Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[bug] Script and application crashes right after trying to disable ssl pinning on iOS #649

Open
0xn4d opened this issue Nov 24, 2023 · 0 comments
Labels
freshissue Default label for new, untriaged issues.

Comments

@0xn4d
Copy link

0xn4d commented Nov 24, 2023

Hello, everyone.

I am trying to use the main frida's script to disable an SSL Pinning but I am also getting this error below.

Steps to reproduce the behavior:

  1. Plug the device within the computer through USB cable
  2. Run command frida-ps -U -ai
  3. Get the bundleIdentifier of DVIA-v2
  4. Run command objection -g <bundle> --debug explore
  5. (Within objection) Run command ios sslpinning disable

Expected behavior:

The script should just continue and indeed disable SSL Pinning protection as I have seen in some walkthroughs.

Evidence / Logs / Screenshots:

...dehacks.DVIAswiftv2.PS93BCYCGQ on (iPhone: 15.7.8) [usb] # ios sslpinning disable
- [incoming message] ------------------
{
  "payload": "\u001b[90mHooking common framework methods\u001b[39m",
  "type": "send"
}
- [./incoming message] ----------------
(agent) Hooking common framework methods
- [incoming message] ------------------
{
  "payload": "\u001b[90mFound NSURLSession based classes. Hooking known pinning methods.\u001b[39m",
  "type": "send"
}
- [./incoming message] ----------------
(agent) Found NSURLSession based classes. Hooking known pinning methods.
- [incoming message] ------------------
{
  "payload": "\u001b[90mHooking lower level SSL methods\u001b[39m",
  "type": "send"
}
- [./incoming message] ----------------
(agent) Hooking lower level SSL methods
- [incoming message] ------------------
{
  "payload": "\u001b[90mHooking lower level TLS methods\u001b[39m",
  "type": "send"
}
- [./incoming message] ----------------
(agent) Hooking lower level TLS methods
- [incoming message] ------------------
{
  "payload": "\u001b[90mHooking BoringSSL methods\u001b[39m",
  "type": "send"
}
- [./incoming message] ----------------
(agent) Hooking BoringSSL methods
An unexpected internal exception has occurred. If this looks like a code related error, please file a bug report!
script has been destroyed

Python stack trace: Traceback (most recent call last):
  File "C:\Users\danil\AppData\Local\Programs\Python\Python311\Lib\site-packages\objection\console\repl.py", line 371, in start_repl
    self.run_command(document)
  File "C:\Users\danil\AppData\Local\Programs\Python\Python311\Lib\site-packages\objection\console\repl.py", line 185, in run_command
    exec_method(arguments)
  File "C:\Users\danil\AppData\Local\Programs\Python\Python311\Lib\site-packages\objection\commands\ios\pinning.py", line 26, in ios_disable
    api.ios_pinning_disable(_should_be_quiet(args))
  File "C:\Users\danil\AppData\Local\Programs\Python\Python311\Lib\site-packages\frida\core.py", line 179, in method
    return script._rpc_request("call", js_name, args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\danil\AppData\Local\Programs\Python\Python311\Lib\site-packages\frida\core.py", line 86, in wrapper
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "C:\Users\danil\AppData\Local\Programs\Python\Python311\Lib\site-packages\frida\core.py", line 491, in _rpc_request
    raise result.error
frida.InvalidOperationError: script has been destroyed

Environment (please complete the following information):

  • Device: iPhone 7
  • OS: iOS 15.7.8
  • Frida Version 16.1.7
  • Objection Version 1.11.0

Application:

DVIA-v2.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
freshissue Default label for new, untriaged issues.
Projects
None yet
Development

No branches or pull requests

1 participant