[macOS arm64] gum_darwin_query_page_size() returns 16 KB (0x4000) for Rosetta 2 (x86_64) processes, causing gum_darwin_read() to fail with KERN_INVALID_ADDRESS #1193
Description
Environment
- Frida version:
17.24.3(arm64andx86_64) - OS: macOS
26.6.2(25G83, Darwin25.6.0,xnu-12377.161.14~5/RELEASE_ARM64_T6050) - SIP / Boot-args: SIP disabled,
boot-args="-arm64e_preview_abi thid_should_crash=0 tss_should_crash=0", target signed withcom.apple.security.cs.debugger
Problem 1: gum_darwin_query_page_size() returns 0x4000 instead of 0x1000 for Rosetta (P_TRANSLATED) tasks
When attaching to a Rosetta-translated x86_64 process from arm64 Frida (frida.attach(pid)), frida-helper-arm64 fails in gum_darwin_module_resolver_load_from_dyld_info() with:
frida.NotSupportedError: unable to read from process memory
Tracing mach_vm_read inside frida-helper-arm64 shows:
[frida-helper-arm64] FAIL mach_vm_read(task=0x160f, addr=0x404c4000, size=0x4000) -> 1 ((os/kern) invalid address)
In the target Rosetta process (vmmap), a dylib (fcntl.cpython-310-darwin.so) is mapped on a 4 KB (0x1000) boundary at 0x404c7000, with an unmapped 8 KB hole immediately preceding it (0x404c5000–0x404c7000):
shared memory 404c4000-404c5000 [ 4K] r--/r-- SM=SHM
404c5000-404c7000 [ 8K] --- UNMAPPED ---
__TEXT 404c7000-404cb000 [16K] r-x/rwx .../fcntl.cpython-310-darwin.so
Root Cause in gum/backend-darwin/gumdarwin.c
gum_darwin_query_page_size()callsgum_darwin_cpu_type_from_pid(pid, &cpu_type)and sets*page_size = 4096ifcpu_typeisGUM_CPU_IA32(1) orGUM_CPU_AMD64(2), and16384(0x4000) ifcpu_typeisGUM_CPU_ARM64(4).- However, in
arm64builds (#elif defined (HAVE_ARM) || defined (HAVE_ARM64)),gum_darwin_cpu_type_from_pid()only checksP_LP64(0x4) ininfo.kp_proc.p_flagand ignoresP_TRANSLATED(0x00020000):ldr w8, [sp, #0x30] ; info.kp_proc.p_flag tst w8, #0x4 ; P_LP64 mov w8, #0x3 ; GUM_CPU_ARM (3) cinc w8, w8, ne ; GUM_CPU_ARM64 (4) str w8, [x19] - Because
gum_darwin_cpu_type_from_pid()never returnsGUM_CPU_IA32orGUM_CPU_AMD64onarm64builds, the4096page size branch ingum_darwin_query_page_size()is dead code. gum_darwin_read()then rounds0x404c7000down by~0x3fffto0x404c4000and attempts a0x4000-bytemach_vm_read, which spans the unmapped hole at0x404c5000–0x404c7000and fails withKERN_INVALID_ADDRESS.
Problem 2: Rosetta 2 injection on modern macOS (x86_64 vs arm64 fruitjector)
- Attempting to attach using
x86_64Frida under Rosetta fails at remote thread creation/state setup withthread_create returned '(os/kern) invalid argument', even withthid_should_crash=0 tss_should_crash=0andcom.apple.security.cs.debugger. - Meanwhile, calling
thread_create()from a nativearm64process succeeds (KERN_SUCCESS), but creates anarm64Mach thread whereasTASK_DYLD_INFOin the Rosetta process points tox86_64dylibs.
Activity