Skip to content

Upgrade to Frida 17.16.4 and add AVX-512/ARM64 PAC instructions - #248

Merged
s1341 merged 6 commits into
frida:mainfrom
kkuehl:feature/upgrade-frida-17.16.4
Jul 30, 2026
Merged

Upgrade to Frida 17.16.4 and add AVX-512/ARM64 PAC instructions#248
s1341 merged 6 commits into
frida:mainfrom
kkuehl:feature/upgrade-frida-17.16.4

Conversation

@kkuehl

@kkuehl kkuehl commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Summary

Comprehensive upgrade from Frida 17.16.1 to 17.16.4 with extensive x86_64 and ARM64 instruction writer enhancements.

Changes

Version Upgrade

  • Updated FRIDA_VERSION from 17.16.1 to 17.16.4 across all three devkit locations (root, frida-sys, frida-gum-sys)
  • Build system automatically downloads Frida 17.16.4 devkit
  • Merged upstream changes including new Memory API and glib_compat module

x86_64 Instruction Writer Enhancements (~70 new methods)

Writer Utilities:

  • clear, cur, offset - Writer state management
  • set_target_cpu, set_target_abi - Target configuration
  • get_cpu_register_for_nth_argument - ABI introspection

AVX-512 Instructions:

  • put_kmovq_kreg_reg_offset_ptr / put_kmovq_reg_offset_ptr_kreg - k-register mask operations
  • put_vextracti64x4_reg_offset_ptr_zmm - Extract 256 bits from 512-bit ZMM register
  • put_vinserti64x4_zmm_reg_offset_ptr - Insert 256 bits into 512-bit ZMM register
  • put_vmovdqu64_reg_offset_ptr_zmm / put_vmovdqu64_zmm_reg_offset_ptr - Unaligned 512-bit moves

Basic Instructions:

  • put_breakpoint, put_padding, put_nop_padding - Debug and alignment
  • put_u8, put_s8 - Raw byte insertion

Call Instructions:

  • put_call_indirect, put_call_near_label, put_call_reg
  • put_call_reg_offset_ptr, put_call_reg_with_arguments
  • Multiple put_call_*_with_aligned_arguments variants
  • Full unsafe argument array APIs for custom calling conventions

CPU & Flag Instructions:

  • put_cpuid, put_lfence, put_rdtsc, put_pause - CPU features
  • put_clc, put_stc, put_cld, put_std - Flag manipulation
  • put_lahf, put_sahf - Flag register access

Comparison & Testing:

  • put_cmp_imm_ptr_imm_u32, put_cmp_reg_i32, put_cmp_reg_reg
  • put_cmp_reg_offset_ptr_reg, put_test_reg_u32
  • put_jcc_short, put_jcc_near - Full conditional jump support

Atomic Operations:

  • put_inc_reg_ptr, put_dec_reg_ptr
  • put_lock_inc_imm32_ptr, put_lock_dec_imm32_ptr
  • put_lock_cmpxchg_reg_ptr_reg, put_lock_xadd_reg_ptr_reg
  • put_xchg_reg_reg_ptr

Memory Operations:

  • put_mov_reg_near_ptr, put_mov_near_ptr_reg
  • put_mov_reg_fs_*, put_mov_fs_* - FS segment register access
  • put_mov_reg_gs_*, put_mov_gs_* - GS segment register access
  • put_movdqu_*, put_movq_* - XMM register moves

FPU State:

  • put_fxsave_reg_ptr, put_fxrstor_reg_ptr - FPU state save/restore

ARM64 Instruction Writer Additions

New Instructions:

  • put_movk_reg_imm - Move with keep for building 64-bit constants incrementally
  • put_pacia_reg_reg - Pointer Authentication Code for ARMv8.3-A security

Testing

✅ Full quality gate passed:

  • cargo fmt
  • cargo clippy --all-targets --all-features
  • cargo build --all-targets --all-features
  • cargo test --all-features

Impact

  • Non-breaking: All additions are new public APIs
  • Comprehensive coverage: Brings x86_64 instruction writer to near-complete coverage of common code generation patterns
  • Platform support: Properly handles Windows/Unix ABI differences and segment register access
  • Security features: Adds ARMv8.3-A PAC support for ARM64

Notes

This PR consolidates multiple incremental updates into one comprehensive release:

  • Version upgrade with upstream merge
  • Complete x86_64 instruction writer coverage
  • Essential ARM64 security features
  • Small, focused additions that are easy to review per commit

kkuehl added 6 commits July 28, 2026 11:48
Upgrade Frida from 17.16.1 to 17.16.4 across all three devkit components.

Add new instruction writer support from Frida 17.16.1+:

x86_64 Writer (AVX-512 instructions):
- kmovq: k-register mask operations for AVX-512
- vextracti64x4: extract 256 bits from 512-bit ZMM register
- vinserti64x4: insert 256 bits into 512-bit ZMM register
- vmovdqu64: unaligned 512-bit moves to/from ZMM registers

ARM64 Writer:
- movk: move with keep for building 64-bit constants incrementally
- pacia: Pointer Authentication Code for ARMv8.3-A security

All changes tested with full quality gate (fmt, clippy, build, test).
The function signature expects (reg, imm: u16, shift: u32), not (reg, imm: u32, shift: u8).
This was revealed after merging upstream which had updated bindings.
Add ~70 additional x86_64 instruction writer methods:

Writer utilities:
- clear, cur, offset: Writer state management
- set_target_cpu, set_target_abi: Target configuration
- get_cpu_register_for_nth_argument: ABI introspection

Basic instructions:
- put_breakpoint, put_padding, put_nop_padding: Debug/alignment
- put_u8, put_s8: Raw byte insertion

Call instructions:
- put_call_indirect, put_call_near_label, put_call_reg
- put_call_reg_offset_ptr, put_call_reg_with_arguments
- put_call_*_with_aligned_arguments variants
- Full unsafe argument array APIs

Flag manipulation:
- put_clc, put_stc, put_cld, put_std: Flag operations
- put_lahf, put_sahf: Flag register access

CPU instructions:
- put_cpuid, put_lfence, put_rdtsc, put_pause: CPU features

Comparison/test:
- put_cmp_imm_ptr_imm_u32, put_cmp_reg_i32, put_cmp_reg_reg
- put_cmp_reg_offset_ptr_reg, put_test_reg_u32

Conditional jumps:
- put_jcc_short, put_jcc_near: Full conditional jump support

Atomic operations:
- put_inc_reg_ptr, put_dec_reg_ptr
- put_lock_inc_imm32_ptr, put_lock_dec_imm32_ptr
- put_lock_cmpxchg_reg_ptr_reg, put_lock_xadd_reg_ptr_reg
- put_xchg_reg_reg_ptr

Memory operations:
- put_mov_reg_near_ptr, put_mov_near_ptr_reg
- put_mov_reg_fs_*, put_mov_fs_*: FS segment access
- put_mov_reg_gs_*, put_mov_gs_*: GS segment access
- put_movdqu_*, put_movq_*: XMM register moves

FPU state:
- put_fxsave_reg_ptr, put_fxrstor_reg_ptr

All changes tested with full quality gate (fmt, clippy, build, test).
Fix imports in the put_pacia_reg_reg example to use the public API.
Aarch64Register is re-exported from instruction_writer, not aarch64 submodule.
Remove duplicate doc comment for put_kmovq_kreg_reg_offset_ptr that was
causing clippy::empty_line_after_doc_comments error.
@kkuehl

kkuehl commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

@s1341 another round

@s1341
s1341 merged commit 7f9c5ea into frida:main Jul 30, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants