int main(int argc, char **argv) {
int flags = 0;
const char *subfile = NULL;
int c;
while((c = getopt(argc, argv, "ixpc:")) != -1) switch(c) {
case 'i': flags |= IMPORTED_SYM; break;
case 'x': flags |= TO_EXECUTE; break;
case 'p': flags |= PRIVATE_SYM; break;
case 'c': subfile = optarg; break;
default: usage();
}
if(!argv[optind] || (argv[optind + 1] && argv[optind + 2])) usage();
struct binary binary;
b_init(&binary);
if(subfile) {
struct binary other;
b_init(&other);
b_load_dyldcache(&other, argv[optind]);
b_dyldcache_load_macho(&other, subfile, &binary);
} else {
b_load_macho(&binary, argv[optind]);
}
if(argv[optind + 1]) {
printf("%8x\n", b_sym(&binary, argv[optind + 1], flags));
} else {
struct data_sym *syms;
uint32_t nsyms;
b_copy_syms(&binary, &syms, &nsyms, flags);
while(nsyms--) {
printf("%8x %s\n", syms->address, syms->name);
syms++;
}
}
return 0;
}
void do_kernel(struct binary *binary, struct binary *sandbox) {
unsigned int class = classify(binary);
addr_t _PE_i_can_has_debugger, _vn_getpath, _memcmp;
struct findmany *text = findmany_init(b_macho_segrange(binary, "__TEXT"));
_PE_i_can_has_debugger = b_sym(binary, "_PE_i_can_has_debugger", MUST_FIND | TO_EXECUTE);
_vn_getpath = b_sym(binary, "_vn_getpath", MUST_FIND | TO_EXECUTE);
_memcmp = b_sym(binary, "_memcmp", MUST_FIND | TO_EXECUTE);
addr_t vme; findmany_add(&vme, text, spec(_50, "01 f0 - 06 00 06 28",
_armv7, "- 02 0f .. .. 63 08 03 f0 01 05 e3 0a 13 f0 01 03",
_armv6, "- .. .. .. .. .. 08 1e 1c .. 0a 01 22 .. 1c 16 40 .. 40"));
addr_t vmp; findmany_add(&vmp, text, spec(_50, "- 26 f0 04 06 00 20 29 46",
_armv7, "- 25 f0 04 05 .. e7 92 45 98 bf 02 99 .. d8",
_armv6, "?"));
// this function checks the baked list of hashes
addr_t mystery = find_data(b_macho_segrange(binary, "__PRELINK_TEXT"), spec(_50, "- f0 b5 03 af 2d e9 00 05 04 46 .. .. 14 f8 01 0b 4f f0 13 0c",
_43, "- f0 b5 03 af 4d f8 04 8d .. .. 03 78 80 46",
_armv7, "- 90 b5 01 af 14 29 .. .. .. .. 90 f8 00 c0",
_armv6, "?"),
0, MUST_FIND);
addr_t dei; findmany_add(&dei, text, spec(_50, "24 bf 04 22 01 92 00 98 .. .. -",
_armv7, "04 22 01 92 00 98 .. 49 -",
_armv6, "?"));
addr_t tfp0; findmany_add(&tfp0, text, spec(_50, "91 e8 01 04 d1 f8 08 80 00 21 02 91 ba f1 00 0f 01 91 - 06 d1 02 a8",
_armv7, "85 68 00 23 .. 93 .. 93 - 5c b9 02 a8 29 46 04 22",
_armv6, "85 68 .. 93 .. 93 - 00 2c 0b d1"));
addr_t csedp; findmany_add(&csedp, text, spec(_50, "df f8 88 33 1d ee 90 0f a2 6a - 1b 68",
_43, "1d ee 90 3f d3 f8 80 33 93 f8 94 30 1b 09 03 f0 01 02 + .. .. .. ..",
_armv7, "1d ee 90 3f d3 f8 4c 33 d3 f8 9c 20 + .. .. .. .. 19 68 00 29",
_armv6, "9c 22 03 59 99 58 + .. .. 1a 68 00 2a"));
addr_t power = 0; if(class >= _43) power = find_data(b_macho_segrange(binary, "__PRELINK_TEXT"),
spec(_50, "- 32 20 00 21 20 22",
_43, "- 32 20 98 47 .. 68"),
0, MUST_FIND);
findmany_go(text);
// vm_map_enter (patch1) - allow RWX pages
patch("vm_map_enter", vme, uint32_t, {spec(_50, 0x28080006,
_armv7, 0x46c00f02,
_armv6, 0x46c046c0)});
// vm_map_protect - allow vm_protect etc. to create RWX pages
patch("vm_map_protect", vmp, uint32_t, {spec(_armv7, 0x46c046c0,
_armv6, 42)});
// AMFI (patch3) - disable the predefined list of executable stuff
patch("AMFI", mystery, uint32_t, {spec(_armv7, 0x47702001,
_armv6, 0xe3a00001)});
// PE_i_can_has_debugger (patch4) - so AMFI allows non-ldid'd binaries (and some other stuff is allowed)
// switching to patching the actual thing, and the startup code
// why? debug_enabled is used directly in kdp, and I was not emulating PE_i_can_has's behavior correctly anyway
patch("+debug_enabled", resolve_ldr(binary, _PE_i_can_has_debugger + 2), uint32_t, {1});
patch("-debug_enabled initializer", dei, uint32_t, {spec(_armv7, 0x60082001,
_armv6, 42)});
// task_for_pid 0
// this choice of patch was necessary so that a reboot wasn't required after
// using the screwed up version from jailbreakme 2.0; no reason to change it
patch("task_for_pid 0", tfp0, uint32_t, {spec(_50, 0xa802e006,
_armv7, 0xa802e00b,
_armv6, 0xe00b2c00)});
if(class >= _50) {
// it moved into BSS?
patch("cs_enforcement_disable check", csedp, uint16_t, {0x2301});
} else {
int main(int argc, void * argv)
{
// Unit tests
// * Single Char tests
{
char a = 'a';
char z = 'z';
char b = 'b';
CtSymbols symbols;
//Encoding TEST
//Must match clocktalk.cpp
CwSymbol a_sym(0u, 1u, 0u, 0u, 0u);
CwSymbol z_sym(0u, 0u, 0u, 0u, 1);
unsigned int dots[6] = { 1, 1, 0, 0, 1, 0 };
unsigned int dashes[5] = { 1,1,1,1,0 };
CwSymbol b_sym(0u, 5u, dots, dashes, 0);
CwSymbol a_int = symbols.Encode(a);
CwSymbol z_int = symbols.Encode(z);
CwSymbol b_int = symbols.Encode(b);
assert(a_int == a_sym);
assert(b_int == b_sym);
char result_a = symbols.Decode(a_int);
char result_z = symbols.Decode(z_int);
char result_b = symbols.Decode(b_int);
assert(result_a == 'A');
assert(result_z != 'Z'); //Negative test
assert(result_b == 'B');
}
// * Stream tests
{
char a = 'A';
// TODO: Numbers
//char * junkstring = "11@#$^)2";
char * knownstring = "AEIOU BCDFG JKLMNP RST W ";
CtSymbols symbols;
CtSymbolStream symStream(&symbols);
CwSymbol a_sym(0u, 1u, 0u, 0u, 0u);
symStream.Write(a);
CwSymbol a_res;
assert(symStream.Read(&a_res));
assert(a_sym == a_res);
symStream.Write(a);
char a_res_c;
assert(symStream.ReadCharacter(&a_res_c));
assert(a_res_c == a);
symStream.Write(knownstring);
unsigned int ptr = 0;
char buf;
while (symStream.ReadCharacter(&buf))
{
assert(knownstring[ptr] == buf);
++ptr;
}
assert(ptr == strlen(knownstring));
//symStream.Write(junkstring);
//ptr = 0;
//while (symStream.ReadCharacter(&buf))
//{
// assert(buf == 4);
//}
}
// * Png tests
{
char *name = "Austen";
CtSymbols symbols;
CtSymbolStream symStr(&symbols);
CwSymbolBrush default_brush;
default_brush.m_box_color = 0x000000FF;
default_brush.m_width = 32;
default_brush.m_height = default_brush.m_width * 5;
default_brush.m_dash_color = 0xFFFFFFFF;
default_brush.m_dot_color = 0xFFFFFFFF;
default_brush.m_dot_radius = 10;
default_brush.m_dot_fade_radius = 14;
default_brush.m_dot_fade_strength = 1.25f;
default_brush.m_dash_width = 5;
default_brush.m_pad = 4;
CwImage *img = new CwPng(10,10);
img->SetBrush(&default_brush);
char a = 'a';
char * knownstring = "aeiou bcdfg jklmnp rst w ";
symStr.Write(a);
img->DrawStream(&symStr);
img->SaveToFile("a.png");
symStr.Write(name);
img->DrawStream(&symStr);
img->SaveToFile("name.png");
symStr.Write(knownstring);
img->DrawStream(&symStr);
img->SaveToFile("all.png");
img->Test();
}
// * Audio tests
}
