java.lang.ClassNotFoundException: com.android.org.conscrypt.TrustManagerImpl

[fuzion24]

java.lang.ClassNotFoundException: com.android.org.conscrypt.TrustManagerImpl

[jakev]

The TrustManagerImpl class doesn't exist on older APIs, so we shouldn't try to hook it if it doesn't exist. I'm about to push a fix to my repo, will update you once I confirm it works for me :)

[anthonycvella]

Ahh that's what I figured but I couldn't find a reference as to which API started including TrustManagerImpl.

[jakev]

@Snwspeckle try installing the bin associated with this: jakev@862716f

[anthonycvella]

@jakev I still seem to be getting the errors which are being thrown on line 144. I think this check also needs to be included there?

[jakev]

Yup, it does. Doh, missed that one.

[anthonycvella]

@jakev Are you going to make the change or should I make it and submit a pull request?

[jakev]

Sorry @Snwspeckle - I'm building right now. Link in just a sec.

[anthonycvella]

@jakev No problem, I'm busy building other things as well.

About this tool, by having this installed and running, is there anything else I need to configure to prevent an app from making calls using SSL? (I'm trying to discover hidden endpoints for an app.) The reason I ask is because I've installed this tool but with wireshark I still see the app requesting GoDadddy for a certificate.

[jakev]

@Snwspeckle please try: jakev@b03a283. I apologize if you still have issues, I don't have an API 17 device with me that has Xposed running ATM.

Note that this tool doesn't prevent an app from making calls using SSL, it aims to disable / bypass certificate checks that might fail when man-in-the-middling an application. If you install this you'll still see encrypted traffic, but if you place a proxy between the app and the remote servers, you should be able to see the traffic. :)

[Fuzion24]

@jakev would you mind opening a pull req with the additional check?

[jakev]

@Fuzion24 absolutely! I was hoping to hear back from @Snwspeckle to confirm it worked before submitting the pull request.If i don't hear back in a few hours I'll create the pull request.

[anthonycvella]

@jakev Sorry for not responding! I got caught up in working on something else. The patch did work and the exceptions are no longer thrown.

Unfortunately, it didn't work for what I needed it to do. Looks like the app I'm working to reverse engineer is written in C++ and is using libcurl for all networking requests which does its own certificate pinning & certificate host verification.

[jakev]

@Fuzion24 created: #11 :)

[anthonycvella]

@jakev Once the pull request has been accepted, I'll go ahead and mark this issue as closed. Thanks for the fix!