mirror of
https://github.com/QM4RS/FridaBox.git
synced 2026-09-16 06:02:22 +02:00
Mahdi Karzari
5140bfc6a7
Integrate Frida Gadget into BlackBox guest startup, add the host workflow and controller tooling, and validate the complete sample hook flow on ARM64 Android 16.
1.1 KiB
1.1 KiB
Detection surfaces
FridaBox is not undetectable. Virtualization reduces accidental identity and API leakage but cannot reproduce a normal kernel/system installation.
- The host Linux UID remains the real UID at kernel level.
- The host SELinux domain remains visible.
- BlackBox virtual stub process names may be observed.
- Host and BlackBox classes coexist with guest classes in the ART process.
- Frida threads, mappings, sockets, and modules are observable.
/proc/self/mapscan reveal Frida Gadget.- The default Frida protocol endpoint can be probed even though it is loopback-only.
- ClassLoader topology differs from a normally installed application.
- Some PackageManager, ActivityManager, and other Binder responses are synthesized.
- The system-side PackageManager does not know the guest package.
- The guest shares the host UID and process sandbox rather than receiving a system-assigned package UID.
- Play Integrity and hardware-backed attestation cannot be faithfully virtualized.
No app-specific anti-Frida or anti-virtualization bypasses are included.