diff --git a/src/hooks/CommonCryptorHooks.m b/src/hooks/CommonCryptorHooks.m old mode 100644 new mode 100755 index 82343b2..81a8b13 --- a/src/hooks/CommonCryptorHooks.m +++ b/src/hooks/CommonCryptorHooks.m @@ -13,7 +13,7 @@ // Utiity function static size_t getIVLength(CCAlgorithm alg) { - + switch(alg) { case kCCAlgorithmAES128: return kCCBlockSizeAES128; @@ -27,36 +27,36 @@ static size_t getIVLength(CCAlgorithm alg) { return kCCBlockSizeRC2; default: return 0; - } + } } // Hook CCCryptorCreate() static CCCryptorStatus (*original_CCCryptorCreate)( - CCOperation op, - CCAlgorithm alg, - CCOptions options, - const void *key, + CCOperation op, + CCAlgorithm alg, + CCOptions options, + const void *key, size_t keyLength, - const void *iv, + const void *iv, CCCryptorRef *cryptorRef); static CCCryptorStatus replaced_CCCryptorCreate( - CCOperation op, - CCAlgorithm alg, - CCOptions options, - const void *key, + CCOperation op, + CCAlgorithm alg, + CCOptions options, + const void *key, size_t keyLength, - const void *iv, - CCCryptorRef *cryptorRef) + const void *iv, + CCCryptorRef *cryptorRef) { CCCryptorStatus origResult = original_CCCryptorCreate(op, alg, options, key, keyLength, iv, cryptorRef); // Only log what the application directly calls. For example we don't want to log internal SSL crypto calls if ([CallStackInspector wasDirectlyCalledByApp]) { - + CallTracer *tracer = [[CallTracer alloc] initWithClass:@"C" andMethod:@"CCCryptorCreate"]; [tracer addArgFromPlistObject:[NSNumber numberWithUnsignedInt: (unsigned int) op] withKey:@"op"]; [tracer addArgFromPlistObject:[NSNumber numberWithUnsignedInt: (unsigned int) alg] withKey:@"alg"]; @@ -75,10 +75,10 @@ static CCCryptorStatus replaced_CCCryptorCreate( // Hook CCCryptorCreateFromData() static CCCryptorStatus (*original_CCCryptorCreateFromData)( CCOperation op, - CCAlgorithm alg, + CCAlgorithm alg, CCOptions options, const void *key, - size_t keyLength, + size_t keyLength, const void *iv, const void *data, size_t dataLength, @@ -88,10 +88,10 @@ static CCCryptorStatus (*original_CCCryptorCreateFromData)( static CCCryptorStatus replaced_CCCryptorCreateFromData( CCOperation op, - CCAlgorithm alg, + CCAlgorithm alg, CCOptions options, const void *key, - size_t keyLength, + size_t keyLength, const void *iv, const void *data, size_t dataLength, @@ -102,7 +102,7 @@ static CCCryptorStatus replaced_CCCryptorCreateFromData( CCCryptorStatus origResult = original_CCCryptorCreateFromData(op, alg, options, key, keyLength, iv, data, dataLength, cryptorRef, dataUsed); if ([CallStackInspector wasDirectlyCalledByApp]) { - + CallTracer *tracer = [[CallTracer alloc] initWithClass:@"C" andMethod:@"CCCryptorCreateFromData"]; [tracer addArgFromPlistObject:[NSNumber numberWithUnsignedInt: (unsigned int) op] withKey:@"op"]; [tracer addArgFromPlistObject:[NSNumber numberWithUnsignedInt: (unsigned int) alg] withKey:@"alg"]; @@ -122,35 +122,39 @@ static CCCryptorStatus replaced_CCCryptorCreateFromData( // Hook CCCryptorUpdate() static CCCryptorStatus (*original_CCCryptorUpdate)( - CCCryptorRef cryptorRef, - const void *dataIn, - size_t dataInLength, + CCCryptorRef cryptorRef, + const void *dataIn, + size_t dataInLength, void *dataOut, - size_t dataOutAvailable, + size_t dataOutAvailable, size_t *dataOutMoved); static CCCryptorStatus replaced_CCCryptorUpdate( - CCCryptorRef cryptorRef, - const void *dataIn, - size_t dataInLength, + CCCryptorRef cryptorRef, + const void *dataIn, + size_t dataInLength, void *dataOut, - size_t dataOutAvailable, - size_t *dataOutMoved) + size_t dataOutAvailable, + size_t *dataOutMoved) { - - CCCryptorStatus origResult = original_CCCryptorUpdate(cryptorRef, dataIn, dataInLength, dataOut, dataOutAvailable, dataOutMoved); - + // dataIn and dataOut may be the same pointer (Encryption and decryption can be performed "in-place") + // Hence we first save dataIn, then call CCCryptorUpdate() and then save dataOut to get both buffers + CallTracer *tracer = [[CallTracer alloc] initWithClass:@"C" andMethod:@"CCCryptorUpdate"]; if ([CallStackInspector wasDirectlyCalledByApp]) { - - CallTracer *tracer = [[CallTracer alloc] initWithClass:@"C" andMethod:@"CCCryptorUpdate"]; [tracer addArgFromPlistObject:[NSNumber numberWithUnsignedInt: (unsigned int) cryptorRef] withKey:@"cryptorRef"]; [tracer addArgFromPlistObject:[PlistObjectConverter convertCBuffer: dataIn withLength: dataInLength] withKey:@"dataIn"]; + } + + CCCryptorStatus origResult = original_CCCryptorUpdate(cryptorRef, dataIn, dataInLength, dataOut, dataOutAvailable, dataOutMoved); + + if ([CallStackInspector wasDirectlyCalledByApp]) { [tracer addArgFromPlistObject:[PlistObjectConverter convertCBuffer: dataOut withLength: *dataOutMoved] withKey:@"dataOut"]; [tracer addReturnValueFromPlistObject: [NSNumber numberWithUnsignedInt:origResult]]; [traceStorage saveTracedCall: tracer]; - [tracer release]; - } + } + [tracer release]; + return origResult; } @@ -160,7 +164,7 @@ static CCCryptorStatus (*original_CCCryptorFinal)( CCCryptorRef cryptorRef, void *dataOut, size_t dataOutAvailable, - size_t *dataOutMoved); + size_t *dataOutMoved); static CCCryptorStatus replaced_CCCryptorFinal( CCCryptorRef cryptorRef, @@ -171,7 +175,7 @@ static CCCryptorStatus replaced_CCCryptorFinal( CCCryptorStatus origResult = original_CCCryptorFinal(cryptorRef, dataOut, dataOutAvailable, dataOutMoved); if ([CallStackInspector wasDirectlyCalledByApp]) { - + CallTracer *tracer = [[CallTracer alloc] initWithClass:@"C" andMethod:@"CCCryptorFinal"]; [tracer addArgFromPlistObject:[NSNumber numberWithUnsignedInt: (unsigned int) cryptorRef] withKey:@"cryptorRef"]; [tracer addArgFromPlistObject:[PlistObjectConverter convertCBuffer: dataOut withLength: *dataOutMoved] withKey:@"dataOut"]; @@ -180,60 +184,62 @@ static CCCryptorStatus replaced_CCCryptorFinal( [traceStorage saveTracedCall: tracer]; [tracer release]; } - return origResult; + return origResult; } // Hook CCCrypt() static CCCryptorStatus (*original_CCCrypt)( - CCOperation op, - CCAlgorithm alg, - CCOptions options, - const void *key, + CCOperation op, + CCAlgorithm alg, + CCOptions options, + const void *key, size_t keyLength, - const void *iv, - const void *dataIn, - size_t dataInLength, - void *dataOut, + const void *iv, + const void *dataIn, + size_t dataInLength, + void *dataOut, size_t dataOutAvailable, size_t *dataOutMoved); static CCCryptorStatus replaced_CCCrypt( - CCOperation op, - CCAlgorithm alg, - CCOptions options, - const void *key, + CCOperation op, + CCAlgorithm alg, + CCOptions options, + const void *key, size_t keyLength, - const void *iv, - const void *dataIn, - size_t dataInLength, - void *dataOut, + const void *iv, + const void *dataIn, + size_t dataInLength, + void *dataOut, size_t dataOutAvailable, size_t *dataOutMoved) { - - CCCryptorStatus origResult = original_CCCrypt(op, alg, options, key, keyLength, iv, dataIn, - dataInLength, dataOut, dataOutAvailable, dataOutMoved); + CallTracer *tracer = [[CallTracer alloc] initWithClass:@"C" andMethod:@"CCCrypt"]; if ([CallStackInspector wasDirectlyCalledByApp]) { - - CallTracer *tracer = [[CallTracer alloc] initWithClass:@"C" andMethod:@"CCCrypt"]; [tracer addArgFromPlistObject:[NSNumber numberWithUnsignedInt: (unsigned int) op] withKey:@"op"]; [tracer addArgFromPlistObject:[NSNumber numberWithUnsignedInt: (unsigned int) alg] withKey:@"alg"]; [tracer addArgFromPlistObject:[NSNumber numberWithUnsignedInt: (unsigned int) options] withKey:@"options"]; [tracer addArgFromPlistObject:[PlistObjectConverter convertCBuffer: key withLength: keyLength] withKey:@"key"]; [tracer addArgFromPlistObject:[PlistObjectConverter convertCBuffer: iv withLength: getIVLength(alg)] withKey:@"iv"]; [tracer addArgFromPlistObject:[PlistObjectConverter convertCBuffer: dataIn withLength: dataInLength] withKey:@"dataIn"]; + } + + CCCryptorStatus origResult = original_CCCrypt(op, alg, options, key, keyLength, iv, dataIn, + dataInLength, dataOut, dataOutAvailable, dataOutMoved); + + if ([CallStackInspector wasDirectlyCalledByApp]) { [tracer addArgFromPlistObject:[PlistObjectConverter convertCBuffer: dataOut withLength: *dataOutMoved] withKey:@"dataOut"]; [tracer addArgFromPlistObject:[NSNumber numberWithUnsignedInt: (unsigned int) dataOutAvailable] withKey:@"dataOutAvailable"]; [tracer addReturnValueFromPlistObject: [NSNumber numberWithUnsignedInt:origResult]]; [traceStorage saveTracedCall: tracer]; - [tracer release]; } + [tracer release]; return origResult; } -@implementation CommonCryptorHooks +@implementation CommonCryptorHooks + (void)enableHooks { MSHookFunction((void *) CCCryptorCreate, (void *) replaced_CCCryptorCreate, (void **) &original_CCCryptorCreate);