Objection is a dynamic instrumentation framework and runtime exploration toolkit for mobile application security analysis. It provides a command-line interface to interact with the memory and state of iOS and Android applications during active execution, serving as a toolkit for runtime analysis and security testing.
The project distinguishes itself by providing specialized capabilities to bypass common mobile security controls, including SSL pinning, biometric authentication, and root or jailbreak detection. It enables the extraction of sensitive credentials and data from secure storage systems, such as keychains and SQLite databases, while allowing for the interception of cryptographic operations.
The toolkit covers a broad range of analysis capabilities, including process memory manipulation, heap object inspection, and container filesystem exploration. It also includes monitoring tools for tracing method arguments, analyzing application intents, and configuring application-specific network proxies.
Instrumentation is achieved by injecting a JavaScript engine into a running process or embedding a binary gadget into the application to enable analysis on devices without root or jailbreak access.