tomer8007/chromium-ipc-sniffer

Old chromium version not support

killaragorn opened this issue · 1 comments

First of all, thank you for providing the tools. I have encountered some problems while using them.
I have compiled a debug version of Chromium myself and have corrected the logic in the code to find the debug version of Chromium. It can now normally download MojoM and start launching Wireshark for monitoring.
However, in Wireshark, the packets do not display further information such as method names.
I am not familiar with the internal details. Can you help me?
image

Hello, thanks for opening an issue and trying this tool.
As I wrote in the README, this project supports only Chrome 80+, and as I remember it that was because below Chrome 80 the encoding of the method names were different inside chrome.dll so it was harder to find them (maybe not even possible without debug symbols).

If you haven't already read it, I recommend reading MethodHashesExtractor.cs to understand how it's extracting the method names.

EDIT: Another thing that happened in some version of chromium > 80 is that they added new mojo fields (1229502) , so surely the parsing will not be complete using the latest version of the tool. So please try the earliest release from the release page (You can also try removing the new fields from the dissector).

By the way, is this tool working for you in higher versions of Chrome?