◆ Reverse Engineering

Frida

17.22.1 open-source

Frida is a dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.

source ↗ website ↗ rss ↗ What is a cyber toolchain? last repo push Sep 25, 2026

frida-compile --library lib/index.ts -o dist
frida-server --device=barebone
adb shell su -c 'insmod /data/local/tmp/frida-agent.ko'
frida-strace -U -f com.dexprotector.detector.envchecks
frida-compile agent.ts -o _agent.js
$ frida -p 0 -l agent.ts
frida-server --disable-preload
Java.deoptimizeBootImage();
frida-server --ignore-crashes
frida -U -l script.js 'var p = Process.spawn("<app_package>", { uid: 1000 });'
frida -U myapp -l script.js
// Inside script.js:
var resolver = new ApiResolver('module');
resolver.enumerateMatches('/i someAPI**/', { onMatch: function(match) { console.log(match); }, onComplete: function() {} });
Java.scheduleOnMainThread(() => {
  const MainClass = Java.use('com.example.Main');
  const ctx = MainClass.getApplicationContext();
  console.log(ctx);
});
frida -U -n <app_name> -l critical_native_hook.js
const buffer = Memory.alloc(16);
const ab = buffer.toArrayBuffer();
const wrapped = ArrayBuffer.wrap(ab);
const unwrapped = ArrayBuffer.unwrap(wrapped);
const symbols = Module.enumerateSymbolsSync('libexample.so');
symbols.forEach(sym => console.log(sym.name + ': ' + sym.size);
var MyClass = Java.use('com.example.Class', { cache: 'skip' });
MyClass.$new();
frida -U -n AppName --eval 'var cmodule = await Frida.loadModule("./lib.so"); console.log(cmodule.moduleMap);'
const FridaGadget = require('frida-gadget');
const gadget = new FridaGadget({ config: 'path/to/config.json' });
const cmodule = new Frida.CModule(...);
// ... use cmodule ...
cmodule.dispose();
frida-inject -P username=admin -P port=8080 <PID>
// In your transform callback:
frida.stalker.unfollow(threadId);
Java.registerClass({
  name: 'com.example.MyClass',
  superclass: Java.use('com.example.BaseClass'),
  methods: { /* ... */ }
});
const server = require('frida-server');
server.enableDebugger(); // Now picks a default or waits for connection logic internally
frida-ls-devices
frida-ps -U -a
frida-repl TargetApp
frida-ps -U

Summary

Frida is an open-source dynamic instrumentation toolkit that lets you inject scripts into running processes to inspect and modify their behaviour at runtime, without needing the source code or recompiling the target. It is free to use, and you work with it through CLI tools like frida-trace and frida-ps, or through Python and Node.js bindings that call into the same engine, so it can also be scripted rather than just run interactively. It is built for reverse-engineers and security researchers, particularly those probing mobile and desktop applications where static analysis alone falls short. It sits in the reverse-engineering category alongside disassemblers and debuggers, but its focus on live process manipulation across platforms, including Apple's OSes with proper code-signing, sets it apart from purely static tools. With commits dating back to 2013, 54 contributors, over 200 commits in the past year, and a release just 16 days ago, it is actively maintained.

Frida is a dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.

How Frida helps

Which processes are running on this device or emulator right now, and what can I attach to?

lists the running processes across the connected device or system so a target can be identified and instrumented without needing its source

How does this mobile app behave differently once it detects a debugger or a rooted device?

lets a script intercept and rewrite the checks and their return values at runtime, so protective logic can be observed and bypassed without patching the binary on disk

Where in memory does this value live, and what changes it while the program runs?

reads and writes the target process's memory directly and can watch specific locations, tying observed behaviour to concrete addresses instead of static offsets

Which network or crypto calls does this app make before I can see them on the wire?

hooks the relevant library functions inside the process itself, capturing arguments such as keys, plaintext or endpoints before they are transformed or encrypted

Can I change what this app does without rebuilding or re-signing it?

scripts injected into the running process can alter arguments, return values or control flow on the fly, giving a live view and control that recompiling or static patching would not

Languages

Not documented

Command line

Source

option surface across analysed releases

options at that release added, per release removed, per release

option	found in	since	description

Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.

Score card

Shipping velocity releases a month, last 12 months
Documentation quality release-notes rubric, 0–100
Breaking-change discipline how rarely a release breaks users, and notice given
Maintenance risk quiet time against its own cadence, maintainers
Innovation & surface new capabilities, API and MCP surface
Community health
Contributor trend distinct committers, this year against last
Maintainer concentration bus factor now against a year ago
Issue backlog trend issues closed per issue opened, 12 months
Responsiveness median time to a maintainer’s first reply

Nine scores for Frida, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored

Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
Documentation quality — the release-notes rubric published on the analytics page, unchanged.
Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail Frida puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

177 entries

October 20264
September 20262
August 20261
July 20262
June 20266
May 20262
April 20261
March 20262
February 20261
January 20261
December 20251
November 20251
October 20253
September 20252
August 20251
July 20255
June 20252
May 20252
March 20252
January 20252
December 20241
November 20241
September 20241
July 20242
May 20243
February 20241
December 20231
November 20232
August 20231
July 20231
June 20231
April 20231
February 20231
December 20221
November 20221
October 20221
July 20222
June 20221
May 20221
February 20222
December 20212
November 20212
October 20212
September 20213
August 20211
July 20213
May 20211
April 20211
March 20211
February 20212
January 20212
December 20204
November 20201
October 20202
September 20202
August 20201
July 20203
June 20205
May 20203
March 20202
February 20202
January 20201
December 20194
November 20193
October 20195
September 20196
August 20193
July 20191
June 20192
May 20193
September 20181
August 20181
July 20181
June 20181
May 20181
April 20181
September 20171
August 20172
January 20171
October 20162
August 20161
June 20161
February 20162
January 20161
November 20151
September 20151
July 20152
June 20152
May 20151
March 20152
August 20142
May 20142
April 20141
February 20141
January 20143

Project health

Issue, contributor and maintainer activity in frida/frida, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

Contributors 4 +2 vs prior 12 months
Maintainers 1 +1 joined · −1 left, last 12 months
Bus factor 1 committers behind half the commits
Community-filed 100% of issues opened, last 12 months
Median time to close 18 days first maintainer reply 41 hours
Open backlog 1,960 of 3,236 issues ever filed

Issues opened / month 4 · 0 communitymaintainers
Open backlog 1,960
Contributors / month 1
Commits / month 35
Stars 21,984

Issue themes, last 12 months

bugs 1%
other 99%

Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

Articles

1 article · updated Nov 4, 2026

Where Frida turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.

Tutorials & guides 1

Jan 32021
Android Penetration Testing: Frida Hacking Articles
Researchers use Frida, a dynamic instrumentation toolkit, to perform android hooking (intercepting IPC and modifying it to make a function perform the desired function).

2 more quotes

Frida uses javascript to perform hooking since Android’s native code and javascript both run on JIT compilation techniques, it can intercept its inter-process communication, add the code specified in a script and…
Needless to say, a program can do countless things; therefore, Frida’s applications have no limit, hence, this article only covers the basics.

Add the badge to your README

Maintain this project? The badge links readers straight to this page, so they can follow every release here.

Choose a badge style and copy the code →