QM4RS/FridaBox
1
0
Fork 0
mirror of https://github.com/QM4RS/FridaBox.git synced 2026-09-14 05:02:07 +02:00
Code Issues Packages Projects Releases 2 Wiki Activity
Files
main
FridaBox/docs/TEST_RESULTS.md
T

7.5 KiB
Raw Permalink Blame History

Test results

Validation date: 2026-07-28

FridaBox 4.2.0 release validation

The signed 4.2.0 release was built after the complete app check and app/Bcore unit-test suites passed. Each split contains exactly one native ABI, reports versionCode 403 and versionName 4.2.0, is 16 KiB ZIP-aligned, and verifies with APK Signature Schemes v1 and v2. All four APKs use the same production certificate as 4.1.0 and 4.1.1 (SHA-256 f8db4dcf0f9272bf75ac170e382ee31ca17fea2606a18aaed0cc4040423cb444).

ABI Size SHA-256
arm64-v8a 3,263,922 bytes e37af8801a3bb12c04db2140c09dfb843f8e105c04aa0c0f88f5731fa3e0cabb
armeabi-v7a 3,246,369 bytes 427b2a4328624cda5881267c4bde00088c2d7df2296f49c5d66cbf4c929b64fc
x86 3,288,071 bytes 8883788d694d42339332f495cbdb8b043198c52648ac168557f0d66dca0beab8
x86_64 3,293,258 bytes 17695849ea9ed7884d2e1a777e9cfbf47529d84ade7a8c6e9746269e9d96b249

The updated ARM64 debug build was also installed on the Samsung SM-S928B running Android 16/API 36. Runtime-bridge controls, version selection without a scroll jump, the centered Gadget browser, Settings cleanup, raised Snackbar, and icon-only animated bottom-navigation selection were exercised without a fatal exception. The other three ABI variants were build-, package-, ELF-, signature-, alignment-, and regression-test-validated but were not exercised on physical hardware in this release cycle.

Host validation

The following commands completed successfully on the build host:

.\gradlew.bat clean
.\gradlew.bat :sample-guest:assembleDebug
.\gradlew.bat :app:assembleDebug
.\gradlew.bat test
.\gradlew.bat :app:check
.\gradlew.bat :app:verifyDebugApkHasNoGadget :app:verifyInstrumentationOrdering :app:verifyDemoGuestUnmodified
npm ci
python tools\build_frida_agents.py
python -m py_compile tools\attach_guest.py tools\forward_frida_ports.py tools\build_frida_agents.py

For this workspace path, native builds used:

$env:FRIDABOX_NDK_PROJECT_DIR='D:\FridaBoxBuild\Bcore'

Unit tests passed with zero failures, including Gadget asset naming, ten-item release pagination, ELF ABI validation, and combined base/split APK inspection. The original suite also covers:

The app check task also verifies that all committed UI control vectors are byte-for-byte reproducible from pinned @tabler/icons 3.45.0 sources.

  • ApkInspectorTest: 3 per variant;
  • ApkIntegrityTest: 1 per variant;
  • InstrumentationPreferenceParserTest: 2 per variant;
  • GuestRuntimeRegistryTest: 2 per variant.

The final APK and custom verification tasks passed:

  • output: app/build/outputs/apk/debug/FridaBox_4.0.0_arm64-v8a-debug.apk;
  • packaged ABIs: ARM64 only;
  • packaged native files do not include a Frida Gadget binary or Gadget configuration;
  • early-load ordering and byte-identical demo-asset checks passed.
  • pinned Frida 17 registry/bootstrap/sample agents rebuilt successfully, and controller help plus empty-range discovery completed successfully.

The build host provided JDK 24.0.1 and complete NDK 29.0.14206865 rather than the requested JDK 21 and NDK 29.0.13846066. These substitutions and the baseline build investigation are recorded in docs/BASELINE.md.

Device validation

Runtime validation passed on a Samsung SM-S928B running ARM64 Android 16/API 36:

  • latest host APK installed successfully;
  • the sample installed only in the FridaBox private workspace and was absent from Android user 0's real PackageManager;
  • Gadget paused startup before SampleApplication.attachBaseContext and onCreate;
  • the controller mapped port 27042 to the sample package/process and reported user ID 0, virtual process ID 0, source APK, and guest PathClassLoader;
  • native enumeration returned 419 modules;
  • sample-hook.js changed Target.add(2, 3) from 5 to 1337;
  • launching without instrumentation recycled the process, opened no Gadget listener, and restored the visible result to 5.

The command and log transcript, including two device-discovered fixes, is in docs/device-validation.log.

Commercial workspace and per-app mode validation

Validation date: 2026-07-20

The redesigned FridaBox launcher and all three per-app modes were validated on the same Samsung SM-S928B, ARM64 Android 16/API 36 device with the imported com.paeezanstudio.pesarkhande 3.3.7 guest.

  • The independent FridaBox launcher, icon, dark product theme, responsive workspace cards, bottom navigation, import action, and selected-mode states rendered correctly at 1080 x 2340.
  • pesarkhande-agent.js (198,960 bytes, SHA-256 41dd04f7a6a4b8de47fcd94ee5646f43effd8f73b36eda64d46a65f4f304fa49) was selected through Android's document picker and copied without modification.
  • On-device mode loaded the private Gadget and Script configuration without a controller, then returned to beforeCreateApplication; the Unity game reached its interactive home screen.
  • Runtime reported local_script_active, package com.paeezanstudio.pesarkhande, virtual user ID 0, virtual process slot 1, the private source APK, and dalvik.system.PathClassLoader.
  • Computer mode paused before beforeCreateApplication. Direct frida -U gadget attachment resumed the guest and enumerated 416 native modules; the first five were app_process64, linker64, libandroid_runtime.so, libbinder.so, and libcutils.so.
  • Clean mode recycled the main guest PID from 26464 to 27819, emitted Instrumentation disabled for this guest process, opened no Gadget listener, and launched the game normally.
  • A stale cross-process SharedPreferences cache initially made Runtime display Waiting for computer for a successful on-device launch. Multi-process reload semantics fixed the display; the persisted state was already correct.
  • The private JavaScript file is mode 0400 and the private Gadget executable is mode 0555 at launch. Android 16 no longer reports the writable-executable warning for the FridaBox Gadget copy.

Final automated builds and tests passed:

.\gradlew.bat :app:assembleDebug :app:assembleRelease :Bcore:testDebugUnitTest :app:testDebugUnitTest

Artifacts:

  • debug: 21,049,981 bytes, SHA-256 80e70b33fca741e4f805aa233cdfaf5bc6fe2030e93c8fd825611eb5c407c917;
  • release: 13,266,764 bytes, SHA-256 caa2218194fcbe91c10d0d29a74b7401aaed53f340b8a0d6668321ddae48ddfb.

The release artifact was intentionally unsigned because no production keystore was supplied. apksigner confirmed the debug APK verifies and the release APK does not contain a debug signature.

Legacy shell removal validation

Validation date: 2026-07-20

The obsolete launcher, GMS/Xposed/fake-location screens, legacy resources, Chinese launcher translations, bundled UI AARs, and old product documentation were removed. The application namespace and all host-owned source moved to com.qm4rs.fridabox; only the runtime engine's compatibility API remains under its upstream package namespace, with attribution retained in THIRD_PARTY_NOTICES.md.

The cleanup passed app/Bcore unit tests, debug and release assembly, and the complete app lint/check task. On the connected Samsung SM-S928B (ARM64, Android 16/API 36), the new APK installed successfully, resumed com.qm4rs.fridabox/.FridaBoxActivity, restored both private guests, and launched com.paeezanstudio.pesarkhande in Clean mode through ProxyActivity$P0 without a fatal exception.

Final cleanup artifacts:

  • debug: 19,795,788 bytes, SHA-256 3fabf2887b3bf1aa1a83475b18803755168b33b2111e89f15d3d1434d89994a5;
  • release: 12,454,018 bytes, SHA-256 b7e9033def3fbe25f92686ceb3a3e2f623951e8d7fdd450b172d30df25e08e8e.
Reference in New Issue View Git Blame Copy Permalink