Dynamic Instrumentation, Reverse Engineering and Security Testing with frida.re
Introduction: The Art of Asking a Running Program Questions
- What this book promises
- How the book is organized
- Authorization, ethics, and the boundaries of this book
- What you need to get started
- Prerequisites and how to read
Part I: Foundations
Chapter 1: The Process You Can’t Stop: Dynamic Instrumentation Fundamentals
- Static vs Dynamic Analysis
- What Happens Inside a Running Process
- Operating-System Injection Primitives
Chapter 2: Frida’s Architecture and Ecosystem
- The Host-Agent Model
- Component Tour
- Supported Platforms and Build Targets
- Terminology and Versioning
Chapter 3: Building Your Instrumentation Lab
- Host Installation on Desktop Platforms
- Android Lab: Emulator, Root, and Targets
- iOS Lab Options
- Verifying the Stack and Laying Out Your Workspace
Part II: Core Skills
Chapter 4: The CLI and the REPL
- Reading Processes: frida-ps and Friends
- Attaching and Spawning from the Command Line
- The Interactive REPL
- Script Injection with -e and -l
Chapter 5: Your First Agent: JavaScript on the Other Side
- The Agent Runtime and Its Constraints
- Messaging: send, recv, and Post
- RPC Exports in Both Directions
- Structuring Reusable Agents (JavaScript and TypeScript)
Chapter 6: Processes, Modules, and Threads
- The Process Object and System Topology
- Modules: Where Code Lives at Runtime
- Threads and Backtraces
- Spawn Versus Attach: Timing the Instrumentation
Chapter 7: Memory: Reading, Scanning and Writing
- Pointers and the Memory Model
- Reading and Writing Primitives and Strings
- Scanning and Enumeration
- Protection, Allocation, and Lifetimes
Part III: Instrumentation Core
Chapter 8: Interceptor: Hooking Native Functions
- attach: Observing Calls
- replace and implement: Rewriting Behavior
- Hooking C++ Members and Vtables
- Mistakes, Deadlocks, and Safer Alternatives
Chapter 9: Calling Native Code — NativeFunction and NativeCallback
- NativeFunction: The Signature System
- Calling Conventions and Structs
- NativeCallback: Giving Native Code a Callback
- Pitfalls: Reentrancy, Lifetimes, and Errors
Chapter 10: Stalker — Control-Flow Tracing
- Following Execution
- Events: Instructions, Blocks, Slices
- Transforms: Instrumenting the Trace Itself
- Costs, Limits, and Practical Use
Part IV: Platform Instrumentation
Chapter 11: Android and Java
- Running Frida on Android
- The Java Bridge and the VM Lock
- Hooking Java Methods
- Finding Classes, Instances, and Native Boundaries
Chapter 12: iOS and Objective-C
- The Objective-C Runtime and Frida
- Running Frida on iOS
- Hooking and Swizzling Objective-C Methods
- Swift Interop and Limitations
Chapter 13: Desktop, Server-Side, and Remote Instrumentation
- Windows Instrumentation
- Linux and macOS Servers
- Remote Devices and Networked frida-server
- Server-Side Use Cases: Daemons, CI, and Automation
Part V: Engineering with Frida
Chapter 14: The Python Bindings — Host-Side Engineering
- Devices and Sessions in Python
- Scripts and Messages from the Host
- RPC from Python
- Building a Small Instrumentation Tool
Chapter 15: Production-Quality Frida Tooling
- Agent Architecture That Survives
- Performance Optimization
- Reliability and Failure Modes
- Detection, Safety, and Authorization
- Keeping Your Tooling Current
Conclusion: From Hook to Habit
Appendix A: Command Quick Reference
- Tool overview
frida(REPL/runner) key flags [13, 49]frida-psflags [14]frida-tracekey flags [15]
Appendix B: API Quick Reference in Context
- Process / Thread / Module
- Memory / pointers
- Interceptor / NativeFunction / NativeCallback / Stalker
- Java bridge (Android; import
frida-java-bridgesince 17) [9, 11] - Objective-C bridge (iOS/macOS; import
frida-objc-bridgesince 17) [9, 11] - Messaging / RPC (agent side) [19]
Appendix C: Systematic Troubleshooting Reference
- Stage 1: Installation and versions
- Stage 2: Connecting and attaching
- Stage 3: Hooks not firing
- Stage 4: Crashes and corruption
- Stage 5: Messaging and performance
- Stage 6: Platform-specific
Appendix D: Glossary
References
- Where Frida Fits in the Landscape