مهندسی معکوس API اپلیکیشنهای موبایل و بایپس SSL Pinning با Frida

import frida
import requests
from typing import Dict, Any

FRIDA_HOOK_SCRIPT = """
Java.perform(function () {
    // 1. Bypass OkHttp3 CertificatePinner
    try {
        var CertificatePinner = Java.use('okhttp3.CertificatePinner');
        CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function (hostname, peerCertificates) {
            console.log('[+] Bypassed OkHttp3 pinning for: ' + hostname);
            return;
        };
    } catch (err) {
        console.log('[-] OkHttp3 CertificatePinner not found');
    }

    // 2. Bypass Android Conscrypt TrustManagerImpl
    try {
        var TrustManagerImpl = Java.use('com.android.org.conscrypt.TrustManagerImpl');
        TrustManagerImpl.verifyChain.implementation = function (untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) {
            console.log('[+] Bypassed TrustManagerImpl for: ' + host);
            return untrustedChain;
        };
    } catch (err) {
        console.log('[-] TrustManagerImpl hook skipped');
    }
});

// 3. Expose Internal App Signing Function as an RPC Endpoint
rpc.exports = {
    generateSignature: function (payload, timestamp) {
        var result = '';
        Java.perform(function () {
            var CryptoHelper = Java.use('com.targetapp.security.CryptoManager');
            result = CryptoHelper.signRequestNative(payload, timestamp);
        });
        return result;
    }
};
"""

class MobileApiScraper:
    def __init__(self, package_name: str):
        self.device = frida.get_usb_device(timeout=5)
        pid = self.device.spawn([package_name])
        self.session = self.device.attach(pid)
        self.script = self.session.create_script(FRIDA_HOOK_SCRIPT)
        self.script.load()
        self.device.resume(pid)
        self.rpc = self.script.exports_sync

    def fetch_protected_endpoint(self, endpoint: str, body_json: str, timestamp: str) -> Dict[str, Any]:
        # Ask the live Android app to compute the exact cryptographic HMAC/JNI signature
        signature = self.rpc.generate_signature(body_json, timestamp)
        headers = {
            'User-Agent': 'TargetApp/4.18.0 (Android 14; Pixel 7)',
            'X-Timestamp': timestamp,
            'X-Signature': signature,
            'Content-Type': 'application/json'
        }
        resp = requests.post(endpoint, data=body_json, headers=headers, timeout=10)
        resp.raise_for_status()
        return resp.json()