Frida-ps, included with the standard frida tools suite, is a helpful way of listing running apps on your target device. Out of the box, an iPhone will have hundreds of running processes at first boot. Thankfully, frida-ps provides several command line options to make this process easier.

Remember to utilize the-U flag to tell Frida you want to see apps on the device connected via USB / emulator. If you don't, you'll instead see processes running on your host machine.


C:\>frida-ps -U -a
  PID  Name                      Identifier
-----  ------------------------  ---------------------------------------
 1797  AnalyticsService
 1411  Android Keyboard (AOSP)
 6765  Android Setup   
 1285  Android System            android
20054  Blocked Numbers Storage
20054  Contacts Storage
19534  Download Manager
 5617  ES File Explorer
 5438  External Storage
 5399  Files           
 1285  Fused Location  
 5102  Gallery         
 1792  Google App      
15496  Google Partner Setup
 6219  Google Play Store
 1874  Google Play services
 6274  Google Services Framew…
20089  MTP Host        
19534  Media Storage   
 1510  Mobile Data     
 1510  Mobile Network Configur…
 5477  Package installer
 6551  Photo Vault               com.enchantedcloud.photovault
 1832  Quickstep       
 1285  Settings Storage
 1422  System UI       
 3360  Terminal Emulator         com.termoneplus
20054  User Dictionary  

Locating an app with frida-ps

Locate a specific app using frida-ps

If you are finding yourself needing to know an app's identifier, frida-ps can be a good way to find it. It will also get us the application's current Process ID (PID) if it's running.

On your host machine, open a Command Prompt.

Type frida-ps -U -a. These switches will limit our list greatly and make it easier to spot our target.

For more info on frida-ps, see frida-ps.

In the case of Photo Vault, the bundle identifier is com.enchantedcloud.photovault. You may optionally note down the PID (Process ID) however, the application identifier is primarily what we are after since we may re-launch the app several times throughout the lab (resulting in a different PID).

Great, now we’ve established our application identifier, and can see that it is running. We also know that since frida-ps gave us the data we needed, we indeed have connectivity between the host machine and frida-server on the device (or emulator).

Last updated