AwesomeREA.org

Tool

fpicker

Frida-based fuzzing suite for closed-source programs, listed here for its in-process instrumentation and coverage layer. A JavaScript harness injected with Frida starts Stalker at an analyst-chosen function and records the basic blocks executed in the target module on each call, feeding either AFL++'s coverage bitmap or fpicker's own standalone mode. Its passive mode works as a tracer: it attaches to a running process without sending inputs and stores each input that reaches the function together with new coverage, on the local host or on USB and network devices running frida-server.

Requirements & limits

  • There are no releases or tags. The reviewed main commit, from 2025-07-24, moves the harness to the Frida 17 APIs, and the Makefile pins frida-core 17.2.14. The README points to a 2021 blog post for background and says fpicker builds on ToothPicker, developed during the author's master's thesis, and was mostly written at ERNW.
  • make fpicker-macos, fpicker-linux or fpicker-ios builds the C host program; the Makefile downloads the matching frida-core devkit from Frida's GitHub releases, although the README still describes placing the devkit files by hand. iOS builds use Xcode's iPhoneOS SDK on macOS, harness scripts are bundled with frida-compile, and AFL++ is needed only for AFL++ mode, built with USEMMAP on macOS and iOS.
  • Each target needs a hand-written harness that names the function where instrumentation starts and, for in-process input, how to call it, so that function and its arguments must first be identified in the target. The README warns that coverage becomes unreliable if the function runs more than once per iteration. Shared-memory communication is unavailable for USB-attached devices, and attach mode does not respawn a target that crashes.
  • Coverage covers basic blocks in the target module during the instrumented call, not a whole-program trace. The examples are small project-written C programs with seed inputs and slides from a WiSec 2021 tutorial; the repository has no automated tests or CI.
  • MIT; Frida and AFL++ are separate projects with their own licenses. The reviewed sources state no REA use, and this collection built and ran nothing.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
App · Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · ttdennis/fpicker · Revision 04f4b06
  2. Makefile GitHub · ttdennis/fpicker · Revision 04f4b06
  3. harness/fuzzer.js GitHub · ttdennis/fpicker · Revision 04f4b06
  4. harness/stalker-instrumentation.js GitHub · ttdennis/fpicker · Revision 04f4b06
  5. examples/protocol_example/README.md GitHub · ttdennis/fpicker · Revision 04f4b06
  6. examples GitHub · ttdennis/fpicker · Revision 04f4b06
  7. LICENSE GitHub · ttdennis/fpicker · Revision 04f4b06
  8. https://github.com/ttdennis/fpicker/commit/04f4b06b6c7a209986594a51bd51c8d8af7a75ea

More in Native binaries

All 116 entries in Native binaries