Erik Johnson EkriirkE

On-device SSL Unpinning with Frida

I like mitmproxy, it worked great until apps started pinning SSL certs.
Then LSposed module SSLUnpinning was found and worked great until apps started using more broad detection.
Then I read about Frida but could not figure out how to get it to work. Most examples involve USB + ADB which I was not too keen on.
I wanted to have it all working on-device with termux. frida-server seemed to run fine, but frida (frida-tools) itself was not cooperating.
Eventually I got to the point where frida seems to want to run but was running into a permission issue with Magisk and the zygote process:
# frida --codeshare Q0120S/bypass-ssl-pinning -f com.theapp.name results in Failed to spawn: unable to access PID 20107 (zygote) while preparing for app launch; try disabling Magisk Hide in case it is active

After searching around there was a hint to use the PID of the app instead - what seems to happen is if you pass the app name it attempts to launch and attach via zyg

Keybase proof

I hereby claim:

I am ekriirke on github.
I am ekriirke (https://keybase.io/ekriirke) on keybase.
I have a public key ASBXC5QHiladK9MOompV0WvaZ5AeEoWSAVOUj6Wdd9wljgo

To claim this, I am signing this object:

	#!/usr/bin/env python3

	BACKUP_FILE = 'backup.ab'

	# Constants
	# ref: https://github.com/omnirom/android_bootable_recovery/blob/android-7.1/adbbu/twadbstream.h
	TWRP = b'TWRP' + b'\x00\x00\x00\x00'

	TWSTREAMHDR = b'twstreamheader'
	TWFN = b'twfilename'