frida 16.2.1 → 16.2.2

package/releng/devkit-assets/frida-core-example-windows.c

@@ -0,0 +1,197 @@
+/*
+ * To build, set up your Release configuration like this:
+ *
+ * [Runtime Library]
+ * Multi-threaded (/MT)
+ *
+ * Visit https://frida.re to learn more about Frida.
+ */
+
+#include "frida-core.h"
+
+#include <stdlib.h>
+#include <string.h>
+
+static void on_detached (FridaSession * session, FridaSessionDetachReason reason, FridaCrash * crash, gpointer user_data);
+static void on_message (FridaScript * script, const gchar * message, GBytes * data, gpointer user_data);
+static void on_signal (int signo);
+static gboolean stop (gpointer user_data);
+
+static GMainLoop * loop = NULL;
+
+int
+main (int argc,
+      char * argv[])
+{
+  guint target_pid;
+  FridaDeviceManager * manager;
+  GError * error = NULL;
+  FridaDeviceList * devices;
+  gint num_devices, i;
+  FridaDevice * local_device;
+  FridaSession * session;
+
+  frida_init ();
+
+  if (argc != 2 || (target_pid = atoi (argv[1])) == 0)
+  {
+    g_printerr ("Usage: %s <pid>\n", argv[0]);
+    return 1;
+  }
+
+  loop = g_main_loop_new (NULL, TRUE);
+
+  signal (SIGINT, on_signal);
+  signal (SIGTERM, on_signal);
+
+  manager = frida_device_manager_new ();
+
+  devices = frida_device_manager_enumerate_devices_sync (manager, NULL, &error);
+  g_assert (error == NULL);
+
+  local_device = NULL;
+  num_devices = frida_device_list_size (devices);
+  for (i = 0; i != num_devices; i++)
+  {
+    FridaDevice * device = frida_device_list_get (devices, i);
+
+    g_print ("[*] Found device: \"%s\"\n", frida_device_get_name (device));
+
+    if (frida_device_get_dtype (device) == FRIDA_DEVICE_TYPE_LOCAL)
+      local_device = g_object_ref (device);
+
+    g_object_unref (device);
+  }
+  g_assert (local_device != NULL);
+
+  frida_unref (devices);
+  devices = NULL;
+
+  session = frida_device_attach_sync (local_device, target_pid, NULL, NULL, &error);
+  if (error == NULL)
+  {
+    FridaScript * script;
+    FridaScriptOptions * options;
+
+    g_signal_connect (session, "detached", G_CALLBACK (on_detached), NULL);
+    if (frida_session_is_detached (session))
+      goto session_detached_prematurely;
+
+    g_print ("[*] Attached\n");
+
+    options = frida_script_options_new ();
+    frida_script_options_set_name (options, "example");
+    frida_script_options_set_runtime (options, FRIDA_SCRIPT_RUNTIME_QJS);
+
+    script = frida_session_create_script_sync (session,
+        "Interceptor.attach(Module.getExportByName('kernel32.dll', 'CreateFileW'), {\n"
+        "  onEnter(args) {\n"
+        "    console.log(`[*] CreateFileW(\"${args[0].readUtf16String()}\")`);\n"
+        "  }\n"
+        "});\n"
+        "Interceptor.attach(Module.getExportByName('kernel32.dll', 'CloseHandle'), {\n"
+        "  onEnter(args) {\n"
+        "    console.log(`[*] CloseHandle(${args[0]})`);\n"
+        "  }\n"
+        "});",
+        options, NULL, &error);
+    g_assert (error == NULL);
+
+    g_clear_object (&options);
+
+    g_signal_connect (script, "message", G_CALLBACK (on_message), NULL);
+
+    frida_script_load_sync (script, NULL, &error);
+    g_assert (error == NULL);
+
+    g_print ("[*] Script loaded\n");
+
+    if (g_main_loop_is_running (loop))
+      g_main_loop_run (loop);
+
+    g_print ("[*] Stopped\n");
+
+    frida_script_unload_sync (script, NULL, NULL);
+    frida_unref (script);
+    g_print ("[*] Unloaded\n");
+
+    frida_session_detach_sync (session, NULL, NULL);
+session_detached_prematurely:
+    frida_unref (session);
+    g_print ("[*] Detached\n");
+  }
+  else
+  {
+    g_printerr ("Failed to attach: %s\n", error->message);
+    g_error_free (error);
+  }
+
+  frida_unref (local_device);
+
+  frida_device_manager_close_sync (manager, NULL, NULL);
+  frida_unref (manager);
+  g_print ("[*] Closed\n");
+
+  g_main_loop_unref (loop);
+
+  return 0;
+}
+
+static void
+on_detached (FridaSession * session,
+             FridaSessionDetachReason reason,
+             FridaCrash * crash,
+             gpointer user_data)
+{
+  gchar * reason_str;
+
+  reason_str = g_enum_to_string (FRIDA_TYPE_SESSION_DETACH_REASON, reason);
+  g_print ("on_detached: reason=%s crash=%p\n", reason_str, crash);
+  g_free (reason_str);
+
+  g_idle_add (stop, NULL);
+}
+
+static void
+on_message (FridaScript * script,
+            const gchar * message,
+            GBytes * data,
+            gpointer user_data)
+{
+  JsonParser * parser;
+  JsonObject * root;
+  const gchar * type;
+
+  parser = json_parser_new ();
+  json_parser_load_from_data (parser, message, -1, NULL);
+  root = json_node_get_object (json_parser_get_root (parser));
+
+  type = json_object_get_string_member (root, "type");
+  if (strcmp (type, "log") == 0)
+  {
+    const gchar * log_message;
+
+    log_message = json_object_get_string_member (root, "payload");
+    g_print ("%s\n", log_message);
+  }
+  else
+  {
+    g_print ("on_message: %s\n", message);
+  }
+
+  g_object_unref (parser);
+}
+
+static void
+on_signal (int signo)
+{
+  g_idle_add (stop, NULL);
+}
+
+static gboolean
+stop (gpointer user_data)
+{
+  g_main_loop_quit (loop);
+
+  return FALSE;
+}

package/releng/devkit-assets/frida-core-example.sln

@@ -0,0 +1,28 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 14
+VisualStudioVersion = 14.0.25420.1
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "frida-core-example", "frida-core-example.vcxproj", "{1A424DA8-5C62-4AEA-A1A9-465359E0C17D}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{1A424DA8-5C62-4AEA-A1A9-465359E0C17D}.Debug|x64.ActiveCfg = Debug|x64
+		{1A424DA8-5C62-4AEA-A1A9-465359E0C17D}.Debug|x64.Build.0 = Debug|x64
+		{1A424DA8-5C62-4AEA-A1A9-465359E0C17D}.Debug|x86.ActiveCfg = Debug|Win32
+		{1A424DA8-5C62-4AEA-A1A9-465359E0C17D}.Debug|x86.Build.0 = Debug|Win32
+		{1A424DA8-5C62-4AEA-A1A9-465359E0C17D}.Release|x64.ActiveCfg = Release|x64
+		{1A424DA8-5C62-4AEA-A1A9-465359E0C17D}.Release|x64.Build.0 = Release|x64
+		{1A424DA8-5C62-4AEA-A1A9-465359E0C17D}.Release|x86.ActiveCfg = Release|Win32
+		{1A424DA8-5C62-4AEA-A1A9-465359E0C17D}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

package/releng/devkit-assets/frida-core-example.vcxproj

@@ -0,0 +1,157 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{1A424DA8-5C62-4AEA-A1A9-465359E0C17D}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>fridacoreexample</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="frida-core-example.c" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="frida-core.h" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

package/releng/devkit-assets/frida-core-example.vcxproj.filters

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="frida-core-example.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="frida-core.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+  </ItemGroup>
+</Project>

package/releng/devkit-assets/frida-gum-example-unix.c

@@ -0,0 +1,122 @@
+#include "frida-gum.h"
+
+#include <fcntl.h>
+#include <unistd.h>
+
+typedef struct _ExampleListener ExampleListener;
+typedef enum _ExampleHookId ExampleHookId;
+
+struct _ExampleListener
+{
+  GObject parent;
+
+  guint num_calls;
+};
+
+enum _ExampleHookId
+{
+  EXAMPLE_HOOK_OPEN,
+  EXAMPLE_HOOK_CLOSE
+};
+
+static void example_listener_iface_init (gpointer g_iface, gpointer iface_data);
+
+#define EXAMPLE_TYPE_LISTENER (example_listener_get_type ())
+G_DECLARE_FINAL_TYPE (ExampleListener, example_listener, EXAMPLE, LISTENER, GObject)
+G_DEFINE_TYPE_EXTENDED (ExampleListener,
+                        example_listener,
+                        G_TYPE_OBJECT,
+                        0,
+                        G_IMPLEMENT_INTERFACE (GUM_TYPE_INVOCATION_LISTENER,
+                            example_listener_iface_init))
+
+int
+main (int argc,
+      char * argv[])
+{
+  GumInterceptor * interceptor;
+  GumInvocationListener * listener;
+
+  gum_init_embedded ();
+
+  interceptor = gum_interceptor_obtain ();
+  listener = g_object_new (EXAMPLE_TYPE_LISTENER, NULL);
+
+  gum_interceptor_begin_transaction (interceptor);
+  gum_interceptor_attach (interceptor,
+      GSIZE_TO_POINTER (gum_module_find_export_by_name (NULL, "open")),
+      listener,
+      GSIZE_TO_POINTER (EXAMPLE_HOOK_OPEN));
+  gum_interceptor_attach (interceptor,
+      GSIZE_TO_POINTER (gum_module_find_export_by_name (NULL, "close")),
+      listener,
+      GSIZE_TO_POINTER (EXAMPLE_HOOK_CLOSE));
+  gum_interceptor_end_transaction (interceptor);
+
+  close (open ("/etc/hosts", O_RDONLY));
+  close (open ("/etc/fstab", O_RDONLY));
+
+  g_print ("[*] listener got %u calls\n", EXAMPLE_LISTENER (listener)->num_calls);
+
+  gum_interceptor_detach (interceptor, listener);
+
+  close (open ("/etc/hosts", O_RDONLY));
+  close (open ("/etc/fstab", O_RDONLY));
+
+  g_print ("[*] listener still has %u calls\n", EXAMPLE_LISTENER (listener)->num_calls);
+
+  g_object_unref (listener);
+  g_object_unref (interceptor);
+
+  gum_deinit_embedded ();
+
+  return 0;
+}
+
+static void
+example_listener_on_enter (GumInvocationListener * listener,
+                           GumInvocationContext * ic)
+{
+  ExampleListener * self = EXAMPLE_LISTENER (listener);
+  ExampleHookId hook_id = GUM_IC_GET_FUNC_DATA (ic, ExampleHookId);
+
+  switch (hook_id)
+  {
+    case EXAMPLE_HOOK_OPEN:
+      g_print ("[*] open(\"%s\")\n", (const gchar *) gum_invocation_context_get_nth_argument (ic, 0));
+      break;
+    case EXAMPLE_HOOK_CLOSE:
+      g_print ("[*] close(%d)\n", GPOINTER_TO_INT (gum_invocation_context_get_nth_argument (ic, 0)));
+      break;
+  }
+
+  self->num_calls++;
+}
+
+static void
+example_listener_on_leave (GumInvocationListener * listener,
+                           GumInvocationContext * ic)
+{
+}
+
+static void
+example_listener_class_init (ExampleListenerClass * klass)
+{
+  (void) EXAMPLE_IS_LISTENER;
+  (void) glib_autoptr_cleanup_ExampleListener;
+}
+
+static void
+example_listener_iface_init (gpointer g_iface,
+                             gpointer iface_data)
+{
+  GumInvocationListenerInterface * iface = g_iface;
+
+  iface->on_enter = example_listener_on_enter;
+  iface->on_leave = example_listener_on_leave;
+}
+
+static void
+example_listener_init (ExampleListener * self)
+{
+}

package/releng/devkit-assets/frida-gum-example-windows.c

@@ -0,0 +1,132 @@
+/*
+ * To build, set up your Release configuration like this:
+ *
+ * [Runtime Library]
+ * Multi-threaded (/MT)
+ *
+ * Visit https://frida.re to learn more about Frida.
+ */
+
+#include "frida-gum.h"
+
+#include <windows.h>
+
+typedef struct _ExampleListener ExampleListener;
+typedef enum _ExampleHookId ExampleHookId;
+
+struct _ExampleListener
+{
+  GObject parent;
+
+  guint num_calls;
+};
+
+enum _ExampleHookId
+{
+  EXAMPLE_HOOK_MESSAGE_BEEP,
+  EXAMPLE_HOOK_SLEEP
+};
+
+static void example_listener_iface_init (gpointer g_iface, gpointer iface_data);
+
+#define EXAMPLE_TYPE_LISTENER (example_listener_get_type ())
+G_DECLARE_FINAL_TYPE (ExampleListener, example_listener, EXAMPLE, LISTENER, GObject)
+G_DEFINE_TYPE_EXTENDED (ExampleListener,
+                        example_listener,
+                        G_TYPE_OBJECT,
+                        0,
+                        G_IMPLEMENT_INTERFACE (GUM_TYPE_INVOCATION_LISTENER,
+                            example_listener_iface_init))
+
+int
+main (int argc,
+      char * argv[])
+{
+  GumInterceptor * interceptor;
+  GumInvocationListener * listener;
+
+  gum_init_embedded ();
+
+  interceptor = gum_interceptor_obtain ();
+  listener = g_object_new (EXAMPLE_TYPE_LISTENER, NULL);
+
+  gum_interceptor_begin_transaction (interceptor);
+  gum_interceptor_attach (interceptor,
+      GSIZE_TO_POINTER (gum_module_find_export_by_name ("user32.dll", "MessageBeep")),
+      listener,
+      GSIZE_TO_POINTER (EXAMPLE_HOOK_MESSAGE_BEEP));
+  gum_interceptor_attach (interceptor,
+      GSIZE_TO_POINTER (gum_module_find_export_by_name ("kernel32.dll", "Sleep")),
+      listener,
+      GSIZE_TO_POINTER (EXAMPLE_HOOK_SLEEP));
+  gum_interceptor_end_transaction (interceptor);
+
+  MessageBeep (MB_ICONINFORMATION);
+  Sleep (1);
+
+  g_print ("[*] listener got %u calls\n", EXAMPLE_LISTENER (listener)->num_calls);
+
+  gum_interceptor_detach (interceptor, listener);
+
+  MessageBeep (MB_ICONINFORMATION);
+  Sleep (1);
+
+  g_print ("[*] listener still has %u calls\n", EXAMPLE_LISTENER (listener)->num_calls);
+
+  g_object_unref (listener);
+  g_object_unref (interceptor);
+
+  gum_deinit_embedded ();
+
+  return 0;
+}
+
+static void
+example_listener_on_enter (GumInvocationListener * listener,
+                           GumInvocationContext * ic)
+{
+  ExampleListener * self = EXAMPLE_LISTENER (listener);
+  ExampleHookId hook_id = GUM_IC_GET_FUNC_DATA (ic, ExampleHookId);
+
+  switch (hook_id)
+  {
+    case EXAMPLE_HOOK_MESSAGE_BEEP:
+      g_print ("[*] MessageBeep(%u)\n", GPOINTER_TO_UINT (gum_invocation_context_get_nth_argument (ic, 0)));
+      break;
+    case EXAMPLE_HOOK_SLEEP:
+      g_print ("[*] Sleep(%u)\n", GPOINTER_TO_UINT (gum_invocation_context_get_nth_argument (ic, 0)));
+      break;
+  }
+
+  self->num_calls++;
+}
+
+static void
+example_listener_on_leave (GumInvocationListener * listener,
+                           GumInvocationContext * ic)
+{
+}
+
+static void
+example_listener_class_init (ExampleListenerClass * klass)
+{
+  (void) EXAMPLE_IS_LISTENER;
+#ifndef _MSC_VER
+  (void) glib_autoptr_cleanup_ExampleListener;
+#endif
+}
+
+static void
+example_listener_iface_init (gpointer g_iface,
+                             gpointer iface_data)
+{
+  GumInvocationListenerInterface * iface = g_iface;
+
+  iface->on_enter = example_listener_on_enter;
+  iface->on_leave = example_listener_on_leave;
+}
+
+static void
+example_listener_init (ExampleListener * self)
+{
+}

package/releng/devkit-assets/frida-gum-example.sln

@@ -0,0 +1,28 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 14
+VisualStudioVersion = 14.0.25420.1
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "frida-gum-example", "frida-gum-example.vcxproj", "{9EF5A94D-9907-4E7A-98E5-B03CB1750740}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{9EF5A94D-9907-4E7A-98E5-B03CB1750740}.Debug|x64.ActiveCfg = Debug|x64
+		{9EF5A94D-9907-4E7A-98E5-B03CB1750740}.Debug|x64.Build.0 = Debug|x64
+		{9EF5A94D-9907-4E7A-98E5-B03CB1750740}.Debug|x86.ActiveCfg = Debug|Win32
+		{9EF5A94D-9907-4E7A-98E5-B03CB1750740}.Debug|x86.Build.0 = Debug|Win32
+		{9EF5A94D-9907-4E7A-98E5-B03CB1750740}.Release|x64.ActiveCfg = Release|x64
+		{9EF5A94D-9907-4E7A-98E5-B03CB1750740}.Release|x64.Build.0 = Release|x64
+		{9EF5A94D-9907-4E7A-98E5-B03CB1750740}.Release|x86.ActiveCfg = Release|Win32
+		{9EF5A94D-9907-4E7A-98E5-B03CB1750740}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal