Android: Issue with Frida's device.attach() Method

[zahid-mobisec]

Android: Issue with Frida's device.attach() and device.spawn() Methods

Description:
I have encountered a bug in Frida's device.attach() and device.spawn() methods while attempting to achieve the following goal: being able to attach to an application that is already running, or spawn it if it is not running, and subsequently attach to it. This process should be repeatable.

To implement this functionality, instead of using device.detach() (which in my case cause other errors) when wanting to detach from the app, I used device.resume(pid). However, there is an issue with this approach. Frida internally maintains a hash map of (pid, process), which is checked by the device.resume() method. This hash map is updated with the pid when we call device.spawn(), but not when we call device.attach() (my assumption). Consequently, when we call device.resume(pid) after using device.attach(), it throws an error...

self._impl.resume(self._pid_of(target)) frida.InvalidArgumentError: invalid PID

Steps to Reproduce:

1. Call device.attach() to attach to a running application.
2. Attempt to detach using device.resume(pid).

Expected Result:
The application should attach and resume successfully, and no errors should occur.

Actual Result:
An error is thrown, indicating that the pid is not found

Impact:
This bug affects the ability to seamlessly attach and detach from applications using Frida's device.attach() and device.spawn() methods, especially in scenarios where it is essential to attach to an already running application again and again.

Additional Information:

• Frida Version: [16.1.1]
• Operating System: [Description: Ubuntu 22.04.3 LTS]

from time import sleep
import frida
import sys


target_package = "com.android.chrome"

# Create a Frida device instance for the Android device
device = frida.get_usb_device()
apps = device.enumerate_applications()

def attach_check(pkg):
    process = device.get_process(pkg)
    pid = process.pid
    print(f"1 Attaching to process {pkg} with PID {pid}")
    session = device.attach(pid)
    print(f"1 Attached to process {pkg} successfully")
    device.resume(pid)
    print(f"1 Resumed process {pkg} successfully")

    sleep(2)

   # [CRASH HAPPENS HERE]

    process = device.get_process(pkg)
    pid = process.pid
    print(f"2 Attaching to process {pkg} again")
    device.attach(pid)
    print(f"2 Attached to process {pkg} successfully")
    session = device.attach(pid)
    print(f"2 Attached to process {pkg} successfully")
    device.resume(pid)
    print(f"2 Resumed process {pkg} successfully")



def spawn_check(pkg):
    print(f"0 Spawning process {pkg}")
    pid = device.spawn([pkg])
    session = device.attach(pid)
    print(f"1 Attached to process {pkg} successfully")
    device.resume(pid)
    print(f"1 Resumed process {pkg} successfully")

    sleep(2)
    
    print(f"0 Spawning process {pkg}")
    pid = device.spawn([pkg])
    session = device.attach(pid)
    print(f"2 Attached to process {pkg} successfully")
    device.resume(pid)
    print(f"2 Resumed process {pkg} successfully")


print(f"Spawn check: {target_package}")
pid = spawn_check(target_package)

print("Killing process")
device.kill(pid)
sleep(3)
print("=====================================")

print(f"Attach check: {target_package}")
attach_check(target_package)

[zahid-mobisec]

further information:
adb shell ps retuns pid for apps which are not running and not shown in running apps list