How eysap/frida-il2cpp-trace works
Frida IL2CPP Trace is a terminal-driven runtime instrumentation tool. The user selects a target process and supplies class/method filters; the host attaches an agent, which discovers the selected class, filters its methods, installs hooks, inspects calls and return values, and reports events for terminal or JSONL output. The graph preserves the documented device, spawn, and output capabilities. Host CLI, configuration loading, and output details are represented from the tree and README; their internal wiring is not sampled, so those links are limited to documented workflow.
Main entry points: class-hooker.ts Hook workflow · session.ts Frida session · cli.ts CLI entry · hook-manager.ts Hook manager
Components 21
Host CLI
- CLI entry
src/host/cli.ts - Option parsing
src/host/options.ts - Config loading
src/host/config-loader.ts - Frida session
src/host/session.ts - Event output
src/host/output.ts
Agent instrumentation
- Hook workflow
src/tools/class-hooker.ts - Class discovery
src/agent/engine/discovery.ts - Method filtering
src/agent/engine/filtering.ts - Hook manager
src/agent/engine/hook-manager.ts - Value inspection
src/agent/engine/inspector.ts - Agent reporting
src/agent/message-reporter.ts - Agent bootstrap
src/agent/bootstrap.ts - Agent RPC
src/agent/index.ts
Shared contracts
- Config validation
src/shared/config.ts - Selectors
src/shared/selectors.ts - Event types
src/shared/events.ts
Runtime integration
- IL2CPP adapter
src/agent/runtime/il2cpp-adapter.ts
Other components
- Terminal user
- Hook configuration
examples/class-hooker.json - Frida runtime
- Unity target
Connections 27
- Terminal user → CLI entry: invokes
- Terminal user → Hook configuration: provides
- CLI entry → Option parsing: parses options
- CLI entry → Config loading: loads config
- Config loading → Config validation: validates
- CLI entry → Frida session: starts session
- CLI entry → Event output: selects output
- Frida session → Frida runtime: attaches and loads
- Frida runtime → Unity target: instruments
- Frida session → Agent RPC: calls agent
- Agent RPC → Agent bootstrap: starts or detaches
- Agent bootstrap → Hook workflow: runs workflow
- Hook workflow → Config validation: validates config
- Hook workflow → Class discovery: selects class
- Class discovery → IL2CPP adapter: finds classes
- Hook workflow → IL2CPP adapter: lists methods
- Hook workflow → Method filtering: filters methods
- Hook workflow → Hook manager: installs hooks
- Hook manager → IL2CPP adapter: attaches methods
- Hook manager → Value inspection: inspects values
- Hook manager → Agent reporting: reports events
- Class discovery → Agent reporting: reports selection
- Agent reporting → Event types: sends typed events
- Agent reporting → Frida session: sends agent messages
- Frida session → Event output: forwards events
- Frida session → Hook manager: detaches hooks
- Config validation → Selectors: uses selectors