Permalink
Browse files

omg it works

  • Loading branch information...
1 parent 30ce92a commit d8ffd259fcd21d2c378c6075af42f32c4837f622 @comex committed Oct 9, 2010
Showing with 384 additions and 2,863 deletions.
  1. +0 −2,713 elf.h
  2. +3 −0 ent.plist
  3. +0 −6 kasm.S
  4. +22 −6 kcode.c
  5. +28 −7 kinc.h
  6. +323 −37 loader.c
  7. +6 −33 make.py
  8. +0 −59 nm.py
  9. +2 −2 stuff.c
View
2,713 elf.h

Large diffs are not rendered by default.

Oops, something went wrong.
View
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict><key>get-task-allow</key><true/><key>run-unsigned-code</key><true/><key>task_for_pid-allow</key><true/></dict></plist>
View
6 kasm.S
@@ -1,6 +0,0 @@
-.thumb
-.syntax unified
-.section .init
-stub:
- b mysyscall
-
View
28 kcode.c
@@ -33,9 +33,9 @@ int weird_hook(char *buf, int size) {
int ret = weird_old(buf, size);
IOLog("weird_old: [%x] ", size);
while(size--) {
- IOLog("%02c ", *buf++);
+ IOLog("%02x ", (int) *buf++);
}
- IOLog("=> %d\n", ret);
+ IOLog("=> %x\n", ret);
return ret;
}
@@ -69,7 +69,25 @@ static int list_iosurfaces() {
return 0;
}
-__attribute__((externally_visible))
+// from the loader
+extern struct sysent sysent[];
+
+int mysyscall(void *p, struct mysyscall_args *uap, int32_t *retval);
+__attribute__((constructor))
+void init() {
+ IOLog("init\n");
+ sysent[8] = (struct sysent){ 1, 0, 0, (void *) mysyscall, NULL, NULL, _SYSCALL_RET_INT_T, 5 * sizeof(uint32_t) };
+
+}
+
+__attribute__((destructor))
+void fini() {
+ IOLog("fini\n");
+ unhook(logger_old); logger_old = NULL;
+ unhook(vm_fault_enter_old); vm_fault_enter_old = NULL;
+ unhook(weird_old); weird_old = NULL;
+}
+
int mysyscall(void *p, struct mysyscall_args *uap, int32_t *retval)
{
//IOLog("Hi mode=%d\n", uap->mode);
@@ -122,9 +140,7 @@ int mysyscall(void *p, struct mysyscall_args *uap, int32_t *retval)
break;
}
case 6: { // unhook
- unhook(logger_old); logger_old = NULL;
- unhook(vm_fault_enter_old); vm_fault_enter_old = NULL;
- unhook(weird_old); weird_old = NULL;
+ fini();
break;
}
case 7: { // hook a function, log args
View
35 kinc.h
@@ -1,7 +1,5 @@
#include <stdint.h>
#include <stdbool.h>
-// This is stupid and generates wasteful code, but is necessary. The BL instruction generated otherwise treats it as ARM and ignores the least-significant bit.
-// A proper solution is apparently making the generated symbol have the right attribute, but I can't do that without... manually generating an ELF file?
#define LC __attribute__((long_call))
typedef uint32_t user_addr_t, vm_size_t, vm_address_t, boolean_t, size_t, vm_offset_t, vm_prot_t;
@@ -33,19 +31,19 @@ typedef enum IODirection {
} IODirection;
LC void *IOMemoryDescriptor_withPhysicalAddress(unsigned long address, unsigned long withLength, IODirection withDirection)
-asm("_ZN18IOMemoryDescriptor19withPhysicalAddressEmm11IODirection");
+asm("__ZN18IOMemoryDescriptor19withPhysicalAddressEmm11IODirection");
LC void *IOMemoryDescriptor_map(void *descriptor, unsigned int options)
-asm("_ZN18IOMemoryDescriptor3mapEm");
+asm("__ZN18IOMemoryDescriptor3mapEm");
LC void *IOMemoryDescriptor_getPhysicalAddress(void *descriptor)
-asm("_ZN18IOMemoryDescriptor18getPhysicalAddressEv");
+asm("__ZN18IOMemoryDescriptor18getPhysicalAddressEv");
LC void *IOMemoryMap_getAddress(void *map)
-asm("_ZN11IOMemoryMap10getAddressEv");
+asm("__ZN11IOMemoryMap10getAddressEv");
LC void *IORegistryEntry_fromPath(const char *name, void *plane, char *residualPath, int *residualLength, void *fromEntry)
-asm("_ZN15IORegistryEntry8fromPathEPKcPK15IORegistryPlanePcPiPS_");
+asm("__ZN15IORegistryEntry8fromPathEPKcPK15IORegistryPlanePcPiPS_");
static inline void delete_object(void *object) {
((void (***)(void *)) object)[0][1](object);
@@ -60,6 +58,29 @@ static inline void *retain_object(void *object) {
return object;
}
+// copied from xnu
+
+struct proc;
+typedef int32_t sy_call_t(struct proc *, void *, int *);
+typedef void sy_munge_t(const void *, void *);
+
+struct sysent { /* system call table */
+ int16_t sy_narg; /* number of args */
+ int8_t sy_resv; /* reserved */
+ int8_t sy_flags; /* flags */
+ sy_call_t *sy_call; /* implementing function */
+ sy_munge_t *sy_arg_munge32; /* system call arguments munger for 32-bit process */
+ sy_munge_t *sy_arg_munge64; /* system call arguments munger for 64-bit process */
+ int32_t sy_return_type; /* system call return types */
+ uint16_t sy_arg_bytes; /* Total size of arguments in bytes for
+ * 32-bit system calls
+ */
+};
+#define _SYSCALL_RET_INT_T 1
+
+// end copied
+
+
#define prop(a, off, typ) *((typ *)(((char *) (a))+(off)))
#define NULL ((void *) 0)
Oops, something went wrong.

0 comments on commit d8ffd25

Please sign in to comment.