fwaeytens

=Frida interactive console=
C:\Python27\Scripts>frida notepad.exe
     ____
    / _  |   Frida 12.7.22 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .

fwaeytens

C:\Python27\Scripts>frida-trace.exe -i "CreateFile*" notepad.exe
Instrumenting functions...
CreateFileMappingFromApp: Loaded handler at "C:\\Python27\\Scripts\\__handlers__\\KERNELBASE.dll\\CreateFileMappingFromApp.js"
CreateFile2: Loaded handler at "C:\\Python27\\Scripts\\__handlers__\\KERNELBASE.dll\\CreateFile2.js"
CreateFileA: Loaded handler at "C:\\Python27\\Scripts\\__handlers__\\KERNELBASE.dll\\CreateFileA.js"
CreateFileMapping2: Loaded handler at "C:\\Python27\\Scripts\\__handlers__\\KERNELBASE.dll\\CreateFileMapping2.js"
CreateFileW: Loaded handler at "C:\\Python27\\Scripts\\__handlers__\\KERNELBASE.dll\\CreateFileW.js"
CreateFileMappingW: Loaded handler at "C:\\Python27\\Scripts\\__handlers__\\KERNELBASE.dll\\CreateFileMappingW.js"
CreateFileMappingNumaW: Loaded handler at "C:\\Python27\\Scripts\\__handlers__\\KERNELBASE.dll\\CreateFileMappingNumaW.js"
CreateFileMoniker: Loaded handler at "C:\\Python27\\Scripts\\__handlers__\\ole32.dll\\CreateFileMoniker.js"

fwaeytens

import frida
import sys


def on_message(message, data):
    if message['type'] == 'send':
        print(message['payload'])
    elif message['type'] == 'error':
        print(message['stack'])
    else: