Rudra-raviRudra-ravi/frida-skills/frida-gadget-injection/SKILL.md

frida-gadget-injection

Skill3 starsChanged 6 months agoMITView on GitHub

Plan and troubleshoot Frida Gadget workflows for Android, iOS, desktop apps, jailed devices, embedded Gadget configuration, load timing, code-signing constraints, and script or interaction mode setup.

In this repository15 other files it gives its agents.
- AGENTS.mdAGENTS.md
- frida-agent-builderSkill
- frida-android-hooksSkill
- frida-anti-instrumentationSkill
- frida-codeshare-searchSkill
- frida-data-extractionSkill
- frida-ios-hooksSkill
- frida-native-hooksSkill
- frida-script-reviewSkill
- frida-setup-checklistSkill
- frida-tls-pinningSkill
- frida-tools-referenceSkill
- frida-tracing-discoverySkill
- frida-troubleshootingSkill
- frida-workflowSkill

The file

We split this skill into the rules it gives an agent

9 rules. About 0 are common, 2 are distinctive, and 7 are very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈2
Distinctive · estimate
This author's own choices. Worth a look.
7
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Distinctive:
Use this skill when normal attach is blocked, root or jailbreak is unavailable, or instrumentation must load from inside the target app.
line 8
Very specific:
Use listen mode when a host should attach after the app starts.
line 12
Very specific:
Use connect mode when Gadget should call back to a host.
line 13
Very specific:
Use script mode for an embedded script that must run without an interactive host.
line 14
Very specific:
Place the Gadget .so where the app will load it.
line 20
Very specific:
Add the matching .config file beside Gadget.
line 21
Very specific:
Add the .config file named exactly like the Gadget binary plus .config.
line 41
Distinctive:
If Gadget does not appear, verify library load, config filename, app signing, architecture, and logs before editing hooks.
line 53
Very specific:
Read references/gadget-patterns.md for configuration examples and troubleshooting.
line 57

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

Frida Gadget Injection

Use this skill when normal attach is blocked, root or jailbreak is unavailable, or instrumentation must load from inside the target app.

Decide Gadget Mode

Use listen mode when a host should attach after the app starts.
Use connect mode when Gadget should call back to a host.
Use script mode for an embedded script that must run without an interactive host.
On jailed iOS, account for code-signing policy before relying on Interceptor.

Android Shape

Match Gadget architecture to APK ABI.
Place the Gadget .so where the app will load it.
Add the matching .config file beside Gadget.
Load the library early enough for the target behavior.
Rebuild, sign, install, and run the app.

Example config:

{
  "interaction": {
    "type": "listen",
    "address": "127.0.0.1",
    "port": 27042
  }
}

iOS Shape

Match Gadget to device architecture and Frida version.
Embed Gadget in the app bundle or dynamic library load path.
Add the .config file named exactly like the Gadget binary plus .config.
Re-sign the app with the required entitlements.
Launch the app and connect with Frida tools.

Verify

frida-ls-devices
frida-ps -Uai
frida -U Gadget

If Gadget does not appear, verify library load, config filename, app signing, architecture, and logs before editing hooks.

References

Read references/gadget-patterns.md for configuration examples and troubleshooting.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free