nganhkhoa/ios-kernel-patch
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

about to commit to the insane

Browse Source
This commit is contained in:
comex 2011-03-14 17:56:05 -04:00
parent 1f0a8172db
commit 4ffc4686e7
2 changed files with 75 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
make_kernel_patchfile.c
View File

@ -55,15 +55,38 @@ addr_t find_sysctl(struct binary *binary, const char *name) {
void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
bool is_armv7 = binary->actual_cpusubtype == 9;
bool four_dot_three = true;
addr_t _kernel_pmap, _PE_i_can_has_debugger, _vn_getpath, _memcmp;
if(0) {
_kernel_pmap = 0x8027e2dc;
_PE_i_can_has_debugger = 0x80203f74;
_vn_getpath = 0x8008d7bd;
_memcmp = 0x8006558d;
} else {
_kernel_pmap = b_sym(binary, "_kernel_pmap", false);
_PE_i_can_has_debugger = b_sym(binary, "_PE_i_can_has_debugger", false);
_vn_getpath = b_sym(binary, "_vn_getpath", true);
_memcmp = b_sym(binary, "_memcmp", true);
}
// '+' = in place only, '-' = in advance only
// patches
patch("+kernel_pmap.nx_enabled",
b_read32(binary, b_sym(binary, "_kernel_pmap", false)) + 0x420,
b_read32(binary, _kernel_pmap) + 0x420,
uint32_t, {0});
// the second ref to mem_size
// 4.3: 23 68 - c3 f8 20 84
// 4.2: 03 68 - c3 f8 20 24
if(four_dot_three) {
patch("-kernel_pmap.nx_enabled initializer",
find_data(b_macho_segrange(binary, "__TEXT"), "23 68 - c3 f8 24 84", 0, true),
uint32_t, {0x6424f8c3});
} else {
patch("-kernel_pmap.nx_enabled initializer",
find_data(b_macho_segrange(binary, "__TEXT"), is_armv7 ? "03 68 - c3 f8 20 24" : "84 23 db 00 - d5 50 22 68", 0, true),
uint32_t, {is_armv7 ? 0xc420f8c3 : 0x682250d0});
}
patch("-lunchd",
find_string(b_macho_segrange(binary, "__DATA"), "/sbin/launchd", 0, true),
@ -75,12 +98,17 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
uint32_t, {is_armv7 ? 0x46c00f02 : 0x46c046c0});
// AMFI (patch3) - disable the predefined list of executable stuff
patch("AMFI",
find_data(b_macho_segrange(binary, "__PRELINK_TEXT"), is_armv7 ? "23 78 9c 45 05 d1 .. .. .. .. .. .. .. 4b 98 47 00 .. -" : "13 20 a0 e3 .. .. .. .. 33 ff 2f e1 00 00 50 e3 00 00 00 0a .. 40 a0 e3 - 04 00 a0 e1 90 80 bd e8", 0, true),
uint32_t, {is_armv7 ? 0x1c201c20 : 0xe3a00001});
addr_t mystery = find_data(b_macho_segrange(binary, "__PRELINK_TEXT"), four_dot_three ? "- f0 b5 03 af 4d f8 04 8d .. .. 03 78 80 46" : is_armv7 ? "- 90 b5 01 af 14 29 .. .. .. .. 90 f8 00 c0" : "???", 0, true);
addr_t scratch = resolve_ldr(binary, is_armv7 ? (mystery + 9) : 42);
if(is_armv7) {
patch("AMFI", mystery, uint16_t, {0x2001, 0x4770});
} else {
patch("AMFI", mystery, uint32_t, {0xe3a00001, 0xe12fff1e});
}
// PE_i_can_has_debugger (patch4) - so AMFI allows non-ldid'd binaries (and some other stuff is allowed)
patch("PE_i_can_has_debugger",
b_sym(binary, "_PE_i_can_has_debugger", false),
_PE_i_can_has_debugger,
uint32_t, {0x47702001});
@ -92,7 +120,7 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
// cs_enforcement_disable
patch("cs_enforcement_disable",
resolve_ldr(binary, find_data(b_macho_segrange(binary, "__TEXT"), is_armv7 ? "1d ee 90 3f d3 f8 4c 33 d3 f8 9c 20 + .. .. .. .. 19 68 00 29" : "9c 22 03 59 99 58 + .. .. 1a 68 00 2a", 0, true)),
resolve_ldr(binary, find_data(b_macho_segrange(binary, "__TEXT"), four_dot_three ? "1d ee 90 3f d3 f8 80 33 93 f8 94 30 1b 09 03 f0 01 02 + .. .. .. .." : is_armv7 ? "1d ee 90 3f d3 f8 4c 33 d3 f8 9c 20 + .. .. .. .. 19 68 00 29" : "9c 22 03 59 99 58 + .. .. 1a 68 00 2a", 0, true)),
uint32_t, {1});
// sandbox
@ -100,15 +128,13 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
addr_t sb_evaluate = find_bof(range, find_int32(range, find_string(range, "bad opcode", false, true), true), is_armv7);
preplace32(sandbox, CONFIG_IS_ARMV7, (uint32_t) is_armv7);
preplace32(sandbox, CONFIG_VN_GETPATH, b_sym(binary, "_vn_getpath", true));
preplace32(sandbox, CONFIG_MEMCMP, b_sym(binary, "_memcmp", true));
preplace32(sandbox, CONFIG_VN_GETPATH, _vn_getpath);
preplace32(sandbox, CONFIG_MEMCMP, _memcmp);
preplace32(sandbox, CONFIG_SB_EVALUATE_ORIG1, b_read32(binary, sb_evaluate));
preplace32(sandbox, CONFIG_SB_EVALUATE_ORIG2, b_read32(binary, sb_evaluate + 4));
preplace32(sandbox, CONFIG_SB_EVALUATE_JUMPTO, sb_evaluate + (is_armv7 ? 9 : 8));
preplace32(sandbox, CONFIG_DVP_STRUCT_OFFSET, find_dvp_struct_offset(binary));
addr_t scratch = find_scratch(binary);
patch("sb_evaluate",
sb_evaluate,
uint32_t, {(is_armv7 ? 0xf000f8df : 0xe51ff004), scratch | 1});
@ -118,6 +144,10 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
scratch,
sandbox);
patch("proc_enforce",
find_sysctl(binary, "proc_enforce"),
uint32_t, {0});
// some "notes"
addr_t sysent = find_data(b_macho_segrange(binary, "__DATA"), "21 00 00 00 00 10 86 00 -", 0, true);

32
pf2c.py Normal file
View File

@ -0,0 +1,32 @@
import sys, struct
patchfp = open(sys.argv[1], 'rb')
def read(f, size):
result = f.read(size)
if len(result) != size: raise Exception('truncated')
return result
print '#define P32(a, b) *((volatile unsigned int *) a) = b;'
print '#define P8(a, b) *((volatile unsigned char *) a) = b;'
while True:
namelen = patchfp.read(4)
if len(namelen) == 0: break
if len(namelen) != 4: raise Exception('truncated')
name = read(patchfp, struct.unpack('I', namelen)[0])
addr, = struct.unpack('I', read(patchfp, 4))
data = read(patchfp, struct.unpack('I', read(patchfp, 4))[0])
if name == 'sysent patch':
sysent_patch, = struct.unpack('I', data)
elif name == 'sysent patch orig':
sysent_patch_orig, = struct.unpack('I', data)
elif name == 'scratch':
scratch, = struct.unpack('I', data)
if addr == 0 or len(data) == 0 or name.startswith('+'): # in place only
continue
print '// %s' % name
for b in xrange(0, len(data) - 3, 4):
print 'P32(0x%x, 0x%x);' % (addr + b, struct.unpack('I', data[b:b+4])[0])
for b in xrange(b + 4, len(data)):
print 'P8(0x%x, 0x%x);' % (addr + b, ord(data[b]))