IOS SSL Pinning 单向证书检验

OSStatus SecTrustEvaluate(SecTrustRef trust, SecTrustResultType *result);

bool SecTrustEvaluateWithError(SecTrustRef trust, CFErrorRef _Nullable *error);

#include <Security/Security.h>
int main(){// 创建 X.509 信任对象  SecTrustRef trust = SecTrustCreateWithCertificates(NULL, NULL);if (trust == NULL) {return 1;  }
// 评估证书链  OSStatus status = SecTrustEvaluateWithError(trust, &error);if (status != errSecSuccess) {// 处理错误    CFStringRef errorStr = CFErrorCopyDescription(error);printf("评估证书链失败：%sn", errorStr);    CFRelease(errorStr);return 1;  }
// 释放资源  SecTrustRelease(trust);
return 0;}

SSL_CTX_set_custom_verify(SSL_CTX *ctx, verify_callback, NULL);

int verify_callback(SSL *ssl, int preverify_ok, X509_STORE_CTX *x509_store_ctx);

#include <openssl/ssl.h>
int verify_callback(SSL *ssl, int preverify_ok, X509_STORE_CTX *x509_store_ctx){// 检查证书的颁发者  X509 *cert = X509_STORE_CTX_get_current_cert(x509_store_ctx);  X509_NAME *issuer = X509_get_issuer_name(cert);char issuer_str[256];  X509_NAME_oneline(issuer, issuer_str, sizeof(issuer_str));
// 验证成功if (preverify_ok) {printf("证书颁发者：%sn", issuer_str);return 0;  }
// 验证失败printf("证书颁发者不受信任：%sn", issuer_str);return 1;}
int main(){  SSL_CTX *ctx = SSL_CTX_new(TLS_method());if (ctx == NULL) {return 1;  }
// 设置验证回调函数  SSL_CTX_set_custom_verify(ctx, verify_callback, NULL);
// ...
  SSL_CTX_free(ctx);return 0;}

SSL_CTX_set_custom_verify(SSL_CTX *ctx, enum ssl_verify_mode_t, enum ssl_verify_result_t(*callback)(SSL *ssl, uint8_t *out_alert)))

#include <openssl/ssl.h>
int main(){  SSL *ssl = SSL_new(ctx);if (ssl == NULL) {return 1;  }
// 获取身份char identity[128];int identity_len = sizeof(identity);int ret = SSL_get_psk_identity(ssl, identity, &identity_len);if (ret != 0) {printf("获取身份失败：%dn", ret);return 1;  }
// ...
  SSL_free(ssl);return 0;}

#include <openssl/ssl.h>
int main(){  SSL_CTX *ctx = SSL_CTX_new(TLS_method());if (ctx == NULL) {return 1;  }
// 设置验证模式为 SSL_VERIFY_PEER  boringssl_context_set_verify_mode_handle(ctx, SSL_VERIFY_PEER);
// ...
  SSL_CTX_free(ctx);return 0;}

const log = {"trace": function(msg){console.log("x1b[35m", ` ${msg}`, "x1b[0m")    },"debug": function(msg){console.log("x1b[32m", ` ${msg}`, "x1b[0m")    },"info": function(msg){console.log("x1b[34m", ` ${msg}`, "x1b[0m")    },"warn": function(msg){console.log("x1b[33m", ` ${msg}`, "x1b[0m")    },"error": function(msg){console.log("x1b[31m", ` ${msg}`, "x1b[0m")    },};
/** 绕过单向证书校验 */function bypassSSLPinning() {let bypass_status = false;try {/**         * SecTrustEvaluate：Security.framework的系统函数，iOS版本<13.0 可用它评估一个SecTrust对象是否可以被系统信任。         * 函数原型：OSStatus SecTrustEvaluate(SecTrustRef trust, SecTrustResultType *result);         * 参考：https://developer.apple.com/documentation/security/1394363-sectrustevaluate?language=objc         */let SecTrustEvaluate_handle = Module.findExportByName('Security', 'SecTrustEvaluate');    // 如果存在，返回一个地址信息if (SecTrustEvaluate_handle) {            Interceptor.replace(SecTrustEvaluate_handle, new NativeCallback(function (trust, result) {return 0;            }, 'int', ['pointer', 'pointer']));            log.debug(`[${SecTrustEvaluate_handle}] SecTrustEvaluate hook installed.`);            bypass_status = true;        };/**         * SecTrustEvaluateWithError：Security.framework的系统函数，iOS版本>=13.0 可用它评估一个SecTrust对象是否可以被系统信任。         * 函数原型：bool SecTrustEvaluateWithError(SecTrustRef trust, CFErrorRef  _Nullable *error);         * 参考：https://developer.apple.com/documentation/security/2980705-sectrustevaluatewitherror?language=objc         */let SecTrustEvaluateWithError_handle = Module.findExportByName('Security', 'SecTrustEvaluateWithError');if (SecTrustEvaluateWithError_handle) {            Interceptor.replace(SecTrustEvaluateWithError_handle, new NativeCallback(function (trust, error) {return 1;            }, 'int', ['pointer', 'pointer']));            log.debug(`[${SecTrustEvaluateWithError_handle}] SecTrustEvaluateWithError hook installed.`);            bypass_status = true;        };        } catch (error) {         log.error(`[!] Exception: ${error}`);        };try {/**         * SSL_CTX_set_custom_verify：该函数用于覆盖默认的ssl验证逻辑，。         * OpenSSL < 1.1.1 ,函数原型：SSL_CTX_set_custom_verify(SSL_CTX *ctx, verify_callback, NULL);         * OpenSSL >= 1.1.1,函数原型：SSL_CTX_set_custom_verify(SSL_CTX *ctx, enum ssl_verify_mode_t, enum ssl_verify_result_t(*callback)(SSL *ssl, uint8_t *out_alert)))          * 第二个参数是选择检验模式，主要看第三个参数，它是一个回调函数，如果数值为0表示检验通过。         * 参考：https://www.cnblogs.com/theseventhson/p/16051195.html         */let SSL_CTX_set_custom_verify_handle = Module.findExportByName('libboringssl.dylib', 'SSL_CTX_set_custom_verify');if (SSL_CTX_set_custom_verify_handle) {let SSL_CTX_set_custom_verify = new NativeFunction(SSL_CTX_set_custom_verify_handle, 'void', ['pointer', 'int', 'pointer']);let callback = new NativeCallback(function (ssl, out_alert) {return 0;   // 修改数值为0x0，表示检验通过            }, 'int', ['pointer', 'pointer']);            Interceptor.replace(SSL_CTX_set_custom_verify_handle, new NativeCallback(function (ctx, mode, ssl_verify_result_t) {                SSL_CTX_set_custom_verify(ctx, 0, callback);                }, 'void', ['pointer', 'int', 'pointer'])            );            log.debug(`[${SSL_CTX_set_custom_verify_handle}] SSL_CTX_set_custom_verify hook installed.`);            bypass_status = true;        };/**         * SSL_get_psk_identity：用于获取 TLS-PSK 握手中使用的身份，该函数的返回值为 0 表示成功，非 0 表示失败。         * 函数原型：SSL_get_psk_identity(SSL_CTX *ctx, char identity, int identity_len);         * 参考：https://nabla-c0d3.github.io/blog/2019/05/18/ssl-kill-switch-for-ios12/         */let SSL_get_psk_identity_handle = Module.findExportByName('libboringssl.dylib', 'SSL_get_psk_identity');if (SSL_get_psk_identity_handle) {            Interceptor.replace(SSL_get_psk_identity_handle, new NativeCallback(function (ctx, identity, identity_len) {return 0;            }, 'int', ['pointer', 'char', 'int']));            log.debug(`[${SSL_get_psk_identity_handle}] SSL_get_psk_identity hook installed.`);            bypass_status = true;        };/**         * boringssl_context_set_verify_mode：用于设置 SSL 上下文的验证模式，该函数的返回值为 0 表示成功，非 0 表示失败。         * 函数原型：boringssl_context_set_verify_mode_handle(SSL_CTX *ctx, mode);         * 参考：https://gist.github.com/azenla/37f941de24c5dfe46f3b8e93d94ce909         */let boringssl_context_set_verify_mode_handle = Module.findExportByName('libboringssl.dylib', 'boringssl_context_set_verify_mode');if (boringssl_context_set_verify_mode_handle) {            Interceptor.replace(boringssl_context_set_verify_mode_handle, new NativeCallback(function (ctx, mode) {return 0;            }, 'int', ['pointer', 'pointer'])            );            log.debug(`[${SSL_get_psk_identity_handle}] boringssl_context_set_verify_mode() hook installed.`);            bypass_status = true;        };
    } catch (error) {        log.error(`[!] Exception: ${error}`);    };if (bypass_status) {        log.info("[+] bypass ssl pinning.");    };};
bypassSSLPinning();