I want to understand how to do a Cert pinning bypass.

So this is what I've attempted:

Attempt 1

Use frida-trace -U THEAPPNAME -i "*NSURL*"

The problem with this approach is that is not matching anything when I try to navigate. But I can see the attempt on the Proxy I'm using to inspect the traffic.

Ok, no problem I'll try something different.

Attempt 2

No worries, I'll search for the string(URL) on the image and add a watchpoint to read from that address.

(lldb) platform select remote-ios
(lldb) process connect connect://
(lldb) section
[0x00000000000000-0x00000100000000] 0x0100000000 Instagram`__PAGEZERO
[0x00000100f28000-0x00000103d14000] 0x0002dec000 Instagram`__TEXT
[0x00000103d14000-0x00000104fd8000] 0x00012c4000 Instagram`__DATA
[0x00000104fd8000-0x000001051cc000] 0x00001f4000 Instagram`__RODATA
[0x000001051cc000-0x000001055dc000] 0x0000410000 Instagram`__LINKEDIT
(lldb) mem find -s "the_URL_IM_SEARCHING_FOR.com" -- 0x00000103d14000 0x00000104fd8000
I Get a match let's say address 0x104b73067
(lldb) watchpoint set expression -s 1 -w read -- 0x104b73067
The Watchpoint is set

But I get nothing, when I run the app but I still get the attempt in the proxy.

Attempt 3

Alright, I'll search for the certificate on the image!

(lldb) mem find -s "CERTIFICATE" -- 0x00000100f28000 0x00000103d14000
I searched for the certificate on all the sections and couldn't find it.

So I'm not sure how to proceed. I've read on may places "how to do it", but they always know the function to hook to, or they know the memory address to watch. I don't want to use a library/script/framework that already does it, the purpose is to learn. But I did try using objection to bypass the Cert pinning (And then I was going to understand how it does it), but it didn't work for this app, so they are doing some custom cert pinning not the standard way.

The problem is finding that key information. The tutorials are not that realistic, if I already know how I implemented the SSL pinning I know which function to search for.

In general how do you go reversing this problem? Any tips/helps, or any general ReverseEngineering Resources where I can learn this?

Any help would be appreciated.

  • 1
    Searching for the certificate is not very effective because cert pinning is usually don on the certificate hash or the public key hash of one of the involved certificates (usually root or leaf certificate). If you want to bypass cert pinning you first have to understand how it is implemented. To do so loading the decrypted app binary into a tool like IDA or Ghidra is recommended. Then use the delegate that performs the cert checking and potentially also pinning. If that does not help the search is getting complicated. If you are luck a open source network library like AFNetworking is used. – Robert Mar 7 at 12:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.