AwesomeREA.org

Tool

Interruptor

Frida library, taken from the Dexcalibur project, that uses Frida’s Stalker to trace a process’s system calls and print strace-like lines with the calling thread, module and offset, decoded flag values and file paths resolved from descriptors. A trace can be limited to chosen modules and syscalls by name or pattern, started when a given library loads, extended with Interceptor-style per-syscall callbacks, and used to write drcov basic-block coverage files. The README documents Linux and Android on AArch64 and x64; the source also contains AArch32 Linux and macOS arm64 and x64 entry points.

Requirements & limits

  • Latest npm release at review: @reversense/interruptor 1.0.12, published 2023-04-02; the newest GitHub release is v1.0.9 (2023-03-29). The reviewed main commit of 2026-09-23 adds unreleased changes, including refactored arm64 register handling and a preadv2/pwritev2 argument fix, without a version bump, and the README still calls the project a work in progress.
  • It is used inside the analyst’s own Frida agent: install the npm package, build from source with npm and TypeScript, or load a webpack-bundled per-architecture script. The README says passing a TypeScript agent directly to frida needs Frida 16 or later, and package.json depends on @types/frida-gum ^17.3.0. Android examples attach to a USB device with frida -U; the README warns that the CodeShare quick-start cannot be configured and may fail on obfuscated or multi-threaded apps.
  • The README’s support list names the Linux syscall API on AArch64 (SVC, with HVC marked work in progress) and x64 (SYSCALL); the AArch32 Linux and macOS factories in the source have no documented status. The agent tracer cannot follow child or multiple processes, and a standalone host-side tracer is marked TODO. Coverage needs an output path the target process can write. CI runs Mocha tests of the Linux AArch32 and arm64 factories on Node 16; no device test results are published. Intended for software the analyst is authorized to inspect.
  • package.json and the npm metadata declare GPL-3.0-only, but the LICENSE file is x64dbg’s modified GPL-3.0 text, whose added exception concerns x64dbg plugins rather than this project, so GitHub cannot classify it. The README also promotes the separate commercial Dexcalibur Pro. The reviewed sources establish no REA connection; nothing was installed or run in this review.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
App · Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · FrenchYeti/interruptor · Revision 6faa9f6
  2. package.json GitHub · FrenchYeti/interruptor · Revision 6faa9f6
  3. LICENSE GitHub · FrenchYeti/interruptor · Revision 6faa9f6
  4. .github/workflows/ci.yml GitHub · FrenchYeti/interruptor · Revision 6faa9f6
  5. src/arch GitHub · FrenchYeti/interruptor · Revision 6faa9f6
  6. src/utilities/Coverage.ts GitHub · FrenchYeti/interruptor · Revision 6faa9f6
  7. https://github.com/FrenchYeti/interruptor/releases/tag/v1.0.9
  8. https://www.npmjs.com/package/@reversense/interruptor/v/1.0.12

More in Native binaries

All 118 entries in Native binaries