frida-trace

Trace functions matching a pattern in a process

$ frida-trace -i "[pattern]" [process_name]

$ frida-trace -I "[module]" [process_name]

$ frida-trace -m "[pattern]" [process_name]

$ frida-trace -U -f [com.example.app] -j "[pattern]"

$ frida-trace -T -f [/path/to/binary]

$ frida-trace -p [pid] -a "[module]![0xoffset]"

$ frida-trace -U --decorate -i "[pattern]" [app_name]

frida-trace [options] [target]

frida-trace is a tool for dynamically tracing function calls in running processes. It can hook native functions (C/C++), Objective-C methods, Swift functions, and Java methods, logging their invocation with arguments and return values.
When you trace a function, frida-trace auto-generates JavaScript handler stubs in a \_\_handlers\_\_/ directory that you can customize to log arguments, modify return values, or implement arbitrary instrumentation logic. If a handler file already exists, it will not be overwritten.
The include (-i, -I) and exclude (-x, -X) options are procedural; each operates on the current working set of functions, so their order matters.

-i FUNCTION, --include FUNCTION

Include [MODULE!]FUNCTION (glob pattern)

Exclude [MODULE!]FUNCTION (glob pattern)

Include all functions in MODULE (glob pattern)

Exclude all functions in MODULE (glob pattern)

Add function at OFFSET in MODULE (for stripped binaries)

Include the program's imports

Include MODULE's imports

Include Objective-C METHOD (glob pattern)

Exclude Objective-C METHOD (glob pattern)

Include Swift FUNC (glob pattern)

Exclude Swift FUNC (glob pattern)

Include Java METHOD (glob pattern)

Exclude Java METHOD (glob pattern)

Add module name to generated onEnter log statement

Do not format output messages

Dump messages to file

Path to JavaScript file used to initialize session

Spawn FILE as a new process

Attach to process by PID

Connect to USB device

Connect to device with the given ID

Tracing many functions with broad glob patterns (like **-i "\*") can severely slow down or freeze the target process. For stripped binaries without symbol information, you must use -a MODULE!OFFSET which requires prior knowledge of function offsets from static analysis tools like Ghidra or IDA Pro. The handler directory (\\handlers\\/**) is created in the current working directory; existing handlers are not overwritten, which can cause confusion if tracing targets change. Root or elevated privileges are required for cross-process injection.

frida-trace was one of the earliest tools built on top of the Frida core, included in the frida-tools package since Frida's public release in 2014. Its function tracing capability leverages Frida's Stalker code tracing component. Over the years, support was added for Objective-C methods, Swift functions, and Java methods, reflecting the tool's evolution alongside the mobile security research community.

frida(1), frida-ps(1), strace(1), ltrace(1)