Frida Tracing Discovery

Find a hook point that runs during the target action and provides enough evidence for the next implementation step.

Start at a Relevant Boundary

1. Establish that the behavior occurs without instrumentation.
2. Choose a relevant boundary: UI action, network setup, file access, IPC, or module loading.
3. Enumerate or trace around that boundary with limited output.
4. Use sampled caller stacks only if needed to locate the responsible implementation.
5. Replace exploratory probes with the narrowest observed hook.

Identify the exact process, loaded modules, and CLI version first. Use the discovery patterns to select a boundary and stopping condition.

CLI Tracing

These are alternatives, not a sequence to run indiscriminately. Replace VERIFIED_PID, class, module, and method patterns with the actual target:

# Objective-C method pattern:
frida-trace -U -p VERIFIED_PID -m '-[ExampleController refresh*]'

# Native export pattern:
frida-trace -U -p VERIFIED_PID -i 'ExampleFramework!*refresh*'

-m selects Objective-C methods; -i selects native functions, optionally qualified by module. Check frida-trace --help for the installed options. Use startup spawning only when needed and within scope. Stop the trace with Ctrl-C after a short reproduction. Frida trace

Generated handlers may log arguments. Inspect or customize them before collecting sensitive traffic or personal data. Prefer method names, counts, and event order. Keep generated handlers and captures as local diagnostic artifacts unless the task includes retaining them.

Native Discovery

const mod = Process.findModuleByName("ExampleFramework");
if (mod !== null) {
  mod.enumerateExports()
    .filter(entry => entry.name.includes("refresh"))
    .slice(0, 50)
    .forEach(entry => console.log(mod.name, entry.name));
}

If a symbol is absent, distinguish module load timing from stripping or a different implementation. Use a matching binary or caller evidence before an offset-based hook.

Callback Discipline

Check signatures before interpreting pointers. Avoid calling arbitrary getters or dumping buffers just to prove a hook fired. When a stack is useful, take a bounded sample inside the interception callback using its native context; stack collection on every hot call can distort the behavior. Frida JavaScript API

Missing ObjC in a custom Frida agent may require bridge import/bundling; test typeof ObjC before accessing it. For Objective-C discovery, distinguish inherited and locally implemented methods.

Completion

Report the process/build, selector or symbol, exact reproduction, observed hits and caller evidence, and why the point is useful. No hits are inconclusive until the process, reproduction, load timing, and overrides have been checked.

If installed, frida-ios-hooks can implement a known iOS hook and frida-troubleshooting can diagnose setup failures. Continue with the bundled guidance if those companions are absent.