Android

Frida instrumentationHooking & instrumentation

Scans the process memory map and thread names for Frida's runtime artifacts.

hooking_fridaCompromising by default

At a glance

Platform: Android
Category: Hooking & instrumentation
Source: IntegrityChecks.kt · checkHookingFrida
Default status: Makes status compromised
Seen firing: Not yet seen firing in a validated run. Based on validated scenarios whose observed result includes this signal; see below.
OWASP MASTG: MASTG-TEST-0048

How it works

What the code inspects.

Reads /proc/self/maps and flags mapped regions containing frida-agent, frida-gadget, libfrida, gum-js-loop or linjector.

Also inspects thread names under /proc/self/task/*/comm for gum-js-loop — the name of the thread Frida's GumJS runtime spins up — as a second indicator.

Both look at the app's own process, so they work without root and without network.

The exploit it addresses

Why this matters.The threat.

Frida is the dominant runtime-manipulation tool on Android: injected into your process it rewrites any Java or native function, bypassing auth, lifting secrets, and neutering SSL pinning and these very checks. objection automates all of this.

How it can be bypassed

No single check is sufficient.Known evasions.

'Stealth' Frida forks rename the agent, randomize the thread name, and map memory anonymously so none of these strings appear in /proc/self/maps.

Running Frida in 'gadget' mode embedded in a repackaged APK, or hooking the file reads of /proc/self/maps, defeats the string scan.

Validation scenarios

Where this check is exercised.1 scenario.

A03

Frida on Android

Pending · android

Open →

References & further reading

All checks

← DYLD_INSERT_LIBRARIES set Xposed / code injection →