r0capture is a packet capture tool for Android that intercepts application-layer network traffic on rooted devices.
The tool solves the problem of capturing encrypted and obfuscated network traffic from Android applications by using Frida to hook into system-level SSL/TLS functions and socket operations. It works by injecting a Frida script into running Android processes to intercept all application-layer protocols including HTTP, WebSocket, FTP, XMPP, IMAP, SMTP, and Protocol Buffers, along with their encrypted variants. The approach bypasses certificate pinning and app obfuscation, capturing traffic regardless of which HTTP framework the application uses, such as HttpUrlConnection, OkHttp, Retrofit, or Volley.
The tool is designed for security researchers and developers analyzing Android applications on rooted devices running Android 7 through 16. It suits penetration testing, reverse engineering, and security auditing workflows where understanding application network behavior is necessary. The tool operates in two modes: spawn mode, which launches an application fresh under instrumentation, and attach mode, which hooks into already-running processes. Captured traffic can be exported to PCAP format for analysis in Wireshark. Additional capabilities include locating the functions responsible for sending and receiving packets within an application and exporting client-side certificates when applications implement mutual TLS authentication.
Development activity shows ongoing maintenance with updates addressing compatibility across multiple Android versions and Frida releases. The project accepts issue reports and direct feedback from users encountering applications that resist capture. Auxiliary features have been added incrementally, including packet function localization and certificate export functionality. The tool includes configuration options for non-standard Frida server ports to evade detection mechanisms that monitor the standard Frida listening port.
