Hacktricks-skills frida-android-hooking

Use Frida to hook Android methods, bypass security checks, brute-force functions, and intercept arguments/return values. Use this skill whenever the user mentions Android pentesting, Frida, Java hooking, method interception, PIN bypass, encryption analysis, or needs to modify Android app behavior at runtime. Also trigger for Android 14/15/16 compatibility issues, Zygisk stealth injection, or when analyzing APK security.

install

source · Clone the upstream repo

git clone https://github.com/abelrguezr/hacktricks-skills

manifest: skills/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1/SKILL.MD

source content

Frida Android Hooking

A skill for using Frida to hook Android methods, bypass security checks, and analyze app behavior at runtime.

Quick Start

Basic Hooking Setup

# Attach to running app
frida -U -l hook.js -f com.example.app --no-pause

# Or use Python wrapper
python scripts/hooking.py hook.js

Python Wrapper Script

Use

scripts/hooking.py

to load any JavaScript hook file:

python scripts/hooking.py <hook-file.js>

This script:

Reads JavaScript from file
Attaches to USB device
Loads the script
Keeps connection open

Hooking Patterns

1. Boolean Bypass

Bypass boolean checks (PIN validation, license checks, etc.):

Java.perform(function () {
  var TargetClass = Java.use("com.example.ClassName")
  TargetClass.checkMethod.implementation = function (arg) {
    console.log("[+] Bypassed check")
    return true  // Always return true
  }
})

Use case: PIN validation, license verification, flag checks

2. Function Brute-Force

Static Functions

Java.perform(function () {
  var TargetClass = Java.use("com.example.ClassName")
  
  for (var i = 1000; i < 9999; i++) {
    if (TargetClass.checkPin(i + "") == true) {
      console.log("[+] Found: " + i)
      break
    }
  }
})

Non-Static Functions

Java.perform(function () {
  Java.choose("com.example.ClassName", {
    onMatch: function (instance) {
      // Use instance to call non-static methods
      instance.checkMethod(arg)
    },
    onComplete: function () {}
  })
})

Note:

Java.choose

requires an existing instance in memory. For static functions, use

Java.use

directly.

3. Intercept Arguments and Return Values

Log what goes in and out of a function:

Java.perform(function () {
  var TargetClass = Java.use("com.example.ClassName")
  
  TargetClass.targetMethod.implementation = function (arg1, arg2) {
    console.log("Input arg1: " + arg1)
    console.log("Input arg2: " + arg2)
    
    var result = this.targetMethod(arg1, arg2)  // Call original
    
    console.log("Return value: " + result)
    return result
  }
})

Use case: Encryption analysis, API key extraction, data flow tracing

4. Handle Method Overloads

When multiple methods share the same name, specify argument types:

var TargetClass = Java.use("com.example.ClassName")

// Select specific overload
TargetClass.methodName.overload('java.lang.String', 'int').implementation = function(s, i) {
  return this.methodName(s, i)
}

Modern Android (14/15/16)

Compatibility Requirements

Frida 17.1.5+ required for stable Java hooking on Android 14+
Upgrade
```
frida-server
```
,
```
frida-gadget
```
, and CLI/Python packages

Spawn Mode for Anti-Debug Bypass

Some apps die before

attach

. Use spawn mode:

frida -U -f com.example.app -l hook.js --no-pause

This loads hooks before

onCreate()

runs.

Zygisk Stealth Injection

For apps with ptrace/Frida detection:

Install Zygisk gadget module (e.g.,
```
zygisk-gadget
```
)

Configure target package:

adb shell "su -c 'echo com.example.app,5000 > /data/local/tmp/re.zyg.fri/target_packages'"

Attach to gadget:

frida -U -n Gadget -l hook.js

Benefits:

No ptrace detection
APK integrity checks pass
Bypasses basic Frida string checks

Common Targets

Target	Class Pattern	Use Case
PIN Validation	`*.utils.PinUtil`	Bypass PIN checks
Encryption	`*.utils.EncryptionUtil`	Extract keys, analyze crypto
License	`.License`	Bypass license verification
Network	`.Network` , `.Api`	Intercept API calls
Storage	`.Storage` , `.Prefs`	Access saved data