mcpField
F
frida-anti-instrumentation

frida-anti-instrumentation

github.com/rudra-raviSecurity7114 installsUpdated 25w ago
Repository

About frida-anti-instrumentation

A Frida skill for mobile app security analysts investigating detection of Frida, root, jailbreaks, emulators, or debugging. It emphasizes identifying the specific check and verifying narrow, targeted hooks rather than masking unrelated failures.

Key features

  1. 01Distinguishes failures before and after attach
  2. 02Logs process, file, and property checks
  3. 03Covers Android, iOS, and native detection points
  4. 04Verifies bypasses by removing hooks

Use cases

  1. 01Investigating an app that exits on Frida attach
  2. 02Finding checks that block debugging or attachment
  3. 03Validating a targeted bypass for a specific detection

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/rudra-ravi/frida-skills --skill frida-anti-instrumentation

After installing, type/frida-anti-instrumentationin Claude Code to confirm it loaded.

Bundled filesagents/openai.yaml

Details

From the project README

Frida Anti-Instrumentation

Use this skill when the app exits, hides behavior, blocks attach, or detects Frida/root/jailbreak/emulator/debugging.

Diagnosis Order

  1. Prove whether failure happens before or after Frida attaches.
  2. Use spawn mode for early checks.
  3. Log exits, process checks, file checks, property checks, and native anti-debug calls.
  4. Identify the specific detection before bypassing it.
  5. Keep only narrow hooks that change the detected condition.

Android Boundaries

Java.perform(() => {
  const Runtime = Java.use("java.lang.Runtime");
  Runtime.exec.overload("java.lang.String").implementation = function (cmd) {
    console.log("Runtime.exec", cmd);
    return this.exec(cmd);
  };
});

Common Java surfaces: File.exists, SystemProperties.get, Build.*, package manager queries, shell command execution, debugger checks, emulator properties.

Native Boundaries

for (const name of ["open", "access", "stat", "ptrace", "prctl", "connect"]) {
  try {
    const f = Module.getGlobalExportByName(name);
    Interceptor.attach(f, { onEnter() { console.log(name); } });
  } catch (_) {}
}

Common native surfaces: /proc, maps, task, frida, gum-js-loop, TCP port scans, ptrace, prctl, syscall, dlopen, checksum functions.

iOS Boundaries

Look for file checks, URL scheme checks, fork, ptrace, sysctl, csops, dyld image scans, suspicious library names, and jailbreak path lists.

Verification

  • The app reaches the previously blocked screen or behavior.
  • Logs show which detection hook fired.
  • Removing the hook restores the failure.
  • The final bypass does not mask unrelated errors or crash paths.

References

Comments

Markdown supported