{
  "added_at": "2026-10-17",
  "additional_evidence_urls": [
    "https://github.com/ChiChou/grapefruit/blob/b7176b409793a1395503fe78153e3b0ba888f77d/package.json",
    "https://github.com/ChiChou/grapefruit/blob/b7176b409793a1395503fe78153e3b0ba888f77d/src/lib/env.ts",
    "https://github.com/ChiChou/grapefruit/blob/b7176b409793a1395503fe78153e3b0ba888f77d/docs/llm.md",
    "https://github.com/ChiChou/grapefruit/blob/b7176b409793a1395503fe78153e3b0ba888f77d/LICENSE",
    "https://github.com/ChiChou/grapefruit/releases/tag/v1.1.2",
    "https://github.com/ChiChou/grapefruit/blob/05852a9b6e32dcc5f1c7e5ca8d91bfabc9d691b9/README.md"
  ],
  "category": "dynamic-analysis",
  "description_en": "Inspect and hook running iOS and Android apps from a Frida-based web interface, with method and crypto-API hooks, filesystem and SQLite browsers, iOS keychain and UI-hierarchy views, and HTTP capture from common networking libraries.",
  "description_zh": "通过基于 Frida 的 Web 界面检查并 Hook 运行中的 iOS 与 Android 应用，提供方法与加密 API 拦截、文件系统与 SQLite 浏览、iOS 钥匙串与界面层级查看，以及常见网络库的 HTTP 流量捕获。",
  "entry_url": "https://awesomerea.org/resources/grapefruit/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/grapefruit/",
  "evidence_url": "https://github.com/ChiChou/grapefruit/blob/b7176b409793a1395503fe78153e3b0ba888f77d/README.md",
  "group": "tools",
  "id": "grapefruit",
  "json_url": "https://awesomerea.org/resources/grapefruit/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/grapefruit/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/grapefruit/index.md",
  "name": "Grapefruit",
  "name_zh": "Grapefruit 移动应用动态插桩工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Requires a Frida server running on the target device, set up through Frida's iOS or Android guides; the reviewed release works with Frida 16 or 17 (default 17).",
    "Reviewed release: v1.1.2 (npm package igf), published 2026-03-30. The npm package requires Node.js >=22.18.0 and is not compatible with bunx; prebuilt binaries cover macOS arm64/x64, Linux x64 and Windows x64. The server binds to localhost port 31337 by default; the default-branch README warns that it has no built-in authentication.",
    "Optional AI features, including hook-script generation, use an LLM configured through LLM_* environment variables: Anthropic, OpenAI, Gemini, OpenRouter or an OpenAI-compatible endpoint such as local Ollama. Prompts are sent to the configured endpoint.",
    "Upstream deliberately ships no Frida-detection, certificate-pinning or jailbreak/root-detection bypasses and suggests combining it with dedicated bypass tooling for authorized assessments. The default branch was 47 commits ahead of v1.1.2 and adds Dart AOT snapshot exploration that the release README does not list. MIT-licensed."
  ],
  "requirements_zh": [
    "需在目标设备上运行 Frida server，并按照 Frida 官方 iOS 或 Android 指南完成配置；所审阅版本支持 Frida 16 或 17（默认 17）。",
    "所审阅版本为 v1.1.2（npm 包名 igf），发布于 2026-03-30。npm 包要求 Node.js >=22.18.0，且不兼容 bunx；预编译程序覆盖 macOS arm64/x64、Linux x64 和 Windows x64。服务默认绑定 localhost 的 31337 端口；默认分支 README 提醒其没有内置身份验证。",
    "可选的 AI 功能（包括生成 Hook 脚本）通过 LLM_* 环境变量配置模型：Anthropic、OpenAI、Gemini、OpenRouter，或本地 Ollama 等兼容 OpenAI 接口的端点；提示内容会发送到所配置的端点。",
    "上游有意不内置 Frida 检测、证书固定或越狱／root 检测的绕过功能，并建议在获得授权的评估中配合专门的绕过工具使用。默认分支比 v1.1.2 多 47 个提交，新增了发行版 README 未列出的 Dart AOT 快照浏览功能。采用 MIT 许可证。"
  ],
  "targets": [
    "app"
  ],
  "url": "https://github.com/ChiChou/grapefruit",
  "verification": "source-reviewed",
  "verified_at": "2026-10-17"
}