0 Frida Gum Function Hook Example.md

Frida Gum Function Hook Example

The program demonstrates how to intercept (“hook”) a C function at runtime with Frida Gum. install_hook() replaces the original func() with my_func(), while keeping a pointer (orig_func) so the genuine implementation can still be called. After the test call, remove_hook() cleans everything up and de-initialises Frida.

Build

We need frida-gum-devkit. Please access frida/releases.

Build with gcc:

gcc main.c -I./frida -L./frida -lfrida-gum

How It Works

Step	What happens	Key API calls
1. Initialise	gum_init_embedded() embeds Frida into the current process and prepares Gum.	gum_init_embedded
2. Obtain interceptor	A GumInterceptor object manages all hook transactions.	gum_interceptor_obtain
3. Begin transaction	Hooks are grouped in a transactional block for safety.	gum_interceptor_begin_transaction
4. Replace target	func is replaced with my_func; Frida stores a thunk to the original code in orig_func.	gum_interceptor_replace
5. Commit	Ends the transaction, activating the hook.	gum_interceptor_end_transaction
6. Call test	func() now executes my_func(); that, in turn, invokes orig_func() so original behaviour still runs.	—
7. Remove hook	The replacement is reverted, all resources freed, and Frida de-initialises.	gum_interceptor_revert, gum_deinit_embedded

Possible Variants / Extensions

1. Attach instead of replace Use gum_interceptor_attach() when you want to run pre- or post-handlers without replacing the function entirely.

2. Pass user data The replacement_data slot can carry a custom struct for state sharing between the interceptor and its callbacks.

3. Hook multiple functions Begin a single transaction, call gum_interceptor_replace() (or attach()) for each target, then end the transaction; this keeps the program in a consistent state.

4. Cross-platform builds Frida Gum works on Linux, macOS, Windows, iOS, and Android. Condition-compile the gcc flags and Frida library path for portability.

5. Error handling Instead of exit(), propagate errors or throw exceptions so that the host program can decide how to continue.

These options let you adapt the basic template to more sophisticated instrumentation tasks while keeping the core hooking logic unchanged.

main.c

#include <frida-gum.h>
#include <stdio.h>
#include <stdlib.h>

/* Pointer to the original function */
static void (*orig_func)(void) = NULL;

/* Target function to be replaced */
static void func(void)
{
    fprintf(stderr, "hello func!\n");
}

/* Function that will be executed after the hook */
static void my_func(void)
{
    printf("[Gum] func called\n");

    if (orig_func == NULL) {
        printf("[Gum] error: orig_func == NULL\n");
    } else {
        orig_func();           /* Execute the original logic */
    }

    printf("[Gum]  -> returned\n");
}

static GumInterceptor *interceptor = NULL;

static void install_hook(void)
{
    gum_init_embedded();                       /* Initialise the Frida runtime */
    interceptor = gum_interceptor_obtain();

    gum_interceptor_begin_transaction(interceptor);

    gpointer target = (void *) func;

    GumReplaceReturn ret = gum_interceptor_replace(
        interceptor,
        target,                         /* function_address   */
        (void *) my_func,               /* replacement        */
        NULL,                           /* replacement_data   */
        (gpointer *) &orig_func         /* original_function  */
    );
    if (ret != GUM_REPLACE_OK) {
        fprintf(stderr, "replace failed: %d\n", ret);
        exit(EXIT_FAILURE);
    }

    gum_interceptor_end_transaction(interceptor);
}

static void remove_hook(void)
{
    gum_interceptor_begin_transaction(interceptor);
    gum_interceptor_revert(interceptor, (void *) func);  /* Specify the target function */
    gum_interceptor_end_transaction(interceptor);

    g_object_unref(interceptor);
    gum_deinit_embedded();
}

int main(void)
{
    install_hook();

    /* Test call */
    func();

    remove_hook();
    return 0;
}