Frida 17 compatibility: rebuild bundle with patched frida-mono-api#19
Open
ymuuuu wants to merge 3 commits into
Open
Frida 17 compatibility: rebuild bundle with patched frida-mono-api#19ymuuuu wants to merge 3 commits into
ymuuuu wants to merge 3 commits into
Conversation
- depend on ymuuuu/frida-mono-api#frida-17 (fixes Module.findExportByName removal) - regenerate dist/xamarin-unpin.js via npm run build - README banner with Frida 17 + GoSecure attribution - .gitignore: exclude mono-api/ (the cloned dependency) Frida 17.0.0 (May 2025) removed Module.findExportByName and the rest of the static Module.* helpers, so the previous bundle crashed at module-load time with TypeError: not a function. The bundled script is regenerated from the patched frida-mono-api branch and verified to contain no remaining Module.findExportByName(...) call sites.
3 tasks
There was a problem hiding this comment.
Pull request overview
Updates this project’s bundled Frida script to be compatible with Frida 17.x by rebuilding the distribution bundle against a patched frida-mono-api that no longer relies on removed static Module.* helpers.
Changes:
- Rebuild
dist/xamarin-unpin.jsusing updatedfrida-mono-apiAPIs compatible with Frida 17.x. - Add a README banner explaining the Frida 17 compatibility context and upstream dependency branch.
- Ignore the build-time
mono-api/checkout and regeneratepackage-lock.jsonwith a newer npm (lockfile v3).
Reviewed changes
Copilot reviewed 1 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| dist/xamarin-unpin.js | Rebuilt bundled script targeting Frida 17-compatible frida-mono-api export lookup APIs. |
| README.md | Adds a Frida 17 compatibility/community-contribution banner and links to the patched dependency branch. |
| .gitignore | Ignores mono-api/ so the build-time dependency checkout won’t be committed. |
| package-lock.json | Regenerated lockfile (now lockfileVersion 3) to reflect the updated build environment and local dependency layout. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+5
to
+8
| > `dist/xamarin-unpin.js` was rebuilt against an updated | ||
| > [`ymuuuu/frida-mono-api@frida-17`](https://github.com/ymuuuu/frida-mono-api/tree/frida-17). | ||
| > Note: the README's *Limitations* section about `frida -f` (early instrumentation) still | ||
| > applies — attach to a running process, do not spawn. |
There was a problem hiding this comment.
The new banner links to ymuuuu/frida-mono-api@frida-17, but later in this README the build instructions still tell contributors to clone GoSecure/frida-mono-api and switch to extra. This is inconsistent and will likely lead to rebuilding dist/xamarin-unpin.js against the wrong frida-mono-api version. Please update the build instructions (or adjust this banner) so they reference the same repo/branch used to build the bundled script.
Suggested change
| > `dist/xamarin-unpin.js` was rebuilt against an updated | |
| > [`ymuuuu/frida-mono-api@frida-17`](https://github.com/ymuuuu/frida-mono-api/tree/frida-17). | |
| > Note: the README's *Limitations* section about `frida -f` (early instrumentation) still | |
| > applies — attach to a running process, do not spawn. | |
| > `dist/xamarin-unpin.js` was rebuilt against an updated `frida-mono-api` fork; if you | |
| > rebuild it locally, use the exact repository and branch specified in the build instructions | |
| > below so your generated bundle matches the checked-in script. Note: the README's | |
| > *Limitations* section about `frida -f` (early instrumentation) still applies — attach | |
| > to a running process, do not spawn. |
- Replace the small blockquote banner with a top-level header that names this as a Frida 17 compatibility fork, links the Frida 17 release notes, and credits the upstream authors (GoSecure and @freehuntx). - Update the "Building and Running the Frida Script" section: the original instructions cloned GoSecure/frida-mono-api on the `extra` branch, which still uses removed APIs. Point at the patched ymuuuu/frida-mono-api@frida-17 instead so a fresh `npm run build` produces a working bundle.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Frida 17.0.0 (release notes, May 2025) removed the static
Module.*helper family (includingModule.findExportByName). The bundleddist/xamarin-unpin.jswas built against the old API surface, so attaching the script under any Frida 17.x runtime crashes immediately at module-load time:(reproduced under
frida -U -l dist/xamarin-unpin.js com.test.sampleon Frida CLI 17.9.1).This PR ships a rebuilt bundle that resolves the crash:
dist/xamarin-unpin.js— regenerated vianpm run buildagainst an updatedfrida-mono-apiwhoseModule.findExportByNamecalls have been migrated to Frida-17 forms (module.findExportByName(...)instance method andModule.findGlobalExportByName(...)for the module-agnostic case). The actual logical change in the bundle is 7 lines; the rest of the file's whitespace differences come from the toolchain version. 0 remainingModule.findExportByName(references in the new bundle.README.md— top banner attributing the work as a community contribution and linking back to the dependentfrida-mono-apiPR..gitignore— addsmono-api/(the build-time clone offrida-mono-api) so future contributors don't accidentally commit it.package-lock.json— regenerated by a current npm; large diff is mechanical, no semver bumps inpackage.json. Happy to revert this file if that's preferred.The
src/main.jssource is unchanged — it doesn't reference any removed API directly, so all of the migration is contained inside the bundledfrida-mono-api.Companion PR
This PR depends on (or pairs with) GoSecure/frida-mono-api#1, which contains the source-level
frida-mono-apimigration. The bundle here is built against that branch, so once the library PR lands the bundle here can be re-generated againstextradirectly with no further changes.Limitations not addressed
The README's existing Limitations section about
frida -fearly-instrumentation still applies and is not changed by this PR —frida-mono-apistill requires the Mono shared library to be already mapped, so the documented attach-mode workflow (launch the app first, thenfrida -U -l ...) is still required.Test plan
git clone -b frida-17 https://github.com/ymuuuu/frida-mono-api mono-api && npm install && npm run buildproducesdist/xamarin-unpin.js.grep "Module\.findExportByName(" dist/xamarin-unpin.jsreturns no matches.Module.findGlobalExportByName('mono_thread_attach')and_monoModule["default"].findExportByName(exportName).[+] Hooked HttpMessageInvoker.SendAsync .../[+] Done!output, then HTTPS traffic interceptable through a user-CA proxy.🤖 Generated with Claude Code