dpnishant/appmon

Documentation:

Welcome to AppMon!

As seen at US & EU

AppMon is an automated framework for monitoring and tampering system API calls of native macOS, iOS and android apps. It is based on Frida.

This project was only possible because of Ole André Vadla Ravnås and I dedicate it to him. Follow him on GitHub, Twitter

It consists of the following components:

• AppMon Sniffer - Intercept API calls to figure out interesting operations performed by an App
• Appmon Intruder - Manipulate API calls data to create change app's original behavior
• AppMon Android Tracer - Automatically traces Java classes, methods, its arguments and their data-types in Android APKs
• AppMon IPA Installer - Creates and installs "inspectable" IPAs on non-jailbroken iOS devices
• AppMon APK Builder - Creates APKs "inspectable" on non-rooted Android devices

New/Experimental Features

Details

Documentation

Follow the documentation below to learn more. Click Here

Credits

JetBrains
Many thanks to JetBrains s.r.o. for providing a free license of All Products Pack to kindly support the development of appmon.

Contributors

This project exists thanks to all the people who contribute.

Backers

Thank you to all our backers! 🙏 [Become a backer]

Sponsors

Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor]

appmon's Issues

Use variable camelCasing

@oleavr dpnishant: You'll pick it up quickly. You probably want to use camelCase for variable names btw, to make the code more idiomatic, and if you later want to use frida-compile you can pre-generate the .js at build time and be able to use existing modules from npm (you could publish some that are Frida-specific as well if you see parts that are reusable across

@oleavr projects) as well. This last point means you don't need to worry about conflicting variable names, because each module is contained and only the stuff you assign to module.exports gets exported

WebUI. : suggestions

These suggestions are based on non-rooted android device support video.

1. Provide a drop down at the right side to select the app in every interface window.
   or
2. A back button or a hyperlink at the page allowing user to go back to app selection screen.

use apksigner instead of jarsigner

https://developer.android.com/studio/command-line/apksigner.html

Caution: If you sign your APK using apksigner and make further changes to the APK, the APK's signature is invalidated. Therefore, you must use tools such as zipalign before signing your APK.

Launching appmon tells SyntaxError

Hello, when I try to launch any of the appmon tools I get this error, and when i put parentheses for the print it just pops other syntax errors.
I'm running python 3.6.1.

File "appmon.py", line 33
    """
      ^
SyntaxError: Missing parentheses in call to 'print'

Webview postdata from Object to string (Question)

I want detect which params sended to Webview. In logger i see this data

How convert it from Object to string readable data?

ImportError: No module named alembic.migration

I'm trying to use Appmon on my Linux machine. I did install all the dependencies by running

sudo -H pip install argparse frida flask termcolor dataset --upgrade

But I get the following error when I run it.

Any idea what is wrong?

~/Programs/appmon-master $ sudo python appmon.py
Traceback (most recent call last):
  File "appmon.py", line 22, in <module>
    import database as db
  File "/home/arya/Programs/appmon-master/database/__init__.py", line 18, in <module>
    import dataset, json, time, htmlentities
  File "/usr/local/lib/python2.7/dist-packages/dataset/__init__.py", line 3, in <module>
    from dataset.database import Database
  File "/usr/local/lib/python2.7/dist-packages/dataset/database.py", line 14, in <module>
    from alembic.migration import MigrationContext
ImportError: No module named alembic.migration

Import database as db error

Hi all, Ive noticed that when running appmon, it will give you error stating that there was a issue on init.py line 67

Referring to that i see the code below

<<<<<<< HEAD
        try:
            artifact_value = artifact_value.replace("<", "&lt;").replace(">", "&gt;")
        except AttributeError as e:
            pass
=======
        artifact_value = artifact_value.replace("<", "&lt;").replace(">", "&gt;")
>>>>>>> 2eb209ce1d4b4d34b0c9dab94ca63c44079fbdae
      else

Removable of the Head and == and >> 2eb will allow the application to run normally. 👍

Can not get data from HTTPConnection again using HTTP.js

My target APP can not get data from HTTPConnction when I using HTTP.js.
I debug the HTTP.js and find that the stream had been read before function getInputStream return.
The APP get the result of getInputStream as stream and try to read the data using function read. But the read() return -1 cause the data had been read in HTTP.js.

If I return stream before the following code, my target APP will be fine:
if (stream) {
var BufferedReaderStream = BufferedReader.$new(InputStreamReader.$new(stream));
var inputLine = "";
while ((inputLine = BufferedReaderStream.readLine()) != null){
responseBody += inputLine + "\n";
}
BufferedReaderStream.close();

I think we should copy a new stream and return. But I didn't find the way. Can you help me?

Add hooks for low-level system calls

https://developer.android.com/reference/android/system/Os.html

Problem attaching a process name with blanks

Hi,

My setup is:
IOS 9.3.2
Appmon on Ubuntu

I have a process with a space his name for example "this is application name".
The appmon failed to start and outputting this error:

[ERROR] unexpected error while probing dyld of target process
Traceback (most recent call last):
File "appmon.py", line 346, in init_session
session = device.attach(arg_to_attach)
File "/usr/local/lib/python2.7/dist-packages/frida/core.py", line 97, in attach
return Session(self._impl.attach(self._pid_of(target)))
NotSupportedError: unexpected error while probing dyld of target process

OnEnter and onLeave

Does this appmon have the ability to find out the onEnter and onLeave for a user defined function ??

NO prompt "Frida: Listening on TCP port 27042"

    I try to install an ipa by using ipa_installer.py  on a non jailbroken device. But there was no prompt "Frida: Listening on TCP port 27042" at the end of installing, just a single "success" and the ipa was successful installed. Surely when i use frida-ps -U it appears "unable to connect to remote frida-server". 
   And I try to read the system log, nothing useful was found. So how can I fix this question? THX for ur help.

"get_usb_device" often times out

I'd recommend passing a "maximum time to wait" value to get_usb_device, as I often encounter a timeout when running Frida code, including this. 1-2 seconds should do the job. I'm not sure whether this is due to the delays associated with accessing Virtual Machine "hardware", however.

Failed to attach: unable to communicate with remote frida-server;

When i try "frida -U -p 0"
Failed to attach: unable to communicate with remote frida-server; please ensure that major versions match and that the remote Frida has the feature you are trying to use
Iphone 4.s
ios 9.3.5
Frida 10.5.8 (client)
frida 32bit "10.5.8 ( server )

(lldb) command source -s 0 '/tmp/A2FA8077-26DB-4AE5-B4F2-44FB956D8A81/fruitstrap-lldb-prep-cmds-a6173add9ee6f9a554b5de7c6098ad2dc2a54ad7'
Executing commands in '/tmp/A2FA8077-26DB-4AE5-B4F2-44FB956D8A81/fruitstrap-lldb-prep-cmds-a6173add9ee6f9a554b5de7c6098ad2dc2a54ad7'.
(lldb) platform select remote-ios --sysroot '/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/9.3 (13E230)/Symbols'
Platform: remote-ios
Connected: no
SDK Path: "/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/9.3 (13E230)/Symbols"
(lldb) target create "/Users/PhidiaS-MAC/Downloads/appmon-master/ipa_installer/apps/Instagramex-injected-resigned/Payload/Instagram.app"
Current executable set to '/Users/PhidiaS-MAC/Downloads/appmon-master/ipa_installer/apps/Instagramex-injected-resigned/Payload/Instagram.app' (armv7).
(lldb) script fruitstrap_device_app="/private/var/containers/Bundle/Application/08262CEB-19D2-442B-99CB-181E707E5923/Instagram.app"
(lldb) script fruitstrap_connect_url="connect://127.0.0.1:49440"
(lldb) command script import "/tmp/A2FA8077-26DB-4AE5-B4F2-44FB956D8A81/fruitstrap_a6173add9ee6f9a554b5de7c6098ad2dc2a54ad7.py"
(lldb) command script add -f fruitstrap_a6173add9ee6f9a554b5de7c6098ad2dc2a54ad7.connect_command connect
(lldb) command script add -s asynchronous -f fruitstrap_a6173add9ee6f9a554b5de7c6098ad2dc2a54ad7.run_command run
(lldb) command script add -s asynchronous -f fruitstrap_a6173add9ee6f9a554b5de7c6098ad2dc2a54ad7.autoexit_command autoexit
(lldb) command script add -s asynchronous -f fruitstrap_a6173add9ee6f9a554b5de7c6098ad2dc2a54ad7.safequit_command safequit
(lldb) connect
(lldb) run
success
2017-08-31 17:13:10.648 Instagram[531:16186] Frida: Listening on TCP port 27042

Please add trace code to each metod call

Hi, good work. but it woud be great if you add somesing like getStackTrace for each function and metod call something like this:

function trace() {
    var Log = Java.use("android.util.Log");
    var Exception = Java.use("java.lang.Exception");
    var ret = "";
    try
    {
        throw Exception.$new("Trace");
    }catch(e){
        ret = (Log.getStackTraceString(e));
    }
    return ret;
}

Omit JSON.stringify()

@oleavr dpnishant: Btw, you can omit JSON.stringify() when you send() data, because send() will JSON.stringify() the data for you, and the language binding, e.g. frida-node, will do the reverse (JSON.parse()) so you get an object / dict / etc. native to the language binding

issues with android-sdk command-line tools

Hi
Per the 5.b we should install the android-sdk command-line tools and execute the ./andorid command.
this command is not available any more as you can see:

root@ubuntu:~/Downloads/tools# ./android

---

The "android" command is deprecated.
For manual SDK, AVD, and project management, please use Android Studio.
For command-line tools, use tools/bin/sdkmanager and tools/bin/avdmanager

---

Invalid or unsupported command ""

Supported commands are:
android list target
android list avd
android list device
android create avd
android move avd
android delete avd
android list sdk
android update sdk

---

could you help with workaround?

Thanks

Parse class-dump output for automated hooking via GUI

ipa_installer determines wrong Executable

The getMachOExecutable() function in ipa_installer.py is not working properly.

In my case the file command returned Mach-O 64-bit executable arm64 for the executable file name. In consequence, none of the files matched the expected string Mach-O universal binary and therefore the last value remaining in output (the last file) was assumed to be the executable (which was in fact a ASCII file in my case).

In general, it would be much more precise to determine the executable by reading the CFBundleExecutable property from the Info.plist file.

Brief attempt (without error handling):

import plistlib

def getMachOExecutable(app_path):
    plist_path = os.path.join(app_path, "Info.plist")
    plist = plistlib.readPlist(plist_path)
    executable = plist["CFBundleExecutable"]
    return os.path.join(app_path, executable)

How to show input, output of function in Class

Android Tracer: static method not traced

I want to trace all methods in AudioRecord, getMinBufferSize was found, but not traced.

payload['overloads'] not populated in android_tracer.py, leading to exception.

The 'overloads' entry in the payload dictionary is not getting populated, this leads to a lot of (handled) exceptions, however also leads to the program saying "didn't find anything. Quitting". After patching this, I received several hundred results.

The following code is a temporary workaround:

if not 'overloads' in payload:
payload['overloads'] = ''

NameError: name 'dev_identity' is not defined

[+] Unpacking IPA...
[+] Injecting DYLIB...
[+] Code-signing...
/tmp/appmon_ipa/SinespCidadao/Payload/SinespCidadao.app/FridaGadget.dylib: replacing existing signature
/tmp/appmon_ipa/SinespCidadao/Payload/SinespCidadao.app: replacing existing signature
Traceback (most recent call last):
File "./ipa_installer.py", line 167, in
subprocess.check_output(["node", iparesign_path, "--without-watchapp", "--identity", dev_identity, "--mobileprovision", mobileprovision_path, injected_ipa_filename])
NameError: name 'dev_identity' is not defined

Suggestions: apk_builder improvements

1. You can call getlibs.sh from within the apk_builder in case folder is not present.
2. Why only pick latest gadgets, will there be any incompatibility in case your current frida is older then gadget packed. We looked at something simmilar for identifying which frida-server to use : https://github.com/AndroidTamer/frida-push/ may be that might help you here.
3. Is there any checks to see if tamper protection is on. coz i suppose modifying the apk means we are tampering with it and some apps might just not allow it to be executed.
4. Why not add adb install in the process to push the apk to remote device.
5. Another good feature would be to pull apk from device itself and patch and reinstall. obviously you will first have to uninstall the apk from device.

seems do not support the latest frida since V8 to Duktape

Any idea to fix this bug？ It seems frida convert V8 to Duktape.
Like this:frida/frida#210

[INFO] Attached to com.netease.mail
[INFO] Building injection...
[INFO] Instrumentation started...
TypeError: not configurable
at ensureClass (frida/node_modules/frida-java/lib/class-factory.js:290)
at ensureClass (frida/node_modules/frida-java/lib/class-factory.js:268)
at frida/node_modules/frida-java/lib/class-factory.js:115
at frida/node_modules/frida-java/index.js:193
at frida/node_modules/frida-java/lib/vm.js:35
at java.js:1231
at script1.js:64

apk_builder.py returns an error - No such file or directory when calling subprocess.check_output()

Problem

subprocess.check_output(["aapt", "dump", "badging", apk_path]) returns an error - No such file or directory.

ENV

(venv) ➜  apk_builder git:(nino) ✗ python --version
Python 2.7.10

Mac OS: 10.11.6

(venv) ➜  apk_builder git:(nino) ✗ pip list
Package        Version
-------------- -------
alembic        0.9.1
appdirs        1.4.3
blindspin      2.0.1
chardet        3.0.2
click          6.7
colorama       0.3.7
configparser   3.5.0
crayons        0.1.2
dataset        0.8.0
Flask          0.12.1
frida          9.1.27
itsdangerous   0.24
Jinja2         2.9.6
Mako           1.0.6
MarkupSafe     1.0
normality      0.4.0
packaging      16.8
pick           0.6.3
pip            9.0.1
pmm            0.5.0
prompt-toolkit 1.0.14
Pygments       2.2.0
pyparsing      2.2.0
python-editor  1.0.3
PyYAML         3.12
requests       2.13.0
setuptools     34.4.0
six            1.10.0
SQLAlchemy     1.1.9
termcolor      1.1.0
wcwidth        0.1.7
Werkzeug       0.12.1
wheel          0.29.0

Reproduction Steps

(venv) ➜  apk_builder git:(nino) ✗ python apk_builder.py --apk /Users/its/Desktop/myapp.apk

     ___      .______   .______   .___  ___.   ______   .__   __.
    /   \     |   _  \  |   _  \  |   \/   |  /  __  \  |  \ |  |
   /  ^  \    |  |_)  | |  |_)  | |  \  /  | |  |  |  | |   \|  |
  /  /_\  \   |   ___/  |   ___/  |  |\/|  | |  |  |  | |  . `  |
 /  _____  \  |  |      |  |      |  |  |  | |  `--'  | |  |\   |
/__/     \__\ | _|      | _|      |__|  |__|  \______/  |__| \__|
					    github.com/dpnishant


[I] Preparing work directory...
[I] Expanding APK...
Traceback (most recent call last):
  File "apk_builder.py", line 94, in <module>
    apk_dump = subprocess.check_output(["aapt", "dump", "badging", apk_path])
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/subprocess.py", line 566, in check_output
    process = Popen(stdout=PIPE, *popenargs, **kwargs)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/subprocess.py", line 710, in __init__
    errread, errwrite)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/subprocess.py", line 1335, in _execute_child
    raise child_exception
OSError: [Errno 2] No such file or directory

App under the 64 - bit system can not use this tool?

python appmon.py -p android -s scripts/Android -a com.xx.account

[ERROR] unable to handle 64-bit processes due to build configuration
Traceback (most recent call last):
File "appmon.py", line 264, in init_session
session = device.attach(app_name)
File "/usr/local/lib/python2.7/dist-packages/frida/core.py", line 96, in attach
return Session(self._impl.attach(self._pid_of(target)))
NotSupportedError: unable to handle 64-bit processes due to build configuration
^CTraceback (most recent call last):
File "appmon.py", line 305, in
script.unload()
NameError: name 'script' is not defined

Cannot select App

Hey I'm, using latest version from github.

After I start appmon the instrumentation looks ok:

python appmon.py -p ios -a Auto
[INFO] Attached to Auto
[INFO] Building injection...
[INFO] Instrumentation started...
 * Running on http://127.0.0.1:5000/
 * Restarting with reloader
[INFO] Attached to Auto
[INFO] Building injection...
[INFO] Instrumentation started...
127.0.0.1 - - [20/Jul/2016 11:28:04] "GET / HTTP/1.1" 200 -

But inside the web interface I cannot select the app, the selection is empty.

Any hints? I also tried another app but same result.

Blank param "appname"

I want analyze this app https://play.google.com/store/apps/details?id=app.source.getcontact
When i started appmon, in logs all correct, but in browser i dont see app name

apk_builder.py fails with unzip: cannot find or open lib.zip, lib.zip.zip or lib.zip.ZIP

I executed the following command line

$ python apk_builder.py --apk myapp.apk

but it fails with the following error message

[I] Preparing work directory...
[I] Expanding APK...
[I] Searching .smali
[I] Patching .smali
[I] Injecting libs
unzip: cannot find or open lib.zip, lib.zip.zip or lib.zip.ZIP.
Traceback (most recent call last):
File "apk_builder.py", line 168, in
unzip_output = subprocess.check_output(["unzip", LIB_FILE_PATH, "-d", lib_dir])
File "/usr/lib/python2.7/subprocess.py", line 573, in check_output
raise CalledProcessError(retcode, cmd, output=output)
CalledProcessError: Command '['unzip', 'lib.zip', '-d', '/tmp/appmon_apk/myapp/lib']' returned non-zero exit status 9

What's wrong?

apkbuilder on Windows

Have Android SDK and build tools and Python 2.7 on windows but cannot run apk_builder.py successfully. What modifications are needed?

Trace all classes and methods of an Android application ordered by their calling priority

I would like to trace all methods priority without set class name. How can I do this?

Instrumentation started but can not hook anything.

can not hook anything in android 6.0
frida 10.0.5
[INFO] Attached to com.sankuai.meituan.takeoutnew
[INFO] Building injection...
[INFO] Instrumentation started...

• Running on http://127.0.0.1:5000/ (Press CTRL+C to quit)

It's running but nothing happen.

Android support

For android , when is it coming?

Problems about database

this is my command:
python appmon.py -p android -a com.geektoy.nfcemulator
this is the result:
___ .______ .______ .___ . ______ . __.
/ \ | _ \ | _ \ | / | / __ \ | \ | |
/ ^ \ | |) | | |) | | \ / | | | | | | | |
/ /\ \ | / | / | |/| | | | | | | . | / _____ \ | | | | | | | | | --' | | |\ |
// _\ | _| | _| || || ___/ || __|
github.com/dpnishant

[INFO] Attached to com.geektoy.nfcemulator
[INFO] Building injection...
[INFO] Instrumentation started...

• Running on http://127.0.0.1:5000/ (Press CTRL+C to quit)

but it hook nothing

the URL is: http://127.0.0.1:5000/monitor/?app=com.geektoy.nfcemulator
error message is: OperationalError: (pysqlite2.dbapi2.OperationalError) unable to open database file

It looks like that the dataset installation is missing on the install file.

add non-rooted android device support

add yololib option to ipa_installer

https://github.com/KJCracks/yololib

TouchID Authentication Bypass Error - ReferenceError: identifier 'Set' undefined

ENV

Mac OS 10.11.6
iPhone 6s Jailbroken iOS 9.0
Frida 10.0.3

Reproduction Steps

➜  appmon git:(master) ✗ git pull
Already up-to-date.
➜  appmon git:(master) ✗ intruder
➜  intruder git:(master) ✗ python appintruder.py -a "[redacted]" -p "ios" -s scripts/iOS/touchID.js

     ___      .______   .______   .___  ___.   ______   .__   __.
    /   \     |   _  \  |   _  \  |   \/   |  /  __  \  |  \ |  |
   /  ^  \    |  |_)  | |  |_)  | |  \  /  | |  |  |  | |   \|  |
  /  /_\  \   |   ___/  |   ___/  |  |\/|  | |  |  |  | |  . `  |
 /  _____  \  |  |      |  |      |  |  |  | |  `--'  | |  |\   |
/__/     \__\ | _|      | _|      |__|  |__|  \______/  |__| \__|
                        github.com/dpnishant


[INFO] Attached to [redacted]
[INFO] Building injection...
[INFO] Instrumentation started...
11:21:53 ReferenceError: identifier 'Set' undefined
    at [anon] (duk_js_var.c:1214)
    at script1.js:21

FYI

AppMon Sniffer works properly

➜  appmon git:(master) ✗ python appmon.py -a "[redacted]" -p "ios" -s scripts/iOS

     ___      .______   .______   .___  ___.   ______   .__   __.
    /   \     |   _  \  |   _  \  |   \/   |  /  __  \  |  \ |  |
   /  ^  \    |  |_)  | |  |_)  | |  \  /  | |  |  |  | |   \|  |
  /  /_\  \   |   ___/  |   ___/  |  |\/|  | |  |  |  | |  . `  |
 /  _____  \  |  |      |  |      |  |  |  | |  `--'  | |  |\   |
/__/     \__\ | _|      | _|      |__|  |__|  \______/  |__| \__|
                        github.com/dpnishant


[INFO] Attached to [redacted]
[INFO] Building injection...
[INFO] Instrumentation started...
 * Running on http://127.0.0.1:5000/ (Press CTRL+C to quit)
127.0.0.1 - - [26/May/2017 11:26:42] "GET / HTTP/1.1" 200 -
127.0.0.1 - - [26/May/2017 11:26:43] "GET /favicon.ico HTTP/1.1" 404 -
[May 26 2017 11:26 AM] Dumped to ./app_dumps/[redacted].db

GET /api/fetch 500 error

I tried to get my appmon(from master branch) working on with apps running on my OnePlus 3 (Android 7.1.1/aarch64) with arm64 frida-server (10.6.21) and frida(10.6.21) from PiPy with python2.7.
But whenever I access the webapp and select the app I want to monitor, it silently fails with a HTTP 500 error. (I can see it in the dev tools).
Here are the logs from the appmon stdout.

127.0.0.1 - - [07/Nov/2017 23:11:33] "GET / HTTP/1.1" 200 -
127.0.0.1 - - [07/Nov/2017 23:11:33] "GET /static/img/logo.png HTTP/1.1" 304 -
127.0.0.1 - - [07/Nov/2017 23:11:39] "GET /monitor?app=com.twitter.android HTTP/1.1" 301 -
127.0.0.1 - - [07/Nov/2017 23:11:39] "GET /monitor/?app=com.twitter.android HTTP/1.1" 200 -
127.0.0.1 - - [07/Nov/2017 23:11:39] "GET /static/img/logo.png HTTP/1.1" 304 -
127.0.0.1 - - [07/Nov/2017 23:11:40] "GET /static/img/to-bottom.png HTTP/1.1" 304 -
127.0.0.1 - - [07/Nov/2017 23:11:40] "GET /static/img/to-top.png HTTP/1.1" 304 -
127.0.0.1 - - [07/Nov/2017 23:11:40] "GET /api/fetch?id=0&app=com.twitter.android&_=1510076499873 HTTP/1.1" 500 -
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/site-packages/flask/app.py", line 2000, in __call__
    return self.wsgi_app(environ, start_response)
  File "/usr/local/lib/python2.7/site-packages/flask/app.py", line 1991, in wsgi_app
    response = self.make_response(self.handle_exception(e))
  File "/usr/local/lib/python2.7/site-packages/flask/app.py", line 1567, in handle_exception
    reraise(exc_type, exc_value, tb)
  File "/usr/local/lib/python2.7/site-packages/flask/app.py", line 1988, in wsgi_app
    response = self.full_dispatch_request()
  File "/usr/local/lib/python2.7/site-packages/flask/app.py", line 1641, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/usr/local/lib/python2.7/site-packages/flask/app.py", line 1544, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "/usr/local/lib/python2.7/site-packages/flask/app.py", line 1639, in full_dispatch_request
    rv = self.dispatch_request()
  File "/usr/local/lib/python2.7/site-packages/flask/app.py", line 1625, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "/Users/madushan/Dev/my/android/appmon/appmon.py", line 64, in serve_json
    response = db.read_from_database(db_name, index)
  File "/Users/madushan/Dev/my/android/appmon/database/__init__.py", line 67, in read_from_database
    artifact_value = artifact_value.replace("<", "&lt;").replace(">", "&gt;")
AttributeError: 'int' object has no attribute 'replace'

Appreciate if anyone could give me a hand in resolving this, am I doing something wrong?

How to avoid code-reuse in scripts?

I'm about to develop several, very similar scripts for iOS and I would like to avoid code-reuse. Is there a way of putting commonly used functions into a separate js file (eg tools.js) and include this file in each script? I want to be able to run all scripts with -s folder but also any individual script with -s folder/script12.js.

Currently I check if the needed functions are defined and if not display a warning asking the user to also include tools.js (please run the script with the additional -s tools.js parameter), but it would be better to make it automatically.

If there is no solution right now, what came to my mind is to have an import statement in the beginning of the js files as a comment, e.g.: //import tools.js and then in appmon.py - merge_scripts() check for this line and also include the imported files to merged.js. If you think this is a good feature, I would be happy to implement it and send a PR.

Best regards,
Mark

Why python 2.x?

In Frida's installation page, it says "Python – latest 3.x is highly recommended", so why appmon uses python 2.x and doesn't compatible with python 3.x?

Apps Crashing when made with Apk Builder

Hello,

This is my first time trying AppMon. I have tried a few apps made using apk builder but each of them crashes on load, its not like there is a security mechanism built on it because i have even tried on my own apps, also i even tried the KitKat version of android till android 6, none of it works. is anyone else having this issue?

Inclusion of dataset on install file

The dataset installation is missing on the install file.
Please update.

Process name not listing in the non rooted android

https://github.com/dpnishant/appmon/wiki/5.b-Setup-on-Android-%5BNon-Rooted%5D
Based on the above link, i was able to set it up appmon. When try to run appmon.py, I am not able to see all the list of process.

python appmon.py -p android -ls 1

PID Processes
=== =========
14632 frida-server
25766 sh
25768 app_process

While running python appmon.py -p android -s scripts/Android -a Gadget I am getting this error

[ERROR] unable to find process with name 'Gadget'

Should i root the device?

No handlers could be found for logger "sqlalchemy.pool.StaticPool"

the newest frida version 10.6.18

AttributeError: 'int' object has no attribute 'replace' error

No handlers could be found for logger "sqlalchemy.pool.StaticPool"
[2017-10-27 04:39:52,012] ERROR in app: Exception on /api/fetch [GET]
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/flask/app.py", line 1982, in wsgi_app
response = self.full_dispatch_request()
File "/usr/local/lib/python2.7/dist-packages/flask/app.py", line 1614, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/usr/local/lib/python2.7/dist-packages/flask/app.py", line 1517, in handle_user_exception
reraise(exc_type, exc_value, tb)
File "/usr/local/lib/python2.7/dist-packages/flask/app.py", line 1612, in full_dispatch_request
rv = self.dispatch_request()
File "/usr/local/lib/python2.7/dist-packages/flask/app.py", line 1598, in dispatch_request
return self.view_functionsrule.endpoint
File "appmon.py", line 64, in serve_json
response = db.read_from_database(db_name, index)
File "/root/appmon/database/init.py", line 67, in read_from_database
artifact_value = artifact_value.replace("<", "<").replace(">", ">")
AttributeError: 'int' object has no attribute 'replace'
127.0.0.1 - - [27/Oct/2017 04:39:52] "GET /api/fetch?id=0&app=com.zywawa.claw&_=1509093591702 HTTP/1.1" 500 -

500error if you need ,i can upload the android app. or you can download it from http://a.attach.diaoyu-3.com/zywawa.apk?1509094220305

Detect device before installing IPA

generate verbose error if device not connected.

iOS AppMon intruder cant start

1. Environment

1.1 Frida version

Mac: 8.1.12
iPad Mini4: 8.1.12

1.2 OS

Mac: 10.11.6
iPad: 9.3.3

1.3 AppMon

commit 21bcd63

2. Reproduction Steps:

1. Connect jailbroken iPad Mini4 to MBP.
2. Run below command
3. Error found

➜  intruder git:(master) ✗ python appintruder.py -a <my_app> -p ios -s scripts/iOS/touchID.js
[ERROR] unable to communicate with remote frida-server; please ensure that major versions match and that the remote Frida has the feature you are trying to use
Traceback (most recent call last):
  File "appintruder.py", line 212, in init_session
    session = device.attach(app_name)
  File "/Library/Python/2.7/site-packages/frida-7.3.6-py2.7-macosx-10.11-intel.egg/frida/core.py", line 96, in attach
    return Session(self._impl.attach(self._pid_of(target)))
  File "/Library/Python/2.7/site-packages/frida-7.3.6-py2.7-macosx-10.11-intel.egg/frida/core.py", line 108, in _pid_of
    return self.get_process(target).pid
  File "/Library/Python/2.7/site-packages/frida-7.3.6-py2.7-macosx-10.11-intel.egg/frida/core.py", line 66, in get_process
    matching = [process for process in self._impl.enumerate_processes() if fnmatch.fnmatchcase(process.name.lower(), process_name_lc)]
ProtocolError: unable to communicate with remote frida-server; please ensure that major versions match and that the remote Frida has the feature you are trying to use
^CTraceback (most recent call last):
  File "appintruder.py", line 252, in <module>
    script.unload()
NameError: name 'script' is not defined

But frida-ps works well.

➜  intruder git:(master) ✗ frida-ps -U
 PID  Name
----  -------------------
1829  1Password
1562  Calendar
1771  Mail
1849  Safari
1776  Settings
1754  User Authentication
1679  AppleIDAuthAgent
1556  AssetCacheLocato
1228  BTServer
1245  BlueTool
1579  CMFSyncAgent
1979  CacheDeleteAppCo
1977  CacheDeleteITune

Start frida-server on iPad - Failed. Frida-server should have been started.

➜  ~ ssh [email protected]
isrs-iPad:~ root# frida-server &
[1] 2211
isrs-iPad:~ root# Unable to start server: Error binding to address: Address already in use

No such file or directory: 'tmp/merged.js'

Please help, i cannot solve this issue : " No such file or directory: 'tmp/merged.js' "

C:\AppMon>py -2 appmon.py -a "com.app.myapp" -p android -s scripts/Android

 ___      .______   .______   .___  ___.   ______   .__   __.
/   \     |   _  \  |   _  \  |   \/   |  /  __  \  |  \ |  |

/ ^ \ | |) | | |) | | \ / | | | | | | | |
/ /\ \ | / | / | |/| | | | | | | . | / _____ \ | | | | | | | | | --' | | |\ |
// _\ | _| | _| || || ___/ || _|
github.com/dpnishant

←[33m[INFO] Attached to com.app.myapp←[0m
←[31m[ERROR] [Errno 2] No such file or directory: '/tmp/merged.js'←[0m
Traceback (most recent call last):
File "appmon.py", line 341, in
script = session.create_script(generate_injection())
File "appmon.py", line 180, in generate_injection
with codecs.open(merge_scripts(script_path), 'r', 'utf-8') as f:
File "appmon.py", line 135, in merge_scripts
with codecs.open(merged_script_path, "w", "utf-8") as f:
File "C:\Python27\lib\codecs.py", line 896, in open
file = builtin.open(filename, mode, buffering)
IOError: [Errno 2] No such file or directory: '/tmp/merged.js'

Please help,

No apps available to select

Hi

I am starting the app python appmon.py -p "android" -a "packagename" -s "scripts/Android/" -o "test/" (note i have removed the app name for packagename)

I can correctly see the dump in the terminal

[Dec 02 2016 4:57 PM] Dumped to test/packagename.db

I can correctly see the db file downloaded and i can open it, but going to localhost:5000, when i click in select app button, there is no app there to choose

If i go to next screen without selecting the app, it fails as the tables are empty

Any idea what could be the problem?

Thanks

sleep(5) statements in appmon.py causes "session detatched" error

Where the code checks if you want to spawn the process, the sleep statements break the code - would suggest removing them, similar to android_intruder.py