Initiative

最近需要分析一些SSL流量，无非三条途径：2种已知中间人解密方法，wireshark抓证书然后解密，和hook dll三种方法。个人无故偏好最后一种。。。。

网上找了些软件，一个是别人写好的现成黑客工具Echo Mirage

支持Winsock, Winsock SSL, OpenSSL三种hook。但是这个dll inject老是挂掉，不爽。。。。

又发现了一个PyDbg。。。这个工具是附属于 pedram.openrce.org 的一个名叫 PaiMei 的子项目中

当然这个 Paimei 就是《Kill Bill 2》里面最后被毒死那个所谓功夫很牛逼的 白眉 师傅。。。。

Paimei 首页 | 文档 | 下载 | 源码

PaiMei is a reverse engineering framework consisting of multiple extensible components. The goal of the framework is to reduce the time from "idea" to prototype to a matter of minutes, instead of days. PaiMei is written entirely in Python and exposes at the highest level a debugger, a graph based binary abstraction and a set of utilities for accomplishing various repetitive tasks. The framework can essentially be thought of as a reverse engineer's swiss army knife and has already been proven effective for a wide range of both static and dynamic tasks such as: fuzzer assistance, code coverage tracking, data flow tracking and more.

用pydbg来截获ssl还是很简单的。。。这个帖子里有现成代码

import sys
import utils
from pydbg import *
pktc = 0
def SSL_read_hook (dbg, args, ret):
    global pktc
    pkt = dbg.read_process_memory(args[1], args[2])
    f.write("[%d] Packet:\n" % pktc)
    f.write(dbg.hex_dump(dbg.read_process_memory(args[1], args[2])))
    f.write('\n')
    pktc = pktc + 1
try:
    pid = int(sys.argv[1])
except:
    print "Usage: %s PID" % sys.argv[0]
    sys.exit(-1)
filename = "ssldump_" + str(pid) + ".txt"
f = open(filename, 'w')
dbg = pydbg()
dbg.attach(pid)
addrSSL_read = dbg.func_resolve_debuggee("SSLEAY32", "SSL_read")
if not addrSSL_read:
    print "Couldn't resolve SSL_read"
    sys.exit(-1)
hooks = utils.hook_container()
print "Hooking SSL_read(0x%x)" % addrSSL_read
hooks.add(dbg, addrSSL_read, 3, None, SSL_read_hook)
print "Function hooked, logging to: %s" % filename
dbg.run()
f.close()

pydbg这个依赖库不需要完全下载paimei，只需要svn checkout/export下面几个python module就可以了：

http://paimei.googlecode.com/svn/trunk/pgraph
http://paimei.googlecode.com/svn/trunk/pida
http://paimei.googlecode.com/svn/trunk/pydbg
http://paimei.googlecode.com/svn/trunk/utils

注意paimei是比较古老的项目了，现在似乎没人管了。所以这个代码里有个bug，会出错

TypeError: can't set attributes of built-in/extension type '_ctypes.Structure'

解决方法是打开 pydbg\my_ctypes.py

在 c_type = (Structure ... 这一行上面加一行：

class Structure(Structure):
    pass

就OK了。

当然hook出来有很多0x00的空值。这个手工处理掉就行了。

现在又开始纠结带gzip/bz2解压功能的ssl分析工具了。。。。。很多时候还是只有自己DIY。。。。

参考 1，2，3

btw, 最近出了一款号称用p2p，基于QtWebkit的OOXX浏览器。我去看了下，就是一个ssl代理

$ openssl s_client -connect ps?????.dreamhostps.com:443
GET http://twitter.com/ HTTP/1.1
HOST: twitter.com

呵呵。。。。