How can I bypass Certificate Pinning, or bypass SSL verification entirely, in an Android app on Android 7 or newer that has a built-in hash 'integrity check' to rule out APK modification?

Here is a rundown of the previous solutions and why they don't work: JustTrustMe does not work on Android 7, and Android-SSL-TrustKiller depends on Cydia Substrate, which is only supported on versions 2.3 through 4.3. That leaves SSLUnpinning_Xposed, which also does not work on Android 7.

I'm seeking any solution that works, which could include an Xposed module or other system modification requiring root. However, making such changes to the APK like these wouldn't work because they would trip the hash integrity check.

Any ideas?

  • @Arya I ended up bypassing the integrity check by decompiling the app with APKtool, first to Java with dex2jar / jd-gui just to get a big picture view, then once I knew where to look I went back to smali and found the integrity check, it simply took a sha1sum of the signature and sent it to the server. So I modified the in-app sha1 function in smali to just return what the 'correct' signature is every time, and that let me edit the app with something like the medium link.
    – habs
    Commented Apr 15, 2018 at 16:18
  • it seems like there really is no such thing as a foolproof 'integrity check' on an android app, or at least not one i've seen yet. so it's just a matter of finding it and disabling it from tripping.
    – habs
    Commented Apr 15, 2018 at 16:20
  • 2
    Here, check it out. I still have not tried it blog.nviso.be/2017/12/22/…
    – Arya
    Commented Apr 15, 2018 at 16:22


You must log in to answer this question.

Browse other questions tagged .