notes

This release has a significant change in how iOS applications are patched. Most importantly, after some help over at nowsecure/node-applesign#113, we realised we needed to set the bundle id and add the entitlement cloning flag. By default objection will now parse the bundleid from your .mobileprovision file automatically, but if you need to set it to something else, you can use the new -b flag on the patchipa command.

fixes

• Correctly parse apktool versions, even if build from source. (https://github.com/sensepost/objection/commit/554c6c660b2e68627ff845301cdd664836eef9ee) (via #449) (thanks @No-Cellist-7780)
• Improve support for patching iOS applications using a free developer account. (https://github.com/sensepost/objection/commit/bb33bce3ca9c36482951081e3d3721645f963124)

other

• Bump agent dependencies (https://github.com/sensepost/objection/commit/23ba6b09dab9ef6c4d2e18812e17b8b92e97197a)
• Formatting fixes (https://github.com/sensepost/objection/commit/7724481889cb8873f3bf94ad63f8c8ab23ad7618)

Code Diff Since v1.10.1

fixes

• Don't crash the agent if no matches were found when using the memory search command (https://github.com/sensepost/objection/commit/24582bb9fd1c83155436d6d0b8719cfecbd68028)
• Handle keychain entries that have the kSecAttrSynchronizable flag set (https://github.com/sensepost/objection/commit/8560d7586310145568b4b4f1dfa71c84e3b005a8) (thanks @jpstotz)

other

• Bump agent dependencies (https://github.com/sensepost/objection/commit/1af959f49478ac679fd78ae8d87389745bf32f0d)

Code Diff Since v1.10.0

fixes

• Fix import check for objc_release indicating that ARC is enabled (https://github.com/sensepost/objection/commit/3b8cc593162a1f8aba0b83843105d1e9958e880c)

Code Diff Since v1.10.0

new

• Add the android hooking list class_loaders command to list the available class loaders (https://github.com/sensepost/objection/commit/b0710ed221ceaf73bc380800d2d7c7dcc1944a14)
• Add the objection signapk command to sign multiple apk's using the objection certificate. NOTE: This commit also changes the internal signer used from jarsigner to apksigner (available in the Kali repo) (https://github.com/sensepost/objection/commit/724019a486d410b0b5d83e6d765158b1972b26a8) (via #375) (thanks @mtschirs)
• Add wildcard class name support for Android method hooking (https://github.com/sensepost/objection/commit/0dee9d68638a2b32dfdcba45526012ce532d7a1f) (via #383) (thanks @bet4it)
• Add the ability to specify an already decoded AndroidManifest to the patchapk command such that --skip-resources could still be used under certain conditions (https://github.com/sensepost/objection/commit/93700023499e471b43585957c079fdef8b21496b) (via #407) (thanks @agreenbhm)
• Improve the iOS biometrics bypass hook by also hooking evaluateAccessControl. (https://github.com/sensepost/objection/commit/2977c8a03a1111c352606352d9b68c12a5e4f7df) (via #411) (thanks @jnovak-praetorian)
• Add a new ios monitor crypto command to monitor CommonCrypto usage in real time. (https://github.com/sensepost/objection/commit/746d08d6bfa5d314c5efe89ff3335135b8dea139) (via #430) (thanks @gagnonca)
• Add a new android proxy set command to set the proxy server used by a specific Android app and not the whole OS. (https://github.com/sensepost/objection/commit/91d131174a3141176a0e6e3c783be72651cb88c3) (via #439) (thanks @GOAT-FARM3R)
• Add a new android deoptimize command to disable all optimizations, forcing the android VM to execute via the interpreter. This could help with some missed hooks (https://github.com/sensepost/objection/commit/a34359165fff68fa219473e83208f8ee0816b9a0)

fixes

• Improve error handling when the remote Frida version does not match the local version (https://github.com/sensepost/objection/commit/6b7baf8b0610643b701bcbf00e6f1b1e9edae113)
• Silence errors that may have occurred while checking for updates (https://github.com/sensepost/objection/commit/925d2bc83e04e8bcb196e46894ca7acbe9b33bb8)
• Improve the sqlite connect command to also download SQLite specific temp files if they are available (https://github.com/sensepost/objection/commit/772154f12e146fa6f79f41d0d54e4a5994b3227f) (via #392) (thanks @mame82)
• Revert an older JSON.stringify patch to properly display hooked arguments for Android hooks again (https://github.com/sensepost/objection/commit/675a88f174acb8619abced5c6058717e7d326d3b) (via #414) (thanks @ido77778)

other

• Update agent dependencies (https://github.com/sensepost/objection/commit/7a727a08f0779d2d5dc7713579965781a6f9f653)
• Update agent dependencies (https://github.com/sensepost/objection/commit/618c08759a52241a8d2336c681bcccfbf97e07ba)
• Target es2020 for the agent. This makes Frida 14+ a requirement for QuickJS (https://github.com/sensepost/objection/commit/1e79aa336f10a80c8e474257e037b6abfd47e51f)
• Major Frida agent dependency bump to latest versions (https://github.com/sensepost/objection/commit/d5642c3fa13284e8b71138cb707253cbdccc78e3)
• Reduce the length of generated job ids (https://github.com/sensepost/objection/commit/dc104f8e80687d875bb958aebb640d51434fb9b8)
• Add warnings about loaded classes when hooking (https://github.com/sensepost/objection/commit/8abb553a1d7cc78384e127d7d24799ec177b001a) (via #403) (thanks @TheDauntless)

Code Diff Since v1.9.6

new

• The pwd command will now do the same as pwd print, fixing #395 (https://github.com/sensepost/objection/commit/b550b9449ec8c5048b232bf0cf1323210b711b2b)
• Plugins can now extend the HTTP API by returning a Flask Blueprint in the http_api method of the plugin itself. An example plugin that does this is included here, and will be exposed when specifying the -a flag to the explore command. (https://github.com/sensepost/objection/commit/a2d988bf8114e27101b27aec461705038e0bb87c)
• Add new hooks to the iOS jailbreak bypass module for calls to fopen and -[UIApplication canOpenURL:]. Thanks @haxxinen (#390)

fixes

• Major update checker refactor. The update checker will now only fire once a day, and will store version information in ~/.objection/version_info. This commit also fixed #386 (https://github.com/sensepost/objection/commit/bca97762497783e8cc5929b4dd4c32427316d4c9)

other

• Bump agent dependencies (https://github.com/sensepost/objection/commit/4fd28182f7171ca820c11794965a89b81506d6d0)
• Bump lodash version (https://github.com/sensepost/objection/commit/9e99a012ccc176a76c1b50ef5febe675226f81de)
• Bump agent dependencies (https://github.com/sensepost/objection/commit/76848d803d262fbd6a7764440d1d6018e1db3af9)

Code Diff Since v1.9.5

fixes

• Fix exceptions thrown when version checking. Thanks @MarshalX (#382)
• Refactor (and fix) Android Heap interaction features to better survive future Frida upgrades :D (https://github.com/sensepost/objection/commit/e46044509a407e115d1e01dc149b381d016475ed)

other

• Bump agent dependencies (https://github.com/sensepost/objection/commit/45dd99a75750e397dffb63817e83a881d5704a6c)
• Bump agent dependencies (https://github.com/sensepost/objection/commit/9605949dca750c1e4eb04179d83eac7c8ae1ad83)
• Bump agent dependencies (https://github.com/sensepost/objection/commit/10c7f57794ab5c6464eecbcb8ee1b921c4d6c7a2)
• Bump @types/frida-gum (https://github.com/sensepost/objection/commit/a3c3ba8d222484f880506cd0be24b25223321fa6)
• Bump frida-objc-bridge version (https://github.com/sensepost/objection/commit/c897944f12883e63faa87fe4cc805ab8ceb55dc6)

Code Diff Since v1.9.4

fixes

• Fix path for embedding scripts on Android platforms (https://github.com/sensepost/objection/commit/1db2da7a4db71e608acd8f02a487dc6a662defec)

Code Diff Since v1.9.3

fixes

• Improve error handling when the --skip-resources flag is used. Thanks @mtschirs (#374)
• Exclude leanback activities (AndroidTV) from launchable activity detection in the Android patcher. Thanks @mtschirs (#374)
• Ensure that ObjC API's are not called if they are not needed. Fixes #377 (https://github.com/sensepost/objection/commit/8e53e4bce4b3ff67d23dde83db973edc3d82aa2c)

other

• Bump agent dependencies (https://github.com/sensepost/objection/commit/4f3ee36e3c3bfff9b39eba06eb918376c4ffbfa8)
• Disable compression in agent builds. This was messing with line numbers in the generated source map (https://github.com/sensepost/objection/commit/ac94e705f75daa4ad7c4d694a5630e17ddc1780a)

Code Diff Since v1.9.2

new

• Expose the ping command to the CLI to check if the agent is alive and responds. (https://github.com/sensepost/objection/commit/fee42b3947a9c7d3e22b10305e1c8b130d923821)

fixes

• Fix a typo in the android hooking generate simple command. Thanks @Techbrunch (#360)
• Add missing quotes to the ios hooking watch method command help file (https://github.com/sensepost/objection/commit/a5a1edb4bda424f25c5529f31313d4d706afef54)
• Improve error reporting when hooking iOS selectors (https://github.com/sensepost/objection/commit/0a206c8401c326fdf0b11b2f0fa1ab472b55a3dc)
• Improve Windows apktool version detection, again (https://github.com/sensepost/objection/commit/46f8d0cc12fb425005e332947a6c9d197a8af243)

other

• Bump agent dependencies (https://github.com/sensepost/objection/commit/a69fffc4f813456a2400a4f0d960e3bfea75764d)

Code Diff Since v1.9.1

new

• Extend support for embedding a gadget configuration and script added in version 1.9.0 to iOS IPA's. Thanks @interference-security (#349)
• Automatically toggle extractNativeLibs to false in Android manifests (with a flag to leave the value untouched). Thanks @StingraySA (#353)
• Refactor the ios keychain add command. The --key flag has been removed in favour of the --account and --service flags, allowing for more granular setting of attributes for a keychain item. (https://github.com/sensepost/objection/commit/4dadfc497864ff8d0eeff6b4d4468a1645558a95)

fixes

• Improve apktool version parsing on Windows (https://github.com/sensepost/objection/commit/79aa7ed881789e5c9458e6a09573bbc848c02441)
• Fix command line overload parsing for the android watch class_method command (https://github.com/sensepost/objection/commit/f08cc24cd9bde142c754876690877f5cc5071b84)
• Improve shell command argument. Thanks @dvalter (#355)

other

• Bump agent dependencies (https://github.com/sensepost/objection/commit/cf204a0e28f247e2aa760f03dc74e30a1928788b)

Code Changes Since v1.9.0

new

• Add the --inline flag to the ios heap execute js command, allowing for inline JavaScript evaluation on iOS heap objects. (https://github.com/sensepost/objection/commit/956056aab6d18bbc37105902996102f02a492a67)
• Add a new --unzip-unicode flag to the iOS IPA patcher to treat the IPA name as unicode. Thanks @Fabiano1107 (#309)
• Add the ability to patch in a gadget configuration and script to Android APK's, making it possible to eternalise scripts without needing a computer. Note: This is an Android only feature for now and needs porting for iOS. For more information, please see: https://frida.re/docs/gadget/. Thanks @gergesh (#329)
• Improve the Android method watcher by dumping information about objects instead of simply showing [object, object] for the argument. Thanks @arielmiki (#334)
• Improve anti-frida evasion by using a different prefix for .dex files generated by Java.registerClass(). An example patch to recompile the Android frida-server with the name frida renamed to freeda can be seen here. (https://github.com/sensepost/objection/commit/d1035e566cef7e4e4c139258ee6d112adafa09af)
• Add a new android keystore watch command. This command will report usages of the java.security.KeyStore class, revealing the password used when accessing items. (https://github.com/sensepost/objection/commit/0513b2d780092eedc95390db51c27c895606f241)

fixes

• Fix android hooking set return_value crashing when no optional overload is set. Thanks @root-intruder (#307)
• Fix suggested package name for jarsigner on Linux. Thanks @RomainL972 (#327)
• Update the iOS biometrics bypass script to handle cases where applications check for an error rather than if a success status was returned. Thanks @gagnonca (#333)
• Android patcher improvements. This comes mostly by enforcing the use of apktool version 2.4.1 and up, as well as by automatically running the empty-framework-dir command before patching. Information about upgrading apktool can be found in the wiki here. (https://github.com/sensepost/objection/commit/46288b5c7b708837bf15e03e44f3d45fa24f148f)
• Fix Android root detection scripts that were pretty horribly broken 😂 (https://github.com/sensepost/objection/commit/539fc306ca88b6f4f47c486d195c18e896280af6)

other

• Bump Python dependencies (https://github.com/sensepost/objection/commit/e09e7bda54e188b3119b0c3c52e6be9f4cb68860)
• Bump agent dependencies (https://github.com/sensepost/objection/commit/326b28ec330802cfea0509d96e0c7a1551125c37, https://github.com/sensepost/objection/commit/ae91da03e55e3b0dcd7aa33d03cd6d89ffd51ad3, https://github.com/sensepost/objection/commit/1b78cb36123e5cb7d1b03d5fdf3cd2d8257f9c20, https://github.com/sensepost/objection/commit/d672f1a554212167d922c6260bfe2800c8ef3e3c, https://github.com/sensepost/objection/commit/2ee2dda2f9c356190963099ec174d0ecdafcb6c4, https://github.com/sensepost/objection/commit/5583264e7d4fca67e511ec2525d0d43149f9593c)
• Remove support for Python 3.5 (https://github.com/sensepost/objection/commit/1b198e8fca04218f2994d24e08e37225437794dc)
• Code cleanups. (https://github.com/sensepost/objection/commit/be95b6006038ccb1b9985a4174b596a4b0e86836, https://github.com/sensepost/objection/commit/b63f6fb2ccaf6e32eb12617042beed5d0f3765d7)

Code Changes Since v1.8.4

other

• Temporarily pin the frida-tools version, pending upstream upgrades.

Code Changes Since v1.8.3

fixes

• Improve Kotlin app repackaging support (thanks @dnet via #299)
• Improve iOS 13 SSL pinning bypass support (thanks @tmm1 via #301)

other

• Bump agent dependencies

Code Changes Since v1.8.2

fixes

• Fix Android overload filter (thanks @jpacg via #293)

Code Changes Since v1.8.1

fixes

• Improve plugin loading when specifying a folder with multiple plugins

Code Changes Since v1.8.0

new

• Add a libboringssl SSL pinning bypass for iOS 11+ (thanks @NickstaDB via #281)
• Multiple Android APK patcher improvements which include better support for Kotlin coroutines, a flag to use aapt2 with apktool and better error handling. (thanks @dnet via #282, #283 and #284)
• Add the ability to watch a specific Java method overload, or set a return value for a specific method overload (thanks @aph3rson via #239)
• Add a new iOS command to dump raw, unparsed and unformatted data from the keychain. This is available as the ios keychain dump_raw command and should be used in conjunction with the original dump command to make sure no parsing errors have occurred.
• Add a new file cat command that will perform cat-like activities, added for convenience. Only ASCII printable characters in the target file will be echoed to screen. For any other processing, files should still be downloaded and processed locally.
• Add new Frida hook generator commands to quickly get ready to use, boilerplate code for your own Frida hooks. Two flavours are available; a simple and class version. The version you choose will depend on your use case, so feel free to experiment!
• Completely refactor SQLite database interactions, removing the old implementation and replacing it with LiteCli. Running the sqlite connect database.sqlite command will now automatically drop you into a litecli REPL. If you want to make changed to the target database, add the --sync flag. This way, once you quit from the litecli REPL, the modified database will be synchronized back to the device.

fixes

• Improve RPC messaging from the JavaScript agent to the Python environment.

other

• Update the Frida agent's dependencies, bumping @types/frida-gum to version 14.

Code Changes Since v1.7.5

new

• Add the plugins directory with some sample plugins.

fixes

• Improve the iOS keychain dumper to handle entries with empty data.

other

• Update the Frida agent's dependencies.

Code Changes Since v1.7.4

fixes

• Change the iOS patcher shorthand flag used when specifying a provisioning profile to an upper case P. Lower case was conflicting with the --pause / -p flag.

Code Changes Since v1.7.3

new

• Add an Android Cordova SSL pinning bypass for applications that make use of SSLCertificateChecker-PhoneGap-Plugin. Thanks @clviper.

other

• Bump agent dependencies.

Code Changes Since v1.7.2

fixes

• Escape APK package names causing parsing errors for the Android patcher.
• Stop the iOS IPA patcher if a valid provisioning profile was not found.

other

• Bump agent dependencies.

Code Changes Since v1.7.1