关于安卓7.0以上版本抓包困难问题

[HA-JD]

看了很多关于抓包的文章Android 7.0以上的不信任用户安装的证书，通过PC FD安装证书抓不到，手机大多数还有root锁，所以用了一个虚拟环境xposed的应用和JustTrustMe抓到了Https包找不到stoken

[HA-JD]

啊刚刚找到，大佬也许你可以去反编译米友社加个net_security_config.xml <?xml version="1.0" encoding="utf-8"?>

这样就应该会信任用户安装的证书了

[HA-JD]

https://www.52pojie.cn/forum.php?mod=viewthread&tid=967606&highlight=Fiddler

[Ljzd-PRO]

我试试

[Ljzd-PRO]

没有MT管理器会员😂NP管理器我也会用到一半闪退

[HA-JD]

https://xiaodao.lanzoux.com/b0dqojgnc

[HA-JD]

VirtualXposed+JustTrustMe0.3就好了，我刚又想了想你要是反编译了它签名变了不能覆盖还得删除应该比虚拟环境还要麻烦吧，虽然有些模拟器不支持安装证书（会有Bug之类的一般没有锁屏密码无法安装，加了密码，可能无限弹窗输入密码）

[Ljzd-PRO]

用apktool反编译了 原先是已经存在了一个net_security_config.xml：

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="true" />
    <debug-overrides>
        <trust-anchors>
            <certificates src="@raw/charlesekko" />
            <certificates src="@raw/charlesca" />
            <certificates src="@raw/charleswx" />
            <certificates src="@raw/charles_cmy" />
            <certificates src="@raw/charlesmxx" />
            <certificates src="@raw/charleslzy" />
            <certificates src="@raw/charles_sc" />
            <certificates src="@raw/charles_zcx" />
            <certificates src="@raw/charleszly" />
            <certificates src="@raw/charles_jihai" />
            <certificates src="@raw/charleszkj" />
            <certificates src="@raw/charlesziyu" />
            <certificates src="@raw/charlesxueqing" />
            <certificates src="@raw/charlesyyk" />
            <certificates src="@raw/charlescg" />
            <certificates src="@raw/charlesylc" />
            <certificates src="@raw/charleshg" />
            <certificates src="@raw/charles_tantian" />
            <certificates src="@raw/charles_hubiao" />
            <certificates src="@raw/charles_chen_gen" />
            <certificates src="@raw/charles_dl" />
            <certificates src="system" />
            <certificates overridePins="true" src="user" />
        </trust-anchors>
    </debug-overrides>
</network-security-config>

看上去里面的内容是为调试而设定的，所以额外增加了上面文章说的内容：

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="true" />
    <debug-overrides>
        <trust-anchors>
            <certificates src="@raw/charlesekko" />
            <certificates src="@raw/charlesca" />
            <certificates src="@raw/charleswx" />
            <certificates src="@raw/charles_cmy" />
            <certificates src="@raw/charlesmxx" />
            <certificates src="@raw/charleslzy" />
            <certificates src="@raw/charles_sc" />
            <certificates src="@raw/charles_zcx" />
            <certificates src="@raw/charleszly" />
            <certificates src="@raw/charles_jihai" />
            <certificates src="@raw/charleszkj" />
            <certificates src="@raw/charlesziyu" />
            <certificates src="@raw/charlesxueqing" />
            <certificates src="@raw/charlesyyk" />
            <certificates src="@raw/charlescg" />
            <certificates src="@raw/charlesylc" />
            <certificates src="@raw/charleshg" />
            <certificates src="@raw/charles_tantian" />
            <certificates src="@raw/charles_hubiao" />
            <certificates src="@raw/charles_chen_gen" />
            <certificates src="@raw/charles_dl" />
            <certificates src="system" />
            <certificates overridePins="true" src="user" />
        </trust-anchors>
    </debug-overrides>
    <trust-anchors>
        <certificates src="system" overridePins="true" />
        <certificates src="user" overridePins="true" />
    </trust-anchors>/>
</network-security-config>

然后用MT管理器签名了，可以正常安装并打开，不过我刷的Pixel Experience 11可能有点问题，用别人该过的HttpCanary以ROOT方式添加证书以后，证书卸载不了了，系统设置的相关界面也是进去就返回上一页，所以没法测试行不行。

[HA-JD]

啊这刚看见<certificates overridePins="true" src="user" />已经有了apk发来我测试一下？

[Ljzd-PRO]

https://www.icloud.com.cn/iclouddrive/0d0KX0Hg-pleOrbDB-uGcJUcA#mihoyobbs_2.27

[Ljzd-PRO]

https://www.icloud.com.cn/iclouddrive/0d0KX0Hg-pleOrbDB-uGcJUcA#mihoyobbs_2.27

链接不行的话刚刚上传了蓝奏云：https://mcdz.lanzouh.com/izjKS04m9yaf

[HA-JD]

好像不行。刚刚用fd给手机安装了证书挂了代理无法连接

[HA-JD]

这个太不行，附上可解决链接，https://hajd.lanzouw.com/b0cmd5p4h?password=glc8 免root