6
votes
Frida command not available after installing Frida PIP Python package
Frida was split into two PIP packages.
The package frida only contains the python bindings, while frida-tools also contains the familiar command line tools from earlier releases.
This is explained ...
- 191
5
votes
Hooking function with frida
Try using Memory.patchCode to achieve this. Here's a short example.
int test() { return 1024; }
int main(int argc, char **argv) {
printf("%d\n", test());
return 0;
}
When compiled ...
- 2,629
5
votes
Accepted
Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)
There are multiple possibilities how this might happen.
The code is loaded dynamically at run-time, e.g. for an [obfuscated/encrypted] dex file that is present in the APK file but does not follow the ...
- 917
4
votes
android unity intercept w/ Frida
Heh, it's some kind of necroposting, but why not?
Well, under hood unity3d use 2 variants: mono, that loads C# dlls and il2cpp, that convert it to C++ before build.
For 2nd case u can use ...
- 41
3
votes
Accepted
Unable to attach into mysterious PID
It's not a malware. It's cygwin's ssh-agent and it uses non existent PID as parent. I was able figure this out using a new version of ProcessHacker.
- 161
3
votes
Replacing a function in a 1995 Windows 32-bit binary using Frida causes crash
Your hook probably clobbers some register which is used by the caller. Watcom fastcall is a bit special and different from stdcall. Maybe try saving and restoring all registers which are not used for ...
- 36.4k
3
votes
Accepted
Frida not hook functions
Your problem is that the name of the function you want to hook is not xxtea_decrypt and because of this you can not hook it:
In your IDA scren shot the function is shown as xxtea_decrypt(uchar *,uint,...
- 917
2
votes
What functions (in which modules) can be hooked by Frida to access unencrypted data of SSL connections in Java programs running under Windows?
That requires some research on your end.
Find out what API functions (not Java level) are used on a system level to deal with SSL. I could imagine that the Java runtime on Windows uses the Internet ...
- 1,391
2
votes
Accepted
Killing thread/process from Frida trace
One (rather ugly) solution to this is simply to crash the program by setting the thread's context's instruction pointer to unmapped memory or kernel memory. You can accomplish that with Frida's ...
- 96
2
votes
hooking libhoudini on x86 emulator
Yes, it's true. So far, Frida 12.11.14 does not support it.
You can check https://www.slideshare.net/cisoplatform7/one-step-ahead-of-cheaters-instrumenting-android-emulators
not sure if it's working......
- 51
2
votes
Accepted
Load a *.dylib or *.so object into the Javascript V8 runtime?
I was misinterpreting the context of the comment in the original link, it seems. I was under the impression that Module.load was a v8-ism, while it in fact appears to be a Frida-API.
https://frida.re/...
- 183
2
votes
Frida reading files is slow
The reason why your code is slow is not Frida but your code. Your code would be also slow when executed in plain J2SE Java.
The simple reason is because you are reading the file byte by byte using an ...
- 917
2
votes
Accepted
Create instance of iOS class that contains a . with frida
ObjC.classes.TestClass is just a shorthand in JavaScript for
ObjC.classes['TestClass'].
Therefore you should be able to access an Test.Class instance this way:
var instance = ObjC.chooseSync(ObjC....
- 917
2
votes
Accepted
Frida hook X509Certificate
If you use an TLS interception proxy and have a rooted phone it may be easier to add the used root CA certificate as system certificate (like described in mitmproxy doc. Afterwards the certificate ...
- 917
1
vote
Accepted
Frida Android how to change value of array passed to method
Frida seems to have some bugs regarding Java arrays that are modified or replaced by JavaScript code. My guess is that the conversion (and mapping of modifications) between the Java array instance and ...
- 917
1
vote
Frida reading files is slow
Unfortunately using buffer still didn't help me.
I guess doing JS -> Java -> JS -> Java takes a bit long. I have found this solution:
var Files = Java.use("java.nio.file.Files");
...
- 176
1
vote
Accepted
frida hook `loc_*` or `sub_*`
Update:
First, you need the base address of the module where your loc_... or sub_... is. To get it, do:
var adr = Process.findModuleByName("YOURMODULENAME")["base"];
Then, get the ...
- 61
1
vote
Accepted
Frida script returning different instruction at address compared to entering commands in repl
This was down to my misunderstanding. I was wanting to either nop out an instruction or modify a register value. I had been trying to print the instruction to verify I was at the correct address but ...
- 167
1
vote
Bypassing certificate transparency with Frida
It can be patched by hooking the right function of your app which checks these peers with Frida. You then always return true and you will have disabled certificate transparency
1
vote
Accepted
Debug shared library in Android application
What you see is possible if the APK files uses the mode extractNativeLibs="false". If that attribute is set in the <application tag in AndroidManifest.xml then Android loads the .so files ...
- 917
1
vote
Accepted
Log input data and resulting hash for CC_MD5 calls in an iOS app with Frida
The main problem of your code is that you expect the md parameter to be a string. In C the unsigned char * is not an indicator for a string. Instead it is often for storing binary data.
In this case ...
- 917
1
vote
Accepted
Read and write to register with Frida
The issue was that w9 is a 32-bit register and I was using a 64 bit device. By calling this.context.x9 for the 64 bit register the Frida script worked perfectly. Many thanks to @whoopdedoo, their ...
- 167
1
vote
Decode lua scripts for cocos2d based game / frida, android
i have done something similar with another game before where i use frida to hook the function luaL_loadbuffer and dump the decrypted lua files from there.
i wrote about it here https://github.com/...
- 111
1
vote
Decode lua scripts for cocos2d based game / frida, android
use ida pro or ghidra to find the decryption function.
if you attach to the process on a real phone you can hook the xxtea function and the 16 bytes at the 3rd argument pointer will be the key.
- 11
1
vote
Calling a method of a Java object passed as argument to hooked function in Frida
It's very likely you need to access the .value of the object. Alternatively you could also "stringfy" this which is an easy was to understand all the properties of the Object. Also, you do ...
- 358
1
vote
Is frida-server latest version compatible with old Android versions
Very well functional, in my projects, when using for Android version 4.0
- 356
1
vote
Is frida-server latest version compatible with old Android versions
I'm currently using the newest Frida to tinker around with a Galaxy S4 running Android 5.1 - works just fine for me!
- 111
1
vote
Accepted
Dump value of register using frida
The Details are all available in the Javascript API documentation for Interceptor
below is a small demo
assuming you have a source code as below the adder function will be called from 3 places
for ...
- 16.3k
1
vote
How to inject JavaScript into a browser with Frida?
There are plenty examples of using Frida on Windows:
Windows example
Huge collection of Awesome Frida links - link
Windows example 2 in Chinese so use Google Translate.
To your question, the general ...
- 3,002
1
vote
How to inject JavaScript into a browser with Frida?
You understand the situation incorrect.
windows.getAll() is JavaScript which the client, in this case, Firefox browser, is evaluating.
Using Frida is injecting JavaScript code into Firefox.
$ cat ...
- 273
Only top scored, non community-wiki answers of a minimum length are eligible