How to capture app traffic using LDPlayer and HTTP Toolkit

Disclaimer

  • This tutorial is using LDPlayer 9, which uses Android 9.0, known for being harder to sniff out data from since it's enforcing SSL pinning. Older versions of Android (7.0) do not have this limitation but newer apps might not work with it.
  • I'm unsure whether this works on other emulators (Memu, Nox, Bluestacks, Genymotion).
  • This tutorial uses the "root" option of the LDPlayer emulator, which could in theory make your app not open due to security reasons. Tough luck, sorry. Check if you can get a rooted phone with Magisk.
  • This guide uses HTTP Toolkit over other alternatives (Charles, Fiddler, mitmproxy, BURP) since the program will try to do the SSL unpin for you, without having to set up proxies.
  • Commands needed in terminal will be in this format or
    this format.
    

Please paste the command as it is, only copying what's following the format.

  • This guide makes use of the Windows Command Prompt, easily accessible searching for cmd in your start menu or running Windows + R and then writing cmd. Best to use the newest "Windows Terminal" from the Microsoft Store since it's cleaner and you can also run Powershell from the same app.
  • This guide is intended to be used as a base / knowledge starting point on capturing app traffic, so it won't mention any specific app capturing method.

Requirements

Setting up

Step 0: Checking and installing ADB.

  • Open Command Prompt and run adb \--version
  1. If you get "Android Debug Bridge version 1.0.41", you can skip ahead to Step 1.
  2. If you get "adb: command not found" (bash) or "'adb is not recognized as an internal...' (cmd), this means you don't have adb, skip to "Installing ADB".
  3. If you get an older version than 1.0.41, you should update it to the latest version. We will uninstall it and then install the newest version.

Uninstalling an older version of ADB

  1. Open Command prompt and run where adb
  2. Make a copy of the path the terminal will give you.
  3. Open an Explorer window, go to said path and delete the folder containing "adb.exe"
  4. Close and re-open the Command Prompt, and run adb \--version and then where adb

    • adb \--version should return either "command not found" or "adb is not recognized as an internal..."
    • where adb should return "INFO: Could not find files for the given pattern(s)."

Installing ADB

This can be done in various ways, directly downloading it from Android Studio and adding it to your PATH manually, using a package manager (Choco, winget) or using a script / program. We will be using an open source script called "nexus-tools" to make it easier, but you're absolutely free to use any other method as long as you end up with the same product (ADB in your PATH). Please avoid using the 15 second adb and fastboot installer you'll find on XDA and Youtube, since it's super old and outdated.

  1. Open a "Windows Powershell" (not Windows Powershell ISE, not Windows Powershell x86) window by going to your start menu and searching for "Powershell".
  2. Copy and paste the following command and run it by pressing the enter key (If you're unsure of running a random command, you'll find it on https://github.com/corbindavenport/nexus-tools#how-to-use-on-windows)
    iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/corbindavenport/nexus-tools/master/install.ps1'))
    
  3. It should start running and automatically install ADB in your PATH (it installs it on C:/Users/username/NexusTools).
  4. Once it's done, it'll ask you if you want to install drivers from adb.clockworkmod.com, confirm it by pressing "Y" and pressing the enter key.
  5. Follow the driver installation by just pressing "Next" until it's done installing, then click on the "Close" button once it's finished. Your terminal window should look like this.
  6. Close your Powershell window (and your Command Prompt window in case you have one in the background) and re-open Command Prompt
  7. Run adb \--version, expected result is "Android Debug Bridge version 1.0.41"

Step 1: Installing and setting up LDPlayer

Downloading and Installing LDPlayer

Although you can just open LDPlayer's homepage and click on "Download", I'd recommend to downloading the offline installer, this way you should be able to make the downloading faster with a download manager (IDM, DownThemAll!, Flashget etc.)

  1. Navigate to https://www.ldplayer.net/versions and click on the yellow button that says "LDPlayer 9"
  2. You should start downloading "LDPlayer9.0_ens_1252_ld.exe", file size near 600MB.
  3. Wait until downloaded, then install as you'd install any other emulator, following the installer instructions.

Setting up LDPlayer (Root + ADB)

  1. Open LDPlayer, let it load and click on the "Settings" shortcut (gear icon)

  1. You're free to change whatever you want on the "Advanced", "Model", "Game Settings", "Audio", "Shortcuts" and "Wallpaper" tabs, since different apps might need different settings to work. Please don't touch the "Network" tab. I use "Mobile mode" and "720x1280 (dpi 320)" as my preferred setup.
  2. Click on the "Other Settings" tab and make sure to enable "Root permission" and change "ADB debugging" to "Open Local Connection"
  3. Click on "Save Settings", LDPlayer will ask you if you want to restart, click on the "Restart now" button".

  1. Make sure it restarted and the emulator is running, then open a Command Prompt window and run adb devices. Result should show a list of devices, with "emulator-5554" in the list and next to it, the word "device". If it shows "offline" instead of "device" make sure to do any action in the emulator (opening an app, switching pages) and re-run the command.

Step 2: Installing HTTP Toolkit

  1. Navigate to https://httptoolkit.tech/ and click on "Download free now for Windows"
  2. Click on the .exe and it should automatically start installing
  3. Once it's done installing it'll open on its own.

Step 3: HTTP Tookit + ADB = Profit

  1. Open HTTP Toolkit and scroll down to the "Android device via ADB" option

    • If this option is absent then your computer is not detecting your emulator as a device, go back to Setting up LDPlayer and make sure "adb devices" is showing emulator-5554 as a device, then close and re-open HTTP Toolkit
  2. Click on it, then the HTTP Toolkit app should open in your emulator, requesting you to connect to the VPN, click on "OK".
  3. If the connection is successful, you'll get a "Connected" window.
  4. Go back to your emulator home, and open any app you want to capture, as soon as you open it you should start seeing the traffic on HTTP Toolkit. Click on any request to check info on the right-side menu.

    • If you don't see any traffic, or your app won't open / closes / says you don't have any internet connection, then the SSL unpin method HTTP Toolkit tried did not work. Sorry! Try with a real rooted device or an emulator with Android 7.0

Questions?

Feel free to reach me out on the Discord server this was posted in. My DM's are open for questions! I don't want to join your scan group nor pitch in with buying an account though, so please don't ask me about that.

Edit Report
Pub: 12 Apr 2023 21:10 UTC
Edit: 18 Apr 2023 20:59 UTC
Views: 1560