renef
hookshare

SSL Pinning Bypass for Renef Usage: ./renef -s com.example.app -l ssl_unpin.lua Covers 30+ bypass targets: Java: TrustManagerImpl, OkHttp3, OkHttp2 (Squareup), Trustkit, Conscrypt, Apache, Appcelerator, Fabric, Netty, CWAC-Netsecurity, IBM MobileFirst/WorkLight, PhoneGap, Chromium Cronet, Flutter plugins, WebViewClient, Cordova, Boye Native: OpenSSL/BoringSSL SSL_CTX_set_verify Flutter: libflutter.so pattern-based + offset-based bypass

Example AES Crypto hook script

Flutter SSL Pinning Bypass Script Works for Flutter apps using BoringSSL

ioctl Kernel Fuzzer Renef script for Android

Bypasses common debugger/tamper detection checks: Java: Debug.isDebuggerConnected, Debug.waitingForDebugger Native: ptrace anti-debug, /proc/self/status TracerPid

renefdump - android memory dumper for renef Please follow instructions from the github: https://github.com/ymuuuu/renefdump Usage should be from the bash script as follows: ./renefdump.sh <package> # attach to the running app, dump, pull ./renefdump.sh -a <pid> # attach by pid instead of package ./renefdump.sh -s <package> # spawn first (rarely useful: empty heap) ./renefdump.sh -o <dir> <package> # local output parent (default: ./dumps) ./renefdump.sh -r <path> <package> # path to the renef client binary ./renefdump.sh -k <package> # keep the dump on the device (skip cleanup) Dumps writable memory ranges of the target process into the app's own writable directory (SELinux: an untrusted_app cannot write shell_data_file, so /data/local/tmp is off-limits regardless of chmod), then prints the su commands to stage and pull them to the host.