|
1 | 1 | Android Notes
|
2 | 2 | ===
|
3 | 3 |
|
4 |
| -SSLPinning |
5 |
| --- |
6 |
| -Auto |
7 |
| --- |
8 |
| -Xposed + JustTrustMe |
9 |
| - |
10 |
| -Manual |
11 |
| --- |
12 |
| -If the hooking doesn't work, we need to extract, patch smali code and zip align |
13 |
| -- `apktool -d test.apk` |
14 |
| -- Patch smali code or change builtin certificates. Search `TrustManager` or `CertificatePinner` |
15 |
| -- `apktool b test/ -o modified.apk` |
16 |
| -- `zipalign -v 4 modified.apk` |
| 4 | +# Android Emulator |
17 | 5 |
|
18 |
| -Frida |
19 |
| --- |
20 |
| -- Download [Frida Server](https://github.com/frida/frida/releases) for Android Emulator, unpack and rename it to `frida-server-android-x86` |
21 |
| -- Transfer to Emulator and start it |
| 6 | +## Root emulator and install Magisk |
22 | 7 |
|
23 |
| -```bash |
24 |
| -adb push frida-server-android-x86 /data/local/tmp/frida-server |
25 |
| -adb shell chmod 777 /data/local/tmp/frida-server |
26 |
| -adb shell /data/local/tmp/frida-server & |
| 8 | +- Enable cold boot |
| 9 | +- Install rootAVD and find your ramdisk |
27 | 10 | ```
|
28 |
| -- Find the identifer of the app |
| 11 | +git clone https://github.com/newbit1/rootAVD.git |
| 12 | +cd rootAVD |
| 13 | +./rootAVD.sh ListAllAVDs |
29 | 14 | ```
|
30 |
| -frida-ps -Ua |
| 15 | + |
| 16 | +- Patch the ramdisk |
| 17 | +``` |
| 18 | +./rootAVD.sh system-images/android-33/google_apis_playstore/arm64-v8a/ramdisk.img |
31 | 19 | ```
|
| 20 | + |
| 21 | +## Install Frida |
| 22 | +- Open Magisk |
| 23 | +- Reboot |
| 24 | +- Download https://github.com/ViRb3/magisk-frida/releases |
| 25 | +- Copy zip file to emulator by drag and drop |
| 26 | +- Open Magisk and install from storage |
| 27 | +- Check if frida is working via `frida-ps -U` |
32 | 28 | - Start the app
|
33 | 29 |
|
| 30 | +# SSLPinning |
| 31 | + |
| 32 | +## Auto |
| 33 | + |
| 34 | +- [Trust User Certs](https://github.com/lupohan44/TrustUserCertificates) |
| 35 | +- Frida |
| 36 | +``` |
| 37 | +frida -U -l ./frida-script.js -f <identifier> |
34 | 38 | ```
|
35 |
| -frida --no-pause -U -l ./frida-script.js -f <identifier> |
36 |
| -``` |
| 39 | + |
| 40 | +## Manual |
| 41 | + |
| 42 | +If the hooking doesn't work, we need to extract, patch smali code and zip align |
| 43 | +- `apktool -d test.apk` |
| 44 | +- Patch smali code or change builtin certificates. Search `TrustManager` or `CertificatePinner` |
| 45 | +- `apktool b test/ -o modified.apk` |
| 46 | +- `zipalign -v 4 modified.apk` |
0 commit comments