Gum

Cross-platform instrumentation and introspection library written in C.

This library is consumed by frida-core through its JavaScript bindings, GumJS.

Provides:

• Instrumentation core

  • Inline hooking: Interceptor
  • Stealthy code tracing: Stalker
  • Memory monitoring: MemoryAccessMonitor

• Cross-platform introspection

  • Running threads and other process state
  • Loaded modules, including their:
    • Imports
    • Exports
    • Symbols
  • Memory scanning
  • DebugSymbol lookups
  • Backtracer implementations
  • Kernel state (iOS only for now)

• Out-of-process dynamic linker for i/macOS: Gum.Darwin.Mapper

• Code generation:

  • X86Writer
  • ArmWriter
  • ThumbWriter
  • Arm64Writer
  • MipsWriter

• Code relocation:

  • X86Relocator
  • ArmRelocator
  • ThumbRelocator
  • Arm64Relocator
  • MipsRelocator

• Helper libraries for developers needing highly granular:

  • Heap allocation tracking and leak checking.
  • Profiling with worst-case inspector callback.

Binaries

Download a devkit for statically linking into your own projects from the Frida releases page.