Frida Troubleshooting
Use this skill before changing hook logic when Frida itself may be failing.
First Evidence
Collect exact commands and output:
frida --version
frida-ls-devices
frida-ps -Uai
For Android:
adb devices
adb shell getprop ro.product.cpu.abi
adb shell /data/local/tmp/frida-server --version
For iOS:
frida-ps -Uai
Diagnosis Order
- Version mismatch: host
frida-tools/Python package vs frida-server/Gadget.
- Device transport: USB, remote, emulator, jailbreak/root state, permissions.
- Mode mismatch: spawn needed for early code, attach sufficient only after target load.
- Runtime availability:
Java.available, Java.perform(), ObjC.available.
- Loader/module timing: class, symbol, or module not loaded yet.
- Wrong overload/signature/address.
- App protection or anti-instrumentation causing early exit.
Practitioner Triage
- Reproduce with a minimal script that only logs platform/runtime availability. Load the real agent only after the minimal script works.
- If CodeShare or a universal bypass "works partly", extract which hook fired and which endpoint/behavior changed before adding more bypasses.
- If traffic still does not appear after pinning bypass, check proxy trust store, certificate transparency, native TLS, HTTP/3/QUIC, alternate endpoints, backend device integrity checks, and non-HTTP protocols.
- If a hook does not fire in an obfuscated app, hook data boundaries and stack traces instead of chasing renamed classes.
- If the app exits without logs, inspect native anti-instrumentation and early lifecycle hooks with spawn mode.
Hook Does Not Fire
- Prove the code path is executed without Frida.
- Log module/class loading before installing the hook.
- For Android, enumerate overloads and class loaders.
- For iOS/Swift, enumerate symbols/modules and hook Objective-C-visible surfaces first.
- For native code, verify signature and architecture, then attach to caller/callee boundaries.
Crash After Hook
- Remove mutation and keep logging only.
- Guard null pointers and invalid ObjC/Java objects.
- Copy values inside callbacks; do not store recycled
retval.
- Check string lifetime when replacing pointer arguments.
- Narrow broad hooks that fire too often or recurse.
References
Read references/error-playbook.md for common errors, likely causes, and next checks.
1---2name: frida-troubleshooting3description: Diagnose Frida attach, spawn, version, frida-server, Gadget, hook, crash, Java, ObjC, class-loader, anti-instrumentation, and device connectivity failures.4---56# Frida Troubleshooting78Use this skill before changing hook logic when Frida itself may be failing.910## First Evidence1112Collect exact commands and output:1314```bash15frida --version16frida-ls-devices17frida-ps -Uai18```1920For Android:2122```bash23adb devices24adb shell getprop ro.product.cpu.abi25adb shell /data/local/tmp/frida-server --version26```2728For iOS:2930```bash31frida-ps -Uai32```3334## Diagnosis Order35361. Version mismatch: host `frida-tools`/Python package vs `frida-server`/Gadget.372. Device transport: USB, remote, emulator, jailbreak/root state, permissions.383. Mode mismatch: spawn needed for early code, attach sufficient only after target load.394. Runtime availability: `Java.available`, `Java.perform()`, `ObjC.available`.405. Loader/module timing: class, symbol, or module not loaded yet.416. Wrong overload/signature/address.427. App protection or anti-instrumentation causing early exit.4344## Practitioner Triage4546- Reproduce with a minimal script that only logs platform/runtime availability. Load the real agent only after the minimal script works.47- If CodeShare or a universal bypass "works partly", extract which hook fired and which endpoint/behavior changed before adding more bypasses.48- If traffic still does not appear after pinning bypass, check proxy trust store, certificate transparency, native TLS, HTTP/3/QUIC, alternate endpoints, backend device integrity checks, and non-HTTP protocols.49- If a hook does not fire in an obfuscated app, hook data boundaries and stack traces instead of chasing renamed classes.50- If the app exits without logs, inspect native anti-instrumentation and early lifecycle hooks with spawn mode.5152## Hook Does Not Fire5354- Prove the code path is executed without Frida.55- Log module/class loading before installing the hook.56- For Android, enumerate overloads and class loaders.57- For iOS/Swift, enumerate symbols/modules and hook Objective-C-visible surfaces first.58- For native code, verify signature and architecture, then attach to caller/callee boundaries.5960## Crash After Hook6162- Remove mutation and keep logging only.63- Guard null pointers and invalid ObjC/Java objects.64- Copy values inside callbacks; do not store recycled `retval`.65- Check string lifetime when replacing pointer arguments.66- Narrow broad hooks that fire too often or recurse.6768## References6970Read `references/error-playbook.md` for common errors, likely causes, and next checks.
rudra-ravi