`Stalker` does not ensure the life-time of the transformer passed to `follow_me`.

[WorksButNotTested]

The transformer provided to Stalker.follow_me should remain in scope until the corresponding unfollow_me is called. It does not appear that this life-time constraint is described by the wrapper class here... https://github.com/frida/frida-rust/blob/c93bd2303b1f6be0813e6b4ad0c8b6e4b82fd9db/frida-gum/src/stalker.rs#L162

Perhaps the follow_me function should return a handle which calls unfollow_me when it falls out of scope and its Drop is called and whose lifetime is tied to the provided transformer? Or perhaps it is just simpler to ensure that the transformer outlives the stalker instance?

Its probably worth checking for other instances of the same issue elsewhere as I may have done the same for the observer stuff I was working on?

[domenukk]

If the transformer isn't used in other contexts (?), the function could also take transformer by value, and store it in the stalker struct

[meme]

I am not sure that it is simpler to ensure that the transformer outlives the stalker instance. Personally, I feel that follow_me returning some sort of cookie that is passed to unfollow_me is a good idea. It also ensures that unfollow_me cannot be called multiple times, or without a matching call to follow_me. If either of you are interested in implementing this feature, I am happy to review. Otherwise I can work on it when time permits.

[WorksButNotTested]

Also, does this line take a double-reference to the event-sink into the user_data? https://github.com/frida/frida-rust/blob/6d287d10c3f248c6d2e9fd1510d1313df1d44084/frida-gum/src/stalker/event_sink.rs#L142

I had a few problems when I copied the approach for the StalkerObserver and end up with something subtly different? https://github.com/frida/frida-rust/blob/6d287d10c3f248c6d2e9fd1510d1313df1d44084/frida-gum/src/stalker/observer.rs#L46

[domenukk]

Probably the function should just take a mut ptr directly(?) At least, accessing a &mut borrow from FFI can lead to UB if it's still used in rust afterwards (not sure if it ever is?)

[s1341]

Is this issue closed?

[WorksButNotTested]

I'm not sure. Looks like the PR which mentioned it above was closed and not merged?

[s1341]

do you mind taking a peek at the code to see if the issue has been fixed?

[WorksButNotTested]

From what I can see, it looks like these 3 APIs mentioned above might all have the same issue, that they take a parameter by reference and expect that it's lifetime extends beyond that of just the function call:

• Stalker
• EventSink
• Observer

[s1341]

Do you feel like taking a stab at a PR to fix them?