search

ViRb3 / TrustMeAlready

🔓 Disable SSL verification and pinning on Android, system-wide
1.21k stars 153 forks source link

Doesn't work on Oreo with Magisk and Xposed #5

Closed beppe9000 closed 4 years ago

jpstotz commented 4 years ago

If TrustMeAlready works depends more on the app and not the Android version. Therefore you have to exactly name the app where it does not work.

beppe9000 commented 4 years ago

i tried a bunch of apps, among them opera browser, stock browser. After some digging I'm not sure if it's this or the PC side...

jpstotz commented 4 years ago

TrustMeAlready uses Xposed therefore it only can modify the part of the app that has been implemented in Java/dex code. Web browsers are mostly written in C/C++ or other languages that compile to native code (ARMv7/ARMv8, ...). Those parts can not be modified using Xposed.

If you want to do so you have to use Frida.

ViRb3 commented 4 years ago

As suggested by the Troubleshooting section, try sniffing Google Chrome's traffic. Last time I tried it worked, so you can use it as a benchmark.

beppe9000 commented 4 years ago

I recompiled the app and the problem solved itself. Indeed I can see all other apps traffic too.

ViRb3 commented 4 years ago

Did you recompile TrustMeAlready or your target app?

beppe9000 commented 4 years ago

The target app... it's bizarre.

ViRb3 commented 4 years ago

Interesting. I think what solved was something else, but glad it got sorted out either way :)

beppe9000 commented 4 years ago

Yeah I do too. I dump some detail here: I am using the magisk module that copies CA certificates to system store with the one generated by fidler 5 but they would not be trusted. I recompiled the app to a lower api version, reinstalled using lucky patcher, rebooted and boom everything works from every app.