From ec9980e0f91aeed0856051146a6dd651d4e0161e Mon Sep 17 00:00:00 2001 From: comex Date: Mon, 23 May 2011 14:19:18 -0400 Subject: [PATCH] update readme and remove lunchd --- README | 20 +++----------------- make_kernel_patchfile.c | 6 +++--- 2 files changed, 6 insertions(+), 20 deletions(-) diff --git a/README b/README index 3972e69..3ff8147 100644 --- a/README +++ b/README @@ -1,9 +1,9 @@ git clone git@github.com:comex/datautils0.git cd datautils0 git clone git@github.com:comex/data.git -make NATIVE=1 -./make_kernel_patchfile /path/to/kernelcache /tmp/patchfile -./apply_patchfile /path/to/kernelcache /tmp/patchfile /output/patched/kernelcache +make BUILD=native +native/make_kernel_patchfile /path/to/kernelcache /tmp/patchfile +native/apply_patchfile /path/to/kernelcache /tmp/patchfile /output/patched/kernelcache Patchfile format: @@ -18,17 +18,3 @@ data datalen - If the address is 0, skip. - If you're patching the kernel after it has already booted, you can (but need not) skip patches with names starting with "-". - -- apply_patchfile patches the kernel to start /sbin/lunchd instead of launchd. You can remove that, but the idea is that the filesystem looks like this: - -/sbin/launchd: an untether exploit that execs /sbin/lunchd; skipped by an already-patched kernel -/sbin/lunchd: a script that execs /sbin/launchd.real with DYLD_INSERT_LIBRARIES set to the dylibs in /Library/LaunchExtensions; this may be used in the future by MobileSubstrate -/sbin/launchd.real: the original /sbin/launchd - -This is the lunchd script: - - #!/bin/bash - shopt -s nullglob - dylibs=$(for dylib in /Library/LaunchExtensions/*.dylib; do echo -n "$dylib:"; done) - export DYLD_INSERT_LIBRARIES=${dylibs%:} - exec -a /sbin/launchd /sbin/launchd.real diff --git a/make_kernel_patchfile.c b/make_kernel_patchfile.c index c1e0d21..faa0f41 100644 --- a/make_kernel_patchfile.c +++ b/make_kernel_patchfile.c @@ -91,9 +91,9 @@ void do_kernel(struct binary *binary, struct binary *sandbox) { // patches - patch("-lunchd", - find_string(b_macho_segrange(binary, "__DATA"), "/sbin/launchd", 0, MUST_FIND), - char, "/sbin/lunchd"); + //patch("-lunchd", + // find_string(b_macho_segrange(binary, "__DATA"), "/sbin/launchd", 0, MUST_FIND), + // char, "/sbin/lunchd"); patch("proc_enforce", find_sysctl(binary, "proc_enforce"),