/*
	Android SSL Re-pinning frida script v0.2 030417-pier 

   $ adb push burpca-cert-der.crt /data/local/tmp/cacert.crt
   $ frida -U -f it.app.mobile -l frida-android-repinning.js --no-pause

   Original Script: https://techblog.mediaservice.net/wp-content/uploads/2017/07/frida-android-repinning_sa-1.js 
*/
setTimeout(function(){
	Java.perform(function(){
		console.log("");
		console.log("[.] Cert Pinning Bypass in process...");

		var CertificateFactory = Java.use("java.security.cert.CertificateFactory");
		var FileInputStream	   = Java.use("java.io.FileInputStream");
		var BufferedInputStream= Java.use("java.io.BufferedInputStream");
		var X509Certificate	   = Java.use("java.security.cert.X509Certificate");
		var KeyStore		   = Java.use("java.security.KeyStore");
		var TrustManagerFactory= Java.use("javax.net.ssl.TrustManagerFactory");
		var SSLContext		   = Java.use("javax.net.ssl.SSLContext");

		// Load CAs from an Input Stream
		console.log("[+] Loading our CA Cert looking Motherfucker!...");
		cf = CertificateFactory.getInstance("X.509");

		try {
			var fileInputStream = FileInputStream.$new("/data/local/tmp/cacert.crt");
		}catch(err){
			console.log("[o] "+err);
		}

		var bufferedInputStream = BufferedInputStream.$new(fileInputStream);
		var ca = cf.generateCertificate(bufferedInputStream);
		bufferedInputStream.close();

		var certInfo = Java.cast(ca, X509Certificate);
		console.log("[o] Our CA Info: "+certInfo.getSubjectDN());

		// Create a Keystore containing a Full of fucking shit and trusted CAs
		console.log("[+] Creating a KeyStore for our CA .. Assholes!");
		var keyStoreType = KeyStore.getDefaultType();
		var keyStore = KeyStore.getInstance(keyStoreType);
		keyStore.load(null, null);
		keyStore.setCertificateEntry("ca", ca);

		// Create a Trustmanager that trusts me and the CAs in our KeyStore MotherFucker!!
		console.log("[+] Creating a TrustManager that trust our love ones in our fucking KeyStore shit...");
		var tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
		var tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
		tmf.init(KeyStore);
		console.log("[+] Our TrustManager is ready.. so am i...");

		console.log("[+] Hijacking SSLContext methods now...");
		console.log("[+] Waiting for the app to provoke me and also to invoke SSLContext.init()...");

		SSLContext.init.overload("[Ljavax.net.ssl.KeyManager;","[Ljavax.net.ssl.TrustManager;","java.security.SecureRandom").implementation = function(a,b,c){
			console.log("[o] App provoked me and this little shit here >> javax.net.ssl.SSLContext.init...");
			SSLContext.init.overload("[Ljavax.net.ssl.KeyManager;","[Ljavax.net.ssl.TrustManager;","java.security.SecureRandom").call(this, a, tmf.getTrustManagers(), c);
			console.log("[+] SSLContext initialized with our custom Shit TrustManager!");
		}

	});
},0);