# fpicker > Frida-based fuzzing suite for closed-source programs, listed here for its in-process instrumentation and coverage layer. A JavaScript harness injected with Frida starts Stalker at an analyst-chosen function and records the basic blocks executed in the target module on each call, feeding either AFL++'s coverage bitmap or fpicker's own standalone mode. Its passive mode works as a tracer: it attaches to a running process without sending inputs and stores each input that reaches the function together with new coverage, on the local host or on USB and network devices running frida-server. - Type: Tool - Targets: App · Binary - Category: Debugging and dynamic analysis - Relationship: Foundation tool - Sources reviewed: 2026-10-20 - Added to the catalog: 2026-11-02 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/fpicker/index.md) ## Requirements & limits - There are no releases or tags. The reviewed main commit, from 2025-07-24, moves the harness to the Frida 17 APIs, and the Makefile pins frida-core 17.2.14. The README points to a 2021 blog post for background and says fpicker builds on ToothPicker, developed during the author's master's thesis, and was mostly written at ERNW. - make fpicker-macos, fpicker-linux or fpicker-ios builds the C host program; the Makefile downloads the matching frida-core devkit from Frida's GitHub releases, although the README still describes placing the devkit files by hand. iOS builds use Xcode's iPhoneOS SDK on macOS, harness scripts are bundled with frida-compile, and AFL++ is needed only for AFL++ mode, built with USEMMAP on macOS and iOS. - Each target needs a hand-written harness that names the function where instrumentation starts and, for in-process input, how to call it, so that function and its arguments must first be identified in the target. The README warns that coverage becomes unreliable if the function runs more than once per iteration. Shared-memory communication is unavailable for USB-attached devices, and attach mode does not respawn a target that crashes. - Coverage covers basic blocks in the target module during the instrumented call, not a whole-program trace. The examples are small project-written C programs with seed inputs and slides from a WiSec 2021 tutorial; the repository has no automated tests or CI. - MIT; Frida and AFL++ are separate projects with their own licenses. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. ## More in Native binaries - [RetroWrite](https://awesomerea.org/resources/retrowrite/index.md) · Tool - [Interruptor](https://awesomerea.org/resources/interruptor/index.md) · Tool - [dyld_cache_extract](https://awesomerea.org/resources/dyld-cache-extract/index.md) · Tool - [FLARE IDA Pro utilities](https://awesomerea.org/resources/flare-ida/index.md) · Tool - [Binlex](https://awesomerea.org/resources/binlex/index.md) · Tool - [Driver Buddy Reloaded](https://awesomerea.org/resources/driver-buddy-reloaded/index.md) · Tool ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.