Hamza Hamz-a

Frida Tips

The documentation is so limited. A compilation of things I found on StackOverflow and don't want to have to search it up again.

Bypass root check

setTimeout(function() { // avoid java.lang.ClassNotFoundException

  Java.perform(function() {

    // Root detection bypass example

Awesome Knowledge Graph Embedding Approaches

This list contains repositories of libraries and approaches for knowledge graph embeddings, which are vector representations of entities and relations in a multi-relational directed labelled graph. Licensed under CC0.

Libraries

🆕 AmpliGraph (4 algorithms) @ https://github.com/Accenture/AmpliGraph
Embedding framework (5 algorithms) @ https://github.com/BookmanHan/Embedding

radare2

load without any analysis (file header at offset 0x0): r2 -n /path/to/file

analyze all: aa
show sections: iS
list functions: afl
list imports: ii
list entrypoints: ie
seek to function: s sym.main

	Java.perform(function(){
	let ThreadDef = Java.use('java.lang.Thread');
	let ThreadObj = ThreadDef.$new();
	function stackTrace() {
	console.log('------------START STACK---------------')
	let stack = ThreadObj.currentThread().getStackTrace();
	for (let i = 0; i < stack.length; i++) {
	console.log(i + ' => ' + stack[i].toString());
	}
	console.log('------------END STACK---------------');

	X-Azure-ClientIP: 127.0.0.1
	X-Azure-SocketIP: 127.0.0.1
	X-Originating-IP: 127.0.0.1
	X-Forwarded-For: 127.0.0.1
	X-Remote-IP: 127.0.0.1
	X-Remote-Addr: 127.0.0.1
	X-Real-Ip: 127.0.0.1
	X-Target-IP: 127.0.0.1
	X-Forwarded-Host: localhost
	True-Client-IP: 127.0.0.1

	#!/usr/bin/python3
	import frida
	import subprocess
	import sys

	if len(sys.argv) !=2:
	print(f"[-] Usage : python3 {sys.argv[0]} <package_to_uninstall>")
	sys.exit(-1)

	def message(message, data):

	require 'yaml'
	require 'base64'
	require 'erb'

	class ActiveSupport
	class Deprecation
	def initialize()
	@silenced = true
	end
	class DeprecatedInstanceVariableProxy

	function getGenericInterceptor(className, func, parameters) {
	args = []
	for (i = 0; i < parameters.length; i++) {
	args.push('arg_' + i)
	}
	var script = "result = this.__FUNCNAME__(__SEPARATED_ARG_NAMES__);\nlogmessage = '__CLASSNAME__.__FUNCNAME__(' + __SEPARATED_ARG_NAMES__ + ') => ' + result;\nconsole.log(logmessage);\nreturn result;"

	script = script.replace(/__FUNCNAME__/g, func);
	script = script.replace(/__SEPARATED_ARG_NAMES__/g, args.join(', '));
	script = script.replace(/__CLASSNAME__/g, className);

	import sys
	import r2pipe

	r2 = r2pipe.open("./zwiebel2")
	r2.cmd("e dbg.profile=zwiebel.rr2")
	r2.cmd("doo") # reopen for debugging
	r2.cmd("db 0x400875") # set breakpoint at `call r14`
	r2.cmd("dc") # continue until breakpoint is hit

	def step():

	'use strict';

	/*
	* Usage:
	* $ frida -U -n Twitter -l load-cycript.js
	*/

	var PORT = 27060;

	dlopen('/usr/lib/libcycript.dylib');