Help us improve
Share bugs, ideas, or general feedback.
From frida-instrument
Instruments running binaries with Frida for runtime function call tracing, API hooking, memory inspection, module enumeration, and instruction-level tracing on live processes.
npx claudepluginhub sandbornm/my-claude-skills --plugin frida-instrumentHow this skill is triggered — by the user, by Claude, or both
Slash command
/frida-instrument:frida-instrumentThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Perform dynamic binary analysis using Frida's instrumentation toolkit. Attach
scripts/agents/dump_memory.jsscripts/agents/enumerate_all.jsscripts/agents/enumerate_exports.jsscripts/agents/enumerate_imports.jsscripts/agents/enumerate_modules.jsscripts/agents/hook_functions.jsscripts/agents/scan_memory.jsscripts/agents/stalker_trace.jsscripts/agents/trace_calls.jsscripts/frida-analyze.shPerforms runtime dynamic analysis of Android apps using Frida, Objection, and ADB to observe behavior, hook methods, modify values, and find vulnerabilities missed by static analysis. For security testing obfuscated or protected apps.
Performs runtime dynamic analysis of Android apps using Frida, Objection, and ADB. Hooks functions, intercepts API calls, and identifies runtime security vulnerabilities.
Performs runtime dynamic analysis of Android apps using Frida, Objection, and ADB to observe behavior, hook methods, modify values, and detect security vulnerabilities missed by static analysis. Useful for testing obfuscated apps and bypassing protections.
Share bugs, ideas, or general feedback.
Perform dynamic binary analysis using Frida's instrumentation toolkit. Attach to or spawn processes, hook functions, trace calls, inspect memory, and perform instruction-level tracing at runtime.
| Task | Command |
|---|---|
| Full enumeration (spawn) | {baseDir}/scripts/frida-analyze.sh --spawn ./binary -s enumerate_all.js -o ./output |
| Full enumeration (attach) | {baseDir}/scripts/frida-analyze.sh --attach <pid> -s enumerate_all.js -o ./output |
| List modules | {baseDir}/scripts/frida-analyze.sh --attach <pid> -s enumerate_modules.js -o ./output |
| List exports | {baseDir}/scripts/frida-analyze.sh --attach <pid> -s enumerate_exports.js -o ./output |
| List imports | {baseDir}/scripts/frida-analyze.sh --attach <pid> -s enumerate_imports.js -o ./output |
| Trace function calls | {baseDir}/scripts/frida-analyze.sh --spawn ./binary -s trace_calls.js -a '{"functions":["open","read","write"]}' -o ./output |
| Hook functions | {baseDir}/scripts/frida-analyze.sh --attach <pid> -s hook_functions.js -a '{"functions":["malloc","free"]}' -o ./output |
| Dump memory | {baseDir}/scripts/frida-analyze.sh --attach <pid> -s dump_memory.js -a '{"module":"libc.so"}' -o ./output |
| Scan memory | {baseDir}/scripts/frida-analyze.sh --attach <pid> -s scan_memory.js -a '{"pattern":"50 41 53 53"}' -o ./output |
| Stalker trace | {baseDir}/scripts/frida-analyze.sh --spawn ./binary -s stalker_trace.js -a '{"function":"main"}' -o ./output |
pip install frida-tools{baseDir}/scripts/frida-analyze.sh [options]
Options:
--spawn <binary> — Launch binary and instrument it--attach <pid_or_name> — Attach to a running process-o, --output <dir> — Output directory (default: current dir)-s, --script <name> — Agent script to run (can be repeated)-a, --script-args <json> — JSON arguments for the last specified script-D, --device <id> — Device ID (for USB/remote devices)-U, --usb — Use USB-connected device--no-pause — Don't pause spawned process (auto-resume)--timeout <seconds> — Script timeout-v, --verbose — Verbose outputComprehensive runtime enumeration: process info, modules, main module exports/imports, and memory layout.
Output: {name}_enumeration.json
List all loaded modules with base addresses, sizes, and file paths.
Output: {name}_modules.json
List function and variable exports. Pass {"module":"libname"} to target a
specific module, or enumerates main module by default.
Output: {name}_exports.json
List imports. Pass {"module":"libname"} to target a specific module.
Output: {name}_imports.json
Trace function calls with arguments and return values using Interceptor.
Pass {"functions":["open","read","write"]} to specify which functions to
trace.
Output: Real-time trace to console + {name}_trace.json
Hook functions to log or modify behavior. Pass function names and optional actions (log, replace return value, skip).
Output: {name}_hooks.json
Dump memory regions. Pass {"module":"libname"} to dump a module, or
{"address":"0x...","size":4096} for a specific region.
Output: {name}_memdump.txt (hex) and {name}_memdump.bin (raw)
Scan process memory for byte patterns or strings. Pass
{"pattern":"48 89 5c 24 ??"} for hex patterns with wildcards, or
{"string":"password"} for string search.
Output: {name}_scan_results.json
Instruction-level code tracing using Frida's Stalker engine. Pass
{"function":"main"} or {"address":"0x..."} to trace from a specific
entry point. Records basic blocks, calls, and returns.
Output: {name}_stalker.json
{baseDir}/scripts/frida-analyze.sh \
--spawn ./target_program \
-s trace_calls.js \
-a '{"functions":["open","read","write","connect","send","recv"]}' \
-o ./traces
{baseDir}/scripts/frida-analyze.sh \
--attach myapp \
-s enumerate_all.js \
-o ./output
cat ./output/myapp_enumeration.json | jq '.modules[:5]'
{baseDir}/scripts/frida-analyze.sh \
--attach myapp \
-s scan_memory.js \
-a '{"string":"password"}' \
-o ./scan
cat ./scan/myapp_scan_results.json
{baseDir}/scripts/frida-analyze.sh \
--spawn ./target \
-s hook_functions.js \
-a '{"functions":["malloc","free"]}' \
-o ./heap
{baseDir}/scripts/frida-analyze.sh \
--spawn ./target \
-s stalker_trace.js \
-a '{"function":"main"}' \
--timeout 30 \
-o ./trace
csrutil disable in recovery mode or target user processes.sudo or ptrace_scope=0 (echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope)-U flag.-U flag.pip install frida-tools
# Linux
sudo {baseDir}/scripts/frida-analyze.sh --attach <pid> ...
# Or adjust ptrace scope
echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope
Some anti-debug protections prevent attachment. Try spawning instead:
{baseDir}/scripts/frida-analyze.sh --spawn ./binary -s enumerate_all.js
{baseDir}/scripts/frida-analyze.sh --timeout 60 --spawn ./binary -s trace_calls.js -a '{"functions":["main"]}'
--spawn to catch early initialization; --attach for long-running processes-a