#> python setup.py install

usage: hallucinate [-h] [--verbose] [--process PROCESS] [--disable DISABLE]
                   [--enable ENABLE] [--dump-script DUMPSCRIPT]
                   [--mapfile MAPFILE] [--force-replace-buffer] [--log]
                   [--pcap PCAP] [--editor EDITOR] [--script SCRIPT]
                   [--java-vm JAVAVM] [--agent-jar AGENTJAR]
                   [--inject-agent-startup] [--java-server-host JAVAAGENTHOST]
                   [--java-server-port JAVAAGENTPORT]
                   [--java-server-key JAVAAGENTKEY]
                   [cmd [cmd ...]]

Instrument processes to intercept (encrypted) network communication

positional arguments:
  cmd                   Command to execute

optional arguments:
  -h, --help            show this help message and exit
  --verbose, -v
  --process PROCESS, -p PROCESS
                        Attach to existing process (by name or PID)
  --disable DISABLE, -d DISABLE
                        Disable default module (gnutls.js, java.js, nss.js,
                        openssl.js, schannel.js)
  --enable ENABLE, -e ENABLE
                        Enable optional module (raw.js, ncrypt.js)
  --dump-script DUMPSCRIPT
                        Dump complete frida script to file for debugging
  --mapfile MAPFILE     JSON configuration to manually override library names
                        and function addresses
  --force-replace-buffer
                        Replace application buffers, even if this likely
                        breaks the application (SChannel only)

handlers:
  Options for processing the intercepted traffic

  --log                 Log clear-text packet data
  --pcap PCAP           Write clear-text communication to a dump file in PCAP
                        format
  --editor EDITOR       Specify a system command to edit individual packet
                        data,{in} and {out} are replaced with temporary
                        files,if only {in} is specified in-place editing is
                        expected
  --script SCRIPT       Python script to load, functions recv/send(data,props)
                        will be called

java:
  Options relating to the Java agent, re(attaching) to a Java process
  multiple times is unreliable

  --java-vm JAVAVM      Java binary to use when injecting the agent. This
                        should match the target application's Java version
  --agent-jar AGENTJAR  Override agent JAR file to inject (typically bundled
                        with hallucinate)
  --inject-agent-startup
                        Inject Java agent via VM argument. Not usable when
                        attaching to a running process
  --java-server-host JAVAAGENTHOST
                        Bind address for Java agent server
  --java-server-port JAVAAGENTPORT
                        Port for Java agent server (random by default)
  --java-server-key JAVAAGENTKEY
                        Secret authentication key for Java agent server
                        connection (random by default)

#> hallucinate  --log -- /usr/bin/curl -k https://localhost

#> hallucinate --disable raw.js  --editor '/usr/bin/gedit {in}' -- /usr/bin/curl -k https://localhost

#> hallucinate --log -p <pid|procname>

def send(data,p):
    if b'HTTP/1.1' in data:
        print("Replacing HTTP version")
        return data.replace(b'HTTP/1.1', b'HTTP/1.0')
    print("Not touching: " + repr(data))

def recv(data,p):
    print("Not touching: " + repr(data))

#> hallucinate -d raw.js --script test.py -- /usr/bin/curl -s -o /dev/null -k https://localhost
INFO:root:Starting ['/usr/bin/curl', '-s', '-o', '/dev/null', '-k', 'https://localhost']
INFO:root:Injected script, resuming execution of 22096
Replacing HTTP version
Not touching: b'HTTP/1.1 200 OK

{
        "openssl":{
                "@lib" : "test.so",
                "SSL_read_ex" : "0x24235235"
        }
}