What it does. 'Performs runtime dynamic analysis of Android applications using Frida, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-dynamic-analysis-of-android-app/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-dynamic-analysis-of-android-app, or copy the skill folder into ~/.claude/skills/performing-dynamic-analysis-of-android-app/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dynamic-analysis-of-android-app/SKILL.md

SKILL.md (verbatim)

name: performing-dynamic-analysis-of-android-app
description: 'Performs runtime dynamic analysis of Android applications using Frida,
  Objection, and Android Debug Bridge to observe application behavior during execution,
  intercept function calls, modify runtime values, and identify vulnerabilities that
  static analysis misses. Use when testing Android apps for runtime security flaws,
  hooking sensitive methods, bypassing client-side protections, or analyzing obfuscated
  applications. Activates for requests involving Android dynamic analysis, runtime
  hooking, Frida Android instrumentation, or live app behavior analysis.

  '
domain: cybersecurity
subdomain: mobile-security
author: mahipal
tags:
- mobile-security
- android
- frida
- dynamic-analysis
- owasp-mobile
- penetration-testing
version: 1.0.0
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.AA-05
- ID.RA-01
- DE.CM-09
mitre_attack:
- T1059
- T1056
- T1036
- T1078
- T1027

Performing Dynamic Analysis of Android App

When to Use

Use this skill when:

• Static analysis results need runtime validation on an actual Android device
• The target app uses obfuscation (DexGuard, custom packers) that prevents effective static analysis
• Testing requires observing actual API calls, decrypted data, or runtime-generated values
• Assessing root detection, tamper detection, or anti-debugging implementations

Do not use this skill on production environments without authorization -- dynamic instrumentation can alter app behavior and trigger security alerts.

Prerequisites

• Rooted Android device or emulator (Genymotion, Android Studio AVD with writable system)
• Frida server installed on device matching the architecture (arm64, x86_64)
• Python 3.10+ with frida-tools and objection packages
• ADB configured and device connected
• Target APK installed on device

Workflow

Step 1: Setup Frida Server on Android Device

# Check device architecture
adb shell getprop ro.product.cpu.abi
# Output: arm64-v8a

# Download matching Frida server from GitHub releases
# https://github.com/frida/frida/releases
# Push to device
adb push frida-server-16.x.x-android-arm64 /data/local/tmp/frida-server
adb shell chmod 755 /data/local/tmp/frida-server
adb shell /data/local/tmp/frida-server &

# Verify Frida connection
frida-ps -U

Step 2: Enumerate Application Attack Surface

# List all packages
frida-ps -U -a

# Attach Objection for high-level exploration
objection --gadget com.target.app explore

# List activities, services, receivers
android hooking list activities
android hooking list services
android hooking list receivers

# List loaded classes
android hooking list classes
android hooking search classes com.target.app

Step 3: Hook Sensitive Methods

# Hook all methods of a class
android hooking watch class com.target.app.auth.LoginManager

# Hook specific method with argument dumping
android hooking watch class_method com.target.app.auth.LoginManager.authenticate --dump-args --dump-return

# Hook crypto operations
android hooking watch class javax.crypto.Cipher --dump-args
android hooking watch class java.security.MessageDigest --dump-args

# Hook network calls
android hooking watch class okhttp3.OkHttpClient --dump-args
android hooking watch class java.net.URL --dump-args

Step 4: Write Custom Frida Scripts for Deep Analysis

// hook_crypto.js - Intercept encryption/decryption operations
Java.perform(function() {
    var Cipher = Java.use("javax.crypto.Cipher");

    Cipher.doFinal.overload("[B").implementation = function(input) {
        var mode = this.getAlgorithm();
        console.log("[Cipher] Algorithm: " + mode);
        console.log("[Cipher] Input: " + bytesToHex(input));

        var result = this.doFinal(input);
        console.log("[Cipher] Output: " + bytesToHex(result));
        return result;
    };

    function bytesToHex(bytes) {
        var hex = [];
        for (var i = 0; i < bytes.length; i++) {
            hex.push(("0" + (bytes[i] & 0xFF).toString(16)).slice(-2));
        }
        return hex.join("");
    }
});

# Execute custom Frida script
frida -U -f com.target.app -l hook_crypto.js --no-pause

Step 5: Bypass Root Detection

// root_bypass.js - Common root detection bypass
Java.perform(function() {
    // Bypass RootBeer library
    var RootBeer = Java.use("com.scottyab.rootbeer.RootBeer");
    RootBeer.isRooted.implementation = function() {
        console.log("[RootBeer] isRooted() bypassed");
        return false;
    };

    // Bypass generic file-based root checks
    var File = Java.use("java.io.File");
    var originalExists = File.exists;
    File.exists.implementation = function() {
        var path = this.getAbsolutePath();
        var rootPaths = ["/system/app/Superuser.apk", "/system/xbin/su",
                         "/sbin/su", "/system/bin/su", "/data/local/bin/su"];
        if (rootPaths.indexOf(path) >= 0) {
            console.log("[Root] Blocked check for: " + path);
            return false;
        }
        return originalExists.call(this);
    };

    // Bypass SafetyNet/Play Integrity
    try {
        var SafetyNet = Java.use("com.google.android.gms.safetynet.SafetyNetApi");
        console.log("[SafetyNet] Class found - may need additional bypass");
    } catch(e) {}
});

Step 6: Analyze Network Communication at Runtime

// network_monitor.js - Monitor all HTTP requests
Java.perform(function() {
    // Hook OkHttp3
    try {
        var OkHttpClient = Java.use("okhttp3.OkHttpClient");
        var Interceptor = Java.use("okhttp3.Interceptor");
        var Chain = Java.use("okhttp3.Interceptor$Chain");

        console.log("[OkHttp] Monitoring network requests...");

        var Request = Java.use("okhttp3.Request");
        Request.url.implementation = function() {
            var url = this.url();
            console.log("[OkHttp] URL: " + url.toString());
            return url;
        };
    } catch(e) {
        console.log("[OkHttp] Not found, trying HttpURLConnection");
    }

    // Hook HttpURLConnection
    var URL = Java.use("java.net.URL");
    URL.openConnection.overload().implementation = function() {
        console.log("[URL] Opening: " + this.toString());
        return this.openConnection();
    };
});

Step 7: Extract Decrypted Data and Secrets

# Using Objection for quick extraction
objection --gadget com.target.app explore

# Dump Android Keystore entries
android keystore list
android keystore dump

# Search heap for sensitive objects
android heap search instances com.target.app.model.User
android heap evaluate <handle> "JSON.stringify(clazz)"

# Memory string search
memory search "password" --string
memory search "api_key" --string

Key Concepts

Term	Definition
Dynamic Instrumentation	Modifying application behavior at runtime by injecting code into the running process
Method Hooking	Replacing or wrapping function implementations to intercept arguments and return values
Frida Server	Daemon running on the target device that receives instrumentation commands from the host
Dalvik/ART Runtime	Android runtime environments; Frida hooks at the ART level for Java/Kotlin methods
Heap Inspection	Examining live objects in the application's memory heap to extract runtime data

Tools & Systems

• Frida: Dynamic instrumentation toolkit for injecting JavaScript into native Android processes
• Objection: Higher-level Frida wrapper with pre-built Android and iOS security testing commands
• frida-trace: Automated method tracing utility for quick reconnaissance of app behavior
• Drozer: Android security assessment framework for testing IPC and exported components
• Android Studio Profiler: Runtime monitoring for CPU, memory, and network activity

Common Pitfalls

• Frida version mismatch: The Frida server on the device must match the frida-tools version on the host. Version mismatches cause connection failures.
• Anti-Frida detection: Some apps detect Frida by checking for the Frida server process, scanning memory for Frida signatures, or monitoring /proc/self/maps. Use Frida Gadget injection or custom server builds.
• Obfuscated class names: When ProGuard/R8 is applied, class and method names are shortened (e.g., a.b.c.d()). Use android hooking search classes to discover actual runtime names.
• Multi-DEX apps: Large apps split across multiple DEX files may not have all classes loaded at startup. Hook class loaders or use Java.enumerateLoadedClasses() after app is fully initialized.

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Android Dynamic Analysis Report

Target Application

Field	Value
Package Name	[PACKAGE]
Version	[VERSION]
Target SDK	[SDK]
Device	[MODEL] / Android [VERSION]
Rooted	[YES/NO]
Analysis Date	[DATE]

Component Enumeration

Type	Count	Exported	Notable
Activities	[N]	[N]	[DETAILS]
Services	[N]	[N]	[DETAILS]
Receivers	[N]	[N]	[DETAILS]
Providers	[N]	[N]	[DETAILS]

Runtime Security Findings

Finding [N]: [TITLE]

• Severity: [LEVEL]
• OWASP Mobile: [M-ID]
• Category: [MASVS-CATEGORY]
• Description: [DESCRIPTION]
• Evidence: [RUNTIME_OUTPUT]
• Recommendation: [REMEDIATION]

Protection Assessment

Protection	Status	Bypass Difficulty
Root Detection	[Present/Absent]	[Easy/Medium/Hard]
SSL Pinning	[Present/Absent]	[Easy/Medium/Hard]
Frida Detection	[Present/Absent]	[Easy/Medium/Hard]
Debug Detection	[Present/Absent]	[Easy/Medium/Hard]
Emulator Detection	[Present/Absent]	[Easy/Medium/Hard]
Tamper Detection	[Present/Absent]	[Easy/Medium/Hard]

Recommendations

1. [RECOMMENDATION]

references/api-reference.md (verbatim)

API Reference — Performing Dynamic Analysis of Android App

Libraries Used

• frida: Dynamic instrumentation for runtime hooking and SSL pinning detection
• subprocess: ADB commands for package management, traffic capture, component analysis

CLI Interface

python agent.py [--device <id>] packages
python agent.py [--device <id>] ssl --package <pkg>
python agent.py [--device <id>] components --package <pkg>
python agent.py [--device <id>] storage --package <pkg>
python agent.py [--device <id>] network [--duration 30]

Core Functions

check_ssl_pinning(package_name, device_id)

Uses Frida to hook TrustManagerImpl and OkHostnameVerifier to detect SSL pinning.

analyze_exported_components(package_name, device_id)

Runs dumpsys package to enumerate exported activities, services, receivers, providers.

check_data_storage(package_name, device_id)

Checks shared_prefs and world-readable files via run-as for insecure storage.

capture_network_traffic(device_id, duration, output)

Runs tcpdump on device and pulls pcap via ADB.

Frida API Calls

• frida.get_usb_device() — Connect to USB device
• device.spawn([package]) — Launch app
• session.create_script(js) — Inject JavaScript
• script.on("message", callback) — Receive hook results

Dependencies

pip install frida frida-tools
# ADB must be installed and device connected

references/standards.md (verbatim)

Standards Reference: Dynamic Analysis of Android App

OWASP Mobile Top 10 2024 Mapping

OWASP ID	Risk	Dynamic Analysis Coverage
M1	Improper Credential Usage	Intercept credentials at runtime, dump keystore
M3	Insecure Authentication/Authorization	Hook auth methods, observe token generation
M5	Insecure Communication	Monitor network calls, intercept decrypted payloads
M7	Insufficient Binary Protections	Test root detection, Frida detection, tamper checks
M8	Security Misconfiguration	Explore exported components, test IPC endpoints
M10	Insufficient Cryptography	Hook Cipher/MessageDigest to observe crypto operations

OWASP MASVS v2.0 Control Mapping

MASVS Category	Dynamic Test	Method
MASVS-STORAGE	Runtime data extraction	Heap inspection, memory search
MASVS-CRYPTO	Algorithm observation	Hook javax.crypto.Cipher
MASVS-AUTH	Auth flow analysis	Hook login/token methods
MASVS-NETWORK	Traffic monitoring	Hook OkHttp, HttpURLConnection
MASVS-PLATFORM	IPC testing	Drozer, intent fuzzing
MASVS-RESILIENCE	Protection bypass	Root/Frida/debug detection bypass

OWASP MASTG Dynamic Test Cases

Test ID	Description	Tool
MASTG-TEST-0001	Testing Local Storage (Runtime)	Objection, Frida
MASTG-TEST-0010	Testing Custom URL Schemes	Frida hooks, ADB
MASTG-TEST-0013	Testing WebView Security	Hook WebView methods
MASTG-TEST-0029	Testing Root Detection	Frida bypass scripts
MASTG-TEST-0038	Testing Anti-Debugging	ptrace hooks, Frida detection

CWE Mappings

CWE ID	Title	Dynamic Detection
CWE-312	Cleartext Storage	Memory search for plaintext secrets
CWE-319	Cleartext Transmission	Network method hooking
CWE-327	Broken Crypto Algorithm	Cipher.getInstance() hooking
CWE-489	Active Debug Code	Debug flag detection at runtime
CWE-693	Protection Mechanism Failure	Root/tamper detection bypass

references/workflows.md (verbatim)

Workflows: Dynamic Analysis of Android App

Workflow 1: Complete Android Dynamic Assessment

[Setup Frida Server] --> [Enumerate app surface] --> [Hook sensitive methods]
                                                            |
                                             +--------------+--------------+
                                             |              |              |
                                      [Auth hooks]   [Crypto hooks]  [Network hooks]
                                      [Login flow]   [Cipher ops]    [API calls]
                                      [Token mgmt]   [Key generation] [URL requests]
                                             |              |              |
                                             +--------------+--------------+
                                                            |
                                                     [Root detection test]
                                                     [Tamper detection test]
                                                     [Debug detection test]
                                                            |
                                                     [Memory/heap analysis]
                                                     [Extract runtime secrets]
                                                            |
                                                     [Document findings]

Workflow 2: Protection Bypass Pipeline

[App refuses to run] --> [Identify protection]
                               |
              +----------------+----------------+
              |                |                |
       [Root detection]  [Frida detection]  [Emulator detection]
              |                |                |
       [File checks?]   [Port scan?]      [Build.prop?]
       [su binary?]     [Memory scan?]    [IMEI check?]
       [RootBeer?]      [Process name?]   [Sensor data?]
              |                |                |
       [Bypass script]  [Custom Frida]    [Prop override]
              |                |                |
              +----------------+----------------+
                               |
                        [Verify bypass works]
                        [Continue assessment]

Decision Matrix: Hooking Strategy

Scenario	Tool	Approach
Quick reconnaissance	Objection	android hooking watch class
Specific method analysis	Frida script	Custom JavaScript hook
Crypto algorithm discovery	frida-trace	Auto-trace javax.crypto.*
Memory forensics	Objection	memory search / memory dump
IPC testing	Drozer	Module-based component testing
Network analysis	Frida + Burp	Hook + proxy combination

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.