Inject module to WebContent process

launcher.py

#!/usr/local/bin/python3

import sys
import os
import base64
import frida


def main():
    host = frida.get_local_device()
    if len(sys.argv) == 2:
        pid = int(sys.argv[1])
    else:
        try:
            pid = next(proc.pid for proc in host.enumerate_processes()
                       if proc.name == 'Safari Web Content')
        except StopIteration as e:
            print('Fatal error: WebContent not found')
            return

    print('target pid:', pid)

    with open(os.environ['DYLIB'], 'rb') as fp:
        buf = fp.read()

    encoded = base64.b64encode(buf).decode('ascii')
    session = host.attach(pid)
    script = session.create_script('''
        rpc.exports = {
            run: function(bundle) {
                const NSObjectFileImageReturnCode = [
                    'NSObjectFileImageFailure',
                    'NSObjectFileImageSuccess',
                    'NSObjectFileImageInappropriateFile',
                    'NSObjectFileImageArch',
                    'NSObjectFileImageFormat',
                    'NSObjectFileImageAccess'
                ];
                const NSLINKMODULE_OPTION_BINDNOW = 1;
                const NSCreateObjectFileImageFromMemory = new NativeFunction(Module.findExportByName(
                    'dyld', 'NSCreateObjectFileImageFromMemory'), 'int', ['pointer', 'uint', 'pointer'])
                const NSLinkModule = new NativeFunction(Module.findExportByName(
                    'dyld', 'NSLinkModule'), 'pointer', ['pointer', 'pointer', 'int']);

                const data = ObjC.classes.NSData.alloc().initWithBase64EncodedString_options_(bundle, 0);
                const mod = Memory.alloc(Process.pointerSize);
                const status = NSCreateObjectFileImageFromMemory(data.bytes(), data.length().valueOf(), mod);
                if (status !== 1) {
                    console.log('could not create object file: ' + NSObjectFileImageReturnCode[status]);
                    return -1;
                }
                const path = Memory.allocUtf8String('eop');
                NSLinkModule(Memory.readPointer(mod), path, NSLINKMODULE_OPTION_BINDNOW);
                data.release();
                return 0;
            }
        }
    ''')

    script.load()
    if script.exports.run(encoded) == 0:
        print('done')
    else:
        print('error happended during module injection')

    session.detach()


if __name__ == '__main__':
    main()

test.m

/*
  cc test.m -bundle -framework Foundation -o test.dylib
  DYLIB=test.dylib python3 inject.py
*/

#import <Foundation/Foundation.h>


__attribute__((constructor)) void entry()
{
  NSLog(@"greet from %d (%s)", getpid(), getprogname());
}