QM4RS/FridaBox
1
0
Fork 0
mirror of https://github.com/QM4RS/FridaBox.git synced 2026-09-16 06:02:22 +02:00
Code Issues Packages Projects Releases 2 Wiki Activity

2 Releases 4 Tags

RSS Feed
  • v4.0.0 0ad236e283
    Compare

    FridaBox 4.0.0 — First Device-Validated Release Stable

    thegame_1980 released this 2026-07-20 03:17:20 +02:00 | 14 commits to main since this release

    📅 Originally published on GitHub: Mon, 20 Jul 2026 01:19:22 GMT
    🏷️ Git tag created: Mon, 20 Jul 2026 01:17:20 GMT

    FridaBox 4.0.0

    The first device-validated FridaBox research release.

    FridaBox provides a standalone Android workspace for importing a guest APK and
    launching it in one of three per-app modes: an autonomous on-device JavaScript
    agent, a computer-attached Frida Gadget session, or a clean launch with
    instrumentation disabled. It does not require root or modification of the guest
    APK.

    Highlights

    • Early Frida Gadget loading before the guest Application is created.
    • Per-app On-device, Computer, and Clean execution policies.
    • Trusted JavaScript import through Android's document picker with private,
      byte-identical storage and SHA-256 tracking.
    • Guest runtime registry with package, process, virtual user/process IDs, source
      APK, ClassLoader, endpoint, and instrumentation state.
    • Native module enumeration and reproducible Frida 17 controller agents.
    • Independent FridaBox application identity and ARM64 production build.

    Artifact

    • ABI: arm64-v8a only
    • Package: com.qm4rs.fridabox
    • Version: 4.0.0 (versionCode 400)
    • Minimum Android API: 21
    • Target Android API: 28
    • APK SHA-256: f70b60116ab3b27fd2f316f15be4ddea8fffec54ce2159c80eadd15d476a56b3
    • Signing certificate SHA-256: 16557b248f5a4ef5c75d358b33c7efac324726d4b2899c7c6d9ca8cb85ded152
    • Signature schemes: v1, v2, and v3
    • Frida Gadget: 17.16.0, pinned and verified

    The APK is aligned for 16 KiB page-size devices. The attached checksum file can
    be verified before installation.

    Validation

    The complete sample hook and three-mode flow passed on a Samsung SM-S928B
    running ARM64 Android 16/API 36. The sample guest remained absent from the real
    Android PackageManager, startup paused before Application.onCreate(), the
    controller discovered and attached to Gadget, native enumeration succeeded,
    and Target.add(2, 3) returned 1337 after loading the sample hook. The same
    guest then launched cleanly after virtual-process recycling.

    The commercial workspace flow was also validated with an imported Unity guest,
    including autonomous on-device script loading, direct frida -U gadget
    attachment, and clean execution.

    Scope and safety

    FridaBox is an authorized dynamic-analysis and virtualization research tool. It
    does not claim invisibility or universal application compatibility. Current
    limitations and observable surfaces are documented in the repository. Use it
    only with software and devices you own or are explicitly authorized to assess.

    Downloads
  • v4.1.0 3b771faa21
    Compare

    FridaBox 4.1.0 — Multi-Architecture Gadget Manager Stable

    thegame_1980 released this | 5 commits to main since this release

    📅 Originally published on GitHub: Tue, 28 Jul 2026 09:26:06 GMT
    🏷️ Git tag created: Tue, 28 Jul 2026 09:23:25 GMT

    FridaBox 4.1.0

    This release expands FridaBox from the ARM64-only 4.0.0 build to all four
    standard Android ABIs and introduces downloadable Frida Gadget management and
    a substantially refreshed workspace.

    Highlights

    • Separate signed APKs for armeabi-v7a, arm64-v8a, x86, and x86_64.
    • Download, verify, select, and manage official ABI-compatible Frida Gadgets
      from the app instead of bundling a Gadget in the host APK.
    • On-device and computer-controlled runtime selection backed by the downloaded
      Gadget store.
    • New liquid-glass launcher, navigation, app actions, iconography, and animated
      bubble menus.
    • Floating guest log overlay and clearer runtime/instrumentation visibility.
    • Guest APK inspection and native-library extraction now understand all four
      supported ABIs.
    • Updated dependencies, documentation, tests, and CI coverage.

    Artifacts

    Choose the APK matching your device or emulator ABI. There is intentionally no
    universal APK.

    ABI APK SHA-256
    arm64-v8a FridaBox-v4.1.0-arm64-v8a.apk ef81f2ff97411388a4f3cc65b1a21a1b54d5732de20a7e1b1abaa3d813408f94
    armeabi-v7a FridaBox-v4.1.0-armeabi-v7a.apk cb8e7d832b38417045e036decfc9447094f8e78e6b7049de96a3a96c87741a3a
    x86 FridaBox-v4.1.0-x86.apk b8f273c2675bf80073a519703b4411bc86d3e0da2eab5d14fe8fc28e4e33effb
    x86_64 FridaBox-v4.1.0-x86_64.apk d19204630d8f802c742a81fe6ebc48b9d6914d86a25bc5f32f0967c99d66f22d
    • Package: com.qm4rs.fridabox
    • Version: 4.1.0 (versionCode 401)
    • Minimum Android API: 21
    • Target Android API: 28
    • Signing certificate SHA-256: f8db4dcf0f9272bf75ac170e382ee31ca17fea2606a18aaed0cc4040423cb444
    • Signature schemes: v1 and v2
    • APK alignment: 16 KiB compatible

    Signing-key migration

    Version 4.1.0 starts a new production signing identity. Android cannot install
    it as an in-place update over 4.0.0, which used a different certificate.
    Uninstall 4.0.0 before installing 4.1.0. Back up any FridaBox-private data you
    need first; uninstalling removes the app's private storage.

    Validation

    The four release APKs were built from the same revision, verified with Android
    apksigner, and inspected to confirm that each contains only its declared ABI.
    The project unit tests, lint checks, instrumentation-order check, generated-icon
    verification, demo-guest integrity check, and no-bundled-Gadget checks passed.
    ARM64 behavior remains covered by the device-validation record from 4.0.0; the
    new 32-bit ARM and x86 artifacts are build- and test-validated but have not yet
    been exercised on physical devices in this release cycle.

    Scope and safety

    FridaBox is an authorized dynamic-analysis and virtualization research tool. It
    does not claim invisibility or universal application compatibility. Current
    limitations and observable surfaces remain documented in the repository. Use it
    only with software and devices you own or are explicitly authorized to assess.

    Downloads