Android Unpinner
This tool removes certificate pinning from APKs.
- Does not require root.
- Uses
frida-apk to mark app as debuggable.
This is much less invasive than other approaches, only AndroidManifest.xml is touched within the APK.
- Includes a custom Java Debug Wire Protocol implementation to inject the Frida Gadget via ADB.
- Uses HTTPToolkit's excellent unpinning script to defeat certificate pinning.
- Already includes all native dependencies for Windows/Linux/macOS (
adb, apksigner, zipalign, aapt2).
- Handles XAPKs by extracting the split APKs, unpinning them and installing them with
adb install-multiple.
The goal was not to build yet another unpinning tool, but to explore some newer avenues for non-rooted devices.
Please shamelessly copy whatever idea you like into other tools. :-)
Installation
Using uv, you can install the tool with a single command:
uv tool install git+https://github.com/mitmproxy/android-unpinner
Alternatively, you can install it manually:
$ git clone https://github.com/mitmproxy/android-unpinner.git
$ cd android-unpinner
$ pip install -e .
Usage
Connect your device via USB and run the following command.
$ android-unpinner all httptoolkit-pinning-demo.apk
See android-unpinner --help for usage details.
You can pull APKs from your device using android-unpinner list-packages and android-unpinner get-apks.
Alternatively, you can download APKs from the internet, for example manually from apkpure.com or automatically
using apkeep.
Comparison
Compared to using a rooted device, android-unpinner...
🟥 requires APK patching.
🟩 does not need to hide from root detection.
Compared to apk-mitm, android-unpinner...
🟥 requires active instrumentation from a desktop machine when launching the app.
🟩 allows more dynamic patching at runtime (thanks to Frida).
🟩 does less invasive APK patching, e.g. classes.dex stays as-is.
Compared to objection, android-unpinner...
🟥 supports only one feature (disable pinning) and no interactive analysis shell.
🟩 is easier to get started with, does not require additional dependencies.
🟩 does less invasive APK patching, e.g. classes.dex stays as-is.
Compared to frida + LIEF,
android-unpinner...
🟥 modifies AndroidManifest.xml
🟩 is easier to get started with, does not require additional dependencies.
🟩 Does not require that the application includes a native library.
Licensing
This tool stands on the shoulders of giants.
httptoolkit-pinning-demo.apk is a copy of HTTP Toolkit's neat demo app available
at https://github.com/httptoolkit/android-ssl-pinning-demo
(Apache-2.0 License).scripts/httptoolkit-unpinner.js is a copy of HTTP Toolkit's excellent unpinning script available at
https://github.com/httptoolkit/frida-android-unpinning/
(AGPL License, Version 3.0 or later).android_unpinner/vendor/frida/ contains the fantastic Frida gadgets available at https://frida.re/
(wxWindows Library Licence, Version 3.1).android_unpinner/vendor/frida-tools/ is adapted from https://github.com/frida/frida-tools
(wxWindows Library Licence, Version 3.1).android_unpinner/vendor/build_tools/ is a copy of some of Android's build tools
(see NOTICE.txt therein for license).android_unpinner/vendor/platform_tools/ is a copy of some of Android's platform tools
(see NOTICE.txt therein for license).- Code written here is licensed under the MIT license
(https://github.com/mitmproxy/mitmproxy/blob/main/LICENSE).
