pydbg和Paimei - hook openssl ssl_read()
最近需要分析一些SSL流量，无非三条途径：2种已知中间人解密方法，wireshark抓证书然后解密，和hook dll三种方法。个人无故偏好最后一种。。。。
网上找了些软件，一个是别人写好的现成黑客工具Echo Mirage
支持Winsock, Winsock SSL, OpenSSL三种hook。但是这个dll inject老是挂掉，不爽。。。。
又发现了一个PyDbg。。。这个工具是附属于 pedram.openrce.org 的一个名叫 PaiMei 的子项目中
当然这个 Paimei 就是《Kill Bill 2》里面最后被毒死那个所谓功夫很牛逼的 白眉 师傅。。。。
PaiMei is a reverse engineering framework consisting of multiple extensible components. The goal of the framework is to reduce the time from "idea" to prototype to a matter of minutes, instead of days. PaiMei is written entirely in Python and exposes at the highest level a debugger, a graph based binary abstraction and a set of utilities for accomplishing various repetitive tasks. The framework can essentially be thought of as a reverse engineer's swiss army knife and has already been proven effective for a wide range of both static and dynamic tasks such as: fuzzer assistance, code coverage tracking, data flow tracking and more.
用pydbg来截获ssl还是很简单的。。。这个帖子里有现成代码
import sys import utils from pydbg import * pktc = 0
def SSL_read_hook (dbg, args, ret): global pktc pkt = dbg.read_process_memory(args[1], args[2]) f.write("[%d] Packet:\n" % pktc) f.write(dbg.hex_dump(dbg.read_process_memory(args[1], args[2]))) f.write('\n') pktc = pktc + 1
try: pid = int(sys.argv[1]) except: print "Usage: %s PID" % sys.argv[0] sys.exit(-1)
filename = "ssldump_" + str(pid) + ".txt" f = open(filename, 'w')
dbg = pydbg() dbg.attach(pid)
addrSSL_read = dbg.func_resolve_debuggee("SSLEAY32", "SSL_read") if not addrSSL_read: print "Couldn't resolve SSL_read" sys.exit(-1)
hooks = utils.hook_container() print "Hooking SSL_read(0x%x)" % addrSSL_read hooks.add(dbg, addrSSL_read, 3, None, SSL_read_hook)
print "Function hooked, logging to: %s" % filename dbg.run() f.close()
pydbg这个依赖库不需要完全下载paimei，只需要svn checkout/export下面几个python module就可以了：
http://paimei.googlecode.com/svn/trunk/pgraph http://paimei.googlecode.com/svn/trunk/pida http://paimei.googlecode.com/svn/trunk/pydbg http://paimei.googlecode.com/svn/trunk/utils
注意paimei是比较古老的项目了，现在似乎没人管了。所以这个代码里有个bug，会出错
TypeError: can't set attributes of built-in/extension type '_ctypes.Structure'
解决方法是打开 pydbg\my_ctypes.py
在 c_type = (Structure ... 这一行上面加一行：
class Structure(Structure):
pass
就OK了。
当然hook出来有很多0x00的空值。这个手工处理掉就行了。
现在又开始纠结带gzip/bz2解压功能的ssl分析工具了。。。。。很多时候还是只有自己DIY。。。。
btw, 最近出了一款号称用p2p，基于QtWebkit的OOXX浏览器。我去看了下，就是一个ssl代理
$ openssl s_client -connect ps?????.dreamhostps.com:443 GET http://twitter.com/ HTTP/1.1 HOST: twitter.com
呵呵。。。。
Posted
archive
