ZygiskFrida

ZygiskFrida

Frida is a dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers

Zygisk part of Magisk allows you to run code in every Android application's Process.

Introduction

ZygiskFrida is a zygisk module allowing you to inject frida gadget in Android applications in a more stealthy way.

• The gadget is not embedded into the APK itself. So APK Integrity/Signature checks will still pass.
• The process is not being ptraced like it is with frida-server. Avoiding ptrace based detection.
• Control about the injection time of the gadget.
• Allows you to load multiple arbitrary libraries into the process.

This repo also provides a Riru flavor in case you are still using riru with an older magisk version rather than zygisk.

How to use the module

Prerequisites

• Rooted device/emulator
• Zygisk available and enabled

Quick start

• Download the latest release from the Release Page
  If you are using riru instead of zygisk choose the riru-release. Otherwise choose the normal version.
• Transfer the ZygiskFrida zip file to your device and install it via Magisk.
• Reboot after install
• Create the config file and adjust the package name to your target app (replace your.target.application in the commands)

adb shell 'su -c cp /data/local/tmp/re.zyg.fri/config.json.example /data/local/tmp/re.zyg.fri/config.json'
adb shell 'su -c sed -i s/com.example.package/your.target.application/ /data/local/tmp/re.zyg.fri/config.json'

• Launch your app. It will pause at startup allowing you to attach f.e. frida -U -N your.target.application or frida -U -n Gadget

This assumes that you don't have any other frida server running (f.e. by using MagiskFrida). You can still run it together with frida-server but you would have to configure the gadget to use a different port.

Configuration

This module also supports adding a start up delay that can delay injection of the gadget to avoid checks run at startup time, loading arbitrary libraries and child gating.

Please take a look at the configuration guide for this.

How to build

• Checkout the project
• Run ./gradlew :module:assembleRelease
• The build magisk module should then be in the out directory.

You can also build and install the module to your device directly with ./gradlew :module:flashAndRebootZygiskRelease

Caveats

• For emulators this will start the gadget in native realm. This means that you will be able to hook Java but not native functions.

Credits

• Inspired by https://github.com/Perfare/Zygisk-Il2CppDumper
• https://github.com/hexhacking/xDL