frida-ios-hooks

Frida iOS Hooks

Use this skill when instrumenting iOS Objective-C, Swift, or native behavior.

Setup Checks

frida --version
frida-ps -Uai
frida -U -f com.example.app -l agent.js --no-pause

Confirm runtime availability:

console.log(

If ObjC.available is false for an iOS app, use frida-troubleshooting before assuming the script is wrong.

Objective-C Hook Pattern

Swift and Native Rules

• Enumerate modules and symbols before guessing Swift mangled names.
• Hook Objective-C-visible Swift through ObjC classes when possible.
• For pure Swift/native functions, resolve symbols and use frida-native-hooks.
• Spawn when hooks must run before app delegate, network stack, or anti-tamper initialization.
• Prefer observation hooks for trust evaluation, crypto, signature generation, and request building before mutating results.

Practitioner Patterns

• Start with Objective-C runtime surfaces when available: delegates, URL loading, keychain, pasteboard, file APIs, crypto wrappers, and jailbreak-detection selectors.
• For Swift-heavy apps, use module/symbol enumeration plus caller stack traces; do not assume selectors exist unless Swift exposes them to Objective-C.
• For pinning, check both Objective-C frameworks and native Security/BoringSSL/CommonCrypto paths. Apps often mix them.
• Use CodeShare tools such as ObjC method observers for discovery, then replace them with narrow hooks once class/method names are known.
• On rootless jailbreaks, keep a minimal "runtime available" script separate from the real agent so setup failures are not confused with hook bugs.

Discovery Snippets

Pinning and Rootless Notes

• Identify whether pinning is in NSURLSession, SecTrustEvaluate*, a third-party framework, or native custom code.
• Rootless jailbreak setups may need matching Frida packages, correct bootstrap path, and updated tooling. Version skew often looks like attach failure or missing ObjC bridge.
• Use Gadget when normal attach is blocked but app modification is in scope.

References

Read references/ios-patterns.md for Objective-C, Swift symbol, SecTrust, module, and rootless troubleshooting patterns.