Trace APIs declaratively through Frida.
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
bin Switch to our libclang fork Feb 24, 2017
example Add an example showing how to use frida-trace May 24, 2016
.gitignore Add an example showing how to use frida-trace May 24, 2016
LICENSE.md Prepare for open source May 2, 2016
README.md Switch to our libclang fork Feb 24, 2017
index.js Expose args and retval to onEnter and onLeave Feb 26, 2017
package.json 2.0.0 Nov 4, 2018

README.md

frida-trace

Trace APIs declaratively through Frida.

Example

const trace = require('frida-trace');

const func = trace.func;
const argIn = trace.argIn;
const argOut = trace.argOut;
const retval = trace.retval;

const types = trace.types;
const pointer = types.pointer;
const INT = types.INT;
const POINTER = types.POINTER;
const UTF8 = types.UTF8;

trace({
  module: 'libsqlite3.dylib',
  functions: [
    func('sqlite3_open', retval(INT), [
      argIn('filename', UTF8),
      argOut('ppDb', pointer(POINTER), when('result', isZero)),
    ]),
    func('sqlite3_prepare_v2', retval(INT), [
      argIn('db', POINTER),
      argIn('zSql', [UTF8, bind('length', 'nByte')]),
      argIn('nByte', INT),
      argOut('ppStmt', pointer(POINTER), when('result', isZero)),
    ])
  ],
  callbacks: {
    onEvent(event) {
      console.log('onEvent! ' + JSON.stringify(event, null, 2));
    },
    onEnter(event, context) {
      event.trace = Thread.backtrace(context)
        .map(DebugSymbol.fromAddress)
        .filter(x => x.name);
    },
    onError(e) {
      console.error(e);
    }
  }
});

function isZero(value) {
  return value === 0;
}

Auto-generating boilerplate from header files

$ ./bin/parse-header.js /usr/include/sqlite3.h | ./bin/generate-boilerplate.js
trace({
  module: 'libfoo.dylib',
  functions: [
    func('sqlite3_libversion', retval(UTF8), []),
    func('sqlite3_sourceid', retval(UTF8), []),
    func('sqlite3_libversion_number', retval(INT), []),
    func('sqlite3_compileoption_used', retval(INT), [
      argIn('zOptName', UTF8)
    ]),
    func('sqlite3_compileoption_get', retval(UTF8), [
      argIn('N', INT)
    ]),
    func('sqlite3_threadsafe', retval(INT), []),
    func('sqlite3_close', retval(INT), [
      argIn('a1', POINTER)
    ]),
    func('sqlite3_close_v2', retval(INT), [
      argIn('a1', POINTER)
    ]),
    func('sqlite3_exec', retval(INT), [
      argIn('a1', POINTER),
      argIn('sql', UTF8),
      argIn('callback', POINTER),
      argIn('a4', POINTER),
      argOut('errmsg', pointer(POINTER), when('result', isZero))
    ]),
...