ios ssl pinning: add support for iOS 13

[tmm1]

based on nabla-c0d3/ssl-kill-switch2#72

cc #281

[tmm1]

Trying to test this and I'm running into an error I'm not sure how to find the source of:

(agent) Hooking BoringSSL methods
A Frida agent exception has occurred.
Error: expected a pointer
    at /script1.js:10720
    at /script1.js:10880
    at /script1.js:10893
    at frida/runtime/message-dispatcher.js:15
    at c (frida/runtime/message-dispatcher.js:25)

[tmm1]

I figured out the error and fixed it.

[leonjza]

Thank you for the PR! I'll test && merge this asap.

Trying to test this and I'm running into an error I'm not sure how to find the source of:

For future reference, adding the --debug flag to the command line will include the agents source map, meaning stack traces would include references to the relevant TypeScript source instead of just a generic script.js trace.

[g-goessel]

@tmm1 I tried your patch and I couldn't bypass the pinning protection with Alamofire.
I could get it to work by doing the following:

--- a/agent/src/ios/pinning.ts
+++ b/agent/src/ios/pinning.ts
@@ -448,10 +448,7 @@ export namespace sslpinning {
   // SSL_CTX_set_custom_verify
   const sSLCtxSetCustomVerify = (ident: string): InvocationListener => {
     const getPskIdentity = libObjc.SSL_get_psk_identity;
-    var setCustomVerify = libObjc.SSL_CTX_set_custom_verify;
-    if (setCustomVerify.isNull()) {
-        setCustomVerify = libObjc.SSL_set_custom_verify;
-    }
+    var setCustomVerify = libObjc.SSL_set_custom_verify;

     if (setCustomVerify.isNull() || getPskIdentity.isNull()) {
       return null;

This is by no mean a clean way to do it because I probably breaks older iOS versions, I will try to do it properly and submit my solution (it's the first time I work with frida/objection)

[leonjza]

@g-goessel thanks for the update and the diff! I also plan on testing this in the coming week.

[tmm1]

@g-goessel please try the change I just made

[g-goessel]

@tmm1 yes, works fine !
Thanks

Out of curiosity, what app do you use to check the ssl pinning ? I modified something but I'm not that good at writing iOS apps 😅

[leonjza]

Thanks again!