### Compile and Install r2frida

Source: https://github.com/nowsecure/r2frida/blob/master/README.md

Compile r2frida from source and install it. This involves cloning the repository, running make, and then performing a user installation.

```sh
$ git clone https://github.com/nowsecure/r2frida.git
$ cd r2frida
$ make
$ make user-install
```

--------------------------------

### Install r2frida-objection Plugin

Source: https://github.com/nowsecure/r2frida/blob/master/plugins/objection/README.md

Install the r2frida-objection plugin locally using make or via the r2pm package manager.

```bash
make user-install
```

```bash
r2pm -ci r2frida-objection
```

--------------------------------

### Install r2frida using r2pm

Source: https://github.com/nowsecure/r2frida/wiki/Introduction

Use the r2 package manager to install the r2frida plugin.

```bash
r2pm -ci r2frida
```

--------------------------------

### Spawn and Launch a New Process

Source: https://github.com/nowsecure/r2frida/blob/master/doc/fortunes.txt

Start a new process. Use 'spawn' to create it and wait, or 'launch' to create and immediately resume execution.

```shell
r2 frida://spawn/program
```

```shell
r2 frida://launch/program
```

--------------------------------

### Launch an app

Source: https://github.com/nowsecure/r2frida/wiki/Introduction

Launch an application, resuming it after spawning. This is useful for starting an application and immediately beginning analysis. You can specify the device ID or omit it.

```bash
r2 frida://launch/usb/device-id/bundle-id
```

```bash
r2 frida://launch/usb//bundle-id
```

--------------------------------

### Build r2frida Agent

Source: https://github.com/nowsecure/r2frida/blob/master/AGENTS.md

Use this command for the initial build of the r2frida agent. Ensure you have the necessary dependencies installed.

```shell
./configure && make -j && make user-install
```

--------------------------------

### Output Target Information in r2 Format (:i*)

Source: https://context7.com/nowsecure/r2frida/llms.txt

Get target process information formatted as r2 configuration commands, useful for importing settings.

```r2
:i*
```

--------------------------------

### List Apps on First USB Device with r2frida

Source: https://context7.com/nowsecure/r2frida/llms.txt

List all installed applications on the first detected USB device (typically for iOS or Android).

```bash
r2 frida://launch/usb//
```

--------------------------------

### Search for Potential Whitebox Cryptography Implementations

Source: https://github.com/nowsecure/r2frida/wiki/random

This example demonstrates searching for the string 'whitebox', which might indicate the presence of whitebox cryptography implementations.

```shell
[0x00000000]> =!/ whitebox
Searching 8 bytes in [0x0000007fa558c000-0x0000007fa558f000]
Searching 8 bytes in [0x0000007feee1a000-0x0000007fef619000]
hits: 7
0x7f6cf4481d hit1_0 whitebox_damagePKhPhi_Z15whitebox_repairPhS_i_Z16CryptoPP_
0x7f6cf44837 hit1_1 whitebox_repairPhS_i_Z16CryptoPP_GenKeysSs_Z16gen_random_b
0x7f6f27c81d hit1_2 whitebox_damagePKhPhi_Z15whitebox_repairPhS_i_Z16CryptoPP_
0x7f6f27c837 hit1_3 whitebox_repairPhS_i_Z16CryptoPP_GenKeysSs_Z16gen_random_b
0x7f6f8fd4f9 hit1_4 whiteboxed_key_gen.cG[fzM~=)j-#wTOL$C9
0x7f6fa185f0 hit1_5 whiteboxed_key_gen.c=j;h58Z=!^X).ln|
0x7f7dcb7552 hit1_6 whitebox
```

--------------------------------

### Configure r2frida Settings

Source: https://context7.com/nowsecure/r2frida/llms.txt

Use ':e' to list all configuration options. Use ':e <option>=<value>' to set a specific option. Examples include enabling backtraces or setting hook output format.

```bash
# List configuration options
[0x00000000]> :e
e patch.code=true
e search.in=perm:r--
e search.quiet=false
e stalker.event=compile
e stalker.timeout=300
e hook.backtrace=false
e hook.output=text

# Enable backtraces in hooks
[0x00000000]> :e hook.backtrace=true

# Set hook output to JSON format
[0x00000000]> :e hook.output=json
```

--------------------------------

### Test Case Structure

Source: https://github.com/nowsecure/r2frida/blob/master/AGENTS.md

Example structure for defining a test case, including name, target, commands, and expected output.

```shell
NAME=test description
FILE=frida://0
CMDS=<<EOF
:commands_here
EOF
EXPECT=<<EOF
expected_output
EOF
RUN
```

--------------------------------

### Spawn process using absolute path

Source: https://github.com/nowsecure/r2frida/blob/master/README.md

Spawns a new process using the absolute path to its binary. The target program will start executing.

```shell
$ r2 frida:///bin/ls
[0x00000000]> :dc        # continue the execution of the target program
```

--------------------------------

### Allocate Memory on Heap (:dma)

Source: https://context7.com/nowsecure/r2frida/llms.txt

Allocate a specified number of bytes on the target process's heap and return the starting address.

```r2
:dma 512
```

--------------------------------

### Get Target Process Info

Source: https://github.com/nowsecure/r2frida/blob/master/doc/fortunes.txt

Use ':i' to retrieve details about the currently attached process, such as its PID, architecture, and bitness.

```shell
:i
```

--------------------------------

### Install r2frida Dependencies on Debian

Source: https://github.com/nowsecure/r2frida/blob/master/README.md

Install the necessary dependencies for compiling r2frida on Debian-based systems. This includes build tools and libraries.

```sh
$ sudo apt install -y make gcc libzip-dev nodejs npm curl pkg-config git
```

--------------------------------

### Manage Environment Variables

Source: https://context7.com/nowsecure/r2frida/llms.txt

Use ':env' to list all environment variables, get a specific variable, or set a new one. Changes are applied to the target process.

```bash
# List all environment variables
[0x00000000]> :env
PATH=/su/bin:/sbin:/vendor/bin:/system/sbin:/system/bin
ANDROID_ROOT=/system
ANDROID_DATA=/data

# Get specific environment variable
[0x00000000]> :env LD_PRELOAD
LD_PRELOAD=/data/local/tmp/libhook.so

# Set environment variable
[0x00000000]> :env LD_PRELOAD=/data/local/tmp/libhook.so
```

--------------------------------

### Get Frida Version

Source: https://context7.com/nowsecure/r2frida/llms.txt

Use ':?V' to display the Frida version information in JSON format.

```bash
# Show Frida version
[0x00000000]> :?V
{"version":"12.5.3"}
```

--------------------------------

### Manage Evaluable Variables with R2Frida

Source: https://github.com/nowsecure/r2frida/wiki/random

Use the `=!e` command to list, get, or set configuration evaluable variables. This command helps in managing R2Frida's settings.

```bash
[0x00000000]> =!e
e patch.code=true
e search.in=perm:r--
e search.quiet=false
e stalker.event=compile
e stalker.timeout=300
e stalker.in=raw
```

--------------------------------

### Launch and Resume App with r2frida

Source: https://context7.com/nowsecure/r2frida/llms.txt

Launch an application and immediately resume its execution.

```bash
r2 frida://launch/usb//com.apple.weather
```

--------------------------------

### Set and Get Environment Variables with R2Frida

Source: https://github.com/nowsecure/r2frida/wiki/random

Use the `=!env` command to get or set environment variables within the target process. This is useful for configuring the runtime environment.

```bash
[0x00000000]> =!env LD_PRELOAD=/data/local/tmp/libhook.so
LD_PRELOAD=/data/local/tmp/libhook.so
```

```bash
[0x00000000]> =!env LD_PRELOAD
LD_PRELOAD=/data/local/tmp/libhook.so
```

```bash
[0x00000000]> =!env
PATH=/su/bin:/sbin:/vendor/bin:/system/sbin:/system/bin:/su/xbin:/system/xbin
ANDROID_BOOTLOGO=1
ANDROID_ROOT=/system
ANDROID_ASSETS=/system/app
ANDROID_DATA=/data
ANDROID_STORAGE=/storage
EXTERNAL_STORAGE=/sdcard
ASEC_MOUNTPOINT=/mnt/asec
ANDROID_SOCKET_zygote=9
ANDROID_LOG_TAGS=*:s
```

--------------------------------

### Add Basic Function Trace (:dt fopen)

Source: https://context7.com/nowsecure/r2frida/llms.txt

Set up a basic tracepoint on the specified function to log its calls.

```r2
:dt fopen
```

--------------------------------

### Spawn Binary with Arguments using r2frida

Source: https://context7.com/nowsecure/r2frida/llms.txt

Spawn a new process and pass arguments to it by enclosing the command and arguments in quotes.

```bash
r2 frida://"/bin/ls -al"
```

--------------------------------

### Get Address of Export Symbol (:iEa)

Source: https://context7.com/nowsecure/r2frida/llms.txt

Retrieve the memory address of a specific exported symbol from a library.

```r2
:iEa libDexHelper.so JNI_OnLoad
```

--------------------------------

### Trace Function Calls

Source: https://github.com/nowsecure/r2frida/blob/master/doc/fortunes.txt

Monitor calls to a specific function, for example, 'fread', using the ':dt' command.

```shell
:dt fread
```

--------------------------------

### Spawn process with arguments

Source: https://github.com/nowsecure/r2frida/blob/master/README.md

Spawns a new process and passes arguments to it. Ensure arguments are correctly quoted if they contain spaces.

```shell
$ r2 frida://"/bin/ls -al"
```

--------------------------------

### Set Breakpoints and Continue

Source: https://github.com/nowsecure/r2frida/blob/master/doc/fortunes.txt

Place a breakpoint at a specific memory address with ':db 0x<addr>' and resume execution with ':dc'.

```shell
:db 0x<addr>
```

```shell
:dc
```

--------------------------------

### Build r2frida-objection Plugin

Source: https://github.com/nowsecure/r2frida/blob/master/plugins/objection/README.md

Build the r2frida-objection plugin. This process involves downloading Objection, compiling the agent, and concatenating the r2frida-plugin logic.

```bash
> make
.. will download objection ..
.. compile the agent ..
.. concat the r2frida-plugin logic ..
>
```

--------------------------------

### Spawn App by Package Name with r2frida

Source: https://github.com/nowsecure/r2frida/wiki/random

Spawn a new instance of an application using its package name. This method uses two forward slashes to differentiate from attaching to a running app.

```bash
r2 frida://device-id//com.snapchat.android
```

--------------------------------

### Spawn Binary by Absolute Path with r2frida

Source: https://context7.com/nowsecure/r2frida/llms.txt

Spawn a new process by providing the absolute path to the binary.

```bash
r2 frida:///bin/ls
```

--------------------------------

### Import Target Info into r2 (.:i*)

Source: https://context7.com/nowsecure/r2frida/llms.txt

Import the target process information directly into the radare2 environment as configuration settings.

```r2
.:i*
```

--------------------------------

### Inspect Class Information with Frida

Source: https://github.com/nowsecure/r2frida/wiki/info

Use the `:isa` command to get the address of a function or symbol. This is useful for identifying the location of specific code within a process.

```shell
- :isa sprintf
0xf5155885
```

--------------------------------

### List Loaded Libraries (:il)

Source: https://context7.com/nowsecure/r2frida/llms.txt

Display a list of all libraries currently loaded into the target process's memory space.

```r2
:il
```

--------------------------------

### Spawn App Explicitly with r2frida

Source: https://github.com/nowsecure/r2frida/wiki/random

Spawn an application using the explicit 'spawn' keyword, specifying the connection type (usb), device ID, and package name.

```bash
r2 frida://spawn/usb/device-id/com.android.app
```

--------------------------------

### Termux LD_LIBRARY_PATH configuration

Source: https://github.com/nowsecure/r2frida/blob/master/README.md

Configures the `LD_LIBRARY_PATH` environment variable to include system libraries before Termux libraries, necessary for native r2frida installation on Android via Termux.

```shell
$ LD_LIBRARY_PATH=/system/lib64:$LD_LIBRARY_PATH r2 frida://...
```

--------------------------------

### Allocate and Initialize String on Heap (:dmas)

Source: https://context7.com/nowsecure/r2frida/llms.txt

Allocate memory on the heap and initialize it with a given string.

```r2
:dmas r2fridaiscool
```

--------------------------------

### Format Code

Source: https://github.com/nowsecure/r2frida/blob/master/AGENTS.md

Use this make target to format the codebase according to the project's style guidelines.

```shell
make fmt
```

--------------------------------

### List Threads in iOS Process

Source: https://github.com/nowsecure/r2frida/wiki/random

The `=!dpt` command lists the thread IDs (TIDs) of all threads currently running in the iOS process. This is a starting point for thread analysis.

```shell
[0x00000000]> =!dpt
1027
18947
26375
39687
37895
37635
36875
36359
34843
29187
33543
43527
86531
77827
63499
67347
68651
62491
[0x00000000]>
```

--------------------------------

### Dump Memory as Hexdump

Source: https://github.com/nowsecure/r2frida/blob/master/doc/fortunes.txt

Extract and display a portion of memory as a hexdump. Use ':px 64 @ 0x<addr>' to dump 64 bytes starting from the specified address.

```shell
:px 64 @ 0x<addr>
```

--------------------------------

### Load Library Dynamically

Source: https://github.com/nowsecure/r2frida/blob/master/doc/fortunes.txt

Inject and load a shared library into the target process at runtime using ':dl /path/to/lib.so'.

```shell
:dl /path/to/lib.so
```

--------------------------------

### Inspect Classes with r2frida

Source: https://github.com/nowsecure/r2frida/wiki/random

Use the `=!ic` command to list all classes available in the target process. Be aware that this can produce a large output.

```shell
- `=!ic`: List classes
```

```shell
[0x00000000]> =!ic
Do you want to print 5769 lines? (y/N) n
```

--------------------------------

### Connect to Local Session with r2frida

Source: https://context7.com/nowsecure/r2frida/llms.txt

Use this command to connect to a local r2frida session without needing to spawn a separate frida-helper process.

```bash
r2 frida://0
```

--------------------------------

### List Objection Actions

Source: https://github.com/nowsecure/r2frida/blob/master/plugins/objection/README.md

Use the ':objection -a' command to list all available actions, or ':objection' to list known-to-work probes. Specific probes can be executed with ':objection [probename]'.

```bash
:objection -a
```

```bash
:objection
```

```bash
:objection [probename]
```

--------------------------------

### List Imports from a Library (:ii libssl.so~+aes)

Source: https://context7.com/nowsecure/r2frida/llms.txt

List the imported functions from a specific library and filter them by name.

```r2
:ii libssl.so~+aes
```

--------------------------------

### USB debugging actions

Source: https://github.com/nowsecure/r2frida/blob/master/README.md

Performs actions like enumerate devices, enumerate apps, run, or attach to processes on USB-connected devices. Use `spawn`, `launch`, or `attach` as the action.

```shell
$ r2 frida://spawn/usb/         # enumerate devices
```

```shell
$ r2 frida://spawn/usb//        # enumerate apps in the first iOS device
```

```shell
$ r2 frida://spawn/usb//Weather # Run the weather app
```

--------------------------------

### Spawn an app

Source: https://github.com/nowsecure/r2frida/wiki/Introduction

Spawn a new instance of an application using its package name (Android) or bundle ID (iOS). The application will be spawned but not resumed. You can specify the device ID or omit it.

```bash
r2 frida://spawn/usb/device-id/bundle-id
```

```bash
r2 frida://spawn/usb//bundle-id
```

--------------------------------

### List All Protocols in iOS

Source: https://github.com/nowsecure/r2frida/wiki/random

The `=!ip` command lists all Objective-C protocols loaded in the current iOS process. This is helpful for understanding the interfaces and contracts available.

```shell
[0x00000000]> =!ip
GVRenderer
CADSyncInterface
VKMapModelDelegate
SCNPhysicsBehaviorJSExport
GEOMapServiceProblemReportTicket
PXWidgetUnlockDelegate
ICMusicSubscriptionLeaseSessionDelegate
IKJSDOMCharacterData
ACDAccountAuthenticationPlugin
TUIDSLookup
FCOrderedCollectionAdditions
MSSubscribeStreamsProtocolDelegate
_DKEventStatsCounterInternalProperty
FBInterstitialAdNativeViewDelegate
[0x00000000]>
```

--------------------------------

### List All Classes in iOS

Source: https://github.com/nowsecure/r2frida/wiki/random

Use the `=!ic` command to list all Objective-C classes loaded in the current iOS process. This is useful for understanding the application's structure.

```shell
[0x00000000]> =!ic
OS_dispatch_queue_attr
OS_dispatch_group
OS_dispatch_semaphore
OS_dispatch_mach
OS_dispatch_source
OS_dispatch_queue
OS_dispatch_queue_mgr
OS_dispatch_queue_network_event
OS_dispatch_queue_root
OS_dispatch_queue_main
OS_dispatch_queue_concurrent
OS_dispatch_queue_serial
OS_dispatch_queue_runloop
[0x00000000]>
```

--------------------------------

### List Live Heap Allocations (:dmal)

Source: https://context7.com/nowsecure/r2frida/llms.txt

Display a list of currently active (live) memory allocations on the heap.

```r2
:dmal
```

--------------------------------

### Run Tests

Source: https://github.com/nowsecure/r2frida/blob/master/AGENTS.md

Execute the test suite for r2frida using this make target. This helps ensure the integrity of your changes.

```shell
make -C test
```

--------------------------------

### Show Target Information

Source: https://github.com/nowsecure/r2frida/wiki/info

Displays general information about the target system, such as architecture, OS, PID, and UID. Useful for understanding the environment.

```shell
[0x00000000]> :i
arch  arm
bits  64
os  linux
pid  14473
uid  10127
objc  false
java  true
cylang  false
```

--------------------------------

### Trace with Format String

Source: https://context7.com/nowsecure/r2frida/llms.txt

This is a placeholder for a command that would trace a function with a custom format string. The specific command is not provided in the source.

--------------------------------

### List Heap Allocations with r2frida

Source: https://github.com/nowsecure/r2frida/wiki/random

Use `=!dmal` to list all live heap allocations created with `dma[s]`. The output shows the address and a truncated representation of the allocated data.

```shell
[0x00000000]> =!dmal
0xf3d7ee10	"r2fridaiscoolW#re.frida.AgentContro"
```

--------------------------------

### Spawn iOS/Android App by Bundle ID with r2frida

Source: https://context7.com/nowsecure/r2frida/llms.txt

Spawn a specific application on an iOS or Android device using its bundle identifier.

```bash
r2 frida://spawn/usb//com.apple.mobilesafari
```

--------------------------------

### List processes and application identifiers

Source: https://github.com/nowsecure/r2frida/wiki/Introduction

Retrieve a list of running processes and their corresponding application identifiers on a connected device. This is useful for identifying the target process for attachment or spawning.

```bash
r2 frida://launch/usb//
PID           Name Identifier
-----------------------------
-            Books com.apple.iBooks
-           Camera com.apple.camera
-            Clock com.apple.mobiletimer
-         Contacts com.apple.MobileAddressBook
-         FaceTime com.apple.facetime
-            Files com.apple.DocumentsApp
-          Find My com.apple.findmy
-         Freeform com.apple.freeform
-             Home com.apple.Home
-        Magnifier com.apple.Magnifier
-             Mail com.apple.mobilemail
-             Maps com.apple.Maps
-          Measure com.apple.measure
-         Messages com.apple.MobileSMS
-            Music com.apple.Music
-      Photo Booth com.apple.Photo-Booth
-           Photos com.apple.mobileslideshow
-         Podcasts com.apple.podcasts
-        Reminders com.apple.reminders
-           Safari com.apple.mobilesafari
-        Shortcuts com.apple.shortcuts
-           Stocks com.apple.stocks
-               TV com.apple.tv
-             Tips com.apple.tips
-        Translate com.apple.Translate
-      Voice Memos com.apple.VoiceMemos
-          Weather com.apple.weather
-        helloObjC me.murphy.helloObjC.helloObjC
-     iTunes Store com.apple.MobileStore
281       palera1n com.llsc12.palera1nLoader
282      App Store com.apple.AppStore
311          Notes com.apple.mobilenotes
451       Calendar com.apple.mobilecal
2018         Sileo org.coolstar.SileoStore
4376      Settings com.apple.Preferences
4429  syscallstrap me.murphy.syscallstrap
```

--------------------------------

### List Symbols (:is libc.so~sprintf)

Source: https://context7.com/nowsecure/r2frida/llms.txt

List all symbols (local and global) within a specified library and filter the results.

```r2
:is libc.so~sprintf
```

--------------------------------

### r2frida Trace Format Help

Source: https://github.com/nowsecure/r2frida/wiki/random

The `=!dtf?` command displays help for tracing with custom formats. Formats include showing arguments as strings (`z`), integers (`i`), or hexadecimal (`x`), and optionally showing backtraces (`+`).

```shell
[0x00000000]> =!dtf?
Usage: dtf [format] || dtf [addr] [fmt]
  ^  = trace onEnter instead of onExit
  +  = show backtrace on trace
 p/x = show pointer in hexadecimal
  c  = show value as a string (char)
  i  = show decimal argument
  z  = show pointer to string
  s  = show string in place
  O  = show pointer to ObjC object
Undocumented: Z, S
 dtf	trace format
```

--------------------------------

### Continue Execution to See Traces (:dc)

Source: https://context7.com/nowsecure/r2frida/llms.txt

Resume the execution of the target process and display any trace events that occur.

```r2
:dc
```

--------------------------------

### List Exports of a Library (:iE libssl.so~AES)

Source: https://context7.com/nowsecure/r2frida/llms.txt

List the exported functions from a specific library and filter them by name.

```r2
:iE libssl.so~AES
```

--------------------------------

### List USB Devices with r2frida

Source: https://context7.com/nowsecure/r2frida/llms.txt

List all connected USB devices that Frida can interact with.

```bash
r2 frida://launch//
```

--------------------------------

### Attach to a Running Process

Source: https://github.com/nowsecure/r2frida/blob/master/doc/fortunes.txt

Connect to a process that is already running. You can specify the process by its PID or its name.

```shell
r2 frida://pid
```

```shell
r2 frida://processname
```

--------------------------------

### List Libraries

Source: https://github.com/nowsecure/r2frida/wiki/random

Lists all loaded libraries in the target process. Commonly used with r2's internal grep `~` to filter library names.

```shell
[0x00000000]> =!il~+keystore,ssl,crypto
0x0000007f94133000 libcrypto.so
0x0000007f93059000 libssl.so
0x0000007f879d8000 libjavacrypto.so
0x0000007f879d3000 libkeystore-engine.so
0x0000007f87985000 libkeystore_binder.so
0x0000007f5c491000 libvisacrypto.so
```

--------------------------------

### Show Target Information in r2 Format

Source: https://github.com/nowsecure/r2frida/wiki/info

Displays target information in a format suitable for r2 configuration. Useful for scripting or setting up r2 environment variables.

```shell
[0x00000000]> :i*
e asm.arch=arm
e asm.bits=64
e asm.os=linux
```

--------------------------------

### Show Target Information in r2 form

Source: https://github.com/nowsecure/r2frida/wiki/random

Displays target information in r2's configuration format, setting related `asm` options. Useful for configuring r2's analysis.

```shell
[0x00000000]> =!i*
e asm.arch=arm
e asm.bits=64
e asm.os=linux
```

--------------------------------

### Load and Manage Frida Scripts

Source: https://context7.com/nowsecure/r2frida/llms.txt

Use ':.' to load and execute JavaScript/TypeScript scripts. Use ':.' to list loaded plugins and ':.-' to unload a plugin by name.

```bash
# Load a Frida script
[0x00000000]> :. agent.js

# List loaded plugins
[0x00000000]> :.

# Unload a plugin by name
[0x00000000]> :.-test

# Eternalize script (keeps running after detach)
[0x00000000]> :.. agent.js
```

--------------------------------

### Set Breakpoints at Address or Import

Source: https://context7.com/nowsecure/r2frida/llms.txt

Set native breakpoints at a specific memory address or by resolving an import symbol. Use ':db' to list all breakpoints, ':dc' to continue execution, and ':dcu' to continue until a specific address.

```bash
# Set a breakpoint at address
[0x00000000]> :db 0x7f95e19548
```

```bash
# Set breakpoint at import address
[0x00000000]> :db `=!ii libtarget.so~dlsym[0]`
```

```bash
# List all breakpoints
[0x00000000]> :db
{
  "0x7f95e19548": {
    "name": "0x7f95e19548",
    "stopped": true,
    "address": "0x7f95e19548"
  }
}
```

```bash
# Continue execution (resume from breakpoint)
[0x00000000]> :dc
Continue 1 thread(s).
```

```bash
# Continue until address
[0x00000000]> :dcu 0x7f95e20000
```

```bash
# Remove specific breakpoint
[0x00000000]> :db- 0x7f95e19548
```

```bash
# Remove all breakpoints
[0x00000000]> :db-*
All breakpoints removed
```

--------------------------------

### Allocate and Write to Memory

Source: https://github.com/nowsecure/r2frida/blob/master/doc/fortunes.txt

Allocate a specified number of bytes using ':dma 1024' and then write data to that memory location with ':wx deadbeef @ 0x<addr>'.

```shell
:dma 1024
```

```shell
:wx deadbeef @ 0x<addr>
```

--------------------------------

### Attach to Specific Device by ID with r2frida

Source: https://context7.com/nowsecure/r2frida/llms.txt

Attach to a process on a specific device identified by its unique ID.

```bash
r2 frida://attach/usb/14c0ce8df9d2ac3c1c42f17e4c0f5b2acfec3829/Safari
```

--------------------------------

### Trace Native Wrappers with Format and Backtrace in r2frida

Source: https://github.com/nowsecure/r2frida/wiki/random

Use `=!dtf <function> <format>^` to trace native wrappers, specifying formats like `z` for strings and `^` for backtraces. This helps in understanding the call stack and arguments.

```shell
[0x00000000]> =!dtf fopen z^; =!dtf dlopen z^
[0x00000000]> =!dc
resumed spawned process.
[TRACE] dtf	dlopen	(0: "libc.so")	0x7f908b4668	libshella-2.9.0.5.so	0xfffffffff9d91668
	0x7f908b4664	libshella-2.9.0.5.so	0xfffffffff9d91664
	0x7f908b4b1c	libshella-2.9.0.5.so	JNI_OnLoad+0x124
	0x7f96b24bac	libshella-2.9.0.5.so	0x1bac
	0x7f97ecf650	libart.so	_ZN3art9JavaVMExt17LoadNativeLibrary<REDACTED>...9_+0x858
```

--------------------------------

### List All Memory Regions (:dm)

Source: https://context7.com/nowsecure/r2frida/llms.txt

Display a map of all memory regions currently allocated in the target process.

```r2
:dm
```

--------------------------------

### List Java Classes and Methods

Source: https://github.com/nowsecure/r2frida/blob/master/doc/fortunes.txt

For Java applications, list all available classes using ':ic' and methods of a specific class using ':icm ClassName'.

```shell
:ic
```

```shell
:icm ClassName
```

--------------------------------

### Clean Project

Source: https://github.com/nowsecure/r2frida/blob/master/AGENTS.md

Use these make targets to clean the project build artifacts. `make mrproper` performs a more thorough cleaning.

```shell
make clean
```

```shell
make mrproper
```

--------------------------------

### List available devices with r2frida

Source: https://github.com/nowsecure/r2frida/wiki/Introduction

Retrieve a list of available devices that Frida can connect to. This command helps identify the device ID for subsequent operations.

```bash
r2 frida://launch//
Id                                          Type Name
-----------------------------------------------------
14c0ce8df9d2ac3c1c42f17e4c0f5b2acfec3829     usb iPad
barebone                                  remote GDB Remote Stub
local                                      local Local System
socket                                    remote Local Socket
```

--------------------------------

### List Libraries with Filtering

Source: https://github.com/nowsecure/r2frida/wiki/info

Lists loaded libraries in the target, filtered by a pattern. Useful for identifying relevant libraries for analysis.

```shell
[0x00000000]> :il~+keystore,ssl,crypto
0x0000007f94133000 libcrypto.so
0x0000007f93059000 libssl.so
0x0000007f879d8000 libjavacrypto.so
0x0000007f879d3000 libkeystore-engine.so
0x0000007f87985000 libkeystore_binder.so
0x0000007f5c491000 libvisacrypto.so
```

--------------------------------

### Spawn App without Device ID with r2frida

Source: https://github.com/nowsecure/r2frida/wiki/random

Spawn an application without explicitly providing the device ID, relying on r2frida to find a suitable USB device. This simplifies the command for common scenarios.

```bash
r2 frida://spawn/usb//com.android.app
```

--------------------------------

### Filter Loaded Libraries (:il~+ssl,crypto)

Source: https://context7.com/nowsecure/r2frida/llms.txt

List loaded libraries and filter the output to show only those containing 'ssl' or 'crypto' in their names.

```r2
:il~+ssl,crypto
```

--------------------------------

### List Memory Maps and Seek

Source: https://github.com/nowsecure/r2frida/blob/master/doc/fortunes.txt

Display the memory map of the target process using ':dm' and navigate to a specific address using 's 0x<addr>'.

```shell
:dm
```

```shell
s 0x<addr>
```

--------------------------------

### Managing r2frida plugins

Source: https://github.com/nowsecure/r2frida/blob/master/README.md

Commands for loading, listing, unloading, and eternally running plugin scripts within the r2frida agent.

```shell
[0x00000000]> :. example.js   # load the plugin script
```

```shell
:.       # list plugins
```

```shell
:.-test  # unload a plugin by name
```

```shell
:.. a.js # eternalize script (keeps running after detach)
```

--------------------------------

### Load and Use Objection Plugin in r2frida

Source: https://github.com/nowsecure/r2frida/blob/master/plugins/objection/README.md

Load the r2frida-objection plugin within an r2frida session and then use the ':objection' command to interact with Objection features.

```bash
$ r2 frida://spawn/usb//Twitter
> :. r2f-objection-plugin.js
> :objection
iosJailbreakDisable
iosJailbreakEnable
...
> :objection iosJailbreakEnable
```

--------------------------------

### List Classes in a Process with Frida

Source: https://github.com/nowsecure/r2frida/wiki/info

The `:ic` command lists all classes within a target process. It may prompt for confirmation if the number of classes is large.

```shell
- :ic: List classes

```java
[0x00000000]> :ic
Do you want to print 5769 lines? (y/N) n
```
```

--------------------------------

### Find Binary Exports and Imports

Source: https://github.com/nowsecure/r2frida/blob/master/doc/fortunes.txt

Locate exported functions using ':iE' and imported functions using ':ii' within the current binary.

```shell
:iE
```

```shell
:ii
```

--------------------------------

### Verify Allocated String (:ps @ address)

Source: https://context7.com/nowsecure/r2frida/llms.txt

Print a null-terminated string located at a specific memory address.

```r2
ps @ 0xf3d7ee10
```

--------------------------------

### Enumerate USB Devices

Source: https://github.com/nowsecure/r2frida/blob/master/doc/fortunes.txt

List available USB devices that can be used for Frida connections using 'r2 frida://list/usb//'.

```shell
r2 frida://list/usb//
```

--------------------------------

### Call Function with Arguments

Source: https://context7.com/nowsecure/r2frida/llms.txt

Use ':dxc' to call a function at a given address with specified arguments. Ensure memory for arguments is allocated first using ':dma'.

```bash
# Find function address
[0x00000000]> :ii frida-gadget.so~gettimeofday
0xf40d8590 f gettimeofday /system/lib/libc.so

# Allocate memory for function arguments (timeval and timezone structs)
[0x00000000]> :dma 16
0xebaf6f18
[0x00000000]> :dma 16
0xebaf70d8

# Call gettimeofday(tv, tz)
[0x00000000]> :dxc 0xf40d8590 0xebaf6f18 0xebaf70d8
"0x0"

# Verify result - read timestamp
[0x00000000]> pt 4 @ 0xebaf6f18
Wed Apr 10 17:47:44 2019
```

--------------------------------

### Attach to Running App with r2frida

Source: https://github.com/nowsecure/r2frida/wiki/random

Use this command to attach r2frida to an already running application on a device using its display name. Ensure you have the correct device ID.

```bash
r2 frida://device-id/Snapchat
```

--------------------------------

### Attach to Process by Name with r2frida

Source: https://context7.com/nowsecure/r2frida/llms.txt

Attach to a running process by its name using the frida URI scheme.

```bash
r2 frida://rax2
```

--------------------------------

### Registering an r2frida plugin

Source: https://github.com/nowsecure/r2frida/blob/master/README.md

Defines and registers a new plugin named 'test' that logs a message when invoked. The plugin script is loaded using the `:.` command.

```javascript
[0x00000000]> cat example.js
r2frida.pluginRegister('test', function(name) {
  if (name === 'test') {
    return function(args) {
      console.log('Hello Args From r2frida plugin', args);
      return 'Things Happen';
    }
  }
});
```

--------------------------------

### Attach to a running app

Source: https://github.com/nowsecure/r2frida/wiki/Introduction

Attach to a running application on a device using its display name. You can also specify the device ID and process name.

```bash
r2 frida://attach/usb/device-id/processName
```

--------------------------------

### Search Memory for Strings and Patterns

Source: https://context7.com/nowsecure/r2frida/llms.txt

Search process memory for strings, hex patterns, wide strings (UTF-16), and numeric values. Use ': /j' for JSON output.

```bash
# Search for string in memory
[0x00000000]> :/ rooted
hits: 9
0x7f595ec8e7 hit1_0 rootediso8601DateFormat...
0x7f6956f976 hit1_3 rooted or jailbroken. This is an added security...
```

```bash
# Search string with JSON output
[0x00000000]> :/j rooted
[{"address":"0x7f595ec8e7","size":6,"flag":"hit2_0","content":"rootediso8601..."}]
```

```bash
# Search hex pattern
[0x00000000]> :/x c0ffee
hits: 7
0x71100090 hit3_0 c0ffee
0x719a104c hit3_1 c0ffee
```

```bash
# Search wide string (UTF-16)
[0x00000000]> :/w password
```

```bash
# Search for 4-byte value (little endian)
[0x00000000]> :/v4 1234
hits: 1076
0x7f95acfb23 hit2_1071 d2040000
```

```bash
# Search for 8-byte value
[0x00000000]> :/v8 0xdeadbeef
```

```bash
# Search for instances of a type (ObjC/Java)
[0x00000000]> :/i NSString
```

--------------------------------

### List Threads and Registers

Source: https://github.com/nowsecure/r2frida/blob/master/doc/fortunes.txt

Display a list of all threads in the target process using ':dpt' and view the current thread's registers with ':dr'.

```shell
:dpt
```

```shell
:dr
```

--------------------------------

### Common r2frida commands

Source: https://github.com/nowsecure/r2frida/blob/master/README.md

Lists frequent commands available within r2frida for inspecting the target process. Use `?` for subcommand help.

```shell
:i        # get information of the target (pid, name, home, arch, bits, ..)
```

```shell
.:i*      # import the target process details into local r2
```

```shell
:?        # show all the available commands
```

```shell
:dm       # list maps. Use ':dm|head' and seek to the program base address
```

```shell
:iE       # list the exports of the current binary (seek)
```

```shell
:dt fread # trace the 'fread' function
```

```shell
:dt-*     # delete all traces
```

--------------------------------

### r2 frida command help

Source: https://github.com/nowsecure/r2frida/blob/master/README.md

Displays the help message for r2 frida commands, outlining available actions, links, devices, and targets.

```shell
$ r2 'frida://?'
r2 frida://[action]/[link]/[device]/[target]
* action = list | apps | attach | spawn | launch
* link   = local | usb | remote host:port
* device = '' | host:port | device-id
* target = pid | appname | process-name | program-in-path | abspath
Local:
* frida://?                        # show this help
* frida://                         # list local processes
* frida://0                        # attach to frida-helper (no spawn needed)
* frida:///usr/local/bin/rax2      # abspath to spawn
* frida://rax2                     # same as above, considering local/bin is in PATH
* frida://spawn/$(program)         # spawn a new process in the current system
* frida://attach/(target)          # attach to target PID in current host
USB:
* frida://list/usb//               # list processes in the first usb device
* frida://apps/usb//               # list apps in the first usb device
* frida://attach/usb//12345        # attach to given pid in the first usb device
* frida://spawn/usb//appname       # spawn an app in the first resolved usb device
* frida://launch/usb//appname      # spawn+resume an app in the first resolved usb device
Remote:
* frida://attach/remote/10.0.0.3:9999/558 # attach to pid 558 on tcp remote frida-server
Environment: (Use the `%` command to change the environment at runtime)
  R2FRIDA_SAFE_IO=0|1              # Workaround a Frida bug on Android/thumb
  R2FRIDA_DEBUG=0|1                # Used to debug argument parsing behaviour
  R2FRIDA_COMPILER_DISABLE=0|1     # Disable the new frida typescript compiler (`:. foo.ts`)
  R2FRIDA_AGENT_SCRIPT=[file]      # path to file of the r2frida agent
```

--------------------------------

### Define Trace Hook with Argument Format (:dth fopen z)

Source: https://context7.com/nowsecure/r2frida/llms.txt

Define a trace hook for a function, specifying the format for arguments (e.g., 'z' for string pointer).

```r2
:dth fopen z
```