# Objection Tutorial

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-ce8af1068db7be4ad9003f8ddb02fea8f943f1a4%2Farte.png?alt=media" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-ce8af1068db7be4ad9003f8ddb02fea8f943f1a4%2Farte.png?alt=media" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-54ee1fb931f39d1e6f50150361b6aa1927f4ee88%2Fgrte.png?alt=media" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-54ee1fb931f39d1e6f50150361b6aa1927f4ee88%2Fgrte.png?alt=media" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

<img src="https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-ce4fbfd491ab398bd58639023728b416b0758bc1%2Fi3.png?alt=media" alt="" data-size="original">

**Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**!

{% embed url="https://go.intigriti.com/hacktricks" %}

## **Introduction**

**objection - Runtime Mobile Exploration**

[**Objection**](https://github.com/sensepost/objection) is a runtime mobile exploration toolkit, powered by [Frida](https://www.frida.re). It was built with the aim of helping assess mobile applications and their security posture without the need for a jailbroken or rooted mobile device.

**Note:** This is not some form of jailbreak / root bypass. By using `objection`, you are still limited by all of the restrictions imposed by the applicable sandbox you are facing.

### Resume

The **goal** of **objection** is let the user call the **main actions that offers Frida**. **Otherwise**, the user will need to create a **single script for every application** that he wants to test.

## Tutorial

For this tutorial I am going to use the APK that you can download here:

{% file src="https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-ce7c3ec295a1279d1f0a9617694034b0e6c339a1%2Fapp-release.zip?alt=media" %}

Or from its [original repository ](https://github.com/asvid/FridaApp)(download app-release.apk)

### Installation

```bash
pip3 install objection
```

### Connection

Make a **regular ADB conection** and **start** the **frida** server in the device (and check that frida is working in both the client and the server).

If you are using a **rooted device** it is needed to select the application that you want to test inside the _**--gadget**_ option. in this case:

```bash
frida-ps -Uai
objection --gadget asvid.github.io.fridaapp explore
```

### Basic Actions

Not all possible commands of objections are going to be listed in this tutorial, only the ones that I have found more useful.

#### Environment

Some interesting information (like passwords or paths) could be find inside the environment.

```bash
env
```

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-a15396d7921ec411dd889b31f1a518fda22f042c%2Fimage%20\(220\).png?alt=media)

#### Frida Information

```bash
frida
```

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-9181a7d109dccb8412635a30668d8014b6631a5a%2Fimage%20\(1093\).png?alt=media)

#### Upload/Download

```bash
file download <remote path> [<local path>]
file upload <local path> [<remote path>]
```

#### Import frida script

```bash
import <local path frida-script>
```

#### SSLPinning

```bash
android sslpinning disable #Attempts to disable SSL Pinning on Android devices.
```

#### Root detection

```bash
android root disable  #Attempts to disable root detection on Android devices.
android root simulate #Attempts to simulate a rooted Android environment.
```

#### Exec Command

```bash
android shell_exec whoami
```

#### Screenshots

```bash
android ui screenshot /tmp/screenshot
android ui FLAG_SECURE false  #This may enable you to take screenshots using the hardware keys
```

### Static analysis made Dynamic

In a real application we should know all of the information discovered in this part before using objection thanks to **static analysis**. Anyway, this way maybe you can see **something new** as here you will only have a complete list of classes, methods and exported objects.

This is also usefull if somehow you are **unable to get some readable source code** of the app.

#### List activities, receivers and services

```bash
android hooking list activities
```

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-7e07102b4e6f87e96c3cf4594a136d3590691ab7%2Fimage%20\(1016\).png?alt=media)

```bash
android hooking list services
android hooking list receivers
```

Frida will launch an error if none is found

#### Getting current activity

```bash
android hooking get current_activity
```

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-74a3163d5e09a99eb2f038694ec0dbfdcac1a99b%2Fimage%20\(813\).png?alt=media)

#### Search Classes

Lets start looking for classes inside our application

```bash
android hooking search classes asvid.github.io.fridaapp
```

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-1ee9326a975e60d9b89c0e3d5fe185992cbd3fcb%2Fimage%20\(507\).png?alt=media)

#### Search Methods of a class

Now lets extract the methods inside the class _MainActivity:_

```bash
android hooking search methods asvid.github.io.fridaapp MainActivity
```

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-1978dd558bcc997a2b44343ac7af9829143d0dcd%2Fimage%20\(929\).png?alt=media)

#### List declared Methods of a class with their parameters

Lets figure out wich parameters does the methods of the class need:

```bash
android hooking list class_methods asvid.github.io.fridaapp.MainActivity
```

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-006ca9f28c8918e23f7d6a94dcbe93bc208cbad8%2Fimage%20\(299\).png?alt=media)

#### List classes

You could also list all the classes that were loaded inside the current applicatoin:

```bash
android hooking list classes #List all loaded classes, As the target application gets usedmore, this command will return more classes.
```

This is very useful if you want to **hook the method of a class and you only know the name of the class**. You coul use this function to **search which module owns the class** and then hook its method.

### Hooking being easy

#### Hooking (watching) a method

From the [source code](https://github.com/asvid/FridaApp/blob/master/app/src/main/java/asvid/github/io/fridaapp/MainActivity.kt) of the application we know that the **function** _**sum()**_ **from** _**MainActivity**_ is being run **every second**. Lets try to **dump all possible information** each time the function is called (arguments, return value and backtrace):

```bash
android hooking watch class_method asvid.github.io.fridaapp.MainActivity.sum --dump-args --dump-backtrace --dump-return
```

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-b010358dd58a1b962e52a5c5cccc0ad3fe94e250%2Fimage%20\(1086\).png?alt=media)

#### Hooking (watching) an entire class

Actually I find all the methods of the class MainActivity really interesting, lets **hook them all**. Be careful, this could **crash** an application.

```bash
android hooking watch class asvid.github.io.fridaapp.MainActivity --dump-args --dump-return
```

If you play with the application while the class is hooked you will see when **each function is being called**, its **arguments** and the **return** value.

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-7db5cbb7b07bcb7fa428cbd450b13cd47f022997%2Fimage%20\(861\).png?alt=media)

#### Changing boolean return value of a function

From the source code you can see that the function _checkPin_ gets a _String_ as argument and returns a _boolean_. Lets make the function **always return true**:

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-877c67db112f6e5b507630bf5f8ec5fc1620eb66%2Fimage%20\(883\).png?alt=media)

Now, If you write anything in the text box for the PIN code you will see tat anything is valid:

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-3e9c614b9566726b780aa8b994ffe0c333adf618%2Fimage%20\(228\).png?alt=media)

### Class instances

Search for and print **live instances of a specific Java class**, specified by a fully qualified class name. Out is the result of an attempt at getting a string value for a discovered objection which would typically **contain property values for the object**.

```
android heap print_instances <class>
```

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-bc3c40e93d4448fb6cd7847a09def112744fe463%2Fimage%20\(1095\).png?alt=media)

### Keystore/Intents

You can play with the keystore and intents using:

```bash
android keystore list
android intents launch_activity
android intent launch_service
```

### Memory

#### Dump

```bash
memory dump all <local destination> #Dump all memory
memory dump from_base <base_address> <size_to_dump> <local_destination> #Dump a part
```

#### List

```bash
memory list modules
```

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-2515a86824aeb76433556a4e4d4b9fcd51ba353a%2Fimage%20\(286\).png?alt=media)

At the bottom os the list you can see frida:

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-ac353e4c43f8b5470e4ab7e2a302cbb0381340c4%2Fimage%20\(1097\).png?alt=media)

Lets checks what is frida exporting:

![](https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-2f8a8d54cec70561d458fa19b847e4c563761f1b%2Fimage%20\(298\).png?alt=media)

#### Search/Write

You can alse search and write inside memory with objection:

```bash
memory search "<pattern eg: 41 41 41 ?? 41>" (--string) (--offsets-only)
memory write "<address>" "<pattern eg: 41 41 41 41>" (--string)
```

### SQLite

You cals can use the command `sqlite` to interact with sqlite databases.

### Exit

```bash
exit
```

## What I miss in Objection

* The hooking methods sometimes crashes the application (this is also because of Frida).
* You can't use the instaces of the classes to call functions of the instance. And you can't create new instances of classes and use them to call functions.
* There isn't a shortcut (like the one for sslpinnin) to hook all the common crypto methods being used by the application to see cyphered text, plain text, keys, IVs and algorithms used.

<img src="https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-ce4fbfd491ab398bd58639023728b416b0758bc1%2Fi3.png?alt=media" alt="" data-size="original">

**Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**!

{% embed url="https://go.intigriti.com/hacktricks" %}

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-ce8af1068db7be4ad9003f8ddb02fea8f943f1a4%2Farte.png?alt=media" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-ce8af1068db7be4ad9003f8ddb02fea8f943f1a4%2Farte.png?alt=media" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-54ee1fb931f39d1e6f50150361b6aa1927f4ee88%2Fgrte.png?alt=media" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="https://4053168017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbkAZDoSuRHGdNlWHdyKs%2Fuploads%2Fgit-blob-54ee1fb931f39d1e6f50150361b6aa1927f4ee88%2Fgrte.png?alt=media" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}
