Runtime Mobile Security: manipulate Android Java Classes and Methods at Runtime

by ddos ·

Runtime Mobile Security

Runtime Mobile Security (RMS), powered by FRIDA, is a powerful web interface that helps you to manipulate Android Java Classes and Methods at Runtime.

You can easily dump all the loaded classes and relative methods, hook everything on the fly, trace methods args and return value, load custom scripts, and much other useful stuff.

General Info

Runtime Mobile Security (RMS) is currently supporting Android devices only.

It has been tested on MacOS and with the following devices:

  • AVD emulator
  • Genymotion emulator
  • Amazon Fire Stick 4K

It should also work well on Windows and Linux but some minor adjustments may be needed.

Changelog v1.5.20

  • dependencies update (including latest version of FRIDA)
  • support for NodeJS 20.10.0 – Fix Issue #122
  • added docker – PR #127 by @sdcampbell 🙏🏻

Install

Follow the instructions below to install and run the new NodeJS version:

  1. Open the terminal and run the following command to install the npm package
    • npm install -g rms-runtime-mobile-security
  2. Make sure the frida-server is up and running on the target device.
  3. Launch RMS via the following command
    • rms (or RMS-Runtime-Mobile-Security)
  4. Open your browser at http://127.0.0.1:5000/
  5. Start enjoying RMS

Use

python3 mobilesecurity.py

1. Run your favorite app by simply inserting its package name

NOTE RMS attaches a persistence process called com.android.systemui to get the list of all the classes that are already loaded in memory before the launch of the target app. If you have an issue with it, try to find a different package that works well on your device. You can set another default package by simply editing the config.json file.

 

2. Check which Classes and Methods have been loaded in memory

 

3. Hook on the fly Classes/Methods and trace their args and return values

 

4. Select a Class and generate on the fly an Hook template for all its methods

 

5. Easily detect new classes that have been loaded in memory

 

 

6. Inject your favorite FRIDA CUSTOM SCRIPTS on the fly

Just add your .js files inside the custom_script folder and they will be automatically loaded by the web interface ready to be executed.

Copyright (C) 2020 @mobilesecurity_

Source: https://github.com/m0bilesecurity/

Tags: Runtime Mobile Security