nganhkhoa/ios-kernel-patch
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

unhelpful commit message

Browse Source
This commit is contained in:
comex 2011-01-03 00:04:28 -05:00
parent 5afa88103b
commit f1a6b079fc
4 changed files with 192 additions and 227 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
apply_patchfile.c
View File

@ -26,15 +26,18 @@ int main(int argc, char **argv) {
addr_t addr;
assert(read(patchfd, &addr, sizeof(addr)) == sizeof(addr));
uint32_t size;
assert(read(patchfd, &size, sizeof(size)) == sizeof(size));
assert(size < 0x1000000);
void *stuff = malloc(size);
assert(read(patchfd, stuff, size) == (ssize_t) size);
printf("%s\n", name);
memcpy((char *) kernel.start + range_to_off_range((range_t) {&binary, addr, size}).start, stuff, size);
if(addr != 0) {
printf("%s\n", name);
memcpy((char *) kernel.start + range_to_off_range((range_t) {&binary, addr, size}).start, stuff, size);
}
free(name);
free(stuff);

219
deplaceholder.c
View File

@ -1,219 +0,0 @@
#include <data/common.h>
#include <data/find.h>
#include <data/binary.h>
#include <data/cc.h>
#include <config/placeholder.h>
#include <data/running_kernel.h>
#include <data/dyld_cache_format.h>
// count the number of set bits
static int count_ones(uint32_t number) {
int result = 0;
for(; number; number >>= 1) {
result += (number & 1);
}
return result;
}
// ldmib<cond> r11/r11!, {.., .., .., sp, pc}
addr_t find_init_ldmib(struct binary *binary, uint32_t cond) {
range_t range;
for(int i = 0; (range = b_dyldcache_nth_segment(binary, i)).start; i++) {
uint32_t *p = rangeconv(range).start;
for(addr_t addr = range.start; addr + 4 <= (range.start + range.size); addr += 4) {
// <3 http://a.qoid.us/01x.py
// fun fact: on armv6 this is actually UNPREDICTABLE
uint32_t val = *p++;
if((val & 0xf9fe000) != 0x99ba000) continue;
uint32_t actual_cond = ((val & 0xf0000000) >> 28);
if(actual_cond != cond) continue;
uint32_t reglist = val & 0x1fff;
// The famous interview question: calculate the number of 1 bits
if(count_ones(reglist) != 3) continue;
return addr;
}
}
die("didn't find ldmib /anywhere/");
}
// ldmia<cond> r0/r0!, {.., .., sp,( lr,)? pc}
// OR
// ldmib<cond> r0/r0!, {.., sp,( lr,)? pc}
// aligned to 0x1000
// each set of two bits in valid_conds is:
// 0 - known false
// 1 - known true
// 2 - unknown
addr_t find_kernel_ldm(struct binary *binary, uint32_t valid_conds) {
range_t range;
uint32_t my_valid_conds = valid_conds;
for(int i = 0; (range = b_dyldcache_nth_segment(binary, i)).start; i++) {
if(!(binary->dyld_mappings[i].sfm_init_prot & PROT_EXEC)) continue;
char *p = rangeconv(range).start;
for(addr_t addr = range.start; addr + 4 <= (range.start + range.size); my_valid_conds = valid_conds, addr = (addr + 0x1000) & ~0xfff) {
back:;
uint32_t val = *((uint32_t *) (p + (addr - range.start)));
uint32_t cond = ((val & 0xf0000000) >> 28);
bool harmless = false;
if(cond != 15 && 0 == (my_valid_conds & (3 << (2*cond)))) {
harmless = true;
} else if(!(val & 0xc000000)) { // data processing
uint32_t rd = (val & 0xf000) >> 12;
if(rd != 0 && rd != 15) {
harmless = true;
if(!(val & (1 << 20))) my_valid_conds = 0x1aaaaaaa; // AL known 1, others unknown
} else if(rd == 0) {
uint32_t op = ((val & 0x1f00000) >> 20);
if(op == 17 || op == 19 || op == 21 || op == 23) {
harmless = true;
my_valid_conds = 0x1aaaaaaa;
}
}
}
if(harmless) {
//printf("@ %08x: %08x is harmless (vc=%08x)\n", addr, val, my_valid_conds);
addr += 4;
goto back;
}
if(cond == 15 || (1u << (2*cond)) != (my_valid_conds & (3 << (2*cond)))) {
continue;
}
//printf("ready to test %08x @ %08x\n", val, addr);
bool ldmib;
if((val & 0xf9fa000) == 0x890a000) {
ldmib = false;
} else if((val & 0xf9fa000) == 0x990a000) {
ldmib = true;
} else {
continue;
}
//printf("%08x -> %08x (%s)\n", addr, val, ldmib ? "ib" : "ia");
uint32_t reglist = val & 0x1fff;
if(count_ones(reglist) != (ldmib ? 1 : 2)) continue;
//printf(":) %08x = %08x\n", addr, val);
return addr;
}
}
die("didn't find ldm /anywhere/");
}
void do_dyldcache(prange_t pr, struct binary *binary) {
bool is_armv7 = b_is_armv7(binary);
preplace32(pr, CONFIG_IS_ARMV7, (uint32_t) is_armv7);
int align = is_armv7 ? 2 : 4;
preplace32(pr, CONFIG_K4, b_dyldcache_find_anywhere(binary, is_armv7 ? "+ 00 68 b0 bd" : "- 00 00 90 e5 b0 80 bd e8", align));
preplace32(pr, CONFIG_K5, b_dyldcache_find_anywhere(binary, is_armv7 ? "+ 20 60 90 bd" : "- 00 00 84 e5 90 80 bd e8", align));
preplace32(pr, CONFIG_K6, b_dyldcache_find_anywhere(binary, is_armv7 ? "+ 20 44 90 bd" : "- 00 00 84 e0 90 80 bd e8", align));
preplace32(pr, CONFIG_K7, b_dyldcache_find_anywhere(binary, is_armv7 ? "+ 0f bd" : "- 0f 80 bd e8", align));
preplace32(pr, CONFIG_K9, b_dyldcache_find_anywhere(binary, "+ 0e bd", 2));
preplace32(pr, CONFIG_K10, b_dyldcache_find_anywhere(binary, is_armv7 ? "+ a7 f1 00 0d 80 bd" : "- 00 d0 47 e2 80 80 bd e8", align));
preplace32(pr, CONFIG_K11, b_dyldcache_find_anywhere(binary, "+ f0 bd", 2));
preplace32(pr, CONFIG_K12, b_dyldcache_find_anywhere(binary, is_armv7 ? "+ a0 47 b0 bd" : "- 34 ff 2f e1 b0 80 bd e8", align));
preplace32(pr, CONFIG_K14, b_dyldcache_find_anywhere(binary, "+ 20 58 90 bd", 2));
preplace32(pr, CONFIG_K15, b_dyldcache_find_anywhere(binary, is_armv7 ? "+ 40 f8 04 4b 90 bd" : "- 00 40 80 e5 90 80 bd e8", align));
preplace32(pr, CONFIG_K16, b_dyldcache_find_anywhere(binary, is_armv7 ? "+ 20 68 90 bd" : "- 00 00 94 e5 90 80 bd e8", align));
preplace32(pr, CONFIG_K17, b_dyldcache_find_anywhere(binary, is_armv7 ? "+ 25 60 b0 bd" : "- 00 50 84 e5 b0 80 bd e8", align));
preplace32(pr, CONFIG_K18, b_dyldcache_find_anywhere(binary, "+ 10 bd", 2));
preplace32(pr, CONFIG_K19, b_dyldcache_find_anywhere(binary, "+ 80 bd", 2));
preplace32(pr, CONFIG_KINIT, find_init_ldmib(binary, is_armv7 ? 4 /* MI */ : 5 /* PL */));
// NE, CS, MI, VC, HI, LT, LE, AL = 0b110100110010110
// >>> ''.join('0' + i for i in '110100110010110')
preplace32(pr, CONFIG_REMAP_FROM, find_kernel_ldm(binary, 0x14414114));
//b_dyldcache_load_macho(binary, "/usr/lib/libSystem.B.dylib");
//preplace32(pr, 0xfeed1001, b_sym(binary, "_sysctlbyname", true));
//preplace32(pr, 0xfeed1002, b_sym(binary, "_execve", true));
}
void do_dyld(prange_t pr, struct binary *binary) {
(void) pr; (void) binary;
}
void do_kernel(prange_t pr, struct binary *binary) {
addr_t sysent = find_data(b_macho_segrange(binary, "__DATA"), "21 00 00 00 00 10 86 00 -", 0, true);
preplace32(pr, CONFIG_SYSENT_PATCH, sysent + 4);
addr_t sysent_patch_orig = b_read32(binary, sysent + 4);
preplace32(pr, CONFIG_SYSENT_PATCH_ORIG, sysent_patch_orig);
preplace32(pr, CONFIG_TARGET_ADDR, (sysent_patch_orig & 0x00ffffff) | 0x2f000000);
}
int main(int argc, char **argv) {
struct binary kernel, dyld, cache;
b_init(&kernel);
b_init(&dyld);
b_init(&cache);
char **p = &argv[1];
if(!p[0]) goto usage;
while(p[0]) {
if(p[0][0] == '-') switch(p[0][1]) {
case 'C':
b_load_running_dyldcache(&cache, (void *) 0x30000000);
p++;
break;
case 'c':
if(!p[1]) goto usage;
b_load_dyldcache(&cache, p[1], false);
p += 2;
break;
case 'k':
if(!p[1]) goto usage;
b_load_macho(&kernel, p[1], false);
p += 2;
break;
case 'd':
if(!p[1]) goto usage;
b_load_macho(&dyld, p[1], false);
p += 2;
break;
case 'K': {
b_running_kernel_load_macho(&kernel);
p++;
break;
}
#ifdef IMG3_SUPPORT
case 'i': {
if(!p[1] || !p[2] || !p[3]) goto usage;
uint32_t key_bits;
prange_t key = parse_hex_string(p[2]);
prange_t iv = parse_hex_string(p[3]);
prange_t data = parse_img3_file(p[1], &key_bits);
prange_t kern = decrypt_and_decompress(key_bits, key, iv, data);
b_prange_load_macho(&kernel, kern, false);
p += 4;
break;
}
#endif
default:
goto usage;
}
else { // not a -
if(!p[1]) goto usage;
mode_t mode;
prange_t pr = load_file(p[0], true, &mode);
if(cache.valid) do_dyldcache(pr, &cache);
if(kernel.valid) do_kernel(pr, &kernel);
if(dyld.valid) do_dyld(pr, &dyld);
check_no_placeholders(pr);
store_file(pr, p[1], mode);
punmap(pr);
p += 2;
}
}
return 0;
usage:
fprintf(stderr, "Usage: data [-c cache | -C] [-d dyld] [-k kc | -K"
#ifdef IMG3_SUPPORT
" | -i kernel_img3 key iv"
#endif
"] infile outfile [infile outfile...]\n");
return 1;
}

175
dmini.c Normal file
View File

@ -0,0 +1,175 @@
#include <data/common.h>
#include <data/find.h>
#include <data/binary.h>
#include <data/cc.h>
#include <config/placeholder.h>
#include <data/running_kernel.h>
#include <data/dyld_cache_format.h>
static struct binary binary;
// count the number of set bits
static int count_ones(uint32_t number) {
int result = 0;
for(; number; number >>= 1) {
result += (number & 1);
}
return result;
}
// ldmia<cond> r0/r0!, {.., .., sp,( lr,)? pc}
// OR
// ldmib<cond> r0/r0!, {.., sp,( lr,)? pc}
// aligned to 0x1000
// each set of two bits in valid_conds is:
// 0 - known false
// 1 - known true
// 2 - unknown
addr_t find_kernel_ldm(struct binary *binary, uint32_t valid_conds) {
range_t range;
uint32_t my_valid_conds = valid_conds;
for(int i = 0; (range = b_nth_segment(binary, i)).binary; i++) {
if(!(binary->dyld_mappings[i].sfm_init_prot & PROT_EXEC)) continue;
char *p = rangeconv(range).start;
for(addr_t addr = range.start; addr + 4 <= (range.start + range.size); my_valid_conds = valid_conds, addr = (addr + 0x1000) & ~0xfff) {
back:;
uint32_t val = *((uint32_t *) (p + (addr - range.start)));
uint32_t cond = ((val & 0xf0000000) >> 28);
bool harmless = false;
if(cond != 15 && 0 == (my_valid_conds & (3 << (2*cond)))) {
harmless = true;
} else if(!(val & 0xc000000)) { // data processing
uint32_t rd = (val & 0xf000) >> 12;
if(rd != 0 && rd != 15) {
harmless = true;
if(!(val & (1 << 20))) my_valid_conds = 0x1aaaaaaa; // AL known 1, others unknown
} else if(rd == 0) {
uint32_t op = ((val & 0x1f00000) >> 20);
if(op == 17 || op == 19 || op == 21 || op == 23) {
harmless = true;
my_valid_conds = 0x1aaaaaaa;
}
}
}
if(harmless) {
//printf("@ %08x: %08x is harmless (vc=%08x)\n", addr, val, my_valid_conds);
addr += 4;
goto back;
}
if(cond == 15 || (1u << (2*cond)) != (my_valid_conds & (3 << (2*cond)))) {
continue;
}
//printf("ready to test %08x @ %08x\n", val, addr);
bool ldmib;
if((val & 0xf9fa000) == 0x890a000) {
ldmib = false;
} else if((val & 0xf9fa000) == 0x990a000) {
ldmib = true;
} else {
continue;
}
//printf("%08x -> %08x (%s)\n", addr, val, ldmib ? "ib" : "ia");
uint32_t reglist = val & 0x1fff;
if(count_ones(reglist) != (ldmib ? 1 : 2)) continue;
//printf(":) %08x = %08x\n", addr, val);
return addr;
}
}
die("didn't find ldm /anywhere/");
}
void main_loop() {
printf("+ %d\n", binary.actual_cpusubtype);
fflush(stdout);
while(1) {
char arg[129]; arg[0] = 0;
int mode = 0;
if(scanf("%d ", &mode) != 1) die("?");
if(!fgets(arg, sizeof(arg), stdin)) die("?");
arg[strlen(arg) - 1] = 0;
addr_t result;
if(mode == 0) {
result = b_find_anywhere(&binary, arg, arg[0] == '+' ? 2 : 4, false);
} else if(mode == 1) {
result = b_sym(&binary, arg, true);
} else if(mode == 2) {
b_dyldcache_load_macho(&binary, arg);
result = 0;
} else die("mode?");
printf("+ %x\n", result);
fflush(stdout);
}
}
int main(int argc, char **argv) {
b_init(&binary);
char **p = &argv[1];
if(!p[0]) goto usage;
while(p[0]) {
if(p[0][0] == '-') switch(p[0][1]) {
case 'C':
b_load_running_dyldcache(&binary, (void *) 0x30000000);
p++;
break;
case 'c':
if(!p[1]) goto usage;
b_load_dyldcache(&binary, p[1], false);
p += 2;
break;
case 'k':
if(!p[1]) goto usage;
b_load_macho(&binary, p[1], false);
p += 2;
break;
case 'd':
if(!p[1]) goto usage;
b_load_macho(&binary, p[1], false);
p += 2;
break;
case 'K': {
b_running_kernel_load_macho(&binary);
p++;
break;
}
#ifdef IMG3_SUPPORT
case 'i': {
if(!p[1] || !p[2] || !p[3]) goto usage;
uint32_t key_bits;
prange_t key = parse_hex_string(p[2]);
prange_t iv = parse_hex_string(p[3]);
prange_t data = parse_img3_file(p[1], &key_bits);
prange_t kern = decrypt_and_decompress(key_bits, key, iv, data);
b_prange_load_macho(&binary, kern, false);
p += 4;
break;
}
#endif
default:
goto usage;
}
}
main_loop();
return 0;
usage:
fprintf(stderr, "Usage: dmini [-c cache | -C] [-d dyld] [-k kc | -K"
#ifdef IMG3_SUPPORT
" | -i kernel_img3 key iv"
#endif
"]\n");
return 1;
}

16
make_kernel_patchfile.c
View File

@ -21,10 +21,11 @@ static inline void patch_with_range(const char *name, addr_t addr, prange_t pr)
patch_with_range(name, addr, (prange_t) {&to_[0], sizeof(to_)}); })
uint32_t find_dvp_struct_offset(struct binary *binary) {
bool is_armv7 = binary->actual_cpusubtype == 9;
range_t range = b_macho_segrange(binary, "__PRELINK_TEXT");
addr_t derive_vnode_path = find_bof(range, find_int32(range, find_string(range, "path", 0, true), true), b_is_armv7(binary));
uint8_t byte = b_read8(binary, find_data((range_t){binary, derive_vnode_path, 1024}, !b_is_armv7(binary) ? "00 00 50 e3 02 30 a0 11 - .. 00 94 e5" : "- .. 69 6a 46", 0, true));
if(b_is_armv7(binary)) {
addr_t derive_vnode_path = find_bof(range, find_int32(range, find_string(range, "path", 0, true), true), is_armv7);
uint8_t byte = b_read8(binary, find_data((range_t){binary, derive_vnode_path, 1024}, !is_armv7 ? "00 00 50 e3 02 30 a0 11 - .. 00 94 e5" : "- .. 69 6a 46", 0, true));
if(is_armv7) {
return (4 | (byte >> 6)) << 2;
} else {
return byte;
@ -52,7 +53,7 @@ addr_t find_sysctl(struct binary *binary, const char *name) {
}
void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
bool is_armv7 = b_is_armv7(binary);
bool is_armv7 = binary->actual_cpusubtype == 9;
//#define IN_PLACE_PATCH
// patches
@ -124,6 +125,11 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
scratch,
sandbox);
addr_t sysent = find_data(b_macho_segrange(binary, "__DATA"), "21 00 00 00 00 10 86 00 -", 0, true);
addr_t sysent_patch_orig = b_read32(binary, sysent + 4);
patch("sysent patch", 0, uint32_t, {sysent + 4});
patch("sysent patch orig", 0, uint32_t, {sysent_patch_orig});
fprintf(stderr, "scratch = %x\n", scratch);
}
@ -139,7 +145,7 @@ int main(int argc, char **argv) {
if(patchfd == -1) {
edie("could not open patchfd");
}
do_kernel(kernel, sandbox, &binary);
close(patchfd);