Skip to content

Instantly share code, notes, and snippets.

View balook's full-sized avatar

bala manohar surya sai balook

24 followers · 33 following
View GitHub Profile
@xdavidhu
xdavidhu / wokplace-ssl-pinning-bypass.md
Last active April 26, 2025 16:53
Bypassing SSL Pinning in Facebook/Meta Workplace (Android)

Tested on Workplace for Android version 362.0.0.29.109. This approach might work in other Facebook/Meta applications. Thank you Imre Rad for helping me analyze the binary.

How does it work?

The Workplace Android app uses the Fizz open source TLS-1.3 library to communicate with the backend APIs. This library is written in C++, and is compiled to native code. It is running as a native library attached to the Android app.

The certificate verification is implemented in fizz/client/ClientProtocol.cpp, on line 1944. The easiest way to bypass this check is to patch the if (state.verifier()) { check on line 1942.