Tool
frida-scripts (0xdea)
Marco Ivaldi's (raptor) collection of Frida JavaScript instrumentation scripts for reverse engineering mobile apps and Linux programs. The main Android and iOS tracers hook Java or Objective-C classes and methods selected by name, wildcard or regular expression, plus native functions matched by Frida ApiResolver patterns such as exports:*!open*, and log each call's arguments and return value; they can also print backtraces. Companion scripts enumerate loaded classes and methods, and a Linux pair traces and enumerates functions in an ELF binary and its shared libraries.
- Targets
- App · Binary
- Category
- Debugging and dynamic analysis
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Prerequisites: Load a script with Frida's CLI from frida-tools, for example frida -U -f <package> -l raptor_frida_android_trace.js for an app on a USB-connected device, after uncommenting or editing the usage examples at the end of the script. Mobile use needs a device that Frida can instrument; the iOS tracer's header records a jailbroken iPhone 8 on iOS 16.5.
- Limits: Version 0.2 (2025-10-02) ported the main tracers to Frida 17. Script headers record Frida 17.3.2 on Android 11 and iOS 16.5 and Frida 17.2.1 on Ubuntu, while the android-snippets and ios-snippets directories were tested only with Frida before 17.0.0. The README warns that the iOS and Android scripts may need tweaking and points to Brida as a maintained project that includes some of them.
- Testing evidence: The repository has no automated tests or CI, and its TODO lists extensive testing with real-world apps.
- License: MIT per LICENSE.
About this entry
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- README.md GitHub · 0xdea/frida-scripts · Revision 987ba48
- raptor_frida_android_trace.js GitHub · 0xdea/frida-scripts · Revision 987ba48
- raptor_frida_ios_trace.js GitHub · 0xdea/frida-scripts · Revision 987ba48
- raptor_frida_linux_trace.js GitHub · 0xdea/frida-scripts · Revision 987ba48
- raptor_frida_android_enum.js GitHub · 0xdea/frida-scripts · Revision 987ba48
- CHANGELOG.md GitHub · 0xdea/frida-scripts · Revision 987ba48
- LICENSE GitHub · 0xdea/frida-scripts · Revision 987ba48
- https://github.com/0xdea/frida-scripts/releases/tag/v0.2
More in Native binaries
- DownUnderCTF: masked-squares flag checker · Case study
- Show Your Work: a measured dissection of REA's evidence architecture · Case study
- Windows loader: static malware analysis with REA and Codex · Case study
- OpenBSD netcat: static REA and Ghidra investigation · Case study
- Ghidra · Tool
- radare2 · Tool