{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/nowsecure/frida-trace/blob/9b92c1762373dcfc7458c34fa8f5826606bbcc8b/index.js",
    "https://github.com/nowsecure/frida-trace/blob/9b92c1762373dcfc7458c34fa8f5826606bbcc8b/package.json",
    "https://github.com/nowsecure/frida-trace/blob/9b92c1762373dcfc7458c34fa8f5826606bbcc8b/frida-trace-tools/package.json",
    "https://github.com/nowsecure/frida-trace/blob/9b92c1762373dcfc7458c34fa8f5826606bbcc8b/example/package.json",
    "https://github.com/nowsecure/frida-trace/blob/9b92c1762373dcfc7458c34fa8f5826606bbcc8b/LICENSE.md",
    "https://github.com/nowsecure/frida-trace/pull/40",
    "https://www.npmjs.com/package/frida-trace/v/4.0.1"
  ],
  "category": "dynamic-analysis",
  "description_en": "JavaScript library for Frida agents that traces native functions from a declarative description: each function is listed with its return type and input and output arguments, including pointers, UTF-8 and UTF-16 strings and byte arrays whose length is bound to another argument or the return value, with conditions such as reading an output pointer only when the call succeeds. It resolves the functions from a module's exports or a vtable, attaches Frida's Interceptor and hands one event per call to callbacks. Helper scripts in the same repository generate trace boilerplate from C headers through libclang.",
  "description_zh": "供 Frida 代理脚本使用的 JavaScript 库，按声明式描述跟踪原生函数：每个函数都列出返回类型及输入、输出参数，参数类型包括指针、UTF-8 与 UTF-16 字符串，以及长度绑定到其他参数或返回值的字节数组，还可设置条件，例如仅在调用成功时读取输出指针。它从模块导出表或虚函数表解析函数，挂接 Frida 的 Interceptor，并为每次调用向回调传递一个事件。同一仓库中的辅助脚本可借助 libclang 从 C 头文件生成跟踪样板代码。",
  "entry_url": "https://awesomerea.org/resources/nowsecure-frida-trace/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/nowsecure-frida-trace/",
  "evidence_url": "https://github.com/nowsecure/frida-trace/blob/9b92c1762373dcfc7458c34fa8f5826606bbcc8b/README.md",
  "group": "tools",
  "id": "nowsecure-frida-trace",
  "json_url": "https://awesomerea.org/resources/nowsecure-frida-trace/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/nowsecure-frida-trace/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/nowsecure-frida-trace/index.md",
  "name": "frida-trace (NowSecure library)",
  "name_zh": "frida-trace（NowSecure 声明式跟踪库）",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Not Frida's own frida-trace command-line tool, which shares the name. The latest npm release, 4.0.1 of 2025-06-16, matches the reviewed main commit 9b92c17 and ports the library to Frida 17; 4.0.0 of January 2024 moved it to ES modules.",
    "It runs inside an agent script that the user writes, compiles (for example with frida-compile) and loads into a process Frida can attach to; it has no command-line interface of its own. Types cover bool, byte, short, int, pointer, byte arrays, UTF-8, UTF-16 and C strings, and the captured values are only as accurate as the signatures the user declares.",
    "The header tools live in frida-trace-tools, version 3.3.0 in the repository and not published on npm; they need Node.js and frida-libclang, and the README still runs them from an older ./bin path. The bundled example host application and agent still depend on frida 16 and frida-trace ^3.0.0. The repository has no tests or CI.",
    "MIT. Instrumentation needs a target process the user is entitled to inspect."
  ],
  "requirements_zh": [
    "它不是 Frida 自带的同名命令行工具 frida-trace。npm 上最新版本为 4.0.1，发布于 2025-06-16，与所审阅的 main 分支提交 9b92c17 一致，将该库移植到 Frida 17；2024 年 1 月发布的 4.0.0 改为 ES 模块。",
    "它运行在用户自行编写、编译（例如使用 frida-compile）并加载到 Frida 可附加进程中的代理脚本里，本身没有命令行界面。支持的类型包括 bool、byte、short、int、指针、字节数组、UTF-8、UTF-16 和 C 字符串；捕获到的值是否准确，取决于用户声明的函数签名是否正确。",
    "头文件工具位于 frida-trace-tools，仓库中的版本为 3.3.0，未发布到 npm；需要 Node.js 和 frida-libclang，而 README 仍按旧的 ./bin 路径调用它们。仓库附带的示例宿主程序与代理仍依赖 frida 16 和 frida-trace ^3.0.0。仓库没有测试或持续集成。",
    "采用 MIT 许可。插桩所需的目标进程须是用户有权检查的进程。"
  ],
  "targets": [
    "app",
    "binary"
  ],
  "url": "https://github.com/nowsecure/frida-trace",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}