Bypassing Frida detection in Android
HTML-код
- Опубликовано: 23 ноя 2024
- #frida #rootdetection #fridadetection #android #pentest #r2pay
Hello everyone, in this video we are going to learn some new techniques which are used in android app for detecting frida based on some frida artifacts in the memory and filesystem.
For learning purpose we have used the application from MSTG crackme i.e r2pay.
You can download this app directly from their github page: github.com/OWA...
It has lot of detections like root detection, frida detection, hook detection for protecting the app from being reversed. This app uses libc functions to detect 2 artifacts one is "/proc/self/task/*/status" and the other is "/proc/self/fd/*".
As always feel free to comment down below in case you have any queries and i will reply as soon as i can.
Also, dont forget to hit a like button and subscribe to this channel to show your support. You can also follow us on twitter at @SecFatal.
Best Frida tutorial I have found till this date. Loved it. Please make more videos on Frida
Awesome info, looking forward to your next video! Already subscribed!
Thanks for the sub!
@@fatalsecsir, can you make video why we can't inject Frida gadget in it..
Would be really helpful if you could share resources to get deeper understanding of this. How to use Frida apis and stuff.
You can get started with this resource it’s very good and useful.
learnfrida.info
upload more quality content, subscribed / liked
Thanks, sure more contents are coming soon.
Hi brother, Have you seen this error in Frida? "Failed to enumerate processes: unable to run ptrace pokedata: I/O"
Are you using a custom rom?
@@fatalsec Yes, android 14 - motorola g53
@@fatalsec
I would like private mentoring, how can I get in touch?
This is physical rooted device? I've heard frida doesn't works normally with emulators
Hy bruh ..that was sooo good like your all other videos, Btw i would like to know what should i refer for making my own custom frida scripts?? As of now,all i do is just copying someone else' scripts from internet..😂.. I just wanted make my own frida scripts (I have the basics of JS coding). Also i would suggest you to share the frida scripts that you are making for your videos, just under their description section.
Hi, thanks for the suggestion. I have already started maintaining a repository:
github.com/fatalSec
Good presentation. Looking forward for next content
Thanks for your feedback.
Hey! Awesome videos thanks ! I’m trying to adapt your method on other apps unfortunately I’m not able to see the lib where the error come from, I don’t have the same stack trace as yours. Mine is juste Java runtime stuff and i don’t have the backtrace at the end for example. Do you have any clues why ?
Hi, this could be because there are no native libraries present in the app and the detection is being done on the java layer itself. You can use the Process.setExceptionHandler() to catch exceptions and backtrace from there.
Fantastic video. Thanks🙏
unfortunatly this doesnt work for all apps. frida is still being detected
Yes, there are many ways to detect frida and every app is different. Until unless they are using the same protection libraries. So you have to understand the concept and work your way through it.
Great informative video
Thanks
Thankyou ! For sharing the knowledge.
Please upload more about Frida...
Sure, more videos are coming soon.
sir do you have your own courses for your videos or only release here in youtube
No courses yet. But I do provide one to one trainings. If you are interested you can contact me on: secfatal@proton.me
@@fatalsec i have left you a message sir
Keep the good work
Well presented 😊
Thanks man
Hi can you share the frida detection logic used in the app
You mean the java/native code used to detect the logic?
@@fatalsec yeah the logic you are trying to bypass
Very useful video sir ............ Can you kill resso manually latest version
You can connect with me on telegram to discuss more in detail. Are you on telegram?
@@fatalsec yes
Amazing video :)
Thanks
very helpful
Very good, my friend.
Thanks
super fucking sueful thanks a ton
What is the android version of the emulator ?
This is google pixel 4 running android 11.
@@fatalsec Thank you, can you share your telegram ID?
Can it crack anti frida libdexprotector?
Well not out of the box. I am sure there are other checks as well in libdexprptector. You can try using these techniques and try to bypass.
Yes libxexrpotector checks on the cmdline, I tried the hex patch on the frida server lib tried to change the main name entered on the cmdline and it worked, so in conclusion the check is on the cmdline, but the lib is obscured so it's difficult.
@@fatalsec Can we continue chatting on telegram?
Yes, let me know your telegram ID I will ping you.
@@fatalsec @ibadifal
Amazing 🤩
Is this mobxeler u r using?
No, it’s my own customised Kali machine
Learn Course full Frida for android
amazing content i love it
Thank you! More content is on the way. Stay tuned.
Bro it shows failed to spawn: need gadget to attach with jailed Android. What should i do??
It seems your frida server is not running on the device. Make sure that frida server is running as root.
@@fatalsec drive.google.com/file/d/1kbnsXhj5iNIOrOfqcnLR35HOMrFGX_6S/view?usp=drivesdk here is the problem bro. I have installed server&gadget both on the emulator /data/local/tmp and granted chmod permission. But still facing the problem.
Bro you're Indian na?
Bhai Please Hindi Me Video Banao.... 😭 English Barrier ban chuki hai coding sikhne me.
Jarur bhai kyu nahi! Hindi me b start karenge jaldi.
Accha😁😆😁😆😁😆😁😆😁😆😁
At backtrace it showing /system/lib/libhoudini[dot]so and also it showing nothing on interceptor script after executing I am using genymotion emulator android 8 and Frida 16.0.8
Can I connect with you on telegram?
It might be possible that the app is having emulator detection and when you are running it in emulator that detection is causing this crash, but I cannot say much without looking at the complete backtrace.
I can share full backtrace can I connect with you in telegram?