╔═══════════════════════════════════════════════════════════════════════════════╗
║                                                                               ║
║     █████╗ ██╗   ██╗████████╗ ██████╗     ███████╗██████╗ ██╗██████╗  █████╗  ║
║    ██╔══██╗██║   ██║╚══██╔══╝██╔═══██╗    ██╔════╝██╔══██╗██║██╔══██╗██╔══██╗ ║
║    ███████║██║   ██║   ██║   ██║   ██║    █████╗  ██████╔╝██║██║  ██║███████║ ║
║    ██╔══██║██║   ██║   ██║   ██║   ██║    ██╔══╝  ██╔══██╗██║██║  ██║██╔══██║ ║
║    ██║  ██║╚██████╔╝   ██║   ╚██████╔╝    ██║     ██║  ██║██║██████╔╝██║  ██║ ║
║    ╚═╝  ╚═╝ ╚═════╝    ╚═╝    ╚═════╝     ╚═╝     ╚═╝  ╚═╝╚═╝╚═════╝ ╚═╝  ╚═╝ ║
║                                                                               ║
╚═══════════════════════════════════════════════════════════════════════════════╝

🚀 Auto Frida v2.0 by Omkar Mirkute

Complete Android Security Testing Automation

---

Auto Frida v2.0 is a powerful, all-in-one Android security testing automation toolkit. Connect your device and let Auto Frida handle everything — from Frida installation to intelligent protection detection and bypass script generation.

What's New • Features • Installation • Usage • Auto Analyzer • Scripts • CodeShare • Author

v2.0 is a major upgrade over v1.0. Here's a summary of everything that's new:

The flagship feature of v2.0. Auto Analyzer automatically detects what protections an app uses and generates a tailored bypass script — no manual analysis needed.

• Spawn-mode detection — hooks are installed before any app code runs, eliminating race conditions that caused missed detections in v1.0
• Weighted pattern analysis — a multi-signal confidence scoring engine classifies protections with accuracy percentages
• Consolidated bypass generation — each native symbol and Java method is hooked exactly once, preventing the double-hook crashes present in older approaches
• Post-generation menu — execute, verify, re-analyze, or merge with a custom script after generation

v2.0 adds 11 new bypass modules beyond what v1.0 had:

• Modular JS design — all bypass scripts are now standalone .js files in js_scripts/, independently editable and version-controlled
• BypassPlan dataclass — replaces 12+ ad-hoc boolean variables with a clean, structured bypass plan built from detected findings
• ProtectionClassifier — a dedicated classification engine with 80+ regex rules across 10 protection categories
• DeviceManager & FridaServerManager — device and server lifecycle logic extracted into dedicated classes, making the codebase far easier to maintain and extend
• _native_resolver.js — a shared native symbol resolver loaded first, ensuring all subsequent native hooks find their targets reliably

• Consolidated native hooks — open, fgets, fopen, strstr, strcmp, __system_property_get, access, stat, kill, realpath all merged into a single hook layer with no conflicts
• Consolidated Java hooks — PackageManager, File, Class.forName, RootBeer, Debug, Settings.Global/Secure/System each hooked once with merged logic from all relevant modules
• Safe BufferedReader filter — fixed a recursive readLine() stack overflow bug from v1 by returning empty strings instead of re-calling
• Android 16 / spawn-mode safe SSLContext.init — no registerClass, no Java.use() at top level; thread guard prevents WebView/Chromium SIGSEGV during startup
• Delayed class scans — custom TrustManager and generic root method scans run at 2–3s after startup, catching lazy-loaded protections
• Multi-device support — automatically prompts to select when multiple USB devices are connected

• 50+ hook detection patterns tracking SSL, root, emulator, anti-debug, Frida detection, dynamic code loading, biometric, and more
• Hook synthesis — even when no JSON events are captured, observed hook activations are converted directly into ProtectionFinding objects
• Multi-signal confidence boost — findings sharing a protection type automatically receive a +10% confidence boost
• Configurable analysis duration — choose from Quick (30s), Standard (45s), Deep (60s), Extended (90s), or Max (120s)

# Clone the repository
git clone https://github.com/ommirkute/Auto-Frida.git

# Navigate to directory
cd Auto-Frida

# Run Auto Frida
python auto_frida.py

💡 Note: Auto Frida will automatically install frida and frida-tools via pip if not already present.

pip install -r requirements.txt

# 1. Connect your Android device via USB
# 2. Enable USB Debugging on your device
# 3. Run Auto Frida

python auto_frida.py

# Auto Frida handles everything:
#   ✓ Validates Python, pip, Frida — installs if needed
#   ✓ Detects device and architecture
#   ✓ Downloads and starts matching Frida server
#   ✓ Lists all installed apps
#   ✓ Detects protections (Auto Analyzer) or injects your script

┌─────────────────────────────────────────────────────────────────────────────┐
│  PHASE 1   │  Environment Validation                                        │
│            │  └── Checks Python, pip, Frida. Auto-installs if needed        │
├────────────┼────────────────────────────────────────────────────────────────┤
│  PHASE 2   │  ADB & Device Detection                                        │
│            │  └── Finds devices, handles auth, multi-device selection       │
├────────────┼────────────────────────────────────────────────────────────────┤
│  PHASE 3   │  Device Analysis                                               │
│            │  └── Detects architecture, checks root, handles SELinux        │
├────────────┼────────────────────────────────────────────────────────────────┤
│  PHASE 4   │  Smart Frida Server Lifecycle                                  │
│            │  └── 3-layer validation → download → push → start              │
├────────────┼────────────────────────────────────────────────────────────────┤
│  PHASE 5   │  App Enumeration                                               │
│            │  └── Lists all installed apps with running PID status          │
├────────────┼────────────────────────────────────────────────────────────────┤
│  PHASE 6   │  Target Selection                                              │
│            │  └── Filter all/running, search by name or package             │
├────────────┼────────────────────────────────────────────────────────────────┤
│  PHASE 7   │  Script Selection                                              │
│            │  └── Auto Analyzer, built-in scripts, CodeShare, or custom     │
├────────────┼────────────────────────────────────────────────────────────────┤
│  PHASE 8   │  Execution                                                     │
│            │  └── Spawn or Attach mode with full error handling             │
└────────────┴────────────────────────────────────────────────────────────────┘

Auto Analyzer is the centerpiece of v2.0. It fully automates the process of finding what protections an app uses and generating a bypass.

Phase 0  ─  Anti-Frida shield included in all generated bypasses
Phase 1  ─  App is spawned via Frida (hooks in place before any app code runs)
            Detection script monitors for 30–120 seconds
Phase 2  ─  Weighted pattern analysis classifies captured events
            50+ hook patterns × confidence scoring → ProtectionFinding list
Phase 3  ─  Consolidated bypass script generated
            Each symbol/method hooked exactly once — no crashes

When prompted for a script, enter AA:

> AA

You'll be asked to choose a monitoring duration:

Interact with the app during monitoring to trigger as many protection checks as possible (login, navigate, make network requests).

Auto Analyzer classifies protections across 10 categories:

Generated scripts are saved to generated_bypasses/ and follow this layered architecture:

Layer -1  Native symbol resolver (_native_resolver.js)
Layer 0a  Shared constants (root paths, packages, keywords)
Layer 0b  Consolidated native hooks (open, fgets, fopen, strstr, __system_property_get, ...)
Layer 0c  Non-conflicting native modules (Flutter SSL, native libssl)
Layer 0d  Anti-Frida Java hooks (500ms timeout)
Layer 1   Main Java.perform block (1000ms timeout)
          ├─ Build field spoofing
          ├─ Consolidated SSL bypass (TrustManager + HttpsURLConnection)
          ├─ OkHttp3, NetworkSecurityConfig, WebView, Xamarin
          ├─ Consolidated root/ADB/debug/PM/signature bypass
          └─ SafetyNet, Emulator, Biometric, Kill-switch, Dynamic class hooks
Layer 2   Delayed class scans (2–3s)
          ├─ Custom TrustManager scan
          └─ Generic root method scan

After script generation you can:

1. Execute & verify — launches the app and live-monitors which bypass hooks trigger
2. Execute without verification — direct Frida session
3. Re-run analysis — choose a different duration
4. Merge with custom script — combine with your own .js file
5. Save and return — keep the script for later use

Auto-Frida/
├── auto_frida.py           # Main application
├── requirements.txt        # Python dependencies
├── README.md
│
├── js_scripts/             # All Frida bypass/detection scripts
│   ├── _native_resolver.js          # Shared native symbol resolver
│   ├── detection_script.js          # Auto Analyzer detection hooks
│   ├── detect_flutter.js            # Flutter runtime detector
│   ├── bypass_anti_frida.js         # Frida detection bypass
│   ├── bypass_flutter_ssl.js        # Flutter libflutter.so SSL
│   ├── bypass_okhttp3.js            # OkHttp3 CertificatePinner
│   ├── bypass_trustmanager.js       # TrustManagerImpl / Conscrypt
│   ├── bypass_network_security.js   # NetworkSecurityConfig
│   ├── bypass_webview.js            # WebViewClient SSL errors
│   ├── bypass_httpsurlconnection.js # HttpsURLConnection / Volley
│   ├── bypass_xamarin.js            # Xamarin / Mono
│   ├── bypass_ssl_native.js         # Native libssl / BoringSSL
│   ├── bypass_rootbeer.js           # RootBeer library
│   ├── bypass_generic_root.js       # File/exec/process root checks
│   ├── bypass_safetynet.js          # SafetyNet + Play Integrity
│   ├── bypass_anti_debug.js         # Debug / ptrace detection
│   ├── bypass_emulator.js           # TelephonyManager emulator
│   ├── bypass_build_props.js        # android.os.Build spoofing
│   ├── bypass_adb_debug.js          # ADB / developer options
│   ├── bypass_signature.js          # Signature / tamper checks
│   ├── bypass_dynamic_dex.js        # DexClassLoader
│   ├── bypass_biometric.js          # BiometricManager / Keyguard
│   └── bypass_kill.js               # System.exit / Runtime.halt
│
├── scripts/                # Built-in general-purpose scripts
│   ├── ssl_pinning_bypass.js
│   ├── root_bypass.js
│   ├── flutter_ssl_bypass.js
│   ├── anti_debug_bypass.js
│   └── scripts.json
│
├── generated_bypasses/     # Auto Analyzer output (created at runtime)
└── logs/
    └── auto_frida.log

Place your .js files in the scripts/ directory, or select "C. Custom" at runtime to enter any path.

For the best SSL pinning bypass success rate, use Reqable as your proxy with its root certificate installed on your device. Reqable is a modern HTTP debugging proxy purpose-built for mobile testing, and it works significantly better than alternatives like Burp Suite or Charles when combined with Auto Frida's bypass scripts.

Step 1 — Install Reqable

Download Reqable from reqable.com and install it on your computer.

Step 2 — Install the Reqable Root Certificate on your Android device

1. Open Reqable on your computer and go to Settings → SSL → Export Root Certificate
2. Push the certificate to your device:

   adb push reqable-ca.crt /sdcard/Download/reqable-ca.crt

3. On the device go to Settings → Security → Install from storage and install the certificate
4. For rooted devices, install it as a system certificate for maximum compatibility:

   # Convert to system cert format
   openssl x509 -inform PEM -subject_hash_old -in reqable-ca.crt | head -1
   # Returns a hash, e.g. "a1b2c3d4" — rename file accordingly
   adb push a1b2c3d4.0 /system/etc/security/cacerts/
   adb shell chmod 644 /system/etc/security/cacerts/a1b2c3d4.0

Step 3 — Configure your device Wi-Fi proxy

Point your Android device's Wi-Fi proxy to your computer's IP on Reqable's port (default 11888):

1. On Android go to Settings → Wi-Fi → Long press your network → Modify network
2. Set Proxy → Manual, enter your computer's local IP and port 11888

Step 4 — Run Auto Frida

Now run Auto Frida and use the Auto Analyzer or any SSL bypass script. With Reqable's cert installed and Auto Frida's bypass active, you get two layers of SSL interception working together — dramatically improving success rates on apps with heavy pinning.

python auto_frida.py
# Select your app → AA (Auto Analyzer) → interact with the app
# Watch decrypted traffic appear in Reqable in real time

💡 Tip: Installing the certificate as a system certificate (step 2, rooted path) is strongly recommended. Many apps explicitly check that the intercepting certificate is in the system store rather than the user store, and will reject user-installed certs even after pinning is bypassed.

Auto Frida supports running scripts directly from Frida CodeShare using the native --codeshare flag.

1. Select "C. Custom" in Script Selection
2. Choose "1. CodeShare"
3. Enter the script in format: author/script-name

frida -U -f com.app.package -l script.js

frida -U -p <PID> -l script.js

adb shell su -c setenforce 0

git clone https://github.com/ommirkute/Auto-Frida.git

Security Researcher & Developer

This project is licensed under the MIT License - see the LICENSE file for details.