Traditional Frida workflows often rely on assumptions that don't hold across all modern mobile applications. This talk explores experimental instrumentation techniques for investigating applications when conventional approaches fail, with the goal of understanding application behaviour rather than simply bypassing protections.

Topics include bypassing certificate pinning by replacing strings in memory, locating X509 certificate structures by working backwards from trusted CA names, and introducing Frimon - a tool built on Frida's eBPF tracer that adapts ideas from Procmon to complement frida-discover and frida-trace. The talk also explores instrumenting application UIs and WebViews, and discusses the challenges posed by frameworks such as Flutter and React Native/Hermes. Each technique is introduced from first principles before a technical deep dive, a (hopefully live) demonstration, and a discussion of its applicability and drawbacks.