API tools faq
paste
Advertisement
Guest User

SSL Pinning for Frida Tools

a guest
Nov 19th, 2024
363
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
JavaScript 39.44 KB | Cybersecurity | 0 0
raw download clone embed print report
  1. /*  Android ssl certificate pinning bypass script for various methods
  2.     by Maurizio Siddu
  3.    
  4.     Run with:
  5.     frida -U -f <APP_ID> -l frida_multiple_unpinning.js [--no-pause]
  6.  
  7.     YouTube VIDEO TUTORIAL / ВИДЕО-РУКОВОДСТВО НА YouTube: https://youtu.be/HCKXLWbrF8k
  8. */
  9.  
  10. setTimeout(function() {
  11.     Java.perform(function() {
  12.         console.log('');
  13.         console.log('======');
  14.         console.log('[#] Android Bypass for various Certificate Pinning methods [#]');
  15.         console.log('======');
  16.        
  17.         var errDict = {};
  18.  
  19.         // TrustManager (Android < 7) //
  20.         ////////////////////////////////
  21.         var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
  22.         var SSLContext = Java.use('javax.net.ssl.SSLContext');
  23.         var TrustManager = Java.registerClass({
  24.             // Implement a custom TrustManager
  25.             name: 'dev.asd.test.TrustManager',
  26.             implements: [X509TrustManager],
  27.             methods: {
  28.                 checkClientTrusted: function(chain, authType) {},
  29.                 checkServerTrusted: function(chain, authType) {},
  30.                 getAcceptedIssuers: function() {return []; }
  31.             }
  32.         });
  33.         // Prepare the TrustManager array to pass to SSLContext.init()
  34.         var TrustManagers = [TrustManager.$new()];
  35.         // Get a handle on the init() on the SSLContext class
  36.         var SSLContext_init = SSLContext.init.overload(
  37.             '[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom');
  38.         try {
  39.             // Override the init method, specifying the custom TrustManager
  40.             SSLContext_init.implementation = function(keyManager, trustManager, secureRandom) {
  41.                 console.log('[+] Bypassing Trustmanager (Android < 7) pinner');
  42.                 SSLContext_init.call(this, keyManager, TrustManagers, secureRandom);
  43.             };
  44.         } catch (err) {
  45.             console.log('[-] TrustManager (Android < 7) pinner not found');
  46.             //console.log(err);
  47.         }
  48.  
  49.  
  50.  
  51.    
  52.         // OkHTTPv3 (quadruple bypass) //
  53.         /////////////////////////////////
  54.         try {
  55.             // Bypass OkHTTPv3 {1}
  56.             var okhttp3_Activity_1 = Java.use('okhttp3.CertificatePinner');
  57.             okhttp3_Activity_1.check.overload('java.lang.String', 'java.util.List').implementation = function(a, b) {
  58.                 console.log('[+] Bypassing OkHTTPv3 {1}: ' + a);
  59.                 return;
  60.             };
  61.         } catch (err) {
  62.             console.log('[-] OkHTTPv3 {1} pinner not found');
  63.             //console.log(err);
  64.             errDict[err] = ['okhttp3.CertificatePinner', 'check'];
  65.         }
  66.         try {
  67.             // Bypass OkHTTPv3 {2}
  68.             // This method of CertificatePinner.check is deprecated but could be found in some old Android apps
  69.             var okhttp3_Activity_2 = Java.use('okhttp3.CertificatePinner');
  70.             okhttp3_Activity_2.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function(a, b) {
  71.                 console.log('[+] Bypassing OkHTTPv3 {2}: ' + a);
  72.                 return;
  73.             };
  74.         } catch (err) {
  75.             console.log('[-] OkHTTPv3 {2} pinner not found');
  76.             //console.log(err);
  77.             //errDict[err] = ['okhttp3.CertificatePinner', 'check'];
  78.         }
  79.         try {
  80.             // Bypass OkHTTPv3 {3}
  81.             var okhttp3_Activity_3 = Java.use('okhttp3.CertificatePinner');
  82.             okhttp3_Activity_3.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function(a, b) {
  83.                 console.log('[+] Bypassing OkHTTPv3 {3}: ' + a);
  84.                 return;
  85.             };
  86.         } catch(err) {
  87.             console.log('[-] OkHTTPv3 {3} pinner not found');
  88.             //console.log(err);
  89.             errDict[err] = ['okhttp3.CertificatePinner', 'check'];
  90.         }
  91.         try {
  92.             // Bypass OkHTTPv3 {4}
  93.             var okhttp3_Activity_4 = Java.use('okhttp3.CertificatePinner');
  94.             //okhttp3_Activity_4['check$okhttp'].implementation = function(a, b) {
  95.             okhttp3_Activity_4.check$okhttp.overload('java.lang.String', 'kotlin.jvm.functions.Function0').implementation = function(a, b) {       
  96.                 console.log('[+] Bypassing OkHTTPv3 {4}: ' + a);
  97.                 return;
  98.             };
  99.         } catch(err) {
  100.             console.log('[-] OkHTTPv3 {4} pinner not found');
  101.             //console.log(err);
  102.             errDict[err] = ['okhttp3.CertificatePinner', 'check$okhttp'];
  103.         }
  104.    
  105.  
  106.    
  107.         // Trustkit (triple bypass) //
  108.         //////////////////////////////
  109.         try {
  110.             // Bypass Trustkit {1}
  111.             var trustkit_Activity_1 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier');
  112.             trustkit_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) {
  113.                 console.log('[+] Bypassing Trustkit {1}: ' + a);
  114.                 return true;
  115.             };
  116.         } catch (err) {
  117.             console.log('[-] Trustkit {1} pinner not found');
  118.             //console.log(err);
  119.             errDict[err] = ['com.datatheorem.android.trustkit.pinning.OkHostnameVerifier', 'verify'];
  120.         }
  121.         try {
  122.             // Bypass Trustkit {2}
  123.             var trustkit_Activity_2 = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier');
  124.             trustkit_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) {
  125.                 console.log('[+] Bypassing Trustkit {2}: ' + a);
  126.                 return true;
  127.             };
  128.         } catch (err) {
  129.             console.log('[-] Trustkit {2} pinner not found');
  130.             //console.log(err);
  131.             errDict[err] = ['com.datatheorem.android.trustkit.pinning.OkHostnameVerifier', 'verify'];
  132.         }
  133.         try {
  134.             // Bypass Trustkit {3}
  135.             var trustkit_PinningTrustManager = Java.use('com.datatheorem.android.trustkit.pinning.PinningTrustManager');
  136.             trustkit_PinningTrustManager.checkServerTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String').implementation = function(chain, authType) {
  137.                 console.log('[+] Bypassing Trustkit {3}');
  138.             };
  139.         } catch (err) {
  140.             console.log('[-] Trustkit {3} pinner not found');
  141.             //console.log(err);
  142.             errDict[err] = ['com.datatheorem.android.trustkit.pinning.PinningTrustManager', 'checkServerTrusted'];
  143.         }
  144.        
  145.    
  146.    
  147.  
  148.         // TrustManagerImpl (Android > 7) //
  149.         ////////////////////////////////////
  150.         try {
  151.             // Bypass TrustManagerImpl (Android > 7) {1}
  152.             var array_list = Java.use("java.util.ArrayList");
  153.             var TrustManagerImpl_Activity_1 = Java.use('com.android.org.conscrypt.TrustManagerImpl');
  154.             TrustManagerImpl_Activity_1.checkTrustedRecursive.implementation = function(certs, ocspData, tlsSctData, host, clientAuth, untrustedChain, trustAnchorChain, used) {
  155.                 console.log('[+] Bypassing TrustManagerImpl (Android > 7) checkTrustedRecursive check for: '+ host);
  156.                 return array_list.$new();
  157.             };
  158.         } catch (err) {
  159.             console.log('[-] TrustManagerImpl (Android > 7) checkTrustedRecursive check not found');
  160.             //console.log(err);
  161.             errDict[err] = ['com.android.org.conscrypt.TrustManagerImpl', 'checkTrustedRecursive'];
  162.         }  
  163.         try {
  164.             // Bypass TrustManagerImpl (Android > 7) {2} (probably no more necessary)
  165.             var TrustManagerImpl_Activity_2 = Java.use('com.android.org.conscrypt.TrustManagerImpl');
  166.             TrustManagerImpl_Activity_2.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) {
  167.                 console.log('[+] Bypassing TrustManagerImpl (Android > 7) verifyChain check for: ' + host);
  168.                 return untrustedChain;
  169.             };  
  170.         } catch (err) {
  171.             console.log('[-] TrustManagerImpl (Android > 7) verifyChain check not found');
  172.             //console.log(err);
  173.             errDict[err] = ['com.android.org.conscrypt.TrustManagerImpl', 'verifyChain'];  
  174.         }
  175.  
  176.  
  177.  
  178.        
  179.  
  180.         // Appcelerator Titanium PinningTrustManager //
  181.         ///////////////////////////////////////////////
  182.         try {
  183.             var appcelerator_PinningTrustManager = Java.use('appcelerator.https.PinningTrustManager');
  184.             appcelerator_PinningTrustManager.checkServerTrusted.implementation = function(chain, authType) {
  185.                 console.log('[+] Bypassing Appcelerator PinningTrustManager');
  186.                 return;
  187.             };
  188.         } catch (err) {
  189.             console.log('[-] Appcelerator PinningTrustManager pinner not found');
  190.             //console.log(err);
  191.             errDict[err] = ['appcelerator.https.PinningTrustManager', 'checkServerTrusted'];  
  192.         }
  193.  
  194.  
  195.  
  196.  
  197.         // Fabric PinningTrustManager //
  198.         ////////////////////////////////
  199.         try {
  200.             var fabric_PinningTrustManager = Java.use('io.fabric.sdk.android.services.network.PinningTrustManager');
  201.             fabric_PinningTrustManager.checkServerTrusted.implementation = function(chain, authType) {
  202.                 console.log('[+] Bypassing Fabric PinningTrustManager');
  203.                 return;
  204.             };
  205.         } catch (err) {
  206.             console.log('[-] Fabric PinningTrustManager pinner not found');
  207.             //console.log(err);
  208.             errDict[err] = ['io.fabric.sdk.android.services.network.PinningTrustManager', 'checkServerTrusted'];  
  209.         }
  210.  
  211.  
  212.  
  213.  
  214.         // OpenSSLSocketImpl Conscrypt (double bypass) //
  215.         /////////////////////////////////////////////////
  216.         try {
  217.             var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl');
  218.             OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certRefs, JavaObject, authMethod) {
  219.                 console.log('[+] Bypassing OpenSSLSocketImpl Conscrypt {1}');
  220.             };
  221.         } catch (err) {
  222.             console.log('[-] OpenSSLSocketImpl Conscrypt {1} pinner not found');
  223.             //console.log(err);
  224.             errDict[err] = ['com.android.org.conscrypt.OpenSSLSocketImpl', 'verifyCertificateChain'];
  225.         }
  226.         try {
  227.             var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl');
  228.             OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certChain, authMethod) {
  229.                 console.log('[+] Bypassing OpenSSLSocketImpl Conscrypt {2}');
  230.             };
  231.         } catch (err) {
  232.             console.log('[-] OpenSSLSocketImpl Conscrypt {2} pinner not found');
  233.             //console.log(err);
  234.             errDict[err] = ['com.android.org.conscrypt.OpenSSLSocketImpl', 'verifyCertificateChain'];  
  235.         }
  236.  
  237.  
  238.  
  239.  
  240.         // OpenSSLEngineSocketImpl Conscrypt //
  241.         ///////////////////////////////////////
  242.         try {
  243.             var OpenSSLEngineSocketImpl_Activity = Java.use('com.android.org.conscrypt.OpenSSLEngineSocketImpl');
  244.             OpenSSLEngineSocketImpl_Activity.verifyCertificateChain.overload('[Ljava.lang.Long;', 'java.lang.String').implementation = function(a, b) {
  245.                 console.log('[+] Bypassing OpenSSLEngineSocketImpl Conscrypt: ' + b);
  246.             };
  247.         } catch (err) {
  248.             console.log('[-] OpenSSLEngineSocketImpl Conscrypt pinner not found');
  249.             //console.log(err);
  250.             errDict[err] = ['com.android.org.conscrypt.OpenSSLEngineSocketImpl', 'verifyCertificateChain'];
  251.         }
  252.  
  253.  
  254.  
  255.  
  256.         // OpenSSLSocketImpl Apache Harmony //
  257.         //////////////////////////////////////
  258.         try {
  259.             var OpenSSLSocketImpl_Harmony = Java.use('org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl');
  260.             OpenSSLSocketImpl_Harmony.verifyCertificateChain.implementation = function(asn1DerEncodedCertificateChain, authMethod) {
  261.                 console.log('[+] Bypassing OpenSSLSocketImpl Apache Harmony');
  262.             };
  263.         } catch (err) {
  264.             console.log('[-] OpenSSLSocketImpl Apache Harmony pinner not found');
  265.             //console.log(err);
  266.             errDict[err] = ['org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl', 'verifyCertificateChain'];  
  267.         }
  268.  
  269.  
  270.  
  271.  
  272.         // PhoneGap sslCertificateChecker //
  273.         ////////////////////////////////////
  274.         try {
  275.             var phonegap_Activity = Java.use('nl.xservices.plugins.sslCertificateChecker');
  276.             phonegap_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(a, b, c) {
  277.                 console.log('[+] Bypassing PhoneGap sslCertificateChecker: ' + a);
  278.                 return true;
  279.             };
  280.         } catch (err) {
  281.             console.log('[-] PhoneGap sslCertificateChecker pinner not found');
  282.             //console.log(err);
  283.             errDict[err] = ['nl.xservices.plugins.sslCertificateChecker', 'execute'];
  284.         }
  285.  
  286.  
  287.  
  288.  
  289.         // IBM MobileFirst pinTrustedCertificatePublicKey (double bypass) //
  290.         ////////////////////////////////////////////////////////////////////
  291.         try {
  292.             // Bypass IBM MobileFirst {1}
  293.             var WLClient_Activity_1 = Java.use('com.worklight.wlclient.api.WLClient');
  294.             WLClient_Activity_1.getInstance().pinTrustedCertificatePublicKey.overload('java.lang.String').implementation = function(cert) {
  295.                 console.log('[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {1}: ' + cert);
  296.                 return;
  297.             };
  298.             } catch (err) {
  299.             console.log('[-] IBM MobileFirst pinTrustedCertificatePublicKey {1} pinner not found');
  300.             //console.log(err);
  301.             errDict[err] = ['com.worklight.wlclient.api.WLClient', 'pinTrustedCertificatePublicKey'];
  302.         }
  303.         try {
  304.             // Bypass IBM MobileFirst {2}
  305.             var WLClient_Activity_2 = Java.use('com.worklight.wlclient.api.WLClient');
  306.             WLClient_Activity_2.getInstance().pinTrustedCertificatePublicKey.overload('[Ljava.lang.String;').implementation = function(cert) {
  307.                 console.log('[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {2}: ' + cert);
  308.                 return;
  309.             };
  310.         } catch (err) {
  311.             console.log('[-] IBM MobileFirst pinTrustedCertificatePublicKey {2} pinner not found');
  312.             //console.log(err);
  313.             errDict[err] = ['com.worklight.wlclient.api.WLClient', 'pinTrustedCertificatePublicKey'];
  314.         }
  315.  
  316.  
  317.  
  318.  
  319.         // IBM WorkLight (ancestor of MobileFirst) HostNameVerifierWithCertificatePinning (quadruple bypass) //
  320.         ///////////////////////////////////////////////////////////////////////////////////////////////////////
  321.         try {
  322.             // Bypass IBM WorkLight {1}
  323.             var worklight_Activity_1 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning');
  324.             worklight_Activity_1.verify.overload('java.lang.String', 'javax.net.ssl.SSLSocket').implementation = function(a, b) {
  325.                 console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {1}: ' + a);
  326.                 return;
  327.             };
  328.         } catch (err) {
  329.             console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {1} pinner not found');
  330.             //console.log(err);
  331.             errDict[err] = ['com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning', 'verify'];
  332.         }
  333.         try {
  334.             // Bypass IBM WorkLight {2}
  335.             var worklight_Activity_2 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning');
  336.             worklight_Activity_2.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) {
  337.                 console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {2}: ' + a);
  338.                 return;
  339.             };
  340.         } catch (err) {
  341.             console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {2} pinner not found');
  342.             //console.log(err);
  343.             errDict[err] = ['com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning', 'verify'];
  344.         }
  345.         try {
  346.             // Bypass IBM WorkLight {3}
  347.             var worklight_Activity_3 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning');
  348.             worklight_Activity_3.verify.overload('java.lang.String', '[Ljava.lang.String;', '[Ljava.lang.String;').implementation = function(a, b) {
  349.                 console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {3}: ' + a);
  350.                 return;
  351.             };
  352.         } catch (err) {
  353.             console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {3} pinner not found');
  354.             //console.log(err);
  355.             errDict[err] = ['com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning', 'verify'];
  356.         }
  357.         try {
  358.             // Bypass IBM WorkLight {4}
  359.             var worklight_Activity_4 = Java.use('com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning');
  360.             worklight_Activity_4.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) {
  361.                 console.log('[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {4}: ' + a);
  362.                 return true;
  363.             };
  364.         } catch (err) {
  365.             console.log('[-] IBM WorkLight HostNameVerifierWithCertificatePinning {4} pinner not found');
  366.             //console.log(err);
  367.             errDict[err] = ['com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning', 'verify'];
  368.         }
  369.  
  370.  
  371.  
  372.  
  373.         // Conscrypt CertPinManager //
  374.         //////////////////////////////
  375.         try {
  376.             var conscrypt_CertPinManager_Activity = Java.use('com.android.org.conscrypt.CertPinManager');
  377.             conscrypt_CertPinManager_Activity.checkChainPinning.overload('java.lang.String', 'java.util.List').implementation = function(a, b) {
  378.                 console.log('[+] Bypassing Conscrypt CertPinManager: ' + a);
  379.                 return;
  380.             };
  381.         } catch (err) {
  382.             console.log('[-] Conscrypt CertPinManager pinner not found');
  383.             //console.log(err);
  384.             errDict[err] = ['com.android.org.conscrypt.CertPinManager', 'checkChainPinning'];
  385.         }
  386.        
  387.        
  388.  
  389.  
  390.         // Conscrypt CertPinManager (Legacy) //
  391.         ///////////////////////////////////////
  392.         try {
  393.             var legacy_conscrypt_CertPinManager_Activity = Java.use('com.android.org.conscrypt.CertPinManager');
  394.             legacy_conscrypt_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(a, b) {
  395.                 console.log('[+] Bypassing Conscrypt CertPinManager (Legacy): ' + a);
  396.                 return true;
  397.             };
  398.         } catch (err) {
  399.             console.log('[-] Conscrypt CertPinManager (Legacy) pinner not found');
  400.             //console.log(err);
  401.             errDict[err] = ['com.android.org.conscrypt.CertPinManager', 'isChainValid'];
  402.         }
  403.            
  404.                
  405.  
  406.  
  407.         // CWAC-Netsecurity (unofficial back-port pinner for Android<4.2) CertPinManager //
  408.         ///////////////////////////////////////////////////////////////////////////////////
  409.         try {
  410.             var cwac_CertPinManager_Activity = Java.use('com.commonsware.cwac.netsecurity.conscrypt.CertPinManager');
  411.             cwac_CertPinManager_Activity.isChainValid.overload('java.lang.String', 'java.util.List').implementation = function(a, b) {
  412.                 console.log('[+] Bypassing CWAC-Netsecurity CertPinManager: ' + a);
  413.                 return true;
  414.             };
  415.         } catch (err) {
  416.             console.log('[-] CWAC-Netsecurity CertPinManager pinner not found');
  417.             //console.log(err);
  418.             errDict[err] = ['com.commonsware.cwac.netsecurity.conscrypt.CertPinManager', 'isChainValid'];
  419.         }
  420.  
  421.  
  422.  
  423.  
  424.         // Worklight Androidgap WLCertificatePinningPlugin //
  425.         /////////////////////////////////////////////////////
  426.         try {
  427.             var androidgap_WLCertificatePinningPlugin_Activity = Java.use('com.worklight.androidgap.plugin.WLCertificatePinningPlugin');
  428.             androidgap_WLCertificatePinningPlugin_Activity.execute.overload('java.lang.String', 'org.json.JSONArray', 'org.apache.cordova.CallbackContext').implementation = function(a, b, c) {
  429.                 console.log('[+] Bypassing Worklight Androidgap WLCertificatePinningPlugin: ' + a);
  430.                 return true;
  431.             };
  432.         } catch (err) {
  433.             console.log('[-] Worklight Androidgap WLCertificatePinningPlugin pinner not found');
  434.             //console.log(err);
  435.             errDict[err] = ['com.worklight.androidgap.plugin.WLCertificatePinningPlugin', 'execute'];
  436.         }
  437.  
  438.  
  439.  
  440.  
  441.         // Netty FingerprintTrustManagerFactory //
  442.         //////////////////////////////////////////
  443.         try {
  444.             var netty_FingerprintTrustManagerFactory = Java.use('io.netty.handler.ssl.util.FingerprintTrustManagerFactory');
  445.             //NOTE: sometimes this below implementation could be useful
  446.             //var netty_FingerprintTrustManagerFactory = Java.use('org.jboss.netty.handler.ssl.util.FingerprintTrustManagerFactory');
  447.             netty_FingerprintTrustManagerFactory.checkTrusted.implementation = function(type, chain) {
  448.                 console.log('[+] Bypassing Netty FingerprintTrustManagerFactory');
  449.             };
  450.         } catch (err) {
  451.             console.log('[-] Netty FingerprintTrustManagerFactory pinner not found');
  452.             //console.log(err);
  453.             errDict[err] = ['io.netty.handler.ssl.util.FingerprintTrustManagerFactory', 'checkTrusted'];
  454.         }
  455.  
  456.  
  457.  
  458.  
  459.         // Squareup CertificatePinner [OkHTTP<v3] (double bypass) //
  460.         ////////////////////////////////////////////////////////////
  461.         try {
  462.             // Bypass Squareup CertificatePinner  {1}
  463.             var Squareup_CertificatePinner_Activity_1 = Java.use('com.squareup.okhttp.CertificatePinner');
  464.             Squareup_CertificatePinner_Activity_1.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function(a, b) {
  465.                 console.log('[+] Bypassing Squareup CertificatePinner {1}: ' + a);
  466.                 return;
  467.             };
  468.         } catch (err) {
  469.             console.log('[-] Squareup CertificatePinner {1} pinner not found');
  470.             //console.log(err);
  471.             errDict[err] = ['com.squareup.okhttp.CertificatePinner', 'check'];
  472.         }
  473.         try {
  474.             // Bypass Squareup CertificatePinner {2}
  475.             var Squareup_CertificatePinner_Activity_2 = Java.use('com.squareup.okhttp.CertificatePinner');
  476.             Squareup_CertificatePinner_Activity_2.check.overload('java.lang.String', 'java.util.List').implementation = function(a, b) {
  477.                 console.log('[+] Bypassing Squareup CertificatePinner {2}: ' + a);
  478.                 return;
  479.             };
  480.         } catch (err) {
  481.             console.log('[-] Squareup CertificatePinner {2} pinner not found');
  482.             //console.log(err);
  483.             errDict[err] = ['com.squareup.okhttp.CertificatePinner', 'check'];
  484.         }
  485.  
  486.  
  487.  
  488.  
  489.         // Squareup OkHostnameVerifier [OkHTTP v3] (double bypass) //
  490.         /////////////////////////////////////////////////////////////
  491.         try {
  492.             // Bypass Squareup OkHostnameVerifier {1}
  493.             var Squareup_OkHostnameVerifier_Activity_1 = Java.use('com.squareup.okhttp.internal.tls.OkHostnameVerifier');
  494.             Squareup_OkHostnameVerifier_Activity_1.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) {
  495.                 console.log('[+] Bypassing Squareup OkHostnameVerifier {1}: ' + a);
  496.                 return true;
  497.             };
  498.         } catch (err) {
  499.             console.log('[-] Squareup OkHostnameVerifier check not found');
  500.             //console.log(err);
  501.             errDict[err] = ['com.squareup.okhttp.internal.tls.OkHostnameVerifier', 'verify'];
  502.         }
  503.         try {
  504.             // Bypass Squareup OkHostnameVerifier {2}
  505.             var Squareup_OkHostnameVerifier_Activity_2 = Java.use('com.squareup.okhttp.internal.tls.OkHostnameVerifier');
  506.             Squareup_OkHostnameVerifier_Activity_2.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) {
  507.                 console.log('[+] Bypassing Squareup OkHostnameVerifier {2}: ' + a);
  508.                 return true;
  509.             };
  510.         } catch (err) {
  511.             console.log('[-] Squareup OkHostnameVerifier check not found');
  512.             //console.log(err);
  513.             errDict[err] = ['com.squareup.okhttp.internal.tls.OkHostnameVerifier', 'verify'];
  514.         }
  515.  
  516.  
  517.        
  518.  
  519.         // Android WebViewClient (quadruple bypass) //
  520.         //////////////////////////////////////////////
  521.         try {
  522.             // Bypass WebViewClient {1} (deprecated from Android 6)
  523.             var AndroidWebViewClient_Activity_1 = Java.use('android.webkit.WebViewClient');
  524.             AndroidWebViewClient_Activity_1.onReceivedSslError.overload('android.webkit.WebView', 'android.webkit.SslErrorHandler', 'android.net.http.SslError').implementation = function(obj1, obj2, obj3) {
  525.                 console.log('[+] Bypassing Android WebViewClient check {1}');
  526.             };
  527.         } catch (err) {
  528.             console.log('[-] Android WebViewClient {1} check not found');
  529.             //console.log(err)
  530.             errDict[err] = ['android.webkit.WebViewClient', 'onReceivedSslError'];
  531.         }
  532.         // Not working properly temporarily disused
  533.         //try {
  534.         //  // Bypass WebViewClient {2}
  535.         //  var AndroidWebViewClient_Activity_2 = Java.use('android.webkit.WebViewClient');
  536.         //  AndroidWebViewClient_Activity_2.onReceivedHttpError.overload('android.webkit.WebView', 'android.webkit.WebResourceRequest', 'android.webkit.WebResourceResponse').implementation = function(obj1, obj2, obj3) {
  537.         //      console.log('[+] Bypassing Android WebViewClient check {2}');
  538.         //  };
  539.         //} catch (err) {
  540.         //  console.log('[-] Android WebViewClient {2} check not found');
  541.         //  //console.log(err)
  542.         //  errDict[err] = ['android.webkit.WebViewClient', 'onReceivedHttpError'];
  543.         //}
  544.         try {
  545.             // Bypass WebViewClient {3}
  546.             var AndroidWebViewClient_Activity_3 = Java.use('android.webkit.WebViewClient');
  547.             //AndroidWebViewClient_Activity_3.onReceivedError.overload('android.webkit.WebView', 'int', 'java.lang.String', 'java.lang.String').implementation = function(obj1, obj2, obj3, obj4) {
  548.             AndroidWebViewClient_Activity_3.onReceivedError.implementation = function(view, errCode, description, failingUrl) {
  549.                 console.log('[+] Bypassing Android WebViewClient check {3}');
  550.             };
  551.         } catch (err) {
  552.             console.log('[-] Android WebViewClient {3} check not found');
  553.             //console.log(err)
  554.             errDict[err] = ['android.webkit.WebViewClient', 'onReceivedError'];
  555.         }
  556.         try {
  557.             // Bypass WebViewClient {4}
  558.             var AndroidWebViewClient_Activity_4 = Java.use('android.webkit.WebViewClient');
  559.             AndroidWebViewClient_Activity_4.onReceivedError.overload('android.webkit.WebView', 'android.webkit.WebResourceRequest', 'android.webkit.WebResourceError').implementation = function(obj1, obj2, obj3) {
  560.                 console.log('[+] Bypassing Android WebViewClient check {4}');
  561.             };
  562.         } catch (err) {
  563.             console.log('[-] Android WebViewClient {4} check not found');
  564.             //console.log(err)
  565.             errDict[err] = ['android.webkit.WebViewClient', 'onReceivedError'];
  566.         }
  567.        
  568.  
  569.  
  570.  
  571.         // Apache Cordova WebViewClient //
  572.         //////////////////////////////////
  573.         try {
  574.             var CordovaWebViewClient_Activity = Java.use('org.apache.cordova.CordovaWebViewClient');
  575.             CordovaWebViewClient_Activity.onReceivedSslError.overload('android.webkit.WebView', 'android.webkit.SslErrorHandler', 'android.net.http.SslError').implementation = function(obj1, obj2, obj3) {
  576.                 console.log('[+] Bypassing Apache Cordova WebViewClient check');
  577.                 obj3.proceed();
  578.             };
  579.         } catch (err) {
  580.             console.log('[-] Apache Cordova WebViewClient check not found');
  581.             //console.log(err);
  582.         }
  583.  
  584.  
  585.  
  586.  
  587.         // Boye AbstractVerifier //
  588.         ///////////////////////////
  589.         try {
  590.             var boye_AbstractVerifier = Java.use('ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier');
  591.             boye_AbstractVerifier.verify.implementation = function(host, ssl) {
  592.                 console.log('[+] Bypassing Boye AbstractVerifier check for: ' + host);
  593.             };
  594.         } catch (err) {
  595.             console.log('[-] Boye AbstractVerifier check not found');
  596.             //console.log(err);
  597.             errDict[err] = ['ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier', 'verify'];
  598.         }
  599.  
  600.  
  601.  
  602.         // Apache AbstractVerifier (quadruple bypass) //
  603.         ////////////////////////////////////////////////
  604.         try {
  605.             var apache_AbstractVerifier_1 = Java.use('org.apache.http.conn.ssl.AbstractVerifier');
  606.             apache_AbstractVerifier_1.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(a, b) {
  607.                 console.log('[+] Bypassing Apache AbstractVerifier {1} check for: ' + a);
  608.                 return;
  609.             };
  610.         } catch (err) {
  611.             console.log('[-] Apache AbstractVerifier {1} check not found');
  612.             //console.log(err);
  613.             errDict[err] = ['org.apache.http.conn.ssl.AbstractVerifier', 'verify'];
  614.         }
  615.                 try {
  616.             var apache_AbstractVerifier_2 = Java.use('org.apache.http.conn.ssl.AbstractVerifier');
  617.             apache_AbstractVerifier_2.verify.overload('java.lang.String', 'javax.net.ssl.SSLSocket').implementation = function(a, b) {
  618.                 console.log('[+] Bypassing Apache AbstractVerifier {2} check for: ' + a);
  619.                 return;
  620.             };
  621.         } catch (err) {
  622.             console.log('[-] Apache AbstractVerifier {2} check not found');
  623.             //console.log(err);
  624.             errDict[err] = ['org.apache.http.conn.ssl.AbstractVerifier', 'verify'];
  625.         }
  626.                 try {
  627.             var apache_AbstractVerifier_3 = Java.use('org.apache.http.conn.ssl.AbstractVerifier');
  628.             apache_AbstractVerifier_3.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(a, b) {
  629.                 console.log('[+] Bypassing Apache AbstractVerifier {3} check for: ' + a);
  630.                 return;
  631.             };
  632.         } catch (err) {
  633.             console.log('[-] Apache AbstractVerifier {3} check not found');
  634.             //console.log(err);
  635.             errDict[err] = ['org.apache.http.conn.ssl.AbstractVerifier', 'verify'];
  636.         }
  637.                 try {
  638.             var apache_AbstractVerifier_4 = Java.use('org.apache.http.conn.ssl.AbstractVerifier');
  639.             apache_AbstractVerifier_4.verify.overload('java.lang.String', '[Ljava.lang.String;', '[Ljava.lang.String;', 'boolean').implementation = function(a, b, c, d) {
  640.                 console.log('[+] Bypassing Apache AbstractVerifier {4} check for: ' + a);
  641.                 return;
  642.             };
  643.         } catch (err) {
  644.             console.log('[-] Apache AbstractVerifier {4} check not found');
  645.             //console.log(err);
  646.             errDict[err] = ['org.apache.http.conn.ssl.AbstractVerifier', 'verify'];
  647.         }
  648.  
  649.  
  650.  
  651.  
  652.         // Chromium Cronet //
  653.         /////////////////////
  654.         try {
  655.             var CronetEngineBuilderImpl_Activity = Java.use("org.chromium.net.impl.CronetEngineBuilderImpl");
  656.             // Setting argument to TRUE (default is TRUE) to disable Public Key pinning for local trust anchors
  657.             CronetEngine_Activity.enablePublicKeyPinningBypassForLocalTrustAnchors.overload('boolean').implementation = function(a) {
  658.                 console.log("[+] Disabling Public Key pinning for local trust anchors in Chromium Cronet");
  659.                 var cronet_obj_1 = CronetEngine_Activity.enablePublicKeyPinningBypassForLocalTrustAnchors.call(this, true);
  660.                 return cronet_obj_1;
  661.             };
  662.             // Bypassing Chromium Cronet pinner
  663.             CronetEngine_Activity.addPublicKeyPins.overload('java.lang.String', 'java.util.Set', 'boolean', 'java.util.Date').implementation = function(hostName, pinsSha256, includeSubdomains, expirationDate) {
  664.                 console.log("[+] Bypassing Chromium Cronet pinner: " + hostName);
  665.                 var cronet_obj_2 = CronetEngine_Activity.addPublicKeyPins.call(this, hostName, pinsSha256, includeSubdomains, expirationDate);
  666.                 return cronet_obj_2;
  667.             };
  668.         } catch (err) {
  669.             console.log('[-] Chromium Cronet pinner not found')
  670.             //console.log(err);
  671.         }
  672.  
  673.  
  674.  
  675.  
  676.         // Flutter Pinning packages http_certificate_pinning and ssl_pinning_plugin (double bypass) //
  677.         //////////////////////////////////////////////////////////////////////////////////////////////
  678.         try {
  679.             // Bypass HttpCertificatePinning.check {1}
  680.             var HttpCertificatePinning_Activity = Java.use('diefferson.http_certificate_pinning.HttpCertificatePinning');
  681.             HttpCertificatePinning_Activity.checkConnexion.overload("java.lang.String", "java.util.List", "java.util.Map", "int", "java.lang.String").implementation = function (a, b, c ,d, e) {
  682.                 console.log('[+] Bypassing Flutter HttpCertificatePinning : ' + a);
  683.                 return true;
  684.             };
  685.         } catch (err) {
  686.             console.log('[-] Flutter HttpCertificatePinning pinner not found');
  687.             //console.log(err);
  688.             errDict[err] = ['diefferson.http_certificate_pinning.HttpCertificatePinning', 'checkConnexion'];
  689.         }
  690.         try {
  691.             // Bypass SslPinningPlugin.check {2}
  692.             var SslPinningPlugin_Activity = Java.use('com.macif.plugin.sslpinningplugin.SslPinningPlugin');
  693.             SslPinningPlugin_Activity.checkConnexion.overload("java.lang.String", "java.util.List", "java.util.Map", "int", "java.lang.String").implementation = function (a, b, c ,d, e) {
  694.                 console.log('[+] Bypassing Flutter SslPinningPlugin: ' + a);
  695.                 return true;
  696.             };
  697.         } catch (err) {
  698.             console.log('[-] Flutter SslPinningPlugin pinner not found');
  699.             //console.log(err);
  700.             errDict[err] = ['com.macif.plugin.sslpinningplugin.SslPinningPlugin', 'checkConnexion'];
  701.         }
  702.        
  703.        
  704.        
  705.        
  706.         // Unusual/obfuscated pinners bypass //
  707.         ///////////////////////////////////////
  708.         try {
  709.             // Iterating all caught pinner errors and try to overload them
  710.             for (var key in errDict) {
  711.                 var errStr = key;
  712.                 var targetClass = errDict[key][0]
  713.                 var targetFunc = errDict[key][1]
  714.                 var retType = Java.use(targetClass)[targetFunc].returnType.type;
  715.                 //console.log("errDict content: "+errStr+" "+targetClass+"."+targetFunc);
  716.                 if (String(errStr).includes('.overload')) {
  717.                     overloader(errStr, targetClass, targetFunc,retType);
  718.                 }
  719.             }
  720.         } catch (err) {
  721.             //console.log('[-] The pinner "'+targetClass+'.'+targetFunc+'" is not unusual/obfuscated, skipping it..');
  722.             //console.log(err);
  723.         }
  724.  
  725.  
  726.  
  727.        
  728.         // Dynamic SSLPeerUnverifiedException Bypasser                               //
  729.         // An useful technique to bypass SSLPeerUnverifiedException failures raising //
  730.         // when the Android app uses some uncommon SSL Pinning methods or an heavily //
  731.         // code obfuscation. Inspired by an idea of: https://github.com/httptoolkit  //
  732.         ///////////////////////////////////////////////////////////////////////////////
  733.         try {
  734.             var UnverifiedCertError = Java.use('javax.net.ssl.SSLPeerUnverifiedException');
  735.             UnverifiedCertError.$init.implementation = function (reason) {
  736.                 try {
  737.                     var stackTrace = Java.use('java.lang.Thread').currentThread().getStackTrace();
  738.                     var exceptionStackIndex = stackTrace.findIndex(stack =>
  739.                         stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException"
  740.                     );
  741.                     // Retrieve the method raising the SSLPeerUnverifiedException
  742.                     var callingFunctionStack = stackTrace[exceptionStackIndex + 1];
  743.                     var className = callingFunctionStack.getClassName();
  744.                     var methodName = callingFunctionStack.getMethodName();
  745.                     var callingClass = Java.use(className);
  746.                     var callingMethod = callingClass[methodName];
  747.                     console.log('\x1b[36m[!] Unexpected SSLPeerUnverifiedException occurred related to the method "'+className+'.'+methodName+'"\x1b[0m');
  748.                     //console.log("Stacktrace details:\n"+stackTrace);
  749.                     // Checking if the SSLPeerUnverifiedException was generated by an usually negligible (not blocking) method
  750.                     if (className == 'com.android.org.conscrypt.ActiveSession' || className == 'com.google.android.gms.org.conscrypt.ActiveSession') {
  751.                         throw 'Reason: skipped SSLPeerUnverifiedException bypass since the exception was raised from a (usually) non blocking method on the Android app';
  752.                     }
  753.                     else {
  754.                         console.log('\x1b[34m[!] Starting to dynamically circumvent the SSLPeerUnverifiedException for the method "'+className+'.'+methodName+'"...\x1b[0m');
  755.                         var retTypeName = callingMethod.returnType.type;           
  756.                         // Skip it when the calling method was already bypassed with Frida
  757.                         if (!(callingMethod.implementation)) {
  758.                             // Trying to bypass (via implementation) the SSLPeerUnverifiedException if due to an uncommon SSL Pinning method
  759.                             callingMethod.implementation = function() {
  760.                                 console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+className+'.'+methodName+'" via Frida function implementation\x1b[0m');
  761.                                 returner(retTypeName);
  762.                             }
  763.                         }
  764.                     }
  765.                 } catch (err2) {
  766.                     // Dynamic circumvention via function implementation does not works, then trying via function overloading
  767.                     if (String(err2).includes('.overload')) {
  768.                         overloader(err2, className, methodName, retTypeName);
  769.                     } else {
  770.                         if (String(err2).includes('SSLPeerUnverifiedException')) {
  771.                             console.log('\x1b[36m[-] Failed to dynamically circumvent SSLPeerUnverifiedException -> '+err2+'\x1b[0m');
  772.                         } else {
  773.                             //console.log('\x1b[36m[-] Another kind of exception raised during overloading  -> '+err2+'\x1b[0m');
  774.                         }
  775.                     }
  776.                 }
  777.                 //console.log('\x1b[36m[+] SSLPeerUnverifiedException hooked\x1b[0m');
  778.                 return this.$init(reason);
  779.             };
  780.         } catch (err1) {
  781.             //console.log('\x1b[36m[-] SSLPeerUnverifiedException not found\x1b[0m');
  782.             //console.log('\x1b[36m'+err1+'\x1b[0m');
  783.         }
  784.        
  785.  
  786.     });
  787.    
  788. }, 0);
  789.  
  790.  
  791.  
  792.  
  793. function returner(typeName) {
  794.     // This is a improvable rudimentary fix, if not works you can patch it manually
  795.     //console.log("typeName: "+typeName)
  796.     if (typeName === undefined || typeName === 'void') {
  797.         return;
  798.     } else if (typeName === 'boolean') {
  799.         return true;
  800.     } else {
  801.         return null;
  802.     }
  803. }
  804.  
  805.  
  806. function overloader(errStr, targetClass, targetFunc, retType) {
  807.     // One ring to overload them all.. ;-)
  808.     var tClass = Java.use(targetClass);
  809.     var tFunc = tClass[targetFunc];
  810.     var params = [];
  811.     var argList = [];
  812.     var overloads = tFunc.overloads;
  813.     var returnTypeName = retType;
  814.     var splittedList = String(errStr).split('.overload');
  815.     for (var n=1; n<splittedList.length; n++) {
  816.         var extractedOverload = splittedList[n].trim().split('(')[1].slice(0,-1).replaceAll("'","");
  817.         // Discarding useless error strings
  818.         if (extractedOverload.includes('<signature>')) {
  819.             continue;
  820.         }
  821.         console.log('\x1b[34m[!] Found the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"\x1b[0m');
  822.         // Check if extractedOverload is empty
  823.         if (!extractedOverload) {
  824.             // Overloading method withouth arguments
  825.             tFunc.overload().implementation = function() {
  826.                 var printStr = printer();
  827.                 console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m');
  828.                 returner(returnTypeName);
  829.             }
  830.         } else {
  831.             // Check if extractedOverload has multiple arguments
  832.             if (extractedOverload.includes(',')) {
  833.                 argList = extractedOverload.split(', ');
  834.             }
  835.             // Considering max 8 arguments for the method to overload (Note: increase it, if needed)
  836.             if (argList.length == 0) {
  837.                 tFunc.overload(extractedOverload).implementation = function(a) {
  838.                     var printStr = printer();
  839.                     console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m');
  840.                     returner(returnTypeName);
  841.                 }
  842.             } else if (argList.length == 2) {
  843.                 tFunc.overload(argList[0], argList[1]).implementation = function(a,b) {
  844.                     var printStr = printer(a);
  845.                     console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m');
  846.                     returner(returnTypeName);
  847.                 }
  848.             } else if (argList.length == 3) {
  849.                 tFunc.overload(argList[0], argList[1], argList[2]).implementation = function(a,b,c) {
  850.                     var printStr = printer(a,b);
  851.                     console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m');
  852.                     returner(returnTypeName);
  853.                 }
  854.             } else if (argList.length == 4) {
  855.                 tFunc.overload(argList[0], argList[1], argList[2], argList[3]).implementation = function(a,b,c,d) {
  856.                     var printStr = printer(a,b,c);
  857.                     console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m');
  858.                     returner(returnTypeName);
  859.                 }
  860.             }  else if (argList.length == 5) {
  861.                 tFunc.overload(argList[0], argList[1], argList[2], argList[3], argList[4]).implementation = function(a,b,c,d,e) {
  862.                     var printStr = printer(a,b,c,d);
  863.                     console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m');
  864.                     returner(returnTypeName);
  865.                 }
  866.             }  else if (argList.length == 6) {
  867.                 tFunc.overload(argList[0], argList[1], argList[2], argList[3], argList[4], argList[5]).implementation = function(a,b,c,d,e,f) {
  868.                     var printStr = printer(a,b,c,d,e);
  869.                     console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m');
  870.                     returner(returnTypeName);
  871.                 }
  872.             }  else if (argList.length == 7) {
  873.                 tFunc.overload(argList[0], argList[1], argList[2], argList[3], argList[4], argList[5], argList[6]).implementation = function(a,b,c,d,e,f,g) {
  874.                     var printStr = printer(a,b,c,d,e,f);
  875.                     console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m');
  876.                     returner(returnTypeName);
  877.                 }
  878.             }  else if (argList.length == 8) {
  879.                 tFunc.overload(argList[0], argList[1], argList[2], argList[3], argList[4], argList[5], argList[6], argList[7]).implementation = function(a,b,c,d,e,f,g,h) {
  880.                     var printStr = printer(a,b,c,d,e,f,g);
  881.                     console.log('\x1b[34m[+] Bypassing the unusual/obfuscated pinner "'+targetClass+'.'+targetFunc+'('+extractedOverload+')"'+printStr+'\x1b[0m');
  882.                     returner(returnTypeName);
  883.                 }
  884.             }
  885.         }
  886.        
  887.     }
  888. }
  889.  
  890.  
  891. function printer(a,b,c,d,e,f,g,h) {
  892.     // Build the string to print for the overloaded pinner
  893.     var printList = [];
  894.     var printStr = '';
  895.     if (typeof a === 'string') {
  896.         printList.push(a);
  897.     }
  898.     if (typeof b === 'string') {
  899.         printList.push(b);
  900.     }
  901.     if (typeof c === 'string') {
  902.         printList.push(c);
  903.     }
  904.     if (typeof d === 'string') {
  905.         printList.push(d);
  906.     }
  907.     if (typeof e === 'string') {
  908.         printList.push(e);
  909.     }
  910.     if (typeof f === 'string') {
  911.         printList.push(f);
  912.     }
  913.     if (typeof g === 'string') {
  914.         printList.push(g);
  915.     }
  916.     if (typeof h === 'string') {
  917.         printList.push(h);
  918.     }
  919.     if (printList.length !== 0) {
  920.         printStr = ' check for:';
  921.         for (var i=0; i<printList.length; i++) {
  922.             printStr += ' '+printList[i];
  923.         }
  924.     }
  925.     return printStr;
  926. }
Tags: Android Emulator frida tools android ssl pinning отладка android трафика android traffic analysis
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!