Frida • A world-class dynamic instrumentation toolkit

Frida 17.16.4 Released

2026-07-22T00:30:23+02:00

Quick bug-fix release to restore some Python binding API and typing surface area that regressed in the recent bindgen rewrite:

bindgen: Restore the remaining public names. The cancellable decorator, RPCResult, make_rpc_call_request(), make_auth_callback(), and ScriptExportsAsync are now exposed again from frida.core.
bindgen: Generate signal callback overloads for the facade’s on()/off() helpers. This means malformed signal handlers should now be caught by type checkers instead of silently passing as any callable.
bindgen: Restore missing facade members omitted by the .gir-based generator: get_device(), get_device_matching(), enumerate_devices(), shutdown(), Cancellable.connect(), and Cancellable.disconnect().
bindgen: Restore the facade typing surface. The generated package once again ships the expected type aliases and annotations, including module functions, read-only options properties, and the _frida.pyi entries that went missing.

Frida 17.16.3 Released

2026-07-20T17:56:10+02:00

Another quick bug-fix release, addressing two issues in the Python bindings:

bindgen: Fixed marshalling of option keyword arguments. None values are now omitted instead of being passed to typed setters.
bindgen: Fixed collection-valued keyword arguments by mapping them to the appropriate select_ or add_ methods while traversing the parent chain. This affects specs, omits, externals, PIDs, and identifiers.

Frida 17.16.2 Released

2026-07-19T22:25:34+02:00

Another quick bug-fix release, fixing an issue where frida-helper on Darwin and Linux kept the embedder’s stdio pipes open.

The helper previously inherited these streams at launch so they could later be used by Device#spawn() with stdio='inherit'. The streams are now passed to the helper with each such request instead.

darwin: Redirect the helper’s own stdin, stdout, and stderr to /dev/null.
linux: Apply the same fix as on Darwin.

Frida 17.16.1 Released

2026-07-18T13:30:39+02:00

Quick bug-fix release with a couple of Darwin-focused fixes:

apple: Stop forcing the classic linker. This was a workaround for an Xcode 15.0 beta 7 issue where the modern linker over-linked libresolv. The modern linker no longer does this, while ld-classic omits SG_READ_ONLY on __DATA_CONST, causing newer dyld versions to reject our images.
darwin: Restrict CodeSegment to old kernels. The revived signed-dylib realize path lets modern XNU accept our signature and map the page, which can later panic the kernel on iOS 15.6.1 and newer. Modern kernels now fall back to mprotect, suspending threads as before, while the signed-segment path remains available for old jailbroken kernels that need it.

Frida 17.16.0 Released

2026-07-17T23:28:26+02:00

Big release this time, with a mix of safety hardening, platform fixes, and some API polishing. Huge thanks to @hsorbo and @SamSunNV for their contributions.

Highlights include:

spawn-gating: Make it fail-safe and scoped. The system-wide Linux eBPF spawn gater is now opt-in through the new SpawnGatingScope, and all suspending gaters now share a watchdog that disables gating and resumes everything if a caught process is left suspended for too long. This avoids wedging process creation system-wide when a client disappears or stops resuming spawns.
spawn-gating: Add a spawn_gating_disabled(reason) signal on HostSession, bubbled up to Device, so clients can tell when the watchdog had to step in.
python: Auto-generate the Python bindings from Frida’s GIR. This also adds support for asyncio, through the new frida.aio package.
swift: Auto-generate the Swift bindings from Frida’s GIR.
auth: Flush the pending INVALID_ARGUMENT reply before closing the authentication channel, so clients reliably see the token rejection instead of a closed connection.
fruity: Fix upload injection on arm64e by applying each segment’s protection before running threaded and chained fixups. This lets writable data segments receive their rebased and authenticated pointers without faulting, while still avoiding any rwx mapping. Thanks @hsorbo!
darwin: Revive CodeSegment realization on modern iOS by emitting a modern SHA-256 CodeDirectory with exec-segment fields and a non-empty identifier. The implementation probes the modern flavor first, falls back to the legacy one when needed, and caches the working strategy.
darwin: Probe CodeSegment support at runtime by patching a scratch page, instead of relying on XNU version guesses for behavior that varies across kernels.
gumjs: Let V8 JIT inside the iOS app sandbox by avoiding the macOS-specific MAP_JIT path on iOS and instead using Gum’s own JIT allocation path.
darwin: Fix arm64e attach crashes by signing resident notifier handler pointers before the add-image stub branches through them.
darwin-mapper: Skip stores for threaded binds, where the resolved target already lives in the chain processor’s symbol table and the default segment/offset may point into read-only __TEXT. Thanks @hsorbo!
arm64-writer: Add PACIA and MOVK instruction emitters, useful for signing pointers inline and building ptrauth discriminators in generated code. Thanks @hsorbo!
x86: Preserve AVX-512 state in Stalker. On AVX-512 hosts we now save and restore the upper halves of zmm0-15, zmm16-31, and the k0-k7 opmask registers, fixing crashes when stalking EVEX-using libc routines.
x86: Add AVX-512 CPU feature detection and writer emitters for the spills needed by Stalker.
x86: Expose XMM registers in CpuContext, backed by the live save area where available, and add gum_cpu_context_copy() plus a boxed type for safe persistence. Thanks for the fun team-work, @hsorbo!
interceptor: Discard hooks when a module is unloaded, without trying to restore prologues in memory that is no longer mapped. Thanks @SamSunNV!
module-registry: Fix ELF range computation for modules whose program headers are not mapped next to the ELF header, such as libgit2. We compute ranges from program headers when possible and fall back to /proc/self/maps only when needed.
memory: Finish migrating internal callers to gum_memory_allocate() and gum_memory_free(), and remove the old gum_alloc_n_pages() family.
windows: Fix installed-assets helper discovery by expanding <arch>, finding helpers in per-architecture directories, and having the manager mint and pass a unique rendezvous name to all helper services.
windows: Improve MSVC cross builds by keeping the arm64->x86 build cross, pointing each compiler at its own include and library paths, and preserving the environment’s INCLUDE/LIB for native build-machine tools.
build: Resolve GLib up front through a new glib.wrap, base in-tree payloads on the GLib flavor, configure native languages for cross builds, and avoid forwarding parent build-machine options into compat builds.
deps: Rebuild prebuilts with the current GitHub Actions Xcode, picking up the updated arm64e ABI.
compiler/barebone: Bump @types/frida-gum to 19.10.0.
tests: Make the bytecode test unload its script before dropping the last reference, fixing an intermittent teardown race under load. Thanks @hsorbo!

Frida 17.15.5 Released

2026-07-13T12:56:02+02:00

Quick bug-fix release with an Android fix from @dezige131, along with several Darwin and Gum.Memory-related improvements from @hsorbo:

android: Tolerate transient USAP patch misses when the target process does not have the boot image mapped.
darwin: Re-enable CodeSegment on newer kernels. The vm_remap OVERWRITE trick works again on iOS 17.6 and newer, allowing CodeSegment to be enabled there once more.
memory: Fix a suspend deadlock in patch_code. Patches are now prepared in a scratch buffer first, allowing the apply callback to allocate freely before other threads are suspended for the lock-free copy back into place.
memory: Make patch_code safer under concurrency and when failures occur. All target pages are made writable before any bytes are committed, only modified bytes are copied back, and pages are restored to RX before the instruction cache is flushed.
memory: Extract the three patching strategies into dedicated helpers, simplifying the dispatcher without changing behavior.

Frida 17.15.4 Released

2026-07-06T19:05:24+02:00

Quick release with a couple of handy improvements:

gumjs: Add Checksum copy and peek methods. Thanks @mrmacete!
defs: Add support for Capstone 6. Thanks @kripticni!
darwin-symbolicator: Add missing locking, and initialize module before jumping to cleanup. Thanks @comex!
qml: Suppress Qt __yield error on recent clang.
barebone, compiler: Bump @types/frida-gum to 19.8.0.
Bump FridaCore to 17.15.3.

Frida 17.15.3 Released

2026-06-22T23:31:35+02:00

Quick bug-fix release, shipped later the same day because software is hard and apparently enjoys reminding us.

darwin: Populate the module registry before activating the interceptor. The first gum_interceptor_obtain() activates the unwind broker, whose backend resolves libdyld through the module registry. Doing this before taking the initial snapshot could re-enter an empty registry and crash on a NULL module lookup. We now snapshot the modules first, then start change tracking.

Frida 17.15.2 Released

2026-06-22T11:46:34+02:00

Quick bug-fix release, with a fix from @wave-sky for spawning processes on Android 10:

linux: Fix payload base selection on Android 10. Spawning processes could fail with a remote connection error due to Android’s XOM mechanism making libstagefright.so execute-only. We now avoid requiring read permission when picking target libraries, consider more media shared libraries, and force read-execute permissions so the payload can run.

Frida 17.15.1 Released

2026-06-20T15:57:05+02:00

Quick bug-fix release with the following fixes:

darwin: Fix an unused variable warning on non-arm64e builds.
linux: Fix musl RTLD call-site discovery when multiple GumModuleRegistry instances are involved. We now scan the linker’s on-disk image instead of live memory, preserving the original instructions and allowing chained interceptors to hook the same loaded addresses.