Como Quebrar SSL Pinning em Aplicativos Android

// ssl_bypass.js — SSL Pinning Bypass universal para Android
// Hooks: OkHttp3, TrustManager, SSLContext, Conscrypt

setTimeout(function() {
  Java.perform(function() {

    // ── 1. Hook no TrustManager customizado ──
    var TrustManager = Java.registerClass({
      name: 'com.sslbypass.CustomTrustManager',
      implements: [Java.use('javax.net.ssl.X509TrustManager')],
      methods: {
        checkClientTrusted(chain, authType) {},
        checkServerTrusted(chain, authType) {},
        getAcceptedIssuers() { return []; }
      }
    });

    // ── 2. Hook no SSLContext para substituir TrustManager ──
    var SSLContext = Java.use('javax.net.ssl.SSLContext');
    SSLContext.init.overload(
      '[Ljavax.net.ssl.KeyManager;',
      '[Ljavax.net.ssl.TrustManager;',
      'java.security.SecureRandom'
    ).implementation = function(km, tm, sr) {
      console.log('[*] SSLContext.init hooked — injetando TrustManager customizado');
      this.init(km, [TrustManager.$new()], sr);
    };

    // ── 3. Hook no OkHttp3 CertificatePinner ──
    try {
      var CertificatePinner = Java.use('okhttp3.CertificatePinner');
      CertificatePinner.check.overload(
        'java.lang.String', 'java.util.List'
      ).implementation = function(hostname, peerCertificates) {
        console.log('[*] OkHttp3 CertificatePinner.check bypassed para: ' + hostname);
        return;
      };
      CertificatePinner.check.overload(
        'java.lang.String', '[Ljava.security.cert.Certificate;'
      ).implementation = function(hostname, certs) {
        console.log('[*] OkHttp3 CertificatePinner.check (v2) bypassed para: ' + hostname);
        return;
      };
    } catch(e) { console.log('[-] OkHttp3 não encontrado: ' + e); }

    // ── 4. Hook no Conscrypt (Android Network Security) ──
    try {
      var ConscryptPin = Java.use('com.android.org.conscrypt.TrustManagerImpl');
      ConscryptPin.verifyChainAndCheckPins.implementation = function(chain, host) {
        console.log('[*] Conscrypt checkPins bypassed para: ' + host);
        return this.checkTrustedRecursive(chain[0], host, true, null, null, null);
      };
    } catch(e) { console.log('[-] Conscrypt hook ignorado: ' + e); }

    // ── 5. HostnameVerifier ──
    var HostnameVerifier = Java.use('javax.net.ssl.HttpsURLConnection');
    HostnameVerifier.setDefaultHostnameVerifier.implementation = function(v) {
      console.log('[*] HostnameVerifier substituído');
      var bypass = Java.registerClass({
        name: 'com.sslbypass.AllHostsVerifier',
        implements: [Java.use('javax.net.ssl.HostnameVerifier')],
        methods: { verify: function(h, s) { return true; } }
      });
      this.setDefaultHostnameVerifier(bypass.$new());
    };

    console.log('[+] SSL Pinning Bypass carregado com sucesso!');
  });
}, 0);

// ssl_bypass.js — SSL Pinning Bypass universal para Android
// Hooks: OkHttp3, TrustManager, SSLContext, Conscrypt

setTimeout(function() {
  Java.perform(function() {

    // ── 1. Hook no TrustManager customizado ──
    var TrustManager = Java.registerClass({
      name: 'com.sslbypass.CustomTrustManager',
      implements: [Java.use('javax.net.ssl.X509TrustManager')],
      methods: {
        checkClientTrusted(chain, authType) {},
        checkServerTrusted(chain, authType) {},
        getAcceptedIssuers() { return []; }
      }
    });

    // ── 2. Hook no SSLContext para substituir TrustManager ──
    var SSLContext = Java.use('javax.net.ssl.SSLContext');
    SSLContext.init.overload(
      '[Ljavax.net.ssl.KeyManager;',
      '[Ljavax.net.ssl.TrustManager;',
      'java.security.SecureRandom'
    ).implementation = function(km, tm, sr) {
      console.log('[*] SSLContext.init hooked — injetando TrustManager customizado');
      this.init(km, [TrustManager.$new()], sr);
    };

    // ── 3. Hook no OkHttp3 CertificatePinner ──
    try {
      var CertificatePinner = Java.use('okhttp3.CertificatePinner');
      CertificatePinner.check.overload(
        'java.lang.String', 'java.util.List'
      ).implementation = function(hostname, peerCertificates) {
        console.log('[*] OkHttp3 CertificatePinner.check bypassed para: ' + hostname);
        return;
      };
      CertificatePinner.check.overload(
        'java.lang.String', '[Ljava.security.cert.Certificate;'
      ).implementation = function(hostname, certs) {
        console.log('[*] OkHttp3 CertificatePinner.check (v2) bypassed para: ' + hostname);
        return;
      };
    } catch(e) { console.log('[-] OkHttp3 não encontrado: ' + e); }

    // ── 4. Hook no Conscrypt (Android Network Security) ──
    try {
      var ConscryptPin = Java.use('com.android.org.conscrypt.TrustManagerImpl');
      ConscryptPin.verifyChainAndCheckPins.implementation = function(chain, host) {
        console.log('[*] Conscrypt checkPins bypassed para: ' + host);
        return this.checkTrustedRecursive(chain[0], host, true, null, null, null);
      };
    } catch(e) { console.log('[-] Conscrypt hook ignorado: ' + e); }

    // ── 5. HostnameVerifier ──
    var HostnameVerifier = Java.use('javax.net.ssl.HttpsURLConnection');
    HostnameVerifier.setDefaultHostnameVerifier.implementation = function(v) {
      console.log('[*] HostnameVerifier substituído');
      var bypass = Java.registerClass({
        name: 'com.sslbypass.AllHostsVerifier',
        implements: [Java.use('javax.net.ssl.HostnameVerifier')],
        methods: { verify: function(h, s) { return true; } }
      });
      this.setDefaultHostnameVerifier(bypass.$new());
    };

    console.log('[+] SSL Pinning Bypass carregado com sucesso!');
  });
}, 0);