Frida API之網絡

@[toc] 在聊天系統開發(1) 的文章中，對TCP/IP相關的網絡編程進行了介紹。在Frida API進階-文件 對文件描述符、輸入輸出流進行了介紹。本篇文章集於此介紹Frida中網絡相關的API。

Socket

Socket.listen([options]): open a TCP or UNIX listening socket. Returns a Promise that receives a SocketListener. Defaults to listening on both IPv4 and IPv6, if supported, and binding on all interfaces on a randomly selected TCP port.

Socket.connect(options): connect to a TCP or UNIX server. Returns a Promise that receives a SocketConnection.

Socket.type(handle): inspect the OS socket handle and return its type as a string which is either tcp, udp, tcp6, udp6, unix:stream, unix:dgram, or null if invalid or unknown.

Socket.localAddress(handle), Socket.peerAddress(handle): inspect the OS socket handle and return its local or peer address, or null if invalid or unknown. The object returned has the fields:

• ip: (IP sockets) IP address as a string.
• port: (IP sockets) IP port as a number.
• path: (UNIX sockets) UNIX path as a string.

SocketListener

All methods are fully asynchronous and return Promise objects.

• path: (UNIX family) path being listened on.
• port: (IP family) IP port being listened on.
• close(): close the listener, releasing resources related to it. Once the listener is closed, all other operations will fail. Closing a listener multiple times is allowed and will not result in an error.
• accept(): wait for the next client to connect. The returned Promise receives a SocketConnection.

SocketConnection

Inherits from IOStream. All methods are fully asynchronous and return Promise objects.

• setNoDelay(noDelay): disable the Nagle algorithm if noDelay is true, otherwise enable it. The Nagle algorithm is enabled by default, so it is only necessary to call this method if you wish to optimize for low delay instead of high throughput.

代碼示例

function frida_Java() { Java.perform(function () { var ip_family = new Object(); ip_family.family = "ipv4"; ip_family.host = "47.92.90.25"; ip_family.port = 7000; var socket = Socket.connect(ip_family); socket.then(function(successMessage){ console.log(successMessage instanceof SocketConnection); successMessage.setNoDelay(true); var promise = successMessage.input.read(1000); promise.then(function(result){ console.log(' burning'+hexdump(result,{lenght:1000})); }).catch(function(error){ console.log(' fail:'+error); }); });

運行結果如下，可以看出successMessage的類型是SocketConnection。

Nagle algorithm

在發出去的數據還沒有被確認之前，假如又有小數據生成，那麼就把小數據收集起來，湊滿一個MSS或者等收到確認後再發送。

JavaScript判斷數據類型

instanceof 是用來判斷 A 是否為 B 的實例，表達式為：A instanceof B，如果 A 是 B 的實例，則返回 true,否則返回 false。 在這裡需要特別注意的是：instanceof 檢測的是原型。

由上圖可以看出[]的原型指向Array.prototype，間接指向Object.prototype, 因此 [] instanceof Array 返回true， [] instanceof Object 也返回true。

其他的判斷方式

1. typeof
2. toString Object.prototype.toString.call(window);//[object global] window 是全局對象 global 的引用
3. constructor

公眾號

更多Frida相關內容，歡迎關注我的微信公眾號:無情劍客。