oleavr

frida-gum-example.c

$ clang -Wall -Os -pipe -g3 frida-gum-example.c -o frida-gum-example -L. -lfrida-gum -lresolv -Wl,-dead_strip -Wl,-no_compact_unwind
$ ./frida-gum-example
[*] open("/etc/hosts")
[*] close(3)
[*] open("/etc/fstab")
[*] close(-1)
[*] listener got 4 calls

[*] listener still has 4 calls

oleavr

var frida = require('frida');

frida.attach('cat')
.then(function (session) {
  console.log('attached:', session);
  return session.createScript(
      'function onMessage(message) {' +
        'send({ name: "pong", payload: message });' +
        'recv(onMessage);' +
      '}' +

oleavr

#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <sys/syspage.h>

int
main(int argc, char *argv[])
{
	struct asinfo_entry *entries = SYSPAGE_ENTRY(asinfo);
	size_t count = SYSPAGE_ENTRY_SIZE(asinfo) / sizeof(struct asinfo_entry);

oleavr

const Java = require('frida-java-bridge');
const { getApi, withRunnableArtThread, ArtStackVisitor, translateMethod } = require('frida-java-bridge/lib/android');

Java.perform(() => {
  const AccountManager = Java.use('android.accounts.AccountManager');

  const m = AccountManager.getAccounts;
  m.implementation = function (...args) {
    console.log('getAccounts() called from: ' + JSON.stringify(captureBacktrace(), null, 2));
    return m.apply(this, args);

oleavr

[CCode (cheader_filename = "frida-core.h", cprefix = "Frida", lower_case_cprefix = "frida_")]
namespace Frida {
	public static void init ();
	public static void shutdown ();
	public static void deinit ();
	public static unowned GLib.MainContext get_main_context ();

	public class DeviceManager : GLib.Object {
		public DeviceManager ();

oleavr

Install Node.js 5.x, then:

npm install frida co uuid

and run:

node app.js

oleavr

const THUMB_HOOK_REDIRECT_SIZE = 8;
const THUMB_BIT_REMOVAL_MASK = ptr(1).not();

const trampolines: NativePointer[] = [];
const replacements: NativePointer[] = [];

export function makeTrampoline(target: NativePointer): NativePointer {
    const targetAddress = target.and(THUMB_BIT_REMOVAL_MASK);
    const trampoline = Memory.alloc(Process.pageSize);

oleavr

'use strict';

var TrustManager;
var manager;

Java.perform(function () {
  var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');

  TrustManager = Java.registerClass({
    name: 'com.example.TrustManager',

oleavr

'use strict';

const slowCallback = new NativeCallback(value => {
  console.log('slowCallback hit');
  return 43;
}, 'int', ['int']);

const fastCallback = Memory.alloc(Process.pageSize);
Memory.patchCode(fastCallback, 128, code => {
  const cw = new X86Writer(code, { pc: fastCallback });

oleavr

All config.mk features enabled on linux-armhf

3.8M frida-inject
2.6M frida-portal
3.2M frida-server

 15M frida-agent.so
 15M frida-gadget.so