We built our own hooking engine. Frida's still in the box.
Here's a moment anyone who does mobile work will recognize. You've got a hardened payments app on the bench. You attach Frida, start poking at its root check, and the app just… dies. No crash dialog. No stack trace. It noticed something it didn't like and took itself out. You check the logs and there's barely anything there.
Let's be clear up front: Frida is excellent. It's one of the best tools in the business, we use it constantly, and Rutken ships it free in the Community tier. For the vast majority of dynamic work (attach, hook a method, read the arguments, watch the traffic) it's exactly what you want, and reaching for anything heavier would be showing off.
But "vast majority" isn't "all." And the apps you most want to look at are precisely the ones that fight back.
Where Frida runs out of road
The trouble is that injected instrumentation has a shape, and a shape can be fingerprinted. A gum runtime riding alongside the app leaves traces: memory it maps, threads it spawns, files it touches, timing it skews. A well-defended app looks for exactly those tells and, when it finds them, it doesn't pop an alert. It corrupts its own state and crashes, or quietly refuses to do the one thing you were trying to observe. You end up debugging the defense instead of the app.
There are softer problems too. Plenty of targets resist repackaging, so the "patch the APK and resign it" route is off the table. And when you lean your whole workflow on someone else's runtime, you inherit their roadmap, a point we felt the hard way when a Frida release reorganized its Java bridge and took a pile of our scripts with it. None of this is a knock on the project. It's just the reality of general-purpose tooling meeting purpose-built defenses.
So we built our own
The brief was simple to say and annoying to do: an in-house hooking engine that gets onto a target without repackaging it, leaves a smaller footprint than a general-purpose runtime, and keeps working on the hardware and the hardened apps where off-the-shelf injection gets caught. We wrote our own instruction encoding and our own delivery path rather than wrapping an existing one, because the whole point was to not look like the thing everyone's defenses are already watching for.
The bar we set ourselves was blunt: it has to match or beat Frida on the cases that matter, or there's no reason for it to exist. If a target is easy, Frida handles it and we don't bother. The in-house engine is for the ones that aren't.
The app that killed itself, and then didn't
Back to that payments app. Its integrity check, when it decided it was being tampered with, routed into a deliberate self-destruct, a divide-by-zero it triggered on purpose to bring the process down and deny you the session. Classic anti-tamper: don't argue with the attacker, just leave.
We hooked the point where that check throws, caught the throw before it reached the kill path, and the app kept running. Then we did the boring, important part: ran it clean, ran it with the hook, ran it clean again, and watched the self-kill fire, not fire, then fire again right on cue. The intervention was the variable. That's the difference between "we think we bypassed it" and "here's the A/B/A that proves we did."
What it actually buys you
Once you're reliably inside a hardened target without repacking it, a lot opens up. You can change what the app sees at runtime (flip a field, rewrite a method's return value, overwrite a local variable mid-execution) and watch how the logic downstream reacts. That's how a static finding stops being a maybe. The analyzer says "this value gates the root check"; the engine lets you force it and confirm the gate opens on a real device. Finding, then proof, in the same tool.
Why this is the paid part
We're not coy about it. Everything Frida-based in Rutken (live capture, TLS unpinning, interception, repeater) is free, because it runs on your machine and costs us nothing to give you, and because a tool you can't try isn't a tool. The in-house engine is what the paid tiers add, and now you know what you're paying for: not a longer feature list, but the specific, hard-won ability to get onto the targets that throw Frida off and prove out what you found.
If you want the free half, grab Rutken and start capturing traffic in a few minutes. If you've got an app that keeps dying the moment you look at it, that's the half we built for you. The tiers are laid out here, in plain language, with the engine broken out so you can see exactly what it does.