I would like to analyse the traffic generated by one of the apps that I use.

This .app contains an OpenSSL 1.1.0 dylib in its Frameworks folder. I would like to extract the pre-master keys using the SSLKEYLOGFILE Environment-variable.

When using curl or Firefox this works fine but not with this app. So with curl or Firefox, Wireshark is able to use the keys for decryption.

What I did so far:

  • set SSLKEYLOGFILE variable
    • this results in a file with some key when I close the opened application
  • replace the included libssl.dylib in the .app with a newly compiled one to make sure it supports the extraction of the key
    • this leads to the same behavior
  • I tried this cript from here which was described here
    • I also do get a key but wireshark does not decrypt the traffic

So how would I extract the SSL pre-master key of a Mac app that includes its own libssl.dylib?

This is the content of the app

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy