com.amazon.amazonvideo.livingroom

[3052]

with this command

adb shell am start -n com.amazon.amazonvideo.livingroom/com.amazon.ignition.IgnitionActivity; `
frida -U -n com.amazon.amazonvideo.livingroom `
-l ./config.js `
-l ./native-connect-hook.js `
-l ./native-tls-hook.js `
-l ./android/android-proxy-override.js `
-l ./android/android-system-certificate-injection.js `
-l ./android/android-certificate-unpinning.js `
-l ./android/android-certificate-unpinning-fallback.js `
-l ./android/android-disable-root-detection.js

I get

[*] Connecting to device...
[*] Spawning Amazon Video TV app...
[*] Compiling script payload...
[*] Injecting scripts...

== Redirecting all TCP connections to 127.0.0.1:8080 ==
== Hooked native TLS lib libssl.so ==
[*] Native hooks injected. Waiting for JVM to boot...
[*] Resuming app execution...
[*] Interception active. Press Ctrl+C to exit.
Manually intercepting tcp6 connection to ::ffff:52.84.217.37:443
Manually intercepting tcp6 connection to ::ffff:52.84.217.97:443
Manually intercepting tcp6 connection to ::ffff:52.84.217.8:443
Manually intercepting tcp6 connection to ::ffff:52.84.217.107:443
Manually intercepting tcp6 connection to ::ffff:52.84.217.37:443
Manually intercepting tcp6 connection to ::ffff:52.84.217.97:443
Manually intercepting tcp6 connection to ::ffff:52.84.217.8:443
Manually intercepting tcp6 connection to ::ffff:52.84.217.107:443
Manually intercepting tcp6 connection to ::ffff:34.210.228.239:443
Manually intercepting tcp6 connection to ::ffff:54.201.253.231:443
Manually intercepting tcp6 connection to ::ffff:35.155.9.57:443
Manually intercepting tcp6 connection to ::ffff:54.68.57.171:443

[3052]

this seems to fix it - thanks to Claude Opus

import zipfile
import subprocess
import os

PACKAGE_NAME = "com.amazon.amazonvideo.livingroom"

def shell(cmd):
    return subprocess.run(["adb", "shell"] + cmd.split(),
                         capture_output=True, text=True).stdout.strip()

def main():
    # Step 1: Find and pull APK
    print("[*] Finding APK path...")
    paths = shell(f"pm path {PACKAGE_NAME}").split("\n")
    arm_path = [p.replace("package:", "") for p in paths if "armeabi" in p]
    
    if not arm_path:
        print("[-] Could not find armeabi APK split")
        return
    
    apk_device_path = arm_path[0]
    print(f"[*] APK: {apk_device_path}")
    
    if not os.path.exists("app.apk"):
        print("[*] Pulling APK...")
        subprocess.run(["adb", "pull", apk_device_path, "app.apk"])
    
    # Step 2: Find libignite.so inside APK
    with zipfile.ZipFile("app.apk", "r") as z:
        info = z.getinfo("lib/armeabi-v7a/libignite.so")
    
    with open("app.apk", "rb") as f:
        f.seek(info.header_offset)
        lh = f.read(30)
        data_offset = info.header_offset + 30 + int.from_bytes(lh[26:28], "little") + int.from_bytes(lh[28:30], "little")
        f.seek(data_offset)
        assert f.read(4) == b"\x7fELF"
    
    # Step 3: Find and patch CURLOPT_SSL_VERIFYPEER = 1
    with open("app.apk", "rb") as f:
        apk = bytearray(f.read())
    
    so_data = apk[data_offset:data_offset + info.file_size]
    
    patched = 0
    for i in range(len(so_data) - 3):
        if (so_data[i] == 0x40 and so_data[i+1] == 0x21 and
            so_data[i+2] == 0x01 and so_data[i+3] == 0x22):
            apk[data_offset + i + 2] = 0x00
            patched += 1
            print(f"[*] Patched CURLOPT_SSL_VERIFYPEER at 0x{i:x}")
    
    if patched == 0:
        print("[-] No CURLOPT_SSL_VERIFYPEER found!")
        return
    
    print(f"[+] Patched {patched} locations")
    
    with open("app_patched.apk", "wb") as f:
        f.write(apk)
    
    # Step 4: Backup and push
    print("[*] Backing up original...")
    shell(f"cp {apk_device_path} {apk_device_path}.bak")
    
    print("[*] Pushing patched APK...")
    subprocess.run(["adb", "push", "app_patched.apk", apk_device_path])
    
    shell(f"am force-stop {PACKAGE_NAME}")
    shell(f"rm -rf /data/data/{PACKAGE_NAME}/code_cache")
    
    print("[*] Starting app...")
    shell(f"am start -n {PACKAGE_NAME}/com.amazon.ignition.IgnitionActivity")
    
    print("[+] Done! Check mitmproxy for traffic.")
    print(f"[*] To restore: adb shell cp {apk_device_path}.bak {apk_device_path}")

if __name__ == "__main__":
    main()

[pimterry]

This is neat. In general I'd rather not include hooks for very specific individual apps here though - they tend to be fragile and it's a maintenance nightmare. Doesn't matter for individual use cases, but it's tricky to manage in a public repo of shared scripts like this.

Any idea how the validation is actually working here? Looks like this is an statically bundled version of curl, presumably with symbols stripped since you're scanning for patterns. Any idea if the trusted CAs are being loaded from a static source in memory, or from a file on disk? I've thought about hooking file reads in the past to append to any files full of CA certs, which would be interesting...

[3052]

this is what Claude Opus says

The binary

The app ships a 15MB ARM native library called libignite.so inside split_config.armeabi_v7a.apk. This single binary contains the entire app engine including a statically linked copy of curl 8.9.1-DEV and OpenSSL (BoringSSL variant). Symbols are fully stripped — we confirmed this by finding zero exported curl/SSL symbols when enumerating the module. All the identification was done by scanning for embedded strings like curl version is %s, curl/curl/lib/vtls/openssl.c, SSL certificate problem: %s, etc.

How the trusted CAs are loaded

The app bundles a CA certificate store inside assets/ignite-assets.tar in the base APK. This tar contains bin/certs/ with ~168 individual PEM certificate files in OpenSSL's c_rehash hash-named format (XXXXXXXX.0). At first launch, the tar is extracted to /data/data/com.amazon.amazonvideo.livingroom/files/bin/certs/.

However, the certs are NOT loaded from disk at verification time. We proved this by hooking both openat() and fopen() in libc — no cert files were ever opened during an SSL connection. The only file access was /usr/local/ssl/openssl.cnf (which doesn't exist on Android).

Instead, the app reads the cert files into memory at startup and passes them to curl via CURLOPT_CAINFO_BLOB — an in-memory blob. We confirmed this by:

• Finding the string CURLOPT_SSLCERT_BLOB in the binary
• Finding the CApath string reference and the path /data/user/0/com.amazon.amazonvideo.livingroom/files/bin/certs/ in writable heap memory at runtime
• Finding zero PEM certificate bundles in any memory-mapped region (the blob is likely DER or loaded/freed before we scanned)
• Proving that adding certs to the on-disk directory had no effect on validation

How verification is configured

The statically linked curl is configured with CURLOPT_SSL_VERIFYPEER = 1 via curl_easy_setopt(). We found three call sites in the .text section of libignite.so with this exact ARM Thumb instruction pattern:

MOVS R1, #64    (CURLOPT_SSL_VERIFYPEER = 64)
MOVS R2, #1     (value = true)
BL curl_easy_setopt

When verification is enabled, curl's OpenSSL backend calls SSL_get_verify_result() after the TLS handshake. If the server's certificate chain doesn't validate against the in-memory CA blob, it returns CURLE_PEER_FAILED_VERIFICATION (error code 60) with the message SSL certificate problem: %s.

Why it was hard to intercept

The ARM code runs on an x86 emulator via libndk_translation.so (Google's ARM-to-x86 binary translator). This means:

• The translated ARM code doesn't appear as normal x86 modules — Frida can't enumerate its exports
• ARM OpenSSL's functions are invisible to Frida's Module.findExportByName()
• The translated code doesn't call through the x86 system libssl.so — it has its own OpenSSL compiled in
• File I/O from translated ARM code goes through syscalls differently than x86 libc wrappers
• The Frida build on this device (17.11.0) didn't have the Java bridge available, ruling out Java-layer SSL hooks

The fix

Patching 3 bytes in the APK — changing MOVS R2, #1 to MOVS R2, #0 at each curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1) call site — disables SSL peer verification entirely. The patch is done in-place on the APK file to preserve zip offsets and alignment, since Android loads .so files directly from the APK via memory mapping.

[3052]

FYI HBO Max (Android TV) (com.wbd.stream) is also using cURL now - I was able to fix with a similar script

https://github.com/user-attachments/files/30175954/patch-max-ssl.py

note this time around I used GLM 5.2 Max Reasoning Effort