Verify frida + frida-tools install state and version.

Enumerate running processes via Frida's local device.

Equivalent to frida-ps, with an optional case-insensitive name substring filter.

Run a Frida JS script against a process.

mode: 'attach' (default — process already running) or 'spawn' (start a new process; pass full command in target). Collects send(...) messages from the script and returns them.

Evaluate inline JavaScript against a target, equivalent to CLI -e.

List all loaded modules in a target process.

Returns name, base address, size, and file path for each module. target: process name or pid (string).

List exported symbols from a specific module in a target process.

module_name: e.g. 'libsystem_kernel.dylib'. Returns name, type ('function' or 'variable'), and address.

List all available Frida devices (USB, remote, local).

Useful for discovering connected devices before specifying a device_id in other tools. Returns id, name, and type for each.

Get info about a specific Frida device or the default local device.

device_id: optional device id from frida_list_devices. Defaults to the local macOS device. Returns device metadata and running process count.

Connect/attach to a process and create a persistent Frida session.

target: process name or pid (string). Full binary path when spawn=True. device_id: optional device id; defaults to local device. spawn: if True, spawn the process under Frida instead of attaching to an existing one.

Returns a session_id for use with session-based tools (hooks, hook messages, etc.). The session stays alive until explicitly disconnected.

Wait for a spawn matching pattern, optionally attach and resume.

Disconnect from the current or a specified Frida session.

session_id: optional; defaults to the active session. Detaches from the process and unloads all persistent hooks.

List all active Frida sessions.

Shows session id, target, pid, device, whether each is the active session, and whether the underlying Frida connection is still alive.

Switch the active Frida session.

session_id: id of the session to activate (from frida_list_sessions). Subsequent session-based tool calls (hooks, messages) will operate on this session.

Check if the current Frida session is alive.

Returns connection status, session id, target, pid, and device name. Useful as a health-check before running session-based tools.

Read lifecycle events for a persistent Frida session.

Clear lifecycle events for a persistent Frida session.

Load a long-running Frida script into a persistent session.

The script remains loaded until explicitly unloaded or the session disconnects. Use send() in JavaScript to emit events, recv() to receive messages, and rpc.exports to expose callable functions.

Load a local JavaScript file as a long-running Frida script.

List long-running scripts loaded in a persistent session.

Unload a long-running script by script_id.

Reload a long-running script, preserving its name and kind.

Call a function exposed through rpc.exports by a loaded script.

Post a JSON-serialisable message to a long-running script.

Read queued events emitted by long-running scripts.

Clear queued events for one script or a whole session.

Export queued script events to JSON or JSONL.

Get base address of a module by name (partial match supported).

target: process name or pid (string). module_name: full or partial module name (case-insensitive). Returns the first matching module's name, base address, size, and path.

Get the frontmost (foreground) application on a device.

device_id: optional Frida device id (from frida_list_devices); defaults to local device. Returns {identifier, name, pid}. Useful on iOS/Android to identify the currently visible app.

Spawn and resume an application by bundle/package identifier.

identifier: app bundle id (iOS/macOS) or package name (Android), e.g. 'com.apple.Safari' or 'com.example.app'. device_id: optional Frida device id; defaults to local device.

Uses Frida's device.spawn() + device.resume() to launch the app fresh. Returns {pid, identifier, status}.

Kill a process by PID or name on a device.

target: integer PID (as string) or process name. If a name is given, the process list is searched (exact match first, then substring). device_id: optional; defaults to local device.

Compile a Frida JS script to bytecode for faster injection.

Shells out to frida-compile. Produces an optimised bundle that loads faster than raw JS.

script_path: path to the source .js file. output_path: optional output path (default: <script>.compiled.js).

Inject a script and eternalize it so it survives session detach.

After script.eternalize(), the hooks live on inside the target process even after the Frida session disconnects. Only killing the target process removes the instrumentation.

target: process name or pid (string). js_code: Frida JS code to inject and eternalize.

Inject a shared library (.dylib / .so) into a target process.

Uses Frida's inject_library_file() to load the library. The library's entrypoint function (if specified) is called with data as its argument.

target: process name or pid (string). library_path: path to the .dylib or .so to inject. entrypoint: optional symbol to call after load. data: optional string argument for the entrypoint.

List all threads in a target process with state and registers.

target: process name or pid (string). Returns thread id, state (running/stopped/waiting), and key register values (pc, sp) for each thread.

List all symbols (not just exports) from a module.

Unlike frida_enumerate_exports, this includes local and debug symbols when available.

target: process name or pid (string). module_name: module to query (default: main executable). filter: optional case-insensitive name substring filter. limit: max symbols to return (default 1000).

Recover a broken/crashed Frida session by re-attaching.

Looks up the original target PID/name from the session registry and attempts to create a new Frida session to the same process.

session_id: optional; defaults to the current active session.

List all installed applications on a device (not just running).

Unlike frida_list_processes which only returns running processes, this enumerates all installed apps. Returns identifier, name, and pid (0 if not running) for each.

device_id: optional Frida device id; defaults to local device.

Get detailed Process metadata: pid, arch, platform, page/pointer sizes, code signing policy, mainModule, dirs, debugger state, current thread id.

target: process name or pid (string).

Collect an agent-friendly target snapshot before deeper analysis.

Returns process metadata, runtime/bridge availability, main module, module/thread samples, memory-range counts, and recommended next tools.

target: process name or pid (attach), or command line when spawn=True. device_id: optional Frida device id for USB/remote targets. spawn: start the target suspended, attach, collect the snapshot, then resume.

Enumerate imports of a module in a target process.

target: process name or pid (string). module_name: module to query (e.g. 'Safari', 'libsystem_kernel.dylib'). filter: optional case-insensitive name substring filter. limit: max imports to return (default 1000).

Enumerate sections (name, base, size, protection) of a module.

target: process name or pid (string). module_name: module to query (e.g. 'CoreAudio', 'libsystem_c.dylib').

Enumerate dependencies of a module in a target process.

target: process name or pid (string). module_name: module to query.

Enumerate malloc heap ranges filtered by memory protection.

target: process name or pid (string). filter: protection string filter (default 'rw-'). Frida returns ranges whose protection is a superset of the specified value.

Find a single export by name, optionally scoped to a module.

target: process name or pid (string). module_name: module to search in, or None for all modules. export_name: export name to find. Returns the address of the export.

Find a symbol by name within a module (including non-exported symbols).

target: process name or pid (string). module_name: module to search. symbol_name: symbol name to find. Returns address and type.

Resolve a debug symbol from an address via DebugSymbol.fromAddress.

target: process name or pid (string). address: hex address (e.g. '0x100004000'). Returns name, moduleName, fileName, lineNumber.

Find all functions with an exact name via DebugSymbol.findFunctionsNamed.

target: process name or pid (string). name: exact function name to search for. Returns list of matching addresses.

Find functions matching a glob pattern via DebugSymbol.findFunctionsMatching.

target: process name or pid (string). glob: glob pattern (e.g. 'xpcsend*', 'objc_msg*'). Returns matching addresses with symbolicated names.

Load debug symbols from a file (e.g. dSYM) into the target.

target: process name or pid (string). path: path to the debug symbol file to load.

Resume a suspended process by PID.

Standalone resume for processes spawned but not yet resumed.

target_pid: integer process ID. device_id: optional Frida device id; defaults to local device.

Execute arbitrary JS in an existing persistent Frida session (REPL).

Reuses a persistent session so hooks and state remain. Unlike inject_script, this creates a one-shot script, collects messages, and unloads without disturbing the session.

session_id: session id from frida_connect / frida_list_sessions. js_code: JavaScript to evaluate. Use send() to return data.

Parse a Frida CLI --options-file into shell-style tokens.

This is a planning/inspection helper for agents. It does not execute the options file.

Run an official frida-tools CodeShare script via frida -c.

Get the first USB Frida device via frida.get_usb_device().

Get Frida's default remote device via frida.get_remote_device().

Find a device with DeviceManager.get_device_matching().

Add a remote device with official auth/keepalive options.

Remove a remote device from Frida's DeviceManager.

Call Device.query_system_parameters().

Call Device.override_option(name, value).

Call Device.unpair().

Send raw base64-decoded input bytes to a spawned target.

Call Device.get_process().

Call Device.is_lost().

Inject a library from base64 bytes with Device.inject_library_blob().

Spawn without attaching, exposing Device.spawn() options.

List Device.enumerate_pending_spawn().

List Device.enumerate_pending_children().

Subscribe to official DeviceManager/Device/Session events.

Read queued official event subscription events.

Unsubscribe from an official event subscription.

Attach to a device bus and start queueing bus messages.

Post a message on an attached Frida bus.

Read queued bus events.

Forget a bus event queue.

Call Session.enable_child_gating().

Call Session.disable_child_gating().

Call Session.resume().

Call Session.is_detached().

Call Session.setup_peer_connection().

Call Session.join_portal().

Terminate a portal membership created by frida_session_join_portal.

Load compiled script bytes with Session.create_script_from_bytes().

Compile script source with Session.compile_script().

Create a script snapshot with Session.snapshot_script().

List rpc.exports exposed by a loaded script.

Enable the Frida script debugger for a loaded script.

Disable the Frida script debugger for a loaded script.

Post a message plus binary data to a loaded script.

Queue Script log-handler events for a loaded script.

Read queued Script log-handler events.

Call Script.get_log_handler().

Reset Script log handling to the Frida default.

Build a Frida agent bundle with frida.Compiler.build().

Start Compiler.watch() and queue compiler events.

Read queued Compiler.watch() events.

Stop tracking a Compiler.watch() record.

Search Frida packages with PackageManager.search().

Install Frida packages with PackageManager.install().

Read PackageManager.registry.