fuzion24 / justtrustme

An xposed module that disables SSL certificate checking for the purposes of auditing an app with cert pinning

JustTrustMe

An xposed module that disables SSL certificate checking. This is useful for auditing an application which does certificate pinning. There also exists a nice framework built by @moxie to aid in pinning certs in your app: certificate pinning.

An example of an application that does cert pinning is Twitter. If you would like to view the network traffic for this application, you must disable the certificate pinning.

I built this for xposed rather than cydia substrate because xposed seems to support newer devices better. Marc Blanchou wrote the original tool for cydia substrate. If you find that you are not able to MITM an application please file an issue.

Installation

As a prequsite, your device must be rooted and the xposed framework must be installed. You can download the xposed framework here.

Install from binary

The JustTrustMe binary can be downloaded from https://github.com/Fuzion24/JustTrustMe/releases/latest

adb install ./JustTrustMe.apk

or navigate here and download the APK on your phone: https://github.com/Fuzion24/JustTrustMe/releases/latest

Build from Source

All the normal gradle build commands apply: To build a release APK:

./gradlew assembleRelease

To install directly to the phone connected via ADB:

./gradlew installRelease

justtrustme's Issues

SSL Version Error

net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH
It returns this error in webview app.
I have 3 certs including fiddler's too.

Instagram

have you hook any version of instagram?

Link broken in readme

https://viaforensics.com/resources/reports/best-practices-ios-android-secure-mobile-development/41-certificate-pinning/ return error 404.

Need new build with new commit

Please update for new build

access_denied (49) - When access control was applied the certificate was rejected

I've selected the app under the module in LSPosed, yet Charles is still telling me access_denied (49) - When access control was applied the certificate was rejected. I have the Charles certificates added. Why's it not working?

Why is it invalid after installation?

Why is it invalid after installation?

I have installed and activated sposed, and my phone has been root

Does it work on android 12?

Android Marhsmallow Support??

Could you add support for android 6?
I have tested it and not working.

The client does not trust the proxy certificate

App link
Used mitmproxy
Android version: 13

NOT WORKING ON ANDROID 7.X

Hello I try to use this on android 7.1.2 but it is not working.when I installed this apk,all of my application network cant be use,only playstore have the internet access while other say that the website has been mooved to new adress. I tried this on android 6.x and its working flawlessly, now I hope that you can fix this issue thanks!

java.lang.ClassNotFoundException: com.android.org.conscrypt.TrustManagerImpl

I've cloned & built the latest code but I seem to be getting ClassNotFoundException's when JustTrustMe attempts to hook. I'm running Android 4.2.2, any suggestions?

I/SSLTrusKiller(30338): Hooking init in javax.net.ssl.SSLContext
I/Xposed  (30338): de.robv.android.xposed.XposedHelpers$ClassNotFoundError: java.lang.ClassNotFoundException: com.android.org.conscrypt.TrustManagerImpl
I/Xposed  (30338):  at de.robv.android.xposed.XposedHelpers.findClass(XposedHelpers.java:52)
I/Xposed  (30338):  at de.robv.android.xposed.XposedHelpers.findAndHookMethod(XposedHelpers.java:136)
I/Xposed  (30338):  at just.trust.me.Main.handleLoadPackage(Main.java:209)
I/Xposed  (30338):  at de.robv.android.xposed.IXposedHookLoadPackage$Wrapper.handleLoadPackage(IXposedHookLoadPackage.java:20)
I/Xposed  (30338):  at de.robv.android.xposed.callbacks.XC_LoadPackage.call(XC_LoadPackage.java:34)
I/Xposed  (30338):  at de.robv.android.xposed.callbacks.XCallback.callAll(XCallback.java:70)
I/Xposed  (30338):  at de.robv.android.xposed.XposedBridge$1.beforeHookedMethod(XposedBridge.java:208)
I/Xposed  (30338):  at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:611)
I/Xposed  (30338):  at android.app.ActivityThread.handleBindApplication(Native Method)
I/Xposed  (30338):  at android.app.ActivityThread.access$1300(ActivityThread.java:141)
I/Xposed  (30338):  at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1294)
I/Xposed  (30338):  at android.os.Handler.dispatchMessage(Handler.java:99)
I/Xposed  (30338):  at android.os.Looper.loop(Looper.java:137)
I/Xposed  (30338):  at android.app.ActivityThread.main(ActivityThread.java:5041)
I/Xposed  (30338):  at java.lang.reflect.Method.invokeNative(Native Method)
I/Xposed  (30338):  at java.lang.reflect.Method.invoke(Method.java:511)
I/Xposed  (30338):  at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:793)
I/Xposed  (30338):  at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:560)
I/Xposed  (30338):  at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:132)
I/Xposed  (30338):  at de.robv.android.xposed.XposedBridge.main(Native Method)
I/Xposed  (30338):  at dalvik.system.NativeStart.main(Native Method)
I/Xposed  (30338): Caused by: java.lang.ClassNotFoundException: com.android.org.conscrypt.TrustManagerImpl
I/Xposed  (30338):  at java.lang.Class.classForName(Native Method)
I/Xposed  (30338):  at java.lang.Class.forName(Class.java:217)
I/Xposed  (30338):  at external.org.apache.commons.lang3.ClassUtils.getClass(ClassUtils.java:823)
I/Xposed  (30338):  at de.robv.android.xposed.XposedHelpers.findClass(XposedHelpers.java:50)
I/Xposed  (30338):  ... 20 more
I/Xposed  (30338): Caused by: java.lang.NoClassDefFoundError: com/android/org/conscrypt/TrustManagerImpl
I/Xposed  (30338):  ... 24 more
I/Xposed  (30338): Caused by: java.lang.ClassNotFoundException: Didn't find class "com.android.org.conscrypt.TrustManagerImpl" on path: /system/framework/com.android.location.provider.jar:/data/app/com.google.android.gms-1.apk
I/Xposed  (30338):  at dalvik.system.BaseDexClassLoader.findClass(BaseDexClassLoader.java:65)
I/Xposed  (30338):  at java.lang.ClassLoader.loadClass(ClassLoader.java:501)
I/Xposed  (30338):  at java.lang.ClassLoader.loadClass(ClassLoader.java:461)
I/Xposed  (30338):  ... 24 more

It does not seem to work with instagram

I am trying to monitor instagram's traffic on my old galaxy s3 (using fiddler proxy on my PC) and it still won't show me the actual traffic?
Is something wrong?

trust anchor for certification path not found

I use android 13, magisk zygisk model. LSPosed, justTrustMe

but can not use "xposed trust anchor for certification path not found"

I can't visit any website when I turn JustTrustMe on.

Everytime I turn JustTrustMe on.
Then all webview(any app or browser) can't visit any webpage and show network errors.
It is strange that I can sniffer the App's API requests as normal at the same time.
I thought it was the problem of my device or it's webview. then I try other devices. all the same.
Does anyone got same situation? how to fix it?

#Mitmproxy Unable to decrypt https when using Mitmproxy

Mitmproxy：does not trust the proxy's certificate

Hello author, when using Mitmproxy, the problem of certificate pinning still cannot be solved. The following is the error reported when capturing the mobile app.

[23:21:54.726][192.168.3.18:35324] server connect api5-normal-c-lq.amemv.com:443 (223.109.60.101:443)
[23:21:54.916][192.168.3.18:35324] Client TLS handshake failed. The client does not trust the proxy's certificate for api5-normal-c-lq.amemv.com (OpenSSL Error([('SSL routines', 'ssl3_read_bytes', 'sslv3 alert certificate unknown')]))
[23:21:54.917][192.168.3.18:35324] client disconnect
[23:21:54.919][192.168.3.18:35324] server disconnect api5-normal-c-lq.amemv.com:443 (223.109.60.101:443)
[23:21:55.067][192.168.3.18:35334] client connect
[23:21:55.082][192.168.3.18:35336] client connect
[23:21:55.102][192.168.3.18:35334] server connect mssdk3-normal-hl.zijieapi.com:443 (120.237.197.119:443)
[23:21:55.104][192.168.3.18:35336] server connect api26-normal-lq.amemv.com:443 (39.135.62.79:443)
[23:21:55.133][192.168.3.18:35266] client disconnect
[23:21:55.134][192.168.3.18:35264] client disconnect
[23:21:55.138][192.168.3.18:35266] server disconnect live-cover.msstatic.com:80 (183.240.67.248:80)
[23:21:55.139][192.168.3.18:35264] server disconnect live-cover.msstatic.com:80 (183.240.67.248:80)
[23:21:55.150][192.168.3.18:35336] Client TLS handshake failed. The client does not trust the proxy's certificate for api26-normal-lq.amemv.com (OpenSSL Error([('SSL routines', 'ssl3_read_bytes', 'sslv3 alert certificate unknown')]))
[

can you support magisk?

dose the apk file is updated

hello i have seen some pull request dose that patch is added to the apk build file or should we have to build new one

error with some apps though there is no decrypting enabled

After I Installed JTM, one of my installed app said there is no connection to server. (while "decrypt HTTPS" was unchecked in fiddler)

link: https://goo.gl/UNDeV3
tested on android 7 device and android 4.4 VM (nox)

What is the license?

Hi what would be the license for this repo?

OKHttp checks cause unhandled exceptions in case that OKHttp interface changes.

In some recent version, okhttp does not have the check method even though okhttp exists.

This class exists: okhttp3.CertificatePinner

However, NoSuchMethodError is thrown when check is accessed.

That should probably be caught for each OKHTTP method search as well. I'm personally getting the exception here:
https://github.com/Fuzion24/JustTrustMe/blob/master/app/src/main/java/just/trust/me/Main.java#L375

Uber-Jump isn't trusting mitm certs

According to ubahnverleih/WoBike#157 (comment)
JTM is not going deep enough to bypass pinnning in Ubers Jump app.
Is that something you can do later?

Uncheck date

Hi,

Is it possible to disable date checking? When I use a VPN I get ssl date errors. I suppose Chrome (Webview) checks for time zone matching.

The inner webview or Chrome get SSL Error With HTTPS

When I visit a https url, I can't get it. But a http url.
So I guess the webview hook are lose efficacy.

Add interface to disable for a single app at a time

got a app can't receive any https network log even using JustTrustMe

the JustTrustMe xposed module works fine, hook normally. Xposed log print out normally. I review the app sources using JADX, find out Using Okhttp and just check the server certificate . But when I turn on Fiddler or BurpSuite , already import the cert file into android phone system. the app can't receive any server response. Fiddler or BurpSuite got no https log. The app may using other request handle to avoid being hijack. the source code is too hard to read. I am sure the app did not check system whether using proxy or vpn.

God help you

I installed it with this program and I work with HttpCanary program and I have no problem but it does not record one of the programs as if no data has been exchanged. I need to understand what it sends to the server but it is nothing. Why? What should I do?

Turn on and off using UI

Is there anyway we can turn this tool on and off without restarting?

It doesn't work with Twitter 5.101.0

Is this some bug?

Not working with "Candy Crush Saga"

First of all: Thank you for that great Xposed Addon!
I'm using your addon for sniffing and analyzing SSL-Pinned App-Traffic.

So far I had no problems but with Candy Crush Saga it's not working.

Which information can I provide to get this working?
I can decompile the App or anything you like.

Thanks!

Just trust me is used in virtual xposed, which cannot be intercepted

I set up a middleman proxy for mitmproxy on my mobile phone. I can normally access the HTTPS protocol in virtual xposed just trust me, but my mitmproxy can't intercept any information. I don't understand why. Is virtual xposed encapsulated as a non - HTTPS protocol?

Not able to bypass pinning in Twitter app 5.47.0

Im using Genymotion with an Android 4.3 + Xposed 2.6.1 and the bypass is not working. No errors exist in the logs. Could you double check if in your setup you are able to bypass it?
Thank you.

custom pinning

it seems some apps like Instagram has implemented a custom pinning flow. how can we alter the code to bypass it?

Does not work with Handelsbanken 7.2.0.

It has worked flawlessly before but with the new Handelsbanken version it does not work anymore. Tried updated versions of Facebook and Facebook Messenger and they are also not intercepted anymore.

not work on genymotion 2.6

• Genymotion - 2.6.0
• Custom Phone - 5.1.0 - API 22 - 768x1280
• Xposed-v80-sdk22-x86
• XposedInstaller_3.0_alpha4
  justtrustme binary 2.0

xposed log:

05-13 05:32:40.211 I/Xposed ( 472): -----------------
05-13 05:32:40.211 I/Xposed ( 472): Starting Xposed version 80, compiled for SDK 22
05-13 05:32:40.211 I/Xposed ( 472): Device: Custom Phone - 5.1.0 - API 22 - 768x1280 (unknown), Android version 5.1 (SDK 22)
05-13 05:32:40.211 I/Xposed ( 472): ROM: vbox86p-userdebug 5.1 LMY47D eng.buildbot.20151117.200402 test-keys
05-13 05:32:40.211 I/Xposed ( 472): Build fingerprint: generic/vbox86p/vbox86p:5.1/LMY47D/buildbot11172007:userdebug/test-keys
05-13 05:32:40.211 I/Xposed ( 472): Platform: x86, 32-bit binary, system server: yes
05-13 05:32:40.211 I/Xposed ( 472): SELinux enabled: no, enforcing: no
05-13 05:32:42.547 I/Xposed ( 472): -----------------
05-13 05:32:42.548 I/Xposed ( 472): Added Xposed (/system/framework/XposedBridge.jar) to CLASSPATH
05-13 05:32:42.673 I/Xposed ( 472): Detected ART runtime
05-13 05:32:42.684 I/Xposed ( 472): Found Xposed class de/robv/android/xposed/XposedBridge, now initializing
05-13 05:32:42.764 I/Xposed ( 472): Loading modules from /data/app/just.trust.me-1/base.apk
05-13 05:32:42.823 I/Xposed ( 472): Loading class just.trust.me.Main

after loading class just.trust.me.Main it has nothing.when i run the app.the burp could proxy the https traffic.

Support for AndroidAsync

I have an application using web sockets with the AndroidAsync project, which JustTrustMe isn't currently hooking. I'll do some research into the best place to hook.

YikYak not working

I am proxying YikYak to Charles with ProxyDroid and it is not sending some requests through. They get stuck with a CONNECT IP:443 HTTP/1.0 and never go through due to pinning

Doesn't work in new facebook clients.

Hello, I noticed what this awesome module doesn't work in the new facebook clients, but It works on this client:

Facebook
Version 6.0.0.28.28

I think they patched the new clients. is there some workaround?
If isn't easy, where I can start my research? I have some programming experience (I think my experience is enough, I just need an starting point)

Thank you!, and, if you have a paypal account where I can donate, please let me know.

Doesn't work with Apple Music

Hi,
I tried this with Apple Music 2.3.0 but no success...
Any improvement to make it works ?

Chrome HTTPS requests arn't going through

After activating the module on Android 4.4.4, Xposed 2.6.1, Chrome 42.0.2311.111, all Chrome HTTPS requests fail with a "Webpage Unavailable" error message. First I thought it was a connection problem but after a bit of messing about I found I could reliably create the error just by activating and deactivating this module.

Further messing about put the problem at the javax.net.ssl.TrustManagerFactory getTrustManagers hook. I think Chrome is expecting a X509ExtendedTrustManager instance in the returned list and when it can't find one hangs resulting finally with a "Webpage Unavailable" error, but that's just conjecture.

The weird thing is if you hook all the checkServerTrusted of the com.android.org.conscrypt.TrustManagerImpl class (which is a subclass of X509ExtendedTrustManager and is what is passed back in the original getTrustManagers) it tries to call a function with type signature X509Certificate[], String, String which I can't find anywhere.

I'd look further into this, but I don't have the time at the moment.

hook checkServerTrusted error

There is a segment of code in main.java:
findAndHookMethod(X509TrustManagerExtensions.class, "checkServerTrusted", X509Certificate[].class, String.class, String.class, new XC_MethodReplacement() {
@OverRide
protected Object replaceHookedMethod(MethodHookParam param) throws Throwable {
return param.args[0];
}
});
in colos 7.0(android 10),checkServerTrusted function return type is List,but param.args[0] is an array,and cannot work on my phone,after i changed it to "return Arrays.asList((X509Certificate[])param.args[0]);",it worked

google chrome crash

I'm on OmniRom 4.4.4. With this xposed module active, google chrome just continues to crash again and again every time I try to open it. Logcat says:
Error creating trust manager: java.lang.IllegalArgumentException: tm is not a supported type of X509TrustManager.

JustTrustMe causes chrome ssl error failed when connect to TLS website

Maybe the same problem

#41

JustTrustMe causes my chrome ssl failed when I connect SSL website
it said:

this site can't be reached
https://google.com

ERR_FAILED

Removing JustTrustMe module solved :(

I'm not a Java Developer, just give someone idea to avoid this problem

Following are log about JustTrustMe and luckypatcher(you can ignore its log)

I hope no one spends the whole day like me to solve this problem.

JustTrustMe: Hooking DefaultHTTPClient for: com.android.chrome
05-18 16:45:46.906 26646 26646 W re-initialized>: type=1400 audit(0.0:295): avc: denied { getattr } for path="/data/data/com.android.chrome" dev="dm-0" ino=3302487 scontext=u:r:isolated_app:s0:c512,c768 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir permissive=0
05-18 16:45:46.910 26646 26646 D JustTrustMe: Hooking DefaultHTTPClient(HttpParams) for: com.android.chrome
05-18 16:45:46.911 26646 26646 D JustTrustMe: Hooking DefaultHTTPClient(ClientConnectionManager, HttpParams) for: com.android.chrome
05-18 16:45:46.912 26646 26646 D JustTrustMe: Hooking SSLSocketFactory(String, KeyStore, String, KeyStore) for: com.android.chrome
05-18 16:45:46.914 26646 26646 D JustTrustMe: Hooking static SSLSocketFactory(String, KeyStore, String, KeyStore) for: com.android.chrome
05-18 16:45:46.917 26646 26646 D JustTrustMe: Hooking SSLSocketFactory(Socket) for: com.android.chrome
05-18 16:45:46.919 26646 26646 D JustTrustMe: Hooking TrustManagerFactory.getTrustManagers() for: com.android.chrome
05-18 16:45:46.923 26646 26646 D JustTrustMe: Hooking HttpsURLConnection.setDefaultHostnameVerifier for: com.android.chrome
05-18 16:45:46.924 26646 26646 D JustTrustMe: Hooking HttpsURLConnection.setSSLSocketFactory for: com.android.chrome
05-18 16:45:46.926 26646 26646 D JustTrustMe: Hooking HttpsURLConnection.setHostnameVerifier for: com.android.chrome
05-18 16:45:46.927 26646 26646 D JustTrustMe: Hooking WebViewClient.onReceivedSslError(WebView, SslErrorHandler, SslError) for: com.android.chrome
05-18 16:45:46.929 26646 26646 D JustTrustMe: Hooking WebViewClient.onReceivedSslError(WebView, int, string, string) for: com.android.chrome
05-18 16:45:46.934 26646 26646 D JustTrustMe: Hooking com.android.org.conscrypt.TrustManagerImpl.checkServerTrusted(X509Certificate[]) for: com.android.chrome
05-18 16:45:46.985 26646 26646 I System.out: Update settings xposed
05-18 16:45:46.983 26646 26646 W boxed_process14: type=1400 audit(0.0:296): avc: denied { open } for path="/data/lp/xposed" dev="dm-0" ino=1720323 scontext=u:r:isolated_app:s0:c512,c768 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=0
05-18 16:45:46.985 26646 26646 W System.err: java.io.FileNotFoundException: /data/lp/xposed: open failed: EACCES (Permission denied)
05-18 16:45:46.986 26646 26646 W System.err:    at libcore.io.IoBridge.open(IoBridge.java:512)
05-18 16:45:46.986 26646 26646 W System.err:    at java.io.RandomAccessFile.<init>(RandomAccessFile.java:274)
05-18 16:45:46.986 26646 26646 W System.err:    at com.chelpus.Л€.Л(Utils.java:6001)
05-18 16:45:46.986 26646 26646 W System.err:    at com.chelpus.Л€.бµЋ(Utils.java:8933)
05-18 16:45:46.986 26646 26646 W System.err:    at com.xposed.XSupport.К(XSupport.java:1342)
05-18 16:45:46.986 26646 26646 W System.err:    at com.xposed.XSupport$28.afterHookedMethod(XSupport.java:1088)
05-18 16:45:46.986 26646 26646 W System.err:    at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:375)
05-18 16:45:46.986 26646 26646 W System.err:    at android.app.ApplicationPackageManager.<init>(<Xposed>)
05-18 16:45:46.986 26646 26646 W System.err:    at android.app.ContextImpl.getPackageManager(ContextImpl.java:237)
05-18 16:45:46.986 26646 26646 W System.err:    at android.content.ContextWrapper.getPackageManager(ContextWrapper.java:94)
05-18 16:45:46.986 26646 26646 W System.err:    at csx.b(PG:13)
05-18 16:45:46.986 26646 26646 W System.err:    at aQv.attachBaseContext(PG:95)
05-18 16:45:46.986 26646 26646 W System.err:    at android.app.Application.attach(Application.java:189)
05-18 16:45:46.986 26646 26646 W System.err:    at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
05-18 16:45:46.986 26646 26646 W System.err:    at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:361)
05-18 16:45:46.986 26646 26646 W System.err:    at android.app.Application.attach(<Xposed>)
05-18 16:45:46.986 26646 26646 W System.err:    at android.app.Instrumentation.newApplication(Instrumentation.java:1103)
05-18 16:45:46.986 26646 26646 W System.err:    at android.app.Instrumentation.newApplication(Instrumentation.java:1087)
05-18 16:45:46.986 26646 26646 W System.err:    at android.app.LoadedApk.makeApplication(LoadedApk.java:983)
05-18 16:45:46.986 26646 26646 W System.err:    at android.app.ActivityThread.handleBindApplication(ActivityThread.java:5715)
05-18 16:45:46.986 26646 26646 W System.err:    at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
05-18 16:45:46.986 26646 26646 W System.err:    at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:361)
05-18 16:45:46.986 26646 26646 W System.err:    at android.app.ActivityThread.handleBindApplication(<Xposed>)
05-18 16:45:46.986 26646 26646 W System.err:    at android.app.ActivityThread.-wrap1(Unknown Source:0)
05-18 16:45:46.986 26646 26646 W System.err:    at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1656)
05-18 16:45:46.986 26646 26646 W System.err:    at android.os.Handler.dispatchMessage(Handler.java:106)
05-18 16:45:46.986 26646 26646 W System.err:    at android.os.Looper.loop(Looper.java:164)
05-18 16:45:46.986 26646 26646 W System.err:    at android.app.ActivityThread.main(ActivityThread.java:6494)
05-18 16:45:46.986 26646 26646 W System.err:    at java.lang.reflect.Method.invoke(Native Method)
05-18 16:45:46.986 26646 26646 W System.err:    at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:440)
05-18 16:45:46.986 26646 26646 W System.err:    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:807)
05-18 16:45:46.986 26646 26646 W System.err:    at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:108)
05-18 16:45:46.986 26646 26646 W System.err: Caused by: android.system.ErrnoException: open failed: EACCES (Permission denied)
05-18 16:45:46.986 26646 26646 W System.err:    at libcore.io.Linux.open(Native Method)
05-18 16:45:46.986 26646 26646 W System.err:    at libcore.io.BlockGuardOs.open(BlockGuardOs.java:207)
05-18 16:45:46.986 26646 26646 W System.err:    at libcore.io.IoBridge.open(IoBridge.java:498)
05-18 16:45:46.986 26646 26646 W System.err:    ... 31 more
05-18 16:45:46.987 26646 26646 W System.err: org.json.JSONException: Value ����������������������������������������� ����������������������������������������������������������������������������������������������������������������������������������������� of type java.lang.String cannot be converted to JSONObject
05-18 16:45:46.987 26646 26646 W System.err:    at org.json.JSON.typeMismatch(JSON.java:111)
05-18 16:45:46.987 26646 26646 W System.err:    at org.json.JSONObject.<init>(JSONObject.java:163)
05-18 16:45:46.987 26646 26646 W System.err:    at org.json.JSONObject.<init>(JSONObject.java:176)
05-18 16:45:46.987 26646 26646 W System.err:    at com.chelpus.Л€.бµЋ(Utils.java:8933)
05-18 16:45:46.987 26646 26646 W System.err:    at com.xposed.XSupport.К(XSupport.java:1342)
05-18 16:45:46.987 26646 26646 W System.err:    at com.xposed.XSupport$28.afterHookedMethod(XSupport.java:1088)
05-18 16:45:46.987 26646 26646 W System.err:    at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:375)
05-18 16:45:46.987 26646 26646 W System.err:    at android.app.ApplicationPackageManager.<init>(<Xposed>)
05-18 16:45:46.987 26646 26646 W System.err:    at android.app.ContextImpl.getPackageManager(ContextImpl.java:237)
05-18 16:45:46.987 26646 26646 W System.err:    at android.content.ContextWrapper.getPackageManager(ContextWrapper.java:94)
05-18 16:45:46.987 26646 26646 W System.err:    at csx.b(PG:13)
05-18 16:45:46.987 26646 26646 W System.err:    at aQv.attachBaseContext(PG:95)
05-18 16:45:46.987 26646 26646 W System.err:    at android.app.Application.attach(Application.java:189)
05-18 16:45:46.987 26646 26646 W System.err:    at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
05-18 16:45:46.987 26646 26646 W System.err:    at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:361)
05-18 16:45:46.987 26646 26646 W System.err:    at android.app.Application.attach(<Xposed>)
05-18 16:45:46.987 26646 26646 W System.err:    at android.app.Instrumentation.newApplication(Instrumentation.java:1103)
05-18 16:45:46.987 26646 26646 W System.err:    at android.app.Instrumentation.newApplication(Instrumentation.java:1087)
05-18 16:45:46.987 26646 26646 W System.err:    at android.app.LoadedApk.makeApplication(LoadedApk.java:983)
05-18 16:45:46.987 26646 26646 W System.err:    at android.app.ActivityThread.handleBindApplication(ActivityThread.java:5715)
05-18 16:45:46.987 26646 26646 W System.err:    at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
05-18 16:45:46.987 26646 26646 W System.err:    at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:361)
05-18 16:45:46.987 26646 26646 W System.err:    at android.app.ActivityThread.handleBindApplication(<Xposed>)
05-18 16:45:46.987 26646 26646 W System.err:    at android.app.ActivityThread.-wrap1(Unknown Source:0)
05-18 16:45:46.987 26646 26646 W System.err:    at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1656)
05-18 16:45:46.987 26646 26646 W System.err:    at android.os.Handler.dispatchMessage(Handler.java:106)
05-18 16:45:46.987 26646 26646 W System.err:    at android.os.Looper.loop(Looper.java:164)
05-18 16:45:46.987 26646 26646 W System.err:    at android.app.ActivityThread.main(ActivityThread.java:6494)
05-18 16:45:46.987 26646 26646 W System.err:    at java.lang.reflect.Method.invoke(Native Method)
05-18 16:45:46.987 26646 26646 W System.err:    at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:440)
05-18 16:45:46.987 26646 26646 W System.err:    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:807)
05-18 16:45:46.987 26646 26646 W System.err:    at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:108)
05-18 16:45:46.996 26646 26646 D JustTrustMe: Hooking com.squareup.okhttp.CertificatePinner.check(String,List) (2.5) for: com.android.chrome
05-18 16:45:46.996 26646 26646 D JustTrustMe: OKHTTP 2.5 not found in com.android.chrome-- not hooking
05-18 16:45:46.996 26646 26646 D JustTrustMe: Hooking okhttp3.CertificatePinner.check(String,List) (3.x) for: com.android.chrome
05-18 16:45:46.996 26646 26646 D JustTrustMe: OKHTTP 3.x not found in com.android.chrome -- not hooking
05-18 16:45:46.997 26646 26646 D JustTrustMe: OKHTTP 3.x not found in com.android.chrome -- not hooking OkHostnameVerifier.verify(String, SSLSession)
05-18 16:45:46.997 26646 26646 D JustTrustMe: OKHTTP 3.x not found in com.android.chrome -- not hooking OkHostnameVerifier.verify(String, X509)(
05-18 16:45:47.001 26646 26646 I cr_ChildProcessService: Creating new ChildProcessService pid=26646
05-18 16:45:47.038 26646 26665 I cr_LibraryLoader: Time to load native libraries: 29 ms (timestamps 5987-6016)
05-18 16:45:47.039 26646 26665 I chromium: [INFO:library_loader_hooks.cc(50)] Chromium logging enabled: level = 0, default verbosity = 0
05-18 16:45:47.039 26646 26665 I cr_LibraryLoader: Expected native library version number "74.0.3729.157", actual native library version number "74.0.3729.157"
05-18 16:45:47.424 22819 23118 E chromium: [ERROR:ssl_client_socket_impl.cc(946)] handshake failed; returned -1, SSL error code 1, net_error -2

You can see 05-18 16:45:47.424 22819 23118 E chromium: [ERROR:ssl_client_socket_impl.cc(946)] handshake failed; returned -1, SSL error code 1, net_error -2 error message

For fix:
Here are my devices info

[ro.lineage.build.version]: [15.1]
[ro.lineage.build.version.plat.rev]: [0]
[ro.lineage.build.version.plat.sdk]: [9]
[ro.lineage.device]: [angler]
[ro.lineage.display.version]: [15.1-20190426-NIGHTLY-angler]
[ro.lineage.releasetype]: [NIGHTLY]
[ro.lineage.version]: [15.1-20190426-NIGHTLY-angler]
[ro.lineagelegal.url]: [https://lineageos.org/legal]
[ro.modversion]: [15.1-20190426-NIGHTLY-angler]
[ro.oem_unlock_supported]: [1]
[ro.opengles.version]: [196610]
[ro.product.board]: [angler]
[ro.product.brand]: [google]
[ro.product.cpu.abi]: [arm64-v8a]
[ro.product.cpu.abilist]: [arm64-v8a,armeabi-v7a,armeabi]
[ro.product.cpu.abilist32]: [armeabi-v7a,armeabi]
[ro.product.cpu.abilist64]: [arm64-v8a]
[ro.product.device]: [angler]
[ro.product.first_api_level]: [23]
[ro.product.locale]: [en-US]
[ro.product.manufacturer]: [Huawei]
[ro.product.model]: [Nexus 6P]
[ro.product.name]: [angler]
[ro.property_service.version]: [2]
[ro.qc.sdk.audio.fluencetype]: [fluence]
[ro.recovery_id]: [0x09e4c08d0df302e302f55d7b801dce1e23339cb4000000000000000000000000]
[ro.revision]: [0]
[ro.ril.force_eri_from_xml]: [true]
[ro.ril.svdo]: [false]
[ro.ril.svlte1x]: [false]
[ro.secure]: [1]
[ro.serialno]: [CVH7N16125000171]
[ro.sf.lcd_density]: [560]
[ro.storage_manager.enabled]: [true]
[ro.telephony.call_ring.multiple]: [0]
[ro.telephony.default_cdma_sub]: [0]
[ro.telephony.default_network]: [10]
[ro.telephony.get_imsi_from_sim]: [true]
[ro.treble.enabled]: [false]
[ro.vendor.build.date]: [Fri Oct 19 16:45:06 UTC 2018]
[ro.vendor.build.date.utc]: [1539967506]
[ro.vendor.build.fingerprint]: [google/angler/angler:8.1.0/OPM7.181205.001/5080180:user/release-keys]
[ro.vendor.extension_library]: [libqti-perfd-client.so]
[ro.vendor.product.brand]: [google]
[ro.vendor.product.device]: [angler]
[ro.vendor.product.manufacturer]: [Huawei]
[ro.vendor.product.model]: [Nexus 6P]
[ro.vendor.product.name]: [lineage_angler]
[ro.wifi.channels]: []
[ro.zygote]: [zygote64_32]

Please public a new release

the recent bugfixs are not inclueded, I have to manual make package.

Support for "cz.msebera.android:httpclient"

Getting hostname exceptions from this library:

javax.net.ssl.SSLException: hostname in certificate didn't match: <somesite.com> != <portswigger>
06-26 14:20:18.445  9908 10192 W System.err: 	at cz.msebera.android.httpclient.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:233)
06-26 14:20:18.446  9908 10192 W System.err: 	at cz.msebera.android.httpclient.conn.ssl.BrowserCompatHostnameVerifier.verify(BrowserCompatHostnameVerifier.java:54)
06-26 14:20:18.446  9908 10192 W System.err: 	at cz.msebera.android.httpclient.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:154)
06-26 14:20:18.446  9908 10192 W System.err: 	at cz.msebera.android.httpclient.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:135)

It doesn't work in facebook .

It doesn't work in facebook.

apk link not working

https://github.com/Fuzion24/JustTrustMe/blob/master/bin/JustTrustMe.apk?raw=true

It doesn't work with starbucks

The App stops working once I enabled fiddler to check what starbucks sends out and receives in.
android 5.1.1
starbucks 5.7
thanks for any help

Could you compile a latest version of apk

ANZ goMoney NZ app doesn't intercept

nz.co.anz.android.mobilebanking

Other apps are intercepting fine so doesn't seem to be a setup problem. Any pointers?