Frida IRE (Interactive Reverse-engineering Environment) is an open source reversing tool focusing on scriptable dynamic instrumentation in userland. It runs on Windows, Mac, Linux and iOS. In this talk, I will focus on live demos showing you how to use Frida’s scripting capabilities to explore live processes both locally and remote. I will also show how Frida potentially can be used to do stealthy instrumentation of paranoid processes protected by anti-debugging. https://www.hackitoergosum.org

1. Frida
h(p://frida.github.io/

2. Demo:
screencast

3. Nomenclature
• Debugger
• Agent
• Target

4. Architecture
Python
hackito.py
hackito.js
frida-­‐python
frida-­‐core
Skype
frida-­‐agent
frida-­‐gum
hackito.js

5. Demo:
a(ach()

6. Demo:
enumerate_modules()

7. Demo:
inspecFng
and
manipulaFng
funcFon
calls

8. Demo:
communicaFng
with
a
target
process

9. Example:
.NET
binding

10. Example:
browser
plugin

11. QuesFons?

12. Thanks!
• DocumentaFon:
h(p://frida.github.io/
• Code:
h(p://github.com/frida
• Chat:
#frida
@
FreeNode