fix find kernel container

Signed-off-by: Sergey Isakov <isakov-sl@bk.ru>
This commit is contained in:
Sergey Isakov 2020-07-18 21:06:10 +03:00
parent 5e911e4b1d
commit 762eac695c
2 changed files with 25 additions and 21 deletions

View File

@ -18,7 +18,7 @@
//#include "sse3_5_patcher.h"
#ifndef DEBUG_ALL
#define KERNEL_DEBUG 1
#define KERNEL_DEBUG 0
#else
#define KERNEL_DEBUG DEBUG_ALL
#endif
@ -92,7 +92,7 @@ EFI_STATUS LOADER_ENTRY::getVTable()
while (KernelData[NTabble] || KernelData[NTabble-1]) --NTabble;
NTabble &= ~0x03; //align, may be 0x07?
// NTabble -=4;
DBG_RT(" NTabble=%x\n", NTabble);
DBG(" NTabble=%x\n", NTabble);
// DBG("LinkAdr=%x NTabble=%x Tabble=%x\n",LinkAdr, NTabble, Tabble);
// SEGMENT *LinkSeg = (SEGMENT*)&KernelData[LinkAdr];
// AddrVtable = LinkSeg->AddrVtable;
@ -140,7 +140,7 @@ UINTN LOADER_ENTRY::searchProcInDriver(UINT8 * driver, UINT32 driverLen, const c
// DBG_RT("%s not found\n", procedure);
return 0;
}
// DBG_RT("found section 0x%x at pos=%d\n", vArray[i].Seg, i);
DBG("found section 0x%x at pos=%d\n", vArray[i].Seg, i);
INTN lSegVAddr;
switch (vArray[i].Seg) {
case ID_SEG_DATA:
@ -190,7 +190,7 @@ UINTN LOADER_ENTRY::searchProcInDriver(UINT8 * driver, UINT32 driverLen, const c
return procAddr;
}
//static int N = 0;
static int N = 0;
//search a procedure by Name and return its offset in the kernel
UINTN LOADER_ENTRY::searchProc(const char *procedure)
{
@ -207,11 +207,11 @@ UINTN LOADER_ENTRY::searchProc(const char *procedure)
for (i=0; i<SizeVtable; ++i) {
size_t Offset = vArray[i].NameOffset;
if (Offset == 0) break;
// if (N < 10) {
// DBG("Offset %lx Seg=%x\n", Offset, vArray[i].Seg);
// DBG("Name to compare %s\n", &Names[Offset]);
// N++;
// }
if (N < 10) {
DBG("Offset %lx Seg=%x\n", Offset, vArray[i].Seg);
DBG("Name to compare %s\n", &Names[Offset]);
N++;
}
// DBG_RT("Offset %lx Seg=%x\n", Offset, vArray[i].Seg);
// DBG_RT("Name to compare %s\n", &Names[Offset]);
// Stall(3000000);
@ -2075,6 +2075,7 @@ VOID LOADER_ENTRY::Get_PreLink()
AddrVtable = symCmd->symoff;
SizeVtable = symCmd->nsyms;
NamesTable = symCmd->stroff;
DBG("SymTab: AddrVtable=0x%x SizeVtable=0x%x NamesTable=0x%x\n", AddrVtable, SizeVtable, NamesTable);
break;
default:
@ -2297,6 +2298,7 @@ VOID
LOADER_ENTRY::KernelAndKextPatcherInit()
{
if (PatcherInited) {
DBG("patcher inited\n");
return;
}
@ -2305,7 +2307,7 @@ LOADER_ENTRY::KernelAndKextPatcherInit()
// KernelRelocBase will normally be 0
// but if OsxAptioFixDrv is used, then it will be > 0
SetKernelRelocBase();
DBG_RT("KernelRelocBase = %llx\n", KernelRelocBase);
DBG("KernelRelocBase = %llx\n", KernelRelocBase);
// Find bootArgs - we need then for proper detection
// of kernel Mach-O header
@ -2322,7 +2324,7 @@ LOADER_ENTRY::KernelAndKextPatcherInit()
// for AptioFix booting - it's always at KernelRelocBase + 0x00200000
// UINT64 os_version = AsciiOSVersionToUint64(OSVersion);
DBG_RT("os_version=%s\n", OSVersion);
DBG("os_version=%s\n", OSVersion);
// if (os_version < AsciiOSVersionToUint64("10.6")) {
// KernelData = (UINT8*)(UINTN)(KernelSlide + KernelRelocBase + 0x00111000);
// } else {
@ -2334,19 +2336,19 @@ LOADER_ENTRY::KernelAndKextPatcherInit()
DBG_RT("Found 32 bit kernel at 0x%llx\n", (UINTN)KernelData);
is64BitKernel = FALSE;
} else if (MACH_GET_MAGIC(KernelData) == MH_MAGIC_64 || MACH_GET_MAGIC(KernelData) == MH_CIGAM_64) {
DBG_RT( "Found 64 bit kernel at 0x%llx\n", (UINTN)KernelData);
DBG( "Found 64 bit kernel at 0x%llx\n", (UINTN)KernelData);
// DBG_RT("text section is: %s\n", (const char*)&KernelData[0x28]);
KernelOffset = 0;
while (KernelOffset < KERNEL_MAX_SIZE) {
KernelOffset += 4;
if ((KernelData[KernelOffset + 0x0C] == MH_EXECUTE) && (MACH_GET_MAGIC(KernelData) == MH_MAGIC_64 )) {
break;
}
KernelOffset += 4;
}
is64BitKernel = TRUE;
} else {
// not valid Mach-O header - exiting
DBG_RT( "Kernel not found at 0x%llx - skipping patches!\n", (UINTN)KernelData);
DBG( "Kernel not found at 0x%llx - skipping patches!\n", (UINTN)KernelData);
KernelData = NULL;
return;
}
@ -2399,6 +2401,7 @@ LOADER_ENTRY::KernelAndKextsPatcherStart()
DBG_RT("Kernels patches: %d\n", KernelAndKextPatches->NrKernels);
if (gSettings.KernelPatchesAllowed && (KernelAndKextPatches->KernelPatches != NULL) && KernelAndKextPatches->NrKernels) {
DBG_RT("Enabled: \n");
DBG("Kernels patches: enabled \n");
KernelAndKextPatcherInit();
if (KernelData == NULL) goto NoKernelData;
if (EFI_ERROR(getVTable())) {
@ -2447,6 +2450,7 @@ LOADER_ENTRY::KernelAndKextsPatcherStart()
DBG_RT( "\nKernelPm patch: ");
if (KernelAndKextPatches->KPKernelPm || KernelAndKextPatches->KPKernelXCPM) {
DBG_RT( "Enabled: \n");
DBG( "KernelPm patch: Enabled\n");
KernelAndKextPatcherInit();
if (KernelData == NULL) goto NoKernelData;
patchedOk = FALSE;

View File

@ -3,7 +3,7 @@
#include "DataHubCpu.h"
#ifndef DEBUG_ALL
#define KEXT_INJECT_DEBUG 2
#define KEXT_INJECT_DEBUG 0
#else
#define KEXT_INJECT_DEBUG DEBUG_ALL
#endif
@ -1096,8 +1096,8 @@ VOID EFIAPI LOADER_ENTRY::KernelBooterExtensionsPatch()
UINTN taskLocation = searchProc("IOTaskHasEntitlement");
procLocation = searchProc("loadExecutable");
patchLocation2 = FindMemMask(&KernelData[procLocation], 0x500, find3, sizeof(find3), mask3, sizeof(mask3));
DBG_RT("IOTaskHasEntitlement at 0x%llx, loadExecutable at 0x%llx\n", taskLocation, procLocation);
DBG_RT("find3 at 0x%llx\n", patchLocation2);
DBG("IOTaskHasEntitlement at 0x%llx, loadExecutable at 0x%llx\n", taskLocation, procLocation);
DBG("find3 at 0x%llx\n", patchLocation2);
if (patchLocation2 != KERNEL_MAX_SIZE) {
DBG_RT("=> patch SIP applied\n");
patchLocation2 += procLocation;
@ -1109,7 +1109,7 @@ VOID EFIAPI LOADER_ENTRY::KernelBooterExtensionsPatch()
}
} else {
patchLocation2 = FindRelative32(KernelData, procLocation, 0x700, taskLocation);
DBG_RT("else search relative at 0x%llx\n", patchLocation2);
DBG("else search relative at 0x%llx\n", patchLocation2);
if (patchLocation2 != 0) {
DBG_RT("=> patch2 SIP applied\n");
KernelData[patchLocation2] = 0xEB;
@ -1119,7 +1119,7 @@ VOID EFIAPI LOADER_ENTRY::KernelBooterExtensionsPatch()
const UINT8 find7[] = {0xE8, 0x00, 0x00, 0x00, 0x00, 0x85, 0xC0, 0x0F, 0x84, 0xFF, 0x00, 0x00, 0x00, 0x49, 0x8B, 0x45 };
const UINT8 mask7[] = {0xFF, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
patchLocation2 = FindMemMask(&KernelData[0], KERNEL_MAX_SIZE, find7, sizeof(find7), mask7, sizeof(mask7));
DBG_RT("found call to TE at 0x%llx\n", patchLocation2);
DBG("found call to TE at 0x%llx\n", patchLocation2);
KernelData[0 + patchLocation2 + 7] = 0xEB;
KernelData[0 + patchLocation2 + 8] = 0x04;
@ -1210,13 +1210,13 @@ VOID EFIAPI LOADER_ENTRY::KernelBooterExtensionsPatch()
const UINT8 find6[] = {0xFF, 0x80, 0x3D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0F, 0x85, 0x00, 0x01, 0x00, 0x00, 0x41 };
const UINT8 mask6[] = {0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0xFF, 0xFF, 0xFF, 0xFF };
patchLocation3 = FindMemMask(&KernelData[0], KERNEL_MAX_SIZE, find6, sizeof(find6), mask6, sizeof(mask6));
DBG_RT("find mask 6 at 0x%llx\n", patchLocation3);
DBG("find mask 6 at 0x%llx\n", patchLocation3);
if (patchLocation3 != KERNEL_MAX_SIZE) {
KernelData[0 + patchLocation3 + 8] = 0x90;
KernelData[0 + patchLocation3 + 9] = 0xE9;
}
} else {
DBG_RT("==> patched KxldUnmap (10.14 - recent macOS)\n");
DBG("==> patched KxldUnmap (10.14 - recent macOS)\n");
// 00 0F 85 XX XX 00 00 48
// 00 90 E9 XX XX 00 00 48
KernelData[procLocation + patchLocation3 + 1] = 0x90;