mcpField
F
frida-tracing-discovery

frida-tracing-discovery

github.com/rudra-raviDevelopment7111 installsUpdated 25w ago
Repository

About frida-tracing-discovery

A Frida skill for discovering unknown APIs, classes, symbols, and call paths. It guides researchers from broad boundary tracing to narrow hooks, with CLI, Android, and native examples.

Key features

  1. 01Broad-to-narrow tracing workflow
  2. 02CLI tracing examples
  3. 03Android method and class-loader discovery
  4. 04Native export enumeration
  5. 05Backtraces to identify callers

Use cases

  1. 01Finding an unknown API call path
  2. 02Locating relevant Android classes or methods
  3. 03Inspecting native library exports and callers

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/rudra-ravi/frida-skills --skill frida-tracing-discovery

After installing, type/frida-tracing-discoveryin Claude Code to confirm it loaded.

Bundled filesagents/openai.yamlreferences/discovery-patterns.md

Details

From the project README

Frida Tracing Discovery

Use this skill when the target API, class, symbol, or call path is unknown.

Start Broad, Then Narrow

  1. Prove the behavior happens without Frida.
  2. Choose the highest-signal boundary: network, crypto, file, IPC, WebView, class loading, native library loading, or UI action.
  3. Trace or enumerate around that boundary.
  4. Add stack traces to identify app-owned callers.
  5. Replace broad probes with narrow hooks.

CLI Tracing

frida-trace -U -f com.example.app -j 'java.net.URL!*' --no-pause
frida-trace -U -f com.example.app -i 'open' -i 'connect' --no-pause
frida-trace -U -n target -m 'Module!*pattern*'

Treat generated handlers as temporary discovery artifacts, then move proven logic into a reviewed script.

Android Discovery

Java.perform(() => {
  const groups = Java.enumerateMethods("*crypto*!*/isu");
  console.log(JSON.stringify(groups, null, 2));
});

Class loader check:

Java.perform(() => {
  Java.enumerateClassLoaders({
    onMatch(loader) {
      try {
        Java.classFactory.loader = loader;
        Java.use("com.example.Target");
        console.log("loader", loader);
      } catch (_) {}
    },
    onComplete() {}
  });
});

Native Discovery

const mod = Process.getModuleByName("libtarget.so");
for (const e of mod.enumerateExports()) {
  if (e.name.includes("SSL") || e.name.includes("crypto")) console.log(e.name, e.address);
}

Backtrace on a generic boundary:

Interceptor.attach(Module.getGlobalExportByName("open"), {
  onEnter(args) {
    console.log(args[0].readUtf8String());
    console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
      .map(DebugSymbol.fromAddress).join("\n"));
  }
});

References

Read references/discovery-patterns.md for target-specific trace ladders.

Comments

Markdown supported