Renef

https://renef.io/
Admin
Renef is a dynamic instrumentation toolkit for Android ARM64 applications that provides runtime...
Tokens:66,119
Snippets:765
Trust Score:2
Update:4 months ago
Show doc for...
Tokens:
Raw
### Renef Server and Client Quick Start

Source: https://renef.io/docs/getting-started.html

This sequence demonstrates the initial setup for using Renef. It involves starting the server on an Android device, running the client on the host machine, and performing basic operations like spawning an app, listing installed apps, and executing Lua code.

```bash
# 1. Start server on Android device
adb shell /data/local/tmp/renef_server

# 2. Run client on host
./build/renef

# 3. Spawn an app
renef> spawn com.example.app

# 4. List installed apps (with filter)
renef> la~example

# 5. Execute Lua code
renef> print("Hello from " .. _VERSION)

# 6. Load and execute a script
renef> l scripts/hook.lua

# 7. Load multiple scripts with auto-watch
renef> l script1.lua script2.lua -w

```

--------------------------------

### Setup Dependencies for Build

Source: https://renef.io/docs/troubleshooting.html

Run 'make setup' to install necessary dependencies like Capstone and Lua if they are not found.

```bash
# Capstone not found
make setup

# Lua not found
make setup-lua
```

--------------------------------

### Quick Start: Initialize, Spawn, and Interact

Source: https://renef.io/docs/python-binding.html

A basic example demonstrating how to initialize Renef, spawn an application, find a module base address, and execute Lua code.

```python
from renef import Renef

# Initialize
r = Renef()

# Spawn and inject into app
session = r.spawn('com.example.app')
print(f"Attached to PID: {session.pid}")

# Use APIs
base = session.Module.find('libc.so')
print(f"libc.so base: 0x{base:x}")

# Execute Lua code
ok, out, err = session.eval('print("Hello from Lua!")')

# Clean up
session.close()
```

--------------------------------

### Ollama Setup Commands

Source: https://renef.io/docs/commands/ai.html

Commands to install Ollama, download a model, start the server, and forward the port for use with Renef on an Android device.

```bash
# Install
curl -fsSL https://ollama.com/install.sh | sh

# Download model (tool calling requires 3.1+)
ollama pull llama3.1

# Start server
ollama serve

# If renef runs on Android device, forward Ollama port
adb reverse tcp:11434 tcp:11434
```

--------------------------------

### Complete Example

Source: https://renef.io/docs/api/java.html

Demonstrates various Java API usages including getting application package name, StringBuilder manipulation, calling static methods with different argument types, and retrieving system properties.

```APIDOC
## Complete Example

### Description
This example demonstrates various Java API usages including getting application package name, StringBuilder manipulation, calling static methods with different argument types, and retrieving system properties.

### Usage
```lua
-- Get application package name
local ActivityThread = Java.use("android/app/ActivityThread")
local app = ActivityThread:call("currentApplication", "()Landroid/app/Application;")
local pkg = app:call("getPackageName", "()Ljava/lang/String;")
print("Package: " .. pkg)

-- StringBuilder example
local StringBuilder = Java.use("java/lang/StringBuilder")
local sb = StringBuilder:new("()V")
sb:call("append", "(Ljava/lang/String;)Ljava/lang/StringBuilder;", "Hello")
sb:call("append", "(Ljava/lang/String;)Ljava/lang/StringBuilder;", " from Renef!")
local result = sb:call("toString", "()Ljava/lang/String;")
print(result)  -- "Hello from Renef!"

-- Static method with different argument types
local String = Java.use("java/lang/String")
print(String:call("valueOf", "(I)Ljava/lang/String;", 42))       -- "42"
print(String:call("valueOf", "(Z)Ljava/lang/String;", false))    -- "false"
print(String:call("valueOf", "(D)Ljava/lang/String;", 3.14))     -- "3.14"

-- Get system property
local System = Java.use("java/lang/System")
local sdk = System:call("getProperty", "(Ljava/lang/String;)Ljava/lang/String;", "ro.build.version.sdk")
print("SDK: " .. tostring(sdk))

-- Note: Java objects returned as JavaInstance userdata are automatically cleaned up by Lua’s garbage collector. Do not store references longer than needed to avoid memory leaks.
```
```

--------------------------------

### Clone and Build renéf

Source: https://renef.io/docs/installation.html

A quick start guide to clone the repository, set up dependencies, build the project, and deploy it to an Android device.

```bash
# 1. Clone the repository
git clone https://github.com/ahmeth4n/renef.git
cd renef

# 2. Setup dependencies (Lua + Capstone)
make setup

# 3. Build everything
make

# 4. Deploy to device
make deploy

# 5. Run server on device
adb shell /data/local/tmp/renef_server

# 6. Run client on PC
./build/renef

```

--------------------------------

### Build and Install r2renef with Meson

Source: https://renef.io/docs/r2renef.html

Use Meson to set up the build environment, then 'ninja' to build and install the r2renef plugin.

```bash
meson setup build
ninja -C build
ninja -C build install

```

--------------------------------

### Automatic Dependency Setup

Source: https://renef.io/docs/installation.html

Use 'make setup' to automatically download and build Lua and Capstone dependencies required for the Android build.

```bash
make setup

```

--------------------------------

### Build and Install r2renef with Make

Source: https://renef.io/docs/r2renef.html

Clone the repository, navigate to the directory, and use 'make' to build and 'make install' to install the plugin to your Radare2 user plugins directory.

```bash
git clone https://github.com/ahmeth4n/r2renef
cd r2renef
make
make install

```

--------------------------------

### Local Mode Quick Reference

Source: https://renef.io/docs/local-mode.html

Commands for one-time setup from the PC and initial server/injection commands on the device.

```bash
# One-time setup (from PC)
make deploy-local
```

```bash
# On device
su
/data/local/tmp/renef_server &
/data/local/tmp/renef --local -s com.example.app -l /data/local/tmp/script.lua -w
```

--------------------------------

### Full I/O Session Logger Setup

Source: https://renef.io/docs/examples/strace.html

This snippet configures the tracer to monitor a comprehensive set of file and network I/O system calls for complete visibility. It includes commands to start tracing, check active tracers, and stop tracing when done.

```Lua
-- Start tracing
Syscall.trace("openat", "read", "write", "close",
              "connect", "sendto", "recvfrom")

-- ... interact with the app ...

-- Check what's active
Syscall.active()

-- Stop when done
Syscall.stop()

```

--------------------------------

### Renef Client Examples

Source: https://renef.io/docs/getting-started.html

A collection of common Renef usage patterns. These examples cover various scenarios such as interactive mode, spawning apps, attaching to processes, loading scripts, and utilizing different hooking engines and devices.

```bash
# Interactive mode (no auto-spawn/attach)
./build/renef

```

```bash
# Spawn app and enter interactive mode
./build/renef -s com.example.app

```

```bash
# Spawn app and load script
./build/renef -s com.example.app -l hook.lua

```

```bash
# Attach to running process by PID
./build/renef -a 12345

```

```bash
# Attach with PLT/GOT hooking and load script
./build/renef -a 12345 --hook pltgot -l script.lua

```

```bash
# Use specific device (emulator)
./build/renef -d emulator-5554 -s com.example.app

```

```bash
# Use specific device (physical device)
./build/renef -d XXXXXXXX -s com.example.app -l bypass.lua

```

```bash
# Spawn, load script, and auto-watch hook output
./build/renef -s com.example.app -l hook.lua -w

```

```bash
# Multiple scripts can be loaded inside REPL after connection
renef> l script1.lua script2.lua -w

```

```bash
# Gadget mode (non-rooted device with patched APK)
./build/renef -g 12345 -l script.lua

```

```bash
# Spawn with verbose output (shows agent debug logs)
./build/renef -s com.example.app -v

```

```bash
# Load script with verbose to debug hook issues
./build/renef -s com.example.app -l hook.lua -v

```

--------------------------------

### Start Server and Run Client in Local Mode

Source: https://renef.io/docs/local-mode.html

Starts the Renef server in the background and then runs the client in local mode from a Termux or ADB shell.

```bash
# Get root
su

# Start server in background
/data/local/tmp/renef_server &

# Run client in local mode
/data/local/tmp/renef --local
```

--------------------------------

### JNI Method Signature Examples

Source: https://renef.io/docs/api/hook

Examples demonstrating the JNI method signature format, which is (ParameterTypes)ReturnType.

```text
-- void method()
"()V"
```

```text
-- int method(int x, int y)
"(II)I"
```

```text
-- String method(String s)
"(Ljava/lang/String;)Ljava/lang/String;"
```

```text
-- void method(int[] arr, boolean flag)
"([IZ)V"
```

```text
-- Object method(String name, int count)
"(Ljava/lang/String;I)Ljava/lang/Object;"
```

--------------------------------

### Manual Lua Setup

Source: https://renef.io/docs/installation.html

Manually set up Lua by downloading the source, extracting it, and running the build script. This is an alternative to 'make setup-lua'.

```bash
# Automatic
make setup-lua

# Or manual
cd external/lua
curl -L -o lua-5.4.7.tar.gz https://www.lua.org/ftp/lua-5.4.7.tar.gz
tar -xzf lua-5.4.7.tar.gz
./build-android.sh

```

--------------------------------

### Complete Fuzzing Example

Source: https://renef.io/docs/api/kcov.html

A minimal example demonstrating a coverage-guided syscall fuzzer. It measures baseline coverage, fuzzes inputs, and tracks new edges to build a corpus.

```lua
local cov = KCov.open()
local corpus = {}
local baseline = nil

-- Measure baseline
cov:reset(); cov:enable()
io.open("/proc/self/maps", "r"):read("*a")
cov:disable()
baseline = cov:edges()

-- Fuzzing loop
local paths = {"/proc/self/status", "/proc/self/stat",
               "/proc/self/cmdline", "/proc/self/environ"}

for i, path in ipairs(paths) do
    cov:reset()
    cov:enable()

    local f = io.open(path, "r")
    if f then f:read("*a"); f:close() end

    cov:disable()

    local new = cov:diff(baseline)
    local hits = cov:count()

    if new > 0 then
        table.insert(corpus, path)
        baseline = cov:edges()  -- update baseline
        print(GREEN .. string.format("[+] %s: %d hits, %d new edges", path, hits, new) .. RESET)
    else
        print(string.format("[-] %s: %d hits, 0 new edges (skip)", path, hits))
    end
end

print(string.format("\nCorpus: %d interesting inputs", #corpus))
cov:close()
```

--------------------------------

### Batch Module Analysis Example

Source: https://renef.io/docs/python-binding.html

Provides an example of iterating through all loaded modules, printing their details, and inspecting their exports, focusing on libraries with 'target' or 'crypto' in their names.

```python
from renef import Renef

r = Renef()
session = r.spawn('com.example.app')

# List all modules
modules = session.Module.list()
print(f"Loaded {len(modules)} modules\n")

# Find interesting libraries
for m in modules:
    if 'target' in m['name'] or 'crypto' in m['name']:
        print(f"\n=== {m['name']} ===")
        print(f"Base: 0x{m['base']:x}")

        exports = session.Module.exports(m['name'])
        print(f"Exports: {len(exports)}")
        for e in exports[:5]:
            print(f"  0x{e['offset']:x} {e['name']}")


```

--------------------------------

### Example File Activity Output

Source: https://renef.io/docs/examples/strace.html

This is an example of the output you might see when tracing file operations. It shows system calls like openat, read, and close with their arguments and return values.

```Log
[tid:22137] openat(AT_FDCWD, "/data/data/com.app/shared_prefs/config.xml", O_RDONLY, 0644) = 5
[tid:22137] read(5</data/data/com.app/shared_prefs/config.xml>, 0x7183361000, 4096) = 1024
[tid:22137] close(5) = 0
[tid:22160] openat(AT_FDCWD, "/data/data/com.app/databases/app.db", O_RDWR|O_CREAT, 0644) = 8
[tid:22160] write(8</data/data/com.app/databases/app.db>, 0x7fe42f5488, 512) = 512

```

--------------------------------

### Function Hooking Example

Source: https://renef.io/docs/python-binding.html

Illustrates how to find a function by its export name, get its offset, and then hook its entry and exit points to log arguments and return values.

```python
from renef import Renef

r = Renef()
session = r.spawn('com.example.app')

# Find function offset
exports = session.Module.exports('libtarget.so')
for e in exports:
    if 'encrypt' in e['name'].lower():
        print(f"Found: {e['name']} @ 0x{e['offset']:x}")

        # Hook it
        session.hook('libtarget.so', e['offset'],
            on_enter='print("encrypt called with:", args[0])',
            on_leave='print("encrypt returned:", retval)'
        )
        break

```

--------------------------------

### Example Workflow: Hooking and Patching

Source: https://renef.io/docs/r2renef.html

This workflow demonstrates how to hook a function, load a Lua script for tracing, and patch a branch instruction to NOP using r2renef.

```bash
# Find a function, disassemble it
[0x7f8a1c000]> s 0x7f8a1c000 + 0x5678
[0x7f8a21678]> pdf

# Load a hook script
[0x7f8a21678]> :l hooks/trace_func.lua

# Watch hook output
[0x7f8a21678]> :watch

# Patch a branch to NOP
[0x7f8a21678]> w \x1f\x20\x03\xd5

# Verify the patch
[0x7f8a21678]> pd 1

```

--------------------------------

### Quick Start: Spawn and Attach to Android Processes

Source: https://renef.io/docs/r2renef.html

Initiate the Renef server on the Android device, set up ADB port forwarding, and then open the target application in r2 using either the spawn or attach URI format.

```bash
# 1. Start Renef server on Android device
adb shell /data/local/tmp/renef_server

# 2. Setup port forwarding
adb forward tcp:1907 tcp:1907

# 3. Open target app in r2
r2 renef://spawn/com.example.app

# Or attach to a running process
r2 renef://attach/12345

```

--------------------------------

### Example Watch Output

Source: https://renef.io/docs/commands/monitoring.html

This is an example of the output you might see when using the watch command to monitor hook events. It shows real-time updates of hook calls and their associated data.

```text
Project: /websites/renef_io
Content:
Skip to main content
#  Real-time Monitoring 
##  `watch [address]`
Watch hook output in real-time. Press ‘q’ to exit watch mode.
```
# Watch all hooks
watch

# Watch specific address (if supported)
watch 0x7f8a1c2b0

```

**Output:**
```
📡 Watching hook output... (waiting for hooks to trigger)
(Press 'q' to exit watch mode)

[+] malloc called
    size: 0x100
[-] Returning: 0x7f9b4000
[+] free called
    ptr: 0x7f9b4000

```

* *

```

--------------------------------

### Rebuild, Sign, and Install Patched APK

Source: https://renef.io/docs/gadget-mode.html

Commands to rebuild the modified APK, sign it with a keystore, and install it on a device.

```bash
# Rebuild APK
apktool b target_unpacked -o target_patched.apk

# Sign APK
apksigner sign --ks your-key.jks target_patched.apk

# Install
它们install target_patched.apk

```

--------------------------------

### List Loaded Plugins CLI Command

Source: https://renef.io/docs/plugins.html

Example output of the `plugins` command in the Renef CLI, showing the loaded plugins with their index, name, and description.

```text
renef> plugins
Loaded plugins (2):
  [1] hello - Simple hello world plugin
  [2] test_plugin - Test plugin for renef

```

--------------------------------

### Complete Java API Example

Source: https://renef.io/docs/api/java.html

Demonstrates various Java API interactions from Lua, including getting application package name, using StringBuilder, calling static methods with different argument types, and retrieving system properties. Java objects are garbage collected by Lua.

```lua
-- Get application package name
local ActivityThread = Java.use("android/app/ActivityThread")
local app = ActivityThread:call("currentApplication", "()Landroid/app/Application;")
local pkg = app:call("getPackageName", "()Ljava/lang/String;")
print("Package: " .. pkg)

-- StringBuilder example
local StringBuilder = Java.use("java/lang/StringBuilder")
local sb = StringBuilder:new("()V")
sb:call("append", "(Ljava/lang/String;)Ljava/lang/StringBuilder;", "Hello")
sb:call("append", "(Ljava/lang/String;)Ljava/lang/StringBuilder;", " from Renef!")
local result = sb:call("toString", "()Ljava/lang/String;")
print(result)  -- "Hello from Renef!"

-- Static method with different argument types
local String = Java.use("java/lang/String")
print(String:call("valueOf", "(I)Ljava/lang/String;", 42))       -- "42"
print(String:call("valueOf", "(Z)Ljava/lang/String;", false))    -- "false"
print(String:call("valueOf", "(D)Ljava/lang/String;", 3.14))     -- "3.14"

-- Get system property
local System = Java.use("java/lang/System")
local sdk = System:call("getProperty", "(Ljava/lang/String;)Ljava/lang/String;", "ro.build.version.sdk")
print("SDK: " .. tostring(sdk))

```

--------------------------------

### Install Native Hook with Callbacks

Source: https://renef.io/docs/python-binding.html

Installing native hooks on a library at a specific offset, with optional callbacks for entering and leaving the hooked function.

```python
# Hook with onEnter
session.hook('libc.so', 0x1234, on_enter='print(args[0])')

# Hook with both callbacks
session.hook('libc.so', 0x1234,
    on_enter='print("enter:", args[0])',
    on_leave='print("leave:", retval)'
)
```

--------------------------------

### Example Workflow: Combining r2 Analysis with Renef Hooking

Source: https://renef.io/docs/r2renef.html

Illustrates combining Radare2's analysis with Renef's hooking capabilities. This includes listing library exports, seeking to functions, and setting up custom Lua hooks.

```bash
# List exports of a library
[0x00000000]> :exec for _, s in ipairs(Module.exports("libtarget.so")) do print(string.format("0x%x %s", s.offset, s.name)) end

# Seek to an exported function
[0x00000000]> s 0x7f8a1c000 + 0x1234

# Disassemble it
[0x7f8a1d234]> pdf

# Hook it from r2
[0x7f8a1d234]> :exec hook("libtarget.so", 0x1234, { onEnter = function(args) print("called!") end })

# Watch the output
[0x7f8a1d234]> :watch

```

--------------------------------

### Basic Hello World Plugin Example

Source: https://renef.io/docs/plugins.html

A simple C plugin that prints 'Hello, World!' or a personalized greeting if input is provided. It includes the required metadata and lifecycle functions.

```c
// hello_plugin.c
#include <renef/plugin.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

RENPluginMetadata ren_plugin_info = {
    .name = "hello",
    .author = "developer",
    .version = "1.0.0",
    .description = "Simple hello world plugin",
    .command = "hello",
    .type = PLUGIN_COMMAND
};

int ren_plugin_init(renef_ctx_t ctx) {
    (void)ctx;
    return 0;  // Success
}

int ren_plugin_exec(renef_ctx_t ctx, char* input) {
    if (!ctx) return -1;

    char msg[256];

    if (input && strlen(input) > 0) {
        snprintf(msg, sizeof(msg), "Hello, %s!\n", input);
    } else {
        snprintf(msg, sizeof(msg), "Hello, World!\n");
    }

    ren_print(ctx, msg);
    return 0;
}

void ren_plugin_close(renef_ctx_t ctx) {
    (void)ctx;
}

```

--------------------------------

### Example Network Activity Output

Source: https://renef.io/docs/examples/strace.html

This is an example of the output generated when tracing network activity. It includes system calls like socket, connect, sendto, and recvfrom.

```Log
[tid:22840] socket(2, 1, 6) = 135
[tid:22840] connect(135<socket:[1670397]>, 0x7fe42f5488, 16) = 0
[tid:22840] sendto(135<socket:[1670397]>, 0x6eb3172388, 256, 0, NULL, 0) = 256
[tid:22840] recvfrom(135<socket:[1670397]>, 0xb400006efbf110d0, 65535, 0, NULL, NULL) = 1024

```

--------------------------------

### Example Syscall Trace Output

Source: https://renef.io/docs/renef-strace.html

Illustrates the format of output lines generated by renef-strace.

```text
Tracing syscalls... (press Ctrl+C or send any key to stop)
[tid:22137] openat(AT_FDCWD, "/data/data/com.app/file.txt", O_RDONLY, 0644) = 3
[tid:22137] read(3</data/data/com.app/file.txt>, 0x7fe42f5488, 4096) = 128
[tid:22137] write(101<anon_inode:[eventfd]>, 0x7fe42f5398, 8) = 8
[tid:22137] close(3) = 0
```

--------------------------------

### Makefile Commands for Plugin Management

Source: https://renef.io/docs/plugins.html

Commands for building, installing, cleaning, and listing plugins using the provided Makefile. It assumes the build system is located in `examples/plugins/`.

```bash
cd examples/plugins

# Build all plugins in directory
make all

# Install to ~/.config/renef/plugins/
make install

# Clean build artifacts
make clean

# List available plugins
make list

```

--------------------------------

### Install uv Python Package Manager

Source: https://renef.io/docs/magisk-renef.html

Installs the uv Python package manager using a curl script. This is a prerequisite for building the module locally.

```bash
# Install uv (Python package manager) if not already installed

```

```bash
curl -Ls https://astral.sh/uv/install.sh | sh

```

--------------------------------

### AI Script Generation Examples

Source: https://renef.io/docs/release-notes/v0.3.6.html

Demonstrates how to use the `ai` command with different providers (Ollama, OpenAI, Anthropic) by setting environment variables for API keys and specifying the desired action.

```bash
# Ollama (local, free)
renef> ai bypass root detection

# OpenAI
OPENAI_API_KEY=sk-... renef> ai hook findLibrary in @Loader.java

# Anthropic
ANTHROPIC_API_KEY=sk-ant-... renef> ai trace all crypto calls

```

--------------------------------

### Start Real-time Hook Output Watch

Source: https://renef.io/docs/python-binding.html

Starting a real-time watch for hook output. The provided callback function receives raw message bytes as they arrive.

```python
def on_message(data):
    print(data.decode(), end='')

session.watch_start(on_message)
```

--------------------------------

### Spawn Application

Source: https://renef.io/docs/python-binding.html

Examples of spawning an application with Renef, showing default trampoline hook and PLT hook options.

```python
session = r.spawn('com.example.app')
session = r.spawn('com.example.app', hook_type=1)  # PLT hook
```

--------------------------------

### Setup Port Forwarding for Gadget Mode

Source: https://renef.io/docs/gadget-mode.html

Instructions to set up ADB port forwarding for gadget mode, either using a Makefile helper or manually.

```bash
# Use the Makefile helper
make gadget-forward

# Or manually
它们forward tcp:6666 tcp:6666

```

--------------------------------

### Example Workflow: Analyzing a Native Library

Source: https://renef.io/docs/r2renef.html

A step-by-step workflow for analyzing a native library within an Android app using r2renef. It covers spawning the app, finding the library, seeking to its base, disassembling, and searching for patterns.

```bash
# Spawn target app
$ r2 renef://spawn/com.example.app

# Find the target library
[0x00000000]> :exec Module.find("libtarget.so")
0x7f8a1c000

# Seek to library base
[0x00000000]> s 0x7f8a1c000

# Disassemble the first function
[0x7f8a1c000]> pd 30

# Look for interesting patterns
[0x7f8a1c000]> /x FD7BBFA9    # ARM64 function prologues

# Dump hex around a match
[0x7f8a1c100]> px 128

```

--------------------------------

### Memory Patching Example

Source: https://renef.io/docs/python-binding.html

Shows how to find a library, read a value from memory, and patch it with new bytes, illustrated with an ARM64 NOP instruction.

```python
from renef import Renef

r = Renef()
session = r.spawn('com.example.game')

# Find library
base = session.Module.find('libgame.so')

# Read original value
original = session.Memory.read_u32(base + 0x1234)
print(f"Original: 0x{original:x}")

# Patch to NOP (ARM64)
session.Memory.write_u32(base + 0x1234, 0xD503201F)

```

--------------------------------

### Running renéf Client on Android Device

Source: https://renef.io/docs/installation.html

Instructions to start the renéf server and client on a rooted Android device via Termux for local execution.

```bash
# Open Termux on your rooted device
# Navigate to deployment directory
cd /data/local/tmp

# Start server
./renef_server &

# Run client
./renef_client

# Use normally
renef> spawn com.example.app

```

--------------------------------

### Trace Specific Syscalls

Source: https://renef.io/docs/api/syscall.html

Start tracing specific syscalls by providing their names as string arguments.

```lua
Syscall.trace("openat", "read", "write", "close")
```

--------------------------------

### Read and parse application preferences

Source: https://renef.io/docs/api/file.html

This example shows how to read application preferences from an XML file. It checks if the file exists, reads its content, and then parses the content to check for specific values, like a 'premium enabled' flag.

```lua
local prefs_path = "/data/data/com.example.app/shared_prefs/settings.xml"

if File.exists(prefs_path) then
    local content = File.read(prefs_path)
    if content then
        print("=== App Settings ===")
        print(content)
        
        -- Parse for specific values
        if content:find("premium.*true") then
            print(GREEN .. "Premium enabled!" .. RESET)
        end
    end
else
    print("Settings file not found")
end


```

--------------------------------

### Start Renev Server in Background

Source: https://renef.io/docs/troubleshooting.html

Run the renef_server on the device in the background, redirecting output to null and detaching from the terminal.

```bash
# Start server in background on device
adb shell "nohup /data/local/tmp/renef_server > /dev/null 2>&1 &"
```

--------------------------------

### RenefSession.watch_start

Source: https://renef.io/docs/python-binding.html

Starts a real-time watch for hook output. A provided callback function receives raw message bytes as they arrive from the agent.

```APIDOC
## session.watch_start(callback)

### Description
Start real-time watch of hook output. The callback receives raw message bytes as they arrive from the agent.

### Parameters
* `callback` - Function that receives `(message: bytes)`

### Returns
`0` on success, `-1` on failure
```

--------------------------------

### List and Filter Applications

Source: https://renef.io/docs/commands/application.html

Use the `la` command to list installed applications. You can filter the list by providing a package name or a partial match using the `~` operator.

```bash
# List all apps
la
```

```bash
# Filter by package name
la~google
```

```bash
# Filter for specific app
la~com.example
```

--------------------------------

### Quick Workflow: Push and Run Script via ADB

Source: https://renef.io/docs/magisk-renef.html

A common workflow involving getting a process PID, pushing a Lua script to the device, and then attaching Renef to run the script.

```bash
# 1. Get the PID of the target app (optional — use -s to spawn instead)

```

```bash
adb shell pidof com.example.app

```

```bash
# 2. Push your Lua script to the device

```

```bash
adb push hook.lua /data/local/tmp/

```

```bash
# 3. Attach and run the script

```

```bash
renef -a <PID> -l /data/local/tmp/hook.lua

```

--------------------------------

### ADB Port Forwarding Setup

Source: https://renef.io/docs/architecture.html

Demonstrates the ADB command to forward a TCP port on the host to an abstract Unix Domain Socket on the device. This is typically handled automatically by ReneF.

```bash
# Setup (done automatically by renef)

```

```bash
adb forward tcp:1907 localabstract:com.android.internal.os.RuntimeInit

```

--------------------------------

### Verify ADB Port Forwarding

Source: https://renef.io/docs/troubleshooting.html

List all active ADB port forwarding configurations to confirm your setup.

```bash
# Verify forwarding
adb forward --list
```

--------------------------------

### Interact with Renef in Gadget Mode

Source: https://renef.io/docs/gadget-mode.html

Examples of interacting with Renef once connected in gadget mode, including executing Lua code, loading scripts, and hooking functions.

```bash
# Connect to gadget
./build/renef -g 12345

# Execute Lua code
renef> print("Hello from gadget mode!")

# Load scripts
renef> l scripts/ssl_bypass.lua

# Hook functions
renef> exec hook("libc.so", 0x1234, { onEnter = function(args) print(args[0]) end })

```

--------------------------------

### Multiple Hooks Script (malloc, free, custom)

Source: https://renef.io/docs/scripting-guide.html

Installs multiple hooks simultaneously: `malloc` and `free` in `libc.so`, and a custom function in `libapp.so`. Logs arguments and return values as appropriate.

```lua
print(CYAN .. "=== Setting up hooks ===" .. RESET)

-- Hook malloc
hook("libc.so", 0x12340, {
    onEnter = function(args)
        print("[malloc] size: " .. args[0])
    end
})

-- Hook free
hook("libc.so", 0x12380, {
    onEnter = function(args)
        print(string.format("[free] ptr: 0x%x", args[0]))
    end
})

-- Hook custom function
local app_base = Module.find("libapp.so")
if app_base then
    hook("libapp.so", 0x5000, {
        onEnter = function(args)
            print("[custom_func] arg0: " .. args[0])
        end,
        onLeave = function(retval)
            print("[custom_func] returning: " .. retval)
            return retval
        end
    })
end

print(GREEN .. "✓ All hooks installed" .. RESET)


```

--------------------------------

### File System Access in Renef

Source: https://renef.io/docs/frida-to-renef.html

Provides examples of using Renef's built-in File API to read files within the target process, such as /proc/self/maps, and to resolve file descriptors.

```lua
-- Read /proc/self/maps from target process
local maps = File.read("/proc/self/maps")

-- Resolve file descriptor in a hook
hook("libc.so", read_offset, {
    onEnter = function(args)
        local path = File.fdpath(args[0])
        print("read() on: " .. tostring(path))
    end
})

```

--------------------------------

### Initialize Renef Client

Source: https://renef.io/docs/python-binding.html

Demonstrates initializing the Renef client, with options for auto-detecting the library path or specifying it manually.

```python
from renef import Renef

# Auto-detect library path
r = Renef()

# Or specify path
r = Renef('/path/to/librenef.so')
```

--------------------------------

### Spawn Mode with Pause

Source: https://renef.io/docs/release-notes/v0.3.6.html

Example of using the `--pause` flag with the `renef` command in spawn mode to freeze the target process immediately after injection, ensuring hooks are installed before application code executes.

```bash
renef -s com.example.app -l bypass.lua --pause

```

--------------------------------

### CLI: Launching Application

Source: https://renef.io/docs/frida-to-renef.html

Launch and attach to an application by bundle ID using Frida or Renef.

```bash
frida -U -f com.example.app
```

```bash
./renef -s com.example.app
```

--------------------------------

### CLI: Launching Application with Script

Source: https://renef.io/docs/frida-to-renef.html

Launch an application and load a script file using Frida or Renef.

```bash
frida -U -f app -l script.js
```

```bash
./renef -s app -l script.lua
```

--------------------------------

### Spawn App and List Script

Source: https://renef.io/docs/examples/ssl-bypass.html

This snippet shows how to spawn a target application and list available scripts.

```renef
renef> spawn com.example.app
renef> l scripts/ssl_unpin.lua
```

--------------------------------

### Build renef-strace

Source: https://renef.io/docs/renef-strace.html

Build the renef-strace binary using make.

```bash
make renef-strace
```

--------------------------------

### Get Java String Length with Jni.getStringLength

Source: https://renef.io/docs/api/hook

This snippet demonstrates how to get the length of a Java String using `Jni.getStringLength`. It takes a raw object pointer or JNI reference to the String.

```lua
local len = Jni.getStringLength(args[1])
print("String length: " .. len)

```

--------------------------------

### Example Security Audit Output

Source: https://renef.io/docs/examples/strace.html

This output shows examples of sensitive file access detected by the security audit tracer. It highlights system calls that matched the defined sensitive paths.

```Log
[SECURITY] [tid:22137] openat(AT_FDCWD, "/proc/self/maps", O_RDONLY, 0644) = 12
[SECURITY] [tid:22137] access("/system/xbin/su", 0) = -1 (No such file or directory)
[SECURITY] [tid:22137] stat("/data/local/tmp/frida-server", 0x7fe42f5488) = -1 (No such file or directory)

```

--------------------------------

### Create Instance and Call Methods in Java

Source: https://renef.io/docs/frida-to-renef.html

Demonstrates creating a StringBuilder instance and appending strings in both Frida and Renef. Note the different syntax for method calls and signature specifications.

```javascript
Java.perform(function() {
    var StringBuilder = Java.use("java.lang.StringBuilder");
    var sb = StringBuilder.$new();
    sb.append("Hello");
    sb.append(" World");
    console.log(sb.toString());
});
```

```lua
local StringBuilder = Java.use("java/lang/StringBuilder")
local sb = StringBuilder:new("()V")
sb:call("append", "(Ljava/lang/String;)Ljava/lang/StringBuilder;", "Hello")
sb:call("append", "(Ljava/lang/String;)Ljava/lang/StringBuilder;", " World")
print(sb:call("toString", "()Ljava/lang/String;"))
```

--------------------------------

### Jni.getStringLength(ref)

Source: https://renef.io/docs/api/hook

Get the length of a Java String.

```APIDOC
## Jni.getStringLength(ref)

### Description
Get the length of a Java String.

### Parameters
* `ref` - Raw object pointer or JNI reference to a String

### Returns
Integer length of the string

### Example
```lua
local len = Jni.getStringLength(args[1])
print("String length: " .. len)
```
```

--------------------------------

### OS.listdir(path)

Source: https://renef.io/docs/api/os.html

List contents of a directory. Entries starting with `.` are excluded.

```APIDOC
## OS.listdir(path)

### Description
List contents of a directory. Entries starting with `.` are excluded.

### Parameters
- **path** (string) - Directory path to list

### Returns
- Table of filename strings, or `nil` if directory cannot be opened
```

--------------------------------

### Jni.getStringUTF(ref)

Source: https://renef.io/docs/api/hook

Get the content of a Java String as a Lua string.

```APIDOC
## Jni.getStringUTF(ref)

### Description
Get the content of a Java String as a Lua string.

### Parameters
* `ref` - Raw object pointer or JNI reference to a String

### Returns
Lua string with the content, or `nil` if invalid

### Example
```lua
local content = Jni.getStringUTF(args[1])
if content then
    print("String content: " .. content)
end
```
```

--------------------------------

### File.fdpath(fd)

Source: https://renef.io/docs/api/file.html

Gets the file path for an open file descriptor.

```APIDOC
## File.fdpath(fd)

### Description
Get the file path for an open file descriptor. This reads `/proc/self/fd/<fd>` symlink.

### Parameters
#### Path Parameters
- **fd** (number) - Required - File descriptor number

### Returns
- **string** - File path as string, or `nil` if fd is invalid
```

--------------------------------

### Remove Hook

Source: https://renef.io/docs/python-binding.html

Removing a previously installed hook using its unique ID.

```python
session.unhook(0)
```

--------------------------------

### session.Thread.id()

Source: https://renef.io/docs/python-binding.html

Gets the ID of the current thread. Returns the thread ID as an integer.

```APIDOC
## `session.Thread.id()`

### Description
Gets the ID of the current thread.

### Returns
- **thread ID** (int) - The ID of the current thread.

### Example
```python
tid = session.Thread.id()
print(f"Thread ID: {tid}")
```
```

--------------------------------

### Renef Command-line Options Overview

Source: https://renef.io/docs/getting-started.html

This section lists the available command-line options for the Renef client. These options control how Renef connects to a device, spawns or attaches to processes, and loads scripts.

```bash
Usage: ./build/renef [options]

Options:
  -s, --spawn <package>    Spawn app by package name
  -a, --attach <pid>       Attach to running process by PID
  -g, --gadget <pid>       Connect to embedded gadget agent (non-root)
  -d, --device <id>        Specify ADB device ID (for multiple devices)
  -l, --load <script>      Load Lua script after connection
  -w, --watch              Enable auto-watch mode after loading script
  -v, --verbose            Show logcat debug output from agent
  --local                  Local mode: connect via UDS directly (for Termux/on-device)
  --hook <type>            Hook engine type: trampoline (default) or pltgot
  -h, --help               Show help message

```

--------------------------------

### Get Current Thread ID

Source: https://renef.io/docs/python-binding.html

Retrieves the unique identifier for the currently executing thread.

```python
tid = session.Thread.id()
print(f"Thread ID: {tid}")

```

--------------------------------

### Manual Build and Push Android Client

Source: https://renef.io/docs/local-mode.html

Manually builds the Android client and pushes the server, client, and agent binaries to the device, setting execute permissions.

```bash
# Build only the Android client
make client-android

# Push manually
adb push build/android/renef_client /data/local/tmp/renef
adb push build/android/renef_server /data/local/tmp/renef_server
adb push build/android/libagent.so /data/local/tmp/libagent.so
adb shell chmod +x /data/local/tmp/renef
adb shell chmod +x /data/local/tmp/renef_server
```

--------------------------------

### Get Target Process ID

Source: https://renef.io/docs/python-binding.html

Accessing the PID of the target process from an active RenefSession.

```python
print(f"Target PID: {session.pid}")
```

--------------------------------

### Trace Syscalls and Watch Output

Source: https://renef.io/docs/api/syscall.html

Demonstrates how to trace specific syscalls and then use the `watch` command to view their output in real-time. This is useful for observing asynchronous syscall behavior.

```javascript
renef> exec Syscall.trace("openat", "read", "write", "close")
Tracing 4 syscall(s)
```

```text
renef> watch
[tid:22137] openat(AT_FDCWD, "/data/data/com.app/config.json", O_RDONLY, 0644) = 5
[tid:22137] read(5</data/data/com.app/config.json>, 0x7183361000, 4096) = 256
[tid:22137] close(5) = 0
# Press 'q' to exit watch
```

```javascript
renef> exec Syscall.stop()
```

--------------------------------

### Attach to Running Process

Source: https://renef.io/docs/python-binding.html

Example of attaching Renef to an already running process using its PID.

```python
session = r.attach(12345)
```

--------------------------------

### Check if Renev Server is Running

Source: https://renef.io/docs/troubleshooting.html

Verify if the renef_server process is active on the device after starting it in the background.

```bash
# Check if running
adb shell "ps | grep renef_server"
```

--------------------------------

### Build Shared Library

Source: https://renef.io/docs/python-binding.html

Instructions to build the shared library 'librenef.so' using CMake and Make.

```bash
cd build
cmake ..
make renef_shared
```

--------------------------------

### OS API

Source: https://renef.io/docs/api

Provides operating system-level functions such as getting process IDs and sending signals.

```APIDOC
## OS API

### Description
Provides operating system-level functions such as getting process IDs and sending signals.

### Methods
- OS.getpid(): number
- OS.kill(pid: number, signal: number): boolean
- OS.tgkill(pid: number, tid: number, signal: number): boolean
- OS.listdir(path: string): Array<string>
```

--------------------------------

### Build for Local Deployment

Source: https://renef.io/docs/local-mode.html

Builds and pushes all necessary binaries for local deployment to `/data/local/tmp/`.

```bash
# Build everything for local deployment
make deploy-local
```

--------------------------------

### Spawn Application with PLT/GOT Hooking

Source: https://renef.io/docs/troubleshooting.html

Launch an application and specify PLT/GOT hooking for intercepting dynamic library calls.

```bash
# Use PLT/GOT
spawn com.example.app --hook=pltgot
```

--------------------------------

### Get Active Syscall Trace Count

Source: https://renef.io/docs/api/syscall.html

This function returns the number of syscall traces that are currently active.

```javascript
Syscall.active()
```

--------------------------------

### Manual Deployment to Android

Source: https://renef.io/docs/installation.html

Manually push the server and payload binaries to the device using ADB and set execute permissions.

```bash
adb push build/android/renef_server /data/local/tmp/
adb push build/android/libagent.so /data/local/tmp/.r
adb shell chmod +x /data/local/tmp/renef_server
adb shell chmod +x /data/local/tmp/.r

```

--------------------------------

### Read Memory

Source: https://renef.io/docs/python-binding.html

Example of reading a 32-bit unsigned integer from a specific memory address using the Memory API.

```python
val = session.Memory.read_u32(0x12345678)
```

--------------------------------

### Get Module Exports

Source: https://renef.io/docs/python-binding.html

Fetches exported symbols from a specified module. Useful for finding function entry points.

```python
exports = session.Module.exports('libc.so')
for e in exports[:10]:
    print(f"0x{e['offset']:x} {e['name']}")

```

--------------------------------

### CLI: Using Built-in Gadget Mode

Source: https://renef.io/docs/frida-to-renef.html

Attach to a process using Renef's built-in gadget mode.

```bash
./renef -g <pid>
```

--------------------------------

### Get Thread ID

Source: https://renef.io/docs/python-binding.html

Retrieving the ID of the current thread within the target process using the Thread API.

```python
tid = session.Thread.id()
```

--------------------------------

### Set NDK Path for Build

Source: https://renef.io/docs/troubleshooting.html

Ensure the NDK environment variable is correctly set to the path of your Android NDK installation.

```bash
# Missing NDK
export NDK=$HOME/Library/Android/sdk/ndk/26.3.11579264
```

--------------------------------

### Match Mangled C++ Symbols

Source: https://renef.io/docs/api/module.html

Use pattern matching with `string.find` to locate mangled C++ symbols, such as those starting with `do_dlopen`.

```lua
if sym.name:find("do_dlopen") then  -- matches __dl__Z9do_dlopenPKc...
```

--------------------------------

### Spawn Application with Default Hooking

Source: https://renef.io/docs/troubleshooting.html

Launch an application using the default trampoline hooking method.

```bash
# Use trampoline (default)
spawn com.example.app
```

--------------------------------

### Get Thread Backtrace

Source: https://renef.io/docs/python-binding.html

Obtains the stack backtrace for the current thread, showing the call sequence leading to the current point.

```python
frames = session.Thread.backtrace()
for frame in frames:
    print(frame)

```

--------------------------------

### Basic Radare2 Commands on Live Process

Source: https://renef.io/docs/r2renef.html

Demonstrates common Radare2 commands for interacting with a live Android process via r2renef, including seeking to addresses, disassembling, hex dumping, and searching.

```r2
# Seek to an address
[0x00000000]> s 0x7f8a1c000

# Disassemble 20 instructions
[0x7f8a1c000]> pd 20

# Print 64 bytes hex dump
[0x7f8a1c000]> px 64

# Disassemble current function
[0x7f8a1c000]> pdf

# Search for hex pattern
[0x7f8a1c000]> /x 504b0304

# Write bytes
[0x7f8a1c000]> w \x1f\x20\x03\xd5

```

--------------------------------

### Get Module Symbols

Source: https://renef.io/docs/python-binding.html

Retrieves all symbols (including local and exported) from a module. Returns a list of dictionaries with offset and name.

```python
symbols = session.Module.symbols('libc.so')

```

--------------------------------

### Deploy renéf Server and Payload

Source: https://renef.io/docs/installation.html

Use 'make deploy' to build and push the server binary and agent payload to the Android device's /data/local/tmp/ directory.

```bash
make deploy

```

--------------------------------

### AI Command Execution with Target Process

Source: https://renef.io/docs/commands/ai.html

Demonstrates how the AI can execute Renef commands to gather information from an attached target process and generate scripts.

```bash
renef> ai bypass root detection
[AI] Provider: OpenAI (gpt-4o)
[AI] Thinking...
[AI] exec: print(Module.list())
[AI] result: libc.so, libssl.so, libapp.so...
[AI] exec: for _,e in ipairs(Module.exports("libapp.so")) do print(e.name) end
[AI] result: Java_com_example_RootCheck_isRooted...

─── AI Response ───
Based on the analysis...

─── Extracted Script ───
hook("com/example/RootCheck", "isRooted", "()Z", {
    onLeave = function() return false end
})
```
Tokens:
Raw