update readme and remove lunchd
This commit is contained in:
parent
5f73f74ea7
commit
ec9980e0f9
20
README
20
README
@ -1,9 +1,9 @@
|
|||||||
git clone git@github.com:comex/datautils0.git
|
git clone git@github.com:comex/datautils0.git
|
||||||
cd datautils0
|
cd datautils0
|
||||||
git clone git@github.com:comex/data.git
|
git clone git@github.com:comex/data.git
|
||||||
make NATIVE=1
|
make BUILD=native
|
||||||
./make_kernel_patchfile /path/to/kernelcache /tmp/patchfile
|
native/make_kernel_patchfile /path/to/kernelcache /tmp/patchfile
|
||||||
./apply_patchfile /path/to/kernelcache /tmp/patchfile /output/patched/kernelcache
|
native/apply_patchfile /path/to/kernelcache /tmp/patchfile /output/patched/kernelcache
|
||||||
|
|
||||||
Patchfile format:
|
Patchfile format:
|
||||||
|
|
||||||
@ -18,17 +18,3 @@ data datalen
|
|||||||
- If the address is 0, skip.
|
- If the address is 0, skip.
|
||||||
|
|
||||||
- If you're patching the kernel after it has already booted, you can (but need not) skip patches with names starting with "-".
|
- If you're patching the kernel after it has already booted, you can (but need not) skip patches with names starting with "-".
|
||||||
|
|
||||||
- apply_patchfile patches the kernel to start /sbin/lunchd instead of launchd. You can remove that, but the idea is that the filesystem looks like this:
|
|
||||||
|
|
||||||
/sbin/launchd: an untether exploit that execs /sbin/lunchd; skipped by an already-patched kernel
|
|
||||||
/sbin/lunchd: a script that execs /sbin/launchd.real with DYLD_INSERT_LIBRARIES set to the dylibs in /Library/LaunchExtensions; this may be used in the future by MobileSubstrate
|
|
||||||
/sbin/launchd.real: the original /sbin/launchd
|
|
||||||
|
|
||||||
This is the lunchd script:
|
|
||||||
|
|
||||||
#!/bin/bash
|
|
||||||
shopt -s nullglob
|
|
||||||
dylibs=$(for dylib in /Library/LaunchExtensions/*.dylib; do echo -n "$dylib:"; done)
|
|
||||||
export DYLD_INSERT_LIBRARIES=${dylibs%:}
|
|
||||||
exec -a /sbin/launchd /sbin/launchd.real
|
|
||||||
|
@ -91,9 +91,9 @@ void do_kernel(struct binary *binary, struct binary *sandbox) {
|
|||||||
|
|
||||||
|
|
||||||
// patches
|
// patches
|
||||||
patch("-lunchd",
|
//patch("-lunchd",
|
||||||
find_string(b_macho_segrange(binary, "__DATA"), "/sbin/launchd", 0, MUST_FIND),
|
// find_string(b_macho_segrange(binary, "__DATA"), "/sbin/launchd", 0, MUST_FIND),
|
||||||
char, "/sbin/lunchd");
|
// char, "/sbin/lunchd");
|
||||||
|
|
||||||
patch("proc_enforce",
|
patch("proc_enforce",
|
||||||
find_sysctl(binary, "proc_enforce"),
|
find_sysctl(binary, "proc_enforce"),
|
||||||
|
Loading…
Reference in New Issue
Block a user