launchd posix spawn hookimg

frida-launchd-spawn.js

const readString = Memory.readUtf8String;
var readU32 = Memory.readU32;

var pid = ptr(0);
const SIGSTOP = 17;

const kill = new NativeFunction(
    Module.findExportByName(null, 'kill'),
    'int', [
      'int',
      'int'
    ]);

Interceptor.attach(Module.findExportByName('/usr/lib/system/libsystem_kernel.dylib', 'posix_spawn'), {
  onEnter: function (args) {
    pid = ptr(args[0]);
    this.name = readString(args[1]);
  },
  onLeave: function (ret) {
    const p = readU32(pid);
    if (this.name.indexOf('xpcproxy') !== -1) {
      console.log(ret, p);
      console.log('# kill -STOP ' + p + ' # ' + this.name);
      kill(p, SIGSTOP);
    }
  }
});