daemon-sec-cheatsheet

frida-tutorial-2.md (11025B)

---

 ---
 title: "Frida Tutorial 2"
 section: "Mobile"
 sectionSlug: "mobile-pentesting"
 sourcePath: "src/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.md"
 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.md"
 sha: "188de82beb54e70956b2952367a0af91d26758b8"
 isIndex: false
 modified: true
 license: "CC-BY-NC-4.0"
 ---
 
 # Frida Tutorial 2
 
 **This is a summary of the post**: [https://11x256.github.io/Frida-hooking-android-part-2/](https://11x256.github.io/Frida-hooking-android-part-2/) (Parts 2, 3 and 4)<sup>[[3]](#references)</sup>\
 **APKs and Source code**: [https://github.com/11x256/frida-android-examples](https://github.com/11x256/frida-android-examples)
 
 This part focuses on **overloaded methods**, **calling app code from your Frida script**, **keeping references to live Java objects**, and **using Python as a controller** for interactive instrumentation.
 
 ## Part 2
 
 Here you can see an example of how to **hook 2 functions with the same name** but different parameters.\
 Also, you are going to learn how to **call a function with your own parameters**.\
 And finally, there is an example of how to **find an instance of a class and make it call a function**.
 
 ```javascript
 // s2.js
 console.log("Script loaded successfully");
 
 Java.perform(function () {
   var MyActivity = Java.use("com.example.a11x256.frida_test.my_activity");
   var JString = Java.use("java.lang.String");
 
   var funInt = MyActivity.fun.overload("int", "int");
   funInt.implementation = function (x, y) {
     console.log("original call: fun(" + x + ", " + y + ")");
     return funInt.call(this, 2, 5);
   };
 
   var funString = MyActivity.fun.overload("java.lang.String");
   funString.implementation = function (x) {
     var myString = JString.$new("My TeSt String#####");
     console.log("Original arg: " + x);
     var ret = funString.call(this, myString);
     console.log("Return value: " + ret);
     return ret;
   };
 
   Java.choose("com.example.a11x256.frida_test.my_activity", {
     onMatch: function (instance) {
       console.log("Found instance: " + instance);
       console.log("Result of secret func: " + instance.secret());
     },
     onComplete: function () {},
   });
 });
 ```
 
 To create a `String`, this script first references `java.lang.String` and then creates a new object with `$new()`. That is the correct way to instantiate Java objects from Frida. In this specific case, passing a plain JavaScript string like `funString.call(this, "hey there!")` also works because Frida will coerce it to `java.lang.String`.
 
 ### Python
 
 ```python
 # loader.py
 import frida
 import time
 
 with open("s2.js", "r", encoding="utf-8") as f:
     jscode = f.read()
 
 device = frida.get_usb_device(timeout=5)
 pid = device.spawn(["com.example.a11x256.frida_test"])
 device.resume(pid)
 time.sleep(1)  # Without it Java.perform may run before ART is ready
 session = device.attach(pid)
 script = session.create_script(jscode)
 script.load()
 input()
 ```
 
 ```bash
 python3 loader.py
 ```
 
 ### Keeping instances after `Java.choose`
 
 `Java.choose()` gives you a live wrapper during the callback. If you want to keep using that object later, retain it explicitly:
 
 ```javascript
 var cached = null;
 
 Java.perform(function () {
   Java.choose("com.example.a11x256.frida_test.my_activity", {
     onMatch: function (instance) {
       cached = Java.retain(instance);
       console.log("Retained instance: " + cached);
       return "stop";
     },
     onComplete: function () {},
   });
 });
 ```
 
 This matters when you want to call the same instance later from `rpc.exports`, timers, or another hook without re-scanning the heap each time.
 
 ### Classes loaded by custom `ClassLoader`s
 
 On recent Android apps, especially apps using **dynamic feature modules**, **plugin frameworks**, or **packed/encrypted code**, `Java.use()` may fail with `ClassNotFoundException` even though the class exists. In that case enumerate the available class loaders and use the correct one through a dedicated `Java.ClassFactory`:<sup>[[1]](#references)</sup>
 
 ```javascript
 Java.perform(function () {
   var targetLoader = null;
 
   Java.enumerateClassLoaders({
     onMatch: function (loader) {
       try {
         if (loader.findClass("com.example.a11x256.frida_test.my_activity")) {
           targetLoader = loader;
           console.log("Found loader: " + loader);
         }
       } catch (e) {}
     },
     onComplete: function () {},
   });
 
   if (targetLoader !== null) {
     var factory = Java.ClassFactory.get(targetLoader);
     var MyActivity = factory.use("com.example.a11x256.frida_test.my_activity");
 
     factory.choose("com.example.a11x256.frida_test.my_activity", {
       onMatch: function (instance) {
         console.log("Instance from alternate loader: " + instance);
       },
       onComplete: function () {},
     });
   }
 });
 ```
 
 If you already know the app loads sensitive code late, this pattern is usually more reliable than retrying `Java.use()` in a loop.
 
 ## Part 3
 
 ### Python
 
 Now you are going to see how to send commands to the hooked app via Python and use **Frida RPC exports** to call JavaScript functions:
 
 ```python
 # loader.py
 import time
 import frida
 
 
 def on_message(message, payload):
     print(message)
     if payload is not None:
         print(payload)
 
 
 with open("s3.js", "r", encoding="utf-8") as f:
     jscode = f.read()
 
 device = frida.get_usb_device(timeout=5)
 pid = device.spawn(["com.example.a11x256.frida_test"])
 device.resume(pid)
 time.sleep(1)
 session = device.attach(pid)
 script = session.create_script(jscode)
 script.on("message", on_message)
 script.load()
 api = script.exports_sync
 
 while True:
     command = input(
         "Enter command:\n1: Exit\n2: Call secret function\n3: Hook Secret\nchoice: "
     ).strip()
     if command == "1":
         break
     if command == "2":
         api.callsecretfunction()
     elif command == "3":
         api.hooksecretfunction()
 ```
 
 The command `1` will **exit**, the command `2` will **find an instance of the class and call the private function** `secret()`, and command `3` will **hook** the function `secret()` so it **returns** a **different string**.
 
 If you call `2` first, you will get the **real secret**. If you call `3` and then `2`, you will get the **fake secret**.
 
 ### JS
 
 ```javascript
 console.log("Script loaded successfully");
 var instancesArray = [];
 
 function callSecretFun() {
   Java.perform(function () {
     if (instancesArray.length === 0) {
       Java.choose("com.example.a11x256.frida_test.my_activity", {
         onMatch: function (instance) {
           instancesArray.push(Java.retain(instance));
           console.log("Found instance: " + instance);
           console.log("Result of secret func: " + instance.secret());
           return "stop";
         },
         onComplete: function () {},
       });
     } else {
       console.log("Result of secret func: " + instancesArray[0].secret());
     }
   });
 }
 
 function hookSecret() {
   Java.perform(function () {
     var MyActivity = Java.use("com.example.a11x256.frida_test.my_activity");
     var JString = Java.use("java.lang.String");
     var secret = MyActivity.secret.overload();
 
     secret.implementation = function () {
       return JString.$new("TE ENGANNNNEEE");
     };
   });
 }
 
 rpc.exports = {
   callsecretfunction: callSecretFun,
   hooksecretfunction: hookSecret,
 };
 ```
 
 In Python, exported JavaScript methods are easier to call through `script.exports_sync`. For example, an export named `enumerateModules` becomes `script.exports_sync.enumerate_modules()`.
 
 ## Part 4
 
 Here you will see how to make **Python and JS interact** using JSON objects. JS uses the `send()` function to send data to the Python client, and Python uses `post()` to send a JSON object back to the JS script. The **JS will block the execution** until it receives a response from Python.
 
 ### Python
 
 ```python
 # loader.py
 import base64
 import time
 import frida
 
 
 def on_message(message, payload):
     print(message)
     if message.get("type") != "send":
         return
 
     encoded = message["payload"].split(":", 1)[1].strip()
     user, password = base64.b64decode(encoded).decode().split(":", 1)
     new_data = base64.b64encode(f"admin:{password}".encode()).decode()
     script.post({"type": "input", "payload": {"my_data": new_data}})
     print(f"Modified data sent for user {user}")
 
 
 with open("s4.js", "r", encoding="utf-8") as f:
     jscode = f.read()
 
 device = frida.get_usb_device(timeout=5)
 pid = device.spawn(["com.example.a11x256.frida_test"])
 device.resume(pid)
 time.sleep(1)
 session = device.attach(pid)
 script = session.create_script(jscode)
 script.on("message", on_message)
 script.load()
 input()
 ```
 
 ### JS
 
 ```javascript
 console.log("Script loaded successfully");
 
 Java.perform(function () {
   var TextView = Java.use("android.widget.TextView");
   var setText = TextView.setText.overload("java.lang.CharSequence");
 
   setText.implementation = function (x) {
     var outgoing = x.toString();
     var incoming = outgoing;
 
     send("Candidate text: " + outgoing);
     recv("input", function (message) {
       incoming = message.payload.my_data;
     }).wait();
 
     console.log("Final string_to_recv: " + incoming);
     return setText.call(this, incoming);
   };
 });
 ```
 
 `recv()` handlers receive **one message** and must be registered again for the next one. Using `.wait()` blocks the current hooked thread until Python replies, so keep this pattern for cases where you really need an inline decision before the original method continues.
 
 ## Modern Frida Notes
 
 - These examples still work as plain scripts loaded through `frida`, `frida-python`, or `frida-trace`.
 - If you migrate them to a **Frida 17+ agent project** built with `frida-create`/`frida-compile`, import the Java bridge explicitly with `import Java from "frida-java-bridge"`.<sup>[[2]](#references)</sup>
 - Frida 17.1.4 bumped `frida-java-bridge` to `7.0.3` in internal Android agents, adding **Android 16** support. If heap scans or Java hooks behave strangely on very recent Android versions, first verify that **frida-tools**, **frida-python**, and **frida-server/gadget** are on matching recent versions.
 - For **anti-Frida**, **root detection**, and **SSL pinning** bypasses, keep that content in the dedicated page:
 
 [Android Anti Instrumentation And Ssl Pinning Bypass](/hacktricks/mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass)
 
 There is a part 5 that is not explained here because it doesn't add anything substantially new. If you want to read it, it is here: [https://11x256.github.io/Frida-hooking-android-part-5/](https://11x256.github.io/Frida-hooking-android-part-5/)
 
 ## References
 
 - [1] [Frida JavaScript API](https://frida.re/docs/javascript-api/)
 - [2] [Frida 17.0.0 Released](https://frida.re/news/2025/05/17/frida-17-0-0-released/)
 - [3] [11x256.github.io - Frida Hooking Android Part 2](https://11x256.github.io/Frida-hooking-android-part-2)