# Deluder

> Frida-based interceptor for the traffic of proxy-unaware applications. JavaScript hook scripts on the send and receive functions of WinSock, Linux libc sockets, OpenSSL, GnuTLS and SChannel pass plaintext buffers to Python interceptor modules, which log them or forward them to a proxy for inspection. It spawns or attaches to a process, optionally through a remote frida-server, and was designed mainly as the backend for the author's PETEP proxy; a proxifier interceptor works with other proxy tools, and new scripts and interceptors can be added.

- Type: Tool
- Targets: App · Protocol
- Category: Protocol analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-20
- Added to the catalog: 2026-11-02
- Original resource: <https://github.com/Warxim/deluder>
- Primary source: <https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/README.md>
- Catalog page: <https://awesomerea.org/resources/deluder/>
- Record JSON: <https://awesomerea.org/resources/deluder/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/deluder/index.md)

## Requirements & limits

- Latest release at review: v1.2.1, published 2025-11-14; the reviewed main commit is identical to that tag. The changelog adds remote frida-server support in 1.1 and GnuTLS and Linux sockets in 1.2. The README lists the hooked functions for each library and their Windows, Linux and macOS module names; other libraries need custom Frida scripts.
- Python 3.9+ with the pinned frida 16.4.10, psutil 6.0.0 and argparse 1.4.0. It is installed from a release or clone with setup.py, or run as a module after installing requirements.txt. Analysts choose the process to spawn or attach to by path, PID or name, remote targets need a frida-server for their platform, and child processes are hooked unless that is disabled.
- Captured messages go to log, debug, proxifier or PETEP interceptors. PETEP integration uses its own protocol on port 8008 by default, and the proxifier frames data by length prefix, suffix or buffer size. The README warns that dropping intercepted messages is unsupported and breaks interception.
- Scripts resolve exported functions in loaded modules whose names match a configurable list, so applications that link these libraries statically or use other TLS stacks need custom scripts. The tests directory has pytest cases for the PETEP and proxifier interceptors and for byte formatting. The reviewed tree has no CI workflow and no automated tests for the Frida hook scripts.
- LICENSE.md is GPL-3.0.

## Primary sources

1. <https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/README.md>
2. <https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/CHANGELOG.md>
3. <https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/requirements.txt>
4. <https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/setup.cfg>
5. <https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/deluder/scripts/openssl.js>
6. <https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/deluder/scripts/common.js>
7. <https://github.com/Warxim/deluder/tree/068bb06429fa053011a61b0c91c26b7bef0996ed/tests>
8. <https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/LICENSE.md>
9. <https://github.com/Warxim/deluder/releases/tag/v1.2.1>

## More in Protocols

- [PiCCANTE](https://awesomerea.org/resources/piccante/index.md) · Tool
- [VanBus](https://awesomerea.org/resources/vanbus/index.md) · Tool
- [Apple Continuity Reverse Engineering Toolkit](https://awesomerea.org/resources/apple-continuity-tools/index.md) · Tool
- [Cabana (standalone openpilot-cabana)](https://awesomerea.org/resources/openpilot-cabana/index.md) · Tool
- [eCapture](https://awesomerea.org/resources/ecapture/index.md) · Tool
- [USBPcap](https://awesomerea.org/resources/usbpcap/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.