universal-flutter-ssl-pinning - GitLite

KO | EN

gitlite — search

#shell #generative-ai #cpp #claude #typescript #swift #mysql #pytorch #go #dotnet

universal-flutter-ssl-pinning

(★ 65)

Automated SSL pinning bypass for any Flutter & Shorebird version — PyGhidra static analysis auto-discovers BoringSSL and generates ready-to-run Frida & Renef scripts

파일 탐색기

ZIP 다운로드

- flutter_ssl_pinning.js
- flutter_ssl_pinning.lua
.gitignore
flutter_http_monitor.py
flutter_ssl_pinning.py
README.md

# CDN으로 사용하기

jsDelivr

jsDelivr는 공개 GitHub 리포지토리를 별도 설정 없이 CDN으로 즉시 서빙합니다. 버전과 파일을 고르면 웹페이지에 바로 붙일 수 있는 링크와 예시 코드가 만들어집니다.

버전

파일

링크

예시

명령어 용어집

이 문서에서 사용된 명령어를 모아봤습니다. 낯선 명령어가 있다면 펼쳐서 확인해보세요.

🔍

`brew install`

설명 보기 ▼

Install a Homebrew formula or cask.

brew install {{formula|cask}}

Install a formula/cask:

brew install {{[-s|--build-from-source]}} {{formula}}

Build and install a formula from source (dependencies will still be installed from bottles):

brew install {{[-n|--dry-run]}} {{formula|cask}}

Download the manifest, print what would be installed but don't actually install anything:

🔍

`frida`

설명 보기 ▼

개발자, 리버스 엔지니어, 보안 연구자를 위한 동적 계측 툴킷.
더 많은 정보: <https://frida.re/docs/frida-cli/>.

frida {{process_name}}

실행 중인 프로세스에 연결된 대화형 쉘(REPL) 시작:

frida {{[-U|--usb]}} {{process_name}}

USB를 통해 프로세스에 연결된 대화형 쉘 시작:

frida {{[-p|--attach-pid]}} {{pid}}

PID를 사용하여 실행 중인 프로세스에 연결:

🔍

`pip install`

설명 보기 ▼

Install Python packages.

pip install {{package1 package2 ...}}

Install one or more packages:

pip install {{package1 package2 ...}} {{[-U|--upgrade]}}

Upgrade all specified packages to the latest version, installing any that are not already present:

pip install {{package}}=={{version}}

Install a specific version of a package:

🔍

`python3`

설명 보기 ▼

이 명령은 `python`의 별칭입니다.

tldr python

자세한 내용은 원본 명령을 참고하세요:

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Reverse-engineers `libflutter.so` with PyGhidra to locate the SSL certificate verification function, then emits ready-to-use bypass scripts for both **Frida** and **Renef**.

## How it works

1. PyGhidra loads `libflutter.so` headlessly and scans all defined strings for `ssl_client`
2. Cross-references from that string are resolved to their containing functions
3. Each function is decompiled to get an accurate parameter count
4. The 3-parameter function is selected — this is `ssl_crypto_x509_session_verify_cert_chain`
5. Its RVA is baked into:
   - A **Frida** script (`flutter_ssl_pinning.js`) that patches the return value to `ptr(1)` (SSL_VERIFY_OK) at runtime
   - A **Renef** script (`flutter_ssl_pinning.lua`) that uses `Memory.patch` to overwrite the function entry with `MOV X0, #1 ; RET` (ARM64)

## Requirements

- [Ghidra](https://ghidra-sre.org/) — `brew install ghidra`
- [pyghidra](https://github.com/NationalSecurityAgency/ghidra/tree/master/GhidraBridge) — `pip install pyghidra`
- **Frida** — `pip install frida-tools`  *or*  **Renef** — [renef.io](https://renef.io)

> Set `GHIDRA_INSTALL_DIR` in your environment, or pass `--ghidra-install-dir`.

## Usage

```bash
# Analyse libflutter.so and generate both scripts
python3 flutter_ssl_pinning.py libflutter.so

# Run with Frida
frida -U -f com.example.app -l flutter_ssl_pinning.js

# Run with Renef
renef -s com.example.app -l flutter_ssl_pinning.lua
```

## Options

| Argument | Default | Description |
|---|---|---|
| `binary` | *(required)* | Path to `libflutter.so` |
| `output` | `flutter_ssl_pinning` | Output base name (generates `<name>.js` and `<name>.lua`) |
| `--module` | `libflutter.so` | Module name in target process |
| `--ghidra-install-dir` | auto | Ghidra installation directory |

## Output files

| File | Tool | Mechanism |
|---|---|---|
| `flutter_ssl_pinning.js` | Frida | `Interceptor.attach` + `retval.replace(ptr(1))` |
| `flutter_ssl_pinning.lua` | Renef | `Memory.patch` (MOV X0, #1 ; RET) |

See the [`example/`](example/) directory for sample generated output.

---

## Tested on

| Target | Status |
|---|---|
| Google Flutter `libflutter.so` (arm64-v8a) | ✅ Working |
| Shorebird-patched Flutter builds | ✅ Working |
| Ghidra 12.x + pyghidra | ✅ Working |
| Frida 17.x and 16.x | ✅ Working |
| Renef (latest) | ✅ Working |

> Both Google Flutter and Shorebird use the same `libflutter.so` SSL engine.
> The auto-discovered RVA is identical across build types for the same Flutter engine version.

---

## Quick Traffic Capture (no proxy)

Besides bypassing pinning for a proxy-based MITM, you can capture decrypted HTTP
traffic **directly in Frida** with the self-contained `flutter_http_monitor.py`.
It auto-locates BoringSSL `SSL_write`/`SSL_read` in `libflutter.so` (any Flutter
version, arm64) and generates a Frida script that prints plaintext requests and
responses — reassembled, de-chunked, gunzipped, and JSON pretty-printed.

```bash
pip install capstone pyelftools

# scan the binary and generate the monitor (or pass an .apk)
python3 flutter_http_monitor.py path/to/libflutter.so -o monitor.js

# run it against the app
frida -U -f com.target.app -l monitor.js
```

Optional, live in the Frida REPL: `addScope('api.example.com')` to watch only
specific hosts (Burp-style scope). Single file — nothing else to ship.

## Disclaimer

This tool is intended for **authorised security research and penetration testing only**.  
Do not use against apps you do not own or have explicit written permission to test.

<a href="https://www.star-history.com/?repos=vichhka-git%2Funiversal-flutter-ssl-pinning&type=date&legend=bottom-right">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/image?repos=vichhka-git/universal-flutter-ssl-pinning&type=date&theme=dark&legend=bottom-right" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/image?repos=vichhka-git/universal-flutter-ssl-pinning&type=date&legend=bottom-right" />
   <img alt="Star History Chart" src="https://api.star-history.com/image?repos=vichhka-git/universal-flutter-ssl-pinning&type=date&legend=bottom-right" />
 </picture>
</a>