mirror of
https://github.com/khanhduytran0/coruna.git
synced 2026-07-14 07:47:25 +02:00
tmp
This commit is contained in:
khanhduytran0
@@ -0,0 +1,99 @@
|
||||
@import Darwin;
|
||||
#include "ida_types.h"
|
||||
|
||||
enum CPUFamily : uint32_t
|
||||
{
|
||||
CPUFamily_A8 = 0x2C91A47E,
|
||||
CPUFamily_A9 = 0x92FB37C8,
|
||||
CPUFamily_A10 = 0x67CEEE93,
|
||||
CPUFamily_A11 = 0xE81E7EF6,
|
||||
CPUFamily_A12 = 0x7D34B9F,
|
||||
CPUFamily_A13 = 0x462504D2,
|
||||
CPUFamily_A14 = 0x1B588BB3,
|
||||
CPUFamily_A15 = 0xDA33D83D,
|
||||
CPUFamily_A16 = 0x8765EDEA,
|
||||
CPUFamily_A17 = 0x2876F5B5,
|
||||
};
|
||||
|
||||
typedef struct struct_krwCtx // sizeof=0x1D50
|
||||
{
|
||||
_DWORD flags;
|
||||
_BYTE gap4[168];
|
||||
uint32_t threadForKernelRead;
|
||||
_BYTE gap42[144];
|
||||
int xnuMajorVersion;
|
||||
_BYTE gap144[20];
|
||||
_QWORD someLargeNumber;
|
||||
_BYTE gap160[8];
|
||||
int int168;
|
||||
int gap16C[7];
|
||||
_QWORD qword188;
|
||||
_BYTE gap190[200];
|
||||
int isRW;
|
||||
struct mach_timebase_info timebase;
|
||||
mach_port_t semaphore;
|
||||
pthread_mutex_t someMutex;
|
||||
uint32_t someInt1;
|
||||
uint32_t someInt2;
|
||||
uint64_t gap191[851];
|
||||
_QWORD qword1D48;
|
||||
} struct_krwCtx;
|
||||
|
||||
typedef struct __attribute__((packed)) __attribute__((aligned(4))) struct_qword1D48 // sizeof=0x74
|
||||
{
|
||||
_BYTE gap0[80];
|
||||
_QWORD qword50;
|
||||
_QWORD qword58;
|
||||
_QWORD qword60;
|
||||
_QWORD qword68;
|
||||
_DWORD dword70;
|
||||
} struct_qword1D48;
|
||||
|
||||
typedef struct __attribute__((packed)) __attribute__((aligned(8))) struct_xnuMajorVersion // sizeof=0x28
|
||||
{ // XREF: driver_init2_1/r
|
||||
_OWORD majorVersion;
|
||||
_OWORD oword10; // XREF: driver_init2_1+48/w
|
||||
// driver_init2_1+10C/r ...
|
||||
_QWORD qword20; // XREF: driver_init2_1+40/w
|
||||
// driver_init2_1+114/r ...
|
||||
} struct_xnuMajorVersion;
|
||||
|
||||
typedef struct __attribute__((packed)) __attribute__((aligned(2))) struct_v83 // sizeof=0x102
|
||||
{
|
||||
_BYTE gap0[48];
|
||||
_DWORD dword30;
|
||||
_BYTE gap34[4];
|
||||
_DWORD dword38;
|
||||
_BYTE gap3C[52];
|
||||
_OWORD xnuMajorVersion;
|
||||
_OWORD oword80;
|
||||
_QWORD qword90;
|
||||
_DWORD dword98;
|
||||
_BYTE gap9C[12];
|
||||
_QWORD qwordA8;
|
||||
_BYTE gapB0[81];
|
||||
_BYTE byte101;
|
||||
} struct_v83;
|
||||
|
||||
typedef struct __attribute__((packed)) __attribute__((aligned(8))) struct_a1 // sizeof=0x128
|
||||
{
|
||||
_OWORD oword0;
|
||||
_OWORD oword10;
|
||||
_OWORD oword20;
|
||||
_OWORD oword30;
|
||||
_OWORD oword40;
|
||||
_OWORD oword50;
|
||||
_OWORD oword60;
|
||||
_OWORD xnuMajorVersion;
|
||||
_OWORD oword80;
|
||||
_OWORD oword90;
|
||||
_OWORD owordA0;
|
||||
_OWORD owordB0;
|
||||
_OWORD owordC0;
|
||||
_OWORD owordD0;
|
||||
_OWORD owordE0;
|
||||
_OWORD owordF0;
|
||||
_OWORD oword100;
|
||||
_OWORD oword110;
|
||||
_QWORD qword120;
|
||||
} struct_a1;
|
||||
@@ -0,0 +1,194 @@
|
||||
/*
|
||||
* ida_types.h — IDA/Hex-Rays type compatibility for clang ARM64
|
||||
*/
|
||||
#ifndef IDA_TYPES_H
|
||||
#define IDA_TYPES_H
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdbool.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include <errno.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/mount.h>
|
||||
#include <sys/sysctl.h>
|
||||
#include <sys/ioctl.h>
|
||||
#include <sys/fcntl.h>
|
||||
#include <sys/socket.h>
|
||||
#include <pthread.h>
|
||||
#include <dlfcn.h>
|
||||
#include <mach/mach.h>
|
||||
#include <mach/mach_time.h>
|
||||
/* mach_vm.h is not available on iOS SDK — declare manually */
|
||||
#define mach_vm_address_t vm_address_t
|
||||
#define mach_vm_size_t vm_size_t
|
||||
#define mach_vm_offset_t vm_offset_t
|
||||
extern kern_return_t mach_vm_read_overwrite(vm_map_t, mach_vm_address_t, mach_vm_size_t, mach_vm_address_t, mach_vm_size_t *);
|
||||
extern kern_return_t mach_vm_write(vm_map_t, mach_vm_address_t, vm_offset_t, mach_msg_type_number_t);
|
||||
extern kern_return_t mach_vm_allocate(vm_map_t, mach_vm_address_t *, mach_vm_size_t, int);
|
||||
extern kern_return_t mach_vm_deallocate(vm_map_t, mach_vm_address_t, mach_vm_size_t);
|
||||
extern kern_return_t mach_vm_protect(vm_map_t, mach_vm_address_t, mach_vm_size_t, boolean_t, vm_prot_t);
|
||||
extern kern_return_t mach_vm_machine_attribute(vm_map_t, mach_vm_address_t, mach_vm_size_t, vm_machine_attribute_t, vm_machine_attribute_val_t *);
|
||||
extern kern_return_t mach_vm_page_info(vm_map_t, mach_vm_address_t, vm_page_info_flavor_t, vm_page_info_t, mach_msg_type_number_t *);
|
||||
#include <mach/thread_act.h>
|
||||
#include <mach/host_priv.h>
|
||||
#include <mach/vm_map.h>
|
||||
#include <IOKit/IOKitLib.h>
|
||||
#include <CoreFoundation/CoreFoundation.h>
|
||||
#include <CommonCrypto/CommonDigest.h>
|
||||
#include <spawn.h>
|
||||
#include <signal.h>
|
||||
#include <arm_neon.h>
|
||||
|
||||
/* ---- IDA integer types ---- */
|
||||
#define __int8 char
|
||||
#define __int16 short
|
||||
#define __int32 int
|
||||
#define __int64 long long
|
||||
|
||||
typedef uint8_t _BYTE;
|
||||
typedef uint16_t _WORD;
|
||||
typedef uint32_t _DWORD;
|
||||
typedef uint64_t _QWORD;
|
||||
typedef __int128 _OWORD;
|
||||
typedef uint8_t _UNKNOWN;
|
||||
typedef int _BOOL4;
|
||||
typedef __int128 __n128;
|
||||
typedef __int128 xmmword;
|
||||
typedef char kernel_version_t[512];
|
||||
|
||||
/* ---- IDA calling conventions (no-ops) ---- */
|
||||
#define __fastcall
|
||||
#define __cdecl
|
||||
#define __usercall
|
||||
#define __thiscall
|
||||
|
||||
/* ---- IDA accessor macros ---- */
|
||||
#define LODWORD(x) (*(uint32_t*)&(x))
|
||||
#define HIDWORD(x) (*((uint32_t*)&(x) + 1))
|
||||
#define LOBYTE(x) (*(uint8_t*)&(x))
|
||||
#define HIBYTE(x) (*((uint8_t*)&(x) + sizeof(x) - 1))
|
||||
#define LOWORD(x) (*(uint16_t*)&(x))
|
||||
#define HIWORD(x) (*((uint16_t*)&(x) + 1))
|
||||
#define BYTE1(x) (*((uint8_t*)&(x) + 1))
|
||||
#define BYTE2(x) (*((uint8_t*)&(x) + 2))
|
||||
#define BYTE3(x) (*((uint8_t*)&(x) + 3))
|
||||
#define BYTE4(x) (*((uint8_t*)&(x) + 4))
|
||||
#define BYTE5(x) (*((uint8_t*)&(x) + 5))
|
||||
#define BYTE6(x) (*((uint8_t*)&(x) + 6))
|
||||
#define BYTE7(x) (*((uint8_t*)&(x) + 7))
|
||||
#define SHIDWORD(x) (*((int32_t*)&(x) + 1))
|
||||
#define SLOBYTE(x) (*(int8_t*)&(x))
|
||||
#define SHIWORD(x) (*((int16_t*)&(x) + 1))
|
||||
#define DWORD1(x) (*((uint32_t*)&(x) + 1))
|
||||
#define DWORD2(x) (*((uint32_t*)&(x) + 2))
|
||||
#define __PAIR64__(h, l) (((uint64_t)(h) << 32) | (uint32_t)(l))
|
||||
#define __PAIR32__(h, l) (((uint32_t)(h) << 16) | (uint16_t)(l))
|
||||
#define __CFADD__(a, b) ((uint64_t)(a) > (uint64_t)(-1) - (uint64_t)(b))
|
||||
#define __OFSUB__(a, b) (((a) ^ (b)) < 0 && ((a) ^ ((a) - (b))) < 0)
|
||||
#define __OFADD__(a, b) (((a) ^ (b)) >= 0 && ((a) ^ ((a) + (b))) < 0)
|
||||
|
||||
/* ---- ARM64 intrinsics ---- */
|
||||
#define __dsb(x) __asm__ volatile("dsb " #x ::: "memory")
|
||||
#define __isb(x) __asm__ volatile("isb " #x ::: "memory")
|
||||
#define __dmb(x) __asm__ volatile("dmb " #x ::: "memory")
|
||||
|
||||
/* ---- IDA helpers ---- */
|
||||
#define __break(x) __builtin_trap()
|
||||
#define bswap32(x) __builtin_bswap32(x)
|
||||
static inline void __chkstk_darwin(void) {}
|
||||
|
||||
/* ---- NEON vector unions (IDA uses .i8[n] / .u8[n] member access) ---- */
|
||||
|
||||
/* ---- Mach type aliases ---- */
|
||||
#ifndef host_t
|
||||
typedef mach_port_t host_t;
|
||||
#endif
|
||||
|
||||
/* ---- SDK compatibility ---- */
|
||||
/* kIOMasterPortDefault was renamed to kIOMainPortDefault in iOS 15.
|
||||
Use 0 (MACH_PORT_NULL) which works for both old and new SDKs. */
|
||||
#undef kIOMasterPortDefault
|
||||
#define kIOMasterPortDefault 0
|
||||
#ifndef SANDBOX_CHECK_NO_REPORT
|
||||
#define SANDBOX_CHECK_NO_REPORT 0x0001
|
||||
#endif
|
||||
|
||||
/* ---- Private syscalls ---- */
|
||||
int __ulock_wait(uint32_t, void *, uint64_t, uint32_t) __attribute__((weak_import));
|
||||
int __ulock_wake(uint32_t, void *, uint64_t) __attribute__((weak_import));
|
||||
int open_dprotected_np(const char *, int, int, int, ...);
|
||||
int fileport_makeport(int fd, mach_port_t *port);
|
||||
int fileport_makefd(mach_port_t port);
|
||||
|
||||
/* ---- Stub for j__fileport wrappers ---- */
|
||||
static inline long long j__fileport_makeport(void) { return 0; }
|
||||
static inline long long j__fileport_makefd(void) { return 0; }
|
||||
|
||||
/* ---- Data constants (zero-init, fill from binary .rodata) ---- */
|
||||
/* Declared as extern in .c file, defined there too */
|
||||
|
||||
|
||||
/* Additional compatibility — appended */
|
||||
#include <sys/utsname.h>
|
||||
#include <mach-o/loader.h>
|
||||
|
||||
#define qmemcpy(d,s,n) memcpy(d,s,n)
|
||||
#define bswap64(x) __builtin_bswap64(x)
|
||||
#define __PAIR128__(h,l) (((__int128)(h) << 64) | (uint64_t)(l))
|
||||
#define WORD6(x) (*((uint16_t*)&(x) + 6))
|
||||
#define BYTE8(x) (*((uint8_t*)&(x) + 8))
|
||||
#define BYTE13(x) (*((uint8_t*)&(x) + 13))
|
||||
/* _ReadStatusReg / ARM64_SYSREG: IDA uses these for mrs instructions.
|
||||
ARM64_SYSREG encodes the system register as an integer, and _ReadStatusReg
|
||||
reads it. We use the "mrs %0, S<reg>" syntax which accepts numeric encoding. */
|
||||
#define ARM64_SYSREG(op0,op1,crn,crm,op2) \
|
||||
(((op0)<<14)|((op1)<<11)|((crn)<<7)|((crm)<<3)|(op2))
|
||||
static __attribute__((always_inline)) uint64_t _ReadStatusReg(uint32_t reg) {
|
||||
uint64_t val;
|
||||
/* Common registers used by the exploit */
|
||||
if (reg == ARM64_SYSREG(3,3,13,0,3)) /* tpidrro_el0 */
|
||||
__asm__ volatile("mrs %0, tpidrro_el0" : "=r"(val));
|
||||
else if (reg == ARM64_SYSREG(3,3,13,0,2)) /* tpidr_el0 */
|
||||
__asm__ volatile("mrs %0, tpidr_el0" : "=r"(val));
|
||||
else
|
||||
val = 0;
|
||||
return val;
|
||||
}
|
||||
|
||||
/* IDA uses __semwait_signal, __memcpy_chk etc. as direct calls */
|
||||
extern int __semwait_signal(int, int, int, int, long long, int);
|
||||
|
||||
/* struct tags C requires */
|
||||
typedef struct IONotificationPort IONotificationPort;
|
||||
|
||||
/* dyld globals */
|
||||
extern double dyldVersionNumber;
|
||||
|
||||
/* _os_alloc_once */
|
||||
struct _os_alloc_once_s { long once; void *ptr; };
|
||||
extern struct _os_alloc_once_s _os_alloc_once_table[];
|
||||
|
||||
/* IOConnectTrap4/6 — marked unavailable on iOS in SDK but symbols exist.
|
||||
Use syscall wrappers instead of the SDK declarations. */
|
||||
static inline kern_return_t _IOConnectTrap4(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4) {
|
||||
return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4}, 4, NULL, NULL);
|
||||
}
|
||||
static inline kern_return_t _IOConnectTrap6(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4, uintptr_t p5, uintptr_t p6) {
|
||||
return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4,p5,p6}, 6, NULL, NULL);
|
||||
}
|
||||
#define IOConnectTrap4 _IOConnectTrap4
|
||||
#define IOConnectTrap6 _IOConnectTrap6
|
||||
|
||||
/* NEON union additions for i16/i32/i64/u32/u64 access */
|
||||
typedef union { int8_t i8[16]; uint8_t u8[16]; int16_t i16[8]; int32_t i32[4]; int64_t i64[2]; uint32_t u32[4]; uint64_t u64[2]; int8x16_t v; int64x2_t v64; } ida_int8x16_t;
|
||||
typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint8x8_t v; int8x8_t vs; int32x2_t v32; } ida_uint8x8_t;
|
||||
|
||||
|
||||
/* Additional NEON union types for IDA decompiler output */
|
||||
typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint64_t u64[1]; int64_t i64[1]; int8x8_t vs; } ida_int8x8_t;
|
||||
typedef union { int32_t i32[2]; uint32_t u32[2]; int64_t i64[1]; uint64_t u64[1]; int32x2_t v; } ida_int32x2_t;
|
||||
typedef union { int64_t i64[2]; uint64_t u64[2]; int32_t i32[4]; uint32_t u32[4]; int16_t i16[8]; int8_t i8[16]; uint8_t u8[16]; int64x2_t v64; int8x16_t v; } ida_int64x2_t;
|
||||
#endif /* IDA_TYPES_H */
|
||||
@@ -0,0 +1,194 @@
|
||||
/*
|
||||
* ida_types.h — IDA/Hex-Rays type compatibility for clang ARM64
|
||||
*/
|
||||
#ifndef IDA_TYPES_H
|
||||
#define IDA_TYPES_H
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdbool.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include <errno.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/mount.h>
|
||||
#include <sys/sysctl.h>
|
||||
#include <sys/ioctl.h>
|
||||
#include <sys/fcntl.h>
|
||||
#include <sys/socket.h>
|
||||
#include <pthread.h>
|
||||
#include <dlfcn.h>
|
||||
#include <mach/mach.h>
|
||||
#include <mach/mach_time.h>
|
||||
/* mach_vm.h is not available on iOS SDK — declare manually */
|
||||
#define mach_vm_address_t vm_address_t
|
||||
#define mach_vm_size_t vm_size_t
|
||||
#define mach_vm_offset_t vm_offset_t
|
||||
extern kern_return_t mach_vm_read_overwrite(vm_map_t, mach_vm_address_t, mach_vm_size_t, mach_vm_address_t, mach_vm_size_t *);
|
||||
extern kern_return_t mach_vm_write(vm_map_t, mach_vm_address_t, vm_offset_t, mach_msg_type_number_t);
|
||||
extern kern_return_t mach_vm_allocate(vm_map_t, mach_vm_address_t *, mach_vm_size_t, int);
|
||||
extern kern_return_t mach_vm_deallocate(vm_map_t, mach_vm_address_t, mach_vm_size_t);
|
||||
extern kern_return_t mach_vm_protect(vm_map_t, mach_vm_address_t, mach_vm_size_t, boolean_t, vm_prot_t);
|
||||
extern kern_return_t mach_vm_machine_attribute(vm_map_t, mach_vm_address_t, mach_vm_size_t, vm_machine_attribute_t, vm_machine_attribute_val_t *);
|
||||
extern kern_return_t mach_vm_page_info(vm_map_t, mach_vm_address_t, vm_page_info_flavor_t, vm_page_info_t, mach_msg_type_number_t *);
|
||||
#include <mach/thread_act.h>
|
||||
#include <mach/host_priv.h>
|
||||
#include <mach/vm_map.h>
|
||||
#include <IOKit/IOKitLib.h>
|
||||
#include <CoreFoundation/CoreFoundation.h>
|
||||
#include <CommonCrypto/CommonDigest.h>
|
||||
#include <spawn.h>
|
||||
#include <signal.h>
|
||||
#include <arm_neon.h>
|
||||
|
||||
/* ---- IDA integer types ---- */
|
||||
#define __int8 char
|
||||
#define __int16 short
|
||||
#define __int32 int
|
||||
#define __int64 long long
|
||||
|
||||
typedef uint8_t _BYTE;
|
||||
typedef uint16_t _WORD;
|
||||
typedef uint32_t _DWORD;
|
||||
typedef uint64_t _QWORD;
|
||||
typedef __int128 _OWORD;
|
||||
typedef uint8_t _UNKNOWN;
|
||||
typedef int _BOOL4;
|
||||
typedef __int128 __n128;
|
||||
typedef __int128 xmmword;
|
||||
typedef char kernel_version_t[512];
|
||||
|
||||
/* ---- IDA calling conventions (no-ops) ---- */
|
||||
#define __fastcall
|
||||
#define __cdecl
|
||||
#define __usercall
|
||||
#define __thiscall
|
||||
|
||||
/* ---- IDA accessor macros ---- */
|
||||
#define LODWORD(x) (*(uint32_t*)&(x))
|
||||
#define HIDWORD(x) (*((uint32_t*)&(x) + 1))
|
||||
#define LOBYTE(x) (*(uint8_t*)&(x))
|
||||
#define HIBYTE(x) (*((uint8_t*)&(x) + sizeof(x) - 1))
|
||||
#define LOWORD(x) (*(uint16_t*)&(x))
|
||||
#define HIWORD(x) (*((uint16_t*)&(x) + 1))
|
||||
#define BYTE1(x) (*((uint8_t*)&(x) + 1))
|
||||
#define BYTE2(x) (*((uint8_t*)&(x) + 2))
|
||||
#define BYTE3(x) (*((uint8_t*)&(x) + 3))
|
||||
#define BYTE4(x) (*((uint8_t*)&(x) + 4))
|
||||
#define BYTE5(x) (*((uint8_t*)&(x) + 5))
|
||||
#define BYTE6(x) (*((uint8_t*)&(x) + 6))
|
||||
#define BYTE7(x) (*((uint8_t*)&(x) + 7))
|
||||
#define SHIDWORD(x) (*((int32_t*)&(x) + 1))
|
||||
#define SLOBYTE(x) (*(int8_t*)&(x))
|
||||
#define SHIWORD(x) (*((int16_t*)&(x) + 1))
|
||||
#define DWORD1(x) (*((uint32_t*)&(x) + 1))
|
||||
#define DWORD2(x) (*((uint32_t*)&(x) + 2))
|
||||
#define __PAIR64__(h, l) (((uint64_t)(h) << 32) | (uint32_t)(l))
|
||||
#define __PAIR32__(h, l) (((uint32_t)(h) << 16) | (uint16_t)(l))
|
||||
#define __CFADD__(a, b) ((uint64_t)(a) > (uint64_t)(-1) - (uint64_t)(b))
|
||||
#define __OFSUB__(a, b) (((a) ^ (b)) < 0 && ((a) ^ ((a) - (b))) < 0)
|
||||
#define __OFADD__(a, b) (((a) ^ (b)) >= 0 && ((a) ^ ((a) + (b))) < 0)
|
||||
|
||||
/* ---- ARM64 intrinsics ---- */
|
||||
#define __dsb(x) __asm__ volatile("dsb " #x ::: "memory")
|
||||
#define __isb(x) __asm__ volatile("isb " #x ::: "memory")
|
||||
#define __dmb(x) __asm__ volatile("dmb " #x ::: "memory")
|
||||
|
||||
/* ---- IDA helpers ---- */
|
||||
#define __break(x) __builtin_trap()
|
||||
#define bswap32(x) __builtin_bswap32(x)
|
||||
static inline void __chkstk_darwin(void) {}
|
||||
|
||||
/* ---- NEON vector unions (IDA uses .i8[n] / .u8[n] member access) ---- */
|
||||
|
||||
/* ---- Mach type aliases ---- */
|
||||
#ifndef host_t
|
||||
typedef mach_port_t host_t;
|
||||
#endif
|
||||
|
||||
/* ---- SDK compatibility ---- */
|
||||
/* kIOMasterPortDefault was renamed to kIOMainPortDefault in iOS 15.
|
||||
Use 0 (MACH_PORT_NULL) which works for both old and new SDKs. */
|
||||
#undef kIOMasterPortDefault
|
||||
#define kIOMasterPortDefault 0
|
||||
#ifndef SANDBOX_CHECK_NO_REPORT
|
||||
#define SANDBOX_CHECK_NO_REPORT 0x0001
|
||||
#endif
|
||||
|
||||
/* ---- Private syscalls ---- */
|
||||
int __ulock_wait(uint32_t, void *, uint64_t, uint32_t) __attribute__((weak_import));
|
||||
int __ulock_wake(uint32_t, void *, uint64_t) __attribute__((weak_import));
|
||||
int open_dprotected_np(const char *, int, int, int, ...);
|
||||
int fileport_makeport(int fd, mach_port_t *port);
|
||||
int fileport_makefd(mach_port_t port);
|
||||
|
||||
/* ---- Stub for j__fileport wrappers ---- */
|
||||
static inline long long j__fileport_makeport(void) { return 0; }
|
||||
static inline long long j__fileport_makefd(void) { return 0; }
|
||||
|
||||
/* ---- Data constants (zero-init, fill from binary .rodata) ---- */
|
||||
/* Declared as extern in .c file, defined there too */
|
||||
|
||||
|
||||
/* Additional compatibility — appended */
|
||||
#include <sys/utsname.h>
|
||||
#include <mach-o/loader.h>
|
||||
|
||||
#define qmemcpy(d,s,n) memcpy(d,s,n)
|
||||
#define bswap64(x) __builtin_bswap64(x)
|
||||
#define __PAIR128__(h,l) (((__int128)(h) << 64) | (uint64_t)(l))
|
||||
#define WORD6(x) (*((uint16_t*)&(x) + 6))
|
||||
#define BYTE8(x) (*((uint8_t*)&(x) + 8))
|
||||
#define BYTE13(x) (*((uint8_t*)&(x) + 13))
|
||||
/* _ReadStatusReg / ARM64_SYSREG: IDA uses these for mrs instructions.
|
||||
ARM64_SYSREG encodes the system register as an integer, and _ReadStatusReg
|
||||
reads it. We use the "mrs %0, S<reg>" syntax which accepts numeric encoding. */
|
||||
#define ARM64_SYSREG(op0,op1,crn,crm,op2) \
|
||||
(((op0)<<14)|((op1)<<11)|((crn)<<7)|((crm)<<3)|(op2))
|
||||
static __attribute__((always_inline)) uint64_t _ReadStatusReg(uint32_t reg) {
|
||||
uint64_t val;
|
||||
/* Common registers used by the exploit */
|
||||
if (reg == ARM64_SYSREG(3,3,13,0,3)) /* tpidrro_el0 */
|
||||
__asm__ volatile("mrs %0, tpidrro_el0" : "=r"(val));
|
||||
else if (reg == ARM64_SYSREG(3,3,13,0,2)) /* tpidr_el0 */
|
||||
__asm__ volatile("mrs %0, tpidr_el0" : "=r"(val));
|
||||
else
|
||||
val = 0;
|
||||
return val;
|
||||
}
|
||||
|
||||
/* IDA uses __semwait_signal, __memcpy_chk etc. as direct calls */
|
||||
extern int __semwait_signal(int, int, int, int, long long, int);
|
||||
|
||||
/* struct tags C requires */
|
||||
typedef struct IONotificationPort IONotificationPort;
|
||||
|
||||
/* dyld globals */
|
||||
extern double dyldVersionNumber;
|
||||
|
||||
/* _os_alloc_once */
|
||||
struct _os_alloc_once_s { long once; void *ptr; };
|
||||
extern struct _os_alloc_once_s _os_alloc_once_table[];
|
||||
|
||||
/* IOConnectTrap4/6 — marked unavailable on iOS in SDK but symbols exist.
|
||||
Use syscall wrappers instead of the SDK declarations. */
|
||||
static inline kern_return_t _IOConnectTrap4(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4) {
|
||||
return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4}, 4, NULL, NULL);
|
||||
}
|
||||
static inline kern_return_t _IOConnectTrap6(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4, uintptr_t p5, uintptr_t p6) {
|
||||
return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4,p5,p6}, 6, NULL, NULL);
|
||||
}
|
||||
#define IOConnectTrap4 _IOConnectTrap4
|
||||
#define IOConnectTrap6 _IOConnectTrap6
|
||||
|
||||
/* NEON union additions for i16/i32/i64/u32/u64 access */
|
||||
typedef union { int8_t i8[16]; uint8_t u8[16]; int16_t i16[8]; int32_t i32[4]; int64_t i64[2]; uint32_t u32[4]; uint64_t u64[2]; int8x16_t v; int64x2_t v64; } ida_int8x16_t;
|
||||
typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint8x8_t v; int8x8_t vs; int32x2_t v32; } ida_uint8x8_t;
|
||||
|
||||
|
||||
/* Additional NEON union types for IDA decompiler output */
|
||||
typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint64_t u64[1]; int64_t i64[1]; int8x8_t vs; } ida_int8x8_t;
|
||||
typedef union { int32_t i32[2]; uint32_t u32[2]; int64_t i64[1]; uint64_t u64[1]; int32x2_t v; } ida_int32x2_t;
|
||||
typedef union { int64_t i64[2]; uint64_t u64[2]; int32_t i32[4]; uint32_t u32[4]; int16_t i16[8]; int8_t i8[16]; uint8_t u8[16]; int64x2_t v64; int8x16_t v; } ida_int64x2_t;
|
||||
#endif /* IDA_TYPES_H */
|
||||
Reference in New Issue
Block a user