oleavr

Frida logging helper

For adding temporary logging to help understand behavior. For when it is impractical to use Frida to instrument Frida.

Choose one of these and copy-paste it into e.g. lib/interfaces/session.vala, then use log_event ("name='%s'", name); to log.

When something appears to be hanging, try applying: x-async-debug.patch.

ceres-c

#!/usr/bin/python3

'''
author: ceres-c
usage: ./frida-extract-keystore.py
       Once the keystore(s) have been exported you have to convert them to PKCS12 using keytool
'''

import frida, sys, time

virtualminds

{

  onEnter: function (log, args, state) {
    soname = Memory.readUtf8String(args[0]);
    if(soname.includes('libmono-btls-shared.so')) {
      log("libmono-btls-shared.so cargada!");
      this.dlopen = true;
      this.dlopenMonitor = false;

    }

su-vikas

Java.perform(function() {
    var surface_view = Java.use('android.view.SurfaceView');

    var set_secure = surface_view.setSecure.overload('boolean');

    set_secure.implementation = function(flag){
        console.log("setSecure() flag called with args: " + flag); 
        set_secure.call(false);
    };

daniellimws

Frida Tips

The documentation is so limited. A compilation of things I found on StackOverflow and don't want to have to search it up again.

Bypass root check

setTimeout(function() { // avoid java.lang.ClassNotFoundException

  Java.perform(function() {

    // Root detection bypass example

yannayl

def strs(f=None, visited=None, level=0, maxlevel=-1):
    if maxlevel >= 0 and level > maxlevel:
        return [], set()
    if not f:
        f = sark.Function()
    if not visited:
        visited = set()
        root = True
    else:
       root = False

ssr-research

#!/usr/bin/env python
#---------------------------------------------------------------------
# Introduction to IDAPython for Vulnerabiliity Hunting
# 
# Author: Zach Miller, Somerset Recon
#
#---------------------------------------------------------------------

# A function to determine if an operand of an instruction is located on the stack. This is used for finding stack buffers 
# that have the potential to be overflowed

zihadmahiuddin

console.log("Loading script...");

var getaddrinfoPtr = Module.findExportByName(null, 'getaddrinfo')
var connectPtr = Module.findExportByName(null, 'connect')
var sendPtr = Module.findExportByName(null, 'send')
var recvPtr = Module.findExportByName(null, 'recv')

var getaddrinfoFunction = new NativeFunction(getaddrinfoPtr, 'int', ['pointer', 'pointer', 'pointer', 'pointer'])
var connectFunction = new NativeFunction(connectPtr, 'int', ['int', 'pointer', 'int'])
var sendFunction = new NativeFunction(sendPtr, 'int', ['int', 'pointer', 'int', 'int'])

maxvonhippel

# Clone MamaDroid
git clone https://bitbucket.org/gianluca_students/mamadroid_code.git mamadroid
# Get some malware to look at
git clone https://github.com/ashishb/android-malware.git malware
# Export variables
export JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk1.8.0_131.jdk/Contents/Home/bin/
export JRE_HOME=/Library/Java/JavaVirtualMachines/jdk1.8.0_102.jdk/Contents/Home/jre/bin
export PATH=$JAVA_HOME:$JRE_HOME:$PATH
# Base dir variable for convenience
basedir=$(echo $(pwd)/mamadroid)

myzhan

Java.scheduleOnMainThread(function() {
        Toast = Java.use("android.widget.Toast");
        var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
        var context = currentApplication.getApplicationContext();
        Toast.makeText(context,"hello world", Toast.LENGTH_SHORT.value).show();
});