hook_transfer_sink.js
2.22 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
// Read-only hook on the actual convergence point for brandservice/webview JS
// API transfer requests: Ljs1/m;->c(TransferRequestInfo, callback). Both the
// mini-program (k2/y7) path and the WebView "luggage" JS API path funnel
// through here before the request is dispatched (locally or via IPC to
// PROCESS_MAIN). Does NOT modify args or block the call — pure observation.
import Java from 'frida-java-bridge';
Java.perform(function () {
try {
var cls = Java.use('js1.m');
cls.c.overload(
'com.tencent.mm.plugin.brandservice.api.TransferRequestInfo',
'zq1.g0'
).implementation = function (reqInfo, cb) {
try {
console.log("\n[sink-hook] js1.m.c() called at " + new Date().toISOString());
if (reqInfo !== null) {
console.log(" type(d): " + reqInfo.d.value);
console.log(" h5Url(e): " + reqInfo.e.value);
console.log(" scope(f): " + reqInfo.f.value);
console.log(" needVerifySignature(n): " + reqInfo.n.value);
console.log(" is_security_check(i): " + reqInfo.i.value);
var h = reqInfo.h.value;
if (h !== null) {
console.log(" reqUrl(h.d): " + h.d.value);
console.log(" cgiCmdId(h.f): " + h.f.value);
console.log(" reqBody(h.e): " + h.e.value);
console.log(" method(h.h): " + h.h.value);
var headers = h.g.value;
if (headers !== null) {
console.log(" headers(h.g): " + headers.toString());
}
} else {
console.log(" h (y24) is null");
}
} else {
console.log(" reqInfo is null");
}
} catch (e) {
console.log("[sink-hook] dump error: " + e);
}
return this.c(reqInfo, cb);
};
console.log("[sink-hook] hooked js1.m.c(TransferRequestInfo, zq1.g0)");
} catch (e) {
console.log("[sink-hook] FAILED to hook js1.m.c: " + e);
}
});