Introduction

r2frida is a plugin for radare2 that connects to a Frida server in order to combine static and dynamic analysis bringing the best of both worlds to you!

As long as it is an IO plugin, it's main purpose is to read/write memory from a process and provides extended functionalities via the : command which runs command thru the IO API.

Android & iOS Connection

Retrieve the device id using frida-ls-devices and the name of the app using frida-ps. The package name may be preferable if the display name contains spaces.

If a deviceid is not specified, it will use the default one found by Frida.

Attach

Attach to a running app using the display name.

r2 frida://attach/usb/device-id/processName

To attach to a running app, you can specify the process name or the PID of the target process.

Attach to the Frida Gadget:

r2 frida://attach/usb//Gadget

Spawn

Spawn an app using two // and the package name (Android) or bundle id (iOS). This will NOT resume the application once spawned.

r2 frida://spawn/usb/device-id/bundle-id

Or without entering the device-id:

r2 frida://spawn/usb//bundle-id

Launch

Launch an app using two // and the package name (Android) or bundle id (iOS). This will resume the application once spawned.

r2 frida://launch/usb/device-id/bundle-id

Or without entering the device-id:

r2 frida://launch/usb//bundle-id