frida_spoof_return
Spoof function return values to bypass anti-debug checks. Attaches Interceptor.onLeave to replace return values of functions like ptrace, sysctl, or isDebuggerAttached on each call.
Instructions
Spoof the return value of a function. Classic anti-debug bypass.
Attaches Interceptor.onLeave and replaces the return value on every call. Common uses: bypass ptrace anti-debug, spoof isDebuggerAttached, override capability checks.
target: process name or pid (string).
function_name_or_addr: hex address or exported symbol name
(e.g. 'ptrace', 'sysctl', 'isDebuggerAttached').
return_value: value to force as return (numeric string, e.g.
'0', '1', '0xffffffff'). Interpreted via ptr().
Stays active for 30 seconds. Returns confirmation and logs the first 50 spoofed calls with original vs. spoofed values.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| function_name_or_addr | Yes | ||
| return_value | Yes |