tomer8007/chromium-ipc-sniffer

A tool to capture communication between Chromium processes on Windows

chromium-ipc-sniffer's Issues

Not working with Chrome 88

.\chromeipc.exe --update-interfaces-info

[+] 1002.Processing file ui/ozone/public/mojom/scenic_gpu_host.mojom
[+] 1003.Processing file ui/ozone/public/mojom/scenic_gpu_service.mojom
[+] 1004.Processing file ui/ozone/public/mojom/wayland/wayland_buffer_manager.mojom
[+] 1005.Processing file ui/ozone/public/mojom/wayland/wayland_overlay_config.mojom
[+] 1006.Processing file ui/webui/resources/cr_components/customize_themes/customize_themes.mojom
[+] 1007.Processing file url/mojom/origin.mojom
[+] 1008.Processing file url/mojom/url.mojom
[+] 1009.Processing file url/mojom/url_test.mojom
[+] Matching commit is 2489b0741310c3a50c990c1d6acb9f113bd879a8
[+] Going to download 30 legacy IPC header files.
[+] Processing file content/common/frame_messages.h
[+] Processing file content/common/page_messages.h

Unhandled Exception: System.Net.WebException: The remote server returned an error: (404) Not Found.
   at ChromeIPCSniffer.LegacyIpcInterfacesFetcher.DownloadAndAnalyzeLegacyIpcFiles(Dictionary`2 legacyIpcFiles, String commit, String chromeVersion)
   at ChromeIPCSniffer.LegacyIpcInterfacesFetcher.UpdateInterfacesInfoIfNeeded(String chromeVersion, Boolean force)
   at ChromeIPCSniffer.Program.Main(String[] args)

Running .\chromeipc.exe alone now chashes:

Chrome IPC Sniffer v0.5.0.0

Type -h to get usage help and extended options

[+] Starting up
[+] Determining your chromium version
[+] You are using chromium 88.0.4324.150
[+] Checking mojom interfaces information
[+] Checking legacy IPC interfaces information

Unhandled Exception: Newtonsoft.Json.JsonReaderException: Unterminated string. Expected delimiter: ". Path '101DB.link', line 59, position 98.
   at Newtonsoft.Json.JsonTextReader.ReadStringIntoBuffer(Char quote)
   at Newtonsoft.Json.JsonTextReader.ParseValue()
   at Newtonsoft.Json.JsonWriter.WriteToken(JsonReader reader, Boolean writeChildren, Boolean writeDateConstructorAsDate, Boolean writeComments)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateJObject(JsonReader reader)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateObject(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateValueInternal(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.Deserialize(JsonReader reader, Type objectType, Boolean checkAdditionalContent)
   at Newtonsoft.Json.JsonSerializer.DeserializeInternal(JsonReader reader, Type objectType)
   at Newtonsoft.Json.JsonConvert.DeserializeObject(String value, Type type, JsonSerializerSettings settings)
   at ChromeIPCSniffer.LegacyIpcInterfacesFetcher.UpdateInterfacesInfoIfNeeded(String chromeVersion, Boolean force)
   at ChromeIPCSniffer.Program.Main(String[] args)

Error occurs when open devtools in chrome.

Chrome version: 92.0.4515.159 (Official Build) (32-bit)
Platform: windows 10 64bit
An error dialog box shows 'frame 1482 too long' when open devtools in chrome, and after this, no more communications were captured.

Wrong interfaces info due to compiler optimization

Above methods should actually be CompositorFrameSinkClient.OnBeginFrame and CompositorFrameSink.SubmitCompositorFrame.
Apparently it's happening because now clang may group similar globals together in the same file:

which breaks the way MojoMethodHashesExtractor works.

Old chromium version not support

First of all, thank you for providing the tools. I have encountered some problems while using them.
I have compiled a debug version of Chromium myself and have corrected the logic in the code to find the debug version of Chromium. It can now normally download MojoM and start launching Wireshark for monitoring.
However, in Wireshark, the packets do not display further information such as method names.
I am not familiar with the internal details. Can you help me?

CEF support

I need capture libcef mojo message.Can you support it?
thank you!

Wireshark not properly displaying IPC message details

Hi there,

Not sure what I'm missing here but for whatever reason Wireshark is not displaying mojo IPC communication details as it supposed to based on your wiki examples. Here's screenshots for more details:

Your help is much appreciated!

Get CDM's decrypted content

Can I get decrypted audio or extract decrypt key in https://github.com/tomer8007/chromium-ipc-sniffer/wiki/Examples ?

IPCZ support

i found chrome version 109 use ipcz message type, can you support it? thanks

Unhandled Exception: System.ComponentModel.Win32Exception: The system cannot find the file specified

For some reason wireshark won't open any ideea?
Here is what i get
[+] Starting up
[+] Determining your chromium version
[+] You are using chromium 96.0.4664.110
[+] Checking mojom interfaces information
[+] Checking legacy IPC interfaces information
[!] Cached info is for 94.0.4606.61, you may run --update-interfaces-info
[+] Extracting scrambled message names from chrome.dll...
[+] Copying LUA dissectors to Wirehsark plugins directory
[!] Could not find Wireshark's colorfilters file, skipping color configuration
[+] Enumerating existing chrome pipes
[+] Starting sniffing of chrome named pipe to \.\pipe\chromeipc.
[+] Opening Wirehark

Unhandled Exception: System.ComponentModel.Win32Exception: The system cannot find the file specified
at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo)
at System.Diagnostics.Process.Start(ProcessStartInfo startInfo)
at ChromiumIPCSniffer.Program.Main(String[] args)