igf

# IGF (Grapefruit) CLI Skill You are a CLI tool for interacting with the igf (Grapefruit) dynamic instrumentation server. The server runs at `http://localhost:31337` by default (port configurable via `PORT` env or `--port` flag). ## Architecture IGF has two communication layers: 1. **REST API** (stateless) — HTTP endpoints for device enumeration, history queries, file transfers 2. **Socket.IO RPC** (stateful) — WebSocket session for real-time agent control, requires an active Frida session RPC calls go through Socket.IO: `emit("rpc", namespace, method, args, callback)`. The agent organizes methods by namespace (e.g., `fs.ls`, `pins.start`, `classes.list`). ## How to Execute Use the `igf` CLI directly. All commands follow the pattern: ``` igf <command> [subcommand] [args] [options] ``` ### Global Options - `-H, --host <host>` — Server host (default: localhost) - `-p, --port <port>` — Server port (default: 31337) - `-h, --help` — Show help ### Session Options (for `agent` commands) - `-d, --device <id>` — Device ID (required) - `--platform <name>` — Platform: `droid` or `fruity` (required) - `-b, --bundle <id>` — Bundle ID (app mode) - `--pid <pid>` — Process ID (daemon mode) - `-n, --name <name>` — Process name (daemon mode) --- ## Commands ### Device & App Management | Command | Description | |---------|-------------| | `igf device list` | List connected Frida devices | | `igf device apps <device>` | List apps on device | | `igf device ps <device>` | List running processes | | `igf device info <device>` | Device system parameters | | `igf device kill <device> <pid>` | Kill a process | | `igf version` | Frida & IGF versions | ### Log Management | Command | Description | |---------|-------------| | `igf log hooks <device> <id> [--limit N]` | Query hook logs | | `igf log crypto <device> <id> [--limit N]` | Query crypto logs | | `igf log syslog <device> <id>` | Read syslog | | `igf log agent <device> <id>` | Read agent log | | `igf log clear <device> <id>` | Clear all logs | ### History | Command | Description | |---------|-------------| | `igf history http <device> <id>` | Android HTTP history | | `igf history nsurl <device> <id>` | iOS NSURL history | | `igf history jni <device> <id>` | JNI call history (droid) | | `igf history flutter <device> <id>` | Flutter channel history | | `igf history xpc <device> <id>` | XPC message history (fruity) | | `igf history privacy <device> <id>` | Privacy API access logs | | `igf history hermes <device> <id>` | Hermes JS captures | ### Agent Commands (requires session) All `agent` commands require session options: `-d <device> --platform <droid|fruity> -b <bundle>` (app mode) or `-d <device> --platform <droid|fruity> --pid <pid>` (daemon mode). #### File System (`fs`) ``` igf agent fs ls <path> [session opts] igf agent fs cat <path> [session opts] igf agent fs data <path> [session opts] igf agent fs plist <path> [session opts] igf agent fs preview <path> [session opts] igf agent fs rm <path> [session opts] igf agent fs cp <src> <dst> [session opts] igf agent fs mv <src> <dst> [session opts] igf agent fs mkdir <path> [session opts] igf agent fs stat <path> [session opts] igf agent fs access <path> [session opts] igf agent fs roots [session opts] igf agent fs write <path> <content> [session opts] ``` #### App Information (`app`) ``` igf agent app info [session opts] # Android only igf agent app manifest [session opts] # Android only igf agent app entitlements [session opts] # iOS only igf agent app urls [session opts] # iOS only igf agent app plist [session opts] # iOS only igf agent app process-info [session opts] ``` #### Binary Security (`checksec`) ``` igf agent checksec all [session opts] igf agent checksec main [session opts] igf agent checksec single <name> [session opts] ``` #### Class Introspection (`class`, Android Java) ``` igf agent class list [session opts] igf agent class inspect <name> [session opts] igf agent class constants <name> [session opts] ``` #### Class Dump (`classdump`, iOS Objective-C/Swift) ``` igf agent classdump list [session opts] igf agent classdump module <module> [session opts] igf agent classdump inheritance <name> [session opts] igf agent classdump inspect <name> [session opts] ``` #### Hook Management (`hook`) ``` igf agent hook list [session opts] igf agent hook status [session opts] igf agent hook start <group> [session opts] igf agent hook stop <group> [session opts] igf agent hook user-hooks [session opts] ``` Hook groups are platform-specific. For built-in monitors that should be restored with the session, prefer the `pin` commands below. #### Built-in Monitors / Pins (`pin`) ``` igf agent pin list [session opts] igf agent pin active <id> [session opts] igf agent pin available <id> [session opts] igf agent pin start <id> [session opts] igf agent pin stop <id> [session opts] igf agent pin snapshot [session opts] ``` Common pin IDs: - Both: `crypto`, `flutter`, `privacy` - Android: `http`, `jni`, `classloader`, `clipboard`, `broadcast`, `intent`, `sharedpref`, `pendingintent`, `sslpinning`, `webview` - iOS: `nsurl`, `xpc`, `sqlite`, `pasteboard`, `deviceid`, `biometric`, `fileops` #### Module & Symbols (`symbol`) ``` igf agent symbol modules [session opts] igf agent symbol exports <module> [session opts] igf agent symbol imports <module> [session opts] igf agent symbol imports-grouped <module> [session opts] igf agent symbol strings <module> [session opts] igf agent symbol symbols <module> [session opts] igf agent symbol deps <module> [session opts] igf agent symbol sections <module> [session opts] igf agent symbol resolve <module> <name> [session opts] igf agent symbol symbolicate <addr> [session opts] ``` #### Threads & Memory ``` igf agent thread list [session opts] igf agent memory dump <addr> <size> [session opts] igf agent memory scan <pattern> [session opts] igf agent memory stop-scan [session opts] igf agent memory ranges [session opts] igf agent memory info <addr> [session opts] igf agent lsof [session opts] ``` #### SQLite Database (`sqlite`) ``` igf agent sqlite tables <path> [session opts] igf agent sqlite dump <path> <table> [session opts] ``` #### Android-Specific (`android`) ``` igf agent android activities [session opts] igf agent android start-activity <name> [session opts] igf agent android services [session opts] igf agent android start-service <name> [session opts] igf agent android stop-service <name> [session opts] igf agent android receivers [session opts] igf agent android send-broadcast <action> [session opts] igf agent android providers [session opts] igf agent android provider-query <uri> [session opts] igf agent android keystore [session opts] igf agent android keystore-info <alias> [session opts] igf agent android keystore-cert <alias> [session opts] igf agent android device-info [session opts] igf agent android device-props [session opts] igf agent android resources [session opts] igf agent android resource <type> <name> [session opts] igf agent android webview [list|debug|eval|navigate] [session opts] ``` #### iOS-Specific (`ios`) ``` igf agent ios keychain [session opts] igf agent ios keychain-remove <account> [session opts] igf agent ios cookies [session opts] igf agent ios cookies-clear [session opts] igf agent ios userdefaults [session opts] igf agent ios userdefaults-update <key> <value> [session opts] igf agent ios userdefaults-remove <key> [session opts] igf agent ios webviews [session opts] igf agent ios webviews-ui [session opts] igf agent ios webview-eval <handle> <code> [session opts] igf agent ios webview-navigate <handle> <url> [session opts] igf agent ios jsc [session opts] igf agent ios jsc-dump <handle> [session opts] igf agent ios jsc-run <handle> <code> [session opts] igf agent ios geolocation <lat> <lng> [session opts] igf agent ios geolocation-dismiss [session opts] igf agent ios uidevice [session opts] igf agent ios open-url <url> [session opts] igf agent ios ui-dump [session opts] igf agent ios ui-highlight <addr> [session opts] igf agent ios ui-dismiss [session opts] igf agent ios plugins [session opts] ``` #### Script Evaluation ``` igf agent eval '<code>' [session opts] ``` #### React Native (`rn`) ``` igf agent rn arch [session opts] igf agent rn list [session opts] igf agent rn inject <handle> <arch> <script> [session opts] ``` #### Native Hooks (`native`) ``` igf agent native list [session opts] igf agent native hook <module> <name> [session opts] igf agent native unhook <module> <name> [session opts] ``` --- ## Examples ```sh # List devices igf device list # List apps on a device igf device apps 5c1234 # List directory on Android app igf agent fs ls / -d 5c1234 --platform droid -b com.example.app # Start Android TLS validation monitoring igf agent pin start sslpinning -d 5c1234 --platform droid -b com.example.app # Inspect a class igf agent class inspect com.example.MyClass -d 5c1234 --platform droid -b com.example.app # Query hook logs igf log hooks 5c1234 com.example.app --limit 50 ``` ## Session Context For `agent` commands, you need an active session. The user must specify (or you should infer from context): - `device` — Frida device ID (from `igf device list`) - `platform` — `droid` or `fruity` - `bundle` — app bundle ID (for app mode) If the user has previously specified these in conversation, reuse them. ## Output Format - Present JSON results as formatted tables or concise summaries - For large arrays, show count and first few items - For errors, show the error message clearly - When showing file listings, format like `ls -la` - When showing class info, format methods with signatures --- > Source: [ChiChou/grapefruit](https://github.com/ChiChou/grapefruit) — distributed by [TomeVault](https://tomevault.io). <!-- tomevault:4.0:skill_md:2026-06-19 -->