Frida 17.17.0: the Barebone agent can now run as a Linux kernel module

What happened on this date

At 00:22 UTC on 2026-08-05, Frida published 17.17.0 on GitHub, with the release page pointing to the project news. The news post from the same day describes a Barebone-focused release: the Barebone agent, written in Rust and embedding the GumJS devkit, previously ran only on XNU and can now also run as a Linux kernel module, exposing a character device for transport and reachable through a normal frida-server instance using the barebone device. The post uses a Pixel 6 Pro as its example and warns that the module only loads on the exact kernel build it was built for. The same release fixed a GumJS detach hang when a native fault was recovered by a later handler, made the arm64 Interceptor detect branches into the range being relocated, fixed several Python binding parameters, and added a soft-float bare-metal SDK with picolibc and compiler-rt, along with scalar fallbacks that avoid FP and SIMD code on soft-float targets.

Why it matters for people protecting app logic

For defenders the point is not any single feature but how concrete it makes a long-standing threat model: on a device the analyst fully controls, dynamic analysis can run at a more privileged layer than the app itself. Self-checks an app performs in user space are checks made inside an environment it cannot fully trust. To be precise, the release notes do not claim this bypasses any particular detection, and the prerequisites are demanding: you must be able to load a module built for the exact kernel, which in practice means a research device under the analyst's own control. It does not change what server-side verification can prove, and it does not make on-device checks worthless. It restates that local checks raise cost and should not be the only source of trust.

Concrete checks

First, write it into your threat model: an attacker may control the device down to the kernel, and on-device detection results are risk signals only. Second, check whether the client still carries secrets that fail the moment they are observed, such as API keys, signing private keys or complete billing rules, and move whatever you can to the server. Third, base every decision that affects entitlements or money on server-side verification, with the client only reporting. Fourth, when you run dynamic-analysis regression tests on your own test devices, record the tool versions used and re-test after new releases instead of carrying old conclusions forward.

Your checklist

• Assume in your threat model that attackers may control the kernel
• Inventory client-side secrets that fail once observed and move them
• Base entitlement and payment decisions on server-side checks
• Record tool versions in dynamic-analysis regression tests and re-test after releases