frida绕过OKhttp3证书单向绑定（附脚本）

// 配置 OkHttpClientOkHttpClient okHttpClient = new OkHttpClient.Builder()        .sslSocketFactory(sslContext.getSocketFactory(), new TrustServerCerts(serverCertificate))        .hostnameVerifier((hostname, session) -> true) // 不验证域名        .addInterceptor(loggingInterceptor)        .build();

public class TrustAllCerts implements X509TrustManager {    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {    }    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {    }    public X509Certificate[] getAcceptedIssuers() {        return new X509Certificate[0];    }}

Java.perform(function() {// 创建TrustAllCerts类，信任所有证书    var TrustAllCerts = Java.registerClass({        name: 'com.example.TrustAllCerts',        implements: [Java.use('javax.net.ssl.X509TrustManager')],        methods: {            checkClientTrusted: function(chain, authType) {},            checkServerTrusted: function(chain, authType) {},            getAcceptedIssuers: function() { return []; }        }    });    // 自己写一个context.init    var SSLContext = Java.use('javax.net.ssl.SSLContext');    var context = SSLContext.getInstance("TLS");    context.init(null, [TrustAllCerts.$new()], null);    var OkHttpClientBuilder = Java.use('okhttp3.OkHttpClient$Builder');    //重写OkHttpClientBuilder.sslSocketFactory方法，让他不管传入什么参数，都默认返回TrustAllCerts    OkHttpClientBuilder.sslSocketFactory.overload('javax.net.ssl.SSLSocketFactory', 'javax.net.ssl.X509TrustManager').implementation = function(sf, tm) {        // 替换为信任所有证书的factory        return this.sslSocketFactory(context.getSocketFactory(), TrustAllCerts.$new());    };});