Frida 17.17.0 Released

Frida 17.17.0 Released ∞

release

05 Aug 2026

This is a big release with lots of bare-metal goodness. The Barebone agent— written in Rust and embedding the GumJS devkit—previously supported only XNU. It can now also run in the Linux kernel, where a small C shim provides the kernel glue.

The agent is packaged as a .ko: load it with insmod, then exchange length-prefixed GVariant messages through /dev/frida. Configure the Barebone backend to use this transport, and run frida-server --device=barebone on the device. Here it is running on my Pixel 6 Pro:

linux-kernel

Build the module for your device

The release page has a GumJS devkit for the none-arm64-softfloat target. You do not have to build Gum yourself. The steps below make a frida-agent.ko for a Pixel 6 Pro. Other arm64 Linux systems use the same steps with a different kernel.

Do the build on an x86-64 Linux host. The kernel build tree contains x86-64 programs.

Install the tools:

sudo apt-get install build-essential clang binutils-aarch64-linux-gnu
rustup target add aarch64-unknown-none
rustup component add rust-src

Your clang must be version 19 or newer. GCC does not implement the soft-float ABI.

Download the source:

git clone --recurse-submodules https://github.com/frida/frida-core.git
cd frida-core

Download the devkit:

version=17.17.0
base=https://github.com/frida/frida/releases/download/$version
curl -LO $base/frida-gumjs-devkit-$version-none-arm64-softfloat.tar.xz
mkdir -p ~/gumjs-devkit
tar -C ~/gumjs-devkit -xf frida-gumjs-devkit-$version-none-arm64-softfloat.tar.xz

Download the SDK:
```
releng/deps.py sync sdk none-arm64-softfloat ~/sdk-none-arm64-softfloat
```
The SDK contains picolibc and the compiler-rt builtins. The devkit needs them.
Read the kernel version from the device:
```
adb shell uname -r
6.1.145-android14-11-gc1de4747ac59-ab14219743
```
The name ends with the GKI commit and the build number. Here the commit is c1de4747ac59. The build number is 14219743.

Download the kernel files:

commit=c1de4747ac59
build=14219743
ci=https://ci.android.com/builds/submitted/$build/kernel_aarch64/latest/raw
mkdir -p ~/kernel-prepared ~/kernel-source
curl -sSL $ci/modules_prepare_outdir.tar.gz | tar -xz -C ~/kernel-prepared
curl -sSL $ci/kernel_aarch64_Module.symvers -o ~/kernel-prepared/Module.symvers
curl -sSL https://android.googlesource.com/kernel/common/+archive/$commit.tar.gz \
    | tar -xz -C ~/kernel-source

Build the module:

make -C src/barebone/agent/linux \
    FRIDA_SDK=$HOME/sdk-none-arm64-softfloat \
    GUMJS_DEVKIT_DIR=$HOME/gumjs-devkit \
    AGENT_LD=aarch64-linux-gnu-ld \
    AGENT_AR=aarch64-linux-gnu-ar \
    AGENT_NM=aarch64-linux-gnu-nm \
    AGENT_OBJCOPY=aarch64-linux-gnu-objcopy \
    KDIR=$HOME/kernel-source \
    KOUT=$HOME/kernel-prepared \
    LLVM=1

Load the module:

adb push src/barebone/agent/linux/frida-agent.ko /data/local/tmp/
adb shell su -c 'insmod /data/local/tmp/frida-agent.ko'

The module loads only on the kernel build that you made it for. The kernel compares the version string exactly. A different build of the same kernel branch does not work.

For more information, read the module README.

Full changelog:

gumjs: Fix a detach hang when a native fault inside JS is recovered by a later handler. We now rebalance the Interceptor transaction when the thread survives, instead of ending it twice. Kudos to @pandasauce for reporting the issue and helping track it down.
arm64: Detect branches into the range being relocated, preventing Interceptor from rewriting a branch so that it lands in the middle of its own redirect patch. Thanks to @WHW0x455 for this fix.
python: Fix the linker_notifier_offsets keyword argument to attach(), restore the default port for Script.enable_debugger(), and reinstate marshalling of certificate options for remote devices and related APIs.
barebone: Add support for running the agent as a Linux kernel module. The agent now starts inside the target as a .ko, exposes a character device for transport, and can be reached through a regular frida-server --device=barebone instance.
deps: Add a soft-float bare-metal SDK comprising picolibc and compiler-rt. This gives the none-arm64-softfloat flavour a libc and runtime that agree on passing floating-point values through general-purpose registers.
deps: Build the soft-float SDK in CI, check for published bundles before spending time installing a toolchain, keep libc headers out of devkit headers, use the SDK as the sysroot, and ensure configure-time link checks resolve libc correctly.
deps: Bump GLib, libffi, and QuickJS for freestanding fixes, vector assembler directive fixes, the precedence-climbing parser, and the corresponding x18 fix.
arm64: Avoid FP and SIMD code on soft-float targets by using scalar fallbacks for memcpy, pointer scanning, and Interceptor’s register shuffling.
gumjs: Bound the QuickJS stack on bare metal, re-enabling its stack check so the parser stops before exhausting the small stacks such hosts may provide.