android network security config bypass with frida

launch-frida-for-android.sh

curl -O https://build.frida.re/frida/android/arm/bin/frida-server

adb push frida-server /data/local/tmp/

adb shell "chmod 755 /data/local/tmp/frida-server"

adb shell "/data/local/tmp/frida-server &" 

network-security-config-bypass.js

// frida -U -l network-security-config-bypass.js --no-pause -f tv.danmaku.bili 
Java.perform(function(){
    NetworkSecurityConfig_Builder =Java.use("android.security.net.config.NetworkSecurityConfig$Builder")
    CertificatesEntryRef = Java.use("android.security.net.config.CertificatesEntryRef")
    CertificateSource = Java.use("android.security.net.config.CertificateSource")
    UserCertificateSource = Java.use("android.security.net.config.UserCertificateSource")

    NetworkSecurityConfig_Builder.getEffectiveCertificatesEntryRefs.implementation = function(){
        origin = this.getEffectiveCertificatesEntryRefs()
        
        source = UserCertificateSource.getInstance()
        userCert = CertificatesEntryRef.$new(source,true)
        origin.add(userCert)

	return origin
    }
})