pierluigicdc / frida-gadget

Frida gadget into an APK

frida-gadget

frida-gadget is a APK patcher for frida gadget.

I hope this will help you to patch APK when you want to utilize the Frida gadget.

Installation

pip install frida-gadget

Prerequirement

You should install the Apktool and set the PATH environment variable. (Install apktool)

brew install apktool

Usage

$ frida-gadget --help
  Usage: frida-gadget [OPTIONS] APK_PATH

  Options:
    --arch TEXT  Support [arm, arm64, x86]
    --help       Show this message and exit.

Example

$ frida-gadget /Users/ksg/demo.apk  --arch arm64
  [INFO] APK: '/Users/ksg/demo.apk'
  [INFO] Gadget Architecture(--arch): 'arm64'
  [DEBUG] Decompiling the target APK using apktool
  [DEBUG] Checking the internet, extractNativeLibs settings
  [DEBUG] Searching the main activity from smali files
  [DEBUG] Main activity founded at '/Users/ksg/demo/smali/com/google/mediapipe/apps/handtrackinggpu/MainActivity.smali'
  [DEBUG] Finding the onCreate method and inject loadLibrary code
  [DEBUG] Recompiling the new APK using apktool
  [INFO] Gadget APK: /Users/ksg/demo/dist/handtrackinggpu.apk
  [INFO] All done

$ ls /Users/ksg/demo/dist/handtrackinggpu.apk
  /Users/ksg/demo/dist/handtrackinggpu.apk

$ unzip -l /Users/ksg/demo/dist/handtrackinggpu.apk | grep libfrida-gadget
  21133848  09-15-2021 02:28   lib/arm64-v8a/libfrida-gadget-15.1.1-android-arm64.so

loadLibrary code will be injected

Easy to re-sign your app by apk-signer

$ apk-signer /Users/ksg/demo/dist/handtrackinggpu.apk
  [Warning] Signing with default keystore.
  [Warning] Please pass --key_path, --key_alias, --key_pass, --ks_pass parameter, if you want to use your keystore
  /Users/ksg/demo/dist/handtrackinggpu-signed.apk

$ adb install /Users/ksg/demo/dist/handtrackinggpu-signed.apk

Similar Projects

https://github.com/sensepost/objection

https://github.com/NickstaDB/patch-apk