author : xingjun.xyf
 *  contact file time desc exports . UnpinningPlus = function ( ) { Java . perform ( function ( ) { var X509TrustManager = Java . use ( 'javax.net.ssl.X509TrustManager' ) ; var HostnameVerifier = Java . use ( 'javax.net.ssl.HostnameVerifier' ) ; var SSLContext = Java . use ( 'javax.net.ssl.SSLContext' ) ; var quiet_output = false ; function quiet_send ( data ) { if ( quiet_output ) { return ; } send ( data ) ; } var X509Certificate = Java . use ( "java.security.cert.X509Certificate" ) ; var TrustManager ; try { TrustManager = Java . registerClass ( { name : 'org.wooyun.TrustManager' , implements : [ X509TrustManager ] , methods : { checkClientTrusted : function ( chain , authType ) { } , checkServerTrusted : function ( chain , authType ) { } , getAcceptedIssuers : function ( ) { return [ ] ; } } } ) ; } catch ( e ) { quiet_send ( "registerClass from X509TrustManager >>>>>>>> " + e . message ) ; } var TrustManagers = [ TrustManager . $new ( ) ] ; try { var TLS_SSLContext = SSLContext . getInstance ( "TLS" ) ; TLS_SSLContext . init ( null , TrustManagers , null ) ; var EmptySSLFactory = TLS_SSLContext . getSocketFactory ( ) ; } catch ( e ) { quiet_send ( e . message ) ; } send ( 'Custom, Empty TrustManager ready' ) ; var SSLContext_init = SSLContext . init . overload ( '[Ljavax.net.ssl.KeyManager;' , '[Ljavax.net.ssl.TrustManager;' , 'java.security.SecureRandom' ) ; SSLContext_init . implementation = function ( keyManager , trustManager , secureRandom ) { quiet_send ( 'Overriding SSLContext.init() with the custom TrustManager' ) ; SSLContext_init . call ( this , null , TrustManagers , null ) ; } ; /*** okhttp3.x unpinning ***/ try { var CertificatePinner = Java . use ( 'okhttp3.CertificatePinner' ) ; quiet_send ( 'OkHTTP 3.x Found' ) ; CertificatePinner . check . overload ( 'java.lang.String' , 'java.util.List' ) . implementation = function ( ) { quiet_send ( 'OkHTTP 3.x check() called. Not throwing an exception.' ) ; } ; } catch ( err ) { if ( err . message . indexOf ( 'ClassNotFoundException' ) === 0 ) { throw new Error ( err ) ; } } try { var PinningTrustManager = Java . use ( 'appcelerator.https.PinningTrustManager' ) ; send ( 'Appcelerator Titanium Found' ) ; PinningTrustManager . checkServerTrusted . implementation = function ( ) { quiet_send ( 'Appcelerator checkServerTrusted() called. Not throwing an exception.' ) ; } ; } catch ( err ) { if ( err . message . indexOf ( 'ClassNotFoundException' ) === 0 ) { throw new Error ( err ) ; } } /*** okhttp unpinning ***/ try { var OkHttpClient = Java . use ( "com.squareup.okhttp.OkHttpClient" ) ; OkHttpClient . setCertificatePinner . implementation = function ( certificatePinner ) { quiet_send ( "OkHttpClient.setCertificatePinner Called!" ) ; return this ; } ; var CertificatePinner = Java . use ( "com.squareup.okhttp.CertificatePinner" ) ; CertificatePinner . check . overload ( 'java.lang.String' , '[Ljava.security.cert.Certificate;' ) . implementation = function ( p0 , p1 ) { quiet_send ( "okhttp Called! [Certificate]" ) ; return ; } ; CertificatePinner . check . overload ( 'java.lang.String' , 'java.util.List' ) . implementation = function ( p0 , p1 ) { quiet_send ( "okhttp Called! [List]" ) ; return ; } ; } catch ( e ) { quiet_send ( "com.squareup.okhttp not found" ) ; } /*** WebView Hooks ***/ var WebViewClient = Java . use ( "android.webkit.WebViewClient" ) ; WebViewClient . onReceivedSslError . implementation = function ( webView , sslErrorHandler , sslError ) { quiet_send ( "WebViewClient onReceivedSslError invoke" ) ; sslErrorHandler . proceed ( ) ; return ; } ; WebViewClient . onReceivedError . overload ( 'android.webkit.WebView' , 'int' , 'java.lang.String' , 'java.lang.String' ) . implementation = function ( a , b , c , d ) { quiet_send ( "WebViewClient onReceivedError invoked" ) ; return ; } ; WebViewClient . onReceivedError . overload ( 'android.webkit.WebView' , 'android.webkit.WebResourceRequest' , 'android.webkit.WebResourceError' ) . implementation = function ( ) { quiet_send ( "WebViewClient onReceivedError invoked" ) ; return ; } ; /*** JSSE Hooks ***/ var HttpsURLConnection = Java . use ( "javax.net.ssl.HttpsURLConnection" ) ; HttpsURLConnection . setDefaultHostnameVerifier . implementation = function ( hostnameVerifier ) { quiet_send ( "HttpsURLConnection.setDefaultHostnameVerifier invoked" ) ; return null ; } ; HttpsURLConnection . setSSLSocketFactory . implementation = function ( SSLSocketFactory ) { quiet_send ( "HttpsURLConnection.setSSLSocketFactory invoked" ) ; return null ; } ; HttpsURLConnection . setHostnameVerifier . implementation = function ( hostnameVerifier ) { quiet_send ( "HttpsURLConnection.setHostnameVerifier invoked" ) ; return null ; } ; /*** Xutils3.x hooks ***/ var TrustHostnameVerifier ; try { TrustHostnameVerifier = Java . registerClass ( { name : 'org.wooyun.TrustHostnameVerifier' , implements : [ HostnameVerifier ] , method : { verify : function ( hostname , session ) { return true ; } } } ) ; } catch ( e ) { quiet_send ( "registerClass from hostnameVerifier >>>>>>>> " + e . message ) ; } try { var RequestParams = Java . use ( 'org.xutils.http.RequestParams' ) ; RequestParams . setSslSocketFactory . implementation = function ( sslSocketFactory ) { sslSocketFactory = EmptySSLFactory ; return null ; } ; RequestParams . setHostnameVerifier . implementation = function ( hostnameVerifier ) { hostnameVerifier = TrustHostnameVerifier . $new ( ) ; return null ; } ; } catch ( e ) { quiet_send ( "Xutils hooks not Found" ) ; } /*** httpclientandroidlib Hooks ***/ try { var AbstractVerifier = Java . use ( "ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier" ) ; AbstractVerifier . verify . overload ( 'java.lang.String' , '[Ljava.lang.String' , '[Ljava.lang.String' , 'boolean' ) . implementation = function ( ) { quiet_send ( "httpclientandroidlib Hooks" ) ; return null ; } ; } catch ( e ) { quiet_send ( "httpclientandroidlib Hooks not found" ) ; } /***
    android 7.0+ network_security_config TrustManagerImpl hook
    apache httpclient partly
    ***/ var TrustManagerImpl = Java . use ( "com.android.org.conscrypt.TrustManagerImpl" ) ; try { TrustManagerImpl . verifyChain . implementation = function ( untrustedChain , trustAnchorChain , host , clientAuth , ocspData , tlsSctData ) { quiet_send ( "TrustManagerImpl verifyChain called" ) ; return untrustedChain ; } ; } catch ( e ) { quiet_send ( "TrustManagerImpl verifyChain nout found below 7.0" ) ; } try { var OpenSSLSocketImpl = Java . use ( 'com.android.org.conscrypt.OpenSSLSocketImpl' ) ; OpenSSLSocketImpl . verifyCertificateChain . implementation = function ( certRefs , authMethod ) { quiet_send ( 'OpenSSLSocketImpl.verifyCertificateChain' ) ; } ; quiet_send ( 'OpenSSLSocketImpl pinning' ) ; } catch ( err ) { quiet_send ( 'OpenSSLSocketImpl pinner not found' ) ; } try { var Activity = Java . use ( "com.datatheorem.android.trustkit.pinning.OkHostnameVerifier" ) ; Activity . verify . overload ( 'java.lang.String' , 'javax.net.ssl.SSLSession' ) . implementation = function ( str ) { quiet_send ( 'Trustkit.verify1: ' + str ) ; return true ; } ; Activity . verify . overload ( 'java.lang.String' , 'java.security.cert.X509Certificate' ) . implementation = function ( str ) { quiet_send ( 'Trustkit.verify2: ' + str ) ; return true ; } ; quiet_send ( 'Trustkit pinning' ) ; } catch ( err ) { quiet_send ( 'Trustkit pinner not found' ) ; } try { var netBuilder = Java . use ( "org.chromium.net.CronetEngine$Builder" ) ; netBuilder . enablePublicKeyPinningBypassForLocalTrustAnchors . implementation = function ( arg ) { console . log ( "Enables or disables public key pinning bypass for local trust anchors = " + arg ) ; var ret = netBuilder . enablePublicKeyPinningBypassForLocalTrustAnchors . call ( this , true ) ; return ret ; } ; netBuilder . addPublicKeyPins . implementation = function ( hostName , pinsSha256 , includeSubdomains , expirationDate ) { console . log ( "cronet addPublicKeyPins hostName = " + hostName ) ; return this ; } ; } catch ( err ) { console . log ( '[-] Cronet pinner not found' ) ; } } ) ; } ;