I want to understand how to do a Cert pinning bypass.
So this is what I've attempted:
frida-trace -U THEAPPNAME -i "*NSURL*"
The problem with this approach is that is not matching anything when I try to navigate. But I can see the attempt on the Proxy I'm using to inspect the traffic.
Ok, no problem I'll try something different.
No worries, I'll search for the string(URL) on the image and add a
watchpoint to read from that address.
(lldb) platform select remote-ios (lldb) process connect connect://127.0.0.1:1234 (lldb) section [0x00000000000000-0x00000100000000] 0x0100000000 Instagram`__PAGEZERO [0x00000100f28000-0x00000103d14000] 0x0002dec000 Instagram`__TEXT [0x00000103d14000-0x00000104fd8000] 0x00012c4000 Instagram`__DATA [0x00000104fd8000-0x000001051cc000] 0x00001f4000 Instagram`__RODATA [0x000001051cc000-0x000001055dc000] 0x0000410000 Instagram`__LINKEDIT (lldb) mem find -s "the_URL_IM_SEARCHING_FOR.com" -- 0x00000103d14000 0x00000104fd8000 I Get a match let's say address 0x104b73067 (lldb) watchpoint set expression -s 1 -w read -- 0x104b73067 The Watchpoint is set
But I get nothing, when I run the app but I still get the attempt in the proxy.
Alright, I'll search for the certificate on the image!
(lldb) mem find -s "CERTIFICATE" -- 0x00000100f28000 0x00000103d14000 I searched for the certificate on all the sections and couldn't find it.
So I'm not sure how to proceed. I've read on may places "how to do it", but they always know the function to hook to, or they know the memory address to watch. I don't want to use a library/script/framework that already does it, the purpose is to learn. But I did try using
objection to bypass the Cert pinning (And then I was going to understand how it does it), but it didn't work for this app, so they are doing some custom cert pinning not the standard way.
The problem is finding that key information. The tutorials are not that realistic, if I already know how I implemented the SSL pinning I know which function to search for.
In general how do you go reversing this problem? Any tips/helps, or any general ReverseEngineering Resources where I can learn this?
Any help would be appreciated.