httptoolkit / frida-interception-and-unpinning

Frida scripts to directly MitM all HTTPS traffic from a target mobile application
https://httptoolkit.com/android/
GNU Affero General Public License v3.0
905 stars 178 forks source link

How to automatically unpin every application ? #22

Closed yoshimo closed 2 years ago

yoshimo commented 2 years ago

This solution is nice as it avoids the trouble of repacking and patching apps statically and some of the integrity checks they do. Can we patch the known checks automatically on startup of the app somehow? It is a bit complicated to start apps manually with frida that interact with each other like apps that use the google play store&services to check licenses. Same is true for automatically started OS components and oem bloatware apps. There used to be Magisk Modules but they are outdated and not maintained at the moment.

pimterry commented 2 years ago

It would be lovely to do that, but unfortunately I don't have any idea myself! I think this is probably a question for the Frida team, not for this specific script. I'd suggest looking through their docs or filing an issue over there to explore this further. They're also quite open to feature requests & PRs, so you could even add this as a new feature if it doesn't exist already.

I'm going to close this here, since it's not related to this specific script, but I would be very interested if you find an answer. Do let me know if there's some way to do that and I'll update the article so that other users can do the same thing. I totally agree this would make life easier!

yoshimo commented 2 years ago

https://gist.github.com/oleavr/ae7bcbbb9179852a4731 was suggested by the frida chat team.

yoshimo commented 2 years ago

https://gist.github.com/oleavr/ae7bcbbb9179852a4731 was suggested by the frida chat team.

@pimterry is that something we can make use of in this script?

pimterry commented 2 years ago

@yoshimo not directly. It's a separate independent thing: from what I can tell, that gist shows how to listen for new processes and automatically run scripts when they launch. This repo contains one such script, so you could run this unpinning script in that way (just replace the inline example script with this script, or load this script from a file and use it there) but you could also run any other script you like. It's a wrapper that provides a different way to run any arbitrary Frida script really.

I don't think we should change the base script to include that wrapper here, since there's many cases where you just want the script by itself. It makes more sense to have them separate, and to use them together when you want that extra functionality.

If you want to help people to automatically unpin every app, I think the best way would be to extend that example gist so it takes the target script as an argument, then publish that in some standalone form that's easy for people to download & use, and then write some docs/blog posts about how to use your published wrapper together with this script to do automatic unpinning.