Feature Request: Export Kernel Slide/Base

[pwmoore]

It's entirely possible this is already implemented and I've missed it, but if not it would be nice if the kernel slide were exported (whether via task_info, or even just a file dropped on disk). I've played around with some heap scanning shenanigans (i.e. @Siguza's tools) and they don't seem to be happy on 13.2.2. I'm sure I can eventually figure out some way of finding the slide that way, but it would be awesome if we could just get the slide without having to do any scanning or probing kernel memory.

Alternately, I may just be being dumb and it's already there or I'm doing something wrong, in which case I apologize in advance. :)

[arx8x]

The patch was supposed to be added after tfp0 was fixed on iOS 13. It's planned, afaik. Scanning vm regions works only until iOS 12.4.3.

[Siguza]

This is planned, the issue is just that our patches are applies before the kernel is booted, at which time the common interface(s) to export the kernel slide don't exist yet. But we'll think of something.

[pwmoore]

Gotcha, thanks. I can imagine that's a tricky task. Just spitballing, I wonder if there's a useless sysctl that could be patched with the slide that we could retrieve, or maybe via boot arg or something. In the meantime I'll poke around and see if I can figure out a good way of retrieving it dynamically.

As always I appreciate the work you guys are doing on this.

[Siguza]

Well task_info has kinda become the standard interface. Just exporting the slide somewhere wouldn't be the issue, we could just patch an unused mach trap.

[bazad]

For what it's worth, a workaround in the meantime (which I'm using in KTRW) is to use an unsafe heap scan: https://gist.github.com/bazad/4636445f27df2086ca395790e9aca279

[pwmoore]

@bazad I actually wound up doing exactly that, although my code is much... uglier than yours. :) It seems to be pretty reliable, so it should meet my needs for now. Appreciate the heads up!

[sbingner]

Exporting to tfp0 dyld info is working and should be in next release - also https://github.com/sbingner/jbctl has the tool I use to test it, may have some code helpful to anybody trying to pull more than kernel slide/base out of it.