aboutsummaryrefslogtreecommitdiff
path: root/frida_mode/src/persistent
diff options
context:
space:
mode:
authorWorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com>2021-04-28 09:25:26 +0100
committerGitHub <noreply@github.com>2021-04-28 10:25:26 +0200
commit39ad3b89467d6de12cbb9d08ccd77d331c0d1f9e (patch)
tree18bdf509d47e0d971bd9d7faf56d27758b23b09c /frida_mode/src/persistent
parent8da5cba4012080afca5e7f7da9aaa6aa6e263f3e (diff)
downloadafl++-39ad3b89467d6de12cbb9d08ccd77d331c0d1f9e.tar.gz
Frida persistent (#880)
* Added x64 support for persistent mode (function call only), in-memory teest cases and complog * Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC * Various minor fixes and finished support for AFL_INST_LIBS * Review changes Co-authored-by: Your Name <you@example.com>
Diffstat (limited to 'frida_mode/src/persistent')
-rw-r--r--frida_mode/src/persistent/persistent.c68
-rw-r--r--frida_mode/src/persistent/persistent_arm32.c70
-rw-r--r--frida_mode/src/persistent/persistent_arm64.c113
-rw-r--r--frida_mode/src/persistent/persistent_x64.c337
-rw-r--r--frida_mode/src/persistent/persistent_x86.c53
5 files changed, 641 insertions, 0 deletions
diff --git a/frida_mode/src/persistent/persistent.c b/frida_mode/src/persistent/persistent.c
new file mode 100644
index 00000000..fe3a1d20
--- /dev/null
+++ b/frida_mode/src/persistent/persistent.c
@@ -0,0 +1,68 @@
+#include <dlfcn.h>
+
+#include "frida-gum.h"
+
+#include "config.h"
+#include "debug.h"
+
+#include "persistent.h"
+#include "util.h"
+
+int __afl_sharedmem_fuzzing = 0;
+afl_persistent_hook_fn hook = NULL;
+guint64 persistent_start = 0;
+guint64 persistent_count = 0;
+
+void persistent_init(void) {
+
+ char *hook_name = getenv("AFL_FRIDA_PERSISTENT_HOOK");
+
+ persistent_start = util_read_address("AFL_FRIDA_PERSISTENT_ADDR");
+ persistent_count = util_read_num("AFL_FRIDA_PERSISTENT_CNT");
+
+ if (persistent_count != 0 && persistent_start == 0)
+ FATAL(
+ "AFL_FRIDA_PERSISTENT_ADDR must be specified if "
+ "AFL_FRIDA_PERSISTENT_CNT is");
+
+ if (persistent_start != 0 && persistent_count == 0) persistent_count = 1000;
+
+ if (persistent_count != 0 && persistent_count < 100)
+ WARNF("Persistent count out of recommended range (<100)");
+
+ if (persistent_count > 10000)
+ WARNF("Persistent count out of recommended range (<10000)");
+
+ if (persistent_start != 0 && !persistent_is_supported())
+ FATAL("Persistent mode not supported on this architecture");
+
+ OKF("Instrumentation - persistent mode [%c] (0x%016lX)",
+ persistent_start == 0 ? ' ' : 'X', persistent_start);
+ OKF("Instrumentation - persistent count [%c] (%ld)",
+ persistent_start == 0 ? ' ' : 'X', persistent_count);
+ OKF("Instrumentation - hook [%s]", hook_name);
+
+ if (hook_name != NULL) {
+
+ void *hook_obj = dlopen(hook_name, RTLD_NOW);
+ if (hook_obj == NULL)
+ FATAL("Failed to load AFL_FRIDA_PERSISTENT_HOOK (%s)", hook_name);
+
+ int (*afl_persistent_hook_init_ptr)(void) =
+ dlsym(hook_obj, "afl_persistent_hook_init");
+ if (afl_persistent_hook_init_ptr == NULL)
+ FATAL("Failed to find afl_persistent_hook_init in %s", hook_name);
+
+ if (afl_persistent_hook_init_ptr() == 0)
+ FATAL("afl_persistent_hook_init returned a failure");
+
+ hook = (afl_persistent_hook_fn)dlsym(hook_obj, "afl_persistent_hook");
+ if (hook == NULL)
+ FATAL("Failed to find afl_persistent_hook in %s", hook_name);
+
+ __afl_sharedmem_fuzzing = 1;
+
+ }
+
+}
+
diff --git a/frida_mode/src/persistent/persistent_arm32.c b/frida_mode/src/persistent/persistent_arm32.c
new file mode 100644
index 00000000..10dab3b2
--- /dev/null
+++ b/frida_mode/src/persistent/persistent_arm32.c
@@ -0,0 +1,70 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "persistent.h"
+
+#if defined(__arm__)
+
+struct arm_regs {
+
+ uint32_t r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10;
+
+ union {
+
+ uint32_t r11;
+ uint32_t fp;
+
+ };
+
+ union {
+
+ uint32_t r12;
+ uint32_t ip;
+
+ };
+
+ union {
+
+ uint32_t r13;
+ uint32_t sp;
+
+ };
+
+ union {
+
+ uint32_t r14;
+ uint32_t lr;
+
+ };
+
+ union {
+
+ uint32_t r15;
+ uint32_t pc;
+
+ };
+
+ uint32_t cpsr;
+
+ uint8_t vfp_zregs[32][16];
+ uint32_t vfp_xregs[16];
+
+};
+
+typedef struct arm_regs arch_api_regs;
+
+gboolean persistent_is_supported(void) {
+
+ return false;
+
+}
+
+void persistent_prologue(GumStalkerOutput *output) {
+
+ FATAL("Persistent mode not supported on this architecture");
+
+}
+
+#endif
+
diff --git a/frida_mode/src/persistent/persistent_arm64.c b/frida_mode/src/persistent/persistent_arm64.c
new file mode 100644
index 00000000..5a18ac2c
--- /dev/null
+++ b/frida_mode/src/persistent/persistent_arm64.c
@@ -0,0 +1,113 @@
+#include "frida-gum.h"
+
+#include "config.h"
+#include "debug.h"
+
+#include "instrument.h"
+
+#if defined(__aarch64__)
+
+struct arm64_regs {
+
+ uint64_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10;
+
+ union {
+
+ uint64_t x11;
+ uint32_t fp_32;
+
+ };
+
+ union {
+
+ uint64_t x12;
+ uint32_t ip_32;
+
+ };
+
+ union {
+
+ uint64_t x13;
+ uint32_t sp_32;
+
+ };
+
+ union {
+
+ uint64_t x14;
+ uint32_t lr_32;
+
+ };
+
+ union {
+
+ uint64_t x15;
+ uint32_t pc_32;
+
+ };
+
+ union {
+
+ uint64_t x16;
+ uint64_t ip0;
+
+ };
+
+ union {
+
+ uint64_t x17;
+ uint64_t ip1;
+
+ };
+
+ uint64_t x18, x19, x20, x21, x22, x23, x24, x25, x26, x27, x28;
+
+ union {
+
+ uint64_t x29;
+ uint64_t fp;
+
+ };
+
+ union {
+
+ uint64_t x30;
+ uint64_t lr;
+
+ };
+
+ union {
+
+ uint64_t x31;
+ uint64_t sp;
+
+ };
+
+ // the zero register is not saved here ofc
+
+ uint64_t pc;
+
+ uint32_t cpsr;
+
+ uint8_t vfp_zregs[32][16 * 16];
+ uint8_t vfp_pregs[17][32];
+ uint32_t vfp_xregs[16];
+
+};
+
+typedef struct arm64_regs arch_api_regs;
+
+gboolean persistent_is_supported(void) {
+
+ return false;
+
+}
+
+void persistent_prologue(GumStalkerOutput *output) {
+
+ FATAL("Persistent mode not supported on this architecture");
+
+}
+
+#endif
+
diff --git a/frida_mode/src/persistent/persistent_x64.c b/frida_mode/src/persistent/persistent_x64.c
new file mode 100644
index 00000000..0cabbf24
--- /dev/null
+++ b/frida_mode/src/persistent/persistent_x64.c
@@ -0,0 +1,337 @@
+#include "frida-gum.h"
+
+#include "config.h"
+
+#include "instrument.h"
+#include "persistent.h"
+
+#if defined(__x86_64__)
+
+struct x86_64_regs {
+
+ uint64_t rax, rbx, rcx, rdx, rdi, rsi, rbp, r8, r9, r10, r11, r12, r13, r14,
+ r15;
+
+ union {
+
+ uint64_t rip;
+ uint64_t pc;
+
+ };
+
+ union {
+
+ uint64_t rsp;
+ uint64_t sp;
+
+ };
+
+ union {
+
+ uint64_t rflags;
+ uint64_t flags;
+
+ };
+
+ uint8_t zmm_regs[32][64];
+
+};
+
+typedef struct x86_64_regs arch_api_regs;
+
+static arch_api_regs saved_regs = {0};
+static void * saved_return = NULL;
+
+gboolean persistent_is_supported(void) {
+
+ return true;
+
+}
+
+static void instrument_persitent_save_regs(GumX86Writer * cw,
+ struct x86_64_regs *regs) {
+
+ GumAddress regs_address = GUM_ADDRESS(regs);
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ -(GUM_RED_ZONE_SIZE));
+
+ /* Should be pushing FPU here, but meh */
+ gum_x86_writer_put_pushfx(cw);
+ gum_x86_writer_put_push_reg(cw, GUM_REG_RAX);
+
+ gum_x86_writer_put_mov_reg_address(cw, GUM_REG_RAX, regs_address);
+
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 1),
+ GUM_REG_RBX);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 2),
+ GUM_REG_RCX);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 3),
+ GUM_REG_RDX);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 4),
+ GUM_REG_RDI);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 5),
+ GUM_REG_RSI);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 6),
+ GUM_REG_RBP);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 7),
+ GUM_REG_R8);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 8),
+ GUM_REG_R9);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 9),
+ GUM_REG_R10);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 10),
+ GUM_REG_R11);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 11),
+ GUM_REG_R12);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 12),
+ GUM_REG_R13);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 13),
+ GUM_REG_R14);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 14),
+ GUM_REG_R15);
+
+ /* Store RIP */
+ gum_x86_writer_put_mov_reg_address(cw, GUM_REG_RBX,
+ GUM_ADDRESS(persistent_start));
+
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 15),
+ GUM_REG_RBX);
+
+ /* Store adjusted RSP */
+ gum_x86_writer_put_mov_reg_reg(cw, GUM_REG_RBX, GUM_REG_RSP);
+
+ /* RED_ZONE + Saved flags, RAX, alignment */
+ gum_x86_writer_put_add_reg_imm(cw, GUM_REG_RBX,
+ GUM_RED_ZONE_SIZE + (0x8 * 3));
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 16),
+ GUM_REG_RBX);
+
+ /* Save the flags */
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RBX, GUM_REG_RSP, 0x8);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 17),
+ GUM_REG_RBX);
+
+ /* Save the RAX */
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RBX, GUM_REG_RSP, 0x0);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, (0x8 * 0),
+ GUM_REG_RBX);
+
+ /* Pop the saved values */
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP, 0x10);
+
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ (GUM_RED_ZONE_SIZE));
+
+}
+
+static void instrument_persitent_restore_regs(GumX86Writer * cw,
+ struct x86_64_regs *regs) {
+
+ GumAddress regs_address = GUM_ADDRESS(regs);
+ gum_x86_writer_put_mov_reg_address(cw, GUM_REG_RAX, regs_address);
+
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RCX, GUM_REG_RAX,
+ (0x8 * 2));
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RDX, GUM_REG_RAX,
+ (0x8 * 3));
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RDI, GUM_REG_RAX,
+ (0x8 * 4));
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RSI, GUM_REG_RAX,
+ (0x8 * 5));
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RBP, GUM_REG_RAX,
+ (0x8 * 6));
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_R8, GUM_REG_RAX,
+ (0x8 * 7));
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_R9, GUM_REG_RAX,
+ (0x8 * 8));
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_R10, GUM_REG_RAX,
+ (0x8 * 9));
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_R11, GUM_REG_RAX,
+ (0x8 * 10));
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_R12, GUM_REG_RAX,
+ (0x8 * 11));
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_R13, GUM_REG_RAX,
+ (0x8 * 12));
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_R14, GUM_REG_RAX,
+ (0x8 * 13));
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_R15, GUM_REG_RAX,
+ (0x8 * 14));
+
+ /* Don't restore RIP or RSP */
+
+ /* Restore RBX, RAX & Flags */
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ -(GUM_RED_ZONE_SIZE));
+
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RBX, GUM_REG_RAX,
+ (0x8 * 1));
+ gum_x86_writer_put_push_reg(cw, GUM_REG_RBX);
+
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RBX, GUM_REG_RAX,
+ (0x8 * 0));
+ gum_x86_writer_put_push_reg(cw, GUM_REG_RBX);
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RBX, GUM_REG_RAX,
+ (0x8 * 17));
+ gum_x86_writer_put_push_reg(cw, GUM_REG_RBX);
+
+ gum_x86_writer_put_popfx(cw);
+ gum_x86_writer_put_pop_reg(cw, GUM_REG_RAX);
+ gum_x86_writer_put_pop_reg(cw, GUM_REG_RBX);
+
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ (GUM_RED_ZONE_SIZE));
+
+}
+
+static void instrument_save_ret(GumX86Writer *cw, void **saved_return_ptr) {
+
+ GumAddress saved_return_address = GUM_ADDRESS(saved_return_ptr);
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ -(GUM_RED_ZONE_SIZE));
+ gum_x86_writer_put_push_reg(cw, GUM_REG_RAX);
+ gum_x86_writer_put_push_reg(cw, GUM_REG_RBX);
+
+ gum_x86_writer_put_mov_reg_address(cw, GUM_REG_RAX, saved_return_address);
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RBX, GUM_REG_RSP,
+ GUM_RED_ZONE_SIZE + 0x10);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RAX, 0, GUM_REG_RBX);
+
+ gum_x86_writer_put_pop_reg(cw, GUM_REG_RBX);
+ gum_x86_writer_put_pop_reg(cw, GUM_REG_RAX);
+
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ (GUM_RED_ZONE_SIZE));
+
+}
+
+static void instrument_jump_ret(GumX86Writer *cw, void **saved_return_ptr) {
+
+ GumAddress saved_return_address = GUM_ADDRESS(saved_return_ptr);
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ -(GUM_RED_ZONE_SIZE));
+
+ /* Place holder for ret */
+ gum_x86_writer_put_push_reg(cw, GUM_REG_RAX);
+ gum_x86_writer_put_push_reg(cw, GUM_REG_RAX);
+
+ gum_x86_writer_put_mov_reg_address(cw, GUM_REG_RAX, saved_return_address);
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RAX, GUM_REG_RAX, 0);
+
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_RSP, 0x8, GUM_REG_RAX);
+ gum_x86_writer_put_pop_reg(cw, GUM_REG_RAX);
+ gum_x86_writer_put_ret_imm(cw, GUM_RED_ZONE_SIZE);
+
+}
+
+static int instrument_afl_persistent_loop_func(void) {
+
+ int ret = __afl_persistent_loop(persistent_count);
+ previous_pc = 0;
+ return ret;
+
+}
+
+static int instrument_afl_persistent_loop(GumX86Writer *cw) {
+
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ -(GUM_RED_ZONE_SIZE));
+ gum_x86_writer_put_call_address_with_arguments(
+ cw, GUM_CALL_CAPI, GUM_ADDRESS(instrument_afl_persistent_loop_func), 0);
+ gum_x86_writer_put_test_reg_reg(cw, GUM_REG_RAX, GUM_REG_RAX);
+
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ (GUM_RED_ZONE_SIZE));
+
+}
+
+static void persistent_prologue_hook(GumX86Writer * cw,
+ struct x86_64_regs *regs) {
+
+ if (hook == NULL) return;
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ -(GUM_RED_ZONE_SIZE));
+
+ gum_x86_writer_put_mov_reg_address(cw, GUM_REG_RCX,
+ GUM_ADDRESS(__afl_fuzz_len));
+ gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RCX, GUM_REG_RCX, 0);
+ gum_x86_writer_put_mov_reg_u64(cw, GUM_REG_RDI, 0xffffffff);
+ gum_x86_writer_put_and_reg_reg(cw, GUM_REG_RCX, GUM_REG_RDI);
+
+ gum_x86_writer_put_call_address_with_arguments(
+ cw, GUM_CALL_CAPI, GUM_ADDRESS(hook), 4, GUM_ARG_ADDRESS,
+ GUM_ADDRESS(regs), GUM_ARG_ADDRESS, GUM_ADDRESS(0), GUM_ARG_ADDRESS,
+ GUM_ADDRESS(__afl_fuzz_ptr), GUM_ARG_REGISTER, GUM_REG_RCX);
+
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ (GUM_RED_ZONE_SIZE));
+
+}
+
+void persistent_prologue(GumStalkerOutput *output) {
+
+ /*
+ * SAVE REGS
+ * SAVE RET
+ * POP RET
+ * loop:
+ * CALL instrument_afl_persistent_loop
+ * TEST EAX, EAX
+ * JZ end:
+ * call hook (optionally)
+ * RESTORE REGS
+ * call original
+ * jmp loop:
+ *
+ * end:
+ * JMP SAVED RET
+ *
+ * original:
+ * INSTRUMENTED PERSISTENT FUNC
+ */
+
+ GumX86Writer *cw = output->writer.x86;
+
+ gconstpointer loop = cw->code + 1;
+ // gum_x86_writer_put_breakpoint(cw);
+
+ /* Stack must be 16-byte aligned per ABI */
+ instrument_persitent_save_regs(cw, &saved_regs);
+
+ /* Stash and pop the return value */
+ instrument_save_ret(cw, &saved_return);
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP, (8));
+
+ /* loop: */
+ gum_x86_writer_put_label(cw, loop);
+
+ /* call instrument_prologue_func */
+ instrument_afl_persistent_loop(cw);
+
+ /* jz done */
+ gconstpointer done = cw->code + 1;
+ gum_x86_writer_put_jcc_near_label(cw, X86_INS_JE, done, GUM_UNLIKELY);
+
+ /* Optionally call the persistent hook */
+ persistent_prologue_hook(cw, &saved_regs);
+
+ instrument_persitent_restore_regs(cw, &saved_regs);
+ gconstpointer original = cw->code + 1;
+ /* call original */
+ gum_x86_writer_put_call_near_label(cw, original);
+ /* jmp loop */
+ gum_x86_writer_put_jmp_near_label(cw, loop);
+
+ /* done: */
+ gum_x86_writer_put_label(cw, done);
+
+ instrument_jump_ret(cw, &saved_return);
+
+ /* original: */
+ gum_x86_writer_put_label(cw, original);
+
+ gum_x86_writer_flush(cw);
+
+}
+
+#endif
+
diff --git a/frida_mode/src/persistent/persistent_x86.c b/frida_mode/src/persistent/persistent_x86.c
new file mode 100644
index 00000000..4daa61a9
--- /dev/null
+++ b/frida_mode/src/persistent/persistent_x86.c
@@ -0,0 +1,53 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "persistent.h"
+
+#if defined(__i386__)
+
+struct x86_regs {
+
+ uint32_t eax, ebx, ecx, edx, edi, esi, ebp;
+
+ union {
+
+ uint32_t eip;
+ uint32_t pc;
+
+ };
+
+ union {
+
+ uint32_t esp;
+ uint32_t sp;
+
+ };
+
+ union {
+
+ uint32_t eflags;
+ uint32_t flags;
+
+ };
+
+ uint8_t xmm_regs[8][16];
+
+};
+
+typedef struct x86_regs arch_api_regs;
+
+gboolean persistent_is_supported(void) {
+
+ return false;
+
+}
+
+void persistent_prologue(GumStalkerOutput *output) {
+
+ FATAL("Persistent mode not supported on this architecture");
+
+}
+
+#endif
+