Skip to content

Commit 9512807

Browse files
committed
add lldb scripts to fix boot delay and bypass the secure root check
1 parent 3247770 commit 9512807

File tree

3 files changed

+28
-0
lines changed

3 files changed

+28
-0
lines changed

fixbootdelay_lldbscript_doc.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
At boot, XNU waits 30 seconds for an RTC device, using IOService::resourceMatching("IORTC") and waitForService.
2+
3+
We patch the two calls to waitForService - the first in IOKitInitializeTime and the second in AppleARMPE::getGMTTimeOfDay to wait for 1 second instead.
4+
5+
XNU also waits to check if the root device is secure in IOSecureBSDRoot with a call to pe->callPlatformFunction. This call hangs,
6+
so the last breakpoint breaks just before the call, skips it, and pretend it returned true.
7+
8+
The included offsets are for the iPhone X iOS 12 beta 4 kernelcache.

lldbit.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/sh
2+
# from xnu's README.md
3+
exec lldb lz_comp2/kcache_out.bin -o "process connect --plugin gdb-remote connect://127.0.0.1:1234" -s lldbscript.lldb

lldbscript.lldb

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
b *0xFFFFFFF007433BE8
2+
breakpoint command add
3+
print $x1=1000000000
4+
c
5+
DONE
6+
b *0xFFFFFFF005FA5D84
7+
breakpoint command add
8+
print ((uint32_t*)0xFFFFFFF0058083A8)[0] = 1
9+
c
10+
DONE
11+
b *0xfffffff00743e434
12+
breakpoint command add
13+
print $pc=0xfffffff00743e438
14+
print $x0=1
15+
c
16+
DONE
17+
b *0xfffffff00743e834

0 commit comments

Comments
 (0)