[bug & solution] Suggest change to the bypassing SSL-Pinning of Okhttp3 since original code doesn't work

[kiven7299]

About the issue

There is an Android app which demo ssl-pinning: https://github.com/httptoolkit/android-ssl-pinning-demo. Try disable its ssl-pinning with Objection (command android sslpinning disable) fails for Okhttp3 library:

• As can be seen bellow, the pinning still performs well:

Spot the bug in Objection's frida scripts

In file agent.js, function const okHttp3CertificatePinnerCheckOkHttp = (ident) => {...}. The issue is red-underlined code bellow:

• Since there is no check$okhttp with argument of u15 type, the code fails to hook into.

Suggest fix

Just hook okhttp3.CertificatePinner.check$okhttp without overload(...)

• Change the red-underlined code to const CertificatePinnerCheckOkHttp = certificatePinner.check$okhttp

Result

[leonjza]

Hey! Thanks for the issue. Up for opening a PR?

[kiven7299]

Hey! Thanks for the issue. Up for opening a PR?

Okay I will open a PR, but it could take time since I'm not used to working with git

[kiven7299]

@leonjza, can you instruct me on how to make a pull request?

[leonjza]

Sure. Fork the repository, make and commit the code changes then follow this guide to make the pull request.

[kiven7299]

Thanks for your help. I've made a pull request