CODEWITHSUNDEEP
c++reverse-engineeringfrida
Kaspek
Kaspek

Reputation: 375

Create new NativeFunction and use it then

I am wondering: how can I allow self-signed certs while app using openssl library?

I saw that code which disables certificate validation StackOverflow question/answer hyperlink

static int always_true_callback(X509_STORE_CTX *ctx, void *arg)
{
  return 1;
}

This is the method, where I should put this new method, which always returns 1 enter image description here

But I don't have any idea how can I create that method using Frida

What is the proper way of doing this?

Upvotes: 2

Views: 1176

Answers (1)

James W.
James W.

Reputation: 3055

There are many ways to accomplish your goal

TL;DR

var SSL_CTX_set_cert_verify_callback = Module.findExportByName('libssl.so', 'SSL_CTX_set_cert_verify_callback');
Interceptor.attach(SSL_CTX_set_cert_verify_callback, {
  onEnter: function(args) { 
    Interceptor.replace(args[1], new NativeCallback((_arg1, _arg2) => {
      return 1;
    }, 'int', ['pointer', 'pointer']);
  },
});

Hook SSL_CTX_set_cert_verify_callback, once it's called intercept *cb and replace the return value.

Interceptor.attach(SSL_CTX_set_cert_verify_callback, {
  onEnter: function(args) { 
    Interceptor.attach(args[1]/* *cb */, {
      onLeave: function(retval) {
        retval.replace(1);
      }
    }); 
  },
});

replace the bytecode

Interceptor.attach(SSL_CTX_set_cert_verify_callback, {
  onEnter: function(args) { 
    // add a condition so you will patch only once
    Memory.patchCode(args[1], 64, code => { 
      const cw = new Arm64Writer(code, { pc: args[1] });
      cw.putMovRegU64('x0', 1);
      cw.putRet();
      cw.flush();
    });
  },
});

replace the function with CModule

const cm = new CModule(`
void ret1(void) {
  return 1;
}
`);


Interceptor.attach(SSL_CTX_set_cert_verify_callback, {
  onEnter: function(args) { 
    Interceptor.replace(args[1], cm.ret1);
  },
});

Upvotes: 2

Related Questions