Repository navigation
Conversation
The Mach-O parser types were renamed from Gum.Darwin* to Gum.Macho* in frida-gum; follow suit here.
The Mach-O parser types were renamed from Gum.Darwin* to Gum.Macho* in frida-gum; follow suit here.
Map the agent straight into the target with the cross-platform Gum.Mapper instead of writing a temporary DLL and loading it through LoadLibrary. A small emitted stub runs the mapped image's constructor, calls its entrypoint, and runs the destructor when it is not staying resident; GumNativeProcessMemory backs the remote reads, writes and allocations. Gated by the existing mapper option, now enabled by default on Windows, so nothing touches the filesystem; the LoadLibrary path stays for builds with the mapper disabled. Blobs are carried over the helper IPC as well, so cross-architecture and elevated targets are covered.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Make Windows agent injection fileless by mapping the agent directly into
the target with the cross-platform
Gum.Mapper, instead of writing atemporary DLL to disk and loading it via
LoadLibrary. This mirrors theDarwin backend and is gated by the existing
mapperMeson option, nowenabled by default on Windows; the
LoadLibrarypath remains for buildswith the mapper disabled (
-Dmapper=disabled).Details
inject_library_blobmaps the agent through a
GumNativeProcessMemoryremote target and runs asmall emitted stub (x86/x64/arm64) that invokes the mapped image's
constructor, calls its entrypoint, and runs the destructor when the agent is
not staying resident. The blob is carried over the helper IPC
(
WindowsRemoteHelper.inject_library_blob) as well, so cross-architectureand elevated targets are covered.
frida-gum's rename of the Mach-O parser types from
Gum.Darwin*toGum.Macho*.Notes
Gum.Mapper,Gum.ProcessMemory/Gum.NativeProcessMemory, and theGum.Macho*rename). Build against that branch.
LoadLibrary; only blobinjection currently takes the mapper. Marked draft while that is finished.
Testing
and run through constructor -> entrypoint -> destructor.