new stuff

config/generate_config.h.py

@@ -1,9 +1,10 @@
-import re, os, sys
+import re, os, sys, struct
 os.chdir(os.path.dirname(os.path.realpath(sys.argv[0])))
 
-number = 0xfeed0000
+minimum_number = number = 0xfeed0000
 ch = open('config.h', 'w')
 cah = open('config_asm.h', 'w')
+pt = open('placeholder_test.bin', 'wb')
 
 for line in open('config.txt'):
     line = re.sub('//.*$', '', line).strip()
@@ -16,3 +17,5 @@
     number += 1
     print >> ch, 'static volatile const unsigned int %s = %s;' % (line, val)
     print >> cah, '#define %s %s' % (line, val)
+    pt.write(struct.pack('I', number))    
+

config/placeholder.h

@@ -0,0 +1,32 @@
+#include "../config/config_asm.h"
+
+// preplace32 is lazy
+#define preplace32(range, a, b) do { uintptr_t _ = preplace32_a(range, a); if(_) preplace32_b(range, _, a, b); } while(0)
+
+static void check_no_placeholders(prange_t pr) {
+    for(uintptr_t addr = (uintptr_t)pr.start; addr + sizeof(uint32_t) <= (uintptr_t)pr.start + pr.size; addr++) {
+        uint32_t val = *(uint32_t *)addr;
+        if(val > CONFIG_MIN && val < CONFIG_MAX) {
+            die("got %08x", val);
+        }
+    }
+}
+
+static uintptr_t preplace32_a(prange_t range, uint32_t a) {
+    for(uintptr_t addr = (uintptr_t)range.start; addr + sizeof(uint32_t) <= (uintptr_t)range.start + range.size; addr++) {
+        if(*(uint32_t *)addr == a) {
+            return addr;
+        }
+    }
+    //fprintf(stderr, "preplace32: warning: didn't find %08x anywhere\n", a);
+    return 0;
+}
+
+static void preplace32_b(prange_t range, uintptr_t start, uint32_t a, uint32_t b) {
+    for(uintptr_t addr = start; addr + sizeof(uint32_t) <= (uintptr_t)range.start + range.size; addr++) {
+        if(*(uint32_t *)addr == a) {
+            *(uint32_t *)addr = b;
+        }
+    }
+}
+

datautils/apply_patchfile.c

@@ -0,0 +1,45 @@
+#include <data/common.h>
+#include <data/binary.h>
+#include <assert.h>
+
+int main(int argc, char **argv) {
+    struct binary binary;
+    b_init(&binary);
+    mode_t mode;
+    prange_t kernel = load_file(argv[1], true, &mode);
+    b_prange_load_macho(&binary, kernel, argv[1]);
+
+    int patchfd = open(argv[2], O_RDONLY);
+    if(patchfd == -1) {
+        edie("could not open patchfd");
+    }
+
+    while(1) {
+        uint32_t name_len;
+        ssize_t result = read(patchfd, &name_len, sizeof(name_len));
+        if(result == 0) break;
+        assert(result == sizeof(name_len));
+        assert(name_len < 128);
+        char *name = malloc(name_len + 1);
+        assert(read(patchfd, name, name_len) == (ssize_t) name_len);
+        name[name_len] = 0;
+
+        addr_t addr;
+        assert(read(patchfd, &addr, sizeof(addr)) == sizeof(addr));
+        uint32_t size;
+        assert(read(patchfd, &size, sizeof(size)) == sizeof(size));
+        assert(size < 0x1000000);
+
+        void *stuff = malloc(size);
+        assert(read(patchfd, stuff, size) == (ssize_t) size);
+
+        printf("%s\n", name);
+        memcpy((char *) kernel.start + range_to_off_range((range_t) {&binary, addr, size}).start, stuff, size);
+
+        free(name);
+        free(stuff);
+    }
+
+    store_file(kernel, argv[3], mode);
+    return 0;
+}

datautils/deplaceholder.c

@@ -2,8 +2,9 @@
 #include <data/find.h>
 #include <data/binary.h>
 #include <data/cc.h>
-#include <data/placeholder.h>
+#include <config/placeholder.h>
 #include <data/running_kernel.h>
+#include <data/dyld_cache_format.h>
 
 // count the number of set bits
 static int count_ones(uint32_t number) {
@@ -32,12 +33,74 @@ addr_t find_init_ldmib(struct binary *binary, uint32_t cond) {
             return addr; 
         }
     }
-    die("didn't find kinit /anywhere/"); 
+    die("didn't find ldmib /anywhere/"); 
 }
 
-//ldmia<cond> r0!, {.., .., sp, (.., ){,2} pc}
-addr_t find_init_ldm(struct binary *binary) {
-
+// ldmia<cond> r0/r0!, {.., .., sp,( lr,)? pc}
+// OR
+// ldmib<cond> r0/r0!, {.., sp,( lr,)? pc}
+// aligned to 0x1000
+// each set of two bits in valid_conds is:
+//  0 - known false
+//  1 - known true
+//  2 - unknown
+
+addr_t find_kernel_ldm(struct binary *binary, uint32_t valid_conds) {
+    range_t range;
+    uint32_t my_valid_conds = valid_conds;
+    for(int i = 0; (range = b_dyldcache_nth_segment(binary, i)).start; i++) {
+        if(!(binary->dyld_mappings[i].sfm_init_prot & PROT_EXEC)) continue;
+        char *p = rangeconv(range).start;
+        for(addr_t addr = range.start; addr + 4 <= (range.start + range.size); my_valid_conds = valid_conds, addr = (addr + 0x1000) & ~0xfff) {
+            back:;
+            uint32_t val = *((uint32_t *) (p + (addr - range.start)));
+            uint32_t cond = ((val & 0xf0000000) >> 28);
+
+            bool harmless = false;
+            if(cond != 15 && 0 == (my_valid_conds & (3 << (2*cond)))) {
+                harmless = true;
+            } else if(!(val & 0xc000000)) { // data processing
+                uint32_t rd = (val & 0xf000) >> 12;
+                if(rd != 0 && rd != 15) {
+                    harmless = true;
+                    if(!(val & (1 << 20))) my_valid_conds = 0x1aaaaaaa; // AL known 1, others unknown
+                } else if(rd == 0) {
+                    uint32_t op = ((val & 0x1f00000) >> 20);
+                    if(op == 17 || op == 19 || op == 21 || op == 23) {
+                        harmless = true;
+                        my_valid_conds = 0x1aaaaaaa;
+                    }
+                }
+            }
+
+            if(harmless) {
+                //printf("@ %08x: %08x is harmless (vc=%08x)\n", addr, val, my_valid_conds);
+                addr += 4;
+                goto back;
+            }
+
+            if(cond == 15 || (1u << (2*cond)) != (my_valid_conds & (3 << (2*cond)))) {
+                continue;
+            }
+
+            //printf("ready to test %08x @ %08x\n", val, addr);
+
+            bool ldmib;
+            if((val & 0xf9fa000) == 0x890a000) {
+                ldmib = false;
+            } else if((val & 0xf9fa000) == 0x990a000) {
+                ldmib = true;
+            } else {
+                continue;
+            }
+            //printf("%08x -> %08x (%s)\n", addr, val, ldmib ? "ib" : "ia");
+            uint32_t reglist = val & 0x1fff;
+            if(count_ones(reglist) != (ldmib ? 1 : 2)) continue;
+            printf(":) %08x = %08x\n", addr, val);
+            return addr; 
+        }
+    }
+    die("didn't find ldm /anywhere/"); 
 }
 
 void do_dyldcache(prange_t pr, struct binary *binary) {
@@ -61,7 +124,9 @@ void do_dyldcache(prange_t pr, struct binary *binary) {
     preplace32(pr, CONFIG_K19, b_dyldcache_find_anywhere(binary, "+ 80 bd", 2));
     preplace32(pr, CONFIG_KINIT, find_init_ldmib(binary, is_armv7 ? 4 /* MI */ : 5 /* PL */));
 
-    preplace32(pr, CONFIG_REMAP_FROM, find_kernel_ldm(binary));
+    // NE, CS, MI, VC, HI, LT, LE, AL = 0b110100110010110
+    // >>> ''.join('0' + i for i in '110100110010110')
+    preplace32(pr, CONFIG_REMAP_FROM, find_kernel_ldm(binary, 0x14414114));
     //b_dyldcache_load_macho(binary, "/usr/lib/libSystem.B.dylib");
     //preplace32(pr, 0xfeed1001, b_sym(binary, "_sysctlbyname", true));
     //preplace32(pr, 0xfeed1002, b_sym(binary, "_execve", true));

datautils/kernel_patcher.c → datautils/make_kernel_patchfile.c

@@ -2,20 +2,28 @@
 #include <data/find.h>
 #include <data/binary.h>
 #include <data/cc.h>
-#include <data/placeholder.h>
-
-#define patch_range(name, addr, pr...) \
-    ({ prange_t pr_ = pr; \
-       memcpy((char *) output.start + range_to_off_range((range_t) {binary, addr, pr_.size}).start, pr_.start, pr_.size); })
+#include <config/placeholder.h>
+
+int patchfd;
+
+static inline void patch_with_range(const char *name, addr_t addr, prange_t pr) {
+    uint32_t len = strlen(name);
+    write(patchfd, &len, sizeof(len));
+    write(patchfd, name, len);
+    write(patchfd, &addr, sizeof(addr));
+    uint32_t size = pr.size; // size_t no good
+    write(patchfd, &size, sizeof(size));
+    write(patchfd, pr.start, pr.size);
+}
 
 #define patch(name, addr, typeof_to, to...) \
     ({ typeof_to to_[] = to; \
-       patch_range(name, addr, (prange_t) {&to_[0], sizeof(to_)}); })
+       patch_with_range(name, addr, (prange_t) {&to_[0], sizeof(to_)}); })
 
 uint32_t find_dvp_struct_offset(struct binary *binary) {
     range_t range = b_macho_segrange(binary, "__PRELINK_TEXT");
     addr_t derive_vnode_path = find_bof(range, find_int32(range, find_string(range, "path", 0, true), true), b_is_armv7(binary));
-    uint8_t byte = read8(binary, find_data((range_t){binary, derive_vnode_path, 1024}, !b_is_armv7(binary) ? "00 00 50 e3 02 30 a0 11 - .. 00 94 e5" : "- .. 69 6a 46", 0, true));
+    uint8_t byte = b_read8(binary, find_data((range_t){binary, derive_vnode_path, 1024}, !b_is_armv7(binary) ? "00 00 50 e3 02 30 a0 11 - .. 00 94 e5" : "- .. 69 6a 46", 0, true));
     if(b_is_armv7(binary)) {
         return (4 | (byte >> 6)) << 2;
     } else {
@@ -49,47 +57,47 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
 //#define IN_PLACE_PATCH
     // patches
 #ifdef IN_PLACE_PATCH
-    patch(PATCH_KERNEL_PMAP_NX_ENABLED,
+    patch("kernel_pmap.nx_enabled",
           b_read32(binary, b_sym(binary, "_kernel_pmap", false)) + 0x420,
           uint32_t, {0});
 #else
     // the second ref to mem_size
-    patch(PATCH_KERNEL_PMAP_NX_ENABLED,
+    patch("kernel_pmap.nx_enabled initializer",
           find_data(b_macho_segrange(binary, "__TEXT"), is_armv7 ? "03 68 - c3 f8 20 24" : "84 23 db 00 - d5 50 22 68", 0, true),
           uint32_t, {is_armv7 ? 0xc420f8c3 : 0x682250d0});
 
     /*patch(PATCH_PROC_ENFORCE,
           find_sysctl(binary, "proc_enforce"),
           uint32_t, {0});*/
 
-    patch(PATCH_LUNCHD,
+    patch("lunchd",
           find_string(b_macho_segrange(binary, "__DATA"), "/sbin/launchd", 0, true),
           char, "/sbin/lunchd");
 #endif
 
     // vm_map_enter (patch1) - allow RWX pages
-    patch(PATCH1,
+    patch("vm_map_enter",
           find_data(b_macho_segrange(binary, "__TEXT"), is_armv7 ? "- 02 0f .. .. 63 08 03 f0 01 05 e3 0a 13 f0 01 03" : "- .. .. .. .. .. 08 1e 1c .. 0a 01 22 .. 1c 16 40 .. 40", 0, true),
           uint32_t, {is_armv7 ? 0x46c00f02 : 0x46c046c0});
 
     // AMFI (patch3) - disable the predefined list of executable stuff
-    patch(PATCH3,
+    patch("AMFI",
           find_data(b_macho_segrange(binary, "__PRELINK_TEXT"), is_armv7 ? "23 78 9c 45 05 d1 .. .. .. .. .. .. .. 4b 98 47 00 .. -" : "13 20 a0 e3 .. .. .. .. 33 ff 2f e1 00 00 50 e3 00 00 00 0a .. 40 a0 e3 - 04 00 a0 e1 90 80 bd e8", 0, true),
           uint32_t, {is_armv7 ? 0x1c201c20 : 0xe3a00001});
     // PE_i_can_has_debugger (patch4) - so AMFI allows non-ldid'd binaries (and some other stuff is allowed)
-    patch(PATCH4,
+    patch("PE_i_can_has_debugger",
           b_sym(binary, "_PE_i_can_has_debugger", false),
           uint32_t, {0x47702001});
 
 
     // task_for_pid 0
     // this is necessary so a reboot isn't required after using the screwed up version
-    patch(PATCH_TFP0,
+    patch("task_for_pid 0",
           find_data(b_macho_segrange(binary, "__TEXT"), is_armv7 ? "85 68 00 23 .. 93 .. 93 - 5c b9 .. .. 29 46 04 22" : "85 68 .. 93 .. 93 - 00 2c 0b d1", 0, true),
           uint32_t, {is_armv7 ? 0x46c0e00b : 0xe00b2c00});
 
     // cs_enforcement_disable
-    patch(PATCH_CS_ENFORCEMENT_DISABLE,
+    patch("cs_enforcement_disable",
           resolve_ldr(binary, find_data(b_macho_segrange(binary, "__TEXT"), is_armv7 ? "1d ee 90 3f d3 f8 4c 33 d3 f8 9c 20 + .. .. .. .. 19 68 00 29" : "9c 22 03 59 99 58 + .. .. 1a 68 00 2a", 0, true)),
           uint32_t, {1});
 
@@ -107,14 +115,14 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
 
     addr_t scratch = find_scratch(binary);
 
-    patch(SB_EVALUATE,
+    patch("sb_evaluate",
           sb_evaluate,
           uint32_t, {(is_armv7 ? 0xf000f8df : 0xe51ff004), scratch | 1});
 
     check_no_placeholders(sandbox);
-    patch_range(SANDBOX,
-                scratch,
-                sandbox);
+    patch_with_range("sb_evaluate hook",
+                     scratch,
+                     sandbox);
 
     fprintf(stderr, "scratch = %x\n", scratch);
 }
@@ -123,11 +131,17 @@ void do_kernel(prange_t output, prange_t sandbox, struct binary *binary) {
 int main(int argc, char **argv) {
     struct binary binary;
     b_init(&binary);
-    b_load_macho(&binary, argv[1], false);
-    mode_t mode;
-    prange_t kernel = load_file(argv[1], true, &mode);
+    prange_t kernel = load_file(argv[1], false, NULL);
+    b_prange_load_macho(&binary, kernel, argv[1]);
     prange_t sandbox = load_file(argv[2], true, NULL);
+
+    patchfd = open(argv[3], O_WRONLY | O_CREAT | O_TRUNC, 0644);
+    if(patchfd == -1) {
+        edie("could not open patchfd");
+    }
+
     do_kernel(kernel, sandbox, &binary);
-    store_file(kernel, argv[3], mode);
+
+    close(patchfd);
     return 0;
 }

make.py

@@ -113,12 +113,13 @@ def datautils(native=False):
     goto('datautils')
 
     gcc = GCC_NATIVE if native else GCC
-    ldid = not native
+    ldid = strip = not native
     def cds(files, output):
-        return compile_stuff(files, output, cflags=['-DIMG3_SUPPORT', '-I..'], ldflags=['-L../data', '-ldata'], gcc=gcc, ldid=ldid)
+        return compile_stuff(files, output, cflags=['-DIMG3_SUPPORT', '-I..'], ldflags=['-L../data', '-ldata'], gcc=gcc, ldid=ldid, strip=strip)
 
     cds(['deplaceholder.c'], 'deplaceholder')
-    cds(['kernel_patcher.c'], 'kernel_patcher')
+    cds(['make_kernel_patchfile.c'], 'make_kernel_patchfile')
+    cds(['apply_patchfile.c'], 'apply_patchfile')
     cds(['dyld_to_pwn.c'], 'dyld_to_pwn')
 
 def datautils_native():