Frida, Burp and Reverse Engineering Lab

Frida BasicsSearch on YouTubeBookmarkSaved

Frida is an open-source dynamic instrumentation toolkit. It injects custom JavaScript into running apps (Android, iOS, Windows, macOS, Linux). You can monitor, trace or change their behaviour in real time, without the source code and without recompiling.

Emulator SetupSearch on YouTubeBookmarkSaved

1. Open Android Studio, then Device Manager, then Create Device.
2. Select the Pixel 4 hardware profile, API 29.
3. On the system image screen, choose a Google APIs image, not a Google Play image.
4. Finish the wizard and boot the AVD.

Frida Server SetupSearch on YouTubeBookmarkSaved

Download frida-serverSearch on YouTubeBookmarkSaved

1. Find the emulator's CPU architecture:

adb shell getprop ro.product.cpu.abi      # e.g. x86_64

2. From https://github.com/frida/frida/releases, download the matching server. The guide uses frida-server-17.8.0-android-x86_64.xz. (Other builds: android-arm, android-arm64, android-x86.)
3. Extract the .xz archive. Optionally rename the binary to frida-server.

xz -d frida-server-17.8.0-android-x86_64.xz        # or use 7-Zip on Windows
mv frida-server-17.8.0-android-x86_64 frida-server

Verify root on the deviceSearch on YouTubeBookmarkSaved

adb shell
su
whoami          # expected output: root

Push and run frida-serverSearch on YouTubeBookmarkSaved

adb push Downloads/frida-server/frida-server /data/local/tmp

adb shell
su
chmod 755 /data/local/tmp/frida-server
/data/local/tmp/frida-server &

Leave this shell running (or keep the & to background it) for as long as Frida must stay attached. /data/local/tmp is used because it is writable and allows executables.

Install frida-tools on the hostSearch on YouTubeBookmarkSaved

In a separate terminal on the laptop:

pip install frida-tools
frida --version
adb shell /data/local/tmp/frida-server --version

Useful Frida commandsSearch on YouTubeBookmarkSaved

frida -U -f jakhar.aseem.diva -l Downloads/frida-server/hook-sharedprefs.js

Getting hook scripts from Frida CodeShareSearch on YouTubeBookmarkSaved

Generic scripts come from Frida CodeShare (https://codeshare.frida.re/). Custom scripts from other repos also work.

1. Search CodeShare for the action you need, for example "root detection bypass" or "antiroot".
2. Open one result and copy the code.
3. Paste it into a text file and save it with a .js extension and a meaningful name.
4. Pass it to frida with -l.

hook-sharedprefs.js was made this way from @ninjadiary/frinja---sharedpreferences.

Target and Practice APKsSearch on YouTubeBookmarkSaved

DIVA: SharedPreferences hookingSearch on YouTubeBookmarkSaved

Spawn DIVA with the SharedPreferences hook. Open the Insecure Data Storage challenge, enter credentials and save. The stored values appear in the Frida terminal.

frida -U -f jakhar.aseem.diva -l Downloads/frida-server/hook-sharedprefs.js

Damn Vulnerable Bank: chained detection bypassSearch on YouTubeBookmarkSaved

The app shows warnings (device is rooted, Frida detected, emulator detected) and does not open. Chain several bypass scripts with repeated -l flags:

frida -U -l C:/Users/<Username>/Downloads/frida-server/frida-antiroot.js -l C:/Users/<Username>/Downloads/frida-server/frida-detect-bypass.js -f com.app.damnvulnerablebank

• frida-antiroot.js comes from CodeShare @dzonerzy/fridantiroot.
• frida-detect-bypass.js comes from the TrustedSec blog "Android Hacking for Beginners".

Burp Suite SetupSearch on YouTubeBookmarkSaved

Proxy listenerSearch on YouTubeBookmarkSaved

1. Download and install Burp Suite on Windows.
2. Go to Proxy, Proxy settings, select the listener and click Edit.
3. Set Bind to port: 8080.
4. Under Binding, choose All interfaces (a specific interface also works, but All interfaces is the safe default).

Point the emulator at BurpSearch on YouTubeBookmarkSaved

10.0.2.2 is the special address the Android emulator uses to reach the host machine. The guide says to do both options.

Option A, Wi-Fi settings: long-press the active Wi-Fi network, Modify network, Proxy, Manual. Hostname 10.0.2.2, port 8080. Save.

Option B, adb:

adb shell settings put global http_proxy 10.0.2.2:8080

To remove the proxy later, set it back with adb shell settings put global http_proxy :0.

Export and install the Burp CA certificateSearch on YouTubeBookmarkSaved

1. In Burp, export the CA certificate in DER format and save it (the guide names it ca-cert.crt here and pushes cert-der.crt below; use one name consistently).
2. Before installing it, browse to any HTTPS page on the emulator. The connection fails. This confirms the proxy is active but not yet trusted.
3. Push the certificate:

adb push Downloads/frida-server/cert-der.crt /sdcard/Download
adb push Downloads/frida-server/cert-der.crt /data/local/tmp      # needed for certain apps; do both to be safe

4. On the emulator: Settings, Security, Encryption & credentials, Install a certificate. Choose the file and confirm Install anyway.

The copy in /data/local/tmp is what Frida certificate-injection scripts usually read.

Verify interceptionSearch on YouTubeBookmarkSaved

1. Keep Intercept off. Browse any page on the emulator.
2. In Burp, open Proxy, HTTP history. The requests appear.

Keep Intercept off for normal browsing. With Intercept on, every request must be forwarded by hand. That suits step-through debugging but slows down general review.

SSL Pinning BypassSearch on YouTubeBookmarkSaved

Certificate (SSL) pinning means the app trusts only a specific certificate or public key built into it. It ignores the user-installed Burp CA. So pinned requests fail through Burp even after the CA is installed. Frida hooks the pinning checks and makes them pass.

Pinning demo appSearch on YouTubeBookmarkSaved

The app has one button per request type. Examples: Plain HTTP, Plain ignore-proxy HTTP, Unpinned, Unpinned WebView, Unpinned HTTP/3, Config-pinned, Context-pinned, OkHttp pinned, Volley pinned, TrustKit pinned, Native CT, Appmattus CT.

1. With Burp as the device proxy, tap the unpinned and pinned request buttons. Note which succeed and which fail.
2. Run the bypass:

frida -U -l C:/Users/<Username>/Downloads/frida-server/ssl-pinning-bypass.js -f tech.httptoolkit.pinning_demo

3. Tap the pinned buttons again and compare Burp's HTTP history. Before the bypass, pinned requests do not appear in Burp. After it, they do.

ssl-pinning-bypass.js is CodeShare's @pcipolloni/universal-android-ssl-pinning-bypass-with-frida.

The same script works on AndroGoat:

frida -U -l C:/Users/<Username>/Downloads/frida-server/ssl-pinning-bypass.js -f owasp.sat.agoat

Full bypass with HTTP Toolkit scriptsSearch on YouTubeBookmarkSaved

For the pinning demo to work completely, use the scripts from https://github.com/httptoolkit/frida-interception-and-unpinning. Clone or download the repo. You need:

• config.js
• native-connect-hook.js
• native-tls-hook.js
• in the android/ folder: android-proxy-override.js, android-system-certificate-injection.js, android-certificate-unpinning.js, android-certificate-unpinning-fallback.js

Edit config.js: set the IP to 10.0.2.2 and the port to 8080. Paste the Burp certificate contents in PEM format into the place provided. Save.

Then run (the handout's command, cleaned up; it had a stray duplicate -l):

frida -U \
  -l config.js \
  -l native-connect-hook.js \
  -l native-tls-hook.js \
  -l android/android-proxy-override.js \
  -l android/android-system-certificate-injection.js \
  -l android/android-certificate-unpinning.js \
  -l ssl-pinning-bypass.js \
  -l android/android-disable-flutter-certificate-pinning.js \
  -l android/android-certificate-unpinning-fallback.js \
  -f tech.httptoolkit.pinning_demo

Further practiceSearch on YouTubeBookmarkSaved

Once Frida, Burp and the rooted emulator work end to end, reuse the workflow on other apps. The guide suggests mParivahan and Aarogya Setu for traffic analysis and detection-bypass practice.

Objection (not in the handouts)Search on YouTubeBookmarkSaved

objection is a runtime exploration tool built on Frida. The handouts do not use it, but it does the same bypasses with one command each. It needs the same frida-server running.

pip install objection
objection -g <package> explore                 # attach to the app
android sslpinning disable                     # inside the objection shell
android root disable
android hooking list activities

Reverse Engineering SetupSearch on YouTubeBookmarkSaved

Java and Android StudioSearch on YouTubeBookmarkSaved

1. Open cmd and type javac. If it is not recognised, install the Oracle JDK and set the environment variables.
2. Install Android Studio with default options (choose Standard).
3. Add the adb path to the PATH variable. It is usually C:\Users\<user>\AppData\Local\Android\Sdk\platform-tools.

Apktool install (Windows)Search on YouTubeBookmarkSaved

From https://apktool.org/docs/install/:

1. Download the Windows wrapper script (save the link as apktool.bat).
2. Download the latest Apktool jar.
3. Rename the jar to apktool.jar.
4. Move apktool.jar and apktool.bat to C:\Windows. Or put both in any folder (for example one on the desktop) and add that folder to the PATH.
5. Run apktool from a command prompt to test.

Genymotion emulatorSearch on YouTubeBookmarkSaved

• Download Genymotion desktop (choose the version without VirtualBox if a VM tool already exists). Install with defaults; a restart may be needed.
• Create an account, choose personal use.
• Create a device: prefer Google Pixel with Android 11 (to get root privilege), network mode NAT.

Apktool: Decompile, Modify, RebuildSearch on YouTubeBookmarkSaved

The exercise uses a Simplecalculator APK.

apktool d simplecalculator.apk       # disassemble: decodes resources and smali
# edit smali or XML files, e.g. smali_classes3/com/atilsamancioglu/simplecalculator/
apktool b simplecalculator           # rebuild: output in simplecalculator/dist/

• apktool d "baksmalis" each classes*.dex into smali folders and decodes AndroidManifest.xml and resources.
• apktool b "smalis" the folders back into .dex files and builds the APK into dist/.

The rebuilt APK will not install, because it is not signed. Uninstall the old app first, then sign the new APK.

Signing the APKSearch on YouTubeBookmarkSaved

Add the build-tools folder (for zipalign) to PATH, for example C:\Users\<user>\AppData\Local\Android\Sdk\build-tools\35.0.0. Use a new cmd window.

# 1. align the APK
zipalign -v 4 dist\simplecalculator.apk dist\zipaligned_simplecal.apk

# 2. create a signing key (one time)
keytool -genkey -v -keystore mykeystore.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000

# 3. sign with v1 and v2 schemes
apksigner sign --ks mykeystore.keystore --v1-signing-enabled true --v2-signing-enabled true dist\zipaligned_simplecal.apk

# 4. verify the signature
apksigner verify dist\zipaligned_simplecal.apk

# 5. install the modified app
adb install dist\zipaligned_simplecal.apk

JADX: Java Source from an APKSearch on YouTubeBookmarkSaved

1. From https://github.com/skylot/jadx/releases, download jadx-1.5.0.zip and jadx-gui-1.5.0-with-jre-win.zip.
2. Extract both (for example into a jadx folder on the desktop).
3. Run the jadx-gui exe and open the APK to browse its classes, manifest and resources.
4. To get the source as a project folder, open cmd in jadx's bin folder (put the APK there) and run:

jadx -d foldername myapp.apk
# or
jadx myapp.apk          # creates a folder named after the APK

The Java files are under <folder>\sources\<package path>, for example simplecalculator\sources\com\atilsamancioglu\simplecalculator.

Cursor IDESearch on YouTubeBookmarkSaved

Install Cursor (the AI code editor) and sign in. Open the project folder that jadx produced. Select a file and ask it to explain the code.

The handout also points to a banking-fraud malware APK on GitHub for reverse engineering practice. It is live malware: analyse it only inside an isolated emulator.

Reverse Engineering WorkflowSearch on YouTubeBookmarkSaved

Quick self-testSearch on YouTubeBookmarkSaved