DOCSEARCHbyAlgolia
Submit Docs

r2frida

repository·master·Indexed 23 days ago

https://github.com/nowsecure/r2frida

A self-contained radare2 plugin that integrates Frida, enabling users to instrument local or remote processes using radare2 commands instead of raw Frida scripts. It provides an abstraction layer bridging radare2 and Frida via r2io-pipe, supporting a variety of connection strings for local, USB, and remote targets. The tool includes a command reference for memory regions, symbol resolution, and tracing, as well as an optional r2frida-objection plugin for Android and iOS probes.

Tokens
13.1K
Snippets
27
Records
104
Agent score
81%

What's inside r2frida

  1. Understand the r2frida architecture

    master

    r2frida acts as an abstraction layer that bridges radare2 and frida using r2io-pipe (an r2pipe abstraction for writing RIO plugins in NodeJS).

    The stack flows as follows:

    1. radare2: The top-level toolchain.
    2. r2io-pipe: The abstraction layer for NodeJS.
    3. r2frida: The r2-like interface for Frida.
    4. frida: The host APIs and logic.
    5. target: The instrumented process running Javascript.

  2. Compile r2frida on Windows

    master

    To compile on Windows, follow these steps:

    1. Install meson and Visual Studio.
    2. Unzip the latest radare2 release zip into the r2frida root directory.
    3. Rename the extracted folder to radare2 (removing the version suffix like -x.y.z).
    4. Run preconfigure.bat to make the VS compiler available in your PATH.
    5. Run configure.bat and then make.bat.

  3. Compile r2frida from source

    master

    To compile r2frida manually, ensure you have the necessary dependencies installed. For GNU/Debian systems, install the following:

    $ sudo apt install -y make gcc libzip-dev nodejs npm curl pkg-config git

    Then, clone the repository and build:

    $ git clone https://github.com/nowsecure/r2frida.git
$ cd r2frida
$ make
$ make user-install
    $ git clone https://github.com/nowsecure/r2frida.git
$ cd r2frida
$ make
$ make user-install

  4. Use r2frida connection strings

    master

    r2frida uses a specific URI scheme to connect to processes via Frida. The format is frida://[action]/[link]/[device]/[target].

    Actions

    • list: List processes
    • apps: List apps
    • attach: Attach to a process
    • spawn: Spawn a process
    • launch: Launch a process

    Links (Connection Type)

    • local: Local system
    • usb: USB device
    • remote: Remote host via host:port

    Targets

    • pid: Process ID
    • appname: Application name
    • process-name: Process name
    • program-in-path: Absolute path to a binary
    • abspath: Absolute path

    Examples

    Local Connections

    • frida://?: Show help
    • frida://: List local processes
    • frida://0: Attach to frida-helper (local session)
    • frida:///usr/local/bin/rax2: Spawn binary by absolute path
    • frida://rax2: Spawn binary by name (if in PATH)
    • frida://spawn/$(program): Spawn a new process
    • frida://attach/(target): Attach to target PID

    USB Connections

    • frida://list/usb//: List processes on the first USB device
    • frida://apps/usb//: List apps on the first USB device
    • frida://attach/usb//12345: Attach to PID 12345 on the first USB device
    • frida://spawn/usb//appname: Spawn an app on the first USB device
    • frida://launch/usb//appname: Spawn and resume an app on the first USB device

    Remote Connections

    • frida://attach/remote/10.0.0.3:9999/558: Attach to PID 558 on a remote frida-server at 10.0.0.3:9999.
    r2 frida://[action]/[link]/[device]/[target]
* action = list | apps | attach | spawn | launch
* link   = local | usb | remote host:port
* device = '' | host:port | device-id
* target = pid | appname | process-name | program-in-path | abspath

  5. Install r2frida on Android via Termux

    master

    When installing r2frida natively on Android via Termux, you must extend the LD_LIBRARY_PATH to point to the system directory before the Termux library directory to resolve symbols correctly.

    $ LD_LIBRARY_PATH=/system/lib64:$LD_LIBRARY_PATH r2 frida://...

  6. Redirect ports for remote Frida instrumentation

    master

    To use r2frida on a remote iOS or Android device, you must forward the 27042 TCP port (where frida-server listens) to your host machine.

    For iOS (via SSH):

    $ ssh -L 27042:localhost:27042 root@192.168.1.35

    For Android (via ADB):

    $ adb forward tcp:27042 tcp:27042
    $ ssh -L 27042:localhost:27042 root@192.168.1.35

$ adb forward tcp:27042 tcp:27042

  8. Use the :objection command in r2frida

    master

    Once installed, you can use the :objection command within an r2frida session to enable or disable jailbreak check bypasses and other probes.

    To use it, first spawn the target process and then load the plugin script:

    1. Start r2frida: r2 frida://spawn/usb//<TargetName>
    2. Load the plugin: : r2f-objection-plugin.js
    3. Execute an objection command: :objection <probename>

    Example of enabling iOS jailbreak bypass:

    > :objection iosJailbreakEnable
    $ r2 frida://spawn/usb//Twitter
> :. r2f-objection-plugin.js
> :objection
iosJailbreakDisable
iosJailbreakEnable
...
> :objection iosJailbreakEnable

  11. How ELF segments and sections are parsed

    master

    The library provides a way to traverse the memory layout of an ELF module by moving from the ELF header to segments, and from segments to sections.

    1. ELF Header: The starting point containing metadata like the program header table offset (phOff).
    2. Segments (Program Headers): Defined by the ELF header. Segments like PT_LOAD represent memory mappings. The PT_DYNAMIC segment is critical as it contains pointers to the dynamic section, which in turn contains the information needed to find other sections.
    3. Sections: Found by parsing the PT_DYNAMIC segment. The library uses the dynamic tags (like DT_STRTAB, DT_SYMTAB, DT_HASH, DT_GNU_HASH) to identify and calculate the boundaries of various ELF sections such as the string table, symbol table, and hash tables.

  12. Handle Base64 encoded paths in filesystem commands

    master
    Several filesystem functions in this module support paths prefixed with base64:. If a path starts with this prefix, the subsequent string is decoded from Base64 before the command is executed. This is useful for passing binary data or paths containing special characters that might be mangled by the transport layer.