List all available Frida devices (local, USB, remote).

Get info for a specific device. Uses default device if ID is omitted.

Connect to a remote Frida server (frida-server over TCP).

Disconnect from a remote Frida server.

Returns a dictionary of information about the host system.

Args: device_id: Target device. Uses default if omitted.

Enable spawn gating on the device.

When enabled, newly spawned processes are suspended until explicitly resumed.

Args: device_id: Target device. Uses default if omitted.

Disable spawn gating on the device.

Args: device_id: Target device. Uses default if omitted.

List pending spawned processes that are waiting to be resumed.

Args: device_id: Target device. Uses default if omitted.

List pending child processes that are waiting to be resumed.

Args: device_id: Target device. Uses default if omitted.

Inject a native library file (.so/.dylib) into a process.

Args: pid: Target process PID. path: Absolute path to the library on the device. entrypoint: Name of the entry function in the library. data: String argument passed to the entrypoint. device_id: Target device. Uses default if omitted.

Inject a native library from memory (base64-encoded binary) into a process.

Args: pid: Target process PID. blob_base64: Base64-encoded library binary. entrypoint: Name of the entry function in the library. data: String argument passed to the entrypoint. device_id: Target device. Uses default if omitted.

List running processes on a device (frida-ps equivalent).

Returns PID and name for each process.

Args: device_id: Target device. Uses default if omitted. scope: Enumeration scope — "minimal", "metadata", or "full". When "full", includes parameters (path, user, ppid, started). pids: Optional list of PIDs to filter by.

Spawn a new process and optionally attach to it.

Args: program: Path or bundle identifier to spawn. device_id: Target device. Uses default if omitted. auto_resume: Whether to resume the process after attaching. argv: Command-line arguments for the spawned process. env: Environment variables as key-value pairs. cwd: Working directory for the spawned process. stdio: Standard I/O mode — "inherit", "pipe", or "redirect".

Note: If spawn times out on Android, call frida_fix_usap to disable the USAP pool and detect root-hiding modules that may interfere with Frida's spawn interception.

Attach to a running process by PID or name.

Args: pid: Process PID (int). name: Process name (str). identifier: Application bundle identifier (str). frontmost: Attach to the frontmost application. device_id: Target device. Uses default if omitted. realm: Session realm — "native" or "emulated".

Detach from a process session.

Kill a process by PID.

Resume a suspended process.

List all active session PIDs.

List installed applications on a device (frida-ls equivalent).

Returns identifier, name, and PID (if running).

Args: device_id: Target device. Uses default if omitted. scope: Enumeration scope — "minimal", "metadata", or "full". When "full", includes parameters (version, build, etc.). identifiers: Optional list of bundle identifiers to filter by.

List only currently running applications.

Args: device_id: Target device. Uses default if omitted. scope: Enumeration scope — "minimal", "metadata", or "full". identifiers: Optional list of bundle identifiers to filter by.

Get details about the frontmost application.

Args: device_id: Target device. Uses default if omitted. scope: Enumeration scope — "minimal", "metadata", or "full".

Inject a JavaScript snippet into a process.

The process must already have an active session (use frida_attach first).

IMPORTANT: The default runtime is QJS (QuickJS), which is lightweight but does NOT include the Java/ObjC bridges. If your script uses Java.perform(), Java.use(), ObjC.classes, or any Java/Objective-C APIs, you MUST set runtime="v8". Always use runtime="v8" for Android Java hooking.

Args: pid: Target process PID. source: JavaScript source code to inject. runtime: Script runtime — "qjs" (default, no Java/ObjC bridge) or "v8" (full runtime with Java/ObjC bridge support).

Returns: script_id for subsequent RPC calls or unloading.

Call an RPC export on an injected script.

The script must expose methods via rpc.exports.

Args: script_id: ID returned by frida_inject. method: Export method name (snake_case in Python, camelCase in JS). args: Positional arguments to pass.

Unload a previously injected script.

Retrieve and drain pending messages from an injected script.

Messages are produced by send() calls in the injected JS.

List all active script IDs.

Enumerate loaded modules in a process.

Injects a helper script to call Process.enumerateModules(). Requires an active session for the given PID.

Args: pid: Target process PID (must have active session). name_filter: Optional substring filter on module name (case-insensitive). Use this to avoid returning hundreds of modules at once.

Enumerate exports of a specific module.

Args: pid: Target process PID (must have active session). module_name: Name of the module to inspect.

List RPC exports available on an injected script.

Args: script_id: ID returned by frida_inject.

Post a message to an injected script.

Args: script_id: ID returned by frida_inject. message: JSON-serializable message to send. data: Optional base64-encoded binary data.

Enable child gating on a session.

When enabled, child processes created by the target are suspended until explicitly resumed.

Args: pid: Target process PID (must have active session).

Disable child gating on a session.

Args: pid: Target process PID (must have active session).

Compile a script to bytecode without loading it.

Args: pid: Target process PID (must have active session). source: JavaScript source code to compile. runtime: Script runtime — "qjs" (default, no Java/ObjC) or "v8" (full runtime with Java/ObjC bridge).

Returns: Base64-encoded bytecode.

Create a snapshot of a script for fast future loading.

Args: pid: Target process PID (must have active session). embed_script: JavaScript source to embed in the snapshot. warmup_script: Optional script to run during snapshot creation. runtime: Script runtime — "qjs" (default, no Java/ObjC) or "v8" (full runtime with Java/ObjC bridge).

Returns: Base64-encoded snapshot data.

Eternalize a script so it persists after detaching from the session.

Args: script_id: ID returned by frida_inject.

Read bytes from process memory.

Args: pid: Target process PID (must have active session). address: Hex address string (e.g. "0x7fff12340000"). size: Number of bytes to read.

Write bytes to process memory.

Args: pid: Target process PID (must have active session). address: Hex address string (e.g. "0x7fff12340000"). hex_data: Hex-encoded bytes to write (e.g. "deadbeef").

Scan process memory for a byte pattern.

Args: pid: Target process PID (must have active session). address: Start address (hex string). size: Number of bytes to scan. pattern: Frida-style pattern (e.g. "48 8b ?? 00").

Change memory protection flags.