frida/frida-gum

Free

Cross-platform instrumentation and introspection library written in C

FreeFree tier

Type

Open Source

Company

Frida

Visit Website GitHub (38 stars)

About frida/frida-gum

frida-gum is a cross-platform instrumentation and introspection library written in C, providing a powerful low-level API for dynamic analysis, reverse engineering, and performance profiling. It includes an inline hooking engine (Interceptor), stealthy code tracing (Stalker), memory monitoring (MemoryAccessMonitor), and comprehensive introspection capabilities such as enumerating running threads, loaded modules (imports, exports, symbols), memory scanning, DebugSymbol lookups, and backtracer implementations. The library supports code generation and relocation for multiple architectures (x86, ARM, Thumb, ARM64, MIPS) and offers helper libraries for heap allocation tracking and profiling. It is consumed by frida-core through its JavaScript bindings, GumJS.

Key Features

Inline hooking via Interceptor

Stealthy code tracing via Stalker

Memory monitoring via MemoryAccessMonitor

Cross-platform introspection (threads, modules, memory scanning, symbols)

Code generation for x86, ARM, Thumb, ARM64, MIPS

Code relocation for same architectures

Kernel state introspection (iOS only for now)

Out-of-process dynamic linker for i/macOS (Gum.Darwin.Mapper)

Helper libraries for heap allocation tracking and profiling

Pros & Cons

Pros

Cross-platform support (Windows, macOS, Linux, iOS, Android, etc.)
Stealthy and low-overhead instrumentation
Comprehensive introspection capabilities
Rich code generation and relocation API for multiple architectures
Integrates with frida-core's JavaScript bindings for high-level scripting

Cons

Kernel state introspection currently limited to iOS
Requires C programming skills; not beginner-friendly
Primarily a low-level library; higher-level use cases need additional layers (GumJS)
Documentation may be sparse for some advanced features

Best For

Dynamic analysis and reverse engineeringSecurity research and vulnerability assessmentPerformance profiling and debuggingInstrumenting third-party or closed-source applicationsBuilding custom runtime monitors and tracers

FAQ

What is frida-gum?

frida-gum is a cross-platform instrumentation and introspection library written in C, used for dynamic analysis, reverse engineering, and performance monitoring. It provides inline hooking, code tracing, memory monitoring, and code generation capabilities.

How do I build frida-gum?

Builds can be configured using the `configure` script (or `configure.bat` on Windows). Run `./configure --enable-gumpp --enable-gumjs --enable-tests` then `make`. For all options, use `./configure --help`.

How do I run tests?

Tests are built with `make test` and executed with `./build/tests/gum-tests`. You can specify a test path with `-p` to run specific tests, e.g., `./build/tests/gum-tests -p /Core/Interceptor/attach_one`.

Is frida-gum free?

Yes, frida-gum is open-source and free to use. It is hosted on GitHub under a license (see repository for details).