frida snippets

This document details various code examples and functionalities related to Android and iOS development, reverse engineering, and system-level interactions. It covers topics ranging from method hooking and system property access to memory manipulation and iOS-specific features. The examples provided demonstrate a diverse set of techniques useful for debugging, analysis, and security research.

& also output examples

Table of Contents

To list abbreviations :ab

Expand by writing key and

Java method hook generator using keyboard shortcut

Fetch SSL keys

⬆ Back to top

Load CPP module

Load C module

⬆ Back to top

One time watchpoint

Intercept funcPtr & log who read/write to x2 via removing permissions w/ mprotect.

⬆ Back to top

Socket activity

Android example

⬆ Back to top

Intercept Open

An example for intercepting libc#open & logging backtrace if specific file was opened.

⬆ Back to top

Execute shell command

List directory contents:

Pull binary from iOS

⬆ Back to top

List modules

List modules & exports

⬆ Back to top

Log SQLite query

⬆ Back to top

system property get

⬆ Back to top

Binder transactions

⬆ Back to top

Reveal native methods

registerNativeMethods can be used as anti reversing technique to the native .so libraries, e.g. hiding the symbols as much as possible, obfuscating the exported symbols and eventually adding some protection over the JNI bridge.

source

@OldVersion

⬆ Back to top

Log method arguments

⬆ Back to top

Enumerate loaded classes

And save to a file named pkg.classes

⬆ Back to top

Class description

Get class methods & members.

If there is a name collision, method & member has the same name, an underscore will be added to member. source

⬆ Back to top

Turn Wifi OFF

It will turn WiFi off on the creation of the first Acivity.

⬆ Back to top

Set proxy

It will set a system-wide proxy using the supplied IP address and port.

⬆ Back to top

Get IMEI

Can also hook & change IMEI.

⬆ Back to top

Hook io InputStream

Hook InputputStream & print buffer as ascii with char limit & exclude list.

⬆ Back to top

Android make Toast

Await for condition

Await until specific DLL will load in Unity app, can implement hot swap.

⬆ Back to top

Webview URLS

Log whenever WebView switch URL.

⬆ Back to top

Print runtime strings

Hoooking toString of StringBuilder/Buffer & printing stacktrace.

⬆ Back to top

Print shared preferences updates

⬆ Back to top

String comparison

⬆ Back to top

Hook JNI by address

Hook native method by module name and method address and print arguments.

⬆ Back to top

Hook constructor

⬆ Back to top

Hook reflection

java.lang.reflect.Method#invoke(Object obj, Object... args, boolean bool)

⬆ Back to top

Trace class

Tracing class method, with pretty colors and options to print as JSON & stacktrace.

TODO add trace for c'tor.

⬆ Back to top

Get Android ID

The ANDROID_ID is unique in each application in Android.

⬆ Back to top

Change location

⬆ Back to top

Bypass FLAG_SECURE

Bypass screenshot prevention stackoverflow question

⬆ Back to top

Shared Preferences update

⬆ Back to top

Hook overloads

⬆ Back to top

Register broadcast receiver

⬆ Back to top

list classes implements interface

⬆ Back to top

Increase step count

⬆ Back to top

OS Log

⬆ Back to top

iOS alert box

⬆ Back to top

File Access

Log each file open

⬆ Back to top

Observe class

observeClass('Someclass$innerClass');

⬆ Back to top

Find iOS application UUID

Get UUID for specific path when attached to an app by reading plist file under each app container.

⬆ Back to top

Extract cookies

⬆ Back to top

Describe class members

Print map of members (with values) for each class instance

⬆ Back to top

Class hierarchy

Object.keys(ObjC.classes) will list all available Objective C classes,

but actually this will return all classes loaded in current process, including system frameworks.

If we want something like weakclassdump, to list classes from executable it self only, Objective C runtime already provides such function objccopyClassNamesForImage

⬆ Back to top

Hook refelaction

Hooking objc_msgSend

⬆ Back to top

Intercept Entire Module

To reduce UI related functions I ues the following steps:

⬆ Back to top

Dump memory segments

⬆ Back to top

Memory scan

⬆ Back to top

Stalker

⬆ Back to top

Cpp demangler

add to your script

compile

run

⬆ Back to top

Early hook

Set hooks before DTINITARRAY ( source )

Credit: iGio90

⬆ Back to top

Device properties

Example of quick&dirty iOS device properties extraction

⬆ Back to top

Take screenshot

⬆ Back to top

Log SSH Commands

⬆ Back to top

TODOs

example:

Mitsuba Renderer 3

Documentation	Tutorial videos	Linux	MacOS	Windows	PyPI

️

Warning

️

There currently is a large amount of undocumented and unstable work going on in

the master branch. We'd highly recommend you use our

latest release

until further notice.

If you already want to try out the upcoming changes, please have a look at

this porting guide.

It should cover most of the new features and breaking changes that are coming.

Introduction

Mitsuba 3 is a research-oriented rendering system for forward and inverse light

transport simulation developed at EPFL in Switzerland.

It consists of a core library and a set of plugins that implement functionality

ranging from materials and light sources to complete rendering algorithms.

Mitsuba 3 is retargetable: this means that the underlying implementations and

data structures can transform to accomplish various different tasks. For

example, the same code can simulate both scalar (classic one-ray-at-a-time) RGB transport

or differential spectral transport on the GPU. This all builds on

Dr.Jit, a specialized just-in-time(JIT) compiler developed specifically for this project.

Main Features

• Cross-platform: Mitsuba 3 has been tested on Linux (x86_64), macOS

  (aarch64, x8664), and Windows (x8664).

• High performance: The underlying Dr.Jit compiler fuses rendering code

  into kernels that achieve state-of-the-art performance using

  an LLVM backend targeting the CPU and a CUDA/OptiX backend

  targeting NVIDIA GPUs with ray tracing hardware acceleration.

• Python first: Mitsuba 3 is deeply integrated with Python. Materials,

  textures, and even full rendering algorithms can be developed in Python,

  which the system JIT-compiles (and optionally differentiates) on the fly.

  This enables the experimentation needed for research in computer graphics and

  other disciplines.

• Differentiation: Mitsuba 3 is a differentiable renderer, meaning that it

  can compute derivatives of the entire simulation with respect to input

  parameters such as camera pose, geometry, BSDFs, textures, and volumes. It

  implements recent differentiable rendering algorithms developed at EPFL.

• Spectral & Polarization: Mitsuba 3 can be used as a monochromatic

  renderer, RGB-based renderer, or spectral renderer. Each variant can

  optionally account for the effects of polarization if desired.

Tutorial videos, documentation

We've recorded several YouTube videos that provide a gentle introduction

Mitsuba 3 and Dr.Jit. Beyond this you can find complete Juypter notebooks

covering a variety of applications, how-to guides, and reference documentation

on readthedocs.

Installation

We provide pre-compiled binary wheels via PyPI. Installing Mitsuba this way is as simple as running

pip install mitsuba

on the command line. The Python package includes thirteen variants by default:

• scalar_rgb

• scalar_spectral

• scalarspectralpolarized

• llvmadrgb

• llvmadmono

• llvmadmono_polarized

• llvmadspectral

• llvmadspectral_polarized

• cudaadrgb

• cudaadmono

• cudaadmono_polarized

• cudaadspectral

• cudaadspectral_polarized

The first two perform classic one-ray-at-a-time simulation using either a RGB

or spectral color representation, while the latter two can be used for inverse

rendering on the CPU or GPU. To access additional variants, you will need to

compile a custom version of Dr.Jit using CMake. Please see the

documentation

for details on this.

Requirements

• Python >= 3.8

• (optional) For computation on the GPU: Nvidia driver >= 495.89

• (optional) For vectorized / parallel computation on the CPU: LLVM >= 11.1

Usage

Here is a simple "Hello World" example that shows how simple it is to render a

scene using Mitsuba 3 from Python:

# Import the library using the alias "mi"import mitsuba as mi# Set the variant of the renderermi.setvariant('scalarrgb')# Load a scenescene = mi.loaddict(mi.cornellbox())# Render the sceneimg = mi.render(scene)# Write the rendered image to an EXR filemi.Bitmap(img).write('cbox.exr')

Tutorials and example notebooks covering a variety of applications can be found

in the documentation.

About

This project was created by Wenzel Jakob.

Significant features and/or improvements to the code were contributed by

Sébastien Speierer,

Nicolas Roussel,

Merlin Nimier-David,

Delio Vicini,

Tizian Zeltner,

Baptiste Nicolet,

Miguel Crespo,

Vincent Leroy, and

Ziyi Zhang.

When using Mitsuba 3 in academic projects, please cite:

@software{Mitsuba3,title = {Mitsuba 3 renderer},author = {Wenzel Jakob and Sébastien Speierer and Nicolas Roussel and Merlin Nimier-David and Delio Vicini and Tizian Zeltner and Baptiste Nicolet and Miguel Crespo and Vincent Leroy and Ziyi Zhang},note = {https://mitsuba-renderer.org},version = {3.1.1},year = 2022}