About the author. I’m Colin Xiao — an independent reverse engineer, mostly working solo on contract jobs. I dig into compiled code of every kind, including but not limited to: Android and iOS apps, x86/x64/ARM native binaries, packers and obfuscators, DRM and license checks, network protocols and APIs, crypto and signature algorithms, malware, game binaries, and embedded/IoT firmware. I also handle large-scale data collection and vulnerability research. If you have any project in mind, I’d be glad to take it on — whatever it is, as long as it’s within my wheelhouse. Just reach out. You can reach me on X at @colinxiao_lab or on Telegram at https://t.me/ColinXiao666.

This research is published for educational and defensive purposes. The target sample is anonymized throughout.

Frida Support in GDA: Hook and Invoke Methods Directly on Decompiled Code

The idea

The usual Frida workflow is a context switch: you find a method in the decompiler, then hand-write a JS hook for it in a separate file, then run it. I wanted to collapse that — hook or invoke a method directly on the decompiled code without ever writing a script. It sounds simple until you hit the edge cases:

Auto-generating JS means more than a code template: you have to handle static methods, constructors, inner classes, anonymous classes, and obfuscated symbols that contain non-printable characters.
Invoking a method requires resolving its arguments and instantiating its owning class, which sometimes needs user input — so you need an in-tool code editor.
Running independently of a terminal means providing your own shell window for Frida’s output, command input, and other interaction.

These problems are all solvable, and putting Frida behind a decompiler UI covers most of the day-to-day pain points:

If the decompiled APK isn’t installed on the device, install and launch it automatically.
Handle static methods, constructors, inner classes, anonymous classes, and obfuscated/invisible symbol names automatically.
Hook anywhere on the decompiled code and see argument values and return values without writing any JS.
Invoke anywhere on the decompiled code with GDA auto-generating the code to minimize hand-editing.
Support “packed hooking / method invocation”: decompile a dumped DEX and, as long as the original app is installed on the device, associate automatically.
Fully custom JS scripts with auto-generated suggestions for cases where you need to mutate arguments, fudge return values, or do anything beyond the defaults.

These address the two most common stuck points: a hook that never fires because you picked the wrong point, and a vulnerability that can’t be triggered because the upper-layer caller isn’t reachable. Here’s the result in action:

Prerequisites

Get GDA from the GitHub releases page or the official site. Then install Frida (installation is well covered elsewhere):

pip3 install frida
pip3 install frida-tools

Verify it:

frida --version

Using it

Since Frida’s Java-layer hooking is method-granular, the decompiled code becomes the UI. Take this decompiled method:

Right-click and you can hook or invoke the method you clicked, with the dynamic result shown inline. The markers 1, 2, and 3 in the screenshot are the three kinds of operands you can act on:

1 — the current decompiled method.
2 — a method called by the current method.
3 — a class object.

1 and 2 support both method-hook and class-hook; 3 only supports class-hook. Any class or method referenced in the code can be hooked directly:

The right-click menu’s Frida options:

Hook method — installs and launches the APK on first use; afterwards it hooks without restarting the app.
Hook method (restart) — restarts the app on every hook.

Invoke method — instantiates the class and runs the selected method, with GDA generating the code. If the method arguments or the class constructor arguments are indeterminate, you fill them in manually and run (F5); if both are fully determined, GDA executes directly without opening the editor.
Invoke from memory — runs the selected method against an existing class instance found in the device’s memory.

Hook class — hooks every method of the selected class. If you selected a method, it hooks that method’s owning class. Like option 1, it installs and launches the APK on first use only.
Hook class (restart) — restarts the app on every hook.

Custom JS — GDA provides a template you can fully overwrite with your own code.

The code editor

The editor exists to fill in what can’t be auto-generated. When you invoke a method whose arguments are indeterminate, GDA opens the editor showing the generated code and lets you fill in the values — some arguments still need manual instantiation. Since invoking a method also means instantiating its owning class, there are two sets of inputs: the constructor arguments and the method arguments. When the selected method’s arguments are constants, GDA fills them in for you:

In the screenshot, 1 is the instantiation arguments (not generated if the method is static), and 2 is the method arguments (auto-filled when the decompiled code determines them). Once filled, press F5 or right-click Run (3); results appear in the window on the right.

The log window

This window shows Frida’s output and accepts Frida commands for interaction. Other operations — quitting Frida, clearing the screen, reloading, resuming — are available from the right-click menu:

Packed (dump-based) debugging

For packed apps, first dump the app’s DEX from the device, drag it into GDA to decompile, then on the first hook/invoke you enter the app’s package name — after that it works normally. To find the package name, drag the original APK into GDA and look in BaseInfo:

For some packers the package name changes, in which case list it from the device:

adb shell pm list packages -f

Then drag the dumped DEX into GDA, right-click any method, and choose Frida Support → Hook method. A dialog appears where you enter the package name you found, after which you can hook and invoke arbitrary methods:

Obfuscated methods and classes

Obfuscated symbols often contain non-printable characters that can’t appear verbatim in JS. GDA’s decompiler renders these as \xXX escapes and converts them automatically, saving you the manual encoding work. If you enable de-obfuscation, the displayed names are no longer the original names — that case is handled automatically too:

Demonstration:

Colin Xiao — I take on contract reverse-engineering work, and writeups like this are how I show what I can do. If you need help with anything in this space — including but not limited to the areas I cover above — I’m available. No project is too big or too small — if it’s reverse engineering and I can do it, I’ll take it. DM me on X (@colinxiao_lab) or Telegram (@ColinXiao666).

Get in touch