search

httptoolkit / frida-interception-and-unpinning

Frida scripts to directly MitM all HTTPS traffic from a target mobile application
https://httptoolkit.com/android/
GNU Affero General Public License v3.0
905 stars 178 forks source link

Google Play Store Android API 18 #43

Closed ghost closed 7 months ago

ghost commented 10 months ago

this is a long shot, but I figure it cant hurt to post this in case others have mess with it. I am trying to intercept older Google Play Stores, and I can get all the newer versions but got stuck on API 18. I first tried MITM Proxy with a "user certificate", then tried again with a "system certificate":

https://docs.mitmproxy.org/stable/howto-install-system-trusted-ca-android/#instructions-for-api-level--28-using--writable-system-1

and confirmed that the system certificate is installed in the Trusted credentials. However I still am not capturing any requests for some reason. so I had the idea that maybe the older Play Store are using pinning or something. so I tried Frida with the script here, not even using MITM Proxy, just to see what would happen. however Frida will not complete:

> adb shell /data/app/frida-server
CANNOT LINK EXECUTABLE: cannot locate symbol "statvfs" referenced by
"/data/app/frida-server"...

I figure I am using wrong version of Frida server:

https://github.com/frida/frida/releases/download/16.0.0/frida-server-16.0.0-android-x86.xz

but just wanted to see if anyone had messed with this.

ghost commented 10 months ago

OK I finally got Frida working with version 15.1.11 and Frida tools 11.0.0, but still not capturing any requests, so not sure what voodoo the app is using.

ghost commented 10 months ago

OK I made a little progress by changing MITM Proxy tls_version_client_min to UNBOUNDED. this allowed to capture Android browser HTTPS requests, but Play Store still getting blocked. I tried logcat, but not really sure what I am looking for