How can I bypass Certificate Pinning, or bypass SSL verification entirely, in an Android app on Android 7 or newer that has a built-in hash 'integrity check' to rule out APK modification?
Here is a rundown of the previous solutions and why they don't work: JustTrustMe does not work on Android 7, and Android-SSL-TrustKiller depends on Cydia Substrate, which is only supported on versions 2.3 through 4.3. That leaves SSLUnpinning_Xposed, which also does not work on Android 7.
I'm seeking any solution that works, which could include an Xposed module or other system modification requiring root. However, making such changes to the APK like these wouldn't work because they would trip the hash integrity check.