| name | performing-dynamic-analysis-of-android-app |
| description | Performs runtime dynamic analysis of Android applications using Frida, Objection, and Android Debug Bridge to observe application behavior during execution, intercept function calls, modify runtime values, and identify vulnerabilities that static analysis misses. Use when testing Android apps for runtime security flaws, hooking sensitive methods, bypassing client-side protections, or analyzing obfuscated applications. Activates for requests involving Android dynamic analysis, runtime hooking, Frida Android instrumentation, or live app behavior analysis.
|
| domain | cybersecurity |
| subdomain | mobile-security |
| author | mahipal |
| tags | ["mobile-security","android","frida","dynamic-analysis","owasp-mobile","penetration-testing"] |
| version | 1.0.0 |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"] |
Performing Dynamic Analysis of Android App
When to Use
Use this skill when:
- Static analysis results need runtime validation on an actual Android device
- The target app uses obfuscation (DexGuard, custom packers) that prevents effective static analysis
- Testing requires observing actual API calls, decrypted data, or runtime-generated values
- Assessing root detection, tamper detection, or anti-debugging implementations
Do not use this skill on production environments without authorization -- dynamic instrumentation can alter app behavior and trigger security alerts.
Most Often Missed & How to Confirm
- Frida/host version mismatch — silent connection failures look like a "clean" app. Confirm
frida-ps -U lists processes and the device server matches the frida-tools version.
- Anti-Frida detection — the app suppresses behavior or exits. Confirm via
/proc/self/maps scans or port checks, then use Gadget injection / a renamed server.
- Obfuscated class names — hooking
a.b.c fails. Confirm real names via android hooking search classes after the app fully initializes.
- Multi-DEX late loading — target classes aren't loaded at startup. Confirm with
Java.enumerateLoadedClasses() post-login before concluding absence.
- Crypto keys in memory — confirm by hooking
javax.crypto.Cipher/MessageDigest and dumping the key/IV during an operation.
- Root-check bypass not verified — after the RootBeer/file-check hook, confirm the app proceeds rather than just logging the bypass.
Prerequisites
- Rooted Android device or emulator (Genymotion, Android Studio AVD with writable system)
- Frida server installed on device matching the architecture (arm64, x86_64)
- Python 3.10+ with
frida-tools and objection packages
- ADB configured and device connected
- Target APK installed on device
Workflow
Step 1: Setup Frida Server on Android Device
adb shell getprop ro.product.cpu.abi
adb push frida-server-16.x.x-android-arm64 /data/local/tmp/frida-server
adb shell 755 /data/local/tmp/frida-server
adb shell /data/local/tmp/frida-server &
frida-ps -U