False positive in detectFridaListener function

[xxqxpxx]

hello ,

i found some false positives on s24 ultra running android 14. this is also happening on another couple of android

my first question is is this supposed to be true ? :

if (fd == -1) {
LOGI("FridaDetect::detectFridaListener socket failed, errno: %d", errno);
return true;
}

and also FridaDetect::detectFridaListener found a fingerprint on port %d (WebSocket) is found which is causing the issue

logs :

SecurityLogs.txt

[xxqxpxx]

this fixed the issue for me. if you approve i can make a pull request

bool FridaDetect::detectFridaListener() {
    LOGI("FridaDetect::detectFridaListener");
   // this->addlog("FridaDetect::detectFridaListener");

    struct sockaddr_in addr;
    addr.sin_family = AF_INET;
    addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); // Use loopback interface (127.0.0.1)


    // Loop through all ports
    for (int port = 1; port <= 65535; port++) {
        int fd = SecureAPI::socket(AF_INET, SOCK_STREAM, 0);
        if (fd == -1) {
            LOGI("FridaDetect::detectFridaListener socket failed, errno: %d", errno);
       //     sprintf(logMessage,"FridaDetect::detectFridaListener socket failed, errno: %d", errno);
           // this->addlog(logMessage);
            // Consider adding a short delay here to avoid overwhelming the system
            usleep(1000); // 1 millisecond delay
            continue;
        }

        addr.sin_port = htons(port);
        int result = SecureAPI::connect(fd, (const struct sockaddr *) &addr, sizeof(addr));
        if (result == -1 && errno != EINPROGRESS) {
            SecureAPI::close(fd);
            continue;
        }

        // More robust WebSocket handshake and fingerprint check
        char req[1024];
        sprintf(req, "GET /ws HTTP/1.1\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: %s\r\nSec-WebSocket-Version: 13\r\nHost: 127.0.0.1:%d\r\nUser-Agent: Frida/16.1.7\r\n\r\n", generateWebSocketKey(), port);
        SecureAPI::write(fd, req, SecureAPI::strlen(req));

        char res[2048]; // Increased buffer size
        int bytesRead = SecureAPI::read(fd, res, sizeof(res));
        if (bytesRead > 0) {
            // Check for multiple fingerprints and patterns
            if (SecureAPI::strstr(res, ("tyZql/Y8dNFFyopTrHadWzvbvRs=")) != nullptr ||
                SecureAPI::strstr(res, ("Sec-WebSocket-Accept")) != nullptr) {
                LOGI("FridaDetect::detectFridaListener found fingerprint on port %d (WebSocket)", ntohs(addr.sin_port));
                LOGI("FridaDetect::detectFridaListener SecureAPI::read(fd, res, sizeof(res))", SecureAPI::read(fd, res, sizeof(res)));


           //     sprintf(logMessage,"FridaDetect::detectFridaListener found fingerprint on port %d (WebSocket)", ntohs(addr.sin_port));
            //    this->addlog(logMessage);
                SecureAPI::close(fd);
                return true;
            }
        }

        SecureAPI::close(fd);
    }
    return false;
}

// Generate a random WebSocket key
char* FridaDetect::generateWebSocketKey() {
    static char key[25];
    const char chars[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
    for (int i = 0; i < 22; ++i) {
        key[i] = chars[rand() % (sizeof(chars) - 1)];
    }
    key[22] = '=';
    key[23] = '=';
    key[24] = '\0';
    return key;
}

[aimardcr]

I'm sorry but your fix cannot be applied because the WebSocket key must be same in order for us to get the same response.

[siddheshchandorkar]

I am also facing same issue on Samsung Galaxy A31 always Frida detected. Also facing issues in Release mode. App directly crashing getting below error.

Crashed: Thread: SIGSEGV 0x00fffff400000003
#00 pc 0x2c26c libNativeGuard.so (BuildId: b2c954f56fa0c5175eab20b1b6c84d79cdd99e21)

[siddheshchandorkar]

@aimardcr I have followed steps mentioned in frida setup.
Below method helps me instead of using detectFridaListener().

bool FridaDetect::isFridaRunning() {
LOGI("FridaDetect::isFridaRunning started ");

DIR* dir = opendir("/proc");
if (!dir) return false;

struct dirent* entry;
while ((entry = readdir(dir)) != nullptr) {
    std::string path = std::string("/proc/") + entry->d_name + "/cmdline";
    std::ifstream file(path);
    if (!file.is_open()) continue;

    std::string cmdline;
    getline(file, cmdline);
    if (cmdline.find("frida-server") != std::string::npos ||
        cmdline.find("frida") != std::string::npos ||
        cmdline.find("gum-js") != std::string::npos) {
        closedir(dir);
        LOGI("FridaDetect::isFridaRunning true");

        return true;
    }
}
closedir(dir);
LOGI("FridaDetect::isFridaRunning false");
return false;

}

bool FridaDetect::isFridaLibraryLoaded() {
LOGI("FridaDetect::isFridaLibraryLoaded started ");

std::ifstream maps("/proc/self/maps");
std::string line;
while (std::getline(maps, line)) {
    if (line.find("frida") != std::string::npos) {
        LOGI("FridaDetect::isFridaLibraryLoaded true ");
        return true;
    }
}
LOGI("FridaDetect::isFridaLibraryLoaded false ");
return false;

}

bool FridaDetect::isFridaListening() {
LOGI("FridaDetect::isFridaListening started ");
std::ifstream netstat("/proc/net/tcp");
std::string line;
while (std::getline(netstat, line)) {
if (line.find("00006996") != std::string::npos) { // 27042 in hex
LOGI("FridaDetect::isFridaListening true ");
return true;
}
}
LOGI("FridaDetect::isFridaListening false ");
return false;
}

bool FridaDetect::fileExists(const char* filename) {
LOGI("FridaDetect::isFridaInstalled fileExists started : %s ", filename);

struct stat buffer;
LOGI("FridaDetect::isFridaInstalled fileExists %i : ", (stat(filename, &buffer) == 0));
return (stat(filename, &buffer) == 0);

}

bool FridaDetect::isFridaInstalled() {
LOGI("FridaDetect::isFridaInstalled started ");
LOGI("FridaDetect::isFridaInstalled frida-server path 1 : %b ", fileExists("/data/local/tmp/frida-server"));
LOGI("FridaDetect::isFridaInstalled frida-server path 2 : %b ", fileExists("/data/data/com.termux/frida-server"));
return fileExists("/data/local/tmp/frida-server") ||
fileExists("/data/data/com.termux/frida-server");