Frida server doesn't work in anbox emulator

Anbox Cloud Users
1

Hi,

I prepared an addon to install frida server into my anbox emuator with this architecture:

ANBOX IMAGE: jammy:android12:amd64
ARCHITECTURE: x86_64

I launch a new container and I expose adb (-s +adb) and frida server port(with adb forward command) but some commands works correctly ex.: frida-ps, instead frida command to spawn an application doesn’t work.

this is the command that i run from my host(local):
frida -H 127.0.0.1:27042 --debug -t 5 -f com.whatsapp

this is the command result:
____
/ _ | Frida 16.0.19 - A world-class dynamic instrumentation toolkit
| ( _ | |
> _ | Commands:
/_ / |_| help -> Displays the help system
. . . . object? -> Display information about ‘object’
. . . . exit/quit -> Exit
. . . .
. . . . More info at https://frida.re/docs/home/
. . . .
. . . . Connected to 127.0.0.1:27042 (id=socket@127.0.0.1:27042)
Failed to spawn: unexpectedly timed out while waiting for app to launch

So, I received always timeout error, and i see that target app(whatsapp in this case) starts correctly in anbox emulator.

There aren’t frida error in logcat logs.

Someone help me please?

Bye,
Demis.

2

Hey Dfelici87
I gave it a quick try by following the guide.
Yes, I can reproduce what you found. The frida-ps command works fine from the host.

frida-ps -U
PID  Name
----  ----------------------------------------------------
6965  1List                                               
7080  Gallery                                             
148  adbd                                                
 5  anbox-fs                                            
136  anboxd                                              
621  android.ext.services                                
89  android.hardware.audio@2.0-service                  
90  android.hardware.automotive.audiocontrol@1.0-service
243  android.hardware.biometrics.fingerprint@2.1-service 
91  android.hardware.camera.provider@2.4-service        
98  android.hardware.cas@1.1-service                    
99  android.hardware.configstore@1.1-service            
100  android.hardware.drm@1.0-service                    
101  android.hardware.drm@1.2-service.clearkey

However, when running the frida command to launch an application and hook the process, it ended up with the error message: Failed to spawn: unexpectedly timed out while waiting for the app to launch. The problem appears to be that after the new process is spawned, Frida cannot find the correct PID, as the application runs in a nested container, causing this issue. For example, you probably get the same results when running the following Python script:

frida.get_usb_device().attach("<target_process_name>")

To make the frida command work, you can attach to the PID using -p instead of the target process (-f ). The PID is the one found in the nested Android container. So after the application is launched, you can query the PID with the following command on the AMS node:

amc exec <container_id> -- sh -c "anbox-shell pidof <target_process>"

and attach the pid from your host

frida -U --debug -t 20 -p <target_pid>
     ____
    / _  |   Frida 16.1.4 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to Anbox (id=10.16.146.162:5559)
Attaching...                                                            
Chrome Inspector server listening on port 9229

[Anbox::PID::<pid>]->

Could you give it a try?

BR
Gary

P.S.: you may want to setup the remote access to AMS on your host so that you are able to run the amc command from your host and interact with the AMS service running on the server.

3

Hi, thanks for your answer.
Yes the problem is that Frida cannot rtrieve process id, because I try -F option(attach to frontmost application) of frida server and spawn works correctly.
The spawn timeout problem is only on anbox android 12, while in android 11 and android 10 frida server works correctly.
I try also an android 12 created with android studio and frida server works correctly, so the problem is only on ANBOX android 12

Someone can help me please!

Bye.

4

hey @dfelici87

I try also an android 12 created with android studio and frida server works correctly, so the problem is only on ANBOX android 12

I guess this was never working on older versions of Anbox Cloud, correct?

Either way this sounds like there is a bug and we need to investigate where it comes from. Can you file a bug here? We will then investigate and try to fix in on of our next patch releases.

Thanks!

5

I don’t known if on older version of Anbox Cloud works, because I starting using Anbox Cloud few week ago.

This is the link of bug issue:

Thank you,
Bye,
Demis.

6

Thanks a lot @dfelici87 !