$ show frida/frida-gum
frida-gum is the core instrumentation engine of the Frida reverse-engineering framework. It is a cross-platform C library that provides dynamic binary instrumentation: function hooking/interception, instruction-level tracing (Stalker), memory access monitoring, and a JavaScript runtime (GumJS) for scripting. The library operates at the assembly level with architecture-specific backends for x86, x86-64, ARM, ARM64, and MIPS, and platform modules for Linux, macOS, Windows, iOS, Android, and QNX. It is not a standalone application but a library consumed by frida-core; it exposes a GObject-based C API plus JavaScript and C++ bindings.
The LLM identified 4 files worth highlighting for reuse:
Implements a consistent instruction relocator interface (init/ref/unref/read_one/peek_next_write_insn/write_one/skip_one/can_relocate/relocate/write_all) used by the Stalker tracer and Interceptor to rewrite instruction streams. The same interface is replicated across x86, ARM, ARM64, and MIPS, making it a clean template for porting to new architectures or extracting into a standalone code-patching library.
A self-contained open-addressing hash table that uses an internal allocator instead of GLib, designed for use before the GLib runtime is available or for stealth-sensitive contexts. It is a drop-in data structure with no external dependencies, demonstrating a reusable pattern for low-level runtimes that need key-value storage without pulling in a full object system.
A minimal, header-only reimplementation of a subset of GLib types and functions (gboolean, gpointer, g_slice, GArray, etc.) used by the CModule runtime to compile C code at runtime without linking against GLib. It is a self-contained compatibility shim that could be extracted for any project needing a lightweight GLib subset, though it risks drifting from upstream GLib semantics.
Constructs the user-facing GumJS JavaScript API and wraps asynchronous operations in Promises, hiding the underlying callback/thread-hop mechanics from script authors. This is a clean example of bridging a synchronous C API to idiomatic async JavaScript, and the pattern is reusable for any native library exposing async operations to JS runtimes.