12 ms·
I tried doing 2 recently, found the file with CertificatePinning in the name, found the part returning 1 and 0 based on whether the check passed and patched it
by ikeboy 9y ago
I tried doing 2 recently, found the file with CertificatePinning in the name, found the part returning 1 and 0 based on whether the check passed and patched it to return 1 in both cases. It still didn't work and after a few hours, I gave up, grepped through the decompiled files for the website name, got an endpoint which turned out to work perfectly in a web browser and which led me to the ultimate endpoint I needed.
I could probably have gone deeper and found more functions to patch, but I don't know smali so everything was guessing and matching up to the java decompiled source (and the original source which seems to have been Moxie's?)
(>$100 billion company making the app with >1 million users.)
- bluesign 9y agoFrom my experience, for certificate pinning, fastest option is to search for existing certificate/fingerprint, and try to replace it with charles’/mitmproxie’s Edit: oh another trick usually works is to change transport to HTTP from HTTPS, just changing endpoint to something you control and changing it to http (with little hex editing the endpoint), and reverse proxy with mitmproxy/charles to the target, you can speed up process.
- ikeboy 9y agoI don't know certificate formats and I imagine it would require conversion between hex and something - maybe you can write a blog post with an example?
- bluesign 9y agoI am not blogging but in a free time I will try to write up a small gist.
- ikeboy 9y agoooh I like the second idea - so since it's an HTTP the cert pinning code won't be triggered at all, and all you need is to grep https to find endpoints and change?
- merty 9y agoFor the edit: If the endpoint works on HTTP that is. We no longer allow HTTP connections to our API servers for instance.
- bluesign 9y agoNope you should change endpoint to charles/mitmproxy, then reverse proxy to https endpoint. So basically for app endpoint will be charles/mitmproxy machine, then from there, you will make https request to real API server