frida_hook_native_by_offset
Hook native functions by module name and hex offset, resolving the base address at runtime to bypass ASLR.
Instructions
Hook a native function by module name + hex offset.
Requires an active session (from frida_connect).
module: module name (partial match, case-insensitive), e.g.
'CoreAudio', 'libsystem_kernel'.
offset: hex offset within the module, e.g. '0x1a2b'.
name: optional label for the hook.
Unlike frida_hook_native_function which takes an absolute address,
this resolves the module base at runtime and adds the offset —
useful when ASLR is in play.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| module | Yes | ||
| offset | Yes | ||
| name | No |