# Essential Repositories to add in Cydia/Sileo/Zebra:
https://cydia.akemi.ai/          # Akemi's Repo
https://build.frida.re           # Frida Repo
https://repo.chariz.com/         # Chariz Repo
http://apt.thebigboss.org/repofiles/cydia/  # BigBoss Repo
https://repo.packix.com/         # Packix (legacy)

# CRITICAL: Change default passwords immediately after SSH installation
# Default root password is 'alpine' - this is a major security risk!

# SSH into device and change passwords:
ssh root@<iOS_DEVICE_IP_ADDRESS>

# Change root password:
passwd root
# Enter new secure password when prompted

# Change mobile user password:
passwd mobile
# Enter new secure password when prompted

# Find Device IP: 
# Settings > Wi-Fi > tap (i) icon next to connected network

# SSH via USB (using iproxy - more stable than WiFi):
# Install usbmuxd tools first:
# macOS: brew install libimobiledevice
# Linux: sudo apt install usbmuxd libimobiledevice-tools

# Forward SSH port via USB:
iproxy 2222 22

# SSH via USB tunnel:
ssh root@localhost -p 2222

# Forward additional ports for tools:
iproxy 8080 8080    # For Burp Suite proxy
iproxy 27042 27042  # For Frida server

# Download appropriate Frida version from GitHub releases
# For iOS ARM64 devices:
wget https://github.com/frida/frida/releases/download/16.1.8/frida-server-16.1.8-ios-arm64.xz

# Extract and transfer to device:
unxz frida-server-16.1.8-ios-arm64.xz
scp frida-server-16.1.8-ios-arm64 root@<iOS_DEVICE_IP>:/usr/sbin/frida-server

# SSH into device and set permissions:
ssh root@<iOS_DEVICE_IP>
chmod 755 /usr/sbin/frida-server

# Start Frida server:
/usr/sbin/frida-server -l 0.0.0.0 &

# Verify Frida is running:
ps aux | grep frida

# Install Frida command line tools:
pip3 install frida-tools

# Verify connection from computer:
frida-ps -U    # List processes on USB-connected device
frida-ps -H <iOS_DEVICE_IP>  # List processes on network-connected device

# Test with simple script:
frida-ps -Uai  # List installed applications with bundle IDs

# Essential tools to install from Cydia/Sileo/Zebra:
# - Filza File Manager (filesystem browser)
# - NewTerm (terminal emulator)
# - AppList (for app management)
# - PreferenceLoader (for tweak settings)
# - Substitute or Substrate (injection framework)

# Run MobSF in Docker (recommended):
docker pull opensecurity/mobile-security-framework-mobsf:latest
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

# Access MobSF web interface:
# Browse to: http://localhost:8000
# Default credentials: mobsf:mobsf

# Alternative: Install directly
git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
cd Mobile-Security-Framework-MobSF
./setup.sh  # For Linux/macOS
python manage.py runserver 0.0.0.0:8000

# Install objection:
pip3 install objection

# Verify installation:
objection version

# Basic usage:
objection -g <bundle_id> explore

# iOS App Installer/Manager tools:
brew install libimobiledevice  # macOS
sudo apt install libimobiledevice-tools  # Linux

# ideviceinstaller for IPA installation:
ideviceinstaller -l  # List installed apps
ideviceinstaller -i app.ipa  # Install IPA file

# 3uTools (Windows GUI alternative for device management)
# Download from: https://www.3u.com/

# In Burp Suite:
# 1. Go to Proxy > Options
# 2. Under Proxy Listeners, click 'Add'
# 3. Set Bind to port: 8080
# 4. Set Bind to address: All interfaces
# 5. Click OK

# On iOS device:
# 1. Settings > Wi-Fi
# 2. Tap (i) icon next to connected network
# 3. Scroll to HTTP Proxy > Manual
# 4. Server: <COMPUTER_IP_ADDRESS>
# 5. Port: 8080
# 6. Authentication: OFF

# Alternative: Set proxy via command line (jailbroken device):
# SSH into device and modify network settings:
sudo defaults write /Library/Preferences/SystemConfiguration/preferences.plist \
HTTPProxy -dict-add HTTPEnable -int 1
sudo defaults write /Library/Preferences/SystemConfiguration/preferences.plist \
HTTPProxy -dict-add HTTPProxy -string "<COMPUTER_IP>"
sudo defaults write /Library/Preferences/SystemConfiguration/preferences.plist \
HTTPProxy -dict-add HTTPPort -int 8080

# Method 1: Via Safari (Standard)
# 1. Open Safari on iOS device
# 2. Browse to: http://burp
# 3. Click 'CA Certificate' to download cacert.der
# 4. Allow profile download when prompted
# 5. Settings > General > Profile > Install PortSwigger CA
# 6. Settings > General > About > Certificate Trust Settings
# 7. Enable full trust for PortSwigger CA

# Method 2: Manual installation for problematic apps
# Export certificate from Burp as DER format
openssl x509 -inform DER -in cacert.der -out cacert.pem
# Convert to mobile config format using online tools or:
# Apple Configurator 2 (macOS) to create configuration profile

# Test HTTPS traffic interception:
# 1. Open Safari and visit https://www.google.com
# 2. Check Burp Suite HTTP history for captured requests
# 3. If not working, check certificate trust settings again

# Troubleshooting:
# - Ensure certificate is properly trusted
# - Check proxy settings are correct
# - Verify Burp is listening on correct interface
# - For stubborn apps, may need SSL pinning bypass

# Clone and setup frida-ios-dump:
git clone https://github.com/AloneMonkey/frida-ios-dump.git
cd frida-ios-dump
pip3 install -r requirements.txt --upgrade

# Ensure Frida server is running on iOS device:
ssh root@<iOS_DEVICE_IP>
/usr/sbin/frida-server -l 0.0.0.0 &

# List available applications:
frida-ps -Uai  # Shows bundle IDs and app names

# Dump IPA file:
# Via USB connection:
./dump.py <APP_NAME_OR_BUNDLE_ID> -u root -P <ROOT_PASSWORD>

# Via network:
./dump.py <APP_NAME_OR_BUNDLE_ID> -H <iOS_DEVICE_IP>

# Examples:
./dump.py Instagram
./dump.py com.burbn.instagram
./dump.py "App Store"  # Use quotes for apps with spaces

# The dumped IPA will be saved in the current directory

# Install flexdecrypt via Cydia/Sileo
# SSH into device:
ssh root@<iOS_DEVICE_IP>

# Find app executable:
find /var/containers/Bundle/Application -name "*.app" | grep -i <app_name>

# Decrypt executable:
flexdecrypt /var/containers/Bundle/Application/<UUID>/<AppName>.app/<ExecutableName>

# Create IPA manually:
cd /var/containers/Bundle/Application/<UUID>/
zip -r <AppName>.ipa Payload/
scp <AppName>.ipa <your_computer>:~/

# SSH into device:
ssh root@<iOS_DEVICE_IP>

# Find application bundle:
find /var/containers/Bundle/Application -name "*.app" -type d | head -20

# For specific app:
find /var/containers/Bundle/Application -name "*WhatsApp*" -type d

# Create IPA structure:
mkdir -p /tmp/Payload
APP_PATH=$(find /var/containers/Bundle/Application -name "*AppName*.app" | head -1)
cp -r "$APP_PATH" /tmp/Payload/

# Create IPA:
cd /tmp
zip -r AppName.ipa Payload/

# Transfer to computer:
scp /tmp/AppName.ipa <user>@<computer_ip>:~/Desktop/

# Install libimobiledevice tools:
# macOS: brew install libimobiledevice
# Linux: sudo apt install libimobiledevice-tools

# List connected devices:
idevice_id -l

# Install IPA:
ideviceinstaller -i <path_to_app.ipa>

# Uninstall app:
ideviceinstaller -U <bundle_id>

# List installed apps:
ideviceinstaller -l

# Download Cydia Impactor from: http://www.cydiaimpactor.com/
# Drag and drop IPA file onto Cydia Impactor
# Enter Apple ID credentials when prompted
# App will be installed with 7-day certificate

# Install TrollStore using appropriate method for your iOS version
# Open TrollStore app
# Tap + button and select IPA file
# Apps installed via TrollStore are permanently signed

# MobSF automatically checks for:
# - PIE (Position Independent Executable): Should be enabled
# - ARC (Automatic Reference Counting): Should be enabled  
# - Stack Canaries: Should be enabled (__stack_chk_guard present)
# - Binary Encryption: cryptid should be 1 for App Store apps
# - Banned APIs: Usage of insecure functions
# - Weak Cryptography: MD5, SHA1, DES, RC4 usage

# MobSF identifies sensitive files:
# - Database files (.sqlite, .db)
# - Configuration files (.plist)
# - Certificate/key files (.pem, .crt, .key)
# - Cache and preference files
# - Custom data formats

# Rename IPA to ZIP and extract:
cp app.ipa app.zip
unzip app.zip
cd Payload/AppName.app/

# Key files to examine:
ls -la
# Look for:
# - Info.plist (app configuration)
# - Main executable (same name as .app folder)
# - *.plist files (preferences, configurations)
# - *.sqlite/*.db files (databases)
# - Assets.car (compiled asset catalog)
# - Frameworks/ (embedded frameworks)

# Find main executable:
MAIN_EXEC=$(ls -1 | grep -v '\.' | head -1)
echo "Main executable: $MAIN_EXEC"

# Check ASLR/PIE (Position Independent Executable):
otool -hv "$MAIN_EXEC" | grep PIE
# Expected: PIE flag should be present

# Check Stack Canaries (Stack Smashing Protection):
otool -I -v "$MAIN_EXEC" | grep stack
# Expected: __stack_chk_guard and __stack_chk_fail should be present

# Check ARC (Automatic Reference Counting):
otool -I -v "$MAIN_EXEC" | grep objc_release
# Expected: _objc_release symbol should be present

# Check Binary Encryption (FairPlay DRM):
otool -arch all -Vl "$MAIN_EXEC" | grep -A5 LC_ENCRYPT
# Expected: cryptid = 1 for App Store apps, 0 for jailbroken dumps

# Check for weak crypto functions:
otool -I -v "$MAIN_EXEC" | grep -E "_CC_MD5|_CC_SHA1|_DES_|_RC4_"

# Check for insecure memory functions:
otool -I -v "$MAIN_EXEC" | grep -E "_gets|_strcpy|_strcat|_sprintf|_vsprintf"

# Check for debugging symbols:
otool -I -v "$MAIN_EXEC" | grep -E "_NSLog|_printf"

# Convert binary plist to XML if needed:
plutil -convert xml1 Info.plist -o Info.xml

# Or use plistutil:
plistutil -i Info.plist -o Info.xml

# Key security-relevant entries to examine:
grep -A 2 -B 2 -E "(CFBundleURLSchemes|NSAllowsArbitraryLoads|UIFileSharingEnabled|NSAppTransportSecurity)" Info.xml

# Extract and analyze specific values:
plutil -extract CFBundleURLTypes json Info.plist  # URL schemes
plutil -extract NSAppTransportSecurity json Info.plist  # ATS config
plutil -extract UIFileSharingEnabled json Info.plist  # File sharing

<!-- Dangerous configurations: -->
<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <true/>  <!-- CRITICAL: Allows HTTP connections -->
</dict>

<key>CFBundleURLTypes</key>
<array>
    <dict>
        <key>CFBundleURLSchemes</key>
        <array>
            <string>myapp</string>  <!-- Custom URL scheme -->
        </array>
    </dict>
</array>

<key>UIFileSharingEnabled</key>
<true/>  <!-- Allows iTunes file access -->

<key>LSSupportsOpeningDocumentsInPlace</key>
<true/>  <!-- Document access -->

# Search for sensitive files and content:
find . -name "*.plist" -exec echo "=== {} ===" \; -exec cat {} \;
find . -name "*.sqlite*" -o -name "*.db"
find . -name "*.pem" -o -name "*.crt" -o -name "*.key" -o -name "*.p12"

# Search for hardcoded secrets:
grep -r -i -E "(password|secret|key|token|api_key|firebase|credential|auth)" .
grep -r -E "[0-9a-f]{32,}" .  # Look for potential hashes/keys
grep -r -E "(https?://|ftp://)" .  # URLs
grep -r -E "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}" .  # Emails

# Search for crypto-related terms:
grep -r -i -E "(encrypt|decrypt|cipher|crypto|hash|salt|iv)" .

# Search for database queries:
grep -r -i -E "(select|insert|update|delete|drop|create)" .

# Check if app uses React Native:
find . -name "main.jsbundle" -o -name "*.bundle"

# Decompile React Native bundle:
npm install -g react-native-decompiler

# Decompile bundle:
npx react-native-decompiler -i main.jsbundle -o ./decompiled_js

# Analyze decompiled JavaScript:
cd decompiled_js
grep -r -E "(fetch|XMLHttpRequest|AsyncStorage|localStorage)" .
grep -r -i -E "(password|secret|key|token|api)" .
grep -r -E "(https?://)" .  # API endpoints

# List devices:
frida-ls-devices

# List processes on device:
frida-ps -U  # Via USB
frida-ps -H <DEVICE_IP>  # Via network

# List installed applications:
frida-ps -Uai

# Attach to running app:
frida -U <bundle_id>
frida -U <process_name>

# Spawn app and attach:
frida -U -f <bundle_id> --no-pause

# Load script and attach:
frida -U -l script.js <bundle_id>

# Interactive REPL:
frida -U <bundle_id>

// In Frida REPL:

// List loaded modules:
Process.enumerateModules()

// Find module by name:
Process.getModuleByName("AppName")

// List classes (Objective-C):
ObjC.classes

// Search for classes:
Object.keys(ObjC.classes).filter(c => c.includes("Login"))

// Get class methods:
ObjC.classes.LoginManager.$methods

// Hook a method:
var LoginManager = ObjC.classes.LoginManager;
LoginManager["- authenticateUser:password:"].implementation = function(user, pass) {
    console.log("Login attempt: " + user + " / " + pass);
    return this.authenticateUser_password_(user, pass);
}

// Call original method and get result:
var result = this.authenticateUser_password_(user, pass);
console.log("Login result: " + result);
return result;

# Connect to app:
objection -g <bundle_id> explore

# Examples:
objection -g com.apple.mobilesafari explore
objection -g Instagram explore

# Spawn app and connect:
objection -g <bundle_id> explore --startup-command "ios sslpinning disable"

# Disable SSL pinning:
ios sslpinning disable
ios sslpinning disable --quiet

# Disable jailbreak detection:
ios jailbreak disable

# Simulate jailbreak detection bypass:
ios jailbreak simulate

# Get app information:
env

# List loaded frameworks:
ios bundles list_frameworks

# Get application directory paths:
env | grep -E "(Documents|Library|tmp)"

# NSUserDefaults (user preferences):
ios nsuserdefaults get

# Keychain dump:
ios keychain dump
ios keychain dump --json  # JSON format

# Cookies:
ios cookies get

# NSURLCredentialStorage:
ios nsurlcredentialstorage dump

# Clipboard:
ios clipboard get

# List files:
ios filesystem ls <path>
ios filesystem ls /var/mobile/Containers/Data/Application/<UUID>/Documents/

# Read file:
ios filesystem cat <path>

# Download file:
ios filesystem download <remote_path> <local_path>

# Upload file:
ios filesystem upload <local_path> <remote_path>

# Search for classes:
ios hooking search classes "keyword"
ios hooking search classes "login"
ios hooking search classes "crypto"
ios hooking search classes "auth"

# List class methods:
ios hooking list class_methods <ClassName>
ios hooking list class_methods NSURLSession

# Watch method calls:
ios hooking watch class_method "+[NSURLSession sessionWithConfiguration:]" --dump-args --dump-return
ios hooking watch class_method "-[LoginManager authenticateUser:password:]" --dump-args

# Set return value:
ios hooking set return_value "-[JailbreakDetector isJailbroken]" false
ios hooking set return_value "-[AuthManager isAuthenticated]" true

# Monitor all methods in a class:
ios hooking watch class NSURLSession

# Connect to database:
ios sqlite connect <path_to_db>
ios sqlite connect /var/mobile/Containers/Data/Application/<UUID>/Documents/database.sqlite

# Once connected, run SQL queries:
sqlite> .tables
sqlite> .schema users
sqlite> SELECT * FROM users;
sqlite> SELECT username, password_hash FROM users WHERE admin=1;

// ios_security_bypass.js
function main() {
    console.log("[+] iOS Security Bypass Script Loading...");
    
    // === Jailbreak Detection Bypass ===
    bypassJailbreakDetection();
    
    // === SSL Pinning Bypass ===
    bypassSSLPinning();
    
    // === Anti-Debugging Bypass ===
    bypassAntiDebugging();
    
    // === Data Extraction Hooks ===
    hookSensitiveDataMethods();
    
    console.log("[+] All hooks installed successfully!");
}

function bypassJailbreakDetection() {
    console.log("[*] Installing jailbreak detection bypasses...");
    
    // Hook file existence checks
    var NSFileManager = ObjC.classes.NSFileManager;
    var defaultManager = NSFileManager.defaultManager();
    
    // Common jailbreak detection files
    var jailbreakFiles = [
        "/Applications/Cydia.app",
        "/Applications/Sileo.app", 
        "/bin/bash",
        "/usr/sbin/sshd",
        "/etc/apt",
        "/private/var/lib/apt/",
        "/var/cache/apt",
        "/var/lib/cydia",
        "/var/mobile/Library/Preferences/com.saurik.Cydia.plist",
        "/Library/MobileSubstrate/MobileSubstrate.dylib",
        "/usr/bin/ssh",
        "/var/lib/undecimus/auto_install"
    ];
    
    // Hook fileExistsAtPath:
    var originalFileExists = defaultManager.fileExistsAtPath_;
    Interceptor.attach(originalFileExists.implementation, {
        onEnter: function(args) {
            this.filePath = ObjC.Object(args[2]).toString();
        },
        onLeave: function(retval) {
            if (jailbreakFiles.includes(this.filePath)) {
                console.log("[*] Blocked jailbreak detection for: " + this.filePath);
                retval.replace(ptr("0x0"));
            }
        }
    });
    
    // Hook canOpenURL for Cydia/Sileo schemes
    var UIApplication = ObjC.classes.UIApplication;
    var sharedApp = UIApplication.sharedApplication();
    var originalCanOpenURL = sharedApp.canOpenURL_;
    
    Interceptor.attach(originalCanOpenURL.implementation, {
        onEnter: function(args) {
            this.url = ObjC.Object(args[2]).toString();
        },
        onLeave: function(retval) {
            if (this.url.includes("cydia://") || this.url.includes("sileo://")) {
                console.log("[*] Blocked URL scheme detection: " + this.url);
                retval.replace(ptr("0x0"));
            }
        }
    });
    
    // Hook fork() and ptrace() system calls
    var fork = Module.findExportByName("libsystem_c.dylib", "fork");
    if (fork) {
        Interceptor.replace(fork, new NativeCallback(function() {
            console.log("[*] Blocked fork() call");
            return -1;
        }, 'int', []));
    }
}

function bypassSSLPinning() {
    console.log("[*] Installing SSL pinning bypasses...");
    
    // Method 1: Hook SecTrustEvaluate
    var SecTrustEvaluate = Module.findExportByName("Security", "SecTrustEvaluate");
    if (SecTrustEvaluate) {
        Interceptor.replace(SecTrustEvaluate, new NativeCallback(function(trust, result) {
            console.log("[*] SSL Pinning Bypass: SecTrustEvaluate");
            Memory.writeU32(result, 1); // kSecTrustResultProceed
            return 0; // errSecSuccess
        }, 'int', ['pointer', 'pointer']));
    }
    
    // Method 2: Hook NSURLSession delegate methods
    try {
        var NSURLSessionTaskDelegate = ObjC.protocols.NSURLSessionTaskDelegate;
        var method = NSURLSessionTaskDelegate["- URLSession:task:didReceiveChallenge:completionHandler:"];
        
        if (method) {
            Interceptor.attach(method.implementation, {
                onEnter: function(args) {
                    console.log("[*] SSL Pinning Bypass: NSURLSessionTaskDelegate");
                    var challenge = ObjC.Object(args[4]);
                    var completionHandler = new ObjC.Block(args[5]);
                    var credential = ObjC.classes.NSURLCredential.credentialForTrust_(challenge.protectionSpace().serverTrust());
                    completionHandler.implementation(1, credential); // NSURLSessionAuthChallengeUseCredential
                }
            });
        }
    } catch (e) {
        console.log("[!] NSURLSessionTaskDelegate hook failed: " + e.message);
    }
    
    // Method 3: Hook common pinning libraries
    hookAFNetworking();
    hookAlamofire();
}

function hookAFNetworking() {
    try {
        var AFNetworkReachabilityManager = ObjC.classes.AFNetworkReachabilityManager;
        if (AFNetworkReachabilityManager) {
            var setSSLPinningMode = AFNetworkReachabilityManager["- setSSLPinningMode:"];
            if (setSSLPinningMode) {
                Interceptor.attach(setSSLPinningMode.implementation, {
                    onEnter: function(args) {
                        console.log("[*] AFNetworking SSL Pinning disabled");
                        args[2] = ptr("0x0"); // AFSSLPinningModeNone
                    }
                });
            }
        }
    } catch (e) {
        console.log("[!] AFNetworking hook failed: " + e.message);
    }
}

function hookAlamofire() {
    // Hook Alamofire's ServerTrustManager if present
    try {
        var ServerTrustManager = ObjC.classes.ServerTrustManager;
        if (ServerTrustManager) {
            console.log("[*] Found Alamofire ServerTrustManager - implementing bypass");
            // Implementation depends on Alamofire version
        }
    } catch (e) {
        console.log("[!] Alamofire hook failed: " + e.message);
    }
}

function bypassAntiDebugging() {
    console.log("[*] Installing anti-debugging bypasses...");
    
    // Hook ptrace
    var ptrace = Module.findExportByName("libsystem_kernel.dylib", "ptrace");
    if (ptrace) {
        Interceptor.replace(ptrace, new NativeCallback(function(request, pid, addr, data) {
            console.log("[*] ptrace called with request: " + request);
            if (request == 31) { // PT_DENY_ATTACH
                console.log("[*] Blocked PT_DENY_ATTACH");
                return 0;
            }
            return 0; // Block all ptrace calls
        }, 'int', ['int', 'int', 'pointer', 'pointer']));
    }
    
    // Hook sysctl for debugger detection
    var sysctl = Module.findExportByName("libsystem_c.dylib", "sysctl");
    if (sysctl) {
        Interceptor.attach(sysctl, {
            onEnter: function(args) {
                var name = Memory.readS32(args[0]);
                if (name == 1 && Memory.readS32(args[0].add(4)) == 14) { // CTL_KERN, KERN_PROC
                    console.log("[*] Blocked sysctl debugger detection");
                    this.modify = true;
                }
            },
            onLeave: function(retval) {
                if (this.modify) {
                    retval.replace(ptr("-1"));
                }
            }
        });
    }
}

function hookSensitiveDataMethods() {
    console.log("[*] Installing sensitive data hooks...");
    
    // Hook NSString stringWithFormat for logging
    var NSString = ObjC.classes.NSString;
    var originalStringWithFormat = NSString.stringWithFormat_;
    
    Interceptor.attach(originalStringWithFormat.implementation, {
        onEnter: function(args) {
            try {
                var format = ObjC.Object(args[2]).toString();
                if (format.toLowerCase().includes("password") || 
                    format.toLowerCase().includes("token") ||
                    format.toLowerCase().includes("secret")) {
                    console.log("[*] Sensitive data in NSString format: " + format);
                }
            } catch (e) {}
        }
    });
    
    // Hook NSUserDefaults for sensitive storage
    var NSUserDefaults = ObjC.classes.NSUserDefaults;
    var setObjectForKey = NSUserDefaults.prototype["- setObject:forKey:"];
    
    Interceptor.attach(setObjectForKey.implementation, {
        onEnter: function(args) {
            try {
                var key = ObjC.Object(args[3]).toString();
                var value = ObjC.Object(args[2]).toString();
                
                if (key.toLowerCase().includes("password") ||
                    key.toLowerCase().includes("token") ||
                    key.toLowerCase().includes("secret") ||
                    key.toLowerCase().includes("key")) {
                    console.log("[*] NSUserDefaults - Key: " + key + ", Value: " + value);
                }
            } catch (e) {}
        }
    });
    
    // Hook Keychain operations
    hookKeychainOperations();
    
    // Hook network requests
    hookNetworkRequests();
}

function hookKeychainOperations() {
    console.log("[*] Hooking Keychain operations...");
    
    // Hook SecItemAdd
    var SecItemAdd = Module.findExportByName("Security", "SecItemAdd");
    if (SecItemAdd) {
        Interceptor.attach(SecItemAdd, {
            onEnter: function(args) {
                console.log("[*] Keychain: SecItemAdd called");
                // args[0] is CFDictionaryRef attributes
                // Could parse and log keychain attributes here
            }
        });
    }
    
    // Hook SecItemCopyMatching
    var SecItemCopyMatching = Module.findExportByName("Security", "SecItemCopyMatching");
    if (SecItemCopyMatching) {
        Interceptor.attach(SecItemCopyMatching, {
            onEnter: function(args) {
                console.log("[*] Keychain: SecItemCopyMatching called");
            }
        });
    }
}

function hookNetworkRequests() {
    console.log("[*] Hooking network requests...");
    
    // Hook NSURLRequest
    var NSMutableURLRequest = ObjC.classes.NSMutableURLRequest;
    var setHTTPBody = NSMutableURLRequest.prototype["- setHTTPBody:"];
    
    Interceptor.attach(setHTTPBody.implementation, {
        onEnter: function(args) {
            try {
                var httpBody = ObjC.Object(args[2]);
                var bodyString = ObjC.classes.NSString.alloc().initWithData_encoding_(httpBody, 4);
                console.log("[*] HTTP Body: " + bodyString.toString());
            } catch (e) {}
        }
    });
    
    // Hook NSURLResponse
    var NSHTTPURLResponse = ObjC.classes.NSHTTPURLResponse;
    if (NSHTTPURLResponse) {
        var allHeaderFields = NSHTTPURLResponse.prototype["- allHeaderFields"];
        Interceptor.attach(allHeaderFields.implementation, {
            onLeave: function(retval) {
                try {
                    var headers = ObjC.Object(retval);
                    console.log("[*] Response Headers: " + headers.toString());
                } catch (e) {}
            }
        });
    }
}

// Initialize the script
if (ObjC.available) {
    main();
} else {
    console.log("[!] Objective-C Runtime not available");
}

# Save script as ios_security_bypass.js
# Run with target app:
frida -U -f <bundle_id> -l ios_security_bypass.js --no-pause

# Or attach to running app:
frida -U <bundle_id> -l ios_security_bypass.js

# On Android device:
# 1. Settings > About Phone
# 2. Tap "Build Number" 7 times to enable Developer Options
# 3. Settings > Developer Options > USB Debugging (Enable)
# 4. Connect device via USB and accept RSA fingerprint

# Verify connection:
adb devices
# Expected output: <device_id>    device

# If unauthorized, check device for RSA key acceptance dialog

# Method 1: Wireless Debugging (Android 11+)
# 1. Enable "Wireless Debugging" in Developer Options
# 2. Tap "Pair device with pairing code"
# 3. Note the IP address and port

# On computer:
adb pair <DEVICE_IP>:<PAIRING_PORT>
# Enter pairing code when prompted

# Connect for debugging:
adb connect <DEVICE_IP>:<DEBUGGING_PORT>

# Method 2: Traditional WiFi ADB (requires USB first)
adb tcpip 5555
adb connect <DEVICE_IP>:5555
adb disconnect  # Disconnect USB cable

# Using Android Studio AVD:
# 1. Create AVD with desired Android version
# 2. Start emulator with writable system:
emulator -avd <AVD_NAME> -writable-system -no-snapshot-load

# Alternative: Using command line
emulator -list-avds
emulator -avd Pixel_6_API_30 -writable-system

# Enable root access on emulator:
adb root
adb remount

# If AVB (Android Verified Boot) enabled:
adb shell avbctl disable-verification
adb reboot
adb root
adb remount

# Device management:
adb devices -l                    # List devices with details
adb shell getprop ro.build.version.release  # Android version
adb shell getprop ro.product.model          # Device model

# Package management:
adb install app.apk               # Install APK
adb install -r app.apk            # Reinstall/update APK
adb uninstall <package_name>      # Uninstall app
adb shell pm list packages        # List all packages
adb shell pm list packages -3     # List user-installed packages
adb shell pm list packages -s     # List system packages
adb shell pm path <package_name>  # Get APK path

# File operations:
adb push <local_file> <remote_path>     # Upload file
adb pull <remote_path> <local_file>     # Download file
adb shell ls /data/data/            # List app data directories

# Process and activity management:
adb shell am force-stop <package_name>  # Stop app
adb shell am start -n <package>/<activity>  # Start activity
adb shell am start -a android.intent.action.VIEW -d "http://example.com"

# Log monitoring:
adb logcat                        # View system logs
adb logcat | grep <package_name>  # Filter logs by package
adb logcat -c                     # Clear log buffer

# Network and proxy:
adb shell settings put global http_proxy <IP>:<PORT>
adb shell settings delete global http_proxy

# Screen and input:
adb shell screencap /sdcard/screen.png     # Take screenshot
adb shell input text "Hello World"         # Input text
adb shell input keyevent 82               # Menu key
adb shell input tap 500 1000              # Tap coordinates

# In Burp Suite:
# 1. Proxy > Options > Proxy Listeners
# 2. Add listener: Port 8080, Bind to all interfaces
# 3. Ensure "Support invisible proxying" is checked for some apps

# Manual proxy configuration:
# 1. Settings > Network & Internet > Wi-Fi
# 2. Long press connected network > Modify network
# 3. Advanced options > Proxy > Manual
# 4. Hostname: <COMPUTER_IP>, Port: 8080

# Command line proxy (requires root):
adb shell settings put global http_proxy <COMPUTER_IP>:8080
adb shell settings put global https_proxy <COMPUTER_IP>:8080

# Verify proxy settings:
adb shell settings get global http_proxy

# 1. Export Burp CA certificate (DER format)
# 2. Transfer to device:
adb push cacert.der /sdcard/Download/

# 3. Install via Settings:
# Settings > Security > Install from storage > Download/cacert.der
# Choose "WiFi certificates" when prompted

# Export Burp CA in DER format, convert to PEM:
openssl x509 -inform DER -in cacert.der -out cacert.pem

# Get certificate hash:
CERT_HASH=$(openssl x509 -inform PEM -subject_hash_old -in cacert.pem | head -1)
echo "Certificate hash: $CERT_HASH"

# Rename certificate:
cp cacert.pem "${CERT_HASH}.0"

# Install on rooted device/emulator:
adb root
adb remount
adb push "${CERT_HASH}.0" /system/etc/security/cacerts/
adb shell chmod 644 /system/etc/security/cacerts/${CERT_HASH}.0
adb reboot

# Verify installation:
adb shell ls -la /system/etc/security/cacerts/ | grep $CERT_HASH

# Use Magisk modules like:
# - "MagiskTrustUserCerts" - Makes user certificates system-trusted
# - "Burp Certificate" - Automatically installs Burp certificate

# Install via Magisk Manager:
# 1. Open Magisk Manager
# 2. Modules > Download > Search for certificate module
# 3. Install and reboot

# Download appropriate Frida server for your architecture:
# Check device architecture:
adb shell getprop ro.product.cpu.abi

# Download from: https://github.com/frida/frida/releases
# For most modern devices (ARM64):
wget https://github.com/frida/frida/releases/download/16.1.8/frida-server-16.1.8-android-arm64.xz

# Extract and push to device:
unxz frida-server-16.1.8-android-arm64.xz
adb push frida-server-16.1.8-android-arm64 /data/local/tmp/frida-server
adb shell chmod 755 /data/local/tmp/frida-server

# Start Frida server (requires root):
adb shell su -c "/data/local/tmp/frida-server &"

# Alternative: Non-root startup (limited functionality):
adb shell "/data/local/tmp/frida-server &"

# Verify Frida server is running:
adb shell ps | grep frida-server

# Forward Frida port:
adb forward tcp:27042 tcp:27042

# Install Frida command-line tools:
pip3 install frida-tools

# Verify installation:
frida --version

# Test connection:
frida-ps -U    # List processes via USB
frida-ps -H <DEVICE_IP>  # List processes via network

# List installed applications:
frida-ps -Uai

# Create startup script:
cat > start_frida.sh << 'EOF'
#!/bin/bash
adb shell su -c "killall frida-server 2>/dev/null"
adb shell su -c "/data/local/tmp/frida-server &"
adb forward tcp:27042 tcp:27042
echo "Frida server started and port forwarded"
EOF

chmod +x start_frida.sh
./start_frida.sh

# List installed packages:
adb shell pm list packages | grep -i <app_name>

# Get APK path:
adb shell pm path <package_name>
# Example output: package:/data/app/com.example.app-1/base.apk

# Pull APK:
adb pull /data/app/com.example.app-1/base.apk ./app.apk

# For split APKs (Android App Bundles):
adb shell pm path <package_name>
# May show multiple APKs - pull all:
adb pull /data/app/com.example.app-1/base.apk
adb pull /data/app/com.example.app-1/split_config.arm64_v8a.apk

# Popular APK sites for legitimate testing:
# - APKMirror (apkmirror.com)
# - APKPure (apkpure.com)
# - APKMonk (apkmonk.com)

# Note: Only download APKs for legitimate testing purposes
# Verify APK integrity with:
aapt dump badging app.apk | grep package

# Install gplaycli:
pip3 install gplaycli

# Configure Google account:
gplaycli -c  # Follow configuration wizard

# Download APK:
gplaycli -d <package_name>
gplaycli -d com.example.app

# Download specific version:
gplaycli -d <package_name> -v <version_code>

# Download from: https://github.com/skylot/jadx/releases
# Extract and run:
unzip jadx-1.4.7.zip
cd jadx-1.4.7
./bin/jadx-gui

# Command line usage:
./bin/jadx -d output_folder app.apk

# Advanced options:
./bin/jadx --show-bad-code --escape-unicode -d output_folder app.apk

# Install APKTool:
# Download from: https://ibotpeaches.github.io/Apktool/
# Or install via package manager:
brew install apktool  # macOS
sudo apt install apktool  # Ubuntu

# Decompile APK:
apktool d app.apk -o app_decompiled

# Recompile after modifications:
apktool b app_decompiled -o app_modified.apk

# Force overwrite existing files:
apktool d -f app.apk -o app_decompiled

# Keep original filenames:
apktool d --keep-broken-res app.apk -o app_decompiled

# Download dex2jar from: https://github.com/pxb1988/dex2jar
# Convert APK to JAR:
d2j-dex2jar.sh app.apk

# This creates app-dex2jar.jar
# Open with JD-GUI for Java source viewing
# Download JD-GUI from: http://java-decompiler.github.io/

# Bytecode Viewer (All-in-one decompiler):
# Download from: https://github.com/Konloch/bytecode-viewer

# Ghidra (For native library analysis):
# Download from: https://ghidra-sre.org/

# radare2 (Command-line reverse engineering):
sudo apt install radare2
r2 app.apk

# Download from: https://github.com/patrickfav/uber-apk-signer/releases
wget https://github.com/patrickfav/uber-apk-signer/releases/download/v1.3.0/uber-apk-signer-1.3.0.jar

# Sign APK (automatically handles alignment and V1/V2 signing):
java -jar uber-apk-signer-1.3.0.jar --apks app_modified.apk

# Sign with custom keystore:
java -jar uber-apk-signer-1.3.0.jar --apks app_modified.apk --ks my-keystore.jks --ksAlias my-alias

# Step 1: Create keystore (one-time setup):
keytool -genkey -v -keystore my-release-key.keystore \
        -alias alias_name \
        -keyalg RSA \
        -keysize 2048 \
        -validity 10000

# Step 2: Align APK (important for performance):
zipalign -v 4 app_modified.apk app_aligned.apk

# Step 3: Sign APK:
apksigner sign --ks my-release-key.keystore \
               --ks-key-alias alias_name \
               --out app_signed.apk \
               app_aligned.apk

# Verify signature:
apksigner verify app_signed.apk

# Install signed APK:
adb install app_signed.apk

# Align first:
zipalign -v 4 app_modified.apk app_aligned.apk

# Sign with jarsigner:
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 \
          -keystore my-release-key.keystore \
          app_aligned.apk alias_name

# Note: V1 signing only, not recommended for modern Android

# Using aapt (Android Asset Packaging Tool):
aapt dump xmltree app.apk AndroidManifest.xml

# Using aapt2 (newer version):
aapt2 dump xmltree app.apk --file AndroidManifest.xml

# Using APKTool (human-readable XML):
apktool d app.apk -o app_decompiled
cat app_decompiled/AndroidManifest.xml

# Extract specific information:
aapt dump badging app.apk | grep -E "package|uses-permission|activity|service"

<!-- CRITICAL: Debug mode enabled in production -->
<application android:debuggable="true">

<!-- HIGH: Allows app data backup -->
<application android:allowBackup="true">

<!-- MEDIUM: Allows clear text traffic -->
<application android:usesCleartextTraffic="true">

<!-- Check for Network Security Config -->
<application android:networkSecurityConfig="@xml/network_security_config">

# Find exported components:
grep -A 5 'android:exported="true"' app_decompiled/AndroidManifest.xml

# Activities with intent filters (implicitly exported on older Android):
grep -B 5 -A 10 '<intent-filter>' app_decompiled/AndroidManifest.xml

# Services, receivers, and providers:
grep -E '<(service|receiver|provider)' app_decompiled/AndroidManifest.xml

# Extract all permissions:
aapt dump permissions app.apk

# Dangerous permissions:
grep 'uses-permission' app_decompiled/AndroidManifest.xml | grep -E '(WRITE_EXTERNAL_STORAGE|READ_EXTERNAL_STORAGE|CAMERA|RECORD_AUDIO|ACCESS_FINE_LOCATION|READ_CONTACTS|SEND_SMS)'

# Custom permissions defined by app:
grep 'permission android:name' app_decompiled/AndroidManifest.xml

# Find custom URL schemes:
grep -A 10 -B 5 'android:scheme' app_decompiled/AndroidManifest.xml

# Extract schemes for testing:
grep 'android:scheme' app_decompiled/AndroidManifest.xml | sed 's/.*android:scheme="\([^"]*\)".*/\1/'

# Test exported activities:
adb shell am start -n <package_name>/<exported_activity>
adb shell am start -n com.example.app/.SecretActivity

# Test with extras:
adb shell am start -n <package_name>/<activity> --es "key" "value"
adb shell am start -n com.example.app/.WebViewActivity --es "url" "file:///etc/passwd"

# Test exported services:
adb shell am startservice -n <package_name>/<exported_service>

# Test broadcast receivers:
adb shell am broadcast -a <action> -n <package_name>/<receiver>
adb shell am broadcast -a com.example.app.SECRET_ACTION --es "data" "payload"

# Test content providers:
adb shell content query --uri "content://<authority>/<path>"
adb shell content query --uri "content://com.example.app.provider/users"

# SQL injection in content providers:
adb shell content query --uri "content://com.example.app.provider/users/1' UNION SELECT password FROM admin--"

# Basic deep link test:
adb shell am start -W -a android.intent.action.VIEW -d "<scheme>://host/path"

# Examples:
adb shell am start -W -a android.intent.action.VIEW -d "myapp://profile?user_id=123"
adb shell am start -W -a android.intent.action.VIEW -d "myapp://webview?url=javascript:alert(1)"
adb shell am start -W -a android.intent.action.VIEW -d "myapp://webview?url=file:///etc/passwd"

# Test with malicious payloads:
adb shell am start -W -a android.intent.action.VIEW -d "myapp://pay?amount=1000000&account=attacker"

# Using MobSF:
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest
# Upload APK at http://localhost:8000

# Using QARK (Quick Android Review Kit):
pip install qark
qark --java <decompiled_java_path> --report-type json

# Using AndroBugs:
git clone https://github.com/AndroBugs/AndroBugs_Framework.git
python AndroBugs_Framework/androbugs.py -f app.apk

# Search for sensitive keywords:
grep -r -i -E "(password|secret|key|token|api_key|firebase|credential|auth)" app_decompiled/

# Hardcoded URLs and endpoints:
grep -r -E "https?://[^\"']+" app_decompiled/

# Crypto-related code:
grep -r -i -E "(encrypt|decrypt|cipher|aes|des|rsa|sha|md5)" app_decompiled/

# SQL queries (potential injection points):
grep -r -E "(SELECT|INSERT|UPDATE|DELETE|DROP)" app_decompiled/

# File operations:
grep -r -E "(FileInputStream|FileOutputStream|openFileOutput|openFileInput)" app_decompiled/

# WebView usage:
grep -r -E "(WebView|loadUrl|addJavascriptInterface)" app_decompiled/

# Network operations:
grep -r -E "(HttpURLConnection|OkHttp|Retrofit|Volley)" app_decompiled/

# Intent handling:
grep -r -E "(getIntent|putExtra|getStringExtra)" app_decompiled/

# SharedPreferences without encryption:
grep -r "getSharedPreferences\|SharedPreferences" app_decompiled/ | grep -v "EncryptedSharedPreferences"

# Internal storage issues:
grep -r "MODE_WORLD_READABLE\|MODE_WORLD_WRITABLE" app_decompiled/

# External storage usage:
grep -r "getExternalStorageDirectory\|getExternalFilesDir" app_decompiled/

# Database operations:
grep -r "SQLiteDatabase\|execSQL\|rawQuery" app_decompiled/

# Weak algorithms:
grep -r -E "(DES|RC4|MD5|SHA1)" app_decompiled/

# Hardcoded keys/IVs:
grep -r -E "new SecretKeySpec\|IvParameterSpec" app_decompiled/

# ECB mode (insecure):
grep -r "ECB" app_decompiled/

# Insecure random:
grep -r "Random\|SecureRandom" app_decompiled/

# SSL/TLS issues:
grep -r -E "(TrustManager|HostnameVerifier|SSLSocketFactory)" app_decompiled/

# Certificate pinning bypasses:
grep -r -E "(checkServerTrusted|ALLOW_ALL_HOSTNAME_VERIFIER)" app_decompiled/

# HTTP usage:
grep -r "http://" app_decompiled/ | grep -v "https://"

# JavaScript enabled:
grep -r "setJavaScriptEnabled(true)" app_decompiled/

# JavaScript interface:
grep -r "addJavascriptInterface" app_decompiled/

# File access enabled:
grep -r -E "(setAllowFileAccess|setAllowFileAccessFromFileURLs|setAllowUniversalAccessFromFileURLs)" app_decompiled/

# Mixed content:
grep -r "setMixedContentMode" app_decompiled/

# Install objection:
pip3 install objection

# Connect to application:
objection -g <package_name> explore

# Spawn application and connect:
objection -g <package_name> explore --startup-command "android sslpinning disable"

# Connect via network:
objection -N -h <DEVICE_IP> -g <package_name> explore

# Batch commands:
objection -g <package_name> run "android sslpinning disable" "android root disable"

# Disable SSL pinning:
android sslpinning disable
android sslpinning disable --quiet

# Disable root detection:
android root disable
android root simulate disable

# List current SSL pinning status:
android sslpinning list_hooks

# SharedPreferences:
android preferences list
android preferences get <filename>
android preferences get com.example.app_preferences

# SQLite databases:
android sqlite list
android sqlite connect <database_path>
android sqlite connect /data/data/com.example.app/databases/users.db

# In SQLite console:
sqlite> .tables
sqlite> .schema users
sqlite> SELECT * FROM users;
sqlite> SELECT username, password FROM users WHERE admin=1;

# Clipboard:
android clipboard get
android clipboard set "test data"

# Intents and activities:
android intent list activities
android intent start <activity_name>
android intent start_activity com.example.app.SecretActivity

# File system:
android filesystem ls /data/data/com.example.app/
android filesystem cat /data/data/com.example.app/shared_prefs/settings.xml
android filesystem download <remote_path> <local_path>
android filesystem upload <local_path> <remote_path>

# Search for classes:
android hooking search classes <keyword>
android hooking search classes login
android hooking search classes crypto
android hooking search classes http

# List class methods:
android hooking list class_methods <class_name>
android hooking list class_methods com.example.app.LoginManager

# Watch method calls:
android hooking watch class_method <class_name>.<method_name> --dump-args --dump-return
android hooking watch class_method com.example.app.LoginManager.authenticateUser --dump-args

# Set return value:
android hooking set return_value <class_name>.<method_name> <value>
android hooking set return_value com.example.app.AuthManager.isAuthenticated true
android hooking set return_value com.example.app.RootDetector.isRooted false

# Generate class methods:
android hooking generate simple <class_name>

# Watch all methods in class:
android hooking watch class <class_name>
android hooking watch class com.example.app.CryptoManager

# Memory information:
memory list modules
memory list exports <module_name>
memory dump all <output_file>

# Heap operations:
android heap search instances <class_name>
android heap evaluate <javascript_code>

# Example: Find all instances of a class
android heap search instances com.example.app.User

// android_security_bypass.js
Java.perform(function() {
    console.log("[+] Android Security Bypass Script Loading...");
    
    // === Root Detection Bypass ===
    bypassRootDetection();
    
    // === SSL Pinning Bypass ===
    bypassSSLPinning();
    
    // === Anti-Debugging Bypass ===
    bypassAntiDebugging();
    
    // === Data Interception ===
    interceptSensitiveData();
    
    console.log("[+] All hooks installed successfully!");
});

function bypassRootDetection() {
    console.log("[*] Installing root detection bypasses...");
    
    // Common root detection methods
    var RootBeer = null;
    try {
        RootBeer = Java.use("com.scottyab.rootbeer.RootBeer");
        RootBeer.isRooted.implementation = function() {
            console.log("[*] RootBeer.isRooted() bypassed");
            return false;
        };
    } catch (e) {}
    
    // Runtime.exec() bypass
    var Runtime = Java.use("java.lang.Runtime");
    Runtime.exec.overload('java.lang.String').implementation = function(command) {
        if (command.includes("su") || command.includes("which su") || command.includes("busybox")) {
            console.log("[*] Blocked Runtime.exec: " + command);
            throw Java.use("java.io.IOException").$new("Command not found");
        }
        return this.exec(command);
    };
    
    Runtime.exec.overload('[Ljava.lang.String;').implementation = function(cmdArray) {
        var command = cmdArray.join(" ");
        if (command.includes("su") || command.includes("busybox")) {
            console.log("[*] Blocked Runtime.exec array: " + command);
            throw Java.use("java.io.IOException").$new("Command not found");
        }
        return this.exec(cmdArray);
    };
    
    // File.exists() bypass for common root files
    var File = Java.use("java.io.File");
    var rootFiles = [
        "/system/app/Superuser.apk",
        "/sbin/su",
        "/system/bin/su",
        "/system/xbin/su",
        "/data/local/xbin/su",
        "/data/local/bin/su",
        "/system/sd/xbin/su",
        "/system/bin/failsafe/su",
        "/data/local/su",
        "/su/bin/su",
        "/system/bin/.ext/.su",
        "/system/usr/we-need-root/su-backup",
        "/system/xbin/daemonsu",
        "/system/etc/init.d/99SuperSUDaemon",
        "/dev/com.koushikdutta.superuser.daemon/",
        "/system/app/Kinguser.apk",
        "/system/bin/ku.sud",
        "/system/xbin/ku.sud",
        "/data/data/com.noshufou.android.su",
        "/data/data/com.kingroot.kinguser",
        "/data/data/com.kingo.root",
        "/data/data/com.smedialink.oneclickroot",
        "/data/data/com.zhiqupk.root.global",
        "/data/data/com.alephzain.framaroot"
    ];
    
    File.exists.implementation = function() {
        var path = this.getAbsolutePath();
        if (rootFiles.includes(path)) {
            console.log("[*] Blocked root file check: " + path);
            return false;
        }
        return this.exists();
    };
    
    // Build.TAGS bypass
    try {
        var Build = Java.use("android.os.Build");
        Build.TAGS.value = "release-keys";
        console.log("[*] Build.TAGS set to release-keys");
    } catch (e) {}
    
    // System property checks
    var SystemProperties = null;
    try {
        SystemProperties = Java.use("android.os.SystemProperties");
        SystemProperties.get.overload('java.lang.String').implementation = function(key) {
            if (key.includes("ro.debuggable") || key.includes("ro.secure")) {
                console.log("[*] SystemProperties.get blocked: " + key);
                return "0";
            }
            if (key.includes("ro.build.tags")) {
                return "release-keys";
            }
            return this.get(key);
        };
    } catch (e) {}
}

function bypassSSLPinning() {
    console.log("[*] Installing SSL pinning bypasses...");
    
    // === TrustManager Bypass ===
    var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
    var SSLContext = Java.use('javax.net.ssl.SSLContext');
    
    // Create custom TrustManager
    var TrustManager = Java.registerClass({
        name: 'org.example.TrustManager',
        implements: [X509TrustManager],
        methods: {
            checkClientTrusted: function(chain, authType) {
                console.log('[*] checkClientTrusted bypassed');
            },
            checkServerTrusted: function(chain, authType) {
                console.log('[*] checkServerTrusted bypassed');
            },
            getAcceptedIssuers: function() {
                return [];
            }
        }
    });
    
    // Hook SSLContext.init()
    SSLContext.init.implementation = function(keyManagers, trustManagers, secureRandom) {
        console.log('[*] SSLContext.init() bypassed');
        var customTrustManagers = [TrustManager.$new()];
        return this.init(keyManagers, customTrustManagers, secureRandom);
    };
    
    // === OkHttp3 Certificate Pinner Bypass ===
    try {
        var CertificatePinner = Java.use('okhttp3.CertificatePinner');
        CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function() {
            console.log('[*] OkHttp3 CertificatePinner.check() bypassed');
        };
        
        var Builder = Java.use('okhttp3.CertificatePinner$Builder');
        Builder.add.overload('java.lang.String', '[Ljava.lang.String;').implementation = function(pattern, pins) {
            console.log('[*] OkHttp3 CertificatePinner.Builder.add() bypassed');
            return this;
        };
    } catch (e) {
        console.log('[!] OkHttp3 not found: ' + e.message);
    }
    
    // === OkHttp2 Bypass ===
    try {
        var CertificatePinner2 = Java.use('com.squareup.okhttp.CertificatePinner');
        CertificatePinner2.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function() {
            console.log('[*] OkHttp2 CertificatePinner.check() bypassed');
        };
    } catch (e) {}
    
    // === Apache HttpClient Bypass ===
    try {
        var DefaultHttpClient = Java.use('org.apache.http.impl.client.DefaultHttpClient');
        DefaultHttpClient.execute.overload('org.apache.http.client.methods.HttpUriRequest').implementation = function(request) {
            console.log('[*] Apache HttpClient request intercepted');
            return this.execute(request);
        };
    } catch (e) {}
    
    // === WebView SSL Error Bypass ===
    try {
        var WebViewClient = Java.use('android.webkit.WebViewClient');
        WebViewClient.onReceivedSslError.implementation = function(view, handler, error) {
            console.log('[*] WebView SSL error bypassed');
            handler.proceed();
        };
    } catch (e) {}
}

function bypassAntiDebugging() {
    console.log("[*] Installing anti-debugging bypasses...");
    
    // Debug flag bypass
    try {
        var ApplicationInfo = Java.use('android.content.pm.ApplicationInfo');
        ApplicationInfo.FLAG_DEBUGGABLE.value = 0;
    } catch (e) {}
    
    // Debug.isDebuggerConnected() bypass
    try {
        var Debug = Java.use('android.os.Debug');
        Debug.isDebuggerConnected.implementation = function() {
            console.log('[*] Debug.isDebuggerConnected() bypassed');
            return false;
        };
    } catch (e) {}
    
    // TracerPid detection bypass
    var File = Java.use('java.io.File');
    var BufferedReader = Java.use('java.io.BufferedReader');
    var FileReader = Java.use('java.io.FileReader');
    
    File.$new.overload('java.lang.String').implementation = function(path) {
        if (path === '/proc/self/status') {
            console.log('[*] Blocked access to /proc/self/status');
            return File.$new('/dev/null');
        }
        return this.$new(path);
    };
}

function interceptSensitiveData() {
    console.log("[*] Installing sensitive data hooks...");
    
    // SharedPreferences interception
    var SharedPreferences = Java.use('android.content.SharedPreferences');
    var Editor = Java.use('android.content.SharedPreferences$Editor');
    
    Editor.putString.implementation = function(key, value) {
        if (key.toLowerCase().includes('password') || 
            key.toLowerCase().includes('token') ||
            key.toLowerCase().includes('secret') ||
            key.toLowerCase().includes('key')) {
            console.log('[*] SharedPreferences - Key: ' + key + ', Value: ' + value);
        }
        return this.putString(key, value);
    };
    
    SharedPreferences.getString.implementation = function(key, defValue) {
        var result = this.getString(key, defValue);
        if (key.toLowerCase().includes('password') || 
            key.toLowerCase().includes('token') ||
            key.toLowerCase().includes('secret')) {
            console.log('[*] SharedPreferences GET - Key: ' + key + ', Value: ' + result);
        }
        return result;
    };
    
    // SQLite operations
    try {
        var SQLiteDatabase = Java.use('android.database.sqlite.SQLiteDatabase');
        
        SQLiteDatabase.execSQL.overload('java.lang.String').implementation = function(sql) {
            console.log('[*] SQLite execSQL: ' + sql);
            return this.execSQL(sql);
        };
        
        SQLiteDatabase.rawQuery.overload('java.lang.String', '[Ljava.lang.String;').implementation = function(sql, selectionArgs) {
            console.log('[*] SQLite rawQuery: ' + sql);
            if (selectionArgs) {
                console.log('[*] Selection Args: ' + selectionArgs.toString());
            }
            return this.rawQuery(sql, selectionArgs);
        };
    } catch (e) {}
    
    // HTTP request/response interception
    interceptNetworkTraffic();
    
    // Clipboard monitoring
    try {
        var ClipboardManager = Java.use('android.content.ClipboardManager');
        ClipboardManager.setPrimaryClip.implementation = function(clip) {
            console.log('[*] Clipboard data set: ' + clip.toString());
            return this.setPrimaryClip(clip);
        };
    } catch (e) {}
    
    // Intent data interception
    var Intent = Java.use('android.content.Intent');
    Intent.putExtra.overload('java.lang.String', 'java.lang.String').implementation = function(key, value) {
        console.log('[*] Intent putExtra - Key: ' + key + ', Value: ' + value);
        return this.putExtra(key, value);
    };
    
    Intent.getStringExtra.implementation = function(key) {
        var result = this.getStringExtra(key);
        console.log('[*] Intent getStringExtra - Key: ' + key + ', Value: ' + result);
        return result;
    };
}

function interceptNetworkTraffic() {
    console.log("[*] Installing network traffic hooks...");
    
    // OkHttp3 Request/Response interception
    try {
        var Request = Java.use('okhttp3.Request');
        var RequestBody = Java.use('okhttp3.RequestBody');
        var Response = Java.use('okhttp3.Response');
        var ResponseBody = Java.use('okhttp3.ResponseBody');
        
        // Intercept requests
        var OkHttpClient = Java.use('okhttp3.OkHttpClient');
        OkHttpClient.newCall.implementation = function(request) {
            console.log('[*] OkHttp3 Request: ' + request.url().toString());
            console.log('[*] Method: ' + request.method());
            
            var headers = request.headers();
            var headerNames = headers.names().toArray();
            for (var i = 0; i < headerNames.length; i++) {
                console.log('[*] Header: ' + headerNames[i] + ' = ' + headers.get(headerNames[i]));
            }
            
            var body = request.body();
            if (body) {
                try {
                    var buffer = Java.use('okio.Buffer').$new();
                    body.writeTo(buffer);
                    console.log('[*] Request Body: ' + buffer.readUtf8());
                } catch (e) {
                    console.log('[*] Could not read request body: ' + e.message);
                }
            }
            
            return this.newCall(request);
        };
        
    } catch (e) {
        console.log('[!] OkHttp3 not available: ' + e.message);
    }
    
    // HttpURLConnection interception
    try {
        var HttpURLConnection = Java.use('java.net.HttpURLConnection');
        var URL = Java.use('java.net.URL');
        
        HttpURLConnection.getInputStream.implementation = function() {
            console.log('[*] HttpURLConnection GET: ' + this.getURL().toString());
            return this.getInputStream();
        };
        
        HttpURLConnection.getOutputStream.implementation = function() {
            console.log('[*] HttpURLConnection POST: ' + this.getURL().toString());
            return this.getOutputStream();
        };
        
    } catch (e) {}
}

// Hook WebView for potential XSS/URL manipulation
try {
    var WebView = Java.use('android.webkit.WebView');
    
    WebView.loadUrl.overload('java.lang.String').implementation = function(url) {
        console.log('[*] WebView loadUrl: ' + url);
        return this.loadUrl(url);
    };
    
    WebView.loadData.overload('java.lang.String', 'java.lang.String', 'java.lang.String').implementation = function(data, mimeType, encoding) {
        console.log('[*] WebView loadData: ' + data.substring(0, 200) + '...');
        return this.loadData(data, mimeType, encoding);
    };
    
    WebView.addJavascriptInterface.implementation = function(obj, name) {
        console.log('[*] WebView addJavascriptInterface: ' + name);
        return this.addJavascriptInterface(obj, name);
    };
    
} catch (e) {}

// Initialize the script
console.log("[+] Android Security Bypass Script Loaded Successfully!");