subprojects: Prepare for release

Switch to a fixed-slot NDP layout to eliminate the slow O(k²) "shrink
until it fits" algorithm. The new packer runs in O(k) time and stops
adding datagrams when the NTB max size would be exceeded.

This greatly reduces CPU time spent building NTBs, dropping total layout
time from ~1.1s to negligible levels for a 256 MiB transfer on a modern
desktop.

.gitignore

@@ -1,5 +1,7 @@
 /build/
 /deps/
+/src/barebone/agent/target/
+/src/barebone/agent/xpacks/
 /src/barebone/helpers/memory-scanner/target/
 /src/barebone/helpers/target/
 /src/barebone/node_modules/

lib/base/buffer-glue.c

@@ -0,0 +1,12 @@
+#include "frida-base.h"
+
+GBytes *
+frida_make_bytes_with_owner (GType t_type,
+                             GBoxedCopyFunc t_dup_func,
+                             GDestroyNotify t_destroy_func,
+                             void * data,
+                             gsize size,
+                             gpointer owner)
+{
+  return g_bytes_new_with_free_func (data, size, t_destroy_func, owner);
+}

lib/base/buffer.vala

@@ -356,10 +356,20 @@ namespace Frida {
 			return *((int8 *) get_pointer (offset, sizeof (int8)));
 		}
 
+		public unowned Buffer write_int8 (size_t offset, int8 val) {
+			*((int8 *) get_pointer (offset, sizeof (int8))) = val;
+			return this;
+		}
+
 		public uint8 read_uint8 (size_t offset) {
 			return *get_pointer (offset, sizeof (uint8));
 		}
 
+		public unowned Buffer write_uint8 (size_t offset, uint8 val) {
+			*((uint8 *) get_pointer (offset, sizeof (uint8))) = val;
+			return this;
+		}
+
 		public int16 read_int16 (size_t offset) {
 			int16 val = *((int16 *) get_pointer (offset, sizeof (int16)));
 			return (byte_order == BIG_ENDIAN)
@@ -367,6 +377,14 @@ namespace Frida {
 				: int16.from_little_endian (val);
 		}
 
+		public unowned Buffer write_int16 (size_t offset, int16 val) {
+			int16 target_val = (byte_order == BIG_ENDIAN)
+				? val.to_big_endian ()
+				: val.to_little_endian ();
+			*((int16 *) get_pointer (offset, sizeof (int16))) = target_val;
+			return this;
+		}
+
 		public uint16 read_uint16 (size_t offset) {
 			uint16 val = *((uint16 *) get_pointer (offset, sizeof (uint16)));
 			return (byte_order == BIG_ENDIAN)
@@ -374,6 +392,14 @@ namespace Frida {
 				: uint16.from_little_endian (val);
 		}
 
+		public unowned Buffer write_uint16 (size_t offset, uint16 val) {
+			uint16 target_val = (byte_order == BIG_ENDIAN)
+				? val.to_big_endian ()
+				: val.to_little_endian ();
+			*((uint16 *) get_pointer (offset, sizeof (uint16))) = target_val;
+			return this;
+		}
+
 		public int32 read_int32 (size_t offset) {
 			int32 val = *((int32 *) get_pointer (offset, sizeof (int32)));
 			return (byte_order == BIG_ENDIAN)
@@ -381,6 +407,14 @@ namespace Frida {
 				: int32.from_little_endian (val);
 		}
 
+		public unowned Buffer write_int32 (size_t offset, int32 val) {
+			int32 target_val = (byte_order == BIG_ENDIAN)
+				? val.to_big_endian ()
+				: val.to_little_endian ();
+			*((int32 *) get_pointer (offset, sizeof (int32))) = target_val;
+			return this;
+		}
+
 		public uint32 read_uint32 (size_t offset) {
 			uint32 val = *((uint32 *) get_pointer (offset, sizeof (uint32)));
 			return (byte_order == BIG_ENDIAN)
@@ -403,6 +437,14 @@ namespace Frida {
 				: int64.from_little_endian (val);
 		}
 
+		public unowned Buffer write_int64 (size_t offset, int64 val) {
+			int64 target_val = (byte_order == BIG_ENDIAN)
+				? val.to_big_endian ()
+				: val.to_little_endian ();
+			*((int64 *) get_pointer (offset, sizeof (int64))) = target_val;
+			return this;
+		}
+
 		public uint64 read_uint64 (size_t offset) {
 			uint64 val = *((uint64 *) get_pointer (offset, sizeof (uint64)));
 			return (byte_order == BIG_ENDIAN)
@@ -465,6 +507,18 @@ namespace Frida {
 			return this;
 		}
 
+		public Bytes read_bytes (size_t offset, size_t size) {
+			var data = new uint8[size + 1];
+			Memory.copy (data, get_pointer (offset, size), size);
+			return new Bytes.take ((owned) data);
+		}
+
+		public unowned Buffer write_bytes (size_t offset, Bytes bytes) {
+			size_t size = bytes.get_size ();
+			Memory.copy (get_pointer (offset, size), bytes.get_data (), size);
+			return this;
+		}
+
 		private uint8 * get_pointer (size_t offset, size_t n) {
 			size_t minimum_size = offset + n;
 			assert (size >= minimum_size);
@@ -474,121 +528,127 @@ namespace Frida {
 	}
 
 	public sealed class BufferReader {
+		public size_t offset {
+			get {
+				return _offset;
+			}
+		}
+
 		public size_t available {
 			get {
-				return buffer.bytes.get_size () - offset;
+				return buffer.bytes.get_size () - _offset;
 			}
 		}
 
 		private Buffer buffer;
-		private size_t offset = 0;
+		private size_t _offset = 0;
 
 		public BufferReader (Buffer buf) {
 			buffer = buf;
 		}
 
-		public uint64 read_pointer (size_t offset) throws Error {
+		public uint64 read_pointer () throws Error {
 			var pointer_size = buffer.pointer_size;
 			check_available (pointer_size);
-			var ptr = buffer.read_pointer (offset);
-			offset += pointer_size;
+			var ptr = buffer.read_pointer (_offset);
+			_offset += pointer_size;
 			return ptr;
 		}
 
 		public int8 read_int8 () throws Error {
 			check_available (sizeof (int8));
-			var val = buffer.read_int8 (offset);
-			offset += sizeof (int8);
+			var val = buffer.read_int8 (_offset);
+			_offset += sizeof (int8);
 			return val;
 		}
 
 		public uint8 read_uint8 () throws Error {
 			check_available (sizeof (uint8));
-			var val = buffer.read_uint8 (offset);
-			offset += sizeof (uint8);
+			var val = buffer.read_uint8 (_offset);
+			_offset += sizeof (uint8);
 			return val;
 		}
 
 		public int16 read_int16 () throws Error {
 			check_available (sizeof (int16));
-			var val = buffer.read_int16 (offset);
-			offset += sizeof (int16);
+			var val = buffer.read_int16 (_offset);
+			_offset += sizeof (int16);
 			return val;
 		}
 
 		public uint16 read_uint16 () throws Error {
 			check_available (sizeof (uint16));
-			var val = buffer.read_uint16 (offset);
-			offset += sizeof (uint16);
+			var val = buffer.read_uint16 (_offset);
+			_offset += sizeof (uint16);
 			return val;
 		}
 
 		public int32 read_int32 () throws Error {
 			check_available (sizeof (int32));
-			var val = buffer.read_int32 (offset);
-			offset += sizeof (int32);
+			var val = buffer.read_int32 (_offset);
+			_offset += sizeof (int32);
 			return val;
 		}
 
 		public uint32 read_uint32 () throws Error {
 			check_available (sizeof (uint32));
-			var val = buffer.read_uint32 (offset);
-			offset += sizeof (uint32);
+			var val = buffer.read_uint32 (_offset);
+			_offset += sizeof (uint32);
 			return val;
 		}
 
 		public int64 read_int64 () throws Error {
 			check_available (sizeof (int64));
-			var val = buffer.read_int64 (offset);
-			offset += sizeof (int64);
+			var val = buffer.read_int64 (_offset);
+			_offset += sizeof (int64);
 			return val;
 		}
 
 		public uint64 read_uint64 () throws Error {
 			check_available (sizeof (uint64));
-			var val = buffer.read_uint64 (offset);
-			offset += sizeof (uint64);
+			var val = buffer.read_uint64 (_offset);
+			_offset += sizeof (uint64);
 			return val;
 		}
 
 		public float read_float () throws Error {
 			check_available (sizeof (float));
-			var val = buffer.read_float (offset);
-			offset += sizeof (float);
+			var val = buffer.read_float (_offset);
+			_offset += sizeof (float);
 			return val;
 		}
 
 		public double read_double () throws Error {
 			check_available (sizeof (double));
-			var val = buffer.read_double (offset);
-			offset += sizeof (double);
+			var val = buffer.read_double (_offset);
+			_offset += sizeof (double);
 			return val;
 		}
 
 		public string read_string () throws Error {
 			check_available (1);
-			var val = buffer.read_string (offset);
-			offset += val.length + 1;
+			var val = buffer.read_string (_offset);
+			_offset += val.length + 1;
 			return val;
 		}
 
 		public string read_fixed_string (size_t size) throws Error {
 			check_available (size);
-			var val = buffer.read_fixed_string (offset, size);
-			offset += size;
+			var val = buffer.read_fixed_string (_offset, size);
+			_offset += size;
 			return val;
 		}
 
 		public Bytes read_bytes (size_t size) throws Error {
 			check_available (size);
-			var val = buffer.bytes[offset:offset + size];
-			offset += size;
+			var val = buffer.bytes[_offset:_offset + size];
+			_offset += size;
 			return val;
 		}
 
 		public unowned BufferReader skip (size_t n) throws Error {
 			check_available (n);
-			offset += n;
+			_offset += n;
 			return this;
 		}
 
@@ -597,4 +657,6 @@ namespace Frida {
 				throw new Error.PROTOCOL ("Malformed buffer: truncated");
 		}
 	}
+
+	public extern Bytes make_bytes_with_owner<T> (void * data, size_t size, owned T? owner = null);
 }

lib/base/meson.build

@@ -13,6 +13,7 @@ base_sources = [
   'socket.vala',
   'socket-glue.c',
   'buffer.vala',
+  'buffer-glue.c',
   'value.vala',
 ]
 

lib/base/session-glue.c

@@ -30,7 +30,7 @@ _frida_query_windows_computer_name (void)
   return g_utf16_to_utf8 (buffer, -1, NULL, NULL, NULL);
 }
 
-#elif defined (HAVE_IOS) || defined (HAVE_TVOS)
+#elif defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 
 #include <CoreFoundation/CoreFoundation.h>
 #include <dlfcn.h>

lib/base/session.vala

@@ -749,6 +749,19 @@ namespace Frida {
 		}
 	}
 
+	[DBus (name = "re.frida.GadgetSession17")]
+	public interface GadgetSession : Object {
+		public abstract async void break_and_resume (Cancellable? cancellable) throws GLib.Error;
+		public abstract async void break_and_detach (Cancellable? cancellable) throws GLib.Error;
+	}
+
+	public enum GadgetBreakpointAction {
+		INVOKE_RETURN,
+		RESUME,
+		DETACH,
+		PAGE_PLAN,
+	}
+
 	[DBus (name = "re.frida.Channel17")]
 	public interface Channel : Object {
 		public abstract async void close (Cancellable? cancellable) throws GLib.Error;
@@ -1952,6 +1965,8 @@ namespace Frida {
 		id = "watchos";
 #elif TVOS
 		id = "tvos";
+#elif XROS
+		id = "xros";
 #elif ANDROID
 		id = "android";
 #elif FREEBSD
@@ -2119,6 +2134,7 @@ namespace Frida {
 		public const string AGENT_SESSION = "/re/frida/AgentSession";
 		public const string AGENT_CONTROLLER = "/re/frida/AgentController";
 		public const string AGENT_MESSAGE_SINK = "/re/frida/AgentMessageSink";
+		public const string GADGET_SESSION = "/re/frida/GadgetSession";
 		public const string CHANNEL = "/re/frida/Channel";
 		public const string SERVICE = "/re/frida/Service";
 		public const string TRANSPORT_BROKER = "/re/frida/TransportBroker";

lib/gadget/gadget-darwin.m

@@ -1,9 +1,25 @@
+#if defined (HAVE_TVOS) || defined (HAVE_WATCHOS)
+# include <Availability.h>
+# undef __TVOS_PROHIBITED
+# define __TVOS_PROHIBITED
+# undef __WATCHOS_PROHIBITED
+# define __WATCHOS_PROHIBITED
+#endif
+
 #include "frida-gadget.h"
 
+#include "frida-base.h"
+
 #import <Foundation/Foundation.h>
+#include <gum/gumdarwin.h>
+#include <mach-o/loader.h>
 #include <objc/runtime.h>
 #include <pthread.h>
 
+static void frida_on_breakpoints_steal_attempt (GumInvocationContext * ic, gpointer user_data);
+
+static GumInvocationListener * frida_dont_steal_my_breakpoints;
+
 gchar *
 frida_gadget_environment_detect_bundle_id (void)
 {
@@ -27,7 +43,7 @@ frida_gadget_environment_detect_bundle_name (void)
 gchar *
 frida_gadget_environment_detect_documents_dir (void)
 {
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   @autoreleasepool
   {
     NSArray<NSString *> * paths = NSSearchPathForDirectoriesInDomains (NSDocumentDirectory, NSUserDomainMask, YES);
@@ -51,3 +67,152 @@ frida_gadget_environment_set_thread_name (const gchar * name)
   /* For now only implemented on i/macOS as Fruity.Injector relies on it there. */
   pthread_setname_np (name);
 }
+
+void
+frida_gadget_environment_detect_darwin_location_fields (GumAddress our_address, gchar ** executable_name, gchar ** our_path,
+    GumMemoryRange ** our_range)
+{
+  mach_port_t task;
+  GumDarwinModuleResolver * resolver;
+  GPtrArray * modules;
+  guint i;
+
+  task = mach_task_self ();
+
+  resolver = gum_darwin_module_resolver_new (task, NULL);
+  if (resolver == NULL)
+    return;
+
+  gum_darwin_module_resolver_fetch_modules (resolver, &modules, NULL);
+
+  for (i = 0; i != modules->len; i++)
+  {
+    GumModule * module;
+    const GumMemoryRange * range;
+
+    module = g_ptr_array_index (modules, i);
+    range = gum_module_get_range (module);
+
+    if (*executable_name == NULL)
+    {
+      gum_mach_header_t * header = GSIZE_TO_POINTER (range->base_address);
+      if (header->filetype == MH_EXECUTE)
+        *executable_name = g_strdup (gum_module_get_name (module));
+    }
+
+    if (our_address >= range->base_address && our_address < range->base_address + range->size)
+    {
+      if (*our_path == NULL)
+        *our_path = g_strdup (gum_module_get_path (module));
+
+      if (*our_range == NULL)
+        *our_range = gum_memory_range_copy (range);
+    }
+
+    if (*executable_name != NULL && *our_path != NULL && *our_range != NULL)
+      break;
+  }
+
+  g_ptr_array_unref (modules);
+
+  g_object_unref (resolver);
+}
+
+void
+frida_gadget_environment_ensure_debugger_breakpoints_only (void)
+{
+  task_set_exception_ports (
+      mach_task_self (),
+      EXC_MASK_ALL & ~EXC_MASK_BREAKPOINT,
+      MACH_PORT_NULL,
+      EXCEPTION_DEFAULT,
+      THREAD_STATE_NONE
+  );
+
+  if (gum_process_get_code_signing_policy () == GUM_CODE_SIGNING_OPTIONAL &&
+      frida_dont_steal_my_breakpoints == NULL &&
+      gum_darwin_is_debugger_mapping_enforced ())
+  {
+    gpointer exceptions_set, exceptions_swap;
+    GumInterceptor * interceptor;
+
+    exceptions_set = &task_set_exception_ports;
+    exceptions_swap = &task_swap_exception_ports;
+
+    frida_dont_steal_my_breakpoints = gum_make_call_listener (frida_on_breakpoints_steal_attempt,
+      NULL, NULL, NULL);
+
+    interceptor = gum_interceptor_obtain ();
+
+    gum_interceptor_attach (interceptor, exceptions_set, frida_dont_steal_my_breakpoints,
+        NULL, GUM_ATTACH_FLAGS_NONE);
+    gum_interceptor_attach (interceptor, exceptions_swap, frida_dont_steal_my_breakpoints,
+        NULL, GUM_ATTACH_FLAGS_NONE);
+
+    g_object_unref (interceptor);
+  }
+}
+
+void
+frida_gadget_environment_allow_stolen_breakpoints (void)
+{
+  GumInterceptor * interceptor;
+
+  if (frida_dont_steal_my_breakpoints == NULL)
+    return;
+
+  interceptor = gum_interceptor_obtain ();
+
+  gum_interceptor_detach (interceptor, frida_dont_steal_my_breakpoints);
+
+  g_object_unref (frida_dont_steal_my_breakpoints);
+  frida_dont_steal_my_breakpoints = NULL;
+
+  g_object_unref (interceptor);
+}
+
+static void
+frida_on_breakpoints_steal_attempt (GumInvocationContext * ic, gpointer user_data)
+{
+  exception_mask_t exception_mask;
+
+  exception_mask = GPOINTER_TO_SIZE (gum_invocation_context_get_nth_argument (ic, 1));
+  exception_mask &= ~EXC_MASK_BREAKPOINT;
+  gum_invocation_context_replace_nth_argument (ic, 1, GSIZE_TO_POINTER (exception_mask));
+}
+
+void
+frida_gadget_environment_break_and_resume (void)
+{
+#ifdef HAVE_ARM64
+  asm volatile (
+      "mov x1, #1337\n\t"
+      "mov x2, #1337\n\t"
+      "mov x3, %0\n\t"
+      "brk #1337\n\t"
+      :
+      : "r" ((gsize) FRIDA_GADGET_BREAKPOINT_ACTION_RESUME)
+      : "x1", "x2", "x3"
+  );
+#else
+  g_assert_not_reached ();
+#endif
+}
+
+void
+frida_gadget_environment_break_and_detach (void)
+{
+#ifdef HAVE_ARM64
+  asm volatile (
+      "mov x1, #1337\n\t"
+      "mov x2, #1337\n\t"
+      "mov x3, %0\n\t"
+      "brk #1337\n\t"
+      :
+      : "r" ((gsize) FRIDA_GADGET_BREAKPOINT_ACTION_DETACH)
+      : "x1", "x2", "x3"
+  );
+#else
+  g_assert_not_reached ();
+#endif
+}

lib/gadget/gadget.vala

@@ -24,12 +24,6 @@ namespace Frida.Gadget {
 			default = Gum.CodeSigningPolicy.OPTIONAL;
 		}
 
-		private ObjectClass klass = (ObjectClass) typeof (Config).class_ref ();
-
-		public Json.Node serialize_property (string property_name, GLib.Value value, GLib.ParamSpec pspec) {
-			return default_serialize_property (property_name, value, pspec);
-		}
-
 		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
 			if (property_name == "interaction" && property_node.get_node_type () == Json.NodeType.OBJECT) {
 				var interaction_node = property_node.get_object ();
@@ -77,20 +71,6 @@ namespace Frida.Gadget {
 			value = Value (pspec.value_type);
 			return false;
 		}
-
-		public unowned ParamSpec? find_property (string name) {
-			return klass.find_property (name);
-		}
-
-		public new Value get_property (ParamSpec pspec) {
-			var val = Value (pspec.value_type);
-			base.get_property (pspec.name, ref val);
-			return val;
-		}
-
-		public new void set_property (ParamSpec pspec, Value value) {
-			base.set_property (pspec.name, value);
-		}
 	}
 
 	private sealed class ScriptInteraction : Object, Json.Serializable {
@@ -112,12 +92,6 @@ namespace Frida.Gadget {
 			default = Script.ChangeBehavior.IGNORE;
 		}
 
-		private ObjectClass klass = (ObjectClass) typeof (ScriptInteraction).class_ref ();
-
-		public Json.Node serialize_property (string property_name, GLib.Value value, GLib.ParamSpec pspec) {
-			return default_serialize_property (property_name, value, pspec);
-		}
-
 		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
 			if (property_name == "parameters" && property_node.get_node_type () == Json.NodeType.OBJECT) {
 				var v = Value (typeof (Json.Node));
@@ -129,20 +103,6 @@ namespace Frida.Gadget {
 			value = Value (pspec.value_type);
 			return false;
 		}
-
-		public unowned ParamSpec? find_property (string name) {
-			return klass.find_property (name);
-		}
-
-		public new Value get_property (ParamSpec pspec) {
-			var val = Value (pspec.value_type);
-			base.get_property (pspec.name, ref val);
-			return val;
-		}
-
-		public new void set_property (ParamSpec pspec, Value value) {
-			base.set_property (pspec.name, value);
-		}
 	}
 
 	private sealed class ScriptDirectoryInteraction : Object {
@@ -183,12 +143,6 @@ namespace Frida.Gadget {
 			default = Script.ChangeBehavior.IGNORE;
 		}
 
-		private ObjectClass klass = (ObjectClass) typeof (ScriptConfig).class_ref ();
-
-		public Json.Node serialize_property (string property_name, GLib.Value value, GLib.ParamSpec pspec) {
-			return default_serialize_property (property_name, value, pspec);
-		}
-
 		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
 			if (property_name == "parameters" && property_node.get_node_type () == Json.NodeType.OBJECT) {
 				var v = Value (typeof (Json.Node));
@@ -200,20 +154,6 @@ namespace Frida.Gadget {
 			value = Value (pspec.value_type);
 			return false;
 		}
-
-		public unowned ParamSpec? find_property (string name) {
-			return klass.find_property (name);
-		}
-
-		public new Value get_property (ParamSpec pspec) {
-			var val = Value (pspec.value_type);
-			base.get_property (pspec.name, ref val);
-			return val;
-		}
-
-		public new void set_property (ParamSpec pspec, Value value) {
-			base.set_property (pspec.name, value);
-		}
 	}
 
 	private sealed class ProcessFilter : Object {
@@ -299,8 +239,6 @@ namespace Frida.Gadget {
 			default = make_empty_json_object ();
 		}
 
-		private ObjectClass klass = (ObjectClass) typeof (ConnectInteraction).class_ref ();
-
 		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
 			if (property_name == "parameters" && property_node.get_node_type () == Json.NodeType.OBJECT) {
 				var v = Value (typeof (Json.Node));
@@ -312,20 +250,6 @@ namespace Frida.Gadget {
 			value = Value (pspec.value_type);
 			return false;
 		}
-
-		public unowned ParamSpec? find_property (string name) {
-			return klass.find_property (name);
-		}
-
-		public new Value get_property (ParamSpec pspec) {
-			var val = Value (pspec.value_type);
-			base.get_property (pspec.name, ref val);
-			return val;
-		}
-
-		public new void set_property (ParamSpec pspec, Value value) {
-			base.set_property (pspec.name, value);
-		}
 	}
 
 	private sealed class Location : Object {
@@ -481,6 +405,12 @@ namespace Frida.Gadget {
 
 		interceptor = Gum.Interceptor.obtain ();
 		interceptor.begin_transaction ();
+
+#if DARWIN
+		if (mapped_range != null)
+			Environment.ensure_debugger_breakpoints_only ();
+#endif
+
 		exceptor = Gum.Exceptor.obtain ();
 
 		try {
@@ -700,6 +630,11 @@ namespace Frida.Gadget {
 					controller = null;
 
 					exceptor = null;
+
+#if DARWIN
+					Environment.allow_stolen_breakpoints ();
+#endif
+
 					interceptor = null;
 				}
 			}
@@ -759,7 +694,7 @@ namespace Frida.Gadget {
 		}
 
 		try {
-			return Json.gobject_from_data (typeof (Config), config_data) as Config;
+			return (Config) Json.gobject_from_data (typeof (Config), config_data);
 		} catch (GLib.Error e) {
 			throw new Error.INVALID_ARGUMENT ("Invalid config: %s", e.message);
 		}
@@ -767,7 +702,7 @@ namespace Frida.Gadget {
 
 	private Config parse_config (string config_data) throws Error {
 		try {
-			return Json.gobject_from_data (typeof (Config), config_data) as Config;
+			return (Config) Json.gobject_from_data (typeof (Config), config_data);
 		} catch (GLib.Error e) {
 			throw new Error.INVALID_ARGUMENT ("Invalid config: %s", e.message);
 		}
@@ -775,21 +710,20 @@ namespace Frida.Gadget {
 
 	private Location detect_location (Gum.MemoryRange? mapped_range) {
 		string? executable_name = null;
-		string? executable_path = null;
-		Gum.MemoryRange? executable_range = null;
 		string? our_path = null;
 		Gum.MemoryRange? our_range = mapped_range;
 
 		Gum.Address our_address = Gum.Address.from_pointer (Gum.strip_code_pointer ((void *) detect_location));
 
+#if DARWIN
+		Environment.detect_darwin_location_fields (our_address, ref executable_name, ref our_path, ref our_range);
+#else
 		var index = 0;
 		Gum.Process.enumerate_modules ((details) => {
 			var range = details.range;
 
 			if (index == 0) {
 				executable_name = details.name;
-				executable_path = details.path;
-				executable_range = details.range;
 			}
 
 			if (mapped_range != null)
@@ -805,6 +739,7 @@ namespace Frida.Gadget {
 
 			return true;
 		});
+#endif
 
 		assert (our_range != null);
 
@@ -1234,7 +1169,7 @@ namespace Frida.Gadget {
 			}
 
 			try {
-				return Json.gobject_from_data (typeof (ScriptConfig), data) as ScriptConfig;
+				return (ScriptConfig) Json.gobject_from_data (typeof (ScriptConfig), data);
 			} catch (GLib.Error e) {
 				throw new Error.INVALID_ARGUMENT ("Invalid config: %s", e.message);
 			}
@@ -1748,7 +1683,7 @@ namespace Frida.Gadget {
 			}
 		}
 
-		private class ControlChannel : Object, Peer, HostSession {
+		private class ControlChannel : Object, Peer, HostSession, GadgetSession {
 			public weak ControlServer parent {
 				get;
 				construct;
@@ -1779,6 +1714,9 @@ namespace Frida.Gadget {
 					HostSession host_session = this;
 					registrations.add (connection.register_object (Frida.ObjectPath.HOST_SESSION, host_session));
 
+					GadgetSession gadget_session = this;
+					registrations.add (connection.register_object (Frida.ObjectPath.GADGET_SESSION, gadget_session));
+
 					AuthenticationService null_auth = new NullAuthenticationService ();
 					registrations.add (connection.register_object (Frida.ObjectPath.AUTHENTICATION_SERVICE, null_auth));
 				} catch (IOError e) {
@@ -1941,6 +1879,22 @@ namespace Frida.Gadget {
 				throw new Error.NOT_SUPPORTED ("Unable to open services when embedded");
 			}
 
+			public async void break_and_resume (Cancellable? cancellable) throws Error, IOError {
+#if DARWIN
+				Environment.break_and_resume ();
+#else
+				throw new Error.NOT_SUPPORTED ("This API is only applicable on Darwin");
+#endif
+			}
+
+			public async void break_and_detach (Cancellable? cancellable) throws Error, IOError {
+#if DARWIN
+				Environment.break_and_detach ();
+#else
+				throw new Error.NOT_SUPPORTED ("This API is only applicable on Darwin");
+#endif
+			}
+
 			private void validate_pid (uint pid) throws Error {
 				if (pid != this_process.pid)
 					throw new Error.NOT_SUPPORTED ("Unable to act on other processes when embedded");
@@ -2176,6 +2130,14 @@ namespace Frida.Gadget {
 		private extern bool has_objc_class (string name);
 
 		private extern void set_thread_name (string name);
+#if DARWIN
+		private extern void detect_darwin_location_fields (Gum.Address our_address, ref string? executable_name,
+			ref string? our_path, ref Gum.MemoryRange? our_range);
+		private extern void ensure_debugger_breakpoints_only ();
+		private extern void allow_stolen_breakpoints ();
+		private extern void break_and_resume ();
+		private extern void break_and_detach ();
+#endif
 	}
 
 	private extern void log_info (string message);

lib/payload/cloak.vala

@@ -44,11 +44,17 @@ namespace Frida {
 
 #if ANDROID
 	public sealed class ThreadCountCloaker : Object {
+		private GetOsThreadStat * get_os_thread_stat_slot;
+		private static GetOsThreadStat old_get_os_thread_stat_impl;
+
 		private ReadFunc * read_slot;
 		private static ReadFunc old_read_impl;
 
 		private static string expected_magic = "%u (".printf (Posix.getpid ());
 
+		[CCode (has_target = false)]
+		private delegate ssize_t GetOsThreadStat (Posix.pid_t tid, void * buf, size_t count);
+
 		[CCode (has_target = false)]
 		private delegate ssize_t ReadFunc (int fd, void * buf, size_t count);
 
@@ -56,39 +62,64 @@ namespace Frida {
 			var art = Gum.Process.find_module_by_name ("libart.so");
 			if (art != null) {
 				art.enumerate_imports (imp => {
-					if (imp.name == "read") {
+					if (imp.name == "_ZN3art15GetOsThreadStatEiPcm" || imp.name == "_ZN3art15GetOsThreadStatEiPcj") {
+						get_os_thread_stat_slot = (GetOsThreadStat *) imp.slot;
+					} else if (imp.name == "read") {
 						read_slot = (ReadFunc *) imp.slot;
-						return false;
 					}
 					return true;
 				});
-				if (read_slot != null)
-					old_read_impl = update_read_slot (on_read);
+				if (get_os_thread_stat_slot != null) {
+					old_get_os_thread_stat_impl = (GetOsThreadStat) update_slot ((void **) get_os_thread_stat_slot,
+						(void *) on_get_os_thread_stat);
+				}
+				if (read_slot != null) {
+					old_read_impl = (ReadFunc) update_slot ((void **) read_slot, (void *) on_read);
+				}
 			}
 		}
 
-		~ThreadCountCloaker () {
-			if (read_slot != null)
-				update_read_slot (old_read_impl);
+		public override void dispose () {
+			if (get_os_thread_stat_slot != null) {
+				update_slot ((void **) get_os_thread_stat_slot, (void *) old_get_os_thread_stat_impl);
+			}
+			if (read_slot != null) {
+				update_slot ((void **) read_slot, (void *) old_read_impl);
+			}
+
+			base.dispose ();
 		}
 
-		private ReadFunc update_read_slot (ReadFunc new_impl) {
+		private static void * update_slot (void ** orig, void * new_impl) {
 			Gum.PageProtection old_prot = READ;
-			Gum.Memory.query_protection (read_slot, out old_prot);
+			Gum.Memory.query_protection (orig, out old_prot);
 
 			bool is_writable = (old_prot & Gum.PageProtection.WRITE) != 0;
 			if (!is_writable)
-				Gum.mprotect (read_slot, sizeof (void *), old_prot | WRITE);
+				Gum.mprotect (orig, sizeof (void *), old_prot | WRITE);
 
-			ReadFunc old_impl = *read_slot;
-			*read_slot = new_impl;
+			void * old_impl = *orig;
+			*orig = new_impl;
 
 			if (!is_writable)
-				Gum.mprotect (read_slot, sizeof (void *), old_prot);
+				Gum.mprotect (orig, sizeof (void *), old_prot);
 
 			return old_impl;
 		}
 
+		private static ssize_t on_get_os_thread_stat (Posix.pid_t tid, void * buf, size_t count) {
+			ssize_t n = old_get_os_thread_stat_impl (tid, buf, count);
+
+			if (tid == Posix.getpid ()) {
+				try {
+					n = adjust_thread_count (buf, n, count);
+				} catch (FileError e) {
+				}
+			}
+
+			return n;
+		}
+
 		private static ssize_t on_read (int fd, void * buf, size_t count) {
 			var n = old_read_impl (fd, buf, count);
 			if (n <= 0)
@@ -101,32 +132,36 @@ namespace Frida {
 				if (!file_descriptor_is_proc_self_stat (fd))
 					return n;
 
-				unowned string raw_str = (string) buf;
-				string str = raw_str.substring (0, n);
-
-				MatchInfo info;
-				if (!/^(\d+ \(.+\)(?: [^ ]+){17}) \d+ (.+)/s.match (str, 0, out info))
-					return n;
-				string fields_before = info.fetch (1);
-				string fields_after = info.fetch (2);
-
-				// We cannot simply use the value we got from the kernel and subtract the number of cloaked threads,
-				// as there's a chance the total may have changed in the last moment.
-				uint num_uncloaked_threads = query_num_uncloaked_threads ();
-
-				string adjusted_str = "%s %u %s".printf (fields_before, num_uncloaked_threads, fields_after);
-
-				var adjusted_length = adjusted_str.length;
-				if (adjusted_length > count)
-					return n;
-				Memory.copy (buf, adjusted_str, adjusted_length);
-				n = adjusted_length;
+				n = adjust_thread_count (buf, n, count);
 			} catch (FileError e) {
 			}
 
 			return n;
 		}
 
+		private static ssize_t adjust_thread_count (void * buf, ssize_t n, size_t count) throws FileError {
+			unowned string raw_str = (string) buf;
+			string str = raw_str.substring (0, n);
+
+			MatchInfo info;
+			if (!/^(\d+ \(.+\)(?: [^ ]+){17}) \d+ (.+)/s.match (str, 0, out info))
+				return n;
+			string fields_before = info.fetch (1);
+			string fields_after = info.fetch (2);
+
+			// We cannot simply use the value we got from the kernel and subtract the number of cloaked threads,
+			// as there's a chance the total may have changed in the last moment.
+			uint num_uncloaked_threads = query_num_uncloaked_threads ();
+
+			string adjusted_str = "%s %u %s".printf (fields_before, num_uncloaked_threads, fields_after);
+
+			var adjusted_length = adjusted_str.length;
+			if (adjusted_length > count)
+				return n;
+			Memory.copy (buf, adjusted_str, adjusted_length);
+			return adjusted_length;
+		}
+
 		private static bool file_content_might_be_from_proc_self_stat (void * content, ssize_t size) {
 			if (size < expected_magic.length)
 				return false;

meson.build

@@ -320,7 +320,7 @@ gobject_dep = dependency('gobject-2.0')
 gmodule_dep = dependency('gmodule-2.0')
 gio_dep = dependency('gio-2.0')
 gee_dep = dependency('gee-0.8', default_options: gee_options)
-json_glib_dep = dependency('json-glib-1.0', default_options: [
+json_glib_dep = dependency('json-glib-1.0', version: '>=1.8', default_options: [
   'introspection=disabled',
   'gtk_doc=disabled',
   'tests=false',
@@ -344,6 +344,7 @@ quickjs_dep = dependency('quickjs', required: get_option('barebone_backend'), de
   'atomics=disabled',
   'stack_check=disabled',
 ])
+lzfse_dep = dependency('lzfse', required: get_option('barebone_backend'))
 
 native_glib_dep = dependency('glib-2.0', version: '>=2.74', native: true, default_options: glib_options)
 native_gio_dep = dependency('gio-2.0', native: true)
@@ -410,7 +411,7 @@ have_droidy_backend = get_option('droidy_backend') \
     .allowed()
 have_socket_backend = get_option('socket_backend').allowed()
 have_barebone_backend = get_option('barebone_backend') \
-    .disable_if(not quickjs_dep.found()) \
+    .disable_if(not (quickjs_dep.found() and lzfse_dep.found())) \
     .disable_auto_if(not host_docks_mobile_devices) \
     .allowed()
 compiler_backend_opt = get_option('compiler_backend') \
@@ -560,9 +561,6 @@ if have_fruity_backend
     'dns=disabled',
     'arp=disabled',
     'ethernet=enabled',
-    'tcp_mss=4036',
-    'tcp_snd_buf=65535',
-    'tcp_wnd=65535',
   ]
   if optimize_for_prod
     lwip_options += 'lwip_debug=disabled'
@@ -578,6 +576,11 @@ if quickjs_dep.found()
   backend_reqs_private += 'quickjs'
 endif
 
+if lzfse_dep.found()
+  backend_deps_private += lzfse_dep
+  backend_reqs_private += 'lzfse'
+endif
+
 if host_os_family == 'linux' and cc.has_function('openpty', prefix: '#include <pty.h>')
   vala_flags += '--define=HAVE_OPENPTY'
 endif
@@ -658,6 +661,7 @@ if get_option('devkits').length() != 0
   mkdevkit = [python, releng / 'mkdevkit.py']
   uninstalled_dir = meson.global_build_root() / 'meson-uninstalled'
   devkit_options = [
+    '--dep-symbol-scope', get_option('devkit_symbol_scope'),
     '--cc', '>>>', cc.cmd_array(), '<<<',
     '--c-args', '>>>', get_option('c_args'), '<<<',
     '--pkg-config', '>>>', find_program('pkg-config'), '<<<',

meson.options

@@ -150,6 +150,15 @@ option('devkits',
   description: 'Devkits to build'
 )
 
+option('devkit_symbol_scope',
+  type: 'combo',
+  choices: ['prefixed', 'original'],
+  value: 'prefixed',
+  description : 'How devkit generation treats third-party symbols:\n'
+                + ' - prefixed: add the \'_frida_\' prefix\n'
+                + ' - original: keep symbols exactly as upstream\n'
+)
+
 option('tests',
   type: 'feature',
   value: 'auto',

server/meson.build

@@ -6,7 +6,7 @@ server_sources = [
 if host_os_family == 'darwin'
   server_sources += ['server-darwin.m']
 endif
-if host_os in ['ios', 'tvos']
+if host_os in ['ios', 'tvos', 'xros']
   server_sources += [
     'server-ios-tvos.c',
   ]

server/server-glue.c

@@ -1,7 +1,7 @@
 #include "server-glue.h"
 
 #include "frida-core.h"
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 # include "server-ios-tvos.h"
 #endif
 #ifdef HAVE_ANDROID
@@ -54,7 +54,7 @@ frida_server_environment_set_verbose_logging_enabled (gboolean enabled)
 void
 frida_server_environment_configure (void)
 {
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   _frida_server_ios_tvos_configure ();
 #endif
 

src/barebone/agent-connection.vala

@@ -0,0 +1,503 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	public sealed class AgentConnection : Object, AsyncInitable {
+		public signal void script_message (AgentScriptId id, string json, Bytes? data);
+
+		private Cancellable io_cancellable = new Cancellable ();
+
+		private SocketConnection hostlink;
+		private BufferedInputStream input;
+		private OutputStream output;
+
+		private AgentConfig agent_config;
+		private ImageConfig? image_config;
+		private Machine machine;
+		private Allocator allocator;
+
+		private Allocation elf_allocation;
+		private Allocation config_allocation;
+		private Callback mprotect_callback;
+		private Callback remap_writable_pages_callback;
+
+		private Gee.Map<uint16, Promise<Variant>> pending_requests = new Gee.HashMap<uint16, Promise<Variant>> ();
+		private uint16 next_request_id = 1;
+
+		private const int COMMAND_TIMEOUT_MS = 25000;
+
+		public static async AgentConnection open (AgentConfig agent_config, ImageConfig? image_config, Machine machine,
+				Allocator allocator, Cancellable? cancellable) throws Error, IOError {
+			var connection = new AgentConnection () {
+				agent_config = agent_config,
+				image_config = image_config,
+				machine = machine,
+				allocator = allocator,
+			};
+
+			try {
+				yield connection.init_async (Priority.DEFAULT, cancellable);
+			} catch (GLib.Error e) {
+				throw_api_error (e);
+			}
+
+			return connection;
+		}
+
+		private async bool init_async (int io_priority, Cancellable? cancellable) throws Error, IOError {
+			HostlinkTransportConfig? transport_config = agent_config.transport as HostlinkTransportConfig;
+			if (transport_config == null)
+				throw new Error.NOT_SUPPORTED ("Unsupported transport config: only hostlink is supported for now");
+
+			var qmp = yield QmpClient.open (transport_config.qmp, 0, cancellable);
+			var link = yield qmp.open_hostlink (cancellable);
+			hostlink = link.connection;
+			input = (BufferedInputStream) Object.new (typeof (BufferedInputStream),
+				"base-stream", hostlink.get_input_stream (),
+				"close-base-stream", false,
+				"buffer-size", 128 * 1024);
+			output = hostlink.get_output_stream ();
+
+			var gdb = machine.gdb;
+			ByteOrder byte_order = gdb.byte_order;
+			uint pointer_size = gdb.pointer_size;
+
+			uint64 kernel_base;
+			Layout layout;
+			if (image_config != null) {
+				kernel_base = image_config.base.address;
+				layout = yield Layout.load_from_symbol_source (File.new_for_path (image_config.file), kernel_base,
+					byte_order, pointer_size, cancellable);
+			} else {
+				kernel_base = 0;
+				layout = new Layout.empty ();
+			}
+			if (kernel_base == 0)
+				throw new Error.NOT_SUPPORTED ("Missing kernel_base");
+
+			var symbols = new Gee.HashMap<string, SymbolInfo> ();
+			var hash_builder = new SymbolHashBuilder ();
+			foreach (var s in layout.symbols) {
+				symbols[s.name] = s;
+				hash_builder.add_symbol (s);
+			}
+			if (image_config != null) {
+				foreach (var e in image_config.symbols.entries) {
+					unowned string name = e.key;
+					if (!symbols.has_key (name)) {
+						var s = new SymbolInfo () {
+							name = name,
+							offset = (uint32) e.value,
+							symbol_type = 0xf,
+							section = 0x10, // FIXME
+						};
+						symbols[name] = s;
+						hash_builder.add_symbol (s);
+					}
+				}
+			}
+
+			SymbolInfo? thread_block = symbols["thread_block"];
+			if (thread_block == null)
+				throw new Error.NOT_SUPPORTED ("Missing symbol for thread_block");
+
+			var config_builder = new VariantBuilder (new VariantType ("(tuta(ssuuuu)ay)"));
+			config_builder.add ("t", link.mmio);
+			config_builder.add ("u", link.irq);
+			config_builder.add ("t", kernel_base);
+
+			config_builder.open (new VariantType ("a(ssuuuu)"));
+			foreach (var m in layout.modules) {
+				config_builder.add ("(ssuuuu)",
+					m.name,
+					m.version,
+					m.offset,
+					m.size,
+					m.start_func_offset,
+					m.stop_func_offset
+				);
+			}
+			config_builder.close ();
+
+			Bytes symbol_data = hash_builder.build (byte_order);
+			config_builder.add_value (Variant.new_from_data (new VariantType ("ay"), symbol_data.get_data (), true,
+				symbol_data));
+
+			Gum.ElfModule elf;
+			try {
+				elf = new Gum.ElfModule.from_file (agent_config.path);
+			} catch (Gum.Error e) {
+				throw new Error.INVALID_ARGUMENT ("%s", e.message);
+			}
+
+			var raw_elf = gdb.make_buffer (new Bytes (elf.get_file_data ()));
+			var missing_symbols = new Gee.ArrayList<string> ();
+			elf.enumerate_symbols (s => {
+				unowned Gum.ElfSectionDetails? sect = s.section;
+				if (sect != null && sect.name == ".kernel_addrs") {
+					string name = s.name[1:];
+					SymbolInfo? info = symbols[name];
+					if (info != null) {
+						size_t file_offset = (size_t) (sect.offset + (s.address - sect.address));
+						raw_elf.write_pointer (file_offset, kernel_base + info.offset);
+					} else {
+						missing_symbols.add (name);
+					}
+				}
+				return true;
+			});
+			if (!missing_symbols.is_empty) {
+				throw new Error.INVALID_ARGUMENT ("Missing symbols for: %s",
+					string.joinv (", ", missing_symbols.to_array ()));
+			}
+
+			yield machine.enter_exception_level (1, 1000, cancellable);
+
+			var bp = yield gdb.add_breakpoint (SOFT, kernel_base + thread_block.offset, 4, cancellable);
+			GDB.Breakpoint? hit_breakpoint = null;
+			do {
+				var exception = yield gdb.continue_until_exception (cancellable);
+				hit_breakpoint = exception.breakpoint;
+			} while (hit_breakpoint != bp);
+			yield bp.remove (cancellable);
+
+			size_t page_size = yield machine.query_page_size (cancellable);
+
+			elf_allocation = yield inject_elf (elf, raw_elf.bytes, page_size, machine, allocator, cancellable);
+
+			uint64 start_address = 0;
+			uint64 remap_writable_pages_address = 0;
+			uint64 mprotect_address = 0;
+			uint64 base_va = elf_allocation.virtual_address;
+			elf.enumerate_symbols (e => {
+				if (e.name == "_start")
+					start_address = base_va + e.address;
+				else if (e.name == "gum_barebone_try_remap_writable_pages")
+					remap_writable_pages_address = base_va + e.address;
+				else if (e.name == "gum_try_mprotect")
+					mprotect_address = base_va + e.address;
+				else
+					return true;
+				return start_address == 0 || mprotect_address == 0 || remap_writable_pages_address == 0;
+			});
+			if (start_address == 0)
+				throw new Error.INVALID_ARGUMENT ("Invalid agent: no _start symbol found");
+			if (remap_writable_pages_address == 0)
+				throw new Error.INVALID_ARGUMENT ("Invalid agent: no gum_barebone_try_remap_writable_pages symbol found");
+			if (mprotect_address == 0)
+				throw new Error.INVALID_ARGUMENT ("Invalid agent: no gum_try_mprotect symbol found");
+
+			remap_writable_pages_callback = yield new Callback (remap_writable_pages_address,
+				new RemapWritablePagesHandler (machine), machine, cancellable);
+			mprotect_callback = yield new Callback (mprotect_address, new MemoryProtectHandler (machine), machine, cancellable);
+
+			var config_blob = config_builder.end ().get_data_as_bytes ();
+			config_allocation = yield allocator.allocate (config_blob.get_size (), 8, cancellable);
+
+			yield gdb.write_byte_array (config_allocation.virtual_address, config_blob, cancellable);
+
+			yield machine.invoke (start_address, {
+					config_allocation.virtual_address,
+					config_allocation.size
+				},
+				cancellable);
+
+			yield gdb.continue (cancellable);
+
+			process_incoming_messages.begin ();
+
+			return true;
+		}
+
+		public async void close (Cancellable? cancellable) throws IOError {
+			io_cancellable.cancel ();
+		}
+
+		public async AgentScriptId create_script (string source, Cancellable? cancellable) throws Error, IOError {
+			var payload = new Variant ("s", source);
+			var response = yield execute_command (Command.CREATE_SCRIPT, payload, cancellable);
+			if (!response.check_format_string ("u", false))
+				throw new Error.PROTOCOL ("Invalid create_script response format");
+			uint32 script_handle;
+			response.get ("u", out script_handle);
+			return AgentScriptId (script_handle);
+		}
+
+		public async void load_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
+			var payload = new Variant ("u", script_id.handle);
+			yield execute_command (Command.LOAD_SCRIPT, payload, cancellable);
+		}
+
+		public async void destroy_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
+			var payload = new Variant ("u", script_id.handle);
+			yield execute_command (Command.DESTROY_SCRIPT, payload, cancellable);
+		}
+
+		public async void post_script_message (AgentScriptId script_id, string message, Bytes? data, Cancellable? cancellable)
+				throws Error, IOError {
+			var payload = new Variant ("(us)", script_id.handle, message);
+			// TODO: Include data.
+			yield execute_command (Command.POST_SCRIPT_MESSAGE, payload, cancellable);
+		}
+
+		private async Variant execute_command (Command command, Variant payload, Cancellable? cancellable) throws Error, IOError {
+			uint16 request_id = next_request_id++;
+
+			var command_message = new Variant ("(yqv)", (uint8) command, request_id, payload);
+			if (machine.gdb.byte_order != ByteOrder.HOST)
+				command_message = command_message.byteswap ();
+			var command_bytes = command_message.get_data_as_bytes ();
+
+			var builder = machine.gdb.make_buffer_builder ();
+			Bytes frame = builder
+				.append_uint32 ((uint32) command_bytes.get_size ())
+				.append_bytes (command_bytes)
+				.build ();
+
+			var promise = new Promise<Variant> ();
+			pending_requests[request_id] = promise;
+
+			try {
+				yield output.write_all_async (frame.get_data (), Priority.DEFAULT, cancellable, null);
+			} catch (GLib.Error e) {
+				pending_requests.unset (request_id);
+				throw new Error.TRANSPORT ("%s", e.message);
+			}
+
+			var timeout_source = new TimeoutSource (COMMAND_TIMEOUT_MS);
+			timeout_source.set_callback (() => {
+				Promise<Variant>? p;
+				if (pending_requests.unset (request_id, out p))
+					p.reject (new Error.TIMED_OUT ("Command timed out"));
+				return Source.REMOVE;
+			});
+			timeout_source.attach (MainContext.get_thread_default ());
+
+			try {
+				return yield promise.future.wait_async (cancellable);
+			} finally {
+				timeout_source.destroy ();
+			}
+		}
+
+		private async void process_incoming_messages () {
+			var byte_order = machine.gdb.byte_order;
+
+			try {
+				while (true) {
+					size_t header_size = 4;
+					if (input.get_available () < header_size)
+						yield fill_until_n_bytes_available (header_size);
+
+					uint32 body_size = 0;
+					unowned uint8[] size_buf = ((uint8[]) &body_size)[:4];
+					input.peek (size_buf);
+					body_size = uint32.from_little_endian (body_size);
+
+					size_t full_size = header_size + body_size;
+					if (input.get_available () < full_size)
+						yield fill_until_n_bytes_available (full_size);
+
+					var body = new uint8[body_size];
+					input.peek (body, header_size);
+
+					input.skip (full_size, io_cancellable);
+
+					var raw_message = new Bytes.take ((owned) body);
+
+					var message = Variant.new_from_data (new VariantType ("(yqv)"), raw_message.get_data (), false,
+						raw_message);
+					if (byte_order != ByteOrder.HOST)
+						message = message.byteswap ();
+					if (!message.check_format_string ("(yqv)", false))
+						throw new Error.PROTOCOL ("Invalid message format");
+
+					uint8 command_code;
+					uint16 request_id;
+					Variant payload;
+					message.get ("(yqv)", out command_code, out request_id, out payload);
+
+					if (command_code == Command.SCRIPT_MESSAGE) {
+						if (!payload.check_format_string ("(us)", false))
+							throw new Error.PROTOCOL ("Invalid script message payload format");
+
+						uint32 script_handle;
+						unowned string json;
+						payload.get ("(u&s)", out script_handle, out json);
+
+						script_message (AgentScriptId (script_handle), json, null);
+					} else if (command_code == Command.REPLY) {
+						Promise<Variant>? promise;
+						if (pending_requests.unset (request_id, out promise))
+							promise.resolve (payload);
+					}
+				}
+			} catch (GLib.Error e) {
+			}
+		}
+
+		private async void fill_until_n_bytes_available (size_t minimum) throws Error, IOError {
+			size_t available = input.get_available ();
+			while (available < minimum) {
+				if (input.get_buffer_size () < minimum)
+					input.set_buffer_size (minimum);
+
+				ssize_t n;
+				try {
+					n = yield input.fill_async ((ssize_t) (input.get_buffer_size () - available), Priority.DEFAULT,
+						io_cancellable);
+				} catch (GLib.Error e) {
+					throw new Error.TRANSPORT ("Connection closed");
+				}
+
+				if (n == 0)
+					throw new Error.TRANSPORT ("Connection closed");
+
+				available += n;
+			}
+		}
+
+		private class RemapWritablePagesHandler : Object, CallbackHandler {
+			public signal void output (string message);
+
+			public uint arity {
+				get { return 2; }
+			}
+
+			private Machine machine;
+
+			public RemapWritablePagesHandler (Machine machine) {
+				this.machine = machine;
+			}
+
+			public async uint64 handle_invocation (uint64[] args, CallFrame frame, Cancellable? cancellable)
+					throws Error, IOError {
+				var pages = args[0];
+				var num_pages = (uint) args[1];
+
+				var physical_addresses = new Gee.ArrayList<uint64?> ();
+				var gdb = machine.gdb;
+				var reader = new BufferReader (yield gdb.read_buffer (pages, num_pages * gdb.pointer_size, cancellable));
+				for (uint i = 0; i != num_pages; i++)
+					physical_addresses.add (reader.read_pointer ());
+
+				Allocation allocation = yield machine.allocate_pages (physical_addresses, cancellable);
+				// TODO: Handle cleanup.
+
+				return allocation.virtual_address;
+			}
+		}
+
+		private class MemoryProtectHandler : Object, CallbackHandler {
+			public signal void output (string message);
+
+			public uint arity {
+				get { return 3; }
+			}
+
+			private Machine machine;
+
+			public MemoryProtectHandler (Machine machine) {
+				this.machine = machine;
+			}
+
+			public async uint64 handle_invocation (uint64[] args, CallFrame frame, Cancellable? cancellable)
+					throws Error, IOError {
+				var address = args[0];
+				var size = (size_t) args[1];
+				var prot = (Gum.PageProtection) args[2];
+				try {
+					yield machine.protect_pages (address, size, prot, cancellable);
+					return 1;
+				} catch (GLib.Error e) {
+					return 0;
+				}
+			}
+		}
+
+		private enum Command {
+			CREATE_SCRIPT = 1,
+			LOAD_SCRIPT = 2,
+			DESTROY_SCRIPT = 3,
+			POST_SCRIPT_MESSAGE = 4,
+			REPLY = 128,
+			SCRIPT_MESSAGE = 129
+		}
+
+		private enum Status {
+			IDLE,
+			BUSY,
+			DATA_READY,
+			ERROR
+		}
+	}
+
+	private class SymbolHashBuilder : Object {
+		private Gee.Map<string, Gee.List<SymbolInfo>> symbol_table = new Gee.TreeMap<string, Gee.List<SymbolInfo>> ();
+
+		public void add_symbol (SymbolInfo symbol) {
+			var symbol_list = symbol_table[symbol.name];
+			if (symbol_list == null) {
+				symbol_list = new Gee.ArrayList<SymbolInfo> ();
+				symbol_table[symbol.name] = symbol_list;
+			}
+			symbol_list.add (symbol);
+		}
+
+		public Bytes build (ByteOrder byte_order) {
+			var builder = new BufferBuilder (byte_order);
+
+			var all_symbols = new Gee.ArrayList<SymbolInfo> ();
+			foreach (var entry in symbol_table.entries) {
+				foreach (var symbol in entry.value)
+					all_symbols.add (symbol);
+			}
+
+			uint total_symbols = all_symbols.size;
+			builder.append_uint32 (total_symbols);
+
+			var name_index_offset = builder.offset;
+			builder.skip (total_symbols * 4);
+
+			var addr_index_offset = builder.offset;
+			builder.skip (total_symbols * 4);
+
+			var symbol_offsets = new uint32[total_symbols];
+			for (uint i = 0; i != total_symbols; i++) {
+				var symbol = all_symbols[(int) i];
+
+				builder.align (4);
+				symbol_offsets[i] = (uint32) builder.offset;
+
+				builder.append_uint32 (symbol.offset);
+				// TODO: Only include details we need.
+				builder.append_uint8 (symbol.symbol_type);
+				builder.append_uint8 (symbol.section);
+				builder.append_uint16 (symbol.description);
+				builder.append_string (symbol.name, StringTerminator.NUL);
+			}
+
+			for (uint i = 0; i != total_symbols; i++)
+				builder.write_uint32 (name_index_offset + (i * 4), symbol_offsets[i]);
+
+			var addr_sorted_symbols = new Gee.ArrayList<int> ();
+			for (uint i = 0; i != total_symbols; i++)
+				addr_sorted_symbols.add ((int) i);
+			addr_sorted_symbols.sort ((a, b) => {
+				var symbol_a = all_symbols[a];
+				var symbol_b = all_symbols[b];
+				if (symbol_a.offset < symbol_b.offset)
+					return -1;
+				if (symbol_a.offset > symbol_b.offset)
+					return 1;
+				return 0;
+			});
+
+			for (uint i = 0; i != total_symbols; i++) {
+				int original_index = addr_sorted_symbols[(int) i];
+				uint symbol_data_offset = symbol_offsets[original_index];
+				builder.write_uint32 (addr_index_offset + (i * 4), symbol_data_offset);
+			}
+
+			return builder.build ();
+		}
+	}
+}

src/barebone/agent/.cargo/config.toml

@@ -0,0 +1,2 @@
+[build]
+target = "aarch64-unknown-none"

src/barebone/agent/Cargo.lock

@@ -0,0 +1,296 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "bindgen"
+version = "0.72.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f72209734318d0b619a5e0f5129918b848c416e122a3c4ce054e03cb87b726f"
+dependencies = [
+ "bitflags",
+ "cexpr",
+ "clang-sys",
+ "itertools",
+ "log",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex",
+ "syn",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
+
+[[package]]
+name = "cc"
+version = "1.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d487aa071b5f64da6f19a3e848e3578944b726ee5a4854b82172f02aa876bfdc"
+dependencies = [
+ "shlex",
+]
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
+
+[[package]]
+name = "clang-sys"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
+[[package]]
+name = "frida-barebone-agent"
+version = "1.0.0"
+dependencies = [
+ "bindgen",
+ "cc",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
+
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.174"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
+
+[[package]]
+name = "libloading"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667"
+dependencies = [
+ "cfg-if",
+ "windows-targets",
+]
+
+[[package]]
+name = "log"
+version = "0.4.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
+
+[[package]]
+name = "memchr"
+version = "2.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "061c1221631e079b26479d25bbf2275bfe5917ae8419cd7e34f13bfc2aa7539a"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "regex"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "syn"
+version = "2.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+
+[[package]]
+name = "windows-targets"
+version = "0.53.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c66f69fcc9ce11da9966ddb31a40968cad001c5bedeb5c2b82ede4253ab48aef"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"

src/barebone/agent/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "frida-barebone-agent"
+version = "1.0.0"
+edition = "2024"
+build = "build.rs"
+
+[profile.release]
+panic = "abort"
+opt-level = "z"
+overflow-checks = false
+lto = true
+codegen-units = 1
+
+[profile.dev]
+panic = "abort"
+
+[build-dependencies]
+cc = "1.2"
+bindgen = "0.72.0"

src/barebone/agent/README.md

@@ -0,0 +1,43 @@
+## Getting the C toolchain
+
+    npm install -g xpm
+    xpm install
+    export PATH=$PWD/xpacks/.bin:$PATH
+
+## How to build Gum
+
+    ./configure \
+        --host=aarch64-none-elf \
+        --enable-gumjs \
+        --with-devkits=gum,gumjs \
+        --with-devkit-symbol-scope=original
+    make
+    export GUMJS_DEVKIT_DIR=$PWD/build/bindings/gumjs/devkit
+
+## Building
+
+    export PATH=$PWD/xpacks/.bin:$PATH
+    export CC_aarch64_unknown_none=aarch64-none-elf-gcc
+    export AR_aarch64_unknown_none=aarch64-none-elf-ar
+    export RANLIB_aarch64_unknown_none=aarch64-none-elf-ranlib
+
+## Development loop
+
+    export FRIDA_BAREBONE_CONFIG=$PWD/etc/xnu.json
+    cargo build --release && make -C ~/src/frida-python && killall -9 qemu-system-aarch64 && sleep 2 && frida -D barebone -p 0
+
+## Speeding up loop
+
+    ./configure \
+        -- \
+        -Dfrida-core:compat=disabled \
+        -Dfrida-core:local_backend=disabled \
+        -Dfrida-core:fruity_backend=disabled \
+        -Dfrida-core:droidy_backend=disabled \
+        -Dfrida-core:socket_backend=disabled \
+        -Dfrida-core:compiler_backend=disabled \
+        -Dfrida-core:gadget=disabled \
+        -Dfrida-core:server=disabled \
+        -Dfrida-core:portal=disabled \
+        -Dfrida-core:inject=disabled \
+        -Dfrida-core:tests=enabled

src/barebone/agent/agent.lds

@@ -0,0 +1,51 @@
+SECTIONS {
+  .text : {
+    *(.text.entrypoint)
+    *(.text*)
+  }
+  .rodata : {
+    *(.rodata*)
+  }
+  .kernel_addrs : ALIGN(8) {
+    . = ALIGN(8);
+    _panic = .; . += 8;
+    _IOLog = .; . += 8;
+    _kalloc = .; . += 8;
+    _kfree = .; . += 8;
+    _kernel_thread_start = .; . += 8;
+    _assert_wait = .; . += 8;
+    _assert_wait_timeout = .; . += 8;
+    _thread_block = .; . += 8;
+    _thread_wakeup = .; . += 8;
+    _mach_absolute_time = .; . += 8;
+    _absolutetime_to_nanoseconds = .; . += 8;
+    _clock_get_calendar_microtime = .; . += 8;
+    _ml_io_map = .; . += 8;
+    _ml_vtophys = .; . += 8;
+    __ZN9IOService11getPlatformEv = .; . += 8;
+    __ZN9IOServiceC2Ev = .; . += 8;
+    __ZN8OSSymbol17withCStringNoCopyEPKc = .; . += 8;
+    __ZN6OSData9withBytesEPKvj = .; . += 8;
+  }
+  .data.rel.ro : {
+    *(.data.rel.ro*)
+  }
+  .got : {
+    *(.got*)
+  }
+  .bss : {
+    *(.bss*)
+  }
+  . = ALIGN(8);
+  _heap_start = .;
+}
+
+VERSION {
+  {
+    global:
+      _start;
+
+    local:
+      *;
+  };
+}

src/barebone/agent/build.rs

@@ -0,0 +1,126 @@
+use std::{
+    env, fs,
+    path::{Path, PathBuf},
+    process::{Command, Stdio},
+};
+
+fn main() {
+    let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap());
+    let devkit_dir = PathBuf::from(env::var("GUMJS_DEVKIT_DIR").unwrap());
+
+    let cc_str = env::var("CC_aarch64_unknown_none")
+            .or_else(|_| env::var("CC"))
+            .unwrap_or_else(|_| "cc".to_string());
+    let cc = Path::new(&cc_str);
+    let cc_include_paths = detect_gcc_include_paths(cc);
+    let cc_library_paths = detect_gcc_library_paths(cc);
+
+    let cc_clang_args: Vec<String> = cc_include_paths
+        .iter()
+        .flat_map(|path| vec!["-isystem".to_string(), path.to_string_lossy().into_owned()])
+        .collect();
+
+    let bindings = bindgen::Builder::default()
+        .use_core()
+        .header(devkit_dir.join("frida-gumjs.h").to_str().unwrap())
+        .clang_arg("-nostdinc")
+        .clang_arg("-target")
+        .clang_arg("aarch64-none-elf")
+        .clang_args(cc_clang_args)
+        .clang_arg(format!("-I{}", devkit_dir.to_str().unwrap()))
+        .merge_extern_blocks(true)
+        .generate()
+        .expect("Unable to generate bindings");
+
+    bindings
+        .write_to_file(out_dir.join("bindings.rs"))
+        .expect("Couldn't write bindings");
+
+    println!(
+        "cargo:rustc-link-search=native={}",
+        devkit_dir.to_str().unwrap()
+    );
+    println!("cargo:rustc-link-lib=static=frida-gumjs");
+    for path in cc_library_paths {
+        println!("cargo:rustc-link-search=native={}", path.to_string_lossy());
+    }
+    println!("cargo:rustc-link-lib=static=c");
+    println!("cargo:rustc-link-lib=static=m");
+    println!("cargo:rustc-link-arg=--export-dynamic");
+    println!("cargo:rustc-link-arg=--emit-relocs");
+    println!("cargo:rustc-link-arg=--script=agent.lds");
+    println!("cargo:rustc-link-arg=--gc-sections");
+    println!("cargo:rerun-if-changed=build.rs");
+}
+
+pub fn detect_gcc_include_paths(gcc: &Path) -> Vec<PathBuf> {
+    let out = Command::new(gcc)
+        .args(["-xc", "-E", "-v", "-"])
+        .stdin(Stdio::null())
+        .output()
+        .expect("Failed to execute GCC to detect include paths");
+
+    let stderr = String::from_utf8_lossy(&out.stderr);
+
+    let mut grab = false;
+    let mut paths = Vec::<PathBuf>::new();
+
+    for line in stderr.lines() {
+        if line.starts_with("#include <...> search starts here:") {
+            grab = true;
+            continue;
+        }
+        if line.starts_with("End of search list.") {
+            break;
+        }
+        if !grab {
+            continue;
+        }
+
+        let raw = line.trim();
+        if raw.is_empty() {
+            continue;
+        }
+
+        let p = Path::new(raw);
+        if p.exists() {
+            let canonical = fs::canonicalize(p).expect("Failed to canonicalize include path");
+            if !paths.contains(&canonical) {
+                paths.push(canonical);
+            }
+        }
+    }
+
+    paths
+}
+
+pub fn detect_gcc_library_paths(gcc: &Path) -> Vec<PathBuf> {
+    let out = Command::new(gcc).arg("-print-search-dirs").output()
+        .expect("Failed to execute GCC to detect library paths");
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let line = stdout.lines().find(|l| l.starts_with("libraries:"))
+        .expect("Failed to find libraries line in GCC output");
+
+    let raw_dirs = line.trim_start_matches("libraries: =");
+    let sep = if cfg!(windows) { ';' } else { ':' };
+
+    let mut paths = Vec::new();
+    for raw in raw_dirs.split(sep) {
+        if raw.is_empty() {
+            continue;
+        }
+
+        let p = Path::new(raw);
+        if !p.exists() {
+            continue;
+        }
+
+        let canonical = fs::canonicalize(p).expect("Failed to canonicalize library path");
+        if !paths.contains(&canonical) {
+            paths.push(canonical);
+        }
+    }
+
+    paths
+}

src/barebone/agent/env.sh

@@ -0,0 +1,8 @@
+export FRIDA_BAREBONE_CONFIG=$PWD/etc/xnu.json
+export PYTHONPATH=$HOME/src/frida-python
+
+export PATH=$PWD/xpacks/.bin:$PATH
+export CC_aarch64_unknown_none=aarch64-none-elf-gcc
+export AR_aarch64_unknown_none=aarch64-none-elf-ar
+export RANLIB_aarch64_unknown_none=aarch64-none-elf-ranlib
+export GUMJS_DEVKIT_DIR=/home/oleavr/src/frida-gum/build/bindings/gumjs/devkit

src/barebone/agent/etc/noalloc.json

@@ -0,0 +1,6 @@
+{
+  "connection": {
+    "host": "127.0.0.1",
+    "port": 9000
+  }
+}

src/barebone/agent/etc/physical.json

@@ -0,0 +1,18 @@
+{
+  "connection": {
+    "host": "127.0.0.1",
+    "port": 9000
+  },
+  "allocator": {
+    "mode": "physical",
+    "physical_base": "0x8ec9b4000"
+  },
+  "agent": {
+    "path": "/Users/oleavr/src/frida-core/src/barebone/agent/target/aarch64-unknown-none/debug/frida-barebone-agent",
+    "transport": {
+      "type": "ram",
+      "path": "/Volumes/RAM Disk/ios-dram",
+      "base_address": "0x800000000"
+    }
+  }
+}

src/barebone/agent/etc/xnu.json

@@ -0,0 +1,42 @@
+{
+  "connection": {
+    "host": "127.0.0.1",
+    "port": 9000
+  },
+  "allocator": {
+    "mode": "target-functions",
+    "alloc_function": "0xfffffff007a3c278",
+    "free_function": "0xfffffff007a3c338"
+  },
+  "agent": {
+    "path": "/Users/oleavr/src/frida-core/src/barebone/agent/target/aarch64-unknown-none/release/frida-barebone-agent",
+    "transport": {
+      "type": "hostlink",
+      "qmp": "unix:/Users/oleavr/src/frida-barebone-ios/qmp.sock"
+    }
+  },
+  "image": {
+    "file": "/Users/oleavr/src/frida-barebone-ios/iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/kernelcache.research.iphone12b",
+    "base": "0xfffffff007004000",
+    "symbols": {
+      "IOLog": "0xfedb68",
+      "_ZN6OSData9withBytesEPKvj": "0xf88588",
+      "_ZN8OSSymbol17withCStringNoCopyEPKc": "0xfc05dc",
+      "_ZN9IOService11getPlatformEv": "0x101ad48",
+      "_ZN9IOServiceC2Ev": "0x1018318",
+      "absolutetime_to_nanoseconds": "0xb5d1e4",
+      "assert_wait": "0xa4d294",
+      "assert_wait_timeout": "0xa4d430",
+      "clock_get_calendar_microtime": "0xa1f32c",
+      "kalloc": "0xa38278",
+      "kernel_thread_start": "0xa70674",
+      "kfree": "0xa38338",
+      "mach_absolute_time": "0xb5ccc0",
+      "ml_io_map": "0xb57a04",
+      "ml_vtophys": "0xb584a0",
+      "panic": "0x27d7944",
+      "thread_block": "0xa51728",
+      "thread_wakeup": "0xa54ea0"
+    }
+  }
+}

src/barebone/agent/examples/spawn-observer.js

@@ -0,0 +1,34 @@
+const _copyinstr = new NativeFunction(
+    DebugSymbol.getFunctionByName('copyinstr'),
+  'int',
+  ['pointer', 'pointer', 'size_t', 'pointer']);
+const { pointerSize } = Process;
+
+Interceptor.attach(DebugSymbol.getFunctionByName('__mac_execve'), {
+  onEnter(args) {
+    const fname = copyinstr(args[1].readPointer());
+    console.log(`>>> __mac_execve() fname=${fname}`);
+  },
+  onLeave(retval) {
+    console.log(`<<< __mac_execve() => ${retval.toInt32()}`);
+  }
+});
+
+Interceptor.attach(DebugSymbol.getFunctionByName('posix_spawn'), {
+  onEnter(args) {
+    const path = copyinstr(args[1].add(pointerSize).readPointer());
+    console.log(`>>> posix_spawn() path=${path}`);
+  },
+  onLeave(retval) {
+    console.log(`<<< posix_spawn() => ${retval.toInt32()}`);
+  }
+});
+
+function copyinstr(userAddr) {
+  const bufSize = 4096;
+  const buf = Memory.alloc(bufSize);
+  const actual = Memory.alloc(pointerSize);
+  if (_copyinstr(userAddr, buf, bufSize, actual) !== 0)
+    throw new Error('copyinstr failed');
+  return buf.readUtf8String();
+}

src/barebone/agent/explore.ts

@@ -0,0 +1,10 @@
+console.log("Agent loading");
+const cm = new CModule(File.readAllBytes("./target/aarch64-unknown-none/release/frida-barebone-agent"));
+//const cm = new CModule(File.readAllBytes("./target/aarch64-unknown-none/debug/frida-barebone-agent"));
+
+const start = new NativeFunction(cm._start, "pointer", []);
+const bufferPhysicalAddress = start();
+console.log("Ready! Buffer is at physical address:", bufferPhysicalAddress);
+$gdb.continue();
+
+Object.assign(globalThis, { cm, start });

src/barebone/agent/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "frida-barebone-agent",
+  "version": "1.0.0",
+  "description": "xPack configuration for frida-barebone-agent",
+  "xpack": {
+    "minimumXpmRequired": "0.20.8",
+    "dependencies": {},
+    "devDependencies": {
+      "@xpack-dev-tools/aarch64-none-elf-gcc": {
+        "specifier": "14.2.1-1.1.1",
+        "local": "link",
+        "platforms": "all"
+      }
+    },
+    "properties": {},
+    "actions": {},
+    "buildConfigurations": {}
+  }
+}

src/barebone/agent/src/glib.rs

@@ -0,0 +1,46 @@
+use core::ptr;
+
+use crate::bindings::{g_wait_is_set, gint64, gpointer};
+use crate::xnu;
+
+const G_WAIT_INFINITE: gint64 = -1;
+
+pub static mut WAKEUP_TOKEN: u64 = 0;
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_get_monotonic_time() -> gint64 {
+    let abstime = xnu::mach_absolute_time();
+    let time = xnu::absolutetime_to_nanoseconds(abstime);
+    (time / 1000) as gint64
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_wait_sleep(token: gpointer, timeout_us: gint64) {
+    let wait_event = ptr::addr_of_mut!(WAKEUP_TOKEN) as *const u8;
+
+    let wait_result = if timeout_us == G_WAIT_INFINITE {
+        xnu::assert_wait(wait_event, xnu::THREAD_INTERRUPTIBLE)
+    } else {
+        xnu::assert_wait_timeout(
+            wait_event,
+            xnu::THREAD_INTERRUPTIBLE,
+            (timeout_us * 1000) as u32,
+            1, // TODO
+        )
+    };
+    if wait_result != xnu::THREAD_WAITING {
+        panic!("assert_wait_timeout failed: {}", wait_result);
+    }
+
+    if unsafe { g_wait_is_set(token) != 0 } {
+        xnu::thread_wakeup(wait_event);
+        return;
+    }
+
+    xnu::thread_block(None);
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_wait_wake(_token: gpointer) {
+    xnu::thread_wakeup(ptr::addr_of_mut!(WAKEUP_TOKEN) as *const u8);
+}

src/barebone/agent/src/gthread.rs

@@ -0,0 +1,609 @@
+use crate::bindings::GCond;
+use crate::bindings::GMutex;
+use crate::bindings::GPrivate;
+use crate::bindings::GRWLock;
+use crate::bindings::GRecMutex;
+use crate::bindings::GSystemThread;
+use crate::bindings::GThreadFunc;
+use crate::bindings::{gpointer, gulong};
+use alloc::boxed::Box;
+use alloc::collections::BTreeMap;
+use core::arch::asm;
+use core::ffi::c_void;
+use core::sync::atomic::{AtomicU32, AtomicU64, Ordering};
+
+// Our implementation structures that overlay the opaque GLib structures
+
+#[repr(C, align(8))]
+struct MutexImpl {
+    lock: AtomicU32,
+    _padding: [u8; core::mem::size_of::<GMutex>() - core::mem::size_of::<AtomicU32>()],
+}
+
+#[repr(C, align(8))]
+struct RecMutexImpl {
+    owner: AtomicU64,     // Thread ID of the owner (uses the 'p' field)
+    count: AtomicU32,     // Recursion count (uses i[0])
+    _unused: u32,         // Unused (uses i[1])
+}
+
+#[repr(C, align(8))]
+struct RWLockImpl {
+    state: AtomicU32,     // Lock state (readers count + writer bit)
+    _padding: [u8; core::mem::size_of::<GRWLock>() - core::mem::size_of::<AtomicU32>()],
+}
+
+#[repr(C, align(8))]
+struct CondImpl {
+    signal: AtomicU32,    // Signal state
+    _padding: [u8; core::mem::size_of::<GCond>() - core::mem::size_of::<AtomicU32>()],
+}
+
+const _: () = assert!(core::mem::size_of::<MutexImpl>() == core::mem::size_of::<GMutex>());
+const _: () = assert!(core::mem::align_of::<MutexImpl>() == core::mem::align_of::<GMutex>());
+const _: () = assert!(core::mem::size_of::<RecMutexImpl>() == core::mem::size_of::<GRecMutex>());
+const _: () = assert!(core::mem::align_of::<RecMutexImpl>() == core::mem::align_of::<GRecMutex>());
+const _: () = assert!(core::mem::size_of::<RWLockImpl>() == core::mem::size_of::<GRWLock>());
+const _: () = assert!(core::mem::align_of::<RWLockImpl>() == core::mem::align_of::<GRWLock>());
+const _: () = assert!(core::mem::size_of::<CondImpl>() == core::mem::size_of::<GCond>());
+const _: () = assert!(core::mem::align_of::<CondImpl>() == core::mem::align_of::<GCond>());
+
+// System thread implementation
+#[repr(C)]
+struct SystemThreadImpl {
+    mutex: GMutex,            // Protects the thread state
+    cond: GCond,              // Signals thread completion
+    thread_id: AtomicU64,     // XNU thread ID
+    func: GThreadFunc,        // Thread function
+    data: gpointer,           // User data
+    finished: AtomicU32,      // Whether thread has finished (0 = running, 1 = finished)
+    detached: AtomicU32,      // Whether thread is detached (1) or joinable (0)
+}
+
+// Thread wrapper data passed to XNU kernel thread
+#[repr(C)]
+struct ThreadWrapperData {
+    func: GThreadFunc,
+    data: gpointer,
+    system_thread: *mut SystemThreadImpl,
+}
+
+unsafe fn mutex_impl<'a>(mutex: *mut GMutex) -> &'a mut MutexImpl {
+    unsafe { &mut *(mutex as *mut MutexImpl) }
+}
+
+unsafe fn rec_mutex_impl<'a>(rec_mutex: *mut GRecMutex) -> &'a mut RecMutexImpl {
+    unsafe { &mut *(rec_mutex as *mut RecMutexImpl) }
+}
+
+unsafe fn rw_lock_impl<'a>(rw_lock: *mut GRWLock) -> &'a mut RWLockImpl {
+    unsafe { &mut *(rw_lock as *mut RWLockImpl) }
+}
+
+unsafe fn cond_impl<'a>(cond: *mut GCond) -> &'a mut CondImpl {
+    unsafe { &mut *(cond as *mut CondImpl) }
+}
+
+// TODO: Clean up Thread-Local Storage (TLS) entries when threads exit
+static mut TLS_STORAGE: Option<Box<BTreeMap<(u64, *mut GPrivate), *mut c_void>>> = None;
+static TLS_LOCK: AtomicU32 = AtomicU32::new(0);
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_mutex_init(mutex: *mut GMutex) {
+    unsafe {
+        let impl_ = mutex_impl(mutex);
+        impl_.lock.store(0, Ordering::Relaxed);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_mutex_clear(_mutex: *mut GMutex) {}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_mutex_lock(mutex: *mut GMutex) {
+    unsafe {
+        let impl_ = mutex_impl(mutex);
+        lock_acquire(&impl_.lock);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_mutex_unlock(mutex: *mut GMutex) {
+    unsafe {
+        let impl_ = mutex_impl(mutex);
+        lock_release(&impl_.lock);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_mutex_trylock(mutex: *mut GMutex) -> u32 {
+    unsafe {
+        let impl_ = mutex_impl(mutex);
+        if lock_try_acquire(&impl_.lock) {
+            1
+        } else {
+            0
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rec_mutex_init(rec_mutex: *mut GRecMutex) {
+    unsafe {
+        let impl_ = rec_mutex_impl(rec_mutex);
+        impl_.owner.store(0, Ordering::Relaxed);
+        impl_.count.store(0, Ordering::Relaxed);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rec_mutex_clear(_rec_mutex: *mut GRecMutex) {
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rec_mutex_lock(rec_mutex: *mut GRecMutex) {
+    unsafe {
+        let impl_ = rec_mutex_impl(rec_mutex);
+        let current_thread = get_current_thread_id();
+
+        loop {
+            if rec_mutex_try_acquire(impl_, current_thread) {
+                break;
+            }
+            rec_mutex_wait(impl_);
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rec_mutex_trylock(rec_mutex: *mut GRecMutex) -> u32 {
+    unsafe {
+        let impl_ = rec_mutex_impl(rec_mutex);
+        let current_thread = get_current_thread_id();
+
+        if rec_mutex_try_acquire(impl_, current_thread) {
+            1
+        } else {
+            0
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rec_mutex_unlock(rec_mutex: *mut GRecMutex) {
+    unsafe {
+        let impl_ = rec_mutex_impl(rec_mutex);
+
+        loop {
+            let current_count = impl_.count.load(Ordering::Relaxed);
+
+            if current_count == 1 {
+                if impl_.count
+                    .compare_exchange_weak(1, 0, Ordering::Release, Ordering::Relaxed)
+                    .is_ok()
+                {
+                    impl_.owner.store(0, Ordering::Relaxed);
+                    lock_notify_all();
+                    break;
+                }
+            } else {
+                if impl_.count
+                    .compare_exchange_weak(current_count, current_count - 1, Ordering::Release, Ordering::Relaxed)
+                    .is_ok()
+                {
+                    break;
+                }
+            }
+        }
+    }
+}
+
+unsafe fn rec_mutex_try_acquire(impl_: &mut RecMutexImpl, current_thread: u64) -> bool {
+    let current_count = impl_.count.load(Ordering::Relaxed);
+
+    if current_count == 0 {
+        if impl_.count
+            .compare_exchange_weak(0, 1, Ordering::Acquire, Ordering::Relaxed)
+            .is_ok()
+        {
+            impl_.owner.store(current_thread, Ordering::Relaxed);
+            return true;
+        }
+    } else {
+        let current_owner = impl_.owner.load(Ordering::Relaxed);
+        if current_owner == current_thread {
+            if impl_.count
+                .compare_exchange_weak(
+                    current_count,
+                    current_count + 1,
+                    Ordering::Acquire,
+                    Ordering::Relaxed,
+                )
+                .is_ok()
+            {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+unsafe fn rec_mutex_wait(impl_: &mut RecMutexImpl) {
+    while impl_.count.load(Ordering::Relaxed) != 0 {
+        unsafe { lock_wait_primitive() };
+    }
+}
+
+// Read-Write Lock implementation
+// We use a simple scheme where the atomic value represents:
+// - 0: unlocked
+// - 1-0x7FFFFFFF: number of readers holding the lock
+// - 0x80000000: writer lock held
+const RW_WRITER_LOCK_BIT: u32 = 0x80000000;
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_init(rw_lock: *mut GRWLock) {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        impl_.state.store(0, Ordering::Relaxed);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_clear(_rw_lock: *mut GRWLock) {}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_writer_lock(rw_lock: *mut GRWLock) {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        loop {
+            if rw_lock_writer_try_acquire(impl_) {
+                break;
+            }
+            rw_lock_wait_for_all(impl_);
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_writer_trylock(rw_lock: *mut GRWLock) -> u32 {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        if rw_lock_writer_try_acquire(impl_) {
+            1
+        } else {
+            0
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_writer_unlock(rw_lock: *mut GRWLock) {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        impl_.state.store(0, Ordering::Release);
+        lock_notify_all();
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_reader_lock(rw_lock: *mut GRWLock) {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        loop {
+            let current = impl_.state.load(Ordering::Relaxed);
+            if current & RW_WRITER_LOCK_BIT != 0 {
+                rw_lock_wait_for_writers(impl_);
+                continue;
+            }
+            if impl_.state
+                .compare_exchange_weak(current, current + 1, Ordering::Acquire, Ordering::Relaxed)
+                .is_ok()
+            {
+                break;
+            }
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_reader_trylock(rw_lock: *mut GRWLock) -> u32 {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        if rw_lock_reader_try_acquire(impl_) {
+            1
+        } else {
+            0
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_rw_lock_reader_unlock(rw_lock: *mut GRWLock) {
+    unsafe {
+        let impl_ = rw_lock_impl(rw_lock);
+        loop {
+            let current = impl_.state.load(Ordering::Relaxed);
+            if impl_.state
+                .compare_exchange_weak(current, current - 1, Ordering::Release, Ordering::Relaxed)
+                .is_ok()
+            {
+                if current - 1 == 0 {
+                    lock_notify_all();
+                }
+                break;
+            }
+        }
+    }
+}
+
+unsafe fn rw_lock_writer_try_acquire(impl_: &mut RWLockImpl) -> bool {
+    impl_.state
+        .compare_exchange_weak(0, RW_WRITER_LOCK_BIT, Ordering::Acquire, Ordering::Relaxed)
+        .is_ok()
+}
+
+unsafe fn rw_lock_reader_try_acquire(impl_: &mut RWLockImpl) -> bool {
+    let current = impl_.state.load(Ordering::Relaxed);
+    if current & RW_WRITER_LOCK_BIT != 0 {
+        return false;
+    }
+    impl_.state
+        .compare_exchange_weak(current, current + 1, Ordering::Acquire, Ordering::Relaxed)
+        .is_ok()
+}
+
+unsafe fn rw_lock_wait_for_writers(impl_: &mut RWLockImpl) {
+    while impl_.state.load(Ordering::Relaxed) & RW_WRITER_LOCK_BIT != 0 {
+        unsafe { lock_wait_primitive() };
+    }
+}
+
+unsafe fn rw_lock_wait_for_all(impl_: &mut RWLockImpl) {
+    while impl_.state.load(Ordering::Relaxed) != 0 {
+        unsafe { lock_wait_primitive() };
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_cond_init(cond: *mut GCond) {
+    unsafe {
+        let impl_ = cond_impl(cond);
+        impl_.signal.store(0, Ordering::Relaxed);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_cond_clear(_cond: *mut GCond) {}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_cond_wait(cond: *mut GCond, mutex: *mut GMutex) {
+    unsafe {
+        g_mutex_unlock(mutex);
+
+        let impl_ = cond_impl(cond);
+        while impl_.signal.load(Ordering::Acquire) == 0 {
+            lock_wait_primitive();
+        }
+
+        g_mutex_lock(mutex);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_cond_signal(cond: *mut GCond) {
+    unsafe {
+        let impl_ = cond_impl(cond);
+        impl_.signal.store(1, Ordering::Release);
+        lock_notify_all();
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_cond_broadcast(cond: *mut GCond) {
+    unsafe {
+        let impl_ = cond_impl(cond);
+        impl_.signal.store(1, Ordering::Release);
+        lock_notify_all();
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_cond_wait_until(cond: *mut GCond, mutex: *mut GMutex, _end_time: i64) -> u32 {
+    // TODO: Implement proper timeout handling
+    g_cond_wait(cond, mutex);
+    1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_private_get(key: *mut GPrivate) -> *mut c_void {
+    unsafe {
+        let thread_id = get_current_thread_id();
+        lock_acquire(&TLS_LOCK);
+
+        ensure_tls_storage();
+        let storage_ptr = core::ptr::addr_of_mut!(TLS_STORAGE);
+        let storage = (*storage_ptr).as_ref().unwrap();
+
+        let value = storage
+            .get(&(thread_id, key))
+            .copied()
+            .unwrap_or(core::ptr::null_mut());
+
+        lock_release(&TLS_LOCK);
+        value
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn g_private_set(key: *mut GPrivate, value: *mut c_void) {
+    unsafe {
+        let thread_id = get_current_thread_id();
+        lock_acquire(&TLS_LOCK);
+
+        ensure_tls_storage();
+        let storage_ptr = core::ptr::addr_of_mut!(TLS_STORAGE);
+        let storage = (*storage_ptr).as_mut().unwrap();
+
+        storage.insert((thread_id, key), value);
+
+        lock_release(&TLS_LOCK);
+    }
+}
+
+unsafe fn ensure_tls_storage() {
+    let storage_ptr = core::ptr::addr_of_mut!(TLS_STORAGE);
+    unsafe {
+        if (*storage_ptr).is_none() {
+            *storage_ptr = Some(Box::new(BTreeMap::new()));
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _g_system_thread_create(
+    _stack_size: gulong,
+    _name: *const core::ffi::c_char,
+    func: GThreadFunc,
+    data: gpointer,
+) -> *mut GSystemThread {
+    unsafe {
+        let system_thread = crate::xnu::kalloc(core::mem::size_of::<SystemThreadImpl>()) as *mut SystemThreadImpl;
+
+        g_mutex_init(&mut (*system_thread).mutex);
+        g_cond_init(&mut (*system_thread).cond);
+        (*system_thread).thread_id.store(0, Ordering::Relaxed);
+        (*system_thread).func = func;
+        (*system_thread).data = data;
+        (*system_thread).finished.store(0, Ordering::Relaxed);
+        (*system_thread).detached.store(0, Ordering::Relaxed);
+
+        let wrapper_data = crate::xnu::kalloc(core::mem::size_of::<ThreadWrapperData>()) as *mut ThreadWrapperData;
+        (*wrapper_data).func = func;
+        (*wrapper_data).data = data;
+        (*wrapper_data).system_thread = system_thread;
+
+        let _xnu_result = crate::xnu::kernel_thread_start(thread_wrapper, wrapper_data as *mut c_void);
+
+        system_thread as *mut GSystemThread
+    }
+}
+
+extern "C" fn thread_wrapper(parameter: *mut c_void, _wait_result: i32) {
+    unsafe {
+        let wrapper_data = parameter as *mut ThreadWrapperData;
+        let func = (*wrapper_data).func;
+        let data = (*wrapper_data).data;
+        let system_thread = (*wrapper_data).system_thread;
+
+        let current_thread_id = get_current_thread_id();
+        (*system_thread).thread_id.store(current_thread_id, Ordering::Relaxed);
+
+        func.unwrap()(data);
+
+        g_mutex_lock(&mut (*system_thread).mutex);
+        (*system_thread).finished.store(1, Ordering::Relaxed);
+        g_cond_signal(&mut (*system_thread).cond);
+
+        let detached = (*system_thread).detached.load(Ordering::Relaxed);
+        g_mutex_unlock(&mut (*system_thread).mutex);
+
+        if detached != 0 {
+            cleanup_system_thread(system_thread);
+        }
+
+        cleanup_wrapper_data(wrapper_data);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _g_system_thread_detach(thread: *mut GSystemThread) {
+    unsafe {
+        let system_thread = thread as *mut SystemThreadImpl;
+
+        g_mutex_lock(&mut (*system_thread).mutex);
+        (*system_thread).detached.store(1, Ordering::Relaxed);
+
+        let finished = (*system_thread).finished.load(Ordering::Relaxed);
+        g_mutex_unlock(&mut (*system_thread).mutex);
+        if finished != 0 {
+            cleanup_system_thread(system_thread);
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _g_system_thread_wait(thread: *mut GSystemThread) {
+    unsafe {
+        let system_thread = thread as *mut SystemThreadImpl;
+
+        loop {
+            let thread_id = (*system_thread).thread_id.load(Ordering::Acquire);
+            if thread_id != 0 {
+                break;
+            }
+            core::hint::spin_loop();
+        }
+
+        g_mutex_lock(&mut (*system_thread).mutex);
+        while (*system_thread).finished.load(Ordering::Relaxed) == 0 {
+            g_cond_wait(&mut (*system_thread).cond, &mut (*system_thread).mutex);
+        }
+        g_mutex_unlock(&mut (*system_thread).mutex);
+
+        cleanup_system_thread(system_thread);
+    }
+}
+
+unsafe fn cleanup_system_thread(system_thread: *mut SystemThreadImpl) {
+    crate::xnu::free(system_thread as *mut u8, core::mem::size_of::<SystemThreadImpl>());
+}
+
+unsafe fn cleanup_wrapper_data(wrapper_data: *mut ThreadWrapperData) {
+    crate::xnu::free(wrapper_data as *mut u8, core::mem::size_of::<ThreadWrapperData>());
+}
+
+unsafe fn lock_acquire(lock: &AtomicU32) {
+    loop {
+        if unsafe { lock_try_acquire(lock) } {
+            break;
+        }
+        unsafe { lock_wait(lock) };
+    }
+}
+
+unsafe fn lock_try_acquire(lock: &AtomicU32) -> bool {
+    lock.compare_exchange_weak(0, 1, Ordering::Acquire, Ordering::Relaxed)
+        .is_ok()
+}
+
+unsafe fn lock_release(lock: &AtomicU32) {
+    lock.store(0, Ordering::Release);
+    unsafe { lock_notify_all() };
+}
+
+unsafe fn lock_wait(lock: &AtomicU32) {
+    while lock.load(Ordering::Relaxed) != 0 {
+        unsafe { lock_wait_primitive() };
+    }
+}
+
+unsafe fn lock_wait_primitive() {
+    unsafe {
+        asm!("wfe", options(nomem, nostack));
+    }
+}
+
+unsafe fn lock_notify_all() {
+    unsafe {
+        asm!("sev", options(nomem, nostack));
+    }
+}
+
+pub unsafe fn get_current_thread_id() -> u64 {
+    let thread_ptr: u64;
+    unsafe {
+        asm!("mrs {}, tpidr_el1", out(reg) thread_ptr, options(nomem, nostack));
+    }
+    thread_ptr
+}

src/barebone/agent/src/gum.rs

@@ -0,0 +1,457 @@
+use crate::{
+    bindings::{
+        _GInterfaceInfo, _GTypeInfo, _GumPageProtection_GUM_PAGE_EXECUTE,
+        _GumRwxSupport_GUM_RWX_NONE, GArray, GObject, GObjectClass, GPrivate, GType,
+        GumDebugSymbolDetails, GumExportDetails, GumExportType_GUM_EXPORT_FUNCTION,
+        GumFoundExportFunc, GumMemoryRange, GumModule, GumModuleInterface, GumModuleRegistry,
+        GumPageProtection, GumRwxSupport, GumThreadId, GumTlsKey, g_array_append_vals, g_array_new,
+        g_free, g_object_get_type, g_object_new, g_object_unref, g_once_init_enter,
+        g_once_init_leave, g_strdup, g_type_add_interface_static, g_type_class_peek_parent,
+        g_type_register_static, gboolean, gchar, gconstpointer, gpointer, gsize, guint,
+        gum_barebone_register_module,
+        gum_barebone_try_remap_writable_pages as _gum_barebone_try_remap_writable_pages,
+        gum_module_get_type, gum_mprotect, gum_query_page_size,
+    },
+    gthread, libc, xnu,
+};
+use alloc::boxed::Box;
+use alloc::ffi::CString;
+use alloc::format;
+use core::ptr;
+use core::{ffi::CStr, ptr::read_volatile};
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_process_get_current_thread_id() -> GumThreadId {
+    unsafe { gthread::get_current_thread_id() }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_barebone_query_page_size() -> guint {
+    unsafe {
+        let tcr_el1: u64;
+        core::arch::asm!("mrs {}, tcr_el1", out(reg) tcr_el1, options(nomem, nostack));
+
+        let tg0 = (tcr_el1 >> 14) & 0x3;
+
+        match tg0 {
+            0b00 => 4096,
+            0b01 => 65536,
+            0b10 => 16384,
+            _ => 4096,
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_query_rwx_support() -> GumRwxSupport {
+    _GumRwxSupport_GUM_RWX_NONE
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_memory_can_remap_writable() -> gboolean {
+    1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_memory_try_remap_writable_pages(
+    first_page: gpointer,
+    n_pages: guint,
+) -> gpointer {
+    unsafe {
+        let page_size = gum_query_page_size() as usize;
+        let mut physical_addrs = alloc::vec::Vec::with_capacity(n_pages as usize);
+
+        let mut current_page = first_page as u64;
+        for _ in 0..n_pages {
+            let phys_addr = xnu::ml_vtophys(current_page);
+            physical_addrs.push(phys_addr as gpointer);
+            current_page += page_size as u64;
+        }
+
+        _gum_barebone_try_remap_writable_pages(
+            physical_addrs.as_ptr() as *mut *const core::ffi::c_void,
+            physical_addrs.len() as guint,
+        )
+    }
+}
+
+#[unsafe(no_mangle)]
+#[inline(never)]
+pub extern "C" fn gum_barebone_try_remap_writable_pages(
+    addrs: *const gpointer,
+    n_addrs: guint,
+) -> gpointer {
+    unsafe {
+        read_volatile(&n_addrs);
+        read_volatile(addrs)
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_try_mprotect(
+    _address: gpointer,
+    _size: gsize,
+    _prot: GumPageProtection,
+) -> gboolean {
+    1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_memory_allocate(
+    _address: gpointer,
+    size: gsize,
+    _alignment: gsize,
+    prot: GumPageProtection,
+) -> gpointer {
+    let ptr = crate::xnu::kalloc(size as usize);
+    unsafe {
+        core::ptr::write_bytes(ptr, 0, size as usize);
+        if (prot & _GumPageProtection_GUM_PAGE_EXECUTE) != 0 {
+            gum_mprotect(ptr as gpointer, size, prot);
+        }
+    }
+    ptr as gpointer
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_memory_free(address: gpointer, size: gsize) -> gboolean {
+    crate::xnu::free(address as *mut u8, size as usize);
+    1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_clear_cache(address: gpointer, size: gsize) {
+    unsafe {
+        let start = address as *const u8;
+        let end = start.add(size as usize);
+        libc::__clear_cache(start, end);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_tls_key_new() -> GumTlsKey {
+    Box::into_raw(Box::new(unsafe { core::mem::zeroed::<GPrivate>() })) as GumTlsKey
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_tls_key_free(key: GumTlsKey) {
+    unsafe {
+        let _ = Box::from_raw(key as *mut GPrivate);
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_tls_key_get_value(key: GumTlsKey) -> gpointer {
+    gthread::g_private_get(key as *mut GPrivate)
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_tls_key_set_value(key: GumTlsKey, value: gpointer) {
+    gthread::g_private_set(key as *mut GPrivate, value)
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_barebone_on_registry_activating(registry: *mut GumModuleRegistry) {
+    let kernel_base = crate::xnu::get_kernel_base();
+
+    unsafe {
+        let module_infos = core::ptr::addr_of!(crate::MODULE_INFO);
+        let module_infos = &*module_infos;
+
+        let mut i = 0;
+        for module_info in module_infos.iter() {
+            let module_base = kernel_base + module_info.offset as u64;
+
+            let module_path = if i == 0 {
+                "/System/Library/Kernels/kernel"
+            } else {
+                &format!(
+                    "/System/Library/Extensions/{}.kext/{}",
+                    module_info.name, module_info.name
+                )
+            };
+            let module_range = GumMemoryRange {
+                base_address: module_base,
+                size: module_info.size as u64,
+            };
+
+            let module = gum_native_module_new(&module_path, &module_info.version, &module_range);
+            gum_barebone_register_module(registry, module);
+            g_object_unref(module as gpointer);
+
+            i += 1;
+        }
+    }
+}
+
+#[repr(C)]
+pub struct GumNativeModule {
+    parent: GObject,
+    name: *mut gchar,
+    version: *mut gchar,
+    path: *mut gchar,
+    range: GumMemoryRange,
+}
+
+#[repr(C)]
+#[allow(dead_code)]
+pub struct GumNativeModuleClass {
+    parent_class: GObjectClass,
+}
+
+static mut GUM_NATIVE_MODULE_TYPE: gsize = 0;
+static mut GUM_NATIVE_MODULE_PARENT_CLASS: *mut GObjectClass = core::ptr::null_mut();
+
+fn gum_native_module_get_type() -> GType {
+    unsafe {
+        if g_once_init_enter(
+            core::ptr::addr_of_mut!(GUM_NATIVE_MODULE_TYPE) as *mut ::core::ffi::c_void
+        ) != 0
+        {
+            let type_name = c"GumNativeModule".as_ptr() as *const gchar;
+
+            let type_info = _GTypeInfo {
+                class_size: core::mem::size_of::<GObjectClass>() as u16,
+                base_init: None,
+                base_finalize: None,
+                class_init: Some(gum_native_module_class_init),
+                class_finalize: None,
+                class_data: core::ptr::null(),
+                instance_size: core::mem::size_of::<GumNativeModule>() as u16,
+                n_preallocs: 0,
+                instance_init: None,
+                value_table: core::ptr::null(),
+            };
+
+            let new_type = g_type_register_static(g_object_get_type(), type_name, &type_info, 0);
+
+            let interface_info = _GInterfaceInfo {
+                interface_init: Some(gum_native_module_iface_init),
+                interface_finalize: None,
+                interface_data: core::ptr::null_mut(),
+            };
+
+            g_type_add_interface_static(new_type, gum_module_get_type(), &interface_info);
+
+            g_once_init_leave(
+                core::ptr::addr_of_mut!(GUM_NATIVE_MODULE_TYPE) as *mut ::core::ffi::c_void,
+                new_type as gsize,
+            );
+        }
+
+        GUM_NATIVE_MODULE_TYPE as GType
+    }
+}
+
+unsafe extern "C" fn gum_native_module_class_init(klass: gpointer, _class_data: gpointer) {
+    unsafe {
+        let object_class = klass as *mut GObjectClass;
+
+        GUM_NATIVE_MODULE_PARENT_CLASS = g_type_class_peek_parent(klass) as *mut GObjectClass;
+
+        (*object_class).finalize = Some(gum_native_module_finalize);
+    }
+}
+
+extern "C" fn gum_native_module_iface_init(g_iface: gpointer, _iface_data: gpointer) {
+    unsafe {
+        let iface = g_iface as *mut GumModuleInterface;
+        (*iface).get_name = Some(gum_native_module_get_name);
+        (*iface).get_version = Some(gum_native_module_get_version);
+        (*iface).get_path = Some(gum_native_module_get_path);
+        (*iface).get_range = Some(gum_native_module_get_range);
+        (*iface).enumerate_exports = Some(gum_native_module_enumerate_exports);
+    }
+}
+
+unsafe extern "C" fn gum_native_module_finalize(object: *mut GObject) {
+    unsafe {
+        let module = object as *mut GumNativeModule;
+
+        g_free((*module).path as gpointer);
+
+        (*GUM_NATIVE_MODULE_PARENT_CLASS).finalize.unwrap()(object);
+    }
+}
+
+fn gum_native_module_new(path: &str, version: &str, range: &GumMemoryRange) -> *mut GumModule {
+    unsafe {
+        let path_cstr = CString::new(path).unwrap();
+        let version_cstr = CString::new(version).unwrap();
+
+        let module =
+            g_object_new(gum_native_module_get_type(), ptr::null()) as *mut GumNativeModule;
+        (*module).path = g_strdup(path_cstr.as_ptr());
+        (*module).name = (*module).path.add(path.rfind('/').unwrap() + 1);
+        (*module).version = g_strdup(version_cstr.as_ptr());
+        (*module).range = *range;
+
+        module as *mut GumModule
+    }
+}
+
+extern "C" fn gum_native_module_get_name(module: *mut GumModule) -> *const gchar {
+    unsafe {
+        let native_module = module as *mut GumNativeModule;
+        (*native_module).name as *const gchar
+    }
+}
+
+extern "C" fn gum_native_module_get_version(module: *mut GumModule) -> *const gchar {
+    unsafe {
+        let native_module = module as *mut GumNativeModule;
+        (*native_module).version as *const gchar
+    }
+}
+
+extern "C" fn gum_native_module_get_path(module: *mut GumModule) -> *const gchar {
+    unsafe {
+        let native_module = module as *mut GumNativeModule;
+        (*native_module).path as *const gchar
+    }
+}
+
+extern "C" fn gum_native_module_get_range(module: *mut GumModule) -> *const GumMemoryRange {
+    unsafe {
+        let native_module = module as *mut GumNativeModule;
+        &(*native_module).range as *const GumMemoryRange
+    }
+}
+
+unsafe extern "C" fn gum_native_module_enumerate_exports(
+    self_: *mut GumModule,
+    func: GumFoundExportFunc,
+    user_data: gpointer,
+) {
+    unsafe {
+        let module = self_ as *mut GumNativeModule;
+        let module_range = &(*module).range;
+
+        let symbol_table = core::ptr::addr_of!(crate::SYMBOL_TABLE);
+        let symbol_table = &*symbol_table;
+
+        const N_EXT: u8 = 0x01; // External symbol flag
+        const N_TYPE: u8 = 0x0e; // Type mask
+        const N_SECT: u8 = 0x0e; // Defined in section
+
+        let start_address = module_range.base_address;
+        let end_address = module_range.base_address + module_range.size;
+
+        for symbol_ref in symbol_table.iter_symbols_in_range(start_address, end_address) {
+            let is_external = (symbol_ref.symbol_type() & N_EXT) != 0;
+            let is_defined = (symbol_ref.symbol_type() & N_TYPE) == N_SECT;
+            if !is_external || !is_defined {
+                continue;
+            }
+
+            let export_type = GumExportType_GUM_EXPORT_FUNCTION;
+
+            let export_details = GumExportDetails {
+                type_: export_type,
+                name: g_strdup(symbol_ref.name_ptr()),
+                address: symbol_ref.address(),
+            };
+
+            let should_continue =
+                func.unwrap()(&export_details as *const GumExportDetails, user_data);
+            if should_continue == 0 {
+                break;
+            }
+        }
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_symbol_details_from_address(
+    address: gpointer,
+    details: *mut GumDebugSymbolDetails,
+) -> gboolean {
+    unsafe {
+        let table = core::ptr::addr_of!(crate::SYMBOL_TABLE).read();
+        if let Some(symbol) = table.find_symbol_by_address(address as u64) {
+            let name_bytes = symbol.name().as_bytes();
+            let copy_len = core::cmp::min(name_bytes.len(), 2048);
+            core::ptr::copy_nonoverlapping(
+                name_bytes.as_ptr(),
+                (*details).symbol_name.as_mut_ptr() as *mut u8,
+                copy_len,
+            );
+            (*details).symbol_name[copy_len] = 0;
+
+            (*details).address = symbol.address();
+
+            (*details).module_name[0] = 0;
+            (*details).file_name[0] = 0;
+            (*details).line_number = 0;
+            (*details).column = 0;
+
+            return 1;
+        }
+
+        0
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_symbol_name_from_address(address: gpointer) -> *mut gchar {
+    unsafe {
+        let table = core::ptr::addr_of!(crate::SYMBOL_TABLE).read();
+        let name_ptr = table.find_symbol_name_ptr_by_address(address as u64);
+        g_strdup(name_ptr as *const gchar)
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_find_function(name: *const gchar) -> gpointer {
+    unsafe {
+        let target_name = CStr::from_ptr(name).to_string_lossy();
+        let table = core::ptr::addr_of!(crate::SYMBOL_TABLE).read();
+
+        if let Some(symbol) = table.find_symbol_by_name(&target_name) {
+            return symbol.address() as gpointer;
+        }
+
+        core::ptr::null_mut()
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_find_functions_named(name: *const gchar) -> *mut GArray {
+    unsafe {
+        let array = g_array_new(0, 0, core::mem::size_of::<gpointer>() as guint);
+
+        let target_name = CStr::from_ptr(name).to_string_lossy();
+        let table = core::ptr::addr_of!(crate::SYMBOL_TABLE).read();
+
+        let symbols = table.find_symbols_by_name(&target_name);
+        for symbol in symbols {
+            let addr = symbol.address() as gpointer;
+            g_array_append_vals(array, &addr as *const gpointer as gconstpointer, 1);
+        }
+
+        array
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_find_functions_matching(pattern: *const gchar) -> *mut GArray {
+    unsafe {
+        let array = g_array_new(0, 0, core::mem::size_of::<gpointer>() as guint);
+
+        let glob_pattern = CStr::from_ptr(pattern).to_string_lossy();
+        let table = core::ptr::addr_of!(crate::SYMBOL_TABLE).read();
+
+        let symbols = table.find_symbols_matching_glob(&glob_pattern);
+        for symbol in symbols {
+            let addr = symbol.address() as gpointer;
+            g_array_append_vals(array, &addr as *const gpointer as gconstpointer, 1);
+        }
+
+        array
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn gum_load_symbols(_path: *const gchar) -> gboolean {
+    0
+}

src/barebone/agent/src/hostlink_virtio.rs

@@ -0,0 +1,763 @@
+use core::cell::UnsafeCell;
+use core::ffi::c_void;
+use core::mem::size_of;
+use core::ptr::{read_volatile, write_volatile};
+use core::sync::atomic::{AtomicUsize, Ordering};
+
+use crate::gum::gum_barebone_query_page_size;
+use crate::xnu;
+
+const MMIO_SIZE: u64 = 0x200;
+
+static PAGE_SIZE: AtomicUsize = AtomicUsize::new(0);
+
+const QSZ: u16 = 64;
+
+const MAGIC: usize = 0x000;
+const VERSION: usize = 0x004;
+const DEVICE: usize = 0x008;
+const STATUS: usize = 0x070;
+
+const DEVFEAT: usize = 0x010;
+const DEVFEAT_SEL: usize = 0x014;
+const DRVFEAT: usize = 0x020;
+const DRVFEAT_SEL: usize = 0x024;
+
+const QSEL: usize = 0x030;
+const QNUM_MAX: usize = 0x034;
+const QNUM: usize = 0x038;
+const QREADY: usize = 0x044;
+
+const QDESC_LO: usize = 0x080;
+const QDESC_HI: usize = 0x084;
+const QAVAIL_LO: usize = 0x090;
+const QAVAIL_HI: usize = 0x094;
+const QUSED_LO: usize = 0x0a0;
+const QUSED_HI: usize = 0x0a4;
+
+const QNOTIFY: usize = 0x050;
+const ISR: usize = 0x060;
+const ISR_ACK: usize = 0x064;
+
+const ST_ACK: u32 = 1;
+const ST_DRV: u32 = 2;
+const ST_DRV_OK: u32 = 4;
+const ST_FEAT_OK: u32 = 8;
+const ST_FAILED: u32 = 0x80;
+
+const DEV_ID_CONSOLE: u32 = 3;
+const F_VERSION_1: u64 = 1u64 << 32;
+const F_MULTIPORT: u64 = 1u64 << 1;
+
+const INT_VRING: u32 = 1;
+
+const Q_RX0: u16 = 0;
+const Q_TX0: u16 = 1;
+const Q_CTRL_RX: u16 = 2;
+const Q_CTRL_TX: u16 = 3;
+
+#[repr(C)]
+#[derive(Copy, Clone)]
+struct VConsCtrl {
+    id: u32,
+    event: u16,
+    value: u16,
+}
+const EV_DEVICE_READY: u16 = 0;
+const EV_DEVICE_ADD: u16 = 1;
+const EV_PORT_READY: u16 = 3;
+const EV_PORT_OPEN: u16 = 6;
+const EV_CONSOLE_PORT: u16 = 4;
+
+#[repr(C)]
+struct Desc {
+    addr: u64,
+    len: u32,
+    flags: u16,
+    next: u16,
+}
+const D_NEXT: u16 = 1;
+const D_WRITE: u16 = 2;
+
+#[repr(C)]
+#[derive(Copy, Clone)]
+struct Avail {
+    flags: u16,
+    idx: u16,
+}
+
+#[repr(C)]
+#[derive(Copy, Clone)]
+struct UsedElem {
+    id: u32,
+    len: u32,
+}
+#[repr(C)]
+#[derive(Copy, Clone)]
+struct Used {
+    flags: u16,
+    idx: u16,
+}
+
+#[derive(Copy, Clone)]
+struct DmaPage {
+    va: *mut u8,
+    pa: u64,
+}
+
+fn dma_page_alloc() -> DmaPage {
+    let len = PAGE_SIZE.load(Ordering::Relaxed);
+    let va = xnu::kalloc(len);
+    let pa = xnu::ml_vtophys(va as u64);
+    DmaPage { va, pa }
+}
+
+fn dma_page_free(p: DmaPage) {
+    let len = PAGE_SIZE.load(Ordering::Relaxed);
+    xnu::free(p.va, len);
+}
+
+struct Vq {
+    sel: u16,
+    size: u16,
+    desc_va: *mut u8,
+    avail_va: *mut u8,
+    used_va: *mut u8,
+    avail_idx: u16,
+    used_idx: u16,
+    free_head: u16,
+    free_cnt: u16,
+}
+impl Vq {
+    fn new(mmio: *mut u8, sel: u16, size: u16) -> Self {
+        w32(mmio, QSEL, sel as u32);
+        let max = r32(mmio, QNUM_MAX) as u16;
+        debug_assert!(max >= size && max != 0);
+        w32(mmio, QNUM, size as u32);
+
+        let d = dma_page_alloc();
+        let a = dma_page_alloc();
+        let u = dma_page_alloc();
+
+        let ps = PAGE_SIZE.load(core::sync::atomic::Ordering::Relaxed);
+        unsafe {
+            core::ptr::write_bytes(d.va, 0, ps);
+            core::ptr::write_bytes(a.va, 0, ps);
+            core::ptr::write_bytes(u.va, 0, ps);
+        }
+
+        w64(mmio, QDESC_LO, QDESC_HI, d.pa);
+        w64(mmio, QAVAIL_LO, QAVAIL_HI, a.pa);
+        w64(mmio, QUSED_LO, QUSED_HI, u.pa);
+
+        let dp = d.va as *mut Desc;
+        for i in 0..size {
+            unsafe {
+                (*dp.add(i as usize)).flags = 0;
+                (*dp.add(i as usize)).next = if i + 1 < size { i + 1 } else { 0xFFFF };
+            }
+        }
+
+        w32(mmio, QREADY, 1);
+
+        Self {
+            sel,
+            size,
+            desc_va: d.va,
+            avail_va: a.va,
+            used_va: u.va,
+            avail_idx: 0,
+            used_idx: 0,
+            free_head: 0,
+            free_cnt: size,
+        }
+    }
+
+    fn alloc(&mut self) -> u16 {
+        debug_assert!(self.free_cnt > 0);
+        let h = self.free_head;
+        let dp = self.desc_va as *mut Desc;
+        unsafe {
+            self.free_head = (*dp.add(h as usize)).next;
+        }
+        self.free_cnt -= 1;
+        h
+    }
+
+    fn free_chain(&mut self, mut idx: u16) {
+        let dp = self.desc_va as *mut Desc;
+        loop {
+            self.free_cnt += 1;
+            let (flags, next) = unsafe {
+                let p = dp.add(idx as usize);
+                ((*p).flags, (*p).next)
+            };
+            if (flags & D_NEXT) == 0 {
+                break;
+            }
+            idx = next;
+        }
+        unsafe {
+            (*dp.add(idx as usize)).next = self.free_head;
+        }
+        self.free_head = idx;
+    }
+
+    fn push_avail(&mut self, head: u16) {
+        let ap = self.avail_va as *mut Avail;
+        let ring = unsafe { (ap as *mut u8).add(size_of::<Avail>()) as *mut u16 };
+        let slot = (self.avail_idx % self.size) as usize;
+        unsafe {
+            *ring.add(slot) = head;
+        }
+        wmb();
+        self.avail_idx = self.avail_idx.wrapping_add(1);
+        unsafe {
+            (*ap).idx = self.avail_idx;
+        }
+    }
+
+    fn pop_used(&mut self) -> Option<UsedElem> {
+        let up = self.used_va as *mut Used;
+        if unsafe { (*up).idx } == self.used_idx {
+            return None;
+        }
+        let ring = unsafe { (up as *mut u8).add(size_of::<Used>()) as *mut UsedElem };
+        let elem = unsafe { *ring.add((self.used_idx % self.size) as usize) };
+        self.used_idx = self.used_idx.wrapping_add(1);
+        Some(elem)
+    }
+}
+
+struct Inner {
+    mmio: *mut u8,
+
+    ctrl_rx: Vq,
+    ctrl_tx: Vq,
+
+    port_id: Option<u32>,
+    rx: Option<Vq>,
+    tx: Option<Vq>,
+
+    rx_need: usize,
+    rx_have: usize,
+    rx_lenbuf: [u8; 4],
+    rx_lenhave: usize,
+    rx_buf: Option<&'static mut [u8]>,
+
+    tx_head: *mut TxNode,
+    tx_tail: *mut TxNode,
+
+    ctrl_rx_pages: [Option<DmaPage>; QSZ as usize],
+    data_rx_pages: [Option<DmaPage>; QSZ as usize],
+    tx_pages: [Option<DmaPage>; QSZ as usize],
+
+    wake_token: *const u8,
+
+    on_rx: Option<fn(&[u8])>,
+}
+
+#[repr(C)]
+struct TxNode {
+    next: *mut TxNode,
+    frame: &'static [u8],
+}
+
+pub struct Hostlink {
+    state: UnsafeCell<Inner>,
+}
+
+unsafe impl Send for Hostlink {}
+
+impl Hostlink {
+    pub fn init(mmio_base: u64, irq_line: u32, on_rx: Option<fn(&[u8])>, wake_token: *const u8) -> Result<Self, ()> {
+        let page_size = gum_barebone_query_page_size();
+        PAGE_SIZE.store(page_size as usize, Ordering::Relaxed);
+
+        let mmio = xnu::ml_io_map(mmio_base, MMIO_SIZE) as *mut u8;
+        if mmio.is_null() {
+            return Err(());
+        }
+
+        w32(mmio, STATUS, 0);
+        w32(mmio, STATUS, ST_ACK | ST_DRV);
+
+        let magic_ok = r32(mmio, MAGIC) == 0x7472_6976;
+        let version_ok = r32(mmio, VERSION) == 2;
+        let device_ok = r32(mmio, DEVICE) == DEV_ID_CONSOLE;
+        if !(magic_ok && version_ok && device_ok) {
+            w32(mmio, STATUS, ST_FAILED);
+            return Err(());
+        }
+
+        let dev_lo = feat_get(mmio, 0) as u64;
+        let dev_hi = (feat_get(mmio, 1) as u64) << 32;
+        let mut drv: u64 = 0;
+        if (dev_hi & F_VERSION_1) != 0 {
+            drv |= F_VERSION_1;
+        }
+        if (dev_lo & F_MULTIPORT) != 0 {
+            drv |= F_MULTIPORT;
+        }
+        feat_set(mmio, 0, (drv & 0xffff_ffff) as u32);
+        feat_set(mmio, 1, (drv >> 32) as u32);
+        w32(mmio, STATUS, r32(mmio, STATUS) | ST_FEAT_OK);
+        let feats_ok = (r32(mmio, STATUS) & ST_FEAT_OK) != 0;
+        if !feats_ok {
+            w32(mmio, STATUS, ST_FAILED);
+            return Err(());
+        }
+
+        let ctrl_rx = Vq::new(mmio, Q_CTRL_RX, QSZ);
+        let ctrl_tx = Vq::new(mmio, Q_CTRL_TX, QSZ);
+
+        w32(mmio, STATUS, r32(mmio, STATUS) | ST_DRV_OK);
+
+        xnu::install_interrupt_handler(
+            irq_line,
+            wake_token as *mut c_void,
+            isr_wake,
+            core::ptr::null_mut(),
+        );
+
+        let inner = Inner {
+            mmio,
+            ctrl_rx,
+            ctrl_tx,
+            port_id: None,
+            rx: None,
+            tx: None,
+            rx_need: 0,
+            rx_have: 0,
+            rx_lenbuf: [0; 4],
+            rx_lenhave: 0,
+            rx_buf: None,
+            tx_head: core::ptr::null_mut(),
+            tx_tail: core::ptr::null_mut(),
+            ctrl_rx_pages: [None; QSZ as usize],
+            data_rx_pages: [None; QSZ as usize],
+            tx_pages: [None; QSZ as usize],
+            wake_token,
+            on_rx,
+        };
+
+        let hl = Hostlink {
+            state: UnsafeCell::new(inner),
+        };
+
+        hl.ctrl_prime_rx(8);
+        hl.ctrl_send(VConsCtrl {
+            id: 0,
+            event: EV_DEVICE_READY,
+            value: 1,
+        });
+
+        Ok(hl)
+    }
+
+    pub fn send(&self, payload: &[u8]) {
+        let s = unsafe { &mut *self.state.get() };
+
+        let total = 4 + payload.len();
+        let buf = xnu::kalloc(total);
+        unsafe {
+            let len = payload.len() as u32;
+            *buf.add(0) = (len & 0xFF) as u8;
+            *buf.add(1) = ((len >> 8) & 0xFF) as u8;
+            *buf.add(2) = ((len >> 16) & 0xFF) as u8;
+            *buf.add(3) = ((len >> 24) & 0xFF) as u8;
+            core::ptr::copy_nonoverlapping(payload.as_ptr(), buf.add(4), payload.len());
+        }
+        let frame: &'static [u8] = unsafe { core::slice::from_raw_parts(buf, total) };
+
+        let node = xnu::kalloc(size_of::<TxNode>()) as *mut TxNode;
+        unsafe {
+            (*node).next = core::ptr::null_mut();
+            (*node).frame = frame;
+        }
+
+        if s.tx_tail.is_null() {
+            s.tx_head = node;
+            s.tx_tail = node;
+        } else {
+            unsafe {
+                (*s.tx_tail).next = node;
+            }
+            s.tx_tail = node;
+        }
+
+        xnu::thread_wakeup(s.wake_token);
+    }
+
+    pub fn process(&self) {
+        let s = unsafe { &mut *self.state.get() };
+
+        if (r32(s.mmio, ISR) & INT_VRING) != 0 {
+            w32(s.mmio, ISR_ACK, INT_VRING);
+        }
+
+        self.ctrl_complete();
+        self.ctrl_prime_rx(QSZ as usize);
+
+        self.data_rx_complete();
+        self.data_tx_complete();
+        self.data_tx_push();
+        self.data_rx_refill();
+    }
+
+    fn ctrl_prime_rx(&self, count: usize) {
+        let s = unsafe { &mut *self.state.get() };
+        let mut posted = 0usize;
+        while posted < count {
+            if s.ctrl_rx.free_cnt == 0 {
+                break;
+            }
+            let pg = dma_page_alloc();
+            let h = s.ctrl_rx.alloc();
+            let d = s.ctrl_rx.desc_va as *mut Desc;
+            unsafe {
+                (*d.add(h as usize)).addr = pg.pa;
+                (*d.add(h as usize)).len = PAGE_SIZE.load(Ordering::Relaxed) as u32;
+                (*d.add(h as usize)).flags = D_WRITE;
+                (*d.add(h as usize)).next = 0;
+            }
+            s.ctrl_rx_pages[h as usize] = Some(pg);
+            s.ctrl_rx.push_avail(h);
+            posted += 1;
+        }
+        let sel = s.ctrl_rx.sel;
+        self.kick(sel);
+    }
+
+    fn ctrl_send(&self, msg: VConsCtrl) {
+        let s = unsafe { &mut *self.state.get() };
+        let pg = dma_page_alloc();
+        unsafe {
+            core::ptr::write(pg.va as *mut VConsCtrl, msg);
+        }
+        let h = s.ctrl_tx.alloc();
+        let d = s.ctrl_tx.desc_va as *mut Desc;
+        unsafe {
+            (*d.add(h as usize)).addr = pg.pa;
+            (*d.add(h as usize)).len = size_of::<VConsCtrl>() as u32;
+            (*d.add(h as usize)).flags = 0;
+            (*d.add(h as usize)).next = 0;
+        }
+        s.tx_pages[h as usize] = Some(pg);
+        s.ctrl_tx.push_avail(h);
+        let sel = s.ctrl_tx.sel;
+        self.kick(sel);
+    }
+
+    fn ctrl_complete(&self) {
+        let s = unsafe { &mut *self.state.get() };
+        while let Some(u) = s.ctrl_rx.pop_used() {
+            let h = u.id as u16;
+            if let Some(pg) = s.ctrl_rx_pages[h as usize].take() {
+                let ev = unsafe { *(pg.va as *const VConsCtrl) };
+                dma_page_free(pg);
+
+                match ev.event {
+                    EV_DEVICE_ADD | EV_CONSOLE_PORT => {
+                        if s.port_id.is_none() {
+                            self.setup_data_port(ev.id);
+                            self.ctrl_send(VConsCtrl {
+                                id: ev.id,
+                                event: EV_PORT_READY,
+                                value: 1,
+                            });
+                            self.ctrl_send(VConsCtrl {
+                                id: ev.id,
+                                event: EV_PORT_OPEN,
+                                value: 1,
+                            });
+                        }
+                    }
+                    _ => {}
+                }
+
+                let pg2 = dma_page_alloc();
+                let d = s.ctrl_rx.desc_va as *mut Desc;
+                unsafe {
+                    (*d.add(h as usize)).addr = pg2.pa;
+                    (*d.add(h as usize)).len = PAGE_SIZE.load(Ordering::Relaxed) as u32;
+                    (*d.add(h as usize)).flags = D_WRITE;
+                    (*d.add(h as usize)).next = 0;
+                }
+                s.ctrl_rx_pages[h as usize] = Some(pg2);
+                s.ctrl_rx.push_avail(h);
+            }
+        }
+        let sel = s.ctrl_rx.sel;
+        self.kick(sel);
+
+        while let Some(u) = s.ctrl_tx.pop_used() {
+            let head = u.id as u16;
+            if let Some(pg) = s.tx_pages[head as usize].take() {
+                dma_page_free(pg);
+            }
+            s.ctrl_tx.free_chain(head);
+        }
+    }
+
+    fn setup_data_port(&self, id: u32) {
+        let s = unsafe { &mut *self.state.get() };
+        if s.port_id.is_some() {
+            return;
+        }
+        let (rx_i, tx_i) = if id == 0 {
+            (Q_RX0, Q_TX0)
+        } else {
+            let base = 4 + ((id as u16 - 1) * 2);
+            (base, base + 1)
+        };
+        let rx = Vq::new(s.mmio, rx_i, QSZ);
+        let tx = Vq::new(s.mmio, tx_i, QSZ);
+        s.rx = Some(rx);
+        s.tx = Some(tx);
+        s.port_id = Some(id);
+        self.data_rx_refill();
+    }
+
+    fn data_rx_refill(&self) {
+        let s = unsafe { &mut *self.state.get() };
+        let Some(rxq) = s.rx.as_mut() else {
+            return;
+        };
+        while rxq.free_cnt > 0 {
+            let h = rxq.alloc();
+            let pg = dma_page_alloc();
+            let d = rxq.desc_va as *mut Desc;
+            unsafe {
+                (*d.add(h as usize)).addr = pg.pa;
+                (*d.add(h as usize)).len = PAGE_SIZE.load(Ordering::Relaxed) as u32;
+                (*d.add(h as usize)).flags = D_WRITE;
+                (*d.add(h as usize)).next = 0;
+            }
+            s.data_rx_pages[h as usize] = Some(pg);
+            rxq.push_avail(h);
+        }
+        let sel = rxq.sel;
+        self.kick(sel);
+    }
+
+    fn data_rx_complete(&self) {
+        let s = unsafe { &mut *self.state.get() };
+        let Some(rxq) = s.rx.as_mut() else {
+            return;
+        };
+        while let Some(u) = rxq.pop_used() {
+            let h = u.id as u16;
+            let n = u.len as usize;
+
+            if let Some(pg) = s.data_rx_pages[h as usize].take() {
+                {
+                    let bytes = unsafe { core::slice::from_raw_parts(pg.va, n) };
+                    self.feed_rx_stream(bytes);
+                }
+                dma_page_free(pg);
+
+                let pg2 = dma_page_alloc();
+                let d = rxq.desc_va as *mut Desc;
+                unsafe {
+                    (*d.add(h as usize)).addr = pg2.pa;
+                    (*d.add(h as usize)).len = PAGE_SIZE.load(Ordering::Relaxed) as u32;
+                    (*d.add(h as usize)).flags = D_WRITE;
+                    (*d.add(h as usize)).next = 0;
+                }
+                s.data_rx_pages[h as usize] = Some(pg2);
+                rxq.push_avail(h);
+            }
+        }
+        let sel = rxq.sel;
+        self.kick(sel);
+    }
+
+    fn feed_rx_stream(&self, mut chunk: &[u8]) {
+        let s = unsafe { &mut *self.state.get() };
+        while !chunk.is_empty() {
+            if s.rx_lenhave < 4 {
+                let need = 4 - s.rx_lenhave;
+                let take = core::cmp::min(need, chunk.len());
+                s.rx_lenbuf[s.rx_lenhave..s.rx_lenhave + take].copy_from_slice(&chunk[..take]);
+                s.rx_lenhave += take;
+                chunk = &chunk[take..];
+                if s.rx_lenhave < 4 {
+                    return;
+                }
+
+                let len = (s.rx_lenbuf[0] as usize)
+                    | ((s.rx_lenbuf[1] as usize) << 8)
+                    | ((s.rx_lenbuf[2] as usize) << 16)
+                    | ((s.rx_lenbuf[3] as usize) << 24);
+
+                if s.rx_buf.is_none() && len > 0 {
+                    let buf = xnu::kalloc(len);
+                    let slice: &'static mut [u8] =
+                        unsafe { core::slice::from_raw_parts_mut(buf, len) };
+                    s.rx_buf = Some(slice);
+                    s.rx_need = len;
+                    s.rx_have = 0;
+                }
+            }
+
+            let need = s.rx_need.saturating_sub(s.rx_have);
+            let take = core::cmp::min(need, chunk.len());
+            if let Some(ref mut buf) = s.rx_buf {
+                unsafe {
+                    core::ptr::copy_nonoverlapping(
+                        chunk.as_ptr(),
+                        buf.as_mut_ptr().wrapping_add(s.rx_have),
+                        take,
+                    );
+                }
+            }
+            s.rx_have += take;
+            chunk = &chunk[take..];
+
+            if s.rx_have == s.rx_need {
+                if let (Some(cb), Some(buf)) = (s.on_rx, &s.rx_buf) {
+                    cb(&buf[..]);
+                }
+                s.rx_buf = None;
+                s.rx_need = 0;
+                s.rx_have = 0;
+                s.rx_lenhave = 0;
+            }
+        }
+    }
+
+    fn data_tx_complete(&self) {
+        let s = unsafe { &mut *self.state.get() };
+        let Some(txq) = s.tx.as_mut() else {
+            return;
+        };
+        while let Some(u) = txq.pop_used() {
+            let mut i = u.id as u16;
+            loop {
+                if let Some(pg) = s.tx_pages[i as usize].take() {
+                    dma_page_free(pg);
+                }
+                let d = txq.desc_va as *mut Desc;
+                let (f, n) = unsafe {
+                    let p = d.add(i as usize);
+                    ((*p).flags, (*p).next)
+                };
+                if (f & D_NEXT) == 0 {
+                    break;
+                }
+                i = n;
+            }
+            txq.free_chain(u.id as u16);
+        }
+    }
+
+    fn data_tx_push(&self) {
+        let s = unsafe { &mut *self.state.get() };
+        let Some(txq) = s.tx.as_mut() else {
+            return;
+        };
+        loop {
+            let node = if s.tx_head.is_null() {
+                core::ptr::null_mut()
+            } else {
+                let n = s.tx_head;
+                s.tx_head = unsafe { (*n).next };
+                if s.tx_head.is_null() {
+                    s.tx_tail = core::ptr::null_mut();
+                }
+                n
+            };
+            if node.is_null() {
+                break;
+            }
+            let frame = unsafe { (*node).frame };
+
+            let mut off = 0usize;
+            let mut head: Option<u16> = None;
+            let mut prev = 0u16;
+
+            while off < frame.len() {
+                if txq.free_cnt == 0 {
+                    break;
+                }
+                let page = PAGE_SIZE.load(Ordering::Relaxed);
+                let chunk = core::cmp::min(page, frame.len() - off);
+                let pg = dma_page_alloc();
+                unsafe {
+                    core::ptr::copy_nonoverlapping(frame.as_ptr().add(off), pg.va, chunk);
+                }
+
+                let i = txq.alloc();
+                let d = txq.desc_va as *mut Desc;
+                unsafe {
+                    (*d.add(i as usize)).addr = pg.pa;
+                    (*d.add(i as usize)).len = chunk as u32;
+                    (*d.add(i as usize)).flags = 0;
+                    (*d.add(i as usize)).next = 0;
+                }
+                s.tx_pages[i as usize] = Some(pg);
+
+                if let Some(_h) = head {
+                    unsafe {
+                        (*d.add(prev as usize)).flags |= D_NEXT;
+                        (*d.add(prev as usize)).next = i;
+                    }
+                    prev = i;
+                } else {
+                    head = Some(i);
+                    prev = i;
+                }
+
+                off += chunk;
+            }
+
+            if let Some(h) = head {
+                let sel = txq.sel;
+                txq.push_avail(h);
+                self.kick(sel);
+            }
+
+            xnu::free(frame.as_ptr() as *mut u8, frame.len());
+            xnu::free(node as *mut u8, core::mem::size_of::<TxNode>());
+        }
+    }
+
+    fn kick(&self, sel: u16) {
+        let s = unsafe { &*self.state.get() };
+        wmb();
+        w32(s.mmio, QSEL, sel as u32);
+        w32(s.mmio, QNOTIFY, sel as u32);
+    }
+}
+
+extern "C" fn isr_wake(token: *mut c_void, _refcon: *mut c_void, _nub: *mut c_void, _src: i32) {
+    xnu::thread_wakeup(token as *const u8);
+}
+
+fn r32(mmio: *mut u8, off: usize) -> u32 {
+    unsafe { read_volatile(mmio.add(off) as *const u32) }
+}
+
+fn w32(mmio: *mut u8, off: usize, val: u32) {
+    unsafe { write_volatile(mmio.add(off) as *mut u32, val) }
+}
+
+fn w64(mmio: *mut u8, lo: usize, hi: usize, v: u64) {
+    w32(mmio, lo, (v & 0xffff_ffff) as u32);
+    w32(mmio, hi, (v >> 32) as u32);
+}
+
+fn feat_get(mmio: *mut u8, sel: u32) -> u32 {
+    w32(mmio, DEVFEAT_SEL, sel);
+    r32(mmio, DEVFEAT)
+}
+
+fn feat_set(mmio: *mut u8, sel: u32, v: u32) {
+    w32(mmio, DRVFEAT_SEL, sel);
+    w32(mmio, DRVFEAT, v)
+}
+
+fn wmb() {
+    unsafe { core::arch::asm!("dmb ishst", options(nostack, preserves_flags)) }
+}

src/barebone/agent/src/libc.rs

@@ -0,0 +1,153 @@
+use core::ptr;
+use crate::bindings::{GMutex, GRecMutex};
+use crate::gthread;
+
+static mut MALLOC_LOCK: GRecMutex = unsafe { core::mem::zeroed() };
+
+#[unsafe(no_mangle)]
+pub extern "C" fn __malloc_lock(_reent: *mut core::ffi::c_void) {
+    gthread::g_rec_mutex_lock(ptr::addr_of_mut!(MALLOC_LOCK));
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn __malloc_unlock(_reent: *mut core::ffi::c_void) {
+    gthread::g_rec_mutex_unlock(ptr::addr_of_mut!(MALLOC_LOCK));
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _fini() {
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _exit(_status: i32) -> ! {
+    loop {}
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _kill(_pid: i32, _sig: i32) -> i32 {
+    -1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _sbrk(incr: isize) -> *mut u8 {
+    const HEAP_SIZE: usize = 32 * 1024 * 1024; // 32 MB
+
+    static mut HEAP_START: *mut u8 = ptr::null_mut();
+    static mut HEAP_CURRENT: *mut u8 = ptr::null_mut();
+    static mut HEAP_MUTEX: GMutex = unsafe { core::mem::zeroed() };
+
+    unsafe {
+        gthread::g_mutex_lock(ptr::addr_of_mut!(HEAP_MUTEX));
+
+        if HEAP_START.is_null() {
+            HEAP_START = crate::xnu::kalloc(HEAP_SIZE);
+            if HEAP_START.is_null() {
+                gthread::g_mutex_unlock(ptr::addr_of_mut!(HEAP_MUTEX));
+                panic!("Failed to allocate 32 MB heap");
+            }
+            HEAP_CURRENT = HEAP_START;
+        }
+
+        let prev_heap_current = HEAP_CURRENT;
+        let new_heap_current = HEAP_CURRENT.add(incr as usize);
+
+        if new_heap_current > HEAP_START.add(HEAP_SIZE) {
+            gthread::g_mutex_unlock(ptr::addr_of_mut!(HEAP_MUTEX));
+            panic!("Heap exhausted: requested {} bytes, {} bytes remaining",
+                   incr,
+                   HEAP_START.add(HEAP_SIZE).offset_from(HEAP_CURRENT));
+        }
+
+        HEAP_CURRENT = new_heap_current;
+
+        gthread::g_mutex_unlock(ptr::addr_of_mut!(HEAP_MUTEX));
+        prev_heap_current
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _getpid() -> i32 {
+    0
+}
+
+#[repr(C)]
+struct Timeval {
+    tv_sec: i64,
+    tv_usec: i64,
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _gettimeofday(tp: *mut core::ffi::c_void, _tzp: *mut core::ffi::c_void) -> i32 {
+    let (secs, microsecs) = crate::xnu::clock_get_calendar_microtime();
+    let timeval = Timeval {
+        tv_sec: secs as i64,
+        tv_usec: microsecs as i64,
+    };
+    unsafe {
+        ptr::copy_nonoverlapping(
+            &timeval as *const Timeval as *const u8,
+            tp as *mut u8,
+            core::mem::size_of::<Timeval>(),
+        );
+    }
+    0
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _isatty(_fd: i32) -> i32 {
+    1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _open(_path: *const u8, _flags: i32, _mode: i32) -> i32 {
+    -1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _close(_fd: i32) -> i32 {
+    0
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _read(_fd: i32, _buf: *mut u8, _count: usize) -> isize {
+    0
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _write(_fd: i32, _buf: *const u8, count: usize) -> isize {
+    count as isize
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _lseek(_fd: i32, _offset: isize, _whence: i32) -> isize {
+    0
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _fstat(_fd: i32, _st: *mut core::ffi::c_void) -> i32 {
+    0
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _link(_old: *const u8, _new: *const u8) -> i32 {
+    -1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn _unlink(_path: *const u8) -> i32 {
+    -1
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn __clear_cache(_start: *const u8, _end: *const u8) {
+    // On AArch64, we need to flush the instruction cache
+    // This is a simplified implementation for the kernel environment
+    unsafe {
+        core::arch::asm!(
+            "ic iallu",     // Invalidate all instruction caches
+            "dsb sy",       // Data synchronization barrier
+            "isb",          // Instruction synchronization barrier
+            options(nomem, nostack),
+        );
+    }
+}

src/barebone/agent/src/main.rs

@@ -0,0 +1,544 @@
+#![no_main]
+#![no_std]
+
+use alloc::boxed::Box;
+use alloc::collections::BTreeMap;
+use alloc::format;
+use alloc::string::String;
+use alloc::vec::Vec;
+use core::alloc::{GlobalAlloc, Layout};
+use core::ffi::{CStr, c_void};
+use core::ptr;
+use core::ptr::null_mut;
+use core::sync::atomic::{AtomicU32, Ordering};
+
+use bindings::{
+    GBytes, GCancellable, GError, GVariant, GVariantIter, GumScript, g_error_free, g_free,
+    g_main_context_default, g_main_context_iteration, g_memdup2, g_object_unref,
+    g_variant_check_format_string, g_variant_get, g_variant_get_child_value, g_variant_get_data,
+    g_variant_get_size, g_variant_get_string, g_variant_get_uint32, g_variant_get_uint64,
+    g_variant_iter_init, g_variant_iter_next, g_variant_new, g_variant_new_from_data,
+    g_variant_new_string, g_variant_new_tuple, g_variant_new_uint32, g_variant_type_free,
+    g_variant_type_new, g_variant_unref, gchar, gpointer, gsize, gum_script_backend_create_sync,
+    gum_script_backend_obtain_qjs, gum_script_load_sync, gum_script_post,
+    gum_script_set_message_handler, gum_script_unload_sync,
+};
+use hostlink_virtio::Hostlink;
+use symbols::SymbolTable;
+
+mod glib;
+mod gthread;
+mod gum;
+mod hostlink_virtio;
+
+mod libc;
+mod pac;
+mod symbols;
+mod xnu;
+
+mod bindings {
+    #![allow(
+        dead_code,
+        improper_ctypes,
+        non_camel_case_types,
+        non_snake_case,
+        non_upper_case_globals,
+        unused_imports
+    )]
+    include!(concat!(env!("OUT_DIR"), "/bindings.rs"));
+}
+
+#[repr(u8)]
+#[derive(PartialEq, Eq, Clone, Copy, Debug)]
+pub enum FridaCommand {
+    CreateScript = 1,
+    LoadScript = 2,
+    DestroyScript = 3,
+    PostScriptMessage = 4,
+
+    Reply = 128,
+    ScriptMessage = 129,
+}
+
+impl core::fmt::Display for FridaCommand {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            FridaCommand::CreateScript => write!(f, "CreateScript"),
+            FridaCommand::LoadScript => write!(f, "LoadScript"),
+            FridaCommand::DestroyScript => write!(f, "DestroyScript"),
+            FridaCommand::PostScriptMessage => write!(f, "PostScriptMessage"),
+            FridaCommand::Reply => write!(f, "Reply"),
+            FridaCommand::ScriptMessage => write!(f, "ScriptMessage"),
+        }
+    }
+}
+
+#[derive(Debug)]
+struct HandlerResponse {
+    variant: *mut GVariant,
+}
+
+impl HandlerResponse {
+    fn success(variant: *mut GVariant) -> Self {
+        Self { variant }
+    }
+
+    fn success_empty() -> Self {
+        let variant = unsafe { g_variant_new_tuple(ptr::null(), 0) };
+        Self { variant }
+    }
+
+    fn error(message: &str) -> Self {
+        let mut c_message = String::from(message);
+        c_message.push('\0');
+        let error_variant = unsafe { g_variant_new_string(c_message.as_ptr()) };
+
+        Self {
+            variant: error_variant,
+        }
+    }
+}
+
+static mut CONFIG_DATA: &'static [u8] = &[];
+pub static mut MODULE_INFO: Vec<ModuleInfo> = Vec::new();
+pub static mut SYMBOL_TABLE: SymbolTable = SymbolTable::empty();
+
+static mut TRANSPORT_DRIVER: *mut Hostlink = core::ptr::null_mut();
+
+#[inline(always)]
+fn transport_set(driver: Hostlink) {
+    unsafe {
+        let boxed = Box::into_raw(Box::new(driver));
+        TRANSPORT_DRIVER = boxed;
+    }
+}
+
+#[inline(always)]
+fn transport_get_unchecked() -> &'static Hostlink {
+    unsafe {
+        debug_assert!(!TRANSPORT_DRIVER.is_null());
+        &*TRANSPORT_DRIVER
+    }
+}
+
+static mut SCRIPTS: BTreeMap<u32, *mut GumScript> = BTreeMap::new();
+static NEXT_SCRIPT_ID: AtomicU32 = AtomicU32::new(1);
+
+#[derive(Debug, Clone)]
+pub struct ModuleInfo {
+    pub name: String,
+    pub version: String,
+    pub offset: u32,
+    pub size: u32,
+    pub start_func_offset: u32,
+    pub stop_func_offset: u32,
+}
+
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn _start(config_data: *const u8, config_size: usize) {
+    unsafe {
+        CONFIG_DATA = core::slice::from_raw_parts(config_data, config_size);
+
+        xnu::kernel_thread_start(frida_agent_worker, 12345usize as *mut core::ffi::c_void);
+    }
+}
+
+unsafe extern "C" fn frida_agent_worker(_parameter: *mut core::ffi::c_void, _wait_result: i32) {
+    unsafe {
+        bindings::g_set_panic_handler(Some(frida_panic_handler), ptr::null_mut());
+        bindings::gum_init_embedded();
+        bindings::g_log_set_default_handler(Some(frida_log_handler), ptr::null_mut());
+
+        let (mmio, irq, kernel_base, module_info, symbol_table) =
+            parse_config(core::ptr::addr_of!(CONFIG_DATA).read());
+        xnu::set_kernel_base(kernel_base);
+        MODULE_INFO = module_info;
+        SYMBOL_TABLE = symbol_table;
+
+        transport_set(
+            Hostlink::init(
+                mmio,
+                irq,
+                Some(on_frame_from_host),
+                ptr::addr_of_mut!(glib::WAKEUP_TOKEN) as *const u8,
+            )
+            .unwrap(),
+        );
+
+        let main_context = g_main_context_default();
+
+        loop {
+            transport_get_unchecked().process();
+            g_main_context_iteration(main_context, 1);
+        }
+    }
+}
+
+fn on_frame_from_host(frame: &[u8]) {
+    if let Some(variant) = deserialize_message(&frame) {
+        process_incoming_message(variant);
+        unsafe {
+            g_variant_unref(variant);
+        }
+    }
+}
+
+unsafe fn parse_config(config: &[u8]) -> (u64, u32, u64, Vec<ModuleInfo>, SymbolTable) {
+    unsafe {
+        let type_string = c"(tuta(ssuuuu)ay)".as_ptr() as *const gchar;
+        let variant_type = g_variant_type_new(type_string);
+
+        let root_variant = g_variant_new_from_data(
+            variant_type,
+            config.as_ptr() as *const core::ffi::c_void,
+            config.len() as gsize,
+            1,
+            None,
+            ptr::null_mut(),
+        );
+
+        let hostlink_mmio_variant = g_variant_get_child_value(root_variant, 0);
+        let hostlink_mmio = g_variant_get_uint64(hostlink_mmio_variant);
+
+        let hostlink_irq_variant = g_variant_get_child_value(root_variant, 1);
+        let hostlink_irq = g_variant_get_uint32(hostlink_irq_variant);
+
+        let kernel_base_variant = g_variant_get_child_value(root_variant, 2);
+        let kernel_base = g_variant_get_uint64(kernel_base_variant);
+        xnu::set_kernel_base(kernel_base);
+
+        let module_info_variant = g_variant_get_child_value(root_variant, 3);
+        let mut iter: GVariantIter = core::mem::zeroed();
+        g_variant_iter_init(&mut iter as *mut GVariantIter, module_info_variant);
+
+        let mut module_info: Vec<ModuleInfo> = Vec::new();
+        let mut raw_name: *mut gchar = null_mut();
+        let mut raw_version: *mut gchar = null_mut();
+        let mut offset: u32 = 0;
+        let mut size: u32 = 0;
+        let mut start_func_offset: u32 = 0;
+        let mut stop_func_offset: u32 = 0;
+        while g_variant_iter_next(
+            &mut iter as *mut GVariantIter,
+            c"(&s&suuuu)".as_ptr(),
+            &mut raw_name,
+            &mut raw_version,
+            &mut offset,
+            &mut size,
+            &mut start_func_offset,
+            &mut stop_func_offset,
+        ) != 0
+        {
+            module_info.push(ModuleInfo {
+                name: String::from(CStr::from_ptr(raw_name).to_str().unwrap()),
+                version: String::from(CStr::from_ptr(raw_version).to_str().unwrap()),
+                offset,
+                size,
+                start_func_offset,
+                stop_func_offset,
+            });
+        }
+
+        let symbol_array_variant = g_variant_get_child_value(root_variant, 4);
+        let symbol_data_ptr = g_variant_get_data(symbol_array_variant) as *const u8;
+        let symbol_data_size = g_variant_get_size(symbol_array_variant) as usize;
+        let symbol_table = SymbolTable::new(core::slice::from_raw_parts(
+            symbol_data_ptr,
+            symbol_data_size,
+        ));
+
+        g_variant_unref(symbol_array_variant);
+        g_variant_unref(module_info_variant);
+        g_variant_unref(kernel_base_variant);
+        g_variant_unref(hostlink_irq_variant);
+        g_variant_unref(hostlink_mmio_variant);
+        g_variant_unref(root_variant);
+        g_variant_type_free(variant_type);
+
+        (
+            hostlink_mmio,
+            hostlink_irq,
+            kernel_base,
+            module_info,
+            symbol_table,
+        )
+    }
+}
+
+unsafe fn serialize_message(variant: *mut GVariant) -> Option<Vec<u8>> {
+    unsafe {
+        let size = g_variant_get_size(variant) as usize;
+        if size == 0 {
+            return None;
+        }
+
+        let data_ptr = g_variant_get_data(variant) as *const u8;
+        let mut result = Vec::with_capacity(size);
+        result.resize(size, 0);
+        core::ptr::copy_nonoverlapping(data_ptr, result.as_mut_ptr(), size);
+
+        Some(result)
+    }
+}
+
+fn deserialize_message(data: &[u8]) -> Option<*mut GVariant> {
+    unsafe {
+        if data.is_empty() {
+            return None;
+        }
+
+        let variant_type = g_variant_type_new(c"(yqv)".as_ptr());
+        let data_copy = g_memdup2(data.as_ptr() as *const c_void, data.len() as u64);
+        let variant = g_variant_new_from_data(
+            variant_type,
+            data_copy,
+            data.len() as u64,
+            0,
+            Some(g_free),
+            data_copy,
+        );
+        g_variant_type_free(variant_type);
+
+        if variant.is_null() {
+            None
+        } else {
+            Some(variant)
+        }
+    }
+}
+
+fn process_incoming_message(variant: *mut GVariant) {
+    {
+        let mut cmd_value: u8 = 0;
+        let mut request_id: u16 = 0;
+        let mut payload_variant: *mut GVariant = ptr::null_mut();
+
+        let cmd = unsafe {
+            g_variant_get(
+                variant,
+                c"(yqv)".as_ptr(),
+                &mut cmd_value,
+                &mut request_id,
+                &mut payload_variant,
+            );
+
+            core::mem::transmute::<u8, FridaCommand>(cmd_value)
+        };
+
+        let response = match cmd {
+            FridaCommand::CreateScript => handle_create_script(payload_variant),
+            FridaCommand::LoadScript => handle_load_script(payload_variant),
+            FridaCommand::DestroyScript => handle_destroy_script(payload_variant),
+            FridaCommand::PostScriptMessage => handle_post_script_message(payload_variant),
+            _ => HandlerResponse::error("Unknown command"),
+        };
+
+        send_command_reply(request_id, response);
+
+        unsafe { g_variant_unref(payload_variant) };
+    }
+}
+
+fn send_command_reply(request_id: u16, response: HandlerResponse) {
+    unsafe {
+        let message = g_variant_new(
+            c"(yqv)".as_ptr(),
+            FridaCommand::Reply as u8 as u32,
+            request_id as u32,
+            response.variant,
+        );
+
+        if let Some(serialized) = serialize_message(message) {
+            transport_get_unchecked().send(&serialized);
+        }
+
+        g_variant_unref(message);
+    }
+}
+
+fn handle_create_script(payload_variant: *mut GVariant) -> HandlerResponse {
+    unsafe {
+        if g_variant_check_format_string(payload_variant, c"s".as_ptr(), 0) == 0 {
+            return HandlerResponse::error("Invalid payload format: expected string");
+        }
+        let source = g_variant_get_string(payload_variant, core::ptr::null_mut());
+
+        let backend = gum_script_backend_obtain_qjs();
+        let cancellable: *mut GCancellable = ptr::null_mut();
+        let mut error: *mut GError = ptr::null_mut();
+
+        let script = gum_script_backend_create_sync(
+            backend,
+            c"agent.js".as_ptr(),
+            source,
+            ptr::null_mut(),
+            cancellable,
+            &mut error,
+        );
+
+        if !error.is_null() {
+            let error_msg = CStr::from_ptr((*error).message).to_str().unwrap();
+            let error_string = String::from(error_msg);
+            g_error_free(error);
+            return HandlerResponse::error(&error_string);
+        }
+
+        let script_id = NEXT_SCRIPT_ID.fetch_add(1, Ordering::Relaxed);
+
+        let script_id_ptr = Box::into_raw(Box::new(script_id));
+        gum_script_set_message_handler(
+            script,
+            Some(frida_message_handler),
+            script_id_ptr as *mut c_void,
+            None,
+        );
+
+        core::ptr::addr_of_mut!(SCRIPTS)
+            .as_mut()
+            .unwrap()
+            .insert(script_id, script);
+
+        HandlerResponse::success(g_variant_new_uint32(script_id))
+    }
+}
+
+unsafe extern "C" fn frida_message_handler(
+    message: *const gchar,
+    _data: *mut GBytes,
+    user_data: gpointer,
+) {
+    unsafe {
+        let script_id = *(user_data as *const u32);
+
+        let message_variant = g_variant_new(
+            c"(yqv)".as_ptr(),
+            FridaCommand::ScriptMessage as u8 as u32,
+            0u32,
+            g_variant_new(c"(us)".as_ptr(), script_id, message),
+        );
+
+        if let Some(serialized) = serialize_message(message_variant) {
+            transport_get_unchecked().send(&serialized);
+        }
+
+        g_variant_unref(message_variant);
+    }
+}
+
+fn handle_load_script(payload_variant: *mut GVariant) -> HandlerResponse {
+    unsafe {
+        if g_variant_check_format_string(payload_variant, c"u".as_ptr(), 0) == 0 {
+            return HandlerResponse::error("Invalid payload format: expected uint32");
+        }
+        let script_id = g_variant_get_uint32(payload_variant);
+
+        let Some(script) = get_script_by_id(script_id) else {
+            return HandlerResponse::error(&format!("Script with ID {} not found", script_id));
+        };
+
+        gum_script_load_sync(script, ptr::null_mut());
+
+        HandlerResponse::success_empty()
+    }
+}
+
+fn handle_destroy_script(payload_variant: *mut GVariant) -> HandlerResponse {
+    unsafe {
+        if g_variant_check_format_string(payload_variant, c"u".as_ptr(), 0) == 0 {
+            return HandlerResponse::error("Invalid payload format: expected uint32");
+        }
+        let script_id = g_variant_get_uint32(payload_variant);
+
+        let scripts = core::ptr::addr_of_mut!(SCRIPTS).as_mut().unwrap();
+        let Some(script) = scripts.remove(&script_id) else {
+            return HandlerResponse::error(&format!("Script with ID {} not found", script_id));
+        };
+
+        gum_script_unload_sync(script, ptr::null_mut());
+        g_object_unref(script as *mut c_void);
+
+        HandlerResponse::success_empty()
+    }
+}
+
+fn handle_post_script_message(payload_variant: *mut GVariant) -> HandlerResponse {
+    unsafe {
+        if g_variant_check_format_string(payload_variant, c"(us)".as_ptr(), 0) == 0 {
+            return HandlerResponse::error("Invalid payload format: expected (uint32, string)");
+        }
+        let mut script_id: u32 = 0;
+        let mut message: *const gchar = ptr::null();
+        g_variant_get(
+            payload_variant,
+            c"(u&s)".as_ptr(),
+            &mut script_id,
+            &mut message,
+        );
+
+        let Some(script) = get_script_by_id(script_id) else {
+            return HandlerResponse::error(&format!("Script with ID {} not found", script_id));
+        };
+
+        gum_script_post(script, message, ptr::null_mut());
+
+        HandlerResponse::success_empty()
+    }
+}
+
+unsafe fn get_script_by_id(script_id: u32) -> Option<*mut GumScript> {
+    unsafe {
+        let scripts = core::ptr::addr_of_mut!(SCRIPTS).as_mut().unwrap();
+        scripts.get(&script_id).copied()
+    }
+}
+
+unsafe extern "C" fn frida_panic_handler(message: *const u8, _user_data: *mut core::ffi::c_void) {
+    let msg = unsafe { core::ffi::CStr::from_ptr(message).to_str().unwrap() };
+    panic!("[Frida] {}", msg);
+}
+
+unsafe extern "C" fn frida_log_handler(
+    _log_domain: *const core::ffi::c_char,
+    _log_level: i32,
+    message: *const core::ffi::c_char,
+    _user_data: *mut core::ffi::c_void,
+) {
+    let msg = unsafe { core::ffi::CStr::from_ptr(message).to_str().unwrap() };
+    kprintln!("[Frida] {}", msg);
+}
+
+#[panic_handler]
+fn panic(info: &core::panic::PanicInfo<'_>) -> ! {
+    let mut s = format!("{}", info);
+    s.push('\0');
+    xnu::panic(s.as_str());
+    loop {}
+}
+
+pub struct XnuAllocator;
+
+unsafe impl GlobalAlloc for XnuAllocator {
+    unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
+        xnu::kalloc(layout.size())
+    }
+
+    unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) {
+        xnu::free(ptr, layout.size());
+    }
+}
+
+#[global_allocator]
+static GLOBAL: XnuAllocator = XnuAllocator;
+extern crate alloc;
+
+#[macro_export]
+macro_rules! kprintln {
+    ($($arg:tt)*) => {{
+        use core::fmt::Write;
+        let mut buf = alloc::string::String::new();
+        write!(&mut buf, $($arg)*).unwrap();
+        buf.push('\n');
+        buf.push('\0');
+        crate::xnu::io_log(&buf)
+    }};
+}

src/barebone/agent/src/pac.rs

@@ -0,0 +1,28 @@
+use core::arch::asm;
+
+pub unsafe fn ptrauth_sign(ptr: *const u8, discriminator: usize) -> *const u8 {
+    let signed: usize;
+    unsafe {
+        asm!(
+            ".inst 0xdac10020",       // pacia x0, x1
+            in("x0") ptr as usize,
+            in("x1") discriminator,
+            lateout("x0") signed,
+            options(nomem, nostack),
+        );
+    }
+    signed as *const u8
+}
+
+pub unsafe fn ptrauth_strip_data(ptr: *const u8) -> *const u8 {
+    let stripped: usize;
+    unsafe {
+        asm!(
+            ".inst 0xdac143e0",       // xpaci x0
+            in("x0") ptr as usize,
+            lateout("x0") stripped,
+            options(nomem, nostack),
+        );
+    }
+    stripped as *const u8
+}

src/barebone/agent/src/symbols.rs

@@ -0,0 +1,443 @@
+use crate::bindings::{
+    GPatternSpec, g_pattern_spec_free, g_pattern_spec_match_string, g_pattern_spec_new,
+};
+use crate::xnu::get_kernel_base;
+use alloc::ffi::CString;
+use core::cmp::Ordering;
+use core::ffi::{CStr, c_char};
+use core::mem::size_of;
+use core::ptr;
+
+pub struct SymbolTable {
+    data: &'static [u8],
+    symbol_count: usize,
+}
+
+impl SymbolTable {
+    pub const fn empty() -> Self {
+        Self {
+            data: &[],
+            symbol_count: 0,
+        }
+    }
+
+    pub fn new(data: &'static [u8]) -> Self {
+        if data.len() < 4 {
+            return Self::empty();
+        }
+        let symbol_count = unsafe { *(data.as_ptr() as *const u32) as usize };
+        Self { data, symbol_count }
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.symbol_count == 0
+    }
+
+    pub fn symbol_count(&self) -> usize {
+        self.symbol_count
+    }
+
+    pub fn find_symbol_by_name(&self, name: &str) -> Option<SymbolRef> {
+        let (_, entry) = self.binary_search_by_name(name)?;
+        Some(SymbolRef {
+            symbol_table: self,
+            entry,
+            kernel_base: get_kernel_base(),
+        })
+    }
+
+    pub fn find_symbols_by_name(&self, name: &str) -> SymbolsByNameIterator {
+        let (found_index, _) = match self.binary_search_by_name(name) {
+            Some(result) => result,
+            None => return SymbolsByNameIterator::empty(self),
+        };
+
+        let mut start = found_index;
+        let mut end = found_index;
+
+        while start > 0 {
+            let entry = self.get_symbol_entry_by_name_index(start - 1);
+            let symbol_name = entry.name(self);
+            if symbol_name == name {
+                start -= 1;
+            } else {
+                break;
+            }
+        }
+
+        while end + 1 < self.symbol_count {
+            let entry = self.get_symbol_entry_by_name_index(end + 1);
+            let symbol_name = entry.name(self);
+            if symbol_name == name {
+                end += 1;
+            } else {
+                break;
+            }
+        }
+
+        SymbolsByNameIterator {
+            symbol_table: self,
+            current_index: start,
+            end_index: end + 1,
+            kernel_base: get_kernel_base(),
+        }
+    }
+
+    pub fn find_symbols_matching_glob(&self, pattern: &str) -> SymbolsMatchingIterator {
+        if self.is_empty() {
+            return SymbolsMatchingIterator::empty(self);
+        }
+
+        let pattern_cstr = CString::new(pattern).unwrap();
+        let pspec = unsafe { g_pattern_spec_new(pattern_cstr.as_ptr()) };
+
+        SymbolsMatchingIterator {
+            symbol_table: self,
+            current_index: 0,
+            end_index: self.symbol_count,
+            pspec,
+            kernel_base: get_kernel_base(),
+        }
+    }
+
+    pub fn find_symbol_by_address(&self, address: u64) -> Option<SymbolRef> {
+        let target_offset = (address - get_kernel_base()) as u32;
+        let (_, entry) = self.binary_search_by_address(target_offset)?;
+        Some(SymbolRef {
+            symbol_table: self,
+            entry,
+            kernel_base: get_kernel_base(),
+        })
+    }
+
+    pub fn find_symbol_name_ptr_by_address(&self, address: u64) -> *const c_char {
+        let target_offset = (address - get_kernel_base()) as u32;
+        if let Some((_, entry)) = self.binary_search_by_address(target_offset) {
+            entry.name_ptr(self)
+        } else {
+            ptr::null()
+        }
+    }
+
+    pub fn find_closest_symbol_by_address(&self, address: u64) -> Option<SymbolRef> {
+        let kernel_base = get_kernel_base();
+        let target_offset = (address - kernel_base) as u32;
+        let (_, entry) = self.binary_search_closest_by_address(target_offset)?;
+        Some(SymbolRef {
+            symbol_table: self,
+            entry,
+            kernel_base,
+        })
+    }
+
+    pub fn iter_symbols_in_range(&self, start_address: u64, end_address: u64) -> SymbolsInRangeIterator {
+        if self.is_empty() {
+            return SymbolsInRangeIterator {
+                symbol_table: self,
+                current_index: 0,
+                end_index: 0,
+                end_offset: 0,
+                kernel_base: get_kernel_base(),
+            };
+        }
+
+        let kernel_base = get_kernel_base();
+        let start_offset = (start_address - kernel_base) as u32;
+        let end_offset = (end_address - kernel_base) as u32;
+
+        let mut left = 0;
+        let mut right = self.symbol_count;
+
+        while left < right {
+            let mid = left + (right - left) / 2;
+            let entry = self.get_symbol_entry_by_address_index(mid);
+
+            if entry.address_offset < start_offset {
+                left = mid + 1;
+            } else {
+                right = mid;
+            }
+        }
+
+        while left > 0 {
+            let prev_entry = self.get_symbol_entry_by_address_index(left - 1);
+            if prev_entry.address_offset >= start_offset {
+                left -= 1;
+            } else {
+                break;
+            }
+        }
+
+        SymbolsInRangeIterator {
+            symbol_table: self,
+            current_index: left,
+            end_index: self.symbol_count,
+            end_offset,
+            kernel_base,
+        }
+    }
+
+    fn get_symbol_entry_by_name_index(&self, index: usize) -> &SymbolEntry {
+        let offset = self.name_index_start() + index * 4;
+        let symbol_offset = unsafe { *(self.data.as_ptr().add(offset) as *const u32) as usize };
+        self.symbol_entry_at(symbol_offset)
+    }
+
+    fn get_symbol_entry_by_address_index(&self, index: usize) -> &SymbolEntry {
+        let offset = self.address_index_start() + index * 4;
+        let symbol_offset = unsafe { *(self.data.as_ptr().add(offset) as *const u32) as usize };
+        self.symbol_entry_at(symbol_offset)
+    }
+
+    fn symbol_entry_at(&self, offset: usize) -> &SymbolEntry {
+        unsafe { &*(self.data.as_ptr().add(offset) as *const SymbolEntry) }
+    }
+
+    fn name_index_start(&self) -> usize {
+        4
+    }
+
+    fn address_index_start(&self) -> usize {
+        4 + self.symbol_count * 4
+    }
+
+    fn binary_search_by_name(&self, name: &str) -> Option<(usize, &SymbolEntry)> {
+        self.binary_search(
+            |table, mid| table.get_symbol_entry_by_name_index(mid),
+            |entry| entry.name(self).cmp(name),
+            false,
+        )
+    }
+
+    fn binary_search_by_address(&self, target_offset: u32) -> Option<(usize, &SymbolEntry)> {
+        self.binary_search(
+            |table, mid| table.get_symbol_entry_by_address_index(mid),
+            |entry| entry.address_offset.cmp(&target_offset),
+            false,
+        )
+    }
+
+    fn binary_search_closest_by_address(
+        &self,
+        target_offset: u32,
+    ) -> Option<(usize, &SymbolEntry)> {
+        self.binary_search(
+            |table, mid| table.get_symbol_entry_by_address_index(mid),
+            |entry| entry.address_offset.cmp(&target_offset),
+            true,
+        )
+    }
+
+    fn binary_search<F, C>(
+        &self,
+        get_entry_fn: F,
+        compare_fn: C,
+        find_closest: bool,
+    ) -> Option<(usize, &SymbolEntry)>
+    where
+        F: Fn(&Self, usize) -> &SymbolEntry,
+        C: Fn(&SymbolEntry) -> Ordering,
+    {
+        if self.is_empty() {
+            return None;
+        }
+
+        let mut left = 0;
+        let mut right = self.symbol_count;
+        let mut best_match: Option<(usize, &SymbolEntry)> = None;
+
+        while left < right {
+            let mid = left + (right - left) / 2;
+            let entry = get_entry_fn(self, mid);
+
+            match compare_fn(entry) {
+                Ordering::Equal => return Some((mid, entry)),
+                Ordering::Less => {
+                    if find_closest {
+                        best_match = Some((mid, entry));
+                    }
+                    left = mid + 1;
+                }
+                Ordering::Greater => right = mid,
+            }
+        }
+
+        best_match
+    }
+}
+
+#[repr(C)]
+struct SymbolEntry {
+    address_offset: u32,
+    symbol_type: u8,
+    section: u8,
+    description: u16,
+}
+
+impl SymbolEntry {
+    fn name<'a>(&self, symbol_table: &'a SymbolTable) -> &'a str {
+        unsafe {
+            CStr::from_ptr(self.name_ptr(symbol_table))
+                .to_str()
+                .unwrap()
+        }
+    }
+
+    fn name_ptr(&self, symbol_table: &SymbolTable) -> *const c_char {
+        let entry_ptr = self as *const SymbolEntry as *const u8;
+        let data_start = symbol_table.data.as_ptr();
+        let entry_offset = unsafe { entry_ptr.offset_from(data_start) as usize };
+        let name_start = entry_offset + size_of::<SymbolEntry>();
+
+        unsafe { symbol_table.data.as_ptr().add(name_start) as *const c_char }
+    }
+}
+
+pub struct SymbolRef<'a> {
+    symbol_table: &'a SymbolTable,
+    entry: &'a SymbolEntry,
+    kernel_base: u64,
+}
+
+impl<'a> SymbolRef<'a> {
+    pub fn name(&self) -> &'a str {
+        self.entry.name(self.symbol_table)
+    }
+
+    pub fn name_ptr(&self) -> *const c_char {
+        self.entry.name_ptr(self.symbol_table)
+    }
+
+    pub fn address(&self) -> u64 {
+        self.kernel_base + self.entry.address_offset as u64
+    }
+
+    pub fn symbol_type(&self) -> u8 {
+        self.entry.symbol_type
+    }
+
+    pub fn section(&self) -> u8 {
+        self.entry.section
+    }
+
+    pub fn description(&self) -> u16 {
+        self.entry.description
+    }
+}
+
+pub struct SymbolsByNameIterator<'a> {
+    symbol_table: &'a SymbolTable,
+    current_index: usize,
+    end_index: usize,
+    kernel_base: u64,
+}
+
+impl<'a> SymbolsByNameIterator<'a> {
+    fn empty(symbol_table: &'a SymbolTable) -> Self {
+        Self {
+            symbol_table,
+            current_index: 0,
+            end_index: 0,
+            kernel_base: get_kernel_base(),
+        }
+    }
+}
+
+impl<'a> Iterator for SymbolsByNameIterator<'a> {
+    type Item = SymbolRef<'a>;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        if self.current_index == self.end_index {
+            return None;
+        }
+
+        let entry = self.symbol_table.get_symbol_entry_by_name_index(self.current_index);
+        self.current_index += 1;
+
+        Some(SymbolRef {
+            symbol_table: self.symbol_table,
+            entry,
+            kernel_base: self.kernel_base,
+        })
+    }
+}
+
+pub struct SymbolsMatchingIterator<'a> {
+    symbol_table: &'a SymbolTable,
+    current_index: usize,
+    end_index: usize,
+    pspec: *mut GPatternSpec,
+    kernel_base: u64,
+}
+
+impl<'a> SymbolsMatchingIterator<'a> {
+    fn empty(symbol_table: &'a SymbolTable) -> Self {
+        Self {
+            symbol_table,
+            current_index: 0,
+            end_index: 0,
+            pspec: ptr::null_mut(),
+            kernel_base: get_kernel_base(),
+        }
+    }
+}
+
+impl<'a> Iterator for SymbolsMatchingIterator<'a> {
+    type Item = SymbolRef<'a>;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        while self.current_index != self.end_index {
+            let entry = self.symbol_table.get_symbol_entry_by_name_index(self.current_index);
+            self.current_index += 1;
+
+            if unsafe { g_pattern_spec_match_string(self.pspec, entry.name_ptr(self.symbol_table)) } != 0 {
+                return Some(SymbolRef {
+                    symbol_table: self.symbol_table,
+                    entry,
+                    kernel_base: self.kernel_base,
+                });
+            }
+        }
+
+        None
+    }
+}
+
+impl<'a> Drop for SymbolsMatchingIterator<'a> {
+    fn drop(&mut self) {
+        if !self.pspec.is_null() {
+            unsafe { g_pattern_spec_free(self.pspec) };
+        }
+    }
+}
+
+pub struct SymbolsInRangeIterator<'a> {
+    symbol_table: &'a SymbolTable,
+    current_index: usize,
+    end_index: usize,
+    end_offset: u32,
+    kernel_base: u64,
+}
+
+impl<'a> Iterator for SymbolsInRangeIterator<'a> {
+    type Item = SymbolRef<'a>;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        while self.current_index != self.end_index {
+            let entry = self.symbol_table.get_symbol_entry_by_address_index(self.current_index);
+            self.current_index += 1;
+
+            if entry.address_offset >= self.end_offset {
+                break;
+            }
+
+            return Some(SymbolRef {
+                symbol_table: self.symbol_table,
+                entry,
+                kernel_base: self.kernel_base,
+            });
+        }
+
+        None
+    }
+}

src/barebone/agent/src/xnu.rs

@@ -0,0 +1,239 @@
+use core::ffi::c_void;
+use core::sync::atomic::{AtomicU64, Ordering};
+
+static KERNEL_BASE: AtomicU64 = AtomicU64::new(0);
+
+pub fn get_kernel_base() -> u64 {
+    KERNEL_BASE.load(Ordering::Relaxed)
+}
+
+pub fn set_kernel_base(base: u64) {
+    KERNEL_BASE.store(base, Ordering::Relaxed);
+}
+
+type ContinuationFn = unsafe extern "C" fn(_parameter: *mut c_void, _wait_result: i32);
+
+unsafe extern "C" {
+    static _panic: unsafe extern "C" fn(*const u8);
+    static _IOLog: unsafe extern "C" fn(*const u8, ...);
+    static _kalloc: unsafe extern "C" fn(usize) -> *mut u8;
+    static _kfree: unsafe extern "C" fn(*mut u8, usize) -> *mut u8;
+    static _kernel_thread_start:
+        unsafe extern "C" fn(*const (), *mut c_void, *mut *mut c_void) -> isize;
+    static _assert_wait: unsafe extern "C" fn(*const u8, u32) -> i32;
+    static _assert_wait_timeout: unsafe extern "C" fn(*const u8, u32, u32, u32) -> i32;
+    static _thread_block: unsafe extern "C" fn(Option<ContinuationFn>) -> i32;
+    static _thread_wakeup: unsafe extern "C" fn(*const u8) -> i32;
+    static _mach_absolute_time: unsafe extern "C" fn() -> u64;
+    static _absolutetime_to_nanoseconds: unsafe extern "C" fn(u64, *mut u64);
+    static _clock_get_calendar_microtime: unsafe extern "C" fn(*mut u32, *mut u32);
+    static _ml_io_map: unsafe extern "C" fn(u64, u64) -> *mut c_void;
+    static _ml_vtophys: unsafe extern "C" fn(u64) -> u64;
+    static __ZN9IOService11getPlatformEv: unsafe extern "C" fn() -> *mut c_void;
+    static __ZN9IOServiceC2Ev: unsafe extern "C" fn(*mut core::ffi::c_void);
+    static __ZN8OSSymbol17withCStringNoCopyEPKc:
+        unsafe extern "C" fn(*const core::ffi::c_char) -> *const OSSymbol;
+    static __ZN6OSData9withBytesEPKvj:
+        unsafe extern "C" fn(*const core::ffi::c_void, u32) -> *mut OSData;
+}
+
+const IO_SERVICE_VTABLE_LENGTH: isize = 168;
+
+const VT_LOOKUP_IC: isize = IO_SERVICE_VTABLE_LENGTH + 25; // IOPlatformExpert
+const VT_REGISTER_INT: isize = IO_SERVICE_VTABLE_LENGTH + 0; // IOInterruptController
+const VT_ENABLE_INT: isize = IO_SERVICE_VTABLE_LENGTH + 3; // IOInterruptController
+
+pub fn panic(msg: &str) {
+    unsafe { _panic(msg.as_ptr()) };
+}
+
+pub fn io_log(msg: &str) {
+    unsafe {
+        _IOLog(msg.as_ptr());
+    }
+}
+
+pub fn kalloc(size: usize) -> *mut u8 {
+    unsafe { _kalloc(size) }
+}
+
+pub fn free(ptr: *mut u8, size: usize) {
+    unsafe {
+        _kfree(ptr, size);
+    }
+}
+
+pub fn kernel_thread_start(continuation: ContinuationFn, thread_parameter: *mut c_void) -> isize {
+    let mut new_thread: *mut c_void = core::ptr::null_mut();
+    return unsafe {
+        let ptr = crate::pac::ptrauth_sign(continuation as *const u8, 0xd507);
+        _kernel_thread_start(
+            core::mem::transmute(ptr),
+            thread_parameter,
+            &mut new_thread as *mut *mut c_void,
+        )
+        // TODO: Call thread_deallocate()
+    };
+}
+
+pub const THREAD_INTERRUPTIBLE: u32 = 1;
+pub const THREAD_WAITING: i32 = -1;
+
+pub fn assert_wait(event: *const u8, interruptible: u32) -> i32 {
+    unsafe { _assert_wait(event, interruptible) }
+}
+
+pub fn assert_wait_timeout(
+    event: *const u8,
+    interruptible: u32,
+    interval: u32,
+    scale_factor: u32,
+) -> i32 {
+    unsafe { _assert_wait_timeout(event, interruptible, interval, scale_factor) }
+}
+
+pub fn thread_block(continuation: Option<ContinuationFn>) -> i32 {
+    unsafe { _thread_block(continuation) }
+}
+
+pub fn thread_wakeup(event: *const u8) -> i32 {
+    unsafe { _thread_wakeup(event) }
+}
+
+pub fn mach_absolute_time() -> u64 {
+    unsafe { _mach_absolute_time() }
+}
+
+pub fn absolutetime_to_nanoseconds(abstime: u64) -> u64 {
+    let mut nanoseconds: u64 = 0;
+    unsafe {
+        _absolutetime_to_nanoseconds(abstime, &mut nanoseconds);
+    }
+    nanoseconds
+}
+
+pub fn clock_get_calendar_microtime() -> (u32, u32) {
+    let mut secs: u32 = 0;
+    let mut microsecs: u32 = 0;
+    unsafe {
+        _clock_get_calendar_microtime(&mut secs, &mut microsecs);
+    }
+    (secs, microsecs)
+}
+
+pub fn ml_io_map(phys_addr: u64, size: u64) -> *mut c_void {
+    unsafe { _ml_io_map(phys_addr, size) }
+}
+
+pub fn ml_vtophys(vaddr: u64) -> u64 {
+    unsafe { _ml_vtophys(vaddr) }
+}
+
+pub type IOInterruptHandler =
+    extern "C" fn(target: *mut c_void, refcon: *mut c_void, nub: *mut c_void, source: i32);
+
+pub fn install_interrupt_handler(
+    irq: u32,
+    target: *mut c_void,
+    handler: IOInterruptHandler,
+    refcon: *mut c_void,
+) -> i32 {
+    let pe = unsafe { __ZN9IOService11getPlatformEv() };
+
+    let name =
+        unsafe { __ZN8OSSymbol17withCStringNoCopyEPKc(c"IOInterruptController0000001A".as_ptr()) };
+
+    let lookup: extern "C" fn(*mut IOPlatformExpert, *mut OSSymbol) -> *mut IOInterruptController =
+        vf(pe as _, VT_LOOKUP_IC);
+    let ic = lookup(pe as *mut IOPlatformExpert, name as *mut OSSymbol);
+    if ic.is_null() {
+        panic!("Failed to lookup IOInterruptController");
+    }
+
+    let nub = kalloc(0x88);
+    unsafe {
+        core::ptr::write_bytes(nub, 0, 0x88);
+        __ZN9IOServiceC2Ev(nub as *mut core::ffi::c_void);
+    }
+
+    type IOServiceInitFn = unsafe extern "C" fn(*mut c_void, *mut c_void) -> bool;
+    let init_fn: IOServiceInitFn = vf(nub as *mut c_void, 21);
+    unsafe { init_fn(nub as *mut c_void, core::ptr::null_mut()) };
+
+    let interrupt_sources =
+        kalloc(core::mem::size_of::<IOInterruptSource>()) as *mut IOInterruptSource;
+
+    let source_bytes = irq.to_ne_bytes();
+    let vector_data =
+        unsafe { __ZN6OSData9withBytesEPKvj(source_bytes.as_ptr() as *const core::ffi::c_void, 4) };
+
+    unsafe {
+        (*interrupt_sources).interrupt_controller = ic;
+        (*interrupt_sources).vector_data = vector_data;
+    }
+
+    unsafe {
+        let interrupt_sources_ptr = (nub as *mut u8).offset(0x80) as *mut *mut IOInterruptSource;
+        *interrupt_sources_ptr = interrupt_sources;
+    }
+
+    let reg: extern "C" fn(
+        *mut _,
+        *mut c_void,
+        i32,
+        *mut c_void,
+        IOInterruptHandler,
+        *mut c_void,
+    ) -> i32 = vf(ic as _, VT_REGISTER_INT);
+
+    let signed_handler = unsafe {
+        let handler_ptr = crate::pac::ptrauth_sign(handler as *const u8, 0xd36);
+        core::mem::transmute::<*const u8, IOInterruptHandler>(handler_ptr)
+    };
+
+    let kr = reg(ic, nub as *mut c_void, 0, target, signed_handler, refcon);
+    if kr != 0 {
+        return kr;
+    }
+
+    let en: extern "C" fn(*mut _, *mut c_void, i32) -> i32 = vf(ic as _, VT_ENABLE_INT);
+    en(ic, nub as *mut c_void, 0)
+}
+
+#[repr(C)]
+struct IOPlatformExpert {
+    _p: [u8; 0],
+}
+
+#[repr(C)]
+struct IOInterruptController {
+    _p: [u8; 0],
+}
+
+#[repr(C)]
+struct OSSymbol {
+    _p: [u8; 0],
+}
+
+#[repr(C)]
+struct OSData {
+    _p: [u8; 0],
+}
+
+#[repr(C)]
+struct IOInterruptSource {
+    interrupt_controller: *mut IOInterruptController,
+    vector_data: *mut OSData,
+}
+
+#[inline(always)]
+fn vf<T>(obj: *mut c_void, slot: isize) -> T
+where
+    T: Copy,
+{
+    let vtable_ptr = unsafe { *(obj as *const *const usize) };
+    let vtable = unsafe { crate::pac::ptrauth_strip_data(vtable_ptr as *const u8) as *const usize };
+    let entry = unsafe { *vtable.offset(slot) };
+    let entry_ptr = unsafe { crate::pac::ptrauth_strip_data(entry as *const u8) };
+    unsafe { core::mem::transmute_copy::<*const u8, T>(&entry_ptr) }
+}

src/barebone/agent/start_qemu.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+QEMUAppleSilicon/build/qemu-system-aarch64 \
+    -M t8030,memory-backend=ram,trustcache=iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/038-44135-124.dmg.trustcache,ticket=root_ticket.der,sep-fw=sep-firmware.n104.RELEASE.new.img4,sep-rom=AppleSEPROM-Cebu-B1,kaslr-off=true,usb-conn-type=unix,usb-conn-addr=/Users/oleavr/src/frida-barebone-ios/usb.socket \
+    -object memory-backend-file,id=ram,size=4G,mem-path="/Volumes/RAM Disk/ios-dram",share=on \
+    -kernel iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/kernelcache.research.iphone12b \
+    -dtb iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/all_flash/DeviceTree.n104ap.im4p \
+    -append "tlto_us=-1 mtxspin=-1 agm-genuine=1 agm-authentic=1 agm-trusted=1 serial=3 launchd_unsecure_cache=1 wdt=-1" \
+    -smp 7 \
+    -drive file=sep_nvram,if=pflash,format=qcow2 \
+    -drive file=sep_ssc,if=pflash,format=qcow2 \
+    -drive file=nvme.1,format=qcow2,if=none,id=drive.1 -device nvme-ns,drive=drive.1,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 \
+    -drive file=nvme.2,format=qcow2,if=none,id=drive.2 -device nvme-ns,drive=drive.2,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 \
+    -drive file=nvme.3,format=qcow2,if=none,id=drive.3 -device nvme-ns,drive=drive.3,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 \
+    -drive file=nvme.4,format=qcow2,if=none,id=drive.4 -device nvme-ns,drive=drive.4,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 \
+    -drive file=nvram,if=none,format=qcow2,id=nvram -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 \
+    -drive file=nvme.6,format=qcow2,if=none,id=drive.6 -device nvme-ns,drive=drive.6,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 \
+    -drive file=nvme.7,format=qcow2,if=none,id=drive.7 -device nvme-ns,drive=drive.7,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 \
+    -initrd iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/038-44135-124.dmg \
+    -serial mon:stdio \
+    -monitor tcp:127.0.0.1:9001,server,nowait \
+    -gdb tcp::9000

src/barebone/agent/tools/interrupt-controllers.xml

@@ -0,0 +1,40 @@
+<dict ID="0">
+  <key>IOPlatformInterruptController</key>
+  <string ID="1">IOCPUInterruptController is not serializable</string>
+
+  <key>IOInterruptController0000001A</key>
+  <string ID="2">AppleInterruptController is not serializable</string>
+
+  <key>IOInterruptController00000048</key>
+  <string ID="3">AppleS5L8960XGPIOIC is not serializable</string>
+
+  <key>IOInterruptController00000047</key>
+  <string ID="4">AppleS5L8960XGPIOIC is not serializable</string>
+
+  <key>IOInterruptController00000023</key>
+  <string ID="5">AppleS5L8960XGPIOIC is not serializable</string>
+
+  <key>IOInterruptController00000049</key>
+  <string ID="6">AppleS5L8960XGPIOIC is not serializable</string>
+
+  <key>IOInterruptController0000008B</key>
+  <string ID="7">AppleT8015SPMIController is not serializable</string>
+
+  <key>IOInterruptController00000084</key>
+  <string ID="8">AppleT8015SPMIController is not serializable</string>
+
+  <key>ApplePCIEMSIController-apcie</key>
+  <string ID="9">ApplePCIEMSIController is not serializable</string>
+
+  <key>AppleEmbeddedPCIEPort2</key>
+  <string ID="10">AppleT8030PCIePort is not serializable</string>
+
+  <key>AppleEmbeddedPCIEPort3</key>
+  <string ID="11">AppleT8030PCIePort is not serializable</string>
+
+  <key>IOInterruptController00000087</key>
+  <string ID="12">AppleT8015SPMIController is not serializable</string>
+
+  <key>IOInterruptController0000005F</key>
+  <string ID="13">AppleSMCPMU is not serializable</string>
+</dict>

src/barebone/agent/tools/osvalue.js

@@ -0,0 +1,33 @@
+const osSerialize_withCapacity = new NativeFunction(ptr('0xfffffff007fbf074'), 'pointer', ['uint']);
+
+const UNPAC_MASK = ptr('0xfffffff000000000');
+
+const serializer = osSerialize_withCapacity(4096);
+
+const gIOInterruptControllers = ptr('0xfffffff009a3f090').readPointer();
+
+const serialize = new NativeFunction(implFor(6, vtableOf(gIOInterruptControllers)), 'uint' /* 'bool' */, ['pointer', 'pointer']);
+console.log('serialize() is at:', serialize.handle);
+const result = serialize(gIOInterruptControllers, serializer);
+console.log('result returned:', result);
+
+const getText = new NativeFunction(implFor(15, vtableOf(serializer)), 'pointer', ['pointer']);
+const text = getText(serializer);
+console.log('Got text:', text.readUtf8String(text));
+
+const release = new NativeFunction(implFor(5, vtableOf(serializer)), 'void', ['pointer']);
+release(serializer);
+
+Object.assign(globalThis, { osSerialize_withCapacity });
+
+function implFor(n, vtable) {
+  return unpac(vtable.add(n * Process.pointerSize).readPointer());
+}
+
+function vtableOf(instance) {
+  return unpac(instance.readPointer());
+}
+
+function unpac(p) {
+  return p.or(UNPAC_MASK);
+}

src/barebone/agent/tools/scan_hex_pattern.py

@@ -0,0 +1,37 @@
+import os
+import r2pipe
+
+def scan_files_for_pattern(directory, hex_pattern, file_extension=None):
+    search_command = "/xj " + hex_pattern.strip()
+
+    for root, _, files in os.walk(directory):
+        for filename in files:
+            if file_extension and not filename.endswith(file_extension):
+                continue
+
+            file_path = os.path.join(root, filename)
+            try:
+                r2 = r2pipe.open(file_path, flags=["-n"])
+                r2.cmd("e io.cache=true")
+
+                result = r2.cmdj(search_command)
+
+                if result:
+                    print(f"Found in {file_path}:")
+                    for match in result:
+                        print(f"  - Offset: 0x{match['offset']:x}")
+
+                r2.quit()
+            except Exception as e:
+                print(f"    Error processing {file_path}: {e}")
+
+if __name__ == "__main__":
+    import argparse
+
+    parser = argparse.ArgumentParser(description="Scan dump files for a hex pattern using r2pipe.")
+    parser.add_argument("directory", help="Directory containing dump files")
+    parser.add_argument("pattern", help="Hex pattern to search (e.g. 'ff ff ff ff')")
+    parser.add_argument("--ext", help="Only scan files with this extension", default=None)
+
+    args = parser.parse_args()
+    scan_files_for_pattern(args.directory, args.pattern, args.ext)

src/barebone/agent/tools/symbolicate.py

@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+import argparse
+import re
+import subprocess
+import sys
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Symbolicate panic backtrace from kernel log")
+    parser.add_argument("--log-file", type=argparse.FileType("r"), required=True,
+                        help="Path to the kernel log file")
+    parser.add_argument("--elf-file", type=str, required=True,
+                        help="Path to the ELF file for symbolication")
+    parser.add_argument("--base-address", type=lambda x: int(x, 16), required=True,
+                        help="Base address where the ELF was loaded (e.g., 0xffffffe8195f0000)")
+    parser.add_argument("--verbose", "-v", action="store_true",
+                        help="Show all backtrace frames, not just symbolicated ones")
+
+    args = parser.parse_args()
+
+    log_content = args.log_file.read()
+    args.log_file.close()
+
+    frames = find_last_panic(log_content)
+    if not frames:
+        print("No panic found in the log file", file=sys.stderr)
+        return 1
+
+    print(f"Found last panic with {len(frames)} backtrace frames")
+    print(f"ELF base address: 0x{args.base_address:x}")
+    print(f"ELF file: {args.elf_file}")
+    print()
+
+    symbolicated_count = 0
+
+    for i, (lr_str, fp_str) in enumerate(frames):
+        lr_addr = int(lr_str, 16)
+        #fp_addr = int(fp_str, 16)
+
+        if lr_addr >= args.base_address:
+            function, location = symbolicate_address(args.elf_file, lr_addr, args.base_address)
+            offset = lr_addr - args.base_address
+
+            print(f"Frame {i:2d}: lr: {lr_str} (offset: 0x{offset:x}) fp: {fp_str}")
+
+            # Color the function name based on resolution status
+            if function == "<unknown>":
+                colored_function = Colors.bold_yellow(function)
+            elif function == "<error>":
+                colored_function = Colors.bold_red(function)
+            else:
+                colored_function = Colors.bold_green(function)
+
+            print(f"          -> {colored_function}")
+            print(f"             {location}")
+            print()
+            symbolicated_count += 1
+        elif args.verbose:
+            print(f"Frame {i:2d}: lr: {lr_str} fp: {fp_str} (outside ELF range)")
+
+    if symbolicated_count == 0:
+        print("No addresses found within the ELF address range")
+        if not args.verbose:
+            print("Use --verbose to see all frames")
+    else:
+        print(f"Symbolicated {symbolicated_count} frame(s)")
+
+    return 0
+
+
+def find_last_panic(log_content: str):
+    panic_pattern = re.compile(
+        r"panic\(.*?\n.*?Panicked thread:.*?\n((?:\s*lr:\s*0x[0-9a-fA-F]+\s*fp:\s*0x[0-9a-fA-F]+\n)*)",
+        re.DOTALL
+    )
+
+    panics = list(panic_pattern.finditer(log_content))
+
+    if not panics:
+        return None
+
+    last_panic = panics[-1]
+    backtrace_section = last_panic.group(1)
+
+    lr_fp_pattern = re.compile(r"lr:\s*(0x[0-9a-fA-F]+)\s*fp:\s*(0x[0-9a-fA-F]+)")
+    frames = lr_fp_pattern.findall(backtrace_section)
+
+    return frames
+
+
+def symbolicate_address(elf_path: str, address: int, base_address: int):
+    try:
+        offset = address - base_address
+
+        result = subprocess.run([
+            "aarch64-none-elf-addr2line", "-e", elf_path, "-f", "-C", f"0x{offset:x}"
+        ], capture_output=True, text=True, check=True)
+
+        lines = result.stdout.strip().split("\n")
+        if len(lines) >= 2:
+            function = lines[0]
+            location = lines[1]
+
+            if function == "??":
+                function = "<unknown>"
+            if location == "??:0" or location == "??:?":
+                location = "<unknown>"
+
+            return function, location
+        else:
+            return "<unknown>", "<unknown>"
+
+    except (subprocess.CalledProcessError, FileNotFoundError):
+        return "<error>", "<error>"
+
+
+class Colors:
+    BOLD = "\033[1m"
+    GREEN = "\033[32m"
+    YELLOW = "\033[33m"
+    RED = "\033[31m"
+    RESET = "\033[0m"
+
+    @staticmethod
+    def bold_green(text: str):
+        return f"{Colors.BOLD}{Colors.GREEN}{text}{Colors.RESET}"
+
+    @staticmethod
+    def bold_yellow(text: str):
+        return f"{Colors.BOLD}{Colors.YELLOW}{text}{Colors.RESET}"
+
+    @staticmethod
+    def bold_red(text: str):
+        return f"{Colors.BOLD}{Colors.RED}{text}{Colors.RESET}"
+
+
+if __name__ == "__main__":
+    sys.exit(main())

src/barebone/allocator.vala

@@ -14,59 +14,83 @@ namespace Frida.Barebone {
 			get;
 		}
 
+		public abstract size_t size {
+			get;
+		}
+
 		public abstract async void deallocate (Cancellable? cancellable) throws Error, IOError;
 	}
 
-	public sealed class SimpleAllocator : Object, Allocator {
+	public sealed class NullAllocator : Object, Allocator {
 		public size_t page_size {
-			get { return _page_size; }
+			get {
+				return _page_size;
+			}
+		}
+
+		private size_t _page_size;
+
+		public NullAllocator (size_t page_size) {
+			this._page_size = page_size;
+		}
+
+		public async Allocation allocate (size_t size, size_t alignment, Cancellable? cancellable) throws Error, IOError {
+			throw new Error.NOT_SUPPORTED ("To enable this feature, specify an allocator in your FRIDA_BAREBONE_CONFIG");
+		}
+	}
+
+	public sealed class PhysicalAllocator : Object, Allocator {
+		public size_t page_size {
+			get {
+				return _page_size;
+			}
 		}
 
 		private Machine machine;
 		private size_t _page_size;
-		private uint64 base_pa;
 
 		private uint64 cursor;
 
-		public SimpleAllocator (Machine machine, size_t page_size, uint64 base_pa) {
+		public PhysicalAllocator (Machine machine, size_t page_size, PhysicalAllocatorConfig config) {
 			this.machine = machine;
 			this._page_size = page_size;
-			this.base_pa = base_pa;
-			this.cursor = base_pa;
+			this.cursor = config.physical_base.address;
 		}
 
 		public async Allocation allocate (size_t size, size_t alignment, Cancellable? cancellable) throws Error, IOError {
-			if (base_pa == 0) {
-				uint64 example_base;
-				if ("corellium" in machine.gdb.features)
-					example_base = 0x0800000000 + ((2048 - 3) * 1024 * 1024);
-				else
-					example_base = 0x0040000000 + (128 * 1024 * 1024);
-				throw new Error.NOT_SUPPORTED ("To enable this feature, set FRIDA_BAREBONE_HEAP_BASE to the physical " +
-					"base address to use, e.g. 0x%" + uint64.FORMAT_MODIFIER + "x", example_base);
-			}
-
 			uint64 address_pa = cursor;
 
-			size_t vm_size = round_size_up (size, page_size);
+			size_t vm_size = round_size_up (size, _page_size);
 			cursor += vm_size;
 
-			uint num_pages = (uint) (vm_size / page_size);
+			uint num_pages = (uint) (vm_size / _page_size);
 
-			Allocation page_allocation = yield machine.allocate_pages (address_pa, num_pages, cancellable);
+			var physical_addresses = new Gee.ArrayList<uint64?> ();
+			for (uint i = 0; i != num_pages; i++)
+				physical_addresses.add (address_pa + (i * _page_size));
 
-			return new SimpleAllocation (page_allocation);
+			Allocation page_allocation = yield machine.allocate_pages (physical_addresses, cancellable);
+
+			return new PhysicalAllocation (page_allocation);
 		}
 
-		private class SimpleAllocation : Object, Allocation {
+		private class PhysicalAllocation : Object, Allocation {
 			public uint64 virtual_address {
-				get { return page_allocation.virtual_address; }
+				get {
+					return page_allocation.virtual_address;
+				}
+			}
+
+			public size_t size {
+				get {
+					return page_allocation.size;
+				}
 			}
 
 			private Allocation page_allocation;
 
-			public SimpleAllocation (Allocation page_allocation) {
-				this.page_allocation = page_allocation;
+			public PhysicalAllocation (Allocation allocation) {
+				page_allocation = allocation;
 			}
 
 			public async void deallocate (Cancellable? cancellable) throws Error, IOError {
@@ -75,4 +99,60 @@ namespace Frida.Barebone {
 			}
 		}
 	}
+
+	public sealed class TargetFunctionsAllocator : Object, Allocator {
+		public size_t page_size {
+			get {
+				return _page_size;
+			}
+		}
+
+		private Machine machine;
+		private size_t _page_size;
+		private TargetFunctionsAllocatorConfig config;
+
+		public TargetFunctionsAllocator (Machine machine, size_t page_size, TargetFunctionsAllocatorConfig config) {
+			this.machine = machine;
+			this._page_size = page_size;
+			this.config = config;
+		}
+
+		public async Allocation allocate (size_t size, size_t alignment, Cancellable? cancellable) throws Error, IOError {
+			uint64 address = yield machine.invoke (config.alloc_function.address, { size }, cancellable);
+
+			// TODO: Handle alignment.
+
+			return new TargetAllocation (address, size, machine, config);
+		}
+
+		private class TargetAllocation : Object, Allocation {
+			public uint64 virtual_address {
+				get {
+					return _virtual_address;
+				}
+			}
+
+			public size_t size {
+				get {
+					return _size;
+				}
+			}
+
+			private uint64 _virtual_address;
+			public size_t _size;
+			private Machine machine;
+			private TargetFunctionsAllocatorConfig config;
+
+			public TargetAllocation (uint64 address, size_t size, Machine m, TargetFunctionsAllocatorConfig c) {
+				_virtual_address = address;
+				_size = size;
+				machine = m;
+				config = c;
+			}
+
+			public async void deallocate (Cancellable? cancellable) throws Error, IOError {
+				yield machine.invoke (config.free_function.address, { _virtual_address, size }, cancellable);
+			}
+		}
+	}
 }

src/barebone/arch-arm/machine.vala

@@ -26,16 +26,25 @@ namespace Frida.Barebone {
 			return 4096;
 		}
 
+		public async uint query_exception_level (Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async void enumerate_ranges (Gum.PageProtection prot, FoundRangeFunc func, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
-		public async Allocation allocate_pages (uint64 physical_address, uint num_pages, Cancellable? cancellable)
+		public async Allocation allocate_pages (Gee.List<uint64?> physical_addresses, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
+		public async void protect_pages (uint64 virtual_address, size_t size, Gum.PageProtection prot,
+				Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async Gee.List<uint64?> scan_ranges (Gee.List<Gum.MemoryRange?> ranges, MatchPattern pattern, uint max_matches,
 				Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
@@ -45,8 +54,7 @@ namespace Frida.Barebone {
 			throw_not_supported ();
 		}
 
-		public async uint64 invoke (uint64 impl, uint64[] args, uint64 landing_zone, Cancellable? cancellable)
-				throws Error, IOError {
+		public async uint64 invoke (uint64 impl, uint64[] args, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
 		}
 

src/barebone/arch-arm64/machine.vala

@@ -25,6 +25,13 @@ namespace Frida.Barebone {
 		private const uint64 INT6_MASK = 0x3fULL;
 		private const uint64 INT48_MASK = 0xffffffffffffULL;
 
+		private const uint64 TABLE_PXN_BIT = 1ULL << 59;
+
+		private const uint64 UXN_BIT = 1ULL << 54;
+		private const uint64 PXN_BIT = 1ULL << 53;
+		private const uint64 AP1_BIT = 1ULL << 7;
+		private const uint64 AP0_BIT = 1ULL << 6;
+
 		public Arm64Machine (GDB.Client gdb) {
 			Object (gdb: gdb);
 		}
@@ -35,6 +42,17 @@ namespace Frida.Barebone {
 			return p.granule;
 		}
 
+		public async uint query_exception_level (Cancellable? cancellable) throws Error, IOError {
+			GDB.Exception? exception = gdb.exception;
+			if (exception == null)
+				throw new Error.INVALID_OPERATION ("Unable to query in current state");
+			GDB.Thread thread = exception.thread;
+
+			var cpsr = yield thread.read_register ("cpsr", cancellable);
+
+			return (uint) ((cpsr >> 2) & 3);
+		}
+
 		public async void enumerate_ranges (Gum.PageProtection prot, FoundRangeFunc func, Cancellable? cancellable)
 				throws Error, IOError {
 			Gee.List<RangeDetails> ranges = ("corellium" in gdb.features)
@@ -55,7 +73,7 @@ namespace Frida.Barebone {
 
 			yield set_addressing_mode (gdb, PHYSICAL, cancellable);
 			try {
-				yield collect_ranges_in_table (p.tt1, p.first_level, p.upper_bits, p.granule, result, cancellable);
+				yield collect_ranges_in_table (p.tt1, p.first_level, p.upper_bits, p, result, cancellable);
 			} finally {
 				set_addressing_mode.begin (gdb, VIRTUAL, null);
 			}
@@ -63,30 +81,30 @@ namespace Frida.Barebone {
 			return result;
 		}
 
-		private async void collect_ranges_in_table (uint64 table_address, uint level, uint64 upper_bits, Granule granule,
+		private async void collect_ranges_in_table (uint64 table_address, uint level, uint64 upper_bits, MMUParameters p,
 				Gee.List<RangeDetails> ranges, Cancellable? cancellable) throws Error, IOError {
-			uint max_entries = compute_max_entries (level, granule);
+			uint max_entries = compute_max_entries (level, p);
 			Buffer entries = yield gdb.read_buffer (table_address, max_entries * Descriptor.SIZE, cancellable);
-			uint shift = address_shift_at_level (level, granule);
+			uint shift = address_shift_at_level (level, p.granule);
 			for (uint i = 0; i != max_entries; i++) {
 				uint64 raw_descriptor = entries.read_uint64 (i * Descriptor.SIZE);
 
-				Descriptor desc = Descriptor.parse (raw_descriptor, level, granule);
+				Descriptor desc = Descriptor.parse (raw_descriptor, level, p.granule);
 				if (desc.kind == INVALID)
 					continue;
 
 				uint64 address = upper_bits | ((uint64) i << shift);
 
 				if (desc.kind == BLOCK) {
-					size_t size = 1 << num_block_bits_at_level (level, granule);
-					Gum.PageProtection prot = protection_from_flags (desc.flags);
+					size_t size = 1 << num_block_bits_at_level (level, p.granule);
+					Gum.PageProtection prot = protection_from_flags (desc.flags, p);
 
 					ranges.add (new RangeDetails (address, desc.target_address, size, prot, MappingType.UNKNOWN));
 
 					continue;
 				}
 
-				yield collect_ranges_in_table (desc.target_address, level + 1, address, granule, ranges, cancellable);
+				yield collect_ranges_in_table (desc.target_address, level + 1, address, p, ranges, cancellable);
 			}
 		}
 
@@ -145,33 +163,35 @@ namespace Frida.Barebone {
 			return result;
 		}
 
-		public async Allocation allocate_pages (uint64 physical_address, uint num_pages, Cancellable? cancellable)
+		public async Allocation allocate_pages (Gee.List<uint64?> physical_addresses, Cancellable? cancellable)
 				throws Error, IOError {
 			MMUParameters p = yield MMUParameters.load (gdb, cancellable);
 
 			yield set_addressing_mode (gdb, PHYSICAL, cancellable);
 			try {
-				Allocation? allocation = yield maybe_insert_descriptor_in_table (physical_address, num_pages, p.tt1,
-					p.first_level, p.upper_bits, p.granule, cancellable);
+				Allocation? allocation = yield maybe_insert_descriptor_in_table (physical_addresses, p.tt1, p.first_level,
+					p.upper_bits, p, cancellable);
 				if (allocation == null)
 					throw new Error.NOT_SUPPORTED ("Unable to insert page table mapping; please file a bug");
+
 				return allocation;
 			} finally {
 				set_addressing_mode.begin (gdb, VIRTUAL, null);
 			}
 		}
 
-		private async Allocation? maybe_insert_descriptor_in_table (uint64 physical_address, uint num_pages,
-				uint64 table_address, uint level, uint64 upper_bits, Granule granule, Cancellable? cancellable)
+		private async Allocation? maybe_insert_descriptor_in_table (Gee.List<uint64?> physical_addresses,
+				uint64 table_address, uint level, uint64 upper_bits, MMUParameters p, Cancellable? cancellable)
 				throws Error, IOError {
-			uint max_entries = compute_max_entries (level, granule);
-			uint shift = address_shift_at_level (level, granule);
+			uint max_entries = compute_max_entries (level, p);
+			uint shift = address_shift_at_level (level, p.granule);
 
 			uint64 first_available_va = 0;
 			uint64 first_available_slot = 0;
 			uint num_available_slots = 0;
 			uint chunk_max_size = (level < 3) ? 4 : 64;
 			uint chunk_offset = 0;
+			uint num_pages = physical_addresses.size;
 			while (chunk_offset != max_entries && num_available_slots != num_pages) {
 				uint64 chunk_base_address = table_address + (chunk_offset * Descriptor.SIZE);
 				uint chunk_size = uint.min (chunk_max_size, max_entries - chunk_offset);
@@ -184,13 +204,15 @@ namespace Frida.Barebone {
 					uint table_index = chunk_offset + i;
 					uint64 address = upper_bits | ((uint64) table_index << shift);
 
-					Descriptor desc = Descriptor.parse (raw_descriptor, level, granule);
+					Descriptor desc = Descriptor.parse (raw_descriptor, level, p.granule);
 
 					if (level < 3) {
 						if (desc.kind != TABLE)
 							continue;
-						Allocation? allocation = yield maybe_insert_descriptor_in_table (physical_address,
-							num_pages, desc.target_address, level + 1, address, granule, cancellable);
+						if ((desc.flags & DescriptorFlags.PXNTABLE) != 0)
+							continue;
+						Allocation? allocation = yield maybe_insert_descriptor_in_table (physical_addresses,
+							desc.target_address, level + 1, address, p, cancellable);
 						if (allocation != null)
 							return allocation;
 						continue;
@@ -215,26 +237,205 @@ namespace Frida.Barebone {
 			if (num_available_slots != num_pages)
 				return null;
 
+			Gum.PageProtection page_prot = Gum.PageProtection.READ | Gum.PageProtection.WRITE;
+			if (!p.sprr_enabled)
+				page_prot |= Gum.PageProtection.EXECUTE;
+
 			var builder = gdb.make_buffer_builder ();
 			for (uint i = 0; i != num_available_slots; i++) {
-				uint64 cur_physical_address = physical_address + (i * granule);
-				uint64 new_descriptor = cur_physical_address | 0x40000000000403ULL;
+				uint64 base_descriptor = physical_addresses[(int) i] | 0x403ULL;
+				uint64 new_descriptor = apply_protection_bits (base_descriptor, page_prot, p);
 				builder.append_uint64 (new_descriptor);
 			}
 			Bytes new_descriptors = builder.build ();
 			Bytes old_descriptors = yield gdb.read_byte_array (first_available_slot, new_descriptors.get_size (), cancellable);
 			yield gdb.write_byte_array (first_available_slot, new_descriptors, cancellable);
 
-			return new DescriptorAllocation (first_available_va, first_available_slot, old_descriptors, gdb);
+			size_t size = num_pages * p.granule;
+			return new DescriptorAllocation (first_available_va, size, first_available_slot, old_descriptors, gdb);
+		}
+
+		public async void protect_pages (uint64 virtual_address, size_t size, Gum.PageProtection prot, Cancellable? cancellable)
+				throws Error, IOError {
+			MMUParameters p = yield MMUParameters.load (gdb, cancellable);
+
+			yield set_addressing_mode (gdb, PHYSICAL, cancellable);
+			try {
+				uint64 page_mask = p.granule - 1;
+				uint64 aligned_va = virtual_address & ~page_mask;
+				uint64 aligned_end = (virtual_address + size + page_mask) & ~page_mask;
+				uint num_pages = (uint) ((aligned_end - aligned_va) / p.granule);
+
+				yield perform_protect_pages (aligned_va, num_pages, prot, p, cancellable);
+			} finally {
+				set_addressing_mode.begin (gdb, VIRTUAL, null);
+			}
+		}
+
+		private async void perform_protect_pages (uint64 start_va, uint num_pages, Gum.PageProtection prot, MMUParameters p,
+				Cancellable? cancellable) throws Error, IOError {
+			var table_cache = new TableWalkCache ();
+			uint pages_processed = 0;
+
+			var processed_tables = new Gee.HashSet<uint64?> (Numeric.uint64_hash, Numeric.uint64_equal);
+			bool need_exec = (prot & Gum.PageProtection.EXECUTE) != 0;
+
+			while (pages_processed != num_pages) {
+				uint64 current_va = start_va + (uint64) pages_processed * p.granule;
+
+				uint64 table_pa = yield find_level3_table (current_va, p, table_cache, cancellable);
+
+				if (need_exec && !processed_tables.contains (table_pa)) {
+					yield clear_pxn_table_bits_for_va (current_va, p, table_cache, cancellable);
+					processed_tables.add (table_pa);
+				}
+
+				uint level3_shift = address_shift_at_level (3, p.granule);
+				uint64 level3_mask = (1ULL << level3_shift) - 1;
+				uint64 table_base_va = current_va & ~level3_mask;
+				uint64 table_end_va = table_base_va + (1ULL << level3_shift);
+				uint64 remaining_va = start_va + num_pages * p.granule;
+				uint64 batch_end_va = uint64.min (remaining_va, table_end_va);
+				uint batch_size = (uint) ((batch_end_va - current_va) / p.granule);
+
+				yield protect_pages_in_table (current_va, batch_size, prot, table_pa, p, cancellable);
+
+				pages_processed += batch_size;
+			}
+		}
+
+		private async void protect_pages_in_table (uint64 current_va, uint batch_size, Gum.PageProtection prot,
+				uint64 table_pa, MMUParameters p, Cancellable? cancellable) throws Error, IOError {
+			uint index_bits = num_address_bits_at_level (3, p);
+			uint index_shift = inpage_bits_for_granule (p.granule);
+			uint index_mask = (1U << index_bits) - 1;
+
+			uint64 first_index = (current_va >> index_shift) & index_mask;
+			uint64 first_slot_pa = table_pa + (first_index * Descriptor.SIZE);
+
+			Buffer descriptors = yield gdb.read_buffer (first_slot_pa, batch_size * Descriptor.SIZE, cancellable);
+
+			bool any_changed = false;
+			for (uint i = 0; i != batch_size; i++) {
+				uint64 raw_desc = descriptors.read_uint64 (i * Descriptor.SIZE);
+				uint64 new_desc = apply_protection_bits (raw_desc, prot, p);
+
+				if (new_desc != raw_desc) {
+					descriptors.write_uint64 (i * Descriptor.SIZE, new_desc);
+					any_changed = true;
+				}
+			}
+
+			if (any_changed)
+				yield gdb.write_byte_array (first_slot_pa, descriptors.bytes, cancellable);
+		}
+
+		private async uint64 find_level3_table (uint64 va, MMUParameters p, TableWalkCache cache, Cancellable? cancellable)
+				throws Error, IOError {
+			TableWalkResult? cached = cache.lookup (va, p);
+			if (cached != null)
+				return yield walk_to_level3 (va, cached.table_pa, cached.level, p, cache, cancellable);
+
+			return yield walk_to_level3 (va, p.tt1, p.first_level, p, cache, cancellable);
+		}
+
+		private async uint64 walk_to_level3 (uint64 va, uint64 start_table_pa, uint start_level, MMUParameters p,
+				TableWalkCache cache, Cancellable? cancellable) throws Error, IOError {
+			uint64 table_pa = start_table_pa;
+			uint level = start_level;
+
+			while (level != 3) {
+				cache.store (va, level, table_pa, p);
+
+				uint shift = address_shift_at_level (level, p.granule);
+				uint entries = compute_max_entries (level, p);
+				uint index = (uint) ((va >> shift) & (entries - 1));
+				uint64 slot_pa = table_pa + ((uint64) index * Descriptor.SIZE);
+
+				Buffer d_buf = yield gdb.read_buffer (slot_pa, Descriptor.SIZE, cancellable);
+				uint64 raw = d_buf.read_uint64 (0);
+				Descriptor desc = Descriptor.parse (raw, level, p.granule);
+
+				if (desc.kind != TABLE)
+					throw new Error.NOT_SUPPORTED ("Walk failed at level %u", level);
+
+				table_pa = desc.target_address;
+				level++;
+			}
+
+			return table_pa;
+		}
+
+		private async void clear_pxn_table_bits_for_va (uint64 va, MMUParameters p, TableWalkCache cache, Cancellable? cancellable)
+				throws Error, IOError {
+			uint64 table_pa = p.tt1;
+			for (uint level = p.first_level; level != 3; level++) {
+				uint entries = compute_max_entries (level, p);
+				uint shift = address_shift_at_level (level, p.granule);
+				uint index = (uint) ((va >> shift) & (entries - 1));
+				uint64 slot_pa = table_pa + (index * Descriptor.SIZE);
+
+				Buffer d_buf = yield gdb.read_buffer (slot_pa, Descriptor.SIZE, cancellable);
+				uint64 raw_desc = d_buf.read_uint64 (0);
+				Descriptor desc = Descriptor.parse (raw_desc, level, p.granule);
+				if (desc.kind != TABLE)
+					break;
+
+				if ((raw_desc & TABLE_PXN_BIT) != 0) {
+					uint64 new_desc = raw_desc & ~TABLE_PXN_BIT;
+					d_buf.write_uint64 (0, new_desc);
+					yield gdb.write_byte_array (slot_pa, d_buf.bytes, cancellable);
+				}
+
+				table_pa = desc.target_address;
+			}
+		}
+
+		private class TableWalkCache {
+			private Gee.Map<uint64?, TableWalkResult> cache =
+				new Gee.HashMap<uint64?, TableWalkResult> (Numeric.uint64_hash, Numeric.uint64_equal);
+
+			public TableWalkResult? lookup (uint64 va, MMUParameters p) {
+				for (int level = 2; level >= (int) p.first_level; level--) {
+					uint64 cache_key = compute_cache_key (va, (uint) level, p);
+					TableWalkResult? result = cache[cache_key];
+					if (result != null)
+						return result;
+				}
+				return null;
+			}
+
+			public void store (uint64 va, uint level, uint64 table_pa, MMUParameters p) {
+				if (level >= 3)
+					return;
+
+				uint64 cache_key = compute_cache_key (va, level, p);
+				cache[cache_key] = new TableWalkResult () {
+					table_pa = table_pa,
+					level = level
+				};
+			}
+
+			private uint64 compute_cache_key (uint64 va, uint level, MMUParameters p) {
+				uint shift = address_shift_at_level (level + 1, p.granule);
+				return (va >> shift) << shift;
+			}
+		}
+
+		private class TableWalkResult {
+			public uint64 table_pa;
+			public uint level;
 		}
 
 		public async Gee.List<uint64?> scan_ranges (Gee.List<Gum.MemoryRange?> ranges, MatchPattern pattern, uint max_matches,
 				Cancellable? cancellable) throws Error, IOError {
 			unowned uint8[] scanner_blob = Data.Barebone.get_memory_scanner_arm64_elf_blob ().data;
 
+			var raw_scanner = new Bytes.static (scanner_blob);
+
 			Gum.ElfModule scanner;
 			try {
-				scanner = new Gum.ElfModule.from_blob (new Bytes.static (scanner_blob));
+				scanner = new Gum.ElfModule.from_blob (raw_scanner);
 			} catch (Gum.Error e) {
 				throw new Error.NOT_SUPPORTED ("%s", e.message);
 			}
@@ -293,13 +494,17 @@ namespace Frida.Barebone {
 
 			uint64 module_page_pa = page_start (module_pa, page_size);
 
-			Allocation module_allocation = yield allocate_pages (module_page_pa, num_pages, cancellable);
+			var module_pas = new Gee.ArrayList<uint64?> ();
+			for (uint i = 0; i != num_pages; i++)
+				module_pas.add (module_page_pa + (i * page_size)); // FIXME: This assumes a contiguous range.
+
+			Allocation module_allocation = yield allocate_pages (module_pas, cancellable);
 
 			size_t page_offset = (size_t) (module_pa - module_page_pa);
 			uint64 module_va = module_allocation.virtual_address + page_offset;
 			uint64 data_va = module_va + data_offset;
 
-			Bytes scanner_module = relocate (scanner, module_va);
+			Bytes scanner_module = relocate (scanner, raw_scanner, module_va);
 			Bytes original_memory = yield gdb.read_byte_array (module_va, vm_size, cancellable);
 			yield gdb.write_byte_array (module_va, scanner_module, cancellable);
 
@@ -354,14 +559,17 @@ namespace Frida.Barebone {
 				case ABS64:
 					relocated.write_uint64 ((size_t) r.address, base_va + r.symbol.address + r.addend);
 					break;
+				case PREL32:
+					var diff = (int64) (base_va + r.symbol.address + r.addend) - (int64) (base_va + r.address);
+					relocated.write_int32 ((size_t) r.address, (int32) diff);
+					break;
 				default:
 					throw new Error.NOT_SUPPORTED ("Unsupported relocation type: %s",
 						Marshal.enum_to_nick<Gum.ElfArm64Relocation> (type));
 			}
 		}
 
-		public async uint64 invoke (uint64 impl, uint64[] args, uint64 landing_zone, Cancellable? cancellable)
-				throws Error, IOError {
+		public async uint64 invoke (uint64 impl, uint64[] args, Cancellable? cancellable) throws Error, IOError {
 			if (args.length > 8)
 				throw new Error.NOT_SUPPORTED ("Unsupported number of arguments; please open a PR");
 
@@ -377,6 +585,7 @@ namespace Frida.Barebone {
 
 			regs["pc"] = impl;
 
+			uint64 landing_zone = saved_regs["pc"].get_uint64 ();
 			regs["x30"] = landing_zone;
 
 			uint64 sp = saved_regs["sp"].get_uint64 ();
@@ -406,6 +615,35 @@ namespace Frida.Barebone {
 			return retval;
 		}
 
+		public async void execute (uint64 start, uint64 end, Cancellable? cancellable) throws Error, IOError {
+			bool was_running = gdb.state != STOPPED;
+			if (was_running)
+				yield gdb.stop (cancellable);
+
+			GDB.Thread thread = gdb.exception.thread;
+			Gee.Map<string, Variant> saved_regs = yield thread.read_registers (cancellable);
+
+			var regs = new Gee.HashMap<string, Variant> ();
+			regs.set_all (saved_regs);
+
+			regs["pc"] = start;
+
+			yield thread.write_registers (regs, cancellable);
+
+			GDB.Breakpoint bp = yield gdb.add_breakpoint (SOFT, end, 4, cancellable);
+			GDB.Exception ex = null;
+			do {
+				ex = yield gdb.continue_until_exception (cancellable);
+			} while (ex.breakpoint != bp || ex.thread.id != thread.id);
+			// TODO: Improve GDB.Client to guarantee a single GDB.Thread instance per ID.
+			yield bp.remove (cancellable);
+
+			yield thread.write_registers (saved_regs, cancellable);
+
+			if (was_running)
+				yield gdb.continue (cancellable);
+		}
+
 		public async CallFrame load_call_frame (GDB.Thread thread, uint arity, Cancellable? cancellable) throws Error, IOError {
 			var regs = yield thread.read_registers (cancellable);
 
@@ -689,6 +927,10 @@ namespace Frida.Barebone {
 			public uint first_level;
 			public uint64 upper_bits;
 			public uint64 tt1;
+			public uint t1sz;
+
+			public bool sprr_enabled;
+			public uint64 sprr_perm;
 
 			public static async MMUParameters load (GDB.Client gdb, Cancellable? cancellable) throws Error, IOError {
 				GDB.Exception? exception = gdb.exception;
@@ -716,6 +958,10 @@ namespace Frida.Barebone {
 					parameters.upper_bits |= 1ULL << (63 - i);
 
 				parameters.tt1 = regs.ttbr1 & INT48_MASK;
+				parameters.t1sz = t1sz;
+
+				parameters.sprr_enabled = (regs.sprr_config & 1) != 0;
+				parameters.sprr_perm = regs.sprr_perm;
 
 				return parameters;
 			}
@@ -724,6 +970,8 @@ namespace Frida.Barebone {
 		private class MMURegisters {
 			public uint64 tcr;
 			public uint64 ttbr1;
+			public uint64 sprr_config;
+			public uint64 sprr_perm;
 
 			public static async MMURegisters read (GDB.Thread thread, Cancellable? cancellable) throws Error, IOError {
 				var regs = new MMURegisters ();
@@ -741,10 +989,19 @@ namespace Frida.Barebone {
 							regs.tcr = val;
 						else if (name == "ttbr1_el1")
 							regs.ttbr1 = val;
+						else if (name == "sprr_config_el1")
+							regs.sprr_config = val;
+						else if (name == "sprr_el1br1_el1")
+							regs.sprr_perm = val;
 					}
 				} else {
 					regs.tcr = yield thread.read_register ("tcr_el1", cancellable);
 					regs.ttbr1 = yield thread.read_register ("ttbr1_el1", cancellable);
+					try {
+						regs.sprr_config = yield thread.read_register ("sprr_config_el1", cancellable);
+						regs.sprr_perm = yield thread.read_register ("sprr_el1br1_el1", cancellable);
+					} catch (Error e) {
+					}
 				}
 
 				return regs;
@@ -850,16 +1107,27 @@ namespace Frida.Barebone {
 
 		private class DescriptorAllocation : Object, Allocation {
 			public uint64 virtual_address {
-				get { return base_va; }
+				get {
+					return base_va;
+				}
+			}
+
+			public size_t size {
+				get {
+					return _size;
+				}
 			}
 
 			private uint64 base_va;
+			private size_t _size;
 			private uint64 first_slot;
 			private Bytes? old_descriptors;
 			private GDB.Client gdb;
 
-			public DescriptorAllocation (uint64 base_va, uint64 first_slot, Bytes old_descriptors, GDB.Client gdb) {
+			public DescriptorAllocation (uint64 base_va, size_t size, uint64 first_slot, Bytes old_descriptors,
+					GDB.Client gdb) {
 				this.base_va = base_va;
+				this._size = size;
 				this.first_slot = first_slot;
 				this.old_descriptors = old_descriptors;
 				this.gdb = gdb;
@@ -908,11 +1176,23 @@ namespace Frida.Barebone {
 			assert_not_reached ();
 		}
 
-		private static uint compute_max_entries (uint level, Granule granule) {
-			return 1 << num_address_bits_at_level (level, granule);
+		private static uint compute_max_entries (uint level, MMUParameters p) {
+			return 1 << num_address_bits_at_level (level, p);
 		}
 
-		private static uint num_address_bits_at_level (uint level, Granule granule) {
+		private static uint num_address_bits_at_level (uint level, MMUParameters p) {
+			if (level == p.first_level) {
+				uint available_address_bits = 64 - p.t1sz - inpage_bits_for_granule (p.granule);
+				uint consumed_by_lower_levels = 0;
+				for (uint l = level + 1; l <= 3; l++)
+					consumed_by_lower_levels += unclipped_address_bits_at_level (l, p.granule);
+				return available_address_bits - consumed_by_lower_levels;
+			} else {
+				return unclipped_address_bits_at_level (level, p.granule);
+			}
+		}
+
+		private static uint unclipped_address_bits_at_level (uint level, Granule granule) {
 			switch (granule) {
 				case 4K:
 					return 9;
@@ -932,7 +1212,7 @@ namespace Frida.Barebone {
 		private static uint address_shift_at_level (uint level, Granule granule) {
 			uint shift = inpage_bits_for_granule (granule);
 			for (int l = 2; l != (int) level - 1; l--)
-				shift += num_address_bits_at_level (l, granule);
+				shift += unclipped_address_bits_at_level (l, granule);
 			return shift;
 		}
 
@@ -949,7 +1229,45 @@ namespace Frida.Barebone {
 			}
 		}
 
-		private static Gum.PageProtection protection_from_flags (DescriptorFlags flags) {
+		private static Gum.PageProtection protection_from_flags (DescriptorFlags flags, MMUParameters p) {
+			if (p.sprr_enabled) {
+				uint idx = 0;
+				if ((flags & DescriptorFlags.AP_READ_ONLY) != 0)
+					idx |= 1 << 3;
+				if ((flags & DescriptorFlags.AP_ALLOW_APPLICATION) != 0)
+					idx |= 1 << 2;
+				if ((flags & DescriptorFlags.UXN) != 0)
+					idx |= 1 << 1;
+				if ((flags & DescriptorFlags.PXN) != 0)
+					idx |= 1 << 0;
+
+				uint perm = (uint) ((p.sprr_perm >> (idx * 4)) & 0xf);
+
+				Gum.PageProtection prot;
+				switch (perm & 3) {
+					case 0:
+						prot = 0;
+						break;
+					case 1:
+						prot = READ | EXECUTE;
+						if ((perm >> 2) == 2)
+							prot = EXECUTE;
+						break;
+					case 2:
+						prot = READ;
+						break;
+					case 3:
+						prot = READ | WRITE;
+						if ((perm >> 2) == 1)
+							prot = 0;
+						break;
+					default:
+						assert_not_reached ();
+				}
+
+				return prot;
+			}
+
 			Gum.PageProtection prot = READ;
 			if ((flags & DescriptorFlags.PXN) == 0)
 				prot |= EXECUTE;
@@ -958,6 +1276,93 @@ namespace Frida.Barebone {
 			return prot;
 		}
 
+		private static uint64 apply_protection_bits (uint64 descriptor, Gum.PageProtection prot, MMUParameters p) throws Error {
+			uint64 result = descriptor;
+
+			if (p.sprr_enabled) {
+				uint target_sprr_index = find_sprr_index_for_permissions (prot, p);
+				result = apply_sprr_index_to_descriptor (result, target_sprr_index);
+			} else {
+				result = apply_non_sprr_protection_bits (result, prot);
+			}
+
+			return result;
+		}
+
+		private static uint64 apply_non_sprr_protection_bits (uint64 descriptor, Gum.PageProtection prot) {
+			uint64 result = descriptor;
+
+			bool want_exec = (prot & Gum.PageProtection.EXECUTE) != 0;
+			bool want_write = (prot & Gum.PageProtection.WRITE) != 0;
+
+			if (want_exec)
+				result &= ~(UXN_BIT | PXN_BIT);
+			else
+				result |= (UXN_BIT | PXN_BIT);
+
+			if (want_write) {
+				result &= ~(AP1_BIT | AP0_BIT);
+			} else {
+				result |= AP1_BIT;
+				result &= ~AP0_BIT;
+			}
+
+			return result;
+		}
+
+		private static uint find_sprr_index_for_permissions (Gum.PageProtection prot, MMUParameters p) throws Error {
+			bool want_read = (prot & Gum.PageProtection.READ) != 0;
+			bool want_write = (prot & Gum.PageProtection.WRITE) != 0;
+			bool want_exec = (prot & Gum.PageProtection.EXECUTE) != 0;
+
+			for (uint i = 0; i != 16; i++) {
+				uint perm = (uint) ((p.sprr_perm >> (i * 4)) & 0xf);
+
+				bool slot_allows_read = false;
+				bool slot_allows_write = false;
+				bool slot_allows_exec = false;
+
+				switch (perm & 3) {
+					case 0:
+						break;
+					case 1:
+						slot_allows_exec = true;
+						if ((perm >> 2) != 2)
+							slot_allows_read = true;
+						break;
+					case 2:
+						slot_allows_read = true;
+						break;
+					case 3:
+						slot_allows_read = true;
+						slot_allows_write = ((perm >> 2) != 1);
+						break;
+				}
+
+				if (slot_allows_read == want_read && slot_allows_write == want_write && slot_allows_exec == want_exec)
+					return i;
+			}
+
+			throw new Error.INVALID_ARGUMENT ("No suitable SPRR slot found for protection 0x%x", prot);
+		}
+
+		private static uint64 apply_sprr_index_to_descriptor (uint64 descriptor, uint sprr_index) {
+			uint64 result = descriptor;
+
+			result &= ~(AP1_BIT | AP0_BIT | UXN_BIT | PXN_BIT);
+
+			if ((sprr_index & 0x8) != 0)
+				result |= AP1_BIT;
+			if ((sprr_index & 0x4) != 0)
+				result |= AP0_BIT;
+			if ((sprr_index & 0x2) != 0)
+				result |= UXN_BIT;
+			if ((sprr_index & 0x1) != 0)
+				result |= PXN_BIT;
+
+			return result;
+		}
+
 		private static Gum.PageProtection protection_from_corellium_pt_details (string details) {
 			Gum.PageProtection prot = READ;
 			if (!("pXN" in details))

src/barebone/arch-unknown/machine.vala

@@ -22,15 +22,24 @@ namespace Frida.Barebone {
 			return 4096;
 		}
 
+		public async uint query_exception_level (Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async void enumerate_ranges (Gum.PageProtection prot, FoundRangeFunc func, Cancellable? cancellable)
 				throws Error, IOError {
 		}
 
-		public async Allocation allocate_pages (uint64 physical_address, uint num_pages, Cancellable? cancellable)
+		public async Allocation allocate_pages (Gee.List<uint64?> physical_addresses, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
+		public async void protect_pages (uint64 virtual_address, size_t size, Gum.PageProtection prot,
+				Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async Gee.List<uint64?> scan_ranges (Gee.List<Gum.MemoryRange?> ranges, MatchPattern pattern,
 				uint max_matches, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
@@ -40,8 +49,7 @@ namespace Frida.Barebone {
 			throw_not_supported ();
 		}
 
-		public async uint64 invoke (uint64 impl, uint64[] args, uint64 landing_zone, Cancellable? cancellable)
-				throws Error, IOError {
+		public async uint64 invoke (uint64 impl, uint64[] args, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
 		}
 

src/barebone/arch-x86/machine.vala

@@ -22,16 +22,25 @@ namespace Frida.Barebone {
 			return 4096;
 		}
 
+		public async uint query_exception_level (Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async void enumerate_ranges (Gum.PageProtection prot, FoundRangeFunc func, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
-		public async Allocation allocate_pages (uint64 physical_address, uint num_pages, Cancellable? cancellable)
+		public async Allocation allocate_pages (Gee.List<uint64?> physical_addresses, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
+		public async void protect_pages (uint64 virtual_address, size_t size, Gum.PageProtection prot,
+				Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async Gee.List<uint64?> scan_ranges (Gee.List<Gum.MemoryRange?> ranges, MatchPattern pattern, uint max_matches,
 				Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
@@ -41,8 +50,7 @@ namespace Frida.Barebone {
 			throw_not_supported ();
 		}
 
-		public async uint64 invoke (uint64 impl, uint64[] args, uint64 landing_zone, Cancellable? cancellable)
-				throws Error, IOError {
+		public async uint64 invoke (uint64 impl, uint64[] args, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
 		}
 

src/barebone/arch-x86_64/machine.vala

@@ -24,16 +24,25 @@ namespace Frida.Barebone {
 			return 4096;
 		}
 
+		public async uint query_exception_level (Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async void enumerate_ranges (Gum.PageProtection prot, FoundRangeFunc func, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
-		public async Allocation allocate_pages (uint64 physical_address, uint num_pages, Cancellable? cancellable)
+		public async Allocation allocate_pages (Gee.List<uint64?> physical_addresses, Cancellable? cancellable)
 				throws Error, IOError {
 			throw_not_supported ();
 		}
 
+		public async void protect_pages (uint64 virtual_address, size_t size, Gum.PageProtection prot,
+				Cancellable? cancellable) throws Error, IOError {
+			throw_not_supported ();
+		}
+
 		public async Gee.List<uint64?> scan_ranges (Gee.List<Gum.MemoryRange?> ranges, MatchPattern pattern, uint max_matches,
 				Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
@@ -43,8 +52,7 @@ namespace Frida.Barebone {
 			throw_not_supported ();
 		}
 
-		public async uint64 invoke (uint64 impl, uint64[] args, uint64 landing_zone, Cancellable? cancellable)
-				throws Error, IOError {
+		public async uint64 invoke (uint64 impl, uint64[] args, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
 		}
 

src/barebone/barebone-host-session.vala

@@ -2,26 +2,8 @@ namespace Frida {
 	public sealed class BareboneHostSessionBackend : Object, HostSessionBackend {
 		private BareboneHostSessionProvider? provider;
 
-		private const uint16 DEFAULT_PORT = 3333;
-
 		public async void start (Cancellable? cancellable) throws IOError {
-			SocketConnectable? connectable = null;
-			unowned string? address = Environment.get_variable ("FRIDA_BAREBONE_ADDRESS");
-			if (address != null) {
-				try {
-					connectable = NetworkAddress.parse (address, DEFAULT_PORT);
-				} catch (GLib.Error e) {
-				}
-			}
-			if (connectable == null)
-				connectable = new InetSocketAddress (new InetAddress.loopback (SocketFamily.IPV4), DEFAULT_PORT);
-
-			uint64 heap_base_pa = 0;
-			unowned string? heap_base_preference = Environment.get_variable ("FRIDA_BAREBONE_HEAP_BASE");
-			if (heap_base_preference != null)
-				heap_base_pa = uint64.parse (heap_base_preference, 16);
-
-			provider = new BareboneHostSessionProvider (connectable, heap_base_pa);
+			provider = new BareboneHostSessionProvider ();
 			provider_available (provider);
 		}
 
@@ -49,22 +31,8 @@ namespace Frida {
 			}
 		}
 
-		public SocketConnectable connectable {
-			get;
-			construct;
-		}
-
-		public uint64 heap_base_pa {
-			get;
-			construct;
-		}
-
 		private BareboneHostSession? host_session;
 
-		public BareboneHostSessionProvider (SocketConnectable connectable, uint64 heap_base_pa) {
-			Object (connectable: connectable, heap_base_pa: heap_base_pa);
-		}
-
 		public async void close (Cancellable? cancellable) throws IOError {
 			if (host_session != null) {
 				yield host_session.close (cancellable);
@@ -76,6 +44,29 @@ namespace Frida {
 			if (host_session != null)
 				throw new Error.INVALID_OPERATION ("Already created");
 
+			Barebone.Config config;
+			unowned string? config_path = Environment.get_variable ("FRIDA_BAREBONE_CONFIG");
+			if (config_path != null) {
+				try {
+					var config_data = yield FS.read_all_text (File.new_for_path (config_path), cancellable);
+					var cfg = (Barebone.Config) Json.gobject_from_data (typeof (Barebone.Config), config_data);
+					cfg.check ();
+					config = cfg;
+				} catch (GLib.Error e) {
+					throw new Error.INVALID_ARGUMENT ("Unable to load %s: %s", config_path, e.message);
+				}
+			} else {
+				config = new Barebone.Config ();
+			}
+
+			SocketConnectable connectable;
+			try {
+				Barebone.ConnectionConfig c = config.connection;
+				connectable = NetworkAddress.parse (c.host, c.port);
+			} catch (GLib.Error e) {
+				throw new Error.INVALID_ARGUMENT ("Unable to load %s: %s", config_path, e.message);
+			}
+
 			IOStream stream;
 			try {
 				var client = new SocketClient ();
@@ -109,16 +100,39 @@ namespace Frida {
 					break;
 			}
 
-			var page_size = yield machine.query_page_size (cancellable);
+			size_t page_size;
+			try {
+				page_size = yield machine.query_page_size (cancellable);
+			} catch (Error e) {
+				page_size = 0;
+			}
 
-			// TODO: Locate and use kernel's allocator when possible.
-			Barebone.Allocator allocator = new Barebone.SimpleAllocator (machine, page_size, heap_base_pa);
+			Barebone.Allocator allocator;
+			Barebone.AllocatorConfig? ac = config.allocator;
+			if (ac == null) {
+				allocator = new Barebone.NullAllocator (page_size);
+			} else if (ac is Barebone.PhysicalAllocatorConfig) {
+				allocator = new Barebone.PhysicalAllocator (machine, page_size,
+					(Barebone.PhysicalAllocatorConfig) ac);
+			} else if (ac is Barebone.TargetFunctionsAllocatorConfig) {
+				allocator = new Barebone.TargetFunctionsAllocator (machine, page_size,
+					(Barebone.TargetFunctionsAllocatorConfig) ac);
+			} else {
+				assert_not_reached ();
+			}
+
+			Barebone.AgentConnection? agent_connection = null;
+			Barebone.AgentConfig? agent_config = config.agent;
+			if (agent_config != null) {
+				agent_connection = yield Barebone.AgentConnection.open (agent_config, config.image, machine, allocator,
+					cancellable);
+			}
 
 			var interceptor = new Barebone.Interceptor (machine, allocator);
 
 			var services = new Barebone.Services (machine, allocator, interceptor);
 
-			host_session = new BareboneHostSession (services);
+			host_session = new BareboneHostSession (agent_connection, services);
 			host_session.agent_session_detached.connect (on_agent_session_detached);
 
 			return host_session;
@@ -170,6 +184,11 @@ namespace Frida {
 	}
 
 	public sealed class BareboneHostSession : Object, HostSession {
+		public Barebone.AgentConnection? connection {
+			get;
+			construct;
+		}
+
 		public Barebone.Services services {
 			get;
 			construct;
@@ -178,8 +197,8 @@ namespace Frida {
 		private Gee.Map<AgentSessionId?, BareboneAgentSession> agent_sessions =
 			new Gee.HashMap<AgentSessionId?, BareboneAgentSession> (AgentSessionId.hash, AgentSessionId.equal);
 
-		public BareboneHostSession (Barebone.Services services) {
-			Object (services: services);
+		public BareboneHostSession (Barebone.AgentConnection? connection, Barebone.Services services) {
+			Object (connection: connection, services: services);
 		}
 
 		public async void close (Cancellable? cancellable) throws IOError {
@@ -255,13 +274,17 @@ namespace Frida {
 
 			var opts = SessionOptions._deserialize (options);
 			if (opts.realm == EMULATED)
-				throw new Error.NOT_SUPPORTED ("Emulated realm is not supported on barebone targets");
+				throw new Error.NOT_SUPPORTED ("Emulated realm is not supported on Barebone targets");
 
 			var session_id = AgentSessionId.generate ();
 
 			MainContext dbus_context = yield get_dbus_context ();
 
-			var session = new BareboneAgentSession (session_id, opts.persist_timeout, dbus_context, services);
+			BareboneAgentSession session;
+			if (connection != null)
+				session = new RemoteBareboneAgentSession (connection, session_id, opts.persist_timeout, dbus_context);
+			else
+				session = new LocalBareboneAgentSession (services, session_id, opts.persist_timeout, dbus_context);
 			agent_sessions[session_id] = session;
 			session.closed.connect (on_agent_session_closed);
 
@@ -321,7 +344,158 @@ namespace Frida {
 		}
 	}
 
-	private sealed class BareboneAgentSession : Object, AgentSession {
+	private sealed class LocalBareboneAgentSession : BareboneAgentSession {
+		public Barebone.Services services {
+			get;
+			construct;
+		}
+
+		private Gee.Map<AgentScriptId?, BareboneScript> scripts =
+			new Gee.HashMap<AgentScriptId?, BareboneScript> (AgentScriptId.hash, AgentScriptId.equal);
+		private uint next_script_id = 1;
+
+		public LocalBareboneAgentSession (Barebone.Services services, AgentSessionId id, uint persist_timeout,
+				MainContext dbus_context) {
+			Object (
+				services: services,
+				id: id,
+				persist_timeout: persist_timeout,
+				frida_context: MainContext.ref_thread_default (),
+				dbus_context: dbus_context
+			);
+		}
+
+		public override async AgentScriptId create_script (string source, HashTable<string, Variant> options,
+				Cancellable? cancellable) throws Error, IOError {
+			check_open ();
+
+			var opts = ScriptOptions._deserialize (options);
+			if (opts.runtime == V8)
+				throw new Error.INVALID_ARGUMENT ("The V8 runtime is not supported by the Barebone backend");
+
+			var id = AgentScriptId (next_script_id++);
+
+			var script = BareboneScript.create (id, source, services);
+			scripts[id] = script;
+			script.message.connect (on_message_from_script);
+
+			return id;
+		}
+
+		public override async void destroy_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
+			check_open ();
+
+			BareboneScript script = get_script (script_id);
+			yield script.destroy (cancellable);
+			script.message.disconnect (on_message_from_script);
+
+			scripts.unset (script_id);
+		}
+
+		public override async void load_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
+			check_open ();
+			var script = get_script (script_id);
+			yield script.load (cancellable);
+		}
+
+		public override async void post_messages (AgentMessage[] messages, uint batch_id, Cancellable? cancellable)
+				throws Error, IOError {
+			transmitter.check_okay_to_receive ();
+
+			foreach (var m in messages) {
+				switch (m.kind) {
+					case SCRIPT: {
+						BareboneScript? script = scripts[m.script_id];
+						if (script != null)
+							script.post (m.text, m.has_data ? new Bytes (m.data) : null);
+						break;
+					}
+					case DEBUGGER:
+						break;
+				}
+			}
+
+			transmitter.notify_rx_batch_id (batch_id);
+		}
+
+		private void on_message_from_script (BareboneScript script, string json, Bytes? data) {
+			transmitter.post_message_from_script (script.id, json, data);
+		}
+
+		private BareboneScript get_script (AgentScriptId script_id) throws Error {
+			var script = scripts[script_id];
+			if (script == null)
+				throw new Error.INVALID_ARGUMENT ("Invalid script ID");
+			return script;
+		}
+	}
+
+	private sealed class RemoteBareboneAgentSession : BareboneAgentSession {
+		public Barebone.AgentConnection connection {
+			get;
+			construct;
+		}
+
+		public RemoteBareboneAgentSession (Barebone.AgentConnection connection, AgentSessionId id, uint persist_timeout,
+				MainContext dbus_context) {
+			Object (
+				connection: connection,
+				id: id,
+				persist_timeout: persist_timeout,
+				frida_context: MainContext.ref_thread_default (),
+				dbus_context: dbus_context
+			);
+		}
+
+		construct {
+			connection.script_message.connect (on_message_from_script);
+		}
+
+		public override async AgentScriptId create_script (string source, HashTable<string, Variant> options,
+				Cancellable? cancellable) throws Error, IOError {
+			check_open ();
+
+			var opts = ScriptOptions._deserialize (options);
+			if (opts.runtime == V8)
+				throw new Error.INVALID_ARGUMENT ("The V8 runtime is not supported by the Barebone backend");
+
+			return yield connection.create_script (source, cancellable);
+		}
+
+		public override async void destroy_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
+			check_open ();
+			yield connection.destroy_script (script_id, cancellable);
+		}
+
+		public override async void load_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
+			check_open ();
+			yield connection.load_script (script_id, cancellable);
+		}
+
+		public override async void post_messages (AgentMessage[] messages, uint batch_id, Cancellable? cancellable)
+				throws Error, IOError {
+			transmitter.check_okay_to_receive ();
+
+			foreach (var m in messages) {
+				switch (m.kind) {
+					case SCRIPT:
+						yield connection.post_script_message (m.script_id, m.text,
+							m.has_data ? new Bytes (m.data) : null, cancellable);
+						break;
+					case DEBUGGER:
+						break;
+				}
+			}
+
+			transmitter.notify_rx_batch_id (batch_id);
+		}
+
+		private void on_message_from_script (AgentScriptId id, string json, Bytes? data) {
+			transmitter.post_message_from_script (id, json, data);
+		}
+	}
+
+	private abstract class BareboneAgentSession : Object, AgentSession {
 		public signal void closed ();
 
 		public AgentSessionId id {
@@ -335,8 +509,12 @@ namespace Frida {
 		}
 
 		public AgentMessageSink? message_sink {
-			get { return transmitter.message_sink; }
-			set { transmitter.message_sink = value; }
+			get {
+				return transmitter.message_sink;
+			}
+			set {
+				transmitter.message_sink = value;
+			}
 		}
 
 		public MainContext frida_context {
@@ -349,34 +527,9 @@ namespace Frida {
 			construct;
 		}
 
-		public Barebone.Services services {
-			get;
-			construct;
-		}
-
-		public Barebone.Allocator allocator {
-			get;
-			construct;
-		}
-
 		private Promise<bool>? close_request;
 
-		private Gee.Map<AgentScriptId?, BareboneScript> scripts =
-			new Gee.HashMap<AgentScriptId?, BareboneScript> (AgentScriptId.hash, AgentScriptId.equal);
-		private uint next_script_id = 1;
-
-		private AgentMessageTransmitter transmitter;
-
-		public BareboneAgentSession (AgentSessionId id, uint persist_timeout, MainContext dbus_context,
-				Barebone.Services services) {
-			Object (
-				id: id,
-				persist_timeout: persist_timeout,
-				frida_context: MainContext.ref_thread_default (),
-				dbus_context: dbus_context,
-				services: services
-			);
-		}
+		protected AgentMessageTransmitter transmitter;
 
 		construct {
 			assert (frida_context != null);
@@ -421,22 +574,8 @@ namespace Frida {
 			throw_not_supported ();
 		}
 
-		public async AgentScriptId create_script (string source, HashTable<string, Variant> options,
-				Cancellable? cancellable) throws Error, IOError {
-			check_open ();
-
-			var opts = ScriptOptions._deserialize (options);
-			if (opts.runtime == V8)
-				throw new Error.INVALID_ARGUMENT ("The V8 runtime is not supported by the barebone backend");
-
-			var id = AgentScriptId (next_script_id++);
-
-			var script = BareboneScript.create (id, source, services);
-			scripts[id] = script;
-			script.message.connect (on_message_from_script);
-
-			return id;
-		}
+		public abstract async AgentScriptId create_script (string source, HashTable<string, Variant> options,
+				Cancellable? cancellable) throws Error, IOError;
 
 		public async AgentScriptId create_script_from_bytes (uint8[] bytes, HashTable<string, Variant> options,
 				Cancellable? cancellable) throws Error, IOError {
@@ -453,33 +592,14 @@ namespace Frida {
 			throw_not_supported ();
 		}
 
-		public async void destroy_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
-			check_open ();
+		public abstract async void destroy_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError;
 
-			BareboneScript script = get_script (script_id);
-			yield script.destroy (cancellable);
-			script.message.disconnect (on_message_from_script);
-
-			scripts.unset (script_id);
-		}
-
-		public async void load_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
-			check_open ();
-			var script = get_script (script_id);
-			yield script.load (cancellable);
-		}
+		public abstract async void load_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError;
 
 		public async void eternalize_script (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
 		}
 
-		private BareboneScript get_script (AgentScriptId script_id) throws Error {
-			var script = scripts[script_id];
-			if (script == null)
-				throw new Error.INVALID_ARGUMENT ("Invalid script ID");
-			return script;
-		}
-
 		public async void enable_debugger (AgentScriptId script_id, Cancellable? cancellable) throws Error, IOError {
 			throw_not_supported ();
 		}
@@ -488,25 +608,8 @@ namespace Frida {
 			throw_not_supported ();
 		}
 
-		public async void post_messages (AgentMessage[] messages, uint batch_id,
-				Cancellable? cancellable) throws Error, IOError {
-			transmitter.check_okay_to_receive ();
-
-			foreach (var m in messages) {
-				switch (m.kind) {
-					case SCRIPT: {
-						BareboneScript? script = scripts[m.script_id];
-						if (script != null)
-							script.post (m.text, m.has_data ? new Bytes (m.data) : null);
-						break;
-					}
-					case DEBUGGER:
-						break;
-				}
-			}
-
-			transmitter.notify_rx_batch_id (batch_id);
-		}
+		public abstract async void post_messages (AgentMessage[] messages, uint batch_id, Cancellable? cancellable)
+			throws Error, IOError;
 
 		public async PortalMembershipId join_portal (string address, HashTable<string, Variant> options,
 				Cancellable? cancellable) throws Error, IOError {
@@ -538,15 +641,11 @@ namespace Frida {
 			transmitter.commit_migration ();
 		}
 
-		private void check_open () throws Error {
+		protected void check_open () throws Error {
 			if (close_request != null)
 				throw new Error.INVALID_OPERATION ("Session is closing");
 		}
 
-		private void on_message_from_script (BareboneScript script, string json, Bytes? data) {
-			transmitter.post_message_from_script (script.id, json, data);
-		}
-
 		private void on_transmitter_closed () {
 			transmitter.closed.disconnect (on_transmitter_closed);
 			transmitter.new_candidates.disconnect (on_transmitter_new_candidates);

src/barebone/c-module.vala

@@ -0,0 +1,66 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	private sealed class CModule : Object {
+		public signal void console_output (string message);
+
+		public Gee.List<Export> exports {
+			get;
+			default = new Gee.ArrayList<Export> ();
+		}
+
+		public class Export {
+			public string name;
+			public uint64 address;
+
+			internal Export (string name, uint64 address) {
+				this.name = name;
+				this.address = address;
+			}
+		}
+
+		private Gum.ElfModule elf;
+		private Allocation allocation;
+		private Callback console_log_callback;
+
+		public async CModule.from_blob (Bytes blob, Machine machine, Allocator allocator, Cancellable? cancellable)
+				throws Error, IOError {
+			try {
+				elf = new Gum.ElfModule.from_blob (blob);
+			} catch (Gum.Error e) {
+				throw new Error.NOT_SUPPORTED ("%s", e.message);
+			}
+
+			var raw_elf = new Bytes.static (elf.get_file_data ());
+
+			size_t page_size = yield machine.query_page_size (cancellable);
+
+			allocation = yield inject_elf (elf, raw_elf, page_size, machine, allocator, cancellable);
+
+			uint64 base_va = allocation.virtual_address;
+			uint64 console_log_trap = 0;
+			elf.enumerate_symbols (e => {
+				if (e.name == "")
+					return true;
+
+				if (e.name == "_console_log") {
+					console_log_trap = base_va + e.address;
+					return true;
+				}
+
+				exports.add (new Export (e.name, base_va + e.address));
+
+				return true;
+			});
+
+			if (console_log_trap != 0) {
+				var handler = new ConsoleLogHandler (machine.gdb);
+				handler.output.connect (on_console_output);
+				console_log_callback = yield new Callback (console_log_trap, handler, machine, cancellable);
+			}
+		}
+
+		private void on_console_output (string message) {
+			console_output (message);
+		}
+	}
+}

src/barebone/config.vala

@@ -0,0 +1,395 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	/**
+	 * Barebone backend configuration. This is specified via the FRIDA_BAREBONE_CONFIG environment
+	 * variable, which should point to the filesystem path of a JSON-encoded configuration file.
+	 *
+	 * Example JSON configurations:
+	 *
+	 * 1. Using all defaults:
+	 * {
+	 *   "connection": {
+	 *     "host": "127.0.0.1",
+	 *     "port": 3333
+	 *   }
+	 * }
+	 *
+	 * 2. Using a physical memory allocator:
+	 *  {
+	 *    "connection": {
+	 *      "host": "127.0.0.1",
+	 *      "port": 9000
+	 *    },
+	 *    "allocator": {
+	 *      "mode": "physical",
+	 *      "physical_base": "0x8ec9b4000"
+	 *    }
+	 *  }
+	 *
+	 * 3. Using target-specific allocation functions:
+	 *  {
+	 *    "connection": {
+	 *      "host": "127.0.0.1",
+	 *      "port": 9000
+	 *    },
+	 *    "allocator": {
+	 *      "mode": "target-functions",
+	 *      "alloc_function": "0xfffffff007a3c278",
+	 *      "free_function": "0xfffffff007a3c338"
+	 *    }
+	 *  }
+	 *
+	 * 4. Injecting a remote agent:
+	 *  {
+	 *    "agent": {
+	 *      "path": "/path/to/target/aarch64-unknown-none/release/frida-barebone-agent",
+	 *      "transport": {
+	 *        "type": "hostlink",
+	 *        "qmp": "unix:/path/to/qmp.sock"
+	 *      }
+	 *    },
+	 *    "image": {
+	 *      "file": "/path/to/kernelcache.research.iphone12b",
+	 *      "base": "0xfffffff007004000"
+	 *    }
+	 *  }
+	 */
+	public sealed class Config : Object, Json.Serializable {
+		public ConnectionConfig connection {
+			get;
+			set;
+			default = new ConnectionConfig ();
+		}
+
+		public AllocatorConfig? allocator {
+			get;
+			set;
+		}
+
+		public AgentConfig? agent {
+			get;
+			set;
+		}
+
+		public ImageConfig? image {
+			get;
+			set;
+		}
+
+		public void check () throws Error {
+			if (allocator != null)
+				allocator.check ();
+			if (agent != null)
+				agent.check ();
+			if (image != null)
+				image.check ();
+		}
+
+		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
+			if (property_name == "allocator") {
+				AllocatorConfig? allocator = null;
+				Type t = typeof (InvalidAllocatorConfig);
+				if (property_node.get_node_type () == Json.NodeType.OBJECT) {
+					switch (property_node.get_object ().get_string_member_with_default ("mode", "invalid")) {
+					case "physical":
+						t = typeof (PhysicalAllocatorConfig);
+						break;
+					case "target-functions":
+						t = typeof (TargetFunctionsAllocatorConfig);
+						break;
+					default:
+						break;
+					}
+					allocator = (AllocatorConfig) Json.gobject_deserialize (t, property_node);
+				} else {
+					allocator = new InvalidAllocatorConfig ();
+				}
+
+				var v = Value (t);
+				v.set_object (allocator);
+				value = v;
+				return true;
+			}
+
+			value = Value (pspec.value_type);
+			return false;
+		}
+	}
+
+	public sealed class ConnectionConfig : Object {
+		public string host {
+			get;
+			set;
+			default = "127.0.0.1";
+		}
+
+		public uint16 port {
+			get;
+			set;
+			default = 3333;
+		}
+	}
+
+	public abstract class AllocatorConfig : Object {
+		public abstract void check () throws Error;
+	}
+
+	public sealed class InvalidAllocatorConfig : AllocatorConfig {
+		public override void check () throws Error {
+			throw new Error.NOT_SUPPORTED ("Config for 'allocator' is invalid");
+		}
+	}
+
+	public sealed class PhysicalAllocatorConfig : AllocatorConfig, Json.Serializable {
+		public MemoryAddress physical_base {
+			get;
+			set;
+		}
+
+		public override void check () throws Error {
+			if (physical_base == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'allocator.physical_base' is missing");
+			physical_base.check ();
+		}
+
+		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
+			if (property_name == "physical_base") {
+				value = deserialize_address ("allocator.physical_base", property_node);
+				return true;
+			}
+
+			value = Value (pspec.value_type);
+			return false;
+		}
+	}
+
+	public sealed class TargetFunctionsAllocatorConfig : AllocatorConfig, Json.Serializable {
+		public MemoryAddress alloc_function {
+			get;
+			set;
+		}
+
+		public MemoryAddress free_function {
+			get;
+			set;
+		}
+
+		public override void check () throws Error {
+			if (alloc_function == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'allocator.alloc_function' is missing");
+			alloc_function.check ();
+
+			if (free_function == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'allocator.free_function' is missing");
+			free_function.check ();
+		}
+
+		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
+			if (property_name == "alloc-function") {
+				value = deserialize_address ("allocator.alloc_function", property_node);
+				return true;
+			}
+
+			if (property_name == "free-function") {
+				value = deserialize_address ("allocator.free_function", property_node);
+				return true;
+			}
+
+			value = Value (pspec.value_type);
+			return false;
+		}
+	}
+
+	public sealed class AgentConfig : Object, Json.Serializable {
+		public string path {
+			get;
+			set;
+		}
+
+		public TransportConfig transport {
+			get;
+			set;
+		}
+
+		public void check () throws Error {
+			if (path == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'agent.path' is missing");
+
+			if (transport == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'agent.transport' is missing");
+			transport.check ();
+		}
+
+		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
+			if (property_name == "transport") {
+				TransportConfig transport;
+				Type t = typeof (InvalidTransportConfig);
+				if (property_node.get_node_type () == Json.NodeType.OBJECT) {
+					switch (property_node.get_object ().get_string_member_with_default ("type", "invalid")) {
+					case "hostlink":
+						t = typeof (HostlinkTransportConfig);
+						break;
+					default:
+						break;
+					}
+					transport = (TransportConfig) Json.gobject_deserialize (t, property_node);
+				} else {
+					transport = new InvalidTransportConfig ();
+				}
+
+				var v = Value (t);
+				v.set_object (transport);
+				value = v;
+				return true;
+			}
+
+			value = Value (pspec.value_type);
+			return false;
+		}
+	}
+
+	public abstract class TransportConfig : Object {
+		public abstract void check () throws Error;
+	}
+
+	public sealed class InvalidTransportConfig : TransportConfig {
+		public override void check () throws Error {
+			throw new Error.NOT_SUPPORTED ("Config for 'agent.transport' is invalid");
+		}
+	}
+
+	public sealed class HostlinkTransportConfig : TransportConfig {
+		public string qmp {
+			get;
+			set;
+		}
+
+		public override void check () throws Error {
+			if (qmp == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'agent.transport.qmp' is missing");
+			if (!qmp.has_prefix ("unix:"))
+				throw new Error.NOT_SUPPORTED ("Config for 'agent.transport.qmp' must be a UNIX socket for now");
+		}
+	}
+
+	public sealed class ImageConfig : Object, Json.Serializable {
+		public string file {
+			get;
+			set;
+		}
+
+		public MemoryAddress base {
+			get;
+			set;
+		}
+
+		public Gee.Map<string, uint64?> symbols {
+			get;
+			set;
+			default = new Gee.HashMap<string, uint64?> ();
+		}
+
+		public void check () throws Error {
+			if (file == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'image.file' is missing");
+
+			if (@base == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'image.base' is missing");
+			@base.check ();
+
+			if (symbols == null)
+				throw new Error.NOT_SUPPORTED ("Config for 'image.symbols' is invalid");
+		}
+
+		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
+			if (property_name == "base") {
+				value = deserialize_address ("image.base", property_node);
+				return true;
+			}
+
+			if (property_name == "symbols") {
+				Gee.Map<string, uint64?> syms = null;
+
+				if (property_node.get_node_type () == Json.NodeType.OBJECT) {
+					syms = new Gee.HashMap<string, uint64?> ();
+
+					property_node.get_object ().foreach_member ((obj, name, node) => {
+						if (syms == null)
+							return;
+
+						uint64 addr;
+						if (!try_deserialize_address (node, out addr)) {
+							syms = null;
+							return;
+						}
+
+						syms[name] = addr;
+					});
+				}
+
+				value = syms;
+				return true;
+			}
+
+			value = Value (pspec.value_type);
+			return false;
+		}
+	}
+
+	public abstract class MemoryAddress : Object {
+		public string label {
+			get;
+			construct;
+		}
+
+		public uint64 address {
+			get;
+			construct;
+		}
+
+		public abstract void check () throws Error;
+	}
+
+	public sealed class InvalidMemoryAddress : MemoryAddress {
+		public InvalidMemoryAddress (string label) {
+			Object (label: label);
+		}
+
+		public override void check () throws Error {
+			throw new Error.NOT_SUPPORTED ("Config for '%s' is invalid", label);
+		}
+	}
+
+	public sealed class NonNullMemoryAddress : MemoryAddress {
+		public NonNullMemoryAddress (string label, uint64 address) {
+			Object (label: label, address: address);
+		}
+
+		public override void check () throws Error {
+			if (address == 0)
+				throw new Error.NOT_SUPPORTED ("Config for '%s' cannot be NULL", label);
+		}
+	}
+
+	private MemoryAddress deserialize_address (string label, Json.Node node) {
+		uint64 addr;
+		if (!try_deserialize_address (node, out addr))
+			return new InvalidMemoryAddress (label);
+		return new NonNullMemoryAddress (label, addr);
+	}
+
+	private bool try_deserialize_address (Json.Node node, out uint64 address) {
+		Type t = node.get_value_type ();
+
+		if (t == typeof (string))
+			return uint64.try_parse (node.get_string (), out address, null, 16);
+
+		if (t == typeof (int64)) {
+			address = node.get_int ();
+			return true;
+		}
+
+		address = 0;
+		return false;
+	}
+}

src/barebone/console.vala

@@ -0,0 +1,31 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	private class ConsoleLogHandler : Object, CallbackHandler {
+		public signal void output (string message);
+
+		public uint arity {
+			get { return 2; }
+		}
+
+		private GDB.Client gdb;
+
+		public ConsoleLogHandler (GDB.Client gdb) {
+			this.gdb = gdb;
+		}
+
+		public async uint64 handle_invocation (uint64[] args, CallFrame frame, Cancellable? cancellable)
+				throws Error, IOError {
+			var message = args[0];
+			var len = (long) args[1];
+
+			Bytes str_bytes = yield gdb.read_byte_array (message, len, cancellable);
+			unowned uint8[] str_data = str_bytes.get_data ();
+			unowned string str_raw = (string) str_data;
+			string str = str_raw.substring (0, len);
+
+			output (str);
+
+			return 0;
+		}
+	}
+}

src/barebone/elf.vala

@@ -0,0 +1,39 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	public async Allocation inject_elf (Gum.ElfModule elf, Bytes raw_elf, size_t page_size, Machine machine, Allocator allocator,
+			Cancellable? cancellable) throws Error, IOError {
+		size_t vm_size = (size_t) elf.mapped_size;
+
+		uint num_pages = (uint) (vm_size / page_size);
+		if (vm_size % page_size != 0)
+			num_pages++;
+
+		uint64 text_base = 0;
+		size_t text_size = 0;
+		elf.enumerate_segments (s => {
+			if ((s.protection & Gum.PageProtection.EXECUTE) != 0) {
+				text_base = s.vm_address;
+				text_size = (size_t) s.vm_size;
+				return false;
+			}
+			return true;
+		});
+		if (text_size == 0)
+			throw new Error.NOT_SUPPORTED ("Unable to detect text segment");
+
+		var allocation = yield allocator.allocate (num_pages * page_size, page_size, cancellable);
+		try {
+			uint64 base_va = allocation.virtual_address;
+
+			Bytes relocated_image = machine.relocate (elf, raw_elf, base_va);
+			yield machine.gdb.write_byte_array (base_va, relocated_image, cancellable);
+
+			yield machine.protect_pages (base_va + text_base, text_size, READ | EXECUTE, cancellable);
+		} catch (GLib.Error e) {
+			yield allocation.deallocate (cancellable);
+			throw_api_error (e);
+		}
+
+		return allocation;
+	}
+}

src/barebone/img4.vala

@@ -0,0 +1,105 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone.Img4 {
+	public async Payload parse_file (File f, Cancellable? cancellable) throws Error, IOError {
+		Bytes blob = yield FS.read_all_bytes (f, cancellable);
+		return parse (blob);
+	}
+
+	public Payload parse (Bytes blob) throws Error {
+		BufferReader r = new BufferReader (new Buffer (blob, BIG_ENDIAN));
+
+		if (r.read_uint8 () != Der.SEQUENCE)
+			throw new Error.PROTOCOL ("IMG4/IM4P must start with DER SEQUENCE");
+		size_t seq_len = Der.read_length (r);
+		size_t seq_end = r.offset + seq_len;
+
+		string first_magic = Der.read_string (r);
+
+		if (first_magic == "IMG4") {
+			if (r.read_uint8 () != Der.SEQUENCE)
+				throw new Error.PROTOCOL ("Expected SEQUENCE for IM4P");
+			size_t im4p_len = Der.read_length (r);
+			seq_end = r.offset + im4p_len;
+			if (Der.read_string (r) != "IM4P")
+				throw new Error.PROTOCOL ("Missing IM4P magic");
+		} else if (first_magic != "IM4P") {
+			throw new Error.PROTOCOL ("Not an IMG4/IM4P container (magic='%s')", first_magic);
+		}
+
+		string kind = Der.read_string (r);
+		string description = Der.read_string (r);
+		Bytes payload_raw = Der.read_octet_string (r);
+		Bytes final_data = maybe_decompress_lzfse (payload_raw);
+
+		return new Payload (kind, description, final_data);
+	}
+
+	public class Payload : Object {
+		public string kind {
+			get;
+			construct;
+		}
+
+		public string description {
+			get;
+			construct;
+		}
+
+		public Bytes data {
+			get;
+			construct;
+		}
+
+		public Payload (string kind, string description, Bytes data) {
+			Object (
+				kind: kind,
+				description: description,
+				data: data
+			);
+		}
+	}
+
+	namespace Der {
+		private const uint8 OCTET_STRING	= 0x04;
+		private const uint8 UTF8_STRING		= 0x0C;
+		private const uint8 IA5_STRING		= 0x16;
+		private const uint8 SEQUENCE		= 0x30;
+
+		private size_t read_length (BufferReader r) throws Error {
+			uint8 b = r.read_uint8 ();
+			if ((b & 0x80) == 0)
+				return b;
+
+			uint8 nlen = (uint8) (b & 0x7f);
+			if (nlen == 0)
+				throw new Error.NOT_SUPPORTED ("Indefinite length not supported in IMG4");
+
+			size_t len = 0;
+			for (uint8 i = 0; i != nlen; i++)
+				len = (len << 8) | r.read_uint8 ();
+			return len;
+		}
+
+		private Bytes read_octet_string (BufferReader r) throws Error {
+			uint8 tag = r.read_uint8 ();
+			if (tag != Der.OCTET_STRING)
+				throw new Error.PROTOCOL ("Expected OCTET STRING, got tag 0x%02x".printf (tag));
+			size_t len = read_length (r);
+			return r.read_bytes (len);
+		}
+
+		private string read_string (BufferReader r) throws Error {
+			uint8 tag = r.read_uint8 ();
+			if (tag != Der.IA5_STRING && tag != Der.UTF8_STRING)
+				throw new Error.PROTOCOL ("Unexpected string tag 0x%02x", tag);
+			size_t len = read_length (r);
+			return r.read_fixed_string (len);
+		}
+	}
+
+	private Bytes maybe_decompress_lzfse (Bytes src) throws Error {
+		if (LZFSE.is_lzfse (src))
+			return LZFSE.decode (src);
+		return src;
+	}
+}

src/barebone/layout.vala

@@ -0,0 +1,188 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	public sealed class Layout : Object {
+		public Gee.List<ModuleInfo> modules {
+			get;
+			construct;
+		}
+
+		public Gee.List<SymbolInfo> symbols {
+			get;
+			construct;
+		}
+
+		private const uint64 CHAINED_PTR_TARGET_MASK = (1 << 30) - 1;
+
+		private Layout (Gee.List<ModuleInfo> modules, Gee.List<SymbolInfo> symbols) {
+			Object (modules: modules, symbols: symbols);
+		}
+
+		public Layout.empty () {
+			Object (modules: new Gee.ArrayList<ModuleInfo> (), symbols: new Gee.ArrayList<SymbolInfo> ());
+		}
+
+		public static async Layout load_from_symbol_source (File symbol_source, uint64 kernel_base, ByteOrder byte_order,
+				uint pointer_size, Cancellable? cancellable) throws Error, IOError {
+			var payload = yield Img4.parse_file (symbol_source, cancellable);
+
+			Bytes kerncache = payload.data;
+
+			Gum.DarwinModule mod;
+			try {
+				mod = new Gum.DarwinModule.from_blob (kerncache, ARM64, Gum.PtrauthSupport.SUPPORTED);
+			} catch (Gum.Error e) {
+				throw new Error.NOT_SUPPORTED ("%s", e.message);
+			}
+
+			var blob = new Blob (kerncache, byte_order, pointer_size);
+
+			var modules = compute_module_list (mod, blob, kernel_base);
+			var symbols = compute_symbol_list (mod);
+
+			return new Layout (modules, symbols);
+		}
+
+		private static Gee.List<ModuleInfo> compute_module_list (Gum.DarwinModule mod, Blob blob, uint64 kernel_base) throws Error {
+			Buffer? kmod_info = null;
+			Buffer? kmod_start = null;
+			Error? pending_error = null;
+			mod.enumerate_sections (s => {
+				if (s.segment_name == "__PRELINK_INFO") {
+					try {
+						if (s.section_name == "__kmod_info")
+							kmod_info = blob.slice (s.file_offset, (size_t) s.size, "__kmod_info");
+						else if (s.section_name == "__kmod_start")
+							kmod_start = blob.slice (s.file_offset, (size_t) s.size, "__kmod_start");
+					} catch (Error e) {
+						pending_error = e;
+						return false;
+					}
+				}
+				return true;
+			});
+			if (pending_error != null)
+				throw pending_error;
+			if (kmod_info == null)
+				throw new Error.NOT_SUPPORTED ("Unable to find __kmod_info");
+			if (kmod_start == null)
+				throw new Error.NOT_SUPPORTED ("Unable to find __kmod_start");
+
+			var kexts = new Gee.ArrayList<ModuleInfo> ();
+			var info_pointers = new BufferReader (kmod_info);
+			while (info_pointers.available != 0) {
+				var kmodinfo_start = chained_pointer_to_vm_offset (info_pointers.read_pointer (), kernel_base);
+				var kmodinfo = new BufferReader (blob.slice (kmodinfo_start, 196, "__kmod_info entry"));
+
+				kmodinfo.skip (blob.pointer_size + 4 + 4);
+
+				string name = kmodinfo.read_fixed_string (64);
+				string version = kmodinfo.read_fixed_string (64);
+
+				kmodinfo.skip (4 + (2 * blob.pointer_size) + 8 + 8);
+
+				size_t start = chained_pointer_to_vm_offset (kmodinfo.read_pointer (), kernel_base);
+				size_t stop = chained_pointer_to_vm_offset (kmodinfo.read_pointer (), kernel_base);
+
+				kexts.add (new ModuleInfo () {
+					name = name,
+					version = version,
+					start_func_offset = (uint32) start,
+					stop_func_offset = (uint32) stop,
+				});
+			}
+
+			var start_offsets = new Gee.ArrayList<uint> ();
+			var start_pointers = new BufferReader (kmod_start);
+			while (start_pointers.available != 0)
+				start_offsets.add ((uint) chained_pointer_to_vm_offset (start_pointers.read_pointer (), kernel_base));
+			if (start_offsets.size != kexts.size + 1)
+				throw new Error.PROTOCOL ("Unexpected __kmod_start length");
+
+			var n = kexts.size;
+			for (var i = 0; i != n; i++) {
+				var kext = kexts[i];
+				kext.offset = start_offsets[i];
+				kext.size = start_offsets[i + 1] - kext.offset;
+			}
+
+			var result = new Gee.ArrayList<ModuleInfo> ();
+
+			result.add (new ModuleInfo () {
+				name = "mach_kernel",
+				version = mod.source_version,
+				offset = 0,
+				size = kexts[0].offset,
+			});
+			result.add_all (kexts);
+
+			return result;
+		}
+
+		private static size_t chained_pointer_to_vm_offset (uint64 val, uint64 kernel_base) {
+			var target = (size_t) (val & CHAINED_PTR_TARGET_MASK);
+
+			bool is_auth = (val >> 63) != 0;
+			if (is_auth)
+				return target;
+
+			return target - (size_t) (kernel_base & CHAINED_PTR_TARGET_MASK);
+		}
+
+		private static Gee.List<SymbolInfo> compute_symbol_list (Gum.DarwinModule mod) {
+			var symbols = new Gee.ArrayList<SymbolInfo> ();
+			mod.enumerate_symbols (s => {
+				symbols.add (new SymbolInfo () {
+					name = (s.name[0] == '_') ? s.name[1:] : s.name,
+					offset = (uint32) s.address,
+					symbol_type = s.type,
+					section = s.section,
+					description = s.description
+				});
+				return true;
+			});
+			return symbols;
+		}
+	}
+
+	public class ModuleInfo {
+		public string name;
+		public string version;
+		public uint32 offset;
+		public uint32 size;
+		public uint32 start_func_offset;
+		public uint32 stop_func_offset;
+	}
+
+	public class SymbolInfo {
+		public string name;
+		public uint32 offset;
+		public uint8 symbol_type;
+		public uint8 section;
+		public uint16 description;
+	}
+
+	private class Blob {
+		private Bytes bytes;
+		private size_t size;
+		public ByteOrder byte_order;
+		public uint pointer_size;
+
+		public Blob (Bytes b, ByteOrder o, uint ptr_size) {
+			bytes = b;
+			size = b.get_size ();
+			byte_order = o;
+			pointer_size = ptr_size;
+		}
+
+		public Buffer slice (size_t offset, size_t n, string label) throws Error {
+			if (offset >= size)
+				throw new Error.PROTOCOL ("Offset out of bounds while parsing %s", label);
+
+			size_t end = offset + n;
+			if (end > size)
+				throw new Error.PROTOCOL ("Size out of bounds while parsing %s", label);
+
+			return new Buffer (bytes[offset:end], byte_order, pointer_size);
+		}
+	}
+}

src/barebone/lzfse.vala

@@ -0,0 +1,23 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone.LZFSE {
+	public bool is_lzfse (Bytes buf) {
+		if (buf.get_size () < 4)
+			return false;
+		unowned uint8[] d = buf.get_data ();
+		return d[0] == 'b' && d[1] == 'v' && d[2] == 'x';
+	}
+
+	public Bytes decode (Bytes compressed) throws Error {
+		size_t est_max = compressed.get_size () * 15;
+		uint8[] dst_buf = new uint8[est_max];
+
+		size_t written = decode_buffer (dst_buf, compressed.get_data ());
+		if (written == 0)
+			throw new Error.PROTOCOL ("liblzfse returned 0 bytes");
+
+		return new Bytes (dst_buf[:written]);
+	}
+
+	[CCode (cheader_filename = "lzfse.h", cname = "lzfse_decode_buffer")]
+	private extern size_t decode_buffer ([CCode (array_length_type = "size_t")] uint8[] dst, [CCode (array_length_type = "size_t")] uint8[] src, void * scratch = null);
+}

src/barebone/machine.vala

@@ -16,19 +16,45 @@ namespace Frida.Barebone {
 
 		public abstract async size_t query_page_size (Cancellable? cancellable) throws Error, IOError;
 
+		public abstract async uint query_exception_level (Cancellable? cancellable) throws Error, IOError;
+
+		public async void enter_exception_level (uint level, uint timeout, Cancellable? cancellable) throws Error, IOError {
+			var timer = new Timer ();
+
+			do {
+				var el = yield query_exception_level (cancellable);
+				if (el == level)
+					return;
+
+				yield gdb.continue (cancellable);
+
+				var source = new TimeoutSource (10);
+				source.set_callback (enter_exception_level.callback);
+				source.attach (MainContext.get_thread_default ());
+				yield;
+
+				yield gdb.stop (cancellable);
+			} while ((uint) (timer.elapsed () * 1000.0) < timeout);
+
+			throw new Error.TIMED_OUT ("Timed out while trying to get target to exception level %u", level);
+		}
+
 		public abstract async void enumerate_ranges (Gum.PageProtection prot, FoundRangeFunc func, Cancellable? cancellable)
 			throws Error, IOError;
 
-		public abstract async Allocation allocate_pages (uint64 physical_address, uint num_pages, Cancellable? cancellable)
+		public abstract async Allocation allocate_pages (Gee.List<uint64?> physical_addresses, Cancellable? cancellable)
 			throws Error, IOError;
 
+		public abstract async void protect_pages (uint64 virtual_address, size_t size, Gum.PageProtection prot,
+			Cancellable? cancellable) throws Error, IOError;
+
 		public abstract async Gee.List<uint64?> scan_ranges (Gee.List<Gum.MemoryRange?> ranges, MatchPattern pattern,
 			uint max_matches, Cancellable? cancellable) throws Error, IOError;
 
-		public Bytes relocate (Gum.ElfModule module, uint64 base_va) throws Error {
+		public Bytes relocate (Gum.ElfModule elf, Bytes raw_elf, uint64 base_va) throws Error {
 			uint64 file_start = uint64.MAX;
 			uint64 file_end = 0;
-			module.enumerate_segments (s => {
+			elf.enumerate_segments (s => {
 				if (s.file_size != 0) {
 					file_start = uint64.min (s.file_offset, file_start);
 					file_end = uint64.max (s.file_offset + s.file_size, file_end);
@@ -36,9 +62,9 @@ namespace Frida.Barebone {
 				return true;
 			});
 
-			var relocated_buf = gdb.make_buffer (new Bytes (module.get_file_data ()[file_start:file_end]));
+			var relocated_buf = gdb.make_buffer (new Bytes (raw_elf[(size_t) file_start:(size_t) file_end].get_data ()));
 			Error? pending_error = null;
-			module.enumerate_relocations (r => {
+			elf.enumerate_relocations (r => {
 				unowned string parent_section = (r.parent != null) ? r.parent.name : "";
 				if (parent_section == ".rela.text" || parent_section.has_prefix (".rela.debug_"))
 					return true;
@@ -58,15 +84,14 @@ namespace Frida.Barebone {
 			Bytes relocated_bytes = relocated_buf.bytes;
 			Bytes relocated_image = gdb.make_buffer_builder ()
 				.append_bytes (relocated_bytes)
-				.skip ((size_t) (module.mapped_size - relocated_bytes.get_size ()))
+				.skip ((size_t) (elf.mapped_size - relocated_bytes.get_size ()))
 				.build ();
 			return relocated_image;
 		}
 
 		public abstract void apply_relocation (Gum.ElfRelocationDetails r, uint64 base_va, Buffer relocated) throws Error;
 
-		public abstract async uint64 invoke (uint64 impl, uint64[] args, uint64 landing_zone, Cancellable? cancellable)
-			throws Error, IOError;
+		public abstract async uint64 invoke (uint64 impl, uint64[] args, Cancellable? cancellable) throws Error, IOError;
 
 		public abstract async CallFrame load_call_frame (GDB.Thread thread, uint arity, Cancellable? cancellable)
 			throws Error, IOError;

src/barebone/meson.build

@@ -1,12 +1,21 @@
 backend_sources += files(
   'barebone-host-session.vala',
+  'config.vala',
+  'agent-connection.vala',
   'script.vala',
   'machine.vala',
   'allocator.vala',
   'callback.vala',
   'memory-scanner.vala',
   'interceptor.vala',
+  'c-module.vala',
   'rust-module.vala',
+  'console.vala',
+  'layout.vala',
+  'elf.vala',
+  'img4.vala',
+  'lzfse.vala',
+  'qmp-client.vala',
   'arch-x86' / 'machine.vala',
   'arch-x86_64' / 'machine.vala',
   'arch-arm' / 'machine.vala',
@@ -59,4 +68,3 @@ backend_sources += custom_target('frida-data-barebone',
 
 backend_vala_args += gum_vala_args
 backend_vala_args_private += '--pkg=quickjs'
-backend_deps += quickjs_dep

src/barebone/package-lock.json

@@ -8,7 +8,7 @@
       "name": "frida-barebone-script-runtime",
       "version": "1.0.0",
       "devDependencies": {
-        "@types/frida-gum": "^19.0.0",
+        "@types/frida-gum": "^19.0.1",
         "esbuild": "^0.25.5",
         "typescript": "^5.8.3"
       }
@@ -439,9 +439,9 @@
       }
     },
     "node_modules/@types/frida-gum": {
-      "version": "19.0.0",
-      "resolved": "https://registry.npmjs.org/@types/frida-gum/-/frida-gum-19.0.0.tgz",
-      "integrity": "sha512-qViK1KwvPEAkajwSUv0wpZvZLiX8xO4JFFCh8dfYZfzSyOEfoE0KliCP/nJSKIKG6N3hXnPowrvPufjs5fLKAA==",
+      "version": "19.0.1",
+      "resolved": "https://registry.npmjs.org/@types/frida-gum/-/frida-gum-19.0.1.tgz",
+      "integrity": "sha512-mp8BpWWkQFJH86ZN5uXZuDiA7KY/+jDknrw0a06x0/+F5ucPwctHrCuV6iT+LLCp/GyICc36ssedF33B1WoLsw==",
       "dev": true,
       "license": "MIT"
     },

src/barebone/package.json

@@ -9,7 +9,7 @@
     "watch": "tsc -w"
   },
   "devDependencies": {
-    "@types/frida-gum": "^19.0.0",
+    "@types/frida-gum": "^19.0.1",
     "esbuild": "^0.25.5",
     "typescript": "^5.8.3"
   }

src/barebone/qmp-client.vala

@@ -0,0 +1,461 @@
+[CCode (gir_namespace = "FridaBarebone", gir_version = "1.0")]
+namespace Frida.Barebone {
+	public sealed class QmpClient : Object, AsyncInitable {
+		public signal void event (string name, Json.Node? data);
+
+		public string address {
+			get;
+			construct;
+		}
+
+		public uint16 port {
+			get;
+			construct;
+		}
+
+		private SocketConnection connection;
+		private DataInputStream input;
+		private OutputStream output;
+
+		private bool is_connected = false;
+		private Promise<bool> close_request = new Promise<bool> ();
+
+		private Gee.Map<uint, Promise<Json.Node>> pending_requests = new Gee.HashMap<uint, Promise<Json.Node>> ();
+		private uint next_request_id = 1;
+
+		private Cancellable io_cancellable = new Cancellable ();
+
+		private const int REQUEST_TIMEOUT_MS = 30000;
+
+		public QmpClient (string? address = null, uint16 port = 0) {
+			Object (
+				address: address ?? "localhost",
+				port: port != 0 ? port : 4444
+			);
+		}
+
+		public static async QmpClient open (string? address = null, uint16 port = 0, Cancellable? cancellable = null)
+				throws Error, IOError {
+			var client = new QmpClient (address, port);
+
+			try {
+				yield client.init_async (Priority.DEFAULT, cancellable);
+			} catch (GLib.Error e) {
+				throw_api_error (e);
+			}
+
+			return client;
+		}
+
+		private async bool init_async (int io_priority, Cancellable? cancellable) throws Error, IOError {
+			var connectable = parse_socket_address (address, port, "localhost", 4444);
+
+			try {
+				var client = new SocketClient ();
+				connection = yield client.connect_async (connectable, cancellable);
+			} catch (GLib.Error e) {
+				throw new Error.TRANSPORT ("Unable to connect to QMP server: %s", e.message);
+			}
+
+			var socket = connection.socket;
+			if (socket.get_family () != UNIX)
+				Tcp.enable_nodelay (socket);
+
+			input = new DataInputStream (connection.get_input_stream ());
+			input.set_newline_type (DataStreamNewlineType.LF);
+			output = connection.get_output_stream ();
+
+			bool started_message_processing = false;
+			try {
+				is_connected = true;
+
+				string? greeting_line = yield input.read_line_async (Priority.DEFAULT, cancellable);
+				if (greeting_line == null)
+					throw new Error.TRANSPORT ("Connection closed during QMP greeting");
+
+				process_incoming_messages.begin ();
+				started_message_processing = true;
+
+				yield execute_command ("qmp_capabilities", null, cancellable);
+
+				return true;
+			} catch (GLib.Error e) {
+				is_connected = false;
+				if (!started_message_processing)
+					close_request.resolve (true);
+
+				if (e is Error)
+					throw_api_error (e);
+				else
+					throw new Error.TRANSPORT ("%s", e.message);
+			}
+		}
+
+		public async void close (Cancellable? cancellable = null) throws IOError {
+			io_cancellable.cancel ();
+
+			try {
+				yield close_request.future.wait_async (cancellable);
+			} catch (Error e) {
+				assert_not_reached ();
+			}
+		}
+
+		public async Hostlink open_hostlink (Cancellable? cancellable = null) throws Error, IOError {
+#if WINDOWS
+			throw new Error.NOT_SUPPORTED ("Missing open_hostlink() for Windows");
+#else
+			uint64 mmio = (uint64) yield get_qom_property_int ("/machine", "hostlink-mmio", cancellable);
+			uint irq = (uint) yield get_qom_property_int ("/machine", "hostlink-irq", cancellable);
+			string bus = yield get_qom_property_string ("/machine", "hostlink-bus", cancellable);
+
+			int fds[2];
+			if (Posix.socketpair (Posix.AF_UNIX, Posix.SOCK_STREAM, 0, fds) != 0)
+				throw new Error.NOT_SUPPORTED ("Unable to allocate socketpair");
+
+			Socket local_sock, remote_sock;
+			try {
+				local_sock = new Socket.from_fd (fds[0]);
+				remote_sock = new Socket.from_fd (fds[1]);
+			} catch (GLib.Error e) {
+				throw new Error.TRANSPORT ("%s", e.message);
+			}
+
+			string fd_name = "appfd";
+			yield getfd (fd_name, fds[1], cancellable);
+
+			string chardev = "vserial0";
+			yield add_chardev_from_fd (chardev, fd_name, cancellable);
+
+			yield add_serial_port (chardev, bus, "re.frida.hostlink", "hostlink.port", 1, cancellable);
+
+			return new Hostlink () {
+				connection = SocketConnection.factory_create_connection (local_sock),
+				mmio = mmio,
+				irq = irq,
+			};
+#endif
+		}
+
+		public class Hostlink {
+			public SocketConnection connection;
+			public uint64 mmio;
+			public uint irq;
+		}
+
+#if !WINDOWS
+		private async int64 get_qom_property_int (string path, string property, Cancellable? cancellable) throws Error, IOError {
+			var val = yield get_qom_property (path, property, cancellable);
+			if (val.get_value_type () != typeof (int64))
+				throw new Error.PROTOCOL ("Expected '%s' property on %s to be an integer", property, path);
+			return val.get_int ();
+		}
+
+		private async string get_qom_property_string (string path, string property, Cancellable? cancellable)
+				throws Error, IOError {
+			var val = yield get_qom_property (path, property, cancellable);
+			if (val.get_value_type () != typeof (string))
+				throw new Error.PROTOCOL ("Expected '%s' property on %s to be a string", property, path);
+			return val.get_string ();
+		}
+
+		private async Json.Node get_qom_property (string path, string property, Cancellable? cancellable) throws Error, IOError {
+			var args = new Json.Builder ();
+			args
+				.begin_object ()
+					.set_member_name ("path")
+					.add_string_value (path)
+					.set_member_name ("property")
+					.add_string_value (property)
+				.end_object ();
+			return yield execute_command ("qom-get", args.get_root (), cancellable);
+		}
+
+		private async void getfd (string name, int fd, Cancellable? cancellable) throws Error, IOError {
+			var args = new Json.Builder ();
+			args
+				.begin_object ()
+					.set_member_name ("fdname")
+					.add_string_value (name)
+				.end_object ();
+			yield execute_command_with_file_descriptor ("getfd", args.get_root (), fd, cancellable);
+		}
+
+		private async void add_chardev_from_fd (string id, string fd_name, Cancellable? cancellable) throws Error, IOError {
+			var args = new Json.Builder ();
+			args
+				.begin_object ()
+					.set_member_name ("id")
+					.add_string_value (id)
+					.set_member_name ("backend")
+					.begin_object ()
+						.set_member_name ("type")
+						.add_string_value ("socket")
+						.set_member_name ("data")
+						.begin_object ()
+							.set_member_name ("server")
+							.add_boolean_value (false)
+							.set_member_name ("addr")
+							.begin_object ()
+								.set_member_name ("type")
+								.add_string_value ("fd")
+								.set_member_name ("data")
+								.begin_object ()
+									.set_member_name ("str")
+									.add_string_value (fd_name)
+								.end_object ()
+							.end_object ()
+						.end_object ()
+					.end_object ()
+				.end_object ();
+			yield execute_command ("chardev-add", args.get_root (), cancellable);
+		}
+
+		private async void add_serial_port (string chardev, string bus, string name, string id, uint nr, Cancellable? cancellable)
+				throws Error, IOError {
+			var args = new Json.Builder ();
+			args
+				.begin_object ()
+					.set_member_name ("driver")
+					.add_string_value ("virtserialport")
+					.set_member_name ("chardev")
+					.add_string_value (chardev)
+					.set_member_name ("bus")
+					.add_string_value (bus)
+					.set_member_name ("name")
+					.add_string_value (name)
+					.set_member_name ("id")
+					.add_string_value (id)
+					.set_member_name ("nr")
+					.add_int_value ((int64) nr)
+				.end_object ();
+			yield execute_command ("device_add", args.get_root (), cancellable);
+		}
+#endif
+
+		public async Json.Node execute_command (string command, Json.Node? arguments = null, Cancellable? cancellable = null)
+				throws Error, IOError {
+			check_connected ();
+
+			Request request = begin_request (command, arguments);
+
+			try {
+				yield output.write_all_async (request.json.data, Priority.DEFAULT, cancellable, null);
+			} catch (GLib.Error e) {
+				cancel_request (request);
+				throw new Error.TRANSPORT ("%s", e.message);
+			}
+
+			return yield join_request (request, cancellable);
+		}
+
+		public async Json.Node execute_command_with_file_descriptor (string command, Json.Node? arguments = null, int fd,
+				Cancellable? cancellable = null) throws Error, IOError {
+			check_connected ();
+
+#if WINDOWS
+			throw new Error.NOT_SUPPORTED ("Executing command with SocketControlMessage is not supported on Windows");
+#else
+			Request request = begin_request (command, arguments);
+
+			var scm = new UnixFDMessage ();
+			try {
+				scm.append_fd (fd);
+			} catch (GLib.Error e) {
+				throw new Error.NOT_SUPPORTED ("%s", e.message);
+			}
+
+			Socket s = connection.get_socket ();
+
+			unowned uint8[] raw_command = request.json.data;
+
+			OutputVector vectors[1] = {
+				OutputVector () {
+					buffer = raw_command,
+					size = raw_command.length,
+				},
+			};
+			SocketControlMessage scms[1] = { scm };
+
+			ssize_t n;
+			try {
+				n = s.send_message (null, vectors, scms, 0, cancellable);
+			} catch (GLib.Error e) {
+				cancel_request (request);
+				throw new Error.TRANSPORT ("%s", e.message);
+			}
+
+			if (n != raw_command.length) {
+				try {
+					yield output.write_all_async (raw_command[n:], Priority.DEFAULT, cancellable, null);
+				} catch (GLib.Error e) {
+					cancel_request (request);
+					throw new Error.TRANSPORT ("%s", e.message);
+				}
+			}
+
+			return yield join_request (request, cancellable);
+#endif
+		}
+
+		private Request begin_request (string command, Json.Node? arguments) {
+			uint id = next_request_id++;
+
+			var promise = new Promise<Json.Node> ();
+			pending_requests[id] = promise;
+
+			string json = build_request (command, id, arguments);
+
+			return new Request () {
+				promise = promise,
+				json = json,
+				id = id,
+			};
+		}
+
+		private static string build_request (string command, uint id, Json.Node? arguments) {
+			var b = new Json.Builder ();
+			b
+				.begin_object ()
+				.set_member_name ("execute")
+				.add_string_value (command);
+
+			if (arguments != null) {
+				b
+					.set_member_name ("arguments")
+					.add_value (arguments);
+			}
+
+			b
+				.set_member_name ("id")
+				.add_int_value ((int64) id);
+
+			Json.Node message = b.end_object ().get_root ();
+
+			return Json.to_string (message, false) + "\n";
+		}
+
+		private async Json.Node join_request (Request request, Cancellable? cancellable) throws Error, IOError {
+			var timeout_source = new TimeoutSource (REQUEST_TIMEOUT_MS);
+			timeout_source.set_callback (() => {
+				Promise<Json.Node>? p;
+				if (pending_requests.unset (request.id, out p))
+					p.reject (new Error.TIMED_OUT ("QMP command timed out"));
+				return Source.REMOVE;
+			});
+			timeout_source.attach (MainContext.get_thread_default ());
+
+			try {
+				return yield request.promise.future.wait_async (cancellable);
+			} finally {
+				timeout_source.destroy ();
+			}
+		}
+
+		private void cancel_request (Request r) {
+			pending_requests.unset (r.id);
+		}
+
+		private class Request {
+			public Promise<Json.Node> promise;
+			public string json;
+			public uint id;
+		}
+
+		private void check_connected () throws Error {
+			if (!is_connected)
+				throw new Error.INVALID_OPERATION ("QMP client is not connected");
+		}
+
+		private async void process_incoming_messages () {
+			try {
+				while (is_connected) {
+					string? line = yield input.read_line_async (Priority.DEFAULT, io_cancellable);
+					if (line == null)
+						break;
+
+					handle_message (Json.from_string (line));
+				}
+			} catch (GLib.Error e) {
+			} finally {
+				is_connected = false;
+
+				foreach (var promise in pending_requests.values)
+					promise.reject (new Error.TRANSPORT ("QMP connection closed"));
+				pending_requests.clear ();
+			}
+
+			io_cancellable.cancel ();
+
+			var source = new IdleSource ();
+			source.set_callback (process_incoming_messages.callback);
+			source.attach (MainContext.get_thread_default ());
+			yield;
+
+			try {
+				yield connection.close_async ();
+			} catch (GLib.Error e) {
+			}
+
+			close_request.resolve (true);
+		}
+
+		private void handle_message (Json.Node message) throws Error {
+			var r = new Json.Reader (message);
+
+			bool is_response = r.read_member ("id");
+			uint id = 0;
+			if (is_response) {
+				id = (uint) r.get_int_value ();
+				GLib.Error? e = r.get_error ();
+				if (e != null)
+					throw new Error.PROTOCOL ("Malformed message: %s", e.message);
+			}
+			r.end_member ();
+
+			if (is_response)
+				handle_response (id, r);
+			else
+				handle_event (r);
+		}
+
+		private void handle_response (uint request_id, Json.Reader r) throws Error {
+			Promise<Json.Node>? promise;
+			if (!pending_requests.unset (request_id, out promise))
+				return;
+
+			if (r.read_member ("error")) {
+				r.read_member ("desc");
+				string? description = r.get_string_value ();
+				if (description == null)
+					throw new Error.PROTOCOL ("Malformed message: %s", r.get_error ().message);
+				r.end_member ();
+
+				promise.reject (new Error.NOT_SUPPORTED ("%s", description));
+				return;
+			}
+			r.end_member ();
+
+			r.read_member ("return");
+			promise.resolve (r.get_current_node ());
+		}
+
+		private void handle_event (Json.Reader r) throws Error {
+			r.read_member ("event");
+			string? name = r.get_string_value ();
+			if (name == null)
+				throw new Error.PROTOCOL ("Malformed event message: missing 'event' property");
+			r.end_member ();
+
+			Json.Node? data = null;
+			if (r.read_member ("data")) {
+				if (!r.is_object ())
+					throw new Error.PROTOCOL ("Malformed event message: 'data' must be an object");
+				data = r.get_current_node ();
+			}
+			r.end_member ();
+
+			event (name, data);
+		}
+	}
+}

src/barebone/rust-module.vala

@@ -84,23 +84,15 @@ namespace Frida.Barebone {
 				throw new Error.NOT_SUPPORTED ("%s", e.message);
 			}
 
-			size_t vm_size = (size_t) elf.mapped_size;
+			var raw_elf = new Bytes.static (elf.get_file_data ());
 
 			size_t page_size = yield machine.query_page_size (cancellable);
-			uint num_pages = (uint) (vm_size / page_size);
-			if (vm_size % page_size != 0)
-				num_pages++;
 
-			var gdb = machine.gdb;
+			allocation = yield inject_elf (elf, raw_elf, page_size, machine, allocator, cancellable);
 
-			allocation = yield allocator.allocate (num_pages * page_size, page_size, cancellable);
 			uint64 base_va = allocation.virtual_address;
-
-			Bytes relocated_image = machine.relocate (elf, base_va);
-			yield gdb.write_byte_array (base_va, relocated_image, cancellable);
-
 			uint64 console_log_trap = 0;
-			elf.enumerate_dynamic_symbols (e => {
+			elf.enumerate_symbols (e => {
 				if (e.name == "")
 					return true;
 
@@ -116,38 +108,14 @@ namespace Frida.Barebone {
 			});
 
 			if (console_log_trap != 0) {
-				console_log_callback = yield new Callback (console_log_trap, new ConsoleLogHandler (this, gdb),
-					machine, cancellable);
+				var handler = new ConsoleLogHandler (machine.gdb);
+				handler.output.connect (on_console_output);
+				console_log_callback = yield new Callback (console_log_trap, handler, machine, cancellable);
 			}
 		}
 
-		private class ConsoleLogHandler : Object, CallbackHandler {
-			public uint arity {
-				get { return 2; }
-			}
-
-			private weak RustModule parent;
-			private GDB.Client gdb;
-
-			public ConsoleLogHandler (RustModule parent, GDB.Client gdb) {
-				this.parent = parent;
-				this.gdb = gdb;
-			}
-
-			public async uint64 handle_invocation (uint64[] args, CallFrame frame, Cancellable? cancellable)
-					throws Error, IOError {
-				var message = args[0];
-				var len = (long) args[1];
-
-				Bytes str_bytes = yield gdb.read_byte_array (message, len, cancellable);
-				unowned uint8[] str_data = str_bytes.get_data ();
-				unowned string str_raw = (string) str_data;
-				string str = str_raw.substring (0, len);
-
-				parent.console_output (str);
-
-				return 0;
-			}
+		private void on_console_output (string message) {
+			console_output (message);
 		}
 
 		private const string CRATE_NAME = "rustmodule";
@@ -201,7 +169,7 @@ namespace Frida.Barebone {
 							.resolve_relative_path (CRATE_NAME);
 					}
 
-					yield write_text_file (workdir, "module.lds", make_linker_script (symbols), cancellable);
+					yield write_text_file (workdir, "module.lds", make_linker_script (code, symbols), cancellable);
 				} catch (GLib.Error e) {
 					throw new Error.PERMISSION_DENIED ("%s", e.message);
 				}
@@ -270,8 +238,8 @@ namespace Frida.Barebone {
 				return rs.str;
 			}
 
-			private static string make_linker_script (Gee.Map<string, uint64?> symbols) {
-				var script = new StringBuilder.sized (256);
+			private static string make_linker_script (string code, Gee.Map<string, uint64?> symbols) {
+				var script = new StringBuilder.sized (512);
 
 				foreach (var e in symbols.entries) {
 					unowned string name = e.key;
@@ -282,15 +250,16 @@ namespace Frida.Barebone {
 						.append_printf ("0x%" + uint64.FORMAT_MODIFIER + "x;\n", address);
 				}
 
-				script.append (prettify_text_asset (BASE_LINKER_SCRIPT));
-
-				return script.str;
-			}
-
-			private const string BASE_LINKER_SCRIPT = """
+				script.append ("""
 				SECTIONS {
 					.text : {
 						*(.text*);
+				""");
+
+				foreach (string name in extract_extern_c_symbols (code))
+					script.append_printf ("		KEEP(*(.text.%s))\n", name);
+
+				script.append ("""
 						_console_log = .;
 						. += 8;
 					}
@@ -307,7 +276,25 @@ namespace Frida.Barebone {
 						*(.bss*)
 					}
 				}
-			""";
+				""");
+
+				return prettify_text_asset (script.str);
+			}
+
+			private static Gee.List<string> extract_extern_c_symbols (string code) {
+				var names = new Gee.ArrayList<string> ();
+
+				var export_pattern = /\#\[\s*no_mangle\s*\]\s*pub\s+(?:unsafe\s+)?extern\s*"C"\s+fn\s+([A-Za-z_]\w*)\s*\(/;
+
+				try {
+					MatchInfo info;
+					for (export_pattern.match (code, 0, out info); info.matches (); info.next ())
+						names.add (info.fetch (1));
+				} catch (RegexError e) {
+				}
+
+				return names;
+			}
 
 			private const string BUILTINS = """
 				#![no_main]

src/barebone/script-runtime/entrypoint.ts

@@ -304,6 +304,13 @@ Object.defineProperties(Process, {
 });
 
 const marshalers: { [type: string]: Marshaler } = {
+    void: {
+        fromNative(v) {
+        },
+        toNative(v) {
+            throw new Error("invalid operation");
+        }
+    },
     pointer: {
         fromNative(v) {
             return new BNativePointer(v);
@@ -338,6 +345,28 @@ const marshalers: { [type: string]: Marshaler } = {
             return BigInt(v);
         }
     },
+    uint: {
+        fromNative(v) {
+            return Number(v);
+        },
+        toNative(v) {
+            if (typeof v !== "number") {
+                throw new Error("expected an integer");
+            }
+            return BigInt(v);
+        }
+    },
+    size_t: {
+        fromNative(v) {
+            return new BUInt64(v);
+        },
+        toNative(v) {
+            if (typeof v === "number") {
+                return BigInt(v);
+            }
+            return v.$v;
+        }
+    },
 };
 
 function getMarshalerFor(t: NativeFunctionReturnType | NativeFunctionArgumentType): Marshaler {

src/barebone/script.vala

@@ -42,8 +42,6 @@ namespace Frida {
 
 		private Gee.Queue<QuickJS.Value?> tick_callbacks = new Gee.ArrayQueue<QuickJS.Value?> ();
 
-		private Barebone.Allocation? cached_landing_zone; // TODO: Deallocate on teardown.
-
 		private Gee.Set<Barebone.Callback> native_callbacks = new Gee.HashSet<Barebone.Callback> ();
 
 		private static QuickJS.ClassID cpu_context_class;
@@ -56,6 +54,9 @@ namespace Frida {
 		private static QuickJS.ClassExoticMethods invocation_args_exotic_methods;
 		private static QuickJS.ClassID invocation_retval_class;
 
+		private static QuickJS.ClassID c_module_class;
+		private Gee.Set<Barebone.CModule> c_modules = new Gee.HashSet<Barebone.CModule> ();
+
 		private static QuickJS.ClassID rust_module_class;
 		private Gee.Set<Barebone.RustModule> rust_modules = new Gee.HashSet<Barebone.RustModule> ();
 
@@ -155,6 +156,7 @@ namespace Frida {
 
 			var memory_obj = ctx.make_object ();
 			add_cfunc (memory_obj, "alloc", on_memory_alloc, 1);
+			add_cfunc (memory_obj, "protect", on_memory_protect, 3);
 			add_cfunc (memory_obj, "scan", on_memory_scan, 4);
 			add_cfunc (memory_obj, "scanSync", on_memory_scan_sync, 3);
 			global.set_property_str (ctx, "Memory", memory_obj);
@@ -206,6 +208,17 @@ namespace Frida {
 			ir.class_name = "InvocationReturnValue";
 			rt.make_class (QuickJS.make_class_id (ref invocation_retval_class), ir);
 
+			QuickJS.ClassDef cm;
+			cm.class_name = "CModule";
+			cm.finalizer = on_c_module_finalize;
+			rt.make_class (QuickJS.make_class_id (ref c_module_class), cm);
+			var cm_proto = ctx.make_object ();
+			add_cfunc (cm_proto, "dispose", on_c_module_dispose, 0);
+			ctx.set_class_proto (c_module_class, cm_proto);
+			var cm_ctor = ctx.make_cfunction2 (on_c_module_construct, cm.class_name, 1, constructor, 0);
+			cm_ctor.set_constructor (ctx, cm_proto);
+			global.set_property_str (ctx, "CModule", cm_ctor);
+
 			QuickJS.ClassDef rm;
 			rm.class_name = "RustModule";
 			rm.finalizer = on_rust_module_finalize;
@@ -672,11 +685,7 @@ namespace Frida {
 
 		private async void do_invoke (uint64 impl, uint64[] args, Promise<uint64?> promise) {
 			try {
-				if (cached_landing_zone == null)
-					cached_landing_zone = yield services.allocator.allocate (4, 1, io_cancellable);
-
-				uint64 retval = yield services.machine.invoke (impl, args, cached_landing_zone.virtual_address,
-					io_cancellable);
+				uint64 retval = yield services.machine.invoke (impl, args, io_cancellable);
 
 				promise.resolve (retval);
 			} catch (GLib.Error e) {
@@ -1124,6 +1133,41 @@ namespace Frida {
 			}
 		}
 
+		private static QuickJS.Value on_memory_protect (QuickJS.Context ctx, QuickJS.Value this_val, QuickJS.Value[] argv) {
+			BareboneScript * script = ctx.get_opaque ();
+
+			uint64 address;
+			if (!script->unparse_native_pointer (argv[0], out address))
+				return QuickJS.Exception;
+
+			uint size;
+			if (!script->unparse_uint (argv[1], out size))
+				return QuickJS.Exception;
+
+			Gum.PageProtection prot;
+			if (!script->unparse_page_protection (argv[2], out prot))
+				return QuickJS.Exception;
+
+			var promise = new Promise<bool?> ();
+			script->do_memory_protect.begin (address, size, prot, promise);
+
+			bool? result = script->process_events_until_ready (promise);
+			if (result == null)
+				return QuickJS.Exception;
+
+			return ctx.make_bool (result);
+		}
+
+		private async void do_memory_protect (uint64 address, size_t size, Gum.PageProtection prot, Promise<bool?> promise) {
+			try {
+				yield services.machine.protect_pages (address, size, prot, io_cancellable);
+
+				promise.resolve (true);
+			} catch (GLib.Error e) {
+				promise.resolve (false);
+			}
+		}
+
 		private static QuickJS.Value on_memory_scan (QuickJS.Context ctx, QuickJS.Value this_val, QuickJS.Value[] argv) {
 			BareboneScript * script = ctx.get_opaque ();
 
@@ -1791,6 +1835,67 @@ namespace Frida {
 			return QuickJS.Undefined;
 		}
 
+		private static QuickJS.Value on_c_module_construct (QuickJS.Context ctx, QuickJS.Value new_target,
+				QuickJS.Value[] argv) {
+			BareboneScript * script = ctx.get_opaque ();
+
+			Bytes blob;
+			if (!script->unparse_bytes (argv[0], out blob))
+				return QuickJS.Exception;
+
+			var promise = new Promise<Barebone.CModule> ();
+			script->load_c_module.begin (blob, promise);
+
+			Barebone.CModule? mod = script->process_events_until_ready (promise);
+			if (mod == null)
+				return QuickJS.Exception;
+
+			var proto = new_target.get_property (ctx, script->prototype_key);
+			var wrapper = ctx.make_object_with_proto_and_class (proto, c_module_class);
+			ctx.free_value (proto);
+
+			wrapper.set_opaque (mod);
+			script->c_modules.add (mod);
+
+			foreach (var e in mod.exports)
+				wrapper.set_property_str (ctx, e.name, script->make_native_pointer (e.address));
+
+			mod.console_output.connect (script->on_console_output);
+
+			return wrapper;
+		}
+
+		private async void load_c_module (Bytes blob, Promise<Barebone.CModule> promise) {
+			try {
+				var mod = yield new Barebone.CModule.from_blob (blob, services.machine, services.allocator, io_cancellable);
+
+				promise.resolve (mod);
+			} catch (GLib.Error e) {
+				promise.reject (e);
+			}
+		}
+
+		private static void on_c_module_finalize (QuickJS.Runtime rt, QuickJS.Value val) {
+			Barebone.CModule * mod = val.get_opaque (c_module_class);
+			if (mod == null)
+				return;
+
+			BareboneScript * script = rt.get_opaque ();
+			script->c_modules.remove (mod);
+		}
+
+		private static QuickJS.Value on_c_module_dispose (QuickJS.Context ctx, QuickJS.Value this_val, QuickJS.Value[] argv) {
+			Barebone.CModule * mod = this_val.get_opaque (c_module_class);
+
+			if (mod != null) {
+				this_val.set_opaque (null);
+				BareboneScript * script = ctx.get_opaque ();
+				script->c_modules.remove (mod);
+			}
+
+			return QuickJS.Undefined;
+		}
+
 		private static QuickJS.Value on_rust_module_construct (QuickJS.Context ctx, QuickJS.Value new_target,
 				QuickJS.Value[] argv) {
 			BareboneScript * script = ctx.get_opaque ();
@@ -1860,7 +1965,7 @@ namespace Frida {
 			foreach (var e in mod.exports)
 				wrapper.set_property_str (ctx, e.name, script->make_native_pointer (e.address));
 
-			mod.console_output.connect (script->on_rust_module_console_output);
+			mod.console_output.connect (script->on_console_output);
 
 			return wrapper;
 		}
@@ -1898,7 +2003,7 @@ namespace Frida {
 			return QuickJS.Undefined;
 		}
 
-		private void on_rust_module_console_output (string message) {
+		private void on_console_output (string message) {
 			var builder = new Json.Builder ();
 			builder
 				.begin_object ()

src/compiler/package-lock.json

@@ -33,7 +33,7 @@
         "@frida/url": "^1.0.2",
         "@frida/util": "^1.0.3",
         "@frida/vm": "^2.0.0",
-        "@types/frida-gum": "19.0.0",
+        "@types/frida-gum": "19.0.1",
         "@types/node": "18.19.103",
         "frida-fs": "7.0.0"
       }
@@ -248,9 +248,9 @@
       "license": "MIT"
     },
     "node_modules/@types/frida-gum": {
-      "version": "19.0.0",
-      "resolved": "https://registry.npmjs.org/@types/frida-gum/-/frida-gum-19.0.0.tgz",
-      "integrity": "sha512-qViK1KwvPEAkajwSUv0wpZvZLiX8xO4JFFCh8dfYZfzSyOEfoE0KliCP/nJSKIKG6N3hXnPowrvPufjs5fLKAA==",
+      "version": "19.0.1",
+      "resolved": "https://registry.npmjs.org/@types/frida-gum/-/frida-gum-19.0.1.tgz",
+      "integrity": "sha512-mp8BpWWkQFJH86ZN5uXZuDiA7KY/+jDknrw0a06x0/+F5ucPwctHrCuV6iT+LLCp/GyICc36ssedF33B1WoLsw==",
       "license": "MIT"
     },
     "node_modules/@types/node": {

src/compiler/package.json

@@ -29,7 +29,7 @@
     "@frida/url": "^1.0.2",
     "@frida/util": "^1.0.3",
     "@frida/vm": "^2.0.0",
-    "@types/frida-gum": "19.0.0",
+    "@types/frida-gum": "19.0.1",
     "@types/node": "18.19.103",
     "frida-fs": "7.0.0"
   }

src/control-service.vala

@@ -192,7 +192,7 @@ namespace Frida {
 		}
 
 		private void on_server_connection (IOStream connection, SocketAddress remote_address, DynamicInterface? dynamic_iface) {
-#if IOS || TVOS
+#if HAVE_LOCAL_BACKEND && (IOS || TVOS)
 			/*
 			 * We defer the launchd injection until the first connection is established in order
 			 * to avoid bootloops on unsupported jailbreaks.

src/darwin/frida-helper-backend-glue.m

@@ -80,7 +80,7 @@
     goto bsd_failure; \
   }
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 # define CORE_FOUNDATION "/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation"
 #else
 # define CORE_FOUNDATION "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"
@@ -390,7 +390,7 @@ static gboolean frida_spawn_instance_is_libc_initialized (FridaSpawnInstance * s
 static void frida_spawn_instance_set_libc_initialized (FridaSpawnInstance * self);
 static kern_return_t frida_spawn_instance_create_dyld_data (FridaSpawnInstance * self);
 static void frida_spawn_instance_destroy_dyld_data (FridaSpawnInstance * self);
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 static gboolean frida_pick_ios_tvos_bootstrapper (GumModule * module, gpointer user_data);
 #endif
 static void frida_spawn_instance_unset_helpers (FridaSpawnInstance * self);
@@ -971,7 +971,7 @@ invalid_pid:
   }
 }
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 
 #import "springboard.h"
 
@@ -2669,7 +2669,7 @@ frida_inject_instance_on_mach_thread_dead (void * context)
 
     self->agent_context->posix_thread = MACH_PORT_NULL;
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
     port_might_be_guarded = gum_darwin_check_xnu_version (7938, 0, 0);
 #else
     port_might_be_guarded = FALSE;
@@ -3284,7 +3284,7 @@ next_phase:
       return TRUE;
 
     case FRIDA_BREAKPOINT_DLOPEN_BOOTSTRAPPER:
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
       if (self->bootstrapper_name != 0)
       {
         frida_spawn_instance_set_libc_initialized (self);
@@ -3577,7 +3577,7 @@ frida_spawn_instance_create_dyld_data (FridaSpawnInstance * self)
   if (!gum_darwin_query_ptrauth_support (self->task, &ptrauth_support))
     return KERN_FAILURE;
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   gum_darwin_enumerate_modules (self->task, frida_pick_ios_tvos_bootstrapper, &data);
 #endif
 
@@ -3655,7 +3655,7 @@ frida_spawn_instance_destroy_dyld_data (FridaSpawnInstance * self)
   self->dyld_data = 0;
 }
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 
 static gboolean
 frida_pick_ios_tvos_bootstrapper (GumModule * module, gpointer user_data)
@@ -5449,7 +5449,7 @@ frida_set_hardware_single_step (gpointer debug_state, GumDarwinUnifiedThreadStat
 static gboolean
 frida_is_hardware_breakpoint_support_working (void)
 {
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   static gsize cached_result = 0;
 
   if (g_once_init_enter (&cached_result))

src/darwin/policy-softener-glue.c

@@ -1,6 +1,6 @@
 #include "frida-helper-backend.h"
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 # include "policyd.h"
 # include "substituted-client.h"
 # include "substituted2-client.h"

src/darwin/system-darwin.m

@@ -16,11 +16,11 @@
 # endif
 #endif
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 # import "springboard.h"
 #endif
 
-#if defined (HAVE_WATCHOS) || defined (HAVE_TVOS)
+#if defined (HAVE_WATCHOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 # import <Foundation/Foundation.h>
 #endif
 
@@ -35,7 +35,7 @@ struct _FridaEnumerateApplicationsOperation
 {
   FridaScope scope;
   GHashTable * process_by_identifier;
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   FridaSpringboardApi * api;
 #endif
 
@@ -45,14 +45,14 @@ struct _FridaEnumerateApplicationsOperation
 struct _FridaEnumerateProcessesOperation
 {
   FridaScope scope;
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   FridaSpringboardApi * api;
 #endif
 
   GArray * result;
 };
 
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 static void frida_collect_application_info_from_id_cstring (const gchar * identifier, FridaEnumerateApplicationsOperation * op);
 static void frida_collect_application_info_from_id_nsstring (NSString * identifier, FridaEnumerateApplicationsOperation * op);
 #endif
@@ -60,13 +60,13 @@ static void frida_collect_application_info_from_id_nsstring (NSString * identifi
 static void frida_collect_process_info_from_pid (guint pid, FridaEnumerateProcessesOperation * op);
 static void frida_collect_process_info_from_kinfo (struct kinfo_proc * process, FridaEnumerateProcessesOperation * op);
 
-#if defined (HAVE_MACOS) || defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_MACOS) || defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 static void frida_add_app_id (GHashTable * parameters, NSString * identifier);
 #endif
 
 #if defined (HAVE_MACOS)
 static void frida_add_app_icons (GHashTable * parameters, NSImage * image);
-#elif defined (HAVE_IOS) || defined (HAVE_TVOS)
+#elif defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 static void frida_add_app_metadata (GHashTable * parameters, NSString * identifier, FridaSpringboardApi * api);
 static void frida_add_app_state (GHashTable * parameters, guint pid, FridaSpringboardApi * api);
 static void frida_add_app_icons (GHashTable * parameters, NSString * identifier);
@@ -100,7 +100,7 @@ frida_system_enumerate_applications (FridaApplicationQueryOptions * options, int
   return NULL;
 }
 
-#elif defined (HAVE_IOS) || defined (HAVE_TVOS)
+#elif defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 
 void
 frida_system_get_frontmost_application (FridaFrontmostQueryOptions * options, FridaHostApplicationInfo * result, GError ** error)
@@ -306,7 +306,7 @@ frida_system_enumerate_processes (FridaProcessQueryOptions * options, int * resu
   NSAutoreleasePool * pool;
 
   op.scope = frida_process_query_options_get_scope (options);
-#if defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   op.api = _frida_get_springboard_api ();
 #endif
 
@@ -395,7 +395,7 @@ frida_collect_process_info_from_kinfo (struct kinfo_proc * process, FridaEnumera
         frida_add_app_icons (info.parameters, app.icon);
     }
   }
-#elif defined (HAVE_IOS) || defined (HAVE_TVOS)
+#elif defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
   {
     FridaSpringboardApi * api = op->api;
     NSString * identifier;
@@ -469,7 +469,7 @@ frida_temporary_directory_get_system_tmp (void)
   }
 }
 
-#if defined (HAVE_MACOS) || defined (HAVE_IOS) || defined (HAVE_TVOS)
+#if defined (HAVE_MACOS) || defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 
 static void
 frida_add_app_id (GHashTable * parameters, NSString * identifier)
@@ -541,7 +541,7 @@ frida_add_app_icons (GHashTable * parameters, NSImage * image)
   g_hash_table_insert (parameters, g_strdup ("icons"), g_variant_ref_sink (g_variant_builder_end (&builder)));
 }
 
-#elif defined (HAVE_IOS) || defined (HAVE_TVOS)
+#elif defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 
 static void
 frida_add_app_metadata (GHashTable * parameters, NSString * identifier, FridaSpringboardApi * api)

src/embed-agent.py

@@ -58,7 +58,7 @@ def main(argv):
             for asset in {embedded_agent, embedded_dbghelp, embedded_symsrv}:
                 asset.write_bytes(b"")
                 embedded_assets += [asset]
-    elif host_os in {"macos", "ios", "watchos", "tvos"}:
+    elif host_os in {"macos", "ios", "watchos", "tvos", "xros"}:
         embedded_agent = priv_dir / "frida-agent.dylib"
         if agent_modern is not None and agent_legacy is not None:
             subprocess.run(lipo + [agent_modern, agent_legacy, "-create", "-output", embedded_agent],

src/embed-helper.py

@@ -36,7 +36,7 @@ def main(argv):
             embedded_helper = priv_dir / f"frida-helper-{missing_arch}.exe"
             embedded_helper.write_bytes(b"")
             embedded_assets += [embedded_helper]
-    elif host_os in {"macos", "ios", "watchos", "tvos"}:
+    elif host_os in {"macos", "ios", "watchos", "tvos", "xros"}:
         embedded_helper = priv_dir / "frida-helper"
 
         if helper_modern is not None and helper_legacy is not None:

src/freebsd/binjector-glue.c

@@ -1626,7 +1626,9 @@ frida_run_to_entrypoint (pid_t pid, GError ** error)
   ret = frida_get_regs (pid, &regs);
   CHECK_OS_RESULT (ret, ==, 0, "frida_get_regs");
 
-#if defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 8
+#if defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 4
+  regs.r_eip = entrypoint;
+#elif defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 8
   regs.r_rip = entrypoint;
 #elif defined (HAVE_ARM64)
   regs.elr = entrypoint;
@@ -1823,7 +1825,33 @@ frida_remote_call (pid_t pid, GumAddress func, const GumAddress * args, gint arg
   ret = frida_get_regs (pid, &regs);
   CHECK_OS_RESULT (ret, ==, 0, "frida_get_regs");
 
-#if defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 8
+#if defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 4
+  regs.r_esp -= FRIDA_RED_ZONE_SIZE;
+  regs.r_esp -= (regs.r_esp - (args_length * 4)) % FRIDA_STACK_ALIGNMENT;
+
+  regs.r_eip = func;
+
+  if (args_length != 0)
+  {
+    guintptr * stack_args;
+
+    stack_args = g_newa (guintptr, args_length);
+    for (i = 0; i != args_length; i++)
+      stack_args[i] = args[i];
+
+    regs.r_esp -= args_length * sizeof (guintptr);
+    if (!frida_remote_write (pid, regs.r_esp, stack_args, args_length * sizeof (guintptr), error))
+      goto propagate_error;
+  }
+
+  {
+    guintptr dummy_return_address = FRIDA_DUMMY_RETURN_ADDRESS;
+
+    regs.r_esp -= 4;
+    if (!frida_remote_write (pid, regs.r_esp, &dummy_return_address, sizeof (dummy_return_address), error))
+      goto propagate_error;
+  }
+#elif defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 8
   regs.r_rsp -= FRIDA_RED_ZONE_SIZE;
   regs.r_rsp -= (regs.r_rsp - (MAX (args_length - 6, 0) * 8)) % FRIDA_STACK_ALIGNMENT;
 
@@ -1905,7 +1933,9 @@ frida_remote_call (pid_t pid, GumAddress func, const GumAddress * args, gint arg
   ret = frida_get_regs (pid, &regs);
   CHECK_OS_RESULT (ret, ==, 0, "frida_get_regs");
 
-#if defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 8
+#if defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 4
+  *retval = regs.r_eax;
+#elif defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 8
   *retval = regs.r_rax;
 #elif defined (HAVE_ARM64)
   *retval = regs.x[0];
@@ -1924,7 +1954,7 @@ os_failure:
         failed_operation, g_strerror (errno));
     return FALSE;
   }
-#if defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 8
+#ifdef HAVE_I386
 propagate_error:
   {
     return FALSE;
@@ -1943,7 +1973,10 @@ frida_remote_exec (pid_t pid, GumAddress remote_address, GumAddress remote_stack
   ret = frida_get_regs (pid, &regs);
   CHECK_OS_RESULT (ret, ==, 0, "frida_get_regs");
 
-#if defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 8
+#if defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 4
+  regs.r_eip = remote_address;
+  regs.r_esp = remote_stack;
+#elif defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 8
   regs.r_rip = remote_address;
   regs.r_rsp = remote_stack;
 #elif defined (HAVE_ARM64)
@@ -1967,7 +2000,9 @@ frida_remote_exec (pid_t pid, GumAddress remote_address, GumAddress remote_stack
     ret = frida_get_regs (pid, &regs);
     CHECK_OS_RESULT (ret, ==, 0, "frida_get_regs");
 
-#if defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 8
+#if defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 4
+    *result = regs.r_eax;
+#elif defined (HAVE_I386) && GLIB_SIZEOF_VOID_P == 8
     *result = regs.r_rax;
 #elif defined (HAVE_ARM64)
     *result = regs.x[0];

src/fruity/debugger-mappings.vala

@@ -0,0 +1,82 @@
+[CCode (gir_namespace = "FridaFruity", gir_version = "1.0")]
+namespace Frida.DebuggerMappings {
+	internal async void spray_pages (GDB.Client gdb, uint64 address, size_t size, size_t page_size, Cancellable? cancellable)
+			throws Error, IOError {
+		int n_pages = (int) (size / page_size);
+		if (n_pages == 0)
+			throw new Error.INVALID_ARGUMENT ("Expected one or more pages");
+
+		var builder = gdb.make_packet_builder_sized (64);
+		Future<bool>? last_write = null;
+
+		for (int i = 0; i < n_pages; i += 2) {
+			bool is_last = (i + 2 >= n_pages);
+
+			uint64 last_byte_addr = address + ((uint64) i * page_size) + page_size - 1;
+			size_t write_count = is_last ? 1 : 2;
+
+			builder
+				.append_c ('M')
+				.append_address (last_byte_addr)
+				.append_c (',')
+				.append_size (write_count)
+				.append_c (':')
+				.append_escaped ((write_count == 2) ? "0000" : "00");
+
+			var request = new Promise<bool> ();
+			gdb.perform_execute.begin (builder.build (), cancellable, request);
+
+			builder.reset ();
+
+			if (is_last)
+				last_write = request.future;
+		}
+
+		yield last_write.wait_async (cancellable);
+	}
+
+	internal async void handle_page_plan (GDB.Client gdb, uint64 address, size_t size, size_t page_size, Cancellable? cancellable)
+			throws Error, IOError {
+		var plan = new BufferReader (yield gdb.read_buffer (address, size, cancellable));
+
+		var n_blocks = plan.read_uint32 ();
+		if (n_blocks == 0)
+			return;
+
+		var builder = gdb.make_packet_builder_sized (64);
+		Future<bool>? last_write = null;
+
+		for (uint32 i = 0; i != n_blocks; i++) {
+			uint64 start = plan.read_pointer ();
+			uint32 count = plan.read_uint32 ();
+
+			for (size_t j = 0; j < count; j += 2) {
+				bool is_last = (j + 2 >= count) && (i == n_blocks - 1);
+
+				uint64 last_byte_addr = start + ((uint64) j * page_size) + page_size - 1;
+				size_t write_count = size_t.min (2, count - j);
+
+				builder
+					.append_c ('M')
+					.append_address (last_byte_addr)
+					.append_c (',')
+					.append_size (write_count)
+					.append_c (':')
+					.append_hexbyte (plan.read_uint8 ());
+
+				if (write_count == 2)
+					builder.append_hexbyte (plan.read_uint8 ());
+
+				var request = new Promise<bool> ();
+				gdb.perform_execute.begin (builder.build (), cancellable, request);
+
+				builder.reset ();
+
+				if (is_last)
+					last_write = request.future;
+			}
+		}
+
+		yield last_write.wait_async (cancellable);
+	}
+}

src/fruity/device-monitor.vala

@@ -340,7 +340,7 @@ namespace Frida.Fruity {
 					var stream = yield tunnel.open_tcp_connection (port, cancellable);
 					return new TcpChannel () { stream = stream, kind = TUNNEL };
 				} catch (Error e) {
-					if (e is Error.SERVER_NOT_RUNNING)
+					if (e is Error.SERVER_NOT_RUNNING || e is Error.TRANSPORT)
 						pending_error = e;
 					else
 						throw e;

src/fruity/fruity-host-session.vala

@@ -808,14 +808,17 @@ namespace Frida {
 			var lldb = yield start_lldb_service (cancellable);
 			var process = yield lldb.launch (argv, launch_options, cancellable);
 			if (process.observed_state == ALREADY_RUNNING) {
-				yield lldb.kill (cancellable);
+				try {
+					yield lldb.kill (cancellable);
+				} catch (Error e) {
+				}
 				yield lldb.close (cancellable);
 
 				lldb = yield start_lldb_service (cancellable);
 				process = yield lldb.launch (argv, launch_options, cancellable);
 			}
 
-			var session = new LLDBSession (lldb, process, gadget_path, device);
+			var session = new LLDBSession (lldb, process, gadget_path, ExceptionHandlingStatus.LIMITED, device);
 			add_lldb_session (session);
 
 			return process.pid;
@@ -833,8 +836,13 @@ namespace Frida {
 		public async void resume (uint pid, Cancellable? cancellable) throws Error, IOError {
 			var session = lldb_sessions[pid];
 			if (session != null) {
-				yield session.resume (cancellable);
-				return;
+				foreach (var entry in gadget_entries.values) {
+					if (entry.pid == pid) {
+						yield entry.resume (cancellable);
+						return;
+					}
+				}
+				assert_not_reached ();
 			}
 
 			var server = yield get_remote_server (cancellable);
@@ -867,7 +875,7 @@ namespace Frida {
 				var lldb = yield start_lldb_service (cancellable);
 				var process = yield lldb.attach_by_pid (pid, cancellable);
 
-				lldb_session = new LLDBSession (lldb, process, null, device);
+				lldb_session = new LLDBSession (lldb, process, null, ExceptionHandlingStatus.FULL, device);
 				yield lldb_session.kill (cancellable);
 				yield lldb_session.close (cancellable);
 			} catch (Error e) {
@@ -903,7 +911,7 @@ namespace Frida {
 
 			string? gadget_path = null;
 
-			lldb_session = new LLDBSession (lldb, process, gadget_path, device);
+			lldb_session = new LLDBSession (lldb, process, gadget_path, ExceptionHandlingStatus.LIMITED, device);
 			add_lldb_session (lldb_session);
 
 			var gadget_details = yield lldb_session.query_gadget_details (cancellable);
@@ -955,7 +963,7 @@ namespace Frida {
 				}
 
 				var local_session_id = AgentSessionId.generate ();
-				var gadget_entry = new GadgetEntry (local_session_id, host_session, connection);
+				var gadget_entry = new GadgetEntry (local_session_id, host_session, connection, pid);
 				gadget_entry.detached.connect (on_gadget_entry_detached);
 				gadget_entries[local_session_id] = gadget_entry;
 				agent_sessions[local_session_id] = new AgentSessionEntry (remote_session_id, connection);
@@ -1139,9 +1147,22 @@ namespace Frida {
 		}
 
 		private void on_gadget_entry_detached (GadgetEntry entry, SessionDetachReason reason) {
+			detach_entry.begin (entry, reason);
+		}
+
+		private async void detach_entry (GadgetEntry entry, SessionDetachReason reason) throws Error, IOError {
 			AgentSessionId id = entry.local_session_id;
 			var no_crash = CrashInfo.empty ();
 
+			var lldb_session = lldb_sessions[entry.pid];
+			if (lldb_session != null) {
+				remove_lldb_session (lldb_session);
+				if (reason == SessionDetachReason.APPLICATION_REQUESTED)
+					yield entry.detach_lldb (lldb_session, io_cancellable);
+				else
+					yield lldb_session.close (io_cancellable);
+			}
+
 			gadget_entries.unset (id);
 			agent_sessions.unset (id);
 
@@ -1375,6 +1396,7 @@ namespace Frida {
 
 		private class LLDBSession : Object {
 			public signal void closed ();
+			public signal void detached ();
 			public signal void output (Bytes bytes);
 
 			public LLDB.Client lldb {
@@ -1397,14 +1419,27 @@ namespace Frida {
 				construct;
 			}
 
-			private Promise<Fruity.Injector.GadgetDetails>? gadget_request;
+			public ExceptionHandlingStatus exception_handling_status {
+				get;
+				construct;
+			}
 
-			public LLDBSession (LLDB.Client lldb, LLDB.Process process, string? gadget_path,
+			private Promise<Fruity.Injector.GadgetDetails>? gadget_request;
+			private ulong exception_handler = 0;
+			private string? main_thread_id;
+			private bool resumed = false;
+
+			private Cancellable io_cancellable = new Cancellable ();
+
+			private const size_t PAGE_SIZE = 0x4000;
+
+			public LLDBSession (LLDB.Client lldb, LLDB.Process process, string? gadget_path, ExceptionHandlingStatus ehs,
 					HostChannelProvider channel_provider) {
 				Object (
 					lldb: lldb,
 					process: process,
 					gadget_path: gadget_path,
+					exception_handling_status: ehs,
 					channel_provider: channel_provider
 				);
 			}
@@ -1415,20 +1450,92 @@ namespace Frida {
 			}
 
 			~LLDBSession () {
+				detach_exception_handler ();
+
 				lldb.closed.disconnect (on_lldb_closed);
 				lldb.console_output.disconnect (on_lldb_console_output);
 			}
 
 			public async void close (Cancellable? cancellable) throws IOError {
+				io_cancellable.cancel ();
+
+				detach_exception_handler ();
+
 				yield lldb.close (cancellable);
 			}
 
-			public async void resume (Cancellable? cancellable) throws Error, IOError {
-				yield lldb.detach (cancellable);
+			private async void handle_exception (GDB.Exception exception) throws Error, IOError {
+				var e = (Frida.LLDB.Exception) exception;
+
+				var sig = (LLDB.Signal) e.signum;
+				var medata = e.medata;
+				if (sig == SIGTRAP && e.metype == EXC_BREAKPOINT && medata.size == 2) {
+					uint64 x1 = e.context["x1"];
+					uint64 x2 = e.context["x2"];
+					var action = (GadgetBreakpointAction) e.context["x3"];
+					if (x1 == x2 == 1337) {
+						uint64 pc = e.context["pc"];
+						var thread = e.thread;
+						yield thread.write_register ("pc", pc + 4, io_cancellable);
+
+						switch (action) {
+							case RESUME: {
+								resumed = true;
+								yield lldb.continue (io_cancellable);
+
+								return;
+							}
+							case DETACH: {
+								yield lldb.detach (io_cancellable);
+								detached ();
+
+								break;
+							}
+							case PAGE_PLAN: {
+								var plan_size = (size_t) e.context["x4"];
+								var plan_address = e.context["x5"];
+								yield DebuggerMappings.handle_page_plan (lldb, plan_address, plan_size,
+									PAGE_SIZE, io_cancellable);
+
+								yield thread.write_register ("x0", 0x1337, io_cancellable);
+
+								if (resumed)
+									yield lldb.continue (io_cancellable);
+								else
+									yield continue_gadget_threads (io_cancellable);
+
+								return;
+							}
+							default:
+								break;
+						}
+					}
+				}
+
+				detach_exception_handler ();
+
+				yield lldb.close (io_cancellable);
+			}
+
+			private async void continue_gadget_threads (Cancellable? cancellable) throws Error, IOError {
+				var gadget_threads = new Gee.ArrayList<LLDB.Thread> ();
+				yield lldb.enumerate_threads (thread => {
+					if (thread.id != main_thread_id)
+						gadget_threads.add (thread);
+					return true;
+				}, cancellable);
+				yield lldb.continue_specific_threads (gadget_threads, cancellable);
 			}
 
 			public async void kill (Cancellable? cancellable) throws Error, IOError {
-				yield lldb.kill (cancellable);
+				io_cancellable.cancel ();
+
+				detach_exception_handler ();
+
+				if (exception_handling_status == FULL)
+					yield lldb.kill (cancellable);
+				else
+					yield lldb.close (cancellable);
 			}
 
 			public async Fruity.Injector.GadgetDetails query_gadget_details (Cancellable? cancellable) throws Error, IOError {
@@ -1461,13 +1568,26 @@ namespace Frida {
 						: Gum.PtrauthSupport.UNSUPPORTED;
 					var module = new Gum.DarwinModule.from_file (path, Gum.CpuType.ARM64, ptrauth_support);
 
-					var details = yield Fruity.Injector.inject ((owned) module, lldb, channel_provider, cancellable);
+					Fruity.Injector.Transaction transaction =
+						yield Fruity.Injector.inject ((owned) module, lldb, channel_provider, cancellable);
+					Fruity.Injector.GadgetDetails gadget = transaction.gadget;
+					main_thread_id = transaction.main_thread_id;
 
-					gadget_request.resolve (details);
+					exception_handler = lldb.notify["exception"].connect ((obj, pspec) => {
+						var exception = lldb.exception;
+						if (exception != null)
+							handle_exception.begin (exception);
+					});
 
-					return details;
+					yield transaction.commit (cancellable);
+
+					gadget_request.resolve (gadget);
+
+					return gadget;
 				} catch (GLib.Error e) {
-					var api_error = new Error.NOT_SUPPORTED ("%s", e.message);
+					var api_error = (e is Error)
+						? (Error) e
+						: new Error.NOT_SUPPORTED ("%s", e.message);
 
 					gadget_request.reject (api_error);
 					gadget_request = null;
@@ -1476,6 +1596,14 @@ namespace Frida {
 				}
 			}
 
+			private void detach_exception_handler () {
+				if (exception_handler != 0) {
+					if (lldb.state != CLOSED)
+						lldb.disconnect (exception_handler);
+					exception_handler = 0;
+				}
+			}
+
 			private void on_lldb_closed () {
 				closed ();
 			}
@@ -1485,6 +1613,11 @@ namespace Frida {
 			}
 		}
 
+		private enum ExceptionHandlingStatus {
+			FULL,
+			LIMITED,
+		}
+
 		private class GadgetEntry : Object {
 			public signal void detached (SessionDetachReason reason);
 
@@ -1503,13 +1636,20 @@ namespace Frida {
 				construct;
 			}
 
-			private Promise<bool>? close_request;
+			public uint pid {
+				get;
+				construct;
+			}
 
-			public GadgetEntry (AgentSessionId local_session_id, HostSession host_session, DBusConnection connection) {
+			private Promise<bool>? close_request;
+			private Promise<bool>? detach_request;
+
+			public GadgetEntry (AgentSessionId local_session_id, HostSession host_session, DBusConnection connection, uint pid) {
 				Object (
 					local_session_id: local_session_id,
 					host_session: host_session,
-					connection: connection
+					connection: connection,
+					pid: pid
 				);
 			}
 
@@ -1550,6 +1690,48 @@ namespace Frida {
 				close_request.resolve (true);
 			}
 
+			public async void resume (Cancellable? cancellable) throws Error, IOError {
+				try {
+					GadgetSession session = yield connection.get_proxy (null, ObjectPath.GADGET_SESSION,
+						DO_NOT_LOAD_PROPERTIES, cancellable);
+
+					yield session.break_and_resume (cancellable);
+				} catch (GLib.Error e) {
+					throw_dbus_error (e);
+				}
+			}
+
+			public async void detach_lldb (LLDBSession lldb_session, Cancellable? cancellable) throws Error, IOError {
+				while (detach_request != null) {
+					try {
+						yield detach_request.future.wait_async (cancellable);
+						return;
+					} catch (Error e) {
+						assert_not_reached ();
+					} catch (IOError e) {
+						cancellable.set_error_if_cancelled ();
+					}
+				}
+				detach_request = new Promise<bool> ();
+
+				try {
+					GadgetSession session = yield connection.get_proxy (null, ObjectPath.GADGET_SESSION,
+						DO_NOT_LOAD_PROPERTIES, cancellable);
+
+					lldb_session.detached.connect (on_lldb_session_detached);
+
+					yield session.break_and_detach (cancellable);
+
+					yield detach_request.future.wait_async (cancellable);
+				} catch (GLib.Error e) {
+					detach_request.reject (e);
+					throw_dbus_error (e);
+				} finally {
+					lldb_session.detached.disconnect (on_lldb_session_detached);
+					detach_request = null;
+				}
+			}
+
 			private void on_connection_closed (DBusConnection connection, bool remote_peer_vanished, GLib.Error? error) {
 				if (close_request == null) {
 					close_request = new Promise<bool> ();
@@ -1562,6 +1744,11 @@ namespace Frida {
 			private void on_session_detached (AgentSessionId id, SessionDetachReason reason) {
 				detached (reason);
 			}
+
+			private void on_lldb_session_detached () {
+				if (detach_request != null)
+					detach_request.resolve (true);
+			}
 		}
 
 		private class AgentSessionEntry {

src/fruity/helpers/upload-api.h

@@ -24,17 +24,21 @@ struct _FridaUploadApi
   int (* listen) (int socket, int backlog);
   int (* getsockname) (int socket, struct sockaddr * restrict address, socklen_t * restrict address_len);
   int (* accept) (int socket, struct sockaddr * restrict address, socklen_t * restrict address_len);
+  int (* close) (int fd);
   ssize_t (* read) (int fd, void * buf, size_t n);
   ssize_t (* write) (int fd, const void *buf, size_t n);
+  int (* getpagesize) (void);
+  int (* mprotect) (void * addr, size_t len, int prot);
   void (* sys_icache_invalidate) (void * start, size_t len);
   void (* sys_dcache_flush) (void * start, size_t len);
   mach_port_t (* _mach_task_self) (void);
   kern_return_t (* mach_vm_allocate) (vm_map_t target, mach_vm_address_t * address, mach_vm_size_t size, int flags);
   kern_return_t (* mach_vm_deallocate) (vm_map_t target, mach_vm_address_t address, mach_vm_size_t size);
+  kern_return_t (* vm_remap) (vm_map_t target_task, vm_address_t * target_address, vm_size_t size, vm_address_t mask, int flags,
+      vm_map_t src_task, vm_address_t src_address, boolean_t copy, vm_prot_t * cur_protection, vm_prot_t * max_protection,
+      vm_inherit_t inheritance);
   void * (* dlopen) (const char * path, int mode);
   void * (* dlsym) (void * handle, const char * symbol);
-  int (* mprotect) (void * addr, size_t len, int prot);
-  int (* close) (int fd);
 
   int * (* get_errno_storage) (void);
 };
@@ -46,18 +50,20 @@ struct _FridaUploadApi
       listen, \
       getsockname, \
       accept, \
+      close, \
       read, \
       write, \
+      getpagesize, \
+      mprotect, \
       sys_icache_invalidate, \
       sys_dcache_flush, \
       dlsym (RTLD_DEFAULT, "mach_task_self"), \
       mach_vm_allocate, \
       mach_vm_deallocate, \
+      vm_remap, \
       dlopen, \
       dlsym, \
-      mprotect, \
-      close, \
-      __error \
+      __error, \
     }
 
 #define FRIDA_RX_BUFFER_SIZE (1024 * 1024)

src/fruity/helpers/upload-listener.c

@@ -67,7 +67,7 @@ failure:
     if (fd != -1)
       api->close (fd);
 
-    return ((uint64_t) error_code << 56);
+    return ((uint64_t) error_code << 57);
   }
 }
 

src/fruity/helpers/upload-receiver.c

@@ -258,6 +258,7 @@ int64_t
 frida_receive (int listener_fd, uint64_t session_id_top, uint64_t session_id_bottom, const char * apple[], const FridaUploadApi * api)
 {
   int result = 0;
+  mach_port_t task;
   bool expecting_client;
   int res;
   struct sockaddr_in addr;
@@ -265,6 +266,8 @@ frida_receive (int listener_fd, uint64_t session_id_top, uint64_t session_id_bot
   int client_fd;
   uint32_t ACK_MAGIC = 0xac4ac4ac;
 
+  task = api->_mach_task_self ();
+
   expecting_client = true;
 
   do
@@ -307,16 +310,33 @@ frida_receive (int listener_fd, uint64_t session_id_top, uint64_t session_id_bot
         {
           uint64_t address;
           uint32_t size;
+          vm_address_t writable_address;
+          vm_prot_t cur_prot, max_prot;
           size_t n;
 
           FRIDA_READ_VALUE (address);
           FRIDA_READ_VALUE (size);
 
-          success = frida_read_chunk (client_fd, (void *) address, size, &n, api);
+          writable_address = 0;
+          success = api->vm_remap (task, &writable_address, size, 0, VM_FLAGS_ANYWHERE, task, address, FALSE, &cur_prot, &max_prot,
+              VM_INHERIT_NONE) == 0;
+          if (!success)
+            break;
+
+          success = api->mprotect ((void *) writable_address, size, VM_PROT_READ | VM_PROT_WRITE) == 0;
+          if (!success)
+            goto unmap_writable;
+
+          success = frida_read_chunk (client_fd, (void *) writable_address, size, &n, api);
+          if (!success)
+            goto unmap_writable;
 
           api->sys_icache_invalidate ((void *) address, n);
           api->sys_dcache_flush ((void *) address, n);
 
+unmap_writable:
+          api->mach_vm_deallocate (task, writable_address, size);
+
           break;
         }
         case FRIDA_UPLOAD_COMMAND_APPLY_THREADED:
@@ -449,6 +469,19 @@ next_client:
 beach:
   api->close (listener_fd);
 
+#ifndef BUILDING_TEST_PROGRAM
+  asm volatile (
+      "mov x0, %0\n\t"
+      "mov x1, #1337\n\t"
+      "mov x2, #1337\n\t"
+      "mov x3, #0\n\t"
+      "brk #1337\n\t"
+      :
+      : "r" ((uint64_t) result)
+      : "x0", "x1", "x2", "x3"
+  );
+#endif
+
   return result;
 }
 

src/fruity/injector.vala

@@ -1,11 +1,45 @@
 [CCode (gir_namespace = "FridaFruityInjector", gir_version = "1.0")]
 namespace Frida.Fruity.Injector {
-	public static async GadgetDetails inject (owned Gum.DarwinModule module, LLDB.Client lldb, HostChannelProvider channel_provider,
+	public static async Transaction inject (owned Gum.DarwinModule module, LLDB.Client lldb, HostChannelProvider channel_provider,
 			Cancellable? cancellable) throws Error, IOError {
 		var session = new Session (module, lldb, channel_provider);
 		return yield session.run (cancellable);
 	}
 
+	public sealed class Transaction : Object {
+		public GadgetDetails gadget {
+			get;
+			construct;
+		}
+
+		public string main_thread_id;
+
+		private bool is_early_instrumentation;
+		private LLDB.Client lldb;
+
+		internal Transaction (GadgetDetails gadget, bool is_early_instrumentation, string main_thread_id, LLDB.Client lldb) {
+			Object (gadget: gadget);
+
+			this.is_early_instrumentation = is_early_instrumentation;
+			this.main_thread_id = main_thread_id;
+			this.lldb = lldb;
+		}
+
+		public async void commit (Cancellable? cancellable) throws Error, IOError {
+			if (is_early_instrumentation) {
+				var gadget_threads = new Gee.ArrayList<LLDB.Thread> ();
+				yield lldb.enumerate_threads (thread => {
+					if (thread.id != main_thread_id)
+						gadget_threads.add (thread);
+					return true;
+				}, cancellable);
+				yield lldb.continue_specific_threads (gadget_threads, cancellable);
+			} else {
+				yield lldb.continue (cancellable);
+			}
+		}
+	}
+
 	public sealed class GadgetDetails : Object {
 		public uint16 port {
 			get;
@@ -17,10 +51,6 @@ namespace Frida.Fruity.Injector {
 		}
 	}
 
-	public errordomain Error {
-		UNSUPPORTED
-	}
-
 	private sealed class Session : Object {
 		public Gum.DarwinModule module {
 			get;
@@ -77,36 +107,26 @@ namespace Frida.Fruity.Injector {
 			);
 		}
 
-		public async GadgetDetails run (Cancellable? cancellable) throws Error, IOError {
+		public async Transaction run (Cancellable? cancellable) throws Error, IOError {
 			try {
+				bool is_early_instrumentation;
+
 				var existing_gadget = yield setup (cancellable);
 				if (existing_gadget != null) {
-					yield lldb.detach (cancellable);
-					return existing_gadget;
+					is_early_instrumentation = false;
+					return new Transaction (existing_gadget, is_early_instrumentation, main_thread.id, lldb);
 				}
 
-				bool is_early_instrumentation = !libsystem_initialized;
+				is_early_instrumentation = !libsystem_initialized;
 
 				yield ensure_libsystem_initialized (cancellable);
-				var result = yield inject_module (cancellable);
+				var gadget = yield inject_module (cancellable);
 
 				yield teardown (cancellable);
 
-				if (is_early_instrumentation) {
-					var gadget_threads = new Gee.ArrayList<LLDB.Thread> ();
-					yield lldb.enumerate_threads (thread => {
-						if (thread.id != main_thread.id)
-							gadget_threads.add (thread);
-						return true;
-					}, cancellable);
-					yield lldb.continue_specific_threads (gadget_threads, cancellable);
-				} else {
-					yield lldb.detach (cancellable);
-				}
-
-				return result;
+				return new Transaction (gadget, is_early_instrumentation, main_thread.id, lldb);
 			} catch (GLib.Error e) {
-				throw new Error.UNSUPPORTED ("%s", e.message);
+				throw new Error.NOT_SUPPORTED ("%s", e.message);
 			}
 		}
 
@@ -151,7 +171,9 @@ namespace Frida.Fruity.Injector {
 				dyld_base = yield lldb.read_pointer (dyld_fields.dyld_load_address, cancellable);
 			} else {
 				yield lldb.enumerate_modules (m => {
-					if (m.pathname == "/usr/lib/dyld" || m.pathname == "/binpack/lib/dyld") {
+					if (m.pathname == "/usr/lib/dyld" ||
+							m.pathname == "/binpack/lib/dyld" ||
+							m.pathname == "/cores/usr/lib/dyld") {
 						dyld_base = m.load_address;
 						return false;
 					}
@@ -185,7 +207,10 @@ namespace Frida.Fruity.Injector {
 
 		private async GadgetDetails inject_module (Cancellable? cancellable) throws GLib.Error {
 			module_size = compute_virtual_size (module);
-			module.base_address = yield lldb.allocate (module_size, "rw", cancellable);
+			module.base_address = yield lldb.allocate (module_size, "rx", cancellable);
+
+			yield DebuggerMappings.spray_pages (lldb, module.base_address, (size_t) module.segments.index (0).vm_size,
+				page_size, cancellable);
 
 			unowned Gum.DarwinModuleImage image = module.image;
 			unowned uint8[] image_data = ((uint8[]) image.data)[0:image.size];
@@ -221,7 +246,7 @@ namespace Frida.Fruity.Injector {
 					case TEXT_ABSOLUTE32:
 						break;
 					default:
-						pending_error = new Error.UNSUPPORTED ("Unsupported rebase type: %u", rebase.type);
+						pending_error = new Error.NOT_SUPPORTED ("Unsupported rebase type: %u", rebase.type);
 						return false;
 				}
 
@@ -250,7 +275,7 @@ namespace Frida.Fruity.Injector {
 							case MAIN_EXECUTABLE:
 							case FLAT_LOOKUP:
 							case WEAK_LOOKUP:
-								pending_error = new Error.UNSUPPORTED ("Unsupported bind ordinal: %d",
+								pending_error = new Error.NOT_SUPPORTED ("Unsupported bind ordinal: %d",
 									bind.library_ordinal);
 								return false;
 							default:
@@ -273,7 +298,7 @@ namespace Frida.Fruity.Injector {
 						threaded_items.add_region (bind.segment.vm_address + slide + bind.offset);
 						break;
 					default:
-						pending_error = new Error.UNSUPPORTED ("Unsupported bind type: %u", bind.type);
+						pending_error = new Error.NOT_SUPPORTED ("Unsupported bind type: %u", bind.type);
 						return false;
 				}
 
@@ -308,7 +333,7 @@ namespace Frida.Fruity.Injector {
 					bool is_weak = (bind.symbol_flags & Gum.DarwinBindSymbolFlags.WEAK_IMPORT) != 0;
 					if (is_weak || is_dyld_stub_binder (module_name, symbol_name))
 						return true;
-					pending_error = new Error.UNSUPPORTED ("Unable to resolve symbol: %s", bind.symbol_name);
+					pending_error = new Error.NOT_SUPPORTED ("Unable to resolve symbol: %s", bind.symbol_name);
 					return false;
 				}
 
@@ -375,17 +400,19 @@ namespace Frida.Fruity.Injector {
 				.append_pointer (symbols.listen)
 				.append_pointer (symbols.getsockname)
 				.append_pointer (symbols.accept)
+				.append_pointer (symbols.close)
 				.append_pointer (symbols.read)
 				.append_pointer (symbols.write)
+				.append_pointer (symbols.getpagesize)
+				.append_pointer (symbols.mprotect)
 				.append_pointer (symbols.sys_icache_invalidate)
 				.append_pointer (symbols.sys_dcache_flush)
 				.append_pointer (symbols._mach_task_self)
 				.append_pointer (symbols.mach_vm_allocate)
 				.append_pointer (symbols.mach_vm_deallocate)
+				.append_pointer (symbols.vm_remap)
 				.append_pointer (symbols.dlopen)
 				.append_pointer (symbols.dlsym)
-				.append_pointer (symbols.mprotect)
-				.append_pointer (symbols.close)
 				.append_pointer (symbols.get_errno_storage);
 
 			apple_strv_builder.build (args);
@@ -400,12 +427,12 @@ namespace Frida.Fruity.Injector {
 					upload_api
 				}, null, cancellable);
 
-			uint8  error_code    =  (uint8) ((listen_result >> 56) & 0xff);
-			uint32 listener_fd   = (uint32) ((listen_result >> 16) & 0xffffffffU);
-			uint16 listener_port = (uint16)  (listen_result        & 0xffff);
+			uint8  error_code                = (uint8)  ((listen_result >> 56) & 0xff);
+			uint32 listener_fd               = (uint32) ((listen_result >> 16) & 0xffffffffU);
+			uint16 listener_port             = (uint16)  (listen_result        & 0xffff);
 
 			if (error_code != 0)
-				throw new Error.UNSUPPORTED ("Unable to listen on TCP (error_code=%u)", error_code);
+				throw new Error.NOT_SUPPORTED ("Unable to listen on TCP (error_code=%u)", error_code);
 
 			yield lldb.write_byte_array (code, new Bytes.static (UPLOAD_RECEIVER_CODE), cancellable);
 
@@ -425,7 +452,7 @@ namespace Frida.Fruity.Injector {
 					upload_api
 				}, null, cancellable);
 			if (receive_result <= 0)
-				throw new Error.UNSUPPORTED ("Unable to start gadget: %" + int64.FORMAT_MODIFIER + "d", receive_result);
+				throw new Error.NOT_SUPPORTED ("Unable to start gadget: %" + int64.FORMAT_MODIFIER + "d", receive_result);
 
 			return (uint16) receive_result;
 		}
@@ -565,17 +592,19 @@ namespace Frida.Fruity.Injector {
 			public uint64 listen;
 			public uint64 getsockname;
 			public uint64 accept;
+			public uint64 close;
 			public uint64 read;
 			public uint64 write;
+			public uint64 getpagesize;
+			public uint64 mprotect;
 			public uint64 sys_icache_invalidate;
 			public uint64 sys_dcache_flush;
 			public uint64 _mach_task_self;
 			public uint64 mach_vm_allocate;
 			public uint64 mach_vm_deallocate;
+			public uint64 vm_remap;
 			public uint64 dlopen;
 			public uint64 dlsym;
-			public uint64 mprotect;
-			public uint64 close;
 			public uint64 get_errno_storage;
 
 			private const string LIBSYSTEM = "/usr/lib/libSystem.B.dylib";
@@ -588,17 +617,19 @@ namespace Frida.Fruity.Injector {
 					.add (LIBSYSTEM, "_listen")
 					.add (LIBSYSTEM, "_getsockname")
 					.add (LIBSYSTEM, "_accept")
+					.add (LIBSYSTEM, "_close")
 					.add (LIBSYSTEM, "_read")
 					.add (LIBSYSTEM, "_write")
+					.add (LIBSYSTEM, "_getpagesize")
+					.add (LIBSYSTEM, "_mprotect")
 					.add (LIBSYSTEM, "_sys_icache_invalidate")
 					.add (LIBSYSTEM, "_sys_dcache_flush")
 					.add (LIBSYSTEM, "_mach_task_self")
 					.add (LIBSYSTEM, "_mach_vm_allocate")
 					.add (LIBSYSTEM, "_mach_vm_deallocate")
+					.add (LIBSYSTEM, "_vm_remap")
 					.add (LIBSYSTEM, "_dlopen")
 					.add (LIBSYSTEM, "_dlsym")
-					.add (LIBSYSTEM, "_mprotect")
-					.add (LIBSYSTEM, "_close")
 					.add (LIBSYSTEM, "___error")
 					;
 			}
@@ -610,17 +641,19 @@ namespace Frida.Fruity.Injector {
 				listen                = symbols.get (LIBSYSTEM, "_listen");
 				getsockname           = symbols.get (LIBSYSTEM, "_getsockname");
 				accept                = symbols.get (LIBSYSTEM, "_accept");
+				close                 = symbols.get (LIBSYSTEM, "_close");
 				read                  = symbols.get (LIBSYSTEM, "_read");
 				write                 = symbols.get (LIBSYSTEM, "_write");
+				getpagesize           = symbols.get (LIBSYSTEM, "_getpagesize");
+				mprotect              = symbols.get (LIBSYSTEM, "_mprotect");
 				sys_icache_invalidate = symbols.get (LIBSYSTEM, "_sys_icache_invalidate");
 				sys_dcache_flush      = symbols.get (LIBSYSTEM, "_sys_dcache_flush");
 				_mach_task_self       = symbols.get (LIBSYSTEM, "_mach_task_self");
 				mach_vm_allocate      = symbols.get (LIBSYSTEM, "_mach_vm_allocate");
 				mach_vm_deallocate    = symbols.get (LIBSYSTEM, "_mach_vm_deallocate");
+				vm_remap              = symbols.get (LIBSYSTEM, "_vm_remap");
 				dlopen                = symbols.get (LIBSYSTEM, "_dlopen");
 				dlsym                 = symbols.get (LIBSYSTEM, "_dlsym");
-				mprotect              = symbols.get (LIBSYSTEM, "_mprotect");
-				close                 = symbols.get (LIBSYSTEM, "_close");
 				get_errno_storage     = symbols.get (LIBSYSTEM, "___error");
 			}
 		}
@@ -638,9 +671,9 @@ namespace Frida.Fruity.Injector {
 			0x68, 0x12, 0x40, 0xf9, 0xe1, 0x43, 0x00, 0x91, 0xe2, 0x33, 0x00, 0x91, 0xe0, 0x03, 0x14, 0xaa, 0x00, 0x01, 0x3f,
 			0xd6, 0x1f, 0x04, 0x00, 0x31, 0x60, 0x02, 0x00, 0x54, 0x68, 0x0e, 0x40, 0xf9, 0xe0, 0x03, 0x14, 0xaa, 0x21, 0x00,
 			0x80, 0x52, 0x00, 0x01, 0x3f, 0xd6, 0x1f, 0x04, 0x00, 0x31, 0xe0, 0x01, 0x00, 0x54, 0x88, 0x7e, 0x40, 0x93, 0xe9,
-			0x27, 0x40, 0x79, 0x29, 0x09, 0xc0, 0x5a, 0x35, 0x7d, 0x10, 0x53, 0x15, 0xbd, 0x70, 0xb3, 0x0d, 0x00, 0x00, 0x14,
-			0x15, 0x20, 0xe0, 0xd2, 0x0b, 0x00, 0x00, 0x14, 0x15, 0x40, 0xe0, 0xd2, 0x06, 0x00, 0x00, 0x14, 0x15, 0x60, 0xe0,
-			0xd2, 0x04, 0x00, 0x00, 0x14, 0x15, 0x80, 0xe0, 0xd2, 0x02, 0x00, 0x00, 0x14, 0x15, 0xa0, 0xe0, 0xd2, 0x68, 0x42,
+			0x27, 0x40, 0x79, 0x29, 0x09, 0xc0, 0x5a, 0x29, 0x7d, 0x10, 0x53, 0x35, 0x41, 0x08, 0xaa, 0x0d, 0x00, 0x00, 0x14,
+			0x15, 0x40, 0xe0, 0xd2, 0x0b, 0x00, 0x00, 0x14, 0x15, 0x80, 0xe0, 0xd2, 0x06, 0x00, 0x00, 0x14, 0x15, 0xc0, 0xe0,
+			0xd2, 0x04, 0x00, 0x00, 0x14, 0x15, 0x00, 0xe1, 0xd2, 0x02, 0x00, 0x00, 0x14, 0x15, 0x40, 0xe1, 0xd2, 0x68, 0x1a,
 			0x40, 0xf9, 0xe0, 0x03, 0x14, 0xaa, 0x00, 0x01, 0x3f, 0xd6, 0xe0, 0x03, 0x15, 0xaa, 0xfd, 0x7b, 0x45, 0xa9, 0xf4,
 			0x4f, 0x44, 0xa9, 0xf6, 0x57, 0x43, 0xa9, 0xff, 0x83, 0x01, 0x91, 0xc0, 0x03, 0x5f, 0xd6, 0x00, 0x1e, 0x00, 0x00,
 			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -650,144 +683,153 @@ namespace Frida.Fruity.Injector {
 		/* Compiled from helpers/upload-receiver.c */
 		private const uint8[] UPLOAD_RECEIVER_CODE = {
 			0xfc, 0x6f, 0xba, 0xa9, 0xfa, 0x67, 0x01, 0xa9, 0xf8, 0x5f, 0x02, 0xa9, 0xf6, 0x57, 0x03, 0xa9, 0xf4, 0x4f, 0x04,
-			0xa9, 0xfd, 0x7b, 0x05, 0xa9, 0xfd, 0x43, 0x01, 0x91, 0xff, 0x03, 0x03, 0xd1, 0xfa, 0x03, 0x04, 0xaa, 0xfb, 0x03,
-			0x03, 0xaa, 0xf7, 0x03, 0x02, 0xaa, 0xf8, 0x03, 0x01, 0xaa, 0xf9, 0x03, 0x00, 0xaa, 0xbf, 0xc3, 0x19, 0xb8, 0x88,
-			0x95, 0x98, 0x52, 0x48, 0x89, 0xb5, 0x72, 0xa8, 0x03, 0x18, 0xb8, 0x13, 0x02, 0x80, 0x52, 0xb3, 0x43, 0x18, 0xb8,
-			0x48, 0x17, 0x40, 0xf9, 0xa1, 0xe3, 0x01, 0xd1, 0xa2, 0xf3, 0x01, 0xd1, 0xe0, 0x03, 0x19, 0xaa, 0x00, 0x01, 0x3f,
-			0xd6, 0x1f, 0x04, 0x00, 0x31, 0xe1, 0x00, 0x00, 0x54, 0x48, 0x47, 0x40, 0xf9, 0x00, 0x01, 0x3f, 0xd6, 0x08, 0x00,
-			0x40, 0xb9, 0x1f, 0x11, 0x00, 0x71, 0xa0, 0xfe, 0xff, 0x54, 0xd7, 0x01, 0x00, 0x14, 0xf6, 0x03, 0x00, 0xaa, 0xa1,
-			0x43, 0x02, 0xd1, 0x02, 0x02, 0x80, 0x52, 0x53, 0x02, 0x00, 0x94, 0xa8, 0x27, 0x77, 0xa9, 0x1f, 0x00, 0x00, 0x71,
-			0x00, 0x11, 0x58, 0xfa, 0x20, 0x01, 0x57, 0xfa, 0x60, 0x00, 0x00, 0x54, 0x65, 0x02, 0x00, 0x94, 0xe8, 0xff, 0xff,
-			0x17, 0x58, 0x02, 0x00, 0x94, 0x20, 0x39, 0x00, 0x34, 0xa8, 0x23, 0x00, 0xd1, 0x1a, 0x01, 0x10, 0xf8, 0xa8, 0x33,
-			0x00, 0xd1, 0x19, 0x01, 0x10, 0xb8, 0xbb, 0x83, 0x11, 0xf8, 0xa1, 0x47, 0x02, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x22,
-			0x00, 0x80, 0x52, 0x41, 0x02, 0x00, 0x94, 0xe0, 0x37, 0x00, 0x34, 0xa8, 0xf3, 0x56, 0x38, 0x10, 0x05, 0x00, 0x51,
-			0x1f, 0x1a, 0x00, 0x71, 0x68, 0x37, 0x00, 0x54, 0x1f, 0x1a, 0x00, 0xf1, 0x10, 0x92, 0x9f, 0x9a, 0xb1, 0x38, 0x00,
-			0x10, 0x1f, 0x20, 0x03, 0xd5, 0x30, 0x7a, 0xb0, 0xb8, 0x11, 0x00, 0x00, 0x10, 0x30, 0x02, 0x10, 0x8b, 0x00, 0x02,
-			0x1f, 0xd6, 0xa1, 0x83, 0x01, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x02, 0x01, 0x80, 0x52, 0x30, 0x02, 0x00, 0x94, 0xc0,
-			0x35, 0x00, 0x34, 0xa1, 0xa3, 0x02, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x82, 0x00, 0x80, 0x52, 0x2b, 0x02, 0x00, 0x94,
-			0x20, 0x35, 0x00, 0x36, 0xa1, 0x03, 0x5a, 0xf8, 0xa2, 0x83, 0x55, 0xb8, 0xa3, 0x83, 0x02, 0xd1, 0xe0, 0x03, 0x16,
-			0xaa, 0xe4, 0x03, 0x1a, 0xaa, 0xbb, 0x01, 0x00, 0x94, 0xf7, 0x03, 0x00, 0xaa, 0x48, 0x23, 0x40, 0xf9, 0x36, 0x02,
-			0x00, 0x94, 0x48, 0x27, 0x40, 0xf9, 0x34, 0x02, 0x00, 0x94, 0x57, 0xfb, 0x07, 0x37, 0x9c, 0x01, 0x00, 0x14, 0xa1,
-			0x83, 0x01, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x02, 0x01, 0x80, 0x52, 0x19, 0x02, 0x00, 0x94, 0xe0, 0x32, 0x00, 0x34,
-			0xa1, 0x83, 0x02, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x02, 0x01, 0x80, 0x52, 0x14, 0x02, 0x00, 0x94, 0x40, 0x32, 0x00,
-			0x34, 0xa1, 0xa3, 0x02, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x42, 0x00, 0x80, 0x52, 0x0f, 0x02, 0x00, 0x94, 0xa0, 0x31,
-			0x00, 0x34, 0xf5, 0x03, 0x00, 0x91, 0xa8, 0x83, 0x55, 0x78, 0x08, 0x71, 0x1d, 0x53, 0x08, 0x3d, 0x00, 0x11, 0x08,
-			0x3d, 0x7c, 0x92, 0xe9, 0x03, 0x00, 0x91, 0x37, 0x01, 0x08, 0xcb, 0xff, 0x02, 0x00, 0x91, 0xa8, 0x83, 0x55, 0x78,
-			0x02, 0xf1, 0x7d, 0xd3, 0xe0, 0x03, 0x16, 0xaa, 0xe1, 0x03, 0x17, 0xaa, 0x01, 0x02, 0x00, 0x94, 0xc0, 0x2f, 0x00,
-			0x34, 0xa1, 0xc3, 0x02, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x42, 0x00, 0x80, 0x52, 0xfc, 0x01, 0x00, 0x94, 0x20, 0x2f,
-			0x00, 0x34, 0xa8, 0x03, 0x55, 0x78, 0x09, 0x71, 0x1d, 0x53, 0x29, 0x3d, 0x00, 0x11, 0x29, 0x3d, 0x7c, 0x92, 0xea,
-			0x03, 0x00, 0x91, 0x58, 0x01, 0x09, 0xcb, 0x1f, 0x03, 0x00, 0x91, 0x02, 0xf1, 0x7d, 0xd3, 0xe0, 0x03, 0x16, 0xaa,
-			0xe1, 0x03, 0x18, 0xaa, 0xf0, 0x01, 0x00, 0x94, 0xa0, 0x2d, 0x00, 0x34, 0x14, 0x00, 0x80, 0xd2, 0xba, 0x03, 0x5a,
-			0xf8, 0xbb, 0x03, 0x56, 0xf8, 0xbc, 0x03, 0x55, 0x78, 0x9f, 0x02, 0x1c, 0xeb, 0x40, 0x27, 0x00, 0x54, 0x19, 0x7b,
-			0x74, 0xf8, 0x33, 0x03, 0x40, 0xf9, 0xf3, 0x01, 0xf0, 0xb7, 0x68, 0xfe, 0x6b, 0xd3, 0x69, 0xaa, 0x40, 0x92, 0x6a,
-			0xaa, 0x6a, 0x93, 0x4a, 0x31, 0x55, 0x92, 0x09, 0x1d, 0x48, 0xb3, 0x28, 0x01, 0x0a, 0xaa, 0x69, 0x7e, 0x40, 0x92,
-			0x7f, 0x02, 0x41, 0xf2, 0xea, 0x03, 0x9a, 0x9a, 0x08, 0x01, 0x89, 0x9a, 0x49, 0x01, 0x1b, 0x8b, 0x20, 0x01, 0x08,
-			0x8b, 0x53, 0x01, 0xf8, 0xb6, 0x04, 0x00, 0x00, 0x14, 0x68, 0x3e, 0x40, 0x92, 0xe0, 0x7a, 0x68, 0xf8, 0xd3, 0x00,
-			0xf8, 0xb6, 0x61, 0xca, 0x71, 0xd3, 0x63, 0xc2, 0x70, 0xd3, 0x62, 0xbe, 0x60, 0xd3, 0xe4, 0x03, 0x19, 0xaa, 0xb6,
-			0x01, 0x00, 0x94, 0x68, 0xf6, 0x73, 0xd3, 0x20, 0x03, 0x00, 0xf9, 0x39, 0x4f, 0x28, 0x8b, 0xa8, 0xfc, 0xff, 0x35,
-			0x94, 0x06, 0x00, 0x91, 0xe0, 0xff, 0xff, 0x17, 0xa1, 0x83, 0x02, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x02, 0x01, 0x80,
-			0x52, 0xc6, 0x01, 0x00, 0x94, 0x80, 0x28, 0x00, 0x34, 0xa1, 0xa3, 0x02, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x02, 0x01,
-			0x80, 0x52, 0xc1, 0x01, 0x00, 0x94, 0xe0, 0x27, 0x00, 0x34, 0xa1, 0xc3, 0x02, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x02,
-			0x01, 0x80, 0x52, 0xbc, 0x01, 0x00, 0x94, 0x40, 0x27, 0x00, 0x34, 0xb9, 0xf3, 0x75, 0xa9, 0xa8, 0x03, 0x55, 0xf8,
-			0xa8, 0x83, 0x10, 0xf8, 0x48, 0x2b, 0x40, 0xf9, 0x00, 0x01, 0x3f, 0xd6, 0xbf, 0x03, 0x1a, 0xf8, 0x48, 0x2f, 0x40,
-			0xf9, 0xa1, 0x83, 0x01, 0xd1, 0xa9, 0x43, 0x00, 0xd1, 0x20, 0x01, 0x10, 0xb8, 0x22, 0x00, 0xa0, 0x52, 0x23, 0x00,
-			0x80, 0x52, 0x00, 0x01, 0x3f, 0xd6, 0x14, 0x00, 0x80, 0x52, 0x13, 0x00, 0x80, 0xd2, 0xb8, 0x03, 0x5a, 0xf8, 0x35,
-			0x83, 0x00, 0x91, 0x37, 0x00, 0x80, 0x52, 0x28, 0x13, 0x40, 0xb9, 0x9f, 0x02, 0x08, 0x6b, 0x60, 0x0c, 0x00, 0x54,
-			0xa8, 0x02, 0x40, 0xb9, 0x09, 0xfd, 0x9f, 0x52, 0xe9, 0xff, 0xaf, 0x72, 0x09, 0x01, 0x09, 0x0b, 0x3f, 0x2d, 0x00,
-			0x71, 0xe9, 0x22, 0xc9, 0x1a, 0x2a, 0x10, 0x81, 0x52, 0x29, 0x01, 0x0a, 0x0a, 0x24, 0x99, 0x40, 0x7a, 0x04, 0x09,
-			0x4c, 0x7a, 0x01, 0x01, 0x00, 0x54, 0xa8, 0x0a, 0x40, 0xb9, 0xa0, 0x02, 0x08, 0x8b, 0x48, 0x37, 0x40, 0xf9, 0x21,
-			0x01, 0x80, 0x52, 0x00, 0x01, 0x3f, 0xd6, 0x00, 0x7b, 0x33, 0xf8, 0x73, 0x06, 0x00, 0x91, 0xa8, 0x06, 0x40, 0xb9,
-			0xb5, 0x02, 0x08, 0x8b, 0x94, 0x06, 0x00, 0x11, 0xe8, 0xff, 0xff, 0x17, 0xa1, 0x83, 0x01, 0xd1, 0xe0, 0x03, 0x16,
-			0xaa, 0x02, 0x01, 0x80, 0x52, 0x8c, 0x01, 0x00, 0x94, 0x40, 0x21, 0x00, 0x34, 0xa1, 0x83, 0x02, 0xd1, 0xe0, 0x03,
-			0x16, 0xaa, 0x82, 0x00, 0x80, 0x52, 0x87, 0x01, 0x00, 0x94, 0xa0, 0x20, 0x00, 0x34, 0xa1, 0xa3, 0x02, 0xd1, 0xe0,
-			0x03, 0x16, 0xaa, 0x82, 0x00, 0x80, 0x52, 0x82, 0x01, 0x00, 0x94, 0x00, 0x20, 0x00, 0x36, 0x48, 0x3f, 0x40, 0xf9,
-			0xa0, 0x03, 0x5a, 0xf8, 0xa1, 0x03, 0x56, 0xb8, 0xa2, 0x83, 0x55, 0xb8, 0x00, 0x01, 0x3f, 0xd6, 0xe0, 0xe6, 0xff,
-			0x34, 0xf9, 0x00, 0x00, 0x14, 0xa1, 0x83, 0x01, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x02, 0x01, 0x80, 0x52, 0x76, 0x01,
-			0x00, 0x94, 0x80, 0x1e, 0x00, 0x34, 0xa1, 0xc3, 0x02, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x82, 0x00, 0x80, 0x52, 0x71,
-			0x01, 0x00, 0x94, 0xe0, 0x1d, 0x00, 0x34, 0x13, 0x00, 0x80, 0x52, 0xb4, 0x03, 0x5a, 0xf8, 0xa8, 0x03, 0x55, 0xb8,
-			0x7f, 0x02, 0x08, 0x6b, 0xe0, 0xe4, 0xff, 0x54, 0xbf, 0xff, 0x35, 0xa9, 0x88, 0x5a, 0x73, 0xf8, 0xa1, 0x83, 0x02,
-			0xd1, 0xa2, 0xa3, 0x02, 0xd1, 0x77, 0x01, 0x00, 0x94, 0x73, 0x06, 0x00, 0x11, 0xf7, 0xff, 0xff, 0x17, 0xa1, 0x83,
-			0x01, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x02, 0x01, 0x80, 0x52, 0x60, 0x01, 0x00, 0x94, 0xc0, 0x1b, 0x00, 0x34, 0xa1,
-			0xd3, 0x02, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x82, 0x00, 0x80, 0x52, 0x5b, 0x01, 0x00, 0x94, 0x20, 0x1b, 0x00, 0x34,
-			0xa1, 0x83, 0x02, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0x02, 0x01, 0x80, 0x52, 0x56, 0x01, 0x00, 0x94, 0x80, 0x1a, 0x00,
-			0x34, 0x13, 0x00, 0x80, 0x52, 0xb4, 0x03, 0x5a, 0xf8, 0xa8, 0xc3, 0x54, 0xb8, 0x7f, 0x02, 0x08, 0x6b, 0x80, 0xe1,
-			0xff, 0x54, 0xbf, 0x7f, 0x35, 0xa9, 0xa8, 0x03, 0x56, 0xf8, 0x89, 0x5a, 0x73, 0xb8, 0x08, 0x01, 0x09, 0x8b, 0xa1,
-			0xa3, 0x02, 0xd1, 0xa2, 0xc3, 0x02, 0xd1, 0x5a, 0x01, 0x00, 0x94, 0x73, 0x06, 0x00, 0x11, 0xf5, 0xff, 0xff, 0x17,
-			0x53, 0x01, 0x00, 0x94, 0x20, 0xe0, 0x07, 0x37, 0xc3, 0x00, 0x00, 0x14, 0x1a, 0x0f, 0x13, 0x8b, 0x88, 0xdf, 0x41,
-			0x29, 0x95, 0x03, 0x08, 0x8b, 0x88, 0x17, 0x40, 0xb9, 0x1f, 0x0d, 0x00, 0x71, 0xc0, 0x12, 0x00, 0x54, 0x1f, 0x09,
-			0x00, 0x71, 0xe0, 0x14, 0x00, 0x54, 0x1f, 0x05, 0x00, 0x71, 0x21, 0x02, 0x00, 0x54, 0x88, 0x0b, 0x40, 0xb9, 0x93,
-			0x03, 0x08, 0x8b, 0xf4, 0x03, 0x1a, 0xaa, 0xb7, 0x01, 0x00, 0xb4, 0x69, 0x02, 0x40, 0xb9, 0x28, 0x1d, 0x00, 0x72,
-			0xa0, 0x00, 0x00, 0x54, 0xa9, 0x26, 0x49, 0x8b, 0x34, 0x01, 0x00, 0x94, 0xe0, 0x43, 0xc1, 0xda, 0x02, 0x00, 0x00,
-			0x14, 0x00, 0x00, 0x80, 0xd2, 0x80, 0x86, 0x00, 0xf8, 0x73, 0x12, 0x00, 0x91, 0xf7, 0x06, 0x00, 0xd1, 0xb7, 0xfe,
-			0xff, 0xb5, 0x09, 0x00, 0x80, 0xd2, 0x88, 0x07, 0x40, 0xb9, 0x88, 0x03, 0x08, 0x8b, 0xa8, 0x03, 0x10, 0xf8, 0x0a,
-			0x45, 0x40, 0xb8, 0xaa, 0x03, 0x12, 0xf8, 0xa8, 0x03, 0x11, 0xf8, 0xa8, 0x03, 0x52, 0xf8, 0x3f, 0x01, 0x08, 0xeb,
-			0xc0, 0x0c, 0x00, 0x54, 0xa9, 0x83, 0x12, 0xf8, 0xa8, 0x03, 0x51, 0xf8, 0x08, 0x79, 0x69, 0xb8, 0xc8, 0x0b, 0x00,
-			0x34, 0x15, 0x00, 0x80, 0xd2, 0xa9, 0x03, 0x50, 0xf8, 0x3b, 0x01, 0x08, 0x8b, 0x68, 0x0f, 0x40, 0x79, 0x6a, 0x2b,
-			0x40, 0x79, 0x69, 0x5b, 0x00, 0x91, 0xa9, 0xab, 0x33, 0xa9, 0x09, 0x79, 0x1d, 0x12, 0xa9, 0x43, 0x13, 0xb8, 0x1f,
-			0x31, 0x00, 0x71, 0xe9, 0xff, 0x9f, 0x52, 0x0a, 0xe0, 0xbf, 0x12, 0x54, 0x01, 0x89, 0x9a, 0x1f, 0x05, 0x00, 0x71,
-			0xaa, 0x83, 0x50, 0xf8, 0x49, 0x01, 0x9f, 0x9a, 0x3c, 0x03, 0x09, 0xcb, 0x1f, 0x19, 0x00, 0x71, 0xe8, 0x03, 0x8a,
-			0x9a, 0x37, 0x03, 0x08, 0xcb, 0xa8, 0x03, 0x54, 0xf8, 0xbf, 0x02, 0x08, 0xeb, 0xe0, 0x08, 0x00, 0x54, 0xa8, 0x83,
-			0x53, 0xf8, 0x08, 0x79, 0x75, 0x78, 0xe9, 0xff, 0x9f, 0x52, 0x1f, 0x01, 0x09, 0xeb, 0x00, 0x08, 0x00, 0x54, 0x69,
-			0x07, 0x40, 0xf9, 0x29, 0x03, 0x09, 0x8b, 0x6a, 0x0b, 0x40, 0x79, 0xa9, 0x26, 0x0a, 0x9b, 0x38, 0x01, 0x08, 0x8b,
-			0xa8, 0x43, 0x53, 0xb8, 0x1f, 0x09, 0x00, 0x71, 0x41, 0x02, 0x00, 0x54, 0x08, 0x03, 0x40, 0xf9, 0xe8, 0x00, 0xf8,
-			0xb7, 0x09, 0xad, 0x6c, 0xd3, 0x29, 0x1d, 0x48, 0x92, 0x0a, 0x8d, 0x40, 0x92, 0xea, 0x02, 0x0a, 0x8b, 0x49, 0x01,
-			0x09, 0x8b, 0x05, 0x00, 0x00, 0x14, 0x09, 0x5d, 0x40, 0x92, 0x49, 0x7b, 0x69, 0xf8, 0x0a, 0xfd, 0x58, 0xd3, 0x29,
-			0x01, 0x2a, 0x8b, 0x09, 0x03, 0x00, 0xf9, 0x08, 0xf9, 0x73, 0xd3, 0x18, 0x0b, 0x08, 0x8b, 0x28, 0xfe, 0xff, 0xb5,
-			0x27, 0x00, 0x00, 0x14, 0x13, 0x03, 0x40, 0xf9, 0x70, 0xfe, 0x7e, 0xd3, 0x62, 0xbe, 0x60, 0xd3, 0x63, 0xc2, 0x70,
-			0xd3, 0x61, 0xca, 0x71, 0xd3, 0x1f, 0x0e, 0x00, 0xf1, 0x10, 0x92, 0x9f, 0x9a, 0x51, 0x0e, 0x00, 0x10, 0x1f, 0x20,
-			0x03, 0xd5, 0x30, 0x7a, 0xb0, 0xb8, 0x11, 0x00, 0x00, 0x10, 0x30, 0x02, 0x10, 0x8b, 0x00, 0x02, 0x1f, 0xd6, 0x68,
-			0xca, 0x73, 0xd3, 0x08, 0x1d, 0x48, 0x92, 0x69, 0xaa, 0x40, 0x92, 0x89, 0x03, 0x09, 0x8b, 0x20, 0x01, 0x08, 0x8b,
-			0x10, 0x00, 0x00, 0x14, 0x68, 0x02, 0x14, 0x8a, 0x48, 0x7b, 0x68, 0xf8, 0x69, 0xca, 0x60, 0xd3, 0x3f, 0x01, 0x41,
-			0xf1, 0xe9, 0xb3, 0x6d, 0xb2, 0xe9, 0x33, 0x89, 0x9a, 0x69, 0xca, 0x60, 0xb3, 0x00, 0x01, 0x09, 0x8b, 0x07, 0x00,
-			0x00, 0x14, 0x20, 0x43, 0x33, 0x8b, 0x03, 0x00, 0x00, 0x14, 0x68, 0x02, 0x14, 0x8a, 0x40, 0x7b, 0x68, 0xf8, 0xe4,
-			0x03, 0x18, 0xaa, 0xab, 0x00, 0x00, 0x94, 0x00, 0x03, 0x00, 0xf9, 0x68, 0xf6, 0x73, 0xd3, 0x18, 0x0f, 0x08, 0x8b,
-			0x68, 0xfb, 0xff, 0xb5, 0xb5, 0x06, 0x00, 0x91, 0xb8, 0xff, 0xff, 0x17, 0xa9, 0x83, 0x52, 0xf8, 0x29, 0x05, 0x00,
-			0x91, 0xbb, 0x83, 0x51, 0xf8, 0x99, 0xff, 0xff, 0x17, 0xa8, 0x23, 0x00, 0xd1, 0x1a, 0x01, 0x50, 0xf8, 0x48, 0x33,
-			0x40, 0xf9, 0xa1, 0x03, 0x5a, 0xf8, 0xa9, 0x43, 0x00, 0xd1, 0x20, 0x01, 0x50, 0xb8, 0x22, 0x00, 0xa0, 0x52, 0x00,
-			0x01, 0x3f, 0xd6, 0xa8, 0x33, 0x00, 0xd1, 0x19, 0x01, 0x50, 0xb8, 0x6c, 0xfe, 0xff, 0x17, 0xbf, 0x02, 0x00, 0x91,
-			0xa8, 0x23, 0x00, 0xd1, 0x1a, 0x01, 0x50, 0xf8, 0xa8, 0x33, 0x00, 0xd1, 0x19, 0x01, 0x50, 0xb8, 0xbb, 0x83, 0x51,
-			0xf8, 0x65, 0xfe, 0xff, 0x17, 0xe8, 0x03, 0x1c, 0xaa, 0x09, 0x8d, 0x40, 0xb8, 0x13, 0x01, 0x09, 0x8b, 0xf4, 0x03,
-			0x1a, 0xaa, 0x77, 0xef, 0xff, 0xb4, 0x69, 0x82, 0x5f, 0xf8, 0x28, 0x3d, 0x00, 0x72, 0xa0, 0x00, 0x00, 0x54, 0xa9,
-			0x82, 0x49, 0x8b, 0xa2, 0x00, 0x00, 0x94, 0xe0, 0x43, 0xc1, 0xda, 0x02, 0x00, 0x00, 0x14, 0x00, 0x00, 0x80, 0xd2,
-			0x68, 0x06, 0x41, 0xf8, 0x08, 0x00, 0x08, 0x8b, 0x88, 0x86, 0x00, 0xf8, 0xf7, 0x06, 0x00, 0xd1, 0x97, 0xfe, 0xff,
-			0xb5, 0x6d, 0xff, 0xff, 0x17, 0x88, 0x0b, 0x40, 0xb9, 0x88, 0x03, 0x08, 0x8b, 0x13, 0x11, 0x00, 0x91, 0xf4, 0x03,
-			0x1a, 0xaa, 0x17, 0xed, 0xff, 0xb4, 0x69, 0xc2, 0x5f, 0xb8, 0x28, 0x1d, 0x00, 0x72, 0xa0, 0x00, 0x00, 0x54, 0xa9,
-			0x26, 0x49, 0x8b, 0x8f, 0x00, 0x00, 0x94, 0xe0, 0x43, 0xc1, 0xda, 0x02, 0x00, 0x00, 0x14, 0x00, 0x00, 0x80, 0xd2,
-			0x68, 0x86, 0x80, 0xb8, 0x08, 0x00, 0x08, 0x8b, 0x88, 0x86, 0x00, 0xf8, 0xf7, 0x06, 0x00, 0xd1, 0x97, 0xfe, 0xff,
-			0xb5, 0x5a, 0xff, 0xff, 0x17, 0xbf, 0x02, 0x00, 0x91, 0x99, 0x00, 0x00, 0x94, 0x48, 0x43, 0x40, 0xf9, 0xe0, 0x03,
-			0x19, 0xaa, 0x00, 0x01, 0x3f, 0xd6, 0xa0, 0xc3, 0x99, 0xb8, 0xbf, 0x43, 0x01, 0xd1, 0xfd, 0x7b, 0x45, 0xa9, 0xf4,
-			0x4f, 0x44, 0xa9, 0xf6, 0x57, 0x43, 0xa9, 0xf8, 0x5f, 0x42, 0xa9, 0xfa, 0x67, 0x41, 0xa9, 0xfc, 0x6f, 0xc6, 0xa8,
-			0xc0, 0x03, 0x5f, 0xd6, 0x0c, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0xb4, 0x01, 0x00, 0x00, 0x9c, 0x02, 0x00,
-			0x00, 0xf4, 0x02, 0x00, 0x00, 0x4c, 0x03, 0x00, 0x00, 0xc0, 0x03, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x24, 0x00,
-			0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0xf8, 0x5f, 0xbc, 0xa9, 0xf6, 0x57, 0x01, 0xa9, 0xf4,
-			0x4f, 0x02, 0xa9, 0xfd, 0x7b, 0x03, 0xa9, 0xfd, 0xc3, 0x00, 0x91, 0xf3, 0x03, 0x04, 0xaa, 0xf4, 0x03, 0x03, 0xaa,
-			0xf5, 0x03, 0x02, 0xaa, 0xf6, 0x03, 0x01, 0xaa, 0xf7, 0x03, 0x00, 0xaa, 0x43, 0x00, 0x00, 0xb4, 0x9f, 0x02, 0x00,
-			0xf9, 0xbf, 0x02, 0x00, 0xf1, 0xf8, 0x17, 0x9f, 0x1a, 0xd5, 0x03, 0x00, 0xb4, 0x68, 0x1a, 0x40, 0xf9, 0xe0, 0x03,
-			0x17, 0xaa, 0xe1, 0x03, 0x16, 0xaa, 0xe2, 0x03, 0x15, 0xaa, 0x00, 0x01, 0x3f, 0xd6, 0x1f, 0x04, 0x00, 0xb1, 0xe1,
-			0x00, 0x00, 0x54, 0x68, 0x46, 0x40, 0xf9, 0x00, 0x01, 0x3f, 0xd6, 0x08, 0x00, 0x40, 0xb9, 0x1f, 0x11, 0x00, 0x71,
-			0xa0, 0xfe, 0xff, 0x54, 0x0a, 0x00, 0x00, 0x14, 0x1f, 0x04, 0x00, 0xf1, 0x2b, 0x01, 0x00, 0x54, 0x94, 0x00, 0x00,
-			0xb4, 0x88, 0x02, 0x40, 0xf9, 0x08, 0x01, 0x00, 0x8b, 0x88, 0x02, 0x00, 0xf9, 0xd6, 0x02, 0x00, 0x8b, 0xb5, 0x02,
-			0x00, 0xcb, 0xe8, 0xff, 0xff, 0x17, 0x18, 0x00, 0x80, 0x52, 0xe0, 0x03, 0x18, 0xaa, 0xfd, 0x7b, 0x43, 0xa9, 0xf4,
-			0x4f, 0x42, 0xa9, 0xf6, 0x57, 0x41, 0xa9, 0xf8, 0x5f, 0xc4, 0xa8, 0xc0, 0x03, 0x5f, 0xd6, 0x38, 0x00, 0x80, 0x52,
-			0xf9, 0xff, 0xff, 0x17, 0xf6, 0x57, 0xbd, 0xa9, 0xf4, 0x4f, 0x01, 0xa9, 0xfd, 0x7b, 0x02, 0xa9, 0xfd, 0x83, 0x00,
-			0x91, 0xf3, 0x03, 0x02, 0xaa, 0xf4, 0x03, 0x01, 0xaa, 0xf5, 0x03, 0x00, 0xaa, 0x88, 0x00, 0x80, 0x52, 0xf6, 0x03,
-			0x08, 0xaa, 0x48, 0x02, 0x00, 0xb4, 0x68, 0x1e, 0x40, 0xf9, 0xe0, 0x03, 0x15, 0xaa, 0xe1, 0x03, 0x14, 0xaa, 0xe2,
-			0x03, 0x16, 0xaa, 0x00, 0x01, 0x3f, 0xd6, 0x1f, 0x04, 0x00, 0xb1, 0xe1, 0x00, 0x00, 0x54, 0x68, 0x46, 0x40, 0xf9,
-			0x00, 0x01, 0x3f, 0xd6, 0x08, 0x00, 0x40, 0xb9, 0x1f, 0x11, 0x00, 0x71, 0xa0, 0xfe, 0xff, 0x54, 0x05, 0x00, 0x00,
-			0x14, 0x94, 0x02, 0x00, 0x8b, 0xc8, 0x02, 0x00, 0xcb, 0x1f, 0x00, 0x00, 0xf1, 0xcc, 0xfd, 0xff, 0x54, 0xdf, 0x02,
-			0x00, 0xf1, 0xe0, 0x17, 0x9f, 0x1a, 0xfd, 0x7b, 0x42, 0xa9, 0xf4, 0x4f, 0x41, 0xa9, 0xf6, 0x57, 0xc3, 0xa8, 0xc0,
-			0x03, 0x5f, 0xd6, 0x44, 0x3c, 0x50, 0xb3, 0x7f, 0x00, 0x00, 0x71, 0x48, 0x00, 0x84, 0x9a, 0x3f, 0x0c, 0x00, 0x71,
-			0x28, 0x02, 0x00, 0x54, 0xf0, 0x03, 0x01, 0x2a, 0x1f, 0x0e, 0x00, 0xf1, 0x10, 0x92, 0x9f, 0x9a, 0xd1, 0x01, 0x00,
-			0x10, 0x1f, 0x20, 0x03, 0xd5, 0x30, 0x7a, 0xb0, 0xb8, 0x11, 0x00, 0x00, 0x10, 0x30, 0x02, 0x10, 0x8b, 0x00, 0x02,
-			0x1f, 0xd6, 0x00, 0x01, 0xc1, 0xda, 0xc0, 0x03, 0x5f, 0xd6, 0x00, 0x05, 0xc1, 0xda, 0xc0, 0x03, 0x5f, 0xd6, 0x00,
-			0x09, 0xc1, 0xda, 0xc0, 0x03, 0x5f, 0xd6, 0x00, 0x0d, 0xc1, 0xda, 0xc0, 0x03, 0x5f, 0xd6, 0x0c, 0x00, 0x00, 0x00,
-			0x14, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x03, 0x00, 0x80, 0xd2, 0xe4, 0x03, 0x1a,
-			0xaa, 0x95, 0xff, 0xff, 0x17, 0xea, 0x03, 0x09, 0xaa, 0x4b, 0x15, 0x40, 0x38, 0x7f, 0x7d, 0x01, 0x71, 0x21, 0x11,
-			0x8a, 0x9a, 0xa9, 0x23, 0x00, 0xd1, 0x29, 0x01, 0x50, 0xf8, 0x29, 0x39, 0x40, 0xf9, 0x08, 0x05, 0x00, 0x51, 0x00,
-			0x5b, 0x68, 0xf8, 0x20, 0x01, 0x1f, 0xd6, 0xa1, 0x03, 0x02, 0xd1, 0xe0, 0x03, 0x16, 0xaa, 0xe2, 0x03, 0x1a, 0xaa,
-			0xb5, 0xff, 0xff, 0x17, 0xa4, 0x93, 0x01, 0xd1, 0x00, 0x00, 0x80, 0x52, 0xe3, 0x03, 0x1b, 0xaa, 0x00, 0x01, 0x1f,
-			0xd6, 0xa0, 0x03, 0x5a, 0xf8, 0xa1, 0x03, 0x56, 0xf8, 0x00, 0x01, 0x1f, 0xd6, 0x48, 0x43, 0x40, 0xf9, 0xe0, 0x03,
-			0x16, 0xaa, 0x00, 0x01, 0x1f, 0xd6
+			0xa9, 0xfd, 0x7b, 0x05, 0xa9, 0xfd, 0x43, 0x01, 0x91, 0xff, 0x43, 0x03, 0xd1, 0xfb, 0x03, 0x04, 0xaa, 0xf6, 0x03,
+			0x03, 0xaa, 0xf8, 0x03, 0x02, 0xaa, 0xf9, 0x03, 0x01, 0xaa, 0xf5, 0x03, 0x00, 0xaa, 0xbf, 0xc3, 0x19, 0xb8, 0x88,
+			0x95, 0x98, 0x52, 0x48, 0x89, 0xb5, 0x72, 0xa8, 0x43, 0x18, 0xb8, 0x88, 0x34, 0x40, 0xf9, 0x00, 0x01, 0x3f, 0xd6,
+			0xfa, 0x03, 0x00, 0xaa, 0x13, 0x02, 0x80, 0x52, 0xb3, 0x83, 0x18, 0xb8, 0x68, 0x17, 0x40, 0xf9, 0xa1, 0xd3, 0x01,
+			0xd1, 0xa2, 0xe3, 0x01, 0xd1, 0xe0, 0x03, 0x15, 0xaa, 0x00, 0x01, 0x3f, 0xd6, 0x1f, 0x04, 0x00, 0x31, 0xe1, 0x00,
+			0x00, 0x54, 0x68, 0x4f, 0x40, 0xf9, 0x00, 0x01, 0x3f, 0xd6, 0x08, 0x00, 0x40, 0xb9, 0x1f, 0x11, 0x00, 0x71, 0xa0,
+			0xfe, 0xff, 0x54, 0xf1, 0x01, 0x00, 0x14, 0xf7, 0x03, 0x00, 0xaa, 0xa1, 0x43, 0x02, 0xd1, 0x02, 0x02, 0x80, 0x52,
+			0x7f, 0x02, 0x00, 0x94, 0xa8, 0x27, 0x77, 0xa9, 0x1f, 0x00, 0x00, 0x71, 0x00, 0x11, 0x59, 0xfa, 0x20, 0x01, 0x58,
+			0xfa, 0x60, 0x00, 0x00, 0x54, 0x8a, 0x02, 0x00, 0x94, 0xe8, 0xff, 0xff, 0x17, 0x80, 0x02, 0x00, 0x94, 0x60, 0x3c,
+			0x00, 0x34, 0x38, 0x00, 0x80, 0x52, 0xbb, 0x83, 0x11, 0xf8, 0xa8, 0x13, 0x00, 0xd1, 0x15, 0x01, 0x10, 0xb8, 0xa8,
+			0x43, 0x00, 0xd1, 0x16, 0x01, 0x10, 0xf8, 0xa8, 0x53, 0x00, 0xd1, 0x1a, 0x01, 0x10, 0xb8, 0xa1, 0x47, 0x02, 0xd1,
+			0xe0, 0x03, 0x17, 0xaa, 0x22, 0x00, 0x80, 0x52, 0x6a, 0x02, 0x00, 0x94, 0xc0, 0x3a, 0x00, 0x34, 0xa8, 0xf3, 0x56,
+			0x38, 0x10, 0x05, 0x00, 0x51, 0x1f, 0x1a, 0x00, 0x71, 0x48, 0x3a, 0x00, 0x54, 0x1f, 0x1a, 0x00, 0xf1, 0x10, 0x92,
+			0x9f, 0x9a, 0x11, 0x00, 0x00, 0x90, 0x31, 0x52, 0x22, 0x91, 0x30, 0x7a, 0xb0, 0xb8, 0x11, 0x00, 0x00, 0x10, 0x30,
+			0x02, 0x10, 0x8b, 0x00, 0x02, 0x1f, 0xd6, 0xa1, 0x83, 0x01, 0xd1, 0x56, 0x02, 0x00, 0x94, 0xe0, 0x38, 0x00, 0x34,
+			0xa1, 0xe3, 0x02, 0xd1, 0xe0, 0x03, 0x17, 0xaa, 0x82, 0x00, 0x80, 0x52, 0x56, 0x02, 0x00, 0x94, 0x40, 0x38, 0x00,
+			0x34, 0xbf, 0x03, 0x16, 0xf8, 0x68, 0x43, 0x40, 0xf9, 0xa2, 0x83, 0x54, 0xb8, 0xa6, 0x03, 0x5a, 0xf8, 0xff, 0x83,
+			0x00, 0xd1, 0x49, 0x00, 0x80, 0x52, 0xe9, 0x13, 0x00, 0xb9, 0xa1, 0x83, 0x02, 0xd1, 0xa9, 0xa3, 0x02, 0xd1, 0xe9,
+			0x07, 0x00, 0xf9, 0xa9, 0x93, 0x02, 0xd1, 0xe9, 0x03, 0x00, 0xf9, 0xe0, 0x03, 0x1a, 0xaa, 0x03, 0x00, 0x80, 0xd2,
+			0x24, 0x00, 0x80, 0x52, 0xe5, 0x03, 0x1a, 0xaa, 0x07, 0x00, 0x80, 0x52, 0x00, 0x01, 0x3f, 0xd6, 0xff, 0x83, 0x00,
+			0x91, 0xc0, 0x35, 0x00, 0x35, 0x68, 0x2b, 0x40, 0xf9, 0xa0, 0x03, 0x56, 0xf8, 0xa1, 0x83, 0x54, 0xb8, 0x62, 0x00,
+			0x80, 0x52, 0x00, 0x01, 0x3f, 0xd6, 0x60, 0x2e, 0x00, 0x35, 0xa1, 0x03, 0x56, 0xf8, 0xa2, 0x83, 0x54, 0xb8, 0xa3,
+			0xc3, 0x02, 0xd1, 0xe0, 0x03, 0x17, 0xaa, 0xe4, 0x03, 0x1b, 0xaa, 0xc0, 0x01, 0x00, 0x94, 0x80, 0x2d, 0x00, 0x34,
+			0x68, 0x2f, 0x40, 0xf9, 0x46, 0x02, 0x00, 0x94, 0x68, 0x33, 0x40, 0xf9, 0x44, 0x02, 0x00, 0x94, 0x33, 0x00, 0x80,
+			0x52, 0x67, 0x01, 0x00, 0x14, 0xa1, 0x83, 0x01, 0xd1, 0x27, 0x02, 0x00, 0x94, 0x00, 0x33, 0x00, 0x34, 0xa1, 0xe3,
+			0x02, 0xd1, 0xe0, 0x03, 0x17, 0xaa, 0x82, 0x00, 0x80, 0x52, 0x27, 0x02, 0x00, 0x94, 0x60, 0x32, 0x00, 0x34, 0x13,
+			0x00, 0x80, 0x52, 0xb4, 0x03, 0x5a, 0xf8, 0xa8, 0x83, 0x54, 0xb8, 0x7f, 0x02, 0x08, 0x6b, 0x80, 0xf6, 0xff, 0x54,
+			0xbf, 0x03, 0x16, 0xf8, 0xbf, 0x03, 0x15, 0xf8, 0x88, 0x5a, 0x73, 0xf8, 0xa1, 0x83, 0x02, 0xd1, 0xa2, 0xc3, 0x02,
+			0xd1, 0x28, 0x02, 0x00, 0x94, 0x73, 0x06, 0x00, 0x11, 0xf6, 0xff, 0xff, 0x17, 0xa1, 0x83, 0x02, 0xd1, 0x12, 0x02,
+			0x00, 0x94, 0x60, 0x30, 0x00, 0x34, 0xa1, 0xc3, 0x02, 0xd1, 0x0f, 0x02, 0x00, 0x94, 0x00, 0x30, 0x00, 0x34, 0xa1,
+			0xe3, 0x02, 0xd1, 0x0c, 0x02, 0x00, 0x94, 0xa0, 0x2f, 0x00, 0x34, 0xbc, 0x03, 0x56, 0xf8, 0xa8, 0xeb, 0x74, 0xa9,
+			0xa8, 0x83, 0x10, 0xf8, 0x68, 0x37, 0x40, 0xf9, 0x00, 0x01, 0x3f, 0xd6, 0xbf, 0x03, 0x1a, 0xf8, 0x68, 0x3b, 0x40,
+			0xf9, 0xa1, 0x83, 0x01, 0xd1, 0xa9, 0x63, 0x00, 0xd1, 0x20, 0x01, 0x10, 0xb8, 0x22, 0x00, 0xa0, 0x52, 0x23, 0x00,
+			0x80, 0x52, 0x00, 0x01, 0x3f, 0xd6, 0x13, 0x00, 0x80, 0x52, 0x15, 0x00, 0x80, 0xd2, 0xb4, 0x03, 0x5a, 0xf8, 0x56,
+			0x83, 0x00, 0x91, 0x48, 0x13, 0x40, 0xb9, 0x7f, 0x02, 0x08, 0x6b, 0xe0, 0x12, 0x00, 0x54, 0xc8, 0x02, 0x40, 0xb9,
+			0x09, 0xfd, 0x9f, 0x52, 0xe9, 0xff, 0xaf, 0x72, 0x09, 0x01, 0x09, 0x0b, 0x3f, 0x2d, 0x00, 0x71, 0x09, 0x23, 0xc9,
+			0x1a, 0x2a, 0x10, 0x81, 0x52, 0x29, 0x01, 0x0a, 0x0a, 0x24, 0x99, 0x40, 0x7a, 0x04, 0x09, 0x4c, 0x7a, 0x01, 0x01,
+			0x00, 0x54, 0xc8, 0x0a, 0x40, 0xb9, 0x69, 0x47, 0x40, 0xf9, 0xc0, 0x02, 0x08, 0x8b, 0x21, 0x01, 0x80, 0x52, 0x20,
+			0x01, 0x3f, 0xd6, 0x80, 0x7a, 0x35, 0xf8, 0xb5, 0x06, 0x00, 0x91, 0xc8, 0x06, 0x40, 0xb9, 0xd6, 0x02, 0x08, 0x8b,
+			0x73, 0x06, 0x00, 0x11, 0xe8, 0xff, 0xff, 0x17, 0xa1, 0x83, 0x01, 0xd1, 0xdf, 0x01, 0x00, 0x94, 0x00, 0x2a, 0x00,
+			0x34, 0xa1, 0x83, 0x02, 0xd1, 0xe0, 0x03, 0x17, 0xaa, 0x82, 0x00, 0x80, 0x52, 0xdf, 0x01, 0x00, 0x94, 0x60, 0x29,
+			0x00, 0x34, 0xa1, 0xc3, 0x02, 0xd1, 0xe0, 0x03, 0x17, 0xaa, 0x82, 0x00, 0x80, 0x52, 0xda, 0x01, 0x00, 0x94, 0xc0,
+			0x28, 0x00, 0x36, 0x68, 0x2b, 0x40, 0xf9, 0xa0, 0x03, 0x5a, 0xf8, 0xa1, 0x03, 0x56, 0xb8, 0xa2, 0x03, 0x55, 0xb8,
+			0x00, 0x01, 0x3f, 0xd6, 0xc0, 0xec, 0xff, 0x34, 0x3f, 0x01, 0x00, 0x14, 0xa1, 0x83, 0x01, 0xd1, 0xcb, 0x01, 0x00,
+			0x94, 0x80, 0x27, 0x00, 0x34, 0xa1, 0x83, 0x02, 0xd1, 0xc8, 0x01, 0x00, 0x94, 0x20, 0x27, 0x00, 0x34, 0xa1, 0xc3,
+			0x02, 0xd1, 0xe0, 0x03, 0x17, 0xaa, 0x42, 0x00, 0x80, 0x52, 0xc8, 0x01, 0x00, 0x94, 0x80, 0x26, 0x00, 0x34, 0xf4,
+			0x03, 0x00, 0x91, 0xa8, 0x03, 0x55, 0x78, 0x08, 0x71, 0x1d, 0x53, 0x08, 0x3d, 0x00, 0x11, 0x08, 0x3d, 0x7c, 0x92,
+			0xe9, 0x03, 0x00, 0x91, 0x38, 0x01, 0x08, 0xcb, 0x1f, 0x03, 0x00, 0x91, 0xa8, 0x03, 0x55, 0x78, 0x02, 0xf1, 0x7d,
+			0xd3, 0xe0, 0x03, 0x17, 0xaa, 0xe1, 0x03, 0x18, 0xaa, 0xba, 0x01, 0x00, 0x94, 0xa0, 0x24, 0x00, 0x34, 0xa1, 0xe3,
+			0x02, 0xd1, 0xe0, 0x03, 0x17, 0xaa, 0x42, 0x00, 0x80, 0x52, 0xb5, 0x01, 0x00, 0x94, 0x00, 0x24, 0x00, 0x34, 0xa8,
+			0x83, 0x54, 0x78, 0x09, 0x71, 0x1d, 0x53, 0x29, 0x3d, 0x00, 0x11, 0x29, 0x3d, 0x7c, 0x92, 0xea, 0x03, 0x00, 0x91,
+			0x59, 0x01, 0x09, 0xcb, 0x3f, 0x03, 0x00, 0x91, 0x02, 0x7d, 0x7d, 0xd3, 0xe0, 0x03, 0x17, 0xaa, 0xe1, 0x03, 0x19,
+			0xaa, 0xa9, 0x01, 0x00, 0x94, 0x80, 0x22, 0x00, 0x34, 0x15, 0x00, 0x80, 0xd2, 0xb6, 0x03, 0x5a, 0xf8, 0xbb, 0x03,
+			0x56, 0xf8, 0xbc, 0x83, 0x54, 0x78, 0xbf, 0x02, 0x1c, 0xeb, 0x00, 0x1a, 0x00, 0x54, 0x3a, 0x7b, 0x75, 0xf8, 0x53,
+			0x03, 0x40, 0xf9, 0xf3, 0x01, 0xf0, 0xb7, 0x68, 0xfe, 0x6b, 0xd3, 0x69, 0xaa, 0x40, 0x92, 0x6a, 0xaa, 0x6a, 0x93,
+			0x4a, 0x31, 0x55, 0x92, 0x09, 0x1d, 0x48, 0xb3, 0x28, 0x01, 0x0a, 0xaa, 0xe9, 0x03, 0x13, 0x2a, 0x7f, 0x02, 0x41,
+			0xf2, 0xea, 0x03, 0x96, 0x9a, 0x08, 0x01, 0x89, 0x9a, 0x49, 0x01, 0x1b, 0x8b, 0x20, 0x01, 0x08, 0x8b, 0x53, 0x01,
+			0xf8, 0xb6, 0x04, 0x00, 0x00, 0x14, 0x68, 0x3e, 0x40, 0x92, 0x00, 0x7b, 0x68, 0xf8, 0xd3, 0x00, 0xf8, 0xb6, 0x61,
+			0xca, 0x71, 0xd3, 0x63, 0xc2, 0x70, 0xd3, 0x62, 0xbe, 0x60, 0xd3, 0xe4, 0x03, 0x1a, 0xaa, 0x63, 0x01, 0x00, 0x94,
+			0x40, 0x03, 0x00, 0xf9, 0x68, 0xf6, 0x73, 0xd3, 0x5a, 0x0f, 0x08, 0x8b, 0x7f, 0x2a, 0x4d, 0xf2, 0x81, 0xfc, 0xff,
+			0x54, 0xb5, 0x06, 0x00, 0x91, 0xdf, 0xff, 0xff, 0x17, 0xa1, 0x83, 0x01, 0xd1, 0x7b, 0x01, 0x00, 0x94, 0x80, 0x1d,
+			0x00, 0x34, 0xa1, 0x93, 0x02, 0xd1, 0xe0, 0x03, 0x17, 0xaa, 0x82, 0x00, 0x80, 0x52, 0x7b, 0x01, 0x00, 0x94, 0xe0,
+			0x1c, 0x00, 0x34, 0xa1, 0x83, 0x02, 0xd1, 0x73, 0x01, 0x00, 0x94, 0x80, 0x1c, 0x00, 0x34, 0x13, 0x00, 0x80, 0x52,
+			0xb4, 0x03, 0x5a, 0xf8, 0xa8, 0xc3, 0x55, 0xb8, 0x7f, 0x02, 0x08, 0x6b, 0xa0, 0xe0, 0xff, 0x54, 0xbf, 0xff, 0x34,
+			0xa9, 0xa8, 0x03, 0x56, 0xf8, 0x89, 0x5a, 0x73, 0xb8, 0x08, 0x01, 0x09, 0x8b, 0xa1, 0xc3, 0x02, 0xd1, 0xa2, 0xe3,
+			0x02, 0xd1, 0x78, 0x01, 0x00, 0x94, 0x73, 0x06, 0x00, 0x11, 0xf5, 0xff, 0xff, 0x17, 0x71, 0x01, 0x00, 0x94, 0x40,
+			0xdf, 0x07, 0x37, 0xd3, 0x00, 0x00, 0x14, 0x98, 0x0e, 0x15, 0x8b, 0x88, 0xe7, 0x41, 0x29, 0x96, 0x03, 0x08, 0x8b,
+			0x88, 0x17, 0x40, 0xb9, 0x1f, 0x0d, 0x00, 0x71, 0xc0, 0x16, 0x00, 0x54, 0x1f, 0x09, 0x00, 0x71, 0xc0, 0x13, 0x00,
+			0x54, 0x1f, 0x05, 0x00, 0x71, 0x81, 0x02, 0x00, 0x54, 0x88, 0x0b, 0x40, 0xb9, 0x93, 0x03, 0x08, 0x8b, 0x94, 0x22,
+			0x00, 0xd1, 0xf5, 0x03, 0x18, 0xaa, 0xf9, 0x01, 0x00, 0xb4, 0x69, 0x02, 0x40, 0xb9, 0x28, 0x1d, 0x40, 0x92, 0xe8,
+			0x00, 0x00, 0x34, 0xc9, 0x26, 0x49, 0x8b, 0x55, 0x01, 0x00, 0x94, 0x80, 0x7a, 0x68, 0xf8, 0x20, 0x01, 0x3f, 0xd6,
+			0xe0, 0x43, 0xc1, 0xda, 0x02, 0x00, 0x00, 0x14, 0x00, 0x00, 0x80, 0xd2, 0xa0, 0x86, 0x00, 0xf8, 0x73, 0x12, 0x00,
+			0x91, 0x39, 0x07, 0x00, 0xd1, 0x79, 0xfe, 0xff, 0xb5, 0x09, 0x00, 0x80, 0xd2, 0x88, 0x07, 0x40, 0xb9, 0x88, 0x03,
+			0x08, 0x8b, 0xa8, 0x03, 0x10, 0xf8, 0x0a, 0x45, 0x40, 0xb8, 0xaa, 0x03, 0x12, 0xf8, 0xa8, 0x03, 0x11, 0xf8, 0xa8,
+			0x03, 0x52, 0xf8, 0x3f, 0x01, 0x08, 0xeb, 0xc0, 0x0c, 0x00, 0x54, 0xa9, 0x83, 0x12, 0xf8, 0xa8, 0x03, 0x51, 0xf8,
+			0x08, 0x79, 0x69, 0xb8, 0xc8, 0x0b, 0x00, 0x34, 0x1c, 0x00, 0x80, 0xd2, 0xa9, 0x03, 0x50, 0xf8, 0x35, 0x01, 0x08,
+			0x8b, 0xa8, 0x0e, 0x40, 0x79, 0xa9, 0x2a, 0x40, 0x79, 0xa9, 0x03, 0x14, 0xf8, 0xa9, 0x5a, 0x00, 0x91, 0xa9, 0x83,
+			0x13, 0xf8, 0x09, 0x79, 0x1d, 0x12, 0xa9, 0x43, 0x13, 0xb8, 0x1f, 0x31, 0x00, 0x71, 0xe9, 0xff, 0x9f, 0x52, 0x0a,
+			0xe0, 0xbf, 0x12, 0x54, 0x01, 0x89, 0x9a, 0x1f, 0x05, 0x00, 0x71, 0xaa, 0x83, 0x50, 0xf8, 0x49, 0x01, 0x9f, 0x9a,
+			0x56, 0x03, 0x09, 0xcb, 0x1f, 0x19, 0x00, 0x71, 0xe8, 0x03, 0x8a, 0x9a, 0x5b, 0x03, 0x08, 0xcb, 0xa8, 0x03, 0x54,
+			0xf8, 0x9f, 0x03, 0x08, 0xeb, 0xc0, 0x08, 0x00, 0x54, 0xa8, 0x83, 0x53, 0xf8, 0x08, 0x79, 0x7c, 0x78, 0xe9, 0xff,
+			0x9f, 0x52, 0x1f, 0x01, 0x09, 0xeb, 0xe0, 0x07, 0x00, 0x54, 0xa9, 0x06, 0x40, 0xf9, 0x49, 0x03, 0x09, 0x8b, 0xaa,
+			0x0a, 0x40, 0x79, 0x89, 0x27, 0x0a, 0x9b, 0x39, 0x01, 0x08, 0x8b, 0xa8, 0x43, 0x53, 0xb8, 0x1f, 0x09, 0x00, 0x71,
+			0x41, 0x02, 0x00, 0x54, 0x29, 0x03, 0x40, 0xf9, 0xe9, 0x00, 0xf8, 0xb7, 0x28, 0xfd, 0x73, 0xd3, 0x2a, 0xfd, 0x64,
+			0xd3, 0x29, 0x8d, 0x40, 0x92, 0x69, 0x03, 0x09, 0x8b, 0x29, 0xe1, 0x0a, 0x8b, 0x06, 0x00, 0x00, 0x14, 0x28, 0xf9,
+			0x73, 0xd3, 0x2a, 0x5d, 0x40, 0x92, 0x0a, 0x7b, 0x6a, 0xf8, 0x29, 0xfd, 0x58, 0xd3, 0x49, 0x01, 0x29, 0x8b, 0x29,
+			0x03, 0x00, 0xf9, 0x39, 0x0b, 0x08, 0x8b, 0x28, 0xfe, 0xff, 0xb5, 0x26, 0x00, 0x00, 0x14, 0x33, 0x03, 0x40, 0xf9,
+			0x70, 0xfe, 0x7e, 0xd3, 0x62, 0xbe, 0x60, 0xd3, 0x63, 0xc2, 0x70, 0xd3, 0x61, 0xca, 0x71, 0xd3, 0x1f, 0x0e, 0x00,
+			0xf1, 0x10, 0x92, 0x9f, 0x9a, 0x11, 0x00, 0x00, 0x90, 0x31, 0xc2, 0x22, 0x91, 0x30, 0x7a, 0xb0, 0xb8, 0x11, 0x00,
+			0x00, 0x10, 0x30, 0x02, 0x10, 0x8b, 0x00, 0x02, 0x1f, 0xd6, 0x68, 0xfe, 0x6b, 0xd3, 0x69, 0xaa, 0x40, 0x92, 0xc9,
+			0x02, 0x09, 0x8b, 0x20, 0xe1, 0x08, 0x8b, 0x10, 0x00, 0x00, 0x14, 0x40, 0x43, 0x33, 0x8b, 0x03, 0x00, 0x00, 0x14,
+			0x68, 0x02, 0x14, 0x8a, 0x00, 0x7b, 0x68, 0xf8, 0xe4, 0x03, 0x19, 0xaa, 0xc7, 0x00, 0x00, 0x94, 0x09, 0x00, 0x00,
+			0x14, 0x68, 0x02, 0x14, 0x8a, 0x08, 0x7b, 0x68, 0xf8, 0x89, 0x00, 0xa0, 0x52, 0x3f, 0x81, 0x53, 0xea, 0xe9, 0xb3,
+			0x6d, 0xb2, 0xe9, 0x03, 0x89, 0x9a, 0x69, 0xca, 0x60, 0xb3, 0x00, 0x01, 0x09, 0x8b, 0x20, 0x03, 0x00, 0xf9, 0x68,
+			0xf6, 0x73, 0xd3, 0x39, 0x0f, 0x08, 0x8b, 0x88, 0xfb, 0xff, 0xb5, 0x9c, 0x07, 0x00, 0x91, 0xb9, 0xff, 0xff, 0x17,
+			0xa9, 0x83, 0x52, 0xf8, 0x29, 0x05, 0x00, 0x91, 0xbb, 0x83, 0x51, 0xf8, 0x99, 0xff, 0xff, 0x17, 0x68, 0x3f, 0x40,
+			0xf9, 0xa1, 0x03, 0x5a, 0xf8, 0xa9, 0x63, 0x00, 0xd1, 0x20, 0x01, 0x50, 0xb8, 0x22, 0x00, 0xa0, 0x52, 0x00, 0x01,
+			0x3f, 0xd6, 0x03, 0x00, 0x00, 0x14, 0x9f, 0x02, 0x00, 0x91, 0xbb, 0x83, 0x51, 0xf8, 0xa8, 0x13, 0x00, 0xd1, 0x15,
+			0x01, 0x50, 0xb8, 0xa8, 0x43, 0x00, 0xd1, 0x16, 0x01, 0x50, 0xf8, 0xa8, 0x53, 0x00, 0xd1, 0x1a, 0x01, 0x50, 0xb8,
+			0x38, 0x00, 0x80, 0x52, 0x5c, 0xfe, 0xff, 0x17, 0x13, 0x00, 0x80, 0x52, 0x68, 0x3f, 0x40, 0xf9, 0xa1, 0x03, 0x56,
+			0xf8, 0xa2, 0x83, 0x54, 0xb8, 0xe0, 0x03, 0x1a, 0xaa, 0x00, 0x01, 0x3f, 0xd6, 0xb3, 0xca, 0x07, 0x37, 0x2e, 0x00,
+			0x00, 0x14, 0x88, 0x0b, 0x40, 0xb9, 0x93, 0x22, 0x00, 0xd1, 0x88, 0x03, 0x08, 0x8b, 0x14, 0x11, 0x00, 0x91, 0xf5,
+			0x03, 0x18, 0xaa, 0x79, 0xee, 0xff, 0xb4, 0x89, 0xc2, 0x5f, 0xb8, 0x28, 0x1d, 0x40, 0x92, 0xe8, 0x00, 0x00, 0x34,
+			0xc9, 0x26, 0x49, 0x8b, 0xb9, 0x00, 0x00, 0x94, 0x60, 0x7a, 0x68, 0xf8, 0x20, 0x01, 0x3f, 0xd6, 0xe0, 0x43, 0xc1,
+			0xda, 0x02, 0x00, 0x00, 0x14, 0x00, 0x00, 0x80, 0xd2, 0x88, 0x86, 0x80, 0xb8, 0x08, 0x00, 0x08, 0x8b, 0xa8, 0x86,
+			0x00, 0xf8, 0x39, 0x07, 0x00, 0xd1, 0x59, 0xfe, 0xff, 0xb5, 0x63, 0xff, 0xff, 0x17, 0xe8, 0x03, 0x1c, 0xaa, 0x09,
+			0x8d, 0x40, 0xb8, 0x93, 0x22, 0x00, 0xd1, 0x14, 0x01, 0x09, 0x8b, 0xf5, 0x03, 0x18, 0xaa, 0xb9, 0xeb, 0xff, 0xb4,
+			0x89, 0x82, 0x5f, 0xf8, 0x28, 0x3d, 0x40, 0xf2, 0xe0, 0x00, 0x00, 0x54, 0xc9, 0x82, 0x49, 0x8b, 0xa3, 0x00, 0x00,
+			0x94, 0x60, 0x7a, 0x68, 0xf8, 0x20, 0x01, 0x3f, 0xd6, 0xe0, 0x43, 0xc1, 0xda, 0x02, 0x00, 0x00, 0x14, 0x00, 0x00,
+			0x80, 0xd2, 0x88, 0x06, 0x41, 0xf8, 0x08, 0x00, 0x08, 0x8b, 0xa8, 0x86, 0x00, 0xf8, 0x39, 0x07, 0x00, 0xd1, 0x59,
+			0xfe, 0xff, 0xb5, 0x4d, 0xff, 0xff, 0x17, 0x9f, 0x02, 0x00, 0x91, 0xa4, 0x00, 0x00, 0x94, 0x68, 0x1b, 0x40, 0xf9,
+			0xe0, 0x03, 0x15, 0xaa, 0x00, 0x01, 0x3f, 0xd6, 0xa8, 0xc3, 0x99, 0xb8, 0xe0, 0x03, 0x08, 0xaa, 0x21, 0xa7, 0x80,
+			0xd2, 0x22, 0xa7, 0x80, 0xd2, 0x03, 0x00, 0x80, 0xd2, 0x20, 0xa7, 0x20, 0xd4, 0xa0, 0xc3, 0x99, 0xb8, 0xbf, 0x43,
+			0x01, 0xd1, 0xfd, 0x7b, 0x45, 0xa9, 0xf4, 0x4f, 0x44, 0xa9, 0xf6, 0x57, 0x43, 0xa9, 0xf8, 0x5f, 0x42, 0xa9, 0xfa,
+			0x67, 0x41, 0xa9, 0xfc, 0x6f, 0xc6, 0xa8, 0xc0, 0x03, 0x5f, 0xd6, 0x0c, 0x00, 0x00, 0x00, 0x38, 0x02, 0x00, 0x00,
+			0x1c, 0x01, 0x00, 0x00, 0xe8, 0x01, 0x00, 0x00, 0xc8, 0x00, 0x00, 0x00, 0x78, 0x03, 0x00, 0x00, 0xdc, 0x03, 0x00,
+			0x00, 0x0c, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0xf8, 0x5f,
+			0xbc, 0xa9, 0xf6, 0x57, 0x01, 0xa9, 0xf4, 0x4f, 0x02, 0xa9, 0xfd, 0x7b, 0x03, 0xa9, 0xfd, 0xc3, 0x00, 0x91, 0xf3,
+			0x03, 0x04, 0xaa, 0xf4, 0x03, 0x03, 0xaa, 0xf5, 0x03, 0x02, 0xaa, 0xf6, 0x03, 0x01, 0xaa, 0xf7, 0x03, 0x00, 0xaa,
+			0x43, 0x00, 0x00, 0xb4, 0x9f, 0x02, 0x00, 0xf9, 0xbf, 0x02, 0x00, 0xf1, 0xf8, 0x17, 0x9f, 0x1a, 0xd5, 0x03, 0x00,
+			0xb4, 0x68, 0x1e, 0x40, 0xf9, 0xe0, 0x03, 0x17, 0xaa, 0xe1, 0x03, 0x16, 0xaa, 0xe2, 0x03, 0x15, 0xaa, 0x00, 0x01,
+			0x3f, 0xd6, 0x1f, 0x04, 0x00, 0xb1, 0xe1, 0x00, 0x00, 0x54, 0x68, 0x4e, 0x40, 0xf9, 0x00, 0x01, 0x3f, 0xd6, 0x08,
+			0x00, 0x40, 0xb9, 0x1f, 0x11, 0x00, 0x71, 0xa0, 0xfe, 0xff, 0x54, 0x0a, 0x00, 0x00, 0x14, 0x1f, 0x04, 0x00, 0xf1,
+			0x2b, 0x01, 0x00, 0x54, 0x94, 0x00, 0x00, 0xb4, 0x88, 0x02, 0x40, 0xf9, 0x08, 0x01, 0x00, 0x8b, 0x88, 0x02, 0x00,
+			0xf9, 0xd6, 0x02, 0x00, 0x8b, 0xb5, 0x02, 0x00, 0xcb, 0xe8, 0xff, 0xff, 0x17, 0x18, 0x00, 0x80, 0x52, 0xe0, 0x03,
+			0x18, 0xaa, 0xfd, 0x7b, 0x43, 0xa9, 0xf4, 0x4f, 0x42, 0xa9, 0xf6, 0x57, 0x41, 0xa9, 0xf8, 0x5f, 0xc4, 0xa8, 0xc0,
+			0x03, 0x5f, 0xd6, 0x38, 0x00, 0x80, 0x52, 0xf9, 0xff, 0xff, 0x17, 0xf6, 0x57, 0xbd, 0xa9, 0xf4, 0x4f, 0x01, 0xa9,
+			0xfd, 0x7b, 0x02, 0xa9, 0xfd, 0x83, 0x00, 0x91, 0xf3, 0x03, 0x02, 0xaa, 0xf4, 0x03, 0x01, 0xaa, 0xf5, 0x03, 0x00,
+			0xaa, 0x88, 0x00, 0x80, 0x52, 0xf6, 0x03, 0x08, 0xaa, 0x48, 0x02, 0x00, 0xb4, 0x68, 0x22, 0x40, 0xf9, 0xe0, 0x03,
+			0x15, 0xaa, 0xe1, 0x03, 0x14, 0xaa, 0xe2, 0x03, 0x16, 0xaa, 0x00, 0x01, 0x3f, 0xd6, 0x1f, 0x04, 0x00, 0xb1, 0xe1,
+			0x00, 0x00, 0x54, 0x68, 0x4e, 0x40, 0xf9, 0x00, 0x01, 0x3f, 0xd6, 0x08, 0x00, 0x40, 0xb9, 0x1f, 0x11, 0x00, 0x71,
+			0xa0, 0xfe, 0xff, 0x54, 0x05, 0x00, 0x00, 0x14, 0x94, 0x02, 0x00, 0x8b, 0xc8, 0x02, 0x00, 0xcb, 0x1f, 0x00, 0x00,
+			0xf1, 0xcc, 0xfd, 0xff, 0x54, 0xdf, 0x02, 0x00, 0xf1, 0xe0, 0x17, 0x9f, 0x1a, 0xfd, 0x7b, 0x42, 0xa9, 0xf4, 0x4f,
+			0x41, 0xa9, 0xf6, 0x57, 0xc3, 0xa8, 0xc0, 0x03, 0x5f, 0xd6, 0x44, 0x3c, 0x50, 0xb3, 0x7f, 0x00, 0x00, 0x71, 0x48,
+			0x00, 0x84, 0x9a, 0xf0, 0x03, 0x01, 0x2a, 0x1f, 0x0e, 0x00, 0xf1, 0x10, 0x92, 0x9f, 0x9a, 0x11, 0x00, 0x00, 0x90,
+			0x31, 0xc2, 0x29, 0x91, 0x30, 0x7a, 0xb0, 0xb8, 0x11, 0x00, 0x00, 0x10, 0x30, 0x02, 0x10, 0x8b, 0x00, 0x02, 0x1f,
+			0xd6, 0xf1, 0x03, 0x00, 0xaa, 0xf0, 0x03, 0x08, 0xaa, 0x1f, 0x21, 0x03, 0xd5, 0x0c, 0x00, 0x00, 0x14, 0xf1, 0x03,
+			0x00, 0xaa, 0xf0, 0x03, 0x08, 0xaa, 0x11, 0x0a, 0xc1, 0xda, 0x08, 0x00, 0x00, 0x14, 0xf1, 0x03, 0x00, 0xaa, 0xf0,
+			0x03, 0x08, 0xaa, 0x11, 0x0e, 0xc1, 0xda, 0x04, 0x00, 0x00, 0x14, 0xf1, 0x03, 0x00, 0xaa, 0xf0, 0x03, 0x08, 0xaa,
+			0x5f, 0x21, 0x03, 0xd5, 0xe0, 0x03, 0x11, 0xaa, 0xc0, 0x03, 0x5f, 0xd6, 0x0c, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x00,
+			0x00, 0x1c, 0x00, 0x00, 0x00, 0x2c, 0x00, 0x00, 0x00, 0xe0, 0x03, 0x17, 0xaa, 0x02, 0x01, 0x80, 0x52, 0x03, 0x00,
+			0x80, 0xd2, 0xe4, 0x03, 0x1b, 0xaa, 0x8c, 0xff, 0xff, 0x17, 0x03, 0x00, 0x80, 0xd2, 0xe4, 0x03, 0x1b, 0xaa, 0x89,
+			0xff, 0xff, 0x17, 0xea, 0x03, 0x09, 0xaa, 0x4b, 0x15, 0x40, 0x38, 0x7f, 0x7d, 0x01, 0x71, 0x21, 0x11, 0x8a, 0x9a,
+			0x69, 0x4b, 0x40, 0xf9, 0xc0, 0x03, 0x5f, 0xd6, 0xa1, 0xf3, 0x01, 0xd1, 0xe0, 0x03, 0x17, 0xaa, 0xe2, 0x03, 0x1b,
+			0xaa, 0xad, 0xff, 0xff, 0x17, 0xa4, 0x93, 0x01, 0xd1, 0x00, 0x00, 0x80, 0x52, 0xe3, 0x03, 0x16, 0xaa, 0x00, 0x01,
+			0x1f, 0xd6, 0x68, 0x1b, 0x40, 0xf9, 0xe0, 0x03, 0x17, 0xaa, 0x00, 0x01, 0x1f, 0xd6, 0xa0, 0x03, 0x5a, 0xf8, 0xa1,
+			0x03, 0x55, 0xf8, 0x00, 0x01, 0x1f, 0xd6
 		};
 
 		private static bool is_dyld_stub_binder (string module_name, string symbol_name) {
@@ -813,7 +855,7 @@ namespace Frida.Fruity.Injector {
 		private static uint64 resolve_dyld_symbol (string name, string nick, Gee.Map<string, uint64?> dyld_symbols) throws Error {
 			uint64? val = dyld_symbols[name];
 			if (val == null)
-				throw new Error.UNSUPPORTED ("Unsupported iOS version (%s not found)", nick);
+				throw new Error.NOT_SUPPORTED ("Unsupported iOS version (%s not found)", nick);
 			return val;
 		}
 
@@ -863,7 +905,7 @@ namespace Frida.Fruity.Injector {
 
 			GDB.Breakpoint? hit_breakpoint = exception.breakpoint;
 			if (hit_breakpoint == null)
-				throw new Error.UNSUPPORTED ("Unexpected exception");
+				throw new Error.NOT_SUPPORTED ("Unexpected exception");
 
 			if (restart_breakpoint != null)
 				yield restart_breakpoint.remove (cancellable);
@@ -871,7 +913,7 @@ namespace Frida.Fruity.Injector {
 
 			if (hit_breakpoint == restart_breakpoint) {
 				if (process_info_ptr == null)
-					throw new Error.UNSUPPORTED ("Missing gProcessInfo");
+					throw new Error.NOT_SUPPORTED ("Missing gProcessInfo");
 				uint64 process_info = yield lldb.read_pointer (process_info_ptr, cancellable);
 				uint64 dyld_image_load_address = yield lldb.read_pointer (process_info + 0x20, cancellable);
 
@@ -892,7 +934,7 @@ namespace Frida.Fruity.Injector {
 
 				hit_breakpoint = exception.breakpoint;
 				if (hit_breakpoint == null)
-					throw new Error.UNSUPPORTED ("Unexpected exception");
+					throw new Error.NOT_SUPPORTED ("Unexpected exception");
 
 				dyld_fields = yield lldb.get_apple_dyld_fields (BYPASS_CACHE, cancellable);
 			}
@@ -924,7 +966,7 @@ namespace Frida.Fruity.Injector {
 
 			hit_breakpoint = exception.breakpoint;
 			if (hit_breakpoint == null)
-				throw new Error.UNSUPPORTED ("Unexpected exception");
+				throw new Error.NOT_SUPPORTED ("Unexpected exception");
 
 			assert (hit_breakpoint == caller_breakpoint);
 			yield caller_breakpoint.remove (cancellable);
@@ -959,7 +1001,7 @@ namespace Frida.Fruity.Injector {
 
 			GDB.Breakpoint? hit_breakpoint = exception.breakpoint;
 			if (hit_breakpoint == null)
-				throw new Error.UNSUPPORTED ("Unexpected exception");
+				throw new Error.NOT_SUPPORTED ("Unexpected exception");
 
 			yield legacy_breakpoint.remove (cancellable);
 
@@ -1005,7 +1047,7 @@ namespace Frida.Fruity.Injector {
 				}
 			}
 
-			throw new Error.UNSUPPORTED ("Unable to probe dyld v3 internals; please file a bug");
+			throw new Error.NOT_SUPPORTED ("Unable to probe dyld v3 internals; please file a bug");
 		}
 
 		private async void initialize_libsystem_from_legacy_codepath (Gee.Map<string, uint64?> dyld_symbols,
@@ -1178,14 +1220,14 @@ namespace Frida.Fruity.Injector {
 				}, null, cancellable);
 			size_t size = length + 1;
 			if (size > page_size)
-				throw new Error.UNSUPPORTED ("Buffer too small; please file a bug");
+				throw new Error.NOT_SUPPORTED ("Buffer too small; please file a bug");
 
 			Bytes output_bytes = yield lldb.read_byte_array (output, size, cancellable);
 			unowned string output_str = (string) output_bytes.get_data ();
 			foreach (var line in output_str.split ("\n")) {
 				var tokens = line.split ("\t", 2);
 				if (tokens.length != 2)
-					throw new Error.UNSUPPORTED ("Unable to fetch dyld symbols; please file a bug");
+					throw new Error.NOT_SUPPORTED ("Unable to fetch dyld symbols; please file a bug");
 
 				unowned string raw_address = tokens[0];
 				unowned string name = tokens[1];
@@ -1202,73 +1244,72 @@ namespace Frida.Fruity.Injector {
 		/* Compiled from helpers/symbol-fetcher.c */
 		private const uint8[] SYMBOL_FETCHER_CODE = {
 			0xff, 0x03, 0x02, 0xd1, 0xfc, 0x6f, 0x02, 0xa9, 0xfa, 0x67, 0x03, 0xa9, 0xf8, 0x5f, 0x04, 0xa9, 0xf6, 0x57, 0x05,
-			0xa9, 0xf4, 0x4f, 0x06, 0xa9, 0xfd, 0x7b, 0x07, 0xa9, 0xfd, 0xc3, 0x01, 0x91, 0xf4, 0x03, 0x01, 0xaa, 0xe0, 0x07,
-			0x00, 0xf9, 0x13, 0x00, 0x80, 0xd2, 0x19, 0x00, 0x80, 0xd2, 0x35, 0x80, 0x00, 0x91, 0x3a, 0x10, 0x40, 0xb9, 0x16,
-			0x00, 0x00, 0x90, 0xd6, 0x3e, 0x13, 0x91, 0x17, 0x00, 0x00, 0x90, 0xf7, 0x5a, 0x13, 0x91, 0x1a, 0x04, 0x00, 0x34,
-			0xa8, 0x02, 0x40, 0xb9, 0x1f, 0x09, 0x00, 0x71, 0xa0, 0x01, 0x00, 0x54, 0x1f, 0x2d, 0x00, 0x71, 0xa0, 0x01, 0x00,
-			0x54, 0x1f, 0x65, 0x00, 0x71, 0x81, 0x01, 0x00, 0x54, 0xb8, 0x22, 0x00, 0x91, 0xe0, 0x03, 0x18, 0xaa, 0xe1, 0x03,
-			0x16, 0xaa, 0xaa, 0x00, 0x00, 0x94, 0x80, 0x01, 0x00, 0x34, 0xb3, 0xa2, 0x41, 0xa9, 0xe8, 0x0b, 0x00, 0xf9, 0x04,
-			0x00, 0x00, 0x14, 0xfc, 0x03, 0x15, 0xaa, 0x02, 0x00, 0x00, 0x14, 0xfb, 0x03, 0x15, 0xaa, 0xa8, 0x06, 0x40, 0xb9,
-			0xb5, 0x02, 0x08, 0x8b, 0x5a, 0x07, 0x00, 0x51, 0x7a, 0xfd, 0xff, 0x35, 0x09, 0x00, 0x00, 0x14, 0xe0, 0x03, 0x18,
-			0xaa, 0xe1, 0x03, 0x17, 0xaa, 0x9b, 0x00, 0x00, 0x94, 0x00, 0xff, 0xff, 0x34, 0xa8, 0x0e, 0x40, 0xf9, 0xa9, 0x16,
-			0x40, 0xf9, 0x19, 0x01, 0x09, 0xcb, 0xf4, 0xff, 0xff, 0x17, 0x88, 0x02, 0x13, 0xcb, 0x28, 0x03, 0x08, 0x8b, 0x89,
-			0x0b, 0x40, 0xb9, 0x13, 0x01, 0x09, 0x8b, 0x89, 0x13, 0x40, 0xb9, 0x19, 0x01, 0x09, 0x8b, 0xe8, 0x07, 0x40, 0xf9,
-			0xe8, 0x0f, 0x00, 0xf9, 0x16, 0x00, 0x00, 0x90, 0xd6, 0x72, 0x0f, 0x91, 0x35, 0x01, 0x80, 0x52, 0x78, 0x0b, 0x40,
-			0xb9, 0x68, 0x0f, 0x40, 0xb9, 0x1f, 0x03, 0x08, 0x6b, 0xc0, 0x0a, 0x00, 0x54, 0x77, 0x52, 0x38, 0x8b, 0xe8, 0x02,
-			0x40, 0xb9, 0x3c, 0x03, 0x08, 0x8b, 0xe0, 0x03, 0x1c, 0xaa, 0xe1, 0x03, 0x16, 0xaa, 0x6a, 0x00, 0x00, 0x94, 0xa0,
-			0x07, 0x00, 0x37, 0xe0, 0x03, 0x1c, 0xaa, 0x01, 0x00, 0x00, 0x90, 0x21, 0xbc, 0x0f, 0x91, 0x65, 0x00, 0x00, 0x94,
-			0x00, 0x07, 0x00, 0x37, 0xe0, 0x03, 0x1c, 0xaa, 0x01, 0x00, 0x00, 0x90, 0x21, 0xf8, 0x0f, 0x91, 0x60, 0x00, 0x00,
-			0x94, 0x60, 0x06, 0x00, 0x37, 0xe0, 0x03, 0x1c, 0xaa, 0x01, 0x00, 0x00, 0x90, 0x21, 0x54, 0x10, 0x91, 0x72, 0x00,
-			0x00, 0x94, 0xc0, 0x05, 0x00, 0x37, 0xe0, 0x03, 0x1c, 0xaa, 0x01, 0x00, 0x00, 0x90, 0x21, 0x8c, 0x10, 0x91, 0x6d,
-			0x00, 0x00, 0x94, 0x20, 0x05, 0x00, 0x37, 0xe0, 0x03, 0x1c, 0xaa, 0x01, 0x00, 0x00, 0x90, 0x21, 0xf4, 0x10, 0x91,
-			0x68, 0x00, 0x00, 0x94, 0x80, 0x04, 0x00, 0x37, 0xe0, 0x03, 0x1c, 0xaa, 0x01, 0x00, 0x00, 0x90, 0x21, 0x40, 0x11,
-			0x91, 0x4c, 0x00, 0x00, 0x94, 0xe0, 0x03, 0x00, 0x37, 0xe0, 0x03, 0x1c, 0xaa, 0x01, 0x00, 0x00, 0x90, 0x21, 0x88,
-			0x11, 0x91, 0x47, 0x00, 0x00, 0x94, 0x40, 0x03, 0x00, 0x37, 0xe0, 0x03, 0x1c, 0xaa, 0x01, 0x00, 0x00, 0x90, 0x21,
-			0xec, 0x11, 0x91, 0x42, 0x00, 0x00, 0x94, 0xa0, 0x02, 0x00, 0x37, 0xe0, 0x03, 0x1c, 0xaa, 0x01, 0x00, 0x00, 0x90,
-			0x21, 0x44, 0x12, 0x91, 0x5c, 0x00, 0x00, 0x94, 0x00, 0x02, 0x00, 0x37, 0xe0, 0x03, 0x1c, 0xaa, 0x01, 0x00, 0x00,
-			0x90, 0x21, 0x64, 0x12, 0x91, 0x57, 0x00, 0x00, 0x94, 0x60, 0x01, 0x00, 0x37, 0xe0, 0x03, 0x1c, 0xaa, 0x01, 0x00,
-			0x00, 0x90, 0x21, 0x84, 0x12, 0x91, 0x33, 0x00, 0x00, 0x94, 0xc0, 0x00, 0x00, 0x37, 0xe0, 0x03, 0x1c, 0xaa, 0x01,
-			0x00, 0x00, 0x90, 0x21, 0xd0, 0x12, 0x91, 0x2e, 0x00, 0x00, 0x94, 0x20, 0x02, 0x00, 0x34, 0xba, 0x00, 0x00, 0x34,
-			0xe8, 0x0f, 0x40, 0xf9, 0x49, 0x01, 0x80, 0x52, 0x09, 0x15, 0x00, 0x38, 0xe8, 0x0f, 0x00, 0xf9, 0xe8, 0x06, 0x40,
-			0xf9, 0x81, 0x02, 0x08, 0x8b, 0xe0, 0x63, 0x00, 0x91, 0x4c, 0x00, 0x00, 0x94, 0xe8, 0x0f, 0x40, 0xf9, 0x15, 0x15,
-			0x00, 0x38, 0xe8, 0x0f, 0x00, 0xf9, 0xe0, 0x63, 0x00, 0x91, 0xe1, 0x03, 0x1c, 0xaa, 0x5d, 0x00, 0x00, 0x94, 0x5a,
-			0x07, 0x00, 0x11, 0x18, 0x07, 0x00, 0x11, 0xa9, 0xff, 0xff, 0x17, 0xe1, 0x23, 0x41, 0xa9, 0x49, 0x01, 0x80, 0x52,
-			0x09, 0x15, 0x00, 0x38, 0xe8, 0x0f, 0x00, 0xf9, 0xe0, 0x63, 0x00, 0x91, 0x3d, 0x00, 0x00, 0x94, 0xe8, 0x0f, 0x40,
-			0xf9, 0x29, 0x01, 0x80, 0x52, 0x09, 0x15, 0x00, 0x38, 0xe8, 0x0f, 0x00, 0xf9, 0x01, 0x00, 0x00, 0x90, 0x21, 0x14,
-			0x13, 0x91, 0xe0, 0x63, 0x00, 0x91, 0x4c, 0x00, 0x00, 0x94, 0xe8, 0x0f, 0x40, 0xf9, 0xe9, 0x07, 0x40, 0xf9, 0x00,
-			0x01, 0x09, 0xcb, 0x1f, 0x01, 0x00, 0x39, 0xfd, 0x7b, 0x47, 0xa9, 0xf4, 0x4f, 0x46, 0xa9, 0xf6, 0x57, 0x45, 0xa9,
-			0xf8, 0x5f, 0x44, 0xa9, 0xfa, 0x67, 0x43, 0xa9, 0xfc, 0x6f, 0x42, 0xa9, 0xff, 0x03, 0x02, 0x91, 0xc0, 0x03, 0x5f,
-			0xd6, 0xf6, 0x57, 0xbd, 0xa9, 0xf4, 0x4f, 0x01, 0xa9, 0xfd, 0x7b, 0x02, 0xa9, 0xfd, 0x83, 0x00, 0x91, 0xf3, 0x03,
-			0x01, 0xaa, 0xf4, 0x03, 0x00, 0xaa, 0x35, 0x00, 0x40, 0x39, 0x96, 0x02, 0x40, 0x39, 0x36, 0x01, 0x00, 0x34, 0xdf,
-			0x02, 0x15, 0x6b, 0xa1, 0x00, 0x00, 0x54, 0xe0, 0x03, 0x14, 0xaa, 0xe1, 0x03, 0x13, 0xaa, 0x12, 0x00, 0x00, 0x94,
-			0x60, 0x00, 0x00, 0x37, 0x94, 0x06, 0x00, 0x91, 0xf7, 0xff, 0xff, 0x17, 0xdf, 0x02, 0x00, 0x71, 0xe0, 0x07, 0x9f,
-			0x1a, 0xfd, 0x7b, 0x42, 0xa9, 0xf4, 0x4f, 0x41, 0xa9, 0xf6, 0x57, 0xc3, 0xa8, 0xc0, 0x03, 0x5f, 0xd6, 0x08, 0x14,
-			0x40, 0x38, 0x29, 0x14, 0x40, 0x38, 0x1f, 0x01, 0x00, 0x71, 0x00, 0x11, 0x49, 0x7a, 0x80, 0xff, 0xff, 0x54, 0x1f,
-			0x01, 0x09, 0x6b, 0xe0, 0x17, 0x9f, 0x1a, 0xc0, 0x03, 0x5f, 0xd6, 0x28, 0x00, 0x40, 0x39, 0xa8, 0x00, 0x00, 0x34,
-			0x21, 0x04, 0x00, 0x91, 0x09, 0x14, 0x40, 0x38, 0x3f, 0x01, 0x08, 0x6b, 0x60, 0xff, 0xff, 0x54, 0x1f, 0x01, 0x00,
-			0x71, 0xe0, 0x17, 0x9f, 0x1a, 0xc0, 0x03, 0x5f, 0xd6, 0x09, 0x00, 0x80, 0x52, 0x08, 0x00, 0x40, 0xf9, 0x8a, 0x07,
-			0x80, 0x52, 0x0b, 0x00, 0x00, 0x90, 0x6b, 0xc1, 0x13, 0x91, 0x5f, 0x11, 0x00, 0x31, 0x80, 0x01, 0x00, 0x54, 0x2c,
-			0x24, 0xca, 0x9a, 0x8c, 0x0d, 0x40, 0x92, 0x2d, 0x01, 0x00, 0x12, 0x9f, 0x01, 0x00, 0x71, 0xa0, 0x19, 0x40, 0x7a,
-			0x29, 0x15, 0x9f, 0x1a, 0x69, 0x00, 0x00, 0x36, 0x6c, 0x69, 0x6c, 0x38, 0x0c, 0x15, 0x00, 0x38, 0x4a, 0x11, 0x00,
-			0x51, 0xf4, 0xff, 0xff, 0x17, 0x69, 0x00, 0x00, 0x37, 0x09, 0x06, 0x80, 0x52, 0x09, 0x15, 0x00, 0x38, 0x08, 0x00,
-			0x00, 0xf9, 0xc0, 0x03, 0x5f, 0xd6, 0x08, 0x00, 0x40, 0xf9, 0x29, 0x00, 0x40, 0x39, 0x89, 0x00, 0x00, 0x34, 0x21,
-			0x04, 0x00, 0x91, 0x09, 0x15, 0x00, 0x38, 0xfc, 0xff, 0xff, 0x17, 0x08, 0x00, 0x00, 0xf9, 0xc0, 0x03, 0x5f, 0xd6,
-			0x6c, 0x69, 0x62, 0x64, 0x79, 0x6c, 0x64, 0x5f, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x00,
-			0x6e, 0x6f, 0x74, 0x69, 0x66, 0x79, 0x4f, 0x62, 0x6a, 0x43, 0x49, 0x6e, 0x69, 0x74, 0x00, 0x72, 0x65, 0x73, 0x74,
-			0x61, 0x72, 0x74, 0x57, 0x69, 0x74, 0x68, 0x44, 0x79, 0x6c, 0x64, 0x49, 0x6e, 0x43, 0x61, 0x63, 0x68, 0x65, 0x00,
-			0x5f, 0x67, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x49, 0x6e, 0x66, 0x6f, 0x00, 0x5f, 0x5f, 0x5a, 0x4e, 0x35,
-			0x64, 0x79, 0x6c, 0x64, 0x34, 0x31, 0x32, 0x67, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x49, 0x6e, 0x66, 0x6f,
-			0x45, 0x00, 0x5f, 0x5f, 0x5a, 0x4c, 0x31, 0x32, 0x73, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x49, 0x6e, 0x66,
-			0x6f, 0x00, 0x6c, 0x61, 0x75, 0x6e, 0x63, 0x68, 0x57, 0x69, 0x74, 0x68, 0x43, 0x6c, 0x6f, 0x73, 0x75, 0x72, 0x65,
-			0x00, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x4d, 0x61, 0x69, 0x6e, 0x45, 0x78, 0x65, 0x63,
-			0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x00, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x54, 0x68, 0x72, 0x65,
-			0x61, 0x64, 0x48, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x73, 0x00, 0x5f, 0x64, 0x6c, 0x6f, 0x70, 0x65, 0x6e, 0x00, 0x5f,
-			0x73, 0x74, 0x72, 0x63, 0x6d, 0x70, 0x00, 0x64, 0x6f, 0x4d, 0x6f, 0x64, 0x49, 0x6e, 0x69, 0x74, 0x46, 0x75, 0x6e,
-			0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x00, 0x64, 0x6f, 0x47, 0x65, 0x74, 0x44, 0x4f, 0x46, 0x53, 0x65, 0x63, 0x74,
-			0x69, 0x6f, 0x6e, 0x73, 0x00, 0x64, 0x79, 0x6c, 0x64, 0x5f, 0x73, 0x69, 0x7a, 0x65, 0x00, 0x5f, 0x5f, 0x54, 0x45,
-			0x58, 0x54, 0x00, 0x5f, 0x5f, 0x4c, 0x49, 0x4e, 0x4b, 0x45, 0x44, 0x49, 0x54, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38,
-			0x39, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66
+			0xa9, 0xf4, 0x4f, 0x06, 0xa9, 0xfd, 0x7b, 0x07, 0xa9, 0xfd, 0xc3, 0x01, 0x91, 0xf4, 0x03, 0x01, 0xaa, 0xe0, 0x0b,
+			0x00, 0xf9, 0x13, 0x00, 0x80, 0xd2, 0x15, 0x00, 0x80, 0xd2, 0x38, 0x80, 0x00, 0x91, 0x39, 0x10, 0x40, 0xb9, 0x16,
+			0x00, 0x00, 0x90, 0xd6, 0x1e, 0x13, 0x91, 0x1a, 0x00, 0x00, 0x90, 0x5a, 0x3b, 0x13, 0x91, 0xd9, 0x03, 0x00, 0x34,
+			0x08, 0x03, 0x40, 0xb9, 0x1f, 0x09, 0x00, 0x71, 0xa0, 0x01, 0x00, 0x54, 0x1f, 0x2d, 0x00, 0x71, 0x20, 0x01, 0x00,
+			0x54, 0x1f, 0x65, 0x00, 0x71, 0x41, 0x01, 0x00, 0x54, 0x00, 0x23, 0x00, 0x91, 0xe1, 0x03, 0x16, 0xaa, 0xa4, 0x00,
+			0x00, 0x94, 0x60, 0x01, 0x00, 0x34, 0x13, 0xef, 0x41, 0xa9, 0x04, 0x00, 0x00, 0x14, 0xfc, 0x03, 0x18, 0xaa, 0x02,
+			0x00, 0x00, 0x14, 0xf7, 0x03, 0x18, 0xaa, 0x08, 0x07, 0x40, 0xb9, 0x18, 0x03, 0x08, 0x8b, 0x39, 0x07, 0x00, 0x51,
+			0xb9, 0xfd, 0xff, 0x35, 0x09, 0x00, 0x00, 0x14, 0x00, 0x23, 0x00, 0x91, 0xe1, 0x03, 0x1a, 0xaa, 0x96, 0x00, 0x00,
+			0x94, 0x00, 0xff, 0xff, 0x34, 0x08, 0x0f, 0x40, 0xf9, 0x09, 0x17, 0x40, 0xf9, 0x15, 0x01, 0x09, 0xcb, 0xf4, 0xff,
+			0xff, 0x17, 0xfb, 0x07, 0x00, 0xf9, 0x1b, 0x00, 0x80, 0x52, 0x88, 0x02, 0x13, 0xcb, 0xa8, 0x02, 0x08, 0x8b, 0xe9,
+			0x0a, 0x40, 0xb9, 0x1a, 0x01, 0x09, 0x8b, 0xe9, 0x12, 0x40, 0xb9, 0x13, 0x01, 0x09, 0x8b, 0xe8, 0x0b, 0x40, 0xf9,
+			0xe8, 0x0f, 0x00, 0xf9, 0x16, 0x00, 0x00, 0x90, 0xd6, 0x52, 0x0f, 0x91, 0x39, 0x01, 0x80, 0x52, 0x95, 0x0b, 0x40,
+			0xb9, 0x88, 0x0f, 0x40, 0xb9, 0xbf, 0x02, 0x08, 0x6b, 0x40, 0x0a, 0x00, 0x54, 0x58, 0x53, 0x35, 0x8b, 0x17, 0x03,
+			0x40, 0xb9, 0x60, 0x02, 0x17, 0x8b, 0xe1, 0x03, 0x16, 0xaa, 0x64, 0x00, 0x00, 0x94, 0xa0, 0x07, 0x00, 0x37, 0x60,
+			0x02, 0x17, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21, 0x9c, 0x0f, 0x91, 0x5f, 0x00, 0x00, 0x94, 0x00, 0x07, 0x00, 0x37,
+			0x60, 0x02, 0x17, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21, 0xd8, 0x0f, 0x91, 0x5a, 0x00, 0x00, 0x94, 0x60, 0x06, 0x00,
+			0x37, 0x60, 0x02, 0x17, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21, 0x34, 0x10, 0x91, 0x6c, 0x00, 0x00, 0x94, 0xc0, 0x05,
+			0x00, 0x37, 0x60, 0x02, 0x17, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21, 0x6c, 0x10, 0x91, 0x67, 0x00, 0x00, 0x94, 0x20,
+			0x05, 0x00, 0x37, 0x60, 0x02, 0x17, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21, 0xd4, 0x10, 0x91, 0x62, 0x00, 0x00, 0x94,
+			0x80, 0x04, 0x00, 0x37, 0x60, 0x02, 0x17, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21, 0x20, 0x11, 0x91, 0x46, 0x00, 0x00,
+			0x94, 0xe0, 0x03, 0x00, 0x37, 0x60, 0x02, 0x17, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21, 0x68, 0x11, 0x91, 0x41, 0x00,
+			0x00, 0x94, 0x40, 0x03, 0x00, 0x37, 0x60, 0x02, 0x17, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21, 0xcc, 0x11, 0x91, 0x3c,
+			0x00, 0x00, 0x94, 0xa0, 0x02, 0x00, 0x37, 0x60, 0x02, 0x17, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21, 0x24, 0x12, 0x91,
+			0x56, 0x00, 0x00, 0x94, 0x00, 0x02, 0x00, 0x37, 0x60, 0x02, 0x17, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21, 0x44, 0x12,
+			0x91, 0x51, 0x00, 0x00, 0x94, 0x60, 0x01, 0x00, 0x37, 0x60, 0x02, 0x17, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21, 0x64,
+			0x12, 0x91, 0x2d, 0x00, 0x00, 0x94, 0xc0, 0x00, 0x00, 0x37, 0x60, 0x02, 0x17, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21,
+			0xb0, 0x12, 0x91, 0x28, 0x00, 0x00, 0x94, 0xc0, 0x01, 0x00, 0x34, 0x5b, 0x00, 0x00, 0x34, 0x6c, 0x00, 0x00, 0x94,
+			0x08, 0x07, 0x40, 0xf9, 0xe0, 0x63, 0x00, 0x91, 0x81, 0x02, 0x08, 0x8b, 0x49, 0x00, 0x00, 0x94, 0xe8, 0x0f, 0x40,
+			0xf9, 0x19, 0x15, 0x00, 0x38, 0xe8, 0x0f, 0x00, 0xf9, 0xe0, 0x63, 0x00, 0x91, 0x61, 0x02, 0x17, 0x8b, 0x5a, 0x00,
+			0x00, 0x94, 0x7b, 0x07, 0x00, 0x11, 0xb5, 0x06, 0x00, 0x11, 0xad, 0xff, 0xff, 0x17, 0x5e, 0x00, 0x00, 0x94, 0xe0,
+			0x63, 0x00, 0x91, 0xe1, 0x07, 0x40, 0xf9, 0x3c, 0x00, 0x00, 0x94, 0xe8, 0x0f, 0x40, 0xf9, 0x29, 0x01, 0x80, 0x52,
+			0x09, 0x15, 0x00, 0x38, 0xe8, 0x0f, 0x00, 0xf9, 0x01, 0x00, 0x00, 0x90, 0x21, 0xf4, 0x12, 0x91, 0xe0, 0x63, 0x00,
+			0x91, 0x4b, 0x00, 0x00, 0x94, 0xe9, 0x23, 0x41, 0xa9, 0x00, 0x01, 0x09, 0xcb, 0x1f, 0x01, 0x00, 0x39, 0xfd, 0x7b,
+			0x47, 0xa9, 0xf4, 0x4f, 0x46, 0xa9, 0xf6, 0x57, 0x45, 0xa9, 0xf8, 0x5f, 0x44, 0xa9, 0xfa, 0x67, 0x43, 0xa9, 0xfc,
+			0x6f, 0x42, 0xa9, 0xff, 0x03, 0x02, 0x91, 0xc0, 0x03, 0x5f, 0xd6, 0xf6, 0x57, 0xbd, 0xa9, 0xf4, 0x4f, 0x01, 0xa9,
+			0xfd, 0x7b, 0x02, 0xa9, 0xfd, 0x83, 0x00, 0x91, 0xf3, 0x03, 0x01, 0xaa, 0xf4, 0x03, 0x00, 0xaa, 0x35, 0x00, 0x40,
+			0x39, 0x96, 0x02, 0x40, 0x39, 0x36, 0x01, 0x00, 0x34, 0xdf, 0x02, 0x15, 0x6b, 0xa1, 0x00, 0x00, 0x54, 0xe0, 0x03,
+			0x14, 0xaa, 0xe1, 0x03, 0x13, 0xaa, 0x12, 0x00, 0x00, 0x94, 0x60, 0x00, 0x00, 0x37, 0x94, 0x06, 0x00, 0x91, 0xf7,
+			0xff, 0xff, 0x17, 0xdf, 0x02, 0x00, 0x71, 0xe0, 0x07, 0x9f, 0x1a, 0xfd, 0x7b, 0x42, 0xa9, 0xf4, 0x4f, 0x41, 0xa9,
+			0xf6, 0x57, 0xc3, 0xa8, 0xc0, 0x03, 0x5f, 0xd6, 0x08, 0x14, 0x40, 0x38, 0x29, 0x14, 0x40, 0x38, 0x1f, 0x01, 0x00,
+			0x71, 0x00, 0x11, 0x49, 0x7a, 0x80, 0xff, 0xff, 0x54, 0x1f, 0x01, 0x09, 0x6b, 0xe0, 0x17, 0x9f, 0x1a, 0xc0, 0x03,
+			0x5f, 0xd6, 0x28, 0x00, 0x40, 0x39, 0xa8, 0x00, 0x00, 0x34, 0x21, 0x04, 0x00, 0x91, 0x09, 0x14, 0x40, 0x38, 0x3f,
+			0x01, 0x08, 0x6b, 0x60, 0xff, 0xff, 0x54, 0x1f, 0x01, 0x00, 0x71, 0xe0, 0x17, 0x9f, 0x1a, 0xc0, 0x03, 0x5f, 0xd6,
+			0x09, 0x00, 0x80, 0x52, 0x08, 0x00, 0x40, 0xf9, 0x8a, 0x07, 0x80, 0x52, 0x0b, 0x00, 0x00, 0x90, 0x6b, 0x81, 0x13,
+			0x91, 0x5f, 0x11, 0x00, 0x31, 0x80, 0x01, 0x00, 0x54, 0x2c, 0x24, 0xca, 0x9a, 0x8c, 0x0d, 0x40, 0xf2, 0xed, 0x17,
+			0x9f, 0x1a, 0x2d, 0x01, 0x0d, 0x2a, 0xbf, 0x01, 0x00, 0x72, 0x29, 0x15, 0x9f, 0x1a, 0x69, 0x00, 0x00, 0x36, 0x6c,
+			0x69, 0x6c, 0x38, 0x0c, 0x15, 0x00, 0x38, 0x4a, 0x11, 0x00, 0x51, 0xf4, 0xff, 0xff, 0x17, 0x69, 0x00, 0x00, 0x37,
+			0x09, 0x06, 0x80, 0x52, 0x09, 0x15, 0x00, 0x38, 0x08, 0x00, 0x00, 0xf9, 0xc0, 0x03, 0x5f, 0xd6, 0x08, 0x00, 0x40,
+			0xf9, 0x29, 0x00, 0x40, 0x39, 0x89, 0x00, 0x00, 0x34, 0x21, 0x04, 0x00, 0x91, 0x09, 0x15, 0x00, 0x38, 0xfc, 0xff,
+			0xff, 0x17, 0x08, 0x00, 0x00, 0xf9, 0xc0, 0x03, 0x5f, 0xd6, 0xe8, 0x0f, 0x40, 0xf9, 0x49, 0x01, 0x80, 0x52, 0x09,
+			0x15, 0x00, 0x38, 0xe8, 0x0f, 0x00, 0xf9, 0xc0, 0x03, 0x5f, 0xd6, 0x6c, 0x69, 0x62, 0x64, 0x79, 0x6c, 0x64, 0x5f,
+			0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x00, 0x6e, 0x6f, 0x74, 0x69, 0x66, 0x79, 0x4f, 0x62,
+			0x6a, 0x43, 0x49, 0x6e, 0x69, 0x74, 0x00, 0x72, 0x65, 0x73, 0x74, 0x61, 0x72, 0x74, 0x57, 0x69, 0x74, 0x68, 0x44,
+			0x79, 0x6c, 0x64, 0x49, 0x6e, 0x43, 0x61, 0x63, 0x68, 0x65, 0x00, 0x5f, 0x67, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73,
+			0x73, 0x49, 0x6e, 0x66, 0x6f, 0x00, 0x5f, 0x5f, 0x5a, 0x4e, 0x35, 0x64, 0x79, 0x6c, 0x64, 0x34, 0x31, 0x32, 0x67,
+			0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x49, 0x6e, 0x66, 0x6f, 0x45, 0x00, 0x5f, 0x5f, 0x5a, 0x4c, 0x31, 0x32,
+			0x73, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x49, 0x6e, 0x66, 0x6f, 0x00, 0x6c, 0x61, 0x75, 0x6e, 0x63, 0x68,
+			0x57, 0x69, 0x74, 0x68, 0x43, 0x6c, 0x6f, 0x73, 0x75, 0x72, 0x65, 0x00, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c,
+			0x69, 0x7a, 0x65, 0x4d, 0x61, 0x69, 0x6e, 0x45, 0x78, 0x65, 0x63, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x00, 0x72,
+			0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x54, 0x68, 0x72, 0x65, 0x61, 0x64, 0x48, 0x65, 0x6c, 0x70, 0x65, 0x72,
+			0x73, 0x00, 0x5f, 0x64, 0x6c, 0x6f, 0x70, 0x65, 0x6e, 0x00, 0x5f, 0x73, 0x74, 0x72, 0x63, 0x6d, 0x70, 0x00, 0x64,
+			0x6f, 0x4d, 0x6f, 0x64, 0x49, 0x6e, 0x69, 0x74, 0x46, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x00, 0x64,
+			0x6f, 0x47, 0x65, 0x74, 0x44, 0x4f, 0x46, 0x53, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x00, 0x64, 0x79, 0x6c,
+			0x64, 0x5f, 0x73, 0x69, 0x7a, 0x65, 0x00, 0x5f, 0x5f, 0x54, 0x45, 0x58, 0x54, 0x00, 0x5f, 0x5f, 0x4c, 0x49, 0x4e,
+			0x4b, 0x45, 0x44, 0x49, 0x54, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35,
+			0x36, 0x37, 0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66
 		};
 
 		private async SymbolSet resolve_symbols (SymbolQuery query, Cancellable? cancellable) throws GLib.Error {
@@ -1343,52 +1384,52 @@ namespace Frida.Fruity.Injector {
 		private const uint8[] SYMBOL_RESOLVER_CODE = {
 			0xff, 0xc3, 0x01, 0xd1, 0xfc, 0x6f, 0x01, 0xa9, 0xfa, 0x67, 0x02, 0xa9, 0xf8, 0x5f, 0x03, 0xa9, 0xf6, 0x57, 0x04,
 			0xa9, 0xf4, 0x4f, 0x05, 0xa9, 0xfd, 0x7b, 0x06, 0xa9, 0xfd, 0x83, 0x01, 0x91, 0xf5, 0x03, 0x02, 0xaa, 0xf3, 0x03,
-			0x01, 0xaa, 0xf4, 0x03, 0x00, 0xaa, 0x08, 0x00, 0x80, 0xd2, 0x49, 0x04, 0x40, 0xb9, 0x0a, 0x03, 0x80, 0x52, 0xeb,
-			0x07, 0x7d, 0xb2, 0x37, 0x2d, 0x0a, 0x9b, 0x76, 0x19, 0x00, 0x30, 0x1f, 0x20, 0x03, 0xd5, 0x18, 0x61, 0x00, 0x91,
+			0x01, 0xaa, 0xf4, 0x03, 0x00, 0xaa, 0x08, 0x00, 0x80, 0xd2, 0x49, 0x04, 0x40, 0xb9, 0x0a, 0x03, 0x80, 0x52, 0x29,
+			0x7d, 0xaa, 0x9b, 0x37, 0x61, 0x00, 0x91, 0x16, 0x00, 0x00, 0x90, 0xd6, 0xa6, 0x0d, 0x91, 0x18, 0x61, 0x00, 0x91,
 			0xff, 0x02, 0x18, 0xeb, 0x60, 0x01, 0x00, 0x54, 0xb9, 0x06, 0x40, 0xf9, 0x28, 0x03, 0x08, 0x8b, 0x00, 0x05, 0x40,
-			0xf9, 0xe1, 0x03, 0x16, 0xaa, 0xad, 0x00, 0x00, 0x94, 0xe8, 0x03, 0x18, 0xaa, 0xe0, 0xfe, 0xff, 0x34, 0x28, 0x03,
-			0x18, 0x8b, 0x08, 0x81, 0x5e, 0xf8, 0x02, 0x00, 0x00, 0x14, 0x08, 0x00, 0x80, 0xd2, 0x19, 0x00, 0x80, 0xd2, 0xe8,
-			0x7f, 0x00, 0xa9, 0x16, 0x00, 0x80, 0xd2, 0x1b, 0x00, 0x80, 0xd2, 0x1c, 0x81, 0x00, 0x91, 0x1a, 0x11, 0x40, 0xb9,
-			0x58, 0x04, 0x80, 0x52, 0x18, 0x00, 0xb0, 0x72, 0x75, 0x06, 0x80, 0x52, 0x15, 0x00, 0xb0, 0x72, 0x5a, 0x04, 0x00,
-			0x34, 0x88, 0x03, 0x40, 0xb9, 0x1f, 0x01, 0x18, 0x6b, 0xa0, 0x01, 0x00, 0x54, 0x1f, 0x01, 0x15, 0x6b, 0xa0, 0x01,
-			0x00, 0x54, 0x1f, 0x65, 0x00, 0x71, 0x81, 0x01, 0x00, 0x54, 0x97, 0x23, 0x00, 0x91, 0xe0, 0x03, 0x17, 0xaa, 0x41,
-			0x14, 0x00, 0x70, 0x1f, 0x20, 0x03, 0xd5, 0x90, 0x00, 0x00, 0x94, 0x60, 0x01, 0x00, 0x34, 0x99, 0x0f, 0x40, 0xf9,
-			0x04, 0x00, 0x00, 0x14, 0xf6, 0x03, 0x1c, 0xaa, 0x02, 0x00, 0x00, 0x14, 0xfb, 0x03, 0x1c, 0xaa, 0x88, 0x07, 0x40,
-			0xb9, 0x9c, 0x03, 0x08, 0x8b, 0x5a, 0x07, 0x00, 0x51, 0x7a, 0xfd, 0xff, 0x35, 0x0b, 0x00, 0x00, 0x14, 0xe0, 0x03,
-			0x17, 0xaa, 0xa1, 0x12, 0x00, 0x50, 0x1f, 0x20, 0x03, 0xd5, 0x81, 0x00, 0x00, 0x94, 0xe0, 0xfe, 0xff, 0x34, 0x88,
+			0xf9, 0xe1, 0x03, 0x16, 0xaa, 0xaf, 0x00, 0x00, 0x94, 0xe8, 0x03, 0x18, 0xaa, 0xe0, 0xfe, 0xff, 0x34, 0x28, 0x03,
+			0x18, 0x8b, 0x08, 0x81, 0x5e, 0xf8, 0x02, 0x00, 0x00, 0x14, 0x08, 0x00, 0x80, 0xd2, 0x18, 0x00, 0x80, 0xd2, 0xe8,
+			0x7f, 0x00, 0xa9, 0x1a, 0x00, 0x80, 0xd2, 0x1b, 0x00, 0x80, 0xd2, 0x1c, 0x81, 0x00, 0x91, 0x16, 0x11, 0x40, 0xb9,
+			0x59, 0x04, 0x80, 0x52, 0x19, 0x00, 0xb0, 0x72, 0x77, 0x06, 0x80, 0x52, 0x17, 0x00, 0xb0, 0x72, 0x15, 0x00, 0x00,
+			0x90, 0xb5, 0x5e, 0x0d, 0x91, 0x16, 0x04, 0x00, 0x34, 0x88, 0x03, 0x40, 0xb9, 0x1f, 0x01, 0x19, 0x6b, 0xa0, 0x01,
+			0x00, 0x54, 0x1f, 0x01, 0x17, 0x6b, 0x20, 0x01, 0x00, 0x54, 0x1f, 0x65, 0x00, 0x71, 0x41, 0x01, 0x00, 0x54, 0x80,
+			0x23, 0x00, 0x91, 0xe1, 0x03, 0x15, 0xaa, 0x92, 0x00, 0x00, 0x94, 0x60, 0x01, 0x00, 0x34, 0x98, 0x0f, 0x40, 0xf9,
+			0x04, 0x00, 0x00, 0x14, 0xfb, 0x03, 0x1c, 0xaa, 0x02, 0x00, 0x00, 0x14, 0xfa, 0x03, 0x1c, 0xaa, 0x88, 0x07, 0x40,
+			0xb9, 0x9c, 0x03, 0x08, 0x8b, 0xd6, 0x06, 0x00, 0x51, 0xb6, 0xfd, 0xff, 0x35, 0x0b, 0x00, 0x00, 0x14, 0x80, 0x23,
+			0x00, 0x91, 0x01, 0x00, 0x00, 0x90, 0x21, 0x78, 0x0d, 0x91, 0x83, 0x00, 0x00, 0x94, 0xe0, 0xfe, 0xff, 0x34, 0x88,
 			0x0f, 0x40, 0xf9, 0x89, 0x17, 0x40, 0xf9, 0x08, 0x01, 0x09, 0xcb, 0xe8, 0x07, 0x00, 0xf9, 0xf2, 0xff, 0xff, 0x17,
-			0x96, 0x00, 0x00, 0xb4, 0xc8, 0xa2, 0x00, 0x91, 0xf7, 0x03, 0x40, 0xf9, 0x04, 0x00, 0x00, 0x14, 0xf7, 0x03, 0x40,
-			0xf9, 0xbb, 0x05, 0x00, 0xb4, 0x68, 0x23, 0x00, 0x91, 0xe9, 0x02, 0x19, 0xcb, 0xea, 0x07, 0x40, 0xf9, 0x49, 0x01,
-			0x09, 0x8b, 0x08, 0x01, 0x40, 0xb9, 0x35, 0x01, 0x08, 0x8b, 0x61, 0x0f, 0x00, 0x10, 0x1f, 0x20, 0x03, 0xd5, 0xe0,
-			0x03, 0x15, 0xaa, 0x31, 0x00, 0x00, 0x94, 0xf6, 0x02, 0x00, 0x8b, 0x01, 0x0f, 0x00, 0x10, 0x1f, 0x20, 0x03, 0xd5,
+			0x9a, 0x00, 0x00, 0xb4, 0x48, 0xa3, 0x00, 0x91, 0xf7, 0x03, 0x40, 0xf9, 0x04, 0x00, 0x00, 0x14, 0xf7, 0x03, 0x40,
+			0xf9, 0xbb, 0x05, 0x00, 0xb4, 0x68, 0x23, 0x00, 0x91, 0xe9, 0x02, 0x18, 0xcb, 0xea, 0x07, 0x40, 0xf9, 0x49, 0x01,
+			0x09, 0x8b, 0x08, 0x01, 0x40, 0xb9, 0x35, 0x01, 0x08, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21, 0x20, 0x0d, 0x91, 0xe0,
+			0x03, 0x15, 0xaa, 0x31, 0x00, 0x00, 0x94, 0xf6, 0x02, 0x00, 0x8b, 0x01, 0x00, 0x00, 0x90, 0x21, 0x40, 0x0d, 0x91,
 			0xe0, 0x03, 0x15, 0xaa, 0x2c, 0x00, 0x00, 0x94, 0xf7, 0x02, 0x00, 0x8b, 0x80, 0x02, 0x40, 0xf9, 0x60, 0x02, 0x00,
 			0xb4, 0x21, 0x01, 0x80, 0x52, 0xc0, 0x02, 0x3f, 0xd6, 0x40, 0x01, 0x00, 0xb4, 0xf5, 0x03, 0x00, 0xaa, 0x94, 0x42,
 			0x00, 0x91, 0x81, 0x82, 0x5f, 0xf8, 0x01, 0xff, 0xff, 0xb4, 0xe0, 0x03, 0x15, 0xaa, 0xe0, 0x02, 0x3f, 0xd6, 0x60,
 			0x86, 0x00, 0xf8, 0x94, 0x22, 0x00, 0x91, 0xfa, 0xff, 0xff, 0x17, 0x94, 0x42, 0x00, 0x91, 0x88, 0x82, 0x5f, 0xf8,
 			0x08, 0xfe, 0xff, 0xb4, 0x7f, 0x86, 0x00, 0xf8, 0x94, 0x22, 0x00, 0x91, 0xfc, 0xff, 0xff, 0x17, 0xfd, 0x7b, 0x46,
 			0xa9, 0xf4, 0x4f, 0x45, 0xa9, 0xf6, 0x57, 0x44, 0xa9, 0xf8, 0x5f, 0x43, 0xa9, 0xfa, 0x67, 0x42, 0xa9, 0xfc, 0x6f,
-			0x41, 0xa9, 0xff, 0xc3, 0x01, 0x91, 0xc0, 0x03, 0x5f, 0xd6, 0x15, 0x00, 0x80, 0xd2, 0xd9, 0xff, 0xff, 0x17, 0xe8,
-			0x03, 0x00, 0xaa, 0x0a, 0x00, 0x80, 0xd2, 0x00, 0x00, 0x80, 0xd2, 0x09, 0x01, 0x40, 0xf9, 0x2b, 0x15, 0x40, 0x38,
-			0x6c, 0x19, 0x40, 0x92, 0x8c, 0x21, 0xca, 0x9a, 0x80, 0x01, 0x00, 0xaa, 0x4a, 0x1d, 0x00, 0x91, 0x6b, 0xff, 0x3f,
-			0x37, 0x09, 0x01, 0x00, 0xf9, 0xc0, 0x03, 0x5f, 0xd6, 0xff, 0x43, 0x01, 0xd1, 0xf8, 0x5f, 0x01, 0xa9, 0xf6, 0x57,
+			0x41, 0xa9, 0xff, 0xc3, 0x01, 0x91, 0xc0, 0x03, 0x5f, 0xd6, 0x15, 0x00, 0x80, 0xd2, 0xd9, 0xff, 0xff, 0x17, 0x09,
+			0x00, 0x80, 0xd2, 0x08, 0x00, 0x80, 0xd2, 0x0a, 0x00, 0x40, 0xf9, 0x4b, 0x15, 0x40, 0x38, 0x6c, 0x19, 0x40, 0x92,
+			0x8c, 0x21, 0xc9, 0x9a, 0x88, 0x01, 0x08, 0xaa, 0x29, 0x1d, 0x00, 0x91, 0x6b, 0xff, 0x3f, 0x37, 0x0a, 0x00, 0x00,
+			0xf9, 0xe0, 0x03, 0x08, 0xaa, 0xc0, 0x03, 0x5f, 0xd6, 0xff, 0x43, 0x01, 0xd1, 0xf8, 0x5f, 0x01, 0xa9, 0xf6, 0x57,
 			0x02, 0xa9, 0xf4, 0x4f, 0x03, 0xa9, 0xfd, 0x7b, 0x04, 0xa9, 0xfd, 0x03, 0x01, 0x91, 0xf4, 0x03, 0x01, 0xaa, 0xf3,
-			0x03, 0x00, 0xaa, 0xe8, 0x03, 0x00, 0xaa, 0xe8, 0x07, 0x00, 0xf9, 0xc8, 0x04, 0x00, 0xb4, 0x3a, 0x00, 0x00, 0x94,
-			0x60, 0x00, 0x00, 0xb4, 0x88, 0x02, 0x40, 0x39, 0x88, 0x04, 0x00, 0x34, 0x15, 0x00, 0x80, 0x52, 0xe8, 0x07, 0x40,
-			0xf9, 0x08, 0x01, 0x00, 0x8b, 0x16, 0x15, 0x40, 0x38, 0xe8, 0x07, 0x00, 0xf9, 0xdf, 0x02, 0x35, 0x6b, 0xc0, 0x02,
+			0x03, 0x00, 0xaa, 0xe8, 0x03, 0x00, 0xaa, 0xe8, 0x07, 0x00, 0xf9, 0x08, 0x05, 0x00, 0xb4, 0x39, 0x00, 0x00, 0x94,
+			0x88, 0x02, 0x40, 0x39, 0x48, 0x00, 0x00, 0x35, 0xc0, 0x04, 0x00, 0xb5, 0x15, 0x00, 0x80, 0x52, 0xe8, 0x07, 0x40,
+			0xf9, 0x08, 0x01, 0x00, 0x8b, 0x16, 0x15, 0x40, 0x38, 0xe8, 0x07, 0x00, 0xf9, 0xdf, 0x02, 0x35, 0x6b, 0xa0, 0x02,
 			0x00, 0x54, 0xe8, 0x07, 0x40, 0xf9, 0x08, 0x05, 0x00, 0x91, 0x38, 0x00, 0x80, 0x52, 0xf7, 0x03, 0x14, 0xaa, 0x09,
 			0xf1, 0x5f, 0x38, 0x49, 0x01, 0x00, 0x34, 0xb8, 0x00, 0x00, 0x36, 0xea, 0x16, 0xc0, 0x38, 0x3f, 0x01, 0x0a, 0x6b,
 			0xf8, 0x17, 0x9f, 0x1a, 0x02, 0x00, 0x00, 0x14, 0x18, 0x00, 0x80, 0x52, 0xe8, 0x07, 0x00, 0xf9, 0x08, 0x05, 0x00,
-			0x91, 0xf6, 0xff, 0xff, 0x17, 0xe8, 0x07, 0x00, 0xf9, 0x1f, 0x00, 0x00, 0x94, 0xb5, 0x06, 0x00, 0x11, 0x98, 0xfd,
-			0x07, 0x36, 0xf4, 0x03, 0x17, 0xaa, 0x02, 0x00, 0x00, 0x14, 0x00, 0x00, 0x80, 0xd2, 0x68, 0x02, 0x00, 0x8b, 0x1f,
-			0x00, 0x00, 0xf1, 0xe8, 0x03, 0x88, 0x9a, 0xda, 0xff, 0xff, 0x17, 0x00, 0x00, 0x80, 0xd2, 0x03, 0x00, 0x00, 0x14,
-			0x13, 0x00, 0x00, 0x94, 0x12, 0x00, 0x00, 0x94, 0xfd, 0x7b, 0x44, 0xa9, 0xf4, 0x4f, 0x43, 0xa9, 0xf6, 0x57, 0x42,
-			0xa9, 0xf8, 0x5f, 0x41, 0xa9, 0xff, 0x43, 0x01, 0x91, 0xc0, 0x03, 0x5f, 0xd6, 0x08, 0x00, 0x40, 0x39, 0x29, 0x00,
-			0x40, 0x39, 0x1f, 0x01, 0x09, 0x6b, 0xc1, 0x00, 0x00, 0x54, 0x00, 0x04, 0x00, 0x91, 0x21, 0x04, 0x00, 0x91, 0x48,
-			0xff, 0xff, 0x35, 0x20, 0x00, 0x80, 0x52, 0xc0, 0x03, 0x5f, 0xd6, 0x00, 0x00, 0x80, 0x52, 0xc0, 0x03, 0x5f, 0xd6,
-			0xe0, 0x23, 0x00, 0x91, 0xae, 0xff, 0xff, 0x17, 0x5f, 0x64, 0x6c, 0x6f, 0x70, 0x65, 0x6e, 0x00, 0x5f, 0x64, 0x6c,
-			0x73, 0x79, 0x6d, 0x00, 0x5f, 0x5f, 0x54, 0x45, 0x58, 0x54, 0x00, 0x5f, 0x5f, 0x4c, 0x49, 0x4e, 0x4b, 0x45, 0x44,
-			0x49, 0x54, 0x00, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x6c, 0x69, 0x62, 0x2f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2f,
-			0x6c, 0x69, 0x62, 0x64, 0x79, 0x6c, 0x64, 0x2e, 0x64, 0x79, 0x6c, 0x69, 0x62, 0x00
+			0x91, 0xf6, 0xff, 0xff, 0x17, 0xe8, 0x07, 0x00, 0xf9, 0x1e, 0x00, 0x00, 0x94, 0xb8, 0x00, 0x00, 0x37, 0xb5, 0x06,
+			0x00, 0x11, 0xeb, 0xff, 0xff, 0x17, 0xf7, 0x03, 0x14, 0xaa, 0x04, 0x00, 0x00, 0x14, 0x68, 0x02, 0x00, 0x8b, 0xf4,
+			0x03, 0x17, 0xaa, 0x60, 0xfb, 0xff, 0xb5, 0x08, 0x00, 0x80, 0xd2, 0xf4, 0x03, 0x17, 0xaa, 0xd8, 0xff, 0xff, 0x17,
+			0x00, 0x00, 0x80, 0xd2, 0x03, 0x00, 0x00, 0x14, 0x10, 0x00, 0x00, 0x94, 0x0f, 0x00, 0x00, 0x94, 0xfd, 0x7b, 0x44,
+			0xa9, 0xf4, 0x4f, 0x43, 0xa9, 0xf6, 0x57, 0x42, 0xa9, 0xf8, 0x5f, 0x41, 0xa9, 0xff, 0x43, 0x01, 0x91, 0xc0, 0x03,
+			0x5f, 0xd6, 0x08, 0x14, 0x40, 0x38, 0x29, 0x14, 0x40, 0x38, 0x1f, 0x01, 0x00, 0x71, 0x00, 0x11, 0x49, 0x7a, 0x80,
+			0xff, 0xff, 0x54, 0x1f, 0x01, 0x09, 0x6b, 0xe0, 0x17, 0x9f, 0x1a, 0xc0, 0x03, 0x5f, 0xd6, 0xe0, 0x23, 0x00, 0x91,
+			0xaf, 0xff, 0xff, 0x17, 0x5f, 0x64, 0x6c, 0x6f, 0x70, 0x65, 0x6e, 0x00, 0x5f, 0x64, 0x6c, 0x73, 0x79, 0x6d, 0x00,
+			0x5f, 0x5f, 0x54, 0x45, 0x58, 0x54, 0x00, 0x5f, 0x5f, 0x4c, 0x49, 0x4e, 0x4b, 0x45, 0x44, 0x49, 0x54, 0x00, 0x2f,
+			0x75, 0x73, 0x72, 0x2f, 0x6c, 0x69, 0x62, 0x2f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2f, 0x6c, 0x69, 0x62, 0x64,
+			0x79, 0x6c, 0x64, 0x2e, 0x64, 0x79, 0x6c, 0x69, 0x62, 0x00
 		};
 
 		private string demangle (string symbol_name) {
@@ -1470,7 +1511,7 @@ namespace Frida.Fruity.Injector {
 			public uint64 get (string module_name, string symbol_name) throws Error {
 				uint64 address;
 				if (!lookup (module_name, symbol_name, out address))
-					throw new Error.UNSUPPORTED ("Symbol not found: %s", symbol_name);
+					throw new Error.NOT_SUPPORTED ("Symbol not found: %s", symbol_name);
 				return address;
 			}
 
@@ -1655,13 +1696,35 @@ namespace Frida.Fruity.Injector {
 				if (pc == 1337)
 					break;
 
+				if ((LLDB.Signal) exception.signum == SIGTRAP && exception.metype == EXC_BREAKPOINT) {
+					uint64 x1 = exception.context["x1"];
+					uint64 x2 = exception.context["x2"];
+					var action = (GadgetBreakpointAction) exception.context["x3"];
+
+					if (x1 == x2 == 1337 && action == INVOKE_RETURN)
+						break;
+
+					if (x1 == x2 == 1337 && action == PAGE_PLAN) {
+						var plan_size = (size_t) exception.context["x4"];
+						var plan_address = exception.context["x5"];
+						yield DebuggerMappings.handle_page_plan (lldb, plan_address, plan_size, page_size,
+							cancellable);
+
+						var thread = exception.thread;
+						yield thread.write_register ("x0", 0x1337, cancellable);
+						yield thread.write_register ("pc", pc + 4, cancellable);
+
+						continue;
+					}
+				}
+
 				if (exception_handler != null) {
 					bool handled = yield exception_handler.try_handle_exception (exception, cancellable);
 					if (handled)
 						continue;
 				}
 
-				throw new Error.UNSUPPORTED ("Invocation of 0x%" + uint64.FORMAT_MODIFIER + "x crashed at %s",
+				throw new Error.NOT_SUPPORTED ("Invocation of 0x%" + uint64.FORMAT_MODIFIER + "x crashed at %s",
 					impl, yield summarize_exception (exception, cancellable));
 			}
 

src/fruity/ncm.vala

@@ -31,9 +31,18 @@ namespace Frida.Fruity {
 		private uint16 ntb_out_max_datagrams;
 		private size_t max_in_transfers;
 		private size_t max_out_transfers;
+		private size_t max_out_bytes_in_flight;
+		private uint16 ndp_reserved_slots;
+		private uint16 ndp_fixed_header_size;
+
 		private VirtualNetworkStack? _netstack;
+		private Gee.Queue<Bytes> pending_input = new Gee.ArrayQueue<Bytes> ();
+		private bool input_flush_scheduled = false;
 		private Gee.Queue<Bytes> pending_output = new Gee.ArrayQueue<Bytes> ();
-		private bool writing = false;
+		private size_t out_in_flight_count = 0;
+		private size_t out_in_flight_bytes = 0;
+		private Gee.Map<Future<uint>, uint16> out_in_flight_sizes = new Gee.HashMap<Future<uint>, uint16> ();
+		private bool out_topup_scheduled = false;
 		private uint16 next_outgoing_sequence = 1;
 
 		private InetAddress? _remote_ipv6_address;
@@ -115,7 +124,7 @@ namespace Frida.Fruity {
 			ndp_out_divisor = ntb_params.read_uint16 (20);
 			ndp_out_payload_remainder = ntb_params.read_uint16 (22);
 			ndp_out_alignment = ntb_params.read_uint16 (24);
-			ntb_out_max_datagrams = uint16.min (ntb_params.read_uint16 (26), 16);
+			ntb_out_max_datagrams = ntb_params.read_uint16 (26);
 
 			if (ntb_in_max_size != device_ntb_in_max_size) {
 				var ntb_size_buf = new BufferBuilder (LITTLE_ENDIAN)
@@ -137,17 +146,24 @@ namespace Frida.Fruity {
 				max_out_transfers = (5 * MAX_TRANSFER_MEMORY) / ntb_out_max_size;
 			} else if (speed == LibUSB.Speed.HIGH) {
 				max_in_transfers = MAX_TRANSFER_MEMORY / ntb_in_max_size;
-				max_out_transfers = MAX_TRANSFER_MEMORY / ntb_out_max_size;
+				max_out_transfers = (3 * MAX_TRANSFER_MEMORY) / ntb_out_max_size;
+				max_out_transfers = size_t.max (max_out_transfers, 6);
+				max_out_transfers = size_t.min (max_out_transfers, 16);
 			} else {
 				max_in_transfers = 4;
 				max_out_transfers = 4;
 			}
 
+			max_out_bytes_in_flight = 4 * MAX_TRANSFER_MEMORY;
+
+			ndp_reserved_slots = (uint16) uint16.min (21, ntb_out_max_datagrams);
+			ndp_fixed_header_size = (uint16) align (8 + (ndp_reserved_slots * 4) + 4, ndp_out_alignment);
+
 			Usb.check (handle.set_interface_alt_setting (config.data_iface, config.data_altsetting),
 				"Failed to set USB interface alt setting");
 
 			_netstack = new VirtualNetworkStack (new Bytes (mac_address), null, 1500);
-			_netstack.outgoing_datagram.connect (on_netif_outgoing_datagram);
+			_netstack.outgoing_datagrams.connect (on_netif_outgoing_datagrams);
 
 			process_incoming_datagrams.begin ();
 
@@ -234,63 +250,96 @@ namespace Frida.Fruity {
 							notify_property ("remote-ipv6-address");
 					}
 
-					_netstack.handle_incoming_datagram (datagram);
+					on_incoming_datagram (datagram);
 				}
 
 				ndp_index = next_ndp_index;
 			} while (ndp_index != 0);
 		}
 
-		private void on_netif_outgoing_datagram (Bytes datagram) {
-			pending_output.offer (datagram);
+		private void on_incoming_datagram (Bytes datagram) {
+			pending_input.offer (datagram);
 
-			if (!writing) {
-				writing = true;
+			if (!input_flush_scheduled) {
 				var source = new IdleSource ();
 				source.set_callback (() => {
-					process_pending_output.begin ();
-					return false;
+					input_flush_scheduled = false;
+					flush_pending_input ();
+					return Source.REMOVE;
 				});
 				source.attach (MainContext.get_thread_default ());
+				input_flush_scheduled = true;
 			}
 		}
 
-		private async void process_pending_output () {
+		private void flush_pending_input () {
+			var datagrams = pending_input;
+			pending_input = new Gee.ArrayQueue<Bytes> ();
 			try {
-				while (!pending_output.is_empty) {
-					var pending = new Gee.ArrayList<Promise<uint>> ();
-
-					do {
-						var request = transfer_next_output_batch ();
-						pending.add (request);
-					} while (pending.size < max_out_transfers && !pending_output.is_empty);
-
-					foreach (var request in pending)
-						yield request.future.wait_async (io_cancellable);
-				}
-			} catch (GLib.Error e) {
-			} finally {
-				writing = false;
+				_netstack.handle_incoming_datagrams (datagrams);
+			} catch (Error e) {
 			}
 		}
 
-		private Promise<uint> transfer_next_output_batch () {
-			size_t num_datagrams = ntb_out_max_datagrams;
-			TransferLayout layout;
-			while ((layout = TransferLayout.compute (pending_output, num_datagrams, ndp_out_alignment,
-					ndp_out_divisor, ndp_out_payload_remainder)).size > ntb_out_max_size) {
-				num_datagrams--;
+		private void on_netif_outgoing_datagrams (Gee.Collection<Bytes> datagrams) {
+			foreach (var d in datagrams)
+				pending_output.offer (d);
+
+			schedule_top_up ();
+		}
+
+		private void schedule_top_up () {
+			if (out_topup_scheduled)
+				return;
+			out_topup_scheduled = true;
+
+			var source = new IdleSource ();
+			source.set_callback (() => {
+				out_topup_scheduled = false;
+				top_up_output_window ();
+				return Source.REMOVE;
+			});
+			source.attach (MainContext.get_thread_default ());
+		}
+
+		private void top_up_output_window () {
+			while (!pending_output.is_empty && out_in_flight_count < max_out_transfers) {
+				size_t max_datagrams = size_t.min (pending_output.size, (size_t) ndp_reserved_slots);
+				var layout = TransferLayout.compute (pending_output, max_datagrams, ntb_out_max_size, ndp_fixed_header_size,
+					ndp_out_alignment, ndp_out_divisor, ndp_out_payload_remainder);
+				if ((out_in_flight_bytes + layout.size) > max_out_bytes_in_flight)
+					break;
+
+				var batch = new Gee.ArrayList<Bytes> ();
+				for (var i = 0; i != layout.offsets.length; i++)
+					batch.add (pending_output.poll ());
+				var transfer = build_output_transfer (batch, layout, next_outgoing_sequence++);
+
+				var request = new Promise<uint> ();
+				do_transfer_output_batch.begin (transfer, request);
+
+				out_in_flight_count++;
+				out_in_flight_bytes += layout.size;
+
+				out_in_flight_sizes.set (request.future, layout.size);
+
+				request.future.then (fut => {
+					on_output_completed (fut);
+				});
 			}
+		}
 
-			var batch = new Gee.ArrayList<Bytes> ();
-			for (var i = 0; i != layout.offsets.size; i++)
-				batch.add (pending_output.poll ());
+		private void on_output_completed (Future<uint> fut) {
+			uint16 size;
+			out_in_flight_sizes.unset (fut, out size);
 
-			var transfer = build_output_transfer (batch, layout, next_outgoing_sequence++);
+			out_in_flight_count--;
+			out_in_flight_bytes -= size;
 
-			var request = new Promise<uint> ();
-			do_transfer_output_batch.begin (transfer, request);
-			return request;
+			if (fut.error != null)
+				return;
+
+			top_up_output_window ();
 		}
 
 		private async void do_transfer_output_batch (Bytes transfer, Promise<uint> request) {
@@ -306,53 +355,45 @@ namespace Frida.Fruity {
 			public uint16 size;
 			public uint16 ndp_header_offset;
 			public uint16 ndp_header_size;
-			public Gee.List<uint16> offsets;
+			public uint16[] offsets;
 
-			public static TransferLayout compute (Gee.Collection<Bytes> datagrams, size_t max_datagrams, size_t ndp_alignment,
+			public static TransferLayout compute (Gee.Collection<Bytes> datagrams, size_t max_datagrams,
+					uint32 max_transfer_size, uint16 ndp_fixed_header_size, size_t ndp_alignment,
 					size_t datagram_modulus, size_t datagram_remainder) {
-				size_t ndp_header_base_size = 4 + 2 + 2;
-				size_t ndp_entry_size = 2 + 2;
 				size_t ethernet_header_size = 14;
 
 				size_t ndp_header_offset = align (TRANSFER_HEADER_SIZE, ndp_alignment, 0);
-				size_t num_datagram_slots = size_t.min (datagrams.size, max_datagrams);
-				size_t ndp_header_size = ndp_header_base_size + ((num_datagram_slots + 1) * ndp_entry_size);
 
-				size_t current_transfer_size = ndp_header_offset + ndp_header_size;
-				var offsets = new Gee.ArrayList<uint16> ();
+				size_t current_transfer_size = ndp_header_offset + ndp_fixed_header_size;
+				var offsets = new uint16[max_datagrams];
 
-				uint i = 0;
+				int i = 0;
 				foreach (var datagram in datagrams) {
 					var size = (uint16) datagram.get_size ();
 
 					size_t start_offset =
 						align (current_transfer_size + ethernet_header_size, datagram_modulus, datagram_remainder);
 					size_t end_offset = start_offset + size;
-					if (end_offset > uint16.MAX)
+					if (end_offset > uint16.MAX || end_offset > max_transfer_size)
 						break;
 
 					current_transfer_size = end_offset;
-					offsets.add ((uint16) start_offset);
+					offsets[i] = (uint16) start_offset;
 
 					i++;
 					if (i == max_datagrams)
 						break;
 				}
 
+				offsets.resize (i);
+
 				return new TransferLayout () {
 					size = (uint16) current_transfer_size,
 					ndp_header_offset = (uint16) ndp_header_offset,
-					ndp_header_size = (uint16) ndp_header_size,
-					offsets = offsets,
+					ndp_header_size = ndp_fixed_header_size,
+					offsets = (owned) offsets,
 				};
 			}
-
-			private static size_t align (size_t val, size_t modulus, size_t remainder) {
-				var delta = val % modulus;
-				if (delta != remainder)
-					return val + modulus - delta + remainder;
-				return val;
-			}
 		}
 
 		private static Bytes build_output_transfer (Gee.List<Bytes> datagrams, TransferLayout layout, uint16 sequence_number) {
@@ -409,6 +450,13 @@ namespace Frida.Fruity {
 
 			return new InetAddress.from_bytes (datagram[22:22 + 16].get_data (), IPV6);
 		}
+
+		private static size_t align (size_t val, size_t modulus, size_t remainder = 0) {
+			var delta = val % modulus;
+			if (delta != remainder)
+				return val + modulus - delta + remainder;
+			return val;
+		}
 	}
 
 	internal sealed class UsbNcmConfig {

src/fruity/network-stack.vala

@@ -149,7 +149,7 @@ namespace Frida.Fruity {
 	}
 
 	public sealed class VirtualNetworkStack : Object, NetworkStack {
-		public signal void outgoing_datagram (Bytes datagram);
+		public signal void outgoing_datagrams (Gee.Collection<Bytes> datagrams);
 
 		public Bytes? ethernet_address {
 			get;
@@ -182,6 +182,8 @@ namespace Frida.Fruity {
 
 		private State state = STARTED;
 
+		private Gee.Queue<Bytes>? pending_outgoing;
+
 		private Gee.Queue<Request> requests = new Gee.ArrayQueue<Request> ();
 		private unowned Thread<bool>? lwip_thread;
 
@@ -281,16 +283,26 @@ namespace Frida.Fruity {
 			return new Ipv6UdpSocket (this);
 		}
 
-		public void handle_incoming_datagram (Bytes datagram) throws Error {
+		public void handle_incoming_datagrams (Gee.Collection<Bytes> datagrams) throws Error {
 			check_started ();
 
 			check (perform_on_lwip_thread (() => {
-				var pbuf = LWIP.PacketBuffer.alloc (RAW, (uint16) datagram.get_size (), POOL);
-				pbuf.take (datagram.get_data ());
+				begin_output ();
 
-				var err = handle.input (pbuf, ref handle);
-				if (err == OK)
-					*((void **) &pbuf) = null;
+				LWIP.ErrorCode err = OK;
+
+				foreach (var d in datagrams) {
+					var pbuf = LWIP.PacketBuffer.alloc (RAW, (uint16) d.get_size (), POOL);
+					pbuf.take (d.get_data ());
+
+					err = handle.input (pbuf, ref handle);
+					if (err == OK)
+						*((void **) &pbuf) = null;
+					else
+						break;
+				}
+
+				end_output ();
 
 				return err;
 			}));
@@ -309,14 +321,39 @@ namespace Frida.Fruity {
 			return OK;
 		}
 
+		internal void begin_output () {
+			pending_outgoing = new Gee.ArrayQueue<Bytes> ();
+		}
+
+		internal void end_output () {
+			var datagrams = pending_outgoing;
+			pending_outgoing = null;
+			if (datagrams.is_empty)
+				return;
+
+			schedule_on_frida_thread (() => {
+				if (state == STARTED)
+					outgoing_datagrams (datagrams);
+				return Source.REMOVE;
+			});
+		}
+
 		private void emit_datagram (LWIP.PacketBuffer pbuf) {
 			var buffer = new uint8[pbuf.tot_len];
 			unowned uint8[] packet = pbuf.get_contiguous (buffer, pbuf.tot_len);
 			var datagram = new Bytes (packet[:pbuf.tot_len]);
 
+			if (pending_outgoing != null) {
+				pending_outgoing.offer (datagram);
+				return;
+			}
+
 			schedule_on_frida_thread (() => {
-				if (state == STARTED)
-					outgoing_datagram (datagram);
+				if (state == STARTED) {
+					var datagrams = new Gee.ArrayQueue<Bytes> ();
+					datagrams.offer (datagram);
+					outgoing_datagrams (datagrams);
+				}
 				return Source.REMOVE;
 			});
 		}
@@ -713,7 +750,10 @@ namespace Frida.Fruity {
 						}
 					}
 
+					netstack.begin_output ();
 					var output_err = pcb.output ();
+					netstack.end_output ();
+
 					if (output_err == RTE)
 						return output_err;
 

src/fruity/xpc.vala

@@ -126,6 +126,8 @@ namespace Frida.Fruity {
 	public sealed class PairingService : Object, AsyncInitable {
 		public const string DNS_SD_NAME = "_remotepairing._tcp.local";
 
+		private signal void events_received (ObjectReader events);
+
 		public PairingTransport transport {
 			get;
 			construct;
@@ -151,8 +153,7 @@ namespace Frida.Fruity {
 			private set;
 		}
 
-		private Gee.Map<uint64?, Promise<ObjectReader>> requests =
-			new Gee.HashMap<uint64?, Promise<ObjectReader>> (Numeric.uint64_hash, Numeric.uint64_equal);
+		private Gee.Queue<Promise<ObjectReader>> requests = new Gee.ArrayQueue<Promise<ObjectReader>> ();
 		private uint64 next_control_sequence_number = 0;
 		private uint64 next_encrypted_sequence_number = 0;
 
@@ -738,11 +739,30 @@ namespace Frida.Fruity {
 				.end_dictionary ()
 				.build ();
 
-			ObjectReader response = yield request_plain (wrapper, cancellable);
+			var promise = new Promise<ObjectReader> ();
+			var pairing_handler = events_received.connect (reader => {
+				try {
+					reader
+						.read_member ("plain")
+						.read_member ("_0")
+						.read_member ("event")
+						.read_member ("_0");
 
-			response
-				.read_member ("event")
-				.read_member ("_0");
+					if (reader.has_member ("pairingData") || reader.has_member ("pairingRejectedWithError"))
+						promise.resolve (reader);
+				} catch (Error e) {
+					promise.reject (e);
+					return;
+				}
+			});
+
+			ObjectReader response = null;
+			try {
+				yield post_plain (wrapper, cancellable);
+				response = yield promise.future.wait_async (cancellable);
+			} finally {
+				disconnect (pairing_handler);
+			}
 
 			if (response.has_member ("pairingRejectedWithError")) {
 				string description = response
@@ -766,12 +786,12 @@ namespace Frida.Fruity {
 		private async ObjectReader request_plain (Bytes payload, Cancellable? cancellable) throws Error, IOError {
 			uint64 seqno = next_control_sequence_number++;
 			var promise = new Promise<ObjectReader> ();
-			requests[seqno] = promise;
+			requests.offer (promise);
 
 			try {
 				yield post_plain_with_sequence_number (seqno, payload, cancellable);
 			} catch (GLib.Error e) {
-				if (requests.unset (seqno))
+				if (requests.remove (promise))
 					promise.reject (e);
 			}
 
@@ -810,7 +830,7 @@ namespace Frida.Fruity {
 		private async string request_encrypted (string json, Cancellable? cancellable) throws Error, IOError {
 			uint64 seqno = next_control_sequence_number++;
 			var promise = new Promise<ObjectReader> ();
-			requests[seqno] = promise;
+			requests.offer (promise);
 
 			Bytes iv = new BufferBuilder (LITTLE_ENDIAN)
 				.append_uint64 (next_encrypted_sequence_number++)
@@ -856,7 +876,7 @@ namespace Frida.Fruity {
 			var e = (error != null)
 				? error
 				: new Error.TRANSPORT ("Connection closed while waiting for response");
-			foreach (Promise<ObjectReader> promise in requests.values)
+			foreach (Promise<ObjectReader> promise in requests)
 				promise.reject (e);
 			requests.clear ();
 		}
@@ -868,16 +888,26 @@ namespace Frida.Fruity {
 					return;
 				reader.end_member ();
 
-				uint64 seqno = reader.read_member ("sequenceNumber").get_uint64_value ();
-				reader.end_member ();
-
 				reader.read_member ("message");
 
-				Promise<ObjectReader> promise;
-				if (!requests.unset (seqno, out promise))
-					return;
+				bool is_event = false;
+				if (reader.has_member ("plain")) {
+					is_event = reader
+						.read_member ("plain")
+						.read_member ("_0")
+						.has_member ("event");
+					reader
+						.end_member ()
+						.end_member ();
+				}
 
-				promise.resolve (reader);
+				if (is_event) {
+					events_received (reader);
+				} else {
+					var request = requests.poll ();
+					if (request != null)
+						request.resolve (reader);
+				}
 			} catch (Error e) {
 			}
 		}
@@ -2014,7 +2044,9 @@ namespace Frida.Fruity {
 		private BufferedInputStream input;
 		private OutputStream output;
 
-		private ByteArray pending_output = new ByteArray ();
+		private Gee.Queue<Bytes> pending_input = new Gee.ArrayQueue<Bytes> ();
+		private bool input_flush_scheduled = false;
+		private Gee.Queue<Bytes> pending_output = new Gee.ArrayQueue<Bytes> ();
 		private bool writing = false;
 
 		private Cancellable io_cancellable = new Cancellable ();
@@ -2095,7 +2127,7 @@ namespace Frida.Fruity {
 			tunnel_params = TunnelParameters.from_json (yield read_message (cancellable));
 
 			_tunnel_netstack = new VirtualNetworkStack (null, tunnel_params.address, tunnel_params.mtu);
-			_tunnel_netstack.outgoing_datagram.connect (post);
+			_tunnel_netstack.outgoing_datagrams.connect (post_batch);
 
 			process_incoming_messages.begin ();
 
@@ -2116,8 +2148,7 @@ namespace Frida.Fruity {
 			try {
 				while (true) {
 					var datagram = yield read_datagram (io_cancellable);
-
-					_tunnel_netstack.handle_incoming_datagram (datagram);
+					on_incoming_datagram (datagram);
 				}
 			} catch (GLib.Error e) {
 			}
@@ -2142,28 +2173,61 @@ namespace Frida.Fruity {
 			closed ();
 		}
 
-		private void post (Bytes bytes) {
-			pending_output.append (bytes.get_data ());
+		private void on_incoming_datagram (Bytes datagram) {
+			pending_input.offer (datagram);
+
+			if (!input_flush_scheduled) {
+				var source = new IdleSource ();
+				source.set_callback (() => {
+					input_flush_scheduled = false;
+					flush_pending_input ();
+					return Source.REMOVE;
+				});
+				source.attach (MainContext.get_thread_default ());
+				input_flush_scheduled = true;
+			}
+		}
+
+		private void flush_pending_input () {
+			var datagrams = pending_input;
+			pending_input = new Gee.ArrayQueue<Bytes> ();
+			try {
+				_tunnel_netstack.handle_incoming_datagrams (datagrams);
+			} catch (Error e) {
+			}
+		}
+
+		private void post (Bytes datagram) {
+			var batch = new Gee.ArrayList<Bytes> ();
+			batch.add (datagram);
+			post_batch (batch);
+		}
+
+		private void post_batch (Gee.Collection<Bytes> datagrams) {
+			foreach (var d in datagrams)
+				pending_output.offer (d);
 
 			if (!writing) {
 				writing = true;
-
-				var source = new IdleSource ();
-				source.set_callback (() => {
-					process_pending_output.begin ();
-					return false;
-				});
-				source.attach (MainContext.get_thread_default ());
+				process_pending_output.begin ();
 			}
 		}
 
 		private async void process_pending_output () {
-			while (pending_output.len > 0) {
-				uint8[] batch = pending_output.steal ();
+			while (!pending_output.is_empty) {
+				size_t size = 0;
+				foreach (var d in pending_output)
+					size += d.get_size ();
+
+				var batch = new ByteArray.sized ((uint) size);
+				foreach (var d in pending_output)
+					batch.append (d.get_data ());
+
+				pending_output = new Gee.ArrayQueue<Bytes> ();
 
 				size_t bytes_written;
 				try {
-					yield output.write_all_async (batch, Priority.DEFAULT, io_cancellable, out bytes_written);
+					yield output.write_all_async (batch.data, Priority.DEFAULT, io_cancellable, out bytes_written);
 				} catch (GLib.Error e) {
 					break;
 				}
@@ -2301,7 +2365,9 @@ namespace Frida.Fruity {
 		private VirtualNetworkStack? _tunnel_netstack;
 
 		private Gee.Map<int64?, Stream> streams = new Gee.HashMap<int64?, Stream> (Numeric.int64_hash, Numeric.int64_equal);
-		private Gee.Queue<Bytes> tx_datagrams = new Gee.ArrayQueue<Bytes> ();
+		private Gee.Queue<Bytes> pending_input = new Gee.ArrayQueue<Bytes> ();
+		private bool input_flush_scheduled = false;
+		private Gee.Queue<Bytes> pending_output = new Gee.ArrayQueue<Bytes> ();
 
 		private DatagramBasedSource? rx_source;
 		private uint8[] rx_buf = new uint8[MAX_UDP_PAYLOAD_SIZE];
@@ -2481,7 +2547,7 @@ namespace Frida.Fruity {
 			tunnel_params = TunnelParameters.from_json (new JsonObjectReader (json));
 
 			_tunnel_netstack = new VirtualNetworkStack (null, tunnel_params.address, tunnel_params.mtu);
-			_tunnel_netstack.outgoing_datagram.connect (send_datagram);
+			_tunnel_netstack.outgoing_datagrams.connect (send_datagrams);
 
 			establish_request.resolve (true);
 		}
@@ -2572,7 +2638,14 @@ namespace Frida.Fruity {
 		}
 
 		private void send_datagram (Bytes datagram) {
-			tx_datagrams.offer (datagram);
+			var batch = new Gee.ArrayList<Bytes> ();
+			batch.add (datagram);
+			send_datagrams (batch);
+		}
+
+		private void send_datagrams (Gee.Collection<Bytes> datagrams) {
+			foreach (var d in datagrams)
+				pending_output.offer (d);
 			process_pending_writes ();
 		}
 
@@ -2629,13 +2702,13 @@ namespace Frida.Fruity {
 					n = connection.write_connection_close (null, &pi, tx_buf, error, ts);
 					state = CLOSE_WRITTEN;
 				} else {
-					Bytes? datagram = tx_datagrams.peek ();
+					Bytes? datagram = pending_output.peek ();
 					if (datagram != null) {
 						int accepted = -1;
 						n = connection.write_datagram (null, null, tx_buf, &accepted, NGTcp2.WriteDatagramFlags.MORE, 0,
 							datagram.get_data (), ts);
 						if (accepted > 0)
-							tx_datagrams.poll ();
+							pending_output.poll ();
 					} else {
 						Stream? stream = null;
 						unowned uint8[]? data = null;
@@ -2763,14 +2836,31 @@ namespace Frida.Fruity {
 		}
 
 		private int on_recv_datagram (uint32 flags, uint8[] data) {
-			try {
-				_tunnel_netstack.handle_incoming_datagram (new Bytes (data));
-			} catch (Error e) {
+			pending_input.offer (new Bytes (data));
+
+			if (!input_flush_scheduled) {
+				var source = new IdleSource ();
+				source.set_callback (() => {
+					input_flush_scheduled = false;
+					flush_pending_input ();
+					return Source.REMOVE;
+				});
+				source.attach (MainContext.get_thread_default ());
+				input_flush_scheduled = true;
 			}
 
 			return 0;
 		}
 
+		private void flush_pending_input () {
+			var datagrams = pending_input;
+			pending_input = new Gee.ArrayQueue<Bytes> ();
+			try {
+				_tunnel_netstack.handle_incoming_datagrams (datagrams);
+			} catch (Error e) {
+			}
+		}
+
 		private static void on_rand (uint8[] dest, NGTcp2.RNGContext rand_ctx) {
 			OpenSSL.Rng.generate (dest);
 		}

src/gdb.vala

@@ -729,6 +729,15 @@ namespace Frida.GDB {
 			check_execute_response (response);
 		}
 
+		public async void perform_execute (Bytes command, Cancellable? cancellable, Promise<bool> request) throws Error, IOError {
+			try {
+				yield execute (command, cancellable);
+				request.resolve (true);
+			} catch (GLib.Error e) {
+				request.reject (e);
+			}
+		}
+
 		private static void check_execute_response (Packet packet) throws Error {
 			unowned string response = packet.payload;
 			if (response[0] == 'E') {
@@ -1678,7 +1687,7 @@ namespace Frida.GDB {
 
 			var response = yield client.query (request, cancellable);
 
-			return Protocol.parse_pointer_value (response.payload, client.pointer_size, client.byte_order);
+			return Protocol.parse_integer_value (response.payload, client.byte_order);
 		}
 
 		public async void write_register (string name, uint64 val, Cancellable? cancellable = null) throws Error, IOError {

src/linux/agent/system-server/package-lock.json

@@ -9,7 +9,7 @@
       "version": "1.0.0",
       "dependencies": {
         "@frida/buffer": "^7.0.4",
-        "frida-java-bridge": "^7.0.4"
+        "frida-java-bridge": "^7.0.8"
       },
       "devDependencies": {
         "esbuild": "^0.25.5",
@@ -534,9 +534,9 @@
       "license": "MIT"
     },
     "node_modules/frida-java-bridge": {
-      "version": "7.0.4",
-      "resolved": "https://registry.npmjs.org/frida-java-bridge/-/frida-java-bridge-7.0.4.tgz",
-      "integrity": "sha512-dE5XCvasUwA/wiVb5gSwBPf6dortI8VtD0qLlw2T0ryqX/0lg4BEtEkg1oRr9IlHDVBTjPOqe9KRzdPar8U3EQ==",
+      "version": "7.0.8",
+      "resolved": "https://registry.npmjs.org/frida-java-bridge/-/frida-java-bridge-7.0.8.tgz",
+      "integrity": "sha512-EmqoTGzcDuCd+YFcjBJJPf7iVQCSbbj9fD0/TN8YYYwl5ZJtTqaCLTTsaC07o3bJaDVs/f3ks+Vu1bOw0S1PnQ==",
       "license": "LGPL-2.0 WITH WxWindows-exception-3.1"
     },
     "node_modules/ieee754": {

src/linux/agent/system-server/package.json

@@ -12,6 +12,6 @@
   },
   "dependencies": {
     "@frida/buffer": "^7.0.4",
-    "frida-java-bridge": "^7.0.4"
+    "frida-java-bridge": "^7.0.8"
   }
 }

src/meson.build

@@ -167,7 +167,7 @@ if have_local_backend
       'darwin' / 'policy-softener.vala',
       'darwin' / 'policy-softener-glue.c',
     ]
-    if host_os in ['macos', 'ios', 'tvos']
+    if host_os in ['macos', 'ios', 'tvos', 'xros']
       helper_backend_sources += [
         'darwin' / 'frida-helper-backend.vala',
         'darwin' / 'frida-helper-backend-glue.m',
@@ -179,7 +179,7 @@ if have_local_backend
         'darwin' / 'frida-helper-null-backend.vala',
       ]
     endif
-    if host_os in ['ios', 'tvos']
+    if host_os in ['ios', 'tvos', 'xros']
       helper_backend_sources += [
         'darwin' / 'springboard.m',
         'darwin' / 'substituted-client.c',
@@ -511,6 +511,7 @@ if have_fruity_backend
     'fruity' / 'springboard-services.vala',
     'fruity' / 'lldb.vala',
     'fruity' / 'injector.vala',
+    'fruity' / 'debugger-mappings.vala',
     'fruity' / 'usbmux.vala',
     'fruity' / 'dns.vala',
     'fruity' / 'keyed-archive.vala',

src/package-manager.vala

@@ -3111,13 +3111,12 @@ namespace Frida {
 						if (out_stream != null) {
 							try {
 								yield out_stream.close_async (io_priority, cancellable);
-
 							} catch (GLib.Error e) {
 								throw new Error.TRANSPORT ("%s", e.message);
 							}
 
-							try {
 #if !WINDOWS
+							try {
 								var info = new FileInfo ();
 								info.set_attribute_uint32 (FileAttribute.UNIX_MODE,
 									current_file_mode & 0777);
@@ -3126,6 +3125,7 @@ namespace Frida {
 							} catch (GLib.Error e) {
 							}
 #endif
+
 							current_file = null;
 							out_stream = null;
 						}

subprojects/frida-gum.wrap

@@ -1,6 +1,6 @@
 [wrap-git]
 url = https://github.com/frida/frida-gum.git
-revision = 17.2.7
+revision = 17.3.2
 depth = 1
 
 [provide]

subprojects/lwip.wrap

@@ -1,6 +1,6 @@
 [wrap-git]
 url = https://github.com/frida/lwip.git
-revision = 267d9f082e9e38083b643421a93c03d4a7046fd0
+revision = 4fe7223c2e80dc328266fb2483e789ee5fad7c79
 depth = 1
 
 [provide]

subprojects/lzfse.wrap

@@ -0,0 +1,8 @@
+[wrap-git]
+url = https://github.com/frida/lzfse.git
+revision = 5cfb7c86919d3c2c636d0d7552b51855a611ba1c
+depth = 1
+
+[provide]
+dependency_names = lzfse
+

subprojects/openssl.wrap

@@ -1,6 +1,6 @@
 [wrap-git]
 url = https://github.com/frida/openssl.git
-revision = 7b86cb6a0c5cb9d79dca012c98a0a30a58eef5b5
+revision = 5029c4562d23547d8e29768e1b0de573c52bf3fc
 depth = 1
 
 [provide]

tests/process-resource-usage.c

@@ -5,7 +5,7 @@
 # include <psapi.h>
 typedef HANDLE FridaProcessHandle;
 #elif defined (HAVE_DARWIN)
-# if defined (HAVE_IOS) || defined (HAVE_TVOS)
+# if defined (HAVE_IOS) || defined (HAVE_TVOS) || defined (HAVE_XROS)
 #  define PROC_PIDLISTFDS 1
 #  define PROC_PIDLISTFD_SIZE (sizeof (struct proc_fdinfo))
 struct proc_fdinfo

tests/test-host-session.vala

@@ -67,6 +67,11 @@ namespace Frida.HostSessionTest {
 			h.run ();
 		});
 
+		GLib.Test.add_func ("/HostSession/Fruity/Manual/speedtest", () => {
+			var h = new Harness ((h) => Fruity.Manual.speedtest.begin (h as Harness));
+			h.run ();
+		});
+
 		GLib.Test.add_func ("/HostSession/Fruity/Manual/Xpc/list", () => {
 			var h = new Harness ((h) => Fruity.Manual.Xpc.list.begin (h as Harness));
 			h.run ();
@@ -3762,6 +3767,11 @@ namespace Frida.HostSessionTest {
 					timer.reset ();
 					var script = yield session.create_script ("""
 						send(Module.getGlobalExportByName('open'));
+						try {
+							ptr(0x69).writeU32(1337);
+						} catch (e) {
+							send('I cannot believe Exceptor works!');
+						}
 						""");
 					printerr (" => took %u ms\n", (uint) (timer.elapsed () * 1000.0));
 
@@ -3808,6 +3818,77 @@ namespace Frida.HostSessionTest {
 				h.done ();
 			}
 
+			private static async void speedtest (Harness h) {
+				/*
+				 * Configured like this:
+				 *
+				 * ./configure \
+				 *   --disable-local-backend \
+				 *   --disable-droidy-backend \
+				 *   --disable-socket-backend \
+				 *   --disable-barebone-backend \
+				 *   --disable-compiler-backend \
+				 *   --with-compat=disabled \
+				 *   --disable-gadget \
+				 *   --disable-server \
+				 *   --disable-portal \
+				 *   --disable-inject \
+				 *   -- \
+				 *   --force-fallback-for=lwip
+				 */
+				if (!GLib.Test.slow ()) {
+					stdout.printf ("<skipping, run in slow mode with iOS device connected> ");
+					h.done ();
+					return;
+				}
+
+				h.disable_timeout ();
+
+				var device_manager = new DeviceManager ();
+
+				try {
+					var device = yield device_manager.get_device_by_id (DEVICE_ID);
+
+					{
+						var stream = yield device.open_channel ("tcp:5050");
+
+						var jumbo_message = new uint8[64 * 1024 * 1024];
+						yield stream.get_output_stream ().write_all_async (jumbo_message, Priority.DEFAULT, null,
+							null);
+
+						yield stream.close_async ();
+					}
+
+					{
+						var stream = yield device.open_channel ("tcp:5051");
+
+						var buf = new uint8[4 * 1024 * 1024];
+						while (true) {
+							var n = yield stream.get_input_stream ().read_async (buf);
+							if (n == 0)
+								break;
+						}
+
+						yield stream.close_async ();
+					}
+
+					var source = new TimeoutSource (500);
+					source.set_callback (speedtest.callback);
+					source.attach (MainContext.get_thread_default ());
+					yield;
+				} catch (GLib.Error e) {
+					printerr ("\nFAIL: %s\n\n", e.message);
+				}
+
+				try {
+					yield device_manager.close ();
+				} catch (IOError e) {
+					assert_not_reached ();
+				}
+
+				h.done ();
+			}
+
 			namespace Xpc {
 
 				private static async void list (Harness h) {

vapi/darwin-xnu.vapi

@@ -101,4 +101,7 @@ namespace Darwin.XNU {
 		IPV6,
 		V4MAPPEDV6,
 	}
+
+	[CCode (cheader_filename = "fcntl.h")]
+	public const int F_FULLFSYNC;
 }

vapi/lzfse.vapi

@@ -0,0 +1 @@
+// Placeholder to satisfy Meson assumptions.

vapi/quickjs.vapi

@@ -118,6 +118,9 @@ namespace QuickJS {
 		[CCode (cname = "JS_NewAtom")]
 		public Atom make_atom (string str);
 
+		[CCode (cname = "JS_NewBool")]
+		public Value make_bool (bool v);
+
 		[CCode (cname = "JS_NewInt32")]
 		public Value make_int32 (int32 v);