Package: binder-trace
Binder TraceBinder Trace is a tool for intercepting and parsing Android Binder messages. Think of it as "Wireshark for Binder".Requirementspython version >= 3.9⚙️ InstallationYou'll need a rooted Android device or emulator.(Linux only) - install xclip or xsel for "copy to clipboard" functionalitysudo apt-get install xclipsudo apt-get install xselInstall from PyPipip install binder-traceCheck which version of frida is installed (make sure you've pip installed the requirements)pip list | grep fridaDownload the matching version of frida-server from thefrida releases pageMake sure adb is running as root, push frida-server to your device and run itadb rootadb push frida-server /data/local/tmpadb shellchmod u+x /data/local/tmp/frida-serveradb shell /data/local/tmp/frida-serverArgumentsArgumentDescription-hPrints the argument help.-d DEVICEThe device to attach to e.g. "emulator-5554". Useadb devicesto list available devices. If not provided defaults to the USB device.-p PIDThe pid of the process on DEVICE to attach to.-n NAMEThe name of the process on DEVICE to attach to e.g. "Messaging".-a [9, 10, 11, 13]The version of android to load structures for.-s STRUCTPATHThe path to the directory of structure files.-c CONFIGThe path to the config file to filter.▶️ Starting binder traceTo start binder trace we need to pick a device and process to attach to.
In the following example we useadbandfrida-psto identify a process to attach to on a local emulator. As it's an Android 11 emulator we choose the Android 11 structs directory. Pick the struct directory that most closely matches your version of Android. If you would like structures for a different version of Android, please let us know. Once it's running start using the target app to generate some binder transactions.> adb devices
List of devices attached
emulator-5554   device

> frida-ps -Ua
 PID  Name           Identifier
----  -------------  ----------------------------
8334  Messaging      com.android.messaging
7941  Phone          com.android.dialer
9607  Settings       com.android.settings

> cd binder_trace
> binder-trace -d emulator-5554 -n Messaging -a 11⌨️ Controls🌐 GlobalKeyActionupMove updownMove downshift + upPage upshift + downPage downhomeGo to topendGo to bottomtabNext paneshift + tabPrevious panectrl + cCopy pane to clipboardspacePause/Unpause transaction recordingcClearhOpen helprReload config fileqQuit📈 Frequency paneKeyActionpToggle order asc/descwJump to next interfacesJump to previous interfaceaToggle all filters onnToggle all filters offenterToggle Filter🔎 Config FileTo filter define any or all of the interface, method, type and inclusive options. To not use an option leave it blank""Without -c argument> binder-trace -d emulator-5554 -n Contacts -a 13With -c argumentconfig.json{"filters":[{"interface":"android.gui.IDisplayEventConnection","method":"requestNextVsync","type":"","inclusive":false},{"interface":"android.content.IContentProvider","method":"","type":"call","inclusive":false}]}> binder-trace -d emulator-5554 -n Contacts -a 13 -c .\binder_trace\binder_trace\config.jsonandroid.gui.IDisplayEventConnection->requestNextVsync->""andandroid.content.IContentProvider->""->callhave been filtered out