Frida 17.22.0 extends its Swift ApiResolver to Linux and Windows

What happened on 2026-10-03

At 06:47 UTC on 2026-10-03, Frida published 17.22.0 on GitHub, with a same-day post on frida.re explaining it. The first change is library builds: frida-compile --library builds a library from TypeScript and pattern sources, so an npm package can ship its patterns with its code; frida-core exposes this as Compiler.build_library() and related calls. The second is the Swift ApiResolver, which was previously limited to Apple platforms and now works on Linux, followed by Windows support covering the Swift core library, metadata sections and how demangled names are freed. Swift tests now actually run on Linux CI. Other fixes include a crash in arm64 vector operand parsing and Windows section names of exactly eight characters that lacked a NUL terminator; section sizes now use the virtual size.

What it means for a defender's threat model

This release carries two lessons for defenders. First, Swift is no longer only an Apple-platform language in this tooling. Teams that ship Swift components on Linux or Windows should assume the same symbol- and metadata-level analysis available on Apple platforms now applies to those artifacts too. The metadata and mangled names that Swift binaries carry reveal semantic information about types and functions; the language runtime needs them, so they should not be treated as internal-only. Second, library builds make analysis scripts and structure descriptions easier to package and reuse, which can lower the cost of carrying analysis of one app version over to the next. The honest conclusion: symbol names and version-to-version churn are not protection. If core rules live only in the client, expect them to be understood.

Checks on your own builds

Start by inventorying the Swift artifacts you ship, including any Linux and Windows components. Use nm with swift demangle to review exported and retained symbols, and confirm that nothing like internal key names, debug entry points or leftover test code is exposed. Check that release configurations strip unnecessary debug information, while accepting that type metadata will remain. Move genuinely sensitive business decisions to the server and keep the client to presentation-level logic. After any stripping or obfuscation step, rerun functional tests on each target platform, because the Swift runtime depends on metadata and over-aggressive processing can break the app at runtime. Read release notes before upgrading your compiler or toolchain.

Your checklist

• Inventory retained symbols in shipped artifacts with nm and swift demangle
• Confirm release builds strip debug info, accepting that type metadata remains
• Rerun functional tests on every target platform after stripping or obfuscation