httptoolkit / frida-interception-and-unpinning

Frida scripts to directly MitM all HTTPS traffic from a target mobile application
https://httptoolkit.com/android/
GNU Affero General Public License v3.0
905 stars 178 forks source link

Game refuses to Connect/Boot after even after SSL Unpinning #4

Open Axovur opened 2 years ago

Axovur commented 2 years ago

While I have followed the guide on SSL unpinning and able to view Twitter's packets, this particular game/app still refuses to connect after the execution of this script or via Objection's unpinning.

The game I am referring to is Fate/Grand Order, here are the links to them on the Play Store: https://play.google.com/store/apps/details?id=com.aniplex.fategrandorder.en https://play.google.com/store/apps/details?id=com.aniplex.fategrandorder

The first link is the English version, and the other is the Japanese version. The Japanese version is more ahead in terms of content, and the English version is following its release path in terms of playable content (but there are certain features on the client that are released ahead of its time according to JP's schedule). The behaviour of the 2 Apps differ a little after HTTP Toolkit is connected, the English version gets stuck on "Connecting", while the Japanese version has a pop up saying the game needs updating or something. After running the script image or even running Objection's unpinning image the game would still refuse to connect. image My current guess is that neither this script nor Objection was unable to unpin it. (or it has somehow detected it to be unpinned thus refusing to connect?) My current device is MuMu, which I'm pretty sure is a slightly modified version of the more popular emulator MEmu with a few extra feature to suit the games I'm playing. (I have installed the CA cert using https://play.google.com/store/apps/details?id=net.jolivier.cert.Importer (since emulators allow me to toggle root effortlessly).)

I'm not much a of a reverse engineer at all myself, so I'm not sure where else to look for the answers for this issue. I'm not sure about hooking and finding the function/method that checks Certificates but since this is a unity game, there might be a way to get started if you want to give it a try. There's a program called il2cppDumper using this I have found that you can dump the function names, but when I looked up the word 'certificate' in the dumped file, there's over 1700 results, and I don't have enough experience to identify which are the functions that are related in solving this issue.

To dump and find the functions, simply download il2cppDumper and the game APK. Open the game APK like an archive and extract the following files: assets\bin\Data\Managed\Metadata\global-metadata.dat and either of the following: lib\armeabi-v7a\libil2cpp.so lib\arm64-v8a\libil2cpp.so Now run Il2CppDumper.exe and open the libil2cpp.so first and then global-metadata.dat. Give a few moments, the dump.cs should be generated and may have what you might be looking for...

EDIT: Updated a bit of info.