We're hitting a sporadic access violation when using the Fiddler OM in our test automation. I have not been able to find anything indicating this is an issue with our code, but I'm still digging

Inside our internal event handler, the relevant code is:

    session["https-Client-Certificate"] = "FiddlerCert.cer"; <-- this has me wondering if it's possible for a corrupt or invalid cert to cause the below crash
    session.bBufferResponse = true;
    string requestBody = session.GetRequestBodyAsString(); <-- crash happens here

 

Unhandled Exception: System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.

   at System.Text.UTF8Encoding.GetChars(Byte* bytes, Int32 byteCount, Char* chars, Int32 charCount, DecoderNLS baseDecoder)
   at System.String.CreateStringFromEncoding(Byte* bytes, Int32 byteLength, Encoding encoding)
   at System.Text.UTF8Encoding.GetString(Byte[] bytes, Int32 index, Int32 count)
   at System.Text.Encoding.GetString(Byte[] bytes)
   at Fiddler.Utilities.GetStringFromArrayRemovingBOM(Byte[] arrInput, Encoding oDefaultEncoding)
   at Fiddler.Session.GetRequestBodyAsString()
   at <INTERNAL NAMESPACE REMOVED>.FiddlerApplication_BeforeRequest(Session session)
   at Fiddler.SessionStateHandler.Invoke(Session oSession)
   at Fiddler.FiddlerApplication.DoBeforeRequest(Session oSession)
   at Fiddler.Session._executeObtainRequest()
   at Fiddler.Session.InnerExecute()
   at Fiddler.Session.Execute(Object objThreadState)
   at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   at System.Threading.ThreadPoolWorkQueue.Dispatch()
   at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()

 

Has anyone seen this before, or know of a fix or workaround? I'd like to think that even in the case of a corrupt/bad/missing certificate, an AV wouldn't happen, but without the Fiddler source, there's no great way for me to prove that (yes, I could disassemble, but I haven't yet).

When I drag the target next to "Any Process" onto a Chrome window, to capture traffic only from Chrome, no traffic is captured. But without specifically targeting Chrome the traffic from Chrome shows up in Fiddler. Same problem appears with Edge browser, but with IE it works as expected. I have no active filters or specific rules. Also tested it on multiple PCs and got the same results. Any ideas what's causing this?

I am trying to capture the traffic of any application installed on iOS 13.2.2 device using Fiddler

Exactly followed the instructions on https://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/ConfigureForiOS , 
but I can not decrypt any HTTPS  traffic; I can only see the HTTP calls captured.

Dear concern, 

I need to decode some octet-stream data in fiddler but i m not able to decode or understand that data using fiddler .

the data have Content-Type: application/octet-stream

the data i.e. unreadable is given below :-

 

  ό   . "Ę%!T ^  u   L   Yo  UJ  L  ) % 2w H/F ƍ=]  $ @t { n 2 m `; 
K 7 eb   j   O< b|  +    I   1 %p 9      } J
C q  Yڒb u70  Uҋ  }  k {fh  
;  > b b9|Ux o26 ?  mz ƒ ǴI x    zyr #% & Vj  *+V   ,    on 4E 6  eh7sm U  K  %  B    Z \
A    
m ؕפ  7ʙ} 
A $  e 3R ݴ  D<B  M ^F.f +! .  5q 0m{6 i  # y<  5 n0 DߺR+, ܌3 ~  \ ) ƀ F
 ׂHP | l׊B kd  JGAϢ    u$ \oڪcme  E m"   n  Y Ԇ (}qկ  @ ,F ΞA   6a XиW B   ƨ1I  7 0 
h  N#m
~   3dl&@  N 5
]yCfQ ̕= '  ?jM   Q{w4    !p X  j 3o3y H1    ~R`  ]={^    w  e`
֧ 5Ui  Uqh~Kޔ ? ̥Շ[&ӆ       _'v@&+A  }  I Lz  'c? 'N QS  e/ F o eYb zp ? # < f  7   U 
 
zK  r{   x jVdy[   K
(    E _ĐӉN8  ]$s<
 = 5  { cnȃb;":d(K9 k ɶ} >M\P
t    ۼ<{RW&t3    uDp  "    [  nW   6ˎ<     _  Uc  o  # h q ¶ 0 Rf5o;   g     @h     B     ,  ~   3   r 
 O      J 0 x    G  @ 
  ] c -    哌 z [ 4- ; [  Ȃ '  m x  F   J y      E;ʯ(t XR*63    h! e gۃp |H       _ hC aV * _u    S LM-
&  C>: 3  V   
  Hs     &ڍ  BX     v !1衠 " ٷ  ٌ `  xY |6o  .         ^ v 0 ֦ z^  | 
    2  3 j  r I J?  g]    %  ijX     @S    G   o  x|  -   v 3   :M U     C(2  "   t ' A Z   c+)HX Aԕ J1!  #@Tt* /| y!/}   {^   A  T  S  E? {   $zc     0ș  ~    Ƕ    <VO+  g##
 5  >M &
   @  >c   {Ui ߎ 8;  b    ':~ %    xMಠ)^2)  9`W  ]  ڿˎu   S  ]P`q EE  ժͯЧ|   g  ʈ` ެ   ٩ a   V hH &  . ;    vsJ=c  mR[S?   s QB  +      `w U+^ o6  I В #?w Ǘ I  :   1^6&    ıI@g . %   &b ρ  N   uOЛe A T H  遮| n 
      K    ?     }P n  2 | x " C  H  W ^   ^=)   y ( q ħ:  3~ٷӨ 6 T  ݒA]Q      -t|m?dݲnI     H RfG6Z  D  l>   d 4  O      5 2   ] į     !$&0 ) t<bإFH L &  /ޜ];=q | 

It's Fiddler.CONFIG.SetNoDecryptstring(string)

There's not much documentation on this feature but I assume it's supposed to let specific HTTPS traffic through without attempting to open it up. If that is in fact what is does then it's exactly what I need. However, it doesn't actually seem to be working as intended. I booted up the .NET4 sample project and made no modifications other than adding one domain to the "SetNoDecryptList" but when I go to the domain I still get a "questionable certificate" type error.

 Any thoughts?

Hello. I have a Honor 8 Pro (DUK-L09) running android 9 (9.1.0.212) with EMUI 9.1. I would like to know if DC Unlocker can find the bootloader code for my device. If possible, could you please provide me the price for the process? Thanks.



Hello. I've been messing around with fiddler for a while now and recently, I tried to monitor and isolate certain app's web traffic to track down the analytics api used. But unfortunately, not everything works. Most of the connections are ssl tunnels with 443 terminations. I did some searching and from what I found, I have tried the following.



1. Check if filters are turned on. Status:OFF

2. Installed Fiddler root certificates to both the phone and the PC.

3. Check if specific process is selected for monitoring. Status:OFF

4. Check if the device is connecting to the right port. Obviously.



Also, my device is running android v.9. I understand that android doesn't accept user installed certificates anymore when it comes to system wide access. So, I recompiled the app after modifying the manifest file and adding a Network security configuration file inside the res/xml folder. Still, no luck. But I should point out that I was able to capture everything once before without any problem. Also, my issue doesn't revolve around https decryption as it works well for twitter in web view. To better describe the issue, I have attached a couple of screenshots. Any assistance is appreciated. Thanks

When Fiddler does not start, window will automatically open the manual proxy service every other period of time

Hi,

Quick question regarding the ability to programmatically obtain the ui-comment set against a session item in C#.

Currently I can set a value:

oSession.oFlags["ui-comments"] = "Comment Added"; 

This is displayed in Fiddler comments column against the request.

But when I attempt to get the value back out, in AutoTamperRequestBefore or AutoTamperResponseBefore there isn't a 'ui-comments' flag available.

Any suggestions gratefully received. 

Many thanks, and keep up the good work.

 

How to fix "The certificate of the peer does not match the expected hostname"?

Ive installed Fiddler on my PC but whenever i enable capturing of web traffic i always am unable to load web pages.

This error appears...

This site can’t be reached
The webpage at https://www.google.com/ might be temporarily down or it may have moved permanently to a new web address.
ERR_TUNNEL_CONNECTION_FAILED

Im using Chrome browser is this important...

Why is this happening and how can i fix it?