yotamn/frida-gum

Frida-gum is a low-level toolkit that lets you inspect and modify what a running program is doing, in real time. It is the engine behind Frida, a popular dynamic instrumentation framework. If you have ever wanted to peek inside a running application to see which functions it calls, what memory it touches, or how it behaves, all without restarting it or having the source code, this library provides the building blocks for that. At a high level, it works by hooking into a program's code as it runs. You can intercept function calls to log them or swap in your own behavior. You can trace execution step by step, monitor memory access, scan memory for patterns, look up debug symbols, and inspect loaded modules. It also includes code generation and relocation tools for multiple CPU architectures (x86, ARM, ARM64, MIPS), which means it can rewrite instructions on the fly to insert its hooks without breaking the program. The people who use this are typically security researchers, reverse engineers, and developers building debugging or analysis tools. For example, a mobile security researcher might use it to understand how an iOS app communicates with a server, or a developer might track down a memory leak by monitoring heap allocations. The library gives these users a way to build highly granular tools: it offers heap allocation tracking, leak detection, and profiling with callbacks for worst-case performance scenarios. A notable aspect of the project is that it is written in C and designed to be cross-platform, covering Windows, macOS, Linux, iOS, and Android across many CPU architectures. It is consumed by a higher-level component called frida-core through JavaScript bindings, which is how most people interact with it, writing scripts in JavaScript rather than dealing with the C library directly. You can download a prebuilt devkit from the Frida releases page if you want to link it into your own native project.