CreditTone/hooker

Features

• Frida-Based Instrumentation - Utilizes Frida to inject JavaScript agents into running Android processes for memory inspection and function interception.
• Dynamic Instrumentation Hooks - Frida automates the process of inserting scripts into running apps to monitor behavior and generate custom interceptors.
• Android DEX Dumpers - Frida dumps memory to retrieve executable files from protected or packed Android applications.
• Android Application Debugging - Provides tools for inspecting the internal state and monitoring UI interactions of running Android apps.
• Environment Cloaking - Bypasses root detection and debugging checks to allow instrumentation tools to run on protected applications.
• Binary Memory Dumping - Extracts executable bytecode from application process memory to recover files from packed or obfuscated binaries.
• Dynamic Process Instrumentation - Provides a framework for injecting scripts into running Android processes to monitor calls and extract DEX files.
• Call Tracing - Monitors native method registration and execution flows to analyze interactions between high-level and low-level code.
• Android Application Reverse Engineering - Analyzes Android applications using Frida to inspect internal functions, map memory, and trace native calls.
• Certificate Pinning Bypasses - Overrides certificate validation methods in system libraries to circumvent SSL pinning and enable traffic interception.
• Mobile Binary Decryption - Extracts DEX files from packed applications and captures cryptographic keys by hooking encryption algorithms.
• Environment Detection Bypasses - Frida circumvents detection for root access and debugging tools to ensure applications run normally during reverse engineering.
• Memory Component Detection - A toolkit for scanning application memory to detect active services and map component addresses.
• Instrumentation Script Generation - Creates scripts for specific classes or methods using memory analysis to automate stack trace printing.
• Android Traffic Analysis Tools - Routes application data through SOCKS5 proxies and captures SSL traffic for offline analysis.
• Automated Hook Generation - Automates the creation of interceptor scripts by analyzing class structures and method signatures in memory.
• SOCKS5 Traffic Routings - Configures system-level networking to tunnel application traffic through a SOCKS5 proxy for interception and debugging.
• App Deobfuscation Utilities - Identifies app packing and dumps internal functions to aid in reverse engineering.
• Runtime Certificate Extractions - Frida extracts client-side certificates as portable files by hooking keystore methods during bidirectional authentication.
• Packed Executable Warnings - Frida identifies the hardening technology used in a package by analyzing its runtime behavior.
• Cryptographic Key Interceptions - Frida intercepts standard encryption functions to capture plaintexts, ciphertexts, and cryptographic keys.
• SSL Traffic Captures - Frida intercepts and saves SSL/TLS traffic into packet capture files for offline analysis.

Star history