MBX-02 & MBX-08 — App Interception Toolkit

This document provides the complete working setup for test cases MBX-02 (UE to carrier apps) and MBX-08 (UE to app data path) using Frida + Burp Suite on Pixel 9.

Quick Start

If you already have a rooted Pixel 9 with frida-server running and Burp Suite configured, jump to One-Line Launch.

Prerequisites Checklist

• Pixel 9 (or compatible Android device) with USB debugging enabled
• ADB installed and configured on laptop
• Frida tools installed: pip install frida-tools
• Burp Suite Community Edition running on laptop (port 8080)
• Burp CA certificate exported as .der file
• Device has Magisk root (confirmed: adb shell su -c id)
• frida-interception-and-unpinning repo cloned: git clone https://github.com/httptoolkit/frida-interception-and-unpinning ~/frida-interception-and-unpinning

See Support_Hardware_Pixel9.md Section 4.3 for full setup instructions.

Device State Verification

Before starting interception, confirm your device is in the correct state:

# 1. Device sees ADB
adb devices
# Output: 47141FDAQ000YG device

# 2. Magisk root is available
adb shell su -c id
# Output: uid=0(root) gid=0(root) groups=0(root)

# 3. Frida-server is on device
adb shell ls -la /data/local/tmp/frida-server
# Output: -rwxr-xr-x frida-server (or similar)

# 4. Burp is running locally
curl -s http://127.0.0.1:8080 > /dev/null && echo "✓ Burp listening" || echo "✗ Burp NOT listening"

# 5. Reverse tunnel is set up
adb reverse tcp:8080 tcp:8080

Setup Workflow

Phase 1: Frida Server Startup (Device)

# Terminal 1: Start frida-server on device (persistent in background)
adb shell su -c "/data/local/tmp/frida-server &"

# Verify it's running
sleep 2
adb shell ps aux | grep frida-server
# Output should show: /data/local/tmp/frida-server

Phase 2: ADB Reverse Tunnel (Laptop)

# Terminal 2: Set up tunnel so device can reach laptop's Burp
adb reverse tcp:8080 tcp:8080

# Verify tunnel
adb reverse --list
# Output: 127.0.0.1:8080 tcp:8080

Phase 3: Frida Launcher (Laptop)

# Terminal 3: Use intercept.sh to launch interception
# Copy intercept.sh to your home directory:
cp utilities/intercept.sh ~/intercept.sh
chmod +x ~/intercept.sh

# Or launch manually:
frida -U \
    -l ~/frida-interception-and-unpinning/config.js \
    -l ~/frida-interception-and-unpinning/native-connect-hook.js \
    -l ~/frida-interception-and-unpinning/android/android-proxy-override.js \
    -l ~/frida-interception-and-unpinning/android/android-system-certificate-injection.js \
    -l ~/frida-interception-and-unpinning/android/android-certificate-unpinning.js \
    -l ~/frida-interception-and-unpinning/android/android-certificate-unpinning-fallback.js \
    -l ~/frida-interception-and-unpinning/android/android-disable-root-detection.js \
    -f com.att.personalcloud

One-Line Launch

Once the setup is complete, you can resume a session with:

# Kill any stale frida-server
adb shell pkill frida-server 2>/dev/null

# Start fresh
adb shell su -c "/data/local/tmp/frida-server &" && \
adb reverse tcp:8080 tcp:8080 && \
sleep 1 && \
~/intercept.sh com.att.personalcloud

Or wrap it in a function:

# Add to ~/.bashrc or ~/.zshrc
intercept_app() {
  local pkg="${1:-com.att.personalcloud}"
  adb shell pkill frida-server 2>/dev/null
  adb shell su -c "/data/local/tmp/frida-server &" && \
  adb reverse tcp:8080 tcp:8080 && \
  sleep 1 && \
  ~/intercept.sh "$pkg"
}

# Usage:
intercept_app com.gmail.android

Interception Script Files

intercept.sh

Location: ./utilities/intercept.sh

Purpose: Automate Frida launcher with all unpinning modules

Dependencies:

• $SCRIPTS — path to frida-interception-and-unpinning repo (default: ~/frida-interception-and-unpinning)
• $PACKAGE — target app package (arg 1, default: com.att.personalcloud)

Modules loaded:

1. config.js — proxy + cert config
2. native-connect-hook.js — native code interception
3. android-proxy-override.js — force all traffic through Burp
4. android-system-certificate-injection.js — inject system cert
5. android-certificate-unpinning.js — SSL pinning bypass
6. android-certificate-unpinning-fallback.js — fallback pinning bypass
7. android-disable-root-detection.js — hide Magisk from app

Usage:

~/intercept.sh com.gmail.android
~/intercept.sh com.uber

config.js

Place in ~/frida-interception-and-unpinning/config.js:

var CONFIG = {
  PROXY_ENABLED: true,
  PROXY_HOST: "127.0.0.1",
  PROXY_PORT: 8080,
  CA_CERT_PATH: "/system/etc/security/cacerts/9a5ba575.0",
  CA_CERT_FALLBACK: "/apex/com.android.conscrypt/cacerts/9a5ba575.0"
};

if (typeof module !== 'undefined' && module.exports) {
  module.exports = CONFIG;
}

Key fields:

• PROXY_HOST/PORT — Burp listener (laptop)
• CA_CERT_PATH — Burp CA cert hash (must match your export)

Burp Suite Configuration

Export CA Certificate

1. Open Burp Suite → Proxy → Settings → CA Certificate
2. Click Export → DER format → save as ~/cacert.der
3. Convert to PEM:

   openssl x509 -inform DER -in ~/cacert.der -out ~/cacert.pem
   

4. Get cert hash:

   openssl x509 -inform PEM -subject_hash_old -in ~/cacert.pem | head -1
   # Output: 9a5ba575
   

5. Update config.js with correct hash (if different from 9a5ba575)

Verify Proxy Listener

1. Proxy → Settings → Proxy listeners
2. Confirm: 127.0.0.1:8080 is listening
3. When app launches via Frida, traffic should appear in Proxy → HTTP history

Test Case Integration

MBX-02: UE to Carrier Apps

Objective: Identify externally visible carrier-app risk at the application layer.

Evidence collection:

1. Launch target app with intercept.sh
2. Perform workflows: login, billing, device-management, support
3. Capture screenshots and evidence:
   • Certificate validation failures (in Burp)
   • Weak headers (missing HSTS, security headers)
   • Token/credential handling
   • Telemetry volume and destinations
   • Exported components (run adb shell dumpsys package com.att.personalcloud)

Expected findings:

• Inventory of API endpoints
• Pinning status (unpinned vs. unpinned with Frida)
• Telemetry destinations
• Excessive permissions in manifest

Evidence template:

MBX-08: UE to App Data Path

Objective: Validate application-layer data-path trust from the handset outward.

Evidence collection:

1. Capture HTTP/HTTPS traffic for each app
2. Separate pinned vs. non-pinned workflows
3. Record certificate validation behavior
4. Note device identifiers and sensitive data exposure

Pinning status check:

# Which apps have pinned certificates?
# Use Frida unpinning status:
# If app connects AFTER Frida injects unpinning scripts → pinned ✓
# If app refuses connection even with scripts → strong pinning ✗
# If app connects without Frida → non-pinned ✓

# Android network_security_config check:
adb shell run-as com.att.personalcloud cat /data/data/com.att.personalcloud/files/.../network_security_config.xml 2>/dev/null
# Or decompile APK with jadx and search for <domain-config>

Expected findings:

• Non-pinned endpoints (interceptable)
• Pinned endpoints (requires Frida or system cert injection)
• Sensitive data leakage (IMEIs, session tokens, location)
• Weak TLS versions (if any)
• Unencrypted HTTP usage (if any)

Evidence template:

Troubleshooting

Data Collection

Burp Suite Export

After interception, export evidence:

# 1. In Burp: Dashboard → Export captured items
# 2. Export as: "all requests and responses"
# 3. Format: XML or CSV

# 2. Or: Proxy → HTTP history → select → right-click → Copy all → save to file

Frida Console Logs

Frida prints to console during injection. Save:

# Redirect frida output to log:
~/intercept.sh com.att.personalcloud 2>&1 | tee ~/frida-intercept-$(date +%s).log

# Later: review frida-intercept-*.log for injection status and errors

ADB Logs

Capture device logcat during interception:

# Terminal 4: Capture device logs
adb logcat -v threadtime > ~/device-logcat-$(date +%s).log

# Filter for target app:
adb logcat --pid=$(adb shell pidof com.att.personalcloud) -v threadtime

Screenshots

Document UI state before/after interception:

adb shell screencap -p /sdcard/screenshot-$(date +%s).png
adb pull /sdcard/screenshot-*.png ~/screenshots/

Evidence Storage

Recommended directory structure:

~/mobility-research/
├── mbx-02-carrier-apps/
│   ├── 2026-05-11_att-app_burp-export.xml
│   ├── 2026-05-11_att-app_frida.log
│   ├── 2026-05-11_att-app_logcat.log
│   ├── 2026-05-11_att-app_screenshots/
│   │   ├── login-flow-01.png
│   │   ├── permissions-dialog.png
│   │   └── success-screen.png
│   └── 2026-05-11_mbx-02_findings.md
└── mbx-08-data-path/
    ├── 2026-05-11_endpoint-matrix.xlsx
    ├── 2026-05-11_pinning-status.csv
    └── 2026-05-11_sensitive-data-exposure.md

Next Steps

• MBX-01 — UE baseline (prerequisites for MBX-02/08)
• MBX-02 — Carrier apps (use this toolkit)
• MBX-08 — App data path (use this toolkit)
• MBX-09-11 — Core network baselines (Open5GS lab, no app toolkit needed)
• MBX-12-15 — LibreSDR RF testing (requires Faraday enclosure)

References

• Support_Hardware_Pixel9.md — Device setup details
• Master_Blackbox_UE_to_Node_Test_Plan.md — Full test plan context
• Frida Interception & Unpinning — Script repo
• Burp Suite Community Edition

Document Version: 1.0
Last Updated: 2026-05-11
Status: Active — Ready for MBX-02 & MBX-08 execution

Appendix A: APK Decompilation & Static Analysis

apktool — Extract APK Structure

apktool d target-app.apk
cd target-app/
ls -la

Output directory structure:

Extract and Analyze Certificate Pinning

# 1. Search for cert references in smali
grep -r "certificate" smali/ | grep -i "pin\|trust\|check"

# 2. Check for embedded certs in res/raw
ls -la res/raw/ | grep -i cert

# 3. Find network security config
find . -name "network_security_config.xml"
cat res/xml/network_security_config.xml 2>/dev/null

# 4. Decompile to Java with jadx for readability
jadx -d out target-app.apk
grep -r "CertificatePinner\|SSLContext\|TrustManager" out/sources/ 2>/dev/null

Identify Pinning Mechanisms

Appendix B: APK Certificate Pinning Bypass — Recompile Method

When to Use Static Bypass

• App embeds certificate in res/raw/
• Legacy app with weak pinning
• Quick POC without Frida complexity
• CTF/intentionally vulnerable app

Step-by-Step Workflow

Step 1: Extract APK

apktool d target-app.apk
cd target-app/res/raw
ls

Step 2: Replace Embedded Certificate

# Identify cert file (usually certificate.der, ca.crt, etc.)
# Replace with Burp CA cert
cp ~/cacert.der certificate.der

Step 3: Recompile APK

cd ../..
export PATH=$PATH:/usr/bin/aapt
apktool b target-app target-app-modified.apk --aapt /usr/bin/aapt

Step 4: Sign APK

Option A — Uber APK Signer (recommended):

java -jar uber-apk-signer.jar --apks target-app-modified.apk
# Output: target-app-modified-aligned-debugSigned.apk

Option B — Manual signing:

jarsigner -verbose -sigalg SHA256withRSA -digestalg SHA-256 \
  -keystore ~/.android/debug.keystore \
  -storepass android \
  -keypass android \
  target-app-modified.apk androiddebugkey

Step 5: Install on Device

adb install -r target-app-modified-signed.apk

Limitations

• ❌ Does NOT work against runtime pinning (OkHttp, custom TrustManager)
• ❌ Does NOT work if app uses code obfuscation or anti-tampering
• ❌ Does NOT work if APK signature check fails
• ✅ Works for static embedded certs only

When to Fall Back to Frida

• App has runtime pinning (OkHttp, custom TrustManager)
• Static bypass fails or app detects tampering
• Need to preserve original app binary
• Testing requires APK installation time < static approach

Appendix C: Mobile Security Frameworks

MobSF — Mobile Security Framework

GitHub: https://github.com/MobSF/Mobile-Security-Framework-MobSF

Docker Quick Start:

docker pull opensecurity/mobile-security-framework-mobsf:latest
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

# Default credentials: mobsf / mobsf

Features:

• APK decompilation and bytecode analysis
• Permission audit (dangerous permissions)
• Hardcoded secrets scanning (API keys, tokens)
• YARA-based malware detection
• Certificate and signing analysis
• Manifest inspection

Workflow:

1. Upload APK to web interface (http://localhost:8000)
2. MobSF decompiles and analyzes automatically
3. Review: Permissions, Strings, Certificate, Smali code
4. Export report

Uber APK Signer

GitHub: https://github.com/patrickfav/uber-apk-signer

Usage:

java -jar uber-apk-signer.jar --apks modified.apk
# Outputs: modified-aligned-debugSigned.apk (ready to install)

Advantages:

• No keystore manipulation required
• Handles APK alignment automatically
• Works with any APK (modified or original)

Appendix D: Pixel 9 Hardware Reality

Device Specifications

Frida Compatibility

• ✅ Frida 17.9.8+ fully supported
• ✅ User-mode instrumentation works on all Android processes
• ✅ Kernel-mode/modem instrumentation NOT available (Tensor G4 limitation)
• ✅ Rooted access enables system cert injection (Magisk)

Notes for Researchers

Important: Pixel 9 uses Tensor G4 + Samsung Exynos Modem, NOT Snapdragon + Qualcomm.
This means:

• SCAT support is limited
• QXDM/QPST tools are incompatible
• RF/modem research requires different toolchain
• App-level testing (Frida/Burp) works normally

Appendix E: ADB Command Reference

Device Management

# List connected devices
adb devices -l

# Enable USB debugging (must do once on device)
adb usb

# Get device properties
adb shell getprop ro.build.version.release       # Android version
adb shell getprop ro.hardware                    # Hardware codename
adb shell getprop ro.board.platform              # Board platform

Proxy & Network

# Set global HTTP proxy
adb shell settings put global http_proxy 127.0.0.1:8080

# Clear HTTP proxy
adb shell settings put global http_proxy :0

# Reverse tunnel (phone:8080 → laptop:8080)
adb reverse tcp:8080 tcp:8080

# List active tunnels
adb reverse --list

# Kill specific tunnel
adb reverse --remove tcp:8080

Process Management

# Force-stop app
adb shell am force-stop com.example.app

# Start app with Frida
frida -U -f com.example.app

# Check if process running
adb shell ps aux | grep com.example.app

# Get PID
adb shell pidof com.example.app

Root Operations

# Verify Magisk root
adb shell su -c id              # Output: uid=0(root)

# Run frida-server as root
adb shell su -c "/data/local/tmp/frida-server &"

# Kill frida-server
adb shell pkill frida-server

# Check Magisk
adb shell su -c "magisk -v"

File Transfer

# Push file to device
adb push ~/cacert.der /sdcard/cacert.der

# Pull file from device
adb pull /system/etc/security/cacerts/9a5ba575.0 ~/9a5ba575.0

# Push and execute
adb push script.sh /data/local/tmp/
adb shell su -c "chmod +x /data/local/tmp/script.sh && /data/local/tmp/script.sh"

Certificate Management

# List system certs
adb shell ls /system/etc/security/cacerts/

# Pull Burp CA cert from device
adb pull /system/etc/security/cacerts/9a5ba575.0 ~/9a5ba575.0

# Check cert hash on device
adb shell openssl x509 -inform PEM -subject_hash_old -in /system/etc/security/cacerts/9a5ba575.0 | head -1

Logging

# Real-time logcat
adb logcat -v threadtime

# Filter by app
adb logcat --pid=$(adb shell pidof com.example.app)

# Save logcat to file
adb logcat -v threadtime > ~/device.log

# Clear logcat
adb logcat -c

Appendix F: Troubleshooting Matrix

Session Origin: bd9dfeb3-818d-4c28-90b6-fe3951163d56
Created: 2026-05-11
Maintainer: tester
Last Updated: 2026-05-11 18:30