Lion Cipher Lab

Hook an Android app at runtime with Frida (bypass a root or SSL-pinning check)

• AppSec / DevSecOps
• Intermediate
• ~90 min
• Free · no account required

Why it matters

The static labs read the app at rest and the traffic lab watched it on the wire, but both hit the same ceiling: any check the app performs on ITSELF -- 'am I running on a rooted phone?', 'is this the exact certificate I pinned?', 'is this a licensed copy?' -- happens inside the running app, on a device the user (or attacker) fully controls. Frida is how you reach inside that running process. It is a dynamic-instrumentation toolkit that injects a JavaScript engine into a live app so you can HOOK functions -- watch them being called, read and change their arguments, and override their return…

What you'll learn

• what dynamic instrumentation is: injecting a scripting engine into a live process to observe and change it WITHOUT recompiling the app
• how Frida's two halves fit together -- frida-tools on your host and a version-matched frida-server on the rooted device
• installing frida-tools with pip and pushing/running the matching frida-server on an Android emulator
• enumerating running processes and apps on a device with frida-ps -U
• attaching to a running app and writing a first hook that logs a Java method call, its arguments, and its return value
• overriding a method's return value live -- forcing a boolean like isRooted() to return false, or neutralising an SSL-pinning check
• proving from the outcome that root detection, SSL pinning, and license checks are CLIENT-SIDE controls the attacker can defeat because the client is in their hands
• the WHEN/WHY/BETTER: when dynamic instrumentation beats static reversing, why client-side security cannot be trusted, and that real defense is server-side
• diagnosing the single most common Frida failure -- a frida-server whose version does not match the frida-tools client
• cleaning up: killing frida-server and restoring the app/emulator, and keeping the whole exercise authorized and on hardware you own

Steps in this lab

1. What Frida is, where it fits, and the one rule that keeps it legal
2. WHEN dynamic instrumentation beats static: the three cases
3. Stand up your target: a rooted emulator and a practice app with a client-side check
4. Install the host half: frida-tools with pip
5. Install the device half: a VERSION-MATCHED frida-server (the #1 failure point)
6. Enumerate the target with frida-ps -U and attach your first (logging) hook
7. Override the return value: defeat the root / SSL-pinning check live
8. WHY it worked and what BETTER looks like: the client can never be the boundary
9. Clean up, keep versions in sync, and where this arc goes next

Open the full interactive lab →