Frida Script Review
Use this skill before running public, generated, or mutation-heavy Frida scripts.
Review Pass
- Identify platform assumptions: Android, iOS, native, desktop, Gadget.
- Identify mutation points: return replacement, argument rewrite, file writes, process control, network changes.
- Check timing: spawn vs attach, module load, class loader, ObjC availability.
- Check safety: null pointers, overloads, string lifetimes,
retval copies, recursion, noisy hooks.
- Reduce broad bundles to the hooks relevant to the target behavior.
Red Flags
- Blind universal bypass without proof of which hook fired.
- Native pointer reads without null or length checks.
- String replacement into fixed buffers without proving buffer size.
- Java method hook without explicit overload where overloads exist.
- ObjC selector assumed without checking
ObjC.available and class/method presence.
retval or argument wrappers stored for later use instead of copied.- Logs that print secrets unnecessarily.
Hardening Pattern
Before mutation:
console.log("hook fired", targetName);
console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
.map(DebugSymbol.fromAddress).join("\n"));
After proof:
if (shouldPatchThisCall()) {
retval.replace(1);
}
Output
Return:
- Risk summary.
- Exact lines or hook blocks to keep, remove, or change.
- Safer reviewed script or patch.
- Verification command and expected proof.
References
1---2name: frida-script-review3description: Review, harden, and simplify Frida scripts before running CodeShare snippets, universal bypasses, broad hooks, native pointer code, Java hooks, or ObjC hooks.4---56# Frida Script Review78Use this skill before running public, generated, or mutation-heavy Frida scripts.910## Review Pass11121. Identify platform assumptions: Android, iOS, native, desktop, Gadget.132. Identify mutation points: return replacement, argument rewrite, file writes, process control, network changes.143. Check timing: spawn vs attach, module load, class loader, ObjC availability.154. Check safety: null pointers, overloads, string lifetimes, `retval` copies, recursion, noisy hooks.165. Reduce broad bundles to the hooks relevant to the target behavior.1718## Red Flags1920- Blind universal bypass without proof of which hook fired.21- Native pointer reads without null or length checks.22- String replacement into fixed buffers without proving buffer size.23- Java method hook without explicit overload where overloads exist.24- ObjC selector assumed without checking `ObjC.available` and class/method presence.25- `retval` or argument wrappers stored for later use instead of copied.26- Logs that print secrets unnecessarily.2728## Hardening Pattern2930Before mutation:3132```js33console.log("hook fired", targetName);34console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)35 .map(DebugSymbol.fromAddress).join("\n"));36```3738After proof:3940```js41if (shouldPatchThisCall()) {42 retval.replace(1);43}44```4546## Output4748Return:4950- Risk summary.51- Exact lines or hook blocks to keep, remove, or change.52- Safer reviewed script or patch.53- Verification command and expected proof.5455## References5657- Frida JavaScript API: https://frida.re/docs/javascript-api/58- Frida troubleshooting: https://frida.re/docs/troubleshooting/59- Frida CodeShare: https://codeshare.frida.re/
rudra-ravi