Frida • A world-class dynamic instrumentation toolkit

Frida 17.9.1 Released

2026-03-27T11:36:54+01:00

Quick bug-fix release with the following improvement:

package-manager: Fix semver pre-release overflow, where numeric pre-release identifiers like "202508252028" would fail validation because parse_uint() rejects values beyond UINT32_MAX. The same overflow also affected version comparison, which used uint. Validation now follows the semver rule that numeric identifiers must not have leading zeros, and comparison now uses length-prefixed string comparison so arbitrarily large numeric identifiers are handled correctly.

Frida 17.9.0 Released

2026-03-26T20:44:02+01:00

This release brings a nice mix of quality-of-life improvements and new capabilities across our Fruity, Droidy, Linux, and packaging layers:

device: Add override_option() for overriding backend-specific options when creating a host session, with updates taking effect immediately on the next connection if a session is already established.
fruity: Add control-endpoint backend option. Default is tcp:27042. Only TCP endpoints are supported.
droidy: Add control-endpoint backend option. Default is tcp:27042, but may be set to any endpoint supported by ADB, such as localabstract:/my-frida-server.
android: Skip 32-bit helper on 64-bit only systems, avoiding wasted time trying to spawn it.
linux: Add an eBPF-based spawn gater implementation. Thanks @NSEcho!
linux: Support injection into group-stopped PIDs.
gum: Add a tool to package devkits as XCFrameworks. Thanks @sewerynplazuk!
python: Add a spawn gating example.
python: Fix the child gating example.

Enjoy!

Frida 17.8.3 Released

2026-03-24T15:41:16+01:00

This release brings another round of fixes and documentation improvements:

Fixes

fruity: Fix TcpTunnelConnection stalls caused by deferred CDTunnel TLS records larger than 8192 bytes. Send a minimal dummy IPv6 datagram when needed to trigger delivery of deferred data and improve reliability. Kudos to @hsorbo for reporting and helping track this down, and @tux-mind for identifying the root cause.
fruity: Fix jailed spawn() on iOS 26.4 betas. Thanks @mrmacete!
fruity: Fix TreeSet comparator behavior where transports with the same score may be treated as equal and dropped, causing Frida to prefer usbmuxd with lwIP over an already available CoreDevice tunnel on macOS. Kudos to @tux-mind for reporting and helping track this down.
fruity: Handle early tunnel loss, e.g. when remotepairingdeviced crashes.
android: Adjust the RTLD path if dlopen(libart) fails. Thanks @sam0holix!

Documentation

docs: Revise macOS certificate identifiers in the README to better support setups with multiple Apple Development certificates and avoid ambiguous certificate selection during make. Thanks @samykamkar!
docs: Update the README to include the websockets package in the installation instructions required by frida-trace. Thanks @samykamkar!

Frida 17.8.2 Released

2026-03-14T11:52:12+01:00

A tiny follow-up release with a couple of fixes and polish across Android and the Node.js bindings:

android: Detect setArgV0() in anonymous memory too.
bindings: Re-add .withTimeout and .combine to Cancellable, which were accidentally dropped when moving to autogenerated bindings. Thanks @hsorbo!

Frida 17.8.1 Released

2026-03-13T13:22:16+01:00

This release brings a bunch of fixes and compatibility improvements across Android, Linux, musl-based systems, and newer LLVM toolchains:

android: Only load in namespace if the ART namespace actually exists.
android: Handle Chrome’s zygote process so it stays invisible to spawn gating, while its children continue to be gated as expected.
android: Bump to Android NDK r29 and target API 21 on all architectures, as older API levels are no longer supported by the latest NDK.
linux: Improve process enumeration so uid is always present, user lookup is more robust, and indeterminate or undersized getpwuid_r() buffers are handled correctly.
linux: Avoid an rtld notifier deadlock on musl.
linux: Handle missing /proc in the debugger check.
compiler: Add a musl-compatible backend mode that runs the Go compiler backend out-of-process as a persistent helper, avoiding TLS-related limitations when frida-core is loaded after startup or through dlopen().
libc-shim: Plug more stdio API holes, including setbuf(), setlinebuf(), setbuffer(), __srget(), and fix the setbuffer() signature on glibc + musl.
meson: Fix linking on modern LLVM/LLD toolchains by using FreeBSD-specific version scripts where needed.

Enjoy!

Frida 17.8.0 Released

2026-03-09T11:45:38+01:00

This release brings some big improvements across the board.

Syscall Tracer

Sometimes it’s useful to observe the system calls happening inside a given target process. Especially if the target includes some kind of Frida detection, root detection, or any other kind of Runtime Application Self-Protection (RASP). In such cases, spotting syscalls that check for artifacts means you can quickly determine what kind of instrumentation/patches you need to apply to beat those checks.

That’s why, as of Frida 17.8.0, and frida-tools 14.6.1, you can now do:

$ frida-strace -U -f com.dexprotector.detector.envchecks

Or, with an attached iPhone running the latest iOS (jailbreak not needed):

$ frida-strace -U -f com.toyopagroup.picaboo

You may also repeat -f any number of times to spawn multiple programs/apps, or combine that with -p $pid and -u $username switches. Targeting by user is not supported for iOS, though. That is a feature particularly useful on Android, where each app has its own user account: in this way you can observe syscalls across all processes owned by a specific app.

EOF

This release also includes a slew of other goodies. Be sure to check out the changelog below for the full details.

Enjoy!

Changelog

fruity: Implement syscall tracing on top of CoreProfile ktrace/kdebug, with syscall decoding, path reconstruction for filesystem-related calls, stitched-in callstacks, and symbolication support.
Support spawning non-debuggable apps by falling back to ProcessControlService and suspending them with signals when LLDB-based launching is not an option.
dtx: Add CoreProfileService, extend ProcessControlService, upgrade protocol handling, lift buffering restrictions, and improve handling of nil arguments and bulk data.
linux: Make the Linux syscall-tracer eBPF backend more verifier-friendly, bump the BPF log buffer size, and align the Linux syscall-trace protocol with the latest cross-platform format.
android: Load the ART/Dalvik VM and run frida-helper.dex in-process. This eliminates a whole host of edge-cases, including ROM compatibility cases.
android-helper: Fix initialization crash on some Transsion-based ROMs by using Looper.prepareMainLooper(). Thanks @depreciating!
android: Fix linker detection and export resolution on newer Android versions.
libc-shim: Improve stdio coverage, add versioned fopen/fopen64 support for libstdc++, and avoid teardown-time undefined behavior by skipping deinit unless explicitly requested.
elf-module: Improve symbol enumeration by falling back to .dynsym when needed, and tighten symbol name bounds checks. Thanks @danielbaier!
gumjs: Add column metadata to the SQLite API. Thanks @codecolorist!
objc-api-resolver: Realize collected classes before copying methods to avoid crashes and undefined behavior. Thanks @mrmacete!
websocket/network-stack: Improve fairness under load by pausing libsoup input to avoid starvation and handling incoming datagrams asynchronously. Thanks @mrmacete and @hsorbo!
atomics: Fix -Watomic-alignment warnings on ABIs where guint64 is not naturally 8-byte aligned.
gum: Add Gum.Android vapi bindings.

Also, kudos to @hsorbo for the fun pair-programming on the Fruity bits!

Frida 17.7.3 Released

2026-02-16T22:45:51+01:00

Quick follow-up release with a handful of Linux syscall-tracer improvements and fixes:

syscall-tracer: Decode timespec values. Recognize timespec pointer arguments and decode them into structured values instead of opaque byte arrays. Supports both __kernel_timespec and old_timespec32 layouts.
syscall-tracer: Fix raw attachment lifetime. The GVariant was previously created from data freed before return, leaving it with a dangling pointer.
syscall-tracer: Fix multi-attachment parsing by encoding how much space is reserved for each attachment.

Frida 17.7.2 Released

2026-02-14T10:52:20+01:00

Quick follow-up release with a handful of fixes and cleanups in our Variant and XPC service layers:

python: Add support for casting to uint64 Variant.
node: Stop accepting redundant uint64 Variant casts. Use BigInt when creating uint64 GVariant values.
node: Plug a leak in the Variant cast logic’s error handling.
xpc-service: Drop support for redundant casts.

Frida 17.7.1 Released

2026-02-13T22:48:44+01:00

Quick bug-fix release, because software is hard and apparently also enjoys same-day encores:

android: Defer spawn completion until setArgV0(), by only recording the package name in selinux_android_setcontext() and delaying contact with RoboLauncher until setArgV0(). This ensures ART is ready so frida-java-bridge can attach to the VM.
android: Refactor Zymbiote code and improve naming.

Frida 17.7.0 Released

2026-02-13T15:12:42+01:00

This release brings some substantial new Linux capabilities, improved service plumbing, and a handful of platform-specific fixes across Darwin, Android, and the API surface.

Highlights include:

linux: Add a new eBPF-powered SyscallTracer service, plus the groundwork for future activity sampling.
droidy: Add support for consuming remote services and implementing services locally.
darwin: Accept __dyld_apis dyld section on macOS 26.
android: Fix spawn package name logic on newer OSes.
icons: Use uint16 for icon dimensions, and omit width/height for PNG icons on macOS, for consistency with other platforms.
node: Expand GVariant marshaling support, use BigInt for 64-bit integers, and fix a Service.request() lifetime issue that could cause refcount underflow and memory corruption.

Thanks to @veecore for the macOS 26 compatibility fix, and to @hsorbo for co-authoring some of the Linux syscall and BPF map work.