Tim W
1211 lines
35 KiB
C++
1211 lines
35 KiB
C++
//
|
|
// offsetfinder64.cpp
|
|
// offsetfinder64
|
|
//
|
|
// Created by tihmstar on 10.01.18.
|
|
// Copyright © 2018 tihmstar. All rights reserved.
|
|
//
|
|
|
|
#include "liboffsetfinder64.hpp"
|
|
|
|
#define LOCAL_FILENAME "liboffsetfinder.cpp"
|
|
#include "all_liboffsetfinder.hpp"
|
|
|
|
extern "C"{
|
|
#include <stdio.h>
|
|
#include <fcntl.h>
|
|
#include <sys/stat.h>
|
|
#include <unistd.h>
|
|
#include <string.h>
|
|
#include "img4.h"
|
|
}
|
|
|
|
using namespace std;
|
|
using namespace tihmstar;
|
|
using namespace patchfinder64;
|
|
|
|
#pragma mark liboffsetfinder
|
|
|
|
#define HAS_BITS(a,b) (((a) & (b)) == (b))
|
|
#define _symtab getSymtab()
|
|
|
|
#define findstr(str,hasNullTerminator) memmem(str, sizeof(str)-(hasNullTerminator == 0))
|
|
|
|
#pragma mark macho external
|
|
|
|
__attribute__((always_inline)) struct load_command *find_load_command64(struct mach_header_64 *mh, uint32_t lc){
|
|
struct load_command *lcmd = (struct load_command *)(mh + 1);
|
|
for (uint32_t i=0; i<mh->ncmds; i++, lcmd = (struct load_command *)((uint8_t *)lcmd + lcmd->cmdsize)) {
|
|
if (lcmd->cmd == lc)
|
|
return lcmd;
|
|
}
|
|
|
|
retcustomerror(lc,load_command_not_found);
|
|
return NULL;
|
|
}
|
|
|
|
__attribute__((always_inline)) struct symtab_command *find_symtab_command(struct mach_header_64 *mh){
|
|
return (struct symtab_command *)find_load_command64(mh, LC_SYMTAB);
|
|
}
|
|
|
|
__attribute__((always_inline)) struct dysymtab_command *find_dysymtab_command(struct mach_header_64 *mh){
|
|
return (struct dysymtab_command *)find_load_command64(mh, LC_DYSYMTAB);
|
|
}
|
|
|
|
__attribute__((always_inline)) struct section_64 *find_section(struct segment_command_64 *seg, const char *sectname){
|
|
struct section_64 *sect = (struct section_64 *)(seg + 1);
|
|
for (uint32_t i=0; i<seg->nsects; i++, sect++) {
|
|
if (strcmp(sect->sectname, sectname) == 0)
|
|
return sect;
|
|
}
|
|
reterror("Failed to find section "+ string(sectname));
|
|
return NULL;
|
|
}
|
|
|
|
offsetfinder64::offsetfinder64(const char* filename, uint64_t kslide, tristate haveSymbols) :
|
|
_freeKernel(true),
|
|
__symtab(NULL),
|
|
_kslide(kslide),
|
|
_haveSymtab(haveSymbols)
|
|
{
|
|
struct stat fs = {0};
|
|
int fd = 0;
|
|
char *img4tmp = NULL;
|
|
auto clean =[&]{
|
|
if (fd>0) close(fd);
|
|
};
|
|
assure((fd = open(filename, O_RDONLY)) != -1);
|
|
assureclean(!fstat(fd, &fs));
|
|
assureclean((_kdata = (uint8_t*)malloc( _ksize = fs.st_size)));
|
|
assureclean(read(fd,_kdata,_ksize)==_ksize);
|
|
|
|
//check if feedfacf, fat, compressed (lzfse/lzss), img4, im4p
|
|
img4tmp = (char*)_kdata;
|
|
if (sequenceHasName(img4tmp, (char*)"IMG4")){
|
|
img4tmp = getElementFromIMG4((char*)_kdata, (char*)"IM4P");
|
|
}
|
|
if (sequenceHasName(img4tmp, (char*)"IM4P")){
|
|
char *extracted = NULL;
|
|
{
|
|
size_t klen;
|
|
const char* compname;
|
|
|
|
extracted = extractPayloadFromIM4P(img4tmp, &compname, &klen);
|
|
|
|
if (compname) {
|
|
//printf("%s comp detected, uncompressing : %s ...\n", compname, extracted ? "success" : "failure");
|
|
}
|
|
}
|
|
if (extracted != NULL) {
|
|
free(_kdata);
|
|
_kdata = (uint8_t*)extracted;
|
|
}
|
|
}
|
|
|
|
if (*(uint32_t*)_kdata == 0xbebafeca || *(uint32_t*)_kdata == 0xcafebabe) {
|
|
bool swap = *(uint32_t*)_kdata == 0xbebafeca;
|
|
|
|
uint8_t* tryfat = [=]() -> uint8_t* {
|
|
// just select first slice
|
|
uint32_t* kdata32 = (uint32_t*) _kdata;
|
|
uint32_t narch = kdata32[1];
|
|
if (swap) narch = ntohl(narch);
|
|
|
|
if (narch != 1) {
|
|
printf("expected 1 arch in fat file, got %u\n", narch);
|
|
return NULL;
|
|
}
|
|
|
|
uint32_t offset = kdata32[2 + 2];
|
|
if (swap) offset = ntohl(offset);
|
|
|
|
if (offset != sizeof(uint32_t)*(2 + 5)) {
|
|
printf("wat, file offset not sizeof(fat_header) + sizeof(fat_arch)?!\n");
|
|
}
|
|
|
|
uint32_t filesize = kdata32[2 + 3];
|
|
if (swap) filesize = ntohl(filesize);
|
|
|
|
uint8_t *ret = (uint8_t*) malloc(filesize);
|
|
if (ret != NULL) {
|
|
memcpy(ret, _kdata + offset, filesize);
|
|
}
|
|
return ret;
|
|
}();
|
|
|
|
if (tryfat != NULL) {
|
|
printf("got fat macho with first slice at %u\n", (uint32_t) (tryfat - _kdata));
|
|
free(_kdata);
|
|
_kdata = tryfat;
|
|
} else {
|
|
printf("got fat macho but failed to parse\n");
|
|
}
|
|
}
|
|
|
|
assureclean(*(uint32_t*)_kdata == 0xfeedfacf);
|
|
|
|
loadSegments();
|
|
clean();
|
|
}
|
|
|
|
void offsetfinder64::loadSegments(){
|
|
struct mach_header_64 *mh = (struct mach_header_64*)_kdata;
|
|
struct load_command *lcmd = (struct load_command *)(mh + 1);
|
|
for (uint32_t i=0; i<mh->ncmds; i++, lcmd = (struct load_command *)((uint8_t *)lcmd + lcmd->cmdsize)) {
|
|
if (lcmd->cmd == LC_SEGMENT_64){
|
|
struct segment_command_64* seg = (struct segment_command_64*)lcmd;
|
|
_segments.push_back({_kdata+seg->fileoff,seg->filesize, (loc_t)seg->vmaddr, (seg->maxprot & VM_PROT_EXECUTE) !=0});
|
|
if (i==0){
|
|
_kernel_base = _segments.back().base; //first segment is base. Is this correct??
|
|
}
|
|
}
|
|
if (lcmd->cmd == LC_UNIXTHREAD) {
|
|
uint32_t *ptr = (uint32_t *)(lcmd + 1);
|
|
uint32_t flavor = ptr[0];
|
|
struct _tread{
|
|
uint64_t x[29]; /* General purpose registers x0-x28 */
|
|
uint64_t fp; /* Frame pointer x29 */
|
|
uint64_t lr; /* Link register x30 */
|
|
uint64_t sp; /* Stack pointer x31 */
|
|
uint64_t pc; /* Program counter */
|
|
uint32_t cpsr; /* Current program status register */
|
|
} *thread = (struct _tread*)(ptr + 2);
|
|
if (flavor == 6) {
|
|
_kernel_entry = (patchfinder64::loc_t)(thread->pc);
|
|
}
|
|
}
|
|
}
|
|
|
|
try {
|
|
deref(_kernel_entry);
|
|
//info("Detected non-slid kernel.");
|
|
_kernelIsSlid = false;
|
|
} catch (tihmstar::out_of_range &e) {
|
|
info("Detected slid kernel. Using kernelslide=%p",(void*)_kslide);
|
|
_kernel_entry += _kslide;
|
|
_kernelIsSlid = true;
|
|
}
|
|
try {
|
|
deref(_kernel_entry);
|
|
} catch (tihmstar::out_of_range &e) {
|
|
reterror("Error occured when handling kernel entry checks");
|
|
}
|
|
|
|
//info("Inited offsetfinder64 %s %s",OFFSETFINDER64_VERSION_COMMIT_COUNT, OFFSETFINDER64_VERSION_COMMIT_SHA);
|
|
try {
|
|
getSymtab();
|
|
} catch (tihmstar::symtab_not_found &e) {
|
|
info("Symtab not found. Assuming we are operating on a dumped kernel");
|
|
}
|
|
//printf("\n");
|
|
}
|
|
|
|
offsetfinder64::offsetfinder64(void* buf, size_t size, uint64_t kslide, tristate haveSymbols) :
|
|
_freeKernel(false),
|
|
_kdata((uint8_t*)buf),
|
|
_ksize(size),
|
|
__symtab(NULL),
|
|
_kslide(kslide),
|
|
_haveSymtab(haveSymbols)
|
|
{
|
|
loadSegments();
|
|
}
|
|
|
|
const void *offsetfinder64::kdata(){
|
|
return _kdata;
|
|
}
|
|
|
|
loc_t offsetfinder64::find_entry(){
|
|
return _kernel_entry;
|
|
}
|
|
|
|
loc_t offsetfinder64::find_base(){
|
|
return _kernel_base;
|
|
}
|
|
|
|
bool offsetfinder64::haveSymbols(){
|
|
if (_haveSymtab == kuninitialized) {
|
|
try {
|
|
getSymtab();
|
|
_haveSymtab = ktrue;
|
|
} catch (tihmstar::symtab_not_found &e) {
|
|
_haveSymtab = kfalse;
|
|
}
|
|
}
|
|
return _haveSymtab;
|
|
}
|
|
|
|
#pragma mark macho offsetfinder
|
|
__attribute__((always_inline)) struct symtab_command *offsetfinder64::getSymtab(){
|
|
if (!__symtab){
|
|
try {
|
|
__symtab = find_symtab_command((struct mach_header_64 *)_kdata);
|
|
} catch (tihmstar::load_command_not_found &e) {
|
|
if (e.cmd() != LC_SYMTAB)
|
|
throw;
|
|
retcustomerror("symtab not found. Is this a dumped kernel?", symtab_not_found);
|
|
}
|
|
}
|
|
return __symtab;
|
|
}
|
|
|
|
#pragma mark offsetfidner
|
|
|
|
loc_t offsetfinder64::memmem(const void *little, size_t little_len){
|
|
for (auto seg : _segments) {
|
|
if (loc_t rt = (loc_t)::memmem(seg.map, seg.size, little, little_len)) {
|
|
return rt-seg.map+seg.base;
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
uint64_t offsetfinder64::deref(loc_t pos){
|
|
return insn::deref(_segments,pos);
|
|
}
|
|
|
|
loc_t offsetfinder64::find_sym(const char *sym){
|
|
uint8_t *psymtab = _kdata + _symtab->symoff;
|
|
uint8_t *pstrtab = _kdata + _symtab->stroff;
|
|
|
|
struct nlist_64 *entry = (struct nlist_64 *)psymtab;
|
|
for (uint32_t i = 0; i < _symtab->nsyms; i++, entry++)
|
|
if (!strcmp(sym, (char*)(pstrtab + entry->n_un.n_strx)))
|
|
return (loc_t)entry->n_value;
|
|
|
|
return 0;
|
|
}
|
|
|
|
loc_t offsetfinder64::find_syscall0(){
|
|
constexpr char sig_syscall_3[] = "\x06\x00\x00\x00\x03\x00\x0c\x00";
|
|
loc_t sys3 = memmem(sig_syscall_3, sizeof(sig_syscall_3)-1);
|
|
return sys3 - (3 * 0x18) + 0x8;
|
|
}
|
|
|
|
|
|
#pragma mark patchfinder64
|
|
|
|
namespace tihmstar{
|
|
namespace patchfinder64{
|
|
|
|
loc_t jump_stub_call_ptr_loc(insn bl_insn){
|
|
assure(bl_insn == insn::bl);
|
|
insn fdst(bl_insn,(loc_t)bl_insn.imm());
|
|
insn ldr((fdst+1));
|
|
if (!((fdst == insn::adrp && ldr == insn::ldr && (fdst+2) == insn::br))) {
|
|
retcustomerror("branch destination not jump_stub_call", bad_branch_destination);
|
|
}
|
|
return (loc_t)fdst.imm() + ldr.imm();
|
|
}
|
|
|
|
bool is_call_to_jump_stub(insn bl_insn){
|
|
try {
|
|
jump_stub_call_ptr_loc(bl_insn);
|
|
return true;
|
|
} catch (tihmstar::bad_branch_destination &e) {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
#pragma mark common patchs
|
|
constexpr char patch_nop[] = "\x1F\x20\x03\xD5";
|
|
constexpr size_t patch_nop_size = sizeof(patch_nop)-1;
|
|
|
|
uint64_t offsetfinder64::find_register_value(loc_t where, int reg, loc_t startAddr){
|
|
insn functop(_segments, where);
|
|
|
|
if (!startAddr) {
|
|
//might be functop
|
|
//good enough for my purpose
|
|
while (--functop != insn::stp || (functop+1) != insn::stp || (functop+2) != insn::stp);
|
|
}else{
|
|
functop = startAddr;
|
|
}
|
|
|
|
uint64_t value[32] = {0};
|
|
|
|
for (;(loc_t)functop.pc() < where;++functop) {
|
|
|
|
switch (functop.type()) {
|
|
case patchfinder64::insn::adrp:
|
|
value[functop.rd()] = functop.imm();
|
|
// printf("%p: ADRP X%d, 0x%llx\n", (void*)functop.pc(), functop.rd(), functop.imm());
|
|
break;
|
|
case patchfinder64::insn::add:
|
|
value[functop.rd()] = value[functop.rn()] + functop.imm();
|
|
// printf("%p: ADD X%d, X%d, 0x%llx\n", (void*)functop.pc(), functop.rd(), functop.rn(), (uint64_t)functop.imm());
|
|
break;
|
|
case patchfinder64::insn::adr:
|
|
value[functop.rd()] = functop.imm();
|
|
// printf("%p: ADR X%d, 0x%llx\n", (void*)functop.pc(), functop.rd(), functop.imm());
|
|
break;
|
|
case patchfinder64::insn::ldr:
|
|
// printf("%p: LDR X%d, [X%d, 0x%llx]\n", (void*)functop.pc(), functop.rt(), functop.rn(), (uint64_t)functop.imm());
|
|
value[functop.rt()] = value[functop.rn()] + functop.imm(); // XXX address, not actual value
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
}
|
|
return value[reg];
|
|
}
|
|
|
|
#pragma mark v0rtex
|
|
loc_t offsetfinder64::find_zone_map(){
|
|
loc_t str = findstr("zone_init",true);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
insn ptr(_segments,ref);
|
|
|
|
loc_t ret = 0;
|
|
|
|
while (++ptr != insn::adrp);
|
|
ret = (loc_t)ptr.imm();
|
|
|
|
while (++ptr != insn::add);
|
|
ret += ptr.imm();
|
|
|
|
return ret;
|
|
}
|
|
|
|
loc_t offsetfinder64::find_kernel_map(){
|
|
return find_sym("_kernel_map");
|
|
}
|
|
|
|
loc_t offsetfinder64::find_kernel_task(){
|
|
return find_sym("_kernel_task");
|
|
}
|
|
|
|
loc_t offsetfinder64::find_realhost(){
|
|
loc_t sym = find_sym("_KUNCExecute");
|
|
|
|
insn ptr(_segments,sym);
|
|
|
|
loc_t ret = 0;
|
|
|
|
while (++ptr != insn::adrp);
|
|
ret = (loc_t)ptr.imm();
|
|
|
|
while (++ptr != insn::add);
|
|
ret += ptr.imm();
|
|
|
|
return ret;
|
|
}
|
|
|
|
loc_t offsetfinder64::find_bzero(){
|
|
return find_sym("___bzero");
|
|
}
|
|
|
|
loc_t offsetfinder64::find_bcopy(){
|
|
return find_sym("_bcopy");
|
|
}
|
|
|
|
loc_t offsetfinder64::find_copyout(){
|
|
return find_sym("_copyout");
|
|
}
|
|
|
|
loc_t offsetfinder64::find_copyin(){
|
|
return find_sym("_copyin");
|
|
}
|
|
|
|
loc_t offsetfinder64::find_ipc_port_alloc_special(){
|
|
loc_t sym = find_sym("_KUNCGetNotificationID");
|
|
insn ptr(_segments,sym);
|
|
|
|
while (++ptr != insn::bl);
|
|
while (++ptr != insn::bl);
|
|
|
|
return (loc_t)ptr.imm();
|
|
}
|
|
|
|
loc_t offsetfinder64::find_ipc_kobject_set(){
|
|
loc_t sym = find_sym("_KUNCGetNotificationID");
|
|
insn ptr(_segments,sym);
|
|
|
|
while (++ptr != insn::bl);
|
|
while (++ptr != insn::bl);
|
|
while (++ptr != insn::bl);
|
|
|
|
return (loc_t)ptr.imm();
|
|
}
|
|
|
|
loc_t offsetfinder64::find_ipc_port_make_send(){
|
|
loc_t sym = find_sym("_convert_task_to_port");
|
|
insn ptr(_segments,sym);
|
|
while (++ptr != insn::bl);
|
|
while (++ptr != insn::bl);
|
|
|
|
return (loc_t)ptr.imm();
|
|
}
|
|
|
|
loc_t offsetfinder64::find_chgproccnt(){
|
|
loc_t str = findstr("\"chgproccnt: lost user\"",true);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
insn functop(_segments,ref);
|
|
|
|
while (--functop != insn::stp);
|
|
while (--functop == insn::stp);
|
|
++functop;
|
|
|
|
return (loc_t)functop.pc();
|
|
}
|
|
|
|
loc_t offsetfinder64::find_kauth_cred_ref(){
|
|
return find_sym("_kauth_cred_ref");
|
|
}
|
|
|
|
loc_t offsetfinder64::find_osserializer_serialize(){
|
|
return find_sym("__ZNK12OSSerializer9serializeEP11OSSerialize");
|
|
}
|
|
|
|
uint32_t offsetfinder64::find_vtab_get_external_trap_for_index(){
|
|
loc_t sym = find_sym("__ZTV12IOUserClient");
|
|
sym += 2*sizeof(uint64_t);
|
|
|
|
loc_t nn = find_sym("__ZN12IOUserClient23getExternalTrapForIndexEj");
|
|
|
|
insn data(_segments,sym,insn::kText_and_Data);
|
|
--data;
|
|
for (int i=0; i<0x200; i++) {
|
|
if ((++data).doublevalue() == (uint64_t)nn)
|
|
return i;
|
|
++data;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
uint32_t offsetfinder64::find_vtab_get_retain_count(){
|
|
loc_t sym = find_sym("__ZTV12IOUserClient");
|
|
sym += 2*sizeof(uint64_t);
|
|
|
|
loc_t nn = find_sym("__ZNK8OSObject14getRetainCountEv");
|
|
|
|
insn data(_segments,sym,insn::kText_and_Data);
|
|
--data;
|
|
for (int i=0; i<0x200; i++) {
|
|
if ((++data).doublevalue() == (uint64_t)nn)
|
|
return i;
|
|
++data;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
uint32_t offsetfinder64::find_proc_ucred(){
|
|
loc_t sym = find_sym("_proc_ucred");
|
|
return (uint32_t)insn(_segments,sym).imm();
|
|
}
|
|
|
|
uint32_t offsetfinder64::find_task_bsd_info(){
|
|
loc_t sym = find_sym("_get_bsdtask_info");
|
|
return (uint32_t)insn(_segments,sym).imm();
|
|
}
|
|
|
|
uint32_t offsetfinder64::find_vm_map_hdr(){
|
|
loc_t sym = find_sym("_vm_map_create");
|
|
|
|
insn stp(_segments, sym);
|
|
|
|
while (++stp != insn::bl);
|
|
|
|
while (++stp != insn::cbz && stp != insn::cbnz);
|
|
|
|
while (++stp != insn::stp || stp.rt() != stp.other());
|
|
|
|
return (uint32_t)stp.imm();
|
|
}
|
|
|
|
typedef struct mig_subsystem_struct {
|
|
uint32_t min;
|
|
uint32_t max;
|
|
char *names;
|
|
} mig_subsys;
|
|
|
|
mig_subsys task_subsys ={ 0xd48, 0xd7a , NULL};
|
|
uint32_t offsetfinder64::find_task_itk_self(){
|
|
loc_t task_subsystem=memmem(&task_subsys, 4);
|
|
assure(task_subsystem);
|
|
task_subsystem += 4*sizeof(uint64_t); //index0 now
|
|
|
|
insn mach_ports_register(_segments, (loc_t)insn::deref(_segments, task_subsystem+3*5*8));
|
|
|
|
while (++mach_ports_register != insn::bl || mach_ports_register.imm() != (uint64_t)find_sym("_lck_mtx_lock"));
|
|
|
|
insn ldr(mach_ports_register);
|
|
|
|
while (++ldr != insn::ldr || (ldr+1) != insn::cbz);
|
|
|
|
return (uint32_t)ldr.imm();
|
|
}
|
|
|
|
uint32_t offsetfinder64::find_task_itk_registered(){
|
|
loc_t task_subsystem=memmem(&task_subsys, 4);
|
|
assure(task_subsystem);
|
|
task_subsystem += 4*sizeof(uint64_t); //index0 now
|
|
|
|
insn mach_ports_register(_segments, (loc_t)insn::deref(_segments, task_subsystem+3*5*8));
|
|
|
|
while (++mach_ports_register != insn::bl || mach_ports_register.imm() != (uint64_t)find_sym("_lck_mtx_lock"));
|
|
|
|
insn ldr(mach_ports_register);
|
|
|
|
while (++ldr != insn::ldr || (ldr+1) != insn::cbz);
|
|
while (++ldr != insn::ldr);
|
|
|
|
return (uint32_t)ldr.imm();
|
|
}
|
|
|
|
|
|
//IOUSERCLIENT_IPC
|
|
mig_subsys host_priv_subsys = { 400, 426 } ;
|
|
uint32_t offsetfinder64::find_iouserclient_ipc(){
|
|
loc_t host_priv_subsystem=memmem(&host_priv_subsys, 8);
|
|
assure(host_priv_subsystem);
|
|
|
|
insn memiterator(_segments,host_priv_subsystem,insn::kData_only);
|
|
loc_t thetable = 0;
|
|
while (1){
|
|
--memiterator;--memiterator; //dec 8 byte
|
|
struct _anon{
|
|
uint64_t ptr;
|
|
uint64_t z0;
|
|
uint64_t z1;
|
|
uint64_t z2;
|
|
} *obj = (struct _anon*)(void*)memiterator;
|
|
|
|
if (!obj->z0 && !obj->z1 &&
|
|
!memcmp(&obj[0], &obj[1], sizeof(struct _anon)) &&
|
|
!memcmp(&obj[0], &obj[2], sizeof(struct _anon)) &&
|
|
!memcmp(&obj[0], &obj[3], sizeof(struct _anon)) &&
|
|
!memcmp(&obj[0], &obj[4], sizeof(struct _anon)) &&
|
|
!obj[-1].ptr && obj[-1].z0 == 1 && !obj[-1].z1) {
|
|
thetable = (loc_t)memiterator.pc();
|
|
break;
|
|
}
|
|
}
|
|
|
|
loc_t iokit_user_client_trap_func = (loc_t)insn::deref(_segments, thetable + 100*4*8 - 8);
|
|
|
|
insn bl_to_iokit_add_connect_reference(_segments,iokit_user_client_trap_func);
|
|
while (++bl_to_iokit_add_connect_reference != insn::bl);
|
|
|
|
insn iokit_add_connect_reference(bl_to_iokit_add_connect_reference,(loc_t)bl_to_iokit_add_connect_reference.imm());
|
|
|
|
while (++iokit_add_connect_reference != insn::add || iokit_add_connect_reference.rd() != 8 || ++iokit_add_connect_reference != insn::ldxr || iokit_add_connect_reference.rn() != 8);
|
|
|
|
return (uint32_t)((--iokit_add_connect_reference).imm());
|
|
}
|
|
|
|
uint32_t offsetfinder64::find_ipc_space_is_task_11(){
|
|
loc_t str = findstr("\"ipc_task_init\"",true);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str,1);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
insn istr(_segments,ref);
|
|
|
|
while (--istr != insn::str);
|
|
|
|
return (uint32_t)istr.imm();
|
|
}
|
|
|
|
uint32_t offsetfinder64::find_ipc_space_is_task(){
|
|
loc_t str = findstr("\"ipc_task_init\"",true);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
loc_t bref = 0;
|
|
bool do_backup_plan = false;
|
|
|
|
bref = find_rel_branch_source(insn(_segments,ref), true, 2, 0x2000);
|
|
|
|
if (bref == 0) {
|
|
//previous attempt doesn't work on some 10.0.2 devices, trying something else...
|
|
do_backup_plan = bref = find_rel_branch_source(insn(_segments,ref), true, 1, 0x2000);
|
|
if (bref == 0) {
|
|
//this seems to be good for iOS 9.3.3
|
|
do_backup_plan = bref = find_rel_branch_source(insn(_segments,ref-4), true, 1, 0x2000);
|
|
if (bref == 0) {
|
|
//this is for iOS 11(.2.6)
|
|
return find_ipc_space_is_task_11();
|
|
}
|
|
}
|
|
}
|
|
|
|
insn istr(_segments,bref);
|
|
|
|
if (!do_backup_plan) {
|
|
while (++istr != insn::str);
|
|
}else{
|
|
while (--istr != insn::str);
|
|
}
|
|
|
|
return (uint32_t)istr.imm();
|
|
}
|
|
|
|
uint32_t offsetfinder64::find_sizeof_task(){
|
|
loc_t str = findstr("\0tasks",true)+1;
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
insn thebl(_segments, ref);
|
|
|
|
loc_t zinit = 0;
|
|
zinit = find_sym("_zinit");
|
|
if (zinit == 0) {
|
|
loc_t str = findstr("zlog%d",true);
|
|
retassure(str, "Failed to find str2");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str);
|
|
retassure(ref, "literal ref to str2");
|
|
|
|
insn functop(_segments,ref);
|
|
while (--functop != insn::stp || (functop+1) != insn::stp || (functop+2) != insn::stp || (functop-1) != insn::ret);
|
|
zinit = (loc_t)functop.pc();
|
|
}
|
|
|
|
while (++thebl != insn::bl || (loc_t)thebl.imm() != zinit);
|
|
|
|
--thebl;
|
|
|
|
return (uint32_t)thebl.imm();
|
|
}
|
|
|
|
loc_t offsetfinder64::find_rop_add_x0_x0_0x10(){
|
|
constexpr char ropbytes[] = "\x00\x40\x00\x91\xC0\x03\x5F\xD6";
|
|
return [](const void *little, size_t little_len, vector<text_t>segments)->loc_t{
|
|
for (auto seg : segments) {
|
|
if (!seg.isExec)
|
|
continue;
|
|
|
|
if (loc_t rt = (loc_t)::memmem(seg.map, seg.size, little, little_len)) {
|
|
return rt-seg.map+seg.base;
|
|
}
|
|
}
|
|
return 0;
|
|
}(ropbytes,sizeof(ropbytes)-1,_segments);
|
|
}
|
|
|
|
loc_t offsetfinder64::find_rop_ldr_x0_x0_0x10(){
|
|
constexpr char ropbytes[] = "\x00\x08\x40\xF9\xC0\x03\x5F\xD6";
|
|
return [](const void *little, size_t little_len, vector<text_t>segments)->loc_t{
|
|
for (auto seg : segments) {
|
|
if (!seg.isExec)
|
|
continue;
|
|
|
|
if (loc_t rt = (loc_t)::memmem(seg.map, seg.size, little, little_len)) {
|
|
return rt-seg.map+seg.base;
|
|
}
|
|
}
|
|
return 0;
|
|
}(ropbytes,sizeof(ropbytes)-1,_segments);
|
|
}
|
|
|
|
loc_t offsetfinder64::find_exec(std::function<bool(patchfinder64::insn &i)>cmpfunc){
|
|
insn i(_segments);
|
|
while (true) {
|
|
if (cmpfunc(i))
|
|
return i;
|
|
try {
|
|
++i;
|
|
} catch (out_of_range &e) {
|
|
break;
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
|
|
|
|
#pragma mark patch_finders
|
|
void slide_ptr(class patch *p,uint64_t slide){
|
|
slide += *(uint64_t*)p->_patch;
|
|
memcpy((void*)p->_patch, &slide, 8);
|
|
}
|
|
|
|
patch offsetfinder64::find_sandbox_patch(){
|
|
loc_t str = findstr("process-exec denied while updating label",false);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
insn bdst(_segments, ref);
|
|
for (int i=0; i<4; i++) {
|
|
while (--bdst != insn::bl){
|
|
}
|
|
}
|
|
--bdst;
|
|
|
|
loc_t cbz = find_rel_branch_source(bdst, true);
|
|
|
|
return patch(cbz, patch_nop, patch_nop_size);
|
|
}
|
|
|
|
|
|
patch offsetfinder64::find_amfi_substrate_patch(){
|
|
loc_t str = findstr("AMFI: hook..execve() killing pid %u: %s",false);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
insn funcend(_segments, ref);
|
|
while (++funcend != insn::ret);
|
|
|
|
insn tbnz(funcend);
|
|
while (--tbnz != insn::tbnz);
|
|
|
|
constexpr char mypatch[] = "\x1F\x20\x03\xD5\x08\x79\x16\x12\x1F\x20\x03\xD5\x00\x00\x80\x52\xE9\x01\x80\x52";
|
|
return {(loc_t)tbnz.pc(),mypatch,sizeof(mypatch)-1};
|
|
}
|
|
|
|
patch offsetfinder64::find_cs_enforcement_disable_amfi(){
|
|
loc_t str = findstr("csflags",true);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
insn cbz(_segments, ref);
|
|
while (--cbz != insn::cbz);
|
|
|
|
insn movz(cbz);
|
|
while (++movz != insn::movz);
|
|
--movz;
|
|
|
|
int anz = static_cast<int>((movz.pc()-cbz.pc())/4 +1);
|
|
|
|
char mypatch[anz*4];
|
|
for (int i=0; i<anz; i++) {
|
|
((uint32_t*)mypatch)[i] = *(uint32_t*)patch_nop;
|
|
}
|
|
|
|
return {(loc_t)cbz.pc(),mypatch,static_cast<size_t>(anz*4)};
|
|
}
|
|
|
|
patch offsetfinder64::find_i_can_has_debugger_patch_off(){
|
|
loc_t str = findstr("Darwin Kernel",false);
|
|
retassure(str, "Failed to find str");
|
|
|
|
str -=4;
|
|
|
|
return {str,"\x01",1};
|
|
}
|
|
|
|
patch offsetfinder64::find_amfi_patch_offsets(){
|
|
loc_t str = findstr("int _validateCodeDirectoryHashInDaemon",false);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
insn bl_amfi_memcp(_segments, ref);
|
|
|
|
loc_t memcmp = 0;
|
|
|
|
loc_t jscpl = 0;
|
|
while (1) {
|
|
while (++bl_amfi_memcp != insn::bl);
|
|
|
|
try {
|
|
jscpl = jump_stub_call_ptr_loc(bl_amfi_memcp);
|
|
} catch (tihmstar::bad_branch_destination &e) {
|
|
continue;
|
|
}
|
|
if (haveSymbols()) {
|
|
if (insn::deref(_segments, jscpl) == (uint64_t)(memcmp = find_sym("_memcmp")))
|
|
break;
|
|
}else{
|
|
//check for _memcmp function signature
|
|
insn checker(_segments, memcmp = (loc_t)insn::deref(_segments, jscpl));
|
|
if (checker == insn::cbz
|
|
&& (++checker == insn::ldrb && checker.rn() == 0)
|
|
&& (++checker == insn::ldrb && checker.rn() == 1)
|
|
// ++checker == insn::sub //i'm too lazy to implement this now, first 3 instructions should be good enough though.
|
|
) {
|
|
break;
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
/* find*/
|
|
//movz w0, #0x0
|
|
//ret
|
|
insn ret0(_segments, memcmp);
|
|
for (;; --ret0) {
|
|
if (ret0 == insn::movz && ret0.rd() == 0 && ret0.imm() == 0 && (ret0+1) == insn::ret) {
|
|
break;
|
|
}
|
|
}
|
|
|
|
uint64_t gadget = ret0.pc();
|
|
return {jscpl,&gadget,sizeof(gadget),slide_ptr};
|
|
}
|
|
|
|
patch offsetfinder64::find_proc_enforce(){
|
|
loc_t str = findstr("Enforce MAC policy on process operations", false);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t valref = memmem(&str, sizeof(str));
|
|
retassure(valref, "Failed to find val ref");
|
|
|
|
loc_t proc_enforce_ptr = valref - (5 * sizeof(uint64_t));
|
|
|
|
loc_t proc_enforce_val_loc = (loc_t)insn::deref(_segments, proc_enforce_ptr);
|
|
|
|
uint8_t mypatch = 1;
|
|
return {proc_enforce_val_loc,&mypatch,1};
|
|
}
|
|
|
|
vector<patch> offsetfinder64::find_nosuid_off(){
|
|
loc_t str = findstr("\"mount_common(): mount of %s filesystem failed with %d, but vnode list is not empty.\"", false);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
insn ldr(_segments,ref);
|
|
|
|
while (--ldr != insn::ldr);
|
|
|
|
loc_t cbnz = find_rel_branch_source(ldr, 1);
|
|
|
|
insn bl_vfs_context_is64bit(ldr,cbnz);
|
|
while (--bl_vfs_context_is64bit != insn::bl || bl_vfs_context_is64bit.imm() != (uint64_t)find_sym("_vfs_context_is64bit"));
|
|
|
|
//patch1
|
|
insn movk(bl_vfs_context_is64bit);
|
|
while (--movk != insn::movk || movk.imm() != 8);
|
|
|
|
//patch2
|
|
insn orr(bl_vfs_context_is64bit);
|
|
while (--orr != insn::orr || movk.imm() != 8);
|
|
|
|
return {{(loc_t)movk.pc(),patch_nop,patch_nop_size},{(loc_t)orr.pc(),"\xE9\x03\x08\x2A",4}}; // mov w9, w8
|
|
}
|
|
|
|
patch offsetfinder64::find_remount_patch_offset(){
|
|
loc_t off = find_syscall0();
|
|
|
|
loc_t syscall_mac_mount = (off + 3*(424-1)*sizeof(uint64_t));
|
|
|
|
loc_t __mac_mount = (loc_t)insn::deref(_segments, syscall_mac_mount);
|
|
|
|
insn patchloc(_segments, __mac_mount);
|
|
|
|
while (++patchloc != insn::tbz || patchloc.rt() != 8 || patchloc.other() != 6);
|
|
|
|
--patchloc;
|
|
|
|
constexpr char mypatch[] = "\xC8\x00\x80\x52"; //movz w8, #0x6
|
|
return {(loc_t)patchloc.pc(),mypatch,sizeof(mypatch)-1};
|
|
}
|
|
|
|
patch offsetfinder64::find_lwvm_patch_offsets(){
|
|
loc_t str = findstr("_mapForIO", false);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
insn functop(_segments,ref);
|
|
|
|
while (--functop != insn::stp || (functop+1) != insn::stp || (functop+2) != insn::stp || (functop-2) != insn::ret);
|
|
|
|
insn dstfunc(functop);
|
|
loc_t destination = 0;
|
|
while (1) {
|
|
while (++dstfunc != insn::bl);
|
|
|
|
try {
|
|
destination = jump_stub_call_ptr_loc(dstfunc);
|
|
} catch (tihmstar::bad_branch_destination &e) {
|
|
continue;
|
|
}
|
|
|
|
if (haveSymbols()) {
|
|
if (insn::deref(_segments, destination) == (uint64_t)find_sym("_PE_i_can_has_kernel_configuration"))
|
|
break;
|
|
}else{
|
|
//check for _memcmp function signature
|
|
insn checker(_segments, (loc_t)insn::deref(_segments, destination));
|
|
uint8_t reg = 0;
|
|
if ((checker == insn::adrp && (static_cast<void>(reg = checker.rd()),true))
|
|
&& (++checker == insn::add && checker.rd() == reg)
|
|
&& ++checker == insn::ldr
|
|
&& ++checker == insn::ret
|
|
) {
|
|
break;
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
while (++dstfunc != insn::bcond || dstfunc.other() != insn::cond::NE);
|
|
|
|
loc_t target = (loc_t)dstfunc.imm();
|
|
|
|
return {destination,&target,sizeof(target),slide_ptr};
|
|
}
|
|
|
|
loc_t offsetfinder64::find_sbops(){
|
|
loc_t str = findstr("Seatbelt sandbox policy", false);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = memmem(&str, sizeof(str));
|
|
retassure(ref, "Failed to find ref");
|
|
|
|
return (loc_t)insn::deref(_segments, ref+0x18);
|
|
}
|
|
|
|
enum OFVariableType : uint32_t{
|
|
kOFVariableTypeBoolean = 1,
|
|
kOFVariableTypeNumber,
|
|
kOFVariableTypeString,
|
|
kOFVariableTypeData
|
|
} ;
|
|
|
|
enum OFVariablePerm : uint32_t{
|
|
kOFVariablePermRootOnly = 0,
|
|
kOFVariablePermUserRead,
|
|
kOFVariablePermUserWrite,
|
|
kOFVariablePermKernelOnly
|
|
};
|
|
struct OFVariable {
|
|
const char *variableName;
|
|
OFVariableType variableType;
|
|
OFVariablePerm variablePerm;
|
|
uint32_t _padding;
|
|
uint32_t variableOffset;
|
|
};
|
|
|
|
|
|
patch offsetfinder64::find_nonceEnabler_patch(){
|
|
if (!haveSymbols()){
|
|
info("Falling back to find_nonceEnabler_patch_nosym, because we don't have symbols");
|
|
return find_nonceEnabler_patch_nosym();
|
|
}
|
|
|
|
loc_t str = findstr("com.apple.System.boot-nonce",true);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t sym = find_sym("_gOFVariables");
|
|
|
|
insn ptr(_segments,sym, insn::kText_and_Data);
|
|
|
|
//#warning TODO: doublecast works, but is still kinda ugly
|
|
OFVariable *varp = (OFVariable*)(void*)ptr;
|
|
OFVariable nullvar = {0};
|
|
for (OFVariable *vars = varp;memcmp(vars, &nullvar, sizeof(OFVariable)) != 0; vars++) {
|
|
|
|
if ((loc_t)vars->variableName == str) {
|
|
uint8_t mypatch = (uint8_t)kOFVariablePermUserWrite;
|
|
loc_t location = sym + ((uint8_t*)&vars->variablePerm - (uint8_t*)varp);
|
|
return {location,&mypatch,1};
|
|
}
|
|
}
|
|
|
|
reterror("failed to find \"com.apple.System.boot-nonce\"");
|
|
return {0,0,0};
|
|
}
|
|
|
|
patch offsetfinder64::find_nonceEnabler_patch_nosym(){
|
|
loc_t str = findstr("com.apple.System.boot-nonce",true);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t valref = memmem(&str, sizeof(str));
|
|
retassure(valref, "Failed to find val ref");
|
|
|
|
loc_t str2 = findstr("com.apple.System.sep.art",true);
|
|
retassure(str2, "Failed to find str2");
|
|
|
|
loc_t valref2 = memmem(&str2, sizeof(str2));
|
|
retassure(valref2, "Failed to find val ref2");
|
|
|
|
auto diff = abs(valref - valref2);
|
|
|
|
assure(diff % sizeof(OFVariable) == 0 && diff < 0x50); //simple sanity check
|
|
|
|
insn ptr(_segments, valref, insn::kText_and_Data);
|
|
|
|
OFVariable *vars = (OFVariable*)(void*)ptr;
|
|
if ((loc_t)vars->variableName == str) {
|
|
uint8_t mypatch = (uint8_t)kOFVariablePermUserWrite;
|
|
loc_t location = valref + offsetof(OFVariable, variablePerm);
|
|
return {location,&mypatch,1};
|
|
}
|
|
|
|
reterror("failed to find \"com.apple.System.boot-nonce\"");
|
|
return {0,0,0};
|
|
}
|
|
|
|
#pragma mark KPP bypass
|
|
loc_t offsetfinder64::find_gPhysBase(){
|
|
loc_t ref = find_sym("_ml_static_ptovirt");
|
|
|
|
insn tgtref(_segments, ref);
|
|
|
|
loc_t gPhysBase = 0;
|
|
|
|
if (tgtref != insn::adrp)
|
|
while (++tgtref != insn::adrp);
|
|
gPhysBase = (loc_t)tgtref.imm();
|
|
|
|
while (++tgtref != insn::ldr);
|
|
gPhysBase += tgtref.imm();
|
|
|
|
return gPhysBase;
|
|
}
|
|
|
|
loc_t offsetfinder64::find_gPhysBase_nosym(){
|
|
loc_t str = findstr("\"pmap_map_high_window_bd: area too large", false);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
insn tgtref(_segments, ref);
|
|
|
|
loc_t gPhysBase = 0;
|
|
|
|
while (++tgtref != insn::adrp);
|
|
gPhysBase = (loc_t)tgtref.imm();
|
|
|
|
while (++tgtref != insn::ldr);
|
|
gPhysBase += tgtref.imm();
|
|
|
|
return gPhysBase;
|
|
}
|
|
|
|
loc_t offsetfinder64::find_kernel_pmap(){
|
|
if (haveSymbols()) {
|
|
return find_sym("_kernel_pmap");
|
|
}else{
|
|
return find_kernel_pmap_nosym();
|
|
}
|
|
}
|
|
|
|
loc_t offsetfinder64::find_kernel_pmap_nosym(){
|
|
loc_t str = findstr("\"pmap_map_bd\"", true);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str, 1);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
insn btm(_segments,ref);
|
|
while (++btm != insn::ret);
|
|
|
|
insn kerne_pmap_ref(btm);
|
|
while (--kerne_pmap_ref != insn::adrp);
|
|
|
|
uint8_t reg = kerne_pmap_ref.rd();
|
|
loc_t kernel_pmap = (loc_t)kerne_pmap_ref.imm();
|
|
|
|
while (++kerne_pmap_ref != insn::ldr || kerne_pmap_ref.rn() != reg);
|
|
assure(kerne_pmap_ref.pc()<btm.pc());
|
|
|
|
kernel_pmap += kerne_pmap_ref.imm();
|
|
|
|
return kernel_pmap;
|
|
}
|
|
|
|
loc_t offsetfinder64::find_cpacr_write(){
|
|
return memmem("\x40\x10\x18\xD5", 4);
|
|
}
|
|
|
|
loc_t offsetfinder64::find_idlesleep_str_loc(){
|
|
loc_t entryp = find_entry();
|
|
|
|
insn finder(_segments,entryp);
|
|
assure(finder == insn::b);
|
|
|
|
insn deepsleepfinder(finder, (loc_t)finder.imm());
|
|
while (--deepsleepfinder != insn::nop);
|
|
|
|
loc_t fref = find_literal_ref(_segments, (loc_t)(deepsleepfinder.pc())+4+0xC);
|
|
|
|
insn str(finder,fref);
|
|
while (++str != insn::str);
|
|
while (++str != insn::str);
|
|
|
|
loc_t idlesleep_str_loc = (loc_t)str.imm();
|
|
int rn = str.rn();
|
|
while (--str != insn::adrp || str.rd() != rn);
|
|
idlesleep_str_loc += str.imm();
|
|
|
|
return idlesleep_str_loc;
|
|
}
|
|
|
|
loc_t offsetfinder64::find_deepsleep_str_loc(){
|
|
loc_t entryp = find_entry();
|
|
|
|
insn finder(_segments,entryp);
|
|
assure(finder == insn::b);
|
|
|
|
insn deepsleepfinder(finder, (loc_t)finder.imm());
|
|
while (--deepsleepfinder != insn::nop);
|
|
|
|
loc_t fref = find_literal_ref(_segments, (loc_t)(deepsleepfinder.pc())+4+0xC);
|
|
|
|
insn str(finder,fref);
|
|
while (++str != insn::str);
|
|
|
|
loc_t idlesleep_str_loc = (loc_t)str.imm();
|
|
int rn = str.rn();
|
|
while (--str != insn::adrp || str.rd() != rn);
|
|
idlesleep_str_loc += str.imm();
|
|
|
|
return idlesleep_str_loc;
|
|
}
|
|
|
|
loc_t offsetfinder64::find_rootvnode() {
|
|
return find_sym("_rootvnode");
|
|
}
|
|
|
|
loc_t offsetfinder64::find_allproc(){
|
|
loc_t str = findstr("\"pgrp_add : pgrp is dead adding process\"",true);
|
|
retassure(str, "Failed to find str");
|
|
|
|
loc_t ref = find_literal_ref(_segments, str);
|
|
retassure(ref, "literal ref to str");
|
|
|
|
insn ptr(_segments,ref);
|
|
|
|
while (++ptr != insn::and_ || ptr.rd() != 8 || ptr.rn() != 8 || ptr.imm() != 0xffffffffffffdfff);
|
|
|
|
loc_t retval = (loc_t)find_register_value(ptr-2, 8);
|
|
|
|
return retval;
|
|
}
|
|
|
|
offsetfinder64::~offsetfinder64(){
|
|
if (_freeKernel) safeFree(_kdata);
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
//
|