Android Anti-Instrumentation & SSL Pinning Bypass (Frida/Objection)

Tip

Leer en oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer en oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Leer en oefen Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks

This page provides a practical workflow to regain dynamic analysis against Android apps that detect/root‑block instrumentation or enforce TLS pinning. It focuses on fast triage, common detections, and copy‑pasteable hooks/tactics to bypass them without repacking when possible.

Detectie-oppervlak (wat apps kontroleer)

  • Root checks: su binary, Magisk paths, getprop values, common root packages
  • Frida/debugger checks (Java): Debug.isDebuggerConnected(), ActivityManager.getRunningAppProcesses(), getRunningServices(), scanning /proc, classpath, loaded libs
  • Native anti‑debug: ptrace(), syscalls, anti‑attach, breakpoints, inline hooks
  • Early init checks: Application.onCreate() or process start hooks that crash if instrumentation is present
  • TLS pinning: custom TrustManager/HostnameVerifier, OkHttp CertificatePinner, Conscrypt pinning, native pins

Bypassing Anti-Frida Detection / Stealth Frida Servers

phantom-frida rebuilds Frida from source and applies ~90 patches so common Frida fingerprints disappear while the stock Frida protocol remains compatible (frida-tools can still connect). Target: apps that grep /proc (cmdline, maps, task comm, fd readlink), D-Bus service names, default ports, or exported symbols.

Fases:

  • Source patches: globale hernoeming van frida-identifiseerders (server/agent/helper) en herboude helper DEX met ’n hernoemde Java package.
  • Targeted build/runtime patches: meson tweaks, memfd label changed to jit-cache, SELinux labels (e.g., frida_file) renamed, libc hooks on exit/signal disabled to avoid hook-detectors.
  • Post-build rename: exported symbol frida_agent_main renamed after the first compile (Vala emits it), requiring a second incremental build.
  • Binary hex patches: thread names (gmain, gdbus, pool-spawner) replaced; optional sweep removes leftover frida/Frida strings.

Detection vectors covered:

  • Base (1–8): process name frida-server, mapped libfrida-agent.so, thread names, memfd label, exported frida_agent_main, SELinux labels, libc hook side-effects, and D-Bus service re.frida.server are renamed/neutralized.
  • Extended (9–16): change listening port (--port), rename D-Bus interfaces/internal C symbols/GType names, temp paths like .frida/frida-, sweep binary strings, rename build-time defines and asset paths (libdir/frida). D-Bus interface names that are part of the wire protocol stay unchanged in base mode to avoid breaking stock clients.

Build/usage (Android arm64 example):

python3 build.py --version 17.7.2 --name myserver --port 27142 --extended --verify
adb push output/myserver-server-17.7.2-android-arm64 /data/local/tmp/myserver-server
adb shell chmod 755 /data/local/tmp/myserver-server
adb shell /data/local/tmp/myserver-server -D &
adb forward tcp:27142 tcp:27142
frida -H 127.0.0.1:27142 -f com.example.app

Vlagte: --skip-build (patch only), --skip-clone, --arch, --ndk-path, --temp-fixes; WSL helper: wsl -d Ubuntu bash build-wsl.sh.

Stap 1 — Vinnige wen: verberg root met Magisk DenyList

  • Skakel Zygisk in Magisk aan
  • Skakel DenyList aan, voeg die teikenpakket by
  • Herbegin en toets weer

Baie apps kyk net na voor die hand liggende indikators (su/Magisk paths/getprop). DenyList neutraliseer dikwels naïewe kontroles.

Verwysings:

  • Magisk (Zygisk & DenyList): https://github.com/topjohnwu/Magisk

Play Integrity / Zygisk detections (post‑SafetyNet)

Nuwer bank- en ID-apps koppel runtime‑kontroles aan Google Play Integrity (SafetyNet‑vervanger) en kan ook crash as Zygisk self teenwoordig is. Vinnige triage wenke:

  • Skakel Zygisk tydelik uit (skakel af + herbegin) en probeer weer; sommige apps crash sodra Zygote injection laai.
  • As attestation login blokkeer, patch Google Play Services met PlayIntegrityFix/Fork + TrickyStore of gebruik ReZygisk/Zygisk‑Next slegs tydens toetsing. Hou die teiken in DenyList en vermy LSPosed modules wat props leak.
  • Vir ’n eenmalige run, gebruik KernelSU/APatch (geen Zygote injection) om onder Zygisk-heuristieke te bly, en koppel dan Frida.

Stap 2 — 30‑sekonde Frida Codeshare toetse

Probeer algemene drop‑in skripte voordat jy dieper delf:

  • anti-root-bypass.js
  • anti-frida-detection.js
  • hide_frida_gum.js

Voorbeeld:

frida -U -f com.example.app -l anti-frida-detection.js

Dit maak gewoonlik stubs vir Java root/debug-kontroles, proses-/diens-skanderings en native ptrace(). Nuttig op lig beskermde apps; geharde teikens mag pasgemaakte hooks benodig.

  • Codeshare: https://codeshare.frida.re/

Outomatiseer met Medusa (Frida framework)

Medusa bied 90+ kant-en-klare modules vir SSL unpinning, root/emulator detection bypass, HTTP comms logging, crypto key interception, en meer.

git clone https://github.com/Ch0pin/medusa
cd medusa
pip install -r requirements.txt
python medusa.py

# Example interactive workflow
show categories
use http_communications/multiple_unpinner
use root_detection/universal_root_detection_bypass
run com.target.app

Wenk: Medusa is uitstekend vir vinnige oorwinnings voordat jy custom hooks skryf. Jy kan ook modules cherry-pick en dit met jou eie scripts kombineer.

Stap 3 — Omseil init-time detectors deur later aan te heg

Baie detections loop slegs tydens process spawn/onCreate(). Spawn‑time injection (-f) of gadgets word gevang; deur later aan te heg ná die UI gelaai is, kan jy verbyglip.

# Launch the app normally (launcher/adb), wait for UI, then attach
frida -U -n com.example.app
# Or with Objection to attach to running process
aobjection --gadget com.example.app explore  # if using gadget

As dit werk, hou die sessie stabiel en gaan voort om kartering en stub-kontroles uit te voer.

Stap 4 — Karteer detectielogika via Jadx en string-soektog

Statische triage-sleutelwoorde in Jadx:

  • “frida”, “gum”, “root”, “magisk”, “ptrace”, “su”, “getprop”, “debugger”

Tipiese Java-patrone:

public boolean isFridaDetected() {
return getRunningServices().contains("frida");
}

Algemene APIs om te hersien/hook:

  • android.os.Debug.isDebuggerConnected
  • android.app.ActivityManager.getRunningAppProcesses / getRunningServices
  • java.lang.System.loadLibrary / System.load (native bridge)
  • java.lang.Runtime.exec / ProcessBuilder (probing commands)
  • android.os.SystemProperties.get (root/emulator heuristics)

Stap 5 — Runtime stubbing with Frida (Java)

Oorskryf pasgemaakte guards om veilige waardes terug te gee sonder repacking:

Java.perform(() => {
const Checks = Java.use('com.example.security.Checks');
Checks.isFridaDetected.implementation = function () { return false; };

// Neutralize debugger checks
const Debug = Java.use('android.os.Debug');
Debug.isDebuggerConnected.implementation = function () { return false; };

// Example: kill ActivityManager scans
const AM = Java.use('android.app.ActivityManager');
AM.getRunningAppProcesses.implementation = function () { return java.util.Collections.emptyList(); };
});

Triaging early crashes? Dump classes net voordat dit ophou om waarskynlike detection namespaces te identifiseer:

Java.perform(() => {
Java.enumerateLoadedClasses({
onMatch: n => console.log(n),
onComplete: () => console.log('Done')
});
});

Vinnige root-detektering stub voorbeeld (pas aan by teiken package/class names):

Java.perform(() => {
try {
const RootChecker = Java.use('com.target.security.RootCheck');
RootChecker.isDeviceRooted.implementation = function () { return false; };
} catch (e) {}
});

Log en neutraliseer verdagte metodes om die uitvoeringsvloei te bevestig:

Java.perform(() => {
const Det = Java.use('com.example.security.DetectionManager');
Det.checkFrida.implementation = function () {
console.log('checkFrida() called');
return false;
};
});

Bypass emulator/VM detection (Java stubs)

Algemene heuristieke: Build.FINGERPRINT/MODEL/MANUFACTURER/HARDWARE wat generic/goldfish/ranchu/sdk bevat; QEMU-artefakte soos /dev/qemu_pipe, /dev/socket/qemud; standaard MAC 02:00:00:00:00:00; 10.0.2.x NAT; ontbrekende telefonie/sensoren.

Vinnige spoof van Build-velde:

Java.perform(function(){
var Build = Java.use('android.os.Build');
Build.MODEL.value = 'Pixel 7 Pro';
Build.MANUFACTURER.value = 'Google';
Build.BRAND.value = 'google';
Build.FINGERPRINT.value = 'google/panther/panther:14/UP1A.231105.003/1234567:user/release-keys';
});

Vul aan met stubs vir lêer-bestaankontroles en identifiseerders (TelephonyManager.getDeviceId/SubscriberId, WifiInfo.getMacAddress, SensorManager.getSensorList) om realistiese waardes terug te gee.

SSL pinning bypass quick hook (Java)

Neutraliseer aangepaste TrustManagers en dwing permissiewe SSL contexts af:

Java.perform(function(){
var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
var SSLContext = Java.use('javax.net.ssl.SSLContext');

// No-op validations
X509TrustManager.checkClientTrusted.implementation = function(){ };
X509TrustManager.checkServerTrusted.implementation = function(){ };

// Force permissive TrustManagers
var TrustManagers = [ X509TrustManager.$new() ];
var SSLContextInit = SSLContext.init.overload('[Ljavax.net.ssl.KeyManager;','[Ljavax.net.ssl.TrustManager;','java.security.SecureRandom');
SSLContextInit.implementation = function(km, tm, sr){
return SSLContextInit.call(this, km, TrustManagers, sr);
};
});

Aantekeninge

  • Brei uit vir OkHttp: hook okhttp3.CertificatePinner en HostnameVerifier soos nodig, of gebruik ’n universele unpinning-skrip vanaf CodeShare.
  • Voer voorbeeld uit: frida -U -f com.target.app -l ssl-bypass.js --no-pause

OkHttp4 / gRPC / Cronet pinning (2024+)

Moderne stacks pin binne nuwer APIs (OkHttp4+, gRPC oor Cronet/BoringSSL). Voeg hierdie hooks by wanneer die basiese SSLContext hook vasloop:

Java.perform(() => {
try {
const Pinner = Java.use('okhttp3.CertificatePinner');
Pinner.check.overload('java.lang.String', 'java.util.List').implementation = function(){};
Pinner.check$okhttp.implementation = function(){};
} catch (e) {}

try {
const CronetB = Java.use('org.chromium.net.CronetEngine$Builder');
CronetB.enablePublicKeyPinningBypassForLocalTrustAnchors.overload('boolean').implementation = function(){ return this; };
CronetB.setPublicKeyPins.overload('java.lang.String', 'java.util.Set', 'boolean').implementation = function(){ return this; };
} catch (e) {}
});

As TLS steeds misluk, skakel oor na native en patch BoringSSL verifikasie-ingangspunte wat deur Cronet/gRPC gebruik word:

const customVerify = Module.findExportByName(null, 'SSL_CTX_set_custom_verify');
if (customVerify) {
Interceptor.attach(customVerify, {
onEnter(args){
// arg0 = SSL_CTX*, arg1 = mode, arg2 = callback
args[1] = ptr(0); // SSL_VERIFY_NONE
args[2] = NULL;  // disable callback
}
});
}

Stap 6 — Volg die JNI/native trail wanneer Java hooks misluk

Volg JNI entry points om native loaders en detection init te lokaliseer:

frida-trace -n com.example.app -i "JNI_OnLoad"

Vinnige inheemse triage van gebundelde .so-lêers:

# List exported symbols & JNI
nm -D libfoo.so | head
objdump -T libfoo.so | grep Java_
strings -n 6 libfoo.so | egrep -i 'frida|ptrace|gum|magisk|su|root'

Interactive/native reversing:

  • Ghidra: https://ghidra-sre.org/
  • r2frida: https://github.com/nowsecure/r2frida

Voorbeeld: neutraliseer ptrace om eenvoudige anti‑debug in libc te omseil:

const ptrace = Module.findExportByName(null, 'ptrace');
if (ptrace) {
Interceptor.replace(ptrace, new NativeCallback(function () {
return -1; // pretend failure
}, 'int', ['int', 'int', 'pointer', 'pointer']));
}

Sien ook: Reversing Native Libraries

Stap 7 — Objection patching (embed gadget / strip basics)

Wanneer jy repacking bo runtime hooks verkies, probeer:

objection patchapk --source app.apk

Aantekeninge:

  • Vereis apktool; maak seker jy gebruik ’n huidige weergawe vanaf die amptelike gids om bouprobleme te vermy: https://apktool.org/docs/install
  • Gadget injection maak instrumentation sonder root moontlik, maar kan steeds deur sterker init‑time checks opgespoor word.

Opsioneel, voeg LSPosed modules en Shamiko by vir sterker root hiding in Zygisk-omgewings, en kurateer die DenyList om child processes te dek.

Vir ’n volledige workflow wat script-mode Gadget-konfigurasie en die inboud van jou Frida 17+ agent in die APK insluit, sien:

Frida Tutorial — Self-contained agent + Gadget embedding

Verwysings:

  • Objection: https://github.com/sensepost/objection

Step 8 — Fallback: Patch TLS pinning for network visibility

As instrumentation geblokkeer is, kan jy steeds verkeer inspekteer deur pinning staties te verwyder:

apk-mitm app.apk
# Then install the patched APK and proxy via Burp/mitmproxy
  • Gereedskap: https://github.com/shroudedcode/apk-mitm
  • Vir netwerkkonfigurasie CA‑trust truuks (en Android 7+ gebruikers CA‑trust), sien:

Make APK Accept CA Certificate

Install Burp Certificate

Nuttige opdrag cheat‑sheet

# List processes and attach
frida-ps -Uai
frida -U -n com.example.app

# Spawn with a script (may trigger detectors)
frida -U -f com.example.app -l anti-frida-detection.js

# Trace native init
frida-trace -n com.example.app -i "JNI_OnLoad"

# Objection runtime
objection --gadget com.example.app explore

# Static TLS pinning removal
apk-mitm app.apk

Universele proxy forcing + TLS unpinning (HTTP Toolkit Frida hooks)

Moderne apps ignoreer dikwels stelselproxies en dwing verskeie lae van pinning af (Java + native), wat verkeersopname pynlik maak selfs met user/system CAs geïnstalleer. ’n Praktiese benadering is om universal TLS unpinning te kombineer met proxy forcing via kant-en-klare Frida hooks, en alles deur mitmproxy/Burp te stuur.

Workflow

  • Voer mitmproxy op jou host uit (of Burp). Verseker dat die toestel die host IP/poort kan bereik.
  • Laai HTTP Toolkit’s gekonsolideerde Frida hooks om beide TLS unpinning uit te voer en proxy gebruik af te dwing oor algemene stacks (OkHttp/OkHttp3, HttpsURLConnection, Conscrypt, WebView, ens.). Dit omseil CertificatePinner/TrustManager checks en oorskryf die proxy selectors, sodat verkeer altyd via jou proxy gestuur word selfs al skakel die app proxies eksplisiet af.
  • Begin die teiken-app met Frida en die hook script, en vang versoeke in mitmproxy.

Example

# Device connected via ADB or over network (-U)
# See the repo for the exact script names & options
frida -U -f com.vendor.app \
-l ./android-unpinning-with-proxy.js \
--no-pause

# mitmproxy listening locally
mitmproxy -p 8080

Aantekeninge

  • Kombineer met ’n stelselwye proxy via adb shell settings put global http_proxy <host>:<port> waar moontlik. Die Frida hooks sal proxygebruik afdwing selfs wanneer apps stelselinstellings omseil.
  • Hierdie tegniek is ideaal wanneer jy ’n MITM nodig het vir mobile-tot-IoT onboarding-vloeie waar pinning/proxy-omseiling algemeen is.
  • Hooks: https://github.com/httptoolkit/frida-interception-and-unpinning

Verwysings

Tip

Leer en oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer en oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Leer en oefen Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks