pimterry
commented
2 weeks ago Interesting! Thanks for the detailed report.
What happens if you skip the native-tls-hook.js script? That seems to be throwing an error here (the access violation accessing 0x0 message). It's not clear whether that's the real underlying cause, but there's definitely something unusual going on there.
The CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found. message from com.android.org.conscrypt.TrustManagerImpl->checkTrustedRecursive implies that the certificate isn't trusted by the basic Android certificate stores, which is unusual. That's supposed to be fixed by android-system-certificate-injection.js, which modifies the cached used by that store (and various other places) so that the certificate you add in config.js is pre-trusted. The fact that that's failing means either something is breaking that pretty basic & normally quite reliable patch (which could be the access violation error above, or something else) or the certificate in your config.js isn't actually correct.
In general it would be interesting to try skipping various scripts or commenting out certain patches, to see if you can work out which part of these scripts is causing this issue. It's also worth running using Frida but with no scripts at all - some apps actively detect Frida and fight against it, and some versions of Frida have bugs that crash under certain conditions, which means sometimes apps will crash with any use of Frida (regardless of these scripts).
luisfernandez93
so I have been trying to use this btw thank you very much... so my current setup is
android emulator, pixel 3a upsidedowncake, frida and proxyman,
what i did:
override config.js in this repo with my own cert_pem which proxyman i think puts in
/Users/blabla/.proxyman/proxyman-ca.pemthen i ran the following:
what I see in logs:
The app starts and then shuts off.
this is what i see in when i use
adb logcat -T1