Android Anti-Instrumentation & SSL Pinning Bypass (Frida/Objection)

Reading time: 7 minutes

tip

Leer en oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer en oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Leer en oefen Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks

Hierdie bladsy verskaf 'n praktiese werkvloei om dynamic analysis teen Android-apps te herstel wat instrumentation opspoor/root‑blokkeer of TLS pinning afdwing. Dit fokus op vinnige triage, algemene opsporings, en copy‑pasteable hooks/taktieke om dit te omseil sonder om te repak waar moontlik.

Detection Surface (what apps check)

  • Root checks: su binary, Magisk paths, getprop values, common root packages
  • Frida/debugger checks (Java): Debug.isDebuggerConnected(), ActivityManager.getRunningAppProcesses(), getRunningServices(), scanning /proc, classpath, loaded libs
  • Native anti‑debug: ptrace(), syscalls, anti‑attach, breakpoints, inline hooks
  • Early init checks: Application.onCreate() or process start hooks that crash if instrumentation is present
  • TLS pinning: custom TrustManager/HostnameVerifier, OkHttp CertificatePinner, Conscrypt pinning, native pins

Step 1 — Quick win: hide root with Magisk DenyList

  • Skakel Zygisk in Magisk aan
  • Skakel DenyList aan, voeg die teikenpakket by
  • Herbegin en toets weer

Baie apps kyk net na voor die hand liggende aanwysers (su/Magisk paths/getprop). DenyList neutraliseer dikwels naĂŻewe kontroles.

References:

  • Magisk (Zygisk & DenyList): https://github.com/topjohnwu/Magisk

Step 2 — 30‑second Frida Codeshare tests

Probeer algemene drop‑in skripte voordat jy dieper delf:

  • anti-root-bypass.js
  • anti-frida-detection.js
  • hide_frida_gum.js

Example:

bash
frida -U -f com.example.app -l anti-frida-detection.js

Hierdie vervang gewoonlik Java root/debug checks, process/service scans en native ptrace(). Nuttig op lig beskermde apps; geharde teikens mag aangepaste hooks nodig hĂȘ.

  • Codeshare: https://codeshare.frida.re/

Stap 3 — Om init-time detectors te omseil deur laat aan te heg

Baie deteksies hardloop slegs tydens process spawn/onCreate(). Spawn‑time injection (-f) of gadgets word gevang; aanheg nadat die UI gelaai is kan verbyglip.

bash
# Launch the app normally (launcher/adb), wait for UI, then attach
frida -U -n com.example.app
# Or with Objection to attach to running process
aobjection --gadget com.example.app explore  # if using gadget

As dit werk, hou die sessie stabiel en gaan voort om map- en stub-kontroles uit te voer.

Stap 4 — Kaart deteksielogika via Jadx en string hunting

Statiese triage-sleutelwoorde in Jadx:

  • "frida", "gum", "root", "magisk", "ptrace", "su", "getprop", "debugger"

Tipiese Java-patrone:

java
public boolean isFridaDetected() {
return getRunningServices().contains("frida");
}

Algemene APIs om te hersien/hook:

  • android.os.Debug.isDebuggerConnected
  • android.app.ActivityManager.getRunningAppProcesses / getRunningServices
  • java.lang.System.loadLibrary / System.load (native bridge)
  • java.lang.Runtime.exec / ProcessBuilder (probing commands)
  • android.os.SystemProperties.get (root/emulator heuristics)

Stap 5 — Runtime stubbing with Frida (Java)

Oorskryf aangepaste guards om veilige waardes terug te gee sonder repacking:

js
Java.perform(() => {
const Checks = Java.use('com.example.security.Checks');
Checks.isFridaDetected.implementation = function () { return false; };

// Neutralize debugger checks
const Debug = Java.use('android.os.Debug');
Debug.isDebuggerConnected.implementation = function () { return false; };

// Example: kill ActivityManager scans
const AM = Java.use('android.app.ActivityManager');
AM.getRunningAppProcesses.implementation = function () { return java.util.Collections.emptyList(); };
});

Hantering van vroeë ineenstortings? Dump classes net voordat dit ineenstort om waarskynlike detection namespaces op te spoor:

js
Java.perform(() => {
Java.enumerateLoadedClasses({
onMatch: n => console.log(n),
onComplete: () => console.log('Done')
});
});

Skryf na die log en neutraliseer verdagte metodes om die uitvoeringsvloei te bevestig:

js
Java.perform(() => {
const Det = Java.use('com.example.security.DetectionManager');
Det.checkFrida.implementation = function () {
console.log('checkFrida() called');
return false;
};
});

Step 6 — Volg die JNI/native spoor wanneer Java hooks misluk

Spoor JNI entry points op om native loaders en detection init te lokaliseer:

bash
frida-trace -n com.example.app -i "JNI_OnLoad"

Vinnige inheemse triage van ingeslote .so-lĂȘers:

bash
# List exported symbols & JNI
nm -D libfoo.so | head
objdump -T libfoo.so | grep Java_
strings -n 6 libfoo.so | egrep -i 'frida|ptrace|gum|magisk|su|root'

Interaktiewe/native reversing:

  • Ghidra: https://ghidra-sre.org/
  • r2frida: https://github.com/nowsecure/r2frida

Voorbeeld: neutriseer ptrace om eenvoudige anti‑debug in libc te omseil:

js
const ptrace = Module.findExportByName(null, 'ptrace');
if (ptrace) {
Interceptor.replace(ptrace, new NativeCallback(function () {
return -1; // pretend failure
}, 'int', ['int', 'int', 'pointer', 'pointer']));
}

Sien ook: Reversing Native Libraries

Stap 7 — Objection patching (embed gadget / strip basics)

Wanneer jy repacking bo runtime hooks verkies, probeer:

bash
objection patchapk --source app.apk

Aantekeninge:

  • Vereis apktool; verseker 'n huidige weergawe vanaf die amptelike gids om bouprobleme te vermy: https://apktool.org/docs/install
  • Gadget injection stel instrumentation sonder root in staat, maar kan steeds deur sterker init‑time checks opgespoor word.

Verwysings:

  • Objection: https://github.com/sensepost/objection

Stap 8 — Valopsie: Patch TLS pinning vir netwerk‑sigbaarheid

As instrumentation geblokkeer is, kan jy nog steeds verkeer inspekteer deur pinning staties te verwyder:

bash
apk-mitm app.apk
# Then install the patched APK and proxy via Burp/mitmproxy
  • Gereedskap: https://github.com/shroudedcode/apk-mitm
  • Vir netwerkkonfigurasie CA‑trust truuks (en Android 7+ user CA trust), sien:

Make APK Accept CA Certificate

Install Burp Certificate

Handige opdrag-snelverwysing

bash
# List processes and attach
frida-ps -Uai
frida -U -n com.example.app

# Spawn with a script (may trigger detectors)
frida -U -f com.example.app -l anti-frida-detection.js

# Trace native init
frida-trace -n com.example.app -i "JNI_OnLoad"

# Objection runtime
objection --gadget com.example.app explore

# Static TLS pinning removal
apk-mitm app.apk

Wenke & waarskuwings

  • Gee voorkeur aan late attach bo spawn wanneer apps by opstart crash
  • Sommige detecties word weer uitgevoer in kritieke flows (e.g., payment, auth) — hou hooks aktief tydens navigasie
  • Meng static en dynamic: string hunt in Jadx om klasse te kortlys; dan hook methods om by runtime te verifieer
  • Versterkte apps kan packers en native TLS pinning gebruik — verwag om native code te reverseer

Verwysings

tip

Leer en oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer en oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Leer en oefen Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks