{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/ttdennis/fpicker/blob/04f4b06b6c7a209986594a51bd51c8d8af7a75ea/Makefile",
    "https://github.com/ttdennis/fpicker/blob/04f4b06b6c7a209986594a51bd51c8d8af7a75ea/harness/fuzzer.js",
    "https://github.com/ttdennis/fpicker/blob/04f4b06b6c7a209986594a51bd51c8d8af7a75ea/harness/stalker-instrumentation.js",
    "https://github.com/ttdennis/fpicker/blob/04f4b06b6c7a209986594a51bd51c8d8af7a75ea/examples/protocol_example/README.md",
    "https://github.com/ttdennis/fpicker/tree/04f4b06b6c7a209986594a51bd51c8d8af7a75ea/examples",
    "https://github.com/ttdennis/fpicker/blob/04f4b06b6c7a209986594a51bd51c8d8af7a75ea/LICENSE",
    "https://github.com/ttdennis/fpicker/commit/04f4b06b6c7a209986594a51bd51c8d8af7a75ea"
  ],
  "category": "dynamic-analysis",
  "description_en": "Frida-based fuzzing suite for closed-source programs, listed here for its in-process instrumentation and coverage layer. A JavaScript harness injected with Frida starts Stalker at an analyst-chosen function and records the basic blocks executed in the target module on each call, feeding either AFL++'s coverage bitmap or fpicker's own standalone mode. Its passive mode works as a tracer: it attaches to a running process without sending inputs and stores each input that reaches the function together with new coverage, on the local host or on USB and network devices running frida-server.",
  "description_zh": "基于 Frida 的闭源程序模糊测试套件，本条目收录的是其进程内插桩与覆盖率采集部分。经 Frida 注入的 JavaScript 测试框架会在分析者选定的函数处启动 Stalker，记录每次调用时目标模块中执行过的基本块，再提供给 AFL++ 的覆盖率位图或 fpicker 自己的独立模式。其被动模式相当于跟踪器：附加到正在运行的进程而不发送输入，并在出现新覆盖时保存到达该函数的输入及对应覆盖信息，可用于本机，也可用于通过 USB 或网络连接、运行 frida-server 的设备。",
  "entry_url": "https://awesomerea.org/resources/fpicker/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/fpicker/",
  "evidence_url": "https://github.com/ttdennis/fpicker/blob/04f4b06b6c7a209986594a51bd51c8d8af7a75ea/README.md",
  "group": "tools",
  "id": "fpicker",
  "json_url": "https://awesomerea.org/resources/fpicker/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/fpicker/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/fpicker/index.md",
  "name": "fpicker",
  "name_zh": "fpicker Frida 插桩与覆盖率采集套件",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "There are no releases or tags. The reviewed main commit, from 2025-07-24, moves the harness to the Frida 17 APIs, and the Makefile pins frida-core 17.2.14. The README points to a 2021 blog post for background and says fpicker builds on ToothPicker, developed during the author's master's thesis, and was mostly written at ERNW.",
    "make fpicker-macos, fpicker-linux or fpicker-ios builds the C host program; the Makefile downloads the matching frida-core devkit from Frida's GitHub releases, although the README still describes placing the devkit files by hand. iOS builds use Xcode's iPhoneOS SDK on macOS, harness scripts are bundled with frida-compile, and AFL++ is needed only for AFL++ mode, built with USEMMAP on macOS and iOS.",
    "Each target needs a hand-written harness that names the function where instrumentation starts and, for in-process input, how to call it, so that function and its arguments must first be identified in the target. The README warns that coverage becomes unreliable if the function runs more than once per iteration. Shared-memory communication is unavailable for USB-attached devices, and attach mode does not respawn a target that crashes.",
    "Coverage covers basic blocks in the target module during the instrumented call, not a whole-program trace. The examples are small project-written C programs with seed inputs and slides from a WiSec 2021 tutorial; the repository has no automated tests or CI.",
    "MIT; Frida and AFL++ are separate projects with their own licenses."
  ],
  "requirements_zh": [
    "项目没有发行版或标签。所审阅的 main 提交日期为 2025-07-24，将测试框架迁移到 Frida 17 API，Makefile 固定使用 frida-core 17.2.14。README 提供了一篇 2021 年博客文章作为背景，并称 fpicker 基于作者硕士论文期间开发的 ToothPicker，大部分在 ERNW 工作期间完成。",
    "make fpicker-macos、fpicker-linux 或 fpicker-ios 用于构建 C 语言主程序；Makefile 会从 Frida 的 GitHub 发行页下载对应的 frida-core 开发包，但 README 仍描述手动放置开发包文件的旧做法。iOS 构建需在 macOS 上使用 Xcode 的 iPhoneOS SDK；测试框架脚本用 frida-compile 打包；只有 AFL++ 模式需要 AFL++，在 macOS 和 iOS 上须以 USEMMAP 编译。",
    "每个目标都需要手写测试框架，指明插桩开始的函数，进程内输入时还需说明如何调用该函数，因此须先在目标中确定该函数及其参数。README 提醒，若该函数在一次迭代中运行多次，覆盖率信息会变得不可靠。通过 USB 连接的设备无法使用共享内存通信，附加模式下目标崩溃后也不会重新启动。",
    "覆盖率仅涵盖插桩调用期间目标模块内的基本块，并非整个程序的跟踪。示例为项目自行编写的小型 C 程序及种子输入，另附 WiSec 2021 教程的幻灯片；仓库没有自动化测试或 CI。",
    "采用 MIT 许可；Frida 和 AFL++ 是各自采用其许可证的独立项目。"
  ],
  "targets": [
    "app",
    "binary"
  ],
  "url": "https://github.com/ttdennis/fpicker",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}