$ show sensepost/objection
objection is a runtime mobile exploration toolkit powered by Frida, designed for security testing of iOS and Android applications without requiring jailbreak or root access. It provides an interactive REPL (objection explore) that lets security researchers bypass SSL pinning, dump keychain/keystore data, monitor cryptographic operations, inspect heap memory, hook methods, and bypass jailbreak/root detection — all by injecting a Frida agent into the target process. Architecture: The Python backend handles CLI commands, device state management, and patching (injecting Frida gadget into IPA/APK files). The TypeScript agent running inside the mobile app exports RPC methods for platform-specific features (Android: hooking, keystore, intents; iOS: keychain, crypto, biometrics). Communication happens over Frida's bi-directional transport. A Flask API server exposes RPC and script endpoints for remote control. The system uses a centralized state layer (connection, device, jobs) and a plugin system for extensibility. Key entry points: 'objection explore' (REPL), 'objection patchapk'/'objection patchipa' (binary patching), 'objection api' (API server), and the agent entry point in 'agent/src/index.ts'. External dependencies include frida, frida-tools, frida-fs, frida-screenshot, Flask, apktool, and GitHub API for gadget downloads. The codebase is well-structured for mobile security automation but shows some drift with deprecated CLI flags, Python 2 compatibility checks, and TODOs for advanced hooking targets.
The LLM identified 2 files worth highlighting for reuse:
Provides base classes BasePlatformGadget and BasePlatformPatcher that encapsulate the pattern for downloading Frida gadget binaries from GitHub releases, verifying checksums, unpacking, and injecting them into mobile application packages (APK/IPA). This is a self-contained, reusable pattern for anyone building tools that need to modify mobile binaries to include instrumentation payloads.
Contains low-level helper functions (fsend, qsend, error handling, type guards) used by the Frida agent to send structured messages back to the Python backend. Implements a consistent protocol for RPC responses, job updates, and log output. This module is small, isolated, and could be extracted as a reusable utility for any Frida agent development project.