mtopsdk(淘宝系android app使用的sdk)强迫请求通过代理进行抓包

背景

android app抓包，会出现http包不走fiddler等代理的情况，譬如淘宝系、支付宝系app

etao app使用mtopsdk(https://help.aliyun.com/document_detail/69785.html)，https://acs.m.taobao.com/下的请求都抓不到

本文分析了com.taobao.etao，最终可以通过fiddler、burp进行抓包

解决

1、通过frida hook可以打印出所有请求及参数

//所有响应 var Response = Java.use('mtopsdk.network.domain.Response'); Response.$init.overload('mtopsdk.network.domain.Response$Builder').implementation = function(){ //PrintStack() console.log("\nResponse "+arguments[0].body) var ret = this.$init.apply(this, arguments); //all request console.log("\nResponse "+this.toString()) return ret } //所有请求 var RequestBuilder = Java.use('mtopsdk.network.domain.Request$Builder'); RequestBuilder.build.overload().implementation = function(){ //PrintStack() var ret = this.build.apply(this, arguments); //all request console.log("\nRequestBuilder "+ret.toString()) return ret } //所有请求 var ANetworkCallImpl = Java.use('mtopsdk.network.impl.ANetworkCallImpl'); ANetworkCallImpl.$init.overload('mtopsdk.network.domain.Request', 'android.content.Context').implementation = function(){ //PrintStack() console.log("\nANetworkCallImpl "+arguments[0]) var ret = this.$init.apply(this, arguments); return ret } //所有请求url var AbstractNetworkConverter = Java.use('mtopsdk.mtop.protocol.converter.impl.AbstractNetworkConverter'); AbstractNetworkConverter.buildBaseUrl.overload('mtopsdk.framework.domain.MtopContext','java.lang.String', 'java.lang.String').implementation = function(){ //console.log("buildBaseUrl "+arguments[1]+' '+arguments[2]) var ret = this.buildBaseUrl.apply(this, arguments); //url //console.log("buildBaseUrl "+ret) return ret }

2、进一步分析得知由于sdk使用spdy协议，导致无法抓包

通过hook 将是否使用spdy返回false

var SwitchConfig = Java.use('mtopsdk.mtop.global.SwitchConfig'); SwitchConfig.isGlobalSpdySwitchOpen.overload().implementation = function(){ var ret = this.isGlobalSpdySwitchOpen.apply(this, arguments); console.log("\nisGlobalSpdySwitchOpenl "+ret) return false }

不同应用集成mtopsdk 混淆程度不一样，函数名可能会变

终于可以抓到包

虽然可以看到包，但请求有签名，无法直接改包，还需要针对具体业务进行hook修改参数，后续可以分析下签名机制

NO_PROXY

其他app可以通过设置no_proxy来bypass wifi代理

1、Socket(Proxy proxy)

2、openConnection (Proxy proxy)

3、OkHttpClient.Builder().proxy(proxy);

等等，需要具体进行hook

 

============支付宝APP使用mpaas-rpc框架======

参考https://juejin.im/post/5bc850caf265da0abf7d195d#heading-12

(请求通过socket连接发送http协议,暂时没法导入fiddler等代理)

通过frida hook可以打印出请求和响应

var Throwable = null; Java.perform(function () { Throwable = Java.use("java.lang.Throwable"); }); /* * 输出当前调用堆栈 */ function PrintStack() { var stackElements = Throwable.$new().getStackTrace(); var body = "Stack: " + stackElements[0];//method//stackElements[0].getMethodName() for (var i = 1; i < stackElements.length; i++) { body += "\n at " + stackElements[i]; } console.log(body); }; Java.perform(function() { //========android 7+ try{ var array_list = Java.use("java.util.ArrayList"); var ApiClient = Java.use('com.android.org.conscrypt.TrustManagerImpl'); ApiClient.checkTrustedRecursive.implementation = function(a1, a2, a3, a4, a5, a6) { var k = array_list.$new(); return k; } }catch (e) { //console.log('universal '+e); } var CoreHttpManager = Java.use('com.alipay.mobile.common.transport.http.inner.CoreHttpManager'); CoreHttpManager.a.overload('com.alipay.mobile.common.transport.http.HttpUrlRequest').implementation = function(){ //PrintStack() //console.log("") // console.log("CoreHttpManager "+arguments[0].getUrl()+' '+arguments[0].getTag('operationType')) var ret = this.a.apply(this, arguments); return ret } //请求，这个位置已经sign过无法更改参数 var HttpCaller = Java.use('com.alipay.mobile.common.rpc.transport.http.HttpCaller'); HttpCaller.sendRequest.overload('com.alipay.mobile.common.transport.http.HttpUrlRequest').implementation = function(){ var ret = this.sendRequest.apply(this, arguments); var blacklist = ['com.alipayhk.imobilewallet.plugin.home.union.query', 'ant.abtest.configlite', 'alipay.mappconfig.queryAppInfo', 'alipay.mappconfig.queryStageInfo', 'alipay.livetradeprod.soundWave.getInitArgs.pb'] var opertype = arguments[0].getTag('operationType') var url = arguments[0].getUrl() var data = arguments[0].getReqData() var header = arguments[0].getHeaders() var Map = Java.use('java.util.HashMap') var args_map = Java.cast(arguments[0].getTags(), Map) var tags = args_map.toString() var resdata = ret.getResData() if (blacklist.indexOf(opertype) == -1 ){ // try{ // console.log("httpcaller ==request "+url+' '+opertype + ' =header: '+header+ ' =tags: '+tags+' =data: '+byteArr2str(data, true)+' \n======response '+byteArr2str(resdata,true)) // console.log("") // }catch(e){ // //console.log('decode error '+opertype) // console.log("httpcaller ==request "+url+' '+opertype + ' =header: '+header+ ' =tags: '+tags+' =data: '+byteArr2str(data, false)+' \n======response '+byteArr2str(resdata, false)) // console.log("") // } } return ret } //es6支持默认参数 function byteArr2str(ba, w){ if(w){ var string = Java.use('java.lang.String') return string.$new(ba) }else{ var array = Java.use('java.util.Arrays') return array.toString(ba) } } //array2str function arr(arr){ if (arr != null){ var ret = '' for(var i = 0, len = arr.length; i < len; i++){ ret += String.fromCharCode(arr[i]) } return ret } } //参考https://juejin.im/post/5bc850caf265da0abf7d195d#heading-12 //Serializer数据格式protobuf和json两种 //在此位置更改参数 var RpcInvoker = Java.use('com.alipay.mobile.common.rpc.RpcInvoker'); RpcInvoker.singleCall.overload('java.lang.reflect.Method', '[Ljava.lang.Object;', 'java.lang.String', 'int', 'com.alipay.mobile.common.rpc.transport.InnerRpcInvokeContext', 'com.alipay.mobile.common.rpc.protocol.util.RPCProtoDesc').implementation = function(){ console.log("") console.log('call '+arguments[2]+ ' =data: '+arguments[1]) var ret = this.singleCall.apply(this, arguments); return ret } }, 0);

可以打印出所有请求