CreditTone/hooker
Hooker
Hooker ist ein Toolkit für die dynamische Instrumentierung, Speicheranalyse und Deobfuskierung von Android-Anwendungen. Es fungiert als Reverse-Engineering-Framework, das Frida verwendet, um Skripte in laufende Prozesse zu injizieren, native Aufrufe zu überwachen und ausführbare DEX-Dateien zu extrahieren.
Das Projekt bietet spezialisierte Dienstprogramme zur Umgehung von Sicherheitskontrollen, einschließlich Tools zum Deaktivieren der SSL-Zertifikatsvalidierung und des BoringSSL-Pinnings, um die Abfangung von HTTPS-Verkehr zu ermöglichen. Es enthält Funktionen zur Erkennung von Application-Packing, zum Extrahieren kryptografischer Schlüssel durch Hooking von Verschlüsselungsalgorithmen sowie zur Umgehung von Root- oder Debugging-Umgebungsprüfungen.
Das Framework deckt ein breites Spektrum an Analysefunktionen ab, darunter Speicherscanning zur Erkennung aktiver Komponenten, SOCKS5-Proxy-Konfiguration für das Routing von Netzwerkverkehr und UI-Interaktionsanalyse. Es unterstützt zudem das Sammeln von Geräte-Fingerprints und das Debugging eingebetteter WebViews.
Features
- Frida-Based Instrumentation - Utilizes Frida to inject JavaScript agents into running Android processes for memory inspection and function interception.
- Dynamic Instrumentation Hooks - Frida automates the process of inserting scripts into running apps to monitor behavior and generate custom interceptors.
- Android DEX Dumpers - Frida dumps memory to retrieve executable files from protected or packed Android applications.
- Android Application Debugging - Provides tools for inspecting the internal state and monitoring UI interactions of running Android apps.
- Environment Cloaking - Bypasses root detection and debugging checks to allow instrumentation tools to run on protected applications.
- Binary Memory Dumping - Extracts executable bytecode from application process memory to recover files from packed or obfuscated binaries.
- Dynamic Process Instrumentation - Provides a framework for injecting scripts into running Android processes to monitor calls and extract DEX files.
- Call Tracing - Monitors native method registration and execution flows to analyze interactions between high-level and low-level code.
- Android Application Reverse Engineering - Analyzes Android applications using Frida to inspect internal functions, map memory, and trace native calls.
- Certificate Pinning Bypasses - Overrides certificate validation methods in system libraries to circumvent SSL pinning and enable traffic interception.
- Mobile Binary Decryption - Extracts DEX files from packed applications and captures cryptographic keys by hooking encryption algorithms.
- Environment Detection Bypasses - Frida circumvents detection for root access and debugging tools to ensure applications run normally during reverse engineering.
- Memory Component Detection - A toolkit for scanning application memory to detect active services and map component addresses.
- Instrumentation Script Generation - Creates scripts for specific classes or methods using memory analysis to automate stack trace printing.
- Android Traffic Analysis Tools - Routes application data through SOCKS5 proxies and captures SSL traffic for offline analysis.
- Automated Hook Generation - Automates the creation of interceptor scripts by analyzing class structures and method signatures in memory.
- SOCKS5 Traffic Routings - Configures system-level networking to tunnel application traffic through a SOCKS5 proxy for interception and debugging.
- App Deobfuscation Utilities - Identifies app packing and dumps internal functions to aid in reverse engineering.
- Runtime Certificate Extractions - Frida extracts client-side certificates as portable files by hooking keystore methods during bidirectional authentication.
- Packed Executable Warnings - Frida identifies the hardening technology used in a package by analyzing its runtime behavior.
- Cryptographic Key Interceptions - Frida intercepts standard encryption functions to capture plaintexts, ciphertexts, and cryptographic keys.
- SSL Traffic Captures - Frida intercepts and saves SSL/TLS traffic into packet capture files for offline analysis.
