TL;DR

  • Start with traffic interception; it gives the biggest return fastest.
  • Don’t fight the tooling—keep a repeatable baseline setup.
  • Document every device/emulator change (you will forget).

Baseline steps

  1. Create an emulator with Google APIs.
  2. Configure system proxy to your interception proxy.
  3. Verify you can capture HTTPS traffic (cert + trust).
  4. Add Frida only when you need to bypass pinning or inspect behavior.

Useful checks

# verify proxy is reachable
curl -I http://127.0.0.1:8080