AwesomeREA.org

Tool

frida-trace (NowSecure library)

JavaScript library for Frida agents that traces native functions from a declarative description: each function is listed with its return type and input and output arguments, including pointers, UTF-8 and UTF-16 strings and byte arrays whose length is bound to another argument or the return value, with conditions such as reading an output pointer only when the call succeeds. It resolves the functions from a module's exports or a vtable, attaches Frida's Interceptor and hands one event per call to callbacks. Helper scripts in the same repository generate trace boilerplate from C headers through libclang.

Targets
App · Binary
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Not Frida's own frida-trace command-line tool, which shares the name. The latest npm release, 4.0.1 of 2025-06-16, matches the reviewed main commit 9b92c17 and ports the library to Frida 17; 4.0.0 of January 2024 moved it to ES modules.
  • It runs inside an agent script that the user writes, compiles (for example with frida-compile) and loads into a process Frida can attach to; it has no command-line interface of its own. Types cover bool, byte, short, int, pointer, byte arrays, UTF-8, UTF-16 and C strings, and the captured values are only as accurate as the signatures the user declares.
  • The header tools live in frida-trace-tools, version 3.3.0 in the repository and not published on npm; they need Node.js and frida-libclang, and the README still runs them from an older ./bin path. The bundled example host application and agent still depend on frida 16 and frida-trace ^3.0.0. The repository has no tests or CI.
  • MIT. Instrumentation needs a target process the user is entitled to inspect; no REA connection is stated, and nothing was run in this review.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · nowsecure/frida-trace · Revision 9b92c17
  2. index.js GitHub · nowsecure/frida-trace · Revision 9b92c17
  3. package.json GitHub · nowsecure/frida-trace · Revision 9b92c17
  4. frida-trace-tools/package.json GitHub · nowsecure/frida-trace · Revision 9b92c17
  5. example/package.json GitHub · nowsecure/frida-trace · Revision 9b92c17
  6. LICENSE.md GitHub · nowsecure/frida-trace · Revision 9b92c17
  7. https://github.com/nowsecure/frida-trace/pull/40
  8. https://www.npmjs.com/package/frida-trace/v/4.0.1

More in Native binaries

All 158 entries in Native binaries