# Interruptor > Frida library, taken from the Dexcalibur project, that uses Frida’s Stalker to trace a process’s system calls and print strace-like lines with the calling thread, module and offset, decoded flag values and file paths resolved from descriptors. A trace can be limited to chosen modules and syscalls by name or pattern, started when a given library loads, extended with Interceptor-style per-syscall callbacks, and used to write drcov basic-block coverage files. The README documents Linux and Android on AArch64 and x64; the source also contains AArch32 Linux and macOS arm64 and x64 entry points. - Type: Tool - Targets: App · Binary - Category: Debugging and dynamic analysis - Relationship: Foundation tool - Sources reviewed: 2026-10-20 - Added to the catalog: 2026-11-02 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/interruptor/index.md) ## Requirements & limits - Latest npm release at review: @reversense/interruptor 1.0.12, published 2023-04-02; the newest GitHub release is v1.0.9 (2023-03-29). The reviewed main commit of 2026-09-23 adds unreleased changes, including refactored arm64 register handling and a preadv2/pwritev2 argument fix, without a version bump, and the README still calls the project a work in progress. - It is used inside the analyst’s own Frida agent: install the npm package, build from source with npm and TypeScript, or load a webpack-bundled per-architecture script. The README says passing a TypeScript agent directly to frida needs Frida 16 or later, and package.json depends on @types/frida-gum ^17.3.0. Android examples attach to a USB device with frida -U; the README warns that the CodeShare quick-start cannot be configured and may fail on obfuscated or multi-threaded apps. - The README’s support list names the Linux syscall API on AArch64 (SVC, with HVC marked work in progress) and x64 (SYSCALL); the AArch32 Linux and macOS factories in the source have no documented status. The agent tracer cannot follow child or multiple processes, and a standalone host-side tracer is marked TODO. Coverage needs an output path the target process can write. CI runs Mocha tests of the Linux AArch32 and arm64 factories on Node 16; no device test results are published. Intended for software the analyst is authorized to inspect. - package.json and the npm metadata declare GPL-3.0-only, but the LICENSE file is x64dbg’s modified GPL-3.0 text, whose added exception concerns x64dbg plugins rather than this project, so GitHub cannot classify it. The README also promotes the separate commercial Dexcalibur Pro. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. ## More in Native binaries - [dyld_cache_extract](https://awesomerea.org/resources/dyld-cache-extract/index.md) · Tool - [FLARE IDA Pro utilities](https://awesomerea.org/resources/flare-ida/index.md) · Tool - [Binlex](https://awesomerea.org/resources/binlex/index.md) · Tool - [Driver Buddy Reloaded](https://awesomerea.org/resources/driver-buddy-reloaded/index.md) · Tool - [FA (Firmware Analysis)](https://awesomerea.org/resources/fa-firmware-analysis/index.md) · Tool - [pyinstxtractor-ng (PyInstaller Extractor Next Generation)](https://awesomerea.org/resources/pyinstxtractor-ng/index.md) · Tool ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.