subprojects: Bump outdated

ci: Build the Barebone agents
Build the agent images and the kext the way frida/frida does, each agent against the SDK its GumJS devkit was built with, and only when src/barebone/agent/ changes. Skip the rest of CI for changes that touch nothing else.
2026-11-12 17:27:43 -10:00 · 2026-11-12 21:30:51 +01:00 · 2026-11-12 21:20:29 +01:00 · 2026-11-12 21:20:29 +01:00 · 2026-11-12 21:20:29 +01:00 · 2026-11-12 21:20:29 +01:00
62 changed files with 3987 additions and 4706 deletions
@@ -0,0 +1,19 @@
+name: Set up LLVM
+description: Install the LLVM toolchain and put its tools on the path
+inputs:
+  version:
+    required: false
+    default: "21"
+    description: The LLVM major version to install
+runs:
+  using: composite
+  steps:
+    - name: Install LLVM
+      shell: bash
+      run: |
+        curl -sSL https://apt.llvm.org/llvm.sh -o llvm.sh
+        chmod +x llvm.sh
+        sudo ./llvm.sh $VERSION
+        echo "/usr/lib/llvm-$VERSION/bin" >> $GITHUB_PATH
+      env:
+        VERSION: ${{ inputs.version }}
@@ -0,0 +1,245 @@
+name: Barebone agent
+
+on:
+  push:
+    paths:
+      - 'src/barebone/agent/**'
+      - '.github/workflows/barebone-agent.yml'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'src/barebone/agent/**'
+      - '.github/workflows/barebone-agent.yml'
+  workflow_dispatch:
+
+jobs:
+  gum-none:
+    strategy:
+      matrix:
+        machine:
+          - none-x86-softfloat_pic
+          - none-x86_64-softfloat_pic
+          - none-x86_64-softfloat_pic_msabi
+          - none-arm-softfloat_pic
+          - none-arm64-softfloat_pic
+      fail-fast: false
+    runs-on: ubuntu-latest
+    env:
+      FRIDA_DEPS: ${{ github.workspace }}/deps
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+      - name: Set up C toolchain
+        uses: ./.github/actions/setup-llvm
+      - name: Grab frida-gum
+        run: |
+          python releng/meson/meson.py subprojects download frida-gum
+          git -C subprojects/frida-gum submodule update --init --recursive --depth 1
+      - name: Configure Gum
+        working-directory: subprojects/frida-gum
+        run: >-
+          ./configure
+          --host=${{ matrix.machine }}
+          --enable-gumjs
+          --with-devkits=gumjs
+          --with-devkit-symbol-scope=original
+        env:
+          CC: clang
+          CXX: clang++
+      - name: Compile
+        working-directory: subprojects/frida-gum
+        run: make
+      - name: Upload GumJS devkit
+        uses: actions/upload-artifact@v7
+        with:
+          name: frida-gumjs-devkit-${{ matrix.machine }}
+          path: subprojects/frida-gum/build/bindings/gumjs/devkit/
+      - name: Upload SDK
+        uses: actions/upload-artifact@v7
+        with:
+          name: sdk-${{ matrix.machine }}
+          path: ${{ env.FRIDA_DEPS }}/sdk-${{ matrix.machine }}/
+
+  gum-macos-kernel:
+    runs-on: macos-latest
+    env:
+      FRIDA_DEPS: ${{ github.workspace }}/deps
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+      - name: Grab frida-gum
+        run: |
+          python3 releng/meson/meson.py subprojects download frida-gum
+          git -C subprojects/frida-gum submodule update --init --recursive --depth 1
+      - name: Configure Gum
+        working-directory: subprojects/frida-gum
+        run: >-
+          ./configure
+          --host=macos-arm64e-kernel
+          --enable-gumjs
+          --with-devkits=gumjs
+          --with-devkit-symbol-scope=original
+      - name: Compile
+        working-directory: subprojects/frida-gum
+        run: make
+      - name: Upload GumJS devkit
+        uses: actions/upload-artifact@v7
+        with:
+          name: frida-gumjs-devkit-macos-arm64e-kernel
+          path: subprojects/frida-gum/build/bindings/gumjs/devkit/
+      - name: Upload SDK
+        uses: actions/upload-artifact@v7
+        with:
+          name: sdk-macos-arm64e-kernel
+          path: ${{ env.FRIDA_DEPS }}/sdk-macos-arm64e-kernel/
+
+  blob:
+    needs: gum-none
+    strategy:
+      matrix:
+        include:
+          - flavor: win9x
+            feature: win9x
+            arch: x86
+            machine: none-x86-softfloat_pic
+            rust_target: i686-unknown-none-pic
+          - flavor: winnt
+            feature: winnt
+            arch: x86
+            machine: none-x86-softfloat_pic
+            rust_target: i686-unknown-none-pic
+          - flavor: winnt
+            feature: winnt
+            arch: x86_64
+            machine: none-x86_64-softfloat_pic_msabi
+            rust_target: x86_64-unknown-none-pic
+          - flavor: winnt
+            feature: winnt
+            arch: arm64
+            machine: none-arm64-softfloat_pic
+            rust_target: aarch64-unknown-none-pic
+          - flavor: xnu
+            feature: xnu
+            arch: arm64
+            machine: none-arm64-softfloat_pic
+            rust_target: aarch64-unknown-none-pic
+          - flavor: linux
+            feature: linux-injected
+            arch: x86
+            machine: none-x86-softfloat_pic
+            rust_target: i686-unknown-none-pic
+          - flavor: linux
+            feature: linux-injected
+            arch: x86_64
+            machine: none-x86_64-softfloat_pic
+            rust_target: x86_64-unknown-none-pic
+          - flavor: linux
+            feature: linux-injected
+            arch: arm
+            machine: none-arm-softfloat_pic
+            rust_target: armv7a-unknown-none-pic
+          - flavor: linux
+            feature: linux-injected
+            arch: arm64
+            machine: none-arm64-softfloat_pic
+            rust_target: aarch64-unknown-none-pic
+      fail-fast: false
+    runs-on: ubuntu-latest
+    env:
+      SDK: ${{ github.workspace }}/sdk-${{ matrix.machine }}
+      GUMJS_DEVKIT_DIR: ${{ github.workspace }}/gumjs-devkit
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+          fetch-depth: 0
+      - name: Detect version
+        run: |
+          version=$(releng/frida_version.py)
+          test -n "$version"
+          echo "FRIDA_VERSION=$version" >> $GITHUB_ENV
+      - name: Set up C toolchain
+        uses: ./.github/actions/setup-llvm
+      - name: Set up Rust
+        run: rustup component add rust-src
+      - name: Download SDK
+        uses: actions/download-artifact@v8
+        with:
+          name: sdk-${{ matrix.machine }}
+          path: ${{ env.SDK }}
+      - name: Download GumJS devkit
+        uses: actions/download-artifact@v8
+        with:
+          name: frida-gumjs-devkit-${{ matrix.machine }}
+          path: ${{ env.GUMJS_DEVKIT_DIR }}
+      - name: Build agent
+        working-directory: src/barebone/agent
+        run: >-
+          cargo build --release
+          --features ${{ matrix.feature }}
+          --target ./${{ matrix.rust_target }}.json -Z json-target-spec
+          -Z build-std=core,alloc,compiler_builtins
+          --target-dir target-${{ matrix.flavor }}
+        env:
+          RUSTC_BOOTSTRAP: 1
+          CC: >-
+            clang
+            -I${{ env.SDK }}/include
+            -I${{ env.SDK }}/include/glib-2.0
+            -I${{ env.SDK }}/lib/glib-2.0/include
+            -I${{ env.SDK }}/include/capstone
+            -I${{ env.SDK }}/include/json-glib-1.0
+          RUSTFLAGS: -L native=${{ env.SDK }}/lib
+      - name: Upload agent
+        uses: actions/upload-artifact@v7
+        with:
+          name: frida-barebone-agent-${{ matrix.flavor }}-${{ matrix.arch }}
+          path: src/barebone/agent/target-${{ matrix.flavor }}/${{ matrix.rust_target }}/release/frida-barebone-agent
+
+  kext:
+    needs: gum-macos-kernel
+    runs-on: macos-latest
+    env:
+      FRIDA_SDK: ${{ github.workspace }}/sdk-macos-arm64e-kernel
+      GUMJS_DEVKIT_DIR: ${{ github.workspace }}/gumjs-devkit
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+          fetch-depth: 0
+      - name: Detect version
+        run: |
+          version=$(releng/frida_version.py)
+          test -n "$version"
+          echo "FRIDA_VERSION=$version" >> $GITHUB_ENV
+      - name: Set up Rust
+        run: rustup component add rust-src
+      - name: Download SDK
+        uses: actions/download-artifact@v8
+        with:
+          name: sdk-macos-arm64e-kernel
+          path: ${{ env.FRIDA_SDK }}
+      - name: Download GumJS devkit
+        uses: actions/download-artifact@v8
+        with:
+          name: frida-gumjs-devkit-macos-arm64e-kernel
+          path: ${{ env.GUMJS_DEVKIT_DIR }}
+      - name: Build agent
+        working-directory: src/barebone/agent/macos
+        run: make
+      - name: Upload agent
+        uses: actions/upload-artifact@v7
+        with:
+          name: frida-barebone-agent-xnu-kext-arm64e
+          path: src/barebone/agent/macos/frida-agent.kext
@@ -2,9 +2,13 @@ name: CI

 on:
  push:
+    paths-ignore:
+      - 'src/barebone/agent/**'
  pull_request:
    branches:
      - main
+    paths-ignore:
+      - 'src/barebone/agent/**'
  workflow_dispatch:
    inputs:
      tag:
@@ -6,7 +6,7 @@
 /src/barebone/agent/linux/*.mod
 /src/barebone/agent/linux/*.mod.c
 /src/barebone/agent/linux/*.o
-/src/barebone/agent/linux/*.o.bin
+/src/barebone/agent/linux/frida-agent.elf
 /src/barebone/agent/linux/.*.cmd
 /src/barebone/agent/linux/Module.symvers
 /src/barebone/agent/linux/modules.order
@@ -510,9 +510,7 @@ def compile(privdir: Path, state: State):
        if not (workdir / "build.ninja").exists():
            if options is None:
                options = load_meson_options(top_builddir, state.role, set(subprojects.keys()))
-                version_opt = next((opt for opt in options if opt.startswith("-Dfrida_version=")), None)
-                if version_opt is None:
-                    options += [f"-Dfrida_version={state.frida_version}"]
+                options += [f"-D:frida_version={state.frida_version}"]

            host_machine = MachineSpec(state.host_os, group.arch, state.host_config, group.triplet)

@@ -525,7 +523,7 @@ def compile(privdir: Path, state: State):
                forwarded_options = [o for o in options if not is_stripped_compat_option(o)]
                forwarded_options += ["-Ddefault_library=static"]
            else:
-                forwarded_options = [o for o in options if not is_overridden_compat_option(o)]
+                forwarded_options = list(options)
            if state.apple_tls == "enabled":
                forwarded_options += ["-Dapple_tls=disabled"]

@@ -576,17 +574,10 @@ def compile(privdir: Path, state: State):


 def is_stripped_compat_option(o: str) -> bool:
-    if is_overridden_compat_option(o):
-        return True
    name = o.split("=", 1)[0].removeprefix("-D")
    return name in STRIPPED_COMPAT_OPTIONS or name.endswith(":default_library")


-def is_overridden_compat_option(o: str) -> bool:
-    name = o.split("=", 1)[0].removeprefix("-D")
-    return name in OVERRIDDEN_COMPAT_OPTIONS
-
-
 def load_meson_options(top_builddir: Path,
                       role: Role,
                       subprojects: set[str]) -> Sequence[str]:
@@ -612,13 +603,14 @@ def option_should_be_forwarded(k: "OptionKey",
    from mesonbuild import options
    from mesonbuild.mesonlib import MachineChoice

+    subproject = k.subproject or ""
    our_project_id = "frida-core" if role == "subproject" else ""
-    is_for_us = k.subproject == our_project_id
-    is_for_child = k.subproject in subprojects
+    is_for_us = subproject == our_project_id
+    is_for_child = subproject in subprojects

    if optstore.is_project_option(k):
        if is_for_us:
-            if k.name == "compiler_backend":
+            if k.name in {"compiler_backend", "assets"}:
                return False
            tokens = k.name.split("_")
            if tokens[0] in {"helper", "agent"} and tokens[-1] in {"modern", "legacy"}:
@@ -639,9 +631,9 @@ def option_should_be_forwarded(k: "OptionKey",
            return False
        if not str(v.value):
            return False
-        if not is_for_child and role == "subproject" and k.subproject in {"", our_project_id}:
+        if not is_for_child and role == "subproject" and subproject in {"", our_project_id}:
            if not options.BUILTIN_OPTIONS[k.evolve(subproject=None, machine=MachineChoice.HOST)].yielding:
-                return k.subproject == our_project_id
+                return subproject == our_project_id
            return True

    if k.get_module_prefix() == "python":
@@ -798,17 +790,6 @@ STRIPPED_COMPAT_OPTIONS = {
    "frida-gum:inspector",
 }

-OVERRIDDEN_COMPAT_OPTIONS = {
-    "compiler_backend",
-    "assets",
-    "helper_modern",
-    "helper_legacy",
-    "agent_modern",
-    "agent_legacy",
-    "agent_emulated_modern",
-    "agent_emulated_legacy",
-}
-
 HELPER_TARGET = "frida-helper"
 HELPER_FILE_WINDOWS = Path("src") / "frida-helper.exe"
 HELPER_FILE_UNIX = Path("src") / "frida-helper"
@@ -35,8 +35,6 @@ namespace Frida {

 		public abstract async ServiceSessionId open_service (string address, Cancellable? cancellable) throws GLib.Error;

-		public abstract async HashTable<string, Variant> dump_backtraces (uint pid, Cancellable? cancellable) throws GLib.Error;
-
 		public signal void spawn_gating_disabled (SpawnGatingDisabledReason reason);
 		public signal void spawn_added (HostSpawnInfo info);
 		public signal void spawn_removed (HostSpawnInfo info);
@@ -819,10 +817,6 @@ namespace Frida {
 		 * Apply the page plan.
 		 */
 		PAGE_PLAN,
-		/**
-		 * Let the debugger inspect the process, then resume execution.
-		 */
-		INTERRUPT,
 	}

 	[DBus (name = "re.frida.Channel17")]
@@ -1008,10 +1002,6 @@ namespace Frida {
 		public async ServiceSessionId open_service (string address, Cancellable? cancellable) throws Error, IOError {
 			throw_not_authorized ();
 		}
-
-		public async HashTable<string, Variant> dump_backtraces (uint pid, Cancellable? cancellable) throws Error, IOError {
-			throw_not_authorized ();
-		}
 	}

 	public sealed class UnauthorizedPortalSession : Object, PortalSession {
@@ -11,50 +11,15 @@
 #include "frida-base.h"

 #import <Foundation/Foundation.h>
-#include <arpa/inet.h>
-#include <errno.h>
 #include <gum/gumdarwin.h>
 #include <mach-o/loader.h>
-#include <netinet/in.h>
 #include <objc/runtime.h>
 #include <pthread.h>
-#include <stdio.h>
-#include <sys/socket.h>
-#include <sys/syscall.h>

 static void frida_on_breakpoints_steal_attempt (GumInvocationContext * ic, gpointer user_data);
-static void frida_wait_until_interrupt_listener_named (void);
-static void frida_wake_interrupt_listener (void);
-static void * frida_run_interrupt_listener (void * data);
-static void frida_announce_interrupt_listener_named (void);
-static void frida_break_and_interrupt_if_armed (void);
-static void frida_lock_interrupt_arming (void);
-static void frida_unlock_interrupt_arming (void);
-static void frida_break_and_interrupt (void);
-static void frida_init_loopback_address (struct sockaddr_in * addr, guint16 port);
-static int frida_open_tcp_socket (void);
-static int frida_bind (int fd, const struct sockaddr_in * addr);
-static int frida_listen (int fd, int backlog);
-static int frida_get_bound_address (int fd, struct sockaddr_in * addr);
-static int frida_accept (int fd);
-static int frida_connect (int fd, const struct sockaddr_in * addr);
-static void frida_close (int fd);
-static gssize frida_syscall (gsize number, gsize a0, gsize a1, gsize a2);

 static GumInvocationListener * frida_dont_steal_my_breakpoints;

-static pthread_t frida_interrupt_listener_thread;
-static int frida_interrupt_listener_fd = -1;
-static guint16 frida_interrupt_listener_port;
-static volatile gboolean frida_interrupt_listener_stopping;
-static pthread_mutex_t frida_interrupt_listener_mutex = PTHREAD_MUTEX_INITIALIZER;
-static pthread_cond_t frida_interrupt_listener_cond = PTHREAD_COND_INITIALIZER;
-static gboolean frida_interrupt_listener_named;
-static volatile guint8 frida_interrupt_listener_armed;
-static GumAddress frida_our_base_address;
-static gsize frida_our_size;
-static volatile gint frida_interrupt_arming_lock;
-
 gchar *
 frida_gadget_environment_detect_bundle_id (void)
 {
@@ -214,286 +179,6 @@ frida_on_breakpoints_steal_attempt (GumInvocationContext * ic, gpointer user_dat
  gum_invocation_context_replace_nth_argument (ic, 1, GSIZE_TO_POINTER (exception_mask));
 }

-void
-frida_gadget_environment_start_interrupt_listener (GumAddress our_base_address, gsize our_size)
-{
-  int fd;
-  struct sockaddr_in addr;
-
-  if (frida_interrupt_listener_fd != -1)
-    return;
-
-  frida_our_base_address = our_base_address;
-  frida_our_size = our_size;
-
-  fd = frida_open_tcp_socket ();
-  if (fd < 0)
-    return;
-
-  frida_init_loopback_address (&addr, 0);
-  if (frida_bind (fd, &addr) != 0 ||
-      frida_listen (fd, 1) != 0 ||
-      frida_get_bound_address (fd, &addr) != 0)
-  {
-    frida_close (fd);
-    return;
-  }
-
-  frida_interrupt_listener_fd = fd;
-  frida_interrupt_listener_port = ntohs (addr.sin_port);
-  frida_interrupt_listener_stopping = FALSE;
-  frida_interrupt_listener_named = FALSE;
-  frida_interrupt_listener_armed = TRUE;
-
-  if (pthread_create (&frida_interrupt_listener_thread, NULL, frida_run_interrupt_listener, NULL) != 0)
-  {
-    frida_close (fd);
-    frida_interrupt_listener_fd = -1;
-    return;
-  }
-
-  frida_wait_until_interrupt_listener_named ();
-}
-
-void
-frida_gadget_environment_stop_interrupt_listener (void)
-{
-  if (frida_interrupt_listener_fd == -1)
-    return;
-
-  frida_interrupt_listener_stopping = TRUE;
-  frida_wake_interrupt_listener ();
-
-  pthread_join (frida_interrupt_listener_thread, NULL);
-
-  frida_close (frida_interrupt_listener_fd);
-  frida_interrupt_listener_fd = -1;
-}
-
-void
-frida_gadget_environment_disarm_interrupt_listener (void)
-{
-  if (frida_interrupt_listener_fd == -1)
-    return;
-
-  frida_lock_interrupt_arming ();
-  frida_interrupt_listener_armed = FALSE;
-  frida_unlock_interrupt_arming ();
-}
-
-static void
-frida_wait_until_interrupt_listener_named (void)
-{
-  pthread_mutex_lock (&frida_interrupt_listener_mutex);
-  while (!frida_interrupt_listener_named)
-    pthread_cond_wait (&frida_interrupt_listener_cond, &frida_interrupt_listener_mutex);
-  pthread_mutex_unlock (&frida_interrupt_listener_mutex);
-}
-
-static void
-frida_wake_interrupt_listener (void)
-{
-  int fd;
-  struct sockaddr_in addr;
-
-  fd = frida_open_tcp_socket ();
-  if (fd < 0)
-    return;
-
-  frida_init_loopback_address (&addr, frida_interrupt_listener_port);
-  frida_connect (fd, &addr);
-  frida_close (fd);
-}
-
-static void *
-frida_run_interrupt_listener (void * data)
-{
-  char name[64];
-  GumThreadId self;
-
-  snprintf (name, sizeof (name), "frida-gadget-interrupt-%u-%" G_GINT64_MODIFIER "x", frida_interrupt_listener_port,
-      (guint64) GPOINTER_TO_SIZE (&frida_interrupt_listener_armed));
-  pthread_setname_np (name);
-
-  self = gum_process_get_current_thread_id ();
-  gum_cloak_add_thread (self);
-
-  frida_announce_interrupt_listener_named ();
-
-  while (TRUE)
-  {
-    int client = frida_accept (frida_interrupt_listener_fd);
-    if (client < 0)
-    {
-      if (client == -EINTR || client == -ECONNABORTED)
-        continue;
-      break;
-    }
-
-    if (!frida_interrupt_listener_stopping)
-      frida_break_and_interrupt_if_armed ();
-
-    frida_close (client);
-
-    if (frida_interrupt_listener_stopping)
-      break;
-  }
-
-  gum_cloak_remove_thread (self);
-
-  return NULL;
-}
-
-static void
-frida_announce_interrupt_listener_named (void)
-{
-  pthread_mutex_lock (&frida_interrupt_listener_mutex);
-  frida_interrupt_listener_named = TRUE;
-  pthread_cond_signal (&frida_interrupt_listener_cond);
-  pthread_mutex_unlock (&frida_interrupt_listener_mutex);
-}
-
-static void
-frida_break_and_interrupt_if_armed (void)
-{
-  frida_lock_interrupt_arming ();
-  if (frida_interrupt_listener_armed)
-    frida_break_and_interrupt ();
-  frida_unlock_interrupt_arming ();
-}
-
-static void
-frida_lock_interrupt_arming (void)
-{
-  while (__atomic_exchange_n (&frida_interrupt_arming_lock, 1, __ATOMIC_ACQUIRE) != 0)
-    ;
-}
-
-static void
-frida_unlock_interrupt_arming (void)
-{
-  __atomic_store_n (&frida_interrupt_arming_lock, 0, __ATOMIC_RELEASE);
-}
-
-static void
-frida_break_and_interrupt (void)
-{
-#ifdef HAVE_ARM64
-  asm volatile (
-      "mov x1, #1337\n\t"
-      "mov x2, #1337\n\t"
-      "mov x3, %0\n\t"
-      "mov x4, %1\n\t"
-      "mov x5, %2\n\t"
-      "brk #1337\n\t"
-      :
-      : "r" ((gsize) FRIDA_GADGET_BREAKPOINT_ACTION_INTERRUPT),
-        "r" ((gsize) frida_our_base_address),
-        "r" (frida_our_size)
-      : "x1", "x2", "x3", "x4", "x5"
-  );
-#endif
-}
-
-static void
-frida_init_loopback_address (struct sockaddr_in * addr, guint16 port)
-{
-  *addr = (struct sockaddr_in) {
-    .sin_len = sizeof (struct sockaddr_in),
-    .sin_family = AF_INET,
-    .sin_port = htons (port),
-    .sin_addr.s_addr = htonl (INADDR_LOOPBACK),
-  };
-}
-
-static int
-frida_open_tcp_socket (void)
-{
-  return frida_syscall (SYS_socket, AF_INET, SOCK_STREAM, 0);
-}
-
-static int
-frida_bind (int fd, const struct sockaddr_in * addr)
-{
-  return frida_syscall (SYS_bind, fd, GPOINTER_TO_SIZE (addr), sizeof (struct sockaddr_in));
-}
-
-static int
-frida_listen (int fd, int backlog)
-{
-  return frida_syscall (SYS_listen, fd, backlog, 0);
-}
-
-static int
-frida_get_bound_address (int fd, struct sockaddr_in * addr)
-{
-  socklen_t addr_len = sizeof (struct sockaddr_in);
-
-  return frida_syscall (SYS_getsockname, fd, GPOINTER_TO_SIZE (addr), GPOINTER_TO_SIZE (&addr_len));
-}
-
-static int
-frida_accept (int fd)
-{
-  return frida_syscall (SYS_accept, fd, 0, 0);
-}
-
-static int
-frida_connect (int fd, const struct sockaddr_in * addr)
-{
-  return frida_syscall (SYS_connect, fd, GPOINTER_TO_SIZE (addr), sizeof (struct sockaddr_in));
-}
-
-static void
-frida_close (int fd)
-{
-  frida_syscall (SYS_close, fd, 0, 0);
-}
-
-static gssize
-frida_syscall (gsize number, gsize a0, gsize a1, gsize a2)
-{
-#ifdef HAVE_ARM64
-  register gsize x0 asm ("x0") = a0;
-  register gsize x1 asm ("x1") = a1;
-  register gsize x2 asm ("x2") = a2;
-  register gsize x16 asm ("x16") = number;
-  gsize failed;
-
-  asm volatile (
-      "svc 0x80\n\t"
-      "cset %2, cs\n\t"
-      : "+r" (x0),
-        "+r" (x1),
-        "=&r" (failed)
-      : "r" (x2),
-        "r" (x16)
-      : "cc", "memory"
-  );
-
-  return failed ? -(gssize) x0 : (gssize) x0;
-#else
-  register gsize rdi asm ("rdi") = a0;
-  register gsize rsi asm ("rsi") = a1;
-  register gsize rdx asm ("rdx") = a2;
-  register gsize rax asm ("rax") = 0x2000000 | number;
-  guint8 failed;
-
-  asm volatile (
-      "syscall\n\t"
-      "setc %2\n\t"
-      : "+r" (rax),
-        "+r" (rdx),
-        "=&q" (failed)
-      : "r" (rdi),
-        "r" (rsi)
-      : "rcx", "r11", "cc", "memory"
-  );
-
-  return failed ? -(gssize) rax : (gssize) rax;
-#endif
-}
-
 void
 frida_gadget_environment_break_and_resume (void)
 {
@@ -26,12 +26,6 @@ namespace Frida.Gadget {
 			default = Gum.CodeSigningPolicy.OPTIONAL;
 		}

-		public bool interruptible {
-			get;
-			set;
-			default = false;
-		}
-
 		public bool deserialize_property (string property_name, out Value value, ParamSpec pspec, Json.Node property_node) {
 			if (property_name == "interaction" && property_node.get_node_type () == Json.NodeType.OBJECT) {
 				var interaction_node = property_node.get_object ();
@@ -415,11 +409,8 @@ namespace Frida.Gadget {
 		interceptor.begin_transaction ();

 #if DARWIN
-		if (mapped_range != null) {
+		if (mapped_range != null)
 			Environment.ensure_debugger_breakpoints_only ();
-			if (config.interruptible)
-				Environment.start_interrupt_listener (location.range.base_address, location.range.size);
-		}
 #endif

 		exceptor = Gum.Exceptor.obtain ();
@@ -643,7 +634,6 @@ namespace Frida.Gadget {
 					exceptor = null;

 #if DARWIN
-					Environment.stop_interrupt_listener ();
 					Environment.allow_stolen_breakpoints ();
 #endif

@@ -1896,11 +1886,6 @@ namespace Frida.Gadget {
 				throw new Error.NOT_SUPPORTED ("Unable to open services when embedded");
 			}

-			public async HashTable<string, Variant> dump_backtraces (uint pid, Cancellable? cancellable)
-					throws Error, IOError {
-				throw new Error.NOT_SUPPORTED ("Unable to dump backtraces when embedded");
-			}
-
 			public async void break_and_resume (Cancellable? cancellable) throws Error, IOError {
 #if DARWIN
 				Environment.break_and_resume ();
@@ -1911,7 +1896,6 @@ namespace Frida.Gadget {

 			public async void break_and_detach (Cancellable? cancellable) throws Error, IOError {
 #if DARWIN
-				Environment.disarm_interrupt_listener ();
 				Environment.break_and_detach ();
 #else
 				throw new Error.NOT_SUPPORTED ("This API is only applicable on Darwin");
@@ -2158,9 +2142,6 @@ namespace Frida.Gadget {
 			ref string? our_path, ref Gum.MemoryRange? our_range);
 		private extern void ensure_debugger_breakpoints_only ();
 		private extern void allow_stolen_breakpoints ();
-		private extern void start_interrupt_listener (Gum.Address our_base_address, size_t our_size);
-		private extern void stop_interrupt_listener ();
-		private extern void disarm_interrupt_listener ();
 		private extern void break_and_resume ();
 		private extern void break_and_detach ();
 #endif
@@ -9,15 +9,12 @@ name = "frida_barebone_agent"
 path = "src/lib.rs"
 crate-type = ["rlib", "staticlib"]

-# The XNU flavour is a freestanding executable the host injects and calls into.
-# The Linux flavour is the staticlib above, linked into a .ko by linux/Kbuild.
 [[bin]]
 name = "frida-barebone-agent"
 path = "src/main.rs"
 required-features = ["blob"]

 [features]
-# Flavors the host injects and calls into, as opposed to the module Linux loads.
 blob = []
 # The XNU flavour itself, and the two ways it is packaged: a blob the host injects
 # into a running kernel, and a kext that kernel loads.
@@ -26,7 +23,6 @@ xnu = ["xnu-core", "blob"]
 xnu-kext = ["xnu-core"]
 win9x = ["blob"]
 winnt = ["blob"]
-linux = []
 linux-injected = ["blob"]

 [profile.release]
@@ -33,8 +33,22 @@ SECTIONS {
    _set_memory_x = .; . += 4;
    _set_memory_nx = .; . += 4;
    _modules = .; . += 4;
+    _module_mutex = .; . += 4;
+    _mutex_lock = .; . += 4;
+    _mutex_unlock = .; . += 4;
    _register_module_notifier = .; . += 4;
    _unregister_module_notifier = .; . += 4;
+    _frida_kmod_link_open = .; . += 4;
+    _frida_kmod_link_close = .; . += 4;
+    _frida_kmod_link_send = .; . += 4;
+    _frida_kmod_link_recv = .; . += 4;
+    _frida_kmod_link_pending = .; . += 4;
+    _frida_kmod_exit_worker = .; . += 4;
+    _frida_kmod_layout = .; . += 4;
+    _frida_kmod_remap_writable = .; . += 4;
+    _frida_kmod_unmap_writable = .; . += 4;
+    _execmem_alloc_rw = .; . += 4;
+    _vmalloc_noprof = .; . += 4;
    _execmem_free = .; . += 4;
    _module_alloc = .; . += 4;
    _module_memfree = .; . += 4;
@@ -33,8 +33,48 @@ SECTIONS {
    _set_memory_x = .; . += 8;
    _set_memory_nx = .; . += 8;
    _modules = .; . += 8;
+    _module_mutex = .; . += 8;
+    _mutex_lock = .; . += 8;
+    _mutex_unlock = .; . += 8;
    _register_module_notifier = .; . += 8;
    _unregister_module_notifier = .; . += 8;
+    _frida_kmod_link_open = .; . += 8;
+    _frida_kmod_link_close = .; . += 8;
+    _frida_kmod_link_send = .; . += 8;
+    _frida_kmod_link_recv = .; . += 8;
+    _frida_kmod_link_pending = .; . += 8;
+    _frida_kmod_exit_worker = .; . += 8;
+    _frida_kmod_layout = .; . += 8;
+    _frida_kmod_remap_writable = .; . += 8;
+    _frida_kmod_unmap_writable = .; . += 8;
+    _execmem_alloc_rw = .; . += 8;
+    _vmalloc_noprof = .; . += 8;
+    _queued_spin_lock_slowpath = .; . += 8;
+    _queued_read_lock_slowpath = .; . += 8;
+    _queued_write_lock_slowpath = .; . += 8;
+    _find_get_task_by_vpid = .; . += 8;
+    ___put_task_struct = .; . += 8;
+    _task_join_group_stop = .; . += 8;
+    ___cleanup_sighand = .; . += 8;
+    _kmem_cache_free = .; . += 8;
+    _signal_cachep = .; . += 8;
+    _put_files_struct = .; . += 8;
+    _switch_task_namespaces = .; . += 8;
+    _free_fs_struct = .; . += 8;
+    ___put_cred = .; . += 8;
+    __raw_spin_lock = .; . += 8;
+    __raw_spin_unlock = .; . += 8;
+    _capable = .; . += 8;
+    _show_map = .; . += 8;
+    _show_smap = .; . += 8;
+    _proc_fill_cache = .; . += 8;
+    _proc_pid_status = .; . += 8;
+    _do_task_stat = .; . += 8;
+    _release_task = .; . += 8;
+    _proc_task_instantiate = .; . += 8;
+    _proc_fd_instantiate = .; . += 8;
+    _proc_fdinfo_instantiate = .; . += 8;
+    ___arm64_sys_prctl = .; . += 8;
    _execmem_free = .; . += 8;
    _module_alloc = .; . += 8;
    _module_memfree = .; . += 8;
@@ -32,8 +32,22 @@ SECTIONS {
    _set_memory_x = .; . += 4;
    _set_memory_nx = .; . += 4;
    _modules = .; . += 4;
+    _module_mutex = .; . += 4;
+    _mutex_lock = .; . += 4;
+    _mutex_unlock = .; . += 4;
    _register_module_notifier = .; . += 4;
    _unregister_module_notifier = .; . += 4;
+    _frida_kmod_link_open = .; . += 4;
+    _frida_kmod_link_close = .; . += 4;
+    _frida_kmod_link_send = .; . += 4;
+    _frida_kmod_link_recv = .; . += 4;
+    _frida_kmod_link_pending = .; . += 4;
+    _frida_kmod_exit_worker = .; . += 4;
+    _frida_kmod_layout = .; . += 4;
+    _frida_kmod_remap_writable = .; . += 4;
+    _frida_kmod_unmap_writable = .; . += 4;
+    _execmem_alloc_rw = .; . += 4;
+    _vmalloc_noprof = .; . += 4;
    _text_poke_kgdb = .; . += 4;
    _execmem_free = .; . += 4;
    _module_alloc = .; . += 4;
@@ -55,6 +69,7 @@ SECTIONS {
    _request_threaded_irq = .; . += 4;
    _vmap = .; . += 4;
    _current_task = .; . += 4;
+    _pcpu_hot = .; . += 4;
    _ioremap = .; . += 4;
    _ioremap_nocache = .; . += 4;
    ___default_kernel_pte_mask = .; . += 4;
@@ -33,8 +33,45 @@ SECTIONS {
    _set_memory_x = .; . += 8;
    _set_memory_nx = .; . += 8;
    _modules = .; . += 8;
+    _module_mutex = .; . += 8;
+    _mutex_lock = .; . += 8;
+    _mutex_unlock = .; . += 8;
    _register_module_notifier = .; . += 8;
    _unregister_module_notifier = .; . += 8;
+    _frida_kmod_link_open = .; . += 8;
+    _frida_kmod_link_close = .; . += 8;
+    _frida_kmod_link_send = .; . += 8;
+    _frida_kmod_link_recv = .; . += 8;
+    _frida_kmod_link_pending = .; . += 8;
+    _frida_kmod_exit_worker = .; . += 8;
+    _frida_kmod_layout = .; . += 8;
+    _frida_kmod_remap_writable = .; . += 8;
+    _frida_kmod_unmap_writable = .; . += 8;
+    _execmem_alloc_rw = .; . += 8;
+    _vmalloc_noprof = .; . += 8;
+    _find_get_task_by_vpid = .; . += 8;
+    ___put_task_struct = .; . += 8;
+    _task_join_group_stop = .; . += 8;
+    ___cleanup_sighand = .; . += 8;
+    _kmem_cache_free = .; . += 8;
+    _signal_cachep = .; . += 8;
+    _put_files_struct = .; . += 8;
+    _switch_task_namespaces = .; . += 8;
+    _free_fs_struct = .; . += 8;
+    ___put_cred = .; . += 8;
+    __raw_spin_lock = .; . += 8;
+    __raw_spin_unlock = .; . += 8;
+    _capable = .; . += 8;
+    _show_map = .; . += 8;
+    _show_smap = .; . += 8;
+    _proc_fill_cache = .; . += 8;
+    _proc_pid_status = .; . += 8;
+    _do_task_stat = .; . += 8;
+    _release_task = .; . += 8;
+    _proc_task_instantiate = .; . += 8;
+    _proc_fd_instantiate = .; . += 8;
+    _proc_fdinfo_instantiate = .; . += 8;
+    ___x64_sys_prctl = .; . += 8;
    _text_poke_kgdb = .; . += 8;
    _execmem_free = .; . += 8;
    _module_alloc = .; . += 8;
@@ -59,6 +96,8 @@ SECTIONS {
    _page_offset_base = .; . += 8;
    _current_task = .; . += 8;
    _cpu_current_top_of_stack = .; . += 8;
+    ___preempt_count = .; . += 8;
+    _pcpu_hot = .; . += 8;
    _register_die_notifier = .; . += 8;
    _unregister_die_notifier = .; . += 8;
    _ioremap = .; . += 8;
@@ -47,8 +47,6 @@ fn main() {
        .write_to_file(out_dir.join("bindings.rs"))
        .expect("Couldn't write bindings");

-    // The Linux flavour is a staticlib: kbuild owns the final link, so it — not
-    // us — decides where the devkit and libc archives come from.
    if env::var("CARGO_FEATURE_BLOB").is_ok() {
        println!(
            "cargo:rustc-link-search=native={}",
@@ -89,6 +87,10 @@ fn main() {
        // references the entrypoint the host calls; keep the linker from
        // dropping it along with the rest of the unreferenced archive members.
        println!("cargo:rustc-link-arg=--undefined=_start");
+        if env::var("CARGO_FEATURE_LINUX_INJECTED").is_ok() {
+            println!("cargo:rustc-link-arg=--undefined=frida_agent_wake");
+            println!("cargo:rustc-link-arg=--undefined=frida_agent_stop");
+        }

        let note = compile_version_note(&out_dir, cc, &cc_args, arch);
        println!("cargo:rustc-link-arg={}", note.to_string_lossy());
@@ -1,5 +1,6 @@
 {
  "agent": {
+    "type": "resident",
    "transport": {
      "type": "socket",
      "path": "/tmp/frida-guest.sock"
@@ -1,5 +1,6 @@
 {
  "agent": {
+    "type": "resident",
    "transport": {
      "type": "device",
      "path": "/dev/frida"
@@ -2,27 +2,15 @@ MODULE_NAME ?= frida-agent

 obj-m += $(MODULE_NAME).o

-# frida-agent-prelinked.o is not built from source here: it is the Rust agent, the
-# GumJS devkit and the C library collapsed into a single relocatable object by the prelink
-# step in Makefile. Copy it in through if_changed rather than kbuild's _shipped rule,
-# so the .cmd file modpost expects gets written.
-$(MODULE_NAME)-y := frida-kmod.o frida-agent-prelinked.o
+$(MODULE_NAME)-y := frida-kmod.o frida-agent-image.o

-targets += frida-agent-prelinked.o
+AFLAGS_frida-agent-image.o := -DFRIDA_AGENT_IMAGE='"$(FRIDA_AGENT_IMAGE)"'

-quiet_cmd_frida_agent_prelinked = COPY    $@
-      cmd_frida_agent_prelinked = cp $< $@
+frida-header-has = $(if $(shell grep -ls '$(2)' $(srctree)/$(1)),-D$(3))
+ccflags-y += $(call frida-header-has,include/linux/sched.h,list_head[[:space:]]*thread_group;,FRIDA_HAVE_TASK_THREAD_GROUP)
+ccflags-y += $(call frida-header-has,include/linux/sched/signal.h,int[[:space:]]*quick_threads;,FRIDA_HAVE_SIGNAL_QUICK_THREADS)
+ccflags-y += $(call frida-header-has,include/linux/fs_struct.h,spinlock_t[[:space:]]*lock;,FRIDA_HAVE_FS_STRUCT_LOCK)
+ccflags-y += $(call frida-header-has,arch/$(SRCARCH)/include/asm/current.h,struct[[:space:]]*pcpu_hot[[:space:]]*{,FRIDA_HAVE_PCPU_HOT)
+ccflags-y += $(call frida-header-has,arch/$(SRCARCH)/include/asm/processor.h,vl_onexec\[ARM64_VEC_MAX\],FRIDA_HAVE_VECTOR_LENGTHS)

-$(obj)/frida-agent-prelinked.o: $(src)/frida-agent-prelinked.o.bin FORCE
-	$(call if_changed,frida_agent_prelinked)
-
-# On x86 objtool validates every object going into a module and generates its ORC
-# unwind tables. It was not built to read a JavaScript runtime linked against a
-# freestanding libc: it gives up on the first Rust switch jump table it cannot
-# follow, and the tables would only ever describe frames no kernel stack trace walks
-# into. Both the blob and the module object it is linked into have to be excused,
-# since objtool runs over each.
-OBJECT_FILES_NON_STANDARD_frida-agent-prelinked.o := y
-OBJECT_FILES_NON_STANDARD_$(MODULE_NAME).o := y
-
-ccflags-y += $(FRIDA_KMOD_DEFS)
+$(obj)/frida-agent-image.o: $(FRIDA_AGENT_IMAGE)
@@ -1,14 +1,3 @@
-# Builds frida-agent.ko in two steps, because kbuild insists on owning the final
-# link:
-#
-#   1. Collapse the Rust staticlib plus everything it needs — the GumJS devkit and
-#      the C library — into one relocatable object, and localize every symbol except
-#      the entry points frida-kmod.c calls. Localizing matters: Gum and the C library
-#      define names like memcpy and malloc that must not leak into the kernel's
-#      namespace.
-#   2. Hand that object to kbuild as a shipped object, so vermagic, modinfo and
-#      CRCs all come from the target kernel's own build system.
-#
 # See README.md for usage.

 # KDIR is the kernel to build against. When it is a source tree that was configured
@@ -17,142 +6,44 @@
 KDIR ?= /lib/modules/$(shell uname -r)/build
 PROFILE ?= release

-# The kernel's own name for the architecture, and the one Rust knows it by. Both
-# follow from the machine this is built for, which defaults to the one building.
 ARCH ?= $(shell uname -m \
 	| sed -e 's/^i[3-6]86$$/x86/' -e 's/^x86_64$$/x86/' -e 's/^aarch64$$/arm64/')
 BITS ?= $(shell uname -m \
 	| sed -e 's/^i[3-6]86$$/32/' -e 's/^x86_64$$/64/' -e 's/^aarch64$$/64/')

 ifeq ($(ARCH)-$(BITS),x86-32)
-RUST_TARGET ?= i686-unknown-none
-AGENT_TARGET_FLAGS ?= --target $(AGENT_DIR)/$(RUST_TARGET).json -Z json-target-spec
+RUST_TARGET ?= i686-unknown-none-pic
 SDK_ARCH ?= x86
-TOOLPREFIX ?=
-AGENT_LD_EMULATION ?= elf_i386
+AGENT_RUSTFLAGS ?=
+AGENT_CFLAGS ?= --target=i386-none-elf
 else ifeq ($(ARCH)-$(BITS),x86-64)
-RUST_TARGET ?= x86_64-unknown-none
+RUST_TARGET ?= x86_64-unknown-none-pic
 SDK_ARCH ?= x86_64
-TOOLPREFIX ?=
-AGENT_LD_EMULATION ?= elf_x86_64
+AGENT_RUSTFLAGS ?= -Zcf-protection=branch -Cllvm-args=--min-jump-table-entries=65536
+AGENT_CFLAGS ?= --target=x86_64-none-elf -fcf-protection=branch -fno-jump-tables
 else ifeq ($(ARCH)-$(BITS),arm64-64)
-RUST_TARGET ?= aarch64-unknown-none
+RUST_TARGET ?= aarch64-unknown-none-pic
 SDK_ARCH ?= arm64
-TOOLPREFIX ?= aarch64-none-elf-
+AGENT_RUSTFLAGS ?=
+AGENT_CFLAGS ?= --target=aarch64-none-elf -ffixed-x18
 else
-$(error Unsupported ARCH "$(ARCH)" and BITS "$(BITS)"; this flavour covers \
+$(error Unsupported ARCH "$(ARCH)" and BITS "$(BITS)"; this flavor covers \
 	x86/32, x86/64 and arm64/64)
 endif
-AGENT_TARGET_FLAGS ?= --target $(RUST_TARGET)
-
-AGENT_DIR := $(CURDIR)/..
-AGENT_TARGET_DIR := $(AGENT_DIR)/target-linux
-AGENT_LIB := $(AGENT_TARGET_DIR)/$(RUST_TARGET)/$(PROFILE)/libfrida_barebone_agent.a

+FRIDA_SDK ?= $(error Set FRIDA_SDK to a none-$(SDK_ARCH)-softfloat_pic SDK prefix)
 GUMJS_DEVKIT_DIR ?= $(error Set GUMJS_DEVKIT_DIR to the directory holding libfrida-gumjs.a)

-# Any binutils that speak the target's ELF will do; nothing here is compiled with
-# them. Building for the host's own architecture, that is the host's binutils.
-AGENT_LD ?= $(TOOLPREFIX)ld
-AGENT_AR ?= $(TOOLPREFIX)ar
-AGENT_NM ?= $(TOOLPREFIX)nm
-AGENT_OBJCOPY ?= $(TOOLPREFIX)objcopy
-
-# The ABI the kernel imposes on anything linked into it. The flags only reach crates
-# Cargo compiles, and the toolchain ships core, alloc and compiler_builtins prebuilt
-# without them, so those three have to be rebuilt from source as well. That needs the
-# rust-src component and an unstable flag, hence RUSTC_BOOTSTRAP.
-#
-# On x86_64 that is endbr64 on every address-taken function, since a kernel with
-# CONFIG_X86_KERNEL_IBT faults an indirect call landing anywhere else, and switches
-# compiled as comparisons rather than jump tables, which objtool cannot follow into.
-# Soft-float, the kernel code model and the absent red zone come with the target
-# itself. On arm64
-# it is x18, which the kernel reserves for the shadow call stack, so nothing linked in
-# may use it as a general-purpose register.
-ifeq ($(ARCH)-$(BITS),x86-32)
-AGENT_RUSTFLAGS ?=
-AGENT_CFLAGS ?= --target=i386-none-elf \
-	-Xclang -target-feature -Xclang +soft-float -mno-mmx -mno-sse \
-	-mlong-double-64 -fno-pic --sysroot=$(FRIDA_SDK)
-else ifeq ($(ARCH)-$(BITS),x86-64)
-AGENT_RUSTFLAGS ?= -Zcf-protection=branch \
-	-Cllvm-args=--min-jump-table-entries=65536 \
-	-Crelocation-model=static -Zplt=yes
-AGENT_CFLAGS ?= --target=x86_64-none-elf \
-	-Xclang -target-feature -Xclang +soft-float -mno-mmx -mno-sse -mno-red-zone \
-	-mlong-double-64 -mcmodel=kernel -fcf-protection=branch -fno-jump-tables \
-	-fno-pic --sysroot=$(FRIDA_SDK)
-else
-AGENT_RUSTFLAGS ?= -Zfixed-x18
-AGENT_CFLAGS ?= --target=aarch64-none-elf -mabi=aapcs-soft -mgeneral-regs-only \
-	-ffixed-x18 -fno-pic --sysroot=$(FRIDA_SDK)
-endif
-AGENT_BUILD_STD ?= -Z build-std=core,alloc,compiler_builtins
-
-# The devkit header reaches for GLib's and capstone's, which a devkit built against
-# an SDK leaves in that SDK rather than beside itself. The sysroot's own include
-# directory is spelled out because only clang's bare-metal driver, which it selects
-# for arm64 but not for x86_64, searches there on its own.
-AGENT_CFLAGS += -isystem $(FRIDA_SDK)/include \
+AGENT_CC ?= clang
+AGENT_CFLAGS += -I$(FRIDA_SDK)/include \
 	-I$(FRIDA_SDK)/include/glib-2.0 \
 	-I$(FRIDA_SDK)/lib/glib-2.0/include \
 	-I$(FRIDA_SDK)/include/capstone \
 	-I$(FRIDA_SDK)/include/json-glib-1.0

-# The soft-float SDK, whose libc is picolibc and whose compiler runtime is
-# compiler-rt. GCC's own newlib and libgcc are hard-float and cannot be used here.
-FRIDA_SDK ?= $(error Set FRIDA_SDK to a none-$(SDK_ARCH)-softfloat_nopic SDK prefix)
-LIBM = $(FRIDA_SDK)/lib/libm.a
-LIBBUILTINS = $(FRIDA_SDK)/lib/libclang_rt.builtins.a
-
-# bindgen reads the devkit header through whatever this compiler reports as its
-# include path, so it has to be one that knows where the SDK keeps its libc. It has
-# to be clang either way: -mabi=aapcs-soft landed there in 19 and GCC has it at no
-# version, and on x86_64 the soft-float ABI is reachable only as an -Xclang feature.
-AGENT_CC ?= clang
-
-PRELINKED := frida-agent-prelinked.o.bin
-
-AGENT_LIB_SOFTFLOAT := $(AGENT_TARGET_DIR)/libfrida-barebone-agent-softfloat.a
-
-# On arm64 the toolchain's own compiler_builtins is compiled for the ordinary AAPCS,
-# where a double travels in d0: its __muldf3 opens with "fmov x14, d0". Everything
-# else there is -mabi=aapcs-soft and passes that same double in x0. Whole-archiving
-# the staticlib puts those definitions in front of the SDK's compiler-rt, which has
-# the soft-float ones, and every double the C library computes then comes back
-# garbage — quietly, since the arithmetic still runs. Drop them and let compiler-rt
-# answer instead. x86_64 needs none of this: soft-float is part of the Rust target
-# there, so the copy build-std compiles already passes doubles the way the C half
-# expects.
-ifeq ($(ARCH),arm64)
-DROP_HARDFLOAT_BUILTINS = \
-	$(AGENT_AR) d $@ $$($(AGENT_NM) --print-armap $@ | sed -n 's/^__muldf3 in //p') && \
-	$(AGENT_AR) s $@
-else
-DROP_HARDFLOAT_BUILTINS = :
-endif
-
-# The agent puts malloc, the C library's locks and its process stubs on the kernel's
-# own facilities, so picolibc's versions are duplicate definitions rather than
-# fallbacks. Work out which members they live in instead of naming them: the set
-# follows from what the agent defines, and picolibc moves things between releases.
-LIBC := $(AGENT_TARGET_DIR)/libc-trimmed.a
-
-ENTRY_POINTS := frida_agent_start frida_agent_stop \
-	gum_interceptor_obtain gum_interceptor_begin_transaction \
-	gum_interceptor_end_transaction gum_interceptor_replace \
-	gum_interceptor_revert
-KEEP_GLOBAL := $(foreach s,$(ENTRY_POINTS),--keep-global-symbol=$(s))
-
-# Two structures the reparenting path reaches into lost a member upstream, and
-# neither change announces itself as anything frida-kmod.c could test for. The
-# headers it is compiled against are the authority on both, so ask them.
-FRIDA_KMOD_DEFS := \
-	$(if $(shell grep -l 'list_head[[:space:]]*thread_group;' \
-		$(KDIR)/include/linux/sched.h),-DFRIDA_HAVE_TASK_THREAD_GROUP) \
-	$(if $(shell grep -l 'spinlock_t[[:space:]]*lock;' \
-		$(KDIR)/include/linux/fs_struct.h),-DFRIDA_HAVE_FS_STRUCT_LOCK)
+AGENT_DIR := $(CURDIR)/..
+AGENT_TARGET_DIR := $(AGENT_DIR)/target-linux-$(SDK_ARCH)
+AGENT_IMAGE := frida-agent.elf

 all: modules

@@ -160,47 +51,24 @@ all: modules
 # next boot, so bring-up wants a fresh one per attempt.
 MODULE_NAME ?= frida-agent

-modules: $(PRELINKED)
+modules: $(AGENT_IMAGE)
 	$(MAKE) -C $(KDIR) $(if $(KOUT),O=$(KOUT)) M=$(CURDIR) ARCH=$(ARCH) \
-		FRIDA_KMOD_DEFS="$(FRIDA_KMOD_DEFS)" MODULE_NAME=$(MODULE_NAME) modules
+		MODULE_NAME=$(MODULE_NAME) FRIDA_AGENT_IMAGE=$(CURDIR)/$(AGENT_IMAGE) modules

-$(PRELINKED): $(AGENT_LIB_SOFTFLOAT) $(LIBC) prelink.lds
-	$(AGENT_LD) -r $(if $(AGENT_LD_EMULATION),-m $(AGENT_LD_EMULATION)) \
-		-T prelink.lds -o $@.tmp \
-		--whole-archive $(AGENT_LIB_SOFTFLOAT) --no-whole-archive \
-		--start-group \
-			$(GUMJS_DEVKIT_DIR)/libfrida-gumjs.a \
-			$(LIBC) \
-			$(LIBM) \
-			$(LIBBUILTINS) \
-		--end-group
-	$(AGENT_OBJCOPY) $(KEEP_GLOBAL) --strip-debug \
-		--remove-section=.llvmbc --remove-section=.llvmcmd $@.tmp $@
-	rm -f $@.tmp
-
-$(AGENT_LIB_SOFTFLOAT): agent
-	cp $(AGENT_LIB) $@
-	$(DROP_HARDFLOAT_BUILTINS)
-
-$(LIBC): export LC_ALL = C
-$(LIBC): $(AGENT_LIB_SOFTFLOAT)
-	cp $(FRIDA_SDK)/lib/libc.a $@
-	$(AGENT_NM) --defined-only $(AGENT_LIB_SOFTFLOAT) \
-		| awk 'NF == 3 && $$2 ~ /^[TDBR]$$/ { print $$3 }' | sort -u > $@.agent-syms
-	$(AGENT_NM) --print-armap $@ | sed -n 's/^\([^ ]*\) in \(.*\)$$/\1 \2/p' | sort -u > $@.members
-	$(AGENT_AR) d $@ $$(join $@.agent-syms $@.members | awk '{ print $$2 }' | sort -u)
-	$(AGENT_AR) s $@
-	rm -f $@.agent-syms $@.members
+$(AGENT_IMAGE): agent
+	cp $(AGENT_TARGET_DIR)/$(RUST_TARGET)/$(PROFILE)/frida-barebone-agent $@

 agent:
-	cd $(AGENT_DIR) && RUSTC_BOOTSTRAP=1 RUSTFLAGS="$(AGENT_RUSTFLAGS)" \
-		CC_$(subst -,_,$(RUST_TARGET))="$(AGENT_CC) $(AGENT_CFLAGS)" \
-		cargo build --$(PROFILE) \
-		$(AGENT_TARGET_FLAGS) --features linux \
-		--target-dir $(AGENT_TARGET_DIR) $(AGENT_BUILD_STD)
+	cd $(AGENT_DIR) && RUSTC_BOOTSTRAP=1 \
+		RUSTFLAGS="-L native=$(FRIDA_SDK)/lib $(AGENT_RUSTFLAGS)" \
+		CC="$(AGENT_CC) $(AGENT_CFLAGS)" \
+		GUMJS_DEVKIT_DIR=$(GUMJS_DEVKIT_DIR) \
+		cargo build --$(PROFILE) --features linux-injected \
+		--target ./$(RUST_TARGET).json -Z json-target-spec \
+		--target-dir $(AGENT_TARGET_DIR) -Z build-std=core,alloc,compiler_builtins

 clean:
 	$(MAKE) -C $(KDIR) $(if $(KOUT),O=$(KOUT)) M=$(CURDIR) ARCH=$(ARCH) clean
-	rm -f $(PRELINKED) $(PRELINKED).tmp $(AGENT_LIB_SOFTFLOAT) $(LIBC)
+	rm -f $(AGENT_IMAGE)

 .PHONY: all modules agent clean
@@ -1,291 +1,201 @@
 # Linux kernel module

-The same agent that the Barebone backend injects into XNU from the outside, but
-loaded from the inside as an ordinary kernel module.
+The agent the Barebone backend injects into a Linux guest from the outside,
+loaded from the inside instead. The module is a loader and nothing more: it
+carries the same `linux-injected` image a hypervisor would write into guest
+memory, maps and relocates it, and starts it. Everything past that point is the
+one implementation, whichever way the agent got in: the GumJS runtime, process
+and module enumeration, cloaking, the userspace injector.

-## How it differs from the XNU flavor
+## What the loader does

-|                   | XNU                                              | Linux                                     |
-|-------------------|--------------------------------------------------|-------------------------------------------|
-| Delivery          | remote stub injects a freestanding ELF           | `insmod frida-agent.ko`                   |
-| Kernel primitives | addresses patched into `.kernel_addrs` by the host | direct calls into `frida-kmod.c`        |
-| Bootstrap config  | GVariant blob written into guest memory          | module parameters                         |
-| Transport         | virtio hostlink or vsock                         | `/dev/frida` character device             |
-| Page permissions  | host rewrites descriptors over the hostlink      | `set_memory_*()`                          |
-| Writable alias    | shadow copy, committed via physical-memory bridge | `vmap()` of the same pages               |
-| Symbols           | table supplied by the host                       | kallsyms                                  |
+|                    | From the outside                              | From the inside (`frida-agent.ko`)               |
+|--------------------|-----------------------------------------------|--------------------------------------------------|
+| Delivery           | host writes the image into guest memory       | `insmod`; the image is embedded in the module    |
+| Relocation         | host applies `.rela.dyn`                      | loader applies `.rela.dyn` (`.rel.dyn` on x86)   |
+| `.kernel_addrs`    | host fills the slots from its symbol source   | loader fills them from kallsyms                  |
+| Struct layouts     | BTF                                           | `offsetof()` table from the module's headers, BTF behind it |
+| Symbol table       | supplied by the host                          | built by the loader from kallsyms                |
+| Transport          | virtio hostlink or vsock                      | `/dev/frida` character device                    |
+| Writable alias     | host rewrites page tables                     | `vmap()` of the same pages                       |
+| Lifetime           | ends when the host detaches                   | resident until `rmmod`                           |

-Because the Linux agent performs its own memory work, it never issues the
-`RemapWritablePages`, `MemoryProtect` or `PatchCode` host RPCs. The wire protocol
-is otherwise identical, so the host side sees the same `(yqv)` frames.
+The configuration the agent starts from is the same GVariant either way; the
+loader writes one naming the character device as its transport. A slot the
+loader fills that the host never does — the link functions, the layout table,
+the writable alias — is what tells the agent it was loaded from the inside.

 ## Building

-Four inputs: this repository, a GumJS devkit built for
-`none-<arch>-softfloat_nopic`, the SDK it was built against, and the kernel the module is for. `Makefile`
-covers x86_64 and arm64, and defaults to the architecture of the machine building.
-
-Building for the running kernel is a good deal shorter than cross-building for a
-device, so that walkthrough comes first; the arm64 one below it is the same steps
-with the kernel obtained from elsewhere.
+Three inputs besides this repository: a GumJS devkit for
+`none-<arch>-softfloat_pic`, the SDK it was built against, and the kernel the
+module is for. Building the image needs no kernel and runs anywhere; only the
+kbuild step needs the kernel's build tree.

 ### Toolchain

-    rustup target add x86_64-unknown-none    # or aarch64-unknown-none
-    rustup component add rust-src
-    sudo dnf install clang binutils kernel-devel-$(uname -r)
+    rustup toolchain install nightly
+    rustup component add rust-src --toolchain nightly

-clang must be 19 or newer, since that is where `-mabi=aapcs-soft` landed; GCC does
-not implement it at any version, nor does it reach x86_64's soft-float ABI. The
-binutils are for the prelink, which reads the archive map that only GNU `nm` prints —
-the LLVM one does not; cross-building wants the target's, natively the host's own
-will do. The host compiler is for Cargo's own build scripts, which run on the machine
-doing the building.
+The image links with `rust-lld`; nothing GNU is involved. clang has to be 19 or
+newer, which is where `-mabi=aapcs-soft` landed. The kbuild step wants whatever
+compiler the kernel was built with.

-The commands below are run from the top of this repository, with `releng` checked
-out — `git submodule update --init releng` if the clone did not recurse.
+### The devkit and the SDK

-### For the running x86_64 kernel
+    version=17.26.2
+    arch=arm64          # or x86_64
+    base=https://github.com/frida/frida/releases/download/$version
+    curl -LO $base/frida-gumjs-devkit-$version-none-$arch-softfloat_pic.tar.xz
+    mkdir -p ~/gumjs-devkit
+    tar -C ~/gumjs-devkit -xf frida-gumjs-devkit-$version-none-$arch-softfloat_pic.tar.xz

-No prebuilt bundles are published for `none-x86_64-softfloat_nopic`, so both inputs are
-built locally, against the same SDK:
+    releng/deps.py sync sdk none-$arch-softfloat_pic ~/sdk-none-$arch-softfloat_pic

-    releng/deps.py build --bundle=sdk --host=none-x86_64-softfloat_nopic
-    mkdir -p ~/sdk-none-x86_64-softfloat_nopic
-    tar -C ~/sdk-none-x86_64-softfloat_nopic -xf deps/sdk-none-x86_64-softfloat_nopic.tar.xz
+`releng/deps.toml` pins which SDK a devkit was built against, and mixing the two
+leaves symbols undefined at link time.

-    gum=subprojects/frida-gum
-    mkdir -p $gum/build/none-x86_64-softfloat_nopic
-    (cd $gum/build/none-x86_64-softfloat_nopic \
-        && FRIDA_DEPS=$PWD/../../../../deps ../../configure \
-            --host=none-x86_64-softfloat_nopic \
-            --enable-gumjs \
-            --with-devkits=gumjs \
-            --with-devkit-symbol-scope=original \
-        && make)
+### For the running kernel

    make -C src/barebone/agent/linux \
-        FRIDA_SDK=$HOME/sdk-none-x86_64-softfloat_nopic \
-        GUMJS_DEVKIT_DIR=$PWD/$gum/build/none-x86_64-softfloat_nopic/bindings/gumjs/devkit
+        FRIDA_SDK=$HOME/sdk-none-$arch-softfloat_pic \
+        GUMJS_DEVKIT_DIR=$HOME/gumjs-devkit

-Everything else — `KDIR`, the Rust target, the binutils, the kernel's own name for the
-architecture — follows from the running kernel.
+`KDIR`, the Rust target and the kernel's name for the architecture all follow
+from the running kernel. `make frida-agent.elf` stops after the image, which is
+also what the Barebone backend injects from the outside.

-### For an arm64 device
+### For an Android device

-Here there are published bundles to start from, and the kernel has to be assembled.
-
-#### The devkit and the SDK
-
-    version=17.17.0
-    base=https://github.com/frida/frida/releases/download/$version
-    curl -LO $base/frida-gumjs-devkit-$version-none-arm64-softfloat_nopic.tar.xz
-    mkdir -p ~/gumjs-devkit
-    tar -C ~/gumjs-devkit -xf frida-gumjs-devkit-$version-none-arm64-softfloat_nopic.tar.xz
-
-    releng/deps.py sync sdk none-arm64-softfloat_nopic ~/sdk-none-arm64-softfloat_nopic
-
-The SDK carries picolibc and the compiler-rt builtins the devkit expects to be linked
-against, and `releng/deps.toml` pins which one. Mixing a devkit with an SDK built for
-a different libc leaves undefined symbols at prelink time.
-
-#### The kernel
-
-Nothing here needs the device's own kernel to be built, but the config alone is not
-enough either. `uname -r` ends in the GKI commit and the build number:
+The image is built the same way; it is the kernel tree that takes assembling.
+`uname -r` ends in the GKI commit and the build number:

    adb shell uname -r
-    6.1.145-android14-11-gc1de4747ac59-ab14219743
+    6.6.102-android15-8-g6eb5b2a8c46b-ab14739656-4k

-which is commit `c1de4747ac59` and build `14219743`. Three pieces are keyed to them:
+which is commit `6eb5b2a8c46b` and build `14739656`. The source comes from the
+commit, the CRCs `CONFIG_MODVERSIONS` checks from what CI published for the
+build, and the config from the device itself:

-    commit=c1de4747ac59
-    build=14219743
+    commit=6eb5b2a8c46b
+    build=14739656
    ci=https://ci.android.com/builds/submitted/$build/kernel_aarch64/latest/raw

-    mkdir -p ~/kernel-prepared ~/kernel-source
-    curl -sSL $ci/modules_prepare_outdir.tar.gz | tar -xz -C ~/kernel-prepared
-    curl -sSL $ci/kernel_aarch64_Module.symvers -o ~/kernel-prepared/Module.symvers
+    mkdir -p ~/kernel
    curl -sSL https://android.googlesource.com/kernel/common/+archive/$commit.tar.gz \
-        | tar -xz -C ~/kernel-source
+        | tar -xz -C ~/kernel
+    curl -sSL $ci/kernel_aarch64_Module.symvers -o ~/kernel/Module.symvers
+    adb shell "su -c 'cat /proc/config.gz'" | gunzip > ~/kernel/.config
+    make -C ~/kernel ARCH=arm64 LLVM=1 olddefconfig modules_prepare

-`modules_prepare_outdir.tar.gz` is the configured build tree with `scripts/` already
-compiled as x86-64 binaries, so the kbuild half has to run on an x86-64 Linux host —
-an arm64 one gets as far as `CC [M]` and then fails to run `fixdep`. `Module.symvers`
-carries the CRCs `CONFIG_MODVERSIONS` checks. The top-level `Makefile` in that prepared tree is a stub
-that includes the source's, hence both `KDIR` and `KOUT` below.
-
-A different GKI build of the same branch does not substitute for these: vermagic is
-compared verbatim, and it names the exact build.
-
-#### Build
+That wants a Linux host, of either architecture, with clang and lld. With
+`CONFIG_MODVERSIONS` the kernel matches a module by its CRCs rather than by the
+release vermagic names, so the release this tree reports does not have to be
+the device's; the vendor's own modules do not carry it either.

    make -C src/barebone/agent/linux \
-        FRIDA_SDK=$HOME/sdk-none-arm64-softfloat_nopic \
+        ARCH=arm64 BITS=64 \
+        FRIDA_SDK=$HOME/sdk-none-arm64-softfloat_pic \
        GUMJS_DEVKIT_DIR=$HOME/gumjs-devkit \
-        AGENT_LD=aarch64-linux-gnu-ld \
-        AGENT_AR=aarch64-linux-gnu-ar \
-        AGENT_NM=aarch64-linux-gnu-nm \
-        AGENT_OBJCOPY=aarch64-linux-gnu-objcopy \
-        KDIR=$HOME/kernel-source \
-        KOUT=$HOME/kernel-prepared \
+        KDIR=$HOME/kernel \
        LLVM=1

-`make` builds the Rust staticlib itself, prelinks it against the devkit and the SDK,
-then hands the result to kbuild. The `AGENT_*` overrides are only needed because the
-defaults name an `aarch64-none-elf-` GNU toolchain; drop them if that is what is
-installed.
-
-The prelink half runs anywhere; the kbuild half needs the x86-64 Linux host above.
-Cross-building from macOS means running that step in a container holding the kernel
-tree.
-
    adb push src/barebone/agent/linux/frida-agent.ko /data/local/tmp/

 ## Loading

    insmod frida-agent.ko

-The module's init path returns as soon as the worker thread is running — watch
-`dmesg` for `frida: listening on /dev/frida`. `rmmod frida-agent` unwinds in the
-reverse order and does not return until the worker is off the module's text.
+Init returns once the agent's worker is running and `/dev/frida` is there.
+`rmmod frida-agent` stops the agent, waits for its worker to leave the image,
+and only then frees it.

 ## Talking to it

-The agent exposes `/dev/frida` and waits: one client at a time, `read`/`write` of the
-same length-prefixed frames the other transports carry, with `poll` for readiness.
-It never dials out, so there is no network namespace to get right and no ordering
-requirement between loading the module and attaching a client.
+The agent waits on `/dev/frida`: one client at a time, `read`/`write` of the
+same length-prefixed frames the other transports carry, with `poll` for
+readiness. It never dials out, so there is no network namespace to get right
+and no ordering between loading the module and attaching a client.

-On Android the node is created by devtmpfs without a policy-specific label, so an
-SELinux-enforcing system needs the client's domain granted access to it before it can
-open the device. A socket-based transport was the other option considered and is a
-worse fit: `AF_VSOCK` only reaches a peer when a hypervisor is on the other side, and
-having the kernel connect out to loopback needs something already listening before
-the module loads.
+On Android devtmpfs creates the node without a policy-specific label, so an
+SELinux-enforcing system needs the client's domain granted access to it.

-### Reaching it from a host
-
-Serve the Barebone device from a frida-server running on the target, so the `open()`
-happens next to the device node and the host talks to an ordinary frida-server:
+Serve the Barebone device from a frida-server running on the target, so the
+`open()` happens next to the device node:

    FRIDA_BAREBONE_CONFIG=/data/local/tmp/linux-kmod.json \
        frida-server --device barebone -l 127.0.0.1:27042

-`etc/linux-kmod.json` is that config. From the host, with `adb forward tcp:27042
-tcp:27042` in place:
+`etc/linux-kmod.json` is that config. Its `"type": "resident"` is what keeps a
+client leaving from stopping the agent. From the host, with
+`adb forward tcp:27042 tcp:27042` in place:

    frida -H 127.0.0.1:27042 -p 0

 ## Injecting into userspace

-Loaded on a live system the module doubles as a ptrace-free injector for ordinary
-processes — how the Linux local backend reaches its targets when the module is
-present, falling back to `ptrace` when it is not. There is no second device node;
-the channel is `prctl()` with a magic option and a token in the fifth argument,
+On x86_64 and arm64 a resident agent doubles as a ptrace-free injector for
+ordinary processes — how the Linux local backend reaches its targets when the
+agent is there, falling back to `ptrace` when it is not. The channel is
+`prctl()` with a magic option and a token in the fifth argument,

    prctl(0x46524944, op, arg1, arg2, 0x1d5f9e6b2c7a4038)

 and any call whose option or token does not match falls through to the real
-prctl, so probing for the module looks like a stock kernel. `op` 32 pings and
+prctl, so probing for the agent looks like a stock kernel. `op` 32 pings and
 returns the magic.

-Allocate, free, read, write and spawn — the primitives the injector drives
-against a target pid — require `CAP_SYS_ADMIN`. A spawned thread is a real
-`CLONE_THREAD` sibling that adopts the target's mm, files, credentials,
-namespaces, fs and SysV semaphore undo list, so it is a native member of the
-group rather than a kernel thread wearing its address space.
+Allocate, free, read, write and spawn — what the injector drives against a
+target pid — require `CAP_SYS_ADMIN`. A spawned thread is a real member of the
+target's thread group that adopts its mm, files, credentials, namespaces, fs
+and SysV semaphore undo list, rather than a kernel thread wearing its address
+space.

-Cloaking is Gum's own registry mirrored into the kernel so it holds against
-`/proc` too: the module intercepts the `maps`, `smaps`, task and status readers
+Cloaking is Gum's own registry mirrored into the kernel, so it holds against
+`/proc` too: the agent intercepts the `maps`, `smaps`, task and status readers
 and drops cloaked threads, ranges and fds while keeping the counts consistent. A
-process cloaks its own resources with the token alone — no capability — so an
-injected agent self-cloaks by forwarding Gum's updates over the same channel,
-and the loader adds the footprint the agent itself never sees. A cloaked thread
-still sees through the cloak when it reads `/proc`, so the agent is not blind to
-its own process.
+process cloaks its own resources with the token alone, so an injected agent
+self-cloaks by forwarding Gum's updates over the same channel. A cloaked thread
+still sees through the cloak when it reads `/proc`.

 ## What the target kernel has to provide

- **x86_64 or arm64.** The register-level pieces — the page size, cache maintenance,
-  where the syscall ABI leaves prctl()'s arguments, and how a spawned thread's
-  registers are set up for its return to userspace — have a half for each. The XNU
-  flavor remains arm64-only.
- **`CONFIG_KPROBES` and `CONFIG_KALLSYMS_ALL`.** A good deal of what the shim
-  needs is compiled in but not exported — `kallsyms_lookup_name`,
-  `kallsyms_on_each_symbol` and `set_memory_*` all are, and GKI trims its export
-  table to the KMI symbol list on top of that. The shim resolves them by name
-  through a kprobe, which is the standard way back in. Without kallsyms the module
-  still loads but cannot look up symbols or change page permissions.
+- **x86_64 or arm64** for everything above; 32-bit x86 and ARM load the agent
+  but have no injector.
+- **`CONFIG_KPROBES` and `CONFIG_KALLSYMS_ALL`.** Most of what the agent calls
+  is compiled in but not exported, and GKI trims its export table to the KMI
+  symbol list on top of that. The loader finds `kallsyms_lookup_name` through a
+  kprobe and resolves the rest by name.
 - **Unsigned modules.** `CONFIG_MODULE_SIG_FORCE` must be off. Android's
  `CONFIG_MODULE_SIG_PROTECT` is fine: it only demands signatures for modules on
  the GKI list.
+- **No BTI on arm64.** The image has no landing pads, so a CPU implementing BTI
+  under a kernel built with `CONFIG_ARM64_BTI_KERNEL` faults the first indirect
+  call into it.

 ## Kernel ABI constraints

-A hardened kernel imposes an ABI on anything linked into it, and the FP constraint
-below is why this flavor is built against a soft-float SDK
-(`none-arm64-softfloat_nopic`, `none-x86_64-softfloat_nopic`) rather than an ordinary
-bare-metal one. The remaining constraints are per-architecture.
+A hardened kernel imposes an ABI on anything running inside it, which the image
+honors whichever way it got in:

 - **FP/SIMD.** JavaScript numbers are doubles, so a hardfloat build would use FP
-  for as long as the runtime lives, and neither architecture lets a kernel thread
-  hold it for free — x86 wants every stretch bracketed by `kernel_fpu_begin()`, and
-  on arm64 kernels before 6.9 there is no correct way to hold it at all:
-  `kernel_neon_begin()` runs with preemption disabled so we cannot sleep under it,
-  and the scheduler does not save a kernel thread's FP registers — live values are
-  lost on preemption and the FP state of whichever user task was interrupted is
-  corrupted. Building everything soft-float removes the question rather than
-  answering it: `-mabi=aapcs-soft -mgeneral-regs-only` on arm64, and on x86_64
-  LLVM's `+soft-float`, which is also what Rust's own `x86_64-unknown-none` turns
-  on, so the two halves agree on where a double travels. `-mno-sse` alone does not
-  reach the ABI; and `long double` has to be narrowed to 64 bits with
-  `-mlong-double-64`, since soft-float has no lowering for x87's 80-bit format and
-  LLVM crashes rather than calling out to a builtin.
- **Indirect branch tracking (x86_64).** With `CONFIG_X86_KERNEL_IBT` an indirect
-  call landing on anything but an `endbr64` faults, so everything linked in is built
-  `-fcf-protection=branch` and the Rust half `-Zcf-protection=branch`.
- **Kernel code model and red zone (x86_64).** Modules are loaded into the top 2GB
-  of the address space and their relocations are resolved as if by `-mcmodel=kernel`,
-  and there is no red zone below the stack pointer for an interrupt to step on. Both
-  come with the Rust target; the C half is told explicitly.
- **objtool (x86_64).** It validates every object entering a module and builds its
-  ORC unwind tables, and was not written to read a JavaScript runtime linked against
-  a freestanding libc. `Kbuild` marks the prelinked blob `OBJECT_FILES_NON_STANDARD`.
- **Shadow call stack (arm64).** With `CONFIG_SHADOW_CALL_STACK` the kernel reserves x18, so
-  the SDK and Gum are built `-ffixed-x18` and the Rust half with `-Zfixed-x18`.
-  Anything linked in that uses x18 as a scratch register overwrites the kernel's SCS
-  pointer, and the thread then returns through whatever that address happens to hold.
-
-  The Rust flag only reaches crates Cargo compiles, so `core`, `alloc` and
-  `compiler_builtins` — which the toolchain ships prebuilt, and which between them
-  account for every x18 write that used to reach the module — are rebuilt from source
-  via `-Z build-std`. That needs `rustup component add rust-src`.
-
-## The soft-float libc
-
-The libc is picolibc and the compiler runtime is compiler-rt, both from the
-soft-float SDK that `FRIDA_SDK` points at. `Makefile` trims a copy of its
-`libc.a` before the prelink: the agent implements `malloc`, the C library's locks and
-its process stubs over the kernel's own facilities, so picolibc's are duplicate
-definitions rather than fallbacks. The set is derived from what the agent defines
-rather than listed, since picolibc moves things between releases.
-
-On arm64 those compiler-rt builtins are load-bearing in a way that is easy to miss.
-Rust's toolchain carries its own `compiler_builtins`, compiled for the ordinary AAPCS
-where a double travels in `d0`, and the prelink whole-archives the Rust staticlib — so
-without the filtering step in `Makefile` those definitions answer the C library's calls
-to `__muldf3` and friends, which pass the same double in `x0`. Nothing crashes. The
-arithmetic simply returns garbage, and the first thing to notice is GLib deciding a
-hash table need not grow. x86_64 needs none of that filtering: soft-float is part of
-the Rust target there, so the copy `-Z build-std` compiles already agrees with the C
-half.
-
-## What a script may look like
-
-The runtime compiles scripts on a kernel thread's stack, and QuickJS parses
-expressions by recursion, so the ceiling is nesting rather than length: roughly
-fourteen levels of parentheses or fifteen of object literals on arm64 Linux, whose
-kernel stack is 16 KiB — as is x86_64's. A script that exceeds it fails to compile rather than taking
-anything down, though the message is not always `stack overflow` — an over-deep
-`if`/`else` chain reports `expecting ';'`. Long scripts are fine; deep ones are not.
+  for as long as the runtime lives, and neither architecture lets a kernel
+  thread hold it for free — x86 wants every stretch bracketed by
+  `kernel_fpu_begin()`, and on arm64 kernels before 6.9 there is no correct way
+  to hold it at all. Building everything soft-float removes the question: the
+  SDK, the devkit and the Rust target all use the soft-float ABI.
+- **Indirect branch tracking (x86_64).** With `CONFIG_X86_KERNEL_IBT` an
+  indirect call landing on anything but an `endbr64` faults, so the image is
+  built `-fcf-protection=branch` and `-Zcf-protection=branch`, with switches
+  compiled as comparisons rather than `notrack` jump tables. The kernel seals
+  the `endbr64` of every function it saw no indirect call to, so the loader
+  restores it on any it hands the agent to call.
+- **Shadow call stack (arm64).** With `CONFIG_SHADOW_CALL_STACK` the kernel
+  reserves x18, so the SDK, the devkit and the Rust target all leave it alone.
+  `core`, `alloc` and `compiler_builtins` are rebuilt from source with
+  `-Z build-std` so that holds for them too.
+- **Stack.** The runtime runs on a kernel thread's stack, and QuickJS parses
+  expressions by recursion, so the ceiling is nesting rather than length: around
+  fourteen levels of parentheses or fifteen of object literals on a 16 KiB
+  kernel stack. A script that exceeds it fails to compile rather than taking
+  anything down, though the message is not always `stack overflow`.
@@ -0,0 +1,7 @@
+	.section .rodata, "a"
+	.balign 16
+	.globl frida_agent_image_start
+frida_agent_image_start:
+	.incbin FRIDA_AGENT_IMAGE
+	.globl frida_agent_image_end
+frida_agent_image_end:
@@ -1,8 +0,0 @@
-SECTIONS
-{
-  .init_array 0 : {
-    _agent_init_start = .;
-    *(.init_array*)
-    _agent_init_end = .;
-  }
-}
@@ -236,7 +236,7 @@ unsafe fn rec_mutex_try_acquire(impl_: &mut RecMutexImpl) -> bool {

 unsafe fn rec_mutex_wait(impl_: &mut RecMutexImpl) {
    while impl_.count.load(Ordering::Relaxed) != 0 {
-        wait_on(&impl_.count, &mut || impl_.count.load(Ordering::Relaxed) == 0);
+        wait_on(&impl_.count, None, &mut || impl_.count.load(Ordering::Relaxed) == 0);
    }
 }

@@ -361,7 +361,7 @@ unsafe fn rw_lock_reader_try_acquire(impl_: &mut RWLockImpl) -> bool {

 unsafe fn rw_lock_wait_for_writers(impl_: &mut RWLockImpl) {
    while impl_.state.load(Ordering::Relaxed) & RW_WRITER_LOCK_BIT != 0 {
-        wait_on(&impl_.state, &mut || {
+        wait_on(&impl_.state, None, &mut || {
            impl_.state.load(Ordering::Relaxed) & RW_WRITER_LOCK_BIT == 0
        });
    }
@@ -369,7 +369,7 @@ unsafe fn rw_lock_wait_for_writers(impl_: &mut RWLockImpl) {

 unsafe fn rw_lock_wait_for_all(impl_: &mut RWLockImpl) {
    while impl_.state.load(Ordering::Relaxed) != 0 {
-        wait_on(&impl_.state, &mut || impl_.state.load(Ordering::Relaxed) == 0);
+        wait_on(&impl_.state, None, &mut || impl_.state.load(Ordering::Relaxed) == 0);
    }
 }

@@ -395,7 +395,7 @@ pub extern "C" fn g_cond_wait(cond: *mut GCond, mutex: *mut GMutex) {

        let impl_ = cond_impl(cond);
        while impl_.generation.load(Ordering::Acquire) == seen {
-            wait_on(&impl_.generation, &mut || {
+            wait_on(&impl_.generation, None, &mut || {
                impl_.generation.load(Ordering::Acquire) != seen
            });
        }
@@ -431,11 +431,13 @@ pub extern "C" fn g_cond_wait_until(cond: *mut GCond, mutex: *mut GMutex, end_ti

        let impl_ = cond_impl(cond);
        let mut signalled = impl_.generation.load(Ordering::Acquire) != seen;
-        while !signalled && crate::kernel::monotonic_micros() < end_time {
-            wait_on(&impl_.generation, &mut || {
+        let mut now = crate::kernel::monotonic_micros();
+        while !signalled && now < end_time {
+            wait_on(&impl_.generation, Some((end_time - now) as u64), &mut || {
                impl_.generation.load(Ordering::Acquire) != seen
            });
            signalled = impl_.generation.load(Ordering::Acquire) != seen;
+            now = crate::kernel::monotonic_micros();
        }

        g_mutex_lock(mutex);
@@ -620,7 +622,7 @@ pub extern "C" fn _g_system_thread_wait(thread: *mut GSystemThread) {
        let system_thread = thread as *mut SystemThreadImpl;

        while (*system_thread).thread_id.load(Ordering::Acquire) == 0 {
-            wait_on(&(*system_thread).thread_id, &mut || {
+            wait_on(&(*system_thread).thread_id, None, &mut || {
                (*system_thread).thread_id.load(Ordering::Acquire) != 0
            });
        }
@@ -645,7 +647,7 @@ unsafe fn cleanup_wrapper_data(wrapper_data: *mut ThreadWrapperData) {

 unsafe fn lock_acquire(lock: &AtomicU32) {
    while !unsafe { lock_try_acquire(lock) } {
-        wait_on(lock, &mut || lock.load(Ordering::Relaxed) == 0);
+        wait_on(lock, None, &mut || lock.load(Ordering::Relaxed) == 0);
    }
 }

@@ -659,19 +661,11 @@ unsafe fn lock_release(lock: &AtomicU32) {
    wake_waiters(lock);
 }

-// Sleeps until `ready` holds or the slice expires, whichever comes first.
-//
-// These used to spin on wfe/sev. A kernel thread that spins never reaches the
-// scheduler, so a lost wakeup — or a genuine deadlock, which is how we found this —
-// starves the CPU it is on until the hardware watchdog takes the machine down. The
-// bounded sleep turns both into a stall that can be observed instead.
-//
 // The address of the word being waited on names the wait channel: XNU pairs
-// assert_wait()/thread_wakeup() on it directly, while the Linux shim has a single
-// channel and treats it as a hint. Every caller re-checks its own condition in a
-// loop, so a spurious wakeup costs nothing either way.
-fn wait_on<T>(word: &T, ready: &mut dyn FnMut() -> bool) {
-    crate::kernel::wait(token_of(word), Some(WAIT_SLICE_US), ready);
+// assert_wait()/thread_wakeup() on it directly. Every caller re-checks its own
+// condition in a loop, so a spurious wakeup costs nothing either way.
+fn wait_on<T>(word: &T, timeout_us: Option<u64>, ready: &mut dyn FnMut() -> bool) {
+    crate::kernel::wait(token_of(word), timeout_us, ready);

    // The wait above returns without sleeping whenever `ready` already holds, so on
    // its own it is not enough to keep a contended loop off the CPU: every caller
@@ -688,4 +682,3 @@ fn token_of<T>(word: &T) -> *const u8 {
    word as *const T as *const u8
 }

-const WAIT_SLICE_US: u64 = 1000;
@@ -19,14 +19,12 @@ use alloc::vec::Vec;
 use core::ptr;
 use core::sync::atomic::{AtomicU32, Ordering};

-#[cfg(feature = "linux")]
-use crate::gum_linux::enumerate_exports_in_range;
-#[cfg(any(feature = "linux", feature = "linux-injected"))]
+#[cfg(feature = "linux-injected")]
 use crate::bindings::{
    GumFoundSymbolFunc, GumSymbolDetails, GumSymbolType_GUM_SYMBOL_FUNCTION,
    GumSymbolType_GUM_SYMBOL_OBJECT, GumSymbolType_GUM_SYMBOL_UNKNOWN, gboolean, gssize,
 };
-#[cfg(any(feature = "linux", feature = "linux-injected"))]
+#[cfg(feature = "linux-injected")]
 use crate::gum_modules::enumerate_symbols_in_range;
 #[cfg(any(feature = "win9x", feature = "winnt"))]
 use crate::gum_windows::{enumerate_exports_in_range, enumerate_imports_in_module};
@@ -192,7 +190,7 @@ extern "C" fn gum_native_module_iface_init(g_iface: gpointer, _iface_data: gpoin
                Some(crate::signed_to_be_called_back(gum_native_module_enumerate_imports, 0));
        }
        (*iface).find_export_by_name = Some(crate::signed_to_be_called_back(gum_native_module_find_export_by_name, 0));
-        #[cfg(any(feature = "linux", feature = "linux-injected"))]
+        #[cfg(feature = "linux-injected")]
        {
            (*iface).enumerate_symbols =
                Some(crate::signed_to_be_called_back(gum_native_module_enumerate_symbols, 0));
@@ -350,7 +348,7 @@ unsafe extern "C" fn gum_native_module_enumerate_imports(
    }
 }

-#[cfg(any(feature = "linux", feature = "linux-injected"))]
+#[cfg(feature = "linux-injected")]
 unsafe extern "C" fn gum_native_module_enumerate_symbols(
    self_: *mut GumModule,
    func: GumFoundSymbolFunc,
@@ -388,12 +386,12 @@ unsafe extern "C" fn gum_native_module_enumerate_symbols(
 /// What the backends implement for `gum_native_module_enumerate_symbols`: call
 /// `callback` for every symbol in `[start, end)`, stopping early when it returns
 /// false.
-#[cfg(any(feature = "linux", feature = "linux-injected"))]
+#[cfg(feature = "linux-injected")]
 pub(crate) type FoundSymbolCallback<'a> = dyn FnMut(*const gchar, u64, u64, u8, bool) -> bool + 'a;

-#[cfg(any(feature = "linux", feature = "linux-injected"))]
+#[cfg(feature = "linux-injected")]
 const SYMBOL_IS_OBJECT: u8 = 1;
-#[cfg(any(feature = "linux", feature = "linux-injected"))]
+#[cfg(feature = "linux-injected")]
 const SYMBOL_IS_FUNCTION: u8 = 2;

 /// What the backends implement for `gum_native_module_enumerate_exports`: call
@@ -116,6 +116,11 @@ pub extern "C" fn gum_memory_try_remap_writable_pages(
        return remap_agent_pages(first_page, n_pages);
    }

+    #[cfg(feature = "linux-injected")]
+    if let Some(alias) = kernel::remap_writable(first_page as u64, n_pages) {
+        return alias as gpointer;
+    }
+
    #[cfg(all(feature = "linux-injected", not(target_arch = "arm")))]
    if writable_in_place(first_page, n_pages) {
        return first_page;
@@ -271,6 +276,11 @@ pub extern "C" fn gum_memory_dispose_writable_pages(writable: gpointer, _n_pages
        return;
    }

+    #[cfg(feature = "linux-injected")]
+    if kernel::unmap_writable(writable as *mut core::ffi::c_void) {
+        return;
+    }
+
    if let Some(executable) = aliases().remove(&(writable as u64)) {
        let size = _n_pages as usize * unsafe { gum_query_page_size() } as usize;
        libc::__clear_cache(executable as *const u8, (executable + size as u64) as *const u8);
@@ -591,7 +601,7 @@ pub extern "C" fn gum_memory_allocate(
    #[cfg(all(not(feature = "xnu-core"), not(feature = "linux-injected")))]
    let ptr = kernel::alloc_code(size as usize);
    #[cfg(feature = "linux-injected")]
-    let ptr = kernel::alloc_heap(size as usize);
+    let ptr = kernel::alloc_code(size as usize);
    #[cfg(not(feature = "xnu-core"))]
    let _ = address;
    #[cfg(not(feature = "xnu-kext"))]
@@ -1,216 +0,0 @@
-// Linux half of Gum's platform backend. Everything is done locally: we are the
-// kernel, so page permissions go through set_memory_*(), writable aliases of
-// write-protected text come from vmap(), and symbols come from kallsyms.
-
-use crate::{
-    bindings::{
-        _GumPageProtection_GUM_PAGE_EXECUTE, _GumPageProtection_GUM_PAGE_READ,
-        _GumPageProtection_GUM_PAGE_WRITE, _GumRwxSupport_GUM_RWX_NONE, GArray,
-        GumDebugSymbolDetails, GumModuleRegistry, GumPageProtection, GumRwxSupport,
-        g_array_append_vals, g_array_new, g_pattern_spec_free, g_pattern_spec_match_string,
-        g_pattern_spec_new, g_strdup, gboolean, gchar, gconstpointer, gpointer, gsize, guint,
-        gum_mprotect,
-    },
-    gum::{self, FoundExportCallback},
-    kernel,
-};
-use core::ffi::CStr;
-use core::ptr;
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_barebone_query_platform() -> *const crate::bindings::gchar {
-    c"linux".as_ptr() as *const crate::bindings::gchar
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_barebone_query_stack_size() -> gsize {
-    crate::linux::stack_headroom() as gsize
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_query_rwx_support() -> GumRwxSupport {
-    _GumRwxSupport_GUM_RWX_NONE
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_memory_can_remap_writable() -> gboolean {
-    1
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_memory_try_remap_writable_pages(
-    first_page: gpointer,
-    n_pages: guint,
-) -> gpointer {
-    kernel::remap_writable(first_page as u64, n_pages) as gpointer
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_memory_dispose_writable_pages(writable: gpointer, _n_pages: guint) {
-    kernel::unmap_writable(writable as *mut core::ffi::c_void);
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_try_mprotect(
-    address: gpointer,
-    size: gsize,
-    prot: GumPageProtection,
-) -> gboolean {
-    if kernel::protect(address as u64, size as usize, prot as u32) {
-        1
-    } else {
-        0
-    }
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_memory_allocate(
-    _address: gpointer,
-    size: gsize,
-    _alignment: gsize,
-    prot: GumPageProtection,
-) -> gpointer {
-    let ptr = kernel::alloc_code(size as usize);
-    unsafe {
-        core::ptr::write_bytes(ptr, 0, size as usize);
-        if (prot & _GumPageProtection_GUM_PAGE_EXECUTE) != 0 {
-            gum::register_slab(ptr as u64, size as usize);
-            gum_mprotect(ptr as gpointer, size, prot);
-        }
-    }
-
-    ptr as gpointer
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_memory_free(address: gpointer, size: gsize) -> gboolean {
-    // vfree() wants the range writable again: the pages go back to the vmalloc
-    // allocator, and leaving them RX would fault the next consumer.
-    if gum::is_agent_slab(address as u64) {
-        unsafe {
-            gum_mprotect(
-                address,
-                size,
-                (_GumPageProtection_GUM_PAGE_READ | _GumPageProtection_GUM_PAGE_WRITE)
-                    as GumPageProtection,
-            );
-        }
-        gum::unregister_slab(address as u64);
-    }
-    kernel::free_code(address as *mut u8, size as usize);
-    1
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_barebone_on_registry_activating(registry: *mut GumModuleRegistry) {
-    crate::gum_modules::publish(registry);
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_barebone_on_registry_deactivating(_registry: *mut GumModuleRegistry) {
-    crate::gum_modules::unpublish();
-}
-
-pub(crate) unsafe fn enumerate_exports_in_range(
-    start_address: u64,
-    end_address: u64,
-    callback: &mut FoundExportCallback<'_>,
-) {
-    if crate::gum_modules::enumerate_exports_in_module(start_address, callback) {
-        return;
-    }
-
-    kernel::enumerate_symbols(&mut |name, address| {
-        if address < start_address || address >= end_address {
-            return true;
-        }
-        callback(name.as_ptr() as *const gchar, address)
-    });
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_symbol_details_from_address(
-    address: gpointer,
-    details: *mut GumDebugSymbolDetails,
-) -> gboolean {
-    let Some((name, symbol_address)) = kernel::symbol_from_address(address as u64) else {
-        return 0;
-    };
-
-    unsafe {
-        let name_bytes = name.as_bytes();
-        let copy_len = core::cmp::min(name_bytes.len(), (*details).symbol_name.len() - 1);
-        core::ptr::copy_nonoverlapping(
-            name_bytes.as_ptr(),
-            (*details).symbol_name.as_mut_ptr() as *mut u8,
-            copy_len,
-        );
-        (*details).symbol_name[copy_len] = 0;
-
-        (*details).address = symbol_address;
-
-        (*details).module_name[0] = 0;
-        (*details).file_name[0] = 0;
-        (*details).line_number = 0;
-        (*details).column = 0;
-    }
-
-    1
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_symbol_name_from_address(address: gpointer) -> *mut gchar {
-    let Some((name, _)) = kernel::symbol_from_address(address as u64) else {
-        return ptr::null_mut();
-    };
-
-    let mut name = name;
-    name.push('\0');
-    unsafe { g_strdup(name.as_ptr() as *const gchar) }
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_find_function(name: *const gchar) -> gpointer {
-    let address = kernel::find_function(unsafe { CStr::from_ptr(name) });
-    address as gpointer
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_find_functions_named(name: *const gchar) -> *mut GArray {
-    let wanted = unsafe { CStr::from_ptr(name) };
-
-    collect_addresses(&mut |candidate, _address| candidate == wanted)
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_find_functions_matching(pattern: *const gchar) -> *mut GArray {
-    unsafe {
-        let spec = g_pattern_spec_new(pattern);
-        let array = collect_addresses(&mut |candidate, _address| {
-            g_pattern_spec_match_string(spec, candidate.as_ptr() as *const gchar) != 0
-        });
-        g_pattern_spec_free(spec);
-        array
-    }
-}
-
-fn collect_addresses(predicate: &mut dyn FnMut(&CStr, u64) -> bool) -> *mut GArray {
-    unsafe {
-        let array = g_array_new(0, 0, core::mem::size_of::<gpointer>() as guint);
-
-        kernel::enumerate_symbols(&mut |name, address| {
-            if predicate(name, address) {
-                let addr = address as gpointer;
-                g_array_append_vals(array, &addr as *const gpointer as gconstpointer, 1);
-            }
-            true
-        });
-
-        array
-    }
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn gum_load_symbols(_path: *const gchar) -> gboolean {
-    0
-}
@@ -6,6 +6,7 @@
 // stream; whoever opens the device decides how it reaches the host.

 use core::cell::UnsafeCell;
+use core::sync::atomic::{AtomicBool, Ordering};
 use core::ffi::{c_int, c_void};

 use alloc::vec::Vec;
@@ -30,6 +31,7 @@ impl Hostlink {
        if unsafe { frida_kmod_link_open() } != 0 {
            return Err(());
        }
+        LINK_OPEN.store(true, Ordering::Release);

        Ok(Hostlink {
            state: UnsafeCell::new(Inner {
@@ -97,25 +99,55 @@ impl Hostlink {

 impl Drop for Hostlink {
    fn drop(&mut self) {
+        LINK_OPEN.store(false, Ordering::Release);
        unsafe { frida_kmod_link_close() };
    }
 }

-#[cfg(feature = "xnu-kext")]
 pub fn a_turn_is_wanted() -> bool {
-    unsafe { frida_kmod_link_pending() }
+    LINK_OPEN.load(Ordering::Acquire) && unsafe { frida_kmod_link_pending() }
 }

+static LINK_OPEN: AtomicBool = AtomicBool::new(false);
+
 fn recv_nonblocking(dst: &mut [u8]) -> usize {
    let n = unsafe { frida_kmod_link_recv(dst.as_mut_ptr() as *mut c_void, dst.len()) };
    if n <= 0 { 0 } else { n as usize }
 }

+#[cfg(feature = "xnu-kext")]
 unsafe extern "C" {
    fn frida_kmod_link_open() -> c_int;
    fn frida_kmod_link_close();
    fn frida_kmod_link_send(data: *const c_void, size: usize) -> c_int;
    fn frida_kmod_link_recv(data: *mut c_void, size: usize) -> isize;
-    #[cfg(feature = "xnu-kext")]
+    fn frida_kmod_link_pending() -> bool;
+}
+
+#[cfg(all(feature = "linux-injected", not(target_arch = "x86")))]
+unsafe extern "C" {
+    #[link_name = "_frida_kmod_link_open"]
+    static frida_kmod_link_open: unsafe extern "C" fn() -> c_int;
+    #[link_name = "_frida_kmod_link_close"]
+    static frida_kmod_link_close: unsafe extern "C" fn();
+    #[link_name = "_frida_kmod_link_send"]
+    static frida_kmod_link_send: unsafe extern "C" fn(*const c_void, usize) -> c_int;
+    #[link_name = "_frida_kmod_link_recv"]
+    static frida_kmod_link_recv: unsafe extern "C" fn(*mut c_void, usize) -> isize;
+    #[link_name = "_frida_kmod_link_pending"]
+    static frida_kmod_link_pending: unsafe extern "C" fn() -> bool;
+}
+
+#[cfg(all(feature = "linux-injected", target_arch = "x86"))]
+unsafe extern "C" {
+    #[link_name = "frida_k_frida_kmod_link_open"]
+    fn frida_kmod_link_open() -> c_int;
+    #[link_name = "frida_k_frida_kmod_link_close"]
+    fn frida_kmod_link_close();
+    #[link_name = "frida_k_frida_kmod_link_send"]
+    fn frida_kmod_link_send(data: *const c_void, size: usize) -> c_int;
+    #[link_name = "frida_k_frida_kmod_link_recv"]
+    fn frida_kmod_link_recv(data: *mut c_void, size: usize) -> isize;
+    #[link_name = "frida_k_frida_kmod_link_pending"]
    fn frida_kmod_link_pending() -> bool;
 }
@@ -1,14 +1,8 @@
 // Facade over the host kernel the agent is running inside of. Both backends
 // expose the same primitives, so the rest of the agent never names a specific
 // kernel.
-//
-// A kernel is reached from the outside -- a remote stub injects the agent and
-// patches the addresses it needs into .kernel_addrs -- or from the inside,
-// where the agent is a kernel module whose glue is an ordinary C translation
-// unit compiled against the target kernel's headers. Linux is reached either
-// way; the others only from the outside.

-#[cfg(any(feature = "linux", feature = "linux-injected"))]
+#[cfg(feature = "linux-injected")]
 pub use crate::linux::*;
 #[cfg(feature = "win9x")]
 pub use crate::win9x::*;
@@ -4,16 +4,12 @@
    feature = "xnu-core",
    feature = "win9x",
    feature = "winnt",
-    feature = "linux",
    feature = "linux-injected"
 )))]
 compile_error!(
-    "pick a flavor: --features xnu, --features win9x, --features winnt, --features linux or --features linux-injected"
+    "pick a flavor: --features xnu, --features win9x, --features winnt or --features linux-injected"
 );

-#[cfg(all(feature = "blob", feature = "linux"))]
-compile_error!("pick one flavour, not both");
-
 use alloc::boxed::Box;
 use alloc::collections::BTreeMap;
 use alloc::format;
@@ -58,17 +54,15 @@ mod ring;

 pub mod kernel;

-#[cfg(feature = "linux")]
-mod gum_linux;
 #[cfg(feature = "linux-injected")]
 mod gum_btf;
-#[cfg(any(feature = "linux", feature = "linux-injected"))]
+#[cfg(feature = "linux-injected")]
 mod gum_modules;
-#[cfg(any(feature = "linux", feature = "xnu-kext"))]
+#[cfg(any(feature = "linux-injected", feature = "xnu-kext"))]
 mod hostlink_chardev;
 #[cfg(any(feature = "linux-injected", feature = "xnu-core"))]
 mod heap;
-#[cfg(any(feature = "linux", feature = "linux-injected"))]
+#[cfg(feature = "linux-injected")]
 mod linux;

 #[cfg(any(feature = "win9x", feature = "winnt"))]
@@ -269,6 +263,19 @@ mod entrypoint_blob {
        unsafe { enter(config_data, config_size) }
    }

+    #[cfg(feature = "linux-injected")]
+    #[unsafe(no_mangle)]
+    pub extern "C" fn frida_agent_wake() {
+        nudge_the_loop(ptr::addr_of!(glib::WAKEUP_TOKEN) as *const u8);
+    }
+
+    #[cfg(feature = "linux-injected")]
+    #[unsafe(no_mangle)]
+    pub extern "C" fn frida_agent_stop() {
+        STOP_REQUESTED.store(true, Ordering::Release);
+        frida_agent_wake();
+    }
+
    unsafe fn enter(config_data: *const u8, config_size: usize) {
        unsafe {
            #[cfg(any(feature = "win9x", feature = "winnt", feature = "linux-injected", feature = "xnu-core"))]
@@ -312,6 +319,12 @@ mod entrypoint_blob {
            #[cfg(feature = "linux-injected")]
            crate::gum_btf::publish();

+            #[cfg(all(feature = "linux-injected", any(target_arch = "x86_64", target_arch = "aarch64")))]
+            {
+                kernel::learn_when_to_sleep();
+                kernel::open_control_channel();
+            }
+
            let wake_token = ptr::addr_of_mut!(glib::WAKEUP_TOKEN) as *const u8;
            // Install this before the loop waits the first time, thus a copy placed in a process later
            // can receive a handle to the same event.
@@ -342,6 +355,10 @@ mod entrypoint_blob {
                    linux::hostlink_pipe_goldfish::Hostlink::init(&path, Some(on_frame_from_host), wake_token)
                        .unwrap(),
                ),
+                #[cfg(feature = "linux-injected")]
+                TransportConfig::CharDevice => Transport::CharDevice(
+                    hostlink_chardev::Hostlink::init(Some(on_frame_from_host)).unwrap(),
+                ),
                #[cfg(feature = "xnu-core")]
                TransportConfig::Vsock { host_port } => Transport::Vsock(
                    hostlink_vsock::Hostlink::init(host_port, Some(on_frame_from_host), wake_token)
@@ -361,6 +378,9 @@ mod entrypoint_blob {

            destroy_all_scripts(context);

+            #[cfg(all(feature = "linux-injected", any(target_arch = "x86_64", target_arch = "aarch64")))]
+            kernel::close_control_channel();
+
            #[cfg(any(feature = "win9x", feature = "winnt", feature = "linux-injected",
                feature = "xnu-core"))]
            {
@@ -384,6 +404,8 @@ mod entrypoint_blob {

            (&raw mut frida_agent_left).write_volatile(1);

+            #[cfg(feature = "linux-injected")]
+            kernel::hand_back_to_the_loader();
        }
    }

@@ -475,6 +497,12 @@ mod entrypoint_blob {
                    #[cfg(not(feature = "linux-injected"))]
                    { panic!("pipe-goldfish is linux-injected's") }
                }
+                6 => {
+                    #[cfg(feature = "linux-injected")]
+                    { TransportConfig::CharDevice }
+                    #[cfg(not(feature = "linux-injected"))]
+                    { panic!("the character device is linux-injected's") }
+                }
                _ => panic!("Unsupported transport kind: {}", transport_kind),
            };
            g_variant_unref(transport_cfg_inner);
@@ -628,7 +656,7 @@ mod entrypoint_xnu_kext {
            kernel::wake(ptr::addr_of!(glib::WAKEUP_TOKEN) as *const u8);
            kernel::wait(
                ptr::addr_of!(glib::WAKEUP_TOKEN) as *const u8,
-                Some(10_000),
+                None,
                &mut || WORKER_EXITED.load(Ordering::Acquire),
            );
        }
@@ -678,94 +706,6 @@ mod entrypoint_xnu_kext {
    }
 }

-#[cfg(feature = "linux")]
-mod entrypoint_linux {
-    use super::*;
-    use core::ffi::c_int;
-    use core::sync::atomic::AtomicBool;
-
-    static STOP_REQUESTED: AtomicBool = AtomicBool::new(false);
-    static WORKER_EXITED: AtomicBool = AtomicBool::new(false);
-
-    /// Called from the module's init path. Everything interesting happens on our
-    /// own kernel thread: `insmod` runs with the module mutex held, and bringing
-    /// up Gum plus connecting to the host both block.
-    #[unsafe(no_mangle)]
-    pub extern "C" fn frida_agent_start(own_base: u64, own_size: u64) -> c_int {
-        kernel::log("frida: agent starting\n\0");
-
-        unsafe {
-            OWN_RANGE = GumMemoryRange {
-                base_address: own_base,
-                size: own_size as gsize,
-            };
-        }
-
-        if kernel::spawn_thread(worker, ptr::null_mut()) != 0 {
-            kernel::log("frida: failed to spawn worker\n\0");
-            return -1;
-        }
-
-        0
-    }
-
-    /// Called from the module's exit path, which must not return until the worker
-    /// is off our text — the module's pages go away right after.
-    #[unsafe(no_mangle)]
-    pub extern "C" fn frida_agent_stop() {
-        kernel::log("frida: agent stopping\n\0");
-
-        STOP_REQUESTED.store(true, Ordering::Release);
-
-        while !WORKER_EXITED.load(Ordering::Acquire) {
-            kernel::wake(ptr::addr_of!(glib::WAKEUP_TOKEN) as *const u8);
-            kernel::wait(
-                ptr::addr_of!(glib::WAKEUP_TOKEN) as *const u8,
-                Some(10_000),
-                &mut || WORKER_EXITED.load(Ordering::Acquire),
-            );
-        }
-
-        kernel::log("frida: agent stopped\n\0");
-    }
-
-    pub fn stop_requested() -> bool {
-        STOP_REQUESTED.load(Ordering::Acquire)
-    }
-
-    unsafe extern "C" fn worker(_parameter: *mut c_void, _wait_result: i32) {
-        unsafe {
-            kernel::log("frida: worker entry\n\0");
-
-            crate::run_constructors();
-            init_gum();
-
-            kernel::install_hooks();
-
-            match hostlink_chardev::Hostlink::init(Some(on_frame_from_host)) {
-                Ok(hostlink) => transport_set(Transport::CharDevice(hostlink)),
-                Err(_) => {
-                    kernel::log("frida: failed to connect to peer\n\0");
-                    WORKER_EXITED.store(true, Ordering::Release);
-                    return;
-                }
-            }
-
-            let main_context = adopt_js_context();
-
-            run_main_loop(main_context);
-
-            destroy_all_scripts(main_context);
-            transport_teardown();
-
-            WORKER_EXITED.store(true, Ordering::Release);
-            kernel::wake(ptr::addr_of!(glib::WAKEUP_TOKEN) as *const u8);
-        }
-    }
-}
-
-#[cfg(feature = "linux")]
-pub use entrypoint_linux::{frida_agent_start, frida_agent_stop};
 #[cfg(feature = "xnu-kext")]
 pub use entrypoint_xnu_kext::{frida_agent_start, frida_agent_stop, frida_agent_wake};
 #[cfg(feature = "blob")]
@@ -782,7 +722,7 @@ pub enum Transport {
    PipeVsock(linux::hostlink_pipe_vsock::Hostlink),
    #[cfg(feature = "linux-injected")]
    PipeGoldfish(linux::hostlink_pipe_goldfish::Hostlink),
-    #[cfg(any(feature = "linux", feature = "xnu-kext"))]
+    #[cfg(any(feature = "linux-injected", feature = "xnu-kext"))]
    CharDevice(hostlink_chardev::Hostlink),
 }

@@ -799,7 +739,7 @@ impl Transport {
            Transport::PipeVsock(h) => h.send(payload),
            #[cfg(feature = "linux-injected")]
            Transport::PipeGoldfish(h) => h.send(payload),
-            #[cfg(any(feature = "linux", feature = "xnu-kext"))]
+            #[cfg(any(feature = "linux-injected", feature = "xnu-kext"))]
            Transport::CharDevice(h) => h.send(payload),
        }
    }
@@ -816,7 +756,7 @@ impl Transport {
            Transport::PipeVsock(h) => h.shutdown(),
            #[cfg(feature = "linux-injected")]
            Transport::PipeGoldfish(h) => h.shutdown(),
-            #[cfg(any(feature = "linux", feature = "xnu-kext"))]
+            #[cfg(any(feature = "linux-injected", feature = "xnu-kext"))]
            Transport::CharDevice(_) => {}
        }
    }
@@ -833,7 +773,7 @@ impl Transport {
            Transport::PipeVsock(h) => h.process(),
            #[cfg(feature = "linux-injected")]
            Transport::PipeGoldfish(h) => h.process(),
-            #[cfg(any(feature = "linux", feature = "xnu-kext"))]
+            #[cfg(any(feature = "linux-injected", feature = "xnu-kext"))]
            Transport::CharDevice(h) => h.process(),
        }
    }
@@ -872,6 +812,8 @@ pub enum TransportConfig {
    PipeVsock { path: alloc::string::String },
    #[cfg(feature = "linux-injected")]
    PipeGoldfish { path: alloc::string::String },
+    #[cfg(feature = "linux-injected")]
+    CharDevice,
 }

 static mut TRANSPORT_DRIVER: *mut Transport = core::ptr::null_mut();
@@ -1262,11 +1204,6 @@ fn run_main_loop(main_context: *mut GMainContext) {
            #[cfg(not(any(feature = "blob", feature = "xnu-core")))]
            transport_get_unchecked().process();

-            #[cfg(feature = "linux")]
-            if entrypoint_linux::stop_requested() {
-                return;
-            }
-
            if stop_requested() {
                return;
            }
@@ -1298,7 +1235,7 @@ fn kernel_half_has_work() -> bool {
        return true;
    }

-    #[cfg(feature = "xnu-kext")]
+    #[cfg(any(feature = "linux-injected", feature = "xnu-kext"))]
    if hostlink_chardev::a_turn_is_wanted() {
        return true;
    }
@@ -1337,6 +1274,11 @@ fn kernel_half_has_work() -> bool {
        return true;
    }

+    #[cfg(all(feature = "linux-injected", any(target_arch = "x86_64", target_arch = "aarch64")))]
+    if kernel::an_operation_waits() {
+        return true;
+    }
+
    kernel::injected_arenas()
        .iter()
        .any(|arena| kernel::holds_a_frame_from_target(*arena))
@@ -1370,6 +1312,9 @@ fn serve_the_kernel_half() {
    #[cfg(feature = "linux-injected")]
    kernel::report_what_the_copies_hit();

+    #[cfg(all(feature = "linux-injected", any(target_arch = "x86_64", target_arch = "aarch64")))]
+    kernel::carry_out_operations();
+
    relay_frames_from_targets();
 }

@@ -1528,7 +1473,7 @@ unsafe extern "C" fn on_script_unloaded(

 static UNLOADS_IN_FLIGHT: AtomicU32 = AtomicU32::new(0);

-#[cfg(any(feature = "linux", feature = "xnu-kext"))]
+#[cfg(feature = "xnu-kext")]
 fn transport_teardown() {
    unsafe {
        let driver = TRANSPORT_DRIVER;
@@ -2247,7 +2192,6 @@ fn text_or_empty(text: *const u8) -> *const core::ffi::c_char {
 }

 fn send_command_reply(request_id: u16, response: HandlerResponse) {
-
    unsafe {
        let message = g_variant_new(
            c"(yquv)".as_ptr(),
@@ -2433,9 +2377,14 @@ fn handle_stop() -> HandlerResponse {
        kernel::show_our_threads_again();
    }

-    #[cfg(feature = "blob")]
+    #[cfg(all(feature = "blob", not(feature = "linux-injected")))]
    STOP_REQUESTED.store(true, Ordering::Release);

+    #[cfg(feature = "linux-injected")]
+    if !kernel::loaded_from_the_inside() {
+        STOP_REQUESTED.store(true, Ordering::Release);
+    }
+
    HandlerResponse::success(unsafe { g_variant_new_uint32(0) })
 }

@@ -50,7 +50,7 @@ pub extern "C" fn sysconf(_name: i32) -> isize {
 #[unsafe(no_mangle)]
 pub extern "C" fn __clear_cache(_start: *const u8, _end: *const u8) {}

-#[cfg(all(target_arch = "arm", not(any(feature = "linux", feature = "linux-injected"))))]
+#[cfg(all(target_arch = "arm", not(feature = "linux-injected")))]
 #[unsafe(no_mangle)]
 pub extern "C" fn __clear_cache(start: *const u8, end: *const u8) {
    unsafe {
@@ -68,7 +68,7 @@ pub extern "C" fn __clear_cache(start: *const u8, end: *const u8) {
    }
 }

-#[cfg(all(target_arch = "arm", any(feature = "linux", feature = "linux-injected")))]
+#[cfg(all(target_arch = "arm", feature = "linux-injected"))]
 #[unsafe(no_mangle)]
 pub extern "C" fn __clear_cache(start: *const u8, end: *const u8) {
    unsafe {
@@ -0,0 +1,402 @@
+use alloc::collections::BTreeMap;
+use alloc::vec::Vec;
+use core::ffi::{c_int, c_void};
+use core::sync::atomic::{AtomicBool, Ordering};
+
+use super::layout::field_offset;
+use super::native;
+
+pub fn add_thread(tgid: i32, tid: i32) {
+    let fresh = Cloak::of(tgid);
+    registry().with(|cloaks| {
+        let threads = &mut cloaks.entry(tgid).or_insert(fresh).threads;
+        if !threads.contains(&tid) {
+            threads.push(tid);
+        }
+    });
+}
+
+pub fn remove_thread(tgid: i32, tid: i32) {
+    registry().with(|cloaks| {
+        if let Some(cloak) = cloaks.get_mut(&tgid) {
+            cloak.threads.retain(|t| *t != tid);
+        }
+    });
+}
+
+pub fn add_range(tgid: i32, base: usize, size: usize) {
+    let fresh = Cloak::of(tgid);
+    registry().with(|cloaks| {
+        cloaks.entry(tgid).or_insert(fresh).ranges.push((base, base + size));
+    });
+}
+
+pub fn remove_range(tgid: i32, base: usize, size: usize) {
+    registry().with(|cloaks| {
+        if let Some(cloak) = cloaks.get_mut(&tgid) {
+            if let Some(index) = cloak.ranges.iter().position(|r| *r == (base, base + size)) {
+                cloak.ranges.swap_remove(index);
+            }
+        }
+    });
+}
+
+pub fn add_fd(tgid: i32, fd: i32) {
+    let fresh = Cloak::of(tgid);
+    registry().with(|cloaks| {
+        let fds = &mut cloaks.entry(tgid).or_insert(fresh).fds;
+        if !fds.contains(&fd) {
+            fds.push(fd);
+        }
+    });
+}
+
+pub fn remove_fd(tgid: i32, fd: i32) {
+    registry().with(|cloaks| {
+        if let Some(cloak) = cloaks.get_mut(&tgid) {
+            cloak.fds.retain(|f| *f != fd);
+        }
+    });
+}
+
+pub fn install_hooks() {
+    let Some(layout) = describe_readers() else {
+        return;
+    };
+    unsafe { LAYOUT = Some(layout) };
+
+    let interceptor = unsafe { crate::bindings::gum_interceptor_obtain() };
+    unsafe {
+        crate::bindings::gum_interceptor_begin_transaction(interceptor);
+        replace(interceptor, _show_map, frida_cb_show_map as *mut c_void, &raw mut SHOW_MAP);
+        replace(interceptor, _show_smap, frida_cb_show_smap as *mut c_void, &raw mut SHOW_SMAP);
+        replace(interceptor, _proc_fill_cache, frida_cb_proc_fill_cache as *mut c_void,
+            &raw mut PROC_FILL_CACHE);
+        replace(interceptor, _proc_pid_status, frida_cb_proc_pid_status as *mut c_void,
+            &raw mut PROC_PID_STATUS);
+        replace(interceptor, _do_task_stat, frida_cb_do_task_stat as *mut c_void, &raw mut DO_TASK_STAT);
+        replace(interceptor, _release_task, frida_cb_release_task as *mut c_void, &raw mut RELEASE_TASK);
+        crate::bindings::gum_interceptor_end_transaction(interceptor);
+    }
+}
+
+pub fn remove_hooks() {
+    if unsafe { (*(&raw const LAYOUT)).is_none() } {
+        return;
+    }
+
+    let interceptor = unsafe { crate::bindings::gum_interceptor_obtain() };
+    unsafe {
+        crate::bindings::gum_interceptor_begin_transaction(interceptor);
+        for target in [_show_map, _show_smap, _proc_fill_cache, _proc_pid_status, _do_task_stat, _release_task] {
+            if target != 0 {
+                crate::bindings::gum_interceptor_revert(interceptor, target as *mut c_void);
+            }
+        }
+        crate::bindings::gum_interceptor_end_transaction(interceptor);
+    }
+
+    registry().with(|cloaks| cloaks.clear());
+}
+
+unsafe fn replace(interceptor: *mut crate::bindings::GumInterceptor, target: usize, replacement: *mut c_void,
+        original: *mut usize) {
+    if target == 0 {
+        return;
+    }
+
+    unsafe {
+        crate::bindings::gum_interceptor_replace(interceptor, target as *mut c_void, replacement,
+            original as *mut *mut c_void, core::ptr::null_mut());
+    }
+}
+
+unsafe extern "C" fn frida_cb_show_map(m: *mut c_void, vma: *mut c_void) -> c_int {
+    if hides_the_area(vma) {
+        return 0;
+    }
+
+    unsafe { call::<ShowFn>(SHOW_MAP)(m, vma) }
+}
+
+unsafe extern "C" fn frida_cb_show_smap(m: *mut c_void, vma: *mut c_void) -> c_int {
+    if hides_the_area(vma) {
+        return 0;
+    }
+
+    unsafe { call::<ShowFn>(SHOW_SMAP)(m, vma) }
+}
+
+unsafe extern "C" fn frida_cb_proc_fill_cache(file: *mut c_void, ctx: *mut c_void, name: *const u8, len: u32,
+        instantiate: usize, task: *mut c_void, ptr: *const c_void) -> bool {
+    if hides_the_entry(instantiate, task as usize, ptr as usize) {
+        return true;
+    }
+
+    unsafe { call::<FillCacheFn>(PROC_FILL_CACHE)(file, ctx, name, len, instantiate, task, ptr) }
+}
+
+unsafe extern "C" fn frida_cb_proc_pid_status(m: *mut c_void, ns: *mut c_void, pid: *mut c_void,
+        task: *mut c_void) -> c_int {
+    let layout = layout();
+    let start = read_word(m as usize + layout.seq_count);
+
+    let result = unsafe { call::<StatusFn>(PROC_PID_STATUS)(m, ns, pid, task) };
+
+    if let Some(hidden) = threads_hidden_from_the_reader(task as usize) {
+        let said = said_since(m as usize, start);
+        if let Some(at) = find(said, b"Threads:\t") {
+            take_from_the_number_at(m as usize, start + at + b"Threads:\t".len(), hidden);
+        }
+    }
+
+    result
+}
+
+unsafe extern "C" fn frida_cb_do_task_stat(m: *mut c_void, ns: *mut c_void, pid: *mut c_void,
+        task: *mut c_void, whole: c_int) -> c_int {
+    let layout = layout();
+    let start = read_word(m as usize + layout.seq_count);
+
+    let result = unsafe { call::<StatFn>(DO_TASK_STAT)(m, ns, pid, task, whole) };
+
+    if let Some(hidden) = threads_hidden_from_the_reader(task as usize) {
+        if let Some(at) = where_the_thread_count_is(said_since(m as usize, start)) {
+            take_from_the_number_at(m as usize, start + at, hidden);
+        }
+    }
+
+    result
+}
+
+unsafe extern "C" fn frida_cb_release_task(task: *mut c_void) {
+    let layout = layout();
+    let task = task as usize;
+    let tgid = read_i32(task + layout.task_tgid);
+
+    remove_thread(tgid, read_i32(task + layout.task_pid));
+    if read_word(task + layout.task_group_leader) == task {
+        registry().with(|cloaks| {
+            cloaks.remove(&tgid);
+        });
+    }
+
+    unsafe { call::<ReleaseFn>(RELEASE_TASK)(task as *mut c_void) };
+}
+
+fn hides_the_area(vma: *mut c_void) -> bool {
+    let layout = layout();
+    let vma = vma as usize;
+    let mm = read_word(vma + layout.vma_mm);
+    let start = read_word(vma + layout.vma_start);
+    let end = read_word(vma + layout.vma_end);
+
+    !the_reader_is_cloaked() && registry().with(|cloaks| {
+        cloaks.values().any(|cloak| {
+            cloak.mm == mm && cloak.ranges.iter().any(|(s, e)| start < *e && *s < end)
+        })
+    })
+}
+
+fn hides_the_entry(instantiate: usize, task: usize, ptr: usize) -> bool {
+    if the_reader_is_cloaked() {
+        return false;
+    }
+
+    let layout = layout();
+    if instantiate == unsafe { _proc_task_instantiate } {
+        let tid = read_i32(task + layout.task_pid);
+        return registry().with(|cloaks| cloaks.values().any(|cloak| cloak.threads.contains(&tid)));
+    }
+
+    if instantiate == unsafe { _proc_fd_instantiate } || instantiate == unsafe { _proc_fdinfo_instantiate } {
+        let tgid = read_i32(task + layout.task_tgid);
+        let fd = read_i32(ptr + layout.fd_data_fd);
+        return registry().with(|cloaks| cloaks.get(&tgid).is_some_and(|cloak| cloak.fds.contains(&fd)));
+    }
+
+    false
+}
+
+fn threads_hidden_from_the_reader(task: usize) -> Option<i32> {
+    if the_reader_is_cloaked() {
+        return None;
+    }
+
+    let tgid = read_i32(task + layout().task_tgid);
+    let hidden = registry().with(|cloaks| cloaks.get(&tgid).map_or(0, |cloak| cloak.threads.len()));
+
+    (hidden != 0).then_some(hidden as i32)
+}
+
+// A cloaked thread is one of ours, so let it see through the cloak; RASP threads in the same
+// process are not cloaked and keep getting the censored view.
+fn the_reader_is_cloaked() -> bool {
+    let tid = read_i32(native::current_task() as usize + layout().task_pid);
+
+    registry().with(|cloaks| cloaks.values().any(|cloak| cloak.threads.contains(&tid)))
+}
+
+fn said_since(m: usize, start: usize) -> &'static [u8] {
+    let layout = layout();
+    let count = read_word(m + layout.seq_count);
+    if start >= count || count >= read_word(m + layout.seq_size) {
+        return &[];
+    }
+
+    unsafe { core::slice::from_raw_parts((read_word(m + layout.seq_buf) + start) as *const u8, count - start) }
+}
+
+fn find(haystack: &[u8], needle: &[u8]) -> Option<usize> {
+    haystack.windows(needle.len()).position(|window| window == needle)
+}
+
+fn where_the_thread_count_is(said: &[u8]) -> Option<usize> {
+    let name_end = said.iter().rposition(|b| *b == b')')?;
+
+    said[name_end..]
+        .iter()
+        .enumerate()
+        .filter(|(_, b)| **b == b' ')
+        .nth(17)
+        .map(|(at, _)| name_end + at + 1)
+}
+
+fn take_from_the_number_at(m: usize, at: usize, hidden: i32) {
+    let layout = layout();
+    let buf = read_word(m + layout.seq_buf);
+    let count = read_word(m + layout.seq_count);
+    let said = unsafe { core::slice::from_raw_parts_mut(buf as *mut u8, count) };
+
+    let digits = said[at..].iter().take_while(|b| b.is_ascii_digit()).count();
+    let value = said[at..at + digits].iter().fold(0i32, |n, b| n * 10 + i32::from(b - b'0'));
+    let shown = if value > hidden { value - hidden } else { 1 };
+    let rendered = alloc::format!("{shown}");
+
+    said.copy_within(at + digits..count, at + rendered.len());
+    said[at..at + rendered.len()].copy_from_slice(rendered.as_bytes());
+    write_word(m + layout.seq_count, count - digits + rendered.len());
+}
+
+struct Cloak {
+    mm: usize,
+    threads: Vec<i32>,
+    ranges: Vec<(usize, usize)>,
+    fds: Vec<i32>,
+}
+
+impl Cloak {
+    fn of(tgid: i32) -> Self {
+        let mm = super::processes::HeldTask::with_id(tgid as u32)
+            .map_or(0, |task| read_word(task.address() + layout().task_mm));
+
+        Self { mm, threads: Vec::new(), ranges: Vec::new(), fds: Vec::new() }
+    }
+}
+
+struct Registry {
+    busy: AtomicBool,
+    cloaks: core::cell::UnsafeCell<BTreeMap<i32, Cloak>>,
+}
+
+unsafe impl Sync for Registry {}
+
+impl Registry {
+    fn with<R>(&self, action: impl FnOnce(&mut BTreeMap<i32, Cloak>) -> R) -> R {
+        native::disable_preemption();
+        while self.busy.swap(true, Ordering::Acquire) {
+            core::hint::spin_loop();
+        }
+        let result = action(unsafe { &mut *self.cloaks.get() });
+        self.busy.store(false, Ordering::Release);
+        native::enable_preemption();
+        result
+    }
+}
+
+fn registry() -> &'static Registry {
+    &REGISTRY
+}
+
+static REGISTRY: Registry = Registry {
+    busy: AtomicBool::new(false),
+    cloaks: core::cell::UnsafeCell::new(BTreeMap::new()),
+};
+
+struct ReaderLayout {
+    task_pid: usize,
+    task_tgid: usize,
+    task_mm: usize,
+    task_group_leader: usize,
+    vma_mm: usize,
+    vma_start: usize,
+    vma_end: usize,
+    seq_buf: usize,
+    seq_size: usize,
+    seq_count: usize,
+    fd_data_fd: usize,
+}
+
+fn describe_readers() -> Option<ReaderLayout> {
+    Some(ReaderLayout {
+        task_pid: field_offset("task_struct", "pid")?,
+        task_tgid: field_offset("task_struct", "tgid")?,
+        task_mm: field_offset("task_struct", "mm")?,
+        task_group_leader: field_offset("task_struct", "group_leader")?,
+        vma_mm: field_offset("vm_area_struct", "vm_mm")?,
+        vma_start: field_offset("vm_area_struct", "vm_start")?,
+        vma_end: field_offset("vm_area_struct", "vm_end")?,
+        seq_buf: field_offset("seq_file", "buf")?,
+        seq_size: field_offset("seq_file", "size")?,
+        seq_count: field_offset("seq_file", "count")?,
+        fd_data_fd: field_offset("fd_data", "fd")?,
+    })
+}
+
+fn layout() -> &'static ReaderLayout {
+    unsafe { (*(&raw const LAYOUT)).as_ref().unwrap() }
+}
+
+static mut LAYOUT: Option<ReaderLayout> = None;
+
+unsafe fn call<F: Copy>(original: usize) -> F {
+    unsafe { core::mem::transmute_copy(&original) }
+}
+
+fn read_word(address: usize) -> usize {
+    unsafe { (address as *const usize).read() }
+}
+
+fn write_word(address: usize, value: usize) {
+    unsafe { (address as *mut usize).write(value) };
+}
+
+fn read_i32(address: usize) -> i32 {
+    unsafe { (address as *const i32).read() }
+}
+
+type ShowFn = unsafe extern "C" fn(*mut c_void, *mut c_void) -> c_int;
+type FillCacheFn =
+    unsafe extern "C" fn(*mut c_void, *mut c_void, *const u8, u32, usize, *mut c_void, *const c_void) -> bool;
+type StatusFn = unsafe extern "C" fn(*mut c_void, *mut c_void, *mut c_void, *mut c_void) -> c_int;
+type StatFn = unsafe extern "C" fn(*mut c_void, *mut c_void, *mut c_void, *mut c_void, c_int) -> c_int;
+type ReleaseFn = unsafe extern "C" fn(*mut c_void);
+
+static mut SHOW_MAP: usize = 0;
+static mut SHOW_SMAP: usize = 0;
+static mut PROC_FILL_CACHE: usize = 0;
+static mut PROC_PID_STATUS: usize = 0;
+static mut DO_TASK_STAT: usize = 0;
+static mut RELEASE_TASK: usize = 0;
+
+unsafe extern "C" {
+    static _show_map: usize;
+    static _show_smap: usize;
+    static _proc_fill_cache: usize;
+    static _proc_pid_status: usize;
+    static _do_task_stat: usize;
+    static _release_task: usize;
+    static _proc_task_instantiate: usize;
+    static _proc_fd_instantiate: usize;
+    static _proc_fdinfo_instantiate: usize;
+}
@@ -0,0 +1,362 @@
+use alloc::vec;
+use core::ffi::{c_int, c_long, c_void};
+use core::mem::size_of;
+use core::ptr;
+use core::sync::atomic::{AtomicBool, AtomicPtr, Ordering};
+
+use super::layout::field_offset;
+use super::{cloak, native, process_memory, user_threads};
+
+pub fn open() {
+    cloak::install_hooks();
+
+    let Some(arguments) = describe_arguments() else {
+        return;
+    };
+    let target = unsafe { SYS_PRCTL_TARGET };
+    if target == 0 {
+        return;
+    }
+    unsafe { ARGUMENTS = Some(arguments) };
+
+    let interceptor = unsafe { crate::bindings::gum_interceptor_obtain() };
+    unsafe {
+        crate::bindings::gum_interceptor_begin_transaction(interceptor);
+        crate::bindings::gum_interceptor_replace(interceptor, target as *mut c_void,
+            frida_cb_sys_prctl as *mut c_void, (&raw mut SYS_PRCTL) as *mut *mut c_void, ptr::null_mut());
+        crate::bindings::gum_interceptor_end_transaction(interceptor);
+    }
+}
+
+pub fn close() {
+    if unsafe { (*(&raw const ARGUMENTS)).is_some() } {
+        let interceptor = unsafe { crate::bindings::gum_interceptor_obtain() };
+        unsafe {
+            crate::bindings::gum_interceptor_begin_transaction(interceptor);
+            crate::bindings::gum_interceptor_revert(interceptor, SYS_PRCTL_TARGET as *mut c_void);
+            crate::bindings::gum_interceptor_end_transaction(interceptor);
+        }
+    }
+
+    cloak::remove_hooks();
+}
+
+pub fn an_operation_waits() -> bool {
+    !PENDING.load(Ordering::Acquire).is_null()
+}
+
+pub fn carry_out_operations() {
+    let operation = PENDING.swap(ptr::null_mut(), Ordering::AcqRel);
+    if operation.is_null() {
+        return;
+    }
+
+    unsafe {
+        (*operation).result = match (*operation).request {
+            Request::Allocate { id, size, protection } => process_memory::allocate(id, size, protection) as c_long,
+            Request::Release { id, address, size } => process_memory::release(id, address, size) as c_long,
+            Request::StartThread { id, entry, stack, argument, tls } => {
+                user_threads::start_in_process(id, entry, stack, argument, tls) as c_long
+            }
+        };
+        (*operation).done.store(true, Ordering::Release);
+    }
+
+    native::wake(wake_token());
+}
+
+unsafe extern "C" fn frida_cb_sys_prctl(regs: *const c_void) -> c_long {
+    let argument = |index: usize| read_word(regs as usize + unsafe { arguments().at[index] });
+
+    if argument(0) as c_int != CONTROL_MAGIC || argument(4) as u64 != CONTROL_TOKEN {
+        let original: unsafe extern "C" fn(*const c_void) -> c_long = unsafe { core::mem::transmute(SYS_PRCTL) };
+        return unsafe { original(regs) };
+    }
+
+    let op = argument(1) as u32;
+    let (first, second) = (argument(2), argument(3));
+
+    if op == OP_PING {
+        return CONTROL_MAGIC as c_long;
+    }
+
+    if op >= OP_ALLOC && !unsafe { _capable(CAP_SYS_ADMIN) } {
+        return -(EPERM as c_long);
+    }
+
+    let tgid = read_i32(native::current_task() as usize + unsafe { arguments().task_tgid });
+    match op {
+        OP_ADD_THREAD => cloak::add_thread(tgid, first as i32),
+        OP_REMOVE_THREAD => cloak::remove_thread(tgid, first as i32),
+        OP_ADD_RANGE => cloak::add_range(tgid, first, second),
+        OP_REMOVE_RANGE => cloak::remove_range(tgid, first, second),
+        OP_ADD_FD => cloak::add_fd(tgid, first as i32),
+        OP_REMOVE_FD => cloak::remove_fd(tgid, first as i32),
+        OP_ALLOC => return allocate(first),
+        OP_FREE => return release(first),
+        OP_WRITE => return write(first),
+        OP_READ => return read(first),
+        OP_SPAWN => return start_thread(first),
+        OP_CLOAK_THREAD => return cloak_thread(first),
+        OP_CLOAK_RANGE => return cloak_range(first),
+        _ => return -(EINVAL as c_long),
+    }
+
+    0
+}
+
+fn allocate(arguments: usize) -> c_long {
+    let Some(args) = arguments_at::<AllocArgs>(arguments) else {
+        return -(EFAULT as c_long);
+    };
+
+    hand_to_the_worker(Request::Allocate { id: args.pid, size: args.size as usize, protection: args.prot as usize })
+}
+
+fn release(arguments: usize) -> c_long {
+    let Some(args) = arguments_at::<FreeArgs>(arguments) else {
+        return -(EFAULT as c_long);
+    };
+
+    hand_to_the_worker(Request::Release { id: args.pid, address: args.address as usize, size: args.size as usize })
+}
+
+fn write(arguments: usize) -> c_long {
+    let Some(args) = arguments_at::<RwArgs>(arguments) else {
+        return -(EFAULT as c_long);
+    };
+
+    let mut bounce = vec![0u8; args.size as usize];
+    if !process_memory::read_own(args.buffer as usize, &mut bounce) {
+        return -(EFAULT as c_long);
+    }
+
+    process_memory::write(args.pid, args.address as usize, &bounce) as c_long
+}
+
+fn read(arguments: usize) -> c_long {
+    let Some(args) = arguments_at::<RwArgs>(arguments) else {
+        return -(EFAULT as c_long);
+    };
+
+    let mut bounce = vec![0u8; args.size as usize];
+    let transferred = process_memory::read(args.pid, args.address as usize, &mut bounce);
+
+    if !process_memory::write_own(args.buffer as usize, &bounce) {
+        return -(EFAULT as c_long);
+    }
+
+    transferred as c_long
+}
+
+fn start_thread(arguments: usize) -> c_long {
+    let Some(args) = arguments_at::<SpawnArgs>(arguments) else {
+        return -(EFAULT as c_long);
+    };
+
+    hand_to_the_worker(Request::StartThread {
+        id: args.pid,
+        entry: args.entry as usize,
+        stack: args.stack as usize,
+        argument: args.arg as usize,
+        tls: args.tls as usize,
+    })
+}
+
+fn cloak_thread(arguments: usize) -> c_long {
+    let Some(args) = arguments_at::<CloakThreadArgs>(arguments) else {
+        return -(EFAULT as c_long);
+    };
+
+    cloak::add_thread(args.tgid as i32, args.tid as i32);
+
+    0
+}
+
+fn cloak_range(arguments: usize) -> c_long {
+    let Some(args) = arguments_at::<CloakRangeArgs>(arguments) else {
+        return -(EFAULT as c_long);
+    };
+
+    cloak::add_range(args.tgid as i32, args.base as usize, args.size as usize);
+
+    0
+}
+
+fn arguments_at<T: Default>(address: usize) -> Option<T> {
+    let mut value = T::default();
+    let raw = unsafe { core::slice::from_raw_parts_mut(&mut value as *mut T as *mut u8, size_of::<T>()) };
+
+    process_memory::read_own(address, raw).then_some(value)
+}
+
+fn hand_to_the_worker(request: Request) -> c_long {
+    let token = wake_token();
+
+    while BUSY.swap(true, Ordering::Acquire) {
+        native::wait(token, None, &mut || !BUSY.load(Ordering::Acquire));
+    }
+
+    let mut operation = Operation { request, result: 0, done: AtomicBool::new(false) };
+    PENDING.store(&mut operation, Ordering::Release);
+    crate::nudge_the_loop(token);
+
+    while !operation.done.load(Ordering::Acquire) {
+        native::wait(token, None, &mut || operation.done.load(Ordering::Acquire));
+    }
+
+    BUSY.store(false, Ordering::Release);
+    native::wake(token);
+
+    operation.result
+}
+
+fn wake_token() -> *const u8 {
+    (&raw const crate::glib::WAKEUP_TOKEN) as *const u8
+}
+
+struct Operation {
+    request: Request,
+    result: c_long,
+    done: AtomicBool,
+}
+
+enum Request {
+    Allocate { id: u32, size: usize, protection: usize },
+    Release { id: u32, address: usize, size: usize },
+    StartThread { id: u32, entry: usize, stack: usize, argument: usize, tls: usize },
+}
+
+static PENDING: AtomicPtr<Operation> = AtomicPtr::new(ptr::null_mut());
+static BUSY: AtomicBool = AtomicBool::new(false);
+
+#[repr(C)]
+#[derive(Default)]
+struct AllocArgs {
+    size: u64,
+    pid: u32,
+    prot: u32,
+}
+
+#[repr(C)]
+#[derive(Default)]
+struct FreeArgs {
+    address: u64,
+    size: u64,
+    pid: u32,
+}
+
+#[repr(C)]
+#[derive(Default)]
+struct RwArgs {
+    address: u64,
+    buffer: u64,
+    size: u64,
+    pid: u32,
+}
+
+#[repr(C)]
+#[derive(Default)]
+struct SpawnArgs {
+    entry: u64,
+    stack: u64,
+    arg: u64,
+    tls: u64,
+    pid: u32,
+}
+
+#[repr(C)]
+#[derive(Default)]
+struct CloakThreadArgs {
+    tgid: u32,
+    tid: u32,
+}
+
+#[repr(C)]
+#[derive(Default)]
+struct CloakRangeArgs {
+    base: u64,
+    size: u64,
+    tgid: u32,
+}
+
+struct ArgumentLayout {
+    at: [usize; 5],
+    task_tgid: usize,
+}
+
+#[cfg(target_arch = "aarch64")]
+fn describe_arguments() -> Option<ArgumentLayout> {
+    let regs = field_offset("pt_regs", "regs")?;
+
+    Some(ArgumentLayout {
+        at: core::array::from_fn(|index| regs + index * size_of::<usize>()),
+        task_tgid: field_offset("task_struct", "tgid")?,
+    })
+}
+
+#[cfg(target_arch = "x86_64")]
+fn describe_arguments() -> Option<ArgumentLayout> {
+    Some(ArgumentLayout {
+        at: [
+            field_offset("pt_regs", "di")?,
+            field_offset("pt_regs", "si")?,
+            field_offset("pt_regs", "dx")?,
+            field_offset("pt_regs", "r10")?,
+            field_offset("pt_regs", "r8")?,
+        ],
+        task_tgid: field_offset("task_struct", "tgid")?,
+    })
+}
+
+unsafe fn arguments() -> &'static ArgumentLayout {
+    unsafe { (*(&raw const ARGUMENTS)).as_ref().unwrap() }
+}
+
+static mut ARGUMENTS: Option<ArgumentLayout> = None;
+static mut SYS_PRCTL: usize = 0;
+
+fn read_word(address: usize) -> usize {
+    unsafe { (address as *const usize).read() }
+}
+
+fn read_i32(address: usize) -> i32 {
+    unsafe { (address as *const i32).read() }
+}
+
+const CONTROL_MAGIC: c_int = 0x4652_4944;
+const CONTROL_TOKEN: u64 = 0x1d5f_9e6b_2c7a_4038;
+
+const OP_ADD_THREAD: u32 = 1;
+const OP_REMOVE_THREAD: u32 = 2;
+const OP_ADD_RANGE: u32 = 3;
+const OP_REMOVE_RANGE: u32 = 4;
+const OP_ADD_FD: u32 = 5;
+const OP_REMOVE_FD: u32 = 6;
+const OP_PING: u32 = 32;
+const OP_ALLOC: u32 = 64;
+const OP_FREE: u32 = 65;
+const OP_WRITE: u32 = 66;
+const OP_READ: u32 = 67;
+const OP_SPAWN: u32 = 68;
+const OP_CLOAK_THREAD: u32 = 69;
+const OP_CLOAK_RANGE: u32 = 70;
+
+const CAP_SYS_ADMIN: c_int = 21;
+
+const EPERM: c_int = 1;
+const EFAULT: c_int = 14;
+const EINVAL: c_int = 22;
+
+#[cfg(target_arch = "aarch64")]
+use self::___arm64_sys_prctl as SYS_PRCTL_TARGET;
+#[cfg(target_arch = "x86_64")]
+use self::___x64_sys_prctl as SYS_PRCTL_TARGET;
+
+unsafe extern "C" {
+    #[cfg(target_arch = "aarch64")]
+    static ___arm64_sys_prctl: usize;
+    #[cfg(target_arch = "x86_64")]
+    static ___x64_sys_prctl: usize;
+    static _capable: unsafe extern "C" fn(c_int) -> bool;
+}
@@ -1,6 +1,7 @@
 use core::ffi::{c_int, c_void};
 use core::ptr;

+use alloc::boxed::Box;
 use alloc::collections::BTreeMap;

 #[cfg(not(target_arch = "x86"))]
@@ -63,17 +64,28 @@ fn take_what_the_copy_opened(placed: &mut Placement) {
    let copy = COPY_TASK.load(core::sync::atomic::Ordering::Acquire) as *mut c_void;
    placed.says = native::take_the_file_of(copy, says_fd);
    placed.hears = native::take_the_file_of(copy, hears_fd);
-    listen_to_the_copy(placed.says);
+    listen_to_the_copy(placed);
 }

-fn listen_to_the_copy(says: *mut c_void) {
-    native::spawn_thread(carry_what_the_copy_says, says);
+fn listen_to_the_copy(placed: &Placement) {
+    let listener = Box::into_raw(Box::new(Listener { says: placed.says, arena: placed.arena }));
+    native::spawn_thread(carry_what_the_copy_says, listener as *mut c_void);
 }

 unsafe extern "C" fn carry_what_the_copy_says(argument: *mut c_void, _reason: i32) {
-    while native::wait_for_a_word(argument) {
+    let listener = unsafe { Box::from_raw(argument as *mut Listener) };
+
+    while native::wait_for_a_word(listener.says) {
        crate::nudge_the_loop(crate::glib::wakeup_token());
    }
+
+    Arena::at(listener.arena).gone();
+    crate::nudge_the_loop(crate::glib::wakeup_token());
+}
+
+struct Listener {
+    says: *mut c_void,
+    arena: usize,
 }

 struct Placement {
@@ -362,23 +374,25 @@ pub unsafe extern "C" fn frida_cb_user(argument: *mut c_void) -> c_int {

    COPY_TASK.store(native::current_task() as usize, core::sync::atomic::Ordering::Release);

+    hand_userland_to(bootstrap, hand_over_argument(stack, arena), arena);
+
+    0
+}
+
+pub(crate) fn hand_userland_to(pc: usize, stack: usize, first_argument: usize) {
    let Some(places) = describe_registers() else {
-        return 0;
+        return;
    };
    let registers = registers_of_this_task(&places);

-    let stack = hand_over_argument(stack, arena);
-
    unsafe {
-        ((registers + places.pc) as *mut usize).write(bootstrap & !THUMB_BIT);
+        ((registers + places.pc) as *mut usize).write(pc & !THUMB_BIT);
        ((registers + places.stack) as *mut usize).write(stack);
        ((registers + places.flags) as *mut usize).write(
-            USER_EXECUTION | (bootstrap & THUMB_BIT) * THUMB_STATE);
-        ((registers + places.first) as *mut usize).write(arena);
+            USER_EXECUTION | (pc & THUMB_BIT) * THUMB_STATE);
+        ((registers + places.first) as *mut usize).write(first_argument);
        write_selectors(registers, &places);
    }
-
-    0
 }

 // What a task starts with in userland is at the top of the kernel stack it was given.
@@ -390,7 +404,7 @@ fn registers_of_this_task(places: &Places) -> usize {
 fn registers_of_task(task: usize, places: &Places) -> usize {
    let stack = unsafe { ((task + places.stack_of_task) as *const usize).read() };

-    stack + STACK_SPAN - TOP_OF_STACK_PADDING - places.size
+    stack + places.stack_span - TOP_OF_STACK_PADDING - places.size
 }

 #[cfg(target_arch = "x86_64")]
@@ -684,6 +698,7 @@ unsafe fn write_selectors(registers: usize, _places: &Places) {
    unsafe {
        ((registers + 136) as *mut usize).write(0x33);
        ((registers + 160) as *mut usize).write(0x2b);
+        ((registers + 120) as *mut isize).write(-1);
    }
 }

@@ -733,6 +748,7 @@ struct Places {
    pc: usize,
    flags: usize,
    stack_of_task: usize,
+    stack_span: usize,
 }

 #[cfg(target_arch = "aarch64")]
@@ -744,6 +760,7 @@ fn describe_registers() -> Option<Places> {
        pc: field_offset("user_pt_regs", "pc")?,
        flags: field_offset("user_pt_regs", "pstate")?,
        stack_of_task: field_offset("task_struct", "stack")?,
+        stack_span: struct_size("thread_union").unwrap_or(STACK_SPAN),
    })
 }

@@ -756,6 +773,7 @@ fn describe_registers() -> Option<Places> {
        pc: 15 * 4,
        flags: 16 * 4,
        stack_of_task: 0,
+        stack_span: STACK_SPAN,
    })
 }

@@ -768,6 +786,7 @@ fn describe_registers() -> Option<Places> {
        pc: 48,
        flags: 56,
        stack_of_task: 0,
+        stack_span: STACK_SPAN,
    })
 }

@@ -780,6 +799,7 @@ fn describe_registers() -> Option<Places> {
        pc: 128,
        flags: 144,
        stack_of_task: 0,
+        stack_span: STACK_SPAN,
    })
 }

@@ -932,7 +952,7 @@ pub unsafe extern "C" fn frida_cb_exec(_data: *mut c_void, task: *mut c_void, _w
        ((program as usize + at) as *const *const u8).read()
    });

-    native::wake(task as *const u8);
+    native::wake(crate::glib::wakeup_token());
 }

 #[cfg(not(target_arch = "x86"))]
@@ -969,7 +989,7 @@ unsafe extern "C" fn frida_replaced_set_task_comm(task: *mut c_void, buf: *const
        if let Some(id) = id_of(task as usize) {
            native::send_signal(STOP, task as usize);
            super::spawn::note_pending_spawn(id, name.to_bytes());
-            native::wake(ptr::null());
+            native::wake(crate::glib::wakeup_token());
        }
    }

@@ -1062,9 +1082,8 @@ fn ask_it_to_leave(placed: &Placement) {
    arena.tell_it_to_go();
    wake_the_copy(placed);

-    let waited_on = &placed.arena as *const usize as *const u8;
    while !arena.has_gone() {
-        native::wait(waited_on, Some(LEAVING_GRACE_US), &mut || arena.has_gone());
+        native::wait(crate::glib::wakeup_token(), None, &mut || arena.has_gone());
    }
 }

@@ -1091,7 +1110,6 @@ fn take_back_what_it_was_given(placed: &Placement, memory: *mut c_void) {
    }
 }

-const LEAVING_GRACE_US: u64 = 100_000;

 pub fn tell_the_copy(id: u32) {
    let Some(placed) = (unsafe { placements() }).get(&id) else {
@@ -1290,7 +1308,6 @@ const EXEC_PROBE: unsafe extern "C" fn(*mut c_void, *mut c_void, c_int, *mut c_v
 const EXEC_PROBE: unsafe extern "C" fn(*mut c_void, *mut c_void, c_int, *mut c_void) =
    frida_cb_exec;

-
 #[cfg(target_arch = "x86")]
 const THREAD_APPEARED_PROBE: unsafe extern "C" fn(*mut c_void, *mut c_void, *mut c_void) =
    frida_kcb_thread_appeared;
@@ -3,6 +3,8 @@ use core::ffi::{c_int, c_void};
 use core::ffi::c_long;
 #[cfg(any(target_arch = "x86", target_arch = "x86_64"))]
 use core::ptr;
+#[cfg(any(target_arch = "arm", target_arch = "aarch64"))]
+use core::sync::atomic::{AtomicBool, Ordering};

 use crate::bindings::{
    gum_barebone_handle_exception, GumCpuContext,
@@ -322,10 +324,15 @@ pub fn install() {
        _patch_text(addr.add(1) as *mut c_void, frida_arm_fixup as *const () as usize as u32);
        _patch_text(addr as *mut c_void, 0xe51ff004);
    }
+    ACTIVATED.store(true, Ordering::Release);
 }

 #[cfg(target_arch = "arm")]
 pub fn uninstall() {
+    if !ACTIVATED.swap(false, Ordering::AcqRel) {
+        return;
+    }
+
    let target = unsafe { _fixup_exception } as *mut u32;
    unsafe {
        _patch_text(target.add(1) as *mut c_void, PROLOGUE[1]);
@@ -437,6 +444,9 @@ unsafe extern "C" {
 #[cfg(target_arch = "aarch64")]
 const PROLOGUE: [u32; 4] = [0xd503233f, 0xa9be7bfd, 0x910003fd, 0xa90153f3];

+#[cfg(any(target_arch = "arm", target_arch = "aarch64"))]
+static ACTIVATED: AtomicBool = AtomicBool::new(false);
+
 #[cfg(target_arch = "aarch64")]
 #[unsafe(no_mangle)]
 static mut FRIDA_ARM64_ORIGINAL_CONT: u64 = 0;
@@ -452,7 +462,7 @@ pub fn install() {

    unsafe { FRIDA_ARM64_ORIGINAL_CONT = target.add(4) as u64 };

-    let jump = detour_to(frida_arm64_fixup as *const () as usize);
+    let jump = redirect_to(frida_arm64_fixup as *const () as usize);
    unsafe {
        let addr = target as *mut u32;
        _aarch64_insn_patch_text_nosync(addr.add(2) as *mut c_void, jump[2]);
@@ -460,10 +470,15 @@ pub fn install() {
        _aarch64_insn_patch_text_nosync(addr.add(1) as *mut c_void, jump[1]);
        _aarch64_insn_patch_text_nosync(addr as *mut c_void, jump[0]);
    }
+    ACTIVATED.store(true, Ordering::Release);
 }

 #[cfg(target_arch = "aarch64")]
 pub fn uninstall() {
+    if !ACTIVATED.swap(false, Ordering::AcqRel) {
+        return;
+    }
+
    let target = unsafe { _fixup_exception } as *mut u32;
    unsafe {
        for slot in 0..4 {
@@ -473,7 +488,7 @@ pub fn uninstall() {
 }

 #[cfg(target_arch = "aarch64")]
-fn detour_to(destination: usize) -> [u32; 4] {
+fn redirect_to(destination: usize) -> [u32; 4] {
    [0x58000050, 0xd61f0200, destination as u32, (destination >> 32) as u32]
 }

@@ -542,7 +557,7 @@ unsafe fn recovered(regs: *mut c_void) -> bool {
 extern "C" fn frida_arm64_park() -> ! {
    static mut PARK_TOKEN: u8 = 0;
    loop {
-        crate::kernel::wait(core::ptr::addr_of!(PARK_TOKEN), Some(1_000_000), &mut || false);
+        crate::kernel::wait(core::ptr::addr_of!(PARK_TOKEN), None, &mut || false);
    }
 }

@@ -1,357 +0,0 @@
-// The agent as a kernel module: every primitive is an ordinary call into
-// linux/frida-kmod.c, compiled by kbuild against the target kernel's headers,
-// which is what keeps us out of the business of guessing struct layouts,
-// config-dependent macros and per-version symbol names.
-
-use core::ffi::{CStr, c_char, c_int, c_void};
-
-use alloc::string::String;
-use alloc::vec::Vec;
-
-use super::{LoadedModule, ModuleEvent};
-use crate::kernel::ThreadEntry;
-
-pub fn log(msg: &str) {
-    unsafe { frida_kmod_log(msg.as_ptr() as *const c_char) };
-}
-
-pub fn panic(msg: &str) -> ! {
-    unsafe { frida_kmod_panic(msg.as_ptr() as *const c_char) }
-}
-
-pub fn run_when_ready(action: fn()) {
-    action();
-}
-
-pub fn spawn_thread(entry: ThreadEntry, parameter: *mut c_void) -> isize {
-    unsafe { frida_kmod_spawn_thread(entry, parameter) as isize }
-}
-
-pub fn install_hooks() {
-    unsafe { frida_kmod_install_hooks() };
-}
-
-pub fn alloc(size: usize) -> *mut u8 {
-    unsafe { frida_kmod_alloc(size) }
-}
-
-pub fn free(ptr: *mut u8, size: usize) {
-    unsafe { frida_kmod_free(ptr, size) };
-}
-
-pub fn alloc_code(size: usize) -> *mut u8 {
-    unsafe { frida_kmod_alloc_code(size) }
-}
-
-pub fn free_code(ptr: *mut u8, size: usize) {
-    unsafe { frida_kmod_free_code(ptr, size) };
-}
-
-pub fn page_size() -> usize {
-    crate::gum::page_size_the_kernel_runs_with()
-}
-
-pub fn alloc_heap(size: usize) -> *mut u8 {
-    alloc(size)
-}
-
-pub fn alloc_dma(size: usize) -> *mut u8 {
-    alloc_code(size)
-}
-
-pub fn free_dma(ptr: *mut u8, size: usize) {
-    free_code(ptr, size);
-}
-
-pub fn own_range() -> (u64, u64) {
-    let mut base: u64 = 0;
-    let mut size: u64 = 0;
-    unsafe { frida_kmod_own_range(&mut base, &mut size) };
-    (base, size)
-}
-
-// The sequence number is taken before `check` runs, so a wakeup racing with the
-// condition we are about to observe still makes the commit return immediately.
-pub fn wait(_token: *const u8, timeout_us: Option<u64>, check: &mut dyn FnMut() -> bool) {
-    let seq = unsafe { frida_kmod_wait_prepare() };
-
-    if check() {
-        return;
-    }
-
-    unsafe { frida_kmod_wait_commit(seq, timeout_us.map_or(-1, |us| us as i64)) };
-}
-
-pub fn poke_loop_wakeup() {}
-
-pub fn wake(_token: *const u8) {
-    unsafe { frida_kmod_wake() };
-}
-
-/// Gives the scheduler a chance to run something else. A kernel thread that loops
-/// without doing this is a hard lockup waiting to happen.
-pub fn yield_now() {
-    unsafe { frida_kmod_yield() };
-}
-
-pub fn monotonic_micros() -> i64 {
-    unsafe { frida_kmod_monotonic_micros() }
-}
-
-pub fn wall_clock_micros() -> (u32, u32) {
-    let mut secs: u32 = 0;
-    let mut micros: u32 = 0;
-    unsafe { frida_kmod_wall_clock_micros(&mut secs, &mut micros) };
-    (secs, micros)
-}
-
-pub fn current_process_id() -> u32 {
-    KERNEL_PROCESS
-}
-
-pub fn current_thread_id() -> u64 {
-    unsafe { frida_kmod_current_thread_id() }
-}
-
-pub fn protect(address: u64, size: usize, gum_prot: u32) -> bool {
-    unsafe { frida_kmod_protect(address, size, gum_prot) != 0 }
-}
-
-pub fn remap_writable(first_page: u64, n_pages: u32) -> *mut c_void {
-    unsafe { frida_kmod_remap_writable(first_page, n_pages) }
-}
-
-/// Tears down an alias handed out by [`remap_writable`] and flushes the icache
-/// over the range it aliased; the shim remembers which range that was.
-pub fn unmap_writable(mapping: *mut c_void) {
-    unsafe { frida_kmod_unmap_writable(mapping) };
-}
-
-pub fn get_kernel_base() -> u64 {
-    unsafe { frida_kmod_kernel_base() }
-}
-
-pub fn get_kernel_size() -> u64 {
-    unsafe { frida_kmod_kernel_size() }
-}
-
-pub fn enumerate_modules() -> Vec<LoadedModule> {
-    unsafe extern "C" fn on_module(
-        name: *const c_char,
-        version: *const c_char,
-        base: u64,
-        size: u64,
-        user_data: *mut c_void,
-    ) -> c_int {
-        unsafe {
-            let modules = &mut *(user_data as *mut Vec<LoadedModule>);
-            modules.push(LoadedModule {
-                name: String::from(CStr::from_ptr(name).to_str().unwrap_or("?")),
-                version: String::from(CStr::from_ptr(version).to_str().unwrap_or("")),
-                base,
-                size,
-            });
-            1
-        }
-    }
-
-    let mut modules: Vec<LoadedModule> = Vec::new();
-    unsafe {
-        frida_kmod_enumerate_modules(on_module, &mut modules as *mut _ as *mut c_void);
-    }
-    modules
-}
-
-pub fn watch_modules(on_event: fn(ModuleEvent, LoadedModule)) {
-    unsafe extern "C" fn on_module_event(
-        loaded: c_int,
-        name: *const c_char,
-        version: *const c_char,
-        base: u64,
-        size: u64,
-        user_data: *mut c_void,
-    ) {
-        unsafe {
-            let on_event: fn(ModuleEvent, LoadedModule) = core::mem::transmute(user_data);
-            on_event(
-                if loaded != 0 {
-                    ModuleEvent::Loaded
-                } else {
-                    ModuleEvent::Unloaded
-                },
-                LoadedModule {
-                    name: String::from(CStr::from_ptr(name).to_str().unwrap_or("?")),
-                    version: String::from(CStr::from_ptr(version).to_str().unwrap_or("")),
-                    base,
-                    size,
-                },
-            );
-        }
-    }
-
-    unsafe {
-        frida_kmod_watch_modules(on_module_event, on_event as *mut c_void);
-    }
-}
-
-pub fn unwatch_modules() {
-    unsafe { frida_kmod_unwatch_modules() };
-}
-
-pub fn enumerate_module_symbols(
-    base: u64,
-    on_symbol: &mut dyn FnMut(*const c_char, u64, u64, u8, bool) -> bool,
-) -> bool {
-    unsafe extern "C" fn on_module_symbol(
-        name: *const c_char,
-        address: u64,
-        size: u64,
-        kind: u8,
-        is_global: c_int,
-        user_data: *mut c_void,
-    ) -> c_int {
-        unsafe {
-            let callback =
-                &mut *(user_data as *mut &mut dyn FnMut(*const c_char, u64, u64, u8, bool) -> bool);
-            if callback(name, address, size, kind, is_global != 0) { 1 } else { 0 }
-        }
-    }
-
-    let mut boxed: &mut dyn FnMut(*const c_char, u64, u64, u8, bool) -> bool = on_symbol;
-    unsafe {
-        frida_kmod_enumerate_module_symbols(base, on_module_symbol, &mut boxed as *mut _ as *mut c_void) != 0
-    }
-}
-
-pub fn enumerate_module_exports(
-    base: u64,
-    on_export: &mut dyn FnMut(*const c_char, u64) -> bool,
-) -> bool {
-    unsafe extern "C" fn on_module_export(
-        name: *const c_char,
-        address: u64,
-        user_data: *mut c_void,
-    ) -> c_int {
-        unsafe {
-            let callback = &mut *(user_data as *mut &mut dyn FnMut(*const c_char, u64) -> bool);
-            if callback(name, address) { 1 } else { 0 }
-        }
-    }
-
-    let mut boxed: &mut dyn FnMut(*const c_char, u64) -> bool = on_export;
-    unsafe {
-        frida_kmod_enumerate_module_exports(base, on_module_export, &mut boxed as *mut _ as *mut c_void) != 0
-    }
-}
-
-pub fn find_symbol(name: &CStr) -> u64 {
-    unsafe { frida_kmod_find_symbol(name.as_ptr()) }
-}
-
-pub fn find_function(name: &CStr) -> u64 {
-    unsafe { frida_kmod_find_function(name.as_ptr()) }
-}
-
-/// Resolves `address` to `(name, symbol_address)`, or `None` when it falls
-/// outside every known symbol.
-pub fn symbol_from_address(address: u64) -> Option<(String, u64)> {
-    const NAME_CAPACITY: usize = 256;
-
-    let mut buffer = [0u8; NAME_CAPACITY];
-    let mut symbol_address: u64 = 0;
-    let found = unsafe {
-        frida_kmod_symbol_name_from_address(
-            address,
-            buffer.as_mut_ptr() as *mut c_char,
-            NAME_CAPACITY,
-            &mut symbol_address,
-        )
-    };
-    if found == 0 {
-        return None;
-    }
-
-    let name = CStr::from_bytes_until_nul(&buffer).unwrap();
-    Some((String::from(name.to_str().unwrap()), symbol_address))
-}
-
-/// Visits every symbol the running kernel knows about. Returns false when
-/// kallsyms is unavailable, which is the case on kernels built without
-/// CONFIG_KALLSYMS or when the shim could not resolve its entry points.
-pub fn enumerate_symbols(callback: &mut dyn FnMut(&CStr, u64) -> bool) -> bool {
-    unsafe extern "C" fn on_symbol(
-        name: *const c_char,
-        address: u64,
-        user_data: *mut c_void,
-    ) -> c_int {
-        unsafe {
-            let callback = &mut *(user_data as *mut &mut dyn FnMut(&CStr, u64) -> bool);
-            if callback(CStr::from_ptr(name), address) { 1 } else { 0 }
-        }
-    }
-
-    let mut boxed: &mut dyn FnMut(&CStr, u64) -> bool = callback;
-    unsafe { frida_kmod_enumerate_symbols(on_symbol, &mut boxed as *mut _ as *mut c_void) != 0 }
-}
-
-const KERNEL_PROCESS: u32 = 0;
-
-type FoundSymbolFunc =
-    unsafe extern "C" fn(name: *const c_char, address: u64, user_data: *mut c_void) -> c_int;
-type ModuleEventFunc = unsafe extern "C" fn(c_int, *const c_char, *const c_char, u64, u64, *mut c_void);
-type FoundModuleSymbolFunc =
-    unsafe extern "C" fn(*const c_char, u64, u64, u8, c_int, *mut c_void) -> c_int;
-type FoundModuleExportFunc = unsafe extern "C" fn(*const c_char, u64, *mut c_void) -> c_int;
-type FoundModuleFunc = unsafe extern "C" fn(
-    name: *const c_char,
-    version: *const c_char,
-    base: u64,
-    size: u64,
-    user_data: *mut c_void,
-) -> c_int;
-
-unsafe extern "C" {
-    fn frida_kmod_log(message: *const c_char);
-    fn frida_kmod_panic(message: *const c_char) -> !;
-    fn frida_kmod_spawn_thread(entry: ThreadEntry, parameter: *mut c_void) -> c_int;
-    fn frida_kmod_install_hooks();
-    fn frida_kmod_alloc(size: usize) -> *mut u8;
-    fn frida_kmod_free(ptr: *mut u8, size: usize);
-    fn frida_kmod_alloc_code(size: usize) -> *mut u8;
-    fn frida_kmod_free_code(ptr: *mut u8, size: usize);
-    fn frida_kmod_own_range(base: *mut u64, size: *mut u64);
-    fn frida_kmod_wait_prepare() -> u32;
-    fn frida_kmod_wait_commit(seq: u32, timeout_us: i64);
-    fn frida_kmod_wake();
-    fn frida_kmod_yield();
-    fn frida_kmod_monotonic_micros() -> i64;
-    fn frida_kmod_wall_clock_micros(secs: *mut u32, micros: *mut u32);
-    fn frida_kmod_current_thread_id() -> u64;
-    fn frida_kmod_protect(address: u64, size: usize, gum_prot: u32) -> c_int;
-    fn frida_kmod_remap_writable(first_page: u64, n_pages: u32) -> *mut c_void;
-    fn frida_kmod_unmap_writable(mapping: *mut c_void);
-    fn frida_kmod_kernel_base() -> u64;
-    fn frida_kmod_kernel_size() -> u64;
-    fn frida_kmod_enumerate_modules(func: FoundModuleFunc, user_data: *mut c_void);
-    fn frida_kmod_watch_modules(func: ModuleEventFunc, user_data: *mut c_void);
-    fn frida_kmod_unwatch_modules();
-    fn frida_kmod_enumerate_module_symbols(
-        base: u64,
-        func: FoundModuleSymbolFunc,
-        user_data: *mut c_void,
-    ) -> c_int;
-    fn frida_kmod_enumerate_module_exports(
-        base: u64,
-        func: FoundModuleExportFunc,
-        user_data: *mut c_void,
-    ) -> c_int;
-    fn frida_kmod_find_symbol(name: *const c_char) -> u64;
-    fn frida_kmod_find_function(name: *const c_char) -> u64;
-    fn frida_kmod_symbol_name_from_address(
-        address: u64,
-        buffer: *mut c_char,
-        size: usize,
-        symbol_address: *mut u64,
-    ) -> c_int;
-    fn frida_kmod_enumerate_symbols(func: FoundSymbolFunc, user_data: *mut c_void) -> c_int;
-}
@@ -1,13 +1,17 @@
 use alloc::collections::BTreeMap;
 use alloc::string::String;
 use alloc::vec::Vec;
-use core::ffi::c_void;
+use core::ffi::{CStr, c_char, c_void};

 pub fn field_offset(container: &str, field: &str) -> Option<usize> {
+    if let Some(told) = told_by_the_loader(container, field) {
+        return Some(told);
+    }
+
    let types = described_types()?;
    let described = types.named(container)?;

-    types.offset_of(&described, field).map(|bits| bits / 8)
+    types.offset_of_path(&described, field).map(|bits| bits / 8)
 }

 pub fn resolve_struct(container: &str) -> Option<usize> {
@@ -96,11 +100,43 @@ pub fn types_are_described() -> bool {
 }

 pub fn struct_size(container: &str) -> Option<usize> {
+    if let Some(told) = told_by_the_loader(container, "") {
+        return Some(told);
+    }
+
    let types = described_types()?;

    Some(types.named(container)?.size as usize)
 }

+fn told_by_the_loader(container: &str, field: &str) -> Option<usize> {
+    let mut entry = unsafe { _frida_kmod_layout } as *const ToldLayout;
+    if entry.is_null() {
+        return None;
+    }
+
+    unsafe {
+        while !(*entry).container.is_null() {
+            let told = &*entry;
+            if CStr::from_ptr(told.container).to_bytes() == container.as_bytes()
+                && CStr::from_ptr(told.field).to_bytes() == field.as_bytes()
+            {
+                return Some(told.value);
+            }
+            entry = entry.add(1);
+        }
+    }
+
+    None
+}
+
+#[repr(C)]
+struct ToldLayout {
+    container: *const c_char,
+    field: *const c_char,
+    value: usize,
+}
+
 struct DescribedTypes {
    types: &'static [u8],
    names: &'static [u8],
@@ -437,6 +473,25 @@ impl DescribedTypes {
        described.kind == KIND_ENUM || described.kind == KIND_WIDE_ENUM
    }

+    fn offset_of_path(&self, described: &Described, path: &str) -> Option<usize> {
+        let Some((member, rest)) = path.split_once('.') else {
+            return self.offset_of(described, path);
+        };
+
+        let (placement, type_id) = self.member_named(described, member)?;
+        let within = self.with_id(type_id)?;
+
+        Some(placement + self.offset_of_path(&within, rest)?)
+    }
+
+    fn member_named(&self, described: &Described, wanted: &str) -> Option<(usize, u32)> {
+        (0..described.members).find_map(|index| {
+            let member = described.body + (index * MEMBER_SIZE);
+            (self.name_of(word_at(self.types, member)) == wanted)
+                .then(|| (self.placement_of(described, member), word_at(self.types, member + 4)))
+        })
+    }
+
    // A structure the kernel lays out itself keeps its fields in a member with no name of its
    // own, so a field is looked for through those as well, and answers where it sits in the
    // structure the question was asked about.
@@ -619,4 +674,5 @@ const MAX_DEPTH: usize = 8;
 unsafe extern "C" {
    static ___start_BTF: *const c_void;
    static ___stop_BTF: *const c_void;
+    static _frida_kmod_layout: usize;
 }
@@ -1,10 +1,3 @@
-// Linux backend. The agent reaches the kernel in one of two ways, and the rest
-// of the agent cannot tell which: loaded from the inside as a kernel module,
-// where every primitive is a call into a shim kbuild compiled against the
-// target's headers; or injected from the outside like XNU and Windows, where
-// the host patches the addresses it needs into .kernel_addrs and the memory it
-// cannot touch is reached over the hostlink.
-
 use alloc::string::String;

 pub fn stack_headroom() -> usize {
@@ -20,8 +13,6 @@ pub(crate) const STACK_SPAN: usize = 16 * 1024;
 #[cfg(any(target_arch = "arm", target_arch = "x86"))]
 pub(crate) const STACK_SPAN: usize = 8 * 1024;

-#[cfg(feature = "linux")]
-mod kmod;
 #[cfg(feature = "linux-injected")]
 mod arena;
 #[cfg(feature = "linux-injected")]
@@ -52,9 +43,15 @@ mod threads;
 pub(crate) mod user;
 #[cfg(feature = "linux-injected")]
 mod processes;
+#[cfg(all(feature = "linux-injected", any(target_arch = "x86_64", target_arch = "aarch64")))]
+mod cloak;
+#[cfg(all(feature = "linux-injected", any(target_arch = "x86_64", target_arch = "aarch64")))]
+mod control;
+#[cfg(all(feature = "linux-injected", any(target_arch = "x86_64", target_arch = "aarch64")))]
+mod process_memory;
+#[cfg(all(feature = "linux-injected", any(target_arch = "x86_64", target_arch = "aarch64")))]
+mod user_threads;

-#[cfg(feature = "linux")]
-pub use self::kmod::*;
 #[cfg(feature = "linux-injected")]
 pub use self::injection::*;
 #[cfg(feature = "linux-injected")]
@@ -63,17 +60,23 @@ pub use self::relay::*;
 pub use self::facade::*;
 #[cfg(feature = "linux-injected")]
 pub use self::native::{
-    alloc_dma, free_dma, get_kernel_base, get_kernel_size, install_interrupt_handler, map_io,
-    map_pages,
-    mmio_interrupt, pci_interrupt, release_fault_reporter, release_interrupt, run_when_ready,
-    patch_text, set_kernel_base, set_protection, virt_to_phys,
+    alloc_dma, free_dma, get_kernel_base, get_kernel_size, hand_back_to_the_loader,
+    install_interrupt_handler, loaded_from_the_inside, map_io, map_pages, mmio_interrupt, pci_interrupt,
+    release_fault_reporter, release_interrupt, remap_writable, run_when_ready, patch_text,
+    set_kernel_base, set_protection, unmap_writable, virt_to_phys,
 };
+#[cfg(all(feature = "linux-injected", any(target_arch = "x86_64", target_arch = "aarch64")))]
+pub use self::native::learn_when_to_sleep;
 #[cfg(feature = "linux-injected")]
 pub use self::mapped::*;
 #[cfg(feature = "linux-injected")]
 pub use self::modules::*;
 #[cfg(feature = "linux-injected")]
 pub use self::processes::*;
+#[cfg(all(feature = "linux-injected", any(target_arch = "x86_64", target_arch = "aarch64")))]
+pub use self::control::{
+    an_operation_waits, carry_out_operations, close as close_control_channel, open as open_control_channel,
+};
 #[cfg(feature = "linux-injected")]
 pub use self::spawn::*;
 #[cfg(feature = "linux-injected")]
@@ -9,6 +9,7 @@ use crate::bindings::{g_free, gsize, gum_memory_read};
 use super::{LoadedModule, ModuleEvent};

 pub fn enumerate_modules() -> Vec<LoadedModule> {
+    let _held = ModuleListLock::take();
    let Some(layout) = module_layout() else {
        return Vec::new();
    };
@@ -38,6 +39,7 @@ pub fn enumerate_module_symbols(
    base: u64,
    on_symbol: &mut dyn FnMut(*const c_char, u64, u64, u8, bool) -> bool,
 ) -> bool {
+    let _held = ModuleListLock::take();
    let Some(layout) = module_layout() else {
        return false;
    };
@@ -87,6 +89,7 @@ pub fn enumerate_module_exports(
    base: u64,
    on_export: &mut dyn FnMut(*const c_char, u64) -> bool,
 ) -> bool {
+    let _held = ModuleListLock::take();
    let Some(layout) = module_layout() else {
        return false;
    };
@@ -152,6 +155,52 @@ fn relative_target(at: usize) -> usize {
    at.wrapping_add_signed(offset as isize)
 }

+struct ModuleListLock {
+    mutex: *mut c_void,
+}
+
+impl ModuleListLock {
+    fn take() -> Self {
+        let mutex = unsafe { _module_mutex } as *mut c_void;
+        let lockable = !mutex.is_null() && unsafe { _mutex_lock.is_some() && _mutex_unlock.is_some() };
+        if !lockable {
+            return Self { mutex: ptr::null_mut() };
+        }
+
+        unsafe { lock_mutex(mutex) };
+
+        Self { mutex }
+    }
+}
+
+impl Drop for ModuleListLock {
+    fn drop(&mut self) {
+        if !self.mutex.is_null() {
+            unsafe { unlock_mutex(self.mutex) };
+        }
+    }
+}
+
+#[cfg(not(target_arch = "x86"))]
+unsafe fn lock_mutex(mutex: *mut c_void) {
+    unsafe { _mutex_lock.unwrap()(mutex) };
+}
+
+#[cfg(not(target_arch = "x86"))]
+unsafe fn unlock_mutex(mutex: *mut c_void) {
+    unsafe { _mutex_unlock.unwrap()(mutex) };
+}
+
+#[cfg(target_arch = "x86")]
+unsafe fn lock_mutex(mutex: *mut c_void) {
+    unsafe { frida_k_mutex_lock(mutex) };
+}
+
+#[cfg(target_arch = "x86")]
+unsafe fn unlock_mutex(mutex: *mut c_void) {
+    unsafe { frida_k_mutex_unlock(mutex) };
+}
+
 pub fn watch_modules(on_event: fn(ModuleEvent, LoadedModule)) {
    if module_layout().is_none() {
        return;
@@ -778,10 +827,15 @@ unsafe extern "C" {
    ) -> c_int;
    fn frida_k_register_module_notifier(block: *mut c_void) -> c_int;
    fn frida_k_unregister_module_notifier(block: *mut c_void) -> c_int;
+    fn frida_k_mutex_lock(mutex: *mut c_void);
+    fn frida_k_mutex_unlock(mutex: *mut c_void);
 }

 unsafe extern "C" {
    static _modules: *const c_void;
+    static _module_mutex: *const c_void;
+    static _mutex_lock: Option<unsafe extern "C" fn(*mut c_void)>;
+    static _mutex_unlock: Option<unsafe extern "C" fn(*mut c_void)>;
    static _register_module_notifier: Option<unsafe extern "C" fn(*mut c_void) -> c_int>;
    #[allow(dead_code)]
    static _unregister_module_notifier: Option<unsafe extern "C" fn(*mut c_void) -> c_int>;
@@ -1,14 +1,9 @@
-// The agent injected from the outside: the host resolves the kernel functions
-// below and patches their addresses into .kernel_addrs, the same way it does
-// for XNU and Windows. Everything the kernel would otherwise have to lend us --
-// its symbol table, its module list, the right to write to its pages -- comes
-// from the host instead, over the hostlink.
-
 use core::ffi::{c_char, c_int, c_uint, c_void};
-use core::ptr;
 use core::ptr::read_volatile;
 use core::sync::atomic::{AtomicBool, AtomicU64, Ordering};
-#[cfg(target_arch = "aarch64")]
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+use core::sync::atomic::{AtomicI32, fence};
+#[cfg(not(target_arch = "arm"))]
 use core::sync::atomic::AtomicUsize;

 use crate::kernel::ThreadEntry;
@@ -47,6 +42,16 @@ pub fn release_fault_reporter() {
    super::kfault::uninstall();
 }

+pub fn loaded_from_the_inside() -> bool {
+    unsafe { _frida_kmod_exit_worker != 0 }
+}
+
+pub fn hand_back_to_the_loader() {
+    if loaded_from_the_inside() {
+        unsafe { frida_kmod_exit_worker() };
+    }
+}
+
 pub fn send_signal(signal: c_int, task: usize) {
    unsafe { _send_sig(signal, task as *mut c_void, 1) };
 }
@@ -152,6 +157,17 @@ pub(crate) fn kcfi_thunk(callback: usize, _type_ref: Option<usize>) -> usize {
    callback
 }

+#[cfg(target_arch = "aarch64")]
+pub(crate) fn kernel_thread_function(cache: &AtomicUsize, callback: KthreadFn) -> KthreadFn {
+    let ref_fn = unsafe { _kthread_worker_fn.map(|f| f as usize) };
+    unsafe { core::mem::transmute(kcfi_thunk_cached(cache, callback as usize, ref_fn)) }
+}
+
+#[cfg(target_arch = "x86_64")]
+pub(crate) fn kernel_thread_function(_cache: &AtomicUsize, callback: KthreadFn) -> KthreadFn {
+    callback
+}
+
 #[cfg(target_arch = "aarch64")]
 fn kcfi_thunk_cached(cache: &AtomicUsize, callback: usize, type_ref: Option<usize>) -> usize {
    let existing = cache.load(Ordering::Acquire);
@@ -212,28 +228,38 @@ pub fn spawn_thread(entry: ThreadEntry, parameter: *mut c_void) -> isize {

 #[cfg(target_arch = "x86")]
 pub fn alloc(size: usize) -> *mut u8 {
-    unsafe { frida_k_alloc(size, GFP_KERNEL as usize) }
+    unsafe { frida_k_alloc(size, allocation_flags() as usize) }
 }

 #[cfg(not(target_arch = "x86"))]
 pub fn alloc(size: usize) -> *mut u8 {
+    let flags = allocation_flags();
+
    unsafe {
        if let Some(f) = ___kmalloc_noprof {
-            f(size, GFP_KERNEL)
+            f(size, flags)
        } else if let Some(f) = _kmalloc {
-            f(size, GFP_KERNEL)
+            f(size, flags)
        } else {
-            ___kmalloc.unwrap()(size, GFP_KERNEL)
+            ___kmalloc.unwrap()(size, flags)
        }
    }
 }

+fn allocation_flags() -> u32 {
+    if can_sleep() { GFP_KERNEL } else { GFP_ATOMIC }
+}
+
 pub fn free(ptr: *mut u8, _size: usize) {
    unsafe { _kfree(ptr) };
 }

 pub fn alloc_heap(size: usize) -> *mut u8 {
    unsafe {
+        #[cfg(not(target_arch = "x86"))]
+        if let Some(f) = _vmalloc_noprof {
+            return f(size);
+        }
        if let Some(f) = _vmalloc {
            return f(size);
        }
@@ -242,7 +268,6 @@ pub fn alloc_heap(size: usize) -> *mut u8 {
    alloc(size)
 }

-
 #[cfg(target_arch = "x86")]
 pub fn alloc_code(size: usize) -> *mut u8 {
    unsafe {
@@ -253,7 +278,9 @@ pub fn alloc_code(size: usize) -> *mut u8 {
 #[cfg(not(target_arch = "x86"))]
 pub fn alloc_code(size: usize) -> *mut u8 {
    unsafe {
-        let code = if let Some(f) = _execmem_alloc {
+        let code = if let Some(f) = _execmem_alloc_rw {
+            f(EXECMEM_MODULE_TEXT, size)
+        } else if let Some(f) = _execmem_alloc {
            f(EXECMEM_MODULE_TEXT, size)
        } else {
            _module_alloc.unwrap()(size)
@@ -283,6 +310,29 @@ pub fn free_code(ptr: *mut u8, _size: usize) {
    }
 }

+#[cfg(not(target_arch = "x86"))]
+pub fn remap_writable(first_page: u64, n_pages: u32) -> Option<*mut c_void> {
+    let remap = unsafe { _frida_kmod_remap_writable }?;
+    let alias = unsafe { remap(first_page, n_pages) };
+
+    (!alias.is_null()).then_some(alias)
+}
+
+#[cfg(target_arch = "x86")]
+pub fn remap_writable(_first_page: u64, _n_pages: u32) -> Option<*mut c_void> {
+    None
+}
+
+#[cfg(not(target_arch = "x86"))]
+pub fn unmap_writable(alias: *mut c_void) -> bool {
+    unsafe { _frida_kmod_unmap_writable }.is_some_and(|unmap| unsafe { unmap(alias) })
+}
+
+#[cfg(target_arch = "x86")]
+pub fn unmap_writable(_alias: *mut c_void) -> bool {
+    false
+}
+
 pub fn page_size() -> usize {
    crate::gum::page_size_the_kernel_runs_with()
 }
@@ -392,13 +442,18 @@ pub fn free_dma(ptr: *mut u8, size: usize) {
    free(ptr, size);
 }

-pub fn wait(_token: *const u8, timeout_us: Option<u64>, check: &mut dyn FnMut() -> bool) {
+pub fn wait(token: *const u8, timeout_us: Option<u64>, check: &mut dyn FnMut() -> bool) {
+    if !can_sleep() {
+        spin_until(check, timeout_us);
+        return;
+    }
+
    let waiters = waiters();

    let mut waiter = [0usize; WAIT_ENTRY_WORDS];
-    let waiter = queue_this_thread(&mut waiter);
+    let waiter = queue_this_thread(&mut waiter, token);

-    unsafe { _prepare_to_wait_event(waiters, waiter, TASK_INTERRUPTIBLE) };
+    unsafe { _prepare_to_wait_event(waiters, waiter, TASK_IDLE) };

    if !check() {
        match timeout_us {
@@ -413,18 +468,19 @@ pub fn wait(_token: *const u8, timeout_us: Option<u64>, check: &mut dyn FnMut()
    unsafe { _finish_wait(waiters, waiter) };
 }

-pub fn wake(_token: *const u8) {
-    unsafe { ___wake_up(waiters(), TASK_NORMAL, WAKE_EVERY_WAITER, ptr::null_mut()) };
+pub fn wake(token: *const u8) {
+    unsafe { ___wake_up(waiters(), TASK_NORMAL, WAKE_EVERY_WAITER, token as *mut c_void) };
 }

 pub fn poke_loop_wakeup() {}

-fn queue_this_thread(entry: &mut [usize; WAIT_ENTRY_WORDS]) -> *mut c_void {
+fn queue_this_thread(entry: &mut [usize; WAIT_ENTRY_WORDS], token: *const u8) -> *mut c_void {
    let entry = entry.as_mut_ptr();

    unsafe {
        entry.add(WAIT_ENTRY_THREAD).write(current_task() as usize);
-        entry.add(WAIT_ENTRY_WAKE).write(_autoremove_wake_function as usize);
+        entry.add(WAIT_ENTRY_WAKE).write(waking_function());
+        entry.add(WAIT_ENTRY_TOKEN).write(token as usize);

        let queued = entry.add(WAIT_ENTRY_QUEUED);
        queued.write(queued as usize);
@@ -434,6 +490,37 @@ fn queue_this_thread(entry: &mut [usize; WAIT_ENTRY_WORDS]) -> *mut c_void {
    entry as *mut c_void
 }

+#[cfg(target_arch = "aarch64")]
+fn waking_function() -> usize {
+    let ref_fn = unsafe { _autoremove_wake_function } as usize;
+    kcfi_thunk_cached(&WAKE_THUNK, frida_cb_wake as *const () as usize, Some(ref_fn))
+}
+
+#[cfg(not(any(target_arch = "aarch64", target_arch = "x86")))]
+fn waking_function() -> usize {
+    frida_cb_wake as *const () as usize
+}
+
+#[cfg(target_arch = "x86")]
+fn waking_function() -> usize {
+    unsafe { _autoremove_wake_function as usize }
+}
+
+#[cfg(not(target_arch = "x86"))]
+unsafe extern "C" fn frida_cb_wake(entry: *mut c_void, mode: c_uint, flags: c_int, key: *mut c_void) -> c_int {
+    let awaited = unsafe { (entry as *const usize).add(WAIT_ENTRY_TOKEN).read() };
+    if key as usize != awaited {
+        return 0;
+    }
+
+    let wake_this_one: unsafe extern "C" fn(*mut c_void, c_uint, c_int, *mut c_void) -> c_int =
+        unsafe { core::mem::transmute(_autoremove_wake_function) };
+    unsafe { wake_this_one(entry, mode, flags, key) }
+}
+
+#[cfg(target_arch = "aarch64")]
+static WAKE_THUNK: AtomicUsize = AtomicUsize::new(0);
+
 fn waiters() -> *mut c_void {
    let queue = (&raw mut WAITERS) as *mut c_void;

@@ -492,7 +579,7 @@ fn pci_irq_vector() -> Option<unsafe extern "C" fn(*mut c_void, c_uint) -> c_int
 #[cfg(target_arch = "arm")]
 pub fn mmio_interrupt(mmio_base: u64) -> Option<u32> {
    let path = alloc::format!("/virtio_mmio@{:x}\0", mmio_base);
-    let node = unsafe { _of_find_node_opts_by_path(path.as_ptr() as *const c_char, ptr::null_mut()) };
+    let node = unsafe { _of_find_node_opts_by_path(path.as_ptr() as *const c_char, core::ptr::null_mut()) };
    if node.is_null() {
        return None;
    }
@@ -513,7 +600,240 @@ pub fn mmio_interrupt(_mmio_base: u64) -> Option<u32> {
 }

 pub fn yield_now() {
-    unsafe { _schedule() };
+    if can_sleep() {
+        unsafe { _schedule() };
+    } else {
+        core::hint::spin_loop();
+    }
+}
+
+#[cfg(any(target_arch = "aarch64", target_arch = "x86_64"))]
+pub fn learn_when_to_sleep() {
+    let above = |found: Option<usize>| found.map_or(usize::MAX, |at| at + 1);
+    RCU_DEPTH_AT.store(above(super::layout::field_offset("task_struct", "rcu_read_lock_nesting")), Ordering::Relaxed);
+    PREEMPT_COUNT_AT.store(above(where_the_preempt_count_is()), Ordering::Release);
+}
+
+#[cfg(any(target_arch = "aarch64", target_arch = "x86_64"))]
+fn can_sleep() -> bool {
+    let Some(places) = sleeping_places() else {
+        return true;
+    };
+    let rcu_depth = places.rcu_read_lock_nesting
+        .map_or(0, |at| unsafe { ((current_task() as usize + at) as *const i32).read_volatile() });
+
+    current_preempt_count(places.preempt_count) == 0 && !interrupts_masked() && rcu_depth == 0
+}
+
+#[cfg(not(any(target_arch = "aarch64", target_arch = "x86_64")))]
+fn can_sleep() -> bool {
+    true
+}
+
+#[cfg(any(target_arch = "aarch64", target_arch = "x86_64"))]
+fn sleeping_places() -> Option<SleepingPlaces> {
+    let found = |at: usize| (at != 0 && at != usize::MAX).then(|| at - 1);
+    Some(SleepingPlaces {
+        preempt_count: found(PREEMPT_COUNT_AT.load(Ordering::Acquire))?,
+        rcu_read_lock_nesting: found(RCU_DEPTH_AT.load(Ordering::Relaxed)),
+    })
+}
+
+#[cfg(target_arch = "aarch64")]
+fn where_the_preempt_count_is() -> Option<usize> {
+    super::layout::field_offset("task_struct", "thread_info.preempt_count")
+}
+
+#[cfg(target_arch = "x86_64")]
+fn where_the_preempt_count_is() -> Option<usize> {
+    let standalone = unsafe { ___preempt_count };
+    if standalone != 0 {
+        return Some(standalone);
+    }
+
+    hot_per_cpu_place("preempt_count")
+}
+
+#[cfg(target_arch = "aarch64")]
+fn current_preempt_count(at: usize) -> u32 {
+    unsafe { ((current_task() as usize + at) as *const u32).read_volatile() }
+}
+
+#[cfg(target_arch = "x86_64")]
+fn current_preempt_count(at: usize) -> u32 {
+    let count: u32;
+    unsafe { core::arch::asm!("mov {:e}, gs:[{}]", out(reg) count, in(reg) at, options(nostack, readonly)) };
+
+    count & !PREEMPT_NEED_RESCHED
+}
+
+#[cfg(target_arch = "aarch64")]
+fn interrupts_masked() -> bool {
+    let daif: usize;
+    unsafe { core::arch::asm!("mrs {}, daif", out(reg) daif, options(nomem, nostack)) };
+
+    daif & DAIF_IRQ_MASKED != 0
+}
+
+#[cfg(target_arch = "x86_64")]
+fn interrupts_masked() -> bool {
+    let flags: usize;
+    unsafe { core::arch::asm!("pushfq", "pop {}", out(reg) flags, options(nomem, preserves_flags)) };
+
+    flags & RFLAGS_IF == 0
+}
+
+#[cfg(any(target_arch = "aarch64", target_arch = "x86_64"))]
+struct SleepingPlaces {
+    preempt_count: usize,
+    rcu_read_lock_nesting: Option<usize>,
+}
+
+#[cfg(any(target_arch = "aarch64", target_arch = "x86_64"))]
+static PREEMPT_COUNT_AT: AtomicUsize = AtomicUsize::new(0);
+#[cfg(any(target_arch = "aarch64", target_arch = "x86_64"))]
+static RCU_DEPTH_AT: AtomicUsize = AtomicUsize::new(0);
+
+fn spin_until(check: &mut dyn FnMut() -> bool, timeout_us: Option<u64>) {
+    let deadline = timeout_us.map(|us| monotonic_micros() + us as i64);
+
+    while !check() && deadline.is_none_or(|deadline| monotonic_micros() < deadline) {
+        core::hint::spin_loop();
+    }
+}
+
+#[cfg(target_arch = "x86_64")]
+pub(crate) fn lock_spinlock(lock: usize) {
+    unsafe { __raw_spin_lock.unwrap()(lock as *mut c_void) };
+}
+
+#[cfg(target_arch = "x86_64")]
+pub(crate) fn unlock_spinlock(lock: usize) {
+    unsafe { __raw_spin_unlock.unwrap()(lock as *mut c_void) };
+}
+
+#[cfg(target_arch = "aarch64")]
+pub(crate) fn lock_spinlock(lock: usize) {
+    if let Some(lock_it) = unsafe { __raw_spin_lock } {
+        return unsafe { lock_it(lock as *mut c_void) };
+    }
+
+    disable_preemption();
+    if let Err(seen) = counter_at(lock).compare_exchange(0, SPIN_LOCKED, Ordering::Acquire, Ordering::Relaxed) {
+        unsafe { _queued_spin_lock_slowpath(lock as *mut c_void, seen as u32) };
+    }
+}
+
+#[cfg(target_arch = "aarch64")]
+pub(crate) fn unlock_spinlock(lock: usize) {
+    if let Some(unlock_it) = unsafe { __raw_spin_unlock } {
+        return unsafe { unlock_it(lock as *mut c_void) };
+    }
+
+    unsafe { core::sync::atomic::AtomicU8::from_ptr(lock as *mut u8) }.store(0, Ordering::Release);
+    enable_preemption();
+}
+
+#[cfg(target_arch = "aarch64")]
+pub(crate) fn read_lock_irqsave(lock: usize) -> usize {
+    let flags = mask_interrupts();
+    disable_preemption();
+    if counter_at(lock).fetch_add(READER_BIAS, Ordering::Acquire) & WRITER_MASK != 0 {
+        unsafe { _queued_read_lock_slowpath(lock as *mut c_void) };
+    }
+    flags
+}
+
+#[cfg(target_arch = "aarch64")]
+pub(crate) fn read_unlock_irqrestore(lock: usize, flags: usize) {
+    counter_at(lock).fetch_sub(READER_BIAS, Ordering::Release);
+    enable_preemption();
+    restore_interrupts(flags);
+}
+
+#[cfg(target_arch = "aarch64")]
+pub(crate) fn write_lock_irqsave(lock: usize) -> usize {
+    let flags = mask_interrupts();
+    disable_preemption();
+    if counter_at(lock).compare_exchange(0, WRITER_LOCKED, Ordering::Acquire, Ordering::Relaxed).is_err() {
+        unsafe { _queued_write_lock_slowpath(lock as *mut c_void) };
+    }
+    flags
+}
+
+#[cfg(target_arch = "aarch64")]
+pub(crate) fn write_unlock_irqrestore(lock: usize, flags: usize) {
+    unsafe { core::sync::atomic::AtomicU8::from_ptr(lock as *mut u8) }.store(0, Ordering::Release);
+    enable_preemption();
+    restore_interrupts(flags);
+}
+
+#[cfg(target_arch = "aarch64")]
+pub(crate) fn disable_preemption() {
+    let count = preempt_count();
+    unsafe { count.write_volatile(count.read_volatile() + 1) };
+    core::sync::atomic::compiler_fence(Ordering::SeqCst);
+}
+
+#[cfg(target_arch = "aarch64")]
+pub(crate) fn enable_preemption() {
+    core::sync::atomic::compiler_fence(Ordering::SeqCst);
+    let count = preempt_count();
+    unsafe { count.write_volatile(count.read_volatile() - 1) };
+}
+
+#[cfg(target_arch = "x86_64")]
+pub(crate) fn disable_preemption() {
+    let at = sleeping_places().unwrap().preempt_count;
+    unsafe { core::arch::asm!("add dword ptr gs:[{}], 1", in(reg) at, options(nostack)) };
+    core::sync::atomic::compiler_fence(Ordering::SeqCst);
+}
+
+#[cfg(target_arch = "x86_64")]
+pub(crate) fn enable_preemption() {
+    core::sync::atomic::compiler_fence(Ordering::SeqCst);
+    let at = sleeping_places().unwrap().preempt_count;
+    unsafe { core::arch::asm!("sub dword ptr gs:[{}], 1", in(reg) at, options(nostack)) };
+}
+
+#[cfg(target_arch = "aarch64")]
+fn preempt_count() -> *mut u32 {
+    let at = sleeping_places().unwrap().preempt_count;
+    (current_task() as usize + at) as *mut u32
+}
+
+#[cfg(target_arch = "aarch64")]
+fn mask_interrupts() -> usize {
+    let flags: usize;
+    unsafe {
+        core::arch::asm!("mrs {}, daif", "msr daifset, #3", out(reg) flags, options(nostack));
+    }
+    flags
+}
+
+#[cfg(target_arch = "aarch64")]
+fn restore_interrupts(flags: usize) {
+    unsafe { core::arch::asm!("msr daif, {}", in(reg) flags, options(nostack)) };
+}
+
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+pub(crate) fn hold(counter: usize) {
+    counter_at(counter).fetch_add(1, Ordering::Relaxed);
+}
+
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+pub(crate) fn let_go(counter: usize) -> bool {
+    if counter_at(counter).fetch_sub(1, Ordering::Release) != 1 {
+        return false;
+    }
+
+    fence(Ordering::Acquire);
+    true
+}
+
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+fn counter_at(address: usize) -> &'static AtomicI32 {
+    unsafe { AtomicI32::from_ptr(address as *mut i32) }
 }

 pub fn monotonic_micros() -> i64 {
@@ -567,33 +887,64 @@ pub fn current_task() -> u64 {
    task
 }

-#[cfg(target_arch = "x86_64")]
+#[cfg(any(target_arch = "x86", target_arch = "x86_64"))]
 pub fn current_task() -> u64 {
-    let task: u64;
-    unsafe {
-        core::arch::asm!("mov {}, gs:[{}]", out(reg) task, in(reg) _current_task, options(nostack));
-    }
-    task
+    let place = per_cpu_place(unsafe { _current_task }, "current_task", &CURRENT_TASK_AT);
+
+    read_per_cpu_word(place) as u64
 }

 #[cfg(target_arch = "x86_64")]
 pub fn top_of_stack() -> usize {
-    let top: usize;
-    unsafe {
-        core::arch::asm!("mov {}, gs:[{}]", out(reg) top, in(reg) _cpu_current_top_of_stack, options(nostack));
+    let place = per_cpu_place(unsafe { _cpu_current_top_of_stack }, "top_of_stack", &TOP_OF_STACK_AT);
+
+    read_per_cpu_word(place)
+}
+
+#[cfg(any(target_arch = "x86", target_arch = "x86_64"))]
+fn per_cpu_place(standalone: usize, hot_member: &str, cache: &AtomicUsize) -> usize {
+    let known = cache.load(Ordering::Relaxed);
+    if known != 0 {
+        return known;
    }
-    top
+
+    let place = if standalone != 0 { standalone } else { hot_per_cpu_place(hot_member).unwrap() };
+    cache.store(place, Ordering::Relaxed);
+
+    place
+}
+
+#[cfg(any(target_arch = "x86", target_arch = "x86_64"))]
+fn hot_per_cpu_place(member: &str) -> Option<usize> {
+    let hot = unsafe { _pcpu_hot };
+    if hot == 0 {
+        return None;
+    }
+
+    Some(hot + super::layout::field_offset("pcpu_hot", member)?)
+}
+
+#[cfg(target_arch = "x86_64")]
+fn read_per_cpu_word(place: usize) -> usize {
+    let value: usize;
+    unsafe { core::arch::asm!("mov {}, gs:[{}]", out(reg) value, in(reg) place, options(nostack, readonly)) };
+
+    value
 }

 #[cfg(target_arch = "x86")]
-pub fn current_task() -> u64 {
-    let task: u32;
-    unsafe {
-        core::arch::asm!("mov {}, fs:[{}]", out(reg) task, in(reg) _current_task as u32, options(nostack));
-    }
-    task as u64
+fn read_per_cpu_word(place: usize) -> usize {
+    let value: usize;
+    unsafe { core::arch::asm!("mov {}, fs:[{}]", out(reg) value, in(reg) place, options(nostack, readonly)) };
+
+    value
 }

+#[cfg(any(target_arch = "x86", target_arch = "x86_64"))]
+static CURRENT_TASK_AT: AtomicUsize = AtomicUsize::new(0);
+#[cfg(target_arch = "x86_64")]
+static TOP_OF_STACK_AT: AtomicUsize = AtomicUsize::new(0);
+
 pub fn get_kernel_base() -> u64 {
    KERNEL_BASE.load(Ordering::Relaxed)
 }
@@ -814,22 +1165,38 @@ const KERNEL_PROCESS: u32 = 0;
 const JS_SAFE_THREAD_ID_MASK: u64 = (1 << 48) - 1;

 const GFP_KERNEL: u32 = 0xcc0;
+const GFP_ATOMIC: u32 = 0x820;
 const NUMA_NO_NODE: c_int = -1;
-const EXECMEM_MODULE_TEXT: u32 = 1;
+const EXECMEM_MODULE_TEXT: u32 = 0;
 const PAGE_SIZE: usize = 4096;
 #[cfg(target_arch = "aarch64")]
 const TCR_T1SZ_SHIFT: u64 = 16;
 #[cfg(target_arch = "aarch64")]
 const TCR_T1SZ_MASK: u64 = 0x3f;
-const TASK_INTERRUPTIBLE: c_uint = 1;
+const TASK_IDLE: c_uint = 0x402;
 const TASK_NORMAL: c_uint = 3;
 const WAKE_EVERY_WAITER: c_int = 0;
 const WAKE_SLACK_NS: u64 = 50_000;
+#[cfg(target_arch = "aarch64")]
+const SPIN_LOCKED: i32 = 1;
+#[cfg(target_arch = "aarch64")]
+const READER_BIAS: i32 = 1 << 9;
+#[cfg(target_arch = "aarch64")]
+const WRITER_LOCKED: i32 = 0xff;
+#[cfg(target_arch = "aarch64")]
+const WRITER_MASK: i32 = 0x1ff;
+#[cfg(target_arch = "aarch64")]
+const DAIF_IRQ_MASKED: usize = 1 << 7;
+#[cfg(target_arch = "x86_64")]
+const PREEMPT_NEED_RESCHED: u32 = 1 << 31;
+#[cfg(target_arch = "x86_64")]
+const RFLAGS_IF: usize = 1 << 9;
 const HRTIMER_MODE_REL: c_int = 1;
 const WAIT_ENTRY_WORDS: usize = 8;
 const WAIT_ENTRY_THREAD: usize = 1;
 const WAIT_ENTRY_WAKE: usize = 2;
 const WAIT_ENTRY_QUEUED: usize = 3;
+const WAIT_ENTRY_TOKEN: usize = WAIT_ENTRY_WORDS - 1;
 const WAIT_QUEUE_WORDS: usize = 16;
 const LOCK_KEY_WORDS: usize = 8;
 #[cfg(target_arch = "aarch64")]
@@ -864,7 +1231,33 @@ struct Timespec64 {
    tv_nsec: i64,
 }

-type KthreadFn = unsafe extern "C" fn(data: *mut c_void) -> c_int;
+pub(crate) type KthreadFn = unsafe extern "C" fn(data: *mut c_void) -> c_int;
+
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+unsafe extern "C" {
+    static __raw_spin_lock: Option<unsafe extern "C" fn(*mut c_void)>;
+    static __raw_spin_unlock: Option<unsafe extern "C" fn(*mut c_void)>;
+}
+
+#[cfg(target_arch = "aarch64")]
+unsafe extern "C" {
+    static _queued_spin_lock_slowpath: unsafe extern "C" fn(*mut c_void, u32);
+    static _queued_read_lock_slowpath: unsafe extern "C" fn(*mut c_void);
+    static _queued_write_lock_slowpath: unsafe extern "C" fn(*mut c_void);
+}
+
+unsafe extern "C" {
+    static _frida_kmod_exit_worker: usize;
+    #[cfg(target_arch = "x86")]
+    #[link_name = "frida_k_frida_kmod_exit_worker"]
+    fn frida_kmod_exit_worker() -> !;
+}
+
+#[cfg(not(target_arch = "x86"))]
+unsafe fn frida_kmod_exit_worker() -> ! {
+    let exit: unsafe extern "C" fn() -> ! = unsafe { core::mem::transmute(_frida_kmod_exit_worker) };
+    unsafe { exit() }
+}
 type IrqHandlerFn = unsafe extern "C" fn(irq: c_int, cookie: *mut c_void) -> c_int;

 unsafe extern "C" {
@@ -900,6 +1293,14 @@ unsafe extern "C" {
    static _vmalloc: Option<unsafe extern "C" fn(usize) -> *mut u8>;
    // Executable memory moved out of the module loader in 6.12.
    static _execmem_alloc: Option<unsafe extern "C" fn(u32, usize) -> *mut u8>;
+    #[cfg(not(target_arch = "x86"))]
+    static _execmem_alloc_rw: Option<unsafe extern "C" fn(u32, usize) -> *mut u8>;
+    #[cfg(not(target_arch = "x86"))]
+    static _vmalloc_noprof: Option<unsafe extern "C" fn(usize) -> *mut u8>;
+    #[cfg(not(target_arch = "x86"))]
+    static _frida_kmod_remap_writable: Option<unsafe extern "C" fn(u64, u32) -> *mut c_void>;
+    #[cfg(not(target_arch = "x86"))]
+    static _frida_kmod_unmap_writable: Option<unsafe extern "C" fn(*mut c_void) -> bool>;
    static _set_memory_rw: Option<unsafe extern "C" fn(usize, c_int) -> c_int>;
    static _set_memory_ro: Option<unsafe extern "C" fn(usize, c_int) -> c_int>;
    static _set_memory_x: Option<unsafe extern "C" fn(usize, c_int) -> c_int>;
@@ -971,6 +1372,10 @@ unsafe extern "C" {
    static _current_task: usize;
    #[cfg(target_arch = "x86_64")]
    static _cpu_current_top_of_stack: usize;
+    #[cfg(target_arch = "x86_64")]
+    static ___preempt_count: usize;
+    #[cfg(any(target_arch = "x86", target_arch = "x86_64"))]
+    static _pcpu_hot: usize;
    #[cfg(target_arch = "arm")]
    static ___pv_offset: *const u64;
    #[cfg(target_arch = "arm")]
@@ -0,0 +1,99 @@
+use core::ffi::{c_int, c_void};
+
+use super::processes::HeldTask;
+
+pub fn allocate(id: u32, size: usize, protection: usize) -> usize {
+    let Some(mm) = BorrowedMemory::of(id) else {
+        return 0;
+    };
+
+    let address = unsafe { _vm_mmap(core::ptr::null_mut(), 0, size, protection, MAP_PRIVATE | MAP_ANONYMOUS, 0) };
+    drop(mm);
+
+    if address >= FIRST_ERROR_ADDRESS { 0 } else { address }
+}
+
+pub fn release(id: u32, address: usize, size: usize) -> c_int {
+    let Some(mm) = BorrowedMemory::of(id) else {
+        return -ESRCH;
+    };
+
+    let result = unsafe { _vm_munmap(address, size) };
+    drop(mm);
+
+    result
+}
+
+pub fn write(id: u32, address: usize, data: &[u8]) -> usize {
+    transfer(id, address, data.as_ptr() as *mut c_void, data.len(), FOLL_WRITE)
+}
+
+pub fn read(id: u32, address: usize, buffer: &mut [u8]) -> usize {
+    transfer(id, address, buffer.as_mut_ptr() as *mut c_void, buffer.len(), 0)
+}
+
+pub fn read_own(address: usize, buffer: &mut [u8]) -> bool {
+    let len = buffer.len();
+    transfer_with(super::native::current_task() as usize, address, buffer.as_mut_ptr() as *mut c_void,
+        len, 0) == len
+}
+
+pub fn write_own(address: usize, data: &[u8]) -> bool {
+    transfer_with(super::native::current_task() as usize, address, data.as_ptr() as *mut c_void,
+        data.len(), FOLL_WRITE) == data.len()
+}
+
+fn transfer(id: u32, address: usize, buffer: *mut c_void, size: usize, flags: u32) -> usize {
+    let Some(task) = HeldTask::with_id(id) else {
+        return 0;
+    };
+
+    transfer_with(task.address(), address, buffer, size, flags)
+}
+
+fn transfer_with(task: usize, address: usize, buffer: *mut c_void, size: usize, flags: u32) -> usize {
+    let transferred = unsafe { _access_process_vm(task as *mut c_void, address, buffer, size as c_int, flags) };
+
+    transferred.max(0) as usize
+}
+
+struct BorrowedMemory(*mut c_void);
+
+impl BorrowedMemory {
+    fn of(id: u32) -> Option<Self> {
+        let task = HeldTask::with_id(id)?;
+        let mm = unsafe { _get_task_mm(task.address() as *mut c_void) };
+        if mm.is_null() {
+            return None;
+        }
+
+        unsafe { _kthread_use_mm(mm) };
+
+        Some(Self(mm))
+    }
+}
+
+impl Drop for BorrowedMemory {
+    fn drop(&mut self) {
+        unsafe {
+            _kthread_unuse_mm(self.0);
+            _mmput(self.0);
+        }
+    }
+}
+
+const MAP_PRIVATE: usize = 0x02;
+const MAP_ANONYMOUS: usize = 0x20;
+const FOLL_WRITE: u32 = 0x01;
+const FIRST_ERROR_ADDRESS: usize = usize::MAX - 4095;
+const ESRCH: c_int = 3;
+
+unsafe extern "C" {
+    static _get_task_mm: unsafe extern "C" fn(*mut c_void) -> *mut c_void;
+    static _mmput: unsafe extern "C" fn(*mut c_void);
+    static _kthread_use_mm: unsafe extern "C" fn(*mut c_void);
+    static _kthread_unuse_mm: unsafe extern "C" fn(*mut c_void);
+    static _vm_mmap: unsafe extern "C" fn(*mut c_void, usize, usize, usize, usize, usize) -> usize;
+    static _vm_munmap: unsafe extern "C" fn(usize, usize) -> c_int;
+    static _access_process_vm: unsafe extern "C" fn(*mut c_void, usize, *mut c_void, c_int, u32) -> c_int;
+}
@@ -72,6 +72,53 @@ pub unsafe fn let_go_of(file: *mut c_void) {
    unsafe { _fput(file) };
 }

+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+pub(crate) struct HeldTask(usize);
+
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+impl HeldTask {
+    pub(crate) fn with_id(id: u32) -> Option<Self> {
+        let task = unsafe { _find_get_task_by_vpid(id as c_int) } as usize;
+        (task != 0).then(|| Self(task))
+    }
+
+    pub(crate) fn leader(&self) -> Option<Self> {
+        let group_leader = super::layout::field_offset("task_struct", "group_leader")?;
+        let usage = super::layout::field_offset("task_struct", "usage")?;
+
+        let flags = lock_tasklist();
+        let leader = unsafe { ((self.0 + group_leader) as *const usize).read() };
+        super::native::hold(leader + usage);
+        unlock_tasklist(flags);
+
+        Some(Self(leader))
+    }
+
+    pub(crate) fn address(&self) -> usize {
+        self.0
+    }
+
+    pub(crate) fn into_address(self) -> usize {
+        let task = self.0;
+        core::mem::forget(self);
+        task
+    }
+
+    pub(crate) unsafe fn from_address(task: usize) -> Self {
+        Self(task)
+    }
+}
+
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+impl Drop for HeldTask {
+    fn drop(&mut self) {
+        let usage = super::layout::field_offset("task_struct", "usage").unwrap();
+        if super::native::let_go(self.0 + usage) {
+            unsafe { ___put_task_struct(self.0 as *mut c_void) };
+        }
+    }
+}
+
 pub fn task_with_id(id: u32) -> Option<usize> {
    let layout = task_layout()?;

@@ -573,12 +620,16 @@ fn lock_tasklist() -> usize {
 #[cfg(not(target_arch = "x86"))]
 fn lock_tasklist() -> usize {
    unsafe {
-        match (__raw_read_lock_irqsave, __raw_read_unlock_irqrestore) {
-            (Some(lock), Some(_)) => lock(_tasklist_lock),
-            _ => {
-                __raw_read_lock.unwrap()(_tasklist_lock);
+        match (__raw_read_lock_irqsave, __raw_read_unlock_irqrestore, __raw_read_lock) {
+            (Some(lock), Some(_), _) => lock(_tasklist_lock),
+            (_, _, Some(lock)) => {
+                lock(_tasklist_lock);
                0
            }
+            #[cfg(target_arch = "aarch64")]
+            _ => super::native::read_lock_irqsave(_tasklist_lock as usize),
+            #[cfg(not(target_arch = "aarch64"))]
+            _ => panic!("no way to lock the task list"),
        }
    }
 }
@@ -591,9 +642,13 @@ fn unlock_tasklist(flags: usize) {
 #[cfg(not(target_arch = "x86"))]
 fn unlock_tasklist(flags: usize) {
    unsafe {
-        match (__raw_read_lock_irqsave, __raw_read_unlock_irqrestore) {
-            (Some(_), Some(unlock)) => unlock(_tasklist_lock, flags),
-            _ => __raw_read_unlock.unwrap()(_tasklist_lock),
+        match (__raw_read_lock_irqsave, __raw_read_unlock_irqrestore, __raw_read_unlock) {
+            (Some(_), Some(unlock), _) => unlock(_tasklist_lock, flags),
+            (_, _, Some(unlock)) => unlock(_tasklist_lock),
+            #[cfg(target_arch = "aarch64")]
+            _ => super::native::read_unlock_irqrestore(_tasklist_lock as usize, flags),
+            #[cfg(not(target_arch = "aarch64"))]
+            _ => panic!("no way to unlock the task list"),
        }
    }
 }
@@ -602,10 +657,6 @@ const PIDTYPE_TGID: c_int = 1;
 const PIDTYPE_MAX: usize = 4;

 pub fn cloak_task(task: *mut c_void) {
-    // detach_pid's arity differs across kernels (the classic detach_pid(task, type)
-    // versus the batched detach_pid(pids, task, type) paired with free_pids); calling
-    // the wrong one drives a UBSAN/CFI trap on hardened kernels. Leave the thread
-    // visible rather than risk it.
    if true {
        let _ = task;
        return;
@@ -638,8 +689,17 @@ unsafe fn detach_pid(pids: *mut *mut c_void, task: *mut c_void, kind: c_int) {
 }

 #[cfg(not(target_arch = "x86"))]
-unsafe fn detach_pid(pids: *mut *mut c_void, task: *mut c_void, kind: c_int) {
-    unsafe { _detach_pid(pids, task, kind) };
+pub(crate) unsafe fn detach_pid(pids: *mut *mut c_void, task: *mut c_void, kind: c_int) {
+    type ReleasingDetachPid = unsafe extern "C" fn(*mut c_void, c_int);
+
+    unsafe {
+        if _free_pids.is_some() {
+            _detach_pid(pids, task, kind);
+        } else {
+            let releasing: ReleasingDetachPid = core::mem::transmute(_detach_pid);
+            releasing(task, kind);
+        }
+    }
 }

 #[cfg(target_arch = "x86")]
@@ -648,11 +708,13 @@ unsafe fn free_pids(pids: *mut *mut c_void) {
 }

 #[cfg(not(target_arch = "x86"))]
-unsafe fn free_pids(pids: *mut *mut c_void) {
-    unsafe { _free_pids(pids) };
+pub(crate) unsafe fn free_pids(pids: *mut *mut c_void) {
+    if let Some(free) = unsafe { _free_pids } {
+        unsafe { free(pids) };
+    }
 }

-unsafe fn unlink(node: usize) {
+pub(crate) unsafe fn unlink(node: usize) {
    let next = unsafe { (node as *const usize).read() };
    let prev = unsafe { ((node + WORD_SIZE) as *const usize).read() };
    unsafe {
@@ -664,34 +726,64 @@ unsafe fn unlink(node: usize) {
 }

 #[cfg(target_arch = "x86")]
-fn write_lock_tasklist() -> usize {
+pub(crate) fn write_lock_tasklist() -> usize {
    unsafe { frida_k_write_lock_tasklist() }
 }

-#[cfg(not(target_arch = "x86"))]
-fn write_lock_tasklist() -> usize {
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+pub(crate) unsafe fn unlink_for_readers(node: usize) {
+    let next = unsafe { (node as *const usize).read() };
+    let prev = unsafe { ((node + WORD_SIZE) as *const usize).read() };
    unsafe {
-        match (__raw_write_lock_irqsave, __raw_write_unlock_irqrestore) {
-            (Some(lock), Some(_)) => lock(_tasklist_lock),
-            _ => {
-                __raw_write_lock.unwrap()(_tasklist_lock);
+        ((next + WORD_SIZE) as *mut usize).write(prev);
+        (prev as *mut usize).write(next);
+    }
+}
+
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+pub(crate) unsafe fn append_for_readers(node: usize, head: usize) {
+    let prev = unsafe { ((head + WORD_SIZE) as *const usize).read() };
+    unsafe {
+        (node as *mut usize).write(head);
+        ((node + WORD_SIZE) as *mut usize).write(prev);
+        core::sync::atomic::AtomicUsize::from_ptr(prev as *mut usize)
+            .store(node, core::sync::atomic::Ordering::Release);
+        ((head + WORD_SIZE) as *mut usize).write(node);
+    }
+}
+
+#[cfg(not(target_arch = "x86"))]
+pub(crate) fn write_lock_tasklist() -> usize {
+    unsafe {
+        match (__raw_write_lock_irqsave, __raw_write_unlock_irqrestore, __raw_write_lock) {
+            (Some(lock), Some(_), _) => lock(_tasklist_lock),
+            (_, _, Some(lock)) => {
+                lock(_tasklist_lock);
                0
            }
+            #[cfg(target_arch = "aarch64")]
+            _ => super::native::write_lock_irqsave(_tasklist_lock as usize),
+            #[cfg(not(target_arch = "aarch64"))]
+            _ => panic!("no way to lock the task list"),
        }
    }
 }

 #[cfg(target_arch = "x86")]
-fn write_unlock_tasklist(flags: usize) {
+pub(crate) fn write_unlock_tasklist(flags: usize) {
    unsafe { frida_k_write_unlock_tasklist(flags) };
 }

 #[cfg(not(target_arch = "x86"))]
-fn write_unlock_tasklist(flags: usize) {
+pub(crate) fn write_unlock_tasklist(flags: usize) {
    unsafe {
-        match (__raw_write_lock_irqsave, __raw_write_unlock_irqrestore) {
-            (Some(_), Some(unlock)) => unlock(_tasklist_lock, flags),
-            _ => __raw_write_unlock.unwrap()(_tasklist_lock),
+        match (__raw_write_lock_irqsave, __raw_write_unlock_irqrestore, __raw_write_unlock) {
+            (Some(_), Some(unlock), _) => unlock(_tasklist_lock, flags),
+            (_, _, Some(unlock)) => unlock(_tasklist_lock),
+            #[cfg(target_arch = "aarch64")]
+            _ => super::native::write_unlock_irqrestore(_tasklist_lock as usize, flags),
+            #[cfg(not(target_arch = "aarch64"))]
+            _ => panic!("no way to unlock the task list"),
        }
    }
 }
@@ -728,7 +820,11 @@ unsafe extern "C" {
    #[cfg(not(target_arch = "x86"))]
    static _detach_pid: unsafe extern "C" fn(*mut *mut c_void, *mut c_void, c_int);
    #[cfg(not(target_arch = "x86"))]
-    static _free_pids: unsafe extern "C" fn(*mut *mut c_void);
+    static _free_pids: Option<unsafe extern "C" fn(*mut *mut c_void)>;
+    #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+    static _find_get_task_by_vpid: unsafe extern "C" fn(c_int) -> *mut c_void;
+    #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+    static ___put_task_struct: unsafe extern "C" fn(*mut c_void);
    #[cfg(not(target_arch = "x86"))]
    static __raw_write_lock: Option<unsafe extern "C" fn(*mut c_void)>;
    #[cfg(not(target_arch = "x86"))]
@@ -625,6 +625,24 @@ int frida_k_unregister_module_notifier (void * a0)
  return ((fn_t) _unregister_module_notifier) (a0);
 }

+extern void * _mutex_lock;
+
+void frida_k_mutex_lock (void * a0)
+{
+  typedef void (__attribute__ ((regparm (3))) * fn_t) (void *);
+
+  ((fn_t) _mutex_lock) (a0);
+}
+
+extern void * _mutex_unlock;
+
+void frida_k_mutex_unlock (void * a0)
+{
+  typedef void (__attribute__ ((regparm (3))) * fn_t) (void *);
+
+  ((fn_t) _mutex_unlock) (a0);
+}
+
 extern int frida_cb_module_state (void * nb, unsigned long action, void * data);

 __attribute__ ((regparm (3))) int
@@ -658,3 +676,57 @@ frida_kcb_die (void * nb, unsigned long action, void * data)
 {
  return frida_cb_die (nb, action, data);
 }
+
+extern void * _frida_kmod_link_open;
+
+int frida_k_frida_kmod_link_open (void)
+{
+  typedef int (__attribute__ ((regparm (3))) * fn_t) (void);
+
+  return ((fn_t) _frida_kmod_link_open) ();
+}
+
+extern void * _frida_kmod_link_close;
+
+void frida_k_frida_kmod_link_close (void)
+{
+  typedef void (__attribute__ ((regparm (3))) * fn_t) (void);
+
+  ((fn_t) _frida_kmod_link_close) ();
+}
+
+extern void * _frida_kmod_link_send;
+
+int frida_k_frida_kmod_link_send (const void * data, unsigned long size)
+{
+  typedef int (__attribute__ ((regparm (3))) * fn_t) (const void *, unsigned long);
+
+  return ((fn_t) _frida_kmod_link_send) (data, size);
+}
+
+extern void * _frida_kmod_link_recv;
+
+long frida_k_frida_kmod_link_recv (void * data, unsigned long size)
+{
+  typedef long (__attribute__ ((regparm (3))) * fn_t) (void *, unsigned long);
+
+  return ((fn_t) _frida_kmod_link_recv) (data, size);
+}
+
+extern void * _frida_kmod_link_pending;
+
+_Bool frida_k_frida_kmod_link_pending (void)
+{
+  typedef _Bool (__attribute__ ((regparm (3))) * fn_t) (void);
+
+  return ((fn_t) _frida_kmod_link_pending) ();
+}
+
+extern void * _frida_kmod_exit_worker;
+
+void frida_k_frida_kmod_exit_worker (void)
+{
+  typedef void (__attribute__ ((regparm (3))) * fn_t) (void);
+
+  ((fn_t) _frida_kmod_exit_worker) ();
+}
@@ -125,7 +125,6 @@ fn leave() -> ! {
        syscall(CLOSE, descriptor as usize, 0, 0, 0, 0, 0);
    }

-    Arena::at(unsafe { ARENA }).gone();
    syscall(EXIT_GROUP, 0, 0, 0, 0, 0, 0);

    loop {}
@@ -0,0 +1,419 @@
+use core::ffi::{c_int, c_void};
+use core::mem::size_of;
+use core::ptr;
+use core::sync::atomic::{AtomicUsize, Ordering};
+
+use super::layout::field_offset;
+use super::native::{self, hold, let_go, lock_spinlock, unlock_spinlock};
+use super::processes::{
+    HeldTask, append_for_readers, detach_pid, free_pids, unlink, unlink_for_readers,
+    write_lock_tasklist, write_unlock_tasklist,
+};
+
+pub fn start_in_process(id: u32, entry: usize, stack: usize, argument: usize, tls: usize) -> c_int {
+    let Some(layout) = describe_thread_group() else {
+        return -ENOSYS;
+    };
+    let Some(task) = HeldTask::with_id(id) else {
+        return -ESRCH;
+    };
+    let Some(leader) = task.leader() else {
+        return -ESRCH;
+    };
+    let mm = unsafe { _get_task_mm(task.address() as *mut c_void) };
+    if mm.is_null() {
+        return -ESRCH;
+    }
+
+    let birth = native::alloc(size_of::<Birth>()) as *mut Birth;
+    unsafe {
+        birth.write(Birth { entry, stack, argument, tls, leader: leader.into_address(), layout });
+
+        _kthread_use_mm(mm);
+        let started = _user_mode_thread(thread_entry(), birth as *mut c_void, 0);
+        _kthread_unuse_mm(mm);
+        _mmput(mm);
+
+        if started < 0 {
+            drop(HeldTask::from_address((*birth).leader));
+            native::free(birth as *mut u8, size_of::<Birth>());
+        }
+
+        started
+    }
+}
+
+struct Birth {
+    entry: usize,
+    stack: usize,
+    argument: usize,
+    tls: usize,
+    leader: usize,
+    layout: ThreadGroupLayout,
+}
+
+fn thread_entry() -> native::KthreadFn {
+    native::kernel_thread_function(&THREAD_ENTRY, frida_cb_user_thread)
+}
+
+static THREAD_ENTRY: AtomicUsize = AtomicUsize::new(0);
+
+unsafe extern "C" fn frida_cb_user_thread(argument: *mut c_void) -> c_int {
+    let birth = unsafe { (argument as *const Birth).read() };
+    native::free(argument as *mut u8, size_of::<Birth>());
+
+    let leader = unsafe { HeldTask::from_address(birth.leader) };
+    let child = native::current_task() as usize;
+    join_thread_group(child, leader.address(), &birth.layout);
+    adopt_context_of(child, leader.address(), &birth.layout);
+    drop(leader);
+
+    super::injection::hand_userland_to(birth.entry, birth.stack, birth.argument);
+    use_thread_pointer(child, birth.tls, &birth.layout);
+
+    0
+}
+
+fn join_thread_group(child: usize, leader: usize, layout: &ThreadGroupLayout) {
+    let task = &layout.task;
+    let old_signal = read_word(child + task.signal);
+    let old_sighand = read_word(child + task.sighand);
+    let signal = read_word(leader + task.signal);
+    let sighand = read_word(leader + task.sighand);
+    let mut freed = [ptr::null_mut::<c_void>(); PIDTYPE_MAX];
+
+    let flags = write_lock_tasklist();
+
+    unsafe {
+        detach_pid(freed.as_mut_ptr(), child as *mut c_void, PIDTYPE_SID);
+        detach_pid(freed.as_mut_ptr(), child as *mut c_void, PIDTYPE_PGID);
+        detach_pid(freed.as_mut_ptr(), child as *mut c_void, PIDTYPE_TGID);
+
+        unlink_for_readers(child + task.tasks);
+        unlink(child + task.sibling);
+        unlink_for_readers(child + task.thread_node);
+    }
+
+    let parent = read_word(leader + task.real_parent);
+    write_word(child + task.real_parent, parent);
+    write_word(child + task.parent, parent);
+    write_word(child + task.group_leader, leader);
+    write_i32(child + task.tgid, read_i32(leader + task.tgid));
+    write_i32(child + task.exit_signal, -1);
+    write_word(child + task.signal, signal);
+    write_word(child + task.sighand, sighand);
+
+    hold(sighand + layout.sighand.count);
+
+    lock_spinlock(sighand + layout.sighand.siglock);
+
+    write_i32(signal + layout.signal.nr_threads, read_i32(signal + layout.signal.nr_threads) + 1);
+    if let Some(quick_threads) = layout.signal.quick_threads {
+        write_i32(signal + quick_threads, read_i32(signal + quick_threads) + 1);
+    }
+    hold(signal + layout.signal.live);
+    hold(signal + layout.signal.sigcnt);
+
+    unsafe {
+        (layout.calls.task_join_group_stop)(child as *mut c_void);
+
+        if let Some(thread_group) = task.thread_group {
+            append_for_readers(child + thread_group, leader + thread_group);
+        }
+        append_for_readers(child + task.thread_node, signal + layout.signal.thread_head);
+    }
+
+    unlock_spinlock(sighand + layout.sighand.siglock);
+
+    write_unlock_tasklist(flags);
+
+    unsafe {
+        free_pids(freed.as_mut_ptr());
+
+        (layout.calls.cleanup_sighand)(old_sighand as *mut c_void);
+        if let_go(old_signal + layout.signal.sigcnt) {
+            _kmem_cache_free(*_signal_cachep, old_signal as *mut c_void);
+        }
+    }
+}
+
+fn adopt_context_of(child: usize, leader: usize, layout: &ThreadGroupLayout) {
+    let task = &layout.task;
+
+    let files = read_word(leader + task.files);
+    let old_files = read_word(child + task.files);
+    hold(files + layout.files_count);
+    lock_spinlock(child + task.alloc_lock);
+    write_word(child + task.files, files);
+    unlock_spinlock(child + task.alloc_lock);
+    unsafe { (layout.calls.put_files_struct)(old_files as *mut c_void) };
+
+    let fs = read_word(leader + task.fs);
+    let old_fs = read_word(child + task.fs);
+    lock_spinlock(fs + layout.fs.lock);
+    write_i32(fs + layout.fs.users, read_i32(fs + layout.fs.users) + 1);
+    unlock_spinlock(fs + layout.fs.lock);
+    lock_spinlock(child + task.alloc_lock);
+    write_word(child + task.fs, fs);
+    unlock_spinlock(child + task.alloc_lock);
+    lock_spinlock(old_fs + layout.fs.lock);
+    let users_left = read_i32(old_fs + layout.fs.users) - 1;
+    write_i32(old_fs + layout.fs.users, users_left);
+    unlock_spinlock(old_fs + layout.fs.lock);
+    if users_left == 0 {
+        unsafe { (layout.calls.free_fs_struct)(old_fs as *mut c_void) };
+    }
+
+    let real_cred = read_word(leader + task.real_cred);
+    let cred = read_word(leader + task.cred);
+    let old_real_cred = read_word(child + task.real_cred);
+    let old_cred = read_word(child + task.cred);
+    hold(real_cred + layout.cred_usage);
+    write_word(child + task.real_cred, real_cred);
+    hold(cred + layout.cred_usage);
+    unsafe { AtomicUsize::from_ptr((child + task.cred) as *mut usize).store(cred, Ordering::Release) };
+    release_cred(old_cred, layout);
+    release_cred(old_real_cred, layout);
+
+    let namespaces = read_word(leader + task.nsproxy);
+    hold(namespaces + layout.nsproxy_count);
+    unsafe { (layout.calls.switch_task_namespaces)(child as *mut c_void, namespaces as *mut c_void) };
+
+    if let Some(undo) = &layout.semaphore_undo {
+        let undo_list = read_word(leader + undo.list);
+        if undo_list != 0 {
+            hold(undo_list + undo.refcnt);
+            write_word(child + undo.list, undo_list);
+        }
+    }
+
+    #[cfg(target_arch = "aarch64")]
+    if let Some(lengths) = &layout.vector_lengths {
+        adopt_vector_lengths(child, leader, lengths);
+    }
+}
+
+fn release_cred(cred: usize, layout: &ThreadGroupLayout) {
+    if let_go(cred + layout.cred_usage) {
+        unsafe { (layout.calls.put_cred)(cred as *mut c_void) };
+    }
+}
+
+#[cfg(target_arch = "aarch64")]
+fn adopt_vector_lengths(child: usize, leader: usize, lengths: &VectorLengthLayout) {
+    for array in [lengths.current, lengths.on_exec] {
+        for kind in 0..VECTOR_KINDS {
+            let at = array + kind * size_of::<u32>();
+            write_i32(child + at, read_i32(leader + at));
+        }
+    }
+}
+
+#[cfg(target_arch = "x86_64")]
+fn use_thread_pointer(child: usize, tls: usize, layout: &ThreadGroupLayout) {
+    const MSR_FS_BASE: u32 = 0xc000_0100;
+
+    write_word(child + layout.task.thread_pointer, tls);
+    unsafe {
+        core::arch::asm!("wrmsr", in("ecx") MSR_FS_BASE, in("eax") tls as u32,
+            in("edx") (tls >> 32) as u32, options(nostack));
+    }
+}
+
+#[cfg(target_arch = "aarch64")]
+fn use_thread_pointer(child: usize, tls: usize, layout: &ThreadGroupLayout) {
+    write_word(child + layout.task.thread_pointer, tls);
+    unsafe { core::arch::asm!("msr tpidr_el0, {}", in(reg) tls, options(nostack)) };
+}
+
+struct ThreadGroupLayout {
+    calls: ThreadGroupCalls,
+    task: TaskLayout,
+    signal: SignalLayout,
+    sighand: SighandLayout,
+    fs: FsLayout,
+    files_count: usize,
+    cred_usage: usize,
+    nsproxy_count: usize,
+    semaphore_undo: Option<SemaphoreUndoLayout>,
+    #[cfg(target_arch = "aarch64")]
+    vector_lengths: Option<VectorLengthLayout>,
+}
+
+struct ThreadGroupCalls {
+    task_join_group_stop: unsafe extern "C" fn(*mut c_void),
+    cleanup_sighand: unsafe extern "C" fn(*mut c_void),
+    put_files_struct: unsafe extern "C" fn(*mut c_void),
+    free_fs_struct: unsafe extern "C" fn(*mut c_void),
+    put_cred: unsafe extern "C" fn(*mut c_void),
+    switch_task_namespaces: unsafe extern "C" fn(*mut c_void, *mut c_void),
+}
+
+struct TaskLayout {
+    tgid: usize,
+    real_parent: usize,
+    parent: usize,
+    group_leader: usize,
+    exit_signal: usize,
+    signal: usize,
+    sighand: usize,
+    tasks: usize,
+    sibling: usize,
+    thread_node: usize,
+    thread_group: Option<usize>,
+    files: usize,
+    fs: usize,
+    cred: usize,
+    real_cred: usize,
+    nsproxy: usize,
+    alloc_lock: usize,
+    thread_pointer: usize,
+}
+
+struct SignalLayout {
+    nr_threads: usize,
+    quick_threads: Option<usize>,
+    live: usize,
+    sigcnt: usize,
+    thread_head: usize,
+}
+
+struct SighandLayout {
+    count: usize,
+    siglock: usize,
+}
+
+struct FsLayout {
+    users: usize,
+    lock: usize,
+}
+
+struct SemaphoreUndoLayout {
+    list: usize,
+    refcnt: usize,
+}
+
+#[cfg(target_arch = "aarch64")]
+struct VectorLengthLayout {
+    current: usize,
+    on_exec: usize,
+}
+
+fn describe_thread_group() -> Option<ThreadGroupLayout> {
+    Some(ThreadGroupLayout {
+        calls: unsafe {
+            ThreadGroupCalls {
+                task_join_group_stop: _task_join_group_stop?,
+                cleanup_sighand: ___cleanup_sighand?,
+                put_files_struct: _put_files_struct?,
+                free_fs_struct: _free_fs_struct?,
+                put_cred: ___put_cred?,
+                switch_task_namespaces: _switch_task_namespaces?,
+            }
+        },
+        task: TaskLayout {
+            tgid: field_offset("task_struct", "tgid")?,
+            real_parent: field_offset("task_struct", "real_parent")?,
+            parent: field_offset("task_struct", "parent")?,
+            group_leader: field_offset("task_struct", "group_leader")?,
+            exit_signal: field_offset("task_struct", "exit_signal")?,
+            signal: field_offset("task_struct", "signal")?,
+            sighand: field_offset("task_struct", "sighand")?,
+            tasks: field_offset("task_struct", "tasks")?,
+            sibling: field_offset("task_struct", "sibling")?,
+            thread_node: field_offset("task_struct", "thread_node")?,
+            thread_group: field_offset("task_struct", "thread_group"),
+            files: field_offset("task_struct", "files")?,
+            fs: field_offset("task_struct", "fs")?,
+            cred: field_offset("task_struct", "cred")?,
+            real_cred: field_offset("task_struct", "real_cred")?,
+            nsproxy: field_offset("task_struct", "nsproxy")?,
+            alloc_lock: field_offset("task_struct", "alloc_lock")?,
+            thread_pointer: field_offset("task_struct", THREAD_POINTER_FIELD)?,
+        },
+        signal: SignalLayout {
+            nr_threads: field_offset("signal_struct", "nr_threads")?,
+            quick_threads: field_offset("signal_struct", "quick_threads"),
+            live: field_offset("signal_struct", "live")?,
+            sigcnt: field_offset("signal_struct", "sigcnt")?,
+            thread_head: field_offset("signal_struct", "thread_head")?,
+        },
+        sighand: SighandLayout {
+            count: field_offset("sighand_struct", "count")?,
+            siglock: field_offset("sighand_struct", "siglock")?,
+        },
+        fs: FsLayout {
+            users: field_offset("fs_struct", "users")?,
+            lock: field_offset("fs_struct", "lock").or_else(|| field_offset("fs_struct", "seq.lock"))?,
+        },
+        files_count: field_offset("files_struct", "count")?,
+        cred_usage: field_offset("cred", "usage")?,
+        nsproxy_count: field_offset("nsproxy", "count")?,
+        semaphore_undo: describe_semaphore_undo(),
+        #[cfg(target_arch = "aarch64")]
+        vector_lengths: describe_vector_lengths(),
+    })
+}
+
+fn describe_semaphore_undo() -> Option<SemaphoreUndoLayout> {
+    Some(SemaphoreUndoLayout {
+        list: field_offset("task_struct", "sysvsem.undo_list")?,
+        refcnt: field_offset("sem_undo_list", "refcnt")?,
+    })
+}
+
+#[cfg(target_arch = "aarch64")]
+fn describe_vector_lengths() -> Option<VectorLengthLayout> {
+    Some(VectorLengthLayout {
+        current: field_offset("task_struct", "thread.vl")?,
+        on_exec: field_offset("task_struct", "thread.vl_onexec")?,
+    })
+}
+
+#[cfg(target_arch = "x86_64")]
+const THREAD_POINTER_FIELD: &str = "thread.fsbase";
+#[cfg(target_arch = "aarch64")]
+const THREAD_POINTER_FIELD: &str = "thread.uw.tp_value";
+
+#[cfg(target_arch = "aarch64")]
+const VECTOR_KINDS: usize = 2;
+
+fn read_word(address: usize) -> usize {
+    unsafe { (address as *const usize).read() }
+}
+
+fn write_word(address: usize, value: usize) {
+    unsafe { (address as *mut usize).write(value) };
+}
+
+fn read_i32(address: usize) -> i32 {
+    unsafe { (address as *const i32).read() }
+}
+
+fn write_i32(address: usize, value: i32) {
+    unsafe { (address as *mut i32).write(value) };
+}
+
+const PIDTYPE_TGID: c_int = 1;
+const PIDTYPE_PGID: c_int = 2;
+const PIDTYPE_SID: c_int = 3;
+const PIDTYPE_MAX: usize = 4;
+
+const ESRCH: c_int = 3;
+const ENOSYS: c_int = 38;
+
+unsafe extern "C" {
+    static _get_task_mm: unsafe extern "C" fn(*mut c_void) -> *mut c_void;
+    static _mmput: unsafe extern "C" fn(*mut c_void);
+    static _kthread_use_mm: unsafe extern "C" fn(*mut c_void);
+    static _kthread_unuse_mm: unsafe extern "C" fn(*mut c_void);
+    static _user_mode_thread: unsafe extern "C" fn(native::KthreadFn, *mut c_void, usize) -> c_int;
+    static _task_join_group_stop: Option<unsafe extern "C" fn(*mut c_void)>;
+    static ___cleanup_sighand: Option<unsafe extern "C" fn(*mut c_void)>;
+    static _kmem_cache_free: unsafe extern "C" fn(*mut c_void, *mut c_void);
+    static _signal_cachep: *const *mut c_void;
+    static _put_files_struct: Option<unsafe extern "C" fn(*mut c_void)>;
+    static _free_fs_struct: Option<unsafe extern "C" fn(*mut c_void)>;
+    static ___put_cred: Option<unsafe extern "C" fn(*mut c_void)>;
+    static _switch_task_namespaces: Option<unsafe extern "C" fn(*mut c_void, *mut c_void)>;
+}
@@ -2,9 +2,6 @@
 // image and calls its `_start`. All of the agent lives in the library crate;
 // this target exists only to produce that link. build.rs passes `--undefined
 // _start` so the entrypoint survives --gc-sections.
-//
-// The Linux flavour is built as a static library instead and linked into a
-// kernel module by kbuild — see linux/Kbuild.

 #![no_std]
 #![no_main]
@@ -1104,10 +1104,6 @@ namespace Frida {
 			throw new Error.NOT_SUPPORTED ("Services are not supported by this backend");
 		}

-		public async HashTable<string, Variant> dump_backtraces (uint pid, Cancellable? cancellable) throws Error, IOError {
-			throw new Error.NOT_SUPPORTED ("Backtrace dumping is not supported by this backend");
-		}
-
 		private void on_agent_session_closed (BareboneAgentSession session) {
 			AgentSessionId id = session.id;

@@ -1026,10 +1026,6 @@ namespace Frida {
 				return yield parent.open_service (address, this, cancellable);
 			}

-			public async HashTable<string, Variant> dump_backtraces (uint pid, Cancellable? cancellable) throws GLib.Error {
-				return yield parent.host_session.dump_backtraces (pid, cancellable);
-			}
-
 			private async void open_tcp_transport (AgentSessionId id, Cancellable? cancellable, out uint16 port,
 					out string token) throws Error {
 				parent.open_tcp_transport (id, cancellable, out port, out token);
@@ -328,7 +328,6 @@ namespace Frida {
 				task = task_for_pid (pid);
 				resume_process (task);
 			} catch (Error e) {
-			} catch (Efni.Error e) {
 			} finally {
 				if (task != 0)
 					deallocate_port (task);
@@ -341,7 +340,6 @@ namespace Frida {
 				task = task_for_pid (pid);
 				resume_process_fast (task);
 			} catch (Error e) {
-			} catch (Efni.Error e) {
 			} finally {
 				if (task != 0)
 					deallocate_port (task);
@@ -607,8 +605,6 @@ namespace Frida {
 				policy_softener.retain (pid);
 			} catch (Error e) {
 				assert_not_reached ();
-			} catch (Efni.Error e) {
-				assert_not_reached ();
 			}

 			if (mapped_module != null)
@@ -741,8 +737,6 @@ namespace Frida {
 					yield disable_spawn_gating (cancellable);
 				} catch (Error e) {
 					assert_not_reached ();
-				} catch (Efni.Error e) {
-					assert_not_reached ();
 				}
 			}
 		}
@@ -796,15 +796,6 @@ namespace Frida {
 			}
 		}

-		public async HashTable<string, Variant> dump_backtraces (uint pid, Cancellable? cancellable) throws Error, IOError {
-			var server = yield get_remote_server (cancellable);
-			try {
-				return yield server.session.dump_backtraces (pid, cancellable);
-			} catch (GLib.Error e) {
-				throw_dbus_error (e);
-			}
-		}
-
 		public async ServiceSession link_service_session (ServiceSessionId id, Cancellable? cancellable) throws Error, IOError {
 			var server = yield get_remote_server (cancellable);
 			ServiceSession session = yield server.connection.get_proxy (null, ObjectPath.for_service_session (id),
@@ -17,8 +17,6 @@ namespace Frida {
 						_resource_store = new ResourceStore ();
 					} catch (Error e) {
 						assert_not_reached ();
-					} catch (Efni.Error e) {
-						assert_not_reached ();
 					}
 				}
 				return _resource_store;
@@ -1586,52 +1586,6 @@ namespace Frida {
 			}
 		}

-		/**
-		 * Captures the backtraces of all threads in a process, for debugging purposes.
-		 *
-		 * Works out-of-band through the debugger, so it doesn't need any cooperation from the process, nor
-		 * from Frida's own threads in it. The process is briefly suspended while this happens.
-		 *
-		 * Only supported on jailed iOS for now. Once Gadget is injected, the process must have been spawned with
-		 * the `interruptible` option set to `true`, so Gadget keeps a thread around that can stop it in the
-		 * debugger even if all of Frida's threads are blocked.
-		 *
-		 * The result has a `threads` array, where each thread has an `id`, an optional `name`, its general-purpose
-		 * `registers`, and `frames`.
-		 * Each frame has an `address`, plus `module` and `offset` when it is inside a known module, so it can
-		 * be symbolicated offline. Frames inside Gadget are attributed to the local Gadget file that was injected,
-		 * or to `FridaGadget.dylib` if it was already loaded. If a thread couldn't be fully walked it also has an
-		 * `error`.
-		 *
-		 * @param pid the process ID to capture backtraces from
-		 * @return a table with the threads and their backtraces
-		 */
-		public async HashTable<string, Variant> dump_backtraces (uint pid, Cancellable? cancellable = null) throws Error, IOError {
-			check_open ();
-
-			var host_session = yield get_host_session (cancellable);
-
-			try {
-				return yield host_session.dump_backtraces (pid, cancellable);
-			} catch (GLib.Error e) {
-				throw_dbus_error (e);
-			}
-		}
-
-		public HashTable<string, Variant> dump_backtraces_sync (uint pid, Cancellable? cancellable = null) throws Error, IOError {
-			var task = create<DumpBacktracesTask> ();
-			task.pid = pid;
-			return task.execute (cancellable);
-		}
-
-		private class DumpBacktracesTask : DeviceTask<HashTable<string, Variant>> {
-			public uint pid;
-
-			protected override async HashTable<string, Variant> perform_operation () throws Error, IOError {
-				return yield parent.dump_backtraces (pid, cancellable);
-			}
-		}
-
 		/**
 		 * Attaches to a process, giving a {@link Session} through which scripts
 		 * can be created and run inside it.
@@ -947,14 +947,6 @@ namespace Frida {
 					gadget_path = gadget_value.get_string ();
 				}

-				bool interruptible = false;
-				Variant? interruptible_value = aux["interruptible"];
-				if (interruptible_value != null) {
-					if (!interruptible_value.is_of_type (VariantType.BOOLEAN))
-						throw new Error.INVALID_ARGUMENT ("The 'interruptible' option must be a boolean");
-					interruptible = interruptible_value.get_boolean ();
-				}
-
 				string[] argv = { app.path };
 				if (options.has_argv) {
 					var provided_argv = options.argv;
@@ -977,7 +969,6 @@ namespace Frida {
 				}

 				var session = new LLDBSession (lldb, process, gadget_path, ExceptionHandlingStatus.LIMITED, device);
-				session.interruptible = interruptible;
 				add_lldb_session (session);

 				return process.pid;
@@ -1096,32 +1087,6 @@ namespace Frida {
 			}
 		}

-		public async HashTable<string, Variant> dump_backtraces (uint pid, Cancellable? cancellable) throws Error, IOError {
-			try {
-				var lldb_session = lldb_sessions[pid];
-				if (lldb_session != null)
-					return yield lldb_session.dump_backtraces (cancellable);
-
-				var lldb = yield start_lldb_service (cancellable);
-				try {
-					yield lldb.attach_by_pid (pid, cancellable);
-					var backtraces = yield BacktraceCollector.collect (lldb, null, cancellable);
-					yield lldb.detach (cancellable);
-					yield lldb.close (cancellable);
-					return backtraces;
-				} catch (GLib.Error e) {
-					lldb.close.begin (null);
-					throw e;
-				}
-			} catch (GLib.Error e) {
-				if (e is Error)
-					throw (Error) e;
-				if (e is IOError)
-					throw (IOError) e;
-				throw new Error.NOT_SUPPORTED ("%s", e.message);
-			}
-		}
-
 		public async AgentSessionId attach (uint pid, HashTable<string, Variant> options,
 				Cancellable? cancellable) throws Error, IOError {
 			try {
@@ -1702,23 +1667,14 @@ namespace Frida {

 			public uint attach_count = 0;

-			public bool interruptible = false;
-
 			private Promise<Fruity.Injector.GadgetDetails>? gadget_request;
-			private Fruity.Injector.GadgetDetails? gadget;
-			private string? gadget_module_name;
-			private bool early_instrumentation = false;
 			private ulong exception_handler = 0;
 			private string? main_thread_id;
 			private bool resumed = false;

-			private bool dumping_backtraces = false;
-			private Promise<Idun.LLDB.Exception>? pending_interrupt;
-
 			private Cancellable io_cancellable = new Cancellable ();

 			private const size_t PAGE_SIZE = 0x4000;
-			private const uint INTERRUPT_TIMEOUT_SECONDS = 5;

 			public LLDBSession (LLDB.Client lldb, LLDB.Process process, string? gadget_path, ExceptionHandlingStatus ehs,
 					Idun.ChannelProvider channel_provider) {
@@ -1754,51 +1710,48 @@ namespace Frida {
 			private async void handle_exception (DebuggerException exception) throws Error, Efni.Error, IOError {
 				var e = (Idun.LLDB.Exception) exception;

-				if (pending_interrupt != null && !pending_interrupt.future.ready && is_interrupt (e)) {
-					pending_interrupt.resolve (e);
-					return;
-				}
-
-				if (is_gadget_breakpoint (e)) {
+				var sig = (LLDB.Signal) e.signum;
+				var medata = e.medata;
+				if (sig == SIGTRAP && e.metype == EXC_BREAKPOINT && medata.size == 2) {
+					uint64 x1 = e.context["x1"];
+					uint64 x2 = e.context["x2"];
 					var action = (GadgetBreakpointAction) e.context["x3"];
+					if (x1 == x2 == 1337) {
+						uint64 pc = e.context["pc"];
+						var thread = e.thread;
+						yield thread.write_register ("pc", pc + 4, io_cancellable);

-					uint64 pc = e.context["pc"];
-					var thread = e.thread;
-					yield thread.write_register ("pc", pc + 4, io_cancellable);
-
-					switch (action) {
-						case RESUME: {
-							resumed = true;
-							yield lldb.resume (io_cancellable);
-
-							return;
-						}
-						case DETACH: {
-							yield lldb.detach (io_cancellable);
-							detached ();
-
-							break;
-						}
-						case PAGE_PLAN: {
-							var plan_size = (size_t) e.context["x4"];
-							var plan_address = e.context["x5"];
-							yield DebuggerMappings.handle_page_plan (lldb, plan_address, plan_size,
-								PAGE_SIZE, io_cancellable);
-
-							yield thread.write_register ("x0", 0x1337, io_cancellable);
-
-							if (resumed)
+						switch (action) {
+							case RESUME: {
+								resumed = true;
 								yield lldb.resume (io_cancellable);
-							else
-								yield continue_gadget_threads (io_cancellable);

-							return;
+								return;
+							}
+							case DETACH: {
+								yield lldb.detach (io_cancellable);
+								detached ();
+
+								break;
+							}
+							case PAGE_PLAN: {
+								var plan_size = (size_t) e.context["x4"];
+								var plan_address = e.context["x5"];
+								yield DebuggerMappings.handle_page_plan (lldb, plan_address, plan_size,
+									PAGE_SIZE, io_cancellable);
+
+								yield thread.write_register ("x0", 0x1337, io_cancellable);
+
+								if (resumed)
+									yield lldb.resume (io_cancellable);
+								else
+									yield continue_gadget_threads (io_cancellable);
+
+								return;
+							}
+							default:
+								break;
 						}
-						case INTERRUPT:
-							yield restore_execution (io_cancellable);
-							return;
-						default:
-							break;
 					}
 				}

@@ -1807,146 +1760,6 @@ namespace Frida {
 				yield lldb.close (io_cancellable);
 			}

-			private static bool is_gadget_breakpoint (Idun.LLDB.Exception e) {
-				var sig = (LLDB.Signal) e.signum;
-				if (!(sig == SIGTRAP && e.metype == EXC_BREAKPOINT && e.medata.size == 2))
-					return false;
-
-				uint64 x1 = e.context["x1"];
-				uint64 x2 = e.context["x2"];
-				return x1 == x2 == 1337;
-			}
-
-			private static bool is_interrupt (Idun.LLDB.Exception e) {
-				return is_gadget_breakpoint (e) && (GadgetBreakpointAction) e.context["x3"] == INTERRUPT;
-			}
-
-			public async HashTable<string, Variant> dump_backtraces (Cancellable? cancellable) throws Error, Efni.Error, IOError {
-				if (dumping_backtraces)
-					throw new Error.INVALID_OPERATION ("Already dumping backtraces");
-				if (gadget_request != null && gadget == null)
-					throw new Error.INVALID_OPERATION ("Gadget is being injected; try again later");
-
-				dumping_backtraces = true;
-				try {
-					if (gadget == null) {
-						if (lldb.state != STOPPED)
-							throw new Error.INVALID_OPERATION ("Process is busy; try again later");
-						return yield BacktraceCollector.collect (lldb, null, cancellable);
-					}
-
-					return yield interrupt_and_dump_backtraces (cancellable);
-				} finally {
-					dumping_backtraces = false;
-				}
-			}
-
-			private async HashTable<string, Variant> interrupt_and_dump_backtraces (Cancellable? cancellable)
-					throws Error, Efni.Error, IOError {
-				if (lldb.state != RUNNING)
-					throw new Error.INVALID_OPERATION ("Process is busy handling an exception; try again later");
-
-				uint16 port = gadget.interrupt_port;
-				if (port == 0) {
-					throw new Error.NOT_SUPPORTED ("Gadget can't be interrupted; spawn with the 'interruptible' option " +
-						"set to true, using a Gadget that supports it");
-				}
-
-				var request = new Promise<Idun.LLDB.Exception> ();
-				pending_interrupt = request;
-
-				IOStream? channel = null;
-				var timeout = new TimeoutSource.seconds (INTERRUPT_TIMEOUT_SECONDS);
-				timeout.set_callback (() => {
-					fail_pending_interrupt (new Error.TIMED_OUT ("Timed out waiting for Gadget's interrupt listener"));
-					return Source.REMOVE;
-				});
-				timeout.attach (MainContext.get_thread_default ());
-
-				Idun.LLDB.Exception? interrupt = null;
-				try {
-					channel = yield channel_provider.open_channel (("tcp:%" + uint16.FORMAT_MODIFIER + "u").printf (port),
-						cancellable);
-					interrupt = yield request.future.wait_async (cancellable);
-				} catch (GLib.Error e) {
-					close_channel.begin (channel);
-					yield resume_if_interrupted (request);
-					throw_as_lldb_session_error (e);
-				} finally {
-					timeout.destroy ();
-					pending_interrupt = null;
-				}
-
-				HashTable<string, Variant>? backtraces = null;
-				GLib.Error? pending_error = null;
-				try {
-					backtraces = yield BacktraceCollector.collect (lldb, make_gadget_range ((!) interrupt), cancellable);
-				} catch (GLib.Error e) {
-					pending_error = e;
-				}
-
-				try {
-					yield handle_exception ((!) interrupt);
-				} catch (GLib.Error e) {
-					if (pending_error == null)
-						pending_error = e;
-				}
-
-				close_channel.begin (channel);
-
-				if (pending_error != null)
-					throw_as_lldb_session_error (pending_error);
-
-				return backtraces;
-			}
-
-			private async void resume_if_interrupted (Promise<Idun.LLDB.Exception> request) {
-				var interrupt = request.future.value;
-				if (interrupt == null)
-					return;
-
-				try {
-					yield handle_exception (interrupt);
-				} catch (GLib.Error e) {
-				}
-			}
-
-			private BacktraceCollector.ModuleRange make_gadget_range (Idun.LLDB.Exception interrupt) {
-				var context = interrupt.context;
-				return new BacktraceCollector.ModuleRange (gadget_module_name, context["x4"], context["x5"]);
-			}
-
-			private void fail_pending_interrupt (Error error) {
-				if (pending_interrupt != null && !pending_interrupt.future.ready)
-					pending_interrupt.reject (error);
-			}
-
-			private static async void close_channel (IOStream? channel) {
-				if (channel == null)
-					return;
-				try {
-					yield channel.close_async ();
-				} catch (IOError e) {
-				}
-			}
-
-			private static void throw_as_lldb_session_error (GLib.Error e) throws Error, Efni.Error, IOError {
-				if (e is Error)
-					throw (Error) e;
-				if (e is Efni.Error)
-					throw (Efni.Error) e;
-				if (e is IOError)
-					throw (IOError) e;
-				throw new Error.TRANSPORT ("%s", e.message);
-			}
-
-			private async void restore_execution (Cancellable? cancellable) throws Error, Efni.Error, IOError {
-				if (resumed || !early_instrumentation)
-					yield lldb.resume (cancellable);
-				else
-					yield continue_gadget_threads (cancellable);
-			}
-
 			private async void continue_gadget_threads (Cancellable? cancellable) throws Error, Efni.Error, IOError {
 				var gadget_threads = new Gee.ArrayList<LLDB.Thread> ();
 				yield lldb.enumerate_threads (thread => {
@@ -1999,10 +1812,9 @@ namespace Frida {
 					var module = new Gum.MachoModule.from_file (path, Gum.CpuType.ARM64, ptrauth_support);

 					Fruity.Injector.Transaction transaction =
-						yield Fruity.Injector.inject ((owned) module, lldb, channel_provider, interruptible, cancellable);
+						yield Fruity.Injector.inject ((owned) module, lldb, channel_provider, cancellable);
 					Fruity.Injector.GadgetDetails gadget = transaction.gadget;
 					main_thread_id = transaction.main_thread_id;
-					early_instrumentation = transaction.is_early_instrumentation;

 					exception_handler = lldb.notify["exception"].connect ((obj, pspec) => {
 						var exception = lldb.exception;
@@ -2012,8 +1824,6 @@ namespace Frida {

 					yield transaction.commit (cancellable);

-					this.gadget = gadget;
-					gadget_module_name = transaction.loaded_gadget ? path : "FridaGadget.dylib";
 					gadget_request.resolve (gadget);

 					return gadget;
@@ -2038,7 +1848,6 @@ namespace Frida {
 			}

 			private void on_lldb_closed () {
-				fail_pending_interrupt (new Error.TRANSPORT ("Debugger connection closed while waiting for Gadget's interrupt"));
 				closed ();
 			}

@@ -2052,172 +1861,6 @@ namespace Frida {
 			LIMITED,
 		}

-		private class BacktraceCollector {
-			public static async HashTable<string, Variant> collect (LLDB.Client lldb, ModuleRange? extra_module,
-					Cancellable? cancellable) throws Efni.Error, IOError {
-				var modules = new Gee.ArrayList<ModuleRange> ();
-				if (extra_module != null)
-					modules.add (extra_module);
-				yield lldb.enumerate_modules (m => {
-					var text = m.segments.first_match (s => s.name == "__TEXT");
-					if (text != null)
-						modules.add (new ModuleRange (m.pathname, m.load_address, text.vmsize));
-					return true;
-				}, cancellable);
-
-				var threads = yield fetch_threads (lldb, cancellable);
-				var register_names = map_register_names (lldb);
-
-				var threads_builder = new VariantBuilder (new VariantType ("aa{sv}"));
-				foreach (var thread in threads)
-					threads_builder.add_value (yield describe_thread (lldb, thread, register_names, modules, cancellable));
-
-				var result = make_parameters_dict ();
-				result["threads"] = threads_builder.end ();
-				return result;
-			}
-
-			private static async Gee.List<ThreadState> fetch_threads (LLDB.Client lldb, Cancellable? cancellable)
-					throws Efni.Error, IOError {
-				var response = yield lldb.query_simple ("jThreadsInfo", cancellable);
-
-				Json.Node root;
-				try {
-					root = Json.from_string (response.payload);
-				} catch (GLib.Error e) {
-					throw new Efni.Error.PROTOCOL ("Invalid jThreadsInfo response");
-				}
-				if (root.get_node_type () != Json.NodeType.ARRAY)
-					throw new Efni.Error.PROTOCOL ("Invalid jThreadsInfo response");
-
-				var threads = new Gee.ArrayList<ThreadState> ();
-				foreach (unowned Json.Node element in root.get_array ().get_elements ()) {
-					unowned Json.Object? info = element.get_object ();
-					if (info == null || !info.has_member ("tid"))
-						continue;
-
-					int64 tid = info.get_int_member ("tid");
-					if (tid == 0)
-						continue;
-					string? name = info.has_member ("name") ? info.get_string_member ("name") : null;
-
-					var thread = new ThreadState (new LLDB.Thread (("%" + int64.FORMAT_MODIFIER + "x").printf (tid), name, lldb));
-					if (info.has_member ("registers")) {
-						unowned Json.Object registers = info.get_object_member ("registers");
-						foreach (unowned string regnum in registers.get_members ())
-							thread.little_endian_registers[(uint) uint64.parse (regnum)] = registers.get_string_member (regnum);
-					}
-					threads.add (thread);
-				}
-
-				return threads;
-			}
-
-			private static Gee.Map<uint, string> map_register_names (LLDB.Client lldb) {
-				var names = new Gee.HashMap<uint, string> ();
-				try {
-					for (uint i = 0; true; i++) {
-						var reg = lldb.get_register_by_index (i);
-						names[reg.id] = reg.name;
-					}
-				} catch (Efni.Error e) {
-				}
-				return names;
-			}
-
-			private static async Variant describe_thread (LLDB.Client lldb, ThreadState state, Gee.Map<uint, string> register_names,
-					Gee.List<ModuleRange> modules, Cancellable? cancellable) throws IOError {
-				var thread = state.thread;
-
-				var builder = new VariantBuilder (VariantType.VARDICT);
-				builder.add ("{sv}", "id", new Variant.string ("0x" + thread.id));
-				unowned string? name = thread.name;
-				if (name != null)
-					builder.add ("{sv}", "name", new Variant.string (name));
-				if (!state.little_endian_registers.is_empty)
-					builder.add ("{sv}", "registers", describe_registers (state, register_names));
-
-				var frames = new VariantBuilder (new VariantType ("aa{sv}"));
-				try {
-					uint64 pc = lldb.strip_code_address (yield thread.read_register ("pc", cancellable));
-					frames.add_value (describe_address (pc, modules));
-
-					foreach (var frame in yield thread.generate_backtrace (null, cancellable)) {
-						if (frame.address == 0)
-							continue;
-						frames.add_value (describe_address (frame.address, modules));
-					}
-				} catch (Efni.Error e) {
-					builder.add ("{sv}", "error", new Variant.string (e.message));
-				}
-				builder.add ("{sv}", "frames", frames.end ());
-
-				return builder.end ();
-			}
-
-			private static Variant describe_registers (ThreadState state, Gee.Map<uint, string> register_names) {
-				var regnums = new Gee.ArrayList<uint> ();
-				regnums.add_all (state.little_endian_registers.keys);
-				regnums.sort ((a, b) => (a < b) ? -1 : (a > b) ? 1 : 0);
-
-				var builder = new VariantBuilder (VariantType.VARDICT);
-				foreach (uint regnum in regnums) {
-					string? name = register_names[regnum];
-					builder.add ("{sv}", (name != null) ? name : regnum.to_string (),
-						new Variant.string (format_little_endian_hex (state.little_endian_registers[regnum])));
-				}
-				return builder.end ();
-			}
-
-			private static string format_little_endian_hex (string little_endian_hex) {
-				var result = new StringBuilder.sized (2 + little_endian_hex.length);
-				result.append ("0x");
-				for (int i = little_endian_hex.length - 2; i >= 0; i -= 2)
-					result.append (little_endian_hex.substring (i, 2));
-				return result.str;
-			}
-
-			private static Variant describe_address (uint64 address, Gee.List<ModuleRange> modules) {
-				var builder = new VariantBuilder (VariantType.VARDICT);
-				string address_str = ("0x%" + uint64.FORMAT_MODIFIER + "x").printf (address);
-				builder.add ("{sv}", "address", new Variant.string (address_str));
-
-				foreach (var m in modules) {
-					if (address >= m.base_address && address < m.base_address + m.size) {
-						uint64 offset = address - m.base_address;
-						if (offset <= uint32.MAX) {
-							builder.add ("{sv}", "module", new Variant.string (m.path));
-							builder.add ("{sv}", "offset", new Variant.uint32 ((uint32) offset));
-						}
-						break;
-					}
-				}
-
-				return builder.end ();
-			}
-
-			private class ThreadState {
-				public LLDB.Thread thread;
-				public Gee.Map<uint, string> little_endian_registers = new Gee.HashMap<uint, string> ();
-
-				public ThreadState (LLDB.Thread thread) {
-					this.thread = thread;
-				}
-			}
-
-			public class ModuleRange {
-				public string path;
-				public uint64 base_address;
-				public uint64 size;
-
-				public ModuleRange (string path, uint64 base_address, uint64 size) {
-					this.path = path;
-					this.base_address = base_address;
-					this.size = size;
-				}
-			}
-		}
-
 		private class GadgetEntry : Object {
 			public signal void detached (SessionDetachReason reason);

@@ -4,9 +4,8 @@ using Idun;
 [CCode (gir_namespace = "FridaFruityInjector", gir_version = "1.0")]
 namespace Frida.Fruity.Injector {
 	public static async Transaction inject (owned Gum.MachoModule module, LLDB.Client lldb, Idun.ChannelProvider channel_provider,
-			bool interruptible, Cancellable? cancellable) throws Error, IOError {
+			Cancellable? cancellable) throws Error, IOError {
 		var session = new Session (module, lldb, channel_provider);
-		session.interruptible = interruptible;
 		return yield session.run (cancellable);
 	}

@@ -18,23 +17,12 @@ namespace Frida.Fruity.Injector {

 		public string main_thread_id;

-		public bool is_early_instrumentation {
-			get;
-			private set;
-		}
-
-		public bool loaded_gadget {
-			get;
-			private set;
-		}
-
+		private bool is_early_instrumentation;
 		private LLDB.Client lldb;

-		internal Transaction (GadgetDetails gadget, bool loaded_gadget, bool is_early_instrumentation, string main_thread_id,
-				LLDB.Client lldb) {
+		internal Transaction (GadgetDetails gadget, bool is_early_instrumentation, string main_thread_id, LLDB.Client lldb) {
 			Object (gadget: gadget);

-			this.loaded_gadget = loaded_gadget;
 			this.is_early_instrumentation = is_early_instrumentation;
 			this.main_thread_id = main_thread_id;
 			this.lldb = lldb;
@@ -61,13 +49,8 @@ namespace Frida.Fruity.Injector {
 			construct;
 		}

-		public uint16 interrupt_port {
-			get;
-			construct;
-		}
-
-		public GadgetDetails (uint16 port, uint16 interrupt_port = 0) {
-			Object (port: port, interrupt_port: interrupt_port);
+		public GadgetDetails (uint16 port) {
+			Object (port: port);
 		}
 	}

@@ -119,8 +102,6 @@ namespace Frida.Fruity.Injector {

 		private size_t module_size;

-		public bool interruptible = false;
-
 		public Session (Gum.MachoModule module, LLDB.Client lldb, Idun.ChannelProvider channel_provider) {
 			Object (
 				module: module,
@@ -136,7 +117,7 @@ namespace Frida.Fruity.Injector {
 				var existing_gadget = yield setup (cancellable);
 				if (existing_gadget != null) {
 					is_early_instrumentation = false;
-					return new Transaction (existing_gadget, false, is_early_instrumentation, main_thread.id, lldb);
+					return new Transaction (existing_gadget, is_early_instrumentation, main_thread.id, lldb);
 				}

 				is_early_instrumentation = !libsystem_initialized;
@@ -146,40 +127,42 @@ namespace Frida.Fruity.Injector {

 				yield teardown (cancellable);

-				return new Transaction (gadget, true, is_early_instrumentation, main_thread.id, lldb);
+				return new Transaction (gadget, is_early_instrumentation, main_thread.id, lldb);
 			} catch (GLib.Error e) {
 				throw new Error.NOT_SUPPORTED ("%s", e.message);
 			}
 		}

 		private async GadgetDetails? setup (Cancellable? cancellable) throws GLib.Error {
-			uint16 existing_port = 0;
-			uint16 existing_interrupt_port = 0;
-			uint64 existing_interrupt_arm_address = 0;
+			GadgetDetails? existing_gadget = null;
 			yield lldb.enumerate_threads (thread => {
 				if (main_thread == null)
 					main_thread = thread;

 				unowned string? name = thread.name;
-				if (name != null) {
-					uint16 port;
-					uint64 arm_address;
-					if (try_parse_gadget_port (name, out port)) {
-						if (existing_port == 0)
-							existing_port = port;
-					} else if (try_parse_interrupt_listener (name, out port, out arm_address)) {
-						existing_interrupt_port = port;
-						existing_interrupt_arm_address = arm_address;
+				if (name == null)
+					return true;
+
+				MatchInfo info;
+				if (/^frida-gadget-tcp-(\d+)$/.match (name, 0, out info)) {
+					string raw_port = info.fetch (1);
+
+					try {
+						uint64 port;
+						const uint radix = 10;
+						uint64.from_string (raw_port, out port, radix, 1, uint16.MAX);
+
+						existing_gadget = new GadgetDetails ((uint16) port);
+
+						return false;
+					} catch (NumberParserError e) {
 					}
 				}

 				return true;
 			}, cancellable);
-			if (existing_port != 0) {
-				if (existing_interrupt_port != 0)
-					yield lldb.write_bool (existing_interrupt_arm_address, true, cancellable);
-				return new GadgetDetails (existing_port, existing_interrupt_port);
-			}
+			if (existing_gadget != null)
+				return existing_gadget;
 			yield save_main_thread_state (cancellable);

 			jit_page = yield lldb.allocate (page_size, "rx", cancellable);
@@ -260,58 +243,7 @@ namespace Frida.Fruity.Injector {
 			var gadget_port = yield upload (buffer, threaded_items.build (symbols), chained_fixups.build (),
 				new UploadSymbols.from_set (symbols), cancellable);

-			uint16 interrupt_port = 0;
-			if (interruptible) {
-				yield lldb.enumerate_threads (thread => {
-					unowned string? name = thread.name;
-					uint64 arm_address;
-					return name == null || !try_parse_interrupt_listener (name, out interrupt_port, out arm_address);
-				}, cancellable);
-			}
-
-			return new GadgetDetails (gadget_port, interrupt_port);
-		}
-
-		private static bool try_parse_gadget_port (string thread_name, out uint16 port) {
-			port = 0;
-
-			MatchInfo info;
-			if (!/^frida-gadget-tcp-(\d+)$/.match (thread_name, 0, out info))
-				return false;
-
-			return try_parse_port (info.fetch (1), out port);
-		}
-
-		private static bool try_parse_interrupt_listener (string thread_name, out uint16 port, out uint64 arm_address) {
-			port = 0;
-			arm_address = 0;
-
-			MatchInfo info;
-			if (!/^frida-gadget-interrupt-(\d+)-([0-9a-f]+)$/.match (thread_name, 0, out info))
-				return false;
-
-			try {
-				const uint radix = 16;
-				uint64.from_string (info.fetch (2), out arm_address, radix);
-			} catch (NumberParserError e) {
-				return false;
-			}
-
-			return try_parse_port (info.fetch (1), out port);
-		}
-
-		private static bool try_parse_port (string raw_port, out uint16 port) {
-			port = 0;
-
-			try {
-				uint64 val;
-				const uint radix = 10;
-				uint64.from_string (raw_port, out val, radix, 1, uint16.MAX);
-				port = (uint16) val;
-				return true;
-			} catch (NumberParserError e) {
-				return false;
-			}
+			return new GadgetDetails (gadget_port);
 		}

 		private void perform_rebase_operations (Buffer buffer) throws GLib.Error {
@@ -456,13 +388,8 @@ namespace Frida.Fruity.Injector {
 						.add_string_value ("resume")
 					.end_object ()
 					.set_member_name ("teardown")
-					.add_string_value ("full");
-			if (interruptible) {
-				config
-					.set_member_name ("interruptible")
-					.add_boolean_value (true);
-			}
-			config.end_object ();
+					.add_string_value ("full")
+				.end_object ();
 			string raw_config = Json.to_string (config.get_root (), false);
 			string config_param = "frida_gadget_config=" + Base64.encode (raw_config.data);

@@ -1021,11 +1021,6 @@ namespace Frida {
 			throw new Error.NOT_SUPPORTED ("Services are not supported by this backend");
 		}

-		public virtual async HashTable<string, Variant> dump_backtraces (uint pid, Cancellable? cancellable)
-				throws Error, IOError {
-			throw new Error.NOT_SUPPORTED ("Backtrace dumping is not supported by this backend");
-		}
-
 		public ServiceSession link_service_session (ServiceSessionId id) throws Error {
 			return service_session_registry.link (id);
 		}
@@ -109,7 +109,6 @@ namespace Frida {
 					var client = yield get_android_helper_client (cancellable);
 					yield client.transport.close (cancellable);
 				} catch (Error e) {
-				} catch (Efni.Error e) {
 				}
 			}
 #endif
@@ -578,8 +577,6 @@ namespace Frida {
 				yield promise.future.wait_async (cancellable);
 			} catch (Error e) {
 				assert_not_reached ();
-			} catch (Efni.Error e) {
-				assert_not_reached ();
 			}

 			worker_thread.join ();
@@ -1448,7 +1445,6 @@ namespace Frida {
 						Posix.kill ((Posix.pid_t) pid, Posix.Signal.CONT);
 					}
 				} catch (Error e) {
-				} catch (Efni.Error e) {
 				}
 			}
 			zymbiote_patches.clear ();
@@ -2345,7 +2341,6 @@ namespace Frida {
 					var crash = parse_java_report (entry.message);
 					on_crash_received (crash);
 				} catch (Error e) {
-				} catch (Efni.Error e) {
 				}

 				return;
@@ -2386,7 +2381,6 @@ namespace Frida {
 				var crash = parse_native_report (report);
 				on_crash_received (crash);
 			} catch (Error e) {
-			} catch (Efni.Error e) {
 			}
 		}

@@ -1246,7 +1246,7 @@ namespace Frida {
 		}

 		private static async Json.Reader? try_open_already_installed_manifest (PackageNode node, File dir, Cancellable? cancellable)
-				throws Efni.Error, IOError {
+				throws IOError {
 			try {
 				Json.Reader r = yield load_json (dir.get_child ("package.json"), cancellable);

@@ -1264,6 +1264,8 @@ namespace Frida {
 				return r;
 			} catch (Error e) {
 				return null;
+			} catch (Efni.Error e) {
+				return null;
 			}
 		}

@@ -2255,6 +2257,8 @@ namespace Frida {
 					yield tar_reader.feed (buffer[:n], cancellable);
 				} catch (Error e) {
 					throw new Error.PROTOCOL ("Unable to extract tarball at %s: %s", tarball_url, e.message);
+				} catch (Efni.Error e) {
+					throw new Error.PROTOCOL ("Unable to extract tarball at %s: %s", tarball_url, e.message);
 				}
 				read_total += (size_t) n;
 				report_bucket += (size_t) n;
@@ -1482,11 +1482,6 @@ namespace Frida {
 			public async ServiceSessionId open_service (string address, Cancellable? cancellable) throws Error, IOError {
 				throw new Error.NOT_SUPPORTED ("Services are not supported by this backend");
 			}
-
-			public async HashTable<string, Variant> dump_backtraces (uint pid, Cancellable? cancellable)
-					throws Error, IOError {
-				throw new Error.NOT_SUPPORTED ("Backtrace dumping is not supported by this backend");
-			}
 		}

 		private class BusService : Object, BusSession {
@@ -17,8 +17,6 @@ namespace Frida {
 						_resource_store = new ResourceStore ();
 					} catch (Error e) {
 						assert_not_reached ();
-					} catch (Efni.Error e) {
-						assert_not_reached ();
 					}
 				}
 				return _resource_store;
@@ -844,7 +842,6 @@ namespace Frida {
 				try {
 					protect_code (load_bias + segment.vm_address, (size_t) round_page (segment.vm_size));
 				} catch (Error e) {
-				} catch (Efni.Error e) {
 				}
 				return true;
 			});
@@ -13,8 +13,6 @@ namespace Frida {
 						_resource_store = new ResourceStore ();
 					} catch (Error e) {
 						assert_not_reached ();
-					} catch (Efni.Error e) {
-						assert_not_reached ();
 					}
 				}
 				return _resource_store;
@@ -280,7 +280,6 @@ namespace Frida {
 				try {
 					icons = yield springboard_agent.fetch_application_icons (app_ids, cancellable);
 				} catch (Error e) {
-				} catch (Efni.Error e) {
 				}
 			}

@@ -436,10 +435,6 @@ namespace Frida {
 			throw_not_supported ();
 		}

-		public async HashTable<string, Variant> dump_backtraces (uint pid, Cancellable? cancellable) throws Error, IOError {
-			throw_not_supported ();
-		}
-
 		public ServiceSession link_service_session (ServiceSessionId id) throws Error {
 			throw_not_supported ();
 		}
@@ -1,6 +1,6 @@
 [wrap-git]
 url = https://github.com/frida/frida-gum.git
-revision = c8f22bb1db7904adcc4ad046c0948ee9597a95fa
+revision = e83a8d47e930b0e6941f922c03d7816b5b4b214d
 depth = 1

 [provide]
@@ -69,21 +69,6 @@ namespace Frida.HostSessionTest {
 			var h = new Harness ((h) => Fruity.Manual.Xpc.launch.begin (h as Harness));
 			h.run ();
 		});
-
-		GLib.Test.add_func ("/HostSession/Fruity/Manual/DumpBacktraces/blocked-frida-threads", () => {
-			var h = new Harness ((h) => Fruity.Manual.DumpBacktraces.blocked_frida_threads.begin (h as Harness));
-			h.run ();
-		});
-
-		GLib.Test.add_func ("/HostSession/Fruity/Manual/DumpBacktraces/reattach", () => {
-			var h = new Harness ((h) => Fruity.Manual.DumpBacktraces.reattach.begin (h as Harness));
-			h.run ();
-		});
-
-		GLib.Test.add_func ("/HostSession/Fruity/Manual/DumpBacktraces/not-interruptible", () => {
-			var h = new Harness ((h) => Fruity.Manual.DumpBacktraces.not_interruptible.begin (h as Harness));
-			h.run ();
-		});
 #endif

 #if HAVE_DROIDY_BACKEND
@@ -4319,265 +4304,6 @@ namespace Frida.HostSessionTest {

 			}

-			namespace DumpBacktraces {
-				private async void blocked_frida_threads (Harness h) {
-					if (!GLib.Test.slow ()) {
-						stdout.printf ("<skipping, run in slow mode with iOS device connected> ");
-						h.done ();
-						return;
-					}
-
-					var target = Target.from_environment ();
-					if (target == null) {
-						stdout.printf ("<skipping, set %s> ", Target.REQUIRED_VARIABLES);
-						h.done ();
-						return;
-					}
-
-					h.disable_timeout ();
-
-					var device_manager = new DeviceManager ();
-
-					try {
-						var device = yield device_manager.get_device_by_id (target.device_id, 5000);
-
-						var pid = yield spawn_with_gadget (device, target, true);
-						var session = yield device.attach (pid);
-						yield device.resume (pid);
-
-						var script = yield session.create_script ("""
-							const hits = { accept: 0, close: 0 };
-
-							function hijack(name, retType, argTypes) {
-							  const target = Module.getGlobalExportByName(name);
-							  const original = new NativeFunction(target, retType, argTypes);
-							  Interceptor.replace(target, new NativeCallback((...args) => {
-							    hits[name]++;
-							    return original(...args);
-							  }, retType, argTypes));
-							}
-
-							hijack('accept', 'int', ['int', 'pointer', 'pointer']);
-							hijack('close', 'int', ['int']);
-
-							const closeHitsBefore = hits.close;
-							new NativeFunction(Module.getGlobalExportByName('close'), 'int', ['int'])(-1);
-							send(hits.close > closeHitsBefore);
-
-							setTimeout(() => {
-							  const end = Date.now() + 60000;
-							  while (Date.now() < end)
-							    ;
-							}, 100);
-							""");
-						var hook_check = new Promise<string> ();
-						var message_handler = script.message.connect ((json, data) => {
-							if (!hook_check.future.ready)
-								hook_check.resolve (json);
-						});
-						yield script.load ();
-						var hook_check_message = yield hook_check.future.wait_async (null);
-						script.disconnect (message_handler);
-						assert_true (hook_check_message == "{\"type\":\"send\",\"payload\":true}");
-
-						yield sleep (500);
-
-						for (uint i = 0; i != 3; i++)
-							assert_backtraces_include_gadget (yield device.dump_backtraces (pid), target.gadget_path);
-
-						yield device.kill (pid);
-					} catch (GLib.Error e) {
-						printerr ("\nFAIL: %s\n\n", e.message);
-						assert_not_reached ();
-					}
-
-					yield close_device_manager (device_manager);
-
-					h.done ();
-				}
-
-				private async void reattach (Harness h) {
-					if (!GLib.Test.slow ()) {
-						stdout.printf ("<skipping, run in slow mode with iOS device connected> ");
-						h.done ();
-						return;
-					}
-
-					var target = Target.from_environment ();
-					if (target == null) {
-						stdout.printf ("<skipping, set %s> ", Target.REQUIRED_VARIABLES);
-						h.done ();
-						return;
-					}
-
-					h.disable_timeout ();
-
-					var device_manager = new DeviceManager ();
-
-					try {
-						var device = yield device_manager.get_device_by_id (target.device_id, 5000);
-
-						var pid = yield spawn_with_gadget (device, target, true);
-						var session = yield device.attach (pid);
-						yield device.resume (pid);
-
-						var interrupt_port = find_interrupt_port (yield device.dump_backtraces (pid));
-						assert_true (interrupt_port != 0);
-
-						yield session.detach ();
-
-						yield connect_and_hang_up (device, interrupt_port);
-						yield sleep (1000);
-
-						session = yield device.attach (pid);
-
-						var backtraces = yield device.dump_backtraces (pid);
-						assert_backtraces_include_gadget (backtraces, "FridaGadget.dylib");
-						assert_true (find_interrupt_port (backtraces) == interrupt_port);
-
-						yield session.detach ();
-						yield device.kill (pid);
-					} catch (GLib.Error e) {
-						printerr ("\nFAIL: %s\n\n", e.message);
-						assert_not_reached ();
-					}
-
-					yield close_device_manager (device_manager);
-
-					h.done ();
-				}
-
-				private async void not_interruptible (Harness h) {
-					if (!GLib.Test.slow ()) {
-						stdout.printf ("<skipping, run in slow mode with iOS device connected> ");
-						h.done ();
-						return;
-					}
-
-					var target = Target.from_environment ();
-					if (target == null) {
-						stdout.printf ("<skipping, set %s> ", Target.REQUIRED_VARIABLES);
-						h.done ();
-						return;
-					}
-
-					h.disable_timeout ();
-
-					var device_manager = new DeviceManager ();
-
-					try {
-						var device = yield device_manager.get_device_by_id (target.device_id, 5000);
-
-						var pid = yield spawn_with_gadget (device, target, false);
-						yield device.attach (pid);
-						yield device.resume (pid);
-
-						try {
-							yield device.dump_backtraces (pid);
-							assert_not_reached ();
-						} catch (Error e) {
-							assert_true (e is Error.NOT_SUPPORTED);
-						}
-
-						yield device.kill (pid);
-					} catch (GLib.Error e) {
-						printerr ("\nFAIL: %s\n\n", e.message);
-						assert_not_reached ();
-					}
-
-					yield close_device_manager (device_manager);
-
-					h.done ();
-				}
-
-				private async uint spawn_with_gadget (Device device, Target target, bool interruptible) throws GLib.Error {
-					var options = new SpawnOptions ();
-					options.aux["gadget"] = target.gadget_path;
-					if (interruptible)
-						options.aux["interruptible"] = true;
-
-					return yield device.spawn (target.app_id, options);
-				}
-
-				private async void connect_and_hang_up (Device device, uint16 port) {
-					try {
-						var connection = yield device.open_channel ("tcp:%u".printf (port));
-						yield connection.close_async ();
-					} catch (GLib.Error e) {
-					}
-				}
-
-				private void assert_backtraces_include_gadget (HashTable<string, Variant> backtraces, string gadget_module) {
-					var threads = backtraces["threads"];
-					assert_true (threads.n_children () > 0);
-
-					bool found_interrupt_listener = false;
-					uint gadget_frames = 0;
-					foreach (var thread in threads) {
-						var thread_dict = new VariantDict (thread);
-
-						string name;
-						if (thread_dict.lookup ("name", "s", out name) && name.has_prefix ("frida-gadget-interrupt-"))
-							found_interrupt_listener = true;
-
-						foreach (var frame in thread_dict.lookup_value ("frames", new VariantType ("aa{sv}"))) {
-							string module;
-							if (new VariantDict (frame).lookup ("module", "s", out module) && module == gadget_module)
-								gadget_frames++;
-						}
-					}
-
-					assert_true (found_interrupt_listener);
-					assert_true (gadget_frames > 0);
-				}
-
-				private uint16 find_interrupt_port (HashTable<string, Variant> backtraces) {
-					foreach (var thread in backtraces["threads"]) {
-						string name;
-						if (new VariantDict (thread).lookup ("name", "s", out name) &&
-								name.has_prefix ("frida-gadget-interrupt-")) {
-							return (uint16) uint.parse (name.split ("-")[3]);
-						}
-					}
-					return 0;
-				}
-
-				private class Target {
-					public const string REQUIRED_VARIABLES = "FRIDA_FRUITY_DEVICE_ID, FRIDA_FRUITY_APP_ID and FRIDA_FRUITY_GADGET";
-
-					public string device_id;
-					public string app_id;
-					public string gadget_path;
-
-					public static Target? from_environment () {
-						unowned string? device_id = Environment.get_variable ("FRIDA_FRUITY_DEVICE_ID");
-						unowned string? app_id = Environment.get_variable ("FRIDA_FRUITY_APP_ID");
-						unowned string? gadget_path = Environment.get_variable ("FRIDA_FRUITY_GADGET");
-						if (device_id == null || app_id == null || gadget_path == null)
-							return null;
-
-						var target = new Target ();
-						target.device_id = device_id;
-						target.app_id = app_id;
-						target.gadget_path = gadget_path;
-						return target;
-					}
-				}
-
-				private async void sleep (uint milliseconds) {
-					Timeout.add (milliseconds, sleep.callback);
-					yield;
-				}
-
-				private async void close_device_manager (DeviceManager device_manager) {
-					try {
-						yield device_manager.close ();
-					} catch (IOError e) {
-						assert_not_reached ();
-					}
-				}
-			}
-
 		}

 	}
Author	SHA1	Message	Date
Ole André Vadla Ravnås	5ebeeacc80	subprojects: Bump outdated	2026-11-12 21:30:51 +01:00
Ole André Vadla Ravnås	813756fee9	ci: Build the Barebone agents Build the agent images and the kext the way frida/frida does, each agent against the SDK its GumJS devkit was built with, and only when src/barebone/agent/ changes. Skip the rest of CI for changes that touch nothing else.	2026-11-12 21:20:29 +01:00
Ole André Vadla Ravnås	f8e9e800cf	barebone: Wait without a time limit A wait given no timeout gave up after a second on Linux, and GLib's lock waits after a millisecond, so an idle agent kept waking for nothing. Sleep until woken, as TASK_IDLE so a long sleep neither adds to the load nor looks hung. Mark the agent in a process gone when its pipe reaches EOF, which happens once its files are released and it no longer touches its mapping, and wait for that. Give timed condition waits their deadline.	2026-11-12 21:20:29 +01:00
Ole André Vadla Ravnås	2bcd1ffb7e	barebone: Wake only the waiters of a token Every waiter shared one wait queue and every wake woke all of them, so each GLib lock released in a hook on a hot kernel path woke the idle worker; on Android that came to some ninety times a second. Record the token in the wait entry and pass it as the wake key, letting the wake function skip waiters of other tokens. Have the spawn gate wake the loop's token rather than counting on that broadcast.	2026-11-12 21:20:29 +01:00
Ole André Vadla Ravnås	008f3e25d2	barebone: Give injected threads the vector lengths A thread started from the kernel side never goes through clone(), so on arm64 it kept the vector lengths of the kernel thread it began as. Once it used SVE, saving its state on a context switch found the length in use did not match, and the kernel killed its thread group. Copy the SVE and SME lengths from the leader, as arch_dup_task_struct() would have.	2026-11-12 21:20:29 +01:00
Ole André Vadla Ravnås	24f68f0c60	barebone: Find x86 per-CPU variables in pcpu_hot From 6.2 to 6.14 the current task, the preempt count and the top of the stack are members of struct pcpu_hot rather than per-CPU variables of their own, leaving the agent without a current task on those kernels. Look them up there when the standalone ones are missing; the loader supplies the member offsets.	2026-11-12 21:20:29 +01:00
Ole André Vadla Ravnås	0c7f6fae2a	barebone: Move the kmod's injector into the agent Port the prctl channel, process memory ops, thread spawning into a target's thread group, and cloaking with its /proc hooks from frida-kmod.c into the shared Linux agent, so both ways into the kernel get them. The loader supplies struct offsets from the kernel headers, falling back to BTF. Choose the detach_pid() ABI at runtime from whether free_pids() exists, which keeps pre-6.15 kernels from crashing on injection. Take the more mature half of each primitive: bounded uninterruptible waits that spin where sleeping is not allowed, inline queued locks where the kernel has no out-of-line ones, module_mutex around walks of the module list, module-region code memory, and a vmap alias for writing kernel text. Fixes #1292	2026-11-12 21:20:29 +01:00
Ole André Vadla Ravnås	a751fbee2c	barebone: Load the injected agent from the kmod Turn frida-kmod.c into an in-kernel loader for the linux-injected image: map and relocate it, fill .kernel_addrs from kallsyms and the loader's own /dev/frida glue, and hand it the config the host would. Drop the separate linux flavor and its prelink.	2026-11-12 21:20:29 +01:00
Ole André Vadla Ravnås	8118e7546f	barebone: Only restore an overwritten prologue kfault's install() leaves fixup_exception() alone when its prologue is not the expected one, but uninstall() wrote that prologue over it regardless, corrupting the kernel once the agent stopped.	2026-11-12 21:20:29 +01:00
Francesco Tamagni	d62dce1c5f	compat: Forward top-level builtin options Meson keys top-level builtin options with subproject None, while top-level project options use "". We only matched the latter, so builtins such as strip never reached compat builds, which resulted in e.g. a stripped arm64 gadget slice despite --enable-symbols.	2026-11-12 14:42:27 +01:00
Ole André Vadla Ravnås	d9bbc37db3	compat: Always pass the resolved frida_version The check for -Dfrida_version never matched the store's -D:frida_version spelling. Append the version the parent resolved unconditionally.	2026-11-12 10:13:17 +01:00
Ole André Vadla Ravnås	a2c88d7b2e	compat: Stop forwarding the parent's assets option The override check missed the store's -D:assets spelling, so the parent's assets=auto replaced the sub-build's assets=installed. Hold assets back with the other options the sub-build sets itself, and drop the separate override list.	2026-11-12 10:13:17 +01:00
Ole André Vadla Ravnås	d65ee995ad	Drop Efni catches that can never be reached The calls they guard only throw Frida.Error.	2026-11-12 10:08:48 +01:00
Ole André Vadla Ravnås	8873e9d5b3	package-manager: Catch Efni errors too Catch the Efni.Error that FS throws for a missing package.json in the already-installed probe, which otherwise fails every fresh install. Wrap Efni errors from tarball extraction as well.	2026-11-12 10:08:48 +01:00