For the impatient, here’s how to do function tracing with Frida:
So as you can see, Frida injected itself into Twitter, enumerated the loaded
shared libraries and hooked all the functions whose names start with either
recv or read. It also generated some boilerplate scripts for taking care
of inspecting the function calls as they happen. Now, those scripts are just
examples that you are meant to edit to taste, and will be automatically reloaded
as they change on the filesystem. By default they just print the name of the
function, as you can see in the output above.
Now, let’s have a look at the generated recvfrom.js:
Now, replace the log() line with the following:
Save the file (it will be reloaded automatically) and perform some action in
your Twitter application to trigger some network activity. You should now see
something along the lines of:
That’s nothing, though. The real magic happens when you start building your
own tools using the Python API that frida-trace is built on top of.