diff --git a/android-certificate-unpinning.js b/android-certificate-unpinning.js index 598d986..5d4121c 100644 --- a/android-certificate-unpinning.js +++ b/android-certificate-unpinning.js @@ -123,6 +123,30 @@ const PINNING_FIXES = { } ], + // --- Native HostnameVerification override (n.b. Android contains its own vendored OkHttp v2!) + + 'com.android.okhttp.Address': [ + { + methodName: '$init', + replacement: () => { + const OkHostnameVerifier = Java.use("com.android.okhttp.internal.tls.OkHostnameVerifier"); + const defaultHostnameVerifier = OkHostnameVerifier.INSTANCE.value; + + const CertPinner = Java.use("com.android.okhttp.CertificatePinner"); + const defaultCertPinner = CertPinner.DEFAULT.value; + + return function () { + // Override arguments, to swap any custom check params (widely used + // to add stricter rules to TLS verification) with the defaults instead: + arguments[5] = defaultHostnameVerifier; + arguments[6] = defaultCertPinner; + + this.$init(...arguments); + } + } + } + ], + // --- OkHttp v3 'okhttp3.CertificatePinner': [ diff --git a/android-fallback-script.js b/android-fallback-script.js index 62605f1..b36b511 100644 --- a/android-fallback-script.js +++ b/android-fallback-script.js @@ -65,16 +65,10 @@ Java.perform(function () { // To do that, we effectively pattern match our way through all the // related types to work out what's what: - console.log('checking chain types...'); - const chainType = Java.use(method.argumentTypes[0].className); const responseTypeName = method.returnType.className; - console.log('got chain response type', responseTypeName); - const matchedChain = matchOkHttpChain(chainType, responseTypeName); - - console.log('matchedChain', matchedChain); return !!matchedChain; }; @@ -86,8 +80,6 @@ Java.perform(function () { ); if (matchingMethods.length !== 1) return; - console.log('got chain proceed method'); - const [proceedMethodName, proceedMethod] = matchingMethods[0]; if (proceedMethod.argumentTypes.length !== 1) return; @@ -101,8 +93,6 @@ Java.perform(function () { ); if (matchingFields.length !== 1) return; - console.log('got chain request field'); - const [requestFieldName] = matchingFields[0]; return {