Question: How Tiktok detect that SSL pinning bypassed? #9

Sasa2023 · 2022-11-26T22:32:31Z

Hi,

First thank you very much for your wonderful job here, it works like charm.

Second, The problem is that somehow Tiktok actually detect that SSL pinning is bypassed, so most of actions such as follow is not working.

Do you have an idea how this happens?

Thanks you again, I appreciated your work,

Sasa

hackercxj · 2022-12-13T10:06:47Z

My account permanently banned after I use the patched apk of v25.9.4. o(T_T)o

But I learn a lot from this project. Thanks.

Eltion · 2022-12-13T10:42:17Z

I'll look into this soon, it could be that they are detecting that frida-gadget is being used :)

arifaslaan · 2022-12-15T01:53:38Z

Have you had the opportunity to review? They also blocked the registration process at the moment.

Eltion · 2022-12-15T02:05:58Z

@arifaslaan not yet :(

kaykyr · 2022-12-19T16:38:02Z

Hi! I am following this topic as well.

I am working on a Frida Script to bypass on iOS. If anybody interested, this is all I have so far:

console.log("iOS 15 Bypass SSL Pinning")

console.log('\n')

var sslSetCustomVerify
var sslCtxSetCustomVerify
var sslGetPskIdentity

try {
	Module.ensureInitialized("libboringssl.dylib")
    console.log("libboringssl.dylib module loaded.")
} catch(err) {
	console.log("libboringssl.dylib module not loaded. Trying to manually load it.")
	Module.load("libboringssl.dylib");  
}

console.log('\n')

const customVerifyCallback = new NativeCallback(function (ssl, out_alert) {
    console.log(ssl)
    console.log(out_alert)
	console.log(`[!!!!] Custom SSL context verify callback called. Returning SSL_VERIFY_NONE`)
	return 0
}, "int", ["pointer", "pointer"])

const customCTXVerifyCallback = new NativeCallback(function (ssl, out_alert) {
    console.log(ssl)
    console.log(out_alert)
	console.log(`[!!!!] Custom SSL CTX context verify callback called. Returning SSL_VERIFY_NONE`)
	return 0
}, "int", ["pointer", "pointer"])

try {
    console.log("Setting custom verify callback...")

	sslSetCustomVerify = new NativeFunction(
		Module.findExportByName("libboringssl.dylib", "SSL_set_custom_verify"),
		'void', ['pointer', 'int', 'pointer']
	);
	Interceptor.replace(sslSetCustomVerify, new NativeCallback(function(ssl, mode, callback) {
		sslSetCustomVerify(ssl, mode, customVerifyCallback)
	}, 'void', ['pointer', 'int', 'pointer']))

    console.log("Custom verify callback set.")
} catch (e) {
    console.log("Cannot set custom verify callback. Trying SSL_CTX_set_custom_verify")

    try {
        sslCtxSetCustomVerify = new NativeFunction(
            Module.findExportByName("libboringssl.dylib", "SSL_CTX_set_custom_verify"),
            'void', ['pointer', 'int', 'pointer']
        );
        Interceptor.replace(sslCtxSetCustomVerify, new NativeCallback(function(ssl, mode, callback) {
            console.log(`SSL_CTX_set_custom_verify(), setting custom callback.`)
            sslCtxSetCustomVerify(ssl, mode, customCTXVerifyCallback)
        }, 'void', ['pointer', 'int', 'pointer']))
    } catch (e) {
        console.log("Cannot set CTX custom verify callback!")
    }
}

console.log('\n')

try {
    console.log("Setting PSK identity...")

	sslGetPskIdentity = new NativeFunction(
		Module.findExportByName("libboringssl.dylib", "SSL_get_psk_identity"),
		'pointer', ['pointer']
	);

    Interceptor.replace(sslGetPskIdentity, new NativeCallback(function(ssl) {
        console.log(`SSL_get_psk_identity(), returning "fakePSKidentity"`)
        console.log(ssl)
        return "fakePSKidentity"
    }, 'pointer', ['pointer']))

    console.log("PSK identity set.")
} catch (e) {
	console.log("Cannot set PSK identity")
}

demon071 · 2022-12-26T14:07:22Z

Does it work with apps other than Tiktok?

Sasa2023 · 2023-01-05T08:21:39Z

Hi @Eltion and everyone,

Is it possible to hook libsscronet after is has been loaded?

Also I thinks that jsBridge is changing the app behavior at runtime by adding new methods or remove others.

Thanks,
Sasa

Eltion · 2023-01-05T12:44:51Z

@Sasa2023, You can run frida to attach to the process and spawn the app.

frida -U -l .\tiktok-ssl-pinning-bypass.js com.zhiliaoapp.musically

So you can open app normally then attach frida to it

Sasa2023 · 2023-01-06T02:40:21Z

@Eltion I am actually doing this but the app is crashing or the hook doesn't work and SSL pinning can't be bypassed.

Eltion · 2023-01-11T12:13:03Z

@Sasa2023 Yes actually it won't work. The reason is that method SSL_CTX_set_custom_verify is only called at the beginning when the app opens :(.

Eltion · 2023-01-11T12:18:47Z

@arifaslaan, @hackercxj , @Sasa2023 can you let me know if you're using frida or patched apk when you're getting these problems?

Eltion · 2023-01-11T21:37:18Z

I've added a new function spoofSignature to fake the signature of the patched apk to appear as signed by tiktok with the same signature as the original apk, I think this maybe is how they figured out that the apk was patched.

2fe2089#diff-692fc9858059052547bb966a14284c25c34198dddd6f2665f0e804ef5895e3ac

arifaslaan · 2023-01-12T00:32:27Z

@arifaslaan, @hackercxj , @Sasa2023 can you let me know if you're using frida or patched apk when you're getting these problems?

Hi Eltion,

I just use patched app. Because it's enough for me. It helps me listen to the app. I don't need to inject with frida again. Actually, I've been dealing with TikTok for about three years. At first, such complex blocking methods did not exist. But right now there is a lot of confusion. I follow all of the things you mentioned above. I'll let you know when I find a solution or something similar. On the Android side, even having the developer options of the phone turned on is a problem in some cases. In fact, all they do is create confusion and complicate the solution. They've always done that. Sorry I went a little off topic.

Best Regards.

arifaslaan · 2023-01-12T00:34:55Z

I've added a new function spoofSignature to fake the signature of the patched apk to appear as signed by tiktok with the same signature as the original apk, I think this maybe is how they figured out that the apk was patched.

An ingenious idea. I'll let you know the result after I try it.

Eltion · 2023-01-14T01:00:16Z

@arifaslaan thank you :)

Sasa2023 · 2023-01-16T21:21:23Z

@Eltion Wow great work faking the sig is actually works but some actions are still detected, Do you have an idea where it might be check and detect emulator I mean in java layer or native layer!?

Thanks a lot @Eltion for your effort and beautiful work :-)

Sasa

Eltion · 2023-01-17T01:20:33Z

@Sasa2023 You're using an emulator? which one? For me I've tested om my phone, actions like follow work :)

Sasa2023 · 2023-01-17T18:43:37Z

Hi @Eltion Thanks a lot for your reply! first I was using Nox player as it was tested by you but I wasn't able to bypass emulator detection because it prevents some API endpoints then I used a real android device with your great script and everything was fine until my device get blocked first they block the IP then they block the device itself and you know it is not that easy to fake change the device info as Tiktok actually record a great deal of data about the device almost everything including if it is emulator, has frida, has cydia, rooted, jailbreaked and so on.

Also I don't know exactly where the register_device function located which read the phone IMEI and others so I can hook it with frida.

Also I am pretty sure that they detect frida gadget but your great work around by spoofing real app package was able to bypass requests such as follow and login.

@Eltion Thank you so much bro.
Sasa

Eltion · 2023-01-19T06:05:18Z

@Sasa2023 does the normal tiktok app work for you? I'll try later to create a patch with custom frida-gadget, that may help

Sasa2023 · 2023-01-19T08:26:13Z

@Eltion Thank you very much for your reply! Yes the normal tiktok app is working fine with me. It think that the custom frida-gadget is a great idea. if you need any help please let me know.

themmfa · 2023-02-05T10:56:40Z

Hey. Can you guys intercept the tiktok traffic r? I tried with patched apk but could not achieve what I want. Traffic is still encoded.

technicaljicama · 2023-02-12T16:27:21Z

tiktok detects frida and other things such as root. they get sent (encrypted) over their mssdk security system

senolatac · 2023-03-02T09:39:02Z

I can provide bounty for decrypted traffic

AskhatMaksut · 2023-03-02T12:50:14Z

Hello @Eltion! Why does the registration process stop working in the latest version 27.8.1 after adding a signature via apksigner? Do you have some original keystore file?

yoshimo · 2023-03-17T15:20:56Z

tiktok detects frida and other things such as root. they get sent (encrypted) over their mssdk security system

Do they detect strong frida too?

simmison · 2023-03-28T11:09:53Z

Sorry this is a little off topic, but maybe someone here can help me out. Has anyone somehow found a way to use TikTok on an emulator? I have tried many things, but TikTok always recognizes very quickly that I am using an emulator. For example, I have tried different emulators like Bluestack, Nox or AVD and rooted it and changed the fingerprint of the device with Magisk Hide Config, but TikTok still recognizes that I am using an emulator.

p1tsi · 2023-05-09T10:49:17Z

Hi! I am following this topic as well.

I am working on a Frida Script to bypass on iOS. If anybody interested, this is all I have so far:

console.log("iOS 15 Bypass SSL Pinning")

console.log('\n')

var sslSetCustomVerify
var sslCtxSetCustomVerify
var sslGetPskIdentity

try {
	Module.ensureInitialized("libboringssl.dylib")
    console.log("libboringssl.dylib module loaded.")
} catch(err) {
	console.log("libboringssl.dylib module not loaded. Trying to manually load it.")
	Module.load("libboringssl.dylib");  
}

console.log('\n')

const customVerifyCallback = new NativeCallback(function (ssl, out_alert) {
    console.log(ssl)
    console.log(out_alert)
	console.log(`[!!!!] Custom SSL context verify callback called. Returning SSL_VERIFY_NONE`)
	return 0
}, "int", ["pointer", "pointer"])

const customCTXVerifyCallback = new NativeCallback(function (ssl, out_alert) {
    console.log(ssl)
    console.log(out_alert)
	console.log(`[!!!!] Custom SSL CTX context verify callback called. Returning SSL_VERIFY_NONE`)
	return 0
}, "int", ["pointer", "pointer"])

try {
    console.log("Setting custom verify callback...")

	sslSetCustomVerify = new NativeFunction(
		Module.findExportByName("libboringssl.dylib", "SSL_set_custom_verify"),
		'void', ['pointer', 'int', 'pointer']
	);
	Interceptor.replace(sslSetCustomVerify, new NativeCallback(function(ssl, mode, callback) {
		sslSetCustomVerify(ssl, mode, customVerifyCallback)
	}, 'void', ['pointer', 'int', 'pointer']))

    console.log("Custom verify callback set.")
} catch (e) {
    console.log("Cannot set custom verify callback. Trying SSL_CTX_set_custom_verify")

    try {
        sslCtxSetCustomVerify = new NativeFunction(
            Module.findExportByName("libboringssl.dylib", "SSL_CTX_set_custom_verify"),
            'void', ['pointer', 'int', 'pointer']
        );
        Interceptor.replace(sslCtxSetCustomVerify, new NativeCallback(function(ssl, mode, callback) {
            console.log(`SSL_CTX_set_custom_verify(), setting custom callback.`)
            sslCtxSetCustomVerify(ssl, mode, customCTXVerifyCallback)
        }, 'void', ['pointer', 'int', 'pointer']))
    } catch (e) {
        console.log("Cannot set CTX custom verify callback!")
    }
}

console.log('\n')

try {
    console.log("Setting PSK identity...")

	sslGetPskIdentity = new NativeFunction(
		Module.findExportByName("libboringssl.dylib", "SSL_get_psk_identity"),
		'pointer', ['pointer']
	);

    Interceptor.replace(sslGetPskIdentity, new NativeCallback(function(ssl) {
        console.log(`SSL_get_psk_identity(), returning "fakePSKidentity"`)
        console.log(ssl)
        return "fakePSKidentity"
    }, 'pointer', ['pointer']))

    console.log("PSK identity set.")
} catch (e) {
	console.log("Cannot set PSK identity")
}

Are you sure that this script works for iOS bypass? I tried with TikTok v29.2.0 and it seems it doesn't work.

abdullahsaeed98 · 2023-05-25T08:53:56Z

This works in TIKTOK iOS app installed in playcover in M1 macs

first open tiktok. and finds its PID and then use this command.

frida -p PID -l script.js

// Existing hook for TTHttpTask
Interceptor.attach(ObjC.classes.TTHttpTask["- skipSSLCertificateError"].implementation, {
    onEnter: function (args) {},
    onLeave: function (retval) {
        console.log('Overriding -> TTHttpTask skipSSLCertificateError : ');
        retval.replace(0x1)
    }
});

@p1tsi @kaykyr

Sicks3c · 2023-08-18T17:50:43Z

This works in TIKTOK iOS app installed in playcover in M1 macs

first open tiktok. and finds its PID and then use this command.

frida -p PID -l script.js
// Existing hook for TTHttpTask
Interceptor.attach(ObjC.classes.TTHttpTask["- skipSSLCertificateError"].implementation, {
    onEnter: function (args) {},
    onLeave: function (retval) {
        console.log('Overriding -> TTHttpTask skipSSLCertificateError : ');
        retval.replace(0x1)
    }
});
@p1tsi @kaykyr

When running tiktok app it crushes auto after few seconds means the PID became unavailable

abdullahsaeed98 · 2023-08-19T06:43:09Z

This works in TIKTOK iOS app installed in playcover in M1 macs
first open tiktok. and finds its PID and then use this command.
frida -p PID -l script.js
// Existing hook for TTHttpTask
Interceptor.attach(ObjC.classes.TTHttpTask["- skipSSLCertificateError"].implementation, {
    onEnter: function (args) {},
    onLeave: function (retval) {
        console.log('Overriding -> TTHttpTask skipSSLCertificateError : ');
        retval.replace(0x1)
    }
});
@p1tsi @kaykyr
When running tiktok app it crushes auto after few seconds means the PID became unavailable

Try on this verison TikTokLRD 24.8.0 ipa you can find it online.

Sicks3c · 2023-08-19T08:54:54Z

This works in TIKTOK iOS app installed in playcover in M1 macs
first open tiktok. and finds its PID and then use this command.
frida -p PID -l script.js
// Existing hook for TTHttpTask
Interceptor.attach(ObjC.classes.TTHttpTask["- skipSSLCertificateError"].implementation, {
    onEnter: function (args) {},
    onLeave: function (retval) {
        console.log('Overriding -> TTHttpTask skipSSLCertificateError : ');
        retval.replace(0x1)
    }
});
@p1tsi @kaykyr
When running tiktok app it crushes auto after few seconds means the PID became unavailable
Try on this verison TikTokLRD 24.8.0 ipa you can find it online.

Thanks, but I couldn't find a trusted link really I hope you can provide one if you have it available
Cheers

arstoo6001 · 2023-10-05T13:03:59Z

Eltion, bro can you find solution for Bypass SSL piining App like Likee

brunoaduarte · 2023-10-10T06:41:49Z

This works in TIKTOK iOS app installed in playcover in M1 macs

first open tiktok. and finds its PID and then use this command.

frida -p PID -l script.js

frida -p $(frida-ps | sed -n -E 's/^[[:space:]]*([0-9]+)[[:space:]]*TikTok.*/\1/p') -l script.js

brunoaduarte · 2023-10-18T20:46:22Z

This works in TIKTOK iOS app installed in playcover in M1 macs
first open tiktok. and finds its PID and then use this command.
frida -p PID -l script.js
// Existing hook for TTHttpTask
Interceptor.attach(ObjC.classes.TTHttpTask["- skipSSLCertificateError"].implementation, {
    onEnter: function (args) {},
    onLeave: function (retval) {
        console.log('Overriding -> TTHttpTask skipSSLCertificateError : ');
        retval.replace(0x1)
    }
});
@p1tsi @kaykyr
When running tiktok app it crushes auto after few seconds means the PID became unavailable
Try on this verison TikTokLRD 24.8.0 ipa you can find it online.

@abdullahsaeed98 it also works with the latest version TikTokLRD 31.5.0, I've just tested it.

junai-py · 2024-04-15T06:58:54Z

@Eltion Im using this patched APK in my rooted device but the app is keep crashing every time when i'm opening

there is any reason for it? what else we can try here ?

Sasa2023 assigned Eltion Nov 26, 2022

Eltion mentioned this issue Jun 24, 2023

Edit Profile pic-Nickname not working. #20

Closed

Question: How Tiktok detect that SSL pinning bypassed? #9

Question: How Tiktok detect that SSL pinning bypassed? #9

Comments

Sasa2023 commented Nov 26, 2022

hackercxj commented Dec 13, 2022

Eltion commented Dec 13, 2022

arifaslaan commented Dec 15, 2022

Eltion commented Dec 15, 2022

kaykyr commented Dec 19, 2022 • edited Loading

demon071 commented Dec 26, 2022

Sasa2023 commented Jan 5, 2023

Eltion commented Jan 5, 2023

Sasa2023 commented Jan 6, 2023

Eltion commented Jan 11, 2023 • edited Loading

Eltion commented Jan 11, 2023

Eltion commented Jan 11, 2023

arifaslaan commented Jan 12, 2023

arifaslaan commented Jan 12, 2023

Eltion commented Jan 14, 2023

Sasa2023 commented Jan 16, 2023

Eltion commented Jan 17, 2023

Sasa2023 commented Jan 17, 2023

Eltion commented Jan 19, 2023

Sasa2023 commented Jan 19, 2023

themmfa commented Feb 5, 2023

technicaljicama commented Feb 12, 2023

senolatac commented Mar 2, 2023

AskhatMaksut commented Mar 2, 2023

yoshimo commented Mar 17, 2023

simmison commented Mar 28, 2023

p1tsi commented May 9, 2023

abdullahsaeed98 commented May 25, 2023

Sicks3c commented Aug 18, 2023

abdullahsaeed98 commented Aug 19, 2023

Sicks3c commented Aug 19, 2023

arstoo6001 commented Oct 5, 2023

brunoaduarte commented Oct 10, 2023 • edited Loading

brunoaduarte commented Oct 18, 2023

junai-py commented Apr 15, 2024

kaykyr commented Dec 19, 2022 •

edited

Loading

Eltion commented Jan 11, 2023 •

edited

Loading

brunoaduarte commented Oct 10, 2023 •

edited

Loading