miticollo

Here, I'll show you how to compile Frida for both rootfull and rootless jailbreaks.

TL;DR

On Dopamine/Fugu15 Max or palera1n you can add my repo (open the link in your favorite browser on your jailbroken iDevice).

The DEBs you will install are build using the following instructions.

Update 2024-02-29

miticollo

import threading

from frida_tools.application import Reactor

import frida


class Application:
    def __init__(self):
        self._stop_requested = threading.Event()

miticollo

#!/usr/bin/env python3

import signal
import sys

import _frida
import frida
from frida.core import Session, Script, Device, ScriptMessage

miticollo

#!/usr/bin/env python3
import signal
import sys
import threading
from typing import List, Tuple

import _frida
import frida
from frida.core import Session, Device, Script

miticollo

#!/usr/bin/env python3
import json

import frida
from frida.core import Device, Session, Script, ScriptExportsSync

compiler: frida.Compiler = frida.Compiler()
compiler.on("diagnostics", lambda diag: print(f"on_diagnostics: {diag}"))
bundle: str = compiler.build('permissions.ts', compression='terser')

miticollo

#!/usr/bin/env python3
import signal
import threading

import _frida
import frida
from frida.core import Device, Session, Script, ScriptMessage

signal_event: threading.Event = threading.Event()

miticollo

Here you can find a list of panic log and how to get them using frida REPL:

1. NULL.add(1).readUtf8String()

miticollo

/*
 * This is example shows how to use CModule, Typescript, and ObjC.
 * It lets us see what files are opened by the target process (`getpid()`).
 * It is lsof for iOS but implemented in frida.
 *
 * How to run?
 *  frida -U -n <target> -l proc.ts
 * In REPL:
 *  rpc.exports.fds();
 *

miticollo

const GRDB_PATH: string = Process.enumerateModules().find((x: Module): boolean => x.name === "GRDB")!.path;

declare let Swift: any;

if (Swift.available) {
    // Tested on iOS 14.4.2 and iOS 15.1b1.
    const mangled: string = "$s4GRDB8DatabaseC13usePassphraseyy10Foundation4DataVKF";
    const demangled: NativePointer = Swift.api.swift_demangle(Memory.allocUtf8String(mangled), mangled.length, NULL, NULL, 0);
    console.log(`Function hooked: ${demangled.readUtf8String()}`);

miticollo

const SYSTEMCONFIGURATION_PATH = '/System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration';
const CAPTIVENETWORK_PATH = '/System/Library/PrivateFrameworks/CaptiveNetwork.framework/CaptiveNetwork';
const FOUNDATION_PATH = '/System/Library/Frameworks/Foundation.framework/Foundation';

Interceptor.attach(Module.getExportByName(SYSTEMCONFIGURATION_PATH, "CNCopyCurrentNetworkInfo"), {
    onEnter(args) {
        console.log("onEnter CNCopyCurrentNetworkInfo");
    },
    onLeave(retval) {
        console.log("onLeave CNCopyCurrentNetworkInfo");