# frida Published articles for frida. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Creating QMI traces from Android phones with Frida to reverse engineer Voice over LTE DevFeed: [Creating QMI traces from Android phones with Frida to reverse engineer Voice over LTE]() Original publisher: [Read original article]() Published: 2025-06-17T00:00:00Z Content type: tutorial Language: en Sources: [postmarketOS Blog]() Topics: [Android](), [Qualcomm](), [Protocol (disambiguation)](), [Linux]() Tags: [android](), [frida](), [postmarketos](), [qualcomm]() ### AI overview A technical post on investigating Qualcomm-based Android phones' Voice over LTE stack through the QMI interface. It discusses QMI services and transports, limitations of Qualcomm Diag tooling, and using Frida to capture QMI messages from a running process. ### Source excerpt This is a guest blog post by Alexander 'lynxis' Couzens, one of the people behind the OpenIMSd NLnet project funded by NGI Zero Core. At postmarketOS we helped them create a grant proposal, and continue helping with project planning. For more details, check the project website. We thank NLnet and the NGI Zero Core fund for supporting this initiative. Introduction To investigate how the Voice over LTE stack in Qualcomm based phones works, I have to look into the QMI interface. QMI is a structured interface using TLV. Furthermore, QMI is a protocol which can be used over different interface and offers communication between services. A service usually handles a logical component of the baseband, e.g. the communication with the simcard is handled by the UIM (User Identity Module). Or the NAS handles the high level Network Access. QMI also supports multiple clients at the same time. It allows two daemons to communicate via QMI at the same time without the need to synchronize with each other. QMI supports at least communication over the following transports (not a full list): USB (e.g. mini-pcie) Shared memory (SoC) Socket (kernel socket class, but internally over shared memory) Tunneled over Qualcomm Diag To research the QMI VoLTE messages of a stock Android, we need to able to capture those messages. When I first encountered QMI and researched how the "legacy" voice calls are working on Qualcomm based phones, I used Qualcomm Diag for it using the osmo-qcdiag project. Sadly osmo-qcdiag only supports Qualcomm Diag when exposed as TTY on Linux via /dev/ttyXXXX, but not (as many other projects by now) directly via USB without a kernel driver. The issue with the kernel driver is the limited support of devices. When enabling Qualcomm Diag for a new phone, it requires a small patch to add the USB ID to the driver. Other projects like SCAT or QCSuper can use libusb to directly communicate with the phone. Because of this I tried to add QMI sniffing in SCAT, but it didn't work wi ## EU Funding for Mobile App Traffic Interception DevFeed: [EU Funding for Mobile App Traffic Interception]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2023-02-27T12:00:00Z Content type: article Language: en Sources: [HTTP Toolkit]() Topics: [interception](), [Mobile](), [Security & Privacy](), [Android](), [iOS](), [Instrumentation](), [Open Source](), [Network]() Tags: [android](), [announcements](), [certificates](), [development](), [eu](), [frida](), [funding](), [hooks](), [http](), [instrumentation](), [interception](), [ios](), [mobile](), [mobile-apps](), [network](), [open](), [privacy](), [product-development](), [security](), [technical]() ### AI overview HTTP Toolkit announces EU-backed funding to improve HTTPS traffic interception for mobile apps on iOS and Android. The project will use Frida integrations and hooks to support app-specific interception, automatic certificate unpinning, and simpler setup. ### Source excerpt HTTP Toolkit has been selected to receive another round of open-source funding from the EU! This aims to improve interception of HTTPS traffic from mobile apps, making it easier for both security/privacy researchers and normal technical users to inspect & manipulate the data that any app they use sends & receives. This funding will directly support work to improve the precision & usability of mobile app interception, on both iOS and Android. In a couple of clicks, you'll be able to target any app installed on a connected device (on either platform) and inspect all its traffic. That means no background noise from full system interception, automatic certificate unpinning, and no fiddly manual setup required. HTTP Toolkit can already automatically intercept Android devices, but only globally for the whole device (using Android's VPN APIs), with system certificates injected but without certificate unpinning, and with no automatic setup support for iOS at all. All those caveats are going away (of course, I'm intending the existing device-wide interception to remain a fully supported option indefinitely too). This is going be powered by a set of new integrations & hooks for Frida, a popular open-source instrumentation toolkit. Many advanced HTTP Toolkit users are already using Frida independently (see the Frida certificate unpinning guide for more info) but doing so often requires quite a bit of setup and specialist knowledge. This project is going to take that away, making network interception of mobile apps easily accessible to anybody who knows what "HTTP" is. All this is being funded by the fantastic NLNet Foundation as part of NGI Zero Entrust, a program funding open-source EU projects that support transparency around data use & privacy in modern technology. This is part of the EU's Next Generation Internet (NGI) initiative, aiming to directly fund researchers & open-source developers to encourage the future engineering of the Internet towards European values: "openn ## Reverse engineering & modifying Android apps with JADX & Frida DevFeed: [Reverse engineering & modifying Android apps with JADX & Frida]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-11-22T12:30:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Reverse Engineering](), [Android](), [Security](), [App]() Tags: [android](), [certificates](), [frida](), [http](), [interception](), [jadx](), [reverse-engineering](), [security]() ### AI overview A practical guide to reverse engineering and modifying Android applications using JADX and Frida. It introduces the initial workflow for locating and understanding relevant code, using certificate pinning as an example for disabling runtime checks so HTTP Toolkit can intercept HTTPS traffic. ### Source excerpt I get a lot of emails from users who want to know exactly what their favourite Android app is doing, and want to tweak and change how that works for themselves. There are some great tools to do this, including JADX & Frida, but using these is complicated, and every reverse engineering problem has its own unique challenges & solutions. There's few good guides to getting started, and even fewer guides on the advanced tricks available. In this article, I want to talk you through the core initial steps to look inside any Android app, give you the tools to find & understand the specific code that matters to you, and then show you how you can use that information to modify the app for yourself. Let's set the scene first. Context I'm assuming here that somebody else has written an Android app that you're interested in. You want to know exactly how a specific bit of behaviour works, and you want to change what it's doing. I'm going to focus on the classic HTTP Toolkit user example here of certificate pinning: where security-conscious apps that send HTTPS traffic go beyond the normal HTTPS validation requirements, and actively check that the HTTPS certificates used are from a small set of specific trusted certificates, not just the standard set trusted by all Android devices. (I'm focusing on certificate pinning because it's a common use case and it's convenient, but the techniques here work for all other kinds of reverse engineering & patching too, don't worry!) Certificate pinning is a problem for HTTP Toolkit users, who are trying to intercept HTTPS traffic to see what messages their Android apps are sending & receiving. It's not possible to intercept these app's traffic because they won't trust HTTP Toolkit's certificate, even after it's been injected into the device's system certificate store. Using the tools we're going to talk about in a moment we can take an unknown 3rd party app, find the certificate pinning code within it, and disable that remotely while the app ru ## Defeating Android Certificate Pinning with Frida DevFeed: [Defeating Android Certificate Pinning with Frida]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-07-06T13:30:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Android](), [interception](), [SSL](), [debug](), [Security]() Tags: [android](), [certificates](), [debugging](), [frida](), [http](), [interception](), [security](), [security-research](), [tls]() ### AI overview This tutorial explains Android certificate pinning, why it prevents HTTPS interception, and how Frida can be used to remove SSL pinning so researchers, developers, and privacy advocates can inspect an app's traffic. ### Source excerpt Some Android apps go to astounding lengths to ensure that even the owner of a device can never see the content of the app's HTTPS requests. This is problematic for security research, privacy analysis and debugging, and for control over your own device in general. It's not a purely theoretical problem either - protections like this attempt to directly block HTTPS inspection tools like HTTP Toolkit, which allow you to automatically intercept HTTPS from Android devices for inspection, testing & mocking, like so: This depends on the target application(s) trusting the debugging proxy's certificate for HTTPS traffic. These HTTP interception and mocking techniques are super useful for testing and understanding most apps, but they have issues with the small set of hyper-vigilant apps that add extra protections aiming to lock down their HTTPS traffic and block this kind of inspection. In the end, this is your Android device, and whether you're a security researcher checking for vulnerabilities, a developer trying to understand how an app uses its API, or a privacy advocate documenting what data an app is sharing, you should be able to see the messages that the apps you use transmit and receive on your own phone. Protections like certificate pinning make this difficult. Let's talk about how you can fight back, by using Frida to remove SSL pinning, and expose the real traffic that any app is sending. What's certificate pinning? By default, when an Android app makes an HTTPS connection, it makes sure that it's talking to a trusted server by comparing the issuer of the server's certificate to Android's built-in list of trusted system certificate authorities. 99% of apps stick with that default. You can't change the system certificate authorities on normal devices, so this list is fairly reliable and secure. You can change it though on rooted devices and most emulators, so it's quite possible to intercept and inspect HTTPS traffic from these apps by using a debugging proxy for HT ## Taint with Frida DevFeed: [Taint with Frida]() Original publisher: [Read original article]() Author: malweisse's corruptions Published: 2018-09-02T00:00:00Z Content type: tutorial Language: en Sources: [The blog of malweisse's corruptions]() Topics: [Tool](), [Testing]() Tags: [analysis](), [frida](), [function](), [memory](), [report](), [testing](), [tool](), [writing]() ### AI overview A tutorial demonstrates using Frida to write a taint-analysis module. The example taints buffers read through the read syscall, traces syscall activity, and reports the taint state when the process exits. ### Source excerpt Frida is slow, you can't do taint analysis cit. chqmatteo I never used Frida before, so I decided some days ago to start learning it. But how to start? Obviously testing the real capabilities of the tool writing a taint analysis module. https://github.com/andreafioraldi/taint-with-frida In the following example each buffer readed using the read syscall is tainted. var taint = require("./taint"); taint.syscallPreHook = function(ctx) { var sn = ctx.rax.toInt32(); taint.log("foo", "syscall index = " + sn); if(sn == 0) { //read taint.memory.taint(ctx.rsi, ctx.rdx); taint.report(); } else if(sn == 60 || sn == 231) { //exit || exit_group taint.log("foo", "exiting"); taint.stopTracing(); taint.report(); } } taint.syscallPostHook = function(ctx) { taint.log("foo", "syscall ret = " + ctx.rax); } Interceptor.attach(ptr("0x400643"), //main function() { taint.log("foo", "enter main()"); taint.startTracing(true); //true -> hook syscalls } );