Frida hook multiple processes

Question

There was such a situation. I run the frida hook on the process like this:

frida -f '..\hack2\hackme.exe'  -l .\start.js

In the script itself I do this

var moduleData = Process.getModuleByName("hackme.exe");

then comes the code which, as a result of which, I launch a function that launches another process - level2.exe.

It would be convenient if you could hook this process directly from this script. calling Process.findModuleByName("level2.exe"); is always null. The only way I see now is to write a Python script that will monitor the launch of the second process and run the hook in different threads. Perhaps there is a simpler solution without resorting to such extreme measures?

Answer 1

This is called child-gating and frida has a very good example

Here is a demo with a simple application. A simple C program with a fork and we try to hook puts for both child and parent.

(test3) [frida-example] cat test.c
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
int main() {
  puts("before");
  pid_t pid = fork();
  if (pid) {
    puts("parent");
  } else {
    puts("child");
  }
}
(test3) [frida-example] make test
cc     test.c   -o test

With the example - adding changes

    def _start(self):
        argv = ["./test"]
        print("✔ spawn(argv={})".format(argv))
        pid = self._device.spawn(argv, env={}, stdio='pipe')
        self._instrument(pid)

and

    def _instrument(self, pid):
        print("✔ attach(pid={})".format(pid))
        session = self._device.attach(pid)
        session.on("detached", lambda reason: self._reactor.schedule(lambda: self._on_detached(pid, session, reason)))
        print("✔ enable_child_gating()")
        session.enable_child_gating()
        print("✔ create_script()")
        script = session.create_script("""\
Interceptor.attach(Module.getExportByName(null, 'puts'), {
  onEnter: function (args) {
    send({
      type: 'puts',
      path: Memory.readUtf8String(args[0])
    });
  }
});
""")

then by running

(test3) [frida-example] python hook.py
✔ spawn(argv=['./test'])
✔ attach(pid=1968)
...
✔ resume(pid=1968)
⚡ message: pid=1968, payload={'type': 'puts', 'path': 'before'}
⚡ message: pid=1968, payload={'type': 'puts', 'path': 'parent'}
...
⚡ child_added: Child(pid=1977, parent_pid=1968, origin=fork)
✔ attach(pid=1977)
...
✔ resume(pid=1977)
⚡ child_removed: Child(pid=1977, parent_pid=1968, origin=fork)
⚡ message: pid=1977, payload={'type': 'puts', 'path': 'child'}
...
⚡ detached: pid=1977, reason='process-terminated'

We hooked both the instances of child and parent