SSL Pinning demo (and other apps) crashing with httptoolkits frida mode

[JustLinuxUser]

Running the pinning demo in the emulator with frida & http toolkit makes the app unstable, and it segfaults sometimes.
Note, it only segfaults after install, so I reinstall the app each time I test.

I also tested a simple app I made that launches a bunch of normal requests using okhttp client, and that one crashes even more

recording.mp4

tombstone_09.txt

Information about the setup:

• HTTP Toolkit desktop v1.20.1 (although I tested it on previous versions, and the same thing was happening)
• Android emulator: x86-64 open source Intel x86_64 atom system image API 35 (android 15) (Although I tested normal images too, like the default google's one, with similar results)

[pimterry]

I've just published a release now with quite a few script updates and using a new version of Frida. Can you test that out? The app will autoupdate if you just open it and wait for a minute, and then the following time you'll get the new version. You can check the version by hovering over the logo - server 1.22.0 includes the latest changes.

If it's still happening after updating, it would be really interesting to try:

• Launching Frida yourself on the device
• Running the scripts manually
• Confirming the issue still occurs
• Shrink the set of scripts you use down & down until either the issue stops (i.e.you can tell which script causes it) or it still occurs with no scripts running at all (i.e. it's a Frida bug)

[JustLinuxUser]

1. Just checked with the server 1.22.0, and found the same issue
2. I tried launching the script manually, and the server manually too with the same results, here are the logs:

frida -U \
    -l ./config.js \
    -l ./native-connect-hook.js \
    -l ./native-tls-hook.js \
    -l ./android/android-proxy-override.js \
    -l ./android/android-system-certificate-injection.js \
    -l ./android/android-certificate-unpinning.js \
    -l ./android/android-certificate-unpinning-fallback.js \
    -l ./android/android-disable-root-detection.js \
    -l ./android/android-disable-flutter-certificate-pinning.js \
    -f tech.httptoolkit.pinning_demo
     ____
    / _  |   Frida 17.2.15 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to Android Emulator 5554 (id=emulator-5554)
Spawning `tech.httptoolkit.pinning_demo`...

== Redirecting all TCP connections to 127.0.0.1:8000 ==
== Hooked native TLS lib libssl.so ==
== Disabled Android root detection ==
Spawned `tech.httptoolkit.pinning_demo`. Resuming main thread!
[Android Emulator 5554::tech.httptoolkit.pinning_demo ]-> == Proxy system configuration overridden to 127.0.0.1:8000 ==
== Proxy configuration overridden to 127.0.0.1:8000 ==
== System certificate trust injected ==
== Certificate unpinning completed ==
== Unpinning fallback auto-patcher installed ==

[!] Error preparing Flutter certificate pinning hooks: Error: Found multiple matches for dart::bin::SSLCertContext::CertificateCallback
Error: Found multiple matches for dart::bin::SSLCertContext::CertificateCallback
    at scanForFunction (/home/andrii/git/frida-interception-and-unpinning/android/android-disable-flutter-certificate-pinning.js:199)
    at hookFlutter (/home/andrii/git/frida-interception-and-unpinning/android/android-disable-flutter-certificate-pinning.js:221)
    at <anonymous> (/home/andrii/git/frida-interception-and-unpinning/android/android-disable-flutter-certificate-pinning.js:289)
    at <anonymous> (/home/andrii/git/frida-interception-and-unpinning/config.js:238)
    at forEach (native)
    at onLeave (/home/andrii/git/frida-interception-and-unpinning/config.js:242)
Manually intercepting tcp6 connection to ::ffff:185.93.3.244:443
Manually intercepting tcp6 connection to [24:0:52:e0:1e:6:0:0:0:0:0:0:8:95:0:1]:443
Manually intercepting tcp6 connection to ::ffff:185.93.3.244:443
Manually intercepting tcp6 connection to [24:0:52:e0:1e:6:0:0:0:0:0:0:8:95:0:1]:443
Manually intercepting tcp6 connection to ::ffff:185.93.3.244:443
Manually intercepting tcp6 connection to [24:0:52:e0:1e:6:0:0:0:0:0:0:8:95:0:1]:443
Blocking QUIC connection to [20:1:48:60:48:60:0:0:0:0:0:0:0:0:88:88]:443
Blocking QUIC connection to 127.0.0.1:443

 !!! --- Unexpected TLS failure --- !!!
      CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
      Thrown by com.android.org.conscrypt.TrustManagerImpl->verifyChain
      [ ] Unrecognized TLS error - this must be patched manually
Process crashed: Bad access due to invalid address

***
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'Android/sdk_phone64_x86_64/emu64x:15/AE3A.240806.019/12368160:userdebug/test-keys'
Revision: '0'
ABI: 'x86_64'
Timestamp: 2025-08-08 17:12:06.095458440+0200
Process uptime: 14s
Cmdline: tech.httptoolkit.pinning_demo
pid: 7593, tid: 7593, name: it.pinning_demo  >>> tech.httptoolkit.pinning_demo <<<
uid: 10155
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x000000000000001a
Cause: null pointer dereference
    rax 000000000000000a  rbx 000073d285da8db0  rcx 0000000000000000  rdx 00007ffd5b686fa0
    r8  0000000100000000  r9  0000000000000030  r10 8000000000000000  r11 0000000000000231
    r12 000073cf597a7d58  r13 00007ffd5b6884a8  r14 00007ffd5b6883a0  r15 00007ffd5b686fa0
    rdi 000073d0c4e07010  rsi 00007ffd5b6883a0
    rbp 00007ffd5b6883a0  rsp 00007ffd5b686e50  rip 000073cfe439008f
46 total frames
backtrace:
      #00 pc 000000000099008f  /apex/com.android.art/lib64/libart.so (artQuickGenericJniTrampoline+79) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #01 pc 000000000022b59b  /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+139) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #02 pc 000000000020986d  /apex/com.android.art/lib64/libart.so (nterp_helper+3837) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #03 pc 0000000000a1cd58  /data/app/~~xp7WS05Rmhx0gqKYqEmHdw==/tech.httptoolkit.pinning_demo-tmgoc6Y2S7ODaMyPJaMxTA==/oat/x86_64/base.vdex (org.chromium.net.impl.UserAgent.versionFromContext+32)
      #04 pc 00000000002089a8  /apex/com.android.art/lib64/libart.so (nterp_helper+56) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #05 pc 0000000000a1cdda  /data/app/~~xp7WS05Rmhx0gqKYqEmHdw==/tech.httptoolkit.pinning_demo-tmgoc6Y2S7ODaMyPJaMxTA==/oat/x86_64/base.vdex (org.chromium.net.impl.UserAgent.from+34)
      #06 pc 0000000000208a15  /apex/com.android.art/lib64/libart.so (nterp_helper+165) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #07 pc 0000000000a15a38  /data/app/~~xp7WS05Rmhx0gqKYqEmHdw==/tech.httptoolkit.pinning_demo-tmgoc6Y2S7ODaMyPJaMxTA==/oat/x86_64/base.vdex (org.chromium.net.impl.CronetEngineBuilderImpl.getDefaultUserAgent+4)
      #08 pc 0000000000209808  /apex/com.android.art/lib64/libart.so (nterp_helper+3736) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #09 pc 0000000000a1bb5c  /data/app/~~xp7WS05Rmhx0gqKYqEmHdw==/tech.httptoolkit.pinning_demo-tmgoc6Y2S7ODaMyPJaMxTA==/oat/x86_64/base.vdex (org.chromium.net.impl.NativeCronetEngineBuilderImpl.build+12)
      #10 pc 0000000000209808  /apex/com.android.art/lib64/libart.so (nterp_helper+3736) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #11 pc 0000000000a05a68  /data/app/~~xp7WS05Rmhx0gqKYqEmHdw==/tech.httptoolkit.pinning_demo-tmgoc6Y2S7ODaMyPJaMxTA==/oat/x86_64/base.vdex (org.chromium.net.ExperimentalOptionsTranslatingCronetEngineBuilder.build+28)
      #12 pc 0000000000209808  /apex/com.android.art/lib64/libart.so (nterp_helper+3736) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #13 pc 0000000000a04672  /data/app/~~xp7WS05Rmhx0gqKYqEmHdw==/tech.httptoolkit.pinning_demo-tmgoc6Y2S7ODaMyPJaMxTA==/oat/x86_64/base.vdex (org.chromium.net.CronetEngine$Builder.build+86)
      #14 pc 0000000000209808  /apex/com.android.art/lib64/libart.so (nterp_helper+3736) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #15 pc 0000000000a22758  /data/app/~~xp7WS05Rmhx0gqKYqEmHdw==/tech.httptoolkit.pinning_demo-tmgoc6Y2S7ODaMyPJaMxTA==/oat/x86_64/base.vdex (tech.httptoolkit.pinning_demo.MainActivity.sendUnpinnedHttp3+64)
      #16 pc 0000000000212154  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+756) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #17 pc 0000000000474bf5  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+181) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #18 pc 000000000087486a  /apex/com.android.art/lib64/libart.so (_jobject* art::InvokeMethod<(art::PointerSize)8>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jobject*, _jobject*, unsigned long)+2218) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #19 pc 00000000007d0337  /apex/com.android.art/lib64/libart.so (art::Method_invoke(_JNIEnv*, _jobject*, _jobject*, _jobjectArray*) (.__uniq.165753521025965369065708152063621506277)+39) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #20 pc 00000000000a672f  /system/framework/x86_64/boot.oat (art_jni_trampoline+127) (BuildId: 68b5d9df423be4ebd4a6c38087fc90e635afb135)
      #21 pc 000000000020986d  /apex/com.android.art/lib64/libart.so (nterp_helper+3837) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #22 pc 0000000000196d26  /data/app/~~xp7WS05Rmhx0gqKYqEmHdw==/tech.httptoolkit.pinning_demo-tmgoc6Y2S7ODaMyPJaMxTA==/oat/x86_64/base.vdex (androidx.appcompat.app.AppCompatViewInflater$DeclaredOnClickListener.onClick+42)
      #23 pc 000000000071077d  /system/framework/x86_64/boot-framework.oat (android.view.View.performClick+429) (BuildId: bc047a67a4076b80992fbdfabdfba12acbd1924a)
      #24 pc 000000000020986d  /apex/com.android.art/lib64/libart.so (nterp_helper+3837) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #25 pc 000000000036775e  /data/app/~~xp7WS05Rmhx0gqKYqEmHdw==/tech.httptoolkit.pinning_demo-tmgoc6Y2S7ODaMyPJaMxTA==/oat/x86_64/base.vdex (com.google.android.material.button.MaterialButton.performClick+6)
      #26 pc 00000000006751cd  /system/framework/x86_64/boot-framework.oat (android.view.View$PerformClick.run+413) (BuildId: bc047a67a4076b80992fbdfabdfba12acbd1924a)
      #27 pc 000000000052bb4f  /system/framework/x86_64/boot-framework.oat (android.os.Handler.dispatchMessage+79) (BuildId: bc047a67a4076b80992fbdfabdfba12acbd1924a)
      #28 pc 000000000052ed9e  /system/framework/x86_64/boot-framework.oat (android.os.Looper.loopOnce+942) (BuildId: bc047a67a4076b80992fbdfabdfba12acbd1924a)
      #29 pc 000000000052e93b  /system/framework/x86_64/boot-framework.oat (android.os.Looper.loop+235) (BuildId: bc047a67a4076b80992fbdfabdfba12acbd1924a)
      #30 pc 000000000030a33c  /system/framework/x86_64/boot-framework.oat (android.app.ActivityThread.main+1500) (BuildId: bc047a67a4076b80992fbdfabdfba12acbd1924a)
      #31 pc 00000000002124b6  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+806) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #32 pc 0000000000474c24  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+228) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #33 pc 000000000087486a  /apex/com.android.art/lib64/libart.so (_jobject* art::InvokeMethod<(art::PointerSize)8>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jobject*, _jobject*, unsigned long)+2218) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #34 pc 00000000007d0337  /apex/com.android.art/lib64/libart.so (art::Method_invoke(_JNIEnv*, _jobject*, _jobject*, _jobjectArray*) (.__uniq.165753521025965369065708152063621506277)+39) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #35 pc 00000000000a672f  /system/framework/x86_64/boot.oat (art_jni_trampoline+127) (BuildId: 68b5d9df423be4ebd4a6c38087fc90e635afb135)
      #36 pc 0000000000810405  /system/framework/x86_64/boot-framework.oat (com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run+117) (BuildId: bc047a67a4076b80992fbdfabdfba12acbd1924a)
      #37 pc 00000000008196f0  /system/framework/x86_64/boot-framework.oat (com.android.internal.os.ZygoteInit.main+2704) (BuildId: bc047a67a4076b80992fbdfabdfba12acbd1924a)
      #38 pc 00000000002124b6  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+806) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #39 pc 0000000000474c24  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+228) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #40 pc 00000000008753a6  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeWithVarArgs<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, __va_list_tag*)+518) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #41 pc 000000000072711a  /apex/com.android.art/lib64/libart.so (art::JNI<true>::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, __va_list_tag*)+586) (BuildId: 86541675bab12d77c4cd601b77f3f707)
      #42 pc 00000000000dcf68  /system/lib64/libandroid_runtime.so (_JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...)+136) (BuildId: 74e467b22a4c3107eac51948743c9977)
      #43 pc 00000000000f2fb0  /system/lib64/libandroid_runtime.so (android::AndroidRuntime::start(char const*, android::Vector<android::String8> const&, bool)+928) (BuildId: 74e467b22a4c3107eac51948743c9977)
      #44 pc 0000000000004706  /system/bin/app_process64 (main+1638) (BuildId: 2919fb70658f9ff2e805cbbbdd33a33b)
      #45 pc 0000000000057c82  /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+114) (BuildId: eb58b4d427279994f00c0e1818477e4f)
***
[Android Emulator 5554::tech.httptoolkit.pinning_demo ]->

Thank you for using Frida!

If you have any suggestions on how would I isolate the scripts, pls let me know.
Thanks for the help

[JustLinuxUser]

I have found a minimal set of crashing scripts:

❯ frida -U \ 
    -l ./config.js \
    -l ./native-connect-hook.js \
    -f tech.httptoolkit.pinning_demo

When the app opens, clicking on the first button every second for ~10 - 15 sec, makes it crash pretty consistently for me, and uninstalling and installing it before opening, helps too

I am not sure where to go from here

[pimterry]

I've been testing this. I can occasionally reproduce it, but not often, and only in specific environments. It never fails on my physical test device, for example, but does something on an official Android emulator. Next steps are to test older version of that native-connect-hook script (which has changed significantly recently) and see if we work out which part of it is causing issues. There's definitely something unusual & low level here though, I suspect it'll be tricky to trace down a root cause but at least we should be able to find out the change here that's triggered the issue.

[JustLinuxUser]

I have tested this commit: 0e47a37 (randomly selected), and it still crashes, if you suspect a particular version(s), pls let me know, and I can try them out