Frida Game Hacking MCP

Instructions

Hook a function at the specified address.

Args:
    address: Address to hook (hex string)
    on_enter: JavaScript code for onEnter (has access to 'args' array)
    on_leave: JavaScript code for onLeave (has access to 'retval')
    description: Optional description

Returns:
    Hook status.

Implementation Reference

• src/frida_game_hacking_mcp/server.py:1501-1555 (handler)

  Core implementation of the hook_function MCP tool. Attaches a Frida Interceptor to the target address, injecting custom JavaScript for onEnter/onLeave callbacks. Manages hook state in the global FridaSession.

  def hook_function(address: str, on_enter: str = "", on_leave: str = "",
                    description: str = "") -> Dict[str, Any]:
      """
      Hook a function at the specified address.
      
      Args:
          address: Address to hook (hex string)
          on_enter: JavaScript code for onEnter (has access to 'args' array)
          on_leave: JavaScript code for onLeave (has access to 'retval')
          description: Optional description
      
      Returns:
          Hook status.
      """
      global _session
      
      if not _session.is_attached():
          return {"error": "Not attached. Use attach() first."}
      
      if address in _session.hooks:
          return {"error": f"Hook exists at {address}. Use unhook_function() first."}
      
      try:
          addr = int(address, 16) if address.startswith("0x") else int(address)
          
          # Use empty statement if no code provided (comment would break JS syntax)
          on_enter_code = on_enter.strip() if on_enter else ""
          on_leave_code = on_leave.strip() if on_leave else ""
          
          script_code = f"""
          Interceptor.attach(ptr("{hex(addr)}"), {{
              onEnter: function(args) {{ {on_enter_code} }},
              onLeave: function(retval) {{ {on_leave_code} }}
          }});
          send("Hook installed");
          """
          
          def on_message(message, data):
              if message['type'] == 'error':
                  logger.error(f"Hook error: {message}")
          
          script = _session.session.create_script(script_code)
          script.on('message', on_message)
          script.load()
          
          _session.hooks[address] = HookInfo(
              address=address, script=script, hook_type="intercept",
              description=description or f"Hook at {address}"
          )
          
          return {"success": True, "address": address, "message": f"Hook installed at {address}"}
      
      except Exception as e:
          return {"error": f"Failed to install hook: {str(e)}"}

• src/frida_game_hacking_mcp/server.py:1500-1500 (registration)

  MCP tool registration via FastMCP decorator @mcp.tool(), which auto-generates schema from signature/docstring and registers the handler.

  @mcp.tool()

• src/frida_game_hacking_mcp/server.py:75-82 (helper)

  Dataclass used to store information about active hooks, referenced in the hook_function handler.

  class HookInfo:
      """Information about an active hook."""
      address: str
      script: Any
      hook_type: str
      description: str = ""

• src/frida_game_hacking_mcp/server.py:83-109 (helper)

  Global session manager that stores hooks dictionary used by hook_function.

  class FridaSession:
      """Manages Frida session state."""
      
      def __init__(self):
          self.device: Optional[Any] = None
          self.session: Optional[Any] = None
          self.pid: Optional[int] = None
          self.process_name: Optional[str] = None
          self.spawned: bool = False
          self.scan_state: ScanState = ScanState()
          self.hooks: Dict[str, HookInfo] = {}
          self.breakpoints: Dict[str, Any] = {}
          self.custom_scripts: Dict[str, Any] = {}
      
      def is_attached(self) -> bool:
          return self.session is not None and not self.session.is_detached
      
      def reset(self):
          self.session = None
          self.pid = None
          self.process_name = None
          self.spawned = False
          self.scan_state = ScanState()
          self.hooks.clear()
          self.breakpoints.clear()
          self.custom_scripts.clear()