From ecd2d3a6d214a30950614c602ca24882adb560a7 Mon Sep 17 00:00:00 2001 From: khanhduytran0 Date: Wed, 17 Jun 2026 15:13:05 +0700 Subject: [PATCH] Fix ioservice matching return type --- src/payload_377bed/entry1_type0x09.m | 2 +- .../entry1_type0x09_dmafail_write.inc | 17 +++++++---------- .../entry1_type0x09_iogpu_physmap_engine.inc | 4 ++-- .../entry1_type0x09_krw_necp_iokit.inc | 3 +-- .../entry1_type0x09_platform_fs.inc | 10 +++++----- 5 files changed, 16 insertions(+), 20 deletions(-) diff --git a/src/payload_377bed/entry1_type0x09.m b/src/payload_377bed/entry1_type0x09.m index 6783e5a..8a170be 100644 --- a/src/payload_377bed/entry1_type0x09.m +++ b/src/payload_377bed/entry1_type0x09.m @@ -419,7 +419,7 @@ __int64 __fastcall krw_ctx_buf_append_entry(__int64 a1, __int64 a2, int a3); __int64 __fastcall buf_append_data(__int64 a1, const void *a2, unsigned int a3); __int64 __fastcall send_mach_msg_from_ctx(__int64 a1, mach_port_t a2, mach_port_t a3, mach_msg_id_t a4); int __fastcall parse_xnu_version_string(__int64 a1); -const CFDictionaryRef *__fastcall ioservice_get_matching(const char *a1); +io_service_t __fastcall ioservice_get_matching(const char *a1); __int64 __fastcall ioservice_notification_send(unsigned int a1, __int64 a2, __int64 a3, unsigned int a4, unsigned int a5, const void *a6, int a7); __int64 __fastcall register_ioservice_publish_notify(__int64 a1, unsigned int a2, mach_port_name_t *a3); bool __fastcall set_thread_realtime_policy_1(thread_act_t a1, thread_policy_t policy_info); diff --git a/src/payload_377bed/entry1_type0x09_dmafail_write.inc b/src/payload_377bed/entry1_type0x09_dmafail_write.inc index 4413967..adbb3d0 100644 --- a/src/payload_377bed/entry1_type0x09_dmafail_write.inc +++ b/src/payload_377bed/entry1_type0x09_dmafail_write.inc @@ -1580,16 +1580,14 @@ int __fastcall parse_xnu_version_string(__int64 a1) } //----- (0000000000024D64) ---------------------------------------------------- -const CFDictionaryRef *__fastcall ioservice_get_matching(const char *a1) +io_service_t __fastcall ioservice_get_matching(const char *a1) { - const CFDictionaryRef *result; // x0 + CFMutableDictionaryRef matching; // x0 - result = IOServiceMatching(a1); - if ( result ) - { - return (const CFDictionaryRef *)IOServiceGetMatchingService(kIOMasterPortDefault, result); - } - return result; + matching = IOServiceMatching(a1); + if ( matching ) + return IOServiceGetMatchingService(kIOMasterPortDefault, matching); + return 0; } // 24D90: variable 'vars8' is possibly undefined @@ -3142,7 +3140,7 @@ __int64 __fastcall setup_iosurface_semaphore_helper(struct_krwCtx *krwCtx) { if ( (unsigned int)(krwCtx->iosurfaceObj + 1) <= 1 ) { - v7 = (unsigned int)ioservice_get_matching("AppleSEPManager"); + v7 = ioservice_get_matching("AppleSEPManager"); if ( v7 + 1 < 2 ) return 708625; krwCtx->iosurfaceObj = v7; @@ -6084,4 +6082,3 @@ LABEL_12: goto LABEL_12; return v5; } - diff --git a/src/payload_377bed/entry1_type0x09_iogpu_physmap_engine.inc b/src/payload_377bed/entry1_type0x09_iogpu_physmap_engine.inc index 797e026..1d0760a 100644 --- a/src/payload_377bed/entry1_type0x09_iogpu_physmap_engine.inc +++ b/src/payload_377bed/entry1_type0x09_iogpu_physmap_engine.inc @@ -5680,7 +5680,7 @@ LABEL_372: v280 = vm_page_size; v285 = v185; *(__int128 *)a1 = 0u; - v186 = (unsigned int)ioservice_get_matching("IOSurfaceRoot"); + v186 = ioservice_get_matching("IOSurfaceRoot"); v10 = 163854; if ( v186 + 1 < 2 ) return v10; @@ -10231,7 +10231,7 @@ __int64 __fastcall find_connect_ioavservice(__int64 a1) } else { - v6 = (unsigned int)ioservice_get_matching("AppleKeyStore"); + v6 = ioservice_get_matching("AppleKeyStore"); result = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED); if ( !(uint32_t)result ) { diff --git a/src/payload_377bed/entry1_type0x09_krw_necp_iokit.inc b/src/payload_377bed/entry1_type0x09_krw_necp_iokit.inc index 39d7166..6139333 100644 --- a/src/payload_377bed/entry1_type0x09_krw_necp_iokit.inc +++ b/src/payload_377bed/entry1_type0x09_krw_necp_iokit.inc @@ -433,7 +433,7 @@ __int64 __fastcall necp_ioservice_auth_write(struct_krwCtx *krwCtx, __int64 a2) v4 = krwCtx->iosurfaceObj; if ( v4 + 1 <= 1 ) { - v5 = (unsigned int)ioservice_get_matching("AppleSEPManager"); + v5 = ioservice_get_matching("AppleSEPManager"); if ( v5 + 1 < 2 ) return 708625; v4 = v5; @@ -504,4 +504,3 @@ LABEL_25: } return v6; } - diff --git a/src/payload_377bed/entry1_type0x09_platform_fs.inc b/src/payload_377bed/entry1_type0x09_platform_fs.inc index 2f4003d..4597f6f 100644 --- a/src/payload_377bed/entry1_type0x09_platform_fs.inc +++ b/src/payload_377bed/entry1_type0x09_platform_fs.inc @@ -1127,6 +1127,7 @@ const CFDictionaryRef *__fastcall iokit_connect_call_struct_method(const CFDicti { const CFDictionaryRef *v1; // x19 io_object_t v2; // w20 + io_service_t service; // w0 kern_return_t v3; // w0 kern_return_t v4; // w0 unsigned int v5; // w8 @@ -1144,16 +1145,16 @@ const CFDictionaryRef *__fastcall iokit_connect_call_struct_method(const CFDicti if ( result ) { v1 = result; - result = ioservice_get_matching("IOHDIXController"); - if ( (unsigned int)((uint32_t)result + 1) < 2 ) + service = ioservice_get_matching("IOHDIXController"); + if ( service + 1 < 2 ) { *((uint32_t *)v1 + 2) = 708625; } else { - v2 = (unsigned int)result; + v2 = service; connect = 0; - v3 = IOServiceOpen((io_service_t)result, mach_task_self_, 0, &connect); + v3 = IOServiceOpen(service, mach_task_self_, 0, &connect); if ( v3 ) { *((uint32_t *)v1 + 2) = v3 | 0x80000000; @@ -3212,4 +3213,3 @@ bool __fastcall check_root_fs_mounted(bool *a1) } return result; } -