Not working with Facebook #13

JohnCoates · 2016-03-18T08:35:54Z

First of all, very cool project!

I was trying out the latest release with the Facebook app and it's not working for me. Tried a reboot. Works fine in Safari. Console notifies of it being loaded. Screenshot from Charles Proxy included. Tried with Burp also, same error. Apple App Store gets intercepted just fine.

nabla-c0d3 · 2016-03-27T23:09:10Z

Hello,
I just tried and can confirm that is not working. There are a few network calls initiated by classes that explicitly check the certificate (GCDAsyncSocket, FBMQTTNativeClient, RCTSRWebSocket). I will need to think of a way to generically disable this type of certificate check, which might be difficult. Will look into it when I have time.

Grazfather · 2016-04-13T21:54:23Z

Hm, I actually can't reproduce. I'm using facebook 52.0 with mitmproxy and my script is successfully pulling out the email and password from my login attempts.

Grazfather · 2016-04-13T22:01:17Z

Seems that it's certain APIs. graph.facebook.com and api.facebook.com fail, but I could register an account through b-api.facebook.com/ without issue.

nabla-c0d3 · 2016-04-13T23:29:29Z

Yes, it is specific APIs.

isayeter · 2016-04-24T16:14:53Z

It is not working on my phone too, any update ?

kopiro · 2016-06-17T10:59:09Z

Any update?

alfondotnet · 2016-07-30T18:00:26Z

@nabla-c0d3 , I assume it's similar for Facebook's messenger app, tried a bunch of things with no luck, I wish I knew more in this domain to be able to help.

kopiro · 2016-07-31T12:09:31Z

@alfonsoperez Yes, it's the same.
Same struggle.

https://medium.com/@destefanoflavio/what-i-learned-hacking-facebook-messenger-soccer-game-3c882ea8537d#.c52oaxrw5

nabla-c0d3 · 2016-08-06T19:19:55Z

GCDAsyncSocket actually does SSL pinning with the usual SecureTransportAPI that's already taken care of by SSL Kill Switch ( https://github.com/robbiehanson/CocoaAsyncSocket/blob/master/Source/GCD/GCDAsyncSocket.m#L6794 )
The remaining classes to patch are FBMQTTNativeClientand RCTSRWebSocket (most likely this https://github.com/facebook/react-native/blob/master/Libraries/WebSocket/RCTSRWebSocket.h#L114 ) which I will look at whenever I have time.

AdrienMangoo · 2016-09-05T22:45:28Z

Any new clues about facebook ?

Thanks

ghost · 2016-09-08T15:20:35Z

Simple fix for that is to hook RCTSRWebSocket function called _checkHandshake

nabla-c0d3 · 2016-09-08T16:02:57Z

I tried disabling pinning in FBMQTTNativeClientand, RCTSRWebSocket and FBSSLPinningVerifier but it still wasn't enough. I'll look into again when I have time.

liuxuan30 · 2016-09-12T05:07:49Z

@nabla-c0d3 what you mean by 'still wasn't enough'? It work partially or not work at all?

liuxuan30 · 2016-09-12T09:17:28Z

@karek314 can you jus tell me how to bypass Facebook app SSL pining for now as a work around? I am ok to inject tweaks? I tried to let _checkHandshake return YES, however, no luck

liuxuan30 · 2016-09-18T01:29:30Z

From what I found is FBNetworkerRequest class is handling the requests and reponses like graph.facebook.com, however, not finding a way to bypass SSL pinning.

AdrienMangoo · 2016-09-27T11:49:17Z

I did some research, and didn't find yet a solution. @liuxuan30 did you get more results on your side ?

liuxuan30 · 2016-09-28T00:27:20Z

as I said, I just found that the API requests are sending out by FBNetworkerRequest. I don't find how FBNetworkerRequest enforce SSL pinning.

ch3repatz · 2016-09-29T12:52:50Z

https://twitter.com/CodeDigging/status/781468522815819776

alfondotnet · 2016-09-29T17:47:20Z

@ch3repatz Impatiently awaiting for details 👍

ch3repatz · 2016-09-29T18:17:42Z

@alfonsoperez hope the author will share his research, not just the screenshot

nabla-c0d3 · 2016-09-29T18:19:12Z

This is still on my TODO list, I just haven't had time to look at this again.

liuxuan30 · 2016-09-30T02:54:22Z

@ch3repatz can't wait.. why just a screenshot

ch3repatz · 2016-09-30T06:27:12Z

@liuxuan30 I don't know, ask the author of research please. I just found the tweet and copied here.

liuxuan30 · 2016-09-30T06:31:34Z

Just asked and get a reply:"Do you mind sharing?"; "No, it's a non-public research for my customer."
So we are still on our own LOL

ch3repatz · 2016-09-30T06:50:48Z

@liuxuan30 sad :(
Ok, let's wait for update from @nabla-c0d3

liuxuan30 · 2016-09-30T08:22:25Z

actually can we have synergy here not just depending on @nabla-c0d3 ? I was able to track down to FBNetworkerRequest it get the response data, but can't find where it do the ssl pining

xuanliu-aa · 2016-10-12T02:16:15Z

@nabla-c0d3 I found that I hooked GCDAsyncSocket ssl related functions, but no one get called. Seems it's not using GCDAsyncSocket at all? Can anyone double check?

nabla-c0d3 · 2016-10-12T20:24:54Z

It's not used in the flows that I have seen. Same with FBMQTTNativeClientand, RCTSRWebSocket and FBSSLPinningVerifier. Overall it's unclear to me where the pinning validation logic is happening during the login flow, but I haven't had time to look at it that much.

liuxuan30 · 2016-10-13T01:53:06Z

@nabla-c0d3 np, I just looked into it and want to save your time when you sit down and working on this. What I find is that the upper FBNetworkerRequest is sending the FB api requests, and doing the ssl pining somewhere in the process.
it not uses FBSSLPinningVerifier in its api network e.g. graph.facebook.com

bruno-rocha-movile · 2016-11-03T11:55:20Z

It also doesn't work with World of Warcraft Armory, It works correctly until you login, then it doesn't catch anything besides the regular google analytics calls

ghost · 2018-08-17T16:45:09Z

@mdbrelo look for string "openssl", usually it has embedded path, if that fails for some reason you can try locate some openssl specific strings.
https://github.com/openssl/openssl/tree/OpenSSL_1_1_0-stable

mdbrelo · 2018-08-17T16:59:25Z

great. I'm trying to learn how to use ida and asm language but it's really hard

liuxuan30 · 2018-08-20T01:22:08Z

@karek314 any ETA you would file a PR for this? Very interested.

ghost · 2018-08-20T12:17:11Z

@liuxuan30 I will when I'll have more time, right now you can just use https://github.com/karek314/hexbytescanner and patch binaries manually before deploying them.

dedfft · 2018-09-11T09:11:58Z

Could please anybody share the final ipa for Facebook with patched ssl pinning? Unfortunately i dont have any framework for patching it myself(

asad0x01 · 2018-09-11T20:48:06Z

I have IPA only :|

…

On Tue, Sep 11, 2018 at 3:12 PM dedfft ***@***.***> wrote: Could please anybody share the final ipa for Facebook with patched ssl pinning? Unfortunately i dont have any framework for patching it myself( — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#13 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AZjAvhoB_kPXCaAjWSHADmOakL0cBkuMks5uZ35hgaJpZM4HzqY6> .

-- <https://about.me/asad0x01?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=gmail_api&utm_content=thumb> Asadul Islam about.me/asad0x01 <https://about.me/asad0x01?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=gmail_api&utm_content=thumb>

dedfft · 2018-09-11T21:25:08Z

U have the facebook patched ipa? Could you please share it?
It is my passion to study https of facebook and that kills me that i am unable to patch it myself to see(((

asad0x01 · 2018-09-11T21:46:31Z

@dedfft you can use this guide by @phwd https://www.facebook.com/113702895386410/videos/1466262083463811/ .Let me know if you need IPA :)

dedfft · 2018-09-11T21:55:20Z

Hello Asad, thank you for the video hint! I have already watched it this year several times, unfortunately i was unable to replicate the procedure several times and was disappointed in myself..

I am curios not in the process of debugging of an ipa, but more in looking at how facebook works inside..
If you could share already patched ipa with me, it would be amazing!

Could you? If that is not too much to ask. Please

asad0x01 · 2018-09-12T14:31:33Z

Please check your mail :) @dedfft

…

On Wed, Sep 12, 2018 at 3:55 AM dedfft ***@***.***> wrote: Hello Asad, thank you for the video hint! I have already watched it this year several times, unfortunately i was unable to replicate the procedure several times and was disappointed in myself.. I am curios not in the process of debugging of an ipa, but more in looking at how facebook works inside.. If you could share already patched ipa with me, it would be amazing! My email is ***@***.*** Could you? If that is not too much to ask. Please — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#13 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AZjAvr18S5qc07e1M8r3AOPSwmv36WZFks5uaDFJgaJpZM4HzqY6> .

-- <https://about.me/asad0x01?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=gmail_api&utm_content=thumb> Asadul Islam about.me/asad0x01 <https://about.me/asad0x01?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=gmail_api&utm_content=thumb>

liuxuan30 · 2018-09-14T01:31:04Z

@asad0x01 I would also want to have one thank you. email is [email protected]

kewtvvw · 2018-09-14T09:51:16Z

@dedfft you can use this guide by @phwd https://www.facebook.com/113702895386410/videos/1466262083463811/ .Let me know if you need IPA :)

@asad0x01 can you share .ipa file with me as well? email: [email protected].
Many thanks!

asad0x01 · 2018-09-14T12:39:14Z

Hey sorry guys.The latest Facebook app is crashing.Still I'm able to intercept https request of other apps.(Moments,Facebook Page Manager). Let me know if you need any of them.I've the base IPA of Facebook app.Not the modified one.

asad0x01 · 2018-09-14T12:41:32Z

For android you can try https://github.com/pouyadarabi/Facebook_SSL_Pinning (Facebook for android Version 175).Also make sure that your android version is Lollipop or above.

asad0x01 · 2018-09-14T13:11:36Z

Here is the Stock IPA of Facebook APP:https://mega.nz/#!lmpBHIAI!yEMBmTSVHmHNzmXB-Jq8_TMzTOvV5fbZ-awJUGxvsxs

Here is the Modified Facebook Pages IPA:https://mega.nz/#!omhlQY6A!95c5LW34bcpFyP1u_G8s32kKrYL1Wlf0oEI49AxZuHA

Here is the Modified Moments IPA:https://mega.nz/#!RngjwArB!AjD66ZXnjNVOvPLs_nfIAEkplI-xgOnUc4q5KU8-LPw

You can install those IPA's using Cydia Impactor.Note that you can only intercept request of those TWO IPA(Facebook Page Manager and Moments).
Thanks to @phwd

dedfft · 2018-09-14T13:37:39Z

Thank you asad, that is fantastic!!
But what about main favebook patched app? Ipa

asad0x01 · 2018-09-14T13:42:57Z

It's crashing unfortunately :( But when I tried it a months ago it was working perfectly.However I'll wait for the next update :)

Eastkap · 2018-09-19T15:27:43Z

I'm trying to do this with Instagram, should this process work ? How could I disable it's SSL pinning?

dedfft · 2018-09-24T20:51:43Z

Maybe any luck with disabled ssl pinning on previous Facebook app versions? I really need at least anything((

portseif · 2018-09-25T22:34:20Z

@asad0x01 can you do other apps as well? Please email me: [email protected]

S00164379 · 2018-09-27T15:32:22Z

Hi,

I have been doing some research and it appears that these days many applications are conducting ssl pinning by OpenSSL library, usually with stripped symbols.

Thus i have wrote simple patcher for this and similar old school hooking with set of hooks/tasks.
https://github.com/karek314/hexbytescanner - binary patcher with json hooks
https://github.com/karek314/hexbytescanner-hooks - hooks itself

Right now i have found that popular library is OpenSSL 1.0.2, if binary does have symbols, ssl pinning can be easily disabled by hooking ssl_verify_cert_chain. However, often it's not possible because of missing symbols.

It can be solved with .json hook and patcher i've made. Hook below is OpenSSL 1.0.2 hook on aarch64
[
  {
    "pattern": "94????0034E80340F9FF0218EB??FCFF54E00313AAE10314AA",
    "patchBytes": "1F2003D5",
    "patchDistance": "0x1"
  }
]
In case someone needs it, here is simple shell script assisting in repacking ipa https://github.com/karek314/HandyIPAPatcher

Additionally, those hooks can be also implemented in ssl-kill-switch2 by utilising vm_read and vm_write with more traditional dynamic byte pattern scanning and patching. If i will find some more free time i will prepare pr, however maybe it will interest you @nabla-c0d3.

If anyone finds some other hooks and feels like sharing them, feel free to pr those in https://github.com/karek314/hexbytescanner-hooks

Is it possible to do this without a mac using frida?

ghost · 2018-09-28T17:54:52Z

@S00164379 Nope. hexbytescanner is written in Objective C++, shouldn't be that hard to rewrite to C++ though.

asad0x01 · 2018-11-09T02:44:15Z

@asad0x01 can you do other apps as well? Please email me: [email protected]

ah!NO!Sorry :(

liuxuan30 · 2018-12-13T01:22:23Z

@asad0x01 any luck with latest Facebook app?

asad0x01 · 2019-02-04T23:40:18Z

Hi,

I have been doing some research and it appears that these days many applications are conducting ssl pinning by OpenSSL library, usually with stripped symbols.

Thus i have wrote simple patcher for this and similar old school hooking with set of hooks/tasks.
https://github.com/karek314/hexbytescanner - binary patcher with json hooks
https://github.com/karek314/hexbytescanner-hooks - hooks itself

Right now i have found that popular library is OpenSSL 1.0.2, if binary does have symbols, ssl pinning can be easily disabled by hooking ssl_verify_cert_chain. However, often it's not possible because of missing symbols.

It can be solved with .json hook and patcher i've made. Hook below is OpenSSL 1.0.2 hook on aarch64
[
  {
    "pattern": "94????0034E80340F9FF0218EB??FCFF54E00313AAE10314AA",
    "patchBytes": "1F2003D5",
    "patchDistance": "0x1"
  }
]
In case someone needs it, here is simple shell script assisting in repacking ipa https://github.com/karek314/HandyIPAPatcher

Additionally, those hooks can be also implemented in ssl-kill-switch2 by utilising vm_read and vm_write with more traditional dynamic byte pattern scanning and patching. If i will find some more free time i will prepare pr, however maybe it will interest you @nabla-c0d3.

If anyone finds some other hooks and feels like sharing them, feel free to pr those in https://github.com/karek314/hexbytescanner-hooks

@nabla-c0d3 do you have any plan to implement this in ssl kill switch 2?Thanks in advance :)

ghost · 2019-02-07T19:24:09Z

@asad0x01 Doesn't work anymore. It for sure does work with OpenSSL 1.1.0 and 1.0.2 ARM64(which still does work with many apps). Current answer lays in https://github.com/facebookincubator/fizz it does pinning now, it's open source, shouldn't be hard but I haven't had time to play around. In past it relied with pinning on OpenSSL. If anyone finds stable pattern to hook pinning function, feel free to share patch here https://github.com/karek314/hexbytescanner-hooks :)

ghost · 2020-11-25T04:06:22Z

The only way to bypass facebook SSL pinning for now is by using frida and objection.

russian-developer · 2021-04-23T17:16:36Z

The only way to bypass facebook SSL pinning for now is using frida and objection.

a very complicated way. :( okay…

ghost · 2021-04-23T18:17:02Z

The only way to bypass facebook SSL pinning for now is using frida and objection.

a very complicated way. :( okay…

https://github.com/tsarpaul/FBUnpinner

nabla-c0d3 added the wontfix label May 2, 2019

Not working with Facebook #13

Not working with Facebook #13

Comments

JohnCoates commented Mar 18, 2016

nabla-c0d3 commented Mar 27, 2016

Grazfather commented Apr 13, 2016

Grazfather commented Apr 13, 2016

nabla-c0d3 commented Apr 13, 2016

isayeter commented Apr 24, 2016

kopiro commented Jun 17, 2016

alfondotnet commented Jul 30, 2016 • edited Loading

kopiro commented Jul 31, 2016

nabla-c0d3 commented Aug 6, 2016 • edited Loading

AdrienMangoo commented Sep 5, 2016

ghost commented Sep 8, 2016

nabla-c0d3 commented Sep 8, 2016

liuxuan30 commented Sep 12, 2016

liuxuan30 commented Sep 12, 2016

liuxuan30 commented Sep 18, 2016

AdrienMangoo commented Sep 27, 2016

liuxuan30 commented Sep 28, 2016

ch3repatz commented Sep 29, 2016 • edited Loading

alfondotnet commented Sep 29, 2016

ch3repatz commented Sep 29, 2016

nabla-c0d3 commented Sep 29, 2016

liuxuan30 commented Sep 30, 2016

ch3repatz commented Sep 30, 2016

liuxuan30 commented Sep 30, 2016 • edited Loading

ch3repatz commented Sep 30, 2016

liuxuan30 commented Sep 30, 2016 • edited Loading

xuanliu-aa commented Oct 12, 2016

nabla-c0d3 commented Oct 12, 2016 • edited Loading

liuxuan30 commented Oct 13, 2016

bruno-rocha-movile commented Nov 3, 2016

ghost commented Aug 17, 2018 • edited by ghost Loading

mdbrelo commented Aug 17, 2018

liuxuan30 commented Aug 20, 2018

ghost commented Aug 20, 2018

dedfft commented Sep 11, 2018

asad0x01 commented Sep 11, 2018 via email

dedfft commented Sep 11, 2018

asad0x01 commented Sep 11, 2018

dedfft commented Sep 11, 2018 • edited Loading

asad0x01 commented Sep 12, 2018 via email

liuxuan30 commented Sep 14, 2018

kewtvvw commented Sep 14, 2018

asad0x01 commented Sep 14, 2018

asad0x01 commented Sep 14, 2018

asad0x01 commented Sep 14, 2018

dedfft commented Sep 14, 2018

asad0x01 commented Sep 14, 2018

Eastkap commented Sep 19, 2018 • edited Loading

dedfft commented Sep 24, 2018

portseif commented Sep 25, 2018

S00164379 commented Sep 27, 2018

ghost commented Sep 28, 2018

asad0x01 commented Nov 9, 2018

liuxuan30 commented Dec 13, 2018

asad0x01 commented Feb 4, 2019

ghost commented Feb 7, 2019

ghost commented Nov 25, 2020 • edited by ghost Loading

russian-developer commented Apr 23, 2021

ghost commented Apr 23, 2021

alfondotnet commented Jul 30, 2016 •

edited

Loading

nabla-c0d3 commented Aug 6, 2016 •

edited

Loading

ch3repatz commented Sep 29, 2016 •

edited

Loading

liuxuan30 commented Sep 30, 2016 •

edited

Loading

liuxuan30 commented Sep 30, 2016 •

edited

Loading

nabla-c0d3 commented Oct 12, 2016 •

edited

Loading

ghost commented Aug 17, 2018 •

edited by ghost

Loading

dedfft commented Sep 11, 2018 •

edited

Loading

Eastkap commented Sep 19, 2018 •

edited

Loading

ghost commented Nov 25, 2020 •

edited by ghost

Loading