Gum

Cross-platform instrumentation and introspection library written in C.

This library is consumed by frida-core through its JavaScript bindings, GumJS.

Provides:

• Instrumentation core
• Inline hooking: Interceptor
• Stealthy code tracing: Stalker

• Memory monitoring: MemoryAccessMonitor

• Cross-platform introspection

• Running threads and other process state
• Loaded modules, including their:
  • Imports
  • Exports
  • Symbols
• Memory scanning
• DebugSymbol lookups
• Backtracer implementations

• Kernel state (iOS only for now)

• Out-of-process dynamic linker for i/macOS: Gum.Darwin.Mapper

• Code generation:

• X86Writer
• ArmWriter
• ThumbWriter
• Arm64Writer

• MipsWriter

• Code relocation:

• X86Relocator
• ArmRelocator
• ThumbRelocator
• Arm64Relocator

• MipsRelocator

• Helper libraries for developers needing highly granular:

• Heap allocation tracking and leak checking.

• Profiling with worst-case inspector callback.

Build Instructions

Builds can be configured with the configure script. configure.bat is available for Windows users.

./configure --enable-gumpp --enable-gumjs --enable-tests
make

Run configure with --help to see all options.

Testing

Tests are built with make test and run with ./build/tests/gum-tests. You can specify a test path with -p to run a specific test or group of tests.

Test paths follow the pattern /<Area>/<Module>/<test_name> where the area/module come from TESTENTRY macros in the fixture files (e.g. TESTENTRY_WITH_FIXTURE("Core/Interceptor", ...)).

./build/tests/gum-tests
./build/tests/gum-tests -p /Core/Interceptor/attach_one

Binaries

Download a devkit for statically linking into your own projects from the Frida releases page.