mcpField
F
frida-data-extraction

frida-data-extraction

github.com/rudra-raviSecurity7108 installsUpdated 25w ago
Repository

About frida-data-extraction

A Frida guide for observing runtime data on authorized targets across Android, iOS, and native buffers. It emphasizes verifying data sources, redacting sensitive values, and avoiding changes to target behavior unless requested.

Key features

  1. 01High-signal Android and iOS observation points
  2. 02Native buffer dump example
  3. 03Tie logs to user actions
  4. 04Sensitive-data redaction guidance
  5. 05Verify data source and encoding

Use cases

  1. 01Observe application requests or serialized data
  2. 02Inspect preferences, database, or file access
  3. 03Analyze runtime data in authorized testing

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/rudra-ravi/frida-skills --skill frida-data-extraction

After installing, type/frida-data-extractionin Claude Code to confirm it loaded.

Bundled filesagents/openai.yaml

Details

From the project README

Frida Data Extraction

Use this skill when the goal is to observe runtime data rather than bypass a check.

Rules

  • Only extract data from systems the user is authorized to test.
  • Avoid printing secrets into shared logs unless the user explicitly needs them.
  • Prefer structured logs with redaction for tokens, cookies, passwords, and private keys.
  • Copy pointer and retval data inside callbacks; Frida may recycle callback objects.

Android Boundaries

Java.perform(() => {
  const Base64 = Java.use("android.util.Base64");
  Base64.encodeToString.overload("[B", "int").implementation = function (bytes, flags) {
    const out = this.encodeToString(bytes, flags);
    console.log("Base64.encodeToString ->", out);
    return out;
  };
});

High-signal targets: request builders, JSON serializers, SharedPreferences, SQLite APIs, keystore wrappers, crypto APIs, WebView bridges, file I/O.

iOS Boundaries

High-signal targets: NSURLRequest, NSURLSession, NSJSONSerialization, Keychain wrappers, NSUserDefaults, SQLite, CommonCrypto, file APIs, pasteboard.

Native Buffers

function dump(ptr, len) {
  if (ptr.isNull() || len <= 0) return;
  console.log(hexdump(ptr, { length: Math.min(len, 256), ansi: false }));
}

Use both hex and text only when the data is valid text. Binary crypto material often is not.

Verification

  • Logs are tied to a user action or request.
  • The source and encoding of each value is clear.
  • Sensitive values are redacted unless needed.
  • The hook does not change the target behavior unless explicitly requested.

References

Comments

Markdown supported