// Ripped from https://github.com/Ch0pin/medusa/ and modified to fit Androguard packets

colorLog('[+] LOADING FRAMEWORK/FLUTTER/VERIFY_CERT_CHAIN_BYPASS_V7A.JS',{c: Color.Red});

// Based on nviso's article https://blogger.nviso.eu/2020/05/20/intercepting-flutter-traffic-on-android-x64/

var m = Process.findModuleByName("libflutter.so"); 

var pattern = "2d e9 f0 4f a3 b0 81 46 50 20 10 70 d9 f8 98 70 00 2f 4d d0 38 68 00 28 4a d0 78 68 0d 46 0d f1 08 0a 90 46 06 68 d1 e9 00 01";
function hook() {
    Memory.scan(m.base, m.size, pattern, {
        onMatch: function(address, size){
            colorLog('[+] ssl_crypto_x509_session_verify_cert_chain found at: ' + address.toString(),{c: Color.Green});
            colorLog('[+] Setting up hook.... ',{c: Color.Blue});
            Interceptor.attach(address.add(0x1),{

                onEnter: function(args){
                    colorLog('[+] Entering ssl_crypto_x509_session_verify_cert_chain ',{c: Color.Green});

                },
                onLeave: function(retval){
                    colorLog('\t[+] Initial Return Value: '+retval,{c: Color.Blue});
                    colorLog('\t[+] Returning True ',{c: Color.Red});
                    retval.replace(0x1);
                }

            });
        }, 
        onError: function(reason){
            console.log('[!] There was an error scanning memory');
        },
        onComplete: function()
        {
            colorLog('[+] All Done... ',{c: Color.Blue});
        }
    });
}

try {
    colorLog("[+] Finding libflutter.so",{c: Color.Green});
    Module.ensureInitialized("libflutter.so");
    hook();
} catch(err) {
    console.log("libflutter.so module not loaded. Trying to manually load it.")
    Module.load("libflutter.so");
}
