📦
1234 /agent/ssl_log.js.map
1842 /agent/ssl_log.js
2417 /agent/android/android_agent.js.map
2834 /agent/android/android_agent.js
864 /agent/android/android_java_tls_libs.js.map
1046 /agent/android/android_java_tls_libs.js
4240 /agent/android/bouncycastle.js.map
4751 /agent/android/bouncycastle.js
1791 /agent/android/conscrypt.js.map
2750 /agent/android/conscrypt.js
1048 /agent/android/gnutls_android.js.map
1053 /agent/android/gnutls_android.js
708 /agent/android/mbedTLS_android.js.map
919 /agent/android/mbedTLS_android.js
1074 /agent/android/nss_android.js.map
1185 /agent/android/nss_android.js
1059 /agent/android/openssl_boringssl_android.js.map
1120 /agent/android/openssl_boringssl_android.js
2716 /agent/android/wolfssl_android.js.map
3492 /agent/android/wolfssl_android.js
1762 /agent/ios/ios_agent.js.map
2005 /agent/ios/ios_agent.js
1625 /agent/ios/openssl_boringssl_ios.js.map
2427 /agent/ios/openssl_boringssl_ios.js
1042 /agent/linux/gnutls_linux.js.map
1051 /agent/linux/gnutls_linux.js
2094 /agent/linux/linux_agent.js.map
2383 /agent/linux/linux_agent.js
698 /agent/linux/mbedTLS_linux.js.map
913 /agent/linux/mbedTLS_linux.js
3199 /agent/linux/nss_linux.js.map
4241 /agent/linux/nss_linux.js
1190 /agent/linux/openssl_boringssl_linux.js.map
1229 /agent/linux/openssl_boringssl_linux.js
2709 /agent/linux/wolfssl_linux.js.map
3486 /agent/linux/wolfssl_linux.js
1772 /agent/macos/macos_agent.js.map
2133 /agent/macos/macos_agent.js
1568 /agent/macos/openssl_boringssl_macos.js.map
2257 /agent/macos/openssl_boringssl_macos.js
7546 /agent/shared/shared_functions.js.map
9255 /agent/shared/shared_functions.js
371 /agent/shared/shared_structures.js.map
201 /agent/shared/shared_structures.js
6194 /agent/ssl_lib/gnutls.js.map
7001 /agent/ssl_lib/gnutls.js
2255 /agent/ssl_lib/java_ssl_libs.js.map
4283 /agent/ssl_lib/java_ssl_libs.js
6638 /agent/ssl_lib/mbedTLS.js.map
6716 /agent/ssl_lib/mbedTLS.js
29513 /agent/ssl_lib/nss.js.map
49965 /agent/ssl_lib/nss.js
5253 /agent/ssl_lib/openssl_boringssl.js.map
6304 /agent/ssl_lib/openssl_boringssl.js
4306 /agent/ssl_lib/wolfssl.js.map
5108 /agent/ssl_lib/wolfssl.js
524 /agent/util/log.js.map
290 /agent/util/log.js
1323 /agent/util/process_infos.js.map
1557 /agent/util/process_infos.js
700 /agent/windows/gnutls_windows.js.map
708 /agent/windows/gnutls_windows.js
708 /agent/windows/mbedTLS_windows.js.map
919 /agent/windows/mbedTLS_windows.js
948 /agent/windows/nss_windows.js.map
1132 /agent/windows/nss_windows.js
980 /agent/windows/openssl_boringssl_windows.js.map
1216 /agent/windows/openssl_boringssl_windows.js
12427 /agent/windows/sspi.js.map
15804 /agent/windows/sspi.js
2056 /agent/windows/windows_agent.js.map
2459 /agent/windows/windows_agent.js
1018 /agent/windows/wolfssl_windows.js.map
1098 /agent/windows/wolfssl_windows.js
✄
{"version":3,"file":"ssl_log.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/ssl_log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAqEnC,YAAY;AACZ,MAAM,CAAC,IAAI,OAAO,GAAa,WAAW,CAAC;AAC3C,YAAY;AACZ,MAAM,CAAC,IAAI,YAAY,GAAY,gBAAgB,CAAA;AACnD;;;;;;;EAOE;AAGF,MAAM,UAAU,UAAU;IACtB,OAAO,OAAO,CAAC;AACnB,CAAC;AAID,SAAS,sBAAsB;IAC3B,IAAG,SAAS,EAAE,EAAC;QACX,GAAG,CAAC,2BAA2B,CAAC,CAAA;QAChC,0BAA0B,EAAE,CAAA;KAC/B;SAAK,IAAG,SAAS,EAAE,EAAC;QACjB,GAAG,CAAC,2BAA2B,CAAC,CAAA;QAChC,0BAA0B,EAAE,CAAA;KAC/B;SAAK,IAAG,OAAO,EAAE,EAAC;QACf,GAAG,CAAC,yBAAyB,CAAC,CAAA;QAC9B,wBAAwB,EAAE,CAAA;KAC7B;SAAK,IAAG,KAAK,EAAE,EAAC;QACb,GAAG,CAAC,uBAAuB,CAAC,CAAA;QAC5B,sBAAsB,EAAE,CAAA;KAC3B;SAAK,IAAG,OAAO,EAAE,EAAC;QACf,GAAG,CAAC,yBAAyB,CAAC,CAAA;QAC9B,wBAAwB,EAAE,CAAA;KAC7B;SAAI;QACD,GAAG,CAAC,qCAAqC,CAAC,CAAA;QAC1C,GAAG,CAAC,0HAA0H,CAAC,CAAA;KAClI;AAEL,CAAC;AAED,sBAAsB,EAAE,CAAA"}
✄
import { load_android_hooking_agent } from "./android/android_agent.js";
import { load_ios_hooking_agent } from "./ios/ios_agent.js";
import { load_macos_hooking_agent } from "./macos/macos_agent.js";
import { load_linux_hooking_agent } from "./linux/linux_agent.js";
import { load_windows_hooking_agent } from "./windows/windows_agent.js";
import { isWindows, isLinux, isAndroid, isiOS, isMacOS } from "./util/process_infos.js";
import { log } from "./util/log.js";
//@ts-ignore
export let offsets = "{OFFSETS}";
//@ts-ignore
export let experimental = "{EXPERIMENTAL}";
/*

create the TLS library for your first prototpye as a lib in ./ssl_lib and than extend this class for the OS where this new lib was tested.

Further keep in mind, that properties of an class only visible inside the Interceptor-onEnter/onLeave scope when they are static.
As an alternative you could make a local variable inside the calling functions which holds an reference to the class property.

*/
export function getOffsets() {
    return offsets;
}
function load_os_specific_agent() {
    if (isWindows()) {
        log('Running Script on Windows');
        load_windows_hooking_agent();
    }
    else if (isAndroid()) {
        log('Running Script on Android');
        load_android_hooking_agent();
    }
    else if (isLinux()) {
        log('Running Script on Linux');
        load_linux_hooking_agent();
    }
    else if (isiOS()) {
        log('Running Script on iOS');
        load_ios_hooking_agent();
    }
    else if (isMacOS()) {
        log('Running Script on MacOS');
        load_macos_hooking_agent();
    }
    else {
        log('Running Script on unknown plattform');
        log("Error: not supported plattform!\nIf you want to have support for this plattform please make an issue at our github page.");
    }
}
load_os_specific_agent();
✄
{"version":3,"file":"android_agent.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/android/android_agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAC,MAAM,4BAA4B,CAAA;AAGxD,IAAI,cAAc,GAAG,OAAO,CAAC;AAC7B,IAAI,WAAW,GAAkB,cAAc,EAAE,CAAC;AAElD,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAA;AAEpC,SAAS,kBAAkB;IACvB,YAAY,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,2BAA2B,CAAC,sBAAmF;IACpH,IAAI;QACJ,MAAM,WAAW,GAAG,eAAe,CAAA;QACnC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;QACrE,IAAI,KAAK,KAAK,SAAS,EAAC;YACpB,MAAM,mCAAmC,CAAA;SAC5C;QAED,IAAI,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAA;QAClE,IAAI,MAAM,GAAG,QAAQ,CAAA;QACrB,KAAK,IAAI,EAAE,IAAI,UAAU,EAAE;YACvB,IAAI,EAAE,CAAC,IAAI,KAAK,oBAAoB,EAAE;gBAClC,MAAM,GAAG,oBAAoB,CAAA;gBAC7B,MAAK;aACR;SACJ;QAGD,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;YACtD,OAAO,EAAE,UAAU,IAAI;gBACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAC3C,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;gBAC1B,IAAI,IAAI,CAAC,UAAU,IAAI,SAAS,EAAE;oBAC9B,KAAI,IAAI,GAAG,IAAI,sBAAsB,CAAC,cAAc,CAAC,EAAC;wBAClD,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;wBAClB,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;wBACjB,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAC;4BAC5B,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,0CAA0C,CAAC,CAAA;4BACjE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;yBACxB;qBAEJ;iBACJ;YACL,CAAC;SAGJ,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAA;KACpD;IAAC,OAAO,KAAK,EAAE;QACZ,MAAM,CAAC,gBAAgB,GAAE,KAAK,CAAC,CAAA;QAC/B,GAAG,CAAC,mDAAmD,CAAC,CAAA;KAC3D;AACD,CAAC;AAED,SAAS,4BAA4B,CAAC,sBAAmF;IACrH,kBAAkB,CAAC,cAAc,EAAE,sBAAsB,EAAC,WAAW,EAAC,SAAS,CAAC,CAAA;AAEpF,CAAC;AAGD,MAAM,UAAU,0BAA0B;IACtC,sBAAsB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,EAAC,CAAC,cAAc,EAAE,cAAc,CAAC,EAAC,CAAC,iBAAiB,EAAE,cAAc,CAAC,EAAC,CAAC,kBAAkB,EAAE,eAAe,CAAC,EAAC,CAAC,qBAAqB,EAAC,WAAW,CAAC,EAAE,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC,CAAC;IACpQ,kBAAkB,EAAE,CAAC;IACrB,4BAA4B,CAAC,sBAAsB,CAAC,CAAC;IACrD,2BAA2B,CAAC,sBAAsB,CAAC,CAAC;AACxD,CAAC"}
✄
import { module_library_mapping } from "../shared/shared_structures.js";
import { getModuleNames, ssl_library_loader } from "../shared/shared_functions.js";
import { log, devlog } from "../util/log.js";
import { gnutls_execute } from "./gnutls_android.js";
import { wolfssl_execute } from "./wolfssl_android.js";
import { nss_execute } from "./nss_android.js";
import { mbedTLS_execute } from "./mbedTLS_android.js";
import { boring_execute } from "./openssl_boringssl_android.js";
import { java_execute } from "./android_java_tls_libs.js";
var plattform_name = "linux";
var moduleNames = getModuleNames();
export const socket_library = "libc";
function install_java_hooks() {
    java_execute();
}
function hook_Android_Dynamic_Loader(module_library_mapping) {
    try {
        const regex_libdl = /.*libdl.*\.so/;
        const libdl = moduleNames.find(element => element.match(regex_libdl));
        if (libdl === undefined) {
            throw "Android Dynamic loader not found!";
        }
        let dl_exports = Process.getModuleByName(libdl).enumerateExports();
        var dlopen = "dlopen";
        for (var ex of dl_exports) {
            if (ex.name === "android_dlopen_ext") {
                dlopen = "android_dlopen_ext";
                break;
            }
        }
        Interceptor.attach(Module.getExportByName(libdl, dlopen), {
            onEnter: function (args) {
                this.moduleName = args[0].readCString();
            },
            onLeave: function (retval) {
                if (this.moduleName != undefined) {
                    for (let map of module_library_mapping[plattform_name]) {
                        let regex = map[0];
                        let func = map[1];
                        if (regex.test(this.moduleName)) {
                            log(`${this.moduleName} was loaded & will be hooked on Android!`);
                            func(this.moduleName);
                        }
                    }
                }
            }
        });
        console.log(`[*] Android dynamic loader hooked.`);
    }
    catch (error) {
        devlog("Loader error: " + error);
        log("No dynamic loader present for hooking on Android.");
    }
}
function hook_native_Android_SSL_Libs(module_library_mapping) {
    ssl_library_loader(plattform_name, module_library_mapping, moduleNames, "Android");
}
export function load_android_hooking_agent() {
    module_library_mapping[plattform_name] = [[/.*libssl_sb.so/, boring_execute], [/.*libssl\.so/, boring_execute], [/.*libgnutls\.so/, gnutls_execute], [/.*libwolfssl\.so/, wolfssl_execute], [/.*libnspr[0-9]?\.so/, nss_execute], [/libmbedtls\.so.*/, mbedTLS_execute]];
    install_java_hooks();
    hook_native_Android_SSL_Libs(module_library_mapping);
    hook_Android_Dynamic_Loader(module_library_mapping);
}
✄
{"version":3,"file":"android_java_tls_libs.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/android/android_java_tls_libs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAGtD,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IAG1C,0BAA0B;QACtB,IAAI,IAAI,CAAC,SAAS,EAAE;YAChB,IAAI,CAAC,OAAO,CAAC;gBAET,4BAA4B;gBAC5B,IAAI;oBACA,oFAAoF;oBACpF,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAA;oBAC7E,GAAG,CAAC,qCAAqC,CAAC,CAAA;oBAC1C,cAAc,EAAE,CAAA;iBACnB;gBAAC,OAAO,KAAK,EAAE;oBACZ,2BAA2B;iBAC9B;YACL,CAAC,CAAC,CAAC;SACN;IACL,CAAC;IAGD,aAAa;QACT,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAClC,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC9B,CAAC;CAEJ;AAGD,MAAM,UAAU,YAAY;IACxB,IAAI,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,CAAC;AAC7B,CAAC"}
✄
import { log } from "../util/log.js";
import { execute as bouncy_execute } from "./bouncycastle.js";
import { SSL_Java } from "../ssl_lib/java_ssl_libs.js";
export class SSL_Java_Android extends SSL_Java {
    install_java_android_hooks() {
        if (Java.available) {
            Java.perform(function () {
                // Bouncycastle/Spongycastle
                try {
                    //If we can load a class of spongycastle, we know its present and we have to hook it
                    var testLoad = Java.use("org.spongycastle.jsse.provider.ProvSSLSocketDirect");
                    log("Bouncycastle/Spongycastle detected.");
                    bouncy_execute();
                }
                catch (error) {
                    //On error, just do nothing
                }
            });
        }
    }
    execute_hooks() {
        this.install_java_android_hooks();
        this.install_java_hooks();
    }
}
export function java_execute() {
    var java_ssl = new SSL_Java_Android();
    java_ssl.execute_hooks();
}
✄
{"version":3,"file":"bouncycastle.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/android/bouncycastle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAA;AAC/H,MAAM,UAAU,OAAO;IACnB,IAAI,CAAC,OAAO,CAAC;QAET,0FAA0F;QAC1F,gEAAgE;QAChE,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAA;QAChG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,cAAc,GAAG,UAAU,GAAQ,EAAE,MAAW,EAAE,GAAQ;YACvG,IAAI,MAAM,GAAkB,EAAE,CAAC;YAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC,EAAE;gBAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;aAC9B;YACD,IAAI,OAAO,GAA2B,EAAE,CAAA;YACxC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;YAClC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAA;YACtD,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;YACjD,IAAI,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,UAAU,EAAE,CAAA;YACnE,IAAI,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,EAAE,CAAA;YACjE,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,EAAE;gBAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;gBACrD,OAAO,CAAC,UAAU,CAAC,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;gBACpD,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAA;aACnC;iBAAM;gBACH,OAAO,CAAC,UAAU,CAAC,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;gBACrD,OAAO,CAAC,UAAU,CAAC,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;gBACpD,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAA;aACpC;YACD,OAAO,CAAC,gBAAgB,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;YACrG,gCAAgC;YAChC,OAAO,CAAC,UAAU,CAAC,GAAG,sBAAsB,CAAA;YAC5C,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAErB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACvC,CAAC,CAAA;QAED,IAAI,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAA;QAC9F,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,cAAc,GAAG,UAAU,GAAQ,EAAE,MAAW,EAAE,GAAQ;YACrG,IAAI,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;YAC3C,IAAI,MAAM,GAAkB,EAAE,CAAC;YAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,EAAE,CAAC,EAAE;gBAChC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;aAC9B;YACD,IAAI,OAAO,GAA2B,EAAE,CAAA;YACxC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;YAClC,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAA;YAChC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;YACjD,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAA;YACtD,IAAI,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,UAAU,EAAE,CAAA;YACnE,IAAI,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,EAAE,CAAA;YACjE,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,EAAE;gBAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;gBACpD,OAAO,CAAC,UAAU,CAAC,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;gBACrD,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAA;aACnC;iBAAM;gBACH,OAAO,CAAC,UAAU,CAAC,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;gBACpD,OAAO,CAAC,UAAU,CAAC,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;gBACrD,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAA;aACpC;YACD,OAAO,CAAC,gBAAgB,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;YACrG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAA;YAC9B,OAAO,CAAC,UAAU,CAAC,GAAG,qBAAqB,CAAA;YAC3C,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAErB,OAAO,SAAS,CAAA;QACpB,CAAC,CAAA;QACD,iEAAiE;QACjE,IAAI,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAA;QACxF,mBAAmB,CAAC,uBAAuB,CAAC,cAAc,GAAG,UAAU,CAAM;YAEzE,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAA;YAClC,IAAI,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAA;YAC1D,IAAI,YAAY,GAAG,kBAAkB,CAAC,YAAY,CAAC,KAAK,CAAA;YACxD,IAAI,eAAe,GAAG,YAAY,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YAEtE,2FAA2F;YAC3F,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YACvC,IAAI,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;YAChH,oBAAoB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;YACxC,IAAI,wBAAwB,GAAG,oBAAoB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;YACxE,IAAI,OAAO,GAA2B,EAAE,CAAA;YACxC,OAAO,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAA;YACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,gBAAgB,GAAG,iBAAiB,CAAC,YAAY,CAAC,GAAG,GAAG,GAAG,2BAA2B,CAAC,wBAAwB,CAAC,CAAA;YACpI,IAAI,CAAC,OAAO,CAAC,CAAA;YACb,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAA;QAC1C,CAAC,CAAA;IAEL,CAAC,CAAC,CAAA;AAEN,CAAC"}
✄
import { log } from "../util/log.js";
import { byteArrayToString, byteArrayToNumber, getAttribute, reflectionByteArrayToString } from "../shared/shared_functions.js";
export function execute() {
    Java.perform(function () {
        //Hook the inner class "AppDataOutput/input" of ProvSSLSocketDirect, so we can access the 
        //socket information in its outer class by accessing this.this$0
        var appDataOutput = Java.use("org.spongycastle.jsse.provider.ProvSSLSocketDirect$AppDataOutput");
        appDataOutput.write.overload('[B', 'int', 'int').implementation = function (buf, offset, len) {
            var result = [];
            for (var i = 0; i < len; ++i) {
                result.push(buf[i] & 0xff);
            }
            var message = {};
            message["contentType"] = "datalog";
            message["src_port"] = this.this$0.value.getLocalPort();
            message["dst_port"] = this.this$0.value.getPort();
            var localAddress = this.this$0.value.getLocalAddress().getAddress();
            var inetAddress = this.this$0.value.getInetAddress().getAddress();
            if (localAddress.length == 4) {
                message["src_addr"] = byteArrayToNumber(localAddress);
                message["dst_addr"] = byteArrayToNumber(inetAddress);
                message["ss_family"] = "AF_INET";
            }
            else {
                message["src_addr"] = byteArrayToString(localAddress);
                message["dst_addr"] = byteArrayToString(inetAddress);
                message["ss_family"] = "AF_INET6";
            }
            message["ssl_session_id"] = byteArrayToString(this.this$0.value.getConnection().getSession().getId());
            //log(message["ssl_session_id"])
            message["function"] = "writeApplicationData";
            send(message, result);
            return this.write(buf, offset, len);
        };
        var appDataInput = Java.use("org.spongycastle.jsse.provider.ProvSSLSocketDirect$AppDataInput");
        appDataInput.read.overload('[B', 'int', 'int').implementation = function (buf, offset, len) {
            var bytesRead = this.read(buf, offset, len);
            var result = [];
            for (var i = 0; i < bytesRead; ++i) {
                result.push(buf[i] & 0xff);
            }
            var message = {};
            message["contentType"] = "datalog";
            message["ss_family"] = "AF_INET";
            message["src_port"] = this.this$0.value.getPort();
            message["dst_port"] = this.this$0.value.getLocalPort();
            var localAddress = this.this$0.value.getLocalAddress().getAddress();
            var inetAddress = this.this$0.value.getInetAddress().getAddress();
            if (localAddress.length == 4) {
                message["src_addr"] = byteArrayToNumber(inetAddress);
                message["dst_addr"] = byteArrayToNumber(localAddress);
                message["ss_family"] = "AF_INET";
            }
            else {
                message["src_addr"] = byteArrayToString(inetAddress);
                message["dst_addr"] = byteArrayToString(localAddress);
                message["ss_family"] = "AF_INET6";
            }
            message["ssl_session_id"] = byteArrayToString(this.this$0.value.getConnection().getSession().getId());
            log(message["ssl_session_id"]);
            message["function"] = "readApplicationData";
            send(message, result);
            return bytesRead;
        };
        //Hook the handshake to read the client random and the master key
        var ProvSSLSocketDirect = Java.use("org.spongycastle.jsse.provider.ProvSSLSocketDirect");
        ProvSSLSocketDirect.notifyHandshakeComplete.implementation = function (x) {
            var protocol = this.protocol.value;
            var securityParameters = protocol.securityParameters.value;
            var clientRandom = securityParameters.clientRandom.value;
            var masterSecretObj = getAttribute(securityParameters, "masterSecret");
            //The key is in the AbstractTlsSecret, so we need to access the superclass to get the field
            var clazz = Java.use("java.lang.Class");
            var masterSecretRawField = Java.cast(masterSecretObj.getClass(), clazz).getSuperclass().getDeclaredField("data");
            masterSecretRawField.setAccessible(true);
            var masterSecretReflectArray = masterSecretRawField.get(masterSecretObj);
            var message = {};
            message["contentType"] = "keylog";
            message["keylog"] = "CLIENT_RANDOM " + byteArrayToString(clientRandom) + " " + reflectionByteArrayToString(masterSecretReflectArray);
            send(message);
            return this.notifyHandshakeComplete(x);
        };
    });
}
✄
{"version":3,"file":"conscrypt.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/android/conscrypt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AAEpC,SAAS,qCAAqC,CAAC,kBAAgC,EAAE,oBAAyB;IAEtG,IAAI,qBAAqB,GAAG,IAAI,CAAA;IAChC,IAAI,YAAY,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAA;IACnD,KAAK,IAAI,EAAE,IAAI,YAAY,EAAE;QACzB,IAAI;YACA,IAAI,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5C,qBAAqB,GAAG,YAAY,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAA;YACxG,MAAK;SACR;QAAC,OAAO,KAAK,EAAE;YACZ,0BAA0B;SAC7B;KAEJ;IACD,kEAAkE;IAClE,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,cAAc,GAAG,oBAAoB,CAAA;IAE/F,OAAO,qBAAqB,CAAA;AAChC,CAAC;AAED,MAAM,UAAU,OAAO;IAEnB,mFAAmF;IACnF,IAAI,CAAC,OAAO,CAAC;QACT,sCAAsC;QACtC,IAAI,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;QACvD,IAAI,oBAAoB,GAAG,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,cAAc,CAAA;QAChG,+GAA+G;QAC/G,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,cAAc,GAAG,UAAU,SAAiB;YAC/F,IAAI,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YACtC,IAAI,SAAS,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE;gBAC7C,GAAG,CAAC,0CAA0C,CAAC,CAAA;gBAC/C,IAAI,qBAAqB,GAAG,qCAAqC,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAA;gBACxG,IAAI,qBAAqB,KAAK,IAAI,EAAE;oBAChC,GAAG,CAAC,uEAAuE,CAAC,CAAA;iBAC/E;qBAAM;oBACH,qBAAqB,CAAC,cAAc,CAAC,cAAc,GAAG;wBAClD,GAAG,CAAC,4CAA4C,CAAC,CAAA;oBAErD,CAAC,CAAA;iBAEJ;aACJ;YACD,OAAO,MAAM,CAAA;QACjB,CAAC,CAAA;QAED,kCAAkC;QAClC,IAAI;YACA,IAAI,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAA;YACrF,iBAAiB,CAAC,eAAe,CAAC,cAAc,GAAG,UAAU,OAAY;gBACrE,GAAG,CAAC,wCAAwC,CAAC,CAAA;YACjD,CAAC,CAAA;YACD,iBAAiB,CAAC,oBAAoB,CAAC,cAAc,GAAG,UAAU,OAAY,EAAE,QAAa;gBACzF,GAAG,CAAC,wCAAwC,CAAC,CAAA;gBAC7C,QAAQ,CAAC,mBAAmB,EAAE,CAAA;YAClC,CAAC,CAAA;SACJ;QAAC,OAAO,KAAK,EAAE;YACZ,qCAAqC;SACxC;IACL,CAAC,CAAC,CAAA;AAIN,CAAC"}
✄
import { log } from "../util/log.js";
function findProviderInstallerFromClassloaders(currentClassLoader, backupImplementation) {
    var providerInstallerImpl = null;
    var classLoaders = Java.enumerateClassLoadersSync();
    for (var cl of classLoaders) {
        try {
            var classFactory = Java.ClassFactory.get(cl);
            providerInstallerImpl = classFactory.use("com.google.android.gms.common.security.ProviderInstallerImpl");
            break;
        }
        catch (error) {
            // On error we return null
        }
    }
    //Revert the implementation to avoid an infinitloop of "Loadclass"
    currentClassLoader.loadClass.overload("java.lang.String").implementation = backupImplementation;
    return providerInstallerImpl;
}
export function execute() {
    //We have to hook multiple entrypoints: ProviderInstallerImpl and ProviderInstaller
    Java.perform(function () {
        //Part one: Hook ProviderInstallerImpl
        var javaClassLoader = Java.use("java.lang.ClassLoader");
        var backupImplementation = javaClassLoader.loadClass.overload("java.lang.String").implementation;
        //The classloader for ProviderInstallerImpl might not be present on startup, so we hook the loadClass method.  
        javaClassLoader.loadClass.overload("java.lang.String").implementation = function (className) {
            let retval = this.loadClass(className);
            if (className.endsWith("ProviderInstallerImpl")) {
                log("Process is loading ProviderInstallerImpl");
                var providerInstallerImpl = findProviderInstallerFromClassloaders(javaClassLoader, backupImplementation);
                if (providerInstallerImpl === null) {
                    log("ProviderInstallerImpl could not be found, although it has been loaded");
                }
                else {
                    providerInstallerImpl.insertProvider.implementation = function () {
                        log("ProviderinstallerImpl redirection/blocking");
                    };
                }
            }
            return retval;
        };
        //Part two: Hook Providerinstaller
        try {
            var providerInstaller = Java.use("com.google.android.gms.security.ProviderInstaller");
            providerInstaller.installIfNeeded.implementation = function (context) {
                log("Providerinstaller redirection/blocking");
            };
            providerInstaller.installIfNeededAsync.implementation = function (context, callback) {
                log("Providerinstaller redirection/blocking");
                callback.onProviderInstalled();
            };
        }
        catch (error) {
            // As it is not available, do nothing
        }
    });
}
✄
{"version":3,"file":"gnutls_android.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/android/gnutls_android.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,OAAO,YAAa,SAAQ,MAAM;IAEpC,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,KAAK,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;QADlB,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAElE,CAAC;IAGD,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACpC,IAAI,CAAC,8BAA8B,EAAE,CAAC;IAC1C,CAAC;IAED,8BAA8B;QAC1B,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EACpD;YACI,OAAO,EAAE,UAAU,IAAS;gBACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;gBAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACzB,MAAM,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,eAAe,CAAC,CAAA;YAEjG,CAAC;SACJ,CAAC,CAAA;IAEF,CAAC;CACJ;AAGD,MAAM,UAAU,cAAc,CAAC,UAAiB;IAC5C,IAAI,UAAU,GAAG,IAAI,YAAY,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IAC7D,UAAU,CAAC,aAAa,EAAE,CAAC;AAG/B,CAAC"}
✄
import { GnuTLS } from "../ssl_lib/gnutls.js";
import { socket_library } from "./android_agent.js";
export class GnuTLS_Linux extends GnuTLS {
    constructor(moduleName, socket_library) {
        super(moduleName, socket_library);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        this.install_tls_keys_callback_hook();
    }
    install_tls_keys_callback_hook() {
        Interceptor.attach(this.addresses["gnutls_init"], {
            onEnter: function (args) {
                this.session = args[0];
            },
            onLeave: function (retval) {
                console.log(this.session);
                GnuTLS.gnutls_session_set_keylog_function(this.session.readPointer(), GnuTLS.keylog_callback);
            }
        });
    }
}
export function gnutls_execute(moduleName) {
    var gnutls_ssl = new GnuTLS_Linux(moduleName, socket_library);
    gnutls_ssl.execute_hooks();
}
✄
{"version":3,"file":"mbedTLS_android.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/android/mbedTLS_android.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IAE1C,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,KAAK,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;QADlB,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAElE,CAAC;IAED;;;;;;MAME;IACF,8BAA8B;QAC1B,8BAA8B;IAClC,CAAC;IAED,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;IACxC,CAAC;CAEJ;AAGD,MAAM,UAAU,eAAe,CAAC,UAAiB;IAC7C,IAAI,WAAW,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IAClE,WAAW,CAAC,aAAa,EAAE,CAAC;AAGhC,CAAC"}
✄
import { mbed_TLS } from "../ssl_lib/mbedTLS.js";
import { socket_library } from "./android_agent.js";
export class mbed_TLS_Android extends mbed_TLS {
    constructor(moduleName, socket_library) {
        super(moduleName, socket_library);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    /*
    SSL_CTX_set_keylog_callback not exported by default on windows.

    We need to find a way to install the callback function for doing that

    Alternatives?:SSL_export_keying_material, SSL_SESSION_get_master_key
    */
    install_tls_keys_callback_hook() {
        // install hooking for windows
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
    }
}
export function mbedTLS_execute(moduleName) {
    var mbedTLS_ssl = new mbed_TLS_Android(moduleName, socket_library);
    mbedTLS_ssl.execute_hooks();
}
✄
{"version":3,"file":"nss_android.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/android/nss_android.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,OAAO,WAAY,SAAQ,GAAG;IAEhC,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,IAAI,sBAAsB,GAAqC,EAAE,CAAC;QAClE,sBAAsB,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,CAAC,CAAA;QAC9K,sBAAsB,CAAC,UAAU,CAAC,GAAG,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,CAAA;QAChF,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAA;QACrG,sBAAsB,CAAC,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QAEhG,KAAK,CAAC,UAAU,EAAC,cAAc,EAAC,sBAAsB,CAAC,CAAC;QAPzC,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAQlE,CAAC;IAGD,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACpC,sDAAsD;IAC1D,CAAC;CAEJ;AAGD,MAAM,UAAU,WAAW,CAAC,UAAiB;IACzC,IAAI,OAAO,GAAG,IAAI,WAAW,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IACzD,OAAO,CAAC,aAAa,EAAE,CAAC;AAG5B,CAAC"}
✄
import { NSS } from "../ssl_lib/nss.js";
import { socket_library } from "./android_agent.js";
export class NSS_Android extends NSS {
    constructor(moduleName, socket_library) {
        var library_method_mapping = {};
        library_method_mapping[`*${moduleName}*`] = ["PR_Write", "PR_Read", "PR_FileDesc2NativeHandle", "PR_GetPeerName", "PR_GetSockName", "PR_GetNameForIdentity", "PR_GetDescType"];
        library_method_mapping[`*libnss*`] = ["PK11_ExtractKeyValue", "PK11_GetKeyData"];
        library_method_mapping["*libssl*.so"] = ["SSL_ImportFD", "SSL_GetSessionID", "SSL_HandshakeCallback"];
        library_method_mapping[`*${socket_library}*`] = ["getpeername", "getsockname", "ntohs", "ntohl"];
        super(moduleName, socket_library, library_method_mapping);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        //this.install_tls_keys_callback_hook() // might fail 
    }
}
export function nss_execute(moduleName) {
    var nss_ssl = new NSS_Android(moduleName, socket_library);
    nss_ssl.execute_hooks();
}
✄
{"version":3,"file":"openssl_boringssl_android.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/android/openssl_boringssl_android.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,OAAO,yBAA0B,SAAQ,iBAAiB;IAE5D,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,KAAK,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;QADlB,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAElE,CAAC;IAGD,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACpC,IAAI,CAAC,8BAA8B,EAAE,CAAC;IAC1C,CAAC;IAED,8BAA8B;QAE1B,iBAAiB,CAAC,2BAA2B,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;QAEjJ,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAC5C;YACI,OAAO,EAAE,UAAU,IAAS;gBACxB,iBAAiB,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAA;YAC7F,CAAC;SAEJ,CAAC,CAAA;IACN,CAAC;CAEJ;AAGD,MAAM,UAAU,cAAc,CAAC,UAAiB;IAC5C,IAAI,UAAU,GAAG,IAAI,yBAAyB,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IAC1E,UAAU,CAAC,aAAa,EAAE,CAAC;AAG/B,CAAC"}
✄
import { OpenSSL_BoringSSL } from "../ssl_lib/openssl_boringssl.js";
import { socket_library } from "./android_agent.js";
export class OpenSSL_BoringSSL_Android extends OpenSSL_BoringSSL {
    constructor(moduleName, socket_library) {
        super(moduleName, socket_library);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        this.install_tls_keys_callback_hook();
    }
    install_tls_keys_callback_hook() {
        OpenSSL_BoringSSL.SSL_CTX_set_keylog_callback = new NativeFunction(this.addresses["SSL_CTX_set_keylog_callback"], "void", ["pointer", "pointer"]);
        Interceptor.attach(this.addresses["SSL_new"], {
            onEnter: function (args) {
                OpenSSL_BoringSSL.SSL_CTX_set_keylog_callback(args[0], OpenSSL_BoringSSL.keylog_callback);
            }
        });
    }
}
export function boring_execute(moduleName) {
    var boring_ssl = new OpenSSL_BoringSSL_Android(moduleName, socket_library);
    boring_ssl.execute_hooks();
}
✄
{"version":3,"file":"wolfssl_android.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/android/wolfssl_android.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAE3D,MAAM,OAAO,eAAgB,SAAQ,OAAO;IAExC,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,KAAK,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;QADlB,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAElE,CAAC;IAGD,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACpC,IAAI,CAAC,8BAA8B,EAAE,CAAC;IAC1C,CAAC;IAED,8BAA8B;QAC1B,OAAO,CAAC,yBAAyB,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAAC,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAE,CAAA;QACzI,OAAO,CAAC,yBAAyB,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAAC,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAE,CAAA;QACzI,sFAAsF;QACtF,OAAO,CAAC,8BAA8B,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,gCAAgC,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAA;QAEnJ,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAC;YACjD,OAAO,EAAE,UAAS,IAAS;gBACvB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACtB,CAAC;YACD,OAAO,EAAE,UAAS,MAAW;gBACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAkB,CAAA;gBAErE,IAAI,UAAU,GAAG,EAAE,CAAC;gBAEpB,sFAAsF;gBACtF,IAAI,0BAA0B,GAAG,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAW,CAAA;gBAEnG,IAAI,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;gBAC3D,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,0BAA0B,CAAC,CAAA;gBACrF,IAAI,WAAW,GAAG,YAAY,CAAC,aAAa,CAAC,0BAA0B,CAAC,CAAA;gBACxE,UAAU,GAAG,GAAG,UAAU,kBAAkB,WAAW,CAAC,WAAW,CAAC,IAAI,CAAA;gBAExE,sFAAsF;gBACtF,IAAI,0BAA0B,GAAG,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAW,CAAA;gBACnG,IAAI,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;gBAC3D,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,0BAA0B,CAAC,CAAA;gBACrF,IAAI,WAAW,GAAG,YAAY,CAAC,aAAa,CAAC,0BAA0B,CAAC,CAAA;gBACxE,UAAU,GAAG,GAAG,UAAU,kBAAkB,WAAW,CAAC,WAAW,CAAC,IAAI,CAAA;gBAExE,sFAAsF;gBACtF,IAAI,uBAAuB,GAAG,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAW,CAAA;gBACrG,IAAI,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;gBACxD,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAA;gBAC3F,IAAI,WAAW,GAAG,YAAY,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAA;gBACrE,UAAU,GAAG,GAAG,UAAU,eAAe,WAAW,CAAC,WAAW,CAAC,IAAI,CAAA;gBAGrE,IAAI,OAAO,GAA8C,EAAE,CAAA;gBAC3D,OAAO,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAA;gBACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAA;gBAC9B,IAAI,CAAC,OAAO,CAAC,CAAA;YAEjB,CAAC;SACJ,CAAC,CAAA;IACN,CAAC;CAGJ;AAGD,MAAM,UAAU,eAAe,CAAC,UAAiB;IAC7C,IAAI,QAAQ,GAAG,IAAI,eAAe,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IAC9D,QAAQ,CAAC,aAAa,EAAE,CAAC;AAG7B,CAAC"}
✄
import { WolfSSL } from "../ssl_lib/wolfssl.js";
import { socket_library } from "./android_agent.js";
import { toHexString } from "../shared/shared_functions.js";
export class WolfSSL_Android extends WolfSSL {
    constructor(moduleName, socket_library) {
        super(moduleName, socket_library);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        this.install_tls_keys_callback_hook();
    }
    install_tls_keys_callback_hook() {
        WolfSSL.wolfSSL_get_client_random = new NativeFunction(this.addresses["wolfSSL_get_client_random"], "int", ["pointer", "pointer", "int"]);
        WolfSSL.wolfSSL_get_server_random = new NativeFunction(this.addresses["wolfSSL_get_server_random"], "int", ["pointer", "pointer", "int"]);
        //https://www.wolfssl.com/doxygen/group__Setup.html#gaf18a029cfeb3150bc245ce66b0a44758
        WolfSSL.wolfSSL_SESSION_get_master_key = new NativeFunction(this.addresses["wolfSSL_SESSION_get_master_key"], "int", ["pointer", "pointer", "int"]);
        Interceptor.attach(this.addresses["wolfSSL_connect"], {
            onEnter: function (args) {
                this.ssl = args[0];
            },
            onLeave: function (retval) {
                this.session = WolfSSL.wolfSSL_get_session(this.ssl);
                var keysString = "";
                //https://www.wolfssl.com/doxygen/group__Setup.html#ga927e37dc840c228532efa0aa9bbec451
                var requiredClientRandomLength = WolfSSL.wolfSSL_get_client_random(this.session, NULL, 0);
                var clientBuffer = Memory.alloc(requiredClientRandomLength);
                WolfSSL.wolfSSL_get_client_random(this.ssl, clientBuffer, requiredClientRandomLength);
                var clientBytes = clientBuffer.readByteArray(requiredClientRandomLength);
                keysString = `${keysString}CLIENT_RANDOM: ${toHexString(clientBytes)}\n`;
                //https://www.wolfssl.com/doxygen/group__Setup.html#ga987035fc600ba9e3b02e2b2718a16a6c
                var requiredServerRandomLength = WolfSSL.wolfSSL_get_server_random(this.session, NULL, 0);
                var serverBuffer = Memory.alloc(requiredServerRandomLength);
                WolfSSL.wolfSSL_get_server_random(this.ssl, serverBuffer, requiredServerRandomLength);
                var serverBytes = serverBuffer.readByteArray(requiredServerRandomLength);
                keysString = `${keysString}SERVER_RANDOM: ${toHexString(serverBytes)}\n`;
                //https://www.wolfssl.com/doxygen/group__Setup.html#gaf18a029cfeb3150bc245ce66b0a44758
                var requiredMasterKeyLength = WolfSSL.wolfSSL_SESSION_get_master_key(this.session, NULL, 0);
                var masterBuffer = Memory.alloc(requiredMasterKeyLength);
                WolfSSL.wolfSSL_SESSION_get_master_key(this.session, masterBuffer, requiredMasterKeyLength);
                var masterBytes = masterBuffer.readByteArray(requiredMasterKeyLength);
                keysString = `${keysString}MASTER_KEY: ${toHexString(masterBytes)}\n`;
                var message = {};
                message["contentType"] = "keylog";
                message["keylog"] = keysString;
                send(message);
            }
        });
    }
}
export function wolfssl_execute(moduleName) {
    var wolf_ssl = new WolfSSL_Android(moduleName, socket_library);
    wolf_ssl.execute_hooks();
}
✄
{"version":3,"file":"ios_agent.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/ios/ios_agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAG3D,IAAI,cAAc,GAAG,QAAQ,CAAC;AAC9B,IAAI,WAAW,GAAkB,cAAc,EAAE,CAAA;AAEjD,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAA;AAGjD,SAAS,uBAAuB,CAAC,sBAAmF;IAChH,IAAI;QACA,MAAM,WAAW,GAAG,mBAAmB,CAAA;QACvC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;QACrE,IAAI,KAAK,KAAK,SAAS,EAAE;YACrB,MAAM,kCAAkC,CAAA;SAC3C;QAED,IAAI,MAAM,GAAG,QAAQ,CAAA;QAErB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;YACtD,OAAO,EAAE,UAAU,IAAI;gBACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAC3C,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;gBAC1B,IAAI,IAAI,CAAC,UAAU,IAAI,SAAS,EAAE;oBAC9B,KAAK,IAAI,GAAG,IAAI,sBAAsB,CAAC,cAAc,CAAC,EAAE;wBACpD,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;wBAClB,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;wBACjB,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;4BAC7B,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,sCAAsC,CAAC,CAAA;4BAC7D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;yBACxB;qBAEJ;iBACJ;YACL,CAAC;SAGJ,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;KAChD;IAAC,OAAO,KAAK,EAAE;QACZ,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAA;QAChC,GAAG,CAAC,+CAA+C,CAAC,CAAA;KACvD;AACL,CAAC;AAGD,SAAS,iBAAiB,CAAC,sBAAmF;IAC1G,kBAAkB,CAAC,cAAc,EAAE,sBAAsB,EAAC,WAAW,EAAC,KAAK,CAAC,CAAA;AAChF,CAAC;AAID,MAAM,UAAU,sBAAsB;IAClC,sBAAsB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,uBAAuB,EAAE,cAAc,CAAC,CAAC,CAAA;IACpF,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;IAC1C,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;AACpD,CAAC"}
✄
import { module_library_mapping } from "../shared/shared_structures.js";
import { log, devlog } from "../util/log.js";
import { getModuleNames, ssl_library_loader } from "../shared/shared_functions.js";
import { boring_execute } from "./openssl_boringssl_ios.js";
var plattform_name = "darwin";
var moduleNames = getModuleNames();
export const socket_library = "libSystem.B.dylib";
function hook_iOS_Dynamic_Loader(module_library_mapping) {
    try {
        const regex_libdl = /libSystem.B.dylib/;
        const libdl = moduleNames.find(element => element.match(regex_libdl));
        if (libdl === undefined) {
            throw "Darwin Dynamic loader not found!";
        }
        var dlopen = "dlopen";
        Interceptor.attach(Module.getExportByName(libdl, dlopen), {
            onEnter: function (args) {
                this.moduleName = args[0].readCString();
            },
            onLeave: function (retval) {
                if (this.moduleName != undefined) {
                    for (let map of module_library_mapping[plattform_name]) {
                        let regex = map[0];
                        let func = map[1];
                        if (regex.test(this.moduleName)) {
                            log(`${this.moduleName} was loaded & will be hooked on iOS!`);
                            func(this.moduleName);
                        }
                    }
                }
            }
        });
        console.log(`[*] iOS dynamic loader hooked.`);
    }
    catch (error) {
        devlog("Loader error: " + error);
        log("No dynamic loader present for hooking on iOS.");
    }
}
function hook_iOS_SSL_Libs(module_library_mapping) {
    ssl_library_loader(plattform_name, module_library_mapping, moduleNames, "iOS");
}
export function load_ios_hooking_agent() {
    module_library_mapping[plattform_name] = [[/.*libboringssl\.dylib/, boring_execute]];
    hook_iOS_SSL_Libs(module_library_mapping);
    hook_iOS_Dynamic_Loader(module_library_mapping);
}
✄
{"version":3,"file":"openssl_boringssl_ios.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/ios/openssl_boringssl_ios.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAO,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAE5C,MAAM,OAAO,qBAAsB,SAAQ,iBAAiB;IA0BxD,YAAmB,UAAiB,EAAS,cAAqB;QAE9D,IAAI,sBAAsB,GAAqC,EAAE,CAAA;QAEjE,yIAAyI;QACzI,sBAAsB,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAA;QACpK,sBAAsB,CAAC,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA,CAAC,kFAAkF;QAEvL,KAAK,CAAC,UAAU,EAAC,cAAc,EAAC,sBAAsB,CAAC,CAAC;QARzC,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IASlE,CAAC;IAjCD,8BAA8B;QAC1B,yGAAyG;QACzG,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,0EAA0E;YAC5F,IAAI,eAAe,GAAG,KAAK,CAAC;YAE5B,IAAI,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,EAAE,UAAU,EAAE,CAAC;YACjH,IAAG,gBAAgB,IAAI,SAAS,EAAC;gBAC7B,MAAM,CAAC,kCAAkC,CAAC,CAAC;gBAC3C,eAAe,GAAG,KAAK,CAAC;aAC3B;iBAAK,IAAI,gBAAgB,IAAI,QAAQ,EAAE;gBACpC,MAAM,CAAC,mCAAmC,CAAC,CAAC;gBAC5C,eAAe,GAAG,KAAK,CAAC,CAAC,eAAe;aAC3C;YACD,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAAE;gBAC9D,OAAO,EAAE,UAAU,IAAU;oBAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;gBACpF,CAAC;aACF,CAAC,CAAC;SAEJ;IAEP,CAAC;IAcD,aAAa;QAET;;;;UAIE;QAEF,IAAI,CAAC,8BAA8B,EAAE,CAAC;IAC1C,CAAC;CAIJ;AAGD,MAAM,UAAU,cAAc,CAAC,UAAiB;IAC5C,IAAI,UAAU,GAAG,IAAI,qBAAqB,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IACtE,UAAU,CAAC,aAAa,EAAE,CAAC;AAG/B,CAAC"}
✄
import { OpenSSL_BoringSSL } from "../ssl_lib/openssl_boringssl.js";
import { socket_library } from "./ios_agent.js";
import { devlog } from "../util/log.js";
export class OpenSSL_BoringSSL_iOS extends OpenSSL_BoringSSL {
    constructor(moduleName, socket_library) {
        var library_method_mapping = {};
        // the iOS implementation needs some further improvements - currently we are not able to get the sockfd from an SSL_read/write invocation
        library_method_mapping[`*${moduleName}*`] = ["SSL_read", "SSL_write", "BIO_get_fd", "SSL_get_session", "SSL_SESSION_get_id", "SSL_new", "SSL_CTX_set_info_callback"];
        library_method_mapping[`*${socket_library}*`] = ["getpeername*", "getsockname*", "ntohs*", "ntohl*"]; // currently those functions gets only identified if we at an asterisk at the end 
        super(moduleName, socket_library, library_method_mapping);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    install_tls_keys_callback_hook() {
        //console.log(this.addresses) // currently only for debugging purposes will be removed in future releases
        if (ObjC.available) { // inspired from https://codeshare.frida.re/@andydavies/ios-tls-keylogger/
            var CALLBACK_OFFSET = 0x2A8;
            var foundationNumber = Module.findExportByName('CoreFoundation', 'kCFCoreFoundationVersionNumber')?.readDouble();
            if (foundationNumber == undefined) {
                devlog("Installing callback for iOS < 14");
                CALLBACK_OFFSET = 0x2A8;
            }
            else if (foundationNumber >= 1751.108) {
                devlog("Installing callback for iOS >= 14");
                CALLBACK_OFFSET = 0x2B8; // >= iOS 14.x 
            }
            Interceptor.attach(this.addresses["SSL_CTX_set_info_callback"], {
                onEnter: function (args) {
                    ptr(args[0]).add(CALLBACK_OFFSET).writePointer(OpenSSL_BoringSSL.keylog_callback);
                }
            });
        }
    }
    execute_hooks() {
        /*
        currently these function hooks aren't implemented
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        */
        this.install_tls_keys_callback_hook();
    }
}
export function boring_execute(moduleName) {
    var boring_ssl = new OpenSSL_BoringSSL_iOS(moduleName, socket_library);
    boring_ssl.execute_hooks();
}
✄
{"version":3,"file":"gnutls_linux.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/linux/gnutls_linux.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,OAAO,YAAa,SAAQ,MAAM;IAEpC,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,KAAK,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;QADlB,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAElE,CAAC;IAGD,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACpC,IAAI,CAAC,8BAA8B,EAAE,CAAC;IAC1C,CAAC;IAED,8BAA8B;QAC1B,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EACpD;YACI,OAAO,EAAE,UAAU,IAAS;gBACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;gBAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACzB,MAAM,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,eAAe,CAAC,CAAA;YAEjG,CAAC;SACJ,CAAC,CAAA;IAEF,CAAC;CAEJ;AAKD,MAAM,UAAU,cAAc,CAAC,UAAiB;IAC5C,IAAI,UAAU,GAAG,IAAI,YAAY,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IAC7D,UAAU,CAAC,aAAa,EAAE,CAAC;AAG/B,CAAC"}
✄
import { GnuTLS } from "../ssl_lib/gnutls.js";
import { socket_library } from "./linux_agent.js";
export class GnuTLS_Linux extends GnuTLS {
    constructor(moduleName, socket_library) {
        super(moduleName, socket_library);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        this.install_tls_keys_callback_hook();
    }
    install_tls_keys_callback_hook() {
        Interceptor.attach(this.addresses["gnutls_init"], {
            onEnter: function (args) {
                this.session = args[0];
            },
            onLeave: function (retval) {
                console.log(this.session);
                GnuTLS.gnutls_session_set_keylog_function(this.session.readPointer(), GnuTLS.keylog_callback);
            }
        });
    }
}
export function gnutls_execute(moduleName) {
    var gnutls_ssl = new GnuTLS_Linux(moduleName, socket_library);
    gnutls_ssl.execute_hooks();
}
✄
{"version":3,"file":"linux_agent.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/linux/linux_agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAE7D,IAAI,cAAc,GAAG,OAAO,CAAC;AAC7B,IAAI,WAAW,GAAkB,cAAc,EAAE,CAAA;AAEjD,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAA;AAEpC,SAAS,yBAAyB,CAAC,sBAAmF;IAClH,IAAI;QACA,MAAM,WAAW,GAAG,eAAe,CAAA;QACnC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;QACrE,IAAI,KAAK,KAAK,SAAS,EAAE;YACrB,MAAM,iCAAiC,CAAA;SAC1C;QAED,IAAI,MAAM,GAAG,QAAQ,CAAA;QAErB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;YACtD,OAAO,EAAE,UAAU,IAAI;gBACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAC3C,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;gBAC1B,IAAI,IAAI,CAAC,UAAU,IAAI,SAAS,EAAE;oBAC9B,KAAK,IAAI,GAAG,IAAI,sBAAsB,CAAC,cAAc,CAAC,EAAE;wBACpD,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;wBAClB,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;wBACjB,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;4BAC7B,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,wCAAwC,CAAC,CAAA;4BAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;yBACxB;qBAEJ;iBACJ;YACL,CAAC;SAGJ,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;KAClD;IAAC,OAAO,KAAK,EAAE;QACZ,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAA;QAChC,GAAG,CAAC,wCAAwC,CAAC,CAAA;KAChD;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,sBAAmF;IAC5G,kBAAkB,CAAC,cAAc,EAAE,sBAAsB,EAAC,WAAW,EAAC,OAAO,CAAC,CAAA;AAClF,CAAC;AAGD,MAAM,UAAU,wBAAwB;IACpC,sBAAsB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC,EAAE,CAAC,kBAAkB,EAAE,eAAe,CAAC,EAAE,CAAC,qBAAqB,EAAE,WAAW,CAAC,EAAE,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC,CAAA;IACxQ,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;IAC5C,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;AACtD,CAAC"}
✄
import { module_library_mapping } from "../shared/shared_structures.js";
import { log, devlog } from "../util/log.js";
import { getModuleNames, ssl_library_loader } from "../shared/shared_functions.js";
import { gnutls_execute } from "./gnutls_linux.js";
import { wolfssl_execute } from "./wolfssl_linux.js";
import { nss_execute } from "./nss_linux.js";
import { mbedTLS_execute } from "./mbedTLS_linux.js";
import { boring_execute } from "./openssl_boringssl_linux.js";
var plattform_name = "linux";
var moduleNames = getModuleNames();
export const socket_library = "libc";
function hook_Linux_Dynamic_Loader(module_library_mapping) {
    try {
        const regex_libdl = /.*libdl.*\.so/;
        const libdl = moduleNames.find(element => element.match(regex_libdl));
        if (libdl === undefined) {
            throw "Linux Dynamic loader not found!";
        }
        var dlopen = "dlopen";
        Interceptor.attach(Module.getExportByName(libdl, dlopen), {
            onEnter: function (args) {
                this.moduleName = args[0].readCString();
            },
            onLeave: function (retval) {
                if (this.moduleName != undefined) {
                    for (let map of module_library_mapping[plattform_name]) {
                        let regex = map[0];
                        let func = map[1];
                        if (regex.test(this.moduleName)) {
                            log(`${this.moduleName} was loaded & will be hooked on Linux!`);
                            func(this.moduleName);
                        }
                    }
                }
            }
        });
        console.log(`[*] Linux dynamic loader hooked.`);
    }
    catch (error) {
        devlog("Loader error: " + error);
        log("No dynamic loader present for hooking.");
    }
}
function hook_Linux_SSL_Libs(module_library_mapping) {
    ssl_library_loader(plattform_name, module_library_mapping, moduleNames, "Linux");
}
export function load_linux_hooking_agent() {
    module_library_mapping[plattform_name] = [[/.*libssl_sb.so/, boring_execute], [/.*libssl\.so/, boring_execute], [/.*libgnutls\.so/, gnutls_execute], [/.*libwolfssl\.so/, wolfssl_execute], [/.*libnspr[0-9]?\.so/, nss_execute], [/libmbedtls\.so.*/, mbedTLS_execute]];
    hook_Linux_SSL_Libs(module_library_mapping);
    hook_Linux_Dynamic_Loader(module_library_mapping);
}
✄
{"version":3,"file":"mbedTLS_linux.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/linux/mbedTLS_linux.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,OAAO,cAAe,SAAQ,QAAQ;IAExC,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,KAAK,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;QADlB,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAElE,CAAC;IAED;;;;;;MAME;IACF,8BAA8B;QAC1B,8BAA8B;IAClC,CAAC;IAED,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;IACxC,CAAC;CAEJ;AAGD,MAAM,UAAU,eAAe,CAAC,UAAiB;IAC7C,IAAI,WAAW,GAAG,IAAI,cAAc,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IAChE,WAAW,CAAC,aAAa,EAAE,CAAC;AAGhC,CAAC"}
✄
import { mbed_TLS } from "../ssl_lib/mbedTLS.js";
import { socket_library } from "./linux_agent.js";
export class mbed_TLS_Linux extends mbed_TLS {
    constructor(moduleName, socket_library) {
        super(moduleName, socket_library);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    /*
    SSL_CTX_set_keylog_callback not exported by default on windows.

    We need to find a way to install the callback function for doing that

    Alternatives?:SSL_export_keying_material, SSL_SESSION_get_master_key
    */
    install_tls_keys_callback_hook() {
        // install hooking for windows
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
    }
}
export function mbedTLS_execute(moduleName) {
    var mbedTLS_ssl = new mbed_TLS_Linux(moduleName, socket_library);
    mbedTLS_ssl.execute_hooks();
}
✄
{"version":3,"file":"nss_linux.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/linux/nss_linux.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAO,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAE5C,MAAM,OAAO,SAAU,SAAQ,GAAG;IAE9B,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,IAAI,sBAAsB,GAAqC,EAAE,CAAC;QAClE,sBAAsB,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,CAAC,CAAA;QAC9K,sBAAsB,CAAC,UAAU,CAAC,GAAG,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,CAAA;QAChF,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAA;QACrG,sBAAsB,CAAC,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QAEhG,KAAK,CAAC,UAAU,EAAC,cAAc,EAAC,sBAAsB,CAAC,CAAC;QAPzC,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAQlE,CAAC;IAGD,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACpC,IAAI,CAAC,8BAA8B,EAAE,CAAA;IACzC,CAAC;IAED,8BAA8B;QAE1B,GAAG,CAAC,WAAW,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAE3F,2BAA2B;QAC3B,GAAG,CAAC,qBAAqB,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAChH;;;UAGE;QACF,GAAG,CAAC,gBAAgB,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAG7H,4BAA4B;QAC5B,GAAG,CAAC,oBAAoB,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1G,GAAG,CAAC,eAAe,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAEpG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAC7C;YACI,OAAO,CAAC,IAAS;gBACb,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;YACD,OAAO,CAAC,MAAW;gBAEf,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE;oBACjB,MAAM,CAAC,qCAAqC,CAAC,CAAA;oBAC7C,OAAM;iBACT;gBAGD,IAAI,QAAQ,GAAG,GAAG,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBACvE,GAAG,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;gBAKrC,6DAA6D;gBAC7D,IAAI,QAAQ,GAAG,CAAC,EAAE;oBACd,MAAM,CAAC,gBAAgB,CAAC,CAAA;oBACxB,IAAI,YAAY,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;oBACnH,IAAI,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe;oBAClD,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,OAAO,SAAS,CAAC,CAAC;oBACrD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,sBAAsB;oBAC9D,YAAY,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAA;oBACrC,MAAM,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;iBACpC;qBAAM;oBACH,MAAM,CAAC,2CAA2C,CAAC,CAAA;iBACtD;YAEL,CAAC;SAEJ,CAAC,CAAC;QAMP;;;;;;WAMG;QACH,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EACtD;YACI,OAAO,CAAC,IAAS;gBAEb,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAEhC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACzC;oBACI,OAAO,CAAC,IAAS;wBACb,IAAI,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;wBAC1B,MAAM,CAAC,8EAA8E,CAAC,CAAC;wBACvF,GAAG,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;oBACtC,CAAC;oBACD,OAAO,CAAC,MAAW;oBACnB,CAAC;iBACJ,CAAC,CAAC;YAEX,CAAC;YACD,OAAO,CAAC,MAAW;YACnB,CAAC;SAEJ,CAAC,CAAC;IAGX,CAAC;CAEJ;AAGD,MAAM,UAAU,WAAW,CAAC,UAAiB;IACzC,IAAI,OAAO,GAAG,IAAI,SAAS,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IACvD,OAAO,CAAC,aAAa,EAAE,CAAC;AAG5B,CAAC"}
✄
import { NSS } from "../ssl_lib/nss.js";
import { socket_library } from "./linux_agent.js";
import { devlog } from "../util/log.js";
export class NSS_Linux extends NSS {
    constructor(moduleName, socket_library) {
        var library_method_mapping = {};
        library_method_mapping[`*${moduleName}*`] = ["PR_Write", "PR_Read", "PR_FileDesc2NativeHandle", "PR_GetPeerName", "PR_GetSockName", "PR_GetNameForIdentity", "PR_GetDescType"];
        library_method_mapping[`*libnss*`] = ["PK11_ExtractKeyValue", "PK11_GetKeyData"];
        library_method_mapping["*libssl*.so"] = ["SSL_ImportFD", "SSL_GetSessionID", "SSL_HandshakeCallback"];
        library_method_mapping[`*${socket_library}*`] = ["getpeername", "getsockname", "ntohs", "ntohl"];
        super(moduleName, socket_library, library_method_mapping);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        this.install_tls_keys_callback_hook();
    }
    install_tls_keys_callback_hook() {
        NSS.getDescType = new NativeFunction(this.addresses['PR_GetDescType'], "int", ["pointer"]);
        // SSL Handshake Functions:
        NSS.PR_GetNameForIdentity = new NativeFunction(this.addresses['PR_GetNameForIdentity'], "pointer", ["pointer"]);
        /*
                SECStatus SSL_HandshakeCallback(PRFileDesc *fd, SSLHandshakeCallback cb, void *client_data);
                more at https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslfnc#1112702
        */
        NSS.get_SSL_Callback = new NativeFunction(this.addresses["SSL_HandshakeCallback"], "int", ["pointer", "pointer", "pointer"]);
        // SSL Key helper Functions 
        NSS.PK11_ExtractKeyValue = new NativeFunction(this.addresses["PK11_ExtractKeyValue"], "int", ["pointer"]);
        NSS.PK11_GetKeyData = new NativeFunction(this.addresses["PK11_GetKeyData"], "pointer", ["pointer"]);
        Interceptor.attach(this.addresses["SSL_ImportFD"], {
            onEnter(args) {
                this.fd = args[1];
            },
            onLeave(retval) {
                if (retval.isNull()) {
                    devlog("[-] SSL_ImportFD error: unknow null");
                    return;
                }
                var retValue = NSS.get_SSL_Callback(retval, NSS.keylog_callback, NULL);
                NSS.register_secret_callback(retval);
                // typedef enum { PR_FAILURE = -1, PR_SUCCESS = 0 } PRStatus;
                if (retValue < 0) {
                    devlog("Callback Error");
                    var getErrorText = new NativeFunction(Module.getExportByName('libnspr4.so', 'PR_GetErrorText'), "int", ["pointer"]);
                    var outbuffer = Memory.alloc(200); // max out size
                    console.log("typeof outbuffer: " + typeof outbuffer);
                    console.log("outbuffer: " + outbuffer); // should be a pointer
                    getErrorText(outbuffer.readPointer());
                    devlog("Error msg: " + outbuffer);
                }
                else {
                    devlog("[*] keylog callback successfull installed");
                }
            }
        });
        /*
            SECStatus SSL_HandshakeCallback(
                PRFileDesc *fd,
                SSLHandshakeCallback cb,
                void *client_data
            );
         */
        Interceptor.attach(this.addresses["SSL_HandshakeCallback"], {
            onEnter(args) {
                this.originalCallback = args[1];
                Interceptor.attach(ptr(this.originalCallback), {
                    onEnter(args) {
                        var sslSocketFD = args[0];
                        devlog("[*] keylog callback successfull installed via applications callback function");
                        NSS.ssl_RecordKeyLog(sslSocketFD);
                    },
                    onLeave(retval) {
                    }
                });
            },
            onLeave(retval) {
            }
        });
    }
}
export function nss_execute(moduleName) {
    var nss_ssl = new NSS_Linux(moduleName, socket_library);
    nss_ssl.execute_hooks();
}
✄
{"version":3,"file":"openssl_boringssl_linux.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/linux/openssl_boringssl_linux.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,OAAO,uBAAwB,SAAQ,iBAAiB;IAE1D,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,KAAK,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;QADlB,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAElE,CAAC;IAGD,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACpC,IAAI,CAAC,8BAA8B,EAAE,CAAC;IAC1C,CAAC;IAED,8BAA8B;QAE1B,iBAAiB,CAAC,2BAA2B,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;QAEpQ,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAC5C;YACI,OAAO,EAAE,UAAU,IAAS;gBACxB,iBAAiB,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAA;YAC7F,CAAC;SAEJ,CAAC,CAAA;IACN,CAAC;CAEJ;AAOD,MAAM,UAAU,cAAc,CAAC,UAAiB;IAC5C,IAAI,UAAU,GAAG,IAAI,uBAAuB,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IACxE,UAAU,CAAC,aAAa,EAAE,CAAC;AAG/B,CAAC"}
✄
import { OpenSSL_BoringSSL } from "../ssl_lib/openssl_boringssl.js";
import { socket_library } from "./linux_agent.js";
export class OpenSSL_BoringSSL_Linux extends OpenSSL_BoringSSL {
    constructor(moduleName, socket_library) {
        super(moduleName, socket_library);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        this.install_tls_keys_callback_hook();
    }
    install_tls_keys_callback_hook() {
        OpenSSL_BoringSSL.SSL_CTX_set_keylog_callback = ObjC.available ? new NativeFunction(this.addresses["SSL_CTX_set_info_callback"], "void", ["pointer", "pointer"]) : new NativeFunction(this.addresses["SSL_CTX_set_keylog_callback"], "void", ["pointer", "pointer"]);
        Interceptor.attach(this.addresses["SSL_new"], {
            onEnter: function (args) {
                OpenSSL_BoringSSL.SSL_CTX_set_keylog_callback(args[0], OpenSSL_BoringSSL.keylog_callback);
            }
        });
    }
}
export function boring_execute(moduleName) {
    var boring_ssl = new OpenSSL_BoringSSL_Linux(moduleName, socket_library);
    boring_ssl.execute_hooks();
}
✄
{"version":3,"file":"wolfssl_linux.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/linux/wolfssl_linux.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAE3D,MAAM,OAAO,aAAc,SAAQ,OAAO;IAEtC,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,KAAK,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;QADlB,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAElE,CAAC;IAGD,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACpC,IAAI,CAAC,8BAA8B,EAAE,CAAC;IAC1C,CAAC;IAED,8BAA8B;QAC1B,OAAO,CAAC,yBAAyB,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAAC,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAE,CAAA;QACzI,OAAO,CAAC,yBAAyB,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAAC,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAE,CAAA;QACzI,sFAAsF;QACtF,OAAO,CAAC,8BAA8B,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,gCAAgC,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAA;QAEnJ,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAC;YACjD,OAAO,EAAE,UAAS,IAAS;gBACvB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACtB,CAAC;YACD,OAAO,EAAE,UAAS,MAAW;gBACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAkB,CAAA;gBAErE,IAAI,UAAU,GAAG,EAAE,CAAC;gBAEpB,sFAAsF;gBACtF,IAAI,0BAA0B,GAAG,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAW,CAAA;gBAEnG,IAAI,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;gBAC3D,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,0BAA0B,CAAC,CAAA;gBACrF,IAAI,WAAW,GAAG,YAAY,CAAC,aAAa,CAAC,0BAA0B,CAAC,CAAA;gBACxE,UAAU,GAAG,GAAG,UAAU,kBAAkB,WAAW,CAAC,WAAW,CAAC,IAAI,CAAA;gBAExE,sFAAsF;gBACtF,IAAI,0BAA0B,GAAG,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAW,CAAA;gBACnG,IAAI,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;gBAC3D,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,0BAA0B,CAAC,CAAA;gBACrF,IAAI,WAAW,GAAG,YAAY,CAAC,aAAa,CAAC,0BAA0B,CAAC,CAAA;gBACxE,UAAU,GAAG,GAAG,UAAU,kBAAkB,WAAW,CAAC,WAAW,CAAC,IAAI,CAAA;gBAExE,sFAAsF;gBACtF,IAAI,uBAAuB,GAAG,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAW,CAAA;gBACrG,IAAI,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;gBACxD,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAA;gBAC3F,IAAI,WAAW,GAAG,YAAY,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAA;gBACrE,UAAU,GAAG,GAAG,UAAU,eAAe,WAAW,CAAC,WAAW,CAAC,IAAI,CAAA;gBAGrE,IAAI,OAAO,GAA8C,EAAE,CAAA;gBAC3D,OAAO,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAA;gBACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAA;gBAC9B,IAAI,CAAC,OAAO,CAAC,CAAA;YAEjB,CAAC;SACJ,CAAC,CAAA;IACN,CAAC;CAEJ;AAGD,MAAM,UAAU,eAAe,CAAC,UAAiB;IAC7C,IAAI,QAAQ,GAAG,IAAI,aAAa,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IAC5D,QAAQ,CAAC,aAAa,EAAE,CAAC;AAG7B,CAAC"}
✄
import { WolfSSL } from "../ssl_lib/wolfssl.js";
import { socket_library } from "./linux_agent.js";
import { toHexString } from "../shared/shared_functions.js";
export class WolfSSL_Linux extends WolfSSL {
    constructor(moduleName, socket_library) {
        super(moduleName, socket_library);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        this.install_tls_keys_callback_hook();
    }
    install_tls_keys_callback_hook() {
        WolfSSL.wolfSSL_get_client_random = new NativeFunction(this.addresses["wolfSSL_get_client_random"], "int", ["pointer", "pointer", "int"]);
        WolfSSL.wolfSSL_get_server_random = new NativeFunction(this.addresses["wolfSSL_get_server_random"], "int", ["pointer", "pointer", "int"]);
        //https://www.wolfssl.com/doxygen/group__Setup.html#gaf18a029cfeb3150bc245ce66b0a44758
        WolfSSL.wolfSSL_SESSION_get_master_key = new NativeFunction(this.addresses["wolfSSL_SESSION_get_master_key"], "int", ["pointer", "pointer", "int"]);
        Interceptor.attach(this.addresses["wolfSSL_connect"], {
            onEnter: function (args) {
                this.ssl = args[0];
            },
            onLeave: function (retval) {
                this.session = WolfSSL.wolfSSL_get_session(this.ssl);
                var keysString = "";
                //https://www.wolfssl.com/doxygen/group__Setup.html#ga927e37dc840c228532efa0aa9bbec451
                var requiredClientRandomLength = WolfSSL.wolfSSL_get_client_random(this.session, NULL, 0);
                var clientBuffer = Memory.alloc(requiredClientRandomLength);
                WolfSSL.wolfSSL_get_client_random(this.ssl, clientBuffer, requiredClientRandomLength);
                var clientBytes = clientBuffer.readByteArray(requiredClientRandomLength);
                keysString = `${keysString}CLIENT_RANDOM: ${toHexString(clientBytes)}\n`;
                //https://www.wolfssl.com/doxygen/group__Setup.html#ga987035fc600ba9e3b02e2b2718a16a6c
                var requiredServerRandomLength = WolfSSL.wolfSSL_get_server_random(this.session, NULL, 0);
                var serverBuffer = Memory.alloc(requiredServerRandomLength);
                WolfSSL.wolfSSL_get_server_random(this.ssl, serverBuffer, requiredServerRandomLength);
                var serverBytes = serverBuffer.readByteArray(requiredServerRandomLength);
                keysString = `${keysString}SERVER_RANDOM: ${toHexString(serverBytes)}\n`;
                //https://www.wolfssl.com/doxygen/group__Setup.html#gaf18a029cfeb3150bc245ce66b0a44758
                var requiredMasterKeyLength = WolfSSL.wolfSSL_SESSION_get_master_key(this.session, NULL, 0);
                var masterBuffer = Memory.alloc(requiredMasterKeyLength);
                WolfSSL.wolfSSL_SESSION_get_master_key(this.session, masterBuffer, requiredMasterKeyLength);
                var masterBytes = masterBuffer.readByteArray(requiredMasterKeyLength);
                keysString = `${keysString}MASTER_KEY: ${toHexString(masterBytes)}\n`;
                var message = {};
                message["contentType"] = "keylog";
                message["keylog"] = keysString;
                send(message);
            }
        });
    }
}
export function wolfssl_execute(moduleName) {
    var wolf_ssl = new WolfSSL_Linux(moduleName, socket_library);
    wolf_ssl.execute_hooks();
}
✄
{"version":3,"file":"macos_agent.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/macos/macos_agent.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAG7D,IAAI,cAAc,GAAG,QAAQ,CAAC;AAC9B,IAAI,WAAW,GAAkB,cAAc,EAAE,CAAA;AAEjD,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAA;AAGjD,SAAS,yBAAyB,CAAC,sBAAmF;IAClH,IAAI;QACA,MAAM,WAAW,GAAG,mBAAmB,CAAA;QACvC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;QACrE,IAAI,KAAK,KAAK,SAAS,EAAE;YACrB,MAAM,kCAAkC,CAAA;SAC3C;QAED,IAAI,MAAM,GAAG,QAAQ,CAAA;QAErB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE;YACpE,OAAO,EAAE,UAAU,IAAI;gBACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAC3C,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;gBAC1B,IAAI,IAAI,CAAC,UAAU,IAAI,SAAS,EAAE;oBAC9B,KAAK,IAAI,GAAG,IAAI,sBAAsB,CAAC,cAAc,CAAC,EAAE;wBACpD,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;wBAClB,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;wBACjB,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;4BAC7B,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,wCAAwC,CAAC,CAAA;4BAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;yBACxB;qBAEJ;iBACJ;YACL,CAAC;SAGJ,CAAC,CAAA;QAEF,GAAG,CAAC,8BAA8B,CAAC,CAAA;KACtC;IAAC,OAAO,KAAK,EAAE;QACZ,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAA;QAChC,GAAG,CAAC,iDAAiD,CAAC,CAAA;KACzD;AACL,CAAC;AAGD,SAAS,mBAAmB,CAAC,sBAAmF;IAC5G,kBAAkB,CAAC,cAAc,EAAE,sBAAsB,EAAC,WAAW,EAAC,OAAO,CAAC,CAAA;AAClF,CAAC;AAID,MAAM,UAAU,wBAAwB;IACpC,sBAAsB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,uBAAuB,EAAE,cAAc,CAAC,CAAC,CAAA;IACpF,mBAAmB,CAAC,sBAAsB,CAAC,CAAC,CAAC,yGAAyG;IACtJ,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;AACtD,CAAC"}
✄
import { module_library_mapping } from "../shared/shared_structures.js";
import { log, devlog } from "../util/log.js";
import { getModuleNames, ssl_library_loader } from "../shared/shared_functions.js";
import { boring_execute } from "./openssl_boringssl_macos.js";
var plattform_name = "darwin";
var moduleNames = getModuleNames();
export const socket_library = "libSystem.B.dylib";
function hook_macOS_Dynamic_Loader(module_library_mapping) {
    try {
        const regex_libdl = /libSystem.B.dylib/;
        const libdl = moduleNames.find(element => element.match(regex_libdl));
        if (libdl === undefined) {
            throw "Darwin Dynamic loader not found!";
        }
        var dlopen = "dlopen";
        Interceptor.attach(Module.getExportByName("libSystem.B.dylib", dlopen), {
            onEnter: function (args) {
                this.moduleName = args[0].readCString();
            },
            onLeave: function (retval) {
                if (this.moduleName != undefined) {
                    for (let map of module_library_mapping[plattform_name]) {
                        let regex = map[0];
                        let func = map[1];
                        if (regex.test(this.moduleName)) {
                            log(`${this.moduleName} was loaded & will be hooked on MacOS!`);
                            func(this.moduleName);
                        }
                    }
                }
            }
        });
        log("MacOS dynamic loader hooked.");
    }
    catch (error) {
        devlog("Loader error: " + error);
        log("No dynamic loader present for hooking on MacOS.");
    }
}
function hook_macOS_SSL_Libs(module_library_mapping) {
    ssl_library_loader(plattform_name, module_library_mapping, moduleNames, "MacOS");
}
export function load_macos_hooking_agent() {
    module_library_mapping[plattform_name] = [[/.*libboringssl\.dylib/, boring_execute]];
    hook_macOS_SSL_Libs(module_library_mapping); // actually we are using the same implementation as we did on iOS, therefore this needs addtional testing
    hook_macOS_Dynamic_Loader(module_library_mapping);
}
✄
{"version":3,"file":"openssl_boringssl_macos.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/macos/openssl_boringssl_macos.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,MAAM,OAAO,uBAAwB,SAAQ,iBAAiB;IAuB1D,YAAmB,UAAiB,EAAS,cAAqB;QAE9D,IAAI,sBAAsB,GAAqC,EAAE,CAAA;QAEjE,yIAAyI;QACzI,sBAAsB,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAA;QACpK,sBAAsB,CAAC,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA,CAAC,kFAAkF;QAEvL,KAAK,CAAC,UAAU,EAAC,cAAc,EAAC,sBAAsB,CAAC,CAAC;QARzC,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IASlE,CAAC;IA9BD,8BAA8B;QAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA,CAAC,2EAA2E;QACvG,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,0EAA0E;YAC5F,IAAI,eAAe,GAAG,KAAK,CAAC;YAE5B,IAAI,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,EAAE,UAAU,EAAE,CAAC;YACjH,IAAG,gBAAgB,IAAI,SAAS,EAAC;gBAC7B,eAAe,GAAG,KAAK,CAAC;aAC3B;iBAAK,IAAI,gBAAgB,IAAI,QAAQ,EAAE;gBACpC,eAAe,GAAG,KAAK,CAAC,CAAC,eAAe;aAC3C;YACD,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAAE;gBAC9D,OAAO,EAAE,UAAU,IAAU;oBAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBACvE,CAAC;aACF,CAAC,CAAC;SAEJ;IAEP,CAAC;IAaD,aAAa;QAET;;;;UAIE;QAEF,IAAI,CAAC,8BAA8B,EAAE,CAAC;IAC1C,CAAC;CAIJ;AAGD,MAAM,UAAU,cAAc,CAAC,UAAiB;IAC5C,IAAI,UAAU,GAAG,IAAI,uBAAuB,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IACxE,UAAU,CAAC,aAAa,EAAE,CAAC;AAG/B,CAAC"}
✄
import { OpenSSL_BoringSSL } from "../ssl_lib/openssl_boringssl.js";
import { socket_library } from "./macos_agent.js";
export class OpenSSL_BoringSSL_MacOS extends OpenSSL_BoringSSL {
    constructor(moduleName, socket_library) {
        var library_method_mapping = {};
        // the iOS implementation needs some further improvements - currently we are not able to get the sockfd from an SSL_read/write invocation
        library_method_mapping[`*${moduleName}*`] = ["SSL_read", "SSL_write", "BIO_get_fd", "SSL_get_session", "SSL_SESSION_get_id", "SSL_new", "SSL_CTX_set_info_callback"];
        library_method_mapping[`*${socket_library}*`] = ["getpeername*", "getsockname*", "ntohs*", "ntohl*"]; // currently those functions gets only identified if we at an asterisk at the end 
        super(moduleName, socket_library, library_method_mapping);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    install_tls_keys_callback_hook() {
        console.log(this.addresses); // currently only for debugging purposes will be removed in future releases
        if (ObjC.available) { // inspired from https://codeshare.frida.re/@andydavies/ios-tls-keylogger/
            var CALLBACK_OFFSET = 0x2A8;
            var foundationNumber = Module.findExportByName('CoreFoundation', 'kCFCoreFoundationVersionNumber')?.readDouble();
            if (foundationNumber == undefined) {
                CALLBACK_OFFSET = 0x2A8;
            }
            else if (foundationNumber >= 1751.108) {
                CALLBACK_OFFSET = 0x2B8; // >= iOS 14.x 
            }
            Interceptor.attach(this.addresses["SSL_CTX_set_info_callback"], {
                onEnter: function (args) {
                    ptr(args[0]).add(CALLBACK_OFFSET).writePointer(this.keylog_callback);
                }
            });
        }
    }
    execute_hooks() {
        /*
        currently these function hooks aren't implemented
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        */
        this.install_tls_keys_callback_hook();
    }
}
export function boring_execute(moduleName) {
    var boring_ssl = new OpenSSL_BoringSSL_MacOS(moduleName, socket_library);
    boring_ssl.execute_hooks();
}
✄
{"version":3,"file":"shared_functions.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/shared/shared_functions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAG1D,SAAS,uBAAuB,CAAC,WAAmB;IAChD,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACxD,IAAG,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,EAAC;QAChD,GAAG,CAAC,cAAc,GAAC,eAAe,GAAC,mCAAmC,GAAC,WAAW,CAAC,CAAC;QACpF,UAAU,CAAC,uBAAuB,EAAC,eAAe,CAAC,CAAA;KACtD;AACL,CAAC;AAED;;;;;GAKG;AAEH,MAAM,UAAU,kBAAkB,CAAC,cAAsB,EAAE,sBAAmF,EAAE,WAA0B,EAAG,YAAoB;IAC7L,KAAI,IAAI,GAAG,IAAI,sBAAsB,CAAC,cAAc,CAAC,EAAC;QAClD,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAClB,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QACjB,KAAI,IAAI,MAAM,IAAI,WAAW,EAAC;YAC1B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAC;gBACnB,IAAG;oBACC,GAAG,CAAC,GAAG,MAAM,8BAA8B,YAAY,GAAG,CAAC,CAAA;oBAC3D,IAAI;wBACA,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;qBACpC;oBAAA,OAAM,KAAK,EAAC;wBACT,uBAAuB,CAAC,MAAM,CAAC,CAAC;qBACnC;oBAED,IAAI,CAAC,MAAM,CAAC,CAAA,CAAC,kIAAkI;iBAClJ;gBAAA,OAAO,KAAK,EAAE;oBACX,GAAG,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAA;oBACvC,+GAA+G;oBAC/G,MAAM,CAAC,gBAAgB,GAAC,KAAK,CAAC,CAAA;oBAC9B,+EAA+E;iBAClF;aAEJ;SACJ;KACJ;AAEL,CAAC;AAGD,QAAQ;AACR,MAAM,UAAU,gBAAgB;IAC5B,IAAI,WAAW,GAAkB,cAAc,EAAE,CAAA;IACjD,IAAI,mBAAmB,GAAG,EAAE,CAAA;IAC5B,QAAO,OAAO,CAAC,QAAQ,EAAC;QACpB,KAAK,OAAO;YACR,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAA;QACnE,KAAK,SAAS;YACV,OAAO,YAAY,CAAA;QACvB,KAAK,QAAQ;YACT,OAAO,mBAAmB,CAAA;QAC9B;YACI,GAAG,CAAC,aAAa,OAAO,CAAC,QAAQ,2BAA2B,CAAC,CAAA;YAC7D,OAAO,EAAE,CAAA;KAChB;AACL,CAAC;AAED,MAAM,UAAU,cAAc;IAC1B,IAAI,WAAW,GAAkB,EAAE,CAAA;IACnC,OAAO,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACvE,OAAO,WAAW,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,sBAAwD;IAClF,IAAI,QAAQ,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,SAAS,GAAqC,EAAE,CAAA;IACpD,KAAK,IAAI,YAAY,IAAI,sBAAsB,EAAE;QAC7C,sBAAsB,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,MAAM;YACzD,IAAI,OAAO,GAAG,QAAQ,CAAC,gBAAgB,CAAC,UAAU,GAAG,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC,CAAA;YACjF,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAEpC,IAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAC,EAAE,6DAA6D;gBACxF,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,EAAC,WAAW,CAAC,MAAM,GAAC,CAAC,CAAC,CAAA;aAC9D;YAED,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE;gBACrB,MAAM,iBAAiB,GAAG,YAAY,GAAG,GAAG,GAAG,MAAM,CAAA;aACxD;iBACI,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAC;gBAEzB,MAAM,CAAC,QAAQ,GAAG,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;aACvD;iBAAI;gBACD,uEAAuE;gBACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;oBACrC,IAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAC;wBACrC,YAAY,GAAG,CAAC,CAAC;wBACjB,MAAM,CAAC,QAAQ,GAAG,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAA;wBAC/D,MAAM;qBACT;iBAEJ;aAEJ;YACD,SAAS,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;QAC3D,CAAC,CAAC,CAAA;KACL;IACD,OAAO,SAAS,CAAA;AACpB,CAAC;AAID;;;;GAIG;AACF,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC9C,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAC,UAAU,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAA;IAE1C,KAAI,MAAM,MAAM,IAAI,OAAO,EAAC;QACxB,IAAG,MAAM,CAAC,IAAI,IAAI,UAAU,EAAC;YACzB,OAAO,MAAM,CAAC,IAAI,CAAC;SACtB;KACJ;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAGD;;;;;;;;;EASE;AACF,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAe,EAAE,eAAiD;IAEnH,IAAI,WAAW,GAAG,IAAI,cAAc,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;IAC1G,IAAI,WAAW,GAAG,IAAI,cAAc,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;IAC1G,IAAI,KAAK,GAAG,IAAI,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC9E,IAAI,KAAK,GAAG,IAAI,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAE9E,IAAI,OAAO,GAAuC,EAAE,CAAA;IACpD,IAAI,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,OAAO,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QACrC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QACrB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,MAAM,EAAE;YAClC,MAAM,CAAC,KAAK,CAAC,CAAA;YACb,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;SACrC;aACI;YACD,MAAM,CAAC,KAAK,CAAC,CAAA;YACb,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;SACrC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,OAAO,EAAE;YAC3B,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAW,CAAA;YACtE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAW,CAAA;YACtE,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAA;SACnC;aAAM,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,QAAQ,EAAE;YACnC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAW,CAAA;YACtE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;YAClC,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAC3B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,IAAI,CAAC,EAAE;gBAC3C,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;aAChH;YACD,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE;gBACpF,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAW,CAAA;gBAC5E,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAA;aACnC;iBACI;gBACD,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAA;aACpC;SACJ;aAAM;YACH,MAAM,CAAC,2CAA2C,GAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YAClE,MAAM,wBAAwB,CAAA;SACjC;KACJ;IACD,OAAO,OAAO,CAAA;AAClB,CAAC;AAID;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAc;IAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,IAAY;QAC/C,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACf,CAAC;AAED,MAAM,UAAU,WAAW,CAAE,SAAc;IACvC,MAAM,SAAS,GAAQ,EAAE,CAAC;IAE1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,EAAC;QAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;KAC5B;IACD,OAAO,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAC3B,IAAI,UAAU,CAAC,SAAS,CAAC,EACzB,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CACpB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,SAAc;IACtD,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;KACpF;IACD,OAAO,MAAM,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAc;IAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QACvC,KAAK,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;KACjD;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,QAAsB,EAAE,SAAiB;IAClE,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAA;IAC7E,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IACzB,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;AAC9B,CAAC"}
✄
import { log, devlog } from "../util/log.js";
import { AF_INET, AF_INET6 } from "./shared_structures.js";
function wait_for_library_loaded(module_name) {
    let timeout_library = 5;
    let module_adress = Module.findBaseAddress(module_name);
    if (module_adress === NULL || module_adress === null) {
        log("[*] Waiting " + timeout_library + " milliseconds for the loading of " + module_name);
        setTimeout(wait_for_library_loaded, timeout_library);
    }
}
/**
 * This file contains methods which are shared for reading
 * secrets/data from different libraries. These methods are
 * indipendent from the implementation of ssl/tls, but they depend
 * on libc.
 */
export function ssl_library_loader(plattform_name, module_library_mapping, moduleNames, plattform_os) {
    for (let map of module_library_mapping[plattform_name]) {
        let regex = map[0];
        let func = map[1];
        for (let module of moduleNames) {
            if (regex.test(module)) {
                try {
                    log(`${module} found & will be hooked on ${plattform_os}!`);
                    try {
                        Module.ensureInitialized(module);
                    }
                    catch (error) {
                        wait_for_library_loaded(module);
                    }
                    func(module); // on some Android Apps we encounterd the problem of multiple SSL libraries but only one is used for the SSL encryption/decryption
                }
                catch (error) {
                    log(`error: skipping module ${module}`);
                    // when we enable the logging of devlogs we can print the error message as well for further improving this part
                    devlog("Loader error: " + error);
                    //  {'description': 'Could not find *libssl*.so!SSL_ImportFD', 'type': 'error'}
                }
            }
        }
    }
}
//TODO: 
export function getSocketLibrary() {
    var moduleNames = getModuleNames();
    var socket_library_name = "";
    switch (Process.platform) {
        case "linux":
            return moduleNames.find(element => element.match(/libc.*\.so/));
        case "windows":
            return "WS2_32.dll";
        case "darwin":
            return "libSystem.B.dylib";
        default:
            log(`Platform "${Process.platform} currently not supported!`);
            return "";
    }
}
export function getModuleNames() {
    var moduleNames = [];
    Process.enumerateModules().forEach(item => moduleNames.push(item.name));
    return moduleNames;
}
/**
 * Read the addresses for the given methods from the given modules
 * @param {{[key: string]: Array<String> }} library_method_mapping A string indexed list of arrays, mapping modules to methods
 * @return {{[key: string]: NativePointer }} A string indexed list of NativePointers, which point to the respective methods
 */
export function readAddresses(library_method_mapping) {
    var resolver = new ApiResolver("module");
    var addresses = {};
    for (let library_name in library_method_mapping) {
        library_method_mapping[library_name].forEach(function (method) {
            var matches = resolver.enumerateMatches("exports:" + library_name + "!" + method);
            var match_number = 0;
            var method_name = method.toString();
            if (method_name.endsWith("*")) { // this is for the temporary iOS bug using fridas ApiResolver
                method_name = method_name.substring(0, method_name.length - 1);
            }
            if (matches.length == 0) {
                throw "Could not find " + library_name + "!" + method;
            }
            else if (matches.length == 1) {
                devlog("Found " + method + " " + matches[0].address);
            }
            else {
                // Sometimes Frida returns duplicates or it finds more than one result.
                for (var k = 0; k < matches.length; k++) {
                    if (matches[k].name.endsWith(method_name)) {
                        match_number = k;
                        devlog("Found " + method + " " + matches[match_number].address);
                        break;
                    }
                }
            }
            addresses[method_name] = matches[match_number].address;
        });
    }
    return addresses;
}
/**
 * Returns the base address of a given module
 * @param {string} moduleName Name of module to return base address from
 * @returns
 */
export function getBaseAddress(moduleName) {
    console.log("Module to find:", moduleName);
    const modules = Process.enumerateModules();
    for (const module of modules) {
        if (module.name == moduleName) {
            return module.base;
        }
    }
    return null;
}
/**
* Returns a dictionary of a sockfd's "src_addr", "src_port", "dst_addr", and
* "dst_port".
* @param {int} sockfd The file descriptor of the socket to inspect.
* @param {boolean} isRead If true, the context is an SSL_read call. If
*     false, the context is an SSL_write call.
* @param {{ [key: string]: NativePointer}} methodAddresses Dictionary containing (at least) addresses for getpeername, getsockname, ntohs and ntohl
* @return {{ [key: string]: string | number }} Dictionary of sockfd's "src_addr", "src_port", "dst_addr",
*     and "dst_port".
*/
export function getPortsAndAddresses(sockfd, isRead, methodAddresses) {
    var getpeername = new NativeFunction(methodAddresses["getpeername"], "int", ["int", "pointer", "pointer"]);
    var getsockname = new NativeFunction(methodAddresses["getsockname"], "int", ["int", "pointer", "pointer"]);
    var ntohs = new NativeFunction(methodAddresses["ntohs"], "uint16", ["uint16"]);
    var ntohl = new NativeFunction(methodAddresses["ntohl"], "uint32", ["uint32"]);
    var message = {};
    var addrlen = Memory.alloc(4);
    var addr = Memory.alloc(128);
    var src_dst = ["src", "dst"];
    for (var i = 0; i < src_dst.length; i++) {
        addrlen.writeU32(128);
        if ((src_dst[i] == "src") !== isRead) {
            devlog("src");
            getsockname(sockfd, addr, addrlen);
        }
        else {
            devlog("dst");
            getpeername(sockfd, addr, addrlen);
        }
        if (addr.readU16() == AF_INET) {
            message[src_dst[i] + "_port"] = ntohs(addr.add(2).readU16());
            message[src_dst[i] + "_addr"] = ntohl(addr.add(4).readU32());
            message["ss_family"] = "AF_INET";
        }
        else if (addr.readU16() == AF_INET6) {
            message[src_dst[i] + "_port"] = ntohs(addr.add(2).readU16());
            message[src_dst[i] + "_addr"] = "";
            var ipv6_addr = addr.add(8);
            for (var offset = 0; offset < 16; offset += 1) {
                message[src_dst[i] + "_addr"] += ("0" + ipv6_addr.add(offset).readU8().toString(16).toUpperCase()).substr(-2);
            }
            if (message[src_dst[i] + "_addr"].toString().indexOf("00000000000000000000FFFF") === 0) {
                message[src_dst[i] + "_addr"] = ntohl(ipv6_addr.add(12).readU32());
                message["ss_family"] = "AF_INET";
            }
            else {
                message["ss_family"] = "AF_INET6";
            }
        }
        else {
            devlog("[-] getPortsAndAddresses resolving error:" + addr.readU16());
            throw "Only supporting IPv4/6";
        }
    }
    return message;
}
/**
 * Convert a Java byte array to string
 * @param byteArray The array to convert
 * @returns {string} The resulting string
 */
export function byteArrayToString(byteArray) {
    return Array.from(byteArray, function (byte) {
        return ('0' + (byte & 0xFF).toString(16)).slice(-2);
    }).join('');
}
export function toHexString(byteArray) {
    const byteToHex = [];
    for (let n = 0; n <= 0xff; ++n) {
        const hexOctet = n.toString(16).padStart(2, "0");
        byteToHex.push(hexOctet);
    }
    return Array.prototype.map.call(new Uint8Array(byteArray), n => byteToHex[n]).join("");
}
/**
 * Convert a Java Reflection array to string
 * @param byteArray The array to convert
 * @returns {string} The resulting string
 */
export function reflectionByteArrayToString(byteArray) {
    var result = "";
    var arrayReflect = Java.use("java.lang.reflect.Array");
    for (var i = 0; i < arrayReflect.getLength(byteArray); i++) {
        result += ('0' + (arrayReflect.get(byteArray, i) & 0xFF).toString(16)).slice(-2);
    }
    return result;
}
/**
 * Convert a Java byte arry to number (Big Endian)
 * @param byteArray The array to convert
 * @returns {number} The resulting number
 */
export function byteArrayToNumber(byteArray) {
    var value = 0;
    for (var i = 0; i < byteArray.length; i++) {
        value = (value * 256) + (byteArray[i] & 0xFF);
    }
    return value;
}
/**
 * Access an attribute of a Java Class
 * @param Instance The instace you want to access
 * @param fieldName The name of the attribute
 * @returns The value of the attribute of the requested field
 */
export function getAttribute(Instance, fieldName) {
    var clazz = Java.use("java.lang.Class");
    var field = Java.cast(Instance.getClass(), clazz).getDeclaredField(fieldName);
    field.setAccessible(true);
    return field.get(Instance);
}
✄
{"version":3,"file":"shared_structures.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/shared/shared_structures.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAG3D,MAAM,CAAC,IAAI,sBAAsB,GAAgE,EAAE,CAAA;AAGnG,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAA;AACxB,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAA;AAC1B,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC"}
✄
/* In this file we store global variables and structures */
export var module_library_mapping = {};
export const AF_INET = 2;
export const AF_INET6 = 10;
export const pointerSize = Process.pointerSize;
✄
{"version":3,"file":"gnutls.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/ssl_lib/gnutls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAe,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAChH,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,OAAO,MAAM;IAcf,YAAmB,UAAiB,EAAS,cAAqB,EAAQ,6BAAgE;QAAvH,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;QAAQ,kCAA6B,GAA7B,6BAA6B,CAAmC;QAZ1I,mBAAmB;QACnB,2BAAsB,GAAqC,EAAE,CAAC;QAY1D,IAAG,OAAO,6BAA6B,KAAK,WAAW,EAAC;YACpD,IAAI,CAAC,sBAAsB,GAAG,6BAA6B,CAAC;SAC/D;aAAI;YACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,oCAAoC,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,aAAa,EAAE,kBAAkB,EAAE,oCAAoC,EAAE,2BAA2B,CAAC,CAAA;YAC9R,IAAI,CAAC,sBAAsB,CAAC,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;SACxG;QAED,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAG5D,aAAa;QACb,IAAG,OAAO,IAAI,WAAW,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAC;YAEhD,IAAG,OAAO,CAAC,OAAO,IAAI,IAAI,EAAC;gBACvB,MAAM,iBAAiB,GAAG,cAAc,CAAC,cAAc,CAAC,CAAA;gBACxD,KAAI,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAC;oBAC5C,YAAY;oBACb,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;iBACnN;aACJ;YAED,MAAM,kBAAkB,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;YAErD,IAAG,kBAAkB,IAAI,IAAI,EAAC;gBAC1B,GAAG,CAAC,iGAAiG,CAAC,CAAA;aACzG;YAGD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAC;gBAC7C,YAAY;gBACZ,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,kBAAkB,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;aAClN;SAGJ;QAED,MAAM,CAAC,wBAAwB,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QACpH,MAAM,CAAC,qBAAqB,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;QACpI,MAAM,CAAC,kCAAkC,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,oCAAoC,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;QACpJ,MAAM,CAAC,yBAAyB,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;IAEpJ,CAAC;IA8CD;;;;;;SAMK;IACJ,MAAM,CAAC,eAAe,CAAC,OAAsB;QAC1C,IAAI,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACjC,IAAI,GAAG,GAAG,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;QAClE,IAAI,GAAG,IAAI,CAAC,EAAE;YACV,OAAO,EAAE,CAAA;SACZ;QACD,IAAI,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,CAAA;QAC/B,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACzB,GAAG,GAAG,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC,EAAE,WAAW,CAAC,CAAA;QAC3D,IAAI,GAAG,IAAI,CAAC,EAAE;YACV,OAAO,EAAE,CAAA;SACZ;QACD,IAAI,UAAU,GAAG,EAAE,CAAA;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE;YAC1B,sEAAsE;YACtE,oBAAoB;YAEpB,UAAU;gBACN,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;SACtE;QACD,OAAO,UAAU,CAAA;IACrB,CAAC;IAED,2BAA2B;QACvB,IAAI,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAC3D;YACI,OAAO,EAAE,UAAU,IAAS;gBACxB,IAAI,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;gBAC1G,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC3D,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAA;gBAChC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;gBACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACtB,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;gBAC1B,MAAM,IAAI,CAAC,CAAA,CAAC,iCAAiC;gBAC7C,IAAI,MAAM,IAAI,CAAC,EAAE;oBACb,OAAM;iBACT;gBACD,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;gBACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;YACtD,CAAC;SACJ,CAAC,CAAA;IAEF,CAAC;IAED,4BAA4B;QACxB,IAAI,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAC3D;YACI,OAAO,EAAE,UAAU,IAAS;gBACxB,IAAI,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAW,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;gBAC3G,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC3D,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,CAAA;gBACjC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;gBAClC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC3D,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;YAC9B,CAAC;SACJ,CAAC,CAAA;IAEF,CAAC;IAED,8BAA8B;IAE9B,CAAC;;AApHD,gBAAgB;AACT,sBAAe,GAAG,IAAI,cAAc,CAAC,UAAU,OAAsB,EAAE,KAAoB,EAAE,MAAqB;IAErH,IAAI,OAAO,GAA8C,EAAE,CAAA;IAC3D,OAAO,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAA;IAEjC,IAAI,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3D,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;IAE5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE;QACjC,sEAAsE;QACtE,oBAAoB;QAEpB,UAAU;YACN,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;KACtE;IAED,IAAI,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAA;IAC7D,IAAI,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAA;IAE7D,IAAI,OAAO,IAAI,KAAK,WAAW,EAAC;QAE5B,MAAM,CAAC,yBAAyB,CAAC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAA;KAClF;SAAI;QACD,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;KAC7D;IAED,IAAI,iBAAiB,GAAG,EAAE,CAAA;IAC1B,IAAI,iBAAiB,GAAG,EAAE,CAAA;IAC1B,CAAC,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAA;IACnC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,EAAE,CAAC,EAAE,EAAE;QACpC,sEAAsE;QACtE,2BAA2B;QAE3B,iBAAiB;YACb,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;KACtE;IACD,OAAO,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,GAAG,GAAG,GAAG,iBAAiB,GAAG,GAAG,GAAG,UAAU,CAAA;IACpF,IAAI,CAAC,OAAO,CAAC,CAAA;IACb,OAAO,CAAC,CAAA;AACZ,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA"}
✄
import { readAddresses, getPortsAndAddresses, getBaseAddress } from "../shared/shared_functions.js";
import { log } from "../util/log.js";
import { offsets } from "../ssl_log.js";
export class GnuTLS {
    constructor(moduleName, socket_library, passed_library_method_mapping) {
        this.moduleName = moduleName;
        this.socket_library = socket_library;
        this.passed_library_method_mapping = passed_library_method_mapping;
        // global variables
        this.library_method_mapping = {};
        if (typeof passed_library_method_mapping !== 'undefined') {
            this.library_method_mapping = passed_library_method_mapping;
        }
        else {
            this.library_method_mapping[`*${moduleName}*`] = ["gnutls_record_recv", "gnutls_record_send", "gnutls_session_set_keylog_function", "gnutls_transport_get_int", "gnutls_session_get_id", "gnutls_init", "gnutls_handshake", "gnutls_session_get_keylog_function", "gnutls_session_get_random"];
            this.library_method_mapping[`*${socket_library}*`] = ["getpeername", "getsockname", "ntohs", "ntohl"];
        }
        this.addresses = readAddresses(this.library_method_mapping);
        // @ts-ignore
        if (offsets != "{OFFSETS}" && offsets.gnutls != null) {
            if (offsets.sockets != null) {
                const socketBaseAddress = getBaseAddress(socket_library);
                for (const method of Object.keys(offsets.sockets)) {
                    //@ts-ignore
                    this.addresses[`${method}`] = offsets.sockets[`${method}`].absolute || socketBaseAddress == null ? ptr(offsets.sockets[`${method}`].address) : socketBaseAddress.add(ptr(offsets.sockets[`${method}`].address));
                }
            }
            const libraryBaseAddress = getBaseAddress(moduleName);
            if (libraryBaseAddress == null) {
                log("Unable to find library base address! Given address values will be interpreted as absolute ones!");
            }
            for (const method of Object.keys(offsets.gnutls)) {
                //@ts-ignore
                this.addresses[`${method}`] = offsets.gnutls[`${method}`].absolute || libraryBaseAddress == null ? ptr(offsets.gnutls[`${method}`].address) : libraryBaseAddress.add(ptr(offsets.gnutls[`${method}`].address));
            }
        }
        GnuTLS.gnutls_transport_get_int = new NativeFunction(this.addresses["gnutls_transport_get_int"], "int", ["pointer"]);
        GnuTLS.gnutls_session_get_id = new NativeFunction(this.addresses["gnutls_session_get_id"], "int", ["pointer", "pointer", "pointer"]);
        GnuTLS.gnutls_session_set_keylog_function = new NativeFunction(this.addresses["gnutls_session_set_keylog_function"], "void", ["pointer", "pointer"]);
        GnuTLS.gnutls_session_get_random = new NativeFunction(this.addresses["gnutls_session_get_random"], "pointer", ["pointer", "pointer", "pointer"]);
    }
    /**
       * Get the session_id of SSL object and return it as a hex string.
       * @param {!NativePointer} ssl A pointer to an SSL object.
       * @return {dict} A string representing the session_id of the SSL object's
       *     SSL_SESSION. For example,
       *     "59FD71B7B90202F359D89E66AE4E61247954E28431F6C6AC46625D472FF76336".
       */
    static getSslSessionId(session) {
        var len_pointer = Memory.alloc(4);
        var err = GnuTLS.gnutls_session_get_id(session, NULL, len_pointer);
        if (err != 0) {
            return "";
        }
        var len = len_pointer.readU32();
        var p = Memory.alloc(len);
        err = GnuTLS.gnutls_session_get_id(session, p, len_pointer);
        if (err != 0) {
            return "";
        }
        var session_id = "";
        for (var i = 0; i < len; i++) {
            // Read a byte, convert it to a hex string (0xAB ==> "AB"), and append
            // it to session_id.
            session_id +=
                ("0" + p.add(i).readU8().toString(16).toUpperCase()).substr(-2);
        }
        return session_id;
    }
    install_plaintext_read_hook() {
        var lib_addesses = this.addresses;
        Interceptor.attach(this.addresses["gnutls_record_recv"], {
            onEnter: function (args) {
                var message = getPortsAndAddresses(GnuTLS.gnutls_transport_get_int(args[0]), true, lib_addesses);
                message["ssl_session_id"] = GnuTLS.getSslSessionId(args[0]);
                message["function"] = "SSL_read";
                this.message = message;
                this.buf = args[1];
            },
            onLeave: function (retval) {
                retval |= 0; // Cast retval to 32-bit integer.
                if (retval <= 0) {
                    return;
                }
                this.message["contentType"] = "datalog";
                send(this.message, this.buf.readByteArray(retval));
            }
        });
    }
    install_plaintext_write_hook() {
        var lib_addesses = this.addresses;
        Interceptor.attach(this.addresses["gnutls_record_send"], {
            onEnter: function (args) {
                var message = getPortsAndAddresses(GnuTLS.gnutls_transport_get_int(args[0]), false, lib_addesses);
                message["ssl_session_id"] = GnuTLS.getSslSessionId(args[0]);
                message["function"] = "SSL_write";
                message["contentType"] = "datalog";
                send(message, args[1].readByteArray(parseInt(args[2])));
            },
            onLeave: function (retval) {
            }
        });
    }
    install_tls_keys_callback_hook() {
    }
}
//NativeCallback
GnuTLS.keylog_callback = new NativeCallback(function (session, label, secret) {
    var message = {};
    message["contentType"] = "keylog";
    var secret_len = secret.add(Process.pointerSize).readUInt();
    var secret_str = "";
    var p = secret.readPointer();
    for (var i = 0; i < secret_len; i++) {
        // Read a byte, convert it to a hex string (0xAB ==> "AB"), and append
        // it to secret_str.
        secret_str +=
            ("0" + p.add(i).readU8().toString(16).toUpperCase()).substr(-2);
    }
    var server_random_ptr = Memory.alloc(Process.pointerSize + 4);
    var client_random_ptr = Memory.alloc(Process.pointerSize + 4);
    if (typeof this !== "undefined") {
        GnuTLS.gnutls_session_get_random(session, client_random_ptr, server_random_ptr);
    }
    else {
        console.log("[-] Error while installing keylog callback");
    }
    var client_random_str = "";
    var client_random_len = 32;
    p = client_random_ptr.readPointer();
    for (i = 0; i < client_random_len; i++) {
        // Read a byte, convert it to a hex string (0xAB ==> "AB"), and append
        // it to client_random_str.
        client_random_str +=
            ("0" + p.add(i).readU8().toString(16).toUpperCase()).substr(-2);
    }
    message["keylog"] = label.readCString() + " " + client_random_str + " " + secret_str;
    send(message);
    return 0;
}, "int", ["pointer", "pointer", "pointer"]);
✄
{"version":3,"file":"java_ssl_libs.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/ssl_lib/java_ssl_libs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EAAE,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAGpD,MAAM,OAAO,QAAQ;IAEjB,kBAAkB;QACd,IAAI,IAAI,CAAC,SAAS,EAAE;YAChB,IAAI,CAAC,OAAO,CAAC;gBAET,6EAA6E;gBAC7E,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;gBAClD,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE;oBAChE,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC,EAAE,GAAG,yLAAyL,CAAC,CAAA;oBAC7N,QAAQ,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAA;oBAC1C,GAAG,CAAC,yBAAyB,CAAC,CAAA;iBACjC;gBAED,8GAA8G;gBAC9G,kDAAkD;gBAClD,iBAAiB,EAAE,CAAA;gBAEnB,+BAA+B;gBAC/B,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;oBAC1D,GAAG,CAAC,iEAAiE,CAAC,CAAA;oBACtE,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;oBACpC,GAAG,CAAC,mBAAmB,CAAC,CAAA;iBAC3B;gBAED,+FAA+F;gBAC/F,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE;oBAClE,GAAG,CAAC,oBAAoB,CAAC,CAAA;oBACzB,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;oBACpC,GAAG,CAAC,mBAAmB,CAAC,CAAA;iBAC3B;gBACD,qDAAqD;gBACrD,yDAAyD;gBAGzD,iEAAiE;gBACjE,QAAQ,CAAC,gBAAgB,CAAC,cAAc,GAAG,UAAU,QAAa,EAAE,QAAgB;oBAChF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE;wBACxI,GAAG,CAAC,oCAAoC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;wBAC9D,OAAO,QAAQ,CAAA;qBAClB;yBAAM;wBACH,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;qBACnD;gBACL,CAAC,CAAA;gBACD,sBAAsB;gBACtB,QAAQ,CAAC,gBAAgB,CAAC,cAAc,GAAG,UAAU,QAAa;oBAC9D,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE;wBACxI,GAAG,CAAC,oCAAoC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;wBAC9D,OAAO,CAAC,CAAA;qBACX;yBAAM;wBAEH,IAAG,SAAS,EAAE,EAAC;4BACX;;;8BAGE;4BACF,IAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,aAAa,EAAC;gCACpC,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAC,CAAC,CAAC,CAAA;6BAC3C;4BAED,4NAA4N;4BAC5N,8CAA8C;4BAC9C,4CAA4C;4BAC5C,sEAAsE;yBACzE;wBAED,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;qBACpC;gBACL,CAAC,CAAA;YACL,CAAC,CAAC,CAAA;SACL;IACL,CAAC;CACJ"}
✄
import { log } from "../util/log.js";
import { execute as conscrypt_execute } from "../android/conscrypt.js";
import { isAndroid } from "../util/process_infos.js";
export class SSL_Java {
    install_java_hooks() {
        if (Java.available) {
            Java.perform(function () {
                //Conscrypt needs early instrumentation as we block the provider installation
                var Security = Java.use("java.security.Security");
                if (Security.getProviders().toString().includes("GmsCore_OpenSSL")) {
                    log("WARNING: PID " + Process.id + " Detected GmsCore_OpenSSL Provider. This can be a bit unstable. If you having issues, rerun with -spawn for early instrumentation. Trying to remove it to fall back on default Provider");
                    Security.removeProvider("GmsCore_OpenSSL");
                    log("Removed GmsCore_OpenSSL");
                }
                //As the classloader responsible for loading ProviderInstaller sometimes is not present from the beginning on,
                //we always have to watch the classloader activity
                conscrypt_execute();
                //Now do the same for Ssl_guard
                if (Security.getProviders().toString().includes("Ssl_Guard")) {
                    log("Ssl_Guard deteced, removing it to fall back on default Provider");
                    Security.removeProvider("Ssl_Guard");
                    log("Removed Ssl_Guard");
                }
                //Same thing for Conscrypt provider which has been manually inserted (not by providerinstaller)
                if (Security.getProviders().toString().includes("Conscrypt version")) {
                    log("Conscrypt detected");
                    Security.removeProvider("Conscrypt");
                    log("Removed Conscrypt");
                }
                //Uncomment this line to show all remaining providers
                //log("Remaining: " + Security.getProviders().toString())
                //Hook insertProviderAt/addprovider for dynamic provider blocking
                Security.insertProviderAt.implementation = function (provider, position) {
                    if (provider.getName().includes("Conscrypt") || provider.getName().includes("Ssl_Guard") || provider.getName().includes("GmsCore_OpenSSL")) {
                        log("Blocking provider registration of " + provider.getName());
                        return position;
                    }
                    else {
                        return this.insertProviderAt(provider, position);
                    }
                };
                //Same for addProvider
                Security.insertProviderAt.implementation = function (provider) {
                    if (provider.getName().includes("Conscrypt") || provider.getName().includes("Ssl_Guard") || provider.getName().includes("GmsCore_OpenSSL")) {
                        log("Blocking provider registration of " + provider.getName());
                        return 1;
                    }
                    else {
                        if (isAndroid()) {
                            /*
                            When a NetworkProvider will be installed it is only allow at position 1
                            s. https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/security/net/config/NetworkSecurityConfigProvider.java
                            */
                            if (provider.getName() === "AndroidNSSP") {
                                return this.insertProviderAt(provider, 1);
                            }
                            // when the "Failed to install provider as highest priority provider. Provider was installed at position"-error is prompted on logcat please uncomment the following line, recompile the typescript and reopen the following
                            // https://github.com/fkie-cad/friTap/issues/1
                            // var android_Version = Java.androidVersion
                            // devlog("highest priority provider error with: "+provider.getName())
                        }
                        return this.addProvider(provider);
                    }
                };
            });
        }
    }
}
✄
{"version":3,"file":"mbedTLS.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/ssl_lib/mbedTLS.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,cAAc,EAAC,MAAM,+BAA+B,CAAA;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AA2FpC,MAAM,OAAO,QAAQ;IAUjB,YAAmB,UAAkB,EAAS,cAAsB,EAAS,6BAAgE;QAA1H,eAAU,GAAV,UAAU,CAAQ;QAAS,mBAAc,GAAd,cAAc,CAAQ;QAAS,kCAA6B,GAA7B,6BAA6B,CAAmC;QAN7I,mBAAmB;QACnB,2BAAsB,GAAqC,EAAE,CAAC;QAM1D,IAAI,OAAO,6BAA6B,KAAK,WAAW,EAAE;YACtD,IAAI,CAAC,sBAAsB,GAAG,6BAA6B,CAAC;SAC/D;aAAM;YACH,IAAI,CAAC,sBAAsB,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;YAC3F,IAAI,CAAC,sBAAsB,CAAC,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;SACzG;QAED,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAE5D,aAAa;QACb,IAAG,OAAO,IAAI,WAAW,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAC;YAEjD,IAAG,OAAO,CAAC,OAAO,IAAI,IAAI,EAAC;gBACvB,MAAM,iBAAiB,GAAG,cAAc,CAAC,cAAc,CAAC,CAAA;gBACxD,KAAI,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAC;oBAC5C,YAAY;oBACb,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;iBACnN;aACJ;YAED,MAAM,kBAAkB,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;YAErD,IAAG,kBAAkB,IAAI,IAAI,EAAC;gBAC1B,GAAG,CAAC,iGAAiG,CAAC,CAAA;aACzG;YAGD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAC;gBAC9C,YAAY;gBACZ,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,kBAAkB,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;aACrN;SAGJ;IAIL,CAAC;IAED,MAAM,CAAC,gCAAgC,CAAC,UAAyB;QAC7D,OAAO;YACH,IAAI,EAAE,UAAU,CAAC,WAAW,EAAE;YAC9B,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;YACpD,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;YAChE,mBAAmB,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;YAC1E,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;YACpE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;YACxE,WAAW,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;YAC9E,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;YACjF,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;YACvG,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;YACnH,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;YAE5E,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;YAC/G,WAAW,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;YAChH,OAAO,EAAE;gBACL,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE;gBAC/E,WAAW,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;gBACxF,WAAW,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;gBAC5F,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;gBAC3F,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;aACvL;SACJ,CAAA;IACL,CAAC;IAED,MAAM,CAAC,mBAAmB,CAAC,UAAyB;QAChD,IAAI,WAAW,GAAG,QAAQ,CAAC,gCAAgC,CAAC,UAAU,CAAC,CAAA;QACvE,OAAO,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;IACtC,CAAC;IAGD,MAAM,CAAC,YAAY,CAAC,UAAyB;QACzC,IAAI,WAAW,GAAG,QAAQ,CAAC,gCAAgC,CAAC,UAAU,CAAC,CAAA;QAEvE,IAAI,UAAU,GAAG,EAAE,CAAA;QACnB,KAAK,IAAI,WAAW,GAAG,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;YAE/E,UAAU,GAAG,GAAG,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAA;SACvH;QAED,OAAO,UAAU,CAAA;IACrB,CAAC;IAGD,2BAA2B;QACvB,IAAI,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,wEAAwE;QACxE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE;YACnD,OAAO,EAAE,UAAU,IAAI;gBACnB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAE1B,IAAI,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;gBACvG,OAAO,CAAC,gBAAgB,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC1D,OAAO,CAAC,UAAU,CAAC,GAAG,kBAAkB,CAAA;gBACxC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;YAC1B,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;gBAC1B,MAAM,IAAI,CAAC,CAAA,CAAC,iCAAiC;gBAC7C,IAAI,MAAM,IAAI,CAAC,EAAE;oBACb,OAAM;iBACT;gBAED,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAC7C,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;gBACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAG5B,CAAC;SAEJ,CAAC,CAAC;IAEP,CAAC;IAGD,4BAA4B;QACxB,IAAI,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,wEAAwE;QACxE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE;YAEpD,OAAO,EAAE,UAAU,IAAI;gBACnB,IAAI,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrB,IAAI,GAAG,GAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;gBACvB,GAAG,IAAI,CAAC,CAAA,CAAC,iCAAiC;gBAC1C,IAAI,GAAG,IAAI,CAAC,EAAE;oBACV,OAAM;iBACT;gBACD,IAAI,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAW,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;gBACxG,OAAO,CAAC,gBAAgB,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC1D,OAAO,CAAC,UAAU,CAAC,GAAG,mBAAmB,CAAA;gBACzC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;gBAClC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACvB,CAAC;SACJ,CAAC,CAAC;IAEP,CAAC;IAGD,8BAA8B;QAC1B,MAAM;IACV,CAAC;CAGJ"}
✄
import { readAddresses, getPortsAndAddresses, getBaseAddress } from "../shared/shared_functions.js";
import { offsets } from "../ssl_log.js";
import { log } from "../util/log.js";
export class mbed_TLS {
    constructor(moduleName, socket_library, passed_library_method_mapping) {
        this.moduleName = moduleName;
        this.socket_library = socket_library;
        this.passed_library_method_mapping = passed_library_method_mapping;
        // global variables
        this.library_method_mapping = {};
        if (typeof passed_library_method_mapping !== 'undefined') {
            this.library_method_mapping = passed_library_method_mapping;
        }
        else {
            this.library_method_mapping[`*${moduleName}*`] = ["mbedtls_ssl_read", "mbedtls_ssl_write"];
            this.library_method_mapping[`*${socket_library}*`] = ["getpeername", "getsockname", "ntohs", "ntohl"];
        }
        this.addresses = readAddresses(this.library_method_mapping);
        // @ts-ignore
        if (offsets != "{OFFSETS}" && offsets.mbedtls != null) {
            if (offsets.sockets != null) {
                const socketBaseAddress = getBaseAddress(socket_library);
                for (const method of Object.keys(offsets.sockets)) {
                    //@ts-ignore
                    this.addresses[`${method}`] = offsets.sockets[`${method}`].absolute || socketBaseAddress == null ? ptr(offsets.sockets[`${method}`].address) : socketBaseAddress.add(ptr(offsets.sockets[`${method}`].address));
                }
            }
            const libraryBaseAddress = getBaseAddress(moduleName);
            if (libraryBaseAddress == null) {
                log("Unable to find library base address! Given address values will be interpreted as absolute ones!");
            }
            for (const method of Object.keys(offsets.mbedtls)) {
                //@ts-ignore
                this.addresses[`${method}`] = offsets.mbedtls[`${method}`].absolute || libraryBaseAddress == null ? ptr(offsets.mbedtls[`${method}`].address) : libraryBaseAddress.add(ptr(offsets.mbedtls[`${method}`].address));
            }
        }
    }
    static parse_mbedtls_ssl_context_struct(sslcontext) {
        return {
            conf: sslcontext.readPointer(),
            state: sslcontext.add(Process.pointerSize).readS32(),
            renego_status: sslcontext.add(Process.pointerSize + 4).readS32(),
            renego_records_seen: sslcontext.add(Process.pointerSize + 4 + 4).readS32(),
            major_ver: sslcontext.add(Process.pointerSize + 4 + 4 + 4).readS32(),
            minor_ver: sslcontext.add(Process.pointerSize + 4 + 4 + 4 + 4).readS32(),
            badmac_seen: sslcontext.add(Process.pointerSize + 4 + 4 + 4 + 4 + 4).readU32(),
            f_send: sslcontext.add(Process.pointerSize + 4 + 4 + 4 + 4 + 4 + 4).readPointer(),
            f_recv: sslcontext.add(Process.pointerSize + 4 + 4 + 4 + 4 + 4 + 4 + Process.pointerSize).readPointer(),
            f_recv_timeout: sslcontext.add(Process.pointerSize + 4 + 4 + 4 + 4 + 4 + 4 + 2 * Process.pointerSize).readPointer(),
            p_bio: sslcontext.add(Process.platform == 'windows' ? 48 : 56).readPointer(),
            session_in: sslcontext.add(Process.pointerSize + 4 + 4 + 4 + 4 + 4 + 4 + 4 * Process.pointerSize).readPointer(),
            session_out: sslcontext.add(Process.pointerSize + 4 + 4 + 4 + 4 + 4 + 4 + 5 * Process.pointerSize).readPointer(),
            session: {
                start: sslcontext.add(24 + 7 * Process.pointerSize).readPointer().readPointer(),
                ciphersuite: sslcontext.add(24 + 7 * Process.pointerSize).readPointer().add(8).readS32(),
                compression: sslcontext.add(24 + 7 * Process.pointerSize).readPointer().add(8 + 4).readS32(),
                id_len: sslcontext.add(24 + 7 * Process.pointerSize).readPointer().add(8 + 4 + 4).readU32(),
                id: sslcontext.add(24 + 7 * Process.pointerSize).readPointer().add(8 + 4 + 4 + 4).readByteArray(sslcontext.add(24 + 7 * Process.pointerSize).readPointer().add(8 + 4 + 4).readU32())
            }
        };
    }
    static getSocketDescriptor(sslcontext) {
        var ssl_context = mbed_TLS.parse_mbedtls_ssl_context_struct(sslcontext);
        return ssl_context.p_bio.readS32();
    }
    static getSessionId(sslcontext) {
        var ssl_context = mbed_TLS.parse_mbedtls_ssl_context_struct(sslcontext);
        var session_id = '';
        for (var byteCounter = 0; byteCounter < ssl_context.session.id_len; byteCounter++) {
            session_id = `${session_id}${ssl_context.session.id?.unwrap().add(byteCounter).readU8().toString(16).toUpperCase()}`;
        }
        return session_id;
    }
    install_plaintext_read_hook() {
        var lib_addesses = this.addresses;
        //https://tls.mbed.org/api/ssl_8h.html#aa2c29eeb1deaf5ad9f01a7515006ede5
        Interceptor.attach(this.addresses["mbedtls_ssl_read"], {
            onEnter: function (args) {
                this.buffer = args[1];
                this.len = args[2];
                this.sslContext = args[0];
                var message = getPortsAndAddresses(mbed_TLS.getSocketDescriptor(args[0]), true, lib_addesses);
                message["ssl_session_id"] = mbed_TLS.getSessionId(args[0]);
                message["function"] = "mbedtls_ssl_read";
                this.message = message;
            },
            onLeave: function (retval) {
                retval |= 0; // Cast retval to 32-bit integer.
                if (retval <= 0) {
                    return;
                }
                var data = this.buffer.readByteArray(retval);
                this.message["contentType"] = "datalog";
                send(this.message, data);
            }
        });
    }
    install_plaintext_write_hook() {
        var lib_addesses = this.addresses;
        //https://tls.mbed.org/api/ssl_8h.html#a5bbda87d484de82df730758b475f32e5
        Interceptor.attach(this.addresses["mbedtls_ssl_write"], {
            onEnter: function (args) {
                var buffer = args[1];
                var len = args[2];
                len |= 0; // Cast retval to 32-bit integer.
                if (len <= 0) {
                    return;
                }
                var data = buffer.readByteArray(len);
                var message = getPortsAndAddresses(mbed_TLS.getSocketDescriptor(args[0]), false, lib_addesses);
                message["ssl_session_id"] = mbed_TLS.getSessionId(args[0]);
                message["function"] = "mbedtls_ssl_write";
                message["contentType"] = "datalog";
                send(message, data);
            }
        });
    }
    install_tls_keys_callback_hook() {
        // TBD
    }
}
✄
{"version":3,"file":"nss.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/ssl_lib/nss.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAqIvC,MAAM,EACF,OAAO,EACP,OAAO,EACP,WAAW,EACX,QAAQ,EACR,QAAQ,EACR,YAAY,EACf,GAAG,aAAa,CAAC,SAAS,CAAC;AAG5B,6FAA6F;AAC7F,MAAM,CAAN,IAAY,SAIX;AAJD,WAAY,SAAS;IACjB,4DAAoB,CAAA;IACpB,sDAAiB,CAAA;IACjB,qDAAgB,CAAA;AACpB,CAAC,EAJW,SAAS,KAAT,SAAS,QAIpB;AAAA,CAAC;AAEF,MAAM,CAAN,IAAY,UAMX;AAND,WAAY,UAAU;IAClB,2DAAgB,CAAA;IAChB,uEAAsB,CAAA;IACtB,uEAAsB,CAAA;IACtB,iEAAmB,CAAA;IACnB,2DAAgB,CAAA;AACpB,CAAC,EANW,UAAU,KAAV,UAAU,QAMrB;AAAC,UAAU,CAAC;AAEb,MAAM,OAAO,GAAG;IAqBZ,YAAmB,UAAkB,EAAS,cAAsB,EAAS,6BAAgE;QAA1H,eAAU,GAAV,UAAU,CAAQ;QAAS,mBAAc,GAAd,cAAc,CAAQ;QAAS,kCAA6B,GAA7B,6BAA6B,CAAmC;QAd7I,mBAAmB;QACnB,2BAAsB,GAAqC,EAAE,CAAC;QAc1D,IAAI,OAAO,6BAA6B,KAAK,WAAW,EAAE;YACtD,IAAI,CAAC,sBAAsB,GAAG,6BAA6B,CAAC;SAC/D;aAAM;YACH,IAAI,CAAC,sBAAsB,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,CAAC,CAAA;YACnL,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,GAAG,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,CAAA;YACrF,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAA;YAC1G,IAAI,CAAC,sBAAsB,CAAC,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;SACxG;QAED,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAE5D,aAAa;QACZ,IAAG,OAAO,IAAI,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,EAAC;YAE9C,IAAG,OAAO,CAAC,OAAO,IAAI,IAAI,EAAC;gBACvB,MAAM,iBAAiB,GAAG,cAAc,CAAC,cAAc,CAAC,CAAA;gBACxD,KAAI,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAC;oBAC5C,YAAY;oBACb,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;iBACnN;aACJ;YAED,MAAM,kBAAkB,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;YAErD,IAAG,kBAAkB,IAAI,IAAI,EAAC;gBAC1B,GAAG,CAAC,iGAAiG,CAAC,CAAA;aACzG;YAGD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAC;gBAC1C,YAAY;gBACZ,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,kBAAkB,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;aACzM;SAGJ;QAED,GAAG,CAAC,kBAAkB,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QACvG,GAAG,CAAC,WAAW,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACtG,GAAG,CAAC,WAAW,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAK1G,CAAC;IAED,uBAAuB;IAEvB,MAAM,CAAC,oBAAoB,CAAC,OAAsB;QAC9C;;;;;;UAME;QACF,OAAO;YACH,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE;YACzB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;YAC9C,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;SAChD,CAAA;IACL,CAAC;IAGD,oEAAoE;IACpE,MAAM,CAAC,yBAAyB,CAAC,WAA0B;QACvD,OAAO;YACH,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE;YAC/B,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAC/B,mBAAmB,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YACzC,gBAAgB,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YACtC,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;SAChC,CAAA;IACL,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,oBAAoB,CAAC,WAA0B;QAClD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA8BE;QACF,OAAO;YACH,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;YACpD,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;YACxD,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;YACxD,wBAAwB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;YACpE,mBAAmB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;YACnE,0BAA0B,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;YAC1E,qBAAqB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;YACtE,mBAAmB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;YACxE,kBAAkB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;YACvE,iBAAiB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;YACtE,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;YAChE,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;YACzD,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;YACpE,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;YACpE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;YAC9D,IAAI,EAAE;gBACF,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,CAAC;gBACvD,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,CAAC;gBACvD,qBAAqB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,CAAC;gBAC7D,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBACvD,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBAC7D,UAAU,EAAE;oBACR,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;oBAC7D,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;oBACxD,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;oBAC1D,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;iBAE7D;gBACD,kBAAkB,EAAE;oBAChB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;oBAC7D,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;oBACxD,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;oBAC1D,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;iBAE7D;gBACD,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBAC5D,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBAC5D,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBACpE,kBAAkB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBACzE,iBAAiB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBACpE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBAChE,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBACjE,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBAClE,UAAU,EAAE;oBACR,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;oBAC7D,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;oBACxD,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;oBAC1D,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;iBAE7D;gBACD,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBACjE,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBAC7D,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBAC5D,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBAC/D,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBAChE,0BAA0B,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBAC7E,kBAAkB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC;gBAC3D,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBAClE,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC;gBACvD,wBAAwB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBAC3E,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBAClE,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBAClE,iBAAiB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBACpE,kBAAkB,EAAE;oBAChB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;oBAC7D,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;iBAChE;gBACD,oBAAoB,EAAE;oBAClB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;oBAC7D,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;iBAChE;gBACD,gBAAgB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBACnE,mBAAmB,EAAE;oBACjB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;oBAC7D,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;iBAChE;gBACD,gBAAgB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBACnE,gBAAgB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBACnE,gBAAgB,EAAE;oBACd,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;oBAC7D,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;oBACxD,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;oBAC1D,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;iBAE7D;gBACD,gBAAgB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBACnE,QAAQ,EAAE;oBACN,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;oBACzD,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;oBAC7D,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;iBAC3D;gBACD,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBAChE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBAChE,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBACjE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBAChE,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;gBAC9D,aAAa,EAAE;oBACX,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;oBACzD,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;oBAC7D,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE;iBAC3D;gBACD,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBACtE,wBAAwB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBAC/E,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBAClE,0BAA0B,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBACjF,uBAAuB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBAC9E,uBAAuB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBAC9E,qBAAqB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBAC5E,qBAAqB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBAC5E,qBAAqB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;gBAC5E,gBAAgB,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;aAE1E,CAAC,mBAAmB;YAErB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA0FE;SACL,CAAA;IAEL,CAAC;IAGD,qEAAqE;IACrE,MAAM,CAAC,6BAA6B,CAAC,MAAqB;QACtD;;;;;;;;;;;;;;;;;UAiBE;QACF,OAAO;YACH,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC;YACpC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1C,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC;YACjD,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;YAC3D,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;YACxD,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC;YAC1C,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;YAC/D,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;SAClE,CAAA;IAEL,CAAC;IA2DD,0CAA0C;IAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+CF;IACE,MAAM,CAAC,2BAA2B,CAAC,MAAqB,EAAE,MAAe,EAAE,eAAiD;QACxH,IAAI,WAAW,GAAG,IAAI,cAAc,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;QACtG,IAAI,WAAW,GAAG,IAAI,cAAc,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;QACtG,IAAI,KAAK,GAAG,IAAI,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC9E,IAAI,KAAK,GAAG,IAAI,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;QAE9E,IAAI,OAAO,GAAuC,EAAE,CAAA;QACpD,IAAI,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC,wDAAwD;QAGvF,mDAAmD;QACnD,IAAI,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,OAAO,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACrC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;YACrB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,MAAM,EAAE;gBAClC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;aAC5B;iBACI;gBACD,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;aAC5B;YAED,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,OAAO,EAAE;gBAC3B,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAW,CAAA;gBACtE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAW,CAAA;gBACtE,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAA;aACnC;iBAAM,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,QAAQ,EAAE;gBACnC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAW,CAAA;gBACtE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;gBAClC,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBAC3B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,IAAI,CAAC,EAAE;oBAC3C,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;iBAChH;gBACD,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE;oBACpF,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAW,CAAA;oBAC5E,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAA;iBACnC;qBACI;oBACD,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAA;iBACpC;aACJ;iBAAM;gBACH,MAAM,CAAC,2BAA2B,CAAC,CAAA;gBACnC,0HAA0H;gBAC1H,MAAM,wBAAwB,CAAA;aACjC;SAEJ;QACD,OAAO,OAAO,CAAA;IAClB,CAAC;IAOD;;;;;MAKE;IACF,MAAM,CAAC,sBAAsB,CAAC,QAAuB;QACjD,IAAI;YACA,2DAA2D;YAC3D,QAAQ,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,CAAC;SACZ;QAAC,OAAO,KAAK,EAAE;YACZ,OAAO,CAAC,CAAC,CAAC;SACb;IACL,CAAC;IAED;;;;;;;;;;;;;;MAcE;IACF,MAAM,CAAC,uBAAuB,CAAC,UAAyB,EAAE,UAAkB;QACxE,IAAI,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9D,IAAI,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/D,IAAI,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAE7D,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE;YACpB,IAAI,OAAO,GAAmB,GAAG,CAAC,qBAAqB,CAAC,QAAQ,CAAE,CAAC,WAAW,EAAE,CAAC;YACjF,IAAI,OAAO,IAAI,UAAU,EAAE;gBACvB,OAAO,UAAU,CAAC;aACrB;SACJ;QAED,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE;YACrB,OAAO,IAAI,CAAC,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;SAC9D;QAED,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE;YACtB,MAAM,CAAC,YAAY,CAAC,CAAA;SACvB;QAGD,iDAAiD;QACjD,MAAM,CAAC,mCAAmC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IAEhB,CAAC;IAID,MAAM,CAAC,kBAAkB,CAAC,cAA6B,EAAE,GAAW;QAChE,IAAI,UAAU,GAAG,EAAE,CAAC;QAGpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE;YAC1B,sEAAsE;YACtE,oBAAoB;YAEpB,UAAU;gBACN,CAAC,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;SACnF;QAED,OAAO,UAAU,CAAA;IACrB,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,UAAyB;QAEzC,IAAI,YAAY,GAAG,CAAC,CAAA,CAAC,mCAAmC;QACxD,IAAI,kBAAkB,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,uBAAuB,CAAC,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAA;QAE1I,IAAI,SAAS,GAAG,kBAAkB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAAC;YAEhD,OAAO,CAAC,CAAC,CAAC;SACb;QACD,OAAO,SAAS,CAAC;IAGrB,CAAC;IAMD;;;;;MAKE;IACF,MAAM,CAAC,YAAY,CAAC,QAAuB,EAAE,GAAW;QACpD,IAAI,UAAU,GAAG,EAAE,CAAC;QAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE;YAC1B,sEAAsE;YACtE,oBAAoB;YAEpB,UAAU;gBACN,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;SAC7E;QAED,OAAO,UAAU,CAAC;IACtB,CAAC;IASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCD;IAGC,MAAM,CAAC,qBAAqB,CAAC,UAAyB;QAClD,IAAI,kBAAkB,GAAG,kEAAkE,CAAC;QAC5F,IAAI,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACxC,iCAAiC;QACjC;;;;;;WAMG;QACH,IAAI,KAAK,GAAG,GAAG,CAAC,uBAAuB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE;YACR,OAAO,kBAAkB,CAAC;SAC7B;QAED,IAAI,mBAAmB,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;QAGvE,IAAI,mBAAmB,IAAI,IAAI,IAAI,mBAAmB,CAAC,MAAM,EAAE,EAAE;YAC7D,IAAI;gBACA,MAAM,CAAC,kCAAkC,CAAC,CAAA;gBAC1C,MAAM,CAAC,OAAO,CAAC,CAAA;gBACf,MAAM,CAAC,kBAAkB,GAAG,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAA;gBACxD,IAAI,MAAM,IAAI,CAAC,EAAE;oBACb,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;oBAClC,iBAAiB;oBACjB,IAAI,iBAAiB,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;oBAChI,IAAI,sBAAsB,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,uBAAuB,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;oBACtI,IAAI,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;oBAC5C,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC;oBAC9B,IAAI,YAAY,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;oBAClD,MAAM,CAAC,gBAAgB,GAAG,YAAY,CAAC,CAAA;oBACvC,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;oBAG7D,IAAI,oBAAoB,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;oBACvE,MAAM,CAAC,wBAAwB,GAAG,oBAAoB,CAAC,CAAA;oBAEvD,IAAI,oBAAoB,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE;wBACpD,IAAI,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAA;wBAC7C,kBAAkB;wBAElB,IAAI,oBAAoB,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;wBACvF,MAAM,CAAC,wBAAwB,GAAG,oBAAoB,CAAC,CAAA;qBAC1D;oBAGD,IAAI,oBAAoB,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;oBAC7E,MAAM,CAAC,wBAAwB,GAAG,oBAAoB,CAAC,CAAA;oBAEvD,MAAM,CAAC,wBAAwB,CAAC,CAAA;oBAChC,MAAM,CAAC,EAAE,CAAC,CAAA;iBACb;qBAAM,IAAI,MAAM,IAAI,CAAC,EAAE;oBACpB,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;oBACzD,IAAI,mBAAmB,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAE7E,MAAM,CAAC,sBAAsB,GAAG,mBAAmB,CAAC,CAAA;iBACvD;qBAAM;oBACH,MAAM,CAAC,wCAAwC,CAAC,CAAC;oBACjD,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;oBAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;iBAEtB;gBAED,MAAM,CAAC,2CAA2C,CAAC,CAAC;gBACpD,MAAM,CAAC,EAAE,CAAC,CAAC;aACd;YAAC,OAAO,KAAK,EAAE;gBACZ,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAA;aAE3B;YACD,OAAO,kBAAkB,CAAC;SAG7B;QAED,IAAI,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAE7D,IAAI,cAAc,GAAG,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAA;QAEvE,IAAI,UAAU,GAAG,GAAG,CAAC,kBAAkB,CAAC,cAAc,EAAE,GAAG,CAAC,CAAA;QAE5D,OAAO,UAAU,CAAA;IACrB,CAAC;IAID,MAAM,CAAC,UAAU,CAAC,UAAyB;QACvC,IAAI,SAAS,GAAG,GAAG,CAAC,uBAAuB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,EAAE;YACZ,MAAM,CAAC,+CAA+C,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;SACf;QAED,IAAI,WAAW,GAAG,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,EAAE;YACd,MAAM,CAAC,iCAAiC,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;SACf;QAED,OAAO,WAAW,CAAC;IACvB,CAAC;IAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAuCE;IAGF,MAAM,CAAC,cAAc,CAAC,SAAwB;QAC1C,IAAI,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,sCAAsC;IAItC;;;;;;OAMG;IACH,MAAM,CAAC,eAAe,CAAC,IAAkB;QACrC,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QACzB,IAAI,gBAAgB,GAAG,GAAG,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;QAE/E,IAAI,aAAa,GAAG,GAAG,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;QAElE,OAAO,aAAa,CAAC;IAEzB,CAAC;IAKD;;;;;OAKG;IAEH,MAAM,CAAC,eAAe,CAAC,IAAkB;QACrC,IAAI,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAEpF,OAAO,aAAa,CAAC;IAEzB,CAAC;IAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IAGH,MAAM,CAAC,eAAe,CAAC,UAAyB;QAC5C,IAAI,yBAAyB,GAAG,CAAC,CAAC,CAAC;QAEnC,IAAI,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE;YACpB,OAAO,CAAC,CAAC,CAAC;SACb;QAGD,IAAI,sBAAsB,GAAG,GAAG,CAAC;QAEjC,yBAAyB,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAG9E,OAAO,yBAAyB,CAAC;IAErC,CAAC;IAKD,MAAM,CAAC,uBAAuB,CAAC,cAA6B;QAGxD,IAAI,EAAE,GAAG,GAAG,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAClD,IAAI,EAAE,IAAI,SAAS,CAAC,UAAU,EAAE;YAC5B,0CAA0C;YAC1C,OAAO,EAAE,CAAC;SACb;QACD,IAAI,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAE,4BAA4B;QAEhF,IAAI,eAAe,GAAG,GAAG,CAAC,oBAAoB,CAAC,OAAwB,CAAC,CAAC;QAEzE,IAAI,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC;QAEtF,OAAO,mBAAmB,CAAC;IAC/B,CAAC;IAGD;;;;;;;;;;;;OAYG;IAEH,MAAM,CAAC,UAAU,CAAC,yBAAiC;QAC/C,IAAI,yBAAyB,GAAG,GAAG,EAAE;YACjC,OAAO,IAAI,CAAC;SACf;aAAM;YACH,OAAO,KAAK,CAAC;SAChB;IACL,CAAC;IAED,0CAA0C;IAE1C,MAAM,CAAC,eAAe,CAAC,IAAY,EAAE,aAAqB,EAAE,GAAW;QACnE,OAAO,IAAI,GAAG,GAAG,GAAG,aAAa,GAAG,GAAG,GAAG,GAAG,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IAEH,MAAM,CAAC,WAAW,CAAC,UAAyB,EAAE,yBAAiC;QAC3E,IAAI,OAAO,GAAuC,EAAE,CAAA;QACpD,OAAO,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC;QAClC,MAAM,CAAC,6CAA6C,CAAC,CAAC;QAGtD,IAAI,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE;YACtB,OAAO;SACV;QAID,IAAI,YAAY,GAAG,GAAG,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAC9D,IAAI,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC;QACpC,IAAI,IAAI,GAAG,GAAG,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAGjD,kGAAkG;QAClG,IAAI,aAAa,GAAG,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,GAAG,CAAC,YAAY,IAAI,CAAC,EAAE;YACvB,kHAAkH;YAClH,IAAI,qBAAqB,GAAG,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,uBAAuB;YAC7G,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,uBAAuB,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;YAC3F,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,uBAAuB,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;YACvG,IAAI,CAAC,OAAO,CAAC,CAAC;YACd,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;SACzB;QAED,IAAI,yBAAyB,IAAI,CAAC,EAAE;YAChC,MAAM,CAAC,iDAAiD,CAAC,CAAC;YAC1D;;eAEG;YACH,sIAAsI;YACtI,IAAI,+BAA+B,GAAG,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,iCAAiC;YAEnI,mCAAmC;YACnC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,iCAAiC,EAAE,aAAa,EAAE,+BAA+B,CAAC,CAAC,CAAC;YAC/G,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,iCAAiC,EAAE,aAAa,EAAE,+BAA+B,CAAC,CAAC;YAC3H,IAAI,CAAC,OAAO,CAAC,CAAC;YAEd,sIAAsI;YACtI,IAAI,+BAA+B,GAAG,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,iCAAiC;YACnI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,iCAAiC,EAAE,aAAa,EAAE,+BAA+B,CAAC,CAAC,CAAC;YAG/G,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,iCAAiC,EAAE,aAAa,EAAE,+BAA+B,CAAC,CAAC;YAC3H,IAAI,CAAC,OAAO,CAAC,CAAC;YAEd,OAAO;SACV;aAAM,IAAI,yBAAyB,IAAI,CAAC,EAAE;YACvC,MAAM,CAAC,sDAAsD,CAAC,CAAC;YAE/D,IAAI,2BAA2B,GAAG,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,6BAA6B;YAC9H,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,6BAA6B,EAAE,aAAa,EAAE,2BAA2B,CAAC,CAAC,CAAC;YACvG,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,6BAA6B,EAAE,aAAa,EAAE,2BAA2B,CAAC,CAAC;YACnH,IAAI,CAAC,OAAO,CAAC,CAAC;YACd,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,qDAAqD;YAC3E,OAAO;SACV;QAGD,IAAI,yBAAyB,GAAG,GAAG,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAIhE,IAAI,GAAG,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE;YAC3C,MAAM,CAAC,uCAAuC,CAAC,CAAC;YAEhD,IAAI,qBAAqB,GAAG,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,yBAAyB;YAC/G,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,yBAAyB,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;YAC7F,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,yBAAyB,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;YACzG,IAAI,CAAC,OAAO,CAAC,CAAC;YAGd,IAAI,qBAAqB,GAAG,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,yBAAyB;YAC/G,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,yBAAyB,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;YAC7F,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,yBAAyB,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;YACzG,IAAI,CAAC,OAAO,CAAC,CAAC;YAEd,IAAI,eAAe,GAAG,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB;YAC7F,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,iBAAiB,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;YAC/E,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,iBAAiB,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;YAC3F,IAAI,CAAC,OAAO,CAAC,CAAC;SAGjB;aAAM;YACH,MAAM,CAAC,uCAAuC,CAAC,CAAC;YAEhD,IAAI,aAAa,GAAG,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,eAAe,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;YAC3E,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,eAAe,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;YACvF,IAAI,CAAC,OAAO,CAAC,CAAC;SAEjB;QAGD,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;QACtB,OAAO;IACX,CAAC;IAKD,MAAM,CAAC,gBAAgB,CAAC,WAA0B;QAC9C,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAEpC,CAAC;IAID,kCAAkC;IAElC,2BAA2B;QACvB,IAAI,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QAGlC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EACxC;YACI,OAAO,EAAE,UAAU,IAAS;gBACxB,qBAAqB;gBACrB,IAAI,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBACtB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YAC3B,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;gBAC1B,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,YAAY,EAAE;oBAC9E,OAAM;iBACT;gBAED,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBACzC,wGAAwG;gBAGxG,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE;oBACtE,IAAI,OAAO,GAAG,GAAG,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAmB,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;oBAC3F,MAAM,CAAC,cAAc,GAAG,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;oBAC3D,OAAO,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;oBAC9D,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAA;oBAChC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;oBAEtB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;oBACvC,IAAI,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;iBACpE;qBAAM;oBACH,IAAI,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;oBACjE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;iBAC/B;YACL,CAAC;SACJ,CAAC,CAAA;IAIV,CAAC;IAGD,4BAA4B;QACxB,IAAI,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QAElC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EACzC;YACI,OAAO,EAAE,UAAU,IAAS;gBACxB,IAAI,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;gBAClB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACtB,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;gBAC1B,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAC,2DAA2D;oBACnF,OAAM;iBACT;gBAED,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAE3B,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBAE/B,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE;oBACtE,IAAI,OAAO,GAAG,GAAG,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAmB,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;oBAC5F,OAAO,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;oBAC9D,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,CAAA;oBACjC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;oBAClC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;iBAC9D;YAEL,CAAC;SACJ,CAAC,CAAA;IAEV,CAAC;IAED,gDAAgD;IAGhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCF;IAGE,MAAM,CAAC,4CAA4C,CAAC,WAA0B,EAAE,KAAa;QACzF,IAAI,KAAK,IAAI,CAAC,EAAE,EAAE,8BAA8B;YAC5C,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;SACnC;aAAM,IAAI,KAAK,IAAI,CAAC,EAAE,EAAE,0CAA0C;YAC/D,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAGhC;;;;;;;;;;;;;;eAcG;SACN;aAAM,IAAI,KAAK,IAAI,CAAC,EAAE,EAAE,iDAAiD;YACtE,OAAO;YACP,mDAAmD;SACtD;aAAM;YACH,MAAM,CAAC,yCAAyC,CAAC,CAAC;SACrD;IAEL,CAAC;IAED,MAAM,CAAC,+BAA+B,CAAC,gCAA+C;QAClF,WAAW,CAAC,MAAM,CAAC,gCAAgC,EAC/C;YACI,OAAO,CAAC,IAAS;gBACb,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrB,GAAG,CAAC,4CAA4C,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,CAAC,MAAW;YACnB,CAAC;SAEJ,CAAC,CAAC;IAEX,CAAC;IAED;;;;;;;WAOO;IACP,MAAM,CAAC,wBAAwB,CAAC,UAAyB;QACrD,IAAI,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE;YACtB,MAAM,CAAC,8EAA8E,CAAC,CAAC;YACvF,OAAO;SACV;QACD,IAAI,YAAY,GAAG,GAAG,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,sBAAsB,CAAC,YAAY,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE;YAC5E,GAAG,CAAC,+BAA+B,CAAC,YAAY,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;SAClF;aAAM;YACH,YAAY,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;SACjE;QAGD,MAAM,CAAC,wBAAwB,GAAG,GAAG,CAAC,eAAe,GAAG,0BAA0B,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IAGtH,CAAC;IAGD,8BAA8B;IAE9B,CAAC;;AA/xCD,qBAAqB;AACd,gBAAY,GAAG,CAAC,CAAC,CAAC;AAClB,sBAAkB,GAAG,EAAE,CAAC;AAqX/B,sCAAsC;AAEtC;;;;;;EAME;AACK,mBAAe,GAAG,IAAI,cAAc,CAAC,UAAU,WAAW,EAAE,WAAW;IAC1E,IAAI,OAAO,IAAI,KAAK,WAAW,EAAE;QAC7B,GAAG,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;KACrC;SAAM;QACH,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;KACzE;IACD,OAAO,CAAC,CAAC;AACb,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAInC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACI,mBAAe,GAAG,IAAI,cAAc,CAAC,UAAU,WAA0B,EAAE,KAAa,EAAE,GAAW,EAAE,MAAqB,EAAE,OAAsB;IACvJ,IAAI,OAAO,IAAI,KAAK,WAAW,EAAE;QAC7B,GAAG,CAAC,4CAA4C,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;KACxE;SAAM;QACH,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;KAC5F;IAED,OAAO;AACX,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC"}
✄
import { readAddresses, getBaseAddress } from "../shared/shared_functions.js";
import { pointerSize, AF_INET, AF_INET6 } from "../shared/shared_structures.js";
import { log, devlog } from "../util/log.js";
import { offsets } from "../ssl_log.js";
const { readU32, readU64, readPointer, writeU32, writeU64, writePointer } = NativePointer.prototype;
// https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/ssltyp#1026722
export var SECStatus;
(function (SECStatus) {
    SECStatus[SECStatus["SECWouldBlock"] = -2] = "SECWouldBlock";
    SECStatus[SECStatus["SECFailure"] = -1] = "SECFailure";
    SECStatus[SECStatus["SECSuccess"] = 0] = "SECSuccess";
})(SECStatus || (SECStatus = {}));
;
export var PRDescType;
(function (PRDescType) {
    PRDescType[PRDescType["PR_DESC_FILE"] = 1] = "PR_DESC_FILE";
    PRDescType[PRDescType["PR_DESC_SOCKET_TCP"] = 2] = "PR_DESC_SOCKET_TCP";
    PRDescType[PRDescType["PR_DESC_SOCKET_UDP"] = 3] = "PR_DESC_SOCKET_UDP";
    PRDescType[PRDescType["PR_DESC_LAYERED"] = 4] = "PR_DESC_LAYERED";
    PRDescType[PRDescType["PR_DESC_PIPE"] = 5] = "PR_DESC_PIPE";
})(PRDescType || (PRDescType = {}));
PRDescType;
export class NSS {
    constructor(moduleName, socket_library, passed_library_method_mapping) {
        this.moduleName = moduleName;
        this.socket_library = socket_library;
        this.passed_library_method_mapping = passed_library_method_mapping;
        // global variables
        this.library_method_mapping = {};
        if (typeof passed_library_method_mapping !== 'undefined') {
            this.library_method_mapping = passed_library_method_mapping;
        }
        else {
            this.library_method_mapping[`*${moduleName}*`] = ["PR_Write", "PR_Read", "PR_FileDesc2NativeHandle", "PR_GetPeerName", "PR_GetSockName", "PR_GetNameForIdentity", "PR_GetDescType"];
            this.library_method_mapping[`*libnss*`] = ["PK11_ExtractKeyValue", "PK11_GetKeyData"];
            this.library_method_mapping["*libssl*.so"] = ["SSL_ImportFD", "SSL_GetSessionID", "SSL_HandshakeCallback"];
            this.library_method_mapping[`*${socket_library}*`] = ["getpeername", "getsockname", "ntohs", "ntohl"];
        }
        this.addresses = readAddresses(this.library_method_mapping);
        // @ts-ignore
        if (offsets != "{OFFSETS}" && offsets.nss != null) {
            if (offsets.sockets != null) {
                const socketBaseAddress = getBaseAddress(socket_library);
                for (const method of Object.keys(offsets.sockets)) {
                    //@ts-ignore
                    this.addresses[`${method}`] = offsets.sockets[`${method}`].absolute || socketBaseAddress == null ? ptr(offsets.sockets[`${method}`].address) : socketBaseAddress.add(ptr(offsets.sockets[`${method}`].address));
                }
            }
            const libraryBaseAddress = getBaseAddress(moduleName);
            if (libraryBaseAddress == null) {
                log("Unable to find library base address! Given address values will be interpreted as absolute ones!");
            }
            for (const method of Object.keys(offsets.nss)) {
                //@ts-ignore
                this.addresses[`${method}`] = offsets.nss[`${method}`].absolute || libraryBaseAddress == null ? ptr(offsets.nss[`${method}`].address) : libraryBaseAddress.add(ptr(offsets.nss[`${method}`].address));
            }
        }
        NSS.SSL_SESSION_get_id = new NativeFunction(this.addresses["SSL_GetSessionID"], "pointer", ["pointer"]);
        NSS.getsockname = new NativeFunction(this.addresses["PR_GetSockName"], "int", ["pointer", "pointer"]);
        NSS.getpeername = new NativeFunction(this.addresses["PR_GetPeerName"], "int", ["pointer", "pointer"]);
    }
    /* PARSING functions */
    static parse_struct_SECItem(secitem) {
        /*
         * struct SECItemStr {
         * SECItemType type;
         * unsigned char *data;
         * unsigned int len;
         * }; --> size = 20
        */
        return {
            "type": secitem.readU64(),
            "data": secitem.add(pointerSize).readPointer(),
            "len": secitem.add(pointerSize * 2).readU32()
        };
    }
    // https://github.com/nss-dev/nss/blob/master/lib/ssl/sslimpl.h#L971
    static parse_struct_sslSocketStr(sslSocketFD) {
        return {
            "fd": sslSocketFD.readPointer(),
            "version": sslSocketFD.add(160),
            "handshakeCallback": sslSocketFD.add(464),
            "secretCallback": sslSocketFD.add(568),
            "ssl3": sslSocketFD.add(1432)
        };
    }
    // https://github.com/nss-dev/nss/blob/master/lib/ssl/sslimpl.h#L771
    static parse_struct_ssl3Str(ssl3_struct) {
        /*
        struct ssl3StateStr {
    
        ssl3CipherSpec *crSpec; // current read spec.
        ssl3CipherSpec *prSpec; // pending read spec.
        ssl3CipherSpec *cwSpec; // current write spec.
        ssl3CipherSpec *pwSpec; // pending write spec.
        
        PRBool peerRequestedKeyUpdate;                     --> enum type
        
        PRBool keyUpdateDeferred;                          --> enum type
        tls13KeyUpdateRequest deferredKeyUpdateRequest;    --> enum type
       
        PRBool clientCertRequested;                        --> enum type
    
        CERTCertificate *clientCertificate;
        SECKEYPrivateKey *clientPrivateKey;
        CERTCertificateList *clientCertChain;
        PRBool sendEmptyCert;
    
        PRUint8 policy;
        PLArenaPool *peerCertArena;
        
        void *peerCertChain;
        
        CERTDistNames *ca_list;
        
        SSL3HandshakeState hs;
        ...
        }
        */
        return {
            "crSpec": ssl3_struct.readPointer(),
            "prSpec": ssl3_struct.add(pointerSize).readPointer(),
            "cwSpec": ssl3_struct.add(pointerSize * 2).readPointer(),
            "pwSpec": ssl3_struct.add(pointerSize * 3).readPointer(),
            "peerRequestedKeyUpdate": ssl3_struct.add(pointerSize * 4).readU32(),
            "keyUpdateDeferred": ssl3_struct.add(pointerSize * 4 + 4).readU32(),
            "deferredKeyUpdateRequest": ssl3_struct.add(pointerSize * 4 + 8).readU32(),
            "clientCertRequested": ssl3_struct.add(pointerSize * 4 + 12).readU32(),
            "clientCertificate": ssl3_struct.add(pointerSize * 4 + 16).readPointer(),
            "clientPrivateKey": ssl3_struct.add(pointerSize * 5 + 16).readPointer(),
            "clientCertChain": ssl3_struct.add(pointerSize * 6 + 16).readPointer(),
            "sendEmptyCert": ssl3_struct.add(pointerSize * 7 + 16).readU32(),
            "policy": ssl3_struct.add(pointerSize * 7 + 20).readU32(),
            "peerCertArena": ssl3_struct.add(pointerSize * 7 + 24).readPointer(),
            "peerCertChain": ssl3_struct.add(pointerSize * 8 + 24).readPointer(),
            "ca_list": ssl3_struct.add(pointerSize * 9 + 24).readPointer(),
            "hs": {
                "server_random": ssl3_struct.add(pointerSize * 10 + 24),
                "client_random": ssl3_struct.add(pointerSize * 10 + 56),
                "client_inner_random": ssl3_struct.add(pointerSize * 10 + 88),
                "ws": ssl3_struct.add(pointerSize * 10 + 120).readU32(),
                "hashType": ssl3_struct.add(pointerSize * 10 + 124).readU32(),
                "messages": {
                    "data": ssl3_struct.add(pointerSize * 10 + 128).readPointer(),
                    "len": ssl3_struct.add(pointerSize * 11 + 128).readU32(),
                    "space": ssl3_struct.add(pointerSize * 11 + 132).readU32(),
                    "fixed": ssl3_struct.add(pointerSize * 11 + 136).readU32(),
                },
                "echInnerMessages": {
                    "data": ssl3_struct.add(pointerSize * 11 + 140).readPointer(),
                    "len": ssl3_struct.add(pointerSize * 12 + 140).readU32(),
                    "space": ssl3_struct.add(pointerSize * 12 + 144).readU32(),
                    "fixed": ssl3_struct.add(pointerSize * 12 + 148).readU32(),
                },
                "md5": ssl3_struct.add(pointerSize * 12 + 152).readPointer(),
                "sha": ssl3_struct.add(pointerSize * 13 + 152).readPointer(),
                "shaEchInner": ssl3_struct.add(pointerSize * 14 + 152).readPointer(),
                "shaPostHandshake": ssl3_struct.add(pointerSize * 15 + 152).readPointer(),
                "signatureScheme": ssl3_struct.add(pointerSize * 16 + 152).readU32(),
                "kea_def": ssl3_struct.add(pointerSize * 16 + 156).readPointer(),
                "cipher_suite": ssl3_struct.add(pointerSize * 17 + 156).readU32(),
                "suite_def": ssl3_struct.add(pointerSize * 17 + 160).readPointer(),
                "msg_body": {
                    "data": ssl3_struct.add(pointerSize * 18 + 160).readPointer(),
                    "len": ssl3_struct.add(pointerSize * 19 + 160).readU32(),
                    "space": ssl3_struct.add(pointerSize * 19 + 164).readU32(),
                    "fixed": ssl3_struct.add(pointerSize * 19 + 168).readU32(),
                },
                "header_bytes": ssl3_struct.add(pointerSize * 19 + 172).readU32(),
                "msg_type": ssl3_struct.add(pointerSize * 19 + 176).readU32(),
                "msg_len": ssl3_struct.add(pointerSize * 19 + 180).readU32(),
                "isResuming": ssl3_struct.add(pointerSize * 19 + 184).readU32(),
                "sendingSCSV": ssl3_struct.add(pointerSize * 19 + 188).readU32(),
                "receivedNewSessionTicket": ssl3_struct.add(pointerSize * 19 + 192).readU32(),
                "newSessionTicket": ssl3_struct.add(pointerSize * 19 + 196),
                "finishedBytes": ssl3_struct.add(pointerSize * 19 + 240).readU32(),
                "finishedMsgs": ssl3_struct.add(pointerSize * 19 + 244),
                "authCertificatePending": ssl3_struct.add(pointerSize * 18 + 316).readU32(),
                "restartTarget": ssl3_struct.add(pointerSize * 19 + 320).readU32(),
                "canFalseStart": ssl3_struct.add(pointerSize * 19 + 324).readU32(),
                "preliminaryInfo": ssl3_struct.add(pointerSize * 19 + 328).readU32(),
                "remoteExtensions": {
                    "next": ssl3_struct.add(pointerSize * 19 + 332).readPointer(),
                    "prev": ssl3_struct.add(pointerSize * 20 + 332).readPointer(),
                },
                "echOuterExtensions": {
                    "next": ssl3_struct.add(pointerSize * 21 + 332).readPointer(),
                    "prev": ssl3_struct.add(pointerSize * 22 + 332).readPointer(),
                },
                "sendMessageSeq": ssl3_struct.add(pointerSize * 23 + 332).readU32(),
                "lastMessageFlight": {
                    "next": ssl3_struct.add(pointerSize * 23 + 336).readPointer(),
                    "prev": ssl3_struct.add(pointerSize * 24 + 336).readPointer(),
                },
                "maxMessageSent": ssl3_struct.add(pointerSize * 25 + 336).readU16(),
                "recvMessageSeq": ssl3_struct.add(pointerSize * 25 + 338).readU16(),
                "recvdFragments": {
                    "data": ssl3_struct.add(pointerSize * 25 + 340).readPointer(),
                    "len": ssl3_struct.add(pointerSize * 26 + 340).readU32(),
                    "space": ssl3_struct.add(pointerSize * 26 + 344).readU32(),
                    "fixed": ssl3_struct.add(pointerSize * 26 + 348).readU32(),
                },
                "recvdHighWater": ssl3_struct.add(pointerSize * 26 + 352).readU32(),
                "cookie": {
                    "type": ssl3_struct.add(pointerSize * 26 + 356).readU64(),
                    "data": ssl3_struct.add(pointerSize * 27 + 356).readPointer(),
                    "len": ssl3_struct.add(pointerSize * 28 + 356).readU32(),
                },
                "times_array": ssl3_struct.add(pointerSize * 28 + 360).readU32(),
                "rtTimer": ssl3_struct.add(pointerSize * 28 + 432).readPointer(),
                "ackTimer": ssl3_struct.add(pointerSize * 29 + 432).readPointer(),
                "hdTimer": ssl3_struct.add(pointerSize * 30 + 432).readPointer(),
                "rtRetries": ssl3_struct.add(pointerSize * 31 + 432).readU32(),
                "srvVirtName": {
                    "type": ssl3_struct.add(pointerSize * 31 + 436).readU64(),
                    "data": ssl3_struct.add(pointerSize * 32 + 436).readPointer(),
                    "len": ssl3_struct.add(pointerSize * 33 + 436).readU32(),
                },
                "currentSecret": ssl3_struct.add(pointerSize * 33 + 440).readPointer(),
                "resumptionMasterSecret": ssl3_struct.add(pointerSize * 34 + 440).readPointer(),
                "dheSecret": ssl3_struct.add(pointerSize * 35 + 440).readPointer(),
                "clientEarlyTrafficSecret": ssl3_struct.add(pointerSize * 36 + 440).readPointer(),
                "clientHsTrafficSecret": ssl3_struct.add(pointerSize * 37 + 440).readPointer(),
                "serverHsTrafficSecret": ssl3_struct.add(pointerSize * 38 + 440).readPointer(),
                "clientTrafficSecret": ssl3_struct.add(pointerSize * 39 + 440).readPointer(),
                "serverTrafficSecret": ssl3_struct.add(pointerSize * 40 + 440).readPointer(),
                "earlyExporterSecret": ssl3_struct.add(pointerSize * 41 + 440).readPointer(),
                "exporterSecret": ssl3_struct.add(pointerSize * 42 + 440).readPointer()
            } // end of hs struct
            /*
            typedef struct SSL3HandshakeStateStr {
        SSL3Random server_random;
        SSL3Random client_random;
        SSL3Random client_inner_random;
        SSL3WaitState ws;                       --> enum type
    
        
        SSL3HandshakeHashType hashType;         --> enum type
        sslBuffer messages;                     --> struct of 20 bytes (1 ptr + 12 bytes;see lib/ssl/sslencode.h)
        sslBuffer echInnerMessages;
        
        PK11Context *md5;
        PK11Context *sha;
        PK11Context *shaEchInner;
        PK11Context *shaPostHandshake;
        SSLSignatureScheme signatureScheme;     --> enum type( see lib/ssl/sslt.h)
        const ssl3KEADef *kea_def;
        ssl3CipherSuite cipher_suite;           --> typedef PRUint16 ssl3CipherSuite (see lib/ssl/ssl3prot.h)
        const ssl3CipherSuiteDef *suite_def;
        sslBuffer msg_body;
                            
        unsigned int header_bytes;
        
        SSLHandshakeType msg_type;
        unsigned long msg_len;
        PRBool isResuming;
        PRBool sendingSCSV;
    
        
        PRBool receivedNewSessionTicket;
        NewSessionTicket newSessionTicket;      --> (see lib/ssl/ssl3prot.h)
    
        PRUint16 finishedBytes;
        union {
            TLSFinished tFinished[2];           --> 12 bytes
            SSL3Finished sFinished[2];          --> 36 bytes
            PRUint8 data[72];
        } finishedMsgs;                         --> 72
    
        PRBool authCertificatePending;
        
        sslRestartTarget restartTarget;
    
        PRBool canFalseStart;
        
        PRUint32 preliminaryInfo;
    
        
        PRCList remoteExtensions;
        PRCList echOuterExtensions;
    
        
        PRUint16 sendMessageSeq;
        PRCList lastMessageFlight;
        PRUint16 maxMessageSent;
        PRUint16 recvMessageSeq;
        sslBuffer recvdFragments;
        PRInt32 recvdHighWater;
        SECItem cookie;
        dtlsTimer timers[3];       24 * 3
        dtlsTimer *rtTimer;
        dtlsTimer *ackTimer;
        dtlsTimer *hdTimer;
        PRUint32 rtRetries;
        SECItem srvVirtName;
                                        
    
        // This group of values is used for TLS 1.3 and above
        PK11SymKey *currentSecret;            // The secret down the "left hand side"   --> ssl3_struct.add(704)
                                                //of the TLS 1.3 key schedule.
        PK11SymKey *resumptionMasterSecret;   // The resumption_master_secret.          --> ssl3_struct.add(712)
        PK11SymKey *dheSecret;                // The (EC)DHE shared secret.             --> ssl3_struct.add(720)
        PK11SymKey *clientEarlyTrafficSecret; // The secret we use for 0-RTT.           --> ssl3_struct.add(728)
        PK11SymKey *clientHsTrafficSecret;    // The source keys for handshake          --> ssl3_struct.add(736)
        PK11SymKey *serverHsTrafficSecret;    // traffic keys.                          --> ssl3_struct.add(744)
        PK11SymKey *clientTrafficSecret;      // The source keys for application        --> ssl3_struct.add(752)
        PK11SymKey *serverTrafficSecret;      // traffic keys                           --> ssl3_struct.add(760)
        PK11SymKey *earlyExporterSecret;      // for 0-RTT exporters                    --> ssl3_struct.add(768)
        PK11SymKey *exporterSecret;           // for exporters                          --> ssl3_struct.add(776)
        ...
    
    
        typedef struct {
        const char *label; 8
        DTLSTimerCb cb; 8
        PRIntervalTime started; 4
        PRUint32 timeout; 4
    } dtlsTimer;
    
            */
        };
    }
    // https://github.com/nss-dev/nss/blob/master/lib/ssl/sslspec.h#L140 
    static parse_struct_sl3CipherSpecStr(cwSpec) {
        /*
        truct ssl3CipherSpecStr {
            PRCList link;
            PRUint8 refCt;
    
            SSLSecretDirection direction;
            SSL3ProtocolVersion version;
            SSL3ProtocolVersion recordVersion;
    
            const ssl3BulkCipherDef *cipherDef;
            const ssl3MACDef *macDef;
    
            SSLCipher cipher;
            void *cipherContext;
    
            PK11SymKey *masterSecret;
            ...
        */
        return {
            "link": cwSpec.add,
            "refCt": cwSpec.add(pointerSize * 2),
            "direction": cwSpec.add(pointerSize * 2 + 4),
            "version": cwSpec.add(pointerSize * 2 + 8),
            "recordVersion": cwSpec.add(pointerSize * 2 + 12),
            "cipherDef": cwSpec.add(pointerSize * 2 + 16).readPointer(),
            "macDef": cwSpec.add(pointerSize * 3 + 16).readPointer(),
            "cipher": cwSpec.add(pointerSize * 4 + 16),
            "cipherContext": cwSpec.add(pointerSize * 4 + 24).readPointer(),
            "master_secret": cwSpec.add(pointerSize * 5 + 24).readPointer()
        };
    }
    /********* NSS helper functions  ********/
    /**
* Returns a dictionary of a sockfd's "src_addr", "src_port", "dst_addr", and
* "dst_port".
* @param {pointer} sockfd The file descriptor of the socket to inspect as PRFileDesc.
* @param {boolean} isRead If true, the context is an SSL_read call. If
*     false, the context is an SSL_write call.
* @param {{ [key: string]: NativePointer}} methodAddresses Dictionary containing (at least) addresses for getpeername, getsockname, ntohs and ntohl
* @return {{ [key: string]: string | number }} Dictionary of sockfd's "src_addr", "src_port", "dst_addr",
*     and "dst_port".

  PRStatus PR_GetPeerName(
PRFileDesc *fd,
PRNetAddr *addr);

PRStatus PR_GetSockName(
PRFileDesc *fd,
PRNetAddr *addr);

PRStatus PR_NetAddrToString(
const PRNetAddr *addr,
char *string,
PRUint32 size);


union PRNetAddr {
struct {
   PRUint16 family;
   char data[14];
} raw;
struct {
   PRUint16 family;
   PRUint16 port;
   PRUint32 ip;
   char pad[8];
} inet;
#if defined(_PR_INET6)
struct {
   PRUint16 family;
   PRUint16 port;
   PRUint32 flowinfo;
   PRIPv6Addr ip;
} ipv6;
#endif // defined(_PR_INET6)
};

typedef union PRNetAddr PRNetAddr;

*/
    static getPortsAndAddressesFromNSS(sockfd, isRead, methodAddresses) {
        var getpeername = new NativeFunction(methodAddresses["PR_GetPeerName"], "int", ["pointer", "pointer"]);
        var getsockname = new NativeFunction(methodAddresses["PR_GetSockName"], "int", ["pointer", "pointer"]);
        var ntohs = new NativeFunction(methodAddresses["ntohs"], "uint16", ["uint16"]);
        var ntohl = new NativeFunction(methodAddresses["ntohl"], "uint32", ["uint32"]);
        var message = {};
        var addrType = Memory.alloc(2); // PRUint16 is a 2 byte (16 bit) value on all plattforms
        //var prNetAddr = Memory.alloc(Process.pointerSize)
        var addrlen = Memory.alloc(4);
        var addr = Memory.alloc(128);
        var src_dst = ["src", "dst"];
        for (var i = 0; i < src_dst.length; i++) {
            addrlen.writeU32(128);
            if ((src_dst[i] == "src") !== isRead) {
                getsockname(sockfd, addr);
            }
            else {
                getpeername(sockfd, addr);
            }
            if (addr.readU16() == AF_INET) {
                message[src_dst[i] + "_port"] = ntohs(addr.add(2).readU16());
                message[src_dst[i] + "_addr"] = ntohl(addr.add(4).readU32());
                message["ss_family"] = "AF_INET";
            }
            else if (addr.readU16() == AF_INET6) {
                message[src_dst[i] + "_port"] = ntohs(addr.add(2).readU16());
                message[src_dst[i] + "_addr"] = "";
                var ipv6_addr = addr.add(8);
                for (var offset = 0; offset < 16; offset += 1) {
                    message[src_dst[i] + "_addr"] += ("0" + ipv6_addr.add(offset).readU8().toString(16).toUpperCase()).substr(-2);
                }
                if (message[src_dst[i] + "_addr"].toString().indexOf("00000000000000000000FFFF") === 0) {
                    message[src_dst[i] + "_addr"] = ntohl(ipv6_addr.add(12).readU32());
                    message["ss_family"] = "AF_INET";
                }
                else {
                    message["ss_family"] = "AF_INET6";
                }
            }
            else {
                devlog("[-] PIPE descriptor error");
                //FIXME: Sometimes addr.readU16() will be 0 when a PIPE Read oder Write gets interpcepted, thus this error will be thrown.
                throw "Only supporting IPv4/6";
            }
        }
        return message;
    }
    /**
    * This functions tests if a given address is a readable pointer
    *
    * @param {*} ptr_addr is a pointer to the memory location where we want to check if there is already an address
    * @returns 1 to indicate that there is a ptr at
    */
    static is_ptr_at_mem_location(ptr_addr) {
        try {
            // an exception is thrown if there isn't a readable address
            ptr_addr.readPointer();
            return 1;
        }
        catch (error) {
            return -1;
        }
    }
    /**
    *
    * typedef struct PRFileDesc {
    *       const struct PRIOMethods *methods;
    *       PRFilePrivate *secret;
    *       PRFileDesc *lower;
    *       PRFileDesc *higher;
    *       void (*dtor) (PRFileDesc *);
    *       PRDescIdentity identity;
    *  } PRFileDesc;
    *
    * @param {*} pRFileDesc
    * @param {*} layer_name
    * @returns
    */
    static NSS_FindIdentityForName(pRFileDesc, layer_name) {
        var lower_ptr = pRFileDesc.add(pointerSize * 2).readPointer();
        var higher_ptr = pRFileDesc.add(pointerSize * 3).readPointer();
        var identity = pRFileDesc.add(pointerSize * 5).readPointer();
        if (!identity.isNull()) {
            var nameptr = NSS.PR_GetNameForIdentity(identity).readCString();
            if (nameptr == layer_name) {
                return pRFileDesc;
            }
        }
        if (!lower_ptr.isNull()) {
            return this.NSS_FindIdentityForName(lower_ptr, layer_name);
        }
        if (!higher_ptr.isNull()) {
            devlog('Have upper');
        }
        // when we reach this we have some sort of error 
        devlog("[-] error while getting SSL layer");
        return NULL;
    }
    static getSessionIdString(session_id_ptr, len) {
        var session_id = "";
        for (var i = 0; i < len; i++) {
            // Read a byte, convert it to a hex string (0xAB ==> "AB"), and append
            // it to session_id.
            session_id +=
                ("0" + session_id_ptr.add(i).readU8().toString(16).toUpperCase()).substr(-2);
        }
        return session_id;
    }
    static getSSL_Layer(pRFileDesc) {
        var ssl_layer_id = 3; // SSL has the Layer ID 3 normally.
        var getIdentitiesLayer = new NativeFunction(Module.getExportByName('libnspr4.so', 'PR_GetIdentitiesLayer'), "pointer", ["pointer", "int"]);
        var ssl_layer = getIdentitiesLayer(pRFileDesc, ssl_layer_id);
        if (ptr(ssl_layer.toString()).isNull()) {
            devlog("PR_BAD_DESCRIPTOR_ERROR: " + ssl_layer);
            return -1;
        }
        return ssl_layer;
    }
    /**
    *
    * @param {*} readAddr is the address where we start reading the bytes
    * @param {*} len is the length of bytes we want to convert to a hex string
    * @returns a hex string with the length of len
    */
    static getHexString(readAddr, len) {
        var secret_str = "";
        for (var i = 0; i < len; i++) {
            // Read a byte, convert it to a hex string (0xab ==> "ab"), and append
            // it to secret_str.
            secret_str +=
                ("0" + readAddr.add(i).readU8().toString(16).toLowerCase()).substr(-2);
        }
        return secret_str;
    }
    /**
 * Get the session_id of SSL object and return it as a hex string.
 * @param {!NativePointer} ssl A pointer to an SSL object.
 * @return {dict} A string representing the session_id of the SSL object's
 *     SSL_SESSION. For example,
 *     "59FD71B7B90202F359D89E66AE4E61247954E28431F6C6AC46625D472FF76336".
 *
 * On NSS the return type of SSL_GetSessionID is a SECItem:
      typedef enum {
 * siBuffer = 0,
 * siClearDataBuffer = 1,
 * siCipherDataBuffer = 2,
 * siDERCertBuffer = 3,
 * siEncodedCertBuffer = 4,
 * siDERNameBuffer = 5,
 * siEncodedNameBuffer = 6,
 * siAsciiNameString = 7,
 * siAsciiString = 8,
 * siDEROID = 9,
 * siUnsignedInteger = 10,
 * siUTCTime = 11,
 * siGeneralizedTime = 12,
 * siVisibleString = 13,
 * siUTF8String = 14,
 * siBMPString = 15
 * } SECItemType;
 *
 * typedef struct SECItemStr SECItem;
 *
 * struct SECItemStr {
 * SECItemType type;
 * unsigned char *data;
 * unsigned int len;
 * }; --> size = 20
 *
 *
 */
    static getSslSessionIdFromFD(pRFileDesc) {
        var dummySSL_SessionID = "3E8ABF58649A1A1C58824D704173BA9AAFA2DA33B45FFEA341D218B29BBACF8F";
        var fdType = NSS.getDescType(pRFileDesc);
        //log("pRFileDescType: "+ fdType)
        /*if(fdType == 4){ // LAYERED
            pRFileDesc = ptr(getSSL_Layer(pRFileDesc).toString())
            if(pRFileDesc.toString() == "-1"){
                log("error")
        
            }
        }*/
        var layer = NSS.NSS_FindIdentityForName(pRFileDesc, 'SSL');
        if (!layer) {
            return dummySSL_SessionID;
        }
        var sslSessionIdSECItem = ptr(NSS.SSL_SESSION_get_id(layer).toString());
        if (sslSessionIdSECItem == null || sslSessionIdSECItem.isNull()) {
            try {
                devlog("---- getSslSessionIdFromFD -----");
                devlog("ERROR");
                devlog("pRFileDescType: " + NSS.getDescType(pRFileDesc));
                if (fdType == 2) {
                    var c = Memory.dup(pRFileDesc, 32);
                    //log(hexdump(c))
                    var getLayersIdentity = new NativeFunction(Module.getExportByName('libnspr4.so', 'PR_GetLayersIdentity'), "uint32", ["pointer"]);
                    var getNameOfIdentityLayer = new NativeFunction(Module.getExportByName('libnspr4.so', 'PR_GetNameForIdentity'), "pointer", ["uint32"]);
                    var layerID = getLayersIdentity(pRFileDesc);
                    devlog("LayerID: " + layerID);
                    var nameIDentity = getNameOfIdentityLayer(layerID);
                    devlog("name address: " + nameIDentity);
                    devlog("name: " + ptr(nameIDentity.toString()).readCString());
                    var sslSessionIdSECItem2 = ptr(NSS.getSSL_Layer(pRFileDesc).toString());
                    devlog("sslSessionIdSECItem2 =" + sslSessionIdSECItem2);
                    if (sslSessionIdSECItem2.toString().startsWith("0x7f")) {
                        var aa = Memory.dup(sslSessionIdSECItem2, 32);
                        //log(hexdump(aa))
                        var sslSessionIdSECItem3 = ptr(NSS.SSL_SESSION_get_id(sslSessionIdSECItem2).toString());
                        devlog("sslSessionIdSECItem3 =" + sslSessionIdSECItem3);
                    }
                    var sslSessionIdSECItem4 = ptr(NSS.SSL_SESSION_get_id(pRFileDesc).toString());
                    devlog("sslSessionIdSECItem4 =" + sslSessionIdSECItem4);
                    devlog("Using Dummy Session ID");
                    devlog("");
                }
                else if (fdType == 4) {
                    pRFileDesc = ptr(NSS.getSSL_Layer(pRFileDesc).toString());
                    var sslSessionIdSECItem = ptr(NSS.SSL_SESSION_get_id(pRFileDesc).toString());
                    devlog("new sessionid_ITEM: " + sslSessionIdSECItem);
                }
                else {
                    devlog("---- SSL Session Analysis ------------");
                    var c = Memory.dup(sslSessionIdSECItem, 32);
                    devlog(hexdump(c));
                }
                devlog("---- getSslSessionIdFromFD finished -----");
                devlog("");
            }
            catch (error) {
                devlog("Error:" + error);
            }
            return dummySSL_SessionID;
        }
        var len = sslSessionIdSECItem.add(pointerSize * 2).readU32();
        var session_id_ptr = sslSessionIdSECItem.add(pointerSize).readPointer();
        var session_id = NSS.getSessionIdString(session_id_ptr, len);
        return session_id;
    }
    static get_SSL_FD(pRFileDesc) {
        var ssl_layer = NSS.NSS_FindIdentityForName(pRFileDesc, 'SSL');
        if (!ssl_layer) {
            devlog("error: couldn't get SSL Layer from pRFileDesc");
            return NULL;
        }
        var sslSocketFD = NSS.get_SSL_Socket(ssl_layer);
        if (!sslSocketFD) {
            devlog("error: couldn't get sslSocketFD");
            return NULL;
        }
        return sslSocketFD;
    }
    /**
    *
    *
    *
    *
    *
    *
    * /* This function tries to find the SSL layer in the stack.
    * It searches for the first SSL layer at or below the argument fd,
    * and failing that, it searches for the nearest SSL layer above the
    * argument fd.  It returns the private sslSocket from the found layer.
    *
    sslSocket *
    ssl_FindSocket(PRFileDesc *fd)
    {
    PRFileDesc *layer;
    sslSocket *ss;
    
    PORT_Assert(fd != NULL);
    PORT_Assert(ssl_layer_id != 0);
    
    layer = PR_GetIdentitiesLayer(fd, ssl_layer_id);
    if (layer == NULL) {
    PORT_SetError(PR_BAD_DESCRIPTOR_ERROR);
    return NULL;
    }
    
    ss = (sslSocket *)layer->secret;
    /* Set ss->fd lazily. We can't rely on the value of ss->fd set by
    * ssl_PushIOLayer because another PR_PushIOLayer call will switch the
    * contents of the PRFileDesc pointed by ss->fd and the new layer.
    * See bug 807250.
    *
    ss->fd = layer;
    return ss;
    }
    
    *
    *
    */
    static get_SSL_Socket(ssl_layer) {
        var sslSocket = ssl_layer.add(pointerSize * 1).readPointer();
        return sslSocket;
    }
    /******** NSS Encryption Keys *******/
    /**
     *
     * ss->ssl3.cwSpec->masterSecret
     *
     * @param {*} ssl3  the parsed ssl3 struct
     * @returns the client_random as hex string (lower case)
     */
    static getMasterSecret(ssl3) {
        var cwSpec = ssl3.cwSpec;
        var masterSecret_Ptr = NSS.parse_struct_sl3CipherSpecStr(cwSpec).master_secret;
        var master_secret = NSS.get_Secret_As_HexString(masterSecret_Ptr);
        return master_secret;
    }
    /**
     * ss->ssl3.hs.client_random
     *
     * @param {*} ssl3 is a ptr to current parsed ssl3 struct
     * @returns the client_random as hex string (lower case)
     */
    static getClientRandom(ssl3) {
        var client_random = NSS.getHexString(ssl3.hs.client_random, NSS.SSL3_RANDOM_LENGTH);
        return client_random;
    }
    /**
    
     
    typedef struct sslSocketStr sslSocket;
     *
    
        SSL Socket struct (https://github.com/nss-dev/nss/blob/master/lib/ssl/sslimpl.h#L971)
    struct sslSocketStr {
    PRFileDesc *fd;                                                                     +8
    
    /* Pointer to operations vector for this socket *
    const sslSocketOps *ops;                                                            +8
    
    /* SSL socket options *
    sslOptions opt;                                                                     sizeOf(sslOptions) --> 40
    /* Enabled version range *
    SSLVersionRange vrange;                                                             + 4
    
    /* A function that returns the current time. *
    SSLTimeFunc now;                                                                    +8
    void *nowArg;                                                                       +8
    
    /* State flags *
    unsigned long clientAuthRequested;                                                  +8
    unsigned long delayDisabled;     /* Nagle delay disabled *                          +8
    unsigned long firstHsDone;       /* first handshake is complete. *                  +8
    unsigned long enoughFirstHsDone; /* enough of the first handshake is                +8
                                      * done for callbacks to be able to
                                      * retrieve channel security
                                      * parameters from the SSL socket. *
    unsigned long handshakeBegun;                                                       +8
    unsigned long lastWriteBlocked;                                                     +8
    unsigned long recvdCloseNotify; /* received SSL EOF. *                              +8
    unsigned long TCPconnected;                                                         +8
    unsigned long appDataBuffered;                                                      +8
    unsigned long peerRequestedProtection; /* from old renegotiation *                  +8
    
    /* version of the protocol to use *
    SSL3ProtocolVersion version;                                                        +4
    SSL3ProtocolVersion clientHelloVersion; /* version sent in client hello. *          --> at offset 160
     */
    static get_SSL_Version(pRFileDesc) {
        var ssl_version_internal_Code = -1;
        var sslSocket = NSS.get_SSL_FD(pRFileDesc);
        if (sslSocket.isNull()) {
            return -1;
        }
        var sslVersion_pointerSize = 160;
        ssl_version_internal_Code = sslSocket.add((sslVersion_pointerSize)).readU16();
        return ssl_version_internal_Code;
    }
    static get_Secret_As_HexString(secret_key_Ptr) {
        var rv = NSS.PK11_ExtractKeyValue(secret_key_Ptr);
        if (rv != SECStatus.SECSuccess) {
            //log("[**] ERROR access the secret key");
            return "";
        }
        var keyData = NSS.PK11_GetKeyData(secret_key_Ptr); // return value is a SECItem
        var keyData_SECITem = NSS.parse_struct_SECItem(keyData);
        var secret_as_hexString = NSS.getHexString(keyData_SECITem.data, keyData_SECITem.len);
        return secret_as_hexString;
    }
    /**
     *
     * @param {*} ssl_version_internal_Code
     * @returns
     *
     *      https://github.com/nss-dev/nss/blob/c989bde00fe64c1b37df13c773adf3e91cc258c7/lib/ssl/sslproto.h#L16
     *      #define SSL_LIBRARY_VERSION_TLS_1_2             0x0303
     *      #define SSL_LIBRARY_VERSION_TLS_1_3             0x0304
     *
     *      0x0303 -->  771
     *      0x0304 -->  772
     *
     */
    static is_TLS_1_3(ssl_version_internal_Code) {
        if (ssl_version_internal_Code > 771) {
            return true;
        }
        else {
            return false;
        }
    }
    //see nss/lib/ssl/sslinfo.c for details */
    static get_Keylog_Dump(type, client_random, key) {
        return type + " " + client_random + " " + key;
    }
    /**
     *
     * @param {*} pRFileDesc
     * @param {*} dumping_handshake_secrets  a zero indicates an false and that the handshake just completed. A 1 indicates a true so that we are during the handshake itself
     * @returns
     */
    static getTLS_Keys(pRFileDesc, dumping_handshake_secrets) {
        var message = {};
        message["contentType"] = "keylog";
        devlog("[*] trying to log some keying materials ...");
        var sslSocketFD = NSS.get_SSL_FD(pRFileDesc);
        if (sslSocketFD.isNull()) {
            return;
        }
        var sslSocketStr = NSS.parse_struct_sslSocketStr(sslSocketFD);
        var ssl3_struct = sslSocketStr.ssl3;
        var ssl3 = NSS.parse_struct_ssl3Str(ssl3_struct);
        // the client_random is used to identify the diffrent SSL streams with their corresponding secrets
        var client_random = NSS.getClientRandom(ssl3);
        if (NSS.doTLS13_RTT0 == 1) {
            //var early_exporter_secret = get_Secret_As_HexString(ssl3_struct.add(768).readPointer()); //EARLY_EXPORTER_SECRET
            var early_exporter_secret = NSS.get_Secret_As_HexString(ssl3.hs.earlyExporterSecret); //EARLY_EXPORTER_SECRET
            devlog(NSS.get_Keylog_Dump("EARLY_EXPORTER_SECRET", client_random, early_exporter_secret));
            message["keylog"] = NSS.get_Keylog_Dump("EARLY_EXPORTER_SECRET", client_random, early_exporter_secret);
            send(message);
            NSS.doTLS13_RTT0 = -1;
        }
        if (dumping_handshake_secrets == 1) {
            devlog("[*] exporting TLS 1.3 handshake keying material");
            /*
             * Those keys are computed in the beginning of a handshake
             */
            //var client_handshake_traffic_secret = get_Secret_As_HexString(ssl3_struct.add(736).readPointer()); //CLIENT_HANDSHAKE_TRAFFIC_SECRET
            var client_handshake_traffic_secret = NSS.get_Secret_As_HexString(ssl3.hs.clientHsTrafficSecret); //CLIENT_HANDSHAKE_TRAFFIC_SECRET
            //parse_struct_ssl3Str(ssl3_struct)
            devlog(NSS.get_Keylog_Dump("CLIENT_HANDSHAKE_TRAFFIC_SECRET", client_random, client_handshake_traffic_secret));
            message["keylog"] = NSS.get_Keylog_Dump("CLIENT_HANDSHAKE_TRAFFIC_SECRET", client_random, client_handshake_traffic_secret);
            send(message);
            //var server_handshake_traffic_secret = get_Secret_As_HexString(ssl3_struct.add(744).readPointer()); //SERVER_HANDSHAKE_TRAFFIC_SECRET
            var server_handshake_traffic_secret = NSS.get_Secret_As_HexString(ssl3.hs.serverHsTrafficSecret); //SERVER_HANDSHAKE_TRAFFIC_SECRET
            devlog(NSS.get_Keylog_Dump("SERVER_HANDSHAKE_TRAFFIC_SECRET", client_random, server_handshake_traffic_secret));
            message["keylog"] = NSS.get_Keylog_Dump("SERVER_HANDSHAKE_TRAFFIC_SECRET", client_random, server_handshake_traffic_secret);
            send(message);
            return;
        }
        else if (dumping_handshake_secrets == 2) {
            devlog("[*] exporting TLS 1.3 RTT0 handshake keying material");
            var client_early_traffic_secret = NSS.get_Secret_As_HexString(ssl3.hs.clientEarlyTrafficSecret); //CLIENT_EARLY_TRAFFIC_SECRET
            devlog(NSS.get_Keylog_Dump("CLIENT_EARLY_TRAFFIC_SECRET", client_random, client_early_traffic_secret));
            message["keylog"] = NSS.get_Keylog_Dump("CLIENT_EARLY_TRAFFIC_SECRET", client_random, client_early_traffic_secret);
            send(message);
            NSS.doTLS13_RTT0 = 1; // there is no callback for the EARLY_EXPORTER_SECRET
            return;
        }
        var ssl_version_internal_Code = NSS.get_SSL_Version(pRFileDesc);
        if (NSS.is_TLS_1_3(ssl_version_internal_Code)) {
            devlog("[*] exporting TLS 1.3 keying material");
            var client_traffic_secret = NSS.get_Secret_As_HexString(ssl3.hs.clientTrafficSecret); //CLIENT_TRAFFIC_SECRET_0
            devlog(NSS.get_Keylog_Dump("CLIENT_TRAFFIC_SECRET_0", client_random, client_traffic_secret));
            message["keylog"] = NSS.get_Keylog_Dump("CLIENT_TRAFFIC_SECRET_0", client_random, client_traffic_secret);
            send(message);
            var server_traffic_secret = NSS.get_Secret_As_HexString(ssl3.hs.serverTrafficSecret); //SERVER_TRAFFIC_SECRET_0
            devlog(NSS.get_Keylog_Dump("SERVER_TRAFFIC_SECRET_0", client_random, server_traffic_secret));
            message["keylog"] = NSS.get_Keylog_Dump("SERVER_TRAFFIC_SECRET_0", client_random, server_traffic_secret);
            send(message);
            var exporter_secret = NSS.get_Secret_As_HexString(ssl3.hs.exporterSecret); //EXPORTER_SECRET 
            devlog(NSS.get_Keylog_Dump("EXPORTER_SECRET", client_random, exporter_secret));
            message["keylog"] = NSS.get_Keylog_Dump("EXPORTER_SECRET", client_random, exporter_secret);
            send(message);
        }
        else {
            devlog("[*] exporting TLS 1.2 keying material");
            var master_secret = NSS.getMasterSecret(ssl3);
            devlog(NSS.get_Keylog_Dump("CLIENT_RANDOM", client_random, master_secret));
            message["keylog"] = NSS.get_Keylog_Dump("CLIENT_RANDOM", client_random, master_secret);
            send(message);
        }
        NSS.doTLS13_RTT0 = -1;
        return;
    }
    static ssl_RecordKeyLog(sslSocketFD) {
        NSS.getTLS_Keys(sslSocketFD, 0);
    }
    /***** Installing the hooks *****/
    install_plaintext_read_hook() {
        var lib_addesses = this.addresses;
        Interceptor.attach(this.addresses["PR_Read"], {
            onEnter: function (args) {
                // ab hier nicht mehr
                this.fd = ptr(args[0]);
                this.buf = ptr(args[1]);
            },
            onLeave: function (retval) {
                if (retval.toInt32() <= 0 || NSS.getDescType(this.fd) == PRDescType.PR_DESC_FILE) {
                    return;
                }
                var addr = Memory.alloc(8);
                var res = NSS.getpeername(this.fd, addr);
                // peername return -1 this is due to the fact that a PIPE descriptor is used to read from the SSL socket
                if (addr.readU16() == 2 || addr.readU16() == 10 || addr.readU16() == 100) {
                    var message = NSS.getPortsAndAddressesFromNSS(this.fd, true, lib_addesses);
                    devlog("Session ID: " + NSS.getSslSessionIdFromFD(this.fd));
                    message["ssl_session_id"] = NSS.getSslSessionIdFromFD(this.fd);
                    message["function"] = "NSS_read";
                    this.message = message;
                    this.message["contentType"] = "datalog";
                    var data = this.buf.readByteArray((new Uint32Array([retval]))[0]);
                }
                else {
                    var temp = this.buf.readByteArray((new Uint32Array([retval]))[0]);
                    devlog(JSON.stringify(temp));
                }
            }
        });
    }
    install_plaintext_write_hook() {
        var lib_addesses = this.addresses;
        Interceptor.attach(this.addresses["PR_Write"], {
            onEnter: function (args) {
                this.fd = ptr(args[0]);
                this.buf = args[1];
                this.len = args[2];
            },
            onLeave: function (retval) {
                if (retval.toInt32() <= 0) { //|| NSS.getDescType(this.fd) == PRDescType.PR_DESC_FILE) {
                    return;
                }
                var addr = Memory.alloc(8);
                NSS.getsockname(this.fd, addr);
                if (addr.readU16() == 2 || addr.readU16() == 10 || addr.readU16() == 100) {
                    var message = NSS.getPortsAndAddressesFromNSS(this.fd, false, lib_addesses);
                    message["ssl_session_id"] = NSS.getSslSessionIdFromFD(this.fd);
                    message["function"] = "NSS_write";
                    message["contentType"] = "datalog";
                    send(message, this.buf.readByteArray((parseInt(this.len))));
                }
            }
        });
    }
    /***** install callbacks for key logging ******/
    /**
 *
 * This callback gets only called in TLS 1.3 and newer versions
 *
 * @param {*} pRFileDesc
 * @param {*} secret_label
 * @param {*} secret
 * @returns
 *
function tls13_RecordKeyLog(pRFileDesc, secret_label, secret){

    var sslSocketFD = get_SSL_FD(pRFileDesc);
    if(sslSocketFD == -1){
        return;
    }

    var sslSocketStr = parse_struct_sslSocketStr(sslSocketFD);

    var ssl3_struct = sslSocketStr.ssl3;
    var ssl3 = parse_struct_ssl3Str(ssl3_struct);
    

    var secret_as_hexString = get_Secret_As_HexString(secret);
    

    log(get_Keylog_Dump(secret_label,getClientRandom(ssl3),secret_as_hexString));


    return 0;
}

// our old way to get the diffrent secrets from TLS 1.3 and above
*/
    static parse_epoch_value_from_SSL_SetSecretCallback(sslSocketFD, epoch) {
        if (epoch == 1) { // client_early_traffic_secret
            NSS.getTLS_Keys(sslSocketFD, 2);
        }
        else if (epoch == 2) { // client|server}_handshake_traffic_secret
            NSS.getTLS_Keys(sslSocketFD, 1);
            /* our old way to get the diffrent secrets from TLS 1.3 and above
    
            per default we assume we are intercepting a TLS client therefore
            dir == 1 --> SERVER_HANDSHAKE_TRAFFIC_SECRET
            dir == 2 --> CLIENT_HANDSHAKE_TRAFFIC_SECRET
            typedef enum {
                ssl_secret_read = 1,
                ssl_secret_write = 2,
            } SSLSecretDirection;
            
            if(dir == 1){
                tls13_RecordKeyLog(sslSocketFD,"SERVER_HANDSHAKE_TRAFFIC_SECRET",secret);
            }else{
                tls13_RecordKeyLog(sslSocketFD,"CLIENT_HANDSHAKE_TRAFFIC_SECRET",secret);
            }*/
        }
        else if (epoch >= 3) { // {client|server}_application_traffic_secret_{N}
            return;
            // we intercept this through the handshake_callback
        }
        else {
            devlog("[-] secret_callback invocation: UNKNOWN");
        }
    }
    static insert_hook_into_secretCallback(addr_of_installed_secretCallback) {
        Interceptor.attach(addr_of_installed_secretCallback, {
            onEnter(args) {
                this.sslSocketFD = args[0];
                this.epoch = args[1];
                NSS.parse_epoch_value_from_SSL_SetSecretCallback(this.sslSocketFD, this.epoch);
            },
            onLeave(retval) {
            }
        });
    }
    /**
         * Registers a secret_callback through inserting the address to our TLS 1.3 callback function at the apprioate offset of the  SSL Socket struct
         * This is neccassy because the computed handshake secrets are already freed after the handshake is completed.
         *
         *
         * @param {*} pRFileDesc a file descriptor (NSS PRFileDesc) to a SSL socket
         * @returns
         */
    static register_secret_callback(pRFileDesc) {
        var sslSocketFD = NSS.get_SSL_FD(pRFileDesc);
        if (sslSocketFD.isNull()) {
            devlog("[-] error while installing secret callback: unable get SSL socket descriptor");
            return;
        }
        var sslSocketStr = NSS.parse_struct_sslSocketStr(sslSocketFD);
        if (NSS.is_ptr_at_mem_location(sslSocketStr.secretCallback.readPointer()) == 1) {
            NSS.insert_hook_into_secretCallback(sslSocketStr.secretCallback.readPointer());
        }
        else {
            sslSocketStr.secretCallback.writePointer(NSS.secret_callback);
        }
        devlog("[**] secret callback (" + NSS.secret_callback + ") installed to address: " + sslSocketStr.secretCallback);
    }
    install_tls_keys_callback_hook() {
    }
}
// global definitions
NSS.doTLS13_RTT0 = -1;
NSS.SSL3_RANDOM_LENGTH = 32;
/********* NSS Callbacks ************/
/*
This callback gets called whenever a SSL Handshake completed

typedef void (*SSLHandshakeCallback)(
        PRFileDesc *fd,
        void *client_data);
*/
NSS.keylog_callback = new NativeCallback(function (sslSocketFD, client_data) {
    if (typeof this !== "undefined") {
        NSS.ssl_RecordKeyLog(sslSocketFD);
    }
    else {
        console.log("[-] Error while installing ssl_RecordKeyLog() callback");
    }
    return 0;
}, "void", ["pointer", "pointer"]);
/**
 * SSL_SetSecretCallback installs a callback that TLS calls when it installs new
 * traffic secrets.
 *
 *
 *
 * SSLSecretCallback is called with the current epoch and the corresponding
 * secret; this matches the epoch used in DTLS 1.3, even if the socket is
 * operating in stream mode:
 *
 * - client_early_traffic_secret corresponds to epoch 1
 * - {client|server}_handshake_traffic_secret is epoch 2
 * - {client|server}_application_traffic_secret_{N} is epoch 3+N
 *
 * The callback is invoked separately for read secrets (client secrets on the
 * server; server secrets on the client), and write secrets.
 *
 * This callback is only called if (D)TLS 1.3 is negotiated.
 *
 * typedef void(PR_CALLBACK *SSLSecretCallback)(
 *   PRFileDesc *fd, PRUint16 epoch, SSLSecretDirection dir, PK11SymKey *secret,
 *   void *arg);
 *
 *  More: https://github.com/nss-dev/nss/blob/master/lib/ssl/sslexp.h#L614
 *
 */
NSS.secret_callback = new NativeCallback(function (sslSocketFD, epoch, dir, secret, arg_ptr) {
    if (typeof this !== "undefined") {
        NSS.parse_epoch_value_from_SSL_SetSecretCallback(sslSocketFD, epoch);
    }
    else {
        console.log("[-] Error while installing parse_epoch_value_from_SSL_SetSecretCallback()");
    }
    return;
}, "void", ["pointer", "uint16", "uint16", "pointer", "pointer"]);
✄
{"version":3,"file":"openssl_boringssl.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/ssl_lib/openssl_boringssl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAEnG,OAAO,EAAc,OAAO,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AAE5C;;;;;;;GAOG;AAEH,MAAM,OAAO,iBAAiB;IAsB1B,YAAmB,UAAiB,EAAS,cAAqB,EAAQ,6BAAgE;QAAvH,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;QAAQ,kCAA6B,GAA7B,6BAA6B,CAAmC;QApB1I,mBAAmB;QACnB,2BAAsB,GAAqC,EAAE,CAAC;QAoB1D,IAAG,OAAO,6BAA6B,KAAK,WAAW,EAAC;YACpD,IAAI,CAAC,sBAAsB,GAAG,6BAA6B,CAAC;SAC/D;aAAI;YACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,SAAS,EAAE,6BAA6B,CAAC,CAAA;YAC3K,IAAI,CAAC,sBAAsB,CAAC,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;SACxG;QAED,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAE5D,aAAa;QACb,IAAG,OAAO,IAAI,WAAW,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAC;YAEjD,IAAG,OAAO,CAAC,OAAO,IAAI,IAAI,EAAC;gBACvB,MAAM,iBAAiB,GAAG,cAAc,CAAC,cAAc,CAAC,CAAA;gBACxD,KAAI,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAC;oBAC5C,YAAY;oBACb,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;iBACnN;aACJ;YAED,MAAM,kBAAkB,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;YAErD,IAAG,kBAAkB,IAAI,IAAI;gBACzB,GAAG,CAAC,iGAAiG,CAAC,CAAA;YAI1G,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAC;gBAC9C,YAAY;gBACZ,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,kBAAkB,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;aACrN;SAIJ;QAED,iBAAiB,CAAC,kBAAkB,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACnI,iBAAiB,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5L,iBAAiB,CAAC,eAAe,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEtH,CAAC;IAGD,2BAA2B;QACvB,IAAI,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QAElC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAC7C;YACI,OAAO,EAAE,UAAU,IAAS;gBACxB,IAAI,CAAC,EAAE,GAAG,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC/C,IAAG,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE;oBACZ,OAAM;iBACT;gBAED,IAAI,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAAY,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;gBACzE,OAAO,CAAC,gBAAgB,CAAC,GAAG,iBAAiB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBACtE,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAA;gBAChC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;gBACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YAEtB,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;gBAC1B,MAAM,IAAI,CAAC,CAAA,CAAC,iCAAiC;gBAC7C,IAAI,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE;oBAC5B,OAAM;iBACT;gBACD,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;gBACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;YACtD,CAAC;SACJ,CAAC,CAAA;IAEN,CAAC;IAED,4BAA4B;QACxB,IAAI,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAC9C;YACI,OAAO,EAAE,UAAU,IAAS;gBACxB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAC;oBACpB,IAAI,CAAC,EAAE,GAAG,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;oBAC/C,IAAG,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE;wBACZ,OAAM;qBACT;oBACD,IAAI,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;oBAC1E,OAAO,CAAC,gBAAgB,CAAC,GAAG,iBAAiB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;oBACtE,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,CAAA;oBACjC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;oBAClC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;iBACtD,CAAC,2DAA2D;YACjE,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;YAC9B,CAAC;SACJ,CAAC,CAAA;IACN,CAAC;IAED,8BAA8B;QAC1B,GAAG,CAAC,gDAAgD,CAAC,CAAA;IACzD,CAAC;IAEA;;;;;;QAMI;IACH,MAAM,CAAC,eAAe,CAAC,GAAkB;QAEvC,IAAI,OAAO,GAAG,iBAAiB,CAAC,eAAe,CAAC,GAAG,CAAkB,CAAA;QACrE,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE;YAClB,GAAG,CAAC,iBAAiB,CAAC,CAAA;YACtB,OAAO,CAAC,CAAA;SACX;QACD,IAAI,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACjC,IAAI,CAAC,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAkB,CAAA;QACnF,IAAI,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,CAAA;QAC/B,IAAI,UAAU,GAAG,EAAE,CAAA;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE;YAC1B,sEAAsE;YACtE,oBAAoB;YAEpB,UAAU;gBACN,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;SACtE;QACD,OAAO,UAAU,CAAA;IACrB,CAAC;;AAzIM,iCAAe,GAAG,IAAI,cAAc,CAAC,UAAU,MAAM,EAAE,OAAsB;IAChF,MAAM,CAAC,iDAAiD,CAAC,CAAC;IAC1D,IAAI,OAAO,GAA8C,EAAE,CAAA;IAC3D,OAAO,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAA;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IACzC,IAAI,CAAC,OAAO,CAAC,CAAA;AACjB,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA"}
✄
import { readAddresses, getPortsAndAddresses, getBaseAddress } from "../shared/shared_functions.js";
import { offsets } from "../ssl_log.js";
import { devlog, log } from "../util/log.js";
/**
 *
 * ToDO
 *  We need to find a way to calculate the offsets in a automated manner.
 *  Darwin: SSL_read/write need improvments
 *  Windows: how to extract the key material?
 *  Android: We need to find a way, when on some Android Apps the fd is below 0
 */
export class OpenSSL_BoringSSL {
    constructor(moduleName, socket_library, passed_library_method_mapping) {
        this.moduleName = moduleName;
        this.socket_library = socket_library;
        this.passed_library_method_mapping = passed_library_method_mapping;
        // global variables
        this.library_method_mapping = {};
        if (typeof passed_library_method_mapping !== 'undefined') {
            this.library_method_mapping = passed_library_method_mapping;
        }
        else {
            this.library_method_mapping[`*${moduleName}*`] = ["SSL_read", "SSL_write", "SSL_get_fd", "SSL_get_session", "SSL_SESSION_get_id", "SSL_new", "SSL_CTX_set_keylog_callback"];
            this.library_method_mapping[`*${socket_library}*`] = ["getpeername", "getsockname", "ntohs", "ntohl"];
        }
        this.addresses = readAddresses(this.library_method_mapping);
        // @ts-ignore
        if (offsets != "{OFFSETS}" && offsets.openssl != null) {
            if (offsets.sockets != null) {
                const socketBaseAddress = getBaseAddress(socket_library);
                for (const method of Object.keys(offsets.sockets)) {
                    //@ts-ignore
                    this.addresses[`${method}`] = offsets.sockets[`${method}`].absolute || socketBaseAddress == null ? ptr(offsets.sockets[`${method}`].address) : socketBaseAddress.add(ptr(offsets.sockets[`${method}`].address));
                }
            }
            const libraryBaseAddress = getBaseAddress(moduleName);
            if (libraryBaseAddress == null)
                log("Unable to find library base address! Given address values will be interpreted as absolute ones!");
            for (const method of Object.keys(offsets.openssl)) {
                //@ts-ignore
                this.addresses[`${method}`] = offsets.openssl[`${method}`].absolute || libraryBaseAddress == null ? ptr(offsets.openssl[`${method}`].address) : libraryBaseAddress.add(ptr(offsets.openssl[`${method}`].address));
            }
        }
        OpenSSL_BoringSSL.SSL_SESSION_get_id = new NativeFunction(this.addresses["SSL_SESSION_get_id"], "pointer", ["pointer", "pointer"]);
        OpenSSL_BoringSSL.SSL_get_fd = ObjC.available ? new NativeFunction(this.addresses["BIO_get_fd"], "int", ["pointer"]) : new NativeFunction(this.addresses["SSL_get_fd"], "int", ["pointer"]);
        OpenSSL_BoringSSL.SSL_get_session = new NativeFunction(this.addresses["SSL_get_session"], "pointer", ["pointer"]);
    }
    install_plaintext_read_hook() {
        var lib_addesses = this.addresses;
        Interceptor.attach(this.addresses["SSL_read"], {
            onEnter: function (args) {
                this.fd = OpenSSL_BoringSSL.SSL_get_fd(args[0]);
                if (this.fd < 0) {
                    return;
                }
                var message = getPortsAndAddresses(this.fd, true, lib_addesses);
                message["ssl_session_id"] = OpenSSL_BoringSSL.getSslSessionId(args[0]);
                message["function"] = "SSL_read";
                this.message = message;
                this.buf = args[1];
            },
            onLeave: function (retval) {
                retval |= 0; // Cast retval to 32-bit integer.
                if (retval <= 0 || this.fd < 0) {
                    return;
                }
                this.message["contentType"] = "datalog";
                send(this.message, this.buf.readByteArray(retval));
            }
        });
    }
    install_plaintext_write_hook() {
        var lib_addesses = this.addresses;
        Interceptor.attach(this.addresses["SSL_write"], {
            onEnter: function (args) {
                if (!ObjC.available) {
                    this.fd = OpenSSL_BoringSSL.SSL_get_fd(args[0]);
                    if (this.fd < 0) {
                        return;
                    }
                    var message = getPortsAndAddresses(this.fd, false, lib_addesses);
                    message["ssl_session_id"] = OpenSSL_BoringSSL.getSslSessionId(args[0]);
                    message["function"] = "SSL_write";
                    message["contentType"] = "datalog";
                    send(message, args[1].readByteArray(parseInt(args[2])));
                } // this is a temporary workaround for the fd problem on iOS
            },
            onLeave: function (retval) {
            }
        });
    }
    install_tls_keys_callback_hook() {
        log("Error: TLS key extraction not implemented yet.");
    }
    /**
      * Get the session_id of SSL object and return it as a hex string.
      * @param {!NativePointer} ssl A pointer to an SSL object.
      * @return {dict} A string representing the session_id of the SSL object's
      *     SSL_SESSION. For example,
      *     "59FD71B7B90202F359D89E66AE4E61247954E28431F6C6AC46625D472FF76336".
      */
    static getSslSessionId(ssl) {
        var session = OpenSSL_BoringSSL.SSL_get_session(ssl);
        if (session.isNull()) {
            log("Session is null");
            return 0;
        }
        var len_pointer = Memory.alloc(4);
        var p = OpenSSL_BoringSSL.SSL_SESSION_get_id(session, len_pointer);
        var len = len_pointer.readU32();
        var session_id = "";
        for (var i = 0; i < len; i++) {
            // Read a byte, convert it to a hex string (0xAB ==> "AB"), and append
            // it to session_id.
            session_id +=
                ("0" + p.add(i).readU8().toString(16).toUpperCase()).substr(-2);
        }
        return session_id;
    }
}
OpenSSL_BoringSSL.keylog_callback = new NativeCallback(function (ctxPtr, linePtr) {
    devlog("invoking keylog_callback from OpenSSL_BoringSSL");
    var message = {};
    message["contentType"] = "keylog";
    message["keylog"] = linePtr.readCString();
    send(message);
}, "void", ["pointer", "pointer"]);
✄
{"version":3,"file":"wolfssl.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/ssl_lib/wolfssl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAe,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAChH,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,OAAO,OAAO;IAYhB,YAAmB,UAAiB,EAAS,cAAqB,EAAQ,6BAAgE;QAAvH,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;QAAQ,kCAA6B,GAA7B,6BAA6B,CAAmC;QAV1I,mBAAmB;QACnB,2BAAsB,GAAqC,EAAE,CAAC;QAU1D,IAAG,OAAO,6BAA6B,KAAK,WAAW,EAAC;YACpD,IAAI,CAAC,sBAAsB,GAAG,6BAA6B,CAAC;SAC/D;aAAI;YACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,2BAA2B,EAAE,2BAA2B,CAAC,CAAA;YAChQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;SACxG;QAED,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAE5D,aAAa;QACb,IAAG,OAAO,IAAI,WAAW,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAC;YAEjD,IAAG,OAAO,CAAC,OAAO,IAAI,IAAI,EAAC;gBACvB,MAAM,iBAAiB,GAAG,cAAc,CAAC,cAAc,CAAC,CAAA;gBACxD,KAAI,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAC;oBAC5C,YAAY;oBACb,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;iBACnN;aACJ;YAED,MAAM,kBAAkB,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;YAErD,IAAG,kBAAkB,IAAI,IAAI,EAAC;gBAC1B,GAAG,CAAC,iGAAiG,CAAC,CAAA;aACzG;YAGD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAC;gBAC9C,YAAY;gBACZ,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,kBAAkB,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;aACrN;SAGJ;QAID,OAAO,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QACjG,OAAO,CAAC,mBAAmB,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IAGnH,CAAC;IAED,8BAA8B;QAC1B,GAAG,CAAC,gDAAgD,CAAC,CAAA;IACzD,CAAC;IAED;;;;;;SAMK;IAEJ,MAAM,CAAC,eAAe,CAAC,GAAkB;QACtC,IAAI,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAkB,CAAA;QAC/D,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE;YAClB,GAAG,CAAC,iBAAiB,CAAC,CAAA;YACtB,OAAO,CAAC,CAAA;SACX;QACD,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,GAAG,GAAG,EAAE,CAAA,CAAC,+CAA+C;QAC5D,IAAI,UAAU,GAAG,EAAE,CAAA;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE;YAC1B,sEAAsE;YACtE,oBAAoB;YAEpB,UAAU;gBACN,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;SACtE;QACD,OAAO,UAAU,CAAA;IACrB,CAAC;IAGD,2BAA2B;QACvB,IAAI,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EACjD;YACI,OAAO,EAAE,UAAU,IAAS;gBAExB,IAAI,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;gBAEjG,OAAO,CAAC,UAAU,CAAC,GAAG,cAAc,CAAA;gBACpC,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC5D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;gBACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YAEtB,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;gBAC1B,MAAM,IAAI,CAAC,CAAA,CAAC,iCAAiC;gBAC7C,IAAI,MAAM,IAAI,CAAC,EAAE;oBACb,OAAM;iBACT;gBACD,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;gBACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;YACtD,CAAC;SACJ,CAAC,CAAA;IACN,CAAC;IAGD,4BAA4B;QACxB,IAAI,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAClD;YACI,OAAO,EAAE,UAAU,IAAS;gBACxB,IAAI,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAW,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;gBAClG,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC5D,OAAO,CAAC,UAAU,CAAC,GAAG,eAAe,CAAA;gBACrC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;gBAClC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC3D,CAAC;YACD,OAAO,EAAE,UAAU,MAAW;YAC9B,CAAC;SACJ,CAAC,CAAA;IACN,CAAC;CAIJ"}
✄
import { readAddresses, getPortsAndAddresses, getBaseAddress } from "../shared/shared_functions.js";
import { log } from "../util/log.js";
import { offsets } from "../ssl_log.js";
export class WolfSSL {
    constructor(moduleName, socket_library, passed_library_method_mapping) {
        this.moduleName = moduleName;
        this.socket_library = socket_library;
        this.passed_library_method_mapping = passed_library_method_mapping;
        // global variables
        this.library_method_mapping = {};
        if (typeof passed_library_method_mapping !== 'undefined') {
            this.library_method_mapping = passed_library_method_mapping;
        }
        else {
            this.library_method_mapping[`*${moduleName}*`] = ["wolfSSL_read", "wolfSSL_write", "wolfSSL_get_fd", "wolfSSL_get_session", "wolfSSL_connect", "wolfSSL_KeepArrays", "wolfSSL_SESSION_get_master_key", "wolfSSL_get_client_random", "wolfSSL_get_server_random"];
            this.library_method_mapping[`*${socket_library}*`] = ["getpeername", "getsockname", "ntohs", "ntohl"];
        }
        this.addresses = readAddresses(this.library_method_mapping);
        // @ts-ignore
        if (offsets != "{OFFSETS}" && offsets.wolfssl != null) {
            if (offsets.sockets != null) {
                const socketBaseAddress = getBaseAddress(socket_library);
                for (const method of Object.keys(offsets.sockets)) {
                    //@ts-ignore
                    this.addresses[`${method}`] = offsets.sockets[`${method}`].absolute || socketBaseAddress == null ? ptr(offsets.sockets[`${method}`].address) : socketBaseAddress.add(ptr(offsets.sockets[`${method}`].address));
                }
            }
            const libraryBaseAddress = getBaseAddress(moduleName);
            if (libraryBaseAddress == null) {
                log("Unable to find library base address! Given address values will be interpreted as absolute ones!");
            }
            for (const method of Object.keys(offsets.wolfssl)) {
                //@ts-ignore
                this.addresses[`${method}`] = offsets.wolfssl[`${method}`].absolute || libraryBaseAddress == null ? ptr(offsets.wolfssl[`${method}`].address) : libraryBaseAddress.add(ptr(offsets.wolfssl[`${method}`].address));
            }
        }
        WolfSSL.wolfSSL_get_fd = new NativeFunction(this.addresses["wolfSSL_get_fd"], "int", ["pointer"]);
        WolfSSL.wolfSSL_get_session = new NativeFunction(this.addresses["wolfSSL_get_session"], "pointer", ["pointer"]);
    }
    install_tls_keys_callback_hook() {
        log("Error: TLS key extraction not implemented yet.");
    }
    /**
       * Get the session_id of SSL object and return it as a hex string.
       * @param {!NativePointer} ssl A pointer to an SSL object.
       * @return {dict} A string representing the session_id of the SSL object's
       *     SSL_SESSION. For example,
       *     "59FD71B7B90202F359D89E66AE4E61247954E28431F6C6AC46625D472FF76336".
       */
    static getSslSessionId(ssl) {
        var session = WolfSSL.wolfSSL_get_session(ssl);
        if (session.isNull()) {
            log("Session is null");
            return 0;
        }
        var p = session.add(8);
        var len = 32; // This comes from internals.h. It is untested!
        var session_id = "";
        for (var i = 0; i < len; i++) {
            // Read a byte, convert it to a hex string (0xAB ==> "AB"), and append
            // it to session_id.
            session_id +=
                ("0" + p.add(i).readU8().toString(16).toUpperCase()).substr(-2);
        }
        return session_id;
    }
    install_plaintext_read_hook() {
        var lib_addesses = this.addresses;
        Interceptor.attach(this.addresses["wolfSSL_read"], {
            onEnter: function (args) {
                var message = getPortsAndAddresses(WolfSSL.wolfSSL_get_fd(args[0]), true, lib_addesses);
                message["function"] = "wolfSSL_read";
                message["ssl_session_id"] = WolfSSL.getSslSessionId(args[0]);
                this.message = message;
                this.buf = args[1];
            },
            onLeave: function (retval) {
                retval |= 0; // Cast retval to 32-bit integer.
                if (retval <= 0) {
                    return;
                }
                this.message["contentType"] = "datalog";
                send(this.message, this.buf.readByteArray(retval));
            }
        });
    }
    install_plaintext_write_hook() {
        var lib_addesses = this.addresses;
        Interceptor.attach(this.addresses["wolfSSL_write"], {
            onEnter: function (args) {
                var message = getPortsAndAddresses(WolfSSL.wolfSSL_get_fd(args[0]), false, lib_addesses);
                message["ssl_session_id"] = WolfSSL.getSslSessionId(args[0]);
                message["function"] = "wolfSSL_write";
                message["contentType"] = "datalog";
                send(message, args[1].readByteArray(parseInt(args[2])));
            },
            onLeave: function (retval) {
            }
        });
    }
}
✄
{"version":3,"file":"log.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/util/log.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,GAAG,CAAC,GAAW;IAC3B,IAAI,OAAO,GAA8B,EAAE,CAAA;IAC3C,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;IAClC,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAA;IACxB,IAAI,CAAC,OAAO,CAAC,CAAA;AACjB,CAAC;AAGD,MAAM,UAAU,MAAM,CAAC,GAAW;IAC9B,IAAI,OAAO,GAA8B,EAAE,CAAA;IAC3C,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAAA;IACtC,OAAO,CAAC,aAAa,CAAC,GAAG,GAAG,CAAA;IAC5B,IAAI,CAAC,OAAO,CAAC,CAAA;AACjB,CAAC"}
✄
export function log(str) {
    var message = {};
    message["contentType"] = "console";
    message["console"] = str;
    send(message);
}
export function devlog(str) {
    var message = {};
    message["contentType"] = "console_dev";
    message["console_dev"] = str;
    send(message);
}
✄
{"version":3,"file":"process_infos.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/util/process_infos.ts"],"names":[],"mappings":"AACA,MAAM,UAAU,wBAAwB;IAChC,OAAO,OAAO,CAAC,IAAI,CAAC;AAC5B,CAAC;AAGD,MAAM,UAAU,SAAS;IACrB,IAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,EAAC;QAC7C,IAAG;YACC,IAAI,CAAC,cAAc,CAAA,CAAC,yDAAyD;YAC7E,OAAO,IAAI,CAAA;SACd;QAAA,OAAM,KAAK,EAAC;YACT,OAAO,KAAK,CAAA;SACf;KACJ;SAAI;QACD,OAAO,KAAK,CAAA;KACf;AACL,CAAC;AAGD,MAAM,UAAU,KAAK;IACjB,IAAG,wBAAwB,EAAE,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,IAAI,QAAQ,EAAC;QACtE,IAAG;YACE,wFAAwF;YACzF,OAAO,IAAI,CAAA;SACd;QAAA,OAAM,KAAK,EAAC;YACT,OAAO,KAAK,CAAA;SACf;KACJ;SAAI;QACD,OAAO,KAAK,CAAA;KACf;AACL,CAAC;AAGD,MAAM,UAAU,OAAO;IACnB,IAAG,wBAAwB,EAAE,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,IAAI,QAAQ,EAAC;QACpE,OAAO,IAAI,CAAA;KACd;SAAI;QACD,OAAO,KAAK,CAAA;KACf;AACL,CAAC;AAGD,MAAM,UAAU,OAAO;IACnB,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,EAAE;QAE7B,IAAI,IAAI,CAAC,SAAS,IAAI,KAAK,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,EAAE;YACxD,OAAO,IAAI,CAAA;SACd;aAAM;YACH,IAAI;gBACA,IAAI,CAAC,cAAc,CAAA,CAAC,yDAAyD;gBAC7E,OAAO,KAAK,CAAA;aACf;YAAC,OAAO,KAAK,EAAE;gBACZ,OAAO,IAAI,CAAA;aACd;SAEJ;KACJ;SAAI;QACD,OAAO,KAAK,CAAA;KACf;AACL,CAAC;AAED,MAAM,UAAU,SAAS;IACrB,IAAI,OAAO,CAAC,QAAQ,IAAI,SAAS,EAAC;QAC9B,OAAO,IAAI,CAAA;KACd;SAAI;QACD,OAAO,KAAK,CAAA;KACf;AACL,CAAC"}
✄
export function get_process_architecture() {
    return Process.arch;
}
export function isAndroid() {
    if (Java.available && Process.platform == "linux") {
        try {
            Java.androidVersion; // this will raise an error when we are not under Android
            return true;
        }
        catch (error) {
            return false;
        }
    }
    else {
        return false;
    }
}
export function isiOS() {
    if (get_process_architecture() === "arm64" && Process.platform == "darwin") {
        try {
            // check if iOS or MacOS (currently we handle MacOS with ARM Processor as an iOS device)
            return true;
        }
        catch (error) {
            return false;
        }
    }
    else {
        return false;
    }
}
export function isMacOS() {
    if (get_process_architecture() === "x64" && Process.platform == "darwin") {
        return true;
    }
    else {
        return false;
    }
}
export function isLinux() {
    if (Process.platform == "linux") {
        if (Java.available == false && Process.platform == "linux") {
            return true;
        }
        else {
            try {
                Java.androidVersion; // this will raise an error when we are not under Android
                return false;
            }
            catch (error) {
                return true;
            }
        }
    }
    else {
        return false;
    }
}
export function isWindows() {
    if (Process.platform == "windows") {
        return true;
    }
    else {
        return false;
    }
}
✄
{"version":3,"file":"gnutls_windows.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/windows/gnutls_windows.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,OAAO,cAAe,SAAQ,MAAM;IAEtC,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,KAAK,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;QADlB,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAElE,CAAC;IAGD,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAEpC,wCAAwC;IAC5C,CAAC;IAED,8BAA8B;QAC1B,qBAAqB;IACzB,CAAC;CAEJ;AAGD,MAAM,UAAU,cAAc,CAAC,UAAiB;IAC5C,IAAI,OAAO,GAAG,IAAI,cAAc,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IAC5D,OAAO,CAAC,aAAa,EAAE,CAAC;AAG5B,CAAC"}
✄
import { GnuTLS } from "../ssl_lib/gnutls.js";
import { socket_library } from "./windows_agent.js";
export class GnuTLS_Windows extends GnuTLS {
    constructor(moduleName, socket_library) {
        super(moduleName, socket_library);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        //this.install_tls_keys_callback_hook();
    }
    install_tls_keys_callback_hook() {
        //Not implemented yet
    }
}
export function gnutls_execute(moduleName) {
    var gnu_ssl = new GnuTLS_Windows(moduleName, socket_library);
    gnu_ssl.execute_hooks();
}
✄
{"version":3,"file":"mbedTLS_windows.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/windows/mbedTLS_windows.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IAE1C,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,KAAK,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;QADlB,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAElE,CAAC;IAED;;;;;;MAME;IACF,8BAA8B;QAC1B,8BAA8B;IAClC,CAAC;IAED,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;IACxC,CAAC;CAEJ;AAGD,MAAM,UAAU,eAAe,CAAC,UAAiB;IAC7C,IAAI,WAAW,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IAClE,WAAW,CAAC,aAAa,EAAE,CAAC;AAGhC,CAAC"}
✄
import { mbed_TLS } from "../ssl_lib/mbedTLS.js";
import { socket_library } from "./windows_agent.js";
export class mbed_TLS_Windows extends mbed_TLS {
    constructor(moduleName, socket_library) {
        super(moduleName, socket_library);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    /*
    SSL_CTX_set_keylog_callback not exported by default on windows.

    We need to find a way to install the callback function for doing that

    Alternatives?:SSL_export_keying_material, SSL_SESSION_get_master_key
    */
    install_tls_keys_callback_hook() {
        // install hooking for windows
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
    }
}
export function mbedTLS_execute(moduleName) {
    var mbedTLS_ssl = new mbed_TLS_Windows(moduleName, socket_library);
    mbedTLS_ssl.execute_hooks();
}
✄
{"version":3,"file":"nss_windows.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/windows/nss_windows.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,OAAO,WAAY,SAAQ,GAAG;IAEhC,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,IAAI,sBAAsB,GAAqC,EAAE,CAAC;QAClE,sBAAsB,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAA;QAC5J,mFAAmF;QACnF,sBAAsB,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAA;QAEnG,KAAK,CAAC,UAAU,EAAC,cAAc,EAAC,sBAAsB,CAAC,CAAC;QANzC,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAOlE,CAAC;IAED,8BAA8B;QAC1B,MAAM;IACV,CAAC;IAGD,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACpC,iEAAiE;IACrE,CAAC;CAEJ;AAGD,MAAM,UAAU,WAAW,CAAC,UAAiB;IACzC,IAAI,OAAO,GAAG,IAAI,WAAW,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IACzD,OAAO,CAAC,aAAa,EAAE,CAAC;AAG5B,CAAC"}
✄
import { NSS } from "../ssl_lib/nss.js";
import { socket_library } from "./windows_agent.js";
export class NSS_Windows extends NSS {
    constructor(moduleName, socket_library) {
        var library_method_mapping = {};
        library_method_mapping[`*${moduleName}*`] = ["PR_Write", "PR_Read", "PR_FileDesc2NativeHandle", "PR_GetPeerName", "PR_GetSockName", "PR_GetNameForIdentity"];
        // library_method_mapping[`*libnss*`] = ["PK11_ExtractKeyValue", "PK11_GetKeyData"]
        library_method_mapping["*ssl*.dll"] = ["SSL_ImportFD", "SSL_GetSessionID", "SSL_HandshakeCallback"];
        super(moduleName, socket_library, library_method_mapping);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    install_tls_keys_callback_hook() {
        // TBD
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        // this.install_tls_keys_callback_hook(); needs to be implemented
    }
}
export function nss_execute(moduleName) {
    var nss_ssl = new NSS_Windows(moduleName, socket_library);
    nss_ssl.execute_hooks();
}
✄
{"version":3,"file":"openssl_boringssl_windows.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/windows/openssl_boringssl_windows.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,OAAO,yBAA0B,SAAQ,iBAAiB;IAE5D,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,IAAI,OAAO,GAAoC,EAAE,CAAC;QAClD,OAAO,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAA;QACtH,OAAO,CAAC,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACjF,KAAK,CAAC,UAAU,EAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAJ3B,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAKlE,CAAC;IAED;;;;;;MAME;IACF,8BAA8B;QAC1B,8BAA8B;IAClC,CAAC;IAED,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;IACxC,CAAC;CAEJ;AAGD,MAAM,UAAU,cAAc,CAAC,UAAiB;IAC5C,IAAI,UAAU,GAAG,IAAI,yBAAyB,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IAC1E,UAAU,CAAC,aAAa,EAAE,CAAC;AAG/B,CAAC"}
✄
import { OpenSSL_BoringSSL } from "../ssl_lib/openssl_boringssl.js";
import { socket_library } from "./windows_agent.js";
export class OpenSSL_BoringSSL_Windows extends OpenSSL_BoringSSL {
    constructor(moduleName, socket_library) {
        let mapping = {};
        mapping[`${moduleName}`] = ["SSL_read", "SSL_write", "SSL_get_fd", "SSL_get_session", "SSL_SESSION_get_id", "SSL_new"];
        mapping[`*${socket_library}*`] = ["getpeername", "getsockname", "ntohs", "ntohl"];
        super(moduleName, socket_library, mapping);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    /*
    SSL_CTX_set_keylog_callback not exported by default on windows.

    We need to find a way to install the callback function for doing that

    Alternatives?:SSL_export_keying_material, SSL_SESSION_get_master_key
    */
    install_tls_keys_callback_hook() {
        // install hooking for windows
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
    }
}
export function boring_execute(moduleName) {
    var boring_ssl = new OpenSSL_BoringSSL_Windows(moduleName, socket_library);
    boring_ssl.execute_hooks();
}
✄
{"version":3,"file":"sspi.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/windows/sspi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEtD;;;;EAIE;AAEF,IAAI,MAAM,GAAG,CAAC,GAAW,EAAE,UAAsB,EAAE,EAAE;IAEjD,MAAM,CAAC,mBAAmB,UAAU,4BAA4B,CAAC,CAAC;IAElE,IAAI,OAAO,GAAuC,EAAE,CAAA;IACpD,OAAO,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;IACxB,IAAI,CAAC,OAAO,CAAC,CAAC;AAClB,CAAC,CAAA;AAOD,+EAA+E;AAC/E,MAAM,OAAO,YAAY;IAMrB,YAAmB,UAAiB,EAAS,cAAqB;QAA/C,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;QAJlE,mBAAmB;QACnB,2BAAsB,GAAqC,EAAE,CAAC;QAK1D,IAAI,CAAC,sBAAsB,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QACtF,IAAG,YAAY,EAAC;YACZ,kCAAkC;YAClC,GAAG,CAAC,oDAAoD,CAAC,CAAA;YACzD,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,GAAG,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,oBAAoB,EAAC,wBAAwB,EAAC,4BAA4B,EAAC,sBAAsB,CAAC,CAAA;SAChM;QACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QAErG,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAE5D,aAAa;QACb,IAAG,OAAO,IAAI,WAAW,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAC;YAE9C,IAAG,OAAO,CAAC,OAAO,IAAI,IAAI,EAAC;gBACvB,MAAM,iBAAiB,GAAG,cAAc,CAAC,cAAc,CAAC,CAAA;gBACxD,KAAI,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAC;oBAC5C,YAAY;oBACb,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;iBACnN;aACJ;YAED,MAAM,kBAAkB,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;YAErD,IAAG,kBAAkB,IAAI,IAAI,EAAC;gBAC1B,GAAG,CAAC,iGAAiG,CAAC,CAAA;aACzG;YAGD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC;gBAC3C,YAAY;gBACZ,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,kBAAkB,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;aAC5M;SAGJ;IAEL,CAAC;IAID,2BAA2B;QACvB,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE;YACjD,OAAO,EAAE,UAAS,IAAI;gBAClB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,EAAE;gBACL,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,2CAA2C;gBAC7F,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA,CAAC,uDAAuD;gBAE1G,2EAA2E;gBAC3E,+EAA+E;gBAC/E,wCAAwC;gBACxC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAA,CAAC,6BAA6B;gBAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAC;oBACnC,IAAI,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;oBACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBACnC;gBAGD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAC;oBAC5C,IAAI,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;oBACjD,IAAI,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;oBACjD,IAAI,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC5D,IAAI,IAAI,IAAI,CAAC,EAAC;wBACV,iFAAiF;wBACjF,IAAI,KAAK,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;wBAC9C,IAAI,OAAO,GAAuC,EAAE,CAAA;wBACpD,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAA;wBAChC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;wBAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;wBAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;wBAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;wBAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,gBAAgB,CAAA;wBACtC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;wBAClC,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAA;wBAC9B,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;qBACvB;iBACJ;YACL,CAAC;SAEJ,CAAC,CAAC;IAEP,CAAC;IAED,4BAA4B;QACxB,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE;YAEjD,OAAO,EAAE,UAAS,IAAI;gBACV,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,yGAAyG;gBAClI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,2CAA2C;gBAC7F,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA,CAAC,uDAAuD;gBAE1G,2EAA2E;gBAC3E,+EAA+E;gBAC/E,wCAAwC;gBACxC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAA,CAAC,6BAA6B;gBAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAC;oBACnC,IAAI,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;oBACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBACnC;gBAGD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAC;oBAC5C,IAAI,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;oBACjD,IAAI,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;oBACjD,IAAI,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC5D,IAAI,IAAI,IAAI,CAAC,EAAC;wBACV,mDAAmD;wBACnD,IAAI,KAAK,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;wBAC9C,IAAI,OAAO,GAAuC,EAAE,CAAA;wBACpD,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAA;wBAChC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;wBAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;wBAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;wBAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;wBAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,gBAAgB,CAAA;wBACtC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAA;wBAClC,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAA;wBAC9B,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;qBACvB;iBACJ;YACb,CAAC;SACJ,CAAC,CAAC;IAEP,CAAC;IAGD,qBAAqB;QAEjB;;UAEE;QAEF,IAAI,cAAc,GAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,GAAG,UAAU,MAAU;YAC9B,OAAO,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,UAAS,CAAC,IAAG,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA,CAAA,CAAC,CAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9H,CAAC,CAAA;QAED,iCAAiC;QAEjC,IAAI,kBAAkB,GAAG,UAAS,UAAe;YAC7C,IAAI,gBAAgB,GAAG,UAAU,CAAA,CAAC,eAAe;YACjD,IAAI,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YACxD,IAAI,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YACpD,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAA;QAED,IAAI,oBAAoB,GAAG,UAAS,cAAmB,EAAE,YAAiB;YACtE;;;;;;;;;;;eAWG;YACH,IAAI,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACnD,IAAI,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAClD,KAAI,IAAI,CAAC,GAAG,CAAC,EAAG,CAAC,GAAG,YAAY,EAAG,CAAC,EAAG,EAAC;gBACpC,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,GAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;gBAC7B,IAAI,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/D,kEAAkE;gBAClE,IAAI,QAAQ,IAAI,EAAE,EAAC,EAAE,iCAAiC;oBACnD,MAAM,CAAC,yBAAyB,GAAG,YAAY,GAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC1F,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;iBAC3B;gBACD,sCAAsC;aACzC;YAED,OAAO,IAAI,CAAC;QAChB,CAAC,CAAA;QAGD,IAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,IAAI,IAAI;YACzC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE;gBACnD,OAAO,EAAE,UAAU,IAAS;oBACxB,yEAAyE;oBACzE,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvB,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;oBAC5B,IAAI,GAAG,GAAG,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;oBACjC,IAAI,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;oBAC5B,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;oBACnC,IAAI,QAAQ,IAAI,CAAC,IAAI,OAAO,IAAI,MAAM,EAAC;wBACnC,2DAA2D;wBAC3D,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;wBACpD,MAAM,CAAC,2CAA2C,GAAG,OAAO,CAAC,CAAC;wBAC9D,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;qBAC3C;gBACL,CAAC;gBACD,OAAO,EAAE,UAAU,MAAM;gBACzB,CAAC;aACJ,CAAC,CAAC;QAEP,IAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI,IAAI;YAC7C,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE;gBACvD,OAAO,EAAE,UAAU,IAAS;oBACxB,6EAA6E;oBAC7E,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjC,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnC,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;gBACrI,CAAC;gBACD,OAAO,EAAE,UAAU,MAAM;oBACrB,IAAI,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;oBACpE,MAAM,CAAC,yCAAyC,CAAC,CAAC;oBAClD,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC,aAAa,GAAG,GAAG,GAAG,UAAU,6BAAqB,CAAC;gBACzF,CAAC;aACJ,CAAC,CAAC;QAEP,IAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,IAAI;YAC3C,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE;gBACrD,OAAO,EAAE,UAAU,IAAS;oBACxB,2EAA2E;oBAC3E,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnC,kHAAkH;oBAClH,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,oBAAoB,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;gBACnI,CAAC;gBACD,OAAO,EAAE,UAAU,MAAM;oBACrB,IAAI,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;oBACpE,MAAM,CAAC,2CAA2C,CAAC,CAAC;oBACpD,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC,aAAa,GAAG,GAAG,GAAG,UAAU,6BAAqB,CAAA;gBACxF,CAAC;aACJ,CAAC,CAAC;QAEP,IAAG,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,IAAI,IAAI;YAC/C,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,EAAE;gBACzD,OAAO,EAAE,UAAU,IAAS;oBACxB,+EAA+E;oBAC/E,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC/B,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjC,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnC,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;oBACnI,IAAI,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBACrD,MAAM,CAAC,2CAA2C,CAAC,CAAC;oBACpD,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC,aAAa,GAAG,GAAG,GAAG,UAAU,6BAAqB,CAAC;gBACzF,CAAC;gBACD,OAAO,EAAE,UAAU,MAAM;gBACzB,CAAC;aACJ,CAAC,CAAC;QAEP,iCAAiC;QAEjC,IAAI,MAAM,GAAQ,EAAE,CAAC;QACrB,IAAI,oBAAoB,GAAG,UAAS,WAAgB;YAChD,IAAI,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YACtD,IAAI,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YACtD,IAAI,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YACtD,IAAI,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC/C,OAAO,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAA;QAED,IAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI,IAAI;YAC7C,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE;gBACvD,OAAO,EAAE,UAAU,IAAS;oBACxB,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5B,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5B,IAAI,CAAC,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;oBAC5D,IAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAC;wBACrB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;wBAC7B,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC;qBACpC;yBAAI;wBACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;wBACpC,IAAI,CAAC,MAAM,GAAG,0BAA0B,CAAC;qBAC5C;gBACL,CAAC;gBACD,OAAO,EAAE,UAAU,MAAM;oBACrB,IAAI,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;oBAC5D,IAAI,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;oBAC5D,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,+BAAuB,CAAC;oBACvG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,+BAAuB,CAAC;gBAC3G,CAAC;aACJ,CAAC,CAAC;QAEP,IAAG,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,IAAI,IAAI;YACnD,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,EAAE;gBAC7D,OAAO,EAAE,UAAU,IAAS;oBACxB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3B,IAAI,CAAC,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;gBAChE,CAAC;gBACD,OAAO,EAAE,UAAU,MAAM;oBACrB,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;oBACtJ,MAAM,CAAC,kBAAkB,GAAG,IAAI,CAAC,aAAa,GAAG,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,+BAAuB,CAAC;gBAC/F,CAAC;aACJ,CAAC,CAAC;IAEX,CAAC;IAED,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACpC,IAAG,YAAY,EAAC;YACZ,IAAI,CAAC,qBAAqB,EAAE,CAAC;SAChC;IACL,CAAC;CAEJ;AAGD,MAAM,UAAU,YAAY,CAAC,UAAiB;IAC1C,IAAI,QAAQ,GAAG,IAAI,YAAY,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IAC3D,QAAQ,CAAC,aAAa,EAAE,CAAC;AAG7B,CAAC"}
✄
import { readAddresses, getBaseAddress } from "../shared/shared_functions.js";
import { socket_library } from "./windows_agent.js";
import { devlog, log } from "../util/log.js";
import { experimental, offsets } from "../ssl_log.js";
/*
ToDo:
- Write Test Client for ground truth and test everything
- Obtain information from the running process to get the socket information instead of using default values
*/
var keylog = (key, tlsVersion) => {
    devlog(`Exporting TLS 1.${tlsVersion} handshake keying material`);
    var message = {};
    message["contentType"] = "keylog";
    message["keylog"] = key;
    send(message);
};
// This library is only existend under Windows therefore there is no Superclass
export class SSPI_Windows {
    constructor(moduleName, socket_library) {
        this.moduleName = moduleName;
        this.socket_library = socket_library;
        // global variables
        this.library_method_mapping = {};
        this.library_method_mapping[`*${moduleName}*`] = ["DecryptMessage", "EncryptMessage"];
        if (experimental) {
            // ncrypt is used for the TLS keys
            log(`ncrypt.dll was loaded & will be hooked on Windows!`);
            this.library_method_mapping["*ncrypt*.dll"] = ["SslHashHandshake", "SslGenerateMasterKey", "SslImportMasterKey", "SslGenerateSessionKeys", "SslExpandExporterMasterKey", "SslExpandTrafficKeys"];
        }
        this.library_method_mapping[`*${socket_library}*`] = ["getpeername", "getsockname", "ntohs", "ntohl"];
        this.addresses = readAddresses(this.library_method_mapping);
        // @ts-ignore
        if (offsets != "{OFFSETS}" && offsets.sspi != null) {
            if (offsets.sockets != null) {
                const socketBaseAddress = getBaseAddress(socket_library);
                for (const method of Object.keys(offsets.sockets)) {
                    //@ts-ignore
                    this.addresses[`${method}`] = offsets.sockets[`${method}`].absolute || socketBaseAddress == null ? ptr(offsets.sockets[`${method}`].address) : socketBaseAddress.add(ptr(offsets.sockets[`${method}`].address));
                }
            }
            const libraryBaseAddress = getBaseAddress(moduleName);
            if (libraryBaseAddress == null) {
                log("Unable to find library base address! Given address values will be interpreted as absolute ones!");
            }
            for (const method of Object.keys(offsets.sspi)) {
                //@ts-ignore
                this.addresses[`${method}`] = offsets.sspi[`${method}`].absolute || libraryBaseAddress == null ? ptr(offsets.sspi[`${method}`].address) : libraryBaseAddress.add(ptr(offsets.sspi[`${method}`].address));
            }
        }
    }
    install_plaintext_read_hook() {
        Interceptor.attach(this.addresses["DecryptMessage"], {
            onEnter: function (args) {
                this.pMessage = args[1];
            },
            onLeave: function () {
                this.cBuffers = this.pMessage.add(4).readULong(); //unsigned long cBuffers (Count of buffers)
                this.pBuffers = this.pMessage.add(8).readPointer(); //PSecBuffer  pBuffers (Pointer to array of secBuffers)
                //https://docs.microsoft.com/en-us/windows/win32/api/sspi/ns-sspi-secbuffer
                //One SecBuffer got 16 Bytes (unsigned long + unsigned long + pointer (64 Bit))
                //--> Bytes to read: cBuffers + 16 Bytes
                this.secBuffers = []; //Addresses of all secBuffers
                for (let i = 0; i < this.cBuffers; i++) {
                    var secBuffer = this.pBuffers.add(i * 16);
                    this.secBuffers.push(secBuffer);
                }
                for (let i = 0; i < this.secBuffers.length; i++) {
                    var size = this.secBuffers[i].add(0).readULong();
                    var type = this.secBuffers[i].add(4).readULong();
                    var bufferPointer = this.secBuffers[i].add(8).readPointer();
                    if (type == 1) {
                        //TODO: Obtain information from the running process to get the socket information
                        var bytes = bufferPointer.readByteArray(size);
                        var message = {};
                        message["ss_family"] = "AF_INET";
                        message["src_port"] = 444;
                        message["src_addr"] = 222;
                        message["dst_port"] = 443;
                        message["dst_addr"] = 222;
                        message["function"] = "DecryptMessage";
                        message["contentType"] = "datalog";
                        message["ssl_session_id"] = 10;
                        send(message, bytes);
                    }
                }
            }
        });
    }
    install_plaintext_write_hook() {
        Interceptor.attach(this.addresses["EncryptMessage"], {
            onEnter: function (args) {
                this.pMessage = args[2]; //PSecBufferDesc pMessage (https://docs.microsoft.com/en-us/windows/win32/api/sspi/ns-sspi-secbufferdesc)
                this.cBuffers = this.pMessage.add(4).readULong(); //unsigned long cBuffers (Count of buffers)
                this.pBuffers = this.pMessage.add(8).readPointer(); //PSecBuffer  pBuffers (Pointer to array of secBuffers)
                //https://docs.microsoft.com/en-us/windows/win32/api/sspi/ns-sspi-secbuffer
                //One SecBuffer got 16 Bytes (unsigned long + unsigned long + pointer (64 Bit))
                //--> Bytes to read: cBuffers + 16 Bytes
                this.secBuffers = []; //Addresses of all secBuffers
                for (let i = 0; i < this.cBuffers; i++) {
                    var secBuffer = this.pBuffers.add(i * 16);
                    this.secBuffers.push(secBuffer);
                }
                for (let i = 0; i < this.secBuffers.length; i++) {
                    var size = this.secBuffers[i].add(0).readULong();
                    var type = this.secBuffers[i].add(4).readULong();
                    var bufferPointer = this.secBuffers[i].add(8).readPointer();
                    if (type == 1) {
                        //TODO: Obtain information from the running process
                        var bytes = bufferPointer.readByteArray(size);
                        var message = {};
                        message["ss_family"] = "AF_INET";
                        message["src_port"] = 443;
                        message["src_addr"] = 222;
                        message["dst_port"] = 444;
                        message["dst_addr"] = 222;
                        message["function"] = "EncryptMessage";
                        message["contentType"] = "datalog";
                        message["ssl_session_id"] = 10;
                        send(message, bytes);
                    }
                }
            }
        });
    }
    install_tls_keys_hook() {
        /* Most of the following code fragments were copied from
         * https://github.com/ngo/win-frida-scripts/tree/master/lsasslkeylog-easy
        */
        var client_randoms = {};
        var buf2hex = function (buffer) {
            return Array.prototype.map.call(new Uint8Array(buffer), function (x) { return ('00' + x.toString(16)).slice(-2); }).join('');
        };
        /* ----- TLS1.2-specific ----- */
        var parse_h_master_key = function (pMasterKey) {
            var NcryptSslKey_ptr = pMasterKey; // NcryptSslKey
            var ssl5_ptr = NcryptSslKey_ptr.add(0x10).readPointer();
            var master_key = ssl5_ptr.add(28).readByteArray(48);
            return buf2hex(master_key);
        };
        var parse_parameter_list = function (pParameterList, calling_func) {
            /*
                typedef struct _NCryptBufferDesc {
                    ULONG         ulVersion;
                    ULONG         cBuffers;
                    PNCryptBuffer pBuffers;
                } NCryptBufferDesc, *PNCryptBufferDesc;
                typedef struct _NCryptBuffer {
                    ULONG cbBuffer;
                    ULONG BufferType;
                    PVOID pvBuffer;
                } NCryptBuffer, *PNCryptBuffer;
             */
            var buffer_count = pParameterList.add(4).readU32();
            var buffers = pParameterList.add(8).readPointer();
            for (var i = 0; i < buffer_count; i++) {
                var buf = buffers.add(16 * i);
                var buf_size = buf.readU32();
                var buf_type = buf.add(4).readU32();
                var buf_buf = buf.add(8).readPointer().readByteArray(buf_size);
                // For buf_type values see NCRYPTBUFFER_SSL_* constans in ncrypt.h
                if (buf_type == 20) { // NCRYPTBUFFER_SSL_CLIENT_RANDOM
                    devlog("Got client random from " + calling_func + "'s pParameterList: " + buf2hex(buf_buf));
                    return buf2hex(buf_buf);
                }
                //console.log("buf_type " + buf_type);
            }
            return null;
        };
        if (this.addresses["SslHashHandshake"] != null)
            Interceptor.attach(this.addresses["SslHashHandshake"], {
                onEnter: function (args) {
                    // https://docs.microsoft.com/en-us/windows/win32/seccng/sslhashhandshake
                    var buf = ptr(args[2]);
                    var len = args[3].toInt32();
                    var mem = buf.readByteArray(len);
                    var msg_type = buf.readU8();
                    var version = buf.add(4).readU16();
                    if (msg_type == 1 && version == 0x0303) {
                        // If we have client random, save it tied to current thread
                        var crandom = buf2hex(buf.add(6).readByteArray(32));
                        devlog("Got client random from SslHashHandshake: " + crandom);
                        client_randoms[this.threadId] = crandom;
                    }
                },
                onLeave: function (retval) {
                }
            });
        if (this.addresses["SslGenerateMasterKey"] != null)
            Interceptor.attach(this.addresses["SslGenerateMasterKey"], {
                onEnter: function (args) {
                    // https://docs.microsoft.com/en-us/windows/win32/seccng/sslgeneratemasterkey
                    this.phMasterKey = ptr(args[3]);
                    this.hSslProvider = ptr(args[0]);
                    this.pParameterList = ptr(args[6]);
                    this.client_random = parse_parameter_list(this.pParameterList, 'SslGenerateMasterKey') || client_randoms[this.threadId] || "???";
                },
                onLeave: function (retval) {
                    var master_key = parse_h_master_key(this.phMasterKey.readPointer());
                    devlog("Got masterkey from SslGenerateMasterKey");
                    keylog("CLIENT_RANDOM " + this.client_random + " " + master_key, 2 /* TLSVersion.ONE_TWO */);
                }
            });
        if (this.addresses["SslImportMasterKey"] != null)
            Interceptor.attach(this.addresses["SslImportMasterKey"], {
                onEnter: function (args) {
                    // https://docs.microsoft.com/en-us/windows/win32/seccng/sslimportmasterkey
                    this.phMasterKey = ptr(args[2]);
                    this.pParameterList = ptr(args[5]);
                    // Get client random from the pParameterList, and if that fails - from the value saved by SslHashHandshake handler
                    this.client_random = parse_parameter_list(this.pParameterList, 'SslImportMasterKey') || client_randoms[this.threadId] || "???";
                },
                onLeave: function (retval) {
                    var master_key = parse_h_master_key(this.phMasterKey.readPointer());
                    devlog("[*] Got masterkey from SslImportMasterKey");
                    keylog("CLIENT_RANDOM " + this.client_random + " " + master_key, 2 /* TLSVersion.ONE_TWO */);
                }
            });
        if (this.addresses["SslGenerateSessionKeys"] != null)
            Interceptor.attach(this.addresses["SslGenerateSessionKeys"], {
                onEnter: function (args) {
                    // https://docs.microsoft.com/en-us/windows/win32/seccng/sslgeneratesessionkeys
                    this.hMasterKey = ptr(args[1]);
                    this.hSslProvider = ptr(args[0]);
                    this.pParameterList = ptr(args[4]);
                    this.client_random = parse_parameter_list(this.pParameterList, 'SslGenerateSessionKeys') || client_randoms[this.threadId] || "???";
                    var master_key = parse_h_master_key(this.hMasterKey);
                    devlog("Got masterkey from SslGenerateSessionKeys");
                    keylog("CLIENT_RANDOM " + this.client_random + " " + master_key, 2 /* TLSVersion.ONE_TWO */);
                },
                onLeave: function (retval) {
                }
            });
        /* ----- TLS1.3-specific ----- */
        var stages = {};
        var get_secret_from_BDDD = function (struct_BDDD) {
            var struct_3lss = struct_BDDD.add(0x10).readPointer();
            var struct_RUUU = struct_3lss.add(0x20).readPointer();
            var struct_YKSM = struct_RUUU.add(0x10).readPointer();
            var secret_ptr = struct_YKSM.add(0x18).readPointer();
            var size = struct_YKSM.add(0x10).readU32();
            return secret_ptr.readByteArray(size);
        };
        if (this.addresses["SslExpandTrafficKeys"] != null)
            Interceptor.attach(this.addresses["SslExpandTrafficKeys"], {
                onEnter: function (args) {
                    this.retkey1 = ptr(args[3]);
                    this.retkey2 = ptr(args[4]);
                    this.client_random = client_randoms[this.threadId] || "???";
                    if (stages[this.threadId]) {
                        stages[this.threadId] = null;
                        this.suffix = "TRAFFIC_SECRET_0";
                    }
                    else {
                        stages[this.threadId] = "handshake";
                        this.suffix = "HANDSHAKE_TRAFFIC_SECRET";
                    }
                },
                onLeave: function (retval) {
                    var key1 = get_secret_from_BDDD(this.retkey1.readPointer());
                    var key2 = get_secret_from_BDDD(this.retkey2.readPointer());
                    keylog("CLIENT_" + this.suffix + " " + this.client_random + " " + buf2hex(key1), 3 /* TLSVersion.ONE_THREE */);
                    keylog("SERVER_" + this.suffix + " " + this.client_random + " " + buf2hex(key2), 3 /* TLSVersion.ONE_THREE */);
                }
            });
        if (this.addresses["SslExpandExporterMasterKey"] != null)
            Interceptor.attach(this.addresses["SslExpandExporterMasterKey"], {
                onEnter: function (args) {
                    this.retkey = ptr(args[3]);
                    this.client_random = client_randoms[this.threadId] || "???";
                },
                onLeave: function (retval) {
                    var key = this.retkey.readPointer().add(0x10).readPointer().add(0x20).readPointer().add(0x10).readPointer().add(0x18).readPointer().readByteArray(48);
                    keylog("EXPORTER_SECRET " + this.client_random + " " + buf2hex(key), 3 /* TLSVersion.ONE_THREE */);
                }
            });
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        if (experimental) {
            this.install_tls_keys_hook();
        }
    }
}
export function sspi_execute(moduleName) {
    var sspi_ssl = new SSPI_Windows(moduleName, socket_library);
    sspi_ssl.execute_hooks();
}
✄
{"version":3,"file":"windows_agent.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/windows/windows_agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAItD,IAAI,cAAc,GAAG,SAAS,CAAC;AAC/B,IAAI,WAAW,GAAkB,cAAc,EAAE,CAAA;AAEjD,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAE3C,SAAS,2BAA2B,CAAC,sBAAmF;IACpH,IAAI;QAEA,MAAM,QAAQ,GAAgB,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAA;QACvD,IAAI,cAAc,GAAG,QAAQ,CAAC,gBAAgB,CAAC,wCAAwC,CAAC,CAAA;QAExF,IAAI,cAAc,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAA;QAGzF,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;YAC1C,OAAO,CAAC,MAAqB;gBAEzB,IAAI,GAAG,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC1B,IAAI,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;gBACrC,IAAI,UAAU,KAAK,IAAI;oBAAE,OAAM;gBAE/B,KAAK,IAAI,GAAG,IAAI,sBAAsB,CAAC,cAAc,CAAC,EAAE;oBACpD,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;oBAClB,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;oBAEjB,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;wBACxB,GAAG,CAAC,GAAG,UAAU,0CAA0C,CAAC,CAAA;wBAC5D,IAAI,CAAC,UAAU,CAAC,CAAA;qBACnB;iBAEJ;YACL,CAAC;SACJ,CAAC,CAAA;QACF,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAA;KACpD;IAAC,OAAO,KAAK,EAAE;QACZ,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAA;QAChC,GAAG,CAAC,wCAAwC,CAAC,CAAA;KAChD;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,sBAAmF;IAC9G,kBAAkB,CAAC,cAAc,EAAE,sBAAsB,EAAC,WAAW,EAAC,SAAS,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,UAAU,0BAA0B;IACtC,sBAAsB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,yCAAyC,EAAE,cAAc,CAAC,EAAE,CAAC,8BAA8B,EAAE,eAAe,CAAC,EAAE,CAAC,uCAAuC,EAAE,cAAc,CAAC,EAAE,CAAC,yBAAyB,EAAE,WAAW,CAAC,EAAE,CAAC,iCAAiC,EAAE,YAAY,CAAC,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAA;IACpV,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IAC9C,2BAA2B,CAAC,sBAAsB,CAAC,CAAC;AACxD,CAAC"}
✄
import { module_library_mapping } from "../shared/shared_structures.js";
import { log, devlog } from "../util/log.js";
import { getModuleNames, ssl_library_loader } from "../shared/shared_functions.js";
import { sspi_execute } from "./sspi.js";
import { boring_execute } from "./openssl_boringssl_windows.js";
import { gnutls_execute } from "./gnutls_windows.js";
import { mbedTLS_execute } from "./mbedTLS_windows.js";
import { nss_execute } from "./nss_windows.js";
import { wolfssl_execute } from "./wolfssl_windows.js";
var plattform_name = "windows";
var moduleNames = getModuleNames();
export const socket_library = "WS2_32.dll";
function hook_Windows_Dynamic_Loader(module_library_mapping) {
    try {
        const resolver = new ApiResolver('module');
        var loadLibraryExW = resolver.enumerateMatches("exports:KERNELBASE.dll!*LoadLibraryExW");
        if (loadLibraryExW.length == 0)
            return console.log("[-] Missing windows dynamic loader!");
        Interceptor.attach(loadLibraryExW[0].address, {
            onLeave(retval) {
                let map = new ModuleMap();
                let moduleName = map.findName(retval);
                if (moduleName === null)
                    return;
                for (let map of module_library_mapping[plattform_name]) {
                    let regex = map[0];
                    let func = map[1];
                    if (regex.test(moduleName)) {
                        log(`${moduleName} was loaded & will be hooked on Windows!`);
                        func(moduleName);
                    }
                }
            }
        });
        console.log("[*] Windows dynamic loader hooked.");
    }
    catch (error) {
        devlog("Loader error: " + error);
        log("No dynamic loader present for hooking.");
    }
}
function hook_Windows_SSL_Libs(module_library_mapping) {
    ssl_library_loader(plattform_name, module_library_mapping, moduleNames, "Windows");
}
export function load_windows_hooking_agent() {
    module_library_mapping[plattform_name] = [[/^(libssl|LIBSSL)-[0-9]+(_[0-9]+)?\.dll$/, boring_execute], [/^.*(wolfssl|WOLFSSL).*\.dll$/, wolfssl_execute], [/^.*(libgnutls|LIBGNUTLS)-[0-9]+\.dll$/, gnutls_execute], [/^(nspr|NSPR)[0-9]*\.dll/, nss_execute], [/(sspicli|SSPICLI|SspiCli)\.dll$/, sspi_execute], [/mbedTLS\.dll/, mbedTLS_execute]];
    hook_Windows_SSL_Libs(module_library_mapping);
    hook_Windows_Dynamic_Loader(module_library_mapping);
}
✄
{"version":3,"file":"wolfssl_windows.js","sourceRoot":"/Users/danielbaier/research/projects/github/friTap/","sources":["agent/windows/wolfssl_windows.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAErC,MAAM,OAAO,eAAgB,SAAQ,OAAO;IAExC,YAAmB,UAAiB,EAAS,cAAqB;QAC9D,IAAI,OAAO,GAAoC,EAAE,CAAC;QAClD,OAAO,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAA;QAC9I,OAAO,CAAC,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACjF,KAAK,CAAC,UAAU,EAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAJ3B,eAAU,GAAV,UAAU,CAAO;QAAS,mBAAc,GAAd,cAAc,CAAO;IAKlE,CAAC;IAGD,8BAA8B;QAC1B,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACjE,CAAC;IAKD,aAAa;QACT,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACpC,kEAAkE;IACtE,CAAC;CAEJ;AAGD,MAAM,UAAU,eAAe,CAAC,UAAiB;IAC7C,IAAI,QAAQ,GAAG,IAAI,eAAe,CAAC,UAAU,EAAC,cAAc,CAAC,CAAC;IAC9D,QAAQ,CAAC,aAAa,EAAE,CAAC;AAG7B,CAAC"}
✄
import { WolfSSL } from "../ssl_lib/wolfssl.js";
import { socket_library } from "./windows_agent.js";
import { log } from "../util/log.js";
export class WolfSSL_Windows extends WolfSSL {
    constructor(moduleName, socket_library) {
        let mapping = {};
        mapping[`${moduleName}`] = ["wolfSSL_read", "wolfSSL_write", "wolfSSL_get_fd", "wolfSSL_get_session", "wolfSSL_connect", "wolfSSL_KeepArrays"];
        mapping[`*${socket_library}*`] = ["getpeername", "getsockname", "ntohs", "ntohl"];
        super(moduleName, socket_library, mapping);
        this.moduleName = moduleName;
        this.socket_library = socket_library;
    }
    install_tls_keys_callback_hook() {
        log("Key extraction currently not implemented for windows!");
    }
    execute_hooks() {
        this.install_plaintext_read_hook();
        this.install_plaintext_write_hook();
        //this.install_tls_keys_callback_hook(); currently not implemented
    }
}
export function wolfssl_execute(moduleName) {
    var wolf_ssl = new WolfSSL_Windows(moduleName, socket_library);
    wolf_ssl.execute_hooks();
}