1

How can I bypass Certificate Pinning, or bypass SSL verification entirely, in an Android app on Android 7 or newer that has a built-in hash 'integrity check' to rule out APK modification?

Here is a rundown of the previous solutions and why they don't work: JustTrustMe does not work on Android 7, and Android-SSL-TrustKiller depends on Cydia Substrate, which is only supported on versions 2.3 through 4.3. That leaves SSLUnpinning_Xposed, which also does not work on Android 7.

I'm seeking any solution that works, which could include an Xposed module or other system modification requiring root. However, making such changes to the APK like these wouldn't work because they would trip the hash integrity check.

Any ideas?

Improve this question
3
  • @Arya I ended up bypassing the integrity check by decompiling the app with APKtool, first to Java with dex2jar / jd-gui just to get a big picture view, then once I knew where to look I went back to smali and found the integrity check, it simply took a sha1sum of the signature and sent it to the server. So I modified the in-app sha1 function in smali to just return what the 'correct' signature is every time, and that let me edit the app with something like the medium link.
    – Harry
    Apr 15, 2018 at 16:18
  • it seems like there really is no such thing as a foolproof 'integrity check' on an android app, or at least not one i've seen yet. so it's just a matter of finding it and disabling it from tripping.
    – Harry
    Apr 15, 2018 at 16:20
  • 2
    Here, check it out. I still have not tried it blog.nviso.be/2017/12/22/…
    – Arya
    Apr 15, 2018 at 16:22

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .