Meticulously Modern Mobile Manipulations
summary
Shows how Frida gadget mode injects into final iOS/Android binaries on non‑jailbroken devices and how Objection wraps that into usable tooling, including an Objection file manager and an embedded HTTP server that serves app container files. Demonstrates enumerating and editing live objects via live heap inspection, replacing a TikTok video URL at runtime, dumping app keychain entries, loading native Meterpreter via the metal shared library, and integrating runtime checks into Jenkins CI. Works within app sandboxes; SSL‑pinning and native hooks may still need extra per‑case work.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 1:37The State of Mobile Application Hacking
- 4:07Flashlight Apps
- 5:04Freew
- 5:38Castle
- 6:17Frida
- 6:46Operating Modes
- 8:01SSL Pinning Bypass
- 10:05API Store
- 10:55Finding the Nail
- 11:46FreedomPowered File Manager
- 12:16Demo
- 14:38Uberta Code
- 15:39Glue
- 16:16Heaps
- 17:11Classes
- 17:46Live Classes
- 18:04Live Classes Demo
- 25:42Malware Analysis
- 27:04Existing Tools
- 28:45Plugin Flex
- 30:31Android Case
- 33:53Metasploit
- 37:30Integration
- 39:07Jenkins
- 40:55Summary
related talks
45mReverse engineering mobile apps: how, why, and what now?
43mRuntime Manipulation of Android and iOS Applications
49mContain Yourself: Building Secure Containers for Mobile Devices
52mUnlocking secrets of proprietary software using Frida
58mUncovering OWASP’s Mobile Risks in iOS Apps
47mAttacking Android Applications
36mTesting iOS Apps without Jailbreak in 2018
51mAnalysis of Real World Apps with Frida