How can I bypass Certificate Pinning, or bypass SSL verification entirely, in an Android app on Android 7 or newer that has a built-in hash 'integrity check' to rule out APK modification?

Here is a rundown of the previous solutions and why they don't work: JustTrustMe does not work on Android 7, and Android-SSL-TrustKiller depends on Cydia Substrate, which is only supported on versions 2.3 through 4.3. That leaves SSLUnpinning_Xposed, which also does not work on Android 7.

I'm seeking any solution that works, which could include an Xposed module or other system modification requiring root. However, making such changes to the APK like these wouldn't work because they would trip the hash integrity check.

Any ideas?

  • 1
    did you find any info on this? – Arya Apr 15 '18 at 14:02
  • @Arya I ended up bypassing the integrity check by decompiling the app with APKtool, first to Java with dex2jar / jd-gui just to get a big picture view, then once I knew where to look I went back to smali and found the integrity check, it simply took a sha1sum of the signature and sent it to the server. So I modified the in-app sha1 function in smali to just return what the 'correct' signature is every time, and that let me edit the app with something like the medium link. – Harry Apr 15 '18 at 16:18
  • 1
    I found a easier way. Let me find the article for you. I will post back – Arya Apr 15 '18 at 16:20
  • it seems like there really is no such thing as a foolproof 'integrity check' on an android app, or at least not one i've seen yet. so it's just a matter of finding it and disabling it from tripping. – Harry Apr 15 '18 at 16:20
  • 2
    Here, check it out. I still have not tried it blog.nviso.be/2017/12/22/… – Arya Apr 15 '18 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.