#.so file editor apk apk
#.so file editor apk install
#.so file editor apk archive
#.so file editor apk Patch

Basically, application should freeze рџ’¤ at the moment of gadget spawn. For example, if you injected into libcrypto.so, then do some operations which use encryption. It may happen at any time and not mandatory at the application start. The application invokes System.loadLibrary to load libfromapk.so and the latter loads libfrida-gadget.so. Pay attention that the Frida's Gadget should start after you trigger some use case in your targeted Android application which loads the native library.

Trace the application (attach to gadget): frida-trace -U Gadget.

Check the frida-gadget presence as described in the following chapter, but shortly: frida-ps -U.

#.so file editor apk apk

Allow untrusted third-party APK on your phone.

#.so file editor apk install

adb install -r target/dist/target-aligned-debugSigned.apk

#.so file editor apk archive

вљ пёЏ WARNING: Archive should have *.apk extension to make Uber Signer work! I used 'Uber APK signer': java -jar uber-apk-signer-1.1.0.jar -a. # 'target' is a directory with unpacked APK of the step 3. readelf -d target/lib/arm64-v8a/libfromapk.soДynamic section at offset 0xb4000 contains 29 entries:Д x0000000000000001 (NEEDED) Shared library:

#.so file editor apk Patch

Run the script - patch libfromapk.so JNI.

Libnative.write('target/lib/arm64-v8a/libfromapk.so') Libnative.add_library('libfrida-gadget.so') # Injection! Libnative = lief.parse('target/lib/arm64-v8a/libfromapk.so')

Write a Python script (say inject-gadget.py) to inject the frida-gadget using lief (see installation instructions here: ).

cp frida-gadget-12.8.8-android-arm64.so target/lib/arm64-v8a/libfrida-gadget.so

Copy frida-gadget to the unpacked APK directory.

unzip/ zip doesn't always work - application may not bring up.

-rs is to not decode resources and sources, it will save you time and keep your nerves while compiling the APK back.

# Destination would be a directory 'target' вљ пёЏ WARNING: Frida Gadget from 12.7.0 to 12.8.7 doesn't bring up the server, and the bug was solved here. Unxz -d frida-gadget-12.8.8-android-arm64.so.xz

Download and unpack frida-gadget >= 12.8.8 for Android for arm64 (or arm32) from here.

Let's say we want to inject libfrida-gadget.so to /lib/arm64-v8a/libfromapk.so. вљ пёЏ If the APK doesn't contain native library then jump to the method #2. вњ”пёЏ For the shared library injection your APK should contain some native library (most probably a JNI library), and the injection is carried out by adding dependency to the native library. The reason I've put my own steps here is a lot of caveats aiming to save time in future because of buggy versions of different tools, and because I'd like to escape all unnecessary steps I usually tend to follow. Method 1: Inject a libfrida-gadget.so as a dependency to a native library (JNI) inside of APK If you decide to analyze some APK, but you haven't got one yet, you have a bunch of options then. Google Play doesn't allow you to download APK directly. How it basically works Note: where to get an APK

Method 2: If APK doesn't contain a native library, then you can inject System.loadLibrary bytecode.Д«asic use case: you've got a third-party APK (Android application package), and you want to debug/trace/explore/reverse-engineer it, and you have your personal Android phone which you don't want to root.

Method 1 : If targeted APK contains any native library ( /lib/arm64-v8a/libfromapk.so), then you can inject libfrida-gadget.so as a dependency into the native library.

You have 2 options to inject Frida's Gadget to Android application: