PD: Intenté hacerlo pero siempre me aparece el mensaje de error "adb no conectado". ¿Hay alguna forma de arreglarlo?

Hi all!

This tutorial will help you understand quickly and easily how to mod Unity apps and games with Frida. 

Introduction

According to Frida document, Frida is Greasemonkey for native apps, or, put in more technical terms, it’s a dynamic code instrumentation toolkit. It lets you inject snippets of JavaScript or your own library into native apps on Windows, macOS, GNU/Linux, iOS, Android, and QNX. Learn more

Explanation

"Frida" means "Free IDA", where Frida could be Ida’s sister, as IDA is a static analysis tool and Frida is a dynamic analysis toolkit.

It lets you inject snippets of JavaScript into native apps on Windows, Mac, Linux, iOS and Android. Frida also provides you with some simple tools built on top of the Frida API.

In other words, it allows you to inject your own code and to programmatically and interactively inspect and change running processes. Frida doesn’t need access to source code and can be used on iOS and Android devices that aren’t jailbroken or rooted. It lets you do all of this through APIs available from Objective-C, which are also exposed to higher-level languages through bindings.

Why is Frida?

As far as I know, Frida is a framework designed for developers, reverse-engineers, and security researchers to monitor and debug running processes. It also enables programmers, software and security professionals to execute their own JS scripts into other processes.

Game/App Modding might not meet the purpose on how Frida is made for, but due to its wonderful features, such as live debugging; powerfull instrumentation kit; simple syntax, simple setup that help beginers easier to implement and learn, etc. It can be a perfect method for modding if we understand the Frida's fundamental, so let's start!

Getting ready

Frida-tools

First, we would need to install Frida-tools on Windows/Mac/Linux in order to use the CLI.

Requirement

• Python, Python3
• Pip, Pip3

Install with Pip

pip install frida-tools

Testing via cmd/terminal

Open cmd/powershell or terminal and type:

frida-ps

This will list all the running processes of our current OS.

Install Frida-server

To communicate with Frida-tools from client-side, let's install Frida-server on whichever device we want to analyze. In this case, it's a Android device.

Requirement

• Rooted device
• ADB is enabled and authorized

First off, download the latest frida-server from the releases page and uncompress it. (PS: Remember to uncompress the file before push it to your phone! )

In this tutorial, we will be doing it on Android device that has arm64-v8a ABI, so we need to find and download frida-server-xx.xx.xx-android-arm64.xz. After uncompressing, we should rename the file to frida-server and push to data/local/tmp

Install the server manually via ADB

Let's install and start the server by following this Frida document

adb push frida-server /data/local/tmp/

adb shell

su

chmod 755 /data/local/tmp/frida-server

/data/local/tmp/frida-server &

Install the server via MagiskFrida module or Frida server app

The process of installing and updating Frida server could be done automatically by a Magisk module or an Android app published on Google Play.

• With Magisk module, just open Magisk app, go to Download tab, find and install the MagiskFrida module then restart the device. This method is highly recommended since MagiskFrida is continuously developing, the server itself is automatically started every time the device boots and also get updated whenever there's a new version released.

• With Frida server app by shingle, find it on Google Play with packageID me.shingle.fridaserver. After su granted, we can now download and start the Frida-server easily.

Testing via cmd/terminal

Open cmd/powershell or terminal and type:

frida-ps -U

This -U option means USB or remote device, so that we should see the processes of our Android device.

Mod our first Unity app

This tutorial comes with a sample Unity app that designed for learning Frida, so let's begin by downloading the apk file.

Hook the script to desired app

First, let's create a Javascript file and write down this simple code:

console.log("Hello World!")

After that, we need to make Frida listen to our app by inputting its packageID, then use -l to hook the custom Javascript file, see this cmd:

frida -U <com.company.someapp> -l <some-script.js>

If the cmd above executes successfully, we will see console output Hello World! string.

To spawn the app then listen to it right away, which is very helpful for early instrumentation, use -f

frida -U -f <com.company.someapp> -l <some-script.js>

While spawning, Frida will pause the app for early instrumentation purpose, so we need %resume to resume it. Or we can do it automatically by adding --no-pause at the end of cmd, also use -Uf for brevity.

frida -Uf <com.company.someapp> -l <some-script.js> --no-pause

Note:

• Apk that built from latest version of Unity Engine (including the sample app in this tutorial) will crash the server if we don't use -f, so make sure to add that option in cmd line.

• Early instrumentation will need a callback wrapper, because the module (libil2cpp.so) may not be able to load before the script's executing. See the example code below:

function awaitForCondition(callback) {
    var i = setInterval(function () {
      var addr = Module.findBaseAddress('libil2cpp.so');
        console.log("Address found:", addr);
        if (addr) {
            clearInterval(i);
            callback(+addr);
        }
    }, 0);
}

var il2cpp = null;

Java.perform(function () {
    awaitForCondition(function (base) {
        il2cpp = ptr(base);
  // do something
    })
})

• The -l <some-script.js> is optional, Frida CLI is a REPL interface so we just need to paste the whole script into cmd line to execute it, but that is not ideally for large amount of codes.

Write the first script

Learning Frida script is not difficult since it supports Javascript API and others high-level programming language. Let's take a look at Javascript API document.

Clone this repo, npm install then create new .js file inside of project folder so we can get code completion, type checking, inline docs, refactoring tools, etc.

Here're some features that we're going to mainly focus on for modding Unity app:

1. Module

• findBaseAdrress(lib name)
• load(path)

2. Interceptor

• attach(address, callback)
• replace(adress, callback)

3. NativePointer(offset | decimal)

• readInt() | readFloat() | readutf16String() | readByteArray(decimal) | readPointer()
• writeInt(decimal) | writeFloat(decimal) | writeUtf16String('some string') | writeByteArray(hex) | writePointer(ptr)

4. NativeFunction(address, 

https://github.com/Octowolve/il2cpp-hacking

https://github.com/LGLTeam/Android-Mod-Menu

https://github.com/L-JINBIN/ApkSignatureKiller

https://forum.xda-developers.com/showthread.php?t=822388  :oneclick signer

https://github.com/djkaty/Il2CppInspector   :Il2CppInspecto

frida 사용가능한 앱플이 있는것 같아요.

지니모션이죠

유료인대 개인사용자는 무료입니다.

데스크탑용으로 다운받으세요

제가 테스트를 안해봐서 정확히는 모르겠네요.

이 튜토리얼에서 단계가 명확하게 언급되어 있습니다 : https://www.youtube.com/watch?v=4wG4OMnB0V4

vmdk 이미지를 Linux 가상 머신에 마운트하여 커널 및 ramdisk를 교체하려면 hyperv가 필요합니다. hhttps : //www.memuplay.com/blog/memuhyperv-tool.html

여러 안드로이드 기술도서들을 찾아봤는데, Handbook만큼 자세하게 설명된 도서는 못 봤네요.

• Purpose 

• Recommended or needed tools 

• (De)construction of Android apps 

• Obtaining APKs 

• Decompiling 

• Resource and code manipulation 

• Repackaging and signing 

• Where to go from here

단말기에서 사용하시면 됩니다.

리버스엔지니어링에 대한 기본적인 지식(INTEL, ARM, MIPS)등을 배우기에 최신 업데이트 된 기초지식서 입니다.

내용이 아주 괜찮고 초반에 공부하기 정말 좋은 책입니다.

최근에 업데이트되어서 공유해봐요.

유니티 엔진은 무료입니다

유니티 허브를 받으시고 원하는 버전을 선택해 무료로 설치할수 있습니다

유니티 게임엔진에 관심 많으신분 한번 설치해서 이것저것 만져보며 둘러보시는것도 좋은 경험이 될거같네요^^;