Frida Dbi

Frida dynamic instrumentation

Local setup (verified in tool-index.md): frida 17.17.0 / frida-tools 14.10.4 installed via pip. The frida CLI scripts live in C:\Users\Admin\AppData\Local\Python\bin\ — not on PATH; call python -m frida_tools.repl (or ...repl -U for USB/Android) or add that bin dir to PATH.

Session basics

python -m frida_tools.repl -f C:/target/game.exe -l hook.js --runtime=v8   # spawn
python -m frida_tools.repl -n game.exe -l hook.js                          # attach
python -m frida_tools.repl -U -f com.vendor.app -l hook.js                 # android

Spawn > attach for early code (loaders, anti-debug init). -f suspends at entry; call resume() from the script or --pause flows when you must hook before the first instruction.

Interceptor (the 90% tool)

const f = Module.getExportByName(null, "ws2_32!send");   // null = search all modules
Interceptor.attach(f, {
  onEnter(args) { this.buf = args[1]; this.len = args[2].toInt32(); },
  onLeave(rv) {
    if (this.len > 0) send({tag:"send", data: hexdump(this.buf, {length: Math.min(this.len, 256)}).toString()});
  }
});

• Module.getExportByName(null, name) resolves across loaded modules; for unexported targets compute the address first (pattern-scanner in-process: Memory.scan on module ranges) and Interceptor.attach(ptr, {...}).
• Calling natives: new NativeFunction(addr, retType, argTypes); keep ABI defaults (Windows x64 = MSVC ABI).
• Replace vs attach: Interceptor.replace swaps implementation (use for neutering, e.g. anti-debug); attach preserves behavior — prefer attach when the target must keep working.
• Always wrap per-hook logic in try/catch and keep hooks idempotent: a hook that throws poisons every subsequent call through that site.

Memory & module APIs

• Memory.scan(base, size, "48 8B ?? 05") — live pattern validation before committing a signature to the DB (offset-dumper pipeline step).
• Process.enumerateModules(), Module.load(), Process.findRangeByAddress for VAD-ish views usermode-side.
• Memory.readPointer/readByteArray/writeU… + Memory.protect for patching; scope writes behind flags — a stray patch survives you.

Stalker (tracing, expensive)

Stalker.follow(threadId, {
  events: { call: true, ret: false, exec: false },
  onReceive(events) { /* parse binary array; batch-send, never per-event send() */ }
});

• Follow one thread at a time; exec: true floods (millions/s).
• Use for: recovering dispatch tables (follow the packet-handler thread and record call targets), locating checks (follow until a "bad" result, bisect the trace), coverage-guided triage.
• Stalker.unfollow + Stalker.flush() on teardown; leak a follow and the process dies with it.
• Cheaper alternative first: frida-trace with -i/-a module!function filters, or Interceptor-only call maps.

Anti-anti-debug / analysis-resistance patterns

Apply bypasses narrowly (one check at a time, verified) — wholesale "anti-anti" scripts break games/apps and destroy evidence of which check fired. For deep debugger-based work switch to x64dbg-anti-debugger.

Games (mono / il2cpp)

• Unity mono: enumerate mono.dll exports (mono_get_root_domain, mono_thread_attach first!), walk assemblies via mono_assembly_foreach NativeFunctions; or use community frida-il2cpp-bridge for il2cpp games (npm-installable; pairs with offset-dumper's il2cpp pipeline for static ground truth).
• Dump vtables/methods at runtime when static metadata is encrypted — often the only stable source on protected builds.

Gadget & server modes

• frida-server (remote/Android): run on device, connect -U/-H. OPSEC: default name/port is a first-order IOC — rename binary, non-default port, bind localhost + adb forward (adb forward tcp:PORT tcp:PORT).
• gadget (embedded in the app you own/build): config modes listen/connect/script/directory; use script for fully offline instrumentation with zero server artifacts.

Reliability discipline (long sessions)

1. One concern per script version; reload (-l again / %reload) after edits rather than stacking variants.
2. Batch send() — coalesce per 50 ms or per N events; per-event RPC kills throughput and can desync the REPL.
3. Save state: dump captured structures to files via rpc.exports + host-side writer; don't keep everything in JS heap.
4. Teardown: unfollow Stalkers, detach Interceptors (Interceptor.detachAll or per-listener handles) when the mission ends — leave a target running with hooks and your next attach inherits the mess.
5. Record: target build + module hashes in every capture log header (windows-internals provenance rules apply).

Pair with

offset-dumper (live validation + encrypted-pointer recovery), network-protocol-re (plaintext hooks at send/EncryptMessage), js-reverse/mobile-reverse (ecosystem-specific flows), x64dbg-anti-debugger (debugger-side counterpart), malware-analysis (sample triage), edr-bypass-re (defender-side hooks being studied).