass().getDeclaredField("b");
methodField.setAccessible(true);
var method = methodField.get(request);
console.log("[METHOD] " + method);
// Get request body
var bodyField = request.getClass().getDeclaredField("d");
bodyField.setAccessible(true);
var reqBody = bodyField.get(request);
if (reqBody) {
try {
// If Buffer wasn't found, try to load it now
if (!Buffer) {
var bufferNames = ["r.f", "r3.f", "okio.Buffer", "r3.Buffer"];
for (var i = 0; i < bufferNames.length; i++) {
try {
Buffer = Java.use(bufferNames[i]);
break;
} catch (e) {}
}
}
if (Buffer) {
// Create a temporary buffer
var buffer = Buffer.$new();
// Try to cast buffer to BufferedSink if needed
try {
var BufferedSink = Java.use("r3.i");
var sink = Java.cast(buffer, BufferedSink);
// Call writeTo passing the sink
reqBody.writeTo(sink);
} catch (e) {
// If cast fails, try direct call
reqBody.writeTo(buffer);
}
// Read the content as UTF-8 string
var bodyContent = buffer.B0(); // readUtf8()
console.log("\n[REQUEST BODY]");
if (bodyContent && bodyContent.length > 0) {
if (bodyContent.length > 2000) {
console.log(bodyContent.substring(0, 2000));
console.log("\n... (truncated, total: " + bodyContent.length + " chars)");
} else {
console.log(bodyContent);
}
} else {
console.log("(empty)");
}
} else {
console.log("\n[REQUEST BODY] Could not load Buffer class");
}
} catch (e) {
console.log("[REQUEST BODY ERROR] " + e);
}
} else {
console.log("[REQUEST BODY] null");
}
console.log("\n[REQUEST] " + method + " " + urlObj.toString());
}
} catch (e) {
console.log("[ERROR] " + e);
console.log("[URL CAPTURE ERROR] " + e);
}
console.log("=".repeat(80) + "\n");
// Call original
return this.intercept(chain);
};
console.log("[*] Hook installed!\n");
console.log("[*] Interceptor hook installed!\n");
} catch (e) {
console.log("[-] Failed: " + e);
console.log("[-] Failed to hook AuthHeaderInterceptor: " + e);
}
});

130
frida_scripts/frida_improved_capture.js Normal file
View File

@@ -0,0 +1,130 @@
/**
* Improved REQUEST BODY Capture
* Using correct method names discovered through inspection
*/
console.log("\n[*] Improved Request Body Capture\n");
Java.perform(function() {
try {
var AuthHeaderInterceptor = Java.use("com.adif.elcanomovil.serviceNetworking.interceptors.AuthHeaderInterceptor");
console.log("[+] Found AuthHeaderInterceptor");
AuthHeaderInterceptor.intercept.implementation = function(chain) {
console.log("\n" + "=".repeat(80));
console.log("[HTTP REQUEST]");
try {
// Cast chain
var ChainClass = Java.use("j3.g");
var chainObj = Java.cast(chain, ChainClass);
// Get request
var requestField = chainObj.getClass().getDeclaredField("e");
requestField.setAccessible(true);
var request = requestField.get(chainObj);
if (request) {
// Get URL
var urlField = request.getClass().getDeclaredField("a");
urlField.setAccessible(true);
var urlObj = urlField.get(request);
console.log("[URL] " + urlObj.toString());
// Get method
var methodField = request.getClass().getDeclaredField("b");
methodField.setAccessible(true);
var method = methodField.get(request);
console.log("[METHOD] " + method);
// Get request headers
try {
var headersField = request.getClass().getDeclaredField("c");
headersField.setAccessible(true);
var headers = headersField.get(request);
if (headers) {
console.log("\n[REQUEST HEADERS]");
var size = headers.size();
for (var i = 0; i < size; i++) {
var name = headers.c(i);
var value = headers.f(i);
console.log(" " + name + ": " + value);
}
}
} catch (e) {
console.log("[HEADERS ERROR] " + e);
}
// Get request body
var bodyField = request.getClass().getDeclaredField("d");
bodyField.setAccessible(true);
var reqBody = bodyField.get(request);
if (reqBody) {
try {
// Load Buffer class - we know it's r3.f from inspection
var Buffer = Java.use("r3.f");
var buffer = Buffer.$new();
// Call writeTo with the buffer (buffer implements BufferedSink)
reqBody.writeTo(buffer);
// Try to read using readUtf8
try {
var bodyContent = buffer.B0(); // readUtf8()
console.log("\n[REQUEST BODY]");
if (bodyContent && bodyContent.length > 0) {
if (bodyContent.length > 3000) {
console.log(bodyContent.substring(0, 3000));
console.log("\n... (truncated, total: " + bodyContent.length + " chars)");
} else {
console.log(bodyContent);
}
} else {
console.log("(empty)");
}
} catch (e) {
// If B0() doesn't work, try other common method names
console.log("[READ ERROR] " + e);
console.log("[DEBUG] Trying alternative methods...");
try {
// Try snapshot().utf8()
var snapshot = buffer.t0(); // snapshot()
if (snapshot) {
var bodyContent = snapshot.Y(); // utf8()
console.log("\n[REQUEST BODY]");
console.log(bodyContent);
}
} catch (e2) {
console.log("[ALT METHOD ERROR] " + e2);
}
}
} catch (e) {
console.log("[REQUEST BODY ERROR] " + e);
}
} else {
console.log("[REQUEST BODY] null");
}
}
} catch (e) {
console.log("[ERROR] " + e);
}
console.log("=".repeat(80) + "\n");
// Call original
return this.intercept(chain);
};
console.log("[*] Hook installed!\n");
} catch (e) {
console.log("[-] Failed: " + e);
}
});

68
frida_scripts/frida_okhttp_intercept.js Normal file
View File

@@ -0,0 +1,68 @@
/**
* Intercept at OkHttp level to capture request bodies
*/
console.log("\n[*] OkHttp Request Interceptor\n");
Java.perform(function() {
// Hook the RealCall.execute method which actually sends the request
try {
var RealCall = Java.use("i3.j"); // OkHttp's RealCall
console.log("[+] Found RealCall");
RealCall.g.implementation = function(chain) {
console.log("\n" + "=".repeat(80));
console.log("[HTTP REQUEST INTERCEPTED]");
try {
// Get the request from chain
var request = chain.b();
if (request) {
console.log("[URL] " + request.g().toString());
console.log("[METHOD] " + request.f());
// Get the body
var body = request.d();
if (body) {
try {
var Buffer = Java.use("r3.f");
var buffer = Buffer.$new();
// Write body to buffer
body.writeTo(buffer);
// Read as string
var bodyStr = buffer.B0();
console.log("\n[REQUEST BODY]");
if (bodyStr && bodyStr.length > 0) {
console.log(bodyStr);
} else {
console.log("(empty)");
}
} catch (e) {
console.log("[BODY ERROR] " + e);
}
} else {
console.log("[BODY] null");
}
}
} catch (e) {
console.log("[ERROR] " + e);
}
console.log("=".repeat(80) + "\n");
// Call original
return this.g(chain);
};
console.log("[*] Hook installed!\n");
} catch (e) {
console.log("[-] Failed to hook RealCall: " + e);
}
});

118
frida_scripts/frida_reflection_capture.js Normal file
View File

@@ -0,0 +1,118 @@
/**
* Request Body Capture using Reflection
* Automatically finds the correct method names
*/
console.log("\n[*] Request Body Capture (Reflection-based)\n");
Java.perform(function() {
try {
var AuthHeaderInterceptor = Java.use("com.adif.elcanomovil.serviceNetworking.interceptors.AuthHeaderInterceptor");
console.log("[+] Found AuthHeaderInterceptor");
AuthHeaderInterceptor.intercept.implementation = function(chain) {
console.log("\n" + "=".repeat(80));
console.log("[HTTP REQUEST]");
try {
// Cast chain
var ChainClass = Java.use("j3.g");
var chainObj = Java.cast(chain, ChainClass);
// Get request
var requestField = chainObj.getClass().getDeclaredField("e");
requestField.setAccessible(true);
var request = requestField.get(chainObj);
if (request) {
// Get URL
var urlField = request.getClass().getDeclaredField("a");
urlField.setAccessible(true);
var urlObj = urlField.get(request);
console.log("[URL] " + urlObj.toString());
// Get method
var methodField = request.getClass().getDeclaredField("b");
methodField.setAccessible(true);
var method = methodField.get(request);
console.log("[METHOD] " + method);
// Get request body
var bodyField = request.getClass().getDeclaredField("d");
bodyField.setAccessible(true);
var reqBody = bodyField.get(request);
if (reqBody) {
try {
// Load Buffer class
var Buffer = Java.use("r3.f");
var buffer = Buffer.$new();
// Call writeTo with the buffer
reqBody.writeTo(buffer);
// Use reflection to find readUtf8() method
var methods = buffer.getClass().getMethods();
var readUtf8Method = null;
for (var i = 0; i < methods.length; i++) {
var method = methods[i];
var methodName = method.getName();
var returnType = method.getReturnType().getName();
var paramCount = method.getParameterTypes().length;
// Look for a method that returns String and has no parameters
if (returnType === "java.lang.String" && paramCount === 0) {
// This is likely readUtf8()
readUtf8Method = method;
console.log("[DEBUG] Found string method: " + methodName + "()");
break;
}
}
if (readUtf8Method) {
readUtf8Method.setAccessible(true);
var bodyContent = readUtf8Method.invoke(buffer);
console.log("\n[REQUEST BODY]");
if (bodyContent && bodyContent.length > 0) {
if (bodyContent.length > 3000) {
console.log(bodyContent.substring(0, 3000));
console.log("\n... (truncated, total: " + bodyContent.length + " chars)");
} else {
console.log(bodyContent);
}
} else {
console.log("(empty)");
}
} else {
console.log("[REQUEST BODY] Could not find readUtf8() method");
}
} catch (e) {
console.log("[REQUEST BODY ERROR] " + e);
console.log("[STACK] " + e.stack);
}
} else {
console.log("[REQUEST BODY] null");
}
}
} catch (e) {
console.log("[ERROR] " + e);
console.log("[STACK] " + e.stack);
}
console.log("=".repeat(80) + "\n");
// Call original
return this.intercept(chain);
};
console.log("[*] Hook installed!\n");
} catch (e) {
console.log("[-] Failed: " + e);
}
});