6
Frida was split into two PIP packages.
The package frida only contains the python bindings, while frida-tools also contains the familiar command line tools from earlier releases.
This is explained in the news post for the 12.0 release:
CLI tools
One thing that caused a bit of confusion in the past was the fact that
our Python bindings also came ...
4
Try using Memory.patchCode to achieve this. Here's a short example.
int test() { return 1024; }
int main(int argc, char **argv) {
printf("%d\n", test());
return 0;
}
When compiled this looks like
[0x00400560]> s sym.test
[0x00400656]> pdf
┌ (fcn) sym.test 11
│ sym.test ();
│ ; CALL XREF from main @ 0x400670
│ ...
3
Heh, it's some kind of necroposting, but why not?
Well, under hood unity3d use 2 variants: mono, that loads C# dlls and il2cpp, that convert it to C++ before build.
For 2nd case u can use unity_metadata_loader or similar products, that takes C# metadata (description of classes mostly) with it's address offsets.
Basically you could need to wait for ...
3
It's not a malware. It's cygwin's ssh-agent and it uses non existent PID as parent. I was able figure this out using a new version of ProcessHacker.
2
One (rather ugly) solution to this is simply to crash the program by setting the thread's context's instruction pointer to unmapped memory or kernel memory. You can accomplish that with Frida's interceptor by using this.context:
onLeave: function (result) {
this.context.pc = 0
}
2
Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)
There are multiple possibilities how this might happen.
The code is loaded dynamically at run-time, e.g. for an [obfuscated/encrypted] dex file that is present in the APK file but does not follow the standard naming scheme /classes*.dex. In case the whole application code is located in such external code files most likely an "APK packer" tool (like DxShield,...
2
Yes, it's true. So far, Frida 12.11.14 does not support it.
You can check https://www.slideshare.net/cisoplatform7/one-step-ahead-of-cheaters-instrumenting-android-emulators
not sure if it's working...
2
I was misinterpreting the context of the comment in the original link, it seems. I was under the impression that Module.load was a v8-ism, while it in fact appears to be a Frida-API.
https://frida.re/docs/javascript-api/#module
2
The reason why your code is slow is not Frida but your code. Your code would be also slow when executed in plain J2SE Java.
The simple reason is because you are reading the file byte by byte using an unbuffered FileInputStream which is the worst way you can read a file. Typically IO operations work on blocks of at least 4096 bytes (a typical block site in a ...
1
The main problem of your code is that you expect the md parameter to be a string. In C the unsigned char * is not an indicator for a string. Instead it is often for storing binary data.
In this case md is also just a pointer where the MD5 functions stores it's 16 byte of binary data.
If you want to print the content you have to encode it e.g. hexadecimal or ...
1
use ida pro or ghidra to find the decryption function.
if you attach to the process on a real phone you can hook the xxtea function and the 16 bytes at the 3rd argument pointer will be the key.
1
It's very likely you need to access the .value of the object. Alternatively you could also "stringfy" this which is an easy was to understand all the properties of the Object. Also, you do not need to perform an overload inside of your overload, just call the method directly using this.decryptAesCipherText()
You can do all of the above with the fix ...
1
Very well functional, in my projects, when using for Android version 4.0
1
I'm currently using the newest Frida to tinker around with a Galaxy S4 running Android 5.1 - works just fine for me!
1
The Details are all available in the Javascript API documentation for Interceptor
below is a small demo
assuming you have a source code as below the adder function will be called from 3 places
for a total of 26 times
#include <stdio.h>
int adder( int a , int b) {
return a+b;
}
int addonce (int a, int b) {
return adder(a,b);
}
int addtwice (...
1
There are plenty examples of using Frida on Windows:
Windows example
Huge collection of Awesome Frida links - link
Windows example 2 in Chinese so use Google Translate.
To your question, the general idea behind Frida is the same regardless of the platform where you have to make yourself familiar with Frida API and write scripts to analyzed hooked functions ...
1
You understand the situation incorrect.
windows.getAll() is JavaScript which the client, in this case, Firefox browser, is evaluating.
Using Frida is injecting JavaScript code into Firefox.
$ cat script.js
Interceptor.attach(Module.findExportByName(null, "PR_Write"), {
onEnter: function (args) {
console.log(Memory.readByteArray(args[1], args[...
1
Answer
// Constants
const kIgnoreArg = '-';
// Utils
function pmalloc() {
return Memory.alloc(Process.pointerSize);
}
function debug() {
send({ event: 'DEBUG', data: Array.prototype.slice.call(arguments).join(' ') });
}
// Globals
var Metadata = {}; // < className, { pointer, methods < methodName, ...
Only top voted, non community-wiki answers of a minimum length are eligible