audioteka certificate ssl pinning fails

[nonab]

I was trying to bypass audioteka app ssl pinning.
After few days of trying i finally managed to make it work by adding this script https://gist.github.com/teknogeek/4dc35fb3801bd7f13e5f0da5b784c725

how can i add it to the app so i don't have to execute it manually?
fork, add it to scripts and do a merge request or there's some different process?

[pimterry]

Hi @nonab! Extra additions are definitely welcome, just open a PR.

That said, most of the hooks in this list should already be present in android-certificate-unpinning.js, so I'd only want to include the hooks that we don't have already.

For example, this code we already have is equivalent to this code in your gist for SSLContext hooking. Similarly this OkHttp code should be equivalent to this bit of your gist.

We have a structured map of handlers here instead of just raw code, to make the very large number of very similar hooks a bit more manageable, but the end result should be exactly the same.

Can you try running your app with the Android unpinning scripts here plus that gist, and then try commenting out the different parts from the gist, until you know exactly which bit is actually required to fix your app?

[nonab]

huh looks like they updated application.
I found a working code but it's not that easy to create a PR with it (at least for me)

i was able to add TrustManagerImpl but second thing looks like it's "okhttp3.CertificatePinner" but with a different name "okhttp3.CertificatePinner.b"

https://gist.github.com/akabe1/5632cbc1cd49f0237cbd0a93bc8e4452#file-frida_multiple_unpinning-js-L804

looks like android-certificate-unpinning-fallback.js caught this one

`== Unpinning fallback auto-patcher installed ==

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate pinning failure!
Peer certificate chain:
sha256/Fb/AmraDyWlbbLsu92RdNO+ke5rAeR+cLjAA5vU8VMo=: O=Mockttp Cert - DO NOT TRUST,L=Unknown,C=XX,CN=api-audioteka.audioteka.com
sha256/tp4UkWAZRzUA2uHCpN0yQoqvSypJ4FLlHNphLJ4YmSA=: O=HTTP Toolkit CA,C=XX,CN=HTTP Toolkit CA
Pinned certificates for api-audioteka.audioteka.com:
sha256/++MBgDH5WGvL9Bcn5Be30cRcL0f5O+NyoXuWtQdX1aI=
sha256/Y9mvm0exBk1JoQ57f9Vm28jKo5lFm/woKcVxrYxu80o=
sha256/qiYwp7YXsE0KKUureoyqpQFubb5gSDeoOoVxn6tmfrU=
sha256/58qRu/uxh4gFezqAcERupSkRYBlBAvfcw7mEjGPLnNU=
sha256/x4QzPSC810K5/cMjb05Qm4k3Bw5zBn4lTdO/nEW/Td4=
Thrown by okhttp3.CertificatePinner->b
[+] okhttp3.CertificatePinner->b (fallback OkHttp patch)`

any idea how to fix this ?

[pimterry]

i was able to add TrustManagerImpl

Does that mean the TrustManagerImpl hook here is required for you app to work? That's a bit surprising but quite interesting, and suggests there is a hook we could add here to do that too.

any idea how to fix this ?

That fallback output actually means that this is working correctly. The classname is obfuscated (randomly generated - so we can't write a hook to match the classname) but the first time it is actually used to block a connection, the fallback script detects it and fixes it, disabling that check automatically.

That means when you run the app, you should see one failing connection and then all subsequent connections will work. Is that what's happening here?

If so, that's expected, and the best we can do (since we can't spot these in advance). If you really need to you can create a custom hook for this yourself to match that exact classname, but that hook may well stop working with each future update of the app, and for most cases you don't need to - generally as TLS failure will be retried shortly afterwards and then everything will work as expected.