MultiApp assist32-release_2201

Frequently Asked Questions

Q1. What is the path to the data directories inside Multi App?

A1. To access data for all profiles in Multi App, add these bookmarks:

· Root data:
/data/data/com.waxmoon.ma.gp/rootfs/data/user

· Android data (external storage):
/storage/emulated/0/Android/data/com.waxmoon.ma.gp/rootfs/storage/emulated

Q2. Why am I getting "Directory access denied"?

A2. Clone any file manager inside Multi App, then open that cloned file manager from within Multi App and navigate to the bookmarks above.
If you try to access these paths from a file manager outside Multi App, you will get a permission denied error.

Q3. Why can't I set up Termux inside Multi App?

A3. If you need Termux for Frida Gadget's listen mode, you must run Termux outside Multi App, not inside the container.

Q4. Why isn't ProxyPin (or similar apps) working inside Multi App for traffic interception?

A4. For intercepting traffic, you need to run proxy apps like ProxyPin outside Multi App.

Q5. I'm getting "Google Play services missing" or "out of date" errors. What to do?

A5. Inside Multi App, tap the plus (+) icon, then:

· Tap "Install Google Suite" to enable Play Services.
· Also, don't forget to tap "Enable Google Installer" to bypass the installer check.

App Name: Multi App: Dual Space
Version: 3.0.2(30002)
ABI: arm64-v8a
Status: Patched

Play Store Link:
https://play.google.com/store/apps/details?id=com.waxmoon.ma.gp

Patch Info:
- VIP Activated
- Play Store Login Support
- dexdumper and il2cppdumper Implemented
- Necessary Permissions Added

Clone the app or game whose dex files or il2cpp you want to dump into the Multi App, and run it once inside the Multi App. The dex and dump.cs files will be dumped and automatically saved.

The configuration file and all dumped dex files will be found at the following location:
/storage/emulated/0/Android/data/com.waxmoon.ma.gp/rootfs/storage/emulated/0/dex_dump/

For the dump.cs:
/storage/emulated/0/Android/data/com.waxmoon.ma.gp/rootfs/storage/emulated/0/il2cpp_dump/

Here, emulated/0 is for the first user ID. For the second or multiple cloned apps, the user ID will change accordingly.

Frequently Asked Questions
https://t.me/waxmoon_ma/8

How to use Frida in Multi App

1. Install Multi App’s Frida mode from here: @waxmoon_ma

2. Inside the Multi App, clone the target app.

3. In the target app’s files directory /data/data/com.waxmoon.ma.gp/rootfs/data/user/<user_id>/<target_pkg>/files create a secenv folder.

Let’s break down the syntax of the following path: /data/data/com.waxmoon.ma.gp/rootfs/data/user/<user_id>/<target_pkg>/files

a. Static Prefix: /data/data/com.waxmoon.ma.gp/rootfs/data/user/ This portion remains the same in all cases.
b. <user_id>: This represents the profile number. In multi‑app environments (which allow cloning apps), every time you clone an app, the profile number increments starting from 0.
For example, the first clone of any app (say, Telegram) gets profile ID 0, the second clone gets ID 1, and so on.
c. <target_pkg>: This is where you put the actual package name of the target app.
For instance, Telegram’s package name is org.telegram.messenger.
d. Example: If you create the first clone of Telegram using Multi App, the real path to its files directory would be: /data/data/com.waxmoon.ma.gp/rootfs/data/user/0/org.telegram.messenger/files

Logical Path for Telegram: /data/data/com.waxmoon.ma.gp/rootfs/data/user/0/org.telegram.messenger/files/secenv

3.1. Inside Multi App clone any file manager and navigate to this location inside Multi App using any file manager. (Outside the Multi App, you will face permission issues.)

4. Place the gadget files in this folder
- libsecure-env.so (Frida Gadget)
- libsecure-env.config.so (Frida Config)
- libsecure-env-script.so (Frida Script)
(Make sure that in the config file, the script name is kept the same)

You can download gadget files from here for testing:
https://t.me/fileshare_tg/322

5. Run the target app.

6. If the gadget does not load, force stop the target app and then launch it again.

If you still don’t understand the point, then copy this post and ask your preferred AI to explain it.

App Name: Multi App: Dual Space
Version: 3.0.2(30002)
ABI: arm64-v8a
Status: Patched

Play Store Link:
https://play.google.com/store/apps/details?id=com.waxmoon.ma.gp

Patch Info:
- VIP Activated
- Play Store Login Support
- Necessary Permissions Added
- FridaBridge Implemented

How to run Frida inside Multi App
https://t.me/waxmoon_ma/28

👉 Frida-Bridge
https://github.com/muhammadrizwan87/frida-bridge.git

Frequently Asked Questions
https://t.me/waxmoon_ma/8

How Does Frida AES Crypto Logger Work

When any app encrypts or decrypts data, the Frida AES Crypto Logger captures the important details of that process (such as the encryption key, IV, encrypted data, and decrypted text) and saves them into a file.

Note: Remember, using Frida AES Crypto Logger does not require the device to be rooted. Even repacking the APK is not necessary.

1. Frida AES Crypto Logger
https://t.me/fileshare_tg/335
2. Script Details
https://t.me/fileshare_tg/336
3. Multi App Frida_Mode v6 (No Root)
https://t.me/waxmoon_ma/29
4. How to use Frida in Multi App
https://t.me/waxmoon_ma/28

✄----------------------------------------
frida-bridge: Loads Frida Gadget into target app, no root, no repacking, even inside containers.
github.com/muhammadrizwan87/frida-bridge

App Name: Multi App: Dual Space
Version: 3.0.2(30002)
ABI: arm64-v8a
Status: Patched

Play Store Link:
https://play.google.com/store/apps/details?id=com.waxmoon.ma.gp

Patch Info:
- VIP Activated
- Play Store Login Support
- Necessary Permissions Added
- Xposed Modules Added
(Using This Manager: https://github.com/JingMatrix/LSPatch)

With Xposed modules, these features will apply to all cloned apps:
- SSL Pinning Bypassed (will not work on Flutter apps)
- VPN Detection Bypassed (Proxy detection bypass not included)
- Mock Location Bypassed

Note: Patched APKs with LSPosed does not work properly on every Android version or ROM. So, on devices where it works, users can enjoy it. Also, there is no need to bypass Developer/ADB settings, Installer check, or Flag Secure, because the developer has already applied these patches.

Multi App v3.0.2 has been updated

It is available in three variants:
1. Dumpers mode
https://t.me/waxmoon_ma/27
2. Frida mode
https://t.me/waxmoon_ma/29
3. Xposed mode
https://t.me/waxmoon_ma/31

Patched by Marc Nin. ❤️

There are some changes in the new version that need attention:
1. Even after clicking "Install Google Suite", the Play Store will not be visible. To make it visible, click the three dots on the top right and then click "Display hidden apps".

2. If you need to bypass Google policies and restrictions, follow these steps:
a. Click the three dots on the top right.
b. Click "About us".
c. Click the "Developer" option 7–8 times.
d. Type WaxMoon and click the "confirm" button.
This will activate Test mode.

3. For Termux compatibility, follow these steps:
a. Long press on the Termux app.
b. Click on the more button.
c. In the Select app launch mode section, click on L2 or L3.
d. Click on the Open button.

Note: If you click the more button in the launch mode, you will also get extra features.

Two new issues have been fixed in the Multi App v2. So don't forget to reinstall.

1. Remote config has been removed. Cloned apps will no longer have launch problems.
2. Offline launching capability has also been added.

Fixed by Marc Nin. ❤️

Technical Question: Is it possible to bypass SSL pinning on non-rooted devices without a PC/ADB and without repacking the target APK?

Technical Answer: Yes. The combination of frida-bridge + frida-hook-engine makes this possible. Even if the user is not familiar with Frida installation, script writing, or agent compilation, they can still bypass SSL pinning on non-rooted devices without a PC/ADB and without repacking the target APK.

frida-bridge:
https://github.com/muhammadrizwan87/frida-bridge

frida-hook-engine:
https://github.com/muhammadrizwan87/frida-hook-engine

Workflow:

1. Download the frida-bridge-implemented Multi App from here:
https://t.me/waxmoon_ma/29

2. Download the frida-hook-engine files from here:
https://t.me/fileshare_tg/371

3. See instructions on where and how to extract the frida-hook-engine files here:
https://t.me/waxmoon_ma/28

4. To activate the module you want, open libsecure-env.config.so and set the module to true according to your requirement. For example, change "sslPinningBypassEnabled": false, to "sslPinningBypassEnabled": true,. For details on setting up the config file, visit:
https://github.com/muhammadrizwan87/frida-hook-engine/blob/main/docs/configuration.md

5. Watch this video for the PoC:
https://t.me/fileshare_tg/373

Using frida-hook-engine with zero effort is now easy, whether the device is rooted or non-rooted. The RevEngi team has also added the engine in their new update. We sincerely thank the entire RevEngi team. Your contribution will be remembered in the reverse engineering communities. ❤️‍🔥

Steps:

1. Upload your APK file to @RevEngiBot.
2. Quote the uploaded APK and send the /inject command to the bot.
3. A menu will open, select Frida Hook Engine.
4. As soon as you select Frida Hook Engine, another menu will open with 21 modules. Select the hook you want to apply, then click the Apply button at the end.
5. The bot will return a patched version of your APK, which will be unsigned. Sign the APK and enjoy Frida's advantages with zero effort.

Zero effort: Means there's no need to manually inject the Frida gadget, write scripts, or compile agents.

Happy Hooking & Happy Reverse Engineering! 🚀