frida-gadget 1.3.1

Automated Frida Gadget injection tool

frida-gadget is a tool that can be used to patch APKs in order to utilize the Frida gadget.

This tool automates the process of downloading the Frida gadget library and injecting the loadlibrary code into the main activity.

Installation

pip install frida-gadget

Prerequirement

You should install Apktool and add it to your PATH environment variable.

# Install Apktool on macOS
brew install apktool

# Add Apktool to your PATH environment variable
export PATH=$PATH:$HOME/.brew/bin

Other Platforms: Install Guide

Usage

$ frida-gadget --help
  Usage: frida-gadget [OPTIONS] APK_PATH

     Patch an APK with the Frida gadget library

     Args:     apk_path (str): Path of the target APK file
               arch     (str): Target architecture of the device

     Outputs:  Injected APK file

  Options:
     --arch TEXT       Support [arm, arm64, x86, x86_64]
     --skip-decompile
     --skip-recompile
     --use-aapt2       Can be required for newer Android apps
     --help            Show this message and exit.

Example

$ frida-gadget handtrackinggpu.apk --arch arm64
  [INFO] Auto-detected frida version: 16.1.3
  [INFO] APK: '[REDACTED]\demo-apk\handtrackinggpu.apk'
  [INFO] Gadget Architecture(--arch): arm64(default)
  [DEBUG] Decompiling the target APK using apktool
  [DEBUG] Downloading the frida gadget library for arm64
  [DEBUG] Checking internet permission and extractNativeLibs settings
  [DEBUG] Adding 'android.permission.INTERNET' permission to AndroidManifest.xml
  [DEBUG] Searching for the main activity in the smali files
  [DEBUG] Found the main activity at '[REDACTED]\frida-gadget\tests\demo-apk\handtrackinggpu\smali\com\google\mediapipe\apps\handtrackinggpu\MainActivity.smali'
  [DEBUG] Locating the onCreate method and injecting the loadLibrary code
  [DEBUG] Recompiling the new APK using apktool

  [INFO] Success: [REDACTED]\demo-apk\handtrackinggpu\dist\handtrackinggpu.apk

$ unzip -l handtrackinggpu.apk | grep libfrida-gadget
  21133848  09-15-2021 02:28   lib/arm64-v8a/libfrida-gadget-16.1.3-android-arm64.so

loadLibrary code will be injected

Easy to re-sign your app by apk-signer

$ apk-signer handtrackinggpu.apk
  [Warning] Signing with default keystore.
  [Warning] Please pass --key_path, --key_alias, --key_pass, --ks_pass parameter, if you want to use your keystore
  handtrackinggpu-signed.apk

$ adb install handtrackinggpu-signed.apk

Contributing