import os
import KernelCollection
def findGlobalSymbolVMAddr(kernel_cache, dylib_index, symbol_name):
for symbol_and_addr in kernel_cache.dictionary()["dylibs"][dylib_index]["global-symbols"]:
if symbol_and_addr["name"] == symbol_name:
return symbol_and_addr["vmAddr"]
return None
def findFixupVMAddr(kernel_cache, fixup_name):
for fixup_vmaddr, fixup_target in kernel_cache.dictionary()["fixups"].iteritems():
if fixup_target == fixup_name:
return fixup_vmaddr
return None
def offsetVMAddr(vmAddr, offset):
het_int = int(vmAddr, 16)
het_int = het_int + offset
return ''.join([ '0x', hex(het_int).upper()[2:] ])
def check(kernel_cache):
enableLogging = False
kernel_cache.buildKernelCollection("arm64e", "/kernel-vtable-patching-arm64e/main.kc", "/kernel-vtable-patching-arm64e/main.kernel", "/kernel-vtable-patching-arm64e/extensions", ["com.apple.bar"], [])
kernel_cache.analyze("/kernel-vtable-patching-arm64e/main.kc", ["-layout", "-arch", "arm64e"])
assert len(kernel_cache.dictionary()["dylibs"]) == 2
assert kernel_cache.dictionary()["dylibs"][0]["name"] == "com.apple.kernel"
assert kernel_cache.dictionary()["dylibs"][1]["name"] == "com.apple.bar"
kernel_cache.analyze("/kernel-vtable-patching-arm64e/main.kc", ["-symbols", "-arch", "arm64e"])
fooClassFooVMAddr = findGlobalSymbolVMAddr(kernel_cache, 0, "__ZN3Foo3fooEv")
if enableLogging:
print "fooClassFooVMAddr: " + fooClassFooVMAddr
fooClassUsed0VMAddr = findGlobalSymbolVMAddr(kernel_cache, 0, "__ZN3Foo8fooUsed0Ev")
if enableLogging:
print "fooClassUsed0VMAddr: " + fooClassUsed0VMAddr
barClassFooVMAddr = findGlobalSymbolVMAddr(kernel_cache, 1, "__ZN3Bar3fooEv")
if enableLogging:
print "barClassFooVMAddr: " + barClassFooVMAddr
kernel_cache.analyze("/kernel-vtable-patching-arm64e/main.kc", ["-fixups", "-arch", "arm64e"])
fooFooFixupAddr = findFixupVMAddr(kernel_cache, "kc(0) + " + fooClassFooVMAddr + " auth(IA addr 49764)")
if enableLogging:
print "fooFooFixupAddr: " + fooFooFixupAddr
fooFooNextFixupAddr = offsetVMAddr(fooFooFixupAddr, 8)
if enableLogging:
print "fooFooNextFixupAddr: " + fooFooNextFixupAddr
assert kernel_cache.dictionary()["fixups"][fooFooNextFixupAddr] == "kc(0) + " + fooClassUsed0VMAddr + " auth(IA addr 61962)"
barFooFixupAddr = findFixupVMAddr(kernel_cache, "kc(0) + " + barClassFooVMAddr + " auth(IA addr 49764)")
if enableLogging:
print "barFooFixupAddr: " + barFooFixupAddr
barFooNextFixupAddr = offsetVMAddr(barFooFixupAddr, 8)
if enableLogging:
print "barFooNextFixupAddr: " + barFooNextFixupAddr
assert kernel_cache.dictionary()["fixups"][barFooNextFixupAddr] == "kc(0) + " + fooClassUsed0VMAddr + " auth(IA addr 61962)"