Test emulator host IPs for connectivity too in Android Frida setup

Author: pimterry

src/interceptors/android/adb-commands.ts

@@ -10,6 +10,11 @@ import { streamToBuffer } from '../../util/stream';
 export const ANDROID_TEMP = '/data/local/tmp';
 export const SYSTEM_CA_PATH = '/system/etc/security/cacerts';
 
+export const EMULATOR_HOST_IPS = [
+    '10.0.2.2', // Standard emulator localhost ip
+    '10.0.3.2', // Genymotion localhost ip
+];
+
 export function createAdbClient() {
     const client = adb.createClient({
         port: process.env['ANDROID_ADB_SERVER_PORT']

src/interceptors/android/android-adb-interceptor.ts

@@ -21,7 +21,8 @@ import {
     setChromeFlags,
     startActivity,
     createPersistentReverseTunnel,
-    closeReverseTunnel
+    closeReverseTunnel,
+    EMULATOR_HOST_IPS
 } from './adb-commands';
 import { streamLatestApk, clearAllApks } from './fetch-apk';
 import { parseCert, getCertificateFingerprint, getCertificateSubjectHash } from '../../certificates';
@@ -95,10 +96,7 @@ export class AndroidAdbInterceptor implements Interceptor {
 
         // Build a trigger URL to activate the proxy on the device:
         const setupParams = {
-            addresses: [
-                '10.0.2.2', // Standard emulator localhost ip
-                '10.0.3.2', // Genymotion localhost ip
-            ].concat(
+            addresses: EMULATOR_HOST_IPS.concat(
                 // Every other external network ip
                 getReachableInterfaces().filter(a =>
                     a.family === "IPv4" // Android VPN app supports IPv4 only

src/interceptors/frida/frida-android-integration.ts

@@ -1,7 +1,13 @@
 import { Client as AdbClient, DeviceClient } from '@devicefarmer/adbkit';
 import * as FridaJs from 'frida-js';
 
-import { createPersistentReverseTunnel, getConnectedDevices, getRootCommand, isProbablyRooted } from '../android/adb-commands';
+import {
+    EMULATOR_HOST_IPS,
+    createPersistentReverseTunnel,
+    getConnectedDevices,
+    getRootCommand,
+    isProbablyRooted
+} from '../android/adb-commands';
 import { waitUntil } from '../../util/promise';
 import { buildAndroidFridaScript } from './frida-scripts';
 import {
@@ -186,7 +192,10 @@ export async function interceptAndroidFridaTarget(
         const proxyIp = await testAndSelectProxyAddress(session, proxyPort, {
             // Localhost here is local to the device - it's the reverse tunnel
             // over ADB, which is generally more robust than wifi etc
-            includeLocalhost: true
+            extraAddresses: [
+                '127.0.0.1',
+                ...EMULATOR_HOST_IPS,
+            ]
         });
 
         const interceptionScript = await buildAndroidFridaScript(

src/interceptors/frida/frida-integration.ts

@@ -37,11 +37,14 @@ export const FRIDA_BINARY_NAME = `adirf-server`; // Reversed to mildly inconveni
 export async function testAndSelectProxyAddress(
     session: FridaJs.FridaAgentSession,
     proxyPort: number,
-    options: { includeLocalhost?: boolean } = {}
+    options: { extraAddresses?: string[] } = {}
 ): Promise<string> {
     const interfaceAddresses = getReachableInterfaces();
     const ips = interfaceAddresses.map(a => a.address);
-    if (options.includeLocalhost) ips.push('127.0.0.1');
+
+    if (options.extraAddresses?.length) {
+        ips.push(...options.extraAddresses);
+    }
 
     if (ips.length === 0) throw new ErrorWithCode('unreachable-proxy', "Couldn't detect proxy external IP");