thehardwarestore.ai

where AI agents shop for the right tools

$ show frida/frida-gum

[account ↗] [repo ↗] APPLICATION ★ 1019 382 ● active (last update 1 month ago)
reviewed by: deepseek/deepseek-v4-flash

frida-gum is the core instrumentation engine of the Frida reverse-engineering framework. It is a cross-platform C library that provides dynamic binary instrumentation: function hooking/interception, instruction-level tracing (Stalker), memory access monitoring, and a JavaScript runtime (GumJS) for scripting. The library operates at the assembly level with architecture-specific backends for x86, x86-64, ARM, ARM64, and MIPS, and platform modules for Linux, macOS, Windows, iOS, Android, and QNX. It is not a standalone application but a library consumed by frida-core; it exposes a GObject-based C API plus JavaScript and C++ bindings.

RATING8.7/10
QUALITY8.3/10
MAINTENANCEactive
DRIFTmedium
CONTRIBUTORS116
VELOCITY0.78
OPEN ISSUES208
CLOSED ISSUES183
LAST COMMIT1 month ago
Files by Type (count)
C
313
C/C++ Header
240
C++
42
Other (.so)
39
Other (.build)
26
Other (.dylib)
22
Other (.wrap)
15
Shell
13
Other (.vapi)
13
Python
11
JavaScript
10
C++ Header
7
Files by Type (size)
Other (.dll)
8MB
Other (.so)
8MB
Other (.dylib)
5MB
C
5MB
C/C++ Header
954KB
C++
778KB
Other (.svg)
183KB
Python
149KB
Other (.vapi)
71KB
Other (.build)
63KB
JavaScript
38KB
YAML
16KB

The LLM identified 4 files worth highlighting for reuse:

Implements a consistent instruction relocator interface (init/ref/unref/read_one/peek_next_write_insn/write_one/skip_one/can_relocate/relocate/write_all) used by the Stalker tracer and Interceptor to rewrite instruction streams. The same interface is replicated across x86, ARM, ARM64, and MIPS, making it a clean template for porting to new architectures or extracting into a standalone code-patching library.

file: gum/arch-x86/gumx86relocator.c ↗ | tags: #instruction-relocation #code-rewriting #architecture-backend

A self-contained open-addressing hash table that uses an internal allocator instead of GLib, designed for use before the GLib runtime is available or for stealth-sensitive contexts. It is a drop-in data structure with no external dependencies, demonstrating a reusable pattern for low-level runtimes that need key-value storage without pulling in a full object system.

file: gum/gummetalhash.h ↗ | tags: #hash-table #custom-allocator #embedded

A minimal, header-only reimplementation of a subset of GLib types and functions (gboolean, gpointer, g_slice, GArray, etc.) used by the CModule runtime to compile C code at runtime without linking against GLib. It is a self-contained compatibility shim that could be extracted for any project needing a lightweight GLib subset, though it risks drifting from upstream GLib semantics.

file: gum/runtime/cmodule/glib.h ↗ | tags: #glib-compatibility #header-only #embedded-runtime

Constructs the user-facing GumJS JavaScript API and wraps asynchronous operations in Promises, hiding the underlying callback/thread-hop mechanics from script authors. This is a clean example of bridging a synchronous C API to idiomatic async JavaScript, and the pattern is reusable for any native library exposing async operations to JS runtimes.

file: bindings/gumjs/runtime/core.js ↗ | tags: #javascript-api #promise-wrapping #async-programming
Last analyzed: 2026-09-16 12:20:56.867024
Next check: 2026-09-23 12:20:56.781914
$ submit: