splay_tree find_data(splay_tree t, int data){
assert(t!=NULL && "l'arbre est vide");
if (data == t->data){ return t;}
else if (data > t->data){
return find_data(t->right, data);}
else {
return find_data(t->left, data);}
}
static void
processing_stw_step (void)
{
int i;
int bridge_count;
gint64 curtime;
if (!dyn_array_ptr_size (®istered_bridges))
return;
#if defined (DUMP_GRAPH)
printf ("-----------------\n");
#endif
/*
* bridge_processing_in_progress must be set with the world
* stopped. If not there would be race conditions.
*/
bridge_processing_in_progress = TRUE;
SGEN_TV_GETTIME (curtime);
object_alloc_init ();
color_alloc_init ();
bridge_count = dyn_array_ptr_size (®istered_bridges);
for (i = 0; i < bridge_count ; ++i)
register_bridge_object (dyn_array_ptr_get (®istered_bridges, i));
setup_time = step_timer (&curtime);
for (i = 0; i < bridge_count; ++i) {
ScanData *sd = find_data (dyn_array_ptr_get (®istered_bridges, i));
if (sd->state == INITIAL) {
dyn_array_ptr_push (&scan_stack, sd);
dfs ();
} else {
g_assert (sd->state == FINISHED_OFF_STACK);
}
}
tarjan_time = step_timer (&curtime);
#if defined (DUMP_GRAPH)
printf ("----summary----\n");
printf ("bridges:\n");
for (i = 0; i < bridge_count; ++i) {
ScanData *sd = find_data (dyn_array_ptr_get (®istered_bridges, i));
printf ("\t%s (%p) index %d color %p\n", safe_name_bridge (sd->obj), sd->obj, sd->index, sd->color);
}
dump_color_table (" after tarjan", FALSE);
#endif
clear_after_processing ();
}
static void
compute_low_index (ScanData *data, GCObject *obj)
{
ScanData *other;
ColorData *cd;
obj = bridge_object_forward (obj);
other = find_data (obj);
#if DUMP_GRAPH
printf ("\tcompute low %p ->%p (%s) %p (%d / %d)\n", data->obj, obj, safe_name_bridge (obj), other, other ? other->index : -2, other ? other->low_index : -2);
#endif
if (!other)
return;
g_assert (other->state != INITIAL);
if ((other->state == SCANNED || other->state == FINISHED_ON_STACK) && data->low_index > other->low_index)
data->low_index = other->low_index;
/* Compute the low color */
if (other->color == NULL)
return;
cd = other->color;
if (!cd->visited) {
dyn_array_ptr_add (&color_merge_array, other->color);
cd->visited = TRUE;
}
}
//实现删除节点的功能
int delete_data(Tree* pt,int data)
{
//1.查找目标元素所在的地址信息
// 返回指向目标节点地址的指针 的地址
Node** ppn = find_data(pt,data);
//2.判断查找是否成功，不存在则删除失败
// ppn = &pt->root;
// *ppn = pt->root;
if(NULL == *ppn)
{
return -1;//查找失败
}
//3.若查找成功，则合并左子树到右子树中
if((*ppn)->left != NULL)
{
insert(&(*ppn)->right,(*ppn)->left);
}
//4.寻找临时指针记录要删除节点的地址
Node* pn = *ppn;
//5.将原来指向目标节点的指针指向右子树
*ppn = (*ppn)->right;
//6.删除目标节点
free(pn);
pn = NULL;
//7.个点个数减 1
--pt->cnt;
return 0;//删除成功
}
/* insert data to loop link */
STATUS insert_data(LINK_NODE** ppLinkNode, int data)
{
LINK_NODE* pNode;
if(NULL == ppLinkNode)
return FALSE;
if(NULL == *ppLinkNode){
pNode = create_link_node(data);
assert(NULL != pNode);
pNode->next = pNode;
*ppLinkNode = pNode;
return TRUE;
}
if(NULL != find_data(*ppLinkNode, data))
return FALSE;
pNode = create_link_node(data);
assert(NULL != pNode);
pNode->next = (*ppLinkNode)->next;
(*ppLinkNode)->next = pNode;
return TRUE;
}
static void target_cb(struct btd_service *service,
btd_service_state_t old_state,
btd_service_state_t new_state)
{
struct btd_device *dev = btd_service_get_device(service);
struct policy_data *data;
data = find_data(dev);
if (data == NULL)
return;
switch (new_state) {
case BTD_SERVICE_STATE_UNAVAILABLE:
case BTD_SERVICE_STATE_DISCONNECTED:
break;
case BTD_SERVICE_STATE_CONNECTING:
break;
case BTD_SERVICE_STATE_CONNECTED:
if (data->tg_timer > 0) {
g_source_remove(data->tg_timer);
data->tg_timer = 0;
}
break;
case BTD_SERVICE_STATE_DISCONNECTING:
break;
}
}
/* delete data */
STATUS delete_data(LINK_NODE** ppLinkNode, int data)
{
LINK_NODE* pIndex = NULL;
LINK_NODE* prev = NULL;
if(NULL == ppLinkNode || NULL == *ppLinkNode)
return FALSE;
pIndex = find_data(*ppLinkNode, data);
if(NULL == pIndex)
return FALSE;
if(pIndex == *ppLinkNode){
if(pIndex == pIndex->next){
*ppLinkNode = NULL;
}else{
prev = pIndex->next;
while(pIndex != prev->next)
prev = prev->next;
prev->next = pIndex->next;
*ppLinkNode = pIndex->next;
}
}else{
prev = pIndex->next;
while(pIndex != prev->next)
prev = prev->next;
prev->next = pIndex->next;
}
free(pIndex);
return TRUE;
}
/***************************************************************************
* Function: void disconnect(conn_data *conn)
*
* Description:
* Remove the indicated connection from the list of connections,
* close the file descriptor associated with it, and free all of the
* memory it's using (including dereferencing of any strings still in
* its input and output lists).
**************************************************************************/
void disconnect(conn_data *conn) {
find_data(conn_list, conn, ptrcmp, TRUE);
close(conn->fd);
destroy_list(conn->input, deref_string);
destroy_list(conn->output, deref_string);
free(conn);
}
static ScanData*
find_or_create_data (GCObject *obj)
{
ScanData *entry = find_data (obj);
if (!entry)
entry = create_data (obj);
return entry;
}
struct ofp_nh_entry *
ofp_rtl_remove(struct ofp_rtl_tree *tree, uint32_t addr_be, uint32_t masklen)
{
struct ofp_rtl_node *elem, *node = tree->root;
const uint32_t addr = to_network_prefix(addr_be, masklen);
struct ofp_nh_entry *data = find_data(tree->vrf, addr_be, masklen);
uint32_t low = 0, high = IPV4_FIRST_LEVEL;
int32_t insert = -1;
if (!data)
return NULL;
for (; high <= IPV4_LENGTH ; low = high, high += IPV4_LEVEL) {
dec_use_reference(node);
if (masklen <= high) {
uint32_t index = ip_range_begin(addr, masklen, low, high);
uint32_t index_end = ip_range_end(addr, masklen, low, high);
for (; index < index_end; index++) {
if (node[index].masklen == masklen &&
!memcmp(&node[index].data, data,
sizeof(struct ofp_nh_entry))) {
if (node[index].next == NULL)
node[index].masklen = 0;
else
node[index].masklen = high + 1;
}
}
/* if exists, re-insert previous route that was overwritten, after cleanup*/
insert = ofp_rt_rule_find_prefix_match(tree->vrf, addr, masklen, low);
break;
}
elem = find_node(node, addr, low, high);
if (elem->masklen == 0)
return NULL;
node = elem->next;
if (get_use_reference(node) == 1 && elem->masklen > high) {
/* next level will be freed so we update prefix_len to 0,
* if there is no leaf stored on the current elem */
elem->masklen = 0;
elem->next = NULL;
}
}
odp_mb_release();
if (insert != -1)
ofp_rtl_insert(tree,
shm->rules[insert].addr,
shm->rules[insert].masklen,
&shm->rules[insert].data[0]);
return data;
}
uint32_t find_dvp_struct_offset(struct binary *binary) {
bool is_armv7 = binary->actual_cpusubtype == 9;
range_t range = b_macho_segrange(binary, "__PRELINK_TEXT");
addr_t derive_vnode_path = find_bof(range, find_int32(range, find_string(range, "path", 0, true), true), is_armv7);
uint8_t byte = b_read8(binary, find_data((range_t) {
binary, derive_vnode_path, 1024
}, !is_armv7 ? "00 00 50 e3 02 30 a0 11 - .. 00 94 e5" : "- .. 69 6a 46", 0, true));
if(is_armv7) {
return (4 | (byte >> 6)) << 2;
} else {
return byte;
std::pair<bool,std::list<std::string>> inst_wire::get_list(std::string key)
{
std::list<std::string> List;
if(find_data(key)==0)
{
return std::pair<bool,std::list<std::string>> (0,List);
}
else
{
List = maplist[key];
return std::pair<bool,std::list<std::string>> (1,List);
}
}
static void target_cb(struct btd_service *service,
btd_service_state_t old_state,
btd_service_state_t new_state)
{
struct btd_device *dev = btd_service_get_device(service);
struct policy_data *data;
data = find_data(dev);
if (data == NULL)
return;
switch (new_state) {
case BTD_SERVICE_STATE_UNAVAILABLE:
if (data->tg_timer > 0) {
g_source_remove(data->tg_timer);
data->tg_timer = 0;
}
break;
case BTD_SERVICE_STATE_DISCONNECTED:
if (old_state == BTD_SERVICE_STATE_CONNECTING) {
int err = btd_service_get_error(service);
if (err == -EAGAIN) {
if (data->tg_retries < TG_RETRIES)
policy_set_tg_timer(data,
TG_RETRY_TIMEOUT);
else
data->tg_retries = 0;
break;
} else if (data->tg_timer > 0) {
g_source_remove(data->tg_timer);
data->tg_timer = 0;
}
} else if (old_state == BTD_SERVICE_STATE_CONNECTED) {
data->tg_retries = 0;
}
break;
case BTD_SERVICE_STATE_CONNECTING:
break;
case BTD_SERVICE_STATE_CONNECTED:
if (data->tg_timer > 0) {
g_source_remove(data->tg_timer);
data->tg_timer = 0;
}
break;
case BTD_SERVICE_STATE_DISCONNECTING:
break;
}
}
static struct policy_data *policy_get_data(struct btd_device *dev)
{
struct policy_data *data;
data = find_data(dev);
if (data != NULL)
return data;
data = g_new0(struct policy_data, 1);
data->dev = dev;
devices = g_slist_prepend(devices, data);
return data;
}
static void
push_object (GCObject *obj)
{
ScanData *data;
obj = bridge_object_forward (obj);
#if DUMP_GRAPH
printf ("\t= pushing %p %s -> ", obj, safe_name_bridge (obj));
#endif
/* Object types we can ignore */
if (is_opaque_object (obj)) {
#if DUMP_GRAPH
printf ("opaque\n");
#endif
return;
}
data = find_data (obj);
/* Already marked - XXX must be done this way as the bridge themselves are alive. */
if (data && data->state != INITIAL) {
#if DUMP_GRAPH
printf ("already marked\n");
#endif
return;
}
/* We only care about dead objects */
if (!data && sgen_object_is_live (obj)) {
#if DUMP_GRAPH
printf ("alive\n");
#endif
return;
}
#if DUMP_GRAPH
printf ("pushed!\n");
#endif
if (!data)
data = create_data (obj);
g_assert (data->state == INITIAL);
g_assert (data->index == -1);
dyn_array_ptr_push (&scan_stack, data);
}
size_t vas_write(void *buf_in, size_t count)
{
u_long len, offset, buf, va;
if(vas_version < 2)
return vas_write_v1(buf_in, count);
if(count != sizeof(u_long)) {
printf("count %d not %d\n", (int)count, (int)sizeof(u_long));
return -1;
}
va = vas_base_va;
if(!find_data(va, &buf, &len, &offset))
*(u_long *)(buf+offset) = *(u_long *)buf_in;
vas_base_va += count;
return count;
}
static WRITE16_HANDLER( jpeg2_w )
{
COMBINE_DATA(&jpeg2);
{
int idx=find_data((int)jpeg2+(((int)jpeg1)<<16));
if(idx>=0)
{
jpeg_addr=gfxlookup[idx][0];
jpeg_w=gfxlookup[idx][2];
jpeg_h=gfxlookup[idx][3];
render_jpeg();
}
else
{
jpeg_addr=-1;
}
}
}
static WRITE16_HANDLER( jpeg2_w )
{
sliver_state *state = space->machine().driver_data<sliver_state>();
int idx;
COMBINE_DATA(&state->m_jpeg2);
idx = find_data((int)state->m_jpeg2 + (((int)state->m_jpeg1) << 16));
if (idx >= 0)
{
state->m_jpeg_addr = gfxlookup[idx][0];
state->m_jpeg_w = gfxlookup[idx][2];
state->m_jpeg_h = gfxlookup[idx][3];
render_jpeg(space->machine());
}
else
{
state->m_jpeg_addr = -1;
}
}
size_t vas_read(void *buf_in, size_t count)
{
u_long len, offset, buf, va;
u_long num, output, remaining;
if(vas_version < 2)
return vas_read_v1(buf_in, count);
va = vas_base_va;
remaining = count;
output = (u_long)buf_in;
while(remaining) {
find_data(va, &buf, &len, &offset);
num = (remaining > (len - offset)) ? (len - offset) : remaining;
bcopy((const void *)(buf+offset), (void *)output, num);
remaining -= num;
va += num;
output += num;
}
vas_base_va += count;
return count;
}
explicit SummaryFractiles (const BlockModel& al)
: Summary (al),
data (find_data (al)),
fractiles (al.number_sequence ("fractiles")),
first (al.name ("first", Attribute::None ()))
{ }
SimplexData* find_data(void *key) const { return find_data((uintptr_t)key);}
SimplexData* find_data(const string& s) const { return find_data((uintptr_t)s.c_str());}
void do_kernel(struct binary *binary, struct binary *sandbox) {
unsigned int class = classify(binary);
addr_t _PE_i_can_has_debugger, _vn_getpath, _memcmp;
struct findmany *text = findmany_init(b_macho_segrange(binary, "__TEXT"));
_PE_i_can_has_debugger = b_sym(binary, "_PE_i_can_has_debugger", MUST_FIND | TO_EXECUTE);
_vn_getpath = b_sym(binary, "_vn_getpath", MUST_FIND | TO_EXECUTE);
_memcmp = b_sym(binary, "_memcmp", MUST_FIND | TO_EXECUTE);
addr_t vme; findmany_add(&vme, text, spec(_50, "01 f0 - 06 00 06 28",
_armv7, "- 02 0f .. .. 63 08 03 f0 01 05 e3 0a 13 f0 01 03",
_armv6, "- .. .. .. .. .. 08 1e 1c .. 0a 01 22 .. 1c 16 40 .. 40"));
addr_t vmp; findmany_add(&vmp, text, spec(_50, "- 26 f0 04 06 00 20 29 46",
_armv7, "- 25 f0 04 05 .. e7 92 45 98 bf 02 99 .. d8",
_armv6, "?"));
// this function checks the baked list of hashes
addr_t mystery = find_data(b_macho_segrange(binary, "__PRELINK_TEXT"), spec(_50, "- f0 b5 03 af 2d e9 00 05 04 46 .. .. 14 f8 01 0b 4f f0 13 0c",
_43, "- f0 b5 03 af 4d f8 04 8d .. .. 03 78 80 46",
_armv7, "- 90 b5 01 af 14 29 .. .. .. .. 90 f8 00 c0",
_armv6, "?"),
0, MUST_FIND);
addr_t dei; findmany_add(&dei, text, spec(_50, "24 bf 04 22 01 92 00 98 .. .. -",
_armv7, "04 22 01 92 00 98 .. 49 -",
_armv6, "?"));
addr_t tfp0; findmany_add(&tfp0, text, spec(_50, "91 e8 01 04 d1 f8 08 80 00 21 02 91 ba f1 00 0f 01 91 - 06 d1 02 a8",
_armv7, "85 68 00 23 .. 93 .. 93 - 5c b9 02 a8 29 46 04 22",
_armv6, "85 68 .. 93 .. 93 - 00 2c 0b d1"));
addr_t csedp; findmany_add(&csedp, text, spec(_50, "df f8 88 33 1d ee 90 0f a2 6a - 1b 68",
_43, "1d ee 90 3f d3 f8 80 33 93 f8 94 30 1b 09 03 f0 01 02 + .. .. .. ..",
_armv7, "1d ee 90 3f d3 f8 4c 33 d3 f8 9c 20 + .. .. .. .. 19 68 00 29",
_armv6, "9c 22 03 59 99 58 + .. .. 1a 68 00 2a"));
addr_t power = 0; if(class >= _43) power = find_data(b_macho_segrange(binary, "__PRELINK_TEXT"),
spec(_50, "- 32 20 00 21 20 22",
_43, "- 32 20 98 47 .. 68"),
0, MUST_FIND);
findmany_go(text);
// vm_map_enter (patch1) - allow RWX pages
patch("vm_map_enter", vme, uint32_t, {spec(_50, 0x28080006,
_armv7, 0x46c00f02,
_armv6, 0x46c046c0)});
// vm_map_protect - allow vm_protect etc. to create RWX pages
patch("vm_map_protect", vmp, uint32_t, {spec(_armv7, 0x46c046c0,
_armv6, 42)});
// AMFI (patch3) - disable the predefined list of executable stuff
patch("AMFI", mystery, uint32_t, {spec(_armv7, 0x47702001,
_armv6, 0xe3a00001)});
// PE_i_can_has_debugger (patch4) - so AMFI allows non-ldid'd binaries (and some other stuff is allowed)
// switching to patching the actual thing, and the startup code
// why? debug_enabled is used directly in kdp, and I was not emulating PE_i_can_has's behavior correctly anyway
patch("+debug_enabled", resolve_ldr(binary, _PE_i_can_has_debugger + 2), uint32_t, {1});
patch("-debug_enabled initializer", dei, uint32_t, {spec(_armv7, 0x60082001,
_armv6, 42)});
// task_for_pid 0
// this choice of patch was necessary so that a reboot wasn't required after
// using the screwed up version from jailbreakme 2.0; no reason to change it
patch("task_for_pid 0", tfp0, uint32_t, {spec(_50, 0xa802e006,
_armv7, 0xa802e00b,
_armv6, 0xe00b2c00)});
if(class >= _50) {
// it moved into BSS?
patch("cs_enforcement_disable check", csedp, uint16_t, {0x2301});
} else {
/***************************************************************************
* Function: void close_port(int port_fd)
*
* Description:
* Remove the indicated port from the list of ports, close the file
* descriptor associated with it, and free all of the memory it is using.
**************************************************************************/
void close_port(port_data *port) {
find_data(port_list, port, ptrcmp, TRUE);
close(port->fd);
free(port);
}
int fixup_nidmap(void)
{
struct PspModuleImport *pImport;
int size;
pImport = (struct PspModuleImport *) g_libstub->pData;
size = g_libstub->iSize;
while(size >= sizeof(struct PspModuleImport))
{
const char *str;
str = (const char*) find_data(LW(pImport->name));
if(str)
{
struct ImportMap *pMap;
pMap = find_map_by_name(str);
if(pMap)
{
int count;
unsigned int *pNid;
pNid = (unsigned int*) find_data(LW(pImport->nids));
count = LH(pImport->func_count) + pImport->var_count;
if(pNid && (count > 0))
{
if(g_verbose)
{
fprintf(stderr, "Mapping library %s\n", str);
}
while(count > 0)
{
int i;
for(i = 0; i < pMap->count; i++)
{
unsigned oldnid, newnid;
if(g_reversemap)
{
oldnid = pMap->nids[i].newnid;
newnid = pMap->nids[i].oldnid;
}
else
{
newnid = pMap->nids[i].newnid;
oldnid = pMap->nids[i].oldnid;
}
if(oldnid == *pNid)
{
if(g_verbose)
{
fprintf(stderr, "Mapping 0x%08X to 0x%08X\n", oldnid, newnid);
}
*pNid = newnid;
break;
}
}
pNid++;
count--;
}
}
}
}
pImport++;
size -= sizeof(struct PspModuleImport);
}
return 1;
}
