I have been attempting to intercept when an app performs a DNS lookup using Frida. I assumed that ultimately a DNS lookup will end up in a libc call to gethostbyname or getaddrinfo but this does not seem to be the case. For example this Frida trace command does not hit either function

frida-trace -U -i "gethostbyname" -i "getaddrinfo" "com.android.my_app"

According the answer to this question, the netd daemon might be responsible for DNS resolution on android

"DNS lookups are centralized in the netd daemon to allow for system-wide caching, while apps call functions (such as getaddrinfo) in Bionic. The query is sent over a UNIX socket to /dev/socket/dnsproxyd to the netd daemon, which parses the request and calls getaddrinfo again to issue DNS lookups, then caches the results so that other apps can use them."

However hooking this daemon doesn't result in any hits either:

frida-trace -U -i "gethostbyname" -i "getaddrinfo" "netd"

I am new to Frida so I am not sure if I am missing something here. I would appreciate some insight into how I can hook the DNS lookup call

  • The functions are being hooked properly as far as I can tell and handlers are being created. I will explore a few other options and try to update this question Jul 21 at 18:06
  • Is the app base on standard DEX code (e.g. compiled from Java or Kotlin) or does it use a different framework like Xamarin, ReactNative, Dart? Some of those language may implement DNS resolving on their own so that it works on all platforms. I do remember that Firefox for Android e.g. does implement DNS resolving on it's own.
    – Robert
    Jul 21 at 20:42
  • @Robert this is just a standard Kotlin app. I believe I found the function performing the lookup. Its android_getaddrinfofornet which is present in the libc that my Android app is using Jul 21 at 21:02


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.