Package: madgadget
madgadgetA CLI tool to quickly pull and patch (Android) multiarch packages.As of today, madgadget only supports Android (target) and Linux (host). If anyone desires to extend its functionality to other OS-es, feel free to open a MR!Heavily work in progress.Usage$ madgadget -h
usage: madgadget [-h] [--version] {pull,inject} ...

Embed frida gadgets into android multiarch applications

positional arguments:
  {pull,inject}  Desired action
    pull         Pull a (split) package from a connected device
    inject       Inject frida-gadget inside a locally-stored package

options:
  -h, --help     show this help message and exit
  --version      show program's version number and exit

Author: Jacopo (antipatico) Scannella$ madgadget pull -h
usage: madgadget pull [-h] [-o OUTPUT] package_name

positional arguments:
  package_name          The name of the package you want to pull (E.G. com.android.settings)

options:
  -h, --help            show this help message and exit
  -o OUTPUT, --output OUTPUT
                        Output directory path$ madgadget inject -h
usage: madgadget inject [-h] [-o OUTPUT] [-A] apk script

positional arguments:
  apk                   Android apk you want to inject frida gadget to
  script                Frida script you want to inject, javascript only

options:
  -h, --help            show this help message and exit
  -o OUTPUT, --output OUTPUT
                        Output file
  -A, --apktool         Use Apktool instead of APKEditor (Default: False)Pulling split apks from connected deviceConnect the device and be sure to have a functional adb connection (you can check ifadb shellworks)Pull all apks of target app with:madgadgetpullcom.targetInjecting frida gadget + script in target apkOnce you pulled your target, you can inject a script with the following:madgagetinjectcom.target.apktest_script.jsNOTE: as of today only lief binary injection method is supported, meaning that you have to select a binary having at least one native library.NOTE: with the injection method used today, you have no guarantee you are going to run 'early' enough in your target application.NOTE: if you are trying to patch a multi-arch apk, you can either target an apk having multiple arch under thelib/folder or an architecture-specific apk splitconfig.InstallationRequirementsAPKEditor(default) orApktoolzipalign(optional, if using Apktool)As of today,madgadgetusesAPKEditorbehind the scenes. Please download it and put somewhere.Then, add the followingapkeditorscript in yourPATH(remember tochmod +x):#!/usr/bin/env bashset-eujarpath="/PATH/TO/YOUR/APKEditor.jar"javaoptions='-Dfile.encoding=utf-8'java"${javaoptions}"-jar"${jarpath}""$@"As an alternative, you can decide to useApktool. Provide a similarapktoolscript in yourPATHto the one described above for APKEditor.
In the future, I plan to use Jython to overcome this usability issue.Install from PyPipython3-mpipinstallmadgadgetInstallation from sourcepython3-mpipinstallflit
python3-mflitinstallTODOsembed jar and move to Jythonadd merge functionalityadd functionality to embed frida gadget without script and custom configurationadd functionality to specify frida gadget versionallow different injection methods (now we are based on lief + so patching, but it would be cool to support smali patching too)allow to specify lief targetchange strategy to select so target by building dagAuthorJacopo antipatico ScannellaDisclaimerThis tool is heavily inspired byobjection, which in turns usesFrida. If you want to make donations, donate to those amazing projects.If I have seen further, it is by standing on the shoulders of giants - Isaac Newton.