frida-discover

frida-discover

Tool for discovering internal functions inside a target process. It instruments the process at runtime, counts calls per function across all threads, then prints a ranked list. The output is typically piped into frida-trace for deeper tracing.

Prerequisites: frida-tools Python package (pip install frida-tools). For remote/USB targets, frida-server must be running on the target device.

Synopsis

frida-discover [options] target

target is a process name, PID, or bundle identifier, specified via the attach flags below.

Device Selection Options

FlagDescription
-D ID, --device IDConnect to device with the given ID (from frida-ls-devices)
-U, --usbConnect to USB-attached device
-R, --remoteConnect to remote frida-server (default host)
-H HOST, --host HOSTConnect to remote frida-server on HOST
--certificate CERTSpeak TLS with HOST, expecting CERTIFICATE
--origin ORIGINSet Origin header when connecting to remote server
--token TOKENAuthenticate with HOST using TOKEN
--keepalive-interval NKeepalive interval in seconds; 0 to disable (default: -1)
--p2pEstablish peer-to-peer connection with target
--stun-server ADDRESSSet STUN server ADDRESS (used with --p2p)
--relay addr,user,pass,turn-TYPEAdd TURN relay for --p2p (repeatable)
--device-option optionOverride backend-specific option (repeatable)

Target / Attach Options

FlagDescription
-f FILE, --file FILESpawn FILE and attach
-F, --attach-frontmostAttach to the frontmost application
-n NAME, --attach-name NAMEAttach to process by NAME
-N ID, --attach-identifier IDAttach to application by bundle/package identifier
-p PID, --attach-pid PIDAttach to process by PID
-W PATTERN, --await PATTERNAwait a spawn matching PATTERN (gated attach)
--realm REALMRealm to attach in: native (default) or emulated
--runtime RUNTIMEScript runtime: qjs (QuickJS) or v8

Global Options

FlagDescription
-O FILE, --options-file FILEText file containing additional command line options
--versionPrint Frida version and exit

Usage Examples

 1# Discover internal functions in a local process by name
 2frida-discover -n Spotify
 3
 4# Discover functions in a process on a USB device by PID
 5frida-discover -U -p 1234
 6
 7# Discover functions in a spawned binary
 8frida-discover -f /usr/bin/ssh
 9
10# Discover in an iOS app by bundle ID
11frida-discover -U -N com.apple.mobilesafari

Runtime Behavior

  1. Attach to the target process.
  2. Print: Injecting script...
  3. Print: Tracing N threads. Press ENTER to stop.
  4. Instrument all threads; accumulate per-function call counts.
  5. On ENTER: Print Stopping..., then print the results report.

Output Format

Results are grouped into two sections: Module Functions and Dynamic Functions.

Each section lists entries sorted by call count descending:

module_name
    Calls       Function
    ----------  ------------------------------
    42          sub_1234abcd
    17          sub_5678ef01
    ...

[Dynamic functions]
    Calls       Function
    ----------  ------------------------------
    8           0x7fff1a2b3c4d
    ...

Workflow: frida-discover + frida-trace

frida-discover is designed as a reconnaissance step before frida-trace:

1# Step 1: Identify hot functions
2frida-discover -n MyApp
3
4# Step 2: Trace a specific function found above
5frida-trace -n MyApp -a "libfoo.dylib!sub_1234abcd"

Notes