From c3938c9d622dd56f1839fad4dbd41eea090f5234 Mon Sep 17 00:00:00 2001 From: comex Date: Fri, 31 Dec 2010 19:58:55 +0100 Subject: [PATCH] new stuff --- apply_patchfile.c | 45 ++++++++++++ deplaceholder.c | 77 +++++++++++++++++++-- kernel_patcher.c => make_kernel_patchfile.c | 58 ++++++++++------ 3 files changed, 152 insertions(+), 28 deletions(-) create mode 100644 apply_patchfile.c rename kernel_patcher.c => make_kernel_patchfile.c (78%) diff --git a/apply_patchfile.c b/apply_patchfile.c new file mode 100644 index 0000000..7a2b2f7 --- /dev/null +++ b/apply_patchfile.c @@ -0,0 +1,45 @@ +#include +#include +#include + +int main(int argc, char **argv) { + struct binary binary; + b_init(&binary); + mode_t mode; + prange_t kernel = load_file(argv[1], true, &mode); + b_prange_load_macho(&binary, kernel, argv[1]); + + int patchfd = open(argv[2], O_RDONLY); + if(patchfd == -1) { + edie("could not open patchfd"); + } + + while(1) { + uint32_t name_len; + ssize_t result = read(patchfd, &name_len, sizeof(name_len)); + if(result == 0) break; + assert(result == sizeof(name_len)); + assert(name_len < 128); + char *name = malloc(name_len + 1); + assert(read(patchfd, name, name_len) == (ssize_t) name_len); + name[name_len] = 0; + + addr_t addr; + assert(read(patchfd, &addr, sizeof(addr)) == sizeof(addr)); + uint32_t size; + assert(read(patchfd, &size, sizeof(size)) == sizeof(size)); + assert(size < 0x1000000); + + void *stuff = malloc(size); + assert(read(patchfd, stuff, size) == (ssize_t) size); + + printf("%s\n", name); + memcpy((char *) kernel.start + range_to_off_range((range_t) {&binary, addr, size}).start, stuff, size); + + free(name); + free(stuff); + } + + store_file(kernel, argv[3], mode); + return 0; +} diff --git a/deplaceholder.c b/deplaceholder.c index 13e43a3..2b109a5 100644 --- a/deplaceholder.c +++ b/deplaceholder.c @@ -2,8 +2,9 @@ #include #include #include -#include +#include #include +#include // count the number of set bits static int count_ones(uint32_t number) { @@ -32,12 +33,74 @@ addr_t find_init_ldmib(struct binary *binary, uint32_t cond) { return addr; } } - die("didn't find kinit /anywhere/"); + die("didn't find ldmib /anywhere/"); } -//ldmia r0!, {.., .., sp, (.., ){,2} pc} -addr_t find_init_ldm(struct binary *binary) { - +// ldmia r0/r0!, {.., .., sp,( lr,)? pc} +// OR +// ldmib r0/r0!, {.., sp,( lr,)? pc} +// aligned to 0x1000 +// each set of two bits in valid_conds is: +// 0 - known false +// 1 - known true +// 2 - unknown + +addr_t find_kernel_ldm(struct binary *binary, uint32_t valid_conds) { + range_t range; + uint32_t my_valid_conds = valid_conds; + for(int i = 0; (range = b_dyldcache_nth_segment(binary, i)).start; i++) { + if(!(binary->dyld_mappings[i].sfm_init_prot & PROT_EXEC)) continue; + char *p = rangeconv(range).start; + for(addr_t addr = range.start; addr + 4 <= (range.start + range.size); my_valid_conds = valid_conds, addr = (addr + 0x1000) & ~0xfff) { + back:; + uint32_t val = *((uint32_t *) (p + (addr - range.start))); + uint32_t cond = ((val & 0xf0000000) >> 28); + + bool harmless = false; + if(cond != 15 && 0 == (my_valid_conds & (3 << (2*cond)))) { + harmless = true; + } else if(!(val & 0xc000000)) { // data processing + uint32_t rd = (val & 0xf000) >> 12; + if(rd != 0 && rd != 15) { + harmless = true; + if(!(val & (1 << 20))) my_valid_conds = 0x1aaaaaaa; // AL known 1, others unknown + } else if(rd == 0) { + uint32_t op = ((val & 0x1f00000) >> 20); + if(op == 17 || op == 19 || op == 21 || op == 23) { + harmless = true; + my_valid_conds = 0x1aaaaaaa; + } + } + } + + if(harmless) { + //printf("@ %08x: %08x is harmless (vc=%08x)\n", addr, val, my_valid_conds); + addr += 4; + goto back; + } + + if(cond == 15 || (1u << (2*cond)) != (my_valid_conds & (3 << (2*cond)))) { + continue; + } + + //printf("ready to test %08x @ %08x\n", val, addr); + + bool ldmib; + if((val & 0xf9fa000) == 0x890a000) { + ldmib = false; + } else if((val & 0xf9fa000) == 0x990a000) { + ldmib = true; + } else { + continue; + } + //printf("%08x -> %08x (%s)\n", addr, val, ldmib ? "ib" : "ia"); + uint32_t reglist = val & 0x1fff; + if(count_ones(reglist) != (ldmib ? 1 : 2)) continue; + printf(":) %08x = %08x\n", addr, val); + return addr; + } + } + die("didn't find ldm /anywhere/"); } void do_dyldcache(prange_t pr, struct binary *binary) { @@ -61,7 +124,9 @@ void do_dyldcache(prange_t pr, struct binary *binary) { preplace32(pr, CONFIG_K19, b_dyldcache_find_anywhere(binary, "+ 80 bd", 2)); preplace32(pr, CONFIG_KINIT, find_init_ldmib(binary, is_armv7 ? 4 /* MI */ : 5 /* PL */)); - preplace32(pr, CONFIG_REMAP_FROM, find_kernel_ldm(binary)); + // NE, CS, MI, VC, HI, LT, LE, AL = 0b110100110010110 + // >>> ''.join('0' + i for i in '110100110010110') + preplace32(pr, CONFIG_REMAP_FROM, find_kernel_ldm(binary, 0x14414114)); //b_dyldcache_load_macho(binary, "/usr/lib/libSystem.B.dylib"); //preplace32(pr, 0xfeed1001, b_sym(binary, "_sysctlbyname", true)); //preplace32(pr, 0xfeed1002, b_sym(binary, "_execve", true)); diff --git a/kernel_patcher.c b/make_kernel_patchfile.c similarity index 78% rename from kernel_patcher.c rename to make_kernel_patchfile.c index 13ad5ee..9e5cda8 100644 --- a/kernel_patcher.c +++ b/make_kernel_patchfile.c @@ -2,20 +2,28 @@ #include #include #include -#include +#include -#define patch_range(name, addr, pr...) \ - ({ prange_t pr_ = pr; \ - memcpy((char *) output.start + range_to_off_range((range_t) {binary, addr, pr_.size}).start, pr_.start, pr_.size); }) +int patchfd; + +static inline void patch_with_range(const char *name, addr_t addr, prange_t pr) { + uint32_t len = strlen(name); + write(patchfd, &len, sizeof(len)); + write(patchfd, name, len); + write(patchfd, &addr, sizeof(addr)); + uint32_t size = pr.size; // size_t no good + write(patchfd, &size, sizeof(size)); + write(patchfd, pr.start, pr.size); +} #define patch(name, addr, typeof_to, to...) \ ({ typeof_to to_[] = to; \ - patch_range(name, addr, (prange_t) {&to_[0], sizeof(to_)}); }) + patch_with_range(name, addr, (prange_t) {&to_[0], sizeof(to_)}); }) uint32_t find_dvp_struct_offset(struct binary *binary) { range_t range = b_macho_segrange(binary, "__PRELINK_TEXT"); addr_t derive_vnode_path = find_bof(range, find_int32(range, find_string(range, "path", 0, true), true), b_is_armv7(binary)); - uint8_t byte = read8(binary, find_data((range_t){binary, derive_vnode_path, 1024}, !b_is_armv7(binary) ? "00 00 50 e3 02 30 a0 11 - .. 00 94 e5" : "- .. 69 6a 46", 0, true)); + uint8_t byte = b_read8(binary, find_data((range_t){binary, derive_vnode_path, 1024}, !b_is_armv7(binary) ? "00 00 50 e3 02 30 a0 11 - .. 00 94 e5" : "- .. 69 6a 46", 0, true)); if(b_is_armv7(binary)) { return (4 | (byte >> 6)) << 2; } else { @@ -49,12 +57,12 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) { //#define IN_PLACE_PATCH // patches #ifdef IN_PLACE_PATCH - patch(PATCH_KERNEL_PMAP_NX_ENABLED, + patch("kernel_pmap.nx_enabled", b_read32(binary, b_sym(binary, "_kernel_pmap", false)) + 0x420, uint32_t, {0}); #else // the second ref to mem_size - patch(PATCH_KERNEL_PMAP_NX_ENABLED, + patch("kernel_pmap.nx_enabled initializer", find_data(b_macho_segrange(binary, "__TEXT"), is_armv7 ? "03 68 - c3 f8 20 24" : "84 23 db 00 - d5 50 22 68", 0, true), uint32_t, {is_armv7 ? 0xc420f8c3 : 0x682250d0}); @@ -62,34 +70,34 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) { find_sysctl(binary, "proc_enforce"), uint32_t, {0});*/ - patch(PATCH_LUNCHD, + patch("lunchd", find_string(b_macho_segrange(binary, "__DATA"), "/sbin/launchd", 0, true), char, "/sbin/lunchd"); #endif // vm_map_enter (patch1) - allow RWX pages - patch(PATCH1, + patch("vm_map_enter", find_data(b_macho_segrange(binary, "__TEXT"), is_armv7 ? "- 02 0f .. .. 63 08 03 f0 01 05 e3 0a 13 f0 01 03" : "- .. .. .. .. .. 08 1e 1c .. 0a 01 22 .. 1c 16 40 .. 40", 0, true), uint32_t, {is_armv7 ? 0x46c00f02 : 0x46c046c0}); // AMFI (patch3) - disable the predefined list of executable stuff - patch(PATCH3, + patch("AMFI", find_data(b_macho_segrange(binary, "__PRELINK_TEXT"), is_armv7 ? "23 78 9c 45 05 d1 .. .. .. .. .. .. .. 4b 98 47 00 .. -" : "13 20 a0 e3 .. .. .. .. 33 ff 2f e1 00 00 50 e3 00 00 00 0a .. 40 a0 e3 - 04 00 a0 e1 90 80 bd e8", 0, true), uint32_t, {is_armv7 ? 0x1c201c20 : 0xe3a00001}); // PE_i_can_has_debugger (patch4) - so AMFI allows non-ldid'd binaries (and some other stuff is allowed) - patch(PATCH4, + patch("PE_i_can_has_debugger", b_sym(binary, "_PE_i_can_has_debugger", false), uint32_t, {0x47702001}); // task_for_pid 0 // this is necessary so a reboot isn't required after using the screwed up version - patch(PATCH_TFP0, + patch("task_for_pid 0", find_data(b_macho_segrange(binary, "__TEXT"), is_armv7 ? "85 68 00 23 .. 93 .. 93 - 5c b9 .. .. 29 46 04 22" : "85 68 .. 93 .. 93 - 00 2c 0b d1", 0, true), uint32_t, {is_armv7 ? 0x46c0e00b : 0xe00b2c00}); // cs_enforcement_disable - patch(PATCH_CS_ENFORCEMENT_DISABLE, + patch("cs_enforcement_disable", resolve_ldr(binary, find_data(b_macho_segrange(binary, "__TEXT"), is_armv7 ? "1d ee 90 3f d3 f8 4c 33 d3 f8 9c 20 + .. .. .. .. 19 68 00 29" : "9c 22 03 59 99 58 + .. .. 1a 68 00 2a", 0, true)), uint32_t, {1}); @@ -107,14 +115,14 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) { addr_t scratch = find_scratch(binary); - patch(SB_EVALUATE, + patch("sb_evaluate", sb_evaluate, uint32_t, {(is_armv7 ? 0xf000f8df : 0xe51ff004), scratch | 1}); check_no_placeholders(sandbox); - patch_range(SANDBOX, - scratch, - sandbox); + patch_with_range("sb_evaluate hook", + scratch, + sandbox); fprintf(stderr, "scratch = %x\n", scratch); } @@ -123,11 +131,17 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) { int main(int argc, char **argv) { struct binary binary; b_init(&binary); - b_load_macho(&binary, argv[1], false); - mode_t mode; - prange_t kernel = load_file(argv[1], true, &mode); + prange_t kernel = load_file(argv[1], false, NULL); + b_prange_load_macho(&binary, kernel, argv[1]); prange_t sandbox = load_file(argv[2], true, NULL); + + patchfd = open(argv[3], O_WRONLY | O_CREAT | O_TRUNC, 0644); + if(patchfd == -1) { + edie("could not open patchfd"); + } + do_kernel(kernel, sandbox, &binary); - store_file(kernel, argv[3], mode); + + close(patchfd); return 0; }