setTimeout(function() { Java.perform(function() { console.log(''); console.log('================================================================='); console.log('[#] Android Bypass for various Certificate Pinning methods [#]'); console.log('================================================================='); var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager'); var SSLContext = Java.use('javax.net.ssl.SSLContext'); // TrustManager (Android < 7) // //////////////////////////////// var TrustManager = Java.registerClass({ // Implement a custom TrustManager name: 'dev.asd.test.TrustManager', implements: [X509TrustManager], methods: { checkClientTrusted: function(chain, authType) {}, checkServerTrusted: function(chain, authType) {}, getAcceptedIssuers: function() {return []; } } }); // Prepare the TrustManager array to pass to SSLContext.init() var TrustManagers = [TrustManager.$new()]; // Get a handle on the init() on the SSLContext class var SSLContext_init = SSLContext.init.overload( '[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom'); try { // Override the init method, specifying the custom TrustManager SSLContext_init.implementation = function(keyManager, trustManager, secureRandom) { console.log('[+] Bypassing Trustmanager (Android < 7) pinner'); SSLContext_init.call(this, keyManager, TrustManagers, secureRandom); }; } catch (err) { console.log('[-] TrustManager (Android < 7) pinner not found'); //console.log(err); } // OkHTTPv3 (quadruple bypass) // ///////////////////////////////// try { // Bypass OkHTTPv3 {1} var okhttp3_Activity_1 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_1.check.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {1}: ' + a); return; }; } catch (err) { console.log('[-] OkHTTPv3 {1} pinner not found'); //console.log(err); } try { // Bypass OkHTTPv3 {2} // This method of CertificatePinner.check is deprecated but could be found in some old Android apps var okhttp3_Activity_2 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_2.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {2}: ' + a); return; }; } catch (err) { console.log('[-] OkHTTPv3 {2} pinner not found'); //console.log(err); } try { // Bypass OkHTTPv3 {3} var okhttp3_Activity_3 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_3.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {3}: ' + a); return; }; } catch(err) { console.log('[-] OkHTTPv3 {3} pinner not found'); //console.log(err); } try { // Bypass OkHTTPv3 {4} var okhttp3_Activity_4 = Java.use('okhttp3.CertificatePinner'); //okhttp3_Activity_4['check$okhttp'].implementation = function(a, b) { okhttp3_Activity_4.check$okhttp.overload('java.lang.String', 'kotlin.jvm.functions.Function0').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {4}: ' + a); return; }; } catch(err) { console.log('[-] OkHTTPv3 {4} pinner not found'); //console.log(err); } // Trustkit (triple bypass) // ////////////////////////////// try { // Bypass Trustkit {1} var trustkit_Activity_1 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier'); trustkit_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) { console.log('[+] Bypassing Trustkit {1}: ' + a); return true; }; } catch (err) { console.log('[-] Trustkit {1} pinner not found'); //console.log(err); } try { // Bypass Trustkit {2} var trustkit_Activity_2 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier'); trustkit_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) { console.log('[+] Bypassing Trustkit {2}: ' + a); return true; }; } catch (err) { console.log('[-] Trustkit {2} pinner not found'); //console.log(err); } try { // Bypass Trustkit {3} var trustkit_PinningTrustManager = Java.use('com.datatheorem.android.trustkit.pinning.PinningTrustManager'); trustkit_PinningTrustManager.checkServerTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String').implementation = function(chain, authType) { console.log('[+] Bypassing Trustkit {3}'); //return; }; } catch (err) { console.log('[-] Trustkit {3} pinner not found'); //console.log(err); } // TrustManagerImpl (Android > 7) // //////////////////////////////////// try { // Bypass TrustManagerImpl (Android > 7) {1} var array_list = Java.use("java.util.ArrayList"); var TrustManagerImpl_Activity_1 = Java.use('com.android.org.conscrypt.TrustManagerImpl'); TrustManagerImpl_Activity_1.checkTrustedRecursive.implementation = function(certs, ocspData, tlsSctData, host, clientAuth, untrustedChain, trustAnchorChain, used) { console.log('[+] Bypassing TrustManagerImpl (Android > 7) checkTrustedRecursive check: '+ host); return array_list.$new(); }; } catch (err) { console.log('[-] TrustManagerImpl (Android > 7) checkTrustedRecursive check not found'); //console.log(err); } try { // Bypass TrustManagerImpl (Android > 7) {2} (probably no more necessary) var TrustManagerImpl_Activity_2 = Java.use('com.android.org.conscrypt.TrustManagerImpl'); TrustManagerImpl_Activity_2.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) { console.log('[+] Bypassing TrustManagerImpl (Android > 7) verifyChain check: ' + host); return untrustedChain; }; } catch (err) { console.log('[-] TrustManagerImpl (Android > 7) verifyChain check not found'); //console.log(err); } // Appcelerator Titanium PinningTrustManager // /////////////////////////////////////////////// try { var appcelerator_PinningTrustManager = Java.use('appcelerator.https.PinningTrustManager'); appcelerator_PinningTrustManager.checkServerTrusted.implementation = function(chain, authType) { console.log('[+] Bypassing Appcelerator PinningTrustManager'); return; }; } catch (err) { console.log('[-] Appcelerator PinningTrustManager pinner not found'); //console.log(err); } // Fabric PinningTrustManager // //////////////////////////////// try { var fabric_PinningTrustManager = Java.use('io.fabric.sdk.android.services.network.PinningTrustManager'); fabric_PinningTrustManager.checkServerTrusted.implementation = function(chain, authType) { console.log('[+] Bypassing Fabric PinningTrustManager'); return; }; } catch (err) { console.log('[-] Fabric PinningTrustManager pinner not found'); //console.log(err); } // OpenSSLSocketImpl Conscrypt (double bypass) // ///////////////////////////////////////////////// try { var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl'); OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certRefs, JavaObject, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Conscrypt {1}'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Conscrypt {1} pinner not found'); //console.log(err); } try { var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl'); OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certChain, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Conscrypt {2}'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Conscrypt {2} pinner not found'); //console.log(err); } // OpenSSLEngineSocketImpl Conscrypt // /////////////////////////////////////// try { var OpenSSLEngineSocketImpl_Activity = Java.use('com.android.org.conscrypt.OpenSSLEngineSocketImpl'); OpenSSLEngineSocketImpl_Activity.verifyCertificateChain.overload('[Ljava.lang.Long;', 'java.lang.String').implementation = function(a, b) { console.log('[+] Bypassing OpenSSLEngineSocketImpl Conscrypt: ' + b); }; } catch (err) { console.log('[-] OpenSSLEngineSocketImpl Conscrypt pinner not found'); //console.log(err); } // OpenSSLSocketImpl Apache Harmony // ////////////////////////////////////// try { var OpenSSLSocketImpl_Harmony = Java.use('org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl'); OpenSSLSocketImpl_Harmony.verifyCertificateChain.implementation = function(asn1DerEncodedCertificateChain, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Apache Harmony'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Apache Harmony pinner not found'); //console.log(err); } // PhoneGap sslCertificateChecker // //////////////////////////////////// try { var phonegap_Activity = Java.use('nl.xservices.plugins.sslCertificateChecker'); phonegap_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(a, b, c) { console.log('[+] Bypassing PhoneGap sslCertificateChecker: ' + a); return true; }; } catch (err) { console.log('[-] PhoneGap sslCertificateChecker pinner not found'); //console.log(err); } // IBM MobileFirst pinTrustedCertificatePublicKey (double bypass) // //////////////////////////////////////////////////////////////////// try { // Bypass IBM MobileFirst {1} var WLClient_Activity_1 = Java.use('com.worklight.wlclient.api.WLClient'); WLClient_Activity_1.getInstance().pinTrustedCertificatePublicKey.overload('java.lang.String').implementation = function(cert) { console.log('[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {1}: ' + cert); return; }; } catch (err) { console.log('[-] IBM MobileFirst pinTrustedCertificatePublicKey {1} pinner not found'); //console.log(err); } try { // Bypass IBM MobileFirst {2} var WLClient_Activity_2 = Java.use('com.worklight.wlclient.api.WLClient'); WLClient_Activity_2.getInstance().pinTrustedCertificatePublicKey.overload('[Ljava.lang.String;').implementation = function(cert) { console.log('[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {2}: ' + cert); return; }; } catch (err) { console.log('[-] IBM MobileFirst pinTrustedCertificatePublicKey {2} pinner not found'); //console.log(err); } // IBM WorkLight (ancestor of MobileFirst) HostNameVerifierWithCertificatePinning (quadruple bypass) // /////////////////////////////////////////////////////////////////////////////////////////////////////// try { // Bypass IBM WorkLight {1} var worklight_Activity_1 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSocket').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {1}: ' + a); return; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {1} pinner not found'); //console.log(err); } try { // Bypass IBM WorkLight {2} var worklight_Activity_2 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {2}: ' + a); return; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {2} pinner not found'); //console.log(err); } try { // Bypass IBM WorkLight {3} var worklight_Activity_3 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_3.verify.overload('java.lang.String', '[Ljava.lang.String;', '[Ljava.lang.String;').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {3}: ' + a); return; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {3} pinner not found'); //console.log(err); } try { // Bypass IBM WorkLight {4} var worklight_Activity_4 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_4.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {4}: ' + a); return true; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {4} pinner not found'); //console.log(err); } // Conscrypt CertPinManager // ////////////////////////////// try { var conscrypt_CertPinManager_Activity = Java.use('com.android.org.conscrypt.CertPinManager'); conscrypt_CertPinManager_Activity.checkChainPinning.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing Conscrypt CertPinManager: ' + a); //return; return true; }; } catch (err) { console.log('[-] Conscrypt CertPinManager pinner not found'); //console.log(err); } // Conscrypt CertPinManager (Legacy) // /////////////////////////////////////// try { var legacy_conscrypt_CertPinManager_Activity = Java.use('com.android.org.conscrypt.CertPinManager'); legacy_conscrypt_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing Conscrypt CertPinManager (Legacy): ' + a); return true; }; } catch (err) { console.log('[-] Conscrypt CertPinManager (Legacy) pinner not found'); //console.log(err); } // CWAC-Netsecurity (unofficial back-port pinner for Android<4.2) CertPinManager // /////////////////////////////////////////////////////////////////////////////////// try { var cwac_CertPinManager_Activity = Java.use('com.commonsware.cwac.netsecurity.conscrypt.CertPinManager'); cwac_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing CWAC-Netsecurity CertPinManager: ' + a); return true; }; } catch (err) { console.log('[-] CWAC-Netsecurity CertPinManager pinner not found'); //console.log(err); } // Worklight Androidgap WLCertificatePinningPlugin // ///////////////////////////////////////////////////// try { var androidgap_WLCertificatePinningPlugin_Activity = Java.use('com.worklight.androidgap.plugin.WLCertificatePinningPlugin'); androidgap_WLCertificatePinningPlugin_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(a, b, c) { console.log('[+] Bypassing Worklight Androidgap WLCertificatePinningPlugin: ' + a); return true; }; } catch (err) { console.log('[-] Worklight Androidgap WLCertificatePinningPlugin pinner not found'); //console.log(err); } // Netty FingerprintTrustManagerFactory // ////////////////////////////////////////// try { var netty_FingerprintTrustManagerFactory = Java.use('io.netty.handler.ssl.util.FingerprintTrustManagerFactory'); //NOTE: sometimes this below implementation could be useful //var netty_FingerprintTrustManagerFactory = Java.use('org.jboss.netty.handler.ssl.util.FingerprintTrustManagerFactory'); netty_FingerprintTrustManagerFactory.checkTrusted.implementation = function(type, chain) { console.log('[+] Bypassing Netty FingerprintTrustManagerFactory'); }; } catch (err) { console.log('[-] Netty FingerprintTrustManagerFactory pinner not found'); //console.log(err); } // Squareup CertificatePinner [OkHTTP stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException" ); // Retrieve the method raising the SSLPeerUnverifiedException var callingFunctionStack = stackTrace[exceptionStackIndex + 1]; var className = callingFunctionStack.getClassName(); var methodName = callingFunctionStack.getMethodName(); var callingClass = Java.use(className); var callingMethod = callingClass[methodName]; console.log('\x1b[36m[!] Attempting to bypass uncommon SSL Pinning method on: '+className+'.'+methodName+'\x1b[0m'); // Skip it when already patched by Frida if (callingMethod.implementation) { return; } // Trying to patch the uncommon SSL Pinning method via implementation var returnTypeName = callingMethod.returnType.type; callingMethod.implementation = function() { rudimentaryFix(returnTypeName); }; } catch (e) { // Dynamic patching via implementation does not works, then trying via function overloading //console.log('[!] The uncommon SSL Pinning method has more than one overload); if (String(e).includes(".overload")) { var splittedList = String(e).split(".overload"); for (let i=2; i 1 ? ' (x' + count + ')' : '')); } } function shortError(error) { var text = String(error); return text.length > 180 ? text.slice(0, 177) + '...' : text; } function installOnce(key, installer) { if (installed[key]) { return; } var now = Date.now(); if (retryAfter[key] && now < retryAfter[key]) { return; } try { var result = installer(); if (result === false) { throw new Error('not available yet'); } installed[key] = true; delete misses[key]; delete retryAfter[key]; ok(key); } catch (error) { misses[key] = shortError(error); retryAfter[key] = now + CONFIG.missRetryMs; } } function refreshClassFactories(force) { var now = Date.now(); if (!force && classFactoriesRefreshedAt !== 0 && now - classFactoriesRefreshedAt < CONFIG.classLoaderRefreshMs) { return; } var factories = []; try { Java.enumerateClassLoadersSync().forEach(function (loader) { try { factories.push(Java.ClassFactory.get(loader)); } catch (_) {} }); } catch (_) {} classFactories = factories; classFactoriesRefreshedAt = now; } function useClass(className) { if (classCache[className]) { return classCache[className]; } var primaryError = null; try { classCache[className] = Java.use(className); return classCache[className]; } catch (error) { primaryError = error; } refreshClassFactories(false); for (var i = 0; i < classFactories.length; i++) { try { var found = classFactories[i].use(className); classCache[className] = found; return found; } catch (_) {} } throw primaryError; } function returnTypeName(overload) { if (!overload || !overload.returnType) { return ''; } return String(overload.returnType.className || overload.returnType.type || ''); } function permissiveReturn(overload, receiver) { var typeName = returnTypeName(overload); if (typeName === 'void') { return; } if (typeName === 'boolean' || typeName === 'java.lang.Boolean') { return true; } if (typeName === 'byte' || typeName === 'short' || typeName === 'int' || typeName === 'long' || typeName === 'float' || typeName === 'double') { return 0; } if (typeName === 'char') { return '\u0000'; } try { if (receiver && receiver.$className && String(receiver.$className) === typeName) { return receiver; } } catch (_) {} return null; } function hookAll(className, methodName, displayName, implementationFactory) { var key = displayName + ' [' + className + '.' + methodName + ']'; installOnce(key, function () { var Target = useClass(className); var method = Target[methodName]; if (!method || !method.overloads || method.overloads.length === 0) { throw new Error('method not found'); } method.overloads.forEach(function (overload, index) { overload.implementation = implementationFactory(overload, index); }); return true; }); } function hookPermissive(className, methodName, displayName) { hookAll(className, methodName, displayName, function (overload) { return function () { var target = arguments.length > 0 ? String(arguments[0]) : ''; hit(displayName + (target ? ': ' + target : '')); return permissiveReturn(overload, this); }; }); } function certificateListFromChain(chain) { var ArrayList = useClass('java.util.ArrayList'); var result = ArrayList.$new(); if (chain) { try { if (chain.size && chain.get) { var listSize = Number(chain.size()); for (var listIndex = 0; listIndex < listSize; listIndex++) { result.add(chain.get(listIndex)); } return result; } for (var i = 0; i < chain.length; i++) { result.add(chain[i]); } } catch (_) {} } return result; } function hookTrustCheck(className, methodName, displayName) { hookAll(className, methodName, displayName, function (overload) { return function (chain) { hit(displayName); var typeName = returnTypeName(overload); if (typeName === 'void') { return; } if (typeName.indexOf('java.util.List') !== -1 || typeName.indexOf('java.util.Collection') !== -1) { return certificateListFromChain(chain); } if (typeName.charAt(0) === '[') { return chain; } return permissiveReturn(overload, this); }; }); } function enumerateMethodOwners(methodName) { var owners = Object.create(null); if (typeof Java.enumerateMethods !== 'function') { return owners; } var groups = Java.enumerateMethods('*!' + methodName + '/s'); groups.forEach(function (group) { (group.classes || []).forEach(function (entry) { if (entry && entry.name) { owners[String(entry.name)] = true; } }); }); return owners; } function installDynamicInterfaceHooks() { if (!CONFIG.enableDynamicInterfaceScan) { return; } var now = Date.now(); if (dynamicClassScanLast !== 0 && now - dynamicClassScanLast < CONFIG.dynamicClassScanEveryMs) { return; } dynamicClassScanLast = now; try { var TrustManager = useClass('javax.net.ssl.X509TrustManager'); var trustOwners = enumerateMethodOwners('checkServerTrusted'); Object.keys(trustOwners).forEach(function (className) { if (className === 'javax.net.ssl.X509TrustManager') { return; } try { var Target = useClass(className); if (TrustManager.class.isAssignableFrom(Target.class)) { hookTrustCheck( className, 'checkServerTrusted', 'Dynamic X509TrustManager' ); } } catch (_) {} }); var HostnameVerifier = useClass('javax.net.ssl.HostnameVerifier'); var verifierOwners = enumerateMethodOwners('verify'); Object.keys(verifierOwners).forEach(function (className) { if (className === 'javax.net.ssl.HostnameVerifier') { return; } try { var Target = useClass(className); if (HostnameVerifier.class.isAssignableFrom(Target.class)) { hookPermissive( className, 'verify', 'Dynamic HostnameVerifier' ); } } catch (_) {} }); delete misses['Dynamic Java interface scan']; } catch (error) { misses['Dynamic Java interface scan'] = shortError(error); } } function installTrustManagerHooks() { installOnce('SSLContext trust-all TrustManager', function () { var X509TrustManager = useClass('javax.net.ssl.X509TrustManager'); var SSLContext = useClass('javax.net.ssl.SSLContext'); var className = 'org.frida.generated.PhysicalDeviceTrustManager' + Process.id; var TrustAll; try { TrustAll = Java.registerClass({ name: className, implements: [X509TrustManager], methods: { checkClientTrusted: function () {}, checkServerTrusted: function () {}, getAcceptedIssuers: function () { return Java.array('java.security.cert.X509Certificate', []); } } }); } catch (_) { TrustAll = useClass(className); } var trustManagers = Java.array('javax.net.ssl.TrustManager', [TrustAll.$new()]); var init = SSLContext.init.overload( '[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom' ); init.implementation = function (keyManagers, ignoredTrustManagers, secureRandom) { hit('SSLContext.init'); return init.call(this, keyManagers, trustManagers, secureRandom); }; try { var permissiveContext = SSLContext.getInstance('TLS'); init.call(permissiveContext, null, trustManagers, null); trustAllSocketFactory = permissiveContext.getSocketFactory(); } catch (error) { info('Could not prebuild trust-all SSLSocketFactory: ' + shortError(error)); } return true; }); installOnce('HttpsURLConnection trust-all SSLSocketFactory', function () { if (trustAllSocketFactory === null) { throw new Error('trust-all SSLSocketFactory is not ready'); } var HttpsURLConnection = useClass('javax.net.ssl.HttpsURLConnection'); HttpsURLConnection.setDefaultSSLSocketFactory(trustAllSocketFactory); var setDefaultFactory = HttpsURLConnection.setDefaultSSLSocketFactory.overload( 'javax.net.ssl.SSLSocketFactory' ); setDefaultFactory.implementation = function () { hit('HttpsURLConnection.setDefaultSSLSocketFactory'); return setDefaultFactory.call(this, trustAllSocketFactory); }; var setInstanceFactory = HttpsURLConnection.setSSLSocketFactory.overload( 'javax.net.ssl.SSLSocketFactory' ); setInstanceFactory.implementation = function () { hit('HttpsURLConnection.setSSLSocketFactory'); return setInstanceFactory.call(this, trustAllSocketFactory); }; return true; }); installOnce('HttpsURLConnection permissive HostnameVerifier', function () { var HostnameVerifier = useClass('javax.net.ssl.HostnameVerifier'); var HttpsURLConnection = useClass('javax.net.ssl.HttpsURLConnection'); var className = 'org.frida.generated.AllowAllHostnameVerifier' + Process.id; var AllowAll; try { AllowAll = Java.registerClass({ name: className, implements: [HostnameVerifier], methods: { verify: function (hostname) { hit('HostnameVerifier: ' + hostname); return true; } } }); } catch (_) { AllowAll = useClass(className); } var verifier = AllowAll.$new(); HttpsURLConnection.setDefaultHostnameVerifier(verifier); var setDefault = HttpsURLConnection.setDefaultHostnameVerifier.overload( 'javax.net.ssl.HostnameVerifier' ); setDefault.implementation = function () { return setDefault.call(this, verifier); }; var getDefault = HttpsURLConnection.getDefaultHostnameVerifier.overload(); getDefault.implementation = function () { return verifier; }; var setInstance = HttpsURLConnection.setHostnameVerifier.overload( 'javax.net.ssl.HostnameVerifier' ); setInstance.implementation = function () { return setInstance.call(this, verifier); }; return true; }); } function installConscryptHooks() { [ 'com.android.org.conscrypt.TrustManagerImpl', 'org.conscrypt.TrustManagerImpl', 'com.google.android.gms.org.conscrypt.TrustManagerImpl' ].forEach(function (className) { hookTrustCheck( className, 'checkServerTrusted', 'Conscrypt checkServerTrusted' ); hookTrustCheck(className, 'checkTrusted', 'Conscrypt checkTrusted'); hookAll(className, 'checkTrustedRecursive', 'Conscrypt checkTrustedRecursive', function () { return function () { hit('Conscrypt checkTrustedRecursive'); return useClass('java.util.ArrayList').$new(); }; }); hookAll(className, 'verifyChain', 'Conscrypt verifyChain', function () { return function (untrustedChain) { hit('Conscrypt verifyChain'); return untrustedChain; }; }); }); hookAll( 'android.net.http.X509TrustManagerExtensions', 'checkServerTrusted', 'X509TrustManagerExtensions checkServerTrusted', function () { return function (chain) { hit('X509TrustManagerExtensions checkServerTrusted'); return certificateListFromChain(chain); }; } ); [ 'com.android.org.conscrypt.Platform', 'org.conscrypt.Platform', 'com.google.android.gms.org.conscrypt.Platform' ].forEach(function (className) { hookPermissive(className, 'checkServerTrusted', 'Conscrypt Platform checkServerTrusted'); }); [ 'android.security.net.config.NetworkSecurityTrustManager', 'android.security.net.config.RootTrustManager' ].forEach(function (className) { hookTrustCheck( className, 'checkServerTrusted', 'Android Network Security checkServerTrusted' ); }); } function installWebViewHooks() { installOnce('WebView SslErrorHandler.cancel -> proceed', function () { var Handler = useClass('android.webkit.SslErrorHandler'); var cancel = Handler.cancel.overload(); cancel.implementation = function () { hit('WebView SslErrorHandler.cancel -> proceed'); return this.proceed(); }; return true; }); [ 'android.webkit.WebViewClient', 'org.apache.cordova.CordovaWebViewClient', 'com.getcapacitor.BridgeWebViewClient' ].forEach(function (className) { var key = 'WebView SSL handler [' + className + ']'; installOnce(key, function () { var Client = useClass(className); var sslError = Client.onReceivedSslError.overload( 'android.webkit.WebView', 'android.webkit.SslErrorHandler', 'android.net.http.SslError' ); sslError.implementation = function (webView, handler) { hit(key); handler.proceed(); }; return true; }); }); } function installCronetHooks() { [ 'org.chromium.net.impl.CronetEngineBuilderImpl', 'org.chromium.net.ExperimentalCronetEngine$Builder', 'org.chromium.net.CronetEngine$Builder' ].forEach(function (className) { hookAll( className, 'enablePublicKeyPinningBypassForLocalTrustAnchors', 'Cronet local-anchor pinning bypass', function (overload) { return function () { hit('Cronet local-anchor pinning bypass'); return overload.call(this, true); }; } ); hookAll(className, 'addPublicKeyPins', 'Cronet addPublicKeyPins', function (overload) { return function (hostname) { hit('Cronet pin ignored: ' + hostname); return returnTypeName(overload) === 'void' ? undefined : this; }; }); }); } function installKnownLibraryHooks() { var hooks = [ ['okhttp3.CertificatePinner', 'check', 'OkHTTP3 CertificatePinner'], ['okhttp3.CertificatePinner', 'check$okhttp', 'OkHTTP3/Kotlin CertificatePinner'], ['okhttp3.internal.tls.OkHostnameVerifier', 'verify', 'OkHTTP3 hostname verifier'], ['com.squareup.okhttp.CertificatePinner', 'check', 'OkHTTP2 CertificatePinner'], ['com.datatheorem.android.trustkit.pinning.OkHostnameVerifier', 'verify', 'TrustKit hostname verifier'], ['com.datatheorem.android.trustkit.pinning.PinningTrustManager', 'checkServerTrusted', 'TrustKit PinningTrustManager'], ['appcelerator.https.PinningTrustManager', 'checkServerTrusted', 'Appcelerator PinningTrustManager'], ['io.fabric.sdk.android.services.network.PinningTrustManager', 'checkServerTrusted', 'Fabric PinningTrustManager'], ['com.android.org.conscrypt.CertPinManager', 'checkChainPinning', 'Conscrypt CertPinManager'], ['com.android.org.conscrypt.CertPinManager', 'isChainValid', 'Conscrypt legacy CertPinManager'], ['org.conscrypt.CertPinManager', 'checkChainPinning', 'Standalone Conscrypt CertPinManager'], ['com.google.android.gms.org.conscrypt.CertPinManager', 'checkChainPinning', 'Google Play Conscrypt CertPinManager'], ['android.security.net.config.NetworkSecurityTrustManager', 'checkPins', 'Android Network Security Config pins'], ['com.commonsware.cwac.netsecurity.conscrypt.CertPinManager', 'isChainValid', 'CWAC CertPinManager'], ['io.netty.handler.ssl.util.FingerprintTrustManagerFactory', 'checkTrusted', 'Netty FingerprintTrustManager'], ['org.jboss.netty.handler.ssl.util.FingerprintTrustManagerFactory', 'checkTrusted', 'JBoss Netty FingerprintTrustManager'], ['com.android.okhttp.CertificatePinner', 'check', 'Android OkHTTP CertificatePinner'], ['com.android.okhttp.internal.tls.OkHostnameVerifier', 'verify', 'Android OkHTTP hostname verifier'], ['io.grpc.okhttp.internal.tls.OkHostnameVerifier', 'verify', 'gRPC OkHTTP hostname verifier'], ['com.squareup.okhttp.internal.tls.OkHostnameVerifier', 'verify', 'Square OkHostnameVerifier'], ['ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier', 'verify', 'Boye AbstractVerifier'], ['org.apache.http.conn.ssl.AbstractVerifier', 'verify', 'Apache AbstractVerifier'], ['org.apache.http.conn.ssl.BrowserCompatHostnameVerifier', 'verify', 'Apache BrowserCompatHostnameVerifier'], ['org.apache.http.conn.ssl.StrictHostnameVerifier', 'verify', 'Apache StrictHostnameVerifier'], ['org.apache.http.conn.ssl.AllowAllHostnameVerifier', 'verify', 'Apache AllowAllHostnameVerifier'], ['com.google.android.gms.common.net.SSLCertificateSocketFactory', 'verifyHostname', 'Google Play SSL hostname verifier'], ['nl.xservices.plugins.sslCertificateChecker', 'execute', 'PhoneGap sslCertificateChecker'], ['nl.xservices.plugins.SSLCertificateChecker', 'execute', 'PhoneGap SSLCertificateChecker'], ['com.worklight.androidgap.plugin.WLCertificatePinningPlugin', 'execute', 'WorkLight Cordova pinning'], ['com.worklight.wlclient.api.WLClient', 'pinTrustedCertificatePublicKey', 'IBM MobileFirst pinning'], ['com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning', 'verify', 'IBM WorkLight hostname verifier'], ['diefferson.http_certificate_pinning.HttpCertificatePinning', 'checkConnexion', 'Flutter http_certificate_pinning plugin'], ['com.macif.plugin.sslpinningplugin.SslPinningPlugin', 'checkConnexion', 'Flutter ssl_pinning_plugin'] ]; hooks.forEach(function (spec) { hookPermissive(spec[0], spec[1], spec[2]); }); [ 'com.android.org.conscrypt.OpenSSLSocketImpl', 'com.android.org.conscrypt.OpenSSLEngineSocketImpl', 'com.android.org.conscrypt.ConscryptFileDescriptorSocket', 'com.android.org.conscrypt.ConscryptEngineSocket', 'com.android.org.conscrypt.ConscryptEngine', 'com.android.org.conscrypt.OpenSSLEngineImpl', 'org.conscrypt.OpenSSLSocketImpl', 'org.conscrypt.OpenSSLEngineSocketImpl', 'org.conscrypt.ConscryptFileDescriptorSocket', 'org.conscrypt.ConscryptEngineSocket', 'org.conscrypt.ConscryptEngine', 'org.conscrypt.OpenSSLEngineImpl', 'com.google.android.gms.org.conscrypt.OpenSSLSocketImpl', 'com.google.android.gms.org.conscrypt.ConscryptFileDescriptorSocket', 'com.google.android.gms.org.conscrypt.ConscryptEngineSocket', 'com.google.android.gms.org.conscrypt.ConscryptEngine', 'org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl' ].forEach(function (className) { hookPermissive(className, 'verifyCertificateChain', 'Conscrypt/OpenSSL certificate verification'); }); } function installDynamicExceptionPatcher() { if (!CONFIG.enableDynamicExceptionFallback) { return; } installOnce('SSLPeerUnverifiedException dynamic fallback', function () { var Exception = useClass('javax.net.ssl.SSLPeerUnverifiedException'); var constructor = Exception.$init.overload('java.lang.String'); constructor.implementation = function (message) { try { var trace = Java.backtrace({ limit: 32 }).frames; var caller = null; var passedExceptionConstructor = false; for (var i = 0; i < trace.length; i++) { var frameClass = String(trace[i].className || ''); if (frameClass === 'javax.net.ssl.SSLPeerUnverifiedException') { passedExceptionConstructor = true; continue; } if (passedExceptionConstructor && frameClass !== 'java.lang.Thread' && frameClass !== 'dalvik.system.VMStack') { caller = trace[i]; break; } } if (caller !== null) { var className = String(caller.className); var methodName = String(caller.methodName); var key = 'Dynamic pinning fallback [' + className + '.' + methodName + ']'; installOnce(key, function () { var Target = useClass(className); var method = Target[methodName]; if (!method || !method.overloads) { throw new Error('caller is not hookable'); } method.overloads.forEach(function (overload) { overload.implementation = function () { hit(key); return permissiveReturn(overload, this); }; }); return true; }); } } catch (error) { info('Dynamic fallback could not patch caller: ' + shortError(error)); } return constructor.call(this, message); }; return true; }); } function findGlobalExport(symbolName) { if (nativeSymbolCache[symbolName]) { return nativeSymbolCache[symbolName]; } for (var i = 0; i < nativeModulesSnapshot.length; i++) { var module = nativeModulesSnapshot[i]; if (!isTlsModuleName(module.name)) { continue; } try { var localAddress = module.findExportByName(symbolName); if (localAddress !== null) { nativeSymbolCache[symbolName] = localAddress; return localAddress; } } catch (_) {} } try { if (typeof Module.findGlobalExportByName === 'function') { var globalAddress = Module.findGlobalExportByName(symbolName); if (globalAddress !== null) { nativeSymbolCache[symbolName] = globalAddress; } return globalAddress; } if (typeof Module.findExportByName === 'function') { var legacyAddress = Module.findExportByName(null, symbolName); if (legacyAddress !== null) { nativeSymbolCache[symbolName] = legacyAddress; } return legacyAddress; } } catch (_) { return null; } return null; } function isTlsModuleName(moduleName) { return /(ssl|crypto|conscrypt|boring|cronet|flutter|monochrome|webview|curl|mbedtls|wolfssl|gnutls|nss3)/i.test( String(moduleName || '') ); } function refreshNativeModules() { try { nativeModulesSnapshot = Process.enumerateModules(); } catch (_) { nativeModulesSnapshot = []; } } function installNativeCallbackSetter( symbolName, callbackIndex, successValue, callbackArgumentTypes ) { var key = 'Native TLS verifier [' + symbolName + ']'; installOnce(key, function () { var address = findGlobalExport(symbolName); if (address === null) { throw new Error('symbol not loaded'); } var callback = new NativeCallback(function () { return successValue; }, 'int', callbackArgumentTypes); nativeKeepAlive.push(callback); var listener = Interceptor.attach(address, { onEnter: function (args) { args[callbackIndex] = callback; hit(symbolName + ' callback replaced'); } }); nativeKeepAlive.push(listener); return true; }); } function installNativeReturnHook(symbolName, successValue) { var key = 'Native TLS result [' + symbolName + ']'; installOnce(key, function () { var address = findGlobalExport(symbolName); if (address === null) { throw new Error('symbol not loaded'); } var addressKey = 'return:' + String(address); if (nativeHookedAddresses[addressKey]) { return true; } var listener = Interceptor.attach(address, { onLeave: function (retval) { retval.replace(successValue); hit(symbolName); } }); nativeKeepAlive.push(listener); nativeHookedAddresses[addressKey] = true; return true; }); } function installNativeArgumentHook(symbolName, argumentIndex, replacementValue) { var key = 'Native TLS argument [' + symbolName + ']'; installOnce(key, function () { var address = findGlobalExport(symbolName); if (address === null) { throw new Error('symbol not loaded'); } var addressKey = 'argument:' + String(address) + ':' + argumentIndex; if (nativeHookedAddresses[addressKey]) { return true; } var listener = Interceptor.attach(address, { onEnter: function (args) { args[argumentIndex] = ptr(replacementValue); hit(symbolName + ' argument forced to ' + replacementValue); } }); nativeKeepAlive.push(listener); nativeHookedAddresses[addressKey] = true; return true; }); } function installNativeStatusPointerHook( symbolName, statusArgumentIndex, successValue ) { var key = 'Native TLS status [' + symbolName + ']'; installOnce(key, function () { var address = findGlobalExport(symbolName); if (address === null) { throw new Error('symbol not loaded'); } var addressKey = 'status:' + String(address) + ':' + statusArgumentIndex; if (nativeHookedAddresses[addressKey]) { return true; } var listener = Interceptor.attach(address, { onEnter: function (args) { this.statusPointer = args[statusArgumentIndex]; }, onLeave: function (retval) { try { if (this.statusPointer && !this.statusPointer.isNull()) { this.statusPointer.writeU32(0); } } catch (_) {} retval.replace(successValue); hit(symbolName + ' status cleared'); } }); nativeKeepAlive.push(listener); nativeHookedAddresses[addressKey] = true; return true; }); } function installAlternativeNativeTlsHooks() { if (!CONFIG.enableAlternativeTlsHooks) { return; } // mbedTLS: clear verification flags and preserve all normal side effects. installNativeStatusPointerHook('mbedtls_x509_crt_verify', 4, 0); installNativeStatusPointerHook('mbedtls_x509_crt_verify_with_profile', 5, 0); installNativeStatusPointerHook('mbedtls_x509_crt_verify_restartable', 5, 0); // GnuTLS: success is 0 and the status output must also be 0. installNativeStatusPointerHook('gnutls_certificate_verify_peers2', 1, 0); installNativeStatusPointerHook('gnutls_certificate_verify_peers3', 2, 0); installNativeStatusPointerHook('gnutls_x509_crt_verify', 4, 0); // wolfSSL/OpenSSL compatibility and NSS return conventions. installNativeReturnHook('wolfSSL_get_verify_result', 0); installNativeReturnHook('wolfSSL_X509_verify_cert', 1); installNativeReturnHook('wolfSSL_CertManagerVerifyBuffer', 1); installNativeReturnHook('CERT_VerifyCert', 0); installNativeReturnHook('CERT_VerifyCertNow', 0); installNativeReturnHook('CERT_VerifyCertName', 0); } function installCurlHook() { if (!CONFIG.enableCurlHooks) { return; } installOnce('libcurl TLS options', function () { var address = findGlobalExport('curl_easy_setopt'); if (address === null) { throw new Error('curl_easy_setopt is not loaded'); } var listener = Interceptor.attach(address, { onEnter: function (args) { var option = args[1].toInt32(); // CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST. if (option === 64 || option === 81) { args[2] = ptr(0); hit('libcurl disabled TLS verification option ' + option); // CURLOPT_PINNEDPUBLICKEY. } else if (option === 10230) { args[2] = ptr(0); hit('libcurl disabled CURLOPT_PINNEDPUBLICKEY'); } } }); nativeKeepAlive.push(listener); return true; }); } function findFlutterVerifier() { var modules = nativeModulesSnapshot.length > 0 ? nativeModulesSnapshot : Process.enumerateModules(); for (var i = 0; i < modules.length; i++) { var module = modules[i]; if (module.name.indexOf('libflutter.so') === -1 && module.name.indexOf('libcronet') === -1) { continue; } var moduleKey = module.name + '@' + String(module.base); if (scannedVerifierModules[moduleKey]) { continue; } try { var symbols = module.enumerateSymbols(); scannedVerifierModules[moduleKey] = true; for (var j = 0; j < symbols.length; j++) { var symbolName = String(symbols[j].name); if (symbolName.indexOf('ssl_verify_peer_cert') !== -1 || symbolName.indexOf('verify_peer_cert') !== -1) { return symbols[j].address; } } } catch (_) { // Stripped modules may not expose a symbol table. } } return null; } function installFlutterNativeHook() { var key = 'Flutter/Cronet native peer verifier'; installOnce(key, function () { var address = findFlutterVerifier(); if (address === null) { throw new Error('verifier symbol not loaded or stripped'); } var addressKey = 'replace:' + String(address); if (nativeHookedAddresses[addressKey] || nativeHookedAddresses['return:' + String(address)]) { return true; } var replacement = new NativeCallback(function () { hit('Flutter/Cronet ssl_verify_peer_cert'); return 0; }, 'int', ['pointer', 'pointer']); nativeKeepAlive.push(replacement); Interceptor.replace(address, replacement); nativeHookedAddresses[addressKey] = true; return true; }); } function installModuleObserver() { if (!CONFIG.enableModuleObserver) { return; } installOnce('Native module-load observer', function () { if (typeof Process.attachModuleObserver !== 'function') { throw new Error('module observer is unavailable in this Frida version'); } var observer = Process.attachModuleObserver({ onAdded: function (module) { if (!isTlsModuleName(module.name)) { return; } if (nativeRefreshTimer !== null) { clearTimeout(nativeRefreshTimer); } nativeRefreshTimer = setTimeout(function () { nativeRefreshTimer = null; refreshNativeModules(); installNativeTlsHooks(); }, 75); } }); nativeKeepAlive.push(observer); return true; }); } function installNativeTlsHooks() { if (!CONFIG.enableNativeTlsHooks) { return; } refreshNativeModules(); // BoringSSL callbacks return ssl_verify_ok (0). installNativeCallbackSetter('SSL_set_custom_verify', 2, 0, ['pointer', 'pointer']); installNativeCallbackSetter('SSL_CTX_set_custom_verify', 2, 0, ['pointer', 'pointer']); // OpenSSL callbacks return 1 for a successful pre-verification. installNativeCallbackSetter('SSL_set_verify', 2, 1, ['int', 'pointer']); installNativeCallbackSetter('SSL_CTX_set_verify', 2, 1, ['int', 'pointer']); installNativeCallbackSetter( 'SSL_CTX_set_cert_verify_callback', 1, 1, ['pointer', 'pointer'] ); // Common native result checks used by OpenSSL/BoringSSL based stacks. installNativeReturnHook('SSL_get_verify_result', 0); installNativeReturnHook('X509_verify_cert', 1); installNativeReturnHook('X509_check_host', 1); installNativeReturnHook('X509_check_ip', 1); installNativeReturnHook('X509_check_ip_asc', 1); installNativeReturnHook('SSL_set1_host', 1); installNativeReturnHook('X509_VERIFY_PARAM_set1_host', 1); installNativeReturnHook('X509_VERIFY_PARAM_set1_ip_asc', 1); installNativeReturnHook('X509_STORE_CTX_get_error', 0); installNativeReturnHook('ssl_verify_peer_cert', 0); if (CONFIG.enableAggressiveNativeHooks) { installNativeArgumentHook('SSL_set_verify_result', 1, 0); installNativeArgumentHook('X509_STORE_CTX_set_error', 1, 0); } installCurlHook(); installAlternativeNativeTlsHooks(); installFlutterNativeHook(); } function installCoreJavaHooks() { installTrustManagerHooks(); installConscryptHooks(); } function installExtendedJavaHooks() { installWebViewHooks(); installCronetHooks(); installKnownLibraryHooks(); installDynamicInterfaceHooks(); installDynamicExceptionPatcher(); } function requestJavaHooks(includeExtended) { if (includeExtended) { fullJavaInstallRequested = true; } if (typeof Java === 'undefined' || !Java.available) { if (attempt <= 1) { info('Java bridge is not available yet; retrying.'); } return; } if (javaInstallPending) { return; } javaInstallPending = true; var requestId = ++nextJavaRequestId; activeJavaRequestId = requestId; var watchdog = setTimeout(function () { if (activeJavaRequestId === requestId) { activeJavaRequestId = 0; javaInstallPending = false; misses['Java bridge watchdog'] = 'Java.perform callback timed out'; info('Java callback timed out; the next cycle will retry without blocking native hooks.'); } }, CONFIG.javaCallbackTimeoutMs); try { Java.perform(function () { if (activeJavaRequestId !== requestId) { return; } clearTimeout(watchdog); var runExtended = fullJavaInstallRequested; if (runExtended) { fullJavaInstallRequested = false; } try { installCoreJavaHooks(); if (runExtended) { installExtendedJavaHooks(); } delete misses['Java hook installer']; delete misses['Java bridge']; delete misses['Java bridge watchdog']; } catch (error) { misses['Java hook installer'] = shortError(error); if (runExtended) { fullJavaInstallRequested = true; } info('Java hooks will retry: ' + shortError(error)); } finally { activeJavaRequestId = 0; javaInstallPending = false; } }); } catch (error) { clearTimeout(watchdog); activeJavaRequestId = 0; javaInstallPending = false; misses['Java bridge'] = shortError(error); info('Java bridge will retry: ' + shortError(error)); } } function printSummary() { if (summaryPrinted) { return; } summaryPrinted = true; var installedCount = Object.keys(installed).length; var unresolvedCount = Object.keys(misses).length; info('Installation finished: ' + installedCount + ' hook groups active; ' + unresolvedCount + ' unavailable in this app (normal).'); info('Maintenance remains active for classes and TLS modules loaded later.'); info('If Frida reports ptrace/pokedata before this banner appears, the problem is frida-server/root/ROM, not this JavaScript file.'); } function tick() { attempt += 1; requestJavaHooks(true); installModuleObserver(); installNativeTlsHooks(); if (attempt >= CONFIG.maxAttempts) { clearInterval(retryTimer); retryTimer = null; if (maintenanceTimer === null) { maintenanceTimer = setInterval(function () { requestJavaHooks(true); installNativeTlsHooks(); }, CONFIG.maintenanceEveryMs); } setTimeout(printSummary, 250); } } console.log('============================================================'); console.log('[#] Android SSL Pinning Test - own app / physical root [#]'); console.log('============================================================'); info('PID=' + Process.id + ', arch=' + Process.arch + (typeof Frida !== 'undefined' ? ', Frida=' + Frida.version : '')); function startCoreHooksAfterResume() { info('Spawn-safe core phase: installing Java trust hooks.'); requestJavaHooks(false); } function startExtendedHooksAfterResume() { info('Spawn-safe extended phase: scanning app TLS stacks.'); installModuleObserver(); installNativeTlsHooks(); requestJavaHooks(true); attempt = 1; retryTimer = setInterval(tick, CONFIG.retryEveryMs); } info('Spawn-safe mode enabled: no Java/native scan runs at script load time.'); setTimeout(startCoreHooksAfterResume, CONFIG.coreDelayMs); setTimeout(startExtendedHooksAfterResume, CONFIG.startupDelayMs);

Project: union