Frida — The Cyber Toolchain

Frida 17.19.0

Fri, 25 Sep 2026 12:07:59 GMT

Frida 17.19.0 ships PS5 support and adds a barebone WinNT ARM64 agent⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds prebuilt Frida binaries for the PlayStation 5 (PS5) platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a barebone WinNT ARM64 agent, now included in CI-shipped assets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.15.0

Fri, 19 Jun 2026 00:00:00 GMT

Frida 17.15.0 adds Process.getThreadById() and getFunctionRange(), and improves Darwin dyld and Linux musl linker integration. • Adds Process.getThreadById() to gumjs for looking up a single thread by ID without enumeration • Adds Process.getFunctionRange() convenience wrapper that throws on error instead of returning null Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.14.0

Tue, 16 Jun 2026 00:00:00 GMT

Adds Script.interrupt() and Script.terminate() APIs for controlling runaway scripts in Frida 17.14.0 • Script.interrupt() aborts executing JavaScript while leaving the script loaded and ready to run again. • Script.terminate() interrupts execution and unloads the script, including stuck or infinite operations. These operations are unsupported in Barebone sessions. • Exposes process argv from enumerate_processes() at metadata scope. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.13.0

Mon, 15 Jun 2026 00:00:00 GMT

Frida 17.13.0 adds process argv access, a Swift typed accessor, ControlFlowGraph.toJSON(), and source locations in generated API documentation. • `argv` is now included in enumerated process parameters across Windows, macOS, Linux, and FreeBSD when requesting full scope. • The `swift` module exposes a typed accessor for the `argv` process parameter. • ControlFlowGraph.toJSON() (and related classes) now supports JSON serialization via JSON.stringify(). • GIR synthesized documentation now includes filename and line information to trace generated API docs back to their source. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.12.0

Wed, 10 Jun 2026 00:00:00 GMT

Frida 17.12.0 adds native Control-Flow Graph analysis in Gum/GumJS and Process.findFunctionRange() • `gum` now includes a native control-flow graph module with resolver-based construction, Cooper-Harvey-Kennedy dominators, and nearest-first dominating site enumeration. • `GumJS` exposes `ControlFlowGraph` and `BasicBlock` objects for analyzing function structures. • Adds Process.find_function_range() in Gum and Process.findFunctionRange() in GumJS to locate function ranges in stripped binaries without symbols. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.11.0

Fri, 05 Jun 2026 00:00:00 GMT

Frida 17.11.0 adds ptrace-free injection fallback, in-kernel instrumentation for Virtualization framework, and Gum export sizes • `/proc/$pid/mem` fallback enables Frida to inject into targets on Linux whose `ptrace` slot is already owned by another tracer, working on x86, x86_64, and arm64. • `VZ kernel GDB stub client` and physical-memory bridge allow in-kernel instrumentation of Virtualization framework guests via the Barebone backend. • `Intra-kernel hostlink over vsock` brings NativeCallback, Interceptor, and Memory.patchCode() to kernel code without relying on BRK callbacks. • `Interceptor` and `Stalker` are now functional in the kernel for barebone targets, with writable-remap support and TLB flushing. • Gum's enumerateExports() now includes export sizes via the `size` field in `GumExportDetails` reports `st_size` or `-1`. • Linux protection queries use the `PROCMAP_QUERY` ioctl on Linux 6.11+ to speed up memory analysis. • Vala bindings expose `X86Writer` so Vala code can generate x86 and x86_64 instructions, mirroring Arm64Writer. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.10.1

Tue, 02 Jun 2026 00:00:00 GMT

Frida 17.10.1 adds Memory.findPointers() with SIMD acceleration for finding pointer-aligned words. • gumjs: Expose Memory.findPointers(), backed by the new gum_memory_find_pointers() helper. This provides a focused, SIMD-accelerated way to find pointer-aligned words matching one or more values, across one or more ranges. • memory: Add gum_memory_find_pointers(), with parallel range tiling and per-architecture kernels such as SSE2 and NEON. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.10.0

Sun, 31 May 2026 00:00:00 GMT

Frida 17.10.0 adds composable Interceptor options via SessionOptions and JavaScript APIs, new UnwindBroker, and stealth improvements. • SessionOptions exposes agent feature toggles for exceptor mode, unwind broker, exit monitor, and thread suspend monitor, plus linker notifier offsets. • Replace old attach flags in the Interceptor API with composable option structs covering scratch register selection, relocation policy, replacement data, and listener data • Expose custom redirect emitters and default Interceptor options through QuickJS and V8 runtimes to make hook sites less predictable • Add support for 32-bit ARM EH ABI in the new UnwindBroker, including ARM-specific personality and exidx handling • Enable `stalker-x86` unwind support on Android, matching the arm64 backend Breaking changes: • The old attach flags in the Interceptor API are replaced by composable option structs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.9.8

Mon, 11 May 2026 00:00:00 GMT

Frida 17.9.8 adds memory protection option to Memory.alloc() and fixes struct returns in GumJS NativeCallback. • Adds optional `protection` field to Memory.alloc() options object Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.9.2

Tue, 28 Apr 2026 00:00:00 GMT

Frida 17.9.2 adds --with-apple-min-os, WebRequestHandler API, and Swift Linux bindings • Adds `--with-apple-min-os` configure flag to raise the Apple deployment-target floor • Adds WebRequestHandler, WebRequest, WebResponse, endpoint request-handler support, and PortalService extra-endpoint registration. • Adds Swift support on Linux via pkg-config, including bindings for WebRequestHandler, PortalService endpoints, DeviceChange async streams, and broader Variant unmarshalling Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.9.0

Thu, 26 Mar 2026 00:00:00 GMT

Frida 17.9.0 adds override_option(), eBPF spawn gater, XCFramework packaging, and control-endpoint config. • Adds override_option() to configure backend-specific options when creating a host session; an established session picks up changes on its next connection. • Adds the `control-endpoint` backend option (default `tcp:27042`) to Fruity and Droidy layers • Adds an eBPF-based spawn gater implementation on Linux • Adds a tool to package devkits as XCFrameworks • Adds a spawn gating example in the Python module Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.8.0

Mon, 09 Mar 2026 00:00:00 GMT

Frida 17.8.0 adds `frida-strace` syscall tracer with CoreProfile ktrace support on iOS and eBPF backend improvements on Linux. • Adds `frida-strace` CLI tool for observing system calls inside a target process • Supports repeated -f flags to spawn multiple programs, combined with -p $pid or -u $username; targeting by user is not supported on iOS. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.7.0

Fri, 13 Feb 2026 00:00:00 GMT

Frida 17.7.0 adds eBPF SyscallTracer service, droidy remote service support, and macOS 26 dyld compatibility • Adds a new eBPF-powered `SyscallTracer` service on Linux with groundwork for future activity sampling. • Adds `droidy` support for consuming remote services and implementing services locally. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.6.0

Sun, 18 Jan 2026 00:00:00 GMT

Frida 17.6.0 adds `FORCE` attach flag, removes Zygote injection for Android stability and reworks SELinux support. • Adds the Interceptor FORCE attach flag for inline hooking functions too small to patch safely; it may overwrite bytes past the function’s end and requires care. • Generalizes frida-helper.dex from non-rooted Android to the Linux and Droidy backends, adding activity launch and broadcast requests while eliminating internal system_server injection and the frida-java-bridge dependency. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.5.2

Mon, 15 Dec 2025 00:00:00 GMT

Frida 17.5.2 adds FridaCore Swift bindings via xcframework and improves Windows export accuracy. • Adds `FridaCore` Swift package with bindings for `AuthenticationService`, `PortalService`, `EndpointParameters`, `PackageManager`, and `Compiler`, plus minimal GLib bindings in a sub-namespace • Publishes `frida-core` releases as `.xcframework` files for direct integration into Xcode projects Breaking changes: • The Swift module previously named `Frida_Private` has been renamed to `FridaCore` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.5.0

Tue, 04 Nov 2025 00:00:00 GMT

Frida 17.5.0 adds CompilerOptions platform/externals and previews revamped async/await Swift bindings available by building from source. • Adds `platform` and `externals` options to `CompilerOptions` for tailored output via `frida-compile` or `Frida.Compiler`. • Revamps experimental Swift bindings around async/await and DeviceListModel for SwiftUI; users must clone and build from main because this release includes no frida-swift prebuilt binaries. • Darwin: `AllImageInfos` now reports the Dyld Shared Cache UUID and slide. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.4.2

Wed, 29 Oct 2025 00:00:00 GMT

Frida 17.4.2 adds get_frontmost_application() to Simmy and fixes hardware.product reporting • Adds get_frontmost_application() to the Simmy backend for identifying the active foreground application Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.4.1

Fri, 24 Oct 2025 00:00:00 GMT

Frida 17.4.1 adds FreeBSD PTY support and Android ArtMethod fixes • Adds PTY (pseudo-terminal) support on FreeBSD so spawn/attach operations requiring a controlling terminal work out of the box Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.4.0

Sun, 12 Oct 2025 00:00:00 GMT

Frida 17.4.0 adds Simulator backend (simmy), early dyld_sim instrumentation, cross-backend host-session, StdioPipes, and VariantReader.list_members() • `simmy` backend: Spawn apps, instrument processes, and interact with Apple simulators via CoreSimulator.framework • `darwin`: Early instrumentation of `dyld_sim`, enabling script attachment before the dynamic loader finishes bootstrapping • `host-session`: Cross-backend communication, allowing devices discovered through one backend to be available to internals in another • `base`: `StdioPipes` and `FileDescriptor` helpers for Darwin, Linux, and FreeBSD backends • `value`: New VariantReader.list_members() helper for introspection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.3.1

Thu, 18 Sep 2025 00:00:00 GMT

Frida 17.3.1 improves CoreDevice tunnel performance for Fruit tools • Massively improved `CoreDevice` tunnel performance Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.3.0

Mon, 15 Sep 2025 00:00:00 GMT

Frida 17.3.0 adds XNU injection support and exposes CModule symbols. • Adds basic XNU injection support in the Barebone backend, tested on iOS 14.0 in QEMU. • Exposes underscore-prefixed CModule symbols so they are usable from Frida scripts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.2.15

Sat, 02 Aug 2025 00:00:00 GMT

Frida 17.2.15 adds iOS 26 injection via dual-mapping, visionOS platform support, FreeBSD x86 32-bit, and uint type in NativeFunction. • Support iOS 26 through dual-mapping, enabling injection on palera1n • Add preliminary visionOS platform support • Bring x86 (32-bit) support to FreeBSD • Wire up NEON register access on ARM/arm64 for Linux and Darwin • Adds uint support to NativeFunction / NativeCallback in the Barebone backend. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.2.14

Thu, 24 Jul 2025 00:00:00 GMT

Frida 17.2.14 adds Module.get_version() and Module#version for source version inspection • Module.get_version() virtual function for native module interfaces • Module.get_version() on Darwin (macOS/iOS) exposing `LC_SOURCE_VERSION` • `Module#version` property exposed in GumJS/JavaScript Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.2.13

Mon, 21 Jul 2025 00:00:00 GMT

Frida 17.2.13 adds support for implementing DebugSymbol APIs in the Barebone backend. • Supports implementing DebugSymbol APIs in barebone mode Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.2.12

Fri, 18 Jul 2025 00:00:00 GMT

Frida 17.2.12 adds bare-metal support, new Buffer API methods, optional symbol prefixing in devkit, and armv6kz build support • Added preliminary support for running Gum without an operating system to enable Frida on bare-metal targets • Added Memory.protect() API to change memory protection on bare-metal targets • Added new methods to `Buffer` API: read_bytes(), write_bytes(), write_int64(), write_uint32(), write_int32(), write_uint16(), write_int16(), write_uint8(), write_int8() • Added support for ‘armv6kz-‘ prefixed toolchains in the build system Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.2.9

Wed, 02 Jul 2025 00:00:00 GMT

Preliminary iOS 26 support with auto code_signing for enforced debugger mappings • Adds preliminary iOS 26 support for gadget injection where debugger mappings are enforced • Sets `code_signing` to required in the gadget configuration when target memory protection cannot be flipped Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.2.7

Tue, 01 Jul 2025 00:00:00 GMT

Frida 17.2.7 enhances its package manager with better npm compatibility, including new `role` and `omits` options for the `install()` function to control dependency types and exclusions. • Adds `role` option to `package-manager`'s `install()` method for equivalent of npm's --save-* switches • Adds `omits` option to `package-manager`'s `install()` method for equivalent of npm's --omit=x switch Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.2.0

Wed, 18 Jun 2025 00:00:00 GMT

Frida 17.2.0 adds frida-pm CLI and PackageManager API for discovering and installing Frida-specific packages. • `frida-pm search` command with `keywords:frida-gum` filter to find Frida-specific packages without Node.js dependency. • `frida-pm install ` subcommand to install packages in one command, working without Node.js installed. • New `frida-core.h` API surface: frida_package_manager_new(), frida_package_install_options_new(), and frida_package_manager_install_sync() for C-based package management. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.1.2

Fri, 06 Jun 2025 00:00:00 GMT

Frida 17.1.2 improves frida-node signal handling and runtime stability. • Adds optional `DeviceManager` constructor parameter in `frida-core` for cleaner initialization • Improves `frida-node` GVariant signal handler parameters and exception propagation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 17.0.0

Sat, 17 May 2025 00:00:00 GMT

Frida 17 unbundles runtime bridges and removes legacy APIs, directing module introspection through Module instances and global export lookup. • Bundles frida-{objc,swift,java}-bridge directly into the `frida` REPL and `frida-trace` agents via frida-tools 14.0.0 • Use Process.getModuleByName() to obtain a Module instance before accessing its introspection methods. • Adds Module.getGlobalExportByName() to access global exports without a specific module handle • Removes legacy static Module methods: Module.ensureInitialized(), Module.findBaseAddress(), Module.getBaseAddress(), Module.findExportByName(), Module.getExportByName(), Module.findSymbolByName(), Module.getSymbolByName(), and Module.enumerateExports() Breaking changes: • The legacy static Module methods (`ensureInitialized`, `findBaseAddress`, `getBaseAddress`, `findExportByName`, `getExportByName`, `findSymbolByName`, `getSymbolByName`) and Module.enumerateExports() are removed; code using them will fail. • Legacy callback-style enumeration APIs and their Sync-suffixed counterparts are removed; modern synchronous enumeration methods still return arrays. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.7.15

Thu, 08 May 2025 00:00:00 GMT

Frida Node.js bindings rewritten with Node-API and auto-generation in 16.7.15 • Rewrites Node.js bindings using Node-API, so one binary per OS/architecture/libc combination supports modern Node.js, Electron, and nw.js versions. • Enables auto-generated Node.js API bindings that reflect frida-core changes instantly. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.7.1

Fri, 21 Mar 2025 00:00:00 GMT

Frida 16.7.1 improves ARM32 Thumb code generation and scales to more ADB devices. • Increases ADB message size limit in `droidy` to support more than ~8 connected devices Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.7.0

Thu, 13 Mar 2025 00:00:00 GMT

Frida 16.7.0 adds thread/module observers and JS Profiler/Sampler APIs for dynamic instrumentation. • Introduces Process.attachThreadObserver() API to monitor thread creation, termination, and renaming events • Adds Process.attachModuleObserver() API to detect module loading and unloading with synchronous callbacks • Exposes `Profiler` and `Sampler` classes in JavaScript for worst-case function profiling and metric sampling • Introduces six new sampler implementations: `CycleSampler`, `BusyCycleSampler`, `WallClockSampler`, `UserTimeSampler`, `MallocCountSampler`, `CallCountSampler` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.6.4

Fri, 17 Jan 2025 00:00:00 GMT

Frida 16.6.4 revives ARM BE8 support and improves module loading stability. • `linux`: Restores support for big-endian ARM (BE8) systems. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.6.0

Thu, 09 Jan 2025 00:00:00 GMT

Frida 16.6.0 adds findSymbolByName()/getSymbolByName(), native instance Module APIs, and .gnu_debugdata fallback for symbol resolution. • `gumjs`: Adds findSymbolByName() and getSymbolByName() methods for direct native symbol lookup by name • `module` / `ncm`: Turns Module APIs into instance methods to allow multiple queries efficiently (e.g., no longer need to pass module path string to every query) • elf-module: Falls back to `.gnu_debugdata` section parsing when in-memory symbols are missing, decompressing the embedded ELF for symbol reuse Breaking changes: • Drop support for running without GObject Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.5.8

Mon, 09 Dec 2024 00:00:00 GMT

Frida 16.5.8 improves Fruity backend network performance and GIR generation. • Fruity: Multi-transfers boost data transfer efficiency • Fruity: Userspace NCM driver batching reduces packet loss in bursty situations • Fruity: Enable lwIP TCP timestamps and SACK to align with Linux IP stack defaults • Fruity: Bump lwIP TCP Maximum Segment Size (MSS) to 4036 for better TCP tunnel performance • Fruity: Account for frida-server bind() delay to improve connection establishment reliability • Fruity: Improve USB device handling on non-macOS systems by avoiding unnecessary USB access when kernel NCM is available • Fruity: Improve TcpTunnelConnection teardown to ensure proper cleanup upon the remote end closing the connection • api: Generate a proper GObject Introspection Repository (GIR), including necessary types and omitting internal ones • api: Omit APIs involving HostSession Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.5.7

Thu, 14 Nov 2024 00:00:00 GMT

Frida 16.5.7 adds TCP tunnel as default backend, Android APK asset loading, MUSL Linux injector compatibility, and PowerPC build support. • TCP tunnel protocol is now the default for Fruity backend connections • `FRIDA_FRUITY_TUNNEL_PROTOCOL` environment variable allows reverting to QUIC transport • Android Gadget supports loading assets from APKs where `extractNativeLibs` is false • Injector compatibility improved for Linux MUSL libc environments • Build system now supports the PowerPC architecture • Remote call stack allocation added to improve compatibility with small-stack applications like Go Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.5.0

Fri, 06 Sep 2024 00:00:00 GMT

Frida 16.5.0 adds thread hardware breakpoints/watchpoints and Windows on ARM support available through source builds. • Adds setHardwareBreakpoint() and unsetHardwareBreakpoint() methods to thread objects for precise breakpoint control • Adds setHardwareWatchpoint() and unsetHardwareWatchpoint() methods to thread objects for memory access monitoring • Adds source-level Windows on ARM support: arm64 Frida can inject into native arm64 and emulated x86_64/x86 processes, but prebuilt Windows arm64 binaries are not provided in this release. • Adds Cancellable.withTimeout() convenience factory function in the Node.js API • Adds Cancellable.combine() convenience method in the Node.js API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.4.0

Fri, 05 Jul 2024 00:00:00 GMT

Frida 16.4.0 adds CoreDevice support on non-macOS via userspace CDC-NCM driver and iOS 18 dyld restart detection • Adds a userspace CDC-NCM driver for Apple CoreDevice connectivity on Windows, Linux, and other libusb-supported platforms when no kernel driver is available. • Add `Await ObjC runtime initialization on iOS >= 18` to ensure Objective-C runtime is ready before script execution on iOS 18 devices • Expose `os.build` and `hardware` fields in the exposed system parameters via Frida's introspection API Breaking changes: • Node.js requirement bumped to >=16 || 14 >=14.17, dropping support for Node versions below these thresholds Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.3.0

Fri, 31 May 2024 00:00:00 GMT

Frida 16.3.0 adds CoreDevice/iOS 17 support, a device service API, and separate RPC binary-data passing improvements. • Adds device.open_service() method to connect to device services via `xpc:`, `dtx:`, or `plist:` protocol prefixes. • Restores spawning debuggable apps on jailed iOS 17; attaching to already-running apps without spawning is still unsupported. • Enables passing binary data as the last argument to RPC exports and returning binary data alongside a JSON-serializable value. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.2.5

Tue, 21 May 2024 00:00:00 GMT

Release 16.2.5 improves Android 14 compatibility for dynamic class registration by enforcing read-only Dex files in Java.registerClass(). • Supports setting DexFile to read-only in `Java.registerClass()` for apps with targetSdk >= 34 on Android 14+ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.2.2

Fri, 17 May 2024 00:00:00 GMT

Frida 16.2.2 adds gumjs Process.runOnThread(), Thread.backtrace limit option, and Stalker iterator chaining; new Meson build system replaces MSVS for Windows. • Adds Process.runOnThread() to GumJS to execute code on a specific thread • Adds StalkerIterator.put_chaining_return() method for Stalker control flow manipulation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.2.0

Fri, 16 Feb 2024 00:00:00 GMT

Frida 16.2.0 adds thread names, memory protection queries, JavaScript Cloak and fast Interceptor APIs, ELF import slots, and jailbroken tvOS support. • Process.enumerateThreads() now exposes the `name` property for threads when available • New Memory.queryProtection() method to determine memory page protection bits • New Cloak.hasRangeContaining() API exposed in JavaScript bindings to identify Frida-owned resources • New Interceptor.replaceFast() method for lower-overhead hooking of hot targets • Module#enumerateImports() now provides the `slot` property on ELF-based platforms (Linux, Android, FreeBSD, QNX) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.1.9

Wed, 20 Dec 2023 00:00:00 GMT

Frida 16.1.9 improves Interceptor stability and Linux/Android spawn() reliability with new exception handling and ELF parsing logic. • darwin: Switches Mach exception handling to a POSIX Exceptor backend for better compatibility with recent Apple OS versions • linux: Improve spawn() to handle r_brk being hit again and consider on-disk ELF for RTLD symbols • android: Handle symlinks in RTLD fallback logic Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.1.6

Mon, 13 Nov 2023 00:00:00 GMT

Frida 16.1.6 rolls back two ARM64 Interceptor/Relocator changes and lets Stalker transformers skip calls on arm64. • `Stalker: Allow transformer to skip calls on arm64` Breaking changes: • Two prior arm64 Interceptor/Relocator changes were rolled back: "relocator: Improve scratch register strategy on arm64" and "interceptor: Relocate tiny targets on arm64" Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.1.5

Sat, 04 Nov 2023 00:00:00 GMT

Frida 16.1.5 adds Swift API Resolver, module enumeration, and iOS unpairing • Adds ApiResolver('swift') to resolve and enumerate Swift API functions. • Adds enumerateSections() and enumerateDependencies() to the Module API. • Adds optional `size` field to ApiResolver matches. • Adds enumerateMatches() support for section scanning via ApiResolver('module'). • Adds device.unpair() method (iOS-devices only). • Adds Thread Local Variable APIs in darwin-module. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.1.4

Tue, 29 Aug 2023 00:00:00 GMT

Frida 16.1.4 adds Worker API for GUMJS and rootless iOS support • Adds `Worker` API in GumJS (QuickJS runtime) to offload heavy processing to a background thread. • Adds support for rootless iOS systems. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.1.3

Fri, 14 Jul 2023 00:00:00 GMT

Frida 16.1.3 adds StalkerIterator.memoryAccess to detect exclusive store contexts on ARM for safe instrumentation. • `StalkerIterator.memoryAccess` property allows a custom transformer to check if the current execution context involves an exclusive store operation, returning 'open' or 'exclusive'. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.1.0

Fri, 23 Jun 2023 00:00:00 GMT

Frida 16.1.0 introduces the alpha-quality Barebone backend for kernel and bare-metal instrumentation through GDB-compatible remote stubs. • Introduces the alpha-quality barebone device (-D barebone) for GDB-compatible remote stubs, with a subset of JavaScript APIs and some features limited to arm64. • Adds support for attaching to system-level code by specifying PID `0` when using the new Barebone backend, enabling hooks on kernel modules and bootloader firmware. • RustModule uses a local Rust toolchain on PATH to compile no_std code and inject it into the target; intrusive features require a suitable physical-memory base through FRIDA_BAREBONE_HEAP_BASE. • Adds the `Interceptor.breakpointKind` property (settable to `'hard'`) to force hardware breakpoints, necessary when software breakpoints cannot be injected due to flash-only memory constraints. • Introduces the $gdb.continue() command in the Frida REPL to manually resume execution of the target after a breakpoint is hit, as automatic resumption is not yet implemented. • Adds the `Memory.scanSync` capability for the Barebone backend to perform memory scanning on the target side, allowing detection of patterns like kernel syscall handlers without transferring raw memory dumps to the host. • Enables passing environment variables `FRIDA_BAREBONE_ADDRESS` (defaulting to `127.0.0.1:3333`) and `FRIDA_BAREBONE_HEAP_BASE` to configure the Barebone backend's connection endpoint and physical memory allocation base for intrusive features. • The temporary internal $gdb API exposes GDB.Client functionality such as register reads and execution control; it is explicitly not a stable public API. • Adds NativePointer#readVolatile() to safely read from memory locations that may be unmapped or have changing protection attributes during execution. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida

Frida 16.0.12

Fri, 14 Apr 2023 00:00:00 GMT

Frida 16.0.12 adds Linux container injection, no-temp-file operation on Linux >=3.17, and shared library server loading. • Inject into Linux containers such as Flatpak apps with the new re-engineered injector • Run without writing temporary files on Linux kernels >= 3.17 using memfd Full history on Cyber Toolchain: https://cybertoolchain.io/tools/frida