I wish to analyze the unencrypted data sent of SSL by an Android APK that uses certificate pinning.
This suspicious APK is used to configure a wireless device.
I need to determine two things:
- First, the WPA key the APK establishes with the device
- Then, the sequence of HTTPS API calls that the APK uses to configure the device.
The configuration process is:
- Download obfuscated APK from company site
- Create account on their servers,
- The APK then connects to the device SSID with a private WPA key
- There is a native .so that does some calculation of the key
The HTTPS sessions to the Internet server use a fixed certificate, attempting to proxy results in a certificate error.
Ideally I would like to use an emulation environment, and hook the library calls (similar to what "Droidbox" appeared to do), but I can't find a more recent version.