{"id":50492840,"url":"https://github.com/juliangrtz/frida-ios-syscall-tracer","last_synced_at":"2026-06-02T04:30:51.328Z","repository":{"id":210787644,"uuid":"723700095","full_name":"juliangrtz/frida-iOS-syscall-tracer","owner":"juliangrtz","description":"Traces syscalls on iOS via Frida, including Mach syscalls.","archived":false,"fork":false,"pushed_at":"2025-10-15T11:11:56.000Z","size":116,"stargazers_count":80,"open_issues_count":0,"forks_count":22,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-10-16T03:53:06.113Z","etag":null,"topics":["frida","frida-stalker","ios","ios-security","strace","syscall","tracer"],"latest_commit_sha":null,"homepage":"https://www.theiphonewiki.com/wiki/Kernel_Syscalls","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/juliangrtz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-11-26T14:00:55.000Z","updated_at":"2025-10-15T11:12:00.000Z","dependencies_parsed_at":null,"dependency_job_id":"93bc7527-865d-468d-bba5-38b62989dacb","html_url":"https://github.com/juliangrtz/frida-iOS-syscall-tracer","commit_stats":{"total_commits":20,"total_committers":2,"mean_commits":10.0,"dds":"0.44999999999999996","last_synced_commit":"408af01a2a869113e833875f48d11d1c69b352ee"},"previous_names":["juliangrtz/frida-ios-syscall-tracer"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/juliangrtz/frida-iOS-syscall-tracer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/juliangrtz%2Ffrida-iOS-syscall-tracer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/juliangrtz%2Ffrida-iOS-syscall-tracer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/juliangrtz%2Ffrida-iOS-syscall-tracer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/juliangrtz%2Ffrida-iOS-syscall-tracer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/juliangrtz","download_url":"https://codeload.github.com/juliangrtz/frida-iOS-syscall-tracer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/juliangrtz%2Ffrida-iOS-syscall-tracer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33806987,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-02T02:00:07.132Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["frida","frida-stalker","ios","ios-security","strace","syscall","tracer"],"created_at":"2026-06-02T04:30:49.706Z","updated_at":"2026-06-02T04:30:51.320Z","avatar_url":"https://github.com/juliangrtz.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# frida-iOS-syscall-tracer\n\n![image](https://github.com/user-attachments/assets/734d0abb-6125-48da-86b2-9bf308d33640)\n\nAn `strace`-like syscall tracer for 64-bit iOS devices based on [Frida's Stalker API](https://frida.re/docs/stalker/).\nThe purpose of this tool is to allow you to backtrace certain anti-(jailbreak|debugging|tampering|reverse engineering) techniques that rely on syscalls, i.e. `SVC` instructions.\nCommon file system-based syscalls that are used for anti-jailbreak techniques in many banking apps, for example, are `stat` and `open`. These scan the file system for file names such as _Cydia_, _Sileo_, _/etc/apt/sources.list_ etc.\n\nFrida 17.8.0 introduced the CLI tool `frida-strace` which is similar to this tracer.\n\n## Features\n\n- traces syscalls (`SVC`s) on instruction level\n- logs detailed information, including\n  - address\n  - syscall number\n  - syscall name\n  - (wip: return value)\n  - (optional: backtrace)\n  - (optional: bytes of `SVC` instruction)\n  - etc.\n- callbacks for syscalls to defeat anti-RE measures\n- configurable\n\n## Requirements\n\n- npm\n- jailbroken iOS device\n- frida and frida-tools on the remote device\n- frida-server on the iOS device\n\n## Installation\n\n```bash\ngit clone https://github.com/juliangrtz/frida-iOS-syscall-tracer\ncd frida-iOS-syscall-tracer\nnpm install\n```\n\n## Configuration\n\nDepending on your target application and goals you might want to change the tracer's behaviour. Its configuration can be found in `agent/config.ts`:\n\n```ts\nexport let Config = {\n    // Use FUZZY with caution.\n    syscallLogBacktracerType: Backtracer.ACCURATE,\n    exceptionBacktracerType: Backtracer.FUZZY,\n\n    // Whether to log negative Mach syscalls. Might spam the console.\n    logMachSyscalls: false,\n\n    // Whether to log SVC instructions and their corresponding byte representations. Might spam the console.\n    logSvcInstructions: false,\n\n    // Whether to backtrace the origin of each syscall. Might spam the console.\n    backtrace: false,\n\n    // Syscall exclusions.\n    excludes: [\n        // e.g. \"ulock_wait\", \"ulock_wake\"\n    ] as string[],\n\n    // Logs more information.\n    verbose: true,\n}\n```\n\n## Usage example\n\n```bash\n# Be sure the jailbroken iOS device is connected via USB and everything is set up correctly.\nfrida -Uf com.apple.stocks -l _tracer.js \n```\n\n## Output example\n\nThe tracer outputs syscalls in the following format:\n\n```plain\n{Address in memory} ({Module name}!{Module address}) [{Thread ID}] {Syscall name}({Arguments})\n```\n\n```text\n$ frida -Uf com.heavily.protected.app -l _tracer.js\n     ____\n    / _  |   Frida 17.3.2 - A world-class dynamic instrumentation toolkit\n   | (_| |\n    \u003e _  |   Commands:\n   /_/ |_|       help      -\u003e Displays the help system\n   . . . .       object?   -\u003e Display information about 'object'\n   . . . .       exit/quit -\u003e Exit\n   . . . .\n   . . . .   More info at https://frida.re/docs/home/\n   . . . .\n   . . . .   Connected to Apple iPad\n[+] Following thread 9991\n[+] Following thread 6403\n0x1ba779aec (libsystem_kernel.dylib!0x1aec) [6403] psynch_mutexwait(mutex=ptr(0x1f35b13e0), mgen=514, ugen=NULL, tid=undefined, flags=8352)}\n0x1ba77a084 (libsystem_kernel.dylib!0x2084) [9991] psynch_mutexdrop(mutex=ptr(0x1f35b13e0), mgen=512, ugen=256, tid=NULL, flags=12448)}\n0x1ba779480 (libsystem_kernel.dylib!0x1480) [6403] psynch_cvwait(cv=ptr(0x1f35b13b0), cvlsgen=undefined, cvugen=NULL, mutex=ptr(0x1f35b13e0), mugen=undefined, flags=4256, sec=NULL, nsec=NULL)}\n0x1ba77ad30 (libsystem_kernel.dylib!0x2d30) [9991] psynch_cvbroad(cv=ptr(0x1f35b13b0), cvlsgen=undefined, cvudgen=undefined, flags=NULL, mutex=NULL, mugen=NULL, tid=NULL)}\n0x1ba778fcc (libsystem_kernel.dylib!0xfcc) [9991] __semwait_signal(cond_sem=5123, mutex_sem=NULL, timeout=1, relative=1, tv_sec=NULL, tv_nsec=NULL)}\nDetected ptrace(PT_DENY_ATTACH) -- neutralizing before syscall!\n0x109739ca4 (rasp!0x29ca4) [9991] ptrace(req=-1, pid=NULL, addr=NULL, data=NULL)}\n0x109739cb4 (rasp!0x29cb4) [9991] stat64(path=\"/usr/sbin/frida-server\", buf=ptr(0x16f652ee0))}\n0x109739cf8 (rasp!0x29cf8) [9991] getppid()}\n0x1ba77d004 (libsystem_kernel.dylib!0x5004) [9991] bsdthread_create(func=ptr(0x109739e60), func_arg=ptr(0x2802bc6c0), stack=ptr(0x16fbcb000), pthread=ptr(0x16fbcb000), flags=150997247)}\n...\n```\n\n## Troubleshooting\n\nThe script was tested on several iOS versions (13, 14 and 15) but is not guaranteed to work on all iOS versions, especially newer ones.\n\nThere is a known issue where Frida is unable to spawn a process: `Failed to spawn: unable to launch iOS app via FBS: The operation couldn’t be completed.`\n\nIf that occurs try to downgrade frida, frida-tools and frida-server.\n\n## To do\n\n- GUI\n\n- Better code quality\n\n- Better stability (reduce crashes)\n\n- Python backend to\n  - save results\n  - dump memory contents\n  - etc.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjuliangrtz%2Ffrida-ios-syscall-tracer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjuliangrtz%2Ffrida-ios-syscall-tracer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjuliangrtz%2Ffrida-ios-syscall-tracer/lists"}