frida_dsh_plugin

Frida makes dynamic instrumentation feel effortless, yet handing raw Frida capabilities directly to an LLM means one unapproved attach can touch a process that should never be touched. frida-dsh-plugin bridges that trust gap by wrapping Frida into a set of policy-constrained structured tools: the model only sees device aliases pre-configured by the deployer, remote addresses, credentials, and target allowlists are all locked at the policy layer, injection-class operations default into an approval chain, and fail closed when no approver is available.

Core capabilities span device discovery, process and application enumeration, attach and spawn, loading built-in templates or raw JavaScript, RPC calls, cursor-based event log reading, resuming or terminating suspended processes, and automatic resource cleanup on session end. Three capability tiers are provided: discovery (read-only), templates (audited template injection), and full (raw scripts plus process control). Handles are bound to the Agent that created them and cannot be reused by others. The backend defaults to frida-node inside the current Node process, with an optional persistent Python worker for environments where the device-side Frida version and the host Node version are mismatched.

It is built for security researchers and reverse engineers who work on devices they own or have explicit authorization to test, and who want an LLM to assist with repetitive instrumentation workflows such as module enumeration, export scanning, Java and Objective-C class discovery, and function hooking. It does not bypass device authorization, code signing, or debugging restrictions, nor does it emulate an interactive REPL; it provides structured tools that let the model complete well-defined tasks within policy boundaries.