Frida tracing discovery

Skill Rudra-ravi/frida-skills/frida-tracing-discovery

Ai skills for Frida dynamic instrumentation across Android, iOS, native hooks, agents, and troubleshooting

Install

npx -y skills add Rudra-ravi/frida-skills --skill frida-tracing-discovery

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Discover Frida hook points with frida-trace, class and method enumeration, module/export/import/symbol discovery, stack traces, Stalker, and probe narrowing.

SKILL.md

2.0 KB, as published. Nobody here has run it

Frida Tracing Discovery

Use this skill when the target API, class, symbol, or call path is unknown.

Start Broad, Then Narrow

Prove the behavior happens without Frida.
Choose the highest-signal boundary: network, crypto, file, IPC, WebView, class loading, native library loading, or UI action.
Trace or enumerate around that boundary.
Add stack traces to identify app-owned callers.
Replace broad probes with narrow hooks.

CLI Tracing

frida-trace -U -f com.example.app -j 'java.net.URL!*' --no-pause
frida-trace -U -f com.example.app -i 'open' -i 'connect' --no-pause
frida-trace -U -n target -m 'Module!*pattern*'

Treat generated handlers as temporary discovery artifacts, then move proven logic into a reviewed script.

Android Discovery

Java.perform(() => {
  const groups = Java.enumerateMethods("*crypto*!*/isu");
  console.log(JSON.stringify(groups, null, 2));
});

Class loader check:

Java.perform(() => {
  Java.enumerateClassLoaders({
    onMatch(loader) {
      try {
        Java.classFactory.loader = loader;
        Java.use("com.example.Target");
        console.log("loader", loader);
      } catch (_) {}
    },
    onComplete() {}
  });
});

Native Discovery

const mod = Process.getModuleByName("libtarget.so");
for (const e of mod.enumerateExports()) {
  if (e.name.includes("SSL") || e.name.includes("crypto")) console.log(e.name, e.address);
}

Backtrace on a generic boundary:

Interceptor.attach(Module.getGlobalExportByName("open"), {
  onEnter(args) {
    console.log(args[0].readUtf8String());
    console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
      .map(DebugSymbol.fromAddress).join("\n"));
  }
});

References

Read references/discovery-patterns.md for target-specific trace ladders.