[bug] Can't bypass ssl pinning

[yaing11]

Describe the bug
I've tried to disable ssl pinning in an app which i've insatlled on the android emulator (on the pic below)

I use Burp Suite to capture the traffic between app and server therefore I've installed cert as a system one (using magisk) and setup proxy on the emulator.

But when I launch objection command (see below) and the input

android sslpinning disable

I've get an error (see Evidence / Logs / Screenshots section).

To Reproduce
Steps to reproduce the behavior:

1. objection -n ru.serebryakovas.lukoilmobileapp start

Expected behavior
I want to disable ssl pinning successfully...

Evidence / Logs / Screenshots

ru.serebryakovas.lukoilmobileapp (run) on (Android: 12) [usb] # android sslpinning disable
(agent) Custom TrustManager ready, overriding SSLContext.init()
(agent) Found okhttp3.CertificatePinner, overriding CertificatePinner.check()
A Frida agent exception has occurred.
TypeError: cannot read property 'overload' of undefined
    at <anonymous> (/src/index.js:20700)
    at <anonymous> (/src/index.js:13540)
    at <anonymous> (/src/index.js:2847)
    at perform (/src/index.js:13339)
    at <anonymous> (/src/index.js:13544)
    at Promise (native)
    at wrapJavaPerform (/src/index.js:13545)
    at okHttp3CertificatePinnerCheck (/src/index.js:20714)
    at disable (/src/index.js:20845)

Python stack trace: Traceback (most recent call last):
  File "/home/era/Android/myenv/lib/python3.12/site-packages/objection/console/repl.py", line 362, in run
    self.run_command(document)
  File "/home/era/Android/myenv/lib/python3.12/site-packages/objection/console/repl.py", line 170, in run_command
    exec_method(arguments)
  File "/home/era/Android/myenv/lib/python3.12/site-packages/objection/commands/android/pinning.py", line 26, in android_disable
    api.android_ssl_pinning_disable(_should_be_quiet(args))
  File "/home/era/Android/myenv/lib/python3.12/site-packages/frida/core.py", line 188, in method
    return script._rpc_request(request, data, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/era/Android/myenv/lib/python3.12/site-packages/frida/core.py", line 94, in wrapper
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "/home/era/Android/myenv/lib/python3.12/site-packages/frida/core.py", line 499, in _rpc_request
    raise result.error
frida.core.RPCException: TypeError: cannot read property 'overload' of undefined
    at <anonymous> (/src/index.js:20700)
    at <anonymous> (/src/index.js:13540)
    at <anonymous> (/src/index.js:2847)
    at perform (/src/index.js:13339)
    at <anonymous> (/src/index.js:13544)
    at Promise (native)
    at wrapJavaPerform (/src/index.js:13545)
    at okHttp3CertificatePinnerCheck (/src/index.js:20714)
    at disable (/src/index.js:20845)

objection --debug explore

(myenv) era@era-Default-string:~/Android$ objection --debug explore
DeprecationWarning: The command 'explore' is deprecated. Use 'objection start' instead of 'objection explore'
[debug] Agent path is: /home/era/Android/myenv/lib/python3.12/site-packages/objection/agent.js
[debug] agent config: AgentConfig(name=None, host=None, port=None, device_type='usb', device_id=None, foremost=False, spawn=False, pause=True, debugger=False, uid=None)
[debug] device determined as: Device(id="emulator-5554", name="Android Emulator 5554", type='usb')
Need a target name to spawn/attach to

Environment (please complete the following information):

• Device: Google Pixel emulator (API 31, Android 12)
• OS: Android 12
• Frida Version 17.5.2
• Frida-server Version 17.5.2-android-x86_64
• Objection Version 1.12.2

Application
https://cloud.mail.ru/public/XQPS/Ea26zowmK

[yaing11]

Sorry, seems to me I forgot to do patchapk. Here is the command

objection patchapk -s base.apk

and it completed without errors

and i've got the base.objection.apk file. Next - i've installed base.objection.apk with success. And now try to

objection -n ru.serebryakovas.lukoilmobileapp start

Butttt...........have another error

ru.serebryakovas.lukoilmobileapp (run) on (Android: 12) [usb] # android sslpinning disable
A Frida agent exception has occurred.
Error: Java API not available
    at _checkAvailable (/src/index.js:13470)
    at perform (/src/index.js:13336)
    at <anonymous> (/src/index.js:13544)
    at Promise (native)
    at wrapJavaPerform (/src/index.js:13545)
    at sslContextEmptyTrustManager (/src/index.js:20693)
    at disable (/src/index.js:20844)
    at androidSslPinningDisable (/src/index.js:21317)
    at call (native)
    at handleRpcMessage (/frida/runtime/message-dispatcher.js:39)
    at handleMessage (/frida/runtime/message-dispatcher.js:25)

Python stack trace: Traceback (most recent call last):
  File "/home/era/Android/myenv/lib/python3.12/site-packages/objection/console/repl.py", line 362, in run
    self.run_command(document)
  File "/home/era/Android/myenv/lib/python3.12/site-packages/objection/console/repl.py", line 170, in run_command
    exec_method(arguments)
  File "/home/era/Android/myenv/lib/python3.12/site-packages/objection/commands/android/pinning.py", line 26, in android_disable
    api.android_ssl_pinning_disable(_should_be_quiet(args))
  File "/home/era/Android/myenv/lib/python3.12/site-packages/frida/core.py", line 188, in method
    return script._rpc_request(request, data, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/era/Android/myenv/lib/python3.12/site-packages/frida/core.py", line 94, in wrapper
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "/home/era/Android/myenv/lib/python3.12/site-packages/frida/core.py", line 499, in _rpc_request
    raise result.error
frida.core.RPCException: Error: Java API not available
    at _checkAvailable (/src/index.js:13470)
    at perform (/src/index.js:13336)
    at <anonymous> (/src/index.js:13544)
    at Promise (native)
    at wrapJavaPerform (/src/index.js:13545)
    at sslContextEmptyTrustManager (/src/index.js:20693)
    at disable (/src/index.js:20844)
    at androidSslPinningDisable (/src/index.js:21317)
    at call (native)
    at handleRpcMessage (/frida/runtime/message-dispatcher.js:39)
    at handleMessage (/frida/runtime/message-dispatcher.js:25)

ru.serebryakovas.lukoilmobileapp (run) on (Android: 12) [usb] # 

[yaing11]

with the android root disable the same problem.

ru.serebryakovas.lukoilmobileapp (run) on (Android: 12) [usb] # android root disable
A Frida agent exception has occurred.
Error: Java API not available
    at _checkAvailable (/src/index.js:13470)
    at perform (/src/index.js:13336)
    at <anonymous> (/src/index.js:13544)
    at Promise (native)
    at wrapJavaPerform (/src/index.js:13545)
    at testKeysCheck (/src/index.js:20885)
    at disable2 (/src/index.js:21127)
    at androidRootDetectionDisable (/src/index.js:21321)
    at call (native)
    at handleRpcMessage (/frida/runtime/message-dispatcher.js:39)
    at handleMessage (/frida/runtime/message-dispatcher.js:25)

Python stack trace: Traceback (most recent call last):
  File "/home/era/Android/myenv/lib/python3.12/site-packages/objection/console/repl.py", line 362, in run
    self.run_command(document)
  File "/home/era/Android/myenv/lib/python3.12/site-packages/objection/console/repl.py", line 170, in run_command
    exec_method(arguments)
  File "/home/era/Android/myenv/lib/python3.12/site-packages/objection/commands/android/root.py", line 13, in disable
    api.android_root_detection_disable()
  File "/home/era/Android/myenv/lib/python3.12/site-packages/frida/core.py", line 188, in method
    return script._rpc_request(request, data, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/era/Android/myenv/lib/python3.12/site-packages/frida/core.py", line 94, in wrapper
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "/home/era/Android/myenv/lib/python3.12/site-packages/frida/core.py", line 499, in _rpc_request
    raise result.error
frida.core.RPCException: Error: Java API not available
    at _checkAvailable (/src/index.js:13470)
    at perform (/src/index.js:13336)
    at <anonymous> (/src/index.js:13544)
    at Promise (native)
    at wrapJavaPerform (/src/index.js:13545)
    at testKeysCheck (/src/index.js:20885)
    at disable2 (/src/index.js:21127)
    at androidRootDetectionDisable (/src/index.js:21321)
    at call (native)
    at handleRpcMessage (/frida/runtime/message-dispatcher.js:39)
    at handleMessage (/frida/runtime/message-dispatcher.js:25)

ru.serebryakovas.lukoilmobileapp (run) on (Android: 12) [usb] # 

[IPMegladon]

Check with latest version of objection (1.12.3) if you get the same issue. The initial issue without using patchapk should be resolved. The second Java API not available issue is something else and likely Frida related.

[IPMegladon]

Potentially fixed by #792