// Ripped from https://github.com/Ch0pin/medusa/ and modified to fit Androguard packets

colorLog('[+] LOADING FRAMEWORK/FLUTTER/VERIFY_CERT_CHAIN_BYPASS_X86_64.JS',{c: Color.Red});

// Based on nviso's article https://blogger.nviso.eu/2020/05/20/intercepting-flutter-traffic-on-android-x64/

function hook(){
    var m = Process.findModuleByName("libflutter.so"); 

    var pattern = "55 41 57 41 56 41 55 41 54 53 48 81 ec f8 00 00 00 c6 02 50 48 8b 9f a8 00 00 00 48 85 db 0f 84 10 01 00 00 48 83 3b 00 0f 84 06 01 00 00";
    Memory.scan(m.base, m.size, pattern, {
        onMatch: function(address, size){
            colorLog('[+] ssl_crypto_x509_session_verify_cert_chain found at: ' + address.toString(),{c: Color.Green});
            colorLog('[+] Setting up hook.... ',{c: Color.Blue});
            Interceptor.attach(address,{

                onEnter: function(args){
                    colorLog('[+] Entering ssl_crypto_x509_session_verify_cert_chain ',{c: Color.Green});

                },
                onLeave: function(retval){
                    colorLog('\t[+] Initial Return Value: '+retval,{c: Color.Blue});
                    colorLog('\t[+] Returning True ',{c: Color.Red});
                    retval.replace(0x1);
                }

            });
        }, 
        onError: function(reason){
            console.log('[!] There was an error scanning memory');
        },
        onComplete: function()
        {
            colorLog('[+] All Done... ',{c: Color.Blue});
        }
        });

}

try {
    colorLog("[+] Finding libflutter.so",{c: Color.Green});
    Module.ensureInitialized("libflutter.so");
    hook();
} catch(err) {
    console.log("libflutter.so module not loaded. Trying to manually load it.")
    Module.load("libflutter.so");
}
