Văn Anh demon071

Tested on Workplace for Android version 362.0.0.29.109. This approach might work in other Facebook/Meta applications. Thank you Imre Rad for helping me analyze the binary.

How does it work?

The Workplace Android app uses the Fizz open source TLS-1.3 library to communicate with the backend APIs. This library is written in C++, and is compiled to native code. It is running as a native library attached to the Android app.

The certificate verification is implemented in fizz/client/ClientProtocol.cpp, on line 1944. The easiest way to bypass this check is to patch the if (state.verifier()) { check on line 1942.

	const fs = require('fs');
	const axios = require('axios');
	const FormData = require('form-data');

	// Function to read the image file as a buffer
	const readImageFile = (filePath) => {
	return new Promise((resolve, reject) => {
	fs.readFile(filePath, (err, data) => {
	if (err) {
	reject(err);