frida-ps

Frida-ps, included with the standard frida tools suite, is a helpful way of listing running apps on your target device. Out of the box, an iPhone will have hundreds of running processes at first boot. Thankfully, frida-ps provides several command line options to make this process easier.

Remember to utilize the-U flag to tell Frida you want to see apps on the device connected via USB / emulator. If you don't, you'll instead see processes running on your host machine.

Examples:

List running apps (-a)

C:\>frida-ps -U -a
  PID  Name                      Identifier
-----  ------------------------  ---------------------------------------
 1797  AnalyticsService          org.android_x86.analytics
 1411  Android Keyboard (AOSP)   com.android.inputmethod.latin
 6765  Android Setup             com.google.android.setupwizard
 1285  Android System            android
20054  Blocked Numbers Storage   com.android.providers.blockednumber
20054  Contacts Storage          com.android.providers.contacts
19534  Download Manager          com.android.providers.downloads
 5617  ES File Explorer          com.estrongs.android.pop
 5438  External Storage          com.android.externalstorage
 5399  Files                     com.android.documentsui
 1285  Fused Location            com.android.location.fused
 5102  Gallery                   com.android.gallery3d
 1792  Google App                com.google.android.googlequicksearchbox
15496  Google Partner Setup      com.google.android.partnersetup
 6219  Google Play Store         com.android.vending
 1874  Google Play services      com.google.android.gms
 6274  Google Services Framew…   com.google.android.gsf
20089  MTP Host                  com.android.mtp
19534  Media Storage             com.android.providers.media
 1510  Mobile Data               com.android.phone
 1510  Mobile Network Configur…  com.android.providers.telephony
 5477  Package installer         com.google.android.packageinstaller
 6551  Photo Vault               com.enchantedcloud.photovault
 1832  Quickstep                 com.android.launcher3
 1285  Settings Storage          com.android.providers.settings
 1422  System UI                 com.android.systemui
 3360  Terminal Emulator         com.termoneplus
20054  User Dictionary           com.android.providers.userdictionary 

List all installed apps (-a -i)

List all running processes

Locating an app with frida-ps

Locate a specific app using frida-ps

If you are finding yourself needing to know an app's identifier, frida-ps can be a good way to find it. It will also get us the application's current Process ID (PID) if it's running.

On your host machine, open a Command Prompt.

Type frida-ps -U -a. These switches will limit our list greatly and make it easier to spot our target.

For more info on frida-ps, see frida-ps.

In the case of Photo Vault, the bundle identifier is com.enchantedcloud.photovault. You may optionally note down the PID (Process ID) however, the application identifier is primarily what we are after since we may re-launch the app several times throughout the lab (resulting in a different PID).

Great, now we’ve established our application identifier, and can see that it is running. We also know that since frida-ps gave us the data we needed, we indeed have connectivity between the host machine and frida-server on the device (or emulator).