frida

Launching the REPL is accomplished from the commandline. Once frida has been installed, you can verify whether or not it is functioning by typing frida with no arguments.

Spawning vs. attaching

Frida has the ability to either spawn a new process (using the specified app identifier) or attach to one that's already running. Which one you choose will be dependent on the app you are reversing and what particular task you are pursuing.

Spawning

To spawn a new process, we use the CLI argument -f <app id>, for example: frida -f com.app.name

When spawning a new process, frida immediately will pause execution of the app. The intent here is to give you a chance to apply method hooks before anything happens in the application. You can type %resume to continue execution, but be warned that apps will generally force close if execution halts for more than a few seconds.

You can turn off the pausing behaviour using the --no-pause CLI flag.

Attaching

To attach to an existing app, you can either:

• Attach to an app using its pid. To find this, use frida-ps.
• Attach to an app using its application identifier. To find this, use frida-ps.
• Attach to the frontmost (focused) application, with CLI flag -F

Loading a script locally

If you have a .js file which you would like to inject, such as the raptor tracing or enum scripts, the way to do this regardless of which platform you are on is by appending the CLI argument -l <script name>

Recommended Scripts

For almost every app, I recommend creating a "base script" that works for you. For me, I generally start with the Raptor tracing scripts. (See: https://github.com/0xdea/frida-scripts )