search

idanr1986 / droidmon

Dalvik Monitoring Framework for CuckooDroid
Other
91 stars 49 forks source link

Hook the constructor. #3

Closed melonaerial closed 8 years ago

melonaerial commented 8 years ago

Hello. Can i hook the constructor of object with your hooks.json file ? What is API for that ?

idanr1986 commented 8 years ago

yes you can just leave the method empty , you can find example in the json

On 20 Oct 2015, at 5:58 PM, Mike R notifications@github.com wrote:

Hello. Can i hook the constructor of object with your hooks.json file ? What is API for that ?

— Reply to this email directly or view it on GitHub https://github.com/idanr1986/droidmon/issues/3.

melonaerial commented 8 years ago 
        {
            "class_name": "java.net.URI", 
            "method": "<init>", 
            "thisObject": false, 
            "type": "fingerprint"
        },
        {
            "class_name": "java.net.URI", 
            "method": "", 
            "thisObject": false, 
            "type": "fingerprint"
        }

I've tried to make hook this way, but it not works for me.

melonaerial commented 8 years ago 
W/System.err( 5631): java.net.UnknownHostException: Unable to resolve host "lgfvfghcbyd.xyz": No address associated with hostname
W/System.err( 5631):    at java.net.InetAddress.lookupHostByName(InetAddress.java:424)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631)
W/System.err( 5631):    at java.net.InetAddress.lookupHostByName(Native Method)
W/System.err( 5631):    at java.net.InetAddress.getAllByNameImpl(InetAddress.java:236)
W/System.err( 5631):    at java.net.InetAddress.getAllByName(InetAddress.java:214)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631)
W/System.err( 5631):    at java.net.InetAddress.getAllByName(Native Method)
W/System.err( 5631):    at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:137)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631)
W/System.err( 5631):    at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(Native Method)
W/System.err( 5631):    at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:164)
W/System.err( 5631):    at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:119)
W/System.err( 5631):    at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:360)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631)
W/System.err( 5631):    at org.apache.http.impl.client.DefaultRequestDirector.execute(Native Method)
W/System.err( 5631):    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:555)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631)
W/System.err( 5631):    at org.apache.http.impl.client.AbstractHttpClient.execute(Native Method)
W/System.err( 5631):    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:487)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631)
W/System.err( 5631):    at org.apache.http.impl.client.AbstractHttpClient.execute(Native Method)
W/System.err( 5631):    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:465)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
W/System.err( 5631):    at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631)
W/System.err( 5631):    at org.apache.http.impl.client.AbstractHttpClient.execute(Native Method)

And have found this. It looks like if in some code will be exception, then all logs from DroidMon will be missed, cause i don't see log messages from this methods in logcat.

idanr1986 commented 8 years ago

{ "class_name": "javax.crypto.spec.SecretKeySpec", "method": null, "thisObject": false, "type": "crypto" },

On 20 Oct 2015, at 8:34 PM, Mike R notifications@github.com wrote:

W/System.err( 5631): java.net.UnknownHostException: Unable to resolve host "lgfvfghcbyd.xyz": No address associated with hostname W/System.err( 5631): at java.net.InetAddress.lookupHostByName(InetAddress.java:424) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631) W/System.err( 5631): at java.net.InetAddress.lookupHostByName(Native Method) W/System.err( 5631): at java.net.InetAddress.getAllByNameImpl(InetAddress.java:236) W/System.err( 5631): at java.net.InetAddress.getAllByName(InetAddress.java:214) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631) W/System.err( 5631): at java.net.InetAddress.getAllByName(Native Method) W/System.err( 5631): at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:137) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631) W/System.err( 5631): at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(Native Method) W/System.err( 5631): at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:164) W/System.err( 5631): at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:119) W/System.err( 5631): at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:360) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631) W/System.err( 5631): at org.apache.http.impl.client.DefaultRequestDirector.execute(Native Method) W/System.err( 5631): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:555) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631) W/System.err( 5631): at org.apache.http.impl.client.AbstractHttpClient.execute(Native Method) W/System.err( 5631): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:487) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631) W/System.err( 5631): at org.apache.http.impl.client.AbstractHttpClient.execute(Native Method) W/System.err( 5631): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:465) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method) W/System.err( 5631): at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631) W/System.err( 5631): at org.apache.http.impl.client.AbstractHttpClient.execute(Native Method) And have found this. It looks like if in some code will be exception, then all logs from DroidMon will be missed, cause i don't see log messages from this methods in logcat.

— Reply to this email directly or view it on GitHub https://github.com/idanr1986/droidmon/issues/3#issuecomment-149641599.