options: -h, --help show this help message and exit -D ID, --device ID connect to device with the given ID -U, --usb connect to USB device -R, --remote connect to remote frida-server -H HOST, --host HOST connect to remote frida-server on HOST --certificate CERTIFICATE speak TLS with HOST, expecting CERTIFICATE --origin ORIGIN connect to remote server with “Origin” header set to ORIGIN --token TOKEN authenticate with HOST using TOKEN --keepalive-interval INTERVAL set keepalive interval in seconds, or 0 to disable (defaults to -1 to auto-select based on transport) --p2p establish a peer-to-peer connection with target --stun-server ADDRESS set STUN server ADDRESS to use with --p2p --relay address,username,password,turn-{udp,tcp,tls} add relay to use with --p2p -f TARGET, --file TARGET spawn FILE -F, --attach-frontmost attach to frontmost application -n NAME, --attach-name NAME attach to NAME -N IDENTIFIER, --attach-identifier IDENTIFIER attach to IDENTIFIER -p PID, --attach-pid PID attach to PID -W PATTERN, --await PATTERN await spawn matching PATTERN --stdio {inherit,pipe} stdio behavior when spawning (defaults to “inherit”) --aux option set aux option when spawning, such as “uid=(int)42” (supported types are: string, bool, int) --realm {native,emulated} realm to attach in --runtime {qjs,v8} script runtime to use --debug enable the Node.js compatible script debugger --squelch-crash if enabled, will not dump crash report to console -O FILE, --options-file FILE text file containing additional command line options --version show program's version number and exit -l SCRIPT, --load SCRIPT load SCRIPT -P PARAMETERS_JSON, --parameters PARAMETERS_JSON parameters as JSON, same as Gadget -C USER_CMODULE, --cmodule USER_CMODULE load CMODULE --toolchain {any,internal,external} CModule toolchain to use when compiling from source code -c CODESHARE_URI, --codeshare CODESHARE_URI load CODESHARE_URI -e CODE, --eval CODE evaluate CODE -q quiet mode (no prompt) and quit after -l and -e -t TIMEOUT, --timeout TIMEOUT seconds to wait before terminating in quiet mode --pause leave main thread paused after spawning program -o LOGFILE, --output LOGFILE output to log file --eternalize eternalize the script before exit --exit-on-error exit with code 1 after encountering any exception in the SCRIPT --kill-on-exit kill the spawned program when Frida exits --auto-perform wrap entered code with Java.perform --auto-reload Enable auto reload of provided scripts and c module (on by default, will be required in the future) --no-auto-reload Disable auto reload of provided scripts and c module
frida-server选项
之前启动frida-server服务都是直接
1 2 3
adb shell su ./data/local/tmp/frida
这样的话是默认启动的 27042 端口
有时候会出现这个端口被APP提前占用的情况，这个时候就需要指定端口了
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
Help Options: -h, --help Show help options
Application Options: --version Output version information and exit -l, --listen=ADDRESS Listen on ADDRESS --certificate=CERTIFICATE Enable TLS using CERTIFICATE --origin=ORIGIN Only accept requests with ?Origin? header matching ORIGIN (by default any origin will be accepted) --token=TOKEN Require authentication using TOKEN --asset-root=ROOT Serve static files inside ROOT (by default no files are served) -d, --directory=DIRECTORY Store binaries in DIRECTORY -D, --daemonize Detach and become a daemon --policy-softener=system|internal Select policy softener -P, --disable-preload Disable preload optimization -C, --ignore-crashes Disable native crash reporter integration -v, --verbose Be verbose
Application Options: -D, --device=ID connect to device with the given ID -f, --file=FILE spawn FILE -p, --pid=PID attach to PID -n, --name=NAME attach to NAME -r, --realm=REALM attach in REALM -s, --script=JAVASCRIPT_FILENAME -R, --runtime=qjs|v8 Script runtime to use -P, --parameters=PARAMETERS_JSON Parameters as JSON, same as Gadget -e, --eternalize Eternalize script and exit -i, --interactive Interact with script through stdin --development Enable development mode --version Output version information and exit
Runtime Mobile Exploration by: @leonjza from @sensepost
By default, communications will happen over USB, unless the --network option is provided.
Options: -N, --network Connect using a network connection instead of USB. -h, --host TEXT [default: 127.0.0.1] -p, --port INTEGER [default: 27042] -ah, --api-host TEXT [default: 127.0.0.1] -ap, --api-port INTEGER [default: 8888] -g, --gadget TEXT Name of the Frida Gadget/Process to connect to. [default: Gadget] -S, --serial TEXT A device serial to connect to. -d, --debug Enable debug mode with verbose output. (Includes agent source map in stack traces) --help Show this message and exit.
Commands: api Start the objection API server in headless mode. device-type Get information about an attached device. explore Start the objection exploration REPL. patchapk Patch an APK with the frida-gadget.so. patchipa Patch an IPA with the FridaGadget dylib. run Run a single objection command. signapk Zipalign and sign an APK with the objection key. version Prints the current version and exists.
Options: -s, --startup-command TEXT A command to run before the repl polls the device for information. -q, --quiet Do not display the objection logo on startup. -c, --file-commands FILENAME A file containing objection commands, separated by a newline, that will run before the repl polls the device for information. -S, --startup-script FILENAME A script to import and run before the repl polls the device for information. -a, --enable-api Start the objection API server. -P, --plugin-folder TEXT The folder to load plugins from. --help Show this message and exit.
Options: -s, --source TEXT The source APK to patch [required] -a, --architecture TEXT The architecture of the device the patched APK will run on. This can be determined with `adb shell getprop ro.product.cpu.abi`. If it is not specified, this command will try and determine it automatically. -V, --gadget-version TEXT The gadget version to use. If not specified, the latest version will be used. -p, --pause Pause the patcher before rebuilding the APK. -k, --skip-cleanup Do not clean temporary files once finished. -d, --enable-debug Set the android:debuggable flag to true in the application manifest. -N, --network-security-config Include a network_security_config.xml file allowing for user added CA's to be trusted on Android 7 and up. This option can not be used with the --skip-resources flag. -D, --skip-resources Skip resource decoding as part of the apktool processing. -t, --target-class TEXT The target class to patch. -2, --use-aapt2 Use the aapt2 binary instead of aapt as part of the apktool processing. -c, --gadget-config TEXT The gadget configuration file to use. Refer to https://frida.re/docs/gadget/ for more information. -l, --script-source TEXT A script file to use with the the "path" config type. Specify "libfrida- gadget.script.so" as the "path" in your config. -n, --ignore-nativelibs Do not change the extractNativeLibs flag in the AndroidManifest.xml. -m, --manifest TEXT A decoded AndroidManifest.xml file to read. --help Show this message and exit.
