Android App Penetration Testing & Frida Hooks

Mastering Frida Scripts: Developing & Deploying Custom Hooks on Genymotion/AVD

Google AdSense Native Placement - Horizontal Top-Post banner

Introduction to Frida and Dynamic Instrumentation

Frida is an incredibly powerful, dynamic instrumentation toolkit that allows developers and security researchers to inject custom scripts into running processes. It’s a game-changer for reverse engineering, penetration testing, and debugging Android applications, enabling runtime modification of code, bypassing security controls, and observing application behavior without recompiling.

This guide will walk you through setting up Frida on Android emulators like Genymotion and Android Virtual Devices (AVD), followed by developing and deploying custom Frida scripts for practical application analysis.

Prerequisites for Your Frida Lab

Before diving in, ensure you have the following tools installed and configured:

  • Python 3.x: Essential for Frida’s command-line tools.
  • Node.js and npm: Required to install Frida’s Python bindings and related tools.
  • ADB (Android Debug Bridge): Part of the Android SDK, necessary for communicating with your emulator. Ensure it’s in your system’s PATH.
  • Frida CLI Tools: Installable via pip or npm.
  • An Android Emulator: Either Genymotion or Android Studio’s AVD.
# Install Frida tools via pip
pip3 install frida-tools

# (Optional) Install via npm if you prefer or encounter issues with pip
npm install -g frida-tools

Setting Up Your Android Emulator for Frida

Option 1: Genymotion Setup

Genymotion is a popular choice for its performance and ease of rooting. Ensure you download and install a Genymotion image with Google Apps for broader compatibility.

  1. Install Genymotion: Download from the official website and install it.
  2. Create a Virtual Device: Choose an Android version (e.g., Android 9.0 or 10.0) and make sure it has ARM translation if you plan to analyze ARM-only apps.
  3. Root Access: Genymotion devices are usually rooted by default or provide an easy way to enable root within the settings or device configuration.
  4. ADB Connection: Genymotion automatically exposes its devices to ADB. Verify with:
adb devices

Option 2: Android Virtual Device (AVD) Setup

AVD, integrated into Android Studio, is equally capable. The key is choosing the right image.

  1. Open AVD Manager: In Android Studio, go to Tools > AVD Manager.
  2. Create a New Virtual Device: Select a device definition (e.g., Pixel 3).
  3. Choose a System Image: This is crucial. Select an image that includes Google APIs and is of a common architecture (e.g., x86_64 or arm64-v8a). For easier rooting, avoid pure Google Play images.
  4. Root the AVD: AVDs are not rooted by default. You can often start an AVD in a writable system partition mode:

    emulator -avd YourAVDName -writable-system

    Then, push `su` binary and configure it. For most cases, a simple way is to use a pre-rooted image if available or find a guide specific to your AVD Android version for rooting. Alternatively, for many Frida operations, running `frida-server` as root might be sufficient without full system root, as long as it has necessary permissions in `/data/local/tmp`.

  5. ADB Connection: AVDs are automatically detected by ADB.

Deploying Frida Server to the Emulator

Frida operates with a client-server architecture. The `frida-server` binary runs on the target device (your emulator), and the `frida-tools` client runs on your host machine.

  1. Identify Emulator Architecture: Determine your emulator’s CPU architecture.
adb shell getprop ro.product.cpu.abi

Common outputs are `x86_64`, `x86`, `arm64-v8a`, or `armeabi-v7a`. This is vital for downloading the correct `frida-server`.

  • Download Frida Server: Go to Frida’s GitHub releases page and download the `frida-server-*-android-ARCH.xz` file matching your emulator’s architecture. Extract it.
  • # Example for arm64
    wget https://github.com/frida/frida/releases/download/16.1.4/frida-server-16.1.4-android-arm64.xz
    unxz frida-server-16.1.4-android-arm64.xz
  • Push to Emulator: Push the extracted `frida-server` binary to a writable location on the emulator, typically `/data/local/tmp/`.
  • adb push frida-server /data/local/tmp/
  • Set Permissions and Execute: Grant execute permissions and run the server.
  • adb shell

    Android Mobile Specs & Compare Directory

    Are you researching mobile hardware properties, processor SoCs, GPU chipsets, or RAM configurations? Access our complete specs catalog to compare up to 5 devices side-by-side!

    Compare Devices Specs →
    Google AdSense Inline Placement - Content Footer banner