fixes; update data; get rid of placeholder functionality; add lambda.h; make make_kernel_patchfile use b_relocate instead, whee

dmini.c

@@ -1,119 +0,0 @@
-#include <data/common.h>
-#include <data/find.h>
-#include <data/binary.h>
-#include <data/cc.h>
-#include <config/placeholder.h>
-#include <data/running_kernel.h>
-#include <data/dyld_cache_format.h>
-
-static struct binary binary;
-
-// count the number of set bits
-static int count_ones(uint32_t number) {
-    int result = 0;
-    for(; number; number >>= 1) {
-        result += (number & 1);
-    }
-    return result;
-}
-
-static int position_of_nth_one(uint32_t number, int n) {
-    for(int pos = 0; pos < 32; pos++) {
-        if((number & (1 << pos)) && !n--) return pos;
-    }
-    die("no nth one (%08x, n=%d)", number, n);
-}
-
-
-
-
-void main_loop() {
-    printf("+ %d\n", binary.actual_cpusubtype);
-    fflush(stdout);
-
-    while(1) {
-        char arg[129]; arg[0] = 0;
-        int mode = 0;
-        if(scanf("%d ", &mode) != 1) die("?");
-        if(!fgets(arg, sizeof(arg), stdin)) die("?");
-        arg[strlen(arg) - 1] = 0;
-
-        addr_t result;
-
-        if(mode == 0) { 
-            result = b_find_anywhere(&binary, arg, arg[0] == '+' ? 2 : 4, false);
-        } else if(mode == 1) {
-            result = b_sym(&binary, arg, true);
-        } else if(mode == 2) {
-            result = b_private_sym(&binary, arg, true);
-        } else if(mode == 3) {
-            b_dyldcache_load_macho(&binary, arg);
-            result = 0;
-        } else die("mode?");
-
-        printf("+ %x\n", result);
-        fflush(stdout);
-    }
-}
-
-int main(int argc, char **argv) {
-    b_init(&binary);
-    char **p = &argv[1];
-    if(!p[0]) goto usage;
-    while(p[0]) {
-        if(p[0][0] == '-') switch(p[0][1]) {
-        case 'C':
-            b_load_running_dyldcache(&binary, (void *) 0x30000000);
-            p++;
-            break;
-        case 'c':
-            if(!p[1]) goto usage;
-            b_load_dyldcache(&binary, p[1], false);
-            p += 2;
-            break;
-        case 'k':
-            if(!p[1]) goto usage;
-            b_load_macho(&binary, p[1], false);
-            p += 2;
-            break;
-        case 'd':
-            if(!p[1]) goto usage;
-            b_load_macho(&binary, p[1], false);
-            p += 2;
-            break;
-        case 'K': {
-            b_running_kernel_load_macho(&binary);  
-            p++;
-            break;
-        }
-#ifdef IMG3_SUPPORT
-        case 'i': {
-            if(!p[1] || !p[2] || !p[3]) goto usage;
-            uint32_t key_bits;
-            prange_t key = parse_hex_string(p[2]);
-            prange_t iv = parse_hex_string(p[3]);
-            prange_t data = parse_img3_file(p[1], &key_bits);
-            prange_t kern = decrypt_and_decompress(key_bits, key, iv, data);
-            b_prange_load_macho(&binary, kern, false);
-            p += 4;
-            break;
-        }
-#endif
-        default:
-            goto usage;
-        }
-    }
-
-    main_loop();
-
-    return 0;
-
-    usage:
-    fprintf(stderr, "Usage: dmini (-c cache | -C | -d dyld | -k kc | -K"
-#ifdef IMG3_SUPPORT
-    " | -i kernel_img3 key iv"
-#endif
-    ")\n");
-    return 1;
-}
-

lambda.h

@@ -0,0 +1,44 @@
+#pragma once
+
+/*  Example:
+    
+    int multiplier = 5;
+    DECL_LAMBDA(l, int, (int a), {
+        return a * multiplier;
+    })
+    assert(l.func(l.arg, 4) == 20);
+
+    The point of this is to work on both iOS, where GCC inline
+    functions don't work, and Linux, where Apple blocks generally
+    aren't available.
+*/
+
+#ifdef __BLOCKS__
+struct _blk {
+    void *isa;
+    int flags;
+    int reserved;
+    void *invoke;
+};
+#define LAMBDA_BODY(typ, ret, args, body) \
+    ({ union { \
+           ret (^blk) args; \
+           struct _blk *_blk; \
+           void *vp; \
+        } u = { ^ret args body }; \
+       (typ) {u._blk->invoke, u.vp}; \
+       })
+#else
+#define LAMBDA_BODY_(typ, ret, args, body) \
+    ({ ret func args body; \
+       (typ) {&func, 0}; \
+       })
+#define LAMBDA_BODY(typ, ret, args, body) \
+    LAMBDA_BODY_(typ, ret, LAMBDA_UNPAREN args, body)
+#endif
+#define LAMBDA_UNPAREN(args...) (void *_lambda_ignored, ##args)
+#define DECL_LAMBDA(name, ret, args, body) \
+    struct { \
+        ret (*func) LAMBDA_UNPAREN args; \
+        void *arg; \
+    } name = LAMBDA_BODY(typeof(name), ret, args, body);

make_kernel_patchfile.c

@@ -1,8 +1,8 @@
 #include <data/common.h>
 #include <data/find.h>
 #include <data/binary.h>
-#include <data/cc.h>
+#include <data/link.h>
-#include <config/placeholder.h>
+#include "lambda.h"
 
 int patchfd;
 
@@ -52,10 +52,10 @@ addr_t find_sysctl(struct binary *binary, const char *name) {
     return b_read32(binary, csref - 8);
 }
 
-void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
+void do_kernel(struct binary *binary, struct binary *sandbox) {
     bool is_armv7 = binary->actual_cpusubtype == 9;
 
-    bool four_dot_three = true;
+    bool four_dot_three = false;
     addr_t _kernel_pmap, _PE_i_can_has_debugger, _vn_getpath, _memcmp;
     if(0) {
         _kernel_pmap = 0x8027e2dc;
@@ -63,10 +63,10 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
         _vn_getpath = 0x8008d7bd;
         _memcmp = 0x8006558d;
     } else {
-        _kernel_pmap = b_sym(binary, "_kernel_pmap", false);
+        _kernel_pmap = b_sym(binary, "_kernel_pmap", false, true);
-        _PE_i_can_has_debugger = b_sym(binary, "_PE_i_can_has_debugger", false);
+        _PE_i_can_has_debugger = b_sym(binary, "_PE_i_can_has_debugger", false, true);
-        _vn_getpath = b_sym(binary, "_vn_getpath", true);
+        _vn_getpath = b_sym(binary, "_vn_getpath", true, true);
-        _memcmp = b_sym(binary, "_memcmp", true);
+        _memcmp = b_sym(binary, "_memcmp", true, true);
     }
 
 
@@ -129,24 +129,27 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
     range_t range = b_macho_segrange(binary, "__PRELINK_TEXT");
     addr_t sb_evaluate = find_bof(range, find_int32(range, find_string(range, "bad opcode", false, true), true), is_armv7);
     
-    preplace32(sandbox, CONFIG_IS_ARMV7, (uint32_t) is_armv7);
+   
-    preplace32(sandbox, CONFIG_VN_GETPATH, _vn_getpath);
+    DECL_LAMBDA(l, uint32_t, (const char *name), {
-    preplace32(sandbox, CONFIG_MEMCMP, _memcmp);
+        if(!strcmp(name, "c_sb_evaluate_orig1")) return b_read32(binary, sb_evaluate);
-    preplace32(sandbox, CONFIG_SB_EVALUATE_ORIG1, b_read32(binary, sb_evaluate));
+        if(!strcmp(name, "c_sb_evaluate_orig2")) return b_read32(binary, sb_evaluate + 4);
-    preplace32(sandbox, CONFIG_SB_EVALUATE_ORIG2, b_read32(binary, sb_evaluate + 4));
+        if(!strcmp(name, "c_sb_evaluate_jumpto")) return sb_evaluate + (is_armv7 ? 9 : 8);
-    preplace32(sandbox, CONFIG_SB_EVALUATE_JUMPTO, sb_evaluate + (is_armv7 ? 9 : 8));
+        if(!strcmp(name, "c_memcmp")) return _memcmp;
-    preplace32(sandbox, CONFIG_DVP_STRUCT_OFFSET, find_dvp_struct_offset(binary));
+        if(!strcmp(name, "c_vn_getpath")) return _vn_getpath;
-    
+        if(!strcmp(name, "c_dvp_struct_offset")) return find_dvp_struct_offset(binary);
-    check_no_placeholders(sandbox);
+        if(!strcmp(name, "c_is_armv7")) return is_armv7;
+        die("? %s", name);
+    })
+    b_relocate(sandbox, (void *) l.arg, (void *) l.func, 0);
+    prange_t sandbox_pr = rangeconv(b_nth_segment(sandbox, 0));
     patch_with_range("sb_evaluate hook",
                      scratch,
-                     sandbox);
+                     sandbox_pr);
     
     patch("sb_evaluate",
           sb_evaluate,
           uint32_t, {(is_armv7 ? 0xf000f8df : 0xe51ff004), scratch | 1});
 
-
     patch("proc_enforce",
           find_sysctl(binary, "proc_enforce"),
           uint32_t, {0});
@@ -157,24 +160,24 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
     addr_t sysent_patch_orig = b_read32(binary, sysent + 4);
     patch("sysent patch", 0, uint32_t, {sysent + 4});
     patch("sysent patch orig", 0, uint32_t, {sysent_patch_orig});
-    patch("scratch", 0, uint32_t, {(scratch + sandbox.size + 0xfff) & ~0xfff});
+    patch("scratch", 0, uint32_t, {(scratch + sandbox_pr.size + 0xfff) & ~0xfff});
-    //patch("IOLog", 0, uint32_t, {b_sym(binary, "_IOLog", true)});
+    //patch("IOLog", 0, uint32_t, {b_sym(binary, "_IOLog", true, true)});*/
 }
 
 
 int main(int argc, char **argv) {
-    struct binary binary;
+    struct binary kernel, sandbox;
-    b_init(&binary);
+    b_init(&kernel);
-    prange_t kernel = load_file(argv[1], false, NULL);
+    b_init(&sandbox);
-    b_prange_load_macho(&binary, kernel, argv[1]);
+    b_load_macho(&kernel, argv[1], false);
-    prange_t sandbox = load_file(argv[2], true, NULL);
+    b_load_macho(&sandbox, argv[2], true);
 
     patchfd = open(argv[3], O_WRONLY | O_CREAT | O_TRUNC, 0644);
     if(patchfd == -1) {
         edie("could not open patchfd");
     }
 
-    do_kernel(kernel, sandbox, &binary);
+    do_kernel(&kernel, &sandbox);
 
     close(patchfd);
     return 0;