Frida Tracing Discovery

Use this skill when the target API, class, symbol, or call path is unknown.

Start Broad, Then Narrow

1. Prove the behavior happens without Frida.
2. Choose the highest-signal boundary: network, crypto, file, IPC, WebView, class loading, native library loading, or UI action.
3. Trace or enumerate around that boundary.
4. Add stack traces to identify app-owned callers.
5. Replace broad probes with narrow hooks.

CLI Tracing

frida-trace -U -f com.example.app -j 'java.net.URL!*' --no-pause
frida-trace -U -f com.example.app -i 'open' -i 'connect' --no-pause
frida-trace -U -n target -m 'Module!*pattern*'