{"id":9781,"date":"2019-12-27T01:46:09","date_gmt":"2019-12-27T01:46:09","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=9781"},"modified":"2026-04-17T18:07:50","modified_gmt":"2026-04-17T18:07:50","slug":"communication-data-decryption-based-frida","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/communication-data-decryption-based-frida\/","title":{"rendered":"Communication Data Decryption Based on Frida"},"content":{"rendered":"


\n<\/p>\n

After completing the audit work, I discovered many out-of-bounds vulnerabilities and our vulnerability verification shows that the vulnerable program has no lack of data encryption. Initially, I handle it in the usual way: figure out the entire encryption process and write a Burp plug-in or mitm proxy script for data encryption and decryption.<\/p>\n

However, after a whole day’s analysis of the encryption algorithm, I found that it wasn’t as easy as I had thought.\n<\/p>\n

    \n
  1. \n

    Background<\/strong><\/h2>\n<\/li>\n<\/ol>\n

    At the beginning of this year, the author received a bank code audit project, which included part of Android and iOS client code (excluding the encapsulation package) of three systems developed by a Beijing vendor and Erlang code of the background system. Erlang, as the intermediate platform to communicate with the core system of the bank, acts as the role of data forwarding. After completing the audit work, I discovered many out-of-bounds vulnerabilities and our vulnerability verification shows that the vulnerable program has no lack of data encryption. Initially, I handle it in the usual way: figure out the entire encryption process and write a Burp plug-in or mitm proxy script for data encryption and decryption.<\/p>\n

    However, after a whole day’s analysis of the encryption algorithm, I found that it wasn’t as easy as I had thought.<\/p>\n

    (1) The encryption algorithm itself, namely AES_CBC_128, is not complicated, but the algorithm to generate the key and IV is very sophisticated.<\/p>\n

    (2) The key and IV value are updated about every 10 minutes, and RSA is used for encryption during the update process.<\/p>\n

    (3) The encryption logic is encapsulated in the third-party library, with code obfuscated. This secures the complicated algorithm logic, making it difficult to crack it.<\/p>\n

    (4) Don’t spend too much time analyzing and reproducing the logic and writing plug-ins. Instead, I treat like this: handling data in plaintext before encryption and decryption and displaying data after decryption.<\/p>\n

      \n
    1. \n

      LUA & Data Sending<\/strong><\/h2>\n<\/li>\n<\/ol>\n

      Generally, Android-supported executables include ARM programs, third-party libraries, and files in the DEX format. However, APK programs have a large number of Lua script files for interaction, they cannot be interpreted by the Android system and can only be interpreted by the third-party library used by the current program.<\/p>\n

      From the libluajava.so file, we can use IDA Pro to locate the following function<\/p>\n

      GetMethodId(env, claz, “postAsynâ€, “(Lcom\/xxxxxx\/emp\/lua\/java\/CLEntity;Ljava\/lang\/String;Ljava\/lang\/String;III)Vâ€)<\/p>\n

      \"Red<\/a><\/p>\n

      Figure 1 Locate the Function<\/p>\n

      Conducting a global search in jeb, we can easily locate Java function.<\/p>\n

      \"Red<\/a><\/p>\n

      Figure 2 Locating the Java Function<\/p>\n

      EW is a task, and doRun is the key point.<\/p>\n

      \"Red<\/a><\/p>\n

      Figure 3 Key point for program running<\/p>\n

      The post method in NetRequest invoked the sendPostRequest method, as shown in the following figure:<\/p>\n

      \"Red<\/a><\/p>\n

      Figure 4 Calling SendPostRequest<\/p>\n

      Since CryptoHttpManager inherits HttpManager, it includes the sendPostRequest method.<\/p>\n

      \"Red<\/a><\/p>\n

      Figure 5 HttpManager<\/p>\n

      \"Red<\/a><\/p>\n

      Figure 6 SendPostRequest<\/p>\n

      This.a first calls CryptoHttpManager which calls the a method of HttpManager to decrypts the returned content by AES, That is to say, the returned content is likely encrypted using the AES encryption algorithm.<\/p>\n

      \"Red<\/a><\/p>\n

      Figure 7 AES decryption<\/p>\n

      First invoke the parent class, encrypt data with the method in the child class and perform the Post action. After getting a response, use the “a” method of the subclass to decrypt it.<\/p>\n

      \"Red<\/a><\/p>\n

      Figure 8 Encryption and decryption process<\/p>\n

        \n
      1. \n

        Hooking and Modification<\/strong><\/h2>\n<\/li>\n<\/ol>\n

        Hook the “a” method (method to start requesting) of CryptoHttpManager and the decryption method (byte [], byte [], byte []) of AESAdapter (decryption method).<\/p>\n\n\n\n
        1<\/p>\n

        2<\/p>\n

        3<\/p>\n

        4<\/p>\n

        5<\/p>\n

        6<\/td>\n

        		      var cryptoHttpMgr = Java.use(“com.xxxxxx.emp.net.CryptoHttpManager”);<\/p>\n

        var request_method = cryptoHttpMgr.a.overload(‘java.lang.String’,’java.lang.Object’,’java.lang.String’,’java.lang.String’,’java.lang.String’,’java.util.Map’,’com.xxxxxx.emp.render.EMPThreadPool$Task’);<\/p>\n

        var aesAdaptor = Java.use(“com.xxxxxx.emp.security.adapter.AESAdapter”);<\/p>\n

        var decryptByte = aesAdaptor.decrypt.overload(‘[B’, ‘[B’, ‘[B’);<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        To print data, we need to use JavaScript to send data out:<\/p>\n\n\n\n
        1<\/p>\n

        2<\/p>\n

        3<\/p>\n

        4<\/p>\n

        5<\/p>\n

        6<\/p>\n

        7<\/p>\n

        8<\/p>\n

        9<\/p>\n

        10<\/p>\n

        11<\/p>\n

        12<\/p>\n

        13<\/p>\n

        14<\/p>\n

        15<\/p>\n

        16<\/p>\n

        17<\/p>\n

        18<\/p>\n

        19<\/p>\n

        20<\/p>\n

        21<\/p>\n

        22<\/p>\n

        23<\/td>\n

        		request_method.implementation = function(url, param, rsq_method, contenttype,<\/p>\n

        accept, headermap, task){<\/p>\n

        send(“[+] Requesting …. “);<\/p>\n

         <\/p>\n

        send(“- Req Method: ” + rsq_method);<\/p>\n

        send(“- Req URL: ” + url);<\/p>\n

        send(“- Req Params: ” + param.toString());<\/p>\n

         <\/p>\n

        return request_method.call(this, url, param, rsq_method, contenttype, accept, headermap, task);<\/p>\n

        };<\/p>\n

         <\/p>\n

        decryptByte.implementation = function(content, key, iv){<\/p>\n

        send(“[+] Decrypting …. “);<\/p>\n

         <\/p>\n

        send(“- AES key:\\\\n” + hexdump(b2s(key)));<\/p>\n

        send(“- AES IV:\\\\n” + hexdump(b2s(iv)));<\/p>\n

         <\/p>\n

        var result = decryptByte.call(this, content, key, iv);<\/p>\n

         <\/p>\n

        send(“- out:\\\\n” + hexdump(b2s(result)));<\/p>\n

         <\/p>\n

        return result;<\/p>\n

        };<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Frida receives and prints the data sent by the “send” function:<\/p>\n\n\n\n
        1<\/p>\n

        2<\/p>\n

        3<\/td>\n

        		def on_message(message, data):<\/p>\n

        if message[‘type’] == ‘send’:<\/p>\n

        print message[‘payload’]<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Format the output:<\/p>\n\n\n\n
        1<\/p>\n

        2<\/p>\n

        3<\/p>\n

        4<\/p>\n

        5<\/p>\n

        6<\/p>\n

        7<\/p>\n

        8<\/p>\n

        9<\/p>\n

        10<\/p>\n

        11<\/p>\n

        12<\/p>\n

        13<\/p>\n

        14<\/p>\n

        15<\/p>\n

        16<\/p>\n

        17<\/p>\n

        18<\/p>\n

        19<\/p>\n

        20<\/p>\n

        21<\/p>\n

        22<\/p>\n

        23<\/p>\n

        24<\/p>\n

        25<\/p>\n

        26<\/p>\n

        27<\/p>\n

        28<\/p>\n

        29<\/p>\n

        30<\/p>\n

        31<\/td>\n

        		function hexdump(buffer, blockSize) {<\/p>\n

        blockSize = blockSize || 16;<\/p>\n

        var lines = [];<\/p>\n

        var hex = “0123456789ABCDEF”;<\/p>\n

        for (var b = 0; b < buffer.length; b += blockSize) {<\/p>\n

        var block = buffer.slice(b, Math.min(b + blockSize, buffer.length));<\/p>\n

        var addr = (“0000″ + b.toString(16)).slice(-4);<\/p>\n

        var codes = block.split(”).map(function(ch) {<\/p>\n

        var code = ch.charCodeAt(0);<\/p>\n

        return ” ” + hex[(0xF0 & code) >> 4] + hex[0x0F & code];<\/p>\n

        }).join(“”);<\/p>\n

        codes += “   “.repeat(blockSize – block.length);<\/p>\n

        var chars = block.replace(\/[^\\x20-\\x7E]\/g, ‘.’); \/\/ nonprinting characters<\/p>\n

        if (chars.charAt(chars.length – 1) == ‘\\\\’){            chars += ‘\\\\’;<\/p>\n

        }<\/p>\n

        chars += ” “.repeat(blockSize – block.length);<\/p>\n

        lines.push(addr + ” ” + codes + “  ” + chars);<\/p>\n

        }<\/p>\n

        return lines.join(“\\\\n”);<\/p>\n

        }<\/p>\n

        function b2s(array) {<\/p>\n

        var result = “”;<\/p>\n

        for (var i = 0; i < array.length; i++) {<\/p>\n

        result += String.fromCharCode(modulus(array[i], 256));<\/p>\n

        }<\/p>\n

        return result;<\/p>\n

        }<\/p>\n

        function modulus(x, n) {<\/p>\n

        return ((x % n) + n) % n;<\/p>\n

        }<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        The final output is shown in Figure 9.<\/p>\n

        \"Red<\/a><\/p>\n

        Figure 9 Logs to be printed<\/p>\n

        Burpsuite is needed if we wants to tamper with data packets. We can do it like the following:<\/p>\n

        \"Red<\/a><\/p>\n

        Figure 10 Packet tampering process<\/p>\n

        However, we cannot send the tampered packet to a real server, but just need a simple server requesting data return.<\/p>\n\n\n\n
        1<\/p>\n

        2<\/p>\n

        3<\/p>\n

        4<\/p>\n

        5<\/p>\n

        6<\/p>\n

        7<\/p>\n

        8<\/p>\n

        9<\/p>\n

        10<\/p>\n

        11<\/p>\n

        12<\/p>\n

        13<\/p>\n

        14<\/p>\n

        15<\/p>\n

        16<\/p>\n

        17<\/p>\n

        18<\/p>\n

        19<\/p>\n

        20<\/p>\n

        21<\/p>\n

        22<\/p>\n

        23<\/p>\n

        24<\/p>\n

        25<\/p>\n

        26<\/p>\n

        27<\/td>\n

        		from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler<\/p>\n

        from optparse import OptionParser<\/p>\n

         <\/p>\n

        ECHO_PORT = 2205<\/p>\n

         <\/p>\n

        class RequestHandler(BaseHTTPRequestHandler):<\/p>\n

         <\/p>\n

        def do_POST(self):<\/p>\n

        request_path = self.path<\/p>\n

         <\/p>\n

        request_headers = self.headers<\/p>\n

        content_length = request_headers.getheaders(‘content-length’)<\/p>\n

        length = int(content_length[0]) if content_length else 0<\/p>\n

         <\/p>\n

        self.send_response(200)<\/p>\n

        self.end_headers()<\/p>\n

         <\/p>\n

        self.wfile.write(self.rfile.read(length))<\/p>\n

         <\/p>\n

        def main():<\/p>\n

        print(‘Listening on localhost:%d’ % ECHO_PORT)<\/p>\n

        server = HTTPServer((”, ECHO_PORT), RequestHandler)<\/p>\n

        server.serve_forever()<\/p>\n

         <\/p>\n

        if __name__ == “__main__”:<\/p>\n

        print(“[x] Starting echo server on port %d” % ECHO_PORT)<\/p>\n

        main()<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        If the data can be printed out, the data has reached the Python layer and can be sent by the requests library.<\/p>\n

        As for the received data, the server only processes the specific data contents, instead of other requests. Thus, we can set the following restrictions on requests:<\/p>\n

          \n
        • Request feature – id=<\/li>\n
        • Request length – must be greater than 14<\/li>\n
        • Transmission flag – Req Params<\/li>\n<\/ul>\n

          Then use “post” in the framework to return content:<\/p>\n\n\n\n
          1<\/p>\n

          2<\/p>\n

          3<\/p>\n

          4<\/p>\n

          5<\/p>\n

          6<\/p>\n

          7<\/p>\n

          8<\/p>\n

          9<\/p>\n

          10<\/p>\n

          11<\/td>\n

          		def on_message(message, data):<\/p>\n

          if message[‘type’] == ‘send’:<\/p>\n

          print(message[‘payload’])<\/p>\n

          payload = ”<\/p>\n

          if len(message[‘payload’]) > 14 and ‘id=’ in message[‘payload’] and ‘Req Params’ in message[‘payload’]:<\/p>\n

          payload = message[‘payload’][14:]<\/p>\n

          r = requests.post(“http:\/\/” + BURP_HOST + “:” + str(BURP_PORT), data = payload, proxies = proxies);<\/p>\n

          if r.status_code == 200:<\/p>\n

          script.post({“type”: “modify”, “payload”: r.text})<\/p>\n

          else:<\/p>\n

          print(message)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          At the same time, obtain the returned data synchronously (not asynchronously):<\/p>\n\n\n\n
          1<\/p>\n

          2<\/p>\n

          3<\/p>\n

          4<\/p>\n

          5<\/td>\n

          		       var op = recv(‘modify’, function onMessage(modMessage) {<\/p>\n

          send(“- Fix Params: ” + modMessage[‘payload’]);<\/p>\n

          param = modMessage[‘payload’];<\/p>\n

          });<\/p>\n

          op.wait();<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          The decrypted content is also tampered in the same way, namely changing the value before returning data.<\/p>\n

            \n
          1. \n

            Repeating<\/strong><\/h2>\n<\/li>\n<\/ol>\n

            In most cases, packet replay is also needed. Fortunately, the key can be used more than once. The user can easily realize data packet repeating by using tag:<\/p>\n

            (1) Send a Burp request.<\/p>\n

            (2) Wait for a response.<\/p>\n

              \n
            • If the response contains ASD (just a meaningless example), go to (3).<\/li>\n
            • If the response does not contain ASD, then break the loop and call the program method (one more call for breaking the loop).<\/li>\n<\/ul>\n

              (3) Remove the ASD tag.<\/p>\n

              (4) Call the program method.<\/p>\n

              (5) Add the asd tag and then back to (1).<\/p>\n\n\n\n
              1<\/p>\n

              2<\/p>\n

              3<\/p>\n

              4<\/p>\n

              5<\/p>\n

              6<\/p>\n

              7<\/p>\n

              8<\/p>\n

              9<\/p>\n

              10<\/p>\n

              11<\/p>\n

              12<\/p>\n

              13<\/p>\n

              14<\/p>\n

              15<\/td>\n

              		while(1){<\/p>\n

              send(“[*] Repeating …. “);<\/p>\n

              send(“- Req params: ” + param); \/\/ 1<\/p>\n

              var op = recv(‘mod_req’, function onMessage(modMessage) { \/\/2<\/p>\n

              send(“- Fix Params: ” + modMessage[‘payload’]);<\/p>\n

              param = modMessage[‘payload’];<\/p>\n

              });<\/p>\n

              op.wait();<\/p>\n

               <\/p>\n

              if (param.indexOf(‘asd’) < 0) break; \/\/ 2.2<\/p>\n

              \/\/2.1<\/p>\n

              param = param.replace(\/asd\/,””); \/\/ 3<\/p>\n

              request_method.call(this, url, param, rsq_method, contenttype, accept, headermap, task); \/\/ 4<\/p>\n

              param = param + ‘asd’; \/\/ 5<\/p>\n

              }<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

              The information processing code in python is as follows:<\/p>\n\n\n\n
              1<\/p>\n

              2<\/p>\n

              3<\/p>\n

              4<\/p>\n

              5<\/p>\n

              6<\/p>\n

              7<\/p>\n

              8<\/p>\n

              9<\/p>\n

              10<\/p>\n

              11<\/p>\n

              12<\/p>\n

              13<\/p>\n

              14<\/td>\n

              		def on_message(message, data):<\/p>\n

              global theflag<\/p>\n

              global vericode<\/p>\n

              if message[‘type’] == ‘send’:<\/p>\n

              print(message[‘payload’].decode(‘utf-8’))<\/p>\n

              payload = ”<\/p>\n

              typestr = ‘mod_req’<\/p>\n

              if len(message[‘payload’]) > 14 and ‘Req params:’ in message[‘payload’] and ‘id=’ in message[‘payload’]:<\/p>\n

              payload = message[‘payload’][14:]<\/p>\n

              r = requests.post(“http:\/\/” + BURP_HOST + “:” + str(BURP_PORT), data = payload, proxies = proxies);<\/p>\n

              if r.status_code == 200:<\/p>\n

              script.post({“type”: typestr, “payload”: r.text})<\/p>\n

              else:<\/p>\n

              print(message)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

              This is also another approach. It should be noted that the returned data is only one of parameters in the function and other parameters needs to be initialized or global variables needs to be set in this function.<\/p>\n

              (1) Use SimpleHTTPServer to monitor a port that is used to receive requests from Burp.<\/p>\n

              (2) Use asynchronous messaging to receive messages that are posted (data obtained from the listening port).<\/p>\n

              (3) Call functions after receiving data.<\/p>\n

                \n
              1. \n

                Verification<\/strong><\/h2>\n<\/li>\n<\/ol>\n

                Start the server and Burpsuite and run the program. The plaintext data will be modified when it arrives at Burpsuite. After reaching the program, the data will be replaced before being encrypted. In the wake of that, different results will be shown on the interface.<\/p>\n

                  \n
                1. \n

                  Summary<\/strong><\/h2>\n<\/li>\n<\/ol>\n

                  After the plaintext data is modified before hook-based encryption, the program be used for tests on Android and iOS systems of some banks, as well as tests on PCs.<\/p>\n

                  In general, the advantage of this approach is that there is no need to care about whether the certificate supports one-way or two-way authentication, whether the modification times out, or whether data irrelevant with business is generated or not.<\/p>\n

                  The encoding issue is a defect of this approach, which is difficult to solve. Due to a large number of Chinese characters exists in the returned packet, the packet, once being modified, cannot be used. Furthermore, the tool runs so slowly that it will be struck once too much data is processed or in the case of key exchange.<\/body><\/html><\/p>\n","protected":false},"excerpt":{"rendered":"

                  After completing the audit work, I discovered many out-of-bounds vulnerabilities and our vulnerability verification shows that the vulnerable program has no lack of data encryption. Initially, I handle it in the usual way: figure out the entire encryption process and write a Burp plug-in or mitm proxy script for data encryption and decryption.<\/p>\n","protected":false},"author":1,"featured_media":9738,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":""},"categories":[5],"tags":[143],"class_list":["post-9781","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ddos-mitigation","tag-communication-data-decryption"],"acf":[],"yoast_head":"\nCommunication Data Decryption Based on Frida - NSFOCUS<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Communication Data Decryption Based on Frida - NSFOCUS\" \/>\n<meta property=\"og:description\" content=\"After completing the audit work, I discovered many out-of-bounds vulnerabilities and our vulnerability verification shows that the vulnerable program has\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/\" \/>\n<meta property=\"og:site_name\" content=\"NSFOCUS\" \/>\n<meta property=\"article:published_time\" content=\"2019-12-27T01:46:09+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-17T18:07:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2019\/12\/1209-9.jpg\" \/>\n<meta name=\"author\" content=\"NSFOCUS\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Communication Data Decryption Based on Frida - NSFOCUS\" \/>\n<meta name=\"twitter:description\" content=\"After completing the audit work, I discovered many out-of-bounds vulnerabilities and our vulnerability verification shows that the vulnerable program has\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2019\/12\/1209-9.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"NSFOCUS\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/communication-data-decryption-based-frida\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/communication-data-decryption-based-frida\\\/\"},\"author\":{\"name\":\"NSFOCUS\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\"},\"headline\":\"Communication Data Decryption Based on Frida\",\"datePublished\":\"2019-12-27T01:46:09+00:00\",\"dateModified\":\"2026-04-17T18:07:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/communication-data-decryption-based-frida\\\/\"},\"wordCount\":1747,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/communication-data-decryption-based-frida\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2019\\\/12\\\/1209-9.jpg\",\"keywords\":[\"Communication Data Decryption\"],\"articleSection\":[\"DDoS Mitigation\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/communication-data-decryption-based-frida\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/communication-data-decryption-based-frida\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/communication-data-decryption-based-frida\\\/\",\"name\":\"Communication Data Decryption Based on Frida - NSFOCUS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/communication-data-decryption-based-frida\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/communication-data-decryption-based-frida\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2019\\\/12\\\/1209-9.jpg\",\"datePublished\":\"2019-12-27T01:46:09+00:00\",\"dateModified\":\"2026-04-17T18:07:50+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/communication-data-decryption-based-frida\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/communication-data-decryption-based-frida\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/communication-data-decryption-based-frida\\\/#primaryimage\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2019\\\/12\\\/1209-9.jpg\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2019\\\/12\\\/1209-9.jpg\",\"width\":515,\"height\":219,\"caption\":\"Cityscape with digital padlock and circuit design.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/communication-data-decryption-based-frida\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nsfocusglobal.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Communication Data Decryption Based on Frida\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"name\":\"NSFOCUS\",\"description\":\"Security Made Smart and Simple\",\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nsfocusglobal.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\",\"name\":\"NSFOCUS\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"width\":248,\"height\":36,\"caption\":\"NSFOCUS\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\",\"name\":\"NSFOCUS\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"caption\":\"NSFOCUS\"},\"sameAs\":[\"https:\\\/\\\/nsfocusglobal.com\"],\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Communication Data Decryption Based on Frida - NSFOCUS","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/","og_locale":"pt_BR","og_type":"article","og_title":"Communication Data Decryption Based on Frida - NSFOCUS","og_description":"After completing the audit work, I discovered many out-of-bounds vulnerabilities and our vulnerability verification shows that the vulnerable program has","og_url":"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/","og_site_name":"NSFOCUS","article_published_time":"2019-12-27T01:46:09+00:00","article_modified_time":"2026-04-17T18:07:50+00:00","og_image":[{"url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2019\/12\/1209-9.jpg","type":"","width":"","height":""}],"author":"NSFOCUS","twitter_card":"summary_large_image","twitter_title":"Communication Data Decryption Based on Frida - NSFOCUS","twitter_description":"After completing the audit work, I discovered many out-of-bounds vulnerabilities and our vulnerability verification shows that the vulnerable program has","twitter_image":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2019\/12\/1209-9.jpg","twitter_misc":{"Escrito por":"NSFOCUS","Est. tempo de leitura":"9 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/#article","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/"},"author":{"name":"NSFOCUS","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d"},"headline":"Communication Data Decryption Based on Frida","datePublished":"2019-12-27T01:46:09+00:00","dateModified":"2026-04-17T18:07:50+00:00","mainEntityOfPage":{"@id":"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/"},"wordCount":1747,"commentCount":0,"publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"image":{"@id":"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2019\/12\/1209-9.jpg","keywords":["Communication Data Decryption"],"articleSection":["DDoS Mitigation"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/","url":"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/","name":"Communication Data Decryption Based on Frida - NSFOCUS","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/#primaryimage"},"image":{"@id":"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2019\/12\/1209-9.jpg","datePublished":"2019-12-27T01:46:09+00:00","dateModified":"2026-04-17T18:07:50+00:00","breadcrumb":{"@id":"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/#primaryimage","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2019\/12\/1209-9.jpg","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2019\/12\/1209-9.jpg","width":515,"height":219,"caption":"Cityscape with digital padlock and circuit design."},{"@type":"BreadcrumbList","@id":"https:\/\/nsfocusglobal.com\/communication-data-decryption-based-frida\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nsfocusglobal.com\/"},{"@type":"ListItem","position":2,"name":"Communication Data Decryption Based on Frida"}]},{"@type":"WebSite","@id":"https:\/\/nsfocusglobal.com\/#website","url":"https:\/\/nsfocusglobal.com\/","name":"NSFOCUS","description":"Security Made Smart and Simple","publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nsfocusglobal.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/nsfocusglobal.com\/#organization","name":"NSFOCUS","url":"https:\/\/nsfocusglobal.com\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","width":248,"height":36,"caption":"NSFOCUS"},"image":{"@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d","name":"NSFOCUS","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","caption":"NSFOCUS"},"sameAs":["https:\/\/nsfocusglobal.com"],"url":"https:\/\/nsfocusglobal.com\/pt-br\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/9781","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/comments?post=9781"}],"version-history":[{"count":0,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/9781\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media\/9738"}],"wp:attachment":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media?parent=9781"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/categories?post=9781"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/tags?post=9781"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}