Frida data extraction

Skill Rudra-ravi/frida-skills/frida-data-extraction

Ai skills for Frida dynamic instrumentation across Android, iOS, native hooks, agents, and troubleshooting

Install

npx -y skills add Rudra-ravi/frida-skills --skill frida-data-extraction

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use Frida to observe and extract runtime data such as HTTP, headers, tokens, JSON, crypto values, preferences, SQLite, files, memory, and byte arrays.

SKILL.md

2.0 KB, as published. Nobody here has run it

Frida Data Extraction

Use this skill when the goal is to observe runtime data rather than bypass a check.

Rules

Only extract data from systems the user is authorized to test.
Avoid printing secrets into shared logs unless the user explicitly needs them.
Prefer structured logs with redaction for tokens, cookies, passwords, and private keys.
Copy pointer and retval data inside callbacks; Frida may recycle callback objects.

Android Boundaries

Java.perform(() => {
  const Base64 = Java.use("android.util.Base64");
  Base64.encodeToString.overload("[B", "int").implementation = function (bytes, flags) {
    const out = this.encodeToString(bytes, flags);
    console.log("Base64.encodeToString ->", out);
    return out;
  };
});

High-signal targets: request builders, JSON serializers, SharedPreferences, SQLite APIs, keystore wrappers, crypto APIs, WebView bridges, file I/O.

iOS Boundaries

High-signal targets: NSURLRequest, NSURLSession, NSJSONSerialization, Keychain wrappers, NSUserDefaults, SQLite, CommonCrypto, file APIs, pasteboard.

Native Buffers

function dump(ptr, len) {
  if (ptr.isNull() || len <= 0) return;
  console.log(hexdump(ptr, { length: Math.min(len, 256), ansi: false }));
}

Use both hex and text only when the data is valid text. Binary crypto material often is not.

Verification

Logs are tied to a user action or request.
The source and encoding of each value is clear.
Sensitive values are redacted unless needed.
The hook does not change the target behavior unless explicitly requested.

References

Frida JavaScript API: https://frida.re/docs/javascript-api/
Frida messages: https://frida.re/docs/messages/
OWASP MASTG Frida: https://mas.owasp.org/MASTG/tools/generic/MASTG-TOOL-0031/