Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

Deluder

Frida-based interceptor for the traffic of proxy-unaware applications. JavaScript hook scripts on the send and receive functions of WinSock, Linux libc sockets, OpenSSL, GnuTLS and SChannel pass plaintext buffers to Python interceptor modules, which log them or forward them to a proxy for inspection. It spawns or attaches to a process, optionally through a remote frida-server, and was designed mainly as the backend for the author's PETEP proxy; a proxifier interceptor works with other proxy tools, and new scripts and interceptors can be added.

Targets
App · Protocol
Category
Protocol analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v1.2.1, published 2025-11-14; the reviewed main commit is identical to that tag. The changelog adds remote frida-server support in 1.1 and GnuTLS and Linux sockets in 1.2. The README lists the hooked functions for each library and their Windows, Linux and macOS module names; other libraries need custom Frida scripts.
  • Python 3.9+ with the pinned frida 16.4.10, psutil 6.0.0 and argparse 1.4.0. It is installed from a release or clone with setup.py, or run as a module after installing requirements.txt. Analysts choose the process to spawn or attach to by path, PID or name, remote targets need a frida-server for their platform, and child processes are hooked unless that is disabled.
  • Captured messages go to log, debug, proxifier or PETEP interceptors. PETEP integration uses its own protocol on port 8008 by default, and the proxifier frames data by length prefix, suffix or buffer size. The README warns that dropping intercepted messages is unsupported and breaks interception.
  • Scripts resolve exported functions in loaded modules whose names match a configurable list, so applications that link these libraries statically or use other TLS stacks need custom scripts. The tests directory has pytest cases for the PETEP and proxifier interceptors and for byte formatting. The reviewed tree has no CI workflow and no automated tests for the Frida hook scripts.
  • LICENSE.md is GPL-3.0.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · Warxim/deluder · Revision 068bb06
  2. CHANGELOG.md GitHub · Warxim/deluder · Revision 068bb06
  3. requirements.txt GitHub · Warxim/deluder · Revision 068bb06
  4. setup.cfg GitHub · Warxim/deluder · Revision 068bb06
  5. deluder/scripts/openssl.js GitHub · Warxim/deluder · Revision 068bb06
  6. deluder/scripts/common.js GitHub · Warxim/deluder · Revision 068bb06
  7. tests GitHub · Warxim/deluder · Revision 068bb06
  8. LICENSE.md GitHub · Warxim/deluder · Revision 068bb06
  9. https://github.com/Warxim/deluder/releases/tag/v1.2.1

More in Protocols

All 140 entries in Protocols

↑↓ move↵ open⌘↵ new tab