initial commit

.gitignore

@@ -0,0 +1,129 @@
+.vscode/
+node_modules/
+.ccls-cache/
+
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+pip-wheel-metadata/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+.python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# celery beat schedule file
+celerybeat-schedule
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019 CodeColorist
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,2 @@
+# saltedfish
+咸鱼

agent/agent.d.ts

@@ -0,0 +1,26 @@
+interface Plugin {
+  path: string,
+  version: number,
+  id: string,
+  executable: string,
+}
+
+interface Context {
+  cm?: CModule,
+  findEncyptInfo?: NativeFunction,
+}
+
+interface NSString {
+  UTF8String(): NativePointer,
+}
+
+interface NSDictionary {
+  objectForKey_(key: string): any,
+}
+
+interface NSBundle {
+  bundleIdentifier(): NSString,
+  bundlePath(): NSString,
+  infoDictionary(): NSDictionary,
+  executablePath(): NSString,
+}

agent/dump.ts

@@ -0,0 +1,54 @@
+import { memcpy, download } from './transfer';
+import { normalize } from './path';
+
+type EncryptInfoTuple = [NativePointer, number, number, number, number];
+
+
+const ctx: Context = {};
+const EncryptInfoTuple = ['pointer', 'uint32', 'uint32', 'uint32', 'uint32'];
+
+function beep() {
+  try {
+    const SOUND = 1007
+    const playSound = Module.findExportByName('AudioToolbox', 'AudioServicesPlaySystemSound')!
+    new NativeFunction(playSound, 'void', ['int'])(SOUND)
+  } catch (e) {
+
+  }
+}
+
+export async function dump() {
+  const bundle = normalize(ObjC.classes.NSBundle.mainBundle().bundlePath().toString());
+  for (let mod of Process.enumerateModules()) {
+    if (!normalize(mod.path).startsWith(bundle))
+      continue;
+
+    const info = ctx.findEncyptInfo!(mod.base) as EncryptInfoTuple;
+    const [ptr, offset, size, offsetOfCmd, sizeOfCmd] = info;
+
+    if (ptr.isNull())
+      continue;
+
+    await download(mod.path);
+
+    // skip fat header
+    const fatOffset = Process.findRangeByAddress(mod.base)!.file!.offset;
+
+    // todo: filename argument
+    // dump decrypted
+    const session = memcpy(mod.base.add(offset), size);
+    send({ subject: 'patch', offset: fatOffset + offset, blob: session, filename: mod.path });
+
+    // erase cryptoff
+    send({ subject: 'patch', offset: fatOffset + offsetOfCmd, size: sizeOfCmd, filename: mod.path });
+  }
+
+  beep();
+  return 0;
+}
+
+export function prepare(c: string) {
+  const cm = new CModule(c);
+  ctx.cm = cm
+  ctx.findEncyptInfo = new NativeFunction(cm['find_encryption_info'], EncryptInfoTuple, ['pointer']);
+}

agent/env.ts

@@ -0,0 +1,9 @@
+export default function() {
+  const keys = ['CFFIXED_USER_HOME', 'HOME', 'TMPDIR'];
+  const env = ObjC.classes.NSProcessInfo.processInfo().environment();
+  const result: {[key: string]: string} = {};
+  for (let key of keys) {
+    result[key] = env.objectForKey_(key).toString();
+  }
+  return result;
+}

agent/index.ts

@@ -0,0 +1,30 @@
+if (typeof CModule === 'undefined')
+  throw new Error('Your frida does not support CModule. Version: ' + Frida.version)
+
+import { dump, prepare } from './dump';
+// import { toNSObject } from './nsdict';
+import environ from './env';
+import { plugins } from './pkd';
+import { launch, stop } from './launchd';
+
+rpc.exports = {
+  dump,
+  prepare,
+  environ,
+  plugins,
+
+  // pkd
+  launch,
+  stop,
+
+  // test() {
+  //   const a = toNSObject({
+  //     foo: 'bar',
+  //     bar: 2,
+  //     aaa: null,
+  //     ddd: false,
+  //     ccc: true
+  //   });
+  //   console.log(a)
+  // }
+}

agent/launchd.ts

@@ -0,0 +1,67 @@
+import { toNSObject } from "./nsdict";
+
+export const add = new NativeFunction(
+  Module.findExportByName('libxpc.dylib', 'launch_add_external_service')!,
+  'uint',
+  ['int', 'pointer', 'pointer'],
+);
+
+export const remove = new NativeFunction(
+  Module.findExportByName('libxpc.dylib', 'launch_remove_external_service')!,
+  'void',
+  ['pointer', 'pointer', 'pointer', 'pointer'],
+);
+
+export const XPCFromCF = new NativeFunction(
+  Module.findExportByName('CoreFoundation', '_CFXPCCreateXPCObjectFromCFObject')!,
+  'pointer',
+  ['pointer']
+);
+
+export function launch(pid: number, path: string, env: any) {
+  const param = XPCFromCF(toNSObject({
+    XPCService: {
+      RunLoopType: '_UIApplicationMain',
+      _SandboxProfile: 'plugin',
+      _AdditionalSubServices: {
+        viewservice: true,
+        'apple-extension-service': true,
+      },
+      EnvironmentVariables: env,
+      _OmitSandboxParameters: true,
+      ServiceType: 'Application',
+    },
+    CFBundlePackageType: 'XPC!',
+  }))
+
+  console.log(new ObjC.Object(param as NativePointer));
+
+  const ret = add(pid, Memory.allocUtf8String(path), param);
+  new ObjC.Object(param as NativePointer).release();
+  return ret;
+}
+
+export function stop(plugin: Plugin) {
+  // Module.findExportByName('libdispatch.dylib', 'dispatch_queue_create')
+  // Module.findExportByName('libdispatch.dylib', 'dispatch_release')
+
+  const mainQueue = new NativeFunction(
+    Module.findExportByName('libdispatch.dylib', 'dispatch_get_main_queue')!,
+    'pointer', [])
+
+  const block = new ObjC.Block({
+    retType: 'void',
+    argTypes: ['object'],
+    implementation: function() {
+      console.log('done')
+    }
+  });
+
+  remove(
+    Memory.allocUtf8String(plugin.id),
+    plugin.version,
+    mainQueue(),
+    block.handle);
+}
+
+// bundleIdentifier, CFBundleVersion, dispatch_queue_create("killer", 0LL), block

agent/nsdict.ts

@@ -0,0 +1,30 @@
+const {
+  NSMutableDictionary, NSMutableArray, NSString,
+  NSNull, __NSCFBoolean
+} = ObjC.classes
+
+
+export function toNSObject(obj: any) {
+  if (typeof obj === 'boolean')
+    return __NSCFBoolean.numberWithBool_(obj);
+  if (typeof obj === 'undefined' || obj === null)
+    return NSNull.null();
+  if (typeof obj === 'string')
+    return NSString.stringWithString_(obj);
+  if (typeof obj === 'object' && 'isKindOfClass_' in obj)
+    return obj;
+
+  if (Array.isArray(obj)) {
+    const mutableArray = NSMutableArray.alloc().init();
+    obj.forEach(item => mutableArray.addObject_(toNSObject(item)));
+    return mutableArray;
+  }
+
+  const mutableDict = NSMutableDictionary.alloc().init();
+  for (const key in obj) {
+    const val = toNSObject(obj[key]);
+    mutableDict.setObject_forKey_(val, key);
+  }
+
+  return mutableDict;
+}

agent/path.ts

@@ -0,0 +1,15 @@
+const SEP = '/'
+
+export function relativeTo(base: string, full: string) {
+  const a = normalize(base).split(SEP);
+  const b = normalize(full).split(SEP);
+
+  let i = 0;
+  while (a[i] === b[i]) i++;
+  return b.slice(i).join(SEP);
+}
+
+export function normalize(path: string) {
+  return ObjC.classes.NSString
+    .stringWithString_(path).stringByStandardizingPath().toString();
+}