magisk-frida

Overview

Maintained by ViRb3, Magisk-Frida is the premier module for security researchers, penetration testers, and reverse engineers who utilize the Frida dynamic instrumentation toolkit on Android.

Ordinarily, running frida-server on Android requires manually pushing the binary to /data/local/tmp/, setting execute permissions, and running it inside an interactive ADB shell that dies as soon as the terminal is closed. Magisk-Frida integrates frida-server into Android’s systemless boot sequence, launching it as a supervised background daemon whenever your device powers on.

Technical Architecture & How It Works

Supervised Daemon Architecture

1. Architecture Detection: During module installation, Magisk-Frida probes ro.product.cpu.abi and selects the matching upstream frida-server binary for your hardware architecture.
2. Boot Service Initialization: During the service.sh late-boot phase, the module starts frida-server using a detached daemon process:

   /data/adb/modules/magisk-frida/frida-server -D

3. SELinux Domain Assignment: Sets appropriate SELinux context (u:r:magisk:s0) so frida-server can attach to target processes, inject companion .so libraries, and read memory mappings without triggering kernel security violations.

Installation & Quickstart

Step 1: Install the Module

1. Download Magisk-Frida-vX.zip.
2. Flash it in Magisk, KernelSU, or APatch and reboot.

Step 2: Test from your Workstation

1. Install Frida tools on your computer:

   pip install frida-tools

2. Connect your phone via USB with ADB enabled.
3. Verify connection:

   frida-ps -U

4. Hook an app:

   frida -U -f com.example.targetapp -l hook.js