{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/fkie-cad/friTap/blob/d7398a153755c136005e932414592885348cf83d/README.md#L175-L198",
    "https://github.com/fkie-cad/friTap/blob/d7398a153755c136005e932414592885348cf83d/README.md#L200-L216",
    "https://github.com/fkie-cad/friTap/blob/d7398a153755c136005e932414592885348cf83d/USAGE.md",
    "https://github.com/fkie-cad/friTap/blob/d7398a153755c136005e932414592885348cf83d/EXAMPLE.md",
    "https://github.com/fkie-cad/friTap/blob/d7398a153755c136005e932414592885348cf83d/setup.py#L35-L40",
    "https://github.com/fkie-cad/friTap/blob/d7398a153755c136005e932414592885348cf83d/LICENSE",
    "https://github.com/fkie-cad/friTap/tree/d7398a153755c136005e932414592885348cf83d/integrations/wireshark",
    "https://github.com/fkie-cad/friTap/releases/tag/v2.5.2",
    "https://pypi.org/project/friTap/2.5.2/",
    "https://doi.org/10.1016/j.fsidi.2024.301766"
  ],
  "category": "protocol-analysis",
  "description_en": "Frida-based tool that hooks TLS libraries such as OpenSSL, BoringSSL, NSS and GnuTLS inside a running process and writes NSS key logs and decrypted payloads as PCAP, so analysts can inspect an application's encrypted traffic in Wireshark. For stripped or statically linked libraries it accepts byte patterns or offsets and can scan for renamed libraries, or it can recover TLS secrets by scanning heap memory instead of hooking. A terminal UI, a Python API and a Wireshark extcap integration wrap the same capture.",
  "description_zh": "基于 Frida 的工具，在运行中的进程内挂钩 OpenSSL、BoringSSL、NSS、GnuTLS 等 TLS 库，输出 NSS 格式的密钥日志和解密后的 PCAP 明文，便于分析者在 Wireshark 中检查应用的加密流量。对于去除符号或静态链接的库，可通过字节模式或偏移量定位函数、扫描被重命名的库，也可不挂钩而改为扫描堆内存来恢复 TLS 密钥。终端界面、Python API 和 Wireshark extcap 集成都基于同一套捕获功能。",
  "entry_url": "https://awesomerea.org/resources/fritap/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/fritap/",
  "evidence_url": "https://github.com/fkie-cad/friTap/blob/d7398a153755c136005e932414592885348cf83d/README.md",
  "group": "tools",
  "id": "fritap",
  "json_url": "https://awesomerea.org/resources/fritap/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/fritap/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/fritap/index.md",
  "name": "friTap",
  "name_zh": "friTap TLS 密钥提取与流量解密工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v2.5.2, uploaded to PyPI on 2026-09-29 and published on GitHub on 2026-10-04; the reviewed main commit is identical to that tag. The README describes Linux, Windows and Android as supported and macOS and iOS as partial and still under development, and says the Windows implementations were verified only on Windows 10.",
    "Installed with pip as fritap on Python 3.10+. friTap 2.x requires frida 17.x and frida-tools 14.x; devices with an older frida-server need a legacy friTap line installed through the documented constraints files. Mobile apps need a frida-server running on the device, and the Android walkthrough uses a rooted phone or emulator with adb in PATH; the desktop example attaches with sudo. libpcap or Npcap is needed only for full packet capture, and live Wireshark piping works only on Linux and macOS.",
    "Analysts name the process or app package to attach to or spawn. Coverage differs by library and platform: the README's support table marks many combinations as read/write hooks only, keys only or not yet implemented, so plaintext captures can be incomplete. Byte patterns for statically linked BoringSSL can come from the authors' separate BoringSecretHunter tool, which analyzes the user's own copy of the library.",
    "GPL-3.0; setup.py declares GPL-3.0-only while its inline comment says GPLv3 or later. The README presents the tool for malware analysis and application privacy research and asks users to cite the authors' 2024 Forensic Science International: Digital Investigation paper on TLS key material extraction."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v2.5.2，于 2026-09-29 上传至 PyPI，2026-10-04 在 GitHub 发布；所审阅的 main 提交与该标签完全一致。README 称已支持 Linux、Windows 和 Android，对 macOS 与 iOS 的支持仍不完整且在开发中，Windows 实现仅在 Windows 10 上验证过。",
    "在 Python 3.10+ 上通过 pip 安装 fritap。friTap 2.x 需要 frida 17.x 和 frida-tools 14.x；设备上的 frida-server 较旧时，需借助文档提供的约束文件安装旧版 friTap。分析移动应用需在设备上运行 frida-server，Android 演示使用已 root 的手机或模拟器，并要求 adb 位于 PATH 中；桌面示例使用 sudo 附加进程。只有完整抓包才需要 libpcap 或 Npcap，实时管道输出到 Wireshark 仅支持 Linux 和 macOS。",
    "分析者需指定要附加或启动的进程或应用包名。不同库和平台的覆盖程度不同：README 的支持表将许多组合标为仅读写挂钩、仅密钥或尚未实现，因此明文捕获可能不完整。静态链接 BoringSSL 所需的字节模式可由作者另行提供的 BoringSecretHunter 工具生成，该工具分析的是使用者自有的库文件副本。",
    "采用 GPL-3.0；setup.py 声明 GPL-3.0-only，但其行内注释写的是 GPLv3 或更高版本。README 将该工具定位于恶意软件分析和应用隐私研究，并请使用者引用作者 2024 年发表于 Forensic Science International: Digital Investigation 的 TLS 密钥材料提取论文。"
  ],
  "targets": [
    "app",
    "protocol"
  ],
  "url": "https://github.com/fkie-cad/friTap",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}