subprojects: Prepare for release

Expose Device.override_option() for overriding backend-specific
options on a device.

Overrides apply when establishing a host session. If one already
exists, changes take effect on the next connection.

examples/child_gating.py

@@ -42,18 +42,16 @@ class Application:
         print("✔ enable_child_gating()")
         session.enable_child_gating()
         print("✔ create_script()")
-        script = session.create_script(
-            """\
-Interceptor.attach(Module.getExportByName(null, 'open'), {
-  onEnter: function (args) {
+        script = session.create_script("""\
+Interceptor.attach(Module.getGlobalExportByName('open'), {
+  onEnter(args) {
     send({
       type: 'open',
-      path: Memory.readUtf8String(args[0])
+      path: args[0].readUtf8String()
     });
   }
 });
-"""
-        )
+""")
         script.on("message", lambda message, data: self._reactor.schedule(lambda: self._on_message(pid, message)))
         print("✔ load()")
         script.load()

examples/inject_library/inject_blob.py

@@ -15,7 +15,7 @@ def on_uninjected(id):
     print("on_uninjected id=%u" % id)
 
 
-(target, library_path) = sys.argv[1:]
+target, library_path = sys.argv[1:]
 
 device = frida.get_local_device()
 device.on("uninjected", on_uninjected)

examples/inject_library/inject_file.py

@@ -15,7 +15,7 @@ def on_uninjected(id):
     print("on_uninjected id=%u" % id)
 
 
-(target, library_path) = sys.argv[1:]
+target, library_path = sys.argv[1:]
 
 device = frida.get_local_device()
 device.on("uninjected", on_uninjected)

examples/rpc.py

@@ -1,8 +1,7 @@
 import frida
 
 session = frida.attach("Twitter")
-script = session.create_script(
-    """\
+script = session.create_script("""\
 rpc.exports = {
   hello: function () {
     return 'Hello';
@@ -11,8 +10,7 @@ rpc.exports = {
     oops;
   }
 };
-"""
-)
+""")
 script.load()
 api = script.exports_sync
 print("api.hello() =>", api.hello())

examples/session_persist_timeout.py

@@ -22,8 +22,7 @@ class Application:
         self._session = session
         session.on("detached", lambda *args: self._reactor.schedule(lambda: self._on_detached(*args)))
 
-        script = session.create_script(
-            """
+        script = session.create_script("""
 let _puts = null;
 
 Interceptor.attach(DebugSymbol.getFunctionByName('f'), {
@@ -48,8 +47,7 @@ function puts(s) {
   }
   _puts(Memory.allocUtf8String(s));
 }
-"""
-        )
+""")
         self._script = script
         script.on("message", lambda *args: self._reactor.schedule(lambda: self._on_message(*args)))
         script.load()

examples/spawn_gating.py

@@ -0,0 +1,78 @@
+import threading
+
+from frida_tools.application import Reactor
+
+import frida
+
+
+class Application:
+    def __init__(self):
+        self._stop_requested = threading.Event()
+        self._reactor = Reactor(run_until_return=lambda reactor: self._stop_requested.wait())
+
+        self._device = frida.get_usb_device()
+        self._sessions = set()
+        self._sessions_lock = threading.Lock()
+
+        self._device.on("spawn-added", lambda spawn: self._reactor.schedule(lambda: self._on_spawn_added(spawn)))
+        self._device.on("spawn-removed", lambda spawn: self._reactor.schedule(lambda: self._on_spawn_removed(spawn)))
+
+    def run(self):
+        self._reactor.schedule(lambda: self._start())
+        self._reactor.run()
+
+    def _start(self):
+        self._device.enable_spawn_gating()
+
+    def _instrument(self, pid):
+        print(f"✔ attach(pid={pid})")
+        session = self._device.attach(pid)
+        session.on("detached", lambda reason: self._reactor.schedule(lambda: self._on_detached(pid, session, reason)))
+        print("✔ create_script()")
+        script = session.create_script("""\
+const puts = new NativeFunction(Module.getGlobalExportByName('puts'), 'int', ['pointer']);
+puts(Memory.allocUtf8String('Hello from Frida agent'));
+Interceptor.attach(Module.getGlobalExportByName('open'), {
+  onEnter(args) {
+    send({
+      type: 'open',
+      path: args[0].readUtf8String()
+    });
+  }
+});
+""")
+        script.on("message", lambda message, data: self._reactor.schedule(lambda: self._on_message(pid, message)))
+        print("✔ load()")
+        script.load()
+        print(f"✔ resume(pid={pid})")
+        self._device.resume(pid)
+        with self._sessions_lock:
+            self._sessions.add(session)
+
+    def _on_spawn_added(self, spawn):
+        print(f"⚡ spawn_added: {spawn}")
+        t = threading.Thread(target=self._handle_spawn, args=(spawn,))
+        t.start()
+
+    def _handle_spawn(self, spawn):
+        if "/bin/ls" in spawn.identifier:
+            self._instrument(spawn.pid)
+        else:
+            pid = spawn.pid
+            print(f"✔ resume(pid={pid})")
+            self._device.resume(pid)
+
+    def _on_spawn_removed(self, spawn):
+        print(f"⚡ spawn_removed: {spawn}")
+
+    def _on_detached(self, pid, session, reason):
+        print(f"⚡ detached: pid={pid}, reason='{reason}'")
+        with self._sessions_lock:
+            self._sessions.remove(session)
+
+    def _on_message(self, pid, message):
+        print(f"⚡ message: pid={pid}, payload={message['payload']}")
+
+
+app = Application()
+app.run()

frida/_frida/extension.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2023 Ole André Vadla Ravnås <oleavr@nowsecure.com>
+ * Copyright (C) 2013-2026 Ole André Vadla Ravnås <oleavr@nowsecure.com>
  * Copyright (C) 2024 Håvard Sørbø <havard@hsorbo.no>
  *
  * Licence: wxWindows Library Licence, Version 3.1
@@ -378,6 +378,7 @@ static PyObject * PyGObject_marshal_variant (GVariant * variant);
 static PyObject * PyGObject_marshal_variant_byte_array (GVariant * variant);
 static PyObject * PyGObject_marshal_variant_dict (GVariant * variant);
 static PyObject * PyGObject_marshal_variant_array (GVariant * variant);
+static PyObject * PyGObject_marshal_variant_tuple (GVariant * variant);
 static gboolean PyGObject_unmarshal_variant (PyObject * value, GVariant ** variant);
 static gboolean PyGObject_unmarshal_variant_from_mapping (PyObject * mapping, GVariant ** variant);
 static gboolean PyGObject_unmarshal_variant_from_sequence (PyObject * sequence, GVariant ** variant);
@@ -403,6 +404,7 @@ static void PyDevice_init_from_handle (PyDevice * self, FridaDevice * handle);
 static void PyDevice_dealloc (PyDevice * self);
 static PyObject * PyDevice_repr (PyDevice * self);
 static PyObject * PyDevice_is_lost (PyDevice * self);
+static PyObject * PyDevice_override_option (PyDevice * self, PyObject * args, PyObject * kw);
 static PyObject * PyDevice_query_system_parameters (PyDevice * self);
 static PyObject * PyDevice_get_frontmost_application (PyDevice * self, PyObject * args, PyObject * kw);
 static PyObject * PyDevice_enumerate_applications (PyDevice * self, PyObject * args, PyObject * kw);
@@ -619,6 +621,7 @@ static PyMethodDef PyDeviceManager_methods[] =
 static PyMethodDef PyDevice_methods[] =
 {
   { "is_lost", (PyCFunction) PyDevice_is_lost, METH_NOARGS, "Query whether the device has been lost." },
+  { "override_option", (PyCFunction) PyDevice_override_option, METH_VARARGS | METH_KEYWORDS, "Override a backend-specific option." },
   { "query_system_parameters", (PyCFunction) PyDevice_query_system_parameters, METH_NOARGS, "Returns a dictionary of information about the host system." },
   { "get_frontmost_application", (PyCFunction) PyDevice_get_frontmost_application, METH_VARARGS | METH_KEYWORDS, "Get details about the frontmost application." },
   { "enumerate_applications", (PyCFunction) PyDevice_enumerate_applications, METH_VARARGS | METH_KEYWORDS, "Enumerate applications." },
@@ -1749,10 +1752,20 @@ PyGObject_marshal_variant (GVariant * variant)
   {
     case G_VARIANT_CLASS_STRING:
       return PyGObject_marshal_string (g_variant_get_string (variant, NULL));
+    case G_VARIANT_CLASS_BYTE:
+      return PyLong_FromLong (g_variant_get_byte (variant));
+    case G_VARIANT_CLASS_INT16:
+      return PyLong_FromLong (g_variant_get_int16 (variant));
+    case G_VARIANT_CLASS_UINT16:
+      return PyLong_FromUnsignedLong (g_variant_get_uint16 (variant));
+    case G_VARIANT_CLASS_INT32:
+      return PyLong_FromLong (g_variant_get_int32 (variant));
+    case G_VARIANT_CLASS_UINT32:
+      return PyLong_FromUnsignedLong (g_variant_get_uint32 (variant));
     case G_VARIANT_CLASS_INT64:
       return PyLong_FromLongLong (g_variant_get_int64 (variant));
     case G_VARIANT_CLASS_UINT64:
-      return PyLong_FromLongLong (g_variant_get_uint64 (variant));
+      return PyLong_FromUnsignedLongLong (g_variant_get_uint64 (variant));
     case G_VARIANT_CLASS_DOUBLE:
       return PyFloat_FromDouble (g_variant_get_double (variant));
     case G_VARIANT_CLASS_BOOLEAN:
@@ -1765,6 +1778,19 @@ PyGObject_marshal_variant (GVariant * variant)
         return PyGObject_marshal_variant_dict (variant);
 
       return PyGObject_marshal_variant_array (variant);
+    case G_VARIANT_CLASS_TUPLE:
+      return PyGObject_marshal_variant_tuple (variant);
+    case G_VARIANT_CLASS_VARIANT:
+    {
+      GVariant * inner;
+      PyObject * result;
+
+      inner = g_variant_get_variant (variant);
+      result = PyGObject_marshal_variant (inner);
+      g_variant_unref (inner);
+
+      return result;
+    }
     default:
       break;
   }
@@ -1823,13 +1849,6 @@ PyGObject_marshal_variant_array (GVariant * variant)
 
   for (i = 0; (child = g_variant_iter_next_value (&iter)) != NULL; i++)
   {
-    if (g_variant_is_of_type (child, G_VARIANT_TYPE_VARIANT))
-    {
-      GVariant * inner = g_variant_get_variant (child);
-      g_variant_unref (child);
-      child = inner;
-    }
-
     PyList_SetItem (list, i, PyGObject_marshal_variant (child));
 
     g_variant_unref (child);
@@ -1838,6 +1857,28 @@ PyGObject_marshal_variant_array (GVariant * variant)
   return list;
 }
 
+static PyObject *
+PyGObject_marshal_variant_tuple (GVariant * variant)
+{
+  GVariantIter iter;
+  PyObject * tuple;
+  guint i;
+  GVariant * child;
+
+  g_variant_iter_init (&iter, variant);
+
+  tuple = PyTuple_New (g_variant_iter_n_children (&iter));
+
+  for (i = 0; (child = g_variant_iter_next_value (&iter)) != NULL; i++)
+  {
+    PyTuple_SetItem (tuple, i, PyGObject_marshal_variant (child));
+
+    g_variant_unref (child);
+  }
+
+  return tuple;
+}
+
 static gboolean
 PyGObject_unmarshal_variant (PyObject * value, GVariant ** variant)
 {
@@ -1847,14 +1888,14 @@ PyGObject_unmarshal_variant (PyObject * value, GVariant ** variant)
 
     PyGObject_unmarshal_string (value, &str);
 
-    *variant = g_variant_new_take_string (str);
+    *variant = g_variant_ref_sink (g_variant_new_take_string (str));
 
     return TRUE;
   }
 
   if (PyBool_Check (value))
   {
-    *variant = g_variant_new_boolean (value == Py_True);
+    *variant = g_variant_ref_sink (g_variant_new_boolean (value == Py_True));
 
     return TRUE;
   }
@@ -1867,14 +1908,14 @@ PyGObject_unmarshal_variant (PyObject * value, GVariant ** variant)
     if (l == -1 && PyErr_Occurred ())
       return FALSE;
 
-    *variant = g_variant_new_int64 (l);
+    *variant = g_variant_ref_sink (g_variant_new_int64 (l));
 
     return TRUE;
   }
 
   if (PyFloat_Check (value))
   {
-    *variant = g_variant_new_double (PyFloat_AsDouble (value));
+    *variant = g_variant_ref_sink (g_variant_new_double (PyFloat_AsDouble (value)));
 
     return TRUE;
   }
@@ -1888,7 +1929,7 @@ PyGObject_unmarshal_variant (PyObject * value, GVariant ** variant)
     PyBytes_AsStringAndSize (value, &buffer, &length);
 
     copy = g_memdup2 (buffer, length);
-    *variant = g_variant_new_from_data (G_VARIANT_TYPE_BYTESTRING, copy, length, TRUE, g_free, copy);
+    *variant = g_variant_ref_sink (g_variant_new_from_data (G_VARIANT_TYPE_BYTESTRING, copy, length, TRUE, g_free, copy));
 
     return TRUE;
   }
@@ -1934,12 +1975,13 @@ PyGObject_unmarshal_variant_from_mapping (PyObject * mapping, GVariant ** varian
 
     g_variant_builder_add (&builder, "{sv}", PyBytes_AsString (key_bytes), raw_value);
 
+    g_variant_unref (raw_value);
     Py_DecRef (key_bytes);
   }
 
   Py_DecRef (items);
 
-  *variant = g_variant_builder_end (&builder);
+  *variant = g_variant_ref_sink (g_variant_builder_end (&builder));
 
   return TRUE;
 
@@ -1962,6 +2004,31 @@ PyGObject_unmarshal_variant_from_sequence (PyObject * sequence, GVariant ** vari
 
   is_tuple = PyTuple_Check (sequence);
 
+  if (is_tuple && PyTuple_Size (sequence) == 2)
+  {
+    gchar * type;
+    gboolean is_uint64_cast;
+
+    if (!PyGObject_unmarshal_string (PyTuple_GetItem (sequence, 0), &type))
+      return FALSE;
+
+    is_uint64_cast = strcmp (type, "uint64") == 0;
+
+    g_free (type);
+
+    if (is_uint64_cast)
+    {
+      unsigned PY_LONG_LONG l;
+
+      l = PyLong_AsUnsignedLongLong (PyTuple_GetItem (sequence, 1));
+      if (l == (unsigned PY_LONG_LONG) -1 && PyErr_Occurred ())
+        return FALSE;
+
+      *variant = g_variant_ref_sink (g_variant_new_uint64 (l));
+      return TRUE;
+    }
+  }
+
   g_variant_builder_init (&builder, is_tuple ? G_VARIANT_TYPE_TUPLE : G_VARIANT_TYPE ("av"));
 
   n = PySequence_Length (sequence);
@@ -1984,10 +2051,11 @@ PyGObject_unmarshal_variant_from_sequence (PyObject * sequence, GVariant ** vari
     else
       g_variant_builder_add (&builder, "v", raw_value);
 
+    g_variant_unref (raw_value);
     Py_DecRef (val);
   }
 
-  *variant = g_variant_builder_end (&builder);
+  *variant = g_variant_ref_sink (g_variant_builder_end (&builder));
 
   return TRUE;
 
@@ -2455,6 +2523,33 @@ PyDevice_is_lost (PyDevice * self)
   return PyBool_FromLong (is_lost);
 }
 
+static PyObject *
+PyDevice_override_option (PyDevice * self, PyObject * args, PyObject * kw)
+{
+  static char * keywords[] = { "name", "value", NULL };
+  const char * name;
+  PyObject * value;
+  GVariant * raw_value;
+  GError * error = NULL;
+
+  if (!PyArg_ParseTupleAndKeywords (args, kw, "sO", keywords, &name, &value))
+    return NULL;
+
+  if (!PyGObject_unmarshal_variant (value, &raw_value))
+    return NULL;
+
+  Py_BEGIN_ALLOW_THREADS
+  frida_device_override_option (PY_GOBJECT_HANDLE (self), name, raw_value, &error);
+  Py_END_ALLOW_THREADS
+
+  g_variant_unref (raw_value);
+
+  if (error != NULL)
+    return PyFrida_raise (error);
+
+  PyFrida_RETURN_NONE;
+}
+
 static PyObject *
 PyDevice_query_system_parameters (PyDevice * self)
 {
@@ -2887,7 +2982,7 @@ PyDevice_spawn (PyDevice * self, PyObject * args, PyObject * kw)
         goto invalid_dict_value;
       }
 
-      g_hash_table_insert (aux, raw_key, g_variant_ref_sink (raw_value));
+      g_hash_table_insert (aux, raw_key, raw_value);
     }
   }
 

frida/core.py

@@ -883,6 +883,14 @@ class Device:
 
         return self._impl.is_lost()
 
+    @cancellable
+    def override_option(self, name: str, value: Any) -> None:
+        """
+        Override a backend-specific option
+        """
+
+        self._impl.override_option(name, value)
+
     @cancellable
     def query_system_parameters(self) -> Dict[str, Any]:
         """
@@ -1310,7 +1318,7 @@ class EndpointParameters:
         _filter_missing_kwargs(kwargs)
 
         if authentication is not None:
-            (auth_scheme, auth_data) = authentication
+            auth_scheme, auth_data = authentication
             if auth_scheme == "token":
                 kwargs["auth_token"] = auth_data
             elif auth_scheme == "callback":

subprojects/frida-core.wrap

@@ -1,6 +1,6 @@
 [wrap-git]
 url = https://github.com/frida/frida-core.git
-revision = 17.6.2
+revision = 17.9.11
 depth = 1
 
 [provide]