1. Java.perform(function() {
    2.     var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
    3.     var HostnameVerifier = Java.use('javax.net.ssl.HostnameVerifier');
    4.     var SSLContext = Java.use('javax.net.ssl.SSLContext');
    5.     var quiet_output = false;
    6.     function quiet_send(data) {
    8.         if (quiet_output) {
    10.             return;
    11.         }
    13.         send(data)
    14.     }
    15.     var X509Certificate = Java.use("java.security.cert.X509Certificate");
    16.     var TrustManager;
    17.     try {
    18.         TrustManager = Java.registerClass({
    19.             name: 'org.wooyun.TrustManager',
    20.             implements: [X509TrustManager],
    21.             methods: {
    22.                 checkClientTrusted: function(chain, authType) {},
    23.                 checkServerTrusted: function(chain, authType) {},
    24.                 getAcceptedIssuers: function() {
    25.                     return [];
    26.                 }
    27.             }
    28.         });
    29.     } catch (e) {
    30.         quiet_send("registerClass from X509TrustManager >>>>>>>> " + e.message);
    31.     }
    33.     // Prepare the TrustManagers array to pass to SSLContext.init()
    34.     var TrustManagers = [TrustManager.$new()];
    36.     try {
    37.         // Prepare a Empty SSLFactory
    38.         var TLS_SSLContext = SSLContext.getInstance("TLS");
    39.         TLS_SSLContext.init(null, TrustManagers, null);
    40.         var EmptySSLFactory = TLS_SSLContext.getSocketFactory();
    41.     } catch (e) {
    42.         quiet_send(e.message);
    43.     }
    45.     send('Custom, Empty TrustManager ready');
    47.     // Get a handle on the init() on the SSLContext class
    48.     var SSLContext_init = SSLContext.init.overload(
    49.         '[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom');
    50.     SSLContext_init.implementation = function(keyManager, trustManager, secureRandom) {
    52.         quiet_send('Overriding SSLContext.init() with the custom TrustManager');
    54.         SSLContext_init.call(this, null, TrustManagers, null);
    55.     };
    56.     try {
    58.         var CertificatePinner = Java.use('okhttp3.CertificatePinner');
    60.         quiet_send('OkHTTP 3.x Found');
    62.         CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function() {
    64.             quiet_send('OkHTTP 3.x check() called. Not throwing an exception.');
    65.         }
    67.     } catch (err) {
    68.         if (err.message.indexOf('ClassNotFoundException') === 0) {
    70.             throw new Error(err);
    71.         }
    72.     }
    73.     try {
    75.         var PinningTrustManager = Java.use('appcelerator.https.PinningTrustManager');
    77.         send('Appcelerator Titanium Found');
    79.         PinningTrustManager.checkServerTrusted.implementation = function() {
    81.             quiet_send('Appcelerator checkServerTrusted() called. Not throwing an exception.');
    82.         }
    84.     } catch (err) {
    85.         if (err.message.indexOf('ClassNotFoundException') === 0) {
    87.             throw new Error(err);
    88.         }
    89.     }
    91.     /*** okhttp unpinning ***/
    94.     try {
    95.         var OkHttpClient = Java.use("com.squareup.okhttp.OkHttpClient");
    96.         OkHttpClient.setCertificatePinner.implementation = function(certificatePinner) {
    97.             // do nothing
    98.             quiet_send("OkHttpClient.setCertificatePinner Called!");
    99.             return this;
    100.         };
    101.         var CertificatePinner = Java.use("com.squareup.okhttp.CertificatePinner");
    102.         CertificatePinner.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function(p0, p1) {
    103.             // do nothing
    104.             quiet_send("okhttp Called! [Certificate]");
    105.             return;
    106.         };
    107.         CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function(p0, p1) {
    108.             // do nothing
    109.             quiet_send("okhttp Called! [List]");
    110.             return;
    111.         };
    112.     } catch (e) {
    113.         quiet_send("com.squareup.okhttp not found");
    114.     }
    116.     /*** WebView Hooks ***/
    118.     /* frameworks/base/core/java/android/webkit/WebViewClient.java */
    119.     /* public void onReceivedSslError(Webview, SslErrorHandler, SslError) */
    120.     var WebViewClient = Java.use("android.webkit.WebViewClient");
    122.     WebViewClient.onReceivedSslError.implementation = function(webView, sslErrorHandler, sslError) {
    123.         quiet_send("WebViewClient onReceivedSslError invoke");
    124.         //执行proceed方法
    125.         sslErrorHandler.proceed();
    126.         return;
    127.     };
    129.     WebViewClient.onReceivedError.overload('android.webkit.WebView', 'int', 'java.lang.String', 'java.lang.String').implementation = function(a, b, c, d) {
    130.         quiet_send("WebViewClient onReceivedError invoked");
    131.         return;
    132.     };
    134.     WebViewClient.onReceivedError.overload('android.webkit.WebView', 'android.webkit.WebResourceRequest', 'android.webkit.WebResourceError').implementation = function() {
    135.         quiet_send("WebViewClient onReceivedError invoked");
    136.         return;
    137.     };
    138.     var HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection");
    139.     HttpsURLConnection.setDefaultHostnameVerifier.implementation = function(hostnameVerifier) {
    140.         quiet_send("HttpsURLConnection.setDefaultHostnameVerifier invoked");
    141.         return null;
    142.     };
    143.     HttpsURLConnection.setSSLSocketFactory.implementation = function(SSLSocketFactory) {
    144.         quiet_send("HttpsURLConnection.setSSLSocketFactory invoked");
    145.         return null;
    146.     };
    147.     /* libcore/luni/src/main/java/javax/net/ssl/HttpsURLConnection.java */
    148.     /* public void setHostnameVerifier(HostnameVerifier) */
    149.     HttpsURLConnection.setHostnameVerifier.implementation = function(hostnameVerifier) {
    150.         quiet_send("HttpsURLConnection.setHostnameVerifier invoked");
    151.         return null;
    152.     };
    154.     /*** Xutils3.x hooks ***/
    155.     //Implement a new HostnameVerifier
    156.     var TrustHostnameVerifier;
    157.     try {
    158.         TrustHostnameVerifier = Java.registerClass({
    159.             name: 'org.wooyun.TrustHostnameVerifier',
    160.             implements: [HostnameVerifier],
    161.             method: {
    162.                 verify: function(hostname, session) {
    163.                     return true;
    164.                 }
    165.             }
    166.         });
    168.     } catch (e) {
    169.         //java.lang.ClassNotFoundException: Didn't find class "org.wooyun.TrustHostnameVerifier"
    170.         quiet_send("registerClass from hostnameVerifier >>>>>>>> " + e.message);
    171.     }
    173.     try {
    174.         var RequestParams = Java.use('org.xutils.http.RequestParams');
    175.         RequestParams.setSslSocketFactory.implementation = function(sslSocketFactory) {
    176.             sslSocketFactory = EmptySSLFactory;
    177.             return null;
    178.         }
    180.         RequestParams.setHostnameVerifier.implementation = function(hostnameVerifier) {
    181.             hostnameVerifier = TrustHostnameVerifier.$new();
    182.             return null;
    183.         }
    185.     } catch (e) {
    186.         quiet_send("Xutils hooks not Found");
    187.     }
    188.     try {
    189.         var AbstractVerifier = Java.use("ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier");
    190.         AbstractVerifier.verify.overload('java.lang.String', '[Ljava.lang.String', '[Ljava.lang.String', 'boolean').implementation = function() {
    191.             quiet_send("httpclientandroidlib Hooks");
    192.             return null;
    193.         }
    194.     } catch (e) {
    195.         quiet_send("httpclientandroidlib Hooks not found");
    196.     }
    198.     /***
    199. android 7.0+ network_security_config TrustManagerImpl hook
    200. apache httpclient partly
    201. ***/
    202.     var TrustManagerImpl = Java.use("com.android.org.conscrypt.TrustManagerImpl");
    203.     // try {
    204.     //     var Arrays = Java.use("java.util.Arrays");
    205.     //     //apache http client pinning maybe baypass
    206.     //     //https://github.com/google/conscrypt/blob/c88f9f55a523f128f0e4dace76a34724bfa1e88c/platform/src/main/java/org/conscrypt/TrustManagerImpl.java#471
    207.     //     TrustManagerImpl.checkTrusted.implementation = function (chain, authType, session, parameters, authType) {
    208.     //         quiet_send("TrustManagerImpl checkTrusted called");
    209.     //         //Generics currently result in java.lang.Object
    210.     //         return Arrays.asList(chain);
    211.     //     }
    212.     //
    213.     // } catch (e) {
    214.     //     quiet_send("TrustManagerImpl checkTrusted nout found");
    215.     // }
    217.     try {
    218.         // Android 7+ TrustManagerImpl
    219.         TrustManagerImpl.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) {
    220.             quiet_send("TrustManagerImpl verifyChain called");
    221.             return untrustedChain;
    222.         }
    223.     } catch (e) {
    224.         quiet_send("TrustManagerImpl verifyChain nout found below 7.0");
    225.     }
    226.     // OpenSSLSocketImpl
    227.     try {
    228.         var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl');
    229.         OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certRefs, authMethod) {
    230.             quiet_send('OpenSSLSocketImpl.verifyCertificateChain');
    231.         }
    233.         quiet_send('OpenSSLSocketImpl pinning')
    234.     } catch (err) {
    235.         quiet_send('OpenSSLSocketImpl pinner not found');
    236.     }
    237.     // Trustkit
    238.     try {
    239.         var Activity = Java.use("com.datatheorem.android.trustkit.pinning.OkHostnameVerifier");
    240.         Activity.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(str) {
    241.             quiet_send('Trustkit.verify1: ' + str);
    242.             return true;
    243.         };
    244.         Activity.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(str) {
    245.             quiet_send('Trustkit.verify2: ' + str);
    246.             return true;
    247.         };
    249.         quiet_send('Trustkit pinning')
    250.     } catch (err) {
    251.         quiet_send('Trustkit pinner not found')
    252.     }
    254.     try {
    255.         var netBuilder = Java.use("org.chromium.net.CronetEngine$Builder");
    256.         netBuilder.enablePublicKeyPinningBypassForLocalTrustAnchors.implementation = function(arg) {
    257.             console.log("Enables or disables public key pinning bypass for local trust anchors = " + arg);
    259.             //true to enable the bypass, false to disable.
    260.             var ret = netBuilder.enablePublicKeyPinningBypassForLocalTrustAnchors.call(this, true);
    261.             return ret;
    262.         };
    264.         netBuilder.addPublicKeyPins.implementation = function(hostName, pinsSha256, includeSubdomains, expirationDate) {
    265.             console.log("cronet addPublicKeyPins hostName = " + hostName);
    266.             return this;
    267.         };
    269.     } catch (err) {
    270.         console.log('[-] Cronet pinner not found')
    271.     }
    272. });