Frida Advanced Techniques: Runtime Hooking, Crypto Extraction, and Anti-Detection Bypass

Frida is the most powerful dynamic instrumentation toolkit in mobile security research. This tutorial goes deep into advanced hooking techniques that professional penetration testers use on real engagements — cryptographic key extraction, native library hooking, and anti-analysis bypass.

Prerequisites and Setup

Hooking Java Methods: Extracting Cryptographic Keys

The most common target in banking and fintech apps is the cryptographic layer. Apps routinely use javax.crypto.Cipher for AES encryption. Hooking at the Java layer lets you intercept both the plaintext input and the encryption key:

// crypto_hook.js — intercept AES operations
Java.perform(function() {
    var Cipher = Java.use('javax.crypto.Cipher');

    Cipher.doFinal.overload('[B').implementation = function(input) {
        var algorithm = this.getAlgorithm();
        console.log('[Cipher.doFinal] Algorithm: ' + algorithm);
        console.log('[Cipher.doFinal] Input: ' +
            Java.use('java.lang.String').$new(input));
        var result = this.doFinal(input);
        console.log('[Cipher.doFinal] Output (hex): ' + bytesToHex(result));
        return result;
    };

    function bytesToHex(bytes) {
        return Array.from(bytes)
            .map(b => ('0' + (b & 0xFF).toString(16)).slice(-2))
            .join('');
    }
});

Native Library Hooking

When Java-level hooks miss critical logic (common in apps with native crypto or certificate pinning in C++), use Frida’s Interceptor to hook at the native level. For standard SSL pinning, the community codeshare script handles 15+ techniques:

Anti-Frida Detection Bypass

Production apps check for Frida’s presence. The three most common detection methods and bypasses:

1. Port 27042 Detection

# Use a non-default port
adb shell "/data/local/tmp/frida-server -l 0.0.0.0:31337 &"
frida -U -H 127.0.0.1:31337 com.target.app

2. Process Name Detection

# Rename the binary before deploying
adb push frida-server /data/local/tmp/fs
adb shell "chmod 755 /data/local/tmp/fs && /data/local/tmp/fs &"

3. Memory String Scan for “LIBFRIDA”

# Use gadget injection mode with a renamed library
frida --gadget=libgadget.so -f com.target.app

Next Steps

With these techniques you can extract cryptographic keys, bypass SSL pinning at both the Java and native level, and evade common Frida detection. Check out our Android security tutorials and the Mobile Hacking Lab Android courses for hands-on labs where you apply these techniques against purpose-built vulnerable apps.