Enumerate exports for the given module name or pointer
an hex/int address or string name
Enumerate imports for the given module name or pointer
an hex/int address or string name
Enumerate java classes
false by default
Enumerate method for the given class
Enumerate all information about the module (imports / exports / symbols)
object from frida-gum
Enumerate loaded modules
Enumerate objc classes
Enumerate method for the given class
Enumerate modules for ObjC inspector panel
Enumerate all mapped ranges
Enumerate symbols for the given module name or pointer
an hex/int address or string name
Evaluate javascript. Used from the UI to inject javascript code into the process
Evaluate javascript. Used from the UI to inject javascript code into the process
Evaluate any input and return a NativePointer
Shortcut to quickly retrieve an export
const openAddress = findExport('open');
const myTargetAddress = findExport('target_func', 'target_module.so');Find a module providing any argument. Could be a string/int pointer or module name
Find a symbol matching the given pattern
get telescope information for the given pointer argument
Return an array of DebugSymbol for the requested pointers
Shortcut to retrieve an Instruction object for the given address
Return a RangeDetails object or null for the requested pointer
Return DebugSymbol or null for the given pointer
Hook all the methods for the given java class
hookAllJavaMethods('android.app.Activity', function() {
console.log('hello from:', this.className, this.method);
})Receive a callback whenever a java class is going to be loaded by the class loader.
hookClassLoaderClassInitialization('com.target.classname', function() {
console.log('target is being loaded');
})Hook the constructor of the given java class
hookJavaConstructor('android.app.Activity', function() {
console.log('activity created');
})Hook the constructor of the given java class
hookJavaConstructor('android.app.Activity.onCreate', function() {
console.log('activity created');
var savedInstanceState = arguments[0];
if (savedInstanceState !== null) {
return this.finish();
} else {
return this.overload.call(this, arguments);
}
})Receive a callback when the native module is being loaded
hookModuleInitialization('libtarget.so', function() {
console.log('libtarget is being loaded');
});Map the given blob as hex string using memfd:create with the given name
a negative integer if error or fd
a boolean indicating if the given pointer is currently watched
a java stack trace. Must be executed in JVM thread
the explorer object for the given java handle
log whatever to Dwarf console
put a breakpoint on a native pointer or a java class with an optional evaluated condition
var nativeTarget = findExport('memcpy');
putBreakpoint(nativeTarget);
nativeTarget = findExport('open');
putBreakpoint(target, function() {
if (this.context.x0.readUtf8String().indexOf('prefs.json') >= 0) {
return true;
}
return false;
});
var javaTarget = 'android.app.Activity.onCreate';
putBreakpoint(javaTarget);Put a java class initialization breakpoint
putJavaClassInitializationBreakpoint('android.app.Activity');Put a native module initialization breakpoint
putModuleInitializationBreakpoint('libtarget.so');Put a watchpoint on the given address
putWatchpoint(0x1000, 'r');
var target = findExport('memcpy');
Interceptor.attach(target, {
onLeave: function(ret) {
putWatchpoint(this.context.x0, 'rw', function() {
log(backtrace(this.context));
});
}
});A shortcut for safely reading from memory
an ArrayBuffer of the given length filled with data starting from target address
a pointer from the given address
A shortcut and secure way to read a string from a pointer with frida on any os
the string pointed by address until termination or optional length
resume the execution of the given thread id
Remove a breakpoint on address_or_class
a boolean indicating if removal was successful
Remove a java class initialization breakpoint on moduleName
a boolean indicating if removal was successful
Remove a module initialization breakpoint on moduleName
a boolean indicating if removal was successful
Remove a watchpoint on the given address
a boolean indicating if removal was successful
Restart the application
Android only
Send whatever to the data panel
var sendCount = 0;
Interceptor.attach(findExport('send'), function() {
setData(sendCount + '', this.context.x1.readByteArray(parseInt(this.context.x2)))
sendCount++;
});Start the java tracer on the given classes
Start the native tracer on the current thread
startNativeTracer(function() {
log('===============');
log(this.instruction);
log(this.context);
log('===============');
if (shouldStopTracer) {
this.stop();
}
});Stop the java tracer
start strace
Write the given hex string or ArrayBuffer into the given address
Shortcut to retrieve native backtrace