Frida Native Hooks

Use this skill when the target is a native function or memory behavior.

Discovery First

1. Identify process architecture and module:

   console.log(Process.arch, Process.platform, Process.pointerSize);
   for (const m of Process.enumerateModules()) console.log(m.name, m.base, m.size);
   

2. Resolve addresses through Frida APIs when possible:

   const mod = Process.getModuleByName("libtarget.so");
   const fn = mod.getExportByName("target_function");
   

3. If names are stripped, search imports/exports first, then symbols, strings, and byte patterns.
4. On ARM/Thumb, prefer addresses returned by Frida APIs so instruction-set details are handled correctly.