Bypassing Frida detection in Android

#frida #rootdetection #fridadetection #android #pentest #r2pay
Hello everyone, in this video we are going to learn some new techniques which are used in android app for detecting frida based on some frida artifacts in the memory and filesystem.
For learning purpose we have used the application from MSTG crackme i.e r2pay.
You can download this app directly from their github page: github.com/OWASP/owasp-mastg/...
It has lot of detections like root detection, frida detection, hook detection for protecting the app from being reversed. This app uses libc functions to detect 2 artifacts one is "/proc/self/task/*/status" and the other is "/proc/self/fd/*".
As always feel free to comment down below in case you have any queries and i will reply as soon as i can.
Also, dont forget to hit a like button and subscribe to this channel to show your support. You can also follow us on twitter at @SecFatal.

[@souravrouth5333]

Best Frida tutorial I have found till this date. Loved it. Please make more videos on Frida

[@Fuddifadu]

Awesome info, looking forward to your next video! Already subscribed!

[@fatalsec]

Thanks for the sub!

[@ochacora3239]

​@@fatalsecsir, can you make video why we can't inject Frida gadget in it..

[@asadakhlaq1298]

Thankyou ! For sharing the knowledge.

[@mhamademad]

upload more quality content, subscribed / liked

[@fatalsec]

Thanks, sure more contents are coming soon.

[@berkedel]

Good presentation. Looking forward for next content

[@fatalsec]

Thanks for your feedback.

[@P0K0]

Keep the good work

[@ananthakrishnaner9807]

Well presented 😊

[@fatalsec]

Thanks man

[@sumitKumar-pf9xo]

Great informative video

[@fatalsec]

Thanks

[@akki6094]

Amazing 🤩

[@AkshayJain-fr3hf]

Amazing video :)

[@fatalsec]

Thanks

[@BeBarOfficial]

very helpful

[@alissonbezerra7]

Very good, my friend.

[@fatalsec]

Thanks

[@kishorbal8070]

Hy bruh ..that was sooo good like your all other videos, Btw i would like to know what should i refer for making my own custom frida scripts?? As of now,all i do is just copying someone else' scripts from internet..😂.. I just wanted make my own frida scripts (I have the basics of JS coding). Also i would suggest you to share the frida scripts that you are making for your videos, just under their description section.

[@fatalsec]

Hi, thanks for the suggestion. I have already started maintaining a repository: github.com/fatalSec

[@abhishekbandivadekar3999]

Would be really helpful if you could share resources to get deeper understanding of this. How to use Frida apis and stuff.

[@fatalsec]

You can get started with this resource it’s very good and useful. learnfrida.info

[@wojiaowangjiaming]

Hey! Awesome videos thanks ! I’m trying to adapt your method on other apps unfortunately I’m not able to see the lib where the error come from, I don’t have the same stack trace as yours. Mine is juste Java runtime stuff and i don’t have the backtrace at the end for example. Do you have any clues why ?

[@fatalsec]

Hi, this could be because there are no native libraries present in the app and the detection is being done on the java layer itself. You can use the Process.setExceptionHandler() to catch exceptions and backtrace from there.

[@trantrungkien2790]

amazing content i love it

[@fatalsec]

Thank you! More content is on the way. Stay tuned.

[@ontheweek559]

Please upload more about Frida...

[@fatalsec]

Sure, more videos are coming soon.

[@still_alive02]

This is physical rooted device? I've heard frida doesn't works normally with emulators

[@kurdm1482]

super fucking sueful thanks a ton

[@KundonGautam]

sir do you have your own courses for your videos or only release here in youtube

[@fatalsec]

No courses yet. But I do provide one to one trainings. If you are interested you can contact me on: [e-mail]

[@kundangautam6528]

@@fatalsec i have left you a message sir

[@LEGENDSAHILL]

Very useful video sir ............ Can you kill resso manually latest version

[@fatalsec]

You can connect with me on telegram to discuss more in detail. Are you on telegram?

[@LEGENDSAHILL]

@@fatalsec yes

[@rachitbedi1]

Hi can you share the frida detection logic used in the app

[@fatalsec]

You mean the java/native code used to detect the logic?

[@rachitbedi1]

@@fatalsec yeah the logic you are trying to bypass

[@ayushmauryars]

Bro you're Indian na?

[@exploitplays3835]

Is this mobxeler u r using?

[@fatalsec]

No, it’s my own customised Kali machine

[@halshs1790]

Learn Course full Frida for android

[@methadonmanfred2787]

unfortunatly this doesnt work for all apps. frida is still being detected

[@fatalsec]

Yes, there are many ways to detect frida and every app is different. Until unless they are using the same protection libraries. So you have to understand the concept and work your way through it.

[@user-fd8gb9qq6e]

What is the android version of the emulator ?

[@fatalsec]

This is google pixel 4 running android 11.

[@user-fd8gb9qq6e]

@@fatalsec Thank you, can you share your telegram ID?

[@BeBarOfficial]

Can it crack anti frida libdexprotector?

[@fatalsec]

Well not out of the box. I am sure there are other checks as well in libdexprptector. You can try using these techniques and try to bypass.

[@BeBarOfficial]

Yes libxexrpotector checks on the cmdline, I tried the hex patch on the frida server lib tried to change the main name entered on the cmdline and it worked, so in conclusion the check is on the cmdline, but the lib is obscured so it's difficult.

[@BeBarOfficial]

@@fatalsec Can we continue chatting on telegram?

[@fatalsec]

Yes, let me know your telegram ID I will ping you.

[@BeBarOfficial]

@@fatalsec @ibadifal

[@mistake262]

Accha😁😆😁😆😁😆😁😆😁😆😁

[@trickshindi100]

Bhai Please Hindi Me Video Banao.... 😭 English Barrier ban chuki hai coding sikhne me.

[@fatalsec]

Jarur bhai kyu nahi! Hindi me b start karenge jaldi.

[@jayedsadiq]

Bro it shows failed to spawn: need gadget to attach with jailed Android. What should i do??

[@fatalsec]

It seems your frida server is not running on the device. Make sure that frida server is running as root.

[@jayedsadiq]

@@fatalsec drive.google.com/file/d/1kbnsXhj5iNIOrOfqcnLR35HOMrFGX_6S/view?usp=drivesdk here is the problem bro. I have installed server&gadget both on the emulator /data/local/tmp and granted chmod permission. But still facing the problem.

[@ayaanalam4217]

At backtrace it showing /system/lib/libhoudini[dot]so and also it showing nothing on interceptor script after executing I am using genymotion emulator android 8 and Frida 16.0.8

[@ayaanalam4217]

Can I connect with you on telegram?

[@fatalsec]

It might be possible that the app is having emulator detection and when you are running it in emulator that detection is causing this crash, but I cannot say much without looking at the complete backtrace.

[@ayaanalam4217]

I can share full backtrace can I connect with you in telegram?