Skip to content

Commit 51b0e43

Browse files
zhuoweizhuowei
committed
lldb_new_ld: the final runit script of doom
1 parent c69d78f commit 51b0e43

File tree

3 files changed

+137
-5
lines changed

3 files changed

+137
-5
lines changed

‎lldb_new_ld/runit.lldb

+39-4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
target modules search-paths add / /Volumes/F32THICKHD/macos114arm64e/out
12
process connect connect://localhost:3335
23
breakpoint set -n sysctlbyname -c "(int)strcmp((char*)$x0, \"kern.osvariant_status\") == 0" -o true
34
breakpoint command add
@@ -8,10 +9,22 @@ c
89
DONE
910
b SLXServer
1011
b exit
11-
b _os_log_error_impl
12-
b _os_log_debug_impl
13-
b _os_log_impl
14-
b mkdir
12+
#b _os_log_error_impl
13+
#breakpoint command add
14+
#print (char*)$x3
15+
#c
16+
#DONE
17+
#b _os_log_debug_impl
18+
#breakpoint command add
19+
#print (char*)$x3
20+
#c
21+
#DONE
22+
#b _os_log_impl
23+
#breakpoint command add
24+
#print (char*)$x3
25+
#c
26+
#DONE
27+
#b mkdir
1528
b sandbox_init_with_parameters
1629
breakpoint command add
1730
print $x0=0
@@ -25,3 +38,25 @@ print (void)strcpy((void*)$x1, "/var/tmp")
2538
print $pc=$lr
2639
c
2740
DONE
41+
breakpoint set -n IOServiceMatching -c "(int)strcmp((char*)$x0, \"IOAccelerator\") == 0" -o true
42+
breakpoint command add
43+
print $x0=(unsigned long long)strcpy((void*)malloc(0x1000), "IOAcceleratorES");
44+
c
45+
DONE
46+
breakpoint set -n IOServiceNameMatching -c "(int)strcmp((char*)$x0, \"IOSurfaceRoot\") == 0" -o true
47+
breakpoint command add
48+
print $x0=(unsigned long long)strcpy((void*)malloc(0x1000), "IOCoreSurfaceRoot");
49+
c
50+
DONE
51+
b IOServiceMatching
52+
b IOServiceNameMatching
53+
b gpu_bundle_find_trusted
54+
breakpoint command add
55+
print $x0=0
56+
print (void*)strcpy((void*)$x1, "/usr/local/zhuowei/AGXMetal13_3.bundle")
57+
print $pc=$lr
58+
DONE
59+
b +[NSBundle bundleWithPath:]
60+
b -[NSBundle load]
61+
b -[CAWindowServer _detectDisplays]
62+
b IOHIDEventSystemCreate

‎resign_any_executable/WindowServer_arm64.entitlement

+97
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.QuartzCore.debug</key>
6+
<true/>
7+
<key>com.apple.afk.user</key>
8+
<true/>
9+
<key>com.apple.appledfr.client</key>
10+
<true/>
11+
<key>com.apple.bluetooth.nsxpc</key>
12+
<true/>
13+
<key>com.apple.hid.manager.user-access-device</key>
14+
<true/>
15+
<key>com.apple.hid.manager.user-access-privileged</key>
16+
<true/>
17+
<key>com.apple.hid.multitouch.user-access</key>
18+
<true/>
19+
<key>com.apple.hid.system.server-access</key>
20+
<true/>
21+
<key>com.apple.hid.system.user-access-service</key>
22+
<true/>
23+
<key>com.apple.hidpreferences.privileged</key>
24+
<true/>
25+
<key>com.apple.iohideventsystem.server</key>
26+
<true/>
27+
<key>com.apple.keystore.sik.access</key>
28+
<true/>
29+
<key>com.apple.private.AmbientDisplay.messaging</key>
30+
<true/>
31+
<key>com.apple.private.allow-explicit-graphics-priority</key>
32+
<true/>
33+
<key>com.apple.private.colorsync.privileged</key>
34+
<true/>
35+
<key>com.apple.private.dfr.brightness-access</key>
36+
<true/>
37+
<key>com.apple.private.gpuwrangler</key>
38+
<true/>
39+
<key>com.apple.private.graphics-restart-no-kill</key>
40+
<true/>
41+
<key>com.apple.private.hid.client.admin</key>
42+
<true/>
43+
<key>com.apple.private.hid.client.event-monitor</key>
44+
<true/>
45+
<key>com.apple.private.iokit.displayservice</key>
46+
<true/>
47+
<key>com.apple.private.iokit.rootdomain-set-property</key>
48+
<true/>
49+
<key>com.apple.private.iosurfaceinfo</key>
50+
<true/>
51+
<key>com.apple.private.kernel.work-interval</key>
52+
<true/>
53+
<key>com.apple.private.tcc.allow</key>
54+
<array>
55+
<string>kTCCServiceAccessibility</string>
56+
<string>kTCCServiceListenEvent</string>
57+
<string>kTCCServicePostEvent</string>
58+
<string>kTCCServiceScreenCapture</string>
59+
</array>
60+
<key>com.apple.private.tcc.manager</key>
61+
<true/>
62+
<key>com.apple.private.xpc.launchd.per-user-lookup</key>
63+
<true/>
64+
<key>com.apple.runningboard.assertions.fuseboard</key>
65+
<true/>
66+
<key>com.apple.runningboard.process-state</key>
67+
<true/>
68+
<key>com.apple.security.exception.mach-lookup.global-name</key>
69+
<array>
70+
<string>com.apple.backlightd</string>
71+
</array>
72+
<!-- zhuowei: iOS get out of sandbox -->
73+
<key>com.apple.private.security.no-container</key>
74+
<true/>
75+
<key>platform-application</key>
76+
<true/>
77+
<!-- zhuowei: iOS probably needs this. Grabbed from splashboardd. -->
78+
<key>com.apple.security.iokit-user-client-class</key>
79+
<array>
80+
<string>AGXCommandQueue</string>
81+
<string>AGXDevice</string>
82+
<string>AGXDeviceUserClient</string>
83+
<string>AGXSharedUserClient</string>
84+
<string>AppleJPEGDriverUserClient</string>
85+
<string>IOAccelContext</string>
86+
<string>IOAccelContext2</string>
87+
<string>IOAccelDevice</string>
88+
<string>IOAccelDevice2</string>
89+
<string>IOAccelSharedUserClient</string>
90+
<string>IOAccelSharedUserClient2</string>
91+
<string>IOAccelSubmitter2</string>
92+
<string>IOMobileFramebufferUserClient</string>
93+
<string>IOSurfaceAcceleratorClient</string>
94+
<string>IOSurfaceRootUserClient</string>
95+
</array>
96+
</dict>
97+
</plist>

‎resign_any_executable/build.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
set -e
33
lipo -thin arm64e -output "$2" "$1"
44
chmod +w "$2"
5-
codesign -d --entitlement "$2.entitlement" "$2"
5+
[[ -e "$2.entitlement" ]] || codesign -d --entitlement "$2.entitlement" "$2"
66
python3 set_to_arm64.py "$2"
77
if [[ -s "$2.entitlement" ]]
88
then

0 commit comments

Comments
 (0)