ac-pm / inspeckage Goto Github PK

Hi, thank you for your app is fantastic.

I tried to analyze Instagram 10.1.0.
With only Serialization ON and all other settings OFF.
The app with previuos login working, return to login also with correct password.
In logcat I see record as it.
Xposed : Inspeckage_Serialization:Possible Path [] Read Object[com.instagram.common.z.c.d] HEX = XXXXXXXXXXXXXXX
With Serialization OFF and all other settings ON, the app start with previuos login working, inspect is working, but also if I have SSL uncheck ON I got always an error unknow_ca on proxy for catch HTTPS traffic.
In logcat I see this:
I Xposed : Inspeckage_Error com.android.okhttp.OkHttpClient#open(java.net.URI)#exact
I Xposed : Inspeckage_Error java.lang.ClassNotFoundException: com.android.okhttp.internal.http.HttpURLConnectionImpl
I Xposed : Inspeckage_Error java.lang.ClassNotFoundException: org.apache.http.conn.ssl.HttpsURLConnection
I Xposed : Inspeckage_Error java.lang.ClassNotFoundException: okhttp3.CertificatePinner

I tried to login with HTTP ON, I got a generic network error from app and I can't login, also without proxy, so no issue with unknow_ca.

Hi,

Many apps crash at launch like Snapchat or GIPHY.

In the Xposed logs I found the common error :

Inspeckage_Error com.android.okhttp.OkHttpClient#open(java.net.URI)#exact
Inspeckage_Error java.lang.ClassNotFoundException: com.android.okhttp.internal.http.HttpURLConnectionImpl
Inspeckage_FileSystem:R/W Dir: [...]

Using OnePlus X - Custom CM13.0 ROM - Xposed v85, Inspeckage 1.4.

Own build of Inspeckage beacause otherwise Xposed says it can't load module
beacause you have to disable Instant Run in Android Studio. So I rebuilt the APK
after disabling Instant Run in the IDE settings. No changes in graddle configuration.

Thanks for your help.

Hey,

I was trying to install the module by following the "Genymotion + Xposed + Inspeckage" video.
I used the same image (5.1.0 api22) and the same packages that you published in your video (https://acpm.mobi/genymotion-xposed-inspeckage/).

For some reason after installing the Inspeckage module, the module cannot be enabled (The red labeled "Module disabled"). I did restart the emulator the same way you did and did checked the module in the Exposed's modules list with no luck.

Is there a way to troubleshoot this issue?

Thanks in advance!

P.S.
Amazing project. Well done :)

I'm running with the following configuration:

• Android x86 6.0.1 (Marshmallow, API 23) under Parallels
• Xposed Framework v87
• Inspeckage v2.3

Upon launching any app from within Inspeckage I get the following stack in the Xposed Framework log viewer:

08-06 17:33:31.148 E/Xposed  ( 3313): java.lang.NullPointerException: Attempt to read from field 'java.util.List mobi.acpm.inspeckage.hooks.entities.FingerprintList.fingerprintItems' on a null object reference
08-06 17:33:31.148 E/Xposed  ( 3313): 	at mobi.acpm.inspeckage.hooks.FingerprintHook.initAllHooks(FingerprintHook.java:52)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at mobi.acpm.inspeckage.Module.handleLoadPackage(Module.java:154)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at de.robv.android.xposed.IXposedHookLoadPackage$Wrapper.handleLoadPackage(IXposedHookLoadPackage.java:34)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at de.robv.android.xposed.callbacks.XC_LoadPackage.call(XC_LoadPackage.java:61)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at de.robv.android.xposed.callbacks.XCallback.callAll(XCallback.java:106)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at de.robv.android.xposed.XposedInit$2.beforeHookedMethod(XposedInit.java:116)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:314)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at android.app.ActivityThread.handleBindApplication(<Xposed>)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at android.app.ActivityThread.-wrap1(ActivityThread.java)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1405)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at android.os.Handler.dispatchMessage(Handler.java:102)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at android.os.Looper.loop(Looper.java:148)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at android.app.ActivityThread.main(ActivityThread.java:5415)
08-06 17:33:31.148 E
/Xposed  ( 3313): 	at java.lang.reflect.Method.invoke(Native Method)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:745)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:635)
08-06 17:33:31.148 E/Xposed  ( 3313): 	at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:102)

Looks like a null check at https://github.com/ac-pm/Inspeckage/blob/master/app/src/main/java/mobi/acpm/inspeckage/hooks/FingerprintHook.java#L45 would be sufficient to mitigate this?

I don't have a build environment to hand right now, otherwise I'd submit a PR! Shout if you need anything else.

Hello,

So I just installed the Inspeckage 1.3 module using Xposed Framework version 85. The module keeps reporting itself as disabled. By inspecting the Xposed error.log, I get the following:

04-15 04:48:55.444 I/Xposed  (  310): Platform: armeabi-v7a, 32-bit binary, system server: yes
04-15 04:48:55.444 I/Xposed  (  310): SELinux enabled: yes, enforcing: yes
07-06 11:01:26.133 I/Xposed  (  310): -----------------
07-06 11:01:26.136 I/Xposed  (  310): Added Xposed (/system/framework/XposedBridge.jar) to CLASSPATH
07-06 11:01:26.608 I/Xposed  (  310): Detected ART runtime
07-06 11:01:26.640 I/Xposed  (  310): Found Xposed class de/robv/android/xposed/XposedBridge, now initializing
07-06 11:01:26.952 I/Xposed  (  310): Loading modules from /data/app/mobi.acpm.inspeckage-1/base.apk
07-06 11:01:27.000 E/Xposed  (  310):   Cannot load module, please disable "Instant Run" in Android Studio.

Seems like the package being hosted has been compiled with the "Instant Run" option enabled. Xposed documentation mentions that this should be disabled:

https://github.com/rovo89/XposedBridge/wiki/Using-the-Xposed-Framework-API

Please make sure to disable Instant Run (File -> Settings -> Build, Execution, Deployment -> Instant Run), otherwise your classes aren't included directly in the APK, but loaded via a stub application which Xposed can't handle.

Could you have a look into that?

Thanks!

Steps to reproduce:

Open app
Click back button
Open navigation drawer and on Config item

Logcat:

03-03 22:30:19.625 17566 17566 E AndroidRuntime: java.lang.RuntimeException: mobi.acpm.inspeckage.ui.MainActivity@dba6f9e must implement OnFragmentInteractionListener
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at mobi.acpm.inspeckage.ui.ConfigFragment.onAttach(ConfigFragment.java:126)
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at android.app.FragmentManagerImpl.moveToState(FragmentManager.java:932)
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at android.app.FragmentManagerImpl.moveToState(FragmentManager.java:1148)
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at android.app.BackStackRecord.run(BackStackRecord.java:793)
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at android.app.FragmentManagerImpl.execPendingActions(FragmentManager.java:1535)
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at android.app.FragmentManagerImpl$1.run(FragmentManager.java:482)
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at android.os.Handler.handleCallback(Handler.java:739)
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:95)
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at android.os.Looper.loop(Looper.java:148)
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at android.app.ActivityThread.main(ActivityThread.java:5417)
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:726)
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)
03-03 22:30:19.625 17566 17566 E AndroidRuntime: at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:117)

I get "possible pinning" on all requests made from a certain app that uses client certificate

UserHooks parseParams causes an OutOfMemoryError when serializing a non-trivial, nested Object to JSON.

UserHooks#parseParam

I observed the issue when playing around with Inspeckage and DIVA. In DIVA, many methods are passed a View or another class that contains multiple references to other objects.

I did not find a trivial way to limit Gson parsing of nested objects (especially if it should support arbitrary objects, and not objects that are defined with Gson de/serialization in mind). In my tests, simply using toString() instead of gson.toJson() avoided the problem at the cost of the output format's "beauty".

first of of all thanks for making such awesome tool i have question i was inspecting an app call zipcar i used proxy and ssl unpinning to see the api or parameters how it reests and headers stuff but i was just able to see its url not the get parameters via it was requesting like username parameter or password parameter nothing in headers also is bug or i missed something btw i am using the fiddler as proxy to see headers please answer it clear because iam noob at this field

Hi there.

I am getting this error if I try to download a file using the Tree view or try to take a screenshot of the app.

Awesome project. Keep it up.

Phone going on a bootloop after updating 3.6.0 on my oneplus 2. June security patch updated. Xposed not getting installed. Rovo pls help

When analyszing an application , hooked results are not showing up on the webpage under tabs , but I can see the entries in the logs(xposed logs)

Let's say, I want to hook a method, void a(int a, String b). What should I write into the method box for the method's parameter? a(int, String)? a(int, java.lang.String)? or a[int, Ljava/lang/String;]?

BTW, 'New hooks' function is cool.

I still could not detect in what circumstances this occurs, but sometimes, the app is running but the webinterface still indicates the app running:false and the most of the information does not appear.

I am using latest build 2.2 of Inspeckage.

Device: Android
OS version: 4.4

once i select the app, most of application won't work or get started.

How to Donate?

Using LG G4 on CyanogenMod 13, opening the config menu crashes the app.

Is this package on f-droid.org?

use google's Gson jar lead this error. I suggest not use any third party jar. if the hooked app use the same jar, this error accours.

I'm trying to use hooks functionality in inspeckage to hook methods in owasp uncrackable1 apk. Its not loading or hooking. Actually its not doing anything

Hi @ac-pm, Thank you so much for this tool. It is exactly the tool I have been looking for. I can get the web server running, launching an app from Inspeckage and I can view the web interface.

But I can't do the interesting stuff as I can't get passed the Module Disabled. I have watched your video 10 times to see I was missing a step. I got all files installed. The only difference I know from your setup was:

• I used xPosed SDK version for x86 (v23). You used v22.
• I am running an Android 6.0 on my GenyMotion Emulator.

When I target an application (eg. Firefox, FM radio, any app) with Inspeckage and try to launch it (through Inspeckage or directly from native android launcher) the application immediately crashes with a system error message "The application has stop working".

• Mobile: LG G4 (H815)
• Android version: 6.0
• Kernel version: 3.10.84
• Software version: V20e-208-01
• Xposed framework installed in version 86 for arm64
• Inspeckage version: 1.4.1

Here are logcat with crash of Firefox
logcat.txt

There is a NullPointerException when launching MicroMachines.

java.lang.RuntimeException: Unable to start activity ComponentInfo{mobi.acpm.inspeckage/mobi.acpm.inspeckage.ui.MainActivity}: java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.String android.content.Context.getString(int)' on a null object reference at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:3253) at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:3349) at android.app.ActivityThread.handleRelaunchActivity(ActivityThread.java:5383) at android.app.ActivityThread.access$1200(ActivityThread.java:221) at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1800) at android.os.Handler.dispatchMessage(Handler.java:102) at android.os.Looper.loop(Looper.java:158) at android.app.ActivityThread.main(ActivityThread.java:7225) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1230) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1120) at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:102) Caused by: java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.String android.content.Context.getString(int)' on a null object reference at mobi.acpm.inspeckage.ui.MainFragment.loadListView(MainFragment.java:281) at mobi.acpm.inspeckage.ui.MainFragment.onCreateView(MainFragment.java:87) at android.app.Fragment.performCreateView(Fragment.java:2281) at android.app.FragmentManagerImpl.moveToState(FragmentManager.java:983) at android.app.FragmentManagerImpl.moveToState(FragmentManager.java:1163) at android.app.FragmentManagerImpl.moveToState(FragmentManager.java:1145) at android.app.FragmentManagerImpl.dispatchActivityCreated(FragmentManager.java:1970) at android.app.FragmentController.dispatchActivityCreated(FragmentController.java:152) at android.app.Activity.performCreateCommon(Activity.java:6867) at android.app.Activity.performCreate(Activity.java:6897) at android.app.Instrumentation.callActivityOnCreate(Instrumentation.java:1135) at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:3206) ... 11 more

Thanks to your contribution, I get the information about applications. And I want to compile the resource code, but when It's install in my phone, It's flash back and can not work.

Similar to my last issue, the app I'm working on doesn't have a running state because it's just a widget and some non-persistent services that update it on intents.

I'm guessing it's a permissions issue? Your module can only pull the directory list/files if it executes code from within the context of the app itself? If you already know the path, perhaps requesting root at the right moment would be enough to allow you to pull files for any app that you're inspecting,

Hello,

Could you add more details on Crypto tab like;

• Showing also crypto key byte array notation (String is good but not enough I think)
• Also maybe show a sample code block about used crypto implementation (like in java)

Thanks

Really amazing tool, truly awesome work!

I'm working with a widget-only app which doesn't have a defined main activity, Inspeckage should probably either check the manifest for a valid activity to start or try/catch the intent in case it crashes. It currently detects my configure widget activity which (I'm guessing) crashes because it expects to be launched from a widget intent and requires additional data.

Hi,

I have an application which crash on launch when inspeckage is enabled on it.
It seems to be an HTTP error, may be because they use squareup/okhttp ?

The crash log is attached below :

05-09 20:39:34.644 28971 28971 I Xposed : Inspeckage_Error com.android.okhttp.OkHttpClient#open(java.net.URI)#exact
05-09 20:39:34.644 28971 28971 I Xposed : Inspeckage_Error java.lang.ClassNotFoundException: com.android.okhttp.internal.http.HttpURLConnectionImpl
05-09 20:39:34.684 28971 28971 E Xposed : com.google.gson.JsonSyntaxException: com.google.gson.stream.MalformedJsonException: Expected value at line 1 column 14 path $.hookJson
05-09 20:39:34.684 28971 28971 E Xposed : at com.google.gson.Gson.fromJson(Gson.java:894)
05-09 20:39:34.684 28971 28971 E Xposed : at com.google.gson.Gson.fromJson(Gson.java:844)
05-09 20:39:34.684 28971 28971 E Xposed : at com.google.gson.Gson.fromJson(Gson.java:793)
05-09 20:39:34.684 28971 28971 E Xposed : at com.google.gson.Gson.fromJson(Gson.java:765)
05-09 20:39:34.684 28971 28971 E Xposed : at mobi.acpm.inspeckage.hooks.UserHooks.initAllHooks(UserHooks.java:40)
05-09 20:39:34.684 28971 28971 E Xposed : at mobi.acpm.inspeckage.Module.handleLoadPackage(Module.java:126)
05-09 20:39:34.684 28971 28971 E Xposed : at de.robv.android.xposed.IXposedHookLoadPackage$Wrapper.handleLoadPackage(IXposedHookLoadPackage.java:34)
05-09 20:39:34.684 28971 28971 E Xposed : at de.robv.android.xposed.callbacks.XC_LoadPackage.call(XC_LoadPackage.java:61)
05-09 20:39:34.684 28971 28971 E Xposed : at de.robv.android.xposed.callbacks.XCallback.callAll(XCallback.java:106)
05-09 20:39:34.684 28971 28971 E Xposed : at de.robv.android.xposed.XposedBridge$1.beforeHookedMethod(XposedBridge.java:203)
05-09 20:39:34.684 28971 28971 E Xposed : at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:729)
05-09 20:39:34.684 28971 28971 E Xposed : at android.app.ActivityThread.handleBindApplication()
05-09 20:39:34.684 28971 28971 E Xposed : at android.app.ActivityThread.access$1800(ActivityThread.java:222)
05-09 20:39:34.684 28971 28971 E Xposed : at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1861)
05-09 20:39:34.684 28971 28971 E Xposed : at android.os.Handler.dispatchMessage(Handler.java:102)
05-09 20:39:34.684 28971 28971 E Xposed : at android.os.Looper.loop(Looper.java:158)
05-09 20:39:34.684 28971 28971 E Xposed : at android.app.ActivityThread.main(ActivityThread.java:7229)
05-09 20:39:34.684 28971 28971 E Xposed : at java.lang.reflect.Method.invoke(Native Method)
05-09 20:39:34.684 28971 28971 E Xposed : at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java)
05-09 20:39:34.684 28971 28971 E Xposed : at com.android.internal.os.ZygoteInit.main(ZygoteInit.java)
05-09 20:39:34.684 28971 28971 E Xposed : at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:134)
05-09 20:39:34.684 28971 28971 E Xposed : Caused by: com.google.gson.stream.MalformedJsonException: Expected value at line 1 column 14 path $.hookJson
05-09 20:39:34.684 28971 28971 E Xposed : at com.google.gson.stream.JsonReader.syntaxError(JsonReader.java:1567)
05-09 20:39:34.684 28971 28971 E Xposed : at com.google.gson.stream.JsonReader.doPeek(JsonReader.java:594)
05-09 20:39:34.684 28971 28971 E Xposed : at com.google.gson.stream.JsonReader.peek(JsonReader.java:429)
05-09 20:39:34.684 28971 28971 E Xposed : at com.google.gson.internal.bind.CollectionTypeAdapterFactory$Adapter.read(CollectionTypeAdapterFactory.java:74)
05-09 20:39:34.684 28971 28971 E Xposed : at com.google.gson.internal.bind.CollectionTypeAdapterFactory$Adapter.read(CollectionTypeAdapterFactory.java:61)
05-09 20:39:34.684 28971 28971 E Xposed : at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory$1.read(ReflectiveTypeAdapterFactory.java:116)
05-09 20:39:34.684 28971 28971 E Xposed : at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory$Adapter.read(ReflectiveTypeAdapterFactory.java:216)
05-09 20:39:34.684 28971 28971 E Xposed : at com.google.gson.Gson.fromJson(Gson.java:879)
05-09 20:39:34.684 28971 28971 E Xposed : ... 20 more
05-09 20:39:34.684 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /data/lp/xposed
05-09 20:39:34.684 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.694 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.694 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.694 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.694 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.694 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.694 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.694 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.704 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.704 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.704 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.704 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.704 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.704 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.704 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.704 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.704 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.704 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.704 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.714 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.714 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.714 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.714 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.714 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.714 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.714 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.714 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.714 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.714 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.724 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.724 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.724 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.724 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.724 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.724 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.724 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.724 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.724 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.724 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.724 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.724 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.724 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.734 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.734 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.734 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.734 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.734 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.734 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.734 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.734 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.734 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.734 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.734 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.734 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.744 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.744 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.744 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.744 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.744 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.744 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.744 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.744 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.744 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.744 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.744 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.744 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.744 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.754 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.754 28971 28971 I Xposed : Inspeckage_FileSystem:R/W [new File(String)]: /storage/emulated/0
05-09 20:39:34.754 28971 28971 F art : art/runtime/indirect_reference_table.cc:115] 505: 0x76b5f078 java.lang.String "Xposed"
05-09 20:39:37.144 25114 25114 I InjectionManager: dispatchPrepareOptionsMenu :de.robv.android.xposed.installer.XposedInstallerActivity
05-09 20:39:38.554 25114 25114 I InjectionManager: dispatchOptionsItemSelected :de.robv.android.xposed.installer.XposedInstallerActivity
05-09 20:39:56.304 29032 29032 W System.err: at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:134)
05-09 20:39:57.254 25114 25114 I InjectionManager: dispatchPrepareOptionsMenu :de.robv.android.xposed.installer.XposedInstallerActivity
05-09 20:39:58.114 25114 25114 I InjectionManager: dispatchOptionsItemSelected :de.robv.android.xposed.installer.XposedInstallerActivity
05-09 20:39:59.024 29032 29032 W System.err: at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:134)
05-09 20:40:10.484 29032 29032 W System.err: at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:134)
05-09 20:40:12.844 29032 29032 W System.err: at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:134)
05-09 20:40:17.084 29032 29032 W System.err: at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:134)
05-09 20:40:19.414 29032 29032 W System.err: at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:134)
05-09 20:40:23.694 29032 29032 W System.err: at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:134)
05-09 20:40:26.044 29032 29032 W System.err: at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:134)
05-09 20:40:50.404 29032 29032 W System.err: at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:134)
05-09 20:40:52.694 29032 29032 W System.err: at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:134)

Thanks,

When I try to Hook any app and Launch in the webpage the HOOKS Section. It just keeps on "Loading" and nothing more. Before some months back it worked good. After some months when I installed again it started giving me this errors.

I installed the module bit did not yet restarted the phone. Intsead, i launched the app and it crashed

java.lang.RuntimeException: Unable to start activity ComponentInfo{mobi.acpm.inspeckage/mobi.acpm.inspeckage.ui.MainActivity}: java.lang.NullPointerException: Attempt to invoke interface method 'boolean java.util.Enumeration.hasMoreElements()' on a null object reference
	at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2456)
	at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:2539)
	at android.app.ActivityThread.access$900(ActivityThread.java:159)
	at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1384)
	at android.os.Handler.dispatchMessage(Handler.java:102)
	at android.os.Looper.loop(Looper.java:152)
	at android.app.ActivityThread.main(ActivityThread.java:5507)
	at java.lang.reflect.Method.invoke(Native Method)
	at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:726)
	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)
	at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:102)
Caused by: java.lang.NullPointerException: Attempt to invoke interface method 'boolean java.util.Enumeration.hasMoreElements()' on a null object reference
	at mobi.acpm.inspeckage.ui.MainFragment.loadInterfaces(MainFragment.java:200)
	at mobi.acpm.inspeckage.ui.MainFragment.onCreateView(MainFragment.java:158)
	at android.app.Fragment.performCreateView(Fragment.java:2220)
	at android.app.FragmentManagerImpl.moveToState(FragmentManager.java:973)
	at android.app.FragmentManagerImpl.moveToState(FragmentManager.java:1148)
	at android.app.BackStackRecord.run(BackStackRecord.java:793)
	at android.app.FragmentManagerImpl.execPendingActions(FragmentManager.java:1535)
	at android.app.FragmentController.execPendingActions(FragmentController.java:325)
	at android.app.Activity.performStart(Activity.java:6320)
	at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2419)
	... 10 more

I've tried to intercept hmac hashes but all this had passed.
It doesn't possible to capture hmac hashes?

Looks like a Snapchat update broke the SSL pinning bypass in Inspeckage. Not able to inspect Snapchat traffic with proxy and CA installed.

I want to ask if i can use Inspeckage to monitor what apps are sendind but from multiple devices on the same time. So i want to have a server with Xposed and Inspeckage and collect the data from devices that connect to that server,

Thanks in advance

The IP address of the local interface that Inspeckage will bind to.

If the Inspeckage is bound to all interfaces or to a specific non-loopback interface, then other computers may be able to connect to the Inspeckage.

Running LG G4 on CyanogenMod13 with the xposed framework, if I've targeted an app and then launch it, it will crash the app every time and 9/10 Inspeckage crashes with it.

Is it possible?

Would it be possible to add an inspector on the HTTP requests to view the headers and body as well?

I have spent the last hour messing around with the proxy'ing for an app but for the life of me I cannot get it to proxy traffic into my Burp proxy on my desktop. What am I missing? I enter in the proxy details on the local network, and the "Add proxy" button doesn't do anything, no indication of whether or not anything actually happened. Burp is running and sees no traffic. The HTTP hook however sees requests going out. What am I doing wrong?

Hi Bro,

the app crash when I open it.
I'm using Genymotion, the Android ROM version is 4.1.1(4.4.4 is the same).
below is the android LOG and the LOG shows in X
/ActivityManager( 286): Start proc mobi.acpm.inspeckage for activity mobi.acpm.inspeckage/.ui.MainActivity: pid=1321 uid=10055 gids={3003, 1015, 1028}

I/qtaguid ( 286): Failed write_ctrl(s 1 10055) res=-1 errno=1

W/NetworkManagementSocketTagger( 286): setKernelCountSet(10055, 1) failed with errno -1

D/AndroidRuntime( 1321): Shutting down VM

W/dalvikvm( 1321): threadid=1: thread exiting with uncaught exception (group=0xa6317288)

E/AndroidRuntime( 1321): FATAL EXCEPTION: main

E/AndroidRuntime( 1321): java.lang.RuntimeException: Unable to instantiate activity ComponentInfo{mobi.acpm.inspeckage/mobi.acpm.inspeckage.ui.MainActivity}: java.lang.ClassNotFoundException: mobi.acpm.inspeckage.ui.MainActivity

E/AndroidRuntime( 1321): at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:1983)

E/AndroidRuntime( 1321): at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:2084)

E/AndroidRuntime( 1321): at android.app.ActivityThread.access$600(ActivityThread.java:130)

E/AndroidRuntime( 1321): at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1195)

E/AndroidRuntime( 1321): at android.os.Handler.dispatchMessage(Handler.java:99)

E/AndroidRuntime( 1321): at android.os.Looper.loop(Looper.java:137)

E/AndroidRuntime( 1321): at android.app.ActivityThread.main(ActivityThread.java:4745)

E/AndroidRuntime( 1321): at java.lang.reflect.Method.invokeNative(Native Method)

E/AndroidRuntime( 1321): at java.lang.reflect.Method.invoke(Method.java:511)

E/AndroidRuntime( 1321): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:786)

E/AndroidRuntime( 1321): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:553)

E/AndroidRuntime( 1321): at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:132)

E/AndroidRuntime( 1321): at dalvik.system.NativeStart.main(Native Method)

E/AndroidRuntime( 1321): Caused by: java.lang.ClassNotFoundException: mobi.acpm.inspeckage.ui.MainActivity

E/AndroidRuntime( 1321): at dalvik.system.BaseDexClassLoader.findClass(BaseDexClassLoader.java:61)

E/AndroidRuntime( 1321): at java.lang.ClassLoader.loadClass(ClassLoader.java:501)

E/AndroidRuntime( 1321): at java.lang.ClassLoader.loadClass(ClassLoader.java:461)

E/AndroidRuntime( 1321): at android.app.Instrumentation.newActivity(Instrumentation.java:1053)

E/AndroidRuntime( 1321): at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:1974)

E/AndroidRuntime( 1321): ... 12 more

W/ActivityManager( 286): Force finishing activity mobi.acpm.inspeckage/.ui.MainActivity

W/WindowManager( 286): Failure taking screenshot for (246x419) to layer 21010

W/ActivityManager( 286): Activity pause timeout for ActivityRecord{537fbd50 mobi.acpm.inspeckage/.ui.MainActivity}

I/qtaguid ( 286): Failed write_ctrl(s 0 10055) res=-1 errno=1

W/NetworkManagementSocketTagger( 286): setKernelCountSet(10055, 0) failed with errno -1

I/Process ( 1321): Sending signal. PID: 1321 SIG: 9

I/ActivityManager( 286): Process mobi.acpm.inspeckage (pid 1321) has died.

2016-5-13 AM 11:56:16 UTC
Loading Xposed v54 (for Zygote)...
Running ROM 'vbox86p-userdebug 4.1.1 JRO03S eng.buildbot.20150610.092736 test-keys' with fingerprint 'generic/vbox86p/vbox86p:4.1.1/JRO03S/eng.buildbot.20150610.092736:userdebug/test-keys'
Loading modules from /data/app/mobi.acpm.inspeckage-1.apk
Loading class mobi.acpm.inspeckage.Module
java.lang.ClassNotFoundException: mobi.acpm.inspeckage.Module
at dalvik.system.BaseDexClassLoader.findClass(BaseDexClassLoader.java:61)
at java.lang.ClassLoader.loadClass(ClassLoader.java:501)
at java.lang.ClassLoader.loadClass(ClassLoader.java:461)
at de.robv.android.xposed.XposedBridge.loadModule(XposedBridge.java:421)
at de.robv.android.xposed.XposedBridge.loadModules(XposedBridge.java:386)
at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:120)
at dalvik.system.NativeStart.main(Native Method)

A new tab that the user can manage new hooks.

When I try to take a screenshot , every time I am getting "SERVER INTERNAL ERROR: Serve() returned a null response." and when I try to download any database file I am getting the same issue. can someone help me how to resolve this issue?

Please, support authentication on the webserver. A simple Basic Auth would be nice ;)

I would like to suggest a small improvement, could you make your amazing tool work on iOS devices? Thanks!

Turn the area of app info collapsible

Hi @ac-pm,

I tried 1.2 today. Very nice. Worked smoothly. One feature that would help me greatly is to see what data is passed over the JNI bridge. There are a few tools out there to perform this (Android Eagle Eye, and Android Shim) but I like the idea of Inspeckage as an uber tool.

A lot of the apps I analyze perform the crypto operations in native code.

Please, enable HTTPS on the webserver

What can hook SO or think?

I'm trying to use logcat feature. I open logcat page, start service and connect to Websocket.
Two messages appears: [WebSocket Open], [Handshake Ok]
In SuperSU logs I see two calls by Inspeckage:
logcat -c with empty response
logcat | grep -v Xposed - returns lots of text

In sniffer I see that websocket connection is succesfully established. But no log data ever sent over it.

Hello great work on Inspeckage,

On the HTTP i see a "possible pinning" message what does that mean?
Maybe that the SSL validation is also performed from the backend as well (not only inside the mobile application)?

Thanks