io_mach.c

Go to the documentation of this file.

// SPDX-FileCopyrightText: 2009-2017 pancake <pancake@nopcode.org>
// SPDX-License-Identifier: LGPL-3.0-only
 
#include <rz_userconf.h>
 
#include <rz_io.h>
#include <rz_lib.h>
#include <rz_cons.h>
 
#if __APPLE__ && DEBUGGER
 
static int __get_pid(RzIODesc *desc);
#define EXCEPTION_PORT 0
 
// NOTE: mach/mach_vm is not available for iOS
#include <mach/exception_types.h>
#include <mach/mach_host.h>
#include <mach/host_priv.h>
#include <mach/mach_init.h>
#include <mach/mach_port.h>
#include <mach/mach_traps.h>
#include <mach/processor_set.h>
#include <mach/mach_error.h>
#include <mach/task.h>
#include <mach/task_info.h>
#include <mach/thread_act.h>
#include <mach/thread_info.h>
#include <mach/vm_map.h>
#include <mach-o/loader.h>
#include <mach-o/nlist.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/wait.h>
#include <errno.h>
 
#define MACH_ERROR_STRING(ret) \
    (mach_error_string(ret) ? mach_error_string(ret) : "(unknown)")
 
#define RZ_MACH_MAGIC rz_str_djb2_hash("mach")
 
typedef struct {
    task_t task;
} RzIOMach;
/*
#define RzIOMACH_PID(x) (x ? ((RzIOMach*)(x))->pid : -1)
#define RzIOMACH_TASK(x) (x ? ((RzIOMach*)(x))->task : -1)
*/
 
int RzIOMACH_TASK(RzIODescData *x) {
    // TODO
    return -1;
}
 
#undef RZ_IO_NFDS
#define RZ_IO_NFDS 2
extern int errno;
 
static task_t task_for_pid_workaround(int pid) {
    host_t myhost = mach_host_self();
    mach_port_t psDefault = 0;
    mach_port_t psDefault_control = 0;
    task_array_t tasks = NULL;
    mach_msg_type_number_t numTasks = 0;
    kern_return_t kr = -1;
    int i;
 
    if (pid == -1) {
        return MACH_PORT_NULL;
    }
    kr = processor_set_default(myhost, &psDefault);
    if (kr != KERN_SUCCESS) {
        return MACH_PORT_NULL;
    }
    kr = host_processor_set_priv(myhost, psDefault, &psDefault_control);
    if (kr != KERN_SUCCESS) {
        //      eprintf ("host_processor_set_priv failed with error 0x%x\n", kr);
        // mach_error ("host_processor_set_priv",kr);
        return MACH_PORT_NULL;
    }
    numTasks = 0;
    kr = processor_set_tasks(psDefault_control, &tasks, &numTasks);
    if (kr != KERN_SUCCESS) {
        //      eprintf ("processor_set_tasks failed with error %x\n", kr);
        return MACH_PORT_NULL;
    }
    if (pid == 0) {
        /* kernel task */
        return tasks[0];
    }
    for (i = 0; i < numTasks; i++) {
        int pid2 = -1;
        pid_for_task(i, &pid2);
        if (pid == pid2) {
            return tasks[i];
        }
    }
    return MACH_PORT_NULL;
}
 
static task_t task_for_pid_ios9pangu(int pid) {
    task_t task = MACH_PORT_NULL;
    host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &task);
    return task;
}
 
static task_t pid_to_task(RzIODesc *fd, int pid) {
    task_t task = 0;
    static task_t old_task = 0;
    static int old_pid = -1;
    kern_return_t kr;
 
    RzIODescData *iodd = fd ? (RzIODescData *)fd->data : NULL;
    RzIOMach *riom = NULL;
    if (iodd) {
        riom = iodd->data;
        if (riom && riom->task) {
            old_task = riom->task;
            riom->task = 0;
            old_pid = iodd->pid;
        }
    }
    if (old_task != 0) {
        if (old_pid == pid) {
            return old_task;
        }
        // we changed the process pid so deallocate a ref from the old_task
        // since we are going to get a new task
        kr = mach_port_deallocate(mach_task_self(), old_task);
        if (kr != KERN_SUCCESS) {
            eprintf("pid_to_task: fail to deallocate port\n");
            return 0;
        }
    }
    int err = task_for_pid(mach_task_self(), (pid_t)pid, &task);
    if ((err != KERN_SUCCESS) || !MACH_PORT_VALID(task)) {
        task = task_for_pid_workaround(pid);
        if (task == MACH_PORT_NULL) {
            task = task_for_pid_ios9pangu(pid);
            if (task != MACH_PORT_NULL) {
                // eprintf ("Failed to get task %d for pid %d.\n", (int)task, (int)pid);
                // eprintf ("Missing priviledges? 0x%x: %s\n", err, MACH_ERROR_STRING (err));
                return -1;
            }
        }
    }
    old_task = task;
    old_pid = pid;
    return task;
}
 
static bool task_is_dead(RzIODesc *fd, int pid) {
    unsigned int count = 0;
    kern_return_t kr = mach_port_get_refs(mach_task_self(),
        pid_to_task(fd, pid), MACH_PORT_RIGHT_SEND, &count);
    return (kr != KERN_SUCCESS || !count);
}
 
static ut64 the_lower = UT64_MAX;
 
static ut64 getNextValid(RzIO *io, RzIODesc *fd, ut64 addr) {
    struct vm_region_submap_info_64 info;
    vm_address_t address = MACH_VM_MIN_ADDRESS;
    vm_size_t size = (vm_size_t)0;
    vm_size_t osize = (vm_size_t)0;
    natural_t depth = 0;
    kern_return_t kr;
    int tid = __get_pid(fd);
    task_t task = pid_to_task(fd, tid);
    ut64 lower = addr;
#if __arm64__ || __aarch64__
    size = osize = 16384; // acording to frida
#else
    size = osize = 4096;
#endif
    if (the_lower != UT64_MAX) {
        return RZ_MAX(addr, the_lower);
    }
 
    for (;;) {
        mach_msg_type_number_t info_count;
        info_count = VM_REGION_SUBMAP_INFO_COUNT_64;
        memset(&info, 0, sizeof(info));
        kr = vm_region_recurse_64(task, &address, &size,
            &depth, (vm_region_recurse_info_t)&info, &info_count);
        if (kr != KERN_SUCCESS) {
            break;
        }
        if (lower == addr) {
            lower = address;
        }
        if (info.is_submap) {
            depth++;
            continue;
        }
        if (addr >= address && addr < address + size) {
            return addr;
        }
        if (address < lower) {
            lower = address;
        }
        if (size < 1) {
            size = osize;
        }
        address += size;
        size = 0;
    }
    the_lower = lower;
    return lower;
}
 
static int __read(RzIO *io, RzIODesc *desc, ut8 *buf, int len) {
    vm_size_t size = 0;
    int blen, err, copied = 0;
    int blocksize = 32;
    RzIODescData *dd = (RzIODescData *)desc->data;
    if (!io || !desc || !buf || !dd) {
        return -1;
    }
    if (dd->magic != rz_str_djb2_hash("mach")) {
        return -1;
    }
    memset(buf, 0xff, len);
    int pid = __get_pid(desc);
    task_t task = pid_to_task(desc, pid);
    if (task_is_dead(desc, pid)) {
        return -1;
    }
    if (pid == 0) {
        if (io->off < 4096) {
            return len;
        }
    }
    copied = getNextValid(io, desc, io->off) - io->off;
    if (copied < 0) {
        copied = 0;
    }
    while (copied < len) {
        blen = RZ_MIN((len - copied), blocksize);
        // blen = len;
        err = vm_read_overwrite(task,
            (ut64)io->off + copied, blen,
            (pointer_t)buf + copied, &size);
        switch (err) {
        case KERN_PROTECTION_FAILURE:
            // eprintf ("rz_io_mach_read: kern protection failure.\n");
            break;
        case KERN_INVALID_ADDRESS:
            if (blocksize == 1) {
                memset(buf + copied, 0xff, len - copied);
                return size + copied;
            }
            blocksize = 1;
            blen = 1;
            buf[copied] = 0xff;
            break;
        }
        if (err == -1 || size < 1) {
            return -1;
        }
        if (size == 0) {
            if (blocksize == 1) {
                memset(buf + copied, 0xff, len - copied);
                return len;
            }
            blocksize = 1;
            blen = 1;
            buf[copied] = 0xff;
        }
        copied += blen;
    }
    return len;
}
 
static int tsk_getperm(RzIO *io, task_t task, vm_address_t addr) {
    kern_return_t kr;
    mach_port_t object;
    vm_size_t vmsize;
    mach_msg_type_number_t info_count = VM_REGION_BASIC_INFO_COUNT_64;
    vm_region_flavor_t flavor = VM_REGION_BASIC_INFO_64;
    vm_region_basic_info_data_64_t info;
    kr = vm_region_64(task, &addr, &vmsize, flavor, (vm_region_info_t)&info, &info_count, &object);
    return (kr != KERN_SUCCESS ? 0 : info.protection);
}
 
static int tsk_pagesize(RzIODesc *desc) {
    int tid = __get_pid(desc);
    task_t task = pid_to_task(desc, tid);
    static vm_size_t pagesize = 0;
    return pagesize
        ? pagesize
        : (host_page_size(task, &pagesize) == KERN_SUCCESS)
        ? pagesize
        : 4096;
}
 
static vm_address_t tsk_getpagebase(RzIODesc *desc, ut64 addr) {
    vm_address_t pagesize = tsk_pagesize(desc);
    return (addr & ~(pagesize - 1));
}
 
static bool tsk_setperm(RzIO *io, task_t task, vm_address_t addr, int len, int perm) {
    kern_return_t kr;
    kr = vm_protect(task, addr, len, 0, perm);
    if (kr != KERN_SUCCESS) {
        perror("tsk_setperm");
        return false;
    }
    return true;
}
 
static bool tsk_write(task_t task, vm_address_t addr, const ut8 *buf, int len) {
    kern_return_t kr = vm_write(task, addr, (vm_offset_t)buf, (mach_msg_type_number_t)len);
    if (kr != KERN_SUCCESS) {
        return false;
    }
    return true;
}
 
static int mach_write_at(RzIO *io, RzIODesc *desc, const void *buf, int len, ut64 addr) {
    vm_address_t vaddr = addr;
    vm_address_t pageaddr;
    vm_size_t pagesize;
    vm_size_t total_size;
    int operms = 0;
    int pid = __get_pid(desc);
    if (!desc || pid < 0) {
        return 0;
    }
    task_t task = pid_to_task(desc, pid);
 
    if (len < 1 || task_is_dead(desc, task)) {
        return 0;
    }
    pageaddr = tsk_getpagebase(desc, addr);
    pagesize = tsk_pagesize(desc);
    total_size = (len > pagesize)
        ? pagesize * (1 + (len / pagesize))
        : pagesize;
    if (tsk_write(task, vaddr, buf, len)) {
        return len;
    }
    operms = tsk_getperm(io, task, pageaddr);
    if (!tsk_setperm(io, task, pageaddr, total_size, VM_PROT_READ | VM_PROT_WRITE | VM_PROT_COPY)) {
        eprintf("io.mach: Cannot set page perms for %d byte(s) at 0x%08" PFMT64x "\n", (int)pagesize, (ut64)pageaddr);
        return -1;
    }
    if (!tsk_write(task, vaddr, buf, len)) {
        eprintf("io.mach: Cannot write on memory\n");
        len = -1;
    }
    if (operms) {
        if (!tsk_setperm(io, task, pageaddr, total_size, operms)) {
            eprintf("io.mach: Cannot restore page perms\n");
            return -1;
        }
    }
    return len;
}
 
static int __write(RzIO *io, RzIODesc *fd, const ut8 *buf, int len) {
    return mach_write_at(io, fd, buf, len, io->off);
}
 
static bool __plugin_open(RzIO *io, const char *file, bool many) {
    return (!strncmp(file, "attach://", 9) || !strncmp(file, "mach://", 7));
}
 
static RzIODesc *__open(RzIO *io, const char *file, int rw, int mode) {
    RzIODesc *ret = NULL;
    RzIOMach *riom = NULL;
    const char *pidfile;
    char *pidpath, *endptr;
    int pid;
    task_t task;
    if (!__plugin_open(io, file, false) && !__plugin_open(io, (const char *)&file[1], false)) {
        return NULL;
    }
    pidfile = file + (file[0] == 'a' ? 9 : (file[0] == 's' ? 8 : 7));
    pid = (int)strtol(pidfile, &endptr, 10);
    if (endptr == pidfile || pid < 0) {
        return NULL;
    }
    task = pid_to_task(NULL, pid);
    if (task == -1) {
        return NULL;
    }
    if (!task) {
        if (pid > 0 && !strncmp(file, "smach://", 8)) {
            kill(pid, SIGKILL);
            eprintf("Child killed\n");
        }
        switch (errno) {
        case EPERM:
            eprintf("Operation not permitted\n");
            break;
        case EINVAL:
            perror("ptrace: Cannot attach");
            eprintf("\n\nPlease ensure your rizin binary is signed and it has the right entitlements to make debugger work. ");
            eprintf("Be aware that binaries signed by Apple cannot be debugged due to the Apple System Integrity Protection (SIP).\n");
            eprintf("\nFor more info look at: https://book.rizin.re/debugger/apple.html#sign-rizin-binary\n\n");
            eprintf("ERRNO: %d (EINVAL)\n", errno);
            break;
        default:
            eprintf("unknown error in debug_attach\n");
            break;
        }
        return NULL;
    }
    RzIODescData *iodd = RZ_NEW0(RzIODescData);
    if (iodd) {
        iodd->pid = pid;
        iodd->tid = pid;
        iodd->data = NULL;
    }
    riom = RZ_NEW0(RzIOMach);
    if (!riom) {
        RZ_FREE(iodd);
        return NULL;
    }
    riom->task = task;
    iodd->magic = rz_str_djb2_hash("mach");
    iodd->data = riom;
    // sleep 1s to get proper path (program name instead of ls) (racy)
    pidpath = pid
        ? rz_sys_pid_to_path(pid)
        : strdup("kernel");
    if (!strncmp(file, "smach://", 8)) {
        ret = rz_io_desc_new(io, &rz_io_plugin_mach, &file[1],
            rw | RZ_PERM_X, mode, iodd);
    } else {
        ret = rz_io_desc_new(io, &rz_io_plugin_mach, file,
            rw | RZ_PERM_X, mode, iodd);
    }
    ret->name = pidpath;
    return ret;
}
 
static ut64 __lseek(RzIO *io, RzIODesc *fd, ut64 offset, int whence) {
    switch (whence) {
    case RZ_IO_SEEK_SET:
        io->off = offset;
        break;
    case RZ_IO_SEEK_CUR:
        io->off += offset;
        break;
    case RZ_IO_SEEK_END:
        io->off = ST64_MAX;
    }
    return io->off;
}
 
static int __close(RzIODesc *fd) {
    if (!fd) {
        return false;
    }
    RzIODescData *iodd = fd->data;
    kern_return_t kr;
    if (!iodd) {
        return false;
    }
    if (iodd->magic != RZ_MACH_MAGIC) {
        return false;
    }
    task_t task = pid_to_task(fd, iodd->pid);
    kr = mach_port_deallocate(mach_task_self(), task);
    if (kr != KERN_SUCCESS) {
        perror("__close io_mach");
    }
    RZ_FREE(fd->data);
    return kr == KERN_SUCCESS;
}
 
static char *__system(RzIO *io, RzIODesc *fd, const char *cmd) {
    if (!io || !fd || !cmd || !fd->data) {
        return NULL;
    }
    RzIODescData *iodd = fd->data;
    if (iodd->magic != RZ_MACH_MAGIC) {
        return NULL;
    }
 
    task_t task = pid_to_task(fd, iodd->tid);
    /* XXX ugly hack for testing purposes */
    if (!strcmp(cmd, "")) {
        return NULL;
    }
    if (!strncmp(cmd, "perm", 4)) {
        int perm = rz_str_rwx(cmd + 4);
        if (perm) {
            int pagesize = tsk_pagesize(fd);
            tsk_setperm(io, task, io->off, pagesize, perm);
        } else {
            eprintf("Usage: R!perm [rwx]\n");
        }
        return NULL;
    }
    if (!strncmp(cmd, "pid", 3)) {
        RzIODescData *iodd = fd->data;
        RzIOMach *riom = iodd->data;
        const char *pidstr = cmd + 3;
        int pid = -1;
        if (*pidstr) {
            pid = __get_pid(fd);
            // return NULL;
        } else {
            eprintf("%d\n", iodd->pid);
            return NULL;
        }
        if (!strcmp(pidstr, "0")) {
            pid = 0;
        } else {
            pid = atoi(pidstr);
            if (!pid) {
                pid = -1;
            }
        }
        if (pid != -1) {
            task_t task = pid_to_task(fd, pid);
            if (task != -1) {
                riom->task = task;
                iodd->pid = pid;
                iodd->tid = pid;
                return NULL;
            }
        }
        eprintf("io_mach_system: Invalid pid %d\n", pid);
    } else {
        eprintf("Try: 'R!pid' or 'R!perm'\n");
    }
    return NULL;
}
 
static int __get_pid(RzIODesc *desc) {
    // dupe for ? rz_io_desc_get_pid (desc);
    if (!desc || !desc->data) {
        return -1;
    }
    RzIODescData *iodd = desc->data;
    if (iodd) {
        if (iodd->magic != RZ_MACH_MAGIC) {
            return -1;
        }
        return iodd->pid;
    }
    return -1;
}
 
// TODO: rename ptrace to io_mach .. err io.ptrace ??
RzIOPlugin rz_io_plugin_mach = {
    .name = "mach",
    .desc = "Attach to mach debugger instance",
    .license = "LGPL",
    .uris = "attach://,mach://,smach://",
    .open = __open,
    .close = __close,
    .read = __read,
    .getpid = __get_pid,
    .gettid = __get_pid,
    .check = __plugin_open,
    .lseek = __lseek,
    .system = __system,
    .write = __write,
    .isdbg = true
};
 
#else
RzIOPlugin rz_io_plugin_mach = {
    .name = "mach",
    .desc = "mach debug io (unsupported in this platform)",
    .license = "LGPL"
};
#endif
 
#ifndef RZ_PLUGIN_INCORE
RZ_API RzLibStruct rizin_plugin = {
    .type = RZ_LIB_TYPE_IO,
    .data = &rz_io_plugin_mach,
    .version = RZ_VERSION
};
#endif