CalvinBackup/coruna
1
0
Fork 0
mirror of https://github.com/khanhduytran0/coruna.git synced 2026-07-12 06:56:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Rename krwCtx and map offsets

Browse Source
This commit is contained in:
khanhduytran0
2026-06-06 17:45:49 +07:00
parent 335371c4eb
commit f827f48f5d
3 changed files with 3981 additions and 4213 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/payload_377bed/defs.h
+45 -13
View File
@@ -73,7 +73,12 @@ struct __attribute__((packed)) struct_krwCtx
struct {
/* 00000004 */ uint8_t gap_0x4_to_0xB[0x7];
/* 0000000B */ uint8_t gap_0xB;
/* 0000000C */ uint8_t gap_0xC_to_0x28[0x1C];
/* 0000000C */ uint8_t gap_0xC;
/* 0000000D */ uint8_t gap_0xD_to_0x10[0x3];
/* 00000010 */ uint32_t gap_0x10;
/* 00000014 */ uint8_t gap_0x14_to_0x18[0x4];
/* 00000018 */ uint64_t gap_0x18;
/* 00000020 */ uint64_t gap_0x20;
/* 00000028 */ uint64_t gap_0x28;
/* 00000030 */ uint64_t gap_0x30;
/* 00000038 */ uint64_t gap_0x38;
@@ -83,8 +88,10 @@ struct __attribute__((packed)) struct_krwCtx
/* 00000058 */ uint32_t gap_0x58;
/* 0000005C */ uint8_t gap_0x5C_to_0x80[0x24];
/* 00000080 */ uint64_t gap_0x80;
/* 00000088 */ uint32_t gap_0x88_size4;
/* 0000008C */ uint8_t gap_0x8C_to_0xA0[0x14];
/* 00000088 */ uint32_t gap_0x88;
/* 0000008C */ uint8_t gap_0x8C_to_0x90[0x4];
/* 00000090 */ uint64_t gap_0x90;
/* 00000098 */ uint64_t gap_0x98;
/* 000000A0 */ uint64_t gap_0xA0;
/* 000000A8 */ uint32_t gap_0xA8_size4;
};
@@ -97,12 +104,13 @@ struct __attribute__((packed)) struct_krwCtx
/* 000000D0 */ uint64_t gap_0xD0;
/* 000000D8 */ uint64_t gap_0xD8;
/* 000000E0 */ uint64_t gap_0xE0;
/* 000000E8 */ uint64_t gap_0xE8;
/* 000000E8 */ uint64_t gap_0xE8; // may be uint32_t?
/* 000000F0 */ uint64_t gap_0xF0;
/* 000000F8 */ uint64_t gap_0xF8;
/* 00000100 */ uint64_t gap_0x100;
/* 00000108 */ uint64_t gap_0x108;
/* 00000110 */ uint64_t gap_0x110;
/* 00000110 */ uint32_t gap_0x110;
/* 00000114 */ uint32_t gap_0x114;
union {
/* 00000118 */ uint64_t gap_0x118;
/* 00000118 */ uint64_t gap_0x118_size8byte;
@@ -147,19 +155,32 @@ struct __attribute__((packed)) struct_krwCtx
union {
/* 00000190 */ uint8_t raw_0x190[136];
struct {
/* 00000190 */ uint8_t gap_0x190_to_0x1A8[0x18];
/* 00000190 */ uint8_t gap_0x190_to_0x1A0[0x10];
/* 000001A0 */ uint64_t gap_0x1A0;
/* 000001A8 */ uint64_t gap_0x1A8_size8;
/* 000001B0 */ uint64_t gap_0x1B0;
/* 000001B8 */ uint8_t gap_0x1B8_to_0x1E0[0x28];
/* 000001E0 */ uint64_t gap_0x1E0;
/* 000001E8 */ uint64_t gap_0x1E8;
/* 000001F0 */ uint8_t gap_0x1F0_to_0x218[0x28];
/* 000001F0 */ uint64_t gap_0x1F0;
/* 000001F8 */ uint64_t gap_0x1F8;
/* 00000200 */ uint64_t gap_0x200;
/* 00000208 */ uint64_t gap_0x208;
/* 00000210 */ uint64_t gap_0x210;
///* 00000200 */ uint8_t gap_0x200_to_0x218[0x18];
};
};
/* 00000218 */ uint64_t gap_0x218;
union {
/* 00000220 */ uint8_t raw_0x220[56];
struct {
/* 00000220 */ uint64_t gap_0x220;
/* 00000228 */ uint64_t gap_0x228;
/* 00000230 */ uint64_t gap_0x230;
/* 00000238 */ uint8_t gap_0x238_to_0x248[0x10];
/* 00000248 */ uint64_t gap_0x248;
/* 00000250 */ uint64_t gap_0x250;
};
};
union {
/* 00000258 */ int isRW;
@@ -189,7 +210,14 @@ struct __attribute__((packed)) struct_krwCtx
/* 000003A0 */ uint64_t gap_0x3A0;
/* 000003A8 */ uint64_t gap_0x3A8;
/* 000003B0 */ uint64_t gap_0x3B0;
/* 000003B8 */ uint8_t gap_0x3B8_to_0x870[0x4B8];
/* 000003B8 */ uint8_t gap_0x3B8_to_0x5C0[0x208];
/* 000005C0 */ uint64_t gap_0x5C0;
/* 000005C8 */ uint8_t gap_0x5C8_to_0x5D0[0x8];
/* 000005D0 */ uint64_t gap_0x5D0;
/* 000005D8 */ uint64_t gap_0x5D8;
/* 000005E0 */ uint32_t gap_0x5E0_size4;
/* 000005E4 */ uint8_t gap_0x5E4_to_0x868[0x284];
/* 00000868 */ uint64_t gap_0x868;
/* 00000870 */ uint64_t gap_0x870;
/* 00000878 */ uint64_t gap_0x878;
/* 00000880 */ uint8_t gap_0x880_to_0x1888[0x1008];
@@ -204,7 +232,7 @@ struct __attribute__((packed)) struct_krwCtx
/* 000018C0 */ uint64_t gap_0x18C0;
/* 000018C8 */ uint8_t gap_0x18C8_to_0x18E0[0x18];
/* 000018E0 */ uint64_t gap_0x18E0_size8;
/* 000018E8 */ uint8_t gap_0x18E8_to_0x18F0[0x8];
/* 000018E8 */ uint64_t gap_0x18E8;
/* 000018F0 */ uint64_t gap_0x18F0;
/* 000018F8 */ uint64_t gap_0x18F8;
/* 00001900 */ uint64_t gap_0x1900;
@@ -227,7 +255,7 @@ struct __attribute__((packed)) struct_krwCtx
/* 00001920 */ uint64_t gap_0x1920;
struct {
/* 00001920 */ uint32_t gap_0x1920_size4;
/* 00001924 */ uint8_t gap_0x1924_to_0x1928[0x4];
/* 00001924 */ uint32_t gap_0x1924_size4;
};
};
};
@@ -250,7 +278,7 @@ struct __attribute__((packed)) struct_krwCtx
/* 00001958 */ uint64_t gap_0x1958;
/* 00001960 */ uint8_t gap_0x1960_to_0x1990[0x30];
/* 00001990 */ uint64_t gap_0x1990_size8;
/* 00001998 */ uint8_t gap_0x1998_to_0x19A0[0x8];
/* 00001998 */ uint64_t gap_0x1998;
/* 000019A0 */ uint64_t gap_0x19A0;
/* 000019A8 */ uint8_t gap_0x19A8_to_0x19C8[0x20];
};
@@ -272,12 +300,16 @@ struct __attribute__((packed)) struct_krwCtx
union {
/* 00001A08 */ uint64_t raw_0x1A08[104];
struct {
/* 00001A08 */ uint8_t gap_0x1A08_to_0x1D18[0x310];
/* 00001A08 */ uint8_t gap_0x1A08_to_0x1D08[0x300];
/* 00001D08 */ uint32_t gap_0x1D08_size4;
/* 00001D0C */ uint8_t gap_0x1D0C_to_0x1D10[0x4];
/* 00001D10 */ uint64_t gap_0x1D10;
/* 00001D18 */ uint64_t gap_0x1D18_size8;
/* 00001D20 */ uint64_t gap_0x1D20_kern_addr_allows_security_research;
/* 00001D28 */ uint8_t gap_0x1D28_to_0x1D30[0x8];
/* 00001D30 */ uint64_t gap_0x1D30_size8;
/* 00001D38 */ uint8_t gap_0x1D38_to_0x1D48[0x10];
/* 00001D38 */ uint64_t gap_0x1D38;
/* 00001D40 */ uint8_t gap_0x1D40_to_0x1D48[0x8];
};
};
/* 00001D48 */ uint64_t IOKitConnInfo;
src/payload_377bed/entry1_type0x09.m
+3936 -3964
View File
File diff suppressed because it is too large Load Diff
src/payload_377bed/tmp/tmp.c
-236
View File
@@ -1,237 +1 @@
bool __fastcall iosurface_physmap_setup(__int64 someStruct, int a2, __int64 a3, unsigned int a4)
{
bool result; // w0
__int64 v9; // x23
int *v10; // x9
__int64 v11; // x24
unsigned __int64 v12; // x10
unsigned __int64 v13; // x11
unsigned int v16; // w8
unsigned __int64 v17; // x14
int v18; // w16
unsigned int v19; // w15
unsigned __int64 v20; // x25
unsigned __int64 v21; // x24
__int64 v22; // x22
__int128 v23; // q0
__int128 v24; // q0
__int64 v25; // x8
int8x16_t *v26; // x8
int8x16_t *v27; // x27
__int64 v28; // x8
int8x16_t *v29; // x24
unsigned __int64 v30; // x26
int v31; // w22
int v32; // w23
unsigned __int64 v33; // x28
__int64 v34; // x8
unsigned __int64 v35; // x8
unsigned __int64 v36; // x8
__int64 v38; // x8
int8x16_t v39; // q1
unsigned __int64 v40; // x8
unsigned __int64 v41; // x9
bool v42; // cf
unsigned __int64 v43; // x9
void *segments; // x0
__int64 v44; // [xsp+0h] [xbp-70h]
uint64_t v45[3]; // [xsp+8h] [xbp-68h] BYREF
result = alloc_kernel_offset_table(someStruct, a3);
if ( !result )
return result;
*(uint32_t *)(someStruct + 216) = a2;
*(uint8_t *)(someStruct + 256) = 1;
v9 = **(uint64_t **)(someStruct + 208);
v10 = (int *)(v9 + 32);
v11 = *(unsigned int *)(v9 + 20);
v12 = v9 + 32 + v11;
v13 = v12 - 8;
if ( v9 + 32 >= v12 || v9 + 40 > v12 || (unsigned __int64)v10 > v13 )
return 0;
v16 = 0;
do
{
v17 = (unsigned int)v10[1];
if ( (unsigned int)v17 < 8 || v12 - (unsigned __int64)v10 < v17 )
break;
v18 = *v10;
v19 = 24;
if ( *v10 <= 10 )
{
switch ( v18 )
{
case -2147483617:
goto LABEL_26;
case -2147483614:
LABEL_24:
v19 = 48;
goto LABEL_26;
case 2:
goto LABEL_26;
}
}
else if ( v18 > 24 )
{
if ( v18 == 34 )
goto LABEL_24;
if ( v18 == 25 )
{
++v16;
v19 = 72;
goto LABEL_26;
}
}
else
{
if ( v18 == 11 )
{
v19 = 80;
LABEL_26:
if ( (unsigned int)v17 < v19 )
break;
goto LABEL_27;
}
if ( v18 == 13 )
goto LABEL_26;
}
LABEL_27:
v10 = (int *)((char *)v10 + v17);
}
while ( (unsigned __int64)v10 < v12 && (unsigned __int64)(v10 + 2) <= v12 && (unsigned __int64)v10 <= v13 );
if ( !v16 )
return 0;
*(uint32_t *)(someStruct + 8) = v16;
segments = malloc(56LL * v16);
*(uint64_t *)someStruct = (uint64_t)segments;
if ( !segments )
return false;
*(uint64_t *)(someStruct + 272) = "__TEXT";
v20 = v9 + 32;
v21 = v9 + 32 + v11;
if ( v9 + 32 < v21 )
{
v22 = (__int64)segments;
do
{
if ( *(uint32_t *)v20 == 25 )
{
if ( *(unsigned int *)(v20 + 64) > ((unsigned __int64)*(unsigned int *)(v20 + 4) - 72) / 0x50 )
return 0;
if ( !strcmp((const char *)(v20 + 8), "__TEXT_EXEC") )
*(uint64_t *)(someStruct + 272) = "__TEXT_EXEC";
v23 = *(__int128 *)(v20 + 40);
*(uint64_t *)v22 = someStruct;
*(__int128 *)(v22 + 8) = v23;
v24 = *(__int128 *)(v20 + 24);
*(uint64_t *)(v22 + 24) = someStruct;
*(__int128 *)(v22 + 32) = v24;
*(uint64_t *)(v22 + 48) = v20;
v22 += 56;
}
v20 += *(unsigned int *)(v20 + 4);
}
while ( v20 < v21 );
v9 = **(uint64_t **)(someStruct + 208);
}
*(int32x2_t *)(someStruct + 40) = vrev64_s32(*(int32x2_t *)(v9 + 4));
*(uint32_t *)(someStruct + 48) = *(uint32_t *)(v9 + 24);
if ( (a4 & 0x100) != 0 )
{
macho_getsectbyname("__TEXT", someStruct, "__thread_starts", v45);
if ( v45[2] )
*(uint8_t *)(someStruct + 156) = 1;
if ( (a4 & 0x400) != 0 )
{
if ( *(uint64_t *)someStruct )
{
v25 = *(uint64_t *)(*(uint64_t *)someStruct + 8LL);
if ( v25 )
*(uint64_t *)(someStruct + 160) = a3 - v25;
}
}
}
if ( (a4 & 0x40) != 0 )
return true;
v26 = **(int8x16_t ***)(someStruct + 208);
v27 = v26 + 2;
v28 = v26[1].u32[1];
v29 = (int8x16_t *)((char *)v27 + v28);
if ( v27 >= (int8x16_t *)&v27->i8[v28] )
return 0;
v30 = 0;
v31 = 0;
v44 = *(int *)(someStruct + 56) - 1LL;
v32 = a4 & 0x580;
v33 = a3;
while ( 2 )
{
if ( v27->i32[0] == 25 )
{
if ( !strcmp(&v27->i8[8], "__TEXT") )
{
*(uint64_t *)(someStruct + 248) = a3 - v27[1].i64[1];
if ( (a4 & 0x100) != 0 )
goto LABEL_54;
}
else if ( (a4 & 0x100) != 0 )
{
LABEL_54:
if ( !strcmp(&v27->i8[8], "__KLD") )
v31 = KRW_CTX_FLAG_CPU_someStruct2;
}
if ( v32 != 384 )
{
v34 = v27[2].i64[0];
if ( v34 )
{
v35 = v27[1].i64[1] + v34;
if ( v35 > v30 )
v30 = v35;
}
}
if ( (a4 & 0x400) != 0 && v27[2].i64[0] )
{
v36 = v27[1].u64[1];
if ( v36 < v33 && v36 != 0 )
v33 = v27[1].u64[1];
}
if ( !strcmp(&v27->i8[8], "__LINKEDIT") )
{
v38 = v27[1].i64[1];
v39 = vextq_s8(v27[2], v27[2], 8u);
if ( v32 == 384 )
v30 = v27[2].i64[0] + v38;
*(uint64_t *)(someStruct + 16) = v38;
*(int8x16_t *)(someStruct + 24) = v39;
}
}
v27 = (int8x16_t *)((char *)v27 + (unsigned int)v27->i32[1]);
if ( v27 < v29 )
continue;
break;
}
result = false;
if ( ((v31 == 0) & (a4 >> 8)) == 0 && v30 )
{
if ( (~a4 & 0x500) == 0 && *(uint64_t *)(someStruct + 160) )
v33 = *(uint64_t *)(someStruct + 160);
v40 = v33 & ~v44;
if ( v33 == a3 )
v40 = a3;
v41 = (v30 + v44) & ~v44;
v42 = v41 >= v40;
v43 = v41 - v40;
if ( v42 )
{
*(uint64_t *)(someStruct + 224) = v40;
*(uint64_t *)(someStruct + 232) = v43;
return map_macho_image_vm(someStruct) != 0;
}
else
{
return 0;
}
}
return result;
}