{"id":17045280,"url":"https://github.com/frenchyeti/interruptor","last_synced_at":"2025-04-05T03:10:49.873Z","repository":{"id":38840765,"uuid":"443181261","full_name":"FrenchYeti/interruptor","owner":"FrenchYeti","description":"Human-friendly cross-platform system call tracing and hooking library based on Frida's Stalker","archived":false,"fork":false,"pushed_at":"2023-07-21T14:48:57.000Z","size":1103,"stargazers_count":341,"open_issues_count":10,"forks_count":45,"subscribers_count":15,"default_branch":"main","last_synced_at":"2025-03-29T02:07:05.517Z","etag":null,"topics":["arm64","frida","hooking","instrumentation","strace","syscall-tracing","syscalls","system-call-tracing","tracing"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/FrenchYeti.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2021-12-30T20:45:42.000Z","updated_at":"2025-03-26T08:11:56.000Z","dependencies_parsed_at":"2024-02-21T10:58:51.935Z","dependency_job_id":null,"html_url":"https://github.com/FrenchYeti/interruptor","commit_stats":{"total_commits":183,"total_committers":4,"mean_commits":45.75,"dds":"0.032786885245901676","last_synced_commit":"25f7f59ac548cd6fe5945cac9ca479d1d3dd37da"},"previous_names":[],"tags_count":9,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FrenchYeti%2Finterruptor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FrenchYeti%2Finterruptor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FrenchYeti%2Finterruptor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FrenchYeti%2Finterruptor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/FrenchYeti","download_url":"https://codeload.github.com/FrenchYeti/interruptor/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247280272,"owners_count":20912967,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["arm64","frida","hooking","instrumentation","strace","syscall-tracing","syscalls","system-call-tracing","tracing"],"created_at":"2024-10-14T09:36:59.669Z","updated_at":"2025-04-05T03:10:49.852Z","avatar_url":"https://github.com/FrenchYeti.png","language":"TypeScript","readme":"# Interruptor\n\n![ci](https://github.com/FrenchYeti/interruptor/workflows/CI/badge.svg)\n\n*Work In Progess*\n\nThe home for Interruptor, a human-friendly interrupts hook library based on Frida's Stalker\n\nInterruptor is the interrupts/systemcall hooking system from Dexcalibur.\n\n\nQuick start for Android app (could not work as is with obfuscated app) :\n```\nfrida --codeshare FrenchYeti/android-arm64-strace -U -f YOUR_BINARY\n```\n\nIf you like it, please consider to buy  :moneybag: [Dexcalibur Pro](https://www.reversense.com/dexcalibur) or :sparkling_heart: [sponsor me](https://github.com/sponsors/frenchyeti). Sponsor encourage me to free parts of Dexcalibur Pro and spend more free time on such projects :)\n\nThe purpose of this library is to provide to Frida users, a rich API able to produce **strace-like** trace + hook + configurable syscall args API.\n\nIt provides by default some useful features such as :\n* File Descriptor lookup (to retrieve path)\n* Bitmap parsing to have humean-friendly output\n* Syscall hook using Frida's Interceptor style\n* Better api to trace/change syscall args before/after\n* Filterable modules and syscalls\n* Coverage generation\n\n### Full documentation of the API is [now available](https://frenchyeti.github.io/interruptor-codedoc/index.html)\n\n## 1. How to use it\n\nInterruptor can be used by following different approach. I Hope you will be able to find the best one for you :\n\n- A. Interruptor as NPM package in your hooking project\n- B. Importing minified file per architecture/os \n- C. Using Frida's CodeShare (not yet configurable, less suitable for tampering)\n- C. From source\n\n### Case A : Using Interruptor package\n\n[See it on NPM](https://www.npmjs.com/package/@reversense/interruptor)\n\n**It is the BEST and more reliable way to use Interruptor** \n\nThis method require Frida \u003e= 16.x is you write your hook in Typescript.\n\nBasically, create a new folder for your hooks or move into your workspace :\n```\nmkdir my_workspace \u0026\u0026 cd my_workspace\n```\n\nAnd install the package :\n````\nnpm install @reversense/interruptor\n````\n\nAfter successful install, you can create a basic script (`script.ts`) like it (TypeScript) :\n```\nimport target from '@reversense/interruptor/index.linux.arm64.js';\n\nconst Interruptor = target.LinuxArm64({});\n\nInterruptor.newAgentTracer({\n    followThread: true,\n    scope: {\n        syscalls: {\n            exclude:  [/clock_gettime/]\n        },\n        modules: {\n            exclude: [/linker/]\n        }\n    },\n    onStart: function(){\n        console.log(\"Entering into lib\")\n    }\n}).start();\n```\n\nThen, just launch your frida script like this :\n```\nfrida -U -l ./script.ts -f \u003cYOUR_APP\u003e\n```\n\nMay be you noted TS script is passed directly to `frida` instead of `frida-compile`, such thing is possible with Frida \u003e= 16.x .\n\n### Case B : From minified files\n\n**Requirements :**\n\n* frida\n\nDownload [latest release](https://github.com/FrenchYeti/interruptor/releases) for your architecture into your working directory, \nand do:\n\n```\nimport target from './index.linux.arm64.min.js';\nimport {DebugUtils} from \"./src/common/DebugUtils.js\";\n\nconst Interruptor = target.LinuxArm64({});\n\nInterruptor.newAgentTracer({\n    followThread: true,\n    scope: {\n        syscalls: {\n            exclude:  [/clock_gettime/]\n        },\n        modules: {\n            exclude: [/linker/]\n        }\n    }\n}).start();\n```\n\nTime to deploy hooks can be configured to be when a particular library is loaded. See options below.\n\n\n### Case C : Using Frida's Codeshare (not yet configurable)\n\n**Warning : this methods don't allow you to configure Interruptor. So, tracing of obfuscated or multi-threaded application could fail.**\n\nThis method is only provided for linux/arm64 and training purpose.\n```\nfrida --codeshare FrenchYeti/android-arm64-strace -f YOUR_BINARY\n```\n\n### Case D : From source\n\n**Requirements :**\n\n* frida\n\nDon't be afraid by dependencies : Interruptor has only common dev dependencies to provide types and unit test features. \n\nDownload or clone the repository, and install it\n```\ngit clone https://github.com/FrenchYeti/interruptor\ncd interruptor\nnpm install\nnpm run build\n```\n\nWhen it is done, just copy one of examples into repository root folder :\n```\ncp ./examples/android/simple_trace.ts .\n```\n\n\nAnd finally :\n```\nfrida -U -l ./simple_strace.arm64.ts -f \u003cPACKAGE\u003e \n```\n\n\n\n## 2. Examples\n\n### 2.A Simple tracing \n\n#### With recent version (\u003e 0.2)\nSimple tracing without hook from attach moment, with excluded module and syscall (by name)\n```\nimport target from '@reversense/interruptor/index.linux.arm64.js';\n\nconst Interruptor = target.LinuxArm64({});\n\n// better results, when app is loaded\nJava.perform(()=\u003e{\n    Interruptor.newAgentTracer({\n        scope: {\n            syscalls: { exclude:  [\"clock_gettime\"] },\n            modules: { exclude: [/linker64/] }\n        }\n    }).start();\n});\n```\n\n#### With version \u003c= 0.2\nSimple tracing without hook from attach moment, with excluded module and syscall (by name)\n```\nvar Interruptor = require('./android-arm64-strace.min.js').target.LinuxArm64();\n\n// better results, when app is loaded\nJava.perform(()=\u003e{\n    Interruptor.newAgentTracer({\n        exclude: {\n            modules: [\"linker64\"],\n            syscalls: [\"clock_gettime\"]\n        }\n    }).start();\n});\n```\n\n#### Output :\n\nOutput :\n```\n\t------- [TID=4407][libutils.so][0x76d9fd6388] Thread routine start -------\n\t[INTERRUPTOR][STARTING] Tracing thread 4407 []\n\t[STARTING TRACE] UID=1 Thread 4407\n [TID=4407] [/system/lib64/libc.so +0x630]   setpriority (   which = NULL ,  who = 0x0 ,  ioprio = 0x0  )    \u003e 0x0\n [TID=4407] [/system/lib64/libc.so +0x928]   openat (   dfd = AT_FDCWD  ,  filename = /proc/4407/timerslack_ns ,  flags = O_RDONLY | O_WRONLY | O_CLOEXEC ,  mode =   )    \u003e (FD) 0x1f\n [TID=4407] [/system/lib64/libc.so +0x990]   write (   fd = 31  /proc/4407/timerslack_ns   ,  buf = 50000 ,  size = 0x5  )    \u003e 0x5\n [TID=4407] [/system/lib64/libc.so +0x6d0]   close (   fd = 31  /proc/4407/timerslack_ns    )    \u003e 0x0\n [TID=4407] [/system/lib64/libc.so +0x270]   prctl (   opt = PR_SET_NAME ,  arg2 = 0x7651d1d560 ,  arg3 = 0x0 ,  arg4 = 0x0 ,  arg5 = 0x0  )    \u003e 0x0\n [TID=4407] [/system/lib64/libc.so +0x1b0]   mprotect (   addr = 0x7641dae000 ,  size = 0x1000 ,  prot = PROT_NONE  )    \u003e 0 SUCCESS\n [TID=4407] [/system/lib64/libc.so +0xf0]   madvise (   addr = 0x7641dae000 ,  size = 0xfb000 ,  behavior = MADV_DONTNEED  )    \u003e 0 SUCCESS\n [TID=4407] [/system/lib64/libc.so +0x928]   openat (   dfd = AT_FDCWD  ,  filename = /dev/ashmem ,  flags = O_RDONLY | O_RDWR | O_CLOEXEC ,  mode =   )    \u003e (FD) 0x1f\n [TID=4407] [/system/lib64/libc.so +0xd90]   fstat (   fd = 31  /dev/ashmem   ,  *statbuf = 0x7641ea9e68  )    \u003e 0x0\n [TID=4407] [/system/lib64/libc.so +0x910]   ioctl (   fd = 31  /dev/ashmem   ,  cmd = 0x41007701 ,  arg = 0x7641ea9f38  )    \u003e 0x0\n [TID=4407] [/system/lib64/libc.so +0x910]   ioctl (   fd = 31  /dev/ashmem   ,  cmd = 0x40087703 ,  arg = 0x2000  )    \u003e 0x0\n [TID=4407] [/system/lib64/libc.so +0x180]   mmap (   start_addr = 0x0 ,  size = 0x2000 ,  prot = PROT_READ | PROT_WRITE ,  flags = MAP_PRIVATE ,  fd = undefined ,  offset = 0x0  )    \u003e 0x76599ee000 SUCCESS\n [TID=4407] [/system/lib64/libc.so +0x6d0]   close (   fd = 31  /dev/ashmem    )    \u003e 0x0\n [TID=4407] [/system/lib64/libc.so +0x1b0]   mprotect (   addr = 0x12f80000 ,  size = 0x40000 ,  prot = PROT_READ | PROT_WRITE  )    \u003e 0 SUCCESS\n [TID=4407] [/system/lib64/libc.so +0x8e0]   getpriority (   which = NULL ,  who = 0x0  )    \u003e 0x14\n [TID=4407] [/system/lib64/libc.so +0x270]   prctl (   opt = PR_SET_NAME ,  arg2 = 0x7641eaa148 ,  arg3 = 0x343a7265646e6942 ,  arg4 = 0x315f363833 ,  arg5 = 0x28  )    \u003e 0x0\n [TID=4407] [/system/lib64/libc.so +0xf70]   getuid (  )    \u003e 10089\n [TID=4407] [/system/lib64/libc.so +0x910]   ioctl (   fd = 12  undefined   ,  cmd = 0xc0306201 ,  arg = 0x7641eaa2b8  )    \u003e 0x0\n [TID=4407] [/system/lib64/libc.so +0x180]   mmap (   start_addr = 0x0 ,  size = 0xfe000 ,  prot = PROT_READ | PROT_WRITE ,  flags = MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE ,  fd = undefined ,  offset = 0x0  )    \u003e 0x7641263000 SUCCESS\n [TID=4407] [/system/lib64/libc.so +0x1b0]   mprotect (   addr = 0x7641263000 ,  size = 0x1000 ,  prot = PROT_NONE  )    \u003e 0 SUCCESS\n [TID=4407] [/system/lib64/libc.so +0x270]   prctl (   opt = PR_SET_VMA ,  arg2 = 0x0 ,  arg3 = 0x7641263000 ,  arg4 = 0x1000 ,  arg5 = 0x76de1b64c5  )    \u003e 0x0\n [TID=4407] [/system/lib64/libc.so +0x180]   mmap (   start_addr = 0x0 ,  size = 0x5000 ,  prot = PROT_NONE ,  flags = MAP_PRIVATE | MAP_ANONYMOUS ,  fd = undefined ,  offset = 0x0  )    \u003e 0x76599e9000 SUCCESS\n [TID=4407] [/system/lib64/libc.so +0x270]   prctl (   opt = PR_SET_VMA ,  arg2 = 0x0 ,  arg3 = 0x76599e9000 ,  arg4 = 0x5000 ,  arg5 = 0x76de1b62f9  )    \u003e 0x0\n [TID=4407] [/system/lib64/libc.so +0x1b0]   mprotect (   addr = 0x76599ea000 ,  size = 0x3000 ,  prot = PROT_READ | PROT_WRITE  )    \u003e 0 SUCCESS\n [TID=4407] [/system/lib64/libc.so +0x270]   prctl (   opt = PR_SET_VMA ,  arg2 = 0x0 ,  arg3 = 0x76599ea000 ,  arg4 = 0x3000 ,  arg5 = 0x76de1b633b  )    \u003e 0x0\n [TID=4407] [/system/lib64/libc.so +0x1ca8]   clone (   unsigned long = 0x3d0f00 ,  unsigned long = 0x76413604e0 ,  int * = 0x7641360500 ,  int * = 0x7641360588 ,  unsigned long = 0x7641360500  )    \u003e 0x1139\n [TID=4407] [/system/lib64/libc.so +0x2c]   futex (   word = 0x7641360570 ,  op = FUTEX_WAKE_PRIVATE ,  u32 val = 0x1 ,  *utime = 0x0 ,  u32 *uaddr2 = 0x0 ,  u32 val3[ = 0x0  )    \u003e 0x1\n [TID=4407] [/system/lib64/libc.so +0x2c]   futex (   word = 0x7659b1c248 ,  op = FUTEX_WAKE_PRIVATE ,  u32 val = 0x7fffffff ,  *utime = 0x0 ,  u32 *uaddr2 = 0x0 ,  u32 val3[ = 0x0  )    \u003e 0x0\n\n\t------- [TID=4409][libutils.so][0x76d9fd6388] Thread routine start -------\n\t[INTERRUPTOR][STARTING] Tracing thread 4409 []\n\t[STARTING TRACE] UID=2 Thread 4409\n [TID=4409] [/system/lib64/libc.so +0x630]   setpriority (   which = NULL ,  who = 0x0 ,  ioprio = 0x0  )    \u003e 0x0\n [TID=4409] [/system/lib64/libc.so +0x928]   openat (   dfd = AT_FDCWD  ,  filename = /proc/4409/timerslack_ns ,  flags = O_RDONLY | O_WRONLY | O_CLOEXEC ,  mode =   )    \u003e (FD) 0x1f\n [TID=4409] [/system/lib64/libc.so +0x990]   write (   fd = 31  /proc/4409/timerslack_ns   ,  buf = 50000 ,  size = 0x5  )    \u003e 0x5\n [TID=4409] [/system/lib64/libc.so +0x6d0]   close (   fd = 31  /proc/4409/timerslack_ns    )    \u003e 0x0\n [TID=4409] [/system/lib64/libc.so +0x270]   prctl (   opt = PR_SET_NAME ,  arg2 = 0x765364f010 ,  arg3 = 0x0 ,  arg4 = 0x0 ,  arg5 = 0x0  )    \u003e 0x0\n [TID=4409] [/system/lib64/libc.so +0x1b0]   mprotect (   addr = 0x7641264000 ,  size = 0x1000 ,  prot = PROT_NONE  )    \u003e 0 SUCCESS\n [TID=4409] [/system/lib64/libc.so +0xf0]   madvise (   addr = 0x7641264000 ,  size = 0xfb000 ,  behavior = MADV_DONTNEED  )    \u003e 0 SUCCESS\n [TID=4409] [/system/lib64/libc.so +0x928]   openat (   dfd = AT_FDCWD  ,  filename = /dev/ashmem ,  flags = O_RDONLY | O_RDWR | O_CLOEXEC ,  mode =   )    \u003e (FD) 0x1f\n [TID=4409] [/system/lib64/libc.so +0xd90]   fstat (   fd = 31  /dev/ashmem   ,  *statbuf = 0x764135fe68  )    \u003e 0x0\n [TID=4409] [/system/lib64/libc.so +0x910]   ioctl (   fd = 31  /dev/ashmem   ,  cmd = 0x41007701 ,  arg = 0x764135ff38  )    \u003e 0x0\n [TID=4409] [/system/lib64/libc.so +0x910]   ioctl (   fd = 31  /dev/ashmem   ,  cmd = 0x40087703 ,  arg = 0x2000  )    \u003e 0x0\n [TID=4409] [/system/lib64/libc.so +0x180]   mmap (   start_addr = 0x0 ,  size = 0x2000 ,  prot = PROT_READ | PROT_WRITE ,  flags = MAP_PRIVATE ,  fd = undefined ,  offset = 0x0  )    \u003e 0x7656380000 SUCCESS\n [TID=4409] [/system/lib64/libc.so +0x6d0]   close (   fd = 31  /dev/ashmem    )    \u003e 0x0\n [TID=4409] [/system/lib64/libc.so +0x1b0]   mprotect (   addr = 0x12fc0000 ,  size = 0x40000 ,  prot = PROT_READ | PROT_WRITE  )    \u003e 0 SUCCESS\n```\n\nMore complete example are provided into examples directory.\n\n### 2.B Simple tracing with hooked \"read\" syscall and dynamic loading\n\n```\nInterruptor.newAgentTracer({\n    scope: {\n        syscalls: { exclude:  [\"clock_gettime\"] }\n    },\n    svc: {\n         read: {\n             onLeave: function(ctx){\n                 let res = Memory.scanSync(ctx.x1, ctx.x2.toInt32(), Interruptor.utils().toScanPattern('frida'));\n                 if(res.length \u003e 0){\n                     res.map( m =\u003e m.address.writeByteArray([0x41,0x41,0x41,0x41,0x41]));\n                     console.log(\"remove 'frida' pattern from resulting buffer\");\n                 }\n             }\n         }\n    }\n}).startOnLoad(/\u003cYOUR_LIB\u003e/g); \n\n```\n\n\n### 2.C Simple tracing with coverage\n\n```\nInterruptor.newAgentTracer({\n    scope: {\n        syscalls: { exclude:  [\"clock_gettime\"] }\n    },\n    coverage: {\n        enabled: true,\n        fname: \"/data/data/\u003cYOUR_APP\u003e/test.drcov\",\n        stops: {\n            count: 2000 // stop after 2000 basic blocks captured\n        }\n    }\n}).startOnLoad(/\u003cYOUR_LIB\u003e/g);\n```\n\n## 3. Supports\n\n**Architectures**\n* Aarch64 : SVC (syscall), HVC (WiP, hypervisor)\n* x64 : SYSCALL\n\n**APIs**\n* Linux kernel API (syscall)\n\n## 4. Roadmap\n\n\n**How to help ?**\n\nThe following links enumerates Linux syscall for several architectures, feel free to extend Interruptor and do a PR :) \n\nhttps://marcin.juszkiewicz.com.pl/download/tables/syscalls.html\n\n\n## 5. Documentation\n\n### 5.A Create a new agent\n\nFirst, you need to get the tracer factory adapted to your OS/Architecture :\nFor now only \"LinuxArm64()\" is available.\n```\nvar Interruptor = require('../dist/index.js').target.LinuxArm64();\n```\n\nNext step is to intanciante a tracer with a specific options. \nOptions are not mandatory but can change a lot the behavior and output.\n```\nInterruptor.newAgentTracer( /* opts */);\n```\n\nA full list of options can be found into the next section.\n\nFinal step, choose when you want to start to trace :\n* A. When frida script is executed\n```\nvar Interruptor = require('../dist/index.js').target.LinuxArm64();\n\nInterruptor.newAgentTracer( /* opts */).start();\n```\n\n* B. The first time a module is opened by the linker\n```\nvar Interruptor = require('../dist/index.js').target.LinuxArm64();\n\nInterruptor.newAgentTracer( /* opts */).startOnLoad(/my_lib\\.so$/g);\n```\n\n* C. From your hooks\n```\nvar Interruptor = require('../dist/index.js').target.LinuxArm64();\n\nInterceptor.attach( /* ... */,{\n    onEnter: function(){\n        Interruptor.newAgentTracer( /* opts */).start();\n    }\n})\n```\n\n### 5.B Options\n\nAll options are optional, except some explicited options\nBelow, a complete overview of options  :\n```\n{\n    followFork: TRUE | FALSE ] // TODO\n    followThread: TRUE | FALSE ] // TODO\n    tid: \u003cThread ID\u003e,\n    pid: \u003cPID\u003e,\n    onStart: \u003ccallback function\u003e,\n    exclude: {\n        syscalls: [ ... syscall names ... ], // \"read\", ...\n        modules: [ ... module names ... ], // \"linker64\" ...\n        svc: [ ... SVC number ...], // 0x1e, ...\n        hvc: [ ... HVC number ...]\n    },\n    // coverage options\n    coverage: {\n        enabled = true,\n        flavor = \"dr\", // not supported\n        fname = \"/data/data/my_app/drcov.dat\", // MANDATORY\n        stops = 2000 // MANDATORY\n    },\n    // output options (partially implemented)\n    output: {\n        flavor: \"dxc\", // \"strace\" is coming\n        tid: true,\n        pid: false,\n        module: true,\n        dump_buff: true, // dump buffer when ptr+size are known \n        highlight: {\n            syscalls: []\n        }\n    },\n    // hooks\n    svc: {\n        [syscall_text_name]: {\n            onEnter: function(pContext){\n            \n            },\n            onLeave: function(pContext){\n            \n            }\n        }\n    }\n}\n```\n#### 5.B.1 Filtering\n\n**! Important !** \n\nWhen a system is excluded, it is not hooked and printed. By consequence, some feature can not work properly such as file descriptor lookup when \"openat\" is excluded.\n\n\nAll interruption types can be filtered using at least the interruption number. Additionnally, Modules and System calls can be filtered by name (string pattern or regexp)  or by properties (using a filtering function).\n\n```\nInterruptor.newAgentTracer({\n    followThread: false,\n    include: {\n        modules: [\"libc.so\"],\n        syscalls: [/^get/,\"read\",\"openat\",\"close\",/^m/]\n    },\n    exclude: {\n        syscalls: [ /time$/]\n    },\n    output: {\n        tid: true,\n        inst: true,\n        module: true\n    }\n}).start();\n```\n\n\nModules and System calls are filtering by following one of these tree ways : Hook/trace only instructions\n* from a list of  mapped modules\n* from modules not included into \"exclude list\" of mapped modules\n* from included modules - excluded modules\n\n```\ninclude: {\n    syscalls: [\n        \"read\",\n        \"openat\",\n        \"close\",\n        /^m/,       // mprotect, madvise, mmap, ...\n        /^get/     // getpriority, getuid, getpid,  ...\n    ]\n},\n```\n\n### 5.C Tracer types\n\nThere are mainly two way to hook interrupts depending of yours needs.\n\n**Agent Tracer**\n\nWhen you want to use only a Frida agent script (and not host script).\n\n*Limitation:*\n\nCannot follow children/multiples processes.\n\n**Standalone Tracer [TODO]**\n\nWhen you need to follow children processes, or external processes.\nIt works even if there is not link between traces processes.\n\nIn this case, the final script runs on the host and act like strace tool into the host or the device.\n\n\n\n\n\n","funding_links":["https://github.com/sponsors/frenchyeti"],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffrenchyeti%2Finterruptor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffrenchyeti%2Finterruptor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffrenchyeti%2Finterruptor/lists"}