I am running an application in BlueStacks that was installed with Google Play and am trying to look at network packets which are encrypted using RSA over TLS. I can see the client key exchange packet in the TLS handshake but do not know where to find my private key within the BlueStacks emulator to decrypt the messages after the handshake (I am trying to man-in-the-middle myself). Where is this located?

  • That the PlayStore should use TLS with client certificate is new to me. The last time I checked the communication was plain TLS just with certificate pinning. On a device with XPosed + TrustMeAlready or using Frida + a script for unpinning you should be able to intercept the PlayStore communication. I don't have any experience how to do this on BlueStacks. From my experience Charles proxy is the best to do so as it has the best ProtoBuf support among all interception-proxies I know.
    – Robert
    May 31 '20 at 15:58
  • These were great tips. WireShark was showing me TLS packets and a client key exchange so I dumbly assumed I needed to decrypt packets. Once I used Charles proxy (really nice program!), it looked like it should work but there was a cert issue. Long story short (this took me most of the day): 1) I set up a new Google account since I don't trust rooting. 2) I used BSTweaker to root BlueStacks then installed SuperSU to allow installing Root Certificate Manager to install the Charles proxy cert. 3) I can now see the traffic! I also looked at Nox and Memu but they seemed dodgy. Many thanks!
    – REnoob
    Jun 1 '20 at 2:03
  • Please add an answer describing the solution if you solved it.
    – Igor Skochinsky
    Jun 4 '20 at 10:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.