Memexurer
commented
3 months ago even after you manage to bypass bumble ssl pins, then you will still get blocked by their backend - maybe they have some JA3 checks for checking if you are mitming requests?
anyways; maybe it will help you: here's my frida script for capturing some of data sent by that custom protocol (also no clue if it will work on newer versions, because the class names could be different)
Java.perform(() => {
let yb7 = Java.use("b.yb7");
yb7["i"].implementation = function (c26527sn) {
//send message; if you view this method in jadx then you'll find all the classes responsible for receiving/sending messages
let gson = Java.use("b.jng").$new();
console.log(gson.h(c26527sn));
this["i"](c26527sn);
};
let mzu = Java.use("b.mzu");
mzu["invoke"].overload().implementation = function () {
//IP pin bypass; you have to use this with --codeshare 007panda/unpinning
return null;
};
})also: use mitmproxy instead of http toolkit, because, as you said, it doesnt support this custom message protocol and it could mess with the data
dkbarn
vikasg603
I am using HTTP Toolkit with a rooted Pixel 5 device running Android 14. It works like a charm for most apps. Now I am trying to inspect an app that uses certificate pinning, specifically com.bumble.app.
This app communicates with host bma.bumble.com over a raw SSL/TLS socket (not HTTP) using a proprietary variant of the gRPC / Protobuf protocol. I don't expect HTTP Toolkit to have a way of parsing this data, but I do want to inspect the unencrypted raw binary data.
I have followed all instructions at https://httptoolkit.com/blog/frida-certificate-pinning/
My device contains frida-server-16.3.3-android-arm64 and it is actively running. My computer has frida-tools 12.4.3 and I've confirmed everything is working by running
frida-ps -U. I've added my certificate into config.js and also enabled debug mode to get more logging output. Here is the output:Over in HTTP Toolkit, I can see that it is intercepting something, but it's not able to recognize it and it just shows up as garbage that can't be processed. Furthermore, the app itself fails to populate. I can click around on various views, but none of the communication with its backend server is actually working.