Frida 17

# Frida 17 Scripting Guide

This skill helps write and fix Frida scripts compatible with Frida 17.0.0 (released May 2025).

## Breaking Changes in Frida 17

### 1. Static Module Methods - REMOVED

```javascript
// OLD - No longer works in Frida 17
Module.findBaseAddress('libriver.so')
Module.getBaseAddress('libriver.so')
Module.findExportByName(null, 'open')
Module.findExportByName('libc.so', 'open')
Module.getExportByName(null, 'open')
Module.ensureInitialized('libc.so')
Module.enumerateExports('libc.so')
Module.enumerateSymbols('libc.so')

// NEW - Use Process and instance methods instead
var lib = Process.findModuleByName('libriver.so');  // returns Module or null
var lib = Process.getModuleByName('libriver.so');   // throws if not found
lib.base                                             // module base address
lib.findExportByName('open')                        // returns address or null
lib.getExportByName('open')                         // throws if not found
lib.enumerateExports()                              // returns array
lib.enumerateSymbols()                              // returns array
```

### 2. Static Memory Methods - REMOVED

```javascript
// OLD - No longer works
Memory.readU32(ptr)
Memory.writeU32(ptr, value)

// NEW - Use NativePointer instance methods
ptr.readU32()
ptr.writeU32(value)
```

### 3. Legacy Enumeration APIs - REMOVED

```javascript
// OLD - Callback style removed
Process.enumerateModules({ onMatch: fn, onComplete: fn })
Process.enumerateModulesSync()

// NEW - Returns array directly
Process.enumerateModules()
```

### 4. Reserved Function Names - DO NOT OVERRIDE

The following are built-in Frida functions. Defining custom functions with these names causes:
`TypeError: cannot define variable 'hexdump'`

**Reserved names:**
- `hexdump` - Use `dumpHex` instead for custom hex dump functions
- `ptr` - pointer constructor shorthand
- `NULL` - null pointer constant

```javascript
// BAD - conflicts with built-in
function hexdump(ptr, len) { ... }

// GOOD - use different name
function dumpHex(ptr, len) { ... }
```

## NativePointer Methods (Valid in Frida 17)

**Conversion:**
- `toInt32()` - cast to signed 32-bit integer
- `toNumber()` - convert to JavaScript number
- `toString([radix])` - convert to string

**NOT available:**
- `toUInt32()` - DOES NOT EXIST, use `toInt32()` for sizes < 2^31

**Memory reading:**
- `readU8()`, `readS8()`, `readU16()`, `readS16()`
- `readU32()`, `readS32()`, `readU64()`, `readS64()`
- `readByteArray(length)` - returns ArrayBuffer
- `readPointer()`, `readCString()`, `readUtf8String()`

**Memory writing:**
- `writeU8(value)`, `writeS8(value)`, etc.
- `writeByteArray(bytes)` - bytes must be ArrayBuffer or JS array
- `writePointer(ptr)`, `writeUtf8String(str)`

**Pointer arithmetic:**
- `add(rhs)`, `sub(rhs)`, `and(rhs)`, `or(rhs)`, `xor(rhs)`
- `shr(n)`, `shl(n)`, `not()`
- `isNull()`, `equals(rhs)`, `compare(rhs)`

## Java Bridge API (Unchanged in Frida 17)

```javascript
Java.perform(function() {
    var MyClass = Java.use('com.example.MyClass');

    // Hook with overload
    MyClass.myMethod.overload('int', 'java.lang.String').implementation = function(a, b) {
        console.log('Called with: ' + a + ', ' + b);
        // Call original
        return this.myMethod.overload('int', 'java.lang.String').call(this, a, b);
    };

    // Hook all overloads
    MyClass.myMethod.overloads.forEach(function(overload) {
        overload.implementation = function() {
            return overload.apply(this, arguments);
        };
    });
});
```

**Java byte[] handling:**
Java byte arrays cannot be passed directly to `Memory.al