sensepost/objection
1
0
Fork 0
mirror of https://github.com/sensepost/objection.git synced 2026-10-12 02:22:18 +00:00
Code Issues Packages Projects Releases Wiki Activity
850 Commits 2 Branches 80 Tags
master
Commit Graph
241 Commits
Author SHA1 Message Date
Radon Rosborough 35c4e2c9e6 (chore) add allowScripts to package.json (#819) 
Unfortunately, NPM 12 adds a new feature, where it will silently skip
running post-install scripts, without telling you, unless you
explicitly configure it otherwise for every individual dependency.

As a result, if you checkout Objection onto a machine running NPM 12,
and run "npm install" in the agent directory, then it will error out
with:

    Error: Could not locate the bindings file.

Which happens because the npm install runs the prepare script in the
agent package.json, which runs the build script, which invokes
frida-compile, which expects for its frida dependency to have been
actually installed properly.

Unfortunately, the npm install output makes absolutely no mention of
the fact that a post-install script was silently skipped. Even in the
debug logfile that it tells you about in the command output. I don't
know why this is the case. If you npm install frida just by itself,
then it does print a warning explaining the problem, but not if it's a
dependency.
 2026-09-17 09:20:15 +02:00
IPMegladon 2da035afe8 (chore) Bump bridge versions, small release 2026-06-02 11:13:21 +02:00
Megladon 6317edff92 (fix) agent android error handling (#792) 
Fixes some of the exception handling for okhttp and other android agent functions to not "crash" when an issue is encountered.
 2026-03-23 15:17:10 +02:00
Jeroen BeckersandJeroen 45a8eeea3c (fix) Missing method name [android sslpinning disable] (#772) 
Co-authored-by: Jeroen <[email protected]>
 2026-01-06 13:42:28 +02:00
Leon Jacobs 8c49080512 (chore) bump agent dependencies 2025-11-21 12:46:23 +02:00
ƁƖαηк キツネ 314c17385a fix: correct ObjC reference in Frida 17.x compatibility layer (#763) 
Fixes a typo in the Frida version compatibility check where
globalThis.Java was incorrectly assigned instead of globalThis.ObjC.

This typo caused a ReferenceError when the agent attempted to use
ObjC methods on iOS devices running Frida 17.x, specifically when
calling env_runtime() and other iOS-specific functions.

The fix ensures that when globalThis.ObjC exists (Frida < 17),
it is correctly assigned to the ObjC variable instead of Java.

Fixes #740

Tested-on:
- Frida 17.0.7
- iOS 17.x (jailbroken device)
- DVIA-v2 test application
 2025-11-10 17:44:06 +02:00
Megladon 24539edd85 (fix) Hotfix update of frida-java-bridge (#771) 2025-11-07 16:29:26 +02:00
Megladon d32c1df114 (fix) Few bugfixes and QoL changes. 
* (feat) Attempt attach using identifier.

* (feat) Job handler fixes, and additional error detection.

* (fix) Compatibility with Apktool 2.12.0 and fix passing cli args.
 2025-10-30 08:25:18 +02:00
Megladon e282ea00ec (fix) frida v17 changes, webserver disabled. (#734) 
* (fix) frida v17 changes, webserver disabled.

* (feat) Frida < 17 backwards compatibility.

* (feat) objection backwards compatibility (-g explore). Bump dep versions.

* (chore) deprecated `pkg_resources` replaced with `packaging`.
 2025-06-11 09:23:36 +02:00
Megladon 8f51649922 Job handler refactoring. 
* (fix/feat) Job handler update.
* Fixed import, some crashes and jobs kill autocomplete
 2025-05-05 11:55:17 +02:00
Connor Armand Du Plooy 5b56bc73b4 (feat) Added optional backtrace for implicit intent analyzer. 2025-05-05 08:45:52 +02:00
Megladon bf39037478 (fix) Bugfixes and minor http server feature. (#698) 
* File size check for https://github.com/sensepost/objection/issues/554
* Modified device.attach to fix https://github.com/sensepost/objection/issues/694
* Fixed http server issues introduced by https://github.com/sensepost/objection/commit/3f9763bfd4179ecb20db18934430e30176cc650f (me)
* Added support for using "../" (previously this would mess with current directory display.)
* Add quotes when file/folder has space to fix https://github.com/sensepost/objection/issues/195
* Recursive directory support for http server. Previously you could not traverse directories.
 2025-03-21 17:13:44 +02:00
Lehasa Seoe 954ce3c65e Added Detection and Analysis of Android Implicit Intents (#714) 
* Added functionality to analyse detect and analyse implicit intents

* Included Jobs into the Implicit Intent Analyser
 2025-03-20 15:30:04 +02:00
Leon Jacobs d9c989d2da (fix) move to macho-ts and frida-screenshot ts 2024-06-07 08:32:37 +02:00
Leon Jacobs 012b6cb540 (chore) bump dependenices 2024-05-24 10:05:14 +02:00
Megladon 3f9763bfd4 (chore) Bumping of dependencies. (#681) 
* (chore) Dependency bump

* Pin to major versions

* Version pinning syntax fix
 2024-05-24 10:02:35 +02:00
Megladon d98323470b (feat) Added memory replace command. (#656) 
* (feat) Added memory replace command.

* refactor duplicate code.
 2024-05-23 23:15:14 +02:00
Connor Armand Du Plooy 08df3fb248 Added --watch and friends to notify (#581) 2024-05-23 22:37:28 +02:00
gastontoth 5ed95764fc Adding functionalities: 'update' and 'remove' item from ios keychain. (#584) 2024-05-23 21:27:37 +02:00
Eric Le Guevelandeleguevel c941ead289 fix(agent): getBroadcastReceivers handle null (#591) 
Resolve https://github.com/sensepost/objection/issues/590

Co-authored-by: eleguevel <[email protected]>
 2023-03-30 13:24:35 +02:00
Apkunpacker 216a275c35 Fix some typo (#603) 
* Update crypto.ts

* Update ios.bundles.list_frameworks.txt

* Update bundles.py
 2023-03-30 13:23:13 +02:00
O.o 57237fc495 Fix biometry access constraints (#610) 2023-03-30 13:22:41 +02:00
Leon Jacobs c6be9333e7 (chore) bump dependencies 2023-02-28 09:21:26 +02:00
dependabot[bot] b2b8030718 Bump terser from 5.10.0 to 5.14.2 in /agent (#559) 
Bumps [terser](https://github.com/terser/terser) from 5.10.0 to 5.14.2.
- [Release notes](https://github.com/terser/terser/releases)
- [Changelog](https://github.com/terser/terser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/terser/terser/commits)

---
updated-dependencies:
- dependency-name: terser
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-02-28 09:16:26 +02:00
Leon Jacobs 50817500c8 (chore) remove superfluous namesapce declarations 2022-02-13 20:17:17 +02:00
Leon Jacobs c3eedb50af (chore) bump agent dependencies 2022-02-13 18:05:23 +02:00
Leon Jacobs 0ce114555a (chore) style fixes, minor tweaks and remove old tests 2022-02-13 14:41:06 +02:00
Connor Armand Du Plooycduplooycduplooy
 		43d312dc80 Feat android pattern hooking (#511) 
* Added android pattern hooking

* Create a job per invocation of search/watch

* Cleaning up

* Added error when search pattern is incorrect

* fix job 'implementation'

Co-authored-by: cduplooy <[email protected]>
Co-authored-by: cduplooy <connor.plooy@com>
 2022-02-13 13:01:38 +02:00
Leon Jacobs 0b6413877c (chore) style fixes, tweaks and remove some tests 2022-02-13 12:14:14 +02:00
Connor Armand Du Plooyandcduplooy 5cc8b86f3b Feat ios pattern hooking (#510) 
* Added ios pattern hooking

* Create a job per invocation of search/watch

* Removed job from ios hooking search

* Removed job from ios hooking search

Co-authored-by: cduplooy <[email protected]>
 2022-02-13 09:30:00 +02:00
Leon Jacobs 6498db340f (chore) android root hook cleanup 2022-02-10 09:18:10 +02:00
Leon Jacobs 3d04df974b (feat) add rootbeer isSelinuxFlagInEnabled() check 2022-02-10 07:30:08 +02:00
Leon Jacobs dd4951737d (feat) fix rootbeer bypass 
remove obfuscated hooks, these are not predictable
remove dead code
rename function names
 2022-02-10 07:18:04 +02:00
haxxinen a3b15bbee6 Adding support for bypassing RootBeer library. (#463) 
app: https://github.com/scottyab/rootbeer
lib: https://github.com/scottyab/rootbeer/tree/master/rootbeerlib
apk: https://play.google.com/store/apps/details?id=com.scottyab.rootbeer.sample
blog: https://medium.com/@scottyab/detecting-root-on-android-97803474f694
 2022-02-10 07:04:26 +02:00
Leon Jacobs e89e455198 (chore) style tweaks 2021-10-24 13:41:20 +02:00
Richard Clifford ee7e94556a Update jailbreak.ts (#482) 2021-10-24 13:27:33 +02:00
Leon Jacobs 29846603b8 (chore) code style tweaks 2021-10-24 13:18:41 +02:00
Nicky Bloorandnickyb ddad47cfee Implement JailMonkey bypass (#455) 
* Implemented JailMonkey bypass in Android agent.

* Implemented JailMonkey bypass in iOS agent.

* Update root.ts

Lost a commit somewhere - fixed "false_object" references to refer to the actual object "JavaFalseObject".

* Update jailbreak.ts

Added check to ensure `ObjC.classes.JailMonkey` is defined before attempting to hook `- isJailBroken`.

Co-authored-by: nickyb <[email protected]>
 2021-10-24 12:59:31 +02:00
Leon Jacobs 61ce6e441d (feat/chore) refactor output for android keystore detail 
introduced in #452
 2021-10-24 12:54:13 +02:00
p0w1andmafe 749363f23e Added Command Android>Keystore>ListDetails (#452) 
Co-authored-by: mafe <[email protected]>
 2021-10-24 11:46:46 +02:00
Leon Jacobs 7f4db55812 (chore) bump agent dependencies 
this commit also fixes new type checking related errors
 2021-10-24 11:43:13 +02:00
Leon Jacobs c2121af494 (chore) bump agent dependencies 
changed 26 packages, and audited 288 packages in 24s

38 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities
 2021-05-18 10:44:35 +02:00
Leon Jacobs 23ba6b09da (chore) bump agent dependencies 
❯ npm update

changed 1 package, and audited 288 packages in 18s

38 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities
 2021-04-06 07:51:31 +02:00
Leon Jacobs 1af959f494 (chore) update agent dependencies 
❯ npm update

added 7 packages, changed 23 packages, and audited 288 packages in 29s

38 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities
 2021-03-30 06:16:51 +02:00
Jan S 8560d75863 (fix) keychain dumper misses entries with kSecAttrSynchronizable=true (#448) 
* (fix) keychain dumper misses entries that were created with kSecAttrSynchronizable=true

* (fix) keychain empty() method misses entries that were created with kSecAttrSynchronizable=true
 2021-03-30 06:04:46 +02:00
Leon Jacobs 24582bb9fd (fix) don't crash if no matches are found 2021-03-13 19:25:54 +02:00
Leon Jacobs 3b8cc59316 (fix) correctly parse imports for ARC 
fixes #426
 2021-03-02 10:12:09 +02:00
Corey GagnonandCorey Gagnon ebd920e945 Simplify ios monitor command. (#440) 
* monitor CommonCrypto in real time

* typo

* improve output when job already registered

* fixed unpad

* attempt to convert dataOut to ascii on decrypt

* fixed output in CCCryptorUpdate

* cleaning up style with tslint

* removed dead code

* simplified `monitor` command for crypto

* removed duplicate helpfile

* renamed helpfile to work with new command

* renamed helpfile to work with new crypto monitor command

Co-authored-by: Corey Gagnon <[email protected]>
 2021-02-22 11:05:22 +02:00
Leon Jacobs a34359165f (feat) add the 'android deoptimize' command 
this is a useful command if you are having trouble with hooks
firing as a result of optimizations.
 2021-02-17 18:05:04 +02:00
GOAT-FARM3R 91d131174a Added command to setup proxy via objection (#439) 2021-02-17 17:15:37 +02:00