setTimeout(function() { Java.perform(function() { console.log(''); console.log('================================================================='); console.log('[#] Android Bypass for various Certificate Pinning methods [#]'); console.log('================================================================='); var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager'); var SSLContext = Java.use('javax.net.ssl.SSLContext'); // TrustManager (Android < 7) // //////////////////////////////// var TrustManager = Java.registerClass({ // Implement a custom TrustManager name: 'dev.asd.test.TrustManager', implements: [X509TrustManager], methods: { checkClientTrusted: function(chain, authType) {}, checkServerTrusted: function(chain, authType) {}, getAcceptedIssuers: function() {return []; } } }); // Prepare the TrustManager array to pass to SSLContext.init() var TrustManagers = [TrustManager.$new()]; // Get a handle on the init() on the SSLContext class var SSLContext_init = SSLContext.init.overload( '[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom'); try { // Override the init method, specifying the custom TrustManager SSLContext_init.implementation = function(keyManager, trustManager, secureRandom) { console.log('[+] Bypassing Trustmanager (Android < 7) pinner'); SSLContext_init.call(this, keyManager, TrustManagers, secureRandom); }; } catch (err) { console.log('[-] TrustManager (Android < 7) pinner not found'); //console.log(err); } // OkHTTPv3 (quadruple bypass) // ///////////////////////////////// try { // Bypass OkHTTPv3 {1} var okhttp3_Activity_1 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_1.check.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {1}: ' + a); return; }; } catch (err) { console.log('[-] OkHTTPv3 {1} pinner not found'); //console.log(err); } try { // Bypass OkHTTPv3 {2} // This method of CertificatePinner.check is deprecated but could be found in some old Android apps var okhttp3_Activity_2 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_2.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {2}: ' + a); return; }; } catch (err) { console.log('[-] OkHTTPv3 {2} pinner not found'); //console.log(err); } try { // Bypass OkHTTPv3 {3} var okhttp3_Activity_3 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_3.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {3}: ' + a); return; }; } catch(err) { console.log('[-] OkHTTPv3 {3} pinner not found'); //console.log(err); } try { // Bypass OkHTTPv3 {4} var okhttp3_Activity_4 = Java.use('okhttp3.CertificatePinner'); //okhttp3_Activity_4['check$okhttp'].implementation = function(a, b) { okhttp3_Activity_4.check$okhttp.overload('java.lang.String', 'kotlin.jvm.functions.Function0').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {4}: ' + a); return; }; } catch(err) { console.log('[-] OkHTTPv3 {4} pinner not found'); //console.log(err); } // Trustkit (triple bypass) // ////////////////////////////// try { // Bypass Trustkit {1} var trustkit_Activity_1 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier'); trustkit_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) { console.log('[+] Bypassing Trustkit {1}: ' + a); return true; }; } catch (err) { console.log('[-] Trustkit {1} pinner not found'); //console.log(err); } try { // Bypass Trustkit {2} var trustkit_Activity_2 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier'); trustkit_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) { console.log('[+] Bypassing Trustkit {2}: ' + a); return true; }; } catch (err) { console.log('[-] Trustkit {2} pinner not found'); //console.log(err); } try { // Bypass Trustkit {3} var trustkit_PinningTrustManager = Java.use('com.datatheorem.android.trustkit.pinning.PinningTrustManager'); trustkit_PinningTrustManager.checkServerTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String').implementation = function(chain, authType) { console.log('[+] Bypassing Trustkit {3}'); //return; }; } catch (err) { console.log('[-] Trustkit {3} pinner not found'); //console.log(err); } // TrustManagerImpl (Android > 7) // //////////////////////////////////// try { // Bypass TrustManagerImpl (Android > 7) {1} var array_list = Java.use("java.util.ArrayList"); var TrustManagerImpl_Activity_1 = Java.use('com.android.org.conscrypt.TrustManagerImpl'); TrustManagerImpl_Activity_1.checkTrustedRecursive.implementation = function(certs, ocspData, tlsSctData, host, clientAuth, untrustedChain, trustAnchorChain, used) { console.log('[+] Bypassing TrustManagerImpl (Android > 7) checkTrustedRecursive check: '+ host); return array_list.$new(); }; } catch (err) { console.log('[-] TrustManagerImpl (Android > 7) checkTrustedRecursive check not found'); //console.log(err); } try { // Bypass TrustManagerImpl (Android > 7) {2} (probably no more necessary) var TrustManagerImpl_Activity_2 = Java.use('com.android.org.conscrypt.TrustManagerImpl'); TrustManagerImpl_Activity_2.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) { console.log('[+] Bypassing TrustManagerImpl (Android > 7) verifyChain check: ' + host); return untrustedChain; }; } catch (err) { console.log('[-] TrustManagerImpl (Android > 7) verifyChain check not found'); //console.log(err); } // Appcelerator Titanium PinningTrustManager // /////////////////////////////////////////////// try { var appcelerator_PinningTrustManager = Java.use('appcelerator.https.PinningTrustManager'); appcelerator_PinningTrustManager.checkServerTrusted.implementation = function(chain, authType) { console.log('[+] Bypassing Appcelerator PinningTrustManager'); return; }; } catch (err) { console.log('[-] Appcelerator PinningTrustManager pinner not found'); //console.log(err); } // Fabric PinningTrustManager // //////////////////////////////// try { var fabric_PinningTrustManager = Java.use('io.fabric.sdk.android.services.network.PinningTrustManager'); fabric_PinningTrustManager.checkServerTrusted.implementation = function(chain, authType) { console.log('[+] Bypassing Fabric PinningTrustManager'); return; }; } catch (err) { console.log('[-] Fabric PinningTrustManager pinner not found'); //console.log(err); } // OpenSSLSocketImpl Conscrypt (double bypass) // ///////////////////////////////////////////////// try { var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl'); OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certRefs, JavaObject, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Conscrypt {1}'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Conscrypt {1} pinner not found'); //console.log(err); } try { var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl'); OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certChain, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Conscrypt {2}'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Conscrypt {2} pinner not found'); //console.log(err); } // OpenSSLEngineSocketImpl Conscrypt // /////////////////////////////////////// try { var OpenSSLEngineSocketImpl_Activity = Java.use('com.android.org.conscrypt.OpenSSLEngineSocketImpl'); OpenSSLEngineSocketImpl_Activity.verifyCertificateChain.overload('[Ljava.lang.Long;', 'java.lang.String').implementation = function(a, b) { console.log('[+] Bypassing OpenSSLEngineSocketImpl Conscrypt: ' + b); }; } catch (err) { console.log('[-] OpenSSLEngineSocketImpl Conscrypt pinner not found'); //console.log(err); } // OpenSSLSocketImpl Apache Harmony // ////////////////////////////////////// try { var OpenSSLSocketImpl_Harmony = Java.use('org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl'); OpenSSLSocketImpl_Harmony.verifyCertificateChain.implementation = function(asn1DerEncodedCertificateChain, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Apache Harmony'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Apache Harmony pinner not found'); //console.log(err); } // PhoneGap sslCertificateChecker // //////////////////////////////////// try { var phonegap_Activity = Java.use('nl.xservices.plugins.sslCertificateChecker'); phonegap_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(a, b, c) { console.log('[+] Bypassing PhoneGap sslCertificateChecker: ' + a); return true; }; } catch (err) { console.log('[-] PhoneGap sslCertificateChecker pinner not found'); //console.log(err); } // IBM MobileFirst pinTrustedCertificatePublicKey (double bypass) // //////////////////////////////////////////////////////////////////// try { // Bypass IBM MobileFirst {1} var WLClient_Activity_1 = Java.use('com.worklight.wlclient.api.WLClient'); WLClient_Activity_1.getInstance().pinTrustedCertificatePublicKey.overload('java.lang.String').implementation = function(cert) { console.log('[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {1}: ' + cert); return; }; } catch (err) { console.log('[-] IBM MobileFirst pinTrustedCertificatePublicKey {1} pinner not found'); //console.log(err); } try { // Bypass IBM MobileFirst {2} var WLClient_Activity_2 = Java.use('com.worklight.wlclient.api.WLClient'); WLClient_Activity_2.getInstance().pinTrustedCertificatePublicKey.overload('[Ljava.lang.String;').implementation = function(cert) { console.log('[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {2}: ' + cert); return; }; } catch (err) { console.log('[-] IBM MobileFirst pinTrustedCertificatePublicKey {2} pinner not found'); //console.log(err); } // IBM WorkLight (ancestor of MobileFirst) HostNameVerifierWithCertificatePinning (quadruple bypass) // /////////////////////////////////////////////////////////////////////////////////////////////////////// try { // Bypass IBM WorkLight {1} var worklight_Activity_1 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSocket').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {1}: ' + a); return; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {1} pinner not found'); //console.log(err); } try { // Bypass IBM WorkLight {2} var worklight_Activity_2 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {2}: ' + a); return; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {2} pinner not found'); //console.log(err); } try { // Bypass IBM WorkLight {3} var worklight_Activity_3 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_3.verify.overload('java.lang.String', '[Ljava.lang.String;', '[Ljava.lang.String;').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {3}: ' + a); return; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {3} pinner not found'); //console.log(err); } try { // Bypass IBM WorkLight {4} var worklight_Activity_4 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_4.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {4}: ' + a); return true; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {4} pinner not found'); //console.log(err); } // Conscrypt CertPinManager // ////////////////////////////// try { var conscrypt_CertPinManager_Activity = Java.use('com.android.org.conscrypt.CertPinManager'); conscrypt_CertPinManager_Activity.checkChainPinning.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing Conscrypt CertPinManager: ' + a); //return; return true; }; } catch (err) { console.log('[-] Conscrypt CertPinManager pinner not found'); //console.log(err); } // Conscrypt CertPinManager (Legacy) // /////////////////////////////////////// try { var legacy_conscrypt_CertPinManager_Activity = Java.use('com.android.org.conscrypt.CertPinManager'); legacy_conscrypt_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing Conscrypt CertPinManager (Legacy): ' + a); return true; }; } catch (err) { console.log('[-] Conscrypt CertPinManager (Legacy) pinner not found'); //console.log(err); } // CWAC-Netsecurity (unofficial back-port pinner for Android<4.2) CertPinManager // /////////////////////////////////////////////////////////////////////////////////// try { var cwac_CertPinManager_Activity = Java.use('com.commonsware.cwac.netsecurity.conscrypt.CertPinManager'); cwac_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing CWAC-Netsecurity CertPinManager: ' + a); return true; }; } catch (err) { console.log('[-] CWAC-Netsecurity CertPinManager pinner not found'); //console.log(err); } // Worklight Androidgap WLCertificatePinningPlugin // ///////////////////////////////////////////////////// try { var androidgap_WLCertificatePinningPlugin_Activity = Java.use('com.worklight.androidgap.plugin.WLCertificatePinningPlugin'); androidgap_WLCertificatePinningPlugin_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(a, b, c) { console.log('[+] Bypassing Worklight Androidgap WLCertificatePinningPlugin: ' + a); return true; }; } catch (err) { console.log('[-] Worklight Androidgap WLCertificatePinningPlugin pinner not found'); //console.log(err); } // Netty FingerprintTrustManagerFactory // ////////////////////////////////////////// try { var netty_FingerprintTrustManagerFactory = Java.use('io.netty.handler.ssl.util.FingerprintTrustManagerFactory'); //NOTE: sometimes this below implementation could be useful //var netty_FingerprintTrustManagerFactory = Java.use('org.jboss.netty.handler.ssl.util.FingerprintTrustManagerFactory'); netty_FingerprintTrustManagerFactory.checkTrusted.implementation = function(type, chain) { console.log('[+] Bypassing Netty FingerprintTrustManagerFactory'); }; } catch (err) { console.log('[-] Netty FingerprintTrustManagerFactory pinner not found'); //console.log(err); } // Squareup CertificatePinner [OkHTTP stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException" ); // Retrieve the method raising the SSLPeerUnverifiedException var callingFunctionStack = stackTrace[exceptionStackIndex + 1]; var className = callingFunctionStack.getClassName(); var methodName = callingFunctionStack.getMethodName(); var callingClass = Java.use(className); var callingMethod = callingClass[methodName]; console.log('\x1b[36m[!] Attempting to bypass uncommon SSL Pinning method on: '+className+'.'+methodName+'\x1b[0m'); // Skip it when already patched by Frida if (callingMethod.implementation) { return; } // Trying to patch the uncommon SSL Pinning method via implementation var returnTypeName = callingMethod.returnType.type; callingMethod.implementation = function() { rudimentaryFix(returnTypeName); }; } catch (e) { // Dynamic patching via implementation does not works, then trying via function overloading //console.log('[!] The uncommon SSL Pinning method has more than one overload); if (String(e).includes(".overload")) { var splittedList = String(e).split(".overload"); for (let i=2; i 1 ? ' (x' + count + ')' : '')); } } function shortError(error) { var text = String(error); return text.length > 180 ? text.slice(0, 177) + '...' : text; } function installOnce(key, installer) { if (installed[key]) { return; } var now = Date.now(); if (retryAfter[key] && now < retryAfter[key]) { return; } try { var result = installer(); if (result === false) { throw new Error('not available yet'); } installed[key] = true; delete misses[key]; delete retryAfter[key]; ok(key); } catch (error) { misses[key] = shortError(error); retryAfter[key] = now + CONFIG.missRetryMs; } } function refreshClassFactories(force) { var now = Date.now(); if (!force && classFactoriesRefreshedAt !== 0 && now - classFactoriesRefreshedAt < CONFIG.classLoaderRefreshMs) { return; } var factories = []; try { Java.enumerateClassLoadersSync().forEach(function (loader) { try { factories.push(Java.ClassFactory.get(loader)); } catch (_) {} }); } catch (_) {} classFactories = factories; classFactoriesRefreshedAt = now; } function useClass(className) { if (classCache[className]) { return classCache[className]; } var primaryError = null; try { classCache[className] = Java.use(className); return classCache[className]; } catch (error) { primaryError = error; } refreshClassFactories(false); for (var i = 0; i < classFactories.length; i++) { try { var found = classFactories[i].use(className); classCache[className] = found; return found; } catch (_) {} } throw primaryError; } function returnTypeName(overload) { if (!overload || !overload.returnType) { return ''; } return String(overload.returnType.className || overload.returnType.type || ''); } function permissiveReturn(overload, receiver) { var typeName = returnTypeName(overload); if (typeName === 'void') { return; } if (typeName === 'boolean' || typeName === 'java.lang.Boolean') { return true; } if (typeName === 'byte' || typeName === 'short' || typeName === 'int' || typeName === 'long' || typeName === 'float' || typeName === 'double') { return 0; } if (typeName === 'char') { return '\u0000'; } try { if (receiver && receiver.$className && String(receiver.$className) === typeName) { return receiver; } } catch (_) {} return null; } function hookAll(className, methodName, displayName, implementationFactory) { var key = displayName + ' [' + className + '.' + methodName + ']'; installOnce(key, function () { var Target = useClass(className); var method = Target[methodName]; if (!method || !method.overloads || method.overloads.length === 0) { throw new Error('method not found'); } method.overloads.forEach(function (overload, index) { overload.implementation = implementationFactory(overload, index); }); return true; }); } function hookPermissive(className, methodName, displayName) { hookAll(className, methodName, displayName, function (overload) { return function () { var target = arguments.length > 0 ? String(arguments[0]) : ''; hit(displayName + (target ? ': ' + target : '')); return permissiveReturn(overload, this); }; }); } function certificateListFromChain(chain) { var ArrayList = useClass('java.util.ArrayList'); var result = ArrayList.$new(); if (chain) { try { if (chain.size && chain.get) { var listSize = Number(chain.size()); for (var listIndex = 0; listIndex < listSize; listIndex++) { result.add(chain.get(listIndex)); } return result; } for (var i = 0; i < chain.length; i++) { result.add(chain[i]); } } catch (_) {} } return result; } function hookTrustCheck(className, methodName, displayName) { hookAll(className, methodName, displayName, function (overload) { return function (chain) { hit(displayName); var typeName = returnTypeName(overload); if (typeName === 'void') { return; } if (typeName.indexOf('java.util.List') !== -1 || typeName.indexOf('java.util.Collection') !== -1) { return certificateListFromChain(chain); } if (typeName.charAt(0) === '[') { return chain; } return permissiveReturn(overload, this); }; }); } function enumerateMethodOwners(methodName) { var owners = Object.create(null); if (typeof Java.enumerateMethods !== 'function') { return owners; } var groups = Java.enumerateMethods('*!' + methodName + '/s'); groups.forEach(function (group) { (group.classes || []).forEach(function (entry) { if (entry && entry.name) { owners[String(entry.name)] = true; } }); }); return owners; } function installDynamicInterfaceHooks() { if (!CONFIG.enableDynamicInterfaceScan) { return; } var now = Date.now(); if (dynamicClassScanLast !== 0 && now - dynamicClassScanLast < CONFIG.dynamicClassScanEveryMs) { return; } dynamicClassScanLast = now; try { var TrustManager = useClass('javax.net.ssl.X509TrustManager'); var trustOwners = enumerateMethodOwners('checkServerTrusted'); Object.keys(trustOwners).forEach(function (className) { if (className === 'javax.net.ssl.X509TrustManager') { return; } try { var Target = useClass(className); if (TrustManager.class.isAssignableFrom(Target.class)) { hookTrustCheck( className, 'checkServerTrusted', 'Dynamic X509TrustManager' ); } } catch (_) {} }); var HostnameVerifier = useClass('javax.net.ssl.HostnameVerifier'); var verifierOwners = enumerateMethodOwners('verify'); Object.keys(verifierOwners).forEach(function (className) { if (className === 'javax.net.ssl.HostnameVerifier') { return; } try { var Target = useClass(className); if (HostnameVerifier.class.isAssignableFrom(Target.class)) { hookPermissive( className, 'verify', 'Dynamic HostnameVerifier' ); } } catch (_) {} }); delete misses['Dynamic Java interface scan']; } catch (error) { misses['Dynamic Java interface scan'] = shortError(error); } } function installTrustManagerHooks() { installOnce('SSLContext trust-all TrustManager', function () { var X509TrustManager = useClass('javax.net.ssl.X509TrustManager'); var SSLContext = useClass('javax.net.ssl.SSLContext'); var className = 'org.frida.generated.PhysicalDeviceTrustManager' + Process.id; var TrustAll; try { TrustAll = Java.registerClass({ name: className, implements: [X509TrustManager], methods: { checkClientTrusted: function () {}, checkServerTrusted: function () {}, getAcceptedIssuers: function () { return Java.array('java.security.cert.X509Certificate', []); } } }); } catch (_) { TrustAll = useClass(className); } var trustManagers = Java.array('javax.net.ssl.TrustManager', [TrustAll.$new()]); var init = SSLContext.init.overload( '[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom' ); init.implementation = function (keyManagers, ignoredTrustManagers, secureRandom) { hit('SSLContext.init'); return init.call(this, keyManagers, trustManagers, secureRandom); }; try { var permissiveContext = SSLContext.getInstance('TLS'); init.call(permissiveContext, null, trustManagers, null); trustAllSocketFactory = permissiveContext.getSocketFactory(); } catch (error) { info('Could not prebuild trust-all SSLSocketFactory: ' + shortError(error)); } return true; }); installOnce('HttpsURLConnection trust-all SSLSocketFactory', function () { if (trustAllSocketFactory === null) { throw new Error('trust-all SSLSocketFactory is not ready'); } var HttpsURLConnection = useClass('javax.net.ssl.HttpsURLConnection'); HttpsURLConnection.setDefaultSSLSocketFactory(trustAllSocketFactory); var setDefaultFactory = HttpsURLConnection.setDefaultSSLSocketFactory.overload( 'javax.net.ssl.SSLSocketFactory' ); setDefaultFactory.implementation = function () { hit('HttpsURLConnection.setDefaultSSLSocketFactory'); return setDefaultFactory.call(this, trustAllSocketFactory); }; var setInstanceFactory = HttpsURLConnection.setSSLSocketFactory.overload( 'javax.net.ssl.SSLSocketFactory' ); setInstanceFactory.implementation = function () { hit('HttpsURLConnection.setSSLSocketFactory'); return setInstanceFactory.call(this, trustAllSocketFactory); }; return true; }); installOnce('HttpsURLConnection permissive HostnameVerifier', function () { var HostnameVerifier = useClass('javax.net.ssl.HostnameVerifier'); var HttpsURLConnection = useClass('javax.net.ssl.HttpsURLConnection'); var className = 'org.frida.generated.AllowAllHostnameVerifier' + Process.id; var AllowAll; try { AllowAll = Java.registerClass({ name: className, implements: [HostnameVerifier], methods: { verify: function (hostname) { hit('HostnameVerifier: ' + hostname); return true; } } }); } catch (_) { AllowAll = useClass(className); } var verifier = AllowAll.$new(); HttpsURLConnection.setDefaultHostnameVerifier(verifier); var setDefault = HttpsURLConnection.setDefaultHostnameVerifier.overload( 'javax.net.ssl.HostnameVerifier' ); setDefault.implementation = function () { return setDefault.call(this, verifier); }; var getDefault = HttpsURLConnection.getDefaultHostnameVerifier.overload(); getDefault.implementation = function () { return verifier; }; var setInstance = HttpsURLConnection.setHostnameVerifier.overload( 'javax.net.ssl.HostnameVerifier' ); setInstance.implementation = function () { return setInstance.call(this, verifier); }; return true; }); } function installConscryptHooks() { [ 'com.android.org.conscrypt.TrustManagerImpl', 'org.conscrypt.TrustManagerImpl', 'com.google.android.gms.org.conscrypt.TrustManagerImpl' ].forEach(function (className) { hookTrustCheck( className, 'checkServerTrusted', 'Conscrypt checkServerTrusted' ); hookTrustCheck(className, 'checkTrusted', 'Conscrypt checkTrusted'); hookAll(className, 'checkTrustedRecursive', 'Conscrypt checkTrustedRecursive', function () { return function () { hit('Conscrypt checkTrustedRecursive'); return useClass('java.util.ArrayList').$new(); }; }); hookAll(className, 'verifyChain', 'Conscrypt verifyChain', function () { return function (untrustedChain) { hit('Conscrypt verifyChain'); return untrustedChain; }; }); }); hookAll( 'android.net.http.X509TrustManagerExtensions', 'checkServerTrusted', 'X509TrustManagerExtensions checkServerTrusted', function () { return function (chain) { hit('X509TrustManagerExtensions checkServerTrusted'); return certificateListFromChain(chain); }; } ); [ 'com.android.org.conscrypt.Platform', 'org.conscrypt.Platform', 'com.google.android.gms.org.conscrypt.Platform' ].forEach(function (className) { hookPermissive(className, 'checkServerTrusted', 'Conscrypt Platform checkServerTrusted'); }); [ 'android.security.net.config.NetworkSecurityTrustManager', 'android.security.net.config.RootTrustManager' ].forEach(function (className) { hookTrustCheck( className, 'checkServerTrusted', 'Android Network Security checkServerTrusted' ); }); } function installWebViewHooks() { installOnce('WebView SslErrorHandler.cancel -> proceed', function () { var Handler = useClass('android.webkit.SslErrorHandler'); var cancel = Handler.cancel.overload(); cancel.implementation = function () { hit('WebView SslErrorHandler.cancel -> proceed'); return this.proceed(); }; return true; }); [ 'android.webkit.WebViewClient', 'org.apache.cordova.CordovaWebViewClient', 'com.getcapacitor.BridgeWebViewClient' ].forEach(function (className) { var key = 'WebView SSL handler [' + className + ']'; installOnce(key, function () { var Client = useClass(className); var sslError = Client.onReceivedSslError.overload( 'android.webkit.WebView', 'android.webkit.SslErrorHandler', 'android.net.http.SslError' ); sslError.implementation = function (webView, handler) { hit(key); handler.proceed(); }; return true; }); }); } function installCronetHooks() { [ 'org.chromium.net.impl.CronetEngineBuilderImpl', 'org.chromium.net.ExperimentalCronetEngine$Builder', 'org.chromium.net.CronetEngine$Builder' ].forEach(function (className) { hookAll( className, 'enablePublicKeyPinningBypassForLocalTrustAnchors', 'Cronet local-anchor pinning bypass', function (overload) { return function () { hit('Cronet local-anchor pinning bypass'); return overload.call(this, true); }; } ); hookAll(className, 'addPublicKeyPins', 'Cronet addPublicKeyPins', function (overload) { return function (hostname) { hit('Cronet pin ignored: ' + hostname); return returnTypeName(overload) === 'void' ? undefined : this; }; }); }); } function installKnownLibraryHooks() { var hooks = [ ['okhttp3.CertificatePinner', 'check', 'OkHTTP3 CertificatePinner'], ['okhttp3.CertificatePinner', 'check$okhttp', 'OkHTTP3/Kotlin CertificatePinner'], ['okhttp3.internal.tls.OkHostnameVerifier', 'verify', 'OkHTTP3 hostname verifier'], ['com.squareup.okhttp.CertificatePinner', 'check', 'OkHTTP2 CertificatePinner'], ['com.datatheorem.android.trustkit.pinning.OkHostnameVerifier', 'verify', 'TrustKit hostname verifier'], ['com.datatheorem.android.trustkit.pinning.PinningTrustManager', 'checkServerTrusted', 'TrustKit PinningTrustManager'], ['appcelerator.https.PinningTrustManager', 'checkServerTrusted', 'Appcelerator PinningTrustManager'], ['io.fabric.sdk.android.services.network.PinningTrustManager', 'checkServerTrusted', 'Fabric PinningTrustManager'], ['com.android.org.conscrypt.CertPinManager', 'checkChainPinning', 'Conscrypt CertPinManager'], ['com.android.org.conscrypt.CertPinManager', 'isChainValid', 'Conscrypt legacy CertPinManager'], ['org.conscrypt.CertPinManager', 'checkChainPinning', 'Standalone Conscrypt CertPinManager'], ['com.google.android.gms.org.conscrypt.CertPinManager', 'checkChainPinning', 'Google Play Conscrypt CertPinManager'], ['android.security.net.config.NetworkSecurityTrustManager', 'checkPins', 'Android Network Security Config pins'], ['com.commonsware.cwac.netsecurity.conscrypt.CertPinManager', 'isChainValid', 'CWAC CertPinManager'], ['io.netty.handler.ssl.util.FingerprintTrustManagerFactory', 'checkTrusted', 'Netty FingerprintTrustManager'], ['org.jboss.netty.handler.ssl.util.FingerprintTrustManagerFactory', 'checkTrusted', 'JBoss Netty FingerprintTrustManager'], ['com.android.okhttp.CertificatePinner', 'check', 'Android OkHTTP CertificatePinner'], ['com.android.okhttp.internal.tls.OkHostnameVerifier', 'verify', 'Android OkHTTP hostname verifier'], ['io.grpc.okhttp.internal.tls.OkHostnameVerifier', 'verify', 'gRPC OkHTTP hostname verifier'], ['com.squareup.okhttp.internal.tls.OkHostnameVerifier', 'verify', 'Square OkHostnameVerifier'], ['ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier', 'verify', 'Boye AbstractVerifier'], ['org.apache.http.conn.ssl.AbstractVerifier', 'verify', 'Apache AbstractVerifier'], ['org.apache.http.conn.ssl.BrowserCompatHostnameVerifier', 'verify', 'Apache BrowserCompatHostnameVerifier'], ['org.apache.http.conn.ssl.StrictHostnameVerifier', 'verify', 'Apache StrictHostnameVerifier'], ['org.apache.http.conn.ssl.AllowAllHostnameVerifier', 'verify', 'Apache AllowAllHostnameVerifier'], ['com.google.android.gms.common.net.SSLCertificateSocketFactory', 'verifyHostname', 'Google Play SSL hostname verifier'], ['nl.xservices.plugins.sslCertificateChecker', 'execute', 'PhoneGap sslCertificateChecker'], ['nl.xservices.plugins.SSLCertificateChecker', 'execute', 'PhoneGap SSLCertificateChecker'], ['com.worklight.androidgap.plugin.WLCertificatePinningPlugin', 'execute', 'WorkLight Cordova pinning'], ['com.worklight.wlclient.api.WLClient', 'pinTrustedCertificatePublicKey', 'IBM MobileFirst pinning'], ['com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning', 'verify', 'IBM WorkLight hostname verifier'], ['diefferson.http_certificate_pinning.HttpCertificatePinning', 'checkConnexion', 'Flutter http_certificate_pinning plugin'], ['com.macif.plugin.sslpinningplugin.SslPinningPlugin', 'checkConnexion', 'Flutter ssl_pinning_plugin'] ]; hooks.forEach(function (spec) { hookPermissive(spec[0], spec[1], spec[2]); }); [ 'com.android.org.conscrypt.OpenSSLSocketImpl', 'com.android.org.conscrypt.OpenSSLEngineSocketImpl', 'com.android.org.conscrypt.ConscryptFileDescriptorSocket', 'com.android.org.conscrypt.ConscryptEngineSocket', 'com.android.org.conscrypt.ConscryptEngine', 'com.android.org.conscrypt.OpenSSLEngineImpl', 'org.conscrypt.OpenSSLSocketImpl', 'org.conscrypt.OpenSSLEngineSocketImpl', 'org.conscrypt.ConscryptFileDescriptorSocket', 'org.conscrypt.ConscryptEngineSocket', 'org.conscrypt.ConscryptEngine', 'org.conscrypt.OpenSSLEngineImpl', 'com.google.android.gms.org.conscrypt.OpenSSLSocketImpl', 'com.google.android.gms.org.conscrypt.ConscryptFileDescriptorSocket', 'com.google.android.gms.org.conscrypt.ConscryptEngineSocket', 'com.google.android.gms.org.conscrypt.ConscryptEngine', 'org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl' ].forEach(function (className) { hookPermissive(className, 'verifyCertificateChain', 'Conscrypt/OpenSSL certificate verification'); }); } function installDynamicExceptionPatcher() { if (!CONFIG.enableDynamicExceptionFallback) { return; } installOnce('SSLPeerUnverifiedException dynamic fallback', function () { var Exception = useClass('javax.net.ssl.SSLPeerUnverifiedException'); var constructor = Exception.$init.overload('java.lang.String'); constructor.implementation = function (message) { try { var trace = Java.backtrace({ limit: 32 }).frames; var caller = null; var passedExceptionConstructor = false; for (var i = 0; i < trace.length; i++) { var frameClass = String(trace[i].className || ''); if (frameClass === 'javax.net.ssl.SSLPeerUnverifiedException') { passedExceptionConstructor = true; continue; } if (passedExceptionConstructor && frameClass !== 'java.lang.Thread' && frameClass !== 'dalvik.system.VMStack') { caller = trace[i]; break; } } if (caller !== null) { var className = String(caller.className); var methodName = String(caller.methodName); var key = 'Dynamic pinning fallback [' + className + '.' + methodName + ']'; installOnce(key, function () { var Target = useClass(className); var method = Target[methodName]; if (!method || !method.overloads) { throw new Error('caller is not hookable'); } method.overloads.forEach(function (overload) { overload.implementation = function () { hit(key); return permissiveReturn(overload, this); }; }); return true; }); } } catch (error) { info('Dynamic fallback could not patch caller: ' + shortError(error)); } return constructor.call(this, message); }; return true; }); } function findGlobalExport(symbolName) { if (nativeSymbolCache[symbolName]) { return nativeSymbolCache[symbolName]; } for (var i = 0; i < nativeModulesSnapshot.length; i++) { var module = nativeModulesSnapshot[i]; if (!isTlsModuleName(module.name)) { continue; } try { var localAddress = module.findExportByName(symbolName); if (localAddress !== null) { nativeSymbolCache[symbolName] = localAddress; return localAddress; } } catch (_) {} } try { if (typeof Module.findGlobalExportByName === 'function') { var globalAddress = Module.findGlobalExportByName(symbolName); if (globalAddress !== null) { nativeSymbolCache[symbolName] = globalAddress; } return globalAddress; } if (typeof Module.findExportByName === 'function') { var legacyAddress = Module.findExportByName(null, symbolName); if (legacyAddress !== null) { nativeSymbolCache[symbolName] = legacyAddress; } return legacyAddress; } } catch (_) { return null; } return null; } function isTlsModuleName(moduleName) { return /(ssl|crypto|conscrypt|boring|cronet|flutter|monochrome|webview|curl|mbedtls|wolfssl|gnutls|nss3)/i.test( String(moduleName || '') ); } function refreshNativeModules() { try { nativeModulesSnapshot = Process.enumerateModules(); } catch (_) { nativeModulesSnapshot = []; } } function installNativeCallbackSetter( symbolName, callbackIndex, successValue, callbackArgumentTypes ) { var key = 'Native TLS verifier [' + symbolName + ']'; installOnce(key, function () { var address = findGlobalExport(symbolName); if (address === null) { throw new Error('symbol not loaded'); } var callback = new NativeCallback(function () { return successValue; }, 'int', callbackArgumentTypes); nativeKeepAlive.push(callback); var listener = Interceptor.attach(address, { onEnter: function (args) { args[callbackIndex] = callback; hit(symbolName + ' callback replaced'); } }); nativeKeepAlive.push(listener); return true; }); } function installNativeReturnHook(symbolName, successValue) { var key = 'Native TLS result [' + symbolName + ']'; installOnce(key, function () { var address = findGlobalExport(symbolName); if (address === null) { throw new Error('symbol not loaded'); } var addressKey = 'return:' + String(address); if (nativeHookedAddresses[addressKey]) { return true; } var listener = Interceptor.attach(address, { onLeave: function (retval) { retval.replace(successValue); hit(symbolName); } }); nativeKeepAlive.push(listener); nativeHookedAddresses[addressKey] = true; return true; }); } function installNativeArgumentHook(symbolName, argumentIndex, replacementValue) { var key = 'Native TLS argument [' + symbolName + ']'; installOnce(key, function () { var address = findGlobalExport(symbolName); if (address === null) { throw new Error('symbol not loaded'); } var addressKey = 'argument:' + String(address) + ':' + argumentIndex; if (nativeHookedAddresses[addressKey]) { return true; } var listener = Interceptor.attach(address, { onEnter: function (args) { args[argumentIndex] = ptr(replacementValue); hit(symbolName + ' argument forced to ' + replacementValue); } }); nativeKeepAlive.push(listener); nativeHookedAddresses[addressKey] = true; return true; }); } function installNativeStatusPointerHook( symbolName, statusArgumentIndex, successValue ) { var key = 'Native TLS status [' + symbolName + ']'; installOnce(key, function () { var address = findGlobalExport(symbolName); if (address === null) { throw new Error('symbol not loaded'); } var addressKey = 'status:' + String(address) + ':' + statusArgumentIndex; if (nativeHookedAddresses[addressKey]) { return true; } var listener = Interceptor.attach(address, { onEnter: function (args) { this.statusPointer = args[statusArgumentIndex]; }, onLeave: function (retval) { try { if (this.statusPointer && !this.statusPointer.isNull()) { this.statusPointer.writeU32(0); } } catch (_) {} retval.replace(successValue); hit(symbolName + ' status cleared'); } }); nativeKeepAlive.push(listener); nativeHookedAddresses[addressKey] = true; return true; }); } function installAlternativeNativeTlsHooks() { if (!CONFIG.enableAlternativeTlsHooks) { return; } // mbedTLS: clear verification flags and preserve all normal side effects. installNativeStatusPointerHook('mbedtls_x509_crt_verify', 4, 0); installNativeStatusPointerHook('mbedtls_x509_crt_verify_with_profile', 5, 0); installNativeStatusPointerHook('mbedtls_x509_crt_verify_restartable', 5, 0); // GnuTLS: success is 0 and the status output must also be 0. installNativeStatusPointerHook('gnutls_certificate_verify_peers2', 1, 0); installNativeStatusPointerHook('gnutls_certificate_verify_peers3', 2, 0); installNativeStatusPointerHook('gnutls_x509_crt_verify', 4, 0); // wolfSSL/OpenSSL compatibility and NSS return conventions. installNativeReturnHook('wolfSSL_get_verify_result', 0); installNativeReturnHook('wolfSSL_X509_verify_cert', 1); installNativeReturnHook('wolfSSL_CertManagerVerifyBuffer', 1); installNativeReturnHook('CERT_VerifyCert', 0); installNativeReturnHook('CERT_VerifyCertNow', 0); installNativeReturnHook('CERT_VerifyCertName', 0); } function installCurlHook() { if (!CONFIG.enableCurlHooks) { return; } installOnce('libcurl TLS options', function () { var address = findGlobalExport('curl_easy_setopt'); if (address === null) { throw new Error('curl_easy_setopt is not loaded'); } var listener = Interceptor.attach(address, { onEnter: function (args) { var option = args[1].toInt32(); // CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST. if (option === 64 || option === 81) { args[2] = ptr(0); hit('libcurl disabled TLS verification option ' + option); // CURLOPT_PINNEDPUBLICKEY. } else if (option === 10230) { args[2] = ptr(0); hit('libcurl disabled CURLOPT_PINNEDPUBLICKEY'); } } }); nativeKeepAlive.push(listener); return true; }); } function findFlutterVerifier() { var modules = nativeModulesSnapshot.length > 0 ? nativeModulesSnapshot : Process.enumerateModules(); for (var i = 0; i < modules.length; i++) { var module = modules[i]; if (module.name.indexOf('libflutter.so') === -1 && module.name.indexOf('libcronet') === -1) { continue; } var moduleKey = module.name + '@' + String(module.base); if (scannedVerifierModules[moduleKey]) { continue; } try { var symbols = module.enumerateSymbols(); scannedVerifierModules[moduleKey] = true; for (var j = 0; j < symbols.length; j++) { var symbolName = String(symbols[j].name); if (symbolName.indexOf('ssl_verify_peer_cert') !== -1 || symbolName.indexOf('verify_peer_cert') !== -1) { return symbols[j].address; } } } catch (_) { // Stripped modules may not expose a symbol table. } } return null; } function installFlutterNativeHook() { var key = 'Flutter/Cronet native peer verifier'; installOnce(key, function () { var address = findFlutterVerifier(); if (address === null) { throw new Error('verifier symbol not loaded or stripped'); } var addressKey = 'replace:' + String(address); if (nativeHookedAddresses[addressKey] || nativeHookedAddresses['return:' + String(address)]) { return true; } var replacement = new NativeCallback(function () { hit('Flutter/Cronet ssl_verify_peer_cert'); return 0; }, 'int', ['pointer', 'pointer']); nativeKeepAlive.push(replacement); Interceptor.replace(address, replacement); nativeHookedAddresses[addressKey] = true; return true; }); } function installModuleObserver() { if (!CONFIG.enableModuleObserver) { return; } installOnce('Native module-load observer', function () { if (typeof Process.attachModuleObserver !== 'function') { throw new Error('module observer is unavailable in this Frida version'); } var observer = Process.attachModuleObserver({ onAdded: function (module) { if (!isTlsModuleName(module.name)) { return; } if (nativeRefreshTimer !== null) { clearTimeout(nativeRefreshTimer); } nativeRefreshTimer = setTimeout(function () { nativeRefreshTimer = null; refreshNativeModules(); installNativeTlsHooks(); }, 75); } }); nativeKeepAlive.push(observer); return true; }); } function installNativeTlsHooks() { if (!CONFIG.enableNativeTlsHooks) { return; } refreshNativeModules(); // BoringSSL callbacks return ssl_verify_ok (0). installNativeCallbackSetter('SSL_set_custom_verify', 2, 0, ['pointer', 'pointer']); installNativeCallbackSetter('SSL_CTX_set_custom_verify', 2, 0, ['pointer', 'pointer']); // OpenSSL callbacks return 1 for a successful pre-verification. installNativeCallbackSetter('SSL_set_verify', 2, 1, ['int', 'pointer']); installNativeCallbackSetter('SSL_CTX_set_verify', 2, 1, ['int', 'pointer']); installNativeCallbackSetter( 'SSL_CTX_set_cert_verify_callback', 1, 1, ['pointer', 'pointer'] ); // Common native result checks used by OpenSSL/BoringSSL based stacks. installNativeReturnHook('SSL_get_verify_result', 0); installNativeReturnHook('X509_verify_cert', 1); installNativeReturnHook('X509_check_host', 1); installNativeReturnHook('X509_check_ip', 1); installNativeReturnHook('X509_check_ip_asc', 1); installNativeReturnHook('SSL_set1_host', 1); installNativeReturnHook('X509_VERIFY_PARAM_set1_host', 1); installNativeReturnHook('X509_VERIFY_PARAM_set1_ip_asc', 1); installNativeReturnHook('X509_STORE_CTX_get_error', 0); installNativeReturnHook('ssl_verify_peer_cert', 0); if (CONFIG.enableAggressiveNativeHooks) { installNativeArgumentHook('SSL_set_verify_result', 1, 0); installNativeArgumentHook('X509_STORE_CTX_set_error', 1, 0); } installCurlHook(); installAlternativeNativeTlsHooks(); installFlutterNativeHook(); } function installCoreJavaHooks() { installTrustManagerHooks(); installConscryptHooks(); } function installExtendedJavaHooks() { installWebViewHooks(); installCronetHooks(); installKnownLibraryHooks(); installDynamicInterfaceHooks(); installDynamicExceptionPatcher(); } function requestJavaHooks(includeExtended) { if (includeExtended) { fullJavaInstallRequested = true; } if (typeof Java === 'undefined' || !Java.available) { if (attempt <= 1) { info('Java bridge is not available yet; retrying.'); } return; } if (javaInstallPending) { return; } javaInstallPending = true; var requestId = ++nextJavaRequestId; activeJavaRequestId = requestId; var watchdog = setTimeout(function () { if (activeJavaRequestId === requestId) { activeJavaRequestId = 0; javaInstallPending = false; misses['Java bridge watchdog'] = 'Java.perform callback timed out'; info('Java callback timed out; the next cycle will retry without blocking native hooks.'); } }, CONFIG.javaCallbackTimeoutMs); try { Java.perform(function () { if (activeJavaRequestId !== requestId) { return; } clearTimeout(watchdog); var runExtended = fullJavaInstallRequested; if (runExtended) { fullJavaInstallRequested = false; } try { installCoreJavaHooks(); if (runExtended) { installExtendedJavaHooks(); } delete misses['Java hook installer']; delete misses['Java bridge']; delete misses['Java bridge watchdog']; } catch (error) { misses['Java hook installer'] = shortError(error); if (runExtended) { fullJavaInstallRequested = true; } info('Java hooks will retry: ' + shortError(error)); } finally { activeJavaRequestId = 0; javaInstallPending = false; } }); } catch (error) { clearTimeout(watchdog); activeJavaRequestId = 0; javaInstallPending = false; misses['Java bridge'] = shortError(error); info('Java bridge will retry: ' + shortError(error)); } } function printSummary() { if (summaryPrinted) { return; } summaryPrinted = true; var installedCount = Object.keys(installed).length; var unresolvedCount = Object.keys(misses).length; info('Installation finished: ' + installedCount + ' hook groups active; ' + unresolvedCount + ' unavailable in this app (normal).'); info('Maintenance remains active for classes and TLS modules loaded later.'); info('If Frida reports ptrace/pokedata before this banner appears, the problem is frida-server/root/ROM, not this JavaScript file.'); } function tick() { attempt += 1; requestJavaHooks(true); installModuleObserver(); installNativeTlsHooks(); if (attempt >= CONFIG.maxAttempts) { clearInterval(retryTimer); retryTimer = null; if (maintenanceTimer === null) { maintenanceTimer = setInterval(function () { requestJavaHooks(true); installNativeTlsHooks(); }, CONFIG.maintenanceEveryMs); } setTimeout(printSummary, 250); } } console.log('============================================================'); console.log('[#] Android SSL Pinning Test - own app / physical root [#]'); console.log('============================================================'); info('PID=' + Process.id + ', arch=' + Process.arch + (typeof Frida !== 'undefined' ? ', Frida=' + Frida.version : '')); function startCoreHooksAfterResume() { info('Spawn-safe core phase: installing Java trust hooks.'); requestJavaHooks(false); } function startExtendedHooksAfterResume() { info('Spawn-safe extended phase: scanning app TLS stacks.'); installModuleObserver(); installNativeTlsHooks(); requestJavaHooks(true); attempt = 1; retryTimer = setInterval(tick, CONFIG.retryEveryMs); } info('Spawn-safe mode enabled: no Java/native scan runs at script load time.'); setTimeout(startCoreHooksAfterResume, CONFIG.coreDelayMs); setTimeout(startExtendedHooksAfterResume, CONFIG.startupDelayMs); function bypass_wifi_check() { var classx = Java.use("android.net.ConnectivityManager"); var networkInfo = classx.getActiveNetworkInfo; networkInfo.implementation = function(args) { console.log('[!] Hook getActiveNetworkInfo()'); var netInfo = networkInfo.call(this); // console.log('\t[!] netInfo1: ' + netInfo); // when use SIM // [!] returnVal:[type: MOBILE[LTE], state: CONNECTED/CONNECTED, reason: (unspecified), extra: internet, failover: false, available: true, roaming: false] // return networkInfo.call(this); var networkInfo_class = Java.use("android.net.NetworkInfo"); // var networkInfo2 = networkInfo2.$new(1, 0, "WIFI", "subWifi"); var networkInfo2 = networkInfo_class.$new(0, 0, "MOBILE", "LTE"); var netDetailedState = Java.use("android.net.NetworkInfo$DetailedState"); networkInfo2.mIsAvailable.value = true; networkInfo2.setDetailedState(netDetailedState.CONNECTED.value, null, null); console.log('\t[!] return modified networkInfo'); // console.log('\t[!] netInfo2: ' + networkInfo2); return networkInfo2; }; var classx2 = Java.use("android.net.NetworkCapabilities"); var hasTransport = classx2.hasTransport; hasTransport.implementation = function(args) { console.log('[!] Hook NetworkCapabilities.hasTransport(i)'); console.log("\t[!] Hook hasTransport(" + args + ")"); var oldResult = hasTransport.call(this, args); console.log("\t[!] oldResult: " + oldResult); if (args === 0) { var newResult = true; console.log("\t[!] newResult: " + newResult); return newResult; } else { return false; } return false; }; } // Este script intenta evadir la detección de Frida de manera más compleja function antiFrida() { try { // Ofuscar el nombre de algunas funciones de Frida var fridaModule = Process.getModuleByName('frida'); var exports = fridaModule.enumerateExports(); for (var i = 0; i < exports.length; i++) { if (exports[i].name.includes('isDebuggerAttached')) { Interceptor.attach(exports[i].address, { onEnter: function (args) { console.log("[+] Frida detection bypass: isDebuggerAttached"); args[0] = ptr(0); // Modificar el primer argumento para indicar que no se detecta un depurador } }); } } // Cambiar el nombre de algunas clases de Frida Java.perform(function () { var fridaClasses = [ 'com.frida.Frida', 'com.frida.Agent', 'com.frida.Client', 'com.frida.Debug' ]; fridaClasses.forEach(function (className) { try { var targetClass = Java.use(className); targetClass.$dispose(); console.log("[+] Frida detection bypass: " + className); } catch (e) { // La clase no existe, continuar } }); }); console.log("[*] Anti-Frida script executed successfully"); } catch (e) { console.log("[-] Error during anti-Frida script execution:", e); } } // Ejecuta la función antiFrida setImmediate(antiFrida); // Este script intenta evadir la detección de Frida function antiFrida() { // Intenta cambiar el nombre de algunas funciones de Frida try { Java.use("frida").isDebuggerAttached.implementation = function () { return false; }; } catch (e) { console.log("Error al intentar cambiar la función de detección de Frida:", e); } // Intenta ofuscar el nombre de las funciones de Frida try { Interceptor.attach(Module.findExportByName(null, 'frida_agent_main'), { onEnter: function (args) { console.log("Entrando en frida_agent_main"); }, onLeave: function (retval) { console.log("Saliendo de frida_agent_main"); } }); } catch (e) { console.log("Error al intentar ofuscar el nombre de frida_agent_main:", e); } } // Ejecuta la función antiFrida antiFrida(); ///////////////////////////////////////////////////2 Java.perform(function() { var RootPackages = ["com.noshufou.android.su", "com.noshufou.android.su.elite", "eu.chainfire.supersu", "com.koushikdutta.superuser", "com.thirdparty.superuser", "com.yellowes.su", "com.koushikdutta.rommanager", "com.koushikdutta.rommanager.license", "com.dimonvideo.luckypatcher", "com.chelpus.lackypatch", "com.ramdroid.appquarantine", "com.ramdroid.appquarantinepro", "com.devadvance.rootcloak", "com.devadvance.rootcloakplus", "de.robv.android.xposed.installer", "com.saurik.substrate", "com.zachspong.temprootremovejb", "com.amphoras.hidemyroot", "com.amphoras.hidemyrootadfree", "com.formyhm.hiderootPremium", "com.formyhm.hideroot", "me.phh.superuser", "eu.chainfire.supersu.pro", "com.kingouser.com", "com.topjohnwu.magisk" ]; var RootBinaries = ["su", "busybox", "supersu", "Superuser.apk", "KingoUser.apk", "SuperSu.apk", "magisk"]; var RootProperties = { "ro.build.selinux": "1", "ro.debuggable": "0", "service.adb.root": "0", "ro.secure": "1" }; var RootPropertiesKeys = []; for (var k in RootProperties) RootPropertiesKeys.push(k); var PackageManager = Java.use("android.app.ApplicationPackageManager"); var Runtime = Java.use('java.lang.Runtime'); var NativeFile = Java.use('java.io.File'); var String = Java.use('java.lang.String'); var SystemProperties = Java.use('android.os.SystemProperties'); var BufferedReader = Java.use('java.io.BufferedReader'); var ProcessBuilder = Java.use('java.lang.ProcessBuilder'); var StringBuffer = Java.use('java.lang.StringBuffer'); var loaded_classes = Java.enumerateLoadedClassesSync(); send("Loaded " + loaded_classes.length + " classes!"); var useKeyInfo = false; var useProcessManager = false; send("loaded: " + loaded_classes.indexOf('java.lang.ProcessManager')); if (loaded_classes.indexOf('java.lang.ProcessManager') != -1) { try { //useProcessManager = true; //var ProcessManager = Java.use('java.lang.ProcessManager'); } catch (err) { send("ProcessManager Hook failed: " + err); } } else { send("ProcessManager hook not loaded"); } var KeyInfo = null; if (loaded_classes.indexOf('android.security.keystore.KeyInfo') != -1) { try { //useKeyInfo = true; //var KeyInfo = Java.use('android.security.keystore.KeyInfo'); } catch (err) { send("KeyInfo Hook failed: " + err); } } else { send("KeyInfo hook not loaded"); } PackageManager.getPackageInfo.overload('java.lang.String', 'int').implementation = function(pname, flags) { var shouldFakePackage = (RootPackages.indexOf(pname) > -1); if (shouldFakePackage) { send("Bypass root check for package: " + pname); pname = "set.package.name.to.a.fake.one.so.we.can.bypass.it"; } return this.getPackageInfo.overload('java.lang.String', 'int').call(this, pname, flags); }; NativeFile.exists.implementation = function() { var name = NativeFile.getName.call(this); var shouldFakeReturn = (RootBinaries.indexOf(name) > -1); if (shouldFakeReturn) { send("Bypass return value for binary: " + name); return false; } else { return this.exists.call(this); } }; var exec = Runtime.exec.overload('[Ljava.lang.String;'); var exec1 = Runtime.exec.overload('java.lang.String'); var exec2 = Runtime.exec.overload('java.lang.String', '[Ljava.lang.String;'); var exec3 = Runtime.exec.overload('[Ljava.lang.String;', '[Ljava.lang.String;'); var exec4 = Runtime.exec.overload('[Ljava.lang.String;', '[Ljava.lang.String;', 'java.io.File'); var exec5 = Runtime.exec.overload('java.lang.String', '[Ljava.lang.String;', 'java.io.File'); exec5.implementation = function(cmd, env, dir) { if (cmd.indexOf("getprop") != -1 || cmd == "mount" || cmd.indexOf("build.prop") != -1 || cmd == "id" || cmd == "sh") { var fakeCmd = "grep"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } if (cmd == "su") { var fakeCmd = "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } return exec5.call(this, cmd, env, dir); }; exec4.implementation = function(cmdarr, env, file) { for (var i = 0; i < cmdarr.length; i = i + 1) { var tmp_cmd = cmdarr[i]; if (tmp_cmd.indexOf("getprop") != -1 || tmp_cmd == "mount" || tmp_cmd.indexOf("build.prop") != -1 || tmp_cmd == "id" || tmp_cmd == "sh") { var fakeCmd = "grep"; send("Bypass " + cmdarr + " command"); return exec1.call(this, fakeCmd); } if (tmp_cmd == "su") { var fakeCmd = "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"; send("Bypass " + cmdarr + " command"); return exec1.call(this, fakeCmd); } } return exec4.call(this, cmdarr, env, file); }; exec3.implementation = function(cmdarr, envp) { for (var i = 0; i < cmdarr.length; i = i + 1) { var tmp_cmd = cmdarr[i]; if (tmp_cmd.indexOf("getprop") != -1 || tmp_cmd == "mount" || tmp_cmd.indexOf("build.prop") != -1 || tmp_cmd == "id" || tmp_cmd == "sh") { var fakeCmd = "grep"; send("Bypass " + cmdarr + " command"); return exec1.call(this, fakeCmd); } if (tmp_cmd == "su") { var fakeCmd = "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"; send("Bypass " + cmdarr + " command"); return exec1.call(this, fakeCmd); } } return exec3.call(this, cmdarr, envp); }; exec2.implementation = function(cmd, env) { if (cmd.indexOf("getprop") != -1 || cmd == "mount" || cmd.indexOf("build.prop") != -1 || cmd == "id" || cmd == "sh") { var fakeCmd = "grep"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } if (cmd == "su") { var fakeCmd = "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } return exec2.call(this, cmd, env); }; exec.implementation = function(cmd) { for (var i = 0; i < cmd.length; i = i + 1) { var tmp_cmd = cmd[i]; if (tmp_cmd.indexOf("getprop") != -1 || tmp_cmd == "mount" || tmp_cmd.indexOf("build.prop") != -1 || tmp_cmd == "id" || tmp_cmd == "sh") { var fakeCmd = "grep"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } if (tmp_cmd == "su") { var fakeCmd = "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } } return exec.call(this, cmd); }; exec1.implementation = function(cmd) { if (cmd.indexOf("getprop") != -1 || cmd == "mount" || cmd.indexOf("build.prop") != -1 || cmd == "id" || cmd == "sh") { var fakeCmd = "grep"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } if (cmd == "su") { var fakeCmd = "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } return exec1.call(this, cmd); }; String.contains.implementation = function(name) { if (name == "test-keys") { send("Bypass test-keys check"); return false; } return this.contains.call(this, name); }; var get = SystemProperties.get.overload('java.lang.String'); get.implementation = function(name) { if (RootPropertiesKeys.indexOf(name) != -1) { send("Bypass " + name); return RootProperties[name]; } return this.get.call(this, name); }; Interceptor.attach(Module.findExportByName("libc.so", "fopen"), { onEnter: function(args) { var path = Memory.readCString(args[0]); path = path.split("/"); var executable = path[path.length - 1]; var shouldFakeReturn = (RootBinaries.indexOf(executable) > -1) if (shouldFakeReturn) { Memory.writeUtf8String(args[0], "/notexists"); send("Bypass native fopen"); } }, onLeave: function(retval) { } }); Interceptor.attach(Module.findExportByName("libc.so", "system"), { onEnter: function(args) { var cmd = Memory.readCString(args[0]); send("SYSTEM CMD: " + cmd); if (cmd.indexOf("getprop") != -1 || cmd == "mount" || cmd.indexOf("build.prop") != -1 || cmd == "id") { send("Bypass native system: " + cmd); Memory.writeUtf8String(args[0], "grep"); } if (cmd == "su") { send("Bypass native system: " + cmd); Memory.writeUtf8String(args[0], "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"); } }, onLeave: function(retval) { } }); /* TO IMPLEMENT: Exec Family int execl(const char *path, const char *arg0, ..., const char *argn, (char *)0); int execle(const char *path, const char *arg0, ..., const char *argn, (char *)0, char *const envp[]); int execlp(const char *file, const char *arg0, ..., const char *argn, (char *)0); int execlpe(const char *file, const char *arg0, ..., const char *argn, (char *)0, char *const envp[]); int execv(const char *path, char *const argv[]); int execve(const char *path, char *const argv[], char *const envp[]); int execvp(const char *file, char *const argv[]); int execvpe(const char *file, char *const argv[], char *const envp[]); */ BufferedReader.readLine.overload('boolean').implementation = function() { var text = this.readLine.overload('boolean').call(this); if (text === null) { // just pass , i know it's ugly as hell but test != null won't work :( } else { var shouldFakeRead = (text.indexOf("ro.build.tags=test-keys") > -1); if (shouldFakeRead) { send("Bypass build.prop file read"); text = text.replace("ro.build.tags=test-keys", "ro.build.tags=release-keys"); } } return text; }; var executeCommand = ProcessBuilder.command.overload('java.util.List'); ProcessBuilder.start.implementation = function() { var cmd = this.command.call(this); var shouldModifyCommand = false; for (var i = 0; i < cmd.size(); i = i + 1) { var tmp_cmd = cmd.get(i).toString(); if (tmp_cmd.indexOf("getprop") != -1 || tmp_cmd.indexOf("mount") != -1 || tmp_cmd.indexOf("build.prop") != -1 || tmp_cmd.indexOf("id") != -1) { shouldModifyCommand = true; } } if (shouldModifyCommand) { send("Bypass ProcessBuilder " + cmd); this.command.call(this, ["grep"]); return this.start.call(this); } if (cmd.indexOf("su") != -1) { send("Bypass ProcessBuilder " + cmd); this.command.call(this, ["justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"]); return this.start.call(this); } return this.start.call(this); }; if (useProcessManager) { var ProcManExec = ProcessManager.exec.overload('[Ljava.lang.String;', '[Ljava.lang.String;', 'java.io.File', 'boolean'); var ProcManExecVariant = ProcessManager.exec.overload('[Ljava.lang.String;', '[Ljava.lang.String;', 'java.lang.String', 'java.io.FileDescriptor', 'java.io.FileDescriptor', 'java.io.FileDescriptor', 'boolean'); ProcManExec.implementation = function(cmd, env, workdir, redirectstderr) { var fake_cmd = cmd; for (var i = 0; i < cmd.length; i = i + 1) { var tmp_cmd = cmd[i]; if (tmp_cmd.indexOf("getprop") != -1 || tmp_cmd == "mount" || tmp_cmd.indexOf("build.prop") != -1 || tmp_cmd == "id") { var fake_cmd = ["grep"]; send("Bypass " + cmdarr + " command"); } if (tmp_cmd == "su") { var fake_cmd = ["justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"]; send("Bypass " + cmdarr + " command"); } } return ProcManExec.call(this, fake_cmd, env, workdir, redirectstderr); }; ProcManExecVariant.implementation = function(cmd, env, directory, stdin, stdout, stderr, redirect) { var fake_cmd = cmd; for (var i = 0; i < cmd.length; i = i + 1) { var tmp_cmd = cmd[i]; if (tmp_cmd.indexOf("getprop") != -1 || tmp_cmd == "mount" || tmp_cmd.indexOf("build.prop") != -1 || tmp_cmd == "id") { var fake_cmd = ["grep"]; send("Bypass " + cmdarr + " command"); } if (tmp_cmd == "su") { var fake_cmd = ["justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"]; send("Bypass " + cmdarr + " command"); } } return ProcManExecVariant.call(this, fake_cmd, env, directory, stdin, stdout, stderr, redirect); }; } if (useKeyInfo) { KeyInfo.isInsideSecureHardware.implementation = function() { send("Bypass isInsideSecureHardware"); return true; } } }); if (Java.available) { Java.perform(function() { try { var Activity = Java.use("com.learnium.RNDeviceInfo.RNDeviceModule"); Activity.isEmulator.implementation = function() { Promise.resolve(false) } } catch (error) { console.log("[-] Error Detected"); console.log((error.stack)); } }); } else { console.log("") console.log("[-] Java is Not available"); } const MODE = { SSLPeerUnverifiedException: true, HttpsURLConnection: true, SSLContext: true, TrustManagerImpl: true, OkHTTPv3: true, Trustkit: true, TitaniumPinningTrustManager: true, FabricPinningTrustManager: true, ConscryptOpenSSLSocketImpl: true, ConscryptOpenSSLEngineSocketImpl: true, ApacheOpenSSLSocketImpl: true, PhoneGapsslCertificateChecker: true, IBMMobileFirst: true, IBMWorkLight: true, ConscryptCertPinManager: true, NetsecurityCertPinManager: true, AndroidgapWorkLight: true, NettyFingerprintTrustManagerFactory: true, SquareupCertificatePinner: true, SquareupOkHostnameVerifier: true, AndroidWebViewClient: true, ApacheWebViewClient: true, BoyeAbstractVerifier: true, ApacheAbstractVerifier: true, Appmattus: true, ChromiumCronet: true, Flutter: true }; let index = 0; // color index const COLORS = { red: '\x1b[31m', green: '\x1b[32m', yellow: '\x1b[33m', blue: '\x1b[34m', magenta: '\x1b[35m', cyan: '\x1b[36m', reset: '\x1b[0m' }; const randomColor = () => { const colorKeys = Object.keys(COLORS).filter(key => key !== "reset" && key !== "red"); index = (index + 1) % colorKeys.length; return COLORS[colorKeys[index]]; } const rudimentaryFix = (typeName) => { if (typeName === "boolean") { return true; } else if (typeName !== "void") { return null; } } const loadJava = (library) => { try { return Java.use(library); } catch (e) { return undefined; } } setTimeout(function () { console.log("---"); console.log("Capturing Android app..."); if (Java.available) { console.log("[*] Java available"); Java.perform(function () { if (MODE.SSLPeerUnverifiedException) { const colorKey = randomColor(); try { const UnverifiedCertError = Java.use("javax.net.ssl.SSLPeerUnverifiedException"); UnverifiedCertError.$init.implementation = function (str) { console.log(`${COLORS.red}[!] Unexpected SSLPeerUnverifiedException occurred, trying to patch it dynamically...${COLORS.reset}`); let className, methodName, callingMethod, returnTypeName; try { const stackTrace = Java.use("java.lang.Thread").currentThread().getStackTrace(); const exceptionStackIndex = stackTrace.findIndex(stack => stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException" ); if (exceptionStackIndex === -1) { console.log(`${COLORS.yellow}[-] SSLPeerUnverifiedException not found in the stack trace.${COLORS.reset}`); return this.$init(str); } // Retrieve the method raising the SSLPeerUnverifiedException const callingFunctionStack = stackTrace[exceptionStackIndex + 1]; className = callingFunctionStack.getClassName(); methodName = callingFunctionStack.getMethodName(); const callingClass = Java.use(className); callingMethod = callingClass[methodName]; // Skip it when already patched by Frida if (callingMethod.implementation) { return; } // Trying to patch the uncommon SSL Pinning method via implementation returnTypeName = callingMethod.returnType.type; callingMethod.implementation = function () { rudimentaryFix(returnTypeName); }; console.log(`${colorKey} --> SSLPeerUnverifiedException [${className}.${methodName}]${COLORS.reset}`); } catch (e) { // Dynamic patching via implementation does not works, then trying via function overloading console.log(`${COLORS.red}[!] The uncommon SSL Pinning method has more than one overload${COLORS.reset}`); if (String(e).includes(".overload")) { const splittedList = String(e).split(".overload"); for (let i = 2; i < splittedList.length; i++) { const extractedOverload = splittedList[i].trim().split("(")[1].slice(0, -1).replaceAll("'", ""); // Check if extractedOverload has multiple arguments if (extractedOverload.includes(",")) { // Go here if overloaded method has multiple arguments (NOTE: max 6 args are covered here) const argList = extractedOverload.split(", "); // Overload the method based on the number of arguments callingMethod.overload(...argList).implementation = function (...args) { rudimentaryFix(returnTypeName); }; // Go here if overloaded method has a single argument } else { callingMethod.overload(extractedOverload).implementation = function (a) { rudimentaryFix(returnTypeName); }; } } console.log(`${colorKey} --> SSLPeerUnverifiedException [${className}.${methodName}]${COLORS.reset}`); } else { console.log(`${COLORS.red}[!] Failed to dynamically patch SSLPeerUnverifiedException ${e}${COLORS.reset}`); } } return this.$init(str); } } catch (e) { console.log(`${COLORS.red}[!] Failed to dynamically patch SSLPeerUnverifiedException ${e}${COLORS.reset}`); } } if (MODE.HttpsURLConnection) { const colorKey = randomColor(); const HttpsURLConnection = loadJava("javax.net.ssl.HttpsURLConnection"); try { HttpsURLConnection.setDefaultHostnameVerifier.implementation = function (hostnameVerifier) { console.log(`${colorKey} --> HttpsURLConnection [DefaultHostnameVerifier]${COLORS.reset}`); }; console.log("[+] HttpsURLConnection [DefaultHostnameVerifier]"); } catch (e) { console.log("[ ] HttpsURLConnection [DefaultHostnameVerifier]"); } try { HttpsURLConnection.setSSLSocketFactory.implementation = function (SSLSocketFactory) { console.log(`${colorKey} --> HttpsURLConnection [SSLSocketFactory]${COLORS.reset}`); }; console.log("[+] HttpsURLConnection [SSLSocketFactory]"); } catch (e) { console.log("[ ] HttpsURLConnection [SSLSocketFactory]"); } try { HttpsURLConnection.setHostnameVerifier.implementation = function (hostnameVerifier) { console.log(`${colorKey} --> HttpsURLConnection [HostnameVerifier]${COLORS.reset}`); }; console.log("[+] HttpsURLConnection [HostnameVerifier]"); } catch (e) { console.log("[ ] HttpsURLConnection [HostnameVerifier]"); } } if (MODE.SSLContext) { // TrustManager (Android < 7) const colorKey = randomColor(); try { const X509TrustManager = Java.use("javax.net.ssl.X509TrustManager"); const SSLContext = Java.use("javax.net.ssl.SSLContext"); const TrustManager = Java.registerClass({ // Implement a custom TrustManager name: "dev.asd.test.TrustManager", implements: [X509TrustManager], methods: { checkClientTrusted: function (chain, authType) { }, checkServerTrusted: function (chain, authType) { }, getAcceptedIssuers: function () { return []; } } }); // Prepare the TrustManager array to pass to SSLContext.init() const TrustManagers = [TrustManager.$new()]; // Get a handle on the init() on the SSLContext class const SSLContext_init = SSLContext.init.overload("[Ljavax.net.ssl.KeyManager;", "[Ljavax.net.ssl.TrustManager;", "java.security.SecureRandom"); // Override the init method, specifying the custom TrustManager SSLContext_init.implementation = function (keyManager, trustManager, secureRandom) { console.log(`${colorKey} --> TrustManager [SSLContext] (Android < 7)${COLORS.reset}`); SSLContext_init.call(this, keyManager, TrustManagers, secureRandom); }; console.log("[+] TrustManager [SSLContext] (Android < 7)"); } catch (e) { console.log("[ ] TrustManager [SSLContext] (Android < 7)"); } } if (MODE.TrustManagerImpl) { // TrustManagerImpl (Android > 7) const colorKey = randomColor(); const TrustManagerImpl = loadJava("com.android.org.conscrypt.TrustManagerImpl"); try { const ArrayList = Java.use("java.util.ArrayList"); TrustManagerImpl.checkTrustedRecursive.implementation = function (certs, ocspData, tlsSctData, host, clientAuth, untrustedChain, trustAnchorChain, used) { console.log(`${colorKey} --> TrustManagerImpl [TrustedRecursive] (Android > 7): ${host}${COLORS.reset}`); return ArrayList.$new(); }; console.log("[+] TrustManagerImpl [TrustedRecursive] (Android > 7)"); } catch (e) { console.log("[ ] TrustManagerImpl [TrustedRecursive] (Android > 7)"); } try { TrustManagerImpl.verifyChain.implementation = function (untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) { console.log(`${colorKey} --> TrustManagerImpl [verifyChain] (Android > 7): ${host}${COLORS.reset}`); return untrustedChain; }; console.log("[+] TrustManagerImpl [verifyChain] (Android > 7)"); } catch (e) { console.log("[ ] TrustManagerImpl [verifyChain] (Android > 7)"); } } if (MODE.OkHTTPv3) { const colorKey = randomColor(); const CertificatePinner = loadJava("okhttp3.CertificatePinner"); try { CertificatePinner.check.overload("java.lang.String", "java.util.List").implementation = function (a, b) { console.log(`${colorKey} --> OkHTTPv3 [List]: ${a}${COLORS.reset}`); }; console.log("[+] OkHTTPv3 [List]"); } catch (e) { console.log("[ ] OkHTTPv3 [List]"); } try { CertificatePinner.check.overload("java.lang.String", "java.security.cert.Certificate").implementation = function (a, b) { console.log(`${colorKey} --> OkHTTPv3 [Certificate]: ${a}${COLORS.reset}`); }; console.log("[+] OkHTTPv3 [Certificate]"); } catch (e) { console.log("[ ] OkHTTPv3 [Certificate]"); } try { CertificatePinner.check.overload("java.lang.String", "[Ljava.security.cert.Certificate;").implementation = function (a, b) { console.log(`${colorKey} --> OkHTTPv3 [Array]: ${a}${COLORS.reset}`); }; console.log("[+] OkHTTPv3 [Array]"); } catch (e) { console.log("[ ] OkHTTPv3 [Array]"); } try { CertificatePinner.check$okhttp.overload("java.lang.String", "kotlin.jvm.functions.Function0").implementation = function (a, b) { console.log(`${colorKey} --> OkHTTPv3 [Function]: ${a}${COLORS.reset}`); }; console.log("[+] OkHTTPv3 [Function]"); } catch (e) { console.log("[ ] OkHTTPv3 [Function]"); } } if (MODE.Trustkit) { const colorKey = randomColor(); const OkHostnameVerifier = loadJava("com.datatheorem.android.trustkit.pinning.OkHostnameVerifier"); const PinningTrustManager = loadJava("com.datatheorem.android.trustkit.pinning.PinningTrustManager"); try { OkHostnameVerifier.verify.overload("java.lang.String", "javax.net.ssl.SSLSession").implementation = function (a, b) { console.log(`${colorKey} --> Trustkit OkHostnameVerifier [SSLSession]: ${a}${COLORS.reset}`); return true; }; console.log("[+] Trustkit OkHostnameVerifier [SSLSession]"); } catch (e) { console.log("[ ] Trustkit OkHostnameVerifier [SSLSession]"); } try { OkHostnameVerifier.verify.overload("java.lang.String", "java.security.cert.X509Certificate").implementation = function (a, b) { console.log(`${colorKey} --> Trustkit OkHostnameVerifier [X509Certificate]: ${a}${COLORS.reset}`); return true; }; console.log("[+] Trustkit OkHostnameVerifier [X509Certificate]"); } catch (e) { console.log("[ ] Trustkit OkHostnameVerifier [X509Certificate]"); } try { PinningTrustManager.checkServerTrusted.overload("[Ljava.security.cert.X509Certificate;", "java.lang.String").implementation = function (chain, authType) { console.log(`${colorKey} --> Trustkit PinningTrustManager${COLORS.reset}`); }; console.log("[+] Trustkit PinningTrustManager"); } catch (e) { console.log("[ ] Trustkit PinningTrustManager"); } } if (MODE.TitaniumPinningTrustManager) { const colorKey = randomColor(); const PinningTrustManager = loadJava("appcelerator.https.PinningTrustManager"); try { PinningTrustManager.checkServerTrusted.implementation = function (chain, authType) { console.log(`${colorKey} --> Titanium [PinningTrustManager]${COLORS.reset}`); }; console.log("[+] Titanium [PinningTrustManager]"); } catch (e) { console.log("[ ] Titanium [PinningTrustManager]"); } } if (MODE.FabricPinningTrustManager) { const colorKey = randomColor(); const PinningTrustManager = loadJava("io.fabric.sdk.android.services.network.PinningTrustManager"); try { PinningTrustManager.checkServerTrusted.implementation = function (chain, authType) { console.log(`${colorKey} --> Fabric [PinningTrustManager]${COLORS.reset}`); }; console.log("[+] Fabric [PinningTrustManager]"); } catch (e) { console.log("[ ] Fabric [PinningTrustManager]"); } } if (MODE.ConscryptOpenSSLSocketImpl) { const colorKey = randomColor(); const OpenSSLSocketImpl = loadJava("com.android.org.conscrypt.OpenSSLSocketImpl"); try { OpenSSLSocketImpl.verifyCertificateChain.implementation = function (certRefs, JavaObject, authMethod) { console.log(`${colorKey} --> Conscrypt [OpenSSLSocketImpl] (Refs)${COLORS.reset}`); }; console.log("[+] Conscrypt [OpenSSLSocketImpl] (Refs)"); } catch (e) { console.log("[ ] Conscrypt [OpenSSLSocketImpl] (Refs)"); } try { OpenSSLSocketImpl.verifyCertificateChain.implementation = function (certChain, authMethod) { console.log(`${colorKey} --> Conscrypt [OpenSSLSocketImpl] (Chain)${COLORS.reset}`); }; console.log("[+] Conscrypt [OpenSSLSocketImpl] (Chain)"); } catch (e) { console.log("[ ] Conscrypt [OpenSSLSocketImpl] (Chain)"); } } if (MODE.ConscryptOpenSSLEngineSocketImpl) { const colorKey = randomColor(); const OpenSSLEngineSocketImpl = loadJava("com.android.org.conscrypt.OpenSSLEngineSocketImpl"); try { OpenSSLEngineSocketImpl.verifyCertificateChain.overload("[Ljava.lang.Long;", "java.lang.String").implementation = function (a, b) { console.log(`${colorKey} --> Conscrypt [OpenSSLEngineSocketImpl]: ${b}${COLORS.reset}`); }; console.log("[+] Conscrypt [OpenSSLEngineSocketImpl]"); } catch (e) { console.log("[ ] Conscrypt [OpenSSLEngineSocketImpl]"); } } if (MODE.ApacheOpenSSLSocketImpl) { const colorKey = randomColor(); const OpenSSLSocketImpl = loadJava("org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl"); try { OpenSSLSocketImpl.verifyCertificateChain.implementation = function (asn1DerEncodedCertificateChain, authMethod) { console.log(`${colorKey} --> Apache [OpenSSLSocketImpl]${COLORS.reset}`); }; console.log("[+] Apache [OpenSSLSocketImpl]"); } catch (e) { console.log("[ ] Apache [OpenSSLSocketImpl]"); } } if (MODE.PhoneGapsslCertificateChecker) { const colorKey = randomColor(); const sslCertificateChecker = loadJava("nl.xservices.plugins.sslCertificateChecker"); try { sslCertificateChecker.execute.overload("java.lang.String", "org.json.JSONArray", "org.apache.cordova.CallbackContext").implementation = function (a, b, c) { console.log(`${colorKey} --> PhoneGap [sslCertificateChecker]: ${a}${COLORS.reset}`); return true; }; console.log("[+] PhoneGap [sslCertificateChecker]"); } catch (e) { console.log("[ ] PhoneGap [sslCertificateChecker]"); } } if (MODE.IBMMobileFirst) { const colorKey = randomColor(); const MobileFirst = loadJava("com.worklight.wlclient.api.WLClient"); try { MobileFirst.getInstance().pinTrustedCertificatePublicKey.overload("java.lang.String").implementation = function (cert) { console.log(`${colorKey} --> IBM [MobileFirst] (String): ${cert}${COLORS.reset}`); }; console.log("[+] IBM [MobileFirst] (String)"); } catch (e) { console.log("[ ] IBM [MobileFirst] (String)"); } try { MobileFirst.getInstance().pinTrustedCertificatePublicKey.overload("[Ljava.lang.String;").implementation = function (cert) { console.log(`${colorKey} --> IBM [MobileFirst] (Array): ${cert}${COLORS.reset}`); }; console.log("[+] IBM [MobileFirst] (Array)"); } catch (e) { console.log("[ ] IBM [MobileFirst] (Array)"); } } if (MODE.IBMWorkLight) { const colorKey = randomColor(); const WorkLight = loadJava("com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning"); try { WorkLight.verify.overload("java.lang.String", "javax.net.ssl.SSLSocket").implementation = function (a, b) { console.log(`${colorKey} --> IBM [WorkLight] (SSLSocket): ${a}${COLORS.reset}`); }; console.log("[+] IBM [WorkLight] (SSLSocket)"); } catch (e) { console.log("[ ] IBM [WorkLight] (SSLSocket)"); } try { WorkLight.verify.overload("java.lang.String", "java.security.cert.X509Certificate").implementation = function (a, b) { console.log(`${colorKey} --> IBM [WorkLight] (X509Certificate): ${a}${COLORS.reset}`); }; console.log("[+] IBM [WorkLight] (X509Certificate)"); } catch (e) { console.log("[ ] IBM [WorkLight] (X509Certificate)"); } try { WorkLight.verify.overload("java.lang.String", "[Ljava.lang.String;", "[Ljava.lang.String;").implementation = function (a, b) { console.log(`${colorKey} --> IBM [WorkLight] (String): ${a}${COLORS.reset}`); }; console.log("[+] IBM [WorkLight] (String)"); } catch (e) { console.log("[ ] IBM [WorkLight] (String)"); } try { WorkLight.verify.overload("java.lang.String", "javax.net.ssl.SSLSession").implementation = function (a, b) { console.log(`${colorKey} --> IBM [WorkLight] (SSLSession): ${a}${COLORS.reset}`); return true; }; console.log("[+] IBM [WorkLight] (SSLSession)"); } catch (e) { console.log("[ ] IBM [WorkLight] (SSLSession)"); } } if (MODE.ConscryptCertPinManager) { const colorKey = randomColor(); const CertPinManager = loadJava("com.android.org.conscrypt.CertPinManager"); try { CertPinManager.checkChainPinning.overload("java.lang.String", "java.util.List").implementation = function (a, b) { console.log(`${colorKey} --> Conscrypt [CertPinManager] (List): ${a}${COLORS.reset}`); return true; }; console.log("[+] Conscrypt [CertPinManager] (List)"); } catch (e) { console.log("[ ] Conscrypt [CertPinManager] (List)"); } try { CertPinManager.isChainValid.overload("java.lang.String", "java.util.List").implementation = function (a, b) { console.log(`${colorKey} --> Conscrypt [CertPinManager] (Legacy): ${a}${COLORS.reset}`); return true; }; console.log("[+] Conscrypt [CertPinManager] (Legacy)"); } catch (e) { console.log("[ ] Conscrypt [CertPinManager] (Legacy)"); } } if (MODE.NetsecurityCertPinManager) { const colorKey = randomColor(); const CertPinManager = loadJava("com.commonsware.cwac.netsecurity.conscrypt.CertPinManager"); try { CertPinManager.isChainValid.overload("java.lang.String", "java.util.List").implementation = function (a, b) { console.log(`${colorKey} --> Netsecurity [CertPinManager]: ${a}${COLORS.reset}`); return true; }; console.log("[+] Netsecurity [CertPinManager]"); } catch (e) { console.log("[ ] Netsecurity [CertPinManager]"); } } if (MODE.AndroidgapWorkLight) { const colorKey = randomColor(); const Worklight = loadJava("com.worklight.androidgap.plugin.WLCertificatePinningPlugin"); try { Worklight.execute.overload("java.lang.String", "org.json.JSONArray", "org.apache.cordova.CallbackContext").implementation = function (a, b, c) { console.log(`${colorKey} --> Android [WorkLight]: ${a}${COLORS.reset}`); return true; }; console.log("[+] Android [WorkLight]"); } catch (e) { console.log("[ ] Android [WorkLight]"); } } if (MODE.NettyFingerprintTrustManagerFactory) { const colorKey = randomColor(); const FingerprintTrustManagerFactory = loadJava("io.netty.handler.ssl.util.FingerprintTrustManagerFactory"); try { FingerprintTrustManagerFactory.checkTrusted.implementation = function (type, chain) { console.log(`${colorKey} --> Netty [FingerprintTrustManagerFactory]${COLORS.reset}`); }; console.log("[+] Netty [FingerprintTrustManagerFactory]"); } catch (e) { console.log("[ ] Netty [FingerprintTrustManagerFactory]"); } } if (MODE.SquareupCertificatePinner) { // OkHTTP < v3 const colorKey = randomColor(); const CertificatePinner = loadJava("com.squareup.okhttp.CertificatePinner"); try { CertificatePinner.check.overload("java.lang.String", "java.security.cert.Certificate").implementation = function (a, b) { console.log(`${colorKey} --> Squareup [CertificatePinner] (Certificate): ${a}${COLORS.reset}`); }; console.log("[+] Squareup [CertificatePinner] (Certificate)"); } catch (e) { console.log("[ ] Squareup [CertificatePinner] (Certificate)"); } try { CertificatePinner.check.overload("java.lang.String", "java.util.List").implementation = function (a, b) { console.log(`${colorKey} --> Squareup [CertificatePinner] (List): ${a}${COLORS.reset}`); }; console.log("[+] Squareup [CertificatePinner] (List)"); } catch (e) { console.log("[ ] Squareup [CertificatePinner] (List)"); } } if (MODE.SquareupOkHostnameVerifier) { // OkHTTP v3 const colorKey = randomColor(); const OkHostnameVerifier = loadJava("com.squareup.okhttp.internal.tls.OkHostnameVerifier"); try { OkHostnameVerifier.verify.overload("java.lang.String", "java.security.cert.X509Certificate").implementation = function (a, b) { console.log(`${colorKey} --> Squareup [OkHostnameVerifier] (X509Certificate): ${a}${COLORS.reset}`); return true; }; console.log("[+] Squareup [OkHostnameVerifier] (X509Certificate)"); } catch (e) { console.log("[ ] Squareup [OkHostnameVerifier] (X509Certificate)"); } try { OkHostnameVerifier.verify.overload("java.lang.String", "javax.net.ssl.SSLSession").implementation = function (a, b) { console.log(`${colorKey} --> Squareup [OkHostnameVerifier] (SSLSession): ${a}${COLORS.reset}`); return true; }; console.log("[+] Squareup [OkHostnameVerifier] (SSLSession)"); } catch (e) { console.log("[ ] Squareup [OkHostnameVerifier] (SSLSession)"); } } if (MODE.AndroidWebViewClient) { const colorKey = randomColor(); const WebViewClient = loadJava("android.webkit.WebViewClient"); try { WebViewClient.onReceivedSslError.overload("android.webkit.WebView", "android.webkit.SslErrorHandler", "android.net.http.SslError").implementation = function (obj1, obj2, obj3) { console.log(`${colorKey} --> Android [WebViewClient] (SslErrorHandler)${COLORS.reset}`); }; console.log("[+] Android [WebViewClient] (SslErrorHandler)"); } catch (e) { console.log("[ ] Android [WebViewClient] (SslErrorHandler)"); } try { WebViewClient.onReceivedSslError.overload("android.webkit.WebView", "android.webkit.WebResourceRequest", "android.webkit.WebResourceError").implementation = function (obj1, obj2, obj3) { console.log(`${colorKey} --> Android [WebViewClient] (SSLWebResourceError)${COLORS.reset}`); }; console.log("[+] Android [WebViewClient] (SSLWebResourceError)"); } catch (e) { console.log("[ ] Android [WebViewClient] (SSLWebResourceError)"); } try { WebViewClient.onReceivedError.overload("android.webkit.WebView", "int", "java.lang.String", "java.lang.String").implementation = function (obj1, obj2, obj3, obj4) { console.log(`${colorKey} --> Android [WebViewClient] (String)${COLORS.reset}`); }; console.log("[+] Android [WebViewClient] (String)"); } catch (e) { console.log("[ ] Android [WebViewClient] (String)"); } try { WebViewClient.onReceivedError.overload("android.webkit.WebView", "android.webkit.WebResourceRequest", "android.webkit.WebResourceError").implementation = function (obj1, obj2, obj3) { console.log(`${colorKey} --> Android [WebViewClient] (WebResourceError)${COLORS.reset}`); }; console.log("[+] Android [WebViewClient] (WebResourceError)"); } catch (e) { console.log("[ ] Android [WebViewClient] (WebResourceError)"); } } if (MODE.ApacheWebViewClient) { const colorKey = randomColor(); const CordovaWebViewClient = loadJava("org.apache.cordova.CordovaWebViewClient"); try { CordovaWebViewClient.onReceivedSslError.overload("android.webkit.WebView", "android.webkit.SslErrorHandler", "android.net.http.SslError").implementation = function (obj1, obj2, obj3) { console.log(`${colorKey} --> Apache [WebViewClient]${COLORS.reset}`); obj3.proceed(); }; console.log("[+] Apache [WebViewClient]"); } catch (e) { console.log("[ ] Apache [WebViewClient]"); } } if (MODE.BoyeAbstractVerifier) { const colorKey = randomColor(); const AbstractVerifier = loadJava("ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier"); try { AbstractVerifier.verify.implementation = function (host, ssl) { console.log(`${colorKey} --> Boye [AbstractVerifier]: ${host}${COLORS.reset}`); }; console.log("[+] Boye [AbstractVerifier]"); } catch (e) { console.log("[ ] Boye [AbstractVerifier]"); } } if (MODE.ApacheAbstractVerifier) { const colorKey = randomColor(); const AbstractVerifier = loadJava("org.apache.http.conn.ssl.AbstractVerifier"); try { AbstractVerifier.verify.implementation = function (a, b, c, d) { console.log(`${colorKey} --> Apache [AbstractVerifier]: ${a}${COLORS.reset}`); }; console.log("[+] Apache [AbstractVerifier]"); } catch (e) { console.log("[ ] Apache [AbstractVerifier]"); } } if (MODE.Appmattus) { const colorKey = randomColor(); const Transparency = loadJava("com.appmattus.certificatetransparency.internal.verifier.CertificateTransparencyInterceptor"); try { Transparency.intercept.implementation = function (a) { console.log(`${colorKey} --> Appmattus [Transparency]${COLORS.reset}`); return a.proceed(a.request()); }; console.log("[+] Appmattus [Transparency]"); } catch (e) { console.log("[ ] Appmattus [Transparency]"); } } if (MODE.ChromiumCronet) { const colorKey = randomColor(); const CronetEngineBuilderImpl = loadJava("org.chromium.net.impl.CronetEngineBuilderImpl"); try { CronetEngineBuilderImpl.enablePublicKeyPinningBypassForLocalTrustAnchors.overload("boolean").implementation = function (a) { console.log(`${colorKey} --> Chromium [CronetEngineBuilderImpl] (LocalTrustAnchors)${COLORS.reset}`); return CronetEngineBuilderImpl.enablePublicKeyPinningBypassForLocalTrustAnchors.call(this, true); }; console.log("[+] Chromium [CronetEngineBuilderImpl] (LocalTrustAnchors)"); } catch (e) { console.log("[ ] Chromium [CronetEngineBuilderImpl] (LocalTrustAnchors)"); } try { CronetEngineBuilderImpl.addPublicKeyPins.overload("java.lang.String", "java.util.Set", "boolean", "java.util.Date").implementation = function (hostName, pinsSha256, includeSubdomains, expirationDate) { console.log(`${colorKey} --> Chromium [CronetEngineBuilderImpl] (PublicKey): ${hostName}${COLORS.reset}`); return CronetEngineBuilderImpl.addPublicKeyPins.call(this, hostName, pinsSha256, includeSubdomains, expirationDate); }; console.log("[+] Chromium [CronetEngineBuilderImpl] (PublicKey)"); } catch (e) { console.log("[ ] Chromium [CronetEngineBuilderImpl] (PublicKey)"); } } if (MODE.Flutter) { const colorKey = randomColor(); const HttpCertificatePinning = loadJava("diefferson.http_certificate_pinning.HttpCertificatePinning"); const SslPinningPlugin = loadJava("com.macif.plugin.sslpinningplugin.SslPinningPlugin"); try { HttpCertificatePinning.checkConnexion.overload("java.lang.String", "java.util.List", "java.util.Map", "int", "java.lang.String").implementation = function (a, b, c, d, e) { console.log(`${colorKey} --> Flutter [HttpCertificatePinning]: ${a}${COLORS.reset}`); return true; }; console.log("[+] Flutter [HttpCertificatePinning]"); } catch (e) { console.log("[ ] Flutter [HttpCertificatePinning]"); } try { SslPinningPlugin.checkConnexion.overload("java.lang.String", "java.util.List", "java.util.Map", "int", "java.lang.String").implementation = function (a, b, c, d, e) { console.log(`${colorKey} --> Flutter [SslPinningPlugin]: ${a}${COLORS.reset}`); return true; }; console.log("[+] Flutter [SslPinningPlugin]"); } catch (e) { console.log("[ ] Flutter [SslPinningPlugin]"); } } } ); } else { console.log(`${COLORS.red}[!] Java unavailable${COLORS.reset}`); } console.log("Capturing setup completed"); console.log("---"); }, 0); //adb push cert-der.crt /data/local/tmp/cert-der.crt //frida -U -f com.dummy.ssl --codeshare kooroshh/ssl-pinning-bypass-okhttp4 --no-pause Java.perform(function() { console.log(""); console.log("[.] Cert Pinning Bypass/Re-Pinning"); var CertificateFactory = Java.use("java.security.cert.CertificateFactory"); var FileInputStream = Java.use("java.io.FileInputStream"); var BufferedInputStream = Java.use("java.io.BufferedInputStream"); var X509Certificate = Java.use("java.security.cert.X509Certificate"); var KeyStore = Java.use("java.security.KeyStore"); var TrustManagerFactory = Java.use("javax.net.ssl.TrustManagerFactory"); var SSLContext = Java.use("javax.net.ssl.SSLContext"); // Load CAs from an InputStream console.log("[+] Loading our CA...") var cf = CertificateFactory.getInstance("X.509"); try { var fileInputStream = FileInputStream.$new("/data/local/tmp/cert-der.crt"); } catch (err) { console.log("[o] " + err); } var bufferedInputStream = BufferedInputStream.$new(fileInputStream); var ca = cf.generateCertificate(bufferedInputStream); bufferedInputStream.close(); var certInfo = Java.cast(ca, X509Certificate); console.log("[o] Our CA Info: " + certInfo.getSubjectDN()); // Create a KeyStore containing our trusted CAs console.log("[+] Creating a KeyStore for our CA..."); var keyStoreType = KeyStore.getDefaultType(); var keyStore = KeyStore.getInstance(keyStoreType); keyStore.load(null, null); keyStore.setCertificateEntry("ca", ca); // Create a TrustManager that trusts the CAs in our KeyStore console.log("[+] Creating a TrustManager that trusts the CA in our KeyStore..."); var tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm(); var tmf = TrustManagerFactory.getInstance(tmfAlgorithm); tmf.init(keyStore); console.log("[+] Our TrustManager is ready..."); console.log("[+] Hijacking SSLContext methods now...") console.log("[-] Waiting for the app to invoke SSLContext.init()...") SSLContext.init.overload("[Ljavax.net.ssl.KeyManager;", "[Ljavax.net.ssl.TrustManager;", "java.security.SecureRandom").implementation = function(a, b, c) { console.log("[o] App invoked javax.net.ssl.SSLContext.init..."); SSLContext.init.overload("[Ljavax.net.ssl.KeyManager;", "[Ljavax.net.ssl.TrustManager;", "java.security.SecureRandom").call(this, a, tmf.getTrustManagers(), c); console.log("[+] SSLContext initialized with our custom TrustManager!"); } // okhttp4 try { var CertificatePinner = Java.use('okhttp3.CertificatePinner'); CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function(str) { console.log('! Intercepted okhttp4: ' + str); return; }; try { CertificatePinner.check$okhttp.overload('java.lang.String', 'kotlin.jvm.functions.Function0').implementation = function(str, _) { console.log('! Intercepted okhttp4: ' + str); return; }; } catch (ex) { console.log("is this Okhttp3 ?!"); } console.log('* Setup okhttp4 pinning') } catch (err) { console.log('* Unable to hook into okhttp4 pinner') console.log(err); } // TrustManagerImpl try { var TrustManagerImpl = Java.use('com.android.org.conscrypt.TrustManagerImpl'); TrustManagerImpl.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) { console.log('! Intercepted TrustManagerImp: ' + host); return untrustedChain; } console.log('* Setup TrustManagerImpl pinning') } catch (err) { console.log('* Unable to hook into TrustManagerImpl') } }); setTimeout(function () { Java.perform(function () { console.log("---"); console.log("Unpinning Android app..."); /// -- Generic hook to protect against SSLPeerUnverifiedException -- /// // In some cases, with unusual cert pinning approaches, or heavy obfuscation, we can't // match the real method & package names. This is a problem! Fortunately, we can still // always match built-in types, so here we spot all failures that use the built-in cert // error type (notably this includes OkHttp), and after the first failure, we dynamically // generate & inject a patch to completely disable the method that threw the error. try { const UnverifiedCertError = Java.use('javax.net.ssl.SSLPeerUnverifiedException'); UnverifiedCertError.$init.implementation = function (str) { console.log(' --> Unexpected SSL verification failure, adding dynamic patch...'); try { const stackTrace = Java.use('java.lang.Thread').currentThread().getStackTrace(); const exceptionStackIndex = stackTrace.findIndex(stack => stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException" ); const callingFunctionStack = stackTrace[exceptionStackIndex + 1]; const className = callingFunctionStack.getClassName(); const methodName = callingFunctionStack.getMethodName(); console.log(` Thrown by ${className}->${methodName}`); const callingClass = Java.use(className); const callingMethod = callingClass[methodName]; if (callingMethod.implementation) return; // Already patched by Frida - skip it console.log(' Attempting to patch automatically...'); const returnTypeName = callingMethod.returnType.type; callingMethod.implementation = function () { console.log(` --> Bypassing ${className}->${methodName} (automatic exception patch)`); // This is not a perfect fix! Most unknown cases like this are really just // checkCert(cert) methods though, so doing nothing is perfect, and if we // do need an actual return value then this is probably the best we can do, // and at least we're logging the method name so you can patch it manually: if (returnTypeName === 'void') { return; } else { return null; } }; console.log(` [+] ${className}->${methodName} (automatic exception patch)`); } catch (e) { console.log(' [ ] Failed to automatically patch failure'); } return this.$init(str); }; console.log('[+] SSLPeerUnverifiedException auto-patcher'); } catch (err) { console.log('[ ] SSLPeerUnverifiedException auto-patcher'); } /// -- Specific targeted hooks: -- /// // HttpsURLConnection try { const HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection"); HttpsURLConnection.setDefaultHostnameVerifier.implementation = function (hostnameVerifier) { console.log(' --> Bypassing HttpsURLConnection (setDefaultHostnameVerifier)'); return; // Do nothing, i.e. don't change the hostname verifier }; console.log('[+] HttpsURLConnection (setDefaultHostnameVerifier)'); } catch (err) { console.log('[ ] HttpsURLConnection (setDefaultHostnameVerifier)'); } try { const HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection"); HttpsURLConnection.setSSLSocketFactory.implementation = function (SSLSocketFactory) { console.log(' --> Bypassing HttpsURLConnection (setSSLSocketFactory)'); return; // Do nothing, i.e. don't change the SSL socket factory }; console.log('[+] HttpsURLConnection (setSSLSocketFactory)'); } catch (err) { console.log('[ ] HttpsURLConnection (setSSLSocketFactory)'); } try { const HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection"); HttpsURLConnection.setHostnameVerifier.implementation = function (hostnameVerifier) { console.log(' --> Bypassing HttpsURLConnection (setHostnameVerifier)'); return; // Do nothing, i.e. don't change the hostname verifier }; console.log('[+] HttpsURLConnection (setHostnameVerifier)'); } catch (err) { console.log('[ ] HttpsURLConnection (setHostnameVerifier)'); } // SSLContext try { const X509TrustManager = Java.use('javax.net.ssl.X509TrustManager'); const SSLContext = Java.use('javax.net.ssl.SSLContext'); const TrustManager = Java.registerClass({ // Implement a custom TrustManager name: 'dev.asd.test.TrustManager', implements: [X509TrustManager], methods: { checkClientTrusted: function (chain, authType) { }, checkServerTrusted: function (chain, authType) { }, getAcceptedIssuers: function () { return []; } } }); // Prepare the TrustManager array to pass to SSLContext.init() const TrustManagers = [TrustManager.$new()]; // Get a handle on the init() on the SSLContext class const SSLContext_init = SSLContext.init.overload( '[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom' ); // Override the init method, specifying the custom TrustManager SSLContext_init.implementation = function (keyManager, trustManager, secureRandom) { console.log(' --> Bypassing Trustmanager (Android < 7) request'); SSLContext_init.call(this, keyManager, TrustManagers, secureRandom); }; console.log('[+] SSLContext'); } catch (err) { console.log('[ ] SSLContext'); } // TrustManagerImpl (Android > 7) try { const array_list = Java.use("java.util.ArrayList"); const TrustManagerImpl = Java.use('com.android.org.conscrypt.TrustManagerImpl'); // This step is notably what defeats the most common case: network security config TrustManagerImpl.checkTrustedRecursive.implementation = function(a1, a2, a3, a4, a5, a6) { console.log(' --> Bypassing TrustManagerImpl checkTrusted '); return array_list.$new(); } TrustManagerImpl.verifyChain.implementation = function (untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) { console.log(' --> Bypassing TrustManagerImpl verifyChain: ' + host); return untrustedChain; }; console.log('[+] TrustManagerImpl'); } catch (err) { console.log('[ ] TrustManagerImpl'); } // OkHTTPv3 (quadruple bypass) try { // Bypass OkHTTPv3 {1} const okhttp3_Activity_1 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_1.check.overload('java.lang.String', 'java.util.List').implementation = function (a, b) { console.log(' --> Bypassing OkHTTPv3 (list): ' + a); return; }; console.log('[+] OkHTTPv3 (list)'); } catch (err) { console.log('[ ] OkHTTPv3 (list)'); } try { // Bypass OkHTTPv3 {2} // This method of CertificatePinner.check could be found in some old Android app const okhttp3_Activity_2 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_2.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function (a, b) { console.log(' --> Bypassing OkHTTPv3 (cert): ' + a); return; }; console.log('[+] OkHTTPv3 (cert)'); } catch (err) { console.log('[ ] OkHTTPv3 (cert)'); } try { // Bypass OkHTTPv3 {3} const okhttp3_Activity_3 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_3.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function (a, b) { console.log(' --> Bypassing OkHTTPv3 (cert array): ' + a); return; }; console.log('[+] OkHTTPv3 (cert array)'); } catch (err) { console.log('[ ] OkHTTPv3 (cert array)'); } try { // Bypass OkHTTPv3 {4} const okhttp3_Activity_4 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_4['check$okhttp'].implementation = function (a, b) { console.log(' --> Bypassing OkHTTPv3 ($okhttp): ' + a); return; }; console.log('[+] OkHTTPv3 ($okhttp)'); } catch (err) { console.log('[ ] OkHTTPv3 ($okhttp)'); } // Trustkit (triple bypass) try { // Bypass Trustkit {1} const trustkit_Activity_1 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier'); trustkit_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function (a, b) { console.log(' --> Bypassing Trustkit OkHostnameVerifier(SSLSession): ' + a); return true; }; console.log('[+] Trustkit OkHostnameVerifier(SSLSession)'); } catch (err) { console.log('[ ] Trustkit OkHostnameVerifier(SSLSession)'); } try { // Bypass Trustkit {2} const trustkit_Activity_2 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier'); trustkit_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function (a, b) { console.log(' --> Bypassing Trustkit OkHostnameVerifier(cert): ' + a); return true; }; console.log('[+] Trustkit OkHostnameVerifier(cert)'); } catch (err) { console.log('[ ] Trustkit OkHostnameVerifier(cert)'); } try { // Bypass Trustkit {3} const trustkit_PinningTrustManager = Java.use('com.datatheorem.android.trustkit.pinning.PinningTrustManager'); trustkit_PinningTrustManager.checkServerTrusted.implementation = function () { console.log(' --> Bypassing Trustkit PinningTrustManager'); }; console.log('[+] Trustkit PinningTrustManager'); } catch (err) { console.log('[ ] Trustkit PinningTrustManager'); } // Appcelerator Titanium try { const appcelerator_PinningTrustManager = Java.use('appcelerator.https.PinningTrustManager'); appcelerator_PinningTrustManager.checkServerTrusted.implementation = function () { console.log(' --> Bypassing Appcelerator PinningTrustManager'); }; console.log('[+] Appcelerator PinningTrustManager'); } catch (err) { console.log('[ ] Appcelerator PinningTrustManager'); } // OpenSSLSocketImpl Conscrypt try { const OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl'); OpenSSLSocketImpl.verifyCertificateChain.implementation = function (certRefs, JavaObject, authMethod) { console.log(' --> Bypassing OpenSSLSocketImpl Conscrypt'); }; console.log('[+] OpenSSLSocketImpl Conscrypt'); } catch (err) { console.log('[ ] OpenSSLSocketImpl Conscrypt'); } // OpenSSLEngineSocketImpl Conscrypt try { const OpenSSLEngineSocketImpl_Activity = Java.use('com.android.org.conscrypt.OpenSSLEngineSocketImpl'); OpenSSLEngineSocketImpl_Activity.verifyCertificateChain.overload('[Ljava.lang.Long;', 'java.lang.String').implementation = function (a, b) { console.log(' --> Bypassing OpenSSLEngineSocketImpl Conscrypt: ' + b); }; console.log('[+] OpenSSLEngineSocketImpl Conscrypt'); } catch (err) { console.log('[ ] OpenSSLEngineSocketImpl Conscrypt'); } // OpenSSLSocketImpl Apache Harmony try { const OpenSSLSocketImpl_Harmony = Java.use('org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl'); OpenSSLSocketImpl_Harmony.verifyCertificateChain.implementation = function (asn1DerEncodedCertificateChain, authMethod) { console.log(' --> Bypassing OpenSSLSocketImpl Apache Harmony'); }; console.log('[+] OpenSSLSocketImpl Apache Harmony'); } catch (err) { console.log('[ ] OpenSSLSocketImpl Apache Harmony'); } // PhoneGap sslCertificateChecker (https://github.com/EddyVerbruggen/SSLCertificateChecker-PhoneGap-Plugin) try { const phonegap_Activity = Java.use('nl.xservices.plugins.sslCertificateChecker'); phonegap_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function (a, b, c) { console.log(' --> Bypassing PhoneGap sslCertificateChecker: ' + a); return true; }; console.log('[+] PhoneGap sslCertificateChecker'); } catch (err) { console.log('[ ] PhoneGap sslCertificateChecker'); } // IBM MobileFirst pinTrustedCertificatePublicKey (double bypass) try { // Bypass IBM MobileFirst {1} const WLClient_Activity_1 = Java.use('com.worklight.wlclient.api.WLClient'); WLClient_Activity_1.getInstance().pinTrustedCertificatePublicKey.overload('java.lang.String').implementation = function (cert) { console.log(' --> Bypassing IBM MobileFirst pinTrustedCertificatePublicKey (string): ' + cert); return; }; console.log('[+] IBM MobileFirst pinTrustedCertificatePublicKey (string)'); } catch (err) { console.log('[ ] IBM MobileFirst pinTrustedCertificatePublicKey (string)'); } try { // Bypass IBM MobileFirst {2} const WLClient_Activity_2 = Java.use('com.worklight.wlclient.api.WLClient'); WLClient_Activity_2.getInstance().pinTrustedCertificatePublicKey.overload('[Ljava.lang.String;').implementation = function (cert) { console.log(' --> Bypassing IBM MobileFirst pinTrustedCertificatePublicKey (string array): ' + cert); return; }; console.log('[+] IBM MobileFirst pinTrustedCertificatePublicKey (string array)'); } catch (err) { console.log('[ ] IBM MobileFirst pinTrustedCertificatePublicKey (string array)'); } // IBM WorkLight (ancestor of MobileFirst) HostNameVerifierWithCertificatePinning (quadruple bypass) try { // Bypass IBM WorkLight {1} const worklight_Activity_1 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSocket').implementation = function (a, b) { console.log(' --> Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSocket): ' + a); return; }; console.log('[+] IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSocket)'); } catch (err) { console.log('[ ] IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSocket)'); } try { // Bypass IBM WorkLight {2} const worklight_Activity_2 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function (a, b) { console.log(' --> Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning (cert): ' + a); return; }; console.log('[+] IBM WorkLight HostNameVerifierWithCertificatePinning (cert)'); } catch (err) { console.log('[ ] IBM WorkLight HostNameVerifierWithCertificatePinning (cert)'); } try { // Bypass IBM WorkLight {3} const worklight_Activity_3 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_3.verify.overload('java.lang.String', '[Ljava.lang.String;', '[Ljava.lang.String;').implementation = function (a, b) { console.log(' --> Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning (string string): ' + a); return; }; console.log('[+] IBM WorkLight HostNameVerifierWithCertificatePinning (string string)'); } catch (err) { console.log('[ ] IBM WorkLight HostNameVerifierWithCertificatePinning (string string)'); } try { // Bypass IBM WorkLight {4} const worklight_Activity_4 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_4.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function (a, b) { console.log(' --> Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSession): ' + a); return true; }; console.log('[+] IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSession)'); } catch (err) { console.log('[ ] IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSession)'); } // Conscrypt CertPinManager try { const conscrypt_CertPinManager_Activity = Java.use('com.android.org.conscrypt.CertPinManager'); conscrypt_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function (a, b) { console.log(' --> Bypassing Conscrypt CertPinManager: ' + a); return true; }; console.log('[+] Conscrypt CertPinManager'); } catch (err) { console.log('[ ] Conscrypt CertPinManager'); } // CWAC-Netsecurity (unofficial back-port pinner for Android<4.2) CertPinManager try { const cwac_CertPinManager_Activity = Java.use('com.commonsware.cwac.netsecurity.conscrypt.CertPinManager'); cwac_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function (a, b) { console.log(' --> Bypassing CWAC-Netsecurity CertPinManager: ' + a); return true; }; console.log('[+] CWAC-Netsecurity CertPinManager'); } catch (err) { console.log('[ ] CWAC-Netsecurity CertPinManager'); } // Worklight Androidgap WLCertificatePinningPlugin try { const androidgap_WLCertificatePinningPlugin_Activity = Java.use('com.worklight.androidgap.plugin.WLCertificatePinningPlugin'); androidgap_WLCertificatePinningPlugin_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function (a, b, c) { console.log(' --> Bypassing Worklight Androidgap WLCertificatePinningPlugin: ' + a); return true; }; console.log('[+] Worklight Androidgap WLCertificatePinningPlugin'); } catch (err) { console.log('[ ] Worklight Androidgap WLCertificatePinningPlugin'); } // Netty FingerprintTrustManagerFactory try { const netty_FingerprintTrustManagerFactory = Java.use('io.netty.handler.ssl.util.FingerprintTrustManagerFactory'); netty_FingerprintTrustManagerFactory.checkTrusted.implementation = function (type, chain) { console.log(' --> Bypassing Netty FingerprintTrustManagerFactory'); }; console.log('[+] Netty FingerprintTrustManagerFactory'); } catch (err) { console.log('[ ] Netty FingerprintTrustManagerFactory'); } // Squareup CertificatePinner [OkHTTP Bypassing Squareup CertificatePinner (cert): ' + a); return; }; console.log('[+] Squareup CertificatePinner (cert)'); } catch (err) { console.log('[ ] Squareup CertificatePinner (cert)'); } try { // Bypass Squareup CertificatePinner {2} const Squareup_CertificatePinner_Activity_2 = Java.use('com.squareup.okhttp.CertificatePinner'); Squareup_CertificatePinner_Activity_2.check.overload('java.lang.String', 'java.util.List').implementation = function (a, b) { console.log(' --> Bypassing Squareup CertificatePinner (list): ' + a); return; }; console.log('[+] Squareup CertificatePinner (list)'); } catch (err) { console.log('[ ] Squareup CertificatePinner (list)'); } // Squareup OkHostnameVerifier [OkHTTP v3] (double bypass) try { // Bypass Squareup OkHostnameVerifier {1} const Squareup_OkHostnameVerifier_Activity_1 = Java.use('com.squareup.okhttp.internal.tls.OkHostnameVerifier'); Squareup_OkHostnameVerifier_Activity_1.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function (a, b) { console.log(' --> Bypassing Squareup OkHostnameVerifier (cert): ' + a); return true; }; console.log('[+] Squareup OkHostnameVerifier (cert)'); } catch (err) { console.log('[ ] Squareup OkHostnameVerifier (cert)'); } try { // Bypass Squareup OkHostnameVerifier {2} const Squareup_OkHostnameVerifier_Activity_2 = Java.use('com.squareup.okhttp.internal.tls.OkHostnameVerifier'); Squareup_OkHostnameVerifier_Activity_2.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function (a, b) { console.log(' --> Bypassing Squareup OkHostnameVerifier (SSLSession): ' + a); return true; }; console.log('[+] Squareup OkHostnameVerifier (SSLSession)'); } catch (err) { console.log('[ ] Squareup OkHostnameVerifier (SSLSession)'); } // Android WebViewClient (double bypass) try { // Bypass WebViewClient {1} (deprecated from Android 6) const AndroidWebViewClient_Activity_1 = Java.use('android.webkit.WebViewClient'); AndroidWebViewClient_Activity_1.onReceivedSslError.overload('android.webkit.WebView', 'android.webkit.SslErrorHandler', 'android.net.http.SslError').implementation = function (obj1, obj2, obj3) { console.log(' --> Bypassing Android WebViewClient (SslErrorHandler)'); }; console.log('[+] Android WebViewClient (SslErrorHandler)'); } catch (err) { console.log('[ ] Android WebViewClient (SslErrorHandler)'); } try { // Bypass WebViewClient {2} const AndroidWebViewClient_Activity_2 = Java.use('android.webkit.WebViewClient'); AndroidWebViewClient_Activity_2.onReceivedSslError.overload('android.webkit.WebView', 'android.webkit.WebResourceRequest', 'android.webkit.WebResourceError').implementation = function (obj1, obj2, obj3) { console.log(' --> Bypassing Android WebViewClient (WebResourceError)'); }; console.log('[+] Android WebViewClient (WebResourceError)'); } catch (err) { console.log('[ ] Android WebViewClient (WebResourceError)'); } // Apache Cordova WebViewClient try { const CordovaWebViewClient_Activity = Java.use('org.apache.cordova.CordovaWebViewClient'); CordovaWebViewClient_Activity.onReceivedSslError.overload('android.webkit.WebView', 'android.webkit.SslErrorHandler', 'android.net.http.SslError').implementation = function (obj1, obj2, obj3) { console.log(' --> Bypassing Apache Cordova WebViewClient'); obj3.proceed(); }; } catch (err) { console.log('[ ] Apache Cordova WebViewClient'); } // Boye AbstractVerifier try { const boye_AbstractVerifier = Java.use('ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier'); boye_AbstractVerifier.verify.implementation = function (host, ssl) { console.log(' --> Bypassing Boye AbstractVerifier: ' + host); }; } catch (err) { console.log('[ ] Boye AbstractVerifier'); } // Appmattus try { const appmatus_Activity = Java.use('com.appmattus.certificatetransparency.internal.verifier.CertificateTransparencyInterceptor'); appmatus_Activity['intercept'].implementation = function (a) { console.log(' --> Bypassing Appmattus (Transparency)'); return a.proceed(a.request()); }; console.log('[+] Appmattus (CertificateTransparencyInterceptor)'); } catch (err) { console.log('[ ] Appmattus (CertificateTransparencyInterceptor)'); } try { const CertificateTransparencyTrustManager = Java.use( 'com.appmattus.certificatetransparency.internal.verifier.CertificateTransparencyTrustManager' ); CertificateTransparencyTrustManager['checkServerTrusted'].overload( '[Ljava.security.cert.X509Certificate;', 'java.lang.String' ).implementation = function (x509CertificateArr, str) { console.log(' --> Bypassing Appmattus (CertificateTransparencyTrustManager)'); }; CertificateTransparencyTrustManager['checkServerTrusted'].overload( '[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'java.lang.String' ).implementation = function (x509CertificateArr, str, str2) { console.log(' --> Bypassing Appmattus (CertificateTransparencyTrustManager)'); return Java.use('java.util.ArrayList').$new(); }; console.log('[+] Appmattus (CertificateTransparencyTrustManager)'); } catch (err) { console.log('[ ] Appmattus (CertificateTransparencyTrustManager)'); } console.log("Unpinning setup completed"); console.log("---"); }); }, 0); ////////////////////////////////////// //////////////////////////////////// function bin2ascii(array) { return String.fromCharCode.apply(null, array); } function bin2hex(array, length) { length = length || array.length; return Array.from(array) .slice(0, length) .map(byte => ('0' + (byte & 0xFF).toString(16)).slice(-2)) .join(''); } Java.perform(function() { var SecretKeySpec = Java.use('javax.crypto.spec.SecretKeySpec'); SecretKeySpec.$init.overload('[B', 'java.lang.String').implementation = function(key, spec) { var hexKey = bin2hex(key); var asciiKey = bin2ascii(key); console.log("KEY: " + hexKey + " | " + asciiKey); return this.$init(key, spec); }; var Cipher = Java.use('javax.crypto.Cipher'); Cipher.getInstance.overload('java.lang.String').implementation = function(spec) { console.log("CIPHER: " + spec); return this.getInstance(spec); }; Cipher.doFinal.overload('[B').implementation = function(data) { console.log("Gotcha!"); var hexData = bin2hex(data); var asciiData = bin2ascii(data); console.log("Data: " + hexData + " | " + asciiData); var iv = this.getIV(); if (iv) { var hexIV = bin2hex(iv); var asciiIV = bin2ascii(iv); console.log("IV: " + hexIV + " | " + asciiIV); } else { console.log("No IV available."); } return this.doFinal(data); }; }); ////////////////////////////////////////////////////////////////// /* Android ssl certificate pinning bypass script for various methods by Maurizio Siddu Run with: frida -U -f -l frida_multiple_unpinning.js [--no-pause] */ setTimeout(function() { Java.perform(function() { console.log(''); console.log('======'); console.log('[#] Android Bypass for various Certificate Pinning methods [#]'); console.log('======'); var errDict = {}; // TrustManager (Android < 7) // //////////////////////////////// var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager'); var SSLContext = Java.use('javax.net.ssl.SSLContext'); var TrustManager = Java.registerClass({ // Implement a custom TrustManager name: 'dev.asd.test.TrustManager', implements: [X509TrustManager], methods: { checkClientTrusted: function(chain, authType) {}, checkServerTrusted: function(chain, authType) {}, getAcceptedIssuers: function() {return []; } } }); // Prepare the TrustManager array to pass to SSLContext.init() var TrustManagers = [TrustManager.$new()]; // Get a handle on the init() on the SSLContext class var SSLContext_init = SSLContext.init.overload( '[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom'); try { // Override the init method, specifying the custom TrustManager SSLContext_init.implementation = function(keyManager, trustManager, secureRandom) { console.log('[+] Bypassing Trustmanager (Android < 7) pinner'); SSLContext_init.call(this, keyManager, TrustManagers, secureRandom); }; } catch (err) { console.log('[-] TrustManager (Android < 7) pinner not found'); //console.log(err); } // OkHTTPv3 (quadruple bypass) // ///////////////////////////////// try { // Bypass OkHTTPv3 {1} var okhttp3_Activity_1 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_1.check.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {1}: ' + a); return; }; } catch (err) { console.log('[-] OkHTTPv3 {1} pinner not found'); //console.log(err); errDict[err] = ['okhttp3.CertificatePinner', 'check']; } try { // Bypass OkHTTPv3 {2} // This method of CertificatePinner.check is deprecated but could be found in some old Android apps var okhttp3_Activity_2 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_2.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {2}: ' + a); return; }; } catch (err) { console.log('[-] OkHTTPv3 {2} pinner not found'); //console.log(err); //errDict[err] = ['okhttp3.CertificatePinner', 'check']; } try { // Bypass OkHTTPv3 {3} var okhttp3_Activity_3 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_3.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {3}: ' + a); return; }; } catch(err) { console.log('[-] OkHTTPv3 {3} pinner not found'); //console.log(err); errDict[err] = ['okhttp3.CertificatePinner', 'check']; } try { // Bypass OkHTTPv3 {4} var okhttp3_Activity_4 = Java.use('okhttp3.CertificatePinner'); //okhttp3_Activity_4['check$okhttp'].implementation = function(a, b) { okhttp3_Activity_4.check$okhttp.overload('java.lang.String', 'kotlin.jvm.functions.Function0').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {4}: ' + a); return; }; } catch(err) { console.log('[-] OkHTTPv3 {4} pinner not found'); //console.log(err); errDict[err] = ['okhttp3.CertificatePinner', 'check$okhttp']; } // Trustkit (triple bypass) // ////////////////////////////// try { // Bypass Trustkit {1} var trustkit_Activity_1 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier'); trustkit_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) { console.log('[+] Bypassing Trustkit {1}: ' + a); return true; }; } catch (err) { console.log('[-] Trustkit {1} pinner not found'); //console.log(err); errDict[err] = ['com.datatheorem.android.trustkit.pinning.OkHostnameVerifier', 'verify']; } try { // Bypass Trustkit {2} var trustkit_Activity_2 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier'); trustkit_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) { console.log('[+] Bypassing Trustkit {2}: ' + a); return true; }; } catch (err) { console.log('[-] Trustkit {2} pinner not found'); //console.log(err); errDict[err] = ['com.datatheorem.android.trustkit.pinning.OkHostnameVerifier', 'verify']; } try { // Bypass Trustkit {3} var trustkit_PinningTrustManager = Java.use('com.datatheorem.android.trustkit.pinning.PinningTrustManager'); trustkit_PinningTrustManager.checkServerTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String').implementation = function(chain, authType) { console.log('[+] Bypassing Trustkit {3}'); }; } catch (err) { console.log('[-] Trustkit {3} pinner not found'); //console.log(err); errDict[err] = ['com.datatheorem.android.trustkit.pinning.PinningTrustManager', 'checkServerTrusted']; } // TrustManagerImpl (Android > 7) // //////////////////////////////////// try { // Bypass TrustManagerImpl (Android > 7) {1} var array_list = Java.use("java.util.ArrayList"); var TrustManagerImpl_Activity_1 = Java.use('com.android.org.conscrypt.TrustManagerImpl'); TrustManagerImpl_Activity_1.checkTrustedRecursive.implementation = function(certs, ocspData, tlsSctData, host, clientAuth, untrustedChain, trustAnchorChain, used) { console.log('[+] Bypassing TrustManagerImpl (Android > 7) checkTrustedRecursive check for: '+ host); return array_list.$new(); }; } catch (err) { console.log('[-] TrustManagerImpl (Android > 7) checkTrustedRecursive check not found'); //console.log(err); errDict[err] = ['com.android.org.conscrypt.TrustManagerImpl', 'checkTrustedRecursive']; } try { // Bypass TrustManagerImpl (Android > 7) {2} (probably no more necessary) var TrustManagerImpl_Activity_2 = Java.use('com.android.org.conscrypt.TrustManagerImpl'); TrustManagerImpl_Activity_2.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) { console.log('[+] Bypassing TrustManagerImpl (Android > 7) verifyChain check for: ' + host); return untrustedChain; }; } catch (err) { console.log('[-] TrustManagerImpl (Android > 7) verifyChain check not found'); //console.log(err); errDict[err] = ['com.android.org.conscrypt.TrustManagerImpl', 'verifyChain']; } // Appcelerator Titanium PinningTrustManager // /////////////////////////////////////////////// try { var appcelerator_PinningTrustManager = Java.use('appcelerator.https.PinningTrustManager'); appcelerator_PinningTrustManager.checkServerTrusted.implementation = function(chain, authType) { console.log('[+] Bypassing Appcelerator PinningTrustManager'); return; }; } catch (err) { console.log('[-] Appcelerator PinningTrustManager pinner not found'); //console.log(err); errDict[err] = ['appcelerator.https.PinningTrustManager', 'checkServerTrusted']; } // Fabric PinningTrustManager // //////////////////////////////// try { var fabric_PinningTrustManager = Java.use('io.fabric.sdk.android.services.network.PinningTrustManager'); fabric_PinningTrustManager.checkServerTrusted.implementation = function(chain, authType) { console.log('[+] Bypassing Fabric PinningTrustManager'); return; }; } catch (err) { console.log('[-] Fabric PinningTrustManager pinner not found'); //console.log(err); errDict[err] = ['io.fabric.sdk.android.services.network.PinningTrustManager', 'checkServerTrusted']; } // OpenSSLSocketImpl Conscrypt (double bypass) // ///////////////////////////////////////////////// try { var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl'); OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certRefs, JavaObject, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Conscrypt {1}'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Conscrypt {1} pinner not found'); //console.log(err); errDict[err] = ['com.android.org.conscrypt.OpenSSLSocketImpl', 'verifyCertificateChain']; } try { var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl'); OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certChain, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Conscrypt {2}'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Conscrypt {2} pinner not found'); //console.log(err); errDict[err] = ['com.android.org.conscrypt.OpenSSLSocketImpl', 'verifyCertificateChain']; } // OpenSSLEngineSocketImpl Conscrypt // /////////////////////////////////////// try { var OpenSSLEngineSocketImpl_Activity = Java.use('com.android.org.conscrypt.OpenSSLEngineSocketImpl'); OpenSSLEngineSocketImpl_Activity.verifyCertificateChain.overload('[Ljava.lang.Long;', 'java.lang.String').implementation = function(a, b) { console.log('[+] Bypassing OpenSSLEngineSocketImpl Conscrypt: ' + b); }; } catch (err) { console.log('[-] OpenSSLEngineSocketImpl Conscrypt pinner not found'); //console.log(err); errDict[err] = ['com.android.org.conscrypt.OpenSSLEngineSocketImpl', 'verifyCertificateChain']; } // OpenSSLSocketImpl Apache Harmony // ////////////////////////////////////// try { var OpenSSLSocketImpl_Harmony = Java.use('org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl'); OpenSSLSocketImpl_Harmony.verifyCertificateChain.implementation = function(asn1DerEncodedCertificateChain, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Apache Harmony'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Apache Harmony pinner not found'); //console.log(err); errDict[err] = ['org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl', 'verifyCertificateChain']; } // PhoneGap sslCertificateChecker // //////////////////////////////////// try { var phonegap_Activity = Java.use('nl.xservices.plugins.sslCertificateChecker'); phonegap_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(a, b, c) { console.log('[+] Bypassing PhoneGap sslCertificateChecker: ' + a); return true; }; } catch (err) { console.log('[-] PhoneGap sslCertificateChecker pinner not found'); //console.log(err); errDict[err] = ['nl.xservices.plugins.sslCertificateChecker', 'execute']; } // IBM MobileFirst pinTrustedCertificatePublicKey (double bypass) // //////////////////////////////////////////////////////////////////// try { // Bypass IBM MobileFirst {1} var WLClient_Activity_1 = Java.use('com.worklight.wlclient.api.WLClient'); WLClient_Activity_1.getInstance().pinTrustedCertificatePublicKey.overload('java.lang.String').implementation = function(cert) { console.log('[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {1}: ' + cert); return; }; } catch (err) { console.log('[-] IBM MobileFirst pinTrustedCertificatePublicKey {1} pinner not found'); //console.log(err); errDict[err] = ['com.worklight.wlclient.api.WLClient', 'pinTrustedCertificatePublicKey']; } try { // Bypass IBM MobileFirst {2} var WLClient_Activity_2 = Java.use('com.worklight.wlclient.api.WLClient'); WLClient_Activity_2.getInstance().pinTrustedCertificatePublicKey.overload('[Ljava.lang.String;').implementation = function(cert) { console.log('[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {2}: ' + cert); return; }; } catch (err) { console.log('[-] IBM MobileFirst pinTrustedCertificatePublicKey {2} pinner not found'); //console.log(err); errDict[err] = ['com.worklight.wlclient.api.WLClient', 'pinTrustedCertificatePublicKey']; } // IBM WorkLight (ancestor of MobileFirst) HostNameVerifierWithCertificatePinning (quadruple bypass) // /////////////////////////////////////////////////////////////////////////////////////////////////////// try { // Bypass IBM WorkLight {1} var worklight_Activity_1 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSocket').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {1}: ' + a); return; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {1} pinner not found'); //console.log(err); errDict[err] = ['com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning', 'verify']; } try { // Bypass IBM WorkLight {2} var worklight_Activity_2 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {2}: ' + a); return; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {2} pinner not found'); //console.log(err); errDict[err] = ['com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning', 'verify']; } try { // Bypass IBM WorkLight {3} var worklight_Activity_3 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_3.verify.overload('java.lang.String', '[Ljava.lang.String;', '[Ljava.lang.String;').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {3}: ' + a); return; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {3} pinner not found'); //console.log(err); errDict[err] = ['com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning', 'verify']; } try { // Bypass IBM WorkLight {4} var worklight_Activity_4 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_4.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {4}: ' + a); return true; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {4} pinner not found'); //console.log(err); errDict[err] = ['com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning', 'verify']; } // Conscrypt CertPinManager // ////////////////////////////// try { var conscrypt_CertPinManager_Activity = Java.use('com.android.org.conscrypt.CertPinManager'); conscrypt_CertPinManager_Activity.checkChainPinning.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing Conscrypt CertPinManager: ' + a); return; }; } catch (err) { console.log('[-] Conscrypt CertPinManager pinner not found'); //console.log(err); errDict[err] = ['com.android.org.conscrypt.CertPinManager', 'checkChainPinning']; } // Conscrypt CertPinManager (Legacy) // /////////////////////////////////////// try { var legacy_conscrypt_CertPinManager_Activity = Java.use('com.android.org.conscrypt.CertPinManager'); legacy_conscrypt_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing Conscrypt CertPinManager (Legacy): ' + a); return true; }; } catch (err) { console.log('[-] Conscrypt CertPinManager (Legacy) pinner not found'); //console.log(err); errDict[err] = ['com.android.org.conscrypt.CertPinManager', 'isChainValid']; } // CWAC-Netsecurity (unofficial back-port pinner for Android<4.2) CertPinManager // /////////////////////////////////////////////////////////////////////////////////// try { var cwac_CertPinManager_Activity = Java.use('com.commonsware.cwac.netsecurity.conscrypt.CertPinManager'); cwac_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing CWAC-Netsecurity CertPinManager: ' + a); return true; }; } catch (err) { console.log('[-] CWAC-Netsecurity CertPinManager pinner not found'); //console.log(err); errDict[err] = ['com.commonsware.cwac.netsecurity.conscrypt.CertPinManager', 'isChainValid']; } // Worklight Androidgap WLCertificatePinningPlugin // ///////////////////////////////////////////////////// try { var androidgap_WLCertificatePinningPlugin_Activity = Java.use('com.worklight.androidgap.plugin.WLCertificatePinningPlugin'); androidgap_WLCertificatePinningPlugin_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(a, b, c) { console.log('[+] Bypassing Worklight Androidgap WLCertificatePinningPlugin: ' + a); return true; }; } catch (err) { console.log('[-] Worklight Androidgap WLCertificatePinningPlugin pinner not found'); //console.log(err); errDict[err] = ['com.worklight.androidgap.plugin.WLCertificatePinningPlugin', 'execute']; } // Netty FingerprintTrustManagerFactory // ////////////////////////////////////////// try { var netty_FingerprintTrustManagerFactory = Java.use('io.netty.handler.ssl.util.FingerprintTrustManagerFactory'); //NOTE: sometimes this below implementation could be useful //var netty_FingerprintTrustManagerFactory = Java.use('org.jboss.netty.handler.ssl.util.FingerprintTrustManagerFactory'); netty_FingerprintTrustManagerFactory.checkTrusted.implementation = function(type, chain) { console.log('[+] Bypassing Netty FingerprintTrustManagerFactory'); }; } catch (err) { console.log('[-] Netty FingerprintTrustManagerFactory pinner not found'); //console.log(err); errDict[err] = ['io.netty.handler.ssl.util.FingerprintTrustManagerFactory', 'checkTrusted']; } // Squareup CertificatePinner [OkHTTP stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException" ); // Retrieve the method raising the SSLPeerUnverifiedException var callingFunctionStack = stackTrace[exceptionStackIndex + 1]; var className = callingFunctionStack.getClassName(); var methodName = callingFunctionStack.getMethodName(); var callingClass = Java.use(className); var callingMethod = callingClass[methodName]; console.log('\x1b[36m[!] Unexpected SSLPeerUnverifiedException occurred related to the method "'+className+'.'+methodName+'"\x1b[0m'); //console.log("Stacktrace details:\n"+stackTrace); // Checking if the SSLPeerUnverifiedException was generated by an usually negligible (not blocking) method if (className == 'com.android.org.conscrypt.ActiveSession' || className == 'com.google.android.gms.org.conscrypt.ActiveSession') { throw 'Reason: skipped SSLPeerUnverifiedException bypass since the exception was raised from a (usually) non blocking method on the Android app'; } else { console.log('\x1b[34m[!] Starting to dynamically circumvent the SSLPeerUnverifiedException for the method "'+className+'.'+methodName+'"...\x1b[0m'); var retTypeName = callingMethod.returnType.type; // Skip it when the calling method was already bypassed with Frida if (!(callingMethod.implementation)) { // Trying to bypass (via implementation) the SSLPeerUnverifiedException if due to an uncommon SSL Pinning method callingMethod.implementation = function() { console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+className+'.'+methodName+'" via Frida function implementation\x1b[0m'); returner(retTypeName); } } } } catch (err2) { // Dynamic circumvention via function implementation does not works, then trying via function overloading if (String(err2).includes('.overload')) { overloader(err2, className, methodName, retTypeName); } else { if (String(err2).includes('SSLPeerUnverifiedException')) { console.log('\x1b[36m[-] Failed to dynamically circumvent SSLPeerUnverifiedException -> '+err2+'\x1b[0m'); } else { //console.log('\x1b[36m[-] Another kind of exception raised during overloading -> '+err2+'\x1b[0m'); } } } //console.log('\x1b[36m[+] SSLPeerUnverifiedException hooked\x1b[0m'); return this.$init(reason); }; } catch (err1) { //console.log('\x1b[36m[-] SSLPeerUnverifiedException not found\x1b[0m'); //console.log('\x1b[36m'+err1+'\x1b[0m'); } }); }, 0); function returner(typeName) { // This is a improvable rudimentary fix, if not works you can patch it manually //console.log("typeName: "+typeName) if (typeName === undefined || typeName === 'void') { return; } else if (typeName === 'boolean') { return true; } else { return null; } } function overloader(errStr, targetClass, targetFunc, retType) { // One ring to overload them all.. ;-) var tClass = Java.use(targetClass); var tFunc = tClass[targetFunc]; var params = []; var argList = []; var overloads = tFunc.overloads; var returnTypeName = retType; var splittedList = String(errStr).split('.overload'); for (var n=1; n')) { continue; } console.log('\x1b[34m[!] Found the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"\x1b[0m'); // Check if extractedOverload is empty if (!extractedOverload) { // Overloading method withouth arguments tFunc.overload().implementation = function() { var printStr = printer(); console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m'); returner(returnTypeName); } } else { // Check if extractedOverload has multiple arguments if (extractedOverload.includes(',')) { argList = extractedOverload.split(', '); } // Considering max 8 arguments for the method to overload (Note: increase it, if needed) if (argList.length == 0) { tFunc.overload(extractedOverload).implementation = function(a) { var printStr = printer(); console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m'); returner(returnTypeName); } } else if (argList.length == 2) { tFunc.overload(argList[0], argList[1]).implementation = function(a,b) { var printStr = printer(a); console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m'); returner(returnTypeName); } } else if (argList.length == 3) { tFunc.overload(argList[0], argList[1], argList[2]).implementation = function(a,b,c) { var printStr = printer(a,b); console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m'); returner(returnTypeName); } } else if (argList.length == 4) { tFunc.overload(argList[0], argList[1], argList[2], argList[3]).implementation = function(a,b,c,d) { var printStr = printer(a,b,c); console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m'); returner(returnTypeName); } } else if (argList.length == 5) { tFunc.overload(argList[0], argList[1], argList[2], argList[3], argList[4]).implementation = function(a,b,c,d,e) { var printStr = printer(a,b,c,d); console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m'); returner(returnTypeName); } } else if (argList.length == 6) { tFunc.overload(argList[0], argList[1], argList[2], argList[3], argList[4], argList[5]).implementation = function(a,b,c,d,e,f) { var printStr = printer(a,b,c,d,e); console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m'); returner(returnTypeName); } } else if (argList.length == 7) { tFunc.overload(argList[0], argList[1], argList[2], argList[3], argList[4], argList[5], argList[6]).implementation = function(a,b,c,d,e,f,g) { var printStr = printer(a,b,c,d,e,f); console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m'); returner(returnTypeName); } } else if (argList.length == 8) { tFunc.overload(argList[0], argList[1], argList[2], argList[3], argList[4], argList[5], argList[6], argList[7]).implementation = function(a,b,c,d,e,f,g,h) { var printStr = printer(a,b,c,d,e,f,g); console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m'); returner(returnTypeName); } } } } } function printer(a,b,c,d,e,f,g,h) { // Build the string to print for the overloaded pinner var printList = []; var printStr = ''; if (typeof a === 'string') { printList.push(a); } if (typeof b === 'string') { printList.push(b); } if (typeof c === 'string') { printList.push(c); } if (typeof d === 'string') { printList.push(d); } if (typeof e === 'string') { printList.push(e); } if (typeof f === 'string') { printList.push(f); } if (typeof g === 'string') { printList.push(g); } if (typeof h === 'string') { printList.push(h); } if (printList.length !== 0) { printStr = ' check for:'; for (var i=0; i 0) { var BufferObj = Buffer.$new(); requestBody.writeTo(BufferObj); try { console.log("\nrequest body String:\n", BufferObj.readString(), "\n"); } catch (error) { try { console.log("\nrequest body ByteString:\n", ByteString.of(BufferObj.readByteArray()).hex(), "\n"); } catch (error) { console.log("error 1:", error); } } } } catch (error) { console.log("error 2:", error); } var response = chain.proceed(request); try { console.log("MyInterceptor.intercept onLeave:", response, "\nresponse headers:\n", response.headers()); var responseBody = response.body(); var contentLength = responseBody ? responseBody.contentLength() : 0; if (contentLength > 0) { console.log("\nresponsecontentLength:", contentLength, "responseBody:", responseBody, "\n"); var ContentType = response.headers().get("Content-Type"); console.log("ContentType:", ContentType); if (ContentType.indexOf("video") == -1) { if (ContentType.indexOf("application") == 0) { var source = responseBody.source(); if (ContentType.indexOf("application/zip") != 0) { try { console.log("\nresponse.body StringClass\n", source.readUtf8(), "\n"); } catch (error) { try { console.log("\nresponse.body ByteString\n", source.readByteString().hex(), "\n"); } catch (error) { console.log("error 4:", error); } } } } } } } catch (error) { console.log("error 3:", error); } return response; } } }); var ArrayList = Java.use("java.util.ArrayList"); var OkHttpClient = Java.use("okhttp3.OkHttpClient"); console.log(OkHttpClient); OkHttpClient.$init.overload('okhttp3.OkHttpClient$Builder').implementation = function(Builder) { console.log("OkHttpClient.$init:", this, Java.cast(Builder.interceptors(), ArrayList)); this.$init(Builder); }; var MyInterceptorObj = MyInterceptor.$new(); var Builder = Java.use("okhttp3.OkHttpClient$Builder"); console.log(Builder); Builder.build.implementation = function() { this.interceptors().clear(); //var MyInterceptorObj = MyInterceptor.$new(); this.interceptors().add(MyInterceptorObj); var result = this.build(); return result; }; Builder.addInterceptor.implementation = function(interceptor) { this.interceptors().clear(); //var MyInterceptorObj = MyInterceptor.$new(); this.interceptors().add(MyInterceptorObj); return this; //return this.addInterceptor(interceptor); }; console.log("hook_okhttp3..."); }); } /////////////////////////////TSL BYPASS//////////////////////////////// /////////////////////////////TSL BYPASS//////////////////////////////// Java.perform(function() { var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager'); // Implementa una clase personalizada que eluda la comprobación de certificados var CustomTrustManager = Java.registerClass({ name: 'com.example.CustomTrustManager', implements: [X509TrustManager], methods: { checkClientTrusted: function(chain, authType) {}, checkServerTrusted: function(chain, authType) {}, getAcceptedIssuers: function() { return []; } } }); // Obtén una instancia del TrustManager original var TrustManager = Java.array('javax.net.ssl.TrustManager', [CustomTrustManager.$new()]); // Obtén una instancia de SSLContext y configúrala con el TrustManager personalizado var SSLContext = Java.use('javax.net.ssl.SSLContext'); SSLContext.init.overload('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom').implementation = function(keyManagers, trustManagers, secureRandom) { return this.init(keyManagers, TrustManager, secureRandom); }; }); /////////////////////////////TSL BYPASS//////////////////////////////// /** A Frida script that disables Flutter's TLS verification This script works on Android x86, Android x64 and iOS x64. It uses pattern matching to find [ssl_verify_peer_cert in handshake.cc](https://github.com/google/boringssl/blob/master/ssl/handshake.cc#L323) If the script doesn't work, take a look at https://github.com/NVISOsecurity/disable-flutter-tls-verification#warning-what-if-this-script-doesnt-work */ var config = { "ios": { "modulename": "Flutter", "patterns": { "arm64": [ "FF 83 01 D1 FA 67 01 A9 F8 5F 02 A9 F6 57 03 A9 F4 4F 04 A9 FD 7B 05 A9 FD 43 01 91 F? 03 00 AA ?? 0? 40 F9 ?8 1? 40 F9 15 ?? 4? F9 B5 00 00 B4", ], }, }, "android": { "modulename": "libflutter.so", "patterns": { "arm64": [ "F? 0F 1C F8 F? 5? 01 A9 F? 5? 02 A9 F? ?? 03 A9 ?? ?? ?? ?? 68 1A 40 F9", "F? 43 01 D1 FE 67 01 A9 F8 5F 02 A9 F6 57 03 A9 F4 4F 04 A9 13 00 40 F9 F4 03 00 AA 68 1A 40 F9", "FF 43 01 D1 FE 67 01 A9 ?? ?? 06 94 ?? 7? 06 94 68 1A 40 F9 15 15 41 F9 B5 00 00 B4 B6 4A 40 F9", ], "arm": [ "2D E9 F? 4? D0 F8 00 80 81 46 D8 F8 18 00 D0 F8 ??", ], "x64": [ "55 41 57 41 56 41 55 41 54 53 50 49 89 f? 4c 8b 37 49 8b 46 30 4c 8b a? ?? 0? 00 00 4d 85 e? 74 1? 4d 8b", "55 41 57 41 56 41 55 41 54 53 48 83 EC 18 49 89 FF 48 8B 1F 48 8B 43 30 4C 8B A0 28 02 00 00 4D 85 E4 74" ] } } }; var TLSValidationDisabled = false; if (Java.available) { console.log("[+] Java environment detected"); Java.perform(hookSystemLoadLibrary); } else if (ObjC.available) { console.log("[+] iOS environment detected"); } disableTLSValidation(); setTimeout(disableTLSValidation, 2000, true); function hookSystemLoadLibrary() { const System = Java.use('java.lang.System'); const Runtime = Java.use('java.lang.Runtime'); const SystemLoad_2 = System.loadLibrary.overload('java.lang.String'); const VMStack = Java.use('dalvik.system.VMStack'); SystemLoad_2.implementation = function(library) { try { const loaded = Runtime.getRuntime().loadLibrary0(VMStack.getCallingClassLoader(), library); if (library === 'flutter') { console.log("[+] libflutter.so loaded"); disableTLSValidation(); } return loaded; } catch (ex) { console.log(ex); } }; } function disableTLSValidation(fallback = false) { if (TLSValidationDisabled) return; var platformConfig = config[Java.available ? "android" : "ios"]; var m = Process.findModuleByName(platformConfig["modulename"]); // If there is no loaded Flutter module, the setTimeout may trigger a second time, but after that we give up if (m === null) { if (fallback) console.log("[!] Flutter module not found."); return; } if (Process.arch in platformConfig["patterns"]) { findAndPatch(m, platformConfig["patterns"][Process.arch], Java.available && Process.arch == "arm" ? 1 : 0, fallback); } else { console.log("[!] Processor architecture not supported: ", Process.arch); } if (!TLSValidationDisabled) { if (fallback) { if (m.enumerateRanges('r-x').length == 0) { console.log('[!] No memory ranges found in Flutter library. This is either a Frida bug, or the application is using some kind of RASP.'); } else { console.log('[!] ssl_verify_peer_cert not found. Please open an issue at https://github.com/NVISOsecurity/disable-flutter-tls-verification/issues'); } } else { console.log('[!] ssl_verify_peer_cert not found. Trying again...'); } } } function findAndPatch(m, patterns, thumb, fallback) { console.log("[+] Flutter library found"); var ranges = m.enumerateRanges('r-x'); ranges.forEach(range => { patterns.forEach(pattern => { Memory.scan(range.base, range.size, pattern, { onMatch: function(address, size) { console.log('[+] ssl_verify_peer_cert found at offset: 0x' + (address - m.base).toString(16)); TLSValidationDisabled = true; hook_ssl_verify_peer_cert(address.add(thumb)); } }); }); }); } function hook_ssl_verify_peer_cert(address) { Interceptor.replace(address, new NativeCallback((pathPtr, flags) => { return 0; }, 'int', ['pointer', 'int'])); } //https://github.com/Eltion/Instagram-SSL-Pinning-Bypass 'use strict' function hook_proxygen_SSLVerification(library) { const functionName = "_ZN8proxygen15SSLVerification17verifyWithMetricsEbP17x509_store_ctx_stRKNSt6__ndk112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEPNS0_31SSLFailureVerificationCallbacksEPNS0_31SSLSuccessVerificationCallbacksERKNS_15TimeUtilGenericINS3_6chrono12steady_clockEEERNS_10TraceEventE"; try { const f = Module.getExportByName(library.name, functionName); Interceptor.attach(f, { onLeave: function (retvalue) { retvalue.replace(1); } }); logger(`[*][+] Hooked function: ${functionName}`); } catch (err) { logger(`[*][-] Failed to hook function: ${functionName}`); logger(err.toString()) } } function waitForModule(moduleName) { return new Promise(resolve => { const interval = setInterval(() => { const module = Process.findModuleByName(moduleName); if (module != null) { clearInterval(interval); resolve(module); } }, 300); }); } function logger(message) { console.log(message); Java.perform(function () { var Log = Java.use("android.util.Log"); Log.v("INSTAGRAM_SSL_PINNING_BYPASS", message); }); } logger("[*][*] Waiting for libliger..."); waitForModule("libliger.so").then((lib) => { logger(`[*][+] Found libliger at: ${lib.base}`) hook_proxygen_SSLVerification(lib); }); //Universal Android SSL Pinning Bypass #2 Java.perform(function () { try { var array_list = Java.use("java.util.ArrayList"); var ApiClient = Java.use('com.android.org.conscrypt.TrustManagerImpl'); if (ApiClient.checkTrustedRecursive) { logger("[*][+] Hooked checkTrustedRecursive") ApiClient.checkTrustedRecursive.implementation = function (a1, a2, a3, a4, a5, a6) { var k = array_list.$new(); return k; } } else { logger("[*][-] checkTrustedRecursive not Found") } } catch(e) { logger("[*][-] Failed to hook checkTrustedRecursive") } }); Java.perform(function () { try { const x509TrustManager = Java.use("javax.net.ssl.X509TrustManager"); const sSLContext = Java.use("javax.net.ssl.SSLContext"); const TrustManager = Java.registerClass({ implements: [x509TrustManager], methods: { checkClientTrusted(chain, authType) { }, checkServerTrusted(chain, authType) { }, getAcceptedIssuers() { return []; }, }, name: "com.leftenter.tiktok", }); const TrustManagers = [TrustManager.$new()]; const SSLContextInit = sSLContext.init.overload( "[Ljavax.net.ssl.KeyManager;", "[Ljavax.net.ssl.TrustManager;", "java.security.SecureRandom"); SSLContextInit.implementation = function (keyManager, trustManager, secureRandom) { SSLContextInit.call(this, keyManager, TrustManagers, secureRandom); }; logger("[*][+] Hooked SSLContextInit") } catch (e) { logger("[*][-] Failed to hook SSLContextInit") } }) // frida -U -l network-security-config-bypass.js --no-pause -f your.package.name Java.perform(function() { NetworkSecurityConfig_Builder = Java.use("android.security.net.config.NetworkSecurityConfig$Builder") CertificatesEntryRef = Java.use("android.security.net.config.CertificatesEntryRef") CertificateSource = Java.use("android.security.net.config.CertificateSource") UserCertificateSource = Java.use("android.security.net.config.UserCertificateSource") NetworkSecurityConfig_Builder.getEffectiveCertificatesEntryRefs.implementation = function() { origin = this.getEffectiveCertificatesEntryRefs() source = UserCertificateSource.getInstance() userCert = CertificatesEntryRef.$new(source, true) origin.add(userCert) return origin } }) /** * Flutter, OkHTTPv3, HttpsURLConnection, TrustKit universal SSL unpinner for Android. * * Usage: * * frida --codeshare vadim-a-yegorov/universalunpinner -f YOUR_BINARY -U --no-pause * * incogbyte, Vadim A. Yegorov, apkunpacker, NVISOsecurity, TheDauntless * https://gist.github.com/vadim-a-yegorov/bc63e939a4b296482183537e11524f3f */ function disableFlutterPinningv2() { var config = { "ios": { "modulename": "Flutter", "patterns": { "arm64": [ "FF 83 01 D1 FA 67 01 A9 F8 5F 02 A9 F6 57 03 A9 F4 4F 04 A9 FD 7B 05 A9 FD 43 01 91 F? 03 00 AA ?? 0? 40 F9 ?8 1? 40 F9 15 ?? 4? F9 B5 00 00 B4", ], }, }, "android": { "modulename": "libflutter.so", "patterns": { "arm64": [ "F? 0F 1C F8 F? 5? 01 A9 F? 5? 02 A9 F? ?? 03 A9 ?? ?? ?? ?? 68 1A 40 F9", "F? 43 01 D1 FE 67 01 A9 F8 5F 02 A9 F6 57 03 A9 F4 4F 04 A9 13 00 40 F9 F4 03 00 AA 68 1A 40 F9", "FF 43 01 D1 FE 67 01 A9 ?? ?? 06 94 ?? 7? 06 94 68 1A 40 F9 15 15 41 F9 B5 00 00 B4 B6 4A 40 F9", ], "arm": [ "2D E9 F? 4? D0 F8 00 80 81 46 D8 F8 18 00 D0 F8 ??", ], "x64": [ "55 41 57 41 56 41 55 41 54 53 50 49 89 f? 4c 8b 37 49 8b 46 30 4c 8b a? ?? 0? 00 00 4d 85 e? 74 1? 4d 8b", "55 41 57 41 56 41 55 41 54 53 48 83 EC 18 49 89 FF 48 8B 1F 48 8B 43 30 4C 8B A0 28 02 00 00 4D 85 E4 74" ] } } }; var TLSValidationDisabled = false; if (Java.available) { console.log("[+] Java environment detected"); Java.perform(hookSystemLoadLibrary); } else if (ObjC.available) { console.log("[+] iOS environment detected"); } disableTLSValidation(); setTimeout(disableTLSValidation, 2000, true); function hookSystemLoadLibrary() { const System = Java.use('java.lang.System'); const Runtime = Java.use('java.lang.Runtime'); const SystemLoad_2 = System.loadLibrary.overload('java.lang.String'); const VMStack = Java.use('dalvik.system.VMStack'); SystemLoad_2.implementation = function(library) { try { const loaded = Runtime.getRuntime().loadLibrary0(VMStack.getCallingClassLoader(), library); if (library === 'flutter') { console.log("[+] libflutter.so loaded"); disableTLSValidation(); } return loaded; } catch (ex) { console.log(ex); } }; } function disableTLSValidation(fallback = false) { if (TLSValidationDisabled) return; var platformConfig = config[Java.available ? "android" : "ios"]; var m = Process.findModuleByName(platformConfig["modulename"]); // If there is no loaded Flutter module, the setTimeout may trigger a second time, but after that we give up if (m === null) { if (fallback) console.log("[!] Flutter module not found."); return; } if (Process.arch in platformConfig["patterns"]) { findAndPatch(m, platformConfig["patterns"][Process.arch], Java.available && Process.arch == "arm" ? 1 : 0, fallback); } else { console.log("[!] Processor architecture not supported: ", Process.arch); } if (!TLSValidationDisabled) { if (fallback) { if (m.enumerateRanges('r-x').length == 0) { console.log('[!] No memory ranges found in Flutter library. This is either a Frida bug, or the application is using some kind of RASP.'); } else { console.log('[!] ssl_verify_peer_cert not found. Please open an issue at https://github.com/NVISOsecurity/disable-flutter-tls-verification/issues'); } } else { console.log('[!] ssl_verify_peer_cert not found. Trying again...'); } } } function findAndPatch(m, patterns, thumb, fallback) { console.log("[+] Flutter library found"); var ranges = m.enumerateRanges('r-x'); ranges.forEach(range => { patterns.forEach(pattern => { Memory.scan(range.base, range.size, pattern, { onMatch: function(address, size) { console.log('[+] ssl_verify_peer_cert found at offset: 0x' + (address - m.base).toString(16)); TLSValidationDisabled = true; hook_ssl_verify_peer_cert(address.add(thumb)); } }); }); }); } function hook_ssl_verify_peer_cert(address) { Interceptor.replace(address, new NativeCallback((pathPtr, flags) => { return 0; }, 'int', ['pointer', 'int'])); } } function hook_ssl_verify_result(address) { Interceptor.attach(address, { onEnter: function(args) { console.log("Disabling SSL validation") }, onLeave: function(retval) { console.log("Retval: " + retval) retval.replace(0x1); } }); } function disablePinning() { try { var m = Process.findModuleByName("libflutter.so"); var pattern = "2d e9 f0 4f a3 b0 82 46 50 20 10 70" var res = Memory.scan(m.base, m.size, pattern, { onMatch: function(address, size) { console.log('[+] ssl_verify_result found at: ' + address.toString()); hook_ssl_verify_result(address.add(0x01)); }, onError: function(reason) { console.log('[!] There was an error scanning memory'); }, onComplete: function() { console.log("All done") } }); } catch (e) { console.warn("Not A Flutter App"); } } function CommonMethods() { try { const HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection"); HttpsURLConnection.setDefaultHostnameVerifier.implementation = function(hostnameVerifier) { console.log('[*] Bypassing HttpsURLConnection (setDefaultHostnameVerifier)'); return; }; console.log('[+] HttpsURLConnection (setDefaultHostnameVerifier)'); } catch (err) { console.log('[!] HttpsURLConnection (setDefaultHostnameVerifier)'); } try { const HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection"); HttpsURLConnection.setSSLSocketFactory.implementation = function(SSLSocketFactory) { console.log('[*] Bypassing HttpsURLConnection (setSSLSocketFactory)'); return; }; console.log('[+] HttpsURLConnection (setSSLSocketFactory)'); } catch (err) { console.log('[!] HttpsURLConnection (setSSLSocketFactory)'); } try { const HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection"); HttpsURLConnection.setHostnameVerifier.implementation = function(hostnameVerifier) { console.log('[*] Bypassing HttpsURLConnection (setHostnameVerifier)'); return; }; console.log('[+] HttpsURLConnection (setHostnameVerifier)'); } catch (err) { console.log('[!] HttpsURLConnection (setHostnameVerifier)'); } try { const X509TrustManager = Java.use('javax.net.ssl.X509TrustManager'); const SSLContext = Java.use('javax.net.ssl.SSLContext'); const TrustManager = Java.registerClass({ name: 'incogbyte.bypass.test.TrustManager', implements: [X509TrustManager], methods: { checkClientTrusted: function(chain, authType) {}, checkServerTrusted: function(chain, authType) {}, getAcceptedIssuers: function() { return []; } } }); const TrustManagers = [TrustManager.$new()]; const SSLContext_init = SSLContext.init.overload('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom'); SSLContext_init.implementation = function(keyManager, trustManager, secureRandom) { console.log('[*] Bypassing Trustmanager (Android < 7) request'); SSLContext_init.call(this, keyManager, TrustManagers, secureRandom); }; console.log('[+] SSLContext'); } catch (err) { console.log('[!] SSLContext'); } try { const array_list = Java.use("java.util.ArrayList"); const TrustManagerImpl = Java.use('com.android.org.conscrypt.TrustManagerImpl'); TrustManagerImpl.checkTrustedRecursive.implementation = function(a1, a2, a3, a4, a5, a6) { console.log('[*] Bypassing TrustManagerImpl checkTrusted '); return array_list.$new(); } TrustManagerImpl.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) { console.log('[*] Bypassing TrustManagerImpl verifyChain: ' + host); return untrustedChain; }; console.log('[+] TrustManagerImpl'); } catch (err) { console.log('[!] TrustManagerImpl'); } try { const okhttp3_Activity_1 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_1.check.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[*] Bypassing OkHTTPv3 (list): ' + a); }; console.log('[+] OkHTTPv3 (list)'); } catch (err) { console.log('[!] OkHTTPv3 (list)'); } try { const okhttp3_Activity_2 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_2.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function(a, b) { console.log('[*] Bypassing OkHTTPv3 (cert): ' + a); return true; }; console.log('[+] OkHTTPv3 (cert)'); } catch (err) { console.log('[!] OkHTTPv3 (cert)'); } try { const okhttp3_Activity_3 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_3.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function(a, b) { console.log('[*] Bypassing OkHTTPv3 (cert array): ' + a); return true; }; console.log('[+] OkHTTPv3 (cert array)'); } catch (err) { console.log('[!] OkHTTPv3 (cert array)'); } try { const okhttp3_Activity_4 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_4['check$okhttp'].implementation = function(a, b) { console.log('[*] Bypassing OkHTTPv3 ($okhttp): ' + a); }; console.log('[+] OkHTTPv3 ($okhttp)'); } catch (err) { console.log('[!] OkHTTPv3 ($okhttp)'); } try { const trustkit_Activity_1 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier'); trustkit_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) { console.log('[*] Bypassing Trustkit OkHostnameVerifier(SSLSession): ' + a); return true; }; console.log('[+] Trustkit OkHostnameVerifier(SSLSession)'); } catch (err) { console.log('[!] Trustkit OkHostnameVerifier(SSLSession)'); } try { const trustkit_Activity_2 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier'); trustkit_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) { console.log('[*] Bypassing Trustkit OkHostnameVerifier(cert): ' + a); return true; }; console.log('[+] Trustkit OkHostnameVerifier(cert)'); } catch (err) { console.log('[!] Trustkit OkHostnameVerifier(cert)'); } try { const trustkit_PinningTrustManager = Java.use('com.datatheorem.android.trustkit.pinning.PinningTrustManager'); trustkit_PinningTrustManager.checkServerTrusted.implementation = function() { console.log('[*] Bypassing Trustkit PinningTrustManager'); }; console.log('[+] Trustkit PinningTrustManager'); } catch (err) { console.log('[!] Trustkit PinningTrustManager'); } try { const appcelerator_PinningTrustManager = Java.use('appcelerator.https.PinningTrustManager'); appcelerator_PinningTrustManager.checkServerTrusted.implementation = function() { console.log('[*] Bypassing Appcelerator PinningTrustManager'); }; console.log('[+] Appcelerator PinningTrustManager'); } catch (err) { console.log('[!] Appcelerator PinningTrustManager'); } try { const OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl'); OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certRefs, JavaObject, authMethod) { console.log('[*] Bypassing OpenSSLSocketImpl Conscrypt'); }; console.log('[+] OpenSSLSocketImpl Conscrypt'); } catch (err) { console.log('[!] OpenSSLSocketImpl Conscrypt'); } try { const OpenSSLEngineSocketImpl_Activity = Java.use('com.android.org.conscrypt.OpenSSLEngineSocketImpl'); OpenSSLEngineSocketImpl_Activity.verifyCertificateChain.overload('[Ljava.lang.Long;', 'java.lang.String').implementation = function(a, b) { console.log('[*] Bypassing OpenSSLEngineSocketImpl Conscrypt: ' + b); }; console.log('[+] OpenSSLEngineSocketImpl Conscrypt'); } catch (err) { console.log('[!] OpenSSLEngineSocketImpl Conscrypt'); } try { const OpenSSLSocketImpl_Harmony = Java.use('org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl'); OpenSSLSocketImpl_Harmony.verifyCertificateChain.implementation = function(asn1DerEncodedCertificateChain, authMethod) { console.log('[*] Bypassing OpenSSLSocketImpl Apache Harmony'); }; console.log('[+] OpenSSLSocketImpl Apache Harmony'); } catch (err) { console.log('[!] OpenSSLSocketImpl Apache Harmony'); } try { const phonegap_Activity = Java.use('nl.xservices.plugins.sslCertificateChecker'); phonegap_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(a, b, c) { console.log('[*] Bypassing PhoneGap sslCertificateChecker: ' + a); return true; }; console.log('[+] PhoneGap sslCertificateChecker'); } catch (err) { console.log('[!] PhoneGap sslCertificateChecker'); } try { const WLClient_Activity_1 = Java.use('com.worklight.wlclient.api.WLClient'); WLClient_Activity_1.getInstance().pinTrustedCertificatePublicKey.overload('java.lang.String').implementation = function(cert) { console.log('[*] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey (string): ' + cert); return; }; console.log('[+] IBM MobileFirst pinTrustedCertificatePublicKey (string)'); } catch (err) { console.log('[!] IBM MobileFirst pinTrustedCertificatePublicKey (string)'); } try { const WLClient_Activity_2 = Java.use('com.worklight.wlclient.api.WLClient'); WLClient_Activity_2.getInstance().pinTrustedCertificatePublicKey.overload('[Ljava.lang.String;').implementation = function(cert) { console.log('[*] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey (string array): ' + cert); return; }; console.log('[+] IBM MobileFirst pinTrustedCertificatePublicKey (string array)'); } catch (err) { console.log('[!] IBM MobileFirst pinTrustedCertificatePublicKey (string array)'); } try { const worklight_Activity_1 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSocket').implementation = function(a, b) { console.log('[*] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSocket): ' + a); return; }; console.log('[+] IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSocket)'); } catch (err) { console.log('[!] IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSocket)'); } try { const worklight_Activity_2 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) { console.log('[*] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning (cert): ' + a); return; }; console.log('[+] IBM WorkLight HostNameVerifierWithCertificatePinning (cert)'); } catch (err) { console.log('[!] IBM WorkLight HostNameVerifierWithCertificatePinning (cert)'); } try { const worklight_Activity_3 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_3.verify.overload('java.lang.String', '[Ljava.lang.String;', '[Ljava.lang.String;').implementation = function(a, b) { console.log('[*] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning (string string): ' + a); return; }; console.log('[+] IBM WorkLight HostNameVerifierWithCertificatePinning (string string)'); } catch (err) { console.log('[!] IBM WorkLight HostNameVerifierWithCertificatePinning (string string)'); } try { const worklight_Activity_4 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_4.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) { console.log('[*] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSession): ' + a); return true; }; console.log('[+] IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSession)'); } catch (err) { console.log('[!] IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSession)'); } try { const conscrypt_CertPinManager_Activity = Java.use('com.android.org.conscrypt.CertPinManager'); conscrypt_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[*] Bypassing Conscrypt CertPinManager: ' + a); return true; }; console.log('[+] Conscrypt CertPinManager'); } catch (err) { console.log('[!] Conscrypt CertPinManager'); } try { const cwac_CertPinManager_Activity = Java.use('com.commonsware.cwac.netsecurity.conscrypt.CertPinManager'); cwac_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[*] Bypassing CWAC-Netsecurity CertPinManager: ' + a); return true; }; console.log('[+] CWAC-Netsecurity CertPinManager'); } catch (err) { console.log('[!] CWAC-Netsecurity CertPinManager'); } try { const androidgap_WLCertificatePinningPlugin_Activity = Java.use('com.worklight.androidgap.plugin.WLCertificatePinningPlugin'); androidgap_WLCertificatePinningPlugin_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(a, b, c) { console.log('[*] Bypassing Worklight Androidgap WLCertificatePinningPlugin: ' + a); return true; }; console.log('[+] Worklight Androidgap WLCertificatePinningPlugin'); } catch (err) { console.log('[!] Worklight Androidgap WLCertificatePinningPlugin'); } try { const netty_FingerprintTrustManagerFactory = Java.use('io.netty.handler.ssl.util.FingerprintTrustManagerFactory'); netty_FingerprintTrustManagerFactory.checkTrusted.implementation = function(type, chain) { console.log('[*] Bypassing Netty FingerprintTrustManagerFactory'); }; console.log('[+] Netty FingerprintTrustManagerFactory'); } catch (err) { console.log('[!] Netty FingerprintTrustManagerFactory'); } try { const Squareup_CertificatePinner_Activity_1 = Java.use('com.squareup.okhttp.CertificatePinner'); Squareup_CertificatePinner_Activity_1.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function(a, b) { console.log('[*] Bypassing Squareup CertificatePinner (cert): ' + a); return; }; console.log('[+] Squareup CertificatePinner (cert)'); } catch (err) { console.log('[!] Squareup CertificatePinner (cert)'); } try { const Squareup_CertificatePinner_Activity_2 = Java.use('com.squareup.okhttp.CertificatePinner'); Squareup_CertificatePinner_Activity_2.check.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[*] Bypassing Squareup CertificatePinner (list): ' + a); return null; }; console.log('[+] Squareup CertificatePinner (list)'); } catch (err) { console.log('[!] Squareup CertificatePinner (list)'); } try { const Squareup_OkHostnameVerifier_Activity_1 = Java.use('com.squareup.okhttp.internal.tls.OkHostnameVerifier'); Squareup_OkHostnameVerifier_Activity_1.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) { console.log('[*] Bypassing Squareup OkHostnameVerifier (cert): ' + a); return true; }; console.log('[+] Squareup OkHostnameVerifier (cert)'); } catch (err) { console.log('[!] Squareup OkHostnameVerifier (cert)'); } try { const Squareup_OkHostnameVerifier_Activity_2 = Java.use('com.squareup.okhttp.internal.tls.OkHostnameVerifier'); Squareup_OkHostnameVerifier_Activity_2.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) { console.log('[*] Bypassing Squareup OkHostnameVerifier (SSLSession): ' + a); return true; }; console.log('[+] Squareup OkHostnameVerifier (SSLSession)'); } catch (err) { console.log('[!] Squareup OkHostnameVerifier (SSLSession)'); } try { const AndroidWebViewClient_Activity_1 = Java.use('android.webkit.WebViewClient'); AndroidWebViewClient_Activity_1.onReceivedSslError.overload('android.webkit.WebView', 'android.webkit.SslErrorHandler', 'android.net.http.SslError').implementation = function(obj1, obj2, obj3) { console.log('[*] Bypassing Android WebViewClient (SslErrorHandler)'); }; console.log('[+] Android WebViewClient (SslErrorHandler)'); } catch (err) { console.log('[!] Android WebViewClient (SslErrorHandler)'); } try { const AndroidWebViewClient_Activity_2 = Java.use('android.webkit.WebViewClient'); AndroidWebViewClient_Activity_2.onReceivedSslError.overload('android.webkit.WebView', 'android.webkit.WebResourceRequest', 'android.webkit.WebResourceError').implementation = function(obj1, obj2, obj3) { console.log('[*] Bypassing Android WebViewClient (WebResourceError)'); }; console.log('[+] Android WebViewClient (WebResourceError)'); } catch (err) { console.log('[!] Android WebViewClient (WebResourceError)'); } try { const CordovaWebViewClient_Activity = Java.use('org.apache.cordova.CordovaWebViewClient'); CordovaWebViewClient_Activity.onReceivedSslError.overload('android.webkit.WebView', 'android.webkit.SslErrorHandler', 'android.net.http.SslError').implementation = function(obj1, obj2, obj3) { console.log('[*] Bypassing Apache Cordova WebViewClient'); obj3.proceed(); }; } catch (err) { console.log('[!] Apache Cordova WebViewClient'); } try { const boye_AbstractVerifier = Java.use('ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier'); boye_AbstractVerifier.verify.implementation = function(host, ssl) { console.log('[*] Bypassing Boye AbstractVerifier: ' + host); }; } catch (err) { console.log('[!] Boye AbstractVerifier'); } } function dynamicPatching() { var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager'); var SSLContext = Java.use('javax.net.ssl.SSLContext'); var TrustManager = Java.registerClass({ name: 'incogbyte.bypass.test.TrustManager', implements: [X509TrustManager], methods: { checkClientTrusted: function(chain, authType) {}, checkServerTrusted: function(chain, authType) {}, getAcceptedIssuers: function() { return []; } } }); try { var okhttp3_Activity_1 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_1.check.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {1}: ' + a); return; }; } catch (err) { console.log('[-] OkHTTPv3 {1} pinner not found'); } try { var okhttp3_Activity_2 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_2.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {2}: ' + a); return; }; } catch (err) { console.log('[-] OkHTTPv3 {2} pinner not found'); } try { var okhttp3_Activity_3 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_3.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {3}: ' + a); return; }; } catch (err) { console.log('[-] OkHTTPv3 {3} pinner not found'); } try { var okhttp3_Activity_4 = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity_4.check$okhttp.overload('java.lang.String', 'kotlin.jvm.functions.Function0').implementation = function(a, b) { console.log('[+] Bypassing OkHTTPv3 {4}: ' + a); return; }; } catch (err) { console.log('[-] OkHTTPv3 {4} pinner not found'); } try { var trustkit_Activity_1 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier'); trustkit_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) { console.log('[+] Bypassing Trustkit {1}: ' + a); return true; }; } catch (err) { console.log('[-] Trustkit {1} pinner not found'); } try { var trustkit_Activity_2 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier'); trustkit_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) { console.log('[+] Bypassing Trustkit {2}: ' + a); return true; }; } catch (err) { console.log('[-] Trustkit {2} pinner not found'); } try { var trustkit_PinningTrustManager = Java.use('com.datatheorem.android.trustkit.pinning.PinningTrustManager'); trustkit_PinningTrustManager.checkServerTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String').implementation = function(chain, authType) { console.log('[+] Bypassing Trustkit {3}'); }; } catch (err) { console.log('[-] Trustkit {3} pinner not found'); } try { var array_list = Java.use("java.util.ArrayList"); var TrustManagerImpl_Activity_1 = Java.use('com.android.org.conscrypt.TrustManagerImpl'); TrustManagerImpl_Activity_1.checkTrustedRecursive.implementation = function(certs, ocspData, tlsSctData, host, clientAuth, untrustedChain, trustAnchorChain, used) { console.log('[+] Bypassing TrustManagerImpl (Android > 7) checkTrustedRecursive check: ' + host); return array_list.$new(); }; } catch (err) { console.log('[-] TrustManagerImpl (Android > 7) checkTrustedRecursive check not found'); } try { var TrustManagerImpl_Activity_2 = Java.use('com.android.org.conscrypt.TrustManagerImpl'); TrustManagerImpl_Activity_2.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) { console.log('[+] Bypassing TrustManagerImpl (Android > 7) verifyChain check: ' + host); return untrustedChain; }; } catch (err) { console.log('[-] TrustManagerImpl (Android > 7) verifyChain check not found'); } try { var appcelerator_PinningTrustManager = Java.use('appcelerator.https.PinningTrustManager'); appcelerator_PinningTrustManager.checkServerTrusted.implementation = function(chain, authType) { console.log('[+] Bypassing Appcelerator PinningTrustManager'); return; }; } catch (err) { console.log('[-] Appcelerator PinningTrustManager pinner not found'); } try { var fabric_PinningTrustManager = Java.use('io.fabric.sdk.android.services.network.PinningTrustManager'); fabric_PinningTrustManager.checkServerTrusted.implementation = function(chain, authType) { console.log('[+] Bypassing Fabric PinningTrustManager'); return; }; } catch (err) { console.log('[-] Fabric PinningTrustManager pinner not found'); } try { var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl'); OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certRefs, JavaObject, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Conscrypt {1}'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Conscrypt {1} pinner not found'); } try { var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl'); OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certChain, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Conscrypt {2}'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Conscrypt {2} pinner not found'); } try { var OpenSSLEngineSocketImpl_Activity = Java.use('com.android.org.conscrypt.OpenSSLEngineSocketImpl'); OpenSSLEngineSocketImpl_Activity.verifyCertificateChain.overload('[Ljava.lang.Long;', 'java.lang.String').implementation = function(a, b) { console.log('[+] Bypassing OpenSSLEngineSocketImpl Conscrypt: ' + b); }; } catch (err) { console.log('[-] OpenSSLEngineSocketImpl Conscrypt pinner not found'); } try { var OpenSSLSocketImpl_Harmony = Java.use('org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl'); OpenSSLSocketImpl_Harmony.verifyCertificateChain.implementation = function(asn1DerEncodedCertificateChain, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Apache Harmony'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Apache Harmony pinner not found'); } try { var phonegap_Activity = Java.use('nl.xservices.plugins.sslCertificateChecker'); phonegap_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(a, b, c) { console.log('[+] Bypassing PhoneGap sslCertificateChecker: ' + a); return true; }; } catch (err) { console.log('[-] PhoneGap sslCertificateChecker pinner not found'); } try { var WLClient_Activity_1 = Java.use('com.worklight.wlclient.api.WLClient'); WLClient_Activity_1.getInstance().pinTrustedCertificatePublicKey.overload('java.lang.String').implementation = function(cert) { console.log('[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {1}: ' + cert); return; }; } catch (err) { console.log('[-] IBM MobileFirst pinTrustedCertificatePublicKey {1} pinner not found'); } try { var WLClient_Activity_2 = Java.use('com.worklight.wlclient.api.WLClient'); WLClient_Activity_2.getInstance().pinTrustedCertificatePublicKey.overload('[Ljava.lang.String;').implementation = function(cert) { console.log('[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {2}: ' + cert); return; }; } catch (err) { console.log('[-] IBM MobileFirst pinTrustedCertificatePublicKey {2} pinner not found'); } try { var worklight_Activity_1 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSocket').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {1}: ' + a); return; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {1} pinner not found'); } try { var worklight_Activity_2 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {2}: ' + a); return; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {2} pinner not found'); } try { var worklight_Activity_3 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_3.verify.overload('java.lang.String', '[Ljava.lang.String;', '[Ljava.lang.String;').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {3}: ' + a); return; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {3} pinner not found'); } try { var worklight_Activity_4 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity_4.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {4}: ' + a); return true; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {4} pinner not found'); } try { var conscrypt_CertPinManager_Activity = Java.use('com.android.org.conscrypt.CertPinManager'); conscrypt_CertPinManager_Activity.checkChainPinning.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing Conscrypt CertPinManager: ' + a); return true; }; } catch (err) { console.log('[-] Conscrypt CertPinManager pinner not found'); } try { var legacy_conscrypt_CertPinManager_Activity = Java.use('com.android.org.conscrypt.CertPinManager'); legacy_conscrypt_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing Conscrypt CertPinManager (Legacy): ' + a); return true; }; } catch (err) { console.log('[-] Conscrypt CertPinManager (Legacy) pinner not found'); } try { var cwac_CertPinManager_Activity = Java.use('com.commonsware.cwac.netsecurity.conscrypt.CertPinManager'); cwac_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing CWAC-Netsecurity CertPinManager: ' + a); return true; }; } catch (err) { console.log('[-] CWAC-Netsecurity CertPinManager pinner not found'); } try { var androidgap_WLCertificatePinningPlugin_Activity = Java.use('com.worklight.androidgap.plugin.WLCertificatePinningPlugin'); androidgap_WLCertificatePinningPlugin_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(a, b, c) { console.log('[+] Bypassing Worklight Androidgap WLCertificatePinningPlugin: ' + a); return true; }; } catch (err) { console.log('[-] Worklight Androidgap WLCertificatePinningPlugin pinner not found'); } try { var netty_FingerprintTrustManagerFactory = Java.use('io.netty.handler.ssl.util.FingerprintTrustManagerFactory'); //var netty_FingerprintTrustManagerFactory = Java.use('org.jboss.netty.handler.ssl.util.FingerprintTrustManagerFactory'); netty_FingerprintTrustManagerFactory.checkTrusted.implementation = function(type, chain) { console.log('[+] Bypassing Netty FingerprintTrustManagerFactory'); }; } catch (err) { console.log('[-] Netty FingerprintTrustManagerFactory pinner not found'); } try { var Squareup_CertificatePinner_Activity_1 = Java.use('com.squareup.okhttp.CertificatePinner'); Squareup_CertificatePinner_Activity_1.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function(a, b) { console.log('[+] Bypassing Squareup CertificatePinner {1}: ' + a); return; }; } catch (err) { console.log('[-] Squareup CertificatePinner {1} pinner not found'); } try { var Squareup_CertificatePinner_Activity_2 = Java.use('com.squareup.okhttp.CertificatePinner'); Squareup_CertificatePinner_Activity_2.check.overload('java.lang.String', 'java.util.List').implementation = function(a, b) { console.log('[+] Bypassing Squareup CertificatePinner {2}: ' + a); return; }; } catch (err) { console.log('[-] Squareup CertificatePinner {2} pinner not found'); } try { var Squareup_OkHostnameVerifier_Activity_1 = Java.use('com.squareup.okhttp.internal.tls.OkHostnameVerifier'); Squareup_OkHostnameVerifier_Activity_1.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) { console.log('[+] Bypassing Squareup OkHostnameVerifier {1}: ' + a); return true; }; } catch (err) { console.log('[-] Squareup OkHostnameVerifier check not found'); } try { var Squareup_OkHostnameVerifier_Activity_2 = Java.use('com.squareup.okhttp.internal.tls.OkHostnameVerifier'); Squareup_OkHostnameVerifier_Activity_2.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) { console.log('[+] Bypassing Squareup OkHostnameVerifier {2}: ' + a); return true; }; } catch (err) { console.log('[-] Squareup OkHostnameVerifier check not found'); } try { var AndroidWebViewClient_Activity_1 = Java.use('android.webkit.WebViewClient'); AndroidWebViewClient_Activity_1.onReceivedSslError.overload('android.webkit.WebView', 'android.webkit.SslErrorHandler', 'android.net.http.SslError').implementation = function(obj1, obj2, obj3) { console.log('[+] Bypassing Android WebViewClient check {1}'); }; } catch (err) { console.log('[-] Android WebViewClient {1} check not found'); } try { var AndroidWebViewClient_Activity_2 = Java.use('android.webkit.WebViewClient'); AndroidWebViewClient_Activity_2.onReceivedSslError.overload('android.webkit.WebView', 'android.webkit.WebResourceRequest', 'android.webkit.WebResourceError').implementation = function(obj1, obj2, obj3) { console.log('[+] Bypassing Android WebViewClient check {2}'); }; } catch (err) { console.log('[-] Android WebViewClient {2} check not found'); } try { var AndroidWebViewClient_Activity_3 = Java.use('android.webkit.WebViewClient'); AndroidWebViewClient_Activity_3.onReceivedError.overload('android.webkit.WebView', 'int', 'java.lang.String', 'java.lang.String').implementation = function(obj1, obj2, obj3, obj4) { console.log('[+] Bypassing Android WebViewClient check {3}'); }; } catch (err) { console.log('[-] Android WebViewClient {3} check not found'); } try { var AndroidWebViewClient_Activity_4 = Java.use('android.webkit.WebViewClient'); AndroidWebViewClient_Activity_4.onReceivedError.overload('android.webkit.WebView', 'android.webkit.WebResourceRequest', 'android.webkit.WebResourceError').implementation = function(obj1, obj2, obj3) { console.log('[+] Bypassing Android WebViewClient check {4}'); }; } catch (err) { console.log('[-] Android WebViewClient {4} check not found'); } try { var CordovaWebViewClient_Activity = Java.use('org.apache.cordova.CordovaWebViewClient'); CordovaWebViewClient_Activity.onReceivedSslError.overload('android.webkit.WebView', 'android.webkit.SslErrorHandler', 'android.net.http.SslError').implementation = function(obj1, obj2, obj3) { console.log('[+] Bypassing Apache Cordova WebViewClient check'); obj3.proceed(); }; } catch (err) { console.log('[-] Apache Cordova WebViewClient check not found'); } try { var boye_AbstractVerifier = Java.use('ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier'); boye_AbstractVerifier.verify.implementation = function(host, ssl) { console.log('[+] Bypassing Boye AbstractVerifier check: ' + host); }; } catch (err) { console.log('[-] Boye AbstractVerifier check not found'); } try { var apache_AbstractVerifier = Java.use('org.apache.http.conn.ssl.AbstractVerifier'); apache_AbstractVerifier.verify.implementation = function(a, b, c, d) { console.log('[+] Bypassing Apache AbstractVerifier check: ' + a); return; }; } catch (err) { console.log('[-] Apache AbstractVerifier check not found'); } try { var CronetEngineBuilderImpl_Activity = Java.use("org.chromium.net.impl.CronetEngineBuilderImpl"); CronetEngine_Activity.enablePublicKeyPinningBypassForLocalTrustAnchors.overload('boolean').implementation = function(a) { console.log("[+] Disabling Public Key pinning for local trust anchors in Chromium Cronet"); var cronet_obj_1 = CronetEngine_Activity.enablePublicKeyPinningBypassForLocalTrustAnchors.call(this, true); return cronet_obj_1; }; CronetEngine_Activity.addPublicKeyPins.overload('java.lang.String', 'java.util.Set', 'boolean', 'java.util.Date').implementation = function(hostName, pinsSha256, includeSubdomains, expirationDate) { console.log("[+] Bypassing Chromium Cronet pinner: " + hostName); var cronet_obj_2 = CronetEngine_Activity.addPublicKeyPins.call(this, hostName, pinsSha256, includeSubdomains, expirationDate); return cronet_obj_2; }; } catch (err) { console.log('[-] Chromium Cronet pinner not found') } try { var HttpCertificatePinning_Activity = Java.use('diefferson.http_certificate_pinning.HttpCertificatePinning'); HttpCertificatePinning_Activity.checkConnexion.overload("java.lang.String", "java.util.List", "java.util.Map", "int", "java.lang.String").implementation = function(a, b, c, d, e) { console.log('[+] Bypassing Flutter HttpCertificatePinning : ' + a); return true; }; } catch (err) { console.log('[-] Flutter HttpCertificatePinning pinner not found'); } try { var SslPinningPlugin_Activity = Java.use('com.macif.plugin.sslpinningplugin.SslPinningPlugin'); SslPinningPlugin_Activity.checkConnexion.overload("java.lang.String", "java.util.List", "java.util.Map", "int", "java.lang.String").implementation = function(a, b, c, d, e) { console.log('[+] Bypassing Flutter SslPinningPlugin: ' + a); return true; }; } catch (err) { console.log('[-] Flutter SslPinningPlugin pinner not found'); } function rudimentaryFix(typeName) { if (typeName === undefined) { return; } else if (typeName === 'boolean') { return true; } else { return null; } } try { var UnverifiedCertError = Java.use('javax.net.ssl.SSLPeerUnverifiedException'); UnverifiedCertError.$init.implementation = function(str) { console.log('[!] Unexpected SSLPeerUnverifiedException occurred, trying to patch it dynamically...!'); try { var stackTrace = Java.use('java.lang.Thread').currentThread().getStackTrace(); var exceptionStackIndex = stackTrace.findIndex(stack => stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException"); var callingFunctionStack = stackTrace[exceptionStackIndex + 1]; var className = callingFunctionStack.getClassName(); var methodName = callingFunctionStack.getMethodName(); var callingClass = Java.use(className); var callingMethod = callingClass[methodName]; console.log('[!] Attempting to bypass uncommon SSL Pinning method on: ' + className + '.' + methodName + '!'); if (callingMethod.implementation) { return; } var returnTypeName = callingMethod.returnType.type; callingMethod.implementation = function() { rudimentaryFix(returnTypeName); }; } catch (e) { if (String(e).includes(".overload")) { var splittedList = String(e).split(".overload"); for (let i = 2; i < splittedList.length; i++) { var extractedOverload = splittedList[i].trim().split("(")[1].slice(0, -1).replaceAll("'", ""); if (extractedOverload.includes(",")) { var argList = extractedOverload.split(", "); console.log('[!] Attempting overload of ' + className + '.' + methodName + ' with arguments: ' + extractedOverload + '!'); if (argList.length == 2) { callingMethod.overload(argList[0], argList[1]).implementation = function(a, b) { rudimentaryFix(returnTypeName); } } else if (argNum == 3) { callingMethod.overload(argList[0], argList[1], argList[2]).implementation = function(a, b, c) { rudimentaryFix(returnTypeName); } } else if (argNum == 4) { callingMethod.overload(argList[0], argList[1], argList[2], argList[3]).implementation = function(a, b, c, d) { rudimentaryFix(returnTypeName); } } else if (argNum == 5) { callingMethod.overload(argList[0], argList[1], argList[2], argList[3], argList[4]).implementation = function(a, b, c, d, e) { rudimentaryFix(returnTypeName); } } else if (argNum == 6) { callingMethod.overload(argList[0], argList[1], argList[2], argList[3], argList[4], argList[5]).implementation = function(a, b, c, d, e, f) { rudimentaryFix(returnTypeName); } } } else { callingMethod.overload(extractedOverload).implementation = function(a) { rudimentaryFix(returnTypeName); } } } } else { console.log('[-] Failed to dynamically patch SSLPeerUnverifiedException ' + e + '!'); } } return this.$init(str); }; } catch (err) {} } /** * Main function */ setTimeout(function() { Java.perform(function() { var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager'); var SSLContext = Java.use('javax.net.ssl.SSLContext'); var TrustManager = Java.registerClass({ name: 'incogbyte.bypass.test.TrustManager', implements: [X509TrustManager], methods: { checkClientTrusted: function(chain, authType) {}, checkServerTrusted: function(chain, authType) {}, getAcceptedIssuers: function() { return []; } } }); console.log("[*] Flutter testing"); setTimeout(disablePinning, 1000); disableFlutterPinningv2(); console.log("[*] Dynamic patching"); dynamicPatching(); console.log("[*] CommonMethods"); CommonMethods(); console.log("[*] Testing OKHTTP methods"); try { var okhttp3_Activity = Java.use('okhttp3.CertificatePinner'); okhttp3_Activity.check.overload('java.lang.String', 'java.util.List').implementation = function(str) { console.log('[+] Bypassing OkHTTPv3 {1}: ' + str); return true; }; okhttp3_Activity.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function(str) { console.log('[+] Bypassing OkHTTPv3 {2}: ' + str); return true; }; } catch (err) { console.log('[-] OkHTTPv3 pinner not found'); } try { var trustkit_Activity = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier'); trustkit_Activity.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(str) { console.log('[+] Bypassing Trustkit {1}: ' + str); return true; }; trustkit_Activity.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(str) { console.log('[+] Bypassing Trustkit {2}: ' + str); return true; }; var trustkit_PinningTrustManager = Java.use('com.datatheorem.android.trustkit.pinning.PinningTrustManager'); trustkit_PinningTrustManager.checkServerTrusted.implementation = function() { console.log('[+] Bypassing Trustkit {3}'); }; } catch (err) { console.log('[-] Trustkit pinner not found'); } try { var TrustManagerImpl = Java.use('com.android.org.conscrypt.TrustManagerImpl'); TrustManagerImpl.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) { console.log('[+] Bypassing TrustManagerImpl (Android > 7): ' + host); return untrustedChain; }; } catch (err) { console.log('[-] TrustManagerImpl (Android > 7) pinner not found'); } try { var appcelerator_PinningTrustManager = Java.use('appcelerator.https.PinningTrustManager'); appcelerator_PinningTrustManager.checkServerTrusted.implementation = function() { console.log('[+] Bypassing Appcelerator PinningTrustManager'); }; } catch (err) { console.log('[-] Appcelerator PinningTrustManager pinner not found'); } try { var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl'); OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certRefs, JavaObject, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Conscrypt'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Conscrypt pinner not found'); } try { var OpenSSLEngineSocketImpl_Activity = Java.use('com.android.org.conscrypt.OpenSSLEngineSocketImpl'); OpenSSLSocketImpl_Activity.verifyCertificateChain.overload('[Ljava.lang.Long;', 'java.lang.String').implementation = function(str1, str2) { console.log('[+] Bypassing OpenSSLEngineSocketImpl Conscrypt: ' + str2); }; } catch (err) { console.log('[-] OpenSSLEngineSocketImpl Conscrypt pinner not found'); } try { var OpenSSLSocketImpl_Harmony = Java.use('org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl'); OpenSSLSocketImpl_Harmony.verifyCertificateChain.implementation = function(asn1DerEncodedCertificateChain, authMethod) { console.log('[+] Bypassing OpenSSLSocketImpl Apache Harmony'); }; } catch (err) { console.log('[-] OpenSSLSocketImpl Apache Harmony pinner not found'); } try { var phonegap_Activity = Java.use('nl.xservices.plugins.sslCertificateChecker'); phonegap_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(str) { console.log('[+] Bypassing PhoneGap sslCertificateChecker: ' + str); return true; }; } catch (err) { console.log('[-] PhoneGap sslCertificateChecker pinner not found'); } try { var WLClient_Activity = Java.use('com.worklight.wlclient.api.WLClient'); WLClient_Activity.getInstance().pinTrustedCertificatePublicKey.overload('java.lang.String').implementation = function(cert) { console.log('[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {1}: ' + cert); return; }; WLClient_Activity.getInstance().pinTrustedCertificatePublicKey.overload('[Ljava.lang.String;').implementation = function(cert) { console.log('[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {2}: ' + cert); return; }; } catch (err) { console.log('[-] IBM MobileFirst pinTrustedCertificatePublicKey pinner not found'); } try { var worklight_Activity = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning'); worklight_Activity.verify.overload('java.lang.String', 'javax.net.ssl.SSLSocket').implementation = function(str) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {1}: ' + str); return; }; worklight_Activity.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(str) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {2}: ' + str); return; }; worklight_Activity.verify.overload('java.lang.String', '[Ljava.lang.String;', '[Ljava.lang.String;').implementation = function(str) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {3}: ' + str); return; }; worklight_Activity.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(str) { console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {4}: ' + str); return true; }; } catch (err) { console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning pinner not found'); } try { var conscrypt_CertPinManager_Activity = Java.use('com.android.org.conscrypt.CertPinManager'); conscrypt_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(str) { console.log('[+] Bypassing Conscrypt CertPinManager: ' + str); return true; }; } catch (err) { console.log('[-] Conscrypt CertPinManager pinner not found'); } try { var cwac_CertPinManager_Activity = Java.use('com.commonsware.cwac.netsecurity.conscrypt.CertPinManager'); cwac_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(str) { console.log('[+] Bypassing CWAC-Netsecurity CertPinManager: ' + str); return true; }; } catch (err) { console.log('[-] CWAC-Netsecurity CertPinManager pinner not found'); } try { var androidgap_WLCertificatePinningPlugin_Activity = Java.use('com.worklight.androidgap.plugin.WLCertificatePinningPlugin'); androidgap_WLCertificatePinningPlugin_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(str) { console.log('[+] Bypassing Worklight Androidgap WLCertificatePinningPlugin: ' + str); return true; }; } catch (err) { console.log('[-] Worklight Androidgap WLCertificatePinningPlugin pinner not found'); } try { var Squareup_CertificatePinner_Activity = Java.use('com.squareup.okhttp.CertificatePinner'); Squareup_CertificatePinner_Activity.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function(str1, str2) { console.log('[+] Bypassing Squareup CertificatePinner {1}: ' + str1); return; }; Squareup_CertificatePinner_Activity.check.overload('java.lang.String', 'java.util.List').implementation = function(str1, str2) { console.log('[+] Bypassing Squareup CertificatePinner {2}: ' + str1); return; }; } catch (err) { console.log('[-] Squareup CertificatePinner pinner not found'); } try { var Squareup_OkHostnameVerifier_Activity = Java.use('com.squareup.okhttp.internal.tls.OkHostnameVerifier'); Squareup_OkHostnameVerifier_Activity.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(str1, str2) { console.log('[+] Bypassing Squareup OkHostnameVerifier {1}: ' + str1); return true; }; Squareup_OkHostnameVerifier_Activity.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(str1, str2) { console.log('[+] Bypassing Squareup OkHostnameVerifier {2}: ' + str1); return true; }; } catch (err) { console.log('[-] Squareup OkHostnameVerifier pinner not found'); } try { var AndroidWebViewClient_Activity = Java.use('android.webkit.WebViewClient'); AndroidWebViewClient_Activity.onReceivedSslError.overload('android.webkit.WebView', 'android.webkit.SslErrorHandler', 'android.net.http.SslError').implementation = function(obj1, obj2, obj3) { console.log('[+] Bypassing Android WebViewClient'); }; } catch (err) { console.log('[-] Android WebViewClient pinner not found'); } try { var CordovaWebViewClient_Activity = Java.use('org.apache.cordova.CordovaWebViewClient'); CordovaWebViewClient_Activity.onReceivedSslError.overload('android.webkit.WebView', 'android.webkit.SslErrorHandler', 'android.net.http.SslError').implementation = function(obj1, obj2, obj3) { console.log('[+] Bypassing Apache Cordova WebViewClient'); obj3.proceed(); }; } catch (err) { console.log('[-] Apache Cordova WebViewClient pinner not found'); } try { var boye_AbstractVerifier = Java.use('ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier'); boye_AbstractVerifier.verify.implementation = function(host, ssl) { console.log('[+] Bypassing Boye AbstractVerifier: ' + host); }; } catch (err) { console.log('[-] Boye AbstractVerifier pinner not found'); } // Android 7+ TrustManagerImpl var TrustManagerImpl = Java.use("com.android.org.conscrypt.TrustManagerImpl"); try { TrustManagerImpl.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) { console.log("[+] TrustManagerImpl verifyChain called"); // Skip all the logic and just return the chain again :P // https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/november/bypassing-androids-network-security-configuration/ // https://github.com/google/conscrypt/blob/c88f9f55a523f128f0e4dace76a34724bfa1e88c/platform/src/main/java/org/conscrypt/TrustManagerImpl.java#L650 return untrustedChain; } } catch (e) { console.log("[-] TrustManagerImpl verifyChain nout found below 7.0"); } // OpenSSLSocketImpl try { var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl'); OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certRefs, authMethod) { console.log(' OpenSSLSocketImpl.verifyCertificateChain'); } console.log('[+] OpenSSLSocketImpl pinning') } catch (err) { console.log('[-] OpenSSLSocketImpl pinner not found'); } // Trustkit try { var Activity = Java.use("com.datatheorem.android.trustkit.pinning.OkHostnameVerifier"); Activity.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(str) { console.log(' Trustkit.verify1: ' + str); return true; }; Activity.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(str) { console.log(' Trustkit.verify2: ' + str); return true; }; console.log('[+] Trustkit pinning') } catch (err) { console.log('[-] Trustkit pinner not found') } // Cronet pinner hook // Weibo don't invoke try { var netBuilder = Java.use("org.chromium.net.CronetEngine$Builder"); // https://developer.android.com/guide/topics/connectivity/cronet/reference/org/chromium/net/CronetEngine.Builder.html#enablePublicKeyPinningBypassForLocalTrustAnchors(boolean) netBuilder.enablePublicKeyPinningBypassForLocalTrustAnchors.implementation = function(arg) { // Weibo not invoke console.log(" Enables or disables public key pinning bypass for local trust anchors = " + arg); // True to enable the bypass, false to disable. var ret = netBuilder.enablePublicKeyPinningBypassForLocalTrustAnchors.call(this, true); return ret; }; netBuilder.addPublicKeyPins.implementation = function(hostName, pinsSha256, includeSubdomains, expirationDate) { console.log("[+] Сronet addPublicKeyPins hostName = " + hostName); return this; }; } catch (err) { console.log('[-] Cronet pinner not found') } }); }, 0); function killUIWebViewSSL() { Interceptor.attach(ObjC.classes.UIWebView["- webView:resource:canAuthenticateAgainstProtectionSpace:forDataSource:"].implementation, { onLeave: function(retval) { retval.replace(ptr('0x1')); } }); Interceptor.attach(ObjC.classes.UIWebView["- webView:resource:didReceiveAuthenticationChallenge:fromDataSource:"].implementation, { onEnter: function(args) { const chall = new ObjC.Object(args[4]); const sender = chall.sender(); const cred = ObjC.classes.NSURLCredential.credentialForTrust_(chall.protectionSpace().serverTrust()); sender.useCredential_forAuthenticationChallenge_(cred, chall); } }); } /* https://kov4l3nko.github.io/blog/2018-05-27-sll-pinning-hook-sectrustevaluate/ **************************************** killSSL.js Frida script by Dima Kovalenko **************************************** Usage: 1. Run Viber on the device 2. Inject the script to the process: $ frida -U -n Viber -l path/to/killSSL.js 3. SSL pinning in Viber HTTPs is disabled. Now you can intercept Viber HTTPs requests, e.g. with mitmproxy. */ function disable_SecTrustEvaluate() { // Are we debugging it? DEBUG = true; // Get SecTrustEvaluate address var SecTrustEvaluate_prt = Module.findExportByName("Security", "SecTrustEvaluate"); if (SecTrustEvaluate_prt == null) { console.log("[!] Security!SecTrustEvaluate(...) not found!"); return; } // Create native function wrappers for SecTrustEvaluate var SecTrustEvaluate = new NativeFunction(SecTrustEvaluate_prt, "int", ["pointer", "pointer"]); // Hook SecTrustEvaluate Interceptor.replace(SecTrustEvaluate_prt, new NativeCallback(function(trust, result) { // Show "hit!" message if we are in debugging mode if (DEBUG) console.log("[*] SecTrustEvaluate(...) hit!"); // Call original function var osstatus = SecTrustEvaluate(trust, result); // Change the result to kSecTrustResultProceed Memory.writeU8(result, 1); // Return errSecSuccess return 0; }, "int", ["pointer", "pointer"])); // It's done! console.log("[*] SecTrustEvaluate(...) hooked. SSL should be pinning disabled."); } // Run the script // disable_SecTrustEvaluate(); function bypass_developerMode_check() { var settingSecure = Java.use('android.provider.Settings$Secure'); settingSecure.getInt.overload('android.content.ContentResolver', 'java.lang.String', 'int').implementation = function(cr, name, flag) { console.log("[!] settingSecure.getInt(cr,name) : " + name); console.log('[+] 1.Secure.getInt(' + name + ') Bypassed'); return 0; } settingSecure.getInt.overload('android.content.ContentResolver', 'java.lang.String').implementation = function(cr, name) { console.log("[!] settingSecure.getInt(cr,name) : " + name); console.log('[+] 2.Secure.getInt(' + name + ') Bypassed'); return 0; } var settingGlobal = Java.use('android.provider.Settings$Global'); settingGlobal.getInt.overload('android.content.ContentResolver', 'java.lang.String', 'int').implementation = function(cr, name, flag) { console.log("[!] settingGlobal.getInt(cr,name) : " + name); console.log('[+] 1.Global.getInt(' + name + ') Bypassed'); return 0; } settingGlobal.getInt.overload('android.content.ContentResolver', 'java.lang.String').implementation = function(cr, name) { console.log("[!] settingGlobal.getInt(cr,name) : " + name); console.log('[+] 2.Global.getInt(' + name + ') Bypassed'); return 0; } } // Main Java.perform(function() { bypass_developerMode_check(); }); // frida -U -f sg.vantagepoint.uncrackable1 --no-pause -l your_script.js Java.perform(function() { var MainActivity = Java.use('sg.vantagepoint.uncrackable1.MainActivity'); // Disable root detection MainActivity.a.implementation = function(str) { console.log('[Root Bypass] Root detection bypassed.'); return; }; // Disable debuggable check MainActivity.onCreate.overload('android.os.Bundle').implementation = function(bundle) { console.log('[Debuggable Bypass] Debuggable check bypassed.'); this.onCreate(bundle); return; }; // Disable exit on button click MainActivity.verify.overload('android.view.View').implementation = function(view) { console.log('[Exit Bypass] Exit on button click bypassed.'); this.verify(view); return; }; }); Interceptor.attach(ObjC.classes.TTHttpTask["- skipSSLCertificateError"].implementation, { onEnter: function (args) { }, onLeave: function (retval) { console.log('Overriding -> TTHttpTask skipSSLCertificateError : '); retval.replace(0x1) } }); console.log('Successfully Initalized SSL Bypass...'); /* Android piracy checker bypass Bypass implemented based on https://stackoverflow.com/a/37540163/432152 */ Java.perform(function() { var PackageManager = Java.use("android.app.ApplicationPackageManager"); var loaded_classes = Java.enumerateLoadedClassesSync(); send("Loaded " + loaded_classes.length + " classes!"); PackageManager.getInstallerPackageName.implementation = function(pname) { var original = this.getInstallerPackageName.call(this, pname); send("Bypass INSTALLER check for package: " + original + " " + pname); return 'com.android.vending'; }; }); ////////////////////// Interceptor.attach(Module.findExportByName("libc.so", "strstr"), { onEnter: function(args) { this.haystack = args[0]; this.needle = args[1]; this.frida = Boolean(0); haystack = Memory.readUtf8String(this.haystack); needle = Memory.readUtf8String(this.needle); if (haystack.indexOf("frida") !== -1 || haystack.indexOf("xposed") !== -1) { this.frida = Boolean(1); } }, onLeave: function(retval) { if (this.frida) { retval.replace(0); } return retval; } }); ///////////////////// Java.perform(function() { var array_list = Java.use("java.util.ArrayList"); var ApiClient = Java.use('com.android.org.conscrypt.TrustManagerImpl'); ApiClient.checkTrustedRecursive.implementation = function(a1, a2, a3, a4, a5, a6) { // console.log('Bypassing SSL Pinning'); var k = array_list.$new(); return k; } }, 0); ///////////////////////////// setTimeout(function() { Java.perform(function() { console.log(''); console.log('======'); console.log('[#] Android Universal Certificate Pinning Bypasser [#]'); console.log('======'); // TrustManagerImpl Certificate Pinning Bypass try { var array_list = Java.use('java.util.ArrayList'); var custom_TrustManagerImpl = Java.use('com.android.org.conscrypt.TrustManagerImpl'); //custom_TrustManagerImpl.checkTrustedRecursive.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) { custom_TrustManagerImpl.checkTrustedRecursive.implementation = function(a, b, c, d, e, f, g, h) { //if host: console.log('[+] Bypassing TrustManagerImpl pinner for: ' + b + '...'); //else: // console.log('[+] Bypassing TrustManagerImpl pinner...'); var fakeTrusted = array_list.$new(); return fakeTrusted; } } catch (err) { console.log('[-] TrustManagerImpl pinner not found'); } // OpenSSLSocketImpl Certificate Pinning Bypass try { var custom_OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl'); custom_OpenSSLSocketImpl.verifyCertificateChain.implementation = function (g, i) { console.log('[+] Bypassing OpenSSLSocketImpl pinner...'); } } catch (err) { console.log('[-] OpenSSLSocketImpl pinner not found'); } }); },0); /////// setTimeout(function() { Java.perform(function() { console.log(""); console.log("[.] Debug check bypass"); var Debug = Java.use('android.os.Debug'); Debug.isDebuggerConnected.implementation = function() { //console.log('isDebuggerConnected Bypassed !'); return false; } }); }, 0); /////////////////////// Java.perform(function () { // Invalidate the certificate pinner set up var OkHttpClient = Java.use("com.squareup.okhttp.OkHttpClient"); OkHttpClient.setCertificatePinner.implementation = function(certificatePinner){ // do nothing console.log("Called!"); return this; }; // Invalidate the certificate pinnet checks (if "setCertificatePinner" was called before the previous invalidation) var CertificatePinner = Java.use("com.squareup.okhttp.CertificatePinner"); CertificatePinner.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function(p0, p1){ // do nothing console.log("Called! [Certificate]"); return; }; CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function(p0, p1){ // do nothing console.log("Called! [List]"); return; }; }); /////////////////////////////// Java.perform(function() { var TrustManagerImpl = Java.use('com.android.org.conscrypt.TrustManagerImpl'); var ArrayList = Java.use("java.util.ArrayList"); TrustManagerImpl.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) { console.log("[+] Bypassing TrustManagerImpl->verifyChain()"); return untrustedChain; } TrustManagerImpl.checkTrustedRecursive.implementation = function(certs, host, clientAuth, untrustedChain, trustAnchorChain, used) { console.log("[+] Bypassing TrustManagerImpl->checkTrustedRecursive()"); return ArrayList.$new(); }; }); ///////////////////////////////////// // Main Java.perform(function() { bypass_developerMode_check(); }); /* This is a stand-alone script for bypassing anti-root detection on Android apps written using Xamarin. I don't know if it works with IOS, let me know. $ frida -U -f com.app.mobile -l xamarin-antiroot.js --no-pause Mono embedding doc: http://docs.go-mono.com/?link=root%3a%2fembed Thanks freehuntx for his work which is embedded in this script: https://github.com/freehuntx/frida-mono-api https://github.com/freehuntx/frida-ex-nativefunction */ Java.perform(function() { let monoModule = null Process.getModuleByName("libmonosgen-2.0.so").enumerateExports().forEach(ex => { if (ex.name == 'mono_thread_attach') monoModule = ex }) if (!monoModule) throw new Error('Can\'t find Mono runtime!') class ExNativeFunction { constructor(address, retType = 'void', argTypes = [], abi = 'default') { const native = new NativeFunction(address, retType, argTypes, abi) native.address = address native.retType = retType native.argTypes = argTypes native.abi = abi native.nativeCallback = callback => { return new NativeCallback(callback, retType, argTypes, abi) } native.intercept = (options = {}) => { return Interceptor.attach(address, options) } native.replace = callback => { return Interceptor.replace(address, native.nativeCallback(callback)) } return native } } global.ExNativeFunction = ExNativeFunction let MonoApi = { mono_assembly_foreach: ['void', ['pointer', 'pointer']], mono_assembly_get_image: ['pointer', ['pointer']], mono_class_from_name: ['pointer', ['pointer', 'pointer', 'pointer']], mono_class_get_method_from_name: ['pointer', ['pointer', 'pointer', 'int']], mono_compile_method: ['pointer', ['pointer']], mono_get_root_domain: ['pointer'], mono_string_new: ['pointer', ['pointer', 'pointer']], mono_domain_get: ['pointer'], mono_string_to_utf8: ['pointer', ['pointer']], mono_thread_attach: ['pointer', ['pointer']], mono_array_length: ['uint32', ['pointer']], mono_array_addr_with_size: ['pointer', ['pointer', 'int', 'uint32']] // ... I've omitted a lot of mono functions which are not used in this script } Object.keys(MonoApi).map(exportName => { if (MonoApi[exportName] === null) { MonoApi[exportName] = () => { throw new Error('Export signature missing: ' + exportName) } } else { const addr = Module.findExportByName('libmonosgen-2.0.so', exportName) MonoApi[exportName] = !addr ? () => { throw new Error('Export not found: ' + exportName) } : MonoApi[exportName] = new ExNativeFunction(addr, ...MonoApi[exportName]) } }) MonoApi.mono_thread_attach(MonoApi.mono_get_root_domain()) // Make sure we are attached to mono. // ============================================================================= // ============================================================================= console.warn("\n\n *** XAMARIN ANTIROOT by Gand3lf *** \n") let DEBUG = false var assemblies = [] MonoApi.mono_assembly_foreach(new NativeCallback(x => { assemblies.push(x) }, 'void', ['pointer', 'pointer']), NULL) function hook(namespace, klass, method, callbacks){ assemblies.forEach(x=>{ var mono_img = MonoApi.mono_assembly_get_image(x) var mono_class = MonoApi.mono_class_from_name(mono_img, Memory.allocUtf8String(namespace), Memory.allocUtf8String(klass)) if(mono_class != 0x0){ if(DEBUG) console.log("Found class: " + klass) var methods = method.split("/") for(var i=0; i < methods.length; i++){ var mono_method = MonoApi.mono_class_get_method_from_name(mono_class, Memory.allocUtf8String(methods[i]), -1) if (mono_method == 0x0){ if(DEBUG) console.log("*** Method \"" + methods[i] + "\" not found") return } if(DEBUG) console.log("Method \"" + methods[i] + "\" found") var impl = MonoApi.mono_compile_method(mono_method) Interceptor.attach(impl, {...callbacks}) } } }) } var rootPackages = ["com.noshufou.android.su", "com.thirdparty.superuser", "eu.chainfire.supersu", "eu.chainfire.suhide", "com.koushikdutta.superuser", "com.zachspong.temprootremovejb", "com.ramdroid.appquarantine", "com.topjohnwu.magisk", "com.kingouser.com", "com.geohot.towelroot", "com.noshufou.android.su.elite", "com.yellowes.su", "com.kingroot.kinguser", "com.kingo.root", "com.smedialink.oneclickroot", "com.zhiqupk.root.global", "com.alephzain.framaroot", "com.devadvance.rootcloak", "com.devadvance.rootcloakplus", "de.robv.android.xposed.installer", "com.saurik.substrate", "com.amphoras.hidemyroot", "com.amphoras.hidemyrootadfree", "com.formyhm.hiderootPremium", "com.formyhm.hideroot", "com.dimonvideo.luckypatcher", "com.chelpus.lackypatch", "com.ramdroid.appquarantinepro", "com.android.vending.billing.InAppBillingService.COIN", "com.blackmartalpha", "org.blackmart.market", "com.android.vending.billing.InAppBillingService.LUCK", "com.allinone.free", "com.repodroid.app", "org.creeplays.hack", "com.baseappfull.fwd", "com.zmapp", "com.dv.marketmod.installer", "org.mobilism.android", "com.android.wp.net.log", "com.android.camera.update", "cc.madkite.freedom", "com.chelpus.luckypatcher", "com.solohsu.android.edxp.manager", "org.meowcat.edxposed.manager", "com.xmodgame", "com.cih.game_cih", "com.charles.lpoqasert", "catch_.me_.if_.you_.can_"] var rootBinaries = ["/system/bin/.ext/.su", "/system/usr/we-need-root/su-backup", "/system/xbin/mu", "/system/su", "/usr/bin/su", "/system/app/Superuser.apk", "/sbin/su", "/system/bin/su", "/system/xbin/su", "/data/local/xbin/su", "/data/local/bin/su", "/system/sd/xbin/su", "/system/bin/failsafe/su", "/data/local/su", "/su/bin/su", "/system/bin/sudo", "/system/bin/su", "/system/xbin/sudo", "/system/xbin/su", "/sbin/sudo", "/sbin/su", "/system/sbin/sudo", "/system/sbin/su", "/vendor/bin/sudo", "/vendor/bin/su", "/odm/bin/sudo", "/odm/bin/su", "/vendor/xbin/sudo", "/vendor/xbin/su", "/system/etc/security/otacerts.zip"] hook('System', 'Environment', 'GetEnvironmentVariable', { onEnter: function (args) { this.block = false var variable_ptr = MonoApi.mono_string_to_utf8(args[0]) var variable = Memory.readCString(variable_ptr) if(DEBUG) console.log('GetEnvironmentVariable(' + variable + ')') if(variable == 'PATH'){ console.warn("Blocking PATH variable reading ...") this.block = true } }, onLeave: function (retval) { if(this.block){ retval.replace(NULL); } } }) hook('System.IO', 'File', 'Exists/Open', { // hook different methods of the same class together with "/" onEnter: function (args) { var filename_ptr = MonoApi.mono_string_to_utf8(args[0]) var filename = Memory.readCString(filename_ptr) if(DEBUG) console.log('Exists/Open(' + filename + ')') if(rootBinaries.includes(filename)){ console.warn("Bypass check on file " + filename + "...") this.found = true } }, onLeave: function (retval) { if(this.found) retval.replace(0x0) } }) hook('Android.Content.PM', 'PackageItemInfo', 'get_PackageName', { onEnter: function (args) {}, onLeave: function (retval) { var package_name_ptr = MonoApi.mono_string_to_utf8(retval) var package_name = Memory.readCString(package_name_ptr) if(DEBUG) console.log('get_PackageName -> ' + package_name + '') if(rootPackages.includes(package_name)){ console.warn("Hidding package " + package_name + "...") var domain = MonoApi.mono_domain_get() var fake_pack = MonoApi.mono_string_new(domain, Memory.allocUtf8String("f4k3.p4ck4g3.n4m3")) retval.replace(fake_pack); } } }) hook('Android.OS', 'Build', 'get_Tags', { onEnter: function (args) {}, onLeave: function (retval) { var tag_value_ptr = MonoApi.mono_string_to_utf8(retval) var tag_value = Memory.readCString(tag_value_ptr) if(DEBUG) console.log('get_Tags -> ' + tag_value + '') if(tag_value.includes("test-keys")){ console.warn("Patching tag test-keys ...") var domain = MonoApi.mono_domain_get() var fake_tag = MonoApi.mono_string_new(domain, Memory.allocUtf8String("release-keys")) retval.replace(fake_tag); } } }) // Check executed commands (here only to show how to do it in mono embedding style) /*hook('Java.Lang', 'Runtime', 'Exec', { onEnter: function (args) { var len = MonoApi.mono_array_length(args[1]) var command = "" for(var i=0; i -1; if (catched) { console.log("the pipe " + name + " existence is hooked"); return false; } else { return this.exists.call(this); } }; } catch (err) { console.log("[-] java.io.File.exists never called [-]"); } // rename the package names try { Java.use("android.app.ApplicationPackageManager").getPackageInfo.overload( "java.lang.String", "int" ).implementation = function(name, flag) { var catched = ["com.example.android.apis", "com.android.development"].indexOf(name) > -1; if (catched) { console.log("the package " + name + " is renamed with fake name"); name = "fake.package.name"; } return this.getPackageInfo.call(this, name, flag); }; } catch (err) { console.log( "[-] ApplicationPackageManager.getPackageInfo never called [-]" ); } // hook the `android_getCpuFamily` method // https://android.googlesource.com/platform/ndk/+/master/sources/android/cpufeatures/cpu-features.c#1067 // Note: If you pass "null" as the first parameter for "Module.findExportByName" it will search in all modules try { Interceptor.attach(Module.findExportByName(null, "android_getCpuFamily"), { onLeave: function(retval) { // const int ANDROID_CPU_FAMILY_X86 = 2; // const int ANDROID_CPU_FAMILY_X86_64 = 5; if ([2, 5].indexOf(retval) > -1) { // const int ANDROID_CPU_FAMILY_ARM64 = 4; retval.replace(4); } }, }); } catch (err) { console.log("[-] android_getCpuFamily never called [-]"); // TODO: trace RegisterNatives in case the libraries are stripped. } }); /** * Bypass Root Detection * @param {any} function( * @returns {any} */ setTimeout(function() { function stackTraceHere(isLog) { var Exception = Java.use("java.lang.Exception"); var Log = Java.use("android.util.Log"); var stackinfo = Log.getStackTraceString(Exception.$new()); if (isLog) { console.log(stackinfo); } else { return stackinfo; } } function stackTraceNativeHere(isLog) { var backtrace = Thread.backtrace(this.context, Backtracer.ACCURATE) .map(DebugSymbol.fromAddress) .join("\n\t"); console.log(backtrace); } function bypassJavaFileCheck() { var UnixFileSystem = Java.use("java.io.UnixFileSystem"); UnixFileSystem.checkAccess.implementation = function(file, access) { var stack = stackTraceHere(false); const filename = file.getAbsolutePath(); if (filename.indexOf("magisk") >= 0) { console.log("Anti Root Detect - check file: " + filename); return false; } if (commonPaths.indexOf(filename) >= 0) { console.log("Anti Root Detect - check file: " + filename); return false; } return this.checkAccess(file, access); }; } function bypassNativeFileCheck() { var fopen = Module.findExportByName("libc.so", "fopen"); Interceptor.attach(fopen, { onEnter: function(args) { this.inputPath = args[0].readUtf8String(); }, onLeave: function(retval) { if (retval.toInt32() != 0) { if (commonPaths.indexOf(this.inputPath) >= 0) { console.log("Anti Root Detect - fopen : " + this.inputPath); retval.replace(ptr(0x0)); } } }, }); var access = Module.findExportByName("libc.so", "access"); Interceptor.attach(access, { onEnter: function(args) { this.inputPath = args[0].readUtf8String(); }, onLeave: function(retval) { if (retval.toInt32() == 0) { if (commonPaths.indexOf(this.inputPath) >= 0) { console.log("Anti Root Detect - access : " + this.inputPath); retval.replace(ptr(-1)); } } }, }); } function setProp() { var Build = Java.use("android.os.Build"); var TAGS = Build.class.getDeclaredField("TAGS"); TAGS.setAccessible(true); TAGS.set(null, "release-keys"); var FINGERPRINT = Build.class.getDeclaredField("FINGERPRINT"); FINGERPRINT.setAccessible(true); FINGERPRINT.set( null, "google/crosshatch/crosshatch:10/QQ3A.200805.001/6578210:user/release-keys" ); // Build.deriveFingerprint.inplementation = function(){ // var ret = this.deriveFingerprint() //该函数无法通过反射调用 // console.log(ret) // return ret // } var system_property_get = Module.findExportByName( "libc.so", "__system_property_get" ); Interceptor.attach(system_property_get, { onEnter(args) { this.key = args[0].readCString(); this.ret = args[1]; }, onLeave(ret) { if (this.key == "ro.build.fingerprint") { var tmp = "google/crosshatch/crosshatch:10/QQ3A.200805.001/6578210:user/release-keys"; var p = Memory.allocUtf8String(tmp); Memory.copy(this.ret, p, tmp.length + 1); } }, }); } //android.app.PackageManager function bypassRootAppCheck() { var ApplicationPackageManager = Java.use( "android.app.ApplicationPackageManager" ); ApplicationPackageManager.getPackageInfo.overload( "java.lang.String", "int" ).implementation = function(str, i) { // console.log(str) if (ROOTmanagementApp.indexOf(str) >= 0) { console.log("Anti Root Detect - check package : " + str); str = "ashen.one.ye.not.found"; } return this.getPackageInfo(str, i); }; //shell pm check } function bypassShellCheck() { var String = Java.use("java.lang.String"); var ProcessImpl = Java.use("java.lang.ProcessImpl"); ProcessImpl.start.implementation = function( cmdarray, env, dir, redirects, redirectErrorStream ) { if (cmdarray[0] == "mount") { console.log("Anti Root Detect - Shell : " + cmdarray.toString()); arguments[0] = Java.array("java.lang.String", [String.$new("")]); return ProcessImpl.start.apply(this, arguments); } if (cmdarray[0] == "getprop") { console.log("Anti Root Detect - Shell : " + cmdarray.toString()); const prop = ["ro.secure", "ro.debuggable"]; if (prop.indexOf(cmdarray[1]) >= 0) { arguments[0] = Java.array("java.lang.String", [String.$new("")]); return ProcessImpl.start.apply(this, arguments); } } if (cmdarray[0].indexOf("which") >= 0) { const prop = ["su"]; if (prop.indexOf(cmdarray[1]) >= 0) { console.log("Anti Root Detect - Shell : " + cmdarray.toString()); arguments[0] = Java.array("java.lang.String", [String.$new("")]); return ProcessImpl.start.apply(this, arguments); } } return ProcessImpl.start.apply(this, arguments); }; } console.log("Attach"); bypassNativeFileCheck(); bypassJavaFileCheck(); setProp(); bypassRootAppCheck(); bypassShellCheck(); Java.perform(function() { var RootPackages = [ "com.noshufou.android.su", "com.noshufou.android.su.elite", "eu.chainfire.supersu", "com.koushikdutta.superuser", "com.thirdparty.superuser", "com.yellowes.su", "com.koushikdutta.rommanager", "com.koushikdutta.rommanager.license", "com.dimonvideo.luckypatcher", "com.chelpus.lackypatch", "com.ramdroid.appquarantine", "com.ramdroid.appquarantinepro", "com.devadvance.rootcloak", "com.devadvance.rootcloakplus", "de.robv.android.xposed.installer", "com.saurik.substrate", "com.zachspong.temprootremovejb", "com.amphoras.hidemyroot", "com.amphoras.hidemyrootadfree", "com.formyhm.hiderootPremium", "com.formyhm.hideroot", "me.phh.superuser", "eu.chainfire.supersu.pro", "com.kingouser.com", "com.topjohnwu.magisk", ]; var RootBinaries = [ "su", "busybox", "supersu", "Superuser.apk", "KingoUser.apk", "SuperSu.apk", "magisk", ]; var RootProperties = { "ro.build.selinux": "1", "ro.debuggable": "0", "service.adb.root": "0", "ro.secure": "1", }; var RootPropertiesKeys = []; for (var k in RootProperties) RootPropertiesKeys.push(k); var PackageManager = Java.use("android.app.ApplicationPackageManager"); var Runtime = Java.use("java.lang.Runtime"); var NativeFile = Java.use("java.io.File"); var String = Java.use("java.lang.String"); var SystemProperties = Java.use("android.os.SystemProperties"); var BufferedReader = Java.use("java.io.BufferedReader"); var ProcessBuilder = Java.use("java.lang.ProcessBuilder"); var StringBuffer = Java.use("java.lang.StringBuffer"); var loaded_classes = Java.enumerateLoadedClassesSync(); send("Loaded " + loaded_classes.length + " classes!"); var useKeyInfo = false; var useProcessManager = false; send("loaded: " + loaded_classes.indexOf("java.lang.ProcessManager")); if (loaded_classes.indexOf("java.lang.ProcessManager") != -1) { try { //useProcessManager = true; //var ProcessManager = Java.use('java.lang.ProcessManager'); } catch (err) { send("ProcessManager Hook failed: " + err); } } else { send("ProcessManager hook not loaded"); } var KeyInfo = null; if (loaded_classes.indexOf("android.security.keystore.KeyInfo") != -1) { try { //useKeyInfo = true; //var KeyInfo = Java.use('android.security.keystore.KeyInfo'); } catch (err) { send("KeyInfo Hook failed: " + err); } } else { send("KeyInfo hook not loaded"); } PackageManager.getPackageInfo.overload( "java.lang.String", "int" ).implementation = function(pname, flags) { var shouldFakePackage = RootPackages.indexOf(pname) > -1; if (shouldFakePackage) { send("Bypass root check for package: " + pname); pname = "set.package.name.to.a.fake.one.so.we.can.bypass.it"; } return this.getPackageInfo .overload("java.lang.String", "int") .call(this, pname, flags); }; NativeFile.exists.implementation = function() { var name = NativeFile.getName.call(this); var shouldFakeReturn = RootBinaries.indexOf(name) > -1; if (shouldFakeReturn) { send("Bypass return value for binary: " + name); return false; } else { return this.exists.call(this); } }; var exec = Runtime.exec.overload("[Ljava.lang.String;"); var exec1 = Runtime.exec.overload("java.lang.String"); var exec2 = Runtime.exec.overload("java.lang.String", "[Ljava.lang.String;"); var exec3 = Runtime.exec.overload( "[Ljava.lang.String;", "[Ljava.lang.String;" ); var exec4 = Runtime.exec.overload( "[Ljava.lang.String;", "[Ljava.lang.String;", "java.io.File" ); var exec5 = Runtime.exec.overload( "java.lang.String", "[Ljava.lang.String;", "java.io.File" ); exec5.implementation = function(cmd, env, dir) { if ( cmd.indexOf("getprop") != -1 || cmd == "mount" || cmd.indexOf("build.prop") != -1 || cmd == "id" || cmd == "sh" ) { var fakeCmd = "grep"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } if (cmd == "su") { var fakeCmd = "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } return exec5.call(this, cmd, env, dir); }; exec4.implementation = function(cmdarr, env, file) { for (var i = 0; i < cmdarr.length; i = i + 1) { var tmp_cmd = cmdarr[i]; if ( tmp_cmd.indexOf("getprop") != -1 || tmp_cmd == "mount" || tmp_cmd.indexOf("build.prop") != -1 || tmp_cmd == "id" || tmp_cmd == "sh" ) { var fakeCmd = "grep"; send("Bypass " + cmdarr + " command"); return exec1.call(this, fakeCmd); } if (tmp_cmd == "su") { var fakeCmd = "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"; send("Bypass " + cmdarr + " command"); return exec1.call(this, fakeCmd); } } return exec4.call(this, cmdarr, env, file); }; exec3.implementation = function(cmdarr, envp) { for (var i = 0; i < cmdarr.length; i = i + 1) { var tmp_cmd = cmdarr[i]; if ( tmp_cmd.indexOf("getprop") != -1 || tmp_cmd == "mount" || tmp_cmd.indexOf("build.prop") != -1 || tmp_cmd == "id" || tmp_cmd == "sh" ) { var fakeCmd = "grep"; send("Bypass " + cmdarr + " command"); return exec1.call(this, fakeCmd); } if (tmp_cmd == "su") { var fakeCmd = "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"; send("Bypass " + cmdarr + " command"); return exec1.call(this, fakeCmd); } } return exec3.call(this, cmdarr, envp); }; exec2.implementation = function(cmd, env) { if ( cmd.indexOf("getprop") != -1 || cmd == "mount" || cmd.indexOf("build.prop") != -1 || cmd == "id" || cmd == "sh" ) { var fakeCmd = "grep"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } if (cmd == "su") { var fakeCmd = "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } return exec2.call(this, cmd, env); }; exec.implementation = function(cmd) { for (var i = 0; i < cmd.length; i = i + 1) { var tmp_cmd = cmd[i]; if ( tmp_cmd.indexOf("getprop") != -1 || tmp_cmd == "mount" || tmp_cmd.indexOf("build.prop") != -1 || tmp_cmd == "id" || tmp_cmd == "sh" ) { var fakeCmd = "grep"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } if (tmp_cmd == "su") { var fakeCmd = "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } } return exec.call(this, cmd); }; exec1.implementation = function(cmd) { if ( cmd.indexOf("getprop") != -1 || cmd == "mount" || cmd.indexOf("build.prop") != -1 || cmd == "id" || cmd == "sh" ) { var fakeCmd = "grep"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } if (cmd == "su") { var fakeCmd = "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled"; send("Bypass " + cmd + " command"); return exec1.call(this, fakeCmd); } return exec1.call(this, cmd); }; String.contains.implementation = function(name) { if (name == "test-keys") { send("Bypass test-keys check"); return false; } return this.contains.call(this, name); }; var get = SystemProperties.get.overload("java.lang.String"); get.implementation = function(name) { if (RootPropertiesKeys.indexOf(name) != -1) { send("Bypass " + name); return RootProperties[name]; } return this.get.call(this, name); }; Interceptor.attach(Module.findExportByName("libc.so", "fopen"), { onEnter: function(args) { var path = Memory.readCString(args[0]); path = path.split("/"); var executable = path[path.length - 1]; var shouldFakeReturn = RootBinaries.indexOf(executable) > -1; if (shouldFakeReturn) { Memory.writeUtf8String(args[0], "/notexists"); send("Bypass native fopen"); } }, onLeave: function(retval) {}, }); Interceptor.attach(Module.findExportByName("libc.so", "system"), { onEnter: function(args) { var cmd = Memory.readCString(args[0]); send("SYSTEM CMD: " + cmd); if ( cmd.indexOf("getprop") != -1 || cmd == "mount" || cmd.indexOf("build.prop") != -1 || cmd == "id" ) { send("Bypass native system: " + cmd); Memory.writeUtf8String(args[0], "grep"); } if (cmd == "su") { send("Bypass native system: " + cmd); Memory.writeUtf8String( args[0], "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled" ); } }, onLeave: function(retval) {}, }); /* TO IMPLEMENT: Exec Family int execl(const char *path, const char *arg0, ..., const char *argn, (char *)0); int execle(const char *path, const char *arg0, ..., const char *argn, (char *)0, char *const envp[]); int execlp(const char *file, const char *arg0, ..., const char *argn, (char *)0); int execlpe(const char *file, const char *arg0, ..., const char *argn, (char *)0, char *const envp[]); int execv(const char *path, char *const argv[]); int execve(const char *path, char *const argv[], char *const envp[]); int execvp(const char *file, char *const argv[]); int execvpe(const char *file, char *const argv[], char *const envp[]); */ BufferedReader.readLine.overload("boolean").implementation = function() { var text = this.readLine.overload("boolean").call(this); if (text === null) { // just pass , i know it's ugly as hell but test != null won't work :( } else { var shouldFakeRead = text.indexOf("ro.build.tags=test-keys") > -1; if (shouldFakeRead) { send("Bypass build.prop file read"); text = text.replace( "ro.build.tags=test-keys", "ro.build.tags=release-keys" ); } } return text; }; var executeCommand = ProcessBuilder.command.overload("java.util.List"); ProcessBuilder.start.implementation = function() { var cmd = this.command.call(this); var shouldModifyCommand = false; for (var i = 0; i < cmd.size(); i = i + 1) { var tmp_cmd = cmd.get(i).toString(); if ( tmp_cmd.indexOf("getprop") != -1 || tmp_cmd.indexOf("mount") != -1 || tmp_cmd.indexOf("build.prop") != -1 || tmp_cmd.indexOf("id") != -1 ) { shouldModifyCommand = true; } } if (shouldModifyCommand) { send("Bypass ProcessBuilder " + cmd); this.command.call(this, ["grep"]); return this.start.call(this); } if (cmd.indexOf("su") != -1) { send("Bypass ProcessBuilder " + cmd); this.command.call(this, [ "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled", ]); return this.start.call(this); } return this.start.call(this); }; if (useProcessManager) { var ProcManExec = ProcessManager.exec.overload( "[Ljava.lang.String;", "[Ljava.lang.String;", "java.io.File", "boolean" ); var ProcManExecVariant = ProcessManager.exec.overload( "[Ljava.lang.String;", "[Ljava.lang.String;", "java.lang.String", "java.io.FileDescriptor", "java.io.FileDescriptor", "java.io.FileDescriptor", "boolean" ); ProcManExec.implementation = function(cmd, env, workdir, redirectstderr) { var fake_cmd = cmd; for (var i = 0; i < cmd.length; i = i + 1) { var tmp_cmd = cmd[i]; if ( tmp_cmd.indexOf("getprop") != -1 || tmp_cmd == "mount" || tmp_cmd.indexOf("build.prop") != -1 || tmp_cmd == "id" ) { var fake_cmd = ["grep"]; send("Bypass " + cmdarr + " command"); } if (tmp_cmd == "su") { var fake_cmd = [ "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled", ]; send("Bypass " + cmdarr + " command"); } } return ProcManExec.call(this, fake_cmd, env, workdir, redirectstderr); }; ProcManExecVariant.implementation = function( cmd, env, directory, stdin, stdout, stderr, redirect ) { var fake_cmd = cmd; for (var i = 0; i < cmd.length; i = i + 1) { var tmp_cmd = cmd[i]; if ( tmp_cmd.indexOf("getprop") != -1 || tmp_cmd == "mount" || tmp_cmd.indexOf("build.prop") != -1 || tmp_cmd == "id" ) { var fake_cmd = ["grep"]; send("Bypass " + cmdarr + " command"); } if (tmp_cmd == "su") { var fake_cmd = [ "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled", ]; send("Bypass " + cmdarr + " command"); } } return ProcManExecVariant.call( this, fake_cmd, env, directory, stdin, stdout, stderr, redirect ); }; } if (useKeyInfo) { KeyInfo.isInsideSecureHardware.implementation = function() { send("Bypass isInsideSecureHardware"); return true; }; } }); }, 0); /** * Bypass Multiple SSL Pinning * @param {any} function( * @returns {any} */ setTimeout(function() { Java.perform(function() { console.log("---"); console.log("Unpinning Android app..."); /// -- Generic hook to protect against SSLPeerUnverifiedException -- /// // In some cases, with unusual cert pinning approaches, or heavy obfuscation, we can't // match the real method & package names. This is a problem! Fortunately, we can still // always match built-in types, so here we spot all failures that use the built-in cert // error type (notably this includes OkHttp), and after the first failure, we dynamically // generate & inject a patch to completely disable the method that threw the error. try { const UnverifiedCertError = Java.use( "javax.net.ssl.SSLPeerUnverifiedException" ); UnverifiedCertError.$init.implementation = function(str) { console.log( " --> Unexpected SSL verification failure, adding dynamic patch..." ); try { const stackTrace = Java.use("java.lang.Thread") .currentThread() .getStackTrace(); const exceptionStackIndex = stackTrace.findIndex( (stack) => stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException" ); const callingFunctionStack = stackTrace[exceptionStackIndex + 1]; const className = callingFunctionStack.getClassName(); const methodName = callingFunctionStack.getMethodName(); console.log(` Thrown by ${className}->${methodName}`); const callingClass = Java.use(className); const callingMethod = callingClass[methodName]; if (callingMethod.implementation) return; // Already patched by Frida - skip it console.log(" Attempting to patch automatically..."); const returnTypeName = callingMethod.returnType.type; callingMethod.implementation = function() { console.log( ` --> Bypassing ${className}->${methodName} (automatic exception patch)` ); // This is not a perfect fix! Most unknown cases like this are really just // checkCert(cert) methods though, so doing nothing is perfect, and if we // do need an actual return value then this is probably the best we can do, // and at least we're logging the method name so you can patch it manually: if (returnTypeName === "void") { return; } else { return null; } }; console.log( ` [+] ${className}->${methodName} (automatic exception patch)` ); } catch (e) { console.log(" [ ] Failed to automatically patch failure"); } return this.$init(str); }; console.log("[+] SSLPeerUnverifiedException auto-patcher"); } catch (err) { console.log("[ ] SSLPeerUnverifiedException auto-patcher"); } /// -- Specific targeted hooks: -- /// // HttpsURLConnection try { const HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection"); HttpsURLConnection.setDefaultHostnameVerifier.implementation = function( hostnameVerifier ) { console.log( " --> Bypassing HttpsURLConnection (setDefaultHostnameVerifier)" ); return; // Do nothing, i.e. don't change the hostname verifier }; console.log("[+] HttpsURLConnection (setDefaultHostnameVerifier)"); } catch (err) { console.log("[ ] HttpsURLConnection (setDefaultHostnameVerifier)"); } try { const HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection"); HttpsURLConnection.setSSLSocketFactory.implementation = function( SSLSocketFactory ) { console.log(" --> Bypassing HttpsURLConnection (setSSLSocketFactory)"); return; // Do nothing, i.e. don't change the SSL socket factory }; console.log("[+] HttpsURLConnection (setSSLSocketFactory)"); } catch (err) { console.log("[ ] HttpsURLConnection (setSSLSocketFactory)"); } try { const HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection"); HttpsURLConnection.setHostnameVerifier.implementation = function( hostnameVerifier ) { console.log(" --> Bypassing HttpsURLConnection (setHostnameVerifier)"); return; // Do nothing, i.e. don't change the hostname verifier }; console.log("[+] HttpsURLConnection (setHostnameVerifier)"); } catch (err) { console.log("[ ] HttpsURLConnection (setHostnameVerifier)"); } // SSLContext try { const X509TrustManager = Java.use("javax.net.ssl.X509TrustManager"); const SSLContext = Java.use("javax.net.ssl.SSLContext"); const TrustManager = Java.registerClass({ // Implement a custom TrustManager name: "dev.asd.test.TrustManager", implements: [X509TrustManager], methods: { checkClientTrusted: function(chain, authType) {}, checkServerTrusted: function(chain, authType) {}, getAcceptedIssuers: function() { return []; }, }, }); // Prepare the TrustManager array to pass to SSLContext.init() const TrustManagers = [TrustManager.$new()]; // Get a handle on the init() on the SSLContext class const SSLContext_init = SSLContext.init.overload( "[Ljavax.net.ssl.KeyManager;", "[Ljavax.net.ssl.TrustManager;", "java.security.SecureRandom" ); // Override the init method, specifying the custom TrustManager SSLContext_init.implementation = function( keyManager, trustManager, secureRandom ) { console.log(" --> Bypassing Trustmanager (Android < 7) request"); SSLContext_init.call(this, keyManager, TrustManagers, secureRandom); }; console.log("[+] SSLContext"); } catch (err) { console.log("[ ] SSLContext"); } // TrustManagerImpl (Android > 7) try { const array_list = Java.use("java.util.ArrayList"); const TrustManagerImpl = Java.use( "com.android.org.conscrypt.TrustManagerImpl" ); // This step is notably what defeats the most common case: network security config TrustManagerImpl.checkTrustedRecursive.implementation = function( a1, a2, a3, a4, a5, a6 ) { console.log(" --> Bypassing TrustManagerImpl checkTrusted "); return array_list.$new(); }; TrustManagerImpl.verifyChain.implementation = function( untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData ) { console.log(" --> Bypassing TrustManagerImpl verifyChain: " + host); return untrustedChain; }; console.log("[+] TrustManagerImpl"); } catch (err) { console.log("[ ] TrustManagerImpl"); } // OkHTTPv3 (quadruple bypass) try { // Bypass OkHTTPv3 {1} const okhttp3_Activity_1 = Java.use("okhttp3.CertificatePinner"); okhttp3_Activity_1.check.overload( "java.lang.String", "java.util.List" ).implementation = function(a, b) { console.log(" --> Bypassing OkHTTPv3 (list): " + a); return; }; console.log("[+] OkHTTPv3 (list)"); } catch (err) { console.log("[ ] OkHTTPv3 (list)"); } try { // Bypass OkHTTPv3 {2} // This method of CertificatePinner.check could be found in some old Android app const okhttp3_Activity_2 = Java.use("okhttp3.CertificatePinner"); okhttp3_Activity_2.check.overload( "java.lang.String", "java.security.cert.Certificate" ).implementation = function(a, b) { console.log(" --> Bypassing OkHTTPv3 (cert): " + a); return; }; console.log("[+] OkHTTPv3 (cert)"); } catch (err) { console.log("[ ] OkHTTPv3 (cert)"); } try { // Bypass OkHTTPv3 {3} const okhttp3_Activity_3 = Java.use("okhttp3.CertificatePinner"); okhttp3_Activity_3.check.overload( "java.lang.String", "[Ljava.security.cert.Certificate;" ).implementation = function(a, b) { console.log(" --> Bypassing OkHTTPv3 (cert array): " + a); return; }; console.log("[+] OkHTTPv3 (cert array)"); } catch (err) { console.log("[ ] OkHTTPv3 (cert array)"); } try { // Bypass OkHTTPv3 {4} const okhttp3_Activity_4 = Java.use("okhttp3.CertificatePinner"); okhttp3_Activity_4["check$okhttp"].implementation = function(a, b) { console.log(" --> Bypassing OkHTTPv3 ($okhttp): " + a); return; }; console.log("[+] OkHTTPv3 ($okhttp)"); } catch (err) { console.log("[ ] OkHTTPv3 ($okhttp)"); } // Trustkit (triple bypass) try { // Bypass Trustkit {1} const trustkit_Activity_1 = Java.use( "com.datatheorem.android.trustkit.pinning.OkHostnameVerifier" ); trustkit_Activity_1.verify.overload( "java.lang.String", "javax.net.ssl.SSLSession" ).implementation = function(a, b) { console.log( " --> Bypassing Trustkit OkHostnameVerifier(SSLSession): " + a ); return true; }; console.log("[+] Trustkit OkHostnameVerifier(SSLSession)"); } catch (err) { console.log("[ ] Trustkit OkHostnameVerifier(SSLSession)"); } try { // Bypass Trustkit {2} const trustkit_Activity_2 = Java.use( "com.datatheorem.android.trustkit.pinning.OkHostnameVerifier" ); trustkit_Activity_2.verify.overload( "java.lang.String", "java.security.cert.X509Certificate" ).implementation = function(a, b) { console.log(" --> Bypassing Trustkit OkHostnameVerifier(cert): " + a); return true; }; console.log("[+] Trustkit OkHostnameVerifier(cert)"); } catch (err) { console.log("[ ] Trustkit OkHostnameVerifier(cert)"); } try { // Bypass Trustkit {3} const trustkit_PinningTrustManager = Java.use( "com.datatheorem.android.trustkit.pinning.PinningTrustManager" ); trustkit_PinningTrustManager.checkServerTrusted.implementation = function() { console.log(" --> Bypassing Trustkit PinningTrustManager"); }; console.log("[+] Trustkit PinningTrustManager"); } catch (err) { console.log("[ ] Trustkit PinningTrustManager"); } // Appcelerator Titanium try { const appcelerator_PinningTrustManager = Java.use( "appcelerator.https.PinningTrustManager" ); appcelerator_PinningTrustManager.checkServerTrusted.implementation = function() { console.log(" --> Bypassing Appcelerator PinningTrustManager"); }; console.log("[+] Appcelerator PinningTrustManager"); } catch (err) { console.log("[ ] Appcelerator PinningTrustManager"); } // OpenSSLSocketImpl Conscrypt try { const OpenSSLSocketImpl = Java.use( "com.android.org.conscrypt.OpenSSLSocketImpl" ); OpenSSLSocketImpl.verifyCertificateChain.implementation = function( certRefs, JavaObject, authMethod ) { console.log(" --> Bypassing OpenSSLSocketImpl Conscrypt"); }; console.log("[+] OpenSSLSocketImpl Conscrypt"); } catch (err) { console.log("[ ] OpenSSLSocketImpl Conscrypt"); } // OpenSSLEngineSocketImpl Conscrypt try { const OpenSSLEngineSocketImpl_Activity = Java.use( "com.android.org.conscrypt.OpenSSLEngineSocketImpl" ); OpenSSLEngineSocketImpl_Activity.verifyCertificateChain.overload( "[Ljava.lang.Long;", "java.lang.String" ).implementation = function(a, b) { console.log(" --> Bypassing OpenSSLEngineSocketImpl Conscrypt: " + b); }; console.log("[+] OpenSSLEngineSocketImpl Conscrypt"); } catch (err) { console.log("[ ] OpenSSLEngineSocketImpl Conscrypt"); } // OpenSSLSocketImpl Apache Harmony try { const OpenSSLSocketImpl_Harmony = Java.use( "org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl" ); OpenSSLSocketImpl_Harmony.verifyCertificateChain.implementation = function(asn1DerEncodedCertificateChain, authMethod) { console.log(" --> Bypassing OpenSSLSocketImpl Apache Harmony"); }; console.log("[+] OpenSSLSocketImpl Apache Harmony"); } catch (err) { console.log("[ ] OpenSSLSocketImpl Apache Harmony"); } // PhoneGap sslCertificateChecker (https://github.com/EddyVerbruggen/SSLCertificateChecker-PhoneGap-Plugin) try { const phonegap_Activity = Java.use( "nl.xservices.plugins.sslCertificateChecker" ); phonegap_Activity.execute.overload( "java.lang.String", "org.json.JSONArray", "org.apache.cordova.CallbackContext" ).implementation = function(a, b, c) { console.log(" --> Bypassing PhoneGap sslCertificateChecker: " + a); return true; }; console.log("[+] PhoneGap sslCertificateChecker"); } catch (err) { console.log("[ ] PhoneGap sslCertificateChecker"); } // IBM MobileFirst pinTrustedCertificatePublicKey (double bypass) try { // Bypass IBM MobileFirst {1} const WLClient_Activity_1 = Java.use( "com.worklight.wlclient.api.WLClient" ); WLClient_Activity_1.getInstance().pinTrustedCertificatePublicKey.overload( "java.lang.String" ).implementation = function(cert) { console.log( " --> Bypassing IBM MobileFirst pinTrustedCertificatePublicKey (string): " + cert ); return; }; console.log( "[+] IBM MobileFirst pinTrustedCertificatePublicKey (string)" ); } catch (err) { console.log( "[ ] IBM MobileFirst pinTrustedCertificatePublicKey (string)" ); } try { // Bypass IBM MobileFirst {2} const WLClient_Activity_2 = Java.use( "com.worklight.wlclient.api.WLClient" ); WLClient_Activity_2.getInstance().pinTrustedCertificatePublicKey.overload( "[Ljava.lang.String;" ).implementation = function(cert) { console.log( " --> Bypassing IBM MobileFirst pinTrustedCertificatePublicKey (string array): " + cert ); return; }; console.log( "[+] IBM MobileFirst pinTrustedCertificatePublicKey (string array)" ); } catch (err) { console.log( "[ ] IBM MobileFirst pinTrustedCertificatePublicKey (string array)" ); } // IBM WorkLight (ancestor of MobileFirst) HostNameVerifierWithCertificatePinning (quadruple bypass) try { // Bypass IBM WorkLight {1} const worklight_Activity_1 = Java.use( "com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning" ); worklight_Activity_1.verify.overload( "java.lang.String", "javax.net.ssl.SSLSocket" ).implementation = function(a, b) { console.log( " --> Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSocket): " + a ); return; }; console.log( "[+] IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSocket)" ); } catch (err) { console.log( "[ ] IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSocket)" ); } try { // Bypass IBM WorkLight {2} const worklight_Activity_2 = Java.use( "com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning" ); worklight_Activity_2.verify.overload( "java.lang.String", "java.security.cert.X509Certificate" ).implementation = function(a, b) { console.log( " --> Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning (cert): " + a ); return; }; console.log( "[+] IBM WorkLight HostNameVerifierWithCertificatePinning (cert)" ); } catch (err) { console.log( "[ ] IBM WorkLight HostNameVerifierWithCertificatePinning (cert)" ); } try { // Bypass IBM WorkLight {3} const worklight_Activity_3 = Java.use( "com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning" ); worklight_Activity_3.verify.overload( "java.lang.String", "[Ljava.lang.String;", "[Ljava.lang.String;" ).implementation = function(a, b) { console.log( " --> Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning (string string): " + a ); return; }; console.log( "[+] IBM WorkLight HostNameVerifierWithCertificatePinning (string string)" ); } catch (err) { console.log( "[ ] IBM WorkLight HostNameVerifierWithCertificatePinning (string string)" ); } try { // Bypass IBM WorkLight {4} const worklight_Activity_4 = Java.use( "com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning" ); worklight_Activity_4.verify.overload( "java.lang.String", "javax.net.ssl.SSLSession" ).implementation = function(a, b) { console.log( " --> Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSession): " + a ); return true; }; console.log( "[+] IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSession)" ); } catch (err) { console.log( "[ ] IBM WorkLight HostNameVerifierWithCertificatePinning (SSLSession)" ); } // Conscrypt CertPinManager try { const conscrypt_CertPinManager_Activity = Java.use( "com.android.org.conscrypt.CertPinManager" ); conscrypt_CertPinManager_Activity.isChainValid.overload( "java.lang.String", "java.util.List" ).implementation = function(a, b) { console.log(" --> Bypassing Conscrypt CertPinManager: " + a); return true; }; console.log("[+] Conscrypt CertPinManager"); } catch (err) { console.log("[ ] Conscrypt CertPinManager"); } // CWAC-Netsecurity (unofficial back-port pinner for Android<4.2) CertPinManager try { const cwac_CertPinManager_Activity = Java.use( "com.commonsware.cwac.netsecurity.conscrypt.CertPinManager" ); cwac_CertPinManager_Activity.isChainValid.overload( "java.lang.String", "java.util.List" ).implementation = function(a, b) { console.log(" --> Bypassing CWAC-Netsecurity CertPinManager: " + a); return true; }; console.log("[+] CWAC-Netsecurity CertPinManager"); } catch (err) { console.log("[ ] CWAC-Netsecurity CertPinManager"); } // Worklight Androidgap WLCertificatePinningPlugin try { const androidgap_WLCertificatePinningPlugin_Activity = Java.use( "com.worklight.androidgap.plugin.WLCertificatePinningPlugin" ); androidgap_WLCertificatePinningPlugin_Activity.execute.overload( "java.lang.String", "org.json.JSONArray", "org.apache.cordova.CallbackContext" ).implementation = function(a, b, c) { console.log( " --> Bypassing Worklight Androidgap WLCertificatePinningPlugin: " + a ); return true; }; console.log("[+] Worklight Androidgap WLCertificatePinningPlugin"); } catch (err) { console.log("[ ] Worklight Androidgap WLCertificatePinningPlugin"); } // Netty FingerprintTrustManagerFactory try { const netty_FingerprintTrustManagerFactory = Java.use( "io.netty.handler.ssl.util.FingerprintTrustManagerFactory" ); netty_FingerprintTrustManagerFactory.checkTrusted.implementation = function(type, chain) { console.log(" --> Bypassing Netty FingerprintTrustManagerFactory"); }; console.log("[+] Netty FingerprintTrustManagerFactory"); } catch (err) { console.log("[ ] Netty FingerprintTrustManagerFactory"); } // Squareup CertificatePinner [OkHTTP Bypassing Squareup CertificatePinner (cert): " + a); return; }; console.log("[+] Squareup CertificatePinner (cert)"); } catch (err) { console.log("[ ] Squareup CertificatePinner (cert)"); } try { // Bypass Squareup CertificatePinner {2} const Squareup_CertificatePinner_Activity_2 = Java.use( "com.squareup.okhttp.CertificatePinner" ); Squareup_CertificatePinner_Activity_2.check.overload( "java.lang.String", "java.util.List" ).implementation = function(a, b) { console.log(" --> Bypassing Squareup CertificatePinner (list): " + a); return; }; console.log("[+] Squareup CertificatePinner (list)"); } catch (err) { console.log("[ ] Squareup CertificatePinner (list)"); } // Squareup OkHostnameVerifier [OkHTTP v3] (double bypass) try { // Bypass Squareup OkHostnameVerifier {1} const Squareup_OkHostnameVerifier_Activity_1 = Java.use( "com.squareup.okhttp.internal.tls.OkHostnameVerifier" ); Squareup_OkHostnameVerifier_Activity_1.verify.overload( "java.lang.String", "java.security.cert.X509Certificate" ).implementation = function(a, b) { console.log(" --> Bypassing Squareup OkHostnameVerifier (cert): " + a); return true; }; console.log("[+] Squareup OkHostnameVerifier (cert)"); } catch (err) { console.log("[ ] Squareup OkHostnameVerifier (cert)"); } try { // Bypass Squareup OkHostnameVerifier {2} const Squareup_OkHostnameVerifier_Activity_2 = Java.use( "com.squareup.okhttp.internal.tls.OkHostnameVerifier" ); Squareup_OkHostnameVerifier_Activity_2.verify.overload( "java.lang.String", "javax.net.ssl.SSLSession" ).implementation = function(a, b) { console.log( " --> Bypassing Squareup OkHostnameVerifier (SSLSession): " + a ); return true; }; console.log("[+] Squareup OkHostnameVerifier (SSLSession)"); } catch (err) { console.log("[ ] Squareup OkHostnameVerifier (SSLSession)"); } // Android WebViewClient (double bypass) try { // Bypass WebViewClient {1} (deprecated from Android 6) const AndroidWebViewClient_Activity_1 = Java.use( "android.webkit.WebViewClient" ); AndroidWebViewClient_Activity_1.onReceivedSslError.overload( "android.webkit.WebView", "android.webkit.SslErrorHandler", "android.net.http.SslError" ).implementation = function(obj1, obj2, obj3) { console.log(" --> Bypassing Android WebViewClient (SslErrorHandler)"); }; console.log("[+] Android WebViewClient (SslErrorHandler)"); } catch (err) { console.log("[ ] Android WebViewClient (SslErrorHandler)"); } try { // Bypass WebViewClient {2} const AndroidWebViewClient_Activity_2 = Java.use( "android.webkit.WebViewClient" ); AndroidWebViewClient_Activity_2.onReceivedSslError.overload( "android.webkit.WebView", "android.webkit.WebResourceRequest", "android.webkit.WebResourceError" ).implementation = function(obj1, obj2, obj3) { console.log(" --> Bypassing Android WebViewClient (WebResourceError)"); }; console.log("[+] Android WebViewClient (WebResourceError)"); } catch (err) { console.log("[ ] Android WebViewClient (WebResourceError)"); } // Apache Cordova WebViewClient try { const CordovaWebViewClient_Activity = Java.use( "org.apache.cordova.CordovaWebViewClient" ); CordovaWebViewClient_Activity.onReceivedSslError.overload( "android.webkit.WebView", "android.webkit.SslErrorHandler", "android.net.http.SslError" ).implementation = function(obj1, obj2, obj3) { console.log(" --> Bypassing Apache Cordova WebViewClient"); obj3.proceed(); }; } catch (err) { console.log("[ ] Apache Cordova WebViewClient"); } // Boye AbstractVerifier try { const boye_AbstractVerifier = Java.use( "ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier" ); boye_AbstractVerifier.verify.implementation = function(host, ssl) { console.log(" --> Bypassing Boye AbstractVerifier: " + host); }; } catch (err) { console.log("[ ] Boye AbstractVerifier"); } // Appmattus try { const appmatus_Activity = Java.use( "com.appmattus.certificatetransparency.internal.verifier.CertificateTransparencyInterceptor" ); appmatus_Activity["intercept"].implementation = function(a) { console.log(" --> Bypassing Appmattus (Transparency)"); return a.proceed(a.request()); }; console.log("[+] Appmattus (CertificateTransparencyInterceptor)"); } catch (err) { console.log("[ ] Appmattus (CertificateTransparencyInterceptor)"); } try { const CertificateTransparencyTrustManager = Java.use( "com.appmattus.certificatetransparency.internal.verifier.CertificateTransparencyTrustManager" ); CertificateTransparencyTrustManager["checkServerTrusted"].overload( "[Ljava.security.cert.X509Certificate;", "java.lang.String" ).implementation = function(x509CertificateArr, str) { console.log( " --> Bypassing Appmattus (CertificateTransparencyTrustManager)" ); }; CertificateTransparencyTrustManager["checkServerTrusted"].overload( "[Ljava.security.cert.X509Certificate;", "java.lang.String", "java.lang.String" ).implementation = function(x509CertificateArr, str, str2) { console.log( " --> Bypassing Appmattus (CertificateTransparencyTrustManager)" ); return Java.use("java.util.ArrayList").$new(); }; console.log("[+] Appmattus (CertificateTransparencyTrustManager)"); } catch (err) { console.log("[ ] Appmattus (CertificateTransparencyTrustManager)"); } console.log("Unpinning setup completed"); console.log("---"); }); }, 0); //////////////////////////////////////////////////////////// // Author: Rohindh // Github: https://github.com/RohindhR // Date: 08/03/2024 // Version: 1.0 // Description: Frida script for bypassing React Native Jail Monkey checks // Tested and developed for Jail Monkey version 2.8.0 (https://www.npmjs.com/package/jail-monkey/v/2.8.0) and Frida version 16.2.1 // Usage: frida -U -f com.example.appname --codeshare RohindhR/react-native-jail-monkey-bypass-all-checks // Note: This script is for educational purposes only. Do not use it for illegal activities. // I am not responsible for any damage done by this script. // Use this script at your own risk. Java.perform(function() { // Bypassing Root, Hook, Mock Location, External Storage, ADB checks Java.use('com.gantix.JailMonkey.JailMonkeyModule').getConstants.implementation = function() { var hashmap = this.getConstants(); hashmap.put('isJailBroken', Java.use("java.lang.Boolean").$new(false)); console.log(`Root Check Bypassed : ✅`); hashmap.put('hookDetected', Java.use("java.lang.Boolean").$new(false)); console.log(`Hook Check Bypassed : ✅`); hashmap.put('canMockLocation', Java.use("java.lang.Boolean").$new(false)); console.log(`Mock Location Check Bypassed : ✅`); hashmap.put('isOnExternalStorage', Java.use("java.lang.Boolean").$new(false)); console.log(`External Storage Check Bypassed : ✅`); hashmap.put('AdbEnabled', Java.use("java.lang.Boolean").$new(false)); console.log(`ADB Check Bypassed : ✅`); return hashmap; } // Bypassing Rooted Check let RootedCheckClass = Java.use("com.gantix.JailMonkey.Rooted.RootedCheck") RootedCheckClass.getResultByDetectionMethod.implementation = function() { let map = this.getResultByDetectionMethod(); map.put("jailMonkey", Java.use("java.lang.Boolean").$new(false)); return map; } // Bypassing Root detection method's result of RootBeer library var RootBeerResultsClass = Java.use("com.gantix.JailMonkey.Rooted.RootedCheck$RootBeerResults"); RootBeerResultsClass.isJailBroken.implementation = function() { return false; }; RootBeerResultsClass.toNativeMap.implementation = function() { var map = this.toNativeMap.call(this); map.put("detectRootManagementApps", Java.use("java.lang.Boolean").$new(false)); map.put("detectPotentiallyDangerousApps", Java.use("java.lang.Boolean").$new(false)); map.put("checkForSuBinary", Java.use("java.lang.Boolean").$new(false)); map.put("checkForDangerousProps", Java.use("java.lang.Boolean").$new(false)); map.put("checkForRWPaths", Java.use("java.lang.Boolean").$new(false)); map.put("detectTestKeys", Java.use("java.lang.Boolean").$new(false)); map.put("checkSuExists", Java.use("java.lang.Boolean").$new(false)); map.put("checkForRootNative", Java.use("java.lang.Boolean").$new(false)); map.put("checkForMagiskBinary", Java.use("java.lang.Boolean").$new(false)); console.log("Root detection method's result bypass : ✅"); return map; }; // Bypassing Development settings check Java.use("com.gantix.JailMonkey.JailMonkeyModule").isDevelopmentSettingsMode.overload("com.facebook.react.bridge.Promise").implementation = function(p) { p.resolve(Java.use("java.lang.Boolean").$new(false)); console.log("isDevelopmentSettingsMode Check Bypassed : ✅"); } // Bypassing Debugger check Java.use("com.gantix.JailMonkey.JailMonkeyModule").isDebuggedMode.overload("com.facebook.react.bridge.Promise").implementation = function(p) { p.resolve(Java.use("java.lang.Boolean").$new(false)); console.log("isDebuggerConnected Check Bypassed : ✅"); } }) // ============================================ // Configuración de hooks avanzados // ============================================ // Desactivar la verificación SSL en OpenSSL y BoringSSL function bypassSSLVerification() { console.log("[*] Bypassing SSL verification..."); // Hookear SSL_CTX_set_verify (OpenSSL) var SSL_CTX_set_verify = Module.findExportByName('libssl.so', 'SSL_CTX_set_verify'); if (SSL_CTX_set_verify) { Interceptor.attach(SSL_CTX_set_verify, { onEnter: function (args) { console.log("[*] SSL_CTX_set_verify - Bypassing SSL verification."); args[1] = ptr(0); // Deshabilitar la verificación de certificados }, onLeave: function (retval) {} }); } // Hookear SSL_set_verify (OpenSSL) var SSL_set_verify = Module.findExportByName('libssl.so', 'SSL_set_verify'); if (SSL_set_verify) { Interceptor.attach(SSL_set_verify, { onEnter: function (args) { console.log("[*] SSL_set_verify - Bypassing SSL verification."); args[1] = ptr(0); // Deshabilitar la verificación }, onLeave: function (retval) {} }); } // Hookear BoringSSL (si está presente) var boringsslMethods = [ 'SSL_CTX_set_verify', 'SSL_set_verify', 'SSL_write', 'SSL_read' ]; boringsslMethods.forEach(function (method) { var addr = Module.findExportByName('libboringssl.so', method); if (addr) { Interceptor.attach(addr, { onEnter: function (args) { console.log("[*] BoringSSL function hooked: " + method); if (method === 'SSL_CTX_set_verify' || method === 'SSL_set_verify') { args[1] = ptr(0); // Bypass SSL verification } } }); } }); // Prevenir el fallo de verificación de certificados en iOS (SecureTransport) var sslFunctions = [ 'SSLContextSetCertificate', 'SSLSetCertificate' ]; sslFunctions.forEach(function (func) { var funcAddr = Module.findExportByName('Security', func); if (funcAddr) { Interceptor.attach(funcAddr, { onEnter: function (args) { console.log("[*] SecureTransport function hooked: " + func); // Manipular el certificado o retornar éxito sin validar } }); } }); console.log("[*] SSL verification bypassed."); } // ============================================ // Bypass del Pinning de Certificados (Avanzado) // ============================================ function bypassCertPinning() { console.log("[*] Attempting to bypass certificate pinning..."); // Saltarse el pinning de certificados basado en X509_verify_cert var X509_verify_cert = Module.findExportByName('libssl.so', 'X509_verify_cert'); if (X509_verify_cert) { Interceptor.attach(X509_verify_cert, { onEnter: function (args) { console.log("[*] X509_verify_cert called. Bypassing certificate pinning."); return 1; // Simula una validación de certificado exitosa }, onLeave: function (retval) {} }); } else { console.log("[-] X509_verify_cert not found."); } // Saltarse pinning de certificados basado en hash (si es que la app utiliza hashes) var certificateCheck = Module.findExportByName(null, 'checkCertificate'); if (certificateCheck) { Interceptor.attach(certificateCheck, { onEnter: function (args) { console.log("[*] Hooked certificateCheck function. Bypassing hash-based certificate pinning."); // Manipula aquí el certificado para evitar el fallo en la comparación de hash } }); } // Saltarse verificación de hostname (si la app realiza este tipo de validación) var verifyHost = Module.findExportByName(null, 'verifyHost'); if (verifyHost) { Interceptor.attach(verifyHost, { onEnter: function (args) { console.log("[*] Hooked verifyHost function. Bypassing hostname verification."); // Manipular el host aquí si es necesario }, onLeave: function (retval) {} }); } console.log("[*] Certificate pinning bypassed."); } // ============================================ // Manejo de Excepciones y Anti-Debugging (Más Avanzado) // ============================================ function bypassAntiDebugging() { console.log("[*] Bypassing anti-debugging techniques..."); // Funciones comunes para detectar debuggers en Android var antiDebuggerFunctions = [ 'ptrace', // Detecta si hay un debugger adjunto 'syscall', // Verifica llamadas del sistema que podrían indicar depuración 'kill', // Algunas apps matan procesos cuando detectan debuggers 'getenv', // Revisa si hay variables de entorno relacionadas con la depuración 'open', // Detecta si hay archivos de debug o traces abiertos 'fopen' ]; antiDebuggerFunctions.forEach(function (funcName) { var addr = Module.findExportByName(null, funcName); if (addr) { Interceptor.attach(addr, { onEnter: function (args) { console.log("[*] Anti-debugging function hooked: " + funcName); if (funcName === 'ptrace') { console.log("[*] Disabling ptrace detection (anti-debugging)."); return; // Deshabilitar ptrace } } }); } }); // Técnicas de anti-debugging específicas de la app: Verifica si se usa el código ofuscado var isDebuggerPresent = Module.findExportByName(null, 'isDebuggerPresent'); if (isDebuggerPresent) { Interceptor.attach(isDebuggerPresent, { onEnter: function (args) { console.log("[*] isDebuggerPresent hooked. Returning false to bypass."); return 0; // Indicar que no hay depurador presente }, onLeave: function (retval) {} }); } console.log("[*] Anti-debugging bypass completed."); } // ============================================ // Hookeando SSL/TLS y manipulando tráfico // ============================================ function hookSSLReadWrite() { console.log("[*] Hooking SSL read and write functions..."); var SSL_write = Module.findExportByName('libssl.so', 'SSL_write'); var SSL_read = Module.findExportByName('libssl.so', 'SSL_read'); if (SSL_write && SSL_read) { Interceptor.attach(SSL_write, { onEnter: function (args) { console.log("[*] SSL_write called with data:"); var data = args[1].readUtf8String(); console.log("[*] Data sent: " + data); } }); Interceptor.attach(SSL_read, { onEnter: function (args) { console.log("[*] SSL_read called."); } }); } else { console.log("[-] SSL_write or SSL_read not found."); } } // ============================================ // Ejecución principal // ============================================ function main() { console.log("[*] Starting Frida script for SSL pinning bypass..."); // Llamada a funciones para bypass SSL Pinning bypassSSLVerification(); bypassCertPinning(); hookSSLReadWrite(); // Llamada a la función para bypass de técnicas anti-debugging bypassAntiDebugging(); console.log("[*] All hooks are active."); } main();

Project: union2