trace 192.168.120.254:5500 using frida

README.md

@@ -166,6 +166,18 @@ The first request was only send once - all other setup tries skipped the first r
 - when connecting with `openssl s_client -connect 192.168.120.254:5500` the device sends `{"cmd": "ping", "type":"request"}`
 - when replying with `enter` or `{"cmd": "ping", "type":"response"}` the connection is closed
 
+## frida
+
+With [frida](https://github.com/frida/frida) I was able to capture the communication to 192.168.120.254:5500 using:
+
+`frida-trace -U -i SSL_read -i SSL_write -N com.lgeha.nuts`
+
+The scripts are in the frida folder.
+
+The request for the ping response seems to be `{"type":"request","cmd":"pong","data":{"constantConnect":"Y"}}`
+
+`//todo more insights to follow...`
+
 ## Findings
 
 ### clip.com

frida/__handlers__/libssl.so/SSL_read.js

@@ -0,0 +1,48 @@
+/*
+ * Auto-generated by Frida. Please modify to match the signature of SSL_read.
+ * This stub is currently auto-generated from manpages when available.
+ *
+ * For full API reference, see: https://frida.re/docs/javascript-api/
+ */
+
+{
+  /**
+   * Called synchronously when about to call SSL_read.
+   *
+   * @this {object} - Object allowing you to store state for use in onLeave.
+   * @param {function} log - Call this function with a string to be presented to the user.
+   * @param {array} args - Function arguments represented as an array of NativePointer objects.
+   * For example use args[0].readUtf8String() if the first argument is a pointer to a C string encoded as UTF-8.
+   * It is also possible to modify arguments by assigning a NativePointer object to an element of this array.
+   * @param {object} state - Object allowing you to keep state across function calls.
+   * Only one JavaScript function will execute at a time, so do not worry about race-conditions.
+   * However, do not use this to store function arguments across onEnter/onLeave, but instead
+   * use "this" which is an object for keeping state local to an invocation.
+   */
+  onEnter(log, args, state) {
+    this.ssl = args[0];
+    this.buf = args[1];
+    this.num = args[2];
+  },
+
+  /**
+   * Called synchronously when about to return from SSL_read.
+   *
+   * See onEnter for details.
+   *
+   * @this {object} - Object allowing you to access state stored in onEnter.
+   * @param {function} log - Call this function with a string to be presented to the user.
+   * @param {NativePointer} retval - Return value represented as a NativePointer object.
+   * @param {object} state - Object allowing you to keep state across function calls.
+   */
+  onLeave(log, retval, state) {
+    retval |= 0;
+    if (retval <= 0)
+    {
+      return;
+    }
+    const data = this.buf.readByteArray(retval);
+    send(["read", retval, this.ssl, this.buf, this.num]);
+    console.log(data);
+  }
+}

frida/__handlers__/libssl.so/SSL_write.js

@@ -0,0 +1,43 @@
+/*
+ * Auto-generated by Frida. Please modify to match the signature of SSL_write.
+ * This stub is currently auto-generated from manpages when available.
+ *
+ * For full API reference, see: https://frida.re/docs/javascript-api/
+ */
+
+{
+  /**
+   * Called synchronously when about to call SSL_write.
+   *
+   * @this {object} - Object allowing you to store state for use in onLeave.
+   * @param {function} log - Call this function with a string to be presented to the user.
+   * @param {array} args - Function arguments represented as an array of NativePointer objects.
+   * For example use args[0].readUtf8String() if the first argument is a pointer to a C string encoded as UTF-8.
+   * It is also possible to modify arguments by assigning a NativePointer object to an element of this array.
+   * @param {object} state - Object allowing you to keep state across function calls.
+   * Only one JavaScript function will execute at a time, so do not worry about race-conditions.
+   * However, do not use this to store function arguments across onEnter/onLeave, but instead
+   * use "this" which is an object for keeping state local to an invocation.
+   */
+  onEnter(log, args, state) {
+    const ssl = args[0];
+    const buf = args[1];
+    const num = parseInt(args[2]);    
+    const data = buf.readByteArray(num);
+    send(["write", ssl, buf, num]);
+    console.log(data)
+  },
+
+  /**
+   * Called synchronously when about to return from SSL_write.
+   *
+   * See onEnter for details.
+   *
+   * @this {object} - Object allowing you to access state stored in onEnter.
+   * @param {function} log - Call this function with a string to be presented to the user.
+   * @param {NativePointer} retval - Return value represented as a NativePointer object.
+   * @param {object} state - Object allowing you to keep state across function calls.
+   */
+  onLeave(log, retval, state) {
+  }
+}