kernelcache.h File Reference

#include "mach0.h"
#include "../xnu/rz_cf_dict.h"

Go to the source code of this file.

Classes
struct	rz_xnu_kernelcache_file_range_t
struct	rz_xnu_kernelcache_rebase_info_t
struct	rz_xnu_kernelcache_parsed_pointer_t
struct	rz_xnu_kernelcache_obj_t

Macros
#define	RZ_BIN_MACH064   1

Typedefs
typedef struct rz_xnu_kernelcache_file_range_t	RzXNUKernelCacheFileRange
typedef struct rz_xnu_kernelcache_rebase_info_t	RzXNUKernelCacheRebaseInfo
typedef struct rz_xnu_kernelcache_parsed_pointer_t	RzXNUKernelCacheParsedPointer
typedef struct rz_xnu_kernelcache_obj_t	RzXNUKernelCacheObj

Functions
RZ_API bool	rz_xnu_kernelcache_buf_is_kernelcache (RzBuffer *b)
RZ_API RzBuffer *	rz_xnu_kernelcache_new_rebasing_buf (RzXNUKernelCacheObj *obj)
RZ_API bool	rz_xnu_kernelcache_needs_rebasing (RzXNUKernelCacheObj *obj)
RZ_API bool	rz_xnu_kernelcache_parse_pointer (RzXNUKernelCacheParsedPointer *ptr, ut64 decorated_addr, RzXNUKernelCacheObj *obj)

Macro Definition Documentation

RZ_BIN_MACH064

#define RZ_BIN_MACH064   1

Definition at line 8 of file kernelcache.h.

Typedef Documentation

RzXNUKernelCacheFileRange

typedef struct rz_xnu_kernelcache_file_range_t RzXNUKernelCacheFileRange

RzXNUKernelCacheObj

typedef struct rz_xnu_kernelcache_obj_t RzXNUKernelCacheObj

RzXNUKernelCacheParsedPointer

typedef struct rz_xnu_kernelcache_parsed_pointer_t RzXNUKernelCacheParsedPointer

RzXNUKernelCacheRebaseInfo

typedef struct rz_xnu_kernelcache_rebase_info_t RzXNUKernelCacheRebaseInfo

Function Documentation

rz_xnu_kernelcache_buf_is_kernelcache()

RZ_API bool rz_xnu_kernelcache_buf_is_kernelcache

(

RzBuffer *

b

)

Definition at line 13 of file kernelcache.c.

                                                               {
    ut64 length = rz_buf_size(b);
    if (length < sizeof(struct MACH0_(mach_header))) {
        return false;
    }
    ut32 cputype;
    if (!rz_buf_read_le32_at(b, 4, &cputype)) {
        return false;
    }
    if (cputype != CPU_TYPE_ARM64) {
        return false;
    }
    ut32 filetype;
    if (!rz_buf_read_le32_at(b, 12, &filetype)) {
        return false;
    }
    if (filetype == MH_FILESET) {
        return true;
    }
    ut32 flags;
    if (!rz_buf_read_le32_at(b, 24, &flags)) {
        return false;
    }
    if (!(flags & MH_PIE)) {
        return false;
    }
    ut32 ncmds;
    if (!rz_buf_read_le32_at(b, 16, &ncmds)) {
        return false;
    }
    bool has_unixthread = false;
    bool has_negative_vaddr = false;
    bool has_kext = false;
 
    ut32 cursor = sizeof(struct MACH0_(mach_header));
    for (size_t i = 0; i < ncmds && cursor < length; i++) {
 
        ut32 cmdtype;
        if (!rz_buf_read_le32_at(b, cursor, &cmdtype)) {
            return false;
        }
 
        ut32 cmdsize;
        if (!rz_buf_read_le32_at(b, cursor + 4, &cmdsize)) {
            return false;
        }
 
        switch (cmdtype) {
        case LC_KEXT:
            has_kext = true;
            break;
        case LC_UNIXTHREAD:
            has_unixthread = true;
            break;
        case LC_LOAD_DYLIB:
        case LC_LOAD_WEAK_DYLIB:
        case LC_LAZY_LOAD_DYLIB:
            return false;
        case LC_SEGMENT_64: {
            if (has_negative_vaddr) {
                break;
            }
            ut64 tmp;
            if (!rz_buf_read_le64_at(b, cursor + 24, &tmp)) {
                return false;
            }
 
            st64 vmaddr = convert_to_two_complement_64(tmp);
            if (vmaddr < 0) {
                has_negative_vaddr = true;
            }
        } break;
        }
 
        cursor += cmdsize;
    }
 
    return has_kext || (has_unixthread && has_negative_vaddr);
}

References b, CPU_TYPE_ARM64, flags, i, LC_KEXT, LC_LAZY_LOAD_DYLIB, LC_LOAD_DYLIB, LC_LOAD_WEAK_DYLIB, LC_SEGMENT_64, LC_UNIXTHREAD, length, MACH0_, MH_FILESET, MH_PIE, rz_buf_read_le32_at, rz_buf_read_le64_at, rz_buf_size(), st64, autogen_x86imm::tmp, and ut64().

Referenced by check_buffer().

rz_xnu_kernelcache_needs_rebasing()

RZ_API bool rz_xnu_kernelcache_needs_rebasing

(

RzXNUKernelCacheObj *

obj

)

Definition at line 317 of file kernelcache.c.

                                                                        {
    return obj->rebase_info || obj->mach0->chained_starts;
}

References rz_xnu_kernelcache_obj_t::rebase_info.

rz_xnu_kernelcache_new_rebasing_buf()

RZ_API RzBuffer* rz_xnu_kernelcache_new_rebasing_buf

(

RzXNUKernelCacheObj *

obj

)

Definition at line 313 of file kernelcache.c.

                                                                               {
    return rz_buf_new_with_methods(&buf_methods, obj);
}

References buf_methods, and rz_buf_new_with_methods().

rz_xnu_kernelcache_parse_pointer()

RZ_API bool rz_xnu_kernelcache_parse_pointer	(	RzXNUKernelCacheParsedPointer *	ptr,
		ut64	decorated_addr,
		RzXNUKernelCacheObj *	obj
	)

Definition at line 218 of file kernelcache.c.

                                                                                                                                {
    /*
     * Logic taken from:
     * https://github.com/Synacktiv/kernelcache-laundering/blob/master/ios12_kernel_cache_helper.py
     */
 
    if ((decorated_addr & 0x4000000000000000LL) == 0 && obj->rebase_info) {
        if (decorated_addr & 0x8000000000000000LL) {
            ptr->address = obj->rebase_info->kernel_base + (decorated_addr & 0xFFFFFFFFLL);
        } else {
            ptr->address = ((decorated_addr << 13) & 0xFF00000000000000LL) | (decorated_addr & 0x7ffffffffffLL);
            if (decorated_addr & 0x40000000000LL) {
                ptr->address |= 0xfffc0000000000LL;
            }
        }
    } else {
        ptr->address = decorated_addr;
    }
 
    return true;
}

References rz_xnu_kernelcache_parsed_pointer_t::address, rz_xnu_kernelcache_rebase_info_t::kernel_base, and rz_xnu_kernelcache_obj_t::rebase_info.

Referenced by on_rebase_pointer(), and p_ptr().