Downgrade Frida Version on iOS Devices

Description

Downgrading Frida may be necessary due to compatibility issues with certain tools, such as Objection, or when performing FairPlay decryption using frida-ios-dump. These tools often depend on specific Frida versions (e.g., 16.1.4) to function correctly. While 16.1.4 is a commonly recommended version, you can install any version known to be compatible with your workflow. 

Notes: 

  • For Objection and frida-ios-dump, version 16.1.4 is widely reported to be stable. 
  • Always verify compatibility with your toolset before downgrading. 
  • For rootless jailbreaks, all paths are under /var/jb/ instead of /. 

Proof of Concept

Step 1 – SSH into the Device 
ssh mobile@<IP_Address> 
You can find your device’s IP address in Settings Wi-Fi (Connected Network) IP Address. 

Step 2 – Escalate Privileges
sudo su

Step 3 – Install Required Packages 
apt install wget

Step 4 – Create and Run The Downgrade Script
Check the current Frida version:
frida-server –version

Create the script: 
apt install nano

nano frida_update.sh

Copy the appropriate downgrade script (Rootful or Rootless) into the file.

chmod u+x frida_update.sh
./frida_update.sh 16.1.4

frida-server –version

Downgrade Scripts

				
					Rootful:
#!/bin/bash
FRIDA_VER=$1
# contains plist
cd /Library/LaunchDaemons/
# move plist to root
mv re.frida.server.plist ~
cd ~
# unload service
launchctl unload re.frida.server.plist
# stash plist
mv re.frida.server.plist /Library/LaunchDaemons
mv /Library/LaunchDaemons/re.frida.server.plist /Library/LaunchDaemons/re.frida.server.backup
# fetch FRIDA
wget -O /tmp/frida_${FRIDA_VER}_iphoneos-arm.deb https://github.com/frida/frida/releases/download/${FRIDA_VER}/frida_${FRIDA_VER}_iphoneos-arm.deb
# update server, agent and plist
dpkg -i /tmp/frida_${FRIDA_VER}_iphoneos-arm.deb
# restore plist
mv /Library/LaunchDaemons/re.frida.server.backup /Library/LaunchDaemons/re.frida.server.plist
# launch service using new plist
launchctl load /Library/LaunchDaemons/re.frida.server.plist
# delete package
rm /tmp/frida_${FRIDA_VER}_iphoneos-arm.deb

				
			
				
					Rootless:
#!/bin/bash
FRIDA_VER=$1
# contains plist
cd /var/jb/Library/LaunchDaemons/
# move plist to root
mv re.frida.server.plist ~
cd ~
# unload service
launchctl unload re.frida.server.plist
# stash plist
mv re.frida.server.plist /var/jb/Library/LaunchDaemons
mv /var/jb/Library/LaunchDaemons/re.frida.server.plist /var/jb/Library/LaunchDaemons/re.frida.server.backup
# fetch FRIDA
wget -O /tmp/frida_${FRIDA_VER}_iphoneos-arm64.deb https://github.com/frida/frida/releases/download/${FRIDA_VER}/frida_${FRIDA_VER}_iphoneos-arm64.deb
# update server, agent and plist
dpkg -i /tmp/frida_${FRIDA_VER}_iphoneos-arm64.deb
# restore plist
mv /var/jb/Library/LaunchDaemons/re.frida.server.backup /var/jb/Library/LaunchDaemons/re.frida.server.plist
# launch service using new plist
launchctl load /var/jb/Library/LaunchDaemons/re.frida.server.plist
# delete package
rm /tmp/frida_${FRIDA_VER}_iphoneos-arm64.deb

				
			
Reference: