Hooking Native Android Methods with Frida

In this video, we use Frida hooking to intercept native Android methods after they have been loaded into the runtime. We write a custom script that uses Interceptor.attach to run code when the native method is invoked.
---
Timestamps:
00:00 Intro
00:50 Grabbing Sample
01:32 Looking at Native Libs
02:51 Emulation Time!
06:10 Attaching Frida
07:36 Enumerating Imports and Exports
09:45 Scripting
16:05 Intercepting Native Binary
20:20 Explaining the Interceptor
22:20 Exploring Method Names in Ghidra
25:30 Running with Hooking Script
28:05 Method order is Important!
30:06 One more time!
30:45 Recap
---
Links Mentioned in Video:
Frida:
github.com/frida/frida
Redroid:
github.com/remote-android/red...
Scrcpy:
github.com/Genymobile/scrcpy
---
Malware Examined in the video (Xloader):
sha256:ada2808ef254c39e70f74c93c7fd3b7f458ea439beebfc1520650fd0e3e34990
MalwareBazaar Link:
bazaar.abuse.ch/sample/ada280...
---
laurieWIRED Twitter:
/ lauriewired
laurieWIRED Website:
lauriewired.com
laurieWIRED Github:
github.com/LaurieWired
laurieWIRED HN:
news.ycombinator.com/user?id=...
laurieWIRED Reddit:
/ lauriewired

[@lxma]

awesome video, thanks for sharing! all of your videos have great production quality and are really informative. you deserve way more subscribers!

[@PixelHamster]

Thanks these videos were incredibly helpful

[@itshoitshoify]

Great content. Thank you! 👍🏻

[@rokis2011]

thanks for explaining, good vids. Keep up

[@sudoalex]

Underrated video 🎉

[@Me.n_n]

Great ❤,,more videos like this 😊

[@katonurlap]

Love your vids :3

[@user-cr9ix2mg5u]

cool vid! can this be used for windows java applications/games to hook interpreted/compiled methods as well from a c++ dll? (using frida C api)

[@0xPanda1]

Thank u very informative

[@叵]

Hello,
Do you know if it is possible to inject a WebView (or any other type of GUI) inside the Frida script so the user of the modified version will be able to change values of hooked functions when the APK is built using Objection?

[@mahdivazhir1834]

Very good thanks

[@hollowgroundxX]

Your reverse engineering videos are very informative. Ty 🙏

[@user-vl8eo4pr4w]

Hi laurie, thanks for the video.
enumerateExports is not working(Showing an empty array)
in my version frida 16.1.10, but it is showing results in your version 16.0.19,, any reason laurie behind this. the same code is not working for me in same 16.0.19 as well.

[@brunoaduarte]

Hi Laurie! Can you demonstrate when and how to hook the native libraries by the enumerated export addresses you showed at 8:25 ? Love your content! Thanks!

[@Pixalynx]

What are those LED lights you have in the background, the ones that change different hues of pink, I want to buy them haha

[@trifalgarh]

Which emulator are you using? Is it Android Studio AVD or is it something else?

[@BedrijvigeBij]

Smart and beautiful

[@erilycus]

Love❤

[@brunoaduarte]

And what if a native library is loaded in "stealth mode", I mean, it doesn't show as an enumerated module. But I can see it loaded in memory, how can I attach to it?

[@Sj-ze5wk]

Can u do ida native so debugging? I always get sig errors

[@WorldTimeLineChannel1]

Great video Laurie. You are a really bright, smart, beautiful girl. Great stuff.

[@user-ex9ip7zw9e]

could you help me analyzing an app,it is very difficult

[@tientoan8157]

Can you give me link of your wallpaper? It's very cool

[@diogocardoso1479]

...Are you married? hahahaha. Taking the joke away, Congratulations on the video, very good indeed!!! +1Subscribed

[@tadasturonis]

I think you slightly misplaced the mayo

[@paulabrudan7896]

Couldnt you just hook the constructor?

[@lauriewired]

Sure thing! You could hook many different functions and get similar results. Just preference by situation :)

[@MrAnhell]

Brains and Beauty plus easy to understand.

[@DebbieMarieClassics]

i really like your hair in this video. That's the most technical thing i can say.

[@moviesynopsis001]

More like Laurie Hired!

[@EugeneM]

Such approach works for some scenarios with very simple Android apps. In serious software this hooking gives us nothing as all of the hidden and secured app logic is implemented in native obfuscated code. Android app loads a native lib, then this lib opens some socket and communicates with Android app via that socket using encrypted strings. And when you want to change how native code works the only thing you can do is trying to trace and debug native lib via IDA. And this approach is much more complicated without any guarantee of success.

[@lauriewired]

Are you saying that native hooking never helps for real apps? Hard disagree. It won't work for certain apps, but it's super useful in a lot of real-world situations. For example, if you are trying to get by some native anti-emulation.

[@still_alive02]

static disassembler like ida wont give much btw, needs to take backtrace by frida, if app have antidebugger you have to hook system calls and trace libc, for example hook functions that looks in proc/self/status

[@Shinika01]

of course for advanced malware the approach wouldn't be "that easy"...
Don't forget that this video is merely educative to help people understand and progress.

[@wrathofainz]

Nerdy girls exist: confirmed.
Now how to meet them...
I'll bookmark this video as part of my research to crack apks. I've been poking one unity game with the intention of removing vendor-lock.
The game doesn't work unless installed from (or spoofed) the Google play store.
It also has some sort of signature check apart from the usual one. Bother.

[@ayushmauryars]

Will you become my friend 😢 pleasee

[@Giurigi123]

i dont understand anything this girl is just looking goood

[@kingmarwat]

Amazing...... but video is tool long . It can be done in 5 minutes... In your next video, be to the point

[@AI__VOICE]

Hey you very attractive 😅 i loos my focus 😂😂😂 of the video topic 😂😂

[@gxbytes]

me also

[@throwawaythrowawayson1983]

@@gxbytes bro don't be thirsting over her. she's a professional. this is a tech video, not a thirst trap. take it seriously.

[@throwawaythrowawayson1983]

you too hacker_07. don't be cringe.