[Frida Util] Consider using valid JSON vs NDJSON

[cpholguera]

The current output uses NDJSON (Newline Delimited JSON) which writes individual JSON objects one after another, without wrapping them in a proper JSON array.

{
  "id": "4e2239c7-9f0d-4174-82f6-929895ee990c",
  ...
}
{
  "id": "907013e5-c9f1-40e0-9a45-c3294e7a2288",
  ...
}

This is fine as it can be consumed by jq (not sure about other tools).

Alternatively, the output could be a valid JSON array containing all result objects:

[
  {
    "id": "4e2239c7-9f0d-4174-82f6-929895ee990c",
    ...
  },
  {
    "id": "907013e5-c9f1-40e0-9a45-c3294e7a2288",
    ...
  }
]

Should we do something like ..?

jq -s '.' output.json > output_fixed.json && mv output_fixed.json output.json

[bernhste]

There is a reason I use NDJSON. The code is based on a tool I use for mobile penetration tests. It is basically a live visualization of security relevant API calls done by the application. The following image shows an older version:

There are more information here, but it is basically a python server which uses frida.re to hook the security-relevant methodes and he visualizes the event in a web application. It is similar to other API monitoring such RMS.

For that to work, we must access each event as soon as it happens. For that reason I chose to send back the event in a single JSON object.

I suggest, that we leave this format for the frida.re code in MAST, as it is easier to use this if we want to build such a tool based on the MAST demo code.

[cpholguera]

That makes total sense, thanks for the clarification @bernhste !