CRACKING META’S MESSENGER CERTIFICATE PINNING ON MACOS

Summary from the TLDR Web Dev newsletter

Meta's Messenger app for macOS uses certificate pinning to prevent users from easily analyzing network requests sent to Meta's servers. Using the Hopper disassembler, this author identifies a key function (IsUsingSandbox()) that controls certificate pinning behavior. By modifying a few bytes within the Messenger binary to force this function to return "true", the author is able to effectively disable certificate pinning and successfully intercept network traffic for analysis.