Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stack corruption in xnu_override() #3

Closed
windoze opened this issue Feb 11, 2018 · 32 comments
Closed

Stack corruption in xnu_override() #3

windoze opened this issue Feb 11, 2018 · 32 comments

Comments

@windoze
Copy link

windoze commented Feb 11, 2018

MacBookPro14,3, macOS 10.13.3 (17D47)
SIP disabled with sudo csrutil enable --without kext

Kernel panic log:

Anonymous UUID:       A58509A4-4DAF-8005-C664-2F30280D765E

Sun Feb 11 16:26:08 2018

*** Panic Report ***
panic(cpu 4 caller 0xffffff7f8a0fad3d): "Kernel stack memory corruption detected"@/BuildRoot/Library/Caches/com.apple.xbs/Sources/xnu/xnu-4570.41.2/libkern/stack_protector.c:37
Backtrace (CPU 4), Frame : Return Address
0xffffff91ffe1b590 : 0xffffff8001c4f606 
0xffffff91ffe1b5e0 : 0xffffff8001d7c654 
0xffffff91ffe1b620 : 0xffffff8001d6e149 
0xffffff91ffe1b6a0 : 0xffffff8001c01120 
0xffffff91ffe1b6c0 : 0xffffff8001c4f03c 
0xffffff91ffe1b7f0 : 0xffffff8001c4edbc 
0xffffff91ffe1b850 : 0xffffff7f8a0fad3d 
0xffffff91ffe1bb30 : 0xffffff7f8a0faf00 
0xffffff91ffe1bb60 : 0xffffff7f8a0fa901 
0xffffff91ffe1bb80 : 0xffffff8002217419 
0xffffff91ffe1bbe0 : 0xffffff8002214603 
0xffffff91ffe1bc50 : 0xffffff8002221914 
0xffffff91ffe1bca0 : 0xffffff80022216ff 
0xffffff91ffe1bd00 : 0xffffff80022331be 
0xffffff91ffe1bd60 : 0xffffff8001ca4a07 
0xffffff91ffe1bdc0 : 0xffffff8001c54c40 
0xffffff91ffe1be10 : 0xffffff8001c31cbd 
0xffffff91ffe1be60 : 0xffffff8001c44b7b 
0xffffff91ffe1bef0 : 0xffffff8001d5857d 
0xffffff91ffe1bfa0 : 0xffffff8001c01926 
      Kernel Extensions in backtrace:
         es.govost.ryan.Thunderbolt3Unblocker(1.0)[C8F26371-DA83-3955-A658-600765BA4795]@0xffffff7f8a0fa000->0xffffff7f8a11cfff
            dependency: com.apple.iokit.IOThunderboltFamily(6.6.3)[1295A2A4-5EE5-341A-8F97-3F2D3481C45C]@0xffffff7f83045000

BSD process name corresponding to current thread: kextd

Mac OS version:
17D47

Kernel version:
Darwin Kernel Version 17.4.0: Sun Dec 17 09:19:54 PST 2017; root:xnu-4570.41.2~1/RELEASE_X86_64
Kernel UUID: 18D901F1-4A03-3FF1-AE34-C26B2732F13C
Kernel slide:     0x0000000001800000
Kernel text base: 0xffffff8001a00000
__HIB  text base: 0xffffff8001900000
System model name: MacBookPro14,3 (Mac-551B86E5744E2388)

System uptime in nanoseconds: 116018658421
last loaded kext at 116016430802: es.govost.ryan.Thunderbolt3Unblocker	1 (addr 0xffffff7f8a0fa000, size 143360)
loaded kexts:
es.govost.ryan.Thunderbolt3Unblocker	1
com.apple.filesystems.smbfs	3.2.1
com.apple.filesystems.autofs	3.0
com.apple.driver.AppleGraphicsDevicePolicy	3.16.21
com.apple.kext.AMDFramebuffer	1.6.0
com.apple.AGDCPluginDisplayMetrics	3.16.2
com.apple.kext.AMDRadeonX4200	1.6.0
com.apple.driver.AppleHV	1
com.apple.kext.AMDRadeonX4150	1.6.0
com.apple.iokit.IOUserEthernet	1.0.1
com.apple.kext.AMDRadeonX4100	1.6.0
com.apple.driver.AudioAUUC	1.70
com.apple.kext.AMD9515Controller	1.6.0
com.apple.iokit.IOBluetoothSerialManager	6.0.2f2
com.apple.kext.AMD9510Controller	1.6.0
com.apple.driver.pmtelemetry	1
com.apple.kext.AMD9520Controller	1.6.0
com.apple.driver.AppleUpstreamUserClient	3.6.4
com.apple.driver.AGPM	110.23.30
com.apple.driver.ApplePlatformEnabler	2.7.0d0
com.apple.driver.X86PlatformShim	1.0.0
com.apple.driver.AppleHDAHardwareConfigDriver	280.12
com.apple.Dont_Steal_Mac_OS_X	7.0.0
com.apple.kext.AMD9500Controller	1.6.0
com.apple.driver.AGDCBacklightControl	3.16.2
com.apple.driver.AppleIntelKBLGraphics	10.3.0
com.apple.driver.AppleHDA	280.12
com.apple.driver.AppleBacklight	170.10.2
com.apple.driver.AppleThunderboltIP	3.1.1
com.apple.driver.AirPort.BrcmNIC-MFG	1220.28.1a3
com.apple.driver.ACPI_SMC_PlatformPlugin	1.0.0
com.apple.driver.eficheck	1
com.apple.driver.AppleIntelPCHPMC	2.0.1
com.apple.driver.AppleHIDALSService	1
com.apple.driver.AppleIntelSlowAdaptiveClocking	4.0.0
com.apple.driver.AppleMCCSControl	1.5.3
com.apple.driver.AppleMuxControl	3.16.21
com.apple.driver.SMCMotionSensor	3.0.4d1
com.apple.driver.AppleIntelKBLGraphicsFramebuffer	10.3.0
com.apple.driver.AppleEmbeddedOSSupportHost	1
com.apple.driver.AppleOSXWatchdog	1
com.apple.driver.AirPort.BrcmNIC	1220.28.1a3
com.apple.driver.AppleFIVRDriver	4.1.0
com.apple.filesystems.apfs	748.41.3
com.apple.driver.AppleFileSystemDriver	3.0.1
com.apple.filesystems.hfs.kext	407.30.1
com.apple.AppleFSCompression.AppleFSCompressionTypeDataless	1.0.0d1
com.apple.BootCache	40
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib	1.0.0
com.apple.driver.AppleTopCaseHIDEventDriver	127
com.apple.driver.AppleSmartBatteryManager	161.0.0
com.apple.driver.AppleACPIButtons	6.1
com.apple.driver.AppleRTC	2.0
com.apple.driver.AppleSMBIOS	2.1
com.apple.driver.AppleACPIEC	6.1
com.apple.driver.AppleAPIC	1.7
com.apple.nke.applicationfirewall	183
com.apple.security.TMSafetyNet	8
com.apple.security.quarantine	3
com.apple.IOBufferCopyEngineTest	1
com.apple.kext.AMDRadeonX4000HWLibs	1.0
com.apple.kext.triggers	1.0
com.apple.driver.AppleSSE	1.0
com.apple.driver.DspFuncLib	280.12
com.apple.kext.OSvKernDSPLib	526
com.apple.driver.usb.cdc.acm	5.0.0
com.apple.AppleGPUWrangler	3.16.2
com.apple.kext.AMDSupport	1.6.0
com.apple.driver.AppleBacklightExpert	1.1.0
com.apple.iokit.IONDRVSupport	517.22
com.apple.iokit.IOBluetoothHostControllerUARTTransport	6.0.2f2
com.apple.iokit.IOBluetoothHostControllerTransport	6.0.2f2
com.apple.driver.IOPlatformPluginLegacy	1.0.0
com.apple.driver.AppleHDAController	280.12
com.apple.iokit.IOHDAFamily	280.12
com.apple.iokit.IOAudioFamily	206.5
com.apple.vecLib.kext	1.2.0
com.apple.driver.usb.cdc.ecm	5.0.0
com.apple.driver.usb.cdc.ncm	5.0.0
com.apple.driver.usb.IOUSBHostHIDDevice	1.2
com.apple.iokit.IOSlowAdaptiveClockingFamily	1.0.0
com.apple.driver.usb.AppleUSBiBridge	1.0
com.apple.driver.usb.cdc	5.0.0
com.apple.driver.usb.networking	5.0.0
com.apple.driver.usb.AppleUSBHostCompositeDevice	1.2
com.apple.driver.AppleUSBHostMergeProperties	1.2
com.apple.kext.AMDRadeonX4000HWServices	1.6.0
com.apple.driver.AppleSMBusController	1.0.18d1
com.apple.driver.AppleGraphicsControl	3.16.21
com.apple.AppleGraphicsDeviceControl	3.16.21
com.apple.iokit.IOAcceleratorFamily2	376.6
com.apple.iokit.IOGraphicsFamily	517.22
com.apple.iokit.IOSurface	209.2.2
com.apple.driver.AppleThunderboltEDMSink	4.1.2
com.apple.driver.AppleThunderboltDPOutAdapter	5.0.2
com.apple.driver.AppleSMBusPCI	1.0.14d1
com.apple.iokit.IO80211Family	1200.12.2
com.apple.driver.mDNSOffloadUserClient	1.0.1b8
com.apple.driver.corecapture	1.0.4
com.apple.driver.AppleIntelLpssUARTv1	3.0.60
com.apple.driver.AppleIntelLpssUARTCommon	3.0.60
com.apple.driver.AppleOnboardSerial	1.0
com.apple.iokit.IOSkywalkFamily	1
com.apple.iokit.IOSerialFamily	11
com.apple.driver.X86PlatformPlugin	1.0.0
com.apple.driver.IOPlatformPluginFamily	6.0.0d8
com.apple.filesystems.hfs.encodings.kext	1
com.apple.driver.AppleActuatorDriver	1204.13
com.apple.driver.AppleHIDKeyboard	203
com.apple.driver.AppleHSBluetoothDriver	127
com.apple.driver.IOBluetoothHIDDriver	6.0.2f2
com.apple.iokit.IOBluetoothFamily	6.0.2f2
com.apple.driver.AppleMultitouchDriver	1204.13
com.apple.driver.AppleInputDeviceSupport	1201.8
com.apple.driver.AppleHSSPIHIDDriver	52
com.apple.driver.AppleHSSPISupport	52
com.apple.driver.AppleIntelLpssSpiController	3.0.60
com.apple.driver.AppleThunderboltDPInAdapter	5.0.2
com.apple.driver.AppleThunderboltDPAdapterFamily	5.0.2
com.apple.driver.AppleThunderboltPCIDownAdapter	2.1.3
com.apple.driver.AppleXsanScheme	3
com.apple.iokit.IONVMeFamily	2.1.0
com.apple.driver.AppleThunderboltNHI	4.5.6
com.apple.driver.AppleHPM	3.1.3
com.apple.iokit.IOThunderboltFamily	6.6.3
com.apple.driver.AppleIntelLpssI2CController	3.0.60
com.apple.driver.AppleIntelLpssDmac	3.0.60
com.apple.driver.AppleIntelLpssI2C	3.0.60
com.apple.driver.AppleIntelLpssGspi	3.0.60
com.apple.driver.usb.AppleUSBXHCIPCI	1.2
com.apple.driver.usb.AppleUSBXHCI	1.2
com.apple.driver.usb.AppleUSBHostPacketFilter	1.0
com.apple.iokit.IOUSBFamily	900.4.1
com.apple.driver.AppleEFINVRAM	2.1
com.apple.driver.AppleEFIRuntime	2.1
com.apple.iokit.IOHIDFamily	2.0.0
com.apple.iokit.IOSMBusFamily	1.1
com.apple.security.sandbox	300.0
com.apple.kext.AppleMatch	1.0.0d1
com.apple.iokit.IOBufferCopyEngineFamily	1
com.apple.driver.DiskImages	480.30.2
com.apple.driver.AppleFDEKeyStore	28.30
com.apple.driver.AppleEffaceableStorage	1.0
com.apple.driver.AppleKeyStore	2
com.apple.driver.AppleUSBTDM	439.30.4
com.apple.driver.AppleMobileFileIntegrity	1.0.5
com.apple.iokit.IOUSBMassStorageDriver	140.30.1
com.apple.iokit.IOSCSIBlockCommandsDevice	404.30.2
com.apple.iokit.IOSCSIArchitectureModelFamily	404.30.2
com.apple.iokit.IOStorageFamily	2.1
com.apple.driver.AppleCredentialManager	1.0
com.apple.driver.KernelRelayHost	1
com.apple.iokit.IOUSBHostFamily	1.2
com.apple.driver.usb.AppleUSBCommon	1.0
com.apple.driver.AppleBusPowerController	1.0
com.apple.driver.AppleSEPManager	1.0.1
com.apple.driver.IOSlaveProcessor	1
com.apple.iokit.IOTimeSyncFamily	650.5
com.apple.iokit.IONetworkingFamily	3.4
com.apple.iokit.IOReportFamily	31
com.apple.driver.AppleACPIPlatform	6.1
com.apple.driver.AppleSMCRTC	1.0
com.apple.driver.AppleSMC	3.1.9
com.apple.iokit.IOPCIFamily	2.9
com.apple.iokit.IOACPIFamily	1.4
com.apple.kec.pthread	1
com.apple.kec.Libm	1
com.apple.kec.corecrypto	1.0

EOF
@rgov
Copy link
Owner

rgov commented Feb 12, 2018

Thanks for the report @windoze. That's unexpected, especially as you are on the same hardware and OS build as me.

Could you please run this command?

$ atos -o Thunderbolt3Unblocker.kext/Contents/MacOS/Thunderbolt3Unblocker -l 0xffffff7f8a0fa000 0xffffff7f8a0fa901 0xffffff7f8a0faf00 0xffffff7f8a0fad3d

@windoze
Copy link
Author

windoze commented Feb 12, 2018

The output is:

$ atos -o Thunderbolt3Unblocker.kext/Contents/MacOS/Thunderbolt3Unblocker -l 0xffffff7f8a0fa000 0xffffff7f8a0fa901 0xffffff7f8a0faf00 0xffffff7f8a0fad3d
Thunderbolt3Unblocker_start (in Thunderbolt3Unblocker) (Thunderbolt3Unblocker.c:28)
xnu_override_test (in Thunderbolt3Unblocker) (xnu_override_test.c:43)
xnu_unpatch (in Thunderbolt3Unblocker) (xnu_override.c:201)

I can provide more info if you need, thanks.

@rgov
Copy link
Owner

rgov commented Feb 12, 2018

Which is line 201 of xnu_override.c for you? What commit are you on? (git show)

@windoze
Copy link
Author

windoze commented Feb 12, 2018

I'm simply on master, nothing except certificate has been changed:

$ git show
commit 17ffbbd6e17b86cee245adad8c02cd2332df0547 (HEAD -> master, origin/master, origin/HEAD)
Author: Ryan Govostes <rgovostes+git@gmail.com>
Date:   Fri Feb 9 12:34:21 2018 +0900

    Add build dependencies

diff --git a/README.md b/README.md
index 3bb9d5b..75c5b62 100644
--- a/README.md
+++ b/README.md
@@ -14,8 +14,10 @@ unsupported in the first place. Use at your own peril.
 
 ## Installation
 
-Run `git submodule update --init --recursive` after cloning the repository to
-also fetch Udis86 sources.
+To prepare your development environment, please run
+
+    git submodule update --init --recursive
+    brew install autoconf automake libtool
 
 It is recommended to keep System Integrity Protection on. To lower security
 just enough to allow this kernel extension to be loaded, use `csrutil enable
$ git diff
diff --git a/Thunderbolt3Unblocker.xcodeproj/project.pbxproj b/Thunderbolt3Unblocker.xcodeproj/project.pbxproj
index d6af701..293608c 100644
--- a/Thunderbolt3Unblocker.xcodeproj/project.pbxproj
+++ b/Thunderbolt3Unblocker.xcodeproj/project.pbxproj
@@ -401,7 +401,7 @@
                        isa = XCBuildConfiguration;
                        buildSettings = {
                                CODE_SIGN_STYLE = Automatic;
-                               DEVELOPMENT_TEAM = G8YUU89437;
+                               DEVELOPMENT_TEAM = H5NV9D5DYB;
                                INFOPLIST_FILE = Thunderbolt3Unblocker/Info.plist;
                                MODULE_NAME = es.govost.ryan.Thunderbolt3Unblocker;
                                MODULE_START = Thunderbolt3Unblocker_start;
@@ -417,7 +417,7 @@
                        isa = XCBuildConfiguration;
                        buildSettings = {
                                CODE_SIGN_STYLE = Automatic;
-                               DEVELOPMENT_TEAM = G8YUU89437;
+                               DEVELOPMENT_TEAM = H5NV9D5DYB;
                                INFOPLIST_FILE = Thunderbolt3Unblocker/Info.plist;
                                MODULE_NAME = es.govost.ryan.Thunderbolt3Unblocker;
                                MODULE_START = Thunderbolt3Unblocker_start;

@windoze
Copy link
Author

windoze commented Feb 12, 2018

xnu_override.c:201 is the entry of function xnu_unpatch:

kern_return_t xnu_unpatch(const void *target) {
    os_log(OS_LOG_DEFAULT, LOG_PREFIX "Reverting patch\n");

    // Scan through the list of branch islands for this target
    BranchIsland *island = firstIsland;
    BranchIsland *prevIsland = NULL;

@rgov
Copy link
Owner

rgov commented Feb 12, 2018

I think that it's detecting stack canary corruption on exit from the first startup test call to xnu_override (and not xnu_unpatch, that's a symbolication glitch). However I'm not sure where stack corruption could happen; I do everything on the heap, and when I bcopy the stack is never the destination (but it sometimes is the source).

It could be a bug in Udis86, but I'd be surprised if this is the first project to ever hit it.

Plus, I can't reproduce it. Hm.

@rgov
Copy link
Owner

rgov commented Feb 12, 2018

It looks like your system uptime was only 2 minutes when this kext was loaded. Did you install it to /System/Library/Extensions or did you kextload it after boot?

@rgov rgov changed the title Kernel panic on loading of the kext Stack corruption in xnu_override() Feb 12, 2018
@windoze
Copy link
Author

windoze commented Feb 12, 2018

It's kinda weird, https://github.com/KhaosT/tb3-enabler seems to be working for me and this program also works on my old MBP2014 with exactly same version of OS (although it cannot do anything because MBP2014 doesn't have TB3 ports).

@rgov
Copy link
Owner

rgov commented Feb 12, 2018

Are you using Thunderbolt3Unblocker and TB3 Enabler at the same time? If so, don't. But the issue seems to be with the code that sets up the patch, and not the patch itself, so it makes sense that TB3 Enabler doesn't panic.

@rgov
Copy link
Owner

rgov commented Feb 12, 2018

What version of Xcode did you use to compile it?

@windoze
Copy link
Author

windoze commented Feb 12, 2018

It's Version 9.2 (9C40b), clang version is Apple LLVM version 9.0.0 (clang-900.0.39.2)
I just downloaded from MAS.
I didn't use them at same time, I tried Thunderbolt3Unblocker, it didn't work, then I went to tb3-enabler.

@windoze
Copy link
Author

windoze commented Feb 12, 2018

Oh, did you use Release or Debug build? I guess it may affect things.

@rgov
Copy link
Owner

rgov commented Feb 12, 2018

Same Xcode works here. Debug build.

@windoze
Copy link
Author

windoze commented Feb 12, 2018

Ok, I'm using Release build, let me revert back tb3-enabler and try Debug, hold on, need to restart my computer.

@windoze
Copy link
Author

windoze commented Feb 12, 2018

No luck, still the same

Kernel panic log:

Anonymous UUID:       A58509A4-4DAF-8005-C664-2F30280D765E

Mon Feb 12 14:28:55 2018

*** Panic Report ***
panic(cpu 4 caller 0xffffff7f8a5bc5cd): "Kernel stack memory corruption detected"@/BuildRoot/Library/Caches/com.apple.xbs/Sources/xnu/xnu-4570.41.2/libkern/stack_protector.c:37
Backtrace (CPU 4), Frame : Return Address
0xffffff82024c3550 : 0xffffff8004c4f606 
0xffffff82024c35a0 : 0xffffff8004d7c654 
0xffffff82024c35e0 : 0xffffff8004d6e149 
0xffffff82024c3660 : 0xffffff8004c01120 
0xffffff82024c3680 : 0xffffff8004c4f03c 
0xffffff82024c37b0 : 0xffffff8004c4edbc 
0xffffff82024c3810 : 0xffffff7f8a5bc5cd 
0xffffff82024c3b20 : 0xffffff7f8a5bc95d 
0xffffff82024c3b50 : 0xffffff7f8a5bbf55 
0xffffff82024c3b80 : 0xffffff8005217419 
0xffffff82024c3be0 : 0xffffff8005214603 
0xffffff82024c3c50 : 0xffffff8005221914 
0xffffff82024c3ca0 : 0xffffff80052216ff 
0xffffff82024c3d00 : 0xffffff80052331be 
0xffffff82024c3d60 : 0xffffff8004ca4a07 
0xffffff82024c3dc0 : 0xffffff8004c54c40 
0xffffff82024c3e10 : 0xffffff8004c31cbd 
0xffffff82024c3e60 : 0xffffff8004c44b7b 
0xffffff82024c3ef0 : 0xffffff8004d5857d 
0xffffff82024c3fa0 : 0xffffff8004c01926 
      Kernel Extensions in backtrace:
         es.govost.ryan.Thunderbolt3Unblocker(1.0)[5369DB5A-4BF6-3DB7-858B-A96C0BDB29D7]@0xffffff7f8a5bb000->0xffffff7f8a5defff
            dependency: com.apple.iokit.IOThunderboltFamily(6.6.3)[1295A2A4-5EE5-341A-8F97-3F2D3481C45C]@0xffffff7f8705b000

BSD process name corresponding to current thread: kextd

Mac OS version:
17D47

Kernel version:
Darwin Kernel Version 17.4.0: Sun Dec 17 09:19:54 PST 2017; root:xnu-4570.41.2~1/RELEASE_X86_64
Kernel UUID: 18D901F1-4A03-3FF1-AE34-C26B2732F13C
Kernel slide:     0x0000000004800000
Kernel text base: 0xffffff8004a00000
__HIB  text base: 0xffffff8004900000
System model name: MacBookPro14,3 (Mac-551B86E5744E2388)

System uptime in nanoseconds: 96757815941
last loaded kext at 96755580570: es.govost.ryan.Thunderbolt3Unblocker	1 (addr 0xffffff7f8a5bb000, size 147456)
loaded kexts:
es.govost.ryan.Thunderbolt3Unblocker	1
com.apple.driver.AppleHIDALSService	1
com.apple.driver.AudioAUUC	1.70
com.apple.filesystems.autofs	3.0
com.apple.driver.AGPM	110.23.30
com.apple.driver.ApplePlatformEnabler	2.7.0d0
com.apple.driver.X86PlatformShim	1.0.0
com.apple.driver.AppleHDAHardwareConfigDriver	280.12
com.apple.driver.AppleHDA	280.12
com.apple.driver.AppleUpstreamUserClient	3.6.4
com.apple.kext.AMDFramebuffer	1.6.0
com.apple.driver.AppleGraphicsDevicePolicy	3.16.21
com.apple.AGDCPluginDisplayMetrics	3.16.2
com.apple.driver.AppleHV	1
com.apple.kext.AMDRadeonX4200	1.6.0
com.apple.kext.AMDRadeonX4150	1.6.0
com.apple.kext.AMDRadeonX4100	1.6.0
com.apple.iokit.IOUserEthernet	1.0.1
com.apple.kext.AMD9515Controller	1.6.0
com.apple.driver.AppleIntelPCHPMC	2.0.1
com.apple.iokit.IOBluetoothSerialManager	6.0.2f2
com.apple.driver.AppleIntelKBLGraphics	10.3.0
com.apple.kext.AMD9510Controller	1.6.0
com.apple.kext.AMD9520Controller	1.6.0
com.apple.driver.pmtelemetry	1
com.apple.Dont_Steal_Mac_OS_X	7.0.0
com.apple.driver.AGDCBacklightControl	3.16.2
com.apple.driver.eficheck	1
com.apple.driver.ACPI_SMC_PlatformPlugin	1.0.0
com.apple.kext.AMD9500Controller	1.6.0
com.apple.driver.AppleBacklight	170.10.2
com.apple.driver.AppleMuxControl	3.16.21
com.apple.driver.AppleOSXWatchdog	1
com.apple.driver.SMCMotionSensor	3.0.4d1
com.apple.driver.AppleIntelKBLGraphicsFramebuffer	10.3.0
com.apple.driver.AppleEmbeddedOSSupportHost	1
com.apple.driver.AppleFIVRDriver	4.1.0
com.apple.driver.AppleIntelSlowAdaptiveClocking	4.0.0
com.apple.driver.AppleThunderboltIP	3.1.1
com.apple.driver.AppleMCCSControl	1.5.3
com.apple.filesystems.apfs	748.41.3
com.apple.driver.AppleFileSystemDriver	3.0.1
com.apple.filesystems.hfs.kext	407.30.1
com.apple.AppleFSCompression.AppleFSCompressionTypeDataless	1.0.0d1
com.apple.BootCache	40
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib	1.0.0
com.apple.driver.AppleTopCaseHIDEventDriver	127
com.apple.driver.AirPort.BrcmNIC	1220.28.1a3
com.apple.driver.AppleSmartBatteryManager	161.0.0
com.apple.driver.AppleACPIButtons	6.1
com.apple.driver.AppleRTC	2.0
com.apple.driver.AppleSMBIOS	2.1
com.apple.driver.AppleACPIEC	6.1
com.apple.driver.AppleAPIC	1.7
com.apple.nke.applicationfirewall	183
com.apple.security.TMSafetyNet	8
com.apple.security.quarantine	3
com.apple.IOBufferCopyEngineTest	1
com.apple.driver.usb.cdc.acm	5.0.0
com.apple.driver.usb.cdc.ecm	5.0.0
com.apple.driver.usb.cdc.ncm	5.0.0
com.apple.driver.usb.IOUSBHostHIDDevice	1.2
com.apple.driver.usb.AppleUSBiBridge	1.0
com.apple.driver.usb.cdc	5.0.0
com.apple.driver.usb.networking	5.0.0
com.apple.driver.usb.AppleUSBHostCompositeDevice	1.2
com.apple.driver.AppleUSBHostMergeProperties	1.2
com.apple.kext.triggers	1.0
com.apple.driver.DspFuncLib	280.12
com.apple.kext.OSvKernDSPLib	526
com.apple.driver.AppleSSE	1.0
com.apple.iokit.IOBluetoothHostControllerUARTTransport	6.0.2f2
com.apple.iokit.IOBluetoothHostControllerTransport	6.0.2f2
com.apple.driver.AppleSMBusPCI	1.0.14d1
com.apple.driver.IOPlatformPluginLegacy	1.0.0
com.apple.AppleGPUWrangler	3.16.2
com.apple.driver.AppleHDAController	280.12
com.apple.iokit.IOHDAFamily	280.12
com.apple.iokit.IOAudioFamily	206.5
com.apple.vecLib.kext	1.2.0
com.apple.driver.AppleBacklightExpert	1.1.0
com.apple.iokit.IONDRVSupport	517.22
com.apple.driver.AppleGraphicsControl	3.16.21
com.apple.iokit.IOAcceleratorFamily2	376.6
com.apple.iokit.IOSurface	209.2.2
com.apple.driver.AppleIntelLpssUARTv1	3.0.60
com.apple.driver.AppleIntelLpssUARTCommon	3.0.60
com.apple.driver.AppleOnboardSerial	1.0
com.apple.iokit.IOSkywalkFamily	1
com.apple.iokit.IOSerialFamily	11
com.apple.driver.X86PlatformPlugin	1.0.0
com.apple.driver.IOPlatformPluginFamily	6.0.0d8
com.apple.iokit.IOSlowAdaptiveClockingFamily	1.0.0
com.apple.kext.AMDSupport	1.6.0
com.apple.AppleGraphicsDeviceControl	3.16.21
com.apple.driver.AppleThunderboltEDMSink	4.1.2
com.apple.driver.AppleThunderboltDPOutAdapter	5.0.2
com.apple.driver.AppleSMBusController	1.0.18d1
com.apple.kext.AMDRadeonX4000HWServices	1.6.0
com.apple.iokit.IOGraphicsFamily	517.22
com.apple.filesystems.hfs.encodings.kext	1
com.apple.driver.AppleActuatorDriver	1204.13
com.apple.driver.AppleHIDKeyboard	203
com.apple.driver.AppleHSBluetoothDriver	127
com.apple.driver.IOBluetoothHIDDriver	6.0.2f2
com.apple.iokit.IOBluetoothFamily	6.0.2f2
com.apple.driver.AppleMultitouchDriver	1204.13
com.apple.driver.AppleInputDeviceSupport	1201.8
com.apple.driver.AppleHSSPIHIDDriver	52
com.apple.driver.AppleHSSPISupport	52
com.apple.driver.AppleIntelLpssSpiController	3.0.60
com.apple.iokit.IO80211Family	1200.12.2
com.apple.driver.mDNSOffloadUserClient	1.0.1b8
com.apple.driver.corecapture	1.0.4
com.apple.driver.AppleThunderboltDPInAdapter	5.0.2
com.apple.driver.AppleThunderboltDPAdapterFamily	5.0.2
com.apple.driver.AppleThunderboltPCIDownAdapter	2.1.3
com.apple.driver.AppleXsanScheme	3
com.apple.iokit.IONVMeFamily	2.1.0
com.apple.driver.AppleThunderboltNHI	4.5.6
com.apple.driver.AppleHPM	3.1.3
com.apple.iokit.IOThunderboltFamily	6.6.3
com.apple.driver.AppleIntelLpssI2CController	3.0.60
com.apple.driver.AppleIntelLpssDmac	3.0.60
com.apple.driver.AppleIntelLpssI2C	3.0.60
com.apple.driver.AppleIntelLpssGspi	3.0.60
com.apple.driver.usb.AppleUSBXHCIPCI	1.2
com.apple.driver.usb.AppleUSBXHCI	1.2
com.apple.driver.usb.AppleUSBHostPacketFilter	1.0
com.apple.iokit.IOUSBFamily	900.4.1
com.apple.driver.AppleEFINVRAM	2.1
com.apple.driver.AppleEFIRuntime	2.1
com.apple.iokit.IOHIDFamily	2.0.0
com.apple.iokit.IOSMBusFamily	1.1
com.apple.security.sandbox	300.0
com.apple.kext.AppleMatch	1.0.0d1
com.apple.iokit.IOBufferCopyEngineFamily	1
com.apple.driver.DiskImages	480.30.2
com.apple.driver.AppleFDEKeyStore	28.30
com.apple.driver.AppleEffaceableStorage	1.0
com.apple.driver.AppleKeyStore	2
com.apple.driver.AppleUSBTDM	439.30.4
com.apple.driver.AppleMobileFileIntegrity	1.0.5
com.apple.iokit.IOUSBMassStorageDriver	140.30.1
com.apple.iokit.IOSCSIBlockCommandsDevice	404.30.2
com.apple.iokit.IOSCSIArchitectureModelFamily	404.30.2
com.apple.iokit.IOStorageFamily	2.1
com.apple.driver.AppleCredentialManager	1.0
com.apple.driver.KernelRelayHost	1
com.apple.iokit.IOUSBHostFamily	1.2
com.apple.driver.usb.AppleUSBCommon	1.0
com.apple.driver.AppleBusPowerController	1.0
com.apple.driver.AppleSEPManager	1.0.1
com.apple.driver.IOSlaveProcessor	1
com.apple.iokit.IOReportFamily	31
com.apple.iokit.IOTimeSyncFamily	650.5
com.apple.iokit.IONetworkingFamily	3.4
com.apple.driver.AppleACPIPlatform	6.1
com.apple.driver.AppleSMCRTC	1.0
com.apple.driver.AppleSMC	3.1.9
com.apple.iokit.IOPCIFamily	2.9
com.apple.iokit.IOACPIFamily	1.4
com.apple.kec.pthread	1
com.apple.kec.Libm	1
com.apple.kec.corecrypto	1.0

EOF

@rgov
Copy link
Owner

rgov commented Feb 12, 2018

Are you loading with kextload or by copying into /System?

@windoze
Copy link
Author

windoze commented Feb 12, 2018

I'm loading with kextload, the command is sudo kextload /path/to/Thunderbolt3Unblocker.kext.

@rgov
Copy link
Owner

rgov commented Feb 12, 2018

Output of nvram boot-args?

@windoze
Copy link
Author

windoze commented Feb 12, 2018

$ sudo nvram boot-args
nvram: Error getting variable - 'boot-args': (iokit/common) data was not found

It's a new Mac I just got yesterday, nothing has been set specifically.

@rgov
Copy link
Owner

rgov commented Feb 12, 2018

Ah, that's good to know. Very interesting. Thanks for your help.

@windoze
Copy link
Author

windoze commented Feb 12, 2018

I wish I did help.
Thanks for the project, and hopefully Apple doesn't do any stupid things like this anymore.

Now I need to reboot my computer again, bye 😄

@rgov rgov mentioned this issue Feb 14, 2018
@kfiil
Copy link

kfiil commented Feb 14, 2018

Kernel_2018-02-14-083326_Kenneths-MacBook-Pro.panic.zip

Thunderbolt3Unblocker.kext.zip

MD5 (/System/Library/Kernels/kernel) = e56518f915ae8d978673d64d70e468aa

nvram: Error getting variable - 'boot-args': (iokit/common) data was not found

@ian-mcdowell
Copy link

ian-mcdowell commented Feb 14, 2018

Just wanted to drop by and say that I also got the same kernel panic when loading this kext. Happened immediately after kextload.

iMac Pro, macOS 10.13.3

@rgov
Copy link
Owner

rgov commented Feb 15, 2018

Thank you @kfiil, I can now reproduce this issue.

I have switched to the Zydis disassembler in the zydis branch, would anyone care to try it to see if the issue is resolved?

@rgov
Copy link
Owner

rgov commented Feb 15, 2018

I was able to confirm that

//#define __UD_STANDALONE__ 1
#include "udis86/udis86.h"

int main() {
    ud_t u;
    ud_init(&u);
    return 0;
}

causes stack corruption. Switching from Udis86 to Zydis hopefully addresses the issue. Please let me know.

@Producdevity
Copy link

I tried the Zydis branch but it doesn't build on my machine, MBP2017 10.13.3

here are a few of the last lines in the error log:

    export WRAP_ASSET_PACKS_IN_SEPARATE_DIRECTORIES=NO
    export XCODE_APP_SUPPORT_DIR=/Applications/Xcode.app/Contents/Developer/Library/Xcode
    export XCODE_PRODUCT_BUILD_VERSION=9C40b
    export XCODE_VERSION_ACTUAL=0920
    export XCODE_VERSION_MAJOR=0900
    export XCODE_VERSION_MINOR=0920
    export arch=x86_64
    export variant=normal
    /bin/sh -c /Users/yassine/Coding/testing/TB3/Thunderbolt3Unblocker/xnu_override/build_zydis.sh

Error: could not load cache
Command /bin/sh failed with exit code 1

@Producdevity
Copy link

image

Hopefully this is usefull

@rgov
Copy link
Owner

rgov commented Feb 15, 2018

Please brew install cmake ninja and try again. If it fails please attach the full output in a Gist.

@kfiil
Copy link

kfiil commented Feb 18, 2018

Hi,
Sorry for not getting back sooner.

I get this build error

~/Library/Developer/Xcode/DerivedData/Thunderbolt3Unblocker-ezxuoqykbtxvicerbhdyjuxspdxj/Build/Products/Debug/zydis ~/Sandbox/OpenSource/Thunderbolt3Unblocker/xnu_override/zydis
CMake Error: The source directory "/Users/kennethfiil/Sandbox/OpenSource/Thunderbolt3Unblocker/xnu_override/zydis" does not appear to contain CMakeLists.txt.
Specify --help for usage, or press the help button on the CMake GUI.

@rgov
Copy link
Owner

rgov commented Feb 19, 2018

Thanks @kfiil and @YassineGherbi. I made some improvements to building and merged back in 60e679a. Please check out master and try. I'm fairly sure it works.

@kfiil
Copy link

kfiil commented Feb 20, 2018

Perfect, it works now (Works on My Machine).

A suggestion, in the readme add default location of the Thunderbolt3Unblocker.kext file and how to build unsigned if peps do not have a developer account!

Thanks for the hard work!

@rgov
Copy link
Owner

rgov commented Feb 20, 2018

Good point on the README but I don’t have specific instructions at hand (since I do sign my kext). Feel free to send a PR!

Closing this one.

@rgov rgov closed this as completed Feb 20, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants