Add Frida support

[confuciussayuhm]

Hello there,

I stumbled across this project last night and it's such a great idea. From a security testing perspective, we utilize Frida to perform security assessments. A frida-server component is copied across to the phone and a client-side firda component connects to frida-server to issue commands and load scripts.

Adding frida (server and client) support to this project would be mind-blowingly amazing.

[yume-chan]

I'm not familiar with Frida, and the documentation looks confusing. Can you explain what features should it support?

As I understand, I need to use the official frida-server, but I can create a custom frida client using Tango to do things like

• Pushing frida-server to device and start it
• Connect to frida-server and run commands on it like querying process list
• Send a payload to frida-server and forward console output.

[confuciussayuhm]

The basic idea would be to get frida-server onto the device and run it as a superuser or normal user. Once frida-server is up, a client-side frida library (Frida github has something you might find interesting) connects and runs pre-built custom JavaScript files in hope of tracing, modifying, or "messing" with the fundamental application functions. There is deliberate emphasis here as this is the point of requesting this feature.

In using this project, in the background I've copied across the latest frida-server to my Android test device. I run this as root and then from my frida client I run a command that spawns a particular app whilst running a pre-built JavaScript file against the app during its startup.

It makes sense to abstract this out into a web app (this project). If you would like to see what a working implementation of this looks like, head over to Corellium. Spin up an Android device. You will find how they have implemented Frida. If you could do this with the use of ones own physical device, again, this would be mind-blowingly amazing.

[Unbrick]

Hi everyone,
first of all: Thank you for this awsome project! I tried to implement WebAdb -> Frida communication but stumbled over a few hurdles:

Regarding the technical overview of frida
Frida runs on device and binds by default to port 27042 on the android device. Communication is performed using dbus over WebSockets. When using frida, one usually performs a port forwarding of the device port 27042 to the OS port 27042 using the adb binary and afterwards connects to the forwarded port using the frida-tools.

Some fine folks over at httptoolkit already developed a browser-based javascript interface for this communication here. This requires the exposed WebSocket port to be forwarded / bound to 127.0.0.1:27042.

The current issue i am stuck with is that the frida-server expects websocket communication but when forwarding an device-port using webadb like so:

const connection: ReadableWritablePair<AdbPacketData,Consumable<AdbPacketInit>> = await device.connect();
const credentialStore: AdbWebCredentialStore = new AdbWebCredentialStore();

const transport: AdbDaemonTransport =
  await AdbDaemonTransport.authenticate({
    serial: device.serial,
    connection,
    credentialStore: credentialStore,
  });

const adb: Adb = new Adb(transport);

const socket = await adb.createSocket('tcp:27042');

the returned AdbSocket interface extends ReadableWritablePair but i cannot spot any obvious way to open a WebSocket to the AdbSocket object (as the forwarded communication is not bound to any port which we could connect to). Directly speaking dbus over the AdbSocket is impossible as the dbus communication should be wrapped in a WebSocket as far as i understand the protocol.

A second possibility would be binding the AdbSocket object to a local port but as far as i am aware, JS in browsers does not have such abilities.

Do you have any ideas on how to force the WebSocket communication over the AdbSocket?

Thank you and best regards!

[yume-chan]

@Unbrick Sorry I didn't see your comment.

Previously I ported undici (an HTTP and WebSocket client written in JavaScript, created by Node.js team) to run on browsers, so I can use Chrome DevTools Protocol (which uses WebSocket) to debug Chromium-based browsers on Android.

The related code is in https://github.com/tango-adb/old-demo/blob/74e9154e5e474812b9e9424b89e5d962d0c9d174/packages/demo/src/pages/chrome-devtools.tsx

Notably:

• AdbUndiciSocket class converts a ReadableWritablePair into a Node.js Duplex
• agent creates AdbUndiciSockets when undici needs to create TCP sockets. This one is fixed to localabstract: schema, but you can modify it to tcp:.
• import { WebSocket } from "@yume-chan/undici-browser" and new WebSocket("http://27042", { dispatcher: agent }) creates WebSocket objects using our agent

[Unbrick]

Thank you for your response, sounds like the more elegant version, i currently ended up re-implementing the websocket protocol within a DuplexStream. I'll try to add the AdbUndiciSocket instead of the custom WS implementation.

By the way: Which UI framework do you use for your current Tango application? Looks pretty clean. And the device sharing feature is just awsome, very nice work!

[yume-chan]

For UI rendering framework I'm using Solid. For UI component framework, I made all components myself.