frida之过app的 SSL Pinning双向证书代理检测hook代码

Java.perform(function() {
    
    
	var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
	var HostnameVerifier = Java.use('javax.net.ssl.HostnameVerifier');
	var SSLContext = Java.use('javax.net.ssl.SSLContext');
	var quiet_output = false;


	function quiet_send(data) {
    
    

		if (quiet_output) {
    
    

			return;
		}

		send(data)
	}

	var X509Certificate = Java.use("java.security.cert.X509Certificate");
	var TrustManager;
	try {
    
    
		TrustManager = Java.registerClass({
    
    
			name: 'org.wooyun.TrustManager',
			implements: [X509TrustManager],
			methods: {
    
    
				checkClientTrusted: function(chain, authType) {
    
    },
				checkServerTrusted: function(chain, authType) {
    
    },
				getAcceptedIssuers: function() {
    
    

					return [];
				}
			}
		});
	} catch (e) {
    
    
		quiet_send("registerClass from X509TrustManager >>>>>>>> " + e.message);
	}





	var TrustManagers = [TrustManager.$new()];

	try {
    
    

		var TLS_SSLContext = SSLContext.getInstance("TLS");
		TLS_SSLContext.init(null, TrustManagers, null);
		var EmptySSLFactory = TLS_SSLContext.getSocketFactory();
	} catch (e) {
    
    
		quiet_send(e.message);
	}

	send('Custom, Empty TrustManager ready');


	var SSLContext_init = SSLContext.init.overload(
		'[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom');


	SSLContext_init.implementation = function(keyManager, trustManager, secureRandom) {
    
    

		quiet_send('Overriding SSLContext.init() with the custom TrustManager');

		SSLContext_init.call(this, null, TrustManagers, null);
	};



	try {
    
    

		var CertificatePinner = Java.use('okhttp3.CertificatePinner');

		quiet_send('OkHTTP 3.x Found');

		CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function() {
    
    

			quiet_send('OkHTTP 3.x check() called. Not throwing an exception.');
		}

	} catch (err) {
    
    


		if (err.message.indexOf('ClassNotFoundException') === 0) {
    
    

			throw new Error(err);
		}
	}

	
	try {
    
    

		var PinningTrustManager = Java.use('appcelerator.https.PinningTrustManager');

		send('Appcelerator Titanium Found');

		PinningTrustManager.checkServerTrusted.implementation = function() {
    
    

			quiet_send('Appcelerator checkServerTrusted() called. Not throwing an exception.');
		}

	} catch (err) {
    
    


		if (err.message.indexOf('ClassNotFoundException') === 0) {
    
    

			throw new Error(err);
		}
	}




	try {
    
    
		var OkHttpClient = Java.use("com.squareup.okhttp.OkHttpClient");
		OkHttpClient.setCertificatePinner.implementation = function(certificatePinner) {
    
    
	
			quiet_send("OkHttpClient.setCertificatePinner Called!");
			return this;
		};

		var CertificatePinner = Java.use("com.squareup.okhttp.CertificatePinner");
		CertificatePinner.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function(p0, p1) {
    
    
		
			quiet_send("okhttp Called! [Certificate]");
			return;
		};
		CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function(p0, p1) {
    
    
			// do nothing
			quiet_send("okhttp Called! [List]");
			return;
		};
	} catch (e) {
    
    
		quiet_send("com.squareup.okhttp not found");
	}


	var WebViewClient = Java.use("android.webkit.WebViewClient");

	WebViewClient.onReceivedSslError.implementation = function(webView, sslErrorHandler, sslError) {
    
    
		quiet_send("WebViewClient onReceivedSslError invoke");

		sslErrorHandler.proceed();
		return;
	};

	WebViewClient.onReceivedError.overload('android.webkit.WebView', 'int', 'java.lang.String', 'java.lang.String').implementation = function(a, b, c, d) {
    
    
		quiet_send("WebViewClient onReceivedError invoked");
		return;
	};

	WebViewClient.onReceivedError.overload('android.webkit.WebView', 'android.webkit.WebResourceRequest', 'android.webkit.WebResourceError').implementation = function() {
    
    
		quiet_send("WebViewClient onReceivedError invoked");
		return;
	};



	var HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection");

	HttpsURLConnection.setDefaultHostnameVerifier.implementation = function(hostnameVerifier) {
    
    
		quiet_send("HttpsURLConnection.setDefaultHostnameVerifier invoked");
		return null;
	};
	
	HttpsURLConnection.setSSLSocketFactory.implementation = function(SSLSocketFactory) {
    
    
		quiet_send("HttpsURLConnection.setSSLSocketFactory invoked");
		return null;
	};

	HttpsURLConnection.setHostnameVerifier.implementation = function(hostnameVerifier) {
    
    
		quiet_send("HttpsURLConnection.setHostnameVerifier invoked");
		return null;
	};


	var TrustHostnameVerifier;
	try {
    
    
		TrustHostnameVerifier = Java.registerClass({
    
    
			name: 'org.wooyun.TrustHostnameVerifier',
			implements: [HostnameVerifier],
			method: {
    
    
				verify: function(hostname, session) {
    
    
					return true;
				}
			}
		});

	} catch (e) {
    
    

		quiet_send("registerClass from hostnameVerifier >>>>>>>> " + e.message);
	}

	try {
    
    
		var RequestParams = Java.use('org.xutils.http.RequestParams');
		RequestParams.setSslSocketFactory.implementation = function(sslSocketFactory) {
    
    
			sslSocketFactory = EmptySSLFactory;
			return null;
		}

		RequestParams.setHostnameVerifier.implementation = function(hostnameVerifier) {
    
    
			hostnameVerifier = TrustHostnameVerifier.$new();
			return null;
		}

	} catch (e) {
    
    
		quiet_send("Xutils hooks not Found");
	}


	try {
    
    
		var AbstractVerifier = Java.use("ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier");
		AbstractVerifier.verify.overload('java.lang.String', '[Ljava.lang.String', '[Ljava.lang.String', 'boolean').implementation = function() {
    
    
			quiet_send("httpclientandroidlib Hooks");
			return null;
		}
	} catch (e) {
    
    
		quiet_send("httpclientandroidlib Hooks not found");
	}


	var TrustManagerImpl = Java.use("com.android.org.conscrypt.TrustManagerImpl");


	try {
    
    
		
		TrustManagerImpl.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) {
    
    
			quiet_send("TrustManagerImpl verifyChain called");
			
			return untrustedChain;
		}
	} catch (e) {
    
    
		quiet_send("TrustManagerImpl verifyChain nout found below 7.0");
	}

	try {
    
    
		var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl');
		OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certRefs, authMethod) {
    
    
			quiet_send('OpenSSLSocketImpl.verifyCertificateChain');
		}

		quiet_send('OpenSSLSocketImpl pinning')
	} catch (err) {
    
    
		quiet_send('OpenSSLSocketImpl pinner not found');
	}
	
	try {
    
    
		var Activity = Java.use("com.datatheorem.android.trustkit.pinning.OkHostnameVerifier");
		Activity.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(str) {
    
    
			quiet_send('Trustkit.verify1: ' + str);
			return true;
		};
		Activity.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(str) {
    
    
			quiet_send('Trustkit.verify2: ' + str);
			return true;
		};

		quiet_send('Trustkit pinning')
	} catch (err) {
    
    
		quiet_send('Trustkit pinner not found')
	}

	try {
    
    
		

		var netBuilder = Java.use("org.chromium.net.CronetEngine$Builder");

		
		netBuilder.enablePublicKeyPinningBypassForLocalTrustAnchors.implementation = function(arg) {
    
    

		
			console.log("Enables or disables public key pinning bypass for local trust anchors = " + arg);

		
			var ret = netBuilder.enablePublicKeyPinningBypassForLocalTrustAnchors.call(this, true);
			return ret;
		};

		netBuilder.addPublicKeyPins.implementation = function(hostName, pinsSha256, includeSubdomains, expirationDate) {
    
    
			console.log("cronet addPublicKeyPins hostName = " + hostName);

		
			return this;
		};

	} catch (err) {
    
    
		console.log('[-] Cronet pinner not found')
	}
});