Hot answers tagged

6 votes

Frida command not available after installing Frida PIP Python package

Frida was split into two PIP packages. The package frida only contains the python bindings, while frida-tools also contains the familiar command line tools from earlier releases. This is explained ...
mschwaig's user avatar
  • 191
5 votes

Hooking function with frida

Try using Memory.patchCode to achieve this. Here's a short example. int test() { return 1024; } int main(int argc, char **argv) { printf("%d\n", test()); return 0; } When compiled ...
sudhackar's user avatar
  • 2,629
5 votes
Accepted

Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)

There are multiple possibilities how this might happen. The code is loaded dynamically at run-time, e.g. for an [obfuscated/encrypted] dex file that is present in the APK file but does not follow the ...
Robert's user avatar
  • 917
4 votes

android unity intercept w/ Frida

Heh, it's some kind of necroposting, but why not? Well, under hood unity3d use 2 variants: mono, that loads C# dlls and il2cpp, that convert it to C++ before build. For 2nd case u can use ...
Demogor's user avatar
  • 41
3 votes
Accepted

Unable to attach into mysterious PID

It's not a malware. It's cygwin's ssh-agent and it uses non existent PID as parent. I was able figure this out using a new version of ProcessHacker.
jeffbRTC's user avatar
  • 161
3 votes

Replacing a function in a 1995 Windows 32-bit binary using Frida causes crash

Your hook probably clobbers some register which is used by the caller. Watcom fastcall is a bit special and different from stdcall. Maybe try saving and restoring all registers which are not used for ...
Igor Skochinsky's user avatar
  • 36.4k
3 votes
Accepted

Frida not hook functions

Your problem is that the name of the function you want to hook is not xxtea_decrypt and because of this you can not hook it: In your IDA scren shot the function is shown as xxtea_decrypt(uchar *,uint,...
Robert's user avatar
  • 917
2 votes

What functions (in which modules) can be hooked by Frida to access unencrypted data of SSL connections in Java programs running under Windows?

That requires some research on your end. Find out what API functions (not Java level) are used on a system level to deal with SSL. I could imagine that the Java runtime on Windows uses the Internet ...
Johann Aydinbas's user avatar
2 votes
Accepted

Killing thread/process from Frida trace

One (rather ugly) solution to this is simply to crash the program by setting the thread's context's instruction pointer to unmapped memory or kernel memory. You can accomplish that with Frida's ...
user464014's user avatar
2 votes

hooking libhoudini on x86 emulator

Yes, it's true. So far, Frida 12.11.14 does not support it. You can check https://www.slideshare.net/cisoplatform7/one-step-ahead-of-cheaters-instrumenting-android-emulators not sure if it's working......
user3347749's user avatar
2 votes
Accepted

Load a *.dylib or *.so object into the Javascript V8 runtime?

I was misinterpreting the context of the comment in the original link, it seems. I was under the impression that Module.load was a v8-ism, while it in fact appears to be a Frida-API. https://frida.re/...
sherrellbc's user avatar
2 votes

Frida reading files is slow

The reason why your code is slow is not Frida but your code. Your code would be also slow when executed in plain J2SE Java. The simple reason is because you are reading the file byte by byte using an ...
Robert's user avatar
  • 917
2 votes
Accepted

Create instance of iOS class that contains a . with frida

ObjC.classes.TestClass is just a shorthand in JavaScript for ObjC.classes['TestClass']. Therefore you should be able to access an Test.Class instance this way: var instance = ObjC.chooseSync(ObjC....
Robert's user avatar
  • 917
2 votes
Accepted

Frida hook X509Certificate

If you use an TLS interception proxy and have a rooted phone it may be easier to add the used root CA certificate as system certificate (like described in mitmproxy doc. Afterwards the certificate ...
Robert's user avatar
  • 917
1 vote
Accepted

Frida Android how to change value of array passed to method

Frida seems to have some bugs regarding Java arrays that are modified or replaced by JavaScript code. My guess is that the conversion (and mapping of modifications) between the Java array instance and ...
Robert's user avatar
  • 917
1 vote

Frida reading files is slow

Unfortunately using buffer still didn't help me. I guess doing JS -> Java -> JS -> Java takes a bit long. I have found this solution: var Files = Java.use("java.nio.file.Files"); ...
Cagri's user avatar
  • 176
1 vote
Accepted

frida hook `loc_*` or `sub_*`

Update: First, you need the base address of the module where your loc_... or sub_... is. To get it, do: var adr = Process.findModuleByName("YOURMODULENAME")["base"]; Then, get the ...
hmngwn's user avatar
  • 61
1 vote
Accepted

Frida script returning different instruction at address compared to entering commands in repl

This was down to my misunderstanding. I was wanting to either nop out an instruction or modify a register value. I had been trying to print the instruction to verify I was at the correct address but ...
Jon's user avatar
  • 167
1 vote

Bypassing certificate transparency with Frida

It can be patched by hooking the right function of your app which checks these peers with Frida. You then always return true and you will have disabled certificate transparency
Sven Onderbeke's user avatar
1 vote
Accepted

Debug shared library in Android application

What you see is possible if the APK files uses the mode extractNativeLibs="false". If that attribute is set in the <application tag in AndroidManifest.xml then Android loads the .so files ...
Robert's user avatar
  • 917
1 vote
Accepted

Log input data and resulting hash for CC_MD5 calls in an iOS app with Frida

The main problem of your code is that you expect the md parameter to be a string. In C the unsigned char * is not an indicator for a string. Instead it is often for storing binary data. In this case ...
Robert's user avatar
  • 917
1 vote
Accepted

Read and write to register with Frida

The issue was that w9 is a 32-bit register and I was using a 64 bit device. By calling this.context.x9 for the 64 bit register the Frida script worked perfectly. Many thanks to @whoopdedoo, their ...
Jon's user avatar
  • 167
1 vote

Decode lua scripts for cocos2d based game / frida, android

i have done something similar with another game before where i use frida to hook the function luaL_loadbuffer and dump the decrypted lua files from there. i wrote about it here https://github.com/...
Chris Li's user avatar
  • 111
1 vote

Decode lua scripts for cocos2d based game / frida, android

use ida pro or ghidra to find the decryption function. if you attach to the process on a real phone you can hook the xxtea function and the 16 bytes at the 3rd argument pointer will be the key.
guest's user avatar
  • 11
1 vote

Calling a method of a Java object passed as argument to hooked function in Frida

It's very likely you need to access the .value of the object. Alternatively you could also "stringfy" this which is an easy was to understand all the properties of the Object. Also, you do ...
diff's user avatar
  • 358
1 vote

Is frida-server latest version compatible with old Android versions

Very well functional, in my projects, when using for Android version 4.0
Happy's user avatar
  • 356
1 vote

Is frida-server latest version compatible with old Android versions

I'm currently using the newest Frida to tinker around with a Galaxy S4 running Android 5.1 - works just fine for me!
The1nk's user avatar
  • 111
1 vote
Accepted

Dump value of register using frida

The Details are all available in the Javascript API documentation for Interceptor below is a small demo assuming you have a source code as below the adder function will be called from 3 places for ...
blabb's user avatar
  • 16.3k
1 vote

How to inject JavaScript into a browser with Frida?

There are plenty examples of using Frida on Windows: Windows example Huge collection of Awesome Frida links - link Windows example 2 in Chinese so use Google Translate. To your question, the general ...
PhoeniX's user avatar
  • 3,002
1 vote

How to inject JavaScript into a browser with Frida?

You understand the situation incorrect. windows.getAll() is JavaScript which the client, in this case, Firefox browser, is evaluating. Using Frida is injecting JavaScript code into Firefox. $ cat ...
whoopdedoo's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible