Error with Lepro app

[StefanoGiu]

I'm testing it with Lepro app, trying to intercept MQTT communication. I had to comment this in "// new ApiResolver('module').enumerateMatches('exports:linker*!dlopen').forEach((dlopen) => {
// Interceptor.attach(dlopen.address, {
// onEnter(args) {
// // const moduleArg = args[0].readCString();
// // if (moduleArg) {
// // this.path = moduleArg;
// // this.moduleName = getModuleName(moduleArg);
// // }
// },
// // onLeave(retval) {
// // if (!this.path || !retval || retval.isNull()) return;
// // if (!MODULE_LOAD_CALLBACKS[this.moduleName]) return;

        // // let module = Process.findModuleByName(this.moduleName)
            // // ?? Process.findModuleByAddress(retval);
        // // if (!module) {
            // // // Some modules are loaded in ways that mean Frida can't detect them, and
            // // // can't look them up by name (notably when loading libraries from inside an
            // // // APK on Android). To handle this, we can use dlsym to look up an example
            // // // symbol and find the underlying module details directly, where possible.
            // // module = getAnonymousModule(this.moduleName, this.path, retval);
            // // if (!module) return;
        // // }

        // // Object.keys(MODULE_LOAD_CALLBACKS).forEach((key) => {
            // // if (this.moduleName === key) {
                // // if (module) {
                    // // MODULE_LOAD_CALLBACKS[key](module);
                    // // delete MODULE_LOAD_CALLBACKS[key];
                // // }
            // // }
        // // });
    // // }
// });

// });" config.js because I had a bluetooth fingerprint crash. I'm using an old Samsung Tab S2 with Android 7.

Once commented, I get the below errors, and I'm not able to see MQTT traffic despite I see the connection to AWS on port 8883.

Any help?

Spawning com.lepro.home...

== Redirecting all TCP connections to 192.168.1.62:8082 ==
== Disabled Android root detection ==
Spawned com.lepro.home. Resuming main thread!
== Proxy system configuration overridden to 192.168.1.62:8082 ==
== Proxy configuration overridden to 192.168.1.62:8082 ==
== System certificate trust injected ==
== Certificate unpinning completed ==
== Unpinning fallback auto-patcher installed ==
=> Blocked possible root detection checks. Enable DEBUG_MODE for more details.
[SM T815::com.lepro.home ]->
!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
Manually intercepting tcp6 connection to ::XXXX:XXXX:8883

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined

[StefanoGiu]

*** Starting scripts ***
== Redirecting all TCP connections to 192.168.1.62:8082 ==
== Disabled Android root detection ==
Spawned com.lepro.home. Resuming main thread!
[SM T815::com.lepro.home ]-> == Proxy system configuration overridden to 192.168.1.62:8082 ==
Rewriting <class: java.net.ProxySelector>
Rewriting <class: sun.net.spi.DefaultProxySelector>
== Proxy configuration overridden to 192.168.1.62:8082 ==
[+] Injected cert into com.android.org.conscrypt.TrustedCertificateIndex
[ ] Skipped cert injection for org.conscrypt.TrustedCertificateIndex (not present)
[ ] Skipped cert injection for org.apache.harmony.xnet.provider.jsse.TrustedCertificateIndex (not present)
== System certificate trust injected ==

=== Disabling all recognized unpinning libraries ===

[+] javax.net.ssl.HttpsURLConnection setDefaultHostnameVerifier
[+] javax.net.ssl.HttpsURLConnection setSSLSocketFactory
[+] javax.net.ssl.HttpsURLConnection setHostnameVerifier
[+] javax.net.ssl.SSLContext init(KeyManager;[], TrustManager;[], SecureRandom)
[+] com.android.org.conscrypt.CertPinManager isChainValid
[ ] com.android.org.conscrypt.CertPinManager checkChainPinning
[+] android.security.net.config.NetworkSecurityConfig $init() (0)
[+] android.security.net.config.NetworkSecurityConfig $init() (1)
[+] com.android.okhttp.internal.tls.OkHostnameVerifier verify(String, SSLSession)
[ ] com.android.okhttp.Address $init(String, int, Dns, SocketFactory, SSLSocketFactory, HostnameVerifier, CertificatePinner, Authenticator, Proxy, List, List, ProxySelector)
[+] com.android.okhttp.Address $init(String, int, SocketFactory, SSLSocketFactory, HostnameVerifier, CertificatePinner, Authenticator, Proxy, List, List, ProxySelector)
[ ] okhttp3.CertificatePinner *
[ ] com.squareup.okhttp.CertificatePinner *
[ ] com.datatheorem.android.trustkit.pinning.PinningTrustManager *
[ ] appcelerator.https.PinningTrustManager *
[ ] nl.xservices.plugins.sslCertificateChecker *
[ ] com.worklight.wlclient.api.WLClient *
[ ] com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning *
[ ] com.worklight.androidgap.plugin.WLCertificatePinningPlugin *
[ ] com.commonsware.cwac.netsecurity.conscrypt.CertPinManager *
[ ] io.netty.handler.ssl.util.FingerprintTrustManagerFactory *
[ ] com.silkimen.cordovahttp.CordovaServerTrust *
[ ] com.appmattus.certificatetransparency.internal.verifier.CertificateTransparencyHostnameVerifier *
[ ] com.appmattus.certificatetransparency.internal.verifier.CertificateTransparencyInterceptor *
[ ] com.appmattus.certificatetransparency.internal.verifier.CertificateTransparencyTrustManager *
== Certificate unpinning completed ==
== Unpinning fallback auto-patcher installed ==
*** Scripts completed ***

Blocked possible root detection: system_property_get ro.debuggable
Ignoring attempt to clear http.proxyHost system property
Ignoring attempt to clear https.proxyHost system property
Ignoring attempt to clear http.proxyPort system property
Ignoring attempt to clear https.proxyPort system property
Ignoring attempt to clear http.nonProxyHosts system property
Ignoring attempt to clear https.nonProxyHosts system property
Blocked possible root detection: file exists check for /system/app/Superuser.apk
Blocked possible root detection: file exists check for /system/xbin/su
Blocked possible root detection: file exists check for /system/app/Superuser.apk
Blocked possible root detection: file exists check for /system/xbin/su
Blocked possible root detection: file exists check for /system/app/Superuser.apk
Blocked possible root detection: file exists check for /system/xbin/su
Blocked possible root detection: file exists check for /system/app/Superuser.apk
=> android.security.net.config.NetworkSecurityConfig $init() (1)
=> android.security.net.config.NetworkSecurityConfig $init() (0)
Blocked possible root detection: file exists check for /system/xbin/su
=> com.android.okhttp.Address $init(String, int, SocketFactory, SSLSocketFactory, HostnameVerifier, CertificatePinner, Authenticator, Proxy, List, List, ProxySelector)
=> com.android.okhttp.Address $init(String, int, SocketFactory, SSLSocketFactory, HostnameVerifier, CertificatePinner, Authenticator, Proxy, List, List, ProxySelector)
=> com.android.okhttp.Address $init(String, int, SocketFactory, SSLSocketFactory, HostnameVerifier, CertificatePinner, Authenticator, Proxy, List, List, ProxySelector)
Ignoring unix:stream connection
Ignoring unix:stream connection
undefined tcp6 fd 64 to {"ip":"::ffff:192.168.1.62","port":8082} (0)
undefined tcp6 fd 68 to {"ip":"::ffff:192.168.1.62","port":8082} (0)
Ignoring unix:stream connection
undefined tcp6 fd 70 to {"ip":"::ffff:192.168.1.62","port":8082} (0)
=> com.android.org.conscrypt.CertPinManager isChainValid
=> com.android.org.conscrypt.CertPinManager isChainValid

!!! --- Unexpected TLS failure --- !!!
=> com.android.org.conscrypt.CertPinManager isChainValid

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
=> com.android.okhttp.internal.tls.OkHostnameVerifier verify(String, SSLSession)

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
=> com.android.okhttp.internal.tls.OkHostnameVerifier verify(String, SSLSession)
=> com.android.okhttp.internal.tls.OkHostnameVerifier verify(String, SSLSession)

!!! --- Unexpected TLS failure --- !!!

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
=> javax.net.ssl.SSLContext init(KeyManager;[], TrustManager;[], SecureRandom)
=> com.android.okhttp.Address $init(String, int, SocketFactory, SSLSocketFactory, HostnameVerifier, CertificatePinner, Authenticator, Proxy, List, List, ProxySelector)
Ignoring unix:stream connection
undefined tcp6 fd 90 to null (-1)
Ignoring unix:stream connection
undefined tcp6 fd 93 to null (-1)
=> com.android.okhttp.Address $init(String, int, SocketFactory, SSLSocketFactory, HostnameVerifier, CertificatePinner, Authenticator, Proxy, List, List, ProxySelector)
=> com.android.org.conscrypt.CertPinManager isChainValid

!!! --- Unexpected TLS failure --- !!!
=> com.android.org.conscrypt.CertPinManager isChainValid

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
=> android.security.net.config.NetworkSecurityConfig $init() (1)
=> android.security.net.config.NetworkSecurityConfig $init() (0)
=> javax.net.ssl.SSLContext init(KeyManager;[], TrustManager;[], SecureRandom)
Ignoring unix:stream connection
Manually intercepting tcp6 connection to ::XX:XXX:8883
Ignoring unix:stream connection
intercepting tcp6 fd 106 to null (-1)
=> com.android.okhttp.internal.tls.OkHostnameVerifier verify(String, SSLSession)

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
=> com.android.org.conscrypt.CertPinManager isChainValid

!!! --- Unexpected TLS failure --- !!!
CertificateException: java.io.IOException: No extension found with name KeyUsage
Thrown by java.security.cert.CertificateParsingException->
[ ] Failed to automatically patch failure
TypeError: cannot read property 'overloads' of undefined
=> android.security.net.config.NetworkSecurityConfig $init() (1)
=> android.security.net.config.NetworkSecurityConfig $init() (0)
=> javax.net.ssl.SSLContext init(KeyManager;[], TrustManager;[], SecureRandom)

[pimterry]

because I had a bluetooth fingerprint crash

Can you explain what that means? It'd be useful if you could share the log of that error.

I'm not able to see MQTT traffic

Unfortunately these scripts aren't really set up for MQTT interception, but it's an interesting experiment, and most of it should work in theory.

Can you explain exactly what "not able to see" means though? What tools are you using, and what exactly is happening? Are connections being received but not decrypted? Is the mobile app still working, suggesting the connections are happening but invisibly, or is it failing? Are there any errors visible anywhere?

Commenting out that dlopen chunk will stop some hooks from working (including native-tls, which might be required to decrypt some MQTT cases). It shouldn't affect network redirection though I think, so you should still see MQTT connections regardless, they'll just fail with TLS errors if they use TLS.

If you enable DEBUG_MODE in config.js, you should see more information about individual connections, which might be helpful, and should give you clues about what connections are being attempted & redirected at least.

[Sanji78]

I am StefanoGiu. I used this script to intercept Lepro MQTT Traffic:

// Robust hooks for Paho MQTT + KeyStore + Signature capture
// Run: frida -U -f com.lepro.home -l interceptmqtt_frida.js --no-pause

if (Java.available) {
  Java.perform(function () {
    const log = function () {
      var a = Array.prototype.slice.call(arguments);
      console.log.apply(console, ["[FRIDA]"].concat(a));
    };

    function safeUse(name) {
      try { return Java.use(name); }
      catch (e) { return null; }
    }

    // helpers to convert java cert/key -> PEM (if getEncoded() available)
    function toPemCertificate(javaCert) {
      try {
        var Base64 = Java.use('android.util.Base64');
        var enc = javaCert.getEncoded();
        var b64 = Base64.encodeToString(enc, 0);
        var pem = "-----BEGIN CERTIFICATE-----\n";
        for (var i = 0; i < b64.length; i += 64) pem += b64.substring(i, i + 64) + "\n";
        pem += "-----END CERTIFICATE-----\n";
        return pem;
      } catch (e) { return null; }
    }

    function toPemPrivateKey(javaKey) {
      try {
        if (!javaKey) return null;
        var enc = javaKey.getEncoded();
        if (enc === null) {
          // very likely hardware-backed / non-exportable
          return null;
        }
        var Base64 = Java.use('android.util.Base64');
        var b64 = Base64.encodeToString(enc, 0);
        var pem = "-----BEGIN PRIVATE KEY-----\n";
        for (var i = 0; i < b64.length; i += 64) pem += b64.substring(i, i + 64) + "\n";
        pem += "-----END PRIVATE KEY-----\n";
        return pem;
      } catch (e) { return null; }
    }

    //////////////////////////
    // KeyStore / KeyChain hooks
    //////////////////////////
    (function hookKeyStoreAndKeyChain() {
      try {
        var KeyStore = safeUse('java.security.KeyStore');
        if (KeyStore) {
          // hook all getKey overloads
          if (KeyStore.getKey && KeyStore.getKey.overloads) {
            KeyStore.getKey.overloads.forEach(function (ov) {
              try {
                ov.implementation = function () {
                  var alias = arguments[0] ? arguments[0].toString() : '(null)';
                  log("KeyStore.getKey called for alias:", alias);
                  var key = ov.apply(this, arguments);
                  if (key) {
                    var pem = toPemPrivateKey(key);
                    if (pem) {
                      log(">>> Private key (PEM) for alias " + alias + ":\n" + pem);
                    } else {
                      try { log("Key object present but not exportable. key class:", key.getClass().getName()); } catch(e){}
                    }
                  } else {
                    log("KeyStore.getKey returned null for alias:", alias);
                  }
                  return key;
                };
              } catch (e) { log("hook KeyStore.getKey overload error:", e); }
            });
            log("Hooked KeyStore.getKey overloads");
          }

          // getCertificate
          try {
            if (KeyStore.getCertificate && KeyStore.getCertificate.overloads) {
              KeyStore.getCertificate.overloads.forEach(function (ov) {
                ov.implementation = function (alias) {
                  log("KeyStore.getCertificate called for alias:", alias);
                  var cert = ov.apply(this, arguments);
                  if (cert) {
                    var pem = toPemCertificate(cert);
                    if (pem) log(">>> Certificate (PEM) for alias " + alias + ":\n" + pem);
                  }
                  return cert;
                };
              });
              log("Hooked KeyStore.getCertificate overloads");
            }
          } catch (e) { log("KeyStore.getCertificate hook err:", e); }

          // list aliases on load
          try {
            if (KeyStore.load && KeyStore.load.overloads) {
              KeyStore.load.overloads.forEach(function (ov) {
                ov.implementation = function () {
                  log("KeyStore.load called, password length:", arguments[1] ? arguments[1].length : 0);
                  var res = ov.apply(this, arguments);
                  try {
                    var aliases = this.aliases();
                    while (aliases.hasMoreElements()) {
                      var a = aliases.nextElement();
                      log("KeyStore alias discovered:", a);
                    }
                  } catch (e) {}
                  return res;
                };
              });
              log("Hooked KeyStore.load overloads");
            }
          } catch (e) { log("KeyStore.load hook err:", e); }
        } else {
          log("java.security.KeyStore not found");
        }

        // android.security.KeyChain.getPrivateKey (static)
        var KeyChain = safeUse('android.security.KeyChain');
        if (KeyChain && KeyChain.getPrivateKey && KeyChain.getPrivateKey.overloads) {
          KeyChain.getPrivateKey.overloads.forEach(function (ov) {
            ov.implementation = function () {
              try {
                var alias = arguments.length >= 2 ? arguments[1] : '(unknown)';
                log("KeyChain.getPrivateKey called for alias:", alias);
                var k = ov.apply(this, arguments);
                if (k) {
                  var pem = toPemPrivateKey(k);
                  if (pem) log(">>> KeyChain private key PEM for " + alias + ":\n" + pem);
                  else log("KeyChain private key returned but not exportable. class:", k.getClass().getName());
                } else log("KeyChain.getPrivateKey returned null for alias " + alias);
                return k;
              } catch (e) { log("KeyChain.getPrivateKey wrapper error:", e); return ov.apply(this, arguments); }
            };
          });
          log("Hooked KeyChain.getPrivateKey overloads");
        } else {
          log("android.security.KeyChain.getPrivateKey not found or no overloads");
        }

      } catch (e) {
        log("hookKeyStoreAndKeyChain error:", e);
      }
    })();

    //////////////////////////
    // Signature capture (captures preimage and produced signature)
    //////////////////////////
    (function hookSignature() {
      try {
        var Signature = safeUse('java.security.Signature');
        if (!Signature) {
          log("java.security.Signature not found");
          return;
        }

        // initSign(PrivateKey)
        if (Signature.initSign && Signature.initSign.overloads) {
          Signature.initSign.overloads.forEach(function (ov) {
            try {
              ov.implementation = function () {
                try {
                  var key = arguments[0];
                  this._frida_key_class = key ? key.getClass().getName() : 'null';
                  log("Signature.initSign called, key class:", this._frida_key_class);
                } catch (e) {}
                return ov.apply(this, arguments);
              };
            } catch (e) { log("Signature.initSign hooking error:", e); }
          });
          log("Hooked Signature.initSign overloads");
        }

        // update overloads: capture data fed into signature
        if (Signature.update && Signature.update.overloads) {
          Signature.update.overloads.forEach(function (ov) {
            try {
              ov.implementation = function () {
                try {
                  var Base64 = Java.use('android.util.Base64');
                  var item = null;
                  if (arguments.length === 1) {
                    // update(byte[])
                    var b = arguments[0];
                    try {
                      item = Base64.encodeToString(b, 0);
                    } catch (e) { item = '[update single: not convertible]'; }
                  } else if (arguments.length === 3) {
                    // update(byte[], off, len) -> create a slice
                    var arr = arguments[0]; var off = arguments[1]; var len = arguments[2];
                    try {
                      var ByteArray = Java.use('[B');
                      var slice = ByteArray.$new(len);
                      for (var i = 0; i < len; i++) slice[i] = arr[off + i];
                      item = Base64.encodeToString(slice, 0);
                    } catch (e) { item = '[update slice: not convertible]'; }
                  } else {
                    item = '[update: unknown signature]';
                  }
                  if (!this._frida_updates) this._frida_updates = [];
                  this._frida_updates.push(item);
                } catch (e) {}
                return ov.apply(this, arguments);
              };
            } catch (e) { log("Signature.update hook err:", e); }
          });
          log("Hooked Signature.update overloads");
        }

        // sign() overloads: capture produced signature
        if (Signature.sign && Signature.sign.overloads) {
          Signature.sign.overloads.forEach(function (ov) {
            try {
              ov.implementation = function () {
                var sig = ov.apply(this, arguments);
                try {
                  var Base64 = Java.use('android.util.Base64');
                  var s64 = Base64.encodeToString(sig, 0);
                  var updates = this._frida_updates ? this._frida_updates.join('|') : '(none)';
                  var keyc = this._frida_key_class ? this._frida_key_class : '(unknown key)';
                  log("Signature.sign() produced signature(base64):", s64);
                  log("  key class:", keyc, "  updates(base64 chunks):", updates);
                } catch (e) { log("Signature.sign: post-processing error", e); }
                // clear collected updates to avoid reusing
                this._frida_updates = null;
                return sig;
              };
            } catch (e) { log("Signature.sign hook err:", e); }
          });
          log("Hooked Signature.sign overloads");
        }

      } catch (e) {
        log("hookSignature error:", e);
      }
    })();

    //////////////////////////
    // Paho (ClientState) hooking - patch ALL overloads (no hardcoded types)
    //////////////////////////
    (function hookPahoClientState() {
      try {
        var ClientState = safeUse('org.eclipse.paho.client.mqttv3.internal.ClientState');
        if (!ClientState) {
          log("org.eclipse.paho.client.mqttv3.internal.ClientState NOT found (obfuscated or not present)");
          return;
        }

        // print all declared methods for debugging
        try {
          var decl = ClientState.class.getDeclaredMethods();
          for (var i = 0; i < decl.length; i++) {
            log("ClientState JS-visible method:", decl[i].toString());
          }
        } catch (e) {}

        if (ClientState.send && ClientState.send.overloads) {
          log("ClientState.send overload count:", ClientState.send.overloads.length);
          ClientState.send.overloads.forEach(function (ov, idx) {
            try {
              log("Hooking ClientState.send overload #", idx, " ->", ov.toString());
              ov.implementation = function () {
                try {
                  // best-effort to read arg 0
                  var arg0 = arguments.length > 0 ? arguments[0] : null;
                  var s = "(no arg0)";
                  try {
                    if (arg0) s = arg0.toString();
                  } catch (e) {
                    try { s = "[toString failed] class=" + arg0.getClass().getName(); } catch (ee) { s = "[unknown arg0]"; }
                  }
                  log("[Paho] ClientState.send called:", s);
                } catch (e) { log("[Paho] ClientState.send wrapper error:", e); }
                return ov.apply(this, arguments);
              };
            } catch (e) { log("ClientState.send overload hook fail:", e); }
          });
          log("Hooked all ClientState.send overloads");
        } else {
          log("ClientState.send not present or no overloads");
        }
      } catch (e) {
        log("hookPahoClientState error:", e);
      }
    })();

    //////////////////////////
    // MqttClient convenience wrappers (publish/subscribe) if present
    //////////////////////////
    (function hookMqttClient() {
      try {
        var MqttClient = safeUse('org.eclipse.paho.client.mqttv3.MqttClient');
        if (!MqttClient) {
          log("org.eclipse.paho.client.mqttv3.MqttClient not found");
          return;
        }
        ['publish','subscribe'].forEach(function (m) {
          try {
            if (MqttClient[m] && MqttClient[m].overloads) {
              MqttClient[m].overloads.forEach(function (ov) {
                var sig = ov.toString();
                ov.implementation = function () {
                  try {
                    var args = Array.prototype.slice.call(arguments);
                    log("[Paho] MqttClient." + m + " called. args:", JSON.stringify(args.map(function (a) {
                      try { return a ? a.toString() : null; } catch (e) { return '[toString fail]'; }
                    })));
                  } catch (e) {}
                  return ov.apply(this, arguments);
                };
              });
              log("Hooked MqttClient." + m + " overloads");
            }
          } catch (e) {}
        });
      } catch (e) { log("hookMqttClient error:", e); }
    })();

    //////////////////////////
    // SSL socket factory: print session peer info if possible
    //////////////////////////
    (function hookSSLSocketFactory() {
      try {
        var SSLSF = safeUse('javax.net.ssl.SSLSocketFactory');
        if (SSLSF && SSLSF.createSocket && SSLSF.createSocket.overloads) {
          SSLSF.createSocket.overloads.forEach(function (ov) {
            try {
              ov.implementation = function () {
                var sock = ov.apply(this, arguments);
                try {
                  if (sock && sock.getSession) {
                    var sess = sock.getSession();
                    if (sess) {
                      try { log("SSLSocket created, peerPrincipal:", sess.getPeerPrincipal ? sess.getPeerPrincipal().toString() : "(no peerPrincipal)"); } catch(e){}
                    }
                  }
                } catch (e) {}
                return sock;
              };
            } catch (e) {}
          });
          log("Hooked SSLSocketFactory.createSocket overloads");
        } else {
          log("javax.net.ssl.SSLSocketFactory not hooked (not present?)");
        }
      } catch (e) { log("hookSSLSocketFactory error:", e); }
    })();

    log("All hooks installed. Waiting for app activity / MQTT operations...");
  });
} else {
  console.log("Java runtime not available");
}

I can see a BEGIN/END CERTIFICATE KEY shared, I see the publish/subscribe events (that seems to be encrypted). I have the Amazon AWS endpoint. port and the public certificates that are available invoking a Lepro API Webcall, I just miss the private key to establish the TLS MQTT connection.

Do you know how to do that? May you help me? Maybe we could work together. My plan is to write a custom component for Home Assistant for Lepro integration.

Thanks