FridaBox device validation transcript Date: 2026-07-19 (Asia/Tehran) Device: Samsung SM-S928B, serial R5CY149SZEX 1. Device and host installation > adb devices -l R5CY149SZEX device product:e3qxxx model:SM_S928B device:e3q transport_id:3 > adb shell getprop ro.product.cpu.abilist arm64-v8a > adb shell getprop ro.build.version.release 16 > adb shell getprop ro.build.version.sdk 36 > $env:FRIDABOX_NDK_PROJECT_DIR='D:\FridaBoxBuild\Bcore'; .\gradlew.bat :app:assembleDebug --console=plain BUILD SUCCESSFUL > adb install -r app\build\outputs\apk\debug\FridaBox_4.0.0_arm64-v8a-debug.apk Performing Streamed Install Success > adb shell am start --user 0 -n com.qm4rs.fridabox/top.niunaijun.blackboxa.view.main.WelcomeActivity Starting: Intent { cmp=com.qm4rs.fridabox/top.niunaijun.blackboxa.view.main.WelcomeActivity } The debug UI action "Install demo guest" installed the generated asset into BlackBox. The UI reported: package: com.qm4rs.fridabox.sample version: 1.0 SHA-256: 35fa3a6d679ae0b0a18635756e1d1a23b5340d12e480eb8600768ab60af0e95e source: /data/user/0/com.qm4rs.fridabox/files/imported-apks/sample-guest.apk ABI: Pure Java/Kotlin (accepted) target SDK: 28 > adb shell pm list packages --user 0 com.qm4rs.fridabox package:com.qm4rs.fridabox > adb shell pm list packages --user 0 com.qm4rs.fridabox.sample Result: the sample guest is absent from Android user 0's real PackageManager. Samsung has an inaccessible user 150, so all PackageManager proof commands explicitly use --user 0. 2. Pre-attach pause The UI selected "Launch instrumented" and confirmed the early-instrumentation warning. Before running the controller: > adb shell ps -A | Select-String fridabox.sample u0_a524 31797 1675 ... S com.qm4rs.fridabox.sample > adb shell ss -ltn | Select-String 27042 LISTEN 0 0 127.0.0.1:27042 0.0.0.0:* > adb logcat -d -v threadtime -s FridaBox.Gadget:I FridaBox.Sample:I *:S 07-19 23:11:00.878 31797 31797 I FridaBox.Gadget: Loading Frida Gadget for com.qm4rs.fridabox.sample There was no FridaBox.Sample attachBaseContext or onCreate line. The guest main thread was paused inside System.loadLibrary before makeApplication. 3. Controller discovery, registry, ClassLoader and native modules > python -m pip install -r tools\requirements.txt Successfully installed frida-17.16.0 > npm ci Pinned packages installed from package-lock.json. > python tools\build_frida_agents.py Built Frida agents: scripts/dist/registry-probe.js, scripts/dist/guest-bootstrap.js, scripts/dist/sample-hook.js > python -u tools\attach_guest.py --package com.qm4rs.fridabox.sample --script scripts\sample-hook.js --keep-alive PORT GUEST PACKAGE GUEST PROCESS VPID SOURCE APK 27042 com.qm4rs.fridabox.sample com.qm4rs.fridabox.sample 0 /data/user/0/com.qm4rs.fridabox/blackbox/data/app/com.qm4rs.fridabox.sample/base.apk [FridaBox] package=com.qm4rs.fridabox.sample [FridaBox] process=com.qm4rs.fridabox.sample [FridaBox] userId=0 [FridaBox] virtualProcessId=0 [FridaBox] source=/data/user/0/com.qm4rs.fridabox/blackbox/data/app/com.qm4rs.fridabox.sample/base.apk [FridaBox] ClassLoader=dalvik.system.PathClassLoader[DexPathList[[zip file "/data/user/0/com.qm4rs.fridabox/blackbox/data/app/com.qm4rs.fridabox.sample/base.apk"],nativeLibraryDirectories=[/data/user/0/com.qm4rs.fridabox/blackbox/data/app/com.qm4rs.fridabox.sample/lib, /data/user/0/com.qm4rs.fridabox/blackbox/data/app/com.qm4rs.fridabox.sample/base.apk!/lib/arm64-v8a, /system/lib64, /system_ext/lib64]]] GuestRuntimeRegistry: {"initializedAt": 1784490060872, "instrumentationEnabled": true, "lastError": null, "package": "com.qm4rs.fridabox.sample", "process": "com.qm4rs.fridabox.sample", "sourceDir": "/data/user/0/com.qm4rs.fridabox/blackbox/data/app/com.qm4rs.fridabox.sample/base.apk", "userId": 0, "virtualProcessId": 0} Native modules: 419 app_process64 @ 0x5e4d8a8000 /system/bin/app_process64 linker64 @ 0x7d37dc1000 /apex/com.android.runtime/bin/linker64 libandroid_runtime.so @ 0x7cf688b000 /system/lib64/libandroid_runtime.so libbinder.so @ 0x7d0ae9a000 /system/lib64/libbinder.so libnativeloader.so @ 0x7d2fbc1000 /apex/com.android.art/lib64/libnativeloader.so [sample-hook] installed for com.qm4rs.fridabox.sample Attached on port 27042 to com.qm4rs.fridabox.sample / com.qm4rs.fridabox.sample Post-attach lifecycle evidence: 07-19 23:11:44.774 31797 31797 I FridaBox.Gadget: Frida Gadget loaded 07-19 23:11:44.782 31797 31797 I FridaBox.Sample: Application.attachBaseContext package=com.qm4rs.fridabox.sample 07-19 23:11:44.787 31797 31797 I FridaBox.Sample: Application.onCreate package=com.qm4rs.fridabox.sample This ordering proves the Application lifecycle resumed only after controller attachment. 4. Java hook proof The validation tapped the visible "CALL TARGET.ADD(2, 3)" button while the controller session remained attached. Controller output: [sample-hook] Target.add(2, 3) => 1337 UI hierarchy output: 5. Recycled launch without instrumentation The previous instrumented process was PID 31797. The controller detached, the UI returned Home, and "Launch without instrumentation" stopped/recycled the virtual process before launch. > adb shell ps -A | Select-String fridabox.sample u0_a524 32298 1675 ... S com.qm4rs.fridabox.sample > adb shell ss -ltn | Select-String 27042 07-19 23:12:47.821 32298 32298 I FridaBox.Gadget: Instrumentation disabled for this guest process 07-19 23:12:47.826 32298 32298 I FridaBox.Sample: Application.attachBaseContext package=com.qm4rs.fridabox.sample 07-19 23:12:47.828 32298 32298 I FridaBox.Sample: Application.onCreate package=com.qm4rs.fridabox.sample The same button then produced: 6. Device-specific failures found and fixed Samsung Android 16 initially froze the BlackBox :black system-service process: libbinder.IPCThreadState: Transaction failed because process frozen. Binder transaction failure: BR_FROZEN_REPLY android.os.DeadObjectException at IBPackageManagerService$Stub$Proxy.installPackageAsUser(...) Fix: enable the existing internal DaemonService for FridaBox. Verification: DaemonService: Foreground service started successfully DaemonService: DaemonService started successfully No subsequent BR_FROZEN_REPLY occurred and the virtual package remained available across host/activity restarts. The first Frida 17 API-loaded probe failed with: Port 27042 rejected: ReferenceError: 'Java' is not defined Fix: explicitly import frida-java-bridge 7.0.13 and reproducibly compile all Java agents with frida-compile 19.0.5. The early registry probe also uses Java.performNow(), avoiding a deadlock with Gadget's on_load=wait main thread. Final result: all required sample runtime checks passed on ARM64 Android 16.