nganhkhoa/ios-kernel-patch
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

catalog

Browse Source
This commit is contained in:
comex 2011-01-07 22:01:46 -05:00
parent d14d30acf7
commit 381edfadc6
2 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
dmini.c
View File

@ -42,13 +42,18 @@ void find_second_ldm(struct binary *binary, uint32_t valid_conds, int reg, addr_
} }
int offset; int offset;
if((val & 0xfdfc081) == 0x890c001) { if((val & 0xfd0c081) == 0x890c001) {
offset = 0; offset = 0;
} else if((val & 0xfdfc081) == 0x990c001) { } else if((val & 0xfd0c081) == 0x990c001) {
offset = 1; offset = 1;
} else { } else {
continue; continue;
} }
uint32_t rn = (val & 0xf0000) >> 16;
if((int) rn != reg) {
continue;
}
*addrp = addr; *addrp = addr;
*num_before_r0 = offset; *num_before_r0 = offset;
@ -105,10 +110,10 @@ void find_kernel_ldm(struct binary *binary, uint32_t valid_conds, addr_t *addrp,
// 0xfdf to be strict about user registers, 0xf9f otherwise // 0xfdf to be strict about user registers, 0xf9f otherwise
int offset; int offset;
if((val & 0xfd0c080) == 0x890c000) { if((val & 0xfd08080) == 0x8908000) {
// ldmia // ldmia
offset = 0; offset = 0;
} else if((val & 0xfd0c080) == 0x990c000) { } else if((val & 0xfd08080) == 0x9908000) {
// ldmib // ldmib
offset = 1; offset = 1;
} else { } else {
@ -119,7 +124,7 @@ void find_kernel_ldm(struct binary *binary, uint32_t valid_conds, addr_t *addrp,
uint32_t reglist = val & 0x7f7f; uint32_t reglist = val & 0x7f7f;
int ones = count_ones(reglist) + offset; // ones = offset of PC int ones = count_ones(reglist) + offset; // ones = offset of PC
printf("addr=%x rn=%u ones=%d val=%x\n", addr, rn, ones, val); //printf("addr=%x rn=%u ones=%d val=%x\n", addr, rn, ones, val);
if(rn != 0 && rn != 5) goto nope; if(rn != 0 && rn != 5) goto nope;
//printf("rn=%u ones=%d\n", rn, ones); //printf("rn=%u ones=%d\n", rn, ones);

3
make_kernel_patchfile.c
View File

@ -129,8 +129,7 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
addr_t sysent_patch_orig = b_read32(binary, sysent + 4); addr_t sysent_patch_orig = b_read32(binary, sysent + 4);
patch("sysent patch", 0, uint32_t, {sysent + 4}); patch("sysent patch", 0, uint32_t, {sysent + 4});
patch("sysent patch orig", 0, uint32_t, {sysent_patch_orig}); patch("sysent patch orig", 0, uint32_t, {sysent_patch_orig});
patch("scratch", 0, uint32_t, {(scratch + sandbox.size + 0xfff) & ~0xfff});
fprintf(stderr, "scratch = %x\n", scratch);
} }