int main(int argc, char *argv[]) {
int option=0;
char *name=NULL;
uint64_t read_addr=0;
char *path=NULL;
boolean_t override=FALSE;
while ((option = getopt(argc, argv, "oa:p:")) != -1) {
switch (option) {
case 'a':
if (strcmp(optarg, "kernel") == 0) {
read_addr=0xffffff8000200000;
} else {
read_addr=KextUnslidBaseAddress(optarg);
if (read_addr == 0) {
__dbg("(!) Invalid read address. Must be a KEXT bundle ID or the \'kernel\' string.");
return 1;
}
}
name=optarg;
break;
case 'p':
if (open(optarg, O_RDONLY) < 0) {
__dbg("(!) File was not found on disk. Creating it now.");
if(open(optarg, O_CREAT|O_RDWR, 0666) < 0) {
__dbg("(!) Unable to create file. Aborting.");
return 1;
}
}
path=optarg;
break;
case 'o':
override=TRUE;
break;
default:
break;
}
}
if (!read_addr || !path) {
usage();
return 0;
}
__dbg("(+) Will dump hierarchy for: %#llx (%s), @ path %s. Override: %d", read_addr, name, path, override);
SET_KERNEL_SLIDE(kslide);
mach_port_t kport = get_kernel_task();
if (!kport) {
return -2;
}
return dump_hierarchy(kport, read_addr, name, path, override);
}
__attribute__((always_inline)) void read_kernel_memory_in_buffer(task_t task, vm_offset_t addr, uint32_t size, void *buffer)
{
mach_vm_size_t sz = 0;
mach_vm_read_overwrite(task, addr, size, (mach_vm_address_t)buffer, (mach_vm_size_t*)&sz);
if (!buffer) {
__dbg("(!) read failed.");
return;
}
}
void *read_kernel_memory(task_t task, vm_offset_t addr, uint32_t size)
{
void* mem = malloc(size);
mach_vm_size_t sz = 0;
mach_vm_read_overwrite(task, addr, size, (mach_vm_address_t)mem, (mach_vm_size_t*)&sz);
if (!mem) {
__dbg("(!) read failed.");
return NULL;
}
return mem;
}
mach_port_t get_kernel_task(void)
{
if (getuid() != 0) {
__dbg("Program should be run as root.");
return 0;
}
mach_port_t ktask = task_for_pid_workaround(0);
if (!ktask) {
__dbg("processor_set_tasks() failed. is SIP enabled?");
return 0;
}
int32_t pid;
pid_for_task(ktask, &pid);
if (pid!=0) {
__dbg("kernel task was returned by processor_set_tasks(), but it appears to have the wrong PID. If you are reading this, the universe is probably collapsing.");
return 0;
}
return ktask;
}
/*
* DBG intrinsic
* First argument for DBG intrinsic must be compile-time constant,
* otherwise an error should be raised.
*/
void test_dbg_const_diag(unsigned int t) {
__dbg(t); // expected-error-re {{argument to {{.*}} must be a constant integer}}
}
// AArch32-LABEL: test_dbg
// AArch32: call void @llvm.arm.dbg(i32 0)
void test_dbg(void) {
__dbg(0);
}
