Crashing when using Stalker in frida-gum devkit for ARM64

[NguyenASang]

Device

Model: iPhoneX on iOS 16.7.8
Jailbreak tool: Palera1n

Issue

When I try to use Stalker to hook one specific instruction in app's binary, everything works perfectly fine, but SOON AFTER the hook finished (mean that the instruction won't be called in the future), the app will crash for unexpected reasons. I did try some old versions of Frida but nothing works and I guarantee that the address of the instruction provided is correct.

Here is the code:

static GumStalker *g_stalker = NULL;
static GumAddress g_target = 0;

static void on_insn_hit(GumCpuContext *ctx, gpointer user_data) {
    GumArm64CpuContext *arm64_ctx = (GumArm64CpuContext *)ctx;
    
    RLog(@"[*] x0: %s", arm64_ctx->x[0]);
    
    const char *empty = "";
    arm64_ctx->x[0] = (guint64)empty;
}

static void transform(GumStalkerIterator *iterator, GumStalkerOutput *output, gpointer user_data) {
    const cs_insn *insn;
    while (gum_stalker_iterator_next(iterator, &insn)) {
        if ((GumAddress)insn->address == g_target) {
            RLogW(@"[*] FOUND: %p - %s %s", (void *)insn->address, insn->mnemonic, insn->op_str);
            
            gum_stalker_iterator_put_callout(iterator, (GumStalkerCallout)on_insn_hit, NULL, NULL);
        }
        
        gum_stalker_iterator_keep(iterator);
    }
}

void install_hook(GumAddress addr) {    
    RLog(@"[*] Installing hook...");
    
    gum_init_embedded();
    g_stalker = gum_stalker_new();
    g_target = addr;
        
    GumStalkerTransformer *transformer = gum_stalker_transformer_make_from_callback(transform, NULL, NULL);
    gum_stalker_follow_me(g_stalker, transformer, NULL);

    RLog(@"[*] Hook installed!");
}

Here is the crashlog:

MyApp-2026-08-06-101522.txt

Additional info

As an alternative, I also try using DobbyInstrument to hook with the same technique and everything works fine (except the nczv is messed which is the thing I'm not happy about). You can take a look at their technique.

Besides, is there a safer and simpler way to achieve what I want ? maybe use Interceptor ?