Frida

https://frida.re/docs
Admin
Frida is a dynamic instrumentation toolkit that enables injecting scripts into running processes to...
Tokens:178,116
Snippets:1,957
Trust Score:9.9
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install Prerequisites on Ubuntu

Source: https://frida.re/docs/building

Install the necessary C/C++ toolchain, Node.js, and Git on an Ubuntu system.

```bash
$ sudo apt-get install build-essential git lib32stdc++-9-dev \
    libc6-dev-i386 nodejs npm
```

--------------------------------

### Tracing Configuration Examples

Source: https://frida.re/docs/frida-trace

Common command-line usage examples for filtering functions and modules.

```text
-i “msvcrt.dll!_cpy_ ”
-i “ _free_ ”
-i “!_free_ ”
-i “gdi32.dll!”
```

--------------------------------

### Build and Run Frida Go Example

Source: https://frida.re/docs/go-api

Command-line instructions to compile and execute the Frida Go example program.

```bash
$ go build main.go && ./main
[*] Frida version: 16.0.3
[*] Devices:
[*] Local System => local
[*] Local Socket => socket
```

--------------------------------

### Install Frida CLI tools

Source: https://frida.re/docs/installation

Use pip to install the Frida command-line tools from PyPI.

```bash
$ pip install frida-tools
```

--------------------------------

### Prepare test process

Source: https://frida.re/docs/installation

Start a process to inject into for testing purposes.

```bash
$ cat
```

```bash
$ cp /bin/cat /tmp/cat
$ /tmp/cat
```

--------------------------------

### gum_unwind_pc_translator_install_resume_context

Source: https://frida.re/docs/gum/iface.UnwindPcTranslator.html

Installs a resume context for the unwinder.

```APIDOC
## gum_unwind_pc_translator_install_resume_context

### Description
Installs a resume context into the provided unwind context for a specific resume instruction pointer.

### Signature
gboolean gum_unwind_pc_translator_install_resume_context(GumUnwindPcTranslator* self, gpointer unwind_context, GumAddress real_resume_ip);
```

--------------------------------

### Sample program output

Source: https://frida.re/docs/functions

Example output showing the function address and loop execution.

```text
f() is at 0x400544
Number: 0
Number: 1
Number: 2
…
```

--------------------------------

### Example process list output

Source: https://frida.re/docs/ios

Sample output showing running processes on an iOS device.

```text
 PID NAME
 488 Clock
 116 Facebook
 312 IRCCloud
1711 LinkedIn
…
```

--------------------------------

### Define module-offset-options.txt

Source: https://frida.re/docs/frida-trace

Example content for a nested options file defining specific module offsets for tracing.

```text
-a "gdi32full.dll!0x3918DC" -a "gdi32full.dll!0xBE7458"
-a "gdi32full.dll!0xBF9904"
```

--------------------------------

### gum_darwin_module_enumerate_function_starts

Source: https://frida.re/docs/gum/method.DarwinModule.enumerate_function_starts.html

Enumerates function starts of the module by invoking a callback function for each discovered start address.

```APIDOC
## void gum_darwin_module_enumerate_function_starts (GumDarwinModule* self, GumFoundDarwinFunctionStartsFunc func, gpointer user_data)

### Description
Enumerates function starts of the module.

### Parameters
- **self** (GumDarwinModule*) - Required - The module instance.
- **func** (GumFoundDarwinFunctionStartsFunc) - Required - Function called with each function start.
- **user_data** (gpointer) - Optional - Data to pass to `func`.
```

--------------------------------

### gboolean install_resume_context (GumUnwindPcTranslator* self, gpointer unwind_context, GumAddress real_resume_ip)

Source: https://frida.re/docs/gum/vfunc.UnwindPcTranslator.install_resume_context.html

Installs a resume context for the specified unwind translator.

```APIDOC
## install_resume_context

### Signature
`gboolean install_resume_context (GumUnwindPcTranslator* self, gpointer unwind_context, GumAddress real_resume_ip)`

### Parameters
- **self** (GumUnwindPcTranslator*) - The translator instance.
- **unwind_context** (gpointer) - The unwind context. Can be NULL. The data is owned by the caller.
- **real_resume_ip** (GumAddress) - The real resume IP address.

### Return Value
- **gboolean** - Returns a boolean indicating the result of the operation.
```

--------------------------------

### GumFoundDarwinFunctionStartsFunc

Source: https://frida.re/docs/gum/callback.FoundDarwinFunctionStartsFunc.html

Callback function signature for processing function start details.

```APIDOC
## GumFoundDarwinFunctionStartsFunc

### Signature
```c
gboolean (* GumFoundDarwinFunctionStartsFunc) (const GumDarwinFunctionStartsDetails* details, gpointer user_data)
```

### Parameters
- **details** (const GumDarwinFunctionStartsDetails*) - The function start details.
- **user_data** (gpointer) - User-provided data, can be NULL.

### Return Value
- **gboolean** - Returns a boolean value.
```

--------------------------------

### Monitoring memory access

Source: https://frida.re/docs/gum/class.MemoryAccessMonitor.html

Example showing how to define an access callback and initialize the monitor to watch a specific memory range.

```c
static void on_access (GumMemoryAccessMonitor * monitor,
    const GumMemoryAccessDetails * details, gpointer user_data);

void
watch (gpointer base, gsize size)
{
  GumMemoryRange range = { GUM_ADDRESS (base), size };
  g_autoptr(GError) error = NULL;
  GumMemoryAccessMonitor * monitor = gum_memory_access_monitor_new (
      &range, 1, GUM_PAGE_WRITE, TRUE, on_access, NULL, NULL);

  if (!gum_memory_access_monitor_enable (monitor, &error))
    g_printerr ("Failed to enable: %s\n", error->message);
}
```

--------------------------------

### Build Frida for Native Machine

Source: https://frida.re/docs/building

Standard commands to build and install Frida on the host machine.

```bash
$ make
```

--------------------------------

### Implement Script Logic

Source: https://frida.re/docs/gadget

Example JavaScript implementation for a script file, utilizing the init and dispose RPC methods.

```javascript
const { TMTheme } = ObjC.classes;

rpc.exports = {
  init(stage, parameters) {
    console.log('[init]', stage, JSON.stringify(parameters));

    ObjC.schedule(ObjC.mainQueue, () => {
      TMTheme.switchToTheme_(TMTheme.darkTheme());
    });
  },
  dispose() {
    console.log('[dispose]');

    ObjC.schedule(ObjC.mainQueue, () => {
      TMTheme.switchToTheme_(TMTheme.lightTheme());
    });
  }
};
```

--------------------------------

### List processes and applications with frida-ps

Source: https://frida.re/docs/frida-ps

Common command-line usage patterns for listing running processes, applications, and installed apps on connected devices.

```bash
# Connect Frida to an iPad over USB and list running processes
$ frida-ps -U

# List running applications
$ frida-ps -Ua

# List installed applications
$ frida-ps -Uai

# Connect Frida to the specific device
$ frida-ps -D 0216027d1d6d3a03
```

--------------------------------

### gum_event_sink_start

Source: https://frida.re/docs/gum/method.EventSink.start.html

Starts the event sink operation.

```APIDOC
## gum_event_sink_start

### Description
Starts the event sink operation for the provided GumEventSink instance.

### Signature
`void gum_event_sink_start (GumEventSink* self)`

### Parameters
- **self** (GumEventSink*) - Required - The event sink instance to start.
```

--------------------------------

### Declaration of gum_unwind_pc_translator_install_resume_context

Source: https://frida.re/docs/gum/method.UnwindPcTranslator.install_resume_context.html

The function signature for installing a resume context on a GumUnwindPcTranslator instance.

```c
gboolean
gum_unwind_pc_translator_install_resume_context (
  GumUnwindPcTranslator* self,
  gpointer unwind_context,
  GumAddress real_resume_ip
)
```

--------------------------------

### Define additional-options.txt

Source: https://frida.re/docs/frida-trace

Example content for an options file, including function tracing, script loading, and nested -O references.

```text
-i "gdi32full.dll!ExtTextOutW"
-S core.js -S ms-windows.js
-O module-offset-options.txt
```

--------------------------------

### Client Execution Output

Source: https://frida.re/docs/functions

Example output showing the memory buffer of the sockaddr_in struct.

```text
$ ./client 127.0.0.1
connect() is at: 0x400780

Here's the serv_addr buffer:
02 00 13 88 7f 00 00 01 30 30 30 30 30 30 30 30
Press ENTER key to Continue
```

--------------------------------

### void start (GumEventSink* self)

Source: https://frida.re/docs/gum/vfunc.EventSink.start.html

Initiates the event sink process for the provided GumEventSink instance.

```APIDOC
## void start (GumEventSink* self)

### Description
Initiates the event sink process for the provided GumEventSink instance.

### Parameters
- **self** (GumEventSink*) - Required - The GumEventSink instance to start.
```

--------------------------------

### Cross-Compile for Raspberry Pi

Source: https://frida.re/docs/building

Install the cross-compiler and build Frida for Raspberry Pi.

```bash
$ sudo apt-get install g++-arm-linux-gnueabihf
$ ./configure --host=arm-linux-gnueabihf
$ make
```

--------------------------------

### Instrument a Mach-O binary

Source: https://frida.re/docs/gum/class.DarwinGrafter.html

Example demonstrating how to initialize a grafter, add an offset, and perform the grafting process.

```c
g_autoptr(GError) error = NULL;
GumDarwinGrafter * grafter = gum_darwin_grafter_new_from_file (
    "/path/to/app", GUM_DARWIN_GRAFTER_FLAGS_INGEST_FUNCTION_STARTS);

gum_darwin_grafter_add (grafter, 0x4118);

if (!gum_darwin_grafter_graft (grafter, &error))
  g_printerr ("Failed to graft: %s\n", error->message);

g_object_unref (grafter);
```

--------------------------------

### Example trace output

Source: https://frida.re/docs/quickstart

The output format after modifying the log function.

```text
  8098 ms	recvfrom(socket=70,
                         buffer=0x32cc018, length=65536,
                         flags=0x0,
                         address=0xb0420bd8, address_len=16)
```

--------------------------------

### Trace functions with frida-trace

Source: https://frida.re/docs/quickstart

Install the Frida tools and trace functions matching specific patterns in a target application.

```bash
~ $ pip install frida-tools
~ $ frida-trace -i "recv*" -i "read*" twitter
recv: Auto-generated handler: …/recv.js
# (snip)
recvfrom: Auto-generated handler: …/recvfrom.js
Started tracing 21 functions. Press Ctrl+C to stop.
    39 ms	recv()
   112 ms	recvfrom()
   128 ms	recvfrom()
   129 ms	recvfrom()
```

--------------------------------

### Trace output example

Source: https://frida.re/docs/ios

Sample output showing intercepted cryptographic function calls.

```text
3979 ms	CCCryptorCreate()
3982 ms	CCCryptorCreateWithMode()
3983 ms	CCCryptorCreate()
3983 ms	CCCryptorCreateWithMode()
```

--------------------------------

### Working Set Procedural Ordering Examples

Source: https://frida.re/docs/frida-trace

Demonstration of how the order of include and exclude flags affects the final traced working set.

```text
-i "str*" -i "mem*" -X "msvcrt.dll"
-i "str*" -X "msvcrt.dll" -i "mem*"
-X "msvcrt.dll" -i "str*" -i "mem*"
```

--------------------------------

### Trace the current thread with GumStalker

Source: https://frida.re/docs/gum/class.Stalker.html

Example demonstrating how to initialize a stalker, define a transformer callback, and follow the current thread.

```c
static void on_exec (GumStalkerIterator * iterator,
    GumStalkerOutput * output, gpointer user_data);

void
trace (void)
{
  g_autoptr(GumStalker) stalker = gum_stalker_new ();
  GumStalkerTransformer * transformer =
      gum_stalker_transformer_make_from_callback (on_exec, NULL, NULL);

  gum_stalker_follow_me (stalker, transformer, NULL);
  // ... code to trace runs here ...
  gum_stalker_unfollow_me (stalker);

  g_object_unref (transformer);
}

static void
on_exec (GumStalkerIterator * iterator,
         GumStalkerOutput * output,
         gpointer user_data)
{
  const cs_insn * insn;

  while (gum_stalker_iterator_next (iterator, &insn))
  {
    // Inspect insn here, then emit it into the recompiled block.
    gum_stalker_iterator_keep (iterator);
  }
}
```

--------------------------------

### Hook script output

Source: https://frida.re/docs/functions

Example output received from the Frida script during execution.

```text
{'type': 'send', 'payload': 531}
{'type': 'send', 'payload': 532}
…
```

--------------------------------

### Android Gadget Configuration File Structure

Source: https://frida.re/docs/gadget

Example directory structure for an Android application where the configuration file must follow specific naming conventions to be loaded from the /lib directory.

```text
lib
└── arm64-v8a
    ├── libgadget.config.so
    ├── libgadget.so
```

--------------------------------

### Process.setExceptionHandler(callback)

Source: https://frida.re/docs/javascript-api

Installs a process-wide exception handler callback to handle native exceptions.

```APIDOC
## Process.setExceptionHandler(callback)

### Description
Installs a process-wide exception handler callback that gets a chance to handle native exceptions before the hosting process itself does.

### Parameters
- **callback** (function) - Required - A function receiving a 'details' object. Return true to indicate the exception was handled.
```

--------------------------------

### Script.setGlobalAccessHandler(handler)

Source: https://frida.re/docs/javascript-api

Installs a handler to resolve attempts to access non-existent global variables.

```APIDOC
## Script.setGlobalAccessHandler(handler)

### Parameters
- **handler** (object | null) - Required - An object with `enumerate()` and `get(property)` methods.
```

--------------------------------

### Enhanced frida-trace Execution Command

Source: https://frida.re/docs/frida-trace/session-initialization-primer

Example command line usage of frida-trace with multiple shared initialization scripts to instrument a specific Windows API function.

```bash
c:\project> frida-trace -p 6980 --decorate -i "gdi32full.dll!ExtTextOutW" -S core.js -S ms-windows.js
```

--------------------------------

### ARM64 Epilogue Helper Implementation

Source: https://frida.re/docs/stalker

This snippet defines the start of the epilogue helper, including the definition of the instruction to restore ALU flags.

```c
static void
gum_exec_ctx_write_epilog_helper (GumExecCtx * ctx,
                                  GumPrologType type,
                                  GumArm64Writer * cw)
{
  // This instruction is used to restore the value of X15 back into
  // the ALU flags.
  const guint32 msr_nzcv_x15 = 0xd51b420f;
```

--------------------------------

### Enable Node.js debugger

Source: https://frida.re/docs/frida-cli

Starts the Frida CLI with the Node.js compatible debugger enabled for script debugging.

```bash
# Connect Frida to a locally-running Calculator.app
# and load calc.js with the debugger enabled
$ frida Calculator -l calc.js --debug

Debugger listening on port 5858
# We can now run node-inspector and start debugging calc.js
[Local::ProcName::Calculator]->
```

--------------------------------

### Trace function calls with frida-trace

Source: https://frida.re/docs/frida-trace

Examples of using frida-trace to monitor APIs, methods, and functions in various applications and platforms.

```bash
# Trace recv* and send* APIs in Safari, insert library names
# in logging
$ frida-trace --decorate -i "recv*" -i "send*" Safari

# Trace ObjC method calls in Safari
$ frida-trace -m "-[NSView drawRect:]" Safari

# Launch SnapChat on your iPhone and trace crypto API calls
$ frida-trace \
    -U \
    -f com.toyopagroup.picaboo \
    -I "libcommonCrypto*"

# Launch YouTube on your Android device and trace Java methods
# with “certificate” in their signature (s), ignoring case (i)
# and only searching in user-defined classes (u)
$ frida-trace \
    -U \
    -f com.google.android.youtube \
    --runtime=v8 \
    -j '*!*certificate*/isu'

# Trace all JNI functions in Samsung FaceService app on Android
$ frida-trace -U -i "Java_*" com.samsung.faceservice

# Trace a Windows process's calls to "mem*" functions in msvcrt.dll
$ frida-trace -p 1372 -i "msvcrt.dll!*mem*"

# Trace all functions matching "*open*" in the process except
# in msvcrt.dll
$ frida-trace -p 1372 -i "*open*" -x "msvcrt.dll!*open*"

# Trace an unexported function in libjpeg.so
$ frida-trace -p 1372 -a "libjpeg.so!0x4793c"
```

--------------------------------

### Pointer Authentication Code Fragment

Source: https://frida.re/docs/stalker

Example of PAC instructions used to sign and validate return addresses on the stack.

```asm
pacia lr, sp
stp fp, lr, [sp, #-FRAME_SIZE]!
mov fp, sp

...

ldp fp, lr, [sp], #FRAME_SIZE
autia lr, sp
ret lr
```

--------------------------------

### Deploy and run frida-server

Source: https://frida.re/docs/android

Push the binary to the device, set permissions, and execute it in the background.

```bash
$ adb root # might be required
$ adb push frida-server /data/local/tmp/
$ adb shell "chmod 755 /data/local/tmp/frida-server"
$ adb shell "/data/local/tmp/frida-server &"
```

--------------------------------

### void gum_metal_array_get_extents (GumMetalArray* self, gpointer* start, gpointer* end)

Source: https://frida.re/docs/gum/method.MetalArray.get_extents.html

Retrieves the start and end pointers for the specified GumMetalArray.

```APIDOC
## void gum_metal_array_get_extents (GumMetalArray* self, gpointer* start, gpointer* end)

### Description
Retrieves the start and end pointers of the provided GumMetalArray. The caller owns the data returned in the start and end pointers.

### Parameters
- **self** (GumMetalArray*) - Required - The GumMetalArray instance.
- **start** (gpointer*) - Optional - Pointer to store the start address. Can be NULL.
- **end** (gpointer*) - Optional - Pointer to store the end address. Can be NULL.
```

--------------------------------

### Build frida-gum from source

Source: https://frida.re/docs/hacking

Initializes the frida-gum build environment by cloning the repository and running the make command.

```bash
$ git clone https://github.com/frida/frida-gum.git
$ cd frida-gum
$ make
```

--------------------------------

### gum_memory_access_monitor_enable

Source: https://frida.re/docs/gum/class.MemoryAccessMonitor.html

Starts watching the configured memory ranges.

```APIDOC
## gum_memory_access_monitor_enable

### Description
Starts watching the configured ranges, stripping the masked permissions from their pages and installing the exception handler. Fails if a monitored page is unallocated or already fully inaccessible.
```

--------------------------------

### gum_stalker_backpatch_get_from

Source: https://frida.re/docs/gum/type_func.Stalker.backpatch_get_from.html

Gets the address of the block a backpatch originates from.

```APIDOC
## gum_stalker_backpatch_get_from

### Description
Gets the address of the block a backpatch originates from.

### Signature
`gpointer gum_stalker_backpatch_get_from (const GumBackpatch* backpatch)`

### Parameters
- **backpatch** (GumBackpatch*) - Required - A GumBackpatch instance.

### Return Value
- **gpointer** - The address of the block the backpatch originates from. Returns NULL if no origin is found.
```

--------------------------------

### Initialize and use GumBacktracer

Source: https://frida.re/docs/gum/iface.Backtracer.html

Demonstrates creating a backtracer instance and generating a backtrace from a CPU context.

```c
g_autoptr(GumBacktracer) backtracer = gum_backtracer_make_accurate ();
                                              // or: make_fuzzy

GumCpuContext *cpu_context = NULL; // walk from here
GumReturnAddressArray retaddrs;
gum_backtracer_generate (backtracer, cpu_context, &retaddrs);

for (guint i = 0; i != retaddrs.len; i++)
  {
    g_print ("retaddrs[%u] = %p\n", i, retaddrs->items[i]);
  }
```

--------------------------------

### Run Docker container with seccomp disabled

Source: https://frida.re/docs/examples/linux

Use this command to start an interactive shell in a Docker container with seccomp disabled, which is required for Frida to function.

```bash
docker run --security-opt seccomp:unconfined -it <image name> /bin/bash
```

--------------------------------

### gum_module_get_name

Source: https://frida.re/docs/gum/iface.Module.html

Gets the module’s short name.

```APIDOC
## gum_module_get_name

### Description
Retrieves the module’s short name, for example, 'libc.so.6'.
```

--------------------------------

### gum_memory_decommit

Source: https://frida.re/docs/gum/func.memory_decommit.html

Decommits a range of memory starting at the specified address.

```APIDOC
## gum_memory_decommit

### Description
Decommits a range of memory starting at the specified address.

### Signature
`gboolean gum_memory_decommit (gpointer address, gsize size)`

### Parameters
- **address** (gpointer) - The starting address of the memory range to decommit. Can be NULL.
- **size** (gsize) - The size of the memory range to decommit.

### Return Value
- **gboolean** - Returns the result of the decommit operation.
```

--------------------------------

### Create a sample C program

Source: https://frida.re/docs/functions

A simple C program that prints the address of a function and calls it in a loop.

```c
#include <stdio.h>
#include <unistd.h>

void
f (int n)
{
  printf ("Number: %d\n", n);
}

int
main (int argc,
      char * argv[])
{
  int i = 0;

  printf ("f() is at %p\n", f);

  while (1)
  {
    f (i++);
    sleep (1);
  }
}
```

--------------------------------

### Explore local process context

Source: https://frida.re/docs/frida-cli

Demonstrates inspecting local variables, context, and ObjC classes within the Frida REPL.

```bash
# Connect Frida to a locally-running Calculator.app
$ frida Calculator

# Look at the local variables/context
[Local::ProcName::Calculator]-> <TAB>
Backtracer           Process
CpuContext           Proxy
Dalvik               Socket
DebugSymbol          Stalker
File                 Thread
Frida                WeakRef
Instruction          clearInterval
Interceptor          clearTimeout
Memory               console
MemoryAccessMonitor  gc
Module               ptr
NULL                 recv
NativeCallback       send
NativeFunction       setInterval
NativePointer        setTimeout
ObjC
# Look at things exposed through the ObjC interface
[Local::ProcName::Calculator]-> ObjC.<TAB>
Object            implement         selector
available         mainQueue         selectorAsString
classes           schedule
# List the first 10 classes (there are a lot of them!)
[Local::...::Calculator]-> Object.keys(ObjC.classes).slice(0, 10)
[
    "NSDrawer",
    "GEOPDETAFilter",
    "NSDeserializer",
    "CBMutableCharacteristic",
    "NSOrthographyCheckingResult",
    "DDVariable",
    "GEOVoltaireLocationShiftProvider",
    "LSDocumentProxy",
    "NSPreferencesModule",
    "CIQRCodeGenerator"
]
```

--------------------------------

### gum_memory_discard

Source: https://frida.re/docs/gum/func.memory_discard.html

Discards a specified range of memory starting at the provided address.

```APIDOC
## gum_memory_discard

### Description
Discards a specified range of memory.

### Signature
`gboolean gum_memory_discard (gpointer address, gsize size)`

### Parameters
- **address** (gpointer) - The starting address of the memory range to discard. Can be NULL.
- **size** (gsize) - The size of the memory range to discard.

### Return Value
- **gboolean** - Returns a boolean indicating the result of the operation.
```

--------------------------------

### install_resume_context function signature

Source: https://frida.re/docs/gum/vfunc.UnwindPcTranslator.install_resume_context.html

The C function signature for the install_resume_context virtual method.

```c
gboolean
install_resume_context (
  GumUnwindPcTranslator* self,
  gpointer unwind_context,
  GumAddress real_resume_ip
)
```

--------------------------------

### Stalker.follow([threadId, options])

Source: https://frida.re/docs/javascript-api

Starts stalking a specific thread or the current thread.

```APIDOC
## Stalker.follow([threadId, options])

### Description
Start stalking `threadId` (or the current thread if omitted), optionally with `options` for enabling events.
```

--------------------------------

### gum_stalker_follow function declaration

Source: https://frida.re/docs/gum/method.Stalker.follow.html

The function signature for starting a thread trace in GumStalker.

```c
void
gum_stalker_follow (
  GumStalker* self,
  GumThreadId thread_id,
  GumStalkerTransformer* transformer,
  GumEventSink* sink
)
```

--------------------------------

### Enumerate Frida Devices in Go

Source: https://frida.re/docs/go-api

Initializes a device manager to list all available Frida devices and their details.

```go
package main

import (
	"fmt"

	"github.com/frida/frida-go/frida"
)

func main() {
	manager := frida.NewDeviceManager()
	devices, err := manager.EnumerateDevices()
	if err != nil {
		panic(err)
	}

	fmt.Printf("[*] Frida version: %s\n", frida.Version())
	fmt.Println("[*] Devices: ")
	for _, device := range devices {
		fmt.Printf("[*] %s => %s\n", device.Name(), device.ID())
	}
}
```

--------------------------------

### gum_memory_is_readable

Source: https://frida.re/docs/gum/func.memory_is_readable.html

Checks if the memory range starting at address with length len is readable.

```APIDOC
## gum_memory_is_readable

### Description
Checks if the memory range starting at the specified address with the given length is readable.

### Signature
`gboolean gum_memory_is_readable (gconstpointer address, gsize len)`

### Parameters
- **address** (gconstpointer) - The starting memory address to check. Can be NULL.
- **len** (gsize) - The length of the memory range to check.

### Return Value
- **gboolean** - Returns TRUE if the memory range is readable, otherwise FALSE.
```

--------------------------------

### ObjC.choose(specifier, callbacks)

Source: https://frida.re/docs/javascript-api

Enumerate live instances of classes matching the specifier by scanning the heap.

```APIDOC
## ObjC.choose(specifier, callbacks)

### Description
Enumerate live instances of classes matching `specifier` by scanning the heap.

### Parameters
- **specifier** (Object) - Required - Either a class selector or an object containing `class` and `subclasses` (boolean) fields.
- **callbacks** (Object) - Required - Object specifying `onMatch(instance)` and `onComplete()` functions.
```

--------------------------------

### gum_interceptor_begin_transaction

Source: https://frida.re/docs/gum/class.Interceptor.html

Starts a transaction to group multiple interception changes into an atomic operation.

```APIDOC
## gum_interceptor_begin_transaction

### Description
Begins a transaction for batching interception changes.

### Signature
void gum_interceptor_begin_transaction (GumInterceptor * interceptor);

### Parameters
- **interceptor** (GumInterceptor*) - The interceptor instance.
```

--------------------------------

### Check device CPU and extract frida-server

Source: https://frida.re/docs/android

Identify the device architecture and prepare the frida-server binary.

```bash
$ adb shell getprop ro.product.cpu.abilist # check your device cpu type

$ unxz frida-server.xz
```

--------------------------------

### Compile the C program

Source: https://frida.re/docs/functions

Command to compile the sample C code using gcc.

```bash
$ gcc -Wall hello.c -o hello
```

--------------------------------

### Java.choose(className, callbacks)

Source: https://frida.re/docs/javascript-api

Enumerates live instances of a class by scanning the Java heap.

```APIDOC
## Java.choose(className, callbacks)

### Description
Enumerates live instances of the `className` class by scanning the Java heap.

### Parameters
- **className** (string) - Required - The name of the class to search for.
- **callbacks** (object) - Required - An object containing `onMatch(instance)` and `onComplete()` methods.
```

--------------------------------

### Configure Build Options

Source: https://frida.re/docs/building

Pass custom options to the build system using the configure script.

```bash
$ ./configure -- first-option second-option …
```

```bash
$ ./configure -- \
    -Dfrida-gum:devkits=gum,gumjs \
    -Dfrida-core:devkits=core
```

--------------------------------

### Stalker.follow

Source: https://frida.re/docs/stalker

Starts stalking the specified thread or the current thread if no thread ID is provided.

```APIDOC
## Stalker.follow

### Description
Starts stalking the specified thread. If no thread ID is provided, the current thread is stalked.

### Parameters
- **threadId** (number) - Optional - The ID of the thread to stalk.
- **options** (object) - Optional - Configuration options for the stalker.
```

--------------------------------

### gum_memory_try_remap_writable_pages

Source: https://frida.re/docs/gum/func.memory_try_remap_writable_pages.html

Attempts to remap a range of writable memory pages starting from the provided address.

```APIDOC
## gum_memory_try_remap_writable_pages

### Signature
`gpointer gum_memory_try_remap_writable_pages (gpointer first_page, guint n_pages)`

### Parameters
- **first_page** (gpointer) - The starting address of the memory pages. Can be NULL.
- **n_pages** (guint) - The number of pages to remap.

### Return Value
- **gpointer** - Returns a pointer to the remapped memory, or NULL if the operation fails.
```

--------------------------------

### Dynamic Branch Instruction

Source: https://frida.re/docs/stalker

Example of a branch instruction where the target is not static, such as a function pointer call.

```assembly
br x0
```

--------------------------------

### Initialize Stalker Slab Configuration

Source: https://frida.re/docs/stalker

Initialization logic that calculates slab sizes and block capacities based on system page size.

```c
#define GUM_CODE_SLAB_MAX_SIZE  (4 * 1024 * 1024)
#define GUM_EXEC_BLOCK_MIN_SIZE 1024

static void
gum_stalker_init (GumStalker * self)
{
  ...

  self->page_size = gum_query_page_size ();
  self->slab_size =
      GUM_ALIGN_SIZE (GUM_CODE_SLAB_MAX_SIZE, self->page_size);
  self->slab_header_size =
      GUM_ALIGN_SIZE (GUM_CODE_SLAB_MAX_SIZE / 12, self->page_size);
  self->slab_max_blocks = (self->slab_header_size -
      G_STRUCT_OFFSET (GumSlab, blocks)) / sizeof (GumExecBlock);

  ...
}
```

--------------------------------

### Configure Gadget ScriptDirectory

Source: https://frida.re/docs/gadget

Minimal JSON configuration to enable the script-directory interaction type.

```json
{
  "interaction": {
    "type": "script-directory",
    "path": "/usr/local/frida/scripts"
  }
}
```

--------------------------------

### Define activation target

Source: https://frida.re/docs/gum/method.Stalker.prefetch.html

Example of defining a non-inlineable function to serve as a target for Stalker reactivation.

```c
__attribute__ ((noinline)) static void activation_target (void) { // Avoid calls being optimized out asm (“”); }
```

--------------------------------

### writeAll()

Source: https://frida.re/docs/javascript-api

Writes all buffered instructions to the output.

```APIDOC
## writeAll()

### Description
Writes all instructions currently held in the relocator's buffer to the destination.
```

--------------------------------

### Configure Gadget script loading

Source: https://frida.re/docs/gadget

Define the interaction type and filesystem path for the instrumentation script in the Gadget configuration file.

```json
{
  "interaction": {
    "type": "script",
    "path": "/home/oleavr/explore.js"
  }
}
```

--------------------------------

### Attaching a Listener with GumInterceptor

Source: https://frida.re/docs/gum/class.Interceptor.html

Demonstrates how to obtain an interceptor, create a call listener, and attach it to a function using a transaction.

```c
static void on_enter (GumInvocationContext * ic, gpointer user_data);
static void on_leave (GumInvocationContext * ic, gpointer user_data);

void
instrument (void)
{
  g_autoptr(GumInterceptor) interceptor = gum_interceptor_obtain ();
  GumInvocationListener * listener =
      gum_make_call_listener (on_enter, on_leave, NULL, NULL);

  gum_interceptor_begin_transaction (interceptor);
  gum_interceptor_attach (interceptor,
      GSIZE_TO_POINTER (gum_module_find_global_export_by_name ("open")),
      listener, NULL);
  gum_interceptor_end_transaction (interceptor);
}
```

--------------------------------

### Compile and run target

Source: https://frida.re/docs/messages

Commands to compile the C target and observe its output.

```bash
$ gcc -Wall hello.c -o hello
```

```text
f() is at 0x400544
Number: 0
Number: 1
Number: 2
…
```

--------------------------------

### Handle JavaScript runtime errors

Source: https://frida.re/docs/messages

Example of an error message received by the host when the injected JavaScript throws an exception.

```text
{'type': 'error', 'description': 'ReferenceError: a is not defined', 'lineNumber': 1}
```

--------------------------------

### Initialize Gum library

Source: https://frida.re/docs/gum/func.init.html

Initializes the Gum library. This function should be called before using other Gum features.

```c
void
gum_init (
  void
)
```

--------------------------------

### Get thread name via native function

Source: https://frida.re/docs/stalker

Retrieves the name of a thread using the native pthread_getname_np function.

```c
int pthread_getname_np(pthread_t thread,
                       char *name, size_t len);
```

--------------------------------

### Shorthand Utilities

Source: https://frida.re/docs/javascript-api

Convenience functions for creating Int64, UInt64, and NativePointer objects.

```APIDOC
### Shorthand Functions

- `int64(v)`: Shorthand for `new Int64(v)`
- `uint64(v)`: Shorthand for `new UInt64(v)`
- `ptr(s)`: Shorthand for `new NativePointer(s)`
- `NULL`: Shorthand for `ptr("0")`
```

--------------------------------

### Run test script

Source: https://frida.re/docs/installation

Execute the verification script to confirm Frida is working.

```bash
$ python example.py
```

--------------------------------

### gum_stalker_follow_me Assembly Implementation

Source: https://frida.re/docs/stalker

AArch64 assembly implementation of gum_stalker_follow_me, handling stack frame setup and register preservation.

```asm
#ifdef __APPLE__
  .globl _gum_stalker_follow_me
_gum_stalker_follow_me:
#else
  .globl gum_stalker_follow_me
  .type gum_stalker_follow_me, %function
gum_stalker_follow_me:
#endif
  stp x29, x30, [sp, -16]!
  mov x29, sp
  mov x3, x30
#ifdef __APPLE__
  bl __gum_stalker_do_follow_me
#else
  bl _gum_stalker_do_follow_me
#endif
  ldp x29, x30, [sp], 16
  br x0
```

--------------------------------

### Resolve Module Exports and Imports

Source: https://frida.re/docs/gum/iface.ApiResolver.html

Demonstrates how to use a module-based resolver to enumerate exports or imports using glob patterns.

```C
void
start (void)
{
  g_autoptr(GumApiResolver) resolver = gum_api_resolver_make ("module");

  gum_api_resolver_enumerate_matches (resolver,
                                      "exports:libc*.so!open*",
                                      // case-insensitive: "exports:*!open/i"
                                      // imports: "imports:example.so!open*"
                                      instrument_c_function,
                                      NULL,
                                      NULL);
}

static gboolean
instrument_c_function (const GumApiDetails *details,
                       gpointer user_data)
{
  g_print ("Found %s at %" G_GINT64_MODIFIER "x\n",
           details->name,
           details->address);
  // e.g.: "Found /system/lib/libc.so at 0x7fff870135c9"

  return TRUE; // keep enumerating
}
```

--------------------------------

### Create test script

Source: https://frida.re/docs/installation

A Python script to attach to the target process and enumerate modules.

```python
import frida

def on_message(message, data):
    print("[on_message] message:", message, "data:", data)

session = frida.attach("cat")

script = session.create_script("""
rpc.exports.enumerateModules = () => {
  return Process.enumerateModules();
};
""")
script.on("message", on_message)
script.load()

print([m["name"] for m in script.exports_sync.enumerate_modules()])
```

--------------------------------

### ARM64 Context Helper Implementation

Source: https://frida.re/docs/stalker

This snippet demonstrates how to push registers, calculate the original stack pointer, and save ALU flags to the context.

```c
/* GumCpuContext.x[29] + fp + lr + padding */
    // X29 is Frame Pointer
    // X30 is the Link Register
    // X15 is pushed just for padding again
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X30, ARM64_REG_X15);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X28, ARM64_REG_X29);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X26, ARM64_REG_X27);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X24, ARM64_REG_X25);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X22, ARM64_REG_X23);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X20, ARM64_REG_X21);

    // Store X19 (currently holding the LR value for this function
    // to return to, the address of the caller written by
    // gum_exec_ctx_write_prolog()) in X20 temporarily. We have
    // already pushed X20 so we can use it freely, but we want to
    // push the app's value of X19 into the context. This was
    // pushed onto the stack by the code in
    // gum_exec_ctx_write_prolog() so we can restore it from there
    // before we push it.
    gum_arm64_writer_put_mov_reg_reg (cw,
        ARM64_REG_X20, ARM64_REG_X19);

    // Restore X19 from the value pushed by the prolog before the
    // call to the helper.
    gum_arm64_writer_put_ldr_reg_reg_offset (cw,
        ARM64_REG_X19, ARM64_REG_SP,
        (6 * 16) + (4 * 32));

    // Push the app's values of X18 and X19. X18 was unmodified. We
    // have corrected X19 above.
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X18, ARM64_REG_X19);

    // Restore X19 from X20
    gum_arm64_writer_put_mov_reg_reg (cw,
        ARM64_REG_X19, ARM64_REG_X20);

    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X16, ARM64_REG_X17);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X14, ARM64_REG_X15);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X12, ARM64_REG_X13);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X10, ARM64_REG_X11);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X8, ARM64_REG_X9);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X6, ARM64_REG_X7);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X4, ARM64_REG_X5);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X2, ARM64_REG_X3);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X0, ARM64_REG_X1);

    /* GumCpuContext.pc + sp */

    // We are going to store the PC and SP here. The PC is set to
    // zero, for the SP, we have to calculate the original SP
    // before we stored all of this context information. Note we
    // use the zero register here (a special register in AArch64
    // which always has the value 0).
    gum_arm64_writer_put_mov_reg_reg (cw,
        ARM64_REG_X0, ARM64_REG_XZR);
    gum_arm64_writer_put_add_reg_reg_imm (cw,
        ARM64_REG_X1, ARM64_REG_SP,
        (16 * 16) + (4 * 32) + 16 + GUM_RED_ZONE_SIZE);
    gum_arm64_writer_put_push_reg_reg (cw,
        ARM64_REG_X0, ARM64_REG_X1);

    immediate_for_sp += sizeof (GumCpuContext) + 8;
  }

  // Store the Arithmetic Logic Unit flags into X15. Whilst it might
  // appear that the above add instruction used to calculate the
  // original stack pointer may have changed the flags, AArch64 has
  // an ADD instruction which doesn't modify the condition flags
  // and an ADDS instruction which does.
  gum_arm64_writer_put_instruction (cw, mrs_x15_nzcv);

  /* conveniently point X20 at the beginning of the saved
     registers */
  // X20 is used later by functions such as
  // gum_exec_ctx_load_real_register_from_full_frame_into() to emit
  // code which references the saved frame.
  gum_arm64_writer_put_mov_reg_reg (cw, ARM64_REG_X20, ARM64_REG_SP);

  /* padding + status */
  // This pushes the flags to ensure that they can be restored
  // correctly after executing inside of Stalker.
  gum_arm64_writer_put_push_reg_reg (cw,
      ARM64_REG_X14, ARM64_REG_X15);
  immediate_for_sp += 1 * 16;

  // We saved our LR into X19 on entry so that we could branch back
  // to the instrumented code once this helper has run. Although
  // the instrumented code called us, we restored LR to its previous
  // value before the helper was called (the app code). Although the
  // LR is not callee-saved (e.g. it is not our responsibility to
  // save and restore it on return, but rather that of our caller),
  // it is done here to minimize the code size of the inline stub in
  // the instrumented block.
  gum_arm64_writer_put_br_reg_no_auth (cw, ARM64_REG_X19);
}
```

--------------------------------

### Implement instrumentation script skeleton

Source: https://frida.re/docs/gadget

Use rpc.exports to define init and dispose lifecycle methods, and Interceptor to hook functions like open.

```javascript
rpc.exports = {
  init(stage, parameters) {
    console.log('[init]', stage, JSON.stringify(parameters));

    Interceptor.attach(Module.getGlobalExportByName('open'), {
      onEnter(args) {
        const path = args[0].readUtf8String();
        console.log('open("' + path + '")');
      }
    });
  },
  dispose() {
    console.log('[dispose]');
  }
};
```

--------------------------------

### Display gum-graft usage and help options

Source: https://frida.re/docs/gum-graft

View the command-line interface options and usage instructions for the gum-graft utility.

```text
Usage:
  gum-graft [OPTION?] BINARY - graft instrumentation into Mach-O binaries

Help Options:
  -h, --help                       Show help options

Application Options:
  -i, --instrument=0x1234          Include instrumentation for a specific code offset
  -s, --ingest-function-starts     Include instrumentation for offsets retrieved from LC_FUNCTION_STARTS
  -m, --ingest-imports             Include instrumentation for imports
  -z, --transform-lazy-binds       Transform lazy binds into regular binds (experimental)
```

--------------------------------

### List processes on Android

Source: https://frida.re/docs/android

Verify Frida communication by listing processes on the USB-connected device.

```bash
$ frida-ps -U
```

--------------------------------

### Querying a SQLite database

Source: https://frida.re/docs/javascript-api

Demonstrates opening a database, preparing a statement with a bound parameter, and iterating through the result set.

```javascript
const db = SqliteDatabase.open('/path/to/people.db');

const smt = db.prepare('SELECT name, bio FROM people WHERE age = ?');

console.log('People whose age is 42:');
smt.bindInteger(1, 42);
let row;
while ((row = smt.step()) !== null) {
  const [name, bio] = row;
  console.log('Name:', name);
  console.log('Bio:', bio);
}
smt.reset();
```

--------------------------------

### void gum_memory_dispose_writable_pages (gpointer first_page, guint n_pages)

Source: https://frida.re/docs/gum/func.memory_dispose_writable_pages.html

Disposes of a specified number of writable memory pages starting from the provided address.

```APIDOC
## void gum_memory_dispose_writable_pages (gpointer first_page, guint n_pages)

### Description
Disposes of writable memory pages. The data is owned by the caller of the function.

### Parameters
- **first_page** (gpointer) - The starting address of the memory pages. Can be NULL.
- **n_pages** (guint) - The number of pages to dispose.
```

--------------------------------

### void gum_ensure_code_readable (gconstpointer address, gsize size)

Source: https://frida.re/docs/gum/func.ensure_code_readable.html

Ensures that the memory range starting at the specified address with the given size is readable.

```APIDOC
## void gum_ensure_code_readable (gconstpointer address, gsize size)

### Description
Ensures that the memory region starting at the provided address with the specified size is readable.

### Parameters
- **address** (gconstpointer) - The starting memory address. Can be NULL.
- **size** (gsize) - The size of the memory region to check.
```

--------------------------------

### GumFoundDarwinInitPointersFunc

Source: https://frida.re/docs/gum/callback.FoundDarwinInitPointersFunc.html

Callback function signature for processing Darwin initialization pointers.

```APIDOC
## GumFoundDarwinInitPointersFunc

### Signature
`gboolean (* GumFoundDarwinInitPointersFunc) (const GumDarwinInitPointersDetails* details, gpointer user_data)`

### Parameters
- **details** (const GumDarwinInitPointersDetails*) - Pointer to the initialization details structure.
- **user_data** (gpointer) - User-provided data passed to the callback, can be NULL.

### Return Value
- **gboolean** - Returns a boolean value.
```

--------------------------------

### Module.load(path)

Source: https://frida.re/docs/javascript-api

Loads a module from the specified filesystem path.

```APIDOC
## Module.load(path)

### Description
Loads the specified module from the filesystem path and returns a Module object. Throws an exception if the module cannot be loaded.

### Parameters
- **path** (string) - Required - The filesystem path to the module.
```

--------------------------------

### void gum_mprotect (gpointer address, gsize size, GumPageProtection prot)

Source: https://frida.re/docs/gum/func.mprotect.html

Changes the memory protection of a memory region starting at the specified address.

```APIDOC
## void gum_mprotect (gpointer address, gsize size, GumPageProtection prot)

### Description
Changes the memory protection of a memory region.

### Parameters
- **address** (gpointer) - The starting address of the memory region. Can be NULL.
- **size** (gsize) - The size of the memory region.
- **prot** (GumPageProtection) - The desired page protection settings.
```

--------------------------------

### Initialize session with JSON parameters

Source: https://frida.re/docs/frida-trace

Pass a JSON object to the global parameters variable using the -P option.

```bash
-P '{"displayPid": true}'
```

```bash
-P "{""displayPid"": true}"
```

--------------------------------

### gum_init

Source: https://frida.re/docs/gum/func.init.html

Initializes the Frida Gum library. This function should be called before using other Gum features.

```APIDOC
## void gum_init (void)

### Description
Initializes the Frida Gum library.

### Signature
`void gum_init (void)`
```

--------------------------------

### Get return address from invocation context

Source: https://frida.re/docs/gum/method.InvocationContext.get_return_address.html

Retrieves the return address associated with the provided invocation context. The returned pointer is owned by the instance and may be NULL.

```C
gpointer
gum_invocation_context_get_return_address (
  GumInvocationContext* context
)
```
Tokens:
Raw