{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/CHANGELOG.md",
    "https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/requirements.txt",
    "https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/setup.cfg",
    "https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/deluder/scripts/openssl.js",
    "https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/deluder/scripts/common.js",
    "https://github.com/Warxim/deluder/tree/068bb06429fa053011a61b0c91c26b7bef0996ed/tests",
    "https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/LICENSE.md",
    "https://github.com/Warxim/deluder/releases/tag/v1.2.1"
  ],
  "category": "protocol-analysis",
  "description_en": "Frida-based interceptor for the traffic of proxy-unaware applications. JavaScript hook scripts on the send and receive functions of WinSock, Linux libc sockets, OpenSSL, GnuTLS and SChannel pass plaintext buffers to Python interceptor modules, which log them or forward them to a proxy for inspection. It spawns or attaches to a process, optionally through a remote frida-server, and was designed mainly as the backend for the author's PETEP proxy; a proxifier interceptor works with other proxy tools, and new scripts and interceptors can be added.",
  "description_zh": "基于 Frida 的拦截工具，用于捕获不支持代理设置的应用程序的流量。JavaScript 挂钩脚本作用于 WinSock、Linux libc 套接字、OpenSSL、GnuTLS 和 SChannel 的收发函数，将明文缓冲区交给 Python 拦截模块记录日志，或转发到代理中查看。它可启动或附加到进程，也可通过远程 frida-server 操作，主要作为作者 PETEP 代理的后端而设计；proxifier 拦截模块可配合其他代理工具使用，并可添加新的脚本和拦截模块。",
  "entry_url": "https://awesomerea.org/resources/deluder/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/deluder/",
  "evidence_url": "https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/README.md",
  "group": "tools",
  "id": "deluder",
  "json_url": "https://awesomerea.org/resources/deluder/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/deluder/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/deluder/index.md",
  "name": "Deluder",
  "name_zh": "Deluder 应用流量拦截工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v1.2.1, published 2025-11-14; the reviewed main commit is identical to that tag. The changelog adds remote frida-server support in 1.1 and GnuTLS and Linux sockets in 1.2. The README lists the hooked functions for each library and their Windows, Linux and macOS module names; other libraries need custom Frida scripts.",
    "Python 3.9+ with the pinned frida 16.4.10, psutil 6.0.0 and argparse 1.4.0. It is installed from a release or clone with setup.py, or run as a module after installing requirements.txt. Analysts choose the process to spawn or attach to by path, PID or name, remote targets need a frida-server for their platform, and child processes are hooked unless that is disabled.",
    "Captured messages go to log, debug, proxifier or PETEP interceptors. PETEP integration uses its own protocol on port 8008 by default, and the proxifier frames data by length prefix, suffix or buffer size. The README warns that dropping intercepted messages is unsupported and breaks interception.",
    "Scripts resolve exported functions in loaded modules whose names match a configurable list, so applications that link these libraries statically or use other TLS stacks need custom scripts. The tests directory has pytest cases for the PETEP and proxifier interceptors and for byte formatting. The reviewed tree has no CI workflow and no automated tests for the Frida hook scripts.",
    "LICENSE.md is GPL-3.0."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v1.2.1，发布于 2025-11-14；所审阅的 main 分支提交与该标签完全一致。更新日志显示 1.1 增加了远程 frida-server 支持，1.2 增加了 GnuTLS 和 Linux 套接字支持。README 列出了每个库被挂钩的函数及其在 Windows、Linux 和 macOS 上的模块名；其他库需要自定义 Frida 脚本。",
    "需要 Python 3.9+，并固定使用 frida 16.4.10、psutil 6.0.0 和 argparse 1.4.0。可从发布包或克隆的仓库用 setup.py 安装，也可在安装 requirements.txt 后以模块方式运行。分析者按路径、PID 或进程名指定要启动或附加的进程；远程目标需要运行对应平台的 frida-server；除非关闭该选项，子进程也会被自动挂钩。",
    "捕获的消息交给 log、debug、proxifier 或 PETEP 拦截模块处理。PETEP 集成使用自有协议，默认端口为 8008；proxifier 可按长度前缀、后缀或缓冲区大小划分数据。README 提醒不支持丢弃拦截到的消息，否则会破坏拦截。",
    "脚本在已加载模块中按可配置的名称列表查找导出函数，因此静态链接这些库或使用其他 TLS 实现的应用需要自定义脚本。tests 目录含针对 PETEP 和 proxifier 拦截模块及字节格式化的 pytest 用例。所审阅的源码树没有 CI 工作流，Frida 挂钩脚本也没有自动化测试。",
    "LICENSE.md 为 GPL-3.0。"
  ],
  "targets": [
    "app",
    "protocol"
  ],
  "url": "https://github.com/Warxim/deluder",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}