frida CLI

Apr 22, 2026 00:00:00

frida (Frida CLI)

Interactive REPL interface for dynamic instrumentation. Emulates IPython/Cycript-style interactive exploration — tab completion, live object inspection, and hot-reloading scripts.

Prerequisites: frida-tools Python package installed (pip install frida-tools). Target device must be reachable (USB, TCP, or local).

Synopsis

frida [options] [target]

Target can be a process name, PID, or bundle identifier depending on the attach flag used.

Device Selection Options

Flag	Description
`-D ID`, `--device ID`	Connect to device with the given ID (from `frida-ls-devices`)
`-U`, `--usb`	Connect to USB-attached device
`-R`, `--remote`	Connect to remote `frida-server` (default host)
`-H HOST`, `--host HOST`	Connect to remote `frida-server` on HOST
`--certificate CERT`	Speak TLS with HOST, expecting CERTIFICATE
`--origin ORIGIN`	Set `Origin` header when connecting to remote server
`--token TOKEN`	Authenticate with HOST using TOKEN
`--keepalive-interval N`	Keepalive interval in seconds; `0` to disable (default: `-1`)
`--p2p`	Establish peer-to-peer connection with target
`--stun-server ADDRESS`	Set STUN server ADDRESS (used with `--p2p`)
`--relay addr,user,pass,turn-TYPE`	Add TURN relay for `--p2p` (repeatable)
`--device-option option`	Override backend-specific option (repeatable)

Target / Attach Options

Flag	Description
`-f FILE`, `--file FILE`	Spawn FILE
`-F`, `--attach-frontmost`	Attach to the frontmost application
`-n NAME`, `--attach-name NAME`	Attach to process by NAME
`-N ID`, `--attach-identifier ID`	Attach to application by bundle/package identifier
`-p PID`, `--attach-pid PID`	Attach to process by PID
`-W PATTERN`, `--await PATTERN`	Await a spawn matching PATTERN (gated attach)
`--realm REALM`	Realm to attach in: `native` (default) or `emulated`
`--runtime RUNTIME`	Script runtime: `qjs` (QuickJS) or `v8`
`--debug`	Enable Node.js-compatible script debugger (listens on port 5858)
`--squelch-crash`	Do not dump crash report to console
`--stdio MODE`	stdio behavior when spawning: `inherit` (default) or `pipe`
`--aux option`	Set aux option when spawning (repeatable)

Script Options

Flag	Description
`-l SCRIPT`, `--load SCRIPT`	Load and execute a script file (repeatable)
`-P JSON`, `--parameters JSON`	Pass parameters as JSON (same format as Gadget config)
`-C CMODULE`, `--cmodule CMODULE`	Load a CModule (compiled C code)
`--toolchain CHOICE`	CModule toolchain: `any` (default), `internal`, or `external`
`-c URI`, `--codeshare URI`	Load script from Frida CodeShare (`user/repo`)
`-e CODE`, `--eval CODE`	Evaluate CODE immediately (repeatable)
`-q`	Quiet mode — no prompt; exit after `-l` and `-e` complete
`-t N`, `--timeout N`	Seconds to wait before exiting in quiet mode; `inf` to run forever (default: `0`)
`--pause`	Leave main thread paused after spawning (do not auto-resume)
`-o FILE`, `--output FILE`	Write log output to FILE
`--eternalize`	Keep the script alive after the REPL exits
`--exit-on-error`	Exit with code 1 on any unhandled script exception
`--kill-on-exit`	Kill the spawned process when Frida exits
`--auto-reload`	Auto-reload scripts and CModule on file change (default: on)
`--no-auto-reload`	Disable auto-reload of scripts and CModule
`--auto-perform`	Wrap entered REPL code with `Java.perform()` automatically

Global Options

Flag	Description
`-O FILE`, `--options-file FILE`	Text file containing additional command line options
`--version`	Print Frida version and exit

Usage Examples

 1# Attach to a local process by name
 2frida Calculator
 3
 4# Attach to Safari on a USB-connected iOS device
 5frida -U Safari
 6
 7# Spawn a binary and attach
 8frida -f /usr/bin/ping
 9
10# Load a script and attach to a process
11frida Calculator -l calc.js
12
13# Load a script, enable Node.js debugger (port 5858)
14frida Calculator -l calc.js --debug
15
16# Attach to an app by bundle ID on USB device
17frida -U -N com.apple.mobilesafari
18
19# Run in quiet/headless mode, evaluate one-liner, then exit
20frida -U -n Safari -e "console.log(ObjC.classes.length)" -q
21
22# Load a CodeShare script
23frida -U -f com.example.app -c "nowsecure/frida-jni-tracer"
24
25# Connect to a remote frida-server
26frida -H 192.168.1.10 -n Spotify

REPL Special Commands

Command	Effect
`%reload`	Manually reload the loaded script from disk
`<TAB>`	Context-aware autocompletion

Built-in REPL Objects

The REPL environment exposes the full Frida JavaScript API:

Category	Objects
Core	`Frida`, `Process`, `Module`, `Memory`, `Thread`
Instrumentation	`Interceptor`, `Stalker`, `MemoryAccessMonitor`
Native types	`NativePointer`, `NativeCallback`, `NativeFunction`, `ptr`, `NULL`
ObjC	`ObjC` (iOS/macOS only)
Java/Android	`Java`, `Dalvik` (Android only)
Misc	`File`, `Socket`, `DebugSymbol`, `Instruction`, `CpuContext`
Messaging	`send`, `recv`
Timers	`setTimeout`, `clearTimeout`, `setInterval`, `clearInterval`, `gc`
Utilities	`WeakRef`, `console`, `Proxy`

Notes

--debug starts a V8/QuickJS inspector on port 5858; connect with node-inspector or Chrome DevTools.
--pause is only meaningful with -f (spawn mode); the process must be manually resumed in the REPL via %resume.
-q with -t 0 (default) exits immediately after scripts finish; use -t inf for long-running headless sessions.
--eternalize is useful when you want injected scripts to keep running after disconnecting the REPL.