Hacking

So you want to dig a little deeper into the project and its source code. Maybe to test out some changes, or better yet, for a pull request! This article aims to give you a birds eye view on the project structure, and some tips on how to get a development environment up and running.

birds eye view

At its core, objection relies heavily on Frida to perform most of the magic. Frida, together with some purpose built hooks and the python REPL is what makes up objection.

A command is entered into the objection REPL, running a python method which may or may not expect arguments. Depending on the python method invoked, a call using the Frida RPC to the injected agent will be made.

project structure

Let's take a quick look at the project structure.

external libraries

Command line argument parsing is handled with click, the REPL is handled by python-prompt-toolkit and the agent is written in TypeScript and compiled to ES5 compatible JavaScript. If you add the -d flag to the explore command, extra debugging information would be printed to the screen during normal operation.

code locations

• Python methods to invoke when matched to a command lives in objection/commands.
• The Frida agent performing the instrumentation magic lives in objection/agent.
• Classes and methods responsible for the command line interface, as well as the REPL live in objection/console.

REPL command flow

When a command is entered in the objection explore REPL, the run_command() method is run to process the string input received from prompt_toolkit. The run_command() method 'explodes' the received command, honoring quotes just like a shell would, and tries to find a python method to execute with _find_command_exec_method .

Commands that can be run is defined in a repository located in the COMMANDS variable in repository.py, specifying an exec key with a value being the python method to execute. Any remaining tokens will be passed on to the python method that will get called as arguments.

Communications with a remote FridaGadget is handled in utils/frida-transport.py.

Depending on the type of Frida hook that will be run (based on an entered command), either a synchronous invocation will occur, which will load, execute and unload the hook, or an asynchronous invocation will occur which loads, executes and backgrounds the hook. Only when the jobs kill <job_id> command is run will an asynchronous invocation be stopped.