# Frida Tutorial

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).

**Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**! {% embed url="https://go.intigriti.com/hacktricks" %} ## Installation Install **frida tools**: ```bash pip install frida-tools pip install frida ``` **Download and install** in the android the **frida server** ([Download the latest release](https://github.com/frida/frida/releases)).\ One-liner to restart adb in root mode, connect to it, upload frida-server, give exec permissions and run it in backgroud: {% code overflow="wrap" %} ```bash adb root; adb connect localhost:6000; sleep 1; adb push frida-server /data/local/tmp/; adb shell "chmod 755 /data/local/tmp/frida-server"; adb shell "/data/local/tmp/frida-server &" ``` {% endcode %} **Check** if it is **working**: ```bash frida-ps -U #List packages and processes frida-ps -U | grep -i #Get all the package name ``` ## Tutorials ### [Tutorial 1](frida-tutorial-1.md) **From**: [https://medium.com/infosec-adventures/introduction-to-frida-5a3f51595ca1](https://medium.com/infosec-adventures/introduction-to-frida-5a3f51595ca1)\ **APK**: [https://github.com/t0thkr1s/frida-demo/releases](https://github.com/t0thkr1s/frida-demo/releases)\ **Source Code**: [https://github.com/t0thkr1s/frida-demo](https://github.com/t0thkr1s/frida-demo) Follow the [link to read it](frida-tutorial-1.md). ### [Tutorial 2](frida-tutorial-2.md) **From**: [https://11x256.github.io/Frida-hooking-android-part-2/](https://11x256.github.io/Frida-hooking-android-part-2/) (Parts 2, 3 & 4)\ **APKs and Source code**: [https://github.com/11x256/frida-android-examples](https://github.com/11x256/frida-android-examples) Follow the[ link to read it.](frida-tutorial-2.md) ### [Tutorial 3](owaspuncrackable-1.md) **From**: [https://joshspicer.com/android-frida-1](https://joshspicer.com/android-frida-1)\ **APK**: [https://github.com/OWASP/owasp-mstg/blob/master/Crackmes/Android/Level\_01/UnCrackable-Level1.apk](https://github.com/OWASP/owasp-mstg/blob/master/Crackmes/Android/Level\_01/UnCrackable-Level1.apk) Follow the [link to read it](owaspuncrackable-1.md).\ **You can find some Awesome Frida scripts here:** [**https://codeshare.frida.re/**](https://codeshare.frida.re) ## Fast Examples Here you can find the more basic and interesting functionalities of Frida to make a quick script: ### Calling Frida from command line ```bash frida-ps -U #Basic frida hooking frida -l disableRoot.js -f owasp.mstg.uncrackable1 #Hooking before starting the app frida -U --no-pause -l disableRoot.js -f owasp.mstg.uncrackable1 #The --no-pause and -f options allow the app to be spawned automatically, #frozen so that the instrumentation can occur, and the automatically #continue execution with our modified code. ``` ### Basic Python Script ```python import frida, sys jscode = open(sys.argv[0]).read() process = frida.get_usb_device().attach('infosecadventures.fridademo') script = process.create_script(jscode) print('[ * ] Running Frida Demo application') script.load() sys.stdin.read() ``` ### Hooking functions without parameters Hook the function `a()` of the class `sg.vantagepoint.a.c` ```javascript Java.perform(function () { ; rootcheck1.a.overload().implementation = function() { rootcheck1.a.overload().implementation = function() { send("sg.vantagepoint.a.c.a()Z Root check 1 HIT! su.exists()"); return false; }; }); ``` Hook java `exit()` ```javascript var sysexit = Java.use("java.lang.System"); sysexit.exit.overload("int").implementation = function(var_0) { send("java.lang.System.exit(I)V // We avoid exiting the application :)"); }; ``` Hook MainActivity `.onStart()` & `.onCreate()` ```javascript var mainactivity = Java.use("sg.vantagepoint.uncrackable1.MainActivity"); mainactivity.onStart.overload().implementation = function() { send("MainActivity.onStart() HIT!!!"); var ret = this.onStart.overload().call(this); }; mainactivity.onCreate.overload("android.os.Bundle").implementation = function(var_0) { send("MainActivity.onCreate() HIT!!!"); var ret = this.onCreate.overload("android.os.Bundle").call(this,var_0); }; ``` Hook android `.onCreate()` ```javascript var activity = Java.use("android.app.Activity"); activity.onCreate.overload("android.os.Bundle").implementation = function(var_0) { send("Activity HIT!!!"); var ret = this.onCreate.overload("android.os.Bundle").call(this,var_0); }; ``` ### Hooking functions with parameters and retrieving the value Hooking a decryption function. Print the input, call the original function decrypt the input and finally, print the plain data: ```javascript function getString(data){ var ret = ""; for (var i=0; i < data.length; i++){ ret += data[i].toString(); } return ret } var aes_decrypt = Java.use("sg.vantagepoint.a.a"); aes_decrypt.a.overload("[B","[B").implementation = function(var_0,var_1) { send("sg.vantagepoint.a.a.a([B[B)[B doFinal(enc) // AES/ECB/PKCS7Padding"); send("Key : " + getString(var_0)); send("Encrypted : " + getString(var_1)); var ret = this.a.overload("[B","[B").call(this,var_0,var_1); send("Decrypted : " + ret); var flag = ""; for (var i=0; i < ret.length; i++){ flag += String.fromCharCode(ret[i]); } send("Decrypted flag: " + flag); return ret; //[B }; ``` ### Hooking functions and calling them with our input Hook a function that receives a string and call it with other string (from [here](https://11x256.github.io/Frida-hooking-android-part-2/)) ```javascript var string_class = Java.use("java.lang.String"); // get a JS wrapper for java's String class my_class.fun.overload("java.lang.String").implementation = function(x){ //hooking the new function var my_string = string_class.$new("My TeSt String#####"); //creating a new String by using `new` operator console.log("Original arg: " +x ); var ret = this.fun(my_string); // calling the original function with the new String, and putting its return value in ret variable console.log("Return value: "+ret); return ret; }; ``` ### Getting an already created object of a class If you want to extract some attribute of a created object you can use this. In this example you are going to see how to get the object of the class my\_activity and how to call the function .secret() that will print a private attribute of the object: ```javascript Java.choose("com.example.a11x256.frida_test.my_activity" , { onMatch : function(instance){ //This function will be called for every instance found by frida console.log("Found instance: "+instance); console.log("Result of secret func: " + instance.secret()); }, onComplete:function(){} }); ```

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥