Exemplo n.º 1
0
load_return_t
load_machfile(
	struct image_params	*imgp,
	struct mach_header	*header,
	load_result_t		*result
)
{
	// vnode
	uint8_t		*vp = imgp->ip_vp;
	off_t			file_offset = imgp->ip_arch_offset;
	off_t			macho_size = imgp->ip_arch_size;
	off_t			file_size = imgp->ip_vp_size;
    
	load_result_t		myresult;
	load_return_t		lret;

    mach_vm_offset_t	aslr_offset = 0;
	mach_vm_offset_t	dyld_aslr_offset = 0;

	if (macho_size > file_size) {
		return(LOAD_BADMACHO);
	}
	
	if (!result)
		result = &myresult;

	*result = load_result_null;

	lret = parse_machfile(vp, header, file_offset, macho_size,
	                      0, (int64_t)aslr_offset, (int64_t)dyld_aslr_offset, result);
    
    printf("load_machfile: %s\n", load_to_string(lret));

	if (lret != LOAD_SUCCESS) {
		return(lret);
	}
    
	return(LOAD_SUCCESS);
}
Exemplo n.º 2
0
static load_return_t
load_dylinker(
	struct dylinker_command	*lcp,
	integer_t		archbits,
	int			depth,
	int64_t			slide,
	load_result_t		*result
)
{
	char			*name;
	char			*p;
	uint8_t		*vp = NULL;	/* set by get_macho_vnode() */
	struct mach_header	*header;
	off_t			file_offset = 0; /* set by get_macho_vnode() */
	off_t			macho_size = 0;	/* set by get_macho_vnode() */
	load_result_t		*myresult;
	kern_return_t		ret;
	struct macho_data	*macho_data;
	struct {
		struct mach_header	__header;
		load_result_t		__myresult;
		struct macho_data	__macho_data;
	} *dyld_data;

	if (lcp->cmdsize < sizeof(*lcp))
		return (LOAD_BADMACHO);

	name = (char *)lcp + lcp->name.offset;
	/*
	 *	Check for a proper null terminated string.
	 */
	p = name;
	do {
		if (p >= (char *)lcp + lcp->cmdsize)
			return(LOAD_BADMACHO);
	} while (*p++);

	/* Allocate wad-of-data from heap to reduce excessively deep stacks */

    printf("load_dylinker 1: %s\n", name);
    
    dyld_data = malloc(sizeof (*dyld_data));
	header = &dyld_data->__header;
	myresult = &dyld_data->__myresult;
	macho_data = &dyld_data->__macho_data;

	ret = get_macho_vnode(name, archbits, header,
	    &file_offset, &macho_size, macho_data, &vp);
	if (ret)
		goto novp_out;

	*myresult = load_result_null;

	/*
	 *	First try to map dyld in directly.  This should work most of
	 *	the time since there shouldn't normally be something already
	 *	mapped to its address.
	 */

    vp = vp + file_offset;
    file_offset = 0;
    header = (struct mach_header*)vp;
    
	ret = parse_machfile(vp, header, file_offset, macho_size, depth, slide, 0, myresult);

	/*
	 *	If it turned out something was in the way, then we'll take
	 *	take this longer path to preflight dyld's vm ranges, then
	 *	map it at a free location in the address space.
	 */

	if (ret == LOAD_NOSPACE) {
		mach_vm_offset_t	dyl_start, map_addr;
		mach_vm_size_t	dyl_length;
		int64_t			slide_amount;

		*myresult = load_result_null;

		/*
		 * Preflight parsing the Mach-O file with a NULL
		 * map, which will return the ranges needed for a
		 * subsequent map attempt (with a slide) in "myresult"
		 */
		ret = parse_machfile(vp, header,
		                     file_offset, macho_size, depth,
		                     0 /* slide */, 0, myresult);

		if (ret != LOAD_SUCCESS) {
			goto novp_out;
		}

		dyl_start = myresult->min_vm_addr;
		dyl_length = myresult->max_vm_addr - myresult->min_vm_addr;

		dyl_length += slide;

		/* To find an appropriate load address, do a quick allocation */
		map_addr = dyl_start;
        map_addr = (mach_vm_offset_t)malloc(dyl_length);
		if (ret == 0) {
			ret = LOAD_NOSPACE;
			goto novp_out;
		}

        free((void*)map_addr);
		
		if (map_addr < dyl_start)
			slide_amount = -(int64_t)(dyl_start - map_addr);
		else
			slide_amount = (int64_t)(map_addr - dyl_start);

		slide_amount += slide;

		*myresult = load_result_null;

		ret = parse_machfile(vp, header,
		                     file_offset, macho_size, depth,
		                     slide_amount, 0, myresult);

		if (ret) {
			goto novp_out;
		}
	}

	if (ret == LOAD_SUCCESS) {		
		result->dynlinker = TRUE;
		result->entry_point = myresult->entry_point;
		result->validentry = myresult->validentry;
		result->all_image_info_addr = myresult->all_image_info_addr;
		result->all_image_info_size = myresult->all_image_info_size;
	}
    
novp_out:
	free(dyld_data);
	return (ret);

}
Exemplo n.º 3
0
load_return_t
load_machfile(
    struct image_params	*imgp,
    struct mach_header	*header,
    thread_t 		thread,
    vm_map_t 		new_map,
    load_result_t		*result
)
{
    struct vnode		*vp = imgp->ip_vp;
    off_t			file_offset = imgp->ip_arch_offset;
    off_t			macho_size = imgp->ip_arch_size;

    pmap_t			pmap = 0;	/* protected by create_map */
    vm_map_t		map;
    vm_map_t		old_map;
    load_result_t		myresult;
    load_return_t		lret;
    boolean_t create_map = TRUE;

    if (new_map != VM_MAP_NULL) {
        create_map = FALSE;
    }

    if (create_map) {
        old_map = current_map();
        pmap = pmap_create((vm_map_size_t) 0, (imgp->ip_flags & IMGPF_IS_64BIT));
        map = vm_map_create(pmap,
                            0,
                            vm_compute_max_offset((imgp->ip_flags & IMGPF_IS_64BIT)),
                            TRUE);
    } else
        map = new_map;

    if ( (header->flags & MH_ALLOW_STACK_EXECUTION) )
        vm_map_disable_NX(map);

    if (!result)
        result = &myresult;

    *result = load_result_null;

    lret = parse_machfile(vp, map, thread, header, file_offset, macho_size,
                          0, result);

    if (lret != LOAD_SUCCESS) {
        if (create_map) {
            vm_map_deallocate(map);	/* will lose pmap reference too */
        }
        return(lret);
    }

    /*
     * For 64-bit users, check for presence of a 4GB page zero
     * which will enable the kernel to share the user's address space
     * and hence avoid TLB flushes on kernel entry/exit
     */
    if ((imgp->ip_flags & IMGPF_IS_64BIT) &&
            vm_map_has_4GB_pagezero(map))
        vm_map_set_4GB_pagezero(map);

    /*
     *	Commit to new map.  First make sure that the current
     *	users of the task get done with it, and that we clean
     *	up the old contents of IPC and memory.  The task is
     *	guaranteed to be single threaded upon return (us).
     *
     *	Swap the new map for the old, which  consumes our new map
     *	reference but each leaves us responsible for the old_map reference.
     *	That lets us get off the pmap associated with it, and
     *	then we can release it.
     */

    if (create_map) {
        task_halt(current_task());

        old_map = swap_task_map(current_task(), map);
        vm_map_clear_4GB_pagezero(old_map);
        pmap_switch(pmap);	/* Make sure we are using the new pmap */
        vm_map_deallocate(old_map);
    }
    return(LOAD_SUCCESS);
}
Exemplo n.º 4
0
load_return_t
load_machfile(
	struct image_params	*imgp,
	struct mach_header	*header,
	thread_t 		thread,
	vm_map_t 		new_map,
	load_result_t		*result
)
{
	struct vnode		*vp = imgp->ip_vp;
	off_t			file_offset = imgp->ip_arch_offset;
	off_t			macho_size = imgp->ip_arch_size;
	off_t			file_size = imgp->ip_vattr->va_data_size;
	
	pmap_t			pmap = 0;	/* protected by create_map */
	vm_map_t		map;
	vm_map_t		old_map;
	task_t			old_task = TASK_NULL; /* protected by create_map */
	load_result_t		myresult;
	load_return_t		lret;
	boolean_t create_map = FALSE;
	int spawn = (imgp->ip_flags & IMGPF_SPAWN);
	task_t task = current_task();
	proc_t p = current_proc();
	mach_vm_offset_t	aslr_offset = 0;
	kern_return_t 		kret;

	if (macho_size > file_size) {
		return(LOAD_BADMACHO);
	}

	if (new_map == VM_MAP_NULL) {
		create_map = TRUE;
		old_task = current_task();
	}

	/*
	 * If we are spawning, we have created backing objects for the process
	 * already, which include non-lazily creating the task map.  So we
	 * are going to switch out the task map with one appropriate for the
	 * bitness of the image being loaded.
	 */
	if (spawn) {
		create_map = TRUE;
		old_task = get_threadtask(thread);
	}

	if (create_map) {
		pmap = pmap_create(get_task_ledger(task), (vm_map_size_t) 0,
				(imgp->ip_flags & IMGPF_IS_64BIT));
		map = vm_map_create(pmap,
				0,
				vm_compute_max_offset((imgp->ip_flags & IMGPF_IS_64BIT)),
				TRUE);

	} else
		map = new_map;

#ifndef	CONFIG_ENFORCE_SIGNED_CODE
	/* This turns off faulting for executable pages, which allows to 
	 * circumvent Code Signing Enforcement */
	if ( (header->flags & MH_ALLOW_STACK_EXECUTION) )
	        vm_map_disable_NX(map);
#endif

	/* Forcibly disallow execution from data pages on even if the arch
	 * normally permits it. */
	if ((header->flags & MH_NO_HEAP_EXECUTION) && !(imgp->ip_flags & IMGPF_ALLOW_DATA_EXEC))
		vm_map_disallow_data_exec(map);
	
	/*
	 * Compute a random offset for ASLR.
	 */
	if (!(imgp->ip_flags & IMGPF_DISABLE_ASLR)) {
		aslr_offset = random();
		aslr_offset %= 1 << ((imgp->ip_flags & IMGPF_IS_64BIT) ? 16 : 8);
		aslr_offset <<= PAGE_SHIFT;
	}
	
	if (!result)
		result = &myresult;

	*result = load_result_null;

	lret = parse_machfile(vp, map, thread, header, file_offset, macho_size,
			      0, (int64_t)aslr_offset, result);

	if (lret != LOAD_SUCCESS) {
		if (create_map) {
			vm_map_deallocate(map);	/* will lose pmap reference too */
		}
		return(lret);
	}

#if CONFIG_EMBEDDED
	/*
	 * Check to see if the page zero is enforced by the map->min_offset.
	 */ 
	if (vm_map_has_hard_pagezero(map, 0x1000) == FALSE) {
		if (create_map) {
			vm_map_deallocate(map);	/* will lose pmap reference too */
		}
		printf("Cannot enforce a hard page-zero for %s\n", imgp->ip_strings);
		psignal(vfs_context_proc(imgp->ip_vfs_context), SIGKILL);
		return (LOAD_BADMACHO);
	}
#else
	/*
	 * For 64-bit users, check for presence of a 4GB page zero
	 * which will enable the kernel to share the user's address space
	 * and hence avoid TLB flushes on kernel entry/exit
	 */ 

	if ((imgp->ip_flags & IMGPF_IS_64BIT) &&
	     vm_map_has_4GB_pagezero(map)) {
		vm_map_set_4GB_pagezero(map);
	}
#endif
	/*
	 *	Commit to new map.
	 *
	 *	Swap the new map for the old, which  consumes our new map
	 *	reference but each leaves us responsible for the old_map reference.
	 *	That lets us get off the pmap associated with it, and
	 *	then we can release it.
	 */

	 if (create_map) {
		/*
		 * If this is an exec, then we are going to destroy the old
		 * task, and it's correct to halt it; if it's spawn, the
		 * task is not yet running, and it makes no sense.
		 */
	 	if (!spawn) {
			/*
			 * Mark the task as halting and start the other
			 * threads towards terminating themselves.  Then
			 * make sure any threads waiting for a process
			 * transition get informed that we are committed to
			 * this transition, and then finally complete the
			 * task halting (wait for threads and then cleanup
			 * task resources).
			 *
			 * NOTE: task_start_halt() makes sure that no new
			 * threads are created in the task during the transition.
			 * We need to mark the workqueue as exiting before we
			 * wait for threads to terminate (at the end of which
			 * we no longer have a prohibition on thread creation).
			 * 
			 * Finally, clean up any lingering workqueue data structures
			 * that may have been left behind by the workqueue threads
			 * as they exited (and then clean up the work queue itself).
			 */
			kret = task_start_halt(task);
			if (kret != KERN_SUCCESS) {
				return(kret);		
			}
			proc_transcommit(p, 0);
			workqueue_mark_exiting(p);
			task_complete_halt(task);
			workqueue_exit(p);
		}
		old_map = swap_task_map(old_task, thread, map, !spawn);
		vm_map_clear_4GB_pagezero(old_map);
		vm_map_deallocate(old_map);
	}
	return(LOAD_SUCCESS);
}
Exemplo n.º 5
0
static
load_return_t
load_dylinker(
    struct dylinker_command	*lcp,
    integer_t		archbits,
    vm_map_t		map,
    thread_t	thread,
    int			depth,
    load_result_t		*result,
    boolean_t		is_64bit
)
{
    char			*name;
    char			*p;
    struct vnode		*vp = NULLVP;	/* set by get_macho_vnode() */
    struct mach_header	header;
    off_t			file_offset = 0; /* set by get_macho_vnode() */
    off_t			macho_size = 0;	/* set by get_macho_vnode() */
    vm_map_t		copy_map;
    load_result_t		myresult;
    kern_return_t		ret;
    vm_map_copy_t	tmp;
    mach_vm_offset_t	dyl_start, map_addr;
    mach_vm_size_t		dyl_length;

    name = (char *)lcp + lcp->name.offset;
    /*
     *	Check for a proper null terminated string.
     */
    p = name;
    do {
        if (p >= (char *)lcp + lcp->cmdsize)
            return(LOAD_BADMACHO);
    } while (*p++);

    ret = get_macho_vnode(name, archbits, &header, &file_offset, &macho_size, &vp);
    if (ret)
        return (ret);

    myresult = load_result_null;

    /*
     *	First try to map dyld in directly.  This should work most of
     *	the time since there shouldn't normally be something already
     *	mapped to its address.
     */

    ret = parse_machfile(vp, map, thread, &header, file_offset, macho_size,
                         depth, &myresult);

    /*
     *	If it turned out something was in the way, then we'll take
     *	take this longer path to map dyld into a temporary map and
     *	copy it into destination map at a different address.
     */

    if (ret == LOAD_NOSPACE) {

        /*
         *	Load the Mach-O.
         *	Use a temporary map to do the work.
         */
        copy_map = vm_map_create(pmap_create(vm_map_round_page(macho_size),
                                             is_64bit),
                                 get_map_min(map), get_map_max(map), TRUE);
        if (VM_MAP_NULL == copy_map) {
            ret = LOAD_RESOURCE;
            goto out;
        }

        myresult = load_result_null;

        ret = parse_machfile(vp, copy_map, thread, &header,
                             file_offset, macho_size,
                             depth, &myresult);

        if (ret) {
            vm_map_deallocate(copy_map);
            goto out;
        }

        if (get_map_nentries(copy_map) > 0) {

            dyl_start = mach_get_vm_start(copy_map);
            dyl_length = mach_get_vm_end(copy_map) - dyl_start;

            map_addr = dyl_start;
            ret = mach_vm_allocate(map, &map_addr, dyl_length, VM_FLAGS_ANYWHERE);

            if (ret != KERN_SUCCESS) {
                vm_map_deallocate(copy_map);
                ret = LOAD_NOSPACE;
                goto out;

            }

            ret = vm_map_copyin(copy_map,
                                (vm_map_address_t)dyl_start,
                                (vm_map_size_t)dyl_length,
                                TRUE, &tmp);
            if (ret != KERN_SUCCESS) {
                (void) vm_map_remove(map,
                                     vm_map_trunc_page(map_addr),
                                     vm_map_round_page(map_addr + dyl_length),
                                     VM_MAP_NO_FLAGS);
                vm_map_deallocate(copy_map);
                goto out;
            }

            ret = vm_map_copy_overwrite(map,
                                        (vm_map_address_t)map_addr,
                                        tmp, FALSE);
            if (ret != KERN_SUCCESS) {
                vm_map_copy_discard(tmp);
                (void) vm_map_remove(map,
                                     vm_map_trunc_page(map_addr),
                                     vm_map_round_page(map_addr + dyl_length),
                                     VM_MAP_NO_FLAGS);
                vm_map_deallocate(copy_map);
                goto out;
            }

            if (map_addr != dyl_start)
                myresult.entry_point += (map_addr - dyl_start);
        } else {
            ret = LOAD_FAILURE;
        }

        vm_map_deallocate(copy_map);
    }

    if (ret == LOAD_SUCCESS) {
        result->dynlinker = TRUE;
        result->entry_point = myresult.entry_point;
        (void)ubc_map(vp, PROT_READ | PROT_EXEC);
    }
out:
    vnode_put(vp);
    return (ret);

}