'use strict'; /* * bypass-flutter-tls-verification.js — accept any TLS certificate in a Flutter app. * * Hooks dart:io's SSLCertContext::CertificateCallback (dart:io installs it on every * SecurityContext via SSL_CTX_set_verify) and forces it to return 1, disabling * certificate verification for HttpClient, SecureSocket, dio, package:http and * everything built on them. */ var CFG = { moduleName: 'libflutter.so', anchors: [ 'CertificateCallback called with no current isolate', 'BadCertificateCallback returned a value that was not a boolean' ], nativeName: 'SecurityContext_Allocate', maxWaitMs: 60000, pollMs: 200, startDelayMs: 250 }; var state = { accepted: 0, rejected: 0, hookInstalled: false, attempts: 0, started: Date.now() }; function log(msg) { console.log('[flutter-tls] ' + msg); } function warn(msg) { console.warn('[flutter-tls] [!] ' + msg); } function hexOf(v) { return '0x' + v.toString(16); } /* Frida 17 removed Memory.readByteArray(); ptr.readByteArray() works on 16.x and 17.x */ function readBytes(ptr, size) { return ptr.readByteArray(size); } function toHex(bytes) { var s = ''; for (var i = 0; i < bytes.length; i++) s += ('0' + bytes[i].toString(16)).slice(-2); return s; } function ptrBytes(absVa) { /* 8-byte LE pattern for an absolute address */ var hexs = ('0000000000000000' + absVa.toString(16)).slice(-16), b = []; for (var i = 14; i >= 0; i -= 2) b.push(hexs.substr(i, 2)); return b.join(' '); } function baseNum(mod) { return parseInt(mod.base.toString(16), 16); } /* '-' means dont-care in protection strings, so 'r--' already includes r-x */ function rangesOf(mod, prot) { var seen = {}, out = []; mod.enumerateRanges(prot).concat(prot === 'r--' ? mod.enumerateRanges('r-x') : []).forEach(function(r) { var k = r.base.toString() + '/' + r.size; if (!seen[k]) { seen[k] = true; out.push({ off: r.base.sub(mod.base).toInt32(), size: r.size, base: r.base }); } }); return out; } function execRanges(mod) { return rangesOf(mod, 'r-x'); } function isExecIn(exec, rel) { for (var i = 0; i < exec.length; i++) if (rel >= exec[i].off && rel < exec[i].off + exec[i].size) return true; return false; } function findStringOffsets(mod, needle) { var out = [], hex = []; for (var i = 0; i < needle.length; i++) hex.push(('0' + needle.charCodeAt(i).toString(16)).slice(-2)); var pattern = hex.join(' '); rangesOf(mod, 'r--').forEach(function(r) { var matches; try { matches = Memory.scanSync(r.base, r.size, pattern); } catch (e) { return; } matches.forEach(function(m) { out.push(m.address.sub(mod.base).toInt32()); }); }); return out; } function findPointerSlots(mod, targetAbs) { var out = [], pattern = ptrBytes(targetAbs); rangesOf(mod, 'r--').forEach(function(r) { var matches; try { matches = Memory.scanSync(r.base, r.size, pattern); } catch (e) { return; } matches.forEach(function(m) { out.push(m.address); }); }); return out; } /* ELF64: PT_GNU_EH_FRAME vaddr relative to the first PT_LOAD */ function ehFrameHdrOffset(mod) { var base = mod.base; var e_phoff = base.add(0x20).readU64().toNumber(); var e_phentsize = base.add(0x36).readU16(), e_phnum = base.add(0x38).readU16(); var firstLoadVa = 0, ehVa = -1; for (var i = 0; i < e_phnum; i++) { var ph = base.add(e_phoff + i * e_phentsize), type = ph.readU32(); if (type === 1 && firstLoadVa === 0) { if (ph.add(8).readU64().toNumber() === 0) firstLoadVa = ph.add(16).readU64().toNumber(); } else if (type === 0x6474e550) { ehVa = ph.add(16).readU64().toNumber(); } } return ehVa < 0 ? -1 : ehVa - firstLoadVa; } function functionEntryPoints(mod) { var off = ehFrameHdrOffset(mod); if (off < 0) return null; var p = mod.base.add(off); if (p.readU8() !== 1) return null; var ehEnc = p.add(1).readU8(); var cur = 4 + ((ehEnc === 0x1b || ehEnc === 0x03) ? 4 : 8); var enc = p.add(2).readU8(), count; if (enc === 0x03 || enc === 0x1b) { count = p.add(cur).readU32(); cur += 4; } else { count = p.add(cur).readU64().toNumber(); cur += 8; } var dv = new DataView(readBytes(p.add(cur), count * 8)); var starts = new Array(count); for (var i = 0; i < count; i++) starts[i] = off + dv.getInt32(i * 8, true); return starts.sort(function(a, b) { return a - b; }); } function entryFor(starts, off) { if (!starts || !starts.length) return -1; var lo = 0, hi = starts.length - 1, best = -1; while (lo <= hi) { var mid = (lo + hi) >> 1; if (starts[mid] <= off) { best = starts[mid]; lo = mid + 1; } else { hi = mid - 1; } } return best; } function endFor(starts, off) { var i = starts ? starts.indexOf(entryFor(starts, off)) : -1; return (i >= 0 && i + 1 < starts.length) ? starts[i + 1] : -1; } var SCAN_CHUNK = 1 << 20; /* code refs to addresses accepted by isWanted(), within a range (module-relative) */ function refsInRange(mod, startOff, size, isWanted) { var arm = archKey() === 'arm64'; var hits = []; for (var done = 0; done < size; done += SCAN_CHUNK) { var chunk = Math.min(SCAN_CHUNK, size - done), buf; try { buf = readBytes(mod.base.add(startOff + done), chunk); } catch (e) { continue; } var absBase = startOff + done; if (arm) { var words = new Uint32Array(buf, 0, chunk >> 2), pages = {}; for (var i = 0; i < words.length; i++) { var w = words[i]; if (((w & 0x9f000000) >>> 0) === 0x10000000) { /* ADR */ var imm = ((w >>> 5) & 0x7ffff) * 4 + ((w >>> 29) & 3); if (imm >= (1 << 20)) imm -= (1 << 21); var t = absBase + i * 4 + imm; if (isWanted(t)) hits.push({ site: absBase + i * 4, target: t }); } else if (((w & 0x7f800000) >>> 0) === 0x11000000) { /* ADD imm */ var rn = (w >>> 5) & 0x1f, imm12 = (w >>> 10) & 0xfff, sh = (w >>> 22) & 1; for (var k = 1; k <= 8 && i - k >= 0; k++) { var pw = words[i - k]; if (((pw & 0x9f000000) >>> 0) !== 0x90000000 || ((pw & 0x1f) !== rn)) continue; var pimm = ((pw >>> 5) & 0x7ffff) * 4 + ((pw >>> 29) & 3); if (pimm >= (1 << 20)) pimm -= (1 << 21); var page = ((absBase + (i - k) * 4) & ~0xfff) + pimm * 0x1000; var target = page + (imm12 << (sh ? 12 : 0)); if (isWanted(target)) hits.push({ site: absBase + i * 4, target: target }); break; } } } } else { var bytes = new Uint8Array(buf), dv = new DataView(bytes.buffer); for (var j = 0; j + 7 <= chunk; j++) { var b0 = bytes[j], b1 = bytes[j + 1]; if (!((b0 >= 0x40 && b0 <= 0x4f || b0 === 0x48) && (b1 === 0x8d || b1 === 0x8b))) continue; if ((bytes[j + 2] & 0xc7) !== 0x05) continue; /* RIP-relative */ var tgt = absBase + j + 7 + dv.getInt32(j + 3, true); if (isWanted(tgt)) hits.push({ site: absBase + j, target: tgt }); } } } return hits; } function anchorRefs(mod, anchors) { var set = {}; anchors.forEach(function(a) { set[a] = true; }); var hits = []; rangesOf(mod, 'r-x').forEach(function(r) { var rBase = r.base.sub(mod.base).toInt32(); refsInRange(mod, rBase, r.size, function(t) { return set[t] === true; }) .forEach(function(h) { hits.push(h); }); }); return hits; } /* CertificateCallback starts by comparing its first argument against 1 */ function looksLikeCertCallback(mod, off) { var buf; try { buf = new Uint8Array(readBytes(mod.base.add(off), 24)); } catch (e) { return false; } if (archKey() === 'arm64') { var words = new Uint32Array(buf.buffer, 0, 6); for (var i = 0; i < words.length; i++) if (words[i] === 0x7100041f) return true; /* cmp w0, #1 */ return false; } for (var j = 0; j + 3 <= buf.length; j++) { /* cmp edi,1 / cmp rdi,1 */ if (buf[j] === 0x83 && buf[j + 1] === 0xff && buf[j + 2] === 0x01) return true; if (buf[j] === 0x48 && buf[j + 1] === 0x83 && buf[j + 2] === 0xff && buf[j + 3] === 0x01) return true; } return false; } /* Frida reports x86_64 as 'x64' */ function archKey() { var a = Process.arch; if (a === 'arm64') return 'arm64'; if (a === 'x64' || a === 'x86_64') return 'x86_64'; return null; } /* A: anchor strings -> code refs -> enclosing function */ function locateViaAnchors(mod, starts) { var anchorOffsets = []; CFG.anchors.forEach(function(s) { findStringOffsets(mod, s).forEach(function(o) { anchorOffsets.push(o); }); }); log('A: anchor strings found: ' + anchorOffsets.length + (anchorOffsets.length ? ' [' + anchorOffsets.map(hexOf).join(', ') + ']' : '')); if (!anchorOffsets.length) return -1; var refs = anchorRefs(mod, anchorOffsets); if (!refs.length) { warn('A: no code reference to the anchor strings'); return -1; } log('A: code reference(s): ' + refs.map(function(r) { return hexOf(r.site); }).join(', ')); if (!starts) { warn('A: no .eh_frame_hdr function table — cannot map a reference to an entry'); return -1; } var byFunc = {}; refs.forEach(function(r) { var entry = entryFor(starts, r.site); if (entry < 0) return; if (!byFunc[entry]) byFunc[entry] = {}; byFunc[entry][r.target] = true; }); var entries = Object.keys(byFunc).map(Number), best = -1, bestAnchors = 0; entries.forEach(function(e) { var n = Object.keys(byFunc[e]).length; if (n > bestAnchors) { bestAnchors = n; best = e; } }); log('A: candidate(s): ' + entries.map(function(e) { return hexOf(e) + '(' + Object.keys(byFunc[e]).length + ' anchors)'; }).join(', ')); if (bestAnchors >= CFG.anchors.length || entries.length === 1) return best; warn('A: no single function references all anchor strings'); return -1; } /* B: native function table entry for "SecurityContext_Allocate" -> its code refs */ function locateViaNativeTable(mod, starts, exec) { var nameRel = findStringOffsets(mod, CFG.nativeName)[0]; if (nameRel === undefined) { warn('B: literal "' + CFG.nativeName + '" not found'); return -1; } var slots = findPointerSlots(mod, baseNum(mod) + nameRel); if (!slots.length) { warn('B: no data word points at that literal'); return -1; } log('B: table entry pointing at the literal: ' + slots.map(function(s) { return s.toString(); }).join(', ')); var B = baseNum(mod), native = -1; slots.forEach(function(slot) { if (native >= 0) return; var dv; try { dv = new DataView(readBytes(slot, 40)); } catch (e) { return; } for (var k = 1; k <= 4; k++) { /* code pointer stored next to the name */ var v = dv.getUint32(k * 8, true) + dv.getUint32(k * 8 + 4, true) * 4294967296 + 0; if (isExecIn(exec, v - B)) { native = v - B; break; } } }); if (native < 0) { warn('B: no code pointer next to the table entry'); return -1; } log('B: ' + CFG.nativeName + ' at +' + hexOf(native)); var end = starts ? endFor(starts, native) : -1; if (end < 0) { warn('B: native function bounds unknown'); return -1; } var cands = []; refsInRange(mod, native, end - native, function(t) { return isExecIn(exec, t) && (starts ? entryFor(starts, t) === t : false); }).forEach(function(h) { if (cands.indexOf(h.target) < 0) cands.push(h.target); }); log('B: code pointer(s) passed out of that function: ' + (cands.length ? cands.map(function(c) { return hexOf(c) + (looksLikeCertCallback(mod, c) ? ' (cert-callback shape)' : ''); }).join(', ') : 'none')); var good = cands.filter(function(c) { return looksLikeCertCallback(mod, c); }); if (good.length === 1) return good[0]; if (good.length > 1) warn('B: ' + good.length + ' candidates match the prologue shape — ambiguous'); return -1; } function resolveCertCallback(mod) { var arch = archKey(); if (arch === null) { warn('architecture ' + Process.arch + ' (32-bit) unsupported — use the arm64/x64 build'); return -1; } var starts = null; try { starts = functionEntryPoints(mod); } catch (e) { warn('.eh_frame_hdr read failed: ' + e); } if (starts) log('function table: ' + starts.length + ' entries from .eh_frame_hdr'); var exec = execRanges(mod); log('resolving CertificateCallback (reads libflutter.so — takes a few seconds)'); var a = -1, b = -1; try { a = locateViaAnchors(mod, starts); } catch (e) { warn('A failed: ' + e); } try { b = locateViaNativeTable(mod, starts, exec); } catch (e) { warn('B failed: ' + e); } var aOk = a >= 0 && looksLikeCertCallback(mod, a); var bOk = b >= 0 && looksLikeCertCallback(mod, b); if (a >= 0 && b >= 0 && a === b) { log('resolved: both methods agree on +' + hexOf(a)); return a; } if (a >= 0 && b >= 0) { warn('methods disagree: A=' + hexOf(a) + ' (shape ' + aOk + '), B=' + hexOf(b) + ' (shape ' + bOk + ')'); if (bOk && !aOk) return b; return a; } if (a >= 0) { log('resolved: A only -> +' + hexOf(a) + ' (shape ' + aOk + ')'); return a; } if (b >= 0) { log('resolved: B only -> +' + hexOf(b) + ' (shape ' + bOk + ')'); return b; } warn('both methods failed — not hooked'); return -1; } /* WebView / Java networking (not dart:io) */ function installJavaBypass() { if (typeof Java === 'undefined' || !Java.available) return; Java.perform(function() { try { var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager'); var SSLContext = Java.use('javax.net.ssl.SSLContext'); var TrustAll = Java.registerClass({ name: 'org.pentest.TrustAll', implements: [X509TrustManager], methods: { checkClientTrusted: function() {}, checkServerTrusted: function() {}, getAcceptedIssuers: function() { return []; } } }); var tms = [TrustAll.$new()]; SSLContext.init.overload('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') .implementation = function(km, tm, sr) { this.init(km, tms, sr); }; log('java TrustManager bypass installed'); } catch (e) { warn('java TrustManager bypass: ' + e); } try { Java.use('okhttp3.CertificatePinner').check .overload('java.lang.String', 'java.util.List') .implementation = function() { return; }; log('okhttp CertificatePinner bypass installed'); } catch (e) { /* not present */ } }); } function install(mod) { if (state.hookInstalled) return true; if (state.attempts > 3) return true; state.attempts++; log('libflutter.so @ ' + mod.base + ' (' + mod.size + ' bytes, ' + Process.arch + ')'); var off = resolveCertCallback(mod); if (off < 0) { warn('could not locate SSLCertContext::CertificateCallback — NOT hooked'); return false; } var target = mod.base.add(off); function onVerify(preverifyOk) { if (preverifyOk === 0) { state.rejected++; log('certificate verification FAILED by native stack (#' + state.rejected + ') -> forced accept'); } else { state.accepted++; } return 1; /* 1 = chain accepted */ } try { Interceptor.replace(target, new NativeCallback(function(preverifyOk, storeCtx) { return onVerify(preverifyOk); }, 'int', ['int', 'pointer'])); state.mode = 'replace'; } catch (e) { warn('Interceptor.replace failed at ' + target + ' (' + e + ') — falling back to attach'); try { Interceptor.attach(target, { onEnter: function(args) { this.preverifyOk = args[0].toInt32(); }, onLeave: function(retval) { retval.replace(onVerify(this.preverifyOk)); } }); state.mode = 'attach'; } catch (e2) { warn('Interceptor.attach also failed at ' + target + ': ' + e2); return false; } } state.hookInstalled = true; log('HOOKED CertificateCallback at +' + hexOf(off) + ' (' + target + ', ' + state.mode + ')'); log('dart:io / Flutter TLS verification is now disabled'); installJavaBypass(); return true; } function bootstrap() { var mod = Process.findModuleByName(CFG.moduleName); if (mod === null) { if (Date.now() - state.started > CFG.maxWaitMs) { warn(CFG.moduleName + ' never loaded — is this a Flutter app?'); state.started = Date.now(); } setTimeout(bootstrap, CFG.pollMs); return; } log('libflutter.so found @ ' + mod.base + ' (' + mod.size + ' bytes, ' + Process.arch + ')'); setTimeout(function() { if (!install(mod)) setTimeout(bootstrap, CFG.pollMs); }, CFG.startDelayMs); } setTimeout(bootstrap, CFG.startDelayMs);

Project: bypass-flutter-tls-verification