Android 7.0+ Monitoring application HTTPS requests

Question

I am trying to capture https requests an application performs during runtime without any success yet. Different failing approaches, using mitmproxy / charles proxy and user ca certificates, obtaining smali code in order to bypass x509Certificate checks, installing ca cert as system to avoid certificate pinning, using different xposed applications (outdated, still worth a try), make me wonder what it is that I am missing. It is only possible to capture chrome's https traffic, other applications refuse to load / connect. To be fair, one might ask why I don't figure out myself where requests are built and log all needed information. Personally, I think a working method capturing said traffic saves a lot of time and work.

# virtual methods
.method public checkClientTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V
    .locals 1
return-void #!!

iget-object v0, p0, La/a/a/a/e/d/d$a;->a:Ljavax/net/ssl/X509TrustManager;

invoke-interface {v0, p1, p2}, Ljavax/net/ssl/X509TrustManager;->checkClientTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V

return-void
.end method

.method public checkServerTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V
    .locals 1

return-void #!!

iget-object v0, p0, La/a/a/a/e/d/d$a;->b:La/a/a/a/e/d/i;

invoke-interface {v0, p1, p2}, La/a/a/a/e/d/i;->a([Ljava/security/cert/X509Certificate;Ljava/lang/String;)Z

move-result v0

if-nez v0, :cond_0

iget-object v0, p0, La/a/a/a/e/d/d$a;->a:Ljavax/net/ssl/X509TrustManager;

    invoke-interface {v0, p1, p2}, Ljavax/net/ssl/X509TrustManager;->checkServerTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V

    :cond_0
    return-void
.end method

.method public getAcceptedIssuers()[Ljava/security/cert/X509Certificate;
    .locals 1

return-void #!!

iget-object v0, p0, La/a/a/a/e/d/d$a;->a:Ljavax/net/ssl/X509TrustManager;

invoke-interface {v0}, Ljavax/net/ssl/X509TrustManager;->getAcceptedIssuers()[Ljava/security/cert/X509Certificate;

move-result-object v0

return-object v0
.end method

If you're successfully capturing traffic (especially https) please let me know your procedure in order to achieve what the question is asking for.

Answer 1

Do you have root on your phone or not? If yes - install xposed framework and try one of this modules:

1. SSLUnpining
2. JustTrustMe

As the alternative to xposed framework you can use frida and

universal bypass script

If you don't have root on your device you need to change the smali code in few places, look for SSlContext and SSLSocketFactory.

You can check this implementation of trust manager and recreate this in the app.