Skip to content

Load Frida bridges for scripts attached with -S / import - #824

Open
tubibibo wants to merge 2 commits into
sensepost:masterfrom
tubibibo:fix/attach-script-bridges
Open

tubibibo wants to merge 2 commits into
sensepost:masterfrom
tubibibo:fix/attach-script-bridges

Conversation

@tubibibo

@tubibibo tubibibo commented Nov 4, 2026 •

Copy link
Copy Markdown

Fixes #808.

Since Frida 17, Java / ObjC / Swift are no longer injected into every script. The host has to answer frida:load-bridge and the script needs the lazy getters frida-tools installs. Scripts loaded through -S / import got neither, so Java was undefined and the resulting ReferenceError was dropped by script_on_message().

Changes

  • prepend the same lazy-bridge prelude frida-tools uses to scripts loaded by attach_script()
  • answer frida:load-bridge from OutputHandlers, reading the bridge bundle from frida-tools' bridges/ directory
  • print type == "error" messages instead of dropping them
  • only install each lazy bridge getter when the global is not already provided, so Frida versions that still define Java / ObjC / Swift are unaffected

Testing

On LDPlayer 14 (Android 14, x86_64), Frida 17.24.1, against an arm64 app, a script doing:

console.log("TYPEOF_JAVA=" + (typeof Java) + " avail=" + Java.available);
Java.perform(() => {
    console.log("MODEL=" + Java.use('android.os.Build').MODEL.value);
});

printed nothing before the change, and TYPEOF_JAVA=object avail=true / the device model after.

pytest tests: 238 passed, 13 failed both before and after the change (pre-existing Windows-specific failures in test_repl.py, test_plugin_manager.py and test_android.py). Added tests/utils/test_agent.py covering the bridge request handling.

Since Frida 17 the Java/ObjC/Swift bridges are no longer injected into every
script, so a bare session.create_script() has no Java global. frida-tools
defines lazy getters and answers frida:load-bridge on the host; objection did
neither, so scripts loaded with -S or import failed with a silent
ReferenceError.

Prepend the same lazy-bridge prelude to scripts loaded through
attach_script(), answer frida:load-bridge from the output handlers, and print
script errors instead of dropping them.
Frida before 17 defines Java, ObjC and Swift itself. Defining getters for
them unconditionally would shadow the built-in objects on those versions,
so skip any global that already exists.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[bug] Objection fails with normal js frida scripts

1 participant