hook_native

Instructions

Implementation Reference

• src/frida_mcp/hooks.py:153-201 (handler)

  The main handler function for hook_native tool. Creates a Frida script to hook a native function by module name + offset using Interceptor.attach.

  def hook_native(module: str, offset: str, name: str = None) -> dict:
      """Hook a native function by module name + offset."""
      fs = get_session()
  
      hook_name = name or f"native_{module}_{offset}"
  
      js_code = '''
          var mod = null;
          var pattern = ''' + json.dumps(module.lower()) + ''';
          Process.enumerateModules().forEach(function(m) {
              if (m.name.toLowerCase().indexOf(pattern) !== -1) mod = m;
          });
          if (mod) {
              var addr = mod.base.add(''' + offset + ''');
              Interceptor.attach(addr, {
                  onEnter: function(args) {
                      var msg = "[''' + hook_name + '''] called";
                      try {
                          var a = [];
                          for (var i = 0; i < 6; i++) {
                              a.push("arg" + i + "=" + args[i]);
                          }
                          msg += " " + a.join(", ");
                      } catch(e) {}
                      send(msg);
                  },
                  onLeave: function(ret) {
                      send("[''' + hook_name + '''] returned: " + ret);
                  }
              });
              send("[+] Hooked " + mod.name + " @ " + addr);
          } else {
              send("[-] Module not found: ''' + module + '''");
          }
      '''
  
      script = fs.session.create_script(js_code)
  
      def on_message(message, data):
          if message["type"] == "send":
              fs.add_message(hook_name, message["payload"])
          elif message["type"] == "error":
              fs.add_message(hook_name, message["stack"], is_error=True)
  
      script.on("message", on_message)
      script.load()
      fs.persistent_scripts.append({"name": hook_name, "script": script})
  
      return {"status": "installed", "name": hook_name, "module": module, "offset": offset, "session_id": fs.id}

• src/frida_mcp/tools.py:316-328 (schema)

  Tool definition with inputSchema for hook_native, declaring module, offset, and optional name parameters.

  Tool(
      name="hook_native",
      description="Hook a native function by module+offset. Messages collected via get_hook_messages().",
      inputSchema={
          "type": "object",
          "properties": {
              "module": {"type": "string", "description": "Module name (partial match ok)"},
              "offset": {"type": "string", "description": "Hex offset from module base (e.g., '0x1234')"},
              "name": {"type": "string", "description": "Optional hook name for identification"},
          },
          "required": ["module", "offset"],
      },
  ),

• src/frida_mcp/server.py:122-123 (registration)

  Server dispatcher that routes the 'hook_native' tool name to the hooks.hook_native function call.

  elif name == "hook_native":
      return hooks.hook_native(arguments["module"], arguments["offset"], arguments.get("name"))

• tests/test_dispatcher.py:55-55 (helper)

  Mock setup for hook_native in test dispatcher, used for testing the dispatching logic.

  hook_native=MagicMock(return_value={}),