Android Anti-Instrumentation & SSL Pinning Bypass (Frida/Objection)

Tip

Leer en oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer en oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Leer en oefen Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks

Hierdie bladsy verskaf ’n praktiese werkvloei om dinamiese analise teen Android apps te herstel wat instrumentation opspoor/root‑blokkeer of TLS pinning afdwing. Dit fokus op vinnige triage, algemene opsporings en copy‑pastebare hooks/taktieke om dit te omseil sonder om te repak wanneer moontlik.

Opsporingsoppervlak (wat apps nagaan)

  • Root‑kontroles: su binary, Magisk paths, getprop values, algemene root‑pakkette
  • Frida/debugger‑kontroles (Java): Debug.isDebuggerConnected(), ActivityManager.getRunningAppProcesses(), getRunningServices(), scanning /proc, classpath, loaded libs
  • Inheemse anti‑debug: ptrace(), syscalls, anti‑attach, breakpoints, inline hooks
  • VroeĂ« init‑kontroles: Application.onCreate() of proses‑start hooks wat crash as instrumentation teenwoordig is
  • TLS pinning: custom TrustManager/HostnameVerifier, OkHttp CertificatePinner, Conscrypt pinning, native pins

Stap 1 — Vinnige wen: versteek root met Magisk DenyList

  • Skakel Zygisk in Magisk aan
  • Skakel DenyList aan, voeg die teiken‑pakket by
  • Herbegin en toets weer

Baie apps kyk net na voor die hand liggende aanwysers (su/Magisk paths/getprop). DenyList neutraliseer dikwels naĂŻef kontroles.

Verwysings:

  • Magisk (Zygisk & DenyList): https://github.com/topjohnwu/Magisk

Stap 2 — 30‑sekonde Frida Codeshare‑toetse

Probeer algemene drop‑in skripte voordat jy dieper delf:

  • anti-root-bypass.js
  • anti-frida-detection.js
  • hide_frida_gum.js

Voorbeeld:

frida -U -f com.example.app -l anti-frida-detection.js

Hierdie deaktiveer gewoonlik Java root/debug-kontroles, proses-/diens-skanderings en native ptrace(). Nuttig vir lig beskermde apps; geharde teikens mag maatgemaakte hooks benodig.

  • Codeshare: https://codeshare.frida.re/

Automatiseer met Medusa (Frida framework)

Medusa bied 90+ kant-en-klare modules vir SSL unpinning, root/emulator detection bypass, HTTP comms logging, crypto key interception, en meer.

git clone https://github.com/Ch0pin/medusa
cd medusa
pip install -r requirements.txt
python medusa.py

# Example interactive workflow
show categories
use http_communications/multiple_unpinner
use root_detection/universal_root_detection_bypass
run com.target.app

Wenk: Medusa is uitstekend vir vinnige oorwinnings voordat jy custom hooks skryf. Jy kan ook selektief modules kies en dit met jou eie scripts kombineer.

Stap 3 — Omseil init-time detectors deur laat aan te heg

Baie deteksies loop slegs tydens process spawn/onCreate(). Spawn‑time injection (-f) of gadgets word gevang; deur ná die UI gelaai is aan te heg kan dit verbyglip.

# Launch the app normally (launcher/adb), wait for UI, then attach
frida -U -n com.example.app
# Or with Objection to attach to running process
aobjection --gadget com.example.app explore  # if using gadget

As dit werk, hou die sessie stabiel en gaan voort om map- en stubkontroles uit te voer.

Step 4 — Kaart die detectielogika met Jadx en string hunting

Statiese triage-sleutelwoorde in Jadx:

  • “frida”, “gum”, “root”, “magisk”, “ptrace”, “su”, “getprop”, “debugger”

Tipiese Java-patrone:

public boolean isFridaDetected() {
return getRunningServices().contains("frida");
}

Algemene APIs om te hersien/hook:

  • android.os.Debug.isDebuggerConnected
  • android.app.ActivityManager.getRunningAppProcesses / getRunningServices
  • java.lang.System.loadLibrary / System.load (native bridge)
  • java.lang.Runtime.exec / ProcessBuilder (probing commands)
  • android.os.SystemProperties.get (root/emulator heuristics)

Stap 5 — Looptyd-stubbing met Frida (Java)

Oorskryf pasgemaakte guards om veilige waardes terug te gee sonder repacking:

Java.perform(() => {
const Checks = Java.use('com.example.security.Checks');
Checks.isFridaDetected.implementation = function () { return false; };

// Neutralize debugger checks
const Debug = Java.use('android.os.Debug');
Debug.isDebuggerConnected.implementation = function () { return false; };

// Example: kill ActivityManager scans
const AM = Java.use('android.app.ActivityManager');
AM.getRunningAppProcesses.implementation = function () { return java.util.Collections.emptyList(); };
});

Triagering van vroeë crashes? Dump classes net voordat die app doodgaan om waarskynlike deteksie namespaces te identifiseer:

Java.perform(() => {
Java.enumerateLoadedClasses({
onMatch: n => console.log(n),
onComplete: () => console.log('Done')
});
});

// Quick root detection stub example (adapt to target package/class names)
Java.perform(() => {
try {
const RootChecker = Java.use('com.target.security.RootCheck');
RootChecker.isDeviceRooted.implementation = function () { return false; };
} catch (e) {}
});

Log en neutraliseer verdagte metodes om die uitvoeringsvloei te bevestig:

Java.perform(() => {
const Det = Java.use('com.example.security.DetectionManager');
Det.checkFrida.implementation = function () {
console.log('checkFrida() called');
return false;
};
});

Bypass emulator/VM detection (Java stubs)

Algemene heuristieke: Build.FINGERPRINT/MODEL/MANUFACTURER/HARDWARE wat generic/goldfish/ranchu/sdk bevat; QEMU-artefakte soos /dev/qemu_pipe, /dev/socket/qemud; standaard MAC 02:00:00:00:00:00; 10.0.2.x NAT; ontbrekende telefonie/sensoren.

Quick spoof of Build fields:

Java.perform(function(){
var Build = Java.use('android.os.Build');
Build.MODEL.value = 'Pixel 7 Pro';
Build.MANUFACTURER.value = 'Google';
Build.BRAND.value = 'google';
Build.FINGERPRINT.value = 'google/panther/panther:14/UP1A.231105.003/1234567:user/release-keys';
});

Voeg stubs by vir lĂȘerbestaan-kontroles en identifiseerders (TelephonyManager.getDeviceId/SubscriberId, WifiInfo.getMacAddress, SensorManager.getSensorList) om realistiese waardes terug te gee.

SSL pinning bypass quick hook (Java)

Neutraliseer aangepaste TrustManagers en dwing permissiewe SSL-contexts af:

Java.perform(function(){
var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
var SSLContext = Java.use('javax.net.ssl.SSLContext');

// No-op validations
X509TrustManager.checkClientTrusted.implementation = function(){ };
X509TrustManager.checkServerTrusted.implementation = function(){ };

// Force permissive TrustManagers
var TrustManagers = [ X509TrustManager.$new() ];
var SSLContextInit = SSLContext.init.overload('[Ljavax.net.ssl.KeyManager;','[Ljavax.net.ssl.TrustManager;','java.security.SecureRandom');
SSLContextInit.implementation = function(km, tm, sr){
return SSLContextInit.call(this, km, TrustManagers, sr);
};
});

Aantekeninge

  • Brei uit vir OkHttp: hook okhttp3.CertificatePinner en HostnameVerifier soos nodig, of gebruik ’n universal unpinning script van CodeShare.
  • Voer voorbeeld uit: frida -U -f com.target.app -l ssl-bypass.js --no-pause

Stap 6 — Volg die JNI/native spoor wanneer Java hooks misluk

Spoor JNI entry points op om native loaders en detection init te lokaliseren:

frida-trace -n com.example.app -i "JNI_OnLoad"

Vinnige inheemse triage van ingeslote .so-lĂȘers:

# List exported symbols & JNI
nm -D libfoo.so | head
objdump -T libfoo.so | grep Java_
strings -n 6 libfoo.so | egrep -i 'frida|ptrace|gum|magisk|su|root'

Interaktiewe/native reversing:

  • Ghidra: https://ghidra-sre.org/
  • r2frida: https://github.com/nowsecure/r2frida

Voorbeeld: neutraliseer ptrace om eenvoudige anti‑debug in libc te oorwin:

const ptrace = Module.findExportByName(null, 'ptrace');
if (ptrace) {
Interceptor.replace(ptrace, new NativeCallback(function () {
return -1; // pretend failure
}, 'int', ['int', 'int', 'pointer', 'pointer']));
}

Sien ook: Reversing Native Libraries

Stap 7 — Objection patching (embed gadget / strip basics)

As jy repacking bo runtime hooks verkies, probeer:

objection patchapk --source app.apk

Aantekeninge:

  • Vereis apktool; maak seker van ’n huidige weergawe vanaf die amptelike gids om bouprobleme te voorkom: https://apktool.org/docs/install
  • Gadget injection enables instrumentation without root but can still be caught by stronger init‑time checks.

Opsioneel, voeg LSPosed modules en Shamiko by vir sterker root hiding in Zygisk environments, en stel die DenyList saam om child processes te dek.

Vir ’n volledige workflow insluitend script-mode Gadget configuration en die bundeling van jou Frida 17+ agent in die APK, sien:

Frida Tutorial — Self-contained agent + Gadget embedding

Verwysings:

  • Objection: https://github.com/sensepost/objection

Stap 8 — Fallback: Patch TLS pinning vir netwerk sigbaarheid

As instrumentation geblokkeer is, kan jy steeds verkeer ondersoek deur pinning staties te verwyder:

apk-mitm app.apk
# Then install the patched APK and proxy via Burp/mitmproxy
  • Gereedskap: https://github.com/shroudedcode/apk-mitm
  • Vir netwerkkonfigurasie CA‑trust-truuks (en Android 7+ user CA trust), sien:

Make APK Accept CA Certificate

Install Burp Certificate

Handige kommando cheat‑sheet

# List processes and attach
frida-ps -Uai
frida -U -n com.example.app

# Spawn with a script (may trigger detectors)
frida -U -f com.example.app -l anti-frida-detection.js

# Trace native init
frida-trace -n com.example.app -i "JNI_OnLoad"

# Objection runtime
objection --gadget com.example.app explore

# Static TLS pinning removal
apk-mitm app.apk

Universal proxy forcing + TLS unpinning (HTTP Toolkit Frida hooks)

Werksvloei

  • Voer mitmproxy op jou host uit (of Burp). Maak seker die toestel kan die host IP/poort bereik.
  • Laai HTTP Toolkit’s consolidated Frida hooks om TLS te unpin en proxygebruik af te dwing oor algemene stacks (OkHttp/OkHttp3, HttpsURLConnection, Conscrypt, WebView, ens.). Dit omseil CertificatePinner/TrustManager-kontroles en oorskryf proxy selectors, sodat verkeer altyd via jou proxy gestuur word, selfs as die app eksplisiet proxies deaktiveer.
  • Begin die teiken-app met Frida en die hook script, en vang versoeke in mitmproxy op.

Voorbeeld

# Device connected via ADB or over network (-U)
# See the repo for the exact script names & options
frida -U -f com.vendor.app \
-l ./android-unpinning-with-proxy.js \
--no-pause

# mitmproxy listening locally
mitmproxy -p 8080

Aantekeninge

  • Kombineer dit met ’n stelselwye proxy via adb shell settings put global http_proxy <host>:<port> wanneer moontlik. Die Frida hooks sal proxygebruik afdwing selfs wanneer apps stelselinstellings omseil.
  • Hierdie tegniek is ideaal wanneer jy ’n MITM nodig het vir mobile-na-IoT onboarding-vloeie waar pinning/proxy-omseiling algemeen is.
  • Hooks: https://github.com/httptoolkit/frida-interception-and-unpinning

Verwysings

Tip

Leer en oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer en oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Leer en oefen Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks