WEBVTT

1
00:00:00.600 --> 00:00:05.575
Welcome. In this tutorial we look at everything this project does with Frida.

2
00:00:06.025 --> 00:00:12.775
Frida is an attacker's tool, and a tester's tool. We use it in two ways: we detect it, and we simulate it.

3
00:00:13.225 --> 00:00:22.025
By the end, you will know how the SDK spots Frida on Android and iOS, and how to reproduce the attack on a real iPhone.

4
00:00:23.633 --> 00:00:30.933
Frida is a dynamic instrumentation toolkit. It injects a JavaScript engine into a running process.

5
00:00:31.383 --> 00:00:38.733
From that script, an attacker can hook any Java or native function, read its arguments, and change what it returns.

6
00:00:39.183 --> 00:00:45.108
The app does not need to be modified on disk. The hooks live only in memory, at runtime.

7
00:00:46.733 --> 00:00:55.083
Why does a device integrity library care? Because Frida can bypass login, disable SSL pinning, and lift secrets.

8
00:00:55.533 --> 00:01:01.133
Worse, it can hook the integrity checks themselves, and make them report a clean device.

9
00:01:01.583 --> 00:01:07.433
So the first job of this project is simple: notice when Frida is inside the process.

10
00:01:09.033 --> 00:01:17.358
On Android, the check is called hooking_frida. It reads the process memory map, /proc/self/maps.

11
00:01:17.808 --> 00:01:24.933
If any mapped region contains frida-agent, frida-gadget, libfrida, or linjector, the signal fires.

12
00:01:25.383 --> 00:01:34.108
A second test looks at thread names. Frida's script runtime runs in a thread called gum-js-loop, and that name is a strong tell.

13
00:01:34.558 --> 00:01:39.683
The signal is marked strong, and it appears in the result under the hooking category.

14
00:01:41.300 --> 00:01:49.325
On iOS, the check is called hooking_libraries. It walks every Mach-O image loaded into the process.

15
00:01:49.775 --> 00:01:58.600
Each image path is lowercased, and compared against a list of needles: frida, fridagadget, substrate, libhooker, ellekit, and more.

16
00:01:59.050 --> 00:02:08.950
A separate check reads the DYLD_INSERT_LIBRARIES environment variable, the classic way to inject a dylib before main runs.

17
00:02:09.400 --> 00:02:13.575
Any match means the app's own code can no longer be trusted.

18
00:02:15.200 --> 00:02:22.375
Detection code is only trustworthy if you test it. So the example app ships an opt-in Frida Gadget build.

19
00:02:22.825 --> 00:02:29.425
Frida Gadget is a dylib that carries Frida inside the app. That means no jailbreak is needed.

20
00:02:29.875 --> 00:02:38.450
You download the gadget, set FRIDA_GADGET=1, and run prebuild. An Expo config plugin does the rest.

21
00:02:38.900 --> 00:02:47.325
It links the gadget on device builds only, embeds and signs it in the frameworks folder, and writes a gadget configuration file.

22
00:02:47.775 --> 00:02:54.025
Without that environment variable, the plugin does nothing, so normal builds are never affected.

23
00:02:55.633 --> 00:03:04.108
The configuration tells the gadget to listen on localhost, port 27042, and to resume the app immediately.

24
00:03:04.558 --> 00:03:14.383
The key setting is code_signing: required. On a stock iPhone with no debugger, iOS kills any process that tries to patch its own code.

25
00:03:14.833 --> 00:03:19.358
Required mode never writes to code pages, so the app survives.

26
00:03:19.808 --> 00:03:29.158
The trade-off is honest: Frida's Interceptor is unavailable unless the app runs under LLDB. For detection testing, that is enough.

27
00:03:30.767 --> 00:03:37.592
Here is the real result, on an iPhone XS Max running iOS eighteen, completely stock.

28
00:03:38.042 --> 00:03:44.992
Launched from the home screen, the status is compromised, with a single signal: hooking_libraries.

29
00:03:45.442 --> 00:03:56.467
Launch the same build from Xcode, and two more signals appear: debugger attached, and hooking dyld insert, because Xcode injects its own view-debugging library.

30
00:03:56.917 --> 00:04:02.592
Those are expected, not false positives. They show each check working independently.

31
00:04:04.200 --> 00:04:13.125
No client-side check is perfect. Stealth Frida forks rename the agent, randomize thread names, and map memory anonymously.

32
00:04:13.575 --> 00:04:19.650
Frida also attaches without setting the debugger flags, so the debugger checks do not catch it.

33
00:04:20.100 --> 00:04:27.625
That is why the documentation recommends pairing these signals with server-side attestation for high-value flows.

34
00:04:29.233 --> 00:04:35.058
Let's recap. One: Frida injects a script engine to hook functions at runtime.

35
00:04:35.508 --> 00:04:44.008
Two: on Android we scan /proc/self/maps and thread names. On iOS we scan loaded images and the dyld environment.

36
00:04:44.458 --> 00:04:50.108
Three: the opt-in gadget build lets you prove those checks fire on a stock iPhone.

37
00:04:50.558 --> 00:04:55.033
Four: detection raises the cost of an attack, it does not end it.

38
00:04:56.667 --> 00:05:03.442
Thanks for watching. Find the gadget plugin in example/plugins, and the full guide in the README.

39
00:05:03.892 --> 00:05:07.292
Now go run the gadget build on your own device.