FridaBox

FridaBox is an authorized mobile-security research workspace that runs an original, unmodified APK inside private virtual processes and loads Frida Gadget before the guest Application is created. It requires no root, frida-server, Magisk, Zygisk, system-image changes, real PackageManager installation, APK patching, repacking, or resigning.

The host application ID and Android namespace are both com.qm4rs.fridabox. Third-party engine provenance is isolated in THIRD_PARTY_NOTICES.md.

MVP capabilities

• SAF import of one base APK into app-private, read-only storage.
• SHA-256 verification before and after private virtual installation.
• ARM64 native-library inspection; pure Java/Kotlin guests are accepted and native guests without arm64-v8a are rejected.
• Per-guest instrumented or non-instrumented launches with virtual process stop before mode changes.
• Frida Gadget 17.16.0 bound to loopback, default port 27042, with conflict fallback and on_load=wait for pre-Application.onCreate() hooks.
• Process-local guest registry and controller-side ClassLoader selection.
• Debug sample guest proving Target.add(2, 3) can be replaced with 1337.
• Reproducibly bundled Frida 17 Java agents using pinned frida-java-bridge 7.0.13 and frida-compile 19.0.5.

Start with docs/BUILDING.md, docs/USAGE.md, and docs/FRIDA_CONNECTION.md.

FridaBox is not undetectable. See docs/DETECTION_SURFACES.md and docs/LIMITATIONS.md.

The complete Android 16 device transcript is in docs/device-validation.log.