thick-client

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Thick Client Security Testing

ACTION REQUIRED（读完后立刻执行）

ACTION REQUIRED (Execute Immediately After Reading)

NOW

: 读取

../field-journal/precedent-pentest.md

```
NOW
```
: 确认目标是 桌面厚客户端（Win/macOS/Linux GUI 或服务伴生），非纯 Web
```
NOW
```
: case-init；安装包来源与测试账号写入 scope
```
NEXT
```
: 工具（Burp 上游代理、进程监控、逆向工具）
```
ACT
```
: 信任边界图 → 本地面 → 网络面 → 更新/供应链

NOW

: Read

../field-journal/precedent-pentest.md

```
NOW
```
: Confirm the target is a desktop thick client (Win/macOS/Linux GUI or service-associated), not a pure Web client
```
NOW
```
: case-init; Record the installation package source and test account in the scope
```
NEXT
```
: Tools (Burp upstream proxy, process monitoring, reverse engineering tools)
```
ACT
```
: Trust boundary diagram → Local surface → Network surface → Update/supply chain

适用场景

Applicable Scenarios

C/S 架构客户端、Electron/Qt/.NET WinForms/WPF
本地配置/凭证存储、IPC、命名管道
客户端强制校验绕过研究（授权）
自动更新通道与代码签名验证

C/S architecture clients, Electron/Qt/.NET WinForms/WPF
Local configuration/credential storage, IPC, named pipes
Research on client-side mandatory verification bypass (authorization)
Automatic update channels and code signature verification

工作流

Workflow

1. 建边界

1. Establish Boundaries

text

□ 进程树、子进程、驱动/服务
□ 监听端口与出站域名
□ 本地敏感路径：%APPDATA%、Keychain、注册表

text

□ Process tree, child processes, drivers/services
□ Listening ports and outbound domains
□ Local sensitive paths: %APPDATA%, Keychain, Registry

2. 本地攻击面

2. Local Attack Surface

text

□ 明文配置、硬编码密钥、调试开关
□ DLL 劫持/搜索顺序（Windows）
□ 数据库文件（SQLite）权限与加密
□ IPC：谁可连接？是否鉴权？

text

□ Plaintext configuration, hardcoded keys, debug switches
□ DLL hijacking/search order (Windows)
□ Database file (SQLite) permissions and encryption
□ IPC: Who can connect? Is authentication required?

3. 网络面

3. Network Surface

text

□ 系统代理 / 应用自定义 TLS
□ 证书钉扎 → 联合 mobile/js 方法学或 Frida
□ API 越权：客户端隐藏的管理接口

text

□ System proxy / application-specific TLS
□ Certificate pinning → Combine with mobile/js methodologies or Frida
□ API privilege escalation: Hidden admin interfaces on the client side

4. 逆向验证

4. Reverse Verification

text

□ .NET → dotnet-reverse；原生 → ida/ghidra；Electron → asar + js-reverse

text

□ .NET → dotnet-reverse; Native → ida/ghidra; Electron → asar + js-reverse

工具链

Toolchain

工具	用途
Process Monitor / API Monitor	行为
Burp / mitmproxy	流量
dnSpy / IDA / Ghidra	逆向
Sysinternals	Windows 面
asar / nexe 检测	Electron

Tool	Purpose
Process Monitor / API Monitor	Behavior monitoring
Burp / mitmproxy	Traffic analysis
dnSpy / IDA / Ghidra	Reverse engineering
Sysinternals	Windows platform analysis
asar / nexe detection	Electron client analysis

参考

References

```
references/thick-client-checklist.md
```

../dotnet-reverse/

../ida-reverse/

../js-reverse/

../api-security/

```
references/thick-client-checklist.md
```

../dotnet-reverse/

../ida-reverse/

../js-reverse/

../api-security/

路由上下文

Routing Context

上游: MASTER R32
下游: 纯协议

protocol-reverse

；供应链更新

supply-chain-security

Upstream: MASTER R32
Downstream: Pure protocol

protocol-reverse

; Supply chain update

supply-chain-security

任务完成自检

Task Completion Self-Check

是否画出信任边界？
本地+网络面是否都覆盖？
Checklist？

Has the trust boundary diagram been drawn?
Have both local and network surfaces been covered?
Have checklists been completed?