frida (Frida CLI)
Interactive REPL interface for dynamic instrumentation. Emulates IPython/Cycript-style interactive exploration — tab completion, live object inspection, and hot-reloading scripts.
Prerequisites: frida-tools Python package installed (pip install frida-tools). Target device must be reachable (USB, TCP, or local).
Synopsis
frida [options] [target]
Target can be a process name, PID, or bundle identifier depending on the attach flag used.
Device Selection Options
| Flag | Description |
|---|
-D ID, --device ID | Connect to device with the given ID (from frida-ls-devices) |
-U, --usb | Connect to USB-attached device |
-R, --remote | Connect to remote frida-server (default host) |
-H HOST, --host HOST | Connect to remote frida-server on HOST |
--certificate CERT | Speak TLS with HOST, expecting CERTIFICATE |
--origin ORIGIN | Set Origin header when connecting to remote server |
--token TOKEN | Authenticate with HOST using TOKEN |
--keepalive-interval N | Keepalive interval in seconds; 0 to disable (default: -1) |
--p2p | Establish peer-to-peer connection with target |
--stun-server ADDRESS | Set STUN server ADDRESS (used with --p2p) |
--relay addr,user,pass,turn-TYPE | Add TURN relay for --p2p (repeatable) |
--device-option option | Override backend-specific option (repeatable) |
Target / Attach Options
| Flag | Description |
|---|
-f FILE, --file FILE | Spawn FILE |
-F, --attach-frontmost | Attach to the frontmost application |
-n NAME, --attach-name NAME | Attach to process by NAME |
-N ID, --attach-identifier ID | Attach to application by bundle/package identifier |
-p PID, --attach-pid PID | Attach to process by PID |
-W PATTERN, --await PATTERN | Await a spawn matching PATTERN (gated attach) |
--realm REALM | Realm to attach in: native (default) or emulated |
--runtime RUNTIME | Script runtime: qjs (QuickJS) or v8 |
--debug | Enable Node.js-compatible script debugger (listens on port 5858) |
--squelch-crash | Do not dump crash report to console |
--stdio MODE | stdio behavior when spawning: inherit (default) or pipe |
--aux option | Set aux option when spawning (repeatable) |
Script Options
| Flag | Description |
|---|
-l SCRIPT, --load SCRIPT | Load and execute a script file (repeatable) |
-P JSON, --parameters JSON | Pass parameters as JSON (same format as Gadget config) |
-C CMODULE, --cmodule CMODULE | Load a CModule (compiled C code) |
--toolchain CHOICE | CModule toolchain: any (default), internal, or external |
-c URI, --codeshare URI | Load script from Frida CodeShare (user/repo) |
-e CODE, --eval CODE | Evaluate CODE immediately (repeatable) |
-q | Quiet mode — no prompt; exit after -l and -e complete |
-t N, --timeout N | Seconds to wait before exiting in quiet mode; inf to run forever (default: 0) |
--pause | Leave main thread paused after spawning (do not auto-resume) |
-o FILE, --output FILE | Write log output to FILE |
--eternalize | Keep the script alive after the REPL exits |
--exit-on-error | Exit with code 1 on any unhandled script exception |
--kill-on-exit | Kill the spawned process when Frida exits |
--auto-reload | Auto-reload scripts and CModule on file change (default: on) |
--no-auto-reload | Disable auto-reload of scripts and CModule |
--auto-perform | Wrap entered REPL code with Java.perform() automatically |
Global Options
| Flag | Description |
|---|
-O FILE, --options-file FILE | Text file containing additional command line options |
--version | Print Frida version and exit |
Usage Examples
1# Attach to a local process by name
2frida Calculator
3
4# Attach to Safari on a USB-connected iOS device
5frida -U Safari
6
7# Spawn a binary and attach
8frida -f /usr/bin/ping
9
10# Load a script and attach to a process
11frida Calculator -l calc.js
12
13# Load a script, enable Node.js debugger (port 5858)
14frida Calculator -l calc.js --debug
15
16# Attach to an app by bundle ID on USB device
17frida -U -N com.apple.mobilesafari
18
19# Run in quiet/headless mode, evaluate one-liner, then exit
20frida -U -n Safari -e "console.log(ObjC.classes.length)" -q
21
22# Load a CodeShare script
23frida -U -f com.example.app -c "nowsecure/frida-jni-tracer"
24
25# Connect to a remote frida-server
26frida -H 192.168.1.10 -n Spotify
REPL Special Commands
| Command | Effect |
|---|
%reload | Manually reload the loaded script from disk |
<TAB> | Context-aware autocompletion |
Built-in REPL Objects
The REPL environment exposes the full Frida JavaScript API:
| Category | Objects |
|---|
| Core | Frida, Process, Module, Memory, Thread |
| Instrumentation | Interceptor, Stalker, MemoryAccessMonitor |
| Native types | NativePointer, NativeCallback, NativeFunction, ptr, NULL |
| ObjC | ObjC (iOS/macOS only) |
| Java/Android | Java, Dalvik (Android only) |
| Misc | File, Socket, DebugSymbol, Instruction, CpuContext |
| Messaging | send, recv |
| Timers | setTimeout, clearTimeout, setInterval, clearInterval, gc |
| Utilities | WeakRef, console, Proxy |
Notes
--debug starts a V8/QuickJS inspector on port 5858; connect with node-inspector or Chrome DevTools.--pause is only meaningful with -f (spawn mode); the process must be manually resumed in the REPL via %resume.-q with -t 0 (default) exits immediately after scripts finish; use -t inf for long-running headless sessions.--eternalize is useful when you want injected scripts to keep running after disconnecting the REPL.