0

I'm working on one Android app for potential malware analysis and I am trying to MITM it. I found out that the verify function never executes (X509 class) when i hook onto my proxy but rather that app fails upon reaching this function

SSLEngineResult unwrap = this.f13022c.f13031h.unwrap(byteBuffer, a2);

This object is part of javax.net.ssl.SSLEngineResult

The exception that this function triggers is javax.net.ssl.SSLHandshakeException: Handshake failed. I had feeling that they check system proxy and if its present that they mess with byteBuffer but that wasn't the case. I attached proxy without serving self signed certificate and app works normally, just the moment i attach self signed certificate trough Fiddler, it crashes on this function and exception occurs. It seems like this entire proccess of handshaking is causing problems and i don't know why. Could it be that the app devs did this on purpose somehow on lower level or could it be that this function itself is not working properly with my certificate (which should be the case really)

Fiddler config enter image description here

Improve this question
2
  • When using Fiddler classic make sure you have the "CertMaker for iOS and Android" update installed and selected "BCertMaker" as the cert generator.
    – Robert
    Mar 29, 2021 at 12:41
  • @Robert I just did what you told me and it still didnt work. I tried another proxy called HTTPToolkit an opensource mitm proxy and it worked! It works on same principle as Fiddler except it opens VPN connection. What could be the issue here? I tried few more proxies such as mitmproxy but it doesn't work. I added picture of fiddler config after installing this new BCert marker
    – TrueStar
    Mar 29, 2021 at 16:03

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.