# Android Frida Pentest

> Use this skill whenever you need to perform dynamic analysis, hooking, or instrumentation on Android applications using Frida. Trigger this for any Android app security testing, reverse engineering, DEX dumping, anti-debugging bypass, runtime manipulation, or mobile pentesting tasks. Make sure to use this skill when the user mentions Android app analysis, Frida, dynamic instrumentation, hooking Java methods, DEX dumping, FLAG_SECURE bypass, or any mobile security testing.

- Skill: `abelrguezr/android-frida-pentest` (Agent Skill, multi-file: 9 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/android-frida-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/android-frida-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/android-frida-pentest

---


# Android Frida Pentesting Skill

A comprehensive guide for dynamic Android application analysis using Frida instrumentation.

## Quick Start

### Install Frida Tools

```bash
pip install frida-tools
pip install frida
```

### Setup Frida Server on Android

**Rooted device (one-liner):**
```bash
adb root; adb connect localhost:6000; sleep 1; adb push frida-server /data/local/tmp/; adb shell "chmod 755 /data/local/tmp/frida-server"; adb shell "/data/local/tmp/frida-server &"
```

**Verify installation:**
```bash
frida-ps -U  # List all processes
frida-ps -U | grep -i <package_name>  # Find specific app
```

### Basic Hooking Commands

```bash
# Spawn app with hooks (hooks before onCreate)
frida -U --no-pause -l script.js -f com.example.app

# Attach to running app
frida -U -n com.example.app -l script.js

# List installed apps
frida-ps -Uai
```

## Frida Gadget (No-Root Option)

When you don't have root access, bundle Frida Gadget inside the APK:

### Manual Gadget Integration

1. **Unpack APK:**
```bash
apktool d app.apk -o app_modified
```

2. **Add Gadget files:**
- Place `libfrida-gadget.so` in `lib/<abi>/` (e.g., `lib/arm64-v8a/`)
- Create `assets/frida-gadget.config`:
```json
{
  "interaction": { "type": "script", "path": "/sdcard/hook.js" },
  "runtime": { "logFile": "/sdcard/frida-gadget.log" }
}
```

3. **Repack and sign:**
```bash
apktool b app_modified -o app_gadget.apk
uber-apk-signer -a app_gadget.apk -o out_signed
adb install -r out_signed/app_gadget-aligned-debugSigned.apk
```

### Automated with Objection

```bash
objection patchapk -s app.apk \
  -c gadget-config.json \
  -l agent.js \
  --use-aapt2
```

## Common Hooking Patterns

### Hook Functions Without Parameters

```javascript
Java.perform(function () {
  var targetClass = Java.use("com.example.ClassName");
  targetClass.methodName.overload().implementation = function () {
    console.log("[+] methodName called");
    return false; // Return custom value
  };
});
```

### Hook Functions With Parameters

```javascript
Java.perform(function () {
  var targetClass = Java.use("com.example.ClassName");
  
  targetClass.methodName.overload("java.lang.String", "int").implementation = function (arg1, arg2) {
    console.log("[+] Input arg1: " + arg1);
    console.log("[+] Input arg2: " + arg2);
    
    var result = this.methodName(arg1, arg2);
    console.log("[+] Output: " + result);
    return result;
  };
});
```

### Hook Activity Lifecycle Methods

```javascript
Java.perform(function () {
  var MainActivity = Java.use("com.example.MainActivity");
  
  MainActivity.onCreate.overload("android.os.Bundle").implementation = function (bundle) {
    console.log("[+] MainActivity.onCreate() called");
    return this.onCreate(bundle);
  };
  
  MainActivity.onStart.overload().implementation = function () {
    console.log("[+] MainActivity.onStart() called");
    return this.onStart();
  };
});
```

### Intercept Decryption Functions

```javascript
function bytesToString(data) {
  var result = "";
  for (var i = 0; i < data.length; i++) {
    result += String.fromCharCode(data[i]);
  }
  return result;
}

Java.perform(function () {
  var cryptoClass = Java.use("com.example.Crypto");
  
  cryptoClass.decrypt.overload("[B", "[B").implementation = function (key, encrypted) {
    console.log("[+] Key: " + bytesToString(key));
    console.log("[+] Encrypted: " + bytesToString(encrypted));
    
    var decrypted = this.decrypt(key, encrypted);
    console.log("[+] Decrypted: " + bytesToString(decrypted));
    return decrypted;
  };
});
```

### Find and Inspect Object Instances

```javascript
Java.choose("com.example.ClassName", {
  onMatch: function (instance) {
    console.log("[+] Found instance: " + instance);
    console.log("[+] Private field: " + instance.privateMethod());
  },
  onComplete: function () {
    console.log("[+] Search complete");
  }
});
```

### Prevent App Exit

```javascript
Java.perform(function () {
  var System = Java.use("java.lang.System");
  
  System.exit.overload("int").implementation = function (code) {
    console.log("[!] App tried to exit with code: " + code);
    // Don't call original - app stays running
    return;
  };
});
```

## Anti-Debugging Bypass

### Disable Root Detection

```javascript
Java.perform(function () {
  var Build = Java.use("android.os.Build");
  var SystemProperties = Java.use("android.os.SystemProperties");
  
  // Fake fingerprint
  Build.FINGERPRINT.get = function() { return "generic/generic/generic"; };
  Build.HARDWARE.get = function() { return "generic"; };
  Build.MODEL.get = function() { return "Android SDK built for x86"; };
  Build.MANUFACTURER.get = function() { return "Google"; };
  
  // Block SystemProperties.get
  SystemProperties.get.overload("java.lang.String").implementation = function (key) {
    if (key.contains("ro.debuggable") || key.contains("ro.secure")) {
      return "0";
    }
    return this.get(key);
  };
});
```

### Block SIGSEGV Handlers

```javascript
Interceptor.attach(Module.findExportByName("libc.so", "sigaction"), {
  onEnter: function (args) {
    if (args[1] !== null) {
      console.log("[+] sigaction called - blocking anti-debug");
      args[1] = null;
    }
  }
});
```

## DEX Dumping with clsdumper

```bash
# Install
pip install clsdumper

# Attach to running app
clsdumper com.example.app

# Spawn with hooks before early loaders
clsdumper com.example.app --spawn

# Use specific strategies
clsdumper com.example.app --strategies fart_dump,oat_extract,memory_scan

# Deep scan (slower, more thorough)
clsdumper com.example.app --deep-scan

# Extract classes to smali
clsdumper com.example.app --extract-classes
```

## JDWP Injection (Debuggable Apps, No Root)

For apps with `android:debuggable="true"`:

```bash
# Clone and run
python frida-jdwp-loader.py frida -n com.example.app

# Keep breakpoint suspended for early hooks
python frida-jdwp-loader.py frida -n com.example.app -s

# Load script directly
python frida-jdwp-loader.py frida -n com.example.app -i script -l hook.js
```

## Useful Scripts

See the `scripts/` directory for ready-to-use Frida scripts:
- `clear-flag-secure.js` - Remove FLAG_SECURE to enable screenshots
- `basic-hook-template.js` - Template for common hooking patterns
- `setup-frida-server.sh` - Automated frida-server deployment

## Best Practices

1. **Spawn vs Attach**: Use `--spawn` (`-f`) to hook before `onCreate()` for early initialization hooks. Use attach for running apps.

2. **Multi-strategy DEX dumping**: Hardened apps load code from multiple sources. Use clsdumper with default strategies plus `--spawn` for maximum coverage.

3. **Frida 17+ Java Bridge**: If your agent hooks Java, include the Java bridge:
```bash
npm install frida-java-bridge
npm run build  # Creates bundled _agent.js
```

4. **Stealth**: For Gadget on hardened apps, use obfuscated names and conditional loading to avoid detection.

5. **UI Thread Hooks**: For window manipulation, schedule on main thread to avoid flicker:
```javascript
Java.scheduleOnMainThread(function () {
  // UI operations here
});
```

## References

- [Frida Documentation](https://frida.re/docs/)
- [Frida Gadget](https://frida.re/docs/gadget/)
- [Objection](https://github.com/sensepost/objection)
- [clsdumper](https://github.com/TheQmaks/clsdumper)
- [Frida CodeShare](https://codeshare.frida.re/)