IGF CLI

Scope

Use IGF for platform-specific inspection (storage, keychain/keystore, manifests, frameworks) and managed captures with persisted evidence and hook snapshots. Use Frida's Python API or CLI for custom scripts, memory operations, threads, module/symbol enumeration, and basic process metadata. Attach a separate Frida session for that work.

The CLI and its daemon do not expose script.*, memory.*, threads.*, symbol.* (except platform-specific symbol.strings), info.processInfo, webview.evaluate, jsc.run, or rn.inject.

Commands

igf rpc [target options] <namespace.method> [args...]
igf session ls --json
igf session open [target options]
igf session close <id>
igf session gc
igf daemon stop
igf setup [--global]

Target options:

• --device <id> --platform <ios|android> --bundle <id> for an app.
• --device <id> --platform <ios|android> --pid <pid> [--name <name>] for a process.
• --session <id> to reuse an explicit daemon session.

Reuse the target supplied by the user. -L <label> selects an isolated daemon; --project <path> selects its data directory. --replace replaces an active iOS app session when needed. --json requests predictable machine output.

RPC arguments are positional JSON values or plain strings. Use the actual namespace and method names from agent/src/{fruity,droid}/router.ts and their exported modules; there are no igf agent, igf device, igf log, or igf history subcommands.

Examples

# Inspect app storage
igf rpc --device DEVICE --platform android --bundle com.example.app fs.roots
igf rpc --session SESSION fs.ls /data/user/0/com.example.app
igf rpc --session SESSION sqlite.tables /path/to/database
igf rpc --session SESSION sqlite.dump /path/to/database users

# Inspect app metadata
igf rpc --device DEVICE --platform android --bundle com.example.app app.info
igf rpc --device DEVICE --platform ios --bundle com.example.app info.plist

# Manage captures
igf rpc --session SESSION pins.list
igf rpc --session SESSION pins.start crypto
igf rpc --session SESSION pins.snapshot
igf rpc --session SESSION pins.stop crypto

Common pin IDs:

• Both: crypto, flutter, privacy.
• Android: http, jni, classloader, clipboard, broadcast, intent, sharedpref, pendingintent, sslpinning, webview.
• iOS: nsurl, xpc, sqlite, pasteboard, deviceid, biometric, fileops.

RPC acquires a short lease and releases it after the call. The daemon keeps the instrumentation session alive until idle collection closes it. Stop captures when finished and retrieve their persisted results.

Persisted Evidence and Device Discovery

The Web server is separate from the CLI daemon. Start igf --no-open with the same --project directory to query its REST API (default localhost:31337).

curl -s http://localhost:31337/api/devices
curl -s http://localhost:31337/api/device/DEVICE/apps
curl -s 'http://localhost:31337/api/history/crypto/DEVICE/com.example.app?limit=50'
curl -s 'http://localhost:31337/api/history/http/DEVICE/com.example.app?limit=50'
curl -s 'http://localhost:31337/api/history/nsurl/DEVICE/com.example.app?limit=50'

Additional history types include jni, flutter, xpc, privacy, and hermes. Hook records are at /api/hooks/DEVICE/IDENTIFIER. Consult src/routes/data.ts and src/routes/hermes.ts for filters and attachments. Present findings with actual captured evidence. Summarize large results and retrieve only the records needed.