[frida]抓包脚本

可以抓取任意指定app的tcp封包，修改了这里的代码：iddoeldor/frida-snippets: Hand-crafted Frida examples (github.com)

使用方法：

1.将文件保存为capture.js

Process
	.getModuleByName({ linux: 'libc.so', darwin: 'libSystem.B.dylib', windows: 'ws2_32.dll' }[Process.platform])
	.enumerateExports().filter(ex => ex.type === 'function' && ['recv', 'send', 'read', 'write'].some(prefix => ex.name === prefix))
	.forEach(ex => {
		Interceptor.attach(ex.address, {
			onEnter: function (args) {
				var fd = args[0].toInt32();
				var socktype = Socket.type(fd);
				if (socktype !== 'tcp' && socktype !== 'tcp6') {
					return;
				}

				var address = Socket.peerAddress(fd);
				if (address === null) {
					return;
				}

				this._fd = fd;
				this._buf = ptr(args[1]);
				this._address = address.ip + ':' + address.port
			},
			onLeave: function (retval) {
				if (!this._fd) {
					return;
				}

				retval = retval.toInt32();
				if (retval > 0) {
					console.log(
						'function =', ex.name, ',',
						'fd =', this._fd, ',',
						'address =', this._address, ',',
						'buf_len =', retval, ',',
						'buf:\n', this._buf.readByteArray(retval),
						'\n', '*'.repeat(100));
				}
			}
		})
	});

2.运行frida-server。

3.手动打开APP，然后frida-ps -Uia查看pid，执行frida -U -p pid --no-pause -l capture.js附加到指定app进程；也可以frida -U -f 包名 --no-pause -l capture.js直接spwan一个新进程。

效果如下：