Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.
There are tools and frameworks available to bypass Root/Jailbreak detection.
If using objection -
objection -g com.attack.appname explore -s "android root disable”https://github.com/sensepost/objection/blob/master/agent/src/android/root.ts
objection -g com.attack.ipaname explore -s "ios jailbreak disable”https://github.com/sensepost/t/blob/master/agent/src/ios/jailbreak.ts
Using frida we can start experimenting and start hooking into interesting places and syscalls using early instrumentation.
/proc/*/Popen and FopengetEnvStat__system_property_findfrida --codeshare FrenchYeti/android-arm64-strace -U -f YOUR_BINARYUsing frida we can start experimenting and start hooking into interesting places and syscalls using early instrumentation.
Java.deoptimizeEveything();
Java.perform(()={
Java.use(…//InsertLogic)
})var ourlib = "librarycustom.so";
var do_dlopen = null;
var call_ctor = null;
var ModBase = null;
Process.findModuleByName('linker64').enumerateSymbols().forEach(function(sym) {
if (sym.name.indexOf('do_dlopen') >= 0) {
do_dlopen = sym.address;
} else if (sym.name.indexOf('call_constructor') >= 0) {
call_ctor = sym.address;
}
})
Interceptor.attach(do_dlopen, function() {
var library = this.context['x0'].readUtf8String();
if (library != null) {
if (library.indexOf(ourlib) >= 0) {
Interceptor.attach(call_ctor, function() {
var x = Process.findModuleByName(ourlib);
ModBase = x.base;
// console.warn(ourlib, "Base : ", ModBase)
})
}
}
})APKiD to identify the protector which was used in the Android AppCertificate pinning is mechanism that allows accepting only authorized ("pinned") certificates for authentication of client-server connections.
This mechainism is devised as a means of thwarting MiTM. This essentially means, we will not be able to use our interception proxies to manipulate API traffic.
disable-flutter-tls-verificationfunction CaptureSSLTraffic() {
let _sslWrite = libSymbol('libcocos2dcpp.so!SSL_write');
let _sslWriteOld = new NativeFunction(_sslWrite, 'int', ['pointer', 'pointer', 'int']);
let counter = 1;
// traffic out
console.log('raplacing [libcocos2dcpp.so!SSL_write]');
Interceptor.replace(_sslWrite, new NativeCallback((ctx, buffer, length) => {
counter++;
// remove gzip compress feature
let replace = buffer.readUtf8String(length).replace('Accept-Encoding: deflate, gzip\r\n', '');
let newBuffer = Memory.allocUtf8String(replace);
// filter multiple calls
if (counter % 2 == 0) {
console.raw('\n====', new Date().toLocaleString(), '====');
console.raw(replace, '\n');
}
// write data to
return _sslWriteOld(ctx, newBuffer, replace.length);
}, 'int', ['pointer', 'pointer', 'int']));
// traffic in
console.log('attaching [libcocos2dcpp.so!SSL_read]');
Interceptor.attach(libSymbol('libcocos2dcpp.so!SSL_read'), {
onEnter: (args) => {
this.buffer = ptr(args[1]);
},
onLeave: (ret) => {
let data = this.buffer.readUtf8String(ret.toInt32());
console.raw(data, '\n=================================');
}
});
}Apps can encryt the network traffic to ensure attacker don’t get visibility into the traffic. In this case, as attacker you won’t be able to manipulate traffic even after bypassing root detection/SSL Pinning etc.
frida --codeshare dzonerzy/aesinfo -f com.appjavax.crypto libraryCCryptfrida-trace to rescue
frida-trace -U -i "encry*" com.appname
frida-trace -U -i "ccrypt*" com.appnameFrida detection is, well, mechanisms to detect if Frida is being run on a mobile device.
Freeda binaryBrida is a Burp Suite Extension that, working as a bridge between Burp Suite and Frida, lets you use and manipulate applications’ own methods while tampering the traffic exchanged between the applications and their back-end services/servers.