#SSL Pinning绕过技术 - 数据采集&安全测试必备

import frida
import sys
import time
from typing import Tuple, Optional

# 直接把核心绕过脚本嵌入，无需单独创建JS文件
BYPASS_SCRIPT = """
Java.perform(function() {
    console.log("[+] 🌐 通用SSL Pinning Bypass已激活");

    const okHttpCheckClasses = [
        'okhttp3.CertificatePinner',
        'okhttp3.internal.tls.CertificatePinnerChainCleaner',
        'com.squareup.okhttp.CertificatePinner'
    ];
    okHttpCheckClasses.forEach(className => {
        try {
            const clazz = Java.use(className);
            const methods = clazz.class.getDeclaredMethods();
            methods.forEach(method => {
                const methodName = method.getName();
                if (methodName.startsWith('check') && clazz[methodName]) {
                    clazz[methodName].overload.apply(
                        clazz[methodName], 
                        Array.from({length: method.getParameterCount()}, () => '*')
                    ).implementation = function() {
                        console.log(`[+] ✅ OkHttp ${className}.${methodName} 绕过成功`);
                        return;
                    };
                }
            });
        } catch(e) {}
    });

    try {
        const X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
        const SSLContext = Java.use('javax.net.ssl.SSLContext');
        const TrustAllManager = Java.registerClass({
            name: 'com.universal.trustall',
            implements: [X509TrustManager],
            methods: {
                checkClientTrusted: function() {},
                checkServerTrusted: function() {},
                getAcceptedIssuers: function() { return []; }
            }
        });
        const trustAllArray = [TrustAllManager.$new()];
        SSLContext.init.overloads.forEach(overload => {
            overload.implementation = function(keyManagers, trustManagers, secureRandom) {
                this.init(keyManagers, trustAllArray, secureRandom);
            };
        });
        console.log("[+] ✅ 系统X509TrustManager已替换为全信任");
    } catch(e) {}

    try {
        const WebViewClient = Java.use('android.webkit.WebViewClient');
        WebViewClient.onReceivedSslError.implementation = function(view, handler, error) {
            console.log(`[+] ✅ WebView SSL错误已忽略，错误类型: ${error.getPrimaryError()}`);
            handler.proceed();
        };
    } catch(e) {}
});
"""

def bypass_ssl_pinning(app_package: str) -> Tuple[Optional[frida.core.Session], Optional[frida.core.Script]]:
    """
    一键绕过Android App的SSL Pinning
    :param app_package: 目标应用的完整包名（如 com.tencent.mm）
    :return: (session, script) 成功返回Frida对象对，失败返回(None, None)
    """
    # --------------------------
    # 1. 获取USB设备
    # --------------------------
    try:
        device = frida.get_usb_device(timeout=5)
        print(f"✅ 连接到设备: {device.name}")
    except Exception as e:
        print(f"❌ 未找到USB设备，请检查ADB/Frida Server是否运行: {str(e).strip()}")
        return None, None

    # --------------------------
    # 2. 连接App（优先spawn启动更稳定）
    # --------------------------
    session: Optional[frida.core.Session] = None
    spawned_pid: Optional[int] = None
    try:
        print(f"⚠️  正在尝试spawn启动App: {app_package}...")
        spawned_pid = device.spawn([app_package])
        session = device.attach(spawned_pid)
    except frida.ProcessNotFoundError:
        print(f"❌ 找不到包名对应的App，请检查是否正确: {app_package}")
        return None, None
    except frida.NotSupportedError:
        print(f"⚠️  设备不支持spawn（部分Android 14+定制系统会禁用），尝试附加到已运行的App...")
        try:
            session = device.attach(app_package)
        except Exception as e:
            print(f"❌ 附加失败，请确认App已在前台运行: {str(e).strip()}")
            return None, None
    except Exception as e:
        print(f"❌ 连接App时发生未知错误: {str(e).strip()}")
        return None, None

    # --------------------------
    # 3. 注入绕过脚本
    # --------------------------
    script: Optional[frida.core.Script] = None
    try:
        script = session.create_script(BYPASS_SCRIPT)
        
        # 实时接收并输出Frida脚本的日志
        def on_message(message, data):
            if message['type'] == 'send':
                print(f"📜 [Frida] {message['payload']}")
        
        script.on('message', on_message)
        script.load()
        print("✅ SSL Pinning绕过脚本注入成功")

        # 如果是spawn启动的，必须resume才能让App继续运行
        if spawned_pid is not None:
            device.resume(spawned_pid)
            print("✅ App已恢复运行")
    except Exception as e:
        print(f"❌ 脚本注入失败，请检查Frida Server与电脑端Frida版本是否严格匹配: {str(e).strip()}")
        if session:
            session.detach()
        return None, None

    return session, script

if __name__ == "__main__":
    # 检查命令行参数
    if len(sys.argv) != 2:
        print("⚠️  使用方法: python ssl_bypass.py <目标应用完整包名>")
        print("💡 示例: python ssl_bypass.py com.tencent.mm")
        sys.exit(1)

    target_pkg = sys.argv[1]
    session_obj, script_obj = bypass_ssl_pinning(target_pkg)

    if session_obj and script_obj:
        print("\n🎉 绕过成功！现在可以用Fiddler/Charles/Burp Suite抓明文HTTPS包了")
        print("⏳ 按 Ctrl+C 退出并清理Frida资源...")
        try:
            # 保持脚本运行，直到用户手动中断
            while True:
                time.sleep(1)
        except KeyboardInterrupt:
            print("\n🛑 正在清理资源...")
            script_obj.unload()
            session_obj.detach()
            print("✅ 清理完成，已退出")
    else:
        sys.exit(1)