Learn Frida

https://learnfrida.info/
Admin
Learn Frida is a practical handbook introducing binary instrumentation techniques using the Frida...
Tokens:70,423
Snippets:866
Trust Score:6.9
Update:3 months ago
Show doc for...
Tokens:
Raw
### Test r2frida setup with a binary

Source: https://learnfrida.info/r2frida

Verify that r2frida is correctly installed and functional by opening a binary, such as /bin/ls, within radare2. This command should launch r2's shell.

```bash
r2 frida:///bin/ls
```

--------------------------------

### Clone Frida Agent Example Repository

Source: https://learnfrida.info/basic_usage?q=

Alternatively, clone the example agent repository to get a pre-configured project structure.

```bash
git clone git://github.com/oleavr/frida-agent-example.git
```

--------------------------------

### Install Agent Dependencies

Source: https://learnfrida.info/basic_usage

Run `npm install` after creating the agent to install all necessary development and runtime dependencies.

```bash
$ npm install
```

--------------------------------

### Clone Frida Agent Example Repository

Source: https://learnfrida.info/basic_usage

Alternatively, clone the example agent repository from GitHub to get a pre-configured agent structure.

```bash
$ git clone git://github.com/oleavr/frida-agent-example.git
```

--------------------------------

### Install Agent Dependencies

Source: https://learnfrida.info/basic_usage?q=

Before building or running the agent, install the necessary Node.js dependencies using npm.

```bash
npm install
```

--------------------------------

### Trace Process with CreateFileW Instrumentation

Source: https://learnfrida.info/basic_usage?q=

This practical example demonstrates how to instrument the CreateFileW function in the notepad.exe process to observe file operations.

```bash
$ frida-trace -i "CreateFileW" notepad.exe
```

--------------------------------

### Install r2frida using r2pm

Source: https://learnfrida.info/r2frida

Install the r2frida plugin using the radare2 package manager. This is the recommended method for setting up the plugin.

```bash
r2pm -ci r2frida
```

--------------------------------

### C Code Example for fopen

Source: https://learnfrida.info/r2frida

A simple C program that demonstrates the usage of fopen and fclose to create and close a file.

```c
#include <stdio.h>

int main()
{
  FILE *fp = NULL;
  fp = fopen("sample_file.dat", "w");
  fclose(fp);
  return 0;
}

```

--------------------------------

### Install Frida and frida-tools

Source: https://learnfrida.info/basic_usage?q=

Installs the necessary Frida packages using pip. Ensure you have Python and pip installed.

```bash
$ pip install frida frida-tools

```

--------------------------------

### Start frida-server

Source: https://learnfrida.info/basic_usage

Start the frida-server on the remote system, listening on all network interfaces (0.0.0.0) on the default port. This makes the server accessible for remote connections.

```bash
./frida-server-16.0.11-linux-x86_64 -l 0.0.0.0

```

--------------------------------

### Process Output Example

Source: https://learnfrida.info/intermediate_usage?q=

This snippet shows example output from a Frida process, including process ID, file descriptor, and data received. It also indicates when a process is detached.

```text
[*] output: pid=1471858, fd=1, data=b'127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4\n::1         localhost localhost.localdomain localhost6 localhost6.localdomain6\n\n\n127.0.0.1 vertex\n::1       vertex\n'
[*] output: pid=1471858, fd=2, data=b''
[*] output: pid=1471858, fd=1, data=b''
[-] detached: pid=1471858, reason='process-terminated'
```

--------------------------------

### Frida Execution Example

Source: https://learnfrida.info/intermediate_usage?q=

An example of how to run the Frida script with the target C program. The output shows the modified usage message, confirming the string replacement.

```bash
frida -f a.out -l ins.js --no-pause -q
. . . .   Connected to Local System (id=local)
Spawned `a.out`. Resuming main thread!
Usage: a.out <foobar> <port>


```

--------------------------------

### Frida Agent Project Structure Example

Source: https://learnfrida.info/basic_usage?q=

After running `frida-create agent`, the project will have a structure including agent source files, package configuration, and build tools.

```bash
frida-create agent
Created ./package.json
Created ./tsconfig.json
Created ./agent/index.ts
Created ./agent/logger.ts
Created ./.gitignore

Run `npm install` to bootstrap, then:
- Keep one terminal running: npm run watch
- Inject agent using the REPL: frida Calculator -l _agent.js
- Edit agent/*.ts – REPL will live-reload on save

Tip: Use an editor like Visual Studio Code for code completion, inline docs,
     instant type-checking feedback, refactoring tools, etc.

$ ls -l
total 16
drwxr-xr-x  4 fernandou  primarygroup  128 14 Feb 15:46 agent/
-rw-r--r--  1 fernandou  primarygroup  449 14 Feb 15:46 package.json
-rw-r--r--  1 fernandou  primarygroup  167 14 Feb 15:46 tsconfig.json
```

--------------------------------

### Instrument API Calls with Wildcard Pattern

Source: https://learnfrida.info/basic_usage?q=

Use the '*' wildcard with the -i parameter to instrument functions matching a starting pattern. This example instruments all functions starting with CreateFile.

```bash
$ frida-trace -i "CreateFile*"
```

--------------------------------

### Install frida-tools

Source: https://learnfrida.info/basic_usage?q=

Install the frida-tools Python package using pip. This package provides CLI tools for instrumentation.

```bash
$ pip install frida-tools

```

--------------------------------

### Frida-Trace Output Example

Source: https://learnfrida.info/basic_usage?q=

This is an example of the output generated by frida-trace when instrumenting functions. It shows the initialization of handlers for specific functions.

```text
Instrumenting functions...
CreateFileW: Auto-generated handler at "/Users/fernandou/__handlers__/KERNEL32.DLL/CreateFileW.js"
CreateFileW: Auto-generated handler at "/Users/fernandou/__handlers__/KERNELBASE.dll/CreateFileW.js"
Started tracing 2 functions. Press Ctrl+C to stop.

```

--------------------------------

### Frida CLI Execution Example

Source: https://learnfrida.info/intermediate_usage

Shows the command-line invocation of Frida to instrument a binary (`a.out`) with a JavaScript script (`ins.js`) and observe the modified output. The `--no-pause` flag prevents the target from pausing at the start.

```bash
frida -f a.out -l ins.js --no-pause -q

```

--------------------------------

### Frida Output Example

Source: https://learnfrida.info/intermediate_usage

Example output from Frida demonstrating that the instrumentation was successful, as indicated by the modified usage string printed to stderr.

```text
. . . .   Connected to Local System (id=local)
Spawned `a.out`. Resuming main thread!                                  
Usage: a.out <foobar> <port>


```

--------------------------------

### frida-trace Output Example

Source: https://learnfrida.info/macos?q=

Example output from `frida-trace` showing the calls to `-[NSFileManager fileExistsAtPath:]` and related methods.

```text
/* TID 0x407 */
    60 ms  -[NSFileManager fileExistsAtPath:0x10f24f018]
    60 ms     | -[NSFileManager getFileSystemRepresentation:0x7ffee09b43e0 maxLength:0x400 withPath:0x10f24f018]

```

--------------------------------

### Start Frida Server

Source: https://learnfrida.info/basic_usage?q=

Launch the frida-server on the remote system, making it listen on all network interfaces (0.0.0.0) on the default port. This allows remote clients to connect.

```bash
$ ./frida-server-16.0.11-linux-x86_64 -l 0.0.0.0

```

--------------------------------

### C Program for Custom Library Loading Example

Source: https://learnfrida.info/advanced_usage

This C program demonstrates file operations by creating and writing to a file. It serves as a target for demonstrating how to replace standard library functions like `fopen` using custom DLLs with Frida.

```c
#include <stdio.h>
#include <stdlib.h>

int main() {
    FILE *fp;
    fp = fopen("file.txt", "w+");
    fprintf(fp, "%s %s", "May the force", "be with you");
    fclose(fp);
    return 0;
}


```

--------------------------------

### Download Frida Server

Source: https://learnfrida.info/basic_usage?q=

Download the frida-server binary for Linux x86_64. Ensure the server version matches your local Frida installation.

```bash
$ wget https://github.com/frida/frida/releases/download/16.0.11/frida-server-16.0.11-linux-x86_64.xz

```

--------------------------------

### Frida Child Gating Script Example

Source: https://learnfrida.info/intermediate_usage?q=

This is an example of Frida's official child-gating script, which is used to detect and follow child processes. Note that this feature is not available in CLI tools like frida-trace.

```javascript
/*
This script demonstrates Frida's child-gating feature.
It's OS-dependent: Windows uses CreateProcessInternalW, Linux uses fork()/vfork().
*/

// Example placeholder for actual child-gating logic
console.log("Child gating script loaded.");

// On Windows, you might hook CreateProcessInternalW to detect child processes.
// On Linux, you might hook fork() and vfork().

// This is a conceptual example and would require specific API hooks.

```

--------------------------------

### Frida Child Gating Script Example

Source: https://learnfrida.info/intermediate_usage

This is an example of Frida's official child-gating script, which is used to detect and follow child processes spawned by a target application. Note that this feature is not available in CLI tools like frida-trace.

```javascript
/*
 * Copyright (C) 2018-2023 Frida's author.
 * Licensed under the Apache License.
 *
 * Example: https://codeshare.frida.re/@d0c-byte/child-gating/
 */


function onChildGated(pid, tid, reason) {
    console.log(`Child process ${pid} was gated, reason: ${reason}`);
}

function onChildStarted(pid, tid, name) {
    console.log(`Child process ${pid} started, name: ${name}`);
}

function onChildExited(pid, tid, reason) {
    console.log(`Child process ${pid} exited, reason: ${reason}`);
}

function main() {
    console.log('Starting child gating...');

    const childGating = new ChildGating({
        onChildGated,
        onChildStarted,
        onChildExited
    });

    childGating.enable();
}

setImmediate(main);

```

--------------------------------

### C Program Example

Source: https://learnfrida.info/intermediate_usage?q=

A basic C program that utilizes fprintf and checks for command-line arguments. This serves as the target for Frida instrumentation.

```c
int main(int argc, char *argv[]){
        if(argc < 3){
                fprintf(stderr, "Usage: %s <target> <port>\n", argv[0]);
                exit(1); 
        }
        return 0;
}

```

--------------------------------

### frida-trace Output Example

Source: https://learnfrida.info/macos?q=

Sample output from frida-trace showing the sequence of NSURL method calls, including initWithString. This helps in understanding the object's lifecycle and identifying relevant methods for interception.

```text
Started tracing 1987 functions. Press Ctrl+C to stop.
  /* TID 0x407 */
  1007 ms  -[NSURL initWithString:0x7fa35550bb40]
  1008 ms     | -[NSURL initWithString:0x7fa35550bb40 relativeToURL:0x0]
  1008 ms  -[NSURL isFileReferenceURL]
  1008 ms     | -[NSURL _cfurl]
  1008 ms  -[NSURL retain]
  1009 ms  -[NSURL retain]
  1009 ms  -[NSURL retain]
  1009 ms  -[NSURL release]
  1009 ms  -[NSURL retain]
  1009 ms  -[NSURL release]
  1009 ms  -[NSURL retain]
  1010 ms  -[NSURL release]
  1010 ms  -[NSURL retain]
  1010 ms  -[NSURL description]
  1010 ms     | -[NSURL scheme]
  1010 ms     |    | -[NSURL _cfurl]
  1010 ms     | -[NSURL baseURL]
  1010 ms     |    | -[NSURL _cfurl]
  1010 ms     | -[NSURL relativeString]
  1010 ms     |    | -[NSURL _cfurl]
  1010 ms  -[NSURL release]
  1010 ms  -[NSURL release]
  1010 ms  -[NSURL release]
  1010 ms  -[NSURLSessionConfiguration setDisposition:0x7fff88b58508]


```

--------------------------------

### C++ Example: Printing std::vector Size

Source: https://learnfrida.info/intermediate_usage

A basic C++ program demonstrating how to create and print the size of a std::vector.

```cpp
// clang++ vectortest.cc
#include <vector>
#include <iostream>

void print_vector_size(std::vector<int> v)
{
    std::cout << "vector size:" << v.size() << std::endl;
}

int main()
{
    std::vector<int> v = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10};
    print_vector_size(v);
    return 0;
}


```

--------------------------------

### Compile C program using clang

Source: https://learnfrida.info/advanced_usage

Compile a C source file using clang, ensuring all warnings are enabled. This command is used to build the `timeofday.c` example.

```bash
clang -Wall timeofday.c -o timeofday

```

--------------------------------

### Sample Frida Output for NSURL Interception

Source: https://learnfrida.info/macos

Example output from Frida when intercepting -[NSURL initWithString:]. Shows the logged method call and the resulting string.

```text
           /* TID 0x407 */
  1003 ms  -[NSURL initWithString:0x7fa35550bb40]
  1003 ms  http://www.stackoverflow.com
  1008 ms     | -[NSURL initWithString:0x7fa35550bb40 relativeToURL:0x0]
  1008 ms  -[NSURL isFileReferenceURL]
  1008 ms     | -[NSURL _cfurl]
```

--------------------------------

### Frida Console Output

Source: https://learnfrida.info/java

This is an example of the console output when the instrumented `getString` method is called after interacting with the shared preferences button in the demo application.

```text
[Android Emulator 5554::learnfrida ]-> on_enter parameters 2131689593 foobarstring
returnedString foobarstring

```

--------------------------------

### Swift Encryption Example

Source: https://learnfrida.info/macos?q=

This Swift code snippet demonstrates how to use CryptoKit to encrypt data using AES.GCM.seal. It sets up a key, nonce, and encrypts a sample string.

```swift
import Foundation
import CryptoKit

let pass = "foobar"
let data = "frida is fun!".data(using: .utf8)!
let key = SymmetricKey(data: SHA256.hash(data: pass.data(using: .utf8)!))
let iv = AES.GCM.Nonce()
let mySealedBox = try AES.GCM.seal(data, using: key, nonce: iv)
let dataToShare = mySealedBox.combined?.base64EncodedData()

```

--------------------------------

### Python Device and Spawn

Source: https://learnfrida.info/basic_usage?q=

This snippet shows how to get the local Frida device and spawn a new process. The spawned process remains suspended until resumed.

```python
device = frida.get_local_device()
pid = device.spawn(process_name)
print('pid: %d' % pid)

```

--------------------------------

### Objective-C Main Function Example

Source: https://learnfrida.info/macos?q=

This Objective-C code snippet demonstrates the usage of `NSFileManager` to check if a file exists and if it is a directory. It serves as the target for Frida's instrumentation.

```objective-c
int main(int argc, const char * argv[]) {
    @autoreleasepool {
        NSString *filepath = @"/Users/fernandou/Desktop/test.c";
        NSFileManager *fileManager = [NSFileManager defaultManager];
        BOOL res;

        if ([fileManager fileExistsAtPath:filepath isDirectory:&res]) {
            NSLog(@"File exists.");
        }
        else {
            NSLog(@"File does not exist.");
        }
    }
    return 0;
}

```

--------------------------------

### Example Output of C to JS Notifications

Source: https://learnfrida.info/advanced_usage

Demonstrates the console output generated when the C code successfully notifies the JavaScript environment. This output shows the values received by the JavaScript callback.

```text
[Local::a.out ]-> notification from C code, value: 0
notification from C code, value: 10000
notification from C code, value: 20000
notification from C code, value: 30000
notification from C code, value: 40000
notification from C code, value: 50000
notification from C code, value: 60000
notification from C code, value: 70000
notification from C code, value: 80000
notification from C code, value: 90000
Time ellapsed: 0.024194
```

--------------------------------

### Prepare Frida Server Binary

Source: https://learnfrida.info/basic_usage?q=

Extract the downloaded frida-server archive and grant it execute permissions. Use the 'file' command to verify the binary type.

```bash
$ unxz frida-server-16.0.11-linux-x86_64.xz
$ file frida-server-16.0.11-linux-x86_64
$ chmod +x frida-server-16.0.11-linux-x86_64

```

--------------------------------

### Spawn and Instrument Remote Process

Source: https://learnfrida.info/basic_usage?q=

Spawn a binary on the remote server using the -f flag and connect using the -H flag. The --pause option starts the process in a suspended state.

```bash
$ frida -H 192.168.1.101 -f /bin/ls --pause

```

--------------------------------

### Select Frida Runtime

Source: https://learnfrida.info/basic_usage?q=

Choose between the QuickJS (`qjs`) and V8 (`v8`) runtimes using the `--runtime` argument. V8 offers better language features and error logging but has more expensive VM exits. QuickJS is sufficient for basic scripts.

```bash
--runtime=qjs
--runtime=v8
```

--------------------------------

### Instrument Specific API Call in a Module

Source: https://learnfrida.info/basic_usage?q=

Combine -i and -I parameters to instrument a specific API call within a particular module. This example instruments only KERNEL32.DLL's CreateFileW.

```bash
$ frida-trace -i "CreateFileW" -I "KERNEL32.DLL"
```

--------------------------------

### Compile and Run C Program with Frida

Source: https://learnfrida.info/basic_usage

Demonstrates the workflow of compiling a C program, launching it with Frida, and then using Frida to enumerate its loaded modules.

```bash
$ clang hello.c
$ frida -f a.out
```

```javascript
Process.enumerateModulesSync()
```

```bash
$ clang hello.c
$ frida -f a.out --pause
```

```javascript
Process.enumerateModulesSync()
```

```javascript
console.log(hexdump(ptr(0x559b2f496000)))
```

--------------------------------

### Select Frida Runtime

Source: https://learnfrida.info/basic_usage

Choose between the QuickJS (`qjs`) and V8 (`v8`) JavaScript runtimes using the `--runtime` argument. V8 offers more detailed error logs and better performance for complex scripts, while QuickJS is sufficient for basic scripts and has less expensive VM exits.

```bash
$ frida --runtime=qjs
$ frida --runtime=v8
```

--------------------------------

### Frida Command Line Spawn and Inject

Source: https://learnfrida.info/basic_usage

Shows how to use Frida's command line to spawn a new process and immediately inject an instrumentation script. The `-f` parameter specifies the path to the executable.

```bash
$ frida -l myscript.js -f <filepath>


```

--------------------------------

### Python Session, Script Creation, and Loading

Source: https://learnfrida.info/basic_usage?q=

This code demonstrates attaching to a process, creating a new instrumentation script, assigning a message callback, and loading the script into the session. The process is then resumed.

```python
session = device.attach(pid)

script = session.create_script(code)
script.on('message', on_message)
script.load()

device.resume(pid)

```

--------------------------------

### Allocate UTF-8 String and Get Pointer

Source: https://learnfrida.info/basic_usage?q=

Allocate memory for a UTF-8 encoded string and get a pointer to it. This pointer can be used in place of other string pointers.

```javascript
Memory.allocUtf8String('foo')
```

--------------------------------

### CModule JavaScript Setup with Notification Callback

Source: https://learnfrida.info/advanced_usage

Combines the CModule definition with the JavaScript NativeCallback for receiving notifications. This setup allows C code to signal events back to the JavaScript environment.

```javascript
const cm = new CModule(`
    #include <gum/guminterceptor.h>

    extern double sqrtReturnPtr;
    extern void notify_from_c(const double * value);

    void onLeave(GumInvocationContext * ic)
    {
      double result;
      result = (double)gum_invocation_context_get_return_value(ic);
      sqrtReturnPtr = result;
      if ((int)sqrtReturnPtr % 1337 == 0)
      {
        notify_from_c(&sqrtReturnPtr);
      }
    }
  `, {
  sqrtReturnPtr,
  notify_from_c: new NativeCallback(notifyPtr => {
    const notifyValue = notifyPtr.readDouble();
    console.log('notification from C code, value: ' + notifyValue);
  }, 'void', ['pointer'])
});
```

--------------------------------

### Spawn and Instrument Process with Frida

Source: https://learnfrida.info/intermediate_usage

This snippet shows how to spawn a process, attach to it, enable child gating, create and load a JavaScript script for instrumentation, and resume the process. It also handles detached events and child process additions.

```python
import threading

import frida
from frida_tools.application import Reactor


class Application(object):
    def __init__(self):
        self._stop_requested = threading.Event()
        self._reactor = Reactor(run_until_return=lambda reactor: self._stop_requested.wait())

        self._device = frida.get_local_device()
        self._sessions = set()

        self._device.on("child-added", lambda child: self._reactor.schedule(lambda: self._on_child_added(child)))
        self._device.on("child-removed", lambda child: self._reactor.schedule(lambda: self._on_child_removed(child)))
        self._device.on("output", lambda pid, fd, data: self._reactor.schedule(lambda: self._on_output(pid, fd, data)))

    def run(self):
        self._reactor.schedule(lambda: self._start())
        self._reactor.run()

    def _start(self):
        argv = ["/bin/sh", "-c", "cat /etc/hosts"]
        env = {
            "BADGER": "badger-badger-badger",
            "SNAKE": "mushroom-mushroom",
        }
        print("✔ spawn(argv={})".format(argv))
        pid = self._device.spawn(argv, env=env, stdio='pipe')
        self._instrument(pid)

    def _stop_if_idle(self):
        if len(self._sessions) == 0:
            self._stop_requested.set()

    def _instrument(self, pid):
        print("[*] attach(pid={})".format(pid))
        session = self._device.attach(pid)
        session.on("detached", lambda reason: self._reactor.schedule(lambda: self._on_detached(pid, session, reason)))
        print("[*] enable_child_gating()")
        session.enable_child_gating()
        print("[*] create_script()")
        script = session.create_script("""
Interceptor.attach(Module.getExportByName(null, 'open'), {
  onEnter(args) {
    send({
      type: 'open',
      path: Memory.readUtf8String(args[0])
    });
  }
});
""")
        script.on("message", lambda message, data: self._reactor.schedule(lambda: self._on_message(pid, message)))
        print("[*] load()")
        script.load()
        print("[*] resume(pid={})".format(pid))
        self._device.resume(pid)
        self._sessions.add(session)

    def _on_child_added(self, child):
        print("[+] child_added: {}".format(child))
        self._instrument(child.pid)

    def _on_child_removed(self, child):
        print("[-] child_removed: {}".format(child))

    def _on_output(self, pid, fd, data):
        print("[*] output: pid={}, fd={}, data={}".format(pid, fd, repr(data)))

    def _on_detached(self, pid, session, reason):
        print("[-] detached: pid={}, reason='{}'".format(pid, reason))
        self._sessions.remove(session)
        self._reactor.schedule(self._stop_if_idle, delay=0.5)

    def _on_message(self, pid, message):
        print("[*] message: pid={}, payload={}".format(pid, message["payload"]))


app = Application()
app.run()

```

--------------------------------

### Resume Process Execution and Observe Output

Source: https://learnfrida.info/advanced_usage

After setting up the replacement, resume the target process and observe the output from your custom function.

```javascript
%resume

```

--------------------------------

### Get Java Stacktrace Skeleton

Source: https://learnfrida.info/java

This snippet provides the basic structure for obtaining a Java stack trace within a Frida instrumentation script. It shows how to get a Thread instance and access its current stack trace.

```javascript
Java.perform(() =>{
    const thread = Java.use('java.lang.Thread').$new();

    const b64Claz = Java.use('java.util.Base64$Decoder');
        b64Claz.decode.overload('[B').implementation = function (inputString) {
            const retval = this.decode(inputString);
            const stacktrace = thread.currentThread().getStackTrace();
            return retval;
        }
});

```

--------------------------------

### Verify shared library creation

Source: https://learnfrida.info/advanced_usage?q=

Use the `file` command to verify that the compilation resulted in a valid shared object file.

```bash
$ file -f program
libtest.o: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped

```

--------------------------------

### Get Objective-C Class Module Name

Source: https://learnfrida.info/macos?q=

Retrieve the module name for an Objective-C class using the `$moduleName` property.

```javascript
[Local::objCLI]-> ObjC.classes.NSString.$moduleName
"/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation"

```

--------------------------------

### Compile C Program

Source: https://learnfrida.info/advanced_usage?q=

Command to compile the C program using clang. Ensure you have clang installed to run this command.

```bash
clang -Wall program.c -o program

```

--------------------------------

### Extract and prepare frida-server

Source: https://learnfrida.info/basic_usage

Extract the downloaded frida-server archive, check its file type, and grant it execute permissions. This prepares the server to be run on the remote system.

```bash
unxz frida-server-16.0.11-linux-x86_64.xz
file frida-server-16.0.11-linux-x86_64
chmod +x frida-server-16.0.11-linux-x86_64

```

--------------------------------

### Select JavaScript Runtime for frida-trace

Source: https://learnfrida.info/basic_usage?q=

Choose between QuickJS and V8 JavaScript runtimes using the --runtime argument. QuickJS is recommended for performance, while V8 offers modern JS features.

```bash
$ frida-trace --runtime=quickjs|v8 1234
```

--------------------------------

### Compiling an Optimized Frida Agent

Source: https://learnfrida.info/optimization

Command to compile an agent after modifying `config.mk`. This example targets a Linux x86_64 architecture.

```bash
make python-linux-x86_64
```

--------------------------------

### enumerateMatchesSync Output for fileExists*

Source: https://learnfrida.info/macos?q=

The output from `enumerateMatchesSync` when searching for methods starting with `fileExists`. It lists potential method names and their addresses.

```json
[
    {
        "address": "0x7fff211855af",
        "name": "-[NSFileManager fileExistsAtPath:]"
    },
    {
        "address": "0x7fff2117d115",
        "name": "-[NSFileManager fileExistsAtPath:isDirectory:]"
    }
]

```

--------------------------------

### Compile and Run sysinfo.c

Source: https://learnfrida.info/advanced_usage

Compile a C++ program that retrieves system information and prints the address of the SYSTEM_INFO struct.

```bash
clang -Wall sysinfo.c -o sysinfo
./sysinfo
0x16f8db5e8

```

--------------------------------

### Run frida-server in background

Source: https://learnfrida.info/java?q=

Execute frida-server in the background on the virtual device to allow Frida to connect.

```bash
./frida-server &
```

--------------------------------

### Attach Frida and Get Struct Pointer

Source: https://learnfrida.info/advanced_usage

Attach Frida to a running process and obtain the memory address of the SYSTEM_INFO struct.

```bash
$ frida -n sysinfo
[Local::ConsoleApplication2.exe]-> sysInfoPtr = ptr(0x16f8db5e8)

```

--------------------------------

### Push frida-server to device

Source: https://learnfrida.info/java?q=

Use ADB to push the frida-server executable to the virtual device's temporary directory.

```bash
adb push frida-server /data/local/tmp/
```

--------------------------------

### Launch Application with Frida Script

Source: https://learnfrida.info/basic_usage

Use the 'frida' command-line tool to launch an application with a specified JavaScript instrumentation script. The -l flag loads the script, and -f spawns the application.

```bash
frida -l instrumentation.js -f searchPathCpp.exe
```

--------------------------------

### frida-trace Output Highlighting initWithString

Source: https://learnfrida.info/macos

This snippet focuses on the initial calls to `-[NSURL initWithString:]` as observed in the frida-trace output. It is useful for identifying the exact method responsible for initializing the URL object with a string.

```text
           /* TID 0x407 */
  1003 ms  -[NSURL initWithString:0x7fa35550bb40]
  1008 ms     | -[NSURL initWithString:0x7fa35550bb40 relativeToURL:0x0]
  1008 ms  -[NSURL isFileReferenceURL]
  1008 ms     | -[NSURL _cfurl]
  1008 ms  -[NSURL retain]


```

--------------------------------

### Get Module Base Address with findBaseAddress()

Source: https://learnfrida.info/basic_usage?q=

Find the base address of a loaded module in the process. This is the first step to applying offsets.

```javascript
myBaseAddr = Module.findBaseAddress('myLib.so');
```

--------------------------------

### Frida Agent Project Structure Output

Source: https://learnfrida.info/basic_usage

This output shows the files created by `frida-create agent` and provides instructions for bootstrapping, development, and injection.

```bash
$ frida-create agent
Created ./package.json
Created ./tsconfig.json
Created ./agent/index.ts
Created ./agent/logger.ts
Created ./.gitignore

Run `npm install` to bootstrap, then:
- Keep one terminal running: npm run watch
- Inject agent using the REPL: frida Calculator -l _agent.js
- Edit agent/*.ts – REPL will live-reload on save

Tip: Use an editor like Visual Studio Code for code completion, inline docs,
     instant type-checking feedback, refactoring tools, etc.

$ ls -l
total 16
drwxr-xr-x  4 fernandou  primarygroup  128 14 Feb 15:46 agent/
-rw-r--r--  1 fernandou  primarygroup  449 14 Feb 15:46 package.json
-rw-r--r--  1 fernandou  primarygroup  167 14 Feb 15:46 tsconfig.json

```

--------------------------------

### Get Pointer Size

Source: https://learnfrida.info/basic_usage

Use Process.pointerSize to determine the size of pointers in bytes for the current process. This is crucial for portable instrumentation scripts.

```javascript
console.log(Process.pointerSize);
```

--------------------------------

### Load CModule and Toolchain with Frida CLI

Source: https://learnfrida.info/basic_usage

Load CModules using the `-C` switch and configure the toolchain with the `--toolchain` switch. These are advanced features discussed in detail elsewhere.

```bash
$ frida -C my_module.so
$ frida --toolchain=gcc
```

--------------------------------

### Get Process Pointer Size

Source: https://learnfrida.info/advanced_usage

Use Process.pointerSize() to determine the size of pointers in the target process, which affects struct member offsets.

```javascript
[Local::ConsoleApplication2.exe]-> Process.pointerSize
4

```

--------------------------------

### Python on_message Callback

Source: https://learnfrida.info/basic_usage?q=

The on_message callback is used to handle messages sent from the Frida agent. This example simply prints the received message.

```python
def on_message(message, data):
    """Print received messages."""
    print(message)

```

--------------------------------

### Frida Output Log

Source: https://learnfrida.info/intermediate_usage?q=

This is an example of the output generated when running the Frida script. It shows process spawning, attachment, instrumentation, and intercepted messages.

```text
$ python3 script.py

[+] spawn(argv=['/bin/sh', '-c', 'cat /etc/hosts'])
[*] attach(pid=1471858)
[*] enable_child_gating()
[*] create_script()
[*] load()
[*] resume(pid=1471858)
[*] message: pid=1471858, payload={'type': 'open', 'path': '/dev/tty'}
[-] detached: pid=1471858, reason='process-replaced'
[+] child_added: Child(pid=1471858, parent_pid=1471858, origin=exec, path='/usr/bin/cat', argv=['cat', '/etc/hosts'], envp={...})
[*] attach(pid=1471858)
[*] enable_child_gating()
[*] create_script()
[*] load()
[*] resume(pid=1471858)
[-] child_removed: Child(pid=1471858, parent_pid=1471858, origin=exec, path='/usr/bin/cat', argv=['cat', '/etc/hosts'], envp={...})
[*] message: pid=1471858, payload={'type': 'open', 'path': '/etc/hosts'}

```

--------------------------------

### Use Java.performNow() to avoid startup delays

Source: https://learnfrida.info/java

Java.performNow() is an alternative to Java.perform() that avoids the need to call resume(), useful for instrumentation during application startup.

```javascript
Java.performNow(function() {
    // Your instrumentation code here
});
```

--------------------------------

### Spawn remote process and inspect

Source: https://learnfrida.info/basic_usage

Spawn a binary on the remote server and pause its execution to inspect its properties. The -f flag spawns the binary, and --pause keeps it from running immediately.

```bash
frida -H 192.168.1.101 -f /bin/ls --pause

```

--------------------------------

### Compile and Run sysinfo.c

Source: https://learnfrida.info/advanced_usage?q=

Compile a simple C program that retrieves and prints the address of the SYSTEM_INFO struct. This address will be used to attach Frida.

```c
#include <iostream>
#include <Windows.h>
int main()
{
    SYSTEM_INFO sysInfo ;
    GetSystemInfo(&sysInfo);
    printf("%p", &sysInfo);
    getchar();
}

```

```bash
clang -Wall sysinfo.c -o sysinfo
./sysinfo
0x16f8db5e8

```

--------------------------------

### Get Pointer to System API

Source: https://learnfrida.info/intermediate_usage

Retrieve a pointer to a system API (e.g., 'mkdir') using Module.getExportByName. This is the first step before creating a NativeFunction for it.

```javascript
mkdir = Module.getExportByName(null, 'mkdir')
```

--------------------------------

### r2frida :dx Command Help

Source: https://learnfrida.info/r2frida

Displays the help information for the :dx command, outlining its subcommands for different types of function calls.

```r2
[0x00000000]> :dx?
 dxc  dx call
 dxo  dx objc
 dxs  dx syscall

```

--------------------------------

### Get r2frida process ID

Source: https://learnfrida.info/r2frida

Display the Process ID (PID) of the currently attached process. This is a quick way to identify the target process.

```shell
:dp  # prints the PID of the process
9502

```

--------------------------------

### Frida Execution and Output

Source: https://learnfrida.info/intermediate_usage?q=

Demonstrates how to run the Frida instrumentation script with the target application and shows the resulting console output, confirming that the `stat` argument was successfully modified.

```bash
$ frida -f a.out -l script.js --no-pause
     ____
    / _  |   Frida 14.2.12 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . . 
   . . . .   More info at https://www.frida.re/docs/home/
Spawned `a.out`. Resuming main thread!                                  
File does not exist.
Installing our own busybox binaries
stat is checking: /bin/ls
final stat path?: /bin/foobar
[Local::a.out]-> Process terminated


```

--------------------------------

### Example Output of CModule Notifications

Source: https://learnfrida.info/advanced_usage?q=

Observe the output generated when the CModule script is executed against the target program, showing the notifications received from C code.

```text
[Local::a.out ]-> notification from C code, value: 0
notification from C code, value: 10000
notification from C code, value: 20000
notification from C code, value: 30000
notification from C code, value: 40000
notification from C code, value: 50000
notification from C code, value: 60000
notification from C code, value: 70000
notification from C code, value: 80000
notification from C code, value: 90000
Time ellapsed: 0.024194

```

--------------------------------

### Spawn Process with frida-trace

Source: https://learnfrida.info/basic_usage?q=

Use the -f parameter to spawn a new process from a given file path. This is useful for instrumenting processes before any app code runs.

```bash
$ frida-trace -f binary.exe
```

--------------------------------

### Enumerate Modules in Frida

Source: https://learnfrida.info/basic_usage?q=

Use Process.enumerateModulesSync() to get a list of loaded modules in the current process. This is useful for finding the base address of your target binary.

```javascript
Process.enumerateModulesSync()
```

```javascript
Process.enumerateModulesSync()
```

--------------------------------

### Spawn r2frida with Arguments

Source: https://learnfrida.info/r2frida

Use this command to spawn a target binary with r2frida, allowing you to pass arguments to the target process. The 'frida:///' block is enclosed in double quotes to correctly pass arguments.

```shell
r2 "frida:///usr/bin/wget man7.org"
```

--------------------------------

### Get sizeof(DWORD) with printf

Source: https://learnfrida.info/advanced_usage

Use printf with sizeof to determine the size of data types like DWORD. This is useful for understanding memory layout.

```c
printf("%d", sizeof(DWORD));

```

--------------------------------

### Allocate string on heap with r2frida

Source: https://learnfrida.info/r2frida?q=

Use the ':dmas' command to allocate a string on the heap and get its address. Use ':dmal' to list current allocations.

```shell
[0x00000000]> :dmas r2fridarul3s
0x7f58d1436b60
```

```shell
[0x00000000]> :dmal
0x7f58d1436b60  "r2fridarul3s"
```

--------------------------------

### Resolving Specific Obj-C Method Address

Source: https://learnfrida.info/macos?q=

Refining the `enumerateMatchesSync` query to target a specific method signature, `-[NSFileManager fileExistsAtPath:]`, to get a precise address.

```javascript
[Local::objCLI]-> myResolver.enumerateMatchesSync("-[NSFileManager fileExistsAtPath:]")

```
Tokens:
Raw