Context

MASTG-DEMO-0x86 (emulator detection, linked to MASTG-TEST-0x49) currently uses a custom Frida script (script.js) to trace emulator detection APIs at runtime.

A hooks.json for Frooky was partially written:

• hooks.json
• output.json

What was achieved

The following hooks are working correctly in hooks.json:

All hooks use filterEventsByStacktrace: ["org.owasp.mastestapp.MastgTest"].

What is missing

1. Build.* static field reads (12 fields) — Frooky limitation

The app reads Build static fields directly (Build.BOARD, Build.BRAND, Build.DEVICE, Build.FINGERPRINT, Build.MODEL, Build.MANUFACTURER, Build.PRODUCT, Build.HARDWARE, Build.ID, Build.SERIAL, Build.TAGS, Build.USER). These are not interceptable via Frida Java instrumentation.

Currently captured only by script.js which hooks the internal MastgTest.queryBuildValue() method. A fix would require either Frooky support for static field interception, or refactoring the sample to use a hookable wrapper method.

2. identityHashCode errors in Frooky for ActivityManager.getRunningServices and GLES20.glGetString

Frooky logs a non-fatal error for these hooks:

Error in identityHashCode Error: identityHashCode(): argument types do not match any of: .overload('java.lang.Object')

Events are still captured but this may be a Frooky bug worth fixing.

Next steps

• Investigate Frooky support for static field interception to cover Build.* reads
• Fix the identityHashCode error in Frooky for List and native-backed return types
• Once fixed, update hooks.json and produce a clean output.json to replace output.txt
• Update MASTG-DEMO-0x86.md to reference output.json and hooks.json