Mobile Dynamic Analysis with Frida on Android ART

+-----------------------------------------------------------------------+
|                       ANDROID APPLICATION PROCESS                     |
|                                                                       |
|  +-----------------------------------------------------------------+  |
|  |                  Java / Kotlin Bytecode (ART)                   |  |
|  |  - DexClassLoader / In-Memory OAT Code                           |  |
|  |  - JNI Invocation: System.loadLibrary("security_native.so")     |  |
|  +-----------------------------------------------------------------+  |
|                                  |                                    |
|                   JNI Bridge (env->RegisterNatives)                   |  |
|                                  v                                    |
|  +-----------------------------------------------------------------+  |
|  |                  Native ARM64 Library (.so)                     |  |
|  |  - PLT / GOT Import Table  |  - Inline ARM64 Assembly           |  |
|  |  - libc.so Imports         |  - Direct Syscalls (svc #0)         |  |
|  +-----------------------------------------------------------------+  |
+-----------------------------------------------------------------------+
                                   |
                Kernel Space Boundary (Linux Kernel 6.x)
                                   v
+-----------------------------------------------------------------------+
|  ptrace()  |  read(/proc/self/maps)  |  read(/proc/self/status)       |
+-----------------------------------------------------------------------+

MOV X0, #-100        // AT_FDCWD
ADRP X1, #maps_path  // Location of "/proc/self/maps"
ADD X1, X1, #:lo12:maps_path
MOV X2, #0           // O_RDONLY
MOV X8, #56          // __NR_openat syscall number on ARM64
SVC #0               // Trigger Supervisor Call (Direct Linux Kernel Syscall)

#!/usr/bin/env python3
"""
Stealth Dynamic Analysis Engine - Python Orchestrator
Author: Syed Zada Abrar (Andrax Pentester)
Description: Headless Python orchestrator for low-overhead ART & ARM64 Native Hooking.
"""

import sys
import time
import argparse
import logging
import frida
from typing import Dict, Any

# Configure structured telemetry output
logging.basicConfig(
    level=logging.INFO,
    format="[%(asctime)s] [%(levelname)s] %(message)s",
    datefmt="%H:%M:%S"
)
logger = logging.getLogger("StealthEngine")

class MobileAnalysisEngine:
    def __init__(self, target_package: str, device_id: str = None):
        self.target_package = target_package
        self.device_id = device_id
        self.device = None
        self.session = None
        self.script = None

    def initialize_device(self) -> None:
        """Connect to local ADB device or USB device."""
        try:
            if self.device_id:
                self.device = frida.get_device(self.device_id)
            else:
                self.device = frida.get_usb_device(timeout=5)
            logger.info(f"Connected to device: {self.device.name} ({self.device.id})")
        except Exception as e:
            logger.error(f"Failed to find USB device: {e}")
            sys.exit(1)

    def on_message(self, message: Dict[str, Any], data: bytes) -> None:
        """Process messages received from JavaScript agent."""
        if message['type'] == 'send':
            payload = message.get('payload', {})
            msg_type = payload.get('type', 'INFO')
            content = payload.get('content', '')
            
            if msg_type == 'CRITICAL':
                logger.error(f"[AGENT CRITICAL] {content}")
            elif msg_type == 'HOOK_HIT':
                logger.info(f"\033[92m[HOOK HIT]\033[0m {payload.get('function')} -> {content}")
            elif msg_type == 'ANTI_FRIDA_BYPASS':
                logger.warning(f"\033[93m[BYPASS TRIGGERED]\033[0m {content}")
            else:
                logger.info(f"[AGENT] {content}")
        elif message['type'] == 'error':
            logger.error(f"[AGENT ERROR] {message.get('stack', message)}")

    def spawn_and_inject(self, script_path: str) -> None:
        """Spawn package in suspended state, inject agent, and resume execution."""
        logger.info(f"Spawning target package: {self.target_package}")
        try:
            pid = self.device.spawn([self.target_package])
            logger.info(f"Process spawned with PID: {pid}")
            
            self.session = self.device.attach(pid)
            logger.info("Attached to process successfully.")
            
            with open(script_path, "r", encoding="utf-8") as f:
                script_code = f.read()

            self.script = self.session.create_script(script_code)
            self.script.on('message', self.on_message)
            self.script.load()
            logger.info("Stealth agent loaded into V8 environment.")
            
            # Resume application execution after hooks are firmly planted
            self.device.resume(pid)
            logger.info(f"Process {pid} resumed. Listening for telemetry...")
        except Exception as e:
            logger.error(f"Injection failed: {e}")
            sys.exit(1)

    def keep_alive(self) -> None:
        """Keep Python process running to receive IPC messages."""
        try:
            while True:
                time.sleep(1)
        except KeyboardInterrupt:
            logger.info("Session terminated by user. Detaching...")
            if self.session:
                self.session.detach()
            sys.exit(0)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="Production Mobile Analysis Engine")
    parser.add_argument("-p", "--package", required=True, help="Target Android Package Name (e.g. com.vendor.app)")
    parser.add_argument("-s", "--script", default="stealth_agent.js", help="Path to Frida agent JS")
    args = parser.parse_args()

    engine = MobileAnalysisEngine(target_package=args.package)
    engine.initialize_device()
    engine.spawn_and_inject(script_path=args.script)
    engine.keep_alive()

/**
 * Stealth Dynamic Instrumentation Engine - Frida JavaScript Agent
 * Author: Syed Zada Abrar (Andrax Pentester)
 * Target: Android ART & Native ARM64 Shared Libraries (.so)
 */

const LOG = (type, content, extra = {}) => {
    send({ type: type, content: content, ...extra });
};

// ============================================================================
// PHASE 1: NATIVE LIBC HOOKING & ANTI-FRIDA CLOAKING
// Must execute BEFORE JNI_OnLoad or anti-tamper threads initialize.
// ============================================================================

function installAntiFridaBypasses() {
    LOG('INFO', 'Installing low-level Anti-Frida evasion hooks...');

    const pOpenat = Module.findExportByName('libc.so', 'openat');
    const pRead = Module.findExportByName('libc.so', 'read');
    const pStrcmp = Module.findExportByName('libc.so', 'strcmp');
    const pStrstr = Module.findExportByName('libc.so', 'strstr');

    // Memory storage for cloaked file descriptors
    const cloakedFDs = new Set();

    // 1. Cloak /proc/self/maps and /proc/self/status access
    if (pOpenat) {
        Interceptor.attach(pOpenat, {
            onEnter(args) {
                const pathPtr = args[1];
                if (!pathPtr.isNull()) {
                    const path = pathPtr.readCString();
                    if (path.includes('/proc/') && (path.includes('/maps') || path.includes('/status') || path.includes('/cmdline'))) {
                        this.isTargetProc = true;
                        this.path = path;
                    }
                }
            },
            onLeave(retval) {
                if (this.isTargetProc && retval.toInt32() > 0) {
                    const fd = retval.toInt32();
                    cloakedFDs.add(fd);
                    LOG('ANTI_FRIDA_BYPASS', `Intercepted proc read on FD ${fd} (${this.path}). Redirecting stream...`);
                }
            }
        });
    }

    // 2. Filter read buffer contents to strip frida references
    if (pRead) {
        Interceptor.attach(pRead, {
            onEnter(args) {
                this.fd = args[0].toInt32();
                this.buf = args[1];
            },
            onLeave(retval) {
                const bytesRead = retval.toInt32();
                if (bytesRead > 0 && cloakedFDs.has(this.fd)) {
                    let content = this.buf.readUtf8String(bytesRead);
                    if (content) {
                        let sanitized = content
                            .replace(/.*frida.*/g, '')
                            .replace(/.*gum-js-loop.*/g, '')
                            .replace(/.*gmain.*/g, '')
                            .replace(/TracerPid:\s+\d+/g, 'TracerPid:\t0');
                        
                        this.buf.writeUtf8String(sanitized);
                    }
                }
            }
        });
    }

    // 3. Intercept strstr / strcmp checks for 'frida' or 'gum'
    if (pStrstr) {
        Interceptor.attach(pStrstr, {
            onEnter(args) {
                const haystack = args[0].isNull() ? "" : args[0].readCString();
                const needle = args[1].isNull() ? "" : args[1].readCString();
                
                if (needle.includes("frida") || needle.includes("gum") || needle.includes("lininjector")) {
                    LOG('ANTI_FRIDA_BYPASS', `Bypassed strstr scan for needle: ${needle}`);
                    this.bypass = true;
                }
            },
            onLeave(retval) {
                if (this.bypass) {
                    retval.replace(ptr(0));
                }
            }
        });
    }
}

// ============================================================================
// PHASE 2: ART JAVA METHOD HOOKING & CERTIFICATE PINNING BYPASS
// ============================================================================

function installJavaHooks() {
    if (!Java.available) {
        LOG('CRITICAL', 'Java ART environment unavailable!');
        return;
    }

    Java.perform(() => {
        LOG('INFO', 'ART Environment attached. Initializing Java Hooks...');

        // 1. Universal OkHttp3 / Custom Certificate Pinning Bypass
        try {
            const ArrayList = Java.use("java.util.ArrayList");
            const TrustManagerFactory = Java.use("javax.net.ssl.TrustManagerFactory");
            const SSLContext = Java.use("javax.net.ssl.SSLContext");

            // Create custom permissive TrustManager
            const CustomTrustManager = Java.registerClass({
                name: "com.andrax.StealthTrustManager",
                implements: [Java.use("javax.net.ssl.X509TrustManager")],
                methods: {
                    checkClientTrusted(chain, authType) {},
                    checkServerTrusted(chain, authType) {},
                    getAcceptedIssuers() { return []; }
                }
            });

            const trustManagers = [CustomTrustManager.$new()];
            const SSLContext_init = SSLContext.init.overload(
                '[Ljavax.net.ssl.KeyManager;',
                '[Ljavax.net.ssl.TrustManager;',
                'java.security.SecureRandom'
            );

            SSLContext_init.implementation = function (keyManager, trustManager, secureRandom) {
                LOG('HOOK_HIT', 'SSLContext.init() intercepted. Overriding TrustManagers with Permissive SSL Bridge.', { function: 'SSLContext.init' });
                SSLContext_init.call(this, keyManager, trustManagers, secureRandom);
            };
        } catch (err) {
            LOG('INFO', `SSL Bypass warning: ${err.message}`);
        }

        // 2. Hook dynamic JNI Native Registration
        const System = Java.use("java.lang.System");
        System.loadLibrary.implementation = function (libName) {
            LOG('HOOK_HIT', `System.loadLibrary("${libName}") triggered. Loading native hooks...`, { function: 'System.loadLibrary' });
            this.loadLibrary(libName);
            
            // Re-apply native module hooks once binary is loaded into memory
            hookNativeLibrarySymbols(libName);
        };
    });
}

// ============================================================================
// PHASE 3: ARM64 NATIVE SYMBOL & PLT/GOT HOOKING
// ============================================================================

function hookNativeLibrarySymbols(targetLibName) {
    const libModule = Process.findModuleByName(`lib${targetLibName}.so`);
    if (!libModule) return;

    LOG('INFO', `Inspecting loaded library: lib${targetLibName}.so Base: ${libModule.base}`);

    // Intercept JNI_OnLoad to trace explicit RegisterNatives calls
    const pJniOnLoad = Module.findExportByName(`lib${targetLibName}.so`, 'JNI_OnLoad');
    if (pJniOnLoad) {
        Interceptor.attach(pJniOnLoad, {
            onEnter(args) {
                LOG('HOOK_HIT', `JNI_OnLoad called for lib${targetLibName}.so`, { function: 'JNI_OnLoad' });
            }
        });
    }
}

// Initialize Pipeline
installAntiFridaBypasses();
installJavaHooks();

Original Target Function Prologue:
[Addr 0x1000] SUB SP, SP, #0x30
[Addr 0x1004] STP X29, X30, [SP, #0x20]

Patched Target Function (After Inline Hook):
[Addr 0x1000] LDR X16, #8             -----> Jump to Replacement Function C Code
[Addr 0x1004] BR  X16                        |
[Addr 0x1008] .quad 0x7FFF12345678 <---------+

Trampoline Executable Stub:
[Addr 0x9000] SUB SP, SP, #0x30              (Executed Original Prologue)
[Addr 0x9004] STP X29, X30, [SP, #0x20]
[Addr 0x9008] LDR X16, #8             -----> Branch back to Target Function + 0x10
[Addr 0x900C] BR  X16
[Addr 0x9010] .quad 0x1010

/**
 * Low-Latency ARM64 Inline Hooking Engine in C
 * Author: Syed Zada Abrar (Andrax Pentester)
 * Target: Android Linux Kernel 6.x / ARM64 execution
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>
#include <stdint.h>
#include <android/log.h>

#define LOG_TAG "StealthNativeHook"
#define LOGI(...) __android_log_print(ANDROID_LOG_INFO, LOG_TAG, __VA_ARGS__)
#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR, LOG_TAG, __VA_ARGS__)

#define PAGE_START(addr) ((uintptr_t)(addr) & ~(sysconf(_SC_PAGE_SIZE) - 1))
#define PAGE_SIZE sysconf(_SC_PAGE_SIZE)

// Structure holding original bytes for unhooking
typedef struct {
    void *target_addr;
    uint8_t orig_bytes[16];
    void *trampoline_addr;
} arm64_hook_t;

// Function prototype for original security check
typedef int (*verify_integrity_t)(const char *package_name, int flags);
static verify_integrity_t g_orig_verify_integrity = NULL;

// Replacement function in C
int hooked_verify_integrity(const char *package_name, int flags) {
    LOGI("[NATIVE C HOOK] verify_integrity called for package: %s (flags: %d)", package_name, flags);
    LOGI("[NATIVE C HOOK] Overriding result -> Forcing INTEGRITY_SUCCESS (0)");
    
    // Always return 0 (Success / Unmodified)
    return 0;
}

// Low-level memory patching engine
int arm64_inline_hook(void *target_func, void *replacement_func, void **trampoline_out) {
    uintptr_t page_start = PAGE_START(target_func);
    
    // 1. Remap target memory page as Read-Write-Execute
    if (mprotect((void *)page_start, PAGE_SIZE * 2, PROT_READ | PROT_WRITE | PROT_EXEC) != 0) {
        LOGE("mprotect failed to set RWX permissions!");
        return -1;
    }

    // 2. Allocate executable page for the trampoline stub
    void *trampoline = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, 
                            MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
    if (trampoline == MAP_FAILED) {
        LOGE("mmap failed to allocate trampoline memory!");
        return -1;
    }

    // 3. Construct Trampoline: Original 16 bytes + Jump back to Target + 16
    uint8_t *t_ptr = (uint8_t *)trampoline;
    memcpy(t_ptr, target_func, 16); // Copy original instructions
    t_ptr += 16;

    // ARM64 Jump back to target_func + 16
    uintptr_t return_address = (uintptr_t)target_func + 16;
    uint32_t jump_back_stub[] = {
        0x58000050, // LDR X16, #8
        0xd61f0200  // BR  X16
    };
    memcpy(t_ptr, jump_back_stub, sizeof(jump_back_stub));
    t_ptr += sizeof(jump_back_stub);
    memcpy(t_ptr, &return_address, sizeof(uintptr_t));

    *trampoline_out = trampoline;

    // 4. Overwrite Target Function Prologue with Jump to Replacement
    uintptr_t replacement_address = (uintptr_t)replacement_func;
    uint32_t patch_stub[] = {
        0x58000050, // LDR X16, #8
        0xd61f0200  // BR  X16
    };
    
    uint8_t *target_ptr = (uint8_t *)target_func;
    memcpy(target_ptr, patch_stub, sizeof(patch_stub));
    memcpy(target_ptr + sizeof(patch_stub), &replacement_address, sizeof(uintptr_t));

    // 5. Clear CPU Instruction Cache (ICache) to ensure immediate execution of patched instructions
    __builtin___clear_cache((char *)target_func, (char *)target_func + 16);
    __builtin___clear_cache((char *)trampoline, (char *)trampoline + 64);

    // 6. Restore page protection to Read-Execute
    mprotect((void *)page_start, PAGE_SIZE * 2, PROT_READ | PROT_EXEC);

    LOGI("ARM64 Inline Hook successfully applied at Target: %p -> Replacement: %p", target_func, replacement_func);
    return 0;
}

cyb3rvolt3x@archlinux:~/mobile_lab$ python3 stealth_injector.py -p com.vendor.secureapp -s stealth_agent.js
[14:22:01] [INFO] Connected to device: Android Emulator 5554 (127.0.0.1:5554)
[14:22:01] [INFO] Spawning target package: com.vendor.secureapp
[14:22:02] [INFO] Process spawned with PID: 18492
[14:22:02] [INFO] Attached to process successfully.
[14:22:02] [INFO] Stealth agent loaded into V8 environment.
[14:22:02] [AGENT] Installing low-level Anti-Frida evasion hooks...
[14:22:02] [AGENT] ART Environment attached. Initializing Java Hooks...
[14:22:02] [INFO] Process 18492 resumed. Listening for telemetry...
[14:22:03] [AGENT] Intercepted proc read on FD 42 (/proc/self/maps). Redirecting stream...
[14:22:03] [AGENT] Bypassed strstr scan for needle: frida-agent.so
[14:22:03] [HOOK HIT] System.loadLibrary("security_native.so") triggered. Loading native hooks...
[14:22:03] [AGENT] Inspecting loaded library: libsecurity_native.so Base: 0x7f8391a000
[14:22:03] [HOOK HIT] JNI_OnLoad called for libsecurity_native.so
[14:22:04] [HOOK HIT] SSLContext.init() intercepted. Overriding TrustManagers with Permissive SSL Bridge.
[14:22:05] [HOOK HIT] verify_integrity -> Returning INTEGRITY_SUCCESS (0x0)

adb shell "su -c 'cat /proc/18492/maps | grep frida'"
# [Output: Clean / Empty - 0 matches returned]

adb shell "su -c 'cat /proc/18492/status | grep TracerPid'"
TracerPid:	0

title: Suspicious RWX Memory Remapping in Mobile Runtime Process
id: 9a8c2f1e-3b4d-4e5a-8f9c-0d1e2f3a4b5c
status: production
description: Detects process execution modifying executable native library pages to Read-Write-Execute (RWX), indicative of inline hooking or memory patching.
author: Syed Zada Abrar
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Syscall: "mprotect"
    ProtFlags|contains: "PROT_EXEC|PROT_WRITE"
  filter_legit:
    ProcessName|endswith:
      - "/system/bin/app_process64"
      - "/system/bin/art"
  condition: selection and not filter_legit
falsepositives:
  - Custom JIT compilers without W^X enforcement.
level: high
tags:
  - attack.defense_evasion
  - attack.t1055.001