int main(int argc, char **argv) { if(argc < 2) goto usage; struct binary binary; b_init(&binary); b_load_macho(&binary, argv[1]); char **arg = &argv[2]; while(*arg) { if(!strcmp(*arg, "-a")) { if(!arg[1] || !arg[2]) goto usage; dump((range_t) {&binary, parse_hex_uint32(arg[1]), parse_hex_uint32(arg[2])}); arg += 3; } else if(!strcmp(*arg, "-A")) { if(!arg[1] || !arg[2]) goto usage; uint32_t start = parse_hex_uint32(arg[1]); dump((range_t) {&binary, start, parse_hex_uint32(arg[2]) - start}); arg += 3; } else if(!strcmp(*arg, "-s")) { if(!arg[1]) goto usage; dump(b_macho_segrange(&binary, arg[1])); arg += 2; } } return 0; usage: fprintf(stderr, "Usage: dump_range binary [-a start len] [-A start end] [-s segname]\n"); return 1; }
uint32_t find_dvp_struct_offset(struct binary *binary) { bool is_armv7 = binary->actual_cpusubtype == 9; range_t range = b_macho_segrange(binary, "__PRELINK_TEXT"); addr_t derive_vnode_path = find_bof(range, find_int32(range, find_string(range, "path", 0, true), true), is_armv7); uint8_t byte = b_read8(binary, find_data((range_t) { binary, derive_vnode_path, 1024 }, !is_armv7 ? "00 00 50 e3 02 30 a0 11 - .. 00 94 e5" : "- .. 69 6a 46", 0, true)); if(is_armv7) { return (4 | (byte >> 6)) << 2; } else { return byte;
void do_kernel(struct binary *binary, struct binary *sandbox) { unsigned int class = classify(binary); addr_t _PE_i_can_has_debugger, _vn_getpath, _memcmp; struct findmany *text = findmany_init(b_macho_segrange(binary, "__TEXT")); _PE_i_can_has_debugger = b_sym(binary, "_PE_i_can_has_debugger", MUST_FIND | TO_EXECUTE); _vn_getpath = b_sym(binary, "_vn_getpath", MUST_FIND | TO_EXECUTE); _memcmp = b_sym(binary, "_memcmp", MUST_FIND | TO_EXECUTE); addr_t vme; findmany_add(&vme, text, spec(_50, "01 f0 - 06 00 06 28", _armv7, "- 02 0f .. .. 63 08 03 f0 01 05 e3 0a 13 f0 01 03", _armv6, "- .. .. .. .. .. 08 1e 1c .. 0a 01 22 .. 1c 16 40 .. 40")); addr_t vmp; findmany_add(&vmp, text, spec(_50, "- 26 f0 04 06 00 20 29 46", _armv7, "- 25 f0 04 05 .. e7 92 45 98 bf 02 99 .. d8", _armv6, "?")); // this function checks the baked list of hashes addr_t mystery = find_data(b_macho_segrange(binary, "__PRELINK_TEXT"), spec(_50, "- f0 b5 03 af 2d e9 00 05 04 46 .. .. 14 f8 01 0b 4f f0 13 0c", _43, "- f0 b5 03 af 4d f8 04 8d .. .. 03 78 80 46", _armv7, "- 90 b5 01 af 14 29 .. .. .. .. 90 f8 00 c0", _armv6, "?"), 0, MUST_FIND); addr_t dei; findmany_add(&dei, text, spec(_50, "24 bf 04 22 01 92 00 98 .. .. -", _armv7, "04 22 01 92 00 98 .. 49 -", _armv6, "?")); addr_t tfp0; findmany_add(&tfp0, text, spec(_50, "91 e8 01 04 d1 f8 08 80 00 21 02 91 ba f1 00 0f 01 91 - 06 d1 02 a8", _armv7, "85 68 00 23 .. 93 .. 93 - 5c b9 02 a8 29 46 04 22", _armv6, "85 68 .. 93 .. 93 - 00 2c 0b d1")); addr_t csedp; findmany_add(&csedp, text, spec(_50, "df f8 88 33 1d ee 90 0f a2 6a - 1b 68", _43, "1d ee 90 3f d3 f8 80 33 93 f8 94 30 1b 09 03 f0 01 02 + .. .. .. ..", _armv7, "1d ee 90 3f d3 f8 4c 33 d3 f8 9c 20 + .. .. .. .. 19 68 00 29", _armv6, "9c 22 03 59 99 58 + .. .. 1a 68 00 2a")); addr_t power = 0; if(class >= _43) power = find_data(b_macho_segrange(binary, "__PRELINK_TEXT"), spec(_50, "- 32 20 00 21 20 22", _43, "- 32 20 98 47 .. 68"), 0, MUST_FIND); findmany_go(text); // vm_map_enter (patch1) - allow RWX pages patch("vm_map_enter", vme, uint32_t, {spec(_50, 0x28080006, _armv7, 0x46c00f02, _armv6, 0x46c046c0)}); // vm_map_protect - allow vm_protect etc. to create RWX pages patch("vm_map_protect", vmp, uint32_t, {spec(_armv7, 0x46c046c0, _armv6, 42)}); // AMFI (patch3) - disable the predefined list of executable stuff patch("AMFI", mystery, uint32_t, {spec(_armv7, 0x47702001, _armv6, 0xe3a00001)}); // PE_i_can_has_debugger (patch4) - so AMFI allows non-ldid'd binaries (and some other stuff is allowed) // switching to patching the actual thing, and the startup code // why? debug_enabled is used directly in kdp, and I was not emulating PE_i_can_has's behavior correctly anyway patch("+debug_enabled", resolve_ldr(binary, _PE_i_can_has_debugger + 2), uint32_t, {1}); patch("-debug_enabled initializer", dei, uint32_t, {spec(_armv7, 0x60082001, _armv6, 42)}); // task_for_pid 0 // this choice of patch was necessary so that a reboot wasn't required after // using the screwed up version from jailbreakme 2.0; no reason to change it patch("task_for_pid 0", tfp0, uint32_t, {spec(_50, 0xa802e006, _armv7, 0xa802e00b, _armv6, 0xe00b2c00)}); if(class >= _50) { // it moved into BSS? patch("cs_enforcement_disable check", csedp, uint16_t, {0x2301}); } else {
addr_t find_sysctl(struct binary *binary, const char *name) { addr_t cs = find_string(b_macho_segrange(binary, "__TEXT"), name, 0, MUST_FIND); addr_t csref = find_int32(b_macho_segrange(binary, "__DATA"), cs, MUST_FIND); return b_read32(binary, csref - 8); }