Ethical Hacking Academy · Lesson

Dynamic Analysis with Frida

Frida and hooking.

Dynamic Analysis with Frida is a free Ethical Hacking Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Is Frida?

Frida is a dynamic instrumentation toolkit. It injects a JavaScript engine into a running app, letting you inspect and modify behavior at runtime, without recompiling.

It is the most important tool for dynamic mobile pentesting.

How Frida Works

Frida runs a small agent (the frida-server on the device) and a client on your machine. You write JavaScript that hooks into functions of the target process.

Your scripts can read arguments, change return values, and call methods directly.

Setup

You push the matching frida-server binary to a rooted device (or use a patched APK with frida-gadget on non-rooted devices) and run it.

The desktop tools then connect over USB.

adb push frida-server /data/local/tmp/
adb shell /data/local/tmp/frida-server &

Enumerating Apps

Confirm the connection by listing installed apps and running processes with the Frida CLI tools.

This verifies frida-server is reachable and gives you the package name to target.

frida-ps -Uai

What Is Hooking?

Hooking means intercepting a function so your code runs before, after, or instead of it. You can log inputs, inspect outputs, or replace behavior entirely.

In Android, you hook Java methods (and native functions) inside the running app.

A Simple Java Hook

Inside Java.perform, you select a class, choose a method, and override its implementation. You can log arguments, then call the original.

Note the example uses single quotes, never backticks, to stay JSON-safe.

Java.perform(function(){
  var Login = Java.use('com.app.Login');
  Login.check.implementation = function(pw){
    console.log('pw=' + pw);
    return this.check(pw);
  };
});

Bypassing a Check

To bypass logic, override a method to return whatever you want. For example, forcing a root or license check to return false (not detected) or true (authorized).

This defeats client-side security that trusts the device.

RootCheck.isRooted.implementation = function(){ return false; };

SSL Pinning Bypass

Apps use SSL pinning to reject proxies. Frida scripts (such as the popular Objection or universal pinning-bypass scripts) hook the pinning logic so you can intercept HTTPS traffic.

This is essential for inspecting an app's API calls through a proxy.

frida -U -f com.app -l ssl-bypass.js

Objection

Objection is built on Frida and offers ready-made commands: bypass SSL pinning, dump the keystore, list activities, and read app storage, all without writing scripts.

It accelerates common tasks during an assessment.

objection -g com.app explore

Spawning vs Attaching

Frida can attach to a running process or spawn the app fresh with your script loaded from the start (-f).

Spawning is needed when you must hook code that runs early, like anti-tamper checks during startup.

frida -U -f com.app -l hook.js --no-pause

Tracing with frida-trace

frida-trace automatically generates and attaches hooks for functions matching a pattern, logging every call. It is great for discovering which methods an app actually uses.

You can target Java methods or native functions, then refine the generated handlers to inspect specific arguments.

frida-trace -U -f com.app -j '*Crypto*!*'

Quick Check

Recall Frida's core capability.

Recap

You now understand dynamic analysis with Frida:

Frida injects a JS engine to hook functions in a live app.
Set up frida-server, enumerate with frida-ps, and hook Java methods.
Override methods to bypass checks and SSL pinning; Objection automates this.
Use spawn mode to catch early startup code.

Next you will examine insecure storage and communications.

Frequently asked questions

Is the “Dynamic Analysis with Frida” lesson free?

Yes — the full text of “Dynamic Analysis with Frida” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “Dynamic Analysis with Frida”?

Frida and hooking. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Dynamic Analysis with Frida” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Ethical Hacking Academy