How I Injected Frida Gadget in the Application and Ran Frida on a Non-Rooted Device

A Step-by-Step Guide to Bypassing Developer Options Through Code Tampering

Introduction

During a recent penetration testing engagement, I encountered a fascinating vulnerability that allowed me to bypass developer options through code tampering. The application had implemented security checks that could be completely defeated using Frida — and the best part? I did this entirely without rooting the device.

In this blog post, I’ll walk you through the entire process of injecting Frida Gadget into an APK and running instrumentation on a non-rooted Android device. This technique is invaluable for penetration testers who need to analyze applications on locked-down devices.

Why Use Frida on a Non-Rooted Device?

Most Android security testing assumes you have root access. But in real-world scenarios, you often don’t have that luxury. Here’s why the non-rooted approach matters:

Frida has two main modes of operation:

Most Android security testing assumes you have root access. But in real-world scenarios, you often don’t have that luxury. Here’s why the non-rooted approach matters:

Frida has two main modes of operation. The first uses frida-server which runs as root and injects into processes. This approach is powerful and can attach to any process, but it requires root access which isn’t always available.

The second uses Frida Gadget where the library is embedded directly into the APK. This approach works perfectly on non-rooted devices but requires APK repackaging.

The embedded approach using Frida Gadget is the key to running instrumentation without root.

The Exploitation Process: Step-by-Step

The technique I used involves a form of static format instrumentation — modifying the application’s native libraries to load the Frida Gadget at startup. Here’s the complete process:

Step 1: Extracting the Split APKs

Modern Android applications often distribute their code across multiple APK files (split APKs). Before we can modify the application, we need to extract all these components.

Extracting the split APK files from the target application

Step 2: Merging the APK Using APK Editor

Since we’re dealing with split APKs, we need to merge them into a single APK file that we can modify and repackage.

Merging the split APKs into a single APK file using APK Editor

Using APK Editor, I merged all the split APK components into one unified APK file. This consolidated all the application’s code, resources, and native libraries into a single package.

Step 3: Signing the Merged APK

After merging, the APK needs to be signed before it can be installed. For testing purposes, I used a debug keystore.

Signing the merged APK with a debug keystore

This allows the APK to be installed on the device, though the signature mismatch may prevent installation if the app has signature verification.

Step 4: Injecting the Frida Gadget in the Application

This is the core step where the exploitation happens. Using Pulse APK tool, I automated the entire Frida Gadget injection process. Here’s what happened:

Starting the patch pipeline for Frida Gadget injection

The injection pipeline executed the following:

• Started the patch pipeline with the Frida Gadget injection profile
• Detected the architecture as arm64-v8a and decompiled the APK
• Automatically identified the main activity of the application
• Patched the AndroidManifest.xml to ensure debuggability
• Copied the Frida Gadget library (libgadget.so) and configuration file into the APK's lib directory
• Injected the Frida Gadget into the native libraries
• Patched the Smali code for proper initialization
• Rebuilt and signed the patched APK
• Verified the injection by confirming the loadFridaGadget() method was present in the DEX files

The final output was a fully patched APK ready for installation on the non-rooted device.

Step 5: Decompiling the Patched APK

Decompiling the patched APK to Configure the frida Gadget Configuration.

Decompiling the patched APK

Step 6: Setting Up the Frida Gadget Configuration

The Frida Gadget requires a configuration file to define how it should interact with the application.

Configuring the Frida listener in the gadget configuration file

Step 7: Recompiling the Patched APK

Step 8: Resigning and Reinstalling

Resigning and reinstalling the patched application on the device

Step 9: Executing the Frida Script

The Frida script successfully executing on the non-rooted device

Advantages of This Technique

The most obvious advantage is that no root access is required, making this work on production devices. There’s also no frida-server dependency since everything is embedded. The approach bypasses many anti-Frida protections because it’s harder to detect. And best of all, there’s no modification of DEX files — only native libraries are touched.

Disadvantages

The main drawbacks are that it requires APK repackaging and re-signing, which some applications may detect. The application must have at least one native library for the injection to work. And the technique relies on early library loading, which may not work in all scenarios.

Conclusion

Running Frida on non-rooted Android devices is not only possible but increasingly practical. The embedded Frida Gadget approach, combined with LIEF for native library modification, provides a powerful way to bypass security controls and analyze applications on locked-down devices.

The technique I demonstrated — injecting libgadget.so as a dependency of an existing native library—is elegant because it requires minimal modifications, works reliably across different architectures, and bypasses many anti-tampering measures.

Whether you’re a penetration tester, security researcher, or developer looking to understand application security, mastering Frida Gadget injection on non-rooted devices is an essential skill in your toolkit.