Mobile Instrumentation

Traffic Jam drives a connected Android device from the Mobile view: it spawns or attaches to an app under Frida with an SSL-unpinning or signature-trace script, routes the app’s traffic through a local mitmproxy TLS proxy, and captures the decrypted packets with tshark on the loopback interface. When you stop the session, the capture is imported into the workspace like any pcapng file. Use this only against apps and systems you are authorized to test.

How a session works

Starting a capture launches three managed processes and reconfigures the device:

1. tshark captures on a loopback interface (lo0/lo) with a BPF filter, writing a .pcapng.
2. mitmdump listens on 127.0.0.1:8081 and writes TLS session keys to a .sslkeylog file (SSLKEYLOGFILE / MITMPROXY_SSLKEYLOGFILE). If a client certificate is configured, it is passed via --set client_certs=.
3. frida injects the selected script into the target app.
4. adb points the device’s global http_proxy setting at the proxy and sets up adb reverse; the original proxy value is restored when the session stops.

The backend requires adb, frida, mitmdump, and tshark on PATH; it looks each up before starting and reports any that are missing.

Prerequisites

The Capture tab shows a readiness strip with a badge per prerequisite (ready / checking / missing):

The device must run frida-server; the app probes its version over adb shell with su, which assumes a rooted device. If the frida-server major version does not match the host frida major version, the app shows a warning — the two must match, so update or restart frida-server on the device and refresh.

Start a capture

Open the Mobile view → Capture tab, then:

1. Pick a Device (Auto USB uses frida -U; a specific device uses -D <id>).
2. Set the Package or process target (e.g. com.example.app). The Android apps list is populated from frida-ps; click a row to fill the target in spawn mode, or use Scan to refresh and the search box to filter.
3. Choose a Frida script (see below).
4. Click Start capture.

Advanced exposes the rest: capture name, Mode (Spawn package → frida -f <pkg> --no-pause, or Attach process → frida -n <name>), capture interface, Proxy port (default 8081), Save to collection (default Mobile captures), the BPF filter (default tcp port 8081, kept in sync with the port), and the SSL unpinning checkbox that gates script injection entirely.

While running, the right column shows live metrics (elapsed time, Frida/proxy state, PCAP and keylog sizes, mTLS and Android-proxy state) and a Process output panel with the last ~12 KiB of tool output and a line filter. Click Stop and import to tear everything down and import the capture; the toast reports how many requests were parsed.

Frida script catalog

The backend ships four built-in scripts, selected by profile:

The selected script is written into the session workspace and loaded with frida -l. The Goldapple profile additionally requires a client certificate: the app extracts a P12 from the APK entry res/raw/prod_keystore_p12.p12 (trying password candidates from the APK and its native libraries) or accepts an uploaded certificate and password, then converts it to PEM for mitmproxy.

Manage scripts in the library

The Frida scripts tab (tabs switch with 1/2) is a script library. Built-in scripts open read-only with their embedded source; use the toolbar to create, duplicate, save (Cmd/Ctrl+S), and delete custom scripts. Custom scripts persist in browser localStorage and appear in the Capture-tab script dropdown with a (custom) suffix; selecting one sends its source to the backend as the custom profile, written to frida-custom.js.

Signature tracing workflow

The Signature trace script hooks the Java crypto primitives apps use to build request signatures and logs every input and output with a [traffic-jam] prefix:

• javax.crypto.Mac.doFinal / .update (HMAC)
• java.security.MessageDigest.digest / .update (hashes)
• javax.crypto.spec.SecretKeySpec (keys, utf8 + hex)
• okhttp3.Request$Builder.addHeader for headers containing sign, sig, token, or nonce

Each log line includes the input (utf8 and hex), the output hex, and a short caller stack. Run the app action that produces a signed request, then read the filtered Process output panel: when a logged output matches an observed signature value, the matching input string is the canonicalization.

The offline analysis works the other direction. In the API workspace, open the Signature tab (see /docs/en/api-re/): it scans headers, query parameters, and cookies for signature-like fields, brute-forces classic canonicalizations, and correlates derivation inputs across captures. For any candidate, Copy Frida hook template generates a per-field script — with the endpoint, field, observed values, and expected byte length embedded, logging [sig-trace] lines — that you attach with:

frida -U -f <package> -l this-script.js

Extract an APK

In the Android apps list, click APK on a row. The backend resolves the package with pm path, pulls each split with adb pull, and returns a <name>.apks.zip archive download.

Where artifacts land

Each session gets a directory under the capture workspace (mobile/<session-id>/) containing the .pcapng, the .sslkeylog, and the injected script. On stop, the capture and keylog are imported and decrypted like any other capture — see /docs/en/capture/. Tool prerequisites are covered in /docs/en/getting-started/installation/.

[!WARNING] Frida injection, SSL unpinning, and mTLS interception bypass an app’s transport protections. Run these workflows only against apps and backends you own or are explicitly authorized to test.