KeyDive is a Python-based CLI tool designed for extracting Widevine L3 DRM keys from Android devices. It operates by establishing an ADB connection to a rooted device, injecting a Frida JavaScript script into the Widevine Content Decryption Module (CDM) process, and hooking specific native functions to intercept cryptographic material (client IDs, private keys, keyboxes). The tool supports multiple provisioning methods (Keybox, OTA, OEM Certificate) and exports data in formats compatible with pywidevine (.wvd). It is primarily used for DRM research, security analysis, and educational purposes regarding digital rights management on Android. The architecture consists of a Python core (`keydive.core.Core`) that manages device communication and Frida sessions, a JavaScript injection script (`keydive.js`) that performs the actual memory interception and data extraction, and a suite of modules (`keydive.drm`) for parsing and serializing DRM-specific binary formats like KeyBox and WVD. The tool handles complex C++ memory layouts (std::string, std::vector) across different Android ABIs and SDK versions, demonstrating significant reverse engineering capability.
frida-gum is the core instrumentation engine of the Frida reverse-engineering framework. It is a cross-platform C library that provides dynamic binary instrumentation: function hooking/interception, instruction-level tracing (Stalker), memory access monitoring, and a JavaScript runtime (GumJS) for scripting. The library operates at the assembly level with architecture-specific backends for x86, x86-64, ARM, ARM64, and MIPS, and platform modules for Linux, macOS, Windows, iOS, Android, and QNX. It is not a standalone application but a library consumed by frida-core; it exposes a GObject-based C API plus JavaScript and C++ bindings.
This repository is a comprehensive, modular Android application security auditing framework designed for AI agents and security engineers. It automates the entire assessment lifecycle, from APK ingestion and static analysis to dynamic instrumentation, RASP (Runtime Application Self-Protection) detection and bypass, and professional reporting aligned with OWASP MASTG and MASVS v2 standards. The architecture is a well-organized toolkit of Python, Bash, and JavaScript (Frida) scripts, orchestrated by shell entry points and sharing a common library (`scripts/lib/`). Key capabilities include a 37+ script Frida arsenal for runtime manipulation, a Semgrep rule set for static vulnerability detection, a DRY bypass profile system for countering RASP solutions, and a weighted scoring engine for MASVS compliance. The codebase emphasizes modularity, schema-driven findings, and CI/CD integration. While the codebase demonstrates strong engineering practices and contains several genuinely reusable components (findings pipeline, Frida script templates, compliance scoring models), its heavy reliance on the rapidly evolving Android and Frida ecosystems introduces a medium level of technical drift. The presence of speculative content on unreleased Android versions and deprecated API references are noted risks. Overall, it is a high-quality, production-grade security toolkit that effectively bridges the gap between manual pentesting and automated security pipelines.
objection is a runtime mobile exploration toolkit powered by Frida, designed for security testing of iOS and Android applications without requiring jailbreak or root access. It provides an interactive REPL (objection explore) that lets security researchers bypass SSL pinning, dump keychain/keystore data, monitor cryptographic operations, inspect heap memory, hook methods, and bypass jailbreak/root detection — all by injecting a Frida agent into the target process. Architecture: The Python backend handles CLI commands, device state management, and patching (injecting Frida gadget into IPA/APK files). The TypeScript agent running inside the mobile app exports RPC methods for platform-specific features (Android: hooking, keystore, intents; iOS: keychain, crypto, biometrics). Communication happens over Frida's bi-directional transport. A Flask API server exposes RPC and script endpoints for remote control. The system uses a centralized state layer (connection, device, jobs) and a plugin system for extensibility. Key entry points: 'objection explore' (REPL), 'objection patchapk'/'objection patchipa' (binary patching), 'objection api' (API server), and the agent entry point in 'agent/src/index.ts'. External dependencies include frida, frida-tools, frida-fs, frida-screenshot, Flask, apktool, and GitHub API for gadget downloads. The codebase is well-structured for mobile security automation but shows some drift with deprecated CLI flags, Python 2 compatibility checks, and TODOs for advanced hooking targets.
fridaUiTools is a PyQt5 desktop application that serves as a comprehensive workbench for Android reverse engineering using Frida. It integrates dozens of Frida scripts for common tasks such as SSL unpinning, DEX dumping, JNI tracing, memory scanning, native hooking, and anti-debug bypass. The tool provides a unified GUI with attach/spawn modes, USB/WiFi connectivity, Frida server management, and AI-assisted script generation and log analysis. The architecture is a monolithic PyQt5 application with a main window (kmainForm.py) that orchestrates multiple dialog forms (e.g., SearchMemory, Wallbreaker, ZenTracer) and a background thread (TraceThread) for Frida script execution. While the codebase is functional and feature-rich, it suffers from tight coupling, duplicate scripts, hardcoded paths, and some dead code, making it more of a practical tool than a reference-quality codebase.