tomer8007/chromium-ipc-sniffer

IPCZ support

pxc1833 opened this issue · 14 comments

i found chrome version 109 use ipcz message type, can you support it? thanks

What is ipcz message type? Do you have an example?

You can enable ipcz by using command line [--enable-features=MojoIpcz] to run chrome.exe.At this time, the protocol recognized by the tool is NPFS.Actually, the first structure in pipe message is no longer mojo core, but IpczHeader.

You can see the structure of IpczHeader and the function of CreateIpczMessage In [https://source.chromium.org/chromiumos/chromiumos/codesearch/+/main:gen/amd64-generic/chroot/build/amd64-generic/usr/include/libchrome/mojo/core/channel.h;l=136?q=ipczHeader&sq=].

Thanks for such a great tool, it's a shame to see what you said ipcz has a lot of messages passing through shared memory, but will you be parsing this messaging in the future though? Maybe it takes a lot of effort

I will try to parse the IpczHeader header you sent and possibly more headers, but as I said I'm afraid that for example the actual method name/parameters will be passed over shared memory.

Yes, I tried to analyze some by myself, and found that there is very little information before the payload. I was able to find information such as the handle value of the shared memory, the length of the resource, etc., but now they are all gone. It may be in the payload or as you said in shared memory.

I see that there are still some messages having their data on named pipes (on top of IPCZ), so all is not lost.

image

I saw that you updated the initial version of ipcz, which helped a lot. Some interesting information may not be analyzed yet. I will continue to pay attention to your updates, thanks

Well, this protocol was more complex than Mojo Core.

@pxc1833 @ihack4falafel ipcz is now much better supported in version 0.6.0.0. Please let me know if this looks right for you.
EDIT: Tagging @krockot

Wow, the "driver objects" is what i need! This project helps me a lot. How to give tips to you if you are free?(^▽^)

@pxc1833 Thank you, if you really want to give tips I do have this PayPal page :-).

Sorry, I'm restricted by my country(China).The paypal prompts "Donations to this recipient aren't supported in this country"

Is there another way? My twitter is pxcpercy

The paypal prompts "Donations to this recipient aren't supported in this country"

Maybe you can try a regular payment to the email address instead of donations?
EDIT: Done, thanks