Content
# tiktok-ssl-bypass-skill
> A [Claude Code](https://docs.claude.com/en/docs/claude-code) skill that bypasses **Cronet / BoringSSL** certificate verification,
> used with **Frida + IDA MCP** to quickly generate SSL Pinning bypass scripts for TikTok and other ByteDance apps.
English: [README_EN.md](README_EN.md)
---
## ⚠️ Disclaimer
This project is only for **authorized security testing, protocol analysis, and learning research**
(your own device, your own traffic, CTF, compliance penetration).
Users must comply with local laws and regulations, and it is strictly prohibited to use it for any commercial or illegal purposes.
The consequences of using this project are borne by the user and have nothing to do with the author.
---
**Core Principle:** The third parameter `callback` of `SSL_CTX_set_custom_verify(ctx, mode, callback)`
is a custom verification callback. Returning `0` means success (`ssl_verify_ok`).
Hooking this callback and forcing it to return `0` can bypass the verification globally.
```
Java API → JNI → Cronet C API → Chromium net stack → BoringSSL(SSL_CTX_set_custom_verify)
```
See the detailed reverse engineering ideas in the skill document: [`skills/rev-cronet-ssl/SKILL.md`](skills/rev-cronet-ssl/SKILL.md)
---
## Repository Contents
| File | Description |
|------|------|
| `skills/rev-cronet-ssl/SKILL.md` | Main skill file: activator, detection principle, **IDA MCP reverse engineering workflow**, bypass strategy decision tree |
| `skills/rev-cronet-ssl/assets/cronet_ssl_bypass.js` | **Universal template**: multi-module, dlopen + polling dual detection, export + offset dual strategy, requires micro-tuning `CONFIG` according to the target version |
| `skills/rev-cronet-ssl/assets/tiktok_ssl_bypass.js` | **Ready-to-use example**: tested on TikTok `45.7.1`, with polling detection and offset confirmed by IDA |
---
## Quick Start
### Prerequisites
- Rooted Android device/emulator with trusted CA for packet capture
- `frida-server` (or gadget) running on the device, `frida` tool on PC
- Packet capture proxy (mitmproxy / Charles / BurpSuite)
### Run (example with TikTok)
```bash
# spawn mode (-H for network forwarding to frida-server; use -U for USB)
frida -U -f com.zhiliaoapp.musically \
-l skills/rev-cronet-ssl/assets/tiktok_ssl_bypass.js
# for Douyin
frida -U -f com.ss.android.ugc.aweme \
-l skills/rev-cronet-ssl/assets/cronet_ssl_bypass.js
```
### Successful Output
```
[tiktok-ssl] hook SSL_CTX_set_custom_verify @ 0x... (libsscronet.so!0x4b2580)
[tiktok-ssl] SSL_CTX_set_custom_verify hit | caller=libsscronet.so!0x... | mode=0x1 | cb=0x...
[tiktok-ssl] force verify 0x1 -> 0 (ssl_verify_ok) [export]
```
If you see `force verify ... -> 0` and the proxy starts to capture traffic, the bypass is successful.
---
## Using as a Claude Code Skill
With [IDA Pro MCP](https://github.com/mrexodia/ida-pro-mcp), let Claude automatically complete the entire process of
"loading so → locating `SSL_CTX_set_custom_verify` → confirming verification callback → calculating offset → generating script".
Install (soft link the skill to your project's `.claude/skills/`):
```bash
git clone https://github.com/Zskkk/tiktok-ssl-bypass-skill.git
ln -s "$(pwd)/tiktok-ssl-bypass-skill/skills/rev-cronet-ssl" \
/path/to/your-project/.claude/skills/rev-cronet-ssl
```
Then, in Claude Code, let it "use rev-cronet-ssl with IDA MCP to generate a Frida script to bypass TikTok SSL".
---
## Applicable Scope
| App | Package Name | Main Module |
|-----|------|--------|
| TikTok | `com.zhiliaoapp.musically` | `libsscronet.so` |
| Douyin | `com.ss.android.ugc.aweme` | `libsscronet.so` |
TikTok and Douyin share the same protocol stack, and the ideas are interchangeable (only offset differs by version).
TikTok region restrictions: remove SIM card + change device language/time zone to overseas + use overseas IP.
