apk.sh [SUBCOMMAND] [APK FILE|APK DIR|PKG NAME] [FLAGS] 


apk.sh pull [PKG NAME] [FLAGS] 
apk.sh decode [APK FILE] [FLAGS] 
apk.sh build [APK DIR] [FLAGS] 
apk.sh patch [APK FILE] [FLAGS] 
apk.sh rename [APK FILE] [PKG NAME] [FLAGS]

adb push noscript.js /data/local/tmp

./apk.sh patch <apk_name> --arch arm --gadget-conf <config.json>

adb install file.gadget.apk

java -jar APKEditor.jar -h

java -jar APKEditor.jar m -i AppName.apks

توجه: نصب بودن ابزار frida-tools و انتقال فایل فریدا سرور به دایرکتوری زیر الزامی میباشد
/data/local/tmp
پس از انتقال فایل دسترسی 777 داده و ران کنید.

frida-trace -R -J 'path/to/class!methodName' ProcessName

frida-trace -R -J 'path/to/class!methodName' -f com.package.name

frida-trace -R -j 'path/to/class!methodName' -p pid

frida-trace -R -I 'libname.so' -i 'MethodName' -f com.package.name

frida-trace -R -I 'libname.so' -i 'MethodName' ProcessName

frida-trace -R -I 'libname.so' -i 'MethodName' -p pid

* Retrieve of DLL and PE from a remote server
* Manual Mapping on a remote process
* Position independent code
* Use of indirect Syscalls
- ZwAllocateVirtualMemory
- ZwProtectVirtualMemory
- ZwQuerySystemInformation
- ZwFreeVirtualMemory
- ZwCreateThreadEx
* Single stub for all Syscalls
- Dynamic SSN retrieve
- Dynamic Syscall address resolution
* Atlas also uses
- LdrLoadDll
- NtWriteVirtualMemory
* Custom implementations of
- GetProcAddress
- GetModuleHandle
* API hashing
* Cleanup on error
* Variable EntryPoint

Reformatted Structure
Polymorphic Code Integration
SysWhispers 3 Integration
AES Encryption
Early Bird Injection
Module Stomping

‏1. Anti Debugging: ‏Disables specific anti-debugging mechanisms to facilitate debugging in certain scenarios.

‏2. BSoD (Blue Screen of Death): ‏Prevents or mitigates potential causes leading to system crashes or blue screen errors

‏3. BlockInput:‏Controls the system's input-blocking functionality to manage or bypass certain input restrictions.

‏4. FindWindow:‏Modifies the behavior of the FindWindow API function for specific use cases

‏General information
‏Accountand group information
‏Network
‏Process Information
‏OS Build and HOTFIXE
‏Persistence
‏HARDWARE Information
‏ Encryption information
‏FIREWALL INFORMATION‏
‏Services
‏History
‏SMB Queries
‏Remoting queries
‏REGISTRY Analysis
‏LOG queries
‏Instllation of Software
‏User activity
بعلاوه، با استفاده از کوئری‌های پیشرفته، موارد زیر نیز قابل بررسی هستند:
‏ Prefetch file information
‏DLL List
‏WMI filters and consumers

‏Edge coverage guided
‏Snapshotting (fully deterministic)
‏Parallel fuzzing (across cores, machines soon)
‏Easy to add to existing SIMICS projects
‏Triage mode to reproduce and debug crashes
‏Modern fuzzing methodologies:
‏ Redqueen/I2S taint-based mutation
‏MOpt & Auto-token mutations
‏TSFFS is focused on several primary use cases:
‏UEFI and BIOS code, particulary based on EDKII
‏Pre- and early-silicon firmware and device drivers
‏Hardware-dependent kernel and firmware code
‏Fuzzing for complex error conditions
‏However, TSFFS is also capable of fuzzing:
‏Kernel & kernel drivers
‏User-space applications
‏Network applications