1

I have a re-occuring issue with Frida (I'm using Frida and Frida-Server for Android x86_64 ver.: 10.6.11), where I try to hook a function and override its functionality, but for some reason I get stuck and the JS code (or Frida, who knows at this point?) just doesn't seem to catch the function that I really need.

My latest attempt was on the following Android sample (#Bankbot): https://koodous.com/apks/6276f23997fff26938b08323322c8ae77b9070ac81851f757c16928f86092f20

Now, this piece of Malware has emulator detection built into it. The following code static methods are responsible for detecting the Android Emulator (which I'm using with Frida):

    // keitev.ebaziueggzxt.q
    public class q {
    // ....
        // detects emulator
        public static boolean c(Context context) {
        // 
            if (android.os.Debug.isDebuggerConnected()) 
            {
                return true;
            }
            // check hardware related properties of the execution environment
            if (b(context)) 
            {
                return true;
            }
            // create array of used language shorts
            // Region ISOs
            String[] split = "ru|rus|kz|ua|by|az|am|kg|md|tj|tm|uz|us|ca|cs|sk".split("\\|"); // 
            // 
            String[] split2 = "ru|uk|be|az|hy|ky|mo|ro|tg|tk|uz|cs|sk".split("\\|"); // 
            TelephonyManager telephonyManager = (TelephonyManager) context.getSystemService("phone");
            // get getNetworkCountryIso()
            if (Arrays.asList(split).contains(j.a(telephonyManager).toLowerCase())) {
                return true;
            }// getSimCountryIso()
            if (Arrays.asList(split).contains(j.b(telephonyManager).toLowerCase())) {
                return true;
            }
            Object obj;
            String language = Locale.getDefault().getLanguage();
            try {
                obj = (String) String.class.getDeclaredMethod("toLowerCase", new Class[0]).invoke(language, new Object[0]);
            } catch (Exception e) {
                String str = language;
            }
            return Arrays.asList(split2).contains(obj);
        }
   // ...
 }

What I tried to do using frida was to find an instance of keitev.ebaziueggzxt.q:

// DisableEmulatorDetection.js
    Java.perform(function()
            {
                Java.choose('keitev.ebaziueggzxt.q',
                {
                    onMatch:function(keitev_ebaziueggzxt_qInstance)
                    {
                        console.log("[*] Found an instance of keitev.ebaziueggzxt.q" + keitev_ebaziueggzxt_qInstance);
                        var keitev_ebaziueggzxt_qClass = Java.use("keitev.ebaziueggzxt.q");
                        if(typeof keitev_ebaziueggzxt_qClass !== "undefined") 
                        {
                            console.log("keitev_ebaziueggzxt_qClass has been loaded!");
                        }

                        keitev_ebaziueggzxt_qClass.c.implementation = function(arg_ctx)
                        {
                            console.log("keitev_ebaziueggzxt_qClass.c called!");
                            return true;
                        }
                    },
                    onComplete:function()
                    {
                        //console.log("Done looking for keitev.ebaziueggzxt.q!");
                    }
                });
            });

I tried to use keitev_ebaziueggzxt_qClass.c.overload('android.content.Context').implementation as well. Frida accepted it, but it didn't do anything. As far as I know static methods don't need to be called from an instantiated object, yet Frida doesn't apply the changes, or if it does, it has no effect on the executing Application.

I tried to execute the code using the following approaches:

Python code:

# bot_instrument.py
import frida
import time

device = frida.get_usb_device()
pid = device.spawn(["keitev.ebaziueggzxt"])
device.resume(pid)
time.sleep(1)
session = device.attach(pid)
script = session.create_script(open('DisableEmulatorDetection.js').read())
script.load()

# stop the script from exiting
input()

and by loading the script when the malware is being spawned:

frida -U -l DisableEmulatorDetection.js keitev.ebaziueggzxt

Could anyone explain to me why I can't hook the keitev_ebaziueggzxt_qClass.c static helper function and provide a solution? I'm assuming there are probably two problems with my approach:

  1. The injected code doens't execute when I think it should.
  2. I'm probably hooking the function wrongly.

I am very eager to hear answers from anyone who uses Frida on Android.

  • @Igor Sochinsky: No, not yet. I thought this was some kind of a 'user error' on my side. I'll put it up and see what they say. – Disane Oct 12 '17 at 15:18
  • I have had similar problems with function hooking in the recent versions of frida. Perhaps you can try an older version and check if the issue persists. – 0xec Oct 15 '17 at 3:52
  • @0xec : I tried ver. 9.1.7 and ver. 8.0.0, but ran into the same issues. Other than that the server side of those versions reported errors when starting them on the AVD, but the code yielded the same results as ver. 10.6.11 – Disane Oct 17 '17 at 10:02
  • It seems that using Frida-Server above Android OS ver. 4.4 is kinda pointless unless you only want to inject methods that will get called more often than once or twice right at the start of the execution of the target App. frida -U -l <path_script> -f <package_name> doesn't work on AVDs running Android 5.0 and above. Also ver. 4.4 on x86 ABI also crashes the target App when injecting into the app_process. The above code works perfectly on an AVD running Android 4.4 ARM! Thought it's slow as hell, but at least I've figured out that the error was not on my side. – Disane Nov 14 '17 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.