Connecting to the patched apk via the network

[ChillVibesMushroom]

I have successfully patched the apk using

objection patchapk --source AndroGoat.apk --skip-resources --ignore-nativelibs

while connected to usb I perform a stream install onto the device and then connect to the frida gadget so the app loads

./adb install -r /home/ronin/objection/AndroGoat.objection.apk
Performing Streamed Install
Success

objection explore

but when I run

objection --network --host 192.168.1.82 explore

I get this error

Using networked device @192.168.1.61:27042
Unable to connect to the frida server: unable to connect to remote frida-server

and Im not trying to connect to the frida server Im trying to connect to the frida gadget

[Mehrdoost]

hey @ChillVibesMushroom , this is a common confusion with objection’s networking flags. The --network flag is for connecting to a remote frida-server running on a device (likefrida-serverstarted on a rooted phone). When you patch an APK with objection patchapk, you’re embedding a frida gadget inside the app. The gadget doesn’t automatically listen on TCP unless you tell it to—by default, it listens on a Unix domain socket (when the app starts via USB) or via a local abstract socket. That’s why objection explore works over USB but --network fails with “unable to connect to remote frida-server”: objection is looking for frida-server, not your gadget.

To connect to the gadget over the network, you need two things:

Make the gadget listen on a TCP port. When you patch the APK, you can provide a configuration file to the gadget. Create a libgadget.config.json (or whatever name) with something like:

{
  "interaction": {
    "type": "listen",
    "address": "0.0.0.0:27042",
    "on_load": "resume"
  }
}

Then patch using:
objection patchapk --source AndroGoat.apk --skip-resources --ignore-nativelibs --gadget-config libgadget.config.json
(The flag --gadget-config is available in recent objection versions; if not, you can manually place the config file in the APK’s lib/ folder as libgadget.config.so.)

Connect using frida directly (or objection’s gadget flag). Once the patched APK is installed and running, you can connect with:

frida -H 192.168.1.61:27042
(frida will auto-detect the gadget). With objection, you can try:
objection --gadget 192.168.1.61:27042 explore
(I’m not 100% sure objection still has that flag—if it doesn’t, just use frida to attach and then you can inject objection’s agent manually: frida -H 192.168.1.61:27042 -l ~/.objection/agent.js)

If you don’t want to patch a config, you can also push a libgadget.config.so file into the app’s data directory after installation (if the gadget is loaded from there), but patching with config is cleaner.

The error you’re seeing is literally objection shouting “I can’t find frida-server”. Ignore it and just focus on getting the gadget to listen on TCP. Let me know if you run into firewall issues on the device—sometimes the port isn’t reachable unless you adb forward, but once you move to WiFi you’re golden.

[ChillVibesMushroom]

I followed the steps provided above and ran into an error where the app won't install on my phone here is what objection looks like

Using latest Github gadget version: 17.15.3
Remote FridaGadget version is v17.15.3, local is v17.5.1. Downloading...
Downloading from: https://github.com/frida/frida/releases/download/17.15.3/frida-gadget-17.15.3-android-arm64.so.xz
Downloading arm64-v8a library to /home/paquee/.objection/android/arm64-v8a/libfrida-gadget.so.xz...
Unpacking /home/paquee/.objection/android/arm64-v8a/libfrida-gadget.so.xz...
Cleaning up downloaded archives...
Patcher will be using Gadget version: 17.15.3
Detected apktool version as: 2.12.1
Running apktool empty-framework-dir...
I: Removing framework file: 1.apk
Unpacking AndroGoat.apk
App already has android.permission.INTERNET
Target class not specified, searching for launchable activity instead...
Smali not found in smali directory. This might be a multidex APK. Searching...
Found smali at: /tmp/tmpgmxbqqy5.apktemp/smali_classes2/owasp/sat/agoat/SplashActivity.smali
Reading smali from: /tmp/tmpgmxbqqy5.apktemp/smali_classes2/owasp/sat/agoat/SplashActivity.smali
Injecting loadLibrary call at line: 31
Attempting to fix the constructors .locals count
Current locals value is 0, updating to 1:
Writing patched smali back to: /tmp/tmpgmxbqqy5.apktemp/smali_classes2/owasp/sat/agoat/SplashActivity.smali
Creating library path: /tmp/tmpgmxbqqy5.apktemp/lib/arm64-v8a
Copying Frida gadget to libs path...
Adding a gadget configuration file...
Rebuilding the APK with the frida-gadget loaded...
Built new APK with injected loadLibrary and frida-gadget
Performing zipalign
Zipalign completed
Signing new APK.
Signed the new APK

[ChillVibesMushroom]

I can confirm running this command alone does patch the apk and objection is working normally

objection patchapk --source AndroGoat.apk

my version of objection is objection: 1.12.5