daemon-sec-cheatsheet

frida-tutorial-1.md (6503B)

---

 ---
 title: "Frida Tutorial 1"
 section: "Mobile"
 sectionSlug: "mobile-pentesting"
 sourcePath: "src/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md"
 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md"
 sha: "188de82beb54e70956b2952367a0af91d26758b8"
 isIndex: false
 modified: true
 license: "CC-BY-NC-4.0"
 ---
 
 # Frida Tutorial 1
 
 **This is a summary of the post**: [https://medium.com/infosec-adventures/introduction-to-frida-5a3f51595ca1](https://medium.com/infosec-adventures/introduction-to-frida-5a3f51595ca1)<sup>[[3]](#references)</sup>\
 **APK**: [https://github.com/t0thkr1s/frida-demo/releases](https://github.com/t0thkr1s/frida-demo/releases)\
 **Source Code**: [https://github.com/t0thkr1s/frida-demo](https://github.com/t0thkr1s/frida-demo)
 
 ## Python
 
 Frida allows you to **insert JavaScript code** inside functions of a running application. But you can use **python** to **call** the hooks and even to **interact** with the **hooks**.
 
 This is a easy python script that you can use with all the proposed examples in this tutorial:
 
 ```python
 #hooking.py
 import frida, sys
 
 with open(sys.argv[1], 'r') as f:
         jscode = f.read()
 process = frida.get_usb_device().attach('infosecadventures.fridademo')
 script = process.create_script(jscode)
 print('[ * ] Running Frida Demo application')
 script.load()
 sys.stdin.read()
 ```
 
 Call the script:
 
 ```bash
 python hooking.py <hookN.js>
 ```
 
 It is useful to know how to use python with frida, but for this examples you could also call directly Frida using command line frida tools:
 
 ```bash
 frida -U --no-pause -l hookN.js -f infosecadventures.fridademo
 ```
 
 ## Hook 1 - Boolean Bypass
 
 Here you can see how to **hook** a **boolean** method (_checkPin_) from the class: _infosecadventures.fridademo.utils.PinUtil_
 
 ```javascript
 //hook1.js
 Java.perform(function () {
   console.log("[ * ] Starting implementation override...")
   var MainActivity = Java.use("infosecadventures.fridademo.utils.PinUtil")
   MainActivity.checkPin.implementation = function (pin) {
     console.log("[ + ] PIN check successfully bypassed!")
     return true
   }
 })
 ```
 
 ```text
 python hooking.py hook1.js
 ```
 
 Mirar: La funcion recibe como parametro un String, no hace falta overload?
 
 ## Hook 2 - Function Bruteforce
 
 ### Non-Static Function
 
 If you want to call a non-static function of a class, you **first need a instance** of that class. Then, you can use that instance to call the function.\
 To do so, you could **find and existing instance** and use it:
 
 ```javascript
 Java.perform(function () {
   console.log("[ * ] Starting PIN Brute-force, please wait...")
   Java.choose("infosecadventures.fridademo.utils.PinUtil", {
     onMatch: function (instance) {
       console.log("[ * ] Instance found in memory: " + instance)
       for (var i = 1000; i < 9999; i++) {
         if (instance.checkPin(i + "") == true) {
           console.log("[ + ] Found correct PIN: " + i)
           break
         }
       }
     },
     onComplete: function () {},
   })
 })
 ```
 
 In this case this is not working as there isn't any instance and the function is Static
 
 ### Static Function
 
 If the function is static, you could just call it:
 
 ```javascript
 //hook2.js
 Java.perform(function () {
   console.log("[ * ] Starting PIN Brute-force, please wait...")
   var PinUtil = Java.use("infosecadventures.fridademo.utils.PinUtil")
 
   for (var i = 1000; i < 9999; i++) {
     if (PinUtil.checkPin(i + "") == true) {
       console.log("[ + ] Found correct PIN: " + i)
     }
   }
 })
 ```
 
 ## Hook 3 - Retrieving arguments and return value
 
 You could hook a function and make it **print** the value of the **passed arguments** and the value of the **return value:**
 
 ```javascript
 //hook3.js
 Java.perform(function () {
   console.log("[ * ] Starting implementation override...")
 
   var EncryptionUtil = Java.use(
     "infosecadventures.fridademo.utils.EncryptionUtil"
   )
   EncryptionUtil.encrypt.implementation = function (key, value) {
     console.log("Key: " + key)
     console.log("Value: " + value)
     var encrypted_ret = this.encrypt(key, value) //Call the original function
     console.log("Encrypted value: " + encrypted_ret)
     return encrypted_ret
   }
 })
 ```
 
 ## Hooking on recent Android versions (14/15/16)
 
 - From **Frida 17.1.x+** Java hooking on Android 14–16 is stable again (ART quick entrypoint offsets were fixed). If `Java.choose` returns nothing on Android 14+, upgrade **frida-server/gadget** and the **CLI/Python** packages to >=17.1.5.<sup>[[1]](#references)</sup>
 - Apps with early anti-debug checks often die before `attach`. Use **spawn** so hooks load before `onCreate`:
 
 ```bash
 frida -U -f infosecadventures.fridademo -l hook1.js --no-pause
 ```
 
 - When multiple overloads exist, select the target explicitly:
 
 ```javascript
 var Cls = Java.use("com.example.Class")
 Cls.doThing.overload('java.lang.String', 'int').implementation = function(s, i) {
   return this.doThing(s, i)
 }
 ```
 
 ## Stealthier injection with Zygisk Gadget
 
 Some apps detect **ptrace** or `frida-server`. Magisk/Zygisk modules can load **frida-gadget** inside Zygote so no process is ptraced:<sup>[[2]](#references)</sup>
 
 1. Install a Zygisk gadget module (e.g., `zygisk-gadget`) and reboot.
 2. Configure the target package and an optional delay to bypass startup checks:
 
 ```bash
 adb shell "su -c 'echo infosecadventures.fridademo,5000 > /data/local/tmp/re.zyg.fri/target_packages'"
 ```
 
 3. Launch the app and attach to the gadget name:
 
 ```bash
 frida -U -n Gadget -l hook3.js
 ```
 
 Because the gadget is injected by Zygote, APK integrity checks stay untouched and basic ptrace/Frida string checks usually fail.
 
 ## Important
 
 In this tutorial you have hooked methods using the name of the method and _.implementation_. But if there were **more than one method** with the same name, you will need to **specify the method** that you want to hook **indicating the type of the arguments**.
 
 You can see that in [the next tutorial](/hacktricks/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2).
 
 ## References
 
 - [1] [Frida News (Android 14–16 fixes & Frida 17.x releases)](https://frida.re/news/)
 - [2] [zygisk-gadget – Zygisk module that loads frida-gadget](https://github.com/hackcatml/zygisk-gadget)
 - [3] [medium.com - Introduction To Frida](https://medium.com/infosec-adventures/introduction-to-frida-5a3f51595ca1)