首页课程文章
无痕注入APC注入线程注入读写驱动注入技术句柄表进程线程系统调用保护模式内存管理远程CALL软件调试驱动封装云下发驱动开发FPS数据方框透视FPS方框FPS自瞄CED3DHOOKD3D绘制Imgui绘制DWM
内核课程驱动出租学习路线聊天室免责声明提问技巧

浅浅记录下学习Protubuf历程，最终实现App与本地Python服务器交互

推荐 原创

周杰伦

文章分类编程技术阅读数 : 599阅读时长 : 9分钟

第一次写文章,难免会有差错,文章若有不妥之处,还请大家不吝赐教~

希望这篇文章对你有帮助,可以减轻入门protobuf的一些负担~

目标:

  1. 搭建window & Nexus6P(Kali NetHunter) 运行gRPC环境 ps:Nexus6P环境的搭建可有可无~
  2. 使用Python gRPC 实现: 客户端<-->服务端的protobuf的通信
  3. PC上 client.py 移植到Nexus6P (Kali NetHunter) 上 实现 android 与服务端(PC)交互 (ps:啥Android啊 那就是Linux.... 可有可无)
  4. r0env2022 搭建 Android app 运行服务端环境 & 编译apk.... 案例Dem0可直接在r0env2022下编译运行,只需要提取出.proto文件 生成服务端代码就可直接使用~真的是太爽了,节省了时间
  5. 拦截AndroidDem0 <--> PC 上 Python实现的服务端的通信 &反序列化

与宿主机隔离开发环境

  1. 使用 virtualenv 创建一个船新的Python310 的环境 virtualenv Python310_LearningProtobuf
    • 先执行pip3 install virtualenv -i https://pypi.douban.com/simple 再执行 pip3 install virtualenvwrapper-win -i https://pypi.douban.com/simple
    • 创建Python虚拟环境存放目录, D:\Interpreter installation Directory\virtualenv 并加入系统环境PATH中
    • 创建虚拟环境 mkvirtualenv Py310protobuf 并进入虚拟环境中...
  2. 虚拟环境安装 protobuf grpcio grpcio-tools ​ pip3 install protobuf grpcio grpcio-tools -i https://pypi.douban.com/simple ​
    • 查看虚拟环境中第三方库及版本

什么是grpc & Protobuf？

  • gRPC是一种高性能、开源的远程过程调用（Remote Procedure Call，简称RPC）框架。它由Google开发并开源，旨在解决分布式系统中不同服务之间的通信问题。gRPC基于HTTP/2协议进行通信，并使用Protocol Buffers（简称Protobuf）作为默认的数据序列化和传输格式。
  • Protocol Buffers（protobuf）是一种轻量级、高效的数据序列化机制，也是Google开源的项目。它能够将结构化的数据序列化为二进制格式，以便在不同的系统之间进行数据交换。相比于JSON或XML等常见的文本格式，Protobuf产生的数据体积更小，序列化和反序列化速度更快。
  • gRPC使用Protobuf作为默认的消息传递格式，通过定义接口和消息类型来描述服务和数据格式，然后自动生成客户端和服务器端的代码。这样可以方便地进行跨语言的服务通信，提供了强大的代码生成能力和易于扩展的特性。gRPC支持多种编程语言，包括C++、Java、Python、Go、Ruby等。
  • 总而言之，gRPC是一个基于HTTP/2和Protobuf的高性能RPC框架，它提供了简单、可靠的通信方式，使得分布式系统中的不同服务之间能够高效地进行数据交互。

Python gRPC Protobuf正向开发 实现PC Client <-->Server 交互

  1. 创建 example.proto 文件 来编写对应规则,创建了一个服务 以及两个数据格式

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    syntax = "proto3" ;
     
    package test;
     
    service HelloDemo {
         rpc Hello(HelloReq) returns(HelloReply){}
    }
     
    message HelloReq{
         string name = 1 ;
         int32 age = 2 ;
         string sendtime = 3 ;
    }
     
    message HelloReply{
         string result = 1 ;
    }

  2. 利用 example.proto 通过 grpcio_tools protoc 来生成Python 客户端和服务端(grpc-server)文件 为踩坑记录

    • python -m grpcio_tools -I. --python_out=. --grpc_python_out=. example.proto 失败 ,原因-> 猜测应该使用./ 来 表示当前目录~
    • 换一种方式,使用文档中提供的方式 下载之后加入到PATH中
    • protoc -I=. --python_out=. --grpc_python_out=. example.proto 对example进行编译 并生成 python客户端和服务端grpc代码
    • but 又又又又报错了 原因不可知也
    • 最后,执行 python -m grpc_tools.protoc -I./ --python_out=./ --grpc_python_out=./ example.proto 生成了两份代码

  3. 根据生成的example_pb2_grpc.py编写 service.py

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    # coding:utf-8
     
    import grpc
    import example_pb2 as pb2
    import example_pb2_grpc as pb2_grpc
    from concurrent import futures    # 目的为了给服务器增加线程
     
    # HelloDemo 为 .proto 文件中 service
    class HelloDemo(pb2_grpc.HelloDemoServicer):
         # Hello 为  .proto 文件中 service 包含 rpc 方法名
         def Hello( self , request, context):
             name, age, sendtime = request.name, request.age, sendtime
             result = f "My Name is {name},age is {age} years old!\n now time is {sendtime}"
             # 返回数据类型为.proto 文件中 message   HelloReply
             return pb2.HelloReply(result = result)
     
     
    def run():
         grpc_server = grpc.server(
             futures.ThreadPoolExecutor(max_workers = 4 ),
         )
         pb2_grpc.add_HelloDemoServicer_to_server(HelloDemo(),grpc_server)
         # PC 上 监听 127.0.0.1 局域网连接 监听 0.0.0.0
         ip_port = "127.0.0.1:5505"
         grpc_server.add_insecure_port(ip_port)
         grpc_server.start()
         print (f "service start at {ip_port}" )
         grpc_server.wait_for_termination()
     
    if __name__ = = "__main__" :
         run()

  4. 根据生成的example_pb2.py 编写client.py

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    # coding:utf-8
     
    import grpc
    import example_pb2 as pb2
    import example_pb2_grpc as pb2_grpc
    from concurrent import futures
     
    def run():
         # 构建通道与服务器连接
         conn = grpc.insecure_channel( "127.0.0.1:5505" )
         # HelloDemoStub表示客户端  ,HelloDemoStub是 protoc 自动生成的
         client = pb2_grpc.HelloDemoStub(channel = conn)
         name, age, sendtime = "xiaozhu0513" , 18 , datetime.now().strftime( '%Y-%m-%d-%H:%M:%S' )
         # 相当于先生成一个 HelloReq 类型的数据  为 本地发送到客户端的数据, 然后传输  实例化客户端的
         response = client.Hello(pb2.HelloReq(
             name = name,
             age = age,
             sendtime = f "{sendtime}"
         ))
         print (f "客户端发送 {name} {age} {sendtime} -> 服务器" )
         print ( "客户端接收到服务器返回信息 " ,response.result)
     
     
    if __name__ = = "__main__" :
         run()

  5. 先运行service.py 再运行 client.py 效果图如下

  6. 至此,完成了第一个小任务,最后查阅资料时,发现官方提供了Demo 以及教程....

常用的protobuf数据类型&特殊字符&pb文件&

常用的protobuf数据类型

  1. string -> 字符串类型，要求utf-8或7-bit 与 ascii编码的字符串
  2. bytes -> 比特类型
  3. bool -> 布尔类型
  4. int32 ->32位整形 对应Py是int
  5. int64 ->64位整形 对应Py是int
  6. float -> 浮点类型
  7. repeated -> 数组 (list) 如 repeated string data = 1; 表示 一个 string 的list
  8. map -> 字典类型(Python) 如map <string , string> data = 1; 前者为key的string类型 后者为string类型的value

常用的protobuf特殊字符

  1. package -> 包名
  2. syntax -> Protobuf语法版本
  3. service -> 定义一个服务
  4. rpc -> 定义服务中的方法
  5. stream -> 定义方法的传输为流传输
  6. message -> 定义消息体 message User{}
  7. extend -> 扩展消息体 extend User{}
  8. import -> 导入一些插件
  9. // -> 注释~

在Nexus6P KaliNetHunter 上 配置环境并启动客户端与PC上server进行通信 (可有可无....)

目标：

  1. 在6P手机上配置好Python环境,grpc环境

  2. 运行client.py 与 PC上server.py进行交互

  3. (未复现出)抓包拦截请求数据,尝试分析.... ​ 当初以为只要运行在手机上就算是android了,,,后来才反应过来,,,,我是运行在linux上py程序不是android

    • client.py 和 android app 走的系统底库不同(后续实现了App抓socket却可以抓到而client.py却不能抓到),

Nexus6P手机上配置grpc环境~

  1. Python3.10 环境下 直接安装 三件套 pip3 install protobuf grpcio grpcio-tools -i https://pypi.douban.com/simple
  2. 下载linux对应的 protoc 工具 push到手机内. 先不下载试试win生成的两份_pb2文件能否共用 ? 是的,可直接可用
  3. 将client.py 修改访问地址为局域网内PC的ip 并push到 /sdcard/protobuf 目录下

Nexus6P 与PC 通信

将服务端的监听端口由127.0.0.1 修改为 0.0.0.0,之后先启动server 再在6P手机上启动client.Py 实现交互


  • 可以发现同一局域网时可以进行通信的

此处采用中间人抓包会报错

客户端启动失败！ charles 抓的包为 Unknow 整体运行逻辑如下~

  • 不知为何原因~

Android grpc-protobuf Dem0

目标：

  1. 实现Android App 与 PC上建立的Python服务端进行通信
  2. 弄清楚普通i请求grpc 的执行流程 以及生成对应的Python服务器版本代码
  3. 最终实现效果可以使得二者可以正常通信，为抓包hook以及分析打下基础

搞清楚 android-java .proto 的运行原理

利用Demo 实现与Python 通信

只分析其中一个界面

找到demo中helloworle.proto文件 pull到PC上 并生成Python _pb2_grpc.py 代码

  • 进入对应解释器环境下 执行 python -m grpc_tools.protoc -I./ --python_out=./ --grpc_python_out=./ helloworld.proto

  • 照猫画虎 写出对应的service.py

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    from datetime import datetime
     
    import grpc
    import helloworld_pb2 as pb2
    import helloworld_pb2_grpc as pb2_grpc
    from concurrent import futures
     
    class Greeter(pb2_grpc.GreeterServicer):
         def SayHello( self , request, context):
             name = request.name
             sendtime = datetime.now().strftime( '%Y-%m-%d-%H:%M:%S' )
             result = f "My Name is {name}!!! send time is {sendtime} "
             print (f "服务器接收到客户端参数 -> name = {name}" )
             print (f "服务器响应时间: {sendtime}" )
             return pb2.HelloReply(message = result)
     
     
    def run():
         grpc_server = grpc.server(
             futures.ThreadPoolExecutor(max_workers = 4 ),
         )
         pb2_grpc.add_GreeterServicer_to_server(Greeter(),grpc_server)
         # ip_port = "127.0.0.1:50051"
         ip_port = "0.0.0.0:50051"
         grpc_server.add_insecure_port(ip_port)
         grpc_server.start()
         print (f "service start at {ip_port}" )
         grpc_server.wait_for_termination()
     
    if __name__ = = "__main__" :
         run()

  • 验证启动apk 能否正常通信

所有所有前期准备已经ok 准备使用hook抓包看能否抓到包~

objection动态分析 & Hook socket抓包

  1. objection 动态分析, 搜索 类 android hooking search classes protobuf
  • 复制系统库保存为txt文件 执行脚本加上hook
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    # 读取文件并处理
    with open ( 'my_protobuf.txt' , 'r' ,encoding = 'utf-8' ) as file :
         lines = file .readlines()
         processed_lines = []
         for line in lines:
             # 进行处理操作
             processed_line = "android hooking watch class " + line
             # 将处理后的行插入到原来的列表中
             processed_lines.append(processed_line)
     
    # 将处理后的内容按行插入到原文件中
    with open ( 'my_protobuf_new.txt' , 'w' ,encoding = 'utf-8' ) as file :
         for processed_line in processed_lines:
             file .write(processed_line)

  1. 所有的输出信息如下

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    87
    com.xuexiang.protobufdemo on (google: 8.1 . 0 ) [usb] # (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.toBuilder()
    (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.dynamicMethod(com.google.protobuf.GeneratedMessageLite$MethodToInvoke)                                                                                         
    (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.dynamicMethod(com.google.protobuf.GeneratedMessageLite$MethodToInvoke)                                                                                         
    (agent) [ 33h1vvf01vb ] Called com.google.protobuf.UnknownFieldSetLite.getDefaultInstance()
    (agent) [r44a6fapyp] Called com.google.protobuf.GeneratedMessageLite$Builder.mergeFrom(com.google.protobuf.GeneratedMessageLite)                                                                                                     
    (agent) [r44a6fapyp] Called com.google.protobuf.GeneratedMessageLite$Builder.copyOnWrite()
    (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.visit(com.google.protobuf.GeneratedMessageLite$Visitor, com.google.protobuf.GeneratedMessageLite)                                                              
    (agent) [flxqngw0jns] Called com.google.protobuf.GeneratedMessageLite$MergeFromVisitor.visitString(boolean, java.lang.String, boolean, java.lang.String)                                                                             
    (agent) [flxqngw0jns] Called com.google.protobuf.GeneratedMessageLite$MergeFromVisitor.visitUnknownFields(com.google.protobuf.UnknownFieldSetLite, com.google.protobuf.UnknownFieldSetLite)                                          
    (agent) [ 33h1vvf01vb ] Called com.google.protobuf.UnknownFieldSetLite.getDefaultInstance()
    (agent) [r44a6fapyp] Called com.google.protobuf.GeneratedMessageLite$Builder.copyOnWrite()
    (agent) [r44a6fapyp] Called com.google.protobuf.GeneratedMessageLite$Builder.build()
    (agent) [r44a6fapyp] Called com.google.protobuf.GeneratedMessageLite$Builder.buildPartial()
    (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.makeImmutable()
    (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.dynamicMethod(com.google.protobuf.GeneratedMessageLite$MethodToInvoke)                                                                                         
    (agent) [ 33h1vvf01vb ] Called com.google.protobuf.UnknownFieldSetLite.makeImmutable()
    (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.isInitialized()
    (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.dynamicMethod(com.google.protobuf.GeneratedMessageLite$MethodToInvoke, java.lang. Object )                                                                       
    (agent) [ 4fnnhkno676 ] Called io.grpc.protobuf.lite.ProtoLiteUtils$MessageMarshaller.stream(java.lang. Object )
    (agent) [ 4fnnhkno676 ] Called io.grpc.protobuf.lite.ProtoLiteUtils$MessageMarshaller.stream(com.google.protobuf.MessageLite)                                                                                                          
    (agent) [t74uyknf3ri] Called io.grpc.protobuf.lite.ProtoInputStream.available()
    (agent) [ 4gz3lfvhznc ] Called com.google.protobuf.CodedOutputStream.computeStringSize( int , java.lang.String)
    (agent) [ 4gz3lfvhznc ] Called com.google.protobuf.CodedOutputStream.computeTagSize( int )
    (agent) [ 75uwxvix9zw ] 【【【Called com.google.protobuf.WireFormat.makeTag( int , int )】】】
    (agent) [ 4gz3lfvhznc ] Called com.google.protobuf.CodedOutputStream.computeUInt32SizeNoTag( int )
    (agent) [ 4gz3lfvhznc ] Called com.google.protobuf.CodedOutputStream.computeStringSizeNoTag(java.lang.String)
    (agent) [ 78m3ko66u48 ] Called com.google.protobuf.Utf8.encodedLength(java.lang.CharSequence)
    (agent) [ 4gz3lfvhznc ] Called com.google.protobuf.CodedOutputStream.computeLengthDelimitedFieldSize( int )
    (agent) [ 4gz3lfvhznc ] Called com.google.protobuf.CodedOutputStream.computeUInt32SizeNoTag( int )
    (agent) [t74uyknf3ri] Called io.grpc.protobuf.lite.ProtoInputStream.drainTo(java.io.OutputStream)
    (agent) [pi8dc23shb] 【【【Called com.google.protobuf.AbstractMessageLite.writeTo(java.io.OutputStream)】】】
    (agent) [ 4gz3lfvhznc ] Called com.google.protobuf.CodedOutputStream.computePreferredBufferSize( int )
    (agent) [ 4gz3lfvhznc ] Called com.google.protobuf.CodedOutputStream.newInstance(java.io.OutputStream, int )
    (agent) [ 2ira22725rq ] Called com.google.protobuf.CodedOutputStream$OutputStreamEncoder.writeString( int , java.lang.String)                                                                                                            
    (agent) [ 2ira22725rq ] Called com.google.protobuf.CodedOutputStream$OutputStreamEncoder.writeTag( int , int )
    (agent) [ 75uwxvix9zw ] 【【【Called com.google.protobuf.WireFormat.makeTag( int , int )】】】
    (agent) [ 2ira22725rq ] Called com.google.protobuf.CodedOutputStream$OutputStreamEncoder.writeUInt32NoTag( int )
    (agent) [ 2ira22725rq ] Called com.google.protobuf.CodedOutputStream$OutputStreamEncoder.flushIfNotAvailable( int )
    (agent) [ 032rofd4w0eb ] Called com.google.protobuf.CodedOutputStream$AbstractBufferedEncoder.bufferUInt32NoTag( int )
    (agent) [ 4gz3lfvhznc ] Called com.google.protobuf.CodedOutputStream.access$ 100 ()
    (agent) [ 2ira22725rq ] Called com.google.protobuf.CodedOutputStream$OutputStreamEncoder.writeStringNoTag(java.lang.String)                                                                                                            
    (agent) [ 4gz3lfvhznc ] Called com.google.protobuf.CodedOutputStream.computeUInt32SizeNoTag( int )
    (agent) [ 78m3ko66u48 ] 【【【Called com.google.protobuf.Utf8.encode(java.lang.CharSequence, [B, int , int )】】】
    (agent) [yozcy0715w] Called com.google.protobuf.Utf8$SafeProcessor.encodeUtf8(java.lang.CharSequence, [B, int , int )
    (agent) [ 2ira22725rq ] Called com.google.protobuf.CodedOutputStream$OutputStreamEncoder.writeUInt32NoTag( int )
    (agent) [ 2ira22725rq ] Called com.google.protobuf.CodedOutputStream$OutputStreamEncoder.flushIfNotAvailable( int )
    (agent) [ 032rofd4w0eb ] Called com.google.protobuf.CodedOutputStream$AbstractBufferedEncoder.bufferUInt32NoTag( int )
    (agent) [ 4gz3lfvhznc ] Called com.google.protobuf.CodedOutputStream.access$ 100 ()
    (agent) [ 2ira22725rq ] Called com.google.protobuf.CodedOutputStream$OutputStreamEncoder.writeLazy([B, int , int )
    (agent) [ 2ira22725rq ] 【【【Called com.google.protobuf.CodedOutputStream$OutputStreamEncoder.write([B, int , int )】】】
    (agent) [ 2ira22725rq ] Called com.google.protobuf.CodedOutputStream$OutputStreamEncoder.flush()
    (agent) [ 2ira22725rq ] Called com.google.protobuf.CodedOutputStream$OutputStreamEncoder.doFlush()
    (agent) [ 4fnnhkno676 ] Called io.grpc.protobuf.lite.ProtoLiteUtils$MessageMarshaller.parse(java.io.InputStream)
    (agent) [ 4fnnhkno676 ] Called io.grpc.protobuf.lite.ProtoLiteUtils$MessageMarshaller.parse(java.io.InputStream)
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.newInstance([B, int , int )
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.newInstance([B, int , int , boolean)
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.pushLimit( int )
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.recomputeBufferSizeAfterLimit()
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.setSizeLimit( int )
    (agent) [ 4fnnhkno676 ] Called io.grpc.protobuf.lite.ProtoLiteUtils$MessageMarshaller.parseFrom(com.google.protobuf.CodedInputStream)                                                                                                  
    (agent) [ 6thpuwhq0js ] Called com.google.protobuf.AbstractParser.parseFrom(com.google.protobuf.CodedInputStream, com.google.protobuf.ExtensionRegistryLite)                                                                           
    (agent) [ 6thpuwhq0js ] Called com.google.protobuf.AbstractParser.parseFrom(com.google.protobuf.CodedInputStream, com.google.protobuf.ExtensionRegistryLite)                                                                           
    (agent) [b7ksjxdkr9] Called com.google.protobuf.GeneratedMessageLite$DefaultInstanceBasedParser.parsePartialFrom(com.google.protobuf.CodedInputStream, com.google.protobuf.ExtensionRegistryLite)                                    
    (agent) [b7ksjxdkr9] Called com.google.protobuf.GeneratedMessageLite$DefaultInstanceBasedParser.parsePartialFrom(com.google.protobuf.CodedInputStream, com.google.protobuf.ExtensionRegistryLite)                                    
    (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.parsePartialFrom(com.google.protobuf.GeneratedMessageLite, com.google.protobuf.CodedInputStream, com.google.protobuf.ExtensionRegistryLite)                    
    (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.dynamicMethod(com.google.protobuf.GeneratedMessageLite$MethodToInvoke)                                                                                         
    (agent) [ 33h1vvf01vb ] Called com.google.protobuf.UnknownFieldSetLite.getDefaultInstance()
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.readTag()
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.isAtEnd()
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.readRawVarint32()
    (agent) [ 75uwxvix9zw ] Called com.google.protobuf.WireFormat.getTagFieldNumber( int )
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.readStringRequireUtf8()
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.readRawVarint32()
    (agent) [ 78m3ko66u48 ] Called com.google.protobuf.Utf8.isValidUtf8([B, int , int )
    (agent) [sa0emcwxaha] Called com.google.protobuf.Utf8$Processor.isValidUtf8([B, int , int )
    (agent) [yozcy0715w] Called com.google.protobuf.Utf8$SafeProcessor.partialIsValidUtf8( int , [B, int , int )
    (agent) [yozcy0715w] Called com.google.protobuf.Utf8$SafeProcessor.partialIsValidUtf8([B, int , int )
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.readTag()
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.isAtEnd()
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.tryRefillBuffer( int )
    (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.makeImmutable()
    (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.dynamicMethod(com.google.protobuf.GeneratedMessageLite$MethodToInvoke)                                                                                         
    (agent) [ 33h1vvf01vb ] Called com.google.protobuf.UnknownFieldSetLite.makeImmutable()
    (agent) [ 6thpuwhq0js ] Called com.google.protobuf.AbstractParser.checkMessageInitialized(com.google.protobuf.MessageLite)                                                                                                             
    (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.isInitialized()
    (agent) [e48kca70yae] Called com.google.protobuf.GeneratedMessageLite.dynamicMethod(com.google.protobuf.GeneratedMessageLite$MethodToInvoke, java.lang. Object )                                                                       
    (agent) [ 34xbsz3uxgl ] Called com.google.protobuf.CodedInputStream.checkLastTagWas( int )

  2. hook com.google.protobuf.Utf8.encode(java.lang.CharSequence, [B, int, int)

  1. 使用frida hook socket 结果如下

至此全部完结~
以上就是最近几天学习内容,接下来研究研究Java具体如何实现的，争取学会还原tag来实现无proto文件反解析出数据.



更多【 浅浅记录下学习Protubuf历程，最终实现App与本地Python服务器交互】相关视频教程：www.yxfzedu.com




相关文章推荐

记录自己的技术轨迹
文章规则：
1)：文章标题请尽量与文章内容相符
2)：严禁色情、血腥、暴力
3)：严禁发布任何形式的广告贴
4)：严禁发表关于中国的政治类话题
5)：严格遵守中国互联网法律法规
6)：有侵权,疑问可发邮件至service@yxfzedu.com
近期原创 更多

Markdown Editor

友情链接
内核结构FAQ
免责声明
课程目录
Windows内核
游戏逆向(FPS)
技术交流QQ群
342478842215039827137189196
314055665159620936
www.yxfzedu.com是一个分享游戏安全,游戏外挂与反外挂,游戏驱动保护的视频网站！
接各种驱动定制如：游戏读写驱动，软件内存保护，防止调试等功能定制。
出租读写驱动，调试驱动，无痕注入支持各种游戏。
邮箱：service@yxfzedu.com
QQ：851920120
特别说明：不接游戏数据分析，外挂编写，登陆协议等类似业务。