메뉴
Dynamic instrumentation via Frida - attach to or spawn a process, load a JS hook script, capture send() events into a lifecycle-managed run directory. Supports local, USB-attached, and remote frida-server targets.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/gadievron/raptor --skill frida명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Hypothesis-driven, tool-grounded security review of coverage gaps
Provides adversarial code comprehension for security research, mapping architecture, tracing data flows, and hunting vulnerability variants to build ground-truth understanding before or alongside static analysis.
Generate, export, load, and verify forensic evidence from GitHub sources. Use when creating verifiable evidence objects from GitHub API, GH Archive, Wayback Machine, local git repositories, or security vendor reports. Handles evidence storage, querying, and re-verification against original sources.
SKILL.md 표시 중
SOC 직업 분류 기준
| name | frida |
| description | Dynamic instrumentation via Frida - attach to or spawn a process, load a JS hook script, capture send() events into a lifecycle-managed run directory. Supports local, USB-attached, and remote frida-server targets. |
Hook a target at runtime to confirm LLM-flagged sinks actually execute, trace API calls, bypass SSL pinning, scan memory for secrets.
/scan or /agentic flagged a sink and you want to confirm it fires at runtime before treating it as exploitable.rr-record (macOS) needs a function-call trace.pipx install frida-tools # host CLI + python bindings
raptor doctor # confirms frida is detected
For remote / mobile targets, install the matching frida-server on the target side. See docs/frida.md. Note: most frida-server binaries bind to 127.0.0.1 by default - start with -l 0.0.0.0:27042 or SSH-forward port 27042.
The slash command surfaces the libexec wrapper; run it as Bash. Lifecycle (output dir, run state) is handled by the wrapper.
libexec/raptor-frida --target <pid|name|bundle-id|binary>
(--template <name> | --script <path>)
[--host HOST[:PORT]] [--usb]
[--duration N] [--spawn] [--unsafe-attach]
Equivalent CLI without a Claude session: raptor frida ....
raptor frida --list-templates
| Name | Purpose |
|---|---|
api-trace | Hooks open/read/write/connect/fork/execve etc. Most useful default. |
ssl-unpin | Bypasses iOS/macOS Security.framework, OpenSSL SSL_get_verify_result, and Android X509TrustManager. |
Operator-supplied scripts via --script ./hook.js - same send(...) capture path.
# Trace API calls in a local PID for 30s
raptor frida --target 1234 --template api-trace --duration 30
# Spawn a binary and watch its first minute
raptor frida --target ./victim --template api-trace --duration 60
# Bypass SSL pinning on a USB-attached mobile target. Spawn by bundle id (frida resolves bundle ids for spawn); attach-by-name needs the running process's name, not the bundle id, so --spawn is the reliable form.
raptor frida --target com.example.app --template ssl-unpin --usb --spawn --duration 120
# Connect to remote frida-server
raptor frida --target target-proc --host 10.10.20.1 --template api-trace
# Operator-supplied hook
raptor frida --target Safari --script ./my-hook.js --duration 30
<run-dir>/
events.jsonl # one JSON object per send() from the script
metadata.json # target, host info, timings, errors
script.js # copy of the script that ran
frida-report.md # short human-readable summary
<run-dir> is resolved by libexec/raptor-run-lifecycle:
/project: out/projects/<name>/frida-<timestamp>/out/frida_<timestamp>/metadata.json first)| Error fragment | Likely cause |
|---|---|
ptrace denied | Linux kernel.yama.ptrace_scope ≥ 1. Lower it or spawn-and-attach. |
task_for_pid | macOS hardened-runtime target or system process - needs SIP-disabled or signed-with-get-task-allow. |
unable to connect to remote frida-server | Target not running, or bound to localhost only. SSH-forward 27042 or rebind. |
frida-python not installed | pipx install frida-tools. |
Frida-instrumented targets are untrusted - that's the whole point. The runner is wrapped in core.sandbox.run() with the frida profile (ptrace allowed, skip_pid_ns=True for /proc access, restrict_reads=True, fake_home=True):
--target ./binary): block_network=True — the target can't reach out.--target <pid|name>): network untouched — the process is already running with whatever connectivity it needs.--unsafe-attach: sandbox bypassed entirely (system processes, SIP targets). Logged in metadata.json.Frida output is automatically consumed by downstream pipelines when evidence exists in the run directory:
| Consumer | What it reads | What it produces |
|---|---|---|
/agentic reachability prepass | events.jsonl function names | metadata.frida_runtime_trace on inventory items; promotes FRIDA_RUNTIME_TRACE witness (SOUND) |
/validate Stage B | events.jsonl function names | runtime_evidence annotations on attack path steps; proximity floor at 6 |
/understand --map context bridge | events.jsonl file operations | ObserveProfile merged into context map (read/write/stat/connect paths) |
| Coverage store | coverage.drcov (bb-coverage template) | Function-level coverage marks via existing import_drcov pipeline |
No flags needed — consumers discover evidence via packages.frida.evidence.discover_evidence() and gate on packages.frida.available().
from packages.frida.active import auto_observe, observe_target, observe_paired
# Single binary spawn — runs under sandbox frida profile
run_dir = observe_target("/path/to/binary", template="api-trace", duration_sec=30)
# Network service — paired observation via netns coordinator
run_dir = observe_paired(["./server", "--port", "8080"],
template="api-trace", wait_port=8080)
# Pipeline hook — skips if fresh evidence already exists
run_dir = auto_observe("/path/to/binary", search_dirs=[out_dir])
Alpha. Three templates ship (api-trace, bb-coverage, ssl-unpin); richer set in progress (collab with @Splinters-io). Integration into /validate (automatic) and /crash-analysis on macOS is planned. The autonomous LLM-guided mode from the abandoned PR #57 is intentionally not in this slice.