subprojects: Prepare for release

- Make stdio handling compatible with musl by treating FILE as
  opaque and fixing stdin/stdout/stderr definitions.
- Improve Linux compatibility.
- Add Darwin dirent shim.
- Fix MSVC support.

.github/workflows/ci.yml

@@ -2,11 +2,15 @@ name: CI
 
 on:
   push:
-    branches:
-      - main
   pull_request:
     branches:
       - main
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to build/test"
+        required: false
+        type: string
 
 env:
   FRIDA_CORE_OPTIONS: '--with-devkits=core --enable-tests'
@@ -71,6 +75,7 @@ jobs:
         if: ${{ !startsWith(matrix.id, 'windows-') && matrix.id != 'linux-x86' }}
         run: |
           ./configure \
+              --host=${{ matrix.id }} \
               --enable-compiler-backend \
               ${{ env.FRIDA_CORE_OPTIONS }}
           make
@@ -205,7 +210,7 @@ jobs:
             /sbin/entropy
             cat /etc/motd
             export PS1='\u@frida:\w\$ '
-            /root/frida-tests
+            /root/tests/frida-tests
             status=\$?
             echo "exit status: \$status"
             if [ \$status -eq 0 ]; then
@@ -281,7 +286,8 @@ jobs:
             COPY initscript /tmp/initramfs/init
             RUN chmod +x /tmp/initramfs/init
 
-            COPY build/tests /tmp/initramfs/root/
+            COPY build/tests /tmp/initramfs/root/tests/
+            COPY build/lib/agent/frida-agent.so /tmp/initramfs/root/lib/agent/
             RUN find . | cpio -o --format=newc -R root:root > /root/initramfs.img
 
             COPY launch.sh /root/launch.sh
@@ -297,6 +303,7 @@ jobs:
       matrix:
         id:
           - ios-arm64
+          - ios-arm64-simulator
           - android-x86
           - android-x86_64
           - android-arm
@@ -341,6 +348,7 @@ jobs:
           name: core-devkit-${{ matrix.id }}
           path: build/src/devkit/
       - name: Package tests
+        if: false
         run: |
           mkdir -p /tmp/pkg
           cd build
@@ -360,7 +368,7 @@ jobs:
           esac
           tar -C /tmp/pkg -czf /tmp/runner.tar.gz .
       - name: Test on Corellium iOS device
-        if: matrix.id == 'ios-arm64'
+        if: false
         continue-on-error: true
         uses: frida/corellium-action@v4
         with:
@@ -376,7 +384,7 @@ jobs:
             tar xf $ASSET_PATH
             ./frida-tests
       - name: Test on Corellium Android device
-        if: matrix.id == 'android-arm64'
+        if: false
         continue-on-error: true
         uses: frida/corellium-action@v4
         with:
@@ -480,3 +488,134 @@ jobs:
           else
             echo "No unexpected changes detected."
           fi
+
+  xcframework:
+    name: Build FridaCore.xcframework
+    runs-on: macos-latest
+    needs:
+      - native
+      - mobile
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v4
+      - name: Download macOS/x86_64 devkit
+        uses: actions/download-artifact@v4
+        with:
+          name: core-devkit-macos-x86_64
+          path: devkits/macos-x86_64
+      - name: Download macOS/arm64 devkit
+        uses: actions/download-artifact@v4
+        with:
+          name: core-devkit-macos-arm64
+          path: devkits/macos-arm64
+      - name: Download iOS/arm64 devkit
+        uses: actions/download-artifact@v4
+        with:
+          name: core-devkit-ios-arm64
+          path: devkits/ios-arm64
+      - name: Download iOS/arm64-simulator devkit
+        uses: actions/download-artifact@v4
+        with:
+          name: core-devkit-ios-arm64-simulator
+          path: devkits/ios-arm64-simulator
+      - name: Create FridaCore.xcframework
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          mkdir -p devkits/macos-universal
+          lipo -create \
+              devkits/macos-x86_64/libfrida-core.a \
+              devkits/macos-arm64/libfrida-core.a \
+              -output devkits/macos-universal/libfrida-core.a
+
+          platforms=(
+            "macos-universal"
+            "ios-arm64"
+            "ios-arm64-simulator"
+          )
+
+          for platform in "${platforms[@]}"; do
+            mkdir -p "xcframework_headers/${platform}/FridaCore"
+          done
+
+          cp devkits/macos-x86_64/frida-core.h \
+              xcframework_headers/macos-universal/frida-core-x86_64.h
+          cp devkits/macos-arm64/frida-core.h \
+              xcframework_headers/macos-universal/frida-core-arm64.h
+
+          cat > xcframework_headers/macos-universal/frida-core.h <<'EOF'
+          #if defined (__x86_64__)
+          # include "frida-core-x86_64.h"
+          #elif defined (__arm64__)
+          # include "frida-core-arm64.h"
+          #else
+          # error "Unsupported macOS architecture for FridaCore"
+          #endif
+          EOF
+
+          cp devkits/ios-arm64/frida-core.h \
+              xcframework_headers/ios-arm64/frida-core.h
+          cp devkits/ios-arm64-simulator/frida-core.h \
+              xcframework_headers/ios-arm64-simulator/frida-core.h
+
+          for platform in "${platforms[@]}"; do
+            cat > "xcframework_headers/${platform}/FridaCore/module.modulemap" <<'EOF'
+          module FridaCore [extern_c] {
+            header "../frida-core.h"
+            export *
+          }
+          EOF
+          done
+
+          xcodebuild -create-xcframework \
+              -library devkits/macos-universal/libfrida-core.a \
+              -headers xcframework_headers/macos-universal \
+              -library devkits/ios-arm64/libfrida-core.a \
+              -headers xcframework_headers/ios-arm64 \
+              -library devkits/ios-arm64-simulator/libfrida-core.a \
+              -headers xcframework_headers/ios-arm64-simulator \
+              -output FridaCore.xcframework
+      - name: Upload FridaCore.xcframework
+        uses: actions/upload-artifact@v4
+        with:
+          name: FridaCore.xcframework
+          path: FridaCore.xcframework
+
+  publish-xcframework:
+    if: github.ref_type == 'tag'
+    runs-on: macos-latest
+    needs:
+      - xcframework
+    steps:
+      - name: Download FridaCore.xcframework artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: FridaCore.xcframework
+          path: dist
+      - name: Rewrap into FridaCore.xcframework directory
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd dist
+
+          mkdir -p FridaCore.xcframework
+
+          shopt -s dotglob
+          for f in *; do
+            if [[ "$f" != "FridaCore.xcframework" ]]; then
+              mv "$f" FridaCore.xcframework/
+            fi
+          done
+      - name: Zip FridaCore.xcframework
+        run: |
+          cd dist
+          zip -r FridaCore.xcframework.zip FridaCore.xcframework
+      - name: Create GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            dist/FridaCore.xcframework.zip
+          prerelease: ${{ contains(github.ref_name, 'snapshot') }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -1,5 +1,8 @@
 /build/
 /deps/
+/src/android-helper/build/
+/src/barebone/agent/target/
+/src/barebone/agent/xpacks/
 /src/barebone/helpers/memory-scanner/target/
 /src/barebone/helpers/target/
 /src/barebone/node_modules/
@@ -9,7 +12,6 @@
 /src/darwin/agent/osanalytics/osanalytics.js
 /src/darwin/agent/reportcrash/node_modules/
 /src/darwin/agent/reportcrash/reportcrash.js
-/src/droidy/helper/build/
 /src/fruity/helpers/build/
 /src/linux/agent/system-server/node_modules/
 /src/linux/agent/system-server/system-server.js

lib/agent/agent-glue.c

@@ -24,7 +24,9 @@ _frida_agent_environment_init (void)
   been_here = TRUE;
 #endif
 
-  gum_init_embedded ();
+#ifdef _MSC_VER
+  frida_libc_shim_init ();
+#endif
   gio_init ();
 
   g_thread_set_garbage_handler (_frida_agent_on_pending_thread_garbage, NULL);
@@ -54,13 +56,11 @@ _frida_agent_environment_deinit (void)
   glib_shutdown ();
 
   gio_deinit ();
-  gum_deinit_embedded ();
 
   frida_run_atexit_handlers ();
 
-# ifdef HAVE_DARWIN
-  /* Do what frida_deinit_memory() does on the other platforms. */
-  gum_internal_heap_unref ();
+# if defined (_MSC_VER) || defined (HAVE_DARWIN)
+  frida_libc_shim_deinit ();
 # endif
 #endif
 }

lib/agent/agent.vala

@@ -1400,12 +1400,12 @@ namespace Frida.Agent {
 				if (nb_api.unload_library == null)
 					parameters.append ("|eternal|sticky");
 				/*
-				 * Disable ExitMonitor to work around a bug in Android's libndk_translation.so on Android 11.
-				 * We need to avoid modifying libc.so ranges that the translator potentially depends on, to
-				 * avoid blowing up when Interceptor's CPU cache flush results in the translated code being
-				 * discarded, which seems like an edge-case the translator doesn't handle.
+				 * Disable Exceptor and ExitMonitor to work around a bug in Android's libndk_translation.so
+				 * on Android 11. We need to avoid modifying libc.so ranges that the translator potentially
+				 * depends on, to avoid blowing up when Interceptor's CPU cache flush results in the translated
+				 * code being discarded, which seems like an edge-case the translator doesn't handle.
 				 */
-				parameters.append ("|exit-monitor:off");
+				parameters.append ("|exceptor:off|exit-monitor:off");
 
 				emulated_bridge_state = new BridgeState (parameters.str);
 

lib/agent/meson.build

@@ -50,9 +50,9 @@ raw_agent = shared_library('frida-agent-raw', agent_sources,
   dependencies: [gio_dep, gee_dep, gum_dep, gumjs_dep, base_dep, pipe_dep, tls_provider_dep, payload_dep],
 )
 
-operations = ['--move', 'constructor', 'frida_init_memory', 'first']
+operations = ['--move', 'constructor', 'frida_libc_shim_init', 'first']
 if host_os_family != 'darwin'
-  operations += ['--move', 'destructor', 'frida_deinit_memory', 'first']
+  operations += ['--move', 'destructor', 'frida_libc_shim_deinit', 'first']
 endif
 modulated_agent = custom_target('frida-agent-modulated',
   input: raw_agent,

lib/base/buffer-glue.c

@@ -0,0 +1,12 @@
+#include "frida-base.h"
+
+GBytes *
+frida_make_bytes_with_owner (GType t_type,
+                             GBoxedCopyFunc t_dup_func,
+                             GDestroyNotify t_destroy_func,
+                             void * data,
+                             gsize size,
+                             gpointer owner)
+{
+  return g_bytes_new_with_free_func (data, size, t_destroy_func, owner);
+}

lib/base/buffer.vala

@@ -356,10 +356,20 @@ namespace Frida {
 			return *((int8 *) get_pointer (offset, sizeof (int8)));
 		}
 
+		public unowned Buffer write_int8 (size_t offset, int8 val) {
+			*((int8 *) get_pointer (offset, sizeof (int8))) = val;
+			return this;
+		}
+
 		public uint8 read_uint8 (size_t offset) {
 			return *get_pointer (offset, sizeof (uint8));
 		}
 
+		public unowned Buffer write_uint8 (size_t offset, uint8 val) {
+			*((uint8 *) get_pointer (offset, sizeof (uint8))) = val;
+			return this;
+		}
+
 		public int16 read_int16 (size_t offset) {
 			int16 val = *((int16 *) get_pointer (offset, sizeof (int16)));
 			return (byte_order == BIG_ENDIAN)
@@ -367,6 +377,14 @@ namespace Frida {
 				: int16.from_little_endian (val);
 		}
 
+		public unowned Buffer write_int16 (size_t offset, int16 val) {
+			int16 target_val = (byte_order == BIG_ENDIAN)
+				? val.to_big_endian ()
+				: val.to_little_endian ();
+			*((int16 *) get_pointer (offset, sizeof (int16))) = target_val;
+			return this;
+		}
+
 		public uint16 read_uint16 (size_t offset) {
 			uint16 val = *((uint16 *) get_pointer (offset, sizeof (uint16)));
 			return (byte_order == BIG_ENDIAN)
@@ -374,6 +392,14 @@ namespace Frida {
 				: uint16.from_little_endian (val);
 		}
 
+		public unowned Buffer write_uint16 (size_t offset, uint16 val) {
+			uint16 target_val = (byte_order == BIG_ENDIAN)
+				? val.to_big_endian ()
+				: val.to_little_endian ();
+			*((uint16 *) get_pointer (offset, sizeof (uint16))) = target_val;
+			return this;
+		}
+
 		public int32 read_int32 (size_t offset) {
 			int32 val = *((int32 *) get_pointer (offset, sizeof (int32)));
 			return (byte_order == BIG_ENDIAN)
@@ -381,6 +407,14 @@ namespace Frida {
 				: int32.from_little_endian (val);
 		}
 
+		public unowned Buffer write_int32 (size_t offset, int32 val) {
+			int32 target_val = (byte_order == BIG_ENDIAN)
+				? val.to_big_endian ()
+				: val.to_little_endian ();
+			*((int32 *) get_pointer (offset, sizeof (int32))) = target_val;
+			return this;
+		}
+
 		public uint32 read_uint32 (size_t offset) {
 			uint32 val = *((uint32 *) get_pointer (offset, sizeof (uint32)));
 			return (byte_order == BIG_ENDIAN)
@@ -403,6 +437,14 @@ namespace Frida {
 				: int64.from_little_endian (val);
 		}
 
+		public unowned Buffer write_int64 (size_t offset, int64 val) {
+			int64 target_val = (byte_order == BIG_ENDIAN)
+				? val.to_big_endian ()
+				: val.to_little_endian ();
+			*((int64 *) get_pointer (offset, sizeof (int64))) = target_val;
+			return this;
+		}
+
 		public uint64 read_uint64 (size_t offset) {
 			uint64 val = *((uint64 *) get_pointer (offset, sizeof (uint64)));
 			return (byte_order == BIG_ENDIAN)
@@ -446,7 +488,7 @@ namespace Frida {
 
 		public string read_fixed_string (size_t offset, size_t size) throws Error {
 			string * start = (string *) get_pointer (offset, size);
-			size_t max_length = size - offset;
+			size_t max_length = size_t.min (size, this.size - offset);
 			string * end = memchr (start, 0, max_length);
 			size_t n;
 			if (end != null)
@@ -465,6 +507,18 @@ namespace Frida {
 			return this;
 		}
 
+		public Bytes read_bytes (size_t offset, size_t size) {
+			var data = new uint8[size + 1];
+			Memory.copy (data, get_pointer (offset, size), size);
+			return new Bytes.take ((owned) data);
+		}
+
+		public unowned Buffer write_bytes (size_t offset, Bytes bytes) {
+			size_t size = bytes.get_size ();
+			Memory.copy (get_pointer (offset, size), bytes.get_data (), size);
+			return this;
+		}
+
 		private uint8 * get_pointer (size_t offset, size_t n) {
 			size_t minimum_size = offset + n;
 			assert (size >= minimum_size);
@@ -474,121 +528,127 @@ namespace Frida {
 	}
 
 	public sealed class BufferReader {
+		public size_t offset {
+			get {
+				return _offset;
+			}
+		}
+
 		public size_t available {
 			get {
-				return buffer.bytes.get_size () - offset;
+				return buffer.bytes.get_size () - _offset;
 			}
 		}
 
 		private Buffer buffer;
-		private size_t offset = 0;
+		private size_t _offset = 0;
 
 		public BufferReader (Buffer buf) {
 			buffer = buf;
 		}
 
-		public uint64 read_pointer (size_t offset) throws Error {
+		public uint64 read_pointer () throws Error {
 			var pointer_size = buffer.pointer_size;
 			check_available (pointer_size);
-			var ptr = buffer.read_pointer (offset);
-			offset += pointer_size;
+			var ptr = buffer.read_pointer (_offset);
+			_offset += pointer_size;
 			return ptr;
 		}
 
 		public int8 read_int8 () throws Error {
 			check_available (sizeof (int8));
-			var val = buffer.read_int8 (offset);
-			offset += sizeof (int8);
+			var val = buffer.read_int8 (_offset);
+			_offset += sizeof (int8);
 			return val;
 		}
 
 		public uint8 read_uint8 () throws Error {
 			check_available (sizeof (uint8));
-			var val = buffer.read_uint8 (offset);
-			offset += sizeof (uint8);
+			var val = buffer.read_uint8 (_offset);
+			_offset += sizeof (uint8);
 			return val;
 		}
 
 		public int16 read_int16 () throws Error {
 			check_available (sizeof (int16));
-			var val = buffer.read_int16 (offset);
-			offset += sizeof (int16);
+			var val = buffer.read_int16 (_offset);
+			_offset += sizeof (int16);
 			return val;
 		}
 
 		public uint16 read_uint16 () throws Error {
 			check_available (sizeof (uint16));
-			var val = buffer.read_uint16 (offset);
-			offset += sizeof (uint16);
+			var val = buffer.read_uint16 (_offset);
+			_offset += sizeof (uint16);
 			return val;
 		}
 
 		public int32 read_int32 () throws Error {
 			check_available (sizeof (int32));
-			var val = buffer.read_int32 (offset);
-			offset += sizeof (int32);
+			var val = buffer.read_int32 (_offset);
+			_offset += sizeof (int32);
 			return val;
 		}
 
 		public uint32 read_uint32 () throws Error {
 			check_available (sizeof (uint32));
-			var val = buffer.read_uint32 (offset);
-			offset += sizeof (uint32);
+			var val = buffer.read_uint32 (_offset);
+			_offset += sizeof (uint32);
 			return val;
 		}
 
 		public int64 read_int64 () throws Error {
 			check_available (sizeof (int64));
-			var val = buffer.read_int64 (offset);
-			offset += sizeof (int64);
+			var val = buffer.read_int64 (_offset);
+			_offset += sizeof (int64);
 			return val;
 		}
 
 		public uint64 read_uint64 () throws Error {
 			check_available (sizeof (uint64));
-			var val = buffer.read_uint64 (offset);
-			offset += sizeof (uint64);
+			var val = buffer.read_uint64 (_offset);
+			_offset += sizeof (uint64);
 			return val;
 		}
 
 		public float read_float () throws Error {
 			check_available (sizeof (float));
-			var val = buffer.read_float (offset);
-			offset += sizeof (float);
+			var val = buffer.read_float (_offset);
+			_offset += sizeof (float);
 			return val;
 		}
 
 		public double read_double () throws Error {
 			check_available (sizeof (double));
-			var val = buffer.read_double (offset);
-			offset += sizeof (double);
+			var val = buffer.read_double (_offset);
+			_offset += sizeof (double);
 			return val;
 		}
 
 		public string read_string () throws Error {
 			check_available (1);
-			var val = buffer.read_string (offset);
-			offset += val.length + 1;
+			var val = buffer.read_string (_offset);
+			_offset += val.length + 1;
 			return val;
 		}
 
 		public string read_fixed_string (size_t size) throws Error {
 			check_available (size);
-			var val = buffer.read_fixed_string (offset, size);
-			offset += size;
+			var val = buffer.read_fixed_string (_offset, size);
+			_offset += size;
 			return val;
 		}
 
 		public Bytes read_bytes (size_t size) throws Error {
 			check_available (size);
-			var val = buffer.bytes[offset:offset + size];
-			offset += size;
+			var val = buffer.bytes[_offset:_offset + size];
+			_offset += size;
 			return val;
 		}
 
 		public unowned BufferReader skip (size_t n) throws Error {
 			check_available (n);
-			offset += n;
+			_offset += n;
 			return this;
 		}
 
@@ -597,4 +657,6 @@ namespace Frida {
 				throw new Error.PROTOCOL ("Malformed buffer: truncated");
 		}
 	}
+
+	public extern Bytes make_bytes_with_owner<T> (void * data, size_t size, owned T? owner = null);
 }

lib/base/linux-syscall.h

@@ -56,6 +56,16 @@
 # else
 #  error Unexpected MIPS ABI
 # endif
+#elif defined (HAVE_RISCV)
+# if GLIB_SIZEOF_VOID_P == 8
+#  define SYS_process_vm_readv   270
+#  define SYS_process_vm_writev  271
+#  define SYS_memfd_create       279
+#  define SYS_pidfd_open         434
+#  define SYS_pidfd_getfd        438
+# else
+#  error RISC-V 32-bit not yet supported
+# endif
 #else
 # error FIXME
 #endif

lib/base/linux.vala

@@ -11,29 +11,6 @@ namespace Frida {
 		return (linux_major == major && linux_minor >= minor) || linux_major > major;
 	}
 
-	public class FileDescriptor : Object, FileDescriptorBased {
-		public int handle;
-
-		public FileDescriptor (int handle) {
-			this.handle = handle;
-		}
-
-		~FileDescriptor () {
-			if (handle != -1)
-				Posix.close (handle);
-		}
-
-		public int steal () {
-			int result = handle;
-			handle = -1;
-			return result;
-		}
-
-		public int get_fd () {
-			return handle;
-		}
-	}
-
 	public sealed class PidFileDescriptor : FileDescriptor {
 		private uint pid;
 

lib/base/meson.build

@@ -13,11 +13,19 @@ base_sources = [
   'socket.vala',
   'socket-glue.c',
   'buffer.vala',
+  'buffer-glue.c',
   'value.vala',
 ]
 
 extra_vala_args = []
 
+if host_os == 'windows'
+  base_sources += 'windows.vala'
+else
+  base_sources += 'posix.vala'
+  extra_vala_args += '--pkg=posix'
+endif
+
 if host_os == 'macos'
   base_sources += [
     'xpc.vala',
@@ -27,6 +35,7 @@ endif
 
 if host_os_family == 'darwin'
   base_sources += 'corefoundation.vala'
+  extra_vala_args += '--pkg=darwin-xnu'
 endif
 
 if host_os_family == 'linux'
@@ -34,13 +43,15 @@ if host_os_family == 'linux'
   extra_vala_args += [
     '--pkg=linux',
     '--pkg=linux-system',
-    '--pkg=posix',
   ]
 endif
 
+if host_os_family == 'freebsd'
+  extra_vala_args += '--pkg=freebsd'
+endif
+
 extra_deps = []
 if host_os_family != 'windows'
-  extra_vala_args += '--pkg=gio-unix-2.0'
   extra_deps += gio_unix_dep
 endif
 
@@ -48,6 +59,11 @@ base_vala_args = [gum_vala_args, '--pkg=gio-2.0', '--pkg=json-glib-1.0']
 if nice_dep.found()
   base_vala_args += '--pkg=nice'
 endif
+if host_os_family != 'windows'
+  base_vala_args += [
+    '--pkg=gio-unix-2.0',
+  ]
+endif
 if host_os_family == 'darwin'
   base_vala_args += [
     '--pkg=corefoundation',

lib/base/posix.vala

@@ -0,0 +1,203 @@
+namespace Frida {
+	public sealed class StdioPipes : Object {
+		public OutputStream? input {
+			get;
+			construct;
+		}
+
+		public InputStream output {
+			get;
+			construct;
+		}
+
+		public InputStream error {
+			get;
+			construct;
+		}
+
+		public StdioPipes (FileDescriptor? input, FileDescriptor output, FileDescriptor error) {
+			Object (
+				input: (input != null) ? new UnixOutputStream (ensure_nonblocking (input.steal ()), true) : null,
+				output: new UnixInputStream (ensure_nonblocking (output.steal ()), true),
+				error: new UnixInputStream (ensure_nonblocking (error.steal ()), true)
+			);
+		}
+
+		private static int ensure_nonblocking (int fd) {
+			try {
+				Unix.set_fd_nonblocking (fd, true);
+				return fd;
+			} catch (GLib.Error e) {
+				assert_not_reached ();
+			}
+		}
+	}
+
+	public class FileDescriptor : Object, FileDescriptorBased {
+		public int handle;
+
+		public FileDescriptor (int handle) {
+			this.handle = handle;
+		}
+
+		~FileDescriptor () {
+			if (handle != -1)
+				Posix.close (handle);
+		}
+
+		public int steal () {
+			int result = handle;
+			handle = -1;
+			return result;
+		}
+
+		public int get_fd () {
+			return handle;
+		}
+
+		public size_t pread (uint8[] buf, uint64 offset) throws Error {
+			while (true) {
+				ssize_t res = Posix.pread (handle, buf, buf.length, (Posix.off_t) offset);
+				if (res == -1) {
+					if (errno == Posix.EINTR)
+						continue;
+					throw new Error.TRANSPORT ("%s", strerror (errno));
+				}
+
+				return res;
+			}
+		}
+
+		public void pread_all (uint8[] buf, uint64 offset) throws Error {
+			size_t total = 0;
+
+			while (total < buf.length) {
+				void * dst = (uint8 *) buf + total;
+				size_t remaining = buf.length - total;
+
+				while (true) {
+					ssize_t res = Posix.pread (handle, dst, remaining, (Posix.off_t) (offset + total));
+					if (res == -1) {
+						if (errno == Posix.EINTR)
+							continue;
+						throw new Error.TRANSPORT ("%s", strerror (errno));
+					}
+
+					if (res == 0)
+						throw new Error.TRANSPORT ("Unexpected EOF: read %zu of %zu bytes", total, buf.length);
+
+					total += (size_t) res;
+					break;
+				}
+			}
+		}
+
+		public size_t pwrite (uint8[] buf, uint64 offset) throws Error {
+			while (true) {
+				ssize_t res = Posix.pwrite (handle, buf, buf.length, (Posix.off_t) offset);
+				if (res == -1) {
+					if (errno == Posix.EINTR)
+						continue;
+					throw new Error.TRANSPORT ("%s", strerror (errno));
+				}
+
+				return res;
+			}
+		}
+	}
+
+	public StdioPipes? make_stdio_pipes (Stdio stdio, bool in_supported, out FileDescriptor? in_fd, out string? in_name,
+			out FileDescriptor? out_fd, out string? out_name, out FileDescriptor? err_fd, out string? err_name) throws Error {
+		if (stdio == PIPE) {
+			FileDescriptor? in_write = null;
+			FileDescriptor? out_read, err_read;
+
+			if (in_supported) {
+				make_stdio_pipe (out in_fd, out in_write, out in_name);
+			} else {
+				in_fd = null;
+				in_name = null;
+			}
+			make_stdio_pipe (out out_read, out out_fd, out out_name);
+			make_stdio_pipe (out err_read, out err_fd, out err_name);
+
+			return new StdioPipes (in_write, out_read, err_read);
+		} else {
+			in_fd = null;
+			in_name = null;
+
+			out_fd = null;
+			out_name = null;
+
+			err_fd = null;
+			err_name = null;
+
+			return null;
+		}
+	}
+
+	public void make_stdio_pipe (out FileDescriptor read, out FileDescriptor write, out string? name = null) throws Error {
+#if HAVE_OPENPTY
+		int rfd = -1, wfd = -1;
+		char buf[Posix.Limits.PATH_MAX];
+		var res =
+#if DARWIN
+			Darwin.XNU.openpty (out rfd, out wfd, buf, null, null)
+#elif LINUX
+			Linux.openpty (out rfd, out wfd, buf, null, null)
+#elif FREEBSD
+			FreeBSD.openpty (out rfd, out wfd, buf, null, null)
+#endif
+			;
+		if (res == -1)
+			throw new Error.NOT_SUPPORTED ("Unable to open PTY: %s", strerror (errno));
+		name = (string) buf;
+
+		enable_close_on_exec (rfd);
+		enable_close_on_exec (wfd);
+
+		disable_sigpipe (rfd);
+		disable_sigpipe (wfd);
+
+		configure_terminal_attributes (rfd);
+
+		read = new FileDescriptor (rfd);
+		write = new FileDescriptor (wfd);
+#else
+		name = null;
+
+		try {
+			int fds[2];
+			Unix.open_pipe (fds, Posix.FD_CLOEXEC);
+
+			read = new FileDescriptor (fds[0]);
+			write = new FileDescriptor (fds[1]);
+		} catch (GLib.Error e) {
+			throw new Error.NOT_SUPPORTED ("Unable to open pipe: %s", e.message);
+		}
+#endif
+	}
+
+#if HAVE_OPENPTY
+	private void enable_close_on_exec (int fd) {
+		Posix.fcntl (fd, Posix.F_SETFD, Posix.fcntl (fd, Posix.F_GETFD) | Posix.FD_CLOEXEC);
+	}
+
+	private void disable_sigpipe (int fd) {
+#if DARWIN
+		Posix.fcntl (fd, Darwin.XNU.F_SETNOSIGPIPE, true);
+#endif
+	}
+
+	private void configure_terminal_attributes (int fd) {
+		var tios = Posix.termios ();
+		Posix.tcgetattr (fd, out tios);
+
+		tios.c_oflag &= ~Posix.ONLCR;
+		tios.c_cflag = (tios.c_cflag & Posix.CLOCAL) | Posix.CS8 | Posix.CREAD | Posix.HUPCL;
+		tios.c_lflag &= ~Posix.ECHO;
+
+		Posix.tcsetattr (fd, 0, tios);
+	}
+#endif
+}

lib/base/promise.vala

@@ -46,7 +46,8 @@ namespace Frida {
 			}
 			private GLib.Error? _error;
 
-			private Gee.ArrayQueue<CompletionFuncEntry> on_complete;
+			private Gee.ArrayQueue<CompletionFuncEntry>? on_complete;
+			private Gee.ArrayQueue<ThenHandlerEntry<T>>? on_then;
 
 			public async T wait_async (Cancellable? cancellable) throws Frida.Error, IOError {
 				if (_ready)
@@ -74,7 +75,21 @@ namespace Frida {
 				return get_result ();
 			}
 
-			private T get_result () throws Frida.Error, IOError {
+			public void then (owned FutureCompletionHandler<T> handler) {
+				if (_ready) {
+					schedule (() => {
+						handler (this);
+						return Source.REMOVE;
+					});
+					return;
+				}
+
+				if (on_then == null)
+					on_then = new Gee.ArrayQueue<ThenHandlerEntry<T>> ();
+				on_then.offer (new ThenHandlerEntry<T> ((owned) handler));
+			}
+
+			public T get_result () throws Frida.Error, IOError {
 				if (error != null) {
 					if (error is Frida.Error)
 						throw (Frida.Error) error;
@@ -111,19 +126,32 @@ namespace Frida {
 			internal void transition_to_ready () {
 				_ready = true;
 
-				if (on_complete != null && !on_complete.is_empty) {
-					var source = new IdleSource ();
-					source.set_priority (Priority.HIGH);
-					source.set_callback (() => {
-						CompletionFuncEntry? entry;
-						while ((entry = on_complete.poll ()) != null)
-							entry.func ();
-						on_complete = null;
-						return false;
+				if (on_complete != null || on_then != null) {
+					schedule (() => {
+						if (on_complete != null) {
+							CompletionFuncEntry? entry;
+							while ((entry = on_complete.poll ()) != null)
+								entry.func ();
+							on_complete = null;
+						}
+
+						if (on_then != null) {
+							ThenHandlerEntry? entry;
+							while ((entry = on_then.poll ()) != null)
+								entry.handler (this);
+							on_then = null;
+						}
+
+						return Source.REMOVE;
 					});
-					source.attach (MainContext.get_thread_default ());
 				}
 			}
+
+			private static void schedule (owned SourceFunc function) {
+				var source = new IdleSource ();
+				source.set_callback ((owned) function);
+				source.attach (MainContext.get_thread_default ());
+			}
 		}
 
 		private class CompletionFuncEntry {
@@ -133,6 +161,14 @@ namespace Frida {
 				this.func = (owned) func;
 			}
 		}
+
+		private class ThenHandlerEntry<T> {
+			public FutureCompletionHandler<T> handler;
+
+			public ThenHandlerEntry (owned FutureCompletionHandler<T> handler) {
+				this.handler = (owned) handler;
+			}
+		}
 	}
 
 	public interface Future<T> : Object {
@@ -140,5 +176,9 @@ namespace Frida {
 		public abstract T? value { get; }
 		public abstract GLib.Error? error { get; }
 		public abstract async T wait_async (Cancellable? cancellable) throws Frida.Error, IOError;
+		public abstract void then (owned FutureCompletionHandler<T> handler);
+		public abstract T get_result () throws Frida.Error, IOError;
 	}
+
+	public delegate void FutureCompletionHandler<T> (Future<T> future);
 }

lib/base/session-glue.c

@@ -30,7 +30,7 @@ _frida_query_windows_computer_name (void)
   return g_utf16_to_utf8 (buffer, -1, NULL, NULL, NULL);
 }
 
-#elif defined (HAVE_IOS) || defined (HAVE_TVOS)
+#elif defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 
 #include <CoreFoundation/CoreFoundation.h>
 #include <dlfcn.h>

lib/base/session.vala

@@ -749,6 +749,19 @@ namespace Frida {
 		}
 	}
 
+	[DBus (name = "re.frida.GadgetSession17")]
+	public interface GadgetSession : Object {
+		public abstract async void break_and_resume (Cancellable? cancellable) throws GLib.Error;
+		public abstract async void break_and_detach (Cancellable? cancellable) throws GLib.Error;
+	}
+
+	public enum GadgetBreakpointAction {
+		INVOKE_RETURN,
+		RESUME,
+		DETACH,
+		PAGE_PLAN,
+	}
+
 	[DBus (name = "re.frida.Channel17")]
 	public interface Channel : Object {
 		public abstract async void close (Cancellable? cancellable) throws GLib.Error;
@@ -1952,6 +1965,8 @@ namespace Frida {
 		id = "watchos";
 #elif TVOS
 		id = "tvos";
+#elif XROS
+		id = "xros";
 #elif ANDROID
 		id = "android";
 #elif FREEBSD
@@ -2119,6 +2134,7 @@ namespace Frida {
 		public const string AGENT_SESSION = "/re/frida/AgentSession";
 		public const string AGENT_CONTROLLER = "/re/frida/AgentController";
 		public const string AGENT_MESSAGE_SINK = "/re/frida/AgentMessageSink";
+		public const string GADGET_SESSION = "/re/frida/GadgetSession";
 		public const string CHANNEL = "/re/frida/Channel";
 		public const string SERVICE = "/re/frida/Service";
 		public const string TRANSPORT_BROKER = "/re/frida/TransportBroker";

lib/base/value.vala

@@ -57,6 +57,22 @@ namespace Frida {
 			push_scope (v);
 		}
 
+		public string[] list_members () throws Error {
+			var scope = peek_scope ();
+			if (scope.dict == null)
+				throw new Error.PROTOCOL ("Dictionary expected, but at %s", scope.val.print (true));
+
+			var members = new Gee.ArrayList<string> ();
+			foreach (var item in scope.val) {
+				string k;
+				Variant v;
+				item.get ("{sv}", out k, out v);
+
+				members.add (k);
+			}
+			return members.to_array ();
+		}
+
 		public bool has_member (string name) throws Error {
 			var scope = peek_scope ();
 			if (scope.dict == null)

lib/base/windows.vala

@@ -0,0 +1,22 @@
+namespace Frida {
+	public sealed class StdioPipes : Object {
+		public OutputStream input {
+			get;
+			construct;
+		}
+
+		public InputStream output {
+			get;
+			construct;
+		}
+
+		public InputStream error {
+			get;
+			construct;
+		}
+
+		public StdioPipes (OutputStream input, InputStream output, InputStream error) {
+			Object (input: input, output: output, error: error);
+		}
+	}
+}

lib/gadget/gadget-darwin.m

@@ -1,9 +1,25 @@
+#if defined (HAVE_TVOS) || defined (HAVE_WATCHOS)
+# include <Availability.h>
+# undef __TVOS_PROHIBITED
+# define __TVOS_PROHIBITED
+# undef __WATCHOS_PROHIBITED
+# define __WATCHOS_PROHIBITED
+#endif
+
 #include "frida-gadget.h"
 
+#include "frida-base.h"
+
 #import <Foundation/Foundation.h>
+#include <gum/gumdarwin.h>
+#include <mach-o/loader.h>
 #include <objc/runtime.h>
 #include <pthread.h>
 
+static void frida_on_breakpoints_steal_attempt (GumInvocationContext * ic, gpointer user_data);
+
+static GumInvocationListener * frida_dont_steal_my_breakpoints;
+
 gchar *
 frida_gadget_environment_detect_bundle_id (void)
 {
@@ -27,7 +43,7 @@ frida_gadget_environment_detect_bundle_name (void)
 gchar *
 frida_gadget_environment_detect_documents_dir (void)
 {
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   @autoreleasepool
   {
     NSArray<NSString *> * paths = NSSearchPathForDirectoriesInDomains (NSDocumentDirectory, NSUserDomainMask, YES);
@@ -51,3 +67,152 @@ frida_gadget_environment_set_thread_name (const gchar * name)
   /* For now only implemented on i/macOS as Fruity.Injector relies on it there. */
   pthread_setname_np (name);
 }
+
+void
+frida_gadget_environment_detect_darwin_location_fields (GumAddress our_address, gchar ** executable_name, gchar ** our_path,
+    GumMemoryRange ** our_range)
+{
+  mach_port_t task;
+  GumDarwinModuleResolver * resolver;
+  GPtrArray * modules;
+  guint i;
+
+  task = mach_task_self ();
+
+  resolver = gum_darwin_module_resolver_new (task, NULL);
+  if (resolver == NULL)
+    return;
+
+  gum_darwin_module_resolver_fetch_modules (resolver, &modules, NULL);
+
+  for (i = 0; i != modules->len; i++)
+  {
+    GumModule * module;
+    const GumMemoryRange * range;
+
+    module = g_ptr_array_index (modules, i);
+    range = gum_module_get_range (module);
+
+    if (*executable_name == NULL)
+    {
+      gum_mach_header_t * header = GSIZE_TO_POINTER (range->base_address);
+      if (header->filetype == MH_EXECUTE)
+        *executable_name = g_strdup (gum_module_get_name (module));
+    }
+
+    if (our_address >= range->base_address && our_address < range->base_address + range->size)
+    {
+      if (*our_path == NULL)
+        *our_path = g_strdup (gum_module_get_path (module));
+
+      if (*our_range == NULL)
+        *our_range = gum_memory_range_copy (range);
+    }
+
+    if (*executable_name != NULL && *our_path != NULL && *our_range != NULL)
+      break;
+  }
+
+  g_ptr_array_unref (modules);
+
+  g_object_unref (resolver);
+}
+
+void
+frida_gadget_environment_ensure_debugger_breakpoints_only (void)
+{
+  task_set_exception_ports (
+      mach_task_self (),
+      EXC_MASK_ALL & ~EXC_MASK_BREAKPOINT,
+      MACH_PORT_NULL,
+      EXCEPTION_DEFAULT,
+      THREAD_STATE_NONE
+  );
+
+  if (gum_process_get_code_signing_policy () == GUM_CODE_SIGNING_OPTIONAL &&
+      frida_dont_steal_my_breakpoints == NULL &&
+      gum_darwin_is_debugger_mapping_enforced ())
+  {
+    gpointer exceptions_set, exceptions_swap;
+    GumInterceptor * interceptor;
+
+    exceptions_set = &task_set_exception_ports;
+    exceptions_swap = &task_swap_exception_ports;
+
+    frida_dont_steal_my_breakpoints = gum_make_call_listener (frida_on_breakpoints_steal_attempt,
+      NULL, NULL, NULL);
+
+    interceptor = gum_interceptor_obtain ();
+
+    gum_interceptor_attach (interceptor, exceptions_set, frida_dont_steal_my_breakpoints,
+        NULL, GUM_ATTACH_FLAGS_NONE);
+    gum_interceptor_attach (interceptor, exceptions_swap, frida_dont_steal_my_breakpoints,
+        NULL, GUM_ATTACH_FLAGS_NONE);
+
+    g_object_unref (interceptor);
+  }
+}
+
+void
+frida_gadget_environment_allow_stolen_breakpoints (void)
+{
+  GumInterceptor * interceptor;
+
+  if (frida_dont_steal_my_breakpoints == NULL)
+    return;
+
+  interceptor = gum_interceptor_obtain ();
+
+  gum_interceptor_detach (interceptor, frida_dont_steal_my_breakpoints);
+
+  g_object_unref (frida_dont_steal_my_breakpoints);
+  frida_dont_steal_my_breakpoints = NULL;
+
+  g_object_unref (interceptor);
+}
+
+static void
+frida_on_breakpoints_steal_attempt (GumInvocationContext * ic, gpointer user_data)
+{
+  exception_mask_t exception_mask;
+
+  exception_mask = GPOINTER_TO_SIZE (gum_invocation_context_get_nth_argument (ic, 1));
+  exception_mask &= ~EXC_MASK_BREAKPOINT;
+  gum_invocation_context_replace_nth_argument (ic, 1, GSIZE_TO_POINTER (exception_mask));
+}
+
+void
+frida_gadget_environment_break_and_resume (void)
+{
+#ifdef HAVE_ARM64
+  asm volatile (
+      "mov x1, #1337\n\t"
+      "mov x2, #1337\n\t"
+      "mov x3, %0\n\t"
+      "brk #1337\n\t"
+      :
+      : "r" ((gsize) FRIDA_GADGET_BREAKPOINT_ACTION_RESUME)
+      : "x1", "x2", "x3"
+  );
+#else
+  g_assert_not_reached ();
+#endif
+}
+
+void
+frida_gadget_environment_break_and_detach (void)
+{
+#ifdef HAVE_ARM64
+  asm volatile (
+      "mov x1, #1337\n\t"
+      "mov x2, #1337\n\t"
+      "mov x3, %0\n\t"
+      "brk #1337\n\t"
+      :
+      : "r" ((gsize) FRIDA_GADGET_BREAKPOINT_ACTION_DETACH)
+      : "x1", "x2", "x3"
+  );
+#else
+  g_assert_not_reached ();
+#endif
+}

lib/gadget/gadget-glue.c

@@ -84,7 +84,9 @@ frida_on_unload (void)
 void
 frida_gadget_environment_init (void)
 {
-  gum_init_embedded ();
+#ifdef _MSC_VER
+  frida_libc_shim_init ();
+#endif
   gio_init ();
 
   g_thread_set_garbage_handler (_frida_gadget_on_pending_thread_garbage, NULL);
@@ -136,13 +138,11 @@ frida_gadget_environment_deinit (void)
   glib_shutdown ();
 
   gio_deinit ();
-  gum_deinit_embedded ();
 
   frida_run_atexit_handlers ();
 
-#ifdef HAVE_DARWIN
-  /* Do what frida_deinit_memory() does on the other platforms. */
-  gum_internal_heap_unref ();
+#if defined (_MSC_VER) || defined (HAVE_DARWIN)
+  frida_libc_shim_deinit ();
 #endif
 }
 

lib/gadget/gadget.vala

@@ -24,12 +24,6 @@ namespace Frida.Gadget {
 			default = Gum.CodeSigningPolicy.OPTIONAL;
 		}
 
-		private ObjectClass klass = (ObjectClass) typeof (Config).class_ref ();
-
-		public Json.Node serialize_property (string property_name, GLib.Value value, GLib.ParamSpec pspec) {
-			return default_serialize_property (property_name, value, pspec);
-		}
-
 		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
 			if (property_name == "interaction" && property_node.get_node_type () == Json.NodeType.OBJECT) {
 				var interaction_node = property_node.get_object ();
@@ -77,20 +71,6 @@ namespace Frida.Gadget {
 			value = Value (pspec.value_type);
 			return false;
 		}
-
-		public unowned ParamSpec? find_property (string name) {
-			return klass.find_property (name);
-		}
-
-		public new Value get_property (ParamSpec pspec) {
-			var val = Value (pspec.value_type);
-			base.get_property (pspec.name, ref val);
-			return val;
-		}
-
-		public new void set_property (ParamSpec pspec, Value value) {
-			base.set_property (pspec.name, value);
-		}
 	}
 
 	private sealed class ScriptInteraction : Object, Json.Serializable {
@@ -112,12 +92,6 @@ namespace Frida.Gadget {
 			default = Script.ChangeBehavior.IGNORE;
 		}
 
-		private ObjectClass klass = (ObjectClass) typeof (ScriptInteraction).class_ref ();
-
-		public Json.Node serialize_property (string property_name, GLib.Value value, GLib.ParamSpec pspec) {
-			return default_serialize_property (property_name, value, pspec);
-		}
-
 		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
 			if (property_name == "parameters" && property_node.get_node_type () == Json.NodeType.OBJECT) {
 				var v = Value (typeof (Json.Node));
@@ -129,20 +103,6 @@ namespace Frida.Gadget {
 			value = Value (pspec.value_type);
 			return false;
 		}
-
-		public unowned ParamSpec? find_property (string name) {
-			return klass.find_property (name);
-		}
-
-		public new Value get_property (ParamSpec pspec) {
-			var val = Value (pspec.value_type);
-			base.get_property (pspec.name, ref val);
-			return val;
-		}
-
-		public new void set_property (ParamSpec pspec, Value value) {
-			base.set_property (pspec.name, value);
-		}
 	}
 
 	private sealed class ScriptDirectoryInteraction : Object {
@@ -183,12 +143,6 @@ namespace Frida.Gadget {
 			default = Script.ChangeBehavior.IGNORE;
 		}
 
-		private ObjectClass klass = (ObjectClass) typeof (ScriptConfig).class_ref ();
-
-		public Json.Node serialize_property (string property_name, GLib.Value value, GLib.ParamSpec pspec) {
-			return default_serialize_property (property_name, value, pspec);
-		}
-
 		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
 			if (property_name == "parameters" && property_node.get_node_type () == Json.NodeType.OBJECT) {
 				var v = Value (typeof (Json.Node));
@@ -200,20 +154,6 @@ namespace Frida.Gadget {
 			value = Value (pspec.value_type);
 			return false;
 		}
-
-		public unowned ParamSpec? find_property (string name) {
-			return klass.find_property (name);
-		}
-
-		public new Value get_property (ParamSpec pspec) {
-			var val = Value (pspec.value_type);
-			base.get_property (pspec.name, ref val);
-			return val;
-		}
-
-		public new void set_property (ParamSpec pspec, Value value) {
-			base.set_property (pspec.name, value);
-		}
 	}
 
 	private sealed class ProcessFilter : Object {
@@ -299,8 +239,6 @@ namespace Frida.Gadget {
 			default = make_empty_json_object ();
 		}
 
-		private ObjectClass klass = (ObjectClass) typeof (ConnectInteraction).class_ref ();
-
 		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
 			if (property_name == "parameters" && property_node.get_node_type () == Json.NodeType.OBJECT) {
 				var v = Value (typeof (Json.Node));
@@ -312,20 +250,6 @@ namespace Frida.Gadget {
 			value = Value (pspec.value_type);
 			return false;
 		}
-
-		public unowned ParamSpec? find_property (string name) {
-			return klass.find_property (name);
-		}
-
-		public new Value get_property (ParamSpec pspec) {
-			var val = Value (pspec.value_type);
-			base.get_property (pspec.name, ref val);
-			return val;
-		}
-
-		public new void set_property (ParamSpec pspec, Value value) {
-			base.set_property (pspec.name, value);
-		}
 	}
 
 	private sealed class Location : Object {
@@ -481,6 +405,12 @@ namespace Frida.Gadget {
 
 		interceptor = Gum.Interceptor.obtain ();
 		interceptor.begin_transaction ();
+
+#if DARWIN
+		if (mapped_range != null)
+			Environment.ensure_debugger_breakpoints_only ();
+#endif
+
 		exceptor = Gum.Exceptor.obtain ();
 
 		try {
@@ -700,6 +630,11 @@ namespace Frida.Gadget {
 					controller = null;
 
 					exceptor = null;
+
+#if DARWIN
+					Environment.allow_stolen_breakpoints ();
+#endif
+
 					interceptor = null;
 				}
 			}
@@ -759,7 +694,7 @@ namespace Frida.Gadget {
 		}
 
 		try {
-			return Json.gobject_from_data (typeof (Config), config_data) as Config;
+			return (Config) Json.gobject_from_data (typeof (Config), config_data);
 		} catch (GLib.Error e) {
 			throw new Error.INVALID_ARGUMENT ("Invalid config: %s", e.message);
 		}
@@ -767,7 +702,7 @@ namespace Frida.Gadget {
 
 	private Config parse_config (string config_data) throws Error {
 		try {
-			return Json.gobject_from_data (typeof (Config), config_data) as Config;
+			return (Config) Json.gobject_from_data (typeof (Config), config_data);
 		} catch (GLib.Error e) {
 			throw new Error.INVALID_ARGUMENT ("Invalid config: %s", e.message);
 		}
@@ -775,21 +710,20 @@ namespace Frida.Gadget {
 
 	private Location detect_location (Gum.MemoryRange? mapped_range) {
 		string? executable_name = null;
-		string? executable_path = null;
-		Gum.MemoryRange? executable_range = null;
 		string? our_path = null;
 		Gum.MemoryRange? our_range = mapped_range;
 
 		Gum.Address our_address = Gum.Address.from_pointer (Gum.strip_code_pointer ((void *) detect_location));
 
+#if DARWIN
+		Environment.detect_darwin_location_fields (our_address, ref executable_name, ref our_path, ref our_range);
+#else
 		var index = 0;
 		Gum.Process.enumerate_modules ((details) => {
 			var range = details.range;
 
 			if (index == 0) {
 				executable_name = details.name;
-				executable_path = details.path;
-				executable_range = details.range;
 			}
 
 			if (mapped_range != null)
@@ -805,6 +739,7 @@ namespace Frida.Gadget {
 
 			return true;
 		});
+#endif
 
 		assert (our_range != null);
 
@@ -1234,7 +1169,7 @@ namespace Frida.Gadget {
 			}
 
 			try {
-				return Json.gobject_from_data (typeof (ScriptConfig), data) as ScriptConfig;
+				return (ScriptConfig) Json.gobject_from_data (typeof (ScriptConfig), data);
 			} catch (GLib.Error e) {
 				throw new Error.INVALID_ARGUMENT ("Invalid config: %s", e.message);
 			}
@@ -1748,7 +1683,7 @@ namespace Frida.Gadget {
 			}
 		}
 
-		private class ControlChannel : Object, Peer, HostSession {
+		private class ControlChannel : Object, Peer, HostSession, GadgetSession {
 			public weak ControlServer parent {
 				get;
 				construct;
@@ -1779,6 +1714,9 @@ namespace Frida.Gadget {
 					HostSession host_session = this;
 					registrations.add (connection.register_object (Frida.ObjectPath.HOST_SESSION, host_session));
 
+					GadgetSession gadget_session = this;
+					registrations.add (connection.register_object (Frida.ObjectPath.GADGET_SESSION, gadget_session));
+
 					AuthenticationService null_auth = new NullAuthenticationService ();
 					registrations.add (connection.register_object (Frida.ObjectPath.AUTHENTICATION_SERVICE, null_auth));
 				} catch (IOError e) {
@@ -1941,6 +1879,22 @@ namespace Frida.Gadget {
 				throw new Error.NOT_SUPPORTED ("Unable to open services when embedded");
 			}
 
+			public async void break_and_resume (Cancellable? cancellable) throws Error, IOError {
+#if DARWIN
+				Environment.break_and_resume ();
+#else
+				throw new Error.NOT_SUPPORTED ("This API is only applicable on Darwin");
+#endif
+			}
+
+			public async void break_and_detach (Cancellable? cancellable) throws Error, IOError {
+#if DARWIN
+				Environment.break_and_detach ();
+#else
+				throw new Error.NOT_SUPPORTED ("This API is only applicable on Darwin");
+#endif
+			}
+
 			private void validate_pid (uint pid) throws Error {
 				if (pid != this_process.pid)
 					throw new Error.NOT_SUPPORTED ("Unable to act on other processes when embedded");
@@ -2176,6 +2130,14 @@ namespace Frida.Gadget {
 		private extern bool has_objc_class (string name);
 
 		private extern void set_thread_name (string name);
+#if DARWIN
+		private extern void detect_darwin_location_fields (Gum.Address our_address, ref string? executable_name,
+			ref string? our_path, ref Gum.MemoryRange? our_range);
+		private extern void ensure_debugger_breakpoints_only ();
+		private extern void allow_stolen_breakpoints ();
+		private extern void break_and_resume ();
+		private extern void break_and_detach ();
+#endif
 	}
 
 	private extern void log_info (string message);

lib/gadget/meson.build

@@ -69,12 +69,12 @@ raw_gadget = shared_library('frida-gadget-raw', gadget_sources,
 )
 
 operations = [
-  '--move', 'constructor', 'frida_init_memory', 'first',
+  '--move', 'constructor', 'frida_libc_shim_init', 'first',
   '--move', 'constructor', 'frida_on_load', 'last',
 ]
 if host_os_family != 'darwin'
   operations += [
-    '--move', 'destructor', 'frida_deinit_memory', 'first',
+    '--move', 'destructor', 'frida_libc_shim_deinit', 'first',
     '--move', 'destructor', 'frida_on_unload', 'last',
   ]
 endif

lib/payload/cloak.vala

@@ -44,11 +44,17 @@ namespace Frida {
 
 #if ANDROID
 	public sealed class ThreadCountCloaker : Object {
+		private GetOsThreadStat * get_os_thread_stat_slot;
+		private static GetOsThreadStat old_get_os_thread_stat_impl;
+
 		private ReadFunc * read_slot;
 		private static ReadFunc old_read_impl;
 
 		private static string expected_magic = "%u (".printf (Posix.getpid ());
 
+		[CCode (has_target = false)]
+		private delegate ssize_t GetOsThreadStat (Posix.pid_t tid, void * buf, size_t count);
+
 		[CCode (has_target = false)]
 		private delegate ssize_t ReadFunc (int fd, void * buf, size_t count);
 
@@ -56,39 +62,64 @@ namespace Frida {
 			var art = Gum.Process.find_module_by_name ("libart.so");
 			if (art != null) {
 				art.enumerate_imports (imp => {
-					if (imp.name == "read") {
+					if (imp.name == "_ZN3art15GetOsThreadStatEiPcm" || imp.name == "_ZN3art15GetOsThreadStatEiPcj") {
+						get_os_thread_stat_slot = (GetOsThreadStat *) imp.slot;
+					} else if (imp.name == "read") {
 						read_slot = (ReadFunc *) imp.slot;
-						return false;
 					}
 					return true;
 				});
-				if (read_slot != null)
-					old_read_impl = update_read_slot (on_read);
+				if (get_os_thread_stat_slot != null) {
+					old_get_os_thread_stat_impl = (GetOsThreadStat) update_slot ((void **) get_os_thread_stat_slot,
+						(void *) on_get_os_thread_stat);
+				}
+				if (read_slot != null) {
+					old_read_impl = (ReadFunc) update_slot ((void **) read_slot, (void *) on_read);
+				}
 			}
 		}
 
-		~ThreadCountCloaker () {
-			if (read_slot != null)
-				update_read_slot (old_read_impl);
+		public override void dispose () {
+			if (get_os_thread_stat_slot != null) {
+				update_slot ((void **) get_os_thread_stat_slot, (void *) old_get_os_thread_stat_impl);
+			}
+			if (read_slot != null) {
+				update_slot ((void **) read_slot, (void *) old_read_impl);
+			}
+
+			base.dispose ();
 		}
 
-		private ReadFunc update_read_slot (ReadFunc new_impl) {
+		private static void * update_slot (void ** orig, void * new_impl) {
 			Gum.PageProtection old_prot = READ;
-			Gum.Memory.query_protection (read_slot, out old_prot);
+			Gum.Memory.query_protection (orig, out old_prot);
 
 			bool is_writable = (old_prot & Gum.PageProtection.WRITE) != 0;
 			if (!is_writable)
-				Gum.mprotect (read_slot, sizeof (void *), old_prot | WRITE);
+				Gum.mprotect (orig, sizeof (void *), old_prot | WRITE);
 
-			ReadFunc old_impl = *read_slot;
-			*read_slot = new_impl;
+			void * old_impl = *orig;
+			*orig = new_impl;
 
 			if (!is_writable)
-				Gum.mprotect (read_slot, sizeof (void *), old_prot);
+				Gum.mprotect (orig, sizeof (void *), old_prot);
 
 			return old_impl;
 		}
 
+		private static ssize_t on_get_os_thread_stat (Posix.pid_t tid, void * buf, size_t count) {
+			ssize_t n = old_get_os_thread_stat_impl (tid, buf, count);
+
+			if (tid == Posix.getpid ()) {
+				try {
+					n = adjust_thread_count (buf, n, count);
+				} catch (FileError e) {
+				}
+			}
+
+			return n;
+		}
+
 		private static ssize_t on_read (int fd, void * buf, size_t count) {
 			var n = old_read_impl (fd, buf, count);
 			if (n <= 0)
@@ -101,32 +132,36 @@ namespace Frida {
 				if (!file_descriptor_is_proc_self_stat (fd))
 					return n;
 
-				unowned string raw_str = (string) buf;
-				string str = raw_str.substring (0, n);
-
-				MatchInfo info;
-				if (!/^(\d+ \(.+\)(?: [^ ]+){17}) \d+ (.+)/s.match (str, 0, out info))
-					return n;
-				string fields_before = info.fetch (1);
-				string fields_after = info.fetch (2);
-
-				// We cannot simply use the value we got from the kernel and subtract the number of cloaked threads,
-				// as there's a chance the total may have changed in the last moment.
-				uint num_uncloaked_threads = query_num_uncloaked_threads ();
-
-				string adjusted_str = "%s %u %s".printf (fields_before, num_uncloaked_threads, fields_after);
-
-				var adjusted_length = adjusted_str.length;
-				if (adjusted_length > count)
-					return n;
-				Memory.copy (buf, adjusted_str, adjusted_length);
-				n = adjusted_length;
+				n = adjust_thread_count (buf, n, count);
 			} catch (FileError e) {
 			}
 
 			return n;
 		}
 
+		private static ssize_t adjust_thread_count (void * buf, ssize_t n, size_t count) throws FileError {
+			unowned string raw_str = (string) buf;
+			string str = raw_str.substring (0, n);
+
+			MatchInfo info;
+			if (!/^(\d+ \(.+\)(?: [^ ]+){17}) \d+ (.+)/s.match (str, 0, out info))
+				return n;
+			string fields_before = info.fetch (1);
+			string fields_after = info.fetch (2);
+
+			// We cannot simply use the value we got from the kernel and subtract the number of cloaked threads,
+			// as there's a chance the total may have changed in the last moment.
+			uint num_uncloaked_threads = query_num_uncloaked_threads ();
+
+			string adjusted_str = "%s %u %s".printf (fields_before, num_uncloaked_threads, fields_after);
+
+			var adjusted_length = adjusted_str.length;
+			if (adjusted_length > count)
+				return n;
+			Memory.copy (buf, adjusted_str, adjusted_length);
+			return adjusted_length;
+		}
+
 		private static bool file_content_might_be_from_proc_self_stat (void * content, ssize_t size) {
 			if (size < expected_magic.length)
 				return false;

lib/payload/process.vala

@@ -1,4 +1,7 @@
 namespace Frida {
+#if DARWIN
+	public extern void libc_shim_deinit ();
+#endif
 	public extern void run_atexit_handlers ();
 
 	public extern uint get_process_id ();

meson.build

@@ -12,9 +12,11 @@ if not meson.get_compiler('vala').version().endswith('-frida')
   error('''Incompatible Vala compiler detected.
 
 Frida currently relies on features not yet upstream. Grab the Frida-optimized
-Vala compiler from:
+Vala sources from:
 
-    https://github.com/frida/vala''')
+    https://github.com/frida/vala
+
+and compile them with Meson.''')
 endif
 
 c_languages = ['c', 'cpp']
@@ -30,18 +32,34 @@ frida_version = get_option('frida_version')
 if frida_version == ''
   frida_version = run_command(releng / 'frida_version.py', meson.project_source_root(), check: true).stdout().strip()
 endif
-tokens = frida_version.split('.')
-frida_major_version = tokens[0].to_int()
-frida_minor_version = tokens[1].to_int()
-if tokens.length() == 4
-  frida_micro_version = tokens[2].split('-')[0].to_int() - 1
-  frida_nano_version = tokens[3].to_int() + 1
+
+is_dev = frida_version.contains('-dev.')
+if is_dev
+  dev_parts = frida_version.split('-dev.')
+  assert(dev_parts.length() == 2)
+  prefix = dev_parts[0]
+  frida_nano_version = dev_parts[1].to_int() + 1
 else
-  assert(tokens.length() == 3)
-  frida_micro_version = tokens[2].to_int()
+  prefix = frida_version
   frida_nano_version = 0
 endif
-frida_profile = (frida_version != '0.0.0' and frida_nano_version == 0) ? 'prod' : 'dev'
+
+parts = prefix.split('-')
+core = parts[0]
+has_suffix = parts.length() > 1
+
+core_tokens = core.split('.')
+assert(core_tokens.length() == 3)
+
+frida_major_version = core_tokens[0].to_int()
+frida_minor_version = core_tokens[1].to_int()
+micro_encoded = core_tokens[2].to_int()
+
+if is_dev and not has_suffix
+  frida_micro_version = micro_encoded - 1
+else
+  frida_micro_version = micro_encoded
+endif
 
 api_version = '1.0'
 
@@ -90,6 +108,12 @@ elif host_machine.cpu_family() == 'mips64'
   else
     host_abi = 'mips64'
   endif
+elif host_machine.cpu_family() == 'riscv32'
+  host_arch = 'riscv'
+  host_abi = 'riscv32'
+elif host_machine.cpu_family() == 'riscv64'
+  host_arch = 'riscv'
+  host_abi = 'riscv64'
 else
   host_arch = host_machine.cpu_family()
   host_abi = host_arch
@@ -234,6 +258,7 @@ cpu_defines = [
   ['arm', 'HAVE_ARM'],
   ['arm64', 'HAVE_ARM64'],
   ['mips', 'HAVE_MIPS'],
+  ['riscv', 'HAVE_RISCV'],
 ]
 foreach d : cpu_defines
   if d.get(0) == host_arch
@@ -269,12 +294,14 @@ if host_os == 'linux'
 #endif
 '''
   if cc.compiles(glibc_src, name: 'compiling for glibc')
-    cdata.set('HAVE_GLIBC', 1)
+    libc = 'glibc'
   elif cc.compiles(uclibc_src, name: 'compiling for uClibc')
-    cdata.set('HAVE_UCLIBC', 1)
+    libc = 'uclibc'
   else
-    cdata.set('HAVE_MUSL', 1)
+    libc = 'musl'
   endif
+  cdata.set('HAVE_' + libc.to_upper(), 1)
+  vala_flags += '--define=' + libc.to_upper()
 endif
 
 if get_option('b_sanitize') == 'address'
@@ -288,6 +315,7 @@ gum_dep = dependency('frida-gum-1.0', default_options: [
 gumjs_dep = dependency('frida-gumjs-1.0')
 gumjs_inspector_dep = dependency('frida-gumjs-inspector-1.0')
 
+glib_version_req = '>=2.74'
 glib_options = [
   'cocoa=disabled',
   'selinux=disabled',
@@ -311,12 +339,12 @@ if optimize_for_prod
   gee_options += 'disable-internal-asserts=true'
 endif
 
-glib_dep = dependency('glib-2.0', version: '>=2.72', default_options: glib_options)
+glib_dep = dependency('glib-2.0', version: glib_version_req, default_options: glib_options)
 gobject_dep = dependency('gobject-2.0')
 gmodule_dep = dependency('gmodule-2.0')
 gio_dep = dependency('gio-2.0')
 gee_dep = dependency('gee-0.8', default_options: gee_options)
-json_glib_dep = dependency('json-glib-1.0', default_options: [
+json_glib_dep = dependency('json-glib-1.0', version: '>=1.8', default_options: [
   'introspection=disabled',
   'gtk_doc=disabled',
   'tests=false',
@@ -340,8 +368,9 @@ quickjs_dep = dependency('quickjs', required: get_option('barebone_backend'), de
   'atomics=disabled',
   'stack_check=disabled',
 ])
+lzfse_dep = dependency('lzfse', required: get_option('barebone_backend'))
 
-native_glib_dep = dependency('glib-2.0', version: '>=2.74', native: true, default_options: glib_options)
+native_glib_dep = dependency('glib-2.0', version: glib_version_req, native: true, default_options: glib_options)
 native_gio_dep = dependency('gio-2.0', native: true)
 native_gee_dep = dependency('gee-0.8', native: true, default_options: gee_options)
 native_brotlienc_dep = dependency('libbrotlienc', native: true)
@@ -398,6 +427,10 @@ else
 endif
 
 have_local_backend = get_option('local_backend').allowed()
+have_simmy_backend = get_option('simmy_backend') \
+    .disable_auto_if(host_os != 'macos') \
+    .require(host_os == 'macos', error_message: 'Simmy backend is only available on macOS') \
+    .allowed()
 have_fruity_backend = get_option('fruity_backend') \
     .disable_auto_if(not host_docks_mobile_devices) \
     .allowed()
@@ -406,7 +439,7 @@ have_droidy_backend = get_option('droidy_backend') \
     .allowed()
 have_socket_backend = get_option('socket_backend').allowed()
 have_barebone_backend = get_option('barebone_backend') \
-    .disable_if(not quickjs_dep.found()) \
+    .disable_if(not (quickjs_dep.found() and lzfse_dep.found())) \
     .disable_auto_if(not host_docks_mobile_devices) \
     .allowed()
 compiler_backend_opt = get_option('compiler_backend') \
@@ -486,6 +519,7 @@ build_tests = get_option('tests') \
     .allowed()
 
 foreach b : [['local', have_local_backend],
+             ['simmy', have_simmy_backend],
              ['fruity', have_fruity_backend],
              ['droidy', have_droidy_backend],
              ['socket', have_socket_backend],
@@ -556,9 +590,6 @@ if have_fruity_backend
     'dns=disabled',
     'arp=disabled',
     'ethernet=enabled',
-    'tcp_mss=4036',
-    'tcp_snd_buf=65535',
-    'tcp_wnd=65535',
   ]
   if optimize_for_prod
     lwip_options += 'lwip_debug=disabled'
@@ -574,7 +605,12 @@ if quickjs_dep.found()
   backend_reqs_private += 'quickjs'
 endif
 
-if host_os_family == 'linux' and cc.has_function('openpty', prefix: '#include <pty.h>')
+if lzfse_dep.found()
+  backend_deps_private += lzfse_dep
+  backend_reqs_private += 'lzfse'
+endif
+
+if host_os_family in ['darwin', 'freebsd'] or (host_os_family == 'linux' and cc.has_function('openpty', prefix: '#include <pty.h>'))
   vala_flags += '--define=HAVE_OPENPTY'
 endif
 
@@ -646,6 +682,9 @@ endif
 if host_os in ['ios', 'tvos']
   backend_libs_private += ['-Wl,-framework,CoreGraphics', '-Wl,-framework,UIKit']
 endif
+if host_os_family == 'freebsd'
+  backend_libs_private += ['-lutil']
+endif
 
 if get_option('devkits').length() != 0
   if get_option('default_library') != 'static'
@@ -654,6 +693,7 @@ if get_option('devkits').length() != 0
   mkdevkit = [python, releng / 'mkdevkit.py']
   uninstalled_dir = meson.global_build_root() / 'meson-uninstalled'
   devkit_options = [
+    '--dep-symbol-scope', get_option('devkit_symbol_scope'),
     '--cc', '>>>', cc.cmd_array(), '<<<',
     '--c-args', '>>>', get_option('c_args'), '<<<',
     '--pkg-config', '>>>', find_program('pkg-config'), '<<<',
@@ -778,6 +818,7 @@ endif
 summary(
   {
     'local': have_local_backend,
+    'simmy': have_simmy_backend,
     'fruity': have_fruity_backend,
     'droidy': have_droidy_backend,
     'socket': have_socket_backend,

meson.options

@@ -10,6 +10,12 @@ option('local_backend',
   description: 'Include backend for the local system',
 )
 
+option('simmy_backend',
+  type: 'feature',
+  value: 'auto',
+  description: 'Include the iDevice Simulator backend',
+)
+
 option('fruity_backend',
   type: 'feature',
   value: 'auto',
@@ -150,6 +156,15 @@ option('devkits',
   description: 'Devkits to build'
 )
 
+option('devkit_symbol_scope',
+  type: 'combo',
+  choices: ['prefixed', 'original'],
+  value: 'prefixed',
+  description : 'How devkit generation treats third-party symbols:\n'
+                + ' - prefixed: add the \'_frida_\' prefix\n'
+                + ' - original: keep symbols exactly as upstream\n'
+)
+
 option('tests',
   type: 'feature',
   value: 'auto',

server/meson.build

@@ -6,7 +6,7 @@ server_sources = [
 if host_os_family == 'darwin'
   server_sources += ['server-darwin.m']
 endif
-if host_os in ['ios', 'tvos']
+if host_os in ['ios', 'tvos', 'xros']
   server_sources += [
     'server-ios-tvos.c',
   ]

server/server-glue.c

@@ -1,7 +1,7 @@
 #include "server-glue.h"
 
 #include "frida-core.h"
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 # include "server-ios-tvos.h"
 #endif
 #ifdef HAVE_ANDROID
@@ -54,7 +54,7 @@ frida_server_environment_set_verbose_logging_enabled (gboolean enabled)
 void
 frida_server_environment_configure (void)
 {
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   _frida_server_ios_tvos_configure ();
 #endif
 

src/android-helper/Makefile

@@ -1,11 +1,15 @@
-ANDROID_API_LEVEL ?= 21
-ANDROID_SDK_ROOT ?= $(shell echo ~/Library/Android/sdk)
+ANDROID_API_LEVEL ?= 19
+ANDROID_SDK_ROOT ?= $(shell echo ~/Android/Sdk)
 
 android_platform := android-$(ANDROID_API_LEVEL)
 android_jar := $(ANDROID_SDK_ROOT)/platforms/$(android_platform)/android.jar
 
-build/frida-helper.dex: build/frida-helper.jar
-	dx --dex --output=$@ $<
+helper.dex: build/frida-helper.jar
+	d8 \
+		--classpath $(android_jar) \
+		--output build/ \
+		$<
+	mv build/classes.dex $@
 
 build/frida-helper.jar: re/frida/Helper.java
 	javac \

src/android-helper/client.vala

@@ -0,0 +1,738 @@
+namespace Frida {
+	public sealed class AndroidHelperClient : Object, AsyncInitable {
+		public signal void closed ();
+
+		public IOStream stream {
+			get;
+			construct;
+		}
+
+		private BufferedInputStream input;
+		private OutputStream output;
+		private Cancellable io_cancellable = new Cancellable ();
+
+		private State state = CLOSED;
+		private Gee.Queue<Request> pending_requests = new Gee.ArrayQueue<Request> ();
+
+		private ByteArray pending_output = new ByteArray ();
+		private bool writing = false;
+
+		private enum State {
+			CLOSED,
+			OPEN
+		}
+
+		private const uint32 MAX_RESPONSE_SIZE = 100 * 1024 * 1024;
+
+		public AndroidHelperClient (IOStream stream) {
+			Object (stream: stream);
+		}
+
+		construct {
+			input = (BufferedInputStream) Object.new (typeof (BufferedInputStream),
+				"base-stream", stream.get_input_stream (),
+				"close-base-stream", false,
+				"buffer-size", 128 * 1024);
+			output = stream.get_output_stream ();
+
+			state = OPEN;
+
+			process_incoming_responses.begin ();
+		}
+
+		public async void close (Cancellable? cancellable) throws IOError {
+			io_cancellable.cancel ();
+
+			var source = new IdleSource ();
+			source.set_callback (close.callback);
+			source.attach (MainContext.get_thread_default ());
+			yield;
+
+			try {
+				yield stream.close_async (Priority.DEFAULT, cancellable);
+			} catch (IOError e) {
+			}
+
+			ensure_closed ();
+		}
+
+		private void ensure_closed () {
+			if (state == CLOSED)
+				return;
+			state = CLOSED;
+			closed ();
+		}
+
+		public async HostApplicationInfo get_frontmost_application (FrontmostQueryOptions options,
+				Cancellable? cancellable) throws Error, IOError {
+			var stanza = new Json.Builder ();
+			stanza
+				.begin_array ()
+				.add_string_value ("get-frontmost-application")
+				.add_string_value (options.scope.to_nick ())
+				.end_array ();
+
+			Json.Node response = yield request (stanza.get_root (), cancellable);
+
+			if (response.is_null ())
+				return HostApplicationInfo.empty ();
+
+			Json.Reader reader = new Json.Reader (response);
+
+			string? identifier = null;
+			string? name = null;
+			uint pid = 0;
+			HashTable<string, Variant> parameters = make_parameters_dict ();
+
+			if (reader.read_element (0)) {
+				identifier = reader.get_string_value ();
+				reader.end_element ();
+			}
+
+			if (reader.read_element (1)) {
+				name = reader.get_string_value ();
+				reader.end_element ();
+			}
+
+			if (reader.read_element (2)) {
+				pid = (uint) reader.get_int_value ();
+				reader.end_element ();
+			}
+
+			if (reader.read_element (3)) {
+				if (reader.is_object ())
+					add_parameters_from_json (parameters, reader);
+				reader.end_element ();
+			}
+
+			GLib.Error? error = reader.get_error ();
+			if (error != null)
+				throw new Error.PROTOCOL ("%s", error.message);
+
+			return HostApplicationInfo (identifier, name, pid, (owned) parameters);
+		}
+
+		public async HostApplicationInfo[] enumerate_applications (ApplicationQueryOptions options, Cancellable? cancellable)
+				throws Error, IOError {
+			var stanza = new Json.Builder ();
+			stanza
+				.begin_array ()
+				.add_string_value ("enumerate-applications");
+
+			stanza.begin_array ();
+			options.enumerate_selected_identifiers (identifier => stanza.add_string_value (identifier));
+			stanza.end_array ();
+
+			stanza
+				.add_string_value (options.scope.to_nick ())
+				.end_array ();
+
+			Json.Node response = yield request (stanza.get_root (), cancellable);
+
+			Json.Reader reader = new Json.Reader (response);
+
+			int num_apps = reader.count_elements ();
+			if (num_apps == -1)
+				throw new Error.PROTOCOL ("Invalid response from helper service");
+
+			var result = new HostApplicationInfo[0];
+
+			for (int i = 0; i != num_apps; i++) {
+				reader.read_element (i);
+
+				string? identifier = null;
+				string? name = null;
+				uint pid = 0;
+				HashTable<string, Variant> parameters = make_parameters_dict ();
+
+				if (reader.read_element (0)) {
+					identifier = reader.get_string_value ();
+					reader.end_element ();
+				}
+
+				if (reader.read_element (1)) {
+					name = reader.get_string_value ();
+					reader.end_element ();
+				}
+
+				if (reader.read_element (2)) {
+					pid = (uint) reader.get_int_value ();
+					reader.end_element ();
+				}
+
+				if (reader.read_element (3)) {
+					if (reader.is_object ())
+						add_parameters_from_json (parameters, reader);
+					reader.end_element ();
+				}
+
+				GLib.Error? error = reader.get_error ();
+				if (error != null)
+					throw new Error.PROTOCOL ("%s", error.message);
+
+				result += HostApplicationInfo (identifier, name, pid, (owned) parameters);
+
+				reader.end_element ();
+			}
+
+			return result;
+		}
+
+		public async HostProcessInfo[] enumerate_processes (ProcessQueryOptions options, Cancellable? cancellable)
+				throws Error, IOError {
+			var stanza = new Json.Builder ();
+			stanza
+				.begin_array ()
+				.add_string_value ("enumerate-processes");
+
+			stanza.begin_array ();
+			options.enumerate_selected_pids (pid => stanza.add_int_value (pid));
+			stanza.end_array ();
+
+			stanza
+				.add_string_value (options.scope.to_nick ())
+				.end_array ();
+
+			Json.Node response = yield request (stanza.get_root (), cancellable);
+
+			Json.Reader reader = new Json.Reader (response);
+
+			int num_processes = reader.count_elements ();
+			if (num_processes == -1)
+				throw new Error.PROTOCOL ("Invalid response from helper service");
+
+			var result = new HostProcessInfo[0];
+
+			for (int i = 0; i != num_processes; i++) {
+				reader.read_element (i);
+
+				uint pid = 0;
+				string? name = null;
+				HashTable<string, Variant> parameters = make_parameters_dict ();
+
+				if (reader.read_element (0)) {
+					pid = (uint) reader.get_int_value ();
+					reader.end_element ();
+				}
+
+				if (reader.read_element (1)) {
+					name = reader.get_string_value ();
+					reader.end_element ();
+				}
+
+				if (reader.read_element (2)) {
+					if (reader.is_object ())
+						add_parameters_from_json (parameters, reader);
+					reader.end_element ();
+				}
+
+				GLib.Error? error = reader.get_error ();
+				if (error != null)
+					throw new Error.PROTOCOL ("%s", error.message);
+
+				result += HostProcessInfo (pid, name, (owned) parameters);
+
+				reader.end_element ();
+			}
+
+			return result;
+		}
+
+		public async string get_process_name (string package, int uid, Cancellable? cancellable) throws Error, IOError {
+			var stanza = new Json.Builder ();
+			stanza
+				.begin_array ()
+				.add_string_value ("get-process-name")
+				.add_string_value (package)
+				.add_int_value (uid)
+				.end_array ();
+
+			Json.Node response = yield request (stanza.get_root (), cancellable);
+
+			var r = new Json.Reader (response);
+			parse_envelope_or_throw (r);
+
+			r.read_element (1);
+			string? process_name = r.get_string_value ();
+			if (process_name == null)
+				throw new Error.PROTOCOL ("Malformed response");
+			return process_name;
+		}
+
+		public async void start_package (string package, PackageEntrypoint entrypoint, Cancellable? cancellable)
+				throws Error, IOError {
+			if (entrypoint is DefaultActivityEntrypoint) {
+				var stanza = new Json.Builder ();
+				stanza
+					.begin_array ()
+					.add_string_value ("start-activity")
+					.add_string_value (package)
+					.add_null_value ()
+					.add_int_value (entrypoint.uid)
+					.end_array ();
+				yield request_ok (stanza, cancellable);
+				return;
+			}
+
+			if (entrypoint is ActivityEntrypoint) {
+				var e = (ActivityEntrypoint) entrypoint;
+
+				var stanza = new Json.Builder ();
+				stanza
+					.begin_array ()
+					.add_string_value ("start-activity")
+					.add_string_value (package)
+					.add_string_value (e.activity)
+					.add_int_value (entrypoint.uid)
+					.end_array ();
+				yield request_ok (stanza, cancellable);
+				return;
+			}
+
+			if (entrypoint is BroadcastReceiverEntrypoint) {
+				var e = (BroadcastReceiverEntrypoint) entrypoint;
+
+				var stanza = new Json.Builder ();
+				stanza
+					.begin_array ()
+					.add_string_value ("send-broadcast")
+					.add_string_value (package)
+					.add_string_value (e.receiver)
+					.add_string_value (e.action)
+					.add_int_value (entrypoint.uid)
+					.end_array ();
+				yield request_ok (stanza, cancellable);
+				return;
+			}
+
+			assert_not_reached ();
+		}
+
+		public async void stop_package (string package, int uid, Cancellable? cancellable) throws Error, IOError {
+			var stanza = new Json.Builder ();
+			stanza
+				.begin_array ()
+				.add_string_value ("stop-package")
+				.add_string_value (package)
+				.add_int_value (uid)
+				.end_array ();
+
+			Json.Node response = yield request (stanza.get_root (), cancellable);
+
+			var r = new Json.Reader (response);
+			parse_envelope_or_throw (r);
+		}
+
+		public async bool try_stop_package_by_pid (uint pid, Cancellable? cancellable) throws Error, IOError {
+			var stanza = new Json.Builder ();
+			stanza
+				.begin_array ()
+				.add_string_value ("try-stop-package-by-pid")
+				.add_int_value ((int) pid)
+				.end_array ();
+
+			Json.Node response = yield request (stanza.get_root (), cancellable);
+
+			var r = new Json.Reader (response);
+			parse_envelope_or_throw (r);
+
+			r.read_element (1);
+			var val = r.get_value ();
+			if (val == null || val.get_value_type () != typeof (bool))
+				throw new Error.PROTOCOL ("Malformed response");
+			return r.get_boolean_value ();
+		}
+
+		private void parse_envelope_or_throw (Json.Reader r) throws Error {
+			r.read_element (0);
+			string? kind = r.get_string_value ();
+			if (kind == null)
+				throw new Error.PROTOCOL ("Malformed response");
+			r.end_element ();
+
+			if (kind == "ok")
+				return;
+
+			if (kind == "error") {
+				r.read_element (1);
+				string? code = r.get_string_value ();
+				if (code == null)
+					throw new Error.PROTOCOL ("Malformed response");
+				r.end_element ();
+
+				r.read_element (2);
+				string? message = r.get_string_value ();
+				if (message == null)
+					throw new Error.PROTOCOL ("Malformed response");
+				r.end_element ();
+
+				if (code == "INVALID_ARGUMENT")
+					throw new Error.INVALID_ARGUMENT ("%s", message);
+
+				throw new Error.NOT_SUPPORTED ("%s", message);
+			}
+
+			throw new Error.PROTOCOL ("Malformed response");
+		}
+
+		private static void add_parameters_from_json (HashTable<string, Variant> parameters, Json.Reader reader) throws Error {
+			foreach (string name in reader.list_members ()) {
+				reader.read_member (name);
+
+				if (reader.is_value ()) {
+					Json.Node val = reader.get_value ();
+
+					parameters[name] = variant_from_json_value (val);
+				} else if (reader.is_array ()) {
+					int length = reader.count_elements ();
+					if (length == 0)
+						throw new Error.PROTOCOL ("Unexpected JSON array element shape");
+
+					if (name == "$icons") {
+						var icons = new VariantBuilder (new VariantType.array (VariantType.VARDICT));
+
+						for (int i = 0; i != length; i++) {
+							reader.read_element (i);
+
+							string? png_str = reader.get_string_value ();
+							if (png_str == null)
+								throw new Error.PROTOCOL ("Unexpected JSON icon type");
+
+							var png = new Bytes.take (Base64.decode (png_str));
+
+							icons.open (VariantType.VARDICT);
+							icons.add ("{sv}", "format", new Variant.string ("png"));
+							icons.add ("{sv}", "image", Variant.new_from_data (new VariantType ("ay"),
+								png.get_data (), true, png));
+							icons.close ();
+
+							reader.end_element ();
+						}
+
+						parameters["icons"] = icons.end ();
+					} else {
+						reader.read_element (0);
+						if (!reader.is_value ())
+							throw new Error.PROTOCOL ("Unexpected JSON array element type");
+						Variant first_element = variant_from_json_value (reader.get_value ());
+						reader.end_element ();
+
+						var builder = new VariantBuilder (new VariantType.array (first_element.get_type ()));
+						builder.add_value (first_element);
+
+						for (int i = 1; i != length; i++) {
+							reader.read_element (i);
+							if (!reader.is_value ())
+								throw new Error.PROTOCOL ("Unexpected JSON array element type");
+							builder.add_value (variant_from_json_value (reader.get_value ()));
+							reader.end_element ();
+						}
+
+						parameters[name] = builder.end ();
+					}
+				} else {
+					throw new Error.PROTOCOL ("Unexpected JSON type");
+				}
+
+				reader.end_member ();
+			}
+		}
+
+		private static Variant variant_from_json_value (Json.Node node) throws Error {
+			Type type = node.get_value_type ();
+
+			if (type == typeof (string))
+				return new Variant.string (node.get_string ());
+
+			if (type == typeof (int64))
+				return new Variant.int64 (node.get_int ());
+
+			if (type == typeof (bool))
+				return new Variant.boolean (node.get_boolean ());
+
+			throw new Error.PROTOCOL ("Unexpected JSON type: %s", type.name ());
+		}
+
+		public async Json.Node request (Json.Node stanza, Cancellable? cancellable) throws Error, IOError {
+			if (state == CLOSED)
+				throw new Error.INVALID_OPERATION ("Helper client is closed");
+
+			var r = new Request (request.callback);
+			pending_requests.offer (r);
+
+			var cancel_source = new CancellableSource (cancellable);
+			cancel_source.set_callback (() => {
+				r.complete_with_error (new IOError.CANCELLED ("Operation was cancelled"));
+				return false;
+			});
+			cancel_source.attach (MainContext.get_thread_default ());
+
+			write_request (stanza);
+
+			yield;
+
+			cancel_source.destroy ();
+
+			cancellable.set_error_if_cancelled ();
+
+			GLib.Error? e = r.error;
+			if (e != null) {
+				if (e is Error)
+					throw (Error) e;
+				if (e is IOError.CANCELLED)
+					throw (IOError) e;
+				throw new Error.TRANSPORT ("%s", e.message);
+			}
+
+			return r.response;
+		}
+
+		private async void request_ok (Json.Builder stanza, Cancellable? cancellable) throws Error, IOError {
+			Json.Node response = yield request (stanza.get_root (), cancellable);
+
+			var r = new Json.Reader (response);
+			parse_envelope_or_throw (r);
+		}
+
+		private void write_request (Json.Node request) {
+			string request_str = Json.to_string (request, false);
+			uint8[] request_data = request_str.data;
+
+			uint offset = pending_output.len;
+			pending_output.set_size ((uint) (offset + sizeof (uint32) + request_data.length));
+
+			uint8 * blob = (uint8 *) pending_output.data + offset;
+
+			uint32 * size = blob;
+			*size = request_data.length.to_big_endian ();
+
+			Memory.copy (blob + 4, request_data, request_data.length);
+
+			if (!writing) {
+				writing = true;
+
+				var source = new IdleSource ();
+				source.set_callback (() => {
+					process_pending_output.begin ();
+					return false;
+				});
+				source.attach (MainContext.get_thread_default ());
+			}
+		}
+
+		private async void process_pending_output () {
+			while (pending_output.len > 0) {
+				uint8[] batch = pending_output.steal ();
+
+				size_t bytes_written;
+				try {
+					yield output.write_all_async (batch, Priority.DEFAULT, io_cancellable, out bytes_written);
+				} catch (GLib.Error e) {
+					break;
+				}
+			}
+
+			writing = false;
+		}
+
+		private async void process_incoming_responses () {
+			while (true) {
+				try {
+					Json.Node response = yield read_response ();
+
+					Request? request = pending_requests.poll ();
+					if (request == null)
+						throw new Error.PROTOCOL ("Unexpected response");
+
+					request.complete_with_response (response);
+				} catch (GLib.Error e) {
+					foreach (Request r in pending_requests)
+						r.complete_with_error (e);
+					pending_requests.clear ();
+
+					ensure_closed ();
+
+					return;
+				}
+			}
+		}
+
+		private async Json.Node read_response () throws GLib.Error {
+			size_t header_size = sizeof (uint32);
+			if (input.get_available () < header_size)
+				yield fill_until_n_bytes_available (header_size, io_cancellable);
+
+			uint32 response_size = 0;
+			unowned uint8[] response_size_buf = ((uint8[]) &response_size)[0:4];
+			input.peek (response_size_buf);
+
+			response_size = uint32.from_big_endian (response_size);
+			if (response_size < 1 || response_size > MAX_RESPONSE_SIZE)
+				throw new Error.PROTOCOL ("Invalid response size");
+
+			size_t frame_size = header_size + response_size;
+			if (input.get_available () < frame_size)
+				yield fill_until_n_bytes_available (frame_size, io_cancellable);
+
+			var response_data = new uint8[response_size + 1];
+			response_data.length = (int) response_size;
+			input.peek (response_data, header_size);
+
+			input.skip (frame_size, io_cancellable);
+
+			return Json.from_string ((string) response_data);
+		}
+
+		private async void fill_until_n_bytes_available (size_t minimum, Cancellable? cancellable) throws GLib.Error {
+			size_t available = input.get_available ();
+			while (available < minimum) {
+				if (input.get_buffer_size () < minimum)
+					input.set_buffer_size (minimum);
+
+				ssize_t n = yield input.fill_async ((ssize_t) (input.get_buffer_size () - available),
+					Priority.DEFAULT, cancellable);
+				if (n == 0)
+					throw new IOError.CONNECTION_CLOSED ("Connection closed");
+
+				available += n;
+			}
+		}
+
+		private class Request {
+			private SourceFunc? handler;
+
+			public Json.Node? response;
+			public GLib.Error? error;
+
+			public Request (owned SourceFunc handler) {
+				this.handler = (owned) handler;
+			}
+
+			public void complete_with_response (Json.Node r) {
+				if (handler == null)
+					return;
+
+				response = r;
+
+				handler ();
+				handler = null;
+			}
+
+			public void complete_with_error (GLib.Error e) {
+				if (handler == null)
+					return;
+
+				error = e;
+
+				handler ();
+				handler = null;
+			}
+		}
+	}
+
+	public abstract class PackageEntrypoint : Object {
+		public int uid {
+			get;
+			set;
+		}
+
+		public static PackageEntrypoint parse (string package, HostSpawnOptions options) throws Error {
+			PackageEntrypoint? entrypoint = null;
+
+			HashTable<string, Variant> aux = options.aux;
+
+			Variant? activity_value = aux["activity"];
+			if (activity_value != null) {
+				if (!activity_value.is_of_type (VariantType.STRING))
+					throw new Error.INVALID_ARGUMENT ("The 'activity' option must be a string");
+				string activity = canonicalize_class_name (activity_value.get_string (), package);
+
+				if (aux.contains ("action")) {
+					throw new Error.INVALID_ARGUMENT (
+						"The 'action' option should only be specified when a 'receiver' is specified");
+				}
+
+				entrypoint = new ActivityEntrypoint (activity);
+			}
+
+			Variant? receiver_value = aux["receiver"];
+			if (receiver_value != null) {
+				if (!receiver_value.is_of_type (VariantType.STRING))
+					throw new Error.INVALID_ARGUMENT ("The 'receiver' option must be a string");
+				string receiver = canonicalize_class_name (receiver_value.get_string (), package);
+
+				if (entrypoint != null) {
+					throw new Error.INVALID_ARGUMENT (
+						"Only one of 'activity' or 'receiver' (with 'action') may be specified");
+				}
+
+				Variant? action_value = aux["action"];
+				if (action_value == null)
+					throw new Error.INVALID_ARGUMENT ("The 'action' option is required when 'receiver' is specified");
+				if (!action_value.is_of_type (VariantType.STRING))
+					throw new Error.INVALID_ARGUMENT ("The 'action' option must be a string");
+				string action = action_value.get_string ();
+
+				entrypoint = new BroadcastReceiverEntrypoint (receiver, action);
+			}
+
+			if (entrypoint == null)
+				entrypoint = new DefaultActivityEntrypoint ();
+
+			Variant? uid_value = aux["uid"];
+			if (uid_value != null) {
+				if (!uid_value.is_of_type (VariantType.INT64))
+					throw new Error.INVALID_ARGUMENT ("The 'uid' option must be an integer");
+				entrypoint.uid = (int) uid_value.get_int64 ();
+			}
+
+			return entrypoint;
+		}
+	}
+
+	public sealed class DefaultActivityEntrypoint : PackageEntrypoint {
+		public DefaultActivityEntrypoint () {
+			Object ();
+		}
+	}
+
+	public sealed class ActivityEntrypoint : PackageEntrypoint {
+		public string activity {
+			get;
+			construct;
+		}
+
+		public ActivityEntrypoint (string activity) {
+			Object (activity: activity);
+		}
+	}
+
+	public sealed class BroadcastReceiverEntrypoint : PackageEntrypoint {
+		public string receiver {
+			get;
+			construct;
+		}
+
+		public string action {
+			get;
+			construct;
+		}
+
+		public BroadcastReceiverEntrypoint (string receiver, string action) {
+			Object (receiver: receiver, action: action);
+		}
+	}
+
+	private static string canonicalize_class_name (string klass, string package) {
+		var result = new StringBuilder (klass);
+
+		if (klass.has_prefix (".")) {
+			result.prepend (package);
+		} else if (klass.index_of (".") == -1) {
+			result.prepend_c ('.');
+			result.prepend (package);
+		}
+
+		return result.str;
+	}
+}

src/android-helper/meson.build

@@ -0,0 +1,2 @@
+backend_sources += files('client.vala')
+android_helper_dex = files('helper.dex')

src/api/generate.py

@@ -238,7 +238,7 @@ def emit_gir(api: ApiSpec, core_gir: str, base_gir: str, output_dir: Path) -> st
         for elem in core_elements + base_elements:
             if tag_name == "class":
                 for child in list(elem):
-                    if (child.tag == CORE_TAG_IMPLEMENTS and child.get("name") == "FridaBase.AgentMessageSink") \
+                    if (child.tag == CORE_TAG_IMPLEMENTS and child.get("name") in {"Frida.HostSessionHub", "FridaBase.AgentMessageSink"}) \
                             or child.tag == CORE_TAG_FIELD \
                             or child.get("name").startswith("_"):
                         elem.remove(child)
@@ -512,6 +512,8 @@ def function_is_public(name):
                 "parse_socket_address",
                 "negotiate_connection",
                 "check_kernel_version",
+                "make_stdio_pipes",
+                "make_stdio_pipe",
             ]
 
 def parse_vala_object_types(source) -> List[ApiObjectType]:

src/barebone/agent-connection.vala

@@ -0,0 +1,503 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	public sealed class AgentConnection : Object, AsyncInitable {
+		public signal void script_message (AgentScriptId id, string json, Bytes? data);
+
+		private Cancellable io_cancellable = new Cancellable ();
+
+		private SocketConnection hostlink;
+		private BufferedInputStream input;
+		private OutputStream output;
+
+		private AgentConfig agent_config;
+		private ImageConfig? image_config;
+		private Machine machine;
+		private Allocator allocator;
+
+		private Allocation elf_allocation;
+		private Allocation config_allocation;
+		private Callback mprotect_callback;
+		private Callback remap_writable_pages_callback;
+
+		private Gee.Map<uint16, Promise<Variant>> pending_requests = new Gee.HashMap<uint16, Promise<Variant>> ();
+		private uint16 next_request_id = 1;
+
+		private const int COMMAND_TIMEOUT_MS = 25000;
+
+		public static async AgentConnection open (AgentConfig agent_config, ImageConfig? image_config, Machine machine,
+				Allocator allocator, Cancellable? cancellable) throws Error, IOError {
+			var connection = new AgentConnection () {
+				agent_config = agent_config,
+				image_config = image_config,
+				machine = machine,
+				allocator = allocator,
+			};
+
+			try {
+				yield connection.init_async (Priority.DEFAULT, cancellable);
+			} catch (GLib.Error e) {
+				throw_api_error (e);
+			}
+
+			return connection;
+		}
+
+		private async bool init_async (int io_priority, Cancellable? cancellable) throws Error, IOError {
+			HostlinkTransportConfig? transport_config = agent_config.transport as HostlinkTransportConfig;
+			if (transport_config == null)
+				throw new Error.NOT_SUPPORTED ("Unsupported transport config: only hostlink is supported for now");
+
+			var qmp = yield QmpClient.open (transport_config.qmp, 0, cancellable);
+			var link = yield qmp.open_hostlink (cancellable);
+			hostlink = link.connection;
+			input = (BufferedInputStream) Object.new (typeof (BufferedInputStream),
+				"base-stream", hostlink.get_input_stream (),
+				"close-base-stream", false,
+				"buffer-size", 128 * 1024);
+			output = hostlink.get_output_stream ();
+
+			var gdb = machine.gdb;
+			ByteOrder byte_order = gdb.byte_order;
+			uint pointer_size = gdb.pointer_size;
+
+			uint64 kernel_base;
+			Layout layout;
+			if (image_config != null) {
+				kernel_base = image_config.base.address;
+				layout = yield Layout.load_from_symbol_source (File.new_for_path (image_config.file), kernel_base,
+					byte_order, pointer_size, cancellable);
+			} else {
+				kernel_base = 0;
+				layout = new Layout.empty ();
+			}
+			if (kernel_base == 0)
+				throw new Error.NOT_SUPPORTED ("Missing kernel_base");
+
+			var symbols = new Gee.HashMap<string, SymbolInfo> ();
+			var hash_builder = new SymbolHashBuilder ();
+			foreach (var s in layout.symbols) {
+				symbols[s.name] = s;
+				hash_builder.add_symbol (s);
+			}
+			if (image_config != null) {
+				foreach (var e in image_config.symbols.entries) {
+					unowned string name = e.key;
+					if (!symbols.has_key (name)) {
+						var s = new SymbolInfo () {
+							name = name,
+							offset = (uint32) e.value,
+							symbol_type = 0xf,
+							section = 0x10, // FIXME
+						};
+						symbols[name] = s;
+						hash_builder.add_symbol (s);
+					}
+				}
+			}
+
+			SymbolInfo? thread_block = symbols["thread_block"];
+			if (thread_block == null)
+				throw new Error.NOT_SUPPORTED ("Missing symbol for thread_block");
+
+			var config_builder = new VariantBuilder (new VariantType ("(tuta(ssuuuu)ay)"));
+			config_builder.add ("t", link.mmio);
+			config_builder.add ("u", link.irq);
+			config_builder.add ("t", kernel_base);
+
+			config_builder.open (new VariantType ("a(ssuuuu)"));
+			foreach (var m in layout.modules) {
+				config_builder.add ("(ssuuuu)",
+					m.name,
+					m.version,
+					m.offset,
+					m.size,
+					m.start_func_offset,
+					m.stop_func_offset
+				);
+			}
+			config_builder.close ();
+
+			Bytes symbol_data = hash_builder.build (byte_order);
+			config_builder.add_value (Variant.new_from_data (new VariantType ("ay"), symbol_data.get_data (), true,
+				symbol_data));
+
+			Gum.ElfModule elf;
+			try {
+				elf = new Gum.ElfModule.from_file (agent_config.path);
+			} catch (Gum.Error e) {
+				throw new Error.INVALID_ARGUMENT ("%s", e.message);
+			}
+
+			var raw_elf = gdb.make_buffer (new Bytes (elf.get_file_data ()));
+			var missing_symbols = new Gee.ArrayList<string> ();
+			elf.enumerate_symbols (s => {
+				unowned Gum.ElfSectionDetails? sect = s.section;
+				if (sect != null && sect.name == ".kernel_addrs") {
+					string name = s.name[1:];
+					SymbolInfo? info = symbols[name];
+					if (info != null) {
+						size_t file_offset = (size_t) (sect.offset + (s.address - sect.address));
+						raw_elf.write_pointer (file_offset, kernel_base + info.offset);
+					} else {
+						missing_symbols.add (name);
+					}
+				}
+				return true;
+			});
+			if (!missing_symbols.is_empty) {
+				throw new Error.INVALID_ARGUMENT ("Missing symbols for: %s",
+					string.joinv (", ", missing_symbols.to_array ()));
+			}
+
+			yield machine.enter_exception_level (1, 1000, cancellable);
+
+			var bp = yield gdb.add_breakpoint (SOFT, kernel_base + thread_block.offset, 4, cancellable);
+			GDB.Breakpoint? hit_breakpoint = null;
+			do {
+				var exception = yield gdb.continue_until_exception (cancellable);
+				hit_breakpoint = exception.breakpoint;
+			} while (hit_breakpoint != bp);
+			yield bp.remove (cancellable);
+
+			size_t page_size = yield machine.query_page_size (cancellable);
+
+			elf_allocation = yield inject_elf (elf, raw_elf.bytes, page_size, machine, allocator, cancellable);
+
+			uint64 start_address = 0;
+			uint64 remap_writable_pages_address = 0;
+			uint64 mprotect_address = 0;
+			uint64 base_va = elf_allocation.virtual_address;
+			elf.enumerate_symbols (e => {
+				if (e.name == "_start")
+					start_address = base_va + e.address;
+				else if (e.name == "gum_barebone_try_remap_writable_pages")
+					remap_writable_pages_address = base_va + e.address;
+				else if (e.name == "gum_try_mprotect")
+					mprotect_address = base_va + e.address;
+				else
+					return true;
+				return start_address == 0 || mprotect_address == 0 || remap_writable_pages_address == 0;
+			});
+			if (start_address == 0)
+				throw new Error.INVALID_ARGUMENT ("Invalid agent: no _start symbol found");
+			if (remap_writable_pages_address == 0)
+				throw new Error.INVALID_ARGUMENT ("Invalid agent: no gum_barebone_try_remap_writable_pages symbol found");
+			if (mprotect_address == 0)
+				throw new Error.INVALID_ARGUMENT ("Invalid agent: no gum_try_mprotect symbol found");
+
+			remap_writable_pages_callback = yield new Callback (remap_writable_pages_address,
+				new RemapWritablePagesHandler (machine), machine, cancellable);
+			mprotect_callback = yield new Callback (mprotect_address, new MemoryProtectHandler (machine), machine, cancellable);
+
+			var config_blob = config_builder.end ().get_data_as_bytes ();
+			config_allocation = yield allocator.allocate (config_blob.get_size (), 8, cancellable);
+
+			yield gdb.write_byte_array (config_allocation.virtual_address, config_blob, cancellable);
+
+			yield machine.invoke (start_address, {
+					config_allocation.virtual_address,
+					config_allocation.size
+				},
+				cancellable);
+
+			yield gdb.continue (cancellable);
+
+			process_incoming_messages.begin ();
+
+			return true;
+		}
+
+		public async void close (Cancellable? cancellable) throws IOError {
+			io_cancellable.cancel ();
+		}
+
+		public async AgentScriptId create_script (string source, Cancellable? cancellable) throws Error, IOError {
+			var payload = new Variant ("s", source);
+			var response = yield execute_command (Command.CREATE_SCRIPT, payload, cancellable);
+			if (!response.check_format_string ("u", false))
+				throw new Error.PROTOCOL ("Invalid create_script response format");
+			uint32 script_handle;
+			response.get ("u", out script_handle);
+			return AgentScriptId (script_handle);
+		}
+
+		public async void load_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
+			var payload = new Variant ("u", script_id.handle);
+			yield execute_command (Command.LOAD_SCRIPT, payload, cancellable);
+		}
+
+		public async void destroy_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
+			var payload = new Variant ("u", script_id.handle);
+			yield execute_command (Command.DESTROY_SCRIPT, payload, cancellable);
+		}
+
+		public async void post_script_message (AgentScriptId script_id, string message, Bytes? data, Cancellable? cancellable)
+				throws Error, IOError {
+			var payload = new Variant ("(us)", script_id.handle, message);
+			// TODO: Include data.
+			yield execute_command (Command.POST_SCRIPT_MESSAGE, payload, cancellable);
+		}
+
+		private async Variant execute_command (Command command, Variant payload, Cancellable? cancellable) throws Error, IOError {
+			uint16 request_id = next_request_id++;
+
+			var command_message = new Variant ("(yqv)", (uint8) command, request_id, payload);
+			if (machine.gdb.byte_order != ByteOrder.HOST)
+				command_message = command_message.byteswap ();
+			var command_bytes = command_message.get_data_as_bytes ();
+
+			var builder = machine.gdb.make_buffer_builder ();
+			Bytes frame = builder
+				.append_uint32 ((uint32) command_bytes.get_size ())
+				.append_bytes (command_bytes)
+				.build ();
+
+			var promise = new Promise<Variant> ();
+			pending_requests[request_id] = promise;
+
+			try {
+				yield output.write_all_async (frame.get_data (), Priority.DEFAULT, cancellable, null);
+			} catch (GLib.Error e) {
+				pending_requests.unset (request_id);
+				throw new Error.TRANSPORT ("%s", e.message);
+			}
+
+			var timeout_source = new TimeoutSource (COMMAND_TIMEOUT_MS);
+			timeout_source.set_callback (() => {
+				Promise<Variant>? p;
+				if (pending_requests.unset (request_id, out p))
+					p.reject (new Error.TIMED_OUT ("Command timed out"));
+				return Source.REMOVE;
+			});
+			timeout_source.attach (MainContext.get_thread_default ());
+
+			try {
+				return yield promise.future.wait_async (cancellable);
+			} finally {
+				timeout_source.destroy ();
+			}
+		}
+
+		private async void process_incoming_messages () {
+			var byte_order = machine.gdb.byte_order;
+
+			try {
+				while (true) {
+					size_t header_size = 4;
+					if (input.get_available () < header_size)
+						yield fill_until_n_bytes_available (header_size);
+
+					uint32 body_size = 0;
+					unowned uint8[] size_buf = ((uint8[]) &body_size)[:4];
+					input.peek (size_buf);
+					body_size = uint32.from_little_endian (body_size);
+
+					size_t full_size = header_size + body_size;
+					if (input.get_available () < full_size)
+						yield fill_until_n_bytes_available (full_size);
+
+					var body = new uint8[body_size];
+					input.peek (body, header_size);
+
+					input.skip (full_size, io_cancellable);
+
+					var raw_message = new Bytes.take ((owned) body);
+
+					var message = Variant.new_from_data (new VariantType ("(yqv)"), raw_message.get_data (), false,
+						raw_message);
+					if (byte_order != ByteOrder.HOST)
+						message = message.byteswap ();
+					if (!message.check_format_string ("(yqv)", false))
+						throw new Error.PROTOCOL ("Invalid message format");
+
+					uint8 command_code;
+					uint16 request_id;
+					Variant payload;
+					message.get ("(yqv)", out command_code, out request_id, out payload);
+
+					if (command_code == Command.SCRIPT_MESSAGE) {
+						if (!payload.check_format_string ("(us)", false))
+							throw new Error.PROTOCOL ("Invalid script message payload format");
+
+						uint32 script_handle;
+						unowned string json;
+						payload.get ("(u&s)", out script_handle, out json);
+
+						script_message (AgentScriptId (script_handle), json, null);
+					} else if (command_code == Command.REPLY) {
+						Promise<Variant>? promise;
+						if (pending_requests.unset (request_id, out promise))
+							promise.resolve (payload);
+					}
+				}
+			} catch (GLib.Error e) {
+			}
+		}
+
+		private async void fill_until_n_bytes_available (size_t minimum) throws Error, IOError {
+			size_t available = input.get_available ();
+			while (available < minimum) {
+				if (input.get_buffer_size () < minimum)
+					input.set_buffer_size (minimum);
+
+				ssize_t n;
+				try {
+					n = yield input.fill_async ((ssize_t) (input.get_buffer_size () - available), Priority.DEFAULT,
+						io_cancellable);
+				} catch (GLib.Error e) {
+					throw new Error.TRANSPORT ("Connection closed");
+				}
+
+				if (n == 0)
+					throw new Error.TRANSPORT ("Connection closed");
+
+				available += n;
+			}
+		}
+
+		private class RemapWritablePagesHandler : Object, CallbackHandler {
+			public signal void output (string message);
+
+			public uint arity {
+				get { return 2; }
+			}
+
+			private Machine machine;
+
+			public RemapWritablePagesHandler (Machine machine) {
+				this.machine = machine;
+			}
+
+			public async uint64 handle_invocation (uint64[] args, CallFrame frame, Cancellable? cancellable)
+					throws Error, IOError {
+				var pages = args[0];
+				var num_pages = (uint) args[1];
+
+				var physical_addresses = new Gee.ArrayList<uint64?> ();
+				var gdb = machine.gdb;
+				var reader = new BufferReader (yield gdb.read_buffer (pages, num_pages * gdb.pointer_size, cancellable));
+				for (uint i = 0; i != num_pages; i++)
+					physical_addresses.add (reader.read_pointer ());
+
+				Allocation allocation = yield machine.allocate_pages (physical_addresses, cancellable);
+				// TODO: Handle cleanup.
+
+				return allocation.virtual_address;
+			}
+		}
+
+		private class MemoryProtectHandler : Object, CallbackHandler {
+			public signal void output (string message);
+
+			public uint arity {
+				get { return 3; }
+			}
+
+			private Machine machine;
+
+			public MemoryProtectHandler (Machine machine) {
+				this.machine = machine;
+			}
+
+			public async uint64 handle_invocation (uint64[] args, CallFrame frame, Cancellable? cancellable)
+					throws Error, IOError {
+				var address = args[0];
+				var size = (size_t) args[1];
+				var prot = (Gum.PageProtection) args[2];
+				try {
+					yield machine.protect_pages (address, size, prot, cancellable);
+					return 1;
+				} catch (GLib.Error e) {
+					return 0;
+				}
+			}
+		}
+
+		private enum Command {
+			CREATE_SCRIPT = 1,
+			LOAD_SCRIPT = 2,
+			DESTROY_SCRIPT = 3,
+			POST_SCRIPT_MESSAGE = 4,
+			REPLY = 128,
+			SCRIPT_MESSAGE = 129
+		}
+
+		private enum Status {
+			IDLE,
+			BUSY,
+			DATA_READY,
+			ERROR
+		}
+	}
+
+	private class SymbolHashBuilder : Object {
+		private Gee.Map<string, Gee.List<SymbolInfo>> symbol_table = new Gee.TreeMap<string, Gee.List<SymbolInfo>> ();
+
+		public void add_symbol (SymbolInfo symbol) {
+			var symbol_list = symbol_table[symbol.name];
+			if (symbol_list == null) {
+				symbol_list = new Gee.ArrayList<SymbolInfo> ();
+				symbol_table[symbol.name] = symbol_list;
+			}
+			symbol_list.add (symbol);
+		}
+
+		public Bytes build (ByteOrder byte_order) {
+			var builder = new BufferBuilder (byte_order);
+
+			var all_symbols = new Gee.ArrayList<SymbolInfo> ();
+			foreach (var entry in symbol_table.entries) {
+				foreach (var symbol in entry.value)
+					all_symbols.add (symbol);
+			}
+
+			uint total_symbols = all_symbols.size;
+			builder.append_uint32 (total_symbols);
+
+			var name_index_offset = builder.offset;
+			builder.skip (total_symbols * 4);
+
+			var addr_index_offset = builder.offset;
+			builder.skip (total_symbols * 4);
+
+			var symbol_offsets = new uint32[total_symbols];
+			for (uint i = 0; i != total_symbols; i++) {
+				var symbol = all_symbols[(int) i];
+
+				builder.align (4);
+				symbol_offsets[i] = (uint32) builder.offset;
+
+				builder.append_uint32 (symbol.offset);
+				// TODO: Only include details we need.
+				builder.append_uint8 (symbol.symbol_type);
+				builder.append_uint8 (symbol.section);
+				builder.append_uint16 (symbol.description);
+				builder.append_string (symbol.name, StringTerminator.NUL);
+			}
+
+			for (uint i = 0; i != total_symbols; i++)
+				builder.write_uint32 (name_index_offset + (i * 4), symbol_offsets[i]);
+
+			var addr_sorted_symbols = new Gee.ArrayList<int> ();
+			for (uint i = 0; i != total_symbols; i++)
+				addr_sorted_symbols.add ((int) i);
+			addr_sorted_symbols.sort ((a, b) => {
+				var symbol_a = all_symbols[a];
+				var symbol_b = all_symbols[b];
+				if (symbol_a.offset < symbol_b.offset)
+					return -1;
+				if (symbol_a.offset > symbol_b.offset)
+					return 1;
+				return 0;
+			});
+
+			for (uint i = 0; i != total_symbols; i++) {
+				int original_index = addr_sorted_symbols[(int) i];
+				uint symbol_data_offset = symbol_offsets[original_index];
+				builder.write_uint32 (addr_index_offset + (i * 4), symbol_data_offset);
+			}
+
+			return builder.build ();
+		}
+	}
+}

src/barebone/agent/.cargo/config.toml

@@ -0,0 +1,2 @@
+[build]
+target = "aarch64-unknown-none"

src/barebone/agent/Cargo.lock

@@ -0,0 +1,296 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "bindgen"
+version = "0.72.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f72209734318d0b619a5e0f5129918b848c416e122a3c4ce054e03cb87b726f"
+dependencies = [
+ "bitflags",
+ "cexpr",
+ "clang-sys",
+ "itertools",
+ "log",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex",
+ "syn",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
+
+[[package]]
+name = "cc"
+version = "1.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d487aa071b5f64da6f19a3e848e3578944b726ee5a4854b82172f02aa876bfdc"
+dependencies = [
+ "shlex",
+]
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
+
+[[package]]
+name = "clang-sys"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
+[[package]]
+name = "frida-barebone-agent"
+version = "1.0.0"
+dependencies = [
+ "bindgen",
+ "cc",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
+
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.174"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
+
+[[package]]
+name = "libloading"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667"
+dependencies = [
+ "cfg-if",
+ "windows-targets",
+]
+
+[[package]]
+name = "log"
+version = "0.4.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
+
+[[package]]
+name = "memchr"
+version = "2.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "061c1221631e079b26479d25bbf2275bfe5917ae8419cd7e34f13bfc2aa7539a"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "regex"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "syn"
+version = "2.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+
+[[package]]
+name = "windows-targets"
+version = "0.53.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c66f69fcc9ce11da9966ddb31a40968cad001c5bedeb5c2b82ede4253ab48aef"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"

src/barebone/agent/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "frida-barebone-agent"
+version = "1.0.0"
+edition = "2024"
+build = "build.rs"
+
+[profile.release]
+panic = "abort"
+opt-level = "z"
+overflow-checks = false
+lto = true
+codegen-units = 1
+
+[profile.dev]
+panic = "abort"
+
+[build-dependencies]
+cc = "1.2"
+bindgen = "0.72.0"

src/barebone/agent/README.md

@@ -0,0 +1,43 @@
+## Getting the C toolchain
+
+    npm install -g xpm
+    xpm install
+    export PATH=$PWD/xpacks/.bin:$PATH
+
+## How to build Gum
+
+    ./configure \
+        --host=aarch64-none-elf \
+        --enable-gumjs \
+        --with-devkits=gum,gumjs \
+        --with-devkit-symbol-scope=original
+    make
+    export GUMJS_DEVKIT_DIR=$PWD/build/bindings/gumjs/devkit
+
+## Building
+
+    export PATH=$PWD/xpacks/.bin:$PATH
+    export CC_aarch64_unknown_none=aarch64-none-elf-gcc
+    export AR_aarch64_unknown_none=aarch64-none-elf-ar
+    export RANLIB_aarch64_unknown_none=aarch64-none-elf-ranlib
+
+## Development loop
+
+    export FRIDA_BAREBONE_CONFIG=$PWD/etc/xnu.json
+    cargo build --release && make -C ~/src/frida-python && killall -9 qemu-system-aarch64 && sleep 2 && frida -D barebone -p 0
+
+## Speeding up loop
+
+    ./configure \
+        -- \
+        -Dfrida-core:compat=disabled \
+        -Dfrida-core:local_backend=disabled \
+        -Dfrida-core:fruity_backend=disabled \
+        -Dfrida-core:droidy_backend=disabled \
+        -Dfrida-core:socket_backend=disabled \
+        -Dfrida-core:compiler_backend=disabled \
+        -Dfrida-core:gadget=disabled \
+        -Dfrida-core:server=disabled \
+        -Dfrida-core:portal=disabled \
+        -Dfrida-core:inject=disabled \
+        -Dfrida-core:tests=enabled

src/barebone/agent/agent.lds

@@ -0,0 +1,51 @@
+SECTIONS {
+  .text : {
+    *(.text.entrypoint)
+    *(.text*)
+  }
+  .rodata : {
+    *(.rodata*)
+  }
+  .kernel_addrs : ALIGN(8) {
+    . = ALIGN(8);
+    _panic = .; . += 8;
+    _IOLog = .; . += 8;
+    _kalloc = .; . += 8;
+    _kfree = .; . += 8;
+    _kernel_thread_start = .; . += 8;
+    _assert_wait = .; . += 8;
+    _assert_wait_timeout = .; . += 8;
+    _thread_block = .; . += 8;
+    _thread_wakeup = .; . += 8;
+    _mach_absolute_time = .; . += 8;
+    _absolutetime_to_nanoseconds = .; . += 8;
+    _clock_get_calendar_microtime = .; . += 8;
+    _ml_io_map = .; . += 8;
+    _ml_vtophys = .; . += 8;
+    __ZN9IOService11getPlatformEv = .; . += 8;
+    __ZN9IOServiceC2Ev = .; . += 8;
+    __ZN8OSSymbol17withCStringNoCopyEPKc = .; . += 8;
+    __ZN6OSData9withBytesEPKvj = .; . += 8;
+  }
+  .data.rel.ro : {
+    *(.data.rel.ro*)
+  }
+  .got : {
+    *(.got*)
+  }
+  .bss : {
+    *(.bss*)
+  }
+  . = ALIGN(8);
+  _heap_start = .;
+}
+
+VERSION {
+  {
+    global:
+      _start;
+
+    local:
+      *;
+  };
+}

src/barebone/agent/build.rs

@@ -0,0 +1,126 @@
+use std::{
+    env, fs,
+    path::{Path, PathBuf},
+    process::{Command, Stdio},
+};
+
+fn main() {
+    let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap());
+    let devkit_dir = PathBuf::from(env::var("GUMJS_DEVKIT_DIR").unwrap());
+
+    let cc_str = env::var("CC_aarch64_unknown_none")
+            .or_else(|_| env::var("CC"))
+            .unwrap_or_else(|_| "cc".to_string());
+    let cc = Path::new(&cc_str);
+    let cc_include_paths = detect_gcc_include_paths(cc);
+    let cc_library_paths = detect_gcc_library_paths(cc);
+
+    let cc_clang_args: Vec<String> = cc_include_paths
+        .iter()
+        .flat_map(|path| vec!["-isystem".to_string(), path.to_string_lossy().into_owned()])
+        .collect();
+
+    let bindings = bindgen::Builder::default()
+        .use_core()
+        .header(devkit_dir.join("frida-gumjs.h").to_str().unwrap())
+        .clang_arg("-nostdinc")
+        .clang_arg("-target")
+        .clang_arg("aarch64-none-elf")
+        .clang_args(cc_clang_args)
+        .clang_arg(format!("-I{}", devkit_dir.to_str().unwrap()))
+        .merge_extern_blocks(true)
+        .generate()
+        .expect("Unable to generate bindings");
+
+    bindings
+        .write_to_file(out_dir.join("bindings.rs"))
+        .expect("Couldn't write bindings");
+
+    println!(
+        "cargo:rustc-link-search=native={}",
+        devkit_dir.to_str().unwrap()
+    );
+    println!("cargo:rustc-link-lib=static=frida-gumjs");
+    for path in cc_library_paths {
+        println!("cargo:rustc-link-search=native={}", path.to_string_lossy());
+    }
+    println!("cargo:rustc-link-lib=static=c");
+    println!("cargo:rustc-link-lib=static=m");
+    println!("cargo:rustc-link-arg=--export-dynamic");
+    println!("cargo:rustc-link-arg=--emit-relocs");
+    println!("cargo:rustc-link-arg=--script=agent.lds");
+    println!("cargo:rustc-link-arg=--gc-sections");
+    println!("cargo:rerun-if-changed=build.rs");
+}
+
+pub fn detect_gcc_include_paths(gcc: &Path) -> Vec<PathBuf> {
+    let out = Command::new(gcc)
+        .args(["-xc", "-E", "-v", "-"])
+        .stdin(Stdio::null())
+        .output()
+        .expect("Failed to execute GCC to detect include paths");
+
+    let stderr = String::from_utf8_lossy(&out.stderr);
+
+    let mut grab = false;
+    let mut paths = Vec::<PathBuf>::new();
+
+    for line in stderr.lines() {
+        if line.starts_with("#include <...> search starts here:") {
+            grab = true;
+            continue;
+        }
+        if line.starts_with("End of search list.") {
+            break;
+        }
+        if !grab {
+            continue;
+        }
+
+        let raw = line.trim();
+        if raw.is_empty() {
+            continue;
+        }
+
+        let p = Path::new(raw);
+        if p.exists() {
+            let canonical = fs::canonicalize(p).expect("Failed to canonicalize include path");
+            if !paths.contains(&canonical) {
+                paths.push(canonical);
+            }
+        }
+    }
+
+    paths
+}
+
+pub fn detect_gcc_library_paths(gcc: &Path) -> Vec<PathBuf> {
+    let out = Command::new(gcc).arg("-print-search-dirs").output()
+        .expect("Failed to execute GCC to detect library paths");
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let line = stdout.lines().find(|l| l.starts_with("libraries:"))
+        .expect("Failed to find libraries line in GCC output");
+
+    let raw_dirs = line.trim_start_matches("libraries: =");
+    let sep = if cfg!(windows) { ';' } else { ':' };
+
+    let mut paths = Vec::new();
+    for raw in raw_dirs.split(sep) {
+        if raw.is_empty() {
+            continue;
+        }
+
+        let p = Path::new(raw);
+        if !p.exists() {
+            continue;
+        }
+
+        let canonical = fs::canonicalize(p).expect("Failed to canonicalize library path");
+        if !paths.contains(&canonical) {
+            paths.push(canonical);
+        }
+    }
+
+    paths
+}

src/barebone/agent/env.sh

@@ -0,0 +1,8 @@
+export FRIDA_BAREBONE_CONFIG=$PWD/etc/xnu.json
+export PYTHONPATH=$HOME/src/frida-python
+
+export PATH=$PWD/xpacks/.bin:$PATH
+export CC_aarch64_unknown_none=aarch64-none-elf-gcc
+export AR_aarch64_unknown_none=aarch64-none-elf-ar
+export RANLIB_aarch64_unknown_none=aarch64-none-elf-ranlib
+export GUMJS_DEVKIT_DIR=/home/oleavr/src/frida-gum/build/bindings/gumjs/devkit

src/barebone/agent/etc/noalloc.json

@@ -0,0 +1,6 @@
+{
+  "connection": {
+    "host": "127.0.0.1",
+    "port": 9000
+  }
+}

src/barebone/agent/etc/physical.json

@@ -0,0 +1,18 @@
+{
+  "connection": {
+    "host": "127.0.0.1",
+    "port": 9000
+  },
+  "allocator": {
+    "mode": "physical",
+    "physical_base": "0x8ec9b4000"
+  },
+  "agent": {
+    "path": "/Users/oleavr/src/frida-core/src/barebone/agent/target/aarch64-unknown-none/debug/frida-barebone-agent",
+    "transport": {
+      "type": "ram",
+      "path": "/Volumes/RAM Disk/ios-dram",
+      "base_address": "0x800000000"
+    }
+  }
+}

src/barebone/agent/etc/xnu.json

@@ -0,0 +1,42 @@
+{
+  "connection": {
+    "host": "127.0.0.1",
+    "port": 9000
+  },
+  "allocator": {
+    "mode": "target-functions",
+    "alloc_function": "0xfffffff007a3c278",
+    "free_function": "0xfffffff007a3c338"
+  },
+  "agent": {
+    "path": "/Users/oleavr/src/frida-core/src/barebone/agent/target/aarch64-unknown-none/release/frida-barebone-agent",
+    "transport": {
+      "type": "hostlink",
+      "qmp": "unix:/Users/oleavr/src/frida-barebone-ios/qmp.sock"
+    }
+  },
+  "image": {
+    "file": "/Users/oleavr/src/frida-barebone-ios/iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/kernelcache.research.iphone12b",
+    "base": "0xfffffff007004000",
+    "symbols": {
+      "IOLog": "0xfedb68",
+      "_ZN6OSData9withBytesEPKvj": "0xf88588",
+      "_ZN8OSSymbol17withCStringNoCopyEPKc": "0xfc05dc",
+      "_ZN9IOService11getPlatformEv": "0x101ad48",
+      "_ZN9IOServiceC2Ev": "0x1018318",
+      "absolutetime_to_nanoseconds": "0xb5d1e4",
+      "assert_wait": "0xa4d294",
+      "assert_wait_timeout": "0xa4d430",
+      "clock_get_calendar_microtime": "0xa1f32c",
+      "kalloc": "0xa38278",
+      "kernel_thread_start": "0xa70674",
+      "kfree": "0xa38338",
+      "mach_absolute_time": "0xb5ccc0",
+      "ml_io_map": "0xb57a04",
+      "ml_vtophys": "0xb584a0",
+      "panic": "0x27d7944",
+      "thread_block": "0xa51728",
+      "thread_wakeup": "0xa54ea0"
+    }
+  }
+}

src/barebone/agent/examples/spawn-observer.js

@@ -0,0 +1,34 @@
+const _copyinstr = new NativeFunction(
+    DebugSymbol.getFunctionByName('copyinstr'),
+  'int',
+  ['pointer', 'pointer', 'size_t', 'pointer']);
+const { pointerSize } = Process;
+
+Interceptor.attach(DebugSymbol.getFunctionByName('__mac_execve'), {
+  onEnter(args) {
+    const fname = copyinstr(args[1].readPointer());
+    console.log(`>>> __mac_execve() fname=${fname}`);
+  },
+  onLeave(retval) {
+    console.log(`<<< __mac_execve() => ${retval.toInt32()}`);
+  }
+});
+
+Interceptor.attach(DebugSymbol.getFunctionByName('posix_spawn'), {
+  onEnter(args) {
+    const path = copyinstr(args[1].add(pointerSize).readPointer());
+    console.log(`>>> posix_spawn() path=${path}`);
+  },
+  onLeave(retval) {
+    console.log(`<<< posix_spawn() => ${retval.toInt32()}`);
+  }
+});
+
+function copyinstr(userAddr) {
+  const bufSize = 4096;
+  const buf = Memory.alloc(bufSize);
+  const actual = Memory.alloc(pointerSize);
+  if (_copyinstr(userAddr, buf, bufSize, actual) !== 0)
+    throw new Error('copyinstr failed');
+  return buf.readUtf8String();
+}

src/barebone/agent/explore.ts

@@ -0,0 +1,10 @@
+console.log("Agent loading");
+const cm = new CModule(File.readAllBytes("./target/aarch64-unknown-none/release/frida-barebone-agent"));
+//const cm = new CModule(File.readAllBytes("./target/aarch64-unknown-none/debug/frida-barebone-agent"));
+
+const start = new NativeFunction(cm._start, "pointer", []);
+const bufferPhysicalAddress = start();
+console.log("Ready! Buffer is at physical address:", bufferPhysicalAddress);
+$gdb.continue();
+
+Object.assign(globalThis, { cm, start });

src/barebone/agent/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "frida-barebone-agent",
+  "version": "1.0.0",
+  "description": "xPack configuration for frida-barebone-agent",
+  "xpack": {
+    "minimumXpmRequired": "0.20.8",
+    "dependencies": {},
+    "devDependencies": {
+      "@xpack-dev-tools/aarch64-none-elf-gcc": {
+        "specifier": "14.2.1-1.1.1",
+        "local": "link",
+        "platforms": "all"
+      }
+    },
+    "properties": {},
+    "actions": {},
+    "buildConfigurations": {}
+  }
+}

src/barebone/agent/src/glib.rs

@@ -0,0 +1,46 @@
+use core::ptr;
+
+use crate::bindings::{g_wait_is_set, gint64, gpointer};
+use crate::xnu;
+
+const G_WAIT_INFINITE: gint64 = -1;
+
+pub static mut WAKEUP_TOKEN: u64 = 0;
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_get_monotonic_time() -> gint64 {
+    let abstime = xnu::mach_absolute_time();
+    let time = xnu::absolutetime_to_nanoseconds(abstime);
+    (time / 1000) as gint64
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_wait_sleep(token: gpointer, timeout_us: gint64) {
+    let wait_event = ptr::addr_of_mut!(WAKEUP_TOKEN) as *const u8;
+
+    let wait_result = if timeout_us == G_WAIT_INFINITE {
+        xnu::assert_wait(wait_event, xnu::THREAD_INTERRUPTIBLE)
+    } else {
+        xnu::assert_wait_timeout(
+            wait_event,
+            xnu::THREAD_INTERRUPTIBLE,
+            (timeout_us * 1000) as u32,
+            1, // TODO
+        )
+    };
+    if wait_result != xnu::THREAD_WAITING {
+        panic!("assert_wait_timeout failed: {}", wait_result);
+    }
+
+    if unsafe { g_wait_is_set(token) != 0 } {
+        xnu::thread_wakeup(wait_event);
+        return;
+    }
+
+    xnu::thread_block(None);
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_wait_wake(_token: gpointer) {
+    xnu::thread_wakeup(ptr::addr_of_mut!(WAKEUP_TOKEN) as *const u8);
+}

src/barebone/agent/src/gthread.rs

@@ -0,0 +1,609 @@
+use crate::bindings::GCond;
+use crate::bindings::GMutex;
+use crate::bindings::GPrivate;
+use crate::bindings::GRWLock;
+use crate::bindings::GRecMutex;
+use crate::bindings::GSystemThread;
+use crate::bindings::GThreadFunc;
+use crate::bindings::{gpointer, gulong};
+use alloc::boxed::Box;
+use alloc::collections::BTreeMap;
+use core::arch::asm;
+use core::ffi::c_void;
+use core::sync::atomic::{AtomicU32, AtomicU64, Ordering};
+
+// Our implementation structures that overlay the opaque GLib structures
+
+#[repr(C, align(8))]
+struct MutexImpl {
+    lock: AtomicU32,
+    _padding: [u8; core::mem::size_of::<GMutex>() - core::mem::size_of::<AtomicU32>()],
+}
+
+#[repr(C, align(8))]
+struct RecMutexImpl {
+    owner: AtomicU64,     // Thread ID of the owner (uses the 'p' field)
+    count: AtomicU32,     // Recursion count (uses i[0])
+    _unused: u32,         // Unused (uses i[1])
+}
+
+#[repr(C, align(8))]
+struct RWLockImpl {
+    state: AtomicU32,     // Lock state (readers count + writer bit)
+    _padding: [u8; core::mem::size_of::<GRWLock>() - core::mem::size_of::<AtomicU32>()],
+}
+
+#[repr(C, align(8))]
+struct CondImpl {
+    signal: AtomicU32,    // Signal state
+    _padding: [u8; core::mem::size_of::<GCond>() - core::mem::size_of::<AtomicU32>()],
+}
+
+const _: () = assert!(core::mem::size_of::<MutexImpl>() == core::mem::size_of::<GMutex>());
+const _: () = assert!(core::mem::align_of::<MutexImpl>() == core::mem::align_of::<GMutex>());
+const _: () = assert!(core::mem::size_of::<RecMutexImpl>() == core::mem::size_of::<GRecMutex>());
+const _: () = assert!(core::mem::align_of::<RecMutexImpl>() == core::mem::align_of::<GRecMutex>());
+const _: () = assert!(core::mem::size_of::<RWLockImpl>() == core::mem::size_of::<GRWLock>());
+const _: () = assert!(core::mem::align_of::<RWLockImpl>() == core::mem::align_of::<GRWLock>());
+const _: () = assert!(core::mem::size_of::<CondImpl>() == core::mem::size_of::<GCond>());
+const _: () = assert!(core::mem::align_of::<CondImpl>() == core::mem::align_of::<GCond>());
+
+// System thread implementation
+#[repr(C)]
+struct SystemThreadImpl {
+    mutex: GMutex,            // Protects the thread state
+    cond: GCond,              // Signals thread completion
+    thread_id: AtomicU64,     // XNU thread ID
+    func: GThreadFunc,        // Thread function
+    data: gpointer,           // User data
+    finished: AtomicU32,      // Whether thread has finished (0 = running, 1 = finished)
+    detached: AtomicU32,      // Whether thread is detached (1) or joinable (0)
+}
+
+// Thread wrapper data passed to XNU kernel thread
+#[repr(C)]
+struct ThreadWrapperData {
+    func: GThreadFunc,
+    data: gpointer,
+    system_thread: *mut SystemThreadImpl,
+}
+
+unsafe fn mutex_impl<'a>(mutex: *mut GMutex) -> &'a mut MutexImpl {
+    unsafe { &mut *(mutex as *mut MutexImpl) }
+}
+
+unsafe fn rec_mutex_impl<'a>(rec_mutex: *mut GRecMutex) -> &'a mut RecMutexImpl {
+    unsafe { &mut *(rec_mutex as *mut RecMutexImpl) }
+}
+
+unsafe fn rw_lock_impl<'a>(rw_lock: *mut GRWLock) -> &'a mut RWLockImpl {
+    unsafe { &mut *(rw_lock as *mut RWLockImpl) }
+}
+
+unsafe fn cond_impl<'a>(cond: *mut GCond) -> &'a mut CondImpl {
+    unsafe { &mut *(cond as *mut CondImpl) }
+}
+
+// TODO: Clean up Thread-Local Storage (TLS) entries when threads exit
+static mut TLS_STORAGE: Option<Box<BTreeMap<(u64, *mut GPrivate), *mut c_void>>> = None;
+static TLS_LOCK: AtomicU32 = AtomicU32::new(0);
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_mutex_init(mutex: *mut GMutex) {
+    unsafe {
+        let impl_ = mutex_impl(mutex);
+        impl_.lock.store(0, Ordering::Relaxed);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_mutex_clear(_mutex: *mut GMutex) {}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_mutex_lock(mutex: *mut GMutex) {
+    unsafe {
+        let impl_ = mutex_impl(mutex);
+        lock_acquire(&impl_.lock);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_mutex_unlock(mutex: *mut GMutex) {
+    unsafe {
+        let impl_ = mutex_impl(mutex);
+        lock_release(&impl_.lock);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_mutex_trylock(mutex: *mut GMutex) -> u32 {
+    unsafe {
+        let impl_ = mutex_impl(mutex);
+        if lock_try_acquire(&impl_.lock) {
+            1
+        } else {
+            0
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rec_mutex_init(rec_mutex: *mut GRecMutex) {
+    unsafe {
+        let impl_ = rec_mutex_impl(rec_mutex);
+        impl_.owner.store(0, Ordering::Relaxed);
+        impl_.count.store(0, Ordering::Relaxed);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rec_mutex_clear(_rec_mutex: *mut GRecMutex) {
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rec_mutex_lock(rec_mutex: *mut GRecMutex) {
+    unsafe {
+        let impl_ = rec_mutex_impl(rec_mutex);
+        let current_thread = get_current_thread_id();
+
+        loop {
+            if rec_mutex_try_acquire(impl_, current_thread) {
+                break;
+            }
+            rec_mutex_wait(impl_);
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rec_mutex_trylock(rec_mutex: *mut GRecMutex) -> u32 {
+    unsafe {
+        let impl_ = rec_mutex_impl(rec_mutex);
+        let current_thread = get_current_thread_id();
+
+        if rec_mutex_try_acquire(impl_, current_thread) {
+            1
+        } else {
+            0
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rec_mutex_unlock(rec_mutex: *mut GRecMutex) {
+    unsafe {
+        let impl_ = rec_mutex_impl(rec_mutex);
+
+        loop {
+            let current_count = impl_.count.load(Ordering::Relaxed);
+
+            if current_count == 1 {
+                if impl_.count
+                    .compare_exchange_weak(1, 0, Ordering::Release, Ordering::Relaxed)
+                    .is_ok()
+                {
+                    impl_.owner.store(0, Ordering::Relaxed);
+                    lock_notify_all();
+                    break;
+                }
+            } else {
+                if impl_.count
+                    .compare_exchange_weak(current_count, current_count - 1, Ordering::Release, Ordering::Relaxed)
+                    .is_ok()
+                {
+                    break;
+                }
+            }
+        }
+    }
+}
+
+unsafe fn rec_mutex_try_acquire(impl_: &mut RecMutexImpl, current_thread: u64) -> bool {
+    let current_count = impl_.count.load(Ordering::Relaxed);
+
+    if current_count == 0 {
+        if impl_.count
+            .compare_exchange_weak(0, 1, Ordering::Acquire, Ordering::Relaxed)
+            .is_ok()
+        {
+            impl_.owner.store(current_thread, Ordering::Relaxed);
+            return true;
+        }
+    } else {
+        let current_owner = impl_.owner.load(Ordering::Relaxed);
+        if current_owner == current_thread {
+            if impl_.count
+                .compare_exchange_weak(
+                    current_count,
+                    current_count + 1,
+                    Ordering::Acquire,
+                    Ordering::Relaxed,
+                )
+                .is_ok()
+            {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+unsafe fn rec_mutex_wait(impl_: &mut RecMutexImpl) {
+    while impl_.count.load(Ordering::Relaxed) != 0 {
+        unsafe { lock_wait_primitive() };
+    }
+}
+
+// Read-Write Lock implementation
+// We use a simple scheme where the atomic value represents:
+// - 0: unlocked
+// - 1-0x7FFFFFFF: number of readers holding the lock
+// - 0x80000000: writer lock held
+const RW_WRITER_LOCK_BIT: u32 = 0x80000000;
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_init(rw_lock: *mut GRWLock) {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        impl_.state.store(0, Ordering::Relaxed);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_clear(_rw_lock: *mut GRWLock) {}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_writer_lock(rw_lock: *mut GRWLock) {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        loop {
+            if rw_lock_writer_try_acquire(impl_) {
+                break;
+            }
+            rw_lock_wait_for_all(impl_);
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_writer_trylock(rw_lock: *mut GRWLock) -> u32 {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        if rw_lock_writer_try_acquire(impl_) {
+            1
+        } else {
+            0
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_writer_unlock(rw_lock: *mut GRWLock) {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        impl_.state.store(0, Ordering::Release);
+        lock_notify_all();
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_reader_lock(rw_lock: *mut GRWLock) {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        loop {
+            let current = impl_.state.load(Ordering::Relaxed);
+            if current & RW_WRITER_LOCK_BIT != 0 {
+                rw_lock_wait_for_writers(impl_);
+                continue;
+            }
+            if impl_.state
+                .compare_exchange_weak(current, current + 1, Ordering::Acquire, Ordering::Relaxed)
+                .is_ok()
+            {
+                break;
+            }
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_reader_trylock(rw_lock: *mut GRWLock) -> u32 {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        if rw_lock_reader_try_acquire(impl_) {
+            1
+        } else {
+            0
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_reader_unlock(rw_lock: *mut GRWLock) {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        loop {
+            let current = impl_.state.load(Ordering::Relaxed);
+            if impl_.state
+                .compare_exchange_weak(current, current - 1, Ordering::Release, Ordering::Relaxed)
+                .is_ok()
+            {
+                if current - 1 == 0 {
+                    lock_notify_all();
+                }
+                break;
+            }
+        }
+    }
+}
+
+unsafe fn rw_lock_writer_try_acquire(impl_: &mut RWLockImpl) -> bool {
+    impl_.state
+        .compare_exchange_weak(0, RW_WRITER_LOCK_BIT, Ordering::Acquire, Ordering::Relaxed)
+        .is_ok()
+}
+
+unsafe fn rw_lock_reader_try_acquire(impl_: &mut RWLockImpl) -> bool {
+    let current = impl_.state.load(Ordering::Relaxed);
+    if current & RW_WRITER_LOCK_BIT != 0 {
+        return false;
+    }
+    impl_.state
+        .compare_exchange_weak(current, current + 1, Ordering::Acquire, Ordering::Relaxed)
+        .is_ok()
+}
+
+unsafe fn rw_lock_wait_for_writers(impl_: &mut RWLockImpl) {
+    while impl_.state.load(Ordering::Relaxed) & RW_WRITER_LOCK_BIT != 0 {
+        unsafe { lock_wait_primitive() };
+    }
+}
+
+unsafe fn rw_lock_wait_for_all(impl_: &mut RWLockImpl) {
+    while impl_.state.load(Ordering::Relaxed) != 0 {
+        unsafe { lock_wait_primitive() };
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_cond_init(cond: *mut GCond) {
+    unsafe {
+        let impl_ = cond_impl(cond);
+        impl_.signal.store(0, Ordering::Relaxed);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_cond_clear(_cond: *mut GCond) {}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_cond_wait(cond: *mut GCond, mutex: *mut GMutex) {
+    unsafe {
+        g_mutex_unlock(mutex);
+
+        let impl_ = cond_impl(cond);
+        while impl_.signal.load(Ordering::Acquire) == 0 {
+            lock_wait_primitive();
+        }
+
+        g_mutex_lock(mutex);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_cond_signal(cond: *mut GCond) {
+    unsafe {
+        let impl_ = cond_impl(cond);
+        impl_.signal.store(1, Ordering::Release);
+        lock_notify_all();
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_cond_broadcast(cond: *mut GCond) {
+    unsafe {
+        let impl_ = cond_impl(cond);
+        impl_.signal.store(1, Ordering::Release);
+        lock_notify_all();
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_cond_wait_until(cond: *mut GCond, mutex: *mut GMutex, _end_time: i64) -> u32 {
+    // TODO: Implement proper timeout handling
+    g_cond_wait(cond, mutex);
+    1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_private_get(key: *mut GPrivate) -> *mut c_void {
+    unsafe {
+        let thread_id = get_current_thread_id();
+        lock_acquire(&TLS_LOCK);
+
+        ensure_tls_storage();
+        let storage_ptr = core::ptr::addr_of_mut!(TLS_STORAGE);
+        let storage = (*storage_ptr).as_ref().unwrap();
+
+        let value = storage
+            .get(&(thread_id, key))
+            .copied()
+            .unwrap_or(core::ptr::null_mut());
+
+        lock_release(&TLS_LOCK);
+        value
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_private_set(key: *mut GPrivate, value: *mut c_void) {
+    unsafe {
+        let thread_id = get_current_thread_id();
+        lock_acquire(&TLS_LOCK);
+
+        ensure_tls_storage();
+        let storage_ptr = core::ptr::addr_of_mut!(TLS_STORAGE);
+        let storage = (*storage_ptr).as_mut().unwrap();
+
+        storage.insert((thread_id, key), value);
+
+        lock_release(&TLS_LOCK);
+    }
+}
+
+unsafe fn ensure_tls_storage() {
+    let storage_ptr = core::ptr::addr_of_mut!(TLS_STORAGE);
+    unsafe {
+        if (*storage_ptr).is_none() {
+            *storage_ptr = Some(Box::new(BTreeMap::new()));
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _g_system_thread_create(
+    _stack_size: gulong,
+    _name: *const core::ffi::c_char,
+    func: GThreadFunc,
+    data: gpointer,
+) -> *mut GSystemThread {
+    unsafe {
+        let system_thread = crate::xnu::kalloc(core::mem::size_of::<SystemThreadImpl>()) as *mut SystemThreadImpl;
+
+        g_mutex_init(&mut (*system_thread).mutex);
+        g_cond_init(&mut (*system_thread).cond);
+        (*system_thread).thread_id.store(0, Ordering::Relaxed);
+        (*system_thread).func = func;
+        (*system_thread).data = data;
+        (*system_thread).finished.store(0, Ordering::Relaxed);
+        (*system_thread).detached.store(0, Ordering::Relaxed);
+
+        let wrapper_data = crate::xnu::kalloc(core::mem::size_of::<ThreadWrapperData>()) as *mut ThreadWrapperData;
+        (*wrapper_data).func = func;
+        (*wrapper_data).data = data;
+        (*wrapper_data).system_thread = system_thread;
+
+        let _xnu_result = crate::xnu::kernel_thread_start(thread_wrapper, wrapper_data as *mut c_void);
+
+        system_thread as *mut GSystemThread
+    }
+}
+
+extern "C" fn thread_wrapper(parameter: *mut c_void, _wait_result: i32) {
+    unsafe {
+        let wrapper_data = parameter as *mut ThreadWrapperData;
+        let func = (*wrapper_data).func;
+        let data = (*wrapper_data).data;
+        let system_thread = (*wrapper_data).system_thread;
+
+        let current_thread_id = get_current_thread_id();
+        (*system_thread).thread_id.store(current_thread_id, Ordering::Relaxed);
+
+        func.unwrap()(data);
+
+        g_mutex_lock(&mut (*system_thread).mutex);
+        (*system_thread).finished.store(1, Ordering::Relaxed);
+        g_cond_signal(&mut (*system_thread).cond);
+
+        let detached = (*system_thread).detached.load(Ordering::Relaxed);
+        g_mutex_unlock(&mut (*system_thread).mutex);
+
+        if detached != 0 {
+            cleanup_system_thread(system_thread);
+        }
+
+        cleanup_wrapper_data(wrapper_data);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _g_system_thread_detach(thread: *mut GSystemThread) {
+    unsafe {
+        let system_thread = thread as *mut SystemThreadImpl;
+
+        g_mutex_lock(&mut (*system_thread).mutex);
+        (*system_thread).detached.store(1, Ordering::Relaxed);
+
+        let finished = (*system_thread).finished.load(Ordering::Relaxed);
+        g_mutex_unlock(&mut (*system_thread).mutex);
+        if finished != 0 {
+            cleanup_system_thread(system_thread);
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _g_system_thread_wait(thread: *mut GSystemThread) {
+    unsafe {
+        let system_thread = thread as *mut SystemThreadImpl;
+
+        loop {
+            let thread_id = (*system_thread).thread_id.load(Ordering::Acquire);
+            if thread_id != 0 {
+                break;
+            }
+            core::hint::spin_loop();
+        }
+
+        g_mutex_lock(&mut (*system_thread).mutex);
+        while (*system_thread).finished.load(Ordering::Relaxed) == 0 {
+            g_cond_wait(&mut (*system_thread).cond, &mut (*system_thread).mutex);
+        }
+        g_mutex_unlock(&mut (*system_thread).mutex);
+
+        cleanup_system_thread(system_thread);
+    }
+}
+
+unsafe fn cleanup_system_thread(system_thread: *mut SystemThreadImpl) {
+    crate::xnu::free(system_thread as *mut u8, core::mem::size_of::<SystemThreadImpl>());
+}
+
+unsafe fn cleanup_wrapper_data(wrapper_data: *mut ThreadWrapperData) {
+    crate::xnu::free(wrapper_data as *mut u8, core::mem::size_of::<ThreadWrapperData>());
+}
+
+unsafe fn lock_acquire(lock: &AtomicU32) {
+    loop {
+        if unsafe { lock_try_acquire(lock) } {
+            break;
+        }
+        unsafe { lock_wait(lock) };
+    }
+}
+
+unsafe fn lock_try_acquire(lock: &AtomicU32) -> bool {
+    lock.compare_exchange_weak(0, 1, Ordering::Acquire, Ordering::Relaxed)
+        .is_ok()
+}
+
+unsafe fn lock_release(lock: &AtomicU32) {
+    lock.store(0, Ordering::Release);
+    unsafe { lock_notify_all() };
+}
+
+unsafe fn lock_wait(lock: &AtomicU32) {
+    while lock.load(Ordering::Relaxed) != 0 {
+        unsafe { lock_wait_primitive() };
+    }
+}
+
+unsafe fn lock_wait_primitive() {
+    unsafe {
+        asm!("wfe", options(nomem, nostack));
+    }
+}
+
+unsafe fn lock_notify_all() {
+    unsafe {
+        asm!("sev", options(nomem, nostack));
+    }
+}
+
+pub unsafe fn get_current_thread_id() -> u64 {
+    let thread_ptr: u64;
+    unsafe {
+        asm!("mrs {}, tpidr_el1", out(reg) thread_ptr, options(nomem, nostack));
+    }
+    thread_ptr
+}

src/barebone/agent/src/gum.rs

@@ -0,0 +1,457 @@
+use crate::{
+    bindings::{
+        _GInterfaceInfo, _GTypeInfo, _GumPageProtection_GUM_PAGE_EXECUTE,
+        _GumRwxSupport_GUM_RWX_NONE, GArray, GObject, GObjectClass, GPrivate, GType,
+        GumDebugSymbolDetails, GumExportDetails, GumExportType_GUM_EXPORT_FUNCTION,
+        GumFoundExportFunc, GumMemoryRange, GumModule, GumModuleInterface, GumModuleRegistry,
+        GumPageProtection, GumRwxSupport, GumThreadId, GumTlsKey, g_array_append_vals, g_array_new,
+        g_free, g_object_get_type, g_object_new, g_object_unref, g_once_init_enter,
+        g_once_init_leave, g_strdup, g_type_add_interface_static, g_type_class_peek_parent,
+        g_type_register_static, gboolean, gchar, gconstpointer, gpointer, gsize, guint,
+        gum_barebone_register_module,
+        gum_barebone_try_remap_writable_pages as _gum_barebone_try_remap_writable_pages,
+        gum_module_get_type, gum_mprotect, gum_query_page_size,
+    },
+    gthread, libc, xnu,
+};
+use alloc::boxed::Box;
+use alloc::ffi::CString;
+use alloc::format;
+use core::ptr;
+use core::{ffi::CStr, ptr::read_volatile};
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_process_get_current_thread_id() -> GumThreadId {
+    unsafe { gthread::get_current_thread_id() }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_barebone_query_page_size() -> guint {
+    unsafe {
+        let tcr_el1: u64;
+        core::arch::asm!("mrs {}, tcr_el1", out(reg) tcr_el1, options(nomem, nostack));
+
+        let tg0 = (tcr_el1 >> 14) & 0x3;
+
+        match tg0 {
+            0b00 => 4096,
+            0b01 => 65536,
+            0b10 => 16384,
+            _ => 4096,
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_query_rwx_support() -> GumRwxSupport {
+    _GumRwxSupport_GUM_RWX_NONE
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_memory_can_remap_writable() -> gboolean {
+    1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_memory_try_remap_writable_pages(
+    first_page: gpointer,
+    n_pages: guint,
+) -> gpointer {
+    unsafe {
+        let page_size = gum_query_page_size() as usize;
+        let mut physical_addrs = alloc::vec::Vec::with_capacity(n_pages as usize);
+
+        let mut current_page = first_page as u64;
+        for _ in 0..n_pages {
+            let phys_addr = xnu::ml_vtophys(current_page);
+            physical_addrs.push(phys_addr as gpointer);
+            current_page += page_size as u64;
+        }
+
+        _gum_barebone_try_remap_writable_pages(
+            physical_addrs.as_ptr() as *mut *const core::ffi::c_void,
+            physical_addrs.len() as guint,
+        )
+    }
+}
+
+#[unsafe(no_mangle)]
+#[inline(never)]
+pub extern "C" fn gum_barebone_try_remap_writable_pages(
+    addrs: *const gpointer,
+    n_addrs: guint,
+) -> gpointer {
+    unsafe {
+        read_volatile(&n_addrs);
+        read_volatile(addrs)
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_try_mprotect(
+    _address: gpointer,
+    _size: gsize,
+    _prot: GumPageProtection,
+) -> gboolean {
+    1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_memory_allocate(
+    _address: gpointer,
+    size: gsize,
+    _alignment: gsize,
+    prot: GumPageProtection,
+) -> gpointer {
+    let ptr = crate::xnu::kalloc(size as usize);
+    unsafe {
+        core::ptr::write_bytes(ptr, 0, size as usize);
+        if (prot & _GumPageProtection_GUM_PAGE_EXECUTE) != 0 {
+            gum_mprotect(ptr as gpointer, size, prot);
+        }
+    }
+    ptr as gpointer
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_memory_free(address: gpointer, size: gsize) -> gboolean {
+    crate::xnu::free(address as *mut u8, size as usize);
+    1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_clear_cache(address: gpointer, size: gsize) {
+    unsafe {
+        let start = address as *const u8;
+        let end = start.add(size as usize);
+        libc::__clear_cache(start, end);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_tls_key_new() -> GumTlsKey {
+    Box::into_raw(Box::new(unsafe { core::mem::zeroed::<GPrivate>() })) as GumTlsKey
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_tls_key_free(key: GumTlsKey) {
+    unsafe {
+        let _ = Box::from_raw(key as *mut GPrivate);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_tls_key_get_value(key: GumTlsKey) -> gpointer {
+    gthread::g_private_get(key as *mut GPrivate)
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_tls_key_set_value(key: GumTlsKey, value: gpointer) {
+    gthread::g_private_set(key as *mut GPrivate, value)
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_barebone_on_registry_activating(registry: *mut GumModuleRegistry) {
+    let kernel_base = crate::xnu::get_kernel_base();
+
+    unsafe {
+        let module_infos = core::ptr::addr_of!(crate::MODULE_INFO);
+        let module_infos = &*module_infos;
+
+        let mut i = 0;
+        for module_info in module_infos.iter() {
+            let module_base = kernel_base + module_info.offset as u64;
+
+            let module_path = if i == 0 {
+                "/System/Library/Kernels/kernel"
+            } else {
+                &format!(
+                    "/System/Library/Extensions/{}.kext/{}",
+                    module_info.name, module_info.name
+                )
+            };
+            let module_range = GumMemoryRange {
+                base_address: module_base,
+                size: module_info.size as u64,
+            };
+
+            let module = gum_native_module_new(&module_path, &module_info.version, &module_range);
+            gum_barebone_register_module(registry, module);
+            g_object_unref(module as gpointer);
+
+            i += 1;
+        }
+    }
+}
+
+#[repr(C)]
+pub struct GumNativeModule {
+    parent: GObject,
+    name: *mut gchar,
+    version: *mut gchar,
+    path: *mut gchar,
+    range: GumMemoryRange,
+}
+
+#[repr(C)]
+#[allow(dead_code)]
+pub struct GumNativeModuleClass {
+    parent_class: GObjectClass,
+}
+
+static mut GUM_NATIVE_MODULE_TYPE: gsize = 0;
+static mut GUM_NATIVE_MODULE_PARENT_CLASS: *mut GObjectClass = core::ptr::null_mut();
+
+fn gum_native_module_get_type() -> GType {
+    unsafe {
+        if g_once_init_enter(
+            core::ptr::addr_of_mut!(GUM_NATIVE_MODULE_TYPE) as *mut ::core::ffi::c_void
+        ) != 0
+        {
+            let type_name = c"GumNativeModule".as_ptr() as *const gchar;
+
+            let type_info = _GTypeInfo {
+                class_size: core::mem::size_of::<GObjectClass>() as u16,
+                base_init: None,
+                base_finalize: None,
+                class_init: Some(gum_native_module_class_init),
+                class_finalize: None,
+                class_data: core::ptr::null(),
+                instance_size: core::mem::size_of::<GumNativeModule>() as u16,
+                n_preallocs: 0,
+                instance_init: None,
+                value_table: core::ptr::null(),
+            };
+
+            let new_type = g_type_register_static(g_object_get_type(), type_name, &type_info, 0);
+
+            let interface_info = _GInterfaceInfo {
+                interface_init: Some(gum_native_module_iface_init),
+                interface_finalize: None,
+                interface_data: core::ptr::null_mut(),
+            };
+
+            g_type_add_interface_static(new_type, gum_module_get_type(), &interface_info);
+
+            g_once_init_leave(
+                core::ptr::addr_of_mut!(GUM_NATIVE_MODULE_TYPE) as *mut ::core::ffi::c_void,
+                new_type as gsize,
+            );
+        }
+
+        GUM_NATIVE_MODULE_TYPE as GType
+    }
+}
+
+unsafe extern "C" fn gum_native_module_class_init(klass: gpointer, _class_data: gpointer) {
+    unsafe {
+        let object_class = klass as *mut GObjectClass;
+
+        GUM_NATIVE_MODULE_PARENT_CLASS = g_type_class_peek_parent(klass) as *mut GObjectClass;
+
+        (*object_class).finalize = Some(gum_native_module_finalize);
+    }
+}
+
+extern "C" fn gum_native_module_iface_init(g_iface: gpointer, _iface_data: gpointer) {
+    unsafe {
+        let iface = g_iface as *mut GumModuleInterface;
+        (*iface).get_name = Some(gum_native_module_get_name);
+        (*iface).get_version = Some(gum_native_module_get_version);
+        (*iface).get_path = Some(gum_native_module_get_path);
+        (*iface).get_range = Some(gum_native_module_get_range);
+        (*iface).enumerate_exports = Some(gum_native_module_enumerate_exports);
+    }
+}
+
+unsafe extern "C" fn gum_native_module_finalize(object: *mut GObject) {
+    unsafe {
+        let module = object as *mut GumNativeModule;
+
+        g_free((*module).path as gpointer);
+
+        (*GUM_NATIVE_MODULE_PARENT_CLASS).finalize.unwrap()(object);
+    }
+}
+
+fn gum_native_module_new(path: &str, version: &str, range: &GumMemoryRange) -> *mut GumModule {
+    unsafe {
+        let path_cstr = CString::new(path).unwrap();
+        let version_cstr = CString::new(version).unwrap();
+
+        let module =
+            g_object_new(gum_native_module_get_type(), ptr::null()) as *mut GumNativeModule;
+        (*module).path = g_strdup(path_cstr.as_ptr());
+        (*module).name = (*module).path.add(path.rfind('/').unwrap() + 1);
+        (*module).version = g_strdup(version_cstr.as_ptr());
+        (*module).range = *range;
+
+        module as *mut GumModule
+    }
+}
+
+extern "C" fn gum_native_module_get_name(module: *mut GumModule) -> *const gchar {
+    unsafe {
+        let native_module = module as *mut GumNativeModule;
+        (*native_module).name as *const gchar
+    }
+}
+
+extern "C" fn gum_native_module_get_version(module: *mut GumModule) -> *const gchar {
+    unsafe {
+        let native_module = module as *mut GumNativeModule;
+        (*native_module).version as *const gchar
+    }
+}
+
+extern "C" fn gum_native_module_get_path(module: *mut GumModule) -> *const gchar {
+    unsafe {
+        let native_module = module as *mut GumNativeModule;
+        (*native_module).path as *const gchar
+    }
+}
+
+extern "C" fn gum_native_module_get_range(module: *mut GumModule) -> *const GumMemoryRange {
+    unsafe {
+        let native_module = module as *mut GumNativeModule;
+        &(*native_module).range as *const GumMemoryRange
+    }
+}
+
+unsafe extern "C" fn gum_native_module_enumerate_exports(
+    self_: *mut GumModule,
+    func: GumFoundExportFunc,
+    user_data: gpointer,
+) {
+    unsafe {
+        let module = self_ as *mut GumNativeModule;
+        let module_range = &(*module).range;
+
+        let symbol_table = core::ptr::addr_of!(crate::SYMBOL_TABLE);
+        let symbol_table = &*symbol_table;
+
+        const N_EXT: u8 = 0x01; // External symbol flag
+        const N_TYPE: u8 = 0x0e; // Type mask
+        const N_SECT: u8 = 0x0e; // Defined in section
+
+        let start_address = module_range.base_address;
+        let end_address = module_range.base_address + module_range.size;
+
+        for symbol_ref in symbol_table.iter_symbols_in_range(start_address, end_address) {
+            let is_external = (symbol_ref.symbol_type() & N_EXT) != 0;
+            let is_defined = (symbol_ref.symbol_type() & N_TYPE) == N_SECT;
+            if !is_external || !is_defined {
+                continue;
+            }
+
+            let export_type = GumExportType_GUM_EXPORT_FUNCTION;
+
+            let export_details = GumExportDetails {
+                type_: export_type,
+                name: g_strdup(symbol_ref.name_ptr()),
+                address: symbol_ref.address(),
+            };
+
+            let should_continue =
+                func.unwrap()(&export_details as *const GumExportDetails, user_data);
+            if should_continue == 0 {
+                break;
+            }
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_symbol_details_from_address(
+    address: gpointer,
+    details: *mut GumDebugSymbolDetails,
+) -> gboolean {
+    unsafe {
+        let table = core::ptr::addr_of!(crate::SYMBOL_TABLE).read();
+        if let Some(symbol) = table.find_symbol_by_address(address as u64) {
+            let name_bytes = symbol.name().as_bytes();
+            let copy_len = core::cmp::min(name_bytes.len(), 2048);
+            core::ptr::copy_nonoverlapping(
+                name_bytes.as_ptr(),
+                (*details).symbol_name.as_mut_ptr() as *mut u8,
+                copy_len,
+            );
+            (*details).symbol_name[copy_len] = 0;
+
+            (*details).address = symbol.address();
+
+            (*details).module_name[0] = 0;
+            (*details).file_name[0] = 0;
+            (*details).line_number = 0;
+            (*details).column = 0;
+
+            return 1;
+        }
+
+        0
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_symbol_name_from_address(address: gpointer) -> *mut gchar {
+    unsafe {
+        let table = core::ptr::addr_of!(crate::SYMBOL_TABLE).read();
+        let name_ptr = table.find_symbol_name_ptr_by_address(address as u64);
+        g_strdup(name_ptr as *const gchar)
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_find_function(name: *const gchar) -> gpointer {
+    unsafe {
+        let target_name = CStr::from_ptr(name).to_string_lossy();
+        let table = core::ptr::addr_of!(crate::SYMBOL_TABLE).read();
+
+        if let Some(symbol) = table.find_symbol_by_name(&target_name) {
+            return symbol.address() as gpointer;
+        }
+
+        core::ptr::null_mut()
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_find_functions_named(name: *const gchar) -> *mut GArray {
+    unsafe {
+        let array = g_array_new(0, 0, core::mem::size_of::<gpointer>() as guint);
+
+        let target_name = CStr::from_ptr(name).to_string_lossy();
+        let table = core::ptr::addr_of!(crate::SYMBOL_TABLE).read();
+
+        let symbols = table.find_symbols_by_name(&target_name);
+        for symbol in symbols {
+            let addr = symbol.address() as gpointer;
+            g_array_append_vals(array, &addr as *const gpointer as gconstpointer, 1);
+        }
+
+        array
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_find_functions_matching(pattern: *const gchar) -> *mut GArray {
+    unsafe {
+        let array = g_array_new(0, 0, core::mem::size_of::<gpointer>() as guint);
+
+        let glob_pattern = CStr::from_ptr(pattern).to_string_lossy();
+        let table = core::ptr::addr_of!(crate::SYMBOL_TABLE).read();
+
+        let symbols = table.find_symbols_matching_glob(&glob_pattern);
+        for symbol in symbols {
+            let addr = symbol.address() as gpointer;
+            g_array_append_vals(array, &addr as *const gpointer as gconstpointer, 1);
+        }
+
+        array
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_load_symbols(_path: *const gchar) -> gboolean {
+    0
+}

src/barebone/agent/src/hostlink_virtio.rs

@@ -0,0 +1,763 @@
+use core::cell::UnsafeCell;
+use core::ffi::c_void;
+use core::mem::size_of;
+use core::ptr::{read_volatile, write_volatile};
+use core::sync::atomic::{AtomicUsize, Ordering};
+
+use crate::gum::gum_barebone_query_page_size;
+use crate::xnu;
+
+const MMIO_SIZE: u64 = 0x200;
+
+static PAGE_SIZE: AtomicUsize = AtomicUsize::new(0);
+
+const QSZ: u16 = 64;
+
+const MAGIC: usize = 0x000;
+const VERSION: usize = 0x004;
+const DEVICE: usize = 0x008;
+const STATUS: usize = 0x070;
+
+const DEVFEAT: usize = 0x010;
+const DEVFEAT_SEL: usize = 0x014;
+const DRVFEAT: usize = 0x020;
+const DRVFEAT_SEL: usize = 0x024;
+
+const QSEL: usize = 0x030;
+const QNUM_MAX: usize = 0x034;
+const QNUM: usize = 0x038;
+const QREADY: usize = 0x044;
+
+const QDESC_LO: usize = 0x080;
+const QDESC_HI: usize = 0x084;
+const QAVAIL_LO: usize = 0x090;
+const QAVAIL_HI: usize = 0x094;
+const QUSED_LO: usize = 0x0a0;
+const QUSED_HI: usize = 0x0a4;
+
+const QNOTIFY: usize = 0x050;
+const ISR: usize = 0x060;
+const ISR_ACK: usize = 0x064;
+
+const ST_ACK: u32 = 1;
+const ST_DRV: u32 = 2;
+const ST_DRV_OK: u32 = 4;
+const ST_FEAT_OK: u32 = 8;
+const ST_FAILED: u32 = 0x80;
+
+const DEV_ID_CONSOLE: u32 = 3;
+const F_VERSION_1: u64 = 1u64 << 32;
+const F_MULTIPORT: u64 = 1u64 << 1;
+
+const INT_VRING: u32 = 1;
+
+const Q_RX0: u16 = 0;
+const Q_TX0: u16 = 1;
+const Q_CTRL_RX: u16 = 2;
+const Q_CTRL_TX: u16 = 3;
+
+#[repr(C)]
+#[derive(Copy, Clone)]
+struct VConsCtrl {
+    id: u32,
+    event: u16,
+    value: u16,
+}
+const EV_DEVICE_READY: u16 = 0;
+const EV_DEVICE_ADD: u16 = 1;
+const EV_PORT_READY: u16 = 3;
+const EV_PORT_OPEN: u16 = 6;
+const EV_CONSOLE_PORT: u16 = 4;
+
+#[repr(C)]
+struct Desc {
+    addr: u64,
+    len: u32,
+    flags: u16,
+    next: u16,
+}
+const D_NEXT: u16 = 1;
+const D_WRITE: u16 = 2;
+
+#[repr(C)]
+#[derive(Copy, Clone)]
+struct Avail {
+    flags: u16,
+    idx: u16,
+}
+
+#[repr(C)]
+#[derive(Copy, Clone)]
+struct UsedElem {
+    id: u32,
+    len: u32,
+}
+#[repr(C)]
+#[derive(Copy, Clone)]
+struct Used {
+    flags: u16,
+    idx: u16,
+}
+
+#[derive(Copy, Clone)]
+struct DmaPage {
+    va: *mut u8,
+    pa: u64,
+}
+
+fn dma_page_alloc() -> DmaPage {
+    let len = PAGE_SIZE.load(Ordering::Relaxed);
+    let va = xnu::kalloc(len);
+    let pa = xnu::ml_vtophys(va as u64);
+    DmaPage { va, pa }
+}
+
+fn dma_page_free(p: DmaPage) {
+    let len = PAGE_SIZE.load(Ordering::Relaxed);
+    xnu::free(p.va, len);
+}
+
+struct Vq {
+    sel: u16,
+    size: u16,
+    desc_va: *mut u8,
+    avail_va: *mut u8,
+    used_va: *mut u8,
+    avail_idx: u16,
+    used_idx: u16,
+    free_head: u16,
+    free_cnt: u16,
+}
+impl Vq {
+    fn new(mmio: *mut u8, sel: u16, size: u16) -> Self {
+        w32(mmio, QSEL, sel as u32);
+        let max = r32(mmio, QNUM_MAX) as u16;
+        debug_assert!(max >= size && max != 0);
+        w32(mmio, QNUM, size as u32);
+
+        let d = dma_page_alloc();
+        let a = dma_page_alloc();
+        let u = dma_page_alloc();
+
+        let ps = PAGE_SIZE.load(core::sync::atomic::Ordering::Relaxed);
+        unsafe {
+            core::ptr::write_bytes(d.va, 0, ps);
+            core::ptr::write_bytes(a.va, 0, ps);
+            core::ptr::write_bytes(u.va, 0, ps);
+        }
+
+        w64(mmio, QDESC_LO, QDESC_HI, d.pa);
+        w64(mmio, QAVAIL_LO, QAVAIL_HI, a.pa);
+        w64(mmio, QUSED_LO, QUSED_HI, u.pa);
+
+        let dp = d.va as *mut Desc;
+        for i in 0..size {
+            unsafe {
+                (*dp.add(i as usize)).flags = 0;
+                (*dp.add(i as usize)).next = if i + 1 < size { i + 1 } else { 0xFFFF };
+            }
+        }
+
+        w32(mmio, QREADY, 1);
+
+        Self {
+            sel,
+            size,
+            desc_va: d.va,
+            avail_va: a.va,
+            used_va: u.va,
+            avail_idx: 0,
+            used_idx: 0,
+            free_head: 0,
+            free_cnt: size,
+        }
+    }
+
+    fn alloc(&mut self) -> u16 {
+        debug_assert!(self.free_cnt > 0);
+        let h = self.free_head;
+        let dp = self.desc_va as *mut Desc;
+        unsafe {
+            self.free_head = (*dp.add(h as usize)).next;
+        }
+        self.free_cnt -= 1;
+        h
+    }
+
+    fn free_chain(&mut self, mut idx: u16) {
+        let dp = self.desc_va as *mut Desc;
+        loop {
+            self.free_cnt += 1;
+            let (flags, next) = unsafe {
+                let p = dp.add(idx as usize);
+                ((*p).flags, (*p).next)
+            };
+            if (flags & D_NEXT) == 0 {
+                break;
+            }
+            idx = next;
+        }
+        unsafe {
+            (*dp.add(idx as usize)).next = self.free_head;
+        }
+        self.free_head = idx;
+    }
+
+    fn push_avail(&mut self, head: u16) {
+        let ap = self.avail_va as *mut Avail;
+        let ring = unsafe { (ap as *mut u8).add(size_of::<Avail>()) as *mut u16 };
+        let slot = (self.avail_idx % self.size) as usize;
+        unsafe {
+            *ring.add(slot) = head;
+        }
+        wmb();
+        self.avail_idx = self.avail_idx.wrapping_add(1);
+        unsafe {
+            (*ap).idx = self.avail_idx;
+        }
+    }
+
+    fn pop_used(&mut self) -> Option<UsedElem> {
+        let up = self.used_va as *mut Used;
+        if unsafe { (*up).idx } == self.used_idx {
+            return None;
+        }
+        let ring = unsafe { (up as *mut u8).add(size_of::<Used>()) as *mut UsedElem };
+        let elem = unsafe { *ring.add((self.used_idx % self.size) as usize) };
+        self.used_idx = self.used_idx.wrapping_add(1);
+        Some(elem)
+    }
+}
+
+struct Inner {
+    mmio: *mut u8,
+
+    ctrl_rx: Vq,
+    ctrl_tx: Vq,
+
+    port_id: Option<u32>,
+    rx: Option<Vq>,
+    tx: Option<Vq>,
+
+    rx_need: usize,
+    rx_have: usize,
+    rx_lenbuf: [u8; 4],
+    rx_lenhave: usize,
+    rx_buf: Option<&'static mut [u8]>,
+
+    tx_head: *mut TxNode,
+    tx_tail: *mut TxNode,
+
+    ctrl_rx_pages: [Option<DmaPage>; QSZ as usize],
+    data_rx_pages: [Option<DmaPage>; QSZ as usize],
+    tx_pages: [Option<DmaPage>; QSZ as usize],
+
+    wake_token: *const u8,
+
+    on_rx: Option<fn(&[u8])>,
+}
+
+#[repr(C)]
+struct TxNode {
+    next: *mut TxNode,
+    frame: &'static [u8],
+}
+
+pub struct Hostlink {
+    state: UnsafeCell<Inner>,
+}
+
+unsafe impl Send for Hostlink {}
+
+impl Hostlink {
+    pub fn init(mmio_base: u64, irq_line: u32, on_rx: Option<fn(&[u8])>, wake_token: *const u8) -> Result<Self, ()> {
+        let page_size = gum_barebone_query_page_size();
+        PAGE_SIZE.store(page_size as usize, Ordering::Relaxed);
+
+        let mmio = xnu::ml_io_map(mmio_base, MMIO_SIZE) as *mut u8;
+        if mmio.is_null() {
+            return Err(());
+        }
+
+        w32(mmio, STATUS, 0);
+        w32(mmio, STATUS, ST_ACK | ST_DRV);
+
+        let magic_ok = r32(mmio, MAGIC) == 0x7472_6976;
+        let version_ok = r32(mmio, VERSION) == 2;
+        let device_ok = r32(mmio, DEVICE) == DEV_ID_CONSOLE;
+        if !(magic_ok && version_ok && device_ok) {
+            w32(mmio, STATUS, ST_FAILED);
+            return Err(());
+        }
+
+        let dev_lo = feat_get(mmio, 0) as u64;
+        let dev_hi = (feat_get(mmio, 1) as u64) << 32;
+        let mut drv: u64 = 0;
+        if (dev_hi & F_VERSION_1) != 0 {
+            drv |= F_VERSION_1;
+        }
+        if (dev_lo & F_MULTIPORT) != 0 {
+            drv |= F_MULTIPORT;
+        }
+        feat_set(mmio, 0, (drv & 0xffff_ffff) as u32);
+        feat_set(mmio, 1, (drv >> 32) as u32);
+        w32(mmio, STATUS, r32(mmio, STATUS) | ST_FEAT_OK);
+        let feats_ok = (r32(mmio, STATUS) & ST_FEAT_OK) != 0;
+        if !feats_ok {
+            w32(mmio, STATUS, ST_FAILED);
+            return Err(());
+        }
+
+        let ctrl_rx = Vq::new(mmio, Q_CTRL_RX, QSZ);
+        let ctrl_tx = Vq::new(mmio, Q_CTRL_TX, QSZ);
+
+        w32(mmio, STATUS, r32(mmio, STATUS) | ST_DRV_OK);
+
+        xnu::install_interrupt_handler(
+            irq_line,
+            wake_token as *mut c_void,
+            isr_wake,
+            core::ptr::null_mut(),
+        );
+
+        let inner = Inner {
+            mmio,
+            ctrl_rx,
+            ctrl_tx,
+            port_id: None,
+            rx: None,
+            tx: None,
+            rx_need: 0,
+            rx_have: 0,
+            rx_lenbuf: [0; 4],
+            rx_lenhave: 0,
+            rx_buf: None,
+            tx_head: core::ptr::null_mut(),
+            tx_tail: core::ptr::null_mut(),
+            ctrl_rx_pages: [None; QSZ as usize],
+            data_rx_pages: [None; QSZ as usize],
+            tx_pages: [None; QSZ as usize],
+            wake_token,
+            on_rx,
+        };
+
+        let hl = Hostlink {
+            state: UnsafeCell::new(inner),
+        };
+
+        hl.ctrl_prime_rx(8);
+        hl.ctrl_send(VConsCtrl {
+            id: 0,
+            event: EV_DEVICE_READY,
+            value: 1,
+        });
+
+        Ok(hl)
+    }
+
+    pub fn send(&self, payload: &[u8]) {
+        let s = unsafe { &mut *self.state.get() };
+
+        let total = 4 + payload.len();
+        let buf = xnu::kalloc(total);
+        unsafe {
+            let len = payload.len() as u32;
+            *buf.add(0) = (len & 0xFF) as u8;
+            *buf.add(1) = ((len >> 8) & 0xFF) as u8;
+            *buf.add(2) = ((len >> 16) & 0xFF) as u8;
+            *buf.add(3) = ((len >> 24) & 0xFF) as u8;
+            core::ptr::copy_nonoverlapping(payload.as_ptr(), buf.add(4), payload.len());
+        }
+        let frame: &'static [u8] = unsafe { core::slice::from_raw_parts(buf, total) };
+
+        let node = xnu::kalloc(size_of::<TxNode>()) as *mut TxNode;
+        unsafe {
+            (*node).next = core::ptr::null_mut();
+            (*node).frame = frame;
+        }
+
+        if s.tx_tail.is_null() {
+            s.tx_head = node;
+            s.tx_tail = node;
+        } else {
+            unsafe {
+                (*s.tx_tail).next = node;
+            }
+            s.tx_tail = node;
+        }
+
+        xnu::thread_wakeup(s.wake_token);
+    }
+
+    pub fn process(&self) {
+        let s = unsafe { &mut *self.state.get() };
+
+        if (r32(s.mmio, ISR) & INT_VRING) != 0 {
+            w32(s.mmio, ISR_ACK, INT_VRING);
+        }
+
+        self.ctrl_complete();
+        self.ctrl_prime_rx(QSZ as usize);
+
+        self.data_rx_complete();
+        self.data_tx_complete();
+        self.data_tx_push();
+        self.data_rx_refill();
+    }
+
+    fn ctrl_prime_rx(&self, count: usize) {
+        let s = unsafe { &mut *self.state.get() };
+        let mut posted = 0usize;
+        while posted < count {
+            if s.ctrl_rx.free_cnt == 0 {
+                break;
+            }
+            let pg = dma_page_alloc();
+            let h = s.ctrl_rx.alloc();
+            let d = s.ctrl_rx.desc_va as *mut Desc;
+            unsafe {
+                (*d.add(h as usize)).addr = pg.pa;
+                (*d.add(h as usize)).len = PAGE_SIZE.load(Ordering::Relaxed) as u32;
+                (*d.add(h as usize)).flags = D_WRITE;
+                (*d.add(h as usize)).next = 0;
+            }
+            s.ctrl_rx_pages[h as usize] = Some(pg);
+            s.ctrl_rx.push_avail(h);
+            posted += 1;
+        }
+        let sel = s.ctrl_rx.sel;
+        self.kick(sel);
+    }
+
+    fn ctrl_send(&self, msg: VConsCtrl) {
+        let s = unsafe { &mut *self.state.get() };
+        let pg = dma_page_alloc();
+        unsafe {
+            core::ptr::write(pg.va as *mut VConsCtrl, msg);
+        }
+        let h = s.ctrl_tx.alloc();
+        let d = s.ctrl_tx.desc_va as *mut Desc;
+        unsafe {
+            (*d.add(h as usize)).addr = pg.pa;
+            (*d.add(h as usize)).len = size_of::<VConsCtrl>() as u32;
+            (*d.add(h as usize)).flags = 0;
+            (*d.add(h as usize)).next = 0;
+        }
+        s.tx_pages[h as usize] = Some(pg);
+        s.ctrl_tx.push_avail(h);
+        let sel = s.ctrl_tx.sel;
+        self.kick(sel);
+    }
+
+    fn ctrl_complete(&self) {
+        let s = unsafe { &mut *self.state.get() };
+        while let Some(u) = s.ctrl_rx.pop_used() {
+            let h = u.id as u16;
+            if let Some(pg) = s.ctrl_rx_pages[h as usize].take() {
+                let ev = unsafe { *(pg.va as *const VConsCtrl) };
+                dma_page_free(pg);
+
+                match ev.event {
+                    EV_DEVICE_ADD | EV_CONSOLE_PORT => {
+                        if s.port_id.is_none() {
+                            self.setup_data_port(ev.id);
+                            self.ctrl_send(VConsCtrl {
+                                id: ev.id,
+                                event: EV_PORT_READY,
+                                value: 1,
+                            });
+                            self.ctrl_send(VConsCtrl {
+                                id: ev.id,
+                                event: EV_PORT_OPEN,
+                                value: 1,
+                            });
+                        }
+                    }
+                    _ => {}
+                }
+
+                let pg2 = dma_page_alloc();
+                let d = s.ctrl_rx.desc_va as *mut Desc;
+                unsafe {
+                    (*d.add(h as usize)).addr = pg2.pa;
+                    (*d.add(h as usize)).len = PAGE_SIZE.load(Ordering::Relaxed) as u32;
+                    (*d.add(h as usize)).flags = D_WRITE;
+                    (*d.add(h as usize)).next = 0;
+                }
+                s.ctrl_rx_pages[h as usize] = Some(pg2);
+                s.ctrl_rx.push_avail(h);
+            }
+        }
+        let sel = s.ctrl_rx.sel;
+        self.kick(sel);
+
+        while let Some(u) = s.ctrl_tx.pop_used() {
+            let head = u.id as u16;
+            if let Some(pg) = s.tx_pages[head as usize].take() {
+                dma_page_free(pg);
+            }
+            s.ctrl_tx.free_chain(head);
+        }
+    }
+
+    fn setup_data_port(&self, id: u32) {
+        let s = unsafe { &mut *self.state.get() };
+        if s.port_id.is_some() {
+            return;
+        }
+        let (rx_i, tx_i) = if id == 0 {
+            (Q_RX0, Q_TX0)
+        } else {
+            let base = 4 + ((id as u16 - 1) * 2);
+            (base, base + 1)
+        };
+        let rx = Vq::new(s.mmio, rx_i, QSZ);
+        let tx = Vq::new(s.mmio, tx_i, QSZ);
+        s.rx = Some(rx);
+        s.tx = Some(tx);
+        s.port_id = Some(id);
+        self.data_rx_refill();
+    }
+
+    fn data_rx_refill(&self) {
+        let s = unsafe { &mut *self.state.get() };
+        let Some(rxq) = s.rx.as_mut() else {
+            return;
+        };
+        while rxq.free_cnt > 0 {
+            let h = rxq.alloc();
+            let pg = dma_page_alloc();
+            let d = rxq.desc_va as *mut Desc;
+            unsafe {
+                (*d.add(h as usize)).addr = pg.pa;
+                (*d.add(h as usize)).len = PAGE_SIZE.load(Ordering::Relaxed) as u32;
+                (*d.add(h as usize)).flags = D_WRITE;
+                (*d.add(h as usize)).next = 0;
+            }
+            s.data_rx_pages[h as usize] = Some(pg);
+            rxq.push_avail(h);
+        }
+        let sel = rxq.sel;
+        self.kick(sel);
+    }
+
+    fn data_rx_complete(&self) {
+        let s = unsafe { &mut *self.state.get() };
+        let Some(rxq) = s.rx.as_mut() else {
+            return;
+        };
+        while let Some(u) = rxq.pop_used() {
+            let h = u.id as u16;
+            let n = u.len as usize;
+
+            if let Some(pg) = s.data_rx_pages[h as usize].take() {
+                {
+                    let bytes = unsafe { core::slice::from_raw_parts(pg.va, n) };
+                    self.feed_rx_stream(bytes);
+                }
+                dma_page_free(pg);
+
+                let pg2 = dma_page_alloc();
+                let d = rxq.desc_va as *mut Desc;
+                unsafe {
+                    (*d.add(h as usize)).addr = pg2.pa;
+                    (*d.add(h as usize)).len = PAGE_SIZE.load(Ordering::Relaxed) as u32;
+                    (*d.add(h as usize)).flags = D_WRITE;
+                    (*d.add(h as usize)).next = 0;
+                }
+                s.data_rx_pages[h as usize] = Some(pg2);
+                rxq.push_avail(h);
+            }
+        }
+        let sel = rxq.sel;
+        self.kick(sel);
+    }
+
+    fn feed_rx_stream(&self, mut chunk: &[u8]) {
+        let s = unsafe { &mut *self.state.get() };
+        while !chunk.is_empty() {
+            if s.rx_lenhave < 4 {
+                let need = 4 - s.rx_lenhave;
+                let take = core::cmp::min(need, chunk.len());
+                s.rx_lenbuf[s.rx_lenhave..s.rx_lenhave + take].copy_from_slice(&chunk[..take]);
+                s.rx_lenhave += take;
+                chunk = &chunk[take..];
+                if s.rx_lenhave < 4 {
+                    return;
+                }
+
+                let len = (s.rx_lenbuf[0] as usize)
+                    | ((s.rx_lenbuf[1] as usize) << 8)
+                    | ((s.rx_lenbuf[2] as usize) << 16)
+                    | ((s.rx_lenbuf[3] as usize) << 24);
+
+                if s.rx_buf.is_none() && len > 0 {
+                    let buf = xnu::kalloc(len);
+                    let slice: &'static mut [u8] =
+                        unsafe { core::slice::from_raw_parts_mut(buf, len) };
+                    s.rx_buf = Some(slice);
+                    s.rx_need = len;
+                    s.rx_have = 0;
+                }
+            }
+
+            let need = s.rx_need.saturating_sub(s.rx_have);
+            let take = core::cmp::min(need, chunk.len());
+            if let Some(ref mut buf) = s.rx_buf {
+                unsafe {
+                    core::ptr::copy_nonoverlapping(
+                        chunk.as_ptr(),
+                        buf.as_mut_ptr().wrapping_add(s.rx_have),
+                        take,
+                    );
+                }
+            }
+            s.rx_have += take;
+            chunk = &chunk[take..];
+
+            if s.rx_have == s.rx_need {
+                if let (Some(cb), Some(buf)) = (s.on_rx, &s.rx_buf) {
+                    cb(&buf[..]);
+                }
+                s.rx_buf = None;
+                s.rx_need = 0;
+                s.rx_have = 0;
+                s.rx_lenhave = 0;
+            }
+        }
+    }
+
+    fn data_tx_complete(&self) {
+        let s = unsafe { &mut *self.state.get() };
+        let Some(txq) = s.tx.as_mut() else {
+            return;
+        };
+        while let Some(u) = txq.pop_used() {
+            let mut i = u.id as u16;
+            loop {
+                if let Some(pg) = s.tx_pages[i as usize].take() {
+                    dma_page_free(pg);
+                }
+                let d = txq.desc_va as *mut Desc;
+                let (f, n) = unsafe {
+                    let p = d.add(i as usize);
+                    ((*p).flags, (*p).next)
+                };
+                if (f & D_NEXT) == 0 {
+                    break;
+                }
+                i = n;
+            }
+            txq.free_chain(u.id as u16);
+        }
+    }
+
+    fn data_tx_push(&self) {
+        let s = unsafe { &mut *self.state.get() };
+        let Some(txq) = s.tx.as_mut() else {
+            return;
+        };
+        loop {
+            let node = if s.tx_head.is_null() {
+                core::ptr::null_mut()
+            } else {
+                let n = s.tx_head;
+                s.tx_head = unsafe { (*n).next };
+                if s.tx_head.is_null() {
+                    s.tx_tail = core::ptr::null_mut();
+                }
+                n
+            };
+            if node.is_null() {
+                break;
+            }
+            let frame = unsafe { (*node).frame };
+
+            let mut off = 0usize;
+            let mut head: Option<u16> = None;
+            let mut prev = 0u16;
+
+            while off < frame.len() {
+                if txq.free_cnt == 0 {
+                    break;
+                }
+                let page = PAGE_SIZE.load(Ordering::Relaxed);
+                let chunk = core::cmp::min(page, frame.len() - off);
+                let pg = dma_page_alloc();
+                unsafe {
+                    core::ptr::copy_nonoverlapping(frame.as_ptr().add(off), pg.va, chunk);
+                }
+
+                let i = txq.alloc();
+                let d = txq.desc_va as *mut Desc;
+                unsafe {
+                    (*d.add(i as usize)).addr = pg.pa;
+                    (*d.add(i as usize)).len = chunk as u32;
+                    (*d.add(i as usize)).flags = 0;
+                    (*d.add(i as usize)).next = 0;
+                }
+                s.tx_pages[i as usize] = Some(pg);
+
+                if let Some(_h) = head {
+                    unsafe {
+                        (*d.add(prev as usize)).flags |= D_NEXT;
+                        (*d.add(prev as usize)).next = i;
+                    }
+                    prev = i;
+                } else {
+                    head = Some(i);
+                    prev = i;
+                }
+
+                off += chunk;
+            }
+
+            if let Some(h) = head {
+                let sel = txq.sel;
+                txq.push_avail(h);
+                self.kick(sel);
+            }
+
+            xnu::free(frame.as_ptr() as *mut u8, frame.len());
+            xnu::free(node as *mut u8, core::mem::size_of::<TxNode>());
+        }
+    }
+
+    fn kick(&self, sel: u16) {
+        let s = unsafe { &*self.state.get() };
+        wmb();
+        w32(s.mmio, QSEL, sel as u32);
+        w32(s.mmio, QNOTIFY, sel as u32);
+    }
+}
+
+extern "C" fn isr_wake(token: *mut c_void, _refcon: *mut c_void, _nub: *mut c_void, _src: i32) {
+    xnu::thread_wakeup(token as *const u8);
+}
+
+fn r32(mmio: *mut u8, off: usize) -> u32 {
+    unsafe { read_volatile(mmio.add(off) as *const u32) }
+}
+
+fn w32(mmio: *mut u8, off: usize, val: u32) {
+    unsafe { write_volatile(mmio.add(off) as *mut u32, val) }
+}
+
+fn w64(mmio: *mut u8, lo: usize, hi: usize, v: u64) {
+    w32(mmio, lo, (v & 0xffff_ffff) as u32);
+    w32(mmio, hi, (v >> 32) as u32);
+}
+
+fn feat_get(mmio: *mut u8, sel: u32) -> u32 {
+    w32(mmio, DEVFEAT_SEL, sel);
+    r32(mmio, DEVFEAT)
+}
+
+fn feat_set(mmio: *mut u8, sel: u32, v: u32) {
+    w32(mmio, DRVFEAT_SEL, sel);
+    w32(mmio, DRVFEAT, v)
+}
+
+fn wmb() {
+    unsafe { core::arch::asm!("dmb ishst", options(nostack, preserves_flags)) }
+}

src/barebone/agent/src/libc.rs

@@ -0,0 +1,153 @@
+use core::ptr;
+use crate::bindings::{GMutex, GRecMutex};
+use crate::gthread;
+
+static mut MALLOC_LOCK: GRecMutex = unsafe { core::mem::zeroed() };
+
+#[unsafe(no_mangle)]
+pub extern "C" fn __malloc_lock(_reent: *mut core::ffi::c_void) {
+    gthread::g_rec_mutex_lock(ptr::addr_of_mut!(MALLOC_LOCK));
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn __malloc_unlock(_reent: *mut core::ffi::c_void) {
+    gthread::g_rec_mutex_unlock(ptr::addr_of_mut!(MALLOC_LOCK));
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _fini() {
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _exit(_status: i32) -> ! {
+    loop {}
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _kill(_pid: i32, _sig: i32) -> i32 {
+    -1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _sbrk(incr: isize) -> *mut u8 {
+    const HEAP_SIZE: usize = 32 * 1024 * 1024; // 32 MB
+
+    static mut HEAP_START: *mut u8 = ptr::null_mut();
+    static mut HEAP_CURRENT: *mut u8 = ptr::null_mut();
+    static mut HEAP_MUTEX: GMutex = unsafe { core::mem::zeroed() };
+
+    unsafe {
+        gthread::g_mutex_lock(ptr::addr_of_mut!(HEAP_MUTEX));
+
+        if HEAP_START.is_null() {
+            HEAP_START = crate::xnu::kalloc(HEAP_SIZE);
+            if HEAP_START.is_null() {
+                gthread::g_mutex_unlock(ptr::addr_of_mut!(HEAP_MUTEX));
+                panic!("Failed to allocate 32 MB heap");
+            }
+            HEAP_CURRENT = HEAP_START;
+        }
+
+        let prev_heap_current = HEAP_CURRENT;
+        let new_heap_current = HEAP_CURRENT.add(incr as usize);
+
+        if new_heap_current > HEAP_START.add(HEAP_SIZE) {
+            gthread::g_mutex_unlock(ptr::addr_of_mut!(HEAP_MUTEX));
+            panic!("Heap exhausted: requested {} bytes, {} bytes remaining",
+                   incr,
+                   HEAP_START.add(HEAP_SIZE).offset_from(HEAP_CURRENT));
+        }
+
+        HEAP_CURRENT = new_heap_current;
+
+        gthread::g_mutex_unlock(ptr::addr_of_mut!(HEAP_MUTEX));
+        prev_heap_current
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _getpid() -> i32 {
+    0
+}
+
+#[repr(C)]
+struct Timeval {
+    tv_sec: i64,
+    tv_usec: i64,
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _gettimeofday(tp: *mut core::ffi::c_void, _tzp: *mut core::ffi::c_void) -> i32 {
+    let (secs, microsecs) = crate::xnu::clock_get_calendar_microtime();
+    let timeval = Timeval {
+        tv_sec: secs as i64,
+        tv_usec: microsecs as i64,
+    };
+    unsafe {
+        ptr::copy_nonoverlapping(
+            &timeval as *const Timeval as *const u8,
+            tp as *mut u8,
+            core::mem::size_of::<Timeval>(),
+        );
+    }
+    0
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _isatty(_fd: i32) -> i32 {
+    1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _open(_path: *const u8, _flags: i32, _mode: i32) -> i32 {
+    -1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _close(_fd: i32) -> i32 {
+    0
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _read(_fd: i32, _buf: *mut u8, _count: usize) -> isize {
+    0
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _write(_fd: i32, _buf: *const u8, count: usize) -> isize {
+    count as isize
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _lseek(_fd: i32, _offset: isize, _whence: i32) -> isize {
+    0
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _fstat(_fd: i32, _st: *mut core::ffi::c_void) -> i32 {
+    0
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _link(_old: *const u8, _new: *const u8) -> i32 {
+    -1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _unlink(_path: *const u8) -> i32 {
+    -1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn __clear_cache(_start: *const u8, _end: *const u8) {
+    // On AArch64, we need to flush the instruction cache
+    // This is a simplified implementation for the kernel environment
+    unsafe {
+        core::arch::asm!(
+            "ic iallu",     // Invalidate all instruction caches
+            "dsb sy",       // Data synchronization barrier
+            "isb",          // Instruction synchronization barrier
+            options(nomem, nostack),
+        );
+    }
+}

src/barebone/agent/src/main.rs

@@ -0,0 +1,544 @@
+#![no_main]
+#![no_std]
+
+use alloc::boxed::Box;
+use alloc::collections::BTreeMap;
+use alloc::format;
+use alloc::string::String;
+use alloc::vec::Vec;
+use core::alloc::{GlobalAlloc, Layout};
+use core::ffi::{CStr, c_void};
+use core::ptr;
+use core::ptr::null_mut;
+use core::sync::atomic::{AtomicU32, Ordering};
+
+use bindings::{
+    GBytes, GCancellable, GError, GVariant, GVariantIter, GumScript, g_error_free, g_free,
+    g_main_context_default, g_main_context_iteration, g_memdup2, g_object_unref,
+    g_variant_check_format_string, g_variant_get, g_variant_get_child_value, g_variant_get_data,
+    g_variant_get_size, g_variant_get_string, g_variant_get_uint32, g_variant_get_uint64,
+    g_variant_iter_init, g_variant_iter_next, g_variant_new, g_variant_new_from_data,
+    g_variant_new_string, g_variant_new_tuple, g_variant_new_uint32, g_variant_type_free,
+    g_variant_type_new, g_variant_unref, gchar, gpointer, gsize, gum_script_backend_create_sync,
+    gum_script_backend_obtain_qjs, gum_script_load_sync, gum_script_post,
+    gum_script_set_message_handler, gum_script_unload_sync,
+};
+use hostlink_virtio::Hostlink;
+use symbols::SymbolTable;
+
+mod glib;
+mod gthread;
+mod gum;
+mod hostlink_virtio;
+
+mod libc;
+mod pac;
+mod symbols;
+mod xnu;
+
+mod bindings {
+    #![allow(
+        dead_code,
+        improper_ctypes,
+        non_camel_case_types,
+        non_snake_case,
+        non_upper_case_globals,
+        unused_imports
+    )]
+    include!(concat!(env!("OUT_DIR"), "/bindings.rs"));
+}
+
+#[repr(u8)]
+#[derive(PartialEq, Eq, Clone, Copy, Debug)]
+pub enum FridaCommand {
+    CreateScript = 1,
+    LoadScript = 2,
+    DestroyScript = 3,
+    PostScriptMessage = 4,
+
+    Reply = 128,
+    ScriptMessage = 129,
+}
+
+impl core::fmt::Display for FridaCommand {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            FridaCommand::CreateScript => write!(f, "CreateScript"),
+            FridaCommand::LoadScript => write!(f, "LoadScript"),
+            FridaCommand::DestroyScript => write!(f, "DestroyScript"),
+            FridaCommand::PostScriptMessage => write!(f, "PostScriptMessage"),
+            FridaCommand::Reply => write!(f, "Reply"),
+            FridaCommand::ScriptMessage => write!(f, "ScriptMessage"),
+        }
+    }
+}
+
+#[derive(Debug)]
+struct HandlerResponse {
+    variant: *mut GVariant,
+}
+
+impl HandlerResponse {
+    fn success(variant: *mut GVariant) -> Self {
+        Self { variant }
+    }
+
+    fn success_empty() -> Self {
+        let variant = unsafe { g_variant_new_tuple(ptr::null(), 0) };
+        Self { variant }
+    }
+
+    fn error(message: &str) -> Self {
+        let mut c_message = String::from(message);
+        c_message.push('\0');
+        let error_variant = unsafe { g_variant_new_string(c_message.as_ptr()) };
+
+        Self {
+            variant: error_variant,
+        }
+    }
+}
+
+static mut CONFIG_DATA: &'static [u8] = &[];
+pub static mut MODULE_INFO: Vec<ModuleInfo> = Vec::new();
+pub static mut SYMBOL_TABLE: SymbolTable = SymbolTable::empty();
+
+static mut TRANSPORT_DRIVER: *mut Hostlink = core::ptr::null_mut();
+
+#[inline(always)]
+fn transport_set(driver: Hostlink) {
+    unsafe {
+        let boxed = Box::into_raw(Box::new(driver));
+        TRANSPORT_DRIVER = boxed;
+    }
+}
+
+#[inline(always)]
+fn transport_get_unchecked() -> &'static Hostlink {
+    unsafe {
+        debug_assert!(!TRANSPORT_DRIVER.is_null());
+        &*TRANSPORT_DRIVER
+    }
+}
+
+static mut SCRIPTS: BTreeMap<u32, *mut GumScript> = BTreeMap::new();
+static NEXT_SCRIPT_ID: AtomicU32 = AtomicU32::new(1);
+
+#[derive(Debug, Clone)]
+pub struct ModuleInfo {
+    pub name: String,
+    pub version: String,
+    pub offset: u32,
+    pub size: u32,
+    pub start_func_offset: u32,
+    pub stop_func_offset: u32,
+}
+
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn _start(config_data: *const u8, config_size: usize) {
+    unsafe {
+        CONFIG_DATA = core::slice::from_raw_parts(config_data, config_size);
+
+        xnu::kernel_thread_start(frida_agent_worker, 12345usize as *mut core::ffi::c_void);
+    }
+}
+
+unsafe extern "C" fn frida_agent_worker(_parameter: *mut core::ffi::c_void, _wait_result: i32) {
+    unsafe {
+        bindings::g_set_panic_handler(Some(frida_panic_handler), ptr::null_mut());
+        bindings::gum_init_embedded();
+        bindings::g_log_set_default_handler(Some(frida_log_handler), ptr::null_mut());
+
+        let (mmio, irq, kernel_base, module_info, symbol_table) =
+            parse_config(core::ptr::addr_of!(CONFIG_DATA).read());
+        xnu::set_kernel_base(kernel_base);
+        MODULE_INFO = module_info;
+        SYMBOL_TABLE = symbol_table;
+
+        transport_set(
+            Hostlink::init(
+                mmio,
+                irq,
+                Some(on_frame_from_host),
+                ptr::addr_of_mut!(glib::WAKEUP_TOKEN) as *const u8,
+            )
+            .unwrap(),
+        );
+
+        let main_context = g_main_context_default();
+
+        loop {
+            transport_get_unchecked().process();
+            g_main_context_iteration(main_context, 1);
+        }
+    }
+}
+
+fn on_frame_from_host(frame: &[u8]) {
+    if let Some(variant) = deserialize_message(&frame) {
+        process_incoming_message(variant);
+        unsafe {
+            g_variant_unref(variant);
+        }
+    }
+}
+
+unsafe fn parse_config(config: &[u8]) -> (u64, u32, u64, Vec<ModuleInfo>, SymbolTable) {
+    unsafe {
+        let type_string = c"(tuta(ssuuuu)ay)".as_ptr() as *const gchar;
+        let variant_type = g_variant_type_new(type_string);
+
+        let root_variant = g_variant_new_from_data(
+            variant_type,
+            config.as_ptr() as *const core::ffi::c_void,
+            config.len() as gsize,
+            1,
+            None,
+            ptr::null_mut(),
+        );
+
+        let hostlink_mmio_variant = g_variant_get_child_value(root_variant, 0);
+        let hostlink_mmio = g_variant_get_uint64(hostlink_mmio_variant);
+
+        let hostlink_irq_variant = g_variant_get_child_value(root_variant, 1);
+        let hostlink_irq = g_variant_get_uint32(hostlink_irq_variant);
+
+        let kernel_base_variant = g_variant_get_child_value(root_variant, 2);
+        let kernel_base = g_variant_get_uint64(kernel_base_variant);
+        xnu::set_kernel_base(kernel_base);
+
+        let module_info_variant = g_variant_get_child_value(root_variant, 3);
+        let mut iter: GVariantIter = core::mem::zeroed();
+        g_variant_iter_init(&mut iter as *mut GVariantIter, module_info_variant);
+
+        let mut module_info: Vec<ModuleInfo> = Vec::new();
+        let mut raw_name: *mut gchar = null_mut();
+        let mut raw_version: *mut gchar = null_mut();
+        let mut offset: u32 = 0;
+        let mut size: u32 = 0;
+        let mut start_func_offset: u32 = 0;
+        let mut stop_func_offset: u32 = 0;
+        while g_variant_iter_next(
+            &mut iter as *mut GVariantIter,
+            c"(&s&suuuu)".as_ptr(),
+            &mut raw_name,
+            &mut raw_version,
+            &mut offset,
+            &mut size,
+            &mut start_func_offset,
+            &mut stop_func_offset,
+        ) != 0
+        {
+            module_info.push(ModuleInfo {
+                name: String::from(CStr::from_ptr(raw_name).to_str().unwrap()),
+                version: String::from(CStr::from_ptr(raw_version).to_str().unwrap()),
+                offset,
+                size,
+                start_func_offset,
+                stop_func_offset,
+            });
+        }
+
+        let symbol_array_variant = g_variant_get_child_value(root_variant, 4);
+        let symbol_data_ptr = g_variant_get_data(symbol_array_variant) as *const u8;
+        let symbol_data_size = g_variant_get_size(symbol_array_variant) as usize;
+        let symbol_table = SymbolTable::new(core::slice::from_raw_parts(
+            symbol_data_ptr,
+            symbol_data_size,
+        ));
+
+        g_variant_unref(symbol_array_variant);
+        g_variant_unref(module_info_variant);
+        g_variant_unref(kernel_base_variant);
+        g_variant_unref(hostlink_irq_variant);
+        g_variant_unref(hostlink_mmio_variant);
+        g_variant_unref(root_variant);
+        g_variant_type_free(variant_type);
+
+        (
+            hostlink_mmio,
+            hostlink_irq,
+            kernel_base,
+            module_info,
+            symbol_table,
+        )
+    }
+}
+
+unsafe fn serialize_message(variant: *mut GVariant) -> Option<Vec<u8>> {
+    unsafe {
+        let size = g_variant_get_size(variant) as usize;
+        if size == 0 {
+            return None;
+        }
+
+        let data_ptr = g_variant_get_data(variant) as *const u8;
+        let mut result = Vec::with_capacity(size);
+        result.resize(size, 0);
+        core::ptr::copy_nonoverlapping(data_ptr, result.as_mut_ptr(), size);
+
+        Some(result)
+    }
+}
+
+fn deserialize_message(data: &[u8]) -> Option<*mut GVariant> {
+    unsafe {
+        if data.is_empty() {
+            return None;
+        }
+
+        let variant_type = g_variant_type_new(c"(yqv)".as_ptr());
+        let data_copy = g_memdup2(data.as_ptr() as *const c_void, data.len() as u64);
+        let variant = g_variant_new_from_data(
+            variant_type,
+            data_copy,
+            data.len() as u64,
+            0,
+            Some(g_free),
+            data_copy,
+        );
+        g_variant_type_free(variant_type);
+
+        if variant.is_null() {
+            None
+        } else {
+            Some(variant)
+        }
+    }
+}
+
+fn process_incoming_message(variant: *mut GVariant) {
+    {
+        let mut cmd_value: u8 = 0;
+        let mut request_id: u16 = 0;
+        let mut payload_variant: *mut GVariant = ptr::null_mut();
+
+        let cmd = unsafe {
+            g_variant_get(
+                variant,
+                c"(yqv)".as_ptr(),
+                &mut cmd_value,
+                &mut request_id,
+                &mut payload_variant,
+            );
+
+            core::mem::transmute::<u8, FridaCommand>(cmd_value)
+        };
+
+        let response = match cmd {
+            FridaCommand::CreateScript => handle_create_script(payload_variant),
+            FridaCommand::LoadScript => handle_load_script(payload_variant),
+            FridaCommand::DestroyScript => handle_destroy_script(payload_variant),
+            FridaCommand::PostScriptMessage => handle_post_script_message(payload_variant),
+            _ => HandlerResponse::error("Unknown command"),
+        };
+
+        send_command_reply(request_id, response);
+
+        unsafe { g_variant_unref(payload_variant) };
+    }
+}
+
+fn send_command_reply(request_id: u16, response: HandlerResponse) {
+    unsafe {
+        let message = g_variant_new(
+            c"(yqv)".as_ptr(),
+            FridaCommand::Reply as u8 as u32,
+            request_id as u32,
+            response.variant,
+        );
+
+        if let Some(serialized) = serialize_message(message) {
+            transport_get_unchecked().send(&serialized);
+        }
+
+        g_variant_unref(message);
+    }
+}
+
+fn handle_create_script(payload_variant: *mut GVariant) -> HandlerResponse {
+    unsafe {
+        if g_variant_check_format_string(payload_variant, c"s".as_ptr(), 0) == 0 {
+            return HandlerResponse::error("Invalid payload format: expected string");
+        }
+        let source = g_variant_get_string(payload_variant, core::ptr::null_mut());
+
+        let backend = gum_script_backend_obtain_qjs();
+        let cancellable: *mut GCancellable = ptr::null_mut();
+        let mut error: *mut GError = ptr::null_mut();
+
+        let script = gum_script_backend_create_sync(
+            backend,
+            c"agent.js".as_ptr(),
+            source,
+            ptr::null_mut(),
+            cancellable,
+            &mut error,
+        );
+
+        if !error.is_null() {
+            let error_msg = CStr::from_ptr((*error).message).to_str().unwrap();
+            let error_string = String::from(error_msg);
+            g_error_free(error);
+            return HandlerResponse::error(&error_string);
+        }
+
+        let script_id = NEXT_SCRIPT_ID.fetch_add(1, Ordering::Relaxed);
+
+        let script_id_ptr = Box::into_raw(Box::new(script_id));
+        gum_script_set_message_handler(
+            script,
+            Some(frida_message_handler),
+            script_id_ptr as *mut c_void,
+            None,
+        );
+
+        core::ptr::addr_of_mut!(SCRIPTS)
+            .as_mut()
+            .unwrap()
+            .insert(script_id, script);
+
+        HandlerResponse::success(g_variant_new_uint32(script_id))
+    }
+}
+
+unsafe extern "C" fn frida_message_handler(
+    message: *const gchar,
+    _data: *mut GBytes,
+    user_data: gpointer,
+) {
+    unsafe {
+        let script_id = *(user_data as *const u32);
+
+        let message_variant = g_variant_new(
+            c"(yqv)".as_ptr(),
+            FridaCommand::ScriptMessage as u8 as u32,
+            0u32,
+            g_variant_new(c"(us)".as_ptr(), script_id, message),
+        );
+
+        if let Some(serialized) = serialize_message(message_variant) {
+            transport_get_unchecked().send(&serialized);
+        }
+
+        g_variant_unref(message_variant);
+    }
+}
+
+fn handle_load_script(payload_variant: *mut GVariant) -> HandlerResponse {
+    unsafe {
+        if g_variant_check_format_string(payload_variant, c"u".as_ptr(), 0) == 0 {
+            return HandlerResponse::error("Invalid payload format: expected uint32");
+        }
+        let script_id = g_variant_get_uint32(payload_variant);
+
+        let Some(script) = get_script_by_id(script_id) else {
+            return HandlerResponse::error(&format!("Script with ID {} not found", script_id));
+        };
+
+        gum_script_load_sync(script, ptr::null_mut());
+
+        HandlerResponse::success_empty()
+    }
+}
+
+fn handle_destroy_script(payload_variant: *mut GVariant) -> HandlerResponse {
+    unsafe {
+        if g_variant_check_format_string(payload_variant, c"u".as_ptr(), 0) == 0 {
+            return HandlerResponse::error("Invalid payload format: expected uint32");
+        }
+        let script_id = g_variant_get_uint32(payload_variant);
+
+        let scripts = core::ptr::addr_of_mut!(SCRIPTS).as_mut().unwrap();
+        let Some(script) = scripts.remove(&script_id) else {
+            return HandlerResponse::error(&format!("Script with ID {} not found", script_id));
+        };
+
+        gum_script_unload_sync(script, ptr::null_mut());
+        g_object_unref(script as *mut c_void);
+
+        HandlerResponse::success_empty()
+    }
+}
+
+fn handle_post_script_message(payload_variant: *mut GVariant) -> HandlerResponse {
+    unsafe {
+        if g_variant_check_format_string(payload_variant, c"(us)".as_ptr(), 0) == 0 {
+            return HandlerResponse::error("Invalid payload format: expected (uint32, string)");
+        }
+        let mut script_id: u32 = 0;
+        let mut message: *const gchar = ptr::null();
+        g_variant_get(
+            payload_variant,
+            c"(u&s)".as_ptr(),
+            &mut script_id,
+            &mut message,
+        );
+
+        let Some(script) = get_script_by_id(script_id) else {
+            return HandlerResponse::error(&format!("Script with ID {} not found", script_id));
+        };
+
+        gum_script_post(script, message, ptr::null_mut());
+
+        HandlerResponse::success_empty()
+    }
+}
+
+unsafe fn get_script_by_id(script_id: u32) -> Option<*mut GumScript> {
+    unsafe {
+        let scripts = core::ptr::addr_of_mut!(SCRIPTS).as_mut().unwrap();
+        scripts.get(&script_id).copied()
+    }
+}
+
+unsafe extern "C" fn frida_panic_handler(message: *const u8, _user_data: *mut core::ffi::c_void) {
+    let msg = unsafe { core::ffi::CStr::from_ptr(message).to_str().unwrap() };
+    panic!("[Frida] {}", msg);
+}
+
+unsafe extern "C" fn frida_log_handler(
+    _log_domain: *const core::ffi::c_char,
+    _log_level: i32,
+    message: *const core::ffi::c_char,
+    _user_data: *mut core::ffi::c_void,
+) {
+    let msg = unsafe { core::ffi::CStr::from_ptr(message).to_str().unwrap() };
+    kprintln!("[Frida] {}", msg);
+}
+
+#[panic_handler]
+fn panic(info: &core::panic::PanicInfo<'_>) -> ! {
+    let mut s = format!("{}", info);
+    s.push('\0');
+    xnu::panic(s.as_str());
+    loop {}
+}
+
+pub struct XnuAllocator;
+
+unsafe impl GlobalAlloc for XnuAllocator {
+    unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
+        xnu::kalloc(layout.size())
+    }
+
+    unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) {
+        xnu::free(ptr, layout.size());
+    }
+}
+
+#[global_allocator]
+static GLOBAL: XnuAllocator = XnuAllocator;
+extern crate alloc;
+
+#[macro_export]
+macro_rules! kprintln {
+    ($($arg:tt)*) => {{
+        use core::fmt::Write;
+        let mut buf = alloc::string::String::new();
+        write!(&mut buf, $($arg)*).unwrap();
+        buf.push('\n');
+        buf.push('\0');
+        crate::xnu::io_log(&buf)
+    }};
+}

src/barebone/agent/src/pac.rs

@@ -0,0 +1,28 @@
+use core::arch::asm;
+
+pub unsafe fn ptrauth_sign(ptr: *const u8, discriminator: usize) -> *const u8 {
+    let signed: usize;
+    unsafe {
+        asm!(
+            ".inst 0xdac10020",       // pacia x0, x1
+            in("x0") ptr as usize,
+            in("x1") discriminator,
+            lateout("x0") signed,
+            options(nomem, nostack),
+        );
+    }
+    signed as *const u8
+}
+
+pub unsafe fn ptrauth_strip_data(ptr: *const u8) -> *const u8 {
+    let stripped: usize;
+    unsafe {
+        asm!(
+            ".inst 0xdac143e0",       // xpaci x0
+            in("x0") ptr as usize,
+            lateout("x0") stripped,
+            options(nomem, nostack),
+        );
+    }
+    stripped as *const u8
+}

src/barebone/agent/src/symbols.rs

@@ -0,0 +1,443 @@
+use crate::bindings::{
+    GPatternSpec, g_pattern_spec_free, g_pattern_spec_match_string, g_pattern_spec_new,
+};
+use crate::xnu::get_kernel_base;
+use alloc::ffi::CString;
+use core::cmp::Ordering;
+use core::ffi::{CStr, c_char};
+use core::mem::size_of;
+use core::ptr;
+
+pub struct SymbolTable {
+    data: &'static [u8],
+    symbol_count: usize,
+}
+
+impl SymbolTable {
+    pub const fn empty() -> Self {
+        Self {
+            data: &[],
+            symbol_count: 0,
+        }
+    }
+
+    pub fn new(data: &'static [u8]) -> Self {
+        if data.len() < 4 {
+            return Self::empty();
+        }
+        let symbol_count = unsafe { *(data.as_ptr() as *const u32) as usize };
+        Self { data, symbol_count }
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.symbol_count == 0
+    }
+
+    pub fn symbol_count(&self) -> usize {
+        self.symbol_count
+    }
+
+    pub fn find_symbol_by_name(&self, name: &str) -> Option<SymbolRef> {
+        let (_, entry) = self.binary_search_by_name(name)?;
+        Some(SymbolRef {
+            symbol_table: self,
+            entry,
+            kernel_base: get_kernel_base(),
+        })
+    }
+
+    pub fn find_symbols_by_name(&self, name: &str) -> SymbolsByNameIterator {
+        let (found_index, _) = match self.binary_search_by_name(name) {
+            Some(result) => result,
+            None => return SymbolsByNameIterator::empty(self),
+        };
+
+        let mut start = found_index;
+        let mut end = found_index;
+
+        while start > 0 {
+            let entry = self.get_symbol_entry_by_name_index(start - 1);
+            let symbol_name = entry.name(self);
+            if symbol_name == name {
+                start -= 1;
+            } else {
+                break;
+            }
+        }
+
+        while end + 1 < self.symbol_count {
+            let entry = self.get_symbol_entry_by_name_index(end + 1);
+            let symbol_name = entry.name(self);
+            if symbol_name == name {
+                end += 1;
+            } else {
+                break;
+            }
+        }
+
+        SymbolsByNameIterator {
+            symbol_table: self,
+            current_index: start,
+            end_index: end + 1,
+            kernel_base: get_kernel_base(),
+        }
+    }
+
+    pub fn find_symbols_matching_glob(&self, pattern: &str) -> SymbolsMatchingIterator {
+        if self.is_empty() {
+            return SymbolsMatchingIterator::empty(self);
+        }
+
+        let pattern_cstr = CString::new(pattern).unwrap();
+        let pspec = unsafe { g_pattern_spec_new(pattern_cstr.as_ptr()) };
+
+        SymbolsMatchingIterator {
+            symbol_table: self,
+            current_index: 0,
+            end_index: self.symbol_count,
+            pspec,
+            kernel_base: get_kernel_base(),
+        }
+    }
+
+    pub fn find_symbol_by_address(&self, address: u64) -> Option<SymbolRef> {
+        let target_offset = (address - get_kernel_base()) as u32;
+        let (_, entry) = self.binary_search_by_address(target_offset)?;
+        Some(SymbolRef {
+            symbol_table: self,
+            entry,
+            kernel_base: get_kernel_base(),
+        })
+    }
+
+    pub fn find_symbol_name_ptr_by_address(&self, address: u64) -> *const c_char {
+        let target_offset = (address - get_kernel_base()) as u32;
+        if let Some((_, entry)) = self.binary_search_by_address(target_offset) {
+            entry.name_ptr(self)
+        } else {
+            ptr::null()
+        }
+    }
+
+    pub fn find_closest_symbol_by_address(&self, address: u64) -> Option<SymbolRef> {
+        let kernel_base = get_kernel_base();
+        let target_offset = (address - kernel_base) as u32;
+        let (_, entry) = self.binary_search_closest_by_address(target_offset)?;
+        Some(SymbolRef {
+            symbol_table: self,
+            entry,
+            kernel_base,
+        })
+    }
+
+    pub fn iter_symbols_in_range(&self, start_address: u64, end_address: u64) -> SymbolsInRangeIterator {
+        if self.is_empty() {
+            return SymbolsInRangeIterator {
+                symbol_table: self,
+                current_index: 0,
+                end_index: 0,
+                end_offset: 0,
+                kernel_base: get_kernel_base(),
+            };
+        }
+
+        let kernel_base = get_kernel_base();
+        let start_offset = (start_address - kernel_base) as u32;
+        let end_offset = (end_address - kernel_base) as u32;
+
+        let mut left = 0;
+        let mut right = self.symbol_count;
+
+        while left < right {
+            let mid = left + (right - left) / 2;
+            let entry = self.get_symbol_entry_by_address_index(mid);
+
+            if entry.address_offset < start_offset {
+                left = mid + 1;
+            } else {
+                right = mid;
+            }
+        }
+
+        while left > 0 {
+            let prev_entry = self.get_symbol_entry_by_address_index(left - 1);
+            if prev_entry.address_offset >= start_offset {
+                left -= 1;
+            } else {
+                break;
+            }
+        }
+
+        SymbolsInRangeIterator {
+            symbol_table: self,
+            current_index: left,
+            end_index: self.symbol_count,
+            end_offset,
+            kernel_base,
+        }
+    }
+
+    fn get_symbol_entry_by_name_index(&self, index: usize) -> &SymbolEntry {
+        let offset = self.name_index_start() + index * 4;
+        let symbol_offset = unsafe { *(self.data.as_ptr().add(offset) as *const u32) as usize };
+        self.symbol_entry_at(symbol_offset)
+    }
+
+    fn get_symbol_entry_by_address_index(&self, index: usize) -> &SymbolEntry {
+        let offset = self.address_index_start() + index * 4;
+        let symbol_offset = unsafe { *(self.data.as_ptr().add(offset) as *const u32) as usize };
+        self.symbol_entry_at(symbol_offset)
+    }
+
+    fn symbol_entry_at(&self, offset: usize) -> &SymbolEntry {
+        unsafe { &*(self.data.as_ptr().add(offset) as *const SymbolEntry) }
+    }
+
+    fn name_index_start(&self) -> usize {
+        4
+    }
+
+    fn address_index_start(&self) -> usize {
+        4 + self.symbol_count * 4
+    }
+
+    fn binary_search_by_name(&self, name: &str) -> Option<(usize, &SymbolEntry)> {
+        self.binary_search(
+            |table, mid| table.get_symbol_entry_by_name_index(mid),
+            |entry| entry.name(self).cmp(name),
+            false,
+        )
+    }
+
+    fn binary_search_by_address(&self, target_offset: u32) -> Option<(usize, &SymbolEntry)> {
+        self.binary_search(
+            |table, mid| table.get_symbol_entry_by_address_index(mid),
+            |entry| entry.address_offset.cmp(&target_offset),
+            false,
+        )
+    }
+
+    fn binary_search_closest_by_address(
+        &self,
+        target_offset: u32,
+    ) -> Option<(usize, &SymbolEntry)> {
+        self.binary_search(
+            |table, mid| table.get_symbol_entry_by_address_index(mid),
+            |entry| entry.address_offset.cmp(&target_offset),
+            true,
+        )
+    }
+
+    fn binary_search<F, C>(
+        &self,
+        get_entry_fn: F,
+        compare_fn: C,
+        find_closest: bool,
+    ) -> Option<(usize, &SymbolEntry)>
+    where
+        F: Fn(&Self, usize) -> &SymbolEntry,
+        C: Fn(&SymbolEntry) -> Ordering,
+    {
+        if self.is_empty() {
+            return None;
+        }
+
+        let mut left = 0;
+        let mut right = self.symbol_count;
+        let mut best_match: Option<(usize, &SymbolEntry)> = None;
+
+        while left < right {
+            let mid = left + (right - left) / 2;
+            let entry = get_entry_fn(self, mid);
+
+            match compare_fn(entry) {
+                Ordering::Equal => return Some((mid, entry)),
+                Ordering::Less => {
+                    if find_closest {
+                        best_match = Some((mid, entry));
+                    }
+                    left = mid + 1;
+                }
+                Ordering::Greater => right = mid,
+            }
+        }
+
+        best_match
+    }
+}
+
+#[repr(C)]
+struct SymbolEntry {
+    address_offset: u32,
+    symbol_type: u8,
+    section: u8,
+    description: u16,
+}
+
+impl SymbolEntry {
+    fn name<'a>(&self, symbol_table: &'a SymbolTable) -> &'a str {
+        unsafe {
+            CStr::from_ptr(self.name_ptr(symbol_table))
+                .to_str()
+                .unwrap()
+        }
+    }
+
+    fn name_ptr(&self, symbol_table: &SymbolTable) -> *const c_char {
+        let entry_ptr = self as *const SymbolEntry as *const u8;
+        let data_start = symbol_table.data.as_ptr();
+        let entry_offset = unsafe { entry_ptr.offset_from(data_start) as usize };
+        let name_start = entry_offset + size_of::<SymbolEntry>();
+
+        unsafe { symbol_table.data.as_ptr().add(name_start) as *const c_char }
+    }
+}
+
+pub struct SymbolRef<'a> {
+    symbol_table: &'a SymbolTable,
+    entry: &'a SymbolEntry,
+    kernel_base: u64,
+}
+
+impl<'a> SymbolRef<'a> {
+    pub fn name(&self) -> &'a str {
+        self.entry.name(self.symbol_table)
+    }
+
+    pub fn name_ptr(&self) -> *const c_char {
+        self.entry.name_ptr(self.symbol_table)
+    }
+
+    pub fn address(&self) -> u64 {
+        self.kernel_base + self.entry.address_offset as u64
+    }
+
+    pub fn symbol_type(&self) -> u8 {
+        self.entry.symbol_type
+    }
+
+    pub fn section(&self) -> u8 {
+        self.entry.section
+    }
+
+    pub fn description(&self) -> u16 {
+        self.entry.description
+    }
+}
+
+pub struct SymbolsByNameIterator<'a> {
+    symbol_table: &'a SymbolTable,
+    current_index: usize,
+    end_index: usize,
+    kernel_base: u64,
+}
+
+impl<'a> SymbolsByNameIterator<'a> {
+    fn empty(symbol_table: &'a SymbolTable) -> Self {
+        Self {
+            symbol_table,
+            current_index: 0,
+            end_index: 0,
+            kernel_base: get_kernel_base(),
+        }
+    }
+}
+
+impl<'a> Iterator for SymbolsByNameIterator<'a> {
+    type Item = SymbolRef<'a>;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        if self.current_index == self.end_index {
+            return None;
+        }
+
+        let entry = self.symbol_table.get_symbol_entry_by_name_index(self.current_index);
+        self.current_index += 1;
+
+        Some(SymbolRef {
+            symbol_table: self.symbol_table,
+            entry,
+            kernel_base: self.kernel_base,
+        })
+    }
+}
+
+pub struct SymbolsMatchingIterator<'a> {
+    symbol_table: &'a SymbolTable,
+    current_index: usize,
+    end_index: usize,
+    pspec: *mut GPatternSpec,
+    kernel_base: u64,
+}
+
+impl<'a> SymbolsMatchingIterator<'a> {
+    fn empty(symbol_table: &'a SymbolTable) -> Self {
+        Self {
+            symbol_table,
+            current_index: 0,
+            end_index: 0,
+            pspec: ptr::null_mut(),
+            kernel_base: get_kernel_base(),
+        }
+    }
+}
+
+impl<'a> Iterator for SymbolsMatchingIterator<'a> {
+    type Item = SymbolRef<'a>;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        while self.current_index != self.end_index {
+            let entry = self.symbol_table.get_symbol_entry_by_name_index(self.current_index);
+            self.current_index += 1;
+
+            if unsafe { g_pattern_spec_match_string(self.pspec, entry.name_ptr(self.symbol_table)) } != 0 {
+                return Some(SymbolRef {
+                    symbol_table: self.symbol_table,
+                    entry,
+                    kernel_base: self.kernel_base,
+                });
+            }
+        }
+
+        None
+    }
+}
+
+impl<'a> Drop for SymbolsMatchingIterator<'a> {
+    fn drop(&mut self) {
+        if !self.pspec.is_null() {
+            unsafe { g_pattern_spec_free(self.pspec) };
+        }
+    }
+}
+
+pub struct SymbolsInRangeIterator<'a> {
+    symbol_table: &'a SymbolTable,
+    current_index: usize,
+    end_index: usize,
+    end_offset: u32,
+    kernel_base: u64,
+}
+
+impl<'a> Iterator for SymbolsInRangeIterator<'a> {
+    type Item = SymbolRef<'a>;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        while self.current_index != self.end_index {
+            let entry = self.symbol_table.get_symbol_entry_by_address_index(self.current_index);
+            self.current_index += 1;
+
+            if entry.address_offset >= self.end_offset {
+                break;
+            }
+
+            return Some(SymbolRef {
+                symbol_table: self.symbol_table,
+                entry,
+                kernel_base: self.kernel_base,
+            });
+        }
+
+        None
+    }
+}

src/barebone/agent/src/xnu.rs

@@ -0,0 +1,239 @@
+use core::ffi::c_void;
+use core::sync::atomic::{AtomicU64, Ordering};
+
+static KERNEL_BASE: AtomicU64 = AtomicU64::new(0);
+
+pub fn get_kernel_base() -> u64 {
+    KERNEL_BASE.load(Ordering::Relaxed)
+}
+
+pub fn set_kernel_base(base: u64) {
+    KERNEL_BASE.store(base, Ordering::Relaxed);
+}
+
+type ContinuationFn = unsafe extern "C" fn(_parameter: *mut c_void, _wait_result: i32);
+
+unsafe extern "C" {
+    static _panic: unsafe extern "C" fn(*const u8);
+    static _IOLog: unsafe extern "C" fn(*const u8, ...);
+    static _kalloc: unsafe extern "C" fn(usize) -> *mut u8;
+    static _kfree: unsafe extern "C" fn(*mut u8, usize) -> *mut u8;
+    static _kernel_thread_start:
+        unsafe extern "C" fn(*const (), *mut c_void, *mut *mut c_void) -> isize;
+    static _assert_wait: unsafe extern "C" fn(*const u8, u32) -> i32;
+    static _assert_wait_timeout: unsafe extern "C" fn(*const u8, u32, u32, u32) -> i32;
+    static _thread_block: unsafe extern "C" fn(Option<ContinuationFn>) -> i32;
+    static _thread_wakeup: unsafe extern "C" fn(*const u8) -> i32;
+    static _mach_absolute_time: unsafe extern "C" fn() -> u64;
+    static _absolutetime_to_nanoseconds: unsafe extern "C" fn(u64, *mut u64);
+    static _clock_get_calendar_microtime: unsafe extern "C" fn(*mut u32, *mut u32);
+    static _ml_io_map: unsafe extern "C" fn(u64, u64) -> *mut c_void;
+    static _ml_vtophys: unsafe extern "C" fn(u64) -> u64;
+    static __ZN9IOService11getPlatformEv: unsafe extern "C" fn() -> *mut c_void;
+    static __ZN9IOServiceC2Ev: unsafe extern "C" fn(*mut core::ffi::c_void);
+    static __ZN8OSSymbol17withCStringNoCopyEPKc:
+        unsafe extern "C" fn(*const core::ffi::c_char) -> *const OSSymbol;
+    static __ZN6OSData9withBytesEPKvj:
+        unsafe extern "C" fn(*const core::ffi::c_void, u32) -> *mut OSData;
+}
+
+const IO_SERVICE_VTABLE_LENGTH: isize = 168;
+
+const VT_LOOKUP_IC: isize = IO_SERVICE_VTABLE_LENGTH + 25; // IOPlatformExpert
+const VT_REGISTER_INT: isize = IO_SERVICE_VTABLE_LENGTH + 0; // IOInterruptController
+const VT_ENABLE_INT: isize = IO_SERVICE_VTABLE_LENGTH + 3; // IOInterruptController
+
+pub fn panic(msg: &str) {
+    unsafe { _panic(msg.as_ptr()) };
+}
+
+pub fn io_log(msg: &str) {
+    unsafe {
+        _IOLog(msg.as_ptr());
+    }
+}
+
+pub fn kalloc(size: usize) -> *mut u8 {
+    unsafe { _kalloc(size) }
+}
+
+pub fn free(ptr: *mut u8, size: usize) {
+    unsafe {
+        _kfree(ptr, size);
+    }
+}
+
+pub fn kernel_thread_start(continuation: ContinuationFn, thread_parameter: *mut c_void) -> isize {
+    let mut new_thread: *mut c_void = core::ptr::null_mut();
+    return unsafe {
+        let ptr = crate::pac::ptrauth_sign(continuation as *const u8, 0xd507);
+        _kernel_thread_start(
+            core::mem::transmute(ptr),
+            thread_parameter,
+            &mut new_thread as *mut *mut c_void,
+        )
+        // TODO: Call thread_deallocate()
+    };
+}
+
+pub const THREAD_INTERRUPTIBLE: u32 = 1;
+pub const THREAD_WAITING: i32 = -1;
+
+pub fn assert_wait(event: *const u8, interruptible: u32) -> i32 {
+    unsafe { _assert_wait(event, interruptible) }
+}
+
+pub fn assert_wait_timeout(
+    event: *const u8,
+    interruptible: u32,
+    interval: u32,
+    scale_factor: u32,
+) -> i32 {
+    unsafe { _assert_wait_timeout(event, interruptible, interval, scale_factor) }
+}
+
+pub fn thread_block(continuation: Option<ContinuationFn>) -> i32 {
+    unsafe { _thread_block(continuation) }
+}
+
+pub fn thread_wakeup(event: *const u8) -> i32 {
+    unsafe { _thread_wakeup(event) }
+}
+
+pub fn mach_absolute_time() -> u64 {
+    unsafe { _mach_absolute_time() }
+}
+
+pub fn absolutetime_to_nanoseconds(abstime: u64) -> u64 {
+    let mut nanoseconds: u64 = 0;
+    unsafe {
+        _absolutetime_to_nanoseconds(abstime, &mut nanoseconds);
+    }
+    nanoseconds
+}
+
+pub fn clock_get_calendar_microtime() -> (u32, u32) {
+    let mut secs: u32 = 0;
+    let mut microsecs: u32 = 0;
+    unsafe {
+        _clock_get_calendar_microtime(&mut secs, &mut microsecs);
+    }
+    (secs, microsecs)
+}
+
+pub fn ml_io_map(phys_addr: u64, size: u64) -> *mut c_void {
+    unsafe { _ml_io_map(phys_addr, size) }
+}
+
+pub fn ml_vtophys(vaddr: u64) -> u64 {
+    unsafe { _ml_vtophys(vaddr) }
+}
+
+pub type IOInterruptHandler =
+    extern "C" fn(target: *mut c_void, refcon: *mut c_void, nub: *mut c_void, source: i32);
+
+pub fn install_interrupt_handler(
+    irq: u32,
+    target: *mut c_void,
+    handler: IOInterruptHandler,
+    refcon: *mut c_void,
+) -> i32 {
+    let pe = unsafe { __ZN9IOService11getPlatformEv() };
+
+    let name =
+        unsafe { __ZN8OSSymbol17withCStringNoCopyEPKc(c"IOInterruptController0000001A".as_ptr()) };
+
+    let lookup: extern "C" fn(*mut IOPlatformExpert, *mut OSSymbol) -> *mut IOInterruptController =
+        vf(pe as _, VT_LOOKUP_IC);
+    let ic = lookup(pe as *mut IOPlatformExpert, name as *mut OSSymbol);
+    if ic.is_null() {
+        panic!("Failed to lookup IOInterruptController");
+    }
+
+    let nub = kalloc(0x88);
+    unsafe {
+        core::ptr::write_bytes(nub, 0, 0x88);
+        __ZN9IOServiceC2Ev(nub as *mut core::ffi::c_void);
+    }
+
+    type IOServiceInitFn = unsafe extern "C" fn(*mut c_void, *mut c_void) -> bool;
+    let init_fn: IOServiceInitFn = vf(nub as *mut c_void, 21);
+    unsafe { init_fn(nub as *mut c_void, core::ptr::null_mut()) };
+
+    let interrupt_sources =
+        kalloc(core::mem::size_of::<IOInterruptSource>()) as *mut IOInterruptSource;
+
+    let source_bytes = irq.to_ne_bytes();
+    let vector_data =
+        unsafe { __ZN6OSData9withBytesEPKvj(source_bytes.as_ptr() as *const core::ffi::c_void, 4) };
+
+    unsafe {
+        (*interrupt_sources).interrupt_controller = ic;
+        (*interrupt_sources).vector_data = vector_data;
+    }
+
+    unsafe {
+        let interrupt_sources_ptr = (nub as *mut u8).offset(0x80) as *mut *mut IOInterruptSource;
+        *interrupt_sources_ptr = interrupt_sources;
+    }
+
+    let reg: extern "C" fn(
+        *mut _,
+        *mut c_void,
+        i32,
+        *mut c_void,
+        IOInterruptHandler,
+        *mut c_void,
+    ) -> i32 = vf(ic as _, VT_REGISTER_INT);
+
+    let signed_handler = unsafe {
+        let handler_ptr = crate::pac::ptrauth_sign(handler as *const u8, 0xd36);
+        core::mem::transmute::<*const u8, IOInterruptHandler>(handler_ptr)
+    };
+
+    let kr = reg(ic, nub as *mut c_void, 0, target, signed_handler, refcon);
+    if kr != 0 {
+        return kr;
+    }
+
+    let en: extern "C" fn(*mut _, *mut c_void, i32) -> i32 = vf(ic as _, VT_ENABLE_INT);
+    en(ic, nub as *mut c_void, 0)
+}
+
+#[repr(C)]
+struct IOPlatformExpert {
+    _p: [u8; 0],
+}
+
+#[repr(C)]
+struct IOInterruptController {
+    _p: [u8; 0],
+}
+
+#[repr(C)]
+struct OSSymbol {
+    _p: [u8; 0],
+}
+
+#[repr(C)]
+struct OSData {
+    _p: [u8; 0],
+}
+
+#[repr(C)]
+struct IOInterruptSource {
+    interrupt_controller: *mut IOInterruptController,
+    vector_data: *mut OSData,
+}
+
+#[inline(always)]
+fn vf<T>(obj: *mut c_void, slot: isize) -> T
+where
+    T: Copy,
+{
+    let vtable_ptr = unsafe { *(obj as *const *const usize) };
+    let vtable = unsafe { crate::pac::ptrauth_strip_data(vtable_ptr as *const u8) as *const usize };
+    let entry = unsafe { *vtable.offset(slot) };
+    let entry_ptr = unsafe { crate::pac::ptrauth_strip_data(entry as *const u8) };
+    unsafe { core::mem::transmute_copy::<*const u8, T>(&entry_ptr) }
+}

src/barebone/agent/start_qemu.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+QEMUAppleSilicon/build/qemu-system-aarch64 \
+    -M t8030,memory-backend=ram,trustcache=iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/038-44135-124.dmg.trustcache,ticket=root_ticket.der,sep-fw=sep-firmware.n104.RELEASE.new.img4,sep-rom=AppleSEPROM-Cebu-B1,kaslr-off=true,usb-conn-type=unix,usb-conn-addr=/Users/oleavr/src/frida-barebone-ios/usb.socket \
+    -object memory-backend-file,id=ram,size=4G,mem-path="/Volumes/RAM Disk/ios-dram",share=on \
+    -kernel iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/kernelcache.research.iphone12b \
+    -dtb iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/all_flash/DeviceTree.n104ap.im4p \
+    -append "tlto_us=-1 mtxspin=-1 agm-genuine=1 agm-authentic=1 agm-trusted=1 serial=3 launchd_unsecure_cache=1 wdt=-1" \
+    -smp 7 \
+    -drive file=sep_nvram,if=pflash,format=qcow2 \
+    -drive file=sep_ssc,if=pflash,format=qcow2 \
+    -drive file=nvme.1,format=qcow2,if=none,id=drive.1 -device nvme-ns,drive=drive.1,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 \
+    -drive file=nvme.2,format=qcow2,if=none,id=drive.2 -device nvme-ns,drive=drive.2,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 \
+    -drive file=nvme.3,format=qcow2,if=none,id=drive.3 -device nvme-ns,drive=drive.3,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 \
+    -drive file=nvme.4,format=qcow2,if=none,id=drive.4 -device nvme-ns,drive=drive.4,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 \
+    -drive file=nvram,if=none,format=qcow2,id=nvram -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 \
+    -drive file=nvme.6,format=qcow2,if=none,id=drive.6 -device nvme-ns,drive=drive.6,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 \
+    -drive file=nvme.7,format=qcow2,if=none,id=drive.7 -device nvme-ns,drive=drive.7,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 \
+    -initrd iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/038-44135-124.dmg \
+    -serial mon:stdio \
+    -monitor tcp:127.0.0.1:9001,server,nowait \
+    -gdb tcp::9000

src/barebone/agent/tools/interrupt-controllers.xml

@@ -0,0 +1,40 @@
+<dict ID="0">
+  <key>IOPlatformInterruptController</key>
+  <string ID="1">IOCPUInterruptController is not serializable</string>
+
+  <key>IOInterruptController0000001A</key>
+  <string ID="2">AppleInterruptController is not serializable</string>
+
+  <key>IOInterruptController00000048</key>
+  <string ID="3">AppleS5L8960XGPIOIC is not serializable</string>
+
+  <key>IOInterruptController00000047</key>
+  <string ID="4">AppleS5L8960XGPIOIC is not serializable</string>
+
+  <key>IOInterruptController00000023</key>
+  <string ID="5">AppleS5L8960XGPIOIC is not serializable</string>
+
+  <key>IOInterruptController00000049</key>
+  <string ID="6">AppleS5L8960XGPIOIC is not serializable</string>
+
+  <key>IOInterruptController0000008B</key>
+  <string ID="7">AppleT8015SPMIController is not serializable</string>
+
+  <key>IOInterruptController00000084</key>
+  <string ID="8">AppleT8015SPMIController is not serializable</string>
+
+  <key>ApplePCIEMSIController-apcie</key>
+  <string ID="9">ApplePCIEMSIController is not serializable</string>
+
+  <key>AppleEmbeddedPCIEPort2</key>
+  <string ID="10">AppleT8030PCIePort is not serializable</string>
+
+  <key>AppleEmbeddedPCIEPort3</key>
+  <string ID="11">AppleT8030PCIePort is not serializable</string>
+
+  <key>IOInterruptController00000087</key>
+  <string ID="12">AppleT8015SPMIController is not serializable</string>
+
+  <key>IOInterruptController0000005F</key>
+  <string ID="13">AppleSMCPMU is not serializable</string>
+</dict>

src/barebone/agent/tools/osvalue.js

@@ -0,0 +1,33 @@
+const osSerialize_withCapacity = new NativeFunction(ptr('0xfffffff007fbf074'), 'pointer', ['uint']);
+
+const UNPAC_MASK = ptr('0xfffffff000000000');
+
+const serializer = osSerialize_withCapacity(4096);
+
+const gIOInterruptControllers = ptr('0xfffffff009a3f090').readPointer();
+
+const serialize = new NativeFunction(implFor(6, vtableOf(gIOInterruptControllers)), 'uint' /* 'bool' */, ['pointer', 'pointer']);
+console.log('serialize() is at:', serialize.handle);
+const result = serialize(gIOInterruptControllers, serializer);
+console.log('result returned:', result);
+
+const getText = new NativeFunction(implFor(15, vtableOf(serializer)), 'pointer', ['pointer']);
+const text = getText(serializer);
+console.log('Got text:', text.readUtf8String(text));
+
+const release = new NativeFunction(implFor(5, vtableOf(serializer)), 'void', ['pointer']);
+release(serializer);
+
+Object.assign(globalThis, { osSerialize_withCapacity });
+
+function implFor(n, vtable) {
+  return unpac(vtable.add(n * Process.pointerSize).readPointer());
+}
+
+function vtableOf(instance) {
+  return unpac(instance.readPointer());
+}
+
+function unpac(p) {
+  return p.or(UNPAC_MASK);
+}

src/barebone/agent/tools/scan_hex_pattern.py

@@ -0,0 +1,37 @@
+import os
+import r2pipe
+
+def scan_files_for_pattern(directory, hex_pattern, file_extension=None):
+    search_command = "/xj " + hex_pattern.strip()
+
+    for root, _, files in os.walk(directory):
+        for filename in files:
+            if file_extension and not filename.endswith(file_extension):
+                continue
+
+            file_path = os.path.join(root, filename)
+            try:
+                r2 = r2pipe.open(file_path, flags=["-n"])
+                r2.cmd("e io.cache=true")
+
+                result = r2.cmdj(search_command)
+
+                if result:
+                    print(f"Found in {file_path}:")
+                    for match in result:
+                        print(f"  - Offset: 0x{match['offset']:x}")
+
+                r2.quit()
+            except Exception as e:
+                print(f"    Error processing {file_path}: {e}")
+
+if __name__ == "__main__":
+    import argparse
+
+    parser = argparse.ArgumentParser(description="Scan dump files for a hex pattern using r2pipe.")
+    parser.add_argument("directory", help="Directory containing dump files")
+    parser.add_argument("pattern", help="Hex pattern to search (e.g. 'ff ff ff ff')")
+    parser.add_argument("--ext", help="Only scan files with this extension", default=None)
+
+    args = parser.parse_args()
+    scan_files_for_pattern(args.directory, args.pattern, args.ext)

src/barebone/agent/tools/symbolicate.py

@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+import argparse
+import re
+import subprocess
+import sys
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Symbolicate panic backtrace from kernel log")
+    parser.add_argument("--log-file", type=argparse.FileType("r"), required=True,
+                        help="Path to the kernel log file")
+    parser.add_argument("--elf-file", type=str, required=True,
+                        help="Path to the ELF file for symbolication")
+    parser.add_argument("--base-address", type=lambda x: int(x, 16), required=True,
+                        help="Base address where the ELF was loaded (e.g., 0xffffffe8195f0000)")
+    parser.add_argument("--verbose", "-v", action="store_true",
+                        help="Show all backtrace frames, not just symbolicated ones")
+
+    args = parser.parse_args()
+
+    log_content = args.log_file.read()
+    args.log_file.close()
+
+    frames = find_last_panic(log_content)
+    if not frames:
+        print("No panic found in the log file", file=sys.stderr)
+        return 1
+
+    print(f"Found last panic with {len(frames)} backtrace frames")
+    print(f"ELF base address: 0x{args.base_address:x}")
+    print(f"ELF file: {args.elf_file}")
+    print()
+
+    symbolicated_count = 0
+
+    for i, (lr_str, fp_str) in enumerate(frames):
+        lr_addr = int(lr_str, 16)
+        #fp_addr = int(fp_str, 16)
+
+        if lr_addr >= args.base_address:
+            function, location = symbolicate_address(args.elf_file, lr_addr, args.base_address)
+            offset = lr_addr - args.base_address
+
+            print(f"Frame {i:2d}: lr: {lr_str} (offset: 0x{offset:x}) fp: {fp_str}")
+
+            # Color the function name based on resolution status
+            if function == "<unknown>":
+                colored_function = Colors.bold_yellow(function)
+            elif function == "<error>":
+                colored_function = Colors.bold_red(function)
+            else:
+                colored_function = Colors.bold_green(function)
+
+            print(f"          -> {colored_function}")
+            print(f"             {location}")
+            print()
+            symbolicated_count += 1
+        elif args.verbose:
+            print(f"Frame {i:2d}: lr: {lr_str} fp: {fp_str} (outside ELF range)")
+
+    if symbolicated_count == 0:
+        print("No addresses found within the ELF address range")
+        if not args.verbose:
+            print("Use --verbose to see all frames")
+    else:
+        print(f"Symbolicated {symbolicated_count} frame(s)")
+
+    return 0
+
+
+def find_last_panic(log_content: str):
+    panic_pattern = re.compile(
+        r"panic\(.*?\n.*?Panicked thread:.*?\n((?:\s*lr:\s*0x[0-9a-fA-F]+\s*fp:\s*0x[0-9a-fA-F]+\n)*)",
+        re.DOTALL
+    )
+
+    panics = list(panic_pattern.finditer(log_content))
+
+    if not panics:
+        return None
+
+    last_panic = panics[-1]
+    backtrace_section = last_panic.group(1)
+
+    lr_fp_pattern = re.compile(r"lr:\s*(0x[0-9a-fA-F]+)\s*fp:\s*(0x[0-9a-fA-F]+)")
+    frames = lr_fp_pattern.findall(backtrace_section)
+
+    return frames
+
+
+def symbolicate_address(elf_path: str, address: int, base_address: int):
+    try:
+        offset = address - base_address
+
+        result = subprocess.run([
+            "aarch64-none-elf-addr2line", "-e", elf_path, "-f", "-C", f"0x{offset:x}"
+        ], capture_output=True, text=True, check=True)
+
+        lines = result.stdout.strip().split("\n")
+        if len(lines) >= 2:
+            function = lines[0]
+            location = lines[1]
+
+            if function == "??":
+                function = "<unknown>"
+            if location == "??:0" or location == "??:?":
+                location = "<unknown>"
+
+            return function, location
+        else:
+            return "<unknown>", "<unknown>"
+
+    except (subprocess.CalledProcessError, FileNotFoundError):
+        return "<error>", "<error>"
+
+
+class Colors:
+    BOLD = "\033[1m"
+    GREEN = "\033[32m"
+    YELLOW = "\033[33m"
+    RED = "\033[31m"
+    RESET = "\033[0m"
+
+    @staticmethod
+    def bold_green(text: str):
+        return f"{Colors.BOLD}{Colors.GREEN}{text}{Colors.RESET}"
+
+    @staticmethod
+    def bold_yellow(text: str):
+        return f"{Colors.BOLD}{Colors.YELLOW}{text}{Colors.RESET}"
+
+    @staticmethod
+    def bold_red(text: str):
+        return f"{Colors.BOLD}{Colors.RED}{text}{Colors.RESET}"
+
+
+if __name__ == "__main__":
+    sys.exit(main())

src/barebone/allocator.vala

@@ -14,59 +14,83 @@ namespace Frida.Barebone {
 			get;
 		}
 
+		public abstract size_t size {
+			get;
+		}
+
 		public abstract async void deallocate (Cancellable? cancellable) throws Error, IOError;
 	}
 
-	public sealed class SimpleAllocator : Object, Allocator {
+	public sealed class NullAllocator : Object, Allocator {
 		public size_t page_size {
-			get { return _page_size; }
+			get {
+				return _page_size;
+			}
+		}
+
+		private size_t _page_size;
+
+		public NullAllocator (size_t page_size) {
+			this._page_size = page_size;
+		}
+
+		public async Allocation allocate (size_t size, size_t alignment, Cancellable? cancellable) throws Error, IOError {
+			throw new Error.NOT_SUPPORTED ("To enable this feature, specify an allocator in your FRIDA_BAREBONE_CONFIG");
+		}
+	}
+
+	public sealed class PhysicalAllocator : Object, Allocator {
+		public size_t page_size {
+			get {
+				return _page_size;
+			}
 		}
 
 		private Machine machine;
 		private size_t _page_size;
-		private uint64 base_pa;
 
 		private uint64 cursor;
 
-		public SimpleAllocator (Machine machine, size_t page_size, uint64 base_pa) {
+		public PhysicalAllocator (Machine machine, size_t page_size, PhysicalAllocatorConfig config) {
 			this.machine = machine;
 			this._page_size = page_size;
-			this.base_pa = base_pa;
-			this.cursor = base_pa;
+			this.cursor = config.physical_base.address;
 		}
 
 		public async Allocation allocate (size_t size, size_t alignment, Cancellable? cancellable) throws Error, IOError {
-			if (base_pa == 0) {
-				uint64 example_base;
-				if ("corellium" in machine.gdb.features)
-					example_base = 0x0800000000 + ((2048 - 3) * 1024 * 1024);
-				else
-					example_base = 0x0040000000 + (128 * 1024 * 1024);
-				throw new Error.NOT_SUPPORTED ("To enable this feature, set FRIDA_BAREBONE_HEAP_BASE to the physical " +
-					"base address to use, e.g. 0x%" + uint64.FORMAT_MODIFIER + "x", example_base);
-			}
-
 			uint64 address_pa = cursor;
 
-			size_t vm_size = round_size_up (size, page_size);
+			size_t vm_size = round_size_up (size, _page_size);
 			cursor += vm_size;
 
-			uint num_pages = (uint) (vm_size / page_size);
+			uint num_pages = (uint) (vm_size / _page_size);
 
-			Allocation page_allocation = yield machine.allocate_pages (address_pa, num_pages, cancellable);
+			var physical_addresses = new Gee.ArrayList<uint64?> ();
+			for (uint i = 0; i != num_pages; i++)
+				physical_addresses.add (address_pa + (i * _page_size));
 
-			return new SimpleAllocation (page_allocation);
+			Allocation page_allocation = yield machine.allocate_pages (physical_addresses, cancellable);
+
+			return new PhysicalAllocation (page_allocation);
 		}
 
-		private class SimpleAllocation : Object, Allocation {
+		private class PhysicalAllocation : Object, Allocation {
 			public uint64 virtual_address {
-				get { return page_allocation.virtual_address; }
+				get {
+					return page_allocation.virtual_address;
+				}
+			}
+
+			public size_t size {
+				get {
+					return page_allocation.size;
+				}
 			}
 
 			private Allocation page_allocation;
 
-			public SimpleAllocation (Allocation page_allocation) {
-				this.page_allocation = page_allocation;
+			public PhysicalAllocation (Allocation allocation) {
+				page_allocation = allocation;
 			}
 
 			public async void deallocate (Cancellable? cancellable) throws Error, IOError {
@@ -75,4 +99,60 @@ namespace Frida.Barebone {
 			}
 		}
 	}
+
+	public sealed class TargetFunctionsAllocator : Object, Allocator {
+		public size_t page_size {
+			get {
+				return _page_size;
+			}
+		}
+
+		private Machine machine;
+		private size_t _page_size;
+		private TargetFunctionsAllocatorConfig config;
+
+		public TargetFunctionsAllocator (Machine machine, size_t page_size, TargetFunctionsAllocatorConfig config) {
+			this.machine = machine;
+			this._page_size = page_size;
+			this.config = config;
+		}
+
+		public async Allocation allocate (size_t size, size_t alignment, Cancellable? cancellable) throws Error, IOError {
+			uint64 address = yield machine.invoke (config.alloc_function.address, { size }, cancellable);
+
+			// TODO: Handle alignment.
+
+			return new TargetAllocation (address, size, machine, config);
+		}
+
+		private class TargetAllocation : Object, Allocation {
+			public uint64 virtual_address {
+				get {
+					return _virtual_address;
+				}
+			}
+
+			public size_t size {
+				get {
+					return _size;
+				}
+			}
+
+			private uint64 _virtual_address;
+			public size_t _size;
+			private Machine machine;
+			private TargetFunctionsAllocatorConfig config;
+
+			public TargetAllocation (uint64 address, size_t size, Machine m, TargetFunctionsAllocatorConfig c) {
+				_virtual_address = address;
+				_size = size;
+				machine = m;
+				config = c;
+			}
+
+			public async void deallocate (Cancellable? cancellable) throws Error, IOError {
+				yield machine.invoke (config.free_function.address, { _virtual_address, size }, cancellable);
+			}
+		}
+	}
 }

src/barebone/arch-arm/machine.vala

@@ -26,16 +26,25 @@ namespace Frida.Barebone {
 			return 4096;
 		}
 
+		public async uint query_exception_level (Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async void enumerate_ranges (Gum.PageProtection prot, FoundRangeFunc func, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
-		public async Allocation allocate_pages (uint64 physical_address, uint num_pages, Cancellable? cancellable)
+		public async Allocation allocate_pages (Gee.List<uint64?> physical_addresses, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
+		public async void protect_pages (uint64 virtual_address, size_t size, Gum.PageProtection prot,
+				Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async Gee.List<uint64?> scan_ranges (Gee.List<Gum.MemoryRange?> ranges, MatchPattern pattern, uint max_matches,
 				Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
@@ -45,8 +54,7 @@ namespace Frida.Barebone {
 			throw_not_supported ();
 		}
 
-		public async uint64 invoke (uint64 impl, uint64[] args, uint64 landing_zone, Cancellable? cancellable)
-				throws Error, IOError {
+		public async uint64 invoke (uint64 impl, uint64[] args, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
 		}
 

src/barebone/arch-arm64/machine.vala

@@ -25,6 +25,13 @@ namespace Frida.Barebone {
 		private const uint64 INT6_MASK = 0x3fULL;
 		private const uint64 INT48_MASK = 0xffffffffffffULL;
 
+		private const uint64 TABLE_PXN_BIT = 1ULL << 59;
+
+		private const uint64 UXN_BIT = 1ULL << 54;
+		private const uint64 PXN_BIT = 1ULL << 53;
+		private const uint64 AP1_BIT = 1ULL << 7;
+		private const uint64 AP0_BIT = 1ULL << 6;
+
 		public Arm64Machine (GDB.Client gdb) {
 			Object (gdb: gdb);
 		}
@@ -35,6 +42,17 @@ namespace Frida.Barebone {
 			return p.granule;
 		}
 
+		public async uint query_exception_level (Cancellable? cancellable) throws Error, IOError {
+			GDB.Exception? exception = gdb.exception;
+			if (exception == null)
+				throw new Error.INVALID_OPERATION ("Unable to query in current state");
+			GDB.Thread thread = exception.thread;
+
+			var cpsr = yield thread.read_register ("cpsr", cancellable);
+
+			return (uint) ((cpsr >> 2) & 3);
+		}
+
 		public async void enumerate_ranges (Gum.PageProtection prot, FoundRangeFunc func, Cancellable? cancellable)
 				throws Error, IOError {
 			Gee.List<RangeDetails> ranges = ("corellium" in gdb.features)
@@ -55,7 +73,7 @@ namespace Frida.Barebone {
 
 			yield set_addressing_mode (gdb, PHYSICAL, cancellable);
 			try {
-				yield collect_ranges_in_table (p.tt1, p.first_level, p.upper_bits, p.granule, result, cancellable);
+				yield collect_ranges_in_table (p.tt1, p.first_level, p.upper_bits, p, result, cancellable);
 			} finally {
 				set_addressing_mode.begin (gdb, VIRTUAL, null);
 			}
@@ -63,30 +81,30 @@ namespace Frida.Barebone {
 			return result;
 		}
 
-		private async void collect_ranges_in_table (uint64 table_address, uint level, uint64 upper_bits, Granule granule,
+		private async void collect_ranges_in_table (uint64 table_address, uint level, uint64 upper_bits, MMUParameters p,
 				Gee.List<RangeDetails> ranges, Cancellable? cancellable) throws Error, IOError {
-			uint max_entries = compute_max_entries (level, granule);
+			uint max_entries = compute_max_entries (level, p);
 			Buffer entries = yield gdb.read_buffer (table_address, max_entries * Descriptor.SIZE, cancellable);
-			uint shift = address_shift_at_level (level, granule);
+			uint shift = address_shift_at_level (level, p.granule);
 			for (uint i = 0; i != max_entries; i++) {
 				uint64 raw_descriptor = entries.read_uint64 (i * Descriptor.SIZE);
 
-				Descriptor desc = Descriptor.parse (raw_descriptor, level, granule);
+				Descriptor desc = Descriptor.parse (raw_descriptor, level, p.granule);
 				if (desc.kind == INVALID)
 					continue;
 
 				uint64 address = upper_bits | ((uint64) i << shift);
 
 				if (desc.kind == BLOCK) {
-					size_t size = 1 << num_block_bits_at_level (level, granule);
-					Gum.PageProtection prot = protection_from_flags (desc.flags);
+					size_t size = 1 << num_block_bits_at_level (level, p.granule);
+					Gum.PageProtection prot = protection_from_flags (desc.flags, p);
 
 					ranges.add (new RangeDetails (address, desc.target_address, size, prot, MappingType.UNKNOWN));
 
 					continue;
 				}
 
-				yield collect_ranges_in_table (desc.target_address, level + 1, address, granule, ranges, cancellable);
+				yield collect_ranges_in_table (desc.target_address, level + 1, address, p, ranges, cancellable);
 			}
 		}
 
@@ -145,33 +163,35 @@ namespace Frida.Barebone {
 			return result;
 		}
 
-		public async Allocation allocate_pages (uint64 physical_address, uint num_pages, Cancellable? cancellable)
+		public async Allocation allocate_pages (Gee.List<uint64?> physical_addresses, Cancellable? cancellable)
 				throws Error, IOError {
 			MMUParameters p = yield MMUParameters.load (gdb, cancellable);
 
 			yield set_addressing_mode (gdb, PHYSICAL, cancellable);
 			try {
-				Allocation? allocation = yield maybe_insert_descriptor_in_table (physical_address, num_pages, p.tt1,
-					p.first_level, p.upper_bits, p.granule, cancellable);
+				Allocation? allocation = yield maybe_insert_descriptor_in_table (physical_addresses, p.tt1, p.first_level,
+					p.upper_bits, p, cancellable);
 				if (allocation == null)
 					throw new Error.NOT_SUPPORTED ("Unable to insert page table mapping; please file a bug");
+
 				return allocation;
 			} finally {
 				set_addressing_mode.begin (gdb, VIRTUAL, null);
 			}
 		}
 
-		private async Allocation? maybe_insert_descriptor_in_table (uint64 physical_address, uint num_pages,
-				uint64 table_address, uint level, uint64 upper_bits, Granule granule, Cancellable? cancellable)
+		private async Allocation? maybe_insert_descriptor_in_table (Gee.List<uint64?> physical_addresses,
+				uint64 table_address, uint level, uint64 upper_bits, MMUParameters p, Cancellable? cancellable)
 				throws Error, IOError {
-			uint max_entries = compute_max_entries (level, granule);
-			uint shift = address_shift_at_level (level, granule);
+			uint max_entries = compute_max_entries (level, p);
+			uint shift = address_shift_at_level (level, p.granule);
 
 			uint64 first_available_va = 0;
 			uint64 first_available_slot = 0;
 			uint num_available_slots = 0;
 			uint chunk_max_size = (level < 3) ? 4 : 64;
 			uint chunk_offset = 0;
+			uint num_pages = physical_addresses.size;
 			while (chunk_offset != max_entries && num_available_slots != num_pages) {
 				uint64 chunk_base_address = table_address + (chunk_offset * Descriptor.SIZE);
 				uint chunk_size = uint.min (chunk_max_size, max_entries - chunk_offset);
@@ -184,13 +204,15 @@ namespace Frida.Barebone {
 					uint table_index = chunk_offset + i;
 					uint64 address = upper_bits | ((uint64) table_index << shift);
 
-					Descriptor desc = Descriptor.parse (raw_descriptor, level, granule);
+					Descriptor desc = Descriptor.parse (raw_descriptor, level, p.granule);
 
 					if (level < 3) {
 						if (desc.kind != TABLE)
 							continue;
-						Allocation? allocation = yield maybe_insert_descriptor_in_table (physical_address,
-							num_pages, desc.target_address, level + 1, address, granule, cancellable);
+						if ((desc.flags & DescriptorFlags.PXNTABLE) != 0)
+							continue;
+						Allocation? allocation = yield maybe_insert_descriptor_in_table (physical_addresses,
+							desc.target_address, level + 1, address, p, cancellable);
 						if (allocation != null)
 							return allocation;
 						continue;
@@ -215,26 +237,205 @@ namespace Frida.Barebone {
 			if (num_available_slots != num_pages)
 				return null;
 
+			Gum.PageProtection page_prot = Gum.PageProtection.READ | Gum.PageProtection.WRITE;
+			if (!p.sprr_enabled)
+				page_prot |= Gum.PageProtection.EXECUTE;
+
 			var builder = gdb.make_buffer_builder ();
 			for (uint i = 0; i != num_available_slots; i++) {
-				uint64 cur_physical_address = physical_address + (i * granule);
-				uint64 new_descriptor = cur_physical_address | 0x40000000000403ULL;
+				uint64 base_descriptor = physical_addresses[(int) i] | 0x403ULL;
+				uint64 new_descriptor = apply_protection_bits (base_descriptor, page_prot, p);
 				builder.append_uint64 (new_descriptor);
 			}
 			Bytes new_descriptors = builder.build ();
 			Bytes old_descriptors = yield gdb.read_byte_array (first_available_slot, new_descriptors.get_size (), cancellable);
 			yield gdb.write_byte_array (first_available_slot, new_descriptors, cancellable);
 
-			return new DescriptorAllocation (first_available_va, first_available_slot, old_descriptors, gdb);
+			size_t size = num_pages * p.granule;
+			return new DescriptorAllocation (first_available_va, size, first_available_slot, old_descriptors, gdb);
+		}
+
+		public async void protect_pages (uint64 virtual_address, size_t size, Gum.PageProtection prot, Cancellable? cancellable)
+				throws Error, IOError {
+			MMUParameters p = yield MMUParameters.load (gdb, cancellable);
+
+			yield set_addressing_mode (gdb, PHYSICAL, cancellable);
+			try {
+				uint64 page_mask = p.granule - 1;
+				uint64 aligned_va = virtual_address & ~page_mask;
+				uint64 aligned_end = (virtual_address + size + page_mask) & ~page_mask;
+				uint num_pages = (uint) ((aligned_end - aligned_va) / p.granule);
+
+				yield perform_protect_pages (aligned_va, num_pages, prot, p, cancellable);
+			} finally {
+				set_addressing_mode.begin (gdb, VIRTUAL, null);
+			}
+		}
+
+		private async void perform_protect_pages (uint64 start_va, uint num_pages, Gum.PageProtection prot, MMUParameters p,
+				Cancellable? cancellable) throws Error, IOError {
+			var table_cache = new TableWalkCache ();
+			uint pages_processed = 0;
+
+			var processed_tables = new Gee.HashSet<uint64?> (Numeric.uint64_hash, Numeric.uint64_equal);
+			bool need_exec = (prot & Gum.PageProtection.EXECUTE) != 0;
+
+			while (pages_processed != num_pages) {
+				uint64 current_va = start_va + (uint64) pages_processed * p.granule;
+
+				uint64 table_pa = yield find_level3_table (current_va, p, table_cache, cancellable);
+
+				if (need_exec && !processed_tables.contains (table_pa)) {
+					yield clear_pxn_table_bits_for_va (current_va, p, table_cache, cancellable);
+					processed_tables.add (table_pa);
+				}
+
+				uint level3_shift = address_shift_at_level (3, p.granule);
+				uint64 level3_mask = (1ULL << level3_shift) - 1;
+				uint64 table_base_va = current_va & ~level3_mask;
+				uint64 table_end_va = table_base_va + (1ULL << level3_shift);
+				uint64 remaining_va = start_va + num_pages * p.granule;
+				uint64 batch_end_va = uint64.min (remaining_va, table_end_va);
+				uint batch_size = (uint) ((batch_end_va - current_va) / p.granule);
+
+				yield protect_pages_in_table (current_va, batch_size, prot, table_pa, p, cancellable);
+
+				pages_processed += batch_size;
+			}
+		}
+
+		private async void protect_pages_in_table (uint64 current_va, uint batch_size, Gum.PageProtection prot,
+				uint64 table_pa, MMUParameters p, Cancellable? cancellable) throws Error, IOError {
+			uint index_bits = num_address_bits_at_level (3, p);
+			uint index_shift = inpage_bits_for_granule (p.granule);
+			uint index_mask = (1U << index_bits) - 1;
+
+			uint64 first_index = (current_va >> index_shift) & index_mask;
+			uint64 first_slot_pa = table_pa + (first_index * Descriptor.SIZE);
+
+			Buffer descriptors = yield gdb.read_buffer (first_slot_pa, batch_size * Descriptor.SIZE, cancellable);
+
+			bool any_changed = false;
+			for (uint i = 0; i != batch_size; i++) {
+				uint64 raw_desc = descriptors.read_uint64 (i * Descriptor.SIZE);
+				uint64 new_desc = apply_protection_bits (raw_desc, prot, p);
+
+				if (new_desc != raw_desc) {
+					descriptors.write_uint64 (i * Descriptor.SIZE, new_desc);
+					any_changed = true;
+				}
+			}
+
+			if (any_changed)
+				yield gdb.write_byte_array (first_slot_pa, descriptors.bytes, cancellable);
+		}
+
+		private async uint64 find_level3_table (uint64 va, MMUParameters p, TableWalkCache cache, Cancellable? cancellable)
+				throws Error, IOError {
+			TableWalkResult? cached = cache.lookup (va, p);
+			if (cached != null)
+				return yield walk_to_level3 (va, cached.table_pa, cached.level, p, cache, cancellable);
+
+			return yield walk_to_level3 (va, p.tt1, p.first_level, p, cache, cancellable);
+		}
+
+		private async uint64 walk_to_level3 (uint64 va, uint64 start_table_pa, uint start_level, MMUParameters p,
+				TableWalkCache cache, Cancellable? cancellable) throws Error, IOError {
+			uint64 table_pa = start_table_pa;
+			uint level = start_level;
+
+			while (level != 3) {
+				cache.store (va, level, table_pa, p);
+
+				uint shift = address_shift_at_level (level, p.granule);
+				uint entries = compute_max_entries (level, p);
+				uint index = (uint) ((va >> shift) & (entries - 1));
+				uint64 slot_pa = table_pa + ((uint64) index * Descriptor.SIZE);
+
+				Buffer d_buf = yield gdb.read_buffer (slot_pa, Descriptor.SIZE, cancellable);
+				uint64 raw = d_buf.read_uint64 (0);
+				Descriptor desc = Descriptor.parse (raw, level, p.granule);
+
+				if (desc.kind != TABLE)
+					throw new Error.NOT_SUPPORTED ("Walk failed at level %u", level);
+
+				table_pa = desc.target_address;
+				level++;
+			}
+
+			return table_pa;
+		}
+
+		private async void clear_pxn_table_bits_for_va (uint64 va, MMUParameters p, TableWalkCache cache, Cancellable? cancellable)
+				throws Error, IOError {
+			uint64 table_pa = p.tt1;
+			for (uint level = p.first_level; level != 3; level++) {
+				uint entries = compute_max_entries (level, p);
+				uint shift = address_shift_at_level (level, p.granule);
+				uint index = (uint) ((va >> shift) & (entries - 1));
+				uint64 slot_pa = table_pa + (index * Descriptor.SIZE);
+
+				Buffer d_buf = yield gdb.read_buffer (slot_pa, Descriptor.SIZE, cancellable);
+				uint64 raw_desc = d_buf.read_uint64 (0);
+				Descriptor desc = Descriptor.parse (raw_desc, level, p.granule);
+				if (desc.kind != TABLE)
+					break;
+
+				if ((raw_desc & TABLE_PXN_BIT) != 0) {
+					uint64 new_desc = raw_desc & ~TABLE_PXN_BIT;
+					d_buf.write_uint64 (0, new_desc);
+					yield gdb.write_byte_array (slot_pa, d_buf.bytes, cancellable);
+				}
+
+				table_pa = desc.target_address;
+			}
+		}
+
+		private class TableWalkCache {
+			private Gee.Map<uint64?, TableWalkResult> cache =
+				new Gee.HashMap<uint64?, TableWalkResult> (Numeric.uint64_hash, Numeric.uint64_equal);
+
+			public TableWalkResult? lookup (uint64 va, MMUParameters p) {
+				for (int level = 2; level >= (int) p.first_level; level--) {
+					uint64 cache_key = compute_cache_key (va, (uint) level, p);
+					TableWalkResult? result = cache[cache_key];
+					if (result != null)
+						return result;
+				}
+				return null;
+			}
+
+			public void store (uint64 va, uint level, uint64 table_pa, MMUParameters p) {
+				if (level >= 3)
+					return;
+
+				uint64 cache_key = compute_cache_key (va, level, p);
+				cache[cache_key] = new TableWalkResult () {
+					table_pa = table_pa,
+					level = level
+				};
+			}
+
+			private uint64 compute_cache_key (uint64 va, uint level, MMUParameters p) {
+				uint shift = address_shift_at_level (level + 1, p.granule);
+				return (va >> shift) << shift;
+			}
+		}
+
+		private class TableWalkResult {
+			public uint64 table_pa;
+			public uint level;
 		}
 
 		public async Gee.List<uint64?> scan_ranges (Gee.List<Gum.MemoryRange?> ranges, MatchPattern pattern, uint max_matches,
 				Cancellable? cancellable) throws Error, IOError {
 			unowned uint8[] scanner_blob = Data.Barebone.get_memory_scanner_arm64_elf_blob ().data;
 
+			var raw_scanner = new Bytes.static (scanner_blob);
+
 			Gum.ElfModule scanner;
 			try {
-				scanner = new Gum.ElfModule.from_blob (new Bytes.static (scanner_blob));
+				scanner = new Gum.ElfModule.from_blob (raw_scanner);
 			} catch (Gum.Error e) {
 				throw new Error.NOT_SUPPORTED ("%s", e.message);
 			}
@@ -293,13 +494,17 @@ namespace Frida.Barebone {
 
 			uint64 module_page_pa = page_start (module_pa, page_size);
 
-			Allocation module_allocation = yield allocate_pages (module_page_pa, num_pages, cancellable);
+			var module_pas = new Gee.ArrayList<uint64?> ();
+			for (uint i = 0; i != num_pages; i++)
+				module_pas.add (module_page_pa + (i * page_size)); // FIXME: This assumes a contiguous range.
+
+			Allocation module_allocation = yield allocate_pages (module_pas, cancellable);
 
 			size_t page_offset = (size_t) (module_pa - module_page_pa);
 			uint64 module_va = module_allocation.virtual_address + page_offset;
 			uint64 data_va = module_va + data_offset;
 
-			Bytes scanner_module = relocate (scanner, module_va);
+			Bytes scanner_module = relocate (scanner, raw_scanner, module_va);
 			Bytes original_memory = yield gdb.read_byte_array (module_va, vm_size, cancellable);
 			yield gdb.write_byte_array (module_va, scanner_module, cancellable);
 
@@ -354,14 +559,17 @@ namespace Frida.Barebone {
 				case ABS64:
 					relocated.write_uint64 ((size_t) r.address, base_va + r.symbol.address + r.addend);
 					break;
+				case PREL32:
+					var diff = (int64) (base_va + r.symbol.address + r.addend) - (int64) (base_va + r.address);
+					relocated.write_int32 ((size_t) r.address, (int32) diff);
+					break;
 				default:
 					throw new Error.NOT_SUPPORTED ("Unsupported relocation type: %s",
 						Marshal.enum_to_nick<Gum.ElfArm64Relocation> (type));
 			}
 		}
 
-		public async uint64 invoke (uint64 impl, uint64[] args, uint64 landing_zone, Cancellable? cancellable)
-				throws Error, IOError {
+		public async uint64 invoke (uint64 impl, uint64[] args, Cancellable? cancellable) throws Error, IOError {
 			if (args.length > 8)
 				throw new Error.NOT_SUPPORTED ("Unsupported number of arguments; please open a PR");
 
@@ -377,6 +585,7 @@ namespace Frida.Barebone {
 
 			regs["pc"] = impl;
 
+			uint64 landing_zone = saved_regs["pc"].get_uint64 ();
 			regs["x30"] = landing_zone;
 
 			uint64 sp = saved_regs["sp"].get_uint64 ();
@@ -406,6 +615,35 @@ namespace Frida.Barebone {
 			return retval;
 		}
 
+		public async void execute (uint64 start, uint64 end, Cancellable? cancellable) throws Error, IOError {
+			bool was_running = gdb.state != STOPPED;
+			if (was_running)
+				yield gdb.stop (cancellable);
+
+			GDB.Thread thread = gdb.exception.thread;
+			Gee.Map<string, Variant> saved_regs = yield thread.read_registers (cancellable);
+
+			var regs = new Gee.HashMap<string, Variant> ();
+			regs.set_all (saved_regs);
+
+			regs["pc"] = start;
+
+			yield thread.write_registers (regs, cancellable);
+
+			GDB.Breakpoint bp = yield gdb.add_breakpoint (SOFT, end, 4, cancellable);
+			GDB.Exception ex = null;
+			do {
+				ex = yield gdb.continue_until_exception (cancellable);
+			} while (ex.breakpoint != bp || ex.thread.id != thread.id);
+			// TODO: Improve GDB.Client to guarantee a single GDB.Thread instance per ID.
+			yield bp.remove (cancellable);
+
+			yield thread.write_registers (saved_regs, cancellable);
+
+			if (was_running)
+				yield gdb.continue (cancellable);
+		}
+
 		public async CallFrame load_call_frame (GDB.Thread thread, uint arity, Cancellable? cancellable) throws Error, IOError {
 			var regs = yield thread.read_registers (cancellable);
 
@@ -689,6 +927,10 @@ namespace Frida.Barebone {
 			public uint first_level;
 			public uint64 upper_bits;
 			public uint64 tt1;
+			public uint t1sz;
+
+			public bool sprr_enabled;
+			public uint64 sprr_perm;
 
 			public static async MMUParameters load (GDB.Client gdb, Cancellable? cancellable) throws Error, IOError {
 				GDB.Exception? exception = gdb.exception;
@@ -716,6 +958,10 @@ namespace Frida.Barebone {
 					parameters.upper_bits |= 1ULL << (63 - i);
 
 				parameters.tt1 = regs.ttbr1 & INT48_MASK;
+				parameters.t1sz = t1sz;
+
+				parameters.sprr_enabled = (regs.sprr_config & 1) != 0;
+				parameters.sprr_perm = regs.sprr_perm;
 
 				return parameters;
 			}
@@ -724,6 +970,8 @@ namespace Frida.Barebone {
 		private class MMURegisters {
 			public uint64 tcr;
 			public uint64 ttbr1;
+			public uint64 sprr_config;
+			public uint64 sprr_perm;
 
 			public static async MMURegisters read (GDB.Thread thread, Cancellable? cancellable) throws Error, IOError {
 				var regs = new MMURegisters ();
@@ -741,10 +989,19 @@ namespace Frida.Barebone {
 							regs.tcr = val;
 						else if (name == "ttbr1_el1")
 							regs.ttbr1 = val;
+						else if (name == "sprr_config_el1")
+							regs.sprr_config = val;
+						else if (name == "sprr_el1br1_el1")
+							regs.sprr_perm = val;
 					}
 				} else {
 					regs.tcr = yield thread.read_register ("tcr_el1", cancellable);
 					regs.ttbr1 = yield thread.read_register ("ttbr1_el1", cancellable);
+					try {
+						regs.sprr_config = yield thread.read_register ("sprr_config_el1", cancellable);
+						regs.sprr_perm = yield thread.read_register ("sprr_el1br1_el1", cancellable);
+					} catch (Error e) {
+					}
 				}
 
 				return regs;
@@ -850,16 +1107,27 @@ namespace Frida.Barebone {
 
 		private class DescriptorAllocation : Object, Allocation {
 			public uint64 virtual_address {
-				get { return base_va; }
+				get {
+					return base_va;
+				}
+			}
+
+			public size_t size {
+				get {
+					return _size;
+				}
 			}
 
 			private uint64 base_va;
+			private size_t _size;
 			private uint64 first_slot;
 			private Bytes? old_descriptors;
 			private GDB.Client gdb;
 
-			public DescriptorAllocation (uint64 base_va, uint64 first_slot, Bytes old_descriptors, GDB.Client gdb) {
+			public DescriptorAllocation (uint64 base_va, size_t size, uint64 first_slot, Bytes old_descriptors,
+					GDB.Client gdb) {
 				this.base_va = base_va;
+				this._size = size;
 				this.first_slot = first_slot;
 				this.old_descriptors = old_descriptors;
 				this.gdb = gdb;
@@ -908,11 +1176,23 @@ namespace Frida.Barebone {
 			assert_not_reached ();
 		}
 
-		private static uint compute_max_entries (uint level, Granule granule) {
-			return 1 << num_address_bits_at_level (level, granule);
+		private static uint compute_max_entries (uint level, MMUParameters p) {
+			return 1 << num_address_bits_at_level (level, p);
 		}
 
-		private static uint num_address_bits_at_level (uint level, Granule granule) {
+		private static uint num_address_bits_at_level (uint level, MMUParameters p) {
+			if (level == p.first_level) {
+				uint available_address_bits = 64 - p.t1sz - inpage_bits_for_granule (p.granule);
+				uint consumed_by_lower_levels = 0;
+				for (uint l = level + 1; l <= 3; l++)
+					consumed_by_lower_levels += unclipped_address_bits_at_level (l, p.granule);
+				return available_address_bits - consumed_by_lower_levels;
+			} else {
+				return unclipped_address_bits_at_level (level, p.granule);
+			}
+		}
+
+		private static uint unclipped_address_bits_at_level (uint level, Granule granule) {
 			switch (granule) {
 				case 4K:
 					return 9;
@@ -932,7 +1212,7 @@ namespace Frida.Barebone {
 		private static uint address_shift_at_level (uint level, Granule granule) {
 			uint shift = inpage_bits_for_granule (granule);
 			for (int l = 2; l != (int) level - 1; l--)
-				shift += num_address_bits_at_level (l, granule);
+				shift += unclipped_address_bits_at_level (l, granule);
 			return shift;
 		}
 
@@ -949,7 +1229,45 @@ namespace Frida.Barebone {
 			}
 		}
 
-		private static Gum.PageProtection protection_from_flags (DescriptorFlags flags) {
+		private static Gum.PageProtection protection_from_flags (DescriptorFlags flags, MMUParameters p) {
+			if (p.sprr_enabled) {
+				uint idx = 0;
+				if ((flags & DescriptorFlags.AP_READ_ONLY) != 0)
+					idx |= 1 << 3;
+				if ((flags & DescriptorFlags.AP_ALLOW_APPLICATION) != 0)
+					idx |= 1 << 2;
+				if ((flags & DescriptorFlags.UXN) != 0)
+					idx |= 1 << 1;
+				if ((flags & DescriptorFlags.PXN) != 0)
+					idx |= 1 << 0;
+
+				uint perm = (uint) ((p.sprr_perm >> (idx * 4)) & 0xf);
+
+				Gum.PageProtection prot;
+				switch (perm & 3) {
+					case 0:
+						prot = 0;
+						break;
+					case 1:
+						prot = READ | EXECUTE;
+						if ((perm >> 2) == 2)
+							prot = EXECUTE;
+						break;
+					case 2:
+						prot = READ;
+						break;
+					case 3:
+						prot = READ | WRITE;
+						if ((perm >> 2) == 1)
+							prot = 0;
+						break;
+					default:
+						assert_not_reached ();
+				}
+
+				return prot;
+			}
+
 			Gum.PageProtection prot = READ;
 			if ((flags & DescriptorFlags.PXN) == 0)
 				prot |= EXECUTE;
@@ -958,6 +1276,93 @@ namespace Frida.Barebone {
 			return prot;
 		}
 
+		private static uint64 apply_protection_bits (uint64 descriptor, Gum.PageProtection prot, MMUParameters p) throws Error {
+			uint64 result = descriptor;
+
+			if (p.sprr_enabled) {
+				uint target_sprr_index = find_sprr_index_for_permissions (prot, p);
+				result = apply_sprr_index_to_descriptor (result, target_sprr_index);
+			} else {
+				result = apply_non_sprr_protection_bits (result, prot);
+			}
+
+			return result;
+		}
+
+		private static uint64 apply_non_sprr_protection_bits (uint64 descriptor, Gum.PageProtection prot) {
+			uint64 result = descriptor;
+
+			bool want_exec = (prot & Gum.PageProtection.EXECUTE) != 0;
+			bool want_write = (prot & Gum.PageProtection.WRITE) != 0;
+
+			if (want_exec)
+				result &= ~(UXN_BIT | PXN_BIT);
+			else
+				result |= (UXN_BIT | PXN_BIT);
+
+			if (want_write) {
+				result &= ~(AP1_BIT | AP0_BIT);
+			} else {
+				result |= AP1_BIT;
+				result &= ~AP0_BIT;
+			}
+
+			return result;
+		}
+
+		private static uint find_sprr_index_for_permissions (Gum.PageProtection prot, MMUParameters p) throws Error {
+			bool want_read = (prot & Gum.PageProtection.READ) != 0;
+			bool want_write = (prot & Gum.PageProtection.WRITE) != 0;
+			bool want_exec = (prot & Gum.PageProtection.EXECUTE) != 0;
+
+			for (uint i = 0; i != 16; i++) {
+				uint perm = (uint) ((p.sprr_perm >> (i * 4)) & 0xf);
+
+				bool slot_allows_read = false;
+				bool slot_allows_write = false;
+				bool slot_allows_exec = false;
+
+				switch (perm & 3) {
+					case 0:
+						break;
+					case 1:
+						slot_allows_exec = true;
+						if ((perm >> 2) != 2)
+							slot_allows_read = true;
+						break;
+					case 2:
+						slot_allows_read = true;
+						break;
+					case 3:
+						slot_allows_read = true;
+						slot_allows_write = ((perm >> 2) != 1);
+						break;
+				}
+
+				if (slot_allows_read == want_read && slot_allows_write == want_write && slot_allows_exec == want_exec)
+					return i;
+			}
+
+			throw new Error.INVALID_ARGUMENT ("No suitable SPRR slot found for protection 0x%x", prot);
+		}
+
+		private static uint64 apply_sprr_index_to_descriptor (uint64 descriptor, uint sprr_index) {
+			uint64 result = descriptor;
+
+			result &= ~(AP1_BIT | AP0_BIT | UXN_BIT | PXN_BIT);
+
+			if ((sprr_index & 0x8) != 0)
+				result |= AP1_BIT;
+			if ((sprr_index & 0x4) != 0)
+				result |= AP0_BIT;
+			if ((sprr_index & 0x2) != 0)
+				result |= UXN_BIT;
+			if ((sprr_index & 0x1) != 0)
+				result |= PXN_BIT;
+
+			return result;
+		}
+
 		private static Gum.PageProtection protection_from_corellium_pt_details (string details) {
 			Gum.PageProtection prot = READ;
 			if (!("pXN" in details))

src/barebone/arch-unknown/machine.vala

@@ -22,15 +22,24 @@ namespace Frida.Barebone {
 			return 4096;
 		}
 
+		public async uint query_exception_level (Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async void enumerate_ranges (Gum.PageProtection prot, FoundRangeFunc func, Cancellable? cancellable)
 				throws Error, IOError {
 		}
 
-		public async Allocation allocate_pages (uint64 physical_address, uint num_pages, Cancellable? cancellable)
+		public async Allocation allocate_pages (Gee.List<uint64?> physical_addresses, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
+		public async void protect_pages (uint64 virtual_address, size_t size, Gum.PageProtection prot,
+				Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async Gee.List<uint64?> scan_ranges (Gee.List<Gum.MemoryRange?> ranges, MatchPattern pattern,
 				uint max_matches, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
@@ -40,8 +49,7 @@ namespace Frida.Barebone {
 			throw_not_supported ();
 		}
 
-		public async uint64 invoke (uint64 impl, uint64[] args, uint64 landing_zone, Cancellable? cancellable)
-				throws Error, IOError {
+		public async uint64 invoke (uint64 impl, uint64[] args, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
 		}
 

src/barebone/arch-x86/machine.vala

@@ -22,16 +22,25 @@ namespace Frida.Barebone {
 			return 4096;
 		}
 
+		public async uint query_exception_level (Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async void enumerate_ranges (Gum.PageProtection prot, FoundRangeFunc func, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
-		public async Allocation allocate_pages (uint64 physical_address, uint num_pages, Cancellable? cancellable)
+		public async Allocation allocate_pages (Gee.List<uint64?> physical_addresses, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
+		public async void protect_pages (uint64 virtual_address, size_t size, Gum.PageProtection prot,
+				Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async Gee.List<uint64?> scan_ranges (Gee.List<Gum.MemoryRange?> ranges, MatchPattern pattern, uint max_matches,
 				Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
@@ -41,8 +50,7 @@ namespace Frida.Barebone {
 			throw_not_supported ();
 		}
 
-		public async uint64 invoke (uint64 impl, uint64[] args, uint64 landing_zone, Cancellable? cancellable)
-				throws Error, IOError {
+		public async uint64 invoke (uint64 impl, uint64[] args, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
 		}
 

src/barebone/arch-x86_64/machine.vala

@@ -24,16 +24,25 @@ namespace Frida.Barebone {
 			return 4096;
 		}
 
+		public async uint query_exception_level (Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async void enumerate_ranges (Gum.PageProtection prot, FoundRangeFunc func, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
-		public async Allocation allocate_pages (uint64 physical_address, uint num_pages, Cancellable? cancellable)
+		public async Allocation allocate_pages (Gee.List<uint64?> physical_addresses, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
+		public async void protect_pages (uint64 virtual_address, size_t size, Gum.PageProtection prot,
+				Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async Gee.List<uint64?> scan_ranges (Gee.List<Gum.MemoryRange?> ranges, MatchPattern pattern, uint max_matches,
 				Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
@@ -43,8 +52,7 @@ namespace Frida.Barebone {
 			throw_not_supported ();
 		}
 
-		public async uint64 invoke (uint64 impl, uint64[] args, uint64 landing_zone, Cancellable? cancellable)
-				throws Error, IOError {
+		public async uint64 invoke (uint64 impl, uint64[] args, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
 		}
 

src/barebone/barebone-host-session.vala

@@ -2,26 +2,8 @@ namespace Frida {
 	public sealed class BareboneHostSessionBackend : Object, HostSessionBackend {
 		private BareboneHostSessionProvider? provider;
 
-		private const uint16 DEFAULT_PORT = 3333;
-
 		public async void start (Cancellable? cancellable) throws IOError {
-			SocketConnectable? connectable = null;
-			unowned string? address = Environment.get_variable ("FRIDA_BAREBONE_ADDRESS");
-			if (address != null) {
-				try {
-					connectable = NetworkAddress.parse (address, DEFAULT_PORT);
-				} catch (GLib.Error e) {
-				}
-			}
-			if (connectable == null)
-				connectable = new InetSocketAddress (new InetAddress.loopback (SocketFamily.IPV4), DEFAULT_PORT);
-
-			uint64 heap_base_pa = 0;
-			unowned string? heap_base_preference = Environment.get_variable ("FRIDA_BAREBONE_HEAP_BASE");
-			if (heap_base_preference != null)
-				heap_base_pa = uint64.parse (heap_base_preference, 16);
-
-			provider = new BareboneHostSessionProvider (connectable, heap_base_pa);
+			provider = new BareboneHostSessionProvider ();
 			provider_available (provider);
 		}
 
@@ -49,22 +31,8 @@ namespace Frida {
 			}
 		}
 
-		public SocketConnectable connectable {
-			get;
-			construct;
-		}
-
-		public uint64 heap_base_pa {
-			get;
-			construct;
-		}
-
 		private BareboneHostSession? host_session;
 
-		public BareboneHostSessionProvider (SocketConnectable connectable, uint64 heap_base_pa) {
-			Object (connectable: connectable, heap_base_pa: heap_base_pa);
-		}
-
 		public async void close (Cancellable? cancellable) throws IOError {
 			if (host_session != null) {
 				yield host_session.close (cancellable);
@@ -72,10 +40,34 @@ namespace Frida {
 			}
 		}
 
-		public async HostSession create (HostSessionOptions? options, Cancellable? cancellable) throws Error, IOError {
+		public async HostSession create (HostSessionHub hub, HostSessionOptions? options, Cancellable? cancellable)
+				throws Error, IOError {
 			if (host_session != null)
 				throw new Error.INVALID_OPERATION ("Already created");
 
+			Barebone.Config config;
+			unowned string? config_path = Environment.get_variable ("FRIDA_BAREBONE_CONFIG");
+			if (config_path != null) {
+				try {
+					var config_data = yield FS.read_all_text (File.new_for_path (config_path), cancellable);
+					var cfg = (Barebone.Config) Json.gobject_from_data (typeof (Barebone.Config), config_data);
+					cfg.check ();
+					config = cfg;
+				} catch (GLib.Error e) {
+					throw new Error.INVALID_ARGUMENT ("Unable to load %s: %s", config_path, e.message);
+				}
+			} else {
+				config = new Barebone.Config ();
+			}
+
+			SocketConnectable connectable;
+			try {
+				Barebone.ConnectionConfig c = config.connection;
+				connectable = NetworkAddress.parse (c.host, c.port);
+			} catch (GLib.Error e) {
+				throw new Error.INVALID_ARGUMENT ("Unable to load %s: %s", config_path, e.message);
+			}
+
 			IOStream stream;
 			try {
 				var client = new SocketClient ();
@@ -109,16 +101,39 @@ namespace Frida {
 					break;
 			}
 
-			var page_size = yield machine.query_page_size (cancellable);
+			size_t page_size;
+			try {
+				page_size = yield machine.query_page_size (cancellable);
+			} catch (Error e) {
+				page_size = 0;
+			}
 
-			// TODO: Locate and use kernel's allocator when possible.
-			Barebone.Allocator allocator = new Barebone.SimpleAllocator (machine, page_size, heap_base_pa);
+			Barebone.Allocator allocator;
+			Barebone.AllocatorConfig? ac = config.allocator;
+			if (ac == null) {
+				allocator = new Barebone.NullAllocator (page_size);
+			} else if (ac is Barebone.PhysicalAllocatorConfig) {
+				allocator = new Barebone.PhysicalAllocator (machine, page_size,
+					(Barebone.PhysicalAllocatorConfig) ac);
+			} else if (ac is Barebone.TargetFunctionsAllocatorConfig) {
+				allocator = new Barebone.TargetFunctionsAllocator (machine, page_size,
+					(Barebone.TargetFunctionsAllocatorConfig) ac);
+			} else {
+				assert_not_reached ();
+			}
+
+			Barebone.AgentConnection? agent_connection = null;
+			Barebone.AgentConfig? agent_config = config.agent;
+			if (agent_config != null) {
+				agent_connection = yield Barebone.AgentConnection.open (agent_config, config.image, machine, allocator,
+					cancellable);
+			}
 
 			var interceptor = new Barebone.Interceptor (machine, allocator);
 
 			var services = new Barebone.Services (machine, allocator, interceptor);
 
-			host_session = new BareboneHostSession (services);
+			host_session = new BareboneHostSession (agent_connection, services);
 			host_session.agent_session_detached.connect (on_agent_session_detached);
 
 			return host_session;
@@ -170,6 +185,11 @@ namespace Frida {
 	}
 
 	public sealed class BareboneHostSession : Object, HostSession {
+		public Barebone.AgentConnection? connection {
+			get;
+			construct;
+		}
+
 		public Barebone.Services services {
 			get;
 			construct;
@@ -178,8 +198,8 @@ namespace Frida {
 		private Gee.Map<AgentSessionId?, BareboneAgentSession> agent_sessions =
 			new Gee.HashMap<AgentSessionId?, BareboneAgentSession> (AgentSessionId.hash, AgentSessionId.equal);
 
-		public BareboneHostSession (Barebone.Services services) {
-			Object (services: services);
+		public BareboneHostSession (Barebone.AgentConnection? connection, Barebone.Services services) {
+			Object (connection: connection, services: services);
 		}
 
 		public async void close (Cancellable? cancellable) throws IOError {
@@ -255,13 +275,17 @@ namespace Frida {
 
 			var opts = SessionOptions._deserialize (options);
 			if (opts.realm == EMULATED)
-				throw new Error.NOT_SUPPORTED ("Emulated realm is not supported on barebone targets");
+				throw new Error.NOT_SUPPORTED ("Emulated realm is not supported on Barebone targets");
 
 			var session_id = AgentSessionId.generate ();
 
 			MainContext dbus_context = yield get_dbus_context ();
 
-			var session = new BareboneAgentSession (session_id, opts.persist_timeout, dbus_context, services);
+			BareboneAgentSession session;
+			if (connection != null)
+				session = new RemoteBareboneAgentSession (connection, session_id, opts.persist_timeout, dbus_context);
+			else
+				session = new LocalBareboneAgentSession (services, session_id, opts.persist_timeout, dbus_context);
 			agent_sessions[session_id] = session;
 			session.closed.connect (on_agent_session_closed);
 
@@ -321,7 +345,158 @@ namespace Frida {
 		}
 	}
 
-	private sealed class BareboneAgentSession : Object, AgentSession {
+	private sealed class LocalBareboneAgentSession : BareboneAgentSession {
+		public Barebone.Services services {
+			get;
+			construct;
+		}
+
+		private Gee.Map<AgentScriptId?, BareboneScript> scripts =
+			new Gee.HashMap<AgentScriptId?, BareboneScript> (AgentScriptId.hash, AgentScriptId.equal);
+		private uint next_script_id = 1;
+
+		public LocalBareboneAgentSession (Barebone.Services services, AgentSessionId id, uint persist_timeout,
+				MainContext dbus_context) {
+			Object (
+				services: services,
+				id: id,
+				persist_timeout: persist_timeout,
+				frida_context: MainContext.ref_thread_default (),
+				dbus_context: dbus_context
+			);
+		}
+
+		public override async AgentScriptId create_script (string source, HashTable<string, Variant> options,
+				Cancellable? cancellable) throws Error, IOError {
+			check_open ();
+
+			var opts = ScriptOptions._deserialize (options);
+			if (opts.runtime == V8)
+				throw new Error.INVALID_ARGUMENT ("The V8 runtime is not supported by the Barebone backend");
+
+			var id = AgentScriptId (next_script_id++);
+
+			var script = BareboneScript.create (id, source, services);
+			scripts[id] = script;
+			script.message.connect (on_message_from_script);
+
+			return id;
+		}
+
+		public override async void destroy_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
+			check_open ();
+
+			BareboneScript script = get_script (script_id);
+			yield script.destroy (cancellable);
+			script.message.disconnect (on_message_from_script);
+
+			scripts.unset (script_id);
+		}
+
+		public override async void load_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
+			check_open ();
+			var script = get_script (script_id);
+			yield script.load (cancellable);
+		}
+
+		public override async void post_messages (AgentMessage[] messages, uint batch_id, Cancellable? cancellable)
+				throws Error, IOError {
+			transmitter.check_okay_to_receive ();
+
+			foreach (var m in messages) {
+				switch (m.kind) {
+					case SCRIPT: {
+						BareboneScript? script = scripts[m.script_id];
+						if (script != null)
+							script.post (m.text, m.has_data ? new Bytes (m.data) : null);
+						break;
+					}
+					case DEBUGGER:
+						break;
+				}
+			}
+
+			transmitter.notify_rx_batch_id (batch_id);
+		}
+
+		private void on_message_from_script (BareboneScript script, string json, Bytes? data) {
+			transmitter.post_message_from_script (script.id, json, data);
+		}
+
+		private BareboneScript get_script (AgentScriptId script_id) throws Error {
+			var script = scripts[script_id];
+			if (script == null)
+				throw new Error.INVALID_ARGUMENT ("Invalid script ID");
+			return script;
+		}
+	}
+
+	private sealed class RemoteBareboneAgentSession : BareboneAgentSession {
+		public Barebone.AgentConnection connection {
+			get;
+			construct;
+		}
+
+		public RemoteBareboneAgentSession (Barebone.AgentConnection connection, AgentSessionId id, uint persist_timeout,
+				MainContext dbus_context) {
+			Object (
+				connection: connection,
+				id: id,
+				persist_timeout: persist_timeout,
+				frida_context: MainContext.ref_thread_default (),
+				dbus_context: dbus_context
+			);
+		}
+
+		construct {
+			connection.script_message.connect (on_message_from_script);
+		}
+
+		public override async AgentScriptId create_script (string source, HashTable<string, Variant> options,
+				Cancellable? cancellable) throws Error, IOError {
+			check_open ();
+
+			var opts = ScriptOptions._deserialize (options);
+			if (opts.runtime == V8)
+				throw new Error.INVALID_ARGUMENT ("The V8 runtime is not supported by the Barebone backend");
+
+			return yield connection.create_script (source, cancellable);
+		}
+
+		public override async void destroy_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
+			check_open ();
+			yield connection.destroy_script (script_id, cancellable);
+		}
+
+		public override async void load_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
+			check_open ();
+			yield connection.load_script (script_id, cancellable);
+		}
+
+		public override async void post_messages (AgentMessage[] messages, uint batch_id, Cancellable? cancellable)
+				throws Error, IOError {
+			transmitter.check_okay_to_receive ();
+
+			foreach (var m in messages) {
+				switch (m.kind) {
+					case SCRIPT:
+						yield connection.post_script_message (m.script_id, m.text,
+							m.has_data ? new Bytes (m.data) : null, cancellable);
+						break;
+					case DEBUGGER:
+						break;
+				}
+			}
+
+			transmitter.notify_rx_batch_id (batch_id);
+		}
+
+		private void on_message_from_script (AgentScriptId id, string json, Bytes? data) {
+			transmitter.post_message_from_script (id, json, data);
+		}
+	}
+
+	private abstract class BareboneAgentSession : Object, AgentSession {
 		public signal void closed ();
 
 		public AgentSessionId id {
@@ -335,8 +510,12 @@ namespace Frida {
 		}
 
 		public AgentMessageSink? message_sink {
-			get { return transmitter.message_sink; }
-			set { transmitter.message_sink = value; }
+			get {
+				return transmitter.message_sink;
+			}
+			set {
+				transmitter.message_sink = value;
+			}
 		}
 
 		public MainContext frida_context {
@@ -349,34 +528,9 @@ namespace Frida {
 			construct;
 		}
 
-		public Barebone.Services services {
-			get;
-			construct;
-		}
-
-		public Barebone.Allocator allocator {
-			get;
-			construct;
-		}
-
 		private Promise<bool>? close_request;
 
-		private Gee.Map<AgentScriptId?, BareboneScript> scripts =
-			new Gee.HashMap<AgentScriptId?, BareboneScript> (AgentScriptId.hash, AgentScriptId.equal);
-		private uint next_script_id = 1;
-
-		private AgentMessageTransmitter transmitter;
-
-		public BareboneAgentSession (AgentSessionId id, uint persist_timeout, MainContext dbus_context,
-				Barebone.Services services) {
-			Object (
-				id: id,
-				persist_timeout: persist_timeout,
-				frida_context: MainContext.ref_thread_default (),
-				dbus_context: dbus_context,
-				services: services
-			);
-		}
+		protected AgentMessageTransmitter transmitter;
 
 		construct {
 			assert (frida_context != null);
@@ -421,22 +575,8 @@ namespace Frida {
 			throw_not_supported ();
 		}
 
-		public async AgentScriptId create_script (string source, HashTable<string, Variant> options,
-				Cancellable? cancellable) throws Error, IOError {
-			check_open ();
-
-			var opts = ScriptOptions._deserialize (options);
-			if (opts.runtime == V8)
-				throw new Error.INVALID_ARGUMENT ("The V8 runtime is not supported by the barebone backend");
-
-			var id = AgentScriptId (next_script_id++);
-
-			var script = BareboneScript.create (id, source, services);
-			scripts[id] = script;
-			script.message.connect (on_message_from_script);
-
-			return id;
-		}
+		public abstract async AgentScriptId create_script (string source, HashTable<string, Variant> options,
+				Cancellable? cancellable) throws Error, IOError;
 
 		public async AgentScriptId create_script_from_bytes (uint8[] bytes, HashTable<string, Variant> options,
 				Cancellable? cancellable) throws Error, IOError {
@@ -453,33 +593,14 @@ namespace Frida {
 			throw_not_supported ();
 		}
 
-		public async void destroy_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
-			check_open ();
+		public abstract async void destroy_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError;
 
-			BareboneScript script = get_script (script_id);
-			yield script.destroy (cancellable);
-			script.message.disconnect (on_message_from_script);
-
-			scripts.unset (script_id);
-		}
-
-		public async void load_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
-			check_open ();
-			var script = get_script (script_id);
-			yield script.load (cancellable);
-		}
+		public abstract async void load_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError;
 
 		public async void eternalize_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
 		}
 
-		private BareboneScript get_script (AgentScriptId script_id) throws Error {
-			var script = scripts[script_id];
-			if (script == null)
-				throw new Error.INVALID_ARGUMENT ("Invalid script ID");
-			return script;
-		}
-
 		public async void enable_debugger (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
 		}
@@ -488,25 +609,8 @@ namespace Frida {
 			throw_not_supported ();
 		}
 
-		public async void post_messages (AgentMessage[] messages, uint batch_id,
-				Cancellable? cancellable) throws Error, IOError {
-			transmitter.check_okay_to_receive ();
-
-			foreach (var m in messages) {
-				switch (m.kind) {
-					case SCRIPT: {
-						BareboneScript? script = scripts[m.script_id];
-						if (script != null)
-							script.post (m.text, m.has_data ? new Bytes (m.data) : null);
-						break;
-					}
-					case DEBUGGER:
-						break;
-				}
-			}
-
-			transmitter.notify_rx_batch_id (batch_id);
-		}
+		public abstract async void post_messages (AgentMessage[] messages, uint batch_id, Cancellable? cancellable)
+			throws Error, IOError;
 
 		public async PortalMembershipId join_portal (string address, HashTable<string, Variant> options,
 				Cancellable? cancellable) throws Error, IOError {
@@ -538,15 +642,11 @@ namespace Frida {
 			transmitter.commit_migration ();
 		}
 
-		private void check_open () throws Error {
+		protected void check_open () throws Error {
 			if (close_request != null)
 				throw new Error.INVALID_OPERATION ("Session is closing");
 		}
 
-		private void on_message_from_script (BareboneScript script, string json, Bytes? data) {
-			transmitter.post_message_from_script (script.id, json, data);
-		}
-
 		private void on_transmitter_closed () {
 			transmitter.closed.disconnect (on_transmitter_closed);
 			transmitter.new_candidates.disconnect (on_transmitter_new_candidates);

src/barebone/c-module.vala

@@ -0,0 +1,66 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	private sealed class CModule : Object {
+		public signal void console_output (string message);
+
+		public Gee.List<Export> exports {
+			get;
+			default = new Gee.ArrayList<Export> ();
+		}
+
+		public class Export {
+			public string name;
+			public uint64 address;
+
+			internal Export (string name, uint64 address) {
+				this.name = name;
+				this.address = address;
+			}
+		}
+
+		private Gum.ElfModule elf;
+		private Allocation allocation;
+		private Callback console_log_callback;
+
+		public async CModule.from_blob (Bytes blob, Machine machine, Allocator allocator, Cancellable? cancellable)
+				throws Error, IOError {
+			try {
+				elf = new Gum.ElfModule.from_blob (blob);
+			} catch (Gum.Error e) {
+				throw new Error.NOT_SUPPORTED ("%s", e.message);
+			}
+
+			var raw_elf = new Bytes.static (elf.get_file_data ());
+
+			size_t page_size = yield machine.query_page_size (cancellable);
+
+			allocation = yield inject_elf (elf, raw_elf, page_size, machine, allocator, cancellable);
+
+			uint64 base_va = allocation.virtual_address;
+			uint64 console_log_trap = 0;
+			elf.enumerate_symbols (e => {
+				if (e.name == "")
+					return true;
+
+				if (e.name == "_console_log") {
+					console_log_trap = base_va + e.address;
+					return true;
+				}
+
+				exports.add (new Export (e.name, base_va + e.address));
+
+				return true;
+			});
+
+			if (console_log_trap != 0) {
+				var handler = new ConsoleLogHandler (machine.gdb);
+				handler.output.connect (on_console_output);
+				console_log_callback = yield new Callback (console_log_trap, handler, machine, cancellable);
+			}
+		}
+
+		private void on_console_output (string message) {
+			console_output (message);
+		}
+	}
+}

src/barebone/config.vala

@@ -0,0 +1,395 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	/**
+	 * Barebone backend configuration. This is specified via the FRIDA_BAREBONE_CONFIG environment
+	 * variable, which should point to the filesystem path of a JSON-encoded configuration file.
+	 *
+	 * Example JSON configurations:
+	 *
+	 * 1. Using all defaults:
+	 * {
+	 *   "connection": {
+	 *     "host": "127.0.0.1",
+	 *     "port": 3333
+	 *   }
+	 * }
+	 *
+	 * 2. Using a physical memory allocator:
+	 *  {
+	 *    "connection": {
+	 *      "host": "127.0.0.1",
+	 *      "port": 9000
+	 *    },
+	 *    "allocator": {
+	 *      "mode": "physical",
+	 *      "physical_base": "0x8ec9b4000"
+	 *    }
+	 *  }
+	 *
+	 * 3. Using target-specific allocation functions:
+	 *  {
+	 *    "connection": {
+	 *      "host": "127.0.0.1",
+	 *      "port": 9000
+	 *    },
+	 *    "allocator": {
+	 *      "mode": "target-functions",
+	 *      "alloc_function": "0xfffffff007a3c278",
+	 *      "free_function": "0xfffffff007a3c338"
+	 *    }
+	 *  }
+	 *
+	 * 4. Injecting a remote agent:
+	 *  {
+	 *    "agent": {
+	 *      "path": "/path/to/target/aarch64-unknown-none/release/frida-barebone-agent",
+	 *      "transport": {
+	 *        "type": "hostlink",
+	 *        "qmp": "unix:/path/to/qmp.sock"
+	 *      }
+	 *    },
+	 *    "image": {
+	 *      "file": "/path/to/kernelcache.research.iphone12b",
+	 *      "base": "0xfffffff007004000"
+	 *    }
+	 *  }
+	 */
+	public sealed class Config : Object, Json.Serializable {
+		public ConnectionConfig connection {
+			get;
+			set;
+			default = new ConnectionConfig ();
+		}
+
+		public AllocatorConfig? allocator {
+			get;
+			set;
+		}
+
+		public AgentConfig? agent {
+			get;
+			set;
+		}
+
+		public ImageConfig? image {
+			get;
+			set;
+		}
+
+		public void check () throws Error {
+			if (allocator != null)
+				allocator.check ();
+			if (agent != null)
+				agent.check ();
+			if (image != null)
+				image.check ();
+		}
+
+		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
+			if (property_name == "allocator") {
+				AllocatorConfig? allocator = null;
+				Type t = typeof (InvalidAllocatorConfig);
+				if (property_node.get_node_type () == Json.NodeType.OBJECT) {
+					switch (property_node.get_object ().get_string_member_with_default ("mode", "invalid")) {
+					case "physical":
+						t = typeof (PhysicalAllocatorConfig);
+						break;
+					case "target-functions":
+						t = typeof (TargetFunctionsAllocatorConfig);
+						break;
+					default:
+						break;
+					}
+					allocator = (AllocatorConfig) Json.gobject_deserialize (t, property_node);
+				} else {
+					allocator = new InvalidAllocatorConfig ();
+				}
+
+				var v = Value (t);
+				v.set_object (allocator);
+				value = v;
+				return true;
+			}
+
+			value = Value (pspec.value_type);
+			return false;
+		}
+	}
+
+	public sealed class ConnectionConfig : Object {
+		public string host {
+			get;
+			set;
+			default = "127.0.0.1";
+		}
+
+		public uint16 port {
+			get;
+			set;
+			default = 3333;
+		}
+	}
+
+	public abstract class AllocatorConfig : Object {
+		public abstract void check () throws Error;
+	}
+
+	public sealed class InvalidAllocatorConfig : AllocatorConfig {
+		public override void check () throws Error {
+			throw new Error.NOT_SUPPORTED ("Config for 'allocator' is invalid");
+		}
+	}
+
+	public sealed class PhysicalAllocatorConfig : AllocatorConfig, Json.Serializable {
+		public MemoryAddress physical_base {
+			get;
+			set;
+		}
+
+		public override void check () throws Error {
+			if (physical_base == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'allocator.physical_base' is missing");
+			physical_base.check ();
+		}
+
+		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
+			if (property_name == "physical_base") {
+				value = deserialize_address ("allocator.physical_base", property_node);
+				return true;
+			}
+
+			value = Value (pspec.value_type);
+			return false;
+		}
+	}
+
+	public sealed class TargetFunctionsAllocatorConfig : AllocatorConfig, Json.Serializable {
+		public MemoryAddress alloc_function {
+			get;
+			set;
+		}
+
+		public MemoryAddress free_function {
+			get;
+			set;
+		}
+
+		public override void check () throws Error {
+			if (alloc_function == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'allocator.alloc_function' is missing");
+			alloc_function.check ();
+
+			if (free_function == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'allocator.free_function' is missing");
+			free_function.check ();
+		}
+
+		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
+			if (property_name == "alloc-function") {
+				value = deserialize_address ("allocator.alloc_function", property_node);
+				return true;
+			}
+
+			if (property_name == "free-function") {
+				value = deserialize_address ("allocator.free_function", property_node);
+				return true;
+			}
+
+			value = Value (pspec.value_type);
+			return false;
+		}
+	}
+
+	public sealed class AgentConfig : Object, Json.Serializable {
+		public string path {
+			get;
+			set;
+		}
+
+		public TransportConfig transport {
+			get;
+			set;
+		}
+
+		public void check () throws Error {
+			if (path == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'agent.path' is missing");
+
+			if (transport == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'agent.transport' is missing");
+			transport.check ();
+		}
+
+		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
+			if (property_name == "transport") {
+				TransportConfig transport;
+				Type t = typeof (InvalidTransportConfig);
+				if (property_node.get_node_type () == Json.NodeType.OBJECT) {
+					switch (property_node.get_object ().get_string_member_with_default ("type", "invalid")) {
+					case "hostlink":
+						t = typeof (HostlinkTransportConfig);
+						break;
+					default:
+						break;
+					}
+					transport = (TransportConfig) Json.gobject_deserialize (t, property_node);
+				} else {
+					transport = new InvalidTransportConfig ();
+				}
+
+				var v = Value (t);
+				v.set_object (transport);
+				value = v;
+				return true;
+			}
+
+			value = Value (pspec.value_type);
+			return false;
+		}
+	}
+
+	public abstract class TransportConfig : Object {
+		public abstract void check () throws Error;
+	}
+
+	public sealed class InvalidTransportConfig : TransportConfig {
+		public override void check () throws Error {
+			throw new Error.NOT_SUPPORTED ("Config for 'agent.transport' is invalid");
+		}
+	}
+
+	public sealed class HostlinkTransportConfig : TransportConfig {
+		public string qmp {
+			get;
+			set;
+		}
+
+		public override void check () throws Error {
+			if (qmp == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'agent.transport.qmp' is missing");
+			if (!qmp.has_prefix ("unix:"))
+				throw new Error.NOT_SUPPORTED ("Config for 'agent.transport.qmp' must be a UNIX socket for now");
+		}
+	}
+
+	public sealed class ImageConfig : Object, Json.Serializable {
+		public string file {
+			get;
+			set;
+		}
+
+		public MemoryAddress base {
+			get;
+			set;
+		}
+
+		public Gee.Map<string, uint64?> symbols {
+			get;
+			set;
+			default = new Gee.HashMap<string, uint64?> ();
+		}
+
+		public void check () throws Error {
+			if (file == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'image.file' is missing");
+
+			if (@base == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'image.base' is missing");
+			@base.check ();
+
+			if (symbols == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'image.symbols' is invalid");
+		}
+
+		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
+			if (property_name == "base") {
+				value = deserialize_address ("image.base", property_node);
+				return true;
+			}
+
+			if (property_name == "symbols") {
+				Gee.Map<string, uint64?> syms = null;
+
+				if (property_node.get_node_type () == Json.NodeType.OBJECT) {
+					syms = new Gee.HashMap<string, uint64?> ();
+
+					property_node.get_object ().foreach_member ((obj, name, node) => {
+						if (syms == null)
+							return;
+
+						uint64 addr;
+						if (!try_deserialize_address (node, out addr)) {
+							syms = null;
+							return;
+						}
+
+						syms[name] = addr;
+					});
+				}
+
+				value = syms;
+				return true;
+			}
+
+			value = Value (pspec.value_type);
+			return false;
+		}
+	}
+
+	public abstract class MemoryAddress : Object {
+		public string label {
+			get;
+			construct;
+		}
+
+		public uint64 address {
+			get;
+			construct;
+		}
+
+		public abstract void check () throws Error;
+	}
+
+	public sealed class InvalidMemoryAddress : MemoryAddress {
+		public InvalidMemoryAddress (string label) {
+			Object (label: label);
+		}
+
+		public override void check () throws Error {
+			throw new Error.NOT_SUPPORTED ("Config for '%s' is invalid", label);
+		}
+	}
+
+	public sealed class NonNullMemoryAddress : MemoryAddress {
+		public NonNullMemoryAddress (string label, uint64 address) {
+			Object (label: label, address: address);
+		}
+
+		public override void check () throws Error {
+			if (address == 0)
+				throw new Error.NOT_SUPPORTED ("Config for '%s' cannot be NULL", label);
+		}
+	}
+
+	private MemoryAddress deserialize_address (string label, Json.Node node) {
+		uint64 addr;
+		if (!try_deserialize_address (node, out addr))
+			return new InvalidMemoryAddress (label);
+		return new NonNullMemoryAddress (label, addr);
+	}
+
+	private bool try_deserialize_address (Json.Node node, out uint64 address) {
+		Type t = node.get_value_type ();
+
+		if (t == typeof (string))
+			return uint64.try_parse (node.get_string (), out address, null, 16);
+
+		if (t == typeof (int64)) {
+			address = node.get_int ();
+			return true;
+		}
+
+		address = 0;
+		return false;
+	}
+}

src/barebone/console.vala

@@ -0,0 +1,31 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	private class ConsoleLogHandler : Object, CallbackHandler {
+		public signal void output (string message);
+
+		public uint arity {
+			get { return 2; }
+		}
+
+		private GDB.Client gdb;
+
+		public ConsoleLogHandler (GDB.Client gdb) {
+			this.gdb = gdb;
+		}
+
+		public async uint64 handle_invocation (uint64[] args, CallFrame frame, Cancellable? cancellable)
+				throws Error, IOError {
+			var message = args[0];
+			var len = (long) args[1];
+
+			Bytes str_bytes = yield gdb.read_byte_array (message, len, cancellable);
+			unowned uint8[] str_data = str_bytes.get_data ();
+			unowned string str_raw = (string) str_data;
+			string str = str_raw.substring (0, len);
+
+			output (str);
+
+			return 0;
+		}
+	}
+}

src/barebone/elf.vala

@@ -0,0 +1,39 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	public async Allocation inject_elf (Gum.ElfModule elf, Bytes raw_elf, size_t page_size, Machine machine, Allocator allocator,
+			Cancellable? cancellable) throws Error, IOError {
+		size_t vm_size = (size_t) elf.mapped_size;
+
+		uint num_pages = (uint) (vm_size / page_size);
+		if (vm_size % page_size != 0)
+			num_pages++;
+
+		uint64 text_base = 0;
+		size_t text_size = 0;
+		elf.enumerate_segments (s => {
+			if ((s.protection & Gum.PageProtection.EXECUTE) != 0) {
+				text_base = s.vm_address;
+				text_size = (size_t) s.vm_size;
+				return false;
+			}
+			return true;
+		});
+		if (text_size == 0)
+			throw new Error.NOT_SUPPORTED ("Unable to detect text segment");
+
+		var allocation = yield allocator.allocate (num_pages * page_size, page_size, cancellable);
+		try {
+			uint64 base_va = allocation.virtual_address;
+
+			Bytes relocated_image = machine.relocate (elf, raw_elf, base_va);
+			yield machine.gdb.write_byte_array (base_va, relocated_image, cancellable);
+
+			yield machine.protect_pages (base_va + text_base, text_size, READ | EXECUTE, cancellable);
+		} catch (GLib.Error e) {
+			yield allocation.deallocate (cancellable);
+			throw_api_error (e);
+		}
+
+		return allocation;
+	}
+}

src/barebone/img4.vala

@@ -0,0 +1,105 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone.Img4 {
+	public async Payload parse_file (File f, Cancellable? cancellable) throws Error, IOError {
+		Bytes blob = yield FS.read_all_bytes (f, cancellable);
+		return parse (blob);
+	}
+
+	public Payload parse (Bytes blob) throws Error {
+		BufferReader r = new BufferReader (new Buffer (blob, BIG_ENDIAN));
+
+		if (r.read_uint8 () != Der.SEQUENCE)
+			throw new Error.PROTOCOL ("IMG4/IM4P must start with DER SEQUENCE");
+		size_t seq_len = Der.read_length (r);
+		size_t seq_end = r.offset + seq_len;
+
+		string first_magic = Der.read_string (r);
+
+		if (first_magic == "IMG4") {
+			if (r.read_uint8 () != Der.SEQUENCE)
+				throw new Error.PROTOCOL ("Expected SEQUENCE for IM4P");
+			size_t im4p_len = Der.read_length (r);
+			seq_end = r.offset + im4p_len;
+			if (Der.read_string (r) != "IM4P")
+				throw new Error.PROTOCOL ("Missing IM4P magic");
+		} else if (first_magic != "IM4P") {
+			throw new Error.PROTOCOL ("Not an IMG4/IM4P container (magic='%s')", first_magic);
+		}
+
+		string kind = Der.read_string (r);
+		string description = Der.read_string (r);
+		Bytes payload_raw = Der.read_octet_string (r);
+		Bytes final_data = maybe_decompress_lzfse (payload_raw);
+
+		return new Payload (kind, description, final_data);
+	}
+
+	public class Payload : Object {
+		public string kind {
+			get;
+			construct;
+		}
+
+		public string description {
+			get;
+			construct;
+		}
+
+		public Bytes data {
+			get;
+			construct;
+		}
+
+		public Payload (string kind, string description, Bytes data) {
+			Object (
+				kind: kind,
+				description: description,
+				data: data
+			);
+		}
+	}
+
+	namespace Der {
+		private const uint8 OCTET_STRING	= 0x04;
+		private const uint8 UTF8_STRING		= 0x0C;
+		private const uint8 IA5_STRING		= 0x16;
+		private const uint8 SEQUENCE		= 0x30;
+
+		private size_t read_length (BufferReader r) throws Error {
+			uint8 b = r.read_uint8 ();
+			if ((b & 0x80) == 0)
+				return b;
+
+			uint8 nlen = (uint8) (b & 0x7f);
+			if (nlen == 0)
+				throw new Error.NOT_SUPPORTED ("Indefinite length not supported in IMG4");
+
+			size_t len = 0;
+			for (uint8 i = 0; i != nlen; i++)
+				len = (len << 8) | r.read_uint8 ();
+			return len;
+		}
+
+		private Bytes read_octet_string (BufferReader r) throws Error {
+			uint8 tag = r.read_uint8 ();
+			if (tag != Der.OCTET_STRING)
+				throw new Error.PROTOCOL ("Expected OCTET STRING, got tag 0x%02x".printf (tag));
+			size_t len = read_length (r);
+			return r.read_bytes (len);
+		}
+
+		private string read_string (BufferReader r) throws Error {
+			uint8 tag = r.read_uint8 ();
+			if (tag != Der.IA5_STRING && tag != Der.UTF8_STRING)
+				throw new Error.PROTOCOL ("Unexpected string tag 0x%02x", tag);
+			size_t len = read_length (r);
+			return r.read_fixed_string (len);
+		}
+	}
+
+	private Bytes maybe_decompress_lzfse (Bytes src) throws Error {
+		if (LZFSE.is_lzfse (src))
+			return LZFSE.decode (src);
+		return src;
+	}
+}

src/barebone/layout.vala

@@ -0,0 +1,188 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	public sealed class Layout : Object {
+		public Gee.List<ModuleInfo> modules {
+			get;
+			construct;
+		}
+
+		public Gee.List<SymbolInfo> symbols {
+			get;
+			construct;
+		}
+
+		private const uint64 CHAINED_PTR_TARGET_MASK = (1 << 30) - 1;
+
+		private Layout (Gee.List<ModuleInfo> modules, Gee.List<SymbolInfo> symbols) {
+			Object (modules: modules, symbols: symbols);
+		}
+
+		public Layout.empty () {
+			Object (modules: new Gee.ArrayList<ModuleInfo> (), symbols: new Gee.ArrayList<SymbolInfo> ());
+		}
+
+		public static async Layout load_from_symbol_source (File symbol_source, uint64 kernel_base, ByteOrder byte_order,
+				uint pointer_size, Cancellable? cancellable) throws Error, IOError {
+			var payload = yield Img4.parse_file (symbol_source, cancellable);
+
+			Bytes kerncache = payload.data;
+
+			Gum.DarwinModule mod;
+			try {
+				mod = new Gum.DarwinModule.from_blob (kerncache, ARM64, Gum.PtrauthSupport.SUPPORTED);
+			} catch (Gum.Error e) {
+				throw new Error.NOT_SUPPORTED ("%s", e.message);
+			}
+
+			var blob = new Blob (kerncache, byte_order, pointer_size);
+
+			var modules = compute_module_list (mod, blob, kernel_base);
+			var symbols = compute_symbol_list (mod);
+
+			return new Layout (modules, symbols);
+		}
+
+		private static Gee.List<ModuleInfo> compute_module_list (Gum.DarwinModule mod, Blob blob, uint64 kernel_base) throws Error {
+			Buffer? kmod_info = null;
+			Buffer? kmod_start = null;
+			Error? pending_error = null;
+			mod.enumerate_sections (s => {
+				if (s.segment_name == "__PRELINK_INFO") {
+					try {
+						if (s.section_name == "__kmod_info")
+							kmod_info = blob.slice (s.file_offset, (size_t) s.size, "__kmod_info");
+						else if (s.section_name == "__kmod_start")
+							kmod_start = blob.slice (s.file_offset, (size_t) s.size, "__kmod_start");
+					} catch (Error e) {
+						pending_error = e;
+						return false;
+					}
+				}
+				return true;
+			});
+			if (pending_error != null)
+				throw pending_error;
+			if (kmod_info == null)
+				throw new Error.NOT_SUPPORTED ("Unable to find __kmod_info");
+			if (kmod_start == null)
+				throw new Error.NOT_SUPPORTED ("Unable to find __kmod_start");
+
+			var kexts = new Gee.ArrayList<ModuleInfo> ();
+			var info_pointers = new BufferReader (kmod_info);
+			while (info_pointers.available != 0) {
+				var kmodinfo_start = chained_pointer_to_vm_offset (info_pointers.read_pointer (), kernel_base);
+				var kmodinfo = new BufferReader (blob.slice (kmodinfo_start, 196, "__kmod_info entry"));
+
+				kmodinfo.skip (blob.pointer_size + 4 + 4);
+
+				string name = kmodinfo.read_fixed_string (64);
+				string version = kmodinfo.read_fixed_string (64);
+
+				kmodinfo.skip (4 + (2 * blob.pointer_size) + 8 + 8);
+
+				size_t start = chained_pointer_to_vm_offset (kmodinfo.read_pointer (), kernel_base);
+				size_t stop = chained_pointer_to_vm_offset (kmodinfo.read_pointer (), kernel_base);
+
+				kexts.add (new ModuleInfo () {
+					name = name,
+					version = version,
+					start_func_offset = (uint32) start,
+					stop_func_offset = (uint32) stop,
+				});
+			}
+
+			var start_offsets = new Gee.ArrayList<uint> ();
+			var start_pointers = new BufferReader (kmod_start);
+			while (start_pointers.available != 0)
+				start_offsets.add ((uint) chained_pointer_to_vm_offset (start_pointers.read_pointer (), kernel_base));
+			if (start_offsets.size != kexts.size + 1)
+				throw new Error.PROTOCOL ("Unexpected __kmod_start length");
+
+			var n = kexts.size;
+			for (var i = 0; i != n; i++) {
+				var kext = kexts[i];
+				kext.offset = start_offsets[i];
+				kext.size = start_offsets[i + 1] - kext.offset;
+			}
+
+			var result = new Gee.ArrayList<ModuleInfo> ();
+
+			result.add (new ModuleInfo () {
+				name = "mach_kernel",
+				version = mod.source_version,
+				offset = 0,
+				size = kexts[0].offset,
+			});
+			result.add_all (kexts);
+
+			return result;
+		}
+
+		private static size_t chained_pointer_to_vm_offset (uint64 val, uint64 kernel_base) {
+			var target = (size_t) (val & CHAINED_PTR_TARGET_MASK);
+
+			bool is_auth = (val >> 63) != 0;
+			if (is_auth)
+				return target;
+
+			return target - (size_t) (kernel_base & CHAINED_PTR_TARGET_MASK);
+		}
+
+		private static Gee.List<SymbolInfo> compute_symbol_list (Gum.DarwinModule mod) {
+			var symbols = new Gee.ArrayList<SymbolInfo> ();
+			mod.enumerate_symbols (s => {
+				symbols.add (new SymbolInfo () {
+					name = (s.name[0] == '_') ? s.name[1:] : s.name,
+					offset = (uint32) s.address,
+					symbol_type = s.type,
+					section = s.section,
+					description = s.description
+				});
+				return true;
+			});
+			return symbols;
+		}
+	}
+
+	public class ModuleInfo {
+		public string name;
+		public string version;
+		public uint32 offset;
+		public uint32 size;
+		public uint32 start_func_offset;
+		public uint32 stop_func_offset;
+	}
+
+	public class SymbolInfo {
+		public string name;
+		public uint32 offset;
+		public uint8 symbol_type;
+		public uint8 section;
+		public uint16 description;
+	}
+
+	private class Blob {
+		private Bytes bytes;
+		private size_t size;
+		public ByteOrder byte_order;
+		public uint pointer_size;
+
+		public Blob (Bytes b, ByteOrder o, uint ptr_size) {
+			bytes = b;
+			size = b.get_size ();
+			byte_order = o;
+			pointer_size = ptr_size;
+		}
+
+		public Buffer slice (size_t offset, size_t n, string label) throws Error {
+			if (offset >= size)
+				throw new Error.PROTOCOL ("Offset out of bounds while parsing %s", label);
+
+			size_t end = offset + n;
+			if (end > size)
+				throw new Error.PROTOCOL ("Size out of bounds while parsing %s", label);
+
+			return new Buffer (bytes[offset:end], byte_order, pointer_size);
+		}
+	}
+}

src/barebone/lzfse.vala

@@ -0,0 +1,23 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone.LZFSE {
+	public bool is_lzfse (Bytes buf) {
+		if (buf.get_size () < 4)
+			return false;
+		unowned uint8[] d = buf.get_data ();
+		return d[0] == 'b' && d[1] == 'v' && d[2] == 'x';
+	}
+
+	public Bytes decode (Bytes compressed) throws Error {
+		size_t est_max = compressed.get_size () * 15;
+		uint8[] dst_buf = new uint8[est_max];
+
+		size_t written = decode_buffer (dst_buf, compressed.get_data ());
+		if (written == 0)
+			throw new Error.PROTOCOL ("liblzfse returned 0 bytes");
+
+		return new Bytes (dst_buf[:written]);
+	}
+
+	[CCode (cheader_filename = "lzfse.h", cname = "lzfse_decode_buffer")]
+	private extern size_t decode_buffer ([CCode (array_length_type = "size_t")] uint8[] dst, [CCode (array_length_type = "size_t")] uint8[] src, void * scratch = null);
+}

src/barebone/machine.vala

@@ -16,19 +16,45 @@ namespace Frida.Barebone {
 
 		public abstract async size_t query_page_size (Cancellable? cancellable) throws Error, IOError;
 
+		public abstract async uint query_exception_level (Cancellable? cancellable) throws Error, IOError;
+
+		public async void enter_exception_level (uint level, uint timeout, Cancellable? cancellable) throws Error, IOError {
+			var timer = new Timer ();
+
+			do {
+				var el = yield query_exception_level (cancellable);
+				if (el == level)
+					return;
+
+				yield gdb.continue (cancellable);
+
+				var source = new TimeoutSource (10);
+				source.set_callback (enter_exception_level.callback);
+				source.attach (MainContext.get_thread_default ());
+				yield;
+
+				yield gdb.stop (cancellable);
+			} while ((uint) (timer.elapsed () * 1000.0) < timeout);
+
+			throw new Error.TIMED_OUT ("Timed out while trying to get target to exception level %u", level);
+		}
+
 		public abstract async void enumerate_ranges (Gum.PageProtection prot, FoundRangeFunc func, Cancellable? cancellable)
 			throws Error, IOError;
 
-		public abstract async Allocation allocate_pages (uint64 physical_address, uint num_pages, Cancellable? cancellable)
+		public abstract async Allocation allocate_pages (Gee.List<uint64?> physical_addresses, Cancellable? cancellable)
 			throws Error, IOError;
 
+		public abstract async void protect_pages (uint64 virtual_address, size_t size, Gum.PageProtection prot,
+			Cancellable? cancellable) throws Error, IOError;
+
 		public abstract async Gee.List<uint64?> scan_ranges (Gee.List<Gum.MemoryRange?> ranges, MatchPattern pattern,
 			uint max_matches, Cancellable? cancellable) throws Error, IOError;
 
-		public Bytes relocate (Gum.ElfModule module, uint64 base_va) throws Error {
+		public Bytes relocate (Gum.ElfModule elf, Bytes raw_elf, uint64 base_va) throws Error {
 			uint64 file_start = uint64.MAX;
 			uint64 file_end = 0;
-			module.enumerate_segments (s => {
+			elf.enumerate_segments (s => {
 				if (s.file_size != 0) {
 					file_start = uint64.min (s.file_offset, file_start);
 					file_end = uint64.max (s.file_offset + s.file_size, file_end);
@@ -36,9 +62,9 @@ namespace Frida.Barebone {
 				return true;
 			});
 
-			var relocated_buf = gdb.make_buffer (new Bytes (module.get_file_data ()[file_start:file_end]));
+			var relocated_buf = gdb.make_buffer (new Bytes (raw_elf[(size_t) file_start:(size_t) file_end].get_data ()));
 			Error? pending_error = null;
-			module.enumerate_relocations (r => {
+			elf.enumerate_relocations (r => {
 				unowned string parent_section = (r.parent != null) ? r.parent.name : "";
 				if (parent_section == ".rela.text" || parent_section.has_prefix (".rela.debug_"))
 					return true;
@@ -58,15 +84,14 @@ namespace Frida.Barebone {
 			Bytes relocated_bytes = relocated_buf.bytes;
 			Bytes relocated_image = gdb.make_buffer_builder ()
 				.append_bytes (relocated_bytes)
-				.skip ((size_t) (module.mapped_size - relocated_bytes.get_size ()))
+				.skip ((size_t) (elf.mapped_size - relocated_bytes.get_size ()))
 				.build ();
 			return relocated_image;
 		}
 
 		public abstract void apply_relocation (Gum.ElfRelocationDetails r, uint64 base_va, Buffer relocated) throws Error;
 
-		public abstract async uint64 invoke (uint64 impl, uint64[] args, uint64 landing_zone, Cancellable? cancellable)
-			throws Error, IOError;
+		public abstract async uint64 invoke (uint64 impl, uint64[] args, Cancellable? cancellable) throws Error, IOError;
 
 		public abstract async CallFrame load_call_frame (GDB.Thread thread, uint arity, Cancellable? cancellable)
 			throws Error, IOError;

src/barebone/meson.build

@@ -1,12 +1,21 @@
 backend_sources += files(
   'barebone-host-session.vala',
+  'config.vala',
+  'agent-connection.vala',
   'script.vala',
   'machine.vala',
   'allocator.vala',
   'callback.vala',
   'memory-scanner.vala',
   'interceptor.vala',
+  'c-module.vala',
   'rust-module.vala',
+  'console.vala',
+  'layout.vala',
+  'elf.vala',
+  'img4.vala',
+  'lzfse.vala',
+  'qmp-client.vala',
   'arch-x86' / 'machine.vala',
   'arch-x86_64' / 'machine.vala',
   'arch-arm' / 'machine.vala',
@@ -59,4 +68,3 @@ backend_sources += custom_target('frida-data-barebone',
 
 backend_vala_args += gum_vala_args
 backend_vala_args_private += '--pkg=quickjs'
-backend_deps += quickjs_dep

src/barebone/package-lock.json

@@ -8,7 +8,7 @@
       "name": "frida-barebone-script-runtime",
       "version": "1.0.0",
       "devDependencies": {
-        "@types/frida-gum": "^19.0.0",
+        "@types/frida-gum": "^19.0.1",
         "esbuild": "^0.25.5",
         "typescript": "^5.8.3"
       }
@@ -439,9 +439,9 @@
       }
     },
     "node_modules/@types/frida-gum": {
-      "version": "19.0.0",
-      "resolved": "https://registry.npmjs.org/@types/frida-gum/-/frida-gum-19.0.0.tgz",
-      "integrity": "sha512-qViK1KwvPEAkajwSUv0wpZvZLiX8xO4JFFCh8dfYZfzSyOEfoE0KliCP/nJSKIKG6N3hXnPowrvPufjs5fLKAA==",
+      "version": "19.0.1",
+      "resolved": "https://registry.npmjs.org/@types/frida-gum/-/frida-gum-19.0.1.tgz",
+      "integrity": "sha512-mp8BpWWkQFJH86ZN5uXZuDiA7KY/+jDknrw0a06x0/+F5ucPwctHrCuV6iT+LLCp/GyICc36ssedF33B1WoLsw==",
       "dev": true,
       "license": "MIT"
     },

src/barebone/package.json

@@ -9,7 +9,7 @@
     "watch": "tsc -w"
   },
   "devDependencies": {
-    "@types/frida-gum": "^19.0.0",
+    "@types/frida-gum": "^19.0.1",
     "esbuild": "^0.25.5",
     "typescript": "^5.8.3"
   }

src/barebone/qmp-client.vala

@@ -0,0 +1,461 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	public sealed class QmpClient : Object, AsyncInitable {
+		public signal void event (string name, Json.Node? data);
+
+		public string address {
+			get;
+			construct;
+		}
+
+		public uint16 port {
+			get;
+			construct;
+		}
+
+		private SocketConnection connection;
+		private DataInputStream input;
+		private OutputStream output;
+
+		private bool is_connected = false;
+		private Promise<bool> close_request = new Promise<bool> ();
+
+		private Gee.Map<uint, Promise<Json.Node>> pending_requests = new Gee.HashMap<uint, Promise<Json.Node>> ();
+		private uint next_request_id = 1;
+
+		private Cancellable io_cancellable = new Cancellable ();
+
+		private const int REQUEST_TIMEOUT_MS = 30000;
+
+		public QmpClient (string? address = null, uint16 port = 0) {
+			Object (
+				address: address ?? "localhost",
+				port: port != 0 ? port : 4444
+			);
+		}
+
+		public static async QmpClient open (string? address = null, uint16 port = 0, Cancellable? cancellable = null)
+				throws Error, IOError {
+			var client = new QmpClient (address, port);
+
+			try {
+				yield client.init_async (Priority.DEFAULT, cancellable);
+			} catch (GLib.Error e) {
+				throw_api_error (e);
+			}
+
+			return client;
+		}
+
+		private async bool init_async (int io_priority, Cancellable? cancellable) throws Error, IOError {
+			var connectable = parse_socket_address (address, port, "localhost", 4444);
+
+			try {
+				var client = new SocketClient ();
+				connection = yield client.connect_async (connectable, cancellable);
+			} catch (GLib.Error e) {
+				throw new Error.TRANSPORT ("Unable to connect to QMP server: %s", e.message);
+			}
+
+			var socket = connection.socket;
+			if (socket.get_family () != UNIX)
+				Tcp.enable_nodelay (socket);
+
+			input = new DataInputStream (connection.get_input_stream ());
+			input.set_newline_type (DataStreamNewlineType.LF);
+			output = connection.get_output_stream ();
+
+			bool started_message_processing = false;
+			try {
+				is_connected = true;
+
+				string? greeting_line = yield input.read_line_async (Priority.DEFAULT, cancellable);
+				if (greeting_line == null)
+					throw new Error.TRANSPORT ("Connection closed during QMP greeting");
+
+				process_incoming_messages.begin ();
+				started_message_processing = true;
+
+				yield execute_command ("qmp_capabilities", null, cancellable);
+
+				return true;
+			} catch (GLib.Error e) {
+				is_connected = false;
+				if (!started_message_processing)
+					close_request.resolve (true);
+
+				if (e is Error)
+					throw_api_error (e);
+				else
+					throw new Error.TRANSPORT ("%s", e.message);
+			}
+		}
+
+		public async void close (Cancellable? cancellable = null) throws IOError {
+			io_cancellable.cancel ();
+
+			try {
+				yield close_request.future.wait_async (cancellable);
+			} catch (Error e) {
+				assert_not_reached ();
+			}
+		}
+
+		public async Hostlink open_hostlink (Cancellable? cancellable = null) throws Error, IOError {
+#if WINDOWS
+			throw new Error.NOT_SUPPORTED ("Missing open_hostlink() for Windows");
+#else
+			uint64 mmio = (uint64) yield get_qom_property_int ("/machine", "hostlink-mmio", cancellable);
+			uint irq = (uint) yield get_qom_property_int ("/machine", "hostlink-irq", cancellable);
+			string bus = yield get_qom_property_string ("/machine", "hostlink-bus", cancellable);
+
+			int fds[2];
+			if (Posix.socketpair (Posix.AF_UNIX, Posix.SOCK_STREAM, 0, fds) != 0)
+				throw new Error.NOT_SUPPORTED ("Unable to allocate socketpair");
+
+			Socket local_sock, remote_sock;
+			try {
+				local_sock = new Socket.from_fd (fds[0]);
+				remote_sock = new Socket.from_fd (fds[1]);
+			} catch (GLib.Error e) {
+				throw new Error.TRANSPORT ("%s", e.message);
+			}
+
+			string fd_name = "appfd";
+			yield getfd (fd_name, fds[1], cancellable);
+
+			string chardev = "vserial0";
+			yield add_chardev_from_fd (chardev, fd_name, cancellable);
+
+			yield add_serial_port (chardev, bus, "re.frida.hostlink", "hostlink.port", 1, cancellable);
+
+			return new Hostlink () {
+				connection = SocketConnection.factory_create_connection (local_sock),
+				mmio = mmio,
+				irq = irq,
+			};
+#endif
+		}
+
+		public class Hostlink {
+			public SocketConnection connection;
+			public uint64 mmio;
+			public uint irq;
+		}
+
+#if !WINDOWS
+		private async int64 get_qom_property_int (string path, string property, Cancellable? cancellable) throws Error, IOError {
+			var val = yield get_qom_property (path, property, cancellable);
+			if (val.get_value_type () != typeof (int64))
+				throw new Error.PROTOCOL ("Expected '%s' property on %s to be an integer", property, path);
+			return val.get_int ();
+		}
+
+		private async string get_qom_property_string (string path, string property, Cancellable? cancellable)
+				throws Error, IOError {
+			var val = yield get_qom_property (path, property, cancellable);
+			if (val.get_value_type () != typeof (string))
+				throw new Error.PROTOCOL ("Expected '%s' property on %s to be a string", property, path);
+			return val.get_string ();
+		}
+
+		private async Json.Node get_qom_property (string path, string property, Cancellable? cancellable) throws Error, IOError {
+			var args = new Json.Builder ();
+			args
+				.begin_object ()
+					.set_member_name ("path")
+					.add_string_value (path)
+					.set_member_name ("property")
+					.add_string_value (property)
+				.end_object ();
+			return yield execute_command ("qom-get", args.get_root (), cancellable);
+		}
+
+		private async void getfd (string name, int fd, Cancellable? cancellable) throws Error, IOError {
+			var args = new Json.Builder ();
+			args
+				.begin_object ()
+					.set_member_name ("fdname")
+					.add_string_value (name)
+				.end_object ();
+			yield execute_command_with_file_descriptor ("getfd", args.get_root (), fd, cancellable);
+		}
+
+		private async void add_chardev_from_fd (string id, string fd_name, Cancellable? cancellable) throws Error, IOError {
+			var args = new Json.Builder ();
+			args
+				.begin_object ()
+					.set_member_name ("id")
+					.add_string_value (id)
+					.set_member_name ("backend")
+					.begin_object ()
+						.set_member_name ("type")
+						.add_string_value ("socket")
+						.set_member_name ("data")
+						.begin_object ()
+							.set_member_name ("server")
+							.add_boolean_value (false)
+							.set_member_name ("addr")
+							.begin_object ()
+								.set_member_name ("type")
+								.add_string_value ("fd")
+								.set_member_name ("data")
+								.begin_object ()
+									.set_member_name ("str")
+									.add_string_value (fd_name)
+								.end_object ()
+							.end_object ()
+						.end_object ()
+					.end_object ()
+				.end_object ();
+			yield execute_command ("chardev-add", args.get_root (), cancellable);
+		}
+
+		private async void add_serial_port (string chardev, string bus, string name, string id, uint nr, Cancellable? cancellable)
+				throws Error, IOError {
+			var args = new Json.Builder ();
+			args
+				.begin_object ()
+					.set_member_name ("driver")
+					.add_string_value ("virtserialport")
+					.set_member_name ("chardev")
+					.add_string_value (chardev)
+					.set_member_name ("bus")
+					.add_string_value (bus)
+					.set_member_name ("name")
+					.add_string_value (name)
+					.set_member_name ("id")
+					.add_string_value (id)
+					.set_member_name ("nr")
+					.add_int_value ((int64) nr)
+				.end_object ();
+			yield execute_command ("device_add", args.get_root (), cancellable);
+		}
+#endif
+
+		public async Json.Node execute_command (string command, Json.Node? arguments = null, Cancellable? cancellable = null)
+				throws Error, IOError {
+			check_connected ();
+
+			Request request = begin_request (command, arguments);
+
+			try {
+				yield output.write_all_async (request.json.data, Priority.DEFAULT, cancellable, null);
+			} catch (GLib.Error e) {
+				cancel_request (request);
+				throw new Error.TRANSPORT ("%s", e.message);
+			}
+
+			return yield join_request (request, cancellable);
+		}
+
+		public async Json.Node execute_command_with_file_descriptor (string command, Json.Node? arguments = null, int fd,
+				Cancellable? cancellable = null) throws Error, IOError {
+			check_connected ();
+
+#if WINDOWS
+			throw new Error.NOT_SUPPORTED ("Executing command with SocketControlMessage is not supported on Windows");
+#else
+			Request request = begin_request (command, arguments);
+
+			var scm = new UnixFDMessage ();
+			try {
+				scm.append_fd (fd);
+			} catch (GLib.Error e) {
+				throw new Error.NOT_SUPPORTED ("%s", e.message);
+			}
+
+			Socket s = connection.get_socket ();
+
+			unowned uint8[] raw_command = request.json.data;
+
+			OutputVector vectors[1] = {
+				OutputVector () {
+					buffer = raw_command,
+					size = raw_command.length,
+				},
+			};
+			SocketControlMessage scms[1] = { scm };
+
+			ssize_t n;
+			try {
+				n = s.send_message (null, vectors, scms, 0, cancellable);
+			} catch (GLib.Error e) {
+				cancel_request (request);
+				throw new Error.TRANSPORT ("%s", e.message);
+			}
+
+			if (n != raw_command.length) {
+				try {
+					yield output.write_all_async (raw_command[n:], Priority.DEFAULT, cancellable, null);
+				} catch (GLib.Error e) {
+					cancel_request (request);
+					throw new Error.TRANSPORT ("%s", e.message);
+				}
+			}
+
+			return yield join_request (request, cancellable);
+#endif
+		}
+
+		private Request begin_request (string command, Json.Node? arguments) {
+			uint id = next_request_id++;
+
+			var promise = new Promise<Json.Node> ();
+			pending_requests[id] = promise;
+
+			string json = build_request (command, id, arguments);
+
+			return new Request () {
+				promise = promise,
+				json = json,
+				id = id,
+			};
+		}
+
+		private static string build_request (string command, uint id, Json.Node? arguments) {
+			var b = new Json.Builder ();
+			b
+				.begin_object ()
+				.set_member_name ("execute")
+				.add_string_value (command);
+
+			if (arguments != null) {
+				b
+					.set_member_name ("arguments")
+					.add_value (arguments);
+			}
+
+			b
+				.set_member_name ("id")
+				.add_int_value ((int64) id);
+
+			Json.Node message = b.end_object ().get_root ();
+
+			return Json.to_string (message, false) + "\n";
+		}
+
+		private async Json.Node join_request (Request request, Cancellable? cancellable) throws Error, IOError {
+			var timeout_source = new TimeoutSource (REQUEST_TIMEOUT_MS);
+			timeout_source.set_callback (() => {
+				Promise<Json.Node>? p;
+				if (pending_requests.unset (request.id, out p))
+					p.reject (new Error.TIMED_OUT ("QMP command timed out"));
+				return Source.REMOVE;
+			});
+			timeout_source.attach (MainContext.get_thread_default ());
+
+			try {
+				return yield request.promise.future.wait_async (cancellable);
+			} finally {
+				timeout_source.destroy ();
+			}
+		}
+
+		private void cancel_request (Request r) {
+			pending_requests.unset (r.id);
+		}
+
+		private class Request {
+			public Promise<Json.Node> promise;
+			public string json;
+			public uint id;
+		}
+
+		private void check_connected () throws Error {
+			if (!is_connected)
+				throw new Error.INVALID_OPERATION ("QMP client is not connected");
+		}
+
+		private async void process_incoming_messages () {
+			try {
+				while (is_connected) {
+					string? line = yield input.read_line_async (Priority.DEFAULT, io_cancellable);
+					if (line == null)
+						break;
+
+					handle_message (Json.from_string (line));
+				}
+			} catch (GLib.Error e) {
+			} finally {
+				is_connected = false;
+
+				foreach (var promise in pending_requests.values)
+					promise.reject (new Error.TRANSPORT ("QMP connection closed"));
+				pending_requests.clear ();
+			}
+
+			io_cancellable.cancel ();
+
+			var source = new IdleSource ();
+			source.set_callback (process_incoming_messages.callback);
+			source.attach (MainContext.get_thread_default ());
+			yield;
+
+			try {
+				yield connection.close_async ();
+			} catch (GLib.Error e) {
+			}
+
+			close_request.resolve (true);
+		}
+
+		private void handle_message (Json.Node message) throws Error {
+			var r = new Json.Reader (message);
+
+			bool is_response = r.read_member ("id");
+			uint id = 0;
+			if (is_response) {
+				id = (uint) r.get_int_value ();
+				GLib.Error? e = r.get_error ();
+				if (e != null)
+					throw new Error.PROTOCOL ("Malformed message: %s", e.message);
+			}
+			r.end_member ();
+
+			if (is_response)
+				handle_response (id, r);
+			else
+				handle_event (r);
+		}
+
+		private void handle_response (uint request_id, Json.Reader r) throws Error {
+			Promise<Json.Node>? promise;
+			if (!pending_requests.unset (request_id, out promise))
+				return;
+
+			if (r.read_member ("error")) {
+				r.read_member ("desc");
+				string? description = r.get_string_value ();
+				if (description == null)
+					throw new Error.PROTOCOL ("Malformed message: %s", r.get_error ().message);
+				r.end_member ();
+
+				promise.reject (new Error.NOT_SUPPORTED ("%s", description));
+				return;
+			}
+			r.end_member ();
+
+			r.read_member ("return");
+			promise.resolve (r.get_current_node ());
+		}
+
+		private void handle_event (Json.Reader r) throws Error {
+			r.read_member ("event");
+			string? name = r.get_string_value ();
+			if (name == null)
+				throw new Error.PROTOCOL ("Malformed event message: missing 'event' property");
+			r.end_member ();
+
+			Json.Node? data = null;
+			if (r.read_member ("data")) {
+				if (!r.is_object ())
+					throw new Error.PROTOCOL ("Malformed event message: 'data' must be an object");
+				data = r.get_current_node ();
+			}
+			r.end_member ();
+
+			event (name, data);
+		}
+	}
+}

src/barebone/rust-module.vala

@@ -84,23 +84,15 @@ namespace Frida.Barebone {
 				throw new Error.NOT_SUPPORTED ("%s", e.message);
 			}
 
-			size_t vm_size = (size_t) elf.mapped_size;
+			var raw_elf = new Bytes.static (elf.get_file_data ());
 
 			size_t page_size = yield machine.query_page_size (cancellable);
-			uint num_pages = (uint) (vm_size / page_size);
-			if (vm_size % page_size != 0)
-				num_pages++;
 
-			var gdb = machine.gdb;
+			allocation = yield inject_elf (elf, raw_elf, page_size, machine, allocator, cancellable);
 
-			allocation = yield allocator.allocate (num_pages * page_size, page_size, cancellable);
 			uint64 base_va = allocation.virtual_address;
-
-			Bytes relocated_image = machine.relocate (elf, base_va);
-			yield gdb.write_byte_array (base_va, relocated_image, cancellable);
-
 			uint64 console_log_trap = 0;
-			elf.enumerate_dynamic_symbols (e => {
+			elf.enumerate_symbols (e => {
 				if (e.name == "")
 					return true;
 
@@ -116,38 +108,14 @@ namespace Frida.Barebone {
 			});
 
 			if (console_log_trap != 0) {
-				console_log_callback = yield new Callback (console_log_trap, new ConsoleLogHandler (this, gdb),
-					machine, cancellable);
+				var handler = new ConsoleLogHandler (machine.gdb);
+				handler.output.connect (on_console_output);
+				console_log_callback = yield new Callback (console_log_trap, handler, machine, cancellable);
 			}
 		}
 
-		private class ConsoleLogHandler : Object, CallbackHandler {
-			public uint arity {
-				get { return 2; }
-			}
-
-			private weak RustModule parent;
-			private GDB.Client gdb;
-
-			public ConsoleLogHandler (RustModule parent, GDB.Client gdb) {
-				this.parent = parent;
-				this.gdb = gdb;
-			}
-
-			public async uint64 handle_invocation (uint64[] args, CallFrame frame, Cancellable? cancellable)
-					throws Error, IOError {
-				var message = args[0];
-				var len = (long) args[1];
-
-				Bytes str_bytes = yield gdb.read_byte_array (message, len, cancellable);
-				unowned uint8[] str_data = str_bytes.get_data ();
-				unowned string str_raw = (string) str_data;
-				string str = str_raw.substring (0, len);
-
-				parent.console_output (str);
-
-				return 0;
-			}
+		private void on_console_output (string message) {
+			console_output (message);
 		}
 
 		private const string CRATE_NAME = "rustmodule";
@@ -201,7 +169,7 @@ namespace Frida.Barebone {
 							.resolve_relative_path (CRATE_NAME);
 					}
 
-					yield write_text_file (workdir, "module.lds", make_linker_script (symbols), cancellable);
+					yield write_text_file (workdir, "module.lds", make_linker_script (code, symbols), cancellable);
 				} catch (GLib.Error e) {
 					throw new Error.PERMISSION_DENIED ("%s", e.message);
 				}
@@ -270,8 +238,8 @@ namespace Frida.Barebone {
 				return rs.str;
 			}
 
-			private static string make_linker_script (Gee.Map<string, uint64?> symbols) {
-				var script = new StringBuilder.sized (256);
+			private static string make_linker_script (string code, Gee.Map<string, uint64?> symbols) {
+				var script = new StringBuilder.sized (512);
 
 				foreach (var e in symbols.entries) {
 					unowned string name = e.key;
@@ -282,15 +250,16 @@ namespace Frida.Barebone {
 						.append_printf ("0x%" + uint64.FORMAT_MODIFIER + "x;\n", address);
 				}
 
-				script.append (prettify_text_asset (BASE_LINKER_SCRIPT));
-
-				return script.str;
-			}
-
-			private const string BASE_LINKER_SCRIPT = """
+				script.append ("""
 				SECTIONS {
 					.text : {
 						*(.text*);
+				""");
+
+				foreach (string name in extract_extern_c_symbols (code))
+					script.append_printf ("		KEEP(*(.text.%s))\n", name);
+
+				script.append ("""
 						_console_log = .;
 						. += 8;
 					}
@@ -307,7 +276,25 @@ namespace Frida.Barebone {
 						*(.bss*)
 					}
 				}
-			""";
+				""");
+
+				return prettify_text_asset (script.str);
+			}
+
+			private static Gee.List<string> extract_extern_c_symbols (string code) {
+				var names = new Gee.ArrayList<string> ();
+
+				var export_pattern = /\#\[\s*no_mangle\s*\]\s*pub\s+(?:unsafe\s+)?extern\s*"C"\s+fn\s+([A-Za-z_]\w*)\s*\(/;
+
+				try {
+					MatchInfo info;
+					for (export_pattern.match (code, 0, out info); info.matches (); info.next ())
+						names.add (info.fetch (1));
+				} catch (RegexError e) {
+				}
+
+				return names;
+			}
 
 			private const string BUILTINS = """
 				#![no_main]

src/barebone/script-runtime/entrypoint.ts

@@ -304,6 +304,13 @@ Object.defineProperties(Process, {
 });
 
 const marshalers: { [type: string]: Marshaler } = {
+    void: {
+        fromNative(v) {
+        },
+        toNative(v) {
+            throw new Error("invalid operation");
+        }
+    },
     pointer: {
         fromNative(v) {
             return new BNativePointer(v);
@@ -338,6 +345,28 @@ const marshalers: { [type: string]: Marshaler } = {
             return BigInt(v);
         }
     },
+    uint: {
+        fromNative(v) {
+            return Number(v);
+        },
+        toNative(v) {
+            if (typeof v !== "number") {
+                throw new Error("expected an integer");
+            }
+            return BigInt(v);
+        }
+    },
+    size_t: {
+        fromNative(v) {
+            return new BUInt64(v);
+        },
+        toNative(v) {
+            if (typeof v === "number") {
+                return BigInt(v);
+            }
+            return v.$v;
+        }
+    },
 };
 
 function getMarshalerFor(t: NativeFunctionReturnType | NativeFunctionArgumentType): Marshaler {

src/barebone/script.vala

@@ -42,8 +42,6 @@ namespace Frida {
 
 		private Gee.Queue<QuickJS.Value?> tick_callbacks = new Gee.ArrayQueue<QuickJS.Value?> ();
 
-		private Barebone.Allocation? cached_landing_zone; // TODO: Deallocate on teardown.
-
 		private Gee.Set<Barebone.Callback> native_callbacks = new Gee.HashSet<Barebone.Callback> ();
 
 		private static QuickJS.ClassID cpu_context_class;
@@ -56,6 +54,9 @@ namespace Frida {
 		private static QuickJS.ClassExoticMethods invocation_args_exotic_methods;
 		private static QuickJS.ClassID invocation_retval_class;
 
+		private static QuickJS.ClassID c_module_class;
+		private Gee.Set<Barebone.CModule> c_modules = new Gee.HashSet<Barebone.CModule> ();
+
 		private static QuickJS.ClassID rust_module_class;
 		private Gee.Set<Barebone.RustModule> rust_modules = new Gee.HashSet<Barebone.RustModule> ();
 
@@ -155,6 +156,7 @@ namespace Frida {
 
 			var memory_obj = ctx.make_object ();
 			add_cfunc (memory_obj, "alloc", on_memory_alloc, 1);
+			add_cfunc (memory_obj, "protect", on_memory_protect, 3);
 			add_cfunc (memory_obj, "scan", on_memory_scan, 4);
 			add_cfunc (memory_obj, "scanSync", on_memory_scan_sync, 3);
 			global.set_property_str (ctx, "Memory", memory_obj);
@@ -206,6 +208,17 @@ namespace Frida {
 			ir.class_name = "InvocationReturnValue";
 			rt.make_class (QuickJS.make_class_id (ref invocation_retval_class), ir);
 
+			QuickJS.ClassDef cm;
+			cm.class_name = "CModule";
+			cm.finalizer = on_c_module_finalize;
+			rt.make_class (QuickJS.make_class_id (ref c_module_class), cm);
+			var cm_proto = ctx.make_object ();
+			add_cfunc (cm_proto, "dispose", on_c_module_dispose, 0);
+			ctx.set_class_proto (c_module_class, cm_proto);
+			var cm_ctor = ctx.make_cfunction2 (on_c_module_construct, cm.class_name, 1, constructor, 0);
+			cm_ctor.set_constructor (ctx, cm_proto);
+			global.set_property_str (ctx, "CModule", cm_ctor);
+
 			QuickJS.ClassDef rm;
 			rm.class_name = "RustModule";
 			rm.finalizer = on_rust_module_finalize;
@@ -672,11 +685,7 @@ namespace Frida {
 
 		private async void do_invoke (uint64 impl, uint64[] args, Promise<uint64?> promise) {
 			try {
-				if (cached_landing_zone == null)
-					cached_landing_zone = yield services.allocator.allocate (4, 1, io_cancellable);
-
-				uint64 retval = yield services.machine.invoke (impl, args, cached_landing_zone.virtual_address,
-					io_cancellable);
+				uint64 retval = yield services.machine.invoke (impl, args, io_cancellable);
 
 				promise.resolve (retval);
 			} catch (GLib.Error e) {
@@ -1124,6 +1133,41 @@ namespace Frida {
 			}
 		}
 
+		private static QuickJS.Value on_memory_protect (QuickJS.Context ctx, QuickJS.Value this_val, QuickJS.Value[] argv) {
+			BareboneScript * script = ctx.get_opaque ();
+
+			uint64 address;
+			if (!script->unparse_native_pointer (argv[0], out address))
+				return QuickJS.Exception;
+
+			uint size;
+			if (!script->unparse_uint (argv[1], out size))
+				return QuickJS.Exception;
+
+			Gum.PageProtection prot;
+			if (!script->unparse_page_protection (argv[2], out prot))
+				return QuickJS.Exception;
+
+			var promise = new Promise<bool?> ();
+			script->do_memory_protect.begin (address, size, prot, promise);
+
+			bool? result = script->process_events_until_ready (promise);
+			if (result == null)
+				return QuickJS.Exception;
+
+			return ctx.make_bool (result);
+		}
+
+		private async void do_memory_protect (uint64 address, size_t size, Gum.PageProtection prot, Promise<bool?> promise) {
+			try {
+				yield services.machine.protect_pages (address, size, prot, io_cancellable);
+
+				promise.resolve (true);
+			} catch (GLib.Error e) {
+				promise.resolve (false);
+			}
+		}
+
 		private static QuickJS.Value on_memory_scan (QuickJS.Context ctx, QuickJS.Value this_val, QuickJS.Value[] argv) {
 			BareboneScript * script = ctx.get_opaque ();
 
@@ -1791,6 +1835,67 @@ namespace Frida {
 			return QuickJS.Undefined;
 		}
 
+		private static QuickJS.Value on_c_module_construct (QuickJS.Context ctx, QuickJS.Value new_target,
+				QuickJS.Value[] argv) {
+			BareboneScript * script = ctx.get_opaque ();
+
+			Bytes blob;
+			if (!script->unparse_bytes (argv[0], out blob))
+				return QuickJS.Exception;
+
+			var promise = new Promise<Barebone.CModule> ();
+			script->load_c_module.begin (blob, promise);
+
+			Barebone.CModule? mod = script->process_events_until_ready (promise);
+			if (mod == null)
+				return QuickJS.Exception;
+
+			var proto = new_target.get_property (ctx, script->prototype_key);
+			var wrapper = ctx.make_object_with_proto_and_class (proto, c_module_class);
+			ctx.free_value (proto);
+
+			wrapper.set_opaque (mod);
+			script->c_modules.add (mod);
+
+			foreach (var e in mod.exports)
+				wrapper.set_property_str (ctx, e.name, script->make_native_pointer (e.address));
+
+			mod.console_output.connect (script->on_console_output);
+
+			return wrapper;
+		}
+
+		private async void load_c_module (Bytes blob, Promise<Barebone.CModule> promise) {
+			try {
+				var mod = yield new Barebone.CModule.from_blob (blob, services.machine, services.allocator, io_cancellable);
+
+				promise.resolve (mod);
+			} catch (GLib.Error e) {
+				promise.reject (e);
+			}
+		}
+
+		private static void on_c_module_finalize (QuickJS.Runtime rt, QuickJS.Value val) {
+			Barebone.CModule * mod = val.get_opaque (c_module_class);
+			if (mod == null)
+				return;
+
+			BareboneScript * script = rt.get_opaque ();
+			script->c_modules.remove (mod);
+		}
+
+		private static QuickJS.Value on_c_module_dispose (QuickJS.Context ctx, QuickJS.Value this_val, QuickJS.Value[] argv) {
+			Barebone.CModule * mod = this_val.get_opaque (c_module_class);
+
+			if (mod != null) {
+				this_val.set_opaque (null);
+				BareboneScript * script = ctx.get_opaque ();
+				script->c_modules.remove (mod);
+			}
+
+			return QuickJS.Undefined;
+		}
+
 		private static QuickJS.Value on_rust_module_construct (QuickJS.Context ctx, QuickJS.Value new_target,
 				QuickJS.Value[] argv) {
 			BareboneScript * script = ctx.get_opaque ();
@@ -1860,7 +1965,7 @@ namespace Frida {
 			foreach (var e in mod.exports)
 				wrapper.set_property_str (ctx, e.name, script->make_native_pointer (e.address));
 
-			mod.console_output.connect (script->on_rust_module_console_output);
+			mod.console_output.connect (script->on_console_output);
 
 			return wrapper;
 		}
@@ -1898,7 +2003,7 @@ namespace Frida {
 			return QuickJS.Undefined;
 		}
 
-		private void on_rust_module_console_output (string message) {
+		private void on_console_output (string message) {
 			var builder = new Json.Builder ();
 			builder
 				.begin_object ()

src/compiler/backend.go

@@ -106,6 +106,8 @@ type BuildOptions struct {
 	DisableTypeCheck bool
 	SourceMap        bool
 	Compress         bool
+	Platform         esbuild.Platform
+	Externals        []string
 }
 
 type OutputFormat C.FridaOutputFormat
@@ -146,7 +148,7 @@ type BuildDiagnosticCallback func(d Diagnostic)
 
 //export _frida_compiler_backend_build
 func _frida_compiler_backend_build(cProjectRoot, cEntrypoint *C.char, outputFormat C.FridaOutputFormat, bundleFormat C.FridaBundleFormat,
-	disableTypeCheck, sourceMap, compress uintptr,
+	disableTypeCheck, sourceMap, compress uintptr, cPlatform *C.char, cExternals **C.char, numExternals C.int,
 	onCompleteFn C.FridaBuildCompleteFunc, onCompleteData unsafe.Pointer, onCompleteDataDestroy C.FridaDestroyFunc,
 	onDiagnosticFn C.FridaDiagnosticFunc, onDiagnosticData unsafe.Pointer) {
 	options := BuildOptions{
@@ -157,6 +159,8 @@ func _frida_compiler_backend_build(cProjectRoot, cEntrypoint *C.char, outputForm
 		DisableTypeCheck: disableTypeCheck != 0,
 		SourceMap:        sourceMap != 0,
 		Compress:         compress != 0,
+		Platform:         platformFromFrida(C.GoString(cPlatform)),
+		Externals:        parseCExternals(cExternals, numExternals),
 	}
 	onComplete := NewCDelegate(onCompleteFn, onCompleteData, onCompleteDataDestroy)
 	onDiagnostic := NewCDelegate(onDiagnosticFn, onDiagnosticData, nil)
@@ -181,7 +185,7 @@ func _frida_compiler_backend_build(cProjectRoot, cEntrypoint *C.char, outputForm
 
 //export _frida_compiler_backend_watch
 func _frida_compiler_backend_watch(cProjectRoot, cEntrypoint *C.char, outputFormat C.FridaOutputFormat, bundleFormat C.FridaBundleFormat,
-	disableTypeCheck, sourceMap, compress uintptr,
+	disableTypeCheck, sourceMap, compress uintptr, cPlatform *C.char, cExternals **C.char, numExternals C.int,
 	onReadyFn C.FridaWatchReadyFunc, onReadyData unsafe.Pointer, onReadyDataDestroy C.FridaDestroyFunc,
 	onStartingFn C.FridaStartingFunc, onStartingData unsafe.Pointer,
 	onFinishedFn C.FridaFinishedFunc, onFinishedData unsafe.Pointer,
@@ -195,6 +199,8 @@ func _frida_compiler_backend_watch(cProjectRoot, cEntrypoint *C.char, outputForm
 		DisableTypeCheck: disableTypeCheck != 0,
 		SourceMap:        sourceMap != 0,
 		Compress:         compress != 0,
+		Platform:         platformFromFrida(C.GoString(cPlatform)),
+		Externals:        parseCExternals(cExternals, numExternals),
 	}
 	onReady := NewCDelegate(onReadyFn, onReadyData, onReadyDataDestroy)
 	onStarting := NewCDelegate(onStartingFn, onStartingData, nil)
@@ -246,6 +252,35 @@ func _frida_compiler_backend_watch_session_dispose(h uintptr) {
 	handle.Delete()
 }
 
+func platformFromFrida(s string) esbuild.Platform {
+	switch s {
+	case "gum":
+		return esbuild.PlatformNode
+	case "browser":
+		return esbuild.PlatformBrowser
+	case "neutral":
+		return esbuild.PlatformNeutral
+	default:
+		panic(fmt.Sprintf("Unknown platform: %q", s))
+	}
+}
+
+func parseCExternals(cExternals **C.char, numExternals C.int) []string {
+	if numExternals == 0 {
+		return nil
+	}
+
+	n := int(numExternals)
+	cArray := (*[1 << 20]*C.char)(unsafe.Pointer(cExternals))[:n:n]
+
+	externals := make([]string, n)
+	for i := 0; i < n; i++ {
+		externals[i] = C.GoString(cArray[i])
+	}
+
+	return externals
+}
+
 func makeCBuildDiagnosticCallback(onDiagnostic *CDelegate[C.FridaDiagnosticFunc]) BuildDiagnosticCallback {
 	return func(d Diagnostic) {
 		var cPath *C.char
@@ -445,9 +480,10 @@ func makeContext(options BuildOptions, callbacks BuildEventCallbacks) (ctx esbui
 		Bundle:            true,
 		Outdir:            projectRoot,
 		AbsWorkingDir:     projectRoot,
-		Platform:          esbuild.PlatformNode,
+		Platform:          options.Platform,
 		Format:            format,
 		Inject:            []string{"frida-builtins:///node-globals.js"},
+		External:          options.Externals,
 		EntryPoints:       []string{entrypoint},
 		Write:             false,
 		Plugins:           plugins,

src/compiler/compiler.vala

@@ -46,7 +46,8 @@ namespace Frida {
 
 				CompilerBackend.build (project_root, entrypoint, opts.output_format, opts.bundle_format,
 					(size_t) (opts.type_check == NONE), (size_t) (opts.source_maps == INCLUDED),
-					(size_t) (opts.compression == TERSER), (owned) on_complete, on_diagnostic);
+					(size_t) (opts.compression == TERSER), opts.platform.to_nick (),
+					opts.externals.to_array (), (owned) on_complete, on_diagnostic);
 				yield;
 
 				if (error_message != null)
@@ -96,7 +97,8 @@ namespace Frida {
 
 			CompilerBackend.watch (project_root, entrypoint, opts.output_format, opts.bundle_format,
 				(size_t) (opts.type_check == NONE), (size_t) (opts.source_maps == INCLUDED),
-				(size_t) (opts.compression == TERSER), (owned) on_ready, on_starting, on_finished,
+				(size_t) (opts.compression == TERSER), opts.platform.to_nick (),
+				opts.externals.to_array (), (owned) on_ready, on_starting, on_finished,
 				on_output, on_diagnostic);
 			yield;
 
@@ -283,13 +285,14 @@ namespace Frida {
 		[CCode (has_target = false)]
 		private delegate void BuildFunc (string project_root, string entrypoint, OutputFormat output_format,
 			BundleFormat bundle_format, size_t disable_type_check, size_t source_map, size_t compress,
-			owned BuildCompleteFunc on_complete, DiagnosticFunc on_diagnostic);
+			string platform, string[] externals, owned BuildCompleteFunc on_complete,
+			DiagnosticFunc on_diagnostic);
 
 		[CCode (has_target = false)]
 		private delegate void WatchFunc (string project_root, string entrypoint, OutputFormat output_format,
 			BundleFormat bundle_format, size_t disable_type_check, size_t source_map, size_t compress,
-			owned WatchReadyFunc on_ready, StartingFunc on_starting, FinishedFunc on_finished, OutputFunc on_output,
-			DiagnosticFunc on_diagnostic);
+			string platform, string[] externals, owned WatchReadyFunc on_ready, StartingFunc on_starting,
+			FinishedFunc on_finished, OutputFunc on_output, DiagnosticFunc on_diagnostic);
 
 #if COMPILER_BACKEND_STATIC_COMPILATION
 		private extern void _init_go_runtime ();
@@ -373,6 +376,27 @@ namespace Frida {
 			set;
 			default = NONE;
 		}
+
+		public JsPlatform platform {
+			get;
+			set;
+			default = GUM;
+		}
+
+		internal Gee.List<string> externals = new Gee.ArrayList<string> ();
+
+		public void clear_externals () {
+			externals.clear ();
+		}
+
+		public void add_external (string external) {
+			externals.add (external);
+		}
+
+		public void enumerate_externals (Func<string> func) {
+			foreach (var external in externals)
+				func (external);
+		}
 	}
 
 	public sealed class BuildOptions : CompilerOptions {
@@ -446,4 +470,18 @@ namespace Frida {
 			return Marshal.enum_to_nick<JsCompression> (this);
 		}
 	}
+
+	public enum JsPlatform {
+		GUM,
+		BROWSER,
+		NEUTRAL;
+
+		public static JsPlatform from_nick (string nick) throws Error {
+			return Marshal.enum_from_nick<JsPlatform> (nick);
+		}
+
+		public string to_nick () {
+			return Marshal.enum_to_nick<JsPlatform> (this);
+		}
+	}
 }

src/compiler/meson.build

@@ -4,6 +4,7 @@ compiler_sources = files(
 )
 
 if have_compiler_backend
+  output_suffix = compiler_backend_static_compilation ? '' : '-raw'
   compiler_backend = custom_target('frida-compiler-backend',
     input: [
       'go.mod',
@@ -17,8 +18,8 @@ if have_compiler_backend
       'package-lock.json',
     ],
     output: [
-      'frida-compiler-backend' + (compiler_backend_static_compilation ? '.a' : ('-raw' + shlib_suffix)),
-      'frida-compiler-backend.h',
+      'frida-compiler-backend' + output_suffix + (compiler_backend_static_compilation ? '.a' : shlib_suffix),
+      'frida-compiler-backend' + output_suffix + '.h',
     ],
     command: [
       python,

src/compiler/package-lock.json

@@ -33,7 +33,7 @@
         "@frida/url": "^1.0.2",
         "@frida/util": "^1.0.3",
         "@frida/vm": "^2.0.0",
-        "@types/frida-gum": "19.0.0",
+        "@types/frida-gum": "19.0.1",
         "@types/node": "18.19.103",
         "frida-fs": "7.0.0"
       }
@@ -248,9 +248,9 @@
       "license": "MIT"
     },
     "node_modules/@types/frida-gum": {
-      "version": "19.0.0",
-      "resolved": "https://registry.npmjs.org/@types/frida-gum/-/frida-gum-19.0.0.tgz",
-      "integrity": "sha512-qViK1KwvPEAkajwSUv0wpZvZLiX8xO4JFFCh8dfYZfzSyOEfoE0KliCP/nJSKIKG6N3hXnPowrvPufjs5fLKAA==",
+      "version": "19.0.1",
+      "resolved": "https://registry.npmjs.org/@types/frida-gum/-/frida-gum-19.0.1.tgz",
+      "integrity": "sha512-mp8BpWWkQFJH86ZN5uXZuDiA7KY/+jDknrw0a06x0/+F5ucPwctHrCuV6iT+LLCp/GyICc36ssedF33B1WoLsw==",
       "license": "MIT"
     },
     "node_modules/@types/node": {

src/compiler/package.json

@@ -29,7 +29,7 @@
     "@frida/url": "^1.0.2",
     "@frida/util": "^1.0.3",
     "@frida/vm": "^2.0.0",
-    "@types/frida-gum": "19.0.0",
+    "@types/frida-gum": "19.0.1",
     "@types/node": "18.19.103",
     "frida-fs": "7.0.0"
   }

src/control-service.vala

@@ -192,7 +192,7 @@ namespace Frida {
 		}
 
 		private void on_server_connection (IOStream connection, SocketAddress remote_address, DynamicInterface? dynamic_iface) {
-#if IOS || TVOS
+#if HAVE_LOCAL_BACKEND && (IOS || TVOS)
 			/*
 			 * We defer the launchd injection until the first connection is established in order
 			 * to avoid bootloops on unsupported jailbreaks.

src/darwin/darwin-host-session.vala

@@ -845,8 +845,8 @@ namespace Frida {
 			construct;
 		}
 
-		public LaunchdAgent (DarwinHostSession host_session, Cancellable io_cancellable) {
-			Object (host_session: host_session, io_cancellable: io_cancellable);
+		public LaunchdAgent (HostSessionConnection connection, Cancellable io_cancellable) {
+			Object (connection: connection, io_cancellable: io_cancellable);
 		}
 
 		construct {
@@ -905,7 +905,7 @@ namespace Frida {
 
 			try {
 				if (path == XPC_PROXY_PATH) {
-					var agent = new XpcProxyAgent ((DarwinHostSession) host_session, identifier, pid);
+					var agent = new XpcProxyAgent (connection, identifier, pid);
 					yield agent.run_until_exec (io_cancellable);
 				}
 
@@ -921,7 +921,7 @@ namespace Frida {
 
 			try {
 				if (path == XPC_PROXY_PATH) {
-					var agent = new XpcProxyAgent ((DarwinHostSession) host_session, identifier, pid);
+					var agent = new XpcProxyAgent (connection, identifier, pid);
 					yield agent.run_until_exec (io_cancellable);
 				}
 
@@ -937,7 +937,8 @@ namespace Frida {
 
 		protected override async string? load_source (Cancellable? cancellable) throws Error, IOError {
 			string * raw_source = Frida.Data.Darwin.get_launchd_js_blob ().data;
-			return raw_source->replace ("@REPORT_CRASHES@", ((DarwinHostSession) host_session).report_crashes.to_string ());
+			return raw_source->replace ("@REPORT_CRASHES@",
+				((DarwinHostSession) connection.host_session).report_crashes.to_string ());
 		}
 	}
 
@@ -952,8 +953,8 @@ namespace Frida {
 			construct;
 		}
 
-		public XpcProxyAgent (DarwinHostSession host_session, string identifier, uint pid) {
-			Object (host_session: host_session, identifier: identifier, pid: pid);
+		public XpcProxyAgent (HostSessionConnection connection, string identifier, uint pid) {
+			Object (connection: connection, identifier: identifier, pid: pid);
 		}
 
 		construct {
@@ -965,7 +966,7 @@ namespace Frida {
 		public async void run_until_exec (Cancellable? cancellable) throws Error, IOError {
 			yield ensure_loaded (cancellable);
 
-			var helper = ((DarwinHostSession) host_session).helper;
+			var helper = ((DarwinHostSession) connection.host_session).helper;
 			yield helper.resume (pid, cancellable);
 
 			yield wait_for_unload (cancellable);
@@ -1002,10 +1003,10 @@ namespace Frida {
 			construct;
 		}
 
-		public ReportCrashAgent (DarwinHostSession host_session, uint pid, MappedAgentContainer mapped_agent_container,
+		public ReportCrashAgent (HostSessionConnection connection, uint pid, MappedAgentContainer mapped_agent_container,
 				Cancellable io_cancellable) {
 			Object (
-				host_session: host_session,
+				connection: connection,
 				pid: pid,
 				mapped_agent_container: mapped_agent_container,
 				io_cancellable: io_cancellable
@@ -1226,9 +1227,9 @@ namespace Frida {
 			construct;
 		}
 
-		public OSAnalyticsAgent (DarwinHostSession host_session, uint pid, Cancellable io_cancellable) {
+		public OSAnalyticsAgent (HostSessionConnection connection, uint pid, Cancellable io_cancellable) {
 			Object (
-				host_session: host_session,
+				connection: connection,
 				pid: pid,
 				io_cancellable: io_cancellable
 			);

src/darwin/frida-helper-backend-glue.m

@@ -30,7 +30,6 @@
 #include <sys/mman.h>
 #include <sys/sysctl.h>
 #include <unistd.h>
-#include <util.h>
 
 #ifndef _POSIX_SPAWN_DISABLE_ASLR
 # define _POSIX_SPAWN_DISABLE_ASLR 0x0100
@@ -80,7 +79,7 @@
     goto bsd_failure; \
   }
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 # define CORE_FOUNDATION "/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation"
 #else
 # define CORE_FOUNDATION "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"
@@ -181,6 +180,7 @@ struct _FridaSpawnInstance
   mach_vm_address_t dyld_data;
 
   GumAddress modern_entry_address;
+  GumAddress sim_notify_address;
 
   /* V4+ */
   GumAddress notify_objc_init;
@@ -390,7 +390,7 @@ static gboolean frida_spawn_instance_is_libc_initialized (FridaSpawnInstance * s
 static void frida_spawn_instance_set_libc_initialized (FridaSpawnInstance * self);
 static kern_return_t frida_spawn_instance_create_dyld_data (FridaSpawnInstance * self);
 static void frida_spawn_instance_destroy_dyld_data (FridaSpawnInstance * self);
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 static gboolean frida_pick_ios_tvos_bootstrapper (GumModule * module, gpointer user_data);
 #endif
 static void frida_spawn_instance_unset_helpers (FridaSpawnInstance * self);
@@ -405,9 +405,6 @@ static void frida_spawn_instance_disable_nth_breakpoint (FridaSpawnInstance * se
 static guint32 frida_spawn_instance_put_software_breakpoint (FridaSpawnInstance * self, GumAddress where, guint index);
 static guint32 frida_spawn_instance_overwrite_arm64_instruction (FridaSpawnInstance * self, GumAddress address, guint32 new_instruction);
 
-static void frida_make_pty (int fds[2]);
-static void frida_configure_terminal_attributes (gint fd);
-
 static FridaInjectInstance * frida_inject_instance_new (FridaDarwinHelperBackend * backend, guint id, guint pid);
 static FridaInjectInstance * frida_inject_instance_clone (const FridaInjectInstance * instance, guint id);
 static void frida_inject_instance_close (FridaInjectInstance * instance);
@@ -804,12 +801,17 @@ _frida_darwin_helper_backend_spawn (FridaDarwinHelperBackend * self, const gchar
   posix_spawnattr_t attributes;
   sigset_t signal_mask_set;
   short flags;
-  int stdin_pipe[2], stdout_pipe[2], stderr_pipe[2];
+  FridaFileDescriptor * in_fd = NULL;
+  FridaFileDescriptor * out_fd = NULL;
+  FridaFileDescriptor * err_fd = NULL;
+  GError * stdio_error = NULL;
   FridaAslr aslr = FRIDA_ASLR_AUTO;
   GVariant * aslr_value;
   gchar * old_cwd = NULL;
   int result, spawn_errno;
 
+  *pipes = NULL;
+
   instance = frida_spawn_instance_new (self);
 
   argv = frida_host_spawn_options_compute_argv (options, path, NULL);
@@ -823,33 +825,13 @@ _frida_darwin_helper_backend_spawn (FridaDarwinHelperBackend * self, const gchar
 
   flags = POSIX_SPAWN_SETPGROUP | POSIX_SPAWN_SETSIGMASK | POSIX_SPAWN_START_SUSPENDED;
 
-  switch (options->stdio)
-  {
-    case FRIDA_STDIO_INHERIT:
-      *pipes = NULL;
+  *pipes = frida_make_stdio_pipes (options->stdio, TRUE, &in_fd, NULL, &out_fd, NULL, &err_fd, NULL, &stdio_error);
+  if (stdio_error != NULL)
+    goto propagate_stdio_error;
 
-      posix_spawn_file_actions_adddup2 (&file_actions, 0, 0);
-      posix_spawn_file_actions_adddup2 (&file_actions, 1, 1);
-      posix_spawn_file_actions_adddup2 (&file_actions, 2, 2);
-
-      break;
-
-    case FRIDA_STDIO_PIPE:
-      frida_make_pty (stdin_pipe);
-      frida_make_pty (stdout_pipe);
-      frida_make_pty (stderr_pipe);
-
-      *pipes = frida_stdio_pipes_new (stdin_pipe[1], stdout_pipe[0], stderr_pipe[0]);
-
-      posix_spawn_file_actions_adddup2 (&file_actions, stdin_pipe[0], 0);
-      posix_spawn_file_actions_adddup2 (&file_actions, stdout_pipe[1], 1);
-      posix_spawn_file_actions_adddup2 (&file_actions, stderr_pipe[1], 2);
-
-      break;
-
-    default:
-      g_assert_not_reached ();
-  }
+  posix_spawn_file_actions_adddup2 (&file_actions, (in_fd != NULL) ? in_fd->handle : 0, 0);
+  posix_spawn_file_actions_adddup2 (&file_actions, (out_fd != NULL) ? out_fd->handle : 1, 1);
+  posix_spawn_file_actions_adddup2 (&file_actions, (err_fd != NULL) ? err_fd->handle : 2, 2);
 
   aslr_value = g_hash_table_lookup (options->aux, "aslr");
   if (aslr_value != NULL && !frida_parse_aslr_option (aslr_value, &aslr, error))
@@ -872,13 +854,6 @@ _frida_darwin_helper_backend_spawn (FridaDarwinHelperBackend * self, const gchar
   if (old_cwd != NULL)
     chdir (old_cwd);
 
-  if (options->stdio == FRIDA_STDIO_PIPE)
-  {
-    close (stdin_pipe[0]);
-    close (stdout_pipe[1]);
-    close (stderr_pipe[1]);
-  }
-
   posix_spawnattr_destroy (&attributes);
 
   posix_spawn_file_actions_destroy (&file_actions);
@@ -892,6 +867,11 @@ _frida_darwin_helper_backend_spawn (FridaDarwinHelperBackend * self, const gchar
 
   goto beach;
 
+propagate_stdio_error:
+  {
+    g_propagate_error (error, stdio_error);
+    goto early_failure;
+  }
 chdir_failed:
   {
     g_set_error (error,
@@ -936,12 +916,18 @@ any_failure:
       kill (instance->pid, SIGKILL);
     frida_spawn_instance_close (instance);
 
+    g_clear_object (pipes);
+
     pid = 0;
 
     goto beach;
   }
 beach:
   {
+    g_clear_object (&in_fd);
+    g_clear_object (&out_fd);
+    g_clear_object (&err_fd);
+
     g_free (old_cwd);
     g_strfreev (envp);
     g_strfreev (argv);
@@ -971,7 +957,7 @@ invalid_pid:
   }
 }
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 
 #import "springboard.h"
 
@@ -1057,6 +1043,8 @@ frida_darwin_helper_backend_launch_using_fbs (NSString * identifier, NSURL * url
   FridaSpringboardApi * api;
   NSMutableDictionary * debug_options, * open_options;
   FridaStdioPipes * pipes = NULL;
+  gchar * stdout_name = NULL;
+  gchar * stderr_name = NULL;
   GError * error = NULL;
   FridaAslr aslr = FRIDA_ASLR_AUTO;
   GVariant * aslr_value;
@@ -1092,22 +1080,12 @@ frida_darwin_helper_backend_launch_using_fbs (NSString * identifier, NSURL * url
   if (strlen (spawn_options->cwd) > 0)
     goto cwd_not_supported;
 
+  pipes = frida_make_stdio_pipes (spawn_options->stdio, FALSE, NULL, NULL, NULL, &stdout_name, NULL, &stderr_name, &error);
+  if (error != NULL)
+    goto failure;
+
   if (spawn_options->stdio == FRIDA_STDIO_PIPE)
   {
-    gint stdout_master, stdout_slave, stderr_master, stderr_slave;
-    gchar stdout_name[PATH_MAX], stderr_name[PATH_MAX];
-
-    openpty (&stdout_master, &stdout_slave, stdout_name, NULL, NULL);
-    openpty (&stderr_master, &stderr_slave, stderr_name, NULL, NULL);
-
-    pipes = frida_stdio_pipes_new (-1, stdout_master, stderr_master);
-
-    frida_configure_terminal_attributes (stdout_master);
-    frida_configure_terminal_attributes (stderr_master);
-
-    frida_stdio_pipes_retain (pipes, stdout_slave);
-    frida_stdio_pipes_retain (pipes, stderr_slave);
-
     chmod (stdout_name, 0666);
     chmod (stderr_name, 0666);
 
@@ -1174,7 +1152,7 @@ frida_darwin_helper_backend_launch_using_fbs (NSString * identifier, NSURL * url
     }
   });
 
-  return;
+  goto beach;
 
 envp_not_supported:
   {
@@ -1195,6 +1173,16 @@ cwd_not_supported:
 failure:
   {
     on_complete (NULL, error, on_complete_target);
+
+    g_clear_object (&pipes);
+
+    goto beach;
+  }
+beach:
+  {
+    g_free (stdout_name);
+    g_free (stderr_name);
+
     return;
   }
 }
@@ -1881,7 +1869,7 @@ _frida_darwin_helper_backend_prepare_spawn_instance_for_injection (FridaDarwinHe
   mach_msg_type_number_t state_count = GUM_DARWIN_THREAD_STATE_COUNT;
   thread_state_flavor_t state_flavor = GUM_DARWIN_THREAD_STATE_FLAVOR;
   GumAddress dyld_start, dyld_granularity, dyld_chunk, dyld_header;
-  GumAddress modern_entry_address, legacy_entry_address;
+  GumAddress modern_entry_address, legacy_entry_address, sim_notify_address;
   const gchar * launch_with_closure_names[] = {
     "__ZN4dyldL17launchWithClosureEPKN5dyld37closure13LaunchClosureEPK15DyldSharedCachePKNS0_11MachOLoadedEmiPPKcSD_SD_R11DiagnosticsPmSG_PbSH_",
     "__ZN4dyldL17launchWithClosureEPKN5dyld312launch_cache13binary_format7ClosureEPK15DyldSharedCachePK11mach_headermiPPKcSE_SE_PmSF_",
@@ -2101,6 +2089,9 @@ _frida_darwin_helper_backend_prepare_spawn_instance_for_injection (FridaDarwinHe
       instance->ret_gadget |= 1;
   }
 
+  sim_notify_address = gum_darwin_module_resolve_symbol_address (dyld, "__ZN5dyld4L29sim_notifyMonitorOfMainCalledEv");
+  instance->sim_notify_address = sim_notify_address;
+
   instance->ret_state = FRIDA_RET_FROM_HELPER;
 
   kr = frida_get_debug_state (child_thread, &instance->previous_debug_state, instance->cpu_type);
@@ -2112,6 +2103,8 @@ _frida_darwin_helper_backend_prepare_spawn_instance_for_injection (FridaDarwinHe
     frida_spawn_instance_set_nth_breakpoint (instance, i++, legacy_entry_address, FRIDA_BREAKPOINT_REPEAT_ALWAYS);
   if (modern_entry_address != 0)
     frida_spawn_instance_set_nth_breakpoint (instance, i++, modern_entry_address, FRIDA_BREAKPOINT_REPEAT_ALWAYS);
+  if (sim_notify_address != 0)
+    frida_spawn_instance_set_nth_breakpoint (instance, i++, sim_notify_address, FRIDA_BREAKPOINT_REPEAT_ALWAYS);
   if (instance->dyld_flavor == FRIDA_DYLD_V4_PLUS)
   {
     GumAddress restart_with_dyld_in_cache = gum_darwin_module_resolve_symbol_address (dyld,
@@ -2669,7 +2662,7 @@ frida_inject_instance_on_mach_thread_dead (void * context)
 
     self->agent_context->posix_thread = MACH_PORT_NULL;
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
     port_might_be_guarded = gum_darwin_check_xnu_version (7938, 0, 0);
 #else
     port_might_be_guarded = FALSE;
@@ -3104,7 +3097,11 @@ frida_spawn_instance_handle_breakpoint (FridaSpawnInstance * self, FridaBreakpoi
 
   if (self->breakpoint_phase == FRIDA_BREAKPOINT_DETECT_FLAVOR)
   {
-    if (self->dyld_flavor == FRIDA_DYLD_V4_PLUS)
+    if (pc == self->sim_notify_address)
+    {
+      self->breakpoint_phase = FRIDA_BREAKPOINT_LIBSYSTEM_INITIALIZED;
+    }
+    else if (self->dyld_flavor == FRIDA_DYLD_V4_PLUS)
     {
       if (pc == self->modern_entry_address)
       {
@@ -3284,7 +3281,7 @@ next_phase:
       return TRUE;
 
     case FRIDA_BREAKPOINT_DLOPEN_BOOTSTRAPPER:
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
       if (self->bootstrapper_name != 0)
       {
         frida_spawn_instance_set_libc_initialized (self);
@@ -3577,7 +3574,7 @@ frida_spawn_instance_create_dyld_data (FridaSpawnInstance * self)
   if (!gum_darwin_query_ptrauth_support (self->task, &ptrauth_support))
     return KERN_FAILURE;
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   gum_darwin_enumerate_modules (self->task, frida_pick_ios_tvos_bootstrapper, &data);
 #endif
 
@@ -3655,7 +3652,7 @@ frida_spawn_instance_destroy_dyld_data (FridaSpawnInstance * self)
   self->dyld_data = 0;
 }
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 
 static gboolean
 frida_pick_ios_tvos_bootstrapper (GumModule * module, gpointer user_data)
@@ -4065,44 +4062,6 @@ frida_spawn_instance_overwrite_arm64_instruction (FridaSpawnInstance * self, Gum
   return original_instruction;
 }
 
-static void
-frida_make_pty (int fds[2])
-{
-  gboolean pipe_opened;
-  int i;
-
-  pipe_opened = openpty (&fds[0], &fds[1], NULL, NULL, NULL) != -1;
-  g_assert (pipe_opened);
-
-  for (i = 0; i != 2; i++)
-  {
-    const int fd = fds[i];
-    int res;
-
-    res = fcntl (fd, F_SETFD, fcntl (fd, F_GETFD) | FD_CLOEXEC);
-    g_assert (res == 0);
-
-    res = fcntl (fd, F_SETNOSIGPIPE, TRUE);
-    g_assert (res == 0);
-  }
-
-  frida_configure_terminal_attributes (fds[0]);
-}
-
-static void
-frida_configure_terminal_attributes (gint fd)
-{
-  struct termios tios;
-
-  tcgetattr (fd, &tios);
-
-  tios.c_oflag &= ~ONLCR;
-  tios.c_cflag = (tios.c_cflag & CLOCAL) | CS8 | CREAD | HUPCL;
-  tios.c_lflag &= ~ECHO;
-
-  tcsetattr (fd, 0, &tios);
-}
-
 static FridaInjectInstance *
 frida_inject_instance_new (FridaDarwinHelperBackend * backend, guint id, guint pid)
 {
@@ -5449,7 +5408,7 @@ frida_set_hardware_single_step (gpointer debug_state, GumDarwinUnifiedThreadStat
 static gboolean
 frida_is_hardware_breakpoint_support_working (void)
 {
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   static gsize cached_result = 0;
 
   if (g_once_init_enter (&cached_result))

src/darwin/frida-helper-backend.vala

@@ -136,9 +136,9 @@ namespace Frida {
 			ChildWatch.add ((Pid) child_pid, on_child_dead);
 
 			if (pipes != null) {
-				stdin_streams[child_pid] = new UnixOutputStream (pipes.input, false);
-				process_next_output_from.begin (new UnixInputStream (pipes.output, false), child_pid, 1, pipes);
-				process_next_output_from.begin (new UnixInputStream (pipes.error, false), child_pid, 2, pipes);
+				stdin_streams[child_pid] = pipes.input;
+				process_next_output_from.begin (pipes.output, child_pid, 1, pipes);
+				process_next_output_from.begin (pipes.error, child_pid, 2, pipes);
 			}
 
 			return child_pid;
@@ -180,10 +180,8 @@ namespace Frida {
 
 			var pipes = pending.pipes;
 			if (pipes != null) {
-				pipes.clear_retained ();
-
-				process_next_output_from.begin (new UnixInputStream (pipes.output, false), pid, 1, pipes);
-				process_next_output_from.begin (new UnixInputStream (pipes.error, false), pid, 2, pipes);
+				process_next_output_from.begin (pipes.output, pid, 1, pipes);
+				process_next_output_from.begin (pipes.error, pid, 2, pipes);
 			}
 		}
 
@@ -439,8 +437,11 @@ namespace Frida {
 
 		private bool is_booting (uint task) throws Error {
 			Gum.Darwin.AllImageInfos infos;
-			if (!Gum.Darwin.query_all_image_infos (task, out infos))
-				throw new Error.PROCESS_NOT_FOUND ("Target process died unexpectedly");
+			try {
+				Gum.Darwin.query_all_image_infos (task, out infos);
+			} catch (Gum.Error e) {
+				throw new Error.PROCESS_NOT_FOUND ("%s", e.message);
+			}
 
 			return !infos.libsystem_initialized;
 		}
@@ -888,57 +889,4 @@ namespace Frida {
 			return false;
 		}
 	}
-
-	public sealed class StdioPipes : Object {
-		public int input {
-			get;
-			construct;
-		}
-
-		public int output {
-			get;
-			construct;
-		}
-
-		public int error {
-			get;
-			construct;
-		}
-
-		private int[] retained = {};
-
-		public StdioPipes (int input, int output, int error) {
-			Object (input: input, output: output, error: error);
-		}
-
-		construct {
-			try {
-				if (input != -1)
-					Unix.set_fd_nonblocking (input, true);
-				Unix.set_fd_nonblocking (output, true);
-				Unix.set_fd_nonblocking (error, true);
-			} catch (GLib.Error e) {
-				assert_not_reached ();
-			}
-		}
-
-		~StdioPipes () {
-			clear_retained ();
-
-			if (input != -1)
-				Posix.close (input);
-			Posix.close (output);
-			Posix.close (error);
-		}
-
-		public void clear_retained () {
-			foreach (var fd in retained)
-				Posix.close (fd);
-			retained = {};
-		}
-
-		public void retain (int fd) {
-			retained += fd;
-		}
-	}
 }

src/darwin/frida-helper-process.vala

@@ -314,6 +314,9 @@ namespace Frida {
 
 			SocketService? service = null;
 			TimeoutSource? timeout_source = null;
+			bool timed_out = false;
+			bool child_exited = false;
+			int child_status = 0;
 
 			try {
 				string tempdir;
@@ -341,7 +344,6 @@ namespace Frida {
 					return false;
 				});
 				idle_source.attach (main_context);
-
 				yield;
 
 				var incoming_handler = service.incoming.connect ((c) => {
@@ -350,42 +352,63 @@ namespace Frida {
 					return true;
 				});
 
-				var timer = new Timer ();
-				timeout_source = new TimeoutSource (10);
+				timeout_source = new TimeoutSource.seconds (10);
 				timeout_source.set_callback (() => {
+					timed_out = true;
 					launch_helper.callback ();
-					return Source.CONTINUE;
+					return Source.REMOVE;
 				});
 				timeout_source.attach (main_context);
 
 				string[] argv = { helper_path, socket_address };
 
-				GLib.SpawnFlags flags = GLib.SpawnFlags.LEAVE_DESCRIPTORS_OPEN | /* GLib.SpawnFlags.CLOEXEC_PIPES */ 256;
+				GLib.SpawnFlags flags =
+					GLib.SpawnFlags.LEAVE_DESCRIPTORS_OPEN |
+					GLib.SpawnFlags.DO_NOT_REAP_CHILD |
+					/* GLib.SpawnFlags.CLOEXEC_PIPES */ 256;
+
 				GLib.Process.spawn_async (null, argv, null, flags, null, out pending_pid);
 
-				while (pending_stream == null && timer.elapsed () < 10.0 && !process_is_dead (pending_pid))
+				var exit_monitor = new ChildExitMonitor (pending_pid, main_context);
+				var exit_handler = exit_monitor.exited.connect ((status) => {
+					child_exited = true;
+					child_status = status;
+					launch_helper.callback ();
+				});
+
+				while (pending_stream == null && !timed_out && !child_exited)
 					yield;
 
+				exit_monitor.disconnect (exit_handler);
+				exit_monitor.stop ();
+
+				timeout_source.destroy ();
+				timeout_source = null;
+
 				service.disconnect (incoming_handler);
 				service.stop ();
 				service = null;
-				timeout_source.destroy ();
-				timeout_source = null;
 
-				if (pending_stream == null)
-					throw new Error.TIMED_OUT ("Unexpectedly timed out while spawning helper process");
+				if (pending_stream == null) {
+					if (child_exited)
+						throw new Error.PROCESS_NOT_FOUND ("Helper exited during launch (status=%d)", child_status);
+					if (timed_out)
+						throw new Error.TIMED_OUT ("Unexpectedly timed out while spawning helper");
+				}
 
 				pending_connection = yield new DBusConnection (pending_stream, ServerGuid.HOST_SESSION_SERVICE,
 					AUTHENTICATION_SERVER | AUTHENTICATION_ALLOW_ANONYMOUS, null, cancellable);
+
 				pending_proxy = yield pending_connection.get_proxy (null, ObjectPath.HELPER, DO_NOT_LOAD_PROPERTIES,
 					cancellable);
+
 				if (pending_connection.is_closed ())
 					throw new Error.NOT_SUPPORTED ("Helper terminated prematurely");
 			} catch (GLib.Error e) {
-				bool died_unexpectedly = pending_pid != 0 && process_is_dead (pending_pid);
-
-				if (pending_pid != 0 && !died_unexpectedly)
+				if (pending_pid != 0 && !child_exited) {
 					Posix.kill ((Posix.pid_t) pending_pid, Posix.Signal.KILL);
+					reap_later.begin (pending_pid);
+				}
 
 				if (timeout_source != null)
 					timeout_source.destroy ();
@@ -393,10 +416,6 @@ namespace Frida {
 				if (service != null)
 					service.stop ();
 
-				if (died_unexpectedly) {
-					throw new Error.PROCESS_NOT_FOUND ("Peer process (%d) died unexpectedly: %s",
-						pending_pid, e.message);
-				}
 				if (e is Error)
 					throw (Error) e;
 				throw new Error.PERMISSION_DENIED ("%s", e.message);
@@ -422,10 +441,6 @@ namespace Frida {
 			return proxy;
 		}
 
-		private static bool process_is_dead (uint pid) {
-			return Posix.kill ((Posix.pid_t) pid, 0) == -1 && Posix.errno == Posix.ESRCH;
-		}
-
 		private void on_connection_closed (bool remote_peer_vanished, GLib.Error? error) {
 			obtain_request = null;
 
@@ -441,7 +456,10 @@ namespace Frida {
 			connection.on_closed.disconnect (on_connection_closed);
 			connection = null;
 
+			Pid pid = process_pid;
 			process_pid = 0;
+			if (pid != 0)
+				reap_later.begin (pid);
 		}
 
 		private void on_output (uint pid, int fd, uint8[] data) {
@@ -559,4 +577,88 @@ namespace Frida {
 			return false;
 		}
 	}
+
+	private class ChildExitMonitor : Object {
+		public signal void exited (int status);
+
+		private Pid pid;
+		private MainContext? context;
+
+		private TimeoutSource? source;
+
+		private uint interval_ms = 10;
+		private const uint MAX_INTERVAL_MS = 1000;
+
+		public ChildExitMonitor (Pid pid, MainContext? ctx = null) {
+			this.pid = pid;
+
+			context = ctx ?? MainContext.get_thread_default ();
+
+			arm ();
+		}
+
+		public void stop () {
+			if (source != null) {
+				source.destroy ();
+				source = null;
+			}
+		}
+
+		private void arm () {
+			source = new TimeoutSource (interval_ms);
+			source.set_callback (() => {
+				int status;
+				if (try_reap (pid, out status)) {
+					stop ();
+					exited (status);
+					return Source.REMOVE;
+				}
+
+				if (interval_ms < MAX_INTERVAL_MS) {
+					interval_ms = uint.min (MAX_INTERVAL_MS, 2 * interval_ms);
+					stop ();
+					arm ();
+					return Source.REMOVE;
+				}
+
+				return Source.CONTINUE;
+			});
+			source.attach (context);
+		}
+
+		private static bool try_reap (Pid pid, out int status) {
+			status = 0;
+			var r = Posix.waitpid ((Posix.pid_t) pid, out status, Posix.WNOHANG);
+			if (r > 0)
+				return true;
+			if (r == 0)
+				return false;
+
+			if (Posix.errno == Posix.EINTR)
+				return false;
+
+			if (Posix.errno == Posix.ECHILD)
+				return true;
+
+			return true;
+		}
+	}
+
+	private async void reap_later (Pid pid) {
+		var monitor = new ChildExitMonitor (pid);
+
+		bool done = false;
+		ulong h = monitor.exited.connect ((status) => {
+			done = true;
+			reap_later.callback ();
+		});
+
+		try {
+			while (!done)
+				yield;
+		} finally {
+			monitor.disconnect (h);
+			monitor.stop ();
+		}
+	}
 }

src/darwin/policy-softener-glue.c

@@ -1,6 +1,6 @@
 #include "frida-helper-backend.h"
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 # include "policyd.h"
 # include "substituted-client.h"
 # include "substituted2-client.h"

src/darwin/springboard.m

@@ -109,8 +109,6 @@ _frida_get_springboard_api (void)
         gum_interceptor_replace (interceptor, frida_xpc_look_up_endpoint, frida_replacement_xpc_look_up_endpoint, NULL, NULL);
       else
         g_error ("Unable to locate _xpc_look_up_endpoint(); please file a bug");
-
-      g_object_unref (interceptor);
     }
 #endif
 

src/darwin/system-darwin.m

@@ -16,11 +16,11 @@
 # endif
 #endif
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 # import "springboard.h"
 #endif
 
-#if defined (HAVE_WATCHOS) || defined (HAVE_TVOS)
+#if defined (HAVE_WATCHOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 # import <Foundation/Foundation.h>
 #endif
 
@@ -35,7 +35,7 @@ struct _FridaEnumerateApplicationsOperation
 {
   FridaScope scope;
   GHashTable * process_by_identifier;
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   FridaSpringboardApi * api;
 #endif
 
@@ -45,14 +45,14 @@ struct _FridaEnumerateApplicationsOperation
 struct _FridaEnumerateProcessesOperation
 {
   FridaScope scope;
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   FridaSpringboardApi * api;
 #endif
 
   GArray * result;
 };
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 static void frida_collect_application_info_from_id_cstring (const gchar * identifier, FridaEnumerateApplicationsOperation * op);
 static void frida_collect_application_info_from_id_nsstring (NSString * identifier, FridaEnumerateApplicationsOperation * op);
 #endif
@@ -60,13 +60,13 @@ static void frida_collect_application_info_from_id_nsstring (NSString * identifi
 static void frida_collect_process_info_from_pid (guint pid, FridaEnumerateProcessesOperation * op);
 static void frida_collect_process_info_from_kinfo (struct kinfo_proc * process, FridaEnumerateProcessesOperation * op);
 
-#if defined (HAVE_MACOS) || defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_MACOS) || defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 static void frida_add_app_id (GHashTable * parameters, NSString * identifier);
 #endif
 
 #if defined (HAVE_MACOS)
 static void frida_add_app_icons (GHashTable * parameters, NSImage * image);
-#elif defined (HAVE_IOS) || defined (HAVE_TVOS)
+#elif defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 static void frida_add_app_metadata (GHashTable * parameters, NSString * identifier, FridaSpringboardApi * api);
 static void frida_add_app_state (GHashTable * parameters, guint pid, FridaSpringboardApi * api);
 static void frida_add_app_icons (GHashTable * parameters, NSString * identifier);
@@ -100,7 +100,7 @@ frida_system_enumerate_applications (FridaApplicationQueryOptions * options, int
   return NULL;
 }
 
-#elif defined (HAVE_IOS) || defined (HAVE_TVOS)
+#elif defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 
 void
 frida_system_get_frontmost_application (FridaFrontmostQueryOptions * options, FridaHostApplicationInfo * result, GError ** error)
@@ -306,7 +306,7 @@ frida_system_enumerate_processes (FridaProcessQueryOptions * options, int * resu
   NSAutoreleasePool * pool;
 
   op.scope = frida_process_query_options_get_scope (options);
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   op.api = _frida_get_springboard_api ();
 #endif
 
@@ -395,7 +395,7 @@ frida_collect_process_info_from_kinfo (struct kinfo_proc * process, FridaEnumera
         frida_add_app_icons (info.parameters, app.icon);
     }
   }
-#elif defined (HAVE_IOS) || defined (HAVE_TVOS)
+#elif defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   {
     FridaSpringboardApi * api = op->api;
     NSString * identifier;
@@ -469,7 +469,7 @@ frida_temporary_directory_get_system_tmp (void)
   }
 }
 
-#if defined (HAVE_MACOS) || defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_MACOS) || defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 
 static void
 frida_add_app_id (GHashTable * parameters, NSString * identifier)
@@ -489,7 +489,7 @@ static void
 frida_add_app_icons (GHashTable * parameters, NSImage * image)
 {
   GVariantBuilder builder;
-  const guint sizes[] = { 16, 32 };
+  const guint sizes[] = { 128 };
   guint i;
 
   g_variant_builder_init (&builder, G_VARIANT_TYPE ("aa{sv}"));
@@ -541,7 +541,7 @@ frida_add_app_icons (GHashTable * parameters, NSImage * image)
   g_hash_table_insert (parameters, g_strdup ("icons"), g_variant_ref_sink (g_variant_builder_end (&builder)));
 }
 
-#elif defined (HAVE_IOS) || defined (HAVE_TVOS)
+#elif defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 
 static void
 frida_add_app_metadata (GHashTable * parameters, NSString * identifier, FridaSpringboardApi * api)