I need to capture https traffic of Instagram Lite app (com.instagram.lite). So I tried to use http-toolkit. I have rooted android device and used adb method, http-toolkit app on my phone tells everything ok and fake certificate needed to capture https was successfully injected. I even see traffic of certain applications, but for Instagram Lite there's only "certificate rejected" on toolkit and app won't load saying there's connection issue.
So I thought app uses certificate pinning, and went through http-toolkit official guide for such case. And when I launch this:
frida -U \ -l ./config.js \ -l ./native-tls-hook.js \ -l ./android/android-certificate-unpinning.js \ -f com.instagram.liteApp launches but then crashes on load screen. I guess it happens at the moment app tries to establish https connection. Same happens for couple of other apps, for example Discord, Spotify (which doesn't have certificate pinning at all). Here's what prints out in console:
____ / _ | Frida 16.2.1 - A world-class dynamic instrumentation toolkit | (_| |> _ | Commands: /_/ |_| help -> Displays the help system . . . . object? -> Display information about 'object' . . . . exit/quit -> Exit . . . . . . . . More info at https://frida.re/docs/home/ . . . . . . . . Connected to SM G950F (id=192.168.8.105:39077)Spawning `com.instagram.lite`... == Hooked native TLS lib libssl.so ==Spawned `com.instagram.lite`. Resuming main thread! [SM G950F::com.instagram.lite ]-> == Certificate unpinning completed ==Process crashed: Bad access due to invalid address****** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***LineageOS Version: '21.0-20240216-UNOFFICIAL-dreamlte'Build fingerprint: 'samsung/dreamltexx/dreamlte:8.0.0/R16NW/G950FXXU1CRC7:user/release-keys'Revision: '10'ABI: 'arm64'Timestamp: 2024-04-24 14:38:07.648559896+0300Process uptime: 3sCmdline: com.instagram.litepid: 10497, tid: 10586, name: stagram.com/... >>> com.instagram.lite <<<uid: 10191signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000000000000000Cause: null pointer dereference x0 00000073c03f1fc8 x1 0000007703a6ebf0 x2 000000770020be50 x3 00000073c03f2230 x4 00000073c03f21f0 x5 0000007714930358 x6 0000007714930358 x7 0000000000000000 x8 0000000000000000 x9 0000000000000000 x10 0000000000000001 x11 0000000000006de0 x12 0000000000000000 x13 0000000000000002 x14 0000000000000004 x15 0000000000000000 x16 00000074504f59d8 x17 00000076fe721e00 x18 0000000000000000 x19 00000073c03f1c10 x20 000000744ef42b28 x21 0000007703a6c440 x22 000000770020be50 x23 000000770b67d6f8 x24 000000770020be80 x25 00000073c03f2060 x26 00000073c03f21f0 x27 0000000000000000 x28 000000770393b680 x29 00000073c03f2000 lr 000000744f887688 sp 00000073c03f1c10 pc 000000744f887698 pst 000000002000000064 total framesbacktrace: #00 pc 0000000000ba6698 /memfd:frida-agent-64.so (deleted) #01 pc 0000000000ad1f58 /memfd:frida-agent-64.so (deleted) #02 pc 0000000000ad4970 /memfd:frida-agent-64.so (deleted) #03 pc 000000000002f5e8 /system/lib64/libssl.so (bssl::ssl_verify_peer_cert(bssl::SSL_HANDSHAKE*)+316) (BuildId: 649a9806f2c0a5537a4863447dbccbf0) #04 pc 000000000005161c /system/lib64/libssl.so (bssl::tls13_client_handshake(bssl::SSL_HANDSHAKE*)+2120) (BuildId: 649a9806f2c0a5537a4863447dbccbf0) #05 pc 000000000003107c /system/lib64/libssl.so (bssl::ssl_client_handshake(bssl::SSL_HANDSHAKE*)+2184) (BuildId: 649a9806f2c0a5537a4863447dbccbf0) #06 pc 000000000002ffbc /system/lib64/libssl.so (bssl::ssl_run_handshake(bssl::SSL_HANDSHAKE*, bool*)+364) (BuildId: 649a9806f2c0a5537a4863447dbccbf0) #07 pc 0000000000042378 /system/lib64/libssl.so (SSL_do_handshake+88) (BuildId: 649a9806f2c0a5537a4863447dbccbf0) #08 pc 0000000000042924 /system/lib64/libssl.so (ssl_read_impl(ssl_st*)+184) (BuildId: 649a9806f2c0a5537a4863447dbccbf0) #09 pc 0000000000042750 /system/lib64/libssl.so (SSL_read+88) (BuildId: 649a9806f2c0a5537a4863447dbccbf0) #10 pc 00000000000279a4 /apex/com.android.conscrypt/lib64/libjavacrypto.so (NativeCrypto_ENGINE_SSL_read_direct(_JNIEnv*, _jclass*, long, _jobject*, long, int, _jobject*)+96) (BuildId: 40feb0ba06373f71e9c827cae9819953) #11 pc 0000000000227430 /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+144) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #12 pc 000000000020a28c /apex/com.android.art/lib64/libart.so (nterp_helper+3852) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #13 pc 0000000000023d2c /apex/com.android.conscrypt/javalib/conscrypt.jar (com.android.org.conscrypt.NativeSsl.readDirectByteBuffer+32) #14 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #15 pc 0000000000019088 /apex/com.android.conscrypt/javalib/conscrypt.jar (com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect+12) #16 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #17 pc 000000000001902e /apex/com.android.conscrypt/javalib/conscrypt.jar (com.android.org.conscrypt.ConscryptEngine.readPlaintextData+42) #18 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #19 pc 0000000000019aa6 /apex/com.android.conscrypt/javalib/conscrypt.jar (com.android.org.conscrypt.ConscryptEngine.unwrap+506) #20 pc 000000000020a9d8 /apex/com.android.art/lib64/libart.so (nterp_helper+5720) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #21 pc 0000000000019c8c /apex/com.android.conscrypt/javalib/conscrypt.jar (com.android.org.conscrypt.ConscryptEngine.unwrap+56) #22 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #23 pc 000000000001979a /apex/com.android.conscrypt/javalib/conscrypt.jar (com.android.org.conscrypt.ConscryptEngine.unwrap+22) #24 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #25 pc 00000000000172a0 /apex/com.android.conscrypt/javalib/conscrypt.jar (com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.processDataFromSocket+140) #26 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #27 pc 00000000000171b0 /apex/com.android.conscrypt/javalib/conscrypt.jar (com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.-$$Nest$mprocessDataFromSocket+0) #28 pc 00000000002093b4 /apex/com.android.art/lib64/libart.so (nterp_helper+52) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #29 pc 00000000000184f2 /apex/com.android.conscrypt/javalib/conscrypt.jar (com.android.org.conscrypt.ConscryptEngineSocket.doHandshake+110) #30 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #31 pc 000000000001887e /apex/com.android.conscrypt/javalib/conscrypt.jar (com.android.org.conscrypt.ConscryptEngineSocket.startHandshake+58) #32 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #33 pc 000000000033d28c /data/data/com.instagram.lite/dex/prog-8a7413981c1c734d5bdd1718740acf9144c0de9d.dex (X.0SA.AGa+3180) #34 pc 000000000020b0f4 /apex/com.android.art/lib64/libart.so (nterp_helper+7540) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #35 pc 000000000033f880 /data/data/com.instagram.lite/dex/prog-8a7413981c1c734d5bdd1718740acf9144c0de9d.dex (X.0SE.A00+280) #36 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #37 pc 000000000033c3e0 /data/data/com.instagram.lite/dex/prog-8a7413981c1c734d5bdd1718740acf9144c0de9d.dex (X.0S8.AGa+928) #38 pc 000000000020b0f4 /apex/com.android.art/lib64/libart.so (nterp_helper+7540) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #39 pc 000000000033f880 /data/data/com.instagram.lite/dex/prog-8a7413981c1c734d5bdd1718740acf9144c0de9d.dex (X.0SE.A00+280) #40 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #41 pc 000000000033b800 /data/data/com.instagram.lite/dex/prog-8a7413981c1c734d5bdd1718740acf9144c0de9d.dex (X.0S4.AGa+464) #42 pc 000000000020b0f4 /apex/com.android.art/lib64/libart.so (nterp_helper+7540) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #43 pc 000000000033f880 /data/data/com.instagram.lite/dex/prog-8a7413981c1c734d5bdd1718740acf9144c0de9d.dex (X.0SE.A00+280) #44 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #45 pc 00000000003395e4 /data/data/com.instagram.lite/dex/prog-8a7413981c1c734d5bdd1718740acf9144c0de9d.dex (X.0RY.AGa+96) #46 pc 000000000020b0f4 /apex/com.android.art/lib64/libart.so (nterp_helper+7540) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #47 pc 000000000033f880 /data/data/com.instagram.lite/dex/prog-8a7413981c1c734d5bdd1718740acf9144c0de9d.dex (X.0SE.A00+280) #48 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #49 pc 000000000032f728 /data/data/com.instagram.lite/dex/prog-8a7413981c1c734d5bdd1718740acf9144c0de9d.dex (X.0Q0.AGa+224) #50 pc 000000000020b0f4 /apex/com.android.art/lib64/libart.so (nterp_helper+7540) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #51 pc 000000000033f880 /data/data/com.instagram.lite/dex/prog-8a7413981c1c734d5bdd1718740acf9144c0de9d.dex (X.0SE.A00+280) #52 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #53 pc 0000000000339252 /data/data/com.instagram.lite/dex/prog-8a7413981c1c734d5bdd1718740acf9144c0de9d.dex (X.0RX.A02+174) #54 pc 000000000020a2d4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #55 pc 000000000033af56 /data/data/com.instagram.lite/dex/prog-8a7413981c1c734d5bdd1718740acf9144c0de9d.dex (X.0Ro.run+1426) #56 pc 00000000002b8370 /system/framework/arm64/boot.oat (java.util.concurrent.ThreadPoolExecutor.runWorker+800) (BuildId: 033b78791329236ed3fb23a647eb6eff57adc488) #57 pc 00000000002b5420 /system/framework/arm64/boot.oat (java.util.concurrent.ThreadPoolExecutor$Worker.run+64) (BuildId: 033b78791329236ed3fb23a647eb6eff57adc488) #58 pc 0000000000160778 /system/framework/arm64/boot.oat (java.lang.Thread.run+72) (BuildId: 033b78791329236ed3fb23a647eb6eff57adc488) #59 pc 00000000002109a4 /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #60 pc 00000000002539a4 /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+172) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #61 pc 000000000066f48c /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+1404) (BuildId: 55b9536b61b755b7bae82e95aa498dab) #62 pc 00000000000be5c8 /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208) (BuildId: 2743e943c62322ac28a0cf6ed5e099da) #63 pc 000000000005b140 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 2743e943c62322ac28a0cf6ed5e099da)***[SM G950F::com.instagram.lite ]->Thank you for using Frida!I'm using Samsung Galaxy S8 with LineageOS 21 (Android 14). Is the issue with device, OS, or am I doing something wrong?