// Universal SSL Pinning Bypass — OkHttp3, TrustManager, X509, Conscrypt, HostnameVerifier
// Usage: frida -U -f com.target.app -l ssl-pinning-bypass.js --no-pause

Java.perform(function() {
    // --- OkHttp3 CertificatePinner ---
    try {
        var CertificatePinner = Java.use('okhttp3.CertificatePinner');
        CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function() {
            console.log('[+] OkHttp3 CertificatePinner.check bypassed');
        };
        CertificatePinner.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function() {
            console.log('[+] OkHttp3 CertificatePinner.check (cert) bypassed');
        };
    } catch(e) {}

    // --- Custom TrustManager (accept all) ---
    try {
        var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
        var SSLContext = Java.use('javax.net.ssl.SSLContext');
        var TrustManager = Java.registerClass({
            name: 'com.rtexit.bypass.TrustManager',
            implements: [X509TrustManager],
            methods: {
                checkClientTrusted: function(chain, authType) {},
                checkServerTrusted: function(chain, authType) { console.log('[+] checkServerTrusted bypassed'); },
                getAcceptedIssuers: function() { return []; }
            }
        });
        var SSLContextInst = SSLContext.getInstance('TLS');
        SSLContextInst.init(null, [TrustManager.$new()], null);
        SSLContext.getDefault.implementation = function() { return SSLContextInst; };
    } catch(e) {}

    // --- HostnameVerifier ---
    try {
        var HttpsURLConnection = Java.use('javax.net.ssl.HttpsURLConnection');
        HttpsURLConnection.setDefaultHostnameVerifier.implementation = function(verifier) {
            console.log('[+] HostnameVerifier bypassed');
        };
    } catch(e) {}

    // --- Conscrypt (Android network stack) ---
    try {
        var PlatformTrustManager = Java.use('com.android.org.conscrypt.TrustManagerImpl');
        PlatformTrustManager.checkTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'boolean').implementation = function(a, b, c) {
            console.log('[+] Conscrypt TrustManagerImpl bypassed');
            return Java.use('java.util.ArrayList').$new();
        };
    } catch(e) {}

    // --- Network Security Config bypass ---
    try {
        var NetworkSecurityTrustManager = Java.use('android.security.net.config.NetworkSecurityTrustManager');
        NetworkSecurityTrustManager.checkServerTrusted.implementation = function(chain, authType, hostname) {
            console.log('[+] NetworkSecurityTrustManager bypassed: ' + hostname);
        };
    } catch(e) {}

    console.log('[RTExit] SSL Pinning bypass loaded.');
});
