dk.ok.android.findtank (!!! --- Unexpected TLS failure --- !!!)

[J-Lindvig]

First of all, thank you for the awesome you have put in HTTP Toolkit and the Frida guide.

I am trying to reverse engineer the OK app, OK is a danish energy company (Gas, Electricity, EV chargers etc). Mainly because I am solid user and contributor to the Home Assistant community i Denmark and wish to be able to control my EV charger (Peblar) through the API of the app.

The app uses certificate pinning, which the default Frida scripts are unable to bypass. In your guide, https://httptoolkit.com/blog/frida-certificate-pinning/, you encourage filling an issue when a "naugthy" app is present.

Could you please investigate in this matter. I am ready to assist you any way I can.

Kind regards

Jacob Lindvig Henriksen

Below is the print out:

jacob@J-Lindvig:~/Frida$ frida -U -l ./config.js -l ./native-connect-hook.js -l ./native-tls-hook.js -l ./android/android-proxy-override.js -l ./android/android-system-certificate-injection.js -l ./android/android-certificate-unpinning.js -l ./android/android-certificate-unpinning-fallback.js -f dk.ok.android.findtank ____ / _ | Frida 16.6.6 - A world-class dynamic instrumentation toolkit | (_| | > _ | Commands: /_/ |_| help -> Displays the help system . . . . object? -> Display information about 'object' . . . . exit/quit -> Exit . . . . . . . . More info at https://frida.re/docs/home/ . . . . . . . . Connected to Android Emulator 5554 (id=emulator-5554) Spawning dk.ok.android.findtank`...

== Redirecting all TCP connections to 127.0.0.1:8000 ==
== Hooked native TLS lib libssl.so ==
Spawned dk.ok.android.findtank. Resuming main thread!
[Android Emulator 5554::dk.ok.android.findtank ]-> == Proxy system configuration overridden to 127.0.0.1:8000 ==
== Proxy configuration overridden to 127.0.0.1:8000 ==
== System certificate trust injected ==
== Certificate unpinning completed ==
== Unpinning fallback auto-patcher installed ==

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually
[ ] Unrecognized TLS error - this must be patched manually
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
[ ] Unrecognized TLS error - this must be patched manually
[ ] Unrecognized TLS error - this must be patched manually
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually
[ ] Unrecognized TLS error - this must be patched manually
[ ] Unrecognized TLS error - this must be patched manually
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually
[ ] Unrecognized TLS error - this must be patched manually
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually
[ ] Unrecognized TLS error - this must be patched manually
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually
[ ] Unrecognized TLS error - this must be patched manually
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: No peer certificates
Thrown by com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by A0.f->intercept
[ ] Unrecognized TLS error - this must be patched manually
`

[pimterry]

Hi @J-Lindvig, thanks for reporting this, I can reproduce that failure with both Frida and with normal system-certificate installation, so there's definitely some unusual pinning happening here.

There's a guide to investigating cases like this here: https://httptoolkit.com/blog/android-reverse-engineering/. The general approach is that you'll need to work out where this failure is happening, collect the related code that configures and then runs that the failing check, and then work out how we can use Frida to disable that. I'm happy to give you some pointers if you can do some investigation here.

There's two good clues in the above that to start from:

A0.f->intercept sounds like a specific function that is rejecting this, due to some certificate transparency checks, so we should take a look at that. That class name is clearly obfuscated but might well be a library - we do automatically handle some well-known obfuscated cases, but it's possible this is one we've missed. If you can get the source for that class and share it, hopefully it's a clearly recognizable case.

com.android.org.conscrypt.ActiveSession->checkPeerCertificatesPresent is an Android native API, which is being called somewhere to do a certificate check. We'll need to get the complete stack trace from the case where this fails to work out how that's being called, and then look at the related code to see how it's configured and why this hasn't been handled by the existing logic. We do already collect the stack trace in https://github.com/httptoolkit/frida-interception-and-unpinning/blob/main/android/android-certificate-unpinning-fallback.js so you can probably just add some logic there to log it, and then investigate from there.