northwavesecurity / fridax Goto Github PK
View Code? Open in Web Editor NEWFridax enables you to read variables and intercept/hook functions in Xamarin/Mono JIT and AOT compiled iOS/Android applications.
License: MIT License
Fridax enables you to read variables and intercept/hook functions in Xamarin/Mono JIT and AOT compiled iOS/Android applications.
License: MIT License
Hi, i saw your tool and i am very impressed with it.
However, while i was practicing on hooking xamarin apps using fridax, i came across an error which relates to the version of frida in your package.
Current major version of frida is 14 and it seems that fridax (npm install) is installing frida 12 still; hence the error while starting up fridax
The error message:
[] Awaiting storage initialization.
[] Awaiting USB device.
[*] Up and running on iPhone.
(frida:3997): Frida-CRITICAL **: 17:02:09.205: file ../../../frida-core/lib/interfaces/session.vala: line 167: uncaught error: GDBus.Error:org.freedesktop.DBus.Error.UnknownMethod: No such interface “re.frida.HostSession12” on object at path /re/frida/HostSession (g-dbus-error-quark, 19)
zsh: segmentation fault ./fridax.js inject --scripts scripts/modify_class_function_argument.js
Reference: frida/frida#1484
my frida version;
frida --version
14.2.12
iDevice frida:
14.2.12
Hello,
I have the below sample code
class Person
{
private string name; // field
public string Name // property
{
get { return name; } // get method
set { name = value; } // set method
}
}
And I found that in compilation, the set method is called as "set_Name(string)"; however, when I try the below code to fetch and modify the data, the console logs an empty argument -no error is returned that shows that the method does not exist- . Can someone tell me what I am doing wrong?
import { MonoApiHelper, MonoApi } from '../vendors/frida-mono-api'
import ClassHelper from '../libraries/class_helper'
var settingClassName = "Person";
var settingMethodName = "set_Name";
var settingMethodArgCount = 1;
// The root AppDomain is the initial domain created by the runtime when it is initialized. Programs execute on this AppDomain.
const domain = MonoApi.mono_get_root_domain()
// Get a reference to a certain class within the Xamarin application.
var classInformation = ClassHelper.getClassByName(settingClassName);
// Attach interceptor and fish out the first method argument
MonoApiHelper.Intercept(classInformation, settingMethodName, {
onEnter: function(args) {
console.log("Entered " + settingMethodName + " with " + settingMethodArgCount + " argument(s).");
console.log("Value of `string id`: " + MonoApiHelper.StringToUtf8(args[0]));
},
onLeave: function onLeave(log, retval, state) {
console.log("Left " + settingMethodName + ".");
}
})
console.log(`'jit_modify_class_function_argument.js' attached and ready.`)
I would be nice if frida-mono-api
had it's own repo since the original repo does not appear to be maintained anymore.
Any plan to make it support to hook Android apps written in Flutter?
fridax $ npm install
> [email protected] install /Users/.../fridax/node_modules/frida
> prebuild-install || node-gyp rebuild
prebuild-install WARN install No prebuilt binaries found (target=14.7.0 runtime=node arch=x64 libc= platform=darwin)
gyp: binding.gyp not found (cwd: /Users/.../fridax/node_modules/frida) while trying to load binding.gyp
gyp ERR! configure error
gyp ERR! stack Error: `gyp` failed with exit code: 1
gyp ERR! stack at ChildProcess.onCpExit (/usr/local/lib/node_modules/npm/node_modules/node-gyp/lib/configure.js:351:16)
gyp ERR! stack at ChildProcess.emit (events.js:314:20)
gyp ERR! stack at Process.ChildProcess._handle.onexit (internal/child_process.js:276:12)
gyp ERR! System Darwin 19.6.0
gyp ERR! command "/usr/local/Cellar/node/14.7.0/bin/node" "/usr/local/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js" "rebuild"
gyp ERR! cwd /Users/.../fridax/node_modules/frida
gyp ERR! node -v v14.7.0
gyp ERR! node-gyp -v v5.1.0
gyp ERR! not ok
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! [email protected] install: `prebuild-install || node-gyp rebuild`
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the [email protected] install script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.
npm ERR! A complete log of this run can be found in:
npm ERR! /Users/.../.npm/_logs/2020-10-22T09_55_37_804Z-debug.log
Does anyone have any idea how Frida can iterate over an observable collection or collection items?
The idea is to go over the items in a collection or get a specific item at an index.
I'm trying to hook a Xamarin-based iOS app and am getting the following error:
~/t/s/s/f/fridax > ./fridax.js inject --device usb --scripts scripts/aot_modify_class_function_argument.js
[*] Awaiting storage initialization.
[*] Awaiting USB device.
[*] Up and running on iPhone.
? Which application do you want to inject? XXXXX
[*] Happy hacking.
[*] Attached to application (session: 74911).
[*] Injected a test script (this runs from within the injected application)!
Error: Can't find Mono runtime!
at <anonymous> (vendors/frida-mono-api/mono-module.js:33)
at call (native)
at o (node_modules/browser-pack/_prelude.js:1)
at <anonymous> (node_modules/browser-pack/_prelude.js:1)
at <anonymous> (vendors/frida-mono-api/mono-api.js:2)
at call (native)
at o (node_modules/browser-pack/_prelude.js:1)
at <anonymous> (node_modules/browser-pack/_prelude.js:1)
at <anonymous> (vendors/frida-mono-api/index.js:1)
at call (native)
at o (node_modules/browser-pack/_prelude.js:1)
at <anonymous> (node_modules/browser-pack/_prelude.js:1)
at <anonymous> (scripts/aot_modify_class_function_argument.js:1)
at call (native)
at o (node_modules/browser-pack/_prelude.js:1)
at r (node_modules/browser-pack/_prelude.js:1)
at <eval> (/script2.js:1246)
I've looked at #1 and the issue was fixed but I'm still having the issue. I've tried poking around but am just getting started with frida. Things I've tried:
Process.enumerateModulesSync()
Process.enumerateExports()
dlopen
and looking for any import of monobut nothing shows up. Is there anything else I can do to troubleshoot the issue? Sadly I can't share the ipa.
I installed all prerequisites according to their latest version. But after installation I faced many problems. One of the problems I encountered was the following error:
...
gyp: binding.gyp not found (cwd: C:\Users\lnatl\Desktop\fridax) while trying to load binding.gyp
gyp ERR! configure error
gyp ERR! stack Error: gyp failed with exit code: 1
...
I found out that these problems are related to node-gyp. So I tried all the solutions available for Windows operating system Like:
And in the end, I reviewed and implemented most of the issues related to this address:
https://github.com/nodejs/node-gyp/issues
The only thing I noticed was that the python version has nothing to do with the gyp node problem. Also, the 2015, 2017 and 2019 versions of Microsoft Visual Studio are better compatible with the node-gyp (according to the experience of people who used the node-gyp).So I decided to install Visual Studio version 2017 (15.9.2) and Visual Studio Build Tools version 2017 (15.9.51). Also, I already had Python version 3.10.5 installed, and since the problem was not with Python, I did not make any changes in the installation of Python with different versions.But the result was still the same.what should i do? After a lot of frustration, I might get better results in Linux. So I installed Ubuntu version 20.04.1 on a virtual machine.
In this environment, I also received the same errors for the following path:
...
gyp: binding.gyp not found (cwd: /home/lnatl/Desktop/fridax) while trying to load binding.gyp
gyp ERR! configure error
gyp ERR! stack Error: `gyp` failed with exit code: 1
...
Also for the Frida module which was being installed in the node_modules folder:
...
npm ERR! gyp: binding.gyp not found (cwd: /tmp/fridax/node_modules/frida) while trying to load binding.gyp
npm ERR! gyp ERR! configure error
npm ERR! gyp ERR! stack Error: `gyp` failed with exit code: 1
...
Hello,
I can't get the modify_class_function_argument.js
script to work.
I'm working with this app: https://github.com/xamarin/xamarin-forms-samples/tree/master/WebServices/TodoREST
I'm trying to intercerpt the GetTasksAsync
function of the TodoItemManager
:
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
namespace TodoREST
{
public class TodoItemManager
{
IRestService restService;
public TodoItemManager (IRestService service)
{
restService = service;
}
public Task<List<TodoItem>> GetTasksAsync ()
{
return restService.RefreshDataAsync ();
}
public Task SaveTaskAsync (TodoItem item, bool isNewItem = false)
{
return restService.SaveTodoItemAsync (item, isNewItem);
}
public Task DeleteTaskAsync (TodoItem item)
{
return restService.DeleteTodoItemAsync (item.ID);
}
}
}
Source for the class: https://github.com/xamarin/xamarin-forms-samples/blob/master/WebServices/TodoREST/TodoREST/Data/TodoItemManager.cs
I'm using this script:
import { MonoApiHelper, MonoApi } from '../vendors/frida-mono-api'
import ClassHelper from '../libraries/class_helper'
// Intercept settings
var settingClassName = "TodoREST.TodoItemManager";
var settingMethodName = "GetTasksAsync";
var settingMethodArgCount = 0;
// The root AppDomain is the initial domain created by the runtime when it is initialized. Programs execute on this AppDomain.
const domain = MonoApi.mono_get_root_domain()
console.log('domain: ' + classInformation);
// Get a reference to a certain class within the Xamarin application.
var classInformation = ClassHelper.getClassByName(settingClassName);
console.log('classInformation: ' + classInformation);
// Get the pointer to the ahead-of-time (AOT) compiled method
let methodInformation = MonoApiHelper.ClassGetMethodFromName(classInformation, settingMethodName, settingMethodArgCount)
console.log('methodInformation: ' + methodInformation);
// Allocate enough memory for MonoError initialization
let monoErrorMemory = Memory.alloc(32)
// Get the pointer to the method
let nativeMethodPointer = MonoApi.mono_aot_get_method(domain, methodInformation, monoErrorMemory)
// Attach interceptor and fish out the first method argument
Interceptor.attach(nativeMethodPointer, {
onEnter: function(args) {
console.log("Entered " + settingMethodName + " with " + settingMethodArgCount + " argument(s).");
console.log("Value of `string id`: " + MonoApiHelper.StringToUtf8(args[3]));
args[3] = MonoApiHelper.StringNew('This is the replaced value of `string c`.', domain);
},
onLeave: function onLeave(log, retval, state) {
console.log("Left " + settingMethodName + ".");
}
})
console.log(`'modify_function_argument.js' attached and ready.`)
The stacktrace I'm getting:
node fridax.js inject --scripts scripts/todo-modify.js
[*] Awaiting storage initialization.
[*] Awaiting USB device.
[*] Up and running on Android Emulator 5554.
? Which application do you want to inject? TodoREST
[*] Happy hacking.
[*] Attached to application (session: 3803).
[*] Injected a test script (this runs from within the injected application)!
domain: undefined
classInformation: 0x98f63330
methodInformation: 0x84b95058
Error: Export not found: mono_aot_get_method
at vendors/frida-mono-api/mono-api.js:799
at scripts/todo-modify.js:45
at o (node_modules/browser-pack/_prelude.js:1)
at r (node_modules/browser-pack/_prelude.js:1)
at /script2.js:1217
^C[*] Script unloaded.
[*] Script unloaded.```
If you need more info let me know.
I can't be Intercept static method,Is it the problem I use or does the framework not implement this function?
I have the same issue as #13 and I think it's tied to your toolset rather then node-gyp
. You need to include binding.gyp
file in your project directory (a sort of Makefile). Tried on two environments (Host - MacOS Catalina, Guest - Kali Linux)
┌──(kali㉿kali)-[/tmp/fridax]
└─$ pwd 130 ⨯ 1 ⚙
/tmp/fridax
┌──(kali㉿kali)-[/tmp/fridax]
└─$ npm --version 1 ⚙
7.0.3
┌──(kali㉿kali)-[/tmp/fridax]
└─$ rm -rf node_modules package-lock.json && npm i 1 ⚙
npm ERR! code 1
npm ERR! path /tmp/fridax/node_modules/frida
npm ERR! command failed
npm ERR! command sh -c prebuild-install || node-gyp rebuild
npm ERR! gyp info it worked if it ends with ok
npm ERR! gyp info using [email protected]
npm ERR! gyp info using [email protected] | linux | x64
npm ERR! gyp info find Python using Python version 3.8.4 found at "/usr/bin/python3"
npm ERR! gyp info spawn /usr/bin/python3
npm ERR! gyp info spawn args [
npm ERR! gyp info spawn args '/usr/share/nodejs/node-gyp/gyp/gyp_main.py',
npm ERR! gyp info spawn args 'binding.gyp',
npm ERR! gyp info spawn args '-f',
npm ERR! gyp info spawn args 'make',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/tmp/fridax/node_modules/frida/build/config.gypi',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/usr/share/nodejs/node-gyp/addon.gypi',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/usr/include/nodejs/common.gypi',
npm ERR! gyp info spawn args '-Dlibrary=shared_library',
npm ERR! gyp info spawn args '-Dvisibility=default',
npm ERR! gyp info spawn args '-Dnode_root_dir=/usr/include/nodejs',
npm ERR! gyp info spawn args '-Dnode_gyp_dir=/usr/share/nodejs/node-gyp',
npm ERR! gyp info spawn args '-Dnode_lib_file=/usr/include/nodejs/<(target_arch)/node.lib',
npm ERR! gyp info spawn args '-Dmodule_root_dir=/tmp/fridax/node_modules/frida',
npm ERR! gyp info spawn args '-Dnode_engine=v8',
npm ERR! gyp info spawn args '--depth=.',
npm ERR! gyp info spawn args '--no-parallel',
npm ERR! gyp info spawn args '--generator-output',
npm ERR! gyp info spawn args 'build',
npm ERR! gyp info spawn args '-Goutput_dir=.'
npm ERR! gyp info spawn args ]
npm ERR! gyp: binding.gyp not found (cwd: /tmp/fridax/node_modules/frida) while trying to load binding.gyp
npm ERR! gyp ERR! configure error
npm ERR! gyp ERR! stack Error: `gyp` failed with exit code: 1
npm ERR! gyp ERR! stack at ChildProcess.onCpExit (/usr/share/nodejs/node-gyp/lib/configure.js:354:16)
npm ERR! gyp ERR! stack at ChildProcess.emit (events.js:314:20)
npm ERR! gyp ERR! stack at Process.ChildProcess._handle.onexit (internal/child_process.js:275:12)
npm ERR! gyp ERR! System Linux 5.7.0-kali1-amd64
npm ERR! gyp ERR! command "/usr/bin/node" "/usr/share/nodejs/node-gyp/bin/node-gyp.js" "rebuild"
npm ERR! gyp ERR! cwd /tmp/fridax/node_modules/frida
npm ERR! gyp ERR! node -v v12.19.0
npm ERR! gyp ERR! node-gyp -v v7.0.0
npm ERR! gyp ERR! not ok
npm ERR! A complete log of this run can be found in:
npm ERR! /home/kali/.npm/_logs/2020-12-01T12_42_46_721Z-debug.log
Hi, thanks for the nice tools
i have an issue when fridax.js stuck in applications = await device.enumerateApplications()
when using frida 15.0.3. However, the JS will run normally when using frida 14.2.18.
using frida 15.0.3:
./fridax.js inject --scripts scripts/jit_modify_class_function_argument.js
[*] Awaiting storage initialization.
[*] Awaiting USB device.
[*] Up and running on SM-G5XXX.
and it stays like that forever.
using frida 14.2.18:
./fridax.js inject --scripts scripts/jit_modify_class_function_argument.js
[*] Awaiting storage initialization.
[*] Awaiting USB device.
[*] Up and running on SM-G5XXX.
? Which application do you want to inject?
App1
App2
App3
❯ App4
(Move up and down to reveal more choices)
fridax version = 1.0.0
frida-server already running = yes
xamarin app already launched = yes
expected behavior = fridax can be run in current version of frida (frida 15.0.X)
Hello,
Thanks for this project, it looks like this is what I was looking for.
I'm running into an issue when trying to run a script:
node fridax.js inject --scripts read_class_static_string_variable
[*] Awaiting storage initialization.
[*] Awaiting USB device.
[*] Up and running on Phone.
? Which application do you want to inject? Gadget
[*] Attached to application (session: 23972).
[*] Injected a test script (this runs from within the injected application)!
Error: Cant find mono!
at node_modules/frida-mono-api/src/mono-module.js:7
at o (node_modules/browser-pack/_prelude.js:1)
at node_modules/frida-mono-api/src/mono-api.js:2
at o (node_modules/browser-pack/_prelude.js:1)
at /script2.js:119
at o (node_modules/browser-pack/_prelude.js:1)
at scripts/read_class_static_string_variable.js:1
at o (node_modules/browser-pack/_prelude.js:1)
at r (node_modules/browser-pack/_prelude.js:1)
[*] Happy hacking.
What I did was:
node fridax.js inject
Any idea of what could be wrong ?
Hi,
Similar to some closed issues, I'm hitting an error about binding.gyp being missing which may be related to the combination of node and frida versions I'm using
My frida install is otherwise fully functional (both npm install frida and compiling frida-node from git source)
It would be helpful if you could state which OS / node / frida version combinations are known to work with fridax?
npm WARN old lockfile
npm WARN old lockfile The package-lock.json file was created with an old version of npm,
npm WARN old lockfile so supplemental metadata must be fetched from the registry.
npm WARN old lockfile
npm WARN old lockfile This is a one-time fix-up, please be patient...
npm WARN old lockfile
npm WARN deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated [email protected]: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
npm ERR! code 1
npm ERR! path /Users/hubert/fridax/node_modules/frida
npm ERR! command failed
npm ERR! command sh -c prebuild-install || node-gyp rebuild
npm ERR! prebuild-install WARN install No prebuilt binaries found (target=16.4.2 runtime=node arch=x64 libc= platform=darwin)
npm ERR! gyp info it worked if it ends with ok
npm ERR! gyp info using [email protected]
npm ERR! gyp info using [email protected] | darwin | x64
npm ERR! gyp info find Python using Python version 3.9.6 found at "/usr/local/opt/[email protected]/bin/python3.9"
npm ERR! (node:70687) [DEP0150] DeprecationWarning: Setting process.config is deprecated. In the future the property will be read-only.
npm ERR! (Use `node --trace-deprecation ...` to show where the warning was created)
npm ERR! gyp info spawn /usr/local/opt/[email protected]/bin/python3.9
npm ERR! gyp info spawn args [
npm ERR! gyp info spawn args '/Users/hubert/node_modules/node-gyp/gyp/gyp_main.py',
npm ERR! gyp info spawn args 'binding.gyp',
npm ERR! gyp info spawn args '-f',
npm ERR! gyp info spawn args 'make',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/Users/hubert/fridax/node_modules/frida/build/config.gypi',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/Users/hubert/node_modules/node-gyp/addon.gypi',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/Users/hubert/Library/Caches/node-gyp/16.4.2/include/node/common.gypi',
npm ERR! gyp info spawn args '-Dlibrary=shared_library',
npm ERR! gyp info spawn args '-Dvisibility=default',
npm ERR! gyp info spawn args '-Dnode_root_dir=/Users/hubert/Library/Caches/node-gyp/16.4.2',
npm ERR! gyp info spawn args '-Dnode_gyp_dir=/Users/hubert/node_modules/node-gyp',
npm ERR! gyp info spawn args '-Dnode_lib_file=/Users/hubert/Library/Caches/node-gyp/16.4.2/<(target_arch)/node.lib',
npm ERR! gyp info spawn args '-Dmodule_root_dir=/Users/hubert/fridax/node_modules/frida',
npm ERR! gyp info spawn args '-Dnode_engine=v8',
npm ERR! gyp info spawn args '--depth=.',
npm ERR! gyp info spawn args '--no-parallel',
npm ERR! gyp info spawn args '--generator-output',
npm ERR! gyp info spawn args 'build',
npm ERR! gyp info spawn args '-Goutput_dir=.'
npm ERR! gyp info spawn args ]
npm ERR! gyp: binding.gyp not found (cwd: /Users/hubert/fridax/node_modules/frida) while trying to load binding.gyp
npm ERR! gyp ERR! configure error
npm ERR! gyp ERR! stack Error: `gyp` failed with exit code: 1
npm ERR! gyp ERR! stack at ChildProcess.onCpExit (/Users/hubert/node_modules/node-gyp/lib/configure.js:351:16)
npm ERR! gyp ERR! stack at ChildProcess.emit (node:events:394:28)
npm ERR! gyp ERR! stack at Process.ChildProcess._handle.onexit (node:internal/child_process:290:12)
npm ERR! gyp ERR! System Darwin 20.6.0
npm ERR! gyp ERR! command "/usr/local/Cellar/node/16.4.2/bin/node" "/Users/hubert/node_modules/.bin/node-gyp" "rebuild"
npm ERR! gyp ERR! cwd /Users/hubert/fridax/node_modules/frida
npm ERR! gyp ERR! node -v v16.4.2
npm ERR! gyp ERR! node-gyp -v v7.1.2
npm ERR! gyp ERR! not ok
npm ERR! A complete log of this run can be found in:
npm ERR! /Users/hubert/.npm/_logs/2021-08-17T13_50_57_678Z-debug.log
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.