This is the 29th day of my participation in the August Wenwen Challenge.More challenges in August

Reverse Frida android from Rose

Quickly build Frida Android reverse environment

During this period of time, I have been following Ruth to make up lessons in my spare time. I broke my mobile phone with a broken hand, so I took this opportunity to write an article to record how to complete the construction of Frida Android reverse environment from scratch.

According to rouse sister’s tutorial, I successfully completed the setup of pixel+ AndRiod 8.1.0 + Twrp3.3 + Magisk + Frida. The tools needed in this process are as follows:

  • A Pixel Phone
  • A computer (for running virtual machines)

All the kits can be downloaded at Gthub: github.com/r0ysue/Andr…

Get these tools and related packages ready and start brushing.

Related software in the background, public background reply 20200530 to obtain.

One, quick brush machine

1. Check your mobile phone to make sure it has enough power and turn it off

2. After shutting down the phone, press the power button and volume – button to enter the Fastboot mode (this action must be skilled, and will be used frequently later).

3. Unpack sailfish-OPm1.171019.011-factory-56D15350 and you will find the following files

4. Run the flash-all.sh file

./flash-all.sh
Copy the code

5, this process will be relatively long, there is no need to do other operations as long as quietly waiting for the phone to restart.

6. Verify the following operation path after the mobile phone is turned on

Phone open Settings - System - About phone - Android versionVersion 8.1.0 is done by brush
Copy the code

Two, install TWRP Recovery

0. For the introduction of TWRP, please refer to the content on Github. Meanwhile, two installation packages need to be prepared

In Recovery, you can mount disks, modify system partitions, use ADB commands, and so on.

TWRP - pixel - installer - sailfish 3.3.0-0. Zip TWRP 3.3.0-0 - sailfish. ImgCopy the code

1. Use the following command to push the first zip package to /sdcard on the phone

The adb push/yourpath/TWRP - pixel - installer - sailfish - 3.3.0-0. Zip/sdcardCopy the code

2. After push is completed, let the phone enter the Fastboot mode again and use the following command to start brushing TWRP

Fastboot boot TWRP 3.3.0-0 - sailfish. ImgCopy the code

3. At this time, the phone will automatically restart and enter the TWRP installation interface.

4. Slide the lower slider to enter the installation interface

5. Clicking Install will take you to a file manager-like interface, where you can see the zip package push in 1. Click on it

6, there will also be a slider, after the slide into the following interface.

7. Click Reboot System to complete the TWRP boot

3. Swipe into Magisk to complete Root

1. Prepare the installation package magisk-v20.4.zip and use the following command to push it

The adb push/yourpath/Magisk - v20.4.zip/sdcardCopy the code

2. Set the phone to Fastboot mode, press the volume button to switch to Recovery mode, and press the power button to select it. At this time, the phone will start up and enter the TWRP installation interface.

3. Repeat steps 3 and 4 in TWRP and select the ZIP package pushed in step 1 in the list

4, the same slider, into the installation

5. Slide over and enter the installation interface

6. After installing Magisk, click Reboot System to install Magisk

7. After the installation is complete, use ADB shell to connect to the mobile phone and use the following command to obtain root permission

su -
Copy the code

There will be a popup on your phone and you can just hit OK

4. Frida-server installation

1. After obtaining the software package, use ADB push to push the decompressed file to the mobile phone

The adb push/yourpath/frida - server - 12.8.0 - android - arm64 / data /local/tmp
Copy the code

2. After push, use ADB shell to connect the mobile phone, switch to /data/local/ TMP, and run to enable

. / frida - server - 12.8.0 - android - arm64Copy the code

3, open a computer shell again, note that the following command is running on your computer, not on your phone

frida-ps -U
Copy the code

Getting the above output represents success

A process that can kill the server if the server on your mobile phone cannot be connected

ps | grep frida
kill- 9 fridapid. / frida - server - 12.8.0 - android - arm64 &Copy the code

Five, tread pit record

The installation was relatively smooth, and I myself ran into a pit with the VM

1. Do not use the 15.0 version of the VM software. Use a higher version or a lower version

Also refer to the notes of other bigwigs

https://mp.weixin.qq.com/s/8XoPinibc12SE-Ru5fXjdg
Copy the code

At the end of the article above, there is also a pit mentioned, which is about the problems in TWRP. Fortunately, I did not encounter it. If I encounter it again, I can refer to the solutions

After completing the above steps, you can continue your Frida learning journey. See you next time