frida_child_process_trap
Monitor child process creation by hooking spawn, fork, and exec APIs. Capture PID, command line, and environment details to trace process trees and detect anti-analysis or sandbox escape attempts.
Instructions
Monitor child process creation by hooking spawn/fork/exec APIs.
Hooks: posix_spawn, posix_spawnp, fork, execve, system(). Captures child PID, command line, argv, and environment variable keys for each spawned process.
target: process name or pid (string).
duration_seconds: how long to monitor (default 10).
Useful for: tracing process trees, catching helper tool invocations, monitoring sandbox escape attempts, detecting anti-analysis forks.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"target": "<target>"
},
"name": "frida_child_process_trap"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| duration_seconds | No |