Error: Found multiple matches for dart::bin::SSLCertContext::CertificateCallback

[enzowritescode]

When using the demo app, the Flutter bypass does not seem to work despite this call out 'all buttons should pass except the final "custom-pinned" button.'

Error:

[!] Error preparing Flutter certificate pinning hooks: Error: Found multiple matches for dart::bin::SSLCertContext::CertificateCallback
Error: Found multiple matches for dart::bin::SSLCertContext::CertificateCallback
    at scanForFunction (/REDACTED/frida-interception-and-unpinning/android/android-disable-flutter-certificate-pinning.js:199)
    at hookFlutter (/REDACTED/frida-interception-and-unpinning/android/android-disable-flutter-certificate-pinning.js:221)
    at <anonymous> (/REDACTED/frida-interception-and-unpinning/android/android-disable-flutter-certificate-pinning.js:286)
    at <eval> (/REDACTED/frida-interception-and-unpinning/android/android-disable-flutter-certificate-pinning.js:292)

I am using objection to patch the APK with the frida gadget, then run the script with frida:

frida -U \
    -l ./config.js \
    -l ./android/android-disable-flutter-certificate-pinning.js \
    -n "SSL Pinning Demo"

[pimterry]

Hi @enzowritescode - the Flutter script remains experimental for now, and doesn't work for quite a few cases. The concept is strong, but it needs more work to properly cover all scenarios. It's listed as experimental in the README here and not included in the default list of scripts to use.

The Flutter button was added to the demo app as part of this work, but as you can see it's not quite automatically defeated yet.

[nitanmarcel]

You can manually hook the symbols without using the matcher, avoiding the issue completely.

Flutter offers artifacts with unstripped symbols that makes it easier for developers to debug their application.

Getting the hash with something like get_flutter_engine.py will allow you to download the unstripped library from their storage.

https://storage.googleapis.com/flutter_infra_release/flutter/<ENGINE_COMMIT_HASH>/<PLATFORM_FOLDER>/symbols.zip

For platforms the options are

android-arm-release, android-arm64-release, android-x64-release

The next step after downloading is extracting the offsets and directly using them instead of trying to match in the binary