& also output examples
## Table of Contents
Native
* [`Load C/C++ module`](#load-cpp-module)
* [`One time watchpoint`](#one-time-watchpoint)
* [`Socket activity`](#socket-activity)
* [`Intercept open`](#intercept-open)
* [`Execute shell command`](#execute-shell-command)
* [`List modules`](#list-modules)
* [`Log SQLite query`](#log-sqlite-query)
* [`Log method arguments`](#log-method-arguments)
* [`Intercept entire module`](#intercept-entire-module)
* [`Dump memory segments`](#dump-memory-segments)
* [`Memory scan`](#memory-scan)
* [`Stalker`](#stalker)
* [`Cpp Demangler`](#cpp-demangler)
* [`Early hook`](#early-hook)
Android
* [`Binder transactions`](#binder-transactions)
* [`Get system property`](#system-property-get)
* [`Reveal manually registered native symbols`](#reveal-native-methods)
* [`Enumerate loaded classes`](#enumerate-loaded-classes)
* [`Class description`](#class-description)
* [`Turn WiFi off`](#turn-wifi-off)
* [`Set proxy`](#set-proxy)
* [`Get IMEI`](#get-imei)
* [`Hook io InputStream`](#hook-io-inputstream)
* [`Android make Toast`](#android-make-toast)
* [`Await for specific module to load`](#await-for-condition)
* [`Webview URLS`](#webview-urls)
* [`Print all runtime strings & stacktrace`](#print-runtime-strings)
* [`Print shared preferences updates`](#Print-shared-preferences-updates)
* [`String comparison`](#string-comparison)
* [`Hook JNI by address`](#hook-jni-by-address)
* [`Hook constructor`](#hook-constructor)
* [`Hook Java reflection`](#hook-refelaction)
* [`Trace class`](#trace-class)
* [`Hooking Unity3d`](https://github.com/iddoeldor/mplus)
* [`Get Android ID`](#get-android-id)
* [`Change location`](#change-location)
* [`Bypass FLAG_SECURE`](#bypass-flag_secure)
* [`Shared Preferences update`](#shared-preferences-update)
* [`Hook all method overloads`](#hook-overloads)
* [`Register broadcast receiver`](#register-broadcast-receiver)
* [`Increase step count`](#increase-step-count)
* [`list classes implements interface with class loaders`](#list-classes-implements-interface)
* File system access hook `$ frida --codeshare FrenchYeti/android-file-system-access-hook -f com.example.app --no-pause`
* How to remove/disable java hooks ? Assign `null` to the `implementation` property.
iOS
* [`OS Log`](#os-log)
* [`iOS alert box`](#ios-alert-box)
* [`File access`](#file-access)
* [`Observe class`](#observe-class)
* [`Find application UUID`](#find-ios-application-uuid)
* [`Extract cookies`](#extract-cookies)
* [`Describe class members`](#describe-class-members)
* [`Class hierarchy`](#class-hierarchy)
* [`Hook refelaction`](#hook-refelaction)
* [`Device properties`](#device-properties)
* [`Take screenshot`](#take-screenshot)
* [`Log SSH commands`](#log-ssh-commands)
Windows
Sublime snippets
{
"scope": "source.js",
"completions": [
{"trigger": "fridainterceptor", "contents": "Interceptor.attach(\n ptr,\n {\n onEnter:function(args) {\n\n },\n onLeave: function(retval) {\n\n }\n }\n)"},
{"trigger": "fridaperform", "contents": "function main(){\n console.log('main()');\n}\n\nconsole.log('script loaded');\nJava.perform(main);"},
{"trigger": "fridause", "contents": "var kls = Java.use('kls');"},
{"trigger": "fridahex", "contents": "hexdump(\n ptr,\n {\n offset: 0,\n length: ptr_size\n }\n);" },
{"trigger": "fridabacktrace", "contents": "console.log('called from:\\n' +\n Thread.backtrace(this.context, Backtracer.ACCURATE)\n .map(DebugSymbol.fromAddress).join('\\n') + '\\n'\n);"},
{"trigger": "fridamods", "contents": "var mods = Process.enumerateModules().filter(function(mod){\n return mod.name.includes(\"\");\n});"},
{"trigger": "fridaexport", "contents": "Module.findExportByName(null, \"\");"},
{"trigger": "fridabase", "contents": "Module.findBaseAddress(name);"},
{"trigger": "fridaoverload", "contents": "kls.method_name.overload().implementation=function(){}"}
]
}
Vim snippets
To list abbreviations `:ab`
Expand by writing `key` and ``
* Add to `~/.vimrc`
```
ab fridaintercept Interceptor.attach(ptr, {onEnter: function(args) {},onLeave: function(retval) {}})
ab fridabacktrace console.warn(Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n'));F(3;
ab fridadescribe console.log(Object.getOwnPropertyNames(Java.use('$').__proto__).join('\n\t'))F$
```
JEB
Java method hook generator using keyboard shortcut
1. `curl -o ~/$JEB$/scripts/FridaCodeGenerator.py https://raw.githubusercontent.com/iddoeldor/frida-snippets/master/scripts/FridaCodeGenerator.py`
2. Place cursor at Java method's signature
3. Press `Ctrl+Shift+Z`
4. Code is copied to system clipboard (using `xclip`)
#### Fetch SSL keys
```
…
```
[⬆ Back to top](#table-of-contents)
#### Load CPP module
```cpp
#include
#include
extern "C" {
void* create_stdstr(char *data, int size) {
std::string* s = new std::string();
(*s).assign(data, size);
return s;
}
}
```
```sh
$ ./android-ndk/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android21-clang++ a.cpp -o a -shared -static-libstdc++ && adb push a /data/local/tmp/a
```
```
…
```
#### Load C module
* https://frida.re/docs/javascript-api/#cmodule
* https://frida.re/news/2019/09/18/frida-12-7-released/
```sh
$ ./aarch64-linux-android21-clang /tmp/b.c -o /tmp/a -shared ../sysroot/usr/lib/aarch64-linux-android/21/liblog.so && adb push /tmp/a /data/local/tmp/a
```
```c
#include
#include
#include
#define TAG "TEST1"
#define LOGI(...) __android_log_print(ANDROID_LOG_INFO, TAG, __VA_ARGS__)
#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR, TAG, __VA_ARGS__)
void test(void) {
FILE* fp = popen("ls -l /sdcard 2>&1", "r");
if (fp == NULL)
LOGE("executing cmd failed");
char b[256];
while (fgets(b, sizeof(b), fp) != NULL) {
LOGI("%s", b);
}
pclose(fp);
}
```
```sh
$ frida -Uf com.app --no-pause --enable-jit -e "Module.load('/data/local/tmp/a')"
[ ] -> new NativeFunction(Module.findExportByName('a', 'test'), 'void', [])()
```
[⬆ Back to top](#table-of-contents)
#### One time watchpoint
Intercept `funcPtr` & log who read/write to `x2` via removing permissions w/ `mprotect`.
```
…
```
Output example
```
…
```
[⬆ Back to top](#table-of-contents)
#### Socket activity
```
…
```
Output example
Android example
```sh
# wrap the script above inside Java.perform
$ frida -Uf com.example.app -l script.js --no-pause
[Android Model-X::com.example.app]-> 117 write 5.0.2.1:5242
117 read 5.0.2.1:5242
135 write 5.0.2.1:4244
135 read 5.0.2.1:4244
135 read 5.0.2.1:4244
```
[⬆ Back to top](#table-of-contents)
#### Intercept Open
An example for intercepting `libc#open` & logging backtrace if specific file was opened.
```
…
```
```
…
```
Output example
Intecepting `com.android.chrome`
[⬆ Back to top](#table-of-contents)
#### Execute shell command
```
…
```
Usage example
List directory contents:
```python
def ls(folder):
cmd = Shell(['/bin/sh', '-c', 'ls -la ' + folder], None)
cmd.exec()
for chunk in cmd.output:
print(chunk.strip().decode())
```
Pull binary from iOS
```python
cmd = Shell(['/bin/sh', '-c', 'cat /System/Library/PrivateFrameworks/Example.framework/example'], None)
cmd.exec()
with open('/tmp/example', 'wb+') as f:
f.writelines(cmd.output)
# $ file /tmp/example
# /tmp/example: Mach-O 64-bit 64-bit architecture=12 executable
```
[⬆ Back to top](#table-of-contents)
#### List modules
```js
Process.enumerateModulesSync()
.filter(function(m){ return m['path'].toLowerCase().indexOf('app') !=-1 ; })
.forEach(function(m) {
console.log(JSON.stringify(m, null, ' '));
// to list exports use Module.enumerateExportsSync(m.name)
});
```
List modules & exports
```js
sudo frida Process --no-pause --eval 'var x={};Process.enumerateModulesSync().forEach(function(m){x[m.name] = Module.enumerateExportsSync(m.name)});x' -q | less +F
```
Output example
```
…
```
[⬆ Back to top](#table-of-contents)
#### Log SQLite query
```js
Interceptor.attach(Module.findExportByName('libsqlite.so', 'sqlite3_prepare16_v2'), {
onEnter: function(args) {
console.log('DB: ' + Memory.readUtf16String(args[0]) + '\tSQL: ' + Memory.readUtf16String(args[1]));
}
});
```
Output example
TODO
[⬆ Back to top](#table-of-contents)
#### system property get
```js
Interceptor.attach(Module.findExportByName(null, '__system_property_get'), {
onEnter: function (args) {
this._name = args[0].readCString();
this._value = args[1];
},
onLeave: function (retval) {
console.log(JSON.stringify({
result_length: retval,
name: this._name,
val: this._value.readCString()
}));
}
});
```
Output example
```
…
```
[⬆ Back to top](#table-of-contents)
#### Binder transactions
```
…
```
Output example
```
…
```
[⬆ Back to top](#table-of-contents)
#### Reveal native methods
`registerNativeMethods` can be used as anti reversing technique to the native .so libraries, e.g. hiding the symbols as much as possible, obfuscating the exported symbols and eventually adding some protection over the JNI bridge.
[source](https://stackoverflow.com/questions/51811348/find-manually-registered-obfuscated-native-function-address)
```
…
```
@OldVersion
```
…
```
Output example
```sh
$ frida -Uf com.google.android.apps.photos --no-pause -l script.js
```
```sh
{"class":"org/chromium/net/GURLUtils","method":"nativeGetOrigin","signature":"(Ljava/lang/String;)Ljava/lang/String;","address":"0x..da910"}
..
```
[⬆ Back to top](#table-of-contents)
#### Log method arguments
```
…
```
Symbol Type Table
"A" The symbol's value is absolute, and will not be changed by further linking.
"B" The symbol is in the uninitialized data section (known as BSS).
"C" The symbol is common. Common symbols are uninitialized data.
When linking, multiple common symbols may appear with the same name.
If the symbol is defined anywhere, the common symbols are treated as undefined references.
"D" The symbol is in the initialized data section.
"G" The symbol is in an initialized data section for small objects.
Some object file formats permit more efficient access to small data objects, such as a global int variable as
opposed to a large global array.
"I" The symbol is an indirect reference to another symbol.
This is a GNU extension to the a.out object file format which is rarely used.
"N" The symbol is a debugging symbol.
"R" The symbol is in a read only data section.
"S" The symbol is in an uninitialized data section for small objects.
"T" The symbol is in the text (code) section.
"U" The symbol is undefined.
"V" The symbol is a weak object. When a weak defined symbol is linked with a normal defined symbol,
the normal defined symbol is used with no error.
When a weak undefined symbol is linked and the symbol is not defined, the value of the weak symbol becomes
zero with no error.
"W" The symbol is a weak symbol that has not been specifically