![\"logo\"](\"gui/src/assets/logo.svg\"){kind=logo}
","directories":{},"_nodeVersion":"24.14.0","dependencies":{"hono":"^4.12.8","frida":"^17.8.2","frida16":"npm:frida@^16.7.19","socket.io":"^4.8.3","drizzle-orm":"^0.45.1","r2hermes-wasm":"file:./externals/radare/r2hermes.wasm","better-sqlite3":"^12.8.0","socket.io-client":"^4.8.3","@hono/node-server":"^1.19.11","frida-remote-stream":"^6.0.3","@types/better-sqlite3":"^7.6.13"},"_hasShrinkwrap":false,"devDependencies":{"tsdown":"^0.20.3","@types/bun":"^1.3.11","typescript":"^5.9.3","@types/node":"^24.12.0","drizzle-kit":"^0.31.9","@typescript/native-preview":"^7.0.0-dev.20260314.1"},"patchedDependencies":{"frida@17.6.2":"patches/frida@17.6.2.patch","frida@17.8.2":"patches/frida@17.8.2.patch","frida@16.7.19":"patches/frida@16.7.19.patch"},"trustedDependencies":["better-sqlite3","frida","frida16"],"_npmOperationalInternal":{"tmp":"tmp/igf_1.0.0_1774632036727_0.8940220598815796","host":"s3://npm-registry-packages-npm-production"}},"1.1.0":{"name":"igf","version":"1.1.0","keywords":["mobile","frida","ios","android","reverse engineering","instrumentation"],"author":"","license":"MIT","_id":"igf@1.1.0","maintainers":[{"name":"codecolorist","email":"codecolorist@gmail.com"}],"homepage":"https://github.com/ChiChou/grapefruit#readme","bugs":{"url":"https://github.com/ChiChou/grapefruit/issues"},"bin":{"igf":"dist/bin.mjs"},"dist":{"shasum":"dba96293c854e831fe4b4331c29cb10ff66b4b7e","tarball":"https://registry.npmjs.org/igf/-/igf-1.1.0.tgz","fileCount":178,"integrity":"sha512-rfTD4yIwx+aYLIF+98UDTL+GfMaymnJwwH6Zaa6yprMzOieK/GOTDTFm2lYZk6xiei5WYh+jGhuOSfaAoPSDzQ==","signatures":[{"sig":"MEQCIBShFTE+biI+ugaclyG1T7FhhTeYx53ODkso7jgKVRscAiBRWpbbP5yhePi5Jq2OSiikO0Q+UiE04QN1WmzLNbTv1A==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/igf@1.1.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":8507455},"main":"dist/index.mjs","type":"module","engines":{"node":">=22.18.0"},"gitHead":"7a6883dfd6abe51252e2eccb097c9174c7a36423","scripts":{"dev":"bun --watch src/index.ts","test":"bun --test","start":"bun src/index.ts","prepack":"npm run build:npm","prepare":"bun scripts/prepare.ts","dev:both":"node scripts/dev.ts","build:all":"bun i && bun scripts/build-bun.ts cross","build:cli":"bun i && bun scripts/build-bun.ts","build:npm":"node scripts/build-npm.ts && tsdown","install:gui":"cd gui && npm i","build:skills":"bun scripts/skills.ts","fetch:r2-wasm":"bun scripts/fetch-r2-wasm.ts","install:agent":"cd agent && npm i","test:coverage":"bun test --coverage --coverage-reporter=lcov --coverage-dir=coverage","test:coverage:text":"bun test --coverage"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:2abdd18b-1b3e-4c13-8e0c-d55e2a30ef06"}},"repository":{"url":"git+https://github.com/ChiChou/grapefruit.git","type":"git"},"_npmVersion":"11.9.0","description":"
\n \n
![\"iOS](\"docs/img/fruity.png\")
\n\n- Keychain access and modification\n- NSURL session traffic capture (HTTP/HTTPS/WebSocket)\n- WebView and JSContext inspection with JavaScript execution\n- UI hierarchy dump and element highlighting\n- Info.plist, entitlements, and binary cookie viewers\n- Biometric (Touch ID / Face ID) bypass\n- UserDefaults browser\n- Pasteboard and file operation monitoring\n- Geolocation spoofing\n- Device ID spoofing\n- Objective-C class and method inspection\n- Open file handles and network connections (lsof)\n- Security analysis (PIE, ARC, stack canaries, encryption)\n- Asset catalog viewer (Assets.car)\n- XPC/NSXPC message inspection\n\n### Android\n\n![\"Android](\"docs/img/droid.png\")
\n\n- AndroidManifest.xml decoder and component browser (activities, services, receivers, providers)\n- Android Keystore inspection with key attributes\n- Content provider query, insert, update, and delete\n- JNI call tracing with arguments, return values, and backtraces\n- Java class inspection (methods, fields, interfaces)\n- Intent building and launching\n- Open file handles and network connections (lsof)\n- HTTP traffic capture (OkHttp, Volley, URLConnection)\n- Resources browser\n- Clipboard and SharedPreferences monitoring\n- Broadcast receiver monitoring\n\n## Scope and Non-Goals\n\nThis project does not include built-in bypasses for anti-tampering protections:\n\n- Frida detection bypass\n- SSL/TLS certificate pinning bypass\n- Jailbreak or root detection bypass\n\n**Rationale:** RASP (Runtime Application Self-Protection) solutions evolve continuously to detect instrumentation frameworks. Maintaining effective bypasses requires ongoing effort to keep pace with new detection methods, introducing significant maintenance burden and potential stability issues. These bypasses are also highly application-specific, making general-purpose solutions fragile.\n\nRather than shipping brittle built-in bypasses, Grapefruit focuses on instrumentation and inspection capabilities that compose well with dedicated bypass tooling.\n\n**Recommended approaches** for authorized assessments where RASP bypass is required:\n\n1. **Frida Syscall Tracer** — Use `frida-strace` (Frida 17.8.0+) to trace system calls in the target process. This helps identify detection artifacts and determine what patches are needed before attaching Grapefruit:\n\n ```sh\n frida-strace -U -f com.example.app\n ```\n\n See the [Frida 17.8.0 release notes](https://frida.re/news/2026/03/09/frida-17-8-0-released/) for details.\n\n2. **Multi-session Architecture** — Frida supports multiple sessions attached to the same process. Spawn a separate session with your RASP bypass scripts first, then launch Grapefruit. When Grapefruit detects that the target app is already running, it attaches to the existing process rather than respawning it, preserving any bypasses already in effect.\n\n## Documentation\n\n- [Development](docs/dev.md)\n- [Architecture](docs/arch.md)\n- [RPC](docs/rpc.md)\n- [Acknowledgements](docs/oss.md)\n\n## License\n\n[MIT](LICENSE)\n","readmeFilename":"README.md"}