fixes; update data; get rid of placeholder functionality; add lambda.h; make make_kernel_patchfile use b_relocate instead, whee
This commit is contained in:
comex
parent
b11cc93d2d
commit
a193396a72
119
dmini.c
119
dmini.c
@ -1,119 +0,0 @@
|
||||
#include <data/common.h>
|
||||
#include <data/find.h>
|
||||
#include <data/binary.h>
|
||||
#include <data/cc.h>
|
||||
#include <config/placeholder.h>
|
||||
#include <data/running_kernel.h>
|
||||
#include <data/dyld_cache_format.h>
|
||||
|
||||
static struct binary binary;
|
||||
|
||||
// count the number of set bits
|
||||
static int count_ones(uint32_t number) {
|
||||
int result = 0;
|
||||
for(; number; number >>= 1) {
|
||||
result += (number & 1);
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
static int position_of_nth_one(uint32_t number, int n) {
|
||||
for(int pos = 0; pos < 32; pos++) {
|
||||
if((number & (1 << pos)) && !n--) return pos;
|
||||
}
|
||||
die("no nth one (%08x, n=%d)", number, n);
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
void main_loop() {
|
||||
printf("+ %d\n", binary.actual_cpusubtype);
|
||||
fflush(stdout);
|
||||
|
||||
while(1) {
|
||||
char arg[129]; arg[0] = 0;
|
||||
int mode = 0;
|
||||
if(scanf("%d ", &mode) != 1) die("?");
|
||||
if(!fgets(arg, sizeof(arg), stdin)) die("?");
|
||||
arg[strlen(arg) - 1] = 0;
|
||||
|
||||
addr_t result;
|
||||
|
||||
if(mode == 0) {
|
||||
result = b_find_anywhere(&binary, arg, arg[0] == '+' ? 2 : 4, false);
|
||||
} else if(mode == 1) {
|
||||
result = b_sym(&binary, arg, true);
|
||||
} else if(mode == 2) {
|
||||
result = b_private_sym(&binary, arg, true);
|
||||
} else if(mode == 3) {
|
||||
b_dyldcache_load_macho(&binary, arg);
|
||||
result = 0;
|
||||
} else die("mode?");
|
||||
|
||||
printf("+ %x\n", result);
|
||||
fflush(stdout);
|
||||
}
|
||||
}
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
b_init(&binary);
|
||||
char **p = &argv[1];
|
||||
if(!p[0]) goto usage;
|
||||
while(p[0]) {
|
||||
if(p[0][0] == '-') switch(p[0][1]) {
|
||||
case 'C':
|
||||
b_load_running_dyldcache(&binary, (void *) 0x30000000);
|
||||
p++;
|
||||
break;
|
||||
case 'c':
|
||||
if(!p[1]) goto usage;
|
||||
b_load_dyldcache(&binary, p[1], false);
|
||||
p += 2;
|
||||
break;
|
||||
case 'k':
|
||||
if(!p[1]) goto usage;
|
||||
b_load_macho(&binary, p[1], false);
|
||||
p += 2;
|
||||
break;
|
||||
case 'd':
|
||||
if(!p[1]) goto usage;
|
||||
b_load_macho(&binary, p[1], false);
|
||||
p += 2;
|
||||
break;
|
||||
case 'K': {
|
||||
b_running_kernel_load_macho(&binary);
|
||||
p++;
|
||||
break;
|
||||
}
|
||||
#ifdef IMG3_SUPPORT
|
||||
case 'i': {
|
||||
if(!p[1] || !p[2] || !p[3]) goto usage;
|
||||
uint32_t key_bits;
|
||||
prange_t key = parse_hex_string(p[2]);
|
||||
prange_t iv = parse_hex_string(p[3]);
|
||||
prange_t data = parse_img3_file(p[1], &key_bits);
|
||||
prange_t kern = decrypt_and_decompress(key_bits, key, iv, data);
|
||||
b_prange_load_macho(&binary, kern, false);
|
||||
p += 4;
|
||||
break;
|
||||
}
|
||||
#endif
|
||||
default:
|
||||
goto usage;
|
||||
}
|
||||
}
|
||||
|
||||
main_loop();
|
||||
|
||||
return 0;
|
||||
|
||||
usage:
|
||||
fprintf(stderr, "Usage: dmini (-c cache | -C | -d dyld | -k kc | -K"
|
||||
#ifdef IMG3_SUPPORT
|
||||
" | -i kernel_img3 key iv"
|
||||
#endif
|
||||
")\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
44
lambda.h
Normal file
44
lambda.h
Normal file
@ -0,0 +1,44 @@
|
||||
#pragma once
|
||||
|
||||
/* Example:
|
||||
|
||||
int multiplier = 5;
|
||||
DECL_LAMBDA(l, int, (int a), {
|
||||
return a * multiplier;
|
||||
})
|
||||
assert(l.func(l.arg, 4) == 20);
|
||||
|
||||
The point of this is to work on both iOS, where GCC inline
|
||||
functions don't work, and Linux, where Apple blocks generally
|
||||
aren't available.
|
||||
*/
|
||||
|
||||
#ifdef __BLOCKS__
|
||||
struct _blk {
|
||||
void *isa;
|
||||
int flags;
|
||||
int reserved;
|
||||
void *invoke;
|
||||
};
|
||||
#define LAMBDA_BODY(typ, ret, args, body) \
|
||||
({ union { \
|
||||
ret (^blk) args; \
|
||||
struct _blk *_blk; \
|
||||
void *vp; \
|
||||
} u = { ^ret args body }; \
|
||||
(typ) {u._blk->invoke, u.vp}; \
|
||||
})
|
||||
#else
|
||||
#define LAMBDA_BODY_(typ, ret, args, body) \
|
||||
({ ret func args body; \
|
||||
(typ) {&func, 0}; \
|
||||
})
|
||||
#define LAMBDA_BODY(typ, ret, args, body) \
|
||||
LAMBDA_BODY_(typ, ret, LAMBDA_UNPAREN args, body)
|
||||
#endif
|
||||
#define LAMBDA_UNPAREN(args...) (void *_lambda_ignored, ##args)
|
||||
#define DECL_LAMBDA(name, ret, args, body) \
|
||||
struct { \
|
||||
ret (*func) LAMBDA_UNPAREN args; \
|
||||
void *arg; \
|
||||
} name = LAMBDA_BODY(typeof(name), ret, args, body);
|
||||
@ -1,8 +1,8 @@
|
||||
#include <data/common.h>
|
||||
#include <data/find.h>
|
||||
#include <data/binary.h>
|
||||
#include <data/cc.h>
|
||||
#include <config/placeholder.h>
|
||||
#include <data/link.h>
|
||||
#include "lambda.h"
|
||||
|
||||
int patchfd;
|
||||
|
||||
@ -52,10 +52,10 @@ addr_t find_sysctl(struct binary *binary, const char *name) {
|
||||
return b_read32(binary, csref - 8);
|
||||
}
|
||||
|
||||
void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
|
||||
void do_kernel(struct binary *binary, struct binary *sandbox) {
|
||||
bool is_armv7 = binary->actual_cpusubtype == 9;
|
||||
|
||||
bool four_dot_three = true;
|
||||
bool four_dot_three = false;
|
||||
addr_t _kernel_pmap, _PE_i_can_has_debugger, _vn_getpath, _memcmp;
|
||||
if(0) {
|
||||
_kernel_pmap = 0x8027e2dc;
|
||||
@ -63,10 +63,10 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
|
||||
_vn_getpath = 0x8008d7bd;
|
||||
_memcmp = 0x8006558d;
|
||||
} else {
|
||||
_kernel_pmap = b_sym(binary, "_kernel_pmap", false);
|
||||
_PE_i_can_has_debugger = b_sym(binary, "_PE_i_can_has_debugger", false);
|
||||
_vn_getpath = b_sym(binary, "_vn_getpath", true);
|
||||
_memcmp = b_sym(binary, "_memcmp", true);
|
||||
_kernel_pmap = b_sym(binary, "_kernel_pmap", false, true);
|
||||
_PE_i_can_has_debugger = b_sym(binary, "_PE_i_can_has_debugger", false, true);
|
||||
_vn_getpath = b_sym(binary, "_vn_getpath", true, true);
|
||||
_memcmp = b_sym(binary, "_memcmp", true, true);
|
||||
}
|
||||
|
||||
|
||||
@ -129,24 +129,27 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
|
||||
range_t range = b_macho_segrange(binary, "__PRELINK_TEXT");
|
||||
addr_t sb_evaluate = find_bof(range, find_int32(range, find_string(range, "bad opcode", false, true), true), is_armv7);
|
||||
|
||||
preplace32(sandbox, CONFIG_IS_ARMV7, (uint32_t) is_armv7);
|
||||
preplace32(sandbox, CONFIG_VN_GETPATH, _vn_getpath);
|
||||
preplace32(sandbox, CONFIG_MEMCMP, _memcmp);
|
||||
preplace32(sandbox, CONFIG_SB_EVALUATE_ORIG1, b_read32(binary, sb_evaluate));
|
||||
preplace32(sandbox, CONFIG_SB_EVALUATE_ORIG2, b_read32(binary, sb_evaluate + 4));
|
||||
preplace32(sandbox, CONFIG_SB_EVALUATE_JUMPTO, sb_evaluate + (is_armv7 ? 9 : 8));
|
||||
preplace32(sandbox, CONFIG_DVP_STRUCT_OFFSET, find_dvp_struct_offset(binary));
|
||||
|
||||
check_no_placeholders(sandbox);
|
||||
|
||||
DECL_LAMBDA(l, uint32_t, (const char *name), {
|
||||
if(!strcmp(name, "c_sb_evaluate_orig1")) return b_read32(binary, sb_evaluate);
|
||||
if(!strcmp(name, "c_sb_evaluate_orig2")) return b_read32(binary, sb_evaluate + 4);
|
||||
if(!strcmp(name, "c_sb_evaluate_jumpto")) return sb_evaluate + (is_armv7 ? 9 : 8);
|
||||
if(!strcmp(name, "c_memcmp")) return _memcmp;
|
||||
if(!strcmp(name, "c_vn_getpath")) return _vn_getpath;
|
||||
if(!strcmp(name, "c_dvp_struct_offset")) return find_dvp_struct_offset(binary);
|
||||
if(!strcmp(name, "c_is_armv7")) return is_armv7;
|
||||
die("? %s", name);
|
||||
})
|
||||
b_relocate(sandbox, (void *) l.arg, (void *) l.func, 0);
|
||||
prange_t sandbox_pr = rangeconv(b_nth_segment(sandbox, 0));
|
||||
patch_with_range("sb_evaluate hook",
|
||||
scratch,
|
||||
sandbox);
|
||||
sandbox_pr);
|
||||
|
||||
patch("sb_evaluate",
|
||||
sb_evaluate,
|
||||
uint32_t, {(is_armv7 ? 0xf000f8df : 0xe51ff004), scratch | 1});
|
||||
|
||||
|
||||
patch("proc_enforce",
|
||||
find_sysctl(binary, "proc_enforce"),
|
||||
uint32_t, {0});
|
||||
@ -157,24 +160,24 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
|
||||
addr_t sysent_patch_orig = b_read32(binary, sysent + 4);
|
||||
patch("sysent patch", 0, uint32_t, {sysent + 4});
|
||||
patch("sysent patch orig", 0, uint32_t, {sysent_patch_orig});
|
||||
patch("scratch", 0, uint32_t, {(scratch + sandbox.size + 0xfff) & ~0xfff});
|
||||
//patch("IOLog", 0, uint32_t, {b_sym(binary, "_IOLog", true)});
|
||||
patch("scratch", 0, uint32_t, {(scratch + sandbox_pr.size + 0xfff) & ~0xfff});
|
||||
//patch("IOLog", 0, uint32_t, {b_sym(binary, "_IOLog", true, true)});*/
|
||||
}
|
||||
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
struct binary binary;
|
||||
b_init(&binary);
|
||||
prange_t kernel = load_file(argv[1], false, NULL);
|
||||
b_prange_load_macho(&binary, kernel, argv[1]);
|
||||
prange_t sandbox = load_file(argv[2], true, NULL);
|
||||
struct binary kernel, sandbox;
|
||||
b_init(&kernel);
|
||||
b_init(&sandbox);
|
||||
b_load_macho(&kernel, argv[1], false);
|
||||
b_load_macho(&sandbox, argv[2], true);
|
||||
|
||||
patchfd = open(argv[3], O_WRONLY | O_CREAT | O_TRUNC, 0644);
|
||||
if(patchfd == -1) {
|
||||
edie("could not open patchfd");
|
||||
}
|
||||
|
||||
do_kernel(kernel, sandbox, &binary);
|
||||
do_kernel(&kernel, &sandbox);
|
||||
|
||||
close(patchfd);
|
||||
return 0;
|
||||
|
||||
Loading…
Reference in New Issue
Block a user