This commit is contained in:
Karmaz95
2024-03-09 23:29:23 +01:00
parent 6d8bec4987
commit dceee00b32
4 changed files with 1788 additions and 8 deletions
+4 -2
View File
@@ -284,9 +284,9 @@ brew install blacktop/tap/ipsw
* `--dylib_hijacking` needs [ipsw](https://github.com/blacktop/ipsw) to be installed. * `--dylib_hijacking` needs [ipsw](https://github.com/blacktop/ipsw) to be installed.
* `--dylibtree` needs the [dyld-shared-cache-extractor](https://github.com/keith/dyld-shared-cache-extractor) to be installed. * `--dylibtree` needs the [dyld-shared-cache-extractor](https://github.com/keith/dyld-shared-cache-extractor) to be installed.
## WHY UROBOROS? ## WHY UROBOROS?
I will write the code for each article as a class SnakeX, where X will be the article number. To make it easier for the audience to follow. Each Snake class will be a child of the previous one and infinitely "eat itself" (inherit methods of the previous class), like Uroboros. I will write the code for each article as a class SnakeX, where X will be the article number, to make it easier for the audience to follow.
Each Snake class will be a child of the previous one and infinitely "eat itself" (inherit methods of the previous class), like Uroboros.
## ADDITIONAL LINKS ## ADDITIONAL LINKS
* [Apple Open Source](https://opensource.apple.com/releases/) * [Apple Open Source](https://opensource.apple.com/releases/)
@@ -302,3 +302,5 @@ I will write the code for each article as a class SnakeX, where X will be the ar
* Build Dyld Shared Cache parser and extractor to make SnakeIV independant of dyld-shared-cache-extractor. * Build Dyld Shared Cache parser and extractor to make SnakeIV independant of dyld-shared-cache-extractor.
* Make testing branch and implement tests, before pushing new updates. * Make testing branch and implement tests, before pushing new updates.
* Create `RottenApple.app` in another repository and use it for testing. * Create `RottenApple.app` in another repository and use it for testing.
* Add Dyld Closure chapter to Snake&Apple V - Dyld
* Move `dumpPrelink_info` and `dumpPrelink_text` to Snake & Apple chapter about Kernel Extensions when ready.
@@ -20,10 +20,10 @@ macos_dyld_policy_at_path(proc *process, amfi_dyld_policy_state_t *policy_state)
log("RPL: 0, HR: 0, RP: 0, LV: 0"); log("RPL: 0, HR: 0, RP: 0, LV: 0");
} }
} else { } else {
// 0x40 == CS_EXECSEG_JIT used ?? (not sure aobut it) // Check if 0x40 == CS_EXECSEG_JIT is used ?? (not sure about it)
if ((flags & 0x40) != 0) { if ((flags & 0x40) != 0) {
// (macOS Only) Page invalidation allowed by task port policy (CS_INVALID_ALLOWED == 0x20) not used // Check if (macOS Only) Page invalidation allowed by task port policy (CS_INVALID_ALLOWED == 0x20) is not used
if ((flags & 0x20) == 0) { if ((flags & 0x20) == 0) {
// Check if process does not use Library Validation // Check if process does not use Library Validation
@@ -23,8 +23,8 @@ macos_dyld_policy_collect_state(calling_process, param_2, amfi_dyld_policy_state
// Check if forced library validation is enabled (required by Hardened System Policy) // Check if forced library validation is enabled (required by Hardened System Policy)
has_CS_FORCED_LV = check_forced_library_validation(calling_process); has_CS_FORCED_LV = check_forced_library_validation(calling_process);
// Check macOS platform (hardware) // Check if binary is inside trust cache (CS_PLATFORM_BINARY == 0x4000000 | CS_DYLD_PLATFORM == 0x2000000)
platform = get_platform(); platform = is_platform_binary();
// Check if Hardened Runtime is enabled // Check if Hardened Runtime is enabled
has_HR = check_hardened_runtime(calling_process); has_HR = check_hardened_runtime(calling_process);
@@ -75,4 +75,3 @@ macos_dyld_policy_collect_state(calling_process, param_2, amfi_dyld_policy_state
} }
+1779
View File
File diff suppressed because it is too large Load Diff